diff --git a/lib/licenses.nix b/lib/licenses.nix
index edf35ec035b2..a790b576032d 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -292,9 +292,10 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "Independent JPEG Group License";
   };
 
-  inria = {
-    fullName  = "INRIA Non-Commercial License Agreement";
+  inria-compcert = {
+    fullName  = "INRIA Non-Commercial License Agreement for the CompCert verified compiler";
     url       = "http://compcert.inria.fr/doc/LICENSE";
+    free      = false;
   };
 
   ipa = spdx {
diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index e9cf58c5baaa..8485609146b6 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -238,6 +238,7 @@
   guillaumekoenig = "Guillaume Koenig <guillaume.edward.koenig@gmail.com>";
   guyonvarch = "Joris Guyonvarch <joris@guyonvarch.me>";
   hakuch = "Jesse Haber-Kucharsky <hakuch@gmail.com>";
+  hamhut1066 = "Hamish Hutchings <github@hamhut1066.com>";
   havvy = "Ryan Scheel <ryan.havvy@gmail.com>";
   hbunke = "Hendrik Bunke <bunke.hendrik@gmail.com>";
   hce = "Hans-Christian Esperer <hc@hcesperer.org>";
diff --git a/nixos/modules/programs/xonsh.nix b/nixos/modules/programs/xonsh.nix
index c0be2d8884b3..49cc4906e038 100644
--- a/nixos/modules/programs/xonsh.nix
+++ b/nixos/modules/programs/xonsh.nix
@@ -21,7 +21,7 @@ in
       enable = mkOption {
         default = false;
         description = ''
-          Whether to configure xnosh as an interactive shell.
+          Whether to configure xonsh as an interactive shell.
         '';
         type = types.bool;
       };
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 412355fb35b5..d6c8ac547246 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -142,9 +142,9 @@ let
     GITLAB_UPLOADS_PATH = "${cfg.statePath}/uploads";
     GITLAB_LOG_PATH = "${cfg.statePath}/log";
     GITLAB_SHELL_PATH = "${cfg.packages.gitlab-shell}";
-    GITLAB_SHELL_CONFIG_PATH = "${cfg.statePath}/home/config.yml";
+    GITLAB_SHELL_CONFIG_PATH = "${cfg.statePath}/shell/config.yml";
     GITLAB_SHELL_SECRET_PATH = "${cfg.statePath}/config/gitlab_shell_secret";
-    GITLAB_SHELL_HOOKS_PATH = "${cfg.statePath}/home/hooks";
+    GITLAB_SHELL_HOOKS_PATH = "${cfg.statePath}/shell/hooks";
     GITLAB_REDIS_CONFIG_FILE = pkgs.writeText "gitlab-redis.yml" redisYml;
     prometheus_multiproc_dir = "/run/gitlab";
     RAILS_ENV = "production";
@@ -555,6 +555,7 @@ in {
         openssh
         nodejs
         procps
+        gnupg
       ];
       preStart = ''
         mkdir -p ${cfg.backupPath}
@@ -567,7 +568,7 @@ in {
         mkdir -p ${cfg.statePath}/tmp/pids
         mkdir -p ${cfg.statePath}/tmp/sockets
 
-        rm -rf ${cfg.statePath}/config ${cfg.statePath}/home/hooks
+        rm -rf ${cfg.statePath}/config ${cfg.statePath}/shell/hooks
         mkdir -p ${cfg.statePath}/config
 
         tr -dc A-Za-z0-9 < /dev/urandom | head -c 32 > ${cfg.statePath}/config/gitlab_shell_secret
diff --git a/nixos/modules/services/security/hologram-agent.nix b/nixos/modules/services/security/hologram-agent.nix
index 49b5c935267b..6c53a2df6306 100644
--- a/nixos/modules/services/security/hologram-agent.nix
+++ b/nixos/modules/services/security/hologram-agent.nix
@@ -33,6 +33,8 @@ in {
   };
 
   config = mkIf cfg.enable {
+    boot.kernelModules = [ "dummy" ];
+
     networking.interfaces.dummy0 = {
       ipAddress = "169.254.169.254";
       prefixLength = 32;
diff --git a/nixos/modules/services/ttys/kmscon.nix b/nixos/modules/services/ttys/kmscon.nix
index 8bad42927e3f..88e488425bce 100644
--- a/nixos/modules/services/ttys/kmscon.nix
+++ b/nixos/modules/services/ttys/kmscon.nix
@@ -60,6 +60,7 @@ in {
       ConditionPathExists=/dev/tty0
 
       [Service]
+      ExecStart=
       ExecStart=${pkgs.kmscon}/bin/kmscon "--vt=%I" ${cfg.extraOptions} --seats=seat0 --no-switchvt --configdir ${configDir} --login -- ${pkgs.shadow}/bin/login -p
       UtmpIdentifier=%I
       TTYPath=/dev/%I
diff --git a/nixos/tests/virtualbox.nix b/nixos/tests/virtualbox.nix
index 4f7cb176d96f..a1ab7614871a 100644
--- a/nixos/tests/virtualbox.nix
+++ b/nixos/tests/virtualbox.nix
@@ -461,11 +461,11 @@ in mapAttrs mkVBoxTest {
     my $test1IP = waitForIP_test1 1;
     my $test2IP = waitForIP_test2 1;
 
-    $machine->succeed("echo '$test2IP' | nc '$test1IP' 1234");
-    $machine->succeed("echo '$test1IP' | nc '$test2IP' 1234");
+    $machine->succeed("echo '$test2IP' | nc -N '$test1IP' 1234");
+    $machine->succeed("echo '$test1IP' | nc -N '$test2IP' 1234");
 
-    $machine->waitUntilSucceeds("nc '$test1IP' 5678 >&2");
-    $machine->waitUntilSucceeds("nc '$test2IP' 5678 >&2");
+    $machine->waitUntilSucceeds("nc -N '$test1IP' 5678 < /dev/null >&2");
+    $machine->waitUntilSucceeds("nc -N '$test2IP' 5678 < /dev/null >&2");
 
     shutdownVM_test1;
     shutdownVM_test2;
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 95f3c0801d2a..d7f71af65293 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -216,12 +216,12 @@ in
 
   clion = buildClion rec {
     name = "clion-${version}";
-    version = "2017.2.1"; /* updated by script */
+    version = "2017.2.2"; /* updated by script */
     description  = "C/C++ IDE. New. Intelligent. Cross-platform";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "acd3d09a37a3fa922a85a48635d1b230d559ea68917e2e7895caf16460d50c13"; /* updated by script */
+      sha256 = "1rnncii7z44186jv9xl3ax179ws9wfwd6yndyf9pvnpcd4jcs6d0"; /* updated by script */
     };
     wmClass = "jetbrains-clion";
     update-channel = "CLion_Release"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@@ -242,77 +242,38 @@ in
 
   gogland = buildGogland rec {
     name = "gogland-${version}";
-    version = "172.3757.46"; /* updated by script */
+    version = "172.3968.45"; /* updated by script */
     description = "Up and Coming Go IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0d6b710edc434ed5d5ea5c4734b9026e2caeba7e74a027c1eb6fd837c5d4f4fd"; /* updated by script */
+      sha256 = "0nk9g28l414yp5ldyx1yl38qpp9s1pxkfxfwmw9yvlff3bi0kkyw"; /* updated by script */
     };
     wmClass = "jetbrains-gogland";
     update-channel = "gogland_1.0_EAP";
   };
 
-  idea14-community = buildIdea rec {
-    name = "idea-community-${version}";
-    version = "14.1.7";
-    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
-    license = stdenv.lib.licenses.asl20;
-    src = fetchurl {
-      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "1i4mdjm9dd6zvxlpdgd3bqg45ir0cfc9hl55cdc0hg5qwbz683fz";
-    };
-    wmClass = "jetbrains-idea-ce";
-    update-channel = "IDEA14.1";
-  };
-
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2017.2.2"; /* updated by script */
+    version = "2017.2.4"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "c719af3d538bef23d061ef62d4acbf503198ff62322a3c0c5b3c38ab7ac36c4f"; /* updated by script */
+      sha256 = "179nqzgbb76pyr48faca6k69v32m5kvx66i2apih95g54sd1xgva"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IDEA_Release";
   };
 
-  idea14-ultimate = buildIdea rec {
-    name = "idea-ultimate-${version}";
-    version = "14.1.7";
-    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
-    license = stdenv.lib.licenses.unfree;
-    src = fetchurl {
-      url = "https://download.jetbrains.com/idea/ideaIU-${version}.tar.gz";
-      sha256 = "1hhga1i2zbsipgq283gn19kv9n94inhr1bxh2yx19gz7yr4r49d2";
-    };
-    wmClass = "jetbrains-idea";
-    update-channel = "IDEA14.1";
-  };
-
-  idea15-ultimate = buildIdea rec {
-    name = "idea-ultimate-${version}";
-    version = "15.0.6";
-    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
-    license = stdenv.lib.licenses.unfree;
-    src = fetchurl {
-      url = "https://download.jetbrains.com/idea/ideaIU-${version}.tar.gz";
-      sha256 = "012aap2qn0jx4x34bdv9ivrsr86vvf683srb5vpj27hc4l6rw6ll";
-    };
-    wmClass = "jetbrains-idea";
-    update-channel = null;
-  };
-
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2017.2.2"; /* updated by script */
+    version = "2017.2.4"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jdk.tar.gz";
-      sha256 = "b8eb9d612800cc896eb6b6fbefbf9f49d92d2350ae1c3c4598e5e12bf93be401"; /* updated by script */
+      sha256 = "1qwqk1r42llh8py0w2iq4w1ks3ipzsxkbdz0zkrd1572zngpk90m"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IDEA_Release";
@@ -320,38 +281,25 @@ in
 
   phpstorm = buildPhpStorm rec {
     name = "phpstorm-${version}";
-    version = "2017.2.1"; /* updated by script */
+    version = "2017.2.4"; /* updated by script */
     description = "Professional IDE for Web and PHP developers";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "2f1af9ef6e9cda25a809a19a25f2d4fbaef00edf9d1d5a195572ab5e04e71e5e"; /* updated by script */
+      sha256 = "0hn3x5wid2z7s2mhnxfqh2yhdkscccpbz7qgsxkjvmkxcynazrvy"; /* updated by script */
     };
     wmClass = "jetbrains-phpstorm";
     update-channel = "PS2017.2";
   };
 
-  phpstorm10 = buildPhpStorm rec {
-    name = "phpstorm-${version}";
-    version = "10.0.4";
-    description = "Professional IDE for Web and PHP developers";
-    license = stdenv.lib.licenses.unfree;
-    src = fetchurl {
-      url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "0fi042zvjpg5pn2mnhj3bbrdkl1b9vmhpf2l6ca4nr0rhjjv7dsm";
-    };
-    wmClass = "jetbrains-phpstorm";
-    update-channel = "WI10";
-  };
-
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2017.2.2"; /* updated by script */
+    version = "2017.2.3"; /* updated by script */
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "4eacc9bf512406bebf71546ccb4b6c14ea8e06748fd76be6ca409ea1955e1f53"; /* updated by script */
+      sha256 = "1aik3jhggxfxnfv4kg9716gwsi013511jf9n20f2mqzdq8w2jmp8"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm_Release";
@@ -359,12 +307,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2017.2.2"; /* updated by script */
+    version = "2017.2.3"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "21aedfd189115fcfee0e8c8df88eccbd8f19b998667af3c55ce5d56d4eaa37a9"; /* updated by script */
+      sha256 = "0ib96yaj7l0igiv2bcrqqpbfn2xn3ic7lxyjn99k6dh8ika1qvry"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm_Release";
@@ -372,15 +320,15 @@ in
 
   rider = buildRider rec {
     name = "rider-${version}";
-    version = "171.4456.1432"; /* updated by script */
+    version = "2017.1.1"; /* updated by script */
     description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
-      url = "https://download.jetbrains.com/resharper/Rider-RC-${version}.tar.gz";
-      sha256 = "37bad69cdfcc4f297b2500a7bb673af7ef8f1fd45baa4eb2fa388d2c4bcb41ee"; /* updated by script */
+      url = "https://download.jetbrains.com/resharper/JetBrains.Rider-${version}.tar.gz";
+      sha256 = "1h6p847izddard3227ifg3q5klwvdfixir63i6adkd2fvsqn5935"; /* updated by script */
     };
     wmClass = "jetbrains-rider";
-    update-channel = "rider_2017_1_eap";
+    update-channel = "rider_2017_1";
   };
 
   ruby-mine = buildRubyMine rec {
@@ -396,68 +344,17 @@ in
     update-channel = "rm2017.1";
   };
 
-  ruby-mine7 = buildRubyMine rec {
-    name = "ruby-mine-${version}";
-    version = "7.1.5";
-    description = "The Most Intelligent Ruby and Rails IDE";
-    license = stdenv.lib.licenses.unfree;
-    src = fetchurl {
-      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "04fcxj1xlap9mxmwf051s926p2darlj5kwl4lms2gy5d8b2lhd5l";
-    };
-    wmClass = "jetbrains-rubymine";
-    update-channel = null;
-  };
-
-  ruby-mine8 = buildRubyMine rec {
-    name = "ruby-mine-${version}";
-    version = "8.0.4";
-    description = "The Most Intelligent Ruby and Rails IDE";
-    license = stdenv.lib.licenses.unfree;
-    src = fetchurl {
-      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "0hipxib7377232w1jbf8h98bmh0djkllsrq3lq0w3fdxqglma43a";
-    };
-    wmClass = "jetbrains-rubymine";
-    update-channel = null;
-  };
-
   webstorm = buildWebStorm rec {
     name = "webstorm-${version}";
-    version = "2017.2.2"; /* updated by script */
+    version = "2017.2.4"; /* updated by script */
     description = "Professional IDE for Web and JavaScript development";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "d6b7b103f8543e25d2602657f12d029856529895af6354e1a0875ed40bd05180"; /* updated by script */
+      sha256 = "1dd2fbsyra4fm39w1kz2biljbrmcqwd866hvzsidigmjplhlzan0"; /* updated by script */
     };
     wmClass = "jetbrains-webstorm";
     update-channel = "WS_Release";
   };
 
-  webstorm10 = buildWebStorm rec {
-    name = "webstorm-${version}";
-    version = "10.0.5";
-    description = "Professional IDE for Web and JavaScript development";
-    license = stdenv.lib.licenses.unfree;
-    src = fetchurl {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "0a5s6f99wyql5pgjl94pf4ljdbviik3b8dbr1s6b7c6jn1gk62ic";
-    };
-    wmClass = "jetbrains-webstorm";
-    update-channel = null;
-  };
-
-  webstorm11 = buildWebStorm rec {
-    name = "webstorm-${version}";
-    version = "11.0.4";
-    description = "Professional IDE for Web and JavaScript development";
-    license = stdenv.lib.licenses.unfree;
-    src = fetchurl {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "17agyqdyz6naxyx6p0y240ar93gja0ypw01nm2qmfzvh7ch03r24";
-    };
-    wmClass = "jetbrains-webstorm";
-    update-channel = null;
-  };
 }
diff --git a/pkgs/applications/editors/texworks/default.nix b/pkgs/applications/editors/texworks/default.nix
new file mode 100644
index 000000000000..fe90250d4152
--- /dev/null
+++ b/pkgs/applications/editors/texworks/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, lib, fetchFromGitHub, cmake, pkgconfig
+, qt5, libsForQt5, hunspell
+, withLua ? true, lua
+, withPython ? true, python }:
+
+stdenv.mkDerivation rec {
+  name = "texworks-${version}";
+  version = "0.6.2";
+
+  src = fetchFromGitHub {
+    owner = "TeXworks";
+    repo = "texworks";
+    rev = "release-${version}";
+    sha256 = "0kj4pq5h4vs2wwg6cazxjlv83x6cwdfsa76winfkdddaqzpdklsj";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ qt5.qtscript libsForQt5.poppler hunspell lua python ]
+                ++ lib.optional withLua lua
+                ++ lib.optional withPython python;
+
+  cmakeFlags = lib.optional withLua "-DWITH_LUA=ON"
+               ++ lib.optional withPython "-DWITH_PYTHON=ON";
+
+  meta = with stdenv.lib; {
+    description = "Simple TeX front-end program inspired by TeXShop";
+    homepage = http://www.tug.org/texworks/;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ dotlambda ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/applications/editors/vscode/default.nix b/pkgs/applications/editors/vscode/default.nix
index e0de8facd3f2..f72af1908c50 100644
--- a/pkgs/applications/editors/vscode/default.nix
+++ b/pkgs/applications/editors/vscode/default.nix
@@ -2,7 +2,7 @@
   makeWrapper, libXScrnSaver, libxkbfile, libsecret }:
 
 let
-  version = "1.16.0";
+  version = "1.16.1";
   channel = "stable";
 
   plat = {
@@ -12,9 +12,9 @@ let
   }.${stdenv.system};
 
   sha256 = {
-    "i686-linux" = "04jf9rl5116qc3n7xgqxir9c54dpkjm210yinih0qnp1wxhb6q0m";
-    "x86_64-linux" = "125xl933y4zmvp4922wm6b3p5d2xfdi9c5a7svx63p6fwxqjk33y";
-    "x86_64-darwin" = "0v8v4spz31qbv5ikb4bkdfldmpj5i6ahlzwn2h5wbfzlzsl8bk24";
+    "i686-linux" = "1k06rish1a1hqrkvzy21lg05vmzd345aa65g3d08ikh6508mp100";
+    "x86_64-linux" = "1l2xbdvjfmf05cqcjcj3w2450vi7wvkm5zdwkmfhh01fnvbrygnw";
+    "x86_64-darwin" = "0bxv3qlhcqn5sb5l5pjhi5560vi1sl844hx3r5x48gmmgd8yziaj";
   }.${stdenv.system};
 
   archive_fmt = if stdenv.system == "x86_64-darwin" then "zip" else "tar.gz";
diff --git a/pkgs/applications/misc/calibre/default.nix b/pkgs/applications/misc/calibre/default.nix
index 6ca457cc1d37..cd9a71729218 100644
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@@ -5,12 +5,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.5.0";
+  version = "3.7.0";
   name = "calibre-${version}";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${version}/${name}.tar.xz";
-    sha256 = "1al0vy11zvlxlrf03i631p6b419hy47pbzmgydswrii4prndj4xv";
+    sha256 = "1wb0ixx11q0p5dzcszq1n2lx9bcl5dynr87d7anfiz73mxdq20za";
   };
 
   patches = [
diff --git a/pkgs/applications/misc/khal/default.nix b/pkgs/applications/misc/khal/default.nix
index 98dbb0cbf911..1334f2317b9d 100644
--- a/pkgs/applications/misc/khal/default.nix
+++ b/pkgs/applications/misc/khal/default.nix
@@ -1,14 +1,15 @@
-{ stdenv, fetchurl, pkgs, python3Packages }:
+{ stdenv, pkgs, python3Packages }:
 
 with python3Packages;
 
 buildPythonApplication rec {
-  version = "0.9.5";
-  name = "khal-${version}";
+  name = "${pname}-${version}";
+  pname = "khal";
+  version = "0.9.7";
 
