diff --git a/.bazelrc b/.bazelrc
index f12de97eaaf8..03683097421b 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -14,6 +14,9 @@ build:darwin --disk_cache=.bazel-cache
 # This will become the default in a future Bazel release.
 build --experimental_strict_action_env
 
+# Required for node_modules trees generated by yarn_install.
+common --experimental_allow_incremental_repository_updates
+
 # Print test output of failed test.
 # Set --test_output=streamed to get the output of all tests in real time.
 # Note, this will force tests to run locally and sequentially.
@@ -89,15 +92,6 @@ build:darwin --protocopt=--include_source_info
 # https://github.com/protocolbuffers/protobuf/blob/master/src/google/protobuf/compiler/command_line_interface.cc#L1363
 #build:windows --protocopt=--include_source_info
 
-# Bazel 0.24 introduced the new flag --incompatible_windows_escape_jvm_flags
-# and modified its Java launcher mechanism. rules_scala needs to be patched
-# to support this. See `bazel_tools/scala-escape-jvmflags.patch`.
-# Without this patch we get the following error on Windows:
-# `LAUNCHER ERROR: Cannot find key "escape_jvmflags" from launch data.`
-# This patch assumes `--noincompatible_windows_escape_jvm_flags`.
-# See https://github.com/bazelbuild/bazel/pull/7490
-build:windows --noincompatible_windows_escape_jvm_flags
-
 # Some tools used in tests, like postgres CLI, require cmd.exe which can be located by them
 # using ComSpec environment variable. By default it's not passed from Bazel client environment.
 test:windows --test_env=ComSpec
diff --git a/.hie-bios b/.hie-bios
index ed5761c11fec..1b4db9db48a0 100755
--- a/.hie-bios
+++ b/.hie-bios
@@ -1,26 +1,14 @@
 #!/bin/sh
 cat "$HIE_BIOS_ARGS" | sed "s/'//g" | sed "s/-qg//g" | sed "s/+RTS.*-RTS//" | sed "s|/bazel-out|bazel-out|g" | sed "s/-fexternal-interpreter//g"
 
-BAZEL_DIR=""
-case $(uname) in
-Linux)
-  BAZEL_DIR=k8-fastbuild
-  ;;
-Darwin)
-  BAZEL_DIR=darwin-fastbuild
-  ;;
-*)
-  echo "Unsupported OS: $(uname)"
-  exit 1
-  ;;
-esac
+BAZEL_GENFILES="$(bazel info bazel-genfiles)"
 
 # For now we hardcode include paths as Bazel passes the list of files explicitly
 # and does not use include paths so we cannot get it from the GHCi invocation.
 echo \
-    -ibazel-out/$BAZEL_DIR/genfiles \
-    -ibazel-out/$BAZEL_DIR/genfiles/compiler/scenario-service/protos \
-    -ibazel-out/$BAZEL_DIR/genfiles/daml-lf/archive \
+    -i"${BAZEL_GENFILES}" \
+    -i"${BAZEL_GENFILES}"/compiler/scenario-service/protos \
+    -i"${BAZEL_GENFILES}"/daml-lf/archive \
     -icompiler/daml-lf-ast/src \
     -icompiler/daml-lf-proto/src \
     -icompiler/daml-lf-reader/src \
diff --git a/BUILD b/BUILD
index 2d20887176c6..43320d969cc7 100644
--- a/BUILD
+++ b/BUILD
@@ -1,5 +1,6 @@
 package(default_visibility = ["//:__subpackages__"])
 
+load("@bazel_tools//tools/python:toolchain.bzl", "py_runtime_pair")
 load(
     "@io_tweag_rules_haskell//haskell:haskell.bzl",
     "haskell_toolchain",
@@ -58,6 +59,30 @@ c2hs_toolchain(
     c2hs = "@haskell_c2hs//:bin",
 )
 
+#
+# Python toolchain
+#
+
+py_runtime(
+    name = "nix_python3_runtime",
+    interpreter = "@python3_nix//:bin/python",
+    python_version = "PY3",
+) if not is_windows else None
+
+py_runtime_pair(
+    name = "nix_python_runtime_pair",
+    py3_runtime = ":nix_python3_runtime",
+) if not is_windows else None
+
+toolchain(
+    name = "nix_python_toolchain",
+    exec_compatible_with = [
+        "@io_tweag_rules_haskell//haskell/platforms:nixpkgs",
+    ],
+    toolchain = ":nix_python_runtime_pair",
+    toolchain_type = "@bazel_tools//tools/python:toolchain_type",
+) if not is_windows else None
+
 filegroup(
     name = "node_modules",
     srcs = glob(["node_modules/**/*"]),
diff --git a/WORKSPACE b/WORKSPACE
index 066b8a135281..3ff96857de2b 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -1,4 +1,11 @@
-workspace(name = "com_github_digital_asset_daml")
+workspace(
+    name = "com_github_digital_asset_daml",
+    managed_directories = {
+        "@npm": ["node_modules"],
+        "@daml_extension_deps": ["daml-foundations/daml-tools/daml-extension/node_modules"],
+        "@navigator_frontend_deps": ["navigator/frontend/node_modules"],
+    },
+)
 
 load("//:util.bzl", "hazel_ghclibs", "hazel_github", "hazel_github_external", "hazel_hackage")
 
@@ -735,8 +742,7 @@ load("@npm//:install_bazel_dependencies.bzl", "install_bazel_dependencies")
 
 install_bazel_dependencies()
 
-# Setup TypeScript toolchain
-load("@build_bazel_rules_typescript//:defs.bzl", "ts_setup_workspace")
+load("@npm_bazel_typescript//:defs.bzl", "ts_setup_workspace")
 
 ts_setup_workspace()
 
@@ -795,6 +801,15 @@ load("@com_github_bazelbuild_buildtools//buildifier:deps.bzl", "buildifier_depen
 
 buildifier_dependencies()
 
+nixpkgs_package(
+    name = "python3_nix",
+    attribute_path = "python3",
+    nix_file_deps = common_nix_file_deps,
+    repositories = dev_env_nix_repos,
+)
+
+register_toolchains("//:nix_python_toolchain") if not is_windows else None
+
 nixpkgs_package(
     name = "postgresql_nix",
     attribute_path = "postgresql",
diff --git a/bazel_tools/dev_env_package/dev_env_package.bzl b/bazel_tools/dev_env_package/dev_env_package.bzl
index a7cbf5fb159f..29e5e8d40294 100644
--- a/bazel_tools/dev_env_package/dev_env_package.bzl
+++ b/bazel_tools/dev_env_package/dev_env_package.bzl
@@ -25,7 +25,15 @@ def _dev_env_package_impl(ctx):
     else:
         tool_home = "../%s" % ctx.attr.nix_label.name
 
-    ctx.symlink(tool_home, ctx.path(ctx.attr.symlink_path))
+    python = ctx.which("python3")
+    if python == None:
+        python = ctx.which("python")
+    if python == None:
+        fail("Cannot find python3 executable")
+    mklinks = ctx.path(Label("//bazel_tools/dev_env_package:dev_env_package.py"))
+    res = ctx.execute([python, mklinks, tool_home, ctx.attr.symlink_path])
+    if res.return_code != 0:
+        fail("Failed to create symlinks\nstdout:{}\nstderr:{}\n".format(res.stdout, res.stderr))
 
     build_path = ctx.path("BUILD")
     build_content = _dev_env_package_build_template.format(
diff --git a/bazel_tools/dev_env_package/dev_env_package.py b/bazel_tools/dev_env_package/dev_env_package.py
new file mode 100755
index 000000000000..7ab209dcfdc2
--- /dev/null
+++ b/bazel_tools/dev_env_package/dev_env_package.py
@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+# Copyright (c) 2019 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+
+import argparse
+import os
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("source", type=str)
+    parser.add_argument("destination", type=str)
+    args = parser.parse_args()
+
+    create_symlinks(args.source, args.destination)
+
+
+def create_symlinks(source_dir, dest_dir):
+    print(os.getcwd(), source_dir, dest_dir)
+    os.makedirs(dest_dir, exist_ok=True)
+    for item in os.listdir(source_dir):
+        if item in ["BUILD", "BUILD.bazel", "WORKSPACE"]:
+            # Skip nested BUILD files as they confuse Bazel.
+            continue
+        relpath = os.path.relpath(os.path.join(source_dir, item), dest_dir)
+        print("ln -s {} {}".format(relpath, os.path.join(dest_dir, item)))
+        os.symlink(relpath, os.path.join(dest_dir, item))
+
+
+if __name__ == "__main__":
+    main()
+
diff --git a/bazel_tools/fat_cc_library.bzl b/bazel_tools/fat_cc_library.bzl
index 81b863874554..8f35acd1bf79 100644
--- a/bazel_tools/fat_cc_library.bzl
+++ b/bazel_tools/fat_cc_library.bzl
@@ -11,7 +11,7 @@ def _fat_cc_library_impl(ctx):
     # For now we assume that we have static PIC libs for all libs.
     # It should be possible to extend this but we do not have a need
     # for it so far and it would complicate things.
-    for lib in cc_info.linking_context.libraries_to_link:
+    for lib in cc_info.linking_context.libraries_to_link.to_list():
         static_lib = None
         if lib.pic_static_library:
             static_lib = lib.pic_static_library
@@ -28,7 +28,7 @@ def _fat_cc_library_impl(ctx):
     static_lib = ctx.outputs.static_library
 
     toolchain = ctx.attr._cc_toolchain[cc_common.CcToolchainInfo]
-    feature_configuration = cc_common.configure_features(cc_toolchain = toolchain)
+    feature_configuration = cc_common.configure_features(ctx = ctx, cc_toolchain = toolchain)
 
     compiler = None
     if is_darwin:
@@ -101,13 +101,7 @@ def _fat_cc_library_impl(ctx):
         linking_context = new_linking_context,
         compilation_context = cc_info.compilation_context,
     )
-    return struct(
-        # cc is a legacy provider so it needs to be handled differently.
-        # Hopefully, rules_haskell will stop depending onit at somepoint and
-        # we can stop providing both cc and CcInfo.
-        cc = input_lib.cc,
-        providers = [new_cc_info],
-    )
+    return [new_cc_info]
 
 # Shared libraries built with Bazel do not declare their dependencies on other libraries properly.
 # Instead that dependency is tracked in Bazel internally. This breaks the GHCi linker if
@@ -138,6 +132,7 @@ fat_cc_library = rule(
             default = [] if is_darwin else ["-Wl,--no-whole-archive"],
         ),
     }),
+    fragments = ["cpp"],
     outputs = {
         "dynamic_library": "lib%{name}.dll" if is_windows else "lib%{name}.so",
         "static_library": "lib%{name}.a",
diff --git a/bazel_tools/grpc-java-plugin-visibility.patch b/bazel_tools/grpc-java-plugin-visibility.patch
new file mode 100644
index 000000000000..cebfc32bbce9
--- /dev/null
+++ b/bazel_tools/grpc-java-plugin-visibility.patch
@@ -0,0 +1,16 @@
+grpc-java now only exposes the protoc plugin indirectly through a toolchain.
+However, the current implementation of //bazel_tools.proto.bzl proto_gen
+assumes direct access to the protoc plugin label.
+https://github.com/grpc/grpc-java/commit/745aa0a2f570d74e7d7fe0c72334c24e21b8ab17
+diff --git a/compiler/BUILD.bazel b/compiler/BUILD.bazel
+index ef940741d..e50ecb66c 100644
+--- a/compiler/BUILD.bazel
++++ b/compiler/BUILD.bazel
+@@ -10,6 +10,7 @@ cc_binary(
+     deps = [
+         "@com_google_protobuf//:protoc_lib",
+     ],
++    visibility = ["//visibility:public"],
+ )
+ 
+ java_library(
diff --git a/bazel_tools/haskell-windows-library-dirs.patch b/bazel_tools/haskell-windows-library-dirs.patch
index f44e7c0d3e96..11405b6f8744 100644
--- a/bazel_tools/haskell-windows-library-dirs.patch
+++ b/bazel_tools/haskell-windows-library-dirs.patch
@@ -58,13 +58,14 @@ new file mode 100644
 index 0000000..ec944e5
 --- /dev/null
 +++ b/haskell/private/cc_wrapper.bzl
-@@ -0,0 +1,50 @@
+@@ -0,0 +1,52 @@
 +load("@bazel_tools//tools/cpp:toolchain_utils.bzl", "find_cpp_toolchain")
 +load("@bazel_tools//tools/build_defs/cc:action_names.bzl", "ACTION_NAMES")
 +
 +def _cc_wrapper_impl(ctx):
 +    cc_toolchain = find_cpp_toolchain(ctx)
 +    feature_configuration = cc_common.configure_features(
++        ctx = ctx,
 +        cc_toolchain = cc_toolchain,
 +        requested_features = ctx.features,
 +        unsupported_features = ctx.disabled_features,
@@ -95,7 +96,8 @@ index 0000000..ec944e5
 +        "_cc_toolchain": attr.label(
 +            default = Label("@bazel_tools//tools/cpp:current_cc_toolchain"),
 +        ),
-+    }
++    },
++    fragments = ["cpp"],
 +)
 +
 +def cc_wrapper(name, **kwargs):
diff --git a/bazel_tools/hlint.bzl b/bazel_tools/hlint.bzl
index e099612a1f86..a00cddf1e3ae 100644
--- a/bazel_tools/hlint.bzl
+++ b/bazel_tools/hlint.bzl
@@ -34,7 +34,7 @@ def _haskell_hlint_aspect_impl(target, ctx):
     inputPaths = []
     if hasattr(ctx.rule.attr, "srcs"):
         for src in ctx.rule.attr.srcs:
-            for f in src.files:
+            for f in src.files.to_list():
                 # We want to only do native Haskell source files, which
                 # seems to involve ignoring these generated paths
                 # (the f.is_source almost always returns True)
diff --git a/bazel_tools/packaging/packaging.bzl b/bazel_tools/packaging/packaging.bzl
index 9268f0ae7c82..6ad2e8e59ffe 100644
--- a/bazel_tools/packaging/packaging.bzl
+++ b/bazel_tools/packaging/packaging.bzl
@@ -15,9 +15,8 @@ def _package_app_impl(ctx):
     tools = [ctx.executable.tar, ctx.executable.gzip] if is_windows else [ctx.executable.patchelf, ctx.executable.tar, ctx.executable.gzip]
     ctx.actions.run_shell(
         outputs = [ctx.outputs.out],
-        inputs =
-            [ctx.executable.package_app] + tools +
-            inputs.to_list(),
+        tools = [ctx.executable.package_app] + tools,
+        inputs = inputs.to_list(),
         arguments = [args],
         progress_message = "Packaging " + ctx.attr.name,
         command = """
diff --git a/bazel_tools/pom_file.bzl b/bazel_tools/pom_file.bzl
index 1c1a0c0864bb..865cf96be08a 100644
--- a/bazel_tools/pom_file.bzl
+++ b/bazel_tools/pom_file.bzl
@@ -21,7 +21,7 @@ MavenInfo = provider(
 
