Changelog: https://www.ruby-lang.org/en/news/2020/03/31/ruby-2-5-8-released/
(cherry picked from commit 99b09d6b8f201379bb34f01a1acacdc1c3950c46)

(cherry picked from commit c13f1a508d6128d7cdea247d21015b5df8e44132)

Changelog: https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-5-7-released/
(cherry picked from commit 5e76e7b4301981d4118337c8f9a14a27cc5c7995)

Changelog:
- https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-4-8-released/
- https://www.ruby-lang.org/en/news/2019/10/02/ruby-2-4-9-released/

(cherry picked from commit 5ed9d8b8aaa1ce53b658704e075387678ba19222)

Build was failing because we were depending on tagged versions of
the deblobbing scripts. The tags are not updated and thus newer
changes required won't be reflected unless the tag is re-created, which
might not be reliably the case.

So bumping revision and switching to use the branches to access the
deblob scripts.

For context, in our case the missing change is:

--- /nix/store/sfc0rrhj5l44zpqgpsymq5750k5wzg8p-tags-r16790/4.19-gnu/deblob-4.19 1970-01-01 01:00:01.000000000 +0100
+++ ../deblob-4.19 2019-09-14 14:53:44.637404289 +0200
@@ -1879,7 +1879,11 @@

announce BRCMFMAC - "Broadcom IEEE802.11n embedded FullMAC WLAN driver"
reject_firmware drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
-reject_firmware drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+if grep -q firmware_request_nowarn drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c; then
+ reject_firmware_nowarn drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+else
+ reject_firmware drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+fi
clean_blob drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
clean_blob drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.h

(cherry picked from commit 2a8f7d71ce88983f14936b76a1d18ef432d65883)

This change is needed because the order of profiles correlate to the
order in PATH, therefore "/etc/profiles/per-user/$USER" always appeared
after the system packages directories.

(cherry picked from commit 33c834f2fb2c25f2351cd0ae9b8cc361e033141b)

GDK_PIXBUF_MODULE_FILE is often set to a nix store path not available in a app
sandbox. This can cause some apps to fail launching, simply reset this env var
when running applications.

fixes https://github.com/NixOS/nixpkgs/issues/53441

(cherry picked from commit 752e176d67e41b6b1d2da20a0c9c70079fe56a60)
(cherry picked from commit be89fd6a038292c381557ecdfa67e3ceea4b2f97)

(cherry picked from commit 179ab1985629ff13b4445e1d75897f657aa2ceac)

(cherry picked from commit e884852ac4c4e179a0bcfd8cfb52b4d0f3b9c018)

cc #64144

(cherry picked from commit 73b5a2531c44228e6368a6d0eb4803fe6f372c3e)

(cherry picked from commit e95bbcf5f85bfd32c5ac95db01a27e86c403b806)

(cherry picked from commit 0d62805dbf966021147019ed8e6ab8ef4d66ac94)
The patch is fairly simple and the vulnerability seems important.

[18.09] php: 7.1.29 -> 7.1.30, 7.2.18 -> 7.2.19

Changelog: https://php.net/index.php#id2019-05-30-2
(cherry picked from commit 639e146de1b8bd85730eeaf950d5b7bc20ffe495)

Changelog: https://php.net/index.php#id2019-05-30-3
(cherry picked from commit 1d92bec20554c4e28322813db059d211c46ddf91)

Only includes a small fix for the login into the Robot Web interface,
which is used to eg. provide access to admin accounts (which in turn is
used by the NixOps Hetzner backend).

Signed-off-by: aszlig <aszlig@nix.build>
(cherry picked from commit 56009d4a8d0a7b9d424fea78b300fee3c92d21d5)

(cherry picked from commit e289798ec86d63b46d01d17d1980c3efc203ecd8)

(cherry picked from commit b5c73e967c8a909e8bcede646a8597aa7e6990d9)

(cherry picked from commit e9ec2f1f2953ea4abca53ad6ada41d7672031d32)

(cherry picked from commit 08aae882b6ad774146dcd6ed4023a566a3140785)

Current URL is no longer available.

