diff --git a/lib/strings.nix b/lib/strings.nix
index 4d7fa1e774d5..48420a367815 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -236,6 +236,26 @@ rec {
     in lenContent >= lenSuffix &&
        substring (lenContent - lenSuffix) lenContent content == suffix;
 
+  /* Determine whether a string contains the given infix
+
+    Type: hasInfix :: string -> string -> bool
+
+    Example:
+      hasInfix "bc" "abcd"
+      => true
+      hasInfix "ab" "abcd"
+      => true
+      hasInfix "cd" "abcd"
+      => true
+      hasInfix "foo" "abcd"
+      => false
+  */
+  hasInfix = infix: content:
+    let
+      drop = x: substring 1 (stringLength x) x;
+    in hasPrefix infix content
+      || content != "" && hasInfix infix (drop content);
+
   /* Convert a string to a list of characters (i.e. singleton strings).
      This allows you to, e.g., map a function over each character.  However,
      note that this will likely be horribly inefficient; Nix is not a
diff --git a/pkgs/applications/altcoins/mist.nix b/pkgs/applications/altcoins/mist.nix
index 194c004f9c7f..2990b44c7f4c 100644
--- a/pkgs/applications/altcoins/mist.nix
+++ b/pkgs/applications/altcoins/mist.nix
@@ -2,7 +2,7 @@
 
 let
   version = "0.11.1";
-  name = "mist";
+  pname = "mist";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
@@ -26,7 +26,7 @@ let
   };
 
   mist = stdenv.lib.appendToName "unwrapped" (stdenv.mkDerivation {
-    inherit name version meta;
+    inherit pname version meta;
 
     src = {
       i686-linux = fetchurl {
diff --git a/pkgs/applications/audio/cadence/default.nix b/pkgs/applications/audio/cadence/default.nix
index c4e34ff7ce7d..f7fa9dbd8615 100644
--- a/pkgs/applications/audio/cadence/default.nix
+++ b/pkgs/applications/audio/cadence/default.nix
@@ -10,7 +10,7 @@
 
  stdenv.mkDerivation rec {
   version = "0.9.0";
-  name = "cadence";
+  pname = "cadence";
 
   src = fetchzip {
     url = "https://github.com/falkTX/Cadence/archive/v${version}.tar.gz";
diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
index b3b838c5d470..33ac72187780 100644
--- a/pkgs/applications/audio/fluidsynth/default.nix
+++ b/pkgs/applications/audio/fluidsynth/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation  rec {
   name = "fluidsynth-${version}";
-  version = "1.1.11";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    sha256 = "0n75jq3xgq46hfmjkaaxz3gic77shs4fzajq40c8gk043i84xbdh";
+    sha256 = "1mqyym5qkh8xd1rqj3yhfxbw5dxjcrljb6nkfqzvcarlv4h6rjn7";
   };
 
   nativeBuildInputs = [ pkgconfig cmake ];
diff --git a/pkgs/applications/audio/vcv-rack/default.nix b/pkgs/applications/audio/vcv-rack/default.nix
index 74e041868dbc..27533084804a 100644
--- a/pkgs/applications/audio/vcv-rack/default.nix
+++ b/pkgs/applications/audio/vcv-rack/default.nix
@@ -3,8 +3,9 @@
 , libzip, rtaudio, rtmidi, speex }:
 
 let
-  glfw-git = glfw.overrideAttrs (oldAttrs: {
-    name = "glfw-git-20180529";
+  glfw-git = glfw.overrideAttrs (oldAttrs: rec {
+    name = "glfw-git-${version}";
+    version = "unstable-2018-05-29";
     src = fetchFromGitHub {
       owner = "glfw";
       repo = "glfw";
diff --git a/pkgs/applications/graphics/vimiv/default.nix b/pkgs/applications/graphics/vimiv/default.nix
index 538931c1040e..e790ef49acbf 100644
--- a/pkgs/applications/graphics/vimiv/default.nix
+++ b/pkgs/applications/graphics/vimiv/default.nix
@@ -6,7 +6,7 @@
 }:
 
 python3Packages.buildPythonApplication rec {
-  name = "vimiv";
+  pname = "vimiv";
   version = "0.7.3";
 
   src = fetchFromGitHub {
diff --git a/pkgs/applications/misc/k2pdfopt/default.nix b/pkgs/applications/misc/k2pdfopt/default.nix
index ad2381394f46..0e84283a9ef7 100644
--- a/pkgs/applications/misc/k2pdfopt/default.nix
+++ b/pkgs/applications/misc/k2pdfopt/default.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
   let
     mupdf_modded = mupdf.overrideAttrs (attrs: {
       name = "mupdf-1.10a";
+      version = "1.10a";
       src = fetchurl {
         url = "https://mupdf.com/downloads/archive/mupdf-1.10a-source.tar.gz";
         sha256 = "0dm8wcs8i29aibzkqkrn8kcnk4q0kd1v66pg48h5c3qqp4v1zk5a";
diff --git a/pkgs/applications/misc/omegat.nix b/pkgs/applications/misc/omegat.nix
index e6a6be88b6c0..660b5db61058 100644
--- a/pkgs/applications/misc/omegat.nix
+++ b/pkgs/applications/misc/omegat.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   version = "4.1.5.2";
-  name = "omegat";
+  pname = "omegat";
 
   src = fetchurl {  # their zip has repeated files or something, so no fetchzip
     url = mirror://sourceforge/project/omegat/OmegaT%20-%20Latest/OmegaT%204.1.5%20update%202/OmegaT_4.1.5_02_Beta_Without_JRE.zip;
diff --git a/pkgs/applications/misc/oneko/default.nix b/pkgs/applications/misc/oneko/default.nix
index 311f093ba6d8..b87f11d7b05d 100644
--- a/pkgs/applications/misc/oneko/default.nix
+++ b/pkgs/applications/misc/oneko/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, imake, gccmakedep, xlibsWrapper }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.sakura.5";
-  vname = "1.2.5";
-  name = "oneko-${vname}";
+  version_name = "1.2.sakura.5";
+  version = "1.2.5";
+  name = "oneko-${version}";
   src = fetchurl {
-    url = "http://www.daidouji.com/oneko/distfiles/oneko-${version}.tar.gz";
+    url = "http://www.daidouji.com/oneko/distfiles/oneko-${version_name}.tar.gz";
     sha256 = "2c2e05f1241e9b76f54475b5577cd4fb6670de058218d04a741a04ebd4a2b22f";
   };
   nativeBuildInputs = [ imake gccmakedep ];
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 8d436e771801..f167980f0bf2 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -73,7 +73,7 @@ let rpath = lib.makeLibraryPath [
 
 
 in stdenv.mkDerivation rec {
-    name = "brave-${version}";
+    pname = "brave";
     version = "0.56.15";
 
     src = fetchurl {
diff --git a/pkgs/applications/networking/enhanced-ctorrent/default.nix b/pkgs/applications/networking/enhanced-ctorrent/default.nix
index 2cfde73a01a6..bb3ab98d1a4c 100644
--- a/pkgs/applications/networking/enhanced-ctorrent/default.nix
+++ b/pkgs/applications/networking/enhanced-ctorrent/default.nix
@@ -1,8 +1,8 @@
 { stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
-  version = "dnh3.3.2";
-  name = "enhanced-ctorrent";
+  version = "3.3.2";
+  pname = "enhanced-ctorrent-dhn";
 
   src = fetchurl {
     url = "http://www.rahul.net/dholmes/ctorrent/ctorrent-dnh3.3.2.tar.gz";
diff --git a/pkgs/applications/networking/flent/http-getter.nix b/pkgs/applications/networking/flent/http-getter.nix
index 20557c18c52c..63c18d6e0929 100644
--- a/pkgs/applications/networking/flent/http-getter.nix
+++ b/pkgs/applications/networking/flent/http-getter.nix
@@ -2,8 +2,8 @@
 , curl, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  name = "http-getter";
-  version = "20180606";
+  pname = "http-getter";
+  version = "unstable-2018-06-06";
 
   src = fetchFromGitHub {
     owner = "tohojo";
diff --git a/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix b/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
index 987a7aa1be05..13c7281aea7c 100644
--- a/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
+++ b/pkgs/applications/networking/instant-messengers/salut-a-toi/default.nix
@@ -9,12 +9,11 @@ let
 
 in
   stdenv.mkDerivation rec {
-    name = "salut-a-toi-${version}";
+    pname = "salut-a-toi";
     version = "0.6.1";
-    pname = "sat-${version}";
 
     src = fetchurl {
-      url = "ftp://ftp.goffi.org/sat/${pname}.tar.bz2";
+      url = "ftp://ftp.goffi.org/sat/sat-${version}.tar.bz2";
       sha256 = "0kn9403n8fpzl0hsb9kkzicsmzq2fjl627l31yykbqzc4nsr780d";
     };
 
diff --git a/pkgs/applications/networking/remote/remmina/default.nix b/pkgs/applications/networking/remote/remmina/default.nix
index dc17ccc4a370..cd2b816c6aa4 100644
--- a/pkgs/applications/networking/remote/remmina/default.nix
+++ b/pkgs/applications/networking/remote/remmina/default.nix
@@ -12,14 +12,14 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "remmina-${version}";
-  version = "1.2.32";
+  pname = "remmina";
+  version = "1.2.32.1";
 
   src = fetchFromGitLab {
     owner  = "Remmina";
     repo   = "Remmina";
     rev    = "v${version}";
-    sha256 = "15szv1xs6drxq6qyksmxcfdz516ja4zm52r4yf6hwij3fgl8qdpw";
+    sha256 = "1b77gs68j5j4nlv69vl81d0kp2623ysvshq7495y6hq5wgi5l3gc";
   };
 
   nativeBuildInputs = [ cmake ninja pkgconfig wrapGAppsHook ];
diff --git a/pkgs/applications/office/bookworm/default.nix b/pkgs/applications/office/bookworm/default.nix
index 5719a9be0a1f..4408af7f45cc 100644
--- a/pkgs/applications/office/bookworm/default.nix
+++ b/pkgs/applications/office/bookworm/default.nix
@@ -5,8 +5,6 @@ stdenv.mkDerivation rec {
   pname = "bookworm";
   version = "unstable-2018-11-19";
 
-  name = "${pname}-${version}";
-
   src = fetchFromGitHub {
     owner = "babluboy";
     repo = pname;
diff --git a/pkgs/applications/science/misc/sasview/xhtml2pdf.nix b/pkgs/applications/science/misc/sasview/xhtml2pdf.nix
index 0b3d438843da..8eff2057928a 100644
--- a/pkgs/applications/science/misc/sasview/xhtml2pdf.nix
+++ b/pkgs/applications/science/misc/sasview/xhtml2pdf.nix
@@ -3,6 +3,7 @@
 let
   #xhtml2pdf specifically requires version "1.0b10" of html5lib
   html5 = html5lib.overrideAttrs( oldAttrs: rec{
+    name = "${oldAttrs.pname}-${version}";
     version = "1.0b10";
     src = oldAttrs.src.override {
       inherit version;
diff --git a/pkgs/applications/video/kodi/plugins.nix b/pkgs/applications/video/kodi/plugins.nix
index f2ceacdd799f..196852933a98 100644
--- a/pkgs/applications/video/kodi/plugins.nix
+++ b/pkgs/applications/video/kodi/plugins.nix
@@ -1,6 +1,7 @@
 { stdenv, callPackage, fetchurl, fetchFromGitHub, unzip
 , cmake, kodiPlain, libcec_platform, tinyxml
-, steam, libusb, pcre-cpp, jsoncpp, libhdhomerun, zlib }:
+, steam, libusb, pcre-cpp, jsoncpp, libhdhomerun, zlib
+, python2Packages }:
 
 with stdenv.lib;
 
@@ -180,26 +181,6 @@ let self = rec {
     // (mkController "ps")
     // (mkController "snes");
 
-  exodus = mkKodiPlugin rec {
-
-    plugin = "exodus";
-    namespace = "plugin.video.exodus";
-    version = "3.1.13";
-
-    src = fetchurl {
-      url = "https://offshoregit.com/${plugin}/${namespace}/${namespace}-${version}.zip";
-      sha256 = "1zyay7cinljxmpzngzlrr4pnk2a7z9wwfdcsk6a4p416iglyggdj";
-    };
-
-    buildInputs = [ unzip ];
-
-    meta = {
-      description = "A streaming plugin for Kodi";
-      platforms = platforms.all;
-      maintainers = with maintainers; [ edwtjo ];
-    };
-  };
-
   hyper-launcher = let
     pname = "hyper-launcher";
     version = "1.5.2";
@@ -251,6 +232,25 @@ let self = rec {
 
   };
 
+  simpleplugin = mkKodiPlugin rec {
+    plugin = "simpleplugin";
+    namespace = "script.module.simpleplugin";
+    version = "2.3.2";
+
+    src = fetchFromGitHub {
+      owner = "romanvm";
+      repo = namespace;
+      rev = "v.${version}";
+      sha256 = "0myar8dqjigb75pcc8zx3i5z79p1ifgphgb82s5syqywk0zaxm3j";
+    };
+
+    meta = {
+      homepage = src.meta.homepage;
+      description = "Simpleplugin API";
+      license = licenses.gpl3;
+    };
+  };
+
   svtplay = mkKodiPlugin rec {
 
     plugin = "svtplay";
@@ -443,4 +443,31 @@ let self = rec {
     };
   };
 
+  yatp = python2Packages.toPythonModule (mkKodiPlugin rec {
+    plugin = "yatp";
+    namespace = "plugin.video.yatp";
+    version = "3.3.2";
+
+    src = fetchFromGitHub {
+      owner = "romanvm";
+      repo = "kodi.yatp";
+      rev = "v.${version}";
+      sha256 = "12g1f57sx7dy6wy7ljl7siz2qs1kxcmijcg7xx2xpvmq61x9qa2d";
+    };
+
+    patches = [ ./yatp/dont-monkey.patch ];
+
+    propagatedBuildInputs = [
+      simpleplugin
+      python2Packages.requests
+      python2Packages.libtorrentRasterbar
+    ];
+
+    meta = {
+      homepage = src.meta.homepage;
+      description = "Yet Another Torrent Player: libtorrent-based torrent streaming for Kodi";
+      license = licenses.gpl3;
+    };
+  });
+
 }; in self
diff --git a/pkgs/applications/video/kodi/yatp/dont-monkey.patch b/pkgs/applications/video/kodi/yatp/dont-monkey.patch
new file mode 100644
index 000000000000..62d5d0c0d4c0
--- /dev/null
+++ b/pkgs/applications/video/kodi/yatp/dont-monkey.patch
@@ -0,0 +1,29 @@
+diff --git a/plugin.video.yatp/server.py b/plugin.video.yatp/server.py
+index 1adcbb5..488b72c 100644
+--- a/plugin.video.yatp/server.py
++++ b/plugin.video.yatp/server.py
+@@ -20,24 +20,8 @@ addon = Addon()
+ _ = addon.initialize_gettext()
+ addon.log_notice('Starting Torrent Server...')
+ 
+-# A monkey-patch to set the necessary librorrent version
+-librorrent_addon = Addon('script.module.libtorrent')
+-orig_custom_version = librorrent_addon.get_setting('custom_version', False)
+-orig_set_version = librorrent_addon.get_setting('set_version', False)
+-librorrent_addon.set_setting('custom_version', 'true')
+-if addon.libtorrent_version == '1.0.9':
+-    librorrent_addon.set_setting('set_version', '4')
+-elif addon.libtorrent_version == '1.1.0':
+-    librorrent_addon.set_setting('set_version', '5')
+-elif addon.libtorrent_version == '1.1.1':
+-    librorrent_addon.set_setting('set_version', '6')
+-else:
+-    librorrent_addon.set_setting('set_version', '0')
+-
+ from libs.server import wsgi_app
+ 
+-librorrent_addon.set_setting('custom_version', orig_custom_version)
+-librorrent_addon.set_setting('set_version', orig_set_version)
+ # ======
+ 
+ if addon.enable_limits:
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index c8495155dbca..729ba9eae185 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -16,7 +16,8 @@ rec {
     } :
   let
     docker-runc = runc.overrideAttrs (oldAttrs: rec {
-      name = "docker-runc";
+      name = "docker-runc-${version}";
+      inherit version;
       src = fetchFromGitHub {
         owner = "docker";
         repo = "runc";
@@ -28,7 +29,8 @@ rec {
     });
 
     docker-containerd = (containerd.override { inherit go; }).overrideAttrs (oldAttrs: rec {
-      name = "docker-containerd";
+      name = "docker-containerd-${version}";
+      inherit version;
       src = fetchFromGitHub {
         owner = "docker";
         repo = "containerd";
@@ -42,7 +44,8 @@ rec {
     });
 
     docker-tini = tini.overrideAttrs  (oldAttrs: rec {
-      name = "docker-init";
+      name = "docker-init-${version}";
+      inherit version;
       src = fetchFromGitHub {
         owner = "krallin";
         repo = "tini";
diff --git a/pkgs/build-support/fetchegg/default.nix b/pkgs/build-support/fetchegg/default.nix
index 746af9e27375..d4d33a5593c3 100644
--- a/pkgs/build-support/fetchegg/default.nix
+++ b/pkgs/build-support/fetchegg/default.nix
@@ -8,7 +8,7 @@ if md5 != "" then
   throw "fetchegg does not support md5 anymore, please use sha256"
 else
 stdenvNoCC.mkDerivation {
-  name = "chicken-${name}-export";
+  name = "chicken-${name}-export-${version}";
   builder = ./builder.sh;
   nativeBuildInputs = [ chicken ];
 
diff --git a/pkgs/build-support/setup-hooks/audit-tmpdir.sh b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
index 0f515842ebce..43ea0d6caecd 100644
--- a/pkgs/build-support/setup-hooks/audit-tmpdir.sh
+++ b/pkgs/build-support/setup-hooks/audit-tmpdir.sh
@@ -13,23 +13,23 @@ auditTmpdir() {
     local dir="$1"
     [ -e "$dir" ] || return 0
 
