diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index 7db09fc550e..6947d41419e 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -279,8 +279,14 @@ rec {
     "2" = # We only do 2-part hacks for things Nix already supports
       if elemAt l 1 == "cygwin"
         then { cpu = elemAt l 0;                      kernel = "windows";  abi = "cygnus";   }
+      # MSVC ought to be the default ABI so this case isn't needed. But then it
+      # becomes difficult to handle the gnu* variants for Aarch32 correctly for
+      # minGW. So it's easier to make gnu* the default for the MinGW, but
+      # hack-in MSVC for the non-MinGW case right here.
+      else if elemAt l 1 == "windows"
+        then { cpu = elemAt l 0;                      kernel = "windows";  abi = "msvc";     }
       else if (elemAt l 1) == "elf"
-      then { cpu = elemAt l 0; vendor = "unknown";    kernel = "none";     abi = elemAt l 1; }
+        then { cpu = elemAt l 0; vendor = "unknown";  kernel = "none";     abi = elemAt l 1; }
       else   { cpu = elemAt l 0;                      kernel = elemAt l 1;                   };
     "3" = # Awkwards hacks, beware!
       if elemAt l 1 == "apple"
@@ -288,7 +294,7 @@ rec {
       else if (elemAt l 1 == "linux") || (elemAt l 2 == "gnu")
         then { cpu = elemAt l 0;                      kernel = elemAt l 1; abi = elemAt l 2; }
       else if (elemAt l 2 == "mingw32") # autotools breaks on -gnu for window
-        then { cpu = elemAt l 0; vendor = elemAt l 1; kernel = "windows";  abi = "gnu"; }
+        then { cpu = elemAt l 0; vendor = elemAt l 1; kernel = "windows";                    }
       else if hasPrefix "netbsd" (elemAt l 2)
         then { cpu = elemAt l 0; vendor = elemAt l 1;    kernel = elemAt l 2;                }
       else if (elem (elemAt l 2) ["eabi" "eabihf" "elf"])
@@ -324,13 +330,12 @@ rec {
                else                                   getKernel args.kernel;
       abi =
         /**/ if args ? abi       then getAbi args.abi
-        else if isLinux   parsed then
+        else if isLinux parsed || isWindows parsed then
           if isAarch32 parsed then
             if lib.versionAtLeast (parsed.cpu.version or "0") "6"
             then abis.gnueabihf
             else abis.gnueabi
           else abis.gnu
-        else if isWindows parsed then abis.gnu
         else                     abis.unknown;
     };
 
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index fd77f637272..001505320c0 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -93,6 +93,7 @@ in
         VERSION_CODENAME=${toLower cfg.codeName}
         VERSION_ID="${cfg.version}"
         PRETTY_NAME="NixOS ${cfg.version} (${cfg.codeName})"
+        LOGO="nix-snowflake"
         HOME_URL="https://nixos.org/"
         SUPPORT_URL="https://nixos.org/nixos/support.html"
         BUG_REPORT_URL="https://github.com/NixOS/nixpkgs/issues"
diff --git a/pkgs/applications/audio/musescore/default.nix b/pkgs/applications/audio/musescore/default.nix
index 28381fcfee6..340978c8183 100644
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@@ -1,20 +1,24 @@
 { stdenv, lib, fetchFromGitHub, cmake, pkgconfig
 , alsaLib, freetype, libjack2, lame, libogg, libpulseaudio, libsndfile, libvorbis
 , portaudio, portmidi, qtbase, qtdeclarative, qtscript, qtsvg, qttools
-, qtwebkit, qtxmlpatterns
+, qtwebengine, qtxmlpatterns
 }:
 
 stdenv.mkDerivation rec {
   name = "musescore-${version}";
-  version = "2.3.2";
+  version = "3.0";
 
   src = fetchFromGitHub {
     owner  = "musescore";
     repo   = "MuseScore";
     rev    = "v${version}";
-    sha256 = "0ncv0xfmq87plqa43cm0fpidlwzz1nq5s7h7139llrbc36yp3pr1";
+    sha256 = "0g8n8xpw5d6wh8bwbvy12sinl9i0ir009sr28i4izr28lr4x8v50";
   };
 
