diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index beac9e29d59..42b00b2025d 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -76,7 +76,7 @@ in
       ];
 
     system.build = {
-      inherit nixos-install nixos-prepare-root nixos-generate-config nixos-option nixos-rebuild nixos-enter;
+      inherit nixos-install nixos-generate-config nixos-option nixos-rebuild nixos-enter;
     };
 
   };
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 6fe29af3a00..d5cfd87520c 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -122,6 +122,7 @@
   ./programs/wireshark.nix
   ./programs/xfs_quota.nix
   ./programs/xonsh.nix
+  ./programs/xss-lock.nix
   ./programs/yabar.nix
   ./programs/zsh/oh-my-zsh.nix
   ./programs/zsh/zsh.nix
diff --git a/nixos/modules/programs/xss-lock.nix b/nixos/modules/programs/xss-lock.nix
new file mode 100644
index 00000000000..49d522c604f
--- /dev/null
+++ b/nixos/modules/programs/xss-lock.nix
@@ -0,0 +1,26 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.xss-lock;
+in
+{
+  options.programs.xss-lock = {
+    enable = mkEnableOption "xss-lock";
+    lockerCommand = mkOption {
+      example = "xlock";
+      type = types.string;
+      description = "Locker to be used with xsslock";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.user.services.xss-lock = {
+      description = "XSS Lock Daemon";
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      serviceConfig.ExecStart = "${pkgs.xss-lock}/bin/xss-lock ${cfg.lockerCommand}";
+    };
+  };
+}
diff --git a/nixos/release.nix b/nixos/release.nix
index 04970f1c188..0e7befbf129 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -403,6 +403,7 @@ in rec {
   tests.xfce = callTest tests/xfce.nix {};
   tests.xmonad = callTest tests/xmonad.nix {};
   tests.xrdp = callTest tests/xrdp.nix {};
+  tests.xss-lock = callTest tests/xss-lock.nix {};
   tests.yabar = callTest tests/yabar.nix {};
   tests.zookeeper = callTest tests/zookeeper.nix {};
 
diff --git a/nixos/tests/home-assistant.nix b/nixos/tests/home-assistant.nix
index 3d920dccc16..797706a062c 100644
--- a/nixos/tests/home-assistant.nix
+++ b/nixos/tests/home-assistant.nix
@@ -71,6 +71,7 @@ in {
     print "$log\n";
 
     # Check that no errors were logged
-    $hass->fail("cat ${configDir}/home-assistant.log | grep -qF ERROR");
+    # The timer can get out of sync due to Hydra's load, so this error is ignored
+    $hass->fail("cat ${configDir}/home-assistant.log | grep -vF 'Timer got out of sync' | grep -qF ERROR");
   '';
 })
diff --git a/nixos/tests/xss-lock.nix b/nixos/tests/xss-lock.nix
new file mode 100644
index 00000000000..3e3864cab77
--- /dev/null
+++ b/nixos/tests/xss-lock.nix
@@ -0,0 +1,25 @@
+import ./make-test.nix ({ pkgs, lib, ... }:
+
+with lib;
+
+{
+  name = "xss-lock";
+  meta.maintainers = with pkgs.stdenv.lib.maintainers; [ ma27 ];
+
+  machine = {
+    imports = [ ./common/x11.nix ./common/user-account.nix ];
+    programs.xss-lock.enable = true;
+    programs.xss-lock.lockerCommand = "${pkgs.xlockmore}/bin/xlock";
+    services.xserver.displayManager.auto.user = "alice";
+  };
+
+  testScript = ''
+    $machine->start;
+    $machine->waitForX;
+    $machine->waitForUnit("xss-lock.service", "alice");
+
+    $machine->fail("pgrep xlock");
+    $machine->succeed("su -l alice -c 'xset dpms force standby'");
+    $machine->succeed("pgrep xlock");
+  '';
+})
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 328370c2501..ecc6e244a58 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -13,9 +13,9 @@ let
     sha256Hash = "1h9f4pkyqxkqxampi8v035czg5d4g6lp4bsrnq5mgpwhjwkr1whk";
   };
   latestVersion = {
-    version = "3.2.0.13"; # "Android Studio 3.2 Canary 14"
-    build = "181.4763614";
-    sha256Hash = "1rx3bip5a7v349whg26kxvj05qlvm7zwacfqnfzfmvvhzbh7xnyh";
+    version = "3.2.0.14"; # "Android Studio 3.2 Canary 15"
+    build = "181.4773949";
+    sha256Hash = "10lhy6sdvvh4a8kj8jyk4z9nzh67v8f5zpkwparvk3pb2s5mf3mk";
   };
 in rec {
   # Old alias
diff --git a/pkgs/applications/editors/typora/default.nix b/pkgs/applications/editors/typora/default.nix
index d687712fc08..ed4aefd90bc 100644
--- a/pkgs/applications/editors/typora/default.nix
+++ b/pkgs/applications/editors/typora/default.nix
@@ -1,20 +1,20 @@
-{ stdenv, fetchurl, dpkg, lib, glib, dbus, makeWrapper, gnome2, atk, cairo
+{ stdenv, fetchurl, dpkg, lib, glib, dbus, makeWrapper, gnome2, gtk3, atk, cairo
 , freetype, fontconfig, nspr, nss, xorg, alsaLib, cups, expat, udev }:
 
 stdenv.mkDerivation rec {
   name = "typora-${version}";
-  version = "0.9.47";
+  version = "0.9.48";
 
   src =
     if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "https://www.typora.io/linux/typora_${version}_amd64.deb";
-        sha256 = "431741948f5a2faba04984c495bea56b4a800c6dbb7e21e24ad3124fb8ffcbc9";
+        sha256 = "36a7c5f855306bcbe3364d12aca94c2f6d013a013e59b46f89df81496ec11800";
       }
     else
       fetchurl {
         url = "https://www.typora.io/linux/typora_${version}_i386.deb";
-        sha256 = "a95c8c1e296d8587a4dc6182af3b24253c3c2abc991badb7c758cd6d1bf5b1b6";
+        sha256 = "7197c526918a791b15b701846f9f2f1747a5b8ceac77c4cba691ee6d74d07d1d";
       }
     ;
 