-    header "checking for references to $TMPDIR in $dir..."
+    header "checking for references to $TMPDIR/ in $dir..."
 
     local i
     while IFS= read -r -d $'\0' i; do
         if [[ "$i" =~ .build-id ]]; then continue; fi
 
         if isELF "$i"; then
-            if patchelf --print-rpath "$i" | grep -q -F "$TMPDIR"; then
-                echo "RPATH of binary $i contains a forbidden reference to $TMPDIR"
+            if patchelf --print-rpath "$i" | grep -q -F "$TMPDIR/"; then
+                echo "RPATH of binary $i contains a forbidden reference to $TMPDIR/"
                 exit 1
             fi
         fi
 
         if  isScript "$i"; then
             if [ -e "$(dirname "$i")/.$(basename "$i")-wrapped" ]; then
-                if grep -q -F "$TMPDIR" "$i"; then
-                    echo "wrapper script $i contains a forbidden reference to $TMPDIR"
+                if grep -q -F "$TMPDIR/" "$i"; then
+                    echo "wrapper script $i contains a forbidden reference to $TMPDIR/"
                     exit 1
                 fi
             fi
diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index 5d5ddcaa8d72..bc12be0fa36c 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -40,7 +40,7 @@ makeWrapper() {
 
     mkdir -p "$(dirname "$wrapper")"
 
-    echo "#! $SHELL -e" > "$wrapper"
+    echo "#! @shell@ -e" > "$wrapper"
 
     params=("$@")
     for ((n = 2; n < ${#params[*]}; n += 1)); do
diff --git a/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix b/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix
index 946e7adff793..2db256c323fb 100644
--- a/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-bluetooth/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, gnome3, meson, ninja, pkgconfig, gtk3, intltool, glib
 , udev, itstool, libxml2, wrapGAppsHook, libnotify, libcanberra-gtk3, gobjectIntrospection
-, gtk-doc, docbook_xsl, docbook_xml_dtd_43 }:
+, gtk-doc, docbook_xsl, docbook_xml_dtd_43, python3 }:
 
 let
   pname = "gnome-bluetooth";
@@ -18,7 +18,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     meson ninja intltool itstool pkgconfig libxml2 wrapGAppsHook gobjectIntrospection
-    gtk-doc docbook_xsl docbook_xml_dtd_43
+    gtk-doc docbook_xsl docbook_xml_dtd_43 python3
   ];
   buildInputs = [
     glib gtk3 udev libnotify libcanberra-gtk3
diff --git a/pkgs/desktops/gnome-3/core/gnome-session/default.nix b/pkgs/desktops/gnome-3/core/gnome-session/default.nix
index 57bcd826038d..973613b3319e 100644
--- a/pkgs/desktops/gnome-3/core/gnome-session/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-session/default.nix
@@ -1,5 +1,5 @@
 { fetchurl, stdenv, substituteAll, meson, ninja, pkgconfig, gnome3, glib, gtk, gsettings-desktop-schemas
-, gnome-desktop, dbus, json-glib, libICE, xmlto, docbook_xsl, docbook_xml_dtd_412
+, gnome-desktop, dbus, json-glib, libICE, xmlto, docbook_xsl, docbook_xml_dtd_412, python3
 , libxslt, gettext, makeWrapper, systemd, xorg, epoxy }:
 
 stdenv.mkDerivation rec {
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     meson ninja pkgconfig gettext makeWrapper
-    xmlto libxslt docbook_xsl docbook_xml_dtd_412
+    xmlto libxslt docbook_xsl docbook_xml_dtd_412 python3
     dbus # for DTD
   ];
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
index ce025899c806..25758ddea8dd 100644
--- a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
@@ -1,7 +1,7 @@
 { fetchurl, substituteAll, stdenv, meson, ninja, pkgconfig, gnome3, perl, gettext, glib, libnotify, lcms2, libXtst
 , libxkbfile, libpulseaudio, alsaLib, libcanberra-gtk3, upower, colord, libgweather, polkit
 , geoclue2, librsvg, xf86_input_wacom, udev, libgudev, libwacom, libxslt, libxml2, networkmanager
-, docbook_xsl, wrapGAppsHook, ibus, xkeyboard_config, tzdata, nss }:
+, docbook_xsl, wrapGAppsHook, python3, ibus, xkeyboard_config, tzdata, nss }:
 
 stdenv.mkDerivation rec {
   name = "gnome-settings-daemon-${version}";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   # fatal error: gio/gunixfdlist.h: No such file or directory
   NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
-  nativeBuildInputs = [ meson ninja pkgconfig perl gettext libxml2 libxslt docbook_xsl wrapGAppsHook ];
+  nativeBuildInputs = [ meson ninja pkgconfig perl gettext libxml2 libxslt docbook_xsl wrapGAppsHook python3 ];
 
   buildInputs = with gnome3; [
     ibus gtk glib gsettings-desktop-schemas networkmanager
diff --git a/pkgs/development/beam-modules/hex-registry-snapshot.nix b/pkgs/development/beam-modules/hex-registry-snapshot.nix
index 991e9717b801..fbd2950b6d53 100644
--- a/pkgs/development/beam-modules/hex-registry-snapshot.nix
+++ b/pkgs/development/beam-modules/hex-registry-snapshot.nix
@@ -1,9 +1,9 @@
 {stdenv, writeText, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-    name = "hex-registry";
+    pname = "hex-registry";
     rev = "11d7a24e9f53f52490ce255a6248e71128e73aa1";
-    version = "20180712.${rev}";
+    version = "unstable-2018-07-12";
 
     src = fetchFromGitHub {
         inherit rev;
diff --git a/pkgs/development/beam-modules/hex/default.nix b/pkgs/development/beam-modules/hex/default.nix
index d0af0b59c9f9..7e91153bed51 100644
--- a/pkgs/development/beam-modules/hex/default.nix
+++ b/pkgs/development/beam-modules/hex/default.nix
@@ -7,13 +7,13 @@ let
   };
 
   pkg = self: stdenv.mkDerivation rec {
-    name = "hex";
-    version = "v0.17.1";
+    pname = "hex";
+    version = "0.17.1";
 
     src = fetchFromGitHub {
         owner = "hexpm";
         repo = "hex";
-        rev = "${version}";
+        rev = "v${version}";
         sha256 = "1s4asar1mcavzj3w37jcz243ka0z5jm0r42yws3h4aagawxxg02z";
     };
 
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index bcb724fd58c6..a7a8011b2e65 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -177,7 +177,7 @@ stdenv.mkDerivation ({
 
   inherit patches;
 
-  hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
+  hardeningDisable = [ "format" "pie" ];
 
   outputs = [ "out" "lib" "man" "info" ];
   setOutputFlags = false;
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index 13ff4165a41c..a3ba03f517a8 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -185,7 +185,7 @@ stdenv.mkDerivation ({
 
   inherit patches;
 
-  hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
+  hardeningDisable = [ "format" "pie" ];
 
   outputs = if langJava || langGo then ["out" "man" "info"]
     else [ "out" "lib" "man" "info" ];
diff --git a/pkgs/development/compilers/gcc/5/default.nix b/pkgs/development/compilers/gcc/5/default.nix
index a30cd6bbda97..95e3d7b84924 100644
--- a/pkgs/development/compilers/gcc/5/default.nix
+++ b/pkgs/development/compilers/gcc/5/default.nix
@@ -178,7 +178,7 @@ stdenv.mkDerivation ({
 
   libc_dev = stdenv.cc.libc_dev;
 
-  hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
+  hardeningDisable = [ "format" "pie" ];
 
   # This should kill all the stdinc frameworks that gcc and friends like to
   # insert into default search paths.
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 372a7065f2dc..ff48e485a9ad 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -178,7 +178,7 @@ stdenv.mkDerivation ({
 
   libc_dev = stdenv.cc.libc_dev;
 
-  hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
+  hardeningDisable = [ "format" "pie" ];
 
   # This should kill all the stdinc frameworks that gcc and friends like to
   # insert into default search paths.
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 094c26cbf696..9235908f14c9 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -149,7 +149,7 @@ stdenv.mkDerivation ({
 
   libc_dev = stdenv.cc.libc_dev;
 
-  hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
+  hardeningDisable = [ "format" "pie" ];
 
   # This should kill all the stdinc frameworks that gcc and friends like to
   # insert into default search paths.
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index 1335666c54ce..363694dcf4e2 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -143,7 +143,7 @@ stdenv.mkDerivation ({
 
   libc_dev = stdenv.cc.libc_dev;
 
-  hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
+  hardeningDisable = [ "format" "pie" ];
 
   # This should kill all the stdinc frameworks that gcc and friends like to
   # insert into default search paths.
diff --git a/pkgs/development/compilers/gcc/snapshot/default.nix b/pkgs/development/compilers/gcc/snapshot/default.nix
index c18189cd9496..586fb2b44e10 100644
--- a/pkgs/development/compilers/gcc/snapshot/default.nix
+++ b/pkgs/development/compilers/gcc/snapshot/default.nix
@@ -137,7 +137,7 @@ stdenv.mkDerivation ({
 
   libc_dev = stdenv.cc.libc_dev;
 
-  hardeningDisable = [ "format" ];
+  hardeningDisable = [ "format" "pie" ];
 
   postPatch =
     if targetPlatform != hostPlatform || stdenv.cc.libc != null then
diff --git a/pkgs/development/compilers/go/1.11.nix b/pkgs/development/compilers/go/1.11.nix
index 30875cfeed81..ddf2eac36e13 100644
--- a/pkgs/development/compilers/go/1.11.nix
+++ b/pkgs/development/compilers/go/1.11.nix
@@ -22,13 +22,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "go-${version}";
-  version = "1.11";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "go";
     rev = "go${version}";
-    sha256 = "1k18d6rkijlgzn1zw4wphzcv6a6w9hb1msgrsh1102jb18644f2q";
+    sha256 = "0pk7pxfm3ij2ksdrg49jz501fr1d103zr4mjjwv821if9g279jc9";
   };
 
   GOCACHE = "off";
diff --git a/pkgs/development/compilers/graalvm/default.nix b/pkgs/development/compilers/graalvm/default.nix
index 4d7938967696..f051b24065a5 100644
--- a/pkgs/development/compilers/graalvm/default.nix
+++ b/pkgs/development/compilers/graalvm/default.nix
@@ -65,7 +65,7 @@ in rec {
 
   mx = stdenv.mkDerivation rec {
     version = "5.192.0";
-    name = "mx";
+    pname = "mx";
     src = fetchFromGitHub {
       owner  = "graalvm";
       repo   = "mx";
diff --git a/pkgs/development/compilers/nasm/default.nix b/pkgs/development/compilers/nasm/default.nix
index b95f6e5ee95f..271d26eda1c0 100644
--- a/pkgs/development/compilers/nasm/default.nix
+++ b/pkgs/development/compilers/nasm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "nasm-${version}";
-  version = "2.13.03";
+  version = "2.14";
 
   src = fetchurl {
     url = "https://www.nasm.us/pub/nasm/releasebuilds/${version}/${name}.tar.bz2";
-    sha256 = "04bh736zfj3xy5ihh1whshpjxsisv7hqkz954clzdw6kg93qdv33";
+    sha256 = "0i678zbm1ljn5jwia7gj1n503izwvzlh55xzm4i0qgfmr8kzsg6l";
   };
 
   nativeBuildInputs = [ perl ];
diff --git a/pkgs/development/compilers/rust/bootstrap.nix b/pkgs/development/compilers/rust/bootstrap.nix
index e738dd7acaed..4f16912a86b5 100644
--- a/pkgs/development/compilers/rust/bootstrap.nix
+++ b/pkgs/development/compilers/rust/bootstrap.nix
@@ -3,16 +3,16 @@
 let
   # Note: the version MUST be one version prior to the version we're
   # building
-  version = "1.29.2";
+  version = "1.30.0";
 
-  # fetch hashes by running `print-hashes.sh 1.29.2`
+  # fetch hashes by running `print-hashes.sh 1.30.0`
   hashes = {
-    i686-unknown-linux-gnu = "fd67338c32348fc0cf09dd066975acc221e062fdc3b052912baef93b39a0b27e";
-    x86_64-unknown-linux-gnu = "e9809825c546969a9609ff94b2793c9107d7d9bed67d557ed9969e673137e8d8";
-    armv7-unknown-linux-gnueabihf = "943ee757d96be97baccb84b0c2a5da368f8f3adf082805b0f0323240e80975c0";
-    aarch64-unknown-linux-gnu = "e11461015ca7106ef8ebf00859842bf4be518ee170226cb8eedaaa666946509f";
-    i686-apple-darwin = "aadec39efcbc476e00722b527dcc587003ab05194efd06ba1b91c1e0f7512d3f";
-    x86_64-apple-darwin = "63f54e3013406b39fcb5b84bcf5e8ce85860d0b97a1e156700e467bf5fb5d5f2";
+    i686-unknown-linux-gnu = "4ceb0e3011d96504587abb7edfdea9c1b4b7cb2c4488cc4a25adc2f3b6a88b21";
+    x86_64-unknown-linux-gnu = "f620e3125cc505c842150bd873c0603432b6cee984cdae8b226cf92c8aa1a80f";
+    armv7-unknown-linux-gnueabihf = "63991f6769ca8db693562c34ac25473e9d4f9f214d6ee98917891be469d69cfd";
+    aarch64-unknown-linux-gnu = "9690c7c50eba5a8461184ee4138b4c284bad31ccc4aa1f2ddeec58b253e6363e";
+    i686-apple-darwin = "b8e5ac31f0a192a58b0e98ff88c47035a2882598946352fa5a86c28ede079230";
+    x86_64-apple-darwin = "07008d90932712282bc599f1e9a226e97879c758dc1f935e6e2675e45694cc1b";
   };
 
   platform =
diff --git a/pkgs/development/compilers/rust/default.nix b/pkgs/development/compilers/rust/default.nix
index a925127596d5..583b48e6dc60 100644
--- a/pkgs/development/compilers/rust/default.nix
+++ b/pkgs/development/compilers/rust/default.nix
@@ -7,11 +7,11 @@
 
 let
   rustPlatform = recurseIntoAttrs (makeRustPlatform (callPackage ./bootstrap.nix {}));
-  version = "1.30.0";
+  version = "1.30.1";
   cargoVersion = "1.30.0";
   src = fetchurl {
     url = "https://static.rust-lang.org/dist/rustc-${version}-src.tar.gz";
-    sha256 = "1vh8q5i273xyjvpipqisny11iz0xfgz30cgjr7068nx5rhzsh2yd";
+    sha256 = "0aavdc1lqv0cjzbqwl5n59yd0bqdlhn0zas61ljf38yrvc18k8rn";
   };
 in rec {
   rustc = callPackage ./rustc.nix {
@@ -29,7 +29,7 @@ in rec {
       ./patches/disable-test-inherit-env.patch
     ];
 
-    forceBundledLLVM = true;
+    withBundledLLVM = false;
 
     configureFlags = [ "--release-channel=stable" ];
 
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index decf14a32948..3ec08a82d017 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -1,9 +1,9 @@
-{ stdenv, targetPackages
+{ stdenv, targetPackages, removeReferencesTo
 , fetchurl, fetchgit, fetchzip, file, python2, tzdata, ps
 , llvm, jemalloc, ncurses, darwin, rustPlatform, git, cmake, curl
 , which, libffi, gdb
 , version
-, forceBundledLLVM ? false
+, withBundledLLVM ? false
 , src
 , configureFlags ? []
 , patches
@@ -20,6 +20,8 @@ let
 
   llvmShared = llvm.override { enableSharedLibraries = true; };
 
+  prefixedJemalloc = jemalloc.override { stripPrefix = false; };
+
   target = builtins.replaceStrings [" "] [","] (builtins.toString targets);
 in
 
@@ -40,7 +42,11 @@ stdenv.mkDerivation {
   # See https://github.com/NixOS/nixpkgs/pull/34227
   stripDebugList = if stdenv.isDarwin then [ "bin" ] else null;
 
-  NIX_LDFLAGS = optionalString stdenv.isDarwin "-rpath ${llvmShared}/lib";
+  NIX_LDFLAGS =
+       # when linking stage1 libstd: cc: undefined reference to `__cxa_begin_catch'
+       optional (stdenv.isLinux && !withBundledLLVM) "--push-state --as-needed -lstdc++ --pop-state"
+    ++ optional (stdenv.isDarwin && !withBundledLLVM) "-lc++"
+    ++ optional stdenv.isDarwin "-rpath ${llvmShared}/lib";
 
