Merge master into staging-next

2019-08-02 23:27:18 +02:00 · 2019-08-02 23:27:18 +02:00 · d20a59d2e5
commit d20a59d2e5
parent 92f3ea646e 66644848cb
69 changed files with 97834 additions and 168594 deletions
--- a/doc/languages-frameworks/vim.section.md
+++ b/doc/languages-frameworks/vim.section.md
@ -21,7 +21,7 @@ At the moment we support three different methods for managing plugins:

 Adding custom .vimrc lines can be done using the following code:

-```
+```nix
 vim_configurable.customize {
  # `name` specifies the name of the executable and package
  name = "vim-with-plugins";
@ -32,11 +32,11 @@ vim_configurable.customize {
 }
 ```

-This configuration is used when vim is invoked with the command specified as name, in this case `vim-with-plugins`.
+This configuration is used when Vim is invoked with the command specified as name, in this case `vim-with-plugins`.

 For Neovim the `configure` argument can be overridden to achieve the same:

-```
+```nix
 neovim.override {
  configure = {
    customRC = ''
@ -46,10 +46,10 @@ neovim.override {
 }
 ```

-If you want to use `neovim-qt` as a graphical editor, you can configure it by overriding neovim in an overlay
-or passing it an overridden neovimn:
+If you want to use `neovim-qt` as a graphical editor, you can configure it by overriding Neovim in an overlay
+or passing it an overridden Neovimn:

-```
+```nix
 neovim-qt.override {
  neovim = neovim.override {
    configure = {
@ -63,16 +63,16 @@ neovim-qt.override {

 ## Managing plugins with Vim packages

-To store you plugins in Vim packages (the native vim plugin manager, see `:help packages`) the following example can be used:
+To store you plugins in Vim packages (the native Vim plugin manager, see `:help packages`) the following example can be used:

-```
+```nix
 vim_configurable.customize {
  vimrcConfig.packages.myVimPackage = with pkgs.vimPlugins; {
    # loaded on launch
    start = [ youcompleteme fugitive ];
    # manually loadable by calling `:packadd $plugin-name`
-    # however, if a vim plugin has a dependency that is not explicitly listed in
-	# opt that dependency will always be added to start to avoid confusion.
+    # however, if a Vim plugin has a dependency that is not explicitly listed in
+    # opt that dependency will always be added to start to avoid confusion.
    opt = [ phpCompletion elm-vim ];
    # To automatically load a plugin when opening a filetype, add vimrc lines like:
    # autocmd FileType php :packadd phpCompletion
@ -83,7 +83,7 @@ vim_configurable.customize {
 `myVimPackage` is an arbitrary name for the generated package. You can choose any name you like.
 For Neovim the syntax is:

-```
+```nix
 neovim.override {
  configure = {
    customRC = ''
@ -92,7 +92,7 @@ neovim.override {
    packages.myVimPackage = with pkgs.vimPlugins; {
      # see examples below how to use custom packages
      start = [ ];
-      # If a vim plugin has a dependency that is not explicitly listed in
+      # If a Vim plugin has a dependency that is not explicitly listed in
      # opt that dependency will always be added to start to avoid confusion.
      opt = [ ];
    };
@ -102,7 +102,7 @@ neovim.override {

 The resulting package can be added to `packageOverrides` in `~/.nixpkgs/config.nix` to make it installable:

-```
+```nix
 {
  packageOverrides = pkgs: with pkgs; {
    myVim = vim_configurable.customize {
@ -126,7 +126,7 @@ After that you can install your special grafted `myVim` or `myNeovim` packages.
 To use [vim-plug](https://github.com/junegunn/vim-plug) to manage your Vim
 plugins the following example can be used:

-```
+```nix
 vim_configurable.customize {
  vimrcConfig.packages.myVimPackage = with pkgs.vimPlugins; {
    # loaded on launch
@ -137,7 +137,7 @@ vim_configurable.customize {

 For Neovim the syntax is:

-```
+```nix
 neovim.override {
  configure = {
    customRC = ''
@ -161,89 +161,112 @@ assuming that "using latest version" is ok most of the time.

 First create a vim-scripts file having one plugin name per line. Example:

-    "tlib"
-    {'name': 'vim-addon-sql'}
-    {'filetype_regex': '\%(vim)$', 'names': ['reload', 'vim-dev-plugin']}
+```
+"tlib"
+{'name': 'vim-addon-sql'}
+{'filetype_regex': '\%(vim)$', 'names': ['reload', 'vim-dev-plugin']}
+```

 Such vim-scripts file can be read by VAM as well like this:

-    call vam#Scripts(expand('~/.vim-scripts'), {})
+```vim
+call vam#Scripts(expand('~/.vim-scripts'), {})
+```

 Create a default.nix file:

-    { nixpkgs ? import <nixpkgs> {}, compiler ? "ghc7102" }:
-    nixpkgs.vim_configurable.customize { name = "vim"; vimrcConfig.vam.pluginDictionaries = [ "vim-addon-vim2nix" ]; }
+```nix
+{ nixpkgs ? import <nixpkgs> {}, compiler ? "ghc7102" }:
+nixpkgs.vim_configurable.customize { name = "vim"; vimrcConfig.vam.pluginDictionaries = [ "vim-addon-vim2nix" ]; }
+```

 Create a generate.vim file:

-    ActivateAddons vim-addon-vim2nix
-    let vim_scripts = "vim-scripts"
-    call nix#ExportPluginsForNix({
-    \  'path_to_nixpkgs': eval('{"'.substitute(substitute(substitute($NIX_PATH, ':', ',', 'g'), '=',':', 'g'), '\([:,]\)', '"\1"',"g").'"}')["nixpkgs"],
-    \  'cache_file': '/tmp/vim2nix-cache',
-    \  'try_catch': 0,
-    \  'plugin_dictionaries': ["vim-addon-manager"]+map(readfile(vim_scripts), 'eval(v:val)')
-    \ })
+```vim
+ActivateAddons vim-addon-vim2nix
+let vim_scripts = "vim-scripts"
+call nix#ExportPluginsForNix({
+\  'path_to_nixpkgs': eval('{"'.substitute(substitute(substitute($NIX_PATH, ':', ',', 'g'), '=',':', 'g'), '\([:,]\)', '"\1"',"g").'"}')["nixpkgs"],
+\  'cache_file': '/tmp/vim2nix-cache',
+\  'try_catch': 0,
+\  'plugin_dictionaries': ["vim-addon-manager"]+map(readfile(vim_scripts), 'eval(v:val)')
+\ })
+```

 Then run

-    nix-shell -p vimUtils.vim_with_vim2nix --command "vim -c 'source generate.vim'"
+```bash
+nix-shell -p vimUtils.vim_with_vim2nix --command "vim -c 'source generate.vim'"
+```

 You should get a Vim buffer with the nix derivations (output1) and vam.pluginDictionaries (output2).
-You can add your vim to your system's configuration file like this and start it by "vim-my":
+You can add your Vim to your system's configuration file like this and start it by "vim-my":

-    my-vim =
-     let plugins = let inherit (vimUtils) buildVimPluginFrom2Nix; in {
-          copy paste output1 here
-     }; in vim_configurable.customize {
-       name = "vim-my";
+```
+my-vim =
+  let plugins = let inherit (vimUtils) buildVimPluginFrom2Nix; in {
+    copy paste output1 here
+  }; in vim_configurable.customize {
+    name = "vim-my";

-       vimrcConfig.vam.knownPlugins = plugins; # optional
-       vimrcConfig.vam.pluginDictionaries = [
-          copy paste output2 here
-       ];
-
-       # Pathogen would be
-       # vimrcConfig.pathogen.knownPlugins = plugins; # plugins
-       # vimrcConfig.pathogen.pluginNames = ["tlib"];
-     };
+    vimrcConfig.vam.knownPlugins = plugins; # optional
+    vimrcConfig.vam.pluginDictionaries = [
+       copy paste output2 here
+    ];

+    # Pathogen would be
+    # vimrcConfig.pathogen.knownPlugins = plugins; # plugins
+    # vimrcConfig.pathogen.pluginNames = ["tlib"];
+  };
+```

 Sample output1:

-    "reload" = buildVimPluginFrom2Nix { # created by nix#NixDerivation
-      name = "reload";
-      src = fetchgit {
-        url = "git://github.com/xolox/vim-reload";
-        rev = "0a601a668727f5b675cb1ddc19f6861f3f7ab9e1";
-        sha256 = "0vb832l9yxj919f5hfg6qj6bn9ni57gnjd3bj7zpq7d4iv2s4wdh";
-      };
-      dependencies = ["nim-misc"];
+```
+"reload" = buildVimPluginFrom2Nix { # created by nix#NixDerivation
+  name = "reload";
+  src = fetchgit {
+    url = "git://github.com/xolox/vim-reload";
+    rev = "0a601a668727f5b675cb1ddc19f6861f3f7ab9e1";
+    sha256 = "0vb832l9yxj919f5hfg6qj6bn9ni57gnjd3bj7zpq7d4iv2s4wdh";
+  };
+  dependencies = ["nim-misc"];

-    };
-    [...]
+};
+[...]
+```

 Sample output2:

-    [
-      ''vim-addon-manager''
-      ''tlib''
-      { "name" = ''vim-addon-sql''; }
-      { "filetype_regex" = ''\%(vim)$$''; "names" = [ ''reload'' ''vim-dev-plugin'' ]; }
-    ]
-
+```nix
+[
+  ''vim-addon-manager''
+  ''tlib''
+  { "name" = ''vim-addon-sql''; }
+  { "filetype_regex" = ''\%(vim)$$''; "names" = [ ''reload'' ''vim-dev-plugin'' ]; }
+]
+```

 ## Adding new plugins to nixpkgs

-In `pkgs/misc/vim-plugins/vim-plugin-names` we store the plugin names
-for all vim plugins we automatically generate plugins for.
-The format of this file `github username/github repository`:
-For example https://github.com/scrooloose/nerdtree becomes `scrooloose/nerdtree`.
-After adding your plugin to this file run the `./update.py` in the same folder.
-This will updated a file called `generated.nix` and make your plugin accessible in the
-`vimPlugins` attribute set (`vimPlugins.nerdtree` in our example).
-If additional steps to the build process of the plugin are required, add an
-override to the `pkgs/misc/vim-plugins/default.nix` in the same directory.
+Nix expressions for Vim plugins are stored in [pkgs/misc/vim-plugins](/pkgs/misc/vim-plugins). For the vast majority of plugins, Nix expressions are automatically generated by running [`./update.py`](/pkgs/misc/vim-plugins/update.py). This creates a [generated.nix](/pkgs/misc/vim-plugins/generated.nix) file based on the plugins listed in [vim-plugin-names](/pkgs/misc/vim-plugins/vim-plugin-names). Plugins are listed in alphabetical order in `vim-plugin-names` using the format `[github username]/[repository]`. For example https://github.com/scrooloose/nerdtree becomes `scrooloose/nerdtree`.
+
+Some plugins require overrides in order to function properly. Overrides are placed in [overrides.nix](/pkgs/misc/vim-plugins/overrides.nix). Overrides are most often required when a plugin requires some dependencies, or extra steps are required during the build process. For example `deoplete-fish` requires both `deoplete-nvim` and `vim-fish`, and so the following override was added:
+
+```
+deoplete-fish = super.deoplete-fish.overrideAttrs(old: {
+  dependencies = with super; [ deoplete-nvim vim-fish ];
+});
+```
+
+Sometimes plugins require an override that must be changed when the plugin is updated. This can cause issues when Vim plugins are auto-updated but the associated override isn't updated. For these plugins, the override should be written so that it specifies all information required to install the plugin, and running `./update.py` doesn't change the derivation for the plugin. Manually updating the override is required to update these types of plugins. An example of such a plugin is `LanguageClient-neovim`.
+
+To add a new plugin:
+
+  1. run `./update.py` and create a commit named "vimPlugins: Update",
+  2. add the new plugin to [vim-plugin-names](/pkgs/misc/vim-plugins/vim-plugin-names) and add overrides if required to [overrides.nix](/pkgs/misc/vim-plugins/overrides.nix),
+  3. run `./update.py` again and create a commit named "vimPlugins.[name]: init at [version]" (where `name` and `version` can be found in [generated.nix](/pkgs/misc/vim-plugins/generated.nix)), and
+  4. create a pull request.

 ## Important repositories

@ -252,4 +275,3 @@ override to the `pkgs/misc/vim-plugins/default.nix` in the same directory.

 - [vim2nix](https://github.com/MarcWeber/vim-addon-vim2nix) which generates the
  .nix code
-
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4219,9 +4219,13 @@
    name = "Ben Hamlin";
  };
  prusnak = {
-    email = "stick@gk2.sk";
+    email = "pavol@rusnak.io";
    github = "prusnak";
    name = "Pavol Rusnak";
+    keys = [{
+      longkeyid = "rsa4096/0x91F3B339B9A02A3D";
+      fingerprint = "86E6 792F C27B FD47 8860  C110 91F3 B339 B9A0 2A3D";
+    }];
  };
  pshendry = {
    email = "paul@pshendry.com";
--- a/nixos/doc/manual/man-pages.xml
+++ b/nixos/doc/manual/man-pages.xml
@ -6,7 +6,7 @@
  <author><personname><firstname>Eelco</firstname><surname>Dolstra</surname></personname>
   <contrib>Author</contrib>
  </author>
-  <copyright><year>2007-2018</year><holder>Eelco Dolstra</holder>
+  <copyright><year>2007-2019</year><holder>Eelco Dolstra</holder>
  </copyright>
 </info>
 <xi:include href="man-configuration.xml" />
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@ -219,6 +219,13 @@
       Nodejs 8 is scheduled EOL under the lifetime of 19.09 and has been dropped.
     </para>
   </listitem>
+   <listitem>
+     <para>
+       By default, prometheus exporters are now run with <literal>DynamicUser</literal> enabled.
+       Exporters that need a real user, now run under a seperate user and group which follow the pattern <literal>&lt;exporter-name&gt;-exporter</literal>, instead of the previous default <literal>nobody</literal> and <literal>nogroup</literal>.
+       Only some exporters are affected by the latter, namely the exporters <literal>dovecot</literal>, <literal>node</literal>, <literal>postfix</literal> and <literal>varnish</literal>.
+     </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -33,6 +33,7 @@ let
    "nginx"
    "node"
    "postfix"
+    "postgres"
    "snmp"
    "surfboard"
    "tor"
@ -87,7 +88,7 @@ let
    };
    user = mkOption {
      type = types.str;
-      default = "nobody";
+      default = "${name}-exporter";
      description = ''
        User name under which the ${name} exporter shall be run.
        Has no effect when <option>systemd.services.prometheus-${name}-exporter.serviceConfig.DynamicUser</option> is true.
@ -95,7 +96,7 @@ let
    };
    group = mkOption {
      type = types.str;
-      default = "nobody";
+      default = "${name}-exporter";
      description = ''
        Group under which the ${name} exporter shall be run.
        Has no effect when <option>systemd.services.prometheus-${name}-exporter.serviceConfig.DynamicUser</option> is true.
@ -126,8 +127,23 @@ let
  );

  mkExporterConf = { name, conf, serviceOpts }:
+    let
+      enableDynamicUser = serviceOpts.serviceConfig.DynamicUser or true;
+    in
    mkIf conf.enable {
      warnings = conf.warnings or [];
+      users.users = (mkIf (conf.user == "${name}-exporter" && !enableDynamicUser) {
+        "${name}-exporter" = {
+          description = ''
+            Prometheus ${name} exporter service user
+          '';
+          isSystemUser = true;
+          inherit (conf) group;
+        };
+      });
+      users.groups = (mkIf (conf.group == "${name}-exporter" && !enableDynamicUser) {
+        "${name}-exporter" = {};
+      });
      networking.firewall.extraCommands = mkIf conf.openFirewall (concatStrings [
        "ip46tables -A nixos-fw ${conf.firewallFilter} "
        "-m comment --comment ${name}-exporter -j nixos-fw-accept"
@ -138,7 +154,8 @@ let
        serviceConfig.Restart = mkDefault "always";
        serviceConfig.PrivateTmp = mkDefault true;
        serviceConfig.WorkingDirectory = mkDefault /tmp;
-      } serviceOpts ] ++ optional (!(serviceOpts.serviceConfig.DynamicUser or false)) {
+        serviceConfig.DynamicUser = mkDefault enableDynamicUser;
+      } serviceOpts ] ++ optional (!enableDynamicUser) {
        serviceConfig.User = conf.user;
        serviceConfig.Group = conf.group;
      });
--- a/nixos/modules/services/monitoring/prometheus/exporters.xml
+++ b/nixos/modules/services/monitoring/prometheus/exporters.xml
@ -159,8 +159,10 @@ in
  # `serviceOpts.script` and `serviceOpts.serviceConfig.ExecStart`
  # has to be specified here. This will be merged with the default
  # service confiuration.
+  # Note that by default 'DynamicUser' is 'true'.
  serviceOpts = {
    serviceConfig = {
+      DynamicUser = false;
      ExecStart = ''
        ${pkgs.prometheus-postfix-exporter}/bin/postfix_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/bind.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/bind.nix
@ -39,7 +39,6 @@ in
  };
  serviceOpts = {
    serviceConfig = {
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-bind-exporter}/bin/bind_exporter \
          -web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix
@ -18,7 +18,6 @@ in
  serviceOpts = {
    serviceConfig = {
      AmbientCapabilities = [ "CAP_NET_RAW" ]; # for ping probes
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-blackbox-exporter}/bin/blackbox_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/collectd.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/collectd.nix
@ -64,7 +64,6 @@ in
    '' else "";
  in {
    serviceConfig = {
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-collectd-exporter}/bin/collectd_exporter \
          -log.format ${cfg.logFormat} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/dnsmasq.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/dnsmasq.nix
@ -26,7 +26,6 @@ in
  };
  serviceOpts = {
    serviceConfig = {
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-dnsmasq-exporter}/bin/dnsmasq_exporter \
          --listen ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix
@ -39,8 +39,8 @@ in
            mail_plugins = $mail_plugins old_stats
            service old-stats {
              unix_listener old-stats {
-                user = nobody
-                group = nobody
+                user = dovecot-exporter
+                group = dovecot-exporter
              }
            }
          ''';
@ -59,6 +59,7 @@ in
  };
  serviceOpts = {
    serviceConfig = {
+      DynamicUser = false;
      ExecStart = ''
        ${pkgs.prometheus-dovecot-exporter}/bin/dovecot_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/fritzbox.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/fritzbox.nix
@ -26,7 +26,6 @@ in
  };
  serviceOpts = {
    serviceConfig = {
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-fritzbox-exporter}/bin/exporter \
          -listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/json.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/json.nix
@ -24,7 +24,6 @@ in
  };
  serviceOpts = {
    serviceConfig = {
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-json-exporter}/bin/prometheus-json-exporter \
          --port ${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/mail.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/mail.nix
@ -143,6 +143,7 @@ in
  };
  serviceOpts = {
    serviceConfig = {
+      DynamicUser = false;
      ExecStart = ''
        ${pkgs.prometheus-mail-exporter}/bin/mailexporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/minio.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/minio.nix
@ -50,7 +50,6 @@ in
  };
  serviceOpts = {
    serviceConfig = {
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-minio-exporter}/bin/minio-exporter \
          -web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/nginx.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/nginx.nix
@ -34,7 +34,6 @@ in
  };
  serviceOpts = {
    serviceConfig = {
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-nginx-exporter}/bin/nginx-prometheus-exporter \
          --nginx.scrape-uri '${cfg.scrapeUri}' \
--- a/nixos/modules/services/monitoring/prometheus/exporters/node.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/node.nix
@ -27,6 +27,7 @@ in
  };
  serviceOpts = {
    serviceConfig = {
+      DynamicUser = false;
      RuntimeDirectory = "prometheus-node-exporter";
      ExecStart = ''
        ${pkgs.prometheus-node-exporter}/bin/node_exporter \
--- a/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
@ -62,6 +62,7 @@ in
  };
  serviceOpts = {
    serviceConfig = {
+      DynamicUser = false;
      ExecStart = ''
        ${pkgs.prometheus-postfix-exporter}/bin/postfix_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/postgres.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/postgres.nix
@ -0,0 +1,47 @@
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.postgres;
+in
+{
+  port = 9187;
+  extraOpts = {
+    telemetryPath = mkOption {
+      type = types.str;
+      default = "/metrics";
+      description = ''
+        Path under which to expose metrics.
+      '';
+    };
+    dataSourceName = mkOption {
+      type = types.str;
+      default = "user=postgres database=postgres host=/run/postgresql sslmode=disable";
+      example = "postgresql://username:password@localhost:5432/postgres?sslmode=disable";
+      description = ''
+        Accepts PostgreSQL URI form and key=value form arguments.
+      '';
+    };
+    runAsLocalSuperUser = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to run the exporter as the local 'postgres' super user.
+      '';
+    };
+  };
+  serviceOpts = {
+    environment.DATA_SOURCE_NAME = cfg.dataSourceName;
+    serviceConfig = {
+      DynamicUser = false;
+      User = mkIf cfg.runAsLocalSuperUser (mkForce "postgres");
+      ExecStart = ''
+        ${pkgs.prometheus-postgres-exporter}/bin/postgres_exporter \
+          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
+          --web.telemetry-path ${cfg.telemetryPath} \
+          ${concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
@ -57,7 +57,6 @@ in
                 else "${pkgs.writeText "snmp-eporter-conf.yml" (builtins.toJSON cfg.configuration)}";
    in {
    serviceConfig = {
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-snmp-exporter.bin}/bin/snmp_exporter \
          --config.file=${configFile} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/surfboard.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/surfboard.nix
@ -20,7 +20,6 @@ in
    description = "Prometheus exporter for surfboard cable modem";
    unitConfig.Documentation = "https://github.com/ipstatic/surfboard_exporter";
    serviceConfig = {
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-surfboard-exporter}/bin/surfboard_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/tor.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/tor.nix
@ -26,7 +26,6 @@ in
  };
  serviceOpts = {
    serviceConfig = {
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-tor-exporter}/bin/prometheus-tor-exporter \
          -b ${cfg.listenAddress} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/unifi.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/unifi.nix
@ -51,7 +51,6 @@ in
  };
  serviceOpts = {
    serviceConfig = {
-      DynamicUser = true;
      ExecStart = ''
        ${pkgs.prometheus-unifi-exporter}/bin/unifi_exporter \
          -telemetry.addr ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/varnish.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/varnish.nix
@ -69,6 +69,7 @@ in
    path = [ pkgs.varnish ];
    serviceConfig = {
      RestartSec = mkDefault 1;
+      DynamicUser = false;
      ExecStart = ''
        ${pkgs.prometheus-varnish-exporter}/bin/prometheus_varnish_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
@ -36,19 +36,17 @@ in {
    };
  };
  serviceOpts = {
-    script = ''
-      ${pkgs.prometheus-wireguard-exporter}/bin/prometheus_wireguard_exporter \
-        -p ${toString cfg.port} \
-        ${optionalString cfg.verbose "-v"} \
-        ${optionalString cfg.singleSubnetPerField "-s"} \
-        ${optionalString (cfg.wireguardConfig != null) "-n ${cfg.wireguardConfig}"}
-    '';
-
    path = [ pkgs.wireguard-tools ];

