diff --git a/lib/default.nix b/lib/default.nix
index 688c117d52b..8735b647679 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -81,7 +81,7 @@ let
       intersperse concatStringsSep concatMapStringsSep
       concatImapStringsSep makeSearchPath makeSearchPathOutput
       makeLibraryPath makeBinPath optionalString
-      hasPrefix hasSuffix stringToCharacters stringAsChars escape
+      hasInfix hasPrefix hasSuffix stringToCharacters stringAsChars escape
       escapeShellArg escapeShellArgs replaceChars lowerChars
       upperChars toLower toUpper addContextFrom splitString
       removePrefix removeSuffix versionOlder versionAtLeast getVersion
diff --git a/pkgs/applications/editors/emacs-modes/hsc3/default.nix b/pkgs/applications/editors/emacs-modes/hsc3/default.nix
index 150bd3593fd..199a5886e1d 100644
--- a/pkgs/applications/editors/emacs-modes/hsc3/default.nix
+++ b/pkgs/applications/editors/emacs-modes/hsc3/default.nix
@@ -8,9 +8,9 @@ let version = "0.15";
 in stdenv.mkDerivation {
   name = "hsc3-mode-${version}";
   src = fetchurl {
-    url = http://hackage.haskell.org/package/hsc3-0.15/hsc3-0.15.tar.gz;
+    url = mirror://hackage/hsc3-0.15/hsc3-0.15.tar.gz;
     sha256 = "2f3b15655419cf8ebe25ab1c6ec22993b2589b4ffca7c3a75ce478ca78a0bde6";
-  }; 
+  };
 
   buildInputs = [ emacs ];
 
diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index e0ac32c54ec..2e3d092225f 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.1.0578";
+  version = "8.1.0675";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "0sawqxp2737y6mga9da36qya47h0idnnaxblzpsx8clw002piyv2";
+    sha256 = "00nlh8f2rf0af3n434s0lp6idxlg4l7mi1lrlbz0xld9dsrzdmas";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index 9e4aec16db8..657a9dd27e5 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -69,7 +69,7 @@ in stdenv.mkDerivation rec {
   configureFlags = [
     "--without-webkit" # old version is required
     "--with-bug-report-url=https://github.com/NixOS/nixpkgs/issues/new"
-    "--with-icc-directory=/var/run/current-system/sw/share/color/icc"
+    "--with-icc-directory=/run/current-system/sw/share/color/icc"
   ];
 
   # on Darwin,
diff --git a/pkgs/applications/networking/cluster/kubernetes/default.nix b/pkgs/applications/networking/cluster/kubernetes/default.nix
index ef31898dd0c..3c20eb126f0 100644
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@@ -15,13 +15,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   name = "kubernetes-${version}";
-  version = "1.13.5";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "06pf4h76zsqs3dsxr57y9sb9sw48nfyw1x2q1725zww61jfz2a6y";
+    sha256 = "1c04x474m5b7qqs9kddrx2mygwpv40hvylr3cq34qxdxgang3qc6";
   };
 
   buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace "hack/lib/golang.sh" --replace "_cgo" ""
-    substituteInPlace "hack/generate-docs.sh" --replace "make" "make SHELL=${stdenv.shell}"
+    substituteInPlace "hack/update-generated-docs.sh" --replace "make" "make SHELL=${stdenv.shell}"
     # hack/update-munge-docs.sh only performs some tests on the documentation.
     # They broke building k8s; disabled for now.
     echo "true" > "hack/update-munge-docs.sh"
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   WHAT="${concatStringsSep " " components}";
 
   postBuild = ''
-    ./hack/generate-docs.sh
+    ./hack/update-generated-docs.sh
     (cd build/pause && cc pause.c -o pause)
   '';
 
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index 404c744eea2..404cea7532b 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -308,6 +308,8 @@ rec {
   hackage = [
     http://hackage.haskell.org/package/
     http://hdiff.luite.com/packages/archive/package/
+    http://hackage.fpcomplete.com/package/
+    http://objects-us-east-1.dream.io/hackage-mirror/package/
   ];
 
   # Roy marples mirrors
diff --git a/pkgs/development/compilers/rust/bootstrap.nix b/pkgs/development/compilers/rust/bootstrap.nix
index b44c7815e90..b3446436179 100644
--- a/pkgs/development/compilers/rust/bootstrap.nix
+++ b/pkgs/development/compilers/rust/bootstrap.nix
@@ -3,16 +3,16 @@
 let
   # Note: the version MUST be one version prior to the version we're
   # building
-  version = "1.32.0";
+  version = "1.33.0";
 
-  # fetch hashes by running `print-hashes.sh 1.32.0`
+  # fetch hashes by running `print-hashes.sh 1.33.0`
   hashes = {
-    i686-unknown-linux-gnu = "4ce3a6a656669fa86606074b43fadeac7465ef48394249407e21106ed714c8db";
-    x86_64-unknown-linux-gnu = "e024698320d76b74daf0e6e71be3681a1e7923122e3ebd03673fcac3ecc23810";
-    armv7-unknown-linux-gnueabihf = "d7b69f60689d2905d8d3c2829b0f1cd0f86265a255ff88ea0deb601aebac6428";
-    aarch64-unknown-linux-gnu = "60def40961728212da4b3a9767d5a2ddb748400e150a5f8a6d5aa0e1b8ba1cee";
-    i686-apple-darwin = "76cc1280f6b61bf7cf1fddd5202cc236db7573ee05f39fc8cd12ddda8f39a7c3";
-    x86_64-apple-darwin = "f0dfba507192f9b5c330b5984ba71d57d434475f3d62bd44a39201e36fa76304";
+    i686-unknown-linux-gnu = "c379203687d98e60623aa88c4df4992dd5a9548bc30674b9fc8e671a979e9f3a";
+    x86_64-unknown-linux-gnu = "6623168b9ee9de79deb0d9274c577d741ea92003768660aca184e04fe774393f";
+    armv7-unknown-linux-gnueabihf = "f6f0ec0a98d922c4bfd79703bc9e9eef439ba347453f33608a87cd63c47e7245";
+    aarch64-unknown-linux-gnu = "a308044e4076b62f637313ea803fa0a8f340b0f1b53136856f2c43afcabe5387";
+    i686-apple-darwin = "ed20809d56bbaea041721ce6fc9f10f7ae7a720c5821587f01a537d07a5454b1";
+    x86_64-apple-darwin = "864e7c074a0b88e38883c87c169513d072300bb52e1d320a067bd34cf14f66bd";
   };
 
   platform =
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 192e017f6e6..9b980043100 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -17,11 +17,11 @@ let
   llvmShared = llvm_7.override { enableSharedLibraries = true; };
 in stdenv.mkDerivation rec {
   pname = "rustc";
-  version = "1.33.0";
+  version = "1.34.0";
 
   src = fetchurl {
     url = "https://static.rust-lang.org/dist/rustc-${version}-src.tar.gz";
-    sha256 = "152x91mg7bz4ygligwjb05fgm1blwy2i70s2j03zc9jiwvbsh0as";
+    sha256 = "0n8z1wngkxab1rvixqg6w8b727hzpnm9wp9h8iy3mpbrzp7mmj3s";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/haskell-modules/generic-builder.nix b/pkgs/development/haskell-modules/generic-builder.nix
index 8047eee1318..b2d7d0eaf9c 100644
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@@ -118,7 +118,7 @@ let
 
   binDir = if enableSeparateBinOutput then "$bin/bin" else "$out/bin";
 
-  newCabalFileUrl = "http://hackage.haskell.org/package/${pname}-${version}/revision/${revision}.cabal";
+  newCabalFileUrl = "mirror://hackage/${pname}-${version}/revision/${revision}.cabal";
   newCabalFile = fetchurl {
     url = newCabalFileUrl;
     sha256 = editedCabalFile;
diff --git a/pkgs/development/haskell-modules/make-package-set.nix b/pkgs/development/haskell-modules/make-package-set.nix
index b4cd7fee311..6b5ecc1df8a 100644
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@@ -183,7 +183,7 @@ in package-set { inherit pkgs stdenv callPackage; } self // {
     callHackageDirect = {pkg, ver, sha256}@args:
       let pkgver = "${pkg}-${ver}";
       in self.callCabal2nix pkg (pkgs.fetchzip {
-           url = "http://hackage.haskell.org/package/${pkgver}/${pkgver}.tar.gz";
+           url = "mirror://hackage/${pkgver}/${pkgver}.tar.gz";
            inherit sha256;
          });
 
