diff --git a/CURATORS.md b/CURATORS.md
index 534942d1..6eb02941 100644
--- a/CURATORS.md
+++ b/CURATORS.md
@@ -230,7 +230,7 @@ docker rm $(docker ps -a -q)
 docker rmi $(docker images -q)
 ```
 
-but `docker pull snoyberg/stackage:nightly` can also be run instead just to update the nightly image say.
+but `docker pull commercialhaskell/stackage:nightly` can also be run instead just to update the nightly image say.
 
 For a new GHC version you should also delete the cache directories on the stackage-build server to
 force all packages to be rebuilt. See: [issue#746](https://github.com/commercialhaskell/stackage/issues/746). Eg:
@@ -241,14 +241,16 @@ This should also be done when moving the Nightly docker image to a new version o
 
 If you're impatient and would like to build the Docker image on the
 build server instead of waiting for Docker Hub, you can run the
-following command:
+following command (replacing `BRANCH=nightly` if the image for a different branch is desired):
 
 ```
+BRANCH=nightly
 DIR=$(mktemp -d)
 (cd $DIR \
   && git clone https://github.com/commercialhaskell/stackage \
   && cd stackage \
-  && docker build --tag snoyberg/stackage:nightly .)
+  && git checkout $BRANCH
+  && docker build --tag commercialhaskell/stackage:$BRANCH .)
 rm -rf $DIR
 ```
 
@@ -312,7 +314,10 @@ develop this advice over time. For now: if you're not sure, ask for guidance.
 __`NOPLAN=1`__ If you wish to rerun a build without recalculating a
 build plan, you can set the environment variable `NOPLAN=1`. This is
 useful for such cases as an intermittent test failure, out of memory
-condition, or manually tweaking the plan file.
+condition, or manually tweaking the plan file. (When using `NOPLAN=1`,
+if one needs to revert one package, say due to a build or test regression,
+one can edit `current-plan.yaml` and updated the SHA256 hash of the .cabal file,
+to avoid having to rebuild everything again.)
 
 Note LTS builds inherit the current Hackage data (stack updated for Nigthly) to avoid excess extra rebuilding.
 
diff --git a/Dockerfile b/Dockerfile
index cf8c7ccc..84815261 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,7 @@ ENV HOME /home/stackage
 ENV LANG en_US.UTF-8
 
 # NOTE: also update debian-bootstrap.sh when cuda version changes
-ENV PATH /usr/local/cuda-10.0/bin:/opt/ghc/8.6.1/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ENV PATH /usr/local/cuda-10.0/bin:/opt/ghc/8.6.2/bin:/usr/sbin:/usr/bin:/sbin:/bin
 ENV CUDA_PATH /usr/local/cuda-10.0
 ENV LD_LIBRARY_PATH=/usr/local/cuda-10.0/lib64:/usr/local/cuda-10.0/nvvm/lib64
 
diff --git a/build-constraints.yaml b/build-constraints.yaml
index 05b0ac02..af1422f8 100644
--- a/build-constraints.yaml
+++ b/build-constraints.yaml
@@ -7,8 +7,10 @@ cabal-format-version: "2.2"
 
 # Constraints for brand new builds
 packages:
+    "Preetham Gujjula <preetham.gujjula@gmail.com> @pgujjula":
+        - modular
 
-    "Erik Schnetter <schnetter@gmail.com> @eschnett": 
+    "Erik Schnetter <schnetter@gmail.com> @eschnett":
         - mpi-hs < 0 # https://github.com/commercialhaskell/stackage/issues/4068
 
     "Yang Bo <pop.atry@gmail.com> @Atry":
@@ -57,6 +59,7 @@ packages:
         - dunai
         - rhine
         - rhine-gloss
+        - dunai-core
 
     "Paul Johnson <paul@cogito.org.uk> @PaulJohnson":
         - geodetics
@@ -526,7 +529,7 @@ packages:
         - psqueues
         - websockets
         - websockets-snap
-        - hakyll < 0 # via pandoc
+        # - hakyll # containers-0.6
 
     "Sibi Prabakaran <sibi@psibi.in> @psibi":
         - download
@@ -535,7 +538,7 @@ packages:
         - tldr
         - fb
         - yesod-fb
-        - yesod-auth-fb
+        - yesod-auth-fb < 0 # https://github.com/psibi/yesod-auth-fb/issues/4
         - hourglass-orphans
         - wai-slack-middleware
         - sysinfo
@@ -708,6 +711,7 @@ packages:
         - vector-instances
         - void
         - wl-pprint-extras
+        - wreq < 0
         - wl-pprint-terminfo
         - zippers
         - zlib-lens
@@ -734,20 +738,20 @@ packages:
         - rank2classes
 
     "Brent Yorgey <byorgey@gmail.com> @byorgey":
-        - active < 0 # via lens-4.17
+        - active
         - diagrams < 0 # via diagrams-contrib
         - diagrams-builder < 0 # via lens-4.17