    serviceConfig = {
-      DynamicUser = true;
      AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+      ExecStart = ''
+        ${pkgs.prometheus-wireguard-exporter}/bin/prometheus_wireguard_exporter \
+          -p ${toString cfg.port} \
+          ${optionalString cfg.verbose "-v"} \
+          ${optionalString cfg.singleSubnetPerField "-s"} \
+          ${optionalString (cfg.wireguardConfig != null) "-n ${cfg.wireguardConfig}"}
+      '';
    };
  };
 }
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -191,7 +191,6 @@ let
    mail = {
      exporterConfig = {
        enable = true;
-        user = "mailexporter";
        configuration = {
          monitoringInterval = "2s";
          mailCheckTimeout = "10s";
@ -199,9 +198,9 @@ let
            name = "testserver";
            server = "localhost";
            port = 25;
-            from = "mailexporter@localhost";
-            to = "mailexporter@localhost";
-            detectionDir = "/var/spool/mail/mailexporter/new";
+            from = "mail-exporter@localhost";
+            to = "mail-exporter@localhost";
+            detectionDir = "/var/spool/mail/mail-exporter/new";
          } ];
        };
      };
@ -211,7 +210,7 @@ let
          after = [ "postfix.service" ];
          requires = [ "postfix.service" ];
          preStart = ''
-            mkdir -p 0600 mailexporter/new
+            mkdir -p 0600 mail-exporter/new
          '';
          serviceConfig = {
            ProtectHome = true;
@ -274,6 +273,30 @@ let
      '';
    };

+    postgres = {
+      exporterConfig = {
+        enable = true;
+        runAsLocalSuperUser = true;
+      };
+      metricProvider = {
+        services.postgresql.enable = true;
+      };
+      exporterTest = ''
+        waitForUnit("prometheus-postgres-exporter.service");
+        waitForOpenPort(9187);
+        waitForUnit("postgresql.service");
+        succeed("curl -sSf http://localhost:9187/metrics | grep -q 'pg_exporter_last_scrape_error 0'");
+        succeed("curl -sSf http://localhost:9187/metrics | grep -q 'pg_up 1'");
+        systemctl("stop postgresql.service");
+        succeed("curl -sSf http://localhost:9187/metrics | grep -qv 'pg_exporter_last_scrape_error 0'");
+        succeed("curl -sSf http://localhost:9187/metrics | grep -q 'pg_up 0'");
+        systemctl("start postgresql.service");
+        waitForUnit("postgresql.service");
+        succeed("curl -sSf http://localhost:9187/metrics | grep -q 'pg_exporter_last_scrape_error 0'");
+        succeed("curl -sSf http://localhost:9187/metrics | grep -q 'pg_up 1'");
+      '';
+    };
+
    snmp = {
      exporterConfig = {
        enable = true;
--- a/pkgs/applications/editors/emacs-modes/libgenerated.nix
+++ b/pkgs/applications/editors/emacs-modes/libgenerated.nix
@ -0,0 +1,90 @@
+lib: self:
+
+let
+
+    fetcherGenerators = { repo ? null
+                        , url ? null
+                        , ... }:
+                        { sha256
+                        , commit
+                        , ...}: {
+      github = self.callPackage ({ fetchFromGitHub }:
+        fetchFromGitHub {
+          owner = lib.head (lib.splitString "/" repo);
+          repo = lib.head (lib.tail (lib.splitString "/" repo));
+          rev = commit;
+          inherit sha256;
+        }
+      ) {};
+      gitlab = self.callPackage ({ fetchFromGitLab }:
+        fetchFromGitLab {
+          owner = lib.head (lib.splitString "/" repo);
+          repo = lib.head (lib.tail (lib.splitString "/" repo));
+          rev = commit;
+          inherit sha256;
+        }
+      ) {};
+      git = self.callPackage ({ fetchgit }:
+        fetchgit {
+          rev = commit;
+          inherit sha256 url;
+        }
+      ) {};
+      bitbucket = self.callPackage ({ fetchhg }:
+        fetchhg {
+          rev = commit;
+          url = "https://bitbucket.com/${repo}";
+          inherit sha256;
+        }
+      ) {};
+      hg = self.callPackage ({ fetchhg }:
+        fetchhg {
+          rev = commit;
+          inherit sha256 url;
+        }
+      ) {};
+    };
+
+in {
+
+  melpaDerivation = variant:
+                      { ename, fetcher
+                      , commit ? null
+                      , sha256 ? null
+                      , ... }@args:
+      let
+        sourceArgs = args."${variant}";
+        version = sourceArgs.version or null;
+        deps = sourceArgs.deps or null;
+        error = sourceArgs.error or args.error or null;
+        hasSource = lib.hasAttr variant args;
+        pname = builtins.replaceStrings [ "@" ] [ "at" ] ename;
+        broken = ! isNull error;
+      in
+      lib.nameValuePair ename (if hasSource then (
+        self.callPackage ({ melpaBuild, fetchurl, ... }@pkgargs:
+          melpaBuild {
+            inherit pname;
+            ename = ename;
+            version = if isNull version then "" else
+              lib.concatStringsSep "." (map toString version);
+            # TODO: Broken should not result in src being null (hack to avoid eval errors)
+            src = if (isNull sha256 || broken) then null else
+              lib.getAttr fetcher (fetcherGenerators args sourceArgs);
+            recipe = if isNull commit then null else
+              fetchurl {
+                name = pname + "-recipe";
+                url = "https://raw.githubusercontent.com/melpa/melpa/${commit}/recipes/${ename}";
+                inherit sha256;
+              };
+            packageRequires = lib.optional (! isNull deps)
+              (map (dep: pkgargs."${dep}" or self."${dep}" or null)
+                   deps);
+            meta = (sourceArgs.meta or {}) // {
+              inherit broken;
+            };
+          }
+        ) {}
+      ) else null);
+
+}
--- a/pkgs/applications/editors/emacs-modes/melpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-packages.nix
@ -4,12 +4,11 @@

 To update the list of packages from MELPA,

-1. Clone https://github.com/ttuegel/emacs2nix.
-2. Clone https://github.com/milkypostman/melpa.
-3. Run `./melpa-packages.sh --melpa PATH_TO_MELPA_CLONE` from emacs2nix.
-4. Copy the new `melpa-generated.nix` file into Nixpkgs.
-5. Check for evaluation errors: `nix-instantiate ./. -A emacsPackagesNg.melpaPackages`.
-6. `git add pkgs/applications/editors/emacs-modes/melpa-generated.nix && git commit -m "melpa-packages $(date -Idate)"`
+1. Run ./update-melpa
+2. Check for evaluation errors:
+env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate --show-trace ../../../../ -A emacsPackagesNg.melpaStablePackages
+env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate --show-trace ../../../../ -A emacsPackagesNg.melpaPackages
+3. `git commit -m "melpa-packages: $(date -Idate)" recipes-archive-melpa.json`

 */

@ -18,7 +17,9 @@ To update the list of packages from MELPA,
 self:

  let
-    imported = import ./melpa-generated.nix { inherit (self) callPackage; };
+    inherit (import ./libgenerated.nix lib self) melpaDerivation;
+    imported = lib.listToAttrs (map (melpaDerivation "unstable")
+                                    (lib.importJSON ./recipes-archive-melpa.json));
    super = builtins.removeAttrs imported [
      "swbuff-x" # required dependency swbuff is missing
    ];
@ -264,6 +265,29 @@ self:
            '';
        });
      });
+
+      # Map legacy renames from emacs2nix since code generation was ported to emacs lisp
+      _0blayout = super."0blayout";
+      _0xc = super."0xc";
+      _2048-game = super."2048-game";
+      _4clojure = super."4clojure";
+      at = super."@";
+      desktop-plus = super."desktop+";
+      # filesets-plus = super."filesets+";
+      ghub-plus = super."ghub+";
+      git-gutter-plus = super."git-gutter+";
+      git-gutter-fringe-plus = super."git-gutter-fringe+";
+      ido-completing-read-plus = super."ido-completing-read+";
+      image-plus = super."image+";
+      image-dired-plus = super."image-dired+";
+      markdown-mode-plus = super."markdown-mode+";
+      package-plus = super."package+";
+      rect-plus = super."rect+";
+      term-plus = super."term+";
+      term-plus-key-intercept = super."term+key-intercept";
+      term-plus-mux = super."term+mux";
+      xml-plus = super."xml+";
+
    };

    melpaPackages =
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix
--- a/pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/melpa-stable-packages.nix
@ -4,22 +4,23 @@

 To update the list of packages from MELPA,

-1. Clone https://github.com/ttuegel/emacs2nix.
-2. Clone https://github.com/milkypostman/melpa.
-3. Run `./melpa-stable-packages.sh --melpa PATH_TO_MELPA_CLONE` from emacs2nix.
-4. Copy the new `melpa-stable-generated.nix` file into Nixpkgs.
-5. Check for evaluation errors: `nix-instantiate ./. -A emacsPackagesNg.melpaStablePackages`.
-6. `git add pkgs/applications/editors/emacs-modes/melpa-stable-generated.nix && git commit -m "melpa-stable-packages $(date -Idate)"`
+
+1. Run ./update-melpa
+2. Check for evaluation errors:
+env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate --show-trace ../../../../ -A emacsPackagesNg.melpaStablePackages
+env NIXPKGS_ALLOW_BROKEN=1 nix-instantiate --show-trace ../../../../ -A emacsPackagesNg.melpaPackages
+3. `git commit -m "melpa-packages: $(date -Idate)" recipes-archive-melpa.json`

 */

-{ external }:
+{ lib, external }:

 self:

  let
-    imported = import ./melpa-stable-generated.nix { inherit (self) callPackage; };
-
+    inherit (import ./libgenerated.nix lib self) melpaDerivation;
+    imported = lib.listToAttrs (map (melpaDerivation "stable")
+                                    (lib.importJSON ./recipes-archive-melpa.json));
    super = imported;

    dontConfigure = pkg: pkg.override (args: {
@ -28,11 +29,11 @@ self:
      });
    });

-    markBroken = pkg: pkg.override (args: {
+    markBroken = pkg: if pkg != null then pkg.override (args: {
      melpaBuild = drv: args.melpaBuild (drv // {
        meta = (drv.meta or {}) // { broken = true; };
      });
-    });
+    }) else null;

    overrides = {
      # Expects bash to be at /bin/bash
@ -205,6 +206,28 @@ self:

      # upstream issue: missing file header
      window-numbering = markBroken super.window-numbering;
+
+      # Map legacy renames from emacs2nix since code generation was ported to emacs lisp
+      _0blayout = super."0blayout";
+      _0xc = super."0xc";
+      _2048-game = super."2048-game";
+      _4clojure = super."4clojure";
+      at = super."@";
+      desktop-plus = super."desktop+";
+      ghub-plus = super."ghub+";
+      git-gutter-plus = super."git-gutter+";
+      git-gutter-fringe-plus = super."git-gutter-fringe+";
+      ido-completing-read-plus = super."ido-completing-read+";
+      image-plus = super."image+";
+      image-dired-plus = super."image-dired+";
+      markdown-mode-plus = super."markdown-mode+";
+      package-plus = super."package+";
+      rect-plus = super."rect+";
+      term-plus = super."term+";
+      term-plus-key-intercept = super."term+key-intercept";
+      term-plus-mux = super."term+mux";
+      xml-plus = super."xml+";
+
    };

