diff --git a/.github/stale.yml b/.github/stale.yml
new file mode 100644
index 00000000000..bf47ba3c25b
--- /dev/null
+++ b/.github/stale.yml
@@ -0,0 +1,32 @@
+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 180
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: false
+# Issues with these labels will never be considered stale
+exemptLabels:
+  - 1.severity: security
+# Label to use when marking an issue as stale
+staleLabel: 2.status: stale
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+  Thank you for your contributions.
+
+  This has been automatically marked as stale because it has had no
+  activity for 180 days.
+
+  If this is still important to you, we ask that you leave a
+  comment below. Your comment can be as simple as "still important
+  to me". This lets people see that at least one person still cares
+  about this. Someone will have to do this at most twice a year if
+  there is no other activity.
+
+  Here are suggestions that might help resolve this more quickly:
+
+  1. Search for maintainers and people that previously touched the
+     related code and @ mention them in a comment.
+  2. Ask on the [NixOS Discourse](https://discourse.nixos.org/).
+  3. Ask on the [#nixos channel](irc://irc.freenode.net/#nixos) on
+     [irc.freenode.net](https://freenode.net).
+
+# Comment to post when closing a stale issue. Set to `false` to disable
+closeComment: false
diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix
index 0da50ccc344..5d65f8e3413 100644
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@@ -128,12 +128,6 @@ in {
       }
     ];
 
-    environment.etc."yggdrasil.conf" = {
-      enable = true;
-      mode = "symlink";
-      source = "/run/yggdrasil/yggdrasil.conf";
-    };
-
     systemd.services.yggdrasil = {
       description = "Yggdrasil Network Service";
       path = [ cfg.package ] ++ optional (configProvided && configFileProvided) pkgs.jq;
@@ -146,7 +140,7 @@ in {
       '';
 
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/yggdrasil -useconffile /etc/yggdrasil.conf";
+        ExecStart = "${cfg.package}/bin/yggdrasil -useconffile /run/yggdrasil/yggdrasil.conf";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         Restart = "always";
 
diff --git a/nixos/tests/yggdrasil.nix b/nixos/tests/yggdrasil.nix
index ddff35cce3a..0ef42a0180c 100644
--- a/nixos/tests/yggdrasil.nix
+++ b/nixos/tests/yggdrasil.nix
@@ -81,7 +81,7 @@ in import ./make-test.nix ({ pkgs, ...} : {
           denyDhcpcdInterfaces = [ "ygg0" ];
           config = {
             IfTAPMode = true;
-            IFName = "ygg0";
+            IfName = "ygg0";
             MulticastInterfaces = [ "eth1" ];
             LinkLocalTCPPort = 43210;
           };
diff --git a/pkgs/applications/audio/ensemble-chorus/default.nix b/pkgs/applications/audio/ensemble-chorus/default.nix
new file mode 100644
index 00000000000..5940203d04d
--- /dev/null
+++ b/pkgs/applications/audio/ensemble-chorus/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, fltk, alsaLib, freetype, libXrandr, libXinerama, libXcursor, lv2, libjack2, cmake, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  pname = "ensemble-chorus";
+  version = "unstable-15-02-2019";
+
+  src = fetchFromGitHub {
+    owner = "jpcima";
+    repo = pname;
+    rev = "59baeb86b8851f521bc8162e22e3f15061662cc3";
+    sha256 = "0c1y10vyhrihcjvxqpqf6b52yk5yhwh813cfp6nla5ax2w88dbhr";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = [
+    fltk alsaLib freetype libXrandr libXinerama libXcursor lv2 libjack2
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/jpcima/ensemble-chorus;
+    description = "Digital model of electronic string ensemble chorus";
+    maintainers = [ maintainers.magnetophon ];
+    platforms = platforms.linux;
+    license = licenses.boost;
+  };
+}
diff --git a/pkgs/applications/audio/gxmatcheq-lv2/default.nix b/pkgs/applications/audio/gxmatcheq-lv2/default.nix
new file mode 100644
index 00000000000..1d5579d74c0
--- /dev/null
+++ b/pkgs/applications/audio/gxmatcheq-lv2/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, xorg, xorgproto, cairo, lv2, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  pname = "GxMatchEQ.lv2";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "brummer10";
+    repo = pname;
+    rev = "V${version}";
+    sha256 = "0azdmgzqwjn26nx38iw13666a1i4y2bv39wk89pf6ihdi46klf72";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [
+    xorg.libX11 xorgproto cairo lv2
+  ];
+
+  # error: format not a string literal and no format arguments [-Werror=format-security]
+  hardeningDisable = [ "format" ];
+
+  installFlags = [ "INSTALL_DIR=$(out)/lib/lv2" ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/brummer10/GxMatchEQ.lv2;
+    description = "Matching Equalizer to apply EQ curve from one source to another source";
+    maintainers = [ maintainers.magnetophon ];
+    license = licenses.gpl3;
+  };
+}
diff --git a/pkgs/applications/audio/ncmpc/default.nix b/pkgs/applications/audio/ncmpc/default.nix
index db788dcc9eb..58eb5462ef8 100644
--- a/pkgs/applications/audio/ncmpc/default.nix
+++ b/pkgs/applications/audio/ncmpc/default.nix
@@ -1,5 +1,12 @@
 { stdenv, fetchFromGitHub, meson, ninja, pkgconfig, glib, ncurses
-, mpd_clientlib, gettext, boost }:
+, mpd_clientlib, gettext, boost
+, pcreSupport ? false
+, pcre ? null
+}:
+
+with stdenv.lib;
+
+assert pcreSupport -> pcre != null;
 
 stdenv.mkDerivation rec {
   pname = "ncmpc";
@@ -12,14 +19,14 @@ stdenv.mkDerivation rec {
     sha256 = "1ssmk1p43gjhcqi86sh6b7csqpwwpf3hs32cmnylv6pmbcwbs69h";
   };
 
-  buildInputs = [ glib ncurses mpd_clientlib boost ];
+  buildInputs = [ glib ncurses mpd_clientlib boost ]
+    ++ optional pcreSupport pcre;
   nativeBuildInputs = [ meson ninja pkgconfig gettext ];
 
   mesonFlags = [
     "-Dlirc=disabled"
-    "-Dregex=disabled"
     "-Ddocumentation=disabled"
-  ];
+  ] ++ optional (!pcreSupport) "-Dregex=disabled";
 
   meta = with stdenv.lib; {
     description = "Curses-based interface for MPD (music player daemon)";
diff --git a/pkgs/applications/audio/spotify-tui/default.nix b/pkgs/applications/audio/spotify-tui/default.nix
index a73a46a7cb0..606abc86ae2 100644
--- a/pkgs/applications/audio/spotify-tui/default.nix
+++ b/pkgs/applications/audio/spotify-tui/default.nix
@@ -2,19 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-tui";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "Rigellute";
     repo = "spotify-tui";
     rev = "v${version}";
-    sha256 = "0pgmcld48sd34jpsc4lr8dbqs8iwk0xp9aa3b15m61mv3lf04qc6";
+    sha256 = "1bbh9df4gfgb5pqavgvmy8fqnr2j5rbqbanv0y31j4i0kv2wrh6a";
   };
 
   cargoSha256 = "1rb4dl9zn3xx2yrapx5cfsli93ggmdq8w9fqi8cy8giyja1mnqfl";
 
-  cargoPatches = [ ./fix-cargo-lock-version.patch ];
-
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ openssl ]
     ++ stdenv.lib.optional stdenv.isDarwin Security;
diff --git a/pkgs/applications/audio/spotify-tui/fix-cargo-lock-version.patch b/pkgs/applications/audio/spotify-tui/fix-cargo-lock-version.patch
deleted file mode 100644
index d38c6890033..00000000000
--- a/pkgs/applications/audio/spotify-tui/fix-cargo-lock-version.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git i/Cargo.lock w/Cargo.lock
-index e1eae72..e004898 100644
---- i/Cargo.lock
-+++ w/Cargo.lock
-@@ -1310,7 +1310,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- 
- [[package]]
- name = "spotify-tui"
--version = "0.7.5"
-+version = "0.8.0"
- dependencies = [
-  "backtrace 0.3.40 (registry+https://github.com/rust-lang/crates.io-index)",
-  "clap 2.33.0 (registry+https://github.com/rust-lang/crates.io-index)",
diff --git a/pkgs/applications/audio/stone-phaser/default.nix b/pkgs/applications/audio/stone-phaser/default.nix
new file mode 100644
index 00000000000..6e64ebc7fb3
--- /dev/null
+++ b/pkgs/applications/audio/stone-phaser/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitHub, xorg, cairo, lv2, libjack2, mesa, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  pname = "stone-phaser";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "jpcima";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "180b32z8h9zi8p0q55r1dzxfckamnngm52zjypjjvvy7qdj3mfcd";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [
+    xorg.libX11 cairo lv2 libjack2 mesa
+  ];
+
+  postPatch = ''
+    patch -d dpf -p 1 -i "$src/resources/patch/DPF-bypass.patch"
+    patchShebangs ./dpf/utils/generate-ttl.sh
+  '';
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/jpcima/stone-phaser;
+    description = "A classic analog phaser effect, made with DPF and Faust";
+    maintainers = [ maintainers.magnetophon ];
+    platforms = platforms.linux;
+    license = licenses.boost;
+  };
+}
diff --git a/pkgs/applications/editors/mle/default.nix b/pkgs/applications/editors/mle/default.nix
index f91d1d8fde6..e98759edd15 100644
--- a/pkgs/applications/editors/mle/default.nix
+++ b/pkgs/applications/editors/mle/default.nix
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace Makefile --replace "-llua5.3" "-llua";
     substituteInPlace mle.h    --replace "<lua5.3/" "<";
+    patchShebangs tests/*
   '';
 
   buildInputs = [ termbox pcre uthash lua5_3 ];
diff --git a/pkgs/applications/editors/retext/default.nix b/pkgs/applications/editors/retext/default.nix
index d1028ec6ce8..31b75c71820 100644
--- a/pkgs/applications/editors/retext/default.nix
+++ b/pkgs/applications/editors/retext/default.nix
@@ -9,7 +9,7 @@ let
   python = let
     packageOverrides = self: super: {
       markdown = super.markdown.overridePythonAttrs(old: {
-        src =  super.fetchPypi {
+        src = super.fetchPypi {
           version = "3.0.1";
           pname = "Markdown";
           sha256 = "d02e0f9b04c500cde6637c11ad7c72671f359b87b9fe924b2383649d8841db7c";
@@ -17,11 +17,12 @@ let
       });
 
       chardet = super.chardet.overridePythonAttrs(old: {
-        src =  super.fetchPypi {
+        src = super.fetchPypi {
           version = "2.3.0";
           pname = "chardet";
           sha256 = "e53e38b3a4afe6d1132de62b7400a4ac363452dc5dfcf8d88e8e0cce663c68aa";
         };
+        patches = [];
       });
     };
     in python3.override { inherit packageOverrides; };
diff --git a/pkgs/applications/editors/texstudio/default.nix b/pkgs/applications/editors/texstudio/default.nix
index f986d79ec50..13b7f4db0c5 100644
--- a/pkgs/applications/editors/texstudio/default.nix
+++ b/pkgs/applications/editors/texstudio/default.nix
@@ -1,5 +1,5 @@
 { lib, mkDerivation, fetchFromGitHub, qmake, qtbase, qtscript, qtsvg,
-  poppler, zlib, pkgconfig }:
+  wrapQtAppsHook, poppler, zlib, pkgconfig }:
 
 mkDerivation rec {
   pname = "texstudio";
@@ -12,7 +12,7 @@ mkDerivation rec {
     sha256 = "0ck65fvz6mzfpqdb1ndgyvgxdnslrwhdr1swgck4gaghcrgbg3gq";
   };
 
