Merge remote-tracking branch 'upstream/master' into HEAD

92 files changed, 716 insertions, 325 deletions

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 268f2c032ad..d77f064ed55 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -13,8 +13,11 @@ pkgs/development/interpreters/python/*	@FRidh
 pkgs/development/python-modules/*	@FRidh
 doc/languages-frameworks/python.md	@FRidh
 
-# Darwin-related
-pkgs/stdenv/darwin/*    @copumpkin @LnL7
-pkgs/os-specific/darwin/*   @LnL7
-pkgs/os-specific/darwin/apple-source-releases/* @copumpkin
+# Boostraping and core infra
+pkgs/stdenv/	@Ericson2314
+pkgs/build-support/cc-wrapper/	@Ericson2314
 
+# Darwin-related
+pkgs/stdenv/darwin/*	@copumpkin @LnL7
+pkgs/os-specific/darwin/*	@LnL7
+pkgs/os-specific/darwin/apple-source-releases/*	@copumpkin
diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index 31760c94eb0..e5286fa995e 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -136,6 +136,7 @@
   dbrock = "Daniel Brockman <daniel@brockman.se>";
   deepfire = "Kosyrev Serge <_deepfire@feelingofgreen.ru>";
   demin-dmitriy = "Dmitriy Demin <demindf@gmail.com>";
+  derchris = "Christian Gerbrandt <derchris@me.com>";
   DerGuteMoritz = "Moritz Heidkamp <moritz@twoticketsplease.de>";
   dermetfan = "Robin Stumm <serverkorken@gmail.com>";
   DerTim1 = "Tim Digel <tim.digel@active-group.de>";
diff --git a/nixos/modules/config/networking.nix b/nixos/modules/config/networking.nix
index b3639037914..619f36cd515 100644
--- a/nixos/modules/config/networking.nix
+++ b/nixos/modules/config/networking.nix
@@ -20,15 +20,6 @@ in
 
   options = {
 
-    networking.fqdn = lib.mkOption {
-      type = types.nullOr types.str;
-      default = null;
-      example = "foo.example.com";
-      description = ''
-        Fully qualified domain name, if any.
-      '';
-    };
-
     networking.hosts = lib.mkOption {
       type = types.attrsOf ( types.listOf types.str );
       default = {};
@@ -220,12 +211,11 @@ in
                 ( builtins.hasAttr "::1" cfg.hosts )
                 ( concatStringsSep " " ( remove "localhost" cfg.hosts."::1" ));
               otherHosts = allToString ( removeAttrs cfg.hosts [ "127.0.0.1" "::1" ]);
-              maybeFQDN = optionalString ( cfg.fqdn != null ) cfg.fqdn;
           in
           ''
-            127.0.0.1 ${maybeFQDN} ${userLocalHosts} localhost
+            127.0.0.1 ${userLocalHosts} localhost
             ${optionalString cfg.enableIPv6 ''
-              ::1 ${maybeFQDN} ${userLocalHosts6} localhost
+              ::1 ${userLocalHosts6} localhost
             ''}
             ${otherHosts}
             ${cfg.extraHosts}
diff --git a/nixos/modules/config/timezone.nix b/nixos/modules/config/timezone.nix
index 39a45042c6c..aa030a816d0 100644
--- a/nixos/modules/config/timezone.nix
+++ b/nixos/modules/config/timezone.nix
@@ -14,13 +14,16 @@ in
     time = {
 
       timeZone = mkOption {
-        default = "UTC";
-        type = types.str;
+        default = null;
+        type = types.nullOr types.str;
         example = "America/New_York";
         description = ''
           The time zone used when displaying times and dates. See <link
           xlink:href="https://en.wikipedia.org/wiki/List_of_tz_database_time_zones"/>
           for a comprehensive list of possible values for this setting.
+
+          If null, the timezone will default to UTC and can be set imperatively
+          using timedatectl.
         '';
       };
 
@@ -40,13 +43,14 @@ in
     # This way services are restarted when tzdata changes.
     systemd.globalEnvironment.TZDIR = tzdir;
 
-    environment.etc.localtime =
-      { source = "/etc/zoneinfo/${config.time.timeZone}";
-        mode = "direct-symlink";
-      };
-
-    environment.etc.zoneinfo.source = tzdir;
+    systemd.services.systemd-timedated.environment = lib.optionalAttrs (config.time.timeZone != null) { NIXOS_STATIC_TIMEZONE = "1"; };
 
+    environment.etc = {
+      zoneinfo.source = tzdir;
+    } // lib.optionalAttrs (config.time.timeZone != null) {
+        localtime.source = "/etc/zoneinfo/${config.time.timeZone}";
+        localtime.mode = "direct-symlink";
+      };
   };
 