         - diagrams-cairo < 0 # via lens-4.17
         - diagrams-canvas < 0 # via lens-4.17
         - diagrams-contrib < 0 # via lens-4.17
-        - diagrams-core < 0 # via lens-4.17
+        - diagrams-core
         - diagrams-gtk < 0 # via diagrams-cairo
         - diagrams-html5 < 0 # via lens-4.17
-        - diagrams-lib < 0 # via lens-4.17
+        - diagrams-lib
         - diagrams-postscript < 0 # via lens-4.17
         - diagrams-rasterific < 0 # via lens-4.17
         - diagrams-solve
-        - diagrams-svg < 0 # via lens-4.17
+        - diagrams-svg
         - force-layout < 0 # via lens-4.17
         - SVGFonts < 0 # via diagrams-core
         - palette
@@ -923,7 +927,7 @@ packages:
     "Michal J. Gajda <maintainer@migamake.com> @mgajda":
         - iterable
         - FenwickTree
-        - json-autotype < 0 # via lens-4.17
+        - json-autotype
 
     "Dom De Re <domdere@domdere.com> @domdere":
         - cassava-conduit
@@ -1218,8 +1222,8 @@ packages:
         - ghcjs-perch < 0 # build failure with GHC 8.4
 
     "Tom Ellis <tom-stackage@jaguarpaw.co.uk> @tomjaguarpaw":
-        - opaleye < 0 # aeson 1.3
-        - product-profunctors < 0 # via contravariant-1.5
+        - opaleye
+        - product-profunctors
 
     "Samplecount stefan@samplecount.com @kaoskorobase":
         - shake-language-c
@@ -1245,6 +1249,7 @@ packages:
         - simple-log
         - text-region
         - haskell-names
+        - hsdev
 
     "Aleksey Kliger <aleksey@lambdageek.org> @lambdageek":
         - unbound-generics
@@ -1320,8 +1325,8 @@ packages:
 
     "Tomas Carnecky @wereHamster":
         - avers
-        # - avers-api # avers, GHC 8.6
-        # - avers-server # cryptonite 0.25
+        - avers-api
+        - avers-server
         - css-syntax
         # - etcd # https://github.com/wereHamster/etcd-hs/issues/5
         - github-types
@@ -1873,6 +1878,7 @@ packages:
         - hamilton
         - hmatrix-backprop
         - hmatrix-vector-sized
+        - lens-typelevel
         - one-liner-instances
         - prompt
         - tagged-binary
@@ -1956,9 +1962,13 @@ packages:
         - timerep
         - xml-conduit-parse
 
+    "Daniel Cartwright <chessai1996@gmail.com> @chessai":
+        - streaming
+        - streaming-bytestring
+        - country
+
     "Kostiantyn Rybnikov <k-bx@k-bx.com> @k-bx":
         - SHA
-        - country
         - currency
         - data-ordlist
         - digits
@@ -1977,8 +1987,6 @@ packages:
         - protocol-buffers
         - protocol-buffers-descriptor
         - regex-pcre
-        - streaming
-        - streaming-bytestring
         - string-class
         - string-combinators
 
@@ -2011,9 +2019,9 @@ packages:
     "Stack Builders stackage@stackbuilders.com @stackbuilders":
         - atomic-write
         - dbcleaner
-        - dotenv < 0.6.0.1 # https://github.com/commercialhaskell/stackage/issues/3955
+        - dotenv
         - hapistrano
-        - inflections < 0.4.0.4 # https://github.com/commercialhaskell/stackage/issues/3955
+        - inflections
         - stache
         - scalendar
 
@@ -2145,6 +2153,7 @@ packages:
         - netpbm
         - network-house
         - reinterpret-cast
+        - shared-memory
         - posix-paths < 0 # GHC 8.4 via base-4.11.0.0
         # As dependencies of packages above
         - attoparsec-binary
@@ -2225,6 +2234,8 @@ packages:
 
     "Jonas Carpay <jonascarpay@gmail.com> @jonascarpay":
         - apecs
+        - apecs-physics
+        - apecs-physics-gloss
 
     "Spencer Janssen <spencerjanssen@gmail.com> @spencerjanssen":
         - Xauth
@@ -2330,10 +2341,10 @@ packages:
         - req
         - req-conduit
         - cue-sheet
-        - wave
-        - flac
-        - flac-picture
-        - lame
+        - wave < 0 # mrkkrp/wave#9
+        - flac < 0 # depends on wave
+        - flac-picture < 0 # depends on flac
+        - lame < 0 # depends on wave
         - path
         - forma
         - stache
@@ -2381,6 +2392,9 @@ packages:
         - pthread < 0 # BuildFailureException Process exited with ExitFailure 1: ./Setup build
         - rank1dynamic
 
+    "Dave Tapley <dukedave@gmail.com> @dukedave":
+        - inline-c-cpp
+