+  patches = [
+    ./remove_qtwebengine_install_hack.patch
+  ];
+
   cmakeFlags = [
   ] ++ lib.optional (lib.versionAtLeast freetype.version "2.5.2") "-DUSE_SYSTEM_FREETYPE=ON";
 
@@ -23,7 +27,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     alsaLib libjack2 freetype lame libogg libpulseaudio libsndfile libvorbis
     portaudio portmidi # tesseract
-    qtbase qtdeclarative qtscript qtsvg qttools qtwebkit qtxmlpatterns
+    qtbase qtdeclarative qtscript qtsvg qttools qtwebengine qtxmlpatterns
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/audio/musescore/remove_qtwebengine_install_hack.patch b/pkgs/applications/audio/musescore/remove_qtwebengine_install_hack.patch
new file mode 100644
index 00000000000..53a0c90ce46
--- /dev/null
+++ b/pkgs/applications/audio/musescore/remove_qtwebengine_install_hack.patch
@@ -0,0 +1,25 @@
+--- a/mscore/CMakeLists.txt
++++ b/mscore/CMakeLists.txt
+@@ -660,22 +660,6 @@ if (MINGW)
+ else (MINGW)
+
+    if ( NOT MSVC )
+-## install qwebengine core
+-      if (NOT APPLE AND USE_WEBENGINE)
+-         install(FILES
+-            ${QT_INSTALL_LIBEXECS}/QtWebEngineProcess
+-            DESTINATION bin
+-            )
+-         install(DIRECTORY
+-            ${QT_INSTALL_DATA}/resources
+-            DESTINATION lib/qt5
+-            )
+-         install(DIRECTORY
+-            ${QT_INSTALL_TRANSLATIONS}/qtwebengine_locales
+-            DESTINATION lib/qt5/translations
+-            )
+-      endif(NOT APPLE AND USE_WEBENGINE)
+-
+       target_link_libraries(mscore
+          ${ALSA_LIB}
+          ${QT_LIBRARIES}
diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index 50a81890789..5ef64b2b801 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -2,20 +2,20 @@
 
 stdenv.mkDerivation rec {
   name = "gpxsee-${version}";
-  version = "6.3";
+  version = "7.1";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "0kbnmcis04kjqkd0msfjd8rdmdf23c71dpzx9wcpf2yadc9rv4c9";
+    sha256 = "1dgag8j3566qwiz1pschfq2wqdp7y1pr4cm9na4zwrdjhn3ci6v5";
   };
 
   nativeBuildInputs = [ qmake ];
   buildInputs = [ qttools ];
 
   preConfigure = ''
-    substituteInPlace src/config.h --replace /usr/share/gpxsee $out/share/gpxsee
+    substituteInPlace src/common/programpaths.cpp --replace /usr/share/ $out/share/
     lrelease lang/*.ts
   '';
 
@@ -31,11 +31,11 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    homepage = http://www.gpxsee.org/;
+    homepage = https://www.gpxsee.org/;
     description = "GPX viewer and analyzer";
     longDescription = ''
       GPXSee is a Qt-based GPS log file viewer and analyzer that supports GPX,
-      TCX, KML, FIT, IGC and NMEA files.
+      TCX, KML, FIT, IGC, NMEA, SLF, LOC and OziExplorer files.
     '';
     license = licenses.gpl3;
     maintainers = [ maintainers.womfoo ];
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index b53c7b910f6..d36f8eb16d2 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -24,11 +24,11 @@ let
   gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
 in stdenv.mkDerivation rec {
   name = "thunderbird-${version}";
-  version = "60.3.3";
+  version = "60.4.0";
 
   src = fetchurl {
     url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-    sha512 = "04m6mgm4nfnq3nfkv0d1al5b7bw95kfcjpyd7aschqi6wnn21g8qacx42ynj89i5l9vc1jx8nz0wy266sy6x5iv9q585c6l6j9gvkrh";
+    sha512 = "0flg3j0bvgpyk4wbb8d17yl8rddww7q9m9n5brqx1jlj0vjk8lrf8awvxxhn5ssyhy2ys2sklnw75y35hnws3hijs8l9l8ahznfqjq8";
   };
 