   # Enable nightly features in stable compiles (used for
   # bootstrapping, see https://github.com/rust-lang/rust/pull/37265).
@@ -54,13 +60,12 @@ stdenv.mkDerivation {
   # We need rust to build rust. If we don't provide it, configure will try to download it.
   # Reference: https://github.com/rust-lang/rust/blob/master/src/bootstrap/configure.py
   configureFlags = configureFlags
-                ++ [ "--enable-local-rust" "--local-rust-root=${rustPlatform.rust.rustc}" "--enable-rpath" ]
-                ++ [ "--enable-vendor" ]
-                # ++ [ "--jemalloc-root=${jemalloc}/lib"
-                ++ [ "--default-linker=${targetPackages.stdenv.cc}/bin/cc" ]
-                ++ optional (!forceBundledLLVM) [ "--enable-llvm-link-shared" ]
-                ++ optional (targets != []) "--target=${target}"
-                ++ optional (!forceBundledLLVM) "--llvm-root=${llvmShared}";
+                ++ [ "--enable-local-rust" "--local-rust-root=${rustPlatform.rust.rustc}" "--enable-rpath"
+                     "--enable-vendor"
+                     "--jemalloc-root=${prefixedJemalloc}/lib"
+                     "--default-linker=${targetPackages.stdenv.cc}/bin/cc" ]
+                ++ optional (!withBundledLLVM) [ "--enable-llvm-link-shared" "--llvm-root=${llvmShared}" ]
+                ++ optional (targets != []) "--target=${target}";
 
   # The bootstrap.py will generated a Makefile that then executes the build.
   # The BOOTSTRAP_ARGS used by this Makefile must include all flags to pass
@@ -79,29 +84,13 @@ stdenv.mkDerivation {
   postPatch = ''
     patchShebangs src/etc
 
-    # Fix dynamic linking against llvm
-    #${optionalString (!forceBundledLLVM) ''sed -i 's/, kind = \\"static\\"//g' src/etc/mklldeps.py''}
+    ${optionalString (!withBundledLLVM) ''rm -rf src/llvm''}
+    rm -rf src/jemalloc
 
     # Fix the configure script to not require curl as we won't use it
     sed -i configure \
       -e '/probe_need CFG_CURL curl/d'
 
-    # Fix the use of jemalloc prefixes which our jemalloc doesn't have
-    # TODO: reenable if we can figure out how to get our jemalloc to work
-    #[ -f src/liballoc_jemalloc/lib.rs ] && sed -i 's,je_,,g' src/liballoc_jemalloc/lib.rs
-    #[ -f src/liballoc/heap.rs ] && sed -i 's,je_,,g' src/liballoc/heap.rs # Remove for 1.4.0+
-
-    # Disable fragile tests.
-    rm -vr src/test/run-make-fulldeps/linker-output-non-utf8 || true
-    rm -vr src/test/run-make-fulldeps/issue-26092 || true
-
-    # Remove test targeted at LLVM 3.9 - https://github.com/rust-lang/rust/issues/36835
-    rm -vr src/test/ui/run-pass/issue-36023.rs || true
-
-    # Disable test getting stuck on hydra - possible fix:
-    # https://reviews.llvm.org/rL281650
-    rm -vr src/test/ui/run-pass/issue-36474.rs || true
-
     # On Hydra: `TcpListener::bind(&addr)`: Address already in use (os error 98)'
     sed '/^ *fn fast_rebind()/i#[ignore]' -i src/libstd/net/tcp.rs
 
@@ -137,14 +126,14 @@ stdenv.mkDerivation {
   # ps is needed for one of the test cases
   nativeBuildInputs =
     [ file python2 ps rustPlatform.rust.rustc git cmake
-      which libffi
+      which libffi removeReferencesTo
     ]
     # Only needed for the debuginfo tests
     ++ optional (!stdenv.isDarwin) gdb;
 
-  buildInputs = [ ncurses ] ++ targetToolchains
+  buildInputs = targetToolchains
     ++ optional stdenv.isDarwin Security
-    ++ optional (!forceBundledLLVM) llvmShared;
+    ++ optional (!withBundledLLVM) llvmShared;
 
   outputs = [ "out" "man" "doc" ];
   setOutputFlags = false;
@@ -165,6 +154,12 @@ stdenv.mkDerivation {
 
   inherit doCheck;
 
+  # remove references to llvm-config in lib/rustlib/x86_64-unknown-linux-gnu/codegen-backends/librustc_codegen_llvm-llvm.so
+  # and thus a transitive dependency on ncurses
+  postInstall = ''
+    find $out/lib -name "*.so" -type f -exec remove-references-to -t ${llvmShared} '{}' '+'
+  '';
+
   configurePlatforms = [];
 
   # https://github.com/NixOS/nixpkgs/pull/21742#issuecomment-272305764
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index 07a63a366f1b..e009204133ef 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -60,9 +60,7 @@ stdenv.mkDerivation rec {
       cf-private
     ];
 
-  # /build/SDL2-2.0.7/src/video/wayland/SDL_waylandevents.c:41:10: fatal error:
-  #   pointer-constraints-unstable-v1-client-protocol.h: No such file or directory
-  enableParallelBuilding = false;
+  enableParallelBuilding = true;
 
   configureFlags = [
     "--disable-oss"
diff --git a/pkgs/development/libraries/eigen/3.3.nix b/pkgs/development/libraries/eigen/3.3.nix
deleted file mode 100644
index c48f8e4c9732..000000000000
--- a/pkgs/development/libraries/eigen/3.3.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{stdenv, fetchurl, fetchpatch, cmake}:
-
-let
-  version = "3.3.5";
-in
-stdenv.mkDerivation {
-  name = "eigen-${version}";
-
-  src = fetchurl {
-    url = "https://bitbucket.org/eigen/eigen/get/${version}.tar.gz";
-    name = "eigen-${version}.tar.gz";
-    sha256 = "13p60x6k61zq2y2in7g4fy5p55cr5dbmj3zvw10zcazxraxbcm04";
-  };
-
-  patches = [
-    ./include-dir.patch
-  ];
-
-  nativeBuildInputs = [ cmake ];
-
-  meta = with stdenv.lib; {
-    description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
-    license = licenses.lgpl3Plus;
-    homepage = http://eigen.tuxfamily.org ;
-    platforms = platforms.unix;
-    maintainers = with stdenv.lib.maintainers; [ sander raskin ];
-    inherit version;
-  };
-}
diff --git a/pkgs/development/libraries/eigen/default.nix b/pkgs/development/libraries/eigen/default.nix
index c120132dcb8b..c48f8e4c9732 100644
--- a/pkgs/development/libraries/eigen/default.nix
+++ b/pkgs/development/libraries/eigen/default.nix
@@ -1,7 +1,7 @@
-{stdenv, fetchurl, cmake}:
+{stdenv, fetchurl, fetchpatch, cmake}:
 
 let
-  version = "3.2.10";
+  version = "3.3.5";
 in
 stdenv.mkDerivation {
   name = "eigen-${version}";
@@ -9,17 +9,15 @@ stdenv.mkDerivation {
   src = fetchurl {
     url = "https://bitbucket.org/eigen/eigen/get/${version}.tar.gz";
     name = "eigen-${version}.tar.gz";
-    sha256 = "00l52y7m276gh8wjkqqcxz6x687azrm7a70s3iraxnpy9bxa9y04";
+    sha256 = "13p60x6k61zq2y2in7g4fy5p55cr5dbmj3zvw10zcazxraxbcm04";
   };
 
+  patches = [
+    ./include-dir.patch
+  ];
+
   nativeBuildInputs = [ cmake ];
 
-  doCheck = false; # a couple of tests fail with "Child aborted"
-
-  postInstall = ''
-    sed -e '/Cflags:/s@''${prefix}/@@' -i "$out"/share/pkgconfig/eigen3.pc
-  '';
-
   meta = with stdenv.lib; {
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
     license = licenses.lgpl3Plus;
diff --git a/pkgs/development/libraries/elf-header/default.nix b/pkgs/development/libraries/elf-header/default.nix
index ab8c217dce43..47b39eeb7e97 100644
--- a/pkgs/development/libraries/elf-header/default.nix
+++ b/pkgs/development/libraries/elf-header/default.nix
@@ -12,7 +12,7 @@ let
 in
 
 stdenvNoCC.mkDerivation {
-  name = "elf-header";
+  pname = "elf-header";
   inherit (libc) version;
 
   src = null;
diff --git a/pkgs/development/libraries/enchant/default.nix b/pkgs/development/libraries/enchant/default.nix
index a9446306d335..dc0967ef61ef 100644
--- a/pkgs/development/libraries/enchant/default.nix
+++ b/pkgs/development/libraries/enchant/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "${pname}-${version}";
-  version = "1.6.0";
+  version = "1.6.1";
   pname = "enchant";
 
   src = fetchurl {
-    url = "http://www.abisource.com/downloads/${pname}/${version}/${name}.tar.gz";
-    sha256 = "0zq9yw1xzk8k9s6x83n1f9srzcwdavzazn3haln4nhp9wxxrxb1g";
+    url = "https://github.com/AbiWord/${pname}/releases/download/${pname}-1-6-1/${name}.tar.gz";
+    sha256 = "1xg3m7mniyqyff8qv46jbfwgchb6di6qxdjnd5sfir7jzv0dkw5y";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Generic spell checking library";
-    homepage = http://www.abisource.com/enchant;
+    homepage = https://abiword.github.io/enchant;
     platforms = platforms.unix;
     license = licenses.lgpl21;
   };
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index 8d88dc04924b..ca4c0bc744b2 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -1,13 +1,13 @@
 { stdenv, lib, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "gdbm-1.18";
-  # FIXME: remove on update to > 1.18
+  name = "gdbm-1.18.1";
+  # FIXME: remove on update to > 1.18.1
   NIX_CFLAGS_COMPILE = if stdenv.cc.isClang then "-Wno-error=return-type" else null;
 
   src = fetchurl {
     url = "mirror://gnu/gdbm/${name}.tar.gz";
-    sha256 = "1kimnv12bzjjhaqk4c8w2j6chdj9c6bg21lchaf7abcyfss2r0mq";
+    sha256 = "1p4ibds6z3ccy65lkmd6lm7js0kwifvl53r0fd759fjxgr917rl6";
   };
 
   doCheck = true; # not cross;
diff --git a/pkgs/development/libraries/glib-networking/default.nix b/pkgs/development/libraries/glib-networking/default.nix
index 4ac6e87b9dd7..87d26b100270 100644
--- a/pkgs/development/libraries/glib-networking/default.nix
+++ b/pkgs/development/libraries/glib-networking/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, meson, ninja, pkgconfig, glib, gettext, gnutls, p11-kit, libproxy, gnome3
+{ stdenv, fetchurl, fetchpatch, meson, ninja, pkgconfig, glib, gettext, python3, gnutls, p11-kit, libproxy, gnome3
 , gsettings-desktop-schemas }:
 
 let
@@ -30,7 +30,10 @@ stdenv.mkDerivation rec {
     patchShebangs meson_post_install.py
   '';
 
-  nativeBuildInputs = [ meson ninja pkgconfig gettext ];
+  nativeBuildInputs = [
+    meson ninja pkgconfig gettext
+    python3 # install_script
+  ];
   propagatedBuildInputs = [ glib gnutls p11-kit libproxy gsettings-desktop-schemas ];
 
   doCheck = false; # tests need to access the certificates (among other things)
diff --git a/pkgs/development/libraries/gnu-efi/default.nix b/pkgs/development/libraries/gnu-efi/default.nix
index 1f8a518d69e4..036863c9c0bf 100644
--- a/pkgs/development/libraries/gnu-efi/default.nix
+++ b/pkgs/development/libraries/gnu-efi/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "gnu-efi-${version}";
-  version = "3.0.8";
+  version = "3.0.9";
 
   src = fetchurl {
     url = "mirror://sourceforge/gnu-efi/${name}.tar.bz2";
-    sha256 = "08mpw8s79azip9jbzm6msq0999pnkqzd82axydrcyyynm276s03n";
+    sha256 = "1w3p4aqlc5j93q44la7dc8cr3hky20zvsd0h0k2lyzhwmrzfl5b7";
   };
 
   buildInputs = [ pciutils ];
diff --git a/pkgs/development/libraries/gsignond/default.nix b/pkgs/development/libraries/gsignond/default.nix
index 11dcc2a2ee91..af7aa2b12076 100644
--- a/pkgs/development/libraries/gsignond/default.nix
+++ b/pkgs/development/libraries/gsignond/default.nix
@@ -6,16 +6,15 @@
 let
 unwrapped = stdenv.mkDerivation rec {
   pname = "gsignond";
-  version = "39022c86ddb5062a10fb0503ad9d81a8e532d527";
+  version = "unstable-2018-10-04";
 
-  name = "${pname}-2018-10-04";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchFromGitLab {
     owner = "accounts-sso";
     repo = pname;
-    rev = version;
+    rev = "39022c86ddb5062a10fb0503ad9d81a8e532d527";
     sha256 = "1gw8vbj3j6wxqy759z97arm8lnqhmraw9s2frv3ar6crnfhlidff";
   };
 
diff --git a/pkgs/development/libraries/hunspell/default.nix b/pkgs/development/libraries/hunspell/default.nix
index 62c3d79cf9a1..3728c05e516c 100644
--- a/pkgs/development/libraries/hunspell/default.nix
+++ b/pkgs/development/libraries/hunspell/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, ncurses, readline, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  version = "1.6.2";
+  version = "1.7.0";
   name = "hunspell-${version}";
 
   src = fetchurl {
     url = "https://github.com/hunspell/hunspell/archive/v${version}.tar.gz";
-    sha256 = "1i7lsv2cm0713ia3j5wjkcrhpfp3lqpjpwp4d3v18n7ycaqcxn9w";
+    sha256 = "12mwwqz6qkx7q1lg9vpjiiwh4fk4c8xs6g6g0xa2ia0hp5pbh9xv";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
diff --git a/pkgs/development/libraries/igraph/default.nix b/pkgs/development/libraries/igraph/default.nix
index 4ac3ebc09889..aab64b941caa 100644
--- a/pkgs/development/libraries/igraph/default.nix
+++ b/pkgs/development/libraries/igraph/default.nix
@@ -3,12 +3,12 @@
   flex, yacc, zlib, libxml2 }:
 
 stdenv.mkDerivation rec {
-  name = "igraph";
+  pname = "igraph";
   version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "igraph";
-    repo = name;
+    repo = pname;
     rev = version;
     sha256 = "1wsy0r511gk069il6iqjs27q8cjvqz20gf0a7inybx1bw84845z8";
   };
diff --git a/pkgs/development/libraries/jemalloc/common.nix b/pkgs/development/libraries/jemalloc/common.nix
index 593f4411f19f..5ac1067d92fb 100644
--- a/pkgs/development/libraries/jemalloc/common.nix
+++ b/pkgs/development/libraries/jemalloc/common.nix
@@ -1,6 +1,13 @@
-{ stdenv, fetchurl, version, sha256, ... }@args:
+{ version, sha256 }:
+{ stdenv, fetchurl,
+# By default, jemalloc puts a je_ prefix onto all its symbols on OSX, which
+# then stops downstream builds (mariadb in particular) from detecting it. This
+# option should remove the prefix and give us a working jemalloc.
+# Causes segfaults with some software (ex. rustc), but defaults to true for backward
+# compatibility. Ignored on non OSX.
+stripPrefix ? true }:
 
-stdenv.mkDerivation (rec {
+stdenv.mkDerivation rec {
   name = "jemalloc-${version}";
   inherit version;
 
@@ -9,10 +16,8 @@ stdenv.mkDerivation (rec {
     inherit sha256;
   };
 