 }
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index c22a552645a..94db0ac0eea 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -76,7 +76,7 @@ let
   // optionalAttrs (cfg.relayDomains != null) { relay_domains = cfg.relayDomains; }
   // optionalAttrs (cfg.recipientDelimiter != "") { recipient_delimiter = cfg.recipientDelimiter; }
   // optionalAttrs haveAliases { alias_maps = "${cfg.aliasMapType}:/etc/postfix/aliases"; }
-  // optionalAttrs haveTransport { transport_maps = "hash:/etc/postfx/transport"; }
+  // optionalAttrs haveTransport { transport_maps = "hash:/etc/postfix/transport"; }
   // optionalAttrs haveVirtual { virtual_alias_maps = "${cfg.virtualMapType}:/etc/postfix/virtual"; }
   // optionalAttrs (cfg.dnsBlacklists != []) { smtpd_client_restrictions = clientRestrictions; }
   // optionalAttrs cfg.enableHeaderChecks { header_checks = "regexp:/etc/postfix/header_checks"; }
diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix
index e0eef9ed96f..c7a128ae212 100644
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@@ -33,8 +33,8 @@ in
 
       package = mkOption {
         type = types.package;
-        default = pkgs.pythonPackages.searx;
-        defaultText = "pkgs.pythonPackages.searx";
+        default = pkgs.searx;
+        defaultText = "pkgs.searx";
         description = "searx package to use.";
       };
 
diff --git a/nixos/tests/timezone.nix b/nixos/tests/timezone.nix
new file mode 100644
index 00000000000..2204649a3fc
--- /dev/null
+++ b/nixos/tests/timezone.nix
@@ -0,0 +1,45 @@
+{
+  timezone-static = import ./make-test.nix ({ pkgs, ... }: {
+    name = "timezone-static";
+    meta.maintainers = with pkgs.lib.maintainers; [ lheckemann ];
+
+    machine.time.timeZone = "Europe/Amsterdam";
+
+    testScript = ''
+      $machine->waitForUnit("dbus.socket");
+      $machine->fail("timedatectl set-timezone Asia/Tokyo");
+      my @dateResult = $machine->execute('date -d @0 "+%Y-%m-%d %H:%M:%S"');
+      $dateResult[1] eq "1970-01-01 01:00:00\n" or die "Timezone seems to be wrong";
+    '';
+  });
+
+  timezone-imperative = import ./make-test.nix ({ pkgs, ... }: {
+    name = "timezone-imperative";
+    meta.maintainers = with pkgs.lib.maintainers; [ lheckemann ];
+
+    machine.time.timeZone = null;
+
+    testScript = ''
+      $machine->waitForUnit("dbus.socket");
+
+      # Should default to UTC
+      my @dateResult = $machine->execute('date -d @0 "+%Y-%m-%d %H:%M:%S"');
+      print $dateResult[1];
+      $dateResult[1] eq "1970-01-01 00:00:00\n" or die "Timezone seems to be wrong";
+
+      $machine->succeed("timedatectl set-timezone Asia/Tokyo");
+
+      # Adjustment should be taken into account
+      my @dateResult = $machine->execute('date -d @0 "+%Y-%m-%d %H:%M:%S"');
+      print $dateResult[1];
+      $dateResult[1] eq "1970-01-01 09:00:00\n" or die "Timezone was not adjusted";
+
+      # Adjustment should persist across a reboot
+      $machine->shutdown;
+      $machine->waitForUnit("dbus.socket");
+      my @dateResult = $machine->execute('date -d @0 "+%Y-%m-%d %H:%M:%S"');
+      print $dateResult[1];
+      $dateResult[1] eq "1970-01-01 09:00:00\n" or die "Timezone adjustment was not persisted";
+    '';
+  });
+}
diff --git a/pkgs/applications/misc/abook/default.nix b/pkgs/applications/misc/abook/default.nix
index 2c4bc0f2128..4c03b197b4a 100644
--- a/pkgs/applications/misc/abook/default.nix
+++ b/pkgs/applications/misc/abook/default.nix
@@ -1,11 +1,11 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, ncurses, readline }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, ncurses, readline, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "abook-0.6.0pre2";
+  name = "abook-0.6.1";
 
   src = fetchurl {
     url = "http://abook.sourceforge.net/devel/${name}.tar.gz";
-    sha256 = "11fkyq9bqw7s6jf38yglk8bsx0ar2wik0fq0ds0rdp8985849m2r";
+    sha256 = "1yf0ifyjhq2r003pnpn92mn0924bn9yxjifxxj2ldcsgd7w0vagh";
   };
 
   patches = [
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
      })
   ];
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
   buildInputs = [ ncurses readline ];
 
   meta = {
diff --git a/pkgs/applications/misc/alacritty/default.nix b/pkgs/applications/misc/alacritty/default.nix
index e84ee7ee16b..50af18ca1fc 100644
--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@@ -43,10 +43,14 @@ buildRustPackage rec {
   buildInputs = [
     cmake
     makeWrapper
-    xclip
     pkgconfig
   ] ++ rpathLibs;
 