   # from firefox, but without sound libraries
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index eca07b81bac..4579c9a83b5 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -7,13 +7,13 @@ with stdenv.lib;
 
 buildGoPackage rec {
   name = "gitea-${version}";
-  version = "1.6.2";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     rev = "v${version}";
-    sha256 = "1ijxpihdg8k6gs1xpim0iviqakvjadjzp0a5ki2czykilnyg8y85";
+    sha256 = "02d37mh1qxsq9lc9ylk5sgdlc1cgwh6fri077crk43mnyb5lhj3j";
     # Required to generate the same checksum on MacOS due to unicode encoding differences
     # More information: https://github.com/NixOS/nixpkgs/pull/48128
     extraPostFetch = ''
diff --git a/pkgs/development/beam-modules/default.nix b/pkgs/development/beam-modules/default.nix
index c5be1c78a55..f71379459dc 100644
--- a/pkgs/development/beam-modules/default.nix
+++ b/pkgs/development/beam-modules/default.nix
@@ -44,6 +44,11 @@ let
         # BEAM-based languages.
         elixir = elixir_1_7;
 
+        elixir_1_8 = lib.callElixir ../interpreters/elixir/1.8.nix {
+          inherit rebar erlang;
+          debugInfo = true;
+        };
+
         elixir_1_7 = lib.callElixir ../interpreters/elixir/1.7.nix {
           inherit rebar erlang;
           debugInfo = true;
@@ -64,10 +69,8 @@ let
           debugInfo = true;
         };
 
-        elixir_1_3 = lib.callElixir ../interpreters/elixir/1.3.nix {
-          inherit rebar erlang;
-          debugInfo = true;
-        };
+        # Remove old versions of elixir, when the supports fades out:
+        #   https://hexdocs.pm/elixir/compatibility-and-deprecations.html
 
         lfe = lfe_1_2;
         lfe_1_2 = lib.callLFE ../interpreters/lfe/1.2.nix { inherit erlang buildRebar3 buildHex; };
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 1ef6dd06570..3283555cd6e 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   name    = "sbcl-${version}";
-  version = "1.4.13";
+  version = "1.4.15";
 
   src = fetchurl {
     url    = "mirror://sourceforge/project/sbcl/sbcl/${version}/${name}-source.tar.bz2";
-    sha256 = "120rnnz8367lk7ljqlf8xidm4b0d738xqsib4kq0q5ms5r7fzgvm";
+    sha256 = "0bipl4gsvpcifi6vkqm5636i3219mk1bl99px4xh5l1q2g7knv28";
   };
 