-  nativeBuildInputs = [ qmake pkgconfig ];
+  nativeBuildInputs = [ qmake wrapQtAppsHook pkgconfig ];
   buildInputs = [ qtbase qtscript qtsvg poppler zlib ];
 
   qmakeFlags = [ "NO_APPDATA=True" ];
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 2a484565956..9cfccc7425b 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -13,8 +13,8 @@ let
     else throw "ImageMagick is not supported on this platform.";
 
   cfg = {
-    version = "6.9.10-69";
-    sha256 = "0l4lllis16gbwjpvvsyfz91i9nq11zb3lg2zlmyay7v5697jshh6";
+    version = "6.9.10-71";
+    sha256 = "0c69xmr8k8c4dplgzxydm30s2dr8biq71x07hc15bw196nsx3srr";
     patches = [];
   }
     # Freeze version on mingw so we don't need to port the patch too often.
diff --git a/pkgs/applications/graphics/fbida/default.nix b/pkgs/applications/graphics/fbida/default.nix
index f5560a9b203..3e64783df31 100644
--- a/pkgs/applications/graphics/fbida/default.nix
+++ b/pkgs/applications/graphics/fbida/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "Image viewing and manipulation programs";
+    description = "Image viewing and manipulation programs including fbi, fbgs, ida, exiftran and thumbnail.cgi";
     homepage = https://www.kraxel.org/blog/linux/fbida/;
     license = licenses.gpl2;
     maintainers = with maintainers; [ pSub ];
diff --git a/pkgs/applications/graphics/rawtherapee/default.nix b/pkgs/applications/graphics/rawtherapee/default.nix
index 74e8c0e6b43..bda16446524 100644
--- a/pkgs/applications/graphics/rawtherapee/default.nix
+++ b/pkgs/applications/graphics/rawtherapee/default.nix
@@ -1,24 +1,24 @@
 { stdenv, fetchFromGitHub, pkgconfig, cmake, pixman, libpthreadstubs, gtkmm3, libXau
 , libXdmcp, lcms2, libiptcdata, libcanberra-gtk3, fftw, expat, pcre, libsigcxx, wrapGAppsHook
-, lensfun
+, lensfun, librsvg
 }:
 
 stdenv.mkDerivation rec {
-  version = "5.5";
-  name = "rawtherapee-" + version;
+  version = "5.7";
+  pname = "rawtherapee";
 
   src = fetchFromGitHub {
     owner = "Beep6581";
     repo = "RawTherapee";
     rev = version;
-    sha256 = "13clnx7rwkfa7wxgsim1xdx2pd7gwmmdad1m8a3fvywr20ml8xzk";
+    sha256 = "0j3887a3683fqpvp66kaw6x81ai3gf5nvrbmb4cc8rb0lgj2xv2g";
   };
 
   nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook ];
 
   buildInputs = [
     pixman libpthreadstubs gtkmm3 libXau libXdmcp
-    lcms2 libiptcdata libcanberra-gtk3 fftw expat pcre libsigcxx lensfun
+    lcms2 libiptcdata libcanberra-gtk3 fftw expat pcre libsigcxx lensfun librsvg
   ];
 
   cmakeFlags = [
diff --git a/pkgs/applications/graphics/sane/backends/default.nix b/pkgs/applications/graphics/sane/backends/default.nix
index 20d5629b83a..4245acf716d 100644
--- a/pkgs/applications/graphics/sane/backends/default.nix
+++ b/pkgs/applications/graphics/sane/backends/default.nix
@@ -5,7 +5,7 @@ callPackage ./generic.nix (args // rec {
   src = fetchurl {
     sha256 = "1j9nbqspaj0rlgalafb5z6r606k0i22kz0rcpd744p176yzlfdr9";
     urls = [
-      "https://alioth.debian.org/frs/download.php/latestfile/176/sane-backends-${version}.tar.gz"
+      "https://alioth-archive.debian.org/releases/sane/sane-backends/${version}/sane-backends-${version}.tar.gz"
     ];
   };
 })
diff --git a/pkgs/applications/graphics/sane/backends/git.nix b/pkgs/applications/graphics/sane/backends/git.nix
index e746f83e5d4..2edd739068d 100644
--- a/pkgs/applications/graphics/sane/backends/git.nix
+++ b/pkgs/applications/graphics/sane/backends/git.nix
@@ -5,6 +5,6 @@ callPackage ./generic.nix (args // {
   src = fetchgit {
     sha256 = "0qf7d7268kdxnb723c03m6icxhbgx0vw8gqvck2q1w5b948dy9g8";
     rev = "e895ee55bec8a3320a0e972b32c05d35b47fe226";
-    url = "git://alioth.debian.org/git/sane/sane-backends.git";
+    url = "https://gitlab.com/sane-project/backends.git";
   };
 })
diff --git a/pkgs/applications/graphics/sane/frontends.nix b/pkgs/applications/graphics/sane/frontends.nix
index 66473c4a155..b00f8f6c58d 100644
--- a/pkgs/applications/graphics/sane/frontends.nix
+++ b/pkgs/applications/graphics/sane/frontends.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "1.0.14";
 
   src = fetchurl {
-    url = "https://alioth.debian.org/frs/download.php/latestfile/175/${pname}-${version}.tar.gz";
+    url = "https://alioth-archive.debian.org/releases/sane/${pname}/${version}/${pname}-${version}.tar.gz";
     sha256 = "1ad4zr7rcxpda8yzvfkq1rfjgx9nl6lan5a628wvpdbh3fn9v0z7";
   };
 
diff --git a/pkgs/applications/misc/electrum/dash.nix b/pkgs/applications/misc/electrum/dash.nix
index 8ba562de1cb..fc5192bb5e4 100644
--- a/pkgs/applications/misc/electrum/dash.nix
+++ b/pkgs/applications/misc/electrum/dash.nix
@@ -42,5 +42,6 @@ python2Packages.buildPythonApplication rec {
     homepage = https://github.com/dashpay/electrum-dash;
     license = licenses.gpl3;
     maintainers = with maintainers; [ np ];
+    knownVulnerabilities = [ "CVE-2018-1000022" ];
   };
 }
diff --git a/pkgs/applications/misc/qdirstat/default.nix b/pkgs/applications/misc/qdirstat/default.nix
index 1f35643dd76..21d4b003179 100644
--- a/pkgs/applications/misc/qdirstat/default.nix
+++ b/pkgs/applications/misc/qdirstat/default.nix
@@ -19,7 +19,7 @@ in mkDerivation rec {
 
   buildInputs = [ perlPackages.perl ];
 
-  preBuild = ''
+  postPatch = ''
     substituteInPlace scripts/scripts.pro \
       --replace /bin/true ${coreutils}/bin/true
 
@@ -37,9 +37,8 @@ in mkDerivation rec {
     substituteInPlace src/StdCleanup.cpp \
       --replace /bin/bash ${bash}/bin/bash
   '';
-  postPatch = ''
-    export qmakeFlags="$qmakeFlags INSTALL_PREFIX=$out"
-  '';
+
+  qmakeFlags = [ "INSTALL_PREFIX=${placeholder "out"}" ];
 
   postInstall = ''
     wrapProgram $out/bin/qdirstat-cache-writer \
diff --git a/pkgs/applications/misc/xmrig/default.nix b/pkgs/applications/misc/xmrig/default.nix
index 8bd45e2f613..265c4c173fc 100644
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "3.2.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    sha256 = "1qb20v3wvd6scx0dnlcqvj947ng4h0lxlvl9kpz0a2a3l5425rjf";
+    sha256 = "17bgz1rpix1zgzzn4zz84jp7hl6b2k968h918y3av5asxn0mji49";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index 05711856743..3abdef62eef 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -45,11 +45,11 @@ let
 
   flash = stdenv.mkDerivation rec {
     pname = "flashplayer-ppapi";
-    version = "32.0.0.270";
+    version = "32.0.0.293";
 
     src = fetchzip {
       url = "https://fpdownload.adobe.com/pub/flashplayer/pdc/${version}/flash_player_ppapi_linux.x86_64.tar.gz";
-      sha256 = "1z8nfw7b3dsy79gb50bmmdjz66j5gx6m0hkw1abp35xdgh2sz2ak";
+      sha256 = "0rgriqdbyrzpm1bcph35bhzd5dz21yim56z93hkmbpdqg7767dwm";
       stripRoot = false;
     };
 