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 15af58be6fc..ef4cab35021 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -30,7 +30,7 @@ with pkgs;
         isPy2 = lib.strings.substring 0 1 pythonVersion == "2";
         isPy3 = lib.strings.substring 0 1 pythonVersion == "3";
         isPy3k = isPy3;
-        isPyPy = interpreter == "pypy";
+        isPyPy = lib.hasInfix "pypy" interpreter;
 
         buildEnv = callPackage ./wrapper.nix { python = self; inherit (pythonPackages) requiredPythonModules; };
         withPackages = import ./with-packages.nix { inherit buildEnv pythonPackages;};
@@ -100,11 +100,11 @@ in {
   pypy27 = callPackage ./pypy {
     self = pypy27;
     sourceVersion = {
-      major = "6";
+      major = "7";
       minor = "0";
       patch = "0";
     };
-    sha256 = "1qjwpc8n68sxxlfg36s5vn1h2gdfvvd6lxvr4lzbvfwhzrgqahsw";
+    sha256 = "1m6ja79sbkl38p1hs7c0n4kq5xzn01wp7wl5456hsw9q6cwg6894";
     pythonVersion = "2.7";
     db = db.override { dbmSupport = true; };
     python = python27;
@@ -114,11 +114,11 @@ in {
   pypy35 = callPackage ./pypy {
     self = pypy35;
     sourceVersion = {
-      major = "6";
+      major = "7";
       minor = "0";
       patch = "0";
     };
-    sha256 = "0lwq8nn0r5yj01bwmkk5p7xvvrp4s550l8184mkmn74d3gphrlwg";
+    sha256 = "0hbv9ziv8n9lqnr6cndrw70p6g40c00w1ds7lmzgrr153myxkp7w";
     pythonVersion = "3.5";
     db = db.override { dbmSupport = true; };
     python = python27;
diff --git a/pkgs/development/interpreters/python/pypy/default.nix b/pkgs/development/interpreters/python/pypy/default.nix
index 193f134e5c6..46cf0475de4 100644
--- a/pkgs/development/interpreters/python/pypy/default.nix
+++ b/pkgs/development/interpreters/python/pypy/default.nix
@@ -108,6 +108,9 @@ in with passthru; stdenv.mkDerivation rec {
       "test_pathlib"
       # disable tarfile because it assumes gid 0 exists
       "test_tarfile"
+      # disable __all__ because of spurious imp/importlib warning and
+      # warning-to-error test policy
+      "test___all__"
     ];
   in ''
     export TERMINFO="${ncurses.out}/share/terminfo/";
diff --git a/pkgs/development/libraries/SDL2_ttf/default.nix b/pkgs/development/libraries/SDL2_ttf/default.nix
index a21315fdc88..b219922223f 100644
--- a/pkgs/development/libraries/SDL2_ttf/default.nix
+++ b/pkgs/development/libraries/SDL2_ttf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "SDL2_ttf-${version}";
-  version = "2.0.14";
+  version = "2.0.15";
 
   src = fetchurl {
     url = "https://www.libsdl.org/projects/SDL_ttf/release/${name}.tar.gz";
-    sha256 = "0xljwcpvd2knrjdfag5b257xqayplz55mqlszrqp0kpnphh5xnrl";
+    sha256 = "0cyd48dipc0m399qy8s03lci8b0bpiy8xlkvrm2ia7wcv0dfpv59";
   };
 
   configureFlags = stdenv.lib.optional stdenv.isDarwin "--disable-sdltest";
diff --git a/pkgs/development/libraries/audio/lv2/default.nix b/pkgs/development/libraries/audio/lv2/default.nix
index 5b98a88a8fb..d026dd258bc 100644
--- a/pkgs/development/libraries/audio/lv2/default.nix
+++ b/pkgs/development/libraries/audio/lv2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "lv2-${version}";
-  version = "1.14.0";
+  version = "1.16.0";
 
   src = fetchurl {
     url = "http://lv2plug.in/spec/${name}.tar.bz2";
-    sha256 = "0chxwys3vnn3nxc9x2vchm74s9sx0vfra6y893byy12ci61jc1dq";
+    sha256 = "1ppippbpdpv13ibs06b0bixnazwfhiw0d0ja6hx42jnkgdyp5hyy";
   };
 
   nativeBuildInputs = [ pkgconfig wafHook ];
diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix
index a761b8bd3f2..38dfceb2e00 100644
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -86,6 +86,7 @@ in stdenv.mkDerivation rec {
     # `-I' flags to be propagated.
     sed -i "src/cairo.pc.in" \
         -es'|^Cflags:\(.*\)$|Cflags: \1 -I${freetype.dev}/include/freetype2 -I${freetype.dev}/include|g'
+    substituteInPlace configure --replace strings $STRINGS
     '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/glibmm/default.nix b/pkgs/development/libraries/glibmm/default.nix
index 054e6df0e4c..829dca04c18 100644
--- a/pkgs/development/libraries/glibmm/default.nix
+++ b/pkgs/development/libraries/glibmm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "glibmm";
-  version = "2.58.0";
+  version = "2.60.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0idnaii4h3mdym2a55gkavipyxigwvbgfmzmwql85s4rgciqjhfk";
+    sha256 = "1g7jxqd270dv2d83r7pf5893mwpz7d5xib0q01na2yalh34v38d3";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index 1a01c28aeb4..27c638d8a87 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -13,14 +13,14 @@ assert cupsSupport -> cups != null;
 with stdenv.lib;
 
 let
-  version = "3.24.7";
+  version = "3.24.8";
 in
 stdenv.mkDerivation rec {
   name = "gtk+3-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${stdenv.lib.versions.majorMinor version}/gtk+-${version}.tar.xz";
-    sha256 = "080m925dyhiidlhsxqzx040l4iha2gg38pzbfpnsnjyzl92124jj";
+    sha256 = "16f71bbkhwhndcsrpyhjia3b77cb5ksf5c45lyfgws4pkgg64sb6";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 7c364c0fcdf..0cf7891bd48 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "2.3.1";
+  version = "2.4.0";
   inherit (stdenv.lib) optional optionals optionalString;
 in
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/harfbuzz/release/harfbuzz-${version}.tar.bz2";
-    sha256 = "0s74ramsbfa183rxkidqgfd2vbhrwicnrqzqsq440dwibffnj1gj";
+    sha256 = "11a3kq3m6mgyjymgrmacr3h562qmmy2f6rc6wcj21mwv31j0avrk";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/http-parser/default.nix b/pkgs/development/libraries/http-parser/default.nix
index 4bae9793c38..d63911ad24f 100644
--- a/pkgs/development/libraries/http-parser/default.nix
+++ b/pkgs/development/libraries/http-parser/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl }:
 
 let
-  version = "2.9.0";
+  version = "2.9.1";
 in stdenv.mkDerivation {
   name = "http-parser-${version}";
 
   src = fetchurl {
     url = "https://github.com/joyent/http-parser/archive/v${version}.tar.gz";
-    sha256 = "0gv1dhzwlv1anbzrba20l39gzzmz818yv8jbclbls268aj62c9pg";
+    sha256 = "08fypqh3jkwvlznvmwwwir53ffg2xcxy0v8bjz6wxjlb41qhf8ik";
   };
 
   NIX_CFLAGS_COMPILE = "-Wno-error";
diff --git a/pkgs/development/libraries/libidn2/default.nix b/pkgs/development/libraries/libidn2/default.nix
index b79cad7cb69..c0fadfeb679 100644
--- a/pkgs/development/libraries/libidn2/default.nix
+++ b/pkgs/development/libraries/libidn2/default.nix
@@ -4,11 +4,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "libidn2-${version}";
-  version = "2.1.1";
+  version = "2.1.1a";
 
   src = fetchurl {
     url = "mirror://gnu/gnu/libidn/${name}.tar.gz";
-    sha256 = "1cbq439dzf14jjpayk5mk0yyq32k3c27acg1d4ra364j6a060hcm";
+    sha256 = "0wlb0jrkccsdxlx90wx6ax5raqcm6y9c75dcgc6j6m6gdv7nnrjp";
   };
 
   outputs = [ "bin" "dev" "out" "info" "devdoc" ];
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 24a708f8277..0682bc32630 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -27,11 +27,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "libinput-${version}";
-  version = "1.12.6";
+  version = "1.13.1";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${name}.tar.xz";
-    sha256 = "0pgla0mc6mvyr1ljy10mcqvfz8i5z6yp7dbx2bcd70y67wx05d0j";
+    sha256 = "1as190kl5mnlpqab4qvkxnm4h8vz5cf22r0ai4cb2azfg3a8gm71";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/development/libraries/libmicrohttpd/default.nix b/pkgs/development/libraries/libmicrohttpd/default.nix
index 3f678e0eb96..0ecd568c376 100644
--- a/pkgs/development/libraries/libmicrohttpd/default.nix
+++ b/pkgs/development/libraries/libmicrohttpd/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libmicrohttpd-${version}";
-  version = "0.9.62";
+  version = "0.9.63";
 
   src = fetchurl {
     url = "mirror://gnu/libmicrohttpd/${name}.tar.gz";
-    sha256 = "0jfvi1fb4im3a3m8qishbmzx3zch993c0mhvl2k92l1zf1yhjgmx";
+    sha256 = "173lj66crwvhzwp1r812sc5h1hda7g6lb9l1y5zf7w3pw4dnzhrp";
   };
 
   outputs = [ "out" "dev" "devdoc" "info" ];
diff --git a/pkgs/development/libraries/libopus/default.nix b/pkgs/development/libraries/libopus/default.nix
index 4369169014c..10d438500a6 100644
--- a/pkgs/development/libraries/libopus/default.nix
+++ b/pkgs/development/libraries/libopus/default.nix
@@ -2,14 +2,14 @@
 , fixedPoint ? false, withCustomModes ? true }:
 
 let
-  version = "1.3";
+  version = "1.3.1";
 in
 stdenv.mkDerivation rec {
   name = "libopus-${version}";
 