   buildInputs = [texinfo];
diff --git a/pkgs/development/interpreters/elixir/1.3.nix b/pkgs/development/interpreters/elixir/1.3.nix
deleted file mode 100644
index 43d48e2cf7c..00000000000
--- a/pkgs/development/interpreters/elixir/1.3.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{ mkDerivation }:
-
-mkDerivation rec {
-  version = "1.3.4";
-  sha256 = "01qqv1ghvfadcwcr5p88w8j217cgaf094pmpqllij3l0q1yg104l";
-  minimumOTPVersion = "18";
-}
diff --git a/pkgs/development/interpreters/elixir/1.8.nix b/pkgs/development/interpreters/elixir/1.8.nix
new file mode 100644
index 00000000000..65c008f8ac6
--- /dev/null
+++ b/pkgs/development/interpreters/elixir/1.8.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+
+mkDerivation rec {
+  version = "1.8.0-rc.1";
+  sha256 = "06k9q46cwn79ic6kw0b0mskf9rqlgm02jb8n1ajz55kmw134kq6m";
+  minimumOTPVersion = "20";
+}
diff --git a/pkgs/development/libraries/libcdr/default.nix b/pkgs/development/libraries/libcdr/default.nix
index 5e46f4dc699..f7276d39b14 100644
--- a/pkgs/development/libraries/libcdr/default.nix
+++ b/pkgs/development/libraries/libcdr/default.nix
@@ -1,25 +1,17 @@
 { stdenv, fetchurl, libwpg, libwpd, lcms, pkgconfig, librevenge, icu, boost, cppunit }:
 
 stdenv.mkDerivation rec {
-  name = "libcdr-0.1.4";
+  name = "libcdr-0.1.5";
 
   src = fetchurl {
     url = "https://dev-www.libreoffice.org/src/${name}.tar.xz";
-    sha256 = "0vd6likgk51j46llybkx4wq3674xzrhp0k82220pkx9x1aqfi9z7";
+    sha256 = "0j1skr11jwvafn0l6p37v3i4lqc8wcn489g8f7c4mqwbk94mrkka";
   };
 
   buildInputs = [ libwpg libwpd lcms librevenge icu boost cppunit ];
 
   nativeBuildInputs = [ pkgconfig ];
 
-  # Boost 1.59 compatability fix
-  # Attempt removing when updating
-  postPatch = ''
-    sed -i 's,^CPPFLAGS.*,\0 -DBOOST_ERROR_CODE_HEADER_ONLY -DBOOST_SYSTEM_NO_DEPRECATED,' src/lib/Makefile.in
-  '';
-
-  configureFlags = stdenv.lib.optional stdenv.cc.isClang "--disable-werror";
-
   CXXFLAGS="--std=gnu++0x"; # For c++11 constants in lcms2.h
 
   meta = {
diff --git a/pkgs/development/python-modules/cbor/default.nix b/pkgs/development/python-modules/cbor/default.nix
new file mode 100644
index 00000000000..360872c0f89
--- /dev/null
+++ b/pkgs/development/python-modules/cbor/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "cbor";
+  version = "1.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1dmv163cnslyqccrybkxn0c9s1jk1mmafmgxv75iamnz5lk5l8hk";
+  };
+
+  # Tests are excluded from PyPI and four unit tests are also broken:
+  # https://github.com/brianolson/cbor_py/issues/6
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    homepage = https://bitbucket.org/bodhisnarkva/cbor;
+    description = "Concise Binary Object Representation (CBOR) library";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ geistesk ];
+  };
+}
diff --git a/pkgs/development/python-modules/django_redis/default.nix b/pkgs/development/python-modules/django_redis/default.nix
index e50b1e1cb65..85761be9ba5 100644
--- a/pkgs/development/python-modules/django_redis/default.nix
+++ b/pkgs/development/python-modules/django_redis/default.nix
@@ -2,11 +2,11 @@
   mock, django, redis, msgpack }:
 buildPythonPackage rec {
   pname = "django-redis";
-  version = "4.9.1";
+  version = "4.10.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "93fc0f73b0c1736546a979a4996826b2c430f56f7e4176df40ef53b9cb0e4f36";
+    sha256 = "1rxcwnv9ik0swkwvfqdi9i9baw6n8if5pj6q63fjh4p9chw3j2xg";
   };
 
   doCheck = false;
diff --git a/pkgs/development/python-modules/faker/default.nix b/pkgs/development/python-modules/faker/default.nix
index 515bd9e99bb..9a46d9611e0 100644
--- a/pkgs/development/python-modules/faker/default.nix
+++ b/pkgs/development/python-modules/faker/default.nix
@@ -8,11 +8,11 @@ assert pythonOlder "3.3" -> ipaddress != null;
 