 _EMPTY_MAVEN_INFO = MavenInfo(
     maven_coordinates = None,
-    maven_dependencies = depset(),
+    maven_dependencies = [],
 )
 
 _MAVEN_COORDINATES_PREFIX = "maven_coordinates="
@@ -114,7 +114,7 @@ def _collect_maven_info_impl(_target, ctx):
     deps = depset([], transitive = [depset([d]) for d in _maven_coordinates(deps + exports + jars)])
     filtered_deps = [
         d
-        for d in deps
+        for d in deps.to_list()
         if not (only_external_deps and (d.split(":")[0].startswith("com.daml") or
                                         d.split(":")[0].startswith("com.digitalasset")))
     ]
diff --git a/bazel_tools/scala-escape-jvmflags.patch b/bazel_tools/scala-escape-jvmflags.patch
index f08c238c55ec..3564522e52c0 100644
--- a/bazel_tools/scala-escape-jvmflags.patch
+++ b/bazel_tools/scala-escape-jvmflags.patch
@@ -7,8 +7,8 @@ index f54a578..0d871ef 100644
              .addKeyValuePair("java_start_class", javaStartClass)
              .addKeyValuePair("classpath", classpath)
 -            .addJoinedValues("jvm_flags", " ", jvmFlags)
-+            .addKeyValuePair("escape_jvmflags", "0")
++            .addKeyValuePair("escape_jvmflags", "1")
 +            .addJoinedValues("jvm_flags", "\t", jvmFlags)
              .build();
 
-     Path launcher = Paths.get(Runfiles.create().rlocation("bazel_tools/tools/launcher/launcher.exe"));
\ No newline at end of file
+     Path launcher = Paths.get(Runfiles.create().rlocation("bazel_tools/tools/launcher/launcher.exe"));
diff --git a/bazel_tools/scala.bzl b/bazel_tools/scala.bzl
index 103bd55718c0..d889686f8d01 100644
--- a/bazel_tools/scala.bzl
+++ b/bazel_tools/scala.bzl
@@ -293,7 +293,7 @@ def _scaladoc_jar_impl(ctx):
                 # which breaks scala macros
 
             elif hasattr(p, "files"):
-                pluginPaths.extend([f for f in p.files if "-sources.jar" not in f.basename])
+                pluginPaths.extend([f for f in p.files.to_list() if "-sources.jar" not in f.basename])
 
         transitive_deps = [dep[JavaInfo].transitive_deps for dep in ctx.attr.deps]
         classpath = depset([], transitive = transitive_deps).to_list()
diff --git a/daml-assistant/BUILD.bazel b/daml-assistant/BUILD.bazel
index 6f969371cf95..f3e67c31ce76 100644
--- a/daml-assistant/BUILD.bazel
+++ b/daml-assistant/BUILD.bazel
@@ -2,14 +2,14 @@
 # SPDX-License-Identifier: Apache-2.0
 
 load("//bazel_tools:haskell.bzl", "da_haskell_binary", "da_haskell_library", "da_haskell_repl", "da_haskell_test")
-load("//bazel_tools:packaging/packaging.bzl", "package_app")
+load("//bazel_tools/packaging:packaging.bzl", "package_app")
 load("@os_info//:os_info.bzl", "is_windows")
 
 # This library is intended to be used by applications called by the assistant,
 # e.g., damlc, to get the names of the various environment variables set by the assistant.
 da_haskell_library(
     name = "daml-project-config",
-    srcs = native.glob(["daml-project-config/**/*.hs"]),
+    srcs = glob(["daml-project-config/**/*.hs"]),
     hazel_deps = [
         "base",
         "directory",
@@ -28,7 +28,7 @@ da_haskell_library(
 
 da_haskell_library(
     name = "daml-lib",
-    srcs = native.glob(
+    srcs = glob(
         ["src/**/*.hs"],
         exclude = [
             "src/DAML/Assistant.hs",
diff --git a/daml-assistant/daml-helper/BUILD.bazel b/daml-assistant/daml-helper/BUILD.bazel
index 6177e6658a7d..41295f2893aa 100644
--- a/daml-assistant/daml-helper/BUILD.bazel
+++ b/daml-assistant/daml-helper/BUILD.bazel
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 load("//bazel_tools:haskell.bzl", "da_haskell_binary", "da_haskell_library", "da_haskell_test")
-load("//bazel_tools:packaging/packaging.bzl", "package_app")
+load("//bazel_tools/packaging:packaging.bzl", "package_app")
 load("@os_info//:os_info.bzl", "is_windows")
 
 da_haskell_library(
diff --git a/daml-foundations/daml-tools/daml-extension/BUILD.bazel b/daml-foundations/daml-tools/daml-extension/BUILD.bazel
index 902fef4f95a0..503908fc807a 100644
--- a/daml-foundations/daml-tools/daml-extension/BUILD.bazel
+++ b/daml-foundations/daml-tools/daml-extension/BUILD.bazel
@@ -3,7 +3,7 @@
 
 package(default_visibility = ["//visibility:public"])
 
-load("@build_bazel_rules_typescript//:defs.bzl", "ts_library")
+load("@npm_bazel_typescript//:index.bzl", "ts_library")
 load("@build_bazel_rules_nodejs//:defs.bzl", "npm_package")
 load("//bazel_tools:pkg.bzl", "pkg_tar")
 
@@ -15,6 +15,11 @@ ts_library(
     srcs = ["src/extension.ts"],
     node_modules = "@daml_extension_deps//:node_modules",
     tsconfig = ":tsconfig.json",
+    deps = [
+        "@daml_extension_deps//@types",
+        "@daml_extension_deps//vscode",
+        "@daml_extension_deps//vscode-languageclient",
+    ],
 )
 
 # With this rule we get access to extension.js, as
diff --git a/daml-foundations/daml-tools/daml-extension/package.json b/daml-foundations/daml-tools/daml-extension/package.json
index efc997950add..a4a977dbbf93 100644
--- a/daml-foundations/daml-tools/daml-extension/package.json
+++ b/daml-foundations/daml-tools/daml-extension/package.json
@@ -132,6 +132,7 @@
         "@types/which": "1.3.1"
     },
     "devDependencies": {
+        "@bazel/hide-bazel-files": "0.32.2",
         "typescript": "3.3.3",
         "@types/node": "6.0.42",
         "vscode": "1.1.33"
diff --git a/daml-foundations/daml-tools/daml-extension/yarn.lock b/daml-foundations/daml-tools/daml-extension/yarn.lock
index e86fcb2f8a84..4d4d312e32d1 100644
--- a/daml-foundations/daml-tools/daml-extension/yarn.lock
+++ b/daml-foundations/daml-tools/daml-extension/yarn.lock
@@ -2,6 +2,11 @@
 # yarn lockfile v1
 
 
+"@bazel/hide-bazel-files@0.32.2":
+  version "0.32.2"
+  resolved "https://registry.yarnpkg.com/@bazel/hide-bazel-files/-/hide-bazel-files-0.32.2.tgz#a482855eafbccb56b1fce0d92ff922c2c6e0a90c"
+  integrity sha512-585XY53mhMZaCjEQJ+aDqkmydWZbuXsKrZsSpoW9YeAVEH0poQY3YhdyCPmMVBo7/l1mkrqpFuOK5BpECfwdtA==
+
 "@types/node@6.0.42":
   version "6.0.42"
   resolved "https://registry.yarnpkg.com/@types/node/-/node-6.0.42.tgz#fc6d167399a4022b396e59a2c66166d3820e5688"
diff --git a/daml-foundations/daml-tools/damlc-app/BUILD.bazel b/daml-foundations/daml-tools/damlc-app/BUILD.bazel
index 7e31ce2d4810..2a56c4f9848f 100644
--- a/daml-foundations/daml-tools/damlc-app/BUILD.bazel
+++ b/daml-foundations/daml-tools/damlc-app/BUILD.bazel
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 load("//bazel_tools:haskell.bzl", "da_haskell_binary")
-load("//bazel_tools:packaging/packaging.bzl", "package_app")
+load("//bazel_tools/packaging:packaging.bzl", "package_app")
 load("@os_info//:os_info.bzl", "is_windows")
 
 da_haskell_binary(
diff --git a/deps.bzl b/deps.bzl
index 48f83e15c825..e1d9fc4c5fd3 100644
--- a/deps.bzl
+++ b/deps.bzl
@@ -26,14 +26,14 @@
 # prefix: @com_github_digital_asset_daml//..., as these won't
 # be resolvable from external workspaces otherwise.
 
-rules_scala_version = "78104d8014d4e4fc8f905cd34b91dfabd9a268c8"
-rules_haskell_version = "0cdcbcdb99f7799ee6e175854cb660cd4a6c1ac9"
-rules_haskell_sha256 = "85d981d07ad973f9ef154baff223b1a837f315473594eb277244dd2cfdc66205"
-rules_nixpkgs_version = "5ffb8a4ee9a52bc6bc12f95cd64ecbd82a79bc82"
-
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 
+rules_scala_version = "8092d5f6165a8d9c4797d5f089c1ba4eee3326b1"
+rules_haskell_version = "772f04acc3eec5b6d219db09e46604ccff1f5755"
+rules_haskell_sha256 = "d4bb5ecc0f2d0949a1b4bddd1b64c164d750247cccc1a883ae6b6430ae9c8b6e"
+rules_nixpkgs_version = "5ffb8a4ee9a52bc6bc12f95cd64ecbd82a79bc82"
+
 def daml_deps():
     if "io_tweag_rules_haskell" not in native.existing_rules():
         http_file(
@@ -88,8 +88,8 @@ def daml_deps():
     if "io_bazel_rules_go" not in native.existing_rules():
         http_archive(
             name = "io_bazel_rules_go",
-            urls = ["https://github.com/bazelbuild/rules_go/releases/download/0.17.0/rules_go-0.17.0.tar.gz"],
-            sha256 = "492c3ac68ed9dcf527a07e6a1b2dcbf199c6bf8b35517951467ac32e421c06c1",
+            urls = ["https://github.com/bazelbuild/rules_go/releases/download/0.18.6/rules_go-0.18.6.tar.gz"],
+            sha256 = "f04d2373bcaf8aa09bccb08a98a57e721306c8f6043a2a0ee610fd6853dcde3d",
         )
 
     if "io_bazel_rules_scala" not in native.existing_rules():
@@ -98,7 +98,7 @@ def daml_deps():
             url = "https://github.com/bazelbuild/rules_scala/archive/%s.zip" % rules_scala_version,
             type = "zip",
             strip_prefix = "rules_scala-%s" % rules_scala_version,
-            sha256 = "2b39ea3eba5ce86126980fa2bf20db9e0896b75aec23f0c639d9bb47dd9914b9",
+            sha256 = "db536b9db36b5aa737db9d08fa05d1fa5531c9cf213b04bed4e9b9fc34cc2390",
             patches = [
                 "@com_github_digital_asset_daml//bazel_tools:scala-escape-jvmflags.patch",
             ],
@@ -116,9 +116,9 @@ def daml_deps():
     if "io_bazel_skydoc" not in native.existing_rules():
         http_archive(
             name = "io_bazel_skydoc",
-            sha256 = "19eb6c162075707df5703c274d3348127625873dbfa5ff83b1ef4b8f5dbaa449",
-            strip_prefix = "skydoc-0.2.0",
-            urls = ["https://github.com/bazelbuild/skydoc/archive/0.2.0.tar.gz"],
+            sha256 = "c2d66a0cc7e25d857e480409a8004fdf09072a1bd564d6824441ab2f96448eea",
+            strip_prefix = "skydoc-0.3.0",
+            urls = ["https://github.com/bazelbuild/skydoc/archive/0.3.0.tar.gz"],
         )
 
     if "bazel_gazelle" not in native.existing_rules():
@@ -131,17 +131,17 @@ def daml_deps():
     if "io_bazel_rules_sass" not in native.existing_rules():
         http_archive(
             name = "io_bazel_rules_sass",
-            sha256 = "1e135452dc627f52eab39a50f4d5b8d13e8ed66cba2e6da56ac4cbdbd776536c",
-            strip_prefix = "rules_sass-1.15.2",
-            urls = ["https://github.com/bazelbuild/rules_sass/archive/1.15.2.tar.gz"],
+            sha256 = "7f0d64061e5bac749275349a7a7918b6f5759365f289192ff791f3c1495afcf1",
+            strip_prefix = "rules_sass-1.22.3",
+            urls = ["https://github.com/bazelbuild/rules_sass/archive/1.22.3.tar.gz"],
         )
 