   src = fetchurl {
     url = "https://archive.mozilla.org/pub/opus/opus-${version}.tar.gz";
-    sha256 = "0l651n19h0vhc0sn6w2c95hgqks1i8m4b3j04ncaznzjznp6jgag";
+    sha256 = "17gz8kxs4i7icsc1gj713gadiapyklynlwqlf0ai98dj4lg8xdb5";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libpipeline/default.nix b/pkgs/development/libraries/libpipeline/default.nix
index e11527ca10c..eabf2d2a106 100644
--- a/pkgs/development/libraries/libpipeline/default.nix
+++ b/pkgs/development/libraries/libpipeline/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "libpipeline-1.5.0";
+  name = "libpipeline-1.5.1";
 
   src = fetchurl {
     url = "mirror://savannah/libpipeline/${name}.tar.gz";
-    sha256 = "0avg525wvifcvjrwa6i1r6kvahmsswj0mpxrsxzzdzra9wpf2whd";
+    sha256 = "0bwh5xz5f2czwb7f564jz1mp4znm8pldnvf65fs0hpw4gmmp0cyn";
   };
 
   patches = stdenv.lib.optionals stdenv.isDarwin [ ./fix-on-osx.patch ];
diff --git a/pkgs/development/libraries/libsecret/default.nix b/pkgs/development/libraries/libsecret/default.nix
index d3b07dfb049..6c2723bbd90 100644
--- a/pkgs/development/libraries/libsecret/default.nix
+++ b/pkgs/development/libraries/libsecret/default.nix
@@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
   buildInputs = [ libgcrypt ];
   # optional: build docs with gtk-doc? (probably needs a flag as well)
 
+  configureFlags = [
+    "--with-libgcrypt-prefix=${libgcrypt.dev}"
+  ];
+
   enableParallelBuilding = true;
 
   installCheckInputs = [ python3 python3.pkgs.dbus-python python3.pkgs.pygobject3 xvfb_run dbus gnome3.gjs ];
diff --git a/pkgs/development/libraries/libsodium/default.nix b/pkgs/development/libraries/libsodium/default.nix
index fbff51b5ffb..51f779bca6b 100644
--- a/pkgs/development/libraries/libsodium/default.nix
+++ b/pkgs/development/libraries/libsodium/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "libsodium-1.0.16";
+  name = "libsodium-1.0.17";
 
   src = fetchurl {
     url = "https://download.libsodium.org/libsodium/releases/${name}.tar.gz";
-    sha256 = "0cq5pn7qcib7q70mm1lgjwj75xdxix27v0xl1xl0kvxww7hwgbgf";
+    sha256 = "1cf2d9v1gylz1qcy2zappbf526qfmph6gd6fnn3w2b347vixmhqc";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index f1b9d349a42..4d293e6fb39 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, fetchpatch, pkgconfig, cmake, zlib, openssl, libsodium }:
 
 stdenv.mkDerivation rec {
-  name = "libssh-0.8.5";
+  name = "libssh-0.8.7";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/0.8/${name}.tar.xz";
-    sha256 = "0dd3nmd20jw4z116qbz3wbffxbzrczi6mcxw0rmqzj0g4hqw9lh7";
+    sha256 = "14nmwfnnrhkwcfk5hn7azl905ivbh4wllmsbw5abd80b5yi4qc23";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/libssh2/default.nix b/pkgs/development/libraries/libssh2/default.nix
index a699ad48a8a..483a56dcdce 100644
--- a/pkgs/development/libraries/libssh2/default.nix
+++ b/pkgs/development/libraries/libssh2/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libssh2";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchurl {
     url = "${meta.homepage}/download/${pname}-${version}.tar.gz";
-    sha256 = "0ngif3ynk6xqzy5nlfjs7bsmfm81g9f145av0z86kf0vbgrigda0";
+    sha256 = "0rqd37pc80nm2pz4sa2m9pfc48axys7jwq1l7z0vii5nyvchg0q8";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 0a75fcbeda6..7b8ea82e03d 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchpatch, fetchFromGitHub, autoconf, automake, libtool, pkgconfig, ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.26.0";
+  version = "1.27.0";
   pname = "libuv";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "08jvjyn5bp4xnzd5g4pi534mklm6hz5pw6wbzbaq3cnwb6a04iwj";
+    sha256 = "1nhd3772qymlv0b251wg9rrqz279vki4hnd4s23yyll0kpmzkpac";
   };
 
   postPatch = let
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index da367b52cc0..a1e10b6d003 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "libwacom-${version}";
-  version = "0.32";
+  version = "0.33";
 
   src = fetchFromGitHub {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "15fz2z2h2awh2l08cv663s1zk4z8bmvvivwnnfvx2q8lkqgfkr7f";
+    sha256 = "0np0a7rpnlm9iqw1i8ycz5mprin6bb99p4h522v9vjk4lhzsp34m";
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
diff --git a/pkgs/development/libraries/nspr/default.nix b/pkgs/development/libraries/nspr/default.nix
index 9dfb3d3851f..4772f1111ac 100644
--- a/pkgs/development/libraries/nspr/default.nix
+++ b/pkgs/development/libraries/nspr/default.nix
@@ -2,14 +2,14 @@
 , CoreServices ? null
 , buildPackages }:
 
-let version = "4.20"; in
+let version = "4.21"; in
 
 stdenv.mkDerivation {
   name = "nspr-${version}";
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    sha256 = "0vjms4j75zvv5b2siyafg7hh924ysx2cwjad8spzp7x87n8n929c";
+    sha256 = "0nkbgk0x31nfm4xl8la0a3vrnpa8gzkh7g4k65p7n880n73k5shm";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/openjpeg/2.x.nix b/pkgs/development/libraries/openjpeg/2.x.nix
index 3aa2fdf0dd2..e865e2e8549 100644
--- a/pkgs/development/libraries/openjpeg/2.x.nix
+++ b/pkgs/development/libraries/openjpeg/2.x.nix
@@ -1,10 +1,10 @@
 { callPackage, fetchpatch, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "2.3.0";
+  version = "2.3.1";
   branch = "2.3";
   revision = "v${version}";
-  sha256 = "08plxrnfl33sn2vh5nwbsngyv6b1sfpplvx881crm1v1ai10m2lz";
+  sha256 = "1dn98d2dfa1lqyxxmab6rrcv52dyhjr4g7i4xf2w54fqsx14ynrb";
 
   extraFlags = [
     "-DOPENJPEG_INSTALL_INCLUDE_DIR=${placeholder "dev"}/include/openjpeg-${branch}"
@@ -12,20 +12,6 @@ callPackage ./generic.nix (args // rec {
   ];
 
   patches = [
-    (fetchpatch {
-      name = "CVE-2018-7648.patch";
-      url = "https://github.com/uclouvain/openjpeg/commit/cc3824767bde397fedb8a1ae4786a222ba860c8d.patch";
-      sha256 = "1j5nxmlgyfkxldk2f1ij6h850xw45q3b5brxqa04dxsfsv8cdj5j";
-    })
-    (fetchpatch {
-      name = "CVE-2017-17480+CVE-2018-18088.patch";
-      url = "https://github.com/uclouvain/openjpeg/commit/92023cd6c377e0384a7725949b25655d4d94dced.patch";
-      sha256 = "0rrxxqcp3vjkmvywxj9ac766m3fppy0x0nszrkf8irrqy1gnp38k";
-    })
-    (fetchpatch {
-      url = https://github.com/uclouvain/openjpeg/commit/24fd3ce777a64b8b315cfe1ee642ec7b1cc6aa97.patch;
-      sha256 = "1sl5wplgdfiqw8qbd8s5j5hq3ynbwgsnv8nxqfrk5s7vyrzx9pxv";
-    })
     ./fix-cmake-config-includedir.patch
   ];
 })
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 0a5f83d1c7c..04988debb72 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, openssl, cyrus_sasl, db, groff, libtool }:
 
 stdenv.mkDerivation rec {
-  name = "openldap-2.4.46";
+  name = "openldap-2.4.47";
 
   src = fetchurl {
     url = "https://www.openldap.org/software/download/OpenLDAP/openldap-release/${name}.tgz";
-    sha256 = "0bab1km8f2nan1x0zgwliknbxg0zlf2pafxrr867kblrdfwdr44s";
+    sha256 = "02sj0p1pq12hqq29b22m3f5zs2rykgvc0q3wlynxjcsjhrvmhk7m";
   };
 