-  # By default, jemalloc puts a je_ prefix onto all its symbols on OSX, which
-  # then stops downstream builds (mariadb in particular) from detecting it. This
-  # option should remove the prefix and give us a working jemalloc.
-  configureFlags = stdenv.lib.optional stdenv.isDarwin "--with-jemalloc-prefix=";
+  # see the comment on stripPrefix
+  configureFlags = stdenv.lib.optional (stdenv.isDarwin && stripPrefix) "--with-jemalloc-prefix=";
   doCheck = true;
 
   enableParallelBuilding = true;
@@ -28,4 +33,4 @@ stdenv.mkDerivation (rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ wkennington ];
   };
-} // (builtins.removeAttrs args [ "stdenv" "fetchurl" "version" "sha256" ]))
+}
diff --git a/pkgs/development/libraries/jemalloc/default.nix b/pkgs/development/libraries/jemalloc/default.nix
index 8cb7c1f96733..7ea7bccd6b87 100644
--- a/pkgs/development/libraries/jemalloc/default.nix
+++ b/pkgs/development/libraries/jemalloc/default.nix
@@ -1,6 +1,4 @@
-{ stdenv, fetchurl, fetchpatch }:
 import ./common.nix {
-  inherit stdenv fetchurl;
   version = "5.1.0";
   sha256 = "0s3jpcyhzia8d4k0xyc67is78kg416p9yc3c2f9w6fhhqqffd5jk";
 }
diff --git a/pkgs/development/libraries/jemalloc/jemalloc450.nix b/pkgs/development/libraries/jemalloc/jemalloc450.nix
index 00b38a855532..d328ab8016a1 100644
--- a/pkgs/development/libraries/jemalloc/jemalloc450.nix
+++ b/pkgs/development/libraries/jemalloc/jemalloc450.nix
@@ -1,6 +1,4 @@
-{ stdenv, fetchurl }:
 import ./common.nix {
-  inherit stdenv fetchurl;
   version = "4.5.0";
   sha256 = "10373xhpc10pgmai9fkc1z0rs029qlcb3c0qfnvkbwdlcibdh2cl";
-}
+} 
diff --git a/pkgs/development/libraries/libarchive/CVE-2017-14166.patch b/pkgs/development/libraries/libarchive/CVE-2017-14166.patch
deleted file mode 100644
index b729ae41e0ad..000000000000
--- a/pkgs/development/libraries/libarchive/CVE-2017-14166.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From fa7438a0ff4033e4741c807394a9af6207940d71 Mon Sep 17 00:00:00 2001
-From: Joerg Sonnenberger <joerg@bec.de>
-Date: Tue, 5 Sep 2017 18:12:19 +0200
-Subject: [PATCH] Do something sensible for empty strings to make fuzzers
- happy.
-
----
- libarchive/archive_read_support_format_xar.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/libarchive/archive_read_support_format_xar.c b/libarchive/archive_read_support_format_xar.c
-index 7a22beb9d..93eeacc5e 100644
---- a/libarchive/archive_read_support_format_xar.c
-+++ b/libarchive/archive_read_support_format_xar.c
-@@ -1040,6 +1040,9 @@ atol10(const char *p, size_t char_cnt)
- 	uint64_t l;
- 	int digit;
- 
-+	if (char_cnt == 0)
-+		return (0);
-+
- 	l = 0;
- 	digit = *p - '0';
- 	while (digit >= 0 && digit < 10  && char_cnt-- > 0) {
-@@ -1054,7 +1057,10 @@ atol8(const char *p, size_t char_cnt)
- {
- 	int64_t l;
- 	int digit;
--        
-+
-+	if (char_cnt == 0)
-+		return (0);
-+
- 	l = 0;
- 	while (char_cnt-- > 0) {
- 		if (*p >= '0' && *p <= '7')
diff --git a/pkgs/development/libraries/libarchive/CVE-2017-14502.patch b/pkgs/development/libraries/libarchive/CVE-2017-14502.patch
deleted file mode 100644
index dad8a93a8a81..000000000000
--- a/pkgs/development/libraries/libarchive/CVE-2017-14502.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 5562545b5562f6d12a4ef991fae158bf4ccf92b6 Mon Sep 17 00:00:00 2001
-From: Joerg Sonnenberger <joerg@bec.de>
-Date: Sat, 9 Sep 2017 17:47:32 +0200
-Subject: [PATCH] Avoid a read off-by-one error for UTF16 names in RAR
- archives.
-
-Reported-By: OSS-Fuzz issue 573
----
- libarchive/archive_read_support_format_rar.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
-index cbb14c32d..751de6979 100644
---- a/libarchive/archive_read_support_format_rar.c
-+++ b/libarchive/archive_read_support_format_rar.c
-@@ -1496,7 +1496,11 @@ read_header(struct archive_read *a, struct archive_entry *entry,
-         return (ARCHIVE_FATAL);
-       }
-       filename[filename_size++] = '\0';
--      filename[filename_size++] = '\0';
-+      /*
-+       * Do not increment filename_size here as the computations below
-+       * add the space for the terminating NUL explicitly.
-+       */
-+      filename[filename_size] = '\0';
- 
-       /* Decoded unicode form is UTF-16BE, so we have to update a string
-        * conversion object for it. */
diff --git a/pkgs/development/libraries/libarchive/default.nix b/pkgs/development/libraries/libarchive/default.nix
index 7625abf38fb3..029be971ac17 100644
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -10,24 +10,13 @@ assert xarSupport -> libxml2 != null;
 
 stdenv.mkDerivation rec {
   name = "libarchive-${version}";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchurl {
     url = "${meta.homepage}/downloads/${name}.tar.gz";
-    sha256 = "1km0mzfl6in7l5vz9kl09a88ajx562rw93ng9h2jqavrailvsbgd";
+    sha256 = "0bhfncid058p7n1n8v29l6wxm3mhdqfassscihbsxfwz3iwb2zms";
   };
 
-  patches = [
-    ./CVE-2017-14166.patch
-    ./CVE-2017-14502.patch
-
-    # LibreSSL patch; this is from upstream, and can be removed when the next release is made.
-    (fetchpatch {
-      url = "https://github.com/libarchive/libarchive/commit/5da00ad75b09e262774ec3675bbe4d5a4502a852.patch";
-      sha256 = "0np1i9r6mfxmbksj7mmf5abpnmlmg63704p9z3ihjh2rnq596c1v";
-    })
-  ];
-
   outputs = [ "out" "lib" "dev" ];
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index 6912817419f6..173dc1f722b4 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -27,12 +27,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional stdenv.isDarwin gettext
     ++ stdenv.lib.optional enableCapabilities libcap;
 
-  preConfigure = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-    # This is intentional: gpg-error-config is a shell script that will work during the build
-    mkdir -p "$NIX_BUILD_TOP"/bin
-    ln -s ${libgpgerror.dev}/bin/gpg-error-config "$NIX_BUILD_TOP/bin"
-    export PATH="$NIX_BUILD_TOP/bin:$PATH"
-  '';
+  configureFlags = [ "--with-libgpg-error-prefix=${libgpgerror.dev}" ];
 
   # Make sure libraries are correct for .pc and .la files
   # Also make sure includes are fixed for callers who don't use libgpgcrypt-config
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 87c6bb03d4bb..1a903978fb8d 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -16,11 +16,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "libinput-${version}";
-  version = "1.12.2";
+  version = "1.12.3";
 
   src = fetchurl {
     url = "https://www.freedesktop.org/software/libinput/${name}.tar.xz";
-    sha256 = "1w8wkh03j5zdgbamyj7wv2f6k76kd0w4z04abxxf5b0mnplrb6vb";
+    sha256 = "0mg2zqbjcgj0aq7d9nwawvyhx43vakilahrc83hrfyif3a3gyrpj";
   };
 
   outputs = [ "bin" "out" "dev" ];
@@ -29,13 +29,10 @@ stdenv.mkDerivation rec {
     (mkFlag documentationSupport "documentation")
     (mkFlag eventGUISupport "debug-gui")
     (mkFlag testsSupport "tests")
+    "--libexecdir=${placeholder "bin"}/libexec"
   ];
 
-  preConfigure = ''
-    mesonFlags="$mesonFlags --libexecdir=$bin/libexec"
-  '';
-
-  nativeBuildInputs = [ pkgconfig meson ninja ]
+  nativeBuildInputs = [ pkgconfig meson ninja python3Packages.python ]
     ++ optionals documentationSupport [ doxygen graphviz ]
     ++ optionals testsSupport [ check valgrind python3Packages.pyparsing ];
 
diff --git a/pkgs/development/libraries/libksba/default.nix b/pkgs/development/libraries/libksba/default.nix
index 0611e0e57e7b..d48d89235d8d 100644
--- a/pkgs/development/libraries/libksba/default.nix
+++ b/pkgs/development/libraries/libksba/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gettext, libgpgerror }:
+{ buildPackages, stdenv, fetchurl, gettext, libgpgerror }:
 
 stdenv.mkDerivation rec {
   name = "libksba-1.3.5";
@@ -12,6 +12,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gettext ];
   propagatedBuildInputs = [ libgpgerror ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  configureFlags = [ "--with-libgpg-error-prefix=${libgpgerror.dev}" ];
 
   postInstall = ''
     mkdir -p $dev/bin
diff --git a/pkgs/development/libraries/libmicrohttpd/default.nix b/pkgs/development/libraries/libmicrohttpd/default.nix
index 041e0d98d654..4462fca7b64e 100644
--- a/pkgs/development/libraries/libmicrohttpd/default.nix
+++ b/pkgs/development/libraries/libmicrohttpd/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libmicrohttpd-${version}";
-  version = "0.9.59";
+  version = "0.9.60";
 
   src = fetchurl {
     url = "mirror://gnu/libmicrohttpd/${name}.tar.gz";
-    sha256 = "0g4jgnv43yddr9yxrqg11632rip0lg5c53gmy5wy3c0i1dywv74v";
+    sha256 = "0wf457bqbdvx53clk4dg2620p83vk4757l7lrpvmxrd9jlzms3nd";
   };
 
   outputs = [ "out" "dev" "devdoc" "info" ];
diff --git a/pkgs/development/libraries/libopus/default.nix b/pkgs/development/libraries/libopus/default.nix
index 135f1caf97e2..30fa7d749a12 100644
--- a/pkgs/development/libraries/libopus/default.nix
+++ b/pkgs/development/libraries/libopus/default.nix
@@ -2,14 +2,14 @@
 , fixedPoint ? false, withCustomModes ? true }:
 
 let
-  version = "1.2.1";
+  version = "1.3";
 in
 stdenv.mkDerivation rec {
   name = "libopus-${version}";
 
   src = fetchurl {
     url = "https://archive.mozilla.org/pub/opus/opus-${version}.tar.gz";
-    sha256 = "0ch7yzgg4bn1g36bpjsfrgs4n19c84d7wpdida6yzifrrhwx7byg";
+    sha256 = "0l651n19h0vhc0sn6w2c95hgqks1i8m4b3j04ncaznzjznp6jgag";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
index 0e5a4a866e8f..9c1ed80e51ed 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@@ -3,20 +3,20 @@
 assert zlib != null;
 
 let
-  patchVersion = "1.6.34";
+  patchVersion = "1.6.35";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    sha256 = "1ha4npf9mfrzp0srg8a5amks5ww84xzfpjbsj8k3yjjpai798qg6";
+    sha256 = "011fq5wgyz07pfrqs9albixbiksx3agx5nkcf3535gbvhlwv5khq";
   };
   whenPatched = stdenv.lib.optionalString apngSupport;
 
 in stdenv.mkDerivation rec {
   name = "libpng" + whenPatched "-apng" + "-${version}";
-  version = "1.6.34";
+  version = "1.6.35";
 
   src = fetchurl {
     url = "mirror://sourceforge/libpng/libpng-${version}.tar.xz";
-    sha256 = "1xjr0v34fyjgnhvaa1zixcpx5yvxcg4zwvfh0fyklfyfj86rc7ig";
+    sha256 = "1mxwjf5cdzk7g0y51gl9w3f0j5ypcls05i89kgnifjaqr742x493";
   };
   postPatch = whenPatched "gunzip < ${patch_src} | patch -Np1";
 
diff --git a/pkgs/development/libraries/libsignal-protocol-c/default.nix b/pkgs/development/libraries/libsignal-protocol-c/default.nix
index 379361a7031e..f3549d52f69e 100644
--- a/pkgs/development/libraries/libsignal-protocol-c/default.nix
+++ b/pkgs/development/libraries/libsignal-protocol-c/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, cmake, openssl }:
 
 stdenv.mkDerivation rec {
-  name = "libsignal-protocol-c";
+  pname = "libsignal-protocol-c";
   version = "2.3.2";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/libraries/libsignon-glib/default.nix b/pkgs/development/libraries/libsignon-glib/default.nix
index 2c0ef60bc635..db2b468bb3a2 100644
--- a/pkgs/development/libraries/libsignon-glib/default.nix
+++ b/pkgs/development/libraries/libsignon-glib/default.nix
@@ -2,15 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libsignon-glib";
-  version = "3639a2e90447e4640a03a44972560afe8f61aa48";
-
-  name = "${pname}-2018-10-24";
+  version = "unstable-2018-10-24";
 
   outputs = [ "out" "dev" "devdoc" "py" ];
 
   src = fetchgit {
     url = "https://gitlab.com/accounts-sso/${pname}";
-    rev = version;
+    rev = "3639a2e90447e4640a03a44972560afe8f61aa48";
     fetchSubmodules = true;
     sha256 = "1cq19zbsx4c57dc5gp3shp8lzcr1hw2ynylpn1nkvfyyrx80m60w";
   };
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index bf0393fd89a6..55c747540f77 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -1,28 +1,22 @@
-{ stdenv, fetchurl, pkgconfig, zlib, libjpeg, xz }:
+{ stdenv
+, fetchurl
+
+, pkgconfig
+
+, zlib
+, libjpeg
+, xz
+}:
 
-let
-  version = "4.0.9";
-in
 stdenv.mkDerivation rec {
+  version = "4.0.10";
   name = "libtiff-${version}";
 
   src = fetchurl {
     url = "https://download.osgeo.org/libtiff/tiff-${version}.tar.gz";
-    sha256 = "1kfg4q01r4mqn7dj63ifhi6pmqzbf4xax6ni6kkk81ri5kndwyvf";
+    sha256 = "1r4np635gr6zlc0bic38dzvxia6iqzcrary4n1ylarzpr8fd2lic";
   };
 
-  prePatch = let
-      debian = fetchurl {
-        # When the URL disappears, it typically means that Debian has new patches
-        # (probably security) and updating to new tarball will apply them as well.
-        url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.9-6.debian.tar.xz;
-        sha256 = "10yk5npchxscgsnd7ihd3bbbw2fxkl7ni0plm43c9q4nwp6ms52f";
-      };
-    in ''
-      tar xf ${debian}
-      patches="$patches $(sed 's|^|debian/patches/|' < debian/patches/series)"
-    '';
-
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 68c35c49ef37..4fed33a4d357 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchpatch, fetchFromGitHub, autoconf, automake, libtool, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  version = "1.23.1";
+  version = "1.23.2";
   name = "libuv-${version}";
 
   src = fetchFromGitHub {
     owner = "libuv";
     repo = "libuv";
     rev = "v${version}";
-    sha256 = "14h8dcyx81sbckbgmqhagncyz8s6z6qzpx0fy8p79whq5hb3f4jg";
+    sha256 = "1xfggj0mbbshj7zyccnfw7wyk42qfg4ng3l4aslw014mg8gaskv7";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/libva-utils/default.nix b/pkgs/development/libraries/libva-utils/default.nix
index 6868e5c8cfa9..a31968a5373c 100644
--- a/pkgs/development/libraries/libva-utils/default.nix
+++ b/pkgs/development/libraries/libva-utils/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner  = "01org";
     repo   = "libva-utils";
     rev    = version;
-    sha256 = "113wdmi4r0qligizj9zmd4a8ml1996x9g2zp2i4pmhb8frv9m8j2";
+    sha256 = "0k5v72prcq462x780j9vpqf4ckrpqf536z6say81wpna0l0qbd98";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index 0ba49da06cfe..435b7e3c915d 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -6,14 +6,14 @@
 
 stdenv.mkDerivation rec {
   name = "libva-${lib.optionalString minimal "minimal-"}${version}";
-  version = "2.1.0";
+  version = "2.3.0";
 
   # update libva-utils and vaapiIntel as well
   src = fetchFromGitHub {
     owner  = "01org";
     repo   = "libva";
     rev    = version;
-    sha256 = "1a60lrgr65hx9b2qp0gjky1298c4d4zp3ap6vnmmz850sxx5rm8w";
+    sha256 = "0zip22b5qwyjygsmrmjq62hdpl9z77d84h5hni8cn6xz5cmbw29z";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/libxl/default.nix b/pkgs/development/libraries/libxl/default.nix
index 035bfa8d6dc3..471789d3e0f6 100644
--- a/pkgs/development/libraries/libxl/default.nix
+++ b/pkgs/development/libraries/libxl/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "libxl";
+  pname = "libxl";
   version = "3.8.1";
 
   src = fetchurl {
-    url = "http://www.libxl.com/download/${name}-lin-${version}.tar.gz";
+    url = "http://www.libxl.com/download/${pname}-lin-${version}.tar.gz";
     sha256 = "1zdbahhyhr70s8hygwp43j9z4zmglyrr782hkcm1078yvkr2f2fm";
   };
 
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 7b5c0b3144b3..a6b935fb826e 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -67,7 +67,7 @@ let
 in
 
 let
-  version = "18.2.4";
+  version = "18.2.5";
   branch  = head (splitString "." version);
 in
 
@@ -81,7 +81,7 @@ let self = stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://mesa.freedesktop.org/archive/mesa-${version}.tar.xz"
     ];
-    sha256 = "0knbr6nl7qk5bijz6p7yqr8fc806gvmz9p6jlnvdaxkqnpmil7b2";
+    sha256 = "0wrbdk988mh42bbpicf5knx5pdqs3xp05s71alqkbr9j523k4b5i";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 6293efcca8b2..77de18de2b02 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -12,17 +12,18 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "6.1";
+  version = "6.1-20181027";
   name = "ncurses-${version}" + lib.optionalString (abiVersion == "5") "-abi5-compat";
 
   src = fetchurl {
-    url = "mirror://gnu/ncurses/ncurses-${version}.tar.gz";
-    sha256 = "05qdmbmrrn88ii9f66rkcmcyzp1kb1ymkx7g040lfkd1nkp7w1da";
+    urls = [
+      "https://invisible-mirror.net/archives/ncurses/current/ncurses-${version}.tgz"
+      "ftp://ftp.invisible-island.net/ncurses/current/ncurses-${version}.tgz"
+    ];
+    sha256 = "1xn6wpi22jc61158w4ifq6s1fvilhmsy1in2srn3plk8pm0d4902";
   };
 