     # Fetch rules_nodejs so we can install our npm dependencies
     if "build_bazel_rules_nodejs" not in native.existing_rules():
         http_archive(
             name = "build_bazel_rules_nodejs",
-            urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/0.29.2/rules_nodejs-0.29.2.tar.gz"],
-            sha256 = "395b7568f20822c13fc5abc65b1eced637446389181fda3a108fdd6ff2cac1e9",
+            urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/0.32.2/rules_nodejs-0.32.2.tar.gz"],
+            sha256 = "6d4edbf28ff6720aedf5f97f9b9a7679401bf7fca9d14a0fff80f644a99992b4",
             patches = ["@com_github_digital_asset_daml//bazel_tools:rules_nodejs_default_shell_env.patch"],
             patch_args = ["-p1"],
         )
@@ -161,17 +161,21 @@ def daml_deps():
     if "io_grpc_grpc_java" not in native.existing_rules():
         http_archive(
             name = "io_grpc_grpc_java",
-            strip_prefix = "grpc-java-1.19.0",
-            urls = ["https://github.com/grpc/grpc-java/archive/v1.19.0.tar.gz"],
-            sha256 = "81d1e12bf0f8bd1560eed7c75f24d8bb8e7368dcf07802586e439c85cf89b005",
+            strip_prefix = "grpc-java-1.21.0",
+            urls = ["https://github.com/grpc/grpc-java/archive/v1.21.0.tar.gz"],
+            sha256 = "9bc289e861c6118623fcb931044d843183c31d0e4d53fc43c4a32b56d6bb87fa",
+            patches = [
+                "@com_github_digital_asset_daml//bazel_tools:grpc-java-plugin-visibility.patch",
+            ],
+            patch_args = ["-p1"],
         )
 
     if "com_github_johnynek_bazel_jar_jar" not in native.existing_rules():
         http_archive(
             name = "com_github_johnynek_bazel_jar_jar",
-            sha256 = "ee227e7f304e9b7f26d033af677f31066f68b1c94ee8f8d04fbecfb371c3caef",
-            strip_prefix = "bazel_jar_jar-16e48f319048e090a2fe7fd39a794312d191fc6f",
-            urls = ["https://github.com/johnynek/bazel_jar_jar/archive/16e48f319048e090a2fe7fd39a794312d191fc6f.zip"],  # Latest commit SHA as at 2019/02/13
+            sha256 = "841ae424eec3f322d411eb49d949622cc84787cb4189a30698fa9adadb98deac",
+            strip_prefix = "bazel_jar_jar-20dbf71f09b1c1c2a8575a42005a968b38805519",
+            urls = ["https://github.com/johnynek/bazel_jar_jar/archive/20dbf71f09b1c1c2a8575a42005a968b38805519.zip"],  # Latest commit SHA as at 2019/02/13
         )
 
     if "com_github_scalapb_scalapb" not in native.existing_rules():
@@ -207,9 +211,9 @@ java_import(
     if "com_github_bazelbuild_buildtools" not in native.existing_rules():
         http_archive(
             name = "com_github_bazelbuild_buildtools",
-            sha256 = "7525deb4d74e3aa4cb2b960da7d1c400257a324be4e497f75d265f2f508c518f",
-            strip_prefix = "buildtools-0.22.0",
-            url = "https://github.com/bazelbuild/buildtools/archive/0.22.0.tar.gz",
+            sha256 = "86592d703ecbe0c5cbb5139333a63268cf58d7efd2c459c8be8e69e77d135e29",
+            strip_prefix = "buildtools-0.26.0",
+            url = "https://github.com/bazelbuild/buildtools/archive/0.26.0.tar.gz",
         )
 
     c2hs_version = "0.28.3"
diff --git a/dev-env/windows/manifests/bazel.json b/dev-env/windows/manifests/bazel.json
index 81e5d04e6e05..2e20303df5c8 100644
--- a/dev-env/windows/manifests/bazel.json
+++ b/dev-env/windows/manifests/bazel.json
@@ -1,12 +1,12 @@
 {
   "homepage": "https://bazel.build",
-  "version": "0.24.0",
+  "version": "0.27.0",
   "license": "Apache-2.0",
   "bin": "bazel.exe",
   "architecture": {
     "64bit": {
-      "url": "https://github.com/bazelbuild/bazel/releases/download/0.24.0/bazel-0.24.0-windows-x86_64.zip",
-      "hash": "d444a319320c0d788bf36c19816235636f8ad7b49b8bc5fad32daf7ae4e7aefa"
+      "url": "https://github.com/bazelbuild/bazel/releases/download/0.27.0/bazel-0.27.0-windows-x86_64.zip",
+      "hash": "6d496005bf02151b983aed1320f1728aca461de2246ee50cbcc56886078b813e"
     }
   },
   "depends": [
diff --git a/docs/BUILD.bazel b/docs/BUILD.bazel
index f3038f0ac3cd..90e72a0c5b85 100644
--- a/docs/BUILD.bazel
+++ b/docs/BUILD.bazel
@@ -12,7 +12,7 @@ nodejs_binary(
         "@npm//grunt-cli",
         "@npm//matchdep",
     ],
-    entry_point = "grunt-cli/bin/grunt",
+    entry_point = "@npm//:node_modules/grunt-cli/bin/grunt",
 )
 
 genrule(
diff --git a/navigator/frontend/BUILD.bazel b/navigator/frontend/BUILD.bazel
index 7a503136587b..3de101575e55 100644
--- a/navigator/frontend/BUILD.bazel
+++ b/navigator/frontend/BUILD.bazel
@@ -40,7 +40,7 @@ filegroup(
 # a custom node.js binary that has access to all plugins loaded by webpack at runtime.
 nodejs_binary(
     name = "webpack",
-    entry_point = "webpack/bin/webpack.js",
+    entry_point = "@navigator_frontend_deps//:node_modules/webpack/bin/webpack.js",
     node_modules = "@navigator_frontend_deps//:node_modules",
     # The webpack build step requires almost all of the node_modules dependencies
     # data = [
diff --git a/navigator/frontend/package.json b/navigator/frontend/package.json
index be658282072e..5a3b6565397e 100644
--- a/navigator/frontend/package.json
+++ b/navigator/frontend/package.json
@@ -20,6 +20,7 @@
     "lint": "tslint --project tslint.json"
   },
   "devDependencies": {
+    "@bazel/hide-bazel-files": "0.32.0",
     "@types/async": "2.0.39",
     "@types/babel-core": "^6.25.3",
     "@types/classnames": "0.0.32",
diff --git a/navigator/frontend/yarn.lock b/navigator/frontend/yarn.lock
index b13f35f65797..6a6a11c5adc9 100644
--- a/navigator/frontend/yarn.lock
+++ b/navigator/frontend/yarn.lock
@@ -76,6 +76,11 @@
     lodash "^4.17.11"
     to-fast-properties "^2.0.0"
 
+"@bazel/hide-bazel-files@0.32.0":
+  version "0.32.0"
+  resolved "https://registry.yarnpkg.com/@bazel/hide-bazel-files/-/hide-bazel-files-0.32.0.tgz#642becc6ac9c27a4486b3f671a078090f93371cb"
+  integrity sha512-eraORpt2iBiHal4FRV2c/3enH2nttWp4myOcHZvEVd8v7P/tt9FWv04MrxDIKHCqZIVt51D/2sXmOJKuKsKqvA==
+
 "@endemolshinegroup/cosmiconfig-typescript-loader@^1.0.0":
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/@endemolshinegroup/cosmiconfig-typescript-loader/-/cosmiconfig-typescript-loader-1.0.0.tgz#a27c0382158e41249ad32264836d21f12b0bb8ff"
diff --git a/nix/bazel.nix b/nix/bazel.nix
index d5a1dbb29175..7974713dd0f7 100644
--- a/nix/bazel.nix
+++ b/nix/bazel.nix
@@ -20,6 +20,7 @@ rec {
     patchelf
     postgresql
     protobuf3_5
+    python3
     zip
     ;
 
diff --git a/nix/overrides/bazel/default.nix b/nix/overrides/bazel/default.nix
index 775959a61c80..09e001b0cfea 100644
--- a/nix/overrides/bazel/default.nix
+++ b/nix/overrides/bazel/default.nix
@@ -1,8 +1,13 @@
-{ stdenv, callPackage, lib, fetchurl, fetchpatch, runCommand, makeWrapper
-, zip, unzip, getopt, postgresql, bash, writeCBin, coreutils, diffutils
-, which, python, perl, gawk, gnused, gnutar, gnugrep, gzip, findutils
+{ stdenv, callPackage, lib, fetchurl, runCommand, runCommandCC, makeWrapper
+, diffutils, getopt, perl, postgresql
+# this package (through the fixpoint glass)
+, bazel
+, lr, xe, zip, unzip, bash, writeCBin, coreutils
+, which, gawk, gnused, gnutar, gnugrep, gzip, findutils
+# updater
+, python3, writeScript
 # Apple dependencies
-, cctools, clang, libcxx, CoreFoundation, CoreServices, Foundation
+, cctools, libcxx, CoreFoundation, CoreServices, Foundation
 # Allow to independently override the jdks used to build and run respectively
 , buildJdk, runJdk
 , buildJdkName
@@ -10,20 +15,41 @@
 # Always assume all markers valid (don't redownload dependencies).
 # Also, don't clean up environment variables.
 , enableNixHacks ? false
+, gcc-unwrapped
+, autoPatchelfHook
 }:
 
 let
-  srcDeps = [
-    (fetchurl {
-      url = "https://github.com/google/desugar_jdk_libs/archive/915f566d1dc23bc5a8975320cd2ff71be108eb9c.zip";
-      sha256 = "0b926df7yxyyyiwm9cmdijy6kplf0sghm23sf163zh8wrk87wfi7";
-    })
-
-    (fetchurl {
-        url = "https://mirror.bazel.build/bazel_java_tools/java_tools_pkg-0.5.1.tar.gz";
-        sha256 = "1ld8m5cj9j0r474f56pixcfi0xvx3w7pzwahxngs8f6ns0yimz5w";
-    })
-  ];
+  version = "0.27.0";
+
+  src = fetchurl {
+    url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
+    sha256 = "0yn662dzgfr8ls4avfl12k5sr4f210bab12wml18bh4sjlxhs263";
+  };
+
+  # Update with `eval $(nix-build -A bazel.updater)`,
+  # then add new dependencies from the dict in ./src-deps.json as required.
+  srcDeps = lib.attrsets.attrValues srcDepsSet;
+  srcDepsSet =
+    let
+      srcs = (builtins.fromJSON (builtins.readFile ./src-deps.json));
+      toFetchurl = d: lib.attrsets.nameValuePair d.name (fetchurl {
+        name = d.name;
+        urls = d.urls;
+        sha256 = d.sha256;
+        });
+        in builtins.listToAttrs (map toFetchurl [
+      srcs.desugar_jdk_libs
+      srcs.io_bazel_skydoc
+      srcs.bazel_skylib
+      srcs.io_bazel_rules_sass
+      (if stdenv.hostPlatform.isDarwin
+       then srcs.${"java_tools_javac11_darwin-v2.0.zip"}
+       else srcs.${"java_tools_javac11_linux-v2.0.zip"})
+      srcs.${"coverage_output_generator-v1.0.zip"}
+      srcs.build_bazel_rules_nodejs
+      srcs.${"android_tools_pkg-0.4.tar.gz"}
+      ]);
 
   distDir = runCommand "bazel-deps" {} ''
     mkdir -p $out
@@ -58,60 +84,143 @@ let
     #        ],
     #     )
     #
-    [ bash coreutils diffutils findutils gawk gnugrep gnutar gnused gzip perl which unzip getopt postgresql];
+    # XXX: Modified relative to upstream Nix expression.
+    [ bash coreutils diffutils findutils gawk gnugrep gnutar gnused gzip perl which unzip getopt postgresql ];
 