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
index 29954e4129e..585b7426eb6 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/default.nix
@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "flashplayer";
-  version = "32.0.0.270";
+  version = "32.0.0.293";
 
   src = fetchurl {
     url =
@@ -85,14 +85,14 @@ stdenv.mkDerivation rec {
     sha256 =
       if debug then
         if arch == "x86_64" then
-          "1c3dn4gkl40i5sjkvpbkn9fl82vjhy1v7dhrayk3ncfsxcyvbcm0"
+          "0lz1na68gdi9n23hfj5c731dbskm9684cwar7ji8yjfhfryfg5yn"
         else
-          "1g7i9mihn5g9i71xyf805k19yk41vsr85gzk87gm426m0hcgg89i"
+          "10gm2ynndlyk66fndfbh7ah5ssqpyw8415i10n3lpw940x201dk0"
       else
         if arch == "x86_64" then
-          "16lxgkbr2hg49vhc7414zkh1kblhysf779854faay308ml3i5kdw"
+          "0hmlv0v9lbgxrmz0n7czfnrbrwjwxhy99gsr5g1m0aqgw0y61clc"
         else
-          "0jrdzm8pw7aq32w7m4rvkhj7mmqyddh5yxpj7q3d9hxrwshkikvj";
+          "0qdw4f48xhnkzdly3jz63v14nmzd0gg49az5wxb08ghs8laaqlik";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
index 27ec18aa6c8..0f7ded95f40 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer/standalone.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation {
   pname = "flashplayer-standalone";
-  version = "32.0.0.270";
+  version = "32.0.0.293";
 
   src = fetchurl {
     url =
@@ -60,9 +60,9 @@ stdenv.mkDerivation {
         "https://fpdownload.macromedia.com/pub/flashplayer/updaters/32/flash_player_sa_linux.x86_64.tar.gz";
     sha256 =
       if debug then
-        "0k5azrl92hkbn7adjz7s2lv8h59n7gsjrcprqdc485i4f7sjmkwj"
+        "13mrknvl3yd8vrcs7mp6szz6f9ssfs72apzvc60f9qfwkhiwlg87"
       else
-        "1la5s4wxchfpl8in576xj675yrg84pify22pwf063h0jg3rdgi68";
+        "0isvmzyi4isxvxxc5ksplcqc5cafpvbrln3dddpms8zps2dxpyzi";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/applications/networking/cluster/kubeseal/default.nix b/pkgs/applications/networking/cluster/kubeseal/default.nix
new file mode 100644
index 00000000000..e232670c31f
--- /dev/null
+++ b/pkgs/applications/networking/cluster/kubeseal/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubeseal";
+  version = "0.9.5";
+
+  src = fetchFromGitHub {
+    owner = "bitnami-labs";
+    repo = "sealed-secrets";
+    rev = "v${version}";
+    sha256 = "0k59n40rmxjdn0xi8gr08zlxk0irfc7crra9x8qdljvivqshma3z";
+  };
+
+  modSha256 = "04dmjyz3vi2l0dfpyy42lkp2fv1vlfkvblrxh1dvb37phrkd5lbd";
+
+  subPackages = [ "cmd/kubeseal" ];
+
+  meta = with lib; {
+    description = "A Kubernetes controller and tool for one-way encrypted Secrets";
+    homepage = "https://github.com/bitnami-labs/sealed-secrets";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ groodt ];
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/slack/default.nix b/pkgs/applications/networking/instant-messengers/slack/default.nix
index d3aa302d601..a16023f307d 100644
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@@ -1,16 +1,17 @@
 { theme ? null, stdenv, fetchurl, dpkg, makeWrapper , alsaLib, atk, cairo,
 cups, curl, dbus, expat, fontconfig, freetype, glib , gnome2, gtk3, gdk-pixbuf,
 libappindicator-gtk3, libnotify, libxcb, nspr, nss, pango , systemd, xorg,
-at-spi2-atk, libuuid, nodePackages
+at-spi2-atk, at-spi2-core, libuuid, nodePackages, libpulseaudio
 }:
 
 let
 
-  version = "4.0.2";
+  version = "4.1.2";
 
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
     at-spi2-atk
+    at-spi2-core
     atk
     cairo
     cups
@@ -32,6 +33,7 @@ let
     stdenv.cc.cc
     systemd
     libuuid
+    libpulseaudio
 
     xorg.libxkbfile
     xorg.libX11
@@ -51,7 +53,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://downloads.slack-edge.com/linux_releases/slack-desktop-${version}-amd64.deb";
-        sha256 = "053j5py16ilpwy868rhh5l2g93xj1fq4fwxrsi2bkfsnmq261hkm";
+        sha256 = "0a1b2k81hm1lfrdb47gmd07jqb7hva9sxsiph7b3iwzpzw8pjrkh";
       }
     else
       throw "Slack is not supported on ${stdenv.hostPlatform.system}";
@@ -63,18 +65,22 @@ in stdenv.mkDerivation {
   inherit src;
 
   buildInputs = [
-    dpkg
     gtk3  # needed for GSETTINGS_SCHEMAS_PATH
   ];
 
-  nativeBuildInputs = [ makeWrapper nodePackages.asar ];
+  nativeBuildInputs = [ dpkg makeWrapper nodePackages.asar ];
 
   dontUnpack = true;
-  buildCommand = ''
+  dontBuild = true;
+  dontPatchELF = true;
+
+  installPhase = ''
+    # The deb file contains a setuid binary, so 'dpkg -x' doesn't work here
+    dpkg --fsys-tarfile $src | tar --extract
+    rm -rf usr/share/lintian
+
     mkdir -p $out
-    dpkg -x $src $out
-    cp -av $out/usr/* $out
-    rm -rf $out/etc $out/usr $out/share/lintian
+    mv usr/* $out
 
     # Otherwise it looks "suspicious"
     chmod -R g-w $out
diff --git a/pkgs/applications/networking/irc/weechat/scripts/default.nix b/pkgs/applications/networking/irc/weechat/scripts/default.nix
index 81ee484f3b3..0880a32af92 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/default.nix
@@ -1,10 +1,12 @@
-{ callPackage, luaPackages }:
+{ callPackage, luaPackages, python3Packages }:
 
 {
   weechat-matrix-bridge = callPackage ./weechat-matrix-bridge {
     inherit (luaPackages) cjson luaffi;
   };
 
+  weechat-matrix = python3Packages.callPackage ./weechat-matrix { };
+
   wee-slack = callPackage ./wee-slack { };
 
   weechat-autosort = callPackage ./weechat-autosort { };
diff --git a/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix/default.nix b/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix/default.nix
new file mode 100644
index 00000000000..ff6a7d94741
--- /dev/null
+++ b/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix/default.nix
@@ -0,0 +1,58 @@
+{ buildPythonPackage, stdenv, python, fetchFromGitHub,
+  pyopenssl, webcolors, future, atomicwrites,
+  attrs, Logbook, pygments, cachetools, matrix-nio }:
+
+let
+  matrixUploadPython = python.withPackages (ps: with ps; [
+    magic
+  ]);
+in buildPythonPackage {
+  pname = "weechat-matrix";
+  version = "unstable-2019-11-10";
+
+  src = fetchFromGitHub {
+    owner = "poljar";
+    repo = "weechat-matrix";
+    rev = "69ad2a9c03d516c212d3d0700dbb2bfe654f6365";
+    sha256 = "1mfbkag5np2lgv6f31nyfnvavyh67jrrx6gxhzb8m99dd43lgs8c";
+  };
+
+  propagatedBuildInputs = [
+    pyopenssl
+    webcolors
+    future
+    atomicwrites
+    attrs
+    Logbook
+    pygments
+    cachetools
+    matrix-nio
+  ];
+
+  passthru.scripts = [ "matrix.py" ];
+
+  dontBuild = true;
+  doCheck = false;
+
+  installPhase = ''
+    mkdir -p $out/share $out/bin
+    cp $src/main.py $out/share/matrix.py
+
+    cp $src/contrib/matrix_upload $out/bin/
+    substituteInPlace $out/bin/matrix_upload \
+      --replace '/usr/bin/env -S python3 -u' '${matrixUploadPython}/bin/python -u' 
+  
+    mkdir -p $out/${python.sitePackages}
+    cp -r $src/matrix $out/${python.sitePackages}/matrix
+  '';
+
+  dontPatchShebangs = true;
+
+  meta = with stdenv.lib; {
+    description = "A Python plugin for Weechat that lets Weechat communicate over the Matrix protocol";
+    homepage = "https://github.com/poljar/weechat-matrix";
+    license = licenses.isc;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.tilpner ];
+  };
+}
diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index 7475692b962..ca5c59379cc 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "rclone";
-  version = "1.49.5";
+  version = "1.50.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0firfb2300grfp5fnqaifhp346m4d0x8r1xshs9d8r6jxb160n03";
+    sha256 = "0iwm0a9h6xxdsqw86xlqcsz7h4pzsg134m6yfqj5s2xg7kfy5laq";
   };
 
   goPackagePath = "github.com/rclone/rclone";
diff --git a/pkgs/applications/science/machine-learning/streamlit/default.nix b/pkgs/applications/science/machine-learning/streamlit/default.nix
index f3d142739b8..c7bdf0f12a4 100644
--- a/pkgs/applications/science/machine-learning/streamlit/default.nix
+++ b/pkgs/applications/science/machine-learning/streamlit/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonApplication rec {
   pname = "streamlit";
-  version = "0.49.0";
+  version = "0.50.2";
   format = "wheel"; # the only distribution available
 
   src = fetchPypi {
     inherit pname version format;
-    sha256 = "1g12z93yh85vcgf3g9banshllr5fhz8i4f9llymcnk6mafvcsiv7";
+    sha256 = "1wymv7qckafs0p2jdjlxjaf1xrhm3iyd185jkldanbb0na5n3ndz";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/libraries/gaia/default.nix b/pkgs/development/libraries/gaia/default.nix
index 9411f76908e..c8c0b8c6800 100644
--- a/pkgs/development/libraries/gaia/default.nix
+++ b/pkgs/development/libraries/gaia/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/MTG/gaia";
     description = "General library to work with points in a semimetric space";
     maintainers = with maintainers; [ doronbehar ];
-    platforms = platforms.all;
+    platforms = platforms.x86; # upstream assume SSE2 / fails on ARM
     license = licenses.agpl3;
   };
 }
diff --git a/pkgs/development/libraries/libexif/default.nix b/pkgs/development/libraries/libexif/default.nix
index 5a8f5126680..833ccf5dca5 100644
--- a/pkgs/development/libraries/libexif/default.nix
+++ b/pkgs/development/libraries/libexif/default.nix
@@ -9,21 +9,32 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-   (fetchpatch {
-     name = "CVE-2017-7544.patch";
-     url = https://sourceforge.net/p/libexif/bugs/_discuss/thread/fc394c4b/489a/attachment/xx.pat;
-     sha256 = "1qgk8hgnxr8d63jsc4vljxz9yg33mbml280dq4a6050rmk9wq4la";
-   })
+    (fetchpatch {
+      name = "CVE-2017-7544.patch";
+      url = "https://github.com/libexif/libexif/commit/c39acd1692023b26290778a02a9232c873f9d71a.patch";
+      sha256 = "0xgx6ly2i4q05shb61mfx6njwf1yp347jkznm0ka4m85i41xm6sd";
+    })
+    (fetchpatch {
+      name = "CVE-2018-20030-1.patch";
+      url = "https://github.com/libexif/libexif/commit/5d28011c40ec86cf52cffad541093d37c263898a.patch";
+      sha256 = "1wv8s962wmbn2m2xypgirf12g6msrbplpsmd5bh86irfwhkcppj3";
+    })
+    (fetchpatch {
+      name = "CVE-2018-20030-2.patch";
+      url = "https://github.com/libexif/libexif/commit/6aa11df549114ebda520dde4cdaea2f9357b2c89.patch";
+      sha256 = "01aqvz63glwq6wg0wr7ykqqghb4abgq77ghvhizbzadg1k4h7drx";
+      excludes = [ "NEWS" ];
+    })
   ];
-  patchFlags = "-p0";
 
   buildInputs = [ gettext ];
 
   meta = {
-    homepage = http://libexif.sourceforge.net/;
+    homepage = https://libexif.github.io/;
     description = "A library to read and manipulate EXIF data in digital photographs";
     license = stdenv.lib.licenses.lgpl21;
     platforms = stdenv.lib.platforms.unix;
+    maintainers = [ stdenv.lib.maintainers.erictapen ];
   };
 