    melpaStablePackages = super // overrides;
--- a/pkgs/applications/editors/emacs-modes/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs-modes/recipes-archive-melpa.json
--- a/pkgs/applications/editors/emacs-modes/update-melpa
+++ b/pkgs/applications/editors/emacs-modes/update-melpa
@ -0,0 +1,8 @@
+#! /usr/bin/env nix-shell
+#! nix-shell --show-trace -i sh -p git nix nix-prefetch-git nix-prefetch-hg "import ./updater-emacs.nix"
+
+# "with import ../../../.. {}; emacsWithPackages (epkgs: with epkgs.melpaPackages; [ promise semaphore ])"
+
+exec emacs --fg-daemon=updater --quick -l update-melpa.el -f run-updater "$@"
+
+# exec emacs update-melpa.el "$@"
--- a/pkgs/applications/editors/emacs-modes/update-melpa.el
+++ b/pkgs/applications/editors/emacs-modes/update-melpa.el
@ -0,0 +1,434 @@
+;; -*- lexical-binding: t -*-
+
+;; This is the updater for recipes-archive-melpa.json
+
+(require 'promise)
+(require 'semaphore-promise)
+(require 'url)
+(require 'json)
+(require 'cl)
+(require 'subr-x)
+(require 'seq)
+
+;; # Lib
+
+(defun alist-set (key value alist)
+  (cons
+   (cons key value)
+   (assq-delete-all
+    key alist)))
+
+(defun alist-update (key f alist)
+  (let ((value (alist-get key alist)))
+    (cons
+     (cons key (funcall f value))
+     (assq-delete-all
+      key alist))))
+
+
+(defun process-promise (semaphore program &rest args)
+  "Generate an asynchronous process and
+return Promise to resolve in that process."
+  (promise-then
+   (semaphore-promise-gated
+    semaphore
+    (lambda (resolve reject)
+      (funcall resolve (apply #'promise:make-process program args))))
+   #'car))
+
+(defun mangle-name (s)
+  (if (string-match "^[a-zA-Z].*" s)
+      s
+    (concat "_" s)))
+
+;; ## Shell promise + env
+
+(defun as-string (o)
+  (with-output-to-string (princ o)))
+
+(defun assocenv (env &rest namevals)
+  (let ((process-environment (copy-sequence env)))
+    (mapc (lambda (e)
+            (setenv (as-string (car e))
+                    (cadr e)))
+          (seq-partition namevals 2))
+    process-environment))
+
+(defun shell-promise (semaphore env script)
+  (semaphore-promise-gated
+   semaphore
+   (lambda (resolve reject)
+     (let ((process-environment env))
+       (funcall resolve (promise:make-shell-command script))))))
+
+;; # Updater
+
+;; ## Previous Archive Reader
+
+(defun previous-commit (index ename variant)
+  (when-let (pdesc (and index (gethash ename index)))
+    (when-let (desc (and pdesc (gethash variant pdesc)))
+      (gethash 'commit desc))))
+
+(defun previous-sha256 (index ename variant)
+  (when-let (pdesc (and index (gethash ename index)))
+    (when-let (desc (and pdesc (gethash variant pdesc)))
+      (gethash 'sha256 desc))))
+
+(defun parse-previous-archive (filename)
+  (let ((idx (make-hash-table :test 'equal)))
+    (loop for desc in
+          (let ((json-object-type 'hash-table)
+                (json-array-type 'list)
+                (json-key-type 'symbol))
+            (json-read-file filename))
+          do (puthash (gethash 'ename desc)
+                      desc idx))
+    idx))
+
+;; ## Prefetcher
+
+;; (defun latest-git-revision (url)
+;;   (process-promise "git" "ls-remote" url))
+
+(defun prefetch (semaphore fetcher repo commit)
+  (promise-then
+   (apply 'process-promise
+          semaphore
+          (pcase fetcher
+            ("github"    (list "nix-prefetch-url"
+                               "--unpack" (concat "https://github.com/" repo "/archive/" commit ".tar.gz")))
+            ("gitlab"    (list "nix-prefetch-url"
+                               "--unpack" (concat "https://gitlab.com/" repo "/repository/archive.tar.gz?ref=" commit)))
+            ("bitbucket" (list "nix-prefetch-hg"
+                               (concat "https://bitbucket.com/" repo) commit))
+            ("hg"        (list "nix-prefetch-hg"
+                               repo commit))
+            ("git"       (list "nix-prefetch-git"
+                               "--fetch-submodules"
+                               "--url" repo
+                               "--rev" commit))
+            (_           (throw 'unknown-fetcher fetcher))))
+   (lambda (res)
+     (pcase fetcher
+       ("git" (alist-get 'sha256 (json-read-from-string res)))
+       (_ (car (split-string res)))))))
+
+(defun source-sha (semaphore ename eprops aprops previous variant)
+  (let* ((fetcher (alist-get 'fetcher eprops))
+         (url     (alist-get 'url eprops))
+         (repo    (alist-get 'repo eprops))
+         (commit  (gethash 'commit aprops))
+         (prev-commit (previous-commit previous ename variant))
+         (prev-sha256 (previous-sha256 previous ename variant)))
+    (if (and commit prev-sha256
+             (equal prev-commit commit))
+        (progn
+          (message "INFO: %s: re-using %s %s" ename prev-commit prev-sha256)
+          (promise-resolve `((sha256 . ,prev-sha256))))
+      (if (and commit (or repo url))
+          (promise-then
+           (prefetch semaphore fetcher (or repo url) commit)
+           (lambda (sha256)
+             (message "INFO: %s: prefetched repository %s %s" ename commit sha256)
+             `((sha256 . ,sha256)))
+           (lambda (err)
+             (message "ERROR: %s: during prefetch %s" ename err)
+             (promise-resolve
+              `((error . ,err)))))
+        (progn
+          (message "ERROR: %s: no commit information" ename)
+          (promise-resolve
+           `((error . "No commit information"))))))))
+
+(defun source-info (recipe archive source-sha)
+  (let* ((esym    (car recipe))
+         (ename   (symbol-name esym))
+         (eprops  (cdr recipe))
+         (aentry  (gethash esym archive))
+         (version (and aentry (gethash 'ver aentry)))
+         (deps    (when-let (deps (gethash 'deps aentry))
+                    (remove 'emacs (hash-table-keys deps))))
+         (aprops  (and aentry (gethash 'props aentry)))
+         (commit  (gethash 'commit aprops)))
+    (append `((version . ,version))
+            (when (< 0 (length deps))
+              `((deps . ,(sort deps 'string<))))
+            `((commit . ,commit))
+            source-sha)))
+
+(defun recipe-info (recipe-index ename)
+  (if-let (desc (gethash ename recipe-index))
+      (destructuring-bind (rcp-commit . rcp-sha256) desc
+        `((commit . ,rcp-commit)
+          (sha256 . ,rcp-sha256)))
+    `((error . "No recipe info"))))
+
+(defun start-fetch (semaphore recipe-index-promise recipes unstable-archive stable-archive previous)
+  (promise-all
+   (mapcar (lambda (entry)
+             (let* ((esym    (car entry))
+                    (ename   (symbol-name esym))
+                    (eprops  (cdr entry))
+                    (fetcher (alist-get 'fetcher eprops))
+                    (url     (alist-get 'url eprops))
+                    (repo    (alist-get 'repo eprops))
+
+                    (unstable-aentry  (gethash esym unstable-archive))
+                    (unstable-aprops  (and unstable-aentry (gethash 'props unstable-aentry)))
+                    (unstable-commit  (and unstable-aprops (gethash 'commit unstable-aprops)))
+
+                    (stable-aentry (gethash esym stable-archive))
+                    (stable-aprops (and stable-aentry (gethash 'props stable-aentry)))
+                    (stable-commit  (and stable-aprops (gethash 'commit stable-aprops)))
+
+                    (unstable-shap (if unstable-aprops
+                                       (source-sha semaphore ename eprops unstable-aprops previous 'unstable)
+                                     (promise-resolve nil)))
+                    (stable-shap (if (equal unstable-commit stable-commit)
+                                     unstable-shap
+                                   (if stable-aprops
+                                       (source-sha semaphore ename eprops stable-aprops previous 'stable)
+                                     (promise-resolve nil)))))
+
+               (promise-then
+                (promise-all (list recipe-index-promise unstable-shap stable-shap))
+                (lambda (res)
+                  (seq-let [recipe-index unstable-sha stable-sha] res
+                    (append `((ename   . ,ename))
+                            (if-let (desc (gethash ename recipe-index))
+                                (destructuring-bind (rcp-commit . rcp-sha256) desc
+                                  (append `((commit . ,rcp-commit)
+                                            (sha256 . ,rcp-sha256))
+                                          (when (not unstable-aprops)
+                                            (message "ERROR: %s: not in archive" ename)
+                                            `((error . "Not in archive")))))
+                              `((error . "No recipe info")))
+                            `((fetcher . ,fetcher))
+                            (if (or (equal "github" fetcher)
+                                    (equal "bitbucket" fetcher)
+                                    (equal "gitlab" fetcher))
+                                `((repo . ,repo))
+                              `((url . ,url)))
+                            (when unstable-aprops `((unstable . ,(source-info entry unstable-archive unstable-sha))))
+                            (when stable-aprops `((stable . ,(source-info entry stable-archive stable-sha))))))))))
+           recipes)))
+
+;; ## Emitter
+
+(defun emit-json (prefetch-semaphore recipe-index-promise recipes archive stable-archive previous)
+  (promise-then
+   (start-fetch
+    prefetch-semaphore
+    recipe-index-promise
+    (sort recipes (lambda (a b)
+                    (string-lessp
+                     (symbol-name (car a))
+                     (symbol-name (car b)))))
+    archive stable-archive
+    previous)
+   (lambda (descriptors)
+     (message "Finished downloading %d descriptors" (length descriptors))
+     (let ((buf (generate-new-buffer "*recipes-archive*")))
+       (with-current-buffer buf
+         ;; (switch-to-buffer buf)
+         ;; (json-mode)
+         (insert
+          (let ((json-encoding-pretty-print t)
+                (json-encoding-default-indentation " "))
+            (json-encode descriptors)))
+         buf)))))
+
+;; ## Recipe indexer
+
+(defun http-get (url parser)
+  (promise-new
+   (lambda (resolve reject)
+     (url-retrieve
+      url (lambda (status)
+            (funcall resolve (condition-case err
+                                 (progn
+                                   (goto-char (point-min))
+                                   (search-forward "\n\n")
+                                   (message (buffer-substring (point-min) (point)))
+                                   (delete-region (point-min) (point))
+                                   (funcall parser))
+                               (funcall reject err))))))))
+
+(defun json-read-buffer (buffer)
+  (with-current-buffer buffer
+    (save-excursion
+      (mark-whole-buffer)
+      (json-read))))
+
+(defun error-count (recipes-archive)
+  (length
+   (seq-filter
+    (lambda (desc)
+      (alist-get 'error desc))
+    recipes-archive)))
+
+;; (error-count (json-read-buffer "recipes-archive-melpa.json"))
+
+(defun latest-recipe-commit (semaphore repo base-rev recipe)
+  (shell-promise
+   semaphore (assocenv process-environment
+                       "GIT_DIR" repo
+                       "BASE_REV" base-rev
+                       "RECIPE" recipe)
+   "exec git log --first-parent -n1 --pretty=format:%H $BASE_REV -- recipes/$RECIPE"))
+
+(defun latest-recipe-sha256 (semaphore repo base-rev recipe)
+  (promise-then
+   (shell-promise
+    semaphore (assocenv process-environment
+                        "GIT_DIR" repo
+                        "BASE_REV" base-rev
+                        "RECIPE" recipe)
+    "exec nix-hash --flat --type sha256 --base32 <(
+       git cat-file blob $(
+         git ls-tree $BASE_REV recipes/$RECIPE | cut -f1 | cut -d' ' -f3
+       )
+     )")
+   (lambda (res)
+     (car
+      (split-string res)))))
+
+(defun index-recipe-commits (semaphore repo base-rev recipes)
+  (promise-then
+   (promise-all
+    (mapcar (lambda (recipe)
+              (promise-then
+               (latest-recipe-commit semaphore repo base-rev recipe)
+               (let ((sha256p (latest-recipe-sha256 semaphore repo base-rev recipe)))
+                 (lambda (commit)
+                   (promise-then sha256p
+                                 (lambda (sha256)
+                                   (message "Indexed Recipe %s %s %s" recipe commit sha256)
+                                   (cons recipe (cons commit sha256))))))))
+            recipes))
+   (lambda (rcp-commits)
+     (let ((idx (make-hash-table :test 'equal)))
+       (mapc (lambda (rcpc)
+               (puthash (car rcpc) (cdr rcpc) idx))
+             rcp-commits)
+       idx))))
+
+(defun with-melpa-checkout (resolve)
+  (let ((tmpdir (make-temp-file "melpa-" t)))
+    (promise-finally
+     (promise-then
+      (shell-promise
+       (semaphore-create 1 "dummy")
+       (assocenv process-environment "MELPA_DIR" tmpdir)
+       "cd $MELPA_DIR
+       (git init --bare
+        git remote add origin https://github.com/melpa/melpa.git
+        git fetch origin) 1>&2
+       echo -n $MELPA_DIR")
+      (lambda (dir)
+        (message "Created melpa checkout %s" dir)
+        (funcall resolve dir)))
+     (lambda ()
+       (delete-directory tmpdir t)
+       (message "Deleted melpa checkout %s" tmpdir)))))
+
+(defun list-recipes (repo base-rev)
+  (promise-then
+   (shell-promise nil (assocenv process-environment
+                                "GIT_DIR" repo
+                                "BASE_REV" base-rev)
+                  "git ls-tree --name-only $BASE_REV recipes/")
+   (lambda (s)
+     (mapcar (lambda (n)
+               (substring n 8))
+             (split-string s)))))
+
+;; ## Main runner
+
+(defvar recipe-indexp)
+(defvar archivep)
+
+(defun run-updater ()
+  (message "Turning off logging to *Message* buffer")
+  (setq message-log-max nil)
+  (setenv "GIT_ASKPASS")
+  (setenv "SSH_ASKPASS")
+  (setq process-adaptive-read-buffering nil)
+
+  ;; Indexer and Prefetcher run in parallel
+
+  ;; Recipe Indexer
+  (setq recipe-indexp
+        (with-melpa-checkout
+         (lambda (repo)
+           (promise-then
+            (promise-then
+             (list-recipes repo "origin/master")
+             (lambda (recipe-names)
+               (promise:make-thread #'index-recipe-commits
+                                    ;; The indexer runs on a local git repository,
+                                    ;; so it is CPU bound.
+                                    ;; Adjust for core count + 2
+                                    (semaphore-create 6 "local-indexer")
+                                    repo "origin/master"
+                                    ;; (seq-take recipe-names 20)
+                                    recipe-names)))
+            (lambda (res)
+              (message "Indexed Recipes: %d" (hash-table-count res))
+              (defvar recipe-index res)
+              res)
+            (lambda (err)
+              (message "ERROR: %s" err))))))
+
+  ;; Prefetcher + Emitter
+  (setq archivep
+        (promise-then
+         (promise-then (promise-all
+                        (list (http-get "https://melpa.org/recipes.json"
+                                        (lambda ()
+                                          (let ((json-object-type 'alist)
+                                                (json-array-type 'list)
+                                                (json-key-type 'symbol))
+                                            (json-read))))
+                              (http-get "https://melpa.org/archive.json"
+                                        (lambda ()
+                                          (let ((json-object-type 'hash-table)
+                                                (json-array-type 'list)
+                                                (json-key-type 'symbol))
+                                            (json-read))))
+                              (http-get "https://stable.melpa.org/archive.json"
+                                        (lambda ()
+                                          (let ((json-object-type 'hash-table)
+                                                (json-array-type 'list)
+                                                (json-key-type 'symbol))
+                                            (json-read))))))
+                       (lambda (resolved)
+                         (message "Finished download")
+                         (seq-let [recipes-content archive-content stable-archive-content] resolved
+                           ;; The prefetcher is network bound, so 64 seems a good estimate
+                           ;; for parallel network connections
+                           (promise:make-thread #'emit-json (semaphore-create 64 "prefetch-pool")
+                                                recipe-indexp
+                                                recipes-content
+                                                archive-content
+                                                stable-archive-content
+                                                (parse-previous-archive "recipes-archive-melpa.json")))))
+         (lambda (buf)
+           (with-current-buffer buf
+             (write-file "recipes-archive-melpa.json")))
+         (lambda (err)
+           (message "ERROR: %s" err))))
+
+  ;; Shutdown routine
+  (make-thread
+   (lambda ()
+     (promise-finally archivep
+                      (lambda ()
+                        ;; (message "Joining threads %s" (all-threads))
+                        ;; (mapc (lambda (thr)
+                        ;;         (when (not (eq thr (current-thread)))
+                        ;;           (thread-join thr)))
+                        ;;       (all-threads))
+
+                        (kill-emacs 0))))))
--- a/pkgs/applications/editors/emacs-modes/updater-emacs.nix
+++ b/pkgs/applications/editors/emacs-modes/updater-emacs.nix
@ -0,0 +1,29 @@
+with import ../../../.. {};
+(emacsPackagesNgFor emacs26).
+emacsWithPackages (epkgs: let
+  promise = epkgs.trivialBuild {
+    pname = "promise";
+    version = "1";
+    src = fetchFromGitHub {
+      owner = "bendlas";
+      repo = "emacs-promise";
+      rev = "4da97087c5babbd8429b5ce62a8323b9b03c6022";
+      sha256 = "0yin7kj69g4zxs30pvk47cnfygxlaw7jc7chr3b36lz51yqczjsy";
+      
+    };
+  };
+  semaphore = epkgs.trivialBuild {
+    pname = "semaphore";
+    version = "1";
+    packageRequires = [ promise ];
+    src = fetchFromGitHub {
+      owner = "webnf";
+      repo = "semaphore.el";
+      rev = "93802cb093073bc6a6ccd797328dafffcef248e0";
+      sha256 = "09pfyp27m35sv340xarhld7xx2vv5fs5xj4418709iw6l6hpk853";
+      
+    };
+  };
+  in [ promise semaphore ]
+     #  ++ (with epkgs.melpaPackages; [ smex rainbow-delimiters paredit ])
+)
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -7,7 +7,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.49.0.49";
+  version = "8.50.0.38";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
@ -58,7 +58,7 @@ let
    if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchurl {
        url = "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb";
-        sha256 = "0l5q336kkw9i13076qn7fkknypg7cwjp58qi8xd6h0rwha3kkqa2";
+        sha256 = "1g0aacp4qgzp3018w1s685yr3ssqlw0z2x6ifrj01k4ig82jfkn6";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/instant-messengers/slack/dark-theme.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/dark-theme.nix
@ -1,22 +1,19 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchgit }:

-let
+stdenv.mkDerivation rec {
  rev = "e2a6a9cd9da70175881ab991220c86aa87179509";
-  sha256 = "1gw0kpszgflk3vqjlm5igd2rznh36mb2j1iqrcqi6pzxlpccv1lg";
  version = "2019-07-25";
-in stdenv.mkDerivation {
-  inherit version;
+  name = "slack-theme-black-${version}";

-  name = "slack-theme-black";
-  src = fetchurl {
-    url = "https://raw.githubusercontent.com/laCour/slack-night-mode/${rev}/css/raw/black.css";
-    inherit sha256;
+  src = fetchgit { inherit rev;
+    url = "https://github.com/laCour/slack-night-mode";
+    sha256 = "1jwxy63qzgvr83idsgcg7yhm9kn0ybfji1m964c5c6ypzcm7j10v";
  };

  dontUnpack = true;

  buildCommand = ''
    mkdir $out
-    cp $src $out/theme.css
+    cp $src/css/raw/black.css $out/theme.css
  '';
 }
--- a/pkgs/applications/networking/instant-messengers/slack/update.sh
+++ b/pkgs/applications/networking/instant-messengers/slack/update.sh
@ -0,0 +1,19 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl common-updater-scripts jq
+
+set -eu -o pipefail
+
+oldVersion="$(nix-instantiate --eval -E "with import ./. {}; slack-theme-black.version or (builtins.parseDrvName slack-theme-black.name).version" | tr -d '"')"
+latestSha="$(curl -L -s https://api.github.com/repos/laCour/slack-night-mode/commits\?sha\=master\&since\=${oldVersion} | jq -r '.[0].sha')"
+
+if [ ! "null" = "${latestSha}" ]; then
+  latestDate="$(curl -L -s https://api.github.com/repos/laCour/slack-night-mode/commits/${latestSha} | jq '.commit.author.date' | sed 's|"\(.*\)T.*|\1|g')"
+  update-source-version slack-theme-black "${latestSha}" --version-key=rev
+  update-source-version slack-theme-black "${latestDate}" --ignore-same-hash
+  nixpkgs="$(git rev-parse --show-toplevel)"
+  default_nix="$nixpkgs/pkgs/applications/networking/instant-messengers/slack/dark-theme.nix"
+  git add "${default_nix}"
+  git commit -m "slack-theme-black: ${oldVersion} -> ${latestDate}"
+else
+  echo "slack-theme-black is already up-to-date"
+fi
--- a/pkgs/applications/science/electronics/verilog/default.nix
+++ b/pkgs/applications/science/electronics/verilog/default.nix
@ -1,31 +1,40 @@
-{ stdenv, fetchFromGitHub, autoconf, gperf, flex, bison }:
+{ stdenv, fetchFromGitHub, autoconf, gperf, flex, bison, readline, ncurses
+, bzip2, zlib
+}:

 stdenv.mkDerivation rec {
-  name = "iverilog-${version}";
-  version = "2019.03.27";
+  pname = "iverilog";
+  version = "unstable-2019-08-01";

  src = fetchFromGitHub {
    owner  = "steveicarus";
-    repo   = "iverilog";
-    rev    = "a9388a895eb85a9d7f2924b89f839f94e1b6d7c4";
-    sha256 = "01d48sy3pzg9x1xpczqrsii2ckrvgnrfj720wiz22jdn90nirhhr";
+    repo = pname;
+    rev    = "c383d2048c0bd15f5db083f14736400546fb6215";
+    sha256 = "1zs0gyhws0qa315magz3w5m45v97knczdgbf2zn4d7bdb7cv417c";
  };

  enableParallelBuilding = true;

-  patchPhase = ''
+  prePatch = ''
+    substituteInPlace configure.in \
+      --replace "AC_CHECK_LIB(termcap, tputs)" "AC_CHECK_LIB(termcap, tputs)"
+  '';
+
+  preConfigure = ''
    chmod +x $PWD/autoconf.sh
    $PWD/autoconf.sh
  '';

-  buildInputs = [ autoconf gperf flex bison ];
+  nativeBuildInputs = [ autoconf gperf flex bison ];