   # Java toolchain used for the build and tests
   javaToolchain = "@bazel_tools//tools/jdk:toolchain_host${buildJdkName}";
 
+  platforms = lib.platforms.linux ++ lib.platforms.darwin;
+
+  # This repository is fetched by bazel at runtime
+  # however it contains prebuilt java binaries, with wrong interpreter
+  # and libraries path.
+  # We prefetch it, patch it, and override it in a global bazelrc.
+  system = if stdenv.hostPlatform.isDarwin
+           then "darwin" else "linux";
+
+  remote_java_tools = stdenv.mkDerivation {
+    name = "remote_java_tools_${system}";
+
+    src = srcDepsSet."java_tools_javac11_${system}-v2.0.zip";
+
+    nativeBuildInputs = [ autoPatchelfHook unzip ];
+    buildInputs = [ gcc-unwrapped ];
+
+    sourceRoot = ".";
+
+    buildPhase = ''
+      mkdir $out;
+    '';
+
+    installPhase = ''
+      cp -Ra * $out/
+      touch $out/WORKSPACE
+    '';
+  };
+
 in
 stdenv.mkDerivation rec {
-
-  version = "0.24.0";
+  name = "bazel-${version}";
 
   meta = with lib; {
     homepage = "https://github.com/bazelbuild/bazel/";
     description = "Build tool that builds code quickly and reliably";
     license = licenses.asl20;
     maintainers = [ maintainers.mboes ];
-    platforms = platforms.linux ++ platforms.darwin;
+    inherit platforms;
   };
 
+  inherit src;
+  sourceRoot = ".";
+
+  patches = [
+    ./python-stub-path-fix.patch
+  ] ++ lib.optional enableNixHacks ./nix-hacks.patch;
+
+
   # Additional tests that check bazel’s functionality. Execute
   #
   #     nix-build . -A bazel.tests
   #
   # in the nixpkgs checkout root to exercise them locally.
-  passthru.tests = {
-    pythonBinPath = callPackage ./python-bin-path-test.nix {};
-    bashTools = callPackage ./bash-tools-test.nix {};
-  };
-
-  name = "bazel-${version}";
-
-  src = fetchurl {
-    url = "https://github.com/bazelbuild/bazel/releases/download/${version}/${name}-dist.zip";
-    sha256 = "11gsc00ghxqkbci8nrflkwq1lcvqawlgkaryj458b24si6bjl7b2";
-  };
+  passthru.tests =
+    let
+      runLocal = name: attrs: script: runCommandCC name ({
+        preferLocalBuild = true;
+        meta.platforms = platforms;
+        buildInputs = [ python3 ];
+      } // attrs) script;
+
+      # bazel wants to extract itself into $install_dir/install every time it runs,
+      # so let’s do that only once.
+      extracted = bazelPkg:
+        let install_dir =
+          # `install_base` field printed by `bazel info`, minus the hash.
+          # yes, this path is kinda magic. Sorry.
+          "$HOME/.cache/bazel/_bazel_nixbld";
+        in runLocal "bazel-extracted-homedir" { passthru.install_dir = install_dir; } ''
+            export HOME=$(mktemp -d)
+            touch WORKSPACE # yeah, everything sucks
+            install_base="$(${bazelPkg}/bin/bazel info | grep install_base)"
+            # assert it’s actually below install_dir
+            [[ "$install_base" =~ ${install_dir} ]] \
+              || (echo "oh no! $install_base but we are \
+            trying to copy ${install_dir} to $out instead!"; exit 1)
+            cp -R ${install_dir} $out
+          '';
+
+      bazelTest = { name, bazelScript, workspaceDir, bazelPkg }:
+        let
+          be = extracted bazelPkg;
+        in runLocal name {} (
+          # skip extraction caching on Darwin, because nobody knows how Darwin works
+          (lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+            # set up home with pre-unpacked bazel
+            export HOME=$(mktemp -d)
+            mkdir -p ${be.install_dir}
+            cp -R ${be}/install ${be.install_dir}
+
+            # https://stackoverflow.com/questions/47775668/bazel-how-to-skip-corrupt-installation-on-centos6
+            # Bazel checks whether the mtime of the install dir files
+            # is >9 years in the future, otherwise it extracts itself again.
+            # see PosixFileMTime::IsUntampered in src/main/cpp/util
+            # What the hell bazel.
+            ${lr}/bin/lr -0 -U ${be.install_dir} | ${xe}/bin/xe -N0 -0 touch --date="9 years 6 months" {}
+          '')
+          +
+          ''
+            # Note https://github.com/bazelbuild/bazel/issues/5763#issuecomment-456374609
+            # about why to create a subdir for the workspace.
+            cp -r ${workspaceDir} wd && chmod u+w wd && cd wd
+
+            ${bazelScript}
+
+            touch $out
+          '');
+
+      bazelWithNixHacks = bazel.override { enableNixHacks = true; };
+    in {
+      pythonBinPathWithoutNixHacks = callPackage ./python-bin-path-test.nix{ inherit runLocal bazelTest; };
+      bashToolsWithoutNixHacks = callPackage ./bash-tools-test.nix { inherit runLocal bazelTest; };
+
+      pythonBinPathWithNixHacks = callPackage ./python-bin-path-test.nix{ inherit runLocal bazelTest; bazel = bazelWithNixHacks; };
+      bashToolsWithNixHacks = callPackage ./bash-tools-test.nix { inherit runLocal bazelTest; bazel = bazelWithNixHacks; };
+    };
+
+  # update the list of workspace dependencies
+  passthru.updater = writeScript "update-bazel-deps.sh" ''
+    #!${runtimeShell}
+    cat ${runCommand "bazel-deps.json" {} ''
+        ${unzip}/bin/unzip ${src} WORKSPACE
+        ${python3}/bin/python3 ${./update-srcDeps.py} ./WORKSPACE > $out
+    ''} > ${builtins.toString ./src-deps.json}
+  '';
 
   # Necessary for the tests to pass on Darwin with sandbox enabled.
   # Bazel starts a local server and needs to bind a local address.
   __darwinAllowLocalNetworking = true;
 
-  sourceRoot = ".";
-
-  patches = [
-    ./python-stub-path-fix.patch
-    # By default the HTTP cache doesn’t retry failed requests leading to error messages like:
-    #   WARNING: Error reading from the remote cache:
-    #   Exhausted retry attempts (0)
-    # Since GHC’s object files are non-deterministic this is quite problematic for us,
-    # e.g., if we get a failed request for any of its dependencies and end up building it
-    # locally we will get cache misses for anything depending on that leading to a ton of unnecessary
-    # rebuilts. See #124
-    ./retry_cache.patch
-    ./combined_cache.patch
-  ] ++ lib.optional enableNixHacks ./nix-hacks.patch;
-
   # Bazel expects several utils to be available in Bash even without PATH. Hence this hack.
 
   customBash = writeCBin "bash" ''
@@ -157,10 +266,6 @@ stdenv.mkDerivation rec {
       # https://github.com/NixOS/nixpkgs/pull/41589
       export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem ${libcxx}/include/c++/v1"
 
-      # 10.10 apple_sdk Foundation doesn't have type arguments on classes
-      # Remove this when we update apple_sdk
-      sed -i -e 's/<.*\*>//g' tools/osx/xcode_locator.m
-
       # don't use system installed Xcode to run clang, use Nix clang instead
       sed -i -e "s;/usr/bin/xcrun clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $NIX_LDFLAGS -framework CoreFoundation;g" \
         scripts/bootstrap/compile.sh \
@@ -168,6 +273,9 @@ stdenv.mkDerivation rec {
         src/tools/xcode/stdredirect/BUILD \
         tools/osx/BUILD
 
+      # nixpkgs's libSystem cannot use pthread headers directly, must import GCD headers instead
+      sed -i -e "/#include <pthread\/spawn.h>/i #include <dispatch/dispatch.h>" src/main/cpp/blaze_util_darwin.cc
+
       # clang installed from Xcode has a compatibility wrapper that forwards
       # invocations of gcc to clang, but vanilla clang doesn't
       sed -i -e 's;_find_generic(repository_ctx, "gcc", "CC", overriden_tools);_find_generic(repository_ctx, "clang", "CC", overriden_tools);g' tools/cpp/unix_cc_configure.bzl
@@ -183,8 +291,8 @@ stdenv.mkDerivation rec {
       # Substitute python's stub shebang to plain python path. (see TODO add pr URL)
       # See also `postFixup` where python is added to $out/nix-support
       substituteInPlace src/main/java/com/google/devtools/build/lib/bazel/rules/python/python_stub_template.txt\
-          --replace "/usr/bin/env python" "${python}/bin/python" \
-          --replace "NIX_STORE_PYTHON_PATH" "${python}/bin/python" \
+          --replace "/usr/bin/env python" "${python3}/bin/python" \
+          --replace "NIX_STORE_PYTHON_PATH" "${python3}/bin/python" \
 
       # md5sum is part of coreutils
       sed -i 's|/sbin/md5|md5sum|' \
@@ -200,9 +308,14 @@ stdenv.mkDerivation rec {
           --replace /bin/true ${coreutils}/bin/true
       done
 
+      # bazel test runner include references to /bin/bash
+      substituteInPlace tools/build_rules/test_rules.bzl \
+        --replace /bin/bash ${customBash}/bin/bash
+
+
       # Fixup scripts that generate scripts. Not fixed up by patchShebangs below.
       substituteInPlace scripts/bootstrap/compile.sh \
-          --replace /bin/sh ${customBash}/bin/bash
+          --replace /bin/bash ${customBash}/bin/bash
 
       # add nix environment vars to .bazelrc
       cat >> .bazelrc <<EOF
@@ -248,24 +361,31 @@ stdenv.mkDerivation rec {
       mv runfiles.bash.tmp tools/bash/runfiles/runfiles.bash
 
       patchShebangs .
+
+      # bazel reads its system bazelrc in /etc
+      # override this path to a builtin one
+      substituteInPlace \
+        src/main/cpp/option_processor.cc \
+        --replace BAZEL_SYSTEM_BAZELRC_PATH "\"$out/etc/bazelrc\""
     '';
     in lib.optionalString stdenv.hostPlatform.isDarwin darwinPatches
      + genericPatches;
 
   buildInputs = [
     buildJdk
+    python3
   ];
 
   # when a command can’t be found in a bazel build, you might also
   # need to add it to `defaultShellPath`.
   nativeBuildInputs = [
     zip
-    python
+    python3
     unzip
     makeWrapper
     which
     customBash
-  ] ++ lib.optionals (stdenv.isDarwin) [ cctools clang libcxx CoreFoundation CoreServices Foundation ];
+  ] ++ lib.optionals (stdenv.isDarwin) [ cctools libcxx CoreFoundation CoreServices Foundation ];
 
   # Bazel makes extensive use of symlinks in the WORKSPACE.
   # This causes problems with infinite symlinks if the build output is in the same location as the
@@ -300,6 +420,12 @@ stdenv.mkDerivation rec {
 
     wrapProgram "$out/bin/bazel" --add-flags --server_javabase="${runJdk}"
 
+    # generates the system bazelrc
+    # warning: the name of the repository depends on the system, hence
+    # the reference to .name
+    mkdir $out/etc
+    echo "build --override_repository=${remote_java_tools.name}=${remote_java_tools}" > $out/etc/bazelrc
+
     # shell completion files
     mkdir -p $out/share/bash-completion/completions $out/share/zsh/site-functions
     mv ./bazel_src/output/bazel-complete.bash $out/share/bash-completion/completions/bazel
@@ -310,8 +436,24 @@ stdenv.mkDerivation rec {
   installCheckPhase = ''
     export TEST_TMPDIR=$(pwd)
 
