diff --git a/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh b/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh
index 6bf9a65b35af..84e40cd0514f 100644
--- a/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh
+++ b/pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh
@@ -4,7 +4,8 @@ updateSourceDateEpoch() {
     # Get the last modification time of all regular files, sort them,
     # and get the most recent. Maybe we should use
     # https://github.com/0-wiz-0/findnewest here.
-    local -a res=($(find "$path" -type f -not -newer "$NIX_BUILD_TOP/.." -printf '%T@ %p\0' | sort -n --zero-terminated | tail -n1 --zero-terminated))
+    local -a res=($(find "$path" -type f -not -newer "$NIX_BUILD_TOP/.." -printf '%T@ %p\0' \
+                    | sort -n --zero-terminated | tail -n1 --zero-terminated | head -c -1))
     local time="${res[0]//\.[0-9]*/}" # remove the fraction part
     local newestFile="${res[1]}"
 
diff --git a/pkgs/development/compilers/gcc/5/default.nix b/pkgs/development/compilers/gcc/5/default.nix
index c3e14d9328e4..d1c76b6097ea 100644
--- a/pkgs/development/compilers/gcc/5/default.nix
+++ b/pkgs/development/compilers/gcc/5/default.nix
@@ -221,8 +221,7 @@ stdenv.mkDerivation ({
     inherit sha256;
   };
 
-  # FIXME stackprotector needs gcc 4.9 in bootstrap tools
-  hardeningDisable = [ "stackprotector" "format" ];
+  hardeningDisable = [ "format" ];
 
   inherit patches;
 
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 5f0d8d0655c2..4ac827db7cb6 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -29,7 +29,7 @@ with stdenv.lib;
 
 let
   majorVersion = "2.7";
-  minorVersion = "13";
+  minorVersion = "14";
   minorVersionSuffix = "";
   pythonVersion = majorVersion;
   version = "${majorVersion}.${minorVersion}${minorVersionSuffix}";
@@ -38,7 +38,7 @@ let
 
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${majorVersion}.${minorVersion}/Python-${version}.tar.xz";
-    sha256 = "0cgpk3zk0fgpji59pb4zy9nzljr70qzgv1vpz5hq5xw2d2c47m9m";
+    sha256 = "0rka541ys16jwzcnnvjp2v12m4cwgd2jp6wj4kj511p715pb5zvi";
   };
 
   hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);
@@ -67,8 +67,6 @@ let
       # libuuid, slowing down program startup a lot).
       ./no-ldconfig.patch
 
-      ./glibc-2.25-enosys.patch
-
     ] ++ optionals hostPlatform.isCygwin [
       ./2.5.2-ctypes-util-find_library.patch
       ./2.5.2-tkinter-x11.patch
@@ -165,7 +163,8 @@ in stdenv.mkDerivation {
         # functionality to 2.x from 3.x
         for item in $out/lib/python${majorVersion}/test/*; do
           if [[ "$item" != */test_support.py*
-             && "$item" != */regrtest.py* ]]; then
+             && "$item" != */test/support
+             && "$item" != */test/regrtest.py* ]]; then
             rm -rf "$item"
           else
             echo $item
diff --git a/pkgs/development/interpreters/python/cpython/2.7/glibc-2.25-enosys.patch b/pkgs/development/interpreters/python/cpython/2.7/glibc-2.25-enosys.patch
deleted file mode 100644
index 31da78e35f1c..000000000000
--- a/pkgs/development/interpreters/python/cpython/2.7/glibc-2.25-enosys.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-https://bugs.python.org/issue29157
-https://github.com/python/cpython/commit/01bdbad3e951
-diff --git a/Python/random.c b/Python/random.c
-index 2f83b5d..0b775ec 100644
---- a/Python/random.c
-+++ b/Python/random.c
-@@ -98,7 +98,7 @@ win32_urandom(unsigned char *buffer, Py_ssize_t size, int raise)
- 
- /* Issue #25003: Don't use getentropy() on Solaris (available since
-  * Solaris 11.3), it is blocking whereas os.urandom() should not block. */
--#elif defined(HAVE_GETENTROPY) && !defined(sun)
-+#elif defined(HAVE_GETENTROPY) && !defined(sun) && !defined(linux)
- #define PY_GETENTROPY 1
- 
- /* Fill buffer with size pseudo-random bytes generated by getentropy().
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index 86d9bd649881..c6313dec90ce 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -25,6 +25,17 @@ stdenv.mkDerivation rec {
   '';
   configureFlags = [ "--enable-libgdbm-compat" ];
 