     "Takahiro Himura <himuratk421@gmail.com> @himura":
         - lens-regex
         # haskell-src-exts via derive
@@ -2604,8 +2618,8 @@ packages:
         - pandoc-types < 1.19 || > 1.19 # Accidental upload, see: https://github.com/fpco/stackage/issues/2223
         - zip-archive
         - doctemplates
-        - pandoc < 0 # via haddock-library-1.6.0
-        - pandoc-citeproc < 0 # via pandoc
+        - pandoc
+        - pandoc-citeproc
 
     "Karun Ramakrishnan <karun012@gmail.com> @karun012":
         - doctest-discover
@@ -2619,7 +2633,7 @@ packages:
         - ua-parser
         - hs-GeoIP
         - retry
-        - katip < 0 # via aeson-1.3.1.0
+        - katip
         # - katip-elasticsearch # async 2.2
 
     "Sid Kapur sidharthkapur1@gmail.com @sid-kap":
@@ -2721,6 +2735,7 @@ packages:
         - hw-rankselect
         - hw-rankselect-base
         - hw-succinct
+        - hw-streams
         - hw-xml < 0 # Build failure haskell-works/hw-xml#28
         - pure-zlib
         - antiope-athena
@@ -2744,6 +2759,10 @@ packages:
         - protolude
         - repline
         - picosat
+        - aos-signature
+        - bulletproofs < 0 # not published to Hackage yet (11 Nov. 18)
+        - pedersen-commitment
+        - merkle-tree
 
     "Daishi Nakajima <nakaji.dayo@gmail.com> @nakaji-dayo":
         - api-field-json-th
@@ -2926,6 +2945,7 @@ packages:
         - writer-cps-morph
         - writer-cps-lens
         - writer-cps-full
+        - writer-cps-exceptions
         - wl-pprint-annotated
         - wl-pprint-console
         - console-style
@@ -2935,6 +2955,7 @@ packages:
         - colorful-monoids
         - ihs
         - paripari
+        - persist
 
     "Taras Serduke <taras.serduke@gmail.com> @tserduke":
         - do-list
@@ -3007,6 +3028,7 @@ packages:
         - pg-transact
         - hspec-pg-transact
         - postgresql-simple-queue
+        - port-utils
 
     "Mahdi Dibaiee <mdibaiee@aol.com> @mdibaiee":
         - picedit < 0 # DependencyFailed (PackageName "cli")
@@ -3223,7 +3245,7 @@ packages:
         - conduit-throttle
 
     "Simon Hafner <hafnersimon@gmail.com> @reactormonk":
-        - uri-bytestring-aeson < 0 # GHC 8.4 via base-4.11.0.0
+        - uri-bytestring-aeson
         - katip-scalyr-scribe < 0 # via katip
 
     "Sebastian Witte <woozletoff@gmail.com> @saep":
@@ -3294,7 +3316,7 @@ packages:
         - first-class-patterns
         - relude
         - summoner
-        - tomland
+        - tomland < 0 # megaparsec 7
 
     "Lorenz Moesenlechner <moesenle@gmail.com> @moesenle":
         - servant-websockets
@@ -3445,8 +3467,10 @@ packages:
     "Alexis Williams <alexis@typedr.at> @typedrat":
         - stb-image-redux
 
-    "Alexandre Peyroux <alex@xn--wxa.email> @apeyroux":
+    "Alexandre Peyroux <alex@px.io> @apeyroux":
         - HSlippyMap
+        - google-isbn
+        - nuxeo
 
     "Andrey Sverdlichenko <blaze@ruddy.ru> @rblaze":
         - credential-store
@@ -3476,6 +3500,8 @@ packages:
     "Domen Kozar <domen@enlambda.com> @domenkozar":
         - cachix
         - cachix-api
+        - mixpanel-client
+        - pretty-sop
         - servant-auth
         - servant-auth-server
         - servant-auth-client
@@ -3486,6 +3512,7 @@ packages:
         - servant-streaming-client
         - servant-streaming-server
         - streaming-wai
+        - systemd
 
     "Andre Van Der Merwe <stackage@andrevdm.com> @andrevdm":
         - bhoogle
@@ -3540,6 +3567,8 @@ packages:
 
     "Chris Coffey <chris@foldl.io> @ChrisCoffey":
         - servant-tracing
+        - cuckoo-filter < 0 # adinapoli/cuckoofilter#1
+        - confcrypt
 
     "Rick Owens <rick@owensmurray.com> @owensmurray":
         - om-elm
@@ -3570,7 +3599,7 @@ packages:
         - yesod-text-markdown
 
     "Alexander Krupenkin <mail@akru.me> @akru":
-        - web3 < 0 # via aeson-1.4.0.0
+        - web3
 
     "Georg Rudoy <0xd34df00d@gmail.com> @0xd34df00d":
         - enum-subset-generate
@@ -3642,6 +3671,15 @@ packages:
     "Nikos Karagianndis <nkarag@gmail.com> @nkarag":
         - DBFunctor
 
+    "Marat Khafizov <xafizoff@gmail.com> @xafizoff":
+        - n2o
+        #- n2o-nitro
+        #- n2o-protocols
+        #- n2o-web
+
+    "David Smith <shmish111@gmail.com> @shmish111":