+    tar xf ${srcDepsSet.io_bazel_skydoc} -C $TEST_TMPDIR
+    mv $(ls | grep skydoc-) io_bazel_skydoc
+
+    tar xf ${srcDepsSet.bazel_skylib} -C $TEST_TMPDIR
+    mv $(ls | grep bazel-skylib-) bazel_skylib
+
+    tar xf ${srcDepsSet.io_bazel_rules_sass} -C $TEST_TMPDIR
+    mv $(ls | grep rules_sass-) rules_sass
+
+    unzip ${srcDepsSet.build_bazel_rules_nodejs} -d $TEST_TMPDIR
+    mv rules_nodejs-0.16.2 build_bazel_rules_nodejs
+
     hello_test () {
       $out/bin/bazel test \
+        --override_repository=io_bazel_skydoc=$TEST_TMPDIR/io_bazel_skydoc \
+        --override_repository=bazel_skylib=$TEST_TMPDIR/bazel_skylib \
+        --override_repository=io_bazel_rules_sass=$TEST_TMPDIR/rules_sass \
+        --override_repository=build_bazel_rules_nodejs=$TEST_TMPDIR/build_bazel_rules_nodejs \
         --test_output=errors \
         --java_toolchain='${javaToolchain}' \
         examples/cpp:hello-success_test \
@@ -347,7 +489,7 @@ stdenv.mkDerivation rec {
     echo "${customBash} ${defaultShellPath}" >> $out/nix-support/depends
     # The templates get tar’d up into a .jar,
     # so nix can’t detect python is needed in the runtime closure
-    echo "${python}" >> $out/nix-support/depends
+    echo "${python3}" >> $out/nix-support/depends
   '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
     echo "${cctools}" >> $out/nix-support/depends
   '';
diff --git a/nix/overrides/bazel/nix-hacks.patch b/nix/overrides/bazel/nix-hacks.patch
index da3f6248f220..f58be89fabc1 100644
--- a/nix/overrides/bazel/nix-hacks.patch
+++ b/nix/overrides/bazel/nix-hacks.patch
@@ -1,33 +1,35 @@
 diff -Naur a/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java b/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
---- a/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java	1980-01-01 00:00:00.000000000 -0500
-+++ b/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java	2018-01-18 08:17:22.420459162 -0500
-@@ -287,21 +287,8 @@
-           markerData.put(key, value);
-         }
-       }
--      boolean result = false;
--      if (markerRuleKey.equals(ruleKey)) {
--        result = handler.verifyMarkerData(rule, markerData, env);
--        if (env.valuesMissing()) {
+--- a/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java	2019-06-12 20:39:37.420705161 -0700
++++ b/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java	2019-06-12 20:44:18.894429744 -0700
+@@ -428,24 +428,7 @@
+       try {
+         content = FileSystemUtils.readContent(markerPath, StandardCharsets.UTF_8);
+         String markerRuleKey = readMarkerFile(content, markerData);
+-        boolean verified = false;
+-        if (Preconditions.checkNotNull(ruleKey).equals(markerRuleKey)
+-            && Objects.equals(
+-                markerData.get(MANAGED_DIRECTORIES_MARKER),
+-                this.markerData.get(MANAGED_DIRECTORIES_MARKER))) {
+-          verified = handler.verifyMarkerData(rule, markerData, env);
+-          if (env.valuesMissing()) {
+-            return null;
+-          }
+-        }
+-
+-        if (verified) {
+           return new Fingerprint().addString(content).digestAndReset();
+-        } else {
+-          // So that we are in a consistent state if something happens while fetching the repository
+-          markerPath.delete();
 -          return null;
 -        }
--      }
- 
--      if (result) {
--        return new Fingerprint().addString(content).digestAndReset();
--      } else {
--        // So that we are in a consistent state if something happens while fetching the repository
--        markerPath.delete();
--        return null;
--      }
-+      return new Fingerprint().addString(content).digestAndReset();
- 
-     } catch (IOException e) {
-       throw new RepositoryFunctionException(e, Transience.TRANSIENT);
+       } catch (IOException e) {
+         throw new RepositoryFunctionException(e, Transience.TRANSIENT);
+       }
 diff -Naur a/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java b/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java
---- a/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java	1980-01-01 00:00:00.000000000 -0500
-+++ b/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java	2018-01-18 08:17:53.274877980 -0500
-@@ -129,7 +129,6 @@
+--- a/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java	2019-06-12 20:39:37.538708196 -0700
++++ b/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java	2019-06-12 20:44:18.863429602 -0700
+@@ -146,7 +146,6 @@
      ProcessBuilder builder = new ProcessBuilder();
      builder.command(params.getArgv());
      if (params.getEnv() != null) {
diff --git a/nix/overrides/bazel/src-deps.json b/nix/overrides/bazel/src-deps.json
new file mode 100644
index 000000000000..a0d07f1a68d4
--- /dev/null
+++ b/nix/overrides/bazel/src-deps.json
@@ -0,0 +1,393 @@
+{
+    "0.16.2.zip": {
+        "name": "0.16.2.zip",
+        "sha256": "9b72bb0aea72d7cbcfc82a01b1e25bf3d85f791e790ddec16c65e2d906382ee0",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_nodejs/archive/0.16.2.zip",
+            "https://github.com/bazelbuild/rules_nodejs/archive/0.16.2.zip"
+        ]
+    },
+    "2d9566b21fbe405acf5f7bf77eda30df72a4744c.tar.gz": {
+        "name": "2d9566b21fbe405acf5f7bf77eda30df72a4744c.tar.gz",
+        "sha256": "4a1318fed4831697b83ce879b3ab70ae09592b167e5bda8edaff45132d1c3b3f",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/skydoc/archive/2d9566b21fbe405acf5f7bf77eda30df72a4744c.tar.gz",
+            "https://github.com/bazelbuild/skydoc/archive/2d9566b21fbe405acf5f7bf77eda30df72a4744c.tar.gz"
+        ]
+    },
+    "8ccf4f1c351928b55d5dddf3672e3667f6978d60.tar.gz": {
+        "name": "8ccf4f1c351928b55d5dddf3672e3667f6978d60.tar.gz",
+        "sha256": "d868ce50d592ef4aad7dec4dd32ae68d2151261913450fac8390b3fd474bb898",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_sass/archive/8ccf4f1c351928b55d5dddf3672e3667f6978d60.tar.gz",
+            "https://github.com/bazelbuild/rules_sass/archive/8ccf4f1c351928b55d5dddf3672e3667f6978d60.tar.gz"
+        ]
+    },
+    "android_tools_pkg-0.4.tar.gz": {
+        "name": "android_tools_pkg-0.4.tar.gz",
+        "sha256": "331e7706f2bcae8a68057d8ddd3e3f1574bca26c67c65802fc4a8ac6164fa912",
+        "urls": [
+            "https://mirror.bazel.build/bazel_android_tools/android_tools_pkg-0.4.tar.gz"
+        ]
+    },
+    "bazel_j2objc": {
+        "name": "bazel_j2objc",
+        "sha256": "a36bac432d0dbd8c98249e484b2b69dd5720afa4abb58711a3c3def1c0bfa21d",
+        "strip_prefix": "j2objc-2.0.3",
+        "urls": [
+            "https://miirror.bazel.build/github.com/google/j2objc/releases/download/2.0.3/j2objc-2.0.3.zip",
+            "https://github.com/google/j2objc/releases/download/2.0.3/j2objc-2.0.3.zip"
+        ]
+    },
+    "bazel_rbe_toolchains": {
+        "name": "bazel_rbe_toolchains",
+        "sha256": "f575778fb1366718f5e1204200ecf35796c558998c15303945d351f0b42669e5",
+        "strip_prefix": "bazel_rbe_toolchains-f50471a57cd05a313a953fa54756db6e8fd93673",
+        "urls": [
+            "https://mirror.bazel.build/github.com/buchgr/bazel_rbe_toolchains/archive/f50471a57cd05a313a953fa54756db6e8fd93673.tar.gz",
+            "https://github.com/buchgr/bazel_rbe_toolchains/archive/f50471a57cd05a313a953fa54756db6e8fd93673.tar.gz"
+        ]
+    },
+    "bazel_skylib": {
+        "name": "bazel_skylib",
+        "sha256": "ba5d15ca230efca96320085d8e4d58da826d1f81b444ef8afccd8b23e0799b52",
+        "strip_prefix": "bazel-skylib-f83cb8dd6f5658bc574ccd873e25197055265d1c",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/archive/f83cb8dd6f5658bc574ccd873e25197055265d1c.tar.gz",
+            "https://github.com/bazelbuild/bazel-skylib/archive/f83cb8dd6f5658bc574ccd873e25197055265d1c.tar.gz"
+        ]
+    },
+    "bazel_toolchains": {
+        "name": "bazel_toolchains",
+        "sha256": "67335b3563d9b67dc2550b8f27cc689b64fadac491e69ce78763d9ba894cc5cc",
+        "strip_prefix": "bazel-toolchains-cddc376d428ada2927ad359211c3e356bd9c9fbb",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/bazel-toolchains/archive/cddc376d428ada2927ad359211c3e356bd9c9fbb.tar.gz",
+            "https://github.com/bazelbuild/bazel-toolchains/archive/cddc376d428ada2927ad359211c3e356bd9c9fbb.tar.gz"
+        ]
+    },
+    "build_bazel_rules_nodejs": {
+        "name": "build_bazel_rules_nodejs",
+        "sha256": "9b72bb0aea72d7cbcfc82a01b1e25bf3d85f791e790ddec16c65e2d906382ee0",
+        "strip_prefix": "rules_nodejs-0.16.2",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_nodejs/archive/0.16.2.zip",
+            "https://github.com/bazelbuild/rules_nodejs/archive/0.16.2.zip"
+        ]
+    },
+    "com_google_googletest": {
+        "name": "com_google_googletest",
+        "sha256": "0fb00ff413f6b9b80ccee44a374ca7a18af7315aea72a43c62f2acd1ca74e9b5",
+        "strip_prefix": "googletest-f13bbe2992d188e834339abe6f715b2b2f840a77",
+        "urls": [
+            "https://mirror.bazel.build/github.com/google/googletest/archive/f13bbe2992d188e834339abe6f715b2b2f840a77.tar.gz",
+            "https://github.com/google/googletest/archive/f13bbe2992d188e834339abe6f715b2b2f840a77.tar.gz"
+        ]
+    },
+    "coverage_output_generator-v1.0.zip": {
+        "name": "coverage_output_generator-v1.0.zip",
+        "sha256": "cc470e529fafb6165b5be3929ff2d99b38429b386ac100878687416603a67889",
+        "urls": [
+            "https://mirror.bazel.build/bazel_coverage_output_generator/releases/coverage_output_generator-v1.0.zip"
+        ]
+    },
+    "desugar_jdk_libs": {
+        "name": "desugar_jdk_libs",
+        "sha256": "fe2e04f91ce8c59d49d91b8102edc6627c6fa2906c1b0e7346f01419ec4f419d",
+        "strip_prefix": "desugar_jdk_libs-e0b0291b2c51fbe5a7cfa14473a1ae850f94f021",
+        "urls": [
+            "https://mirror.bazel.build/github.com/google/desugar_jdk_libs/archive/e0b0291b2c51fbe5a7cfa14473a1ae850f94f021.zip",
+            "https://github.com/google/desugar_jdk_libs/archive/e0b0291b2c51fbe5a7cfa14473a1ae850f94f021.zip"
+        ]
+    },
+    "e0b0291b2c51fbe5a7cfa14473a1ae850f94f021.zip": {
+        "name": "e0b0291b2c51fbe5a7cfa14473a1ae850f94f021.zip",
+        "sha256": "fe2e04f91ce8c59d49d91b8102edc6627c6fa2906c1b0e7346f01419ec4f419d",
+        "urls": [
+            "https://mirror.bazel.build/github.com/google/desugar_jdk_libs/archive/e0b0291b2c51fbe5a7cfa14473a1ae850f94f021.zip",
+            "https://github.com/google/desugar_jdk_libs/archive/e0b0291b2c51fbe5a7cfa14473a1ae850f94f021.zip"
+        ]
+    },
+    "f83cb8dd6f5658bc574ccd873e25197055265d1c.tar.gz": {
+        "name": "f83cb8dd6f5658bc574ccd873e25197055265d1c.tar.gz",
+        "sha256": "ba5d15ca230efca96320085d8e4d58da826d1f81b444ef8afccd8b23e0799b52",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/archive/f83cb8dd6f5658bc574ccd873e25197055265d1c.tar.gz",
+            "https://github.com/bazelbuild/bazel-skylib/archive/f83cb8dd6f5658bc574ccd873e25197055265d1c.tar.gz"
+        ]
+    },
+    "io_bazel_rules_sass": {
+        "name": "io_bazel_rules_sass",
+        "sha256": "d868ce50d592ef4aad7dec4dd32ae68d2151261913450fac8390b3fd474bb898",
+        "strip_prefix": "rules_sass-8ccf4f1c351928b55d5dddf3672e3667f6978d60",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/rules_sass/archive/8ccf4f1c351928b55d5dddf3672e3667f6978d60.tar.gz",
+            "https://github.com/bazelbuild/rules_sass/archive/8ccf4f1c351928b55d5dddf3672e3667f6978d60.tar.gz"
+        ]
+    },
+    "io_bazel_skydoc": {
+        "name": "io_bazel_skydoc",
+        "sha256": "4a1318fed4831697b83ce879b3ab70ae09592b167e5bda8edaff45132d1c3b3f",
+        "strip_prefix": "skydoc-2d9566b21fbe405acf5f7bf77eda30df72a4744c",
+        "urls": [
+            "https://mirror.bazel.build/github.com/bazelbuild/skydoc/archive/2d9566b21fbe405acf5f7bf77eda30df72a4744c.tar.gz",
+            "https://github.com/bazelbuild/skydoc/archive/2d9566b21fbe405acf5f7bf77eda30df72a4744c.tar.gz"
+        ]
+    },
+    "java_tools_javac11_darwin-v2.0.zip": {
+        "name": "java_tools_javac11_darwin-v2.0.zip",