-  src = fetchurl {
-    url = "mirror://pypi/k/khal/khal-${version}.tar.gz";
-    sha256 = "0fvv0kjym9q8v20zbpr5m8ig65b8hva4p0c935qsdvgdni68jidr";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0x1p62ff7ggb172rjr6sbdrjh1gl3ck3bwxsqlsix8i5wycwvnmv";
   };
 
   LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/applications/misc/mqtt-bench/default.nix b/pkgs/applications/misc/mqtt-bench/default.nix
new file mode 100644
index 000000000000..eea166d8df75
--- /dev/null
+++ b/pkgs/applications/misc/mqtt-bench/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, buildGoPackage, fetchFromGitHub, fetchpatch }:
+
+buildGoPackage rec {
+  name = "mqtt-bench-${version}";
+  version = "0.3.0";
+  rev = "v${version}";
+
+  goPackagePath = "github.com/takanorig/mqtt-bench";
+
+  src = fetchFromGitHub {
+    inherit rev;
+    owner = "takanorig";
+    repo = "mqtt-bench";
+    sha256 = "03b9ak2j303iwq6abd7j10f2cs2ianwnbflwmyx9g96i7zd74f5m";
+  };
+
+  patches = [
+    (fetchpatch {
+      url = "https://patch-diff.githubusercontent.com/raw/takanorig/mqtt-bench/pull/13.patch";
+      name = "mqtt-paho-changes.patch";
+      sha256 = "17c8ajrp5dmbsasj6njxrlhy0x08b65fignzm3yccqbhb4ijcvha";
+    })
+  ];
+
+  goDeps = ./deps.nix;
+
+  meta = with stdenv.lib; {
+    description = "Mosquitto benchmark tool";
+    homepage = https://github.com/takanorig/mqtt-bench;
+    maintainers = with maintainers; [ disassembler ];
+  };
+}
diff --git a/pkgs/applications/misc/mqtt-bench/deps.nix b/pkgs/applications/misc/mqtt-bench/deps.nix
new file mode 100644
index 000000000000..d93d3c468145
--- /dev/null
+++ b/pkgs/applications/misc/mqtt-bench/deps.nix
@@ -0,0 +1,21 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+[
+  {
+    goPackagePath = "github.com/eclipse/paho.mqtt.golang";
+    fetch = {
+      type = "git";
+      url = "https://github.com/eclipse/paho.mqtt.golang";
+      rev = "65f43bda5f7edbbf6b7533d3a5a13b2c67cf3545";
+      sha256 = "1ad136xf78br599ya43j45f8dycjip1k0hkplayy1slg8ckwrhdr";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev = "8351a756f30f1297fe94bbf4b767ec589c6ea6d0";
+      sha256 = "0b6m579i3wrx1m69mqkdng5gjfssprxx0pg45kzrdi68sh0zr5d1";
+    };
+  }
+]
diff --git a/pkgs/applications/misc/tint2/default.nix b/pkgs/applications/misc/tint2/default.nix
index 3edc9b73bb54..6a613b6d5b5b 100644
--- a/pkgs/applications/misc/tint2/default.nix
+++ b/pkgs/applications/misc/tint2/default.nix
@@ -1,18 +1,18 @@
 { stdenv, fetchFromGitLab, pkgconfig, cmake, gettext, cairo, pango, pcre
-, glib , imlib2, gtk2, libXinerama , libXrender, libXcomposite, libXdamage
-, libX11 , libXrandr, librsvg, libpthreadstubs , libXdmcp
-, libstartup_notification , hicolor_icon_theme, wrapGAppsHook
+, glib, imlib2, gtk2, libXinerama, libXrender, libXcomposite, libXdamage
+, libX11, libXrandr, librsvg, libpthreadstubs, libXdmcp
+, libstartup_notification, hicolor_icon_theme, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
   name = "tint2-${version}";
-  version = "0.14.6";
+  version = "15.1";
 
   src = fetchFromGitLab {
     owner = "o9000";
     repo = "tint2";
     rev = version;
-    sha256 = "0v7i8araj85cbl45icinvmsz5741cx2ybjgkx72m3xfcb9fqg69l";
+    sha256 = "16mpvknibbqy0vjgkwig7g8i6rivm14ipd7ixvqydgcj7wibn0b7";
   };
 
   enableParallelBuilding = true;
@@ -23,11 +23,8 @@ stdenv.mkDerivation rec {
     libXcomposite libXdamage libX11 libXrandr librsvg libpthreadstubs
     libXdmcp libstartup_notification hicolor_icon_theme ];
 
-  preConfigure = ''
+  postPatch = ''
     substituteInPlace CMakeLists.txt --replace /etc $out/etc
-  '';
-
-  prePatch = ''
     for f in ./src/launcher/apps-common.c \
              ./src/launcher/icon-theme-common.c \
              ./themes/*tint2rc
diff --git a/pkgs/applications/misc/valauncher/default.nix b/pkgs/applications/misc/valauncher/default.nix
index 7d35f1f64a8e..00a60ae50a48 100644
--- a/pkgs/applications/misc/valauncher/default.nix
+++ b/pkgs/applications/misc/valauncher/default.nix
@@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, cmake, gtk3, vala_0_26, pkgconfig, gnome3 }:
+{ stdenv, fetchFromGitHub, cmake, gtk3, vala, pkgconfig, gnome3 }:
 
 stdenv.mkDerivation rec {
-  version = "1.2";
+  version = "1.3.1";
   name = "valauncher-${version}";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "valauncher";
     rev = "v${version}";
-    sha256 = "1d1gfmzmr5ra2rnjc6rbz31mf3hk7q04lh4i1hljgk7fh90dacb6";
+    sha256 = "18969v870737jg1q0l3d05pb9mxsrcpdi0mnyz94rwkspszvxxqi";
   };
 
-  buildInputs = [ cmake gtk3 vala_0_26 pkgconfig gnome3.libgee ];
+  buildInputs = [ cmake gtk3 vala pkgconfig gnome3.libgee ];
 
   meta = with stdenv.lib; {
       description = "A fast dmenu-like gtk3 application launcher";
diff --git a/pkgs/applications/networking/cluster/minikube/default.nix b/pkgs/applications/networking/cluster/minikube/default.nix
index 9745143dabda..b601bb00c200 100644
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@@ -23,7 +23,7 @@ let
 in buildGoPackage rec {
   pname   = "minikube";
   name    = "${pname}-${version}";
-  version = "0.22.1";
+  version = "0.22.2";
 
   goPackagePath = "k8s.io/minikube";
 
@@ -31,7 +31,7 @@ in buildGoPackage rec {
     owner  = "kubernetes";
     repo   = "minikube";
     rev    = "v${version}";
-    sha256 = "015ffsb7xx82y0dl38gayv2v9v33v99qmssd5djl21dhb3j79yba";
+    sha256 = "04h0hp0mkps3ilcig6xnmp41rlgaxhhpxakc86lsknvkk9kmrx89";
   };
 
   # kubernetes is here only to shut up a loud warning when generating the completions below. minikube checks very eagerly
diff --git a/pkgs/applications/networking/dropbox/default.nix b/pkgs/applications/networking/dropbox/default.nix
index 0bd3dcbc33a9..b9dae2d42006 100644
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@@ -24,10 +24,10 @@
 let
   # NOTE: When updating, please also update in current stable,
   # as older versions stop working
-  version = "34.4.22";
+  version = "35.4.20";
   sha256 = {
-    "x86_64-linux" = "1ryxj8d5ym2dc18vn2m883jvy9n19xvw5kgfbqxziirb0bip58ba";
-    "i686-linux"   = "1pj7c77196ill8jpwk8f66917v2a7c2xvkd9mssh98c9n321k5j8";
+    "x86_64-linux" = "09qxr94bcyjn5ky20yapljxi2n2nbk6ldcpx2h0ysy8jp6zbrn78";
+    "i686-linux"   = "1rd4b26dbjf779g085si65lac74bk6lcx8k7i3nqk3vrvbva9n40";
   }."${stdenv.system}" or (throw "system ${stdenv.system} not supported");
 
   arch = {
diff --git a/pkgs/applications/networking/spideroak/default.nix b/pkgs/applications/networking/spideroak/default.nix
index b9d74bee83d8..6c8e3466ce0d 100644
--- a/pkgs/applications/networking/spideroak/default.nix
+++ b/pkgs/applications/networking/spideroak/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeWrapper, glib
 , fontconfig, patchelf, libXext, libX11
-, freetype, libXrender
+, freetype, libXrender, zlib
 }:
 
 let
@@ -17,7 +17,7 @@ let
     else throw "Spideroak client for: ${stdenv.system} not supported!";
 
   ldpath = stdenv.lib.makeLibraryPath [
-    glib fontconfig libXext libX11 freetype libXrender
+    glib fontconfig libXext libX11 freetype libXrender zlib
   ];
 
   version = "6.0.1";
@@ -43,6 +43,8 @@ in stdenv.mkDerivation {
     rmdir $out/usr/bin || true
     mv $out/usr/share $out/
 
+    rm -f $out/opt/SpiderOakONE/lib/libz*
+
     patchelf --set-interpreter ${stdenv.glibc.out}/lib/${interpreter} \
       "$out/opt/SpiderOakONE/lib/SpiderOakONE"
 
diff --git a/pkgs/applications/office/impressive/default.nix b/pkgs/applications/office/impressive/default.nix
index 3232abfb268e..59249d1a6eb0 100644
--- a/pkgs/applications/office/impressive/default.nix
+++ b/pkgs/applications/office/impressive/default.nix
@@ -1,12 +1,12 @@
-{ fetchurl, stdenv, python2Packages, makeWrapper, lib
-, xpdf, mesa, SDL, freeglut }:
+{ fetchurl, stdenv, python2, makeWrapper, lib
+, mesa, SDL, freeglut, ghostscript, pdftk, dejavu_fonts }:
 
 let
-  inherit (python2Packages) python pyopengl pygame setuptools pillow;
   version = "0.11.1";
+  pythonEnv = python2.withPackages (ps: with ps; [pyopengl pygame pillow]);
 in stdenv.mkDerivation {
     # This project was formerly known as KeyJNote.
-    # See http://keyj.s2000.ws/?p=77 for details.
+    # See http://keyj.emphy.de/apple-lawsuit/ for details.
 
     name = "impressive-${version}";
 
@@ -15,37 +15,26 @@ in stdenv.mkDerivation {
       sha256 = "0b3rmy6acp2vmf5nill3aknxvr9a5aawk1vnphkah61anxp62gsr";
     };
 
-    # Note: We need to have `setuptools' in the path to be able to use
-    # PyOpenGL.
-    buildInputs = [ makeWrapper xpdf pillow pyopengl pygame ];
+    buildInputs = [ makeWrapper pythonEnv ];
 
     configurePhase = ''
+      # Let's fail at build time if the library we're substituting in doesn't
+      # exist/isn't marked as executable
+      test -x ${SDL}/lib/libSDL.so
       sed -i "impressive.py" \
-          -e 's|^#!/usr/bin/env.*$|#!${python}/bin/python|g'
+          -e '/^__website__/a SDL_LIBRARY = "${SDL}/lib/libSDL.so"' \
+          -e 's/sdl = CDLL.*/sdl = CDLL(SDL_LIBRARY)/' \
+          -e 's^FontPath =.*/usr/.*$^FontPath = ["${dejavu_fonts}/share/fonts", ""]^'
     '';
 
     installPhase = ''
-      mkdir -p "$out/bin" "$out/share/doc/impressive"
+      mkdir -p "$out/bin" "$out/share/doc/impressive" "$out/share/man/man1"
       mv impressive.py "$out/bin/impressive"
-      mv * "$out/share/doc/impressive"
+      mv impressive.1 "$out/share/man/man1"
+      mv changelog.txt impressive.html license.txt "$out/share/doc/impressive"
 
-      # XXX: We have to reiterate PyOpenGL's dependencies here.
-      #
-      # `setuptools' must be in the Python path as it's used by
-      # PyOpenGL.
-      #
-      # We set $LIBRARY_PATH (no `LD_'!) so that ctypes can find
-      # `libGL.so', which it does by running `gcc', which in turn
-      # honors $LIBRARY_PATH.  See
-      # http://python.net/crew/theller/ctypes/reference.html#id1 .
       wrapProgram "$out/bin/impressive" \
-         --prefix PATH ":" "${xpdf}/bin" \
-         --prefix PYTHONPATH ":" \
-                  ${lib.concatStringsSep ":"
-                     (map (path:
-                            path + "/lib/${python.libPrefix}/site-packages")
-                          [ pillow pyopengl pygame setuptools ])} \
-         --prefix LIBRARY_PATH ":" "${lib.makeLibraryPath [ mesa freeglut SDL ]}"
+         --prefix PATH ":" "${ghostscript}/bin:${pdftk}/bin"
     '';
 
     meta = {
@@ -73,7 +62,7 @@ in stdenv.mkDerivation {
 
       license = stdenv.lib.licenses.gpl2;
 
-      maintainers = [ ];
+      maintainers = with lib.maintainers; [ lheckemann ];
       platforms = stdenv.lib.platforms.mesaPlatforms;
     };
   }
diff --git a/pkgs/applications/version-management/gitaly/Gemfile b/pkgs/applications/version-management/gitaly/Gemfile
index c29ef2ec7c18..a12e23a57b51 100644
--- a/pkgs/applications/version-management/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitaly/Gemfile
@@ -1,5 +1,5 @@
 source 'https://rubygems.org'
 
 gem 'github-linguist', '~> 4.7.0', require: 'linguist'
-gem 'gitaly', '~> 0.30.0'
+gem 'gitaly-proto', '~> 0.31.0', require: 'gitaly'
 gem 'activesupport'
diff --git a/pkgs/applications/version-management/gitaly/Gemfile.lock b/pkgs/applications/version-management/gitaly/Gemfile.lock
index 062d1f07abc9..9d2f03b531e5 100644
--- a/pkgs/applications/version-management/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitaly/Gemfile.lock
@@ -13,7 +13,7 @@ GEM
     escape_utils (1.1.1)
     faraday (0.12.2)
       multipart-post (>= 1.2, < 3)
-    gitaly (0.30.0)
+    gitaly-proto (0.31.0)
       google-protobuf (~> 3.1)
       grpc (~> 1.0)
     github-linguist (4.7.6)
@@ -30,7 +30,7 @@ GEM
       multi_json (~> 1.11)
       os (~> 0.9)
       signet (~> 0.7)
-    grpc (1.4.1)
+    grpc (1.4.5)
       google-protobuf (~> 3.1)
       googleauth (~> 0.5.1)
     i18n (0.8.1)
@@ -63,7 +63,7 @@ PLATFORMS
 
 DEPENDENCIES
   activesupport
-  gitaly (~> 0.30.0)
+  gitaly-proto (~> 0.31.0)
   github-linguist (~> 4.7.0)
 