-  # The patch st-0.7.patch needs to be removed, if ncurses is upgraded in the future.
-  # It is necessary for the 6.1 version of ncurses.
-  patches = [ ./st-0.7.patch ] ++ lib.optional (!stdenv.cc.isClang) ./clang.patch;
+  patches = lib.optional (!stdenv.cc.isClang) ./clang.patch;
 
   outputs = [ "out" "dev" "man" ];
   setOutputFlags = false; # some aren't supported
@@ -32,6 +33,7 @@ stdenv.mkDerivation rec {
     "--without-debug"
     "--enable-pc-files"
     "--enable-symlinks"
+    "--with-manpage-format=normal"
   ] ++ lib.optional unicode "--enable-widec"
     ++ lib.optional (!withCxx) "--without-cxx"
     ++ lib.optional (abiVersion == "5") "--with-abi-version=5"
diff --git a/pkgs/development/libraries/ncurses/st-0.7.patch b/pkgs/development/libraries/ncurses/st-0.7.patch
deleted file mode 100644
index 956f9b68d68f..000000000000
--- a/pkgs/development/libraries/ncurses/st-0.7.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/misc/terminfo.src b/misc/terminfo.src
-index 84f4810..ac300a7 100644
---- a/misc/terminfo.src
-+++ b/misc/terminfo.src
-@@ -6260,7 +6260,7 @@ st-0.7|simpleterm 0.7,
- 	     %=%t3%e%p1%d%;m,
- 	sgr=%?%p9%t\E(0%e\E(B%;\E[0%?%p6%t;1%;%?%p2%t;4%;%?%p1%p3%|
- 	    %t;7%;%?%p4%t;5%;%?%p5%t;2%;%?%p7%t;8%;m,
--	Ss=\E]52;%p1%s;%p2%s\007, kDN3=\E[1;3B, kDN5=\E[1;5B,
-+	Ms=\E]52;%p1%s;%p2%s\007, kDN3=\E[1;3B, kDN5=\E[1;5B,
- 	kLFT3=\E[1;3D, kLFT5=\E[1;5D, kNXT3=\E[6;3~,
- 	kNXT5=\E[6;5~, kPRV3=\E[5;3~, kPRV5=\E[5;5~,
- 	kRIT3=\E[1;3C, kRIT5=\E[1;5C, kUP3=\E[1;3A, kUP5=\E[1;5A,
diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 8a3de28b7842..e559b9a076ac 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -8,11 +8,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "nss-${version}";
-  version = "3.39";
+  version = "3.40";
 
   src = fetchurl {
-    url = "mirror://mozilla/security/nss/releases/NSS_3_39_RTM/src/${name}.tar.gz";
-    sha256 = "0jw6qlfl2g47hhx056nvnj6h92bk3sn46hy3ig61a911dzblvrkb";
+    url = "mirror://mozilla/security/nss/releases/NSS_3_40_RTM/src/${name}.tar.gz";
+    sha256 = "1p9jidi3nysirf3lhkrqkjjrf2cw3y2wz2jgjvsjn1ysidxhhqh5";
   };
 
   buildInputs = [ perl zlib sqlite ]
diff --git a/pkgs/development/libraries/sqlite/analyzer.nix b/pkgs/development/libraries/sqlite/analyzer.nix
index 5b68b4901f9a..f3d69f094447 100644
--- a/pkgs/development/libraries/sqlite/analyzer.nix
+++ b/pkgs/development/libraries/sqlite/analyzer.nix
@@ -6,11 +6,11 @@ in
 
 stdenv.mkDerivation rec {
   name = "sqlite-analyzer-${version}";
-  version = "3.24.0";
+  version = "3.25.3";
 
   src = assert version == sqlite.version; fetchurl {
     url = "https://sqlite.org/2018/sqlite-src-${archiveVersion version}.zip";
-    sha256 = "19ck2sg13i6ga5vapxak42jn6050vpfid0zrmah7jh32mksh58vj";
+    sha256 = "08b4fs9mrah5gxl1865smlqs2ba6g7k7d6pfa084i6d78342p4n7";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 92574091558a..c98164ae63b8 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -10,12 +10,12 @@ in
 
 stdenv.mkDerivation rec {
   name = "sqlite-${version}";
-  version = "3.24.0";
+  version = "3.25.3";
 
   # NB! Make sure to update analyzer.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2018/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "0jmprv2vpggzhy7ma4ynmv1jzn3pfiwzkld0kkg6hvgvqs44xlfr";
+    sha256 = "1pgkja0d13qp5p79ik9kh9lm5y79cwyxwwfc80cr8a1rw5xzksq0";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/vaapi-intel/default.nix b/pkgs/development/libraries/vaapi-intel/default.nix
index ba763e334905..70ee61aecd3b 100644
--- a/pkgs/development/libraries/vaapi-intel/default.nix
+++ b/pkgs/development/libraries/vaapi-intel/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "intel-vaapi-driver-${version}";
-  inherit (libva) version;
+  version = "2.2.0"; # generally try to match libva version, but not required
 
   src = fetchFromGitHub {
     owner  = "intel";
     repo   = "intel-vaapi-driver";
     rev    = version;
-    sha256 = "15ag4al9h6b8f8sw1zpighyhsmr5qfqp1882q7r3gsh5g4cnj763";
+    sha256 = "1z8iqnswias2gph61yzyal53456y71ff98f21cs17hw4qjfkwa6k";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/libraries/x265/default.nix b/pkgs/development/libraries/x265/default.nix
index d11a93254bfb..4212687a02ac 100644
--- a/pkgs/development/libraries/x265/default.nix
+++ b/pkgs/development/libraries/x265/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, yasm
+{ stdenv, fetchurl, fetchpatch, cmake, yasm
 , debugSupport ? false # Run-time sanity checks (debugging)
 , highbitdepthSupport ? false # false=8bits per channel, true=10/12bits per channel
 , werrorSupport ? false # Warnings as errors
@@ -16,19 +16,28 @@ in
 
 stdenv.mkDerivation rec {
   name = "x265-${version}";
-  version = "2.7";
+  version = "2.9";
 
   src = fetchurl {
     urls = [
-      "http://get.videolan.org/x265/x265_${version}.tar.gz"
-      "https://github.com/videolan/x265/archive/${version}.tar.gz"
+      "https://get.videolan.org/x265/x265_${version}.tar.gz"
+      "ftp://ftp.videolan.org/pub/videolan/x265/x265_${version}.tar.gz"
     ];
-    sha256 = "18llni1m8kfvdwy5bp950z6gyd0nijmvi3hzd6gd8vpy5yk5zrym";
+    sha256 = "090hp4216isis8q5gb7bwzia8rfyzni54z21jnwm97x3hiy6ibpb";
   };
 
   enableParallelBuilding = true;
 
-  patchPhase = ''
+  patches = [
+    # Fix issue #442 (linking issue on non-x86 platforms)
+    # Applies on v2.9 only, this should be removed at next update
+    (fetchpatch {
+      url = "https://bitbucket.org/multicoreware/x265/commits/471726d3a0462739ff8e3518eb1a1e8a01de4e8d/raw";
+      sha256 = "0mj8lb8ng8lrhzjavap06vjhqf6j0r3sn76c6rhs3012f86lv928";
+    })
+  ];
+
+  postPatch = ''
     sed -i 's/unknown/${version}/g' source/cmake/version.cmake
   '';
 
diff --git a/pkgs/development/libraries/yojimbo/default.nix b/pkgs/development/libraries/yojimbo/default.nix
index 557c46470a8d..6305b6c03a46 100644
--- a/pkgs/development/libraries/yojimbo/default.nix
+++ b/pkgs/development/libraries/yojimbo/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, premake5, doxygen, libsodium, mbedtls }:
 
 stdenv.mkDerivation rec {
-  name = "yojimbo";
+  pname = "yojimbo";
   version = "1.1";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/metaphone/default.nix b/pkgs/development/python-modules/metaphone/default.nix
index b72789369f26..e167ee494a82 100644
--- a/pkgs/development/python-modules/metaphone/default.nix
+++ b/pkgs/development/python-modules/metaphone/default.nix
@@ -1,12 +1,12 @@
 { stdenv, buildPythonPackage, isPy3k, fetchPypi, nose }:
 
 buildPythonPackage rec {
-  pname = "Metaphone";
+  pname = "metaphone";
   version = "0.6";
-  name  = "metaphone-${version}";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "Metaphone";
+    inherit version;
     sha256 = "09ysaczwh2rlsqq9j5fz7m4pq2fs0axp5vvivrpfrdvclvffl2xd";
   };
 
diff --git a/pkgs/development/python-modules/py3exiv2/default.nix b/pkgs/development/python-modules/py3exiv2/default.nix
index 4c6ca0bad338..647fbdd872ce 100644
--- a/pkgs/development/python-modules/py3exiv2/default.nix
+++ b/pkgs/development/python-modules/py3exiv2/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   patches = [
     (substituteAll {
       src = ./setup.patch;
-      version = "3${stdenv.lib.versions.minor python.version}";
+      version_ = "3${stdenv.lib.versions.minor python.version}";
     })
   ];
 
diff --git a/pkgs/development/python-modules/py3exiv2/setup.patch b/pkgs/development/python-modules/py3exiv2/setup.patch
index 8b0619c5bc5f..784533105d6b 100644
--- a/pkgs/development/python-modules/py3exiv2/setup.patch
+++ b/pkgs/development/python-modules/py3exiv2/setup.patch
@@ -3,9 +3,9 @@
 @@ -39,7 +39,7 @@
                  if '3' in l[2:]:
                      return l.replace('libboost', 'boost')
- 
+
 -libboost = get_libboost_name()
-+libboost = 'boost_python@version@'
- 
++libboost = 'boost_python@version_@'
+
  setup(
      name='py3exiv2',
diff --git a/pkgs/development/python-modules/pyinputevent/default.nix b/pkgs/development/python-modules/pyinputevent/default.nix
index 4709cf0d1167..6eeeeb20c005 100644
--- a/pkgs/development/python-modules/pyinputevent/default.nix
+++ b/pkgs/development/python-modules/pyinputevent/default.nix
@@ -4,7 +4,7 @@
 }:
 
 buildPythonPackage rec {
-  name = "pyinputevent";
+  pname = "pyinputevent";
   version = "2016-10-18";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/pymaging/default.nix b/pkgs/development/python-modules/pymaging/default.nix
index 34620c55c80f..234aee8436dc 100644
--- a/pkgs/development/python-modules/pymaging/default.nix
+++ b/pkgs/development/python-modules/pymaging/default.nix
@@ -4,7 +4,7 @@
 }:
 
 buildPythonPackage rec {
-  name = "pymaging";
+  pname = "pymaging";
   version = "unstable-2016-11-16";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/pymaging_png/default.nix b/pkgs/development/python-modules/pymaging_png/default.nix
index 6756f9deee38..fb92739776da 100644
--- a/pkgs/development/python-modules/pymaging_png/default.nix
+++ b/pkgs/development/python-modules/pymaging_png/default.nix
@@ -5,7 +5,7 @@
 }:
 
 buildPythonPackage rec {
-  name = "pymaging-png";
+  pname = "pymaging-png";
   version = "unstable-2016-11-16";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/qutip/default.nix b/pkgs/development/python-modules/qutip/default.nix
index 4a8460ddfdbe..13c24312ed0f 100644
--- a/pkgs/development/python-modules/qutip/default.nix
+++ b/pkgs/development/python-modules/qutip/default.nix
@@ -11,11 +11,11 @@
 }:
 
 buildPythonPackage rec {
-  name = "qutip";
+  pname = "qutip";
   version = "2.2.0";
 
   src = fetchurl {
-    url = "https://qutip.googlecode.com/files/QuTiP-2.2.0.tar.gz";
+    url = "https://qutip.googlecode.com/files/QuTiP-${version}.tar.gz";
     sha256 = "a26a639d74b2754b3a1e329d91300e587e8c399d8a81d8f18a4a74c6d6f02ba3";
   };
 
diff --git a/pkgs/development/python-modules/rbtools/default.nix b/pkgs/development/python-modules/rbtools/default.nix
index 127188ac3fbd..3be8bb99bbe4 100644
--- a/pkgs/development/python-modules/rbtools/default.nix
+++ b/pkgs/development/python-modules/rbtools/default.nix
@@ -7,7 +7,7 @@
 }:
 
 buildPythonPackage rec {
-  name = "rbtools";
+  pname = "rbtools";
   version = "0.7.2";
   disabled = isPy3k;
 
diff --git a/pkgs/development/python-modules/repocheck/default.nix b/pkgs/development/python-modules/repocheck/default.nix
index 17dea17105ee..88437ae90327 100644
--- a/pkgs/development/python-modules/repocheck/default.nix
+++ b/pkgs/development/python-modules/repocheck/default.nix
@@ -4,7 +4,7 @@
 }:
 
 buildPythonPackage rec {
-  name = "repocheck";
+  pname = "repocheck";
   version = "2015-08-05";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index 99d4b56b2b19..9894c4319c5c 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -11,8 +11,6 @@ buildPythonPackage rec {
     sha256 = "ec22d826a36ed72a7358ff3fe56cbd4ba69dd7a6718ffd450ff0e9df7a47ce6a";
   };
 
-  outputs = [ "out" "dev" ];
-
   nativeBuildInputs = [ pytest ];
   propagatedBuildInputs = [ urllib3 idna chardet certifi ];
   # sadly, tests require networking
diff --git a/pkgs/development/python-modules/snappergui/default.nix b/pkgs/development/python-modules/snappergui/default.nix
index 43e942a95880..db1a75ab7f27 100644
--- a/pkgs/development/python-modules/snappergui/default.nix
+++ b/pkgs/development/python-modules/snappergui/default.nix
@@ -6,7 +6,7 @@
 }:
 
 buildPythonPackage rec {
-  name = "Snapper-GUI";
+  pname = "Snapper-GUI";
   version = "0.1";
 
   src = fetchgit {
diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index e4e9bfaba1cf..831c527af0e6 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -25,10 +25,11 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Sphinx";
+  pname = "sphinx";
   version = "1.7.9";
   src = fetchPypi {
-    inherit pname version;
+    pname = "Sphinx";
+    inherit version;
     sha256 = "217a7705adcb573da5bbe1e0f5cab4fa0bd89fd9342c9159121746f593c2d5a4";
   };
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index e1c576f94276..c0cca3562f77 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchPypi
+, fetchpatch
 , buildPythonPackage
 , pytest
 , mock
@@ -9,13 +10,23 @@
 
 buildPythonPackage rec {
   pname = "SQLAlchemy";
-  version = "1.2.12";
+  version = "1.2.13";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c5951d9ef1d5404ed04bae5a16b60a0779087378928f997a294d1229c6ca4d3e";
+    sha256 = "84412de3794acee05630e7788f25e80e81f78eb4837e7b71d0499129f660486a";
   };
 
+  patches = [
+    # fix for failing doc tests
+    # https://bitbucket.org/zzzeek/sqlalchemy/issues/4370/sqlite-325x-docs-tutorialrst-doctests-fail
+    (fetchpatch {
+      name = "doc-test-fixes.patch";
+      url = https://bitbucket.org/zzzeek/sqlalchemy/commits/63279a69e2b9277df5e97ace161fa3a1bb4f29cd/raw;
+      sha256 = "1x25aj5hqmgjdak4hllya0rf0srr937k1hwaxb24i9ban607hjri";
+    })
+  ];
+
   checkInputs = [
     pytest
     mock
@@ -32,4 +43,4 @@ buildPythonPackage rec {
     description = "A Python SQL toolkit and Object Relational Mapper";
     license = licenses.mit;
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/python-modules/svg2tikz/default.nix b/pkgs/development/python-modules/svg2tikz/default.nix
index c3308bf229c0..36f6dc06850f 100644
--- a/pkgs/development/python-modules/svg2tikz/default.nix
+++ b/pkgs/development/python-modules/svg2tikz/default.nix
@@ -6,7 +6,7 @@
 }:
 
 buildPythonPackage {
-  name = "svg2tikz";
+  pname = "svg2tikz";
   version = "1.0.0";
   disabled = ! isPy27;
 
diff --git a/pkgs/development/python-modules/urwidtrees/default.nix b/pkgs/development/python-modules/urwidtrees/default.nix
index ac9cf73cab17..da5501f50ba4 100644
--- a/pkgs/development/python-modules/urwidtrees/default.nix
+++ b/pkgs/development/python-modules/urwidtrees/default.nix
@@ -5,7 +5,7 @@
 }:
 
 buildPythonPackage rec {
-  name = "urwidtrees";
+  pname = "urwidtrees";
   version  = "1.0";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/python-modules/waitress-django/default.nix b/pkgs/development/python-modules/waitress-django/default.nix
index 421995e3792a..c230cd9cfa6e 100644
--- a/pkgs/development/python-modules/waitress-django/default.nix
+++ b/pkgs/development/python-modules/waitress-django/default.nix
@@ -3,7 +3,6 @@
 buildPythonPackage rec {
   pname = "waitress-django";
   version = "0.0.0";
-  name = pname;
 
   src = ./.;
   pythonPath = [ django_1_8 waitress ];
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index c199e6f087b1..c429eaec035b 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -29,7 +29,7 @@ let
   v8 = v8_3_16_14;
 
   rainbow_rake = buildRubyGem {
-    name = "rake";
+    pname = "rake";
     gemName = "rake";
     source.sha256 = "01j8fc9bqjnrsxbppncai05h43315vmz9fwg28qdsgcjw9ck1d7n";
     type = "gem";
diff --git a/pkgs/development/tools/analysis/retdec/default.nix b/pkgs/development/tools/analysis/retdec/default.nix
index 428ca259f496..3e64e91d1300 100644
--- a/pkgs/development/tools/analysis/retdec/default.nix
+++ b/pkgs/development/tools/analysis/retdec/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, fetchpatch
 , fetchzip
 , lib
 , callPackage
@@ -70,8 +71,8 @@ let
   yaramod = fetchFromGitHub {
     owner = "avast-tl";
     repo = "yaramod";
-    rev = "v2.1.2";
-    sha256 = "1rpyqzkrqvk721hf75wb7aasw5mzp9wz4j89p0x1l9p5x1b3maz3";
+    rev = "v2.2.2";
+    sha256 = "0cq9h4h686q9ybamisbl797g6xjy211s3cq83nixkwkigmz48ccp";
   };
   jsoncpp = fetchFromGitHub {
     owner = "open-source-parsers";
@@ -181,6 +182,20 @@ in stdenv.mkDerivation rec {
     (yaramod // { dep_name = "yaramod"; })
   ];
 