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
       gnome2.gdk_pixbuf
       gnome2.pango
       expat
+      gtk3
       atk
       nspr
       nss
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index 65a3238ef57..1a9bb44cabb 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -14,8 +14,8 @@ let
     else throw "ImageMagick is not supported on this platform.";
 
   cfg = {
-    version = "7.0.7-29";
-    sha256 = "0jfpfydz50zxs776knz6w2f5g0l4nhivp9g1fz4cf5clgjcpa3z6";
+    version = "7.0.7-32";
+    sha256 = "1i3rvq0f4lq1las4g12ipfs6h5vyngwh5fllvynpci2lh32gd48j";
     patches = [];
   };
 in
diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index 5978612fdf3..de4849e2162 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -51,7 +51,9 @@ stdenv.mkDerivation rec {
     libvisio libcdr libexif potrace python2Env icu
   ];
 
-  enableParallelBuilding = true;
+  # To avoid non-deterministic build failure using make.
+  # When switching back to cmake turn parallel back on, see #40046.
+  enableParallelBuilding = false;
 
   preConfigure = ''
     intltoolize -f
diff --git a/pkgs/applications/misc/ape/apeclex.nix b/pkgs/applications/misc/ape/apeclex.nix
new file mode 100644
index 00000000000..710ddfec994
--- /dev/null
+++ b/pkgs/applications/misc/ape/apeclex.nix
@@ -0,0 +1,8 @@
+{ stdenv, attemptoClex, callPackage }:
+
+callPackage ./. {
+  pname = "ape-clex";
+  lexicon = "${attemptoClex}/clex_lexicon.pl";
+  description = "Parser for Attempto Controlled English (ACE) with a large lexicon (~100,000 entries)";
+  license = with stdenv.lib; [ licenses.lgpl3 licenses.gpl3 ];
+}
diff --git a/pkgs/applications/misc/ape/clex.nix b/pkgs/applications/misc/ape/clex.nix
new file mode 100644
index 00000000000..37d140e19ba
--- /dev/null
+++ b/pkgs/applications/misc/ape/clex.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "attempto-clex-${version}";
+  version = "5133afe";
+
+  src = fetchFromGitHub {
+     owner = "Attempto";
+     repo = "Clex";
+     rev = version;
+     sha256 = "0p9s64g1jic213bwm6347jqckszgnni9szrrz31qjgaf32kf7nkp";
+  };
+
+  installPhase = ''
+    mkdir -p $out
+    cp clex_lexicon.pl $out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Large lexicon for APE (~100,000 entries)";
+    license = licenses.gpl3;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ yrashk ];
+  };
+}
diff --git a/pkgs/applications/misc/ape/default.nix b/pkgs/applications/misc/ape/default.nix
new file mode 100644
index 00000000000..e78ba2df999
--- /dev/null
+++ b/pkgs/applications/misc/ape/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, swiProlog, makeWrapper,
+  fetchFromGitHub,
+  lexicon ? "lexicon/clex_lexicon.pl",
+  pname ? "ape",
+  description ? "Parser for Attempto Controlled English (ACE)",
+  license ? with stdenv.lib; licenses.lgpl3
+  }:
+
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  version = "6.7-131003";
+
+  buildInputs = [ swiProlog makeWrapper ];
+
+  src = fetchFromGitHub {
+     owner = "Attempto";
+     repo = "APE";
+     rev = version;
+     sha256 = "0cw47qjg4896kw3vps6rfs02asvscsqvcfdiwgfmqb3hvykb1sdx";
+  };
+
+  patchPhase = ''
+    # We move the file first to avoid "same file" error in the default case
+    cp ${lexicon} new_lexicon.pl
+    rm lexicon/clex_lexicon.pl
+    cp new_lexicon.pl lexicon/clex_lexicon.pl
+  '';
+
+  buildPhase = ''
+    make build
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ape.exe $out
+    makeWrapper $out/ape.exe $out/bin/ape --add-flags ace
+  '';
+
+  meta = with stdenv.lib; {
+    description = description;
+    license = license;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ yrashk ];
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/franz/default.nix b/pkgs/applications/networking/instant-messengers/franz/default.nix
index 95e01e586ec..75df17bd5b0 100644
--- a/pkgs/applications/networking/instant-messengers/franz/default.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeDesktopItem, makeWrapper
+{ stdenv, fetchurl, makeDesktopItem, makeWrapper, autoPatchelfHook
 , xorg, gtk2, atk, glib, pango, gdk_pixbuf, cairo, freetype, fontconfig
 , gnome2, dbus, nss, nspr, alsaLib, cups, expat, udev, libnotify, xdg_utils }:
 
@@ -8,17 +8,6 @@ let
 
   version = "4.0.4";
 