 }
diff --git a/pkgs/development/libraries/olm/default.nix b/pkgs/development/libraries/olm/default.nix
index dd3f83a0130..224c01e2c50 100644
--- a/pkgs/development/libraries/olm/default.nix
+++ b/pkgs/development/libraries/olm/default.nix
@@ -2,18 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "olm";
-  version = "3.0.0";
-
-  meta = {
-    description = "Implements double cryptographic ratchet and Megolm ratchet";
-    license = stdenv.lib.licenses.asl20;
-    homepage = https://matrix.org/git/olm/about;
-    platforms = with stdenv.lib.platforms; darwin ++ linux;
-  };
+  version = "3.1.4";
 
   src = fetchurl {
-    url = "https://matrix.org/git/olm/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "1iivxjk458v9lhqgzp0c4k5azligsh9k3rk6irf9ssj29wzgjm2c";
+    url = "https://matrix.org/git/olm/-/archive/${version}/${pname}-${version}.tar.gz";
+    sha256 = "0f7azjxc77n4ib9nj3cwyk3vhk8r2dsyf7id6nvqyxqxwxn95a8w";
   };
 
   doCheck = true;
@@ -25,4 +18,11 @@ stdenv.mkDerivation rec {
   makeFlags = if stdenv.cc.isClang then [ "CC=cc" ] else null;
 
   installFlags = "PREFIX=$(out)";
+
+  meta = {
+    description = "Implements double cryptographic ratchet and Megolm ratchet";
+    license = stdenv.lib.licenses.asl20;
+    homepage = https://matrix.org/git/olm/about;
+    platforms = with stdenv.lib.platforms; darwin ++ linux;
+  };
 }
diff --git a/pkgs/development/libraries/physics/apfel/default.nix b/pkgs/development/libraries/physics/apfel/default.nix
index 5302ad21258..4ebfd6fbfa3 100644
--- a/pkgs/development/libraries/physics/apfel/default.nix
+++ b/pkgs/development/libraries/physics/apfel/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, gfortran, lhapdf, python2 }:
+{ stdenv, fetchFromGitHub, gfortran, lhapdf, python2, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "apfel";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "13n5ygbqvskg3qq5n4sff1nbii0li0zf1vqissai7x0hynxgy7p6";
   };
 
-  buildInputs = [ gfortran lhapdf python2 ];
+  buildInputs = [ gfortran lhapdf python2 zlib ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/physics/qcdnum/default.nix b/pkgs/development/libraries/physics/qcdnum/default.nix
index ad5f994620f..8b002ce8195 100644
--- a/pkgs/development/libraries/physics/qcdnum/default.nix
+++ b/pkgs/development/libraries/physics/qcdnum/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gfortran }:
+{ stdenv, fetchurl, gfortran, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "QCDNUM";
@@ -10,6 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ gfortran ];
+  buildInputs = [ zlib ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/mobile/androidenv/deploy-androidpackage.nix b/pkgs/development/mobile/androidenv/deploy-androidpackage.nix
index 97fd197cb7d..839a14f7033 100644
--- a/pkgs/development/mobile/androidenv/deploy-androidpackage.nix
+++ b/pkgs/development/mobile/androidenv/deploy-androidpackage.nix
@@ -8,6 +8,7 @@ stdenv.mkDerivation ({
   name = package.name + "-" + package.revision;
   src = if os != null && builtins.hasAttr os package.archives then package.archives.${os} else package.archives.all;
   buildInputs = [ unzip ] ++ buildInputs;
+  preferLocalBuild = true;
 
   # Most Android Zip packages have a root folder, but some don't. We unpack
   # the zip file in a folder and we try to discover whether it has a single root
diff --git a/pkgs/development/python-modules/matrix-nio/default.nix b/pkgs/development/python-modules/matrix-nio/default.nix
new file mode 100644
index 00000000000..8658130d9f6
--- /dev/null
+++ b/pkgs/development/python-modules/matrix-nio/default.nix
@@ -0,0 +1,49 @@
+{ lib, buildPythonPackage, fetchFromGitHub, git,
+  attrs, future, peewee, h11, h2, atomicwrites, pycryptodome, sphinx, Logbook, jsonschema,
+  python-olm, unpaddedbase64, aiohttp }:
+
+buildPythonPackage rec {
+  pname = "nio";
+  version = "0.6";
+
+  src = fetchFromGitHub {
+    owner = "poljar";
+    repo = "matrix-nio";
+    rev = version;
+    sha256 = "0pq5i6ks3pck2kq9m4p3pw9hbvkzs27xkyv68mjnfc6chp2g2mg9";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'python-olm>=3.1.0' ""
+  '';
+
+  nativeBuildInputs = [
+    git
+  ];
+
+  propagatedBuildInputs = [
+    attrs
+    future
+    peewee
+    h11
+    h2
+    atomicwrites
+    pycryptodome
+    sphinx
+    Logbook
+    jsonschema
+    python-olm
+    unpaddedbase64
+    aiohttp
+  ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A Python Matrix client library, designed according to sans I/O principles";
+    homepage = "https://github.com/poljar/matrix-nio";
+    license = licenses.isc;
+    maintainers = [ maintainers.tilpner ];
+  };
+}
diff --git a/pkgs/development/python-modules/poetry/default.nix b/pkgs/development/python-modules/poetry/default.nix
index d31fe236f82..8f1136c4654 100644
--- a/pkgs/development/python-modules/poetry/default.nix
+++ b/pkgs/development/python-modules/poetry/default.nix
@@ -7,6 +7,7 @@
 , pyrsistent
 , pyparsing
 , cachecontrol
+, lockfile
 , pkginfo
 , html5lib
 , shellingham
@@ -59,6 +60,7 @@ in buildPythonPackage rec {
     pyrsistent
     pyparsing
     cachecontrol
+    lockfile
     pkginfo
     html5lib
     shellingham
diff --git a/pkgs/development/python-modules/pynvim/default.nix b/pkgs/development/python-modules/pynvim/default.nix
index e5e14f44e10..a4765434f74 100644
--- a/pkgs/development/python-modules/pynvim/default.nix
+++ b/pkgs/development/python-modules/pynvim/default.nix
@@ -7,22 +7,21 @@
 , trollius
 , pythonOlder
 , isPyPy
+, pytestrunner
 }:
 
 buildPythonPackage rec {
   pname = "pynvim";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "01dybk4vs452pljn1q3il5z2sd313ki0lgiglc0xmjc6wp290r6g";
+    sha256 = "1mp9ajsgrb9k2f3s8g7vdflj5mg02ii0d0wk4n6dmvjx52rqpzbi";
   };
 
-  checkInputs = [ nose ];
-
-  checkPhase = ''
-    nosetests
-  '';
+  nativeBuildInputs = [
+    pytestrunner
+  ];
 
   # Tests require pkgs.neovim,
   # which we cannot add because of circular dependency.
diff --git a/pkgs/development/python-modules/python-olm/default.nix b/pkgs/development/python-modules/python-olm/default.nix
new file mode 100644
index 00000000000..4fc0ad66f95
--- /dev/null
+++ b/pkgs/development/python-modules/python-olm/default.nix
@@ -0,0 +1,29 @@
+{ lib, buildPythonPackage, olm,
+  cffi, future, typing }:
+
+buildPythonPackage {
+  pname = "python-olm";
+  inherit (olm) src version;
+
+  sourceRoot = "${olm.name}/python";
+  buildInputs = [ olm ];
+
+  preBuild = ''
+    make include/olm/olm.h
+  '';
+
+  propagatedBuildInputs = [
+    cffi
+    future
+    typing
+  ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Python bindings for Olm";
+    homepage = "https://gitlab.matrix.org/matrix-org/olm/tree/master/python";
+    license = olm.meta.license;
+    maintainers = [ maintainers.tilpner ];
+  };
+}
diff --git a/pkgs/development/tools/misc/chrpath/default.nix b/pkgs/development/tools/misc/chrpath/default.nix
index 956a8df69ce..3cae6aa2ae6 100644
--- a/pkgs/development/tools/misc/chrpath/default.nix
+++ b/pkgs/development/tools/misc/chrpath/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   name = "chrpath-0.16";
 
   src = fetchurl {
-    url = "https://alioth.debian.org/frs/download.php/file/3979/chrpath-0.16.tar.gz";
+    url = "https://alioth-archive.debian.org/releases/chrpath/chrpath/0.16/chrpath-0.16.tar.gz";
     sha256 = "0yvfq891mcdkf8g18gjjkn2m5rvs8z4z4cl1vwdhx6f2p9a4q3dv";
   };
 
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
       binary. The rpath, or runpath if it is present, is where the runtime
       linker should look for the libraries needed for a program.
     '';
-    homepage = https://alioth.debian.org/projects/chrpath/;
+    homepage = https://tracker.debian.org/pkg/chrpath;
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];
diff --git a/pkgs/development/tools/rucksack/default.nix b/pkgs/development/tools/rucksack/default.nix
index 85a4d0fa23d..9eb568040ff 100644
--- a/pkgs/development/tools/rucksack/default.nix
+++ b/pkgs/development/tools/rucksack/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Texture packer and resource bundler";
-    platforms = platforms.unix;
+    platforms = [ "i686-linux" "x86_64-linux" ]; # fails on Darwin and AArch64
     homepage = https://github.com/andrewrk/rucksack;
     license = licenses.mit;
     maintainers = [ maintainers.andrewrk ];
diff --git a/pkgs/development/tools/rust/cargo-bloat/default.nix b/pkgs/development/tools/rust/cargo-bloat/default.nix
index 0c1af58221b..32e369251d5 100644
--- a/pkgs/development/tools/rust/cargo-bloat/default.nix
+++ b/pkgs/development/tools/rust/cargo-bloat/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-bloat";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "RazrFalcon";
     repo = pname;
     rev = "v${version}";
-    sha256 = "03pzp5d9kzbx62jpjzgww0x3qv9f08blvl8f4yg5hrlyaaa06xsd";
+    sha256 = "0wzsc8azxgvavsbsdpd1i6g8i4sp07wn9iayr8dp8072ig5c4fhy";
   };
 
   cargoSha256 = "1jc1lx0yk8galkyc4a67d39ywsfrgc2sjjsz08p47gpz7228d64w";
diff --git a/pkgs/games/steam/chrootenv.nix b/pkgs/games/steam/chrootenv.nix
index 0de961e6d49..3be1f522974 100644
--- a/pkgs/games/steam/chrootenv.nix
+++ b/pkgs/games/steam/chrootenv.nix
@@ -75,7 +75,7 @@ in buildFHSUserEnv rec {
     xorg.libX11
     xorg.libXfixes
     libGL
-    libva
+    pkgsi686Linux.libva
 