 BUNDLED WITH
diff --git a/pkgs/applications/version-management/gitaly/default.nix b/pkgs/applications/version-management/gitaly/default.nix
index 4263ff886a6f..ff6555ad8f05 100644
--- a/pkgs/applications/version-management/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitaly/default.nix
@@ -7,14 +7,14 @@ let
     gemdir = ./.;
   };
 in buildGoPackage rec {
-  version = "0.33.0";
+  version = "0.35.0";
   name = "gitaly-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "1x23z3a0svychs1kc9cbiskl0dp7ji9ddzqr6md22jiy6vgwx2wa";
+    sha256 = "0h3gh4y571wrnnsg5wpi67psih8yssaw24v3vrcpqpkz5linj7pl";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitaly";
diff --git a/pkgs/applications/version-management/gitaly/gemset.nix b/pkgs/applications/version-management/gitaly/gemset.nix
index d68d7a553c9d..06ba56e6b9a9 100644
--- a/pkgs/applications/version-management/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitaly/gemset.nix
@@ -50,14 +50,14 @@
     };
     version = "0.12.2";
   };
-  gitaly = {
+  gitaly-proto = {
     dependencies = ["google-protobuf" "grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16ya0vqmrr3nsrsrcph1rqnb43gpvszhvs8v6viki5lvg9rdxb67";
+      sha256 = "1n5bpclizxc42m5kbrhdgsb0ddkl47d0rgmcya5b6sv8qbclkkds";
       type = "gem";
     };
-    version = "0.30.0";
+    version = "0.31.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -89,10 +89,10 @@
     dependencies = ["google-protobuf" "googleauth"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hp8sfvl99imzp3c5sp96qpi49550v7ri7ljfvb3nllcmd3jw7sk";
+      sha256 = "1zhci260088zlghpaz6ania1blz1dd7lgklsjnqk1vcymhpr6b38";
       type = "gem";
     };
-    version = "1.4.1";
+    version = "1.4.5";
   };
   i18n = {
     source = {
diff --git a/pkgs/applications/version-management/gitlab/Gemfile b/pkgs/applications/version-management/gitlab/Gemfile
index f0133fda6a4f..5a38c956be10 100644
--- a/pkgs/applications/version-management/gitlab/Gemfile
+++ b/pkgs/applications/version-management/gitlab/Gemfile
@@ -27,7 +27,7 @@ gem 'doorkeeper-openid_connect', '~> 1.1.0'
 gem 'omniauth', '~> 1.4.2'
 gem 'omniauth-auth0', '~> 1.4.1'
 gem 'omniauth-azure-oauth2', '~> 0.0.6'
-gem 'omniauth-cas3', '~> 1.1.2'
+gem 'omniauth-cas3', '~> 1.1.4'
 gem 'omniauth-facebook', '~> 4.0.0'
 gem 'omniauth-github', '~> 1.1.1'
 gem 'omniauth-gitlab', '~> 1.0.2'
@@ -126,12 +126,9 @@ gem 'wikicloth', '0.8.1'
 gem 'asciidoctor', '~> 1.5.2'
 gem 'asciidoctor-plantuml', '0.0.7'
 gem 'rouge', '~> 2.0'
-gem 'truncato', '~> 0.7.8'
+gem 'truncato', '~> 0.7.9'
 gem 'bootstrap_form', '~> 2.7.0'
-
-# See https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s
-# and https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM
-gem 'nokogiri', '~> 1.6.7', '>= 1.6.7.2'
+gem 'nokogiri', '~> 1.8.0'
 
 # Diffs
 gem 'diffy', '~> 3.1.0'
@@ -250,7 +247,7 @@ gem 'uglifier', '~> 2.7.2'
 gem 'addressable', '~> 2.3.8'
 gem 'bootstrap-sass', '~> 3.3.0'
 gem 'font-awesome-rails', '~> 4.7'
-gem 'gemojione', '~> 3.0'
+gem 'gemojione', '~> 3.3'
 gem 'gon', '~> 6.1.0'
 gem 'jquery-atwho-rails', '~> 1.3.2'
 gem 'jquery-rails', '~> 4.1.0'
@@ -289,7 +286,7 @@ group :metrics do
   gem 'influxdb', '~> 0.2', require: false
 
   # Prometheus
-  gem 'prometheus-client-mmap', '~>0.7.0.beta11'
+  gem 'prometheus-client-mmap', '~>0.7.0.beta14'
   gem 'raindrops', '~> 0.18'
 end
 
@@ -324,6 +321,7 @@ group :development, :test do
   gem 'spinach-rerun-reporter', '~> 0.0.2'
   gem 'rspec_profiling', '~> 0.0.5'
   gem 'rspec-set', '~> 0.1.3'
+  gem 'rspec-parameterized'
 
   # Prevent occasions where minitest is not bundled in packaged versions of ruby (see #3826)
   gem 'minitest', '~> 5.7.0'
diff --git a/pkgs/applications/version-management/gitlab/Gemfile.lock b/pkgs/applications/version-management/gitlab/Gemfile.lock
index 08ce4486ba07..d729b62d8f9a 100644
--- a/pkgs/applications/version-management/gitlab/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/Gemfile.lock
@@ -2,6 +2,7 @@ GEM
   remote: https://rubygems.org/
   specs:
     RedCloth (4.3.2)
+    abstract_type (0.0.7)
     ace-rails-ap (4.1.2)
     actionmailer (4.2.8)
       actionpack (= 4.2.8)
@@ -43,6 +44,9 @@ GEM
       tzinfo (~> 1.1)
     acts-as-taggable-on (4.0.0)
       activerecord (>= 4.0)
+    adamantium (0.2.0)
+      ice_nine (~> 0.11.0)
+      memoizable (~> 0.4.0)
     addressable (2.3.8)
     after_commit_queue (1.3.0)
       activerecord (>= 3.0)
@@ -126,6 +130,9 @@ GEM
     coercible (1.0.0)
       descendants_tracker (~> 0.0.1)
     colorize (0.7.7)
+    concord (0.1.5)
+      adamantium (~> 0.2.0)
+      equalizer (~> 0.0.9)
     concurrent-ruby (1.0.5)
     concurrent-ruby-ext (1.0.5)
       concurrent-ruby (= 1.0.5)
@@ -258,7 +265,7 @@ GEM
       ruby-progressbar (~> 1.4)
     gemnasium-gitlab-service (0.2.6)
       rugged (~> 0.21)
-    gemojione (3.0.1)
+    gemojione (3.3.0)
       json
     get_process_mem (0.2.0)
     gettext (3.2.2)
@@ -280,7 +287,7 @@ GEM
       escape_utils (~> 1.1.0)
       mime-types (>= 1.19)
       rugged (>= 0.23.0b)
-    github-markup (1.4.0)
+    github-markup (1.6.1)
     gitlab-flowdock-git-hook (1.0.1)
       flowdock (~> 0.7)
       gitlab-grit (>= 2.4.1)
@@ -300,13 +307,14 @@ GEM
       activesupport (>= 4.1.0)
     gollum-grit_adapter (1.0.1)
       gitlab-grit (~> 2.7, >= 2.7.1)
-    gollum-lib (4.2.1)
-      github-markup (~> 1.4.0)
+    gollum-lib (4.2.7)
+      gemojione (~> 3.2)
+      github-markup (~> 1.6)
       gollum-grit_adapter (~> 1.0)
-      nokogiri (~> 1.6.4)
-      rouge (~> 2.0)
-      sanitize (~> 2.1.0)
-      stringex (~> 2.5.1)
+      nokogiri (>= 1.6.1, < 2.0)
+      rouge (~> 2.1)
+      sanitize (~> 2.1)
+      stringex (~> 2.6)
     gollum-rugged_adapter (0.4.4)
       mime-types (>= 1.15)
       rugged (~> 0.25)
@@ -468,14 +476,16 @@ GEM
       railties (>= 4, < 5.2)
     loofah (2.0.3)
       nokogiri (>= 1.5.9)
-    mail (2.6.5)
+    mail (2.6.6)
       mime-types (>= 1.16, < 4)
     mail_room (0.9.1)
     memoist (0.15.0)
+    memoizable (0.4.2)
+      thread_safe (~> 0.3, >= 0.3.1)
     method_source (0.8.2)
     mime-types (2.99.3)
     mimemagic (0.3.0)
-    mini_portile2 (2.1.0)
+    mini_portile2 (2.2.0)
     minitest (5.7.0)
     mmap2 (2.2.7)
     mousetrap-rails (1.4.6)
@@ -489,8 +499,8 @@ GEM
     net-ldap (0.16.0)
     net-ssh (4.1.0)
     netrc (0.11.0)
-    nokogiri (1.6.8.1)
-      mini_portile2 (~> 2.1.0)
+    nokogiri (1.8.0)
+      mini_portile2 (~> 2.2.0)
     numerizer (0.1.1)
     oauth (0.5.1)
     oauth2 (1.4.0)
@@ -513,9 +523,9 @@ GEM
       jwt (~> 1.0)
       omniauth (~> 1.0)
       omniauth-oauth2 (~> 1.1)
-    omniauth-cas3 (1.1.3)
+    omniauth-cas3 (1.1.4)
       addressable (~> 2.3)
-      nokogiri (~> 1.6.6)
+      nokogiri (~> 1.7, >= 1.7.1)
       omniauth (~> 1.2)
     omniauth-facebook (4.0.0)
       omniauth-oauth2 (~> 1.2)
@@ -603,7 +613,7 @@ GEM
       cliver (~> 0.3.1)
       multi_json (~> 1.0)
       websocket-driver (>= 0.2.0)
-    posix-spawn (0.3.11)
+    posix-spawn (0.3.13)
     powerpack (0.1.1)
     premailer (1.10.4)
       addressable
@@ -612,7 +622,12 @@ GEM
     premailer-rails (1.9.7)
       actionmailer (>= 3, < 6)
       premailer (~> 1.7, >= 1.7.9)
-    prometheus-client-mmap (0.7.0.beta11)
+    proc_to_ast (0.1.0)
+      coderay
+      parser
+      unparser
+    procto (0.0.3)
+    prometheus-client-mmap (0.7.0.beta14)
       mmap2 (~> 2.2, >= 2.2.7)
     pry (0.10.4)
       coderay (~> 1.1.0)
@@ -720,6 +735,10 @@ GEM
       chunky_png
     rqrcode-rails3 (0.1.7)
       rqrcode (>= 0.4.2)
+    rspec (3.6.0)
+      rspec-core (~> 3.6.0)
+      rspec-expectations (~> 3.6.0)
+      rspec-mocks (~> 3.6.0)
     rspec-core (3.6.0)
       rspec-support (~> 3.6.0)
     rspec-expectations (3.6.0)
@@ -728,6 +747,12 @@ GEM
     rspec-mocks (3.6.0)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.6.0)
+    rspec-parameterized (0.4.0)
+      binding_of_caller
+      parser
+      proc_to_ast
+      rspec (>= 2.13, < 4)
+      unparser
     rspec-rails (3.6.0)
       actionpack (>= 3.0)
       activesupport (>= 3.0)
@@ -852,7 +877,7 @@ GEM
     state_machines-activerecord (0.4.0)
       activerecord (>= 4.1, < 5.1)
       state_machines-activemodel (>= 0.3.0)
-    stringex (2.5.2)
+    stringex (2.7.1)
     sys-filesystem (1.1.6)
       ffi
     sysexits (1.2.0)
@@ -871,9 +896,9 @@ GEM
     timfel-krb5-auth (0.8.3)
     toml-rb (0.3.15)
       citrus (~> 3.0, > 3.0)
-    truncato (0.7.8)
+    truncato (0.7.10)
       htmlentities (~> 4.3.1)
-      nokogiri (~> 1.6.1)
+      nokogiri (~> 1.8.0, >= 1.7.0)
     tzinfo (1.2.3)
       thread_safe (~> 0.1)
     u2f (0.2.1)
@@ -892,6 +917,14 @@ GEM
       get_process_mem (~> 0)
       unicorn (>= 4, < 6)
     uniform_notifier (1.10.0)
+    unparser (0.2.6)
+      abstract_type (~> 0.0.7)
+      adamantium (~> 0.2.0)
+      concord (~> 0.1.5)
+      diff-lcs (~> 1.3)
+      equalizer (~> 0.0.9)
+      parser (>= 2.3.1.2, < 2.5)
+      procto (~> 0.0.2)
     url_safe_base64 (0.2.2)
     validates_hostname (1.0.6)
       activerecord (>= 3.0)
@@ -990,7 +1023,7 @@ DEPENDENCIES
   foreman (~> 0.78.0)
   fuubar (~> 2.2.0)
   gemnasium-gitlab-service (~> 0.2)
-  gemojione (~> 3.0)
+  gemojione (~> 3.3)
   gettext (~> 3.2.2)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.2.0)
@@ -1036,7 +1069,7 @@ DEPENDENCIES
   mysql2 (~> 0.4.5)
   net-ldap
   net-ssh (~> 4.1.0)
-  nokogiri (~> 1.6.7, >= 1.6.7.2)
+  nokogiri (~> 1.8.0)
   oauth2 (~> 1.4)
   octokit (~> 4.6.2)
   oj (~> 2.17.4)
@@ -1044,7 +1077,7 @@ DEPENDENCIES
   omniauth-auth0 (~> 1.4.1)
   omniauth-authentiq (~> 0.3.1)
   omniauth-azure-oauth2 (~> 0.0.6)
-  omniauth-cas3 (~> 1.1.2)
+  omniauth-cas3 (~> 1.1.4)
   omniauth-facebook (~> 4.0.0)
   omniauth-github (~> 1.1.1)
   omniauth-gitlab (~> 1.0.2)
@@ -1069,7 +1102,7 @@ DEPENDENCIES
   pg (~> 0.18.2)
   poltergeist (~> 1.9.0)
   premailer-rails (~> 1.9.7)
-  prometheus-client-mmap (~> 0.7.0.beta11)
+  prometheus-client-mmap (~> 0.7.0.beta14)
   pry-byebug (~> 3.4.1)
   pry-rails (~> 0.3.4)
   rack-attack (~> 4.4.1)
@@ -1095,6 +1128,7 @@ DEPENDENCIES
   responders (~> 2.0)
   rouge (~> 2.0)
   rqrcode-rails3 (~> 0.1.7)
+  rspec-parameterized
   rspec-rails (~> 3.6.0)
   rspec-retry (~> 0.4.5)
   rspec-set (~> 0.1.3)
@@ -1133,7 +1167,7 @@ DEPENDENCIES
   thin (~> 1.7.0)
   timecop (~> 0.8.0)
   toml-rb (~> 0.3.15)
-  truncato (~> 0.7.8)
+  truncato (~> 0.7.9)
   u2f (~> 0.2.1)
   uglifier (~> 2.7.2)
   underscore-rails (~> 1.8.0)
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index 993d61dc9ac3..9087ff6fdc02 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -18,11 +18,11 @@ let
     };
   };
 