-  runtimeDeps = [
-    udev libnotify
-  ];
-  deps = (with xorg; [
-    libXi libXcursor libXdamage libXrandr libXcomposite libXext libXfixes
-    libXrender libX11 libXtst libXScrnSaver
-  ]) ++ [
-    gtk2 atk glib pango gdk_pixbuf cairo freetype fontconfig dbus
-    gnome2.GConf nss nspr alsaLib cups expat stdenv.cc.cc
-  ] ++ runtimeDeps;
-
   desktopItem = makeDesktopItem rec {
     name = "Franz";
     exec = name;
@@ -39,16 +28,21 @@ in stdenv.mkDerivation rec {
   # don't remove runtime deps
   dontPatchELF = true;
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
+  buildInputs = (with xorg; [
+    libXi libXcursor libXdamage libXrandr libXcomposite libXext libXfixes
+    libXrender libX11 libXtst libXScrnSaver
+  ]) ++ [
+    gtk2 atk glib pango gdk_pixbuf cairo freetype fontconfig dbus
+    gnome2.GConf nss nspr alsaLib cups expat stdenv.cc.cc
+  ];
+  runtimeDependencies = [ udev.lib libnotify ];
 
   unpackPhase = ''
     tar xzf $src
   '';
 
   installPhase = ''
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" Franz
-    patchelf --set-rpath "$out/opt/franz:${stdenv.lib.makeLibraryPath deps}" Franz
-
     mkdir -p $out/bin $out/opt/franz
     cp -r * $out/opt/franz
     ln -s $out/opt/franz/Franz $out/bin
diff --git a/pkgs/applications/networking/mailreaders/astroid/default.nix b/pkgs/applications/networking/mailreaders/astroid/default.nix
index 610b16dab5b..9a348fc03f7 100644
--- a/pkgs/applications/networking/mailreaders/astroid/default.nix
+++ b/pkgs/applications/networking/mailreaders/astroid/default.nix
@@ -1,24 +1,22 @@
-{ stdenv, fetchFromGitHub, scons, pkgconfig, gnome3, gmime3, webkitgtk24x-gtk3
-, libsass, notmuch, boost, wrapGAppsHook }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, gnome3, gmime3, webkitgtk24x-gtk3
+, libsass, notmuch, boost, wrapGAppsHook, glib-networking }:
 
 stdenv.mkDerivation rec {
   name = "astroid-${version}";
-  version = "0.10.2";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "astroidmail";
     repo = "astroid";
     rev = "v${version}";
-    sha256 = "0y1i40xbjjvnylqpdkvj0m9fl6f5k9zk1z4pqg3vhj8x1ys8am1c";
+    sha256 = "1z48rvlzwi7bq7j55rnb0gg1a4k486yj910z2cxz1p46lxk332j1";
   };
 
-  nativeBuildInputs = [ scons pkgconfig wrapGAppsHook ];
+  nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook ];
 
   buildInputs = [ gnome3.gtkmm gmime3 webkitgtk24x-gtk3 libsass gnome3.libpeas
-                  notmuch boost gnome3.gsettings-desktop-schemas ];
-
-  buildPhase = "scons --propagate-environment --prefix=$out build";
-  installPhase = "scons --propagate-environment --prefix=$out install";
+                  notmuch boost gnome3.gsettings-desktop-schemas
+                  glib-networking ];
 
   meta = with stdenv.lib; {
     homepage = https://astroidmail.github.io/;
diff --git a/pkgs/applications/science/electronics/gtkwave/default.nix b/pkgs/applications/science/electronics/gtkwave/default.nix
index 671c53365ab..4ca489c40b3 100644
--- a/pkgs/applications/science/electronics/gtkwave/default.nix
+++ b/pkgs/applications/science/electronics/gtkwave/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "gtkwave-${version}";
-  version = "3.3.89";
+  version = "3.3.90";
 
   src = fetchurl {
     url    = "mirror://sourceforge/gtkwave/${name}.tar.gz";
-    sha256 = "1j7byy0kmapa66dp17gjvs4pa4gckjccljydixswdknpxs5ma45g";
+    sha256 = "1q1fi0nqja9d8xj24h7ykvnpms6zqgn24jmyj1mxn48qig301c6m";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index 1571f8e573d..95093f4eefc 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchzip }:
 
 let
-  version = "1.14.0";
+  version = "1.14.3";
 in fetchzip rec {
   name = "iosevka-bin-${version}";
 
@@ -12,7 +12,7 @@ in fetchzip rec {
     unzip -j $downloadedFile \*.ttc -d $out/share/fonts/iosevka
   '';
 
-  sha256 = "03zgh5dfx58sxrprhqi8cyc18sh05k84yc262bn81vavl6lm14ns";
+  sha256 = "0qc5i6ijr25d2jwi5r4bcvbaw74y1p05a5fvlwss3l9rhmmxsfpl";
 
   meta = with stdenv.lib; {
     homepage = https://be5invis.github.io/Iosevka/;
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index 657eb80c539..4fc47793661 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -26,13 +26,13 @@ in
 let pname = if set != null then "iosevka-${set}" else "iosevka"; in
 
 let
-  version = "1.14.2";
+  version = "1.14.3";
   name = "${pname}-${version}";
   src = fetchFromGitHub {
     owner = "be5invis";
     repo ="Iosevka";
     rev = "v${version}";
-    sha256 = "18vh5rjffqgiliyfia40lh7cygz6fv3rwgq28fxl26i9sc95qsqd";
+    sha256 = "0ba8hwxi88bp2jb9xfhk95nnlv8ykl74cv62xr4ybzm3b8ahpwqf";
   };
 in
 
diff --git a/pkgs/desktops/enlightenment/enlightenment.nix b/pkgs/desktops/enlightenment/enlightenment.nix
index b0fd5f3db2b..dc538625bf0 100644
--- a/pkgs/desktops/enlightenment/enlightenment.nix
+++ b/pkgs/desktops/enlightenment/enlightenment.nix
@@ -35,15 +35,44 @@ stdenv.mkDerivation rec {
     gdbm
     pcre
     mesa_noglu
+    xkeyboard_config
   ] ++
     stdenv.lib.optionals stdenv.isLinux [ libcap ];
 