 buildPythonPackage rec {
   pname = "Faker";
-  version = "0.9.3";
+  version = "1.0.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8c6df7903c7b4a51f4ac273bc5fec79a249e3220c47b35d1ac1175b41982d772";
+    sha256 = "067mdy9p1vbkypr3vazmrb0sga6maqbk542hr7hmzcb5lp3dr8sj";
   };
 
   buildInputs = [ pytestrunner ];
diff --git a/pkgs/development/python-modules/node-semver/default.nix b/pkgs/development/python-modules/node-semver/default.nix
index 004ec42718e..34a81a66ec9 100644
--- a/pkgs/development/python-modules/node-semver/default.nix
+++ b/pkgs/development/python-modules/node-semver/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchPypi, buildPythonPackage, pytest }:
 
 buildPythonPackage rec {
-  version = "0.5.1";
+  version = "0.6.1";
   pname = "node-semver";
 
   checkInputs = [ pytest ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b87e335179d874a3dd58041198b2715ae70fd20eba81683acde3553c51b28f8e";
+    sha256 = "1dv6mjsm67l1razcgmq66riqmsb36wns17mnipqr610v0z0zf5j0";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/python-modules/pdf2image/default.nix b/pkgs/development/python-modules/pdf2image/default.nix
index 1af93531daa..32a4581676b 100644
--- a/pkgs/development/python-modules/pdf2image/default.nix
+++ b/pkgs/development/python-modules/pdf2image/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonPackage rec {
   pname = "pdf2image";
-  version = "1.0.0";
+  version = "1.3.1";
 
-  buildInputs = [ pillow poppler_utils ];
+  propagatedBuildInputs = [ pillow poppler_utils ];
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "74607efb48a9e95289148d70af05a53dbef192010a44ac868437fb044842697d";
+    sha256 = "0igkzl12582iq6bh6dycw9bcz2459rs6gybq9mranj54yfgjl2ky";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/clang-tools/default.nix b/pkgs/development/tools/clang-tools/default.nix
index 2ababe85d0c..42bcf7fd055 100644
--- a/pkgs/development/tools/clang-tools/default.nix
+++ b/pkgs/development/tools/clang-tools/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, writeScript, llvmPackages_latest }:
+{ stdenv, writeScript, llvmPackages }:
 
 let
-  clang = llvmPackages_latest.clang-unwrapped;
+  clang = llvmPackages.clang-unwrapped;
   version = stdenv.lib.getVersion clang;
 in
 
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index d712ea99578..e8d272622ce 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -6,8 +6,8 @@ let
   };
 in {
   fuse_2 = mkFuse {
-    version = "2.9.8";
-    sha256Hash = "0s04ln4k9zvvbjih8ybaa19fxg8xv7dcsz2yrlbk35psnf3l67af";
+    version = "2.9.9";
+    sha256Hash = "1yxxvm58c30pc022nl1wlg8fljqpmwnchkywic3r74zirvlcq23n";
   };
 
   fuse_3 = mkFuse {
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index e424dff596d..3f6479c572b 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -4,6 +4,9 @@
 , perl
 , bison ? null
 , flex ? null
+, gmp ? null
+, libmpc ? null
+, mpfr ? null
 , stdenv
 
 , # The kernel source tarball.
@@ -89,7 +92,7 @@ let
     passAsFile = [ "kernelConfig" ];
 
     depsBuildBuild = [ buildPackages.stdenv.cc ];
-    nativeBuildInputs = [ perl ]
+    nativeBuildInputs = [ perl gmp libmpc mpfr ]
       ++ lib.optionals (stdenv.lib.versionAtLeast version "4.16") [ bison flex ];
 
     platformName = stdenv.hostPlatform.platform.name;
@@ -112,7 +115,10 @@ let
       export buildRoot="''${buildRoot:-build}"
 