-  meta = {
+  buildInputs = [ readline ncurses bzip2 zlib ];
+
+  meta = with stdenv.lib; {
    description = "Icarus Verilog compiler";
    repositories.git = https://github.com/steveicarus/iverilog.git;
-    homepage = http://www.icarus.com;
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = with stdenv.lib.maintainers; [winden];
-    platforms = with stdenv.lib.platforms; linux;
+    homepage = "http://iverilog.icarus.com/";
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ winden ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/video/vokoscreen/default.nix
+++ b/pkgs/applications/video/vokoscreen/default.nix
@ -1,9 +1,9 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, fetchFromGitHub, mkDerivation
 , pkgconfig, qtbase, qttools, qmake, qtmultimedia, qtx11extras, alsaLib, libv4l, libXrandr
 , ffmpeg
 }:

-stdenv.mkDerivation rec {
+mkDerivation rec {

  pname = "vokoscreen";
  version = "2.5.8-beta";
--- a/pkgs/development/compilers/graalvm/001_mx.py.patch
+++ b/pkgs/development/compilers/graalvm/001_mx.py.patch
@ -1,8 +1,8 @@
 diff --git a/mx.py b/mx.py
-index d119b62..471fe98 100644
+index af7a9c2..08c0ea8 100755
 --- a/mx.py
 +++ b/mx.py
-@@ -4961,30 +4961,6 @@ class PackedResourceLibrary(ResourceLibrary):
+@@ -4976,30 +4976,6 @@ class PackedResourceLibrary(ResourceLibrary):
 
     def get_path(self, resolve):
         extract_path = _make_absolute(self.extract_path, self.suite.dir)
@ -33,7 +33,7 @@ index d119b62..471fe98 100644
         return extract_path
 
     def _check_download_needed(self):
-@@ -5885,7 +5861,7 @@ class HgConfig(VC):
+@@ -5900,7 +5876,7 @@ class HgConfig(VC):
 
     def update_to_branch(self, vcdir, branch, abortOnError=True):
         cmd = ['update', branch]
@ -42,7 +42,7 @@ index d119b62..471fe98 100644
 
     def add(self, vcdir, path, abortOnError=True):
         return self.run(['hg', '-q', '-R', vcdir, 'add', path]) == 0
-@@ -5922,7 +5898,7 @@ class HgConfig(VC):
+@@ -5937,7 +5913,7 @@ class HgConfig(VC):
                 return None
 
     def parent_info(self, vcdir, abortOnError=True):
@ -51,7 +51,7 @@ index d119b62..471fe98 100644
         author, date = out.split("|||")
         ts, _ = date.split(" ")
         return self._sanitize_parent_info({
-@@ -8287,46 +8263,8 @@ class SuiteImport:
+@@ -8301,46 +8277,8 @@ class SuiteImport:
         version = import_dict.get("version")
         suite_dir = None
         version_from = import_dict.get("versionFrom")
@ -100,7 +100,7 @@ index d119b62..471fe98 100644
 
     @staticmethod
     def get_source_urls(source, kind=None):
-@@ -8367,8 +8305,6 @@ class Suite(object):
+@@ -8381,8 +8319,6 @@ class Suite(object):
     :type dists: list[Distribution]
     """
     def __init__(self, mxDir, primary, internal, importing_suite, load, vc, vc_dir, dynamicallyImported=False):
@ -109,7 +109,7 @@ index d119b62..471fe98 100644
         self.imported_by = [] if primary else [importing_suite]
         self.mxDir = mxDir
         self.dir = dirname(mxDir)
-@@ -8396,7 +8332,7 @@ class Suite(object):
+@@ -8410,7 +8346,7 @@ class Suite(object):
         self._outputRoot = None
         self._preloaded_suite_dict = None
         self.vc = vc
@ -118,7 +118,7 @@ index d119b62..471fe98 100644
         self._preload_suite_dict()
         self._init_imports()
         if load:
-@@ -9295,7 +9231,9 @@ def get_dynamic_imports():
+@@ -9310,7 +9246,9 @@ def get_dynamic_imports():
 class SourceSuite(Suite):
     """A source suite"""
     def __init__(self, mxDir, primary=False, load=True, internal=False, importing_suite=None, dynamicallyImported=False):
@ -129,7 +129,7 @@ index d119b62..471fe98 100644
         Suite.__init__(self, mxDir, primary, internal, importing_suite, load, vc, vc_dir, dynamicallyImported=dynamicallyImported)
         logvv("SourceSuite.__init__({}), got vc={}, vc_dir={}".format(mxDir, self.vc, self.vc_dir))
         self.projects = []
-@@ -9344,17 +9282,7 @@ class SourceSuite(Suite):
+@@ -9359,17 +9297,7 @@ class SourceSuite(Suite):
         """
         Gets the release tag from VC or create a time based once if VC is unavailable
         """
@ -148,7 +148,7 @@ index d119b62..471fe98 100644
 
     def scm_metadata(self, abortOnError=False):
         scm = self.scm
-@@ -12526,55 +12454,8 @@ def _attempt_download(url, path, jarEntryName=None):
+@@ -12541,55 +12469,8 @@ def _attempt_download(url, path, jarEntryName=None):
     return False
 
 def download(path, urls, verbose=False, abortOnError=True, verifyOnly=False):
@ -206,7 +206,7 @@ index d119b62..471fe98 100644
 
 def update_file(path, content, showDiff=False):
     """
-@@ -13378,6 +13259,7 @@ class Archiver(SafeFileCreation):
+@@ -13393,6 +13274,7 @@ class Archiver(SafeFileCreation):
 
     def _add_zip(self, filename, archive_name, provenance):
         self._add_provenance(archive_name, provenance)
@ -214,7 +214,7 @@ index d119b62..471fe98 100644
         self.zf.write(filename, archive_name)
 
     def _add_str_zip(self, data, archive_name, provenance):
-@@ -18526,12 +18408,35 @@ def _find_suite_import(importing_suite, suite_import, fatalIfMissing=True, load=
+@@ -18541,12 +18423,35 @@ def _find_suite_import(importing_suite, suite_import, fatalIfMissing=True, load=
         Attempts to locate an existing suite in the local context
         Returns the path to the mx.name dir if found else None
         """
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@ -1,10 +1,10 @@
-{ stdenv, lib, fetchFromGitHub, fetchurl, fetchzip, fetchgit, mercurial, python27,
-  zlib, makeWrapper, openjdk, unzip, git, clang, llvm, which, icu, ruby, bzip2
+{ stdenv, lib, fetchFromGitHub, fetchurl, fetchzip, fetchgit, mercurial, python27, setJavaClassPath,
+  zlib, makeWrapper, openjdk, unzip, git, clang, llvm, which, icu, ruby, bzip2, glibc
  # gfortran, readline, bzip2, lzma, pcre, curl, ed, tree ## WIP: fastr deps
 }:

 let
-  version = "1.0.0-rc15";
+  version = "19.1.1";
  truffleMake = ./truffle.make;
  makeMxGitCache = list: out: ''
     mkdir ${out}
@ -32,7 +32,7 @@ let
    hg checkout ${lib.escapeShellArg "vm${version}"}
  '';

-  # pre-download some cache entries ('mx' will not be able to download under nixbld1)
+  # pre-download some cache entries ('mx' will not be able to download under nixbld)
  makeMxCache = list:
    stdenv.mkDerivation {
      name = "mx-cache";
@ -62,31 +62,27 @@ let
    };

  jvmci8-mxcache = [
-    rec { sha1 = "977b33afe2344a9ee801fd3317c54d8e1f9d7a79"; name = "JACOCOCORE_0.8.2_${sha1}/jacococore-0.8.2.jar";                                   url = mirror://maven/org/jacoco/org.jacoco.core/0.8.2/org.jacoco.core-0.8.2.jar; }
-    rec { sha1 = "46f38efb779fb08216379e1a196396f4e22bbe41"; name = "JACOCOCORE_0.8.2_${sha1}/jacococore-0.8.2.sources.jar";                           url = mirror://maven/org/jacoco/org.jacoco.core/0.8.2/org.jacoco.core-0.8.2-sources.jar; }
-    rec { sha1 = "50e133cdfd2d31ca5702b73615be70f801d3ae26"; name = "JACOCOREPORT_0.8.2_${sha1}/jacocoreport-0.8.2.jar";                               url = mirror://maven/org/jacoco/org.jacoco.report/0.8.2/org.jacoco.report-0.8.2.jar; }
-    rec { sha1 = "7488cd6e42cc4fa85b51200b7f451465692e033b"; name = "JACOCOREPORT_0.8.2_${sha1}/jacocoreport-0.8.2.sources.jar";                       url = mirror://maven/org/jacoco/org.jacoco.report/0.8.2/org.jacoco.report-0.8.2-sources.jar; }
-    rec { sha1 = "4806883004063feb978b8811f00d5ea2138750bb"; name = "JACOCOAGENT_0.8.2_${sha1}/jacocoagent-0.8.2.jar";                                 url = mirror://maven/org/jacoco/org.jacoco.agent/0.8.2/org.jacoco.agent-0.8.2-runtime.jar; }
+    rec { sha1 = "53addc878614171ff0fcbc8f78aed12175c22cdb"; name = "JACOCOCORE_0.8.4_${sha1}/jacococore-0.8.4.jar";                                   url = mirror://maven/org/jacoco/org.jacoco.core/0.8.4/org.jacoco.core-0.8.4.jar; }
+    rec { sha1 = "9bd1fa334d941005bc9ab3ac92478a590f5b7d73"; name = "JACOCOCORE_0.8.4_${sha1}/jacococore-0.8.4.sources.jar";                           url = mirror://maven/org/jacoco/org.jacoco.core/0.8.4/org.jacoco.core-0.8.4-sources.jar; }
+    rec { sha1 = "e5ca9511493b7e3bc2cabdb8ded92e855f3aac32"; name = "JACOCOREPORT_0.8.4_${sha1}/jacocoreport-0.8.4.jar";                               url = mirror://maven/org/jacoco/org.jacoco.report/0.8.4/org.jacoco.report-0.8.4.jar; }
+    rec { sha1 = "eb61e479b35b467954f28a565c094c563b790e19"; name = "JACOCOREPORT_0.8.4_${sha1}/jacocoreport-0.8.4.sources.jar";                       url = mirror://maven/org/jacoco/org.jacoco.report/0.8.4/org.jacoco.report-0.8.4-sources.jar; }
+    rec { sha1 = "869021a6d90cfb008b12e83fccbe42eca29e5355"; name = "JACOCOAGENT_0.8.4_${sha1}/jacocoagent-0.8.4.jar";                                 url = mirror://maven/org/jacoco/org.jacoco.agent/0.8.4/org.jacoco.agent-0.8.4-runtime.jar; }
    rec { sha1 = "306816fb57cf94f108a43c95731b08934dcae15c"; name = "JOPTSIMPLE_4_6_${sha1}/joptsimple-4-6.jar";                                       url = mirror://maven/net/sf/jopt-simple/jopt-simple/4.6/jopt-simple-4.6.jar; }
    rec { sha1 = "9cd14a61d7aa7d554f251ef285a6f2c65caf7b65"; name = "JOPTSIMPLE_4_6_${sha1}/joptsimple-4-6.sources.jar";                               url = mirror://maven/net/sf/jopt-simple/jopt-simple/4.6/jopt-simple-4.6-sources.jar; }
-    rec { sha1 = "b852fb028de645ad2852bbe998e084d253f450a5"; name = "JMH_GENERATOR_ANNPROCESS_1_18_${sha1}/jmh-generator-annprocess-1-18.jar";         url = mirror://maven/org/openjdk/jmh/jmh-generator-annprocess/1.18/jmh-generator-annprocess-1.18.jar; }
-    rec { sha1 = "d455b0dc6108b5e6f1fb4f6cf1c7b4cbedbecc97"; name = "JMH_GENERATOR_ANNPROCESS_1_18_${sha1}/jmh-generator-annprocess-1-18.sources.jar"; url = mirror://maven/org/openjdk/jmh/jmh-generator-annprocess/1.18/jmh-generator-annprocess-1.18-sources.jar; }
-    rec { sha1 = "7aac374614a8a76cad16b91f1a4419d31a7dcda3"; name = "JMH_GENERATOR_ANNPROCESS_1_21_${sha1}/jmh-generator-annprocess-1-21.jar";         url = mirror://maven/org/openjdk/jmh/jmh-generator-annprocess/1.21/jmh-generator-annprocess-1.21.jar; }
-    rec { sha1 = "fb48e2a97df95f8b9dced54a1a37749d2a64d2ae"; name = "JMH_GENERATOR_ANNPROCESS_1_21_${sha1}/jmh-generator-annprocess-1-21.sources.jar"; url = mirror://maven/org/openjdk/jmh/jmh-generator-annprocess/1.21/jmh-generator-annprocess-1.21-sources.jar; }
-    rec { sha1 = "c01b6798f81b0fc2c5faa70cbe468c275d4b50c7"; name = "ASM_6.2.1_${sha1}/asm-6.2.1.jar";                                                 url = mirror://maven/org/ow2/asm/asm/6.2.1/asm-6.2.1.jar; }
-    rec { sha1 = "cee28077ac7a63d3de0b205ec314d83944ff6267"; name = "ASM_6.2.1_${sha1}/asm-6.2.1.sources.jar";                                         url = mirror://maven/org/ow2/asm/asm/6.2.1/asm-6.2.1-sources.jar; }
-    rec { sha1 = "332b022092ecec53cdb6272dc436884b2d940615"; name = "ASM_TREE_6.2.1_${sha1}/asm-tree-6.2.1.jar";                                       url = mirror://maven/org/ow2/asm/asm-tree/6.2.1/asm-tree-6.2.1.jar; }
-    rec { sha1 = "072bd64989090e4ed58e4657e3d4481d96f643af"; name = "ASM_TREE_6.2.1_${sha1}/asm-tree-6.2.1.sources.jar";                               url = mirror://maven/org/ow2/asm/asm-tree/6.2.1/asm-tree-6.2.1-sources.jar; }
-    rec { sha1 = "e8b876c5ccf226cae2f44ed2c436ad3407d0ec1d"; name = "ASM_ANALYSIS_6.2.1_${sha1}/asm-analysis-6.2.1.jar";                               url = mirror://maven/org/ow2/asm/asm-analysis/6.2.1/asm-analysis-6.2.1.jar; }
-    rec { sha1 = "b0b249bd185677648692e7c57b488b6d7c2a6653"; name = "ASM_ANALYSIS_6.2.1_${sha1}/asm-analysis-6.2.1.sources.jar";                       url = mirror://maven/org/ow2/asm/asm-analysis/6.2.1/asm-analysis-6.2.1-sources.jar; }
-    rec { sha1 = "eaf31376d741a3e2017248a4c759209fe25c77d3"; name = "ASM_COMMONS_6.2.1_${sha1}/asm-commons-6.2.1.jar";                                 url = mirror://maven/org/ow2/asm/asm-commons/6.2.1/asm-commons-6.2.1.jar; }
-    rec { sha1 = "667fa0f9d370e7848b0e3d173942855a91fd1daf"; name = "ASM_COMMONS_6.2.1_${sha1}/asm-commons-6.2.1.sources.jar";                         url = mirror://maven/org/ow2/asm/asm-commons/6.2.1/asm-commons-6.2.1-sources.jar; }
+    rec { sha1 = "fa29aa438674ff19d5e1386d2c3527a0267f291e"; name = "ASM_7.1_${sha1}/asm-7.1.jar";                                                     url = mirror://maven/org/ow2/asm/asm/7.1/asm-7.1.jar; }
+    rec { sha1 = "9d170062d595240da35301362b079e5579c86f49"; name = "ASM_7.1_${sha1}/asm-7.1.sources.jar";                                             url = mirror://maven/org/ow2/asm/asm/7.1/asm-7.1-sources.jar; }
+    rec { sha1 = "a3662cf1c1d592893ffe08727f78db35392fa302"; name = "ASM_TREE_7.1_${sha1}/asm-tree-7.1.jar";                                           url = mirror://maven/org/ow2/asm/asm-tree/7.1/asm-tree-7.1.jar; }
+    rec { sha1 = "157238292b551de8680505fa2d19590d136e25b9"; name = "ASM_TREE_7.1_${sha1}/asm-tree-7.1.sources.jar";                                   url = mirror://maven/org/ow2/asm/asm-tree/7.1/asm-tree-7.1-sources.jar; }
+    rec { sha1 = "379e0250f7a4a42c66c5e94e14d4c4491b3c2ed3"; name = "ASM_ANALYSIS_7.1_${sha1}/asm-analysis-7.1.jar";                                   url = mirror://maven/org/ow2/asm/asm-analysis/7.1/asm-analysis-7.1.jar; }
+    rec { sha1 = "36789198124eb075f1a5efa18a0a7812fb16f47f"; name = "ASM_ANALYSIS_7.1_${sha1}/asm-analysis-7.1.sources.jar";                           url = mirror://maven/org/ow2/asm/asm-analysis/7.1/asm-analysis-7.1-sources.jar; }
+    rec { sha1 = "431dc677cf5c56660c1c9004870de1ed1ea7ce6c"; name = "ASM_COMMONS_7.1_${sha1}/asm-commons-7.1.jar";                                     url = mirror://maven/org/ow2/asm/asm-commons/7.1/asm-commons-7.1.jar; }
+    rec { sha1 = "a62ff3ae6e37affda7c6fb7d63b89194c6d006ee"; name = "ASM_COMMONS_7.1_${sha1}/asm-commons-7.1.sources.jar";                             url = mirror://maven/org/ow2/asm/asm-commons/7.1/asm-commons-7.1-sources.jar; }
    rec { sha1 = "ec2544ab27e110d2d431bdad7d538ed509b21e62"; name = "COMMONS_MATH3_3_2_${sha1}/commons-math3-3-2.jar";                                 url = mirror://maven/org/apache/commons/commons-math3/3.2/commons-math3-3.2.jar; }
    rec { sha1 = "cd098e055bf192a60c81d81893893e6e31a6482f"; name = "COMMONS_MATH3_3_2_${sha1}/commons-math3-3-2.sources.jar";                         url = mirror://maven/org/apache/commons/commons-math3/3.2/commons-math3-3.2-sources.jar; }
-    rec { sha1 = "0174aa0077e9db596e53d7f9ec37556d9392d5a6"; name = "JMH_1_18_${sha1}/jmh-1-18.jar";                                                   url = mirror://maven/org/openjdk/jmh/jmh-core/1.18/jmh-core-1.18.jar; }
-    rec { sha1 = "7ff1e1aafea436b6aa8b29a8b8f1c2d66be26f5b"; name = "JMH_1_18_${sha1}/jmh-1-18.sources.jar";                                           url = mirror://maven/org/openjdk/jmh/jmh-core/1.18/jmh-core-1.18-sources.jar; }
    rec { sha1 = "442447101f63074c61063858033fbfde8a076873"; name = "JMH_1_21_${sha1}/jmh-1-21.jar";                                                   url = mirror://maven/org/openjdk/jmh/jmh-core/1.21/jmh-core-1.21.jar; }
    rec { sha1 = "a6fe84788bf8cf762b0e561bf48774c2ea74e370"; name = "JMH_1_21_${sha1}/jmh-1-21.sources.jar";                                           url = mirror://maven/org/openjdk/jmh/jmh-core/1.21/jmh-core-1.21-sources.jar; }
+    rec { sha1 = "7aac374614a8a76cad16b91f1a4419d31a7dcda3"; name = "JMH_GENERATOR_ANNPROCESS_1_21_${sha1}/jmh-generator-annprocess-1-21.jar";         url = mirror://maven/org/openjdk/jmh/jmh-generator-annprocess/1.21/jmh-generator-annprocess-1.21.jar; }
+    rec { sha1 = "fb48e2a97df95f8b9dced54a1a37749d2a64d2ae"; name = "JMH_GENERATOR_ANNPROCESS_1_21_${sha1}/jmh-generator-annprocess-1-21.sources.jar"; url = mirror://maven/org/openjdk/jmh/jmh-generator-annprocess/1.21/jmh-generator-annprocess-1.21-sources.jar; }
    rec { sha1 = "2973d150c0dc1fefe998f834810d68f278ea58ec"; name = "JUNIT_${sha1}/junit.jar";                                                         url = mirror://maven/junit/junit/4.12/junit-4.12.jar; }
    rec { sha1 = "a6c32b40bf3d76eca54e3c601e5d1470c86fcdfa"; name = "JUNIT_${sha1}/junit.sources.jar";                                                 url = mirror://maven/junit/junit/4.12/junit-4.12-sources.jar; }
    rec { sha1 = "42a25dc3219429f0e5d060061f71acb49bf010a0"; name = "HAMCREST_${sha1}/hamcrest.jar";                                                   url = mirror://maven/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar; }
@ -114,11 +110,11 @@ let
    rec { sha1 = "280c265b789e041c02e5c97815793dfc283fb1e6"; name = "LIBFFI_SOURCES_${sha1}/libffi-sources.tar.gz";                                    url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/libffi-3.2.1.tar.gz; }
    rec { sha1 = "8819cea8bfe22c9c63f55465e296b3855ea41786"; name = "TruffleJSON_${sha1}/trufflejson.jar";                                             url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/trufflejson-20180130.jar; }
    rec { sha1 = "9712a8124c40298015f04a74f61b3d81a51513af"; name = "CHECKSTYLE_8.8_${sha1}/checkstyle-8.8.jar";                                       url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/checkstyle-8.8-all.jar; }
-    rec { sha1 = "5a5574f03b58465226166a638641a384b9f44445"; name = "VISUALVM_COMMON_${sha1}/visualvm-common.tar.gz";                                  url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm-655.tar.gz; }
-    rec { sha1 = "64f07398bac9897e9b8123edeaf5cf9ff19517b5"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm-655-linux-amd64.tar.gz; }
+    rec { sha1 = "158ba6f2b346469b5f8083d1700c3f55b8b9082c"; name = "VISUALVM_COMMON_${sha1}/visualvm-common.tar.gz";                                  url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-11.tar.gz; }
+    rec { sha1 = "eb5ffa476ed2f6fac0ecd4bb2ae32741f9646932"; name = "VISUALVM_PLATFORM_SPECIFIC_${sha1}/visualvm-platform-specific.tar.gz";            url = https://lafo.ssw.uni-linz.ac.at/pub/graal-external-deps/visualvm/visualvm-19_0_0-11-linux-amd64.tar.gz; }
    rec { sha1 = "e6e60889b7211a80b21052a249bd7e0f88f79fee"; name = "Java-WebSocket_${sha1}/java-websocket.jar";                                       url = mirror://maven/org/java-websocket/Java-WebSocket/1.3.9/Java-WebSocket-1.3.9.jar; }
    rec { sha1 = "7a4d00d5ec5febd252a6182e8b6e87a0a9821f81"; name = "ICU4J_${sha1}/icu4j.jar";                                                         url = mirror://maven/com/ibm/icu/icu4j/62.1/icu4j-62.1.jar; }
-   # This duplication of asm with underscore and minus is totally weird
+    # This duplication of asm with underscore and minus is totally weird
    rec { sha1 = "c01b6798f81b0fc2c5faa70cbe468c275d4b50c7"; name = "ASM-6.2.1_${sha1}/asm-6.2.1.jar";                                                 url = mirror://maven/org/ow2/asm/asm/6.2.1/asm-6.2.1.jar; }
    rec { sha1 = "cee28077ac7a63d3de0b205ec314d83944ff6267"; name = "ASM-6.2.1_${sha1}/asm-6.2.1.sources.jar";                                         url = mirror://maven/org/ow2/asm/asm/6.2.1/asm-6.2.1-sources.jar; }
    rec { sha1 = "332b022092ecec53cdb6272dc436884b2d940615"; name = "ASM_TREE-6.2.1_${sha1}/asm-tree-6.2.1.jar";                                       url = mirror://maven/org/ow2/asm/asm-tree/6.2.1/asm-tree-6.2.1.jar; }
@ -145,14 +141,10 @@ let
  ];