-  # Instead of setting owner to root and permissions to setuid/setgid
-  # (which is not allowed for files in /nix/store) of some
-  # enlightenment programs, the file $out/e-wrappers.nix is created,
-  # containing the needed configuration for that purpose. It can be
-  # used in the enlightenment module.
-  patches = [ ./enlightenment.suid-exes.patch ];
+  patches = [
+    # Some programs installed by enlightenment (to set the cpu frequency,
+    # for instance) need root ownership and setuid/setgid permissions, which
+    # are not allowed for files in /nix/store. Instead of allowing the
+    # installer to try to do this, the file $out/e-wrappers.nix is created,
+    # containing the needed configuration for wrapping those programs. It
+    # can be used in the enlightenment module. The idea is:
+    # 
+    #  1) rename the original binary adding the extension .orig
+    #  2) wrap the renamed binary at /run/wrappers/bin/
+    #  3) create a new symbolic link using the original binary name (in the
+    #     original directory where enlightenment wants it) pointing to the
+    #     wrapper
+
+    ./enlightenment.suid-exes.patch
+  ];
+
+  postPatch = ''
+    # In order to get the available keyboard layouts Enlightenment looks for
+    # the file xorg.lst, that should be provided by xkeyboard-config (when
+    # configured with option --with-xkb-rules-symlink=xorg). Currently
+    # xkeyboard-config is not configured with this option in
+    # NixOS. Therefore it is needed to add base.lst (which xorg.lst would be
+    # a symbolic link to) explicitly as an alternative.
+
+    sed "/#ifdef XKB_BASE/a XKB_BASE \"\/rules\/base.lst\"," \
+      -i src/modules/wizard/page_011.c src/modules/xkbswitch/e_mod_parse.c
+
+    # edge_cc is a binary provided by efl and cannot be found at the directory
+    # given by e_prefix_bin_get(), which is $out/bin
+
+    substituteInPlace src/bin/e_import_config_dialog.c \
+      --replace "e_prefix_bin_get()" "\"${efl}/bin\""
+  '';
 
   mesonFlags = [ "-Dsystemdunitdir=lib/systemd/user" ];
 
diff --git a/pkgs/desktops/maxx/default.nix b/pkgs/desktops/maxx/default.nix
index 69d16c9b20a..10fa745d978 100644
--- a/pkgs/desktops/maxx/default.nix
+++ b/pkgs/desktops/maxx/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, makeWrapper, libredirect, gcc-unwrapped, bash, gtk-engine-murrine, gtk_engines, librsvg
+{ stdenv, fetchurl, makeWrapper, autoPatchelfHook
+, libredirect, gcc-unwrapped, bash, gtk-engine-murrine, gtk_engines, librsvg
 
 , libX11, libXext, libXi, libXau, libXrender, libXft, libXmu, libSM, libXcomposite, libXfixes, libXpm
 , libXinerama, libXdamage, libICE, libXtst, libXaw, fontconfig, pango, cairo, glib, libxml2, atk, gtk2
@@ -9,11 +10,6 @@
 let
   version = "Indy-1.1.0";
 
-  deps = [
-    stdenv.cc.cc libX11 libXext libXi libXau libXrender libXft libXmu libSM libXcomposite libXfixes libXpm
-    libXinerama libXdamage libICE libXtst libXaw fontconfig pango cairo glib libxml2 atk gtk2
-    gdk_pixbuf libGL ncurses
-  ];
   runtime_deps = [
     xclock xsettingsd
   ];
@@ -31,7 +27,12 @@ in stdenv.mkDerivation {
     })
   ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
+  buildInputs = [
+    stdenv.cc.cc libX11 libXext libXi libXau libXrender libXft libXmu libSM libXcomposite libXfixes libXpm
+    libXinerama libXdamage libICE libXtst libXaw fontconfig pango cairo glib libxml2 atk gtk2
+    gdk_pixbuf libGL ncurses
+  ];
 
   buildPhase = ''
     while IFS= read -r -d ''$'\0' i; do
@@ -58,15 +59,11 @@ in stdenv.mkDerivation {
       --prefix PATH : ${stdenv.lib.makeBinPath runtime_deps}
 
     while IFS= read -r -d ''$'\0' i; do
-      if isELF "$i"; then
-        bin=`patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$i"; echo $?`
-        patchelf --set-rpath "$maxx/lib64:$maxx/OpenMotif-2.1.32/lib64:$maxx/OpenMotif-2.3.1/lib64:${stdenv.lib.makeLibraryPath deps}" "$i"
-        if [ "$bin" -eq 0 ]; then
-          wrapProgram "$i" \
-            --set LD_PRELOAD "${libredirect}/lib/libredirect.so" \
-            --set NIX_REDIRECTS /opt/MaXX=$maxx \
-            --prefix PATH : $maxx/sbin
-        fi
+      if isExecutable "$i"; then
+        wrapProgram "$i" \
+          --set LD_PRELOAD "${libredirect}/lib/libredirect.so" \
+          --set NIX_REDIRECTS /opt/MaXX=$maxx \
+          --prefix PATH : $maxx/sbin
       fi
     done < <(find "$maxx" -type f -print0)
 