(cherry picked from commit 6e100ae88f1096ec8c3dbc72e2b2e587c3a08d64)

[18.09] spectre-meltdown-checker: 0.39 -> 0.41

https://github.com/speed47/spectre-meltdown-checker/releases/tag/v0.41
(cherry picked from commit f5b400b875f42a6fbf01564534e74063ec53d7a9)

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/spectre-meltdown-checker/versions

(cherry picked from commit 4ca9524e987d2396c9a7aa4b44c205c7346bd2a6)

[r18.09] leptonica: patch multiple CVEs

this should fix CVE-2018-3836, CVE-2018-7186, CVE-2018-7247 & CVE-2018-7440

a fix for CVE-2018-7441 & CVE-2018-7442 is *not* included as its patches
are very wide-ranging

also enable tests to give confidence that I'm not completely butchering
the code

(cherry-picked from commit 0861ad591a96ad7246335c9cb35f51126874ea12)

ffmpeg-full: nvenc doesn't imply nonfree licensing

[18.09] php: 7.1.27 -> 7.1.29, 7.2.16 -> 7.2.18

(cherry picked from commit 5ee553b2800bc78fb826d291c6d993f3d8052f48)

(cherry picked from commit 7d0a77cd3618df6c873c769a6a4bcd2698c6b625)

(cherry picked from commit a03324e9baadde07c5f0063a4c6c065416865c85)

I verified the hash did NOT change as suggested in #60699.

(cherry picked from commit 0b9c477719e23606417a73f3522dd2186715d04b)

Changelog: https://www.php.net/ChangeLog-7.php#7.2.18
(cherry picked from commit 6f3625a1c6f30a19788dbd3c444dadc1d295eb74)

security release, see announcement:
https://www.php.net/archive/2019.php#id2019-04-04-2

(cherry picked from commit 76394e36ec367b8d75cb1b4352687e3692ab2854)

Changelog: https://www.php.net/ChangeLog-7.php#7.1.29
(cherry picked from commit 2a0125c0cefc4ee6204a844e7d71bab6727063d9)

security release:
https://www.php.net/archive/2019.php#id2019-04-04-3

(cherry picked from commit b8446dcc57e0fb4d2eae3becd9c51ad77bcba0de)

texlive attribute was accidentally added in attrset wrapped with

stdenv.lib.optionalAttrs (!stdenv.isDarwin)

Fixes: dbc2c1c4b8 ('texlive: add missing perl dependencies for latexindent')
(cherry picked from commit b6d0bdf5136031b49d174e638e7d0bdc8c5e5a12)

(cherry picked from commit dbc2c1c4b8e4d82a3c8ef3ef5fe76d84ac07766d)

cc #59537

(cherry picked from commit 5d03bfd653b28bf0a8b39d45420e60da6d91fbe0)

(cherry picked from commit e0bf73dbde74e66167bd9ccf385a1fbc228c4036)

(cherry picked from commit 9d7638371fbc59fc916c32a5d8e9308dace29e6a)

[18.09] thin-provisioning-tools: fix patch url

Void Linux changed its github organization from "voidlinux" to "void-linux"
See: https://voidlinux.org/news/2018/06/GitHub-Organisation-is-moving.html

(cherry picked from commit 898f34a059d843d0421cc7d7670d19ff77867496)

[18.09] bind: 9.12.3-P4 -> 9.12.4-P1

Upstream added a commit [1] right after the release that fixes the
aarch64 atomic operation linker issue we have been seeing [2].

[1] https://gitlab.isc.org/isc-projects/bind9/commit/d72f436b7d7c697b262968c48c2d7643069ab17f
[2] https://github.com/NixOS/nixpkgs/issues/60301#issue-437896459

(cherry picked from commit 37dd347cd31c9eeecf991bc062c00ca6f8b9dee4)