-  version = "9.5.2";
+  version = "9.5.5";
 
   gitlabDeb = fetchurl {
     url = "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/jessie/gitlab-ce_${version}-ce.0_amd64.deb/download";
-    sha256 = "0h0cmhs1bz5248vqxq5x3grggw2x53n6kbinlsyhnvcyds0vk0pa";
+    sha256 = "1wrwxksfqkha7qm2hbgs0z7lmgisdvdqa4wcll0qfzq1c3d286zz";
   };
 
 in
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "gitlabhq";
     repo = "gitlabhq";
     rev = "v${version}";
-    sha256 = "0ljqimdzxw5pvif2jrzjdihypa30595nb02h12a4gw3wz3qrrxdc";
+    sha256 = "0qi21lkq69ah977vssbkllb7q5jwb0vf2ws5s3bzpvp2mj3iab5m";
   };
 
   patches = [
diff --git a/pkgs/applications/version-management/gitlab/gemset.nix b/pkgs/applications/version-management/gitlab/gemset.nix
index d2506b288f5c..fd27c6435974 100644
--- a/pkgs/applications/version-management/gitlab/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gemset.nix
@@ -1,4 +1,12 @@
 {
+  abstract_type = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09330cmhrc2wmfhdj9zzg82sv6cdhm3qgdkva5ni5xfjril2pf14";
+      type = "gem";
+    };
+    version = "0.0.7";
+  };
   ace-rails-ap = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -97,6 +105,15 @@
     };
     version = "4.0.0";
   };
+  adamantium = {
+    dependencies = ["ice_nine" "memoizable"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0165r2ikgfwv2rm8dzyijkp74fvg0ni72hpdx8ay2v7cj08dqyak";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
   addressable = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -474,6 +491,15 @@
     };
     version = "0.7.7";
   };
+  concord = {
+    dependencies = ["adamantium" "equalizer"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1b6cdn0fg4n9gzbdr7zyf4jq40y6h0c0g9cra7wk9hhmsylk91bg";
+      type = "gem";
+    };
+    version = "0.1.5";
+  };
   concurrent-ruby = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -1002,10 +1028,10 @@
     dependencies = ["json"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "17yy3cp7b75ngc2v4f0cacvq3f1bk3il5a0ykvnypl6fcj6r6b3w";
+      sha256 = "0ayk8r147k1s38nj18pwk76npx1p7jhi86silk800nj913pjvrhj";
       type = "gem";
     };
-    version = "3.0.1";
+    version = "3.3.0";
   };
   get_process_mem = {
     source = {
@@ -1071,10 +1097,10 @@
   github-markup = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "046bvnbhk3bw021sd88808n71dya0b0dmx8hm64rj0fvs2jzg54z";
+      sha256 = "1nyb9ck2c9z5qi86n7r52w0m126qpnvc93yh35cn8bwsnkjqx0iq";
       type = "gem";
     };
-    version = "1.4.0";
+    version = "1.6.1";
   };
   gitlab-flowdock-git-hook = {
     dependencies = ["flowdock" "gitlab-grit" "multi_json"];
@@ -1130,13 +1156,13 @@
     version = "1.0.1";
   };
   gollum-lib = {
-    dependencies = ["github-markup" "gollum-grit_adapter" "nokogiri" "rouge" "sanitize" "stringex"];
+    dependencies = ["gemojione" "github-markup" "gollum-grit_adapter" "nokogiri" "rouge" "sanitize" "stringex"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1q668c76gnyyyl8217gnblbj50plm7giacs5lgf7ix2rj8rdxzj7";
+      sha256 = "1filwvjfj5q2m6w4q274ai36d6f0mrsv2l2khhk4bv1q6pqby2fq";
       type = "gem";
     };
-    version = "4.2.1";
+    version = "4.2.7";
   };
   gollum-rugged_adapter = {
     dependencies = ["mime-types" "rugged"];
@@ -1620,10 +1646,10 @@
     dependencies = ["mime-types"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07k8swmv7vgk86clzpjhdlmgahlvg6yzjwy7wcsv0xx400fh4x61";
+      sha256 = "0d7lhj2dw52ycls6xigkfz6zvfhc6qggply9iycjmcyj9760yvz9";
       type = "gem";
     };
-    version = "2.6.5";
+    version = "2.6.6";
   };
   mail_room = {
     source = {
@@ -1641,6 +1667,15 @@
     };
     version = "0.15.0";
   };
+  memoizable = {
+    dependencies = ["thread_safe"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0v42bvghsvfpzybfazl14qhkrjvx0xlmxz0wwqc960ga1wld5x5c";
+      type = "gem";
+    };
+    version = "0.4.2";
+  };
   method_source = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -1668,10 +1703,10 @@
   mini_portile2 = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1y25adxb1hgg1wb2rn20g3vl07qziq6fz364jc5694611zz863hb";
+      sha256 = "0g5bpgy08q0nc0anisg3yvwc1gc3inl854fcrg48wvg7glqd6dpm";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "2.2.0";
   };
   minitest = {
     source = {
@@ -1774,10 +1809,10 @@
     dependencies = ["mini_portile2"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "045xdg0w7nnsr2f2gb7v7bgx53xbc9dxf0jwzmh2pr3jyrzlm0cj";
+      sha256 = "1nffsyx1xjg6v5n9rrbi8y1arrcx2i5f21cp6clgh9iwiqkr7rnn";
       type = "gem";
     };
-    version = "1.6.8.1";
+    version = "1.8.0";
   };
   numerizer = {
     source = {
@@ -1861,10 +1896,10 @@
     dependencies = ["addressable" "nokogiri" "omniauth"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13swm2hi2z63nvb2bps6g41kki8kr9b5c7014rk8259bxlpflrk7";
+      sha256 = "191b4jm4djmmy54yxfxj3c889r2wn3g6sfsdj6l1rjy0kw1m2qgx";
       type = "gem";
     };
-    version = "1.1.3";
+    version = "1.1.4";
   };
   omniauth-facebook = {
     dependencies = ["omniauth-oauth2"];
@@ -2152,10 +2187,10 @@
   posix-spawn = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "052lnxbkvlnwfjw4qd7vn2xrlaaqiav6f5x5bcjin97bsrfq6cmr";
+      sha256 = "1pmxmpins57qrbr31bs3bm7gidhaacmrp4md6i962gvpq4gyfcjw";
       type = "gem";
     };
-    version = "0.3.11";
+    version = "0.3.13";
   };
   powerpack = {
     source = {
@@ -2183,14 +2218,31 @@
     };
     version = "1.9.7";
   };
+  proc_to_ast = {
+    dependencies = ["coderay" "parser" "unparser"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "14c65w48bbzp5lh1cngqd1y25kqvfnq1iy49hlzshl12dsk3z9wj";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
+  procto = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13imvg1x50rz3r0yyfbhxwv72lbf7q28qx9l9nfbb91h2n9ch58c";
+      type = "gem";
+    };
+    version = "0.0.3";
+  };
   prometheus-client-mmap = {
     dependencies = ["mmap2"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13y2rg2bzbpdx33d72j4dwgwcnml4y7gv0pg401642kmv3ypab77";
+      sha256 = "1r9s30hypcpw4abxlzcjlkcwkckqvr5sbph3blbl0rq2r8c8h25p";
       type = "gem";
     };
-    version = "0.7.0.beta11";
+    version = "0.7.0.beta14";
   };
   pry = {
     dependencies = ["coderay" "method_source" "slop"];
@@ -2591,6 +2643,15 @@
     };
     version = "0.1.7";
   };
+  rspec = {
+    dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nd50hycab2a2vdah9lxi585g8f63jxjvmzmxqyln51grxwx9hzb";
+      type = "gem";
+    };
+    version = "3.6.0";
+  };
   rspec-core = {
     dependencies = ["rspec-support"];
     source = {
@@ -2618,6 +2679,15 @@
     };
     version = "3.6.0";
   };
+  rspec-parameterized = {
+    dependencies = ["binding_of_caller" "parser" "proc_to_ast" "rspec" "unparser"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0arynbr6cfjhccwc8gy2xf87nybdnncsnmfwknnh8s7d4mj730p0";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
   rspec-rails = {
     dependencies = ["actionpack" "activesupport" "railties" "rspec-core" "rspec-expectations" "rspec-mocks" "rspec-support"];
     source = {
@@ -3070,10 +3140,10 @@
   stringex = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "150adm7rfh6r9b5ra6vk75mswf9m3wwyslcf8f235a08m29fxa17";
+      sha256 = "1zc93v00av643lc6njl09wwki7h5yqayhh1din8zqfylw814l1dv";
       type = "gem";
     };
-    version = "2.5.2";
+    version = "2.7.1";
   };
   sys-filesystem = {
     dependencies = ["ffi"];
@@ -3179,10 +3249,10 @@
     dependencies = ["htmlentities" "nokogiri"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09ngwz2mpfsi1ms94j7nmms4kbd5sgcqv5dshrbwaqf585ja7cm5";
+      sha256 = "1x4fhfi4p7ah9sshfhbk9j145s1ailbyj0dxnvqirs9kk10x2d1b";
       type = "gem";
     };
-    version = "0.7.8";
+    version = "0.7.10";
   };
   tzinfo = {
     dependencies = ["thread_safe"];
@@ -3269,6 +3339,15 @@
     };
     version = "1.10.0";
   };
+  unparser = {
+    dependencies = ["abstract_type" "adamantium" "concord" "diff-lcs" "equalizer" "parser" "procto"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1jhpgvghn764myi5iwlys98f71yspwgrzimzz11108jnhl5rcx7l";
+      type = "gem";
+    };
+    version = "0.2.6";
+  };
   url_safe_base64 = {
     source = {
       remotes = ["https://rubygems.org"];
diff --git a/pkgs/data/icons/numix-icon-theme-circle/default.nix b/pkgs/data/icons/numix-icon-theme-circle/default.nix
index 33734e15c9ce..1dd268cf816e 100644
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, numix-icon-theme }:
 
 stdenv.mkDerivation rec {
-  version = "2016-11-10";
+  version = "17-09-13";
 
   package-name = "numix-icon-theme-circle";
 
@@ -10,8 +10,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = package-name;
-    rev = "ba72743b0ee78cf56585bb498eb59e83d0de17a2";
-    sha256 = "0zyvcpa8d8jc7r08chhv0chp7z29w6ir9hkgm9aq23aa80i6pdgv";
+    rev = version;
+    sha256 = "14ck07j9v0yh8ky191sa3xxi4qh7bbg84i8jijy3kbjcx9s0zl8a";
   };
 
   buildInputs = [ numix-icon-theme ];
diff --git a/pkgs/data/icons/numix-icon-theme-square/default.nix b/pkgs/data/icons/numix-icon-theme-square/default.nix
index 4485351b9c39..90040c8fc286 100644
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@@ -1,17 +1,15 @@
 { stdenv, fetchFromGitHub, numix-icon-theme }:
 
 stdenv.mkDerivation rec {
-  version = "2016-11-23";
-
-  package-name = "numix-icon-theme-square";
-
   name = "${package-name}-${version}";
+  package-name = "numix-icon-theme-square";
+  version = "17-09-13";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = package-name;
-    rev = "1c30eb02aea3d95c49f95c212702b56e93ac9043";
-    sha256 = "1d2car4dsh1dnim9jlakm035ydqd1f115cagm6zm8gwa5w9annag";
+    rev = version;
+    sha256 = "1grpm902hiid561fbp9y1rb9z21y8d1krjgxgs7j8qnpx380sd5x";
   };
 
   buildInputs = [ numix-icon-theme ];
diff --git a/pkgs/data/icons/numix-icon-theme/default.nix b/pkgs/data/icons/numix-icon-theme/default.nix
index 7f6a3fe48d79..c767675e90ec 100644
--- a/pkgs/data/icons/numix-icon-theme/default.nix
+++ b/pkgs/data/icons/numix-icon-theme/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  version = "2017-01-25";
+  version = "2017-09-17";
 
   package-name = "numix-icon-theme";
 
@@ -10,8 +10,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = package-name;
-    rev = "271471c7944d592a1d666910de0adce82a393d31";
-    sha256 = "1yc9jk1233ybk6cd7q4x3q87rwgq9nkcgkn9fw9si422dkvnwd7h";
+    rev = "d0e7da93520e521bf7df7cffa3620c10a8400a7f";
+    sha256 = "1my43kv9yz9vdn51zhd13c8zavba17cqrmxkmhpx0c8xldjqfp3i";
   };
 
   dontBuild = true;
diff --git a/pkgs/development/compilers/compcert/default.nix b/pkgs/development/compilers/compcert/default.nix
index f519776b6891..a12f1c42ba61 100644
--- a/pkgs/development/compilers/compcert/default.nix
+++ b/pkgs/development/compilers/compcert/default.nix
@@ -7,11 +7,11 @@ assert lib.versionAtLeast ocamlPackages.ocaml.version "4.02";
 
 stdenv.mkDerivation rec {
   name    = "compcert-${version}";
-  version = "3.0.1";
+  version = "3.1";
 
   src = fetchurl {
     url    = "http://compcert.inria.fr/release/${name}.tgz";
-    sha256 = "0dgrj26dzdy4n3s9b5hwc6lm54vans1v4qx9hdp1q8w1qqcdriq9";
+    sha256 = "0irfwlw2chalp0g2gw0makc699hn3z37sha1a239p9d90mzx03cx";
   };
 
   buildInputs = [ coq ]
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   configurePhase = ''
+    substituteInPlace VERSION --replace '3.0.1' '3.1'
     substituteInPlace ./configure --replace '{toolprefix}gcc' '{toolprefix}cc'
     ./configure -clightgen -prefix $out -toolprefix ${tools}/bin/ '' +
     (if stdenv.isDarwin then "x86_64-macosx" else "x86_64-linux");
@@ -39,7 +40,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Formally verified C compiler";
     homepage    = "http://compcert.inria.fr";
-    license     = licenses.inria;
+    license     = licenses.inria-compcert;
     platforms   = platforms.linux ++
                   platforms.darwin;
     maintainers = with maintainers; [ thoughtpolice jwiegley vbgl ];
diff --git a/pkgs/development/compilers/jetbrains-jdk/default.nix b/pkgs/development/compilers/jetbrains-jdk/default.nix
new file mode 100644
index 000000000000..e0aa815e4dcb
--- /dev/null
+++ b/pkgs/development/compilers/jetbrains-jdk/default.nix
@@ -0,0 +1,80 @@
+{ stdenv, lib, fetchurl, file, glib, libxml2, libav_0_8, ffmpeg, libxslt
+, mesa_noglu , xorg, alsaLib, fontconfig, freetype, pango, gtk2, cairo
+, gdk_pixbuf, atk }:
+
+# TODO: Investigate building from source instead of patching binaries.
+# TODO: Binary patching for not just x86_64-linux but also x86_64-darwin i686-linux
+
+let drv = stdenv.mkDerivation rec {
+  pname = "jetbrainsjdk";
+  version = "152b970.2";
+  name = pname + "-" + version;
+
+  src = if stdenv.system == "x86_64-linux" then
+    fetchurl {
+      url = "https://bintray.com/jetbrains/intellij-jdk/download_file?file_path=jbsdk8u${version}_linux_x64.tar.gz";
+      sha256 = "0i2cqjfab91kr618z88nb5g9yg60j5z08wjl0nlvcmpvg2z6va0m";
+    }
+  else
+    abort "unsupported system: ${stdenv.system}";
+
+  nativeBuildInputs = [ file ];
+
+  unpackCmd = "mkdir jdk; pushd jdk; tar -xzf $src; popd";
+
+  installPhase = ''
+    cd ..
+
+    exes=$(file $sourceRoot/bin/* $sourceRoot/jre/bin/* 2> /dev/null | grep -E 'ELF.*(executable|shared object)' | sed -e 's/: .*$//')
+    for file in $exes; do
+      paxmark m "$file"
+    done
+
+    mv $sourceRoot $out
+    jrePath=$out/jre
+  '';
+
+  postFixup = let
+    arch = "amd64";
+    rSubPaths = [
+      "lib/${arch}/jli"
+      "lib/${arch}/server"
+      "lib/${arch}/xawt"
+      "lib/${arch}"
+    ];
+    in ''
+    rpath+="''${rpath:+:}${stdenv.lib.concatStringsSep ":" (map (a: "$jrePath/${a}") rSubPaths)}"
+    find $out -type f -perm -0100 \
+        -exec patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "$rpath" {} \;
+    find $out -name "*.so" -exec patchelf --set-rpath "$rpath" {} \;
+  '';
+
+  rpath = lib.makeLibraryPath ([
+    stdenv.cc.cc stdenv.cc.libc glib libxml2 libav_0_8 ffmpeg libxslt mesa_noglu
+    alsaLib fontconfig freetype pango gtk2 cairo gdk_pixbuf atk
+  ] ++ (with xorg; [
+    libX11 libXext libXtst libXi libXp libXt libXrender libXxf86vm
+  ]));
+
+  passthru.home = drv;
+
+  meta = with stdenv.lib; {
+    description = "An OpenJDK fork to better support Jetbrains's products.";
+    longDescription = ''
+     JetBrains Runtime is a runtime environment for running IntelliJ Platform
+     based products on Windows, Mac OS X, and Linux. JetBrains Runtime is
+     based on OpenJDK project with some modifications. These modifications
+     include: Subpixel Anti-Aliasing, enhanced font rendering on Linux, HiDPI
+     support, ligatures, some fixes for native crashes not presented in
+     official build, and other small enhancements.
+
+     JetBrains Runtime is not a certified build of OpenJDK. Please, use at
+     your own risk.
+    '';
+    homepage = "https://bintray.com/jetbrains/intellij-jdk/";
+    licenses = licenses.gpl2;
+    maintainers = with maintainers; [ edwtjo ];
+    platforms = with platforms; [ "x86_64-linux" ];
+  };
+}; in drv
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index 54f2b494e1dd..82c4a033c856 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -11412,6 +11412,19 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
+  "List_0_6_1" = callPackage
+    ({ mkDerivation, base, transformers }:
+     mkDerivation {
+       pname = "List";
+       version = "0.6.1";
+       sha256 = "0ar4bpfv9nqc3bdwg6rlcnwr5si2df38ch8m2wnnl0346yzvmjni";
+       libraryHaskellDepends = [ base transformers ];
+       homepage = "http://github.com/yairchu/generator";
+       description = "List monad transformer and class";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "ListLike" = callPackage
     ({ mkDerivation, array, base, bytestring, containers, deepseq
      , dlist, fmlist, HUnit, QuickCheck, random, text, utf8-string
@@ -25831,17 +25844,15 @@ self: {
      }) {inherit (pkgs) openssl;};
 