     # Not formally in runtime but needed by some games
     at-spi2-atk
diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 9bcc6c008b8..9abd1b5e718 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -61,12 +61,12 @@ let
 
   ale = buildVimPluginFrom2Nix {
     pname = "ale";
-    version = "2019-11-07";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "w0rp";
       repo = "ale";
-      rev = "db6b1b5ecc17558f87f55b159f90ebf36677b6b3";
-      sha256 = "1sm6s0zn3gdm3bjp912ydqzskynzi2rw9v8q80g8p277c9vil28q";
+      rev = "b91d82bfaa395bb86b3ea51f63cc8cef05e90f98";
+      sha256 = "0hgzi91213x0r5mvp1hw8dk1fcjmqjf706cnjcilgv7ljnd6sa5z";
     };
   };
 
@@ -799,12 +799,12 @@ let
 
   defx-nvim = buildVimPluginFrom2Nix {
     pname = "defx-nvim";
-    version = "2019-10-27";
+    version = "2019-11-16";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "defx.nvim";
-      rev = "0a42be58745b2b0a19f6d59ca6238d1dfc96a07b";
-      sha256 = "0hm3i66fni89khv8ik8xs36x5485yc2i0mn5fkhjl61ip417b13y";
+      rev = "663cebbcbd2d1ecb3c052cffdd397b6157bc22f1";
+      sha256 = "0cjxdsz8ya09pbp70lk0cd3zizqgcpvk0wcdqqin73b59xirq5nr";
     };
   };
 
@@ -978,12 +978,12 @@ let
 
   deoplete-nvim = buildVimPluginFrom2Nix {
     pname = "deoplete-nvim";
-    version = "2019-11-11";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "deoplete.nvim";
-      rev = "22db8b273c746bb228a8728f4dd3a5b934d709af";
-      sha256 = "0ajmpz2ibdb8jlg5z6vsb06fr2vahf8alzdrxw7kns4f7hs14ib7";
+      rev = "84981f49c68d07749a5d522f8df595c60fdbcb6f";
+      sha256 = "0ix8a8ayshkr284vip9pvc6rw1q3vb4s6jny7lkv4zqh3g4jm3hg";
     };
   };
 
@@ -1223,12 +1223,12 @@ let
 
   ghcid = buildVimPluginFrom2Nix {
     pname = "ghcid";
-    version = "2019-11-06";
+    version = "2019-11-14";
     src = fetchFromGitHub {
       owner = "ndmitchell";
       repo = "ghcid";
-      rev = "d73f77a98d20673926a586cc471e557887f4a5d4";
-      sha256 = "0kq2qzb5rrdav51jlhg6f8ib2zq6crfic9295jz0gryzc9hm4ynq";
+      rev = "25faf559b6f5e8fdef8e1ca2aaf557644a57a165";
+      sha256 = "08653iwhz29xskrj36sih0z2bb247p137g8ls8ydvjgfy60jzrkm";
     };
   };
 
@@ -1421,12 +1421,12 @@ let
 
   intero-neovim = buildVimPluginFrom2Nix {
     pname = "intero-neovim";
-    version = "2018-08-07";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "parsonsmatt";
       repo = "intero-neovim";
-      rev = "9bb546e37adc1ffda28ff33922c506c15ed67b10";
-      sha256 = "173kc8xrbmkhrc9ssaz6h5w1zisxsgz4bibihgj9bx60ibn4kaa7";
+      rev = "4ce2d154379f8c95b3819512a9b67ead5204ffd0";
+      sha256 = "1na61qb31z80973jfi7ziw2zv6y73rm0bpfb6iqxjppmg4iqgl3i";
     };
   };
 
@@ -1598,23 +1598,23 @@ let
 
   lh-brackets = buildVimPluginFrom2Nix {
     pname = "lh-brackets";
-    version = "2019-05-23";
+    version = "2019-11-16";
     src = fetchFromGitHub {
       owner = "LucHermitte";
       repo = "lh-brackets";
-      rev = "f3240c3782a97720e9a344b5bd5f6808e156722b";
-      sha256 = "1qyh58xxp6hh86bykk17934pgg72q7xfsngrhrrr3cxb8jpnmx7z";
+      rev = "941444938a7effce57ddd2706f6fd2455d74a8c5";
+      sha256 = "1pkpjz0j2n1b1qdbmp4lj43qk2ddr55001yjg6cpznsl7b8rq095";
     };
   };
 
   lh-vim-lib = buildVimPluginFrom2Nix {
     pname = "lh-vim-lib";
-    version = "2019-09-30";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "LucHermitte";
       repo = "lh-vim-lib";
-      rev = "3c041e1e98c207f260f9c0b2f323e724adf1fb6d";
-      sha256 = "063mvhip0pvnil2ip2nlwadn5g845k0v6r3p44zywlklgm5l62ss";
+      rev = "76432c08d570a30f6d2d4c246756a3eb6e898ee3";
+      sha256 = "1wwr5yjvzv1xc0f5qbjfqclrpvx9vnrg8dkybf95lwgp9a8v7xxv";
     };
   };
 
@@ -1675,12 +1675,12 @@ let
 
   mattn-calendar-vim = buildVimPluginFrom2Nix {
     pname = "mattn-calendar-vim";
-    version = "2018-08-24";
+    version = "2019-11-13";
     src = fetchFromGitHub {
       owner = "mattn";
       repo = "calendar-vim";
-      rev = "867d0cd2d9388e7f1a88f5fe4da23461422fa8fb";
-      sha256 = "0f13wkvnjcv3awmahrkqw9f9hjdj8fq8wm10rs8jfmzad7w16dvk";
+      rev = "17a0395f19739964b85672fb5538ea3f2e28ca7a";
+      sha256 = "01g9ig5h7cqvlv2xakr8cml7l4rlgnypglqzag8zyr2lb2c1dmm3";
     };
   };
 
@@ -1829,12 +1829,12 @@ let
 
   neodark-vim = buildVimPluginFrom2Nix {
     pname = "neodark-vim";
-    version = "2019-06-15";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "KeitaNakamura";
       repo = "neodark.vim";
-      rev = "eeafb097ad5d9aa9db4ba43b8556306da9e3329f";
-      sha256 = "0n34980wdvxrgymnb0xgdy01mv201643xijr9czi0pf1hvfsbd70";
+      rev = "ab86163fed0a2c2b776aff463745e792fbed01d6";
+      sha256 = "0mv3vrqly1zgjy8knb87nhlhw4z2xyxzwfisqw6npi738xc612pz";
     };
   };
 
@@ -1928,12 +1928,12 @@ let
 
   neovim-fuzzy = buildVimPluginFrom2Nix {
     pname = "neovim-fuzzy";
-    version = "2018-11-15";
+    version = "2019-11-14";
     src = fetchFromGitHub {
       owner = "cloudhead";
       repo = "neovim-fuzzy";
-      rev = "c177209678477d091ee4576e231c5b80b44514d0";
-      sha256 = "069phpy1p8dindi6whddsb9x5zyw1adzsnv7br7q955hf6x9bxxj";
+      rev = "53383395befafce802c902c21b54847074454491";
+      sha256 = "064qi6zv2hrzn91pvr31b9zj2q0k9vbkk5csdhw5y52q26p1gakq";
     };
   };
 
@@ -1972,12 +1972,12 @@ let
 
   nerdtree = buildVimPluginFrom2Nix {
     pname = "nerdtree";
-    version = "2019-10-22";
+    version = "2019-11-13";
     src = fetchFromGitHub {
       owner = "scrooloose";
       repo = "nerdtree";
-      rev = "fec3e57ad23e4c268d07181d6afb858925b647a1";
-      sha256 = "1s5rmzl2rlqgxms5gi8gj6nnk18qqfsz6r40kk84cgqkf0ip13xv";
+      rev = "8d9b8dae67c5a6affbfd0304e0949ce9e79065ea";
+      sha256 = "1jgjw0lm1znf530mfa9iniwb3j35hpgz49ccykg5q6lrbscchc7h";
     };
   };
 
@@ -2104,12 +2104,12 @@ let
 
   open-browser-vim = buildVimPluginFrom2Nix {
     pname = "open-browser-vim";
-    version = "2018-11-29";
+    version = "2019-11-14";
     src = fetchFromGitHub {
       owner = "tyru";
       repo = "open-browser.vim";
-      rev = "b900ff9d39bb36891704bd0fe76737ee3a7ac2b9";
-      sha256 = "1sws0pzm13cgl7mf6938xjmh23hk02agf23zfx5rdb4d2lcn4ir3";
+      rev = "cd29e8c8db02cd7744728a8f77a829b967e5ff31";
+      sha256 = "0n1q76bcavkh1smk3l78ai7jh7qzn3sbpqcxs3pjf5za5j4c5i48";
     };
   };
 
@@ -2721,12 +2721,12 @@ let
 
   traces-vim = buildVimPluginFrom2Nix {
     pname = "traces-vim";
-    version = "2019-10-09";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "markonm";
       repo = "traces.vim";
-      rev = "6863fcdce850673b4468c43244d189ade3f99a8f";
-      sha256 = "0sq5cmsng2lid3dlfhcyagpzsjw1abp43wl3clm3bc5f3944lx5r";
+      rev = "393b3d0d55b951ad8d28f63f0e28c48e25ff48e4";
+      sha256 = "1hwn530p6zcjhk2lcmiqgrahxmp9hkwbzjbz4vnqdf1j6w9aqrwp";
     };
   };
 