       # Get a basic config file for later refinement with $generateConfig.
-      make HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc -C . O="$buildRoot" $kernelBaseConfig ARCH=$kernelArch
+      make -C .  O="$buildRoot" $kernelBaseConfig \
+          ARCH=$kernelArch \
+          HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc \
+          HOSTCXX=${buildPackages.stdenv.cc.targetPrefix}g++
 
       # Create the config file.
       echo "generating kernel configuration..."
diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix
index 84d1dd8a378..9d28b3edf85 100644
--- a/pkgs/os-specific/linux/kernel/hardened-config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened-config.nix
@@ -103,17 +103,18 @@ PAGE_POISONING_ZERO y
 PANIC_ON_OOPS y
 PANIC_TIMEOUT -1
 
-${optionalString (versionOlder version "4.18") ''
-  GCC_PLUGINS y # Enable gcc plugin options
-  # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
-  GCC_PLUGIN_LATENT_ENTROPY y
+GCC_PLUGINS y # Enable gcc plugin options
+# Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
+GCC_PLUGIN_LATENT_ENTROPY y
 
-  ${optionalString (versionAtLeast version "4.11") ''
-    GCC_PLUGIN_STRUCTLEAK y # A port of the PaX structleak plugin
-  ''}
-  ${optionalString (versionAtLeast version "4.14") ''
-    GCC_PLUGIN_STRUCTLEAK_BYREF_ALL y # Also cover structs passed by address
-  ''}
+${optionalString (versionAtLeast version "4.11") ''
+  GCC_PLUGIN_STRUCTLEAK y # A port of the PaX structleak plugin
+''}
+${optionalString (versionAtLeast version "4.14") ''
+  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL y # Also cover structs passed by address
+''}
+${optionalString (versionAtLeast version "4.20") ''
+  GCC_PLUGIN_STACKLEAK y # A port of the PaX stackleak plugin
 ''}
 
 # Disable various dangerous settings
diff --git a/pkgs/tools/X11/xpointerbarrier/default.nix b/pkgs/tools/X11/xpointerbarrier/default.nix
index 50d0ac4f2b9..435f2b2e980 100644
--- a/pkgs/tools/X11/xpointerbarrier/default.nix
+++ b/pkgs/tools/X11/xpointerbarrier/default.nix
@@ -1,13 +1,11 @@
-{ stdenv, xorg, fetchFromGitHub }:
+{ stdenv, xorg, fetchgit }:
 stdenv.mkDerivation rec {
   name = "xpointerbarrier-${version}";
-  version = "17.11";
-
-  src = fetchFromGitHub {
-    owner = "vain";
-    repo = "xpointerbarrier";
+  version = "18.06";
+  src = fetchgit {
+    url = "https://www.uninformativ.de/git/xpointerbarrier.git";
     rev = "v${version}";
-    sha256 = "0s6bd58xjyc2nqzjq6aglx6z64x9xavda3i6p8vrmxqmcpik54nm";
+    sha256 = "1k7i641x18qhjm0llsaqn2h2g9k31kgv6p8sildllmbvgxyrgvq7";
   };
 
   buildInputs = [ xorg.libX11 xorg.libXfixes xorg.libXrandr ];
@@ -15,7 +13,7 @@ stdenv.mkDerivation rec {
   makeFlags = "prefix=$(out)";
 
   meta = {
-    homepage = https://github.com/vain/xpointerbarrier;
+    homepage = https://uninformativ.de/git/xpointerbarrier;
     description = "Create X11 pointer barriers around your working area";
     license = stdenv.lib.licenses.mit;
     maintainers = [ stdenv.lib.maintainers.xzfc ];
diff --git a/pkgs/tools/misc/plantuml/default.nix b/pkgs/tools/misc/plantuml/default.nix
index c3d3f916d97..19cc8805b1c 100644
--- a/pkgs/tools/misc/plantuml/default.nix
+++ b/pkgs/tools/misc/plantuml/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, jre, graphviz }:
 