+        - bazel-runfiles
+
     # If you stop maintaining a package you can move it here.
     # It will then be disabled if it starts causing problems.
     # See https://github.com/fpco/stackage/issues/1056
@@ -3710,12 +3748,10 @@ packages:
         - HaskellNet < 0
         - HaskellNet-SSL < 0
         - IPv6DB < 0
-        - JuicyPixels-extra < 0
         - JuicyPixels-scale-dct < 0
         - LambdaHack < 0
         - Network-NineP < 0
         - QuasiText < 0
-        - RSA < 0
         - RefSerialize < 0
         - SCalendar < 0
         - ShellCheck < 0
@@ -3726,96 +3762,6 @@ packages:
         - aeson-typescript < 0
         - alarmclock < 0
         - algebra < 0
-        - amazonka < 0
-        - amazonka-apigateway < 0
-        - amazonka-application-autoscaling < 0
-        - amazonka-appstream < 0
-        - amazonka-athena < 0
-        - amazonka-autoscaling < 0
-        - amazonka-budgets < 0
-        - amazonka-certificatemanager < 0
-        - amazonka-cloudformation < 0
-        - amazonka-cloudfront < 0
-        - amazonka-cloudhsm < 0
-        - amazonka-cloudsearch < 0
-        - amazonka-cloudsearch-domains < 0
-        - amazonka-cloudtrail < 0
-        - amazonka-cloudwatch < 0
-        - amazonka-cloudwatch-events < 0
-        - amazonka-cloudwatch-logs < 0
-        - amazonka-codebuild < 0
-        - amazonka-codecommit < 0
-        - amazonka-codedeploy < 0
-        - amazonka-codepipeline < 0
-        - amazonka-cognito-identity < 0
-        - amazonka-cognito-idp < 0
-        - amazonka-cognito-sync < 0
-        - amazonka-config < 0
-        - amazonka-core < 0
-        - amazonka-datapipeline < 0
-        - amazonka-devicefarm < 0
-        - amazonka-directconnect < 0
-        - amazonka-discovery < 0
-        - amazonka-dms < 0
-        - amazonka-ds < 0
-        - amazonka-dynamodb < 0
-        - amazonka-dynamodb-streams < 0
-        - amazonka-ec2 < 0
-        - amazonka-ecr < 0
-        - amazonka-ecs < 0
-        - amazonka-efs < 0
-        - amazonka-elasticache < 0
-        - amazonka-elasticbeanstalk < 0
-        - amazonka-elasticsearch < 0
-        - amazonka-elastictranscoder < 0
-        - amazonka-elb < 0
-        - amazonka-elbv2 < 0
-        - amazonka-emr < 0
-        - amazonka-gamelift < 0
-        - amazonka-glacier < 0
-        - amazonka-health < 0
-        - amazonka-iam < 0
-        - amazonka-importexport < 0
-        - amazonka-inspector < 0
-        - amazonka-iot < 0
-        - amazonka-iot-dataplane < 0
-        - amazonka-kinesis < 0
-        - amazonka-kinesis-analytics < 0
-        - amazonka-kinesis-firehose < 0
-        - amazonka-kms < 0
-        - amazonka-lambda < 0
-        - amazonka-lightsail < 0
-        - amazonka-marketplace-analytics < 0
-        - amazonka-marketplace-metering < 0
-        - amazonka-ml < 0
-        - amazonka-opsworks < 0
-        - amazonka-opsworks-cm < 0
-        - amazonka-pinpoint < 0
-        - amazonka-polly < 0
-        - amazonka-rds < 0
-        - amazonka-redshift < 0
-        - amazonka-rekognition < 0
-        - amazonka-route53 < 0
-        - amazonka-route53-domains < 0
-        - amazonka-s3 < 0
-        - amazonka-sdb < 0
-        - amazonka-servicecatalog < 0
-        - amazonka-ses < 0
-        - amazonka-shield < 0
-        - amazonka-sms < 0
-        - amazonka-snowball < 0
-        - amazonka-sns < 0
-        - amazonka-sqs < 0
-        - amazonka-ssm < 0
-        - amazonka-stepfunctions < 0
-        - amazonka-storagegateway < 0
-        - amazonka-sts < 0
-        - amazonka-support < 0
-        - amazonka-swf < 0
-        - amazonka-test < 0
-        - amazonka-waf < 0
-        - amazonka-workspaces < 0
-        - amazonka-xray < 0
         - amqp < 0
         - antiope-athena < 0
         - antiope-core < 0
@@ -3830,9 +3776,7 @@ packages:
         - asif < 0
         - async-pool < 0
         - atom-conduit < 0
-        - authenticate-oauth < 0
         - autoexporter < 0
-        - avers < 0
         - avwx < 0