@@ -2765,12 +2765,12 @@ let
 
   ultisnips = buildVimPluginFrom2Nix {
     pname = "ultisnips";
-    version = "2019-11-12";
+    version = "2019-11-13";
     src = fetchFromGitHub {
       owner = "SirVer";
       repo = "ultisnips";
-      rev = "298f4c255dd7048a99d968d91fc001b6e2203e65";
-      sha256 = "0kdld6w8ic1skl37kl7hxlgr8xrcmgspmcvrq5k1c9c6z1pmra5m";
+      rev = "f7b9b3b1100b3b2883ed2d0ac3627708a10dc469";
+      sha256 = "08g1h9ra807d19rhaf5l6g7pryq07cyy4g1ab0ycwyb0whlr6m57";
     };
   };
 
@@ -3084,12 +3084,12 @@ let
 
   vim-airline = buildVimPluginFrom2Nix {
     pname = "vim-airline";
-    version = "2019-11-10";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "vim-airline";
       repo = "vim-airline";
-      rev = "e4e4ba3c7b6f510ae10be2dfcac83e12afbd26e9";
-      sha256 = "0rwp8rwgb72wblrh3l6k7166da6pknvmyvx03fz53qmpxhsvhyhl";
+      rev = "29549aa55a5f20317eb63b8cd0c08c68a1336f3e";
+      sha256 = "1z2chmvxqq5s7a9qjam9j46m7dyfh80z62411swlc9py4aqm91ci";
     };
   };
 
@@ -3348,12 +3348,12 @@ let
 
   vim-cpp-enhanced-highlight = buildVimPluginFrom2Nix {
     pname = "vim-cpp-enhanced-highlight";
-    version = "2019-07-01";
+    version = "2019-11-14";
     src = fetchFromGitHub {
       owner = "octol";
       repo = "vim-cpp-enhanced-highlight";
-      rev = "da1d86aaf42bd4e52272b5a2f62b098c3986c048";
-      sha256 = "02cz8av85pjxpl9ggiy0y0z3gnjvd6ng1pafzv0c64xharg9l5aq";
+      rev = "27e0ffc215b81fa5aa87eca396acd4421d36c060";
+      sha256 = "15nyd4yssswyi4brkch09rca0qh7p77li4xyrivmiapkr4a60vwb";
     };
   };
 
@@ -3436,12 +3436,12 @@ let
 
   vim-dirvish = buildVimPluginFrom2Nix {
     pname = "vim-dirvish";
-    version = "2019-11-06";
+    version = "2019-11-16";
     src = fetchFromGitHub {
       owner = "justinmk";
       repo = "vim-dirvish";
-      rev = "fec6464f187aa2db8e90e0f32a81df781acea249";
-      sha256 = "08a08a40krz6yl56snh1392lkklgdhklfr10jshyhvqis4rbpknr";
+      rev = "4d7b4d4e2db72e95ea03c6ef757b01cbc128179e";
+      sha256 = "0ab7ivgkfaji0yl6mcx03nmr304vmdwxwiw0an94fa6wbhk0y9yl";
     };
   };
 
@@ -3689,12 +3689,12 @@ let
 
   vim-fugitive = buildVimPluginFrom2Nix {
     pname = "vim-fugitive";
-    version = "2019-11-08";
+    version = "2019-11-16";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-fugitive";
-      rev = "1e57d678bad1ffb7468e7dccc45401d1b096249a";
-      sha256 = "04k9bmqzlrx9pvkjs51znbbrqxy416k6jl7ffdp892hacgvr8cnj";
+      rev = "0004f585fde10ccb1617cbe53c97a4c0ecd622ce";
+      sha256 = "1nkvf75kr1ibg50jbrb1ysia24wr244vaqn6kjyfki74mdvyx9hw";
     };
   };
 
@@ -3766,12 +3766,12 @@ let
 
   vim-go = buildVimPluginFrom2Nix {
     pname = "vim-go";
-    version = "2019-11-12";
+    version = "2019-11-14";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "32f87164ba90fd011e9d751f4e9f57436c94139d";
-      sha256 = "0d52s8qankvc8kfy7sidv6ifws7nfiaph22hj27ysdfdg6ra5m7k";
+      rev = "58ddb1d95ee3c48877ca41e246c1faed654e1e2b";
+      sha256 = "0y0dimm7d76j1zfps1ndpbna4j1sc8c7gclv6p2b36nkv5d6hyw2";
     };
   };
 
@@ -4041,12 +4041,12 @@ let
 
   vim-javacomplete2 = buildVimPluginFrom2Nix {
     pname = "vim-javacomplete2";
-    version = "2019-11-09";
+    version = "2019-11-16";
     src = fetchFromGitHub {
       owner = "artur-shaik";
       repo = "vim-javacomplete2";
-      rev = "251f324609d65ef291faacf9ad302a6bdee9beed";
-      sha256 = "0vr9r3pwbs6d0d3cmz1y3qsbci1kq6vh87ciyp5haisf4ramz5wm";
+      rev = "676fecd601e844bcd580aa806296dfe4de91a558";
+      sha256 = "0ff3d1wsx47i9mim22j81r43z3n2c30ljw0fjicy43vb74wss873";
     };
   };
 
@@ -4130,12 +4130,12 @@ let
 
   vim-jsx-pretty = buildVimPluginFrom2Nix {
     pname = "vim-jsx-pretty";
-    version = "2019-11-10";
+    version = "2019-11-14";
     src = fetchFromGitHub {
       owner = "MaxMEllon";
       repo = "vim-jsx-pretty";
-      rev = "b71fa1f62e4bd727eb603db1182a859088210225";
-      sha256 = "10p5b4shlcjc231ln8fz1qlwbsqmkpxyvdz8jf6j5nnp6k5drwym";
+      rev = "cd6608c7ad33c50c47d6d7f91844fff84af7fa60";
+      sha256 = "100n5ss5y5jr6f38w4x418ld6hwdv6xpl129lzz43d2q2w428bqj";
     };
   };
 
@@ -4251,12 +4251,12 @@ let
 
   vim-lsc = buildVimPluginFrom2Nix {
     pname = "vim-lsc";
-    version = "2019-11-13";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "natebosch";
       repo = "vim-lsc";
-      rev = "83bfdee86d1c5a6ba6e4ebdcfcca286bfd6c38f1";
-      sha256 = "1m38j7mdzh3r602462v0vq1mbfcyyc98g82zmc354hcm8nmyjn2g";
+      rev = "7fa6a2db67d27782fedab751129249ab20ab1105";
+      sha256 = "0lik69wyw7cpysck661pivcqiah6crw5isl5j5nfhhpf6mm7i5hg";
     };
   };
 
@@ -4515,12 +4515,12 @@ let
 
   vim-pandoc-syntax = buildVimPluginFrom2Nix {
     pname = "vim-pandoc-syntax";
-    version = "2019-06-25";
+    version = "2019-11-14";
     src = fetchFromGitHub {
       owner = "vim-pandoc";
       repo = "vim-pandoc-syntax";
-      rev = "6710d46c8b772f77248f30d650c83f90c68f37ab";
-      sha256 = "1dir9h6s63lr10ffaxlpjar0xfmmjr3nhhgijsaa0vgnghc00r7x";
+      rev = "98a3051566690fcd779f540e9d4a81ccad667bd5";
+      sha256 = "0bvrkflryzb43xg5s9kiksk7nslgrqpybasz4grjv6lnmzis7x97";
     };
   };
 
@@ -4570,12 +4570,12 @@ let
 
   vim-pencil = buildVimPluginFrom2Nix {
     pname = "vim-pencil";
-    version = "2019-08-30";
+    version = "2019-11-16";
     src = fetchFromGitHub {
       owner = "reedes";
       repo = "vim-pencil";
-      rev = "4e0f08de173fcde5f3cb93da2c8129b1588e469a";
-      sha256 = "1vhqcd0gls9bys1anjlfyx4mh3rfkc076g6j9h1r4j09zn0bw1qn";
+      rev = "236380f1afcc1df10ae78cbf2c6e958d29183eaa";
+      sha256 = "1yxc03pmf0wr104mxy2ssln16jm3kkylivmhh47jk5iv2xw8i38q";
     };
   };
 
@@ -4603,12 +4603,12 @@ let
 
   vim-polyglot = buildVimPluginFrom2Nix {
     pname = "vim-polyglot";
-    version = "2019-11-12";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "sheerun";
       repo = "vim-polyglot";
-      rev = "0c79dd3e73e8e09b73d4a5d20bf470a3f6f715f2";
-      sha256 = "161j5mdcxqnib82dcvg4gmaxdh0f8zn621yssj0vjhfz8jl8lnrf";
+      rev = "d15651463ab5c3dd6609e548527a8ea18ab80c98";
+      sha256 = "1x7xx12hdydn37hb2k0awzv4s00sb7zk09jixr9mjfrh2x7ywf1c";
     };
   };
 
@@ -4735,12 +4735,12 @@ let
 
   vim-rsi = buildVimPluginFrom2Nix {
     pname = "vim-rsi";
-    version = "2019-11-13";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-rsi";
-      rev = "5e1453274011d2280f4ae357259b69eb9cba0b9f";
-      sha256 = "0jkyrlbm8z4v8s7zchn6ig61pdhrqdpd7cqfcf0ipff07fsws3qr";
+      rev = "ad8ba6beae8e82339479104b914214a868c9f1fe";
+      sha256 = "1ycjwnbs6rks78yxh0k0ywpvic0663mv7kydy3kjpa4f5bnkgbvc";
     };
   };
 
@@ -4867,12 +4867,12 @@ let
 
   vim-sleuth = buildVimPluginFrom2Nix {
     pname = "vim-sleuth";
-    version = "2019-11-13";
+    version = "2019-11-16";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-sleuth";
-      rev = "7b37cfd2f7eb7e96ec43d16ddb38a4ba1acbd576";
-      sha256 = "1wc1cbfz99xmvs11ydsbdaii8kyi1s7kz7avxdwh19vhks8zp4ay";
+      rev = "ea3f065f23cd0592062b8226c8fef08b6af3b459";
+      sha256 = "17w4m6zg1izcs75isy1jdzycgdr1ml1f5wqf1bjq80qgy3f28znp";
     };
   };
 
@@ -4977,12 +4977,12 @@ let
 
   vim-startify = buildVimPluginFrom2Nix {
     pname = "vim-startify";
-    version = "2019-11-06";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "mhinz";
       repo = "vim-startify";
-      rev = "2ea908578955c9a4ab6d0337531c0f122b51c182";
-      sha256 = "0014w64g9p3rq7mk9ri3hhmgyr0wrmxgv24gcaw5hr90cr58gs6b";
+      rev = "a521559d7036c66a8d43287c5c17a48db771ac47";
+      sha256 = "1gnjrixlkrrcxf291cwxiasl3yrnvc6bd56p8pa611z070253xlr";
     };
   };
 