+  postInstall = ''
+    # create symlinks for compatibility
+    install -dm755 $out/include/gdbm
+    (
+      cd $out/include/gdbm
+      ln -s ../gdbm.h gdbm.h
+      ln -s ../ndbm.h ndbm.h
+      ln -s ../dbm.h  dbm.h
+    )
+  '';
+
   meta = with lib; {
     description = "GNU dbm key/value database library";
 
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index ee74836df81d..a35d2380eded 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -12,8 +12,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "man" "doc" "info" ];
 
-  # FIXME stackprotector needs gcc 4.9 in bootstrap tools
-  hardeningDisable = [ "format" "stackprotector" ];
+  hardeningDisable = [ "format" ];
 
   LDFLAGS = if stdenv.isSunOS then "-lm -lmd -lmp -luutil -lnvpair -lnsl -lidmap -lavl -lsec" else "";
 
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 370572956726..28b6faa436aa 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -10,22 +10,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "libxml2-${version}";
-  version = "2.9.4";
+  version = "2.9.5";
 
   src = fetchurl {
     url = "http://xmlsoft.org/sources/${name}.tar.gz";
-    sha256 = "0g336cr0bw6dax1q48bblphmchgihx9p1pjmxdnrd6sh3qci3fgz";
+    sha256 = "0f6d5nkvcfx8yqis2dwrnv6qaj0nhiifz49y657vmrwwxvnc2ca0";
   };
 
-  patches = [
-    (fetchpatch {
-      # Contains fixes for CVE-2016-{4658,5131} and other bugs.
-      name = "misc.patch";
-      url = "https://git.gnome.org/browse/libxml2/patch/?id=e905f081&id2=v2.9.4";
-      sha256 = "14rnzilspmh92bcpwbd6kqikj36gx78al42ilgpqgl1609krb5m5";
-    })
-  ];
-
   outputs = [ "bin" "dev" "out" "man" "doc" ]
     ++ lib.optional pythonSupport "py";
   propagatedBuildOutputs = "out bin" + lib.optionalString pythonSupport " py";
diff --git a/pkgs/development/libraries/p11-kit/default.nix b/pkgs/development/libraries/p11-kit/default.nix
index 7a7a6d9d23f1..34182cd5a847 100644
--- a/pkgs/development/libraries/p11-kit/default.nix
+++ b/pkgs/development/libraries/p11-kit/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, autoreconfHook, which, pkgconfig, libiconv
-, libffi, libtasn1, gtk_doc, libxslt, docbook_xsl }:
+, libffi, libtasn1 }:
 
 stdenv.mkDerivation rec {
   name = "p11-kit-${version}";
@@ -12,10 +12,10 @@ stdenv.mkDerivation rec {
     sha256 = "1l8sg0g74k2mk0y6vz19hc103dzizxa0h579gdhvxifckglb01hy";
   };
 
-  outputs = [ "out" "dev" "devdoc" ];
+  outputs = [ "out" "dev"];
   outputBin = "dev";
 