         - axel < 0
         - bank-holidays-england < 0
@@ -3854,17 +3798,11 @@ packages:
         - bson < 0
         - bson-lens < 0
         - bugsnag-haskell < 0
-        - cabal-install < 0
-        - cabal2nix < 0
         - cachix < 0
         - cachix-api < 0
         - cairo < 0
         - cayley-client < 0
-        - cborg < 0
         - chatwork < 0
-        - cheapskate < 0
-        - cheapskate-highlight < 0
-        - cheapskate-lucid < 0
         - check-email < 0
         - cipher-aes128 < 0
         - cipher-blowfish < 0
@@ -3877,7 +3815,6 @@ packages:
         - clash-ghc < 0
         - clash-lib < 0
         - clash-prelude < 0
-        - classy-prelude-yesod < 0
         - classyplate < 0
         - closed < 0
         - code-builder < 0
@@ -3889,35 +3826,25 @@ packages:
         - consul-haskell < 0
         - containers-unicode-symbols < 0
         - country < 0
-        - cpphs < 0
         - cql-io < 0
         - credential-store < 0
         - crypto-pubkey < 0
-        - crypto-pubkey-types < 0
         - cryptocipher < 0
         - cryptocompare < 0
-        - cryptohash-cryptoapi < 0
-        - cryptonite-conduit < 0
         - cryptonite-openssl < 0
         - csg < 0
-        - cue-sheet < 0
         - curl-runnings < 0
         - cyclotomic < 0
         - czipwith < 0
         - darcs < 0
         - data-tree-print < 0
-        - datadog < 0
         - datasets < 0
         - dawg-ord < 0
         - deferred-folds < 0
         - dejafu < 0
         - derulo < 0
-        - dhall < 0
         - dhall-bash < 0
-        - dhall-json < 0
-        - dhall-text < 0
         - dhall-to-cabal < 0
-        - diagrams-solve < 0
         - discrimination < 0
         - distributed-static < 0
         - distribution-opensuse < 0
@@ -3932,7 +3859,6 @@ packages:
         - edit < 0
         - ekg-core < 0
         - ekg-statsd < 0
-        - email-validate < 0
         - emd < 0
         - enummapset < 0
         - envy < 0
@@ -3945,15 +3871,11 @@ packages:
         - fay < 0
         - fay-base < 0
         - fay-dom < 0
-        - fb < 0
         - feed < 0
         - file-modules < 0
         - filecache < 0
         - find-clumpiness < 0
-        - flac < 0
-        - flac-picture < 0
         - flow < 0
-        - fmt < 0
         - fold-debounce-conduit < 0
         - friday < 0
         - friday-juicypixels < 0
@@ -3963,7 +3885,6 @@ packages:
         - generic-xmlpickler < 0
         - generics-eot < 0
         - ghc-parser < 0
-        - ghc-syntax-highlighter < 0
         - ghcjs-base-stub < 0
         - gi-gtk-hs < 0
         - gio < 0
@@ -3985,7 +3906,6 @@ packages:
         - gtk3 < 0
         - gym-http-api < 0
         - hOpenPGP < 0
-        - haddock-library < 0
         - hailgun < 0
         - hamilton < 0
         - handwriting < 0
@@ -3994,7 +3914,6 @@ packages:
         - haskell-lsp < 0
         - haskell-lsp-types < 0
         - haskell-spacegoo < 0
-        - haskell-src-meta < 0
         - haskell-tools-ast < 0
         - haskell-tools-backend-ghc < 0
         - haskell-tools-builtin-refactorings < 0
@@ -4016,7 +3935,6 @@ packages:
         - hasql-pool < 0
         - hasql-transaction < 0
         - hedis < 0
-        - here < 0
         - herms < 0
         - heterocephalus < 0
         - hgrev < 0
@@ -4028,26 +3946,18 @@ packages:
         - hledger-lib < 0
         - hledger-ui < 0
         - hledger-web < 0
-        - hlint < 0
         - hmatrix-backprop < 0
         - hmatrix-vector-sized < 0
-        - hoogle < 0
         - hoopl < 0
         - hopenpgp-tools < 0
-        - hpack < 0
         - hpqtypes < 0
         - hquantlib < 0
         - hsebaysdk < 0
-        - hslua < 0
-        - hslua-aeson < 0
-        - hslua-module-text < 0
-        - hspec-megaparsec < 0
         - hspec-need-env < 0
         - hspec-wai-json < 0
         - hsx-jmacro < 0
         - hsyslog-udp < 0
         - http-client-openssl < 0
-        - http-reverse-proxy < 0
         - http-streams < 0