diff --git a/pkgs/development/compilers/iasl/default.nix b/pkgs/development/compilers/iasl/default.nix
index 22f80ae559f..6cf4c85fb20 100644
--- a/pkgs/development/compilers/iasl/default.nix
+++ b/pkgs/development/compilers/iasl/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "iasl-${version}";
-  version = "20180313";
+  version = "20180508";
 
   src = fetchurl {
     url = "https://acpica.org/sites/acpica/files/acpica-unix-${version}.tar.gz";
-    sha256 = "05ab2xfv9wqwbzjaa9xqgrvvan87rxv29hw48h1gcckpc5smp2wm";
+    sha256 = "1n7lqmv77kg28drahvxzybwl9v4hzwi8i7xkpgliclfcp5ff909b";
   };
 
   NIX_CFLAGS_COMPILE = "-O3";
diff --git a/pkgs/development/haskell-modules/make-package-set.nix b/pkgs/development/haskell-modules/make-package-set.nix
index bde4f85f678..bbc3d856ff2 100644
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@@ -176,6 +176,7 @@ in package-set { inherit pkgs stdenv callPackage; } self // {
     #   , source-overrides : Defaulted (Either Path VersionNumber)
     #   , overrides : Defaulted (HaskellPackageOverrideSet)
     #   , modifier : Defaulted
+    #   , returnShellEnv : Defaulted
     #   } -> NixShellAwareDerivation
     # Given a path to a haskell package directory whose cabal file is
     # named the same as the directory name, an optional set of
@@ -183,11 +184,19 @@ in package-set { inherit pkgs stdenv callPackage; } self // {
     # function, an optional set of arbitrary overrides, and an optional
     # haskell package modifier,  return a derivation appropriate
     # for nix-build or nix-shell to build that package.
-    developPackage = { root, source-overrides ? {}, overrides ? self: super: {}, modifier ? drv: drv }:
-      let name = builtins.baseNameOf root;
-          drv =
-            (extensible-self.extend (pkgs.lib.composeExtensions (self.packageSourceOverrides source-overrides) overrides)).callCabal2nix name root {};
-      in if pkgs.lib.inNixShell then (modifier drv).env else modifier drv;
+    developPackage =
+      { root
+      , source-overrides ? {}
+      , overrides ? self: super: {}
+      , modifier ? drv: drv
+      , returnShellEnv ? pkgs.lib.inNixShell }:
+      let drv =
+        (extensible-self.extend
+           (pkgs.lib.composeExtensions
+              (self.packageSourceOverrides source-overrides)
+              overrides))
+        .callCabal2nix (builtins.baseNameOf root) root {};
+      in if returnShellEnv then (modifier drv).env else modifier drv;
 
     ghcWithPackages = selectFrom: withPackages (selectFrom self);
 
diff --git a/pkgs/development/libraries/ace/default.nix b/pkgs/development/libraries/ace/default.nix
index d61315f7db8..e428b9a8c78 100644
--- a/pkgs/development/libraries/ace/default.nix
+++ b/pkgs/development/libraries/ace/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ace-${version}";
-  version = "6.4.7";
+  version = "6.4.8";
 
   src = fetchurl {
     url = "http://download.dre.vanderbilt.edu/previous_versions/ACE-${version}.tar.bz2";
-    sha256 = "1zbncdxkkwnx4aphy0apnp7xn4aspxvq2h9bbjh33dpsy0j81afd";
+    sha256 = "190cyfs2najph2yycyj8abzddwa8s4wx8lx38iv237plwfl2308g";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/tools/gllvm/default.nix b/pkgs/development/tools/gllvm/default.nix
index 470ba291825..6cf36e44dd1 100644
--- a/pkgs/development/tools/gllvm/default.nix
+++ b/pkgs/development/tools/gllvm/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "gllvm-${version}";
-  version = "1.2.0";
+  version = "1.2.1";
 
   goPackagePath = "github.com/SRI-CSL/gllvm";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner = "SRI-CSL";
     repo = "gllvm";
     rev = "v${version}";
-    sha256 = "0779828kzw9ihdnw5r3h2fzzd8ml8cskyf5hmaqqksinjb7bm3is";
+    sha256 = "1rbvn7qhzb7xxqv0wrkwxq4sm657vsl6q7nwrfq2zwb21573811z";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/java/jhiccup/default.nix b/pkgs/development/tools/java/jhiccup/default.nix
index 03aa841dc7b..39b57302337 100644
--- a/pkgs/development/tools/java/jhiccup/default.nix
+++ b/pkgs/development/tools/java/jhiccup/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "jhiccup-${version}";
-  version = "2.0.8";
+  version = "2.0.9";
 
   src = fetchzip {
     url    = "https://www.azul.com/files/jHiccup-${version}-dist.zip";
-    sha256 = "1q4wd5ywisgh0f4ic7iglxai0gc8mnl1pkjw1hm1xdij8j5i488g";
+    sha256 = "1y089kzj191j3vclkma4vi1w66pw4jqrnm5z0qw264wqcn0hnq11";
   };
 