-  nativeBuildInputs = [ autoreconfHook which pkgconfig gtk_doc libxslt docbook_xsl ];
+  nativeBuildInputs = [ autoreconfHook which pkgconfig ];
   buildInputs = [ libffi libtasn1 libiconv ];
 
   autoreconfPhase = ''
@@ -26,7 +26,6 @@ stdenv.mkDerivation rec {
     "--sysconfdir=/etc"
     "--localstatedir=/var"
     "--without-trust-paths"
-    "--enable-doc"
   ];
 
   installFlags = [ "exampledir=\${out}/etc/pkcs11" ];
diff --git a/pkgs/development/python-modules/subprocess32/default.nix b/pkgs/development/python-modules/subprocess32/default.nix
new file mode 100644
index 000000000000..cb7a6fe2e868
--- /dev/null
+++ b/pkgs/development/python-modules/subprocess32/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, isPy3k
+, isPyPy
+, bash
+, python
+}:
+
+buildPythonPackage rec {
+  pname = "subprocess32";
+  version = "3.2.7";
+  name = "${pname}-${version}";
+  disabled = isPy3k;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1e450a4a4c53bf197ad6402c564b9f7a53539385918ef8f12bdf430a61036590";
+  };
+
+  buildInputs = [ bash ];
+
+  preConfigure = ''
+    substituteInPlace test_subprocess32.py \
+      --replace '/usr/' '${bash}/'
+  '';
+
+  doCheck = !isPyPy;
+  checkPhase = ''
+    ${python.interpreter} test_subprocess32.py
+  '';
+
+  meta = {
+    homepage = https://pypi.python.org/pypi/subprocess32;
+    description = "Backport of the subprocess module from Python 3.2.5 for use on 2.x";
+    maintainers = with lib.maintainers; [ garbas ];
+  };
+}
\ No newline at end of file
diff --git a/pkgs/development/tools/misc/texinfo/6.3.nix b/pkgs/development/tools/misc/texinfo/6.5.nix
similarity index 94%
rename from pkgs/development/tools/misc/texinfo/6.3.nix
rename to pkgs/development/tools/misc/texinfo/6.5.nix
index c6d3a6f66773..4691df6917b4 100644
--- a/pkgs/development/tools/misc/texinfo/6.3.nix
+++ b/pkgs/development/tools/misc/texinfo/6.5.nix
@@ -3,11 +3,11 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "texinfo-6.3";
+  name = "texinfo-6.5";
 
   src = fetchurl {
     url = "mirror://gnu/texinfo/${name}.tar.xz";
-    sha256 = "0fpr9kdjjl6nj2pc50k2zr7134hvqz8bi8pfqa7131a9lpzz6v14";
+    sha256 = "0qjzvbvnv9003xdrcpi3jp7y68j4hq2ciw9frh2hghh698zlnxvp";
   };
 
   buildInputs = [ perl xz ]
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index e433deff90c6..725c788dd1ac 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -1,5 +1,6 @@
-{ stdenv, fetchurl, openldap
-, enablePython ? false, python ? null
+{
+  stdenv, fetchurl,
+  enablePython ? false, python ? null,
 }:
 
 assert enablePython -> python != null;
@@ -12,25 +13,19 @@ stdenv.mkDerivation rec {
     sha256 = "1vvqw5xgirap0jdmajw7l3pq563aycvy3hlqvj3k2cac8i4jbqlq";
   };
 
-  outputs = [ "bin" "dev" "out" "man" "plugins" ];
+  outputs = [ "bin" "dev" "out" "man" ];
 
-  buildInputs = [ openldap ]
-            ++ stdenv.lib.optional enablePython python;
+  buildInputs = stdenv.lib.optional enablePython python;
 
-  configureFlags = ''
-    ${if enablePython then "--with-python" else "--without-python"}
-  '';
+  configureFlags = [
+    # z/OS plugin is not useful on Linux,
+    # and pulls in an extra openldap dependency otherwise
+    "--disable-zos-remote"
+    (if enablePython then "--with-python" else "--without-python")
+  ];
 
   enableParallelBuilding = true;
 
-  postInstall =
-    ''
-      # Move the z/OS plugin to a separate output to prevent an
-      # openldap runtime dependency in audit.bin.
-      mkdir -p $plugins/bin
-      mv $bin/sbin/audispd-zos-remote $plugins/bin/
-    '';
-
   meta = {
     description = "Audit Library";
     homepage = http://people.redhat.com/sgrubb/audit/;
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index c3f4863fe6f5..9a422a96d703 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -76,8 +76,6 @@ stdenv.mkDerivation rec {
   NIX_LDFLAGS = optionalString selinuxSupport "-lsepol";
   FORCE_UNSAFE_CONFIGURE = optionalString hostPlatform.isSunOS "1";
 