  graal-mxcachegit = [
-    { sha256 = "0siryzvmj9h8zkyr0d3gy9fqgyxb9s5xs15rf7lnx9zh3ykq549y"; name = "graaljs";
-      url = "http://github.com/graalvm/graaljs.git"; rev = "vm-${version}"; }
-    { sha256 = "1ii3mwa0c2zk9vm51hyrymdz3whfihm6sccd2r5ja2v53jcdc1a3"; name = "truffleruby";
-      url = "http://github.com/oracle/truffleruby.git"; rev = "vm-${version}"; }
-    { sha256 = "1nz8yqg2k9shpmhj3jv7k2icfg72cm55baf354rsh1pqanay8qb7"; name = "fastr";
-      url = "http://github.com/oracle/fastr.git"; rev = "vm-${version}"; }
-    { sha256 = "1c8nnrl30fys22gk3y6dvxzq0fq1a5hjkqrw15p68cwpz9wma4gi"; name = "graalpython";
-      url = "https://github.com/graalvm/graalpython.git"; rev = "vm-${version}"; }
+    { sha256 = "05z2830ng71bhgsxc0zyc74l1bz7hg54la8j1r99993fhhch4y36"; name = "graaljs";     url = "https://github.com/graalvm/graaljs.git";     rev = "vm-${version}"; }
+    { sha256 = "0ai5x4n1c2lcfkfpp29zn1bcmp3khc5hvssyw1qr1l2zy79fxwjp"; name = "truffleruby"; url = "https://github.com/oracle/truffleruby.git";  rev = "vm-${version}"; }
+    { sha256 = "010079qsl6dff3yca8vlzcahq9z1ppyr758shjkm1f7izwphjv7p"; name = "fastr";       url = "https://github.com/oracle/fastr.git";        rev = "vm-${version}"; }
+    { sha256 = "0hcqbasqs0yb7p1sal63qbxqxh942gh5vzl95pfdlflmc2g82v4q"; name = "graalpython"; url = "https://github.com/graalvm/graalpython.git"; rev = "vm-${version}"; }
  ];

  ninja-syntax = python27.pkgs.buildPythonPackage rec {
@ -176,13 +168,13 @@ let
 in rec {

  mx = stdenv.mkDerivation rec {
-    version = "5.215.4";
+    version = "5.223.0";
    pname = "mx";
    src = fetchFromGitHub {
      owner  = "graalvm";
      repo   = "mx";
      rev    = version;
-      sha256 = "0wrwfiwqjw6xp0bvp2g15jn6yrjb9w6jw1xnwvkyhkw1s6m0w0z1";
+      sha256 = "0q51dnm6n1472p93dxr4jh8d7cv09a70pq89cdgxwh42vapykrn9";
    };
    nativeBuildInputs = [ makeWrapper ];
    prePatch = ''
@ -215,19 +207,19 @@ in rec {
    meta = with stdenv.lib; {
      homepage = https://github.com/graalvm/mx;
      description = "Command-line tool used for the development of Graal projects";
-      license = licenses.unfree;
+      license = licenses.gpl2;
      platforms = python27.meta.platforms;
    };
  };

  jvmci8 = stdenv.mkDerivation rec {
-    version = "0.58";
+    version = "19.2-b01";
    name = "jvmci-${version}";
    src = fetchFromGitHub {
      owner  = "graalvm";
      repo   = "graal-jvmci-8";
      rev    = "jvmci-${version}";
-      sha256 = "0p8icn3d99zggsh6pqb15dz1j186ck442sjpn2cv43n4nvdmmp1m";
+      sha256 = "0maipj871vaxvap4576m0pzblzqxfjjzmwap3ndd84ny8d6vbqaa";
    };
    buildInputs = [ mx mercurial openjdk ];
    postUnpack = ''
@ -245,6 +237,9 @@ in rec {
      # The hotspot version name regex fix
      substituteInPlace mx.jvmci/mx_jvmci.py \
        --replace "\\d+.\\d+-b\\d+" "\\d+.\\d+-bga"
+      substituteInPlace src/share/vm/jvmci/jvmciCompilerToVM.cpp \
+        --replace 'method->name_and_sig_as_C_string(), method->native_function(), entry' \
+                  'method->name_and_sig_as_C_string(), p2i(method->native_function()), p2i(entry)' || exit -1
    '';
    hardeningDisable = [ "fortify" ];
    NIX_CFLAGS_COMPILE = [
@ -264,9 +259,22 @@ in rec {
      mv openjdk1.8.0_*/linux-amd64/product/* $out
      install -v -m0555 -D $MX_CACHE_DIR/hsdis*/hsdis.so $out/jre/lib/amd64/hsdis-amd64.so
    '';
-    dontFixup = true; # do not nuke path of ffmpeg etc
-    dontStrip = true; # why? see in oraclejdk derivation
-    meta = openjdk.meta // { inherit (graalvm8.meta) platforms; };
+    # copy-paste openjdk's preFixup
+    preFixup = ''
+      # Propagate the setJavaClassPath setup hook from the JRE so that
+      # any package that depends on the JRE has $CLASSPATH set up
+      # properly.
+      mkdir -p $out/nix-support
+      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
+
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat <<EOF > $out/nix-support/setup-hook
+      if [ -z "\$JAVA_HOME" ]; then export JAVA_HOME=$out; fi
+      EOF
+    '';
+    dontStrip = true; # stripped javac crashes with "segmentaion fault"
+    inherit (openjdk) meta;
    inherit (openjdk) postFixup;
  };

@ -277,7 +285,7 @@ in rec {
      owner  = "oracle";
      repo   = "graal";
      rev    = "vm-${version}";
-      sha256 = "18fqah8x7gwz02ji40b4vyqav9x5dw703xwikjc117wlyymb1k56";
+      sha256 = "0abx6adk91yzaf1md4qbidxykpqcgphh6j4hj01ry57s4if0j66f";
    };
    patches = [ ./002_setjmp.c.patch ./003_mx_truffle.py.patch ];
    buildInputs = [ mx zlib mercurial jvmci8 git clang llvm
@ -320,6 +328,10 @@ in rec {

      # Patch the native-image template, as it will be run during build
      chmod +x vm/mx.vm/launcher_template.sh && patchShebangs vm/mx.vm
+      # Prevent random errors from too low maxRuntimecompilemethods
+      substituteInPlace truffle/mx.truffle/macro-truffle.properties \
+        --replace '-H:MaxRuntimeCompileMethods=1400' \
+                  '-H:MaxRuntimeCompileMethods=28000'
    '';

    buildPhase = ''
@ -345,19 +357,21 @@ in rec {

    installPhase = ''
      mkdir -p $out
-      cp -rf $MX_ALT_OUTPUT_ROOT/vm/linux-amd64/GRAALVM_CMP_GU_GVM_INS_JS_LIBPOLY_NFI_NJS_POLY_POLYNATIVE_PRO_PYN_RGX_SLG_SVM_SVMAG_SVMCF_SVML_TFL_VVM/graalvm-unknown-${version}/* $out
+      rm -rf $MX_ALT_OUTPUT_ROOT/vm/linux-amd64/GRAALVM_*STAGE1*
+      cp -rf $MX_ALT_OUTPUT_ROOT/vm/linux-amd64/GRAALVM*/graalvm-unknown-${version}/* $out

      # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
      substituteInPlace $out/jre/lib/security/java.security \
        --replace file:/dev/random    file:/dev/./urandom \
        --replace NativePRNGBlocking  SHA1PRNG
-      # Organize the out dir
-      mkdir -p $out/share && mv $out/man $out/share
-      rm $out/ASSEMBLY_EXCEPTION $out/release $out/LICENSE $out/THIRD_PARTY_README
+      # copy static and dynamic libraries needed for static compilation
+      cp -rf ${glibc}/lib/* $out/jre/lib/svm/clibraries/linux-amd64/
+      cp ${glibc.static}/lib/* $out/jre/lib/svm/clibraries/linux-amd64/
+      cp ${zlib.static}/lib/libz.a $out/jre/lib/svm/clibraries/linux-amd64/libz.a
    '';

-    dontFixup = true; # do not nuke path of ffmpeg etc
-    dontStrip = true; # why? see in oraclejdk derivation
+    inherit (jvmci8) preFixup;
+    dontStrip = true; # stripped javac crashes with "segmentaion fault"
    doInstallCheck = true;
    installCheckPhase = ''
      echo ${lib.escapeShellArg ''
@ -377,8 +391,14 @@ in rec {
      $out/bin/native-image --no-server HelloWorld
      ./helloworld
      ./helloworld | fgrep 'Hello World'
+
+      # Ahead-Of-Time compilation with --static
+      $out/bin/native-image --no-server --static HelloWorld
+      ./helloworld
+      ./helloworld | fgrep 'Hello World'
    '';

+    enableParallelBuilding = true;
    passthru.home = graalvm8;

    meta = with stdenv.lib; {
@ -386,7 +406,7 @@ in rec {
      description = "High-Performance Polyglot VM";
      license = licenses.gpl2;
      maintainers = with maintainers; [ volth hlolli ];
-      platforms = [ "x86_64-linux" ];
+      platforms = [ "x86_64-linux" /*"aarch64-linux" "x86_64-darwin"*/ ];
    };
  };
 }
--- a/pkgs/development/ocaml-modules/lambdasoup/default.nix
+++ b/pkgs/development/ocaml-modules/lambdasoup/default.nix
@ -0,0 +1,23 @@
+{ lib, fetchFromGitHub, buildDunePackage, markup }:
+
+buildDunePackage rec {
+  pname = "lambdasoup";
+  version = "0.6.3"; # NB: double-check the license when updating
+
+  src = fetchFromGitHub {
+    owner = "aantron";
+    repo = pname;
+    rev = version;
+    sha256 = "1w4zp3vswijzvrx0c3fv269ncqwnvvrzc46629nnwm9shwv07vmv";
+  };
+
+  propagatedBuildInputs = [ markup ];
+
+  meta = {
+    description = "Functional HTML scraping and rewriting with CSS in OCaml";
+    homepage = "https://aantron.github.io/lambdasoup/";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+
+}
--- a/pkgs/development/ocaml-modules/secp256k1/default.nix
+++ b/pkgs/development/ocaml-modules/secp256k1/default.nix
@ -0,0 +1,22 @@
+{ stdenv, fetchFromGitHub, buildDunePackage, base, stdio, configurator, secp256k1 }:
+
+buildDunePackage rec {
+  pname = "secp256k1";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "dakk";
+    repo = "secp256k1-ml";
+    rev = "42c04c93e2ed9596f6378676e944c8cfabfa69d7";
+    sha256 = "1zw2kgg181a9lj1m8z0ybijs8gw9w1kk990avh1bp9x8kc1asffg";
+  };
+
+  buildInputs = [ base stdio configurator secp256k1 ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/dakk/secp256k1-ml;
+    description = "Elliptic curve library secp256k1 wrapper for Ocaml";
+    license = licenses.mit;
+    maintainers = [ maintainers.vyorkin ];
+  };
+}
--- a/pkgs/development/python-modules/cmd2/default.nix
+++ b/pkgs/development/python-modules/cmd2/default.nix
@ -6,11 +6,11 @@
 }:
 buildPythonPackage rec {
  pname = "cmd2";
-  version = "0.9.14";
+  version = "0.9.15";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0rllwc4h89xdivy85nmgqdi2s0sk1zw31mlvrnlr9gz2902cnq93";
+    sha256 = "0k3y3czpabw173vhqg523l2r804jj08986wlz6vyh224zr0ngggw";
  };

  LC_ALL="en_US.UTF-8";
--- a/pkgs/development/python-modules/pysnmp/default.nix
+++ b/pkgs/development/python-modules/pysnmp/default.nix
@ -7,12 +7,12 @@
 }:

 buildPythonPackage rec {
-  version = "4.4.9";
+  version = "4.4.10";
  pname = "pysnmp";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0h844s9p67z50bv83wdyf577759jg0xrj99fv4yrcvhjh2byblfm";
+    sha256 = "0bbcnn49krawq8pkhpzc427yxki0kxjndhhn61140j3wjbvavhah";
  };

  # NameError: name 'mibBuilder' is not defined
--- a/pkgs/development/python-modules/python-lz4/default.nix
+++ b/pkgs/development/python-modules/python-lz4/default.nix
@ -1,29 +1,30 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytestrunner
-, pytest
-, psutil
-, setuptools_scm
-, pkgconfig
-, isPy3k
 , future
+, isPy3k
+, pkgconfig
+, psutil
+, pytest
+, pytestcov
+, pytestrunner
+, setuptools_scm
 }:

 buildPythonPackage rec {
  pname = "python-lz4";
-  version = "2.1.2";
+  version = "2.1.6";

  # get full repository inorder to run tests
  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "1kzzdfkrq9nnlh0wssa6ccncvv0sk4wmhivhgyndjxz6d6przl5d";
+    sha256 = "1gx228946c2w645sh190m7ixfd0zfkdl3i8ybga77jz2sn1chzdi";
  };

  buildInputs = [ setuptools_scm pkgconfig pytestrunner ];
-  checkInputs = [ pytest psutil ];
+  checkInputs = [ pytest pytestcov psutil ];
  propagatedBuildInputs = lib.optionals (!isPy3k) [ future ];

  # give a hint to setuptools_scm on package version
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@ -2,7 +2,7 @@
  testfixtures, pillow, six, twisted, w3lib, lxml, queuelib, pyopenssl,
  service-identity, parsel, pydispatcher, cssselect, lib }:
 buildPythonPackage rec {
-  version = "1.7.2";
+  version = "1.7.3";
  pname = "Scrapy";

  checkInputs = [ glibcLocales mock pytest botocore testfixtures pillow ];
@ -31,7 +31,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "7a4ed68cfb44dc86e1895f0fb46257ee4adb1090754ac21faec205763f054464";
+    sha256 = "fe5a40177960e97d42d1c752a73edb40f76a85a24076dec8535cffa499eb08c8";
  };

  postInstall = ''
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@ -1,15 +1,15 @@
 { lib, buildGoModule, fetchFromGitHub }:

 buildGoModule rec {
-  name = "kustomize-${version}";
-  version = "3.0.0";
-  # rev is the 3.0.0 commit, mainly for kustomize version command output
-  rev = "e0bac6ad192f33d993f11206e24f6cda1d04c4ec";
+  pname = "kustomize";
+  version = "3.1.0";
+  # rev is the 3.1.0 commit, mainly for kustomize version command output
+  rev = "95f3303493fdea243ae83b767978092396169baf";

  goPackagePath = "sigs.k8s.io/kustomize";
  subPackages = [ "cmd/kustomize" ];