+        "sha256": "0ceb0c9ff91256fe33508306bc9cd9e188dcca38df78e70839d426bdaef67a38",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v2.0/java_tools_javac11_darwin-v2.0.zip"
+        ]
+    },
+    "java_tools_javac11_linux-v2.0.zip": {
+        "name": "java_tools_javac11_linux-v2.0.zip",
+        "sha256": "074d624fb34441df369afdfd454e75dba821d5d54932fcfee5ba598d17dc1b99",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v2.0/java_tools_javac11_linux-v2.0.zip"
+        ]
+    },
+    "java_tools_javac11_windows-v2.0.zip": {
+        "name": "java_tools_javac11_windows-v2.0.zip",
+        "sha256": "2c3fc0ce7d30d60e26f4b8a36e2eadcf9e6a9d5a51b667d3d13b78db53b24251",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v2.0/java_tools_javac11_windows-v2.0.zip"
+        ]
+    },
+    "java_tools_langtools_javac10": {
+        "name": "java_tools_langtools_javac10",
+        "sha256": "e379c71e051eb83e3fc9a08c9b404712707d8920ffcf1e8fd59c844965f0b0dd",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/jdk_langtools/langtools_jdk10.zip"
+        ]
+    },
+    "java_tools_langtools_javac11": {
+        "name": "java_tools_langtools_javac11",
+        "sha256": "128a63f39d3f828a761f6afcfe3c6115279336a72ea77f60d7b3acf1841c9acb",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/jdk_langtools/langtools_jdk11.zip"
+        ]
+    },
+    "java_tools_langtools_javac9": {
+        "name": "java_tools_langtools_javac9",
+        "sha256": "3b6bbc47256acf2f61883901e2d4e3f9b292f5fe154a6912b928805de24cb864",
+        "urls": [
+            "https://mirror.bazel.build/bazel_java_tools/jdk_langtools/langtools_jdk9.zip"
+        ]
+    },
+    "jdk10-server-release-1804.tar.xz": {
+        "name": "jdk10-server-release-1804.tar.xz",
+        "sha256": "b7098b7aaf6ee1ffd4a2d0371a0be26c5a5c87f6aebbe46fe9a92c90583a84be",
+        "urls": [
+            "https://mirror.bazel.build/openjdk.linaro.org/releases/jdk10-server-release-1804.tar.xz"
+        ]
+    },
+    "jdk9-server-release-1708.tar.xz": {
+        "name": "jdk9-server-release-1708.tar.xz",
+        "sha256": "72e7843902b0395e2d30e1e9ad2a5f05f36a4bc62529828bcbc698d54aec6022",
+        "urls": [
+            "https://mirror.bazel.build/openjdk.linaro.org/releases/jdk9-server-release-1708.tar.xz"
+        ]
+    },
+    "openjdk10_linux_archive": {
+        "build_file_content": "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
+        "name": "openjdk10_linux_archive",
+        "sha256": "b3c2d762091a615b0c1424ebbd05d75cc114da3bf4f25a0dec5c51ea7e84146f",
+        "strip_prefix": "zulu10.2+3-jdk10.0.1-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu10.2+3-jdk10.0.1/zulu10.2+3-jdk10.0.1-linux_x64.tar.gz"
+        ]
+    },
+    "openjdk11_linux_archive": {
+        "build_file_content": "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
+        "name": "openjdk11_linux_archive",
+        "sha256": "ddb0fd4526089cf1ce2db36282c282263f587a9e8be373fa02f511a12923cc48",
+        "strip_prefix": "zulu11.31.11-ca-jdk11.0.3-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.31.11-ca-jdk11.0.3/zulu11.31.11-ca-jdk11.0.3-linux_x64.tar.gz"
+        ]
+    },
+    "openjdk12_linux_archive": {
+        "build_file_content": "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
+        "name": "openjdk12_linux_archive",
+        "sha256": "529c99841d69e11a85aea967ccfb9d0fd40b98c5b68dbe1d059002655e0a9c13",
+        "strip_prefix": "zulu12.2.3-ca-jdk12.0.1-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu12.2.3-ca-jdk12.0.1/zulu12.2.3-ca-jdk12.0.1-linux_x64.tar.gz"
+        ]
+    },
+    "openjdk9_linux_archive": {
+        "build_file_content": "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
+        "name": "openjdk9_linux_archive",
+        "sha256": "45f2dfbee93b91b1468cf81d843fc6d9a47fef1f831c0b7ceff4f1eb6e6851c8",
+        "strip_prefix": "zulu9.0.7.1-jdk9.0.7-linux_x64",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu-9.0.7.1-jdk9.0.7/zulu9.0.7.1-jdk9.0.7-linux_x64.tar.gz"
+        ]
+    },
+    "openjdk_linux": {
+        "downloaded_file_path": "zulu-linux.tar.gz",
+        "name": "openjdk_linux",
+        "sha256": "460d8a4f0c0204160b48086e341b22943c9cca471b195340e75b38ae9eb33c1c",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-linux_x64-allmodules-90755145cb6e6418584d8603cd5fa9afbb30aecc-1549209950.tar.gz"
+        ]
+    },
+    "openjdk_linux_aarch64": {
+        "name": "openjdk_linux_aarch64",
+        "sha256": "72e7843902b0395e2d30e1e9ad2a5f05f36a4bc62529828bcbc698d54aec6022",
+        "urls": [
+            "https://mirror.bazel.build/openjdk.linaro.org/releases/jdk9-server-release-1708.tar.xz",
+            "http://openjdk.linaro.org/releases/jdk9-server-release-1708.tar.xz"
+        ]
+    },
+    "openjdk_linux_minimal": {
+        "downloaded_file_path": "zulu-linux-minimal.tar.gz",
+        "name": "openjdk_linux_minimal",
+        "sha256": "5123bc8dd21886761d1fd9ca0fb1898b3372d7243064a070ec81ca9c9d1a6791",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-linux_x64-minimal-524ae2ca2a782c9f15e00f08bd35b3f8ceacbd7f-1556011926.tar.gz"
+        ]
+    },
+    "openjdk_linux_vanilla": {
+        "downloaded_file_path": "zulu-linux-vanilla.tar.gz",
+        "name": "openjdk_linux_vanilla",
+        "sha256": "f3f44b6235508e87b760bf37a49e186cc1fa4e9cd28384c4dbf5a33991921e08",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-linux_x64.tar.gz"
+        ]
+    },
+    "openjdk_macos": {
+        "downloaded_file_path": "zulu-macos.tar.gz",
+        "name": "openjdk_macos",
+        "sha256": "8fa61d85ca6f657d646fdb50cfc8634987f8f7d8a3250ed39fb7364647633252",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-macosx_x64-allmodules-90755145cb6e6418584d8603cd5fa9afbb30aecc-1549209951.tar.gz"
+        ]
+    },
+    "openjdk_macos_minimal": {
+        "downloaded_file_path": "zulu-macos-minimal.tar.gz",
+        "name": "openjdk_macos_minimal",
+        "sha256": "ac56e44db46fd56ac78b39b6823daed4faa74a2677ac340c7d217f863884ec0f",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-macosx_x64-minimal-524ae2ca2a782c9f15e00f08bd35b3f8ceacbd7f-1556003114.tar.gz"
+        ]
+    },
+    "openjdk_macos_vanilla": {
+        "downloaded_file_path": "zulu-macos-vanilla.tar.gz",
+        "name": "openjdk_macos_vanilla",
+        "sha256": "059f8e3484bf07b63a8f2820d5f528f473eff1befdb1896ee4f8ff06be3b8d8f",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-macosx_x64.zip"
+        ]
+    },
+    "openjdk_win": {
+        "downloaded_file_path": "zulu-win.zip",
+        "name": "openjdk_win",
+        "sha256": "e6ddb361309f8e84eb5fb5ad8b0f5cc031ba3679910139262c31efd8f7579d05",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-win_x64-allmodules-90755145cb6e6418584d8603cd5fa9afbb30aecc-1549209972.zip"
+        ]
+    },
+    "openjdk_win_minimal": {
+        "downloaded_file_path": "zulu-win-minimal.zip",
+        "name": "openjdk_win_minimal",
+        "sha256": "8e5dada6e9ebcc9ce29b4d051449bb95d3ee1e620e166da862224bbf15211f8b",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-win_x64-minimal-524ae2ca2a782c9f15e00f08bd35b3f8ceacbd7f-1556003136.zip"
+        ]
+    },
+    "openjdk_win_vanilla": {
+        "downloaded_file_path": "zulu-win-vanilla.zip",
+        "name": "openjdk_win_vanilla",
+        "sha256": "e1f5b4ce1b9148140fae2fcfb8a96d1c9b7eac5b8df0e13fbcad9b8561284880",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-win_x64.zip"
+        ]
+    },
+    "zulu10.2+3-jdk10.0.1-linux_x64-allmodules.tar.gz": {
+        "name": "zulu10.2+3-jdk10.0.1-linux_x64-allmodules.tar.gz",
+        "sha256": "57fad3602e74c79587901d6966d3b54ef32cb811829a2552163185d5064fe9b5",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu10.2+3-jdk10.0.1/zulu10.2+3-jdk10.0.1-linux_x64-allmodules.tar.gz"
+        ]
+    },
+    "zulu10.2+3-jdk10.0.1-macosx_x64-allmodules.tar.gz": {
+        "name": "zulu10.2+3-jdk10.0.1-macosx_x64-allmodules.tar.gz",
+        "sha256": "e669c9a897413d855b550b4e39d79614392e6fb96f494e8ef99a34297d9d85d3",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu10.2+3-jdk10.0.1/zulu10.2+3-jdk10.0.1-macosx_x64-allmodules.tar.gz"
+        ]
+    },
+    "zulu10.2+3-jdk10.0.1-win_x64-allmodules.zip": {
+        "name": "zulu10.2+3-jdk10.0.1-win_x64-allmodules.zip",
+        "sha256": "c39e7700a8d41794d60985df5a20352435196e78ecbc6a2b30df7be8637bffd5",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu10.2+3-jdk10.0.1/zulu10.2+3-jdk10.0.1-win_x64-allmodules.zip"
+        ]
+    },
+    "zulu11.2.3-jdk11.0.1-linux_x64.tar.gz": {
+        "name": "zulu11.2.3-jdk11.0.1-linux_x64.tar.gz",
+        "sha256": "232b1c3511f0d26e92582b7c3cc363be7ac633e371854ca2f2e9f2b50eb72a75",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.2.3-jdk11.0.1/zulu11.2.3-jdk11.0.1-linux_x64.tar.gz"
+        ]
+    },
+    "zulu11.2.3-jdk11.0.1-macosx_x64.tar.gz": {
+        "name": "zulu11.2.3-jdk11.0.1-macosx_x64.tar.gz",
+        "sha256": "1edf366ee821e5db8e348152fcb337b28dfd6bf0f97943c270dcc6747cedb6cb",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.2.3-jdk11.0.1/zulu11.2.3-jdk11.0.1-macosx_x64.tar.gz"
+        ]
+    },
+    "zulu11.2.3-jdk11.0.1-win_x64.zip": {
+        "name": "zulu11.2.3-jdk11.0.1-win_x64.zip",
+        "sha256": "8e1e2b8347de6746f3fd1538840dd643201533ab113abc4ed93678e342d28aa3",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.2.3-jdk11.0.1/zulu11.2.3-jdk11.0.1-win_x64.zip"
+        ]
+    },
+    "zulu11.29.3-ca-jdk11.0.2-linux_x64.tar.gz": {
+        "name": "zulu11.29.3-ca-jdk11.0.2-linux_x64.tar.gz",
+        "sha256": "f3f44b6235508e87b760bf37a49e186cc1fa4e9cd28384c4dbf5a33991921e08",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-linux_x64.tar.gz"
+        ]
+    },
+    "zulu11.29.3-ca-jdk11.0.2-macosx_x64.zip": {
+        "name": "zulu11.29.3-ca-jdk11.0.2-macosx_x64.zip",
+        "sha256": "059f8e3484bf07b63a8f2820d5f528f473eff1befdb1896ee4f8ff06be3b8d8f",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-macosx_x64.zip"
+        ]
+    },
+    "zulu11.29.3-ca-jdk11.0.2-win_x64.zip": {
+        "name": "zulu11.29.3-ca-jdk11.0.2-win_x64.zip",
+        "sha256": "e1f5b4ce1b9148140fae2fcfb8a96d1c9b7eac5b8df0e13fbcad9b8561284880",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu11.29.3-ca-jdk11.0.2/zulu11.29.3-ca-jdk11.0.2-win_x64.zip"
+        ]
+    },
+    "zulu9.0.7.1-jdk9.0.7-linux_x64-allmodules.tar.gz": {
+        "name": "zulu9.0.7.1-jdk9.0.7-linux_x64-allmodules.tar.gz",
+        "sha256": "f27cb933de4f9e7fe9a703486cf44c84bc8e9f138be0c270c9e5716a32367e87",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu-9.0.7.1-jdk9.0.7/zulu9.0.7.1-jdk9.0.7-linux_x64-allmodules.tar.gz"
+        ]
+    },
+    "zulu9.0.7.1-jdk9.0.7-macosx_x64-allmodules.tar.gz": {
+        "name": "zulu9.0.7.1-jdk9.0.7-macosx_x64-allmodules.tar.gz",
+        "sha256": "404e7058ff91f956612f47705efbee8e175a38b505fb1b52d8c1ea98718683de",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu-9.0.7.1-jdk9.0.7/zulu9.0.7.1-jdk9.0.7-macosx_x64-allmodules.tar.gz"
+        ]
+    },
+    "zulu9.0.7.1-jdk9.0.7-win_x64-allmodules.zip": {
+        "name": "zulu9.0.7.1-jdk9.0.7-win_x64-allmodules.zip",
+        "sha256": "e738829017f107e7a7cd5069db979398ec3c3f03ef56122f89ba38e7374f63ed",
+        "urls": [
+            "https://mirror.bazel.build/openjdk/azul-zulu-9.0.7.1-jdk9.0.7/zulu9.0.7.1-jdk9.0.7-win_x64-allmodules.zip"
+        ]
+    }
+}
diff --git a/nix/tools/bazel-deps/default.nix b/nix/tools/bazel-deps/default.nix
index 2dfcdf74090a..fc25a16cc05f 100644
--- a/nix/tools/bazel-deps/default.nix
+++ b/nix/tools/bazel-deps/default.nix
@@ -6,7 +6,7 @@
 buildBazelPackage rec {
   name = "bazel-deps-${version}";
   __noChroot = true;
-  version = "2019-03-05";
+  version = "2019-06-29";
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/johnynek/bazel-deps";
@@ -18,8 +18,8 @@ buildBazelPackage rec {
   src = fetchFromGitHub {
     owner = "johnynek";
     repo = "bazel-deps";
-    rev = "a53246efd3bcabc1362c830f53b6ac4818871b12";
-    sha256 = "0fa66yz619lz07lygf7dfvnqbj3ai4g6dwk7l92j2l5c4kpbx29a";
+    rev = "11035a564ff3d535d2d667e6c6fecaeacb252080";
+    sha256 = "0g5cx7sv4p4h6csqqmalsm4r7x56xnsynvb2h2508kwanwasm56s";
   };
 