   "apecs" = callPackage
-    ({ mkDerivation, base, containers, criterion, linear, mtl, random
-     , sdl2, vector
+    ({ mkDerivation, base, containers, criterion, linear, mtl
+     , QuickCheck, vector
      }:
      mkDerivation {
        pname = "apecs";
-       version = "0.2.0.2";
-       sha256 = "177cym1wfkfw2abg3hs17fj569j189vr99a98avh1nnf6bgv8hk9";
-       isLibrary = true;
-       isExecutable = true;
+       version = "0.2.0.3";
+       sha256 = "0bsaxgmkcy4jpvf98frqa6dhdwzk2m59bcshb6rqx8ixllinpyvp";
        libraryHaskellDepends = [ base containers mtl vector ];
-       executableHaskellDepends = [ base linear random sdl2 ];
+       testHaskellDepends = [ base QuickCheck ];
        benchmarkHaskellDepends = [ base criterion linear ];
        homepage = "https://github.com/jonascarpay/apecs#readme";
        description = "A fast ECS for game engine programming";
@@ -42109,6 +42120,37 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
+  "checkmate" = callPackage
+    ({ mkDerivation, base, bytestring, containers, diff-parse
+     , directory, file-embed, filepath, github, hlint, hspec
+     , hspec-megaparsec, interpolatedstring-perl6, megaparsec
+     , monad-parallel, optparse-applicative, QuickCheck, quickcheck-text
+     , range, temporary, text
+     }:
+     mkDerivation {
+       pname = "checkmate";
+       version = "0.1.3";
+       sha256 = "1i0hbbgg5lh44azk5vsm6nppazgn657942rcx6h08d6925kn6l7v";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         base containers diff-parse directory filepath megaparsec
+         monad-parallel range text
+       ];
+       executableHaskellDepends = [
+         base diff-parse directory filepath github megaparsec
+         optparse-applicative range text
+       ];
+       testHaskellDepends = [
+         base bytestring diff-parse directory file-embed filepath hlint
+         hspec hspec-megaparsec interpolatedstring-perl6 megaparsec
+         QuickCheck quickcheck-text range temporary text
+       ];
+       homepage = "https://github.com/spoqa/checkmate#readme";
+       description = "Generate checklists relevant to a given patch";
+       license = stdenv.lib.licenses.gpl3;
+     }) {};
+
   "chell" = callPackage
     ({ mkDerivation, ansi-terminal, base, bytestring, options, patience
      , random, template-haskell, text, transformers
@@ -52063,19 +52105,13 @@ self: {
      }) {};
 
   "currency-codes" = callPackage
-    ({ mkDerivation, aeson, base, bson, lens, random, safe, swagger2
-     , text
-     }:
+    ({ mkDerivation, aeson, base, bson, random, safe, text }:
      mkDerivation {
        pname = "currency-codes";
-       version = "1.0.0.3";
-       sha256 = "0lfaikcig22y79fm75jc40d6ii3xrj4firyfssyqcqbyjhvf3fyn";
-       revision = "1";
-       editedCabalFile = "0jp3x19zymrjxlzrg98ch2fch9a1c93g41nzcfmxc6jjy5lh7x6z";
-       libraryHaskellDepends = [
-         aeson base bson lens random safe swagger2 text
-       ];
-       homepage = "https://gitlab.com/chordify/currency-codes";
+       version = "2.0.0.0";
+       sha256 = "0sdgnzww38l9vhjxs2b92c4j0db4ssbhxs4zrhvnfh66x6jjvnd5";
+       libraryHaskellDepends = [ aeson base bson random safe text ];
+       homepage = "https://github.com/chordify/currency-codes";
        description = "ISO-4217 Currency Codes";
        license = stdenv.lib.licenses.mit;
      }) {};
@@ -70865,8 +70901,8 @@ self: {
      }:
      mkDerivation {
        pname = "fltkhs";
-       version = "0.5.4.0";
-       sha256 = "0bg486byrg7mxc6j1v9fj80n43zk813riw5m5ninhyf0f34gjbwh";
+       version = "0.5.4.1";
+       sha256 = "0yclwq488g9mz6wsjcch7c5kwgc97rxp0lqjlfj44vbqbjk72l5x";
        isLibrary = true;
        isExecutable = true;
        setupHaskellDepends = [ base Cabal directory filepath ];
@@ -80139,8 +80175,8 @@ self: {
      }:
      mkDerivation {
        pname = "goatee-gtk";
-       version = "0.3.1.1";
-       sha256 = "0pgpdk1y140pcdsyry185k0bpdhyr87bqrzk24yv65kgvqs442zm";
+       version = "0.3.1.2";
+       sha256 = "19qgkrv22jffvy27ykqyhgqw2qak4888r1d3x1lfs48r3bisli2h";
        isLibrary = true;
        isExecutable = true;
        enableSeparateDataOutput = true;
@@ -85359,6 +85395,30 @@ self: {
        maintainers = with stdenv.lib.maintainers; [ peti ];
      }) {};
 
+  "hackage-db_2_0" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, Cabal, containers
+     , directory, filepath, tar, time, utf8-string
+     }:
+     mkDerivation {
+       pname = "hackage-db";
+       version = "2.0";
+       sha256 = "09xza82g45nv3gxmryqd2mns4bm8hr6d7hzr7nqdi6zq46s0lfgq";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson base bytestring Cabal containers directory filepath tar time
+         utf8-string
+       ];
+       executableHaskellDepends = [
+         base bytestring Cabal containers utf8-string
+       ];
+       homepage = "https://github.com/peti/hackage-db#readme";
+       description = "Access Hackage's package database via Data.Map";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+       maintainers = with stdenv.lib.maintainers; [ peti ];
+     }) {};
+
   "hackage-diff" = callPackage
     ({ mkDerivation, ansi-terminal, async, attoparsec, base, Cabal
      , cpphs, directory, filepath, haskell-src-exts, HTTP, mtl, process
@@ -97707,8 +97767,8 @@ self: {
      }:
      mkDerivation {
        pname = "hledger-iadd";
-       version = "1.2.5";
-       sha256 = "1va5a1j4pa6yvzhk0y4pxs0q80ph3yr8jdbgy422mkvbmczxynna";
+       version = "1.2.6";
+       sha256 = "1l5vzhyya5h6sc3l74iy0mnys8bcjp6m5z0m3lqabk37ik31ld36";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
@@ -98214,6 +98274,24 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {inherit (pkgs) gsl;};
 
+  "hmatrix-gsl-stats_0_4_1_7" = callPackage
+    ({ mkDerivation, base, binary, gsl, hmatrix, storable-complex
+     , vector
+     }:
+     mkDerivation {
+       pname = "hmatrix-gsl-stats";
+       version = "0.4.1.7";
+       sha256 = "1gslgk58lzin43cvbpivhw7nrn9qyaa6qwhy1z9ypvyal5p8n3sa";
+       libraryHaskellDepends = [
+         base binary hmatrix storable-complex vector
+       ];
+       libraryPkgconfigDepends = [ gsl ];
+       homepage = "http://code.haskell.org/hmatrix-gsl-stats";
+       description = "GSL Statistics interface";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {inherit (pkgs) gsl;};
+
   "hmatrix-mmap" = callPackage
     ({ mkDerivation, base, hmatrix, mmap }:
      mkDerivation {
@@ -105034,8 +105112,8 @@ self: {
      }:
      mkDerivation {
        pname = "hsyslog-tcp";
-       version = "0.1.0.0";
-       sha256 = "06qlpxl5cf45a2y9ncjcngrghbhgf624a6s1yczx1pfx7zqda6i6";
+       version = "0.2.0.0";
+       sha256 = "1zbp8l5lj2xb6yczijd76dhdbxfzxpl7han1b01bc8qfw7pkj4g9";
        libraryHaskellDepends = [
          base bytestring hsyslog hsyslog-udp network text time
        ];
@@ -136267,7 +136345,7 @@ self: {
        description = "MXNet interface in Haskell";
        license = stdenv.lib.licenses.mit;
        hydraPlatforms = stdenv.lib.platforms.none;
-     }) {mxnet = null;};
+     }) {inherit (pkgs) mxnet;};
 
   "mxnet-examples" = callPackage
     ({ mkDerivation, base, mxnet }:
@@ -136297,7 +136375,7 @@ self: {
        description = "NNVM interface in Haskell";
        license = stdenv.lib.licenses.mit;
        hydraPlatforms = stdenv.lib.platforms.none;
-     }) {mxnet = null;};
+     }) {inherit (pkgs) mxnet;};
 
   "myTestlll" = callPackage
     ({ mkDerivation, ansi-terminal, array, arrows, base, bytestring
@@ -136723,8 +136801,8 @@ self: {
      }:
      mkDerivation {
        pname = "nakadi-client";
-       version = "0.2.0.0";
-       sha256 = "0s9n5zrn6jncgjnj56ffpfmlhd9pmf6r82cq5xl054rxh5kbr79p";
+       version = "0.2.0.1";
+       sha256 = "1vg1aflms5hwbx86a9hrs84y9fl6wi2ihgq32ag763kbih3wvcsr";
        libraryHaskellDepends = [
          aeson aeson-casing base bytestring conduit conduit-combinators
          conduit-extra containers hashable http-client http-client-tls
@@ -156685,24 +156763,25 @@ self: {
        license = stdenv.lib.licenses.mit;
      }) {};
 
-  "pusher-http-haskell_1_4_0_0" = callPackage
+  "pusher-http-haskell_1_5_0_0" = callPackage
     ({ mkDerivation, aeson, base, base16-bytestring, bytestring
-     , cryptonite, hashable, hspec, http-client, http-types, memory
-     , QuickCheck, scientific, text, time, transformers
-     , unordered-containers, vector
+     , containers, cryptonite, hashable, hspec, HTTP, http-client
+     , http-types, memory, network-uri, QuickCheck, scientific, text
+     , time, transformers, unordered-containers, vector
      }:
      mkDerivation {
        pname = "pusher-http-haskell";
-       version = "1.4.0.0";
-       sha256 = "0mqv3h2c20p9zzhq87xysjx7fyf3w5ggss975pxdblr5y7x18bmc";
+       version = "1.5.0.0";
+       sha256 = "098vj92gwzspqp0xbd4dxxb3dggpdz5gpf616p2spkj9xvdqgy17";
        libraryHaskellDepends = [
-         aeson base base16-bytestring bytestring cryptonite hashable
-         http-client http-types memory text time transformers
+         aeson base base16-bytestring bytestring containers cryptonite
+         hashable HTTP http-client http-types memory text time transformers
          unordered-containers vector
        ];
        testHaskellDepends = [
-         aeson base bytestring hspec http-client http-types QuickCheck
-         scientific text transformers unordered-containers vector
+         aeson base base16-bytestring bytestring cryptonite hspec HTTP
+         http-client http-types memory network-uri QuickCheck scientific
+         text time transformers unordered-containers vector
        ];
        homepage = "https://github.com/pusher-community/pusher-http-haskell";
        description = "Haskell client library for the Pusher HTTP API";
@@ -157691,6 +157770,8 @@ self: {
        pname = "quickcheck-instances";
        version = "0.3.16";
        sha256 = "07xqbjb3rb5hzhjak3qpvj4hl91gc0z2272n60hv67zmv3w8kcf1";
+       revision = "1";
+       editedCabalFile = "1sfqjhk7z185l0gxrvn5pi3s8mvnqv1d1yzrx0k0mi48y5421jcm";
        libraryHaskellDepends = [
          array base base-compat bytestring case-insensitive containers
          hashable old-time QuickCheck scientific tagged text time
@@ -181334,8 +181415,8 @@ self: {
      }:
      mkDerivation {
        pname = "static-tensor";
-       version = "0.1.0.0";
-       sha256 = "118srwpc648s2472mbr14y7pkf7swfd19p4na0s3b4jxqzrxf4wj";
+       version = "0.2.0.0";
+       sha256 = "1jnl9gv2z4554arzfkrna49vn646i4q57l3g8pq4phzzmq79hh1p";
        libraryHaskellDepends = [
          base deepseq lens mono-traversable singletons split
          template-haskell
@@ -182930,6 +183011,8 @@ self: {
        pname = "streaming-postgresql-simple";
        version = "0.2.0.1";
        sha256 = "1ffsxwgsaxqnf49n4lnyrh2zy6q9zc1i3ssd03m08ip813pk5j8k";
+       revision = "1";
+       editedCabalFile = "1y5j3p3gphr3mnzl1dvfmbm8iipsdy0vq2fk0klxgid1dsqfl2vn";
        libraryHaskellDepends = [
          base bytestring exceptions postgresql-libpq postgresql-simple
          resourcet safe-exceptions streaming transformers
@@ -191679,6 +191762,32 @@ self: {
        license = stdenv.lib.licenses.bsd3;
      }) {};
 
+  "threepenny-gui_0_8_2_0" = callPackage
+    ({ mkDerivation, aeson, async, base, bytestring, containers
+     , data-default, deepseq, exceptions, file-embed, filepath, hashable
+     , network-uri, safe, snap-core, snap-server, stm, template-haskell
+     , text, transformers, unordered-containers, vault, vector
+     , websockets, websockets-snap
+     }:
+     mkDerivation {
+       pname = "threepenny-gui";
+       version = "0.8.2.0";
+       sha256 = "1qmvrkha68f30kdv8hvdkj25sgsski7rnd6dqmvbhqrn6fpsqm8r";
+       isLibrary = true;
+       isExecutable = true;
+       enableSeparateDataOutput = true;
+       libraryHaskellDepends = [
+         aeson async base bytestring containers data-default deepseq
+         exceptions file-embed filepath hashable network-uri safe snap-core
+         snap-server stm template-haskell text transformers
+         unordered-containers vault vector websockets websockets-snap
+       ];
+       homepage = "http://wiki.haskell.org/Threepenny-gui";
+       description = "GUI framework that uses the web browser as a display";
+       license = stdenv.lib.licenses.bsd3;
+       hydraPlatforms = stdenv.lib.platforms.none;
+     }) {};
+
   "threepenny-gui-contextmenu" = callPackage
     ({ mkDerivation, base, threepenny-gui }:
      mkDerivation {
@@ -200074,15 +200183,15 @@ self: {
      }) {};
 
   "userid" = callPackage
-    ({ mkDerivation, aeson, base, boomerang, safecopy, web-routes
-     , web-routes-th
+    ({ mkDerivation, aeson, base, boomerang, cereal, safecopy
+     , web-routes, web-routes-th
      }:
      mkDerivation {
        pname = "userid";
-       version = "0.1.2.8";
-       sha256 = "0911217jymfmdh5j0f66bqgaa5nhs7yf907dgnyyzkysh2473cmh";
+       version = "0.1.3";
+       sha256 = "02vcgm7n4s5lljp93q6a3b7xgw6vm6m0hm8qz9qfzgllb2d8b353";
        libraryHaskellDepends = [
-         aeson base boomerang safecopy web-routes web-routes-th
+         aeson base boomerang cereal safecopy web-routes web-routes-th
        ];
        homepage = "http://www.github.com/Happstack/userid";
        description = "The UserId type and useful instances for web development";
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 5cb627ed8957..5c7bbb32c330 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -1,10 +1,12 @@
 /* Build configuration used to build glibc, Info files, and locale
    information.  */
 
-{ stdenv, lib, fetchurl
-, gd ? null, libpng ? null
+{ stdenv, lib
 , buildPlatform, hostPlatform
 , buildPackages
+, fetchurl
+, linuxHeaders ? null
+, gd ? null, libpng ? null
 }:
 
 { name
@@ -17,7 +19,6 @@
 } @ args:
 
 let
-  inherit (buildPackages) linuxHeaders;
   version = "2.25";
   patchSuffix = "-49";
   sha256 = "067bd9bb3390e79aa45911537d13c3721f1d9d3769931a30c2681bfee66f23a0";
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 06288ce9a6b8..475ac496e7e8 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -28,12 +28,13 @@ stdenv.mkDerivation rec {
       "--disable-dependency-tracking"   # speeds up one-time build
       "--enable-modules"
       "--sysconfdir=/etc"
+      "--localstatedir=/var"
       "--enable-crypt"
     ] ++ stdenv.lib.optional (openssl == null) "--without-tls"
       ++ stdenv.lib.optional (cyrus_sasl == null) "--without-cyrus-sasl"
       ++ stdenv.lib.optional stdenv.isFreeBSD "--with-pic";
 
-  installFlags = [ "sysconfdir=$(out)/etc" ];
+  installFlags = [ "sysconfdir=$(out)/etc" "localstatedir=$(out)/var" ];
 