   configurePhase = ":";
diff --git a/pkgs/development/tools/wllvm/default.nix b/pkgs/development/tools/wllvm/default.nix
index 399a8e66860..8fa7574f311 100644
--- a/pkgs/development/tools/wllvm/default.nix
+++ b/pkgs/development/tools/wllvm/default.nix
@@ -1,20 +1,20 @@
 { stdenv, python3Packages }:
 
 python3Packages.buildPythonApplication rec {
-  version = "1.2.0";
+  version = "1.2.1";
   pname = "wllvm";
   name = "${pname}-${version}";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1hriyv5gfkcxjqk71l3030qfy3scsjr3mp12hkxfknh65inlqs5z";
+    sha256 = "1yr0gijhgbxx1sl5a8dygr3a8g5wfkh9rk4v789r2aplvcbanv5a";
   };
 
   meta = with stdenv.lib; {
     homepage = https://github.com/travitch/whole-program-llvm;
     description = "A wrapper script to build whole-program LLVM bitcode files";
     license = licenses.mit;
-    maintainers = with maintainers; [ mic92 ];
+    maintainers = with maintainers; [ mic92 dtzWill ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/misc/emulators/wine/base.nix b/pkgs/misc/emulators/wine/base.nix
index e0646099415..0ff6f3f041e 100644
--- a/pkgs/misc/emulators/wine/base.nix
+++ b/pkgs/misc/emulators/wine/base.nix
@@ -6,8 +6,6 @@
   buildScript ? null, configureFlags ? ""
 }:
 
-assert stdenv.cc.cc.isGNU or false;
-
 with import ./util.nix { inherit lib; };
 
 stdenv.mkDerivation ((lib.optionalAttrs (! isNull buildScript) {
@@ -54,9 +52,14 @@ stdenv.mkDerivation ((lib.optionalAttrs (! isNull buildScript) {
   ++ lib.optionals xmlSupport    [ pkgs.libxml2 pkgs.libxslt ]
   ++ lib.optionals tlsSupport    [ pkgs.openssl pkgs.gnutls ]
   ++ lib.optionals openglSupport [ pkgs.libGLU_combined pkgs.mesa_noglu.osmesa pkgs.libdrm ]
-  ++ (with pkgs.xorg; [
-    libX11  libXi libXcursor libXrandr libXrender libXxf86vm libXcomposite libXext
-  ])));
+  ++ lib.optionals stdenv.isDarwin (with pkgs.buildPackages.darwin.apple_sdk.frameworks; [
+     CoreServices Foundation ForceFeedback AppKit OpenGL IOKit DiskArbitration Security
+     ApplicationServices AudioToolbox CoreAudio AudioUnit CoreMIDI OpenAL OpenCL Cocoa Carbon
+  ])
+  ++ lib.optionals stdenv.isLinux  (with pkgs.xorg; [
+     libXi libXcursor libXrandr libXrender libXxf86vm libXcomposite libXext
+  ])
+  ++ [ pkgs.xorg.libX11 ]));
 
   # Wine locates a lot of libraries dynamically through dlopen().  Add
   # them to the RPATH so that the user doesn't have to set them in
@@ -105,7 +108,8 @@ stdenv.mkDerivation ((lib.optionalAttrs (! isNull buildScript) {
 
   # https://bugs.winehq.org/show_bug.cgi?id=43530
   # https://github.com/NixOS/nixpkgs/issues/31989
-  hardeningDisable = [ "bindnow" ];
+  hardeningDisable = [ "bindnow" ]
+    ++ lib.optional (stdenv.hostPlatform.isDarwin) "fortify";
 
   passthru = { inherit pkgArches; };
   meta = {
diff --git a/pkgs/misc/emulators/wine/packages.nix b/pkgs/misc/emulators/wine/packages.nix
index a786babc79d..d2305aa37ba 100644
--- a/pkgs/misc/emulators/wine/packages.nix
+++ b/pkgs/misc/emulators/wine/packages.nix
@@ -20,7 +20,7 @@ in with src; {
     geckos = [ gecko64 ];
     monos =  [ mono ];
     configureFlags = [ "--enable-win64" ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
   };
   wineWow = callPackage ./base.nix {
     name = "wine-wow-${version}";
diff --git a/pkgs/os-specific/linux/firejail/default.nix b/pkgs/os-specific/linux/firejail/default.nix
index 1c7ebce9f87..9f2374e75a8 100644
--- a/pkgs/os-specific/linux/firejail/default.nix
+++ b/pkgs/os-specific/linux/firejail/default.nix
@@ -3,11 +3,11 @@ let
   s = # Generated upstream information
   rec {
     baseName="firejail";
-    version="0.9.52";
+    version="0.9.54";
     name="${baseName}-${version}";
-    hash="0w8l8z4j7iph8fp7rchhnfsrik3f00f9v5xr191fp38fphzcj56s";
-    url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.52.tar.xz";
-    sha256="0w8l8z4j7iph8fp7rchhnfsrik3f00f9v5xr191fp38fphzcj56s";
+    hash="0mkpqlhi1vxiwd1pmlsk02vpydy1gj61k1gi3zlz6qw84xa6i6ff";
+    url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.54.tar.xz";
+    sha256="0mkpqlhi1vxiwd1pmlsk02vpydy1gj61k1gi3zlz6qw84xa6i6ff";
   };
   buildInputs = [
     which
diff --git a/pkgs/os-specific/linux/lsscsi/default.nix b/pkgs/os-specific/linux/lsscsi/default.nix
index 084a7e7c9a3..d250d658282 100644
--- a/pkgs/os-specific/linux/lsscsi/default.nix
+++ b/pkgs/os-specific/linux/lsscsi/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation {
-  name = "lsscsi-0.28";
+  name = "lsscsi-0.29";
 