 stdenv.mkDerivation rec {
-  version = "1.2018.13";
+  version = "1.2018.14";
   name = "plantuml-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/plantuml/${version}/plantuml.${version}.jar";
-    sha256 = "181wm05gp4hs4g0z345pp1x9w1g5bx1vpipkhnwvmy4vdj17b4bg";
+    sha256 = "0alsrip25w3hy7h9rryrm7isl6jyk1spdm6bqgbmbscla7vq960y";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/system/fakeroot/default.nix b/pkgs/tools/system/fakeroot/default.nix
index 8796de4e9e0..1a16a8a34c7 100644
--- a/pkgs/tools/system/fakeroot/default.nix
+++ b/pkgs/tools/system/fakeroot/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch, getopt, libcap }:
+{ stdenv, fetchurl, fetchpatch, getopt, libcap, gnused }:
 
 stdenv.mkDerivation rec {
   version = "1.23";
@@ -29,14 +29,12 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [ getopt ]
+  buildInputs = [ getopt gnused ]
     ++ stdenv.lib.optional (!stdenv.isDarwin) libcap
     ;
 
   postUnpack = ''
-    for prog in getopt; do
-      sed -i "s@getopt@$(type -p getopt)@g" ${name}/scripts/fakeroot.in
-    done
+    sed -i -e "s@getopt@$(type -p getopt)@g" -e "s@sed@$(type -p sed)@g" ${name}/scripts/fakeroot.in
   '';
 
   meta = {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 29c8dad3fd0..5401ff3c29b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6641,7 +6641,9 @@ in
   clang_37 = llvmPackages_37.clang;
   clang_35 = wrapCC llvmPackages_35.clang;
 
-  clang-tools = callPackage ../development/tools/clang-tools { };
+  clang-tools = callPackage ../development/tools/clang-tools {
+    llvmPackages = llvmPackages_latest;
+  };
 
   clang-analyzer = callPackage ../development/tools/analysis/clang-analyzer { };
 
@@ -7674,7 +7676,7 @@ in
   inherit (beam.interpreters)
     erlang erlangR18 erlangR19 erlangR20 erlangR21
     erlang_odbc erlang_javac erlang_odbc_javac erlang_nox erlang_basho_R16B02
-    elixir elixir_1_7 elixir_1_6 elixir_1_5 elixir_1_4 elixir_1_3
+    elixir elixir_1_8 elixir_1_7 elixir_1_6 elixir_1_5 elixir_1_4
     lfe lfe_1_2;
 
   inherit (beam.packages.erlang)
diff --git a/pkgs/top-level/beam-packages.nix b/pkgs/top-level/beam-packages.nix
index 85bdc59e6db..f05cf3d9290 100644
--- a/pkgs/top-level/beam-packages.nix
+++ b/pkgs/top-level/beam-packages.nix
@@ -61,7 +61,7 @@ rec {
     # Other Beam languages. These are built with `beam.interpreters.erlang`. To
     # access for example elixir built with different version of Erlang, use
     # `beam.packages.erlangR19.elixir`.
-    inherit (packages.erlang) elixir elixir_1_7 elixir_1_6 elixir_1_5 elixir_1_4 elixir_1_3;
+    inherit (packages.erlang) elixir elixir_1_8 elixir_1_7 elixir_1_6 elixir_1_5 elixir_1_4;
 
     inherit (packages.erlang) lfe lfe_1_2;
   };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 46c50dce9e0..bcf3c03a2d0 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1194,6 +1194,8 @@ in {
 
   case = callPackage ../development/python-modules/case {};
 
+  cbor = callPackage ../development/python-modules/cbor {};
+
   cassandra-driver = callPackage ../development/python-modules/cassandra-driver { };
 
   cccolutils = callPackage ../development/python-modules/cccolutils {};