   # 1. Fixup broken libtool
   # 2. Libraries left in the build location confuse `patchelf --shrink-rpath`
diff --git a/pkgs/development/libraries/science/biology/nifticlib/default.nix b/pkgs/development/libraries/science/biology/nifticlib/default.nix
new file mode 100644
index 000000000000..ae916b84ea33
--- /dev/null
+++ b/pkgs/development/libraries/science/biology/nifticlib/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchurl, cmake, zlib }:
+
+stdenv.mkDerivation rec {
+  pname    = "nifticlib";
+  pversion = "2.0.0";
+  name  = "${pname}-${pversion}";
+
+  src = fetchurl {
+    url    = "mirror://sourceforge/project/niftilib/${pname}/${pname}_2_0_0/${name}.tar.gz";
+    sha256 = "123z9bwzgin5y8gi5ni8j217k7n683whjsvg0lrpii9flgk8isd3";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ zlib ];
+
+  checkPhase = "ctest";
+
+  meta = with stdenv.lib; {
+    homepage = https://sourceforge.net/projects/niftilib;
+    description = "Medical imaging format C API";
+    maintainers = with maintainers; [ bcdarwin ];
+    platforms = platforms.linux;
+    license = licenses.publicDomain;
+  };
+}
diff --git a/pkgs/development/libraries/zeroc-ice/default.nix b/pkgs/development/libraries/zeroc-ice/default.nix
index e41dfbc6a726..8527832ad9c2 100644
--- a/pkgs/development/libraries/zeroc-ice/default.nix
+++ b/pkgs/development/libraries/zeroc-ice/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchFromGitHub, mcpp, bzip2, expat, openssl, db5 }:
+{ stdenv, fetchFromGitHub, mcpp, bzip2, expat, openssl, db5
+, darwin, libiconv, Security
+}:
 
 stdenv.mkDerivation rec {
   name = "zeroc-ice-${version}";
@@ -11,17 +13,20 @@ stdenv.mkDerivation rec {
     sha256 = "05xympbns32aalgcfcpxwfd7bvg343f16xpg6jv5s335ski3cjy2";
   };
 
-  buildInputs = [ mcpp bzip2 expat openssl db5 ];
+  buildInputs = [ mcpp bzip2 expat openssl db5 ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.cctools libiconv Security ];
 
-  buildPhase = ''
-    cd cpp
-    make -j $NIX_BUILD_CORES OPTIMIZE=yes
+  postUnpack = ''
+    sourceRoot=$sourceRoot/cpp
   '';
 
-  installPhase = ''
-    make -j $NIX_BUILD_CORES prefix=$out install
+  prePatch = ''
+    substituteInPlace config/Make.rules.Darwin \
+        --replace xcrun ""
   '';
 
+  makeFlags = [ "prefix=$(out)" "OPTIMIZE=yes" ];
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/ocaml-modules/csv/1.5.nix b/pkgs/development/ocaml-modules/csv/1.5.nix
new file mode 100644
index 000000000000..a7505f6f51cd
--- /dev/null
+++ b/pkgs/development/ocaml-modules/csv/1.5.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchzip, ocaml, findlib, ocamlbuild }:
+
+stdenv.mkDerivation {
+
+  name = "ocaml${ocaml.version}-csv-1.5";
+
+  src = fetchzip {
+    url = "https://github.com/Chris00/ocaml-csv/releases/download/1.5/csv-1.5.tar.gz";
+    sha256 = "1ca7jgg58j24pccs5fshis726s06fdcjshnwza5kwxpjgdbvc63g";
+  };
+
+  buildInputs = [ ocaml findlib ocamlbuild ];
+
+  createFindlibDestdir = true;
+
+  configurePhase = "ocaml setup.ml -configure --prefix $out --enable-tests";
+
+  buildPhase = "ocaml setup.ml -build";
+
+  doCheck = true;
+  checkPhase = "ocaml setup.ml -test";
+
+  installPhase = "ocaml setup.ml -install";
+
+  meta = with stdenv.lib; {
+    description = "A pure OCaml library to read and write CSV files";
+    homepage = https://github.com/Chris00/ocaml-csv;
+    license = licenses.lgpl21;
+    maintainers = [ maintainers.vbgl ];
+    platforms = ocaml.meta.platforms or [];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/csv/default.nix b/pkgs/development/ocaml-modules/csv/default.nix
index 751d40ff706d..c168045831f1 100644
--- a/pkgs/development/ocaml-modules/csv/default.nix
+++ b/pkgs/development/ocaml-modules/csv/default.nix
@@ -1,48 +1,26 @@
-{ stdenv, fetchzip, ocaml, findlib, ocamlbuild, ocaml_lwt }:
+{ stdenv, fetchurl, ocaml, findlib, jbuilder }:
 
-let param =
-  if stdenv.lib.versionAtLeast ocaml.version "4.2"
-  then {
-    version = "1.7";
-    url = https://math.umons.ac.be/anum/software/csv/csv-1.7.tar.gz;
-    sha256 = "1mmcjiiz0jppgipavpph5kn04xcpalw4scbjrw2z3drghvr3qqwf";
-    lwtSupport = true;
-  } else {
-    version = "1.5";
-    url = https://github.com/Chris00/ocaml-csv/releases/download/1.5/csv-1.5.tar.gz;
-    sha256 = "1ca7jgg58j24pccs5fshis726s06fdcjshnwza5kwxpjgdbvc63g";
-    lwtSupport = false;
-  };
-in
+stdenv.mkDerivation rec {
+	version = "2.0";
+	name = "ocaml${ocaml.version}-csv-${version}";
+	src = fetchurl {
+		url = "https://github.com/Chris00/ocaml-csv/releases/download/2.0/csv-2.0.tbz";
+		sha256 = "1g6xsybwc5ifr7n4hkqlh3294njzca12xg86ghh6pqy350wpq1zp";
+	};
 
-stdenv.mkDerivation {
+	unpackCmd = "tar -xjf $src";
 
-  name = "ocaml${ocaml.version}-csv-${param.version}";
+	buildInputs = [ ocaml findlib jbuilder ];
 
-  src = fetchzip {
-    inherit (param) url sha256;
-  };
+	buildPhase = "jbuilder build -p csv";
 
-  buildInputs = [ ocaml findlib ocamlbuild ]
-  ++ stdenv.lib.optional param.lwtSupport ocaml_lwt;
+	inherit (jbuilder) installPhase;
 
-  createFindlibDestdir = true;
-
-  configurePhase = "ocaml setup.ml -configure --prefix $out --enable-tests"
-  + stdenv.lib.optionalString param.lwtSupport " --enable-lwt";
-
-  buildPhase = "ocaml setup.ml -build";
-
-  doCheck = true;
-  checkPhase = "ocaml setup.ml -test";
-
-  installPhase = "ocaml setup.ml -install";
-
-  meta = with stdenv.lib; {
-    description = "A pure OCaml library to read and write CSV files";
-    homepage = https://github.com/Chris00/ocaml-csv;
-    license = licenses.lgpl21;
-    maintainers = [ maintainers.vbgl ];
-    platforms = ocaml.meta.platforms or [];
-  };
+	meta = {
+		description = "A pure OCaml library to read and write CSV files";
+		license = stdenv.lib.licenses.lgpl21;
+		maintainers = [ stdenv.lib.maintainers.vbgl ];
+		homepage = https://github.com/Chris00/ocaml-csv;
+		inherit (ocaml.meta) platforms;
+	};
 }
diff --git a/pkgs/development/ocaml-modules/ocamlfuse/default.nix b/pkgs/development/ocaml-modules/ocamlfuse/default.nix
index de69ce472281..e5a3c282e581 100644
--- a/pkgs/development/ocaml-modules/ocamlfuse/default.nix
+++ b/pkgs/development/ocaml-modules/ocamlfuse/default.nix
@@ -1,12 +1,14 @@
 { stdenv, fetchFromGitHub, ocaml, camlidl, fuse, findlib }:
 
 stdenv.mkDerivation rec {
-  name = "ocamlfuse-2.7-3";
+  name = "ocamlfuse-${version}";
+  version = "2.7.1_cvs5";
+
   src = fetchFromGitHub {
     owner = "astrada";
     repo = "ocamlfuse";
-    rev = "a085349685758668854499ce6c1fc00c83a5c23b";
-    sha256 = "1pyml2ay5wab1blwpzrv1r6lnycm000jk6aar8i9fkdnh15sa6c3";
+    rev = "v${version}";
+    sha256 = "01ayw2hzpxan95kncbxh9isj9g149cs8scq3xim1vy8bz085wb0m";
   };
 
   buildInputs = [ocaml findlib];
@@ -18,9 +20,9 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = http://sourceforge.net/projects/ocamlfuse;
+    description = "OCaml bindings for FUSE";
     license = stdenv.lib.licenses.gpl2;
-    description = "ocaml binding for fuse";
-    maintainers = with stdenv.lib.maintainers; [ bennofs ];
     platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ bennofs ];
   };
 }
diff --git a/pkgs/development/python-modules/afew/default.nix b/pkgs/development/python-modules/afew/default.nix
index 39c921eb7bcd..05280738e5ba 100644
--- a/pkgs/development/python-modules/afew/default.nix
+++ b/pkgs/development/python-modules/afew/default.nix
@@ -1,19 +1,20 @@
 { stdenv, buildPythonPackage, fetchFromGitHub
-, isPy3k , dbacl, notmuch, chardet, subprocess32 }:
+, isPy3k , setuptools_scm, notmuch, chardet, subprocess32 }:
 
 buildPythonPackage rec {
   pname = "afew";
-  version = "git-2017-02-08";
+  version = "1.2.0";
   name = "${pname}-${version}";
 
   src = fetchFromGitHub {
     owner = "afewmail";
     repo = "afew";
-    rev = "889a3b966835c4d16aa1f24bb89f12945b9b2a67";
-    sha256 = "01gwrx1m3ka13ps3vj04a3y8llli2j2vkd3gcggcvxdphhpysckm";
+    rev = "3405475276a2433e1238be330e538ebf2a976e5e";
+    sha256 = "1h974avnfc6636az130yjqwm28z3aaqm49bjhpy3razx6zvyhzlf";
   };
 
-  buildInputs = [ dbacl ];
+  buildInputs = [ setuptools_scm ];
+  SETUPTOOLS_SCM_PRETEND_VERSION = "${version}";
 
   propagatedBuildInputs = [
     notmuch
@@ -22,10 +23,6 @@ buildPythonPackage rec {
 
   doCheck = false;
 
-  preConfigure = ''
-    substituteInPlace afew/DBACL.py --replace "'dbacl'" "'${dbacl}/bin/dbacl'"
-  '';
-
   postInstall = ''
     wrapProgram $out/bin/afew \
       --prefix LD_LIBRARY_PATH : ${notmuch}/lib
diff --git a/pkgs/development/python-modules/flake8-future-import/default.nix b/pkgs/development/python-modules/flake8-future-import/default.nix
new file mode 100644
index 000000000000..f00c1fe21661
--- /dev/null
+++ b/pkgs/development/python-modules/flake8-future-import/default.nix
@@ -0,0 +1,20 @@
+{ lib, fetchFromGitHub, buildPythonPackage, python, flake8, six }:
+
+buildPythonPackage rec {
+  pname = "flake8-future-import";
+  name = "${pname}-${version}";
+  version = "0.4.3";
+  # PyPI tarball doesn't include the test suite
+  src = fetchFromGitHub {
+    owner = "xZise";
+    repo = "flake8-future-import";
+    rev = version;
+    sha256 = "0622bdcfa588m7g8igag6hf4rhjdwh74yfnrjwlxw4vlqhg344k4";
+  };
+  propagatedBuildInputs = [ flake8 six ];
+  meta = {
+    homepage = https://github.com/xZise/flake8-future-import;
+    description = "A flake8 extension to check for the imported __future__ modules to make it easier to have a consistent code base";
+    license = lib.licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/pafy/default.nix b/pkgs/development/python-modules/pafy/default.nix
new file mode 100644
index 000000000000..77ed1d6c4c0a
--- /dev/null
+++ b/pkgs/development/python-modules/pafy/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, youtube-dl, fetchPypi }:
+buildPythonPackage rec {
+  name = "${pname}-${version}";
+  pname = "pafy";
+  version = "0.5.3.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1a7dxi95m1043rxx1r5x3ngb66nwlq6aqcasyqqjzmmmjps4zrim";
+  };
+
+  # No tests included in archive
+  doCheck = false;
+
+  propagatedBuildInputs = [ youtube-dl ];
+
+  meta = with lib; {
+    description = "A library to download YouTube content and retrieve metadata";
+    homepage = http://np1.github.io/pafy/;
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ odi ];
+  };
+}
+
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index bf1f9d14b776..6647d71bd006 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -67,6 +67,10 @@ in
   charlock_holmes = attrs: {
     buildInputs = [ which icu zlib ];
   };
+  
+  curb = attrs: {
+    buildInputs = [ curl ];
+  };
 
   dep-selector-libgecode = attrs: {
     USE_SYSTEM_GECODE = true;
diff --git a/pkgs/development/tools/build-managers/sbt/default.nix b/pkgs/development/tools/build-managers/sbt/default.nix
index 6d49b81bd611..e5f68365e427 100644
--- a/pkgs/development/tools/build-managers/sbt/default.nix
+++ b/pkgs/development/tools/build-managers/sbt/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "sbt-${version}";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchurl {
     urls = [
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
       "https://github.com/sbt/sbt/releases/download/v${version}/sbt-${version}.tgz"
       "https://cocl.us/sbt-${version}.tgz"
     ];
-    sha256 = "0nhf7fksgaa8snrhfaac4n6gf29bbv59lfyiv7pr2jhbi5m9js2v";
+    sha256 = "1w1f6nsdq3inxhqhy69mgljfjr51n1v1s8i51gcg11rd2bc67w63";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/tools/misc/gengetopt/default.nix b/pkgs/development/tools/misc/gengetopt/default.nix
index 19e934f884f7..304f16942eaf 100644
--- a/pkgs/development/tools/misc/gengetopt/default.nix
+++ b/pkgs/development/tools/misc/gengetopt/default.nix
@@ -10,6 +10,10 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  postPatch = ''
+    sed -e 's/set -o posix/set +o posix/' -i configure
+  '';
+
   meta = {
     description = "Command-line option parser generator";
 
diff --git a/pkgs/development/tools/misc/kibana/5.x.nix b/pkgs/development/tools/misc/kibana/5.x.nix
index 69a19987020d..735f85f74569 100644
--- a/pkgs/development/tools/misc/kibana/5.x.nix
+++ b/pkgs/development/tools/misc/kibana/5.x.nix
@@ -11,9 +11,9 @@ let
   elasticArch = archOverrides."${arch}" or arch;
   plat = elemAt info 1;
   shas = {
-    "x86_64-linux"  = "0nmx7r6i54x7pii4ryh3wzzbwvnmcb3f1hn6ch96r24xi4v9m1sb";
-    "i686-linux"    = "0am6wmbcsh7zxzdrl1q9jbjrb7y4apvi6sr70j61xcx07pbickpp";
-    "x86_64-darwin" = "0kjnlzsz4i2fca3jgfsr1kknqzaypb0r78a7cxz2m7daj3bmpvpl";
+    "x86_64-linux"  = "02dhhp16pmkrpi2dfrca9qzz1q7jrxhaw6l3cfflgxx77hz0hlnw";
+    "i686-linux"    = "1h1zr342dq7nngvzpf9pn9mvwsi7aksa3qjyqpcc4yvbmmyrlk0m";
+    "x86_64-darwin" = "0van8cnir6s520crc20bf2clbkf822c3ylpk7iiq7da8hwvsypp9";
   };
 in stdenv.mkDerivation rec {
   name = "kibana-${version}";
diff --git a/pkgs/development/tools/ocaml/merlin/default.nix b/pkgs/development/tools/ocaml/merlin/default.nix
index 4680785ac7c2..a6252a5c729d 100644
--- a/pkgs/development/tools/ocaml/merlin/default.nix
+++ b/pkgs/development/tools/ocaml/merlin/default.nix
@@ -4,15 +4,7 @@
 assert stdenv.lib.versionAtLeast (stdenv.lib.getVersion ocaml) "4.00";
 
 let
-  version = if lib.versionOlder (lib.getVersion ocaml) "4.02.0"
-  then
-    "2.3.1"
-  else
-    "2.5.4";
-  hashes = {
-    "2.3.1" = "192jamcc7rmvadlqqsjkzsl6hlgwhg9my1qc89fxh1lmd4qdsrpn";
-    "2.5.4" = "101vk16c5wayd51s8w0mvy99bk7q3gm2gz8i8616wa1lmyszjknh";
-  };
+  version = "3.0.2";
 in
 
 stdenv.mkDerivation {
@@ -20,8 +12,8 @@ stdenv.mkDerivation {
   name = "merlin-${version}";
 
   src = fetchzip {
-    url = "https://github.com/the-lambda-church/merlin/archive/v${version}.tar.gz";
-    sha256 = hashes."${version}";
+    url = "https://github.com/ocaml/merlin/archive/v${version}.tar.gz";
+    sha256 = "0lcgafs5ip8vhvrp1d7yv6mzjsirmayd83cj4wwq6zxcrl7yv4x8";
   };
 
   buildInputs = [ ocaml findlib yojson ]
diff --git a/pkgs/misc/drivers/hplip/default.nix b/pkgs/misc/drivers/hplip/default.nix
index 6adc2a765c7f..9342c547a17e 100644
--- a/pkgs/misc/drivers/hplip/default.nix
+++ b/pkgs/misc/drivers/hplip/default.nix
@@ -61,10 +61,9 @@ pythonPackages.buildPythonApplication {
 
   nativeBuildInputs = [
     pkgconfig
-    makeWrapper
   ];
 