   patches = [./maven-coordinates.patch];
@@ -74,7 +74,7 @@ buildBazelPackage rec {
       find . -type d -empty -delete
     '';
 
-    sha256 = "0kxb8xh9lqf2b3fx5ln3dm7dbs2min172xa6rdpvqmcl4vy73vcp";
+    sha256 = "1nlcw7p1gcsxkm4zzv4znqdkd42258576m9aavi57b1xqhk68fjm";
   };
 
   buildAttrs = {
diff --git a/nix/tools/bazel-watcher/default.nix b/nix/tools/bazel-watcher/default.nix
index 035bc16064d5..cb209e305333 100644
--- a/nix/tools/bazel-watcher/default.nix
+++ b/nix/tools/bazel-watcher/default.nix
@@ -8,18 +8,21 @@
 
 buildBazelPackage rec {
   name = "bazel-watcher-${version}";
-  version = "0.10.3";
+  version = "git-18bdb44";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "bazel-watcher";
-    rev = "v${version}";
+    rev = "18bdb44832ccc533e0ab3923ef80060eeb24582d";
     sha256 = "17z4nqqsdrainbh8fmhf6sgrxwf7aknadmn94z1yqpxa7kb9x33v";
   };
 
   nativeBuildInputs = [ go git python ];
 
   bazelTarget = "//ibazel";
+  bazelFlags = [
+    "--incompatible_string_join_requires_strings=false"
+  ];
 
   fetchAttrs = {
     preBuild = ''
@@ -47,13 +50,15 @@ buildBazelPackage rec {
       sed -e '/^FILE:@bazel_gazelle_go_repository_tools.*/d' -i $bazelOut/external/\@*.marker
     '';
 
-    sha256 = "1ck1rsg5msd77abs889nl2n2i3jlah4d4vjz5wbsb3jyhzn8n5ny";
+    sha256 = "1b2apdfcpx7v0rjcl9frx02cac1gic0acx7p526q5all6xic6r6k";
   };
 
   buildAttrs = {
     preBuild = ''
       patchShebangs .
 
+      echo build "--incompatible_require_ctx_in_configure_features=false" >> .bazelrc
+
       # tell rules_go to use the Go binary found in the PATH
       sed -e 's:go_register_toolchains():go_register_toolchains(go_version = "host"):g' -i WORKSPACE
     '';
diff --git a/package.json b/package.json
index 69272ee60b47..0ecaab8a611b 100644
--- a/package.json
+++ b/package.json
@@ -5,7 +5,6 @@
   "private": true,
   "version": "0.0.0",
   "dependencies": {
-    "@bazel/typescript": "0.23.2",
     "bower": "1.8.8",
     "browserify": "16.2.3",
     "dockerode": "^2.5.8",
@@ -30,6 +29,8 @@
     "url": "^0.11.0"
   },
   "devDependencies": {
-    "@bazel/bazel": "0.22.0"
+    "@bazel/bazel": "0.22.0",
+    "@bazel/hide-bazel-files": "0.32.2",
+    "@bazel/typescript": "0.32.2"
   }
 }
diff --git a/yarn.lock b/yarn.lock
index 251935c02952..261ea1adf13a 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -26,17 +26,84 @@
     "@bazel/bazel-linux_x64" "0.22.0"
     "@bazel/bazel-win32_x64" "0.22.0"
 
-"@bazel/typescript@0.23.2":
-  version "0.23.2"
-  resolved "https://registry.yarnpkg.com/@bazel/typescript/-/typescript-0.23.2.tgz#a3ff199880855259d84216cb41644c1d9a0fad14"
-  integrity sha512-GrTyDW6Fvp/rgnxZGYampB5/QmDWvxtLEtUyMCPa/QXFR1OVxaMWeHxxuFEcES2UKJegqBDKAA8IzX21x4UbEw==
+"@bazel/hide-bazel-files@0.32.2":
+  version "0.32.2"
+  resolved "https://registry.yarnpkg.com/@bazel/hide-bazel-files/-/hide-bazel-files-0.32.2.tgz#a482855eafbccb56b1fce0d92ff922c2c6e0a90c"
+  integrity sha512-585XY53mhMZaCjEQJ+aDqkmydWZbuXsKrZsSpoW9YeAVEH0poQY3YhdyCPmMVBo7/l1mkrqpFuOK5BpECfwdtA==
+
+"@bazel/typescript@0.32.2":
+  version "0.32.2"
+  resolved "https://registry.yarnpkg.com/@bazel/typescript/-/typescript-0.32.2.tgz#c296bb44cb6362a0e3a08ca88752852bc9591ecf"
+  integrity sha512-32zDyvHdYjIa63vtImhl6wy5ErOFVWPkjMT2T035D0UPSKI1tvENW/bRZ3QFlFHqfmJZRBpaI3GiUpO3vUvzmw==
   dependencies:
-    jasmine-core "2.8.0"
-    protobufjs "5.0.3"
+    protobufjs "6.8.8"
     semver "5.6.0"
     source-map-support "0.5.9"
     tsutils "2.27.2"
 
+"@protobufjs/aspromise@^1.1.1", "@protobufjs/aspromise@^1.1.2":
+  version "1.1.2"
+  resolved "https://registry.yarnpkg.com/@protobufjs/aspromise/-/aspromise-1.1.2.tgz#9b8b0cc663d669a7d8f6f5d0893a14d348f30fbf"
+  integrity sha1-m4sMxmPWaafY9vXQiToU00jzD78=
+
+"@protobufjs/base64@^1.1.2":
+  version "1.1.2"
+  resolved "https://registry.yarnpkg.com/@protobufjs/base64/-/base64-1.1.2.tgz#4c85730e59b9a1f1f349047dbf24296034bb2735"
+  integrity sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==
+
+"@protobufjs/codegen@^2.0.4":
+  version "2.0.4"
+  resolved "https://registry.yarnpkg.com/@protobufjs/codegen/-/codegen-2.0.4.tgz#7ef37f0d010fb028ad1ad59722e506d9262815cb"
+  integrity sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg==
+
+"@protobufjs/eventemitter@^1.1.0":
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/@protobufjs/eventemitter/-/eventemitter-1.1.0.tgz#355cbc98bafad5978f9ed095f397621f1d066b70"
+  integrity sha1-NVy8mLr61ZePntCV85diHx0Ga3A=
+
+"@protobufjs/fetch@^1.1.0":
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/@protobufjs/fetch/-/fetch-1.1.0.tgz#ba99fb598614af65700c1619ff06d454b0d84c45"
+  integrity sha1-upn7WYYUr2VwDBYZ/wbUVLDYTEU=
+  dependencies:
+    "@protobufjs/aspromise" "^1.1.1"
+    "@protobufjs/inquire" "^1.1.0"
+
+"@protobufjs/float@^1.0.2":
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/@protobufjs/float/-/float-1.0.2.tgz#5e9e1abdcb73fc0a7cb8b291df78c8cbd97b87d1"
+  integrity sha1-Xp4avctz/Ap8uLKR33jIy9l7h9E=
+
+"@protobufjs/inquire@^1.1.0":
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/@protobufjs/inquire/-/inquire-1.1.0.tgz#ff200e3e7cf2429e2dcafc1140828e8cc638f089"
+  integrity sha1-/yAOPnzyQp4tyvwRQIKOjMY48Ik=
+
+"@protobufjs/path@^1.1.2":
+  version "1.1.2"
+  resolved "https://registry.yarnpkg.com/@protobufjs/path/-/path-1.1.2.tgz#6cc2b20c5c9ad6ad0dccfd21ca7673d8d7fbf68d"
+  integrity sha1-bMKyDFya1q0NzP0hynZz2Nf79o0=
+
+"@protobufjs/pool@^1.1.0":
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/@protobufjs/pool/-/pool-1.1.0.tgz#09fd15f2d6d3abfa9b65bc366506d6ad7846ff54"
+  integrity sha1-Cf0V8tbTq/qbZbw2ZQbWrXhG/1Q=
+
+"@protobufjs/utf8@^1.1.0":
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/@protobufjs/utf8/-/utf8-1.1.0.tgz#a777360b5b39a1a2e5106f8e858f2fd2d060c570"
+  integrity sha1-p3c2C1s5oaLlEG+OhY8v0tBgxXA=
+
+"@types/long@^4.0.0":
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/@types/long/-/long-4.0.0.tgz#719551d2352d301ac8b81db732acb6bdc28dbdef"
+  integrity sha512-1w52Nyx4Gq47uuu0EVcsHBxZFJgurQ+rTKS3qMHxR1GY2T8c2AJYd6vZoZ9q1rupaDjU0yT+Jc2XTyXkjeMA+Q==
+
+"@types/node@^10.1.0":
+  version "10.14.10"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-10.14.10.tgz#e491484c6060af8d461e12ec81c0da8a3282b8de"
+  integrity sha512-V8wj+w2YMNvGuhgl/MA5fmTxgjmVHVoasfIaxMMZJV6Y8Kk+Ydpi1z2whoShDCJ2BuNVoqH/h1hrygnBxkrw/Q==
+
 JSONStream@1.3.2:
   version "1.3.2"
   resolved "https://registry.yarnpkg.com/JSONStream/-/JSONStream-1.3.2.tgz#c102371b6ec3a7cf3b847ca00c20bb0fce4c6dea"
@@ -212,14 +279,6 @@ array-unique@^0.3.2:
   resolved "https://registry.yarnpkg.com/array-unique/-/array-unique-0.3.2.tgz#a894b75d4bc4f6cd679ef3244a9fd8f46ae2d428"
   integrity sha1-qJS3XUvE9s1nnvMkSp/Y9Gri1Cg=
 
-ascli@~1:
-  version "1.0.1"
-  resolved "https://registry.yarnpkg.com/ascli/-/ascli-1.0.1.tgz#bcfa5974a62f18e81cabaeb49732ab4a88f906bc"
-  integrity sha1-vPpZdKYvGOgcq660lzKrSoj5Brw=
-  dependencies:
-    colour "~0.7.1"
-    optjs "~3.2.2"
-
 asn1.js@^4.0.0:
   version "4.10.1"
   resolved "https://registry.yarnpkg.com/asn1.js/-/asn1.js-4.10.1.tgz#b9c2bf5805f1e64aadeed6df3a2bfafb5a73f5a0"
@@ -578,13 +637,6 @@ builtin-status-codes@^3.0.0:
   resolved "https://registry.yarnpkg.com/builtin-status-codes/-/builtin-status-codes-3.0.0.tgz#85982878e21b98e1c66425e03d0174788f569ee8"
   integrity sha1-hZgoeOIbmOHGZCXgPQF0eI9Wnug=
 
-bytebuffer@~5:
-  version "5.0.1"
-  resolved "https://registry.yarnpkg.com/bytebuffer/-/bytebuffer-5.0.1.tgz#582eea4b1a873b6d020a48d58df85f0bba6cfddd"
-  integrity sha1-WC7qSxqHO20CCkjVjfhfC7ps/d0=
-  dependencies:
-    long "~3"
-
 bytes@1:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/bytes/-/bytes-1.0.0.tgz#3569ede8ba34315fab99c3e92cb04c7220de1fa8"
@@ -623,7 +675,7 @@ camelcase-keys@^2.0.0:
     camelcase "^2.0.0"
     map-obj "^1.0.0"
 
-camelcase@^2.0.0, camelcase@^2.0.1:
+camelcase@^2.0.0:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/camelcase/-/camelcase-2.1.1.tgz#7c1d16d679a1bbe59ca02cacecfb011e201f5a1f"
   integrity sha1-fB0W1nmhu+WcoCys7PsBHiAfWh8=
@@ -690,15 +742,6 @@ class-utils@^0.3.5:
     isobject "^3.0.0"
     static-extend "^0.1.1"
 