-  buildFlagsArray = let t = "${goPackagePath}/pkg/commands/misc"; in ''
+  buildFlagsArray = let t = "${goPackagePath}/v3/pkg/commands/misc"; in ''
    -ldflags=
      -s -X ${t}.kustomizeVersion=${version}
         -X ${t}.gitCommit=${rev}
@ -17,9 +17,9 @@ buildGoModule rec {
  '';

  src = fetchFromGitHub {
-    sha256 = "1ywppn97gfgrwlq1nrj4kdvrdanq5ahqaa636ynyp9yiv9ibziq6";
+    sha256 = "0kigcirkjvnj3xi1p28p9yp3s0lff24q5qcvf8ahjwvpbwka14sh";
    rev = "v${version}";
-    repo = "kustomize";
+    repo = pname;
    owner = "kubernetes-sigs";
  };

--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@ -4,9 +4,9 @@
 let
  # NOTE: bumping the version and updating the hash is insufficient;
  # you must use bundix to generate a new gemset.nix in the Vagrant source.
-  version = "2.2.3";
+  version = "2.2.5";
  url = "https://github.com/hashicorp/vagrant/archive/v${version}.tar.gz";
-  sha256 = "1j00glqn8b1zsgqg2nyk5as405a6s6vclswg2ri0a229hnsiabvs";
+  sha256 = "0a228f5185b24b72efcc5a3924f86fa9fabab6f7562c3c63c1d9d239aa72a7b1";

  deps = bundlerEnv rec {
    name = "${pname}-${version}";
--- a/pkgs/development/tools/vagrant/gemset.nix
+++ b/pkgs/development/tools/vagrant/gemset.nix
@ -1,20 +1,13 @@
 {
-  addressable = {
-    dependencies = ["public_suffix"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0bcm2hchn897xjhqj9zzsxf3n9xhddymj4lsclz508f4vw3av46l";
-      type = "gem";
-    };
-    version = "2.6.0";
-  };
  bcrypt_pbkdf = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0cj4k13c7qvvck7y25i3xarvyqq8d27vl61jddifkc7llnnap1hv";
+      sha256 = "02vssr285m7kpsr47jdmzbar1h1d0mnkmyrpr1zg828isfmwii35";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.0.1";
  };
  builder = {
    source = {
@ -34,21 +27,14 @@
    version = "0.6.3";
  };
  concurrent-ruby = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ixcx9pfissxrga53jbdpza85qd5f6b5nq1sfqa9rnfq82qnlbp1";
+      sha256 = "1x07r23s7836cpp5z9yrlbpljcxpax14yw4fy4bnp6crhr6x24an";
      type = "gem";
    };
-    version = "1.1.4";
-  };
-  crack = {
-    dependencies = ["safe_yaml"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0abb0fvgw00akyik1zxnq7yv391va148151qxdghnzngv66bl62k";
-      type = "gem";
-    };
-    version = "0.4.3";
+    version = "1.1.5";
  };
  diff-lcs = {
    source = {
@ -60,12 +46,14 @@
  };
  domain_name = {
    dependencies = ["unf"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0abdlwb64ns7ssmiqhdwgl27ly40x2l27l8hs8hn0z4kb3zd2x3v";
+      sha256 = "0lcqjsmixjp52bnlgzh4lg9ppsk52x9hpwdjd53k8jnbah2602h0";
      type = "gem";
    };
-    version = "0.5.20180417";
+    version = "0.5.20190701";
  };
  ed25519 = {
    source = {
@ -83,30 +71,26 @@
    };
    version = "2.7.0";
  };
-  fake_ftp = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0rn7lxdk3sqc2i4v2c5k25b9ca1qnkdf32nv04y760aml9mszwf7";
-      type = "gem";
-    };
-    version = "0.1.1";
-  };
  ffi = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0j8pzj8raxbir5w5k6s7a042sb5k02pg0f8s4na1r5lan901j00p";
+      sha256 = "06mvxpjply8qh4j3fj9wh08kdzwkbnvsiysh0vrhlk5cwxzjmblh";
      type = "gem";
    };
-    version = "1.10.0";
+    version = "1.11.1";
  };
  gssapi = {
    dependencies = ["ffi"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0j93nsf9j57p7x4aafalvjg8hia2mmqv3aky7fmw2ck5yci343ix";
+      sha256 = "13l6pqbfrx3vv7cw26nq9p8rnyp9br31gaz85q32wx6hnzfcriwh";
      type = "gem";
    };
-    version = "1.2.0";
+    version = "1.3.0";
  };
  gyoku = {
    dependencies = ["builder"];
@ -117,14 +101,6 @@
    };
    version = "1.3.1";
  };
-  hashdiff = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "19ykg5pax8798nh1yv71adkx0zzs7gn2rxjj86v7nsw0jba5lask";
-      type = "gem";
-    };
-    version = "0.3.8";
-  };
  hashicorp-checkpoint = {
    source = {
      remotes = ["https://rubygems.org"];
@ -203,12 +179,14 @@
    version = "3.2.2";
  };
  mime-types-data = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07wvp0aw2gjm4njibb70as6rh5hi1zzri5vky1q6jx95h8l56idc";
+      sha256 = "1m00pg19cm47n1qlcxgl91ajh2yq0fszvn1vy8fy0s1jkrp9fw4a";
      type = "gem";
    };
-    version = "3.2018.0812";
+    version = "3.2019.0331";
  };
  multi_json = {
    source = {
@ -260,22 +238,6 @@
    };
    version = "2.6.0";
  };
-  public_suffix = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "08q64b5br692dd3v0a9wq9q5dvycc6kmiqmjbdxkxbfizggsvx6l";
-      type = "gem";
-    };
-    version = "3.0.3";
-  };
-  rake = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "01j8fc9bqjnrsxbppncai05h43315vmz9fwg28qdsgcjw9ck1d7n";
-      type = "gem";
-    };
-    version = "12.0.0";
-  };
  rb-fsevent = {
    source = {
      remotes = ["https://rubygems.org"];
@ -338,15 +300,6 @@
    };
    version = "3.5.0";
  };
-  rspec-its = {
-    dependencies = ["rspec-core" "rspec-expectations"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1pwphny5jawcm1hda3vs9pjv1cybaxy17dc1s75qd7drrvx697p3";
-      type = "gem";
-    };
-    version = "1.2.0";
-  };
  rspec-mocks = {
    dependencies = ["diff-lcs" "rspec-support"];
    source = {
@ -381,20 +334,14 @@
    version = "0.6.2";
  };
  rubyzip = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1n1lb2sdwh9h27y244hxzg1lrxxg2m53pk1vq7p33bna003qkyrj";
+      sha256 = "1w9gw28ly3zyqydnm8phxchf4ymyjl2r7zf7c12z8kla10cpmhlc";
      type = "gem";
    };
-    version = "1.2.2";
-  };
-  safe_yaml = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1hly915584hyi9q9vgd968x2nsi5yag9jyf5kq60lwzi5scr7094";
-      type = "gem";
-    };
-    version = "1.0.4";
+    version = "1.2.3";
  };
  thor = {
    source = {
@ -414,15 +361,14 @@
    version = "0.1.4";
  };
  unf_ext = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06p1i6qhy34bpb8q8ms88y6f2kz86azwm098yvcc0nyqk9y729j1";
+      sha256 = "1ll6w64ibh81qwvjx19h8nj7mngxgffg7aigjx11klvf5k2g4nxf";
      type = "gem";
    };
-    version = "0.0.7.5";
-  };
-  vagrant = {
-    dependencies = ["bcrypt_pbkdf" "childprocess" "ed25519" "erubis" "hashicorp-checkpoint" "i18n" "listen" "log4r" "net-scp" "net-sftp" "net-ssh" "rb-kqueue" "rest-client" "ruby_dep" "rubyzip" "vagrant_cloud" "wdm" "winrm" "winrm-elevated" "winrm-fs"];
+    version = "0.0.7.6";
  };
  vagrant-spec = {
    dependencies = ["childprocess" "log4r" "rspec" "thor"];
@ -452,24 +398,17 @@
    };
    version = "0.1.1";
  };
-  webmock = {
-    dependencies = ["addressable" "crack" "hashdiff"];
+  winrm = {
+    dependencies = ["builder" "erubis" "gssapi" "gyoku" "httpclient" "logging" "nori" "rubyntlm"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "04hkcqsmbfnp8g237pisnc834vpgildklicbjbyikqg0bg1rwcy5";
+      sha256 = "19vxrclxc5l8n2agwvv291740s6gna2phg3lkybjb0ldkmpi3sj2";
      type = "gem";
    };
    version = "2.3.2";
  };
-  winrm = {
-    dependencies = ["builder" "erubis" "gssapi" "gyoku" "httpclient" "logging" "nori" "rubyntlm"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0l299w172hl023b3v2vnbx4cqfjq9k2pp8blc1dz8n6g9dc6pk9f";
-      type = "gem";
-    };
-    version = "2.3.1";
-  };
  winrm-elevated = {
    dependencies = ["winrm" "winrm-fs"];
    source = {
--- a/pkgs/games/empty-epsilon/default.nix
+++ b/pkgs/games/empty-epsilon/default.nix
@ -3,8 +3,8 @@
 let

  major = "2019";
-  minor = "01";
-  patch = "19";
+  minor = "05";
+  patch = "21";

  version = "${major}.${minor}.${patch}";

@ -16,7 +16,7 @@ let
      owner = "daid";
      repo = "SeriousProton";
      rev = "EE-${version}";
-      sha256 = "1a5g16vvjrykmdgy5fc8x0v4ipfm0qdaimmy5jz84am14dqi3f8w";
+      sha256 = "0q6in9rfs3b3qrfj2j6aj64z110k1yall4iqpp68rpp9r1dsh26p";
    };

    nativeBuildInputs = [ cmake ];
@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
    owner = "daid";
    repo = "EmptyEpsilon";
    rev = "EE-${version}";
-    sha256 = "082v27w3n4jdm4a5884607rwsw4s00cnpqmh7bsdg9q3l29jpygn";
+    sha256 = "0v2xz1wlji6m6311r3vpkdil3a7l1w5nsz5yqd1l8bimy11rdr55";
  };

  nativeBuildInputs = [ cmake ];
@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
    description = "Open source bridge simulator based on Artemis";
    homepage = https://daid.github.io/EmptyEpsilon/;
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz lheckemann ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/misc/vim-plugins/readme.md
+++ b/pkgs/misc/vim-plugins/readme.md
@ -0,0 +1 @@
+Instructions for adding Vim plugins to `nixpkgs` can be found [here](/doc/languages-frameworks/vim.section.md).
--- a/pkgs/servers/monitoring/prometheus/postgres-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/postgres-exporter.nix
@ -0,0 +1,24 @@
+{ stdenv, buildGoPackage, fetchFromGitHub }:
+
+with stdenv.lib;
+
+buildGoPackage rec {
+  name = "postgres_exporter-${version}";
+  version = "0.5.1";
+
+  goPackagePath = "github.com/wrouesnel/postgres_exporter";
+
+  src = fetchFromGitHub {
+    owner = "wrouesnel";
+    repo = "postgres_exporter";
+    rev = "v${version}";
+    sha256 = "1awcqhiak56nrsaa49lkw6mcbrlm86ls14sp9v69h3a0brc1q7bn";
+  };
+
+  meta = {
+    inherit (src.meta) homepage;
+    description = "A Prometheus exporter for PostgreSQL";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fpletz ];
+  };
+}
--- a/pkgs/servers/sql/mariadb/cmake-fix-crypt-libs.patch
+++ b/pkgs/servers/sql/mariadb/cmake-fix-crypt-libs.patch
@ -0,0 +1,12 @@
+diff --git a/libmariadb/plugins/auth/CMakeLists.txt b/libmariadb/plugins/auth/CMakeLists.txt
+index aa599418..7a51f73b 100644
+--- a/libmariadb/plugins/auth/CMakeLists.txt
+++ b/libmariadb/plugins/auth/CMakeLists.txt
+@@ -50,6 +50,7 @@ IF(WITH_SSL)
+                         ${REF10_SOURCES}
+                         ${CRYPT_SOURCE}
+                 INCLUDES ${REF10_DIR}
+                LIBRARIES ${ED25519_LIBS}
+                 COMPILE_OPTIONS -DMYSQL_CLIENT=1)
+   IF(MSVC)
+      # Silence conversion (integer truncantion) warnings from reference code
--- a/pkgs/servers/sql/mariadb/cmake-libmariadb-includedir.patch
+++ b/pkgs/servers/sql/mariadb/cmake-libmariadb-includedir.patch
@ -0,0 +1,21 @@
+diff --git a/libmariadb/mariadb_config/mariadb_config.c.in b/libmariadb/mariadb_config/mariadb_config.c.in
+index 703c9466..c6d3f1bc 100644
+--- a/libmariadb/mariadb_config/mariadb_config.c.in
+++ b/libmariadb/mariadb_config/mariadb_config.c.in
+@@ -5,13 +5,13 @@
+ 
+ static char *mariadb_progname;
+ 
+-#define INCLUDE "-I@CMAKE_INSTALL_PREFIX@/@INSTALL_INCLUDEDIR@ -I@CMAKE_INSTALL_PREFIX@/@INSTALL_INCLUDEDIR@/mysql"
+-#define LIBS    "-L@CMAKE_INSTALL_PREFIX@/@INSTALL_LIBDIR@/ -lmariadb"
+#define INCLUDE "-I@CMAKE_INSTALL_PREFIX_DEV@/@INSTALL_INCLUDEDIR@ -I@CMAKE_INSTALL_PREFIX_DEV@/@INSTALL_INCLUDEDIR@/mysql"
+#define LIBS    "-L@CMAKE_INSTALL_PREFIX_DEV@/@INSTALL_LIBDIR@/ -lmariadb"
+ #define LIBS_SYS "@extra_dynamic_LDFLAGS@"
+ #define CFLAGS  INCLUDE
+ #define VERSION "@MARIADB_CLIENT_VERSION@"
+ #define CC_VERSION "@CPACK_PACKAGE_VERSION@"
+-#define PLUGIN_DIR "@CMAKE_INSTALL_PREFIX@/@INSTALL_PLUGINDIR@"
+#define PLUGIN_DIR "@CMAKE_INSTALL_PREFIX_DEV@/@INSTALL_PLUGINDIR@"
+ #define SOCKET  "@MARIADB_UNIX_ADDR@"
+ #define PORT "@MARIADB_PORT@"
+ #define TLS_LIBRARY_VERSION "@TLS_LIBRARY_VERSION@"
--- a/pkgs/servers/sql/mariadb/cmake-without-client.patch
+++ b/pkgs/servers/sql/mariadb/cmake-without-client.patch
@ -0,0 +1,15 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 1ea7c1df..b0face0d 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -176,6 +176,10 @@ ELSE()
+   SET (SKIP_COMPONENTS "N-O-N-E")
+ ENDIF()
+ 
+IF (WITHOUT_CLIENT)
+  SET (SKIP_COMPONENTS "Client|ClientPlugins|ManPagesClient")
+ENDIF()
+
+ OPTION(NOT_FOR_DISTRIBUTION "Allow linking with GPLv2-incompatible system libraries. Only set it you never plan to distribute the resulting binaries" OFF)
+ 
+ INCLUDE(check_compiler_flag)
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@ -4,6 +4,7 @@
 , fixDarwinDylibNames, cctools, CoreServices
 , asio, buildEnv, check, scons
 , less
+, withoutClient ? false
 }:

 with stdenv.lib;
@ -14,9 +15,9 @@ libExt = stdenv.hostPlatform.extensions.sharedLibrary;

 mytopEnv = perl.withPackages (p: with p; [ DataDumper DBDmysql DBI TermReadKey ]);

-mariadb = everything // {
-  inherit client; # libmysqlclient.so in .out, necessary headers in .dev and utils in .bin
-  server = everything; # a full single-output build, including everything in `client` again
+mariadb = server // {
+  inherit client; # MariaDB Client
+  server = server; # MariaDB Server
  inherit connector-c; # libmysqlclient.so
  inherit galera;
 };
@ -27,14 +28,14 @@ galeraLibs = buildEnv {
 };

 common = rec { # attributes common to both builds
-  version = "10.3.15";
+  version = "10.3.17";

  src = fetchurl {
    urls = [
      "https://downloads.mariadb.org/f/mariadb-${version}/source/mariadb-${version}.tar.gz"
      "https://downloads.mariadb.com/MariaDB/mariadb-${version}/source/mariadb-${version}.tar.gz"
    ];
-    sha256 = "0s399nxk2z8fgdr527p64y74zwjc3gpv7psf1n2r6ksl9njr3wr7";
+    sha256 = "15vh15az16932q42y9dxpzwxldmh0x4hvzrar3f8kblsqm7ym890";
    name   = "mariadb-${version}.tar.gz";
  };

@ -42,19 +43,18 @@ common = rec { # attributes common to both builds

  buildInputs = [
    ncurses openssl zlib pcre jemalloc libiconv
-  ] ++ stdenv.lib.optionals stdenv.isLinux [ libaio systemd libkrb5 ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ perl fixDarwinDylibNames cctools CoreServices ];
+  ] ++ optionals stdenv.isLinux [ libaio systemd libkrb5 ]
+    ++ optionals stdenv.isDarwin [ perl fixDarwinDylibNames cctools CoreServices ];

  prePatch = ''
    sed -i 's,[^"]*/var/log,/var/log,g' storage/mroonga/vendor/groonga/CMakeLists.txt
  '';

-  patches = [ ./cmake-includedir.patch ]
-    ++ optionals stdenv.isDarwin [
-      # Derived from "Fixed c++11 narrowing error"
-      # https://github.com/MariaDB/server/commit/a0dfefb0f8a47145e599a5f1b0dc576fa7634b92
-      ./fix-c++11-narrowing-error.patch
-    ];
+  patches = [
+    ./cmake-includedir.patch
+    ./cmake-libmariadb-includedir.patch
+    ./cmake-fix-crypt-libs.patch
+  ];

  cmakeFlags = [
    "-DBUILD_CONFIG=mysql_release"
@ -68,6 +68,8 @@ common = rec { # attributes common to both builds
    "-DINSTALL_DOCDIR=share/doc/mysql"
    "-DINSTALL_DOCREADMEDIR=share/doc/mysql"
    "-DINSTALL_INCLUDEDIR=include/mysql"
+    "-DINSTALL_LIBDIR=lib/mysql"
+    "-DINSTALL_PLUGINDIR=lib/mysql/plugin"
    "-DINSTALL_INFODIR=share/mysql/docs"
    "-DINSTALL_MANDIR=share/man"
    "-DINSTALL_MYSQLSHAREDIR=share/mysql"
@ -80,20 +82,30 @@ common = rec { # attributes common to both builds
    "-DWITH_SSL=system"
    "-DWITH_PCRE=system"
    "-DWITH_SAFEMALLOC=OFF"
+    "-DWITH_UNIT_TESTS=OFF"
    "-DEMBEDDED_LIBRARY=OFF"
-  ] ++ optional stdenv.isDarwin [
+  ] ++ optionals stdenv.isDarwin [
    # On Darwin without sandbox, CMake will find the system java and attempt to build with java support, but
    # then it will fail during the actual build. Let's just disable the flag explicitly until someone decides
    # to pass in java explicitly.
    "-DCONNECT_WITH_JDBC=OFF"
    "-DCURSES_LIBRARY=${ncurses.out}/lib/libncurses.dylib"
-  ] ++ optional stdenv.hostPlatform.isMusl [
+  ] ++ optionals stdenv.hostPlatform.isMusl [
    "-DWITHOUT_TOKUDB=1" # mariadb docs say disable this for musl
  ];