-  makeFlags = optionalString hostPlatform.isDarwin "CFLAGS=-D_FORTIFY_SOURCE=0";
-
   # Works around a bug with 8.26:
   # Makefile:3440: *** Recursive variable 'INSTALL' references itself (eventually).  Stop.
   preInstall = optionalString (hostPlatform != buildPlatform) ''
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index a65ccb0541c8..cb462a2cedd2 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.6.5";
+  version = "1.6.6";
 
   src = fetchurl {
     url = "http://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "0khhrj11yhh6a0h578w29yw2j7yzvaqkr4p44jzjapq1549am5z2";
+    sha256 = "145kska9a63yf32y3jg91y5ikcmsb7qvbcm7a8k6fgh96gf18awp";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7ad1b54dd5cb..e753b9d9630d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7518,7 +7518,7 @@ with pkgs;
   texinfo413 = callPackage ../development/tools/misc/texinfo/4.13a.nix { };
   texinfo4 = texinfo413;
   texinfo5 = callPackage ../development/tools/misc/texinfo/5.2.nix { };
-  texinfo6 = callPackage ../development/tools/misc/texinfo/6.3.nix { };
+  texinfo6 = callPackage ../development/tools/misc/texinfo/6.5.nix { };
   texinfo = texinfo6;
   texinfoInteractive = appendToName "interactive" (
     texinfo.override { interactive = true; }
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index ed78f67739e3..2cba7966bb0e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -15675,14 +15675,19 @@ let self = _self // overrides; _self = with self; {
   };
 
   XMLLibXML = buildPerlPackage rec {
-    name = "XML-LibXML-2.0122";
+    name = "XML-LibXML-2.0129";
     src = fetchurl {
       url = "mirror://cpan/authors/id/S/SH/SHLOMIF/${name}.tar.gz";
-      sha256 = "0llgkgifcw7zz7r7f2jiqryi5axymmd3fwzp4aa5gk6j37w66xkn";
+      sha256 = "0rmk6vysfgcn8434wyydd56midgshly37wx7c50ch038l2djd82w";
     };
     SKIP_SAX_INSTALL = 1;
     buildInputs = [ pkgs.libxml2 ];
     propagatedBuildInputs = [ XMLSAX ];
+
+    # https://rt.cpan.org/Public/Bug/Display.html?id=122958
+    preCheck = ''
+      rm t/32xpc_variables.t t/48_reader_undef_warning_on_empty_str_rt106830.t
+    '';
   };
 
   XMLLibXMLSimple = buildPerlPackage {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3e24dd180c86..7f6793158a1d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -20539,33 +20539,7 @@ in {
     };
   };
 
-  subprocess32 = buildPythonPackage rec {
-    name = "subprocess32-3.2.6";
-    disabled = isPy3k;
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/s/subprocess32/${name}.tar.gz";
-      sha256 = "ddf4d46ed2be2c7e7372dfd00c464cabb6b3e29ca4113d85e26f82b3d2c220f6";
-    };
-
-    buildInputs = [ pkgs.bash ];
-
-    preConfigure = ''
-      substituteInPlace test_subprocess32.py \
-        --replace '/usr/' '${pkgs.bash}/'
-    '';
-
-    doCheck = !isPyPy;
-    checkPhase = ''
-      ${python.interpreter} test_subprocess32.py
-    '';
-
-    meta = {
-      homepage = https://pypi.python.org/pypi/subprocess32;
-      description = "Backport of the subprocess module from Python 3.2.5 for use on 2.x";
-      maintainers = with maintainers; [ garbas ];
-    };
-  };
+  subprocess32 = callPackage ../development/python-modules/subprocess32 { };
 
   spark_parser = buildPythonPackage (rec {
     name = "${pname}-${version}";