   src = fetchurl {
-    url = "http://sg.danny.cz/scsi/lsscsi-0.28.tgz";
-    sha256 = "0l6xz8545lnfd9f4z974ar1pbzfdkr6c8r56zjrcaazl3ad00p82";
+    url = "http://sg.danny.cz/scsi/lsscsi-0.29.tgz";
+    sha256 = "0538fjgxky03yn7mzyslkyi2af3yy5llsnjjcgjx73x08wd6hv5n";
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 6e3e444240a..c5daaabd5be 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -6,11 +6,11 @@ assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "3.10";
 let
   name = "wireguard-${version}";
 
-  version = "0.0.20180420";
+  version = "0.0.20180514";
 
   src = fetchurl {
     url    = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "05nsn5pkzvkfsc8z0mm4fdb1znklpmb00v608j8gxlz8z6nd535m";
+    sha256 = "1nk6yj1gdmpar99zzw39n1v795m6fxsrilg37d02jm780rgbd5g8";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/dns/nsd/default.nix b/pkgs/servers/dns/nsd/default.nix
index b4bd6175f3e..c1c0d4e425c 100644
--- a/pkgs/servers/dns/nsd/default.nix
+++ b/pkgs/servers/dns/nsd/default.nix
@@ -15,11 +15,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "nsd-4.1.20";
+  name = "nsd-4.1.21";
 
   src = fetchurl {
     url = "http://www.nlnetlabs.nl/downloads/nsd/${name}.tar.gz";
-    sha256 = "04zph9zli3a0zx1sfphwbxx6f8whdxcjai6w0k7a565vgcfzd5wa";
+    sha256 = "1gfjdgb5nc0nrbpdm36ngxml302khl2lnwkykl3q45byl0sbjn3q";
   };
 
   prePatch = ''
diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix
index 936e457eb33..9943c0b9ab0 100644
--- a/pkgs/servers/mattermost/default.nix
+++ b/pkgs/servers/mattermost/default.nix
@@ -1,49 +1,61 @@
-{ stdenv, fetchurl, fetchFromGitHub, buildGoPackage }:
+{ stdenv, fetchurl, fetchFromGitHub, buildGoPackage, buildEnv }:
 
 let
-  version = "4.8.0";
-  goPackagePath = "github.com/mattermost/mattermost-server";
-  buildFlags = "-ldflags \"-X '${goPackagePath}/model.BuildNumber=nixpkgs-${version}'\"";
+  version = "4.10.0";
+
+  mattermost-server = buildGoPackage rec {
+    name = "mattermost-server-${version}";
+
+    src = fetchFromGitHub {
+      owner = "mattermost";
+      repo = "mattermost-server";
+      rev = "v${version}";
+      sha256 = "02isw8qapp35pgriy4w1ar1ppvgc5a10j550hjbc1mylnhzkg1jf";
+    };
+
+    goPackagePath = "github.com/mattermost/mattermost-server";
+
+    buildFlagsArray = ''
+      -ldflags=
+        -X ${goPackagePath}/model.BuildNumber=nixpkgs-${version}
+    '';
+
+    postInstall = ''
+      ln -s $bin/bin/mattermost-server $bin/bin/platform
+      ln -s $bin/bin/mattermost-server $bin/bin/mattermost-platform
+    '';
+
+  };
+
+  mattermost-webapp = stdenv.mkDerivation {
+    name = "mattermost-webapp-${version}";
+
+    src = fetchurl {
+      url = "https://releases.mattermost.com/${version}/mattermost-${version}-linux-amd64.tar.gz";
+      sha256 = "0pfj2dxl4qrv4w6yj0385nw0fa4flcg95kkahs0arwhan5bgifl5";
+    };
+
+    installPhase = ''
+      mkdir -p $out
+      tar --strip 1 --directory $out -xf $src \
+        mattermost/client \
+        mattermost/i18n \
+        mattermost/fonts \
+        mattermost/templates \
+        mattermost/config
+    '';
+  };
+
 in
+  buildEnv {
+    name = "mattermost-${version}";
+    paths = [ mattermost-server mattermost-webapp ];
 