   # TODO: separate "out" and "bin"
diff --git a/pkgs/development/libraries/pcre/default.nix b/pkgs/development/libraries/pcre/default.nix
index f9bd4ae91b4..6d2896ac339 100644
--- a/pkgs/development/libraries/pcre/default.nix
+++ b/pkgs/development/libraries/pcre/default.nix
@@ -8,7 +8,7 @@ with stdenv.lib;
 assert elem variant [ null "cpp" "pcre16" "pcre32" ];
 
 let
-  version = "8.42";
+  version = "8.43";
   pname = if (variant == null) then "pcre"
     else  if (variant == "cpp") then "pcre-cpp"
     else  variant;
@@ -18,7 +18,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://ftp.pcre.org/pub/pcre/pcre-${version}.tar.bz2";
-    sha256 = "00ckpzlgyr16bnqx8fawa3afjgqxw5yxgs2l081vw23qi1y4pl1c";
+    sha256 = "0sxg1wlknq05ryq63h21cchjmcjkin9lmnqsmhs3h08301965rwi";
   };
 
   outputs = [ "bin" "dev" "out" "doc" "man" ];
diff --git a/pkgs/development/libraries/phonon/default.nix b/pkgs/development/libraries/phonon/default.nix
index 82574864ec4..4d68d3718c0 100644
--- a/pkgs/development/libraries/phonon/default.nix
+++ b/pkgs/development/libraries/phonon/default.nix
@@ -6,7 +6,7 @@
 with lib;
 
 let
-  v = "4.10.1";
+  v = "4.10.2";
 
   soname = if withQt5 then "phonon4qt5" else "phonon";
   buildsystemdir = "share/cmake/${soname}";
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://kde/stable/phonon/${v}/phonon-${v}.tar.xz";
-    sha256 = "1dwdw0hm6685psrp7v9frhkhqvsxrbdnm3gw794j5z7g3brqvag5";
+    sha256 = "02c8fyyvg5qb0lxwxmnxc5grkg6p3halakjf02vmwmvqaycb3v9l";
   };
 
   buildInputs =
diff --git a/pkgs/development/python-modules/Nikola/default.nix b/pkgs/development/python-modules/Nikola/default.nix
index 55c6c6ec95f..06bcde602a7 100644
--- a/pkgs/development/python-modules/Nikola/default.nix
+++ b/pkgs/development/python-modules/Nikola/default.nix
@@ -19,7 +19,6 @@
 , PyRSS2Gen
 , Logbook
 , blinker
-, setuptools
 , natsort
 , requests
 , piexif
@@ -28,7 +27,6 @@
 , jinja2
 , Babel
 , freezegun
-, pyyaml
 , toml
 , notebook
 , ruamel_yaml
@@ -46,9 +44,11 @@ buildPythonPackage rec {
   checkInputs = [ pytest pytestcov mock glibcLocales freezegun ];
 
   propagatedBuildInputs = [
-    pygments pillow dateutil docutils Mako unidecode lxml Yapsy PyRSS2Gen
-    Logbook blinker setuptools natsort requests piexif markdown phpserialize
-    jinja2 doit Babel pyyaml toml notebook ruamel_yaml
+    # requirements.txt
+    doit pygments pillow dateutil docutils Mako markdown unidecode
+    lxml Yapsy PyRSS2Gen Logbook blinker natsort requests piexif Babel
+    # requirements-extras.txt
+    phpserialize jinja2 toml notebook ruamel_yaml
   ];
 
   src = fetchPypi {
diff --git a/pkgs/development/python-modules/canmatrix/default.nix b/pkgs/development/python-modules/canmatrix/default.nix
index 3e07188986d..a6c3f485d74 100644
--- a/pkgs/development/python-modules/canmatrix/default.nix
+++ b/pkgs/development/python-modules/canmatrix/default.nix
@@ -1,39 +1,53 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, python
+, pythonOlder
+, attrs
+, bitstruct
+, future
+, pathlib2
+, typing
 , lxml
 , xlwt
 , xlrd
 , XlsxWriter
 , pyyaml
-, future }:
+, pytest
+}:
 
 buildPythonPackage rec {
   pname = "canmatrix";
-  version = "0.6";
+  version = "0.7";
 
   # uses fetchFromGitHub as PyPi release misses test/ dir
   src = fetchFromGitHub {
     owner = "ebroecker";
     repo = pname;
     rev = version;
-    sha256 = "1lb0krhchja2jqfsh5lsfgmqcchs1pd38akvc407jfmll96f4yqz";
+    sha256 = "0q8qb282nfgirl8r2i9c8whm3hvr14ig2r42ssgnv2hya971cwjq";
   };
 
-  checkPhase = ''
-    cd test
-    ${python.interpreter} ./test.py
-  '';
+  propagatedBuildInputs = [
+    # required
+    attrs
+    bitstruct
+    future
+    pathlib2
+    # optional
+    lxml
+    xlwt
+    xlrd
+    XlsxWriter
+    pyyaml
+  ] ++ lib.optional (pythonOlder "3.5") typing;
 
-  propagatedBuildInputs =
-    [ lxml
-      xlwt
-      xlrd
-      XlsxWriter
-      pyyaml
-      future
-    ];
+  checkInputs = [
+    pytest
+  ];
+
+  checkPhase = ''
+    pytest -s src/canmatrix
+  '';
 
   meta = with lib; {
     homepage = https://github.com/ebroecker/canmatrix;
diff --git a/pkgs/development/python-modules/execnet/default.nix b/pkgs/development/python-modules/execnet/default.nix
index df78bff6f1d..7ad1f4267d0 100644
--- a/pkgs/development/python-modules/execnet/default.nix
+++ b/pkgs/development/python-modules/execnet/default.nix
@@ -1,5 +1,7 @@
 { stdenv
+, lib
 , buildPythonPackage
+, isPyPy
 , fetchPypi
 , pytest_3
 , setuptools_scm
@@ -15,7 +17,7 @@ buildPythonPackage rec {
     sha256 = "a7a84d5fa07a089186a329528f127c9d73b9de57f1a1131b82bb5320ee651f6a";
   };
 
-  checkInputs = [ pytest_3  ];
+  checkInputs = [ pytest_3 ];
   nativeBuildInputs = [ setuptools_scm ];
   propagatedBuildInputs = [ apipkg ];
 
@@ -25,6 +27,7 @@ buildPythonPackage rec {
     rm -v testing/test_channel.py
     rm -v testing/test_xspec.py
     rm -v testing/test_gateway.py
+    ${lib.optionalString isPyPy "rm -v testing/test_multi.py"}
   '';
 
   checkPhase = ''
diff --git a/pkgs/development/python-modules/intake/default.nix b/pkgs/development/python-modules/intake/default.nix
index 4434ea0edc1..2646ee1b936 100644
--- a/pkgs/development/python-modules/intake/default.nix
+++ b/pkgs/development/python-modules/intake/default.nix
@@ -21,12 +21,12 @@
 
 buildPythonPackage rec {
   pname = "intake";
-  version = "0.4.1";
+  version = "0.4.4";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f47e53aa764eeadf6adcc667b9817b1ad32496477476da0b982d4fc0744b40ef";
+    sha256 = "3fc1b7c2949c9b4200ecbbfdff17da126981a1d8d95ccb7b7bcca3e3dd849d5e";
   };
 
   checkInputs = [ pytest ];
@@ -47,8 +47,9 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
-    # single test assumes python for executable name
-    PATH=$out/bin:$PATH HOME=$(mktemp -d) pytest --ignore=intake/catalog/tests/test_default.py
+    # test_filtered_compressed_cache requires calvert_uk_filter.tar.gz, which is not included in tarball
+    # test_which assumes python for executable name
+    PATH=$out/bin:$PATH HOME=$(mktemp -d) pytest -k "not test_filtered_compressed_cache and not test_which"
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/kaptan/default.nix b/pkgs/development/python-modules/kaptan/default.nix
index 35194294e9d..aada19dd45b 100644
--- a/pkgs/development/python-modules/kaptan/default.nix
+++ b/pkgs/development/python-modules/kaptan/default.nix
@@ -13,6 +13,12 @@ buildPythonPackage rec {
     sha256 = "8403d6e48200c3f49cb6d6b3dcb5898aa5ab9d820831655bf9a2403e00cd4207";
   };
 
+  # https://github.com/emre/kaptan/pull/151
+  postPatch = ''
+    substituteInPlace requirements/base.txt \
+      --replace "PyYAML>=3.13,<4" "PyYAML>=3.13"
+  '';
+
   propagatedBuildInputs = [ pyyaml ];
 
   # No tests in archive
diff --git a/pkgs/development/python-modules/magic-wormhole-transit-relay/default.nix b/pkgs/development/python-modules/magic-wormhole-transit-relay/default.nix
index a553a3bf433..5ddece686fa 100644
--- a/pkgs/development/python-modules/magic-wormhole-transit-relay/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole-transit-relay/default.nix
@@ -14,7 +14,7 @@ buildPythonPackage rec {
   checkInputs = [ mock ];
 
   checkPhase = ''
-    python -m twisted.trial wormhole_transit_relay
+    ${twisted}/bin/trial wormhole_transit_relay
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/mock/default.nix b/pkgs/development/python-modules/mock/default.nix
index 142383b8db7..8ab724144f7 100644
--- a/pkgs/development/python-modules/mock/default.nix
+++ b/pkgs/development/python-modules/mock/default.nix
@@ -20,6 +20,12 @@ buildPythonPackage rec {
   buildInputs = [ unittest2 ];
   propagatedBuildInputs = [ funcsigs six pbr ];
 