+  # Use newer yaramod to fix w/bison 3.2+
+  patches = [
+    # 2.1.2 -> 2.2.1
+    (fetchpatch {
+      url = https://github.com/avast-tl/retdec/commit/c9d23da1c6e23c149ed684c6becd3f3828fb4a55.patch;
+      sha256 = "0hdq634f72fihdy10nx2ajbps561w03dfdsy5r35afv9fapla6mv";
+    })
+    # 2.2.1 -> 2.2.2
+    (fetchpatch {
+      url = https://github.com/avast-tl/retdec/commit/fb85f00754b5d13b781385651db557741679721e.patch;
+      sha256 = "0a8mwmwb39pr5ag3q11nv81ncdk51shndqrkm92shqrmdq14va52";
+    })
+  ];
+
   postPatch = (lib.concatMapStrings patchDep external_deps) + ''
     # install retdec-support
     echo "Checking version of retdec-support"
diff --git a/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch b/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch
new file mode 100644
index 000000000000..cd09f0edff37
--- /dev/null
+++ b/pkgs/development/tools/analysis/valgrind/coregrind-makefile-race.patch
@@ -0,0 +1,41 @@
+From 7820fc268fae4353118b6355f1d4b9e1b7eeebec Mon Sep 17 00:00:00 2001
+From: Philippe Waroquiers <philippe.waroquiers@skynet.be>
+Date: Sun, 28 Oct 2018 18:35:11 +0100
+Subject: [PATCH 1/1] Fix dependencies between libcoregrind*.a and
+ *m_main.o/*m_libcsetjmp.o
+
+The primary and secondary coregrind libraries must be updated
+when m_main.c or m_libcsetjmp.c are changed.
+
+A dependency was missing between libcoregrind*.a and libnolto_coregrind*.a,
+and so tools were not relinked when m_main.c or m_libcsetjmp.c were
+changed.
+---
+ coregrind/Makefile.am | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/coregrind/Makefile.am b/coregrind/Makefile.am
+index 914a270..8de1996 100644
+--- a/coregrind/Makefile.am
++++ b/coregrind/Makefile.am
+@@ -511,6 +511,8 @@ libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_CFLAGS += \
+ endif
+ libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_LIBADD = \
+     $(libnolto_coregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_OBJECTS)
++libcoregrind_@VGCONF_ARCH_PRI@_@VGCONF_OS@_a_DEPENDENCIES = \
++    libnolto_coregrind-@VGCONF_ARCH_PRI@-@VGCONF_OS@.a
+ 
+ if VGCONF_HAVE_PLATFORM_SEC
+ libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_SOURCES = \
+@@ -531,6 +533,8 @@ libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_CFLAGS += \
+ endif
+ libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_LIBADD = \
+     $(libnolto_coregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_OBJECTS)
++libcoregrind_@VGCONF_ARCH_SEC@_@VGCONF_OS@_a_DEPENDENCIES = \
++    libnolto_coregrind-@VGCONF_ARCH_SEC@-@VGCONF_OS@.a
+ endif
+ 
+ #----------------------------------------------------------------------------
+-- 
+2.9.3
+
diff --git a/pkgs/development/tools/analysis/valgrind/default.nix b/pkgs/development/tools/analysis/valgrind/default.nix
index a371bc2e0022..df99ecb13bb3 100644
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "19ds42jwd89zrsjb94g7gizkkzipn8xik3xykrpcqxylxyzi2z03";
   };
 
+  patches = [ ./coregrind-makefile-race.patch ];
+
   outputs = [ "out" "dev" "man" "doc" ];
 
   hardeningDisable = [ "stackprotector" ];
diff --git a/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch b/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
index bef89c881b5a..382c2f0c05b2 100644
--- a/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
+++ b/pkgs/development/tools/build-managers/meson/allow-dirs-outside-of-prefix.patch
@@ -1,6 +1,6 @@
 --- a/mesonbuild/coredata.py
 +++ b/mesonbuild/coredata.py
-@@ -282,18 +282,13 @@
+@@ -298,18 +298,13 @@
          '''
          if option.endswith('dir') and os.path.isabs(value) and \
             option not in builtin_dir_noprefix_options:
@@ -22,4 +22,4 @@
 +                value = value[skip:]
          return value
  
-     def init_builtins(self, options):
+     def init_builtins(self):
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 7eff35e224c0..13f61fb16177 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -1,12 +1,12 @@
-{ lib, python3Packages, stdenv, writeTextDir, substituteAll, targetPackages, fetchpatch }:
+{ lib, python3Packages, stdenv, writeTextDir, substituteAll, targetPackages }:
 
 python3Packages.buildPythonApplication rec {
-  version = "0.46.1";
+  version = "0.48.2";
   pname = "meson";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1jdxs2mkniy1hpdjc4b4jb95axsjp6j5fzphmm6d4gqmqyykjvqc";
+    sha256 = "1shfbr0mf8gmwpw5ivrmwp8282qw9mfhxmccd7fsgidp4x3nslby";
   };
 
   postFixup = ''
@@ -16,6 +16,9 @@ python3Packages.buildPythonApplication rec {
       mv ".$i-wrapped" "$i"
     done
     popd
+
+    # Do not propagate Python
+    rm $out/nix-support/propagated-build-inputs
   '';
 
   patches = [
@@ -41,12 +44,6 @@ python3Packages.buildPythonApplication rec {
       src = ./fix-rpath.patch;
       inherit (builtins) storeDir;
     })
-
-    # Support Python 3.7. This is part of 0.47 and 0.48.1.
-    (fetchpatch {
-      url = https://github.com/mesonbuild/meson/commit/a87496addd9160300837aa50193f4798c6f1d251.patch;
-      sha256 = "1jfn9dgib5bc8frcd65cxn3fzhp19bpbjadxjkqzbjk1v4hdbl88";
-    })
   ];
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/tools/build-managers/meson/fix-rpath.patch b/pkgs/development/tools/build-managers/meson/fix-rpath.patch
index e52428a7db26..30ecb30ee932 100644
--- a/pkgs/development/tools/build-managers/meson/fix-rpath.patch
+++ b/pkgs/development/tools/build-managers/meson/fix-rpath.patch
@@ -1,6 +1,15 @@
 --- a/mesonbuild/compilers/compilers.py
 +++ b/mesonbuild/compilers/compilers.py
-@@ -846,8 +848,10 @@
+@@ -1112,6 +1112,8 @@
+         for p in rpath_paths:
+             if p == from_dir:
+                 relative = '' # relpath errors out in this case
++            elif os.path.isabs(p):
++                relative = p # These can be outside of build dir.
+             else:
+                 relative = os.path.relpath(os.path.join(build_dir, p), os.path.join(build_dir, from_dir))
+             rel_rpaths.append(relative)
+@@ -1121,8 +1123,10 @@
              if paths != '':
                  paths += ':'
              paths += build_rpath
@@ -15,7 +24,7 @@
              else:
 --- a/mesonbuild/scripts/depfixer.py
 +++ b/mesonbuild/scripts/depfixer.py
-@@ -300,6 +300,14 @@
+@@ -303,6 +303,14 @@
              return
          self.bf.seek(rp_off)
          old_rpath = self.read_str()
@@ -30,3 +39,14 @@
          if len(old_rpath) < len(new_rpath):
              sys.exit("New rpath must not be longer than the old one.")
          # The linker does read-only string deduplication. If there is a
+@@ -316,6 +324,10 @@
+         if not new_rpath:
+             self.remove_rpath_entry(entrynum)
+         else:
++            # clean old rpath to avoid stale references
++            # (see https://github.com/NixOS/nixpkgs/pull/46020)
++            self.bf.seek(rp_off)
++            self.bf.write(b'\0'*len(old_rpath))
+             self.bf.seek(rp_off)
+             self.bf.write(new_rpath)
+             self.bf.write(b'\0')
diff --git a/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch b/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
index d8d14f188a2f..b7667ed493f2 100644
--- a/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
+++ b/pkgs/development/tools/build-managers/meson/gir-fallback-path.patch
@@ -1,13 +1,16 @@
 --- a/mesonbuild/modules/gnome.py
 +++ b/mesonbuild/modules/gnome.py
-@@ -427,6 +427,10 @@
-         scan_command += ['--no-libtool', '--namespace=' + ns, '--nsversion=' + nsversion, '--warn-all',
-                          '--output', '@OUTPUT@']
+@@ -780,6 +780,13 @@
+         scan_command += self._scan_langs(state, [lc[0] for lc in langs_compilers])
+         scan_command += list(external_ldflags)
  
-+        fallback_libpath = girtarget.get_custom_install_dir()[0]
++        if len(set([girtarget.get_custom_install_dir()[0] for girtarget in girtargets])) > 1:
++            raise MesonException('generate_gir tries to build multiple libraries with different install_dir at once: {}'.format(','.join([str(girtarget) for girtarget in girtargets])))
++
++        fallback_libpath = girtargets[0].get_custom_install_dir()[0]
 +        if fallback_libpath is not None and isinstance(fallback_libpath, str) and len(fallback_libpath) > 0 and fallback_libpath[0] == "/":
 +            scan_command += ['--fallback-library-path=' + fallback_libpath]
 +
-         header = kwargs.pop('header', None)
-         if header:
-             if not isinstance(header, str):
+         scan_target = self._make_gir_target(state, girfile, scan_command, depends, kwargs)
+ 
+         typelib_output = '%s-%s.typelib' % (ns, nsversion)
diff --git a/pkgs/development/tools/glslviewer/default.nix b/pkgs/development/tools/glslviewer/default.nix
index fbae0a76f254..e8315e7b60c2 100644
--- a/pkgs/development/tools/glslviewer/default.nix
+++ b/pkgs/development/tools/glslviewer/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     libXi libX11
   ] ++ (with python2Packages; [ python setuptools wrapPython ])
     ++ stdenv.lib.optional stdenv.isDarwin Cocoa;
-  pythonPath = with python2Packages; [ requests.dev ];
+  pythonPath = with python2Packages; [ requests ];
 
   # Makefile has /usr/local/bin hard-coded for 'make install'
   preConfigure = ''
diff --git a/pkgs/development/tools/icr/default.nix b/pkgs/development/tools/icr/default.nix
index 3c6eb6a98b06..8fb79a9eabe3 100644
--- a/pkgs/development/tools/icr/default.nix
+++ b/pkgs/development/tools/icr/default.nix
@@ -2,7 +2,7 @@
 , openssl, readline }:
 
 stdenv.mkDerivation rec {
-  name = "icr";
+  pname = "icr";
   version = "0.5.0";
 
   src = fetchFromGitHub {
diff --git a/pkgs/development/tools/kubectx/default.nix b/pkgs/development/tools/kubectx/default.nix
index 959bb8698682..e70cf409197f 100644
--- a/pkgs/development/tools/kubectx/default.nix
+++ b/pkgs/development/tools/kubectx/default.nix
@@ -3,12 +3,12 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  name = "kubectx";
+  pname = "kubectx";
   version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "ahmetb";
-    repo = "${name}";
+    repo = pname;
     rev = "v${version}";
     sha256 = "1507g8sm73mqfsxl3fabmj37pk9l4jddsdi4qlpf0ixhk3z1lfkg";
   };
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 54f9b5e4031f..2d2884eda3e2 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
     then "-Wno-string-plus-int -Wno-deprecated-declarations"
     else "-static-libgcc";
 
-  hardeningDisable = [ "format" ] ++ stdenv.lib.optional stdenv.targetPlatform.isMusl "pie";
+  hardeningDisable = [ "format" "pie" ];
 
   # TODO(@Ericson2314): Always pass "--target" and always targetPrefix.
   configurePlatforms = [ "build" "host" ] ++ stdenv.lib.optional (stdenv.targetPlatform != stdenv.hostPlatform) "target";
diff --git a/pkgs/development/tools/misc/gdb/debug-info-from-env.patch b/pkgs/development/tools/misc/gdb/debug-info-from-env.patch
index ad6dca6749e4..a7eda2c7e173 100644
--- a/pkgs/development/tools/misc/gdb/debug-info-from-env.patch
+++ b/pkgs/development/tools/misc/gdb/debug-info-from-env.patch
@@ -1,81 +1,13 @@
-Look up .build-id files relative to the directories in the
-colon-separated environment variable NIX_DEBUG_INFO_DIRS, in addition
-to the existing debug-file-directory setting.
+Initialize debug-file-directory from NIX_DEBUG_INFO_DIRS, a colon-separated list
+of directories with separate debugging information files.
 
-diff -ru --exclude '*gcore' --exclude '*pdtrace' gdb-8.0-orig/gdb/build-id.c gdb-8.0/gdb/build-id.c
---- gdb-8.0-orig/gdb/build-id.c	2017-06-04 17:51:26.000000000 +0200
-+++ gdb-8.0/gdb/build-id.c	2017-07-28 13:18:10.797375927 +0200
-@@ -67,8 +67,8 @@
+--- a/gdb/main.c
++++ b/gdb/main.c
+@@ -551,3 +551,6 @@ captured_main_1 (struct captured_main_args *context)
  
- /* See build-id.h.  */
- 
--gdb_bfd_ref_ptr
--build_id_to_debug_bfd (size_t build_id_len, const bfd_byte *build_id)
-+static gdb_bfd_ref_ptr
-+build_id_to_debug_bfd_in (const char *directories, size_t build_id_len, const bfd_byte *build_id)
- {
-   char *link, *debugdir;
-   VEC (char_ptr) *debugdir_vec;
-@@ -78,7 +78,7 @@
-   int alloc_len;
- 
-   /* DEBUG_FILE_DIRECTORY/.build-id/ab/cdef */
--  alloc_len = (strlen (debug_file_directory)
-+  alloc_len = (strlen (directories)
- 	       + (sizeof "/.build-id/" - 1) + 1
- 	       + 2 * build_id_len + (sizeof ".debug" - 1) + 1);
-   link = (char *) alloca (alloc_len);
-@@ -86,7 +86,7 @@
-   /* Keep backward compatibility so that DEBUG_FILE_DIRECTORY being "" will
-      cause "/.build-id/..." lookups.  */
- 
--  debugdir_vec = dirnames_to_char_ptr_vec (debug_file_directory);
-+  debugdir_vec = dirnames_to_char_ptr_vec (directories);
-   back_to = make_cleanup_free_char_ptr_vec (debugdir_vec);
- 
-   for (ix = 0; VEC_iterate (char_ptr, debugdir_vec, ix, debugdir); ++ix)
-@@ -137,6 +137,30 @@
-   return abfd;
- }
- 
-+gdb_bfd_ref_ptr
-+build_id_to_debug_bfd (size_t build_id_len, const bfd_byte *build_id)
-+{
-+  gdb_bfd_ref_ptr abfd = build_id_to_debug_bfd_in(debug_file_directory, build_id_len, build_id);
+-  debug_file_directory = relocate_gdb_directory (DEBUGDIR,
++  debug_file_directory = getenv("NIX_DEBUG_INFO_DIRS");
 +
-+  if (abfd != NULL)
-+    return abfd;
-+
-+  static int init = 0;
-+  static char *env_var;
-+  if (!init)
-+    {
-+      env_var = getenv("NIX_DEBUG_INFO_DIRS");
-+      init = 1;
-+    }
-+
-+  if (env_var)
-+    {
-+      abfd = build_id_to_debug_bfd_in(env_var, build_id_len, build_id);
-+    }
-+
-+  return abfd;
-+}
-+
- /* See build-id.h.  */
- 
- char *
-diff -ru --exclude '*gcore' --exclude '*pdtrace' gdb-8.0-orig/gdb/symfile.c gdb-8.0/gdb/symfile.c
---- gdb-8.0-orig/gdb/symfile.c	2017-06-04 17:51:27.000000000 +0200
-+++ gdb-8.0/gdb/symfile.c	2017-07-28 12:54:05.401586174 +0200
-@@ -1415,8 +1415,8 @@
- 			   struct cmd_list_element *c, const char *value)
- {
-   fprintf_filtered (file,
--		    _("The directory where separate debug "
--		      "symbols are searched for is \"%s\".\n"),
-+		    _("The directories where separate debug "
-+		      "symbols are searched for are \"%s\".\n"),
- 		    value);
- }
- 
++  if (debug_file_directory == NULL)
++    debug_file_directory = relocate_gdb_directory (DEBUGDIR,
+ 						 DEBUGDIR_RELOCATABLE);
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index a60a77bed30b..103f11311484 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 
 # Build time
-, fetchurl, pkgconfig, perl, texinfo, setupDebugInfoDirs
+, fetchurl, fetchpatch, pkgconfig, perl, texinfo, setupDebugInfoDirs
 