         - hunit-dejafu < 0
         - hw-json < 0
@@ -4056,17 +3966,14 @@ packages:
         - hxt-pickle-utils < 0
         - hyperloglog < 0
         - hyraxAbif < 0
-        - identicon < 0
         - ihaskell < 0
         - ihaskell-hvega < 0
         - incremental-parser < 0
         - indentation-core < 0
         - indentation-parsec < 0
-        - indexed-list-literals < 0
         - influxdb < 0
         - inline-java < 0
         - inliterate < 0
-        - interpolate < 0
         - interpolatedstring-perl6 < 0
         - invertible < 0
         - invertible-grammar < 0
@@ -4080,7 +3987,6 @@ packages:
         - jmacro < 0
         - jmacro-rpc < 0
         - jmacro-rpc-snap < 0
-        - jose < 0
         - jose-jwt < 0
         - json-feed < 0
         - json-rpc-client < 0
@@ -4093,9 +3999,6 @@ packages:
         - koofr-client < 0
         - kraken < 0
         - lackey < 0
-        - lambdabot-core < 0
-        - lambdabot-irc-plugins < 0
-        - lame < 0
         - language-c-quote < 0
         - language-puppet < 0
         - learn-physics < 0
@@ -4108,7 +4011,6 @@ packages:
         - logging-effect-extra < 0
         - logging-effect-extra-file < 0
         - logging-effect-extra-handler < 0
-        - lrucache < 0
         - lucid-extras < 0
         - mapquest-api < 0
         - marvin-interpolate < 0
@@ -4122,20 +4024,14 @@ packages:
         - mime-mail-ses < 0
         - minio-hs < 0
         - miso < 0
-        - mmark < 0
-        - mmark-cli < 0
-        - mmark-ext < 0
-        - modern-uri < 0
         - moesocks < 0
         - monad-metrics < 0
         - mongoDB < 0
-        - monoid-extras < 0
         - monoid-subclasses < 0
         - monoidal-containers < 0
         - morte < 0
         - multipart < 0
         - mwc-probability-transition < 0
-        - mysql-haskell < 0
         - mysql-haskell-nem < 0
         - mysql-haskell-openssl < 0
         - named < 0
@@ -4165,7 +4061,6 @@ packages:
         - parallel-io < 0
         - partial-order < 0
         - perf < 0
-        - persistent-mysql-haskell < 0
         - persistent-refs < 0
         - picosat < 0
         - pier < 0
@@ -4182,7 +4077,6 @@ packages:
         - pipes-safe < 0
         - pkcs10 < 0
         - plotlyhs < 0
-        - polyparse < 0
         - postgresql-binary < 0
         - postgresql-simple-migration < 0
         - postgresql-simple-url < 0
@@ -4191,7 +4085,6 @@ packages:
         - prometheus < 0
         - protocol-radius < 0
         - protocol-radius-test < 0
-        - protolude < 0
         - publicsuffix < 0
         - qm-interpolated-string < 0
         - qnap-decrypt < 0
@@ -4204,13 +4097,9 @@ packages:
         - rebase < 0
         - ref-fd < 0
         - registry < 0
-        - repline < 0
-        - req < 0
-        - req-conduit < 0
         - req-url-extra < 0
         - require < 0
         - rerebase < 0
-        - rethinkdb-client-driver < 0
         - rhine < 0
         - rhine-gloss < 0
         - rollbar-hs < 0
@@ -4224,20 +4113,13 @@ packages:
         - search-algorithms < 0
         - seqid < 0
         - seqid-streams < 0
-        - serialise < 0
         - servant-JuicyPixels < 0
-        - servant-auth < 0
-        - servant-auth-client < 0
-        - servant-auth-docs < 0
-        - servant-auth-server < 0
-        - servant-auth-swagger < 0
         - servant-checked-exceptions < 0
         - servant-checked-exceptions-core < 0
         - servant-dhall < 0
         - servant-elm < 0
         - servant-exceptions < 0
         - servant-github-webhook < 0
-        - servant-kotlin < 0
         - servant-pandoc < 0
         - servant-quickcheck < 0
         - servant-rawm < 0
@@ -4246,9 +4128,7 @@ packages:
         - servant-streaming < 0
         - servant-streaming-client < 0
         - servant-streaming-server < 0
-        - servant-tracing < 0
         - servant-websockets < 0
-        - serverless-haskell < 0
         - servius < 0
         - ses-html < 0
         - set-cover < 0