-buildGoPackage rec {
-  name = "mattermost-${version}";
-
-  src = fetchFromGitHub {
-    owner = "mattermost";
-    repo = "mattermost-server";
-    rev = "v${version}";
-    sha256 = "16yf4p0n3klgh0zw2ikbahj9cy1wcxbwg86pld0yz63cfvfz5ns4";
-  };
-
-  webApp = fetchurl {
-    url = "https://releases.mattermost.com/${version}/mattermost-team-${version}-linux-amd64.tar.gz";
-    sha256 = "0ykp9apsv2514bircgay0xi0jigiai65cnb8q77v1qxjzdyx8s75";
-  };
-
-  inherit goPackagePath;
-
-  buildPhase = ''
-    runHook preBuild
-    cd go/src/${goPackagePath}/cmd/platform
-    go install ${buildFlags}
-    runHook postBuild
-  '';
-
-  preInstall = ''
-    mkdir -p $bin
-    tar --strip 1 -C $bin -xf $webApp
-  '';
-
-  postInstall = ''
-    ln -s $bin/bin/platform $bin/bin/mattermost-platform
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Open-source, self-hosted Slack-alternative";
-    homepage = https://www.mattermost.org;
-    license = with licenses; [ agpl3 asl20 ];
-    maintainers = with maintainers; [ fpletz ryantm ];
-    platforms = platforms.unix;
-  };
-}
+    meta = with stdenv.lib; {
+      description = "Open-source, self-hosted Slack-alternative";
+      homepage = https://www.mattermost.org;
+      license = with licenses; [ agpl3 asl20 ];
+      maintainers = with maintainers; [ fpletz ryantm ];
+      platforms = platforms.unix;
+    };
+  }
diff --git a/pkgs/tools/filesystems/duperemove/default.nix b/pkgs/tools/filesystems/duperemove/default.nix
index 613ab7bab1e..4e71d910a5d 100644
--- a/pkgs/tools/filesystems/duperemove/default.nix
+++ b/pkgs/tools/filesystems/duperemove/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "duperemove-${version}";
-  version = "0.10";
+  version = "0.11";
 
   src = fetchFromGitHub {
     owner = "markfasheh";
     repo = "duperemove";
     rev = "v${version}";
-    sha256 = "1fll0xjg1p3pabgjiddild4ragk9spbdmdzrkq0hv5pxb1qrv7lp";
+    sha256 = "09bwpsvnppl9bm2l5pym5673x04ah3hddb0xip61gdq8ws3ri5yj";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/tools/package-management/xbps/cert-paths.patch b/pkgs/tools/package-management/xbps/cert-paths.patch
new file mode 100644
index 00000000000..569161d9f2e
--- /dev/null
+++ b/pkgs/tools/package-management/xbps/cert-paths.patch
@@ -0,0 +1,25 @@
+From d13a550dbc8876c35b912fe3e0eadd45b278be27 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Fri, 18 May 2018 09:51:48 -0500
+Subject: [PATCH] add certificate path fallbacks
+
+---
+ lib/fetch/common.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/fetch/common.c b/lib/fetch/common.c
+index 94fb2651..79b50115 100644
+--- a/lib/fetch/common.c
++++ b/lib/fetch/common.c
+@@ -1012,6 +1012,8 @@ fetch_ssl_setup_peer_verification(SSL_CTX *ctx, int verbose)
+ 
+ 	if (getenv("SSL_NO_VERIFY_PEER") == NULL) {
+ 		ca_cert_file = getenv("SSL_CA_CERT_FILE");
++		ca_cert_file = ca_cert_file ? ca_cert_file : getenv("NIX_SSL_CERT_FILE");
++		ca_cert_file = ca_cert_file ? ca_cert_file : "/etc/ssl/certs/ca-certificates.crt";
+ 		ca_cert_path = getenv("SSL_CA_CERT_PATH") != NULL ?
+ 		    getenv("SSL_CA_CERT_PATH") : X509_get_default_cert_dir();
+ 		if (verbose) {
+-- 
+2.17.0
+
diff --git a/pkgs/tools/package-management/xbps/default.nix b/pkgs/tools/package-management/xbps/default.nix
new file mode 100644
index 00000000000..dbcd9dafbef
--- /dev/null
+++ b/pkgs/tools/package-management/xbps/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchFromGitHub, pkgconfig, which, zlib, openssl, libarchive }:
+
+stdenv.mkDerivation rec {
+  name = "xbps-${version}";
+  version = "0.52";
+
+  src = fetchFromGitHub {
+    owner = "voidlinux";
+    repo = "xbps";
+    rev = version;
+    sha256 = "1sf6iy9l3dijsczsngzbhksshfm1374g2rrdasc04l6gz35l2cdp";
+  };
+
+  nativeBuildInputs = [ pkgconfig which ];
+
+  buildInputs = [ zlib openssl libarchive ];
+
+  patches = [ ./cert-paths.patch ];
+
+  postPatch = ''
+    # fix unprefixed ranlib (needed on cross)
+    substituteInPlace lib/Makefile \
+      --replace 'SILENT}ranlib ' 'SILENT}$(RANLIB) '
+
+    # Don't try to install keys to /var/db/xbps, put in $out/share for now
+    substituteInPlace data/Makefile \
+      --replace '$(DESTDIR)/$(DBDIR)' '$(DESTDIR)/$(SHAREDIR)'
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/voidlinux/xbps;
+    description = "The X Binary Package System";
+    platforms = platforms.linux; # known to not work on Darwin, at least
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ dtzWill ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f74f0a384cc..0d919a3d319 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21114,6 +21114,8 @@ with pkgs;
 
   xboxdrv = callPackage ../misc/drivers/xboxdrv { };
 
+  xbps = callPackage ../tools/package-management/xbps { };
+
   xcftools = callPackage ../tools/graphics/xcftools { };
 
   xhyve = callPackage ../applications/virtualization/xhyve {
@@ -21314,6 +21316,10 @@ with pkgs;
 
   teseq = callPackage ../applications/misc/teseq {  };
 
+  ape = callPackage ../applications/misc/ape { };
+  attemptoClex = callPackage ../applications/misc/ape/clex.nix { };
+  apeClex = callPackage ../applications/misc/ape/apeclex.nix { };
+
   # Unix tools
   unixtools = recurseIntoAttrs (callPackages ./unix-tools.nix { });
   inherit (unixtools) hexdump ps logger eject umount