+  postInstall = ''
+    rm "$out"/lib/mysql/plugin/daemon_example.ini
+    mkdir -p "$dev"/bin && mv "$out"/bin/{mariadb_config,mysql_config} "$dev"/bin
+    mkdir -p "$dev"/lib/mysql && mv "$out"/lib/mysql/{libmariadbclient.a,libmysqlclient.a,libmysqlclient_r.a,libmysqlservices.a} "$dev"/lib/mysql
+    mkdir -p "$dev"/lib/mysql/plugin && mv "$out"/lib/mysql/plugin/{caching_sha2_password.so,dialog.so,mysql_clear_password.so,sha256_password.so} "$dev"/lib/mysql/plugin
+  '';
+
+  enableParallelBuilding = true;
+
  passthru.mysqlVersion = "5.7";

-  meta = with stdenv.lib; {
+  meta = {
    description = "An enhanced, drop-in replacement for MySQL";
    homepage    = https://mariadb.org/;
    license     = licenses.gpl2;
@ -103,36 +115,40 @@ common = rec { # attributes common to both builds
 };

 client = stdenv.mkDerivation (common // {
-  name = "mariadb-client-${common.version}";
+  pname = "mariadb-client";

  outputs = [ "out" "dev" "man" ];

  propagatedBuildInputs = [ openssl zlib ]; # required from mariadb.pc

-  patches = [ ./cmake-plugin-includedir.patch ];
+  patches = common.patches ++ [
+    ./cmake-plugin-includedir.patch
+  ];

  cmakeFlags = common.cmakeFlags ++ [
    "-DWITHOUT_SERVER=ON"
    "-DWITH_WSREP=OFF"
+    "-DINSTALL_MYSQLSHAREDIR=share/mysql-client"
  ];

-  postInstall = ''
-    rm -r "$out"/share/mysql
-    rm -r "$out"/share/doc
-    rm "$out"/bin/{msql2mysql,mysql_plugin,mytop,wsrep_sst_rsync_wan,mysql_config,mariadb_config}
-    rm "$out"/lib/plugin/{daemon_example.ini,dialog.so,mysql_clear_password.so,sha256_password.so}
-    libmysqlclient_path=$(readlink -f $out/lib/libmysqlclient${libExt})
-    rm "$out"/lib/{libmariadb${libExt},libmysqlclient${libExt},libmysqlclient_r${libExt}}
-    mv "$libmysqlclient_path" "$out"/lib/libmysqlclient${libExt}
-    ln -sv libmysqlclient${libExt} "$out"/lib/libmysqlclient_r${libExt}
-    mkdir -p "$dev"/lib && mv "$out"/lib/{libmariadbclient.a,libmysqlclient.a,libmysqlclient_r.a,libmysqlservices.a} "$dev"/lib
+  preConfigure = ''
+   cmakeFlags="$cmakeFlags \
+      -DCMAKE_INSTALL_PREFIX_DEV=$dev"
  '';

-  enableParallelBuilding = true; # the client should be OK
+  postInstall =  common.postInstall + ''
+    rm -r "$out"/share/doc
+    rm "$out"/bin/{mysqltest,mytop,wsrep_sst_rsync_wan}
+    libmysqlclient_path=$(readlink -f $out/lib/mysql/libmysqlclient${libExt})
+    rm "$out"/lib/mysql/{libmariadb${libExt},libmysqlclient${libExt},libmysqlclient_r${libExt}}
+    mv "$libmysqlclient_path" "$out"/lib/mysql/libmysqlclient${libExt}
+    ln -sv libmysqlclient${libExt} "$out"/lib/mysql/libmysqlclient_r${libExt}
+
+  '';
 });

-everything = stdenv.mkDerivation (common // {
-  name = "mariadb-${common.version}";
+server = stdenv.mkDerivation (common // {
+  pname = "mariadb-server";

  outputs = [ "out" "dev" "man" ];

@ -144,6 +160,10 @@ everything = stdenv.mkDerivation (common // {
  ] ++ optional (stdenv.isLinux && !stdenv.isAarch32) numactl
    ++ optional (!stdenv.isDarwin) mytopEnv;

+  patches = common.patches ++ [
+    ./cmake-without-client.patch
+  ];
+
  cmakeFlags = common.cmakeFlags ++ [
    "-DMYSQL_DATADIR=/var/lib/mysql"
    "-DINSTALL_PLUGINDIR=lib/mysql/plugin"
@ -156,6 +176,8 @@ everything = stdenv.mkDerivation (common // {
    "-DWITH_INNODB_DISALLOW_WRITES=ON"
    "-DWITHOUT_EXAMPLE=1"
    "-DWITHOUT_FEDERATED=1"
+  ] ++ stdenv.lib.optionals withoutClient [
+    "-DWITHOUT_CLIENT=ON"
  ] ++ stdenv.lib.optionals stdenv.isDarwin [
    "-DWITHOUT_OQGRAPH=1"
    "-DWITHOUT_TOKUDB=1"
@ -163,27 +185,27 @@ everything = stdenv.mkDerivation (common // {

  preConfigure = ''
    cmakeFlags="$cmakeFlags \
+      -DCMAKE_INSTALL_PREFIX_DEV=$dev
      -DINSTALL_SHAREDIR=$dev/share/mysql
      -DINSTALL_SUPPORTFILESDIR=$dev/share/mysql"
  '' + optionalString (!stdenv.isDarwin) ''
    patchShebangs scripts/mytop.sh
  '';

-  postInstall = ''
+  postInstall = common.postInstall + ''
    chmod +x "$out"/bin/wsrep_sst_common
+    rm "$out"/bin/mysql_client_test
    rm -r "$out"/data # Don't need testing data
-    rm "$out"/bin/{mysql_find_rows,mysql_waitpid,mysqlaccess,mysqladmin,mysqlbinlog,mysqlcheck}
-    rm "$out"/bin/{mysqldump,mysqlhotcopy,mysqlimport,mysqlshow,mysqlslap,mysqltest}
+    rm "$out"/lib/mysql/{libmysqlclient${libExt},libmysqlclient_r${libExt}}
+    mv "$out"/share/{groonga,groonga-normalizer-mysql} "$out"/share/doc/mysql
+  '' + optionalString withoutClient ''
    ${ # We don't build with GSSAPI on Darwin
-      optionalString (! stdenv.isDarwin) ''
+      optionalString (!stdenv.isDarwin) ''
        rm "$out"/lib/mysql/plugin/auth_gssapi_client.so
      ''
    }
-    rm "$out"/lib/mysql/plugin/{client_ed25519.so,daemon_example.ini}
-    rm "$out"/lib/{libmysqlclient${libExt},libmysqlclient_r${libExt}}
-    mv "$out"/share/{groonga,groonga-normalizer-mysql} "$out"/share/doc/mysql
-    mkdir -p "$dev"/lib && mv "$out"/lib/{libmariadbclient.a,libmysqlclient.a,libmysqlclient_r.a,libmysqlservices.a} "$dev"/lib
-  '' + optionalString (! stdenv.isDarwin) ''
+    rm "$out"/lib/mysql/plugin/client_ed25519.so
+  '' + optionalString (!stdenv.isDarwin) ''
    sed -i 's/-mariadb/-mysql/' "$out"/bin/galera_new_cluster
  '';

--- a/pkgs/servers/sql/mariadb/fix-c++11-narrowing-error.patch
+++ b/pkgs/servers/sql/mariadb/fix-c++11-narrowing-error.patch
@ -1,13 +0,0 @@
-diff --git a/sql/table.cc b/sql/table.cc
-index e46af771507..9bef21a1da2 100644
--- a/sql/table.cc
-+++ b/sql/table.cc
-@@ -8814,7 +8814,7 @@ bool TR_table::update(ulonglong start_id, ulonglong end_id)
- 
-   store(FLD_BEGIN_TS, thd->transaction_time());
-   thd->set_time();
-  timeval end_time= {thd->query_start(), long(thd->query_start_sec_part())};
-+  timeval end_time= {thd->query_start(), int(thd->query_start_sec_part())};
-   store(FLD_TRX_ID, start_id);
-   store(FLD_COMMIT_ID, end_id);
-   store(FLD_COMMIT_TS, end_time);
--- a/pkgs/tools/misc/cbmem/default.nix
+++ b/pkgs/tools/misc/cbmem/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "cbmem";
+  version = "4.9";
+
+  src = fetchurl {
+    url = "https://coreboot.org/releases/coreboot-${version}.tar.xz";
+    sha256 = "0xkai65d3z9fivwscbkm7ndcw2p9g794xz8fwdv979w77n5qsdij";
+  };
+
+  buildPhase = ''
+    make -C util/cbmem
+  '';
+
+  installPhase = ''
+    install -Dm755 util/cbmem/cbmem $out/bin/cbmem
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Read coreboot timestamps and console logs";
+    homepage = "https://www.coreboot.org";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.petabyteboy ];
+    platforms = platforms.linux;
+  };
+}
+
--- a/pkgs/tools/misc/dua/default.nix
+++ b/pkgs/tools/misc/dua/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "dua";
-  version = "2.1.5";
+  version = "2.1.11";

  src = fetchFromGitHub {
    owner = "Byron";
    repo = "dua-cli";
    rev = "v${version}";
-    sha256 = "0xiprpk74l0q5w3j82lx1l3jy4mi015nvlixih9z1lam4qi1yq0p";
+    sha256 = "08zgi2yiynb20l1f9rhly4a7zgqnr7lq3cr5vkmh1jnfs6z27dv6";
  };

-  cargoSha256 = "1jg1ljm5h21shkyfrq0ivz9m0c25dxc0kd6cipf5i2dbnzcszmhh";
+  cargoSha256 = "0ca9gaih0b9qg7bdgyhvb9gr1mq23r62pi0845vwc216jfaag079";

  meta = with lib; {
    description = "A tool to conveniently learn about the disk usage of directories, fast!";
--- a/pkgs/tools/misc/lsd/default.nix
+++ b/pkgs/tools/misc/lsd/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "lsd";
-  version = "0.15.1";
+  version = "0.16.0";

  src = fetchFromGitHub {
    owner = "Peltoche";
    repo = pname;
    rev = version;
-    sha256 = "1m8jcmdp66n0vgyzfgknmg4rwc41y9fd4vjgapaggg6lc9cc68gp";
+    sha256 = "0fh5rz6slyjzz03bpjcl9gplk36vm7qcc0i0gvhsikwvw0cf3hym";
  };

-  cargoSha256 = "095jf63jyd485fk8pl7grvycn7pkwnxdm5lwkmfl9p46m8q1qqr2";
+  cargoSha256 = "0377jbjkrrjss3w8xmjsjjynycpdk19grp20hffxschg4ryvniin";

  preFixup = ''
    install -Dm644 -t $out/share/zsh/site-functions/ target/release/build/lsd-*/out/_lsd
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@ -18,11 +18,11 @@ buildPythonPackage rec {
  # The websites youtube-dl deals with are a very moving target. That means that
  # downloads break constantly. Because of that, updates should always be backported
  # to the latest stable release.
-  version = "2019.07.30";
+  version = "2019.08.02";

  src = fetchurl {
    url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0nb5xvq4aq0az8y5wb54zp5q4qzfhs7rcb39yp6j5q8jyjp9kzwy";
+    sha256 = "101b6jrf6ckbxrn76ppvgdyrb25p7d247kn8qgq7n476sfnkfg2p";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/tools/security/bitwarden-cli/node-packages-generated.nix
+++ b/pkgs/tools/security/bitwarden-cli/node-packages-generated.nix
@ -1,4 +1,4 @@
-# This file has been generated by node2nix 1.6.0. Do not edit!
+# This file has been generated by node2nix 1.7.0. Do not edit!

 {nodeEnv, fetchurl, fetchgit, globalBuildInputs ? []}:

@ -13,40 +13,40 @@ let
        sha512 = "sY5AXXVZv4Y1VACTtR11UJCPHHudgY5i26Qj5TypE6DKlIApbwb5uqhXcJ5UUGbvZNRh7EeIoW+LrJumBsKp7w==";
      };
    };
-    "acorn-6.1.1" = {
+    "acorn-6.2.1" = {
      name = "acorn";
      packageName = "acorn";
-      version = "6.1.1";
+      version = "6.2.1";
      src = fetchurl {
-        url = "https://registry.npmjs.org/acorn/-/acorn-6.1.1.tgz";
-        sha512 = "jPTiwtOxaHNaAPg/dmrJ/beuzLRnXtB0kQPQ8JpotKJgTB6rX6c8mlf315941pyjBSaPg8NHXS9fhP4u17DpGA==";
+        url = "https://registry.npmjs.org/acorn/-/acorn-6.2.1.tgz";
+        sha512 = "JD0xT5FCRDNyjDda3Lrg/IxFscp9q4tiYtxE1/nOzlKCk7hIRuYjhq1kCNkbPjMRMZuFq20HNQn1I9k8Oj0E+Q==";
      };
    };
-    "acorn-globals-4.3.0" = {
+    "acorn-globals-4.3.2" = {
      name = "acorn-globals";
      packageName = "acorn-globals";
-      version = "4.3.0";
+      version = "4.3.2";
      src = fetchurl {
-        url = "https://registry.npmjs.org/acorn-globals/-/acorn-globals-4.3.0.tgz";
-        sha512 = "hMtHj3s5RnuhvHPowpBYvJVj3rAar82JiDQHvGs1zO0l10ocX/xEdBShNHTJaboucJUsScghp74pH3s7EnHHQw==";
+        url = "https://registry.npmjs.org/acorn-globals/-/acorn-globals-4.3.2.tgz";
+        sha512 = "BbzvZhVtZP+Bs1J1HcwrQe8ycfO0wStkSGxuul3He3GkHOIZ6eTqOkPuw9IP1X3+IkOo4wiJmwkobzXYz4wewQ==";
      };
    };
-    "acorn-walk-6.1.1" = {
+    "acorn-walk-6.2.0" = {
      name = "acorn-walk";
      packageName = "acorn-walk";
-      version = "6.1.1";
+      version = "6.2.0";
      src = fetchurl {
-        url = "https://registry.npmjs.org/acorn-walk/-/acorn-walk-6.1.1.tgz";
-        sha512 = "OtUw6JUTgxA2QoqqmrmQ7F2NYqiBPi/L2jqHyFtllhOUvXYQXf0Z1CYUinIfyT4bTCGmrA7gX9FvHA81uzCoVw==";
+        url = "https://registry.npmjs.org/acorn-walk/-/acorn-walk-6.2.0.tgz";
+        sha512 = "7evsyfH1cLOCdAzZAd43Cic04yKydNx0cF+7tiA19p1XnLLPU4dpCQOqpjqwokFe//vS0QqfqqjCS2JkiIs0cA==";
      };
    };
-    "ajv-6.10.0" = {
+    "ajv-6.10.2" = {
      name = "ajv";
      packageName = "ajv";
-      version = "6.10.0";
+      version = "6.10.2";
      src = fetchurl {
-        url = "https://registry.npmjs.org/ajv/-/ajv-6.10.0.tgz";
-        sha512 = "nffhOpkymDECQyR0mnsUtoCE8RlX38G0rYP+wgLWFyZuUyuuojSSvi/+euOiQBIn63whYwYVIIH1TvE3tu4OEg==";
+        url = "https://registry.npmjs.org/ajv/-/ajv-6.10.2.tgz";
+        sha512 = "TXtUUEYHuaTEbLZWIKUr5pmBuhDLy+8KYtPYdcV8qC+pOZL+NKqYwvWSRrVXHn+ZmRRAu8vJTAznH7Oag6RVRw==";
      };
    };
    "ansi-escapes-3.2.0" = {
@ -256,22 +256,22 @@ let
        sha1 = "b5fd54220aa2bc5ab57aab7140c940754503c1a7";
      };
    };
-    "cssom-0.3.6" = {
+    "cssom-0.3.8" = {
      name = "cssom";
      packageName = "cssom";
-      version = "0.3.6";
+      version = "0.3.8";
      src = fetchurl {
-        url = "https://registry.npmjs.org/cssom/-/cssom-0.3.6.tgz";
-        sha512 = "DtUeseGk9/GBW0hl0vVPpU22iHL6YB5BUX7ml1hB+GMpo0NX5G4voX3kdWiMSEguFtcW3Vh3djqNF4aIe6ne0A==";
+        url = "https://registry.npmjs.org/cssom/-/cssom-0.3.8.tgz";
+        sha512 = "b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==";
      };
    };
-    "cssstyle-1.2.2" = {
+    "cssstyle-1.4.0" = {
      name = "cssstyle";
      packageName = "cssstyle";
-      version = "1.2.2";
+      version = "1.4.0";
      src = fetchurl {
-        url = "https://registry.npmjs.org/cssstyle/-/cssstyle-1.2.2.tgz";
-        sha512 = "43wY3kl1CVQSvL7wUY1qXkxVGkStjpkDmVjiIKX8R97uhajy8Bybay78uOtqvh7Q5GK75dNPfW0geWjE6qQQow==";
+        url = "https://registry.npmjs.org/cssstyle/-/cssstyle-1.4.0.tgz";
+        sha512 = "GBrLZYZ4X4x6/QEoBnIrqb8B/f5l4+8me2dkom/j1Gtbxy0kBv6OGzKuAsGM75bkGwGAFkt56Iwg28S3XTZgSA==";
      };
    };
    "dashdash-1.14.1" = {
@ -364,13 +364,13 @@ let
        sha1 = "0dee3fed31fcd469618ce7342099fc1afa0bdb13";
      };
    };
-    "esutils-2.0.2" = {
+    "esutils-2.0.3" = {
      name = "esutils";
      packageName = "esutils";
-      version = "2.0.2";
+      version = "2.0.3";
      src = fetchurl {
-        url = "https://registry.npmjs.org/esutils/-/esutils-2.0.2.tgz";
-        sha1 = "0abf4f1caa5bcb1f7a9d8acc6dea4faaa04bac9b";
+        url = "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz";
+        sha512 = "kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==";
      };
    };
    "extend-3.0.2" = {
@ -382,13 +382,13 @@ let
        sha512 = "fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==";
      };
    };
-    "external-editor-3.0.3" = {
+    "external-editor-3.1.0" = {
      name = "external-editor";
      packageName = "external-editor";
-      version = "3.0.3";
+      version = "3.1.0";
      src = fetchurl {
-        url = "https://registry.npmjs.org/external-editor/-/external-editor-3.0.3.tgz";
-        sha512 = "bn71H9+qWoOQKyZDo25mOMVpSmXROAsTJVVVYzrrtol3d4y+AsKjf4Iwl2Q+IuT0kFSQ1qo166UuIwqYq7mGnA==";
+        url = "https://registry.npmjs.org/external-editor/-/external-editor-3.1.0.tgz";
+        sha512 = "hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==";
      };
    };
    "extsprintf-1.3.0" = {
@ -463,13 +463,13 @@ let
        sha1 = "5eff8e3e684d569ae4cb2b1282604e8ba62149fa";
      };
    };
-    "graceful-fs-4.1.15" = {
+    "graceful-fs-4.2.0" = {
      name = "graceful-fs";
      packageName = "graceful-fs";
-      version = "4.1.15";
+      version = "4.2.0";
      src = fetchurl {
-        url = "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.1.15.tgz";
-        sha512 = "6uHUhOPEBgQ24HM+r6b/QwWfZq+yiFcipKFrOFiBEnWdy5sdzYoi+pJeQaPI5qOLRFqWmAXUPQNsielzdLoecA==";
+        url = "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.0.tgz";
+        sha512 = "jpSvDPV4Cq/bgtpndIWbI5hmYxhQGHPC4d4cqBPb4DLniCfhJokdXhwhaDuLBGLQdvvRum/UiX6ECVIPvDXqdg==";
      };
    };
    "har-schema-2.0.0" = {
@ -634,13 +634,13 @@ let
        sha1 = "3b09924edf9f083c0490fdd4c0bc4421e04764ee";
      };
    };
-    "lodash-4.17.11" = {
+    "lodash-4.17.15" = {
      name = "lodash";
      packageName = "lodash";
-      version = "4.17.11";
+      version = "4.17.15";
      src = fetchurl {
-        url = "https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz";
-        sha512 = "cQKh8igo5QUhZ7lg38DYWAxMvjSAKG0A8wGSVimP07SIUEK2UO+arSRKbRZWtelMtN5V0Hkwh5ryOto/SshYIg==";
+        url = "https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz";
+        sha512 = "8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A==";
      };
    };
    "lodash.sortby-4.7.0" = {
@ -670,22 +670,22 @@ let
        sha512 = "rlAEsgU9Bnavca2w1WJ6+6cdeHMXNyadcersyk3ZpuhgWb5HBNj8l4WwJz9PjksAhYDlpQffCVXPctOn+wCIVA==";
      };
    };
-    "mime-db-1.38.0" = {
+    "mime-db-1.40.0" = {
      name = "mime-db";
      packageName = "mime-db";
-      version = "1.38.0";
+      version = "1.40.0";
      src = fetchurl {
-        url = "https://registry.npmjs.org/mime-db/-/mime-db-1.38.0.tgz";
-        sha512 = "bqVioMFFzc2awcdJZIzR3HjZFX20QhilVS7hytkKrv7xFAn8bM1gzc/FOX2awLISvWe0PV8ptFKcon+wZ5qYkg==";
+        url = "https://registry.npmjs.org/mime-db/-/mime-db-1.40.0.tgz";
+        sha512 = "jYdeOMPy9vnxEqFRRo6ZvTZ8d9oPb+k18PKoYNYUe2stVEBPPwsln/qWzdbmaIvnhZ9v2P+CuecK+fpUfsV2mA==";
      };
    };
-    "mime-types-2.1.22" = {
+    "mime-types-2.1.24" = {
      name = "mime-types";
      packageName = "mime-types";
-      version = "2.1.22";
+      version = "2.1.24";
      src = fetchurl {
-        url = "https://registry.npmjs.org/mime-types/-/mime-types-2.1.22.tgz";
-        sha512 = "aGl6TZGnhm/li6F7yx82bJiBZwgiEa4Hf6CNr8YO+r5UHr53tSTYZb102zyU50DOWWKeOv0uQLRL0/9EiKWCog==";
+        url = "https://registry.npmjs.org/mime-types/-/mime-types-2.1.24.tgz";
+        sha512 = "WaFHS3MCl5fapm3oLxU4eYDw77IQM2ACcxQ9RIxfaC3ooc6PFuBMGZZsYpvoXS5D5QTWPieo1jjLdAm3TBP3cQ==";
      };
    };
    "mimic-fn-1.2.0" = {
@ -724,13 +724,13 @@ let
        sha512 = "sol30LUpz1jQFBjOKwbjxijiE3b6pjd74YwfD0fJOKPjF+fONKb2Yg8rYgS6+bK6VDl+/wfr4IYpC7jDzLUIfw==";
      };
    };
-    "nwsapi-2.1.3" = {
+    "nwsapi-2.1.4" = {
      name = "nwsapi";
      packageName = "nwsapi";
-      version = "2.1.3";
+      version = "2.1.4";
      src = fetchurl {
-        url = "https://registry.npmjs.org/nwsapi/-/nwsapi-2.1.3.tgz";
-        sha512 = "RowAaJGEgYXEZfQ7tvvdtAQUKPyTR6T6wNu0fwlNsGQYr/h3yQc6oI8WnVZh3Y/Sylwc+dtAlvPqfFZjhTyk3A==";
+        url = "https://registry.npmjs.org/nwsapi/-/nwsapi-2.1.4.tgz";
+        sha512 = "iGfd9Y6SFdTNldEy2L0GUhcarIutFmk+MPWIn9dmj8NMIup03G08uUF2KGbbmv/Ux4RT0VZJoP/sVbWA6d/VIw==";
      };
    };
    "oauth-sign-0.9.0" = {
@ -823,13 +823,13 @@ let
        sha1 = "21932a549f5e52ffd9a827f570e04be62a97da54";
      };
    };
-    "psl-1.1.31" = {
+    "psl-1.3.0" = {
      name = "psl";
      packageName = "psl";
-      version = "1.1.31";
+      version = "1.3.0";
      src = fetchurl {
-        url = "https://registry.npmjs.org/psl/-/psl-1.1.31.tgz";
-        sha512 = "/6pt4+C+T+wZUieKR620OpzN/LlnNKuWjy1iFLQ/UG35JqHlR/89MP1d96dUfkf6Dne3TuLQzOYEYshJ+Hx8mw==";
+        url = "https://registry.npmjs.org/psl/-/psl-1.3.0.tgz";
+        sha512 = "avHdspHO+9rQTLbv1RO+MPYeP/SzsCoxofjVnHanETfQhTJrmB0HlDoW+EiN/R+C0BZ+gERab9NY0lPN2TxNag==";
      };
    };
    "punycode-1.4.1" = {
@ -904,22 +904,22 @@ let
        sha1 = "0371ab4ae0bdd720d4166d7dfda64ff7a445a6c0";
      };
    };
-    "rxjs-6.4.0" = {
+    "rxjs-6.5.2" = {
      name = "rxjs";
      packageName = "rxjs";
-      version = "6.4.0";
+      version = "6.5.2";
      src = fetchurl {
-        url = "https://registry.npmjs.org/rxjs/-/rxjs-6.4.0.tgz";
-        sha512 = "Z9Yfa11F6B9Sg/BK9MnqnQ+aQYicPLtilXBp2yUtDt2JRCE0h26d33EnfO3ZxoNxG0T92OUucP3Ct7cpfkdFfw==";
+        url = "https://registry.npmjs.org/rxjs/-/rxjs-6.5.2.tgz";
+        sha512 = "HUb7j3kvb7p7eCUHE3FqjoDsC1xfZQ4AHFWfTKSpZ+sAhhz5X1WX0ZuUqWbzB2QhSLp3DoLUG+hMdEDKqWo2Zg==";
      };
    };
-    "safe-buffer-5.1.2" = {
+    "safe-buffer-5.2.0" = {
      name = "safe-buffer";
      packageName = "safe-buffer";
-      version = "5.1.2";
+      version = "5.2.0";
      src = fetchurl {
-        url = "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz";
-        sha512 = "Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==";
+        url = "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.0.tgz";
+        sha512 = "fZEwUGbVl7kouZs1jCdMLdt95hdIv0ZeHg6L7qPeciMZhZ+/gdesW4wgTARkrFWEpspjEATAzUGPG8N2jJiwbg==";
      };
    };
    "safer-buffer-2.1.2" = {
@ -931,13 +931,13 @@ let
        sha512 = "YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==";
      };
    };
-    "saxes-3.1.9" = {
+    "saxes-3.1.11" = {
      name = "saxes";
      packageName = "saxes";
-      version = "3.1.9";
+      version = "3.1.11";
      src = fetchurl {
-        url = "https://registry.npmjs.org/saxes/-/saxes-3.1.9.tgz";
-        sha512 = "FZeKhJglhJHk7eWG5YM0z46VHmI3KJpMBAQm3xa9meDvd+wevB5GuBB0wc0exPInZiBBHqi00DbS8AcvCGCFMw==";
+        url = "https://registry.npmjs.org/saxes/-/saxes-3.1.11.tgz";
+        sha512 = "Ydydq3zC+WYDJK1+gRxRapLIED9PWeSuuS41wqyoRmzvhhh9nc+QQrVMKJYzJFULazeGhzSV0QleN2wD3boh2g==";
      };
    };
    "signal-exit-3.0.2" = {
@ -1012,13 +1012,13 @@ let
        sha512 = "QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==";
      };
    };
-    "symbol-tree-3.2.2" = {
+    "symbol-tree-3.2.4" = {
      name = "symbol-tree";
      packageName = "symbol-tree";
-      version = "3.2.2";
+      version = "3.2.4";
      src = fetchurl {
-        url = "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.2.tgz";
-        sha1 = "ae27db38f660a7ae2e1c3b7d1bc290819b8519e6";
+        url = "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz";
+        sha512 = "9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==";
      };
    };
    "through-2.3.8" = {
@ -1075,13 +1075,13 @@ let
        sha1 = "a8b13fd6bfd2489519674ccde55ba3693b706d09";
      };
    };
-    "tslib-1.9.3" = {
+    "tslib-1.10.0" = {
      name = "tslib";
      packageName = "tslib";
-      version = "1.9.3";
+      version = "1.10.0";
      src = fetchurl {
-        url = "https://registry.npmjs.org/tslib/-/tslib-1.9.3.tgz";
-        sha512 = "4krF8scpejhaOgqzBEcGM7yDIEfi0/8+8zDRZhNZZ2kjmHJ4hv3zCbQWxoJGz1iw5U0Jl0nma13xzHXcncMavQ==";
+        url = "https://registry.npmjs.org/tslib/-/tslib-1.10.0.tgz";
+        sha512 = "qOebF53frne81cf0S9B41ByenJ3/IuH8yJKngAX35CmiZySA0khhkovshKK+jGCaMnVomla7gVlIcc3EvKPbTQ==";
      };
    };
    "tunnel-agent-0.6.0" = {
@ -1219,13 +1219,13 @@ let
        sha512 = "A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==";
      };
    };
-    "xmlchars-1.3.1" = {
+    "xmlchars-2.1.1" = {
      name = "xmlchars";
      packageName = "xmlchars";
-      version = "1.3.1";
+      version = "2.1.1";
      src = fetchurl {
-        url = "https://registry.npmjs.org/xmlchars/-/xmlchars-1.3.1.tgz";
-        sha512 = "tGkGJkN8XqCod7OT+EvGYK5Z4SfDQGD30zAa58OcnAa0RRWgzUEK72tkXhsX1FZd+rgnhRxFtmO+ihkp8LHSkw==";
+        url = "https://registry.npmjs.org/xmlchars/-/xmlchars-2.1.1.tgz";
+        sha512 = "7hew1RPJ1iIuje/Y01bGD/mXokXxegAgVS+e+E0wSi2ILHQkYAH1+JXARwTjZSM4Z4Z+c73aKspEcqj+zPPL/w==";
      };
    };
    "zxcvbn-4.4.2" = {
@ -1250,10 +1250,10 @@ in
    };
    dependencies = [
      sources."abab-2.0.0"
-      sources."acorn-6.1.1"
-      sources."acorn-globals-4.3.0"
-      sources."acorn-walk-6.1.1"
-      sources."ajv-6.10.0"
+      sources."acorn-6.2.1"
+      sources."acorn-globals-4.3.2"
+      sources."acorn-walk-6.2.0"
+      sources."ajv-6.10.2"
      sources."ansi-escapes-3.2.0"
      sources."ansi-regex-3.0.0"
      sources."ansi-styles-3.2.1"
@ -1277,8 +1277,8 @@ in
      sources."combined-stream-1.0.6"
      sources."commander-2.18.0"
      sources."core-util-is-1.0.2"
-      sources."cssom-0.3.6"
-      sources."cssstyle-1.2.2"
+      sources."cssom-0.3.8"
+      sources."cssstyle-1.4.0"
      sources."dashdash-1.14.1"
      sources."data-urls-1.1.0"
      sources."deep-is-0.1.3"
@ -1289,9 +1289,9 @@ in
      sources."escodegen-1.11.1"
      sources."esprima-3.1.3"
      sources."estraverse-4.2.0"
-      sources."esutils-2.0.2"
+      sources."esutils-2.0.3"
      sources."extend-3.0.2"
-      sources."external-editor-3.0.3"
+      sources."external-editor-3.1.0"
      sources."extsprintf-1.3.0"
      sources."fast-deep-equal-2.0.1"
      sources."fast-json-stable-stringify-2.0.0"
@ -1300,7 +1300,7 @@ in
      sources."forever-agent-0.6.1"
      sources."form-data-2.3.2"
      sources."getpass-0.1.7"
-      sources."graceful-fs-4.1.15"
+      sources."graceful-fs-4.2.0"
      sources."har-schema-2.0.0"
      sources."har-validator-5.1.3"
      sources."has-flag-3.0.0"
@ -1319,17 +1319,17 @@ in
      sources."json-stringify-safe-5.0.1"
      sources."jsprim-1.4.1"
      sources."levn-0.3.0"
-      sources."lodash-4.17.11"
+      sources."lodash-4.17.15"
      sources."lodash.sortby-4.7.0"
      sources."lowdb-1.0.0"
      sources."lunr-2.3.3"
-      sources."mime-db-1.38.0"
-      sources."mime-types-2.1.22"
+      sources."mime-db-1.40.0"
+      sources."mime-types-2.1.24"
      sources."mimic-fn-1.2.0"
      sources."mute-stream-0.0.7"
      sources."node-fetch-2.2.0"
      sources."node-forge-0.7.6"
-      sources."nwsapi-2.1.3"
+      sources."nwsapi-2.1.4"
      sources."oauth-sign-0.9.0"
      sources."onetime-2.0.1"
      sources."optionator-0.8.2"
@ -1340,7 +1340,7 @@ in
      sources."pify-3.0.0"
      sources."pn-1.1.0"
      sources."prelude-ls-1.1.2"
-      sources."psl-1.1.31"
+      sources."psl-1.3.0"
      sources."punycode-2.1.1"
      sources."qs-6.5.2"
      (sources."request-2.88.0" // {
@ -1353,10 +1353,10 @@ in
      sources."request-promise-native-1.0.7"
      sources."restore-cursor-2.0.0"
      sources."run-async-2.3.0"
-      sources."rxjs-6.4.0"
-      sources."safe-buffer-5.1.2"
+      sources."rxjs-6.5.2"
+      sources."safe-buffer-5.2.0"
      sources."safer-buffer-2.1.2"
-      sources."saxes-3.1.9"
+      sources."saxes-3.1.11"
      sources."signal-exit-3.0.2"
      sources."source-map-0.6.1"
      sources."sshpk-1.16.1"
@ -1365,7 +1365,7 @@ in
      sources."string-width-2.1.1"
      sources."strip-ansi-4.0.0"
      sources."supports-color-5.5.0"
-      sources."symbol-tree-3.2.2"
+      sources."symbol-tree-3.2.4"
      sources."through-2.3.8"
      (sources."tldjs-2.3.1" // {
        dependencies = [
@ -1375,7 +1375,7 @@ in
      sources."tmp-0.0.33"
      sources."tough-cookie-2.5.0"
      sources."tr46-1.0.1"
-      sources."tslib-1.9.3"
+      sources."tslib-1.10.0"
      sources."tunnel-agent-0.6.0"
      sources."tweetnacl-0.14.5"
      sources."type-check-0.3.2"
@ -1391,7 +1391,7 @@ in
      sources."wordwrap-1.0.0"
      sources."ws-6.2.1"
      sources."xml-name-validator-3.0.0"
-      sources."xmlchars-1.3.1"
+      sources."xmlchars-2.1.1"
      sources."zxcvbn-4.4.2"
    ];
    buildInputs = globalBuildInputs;
@ -1402,5 +1402,6 @@ in
    };
    production = true;
    bypassCache = true;
+    reconstructLock = true;
  };
 }
--- a/pkgs/tools/security/bitwarden-cli/node-packages.nix
+++ b/pkgs/tools/security/bitwarden-cli/node-packages.nix
@ -1,4 +1,4 @@
-# This file has been generated by node2nix 1.6.0. Do not edit!
+# This file has been generated by node2nix 1.7.0. Do not edit!

 {pkgs ? import <nixpkgs> {
    inherit system;
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -195,6 +195,8 @@ mapAliases ({
  m3d-linux = m33-linux; # added 2016-08-13
  man_db = man-db; # added 2016-05
  manpages = man-pages; # added 2015-12-06
+  mariadb-client = hiPrio mariadb.client; #added 2019.07.28
+  mysql-client = hiPrio mariadb.client;
  memtest86 = memtest86plus; # added 2019-05-08
  mesa_noglu = mesa; # added 2019-05-28
  # NOTE: 2018-07-12: legacy alias:
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -14750,6 +14750,8 @@ in

  ifdtool = callPackage ../tools/misc/ifdtool { };

+  cbmem = callPackage ../tools/misc/cbmem { };
+
  nvramtool = callPackage ../tools/misc/nvramtool { };

  vmfs-tools = callPackage ../tools/filesystems/vmfs-tools { };
@ -14806,6 +14808,7 @@ in
  prometheus-node-exporter = callPackage ../servers/monitoring/prometheus/node-exporter.nix { };
  prometheus-openvpn-exporter = callPackage ../servers/monitoring/prometheus/openvpn-exporter.nix { };
  prometheus-postfix-exporter = callPackage ../servers/monitoring/prometheus/postfix-exporter.nix { };
+  prometheus-postgres-exporter = callPackage ../servers/monitoring/prometheus/postgres-exporter.nix { };
  prometheus-pushgateway = callPackage ../servers/monitoring/prometheus/pushgateway.nix { };
  prometheus-rabbitmq-exporter = callPackage ../servers/monitoring/prometheus/rabbitmq-exporter.nix { };
  prometheus-snmp-exporter = callPackage ../servers/monitoring/prometheus/snmp-exporter.nix {
--- a/pkgs/top-level/emacs-packages.nix
+++ b/pkgs/top-level/emacs-packages.nix
@ -50,7 +50,7 @@ let
  };

  melpaStablePackages = import ../applications/editors/emacs-modes/melpa-stable-packages.nix {
-    inherit external;
+    inherit external lib;
  };

  melpaPackages = import ../applications/editors/emacs-modes/melpa-packages.nix {
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@ -376,6 +376,8 @@ let

    lacaml = callPackage ../development/ocaml-modules/lacaml { };

+    lambdasoup = callPackage ../development/ocaml-modules/lambdasoup { };
+
    lambdaTerm-1_6 = callPackage ../development/ocaml-modules/lambda-term/1.6.nix { lwt = lwt2; };
    lambdaTerm =
      if lib.versionOlder "4.02" ocaml.version
@ -591,6 +593,10 @@ let

    result = callPackage ../development/ocaml-modules/ocaml-result { };

+    secp256k1 = callPackage ../development/ocaml-modules/secp256k1 {
+      inherit (pkgs) secp256k1;
+    };
+
    seq = callPackage ../development/ocaml-modules/seq { };

    sequence = callPackage ../development/ocaml-modules/sequence { };
				`@ -0,0 +1 @@`
				Instructions for adding Vim plugins to `nixpkgs` can be found [here](/doc/languages-frameworks/vim.section.md).