 # Run time
 , ncurses, readline, gmp, mpfr, expat, zlib, dejagnu
@@ -13,7 +13,7 @@
 
 let
   basename = "gdb-${version}";
-  version = "8.1.1";
+  version = "8.2";
 in
 
 assert pythonSupport -> python != null;
@@ -26,11 +26,20 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnu/gdb/${basename}.tar.xz";
-    sha256 = "0g6hv9xk12aa58w77fydaldqr9a6b0a6bnwsq87jfc6lkcbc7p4p";
+    sha256 = "0fbw6j4z7kmvywwgavn7w3knp860i5i9qnjffc5p52bwkji43963";
   };
 
-  patches = [ ./debug-info-from-env.patch ]
-    ++ stdenv.lib.optional stdenv.isDarwin ./darwin-target-match.patch;
+  patches = [
+    ./debug-info-from-env.patch
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [
+    ./darwin-target-match.patch
+    (fetchpatch {
+      name = "gdb-aarch64-linux-tdep.patch";
+      url = "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=patch;h=0c0a40e0abb9f1a584330a1911ad06b3686e5361";
+      excludes = [ "gdb/ChangeLog" ];
+      sha256 = "16zjw99npyapj68sw52xzmbw671ajm9xv7g5jxfmp94if5y91mnj";
+    })
+  ];
 
   nativeBuildInputs = [ pkgconfig texinfo perl setupDebugInfoDirs ];
 
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 1b90cfb1d01c..44ec787a1a5a 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perl, gettext, LocaleGettext }:
 
 stdenv.mkDerivation rec {
-  name = "help2man-1.47.7";
+  name = "help2man-1.47.8";
 
   src = fetchurl {
     url = "mirror://gnu/help2man/${name}.tar.xz";
-    sha256 = "03gckfr2980qn319c02vflq7d75vq2qdkxrw80kb9g84xn48wnsq";
+    sha256 = "1p5830h88cx0zn0snwaj0vpph81xicpsirfwlxmcgjrlmn0nm3sj";
   };
 
   nativeBuildInputs = [ gettext LocaleGettext ];
diff --git a/pkgs/development/tools/misc/intel-gpu-tools/default.nix b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
index a1b358807c4e..a8f358ab55b4 100644
--- a/pkgs/development/tools/misc/intel-gpu-tools/default.nix
+++ b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, pkgconfig, libdrm, libpciaccess, cairo, dri2proto, udev
 , libX11, libXext, libXv, libXrandr, glib, bison, libunwind, python3, kmod
-, procps, utilmacros, gnome2, openssl }:
+, procps, utilmacros, gnome2, openssl, peg }:
 
 stdenv.mkDerivation rec {
   name = "intel-gpu-tools-${version}";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig utilmacros ];
   buildInputs = [ libdrm libpciaccess cairo dri2proto udev libX11 kmod
     libXext libXv libXrandr glib bison libunwind python3 procps
-    gnome2.gtkdoc openssl ];
+    gnome2.gtkdoc openssl peg ];
 
   preConfigure = ''
     ./autogen.sh
diff --git a/pkgs/development/tools/parsing/bison/3.x.nix b/pkgs/development/tools/parsing/bison/3.x.nix
index d75a7e0ee3db..bae134ea3a51 100644
--- a/pkgs/development/tools/parsing/bison/3.x.nix
+++ b/pkgs/development/tools/parsing/bison/3.x.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, m4, perl, help2man }:
 
 stdenv.mkDerivation rec {
-  name = "bison-3.1";
+  name = "bison-3.2.1";
 
   src = fetchurl {
     url = "mirror://gnu/bison/${name}.tar.gz";
-    sha256 = "0ip9krjf0lw57pk3wfbxgjhif1i18hm3vh35d1ifrvhnafskdjx7";
+    sha256 = "1pgcvwzzlckb83sdcljz75hg71zwbc2a4pl5ycwxsxw05423gwq1";
   };
 
   patches = []; # remove on another rebuild
diff --git a/pkgs/development/tools/pyre/default.nix b/pkgs/development/tools/pyre/default.nix
index 382e733cb98b..02772f9f7916 100644
--- a/pkgs/development/tools/pyre/default.nix
+++ b/pkgs/development/tools/pyre/default.nix
@@ -82,7 +82,7 @@ let
   };
 };
 typeshed = stdenv.mkDerivation {
-  name = "typeshed";
+  pname = "typeshed";
   version = pyre-version;
   src = fetchFromGitHub {
     owner = "python";
diff --git a/pkgs/development/tools/scry/default.nix b/pkgs/development/tools/scry/default.nix
index ab810a2ae9fa..03e7c64f5496 100644
--- a/pkgs/development/tools/scry/default.nix
+++ b/pkgs/development/tools/scry/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, crystal, shards, which }:
 
 stdenv.mkDerivation rec {
-  name = "scry";
+  pname = "scry";
   # 0.7.1 doesn't work with crystal > 0.25
   version = "0.7.1.20180919";
 
diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix
index 868d60d6d322..6bfaa2a2f274 100644
--- a/pkgs/misc/arm-trusted-firmware/default.nix
+++ b/pkgs/misc/arm-trusted-firmware/default.nix
@@ -6,11 +6,12 @@ let
             , platform
             , extraMakeFlags ? []
             , extraMeta ? {}
+            , version ? "1.5"
             , ... } @ args:
            stdenv.mkDerivation (rec {
 
     name = "arm-trusted-firmware-${platform}-${version}";
-    version = "1.5";
+    inherit version;
 
     src = fetchFromGitHub {
       owner = "ARM-software";
diff --git a/pkgs/misc/drivers/epkowa/default.nix b/pkgs/misc/drivers/epkowa/default.nix
index 3359f9e94acc..643977d829db 100644
--- a/pkgs/misc/drivers/epkowa/default.nix
+++ b/pkgs/misc/drivers/epkowa/default.nix
@@ -26,7 +26,7 @@ in
 
 let plugins = {
   x770 =   stdenv.mkDerivation rec {
-    name = "iscan-gt-x770-bundle";
+    pname = "iscan-gt-x770-bundle";
     version = "1.0.1";
     pluginVersion = "2.1.2-1";
 
@@ -58,7 +58,7 @@ let plugins = {
     meta = common_meta // { description = "iscan esci x770 plugin for "+passthru.hw; };
     };
   f720 = stdenv.mkDerivation rec {
-    name = "iscan-gt-f720-bundle";
+    pname = "iscan-gt-f720-bundle";
     version = "1.0.1";
     pluginVersion = "0.1.1-2";
 
diff --git a/pkgs/misc/drivers/hplip/3.16.11.nix b/pkgs/misc/drivers/hplip/3.16.11.nix
index 8982834d9a99..0c6ff464a622 100644
--- a/pkgs/misc/drivers/hplip/3.16.11.nix
+++ b/pkgs/misc/drivers/hplip/3.16.11.nix
@@ -23,7 +23,7 @@ let
   };
 
   hplipState = substituteAll {
-    inherit version;
+    version_ = version;
     src = ./hplip.state;
   };
 
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index f03d75dfa02d..e2c34473e544 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -25,7 +25,7 @@ let
   };
 
   hplipState = substituteAll {
-    inherit version;
+    version_ = version;
     src = ./hplip.state;
   };
 
diff --git a/pkgs/misc/drivers/hplip/hplip.state b/pkgs/misc/drivers/hplip/hplip.state
index 9d19a93f3644..3c7c2eb2df7b 100644
--- a/pkgs/misc/drivers/hplip/hplip.state
+++ b/pkgs/misc/drivers/hplip/hplip.state
@@ -1,4 +1,4 @@
 [plugin]
 installed=1
 eula=1
-version=@version@
+version=@version_@
diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index 2eef6009ac26..7a0a48db1185 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -67,7 +67,7 @@ in with stdenv.lib.licenses;
     buildPhase = "make";
   };
 
-  beetle-pce-fast = (mkLibRetroCore rec {
+  beetle-pce-fast = let der = (mkLibRetroCore rec {
     core = "mednafen-pce-fast";
     src = fetchRetro {
       repo = "beetle-pce-fast-libretro";
@@ -76,12 +76,12 @@ in with stdenv.lib.licenses;
     };
     description = "Port of Mednafen's PC Engine core to libretro";
     license = gpl2;
-  }).override {
+  }); in der.override {
     buildPhase = "make";
-    name = "beetle-pce-fast";
+    name = "beetle-pce-fast-${der.version}";
   };
 
-  beetle-psx = (mkLibRetroCore rec {
+  beetle-psx = let der = (mkLibRetroCore rec {
     core = "mednafen-psx";
     src = fetchRetro {
       repo = "beetle-psx-libretro";
@@ -90,12 +90,12 @@ in with stdenv.lib.licenses;
     };
     description = "Port of Mednafen's PSX Engine core to libretro";
     license = gpl2;
-  }).override {
+  }); in der.override {
     buildPhase = "make";
-    name = "beetle-psx";
+    name = "beetle-psx-${der.version}";
   };
 
-  beetle-saturn = (mkLibRetroCore rec {
+  beetle-saturn = let der = (mkLibRetroCore rec {
     core = "mednafen-saturn";
     src = fetchRetro {
       repo = "beetle-saturn-libretro";
@@ -104,9 +104,9 @@ in with stdenv.lib.licenses;
     };
     description = "Port of Mednafen's Saturn core to libretro";
     license = gpl2;
-  }).override {
+  }); in der.override {
     buildPhase = "make";
-    name = "beetle-saturn";
+    name = "beetle-saturn-${der.version}";
     meta.platforms = [ "x86_64-linux" ];
   };
 
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 71ad6203e325..5f4efe943ca9 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -42,7 +42,8 @@ stdenv.mkDerivation rec {
     sha256 = "1dzg45vgy2w1xcd3p6h8d76ykhabbvk1h0lf8yb24ikrwlv8cr4p";
   };
 
-  hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
+  hardeningDisable = [ "format" "pie" ]
+    ++ lib.optionals enableStatic [ "fortify" ];
 
   patches = [
     ./busybox-in-store.patch
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 27a615d7bb96..b94e34c8f6c4 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -370,9 +370,12 @@ let
     };
 
     container = {
-      NAMESPACES     = option yes; #  Required by 'unshare' used by 'nixos-install'
+      NAMESPACES     = yes; #  Required by 'unshare' used by 'nixos-install'
       RT_GROUP_SCHED = no;
-      CGROUP_DEVICE  = option yes;
+      CGROUP_DEVICE  = yes;
+      CGROUP_HUGETLB = yes;
+      CGROUP_PERF    = yes;
+      CGROUP_RDMA    = whenAtLeast "4.11" yes;
 
       MEMCG                    = yes;
       MEMCG_SWAP               = yes;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 1d280647c5a1..0ce6ed769a33 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -269,7 +269,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.platform kernelPatches
       ++ optionals stdenv.lib.inNixShell [ pkgconfig ncurses ]
       ;
 
-  hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" ];
+  hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
 
   # Absolute paths for compilers avoid any PATH-clobbering issues.
   makeFlags = commonMakeFlags ++ [
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix
index 069bd17c4839..b78286a902b1 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexectools/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1ac20jws8iys9w6dpn4q3hihyx73zkabdwv3gcb779cxfrmq2k2h";
   };
 
-  hardeningDisable = [ "format" "pic" "relro" ];
+  hardeningDisable = [ "format" "pic" "relro" "pie" ];
 
   configureFlags = [ "BUILD_CC=${buildPackages.stdenv.cc.targetPrefix}cc" ];
   nativeBuildInputs = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/os-specific/linux/libratbag/default.nix b/pkgs/os-specific/linux/libratbag/default.nix
index 271dc156695a..c614b39255d6 100644
--- a/pkgs/os-specific/linux/libratbag/default.nix
+++ b/pkgs/os-specific/linux/libratbag/default.nix
@@ -12,15 +12,14 @@ stdenv.mkDerivation rec {
     sha256 = "0cr5skrb7a5mgj7dkm647ib8336hb88bf11blaf6xldafi8b0jlj";
   };
 
-
-  # todo: python should be in buildInputs, but right now meson propagates
-  # its own python. see: https://github.com/NixOS/nixpkgs/pull/46020
   nativeBuildInputs = [
-    (python3.withPackages (ps: with ps; [ evdev pygobject3 ]))
     meson ninja pkgconfig gitMinimal swig check valgrind
   ];
 
-  buildInputs = [ glib systemd udev libevdev ];
+  buildInputs = [
+    glib systemd udev libevdev
+    (python3.withPackages (ps: with ps; [ evdev pygobject3 ]))
+  ];
 
   mesonFlags = [
     "-Dsystemd-unit-dir=./lib/systemd/system/"
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 55758190efd6..72693696494b 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -4,15 +4,15 @@
 let
   version = lib.concatStringsSep "." ([ majorVersion ]
     ++ lib.optional (patchVersion != "") patchVersion);
-  majorVersion = "2.32";
-  patchVersion = "1";
+  majorVersion = "2.33";
+  patchVersion = "";
 
 in stdenv.mkDerivation rec {
   name = "util-linux-${version}";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${majorVersion}/${name}.tar.xz";
-    sha256 = "1ck7d8srw5szpjq7v0gpmjahnjs6wgqzm311ki4gazww6xx71rl6";
+    sha256 = "12k54fj1wz1193kq619vplvzj7gf8yn42sfj0kmfxgrm7kbvjqgj";
   };
 
   patches = [
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index b4b4cf49592d..bf82e916590b 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -16,12 +16,12 @@ assert ldapSupport -> aprutil.ldapSupport && openldap != null;
 assert http2Support -> nghttp2 != null;
 
 stdenv.mkDerivation rec {
-  version = "2.4.35";
+  version = "2.4.37";
   name = "apache-httpd-${version}";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha256 = "0mlvwsm7hmpc7db6lfc2nx3v4cll3qljjxhjhgsw6aniskywc1r6";
+    sha256 = "09npb7vlz5sizgj0nvl0bqxj9zig29ipkp07fgmw5ykjcxfdr61l";
   };
 
   # FIXME: -dev depends on -doc
diff --git a/pkgs/servers/sql/postgresql/default.nix b/pkgs/servers/sql/postgresql/default.nix
index 480b5327028b..f802de9df9df 100644
--- a/pkgs/servers/sql/postgresql/default.nix
+++ b/pkgs/servers/sql/postgresql/default.nix
@@ -103,33 +103,33 @@ let
 in {
 
   postgresql_9_3 = common {
-    version = "9.3.24";
+    version = "9.3.25";
     psqlSchema = "9.3";
-    sha256 = "1a8dnv16n2rxnbwhqw7c0kjpj3xqvkpwk50kvimj4d917cxaf542";
+    sha256 = "1nxn0hjrg4y5v5n2jgzrbicgv4504r2yfjyk6g6rq0sx8603x5g4";
   };
 
   postgresql_9_4 = common {
-    version = "9.4.19";
+    version = "9.4.20";
     psqlSchema = "9.4";
-    sha256 = "12qn9h47rkn4k41gdbxkkvg0pff43k1113jmhc83f19adc1nnxq3";
+    sha256 = "0zzqjz5jrn624hzh04drpj6axh30a9k6bgawid6rwk45nbfxicgf";
   };
 
   postgresql_9_5 = common {
-    version = "9.5.14";
+    version = "9.5.15";
     psqlSchema = "9.5";
-    sha256 = "0k8s62h6qd9p3xlx315j5irniskqsnx1nz4ir5r1yhqp07mdab1y";
+    sha256 = "0i2lylgmsmy2g1ixlvl112fryp7jmrd0i2brk8sxb7vzzpg3znnv";
   };
 
   postgresql_9_6 = common {
-    version = "9.6.10";
+    version = "9.6.11";
     psqlSchema = "9.6";
-    sha256 = "09l4zqs74fqnazdsyln9x657mq3wsbgng9wpvq71yh26cv2sq5c6";
+    sha256 = "0c55akrkzqd6p6a8hr0338wk246hl76r9j16p4zn3s51d7f0l99q";
   };
 
   postgresql_10 = common {
-    version = "10.5";
+    version = "10.6";
     psqlSchema = "10.0";
-    sha256 = "04a07jkvc5s6zgh6jr78149kcjmsxclizsqabjw44ld4j5n633kc";
+    sha256 = "0jv26y3f10svrjxzsgqxg956c86b664azyk2wppzpa5x11pjga38";
   };
 
   postgresql_11 = common {
diff --git a/pkgs/servers/web-apps/fileshelter/default.nix b/pkgs/servers/web-apps/fileshelter/default.nix
index d0be4f575dd6..01fb8c624820 100644
--- a/pkgs/servers/web-apps/fileshelter/default.nix
+++ b/pkgs/servers/web-apps/fileshelter/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, autoreconfHook, libzip, boost, wt3, libconfig, pkgconfig } :
 
 stdenv.mkDerivation rec {
-  name = "fileshelter";
+  pname = "fileshelter";
   version = "3.0.0";
 
   src = fetchFromGitHub {
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 67c7c5eae53a..5f6f608aa7a6 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -65,6 +65,8 @@ rec {
     , pos ? # position used in error messages and for meta.position
         (if attrs.meta.description or null != null
           then builtins.unsafeGetAttrPos "description" attrs.meta
+          else if attrs.version or null != null
+          then builtins.unsafeGetAttrPos "version" attrs
           else builtins.unsafeGetAttrPos "name" attrs)
     , separateDebugInfo ? false
     , outputs ? [ "out" ]
@@ -79,6 +81,8 @@ rec {
     , ... } @ attrs:
 
     let
+      computedName = if name != "" then name else "${attrs.pname}-${attrs.version}";
+
       # TODO(@oxij, @Ericson2314): This is here to keep the old semantics, remove when
       # no package has `doCheck = true`.
       doCheck' = doCheck && stdenv.hostPlatform == stdenv.buildPlatform;
@@ -177,7 +181,7 @@ rec {
         // {
           # A hack to make `nix-env -qa` and `nix search` ignore broken packages.
           # TODO(@oxij): remove this assert when something like NixOS/nix#1771 gets merged into nix.
-          name = assert validity.handled && (separateDebugInfo -> stdenv.hostPlatform.isLinux); name + lib.optionalString
+          name = assert validity.handled && (separateDebugInfo -> stdenv.hostPlatform.isLinux); computedName + lib.optionalString
             # Fixed-output derivations like source tarballs shouldn't get a host
             # suffix. But we have some weird ones with run-time deps that are
             # just used for their side-affects. Those might as well since the
@@ -273,7 +277,7 @@ rec {
       meta = {
           # `name` above includes cross-compilation cruft (and is under assert),
           # lets have a clean always accessible version here.
-          inherit name;
+          name = computedName;
 