-  propagatedBuildInputs = with pythonPackages; [
+  pythonPath = with pythonPackages; [
     dbus
     pillow
     pygobject2
@@ -74,6 +73,8 @@ pythonPackages.buildPythonApplication {
     pyqt4
   ];
 
+  makeWrapperArgs = [ ''--prefix PATH : "${nettools}/bin"'' ];
+
   prePatch = ''
     # HPLIP hardcodes absolute paths everywhere. Nuke from orbit.
     find . -type f -exec sed -i \
@@ -88,6 +89,7 @@ pythonPackages.buildPythonApplication {
 
   preConfigure = ''
     export configureFlags="$configureFlags
+      --with-hpppddir=$out/share/cups/model/HP
       --with-cupsfilterdir=$out/lib/cups/filter
       --with-cupsbackenddir=$out/lib/cups/backend
       --with-icondir=$out/share/applications
@@ -144,10 +146,30 @@ pythonPackages.buildPythonApplication {
     rm $out/etc/udev/rules.d/56-hpmud.rules
   '';
 
-  postFixup = ''
-    wrapProgram $out/lib/cups/filter/hpps \
-      --prefix PATH : "${nettools}/bin"
+  # The installed executables are just symlinks into $out/share/hplip,
+  # but wrapPythonPrograms ignores symlinks. We cannot replace the Python
+  # modules in $out/share/hplip with wrapper scripts because they import
+  # each other as libraries. Instead, we emulate wrapPythonPrograms by
+  # 1. Calling patchPythonProgram on the original script in $out/share/hplip
+  # 2. Making our own wrapper pointing directly to the original script.
+  dontWrapPythonPrograms = true;
+  preFixup = ''
+    buildPythonPath "$out $pythonPath"
 
+    for bin in $out/bin/*; do
+      py=$(readlink -m $bin)
+      rm $bin
+      echo "patching \`$py'..."
+      patchPythonScript "$py"
+      echo "wrapping \`$bin'..."
+      makeWrapper "$py" "$bin" \
+          --prefix PATH ':' "$program_PATH" \
+          --set PYTHONNOUSERSITE "true" \
+          $makeWrapperArgs
+    done
+  '';
+
+  postFixup = ''
     substituteInPlace $out/etc/hp/hplip.conf --replace /usr $out
   '' + stdenv.lib.optionalString (!withPlugin) ''
     # A udev rule to notify users that they need the binary plugin.
diff --git a/pkgs/misc/logging/beats/default.nix b/pkgs/misc/logging/beats/default.nix
index 2b555978edc3..e3333fa5caac 100644
--- a/pkgs/misc/logging/beats/default.nix
+++ b/pkgs/misc/logging/beats/default.nix
@@ -8,7 +8,7 @@ let beat = package : extraArgs : buildGoPackage (rec {
         owner = "elastic";
         repo = "beats";
         rev = "v${version}";
-        sha256 = "0vzjlgc0sym3kh6nflf2iyy2k3gxd7zwq8ma0cd7kpf42vxwhvqy";
+        sha256 = "1lbdi4c0y4bfkmim9q98ravknv4yw0dl3z57c3w5aqhi2sx0w23h";
       };
 
       goPackagePath = "github.com/elastic/beats";
diff --git a/pkgs/misc/themes/flat-plat/default.nix b/pkgs/misc/themes/flat-plat/default.nix
index 3c7882e8f946..cd652440efae 100644
--- a/pkgs/misc/themes/flat-plat/default.nix
+++ b/pkgs/misc/themes/flat-plat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "flat-plat-gtk-theme-${version}";
-  version = "20170605";
+  version = "20170917";
 
   src = fetchFromGitHub {
     owner = "nana-4";
     repo = "Flat-Plat";
     rev = "v${version}";
-    sha256 = "1vcd6mkkfk9a1n5hwpdigvsdsfd8df83kc94w53rs7gw9pqfygya";
+    sha256 = "17r4wl27yx49xg0l3s5d67174r63p4cw6cbdmzl81if7iab69hv0";
   };
 
   nativeBuildInputs = [ gnome3.glib libxml2 ];
diff --git a/pkgs/misc/vim-plugins/default.nix b/pkgs/misc/vim-plugins/default.nix
index ee6b0fe8c375..24dd868d64dc 100644
--- a/pkgs/misc/vim-plugins/default.nix
+++ b/pkgs/misc/vim-plugins/default.nix
@@ -495,6 +495,17 @@ rec {
 
   };
 
+  LanguageClient-neovim = buildVimPluginFrom2Nix { # created by nix#NixDerivation
+    name = "LanguageClient-neovim-2017-09-05";
+    src = fetchgit {
+      url = "https://github.com/autozimu/LanguageClient-neovim";
+      rev = "5bfc3492d50c3c48c6e0b0d1899ed2bbca2cf48f";
+      sha256 = "1zi3v4yx4hgzfr23377z84yngiqvdwjpdpkn12lpi6irb04q6641";
+    };
+    dependencies = [];
+
+  };
+
   clighter8 = buildVimPluginFrom2Nix { # created by nix#NixDerivation
     name = "clighter8-2017-07-23";
     src = fetchgit {
@@ -1363,6 +1374,17 @@ rec {
 
   };
 
+  nvim-cm-racer = buildVimPluginFrom2Nix { # created by nix#NixDerivation
+    name = "nvim-cm-racer-2017-07-27";
+    src = fetchgit {
+      url = "https://github.com/roxma/nvim-cm-racer";
+      rev = "2a8a4a49fa58c5dac9e0bed9511f6928930cacd2";
+      sha256 = "1yljxwypgn91084yyicbc2qprn31ld7s4drvnddzczyhzq5m2gpx";
+    };
+    dependencies = [];
+
+  };
+
   nvim-completion-manager = buildVimPluginFrom2Nix { # created by nix#NixDerivation
     name = "nvim-completion-manager-2017-09-05";
     src = fetchgit {
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 8dd187fe5223..f1983e3eeb6a 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -31,6 +31,7 @@
 "github:alvan/vim-closetag"
 "github:andviro/flake8-vim"
 "github:ap/vim-css-color"
+"github:autozimu/LanguageClient-neovim"
 "github:bbchung/clighter8"
 "github:benekastah/neomake"
 "github:bitc/vim-hdevtools"
@@ -109,6 +110,7 @@
 "github:rhysd/vim-grammarous"
 "github:rodjek/vim-puppet"
 "github:roxma/nvim-completion-manager"
+"github:roxma/nvim-cm-racer"
 "github:ryanoasis/vim-devicons"
 "github:rust-lang/rust.vim"
 "github:sbdchd/neoformat"
diff --git a/pkgs/os-specific/linux/kernel/linux-4.12.nix b/pkgs/os-specific/linux/kernel/linux-4.12.nix
index 640534aa2a6e..bff0f5db9538 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.12.nix
@@ -1,11 +1,11 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.12.13";
+  version = "4.12.14";
   extraMeta.branch = "4.12";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "18sxw7mw4fya7381mkah70s3di6b8xxfigjhrhb7zcczrffb4vl9";
+    sha256 = "09zxmknh6awhqmj8dyq95bdlwcasryy35hkjxjlzixdgn52kzaw6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.13.nix b/pkgs/os-specific/linux/kernel/linux-4.13.nix
index 1d51b033dc14..d1c4d8ba8e7d 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.13.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.13.nix
@@ -1,11 +1,11 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.13.2";
+  version = "4.13.3";
   extraMeta.branch = "4.13";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1lgwgw9yp5ywbylnmahsmqzs98yfq53mvvqqdgp7ljiqg8bxqjh6";
+    sha256 = "1ayai3i0jakxzszpijhknjiwwi055wa74bpmnr0n7dh2l5s2rlh3";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 5f4686a5ec65..5033bb88f79a 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.9.50";
+  version = "4.9.51";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0dhm5w7qa1hyqp254r41b4nhf10a8w7sv1mhd16f61inpb41829c";
+    sha256 = "12mag09scyzi5a352y39y4b6rjh89qqca53hhmjc396q09hsdyl3";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
index 3b9357ae35ed..a2bf05647830 100644
--- a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
+++ b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
@@ -3,9 +3,9 @@
 with stdenv.lib;
 
 let
-  version = "4.13.2";
+  version = "4.13.3";
   revision = "a";
-  sha256 = "1srglf014a2ra4sgzwrf53wdc3rrr5lx8dcx57xm4lpvrc4r66y6";
+  sha256 = "1w1waqrzji17f7zmnkr7afbd2yz0xqf6m3g8dz2bkd2kzv07vzx5";
 
   # modVersion needs to be x.y.z, will automatically add .0 if needed
   modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
diff --git a/pkgs/servers/atlassian/confluence.nix b/pkgs/servers/atlassian/confluence.nix
index ea8d2651836a..a4cc5c8780da 100644
--- a/pkgs/servers/atlassian/confluence.nix
+++ b/pkgs/servers/atlassian/confluence.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "atlassian-confluence-${version}";
-  version = "6.3.1";
+  version = "6.4.0";
 
   src = fetchurl {
     url = "https://www.atlassian.com/software/confluence/downloads/binary/${name}.tar.gz";
-    sha256 = "0f7hc8q4sigvr9bdxx8phnp6bkfkz9bccwkrx0xqyrvvdc5x5690";
+    sha256 = "1ba8zpcywnnanzqxjaqiyfc6j5qr6jk6laryz8npiqz4grv3qk61";
   };
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" ];
diff --git a/pkgs/servers/atlassian/jira.nix b/pkgs/servers/atlassian/jira.nix
index 0013286c03c1..f2ccb523e2ff 100644
--- a/pkgs/servers/atlassian/jira.nix
+++ b/pkgs/servers/atlassian/jira.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "atlassian-jira-${version}";
-  version = "7.4.1";
+  version = "7.5.0";
 
   src = fetchurl {
     url = "https://downloads.atlassian.com/software/jira/downloads/atlassian-jira-software-${version}.tar.gz";
-    sha256 = "1ixkhc206z3zpiaj46v8z2gxmix24sxqs2d17fb64gkyml9s5gqb";
+    sha256 = "12pf0q1ixsf9ld0569mbwvjz5v9bhh7ad3bd8x9qx188vq5cz381";
   };
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" "fixupPhase" ];
diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix
index cf6cc8d69910..f3222f2982b4 100644
--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
@@ -51,8 +51,8 @@
     src = fetchFromGitHub {
       owner = "openresty";
       repo = "echo-nginx-module";
-      rev = "v0.57";
-      sha256 = "1q0f0zprcn0ypl2qh964cq186l3f40p0z7n7x22m8cxj367vf000";
+      rev = "v0.61";
+      sha256 = "0brjhhphi94ms4gia7za0mfx0png4jbhvq6j0nzjwp537iyiy23k";
     };
   };
 
diff --git a/pkgs/servers/misc/client-ip-echo/client-ip-echo.nix b/pkgs/servers/misc/client-ip-echo/client-ip-echo.nix
new file mode 100644
index 000000000000..08c08d7d3c16
--- /dev/null
+++ b/pkgs/servers/misc/client-ip-echo/client-ip-echo.nix
@@ -0,0 +1,16 @@
+{ mkDerivation, fetchFromGitHub, base, bytestring, network, stdenv }:
+mkDerivation {
+  pname = "client-ip-echo";
+  version = "0.1.0.1";
+  src = fetchFromGitHub {
+    owner = "jerith666";
+    repo = "client-ip-echo";
+    rev = "f6e3e115a1e61a387cf79956ead36d7ac25a2901";
+    sha256 = "0irxcaiwxxn4ggd2dbya1mvpnyfanx0x06whp8ccrha141cafwqp";
+  };
+  isLibrary = false;
+  isExecutable = true;
+  executableHaskellDepends = [ base bytestring network ];
+  description = "accepts TCP connections and echoes the client's IP address back to it";
+  license = stdenv.lib.licenses.lgpl3;
+}
diff --git a/pkgs/servers/misc/client-ip-echo/default.nix b/pkgs/servers/misc/client-ip-echo/default.nix
new file mode 100644
index 000000000000..5bc0ea45e2b6
--- /dev/null
+++ b/pkgs/servers/misc/client-ip-echo/default.nix
@@ -0,0 +1,2 @@
+{ pkgs }:
+pkgs.haskellPackages.callPackage ./client-ip-echo.nix { }
diff --git a/pkgs/servers/search/elasticsearch/5.x.nix b/pkgs/servers/search/elasticsearch/5.x.nix
index 781f505f4690..cfa471f217ee 100644
--- a/pkgs/servers/search/elasticsearch/5.x.nix
+++ b/pkgs/servers/search/elasticsearch/5.x.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://artifacts.elastic.co/downloads/elasticsearch/${name}.tar.gz";
-    sha256 = "1wavcqhwx4nj5v1ba8136009asnhrnhpm87zdsbxlvifqz0f4w08";
+    sha256 = "0pvi6akicg0i3bz3lbc6k9rznxw7d25flg9wbs2dyxv8i2rrqvq0";
   };
 
   patches = [ ./es-home-5.x.patch ./es-classpath-5.x.patch ];
diff --git a/pkgs/servers/traefik/default.nix b/pkgs/servers/traefik/default.nix
new file mode 100644
index 000000000000..f1fb1a34fc24
--- /dev/null
+++ b/pkgs/servers/traefik/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, buildGoPackage, fetchurl, bash, go-bindata}:
+
+buildGoPackage rec {
+  name = "traefik-${version}";
+  version = "1.3.8";
+
+  goPackagePath = "github.com/containous/traefik";
+
+  src = fetchurl {
+    url = "https://github.com/containous/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
+    sha256 = "6fce36dd30bb5ae5f91e69f2950f22fe7a74b920e80c6b441a0721122f6a6174";
+  };
+
+  buildInputs = [ go-bindata bash ];
+  unpackPhase = ''
+    runHook preUnpack
+    mkdir traefik
+    tar -C traefik -xvzf $src
+    export sourceRoot="traefik"
+    runHook postUnpack
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    (
+      cd go/src/github.com/containous/traefik
+      bash ./script/make.sh generate
+
+      CODENAME=$(awk -F "=" '/CODENAME=/ { print $2}' script/binary)
+      go build -ldflags "\
+        -X github.com/containous/traefik/version.Version=${version} \
+        -X github.com/containous/traefik/version.Codename=$CODENAME \
+      " -a -o $bin/bin/traefik ./cmd/traefik
+    )
+    runHook postBuild
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://traefik.io;
+    description = "A modern reverse proxy";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hamhut1066 ];
+  };
+}
diff --git a/pkgs/servers/unifi/default.nix b/pkgs/servers/unifi/default.nix
index ec3b255116b3..08a9637308cb 100644
--- a/pkgs/servers/unifi/default.nix
+++ b/pkgs/servers/unifi/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   name = "unifi-controller-${version}";
-  version = "5.5.20";
+  version = "5.6.16";
 
   src = fetchurl {
-    url = "https://www.ubnt.com/downloads/unifi/${version}/unifi_sysvinit_all.deb";
-    sha256 = "14v38x46vgwm3wg28lzv4sz6kjgp6r1xkwxnxn6pzq2r7v6xkaz0";
+    url = "https://www.ubnt.com/downloads/unifi/${version}-86cdeea491/unifi_sysvinit_all.deb";
+    sha256 = "1kfrawf48q9rx48hcnmiqndbg84v340yfykh23af7xpcxmzl5jy7";
   };
 
   buildInputs = [ dpkg ];
diff --git a/pkgs/shells/elvish/default.nix b/pkgs/shells/elvish/default.nix
index 1d1dddd0c2a0..8a7d49710125 100644
--- a/pkgs/shells/elvish/default.nix
+++ b/pkgs/shells/elvish/default.nix
@@ -2,7 +2,11 @@
 
 buildGoPackage rec {
   name = "elvish-${version}";
-  version = "0.9";
+  version = "0.10";
+
+  postInstall = stdenv.lib.optionalString (stdenv.isDarwin) ''
+    install_name_tool -delete_rpath $out/lib $bin/bin/elvish
+  '';
 
   goPackagePath = "github.com/elves/elvish";
 