-cliui@^3.0.3:
-  version "3.2.0"
-  resolved "https://registry.yarnpkg.com/cliui/-/cliui-3.2.0.tgz#120601537a916d29940f934da3b48d585a39213d"
-  integrity sha1-EgYBU3qRbSmUD5NNo7SNWFo5IT0=
-  dependencies:
-    string-width "^1.0.1"
-    strip-ansi "^3.0.1"
-    wrap-ansi "^2.0.0"
-
 clone@2.x:
   version "2.1.2"
   resolved "https://registry.yarnpkg.com/clone/-/clone-2.1.2.tgz#1b7f4b9f591f1e8f83670401600345a02887435f"
@@ -739,11 +782,6 @@ colors@~1.1.2:
   resolved "https://registry.yarnpkg.com/colors/-/colors-1.1.2.tgz#168a4701756b6a7f51a12ce0c97bfa28c084ed63"
   integrity sha1-FopHAXVran9RoSzgyXv6KMCE7WM=
 
-colour@~0.7.1:
-  version "0.7.1"
-  resolved "https://registry.yarnpkg.com/colour/-/colour-0.7.1.tgz#9cb169917ec5d12c0736d3e8685746df1cadf778"
-  integrity sha1-nLFpkX7F0SwHNtPoaFdG3xyt93g=
-
 combine-source-map@^0.8.0, combine-source-map@~0.8.0:
   version "0.8.0"
   resolved "https://registry.yarnpkg.com/combine-source-map/-/combine-source-map-0.8.0.tgz#a58d0df042c186fcf822a8e8015f5450d2d79a8b"
@@ -959,7 +997,7 @@ debug@^3.1.0, debug@^3.2.6:
   dependencies:
     ms "^2.1.1"
 
-decamelize@^1.1.1, decamelize@^1.1.2:
+decamelize@^1.1.2:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/decamelize/-/decamelize-1.2.0.tgz#f6534d15148269b20352e7bee26f501f9a191290"
   integrity sha1-9lNNFRSCabIDUue+4m9QH5oZEpA=
@@ -1527,7 +1565,7 @@ glob-parent@^3.1.0:
     is-glob "^3.1.0"
     path-dirname "^1.0.0"
 
-glob@^7.0.5, glob@^7.1.0, glob@^7.1.2, glob@^7.1.3, glob@~7.1.1:
+glob@^7.1.0, glob@^7.1.2, glob@^7.1.3, glob@~7.1.1:
   version "7.1.3"
   resolved "https://registry.yarnpkg.com/glob/-/glob-7.1.3.tgz#3960832d3f1574108342dafd3a67b332c0969df1"
   integrity sha512-vcfuiIxogLV4DlGBHIUOwI0IbrJ8HWPc4MU7HzviGeNho/UJDfi6B5p3sHeWIQ0KGIU0Jpxi5ZHxemQfLkkAwQ==
@@ -2001,11 +2039,6 @@ interpret@~1.1.0:
   resolved "https://registry.yarnpkg.com/interpret/-/interpret-1.1.0.tgz#7ed1b1410c6a0e0f78cf95d3b8440c63f78b8614"
   integrity sha1-ftGxQQxqDg94z5XTuEQMY/eLhhQ=
 
-invert-kv@^1.0.0:
-  version "1.0.0"
-  resolved "https://registry.yarnpkg.com/invert-kv/-/invert-kv-1.0.0.tgz#104a8e4aaca6d3d8cd157a8ef8bfab2d7a3ffdb6"
-  integrity sha1-EEqOSqym09jNFXqO+L+rLXo//bY=
-
 ipaddr.js@1.9.0:
   version "1.9.0"
   resolved "https://registry.yarnpkg.com/ipaddr.js/-/ipaddr.js-1.9.0.tgz#37df74e430a0e47550fe54a2defe30d8acd95f65"
@@ -2214,11 +2247,6 @@ isobject@^3.0.0, isobject@^3.0.1:
   resolved "https://registry.yarnpkg.com/isobject/-/isobject-3.0.1.tgz#4e431e92b11a9731636aa1f9c8d1ccbcfdab78df"
   integrity sha1-TkMekrEalzFjaqH5yNHMvP2reN8=
 
-jasmine-core@2.8.0:
-  version "2.8.0"
-  resolved "https://registry.yarnpkg.com/jasmine-core/-/jasmine-core-2.8.0.tgz#bcc979ae1f9fd05701e45e52e65d3a5d63f1a24e"
-  integrity sha1-vMl5rh+f0FcB5F5S5l06XWPxok4=
-
 js-yaml@~3.13.0:
   version "3.13.1"
   resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.13.1.tgz#aff151b30bfdfa8e49e05da22e7415e9dfa37847"
@@ -2282,13 +2310,6 @@ labeled-stream-splicer@^2.0.0:
     isarray "^2.0.4"
     stream-splicer "^2.0.0"
 
-lcid@^1.0.0:
-  version "1.0.0"
-  resolved "https://registry.yarnpkg.com/lcid/-/lcid-1.0.0.tgz#308accafa0bc483a3867b4b6f2b9506251d1b835"
-  integrity sha1-MIrMr6C8SDo4Z7S28rlQYlHRuDU=
-  dependencies:
-    invert-kv "^1.0.0"
-
 liftoff@~2.5.0:
   version "2.5.0"
   resolved "https://registry.yarnpkg.com/liftoff/-/liftoff-2.5.0.tgz#2009291bb31cea861bbf10a7c15a28caf75c31ec"
@@ -2334,10 +2355,10 @@ lodash@4.x, lodash@^4.17.10, lodash@^4.17.11, lodash@^4.17.4, lodash@~4.17.10, l
   resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.11.tgz#b39ea6229ef607ecd89e2c8df12536891cac9b8d"
   integrity sha512-cQKh8igo5QUhZ7lg38DYWAxMvjSAKG0A8wGSVimP07SIUEK2UO+arSRKbRZWtelMtN5V0Hkwh5ryOto/SshYIg==
 
-long@~3:
-  version "3.2.0"
-  resolved "https://registry.yarnpkg.com/long/-/long-3.2.0.tgz#d821b7138ca1cb581c172990ef14db200b5c474b"
-  integrity sha1-2CG3E4yhy1gcFymQ7xTbIAtcR0s=
+long@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/long/-/long-4.0.0.tgz#9a7b71cfb7d361a194ea555241c92f7468d5bf28"
+  integrity sha512-XsP+KhQif4bjX1kbuSiySJFNAehNxgLb6hPRGJ9QsUr8ajHkuXGdrHmFUTUUXhDwVX2R5bY4JNZEwbUiMhV+MA==
 
 loud-rejection@^1.0.0:
   version "1.6.0"
@@ -2819,11 +2840,6 @@ opn@^5.4.0:
   dependencies:
     is-wsl "^1.1.0"
 
-optjs@~3.2.2:
-  version "3.2.2"
-  resolved "https://registry.yarnpkg.com/optjs/-/optjs-3.2.2.tgz#69a6ce89c442a44403141ad2f9b370bd5bb6f4ee"
-  integrity sha1-aabOicRCpEQDFBrS+bNwvVu29O4=
-
 os-browserify@~0.3.0:
   version "0.3.0"
   resolved "https://registry.yarnpkg.com/os-browserify/-/os-browserify-0.3.0.tgz#854373c7f5c2315914fc9bfc6bd8238fdda1ec27"
@@ -2834,13 +2850,6 @@ os-homedir@^1.0.0:
   resolved "https://registry.yarnpkg.com/os-homedir/-/os-homedir-1.0.2.tgz#ffbc4988336e0e833de0c168c7ef152121aa7fb3"
   integrity sha1-/7xJiDNuDoM94MFox+8VISGqf7M=
 
-os-locale@^1.4.0:
-  version "1.4.0"
-  resolved "https://registry.yarnpkg.com/os-locale/-/os-locale-1.4.0.tgz#20f9f17ae29ed345e8bde583b13d2009803c14d9"
-  integrity sha1-IPnxeuKe00XoveWDsT0gCYA8FNk=
-  dependencies:
-    lcid "^1.0.0"
-
 os-tmpdir@^1.0.0:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/os-tmpdir/-/os-tmpdir-1.0.2.tgz#bbe67406c79aa85c5cfec766fe5734555dfa1274"
@@ -3037,15 +3046,24 @@ process@~0.11.0:
   resolved "https://registry.yarnpkg.com/process/-/process-0.11.10.tgz#7332300e840161bda3e69a1d1d91a7d4bc16f182"
   integrity sha1-czIwDoQBYb2j5podHZGn1LwW8YI=
 
-protobufjs@5.0.3:
-  version "5.0.3"
-  resolved "https://registry.yarnpkg.com/protobufjs/-/protobufjs-5.0.3.tgz#e4dfe9fb67c90b2630d15868249bcc4961467a17"
-  integrity sha512-55Kcx1MhPZX0zTbVosMQEO5R6/rikNXd9b6RQK4KSPcrSIIwoXTtebIczUrXlwaSrbz4x8XUVThGPob1n8I4QA==
-  dependencies:
-    ascli "~1"
-    bytebuffer "~5"
-    glob "^7.0.5"
-    yargs "^3.10.0"
+protobufjs@6.8.8:
+  version "6.8.8"
+  resolved "https://registry.yarnpkg.com/protobufjs/-/protobufjs-6.8.8.tgz#c8b4f1282fd7a90e6f5b109ed11c84af82908e7c"
+  integrity sha512-AAmHtD5pXgZfi7GMpllpO3q1Xw1OYldr+dMUlAnffGTAhqkg72WdmSY71uKBF/JuyiKs8psYbtKrhi0ASCD8qw==
+  dependencies:
+    "@protobufjs/aspromise" "^1.1.2"
+    "@protobufjs/base64" "^1.1.2"
+    "@protobufjs/codegen" "^2.0.4"
+    "@protobufjs/eventemitter" "^1.1.0"
+    "@protobufjs/fetch" "^1.1.0"
+    "@protobufjs/float" "^1.0.2"
+    "@protobufjs/inquire" "^1.1.0"
+    "@protobufjs/path" "^1.1.2"
+    "@protobufjs/pool" "^1.1.0"
+    "@protobufjs/utf8" "^1.1.0"
+    "@types/long" "^4.0.0"
+    "@types/node" "^10.1.0"
+    long "^4.0.0"
 
 proxy-addr@~2.0.5:
   version "2.0.5"
@@ -4137,19 +4155,6 @@ wide-align@^1.1.0:
   dependencies:
     string-width "^1.0.2 || 2"
 
-window-size@^0.1.4:
-  version "0.1.4"
-  resolved "https://registry.yarnpkg.com/window-size/-/window-size-0.1.4.tgz#f8e1aa1ee5a53ec5bf151ffa09742a6ad7697876"
-  integrity sha1-+OGqHuWlPsW/FR/6CXQqatdpeHY=
-
-wrap-ansi@^2.0.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-2.1.0.tgz#d8fc3d284dd05794fe84973caecdd1cf824fdd85"
-  integrity sha1-2Pw9KE3QV5T+hJc8rs3Rz4JP3YU=
-  dependencies:
-    string-width "^1.0.1"
-    strip-ansi "^3.0.1"
-
 wrappy@1:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/wrappy/-/wrappy-1.0.2.tgz#b5243d8f3ec1aa35f1364605bc0d1036e30ab69f"
@@ -4169,25 +4174,7 @@ xtend@^4.0.0, xtend@^4.0.1, xtend@~4.0.0, xtend@~4.0.1:
   resolved "https://registry.yarnpkg.com/xtend/-/xtend-4.0.1.tgz#a5c6d532be656e23db820efb943a1f04998d63af"
   integrity sha1-pcbVMr5lbiPbgg77lDofBJmNY68=
 
-y18n@^3.2.0:
-  version "3.2.1"
-  resolved "https://registry.yarnpkg.com/y18n/-/y18n-3.2.1.tgz#6d15fba884c08679c0d77e88e7759e811e07fa41"
-  integrity sha1-bRX7qITAhnnA136I53WegR4H+kE=
-
 yallist@^3.0.0, yallist@^3.0.2:
   version "3.0.3"
   resolved "https://registry.yarnpkg.com/yallist/-/yallist-3.0.3.tgz#b4b049e314be545e3ce802236d6cd22cd91c3de9"
   integrity sha512-S+Zk8DEWE6oKpV+vI3qWkaK+jSbIK86pCwe2IF/xwIpQ8jEuxpw9NyaGjmp9+BoJv5FV2piqCDcoCtStppiq2A==
-
-yargs@^3.10.0:
-  version "3.32.0"
-  resolved "https://registry.yarnpkg.com/yargs/-/yargs-3.32.0.tgz#03088e9ebf9e756b69751611d2a5ef591482c995"
-  integrity sha1-AwiOnr+edWtpdRYR0qXvWRSCyZU=
-  dependencies:
-    camelcase "^2.0.1"
-    cliui "^3.0.3"
-    decamelize "^1.1.1"
-    os-locale "^1.4.0"
-    string-width "^1.0.1"
-    window-size "^0.1.4"
-    y18n "^3.2.0"