+  # On PyPy for Python 2.7 in particular, Mock's tests have a known failure.
+  # Mock upstream has a decoration to disable the failing test and make
+  # everything pass, but it is not yet released. The commit:
+  # https://github.com/testing-cabal/mock/commit/73bfd51b7185#diff-354f30a63fb0907d4ad57269548329e3L12
+  doCheck = !(python.isPyPy && python.isPy27);
+
   checkPhase = ''
     ${python.interpreter} -m unittest discover
   '';
diff --git a/pkgs/development/python-modules/mt-940/default.nix b/pkgs/development/python-modules/mt-940/default.nix
index 820b4c1696b..f3965b8a74a 100644
--- a/pkgs/development/python-modules/mt-940/default.nix
+++ b/pkgs/development/python-modules/mt-940/default.nix
@@ -1,36 +1,27 @@
-{ buildPythonPackage, stdenv, pyyaml, pytest, enum34
-, pytestpep8, pytest-flakes, fetchFromGitHub, isPy3k, lib, glibcLocales
+{ lib, buildPythonPackage, fetchPypi, isPy3k
+, enum34, pyyaml, pytest
 }:
 
 buildPythonPackage rec {
-  version = "4.13.2";
+  version = "4.15.0";
   pname = "mt-940";
 
-  # No tests in PyPI tarball
-  # See https://github.com/WoLpH/mt940/pull/72
-  src = fetchFromGitHub {
-    owner = "WoLpH";
-    repo = "mt940";
-    rev = "v${version}";
-    sha256 = "1lvw3qyv7qhjabcvg55br8x4pnc7hv8xzzaf6wnr8cfjg0q7dzzg";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "4c1d5c23a9c3fec12a61ce3f61d8be107b4693be4a4b97381eca23f4a4dca8ed";
   };
 
-  postPatch = ''
-    # No coverage report
-    sed -i "/--\(no-\)\?cov/d" pytest.ini
-  '';
-
   propagatedBuildInputs = lib.optional (!isPy3k) enum34;
 
-  checkInputs = [ pyyaml pytestpep8 pytest-flakes pytest ];
+  checkInputs = [ pyyaml pytest ];
 
   checkPhase = ''
     py.test
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "A library to parse MT940 files and returns smart Python collections for statistics and manipulation";
-    inherit (src.meta) homepage;
+    homepage = https://github.com/WoLpH/mt940;
     license = licenses.bsd3;
   };
 }
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index b74bbf581d8..e479542c509 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchPypi, python, buildPythonPackage, isPyPy, gfortran, pytest, blas, writeTextFile }:
+{ stdenv, lib, fetchPypi, python, buildPythonPackage, gfortran, pytest, blas, writeTextFile }:
 
 let
   blasImplementation = lib.nameFromURL blas.name "-";
@@ -24,7 +24,6 @@ in buildPythonPackage rec {
     sha256 = "1c4inssky16p6ab63n1gass6dik1dzxrp3y7kmxbdq6xg4w2wsbc";
   };
 
-  disabled = isPyPy;
   nativeBuildInputs = [ gfortran pytest ];
   buildInputs = [ blas ];
 
diff --git a/pkgs/development/python-modules/pyasn1-modules/default.nix b/pkgs/development/python-modules/pyasn1-modules/default.nix
index 0bef3f9e69f..6ab9d3c7c3a 100644
--- a/pkgs/development/python-modules/pyasn1-modules/default.nix
+++ b/pkgs/development/python-modules/pyasn1-modules/default.nix
@@ -3,7 +3,6 @@
 buildPythonPackage rec {
   pname = "pyasn1-modules";
   version = "0.2.4";
-  disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/pycryptopp/default.nix b/pkgs/development/python-modules/pycryptopp/default.nix
index 06045a58393..8bb472d8fde 100644
--- a/pkgs/development/python-modules/pycryptopp/default.nix
+++ b/pkgs/development/python-modules/pycryptopp/default.nix
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchPypi
 , isPy3k
-, isPyPy
 , setuptoolsDarcs
 , darcsver
 , pkgs
@@ -11,7 +10,7 @@
 buildPythonPackage rec {
   pname = "pycryptopp";
   version = "0.7.1.869544967005693312591928092448767568728501330214";
-  disabled = isPy3k || isPyPy;  # see https://bitbucket.org/pypy/pypy/issue/1190/
+  disabled = isPy3k;  # see https://bitbucket.org/pypy/pypy/issue/1190/
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/python-modules/pytest-shutil/default.nix b/pkgs/development/python-modules/pytest-shutil/default.nix
index fedf5010b2b..c5444708be8 100644
--- a/pkgs/development/python-modules/pytest-shutil/default.nix
+++ b/pkgs/development/python-modules/pytest-shutil/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, fetchPypi
+{ stdenv, lib, isPyPy, buildPythonPackage, fetchPypi
 , pytest_3, cmdline, pytestcov, coverage, setuptools-git, mock, pathpy, execnet
 , contextlib2, termcolor }:
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   nativeBuildInputs = [ pytest_3 ];
 
   checkPhase = ''
-    py.test
+    py.test ${lib.optionalString isPyPy "-k'not (test_run or test_run_integration)'"}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/pytoml/default.nix b/pkgs/development/python-modules/pytoml/default.nix
index 91661a1fb51..d65de812323 100644
--- a/pkgs/development/python-modules/pytoml/default.nix
+++ b/pkgs/development/python-modules/pytoml/default.nix
@@ -1,23 +1,29 @@
 { stdenv
 , buildPythonPackage
-, fetchgit
+, fetchFromGitHub
 , python
+, pytest
 }:
 
 buildPythonPackage rec {
   pname = "pytoml";
-  version = "0.1.14";
+  version = "0.1.20";
+
+  src = fetchFromGitHub {
+    owner = "avakar";
+    repo = "pytoml";
+    rev = "v${version}";
+    fetchSubmodules = true; # ensure test submodule is available
+    sha256 = "02hjq44zhh6z0fsbm3hvz34sav6fic90sjrw8g1pkdvskzzl46mz";
+  };
+
+  checkInputs = [ pytest ];
 
   checkPhase = ''
     ${python.interpreter} test/test.py
+    pytest test
   '';
 
-  # fetchgit used to ensure test submodule is available
-  src = fetchgit {
-    url = "${meta.homepage}.git";
-    rev = "refs/tags/v${version}";
-    sha256 = "1ip71yqxnyi4jhw5x1q7a0za61ndhpfh0vbx08jfv0w4ayng6rgv";
-  };
 
   meta = with stdenv.lib; {
     description = "A TOML parser/writer for Python";
diff --git a/pkgs/development/python-modules/pyyaml/default.nix b/pkgs/development/python-modules/pyyaml/default.nix
index b4732e34c4e..84dfb549fe1 100644
--- a/pkgs/development/python-modules/pyyaml/default.nix
+++ b/pkgs/development/python-modules/pyyaml/default.nix
@@ -1,17 +1,22 @@
-{ lib, buildPythonPackage, fetchPypi, libyaml, buildPackages }:
+{ lib, buildPythonPackage, fetchPypi, cython, libyaml, buildPackages }:
 
 buildPythonPackage rec {
   pname = "PyYAML";
-  version = "3.13";
+  version = "5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "3ef3092145e9b70e3ddd2c7ad59bdd0252a94dfe3949721633e41344de00a6bf";
+    sha256 = "436bc774ecf7c103814098159fbb84c2715d25980175292c648f2da143909f95";
   };
 
-  nativeBuildInputs = [ buildPackages.stdenv.cc ];
+  # force regeneration using Cython
+  postPatch = ''
+    rm ext/_yaml.c
+  '';
 
-  propagatedBuildInputs = [ libyaml ];
+  nativeBuildInputs = [ cython buildPackages.stdenv.cc ];
+
+  buildInputs = [ libyaml ];
 
   meta = with lib; {
     description = "The next generation YAML parser and emitter for Python";
diff --git a/pkgs/development/python-modules/typing/default.nix b/pkgs/development/python-modules/typing/default.nix
index e363ca22cf2..5c5ecd8949a 100644
--- a/pkgs/development/python-modules/typing/default.nix
+++ b/pkgs/development/python-modules/typing/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy3k, python }:
+{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy3k, isPyPy, python }:
 
 let
   testDir = if isPy3k then "src" else "python2";
@@ -14,7 +14,8 @@ in buildPythonPackage rec {
 
   # Error for Python3.6: ImportError: cannot import name 'ann_module'
   # See https://github.com/python/typing/pull/280
-  doCheck = pythonOlder "3.6";
+  # Also, don't bother on PyPy: AssertionError: TypeError not raised
+  doCheck = pythonOlder "3.6" && !isPyPy;
 
   checkPhase = ''
     cd ${testDir}
diff --git a/pkgs/development/python-modules/werkzeug/default.nix b/pkgs/development/python-modules/werkzeug/default.nix
index 19945785eed..d0397d61605 100644
--- a/pkgs/development/python-modules/werkzeug/default.nix
+++ b/pkgs/development/python-modules/werkzeug/default.nix
@@ -14,6 +14,13 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ itsdangerous ];
   checkInputs = [ pytest requests hypothesis ];
 