@@ -5076,12 +5076,12 @@ let
 
   vim-terraform = buildVimPluginFrom2Nix {
     pname = "vim-terraform";
-    version = "2019-11-04";
+    version = "2019-11-13";
     src = fetchFromGitHub {
       owner = "hashivim";
       repo = "vim-terraform";
-      rev = "bd9c84050939b6a93eb7e7ce8321375e4009cc77";
-      sha256 = "09jqq9iakcp8ikqjm1jxmqcbbkvnxdcwn3bm0w2gfm3r9c5a8amd";
+      rev = "fd3374f1957d5611f0bc7dc2856a439c03d06ac0";
+      sha256 = "12j95yj1sc61j66mrcbrm0q052rbs0rmsksfyvaxc8q5kxc4dvyz";
     };
   };
 
@@ -5296,12 +5296,12 @@ let
 
   vim-visual-multi = buildVimPluginFrom2Nix {
     pname = "vim-visual-multi";
-    version = "2019-11-09";
+    version = "2019-11-16";
     src = fetchFromGitHub {
       owner = "mg979";
       repo = "vim-visual-multi";
-      rev = "6fe86c8426b6bfa51b683ba04dbe5232820c20a9";
-      sha256 = "0lahy379p2xzlv1n3v2zi2pyqxzix6dlw12z4f74v6yy4nmqjmbb";
+      rev = "99d367c4974a9e398943a0f457a8f3994732b050";
+      sha256 = "1cgphcm2fkhvks6bx8f0i54i91pcprisb079sddildnq4lsj895r";
     };
   };
 
@@ -5494,12 +5494,12 @@ let
 
   vimtex = buildVimPluginFrom2Nix {
     pname = "vimtex";
-    version = "2019-11-11";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "b31a981779d9a18e750832351acd41d0a45467ec";
-      sha256 = "04lnghxid70nk518qf72rqifq6vllakvxc7acw9lndhk5kw7pgg4";
+      rev = "7a11cf3ddf65584232d02d9d235bd6b8940a4288";
+      sha256 = "0k7k6f4bx0f1svlph4h39w14qqawkqihp668jnjj6p0ppffxa7a4";
     };
   };
 
@@ -5637,24 +5637,24 @@ let
 
   yats-vim = buildVimPluginFrom2Nix {
     pname = "yats-vim";
-    version = "2019-11-06";
+    version = "2019-11-15";
     src = fetchFromGitHub {
       owner = "HerringtonDarkholme";
       repo = "yats.vim";
-      rev = "773c6b6408597bf3e7175bd7a3427aaa1ee8b5ae";
-      sha256 = "1n8cqdsygbaxnlgaaf5r946rs9d9irvqdg0779c4pz8vrxdvhwzs";
+      rev = "c134c9e7595597684609fe2344076a66bbe82a17";
+      sha256 = "1g77j1pbnndyyi9s4yiia5bzd20n7x2fj3m9p7k173hv2n9kf93f";
       fetchSubmodules = true;
     };
   };
 
   youcompleteme = buildVimPluginFrom2Nix {
     pname = "youcompleteme";
-    version = "2019-11-11";
+    version = "2019-11-14";
     src = fetchFromGitHub {
       owner = "valloric";
       repo = "youcompleteme";
-      rev = "7efbb1da88067d8fd14a92daaa93693ef5cb6316";
-      sha256 = "11z1lcr1z03akai4lsvlxvz0x9nyc0ans6vv8k04im9dkaqnvc2i";
+      rev = "03ab4574d1c009be0da22c93ca96cf079b6ca99b";
+      sha256 = "0n375wxbm1q7m585s5yvj3v16dqvrp21c8s4ikjnwq4gkwh623ph";
       fetchSubmodules = true;
     };
   };
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index a6d9dbe1abe..35bd141ae46 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.201";
+  version = "4.4.202";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "120kci4kmc48zcw16lhxmh71kaxm9ac5qxik36q3a20czg28b2m7";
+    sha256 = "0adrmps7izfqy0yn4440isxvigslwzk1a375r9kh86idwbmcxb7x";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 3dc15168517..cb9d5a71dd9 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.201";
+  version = "4.9.202";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "125xmh5h1zmfniidpjljny53qkl4phpxaali69i66lajscxx8grq";
+    sha256 = "1gsfbvsswpwj6r56ynb6mmx7dc8hp9yhi7sfr0hhii0gs4ffq241";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/servers/bird/default.nix b/pkgs/servers/bird/default.nix
index 7ac7bc8e918..2cc27eda1d4 100644
--- a/pkgs/servers/bird/default.nix
+++ b/pkgs/servers/bird/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, flex, bison, readline }:
+{ lib, stdenv, fetchurl, fetchpatch, flex, bison, readline, libssh }:
 
 with lib;
 
@@ -15,7 +15,7 @@ let
       };
 
       nativeBuildInputs = [ flex bison ];
-      buildInputs = [ readline ];
+      buildInputs = [ readline libssh ];
 
       patches = [
         (./. + "/dont-create-sysconfdir-${builtins.substring 0 1 version}.patch")
diff --git a/pkgs/servers/documize-community/default.nix b/pkgs/servers/documize-community/default.nix
index e6b7e2be125..2cc6b2a9f74 100644
--- a/pkgs/servers/documize-community/default.nix
+++ b/pkgs/servers/documize-community/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "documize-community";
-  version = "3.4.2";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "documize";
     repo = "community";
     rev = "v${version}";
-    sha256 = "17dzj24dc3f6bw8v4fsj578gfz0fcvh42a2srci580s41mq2kjy4";
+    sha256 = "1y38lgkxhyrga44wj216vl08fzyv8wbk02a85flnihrb4b1092x0";
   };
 
   goPackagePath = "github.com/documize/community";
diff --git a/pkgs/servers/gortr/default.nix b/pkgs/servers/gortr/default.nix
new file mode 100644
index 00000000000..375631d5cbf
--- /dev/null
+++ b/pkgs/servers/gortr/default.nix
@@ -0,0 +1,22 @@
+{ lib, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "gortr";
+  version = "0.13.0";
+
+  src = fetchFromGitHub {
+    owner = "cloudflare";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1kg42qynqqj05bvfwzd77mpl63y3gnkk15x2a4rspxf4w1ziaxkr";
+  };
+  modSha256 = "157dpalfz3z1s3mxq63xy6lrkwzyy9xzmvn7wsxkwznjq4djv1a1";
+
+  meta = with lib; {
+    description = "The RPKI-to-Router server used at Cloudflare";
+    homepage = "https://github.com/cloudflare/gortr/";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ petabyteboy ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/broot/default.nix b/pkgs/tools/misc/broot/default.nix
index 93084640e76..63d5ff69e79 100644
--- a/pkgs/tools/misc/broot/default.nix
+++ b/pkgs/tools/misc/broot/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "0.9.4";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1im04vlhmjdwzp19pizk4bmzvybgjg40ig833qx5lbisfs74xyxw";
+    sha256 = "1wisqb4cqdgsnjvmpgxbzs9zcw6npqw1kqxxs8mn33sxlikhbf2l";
   };
 
-  cargoSha256 = "0675995zh9nn690kdha3zfsa157173rxwcqz0kasbl9byjczi6sm";
+  cargoSha256 = "09gnyj97akychin1axp9kcww3c04xx7x1qnplhs2yxfki62r4y2b";
 
   meta = with stdenv.lib; {
     description = "An interactive tree view, a fuzzy search, a balanced BFS descent and customizable commands";
diff --git a/pkgs/tools/networking/gmrender-resurrect/default.nix b/pkgs/tools/networking/gmrender-resurrect/default.nix
index be1ca9f265d..d942dce6a19 100644
--- a/pkgs/tools/networking/gmrender-resurrect/default.nix
+++ b/pkgs/tools/networking/gmrender-resurrect/default.nix
@@ -1,38 +1,38 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, pkgconfig, makeWrapper
-, gstreamer, gst-plugins-base, gst-plugins-good, gst-plugins-bad, gst-plugins-ugly, gst-libav, libupnp }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, makeWrapper, gstreamer
+, gst-plugins-base, gst-plugins-good, gst-plugins-bad, gst-plugins-ugly, gst-libav, libupnp }:
 
-let version = "4f221e6b85abf85957b547436e982d7a501a1718"; in
+let
+  version = "0.0.8";
 
-stdenv.mkDerivation {
-  pname = "gmrender-resurrect";
-  inherit version;
+  makePluginPath = plugins: builtins.concatStringsSep ":" (map (p: p + "/lib/gstreamer-1.0") plugins);
 
-  src = fetchFromGitHub {
-    owner = "hzeller";
-    repo = "gmrender-resurrect";
-    rev = version;
-    sha256 = "1dmdhyz27bh74qmvncfd3kw7zqwnd05bhxcfjjav98z5qrxdygj4";
-  };
+  pluginPath = makePluginPath [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav ];
+in
+  stdenv.mkDerivation {
+    pname = "gmrender-resurrect";
+    inherit version;
 
-  preConfigurePhases = "autoconfPhase";
+    src = fetchFromGitHub {
+      owner = "hzeller";
+      repo = "gmrender-resurrect";
+      rev = "v${version}";
+      sha256 = "14i5jrry6qiap5l2x2jqj7arymllajl3wgnk29ccvr8d45zp4jn1";
+    };
 
-  autoconfPhase = "./autogen.sh";
+    buildInputs = [ gstreamer libupnp ];
+    nativeBuildInputs = [ autoreconfHook pkgconfig makeWrapper ];
 
-  buildInputs = [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-libav libupnp ];
-  nativeBuildInputs = [ autoconf automake pkgconfig makeWrapper ];
+    postInstall = ''
+      for prog in "$out/bin/"*; do
+          wrapProgram "$prog" --suffix GST_PLUGIN_SYSTEM_PATH_1_0 : "${pluginPath}"
+      done
+    '';
 
-  postInstall = ''
-    for prog in "$out/bin/"*; do
-        wrapProgram "$prog" --suffix GST_PLUGIN_SYSTEM_PATH : "${gst-plugins-base}/lib/gstreamer-1.0:${gst-plugins-good}/lib/gstreamer-1.0:${gst-plugins-bad}/lib/gstreamer-1.0:${gst-plugins-ugly}/lib/gstreamer-1.0:${gst-libav}/lib/gstreamer-1.0"
-    done
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Resource efficient UPnP/DLNA renderer, optimal for Raspberry Pi, CuBox or a general MediaServer";
-    homepage = https://github.com/hzeller/gmrender-resurrect;
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    broken = true;
-    maintainers = [ maintainers.koral ];
-  };
-}
+    meta = with stdenv.lib; {
+      description = "Resource efficient UPnP/DLNA renderer, optimal for Raspberry Pi, CuBox or a general MediaServer";
+      homepage = https://github.com/hzeller/gmrender-resurrect;
+      license = licenses.gpl2;
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ koral ashkitten ];
+    };
+  }
diff --git a/pkgs/tools/networking/mitmproxy/default.nix b/pkgs/tools/networking/mitmproxy/default.nix
index a9758e5fd47..53369baa01c 100644
--- a/pkgs/tools/networking/mitmproxy/default.nix
+++ b/pkgs/tools/networking/mitmproxy/default.nix
@@ -52,10 +52,12 @@ buildPythonPackage rec {
 
   doCheck = (!stdenv.isDarwin);
 