@@ -10,7 +14,7 @@ buildGoPackage rec {
     repo = "elvish";
     owner = "elves";
     rev = version;
-    sha256 = "0alsv04iihrk1nffp6fmyzxid26dqhg1k45957c2ymyzyq9cglxj";
+    sha256 = "0v6byd81nz0fbd3sdlippi1jn1z3gbqc2shnr7akd1n6k9259vrj";
   };
 
   meta = with stdenv.lib; {
@@ -18,6 +22,6 @@ buildGoPackage rec {
     homepage = https://github.com/elves/elvish;
     license = licenses.bsd2;
     maintainers = with maintainers; [ vrthra ];
-    platforms = with platforms; linux;
+    platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/shells/oil/default.nix b/pkgs/shells/oil/default.nix
index eebbc6d1b867..ec7dbbbf5ffc 100644
--- a/pkgs/shells/oil/default.nix
+++ b/pkgs/shells/oil/default.nix
@@ -1,13 +1,13 @@
 { stdenv, lib, fetchurl, coreutils }:
 let
-  version = "0.0.0";
+  version = "0.1.0";
 in
 stdenv.mkDerivation {
   name = "oil-${version}";
 
   src = fetchurl {
     url = "https://www.oilshell.org/download/oil-${version}.tar.xz";
-    sha256 = "1mvyvvzw149piwa7xdl3byyn7h31p4cnrf3w9dxr5qfd9vc4gmsm";
+    sha256 = "0cf7jwwgvcq7q6zq8g5pi464hnn83b2km0nv6711qgqbxmsw85nx";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
new file mode 100644
index 000000000000..c7a22f00dce7
--- /dev/null
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -0,0 +1,52 @@
+{ stdenv, fetchurl, autoconf, automake, pkgconfig
+, perl, flex, bison, readline, libexif
+, x11Support ? true, SDL
+, svgSupport ? true, inkscape
+, asciiArtSupport ? true, aalib
+, gifSupport ? true, giflib
+, tiffSupport ? true, libtiff
+, jpegSupport ? true, libjpeg
+, pngSupport ? true, libpng
+}:
+
+stdenv.mkDerivation rec {
+  name = "fim-${version}";
+  version = "0.5rc3";
+
+  src = fetchurl {
+    url = mirror://savannah/fbi-improved/fim-0.5-rc3.tar.gz;
+    sha256 = "12aka85h469zfj0zcx3xdpan70gq8nf5rackgb1ldcl9mqjn50c2";
+  };
+
+  postPatch = ''
+   substituteInPlace doc/vim2html.pl \
+     --replace /usr/bin/perl ${perl}/bin/perl
+  '';
+
+  nativeBuildInputs = [ autoconf automake pkgconfig ];
+
+  buildInputs = with stdenv.lib;
+    [ perl flex bison readline libexif ]
+    ++ optional x11Support SDL
+    ++ optional svgSupport inkscape
+    ++ optional asciiArtSupport aalib
+    ++ optional gifSupport giflib
+    ++ optional tiffSupport libtiff
+    ++ optional jpegSupport libjpeg
+    ++ optional pngSupport libpng;
+
+  NIX_CFLAGS_COMPILE = stdenv.lib.optional x11Support "-lSDL";
+
+  meta = with stdenv.lib; {
+    description = "A lightweight, highly customizable and scriptable image viewer";
+    longDescription = ''
+      FIM (Fbi IMproved) is a lightweight, console based image viewer that aims
+      to be a highly customizable and scriptable for users who are comfortable
+      with software like the VIM text editor or the Mutt mail user agent.
+    '';
+    homepage = http://www.nongnu.org/fbi-improved/;
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos ];
+  };
+}
diff --git a/pkgs/tools/misc/esptool/default.nix b/pkgs/tools/misc/esptool/default.nix
index 427ddea2f36e..33624302ebcc 100644
--- a/pkgs/tools/misc/esptool/default.nix
+++ b/pkgs/tools/misc/esptool/default.nix
@@ -11,7 +11,7 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "137p0kcscly95qpjzgx1yxm8k2wf5y9v3srvlhp2ajniirgv8ijv";
   };
 
-  buildInputs = with python3.pkgs; [ flake8 ];
+  buildInputs = with python3.pkgs; [ flake8 flake8-future-import ];
   propagatedBuildInputs = with python3.pkgs; [ pyserial pyaes ecdsa openssl ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/logstash/5.x.nix b/pkgs/tools/misc/logstash/5.x.nix
index d796b3952f68..4ecc0be783eb 100644
--- a/pkgs/tools/misc/logstash/5.x.nix
+++ b/pkgs/tools/misc/logstash/5.x.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://artifacts.elastic.co/downloads/logstash/${name}.tar.gz";
-    sha256 = "04nrw7ikcjp02cmwvaa1swj0b66l91n9d8qbdicsa023js4mp14m";
+    sha256 = "11qg8i0svsccr1wd0yj0ivfzpza2hd68221g38v88shvj0bb737f";
   };
 
   dontBuild         = true;
diff --git a/pkgs/tools/misc/svtplay-dl/default.nix b/pkgs/tools/misc/svtplay-dl/default.nix
index a652243a9d60..5999fa316223 100644
--- a/pkgs/tools/misc/svtplay-dl/default.nix
+++ b/pkgs/tools/misc/svtplay-dl/default.nix
@@ -5,13 +5,13 @@ let
   inherit (pythonPackages) python nose pycrypto requests mock;
 in stdenv.mkDerivation rec {
   name = "svtplay-dl-${version}";
-  version = "1.9.4";
+  version = "1.9.6";
 
   src = fetchFromGitHub {
     owner = "spaam";
     repo = "svtplay-dl";
     rev = version;
-    sha256 = "15vjaia1qbs49gplpfi8sj5scl9mb4qg8n2z4zyzjs5461lx5qqv";
+    sha256 = "11xw4whh60k61i8akd7avb254mmffaig72kb7w6prk1kjq05js2s";
   };
 
   pythonPaths = [ pycrypto requests ];
diff --git a/pkgs/tools/networking/openfortivpn/default.nix b/pkgs/tools/networking/openfortivpn/default.nix
index 3854d94f9093..48abd9a33742 100644
--- a/pkgs/tools/networking/openfortivpn/default.nix
+++ b/pkgs/tools/networking/openfortivpn/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, openssl, ppp }:
+{ stdenv, fetchFromGitHub, autoreconfHook, openssl, ppp, pkgconfig }:
 
 with stdenv.lib;
 
 let repo = "openfortivpn";
-    version = "1.2.0";
+    version = "1.5.0";
 
 in stdenv.mkDerivation {
   name = "${repo}-${version}";
@@ -12,10 +12,10 @@ in stdenv.mkDerivation {
     owner = "adrienverge";
     inherit repo;
     rev = "v${version}";
-    sha256 = "1a1l9f6zivfyxg9g2x7kzkvcyh84s7l6v0kimihhrd19zl0m41jn";
+    sha256 = "0fm0z73afghwmbshpsn5jfbyyfzz1v8s7scwycnvsk2cgv5f4r86";
   };
-
-  buildInputs = [ openssl ppp autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ openssl ppp ];
 
   NIX_CFLAGS_COMPILE = "-Wno-error=unused-function";
 
diff --git a/pkgs/tools/networking/p2p/libtorrent/default.nix b/pkgs/tools/networking/p2p/libtorrent/default.nix
index d1827a6045d8..9646c47a8d71 100644
--- a/pkgs/tools/networking/p2p/libtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/libtorrent/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "libtorrent-${version}";
-  version = "0.13.6";
+  version = "20161212";
 
-  src = fetchFromGitHub rec {
+  src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "libtorrent";
-    rev = "${version}";
-    sha256 = "1rvrxgb131snv9r6ksgzmd74rd9z7q46bhky0zazz7dwqqywffcp";
+    rev = "c167c5a9e0bcf0df23ae5efd91396aae0e37eb87";
+    sha256 = "0y9759sxx5dyamyw8w58dsxq7bmnn57q7s2f4cw2zln2pp5gripw";
   };
 
   buildInputs = [ pkgconfig libtool autoconf automake cppunit openssl libsigcxx zlib ];
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   preConfigure = "./autogen.sh";
 
   meta = with stdenv.lib; {
-    homepage = http://www.libtorrent.org/;
+    homepage = "http://rtorrent.net/downloads/";
     description = "A BitTorrent library written in C++ for *nix, with focus on high performance and good code";
 
     platforms = platforms.linux;
diff --git a/pkgs/tools/networking/p2p/rtorrent/default.nix b/pkgs/tools/networking/p2p/rtorrent/default.nix
index 2883043f8b76..bd3c28504800 100644
--- a/pkgs/tools/networking/p2p/rtorrent/default.nix
+++ b/pkgs/tools/networking/p2p/rtorrent/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   name = "rtorrent-${version}";
-  version = "0.9.6";
+  version = "20161023";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "rtorrent";
-    rev = "${version}";
-    sha256 = "0iyxmjr1984vs7hrnxkfwgrgckacqml0kv4bhj185w9bhjqvgfnf";
+    rev = "226e670decf92e7adaa845a6982aca4f164ea740";
+    sha256 = "0cxyakc09bn6wjfj42gh508hc62awx825skzacpizx2bqs6v7xvb";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix
index 7080cda57f41..87686cd52c12 100644
--- a/pkgs/tools/security/gnupg/22.nix
+++ b/pkgs/tools/security/gnupg/22.nix
@@ -15,11 +15,11 @@ assert guiSupport -> pinentry != null;
 stdenv.mkDerivation rec {
   name = "gnupg-${version}";
 
-  version = "2.2.0";
+  version = "2.2.1";
 
   src = fetchurl {
     url = "mirror://gnupg/gnupg/${name}.tar.bz2";
-    sha256 = "1rj538kp3wsdq7rhl8sy1wpwhlsbxcch0cwk64kgz8gpw05lllfl";
+    sha256 = "1yv2pwf3vhv9dpbf51fnm0wy03va1cg5r7qaz7rg75cwbgb0rmrl";
   };
 
   buildInputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f31f7b644375..ddf72018c135 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -820,6 +820,7 @@ with pkgs;
   });
 
   caddy = callPackage ../servers/caddy { };
+  traefik = callPackage ../servers/traefik { };
 
   capstone = callPackage ../development/libraries/capstone { };
 
@@ -1501,6 +1502,8 @@ with pkgs;
 
   clex = callPackage ../tools/misc/clex { };
 
+  client-ip-echo = callPackage ../servers/misc/client-ip-echo { };
+
   cloc = callPackage ../tools/misc/cloc {
     inherit (perlPackages) perl AlgorithmDiff RegexpCommon;
   };
@@ -1838,7 +1841,7 @@ with pkgs;
   evemu = callPackage ../tools/system/evemu { };
 
   # The latest version used by elasticsearch, logstash, kibana and the the beats from elastic.
-  elk5Version = "5.5.2";
+  elk5Version = "5.6.1";
 
   elasticsearch = callPackage ../servers/search/elasticsearch { };
   elasticsearch2 = callPackage ../servers/search/elasticsearch/2.x.nix { };
@@ -2013,6 +2016,8 @@ with pkgs;
 
   fdk_aac = callPackage ../development/libraries/fdk-aac { };
 
+  fim = callPackage ../tools/graphics/fim { };
+
   flac123 = callPackage ../applications/audio/flac123 { };
 
   flamegraph = callPackage ../development/tools/flamegraph { };
@@ -4552,6 +4557,8 @@ with pkgs;
 
   textadept = callPackage ../applications/editors/textadept { };
 
+  texworks = callPackage ../applications/editors/texworks { };
+
   thc-hydra = callPackage ../tools/security/thc-hydra { };
 
   thefuck = callPackage ../tools/misc/thefuck { };
@@ -5341,10 +5348,7 @@ with pkgs;
 
   cmucl_binary = callPackage_i686 ../development/compilers/cmucl/binary.nix { };
 
-  compcert = callPackage ../development/compilers/compcert {
-    # Pin the version of coq used in compcert to 8.6 until the next release
-    coq = callPackage ../applications/science/logic/coq { version = "8.6"; };
-  };
+  compcert = callPackage ../development/compilers/compcert { };
 
 
   # Users installing via `nix-env` will likely be using the REPL,
@@ -9723,6 +9727,8 @@ with pkgs;
 
   mpeg2dec = libmpeg2;
 
+  mqtt-bench = callPackage ../applications/misc/mqtt-bench {};
+
   msilbc = callPackage ../development/libraries/msilbc { };
 
   mp4v2 = callPackage ../development/libraries/mp4v2 { };
@@ -9761,6 +9767,8 @@ with pkgs;
 
   ndpi = callPackage ../development/libraries/ndpi { };
 
+  nifticlib = callPackage ../development/libraries/science/biology/nifticlib { };
+
   notify-sharp = callPackage ../development/libraries/notify-sharp { };
 
   ncurses5 = callPackage ../development/libraries/ncurses { abiVersion = "5"; };
@@ -14603,7 +14611,12 @@ with pkgs;
     libart = pkgs.gnome2.libart_lgpl;
   };
 
-  jetbrains = recurseIntoAttrs (callPackages ../applications/editors/jetbrains { androidsdk = androidsdk_extras; });
+  jetbrains = (recurseIntoAttrs (callPackages ../applications/editors/jetbrains {
+    jdk = jetbrains.jdk;
+    androidsdk = androidsdk_extras;
+  }) // {
+    jdk = callPackage ../development/compilers/jetbrains-jdk {  };
+  });
 
   libquvi = callPackage ../applications/video/quvi/library.nix { };
 
@@ -17195,7 +17208,9 @@ with pkgs;
 
   zed = callPackage ../applications/editors/zed { };
 
-  zeroc_ice = callPackage ../development/libraries/zeroc-ice { };
+  zeroc_ice = callPackage ../development/libraries/zeroc-ice {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   zexy = callPackage ../applications/audio/pd-plugins/zexy  { };
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index cccb378068d8..4af5a810fd06 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -172,7 +172,10 @@ let
       lwt = ocaml_lwt;
     };
 
-    csv = callPackage ../development/ocaml-modules/csv { };
+    csv =
+      if lib.versionAtLeast ocaml.version "4.2"
+      then callPackage ../development/ocaml-modules/csv { }
+      else callPackage ../development/ocaml-modules/csv/1.5.nix { };
 
     curses = callPackage ../development/ocaml-modules/curses { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d653fce55e3c..2cba7966bb0e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -5713,10 +5713,10 @@ let self = _self // overrides; _self = with self; {
   };
 
   FileSlurper = buildPerlPackage rec {
-    name = "File-Slurper-0.009";
+    name = "File-Slurper-0.010";
     src = fetchurl {
       url = "mirror://cpan/authors/id/L/LE/LEONT/${name}.tar.gz";
-      sha256 = "3eab340deff6ba5456e7d1156b9cfcc387e1243acfc156ff92b75b3f2e120b91";
+      sha256 = "a393364648c9d6be938e8a68c3094c5f8a37b19d3159141ec81ba49559343c16";
     };
     buildInputs = [ TestWarnings ];
     meta = {
@@ -11874,11 +11874,11 @@ let self = _self // overrides; _self = with self; {
     };
   };
 
-  ScopeUpper = buildPerlPackage {
-    name = "Scope-Upper-0.24";
+  ScopeUpper = buildPerlPackage rec {
+    name = "Scope-Upper-0.29";
     src = fetchurl {
-      url = mirror://cpan/authors/id/V/VP/VPIT/Scope-Upper-0.24.tar.gz;
-      sha256 = "159jcwliyb7j80858pi052hkmhgy4cdbjha419kmhhqc9s1rhd5g";
+      url = "mirror://cpan/authors/id/V/VP/VPIT/${name}.tar.gz";
+      sha256 = "4b07360a243ce0ccaacfdfa98ae38ef2686aa908fcf4ef3d669105ac36759e0a";
     };
     meta = {
       homepage = http://search.cpan.org/dist/Scope-Upper/;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fbce3d6e3b87..22b46e06dbd4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7748,7 +7748,9 @@ in {
     };
     doCheck = false;
     propagatedBuildInputs = with self; [ requests ];
+    buildInputs = with pkgs; [ file ];
     prePatch = ''
+      sed -i -e "s|'file|'${pkgs.file}/bin/file|" py3status/parse_config.py
       sed -i -e "s|\[\"acpi\"|\[\"${pkgs.acpi}/bin/acpi\"|" py3status/modules/battery_level.py
       sed -i -e "s|notify-send|${pkgs.libnotify}/bin/notify-send|" py3status/modules/battery_level.py
       sed -i -e "s|/usr/bin/whoami|${pkgs.coreutils}/bin/whoami|" py3status/modules/external_script.py
@@ -9003,6 +9005,8 @@ in {
 
   flake8-debugger = callPackage ../development/python-modules/flake8-debugger { };
 
+  flake8-future-import = callPackage ../development/python-modules/flake8-future-import { };
+
   flaky = buildPythonPackage rec {
     name = "flaky-${version}";
     version = "3.1.0";
@@ -25288,27 +25292,7 @@ EOF
     };
   };
 
-  pafy = buildPythonPackage rec {
-    name = "pafy-${version}";
-    version = "0.5.2";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pafy/${name}.tar.gz";
-      sha256 = "1ckvrypyvb7jbqlgwdz0y337ajagjv7dgxyns326nqwypn1wpq0i";
-    };
-
-    # No tests included in archive
-    doCheck = false;
-
-    propagatedBuildInputs = with self; [ youtube-dl ];
-
-    meta = with stdenv.lib; {
-      description = "A library to download YouTube content and retrieve metadata";
-      homepage = http://np1.github.io/pafy/;
-      license = licenses.lgpl3Plus;
-      maintainers = with maintainers; [ odi ];
-    };
-  };
+  pafy = callPackage ../development/python-modules/pafy { };
 
   suds = buildPythonPackage rec {
     name = "suds-0.4";