+  # Hi! New version of Werkzeug? Please double-check that this commit is
+  # inclucded, and then remove the following patch.
+  # https://github.com/pallets/werkzeug/commit/1cfdcf9824cb20e362979e8f7734012926492165
+  patchPhase = ''
+    substituteInPlace "tests/test_serving.py" --replace "'python'" "sys.executable"
+  '';
+
   checkPhase = ''
     pytest ${stdenv.lib.optionalString stdenv.isDarwin "-k 'not test_get_machine_id'"}
   '';
diff --git a/pkgs/development/python-modules/zfec/default.nix b/pkgs/development/python-modules/zfec/default.nix
index 0e18de7d502..9193c2ddc08 100644
--- a/pkgs/development/python-modules/zfec/default.nix
+++ b/pkgs/development/python-modules/zfec/default.nix
@@ -3,13 +3,11 @@
 , fetchPypi
 , setuptoolsDarcs
 , pyutil
-, isPyPy
 }:
 
 buildPythonPackage rec {
   pname = "zfec";
   version = "1.5.3";
-  disabled = isPyPy;
 
   src = fetchPypi {
     inherit pname version;
diff --git a/pkgs/development/tools/build-managers/conan/default.nix b/pkgs/development/tools/build-managers/conan/default.nix
index 8ae56834702..ed7babf4933 100644
--- a/pkgs/development/tools/build-managers/conan/default.nix
+++ b/pkgs/development/tools/build-managers/conan/default.nix
@@ -37,6 +37,13 @@ let newPython = python3.override {
         sha256 = "c0abe3218b86533cca287e7057a37481883c07acef7814b70583406938214cc8";
       };
     });
+    pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
+      version = "3.13";
+      src = oldAttrs.src.override {
+        inherit version;
+        sha256 = "3ef3092145e9b70e3ddd2c7ad59bdd0252a94dfe3949721633e41344de00a6bf";
+      };
+    });
   };
 };
 
diff --git a/pkgs/development/tools/remarshal/default.nix b/pkgs/development/tools/remarshal/default.nix
index 6632d062633..10bfd0c2f2d 100644
--- a/pkgs/development/tools/remarshal/default.nix
+++ b/pkgs/development/tools/remarshal/default.nix
@@ -2,13 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "remarshal";
-  version = "0.8.0";
+  version = "0.9.1";
 
-  src = fetchFromGitHub {
-    owner  = "dbohdan";
-    repo   = "remarshal";
-    rev    = "v${version}";
-    sha256 = "192r1mfd5yj6kg6fqmkjngdlgn25g5rkvm0p6xaflpvavnhvhnsj";
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "564ffe9cbde85bd28a9c184b90c764abd2003abd6101a30802262198b5c7fc40";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix
index 3089fe93dea..ef39e9f2fb5 100644
--- a/pkgs/misc/cups/default.nix
+++ b/pkgs/misc/cups/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   name = "cups-${version}";
 
   # After 2.2.6, CUPS requires headers only available in macOS 10.12+
-  version = if stdenv.isDarwin then "2.2.6" else "2.2.10";
+  version = if stdenv.isDarwin then "2.2.6" else "2.2.11";
 
   passthru = { inherit version; };
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
     sha256 = if version == "2.2.6"
              then "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20"
-             else "1fq52aw1mini3ld2czv5gg37wbbvh4n7yc7wzzxvbs3zpfrv5j3p";
+             else "0v5p10lyv8wv48s8ghkhjmdrxg6iwj8hn36v1ilkz46n7y0i107m";
   };
 
   outputs = [ "out" "lib" "dev" "man" ];
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index c8edd865479..d05eaf4b84e 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -6,11 +6,11 @@
 assert enablePython -> python != null;
 
 stdenv.mkDerivation rec {
-  name = "audit-2.8.4";
+  name = "audit-2.8.5";
 
   src = fetchurl {
     url = "https://people.redhat.com/sgrubb/audit/${name}.tar.gz";
-    sha256 = "0f4ci6ffznnmgblwgv7ich9mjfk3p6y5l6m6h3chhmzw156nj454";
+    sha256 = "1dzcwb2q78q7x41shcachn7f4aksxbxd470yk38zh03fch1l2p8f";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
     # and pulls in an extra openldap dependency otherwise
     "--disable-zos-remote"
     (if enablePython then "--with-python" else "--without-python")
+    "--with-arm"
+    "--with-aarch64"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix
index 7cbf6cb7cee..d68e538d671 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexectools/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "kexec-tools-${version}";
-  version = "2.0.18";
+  version = "2.0.19";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${name}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${name}.tar.xz"
     ];
-    sha256 = "0f5jnb0470nmxyl1cz2687hqjr8cwqniqc1ycq9bazlp85rz087h";
+    sha256 = "03jyi4c47ywclycf3a253xpqs7p6ys8inz9q66b8m3xc6nrh307d";
   };
 
   hardeningDisable = [ "format" "pic" "relro" "pie" ];
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index 9db581ad527..5a5da4dfc71 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "linux-pam-${version}";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchurl {
-    url = "http://www.linux-pam.org/library/Linux-PAM-${version}.tar.bz2";
-    sha256 = "1fyi04d5nsh8ivd0rn2y0z83ylgc0licz7kifbb6xxi2ylgfs6i4";
+    url    = "https://github.com/linux-pam/linux-pam/releases/download/v1.3.1/Linux-PAM-${version}.tar.xz";
+    sha256 = "1nyh9kdi3knhxcbv5v4snya0g3gff0m671lnvqcbygw3rm77mx7g";
   };
 
   patches = stdenv.lib.optionals (stdenv.hostPlatform.libc == "musl") [
diff --git a/pkgs/os-specific/linux/udisks/1-default.nix b/pkgs/os-specific/linux/udisks/1-default.nix
index d48c21f6b52..03c48867b34 100644
--- a/pkgs/os-specific/linux/udisks/1-default.nix
+++ b/pkgs/os-specific/linux/udisks/1-default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
       substituteInPlace src/main.c --replace \
         "/sbin:/bin:/usr/sbin:/usr/bin" \
-        "${utillinux}/bin:${mdadm}/sbin:/var/run/current-system/sw/bin:/var/run/current-system/sw/bin"
+        "${utillinux}/bin:${mdadm}/sbin:/run/current-system/sw/bin:/run/current-system/sw/bin"
     '';
 
   buildInputs =
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index ec18c25ee66..3e94ba5c1ea 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -39,7 +39,7 @@ in stdenv.mkDerivation rec {
     "--enable-last"
     "--enable-mesg"
     "--disable-use-tty-group"
-    "--enable-fs-paths-default=/run/wrappers/bin:/var/run/current-system/sw/bin:/sbin"
+    "--enable-fs-paths-default=/run/wrappers/bin:/run/current-system/sw/bin:/sbin"
     "--disable-makeinstall-setuid" "--disable-makeinstall-chown"
     (lib.withFeature (ncurses != null) "ncursesw")
     (lib.withFeature (systemd != null) "systemd")
diff --git a/pkgs/servers/asterisk/runtime-vardirs.patch b/pkgs/servers/asterisk/runtime-vardirs.patch
index 17959bac9a0..498c62ee4d8 100644
--- a/pkgs/servers/asterisk/runtime-vardirs.patch
+++ b/pkgs/servers/asterisk/runtime-vardirs.patch
@@ -5,7 +5,7 @@ diff -rupN asterisk-14.1.2/build_tools/make_defaults_h asterisk-14.1.2-patched/b
  #!/bin/sh
 +
 +ASTLOGDIR=/var/log/asterisk
-+ASTVARRUNDIR=/var/run/asterisk
++ASTVARRUNDIR=/run/asterisk
 +ASTVARLIBDIR=/var/lib/asterisk
 +ASTDBDIR=${ASTVARLIBDIR}
 +ASTDATADIR=${ASTVARLIBDIR}
diff --git a/pkgs/servers/dict/libmaa.nix b/pkgs/servers/dict/libmaa.nix
index 3c04a678def..f5c0cf230af 100644
--- a/pkgs/servers/dict/libmaa.nix
+++ b/pkgs/servers/dict/libmaa.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ libtool ];
-  # configureFlags = [ "--datadir=/var/run/current-system/share/dictd" ];
+  # configureFlags = [ "--datadir=/run/current-system/share/dictd" ];
 
   meta = with stdenv.lib; {
     description = "Dict protocol server and client";
diff --git a/pkgs/servers/mail/rspamd/default.nix b/pkgs/servers/mail/rspamd/default.nix
index 756796d6201..f14d36f1efb 100644
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DDEBIAN_BUILD=ON"
-    "-DRUNDIR=/var/run/rspamd"
+    "-DRUNDIR=/run/rspamd"
     "-DDBDIR=/var/lib/rspamd"
     "-DLOGDIR=/var/log/rspamd"
     "-DLOCAL_CONFDIR=/etc/rspamd"
diff --git a/pkgs/tools/admin/awscli/default.nix b/pkgs/tools/admin/awscli/default.nix
index c36b6d2fbd6..e09833869d6 100644
--- a/pkgs/tools/admin/awscli/default.nix
+++ b/pkgs/tools/admin/awscli/default.nix
@@ -21,6 +21,13 @@ let
           sha256 = "48eb22f4f8461b1df5734a074b57042430fb06e1d61bd1e11b078c0fe6d7a1f1";
         };
       });
+      pyyaml = super.pyyaml.overridePythonAttrs (oldAttrs: rec {
+        version = "3.13";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "3ef3092145e9b70e3ddd2c7ad59bdd0252a94dfe3949721633e41344de00a6bf";
+        };
+      });
     };
   };
 
diff --git a/pkgs/tools/archivers/gnutar/default.nix b/pkgs/tools/archivers/gnutar/default.nix
index 8ec34ce6730..b64696a3420 100644
--- a/pkgs/tools/archivers/gnutar/default.nix
+++ b/pkgs/tools/archivers/gnutar/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "gnutar-${version}";
-  version = "1.31";
+  version = "1.32";
 
   src = fetchurl {
     url = "mirror://gnu/tar/tar-${version}.tar.xz";
-    sha256 = "1h9dxhjhz1jnyhmh6jfhqw1g1sxqbg3cd32vpwg7x2xxxqffzwrp";
+    sha256 = "1n7xy657ii0sa42zx6944v2m4v9qrh6sqgmw17l3nch3y43sxlyh";
   };
 