+  # examples.complex.xss_scanner doesn't import correctly with pytest5
   checkPhase = ''
     export HOME=$(mktemp -d)
     export LC_CTYPE=en_US.UTF-8
-    pytest -k 'not test_find_unclaimed_URLs and not test_tcp'
+    pytest --ignore test/examples \
+      -k 'not test_find_unclaimed_URLs and not test_tcp'
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/tools/networking/surfraw/default.nix b/pkgs/tools/networking/surfraw/default.nix
index d69221d9d50..eac73765300 100644
--- a/pkgs/tools/networking/surfraw/default.nix
+++ b/pkgs/tools/networking/surfraw/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   name = "surfraw-2.3.0";
 
   src = fetchurl {
-    url = "http://surfraw.alioth.debian.org/dist/surfraw-2.3.0.tar.gz";
+    url = "https://gitlab.com/surfraw/Surfraw/uploads/2de827b2786ef2fe43b6f07913ca7b7f/surfraw-2.3.0.tar.gz";
     sha256 = "099nbif0x5cbcf18snc58nx1a3q7z0v9br9p2jiq9pcc7ic2015d";
   };
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Provides a fast unix command line interface to a variety of popular WWW search engines and other artifacts of power";
-    homepage = http://surfraw.alioth.debian.org;
+    homepage = https://gitlab.com/surfraw/Surfraw;
     maintainers = [];
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.publicDomain;
diff --git a/pkgs/tools/security/efitools/default.nix b/pkgs/tools/security/efitools/default.nix
index 8a64a019fef..33b6c3b672d 100644
--- a/pkgs/tools/security/efitools/default.nix
+++ b/pkgs/tools/security/efitools/default.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
     sed -i -e 's#/usr/include/efi#${gnu-efi}/include/efi/#g' Make.rules
     sed -i -e 's#/usr/lib64/gnuefi#${gnu-efi}/lib/#g' Make.rules
     sed -i -e 's#$(DESTDIR)/usr#$(out)#g' Make.rules
+    substituteInPlace lib/console.c --replace "EFI_WARN_UNKOWN_GLYPH" "EFI_WARN_UNKNOWN_GLYPH"
     patchShebangs .
   '';
 
diff --git a/pkgs/tools/security/haka/default.nix b/pkgs/tools/security/haka/default.nix
index bd7d356c1a0..bfac54d2d86 100644
--- a/pkgs/tools/security/haka/default.nix
+++ b/pkgs/tools/security/haka/default.nix
@@ -30,6 +30,6 @@ stdenv.mkDerivation {
     homepage = http://www.haka-security.org/;
     license = stdenv.lib.licenses.mpl20;
     maintainers = [ stdenv.lib.maintainers.tvestelind ];
-    platforms = stdenv.lib.platforms.linux;
+    platforms = [ "x86_64-linux" "i686-linux" ]; # fails on aarch64
   };
 }
diff --git a/pkgs/tools/security/john/default.nix b/pkgs/tools/security/john/default.nix
index 4107e9fcf14..fd5659e7f9d 100644
--- a/pkgs/tools/security/john/default.nix
+++ b/pkgs/tools/security/john/default.nix
@@ -47,11 +47,12 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = [ "-DJOHN_SYSTEMWIDE=1" ];
 
   postInstall = ''
-    mkdir -p "$out/bin" "$out/etc/john" "$out/share/john" "$out/share/doc/john"
+    mkdir -p "$out/bin" "$out/etc/john" "$out/share/john" "$out/share/doc/john" "$out/share/john/rules"
     find -L ../run -mindepth 1 -maxdepth 1 -type f -executable \
       -exec cp -d {} "$out/bin" \;
     cp -vt "$out/etc/john" ../run/*.conf
     cp -vt "$out/share/john" ../run/*.chr ../run/password.lst
+    cp -vt "$out/share/john/rules" ../run/rules/*.rule
     cp -vrt "$out/share/doc/john" ../doc/*
   '';
 
diff --git a/pkgs/tools/security/vault/default.nix b/pkgs/tools/security/vault/default.nix
index dc5556c7016..1e5a16e1958 100644
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "vault";
-  version = "1.2.4";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "1dqnl5pbhjb19sw2c9ry510vp4gls2l13xylf1bdqzcwd8gpxm42";
+    sha256 = "0ayvmqg4fj9cliwbl4pb12mailq7062j3f9v8arpv6x5r4hydlpy";
   };
 
   goPackagePath = "github.com/hashicorp/vault";
diff --git a/pkgs/tools/system/fakeroot/default.nix b/pkgs/tools/system/fakeroot/default.nix
index c31e7337dd5..934b74dd384 100644
--- a/pkgs/tools/system/fakeroot/default.nix
+++ b/pkgs/tools/system/fakeroot/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = http://fakeroot.alioth.debian.org/;
+    homepage = https://salsa.debian.org/clint/fakeroot;
     description = "Give a fake root environment through LD_PRELOAD";
     license = stdenv.lib.licenses.gpl2Plus;
     maintainers = with stdenv.lib.maintainers; [viric];
diff --git a/pkgs/tools/system/hardinfo/default.nix b/pkgs/tools/system/hardinfo/default.nix
index a2e342f85b7..6c5019847ff 100644
--- a/pkgs/tools/system/hardinfo/default.nix
+++ b/pkgs/tools/system/hardinfo/default.nix
@@ -45,6 +45,6 @@ stdenv.mkDerivation rec {
     description = "Display information about your hardware and operating system";
     license = licenses.gpl2;
     maintainers = with maintainers; [ bjornfor ];
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" "i686-linux" ]; # ARMv7 and AArch64 are unsupported
   };
 }
diff --git a/pkgs/tools/system/logcheck/default.nix b/pkgs/tools/system/logcheck/default.nix
index 064071a5ca4..d51df4f408a 100644
--- a/pkgs/tools/system/logcheck/default.nix
+++ b/pkgs/tools/system/logcheck/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
       Logcheck helps spot problems and security violations in your logfiles automatically and will send the results to you by e-mail.
       Logcheck was part of the Abacus Project of security tools, but this version has been rewritten.
     '';
-    homepage = http://logcheck.alioth.debian.org/;
+    homepage = https://salsa.debian.org/debian/logcheck;
     license = licenses.gpl2;
     maintainers = [ maintainers.bluescreen303 ];
   };
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3dee9eb249e..e64f640555f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3037,6 +3037,8 @@ in
 
   enscript = callPackage ../tools/text/enscript { };
 
+  ensemble-chorus = callPackage ../applications/audio/ensemble-chorus { };
+
   entr = callPackage ../tools/misc/entr { };
 
   eot_utilities = callPackage ../tools/misc/eot-utilities { };
@@ -6540,6 +6542,8 @@ in
 
   staruml = callPackage ../tools/misc/staruml { inherit (gnome2) GConf; libgcrypt = libgcrypt_1_5; };
 
+  stone-phaser = callPackage ../applications/audio/stone-phaser { };
+
   systrayhelper = callPackage ../tools/misc/systrayhelper {};
 
   Sylk = callPackage ../applications/networking/Sylk {};
@@ -19134,6 +19138,8 @@ in
 
   gxmessage = callPackage ../applications/misc/gxmessage { };
 
+  gxmatcheq-lv2 = callPackage ../applications/audio/gxmatcheq-lv2 { };
+
   gxplugins-lv2 = callPackage ../applications/audio/gxplugins-lv2 { };
 
   hackrf = callPackage ../applications/radio/hackrf { };
@@ -19595,6 +19601,8 @@ in
     go = buildPackages.go_1_12;
   };
 
+  kubeseal = callPackage ../applications/networking/cluster/kubeseal { };
+
   kubectl = callPackage ../applications/networking/cluster/kubectl { };
 
   kubeless = callPackage ../applications/networking/cluster/kubeless { };
@@ -25539,4 +25547,6 @@ in
 
   sieveshell = with python3.pkgs; toPythonApplication managesieve;
 
+  gortr = callPackage ../servers/gortr {};
+
 }
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index c5b6bc3f049..95ff84d4842 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12902,6 +12902,22 @@ let
     };
   };
 
+  MySQLDiff = buildPerlPackage rec {
+    pname = "MySQL-Diff";
+    version = "0.60";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/E/ES/ESTRABD/MySQL-Diff-0.60.tar.gz";
+      sha256 = "5d7080a4bd5714ff9ef536aa774a7adb3c6f0e760215ca6c39d8a3545344f956";
+    };
+    propagatedBuildInputs = [ FileSlurp StringShellQuote pkgs.mysql-client ];
+    meta = {
+      homepage = "https://github.com/estrabd/mysqldiff";
+      description = "Generates a database upgrade instruction set";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+      maintainers = [ maintainers.sgo ];
+    };
+  };
+
   namespaceautoclean = buildPerlPackage {
     pname = "namespace-autoclean";
     version = "0.29";
@@ -16326,6 +16342,7 @@ let
       url = mirror://cpan/authors/id/R/RO/ROSCH/String-ShellQuote-1.04.tar.gz;
       sha256 = "0dfxhr6hxc2majkkrm0qbx3qcbykzpphbj2ms93dc86f7183c1p6";
     };
+    doCheck = !stdenv.isDarwin;
     meta = {
       # http://cpansearch.perl.org/src/ROSCH/String-ShellQuote-1.04/README
       license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f61ca230c07..7f1980d40da 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1149,6 +1149,8 @@ in {
     igraph = pkgs.igraph;
   };
 
+  python-olm = callPackage ../development/python-modules/python-olm { };
+
   python3-openid = callPackage ../development/python-modules/python3-openid { };
 
   python-packer = callPackage ../development/python-modules/python-packer { };
@@ -3847,6 +3849,8 @@ in {
 
   matrix-client = callPackage ../development/python-modules/matrix-client { };
 
+  matrix-nio = callPackage ../development/python-modules/matrix-nio { };
+
   mautrix-appservice = callPackage ../development/python-modules/mautrix-appservice { };
 
   maya = callPackage ../development/python-modules/maya { };