@@ -4268,7 +4148,6 @@ packages:
         - sparkle < 0
         - speculation < 0
         - squeal-postgresql < 0
-        - stache < 0
         - stack < 0
         - statestack < 0
         - static-text < 0
@@ -4278,17 +4157,14 @@ packages:
         - stringsearch < 0
         - strive < 0
         - summoner < 0
-        - svg-builder < 0
         - swish < 0
         - tasty-dejafu < 0
         - tasty-stats < 0
-        - tcp-streams < 0
         - tcp-streams-openssl < 0
         - tdigest < 0
         - telegram-bot-simple < 0
         - termbox < 0
         - termonad < 0
-        - texmath < 0
         - text-builder < 0
         - text-ldap < 0
         - text-show < 0
@@ -4309,7 +4185,6 @@ packages:
         - tz < 0
         - tzdata < 0
         - union < 0
-        - uri-bytestring < 0
         - uri-templater < 0
         - urlpath < 0
         - users < 0
@@ -4318,7 +4193,6 @@ packages:
         - vector-sized < 0
         - vector-space < 0
         - vectortiles < 0
-        - versions < 0
         - wai-cli < 0
         - wai-middleware-caching-lru < 0
         - wai-middleware-consul < 0
@@ -4328,9 +4202,7 @@ packages:
         - wai-middleware-travisci < 0
         - wai-slack-middleware < 0
         - wai-transformers < 0
-        - wai-websockets < 0
         - warp-tls-uid < 0
-        - wave < 0
         - web-plugins < 0
         - webdriver < 0
         - webex-teams-api < 0
@@ -4342,7 +4214,6 @@ packages:
         - withdependencies < 0
         - wl-pprint-extras < 0
         - wl-pprint-terminfo < 0
-        - wreq < 0
         - wreq-stringless < 0
         - ws < 0
         - wss-client < 0
@@ -4350,27 +4221,7 @@ packages:
         - xml-html-qq < 0
         - xmonad-contrib < 0
         - xmonad-extras < 0
-        - yesod < 0
-        - yesod-alerts < 0
-        - yesod-auth < 0
-        - yesod-auth-fb < 0
         - yesod-auth-hashdb < 0
-        - yesod-bin < 0
-        - yesod-csp < 0
-        - yesod-eventsource < 0
-        - yesod-fb < 0
-        - yesod-form < 0
-        - yesod-form-bootstrap4 < 0
-        - yesod-gitrepo < 0
-        - yesod-newsfeed < 0
-        - yesod-paginator < 0
-        - yesod-persistent < 0
-        - yesod-recaptcha2 < 0
-        - yesod-sitemap < 0
-        - yesod-static < 0
-        - yesod-test < 0
-        - yesod-text-markdown < 0
-        - yesod-websockets < 0
 
         # failed to build
         - ClustalParser < 0
@@ -4380,7 +4231,6 @@ packages:
         - df1 < 0
         - di-handle < 0
         - dimensional < 0
-        - dunai < 0
         - exinst < 0
         - extensible < 0
         - fgl < 0
@@ -4398,7 +4248,6 @@ packages:
         - o-clock < 0
         - stm-stats < 0
         - teardown < 0
-        - typenums < 0
         - typography-geometry < 0
         - universe-instances-extended < 0
         - vivid < 0
@@ -4428,14 +4277,7 @@ packages:
         - hspec-core < 2.5.6
         - hspec-discover < 2.5.6
         - hspec-meta < 2.5.6
-
-        # https://github.com/commercialhaskell/stackage/issues/3955
-        - megaparsec < 7.0.0
-        - hspec-megaparsec
-        - modern-uri
-        - cue-sheet
-        - stache
-        - neat-interpolation < 0.3.2.3
+        - hspec-contrib < 0.5.1
 
         # https://github.com/commercialhaskell/stackage/issues/4053
         - yaml < 0.11
@@ -4446,9 +4288,8 @@ packages:
         # https://github.com/commercialhaskell/stackage/issues/4066
         - generics-sop < 0.4.0.0
 
-        # https://github.com/commercialhaskell/stackage/issues/4067
-        - hsinstall < 2
-
+        # https://github.com/commercialhaskell/stackage/issues/4073
+        - pretty-show < 1.9
 # end of packages
 
 # Package flags are applied to individual packages, and override the values of
@@ -4573,6 +4414,9 @@ package-flags:
     windns:
         allow-non-windows: true
 
+    hsdev:
+        docs: false
+
 # end of package-flags
 
 # Special configure options for individual packages
@@ -4641,6 +4485,7 @@ skipped-tests:
     # These can periodically be checked for updates;
     # just remove these lines and run `stackage-curator check' to verify.
     - Cabal # GHC 8.4 via base-orphans-0.7, base-orphans-0.7
+    - RSA # DRBG-0.5.5 via cipher-aes128-0.7.0.3 via Cabal-2.4
     - aeson # QuickCheck-2.11.3, base-orphans-0.7, hashable-time
     - attoparsec # QuickCheck-2.11.3
     - barrier # tasty 0.12 and tasty-hunit 0.10
@@ -4652,12 +4497,12 @@ skipped-tests:
     - ed25519 # QuickCheck, hlint and more
     - hackage-security # QuickCheck
     - haddock-library # base-compat-0.10.1, hspec-2.5.1
+    - haskell-src-meta # GHC 8.6, template-haskell
     - http-streams # via snap-server-1.1.0.0
     - indents # tasty 0.12 and tasty-hunit 0.10
     - ip # hspec 2.5 https://github.com/andrewthad/haskell-ip/issues/33
     - language-ecmascript # testing-feat 1.1.0.0
     - makefile # GHC 8.2
-    - mysql-haskell # tasty
     - next-ref # hspec 2.3
     - partial-order # HUnit 1.6
     - serialise
@@ -4716,6 +4561,7 @@ skipped-tests:
     - rss-conduit
     - servant-blaze
     - servant-cassava
+    - servant-auth-server
     - siggy-chardust
     - simple-vec3
     - skews
@@ -4742,6 +4588,7 @@ skipped-tests:
     - path # via genvalidity genvalidity-property
     - system-fileio # ansi-terminal-0.8 via chell
     - system-filepath # ansi-terminal-0.8 via chell
+    - buffer-builder # per HTF per cpphs per polyparse (ghc 8.6 failure)
 
     # Blocked by stackage upper bounds. These can be re-enabled once
     # the relevant stackage upper bound is lifted.
@@ -4952,6 +4799,7 @@ expected-test-failures:
     - users-postgresql-simple # PostgreSQL
     - wai-cors # PhantomJS
     - wai-session-postgresql # PostgreSQL
+    - web3 # requires running server
     - webdriver-angular # webdriver server
     - websockets
 
@@ -4979,6 +4827,7 @@ expected-test-failures:
     - http-client-tls # https://github.com/snoyberg/http-client/issues/360
     - http-link-header # https://github.com/myfreeweb/http-link-header/issues/7
     - mmark # https://github.com/commercialhaskell/stackage/issues/3906#issuecomment-413061849
+    - systemd # https://github.com/erebe/systemd/issues/3
     - unicode-show # https://github.com/nushio3/unicode-show/issues/2
     - wreq
     - xml-picklers # https://github.com/Philonous/xml-picklers/issues/5
@@ -4994,6 +4843,7 @@ expected-test-failures:
     - hoopl # https://github.com/haskell/hoopl/issues/50
     - hspec-expectations-pretty-diff # GHC 8 issue not reported upstream since issue tracker disabled
     - hweblib # https://github.com/aycanirican/hweblib/issues/3
+    - multiset # doctests require Glob, a hidden package
     - perf # https://github.com/fpco/stackage/pull/2859
     - picosat # https://github.com/fpco/stackage/pull/2382
     - pkcs10 # https://github.com/fcomb/pkcs10-hs/issues/2
@@ -5091,6 +4941,7 @@ expected-haddock-failures:
 skipped-haddocks:
 - approximate
 - invertible
+- modular # https://github.com/haskell/haddock/issues/900
 - sparkle # Java function failures tweag/sparkle#144
 # end of skipped-haddocks
 
@@ -5130,7 +4981,6 @@ skipped-benchmarks:
     - binary-tagged
     - Earley
     - IntervalMap
-    - JuicyPixels-extra
     - ad
     - attoparsec
     - backprop
@@ -5239,7 +5089,6 @@ skipped-benchmarks:
     - type-of-html
     - ua-parser
     - unbound-generics
-    - uri-bytestring
     - vec
     - vinyl
     - websockets
@@ -5412,6 +5261,8 @@ github-users:
         - RyanGlScott
     onrock-eng:
         - donkeybonks
+    tweag:
+        - bazel-runfiles
 
 # end of github-users
 
diff --git a/check b/check
index 7c0440a4..f4aa4ca2 100755
--- a/check
+++ b/check
@@ -3,4 +3,4 @@
 # Convenience script for checking constraints locally
 
 cd `dirname $0`
-exec stack exec --resolver ghc-8.6.1 stackage-curator check
+exec stack exec --resolver ghc-8.6.2 stackage-curator check
diff --git a/debian-bootstrap.sh b/debian-bootstrap.sh
index 322a6a43..eed169cf 100755
--- a/debian-bootstrap.sh
+++ b/debian-bootstrap.sh
@@ -25,7 +25,7 @@ add-apt-repository -y --keyserver hkp://keyserver.ubuntu.com:80 'deb http://down
 add-apt-repository -y --keyserver hkp://keyserver.ubuntu.com:80 'deb http://download.mono-project.com/repo/debian wheezy-apache24-compat main'
 add-apt-repository -y --keyserver hkp://keyserver.ubuntu.com:80 'deb http://download.mono-project.com/repo/debian wheezy-libjpeg62-compat main'
 
-GHCVER=8.6.1
+GHCVER=8.6.2
 
 apt-get update
 apt-get install -y \
diff --git a/etc/ci-script.sh b/etc/ci-script.sh
index 27c860e0..4b4e39fb 100755
--- a/etc/ci-script.sh
+++ b/etc/ci-script.sh
@@ -2,7 +2,7 @@
 
 set -euxo pipefail
 
-export GHCVER=8.6.1
+export GHCVER=8.6.2
 
 # Download and unpack the stack executable
 mkdir -p ~/.local/bin