           # If the packager hasn't specified `outputsToInstall`, choose a default,
           # which is the name of `p.bin or p.out or p`;
diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 8af369b1d17d..be96d018612c 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -653,7 +653,8 @@ fi
 
 substituteStream() {
     local var=$1
-    shift
+    local description=$2
+    shift 2
 
     while (( "$#" )); do
         case "$1" in
@@ -661,6 +662,14 @@ substituteStream() {
                 pattern="$2"
                 replacement="$3"
                 shift 3
+                local savedvar
+                savedvar="${!var}"
+                eval "$var"'=${'"$var"'//"$pattern"/"$replacement"}'
+                if [ "$pattern" != "$replacement" ]; then
+                    if [ "${!var}" == "$savedvar" ]; then
+                        echo "substituteStream(): WARNING: pattern '$pattern' doesn't match anything in $description" >&2
+                    fi
+                fi
                 ;;
 
             --subst-var)
@@ -677,11 +686,13 @@ substituteStream() {
                 fi
                 pattern="@$varName@"
                 replacement="${!varName}"
+                eval "$var"'=${'"$var"'//"$pattern"/"$replacement"}'
                 ;;
 
             --subst-var-by)
                 pattern="@$2@"
                 replacement="$3"
+                eval "$var"'=${'"$var"'//"$pattern"/"$replacement"}'
                 shift 3
                 ;;
 
@@ -690,8 +701,6 @@ substituteStream() {
                 return 1
                 ;;
         esac
-
-        eval "$var"'=${'"$var"'//"$pattern"/"$replacement"}'
     done
 
     printf "%s" "${!var}"
@@ -719,7 +728,7 @@ substitute() {
     consumeEntire content < "$input"
 
     if [ -e "$output" ]; then chmod +w "$output"; fi
-    substituteStream content "$@" > "$output"
+    substituteStream content "file '$input'" "$@" > "$output"
 }
 
 substituteInPlace() {
@@ -741,7 +750,7 @@ substituteAllStream() {
     local -a args=()
     _allFlags
 
-    substituteStream "$1" "${args[@]}"
+    substituteStream "$1" "$2" "${args[@]}"
 }
 
 # Substitute all environment variables that start with a lowercase character and
@@ -1152,7 +1161,7 @@ fixupPhase() {
         for hook in $setupHooks; do
             local content
             consumeEntire content < "$hook"
-            substituteAllStream content >> "${!outputDev}/nix-support/setup-hook"
+            substituteAllStream content "file '$hook'" >> "${!outputDev}/nix-support/setup-hook"
             unset -v content
         done
         unset -v hook
diff --git a/pkgs/tools/misc/ethtool/default.nix b/pkgs/tools/misc/ethtool/default.nix
index 105733e00333..5bca02037c7b 100644
--- a/pkgs/tools/misc/ethtool/default.nix
+++ b/pkgs/tools/misc/ethtool/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ethtool-${version}";
-  version = "4.18";
+  version = "4.19";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/ethtool/${name}.tar.xz";
-    sha256 = "0461nwqp1z9a89nmxf7kq0r4jfl9c7fg55c71lfmc5y0siaqb54h";
+    sha256 = "1j6hyr809af2m3gqm11hdfwks5kljqy1ikspq3d9rhj29qv6r2mi";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/hdf5/default.nix b/pkgs/tools/misc/hdf5/default.nix
index e481a31e9267..3d50b068cc49 100644
--- a/pkgs/tools/misc/hdf5/default.nix
+++ b/pkgs/tools/misc/hdf5/default.nix
@@ -16,11 +16,11 @@ assert !cpp || mpi == null;
 let inherit (stdenv.lib) optional optionals; in
 
 stdenv.mkDerivation rec {
-  version = "1.10.3";
+  version = "1.10.4";
   name = "hdf5-${version}";
   src = fetchurl {
     url = "https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-1.10/${name}/src/${name}.tar.bz2";
-    sha256 = "1a85v6812afi6k3gmfdcj80f6ys9kc80v7ysz39pz9948z7dqp66";
+    sha256 = "1pr85fa1sh2ky6ai2hs3f21lp252grl2cq3wbyi4rh7dm83gyrqj";
  };
 
   passthru = {
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
       applications to evolve in their use of HDF5. The HDF5 Technology suite includes tools and
       applications for managing, manipulating, viewing, and analyzing data in the HDF5 format.
     '';
-    license = stdenv.lib.licenses.free; # BSD-like
+    license = stdenv.lib.licenses.bsd3; # Lawrence Berkeley National Labs BSD 3-Clause variant
     homepage = https://www.hdfgroup.org/HDF5/;
     platforms = stdenv.lib.platforms.unix;
     broken = (gfortran != null) && stdenv.isDarwin;
diff --git a/pkgs/tools/misc/hid-listen/default.nix b/pkgs/tools/misc/hid-listen/default.nix
index 0ebad4f7117d..6bbe4888d1b8 100644
--- a/pkgs/tools/misc/hid-listen/default.nix
+++ b/pkgs/tools/misc/hid-listen/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchzip }:
 stdenv.mkDerivation rec {
-  name = "hid-listen";
+  pname = "hid-listen";
   version = "1.01";
 
   src = fetchzip {
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index dac92f98223c..42ea641afb67 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -34,6 +34,11 @@ stdenv.mkDerivation rec {
     sha256 = "084niy7cin13ba65p8x38w2xcyc54n3fgzbin40fa2shfr0ca0kq";
   };
 
+  patches = [
+    # Cherry picked fix for https://github.com/curl/curl/issues/3218
+    ./fix-ipv6-url-parsing.patch
+  ];
+
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
   separateDebugInfo = stdenv.isLinux;
 
diff --git a/pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch b/pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch
new file mode 100644
index 000000000000..8a74b27ce7fd
--- /dev/null
+++ b/pkgs/tools/networking/curl/fix-ipv6-url-parsing.patch
@@ -0,0 +1,54 @@
+From b28094833a971870fd8c07960b3b12bf6fbbaad3 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 2 Nov 2018 15:11:16 +0100
+Subject: [PATCH] URL: fix IPv6 numeral address parser
+
+Regression from 46e164069d1a52. Extended test 1560 to verify.
+
+Reported-by: tpaukrt on github
+Fixes #3218
+Closes #3219
+---
+ lib/urlapi.c            | 8 ++++++--
+ tests/libtest/lib1560.c | 9 +++++++++
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/lib/urlapi.c b/lib/urlapi.c
+index c53e523434..18a6076fff 100644
+--- a/lib/urlapi.c
++++ b/lib/urlapi.c
+@@ -499,8 +499,12 @@ static CURLUcode parse_port(struct Curl_URL *u, char *hostname)
+      (']' == endbracket)) {
+     /* this is a RFC2732-style specified IP-address */
+     portptr = &hostname[len];
+-    if (*portptr != ':')
+-      return CURLUE_MALFORMED_INPUT;
++    if(*portptr) {
++      if(*portptr != ':')
++        return CURLUE_MALFORMED_INPUT;
++    }
++    else
++      portptr = NULL;
+   }
+   else
+     portptr = strchr(hostname, ':');
+diff --git a/tests/libtest/lib1560.c b/tests/libtest/lib1560.c
+index e0faa12b29..57469a9063 100644
+--- a/tests/libtest/lib1560.c
++++ b/tests/libtest/lib1560.c
+@@ -128,6 +128,15 @@ struct querycase {
+ };
+ 
+ static struct testcase get_parts_list[] ={
++  {"http://[fd00:a41::50]:8080",
++   "http | [11] | [12] | [13] | [fd00:a41::50] | 8080 | / | [16] | [17]",
++   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
++  {"http://[fd00:a41::50]/",
++   "http | [11] | [12] | [13] | [fd00:a41::50] | [15] | / | [16] | [17]",
++   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
++  {"http://[fd00:a41::50]",
++   "http | [11] | [12] | [13] | [fd00:a41::50] | [15] | / | [16] | [17]",
++   CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
+   {"https://[::1%252]:1234",
+    "https | [11] | [12] | [13] | [::1%252] | 1234 | / | [16] | [17]",
+    CURLU_DEFAULT_SCHEME, 0, CURLUE_OK},
diff --git a/pkgs/tools/networking/dnsmasq/default.nix b/pkgs/tools/networking/dnsmasq/default.nix
index 9adb95d1d3fb..315e12cc155e 100644
--- a/pkgs/tools/networking/dnsmasq/default.nix
+++ b/pkgs/tools/networking/dnsmasq/default.nix
@@ -12,11 +12,11 @@ let
   ]);
 in
 stdenv.mkDerivation rec {
-  name = "dnsmasq-2.79";
+  name = "dnsmasq-2.80";
 
   src = fetchurl {
     url = "http://www.thekelleys.org.uk/dnsmasq/${name}.tar.xz";
-    sha256 = "07w6cw706yyahwvbvslhkrbjf2ynv567cgy9pal8bz8lrbsp9bbq";
+    sha256 = "1fv3g8vikj3sn37x1j6qsywn09w1jipvlv34j3q5qrljbrwa5ayd";
   };
 
   preBuild = ''
diff --git a/pkgs/tools/networking/modem-manager/default.nix b/pkgs/tools/networking/modem-manager/default.nix
index 6ca8c8925621..15ec2ef41cd7 100644
--- a/pkgs/tools/networking/modem-manager/default.nix
+++ b/pkgs/tools/networking/modem-manager/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "modem-manager-${version}";
-  pname = "ModemManager";
   version = "1.7.990";
 
+  package = "ModemManager";
   src = fetchurl {
-    url = "https://www.freedesktop.org/software/${pname}/${pname}-${version}.tar.xz";
+    url = "https://www.freedesktop.org/software/${package}/${package}-${version}.tar.xz";
     sha256 = "1v4hixmghlrw7w4ajq2x4k62js0594h223d0yma365zwqr7hjrfl";
   };
 
diff --git a/pkgs/tools/networking/quickserve/default.nix b/pkgs/tools/networking/quickserve/default.nix
index 06e5918dccd8..7269eb7b80a9 100644
--- a/pkgs/tools/networking/quickserve/default.nix
+++ b/pkgs/tools/networking/quickserve/default.nix
@@ -12,7 +12,7 @@ let
   };
   wrappedPython = python3.withPackages (_: [ threaded_servers ]);
 in stdenv.mkDerivation {
-  name = "quickserve";
+  pname = "quickserve";
   version = "2018";
 
   unpackPhase = ":";
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index 06a06f5721c9..08dc68889809 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.2.10";
+  version = "2.2.11";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "05f9804g72pffdxgvxjmjzkfcpjg1x221g9rwcr8fi51hrxd77br";
+    sha256 = "1ncwqjhcxh46fgkp84g2lhf91amcha7abk6wdm1kagzm7q93wv29";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 975e533d4771..56848af71f65 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -5,14 +5,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "sudo-1.8.25p1";
+  name = "sudo-1.8.26";
 
   src = fetchurl {
     urls =
       [ "ftp://ftp.sudo.ws/pub/sudo/${name}.tar.gz"
         "ftp://ftp.sudo.ws/pub/sudo/OLD/${name}.tar.gz"
       ];
-    sha256 = "0nqri46d4dpycj96zin2f2wszmhm7q9mr68hhj9sp81pgmx9rjcx";
+    sha256 = "1qpyyfga8rs02p3186sns8qvh2bzwa48ka845nrcqh83dyd23nj0";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/system/lshw/default.nix b/pkgs/tools/system/lshw/default.nix
index d57b65189753..5711dff57839 100644
--- a/pkgs/tools/system/lshw/default.nix
+++ b/pkgs/tools/system/lshw/default.nix
@@ -6,10 +6,10 @@ let numVersion = "02.18"; # :(
 in
 stdenv.mkDerivation rec {
   name = "lshw-${numVersion}b";
-  version = "B.${numVersion}";
+  version = "${numVersion}";
 
   src = fetchurl {
-    url = "https://ezix.org/software/files/lshw-${version}.tar.gz";
+    url = "https://ezix.org/software/files/lshw-B.${version}.tar.gz";
     sha256 = "0brwra4jld0d53d7jsgca415ljglmmx1l2iazpj4ndilr48yy8mf";
   };
 
diff --git a/pkgs/tools/virtualization/awsebcli/default.nix b/pkgs/tools/virtualization/awsebcli/default.nix
index b1693bd262fe..fabdd5357743 100644
--- a/pkgs/tools/virtualization/awsebcli/default.nix
+++ b/pkgs/tools/virtualization/awsebcli/default.nix
@@ -20,6 +20,7 @@ let
       });
 
       pathspec = super.pathspec.overridePythonAttrs (oldAttrs: rec {
+        name = "${oldAttrs.pname}-${version}";
         version = "0.5.5";
         src = oldAttrs.src.override {
           inherit version;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c47fb0474483..333373f06057 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -344,7 +344,7 @@ with pkgs;
       inherit contents compressor prepend;
     };
 
-  makeWrapper = makeSetupHook { deps = [ dieHook ]; }
+  makeWrapper = makeSetupHook { deps = [ dieHook ]; substitutions = { shell = pkgs.runtimeShell; }; }
                               ../build-support/setup-hooks/make-wrapper.sh;
 
   makeModulesClosure = { kernel, firmware, rootModules, allowMissing ? false }:
@@ -1684,9 +1684,7 @@ with pkgs;
 
   apparix = callPackage ../tools/misc/apparix { };
 
-  appleseed = callPackage ../tools/graphics/appleseed {
-    eigen = eigen3_3;
-  };
+  appleseed = callPackage ../tools/graphics/appleseed { };
 
   arping = callPackage ../tools/networking/arping { };
 
@@ -3227,9 +3225,7 @@ with pkgs;
 
   halibut = callPackage ../tools/typesetting/halibut { };
 
-  halide = callPackage ../development/compilers/halide {
-    eigen = eigen3_3;
-  };
+  halide = callPackage ../development/compilers/halide { };
 
   hardinfo = callPackage ../tools/system/hardinfo { };
 
@@ -7405,6 +7401,7 @@ with pkgs;
   # For beta and nightly releases use the nixpkgs-mozilla overlay
   rust = callPackage ../development/compilers/rust ({
     inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
+    llvm = llvm_7;
   } // stdenv.lib.optionalAttrs (stdenv.cc.isGNU && stdenv.hostPlatform.isi686) {
     stdenv = overrideCC stdenv gcc6; # with gcc-7: undefined reference to `__divmoddi4'
   });
@@ -9506,7 +9503,6 @@ with pkgs;
   editline = callPackage ../development/libraries/editline { };
 
   eigen = callPackage ../development/libraries/eigen {};
-  eigen3_3 = callPackage ../development/libraries/eigen/3.3.nix {};
 
   eigen2 = callPackage ../development/libraries/eigen/2.0.nix {};
 
@@ -10659,6 +10655,7 @@ with pkgs;
   in
     (gap.override { keepAllPackages = false; }).overrideAttrs (oldAttrs: {
       name = "libgap-${oldAttrs.pname}-${version}";
+      inherit version;
       src = fetchurl {
         url = "https://www.gap-system.org/pub/gap/gap48/tar.bz2/gap${version}_${pkgVer}.tar.bz2";
         sha256 = "19n2p1mdg33s2x9rs51iak7rgndc1cwr56jyqnah0g1ydgg1yh6b";
@@ -10740,9 +10737,7 @@ with pkgs;
 
   libf2c = callPackage ../development/libraries/libf2c {};
 
-  libfive = callPackage ../development/libraries/libfive {
-    eigen = eigen3_3;
-  };
+  libfive = callPackage ../development/libraries/libfive { };
 
   libfixposix = callPackage ../development/libraries/libfixposix {};
 
@@ -21719,7 +21714,6 @@ with pkgs;
   };
 
   caffe2 = callPackage ../development/libraries/science/math/caffe2 (rec {
-    eigen = eigen3_3;
     inherit (python3Packages) python future six numpy pydot;
     protobuf = protobuf3_1;
     python-protobuf = python3Packages.protobuf.override { inherit protobuf; };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 992ef14c4b94..5d34c61d4b8c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3901,6 +3901,7 @@ in {
 
   sphinx_1_2 = self.sphinx.overridePythonAttrs rec {
     name = "sphinx-1.2.3";
+    version = "1.2.3";
     src = pkgs.fetchurl {
       url = "mirror://pypi/s/sphinx/sphinx-1.2.3.tar.gz";
       sha256 = "94933b64e2fe0807da0612c574a021c0dac28c7bd3c4a23723ae5a39ea8f3d04";