   # avoid retaining reference to CF during stdenv bootstrap
diff --git a/pkgs/tools/backup/bareos/default.nix b/pkgs/tools/backup/bareos/default.nix
index 5cf675a9af1..ad0001f22e1 100644
--- a/pkgs/tools/backup/bareos/default.nix
+++ b/pkgs/tools/backup/bareos/default.nix
@@ -42,8 +42,8 @@ stdenv.mkDerivation rec {
     "--with-working-dir=/var/lib/bareos"
     "--with-bsrdir=/var/lib/bareos"
     "--with-logdir=/var/log/bareos"
-    "--with-pid-dir=/var/run/bareos"
-    "--with-subsys-dir=/var/run/bareos"
+    "--with-pid-dir=/run/bareos"
+    "--with-subsys-dir=/run/bareos"
     "--enable-ndmp"
     "--enable-lmdb"
     "--enable-batch-insert"
diff --git a/pkgs/tools/backup/btrbk/default.nix b/pkgs/tools/backup/btrbk/default.nix
index 9c749bd7bdd..2df609384c1 100644
--- a/pkgs/tools/backup/btrbk/default.nix
+++ b/pkgs/tools/backup/btrbk/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "btrbk-${version}";
-  version = "0.27.1";
+  version = "0.27.2";
 
   src = fetchurl {
     url = "https://digint.ch/download/btrbk/releases/${name}.tar.xz";
-    sha256 = "040f6qzv188yd38n11zdiin3gaavrlld36xf1ks4hxhq921bh0jc";
+    sha256 = "1xxpwlvijzgvn17sag9gx3vbmk82plmyp19wah714z3j07djczh2";
   };
 
   nativeBuildInputs = [ asciidoc makeWrapper ];
diff --git a/pkgs/tools/misc/fontforge/default.nix b/pkgs/tools/misc/fontforge/default.nix
index 04717974a8b..33a44dccc2d 100644
--- a/pkgs/tools/misc/fontforge/default.nix
+++ b/pkgs/tools/misc/fontforge/default.nix
@@ -1,26 +1,26 @@
-{ stdenv, fetchFromGitHub, lib
+{ stdenv, fetchurl, lib
 , autoconf, automake, gnum4, libtool, perl, gnulib, uthash, pkgconfig, gettext
-, python, freetype, zlib, glib, libungif, libpng, libjpeg, libtiff, libxml2, pango
+, python, freetype, zlib, glib, libungif, libpng, libjpeg, libtiff, libxml2, cairo, pango
+, readline, woff2, zeromq
 , withSpiro ? false, libspiro
 , withGTK ? false, gtk2
 , withPython ? true
+, withExtras ? true
 , Carbon ? null, Cocoa ? null
 }:
 
 stdenv.mkDerivation rec {
-  name = "fontforge-${version}";
-  version = "20170730";
+  pname = "fontforge";
+  version = "20190317";
 
-  src = fetchFromGitHub {
-    owner = "fontforge";
-    repo = "fontforge";
-    rev = version;
-    sha256 = "15k6x97383p8l40jvcivalhwgbbcdg5vciyjz6m9r0lrlnjqkv99";
+  src = fetchurl {
+    url = "https://github.com/${pname}/${pname}/releases/download/${version}/${pname}-${version}.tar.gz";
+    sha256 = "1ddqbpc32cgbccdnv0lfw0qhj59hcqzb7616ph5lkvm91pnas4dp";
   };
 
   patches = [ ./fontforge-20140813-use-system-uthash.patch ];
 
-  # use $SOURCE_DATE_EPOCH instead of non-determenistic timestamps
+  # use $SOURCE_DATE_EPOCH instead of non-deterministic timestamps
   postPatch = ''
     find . -type f -name '*.c' -exec sed -r -i 's#\btime\(&(.+)\)#if (getenv("SOURCE_DATE_EPOCH")) \1=atol(getenv("SOURCE_DATE_EPOCH")); else &#g' {} \;
     sed -r -i 's#author\s*!=\s*NULL#& \&\& !getenv("SOURCE_DATE_EPOCH")#g'                            fontforge/cvexport.c fontforge/dumppfa.c fontforge/print.c fontforge/svg.c fontforge/splineutil2.c
@@ -32,19 +32,20 @@ stdenv.mkDerivation rec {
   # do not use x87's 80-bit arithmetic, rouding errors result in very different font binaries
   NIX_CFLAGS_COMPILE = lib.optionals stdenv.isi686 [ "-msse2" "-mfpmath=sse" ];
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig autoconf automake gnum4 libtool perl gettext ];
   buildInputs = [
-    autoconf automake gnum4 libtool perl gettext uthash
+    readline uthash woff2 zeromq
     python freetype zlib glib libungif libpng libjpeg libtiff libxml2
   ]
     ++ lib.optionals withSpiro [libspiro]
-    ++ lib.optionals withGTK [ gtk2 pango ]
+    ++ lib.optionals withGTK [ gtk2 cairo pango ]
     ++ lib.optionals stdenv.isDarwin [ Carbon Cocoa ];
 
-  configureFlags =
-    lib.optionals (!withPython) [ "--disable-python-scripting" "--disable-python-extension" ]
+    configureFlags = [ "--enable-woff2" ]
+    ++ lib.optionals (!withPython) [ "--disable-python-scripting" "--disable-python-extension" ]
     ++ lib.optional withGTK "--enable-gtk2-use"
-    ++ lib.optional (!withGTK) "--without-x";
+    ++ lib.optional (!withGTK) "--without-x"
+    ++ lib.optional withExtras "--enable-fontforge-extras";
 
   # work-around: git isn't really used, but configuration fails without it
   preConfigure = ''
@@ -54,7 +55,7 @@ stdenv.mkDerivation rec {
     export GIT="$(type -P true)"
     cp -r "${gnulib}" ./gnulib
     chmod +w -R ./gnulib
-    ./bootstrap --skip-git --gnulib-srcdir=./gnulib
+    ./bootstrap --skip-git --gnulib-srcdir=./gnulib --force
   '';
 
   doCheck = false; # tries to wget some fonts
diff --git a/pkgs/tools/misc/fontforge/fontforge-20140813-use-system-uthash.patch b/pkgs/tools/misc/fontforge/fontforge-20140813-use-system-uthash.patch
index 27c8274c1d2..fb53c619b2b 100644
--- a/pkgs/tools/misc/fontforge/fontforge-20140813-use-system-uthash.patch
+++ b/pkgs/tools/misc/fontforge/fontforge-20140813-use-system-uthash.patch
@@ -8,10 +8,11 @@
  EXTRA_DIST =
  CLEANFILES =
  MOSTLYCLEANFILES =
-@@ -113,7 +112,6 @@
+@@ -113,8 +112,7 @@
  	Packaging/FontForge-doc.spec \
  	Packaging/FontForge.spec \
  	Packaging/FontForge.static.spec \
+ 	README \
 -	uthash/src \
  	$(NULL)
  
diff --git a/pkgs/tools/misc/fontforge/fontforge-fonttools.nix b/pkgs/tools/misc/fontforge/fontforge-fonttools.nix
index 551fc71b7a7..ea4acfc5f0b 100644
--- a/pkgs/tools/misc/fontforge/fontforge-fonttools.nix
+++ b/pkgs/tools/misc/fontforge/fontforge-fonttools.nix
@@ -1,32 +1 @@
-{ stdenv, fetchFromGitHub, zlib }:
-
-stdenv.mkDerivation rec {
-  version = "20160404";
-  name = "fontforge-fonttools-${version}";
-
-  src = fetchFromGitHub {
-    owner = "fontforge";
-    repo = "fontforge";
-    rev = version;
-    sha256 = "15nacq84n9gvlzp3slpmfrrbh57kfb6lbdlc46i7aqgci4qv6fg0";
-  };
-
-  buildInputs = [ zlib ];
-
-  setSourceRoot = ''export sourceRoot="$(echo */contrib/fonttools)"'';
-
-  installPhase = ''
-    mkdir -p "$out"/{bin,share/doc/fontforge-fonttools}
-    for i in *.c; do
-      $CC "$i" -lz -lm --std=c99 -o "$out"/bin/$(basename "$i" .c)
-    done
-    cp README* "$out/share/doc/fontforge-fonttools"
-  '';
-
-  meta = with stdenv.lib; {
-    description = ''Small font tools shipped in FontForge contrib'';
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ raskin ];
-    platforms = with platforms; unix;
-  };
-}
+{ fontforge }: fontforge.override { withExtras = true; }
diff --git a/pkgs/tools/misc/mandoc/default.nix b/pkgs/tools/misc/mandoc/default.nix
index f485cb95f5d..9ddd9218801 100644
--- a/pkgs/tools/misc/mandoc/default.nix
+++ b/pkgs/tools/misc/mandoc/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "mandoc-${version}";
-  version = "1.14.4";
+  version = "1.14.5";
 