+  patchPhase = ''
+    substituteInPlace copypasta/src/x11.rs \
+      --replace Command::new\(\"xclip\"\) Command::new\(\"${xclip}/bin/xclip\"\)
+  '';
+
   installPhase = ''
     mkdir -p $out/bin
     for f in $(find target/release -maxdepth 1 -type f); do
diff --git a/pkgs/applications/misc/albert/default.nix b/pkgs/applications/misc/albert/default.nix
index 854408e6e3e..dd4858cfe2a 100644
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@@ -1,17 +1,17 @@
-{ mkDerivation, lib, fetchFromGitHub, qtbase, qtsvg, qtx11extras, muparser, cmake }:
+{ mkDerivation, lib, fetchFromGitHub, makeWrapper, qtbase, qtsvg, qtx11extras, muparser, cmake }:
 
 mkDerivation rec {
   name    = "albert-${version}";
-  version = "0.11.3";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner  = "albertlauncher";
     repo   = "albert";
     rev    = "v${version}";
-    sha256 = "0ddz6h1334b9kqy1lfi7qa21znm3l0b9h0d4s62llxdasv103jh5";
+    sha256 = "120l7hli2l4qj2s126nawc4dsy4qvwvb0svc42hijry4l8imdhkq";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake makeWrapper ];
 
   buildInputs = [ qtbase qtsvg qtx11extras muparser ];
 
@@ -31,6 +31,11 @@ mkDerivation rec {
     rm "$out/lib"
   '';
 
+  postInstall = ''
+    wrapProgram $out/bin/albert \
+      --prefix XDG_DATA_DIRS : $out/share
+  '';
+
   meta = with lib; {
     homepage    = https://albertlauncher.github.io/;
     description = "Desktop agnostic launcher";
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 34f403fda89..4aaa5f1ff67 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -2,11 +2,11 @@
 
 python2Packages.buildPythonApplication rec {
   name = "electrum-${version}";
-  version = "2.8.3";
+  version = "2.9.0";
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "04jswalydzwm16iismbq1h2shj17iq9sqm0mz8p98sh3dwkacvn1";
+    sha256 = "1lida5phq0c1lxnk75d9jsps0vw4zy7saaxhv0q4kv76rk2b3fhv";
   };
 
   propagatedBuildInputs = with python2Packages; [
diff --git a/pkgs/applications/misc/ephemeralpg/default.nix b/pkgs/applications/misc/ephemeralpg/default.nix
index 104192f7e61..65df422599c 100644
--- a/pkgs/applications/misc/ephemeralpg/default.nix
+++ b/pkgs/applications/misc/ephemeralpg/default.nix
@@ -12,4 +12,9 @@ stdenv.mkDerivation rec {
     PREFIX=$out make install
     wrapProgram $out/bin/pg_tmp --prefix PATH : ${postgresql}/bin
   '';
+  meta = {
+    description = ''Run tests on an isolated, temporary PostgreSQL database.'';
+    license = stdenv.lib.licenses.isc;
+    homepage = http://ephemeralpg.org/;
+  };
 }
diff --git a/pkgs/applications/misc/moonlight-embedded/default.nix b/pkgs/applications/misc/moonlight-embedded/default.nix
index 391440f8622..894751571ec 100644
--- a/pkgs/applications/misc/moonlight-embedded/default.nix
+++ b/pkgs/applications/misc/moonlight-embedded/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "moonlight-embedded-${version}";
-  version = "2.2.3";
+  version = "2.4.2";
 
   # fetchgit used to ensure submodules are available
   src = fetchgit {
     url = "git://github.com/irtimmer/moonlight-embedded";
     rev = "refs/tags/v${version}";
-    sha256 = "0m1114dsz44rvq402b4v5ib2cwj2vbasir0l8vi0q5iymwmsvxj4";
+    sha256 = "0khdbwfclvpjgyk5ar1fs4j66zsjikaj422wlvrvqhyzi1v5arpr";
   };
 
   outputs = [ "out" "doc" ];
diff --git a/pkgs/applications/misc/qdirstat/default.nix b/pkgs/applications/misc/qdirstat/default.nix
index be252ed81ef..cbbac11424e 100644
--- a/pkgs/applications/misc/qdirstat/default.nix
+++ b/pkgs/applications/misc/qdirstat/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchFromGitHub, qmake
-, coreutils, xdg_utils, bash, perl }:
+, coreutils, xdg_utils, bash
+, perl, makeWrapper, perlPackages }:
 
 let
   version = "1.4";
@@ -13,7 +14,7 @@ in stdenv.mkDerivation rec {
     sha256 = "1ppasbr0mq301q6n3rm0bsmprs7vgkcjmmc0gbgqpgw84nmp9fqh";
   };
 
-  nativeBuildInputs = [ qmake ];
+  nativeBuildInputs = [ qmake makeWrapper ];
 
   buildInputs = [ perl ];
 
@@ -45,6 +46,11 @@ in stdenv.mkDerivation rec {
       --replace /bin/bash ${bash}/bin/bash
   '';
 
+  postInstall = ''
+    wrapProgram $out/bin/qdirstat-cache-writer \
+      --set PERL5LIB "${stdenv.lib.makePerlPath [ perlPackages.URI ]}"
+  '';
+
   meta = with stdenv.lib; {
     description = "Graphical disk usage analyzer";
     homepage = src.meta.homepage;
diff --git a/pkgs/applications/misc/urh/default.nix b/pkgs/applications/misc/urh/default.nix
index 9015bb9956b..faf373092d5 100644
--- a/pkgs/applications/misc/urh/default.nix
+++ b/pkgs/applications/misc/urh/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "urh-${version}";
-  version = "1.5.5";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "jopohl";
     repo = "urh";
     rev = "v${version}";
-    sha256 = "1f7hz2zs2dx3v6hpdyz7wyyq1xf641jhpljyhvmjr4zg5m035isa";
+    sha256 = "00l1zs3qw89z1hlylprzrpf6nf7h22h0nw43h97gv775vaqqgczv";
   };
 
   buildInputs = [ hackrf rtl-sdr ];
diff --git a/pkgs/applications/misc/xtermcontrol/default.nix b/pkgs/applications/misc/xtermcontrol/default.nix
new file mode 100644
index 00000000000..eae5240129a
--- /dev/null
+++ b/pkgs/applications/misc/xtermcontrol/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  version = "3.3";
+  name = "xtermcontrol-${version}";
+
+  src = fetchurl {
+    url = "http://thrysoee.dk/xtermcontrol/xtermcontrol-${version}.tar.gz";
+    sha256 = "1v2c1cnx43apmspga7icssh5ndbhzy5h82y6vm8fda40flq9mxj5";
+  };
+
+  meta = {
+    description = "Enables dynamic control of xterm properties";
+    longDescription = ''
+      Enables dynamic control of xterm properties.
+      It makes it easy to change colors, title, font and geometry of a running xterm, as well as to report the current settings of these properties.
+      Window manipulations de-/iconify, raise/lower, maximize/restore and reset are also supported.
+      To complete the feature set; xtermcontrol lets advanced users issue any xterm control sequence of their choosing.
+    '';
+    homepage = http://thrysoee.dk/xtermcontrol;
+    license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.unix;
+    maintainers = [ stdenv.lib.maintainers.derchris ];
+  };
+}
diff --git a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
index 5bcf47a4905..423be7c33e7 100644
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -84,7 +84,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "7.0.2";
+  version = "7.0.3";
 
   lang = "en-US";
 
@@ -94,7 +94,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "0xdw8mvyxz9vaxikzsj4ygzp36m4jfhvhqfiyaiiywpf39rqpkqr";
+      sha256 = "1p91szx60xx3295bpap9w2ydgaibj0yn9lbdyhajal35bbhjxqhc";
     };
 
     "i686-linux" = fetchurl {
@@ -102,7 +102,7 @@ let
         "https://github.com/TheTorProject/gettorbrowser/releases/download/v${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "0m522i8zih5sj18dyzk9im7gmpmrbf96657v38m3pxn4ci38b83z";
+      sha256 = "0p51dxiq3qxyc5n7xvh1hq039pvp7z730f6dks4h5p3sfqw6isfp";
     };
   };
 in
diff --git a/pkgs/applications/networking/mailreaders/alpine/default.nix b/pkgs/applications/networking/mailreaders/alpine/default.nix
index 22859a4c25d..df930b93173 100644
--- a/pkgs/applications/networking/mailreaders/alpine/default.nix
+++ b/pkgs/applications/networking/mailreaders/alpine/default.nix
@@ -3,34 +3,26 @@
 }:
 