   src = fetchurl {
     url = "https://mandoc.bsd.lv/snapshots/mandoc-${version}.tar.gz";
-    sha256 = "24eb72103768987dcc63b53d27fdc085796330782f44b3b40c4660b1e1ee9b9c";
+    sha256 = "1xyqllxpjj1kimlipx11pzyywf5c25i4wmv0lqm7ph3gnlnb86c2";
   };
 
   buildInputs = [ zlib ];
diff --git a/pkgs/tools/misc/pubs/default.nix b/pkgs/tools/misc/pubs/default.nix
index fcf67870e87..4e840957ce3 100644
--- a/pkgs/tools/misc/pubs/default.nix
+++ b/pkgs/tools/misc/pubs/default.nix
@@ -11,11 +11,18 @@ python3Packages.buildPythonApplication rec {
     sha256 = "16zwdqfbmlla6906g3a57a4nj8wnl11fq78r20qms717bzv211j0";
   };
 
-  # Fix for bibtexparser 1.1.0
-  patches = fetchpatch {
-    url = https://github.com/pubs/pubs/pull/185/commits/e58ae98b93b8364a07fd5f5f452ba88ad332c948.patch;
-    sha256 = "1n7zrk119v395jj8wqg8wlymc9l9pq3v752yy3kam9kflc0aashp";
-  };
+  patches = [
+    # Fix for bibtexparser 1.1.0
+    (fetchpatch {
+      url = https://github.com/pubs/pubs/pull/185/commits/e58ae98b93b8364a07fd5f5f452ba88ad332c948.patch;
+      sha256 = "1n7zrk119v395jj8wqg8wlymc9l9pq3v752yy3kam9kflc0aashp";
+    })
+    # Fix test broken by PyYAML 5.1
+    (fetchpatch {
+      url = https://github.com/pubs/pubs/pull/194/commits/c3cb713ae76528eeeaaeb948fe319a76ab3934d8.patch;
+      sha256 = "05as418m7wzs65839bb91b2jrs8l68z8ldcjcd9cn4b9fcgsf3rk";
+    })
+  ];
 
   propagatedBuildInputs = with python3Packages; [
     argcomplete dateutil configobj feedparser bibtexparser pyyaml requests six beautifulsoup4
diff --git a/pkgs/tools/misc/timidity/timidity.cfg b/pkgs/tools/misc/timidity/timidity.cfg
index fda915729ae..fa07eb43eee 100644
--- a/pkgs/tools/misc/timidity/timidity.cfg
+++ b/pkgs/tools/misc/timidity/timidity.cfg
@@ -41,8 +41,8 @@
 # point to the library directory: 
 #
 
-dir /var/run/current-system/sw/share/timidity/instruments
-dir /var/run/current-system/sw/share/timidity/patch
+dir /run/current-system/sw/share/timidity/instruments
+dir /run/current-system/sw/share/timidity/patch
 
 ##############################################################################
 # This sets up the default patches in the TiMidity support package
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index 45ff2947c68..29e64205a2b 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -24,14 +24,14 @@ assert brotliSupport -> brotli != null;
 assert gssSupport -> libkrb5 != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.64.0";
+  name = "curl-7.64.1";
 
   src = fetchurl {
     urls = [
       "https://curl.haxx.se/download/${name}.tar.bz2"
       "https://github.com/curl/curl/releases/download/${lib.replaceStrings ["."] ["_"] name}/${name}.tar.bz2"
     ];
-    sha256 = "1szj9ia1snbfqzfcsk6hx1j7jhbqsy0f9k5d7x9xiy8w5lfblwym";
+    sha256 = "0pd484nk4q4dxjilwla3bw1l1jy44043xs991xld0l2jncwcgisc";
   };
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
diff --git a/pkgs/tools/networking/dhcp/default.nix b/pkgs/tools/networking/dhcp/default.nix
index 41074e3dad6..6987bc553a5 100644
--- a/pkgs/tools/networking/dhcp/default.nix
+++ b/pkgs/tools/networking/dhcp/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, perl, file, nettools, iputils, iproute, makeWrapper
 , coreutils, gnused, openldap ? null
+, buildPackages, lib
 }:
 
 stdenv.mkDerivation rec {
@@ -19,7 +20,11 @@ stdenv.mkDerivation rec {
       ./set-hostname.patch
     ];
 
-  buildInputs = [ perl makeWrapper openldap ];
+  nativeBuildInputs = [ perl ];
+
+  buildInputs = [ makeWrapper openldap ];
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
 
   configureFlags = [
     "--enable-failover"
@@ -31,6 +36,7 @@ stdenv.mkDerivation rec {
     "--enable-early-chroot"
     "--sysconfdir=/etc"
     "--localstatedir=/var"
+    (lib.optional stdenv.isLinux "--with-randomdev=/dev/random")
   ] ++ stdenv.lib.optionals (openldap != null) [ "--with-ldap" "--with-ldapcrypto" ];
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error=pointer-compare" ];
@@ -57,6 +63,8 @@ stdenv.mkDerivation rec {
       substituteInPlace configure --replace "/usr/bin/file" "${file}/bin/file"
       sed -i "includes/dhcpd.h" \
 	-"es|^ *#define \+_PATH_DHCLIENT_SCRIPT.*$|#define _PATH_DHCLIENT_SCRIPT \"$out/sbin/dhclient-script\"|g"
+
+      export AR='${stdenv.cc.bintools.bintools}/bin/${stdenv.cc.targetPrefix}ar'
     '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index 1695e23514a..78aeb2a03ed 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -79,7 +79,7 @@ in stdenv.mkDerivation rec {
   installFlags = [
     "sysconfdir=${placeholder "out"}/etc"
     "localstatedir=${placeholder "out"}/var"
-    "runstatedir=${placeholder "out"}/var/run"
+    "runstatedir=${placeholder "out"}/run"
   ];
 
   postInstall = ''
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 25e03d80369..69464c69f75 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchurl {
     url = "https://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "05xrb8havr2vgjsdy7n85kgnvk1mg7qwhjp4a8n6pg4jhd5zjnj1";
+    sha256 = "1iarvk0i92asvrkpla9z55aan20k6pklzpck9yk4rfnchsdvzh63";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/networking/wicd/wpa2-ttls b/pkgs/tools/networking/wicd/wpa2-ttls
index c5ac798be5d..650375cbbaa 100644
--- a/pkgs/tools/networking/wicd/wpa2-ttls
+++ b/pkgs/tools/networking/wicd/wpa2-ttls
@@ -4,7 +4,7 @@ version = 1
 require identity *Identity anonymous_identity *Anonymous_identity password *Password ca_cert *Path_to_CA_Cert
 protected password *Password
 -----
-ctrl_interface=/var/run/wpa_supplicant
+ctrl_interface=/run/wpa_supplicant
 network={
         ssid="$_ESSID"
         scan_ssid=$_SCAN
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index 66a5615ee13..5c40ccdef58 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "pcsclite-${version}";
-  version = "1.8.24";
+  version = "1.8.25";
 
   outputs = [ "bin" "out" "dev" "doc" "man" ];
 
   src = fetchurl {
     url = "https://pcsclite.apdu.fr/files/pcsc-lite-${version}.tar.bz2";
-    sha256 = "0s3mv6csbi9303vvis0hilm71xsmi6cqkbh2kiipdisydbx6865q";
+    sha256 = "14l7irs1nsh8b036ag4cfy8wryyysch78scz5dw6xxqwqgnpjvfp";
   };
 
   patches = [ ./no-dropdir-literals.patch ];
diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index 705338634f1..87df0ffd834 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -11,6 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0w35ypl960pczg5kp6km3dyr000m1hf0vpwwlh72jjkjza36c1v8";
   };
 
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libgpgerror libassuan libcap libsecret gtk2 gcr ncurses qt ];
 
   prePatch = ''
@@ -33,9 +34,10 @@ stdenv.mkDerivation rec {
     (stdenv.lib.enableFeature (gtk2 != null)      "pinentry-gtk2")
     (stdenv.lib.enableFeature (gcr != null)       "pinentry-gnome3")
     (stdenv.lib.enableFeature (qt != null)        "pinentry-qt")
-  ];
 
-  nativeBuildInputs = [ pkgconfig ];
+    "--with-libassuan-prefix=${libassuan.dev}"
+    "--with-libgpg-error-prefix=${libgpgerror.dev}"
+  ];
 
   meta = with stdenv.lib; {
     homepage = http://gnupg.org/aegypten2/;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d70614bf35a..1ec5911891c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5020,6 +5020,7 @@ in
 
   pinentry = callPackage ../tools/security/pinentry {
     libcap = if stdenv.isDarwin then null else libcap;
+    gcr = null;
   };
 
   pinentry_ncurses = res.pinentry.override {