 # NOTE: Please check if any changes here are applicable to ../realpine/ as well
-let
-  version = "2.00";
-  baseName = "alpine";
-in
-stdenv.mkDerivation {
-  name = "${baseName}-${version}";
+stdenv.mkDerivation rec {
+  name = "alpine-${version}";
+  version = "2.21";
 
   src = fetchurl {
-    url = "ftp://ftp.cac.washington.edu/alpine/alpine-${version}.tar.bz2";
-    sha256 = "19m2w21dqn55rhxbh5lr9qarc2fqa9wmpj204jx7a0zrb90bhpf8";
+    url = "http://alpine.freeiz.com/alpine/release/src/${name}.tar.xz";
+    sha256 = "0f3llxrmaxw7w9w6aixh752md3cdc91mwfmbarkm8s413f4bcc30";
   };
 
   buildInputs = [
     ncurses tcl openssl pam kerberos openldap
   ];
 
-  hardeningDisable = [ "format" "fortify" ];
+  hardeningDisable = [ "format" ];
 
   configureFlags = [
     "--with-ssl-include-dir=${openssl.dev}/include/openssl"
-    "--with-tcl-lib=${tcl.libPrefix}"
     "--with-passfile=.pine-passfile"
   ];
 
-  preConfigure = ''
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lgcc_s"
-  '';
-
   meta = {
     description = "Console mail reader";
     license = stdenv.lib.licenses.asl20;
diff --git a/pkgs/applications/networking/vnstat/default.nix b/pkgs/applications/networking/vnstat/default.nix
index 1c78f926fe7..c3424e2fc77 100644
--- a/pkgs/applications/networking/vnstat/default.nix
+++ b/pkgs/applications/networking/vnstat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "vnstat-${version}";
-  version = "1.15";
+  version = "1.17";
 
   src = fetchurl {
-    sha256 = "0fdw3nbrfm4acv48r0934ls6ld5lwkff3gyym2c72qlbm9dlp0f3";
+    sha256 = "0wbrmb4zapblb3b61180ryqy6i0c7gcacqz0y3r1x7nafqswbr0q";
     url = "http://humdi.net/vnstat/${name}.tar.gz";
   };
 
diff --git a/pkgs/applications/science/math/calc/default.nix b/pkgs/applications/science/math/calc/default.nix
index b8ed7ffac3c..ff8a1ff9584 100644
--- a/pkgs/applications/science/math/calc/default.nix
+++ b/pkgs/applications/science/math/calc/default.nix
@@ -12,11 +12,11 @@ in
 stdenv.mkDerivation rec {
 
   name = "calc-${version}";
-  version = "2.12.5.3";
+  version = "2.12.6.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/calc/${name}.tar.bz2";
-    sha256 = "14mnz6smhi3a0rgmwvddk9w3vdisi8khq67i8nqsl47vgs8n1kqg";
+    url = "https://github.com/lcn2/calc/releases/download/${version}/${name}.tar.bz2";
+    sha256 = "1vy4jmhmpl3gzgpkpv0kqwjv8hn1cza8cn1g8c69gq3inqvr4fvd";
   };
 
   buildInputs = [ makeWrapper readline ncurses utillinux ];
diff --git a/pkgs/applications/science/math/qalculate-gtk/default.nix b/pkgs/applications/science/math/qalculate-gtk/default.nix
index 5f49b240fc0..cd89fbbe187 100644
--- a/pkgs/applications/science/math/qalculate-gtk/default.nix
+++ b/pkgs/applications/science/math/qalculate-gtk/default.nix
@@ -2,13 +2,19 @@
 
 stdenv.mkDerivation rec {
   name = "qalculate-gtk-${version}";
-  version = "0.9.9";
+  version = "1.0.0";
 
   src = fetchurl {
     url = "https://github.com/Qalculate/qalculate-gtk/archive/v${version}.tar.gz";
-    sha256 = "0v9ibycilygmi9zzi7cxif7si56c85lfzdvbqnbf32whg8ydqqkg";
+    sha256 = "08sg6kfcfdpxjsl538ba26ncm2cxzc63nlafj99ff4b46wxia57k";
   };
 
+  patchPhase = ''
+    for fn in src/interface.cc src/main.cc; do
+      substituteInPlace $fn --replace 'getPackageDataDir().c_str()' \"$out/share\"
+    done
+  '';
+
   hardeningDisable = [ "format" ];
 
   nativeBuildInputs = [ intltool pkgconfig autoreconfHook wrapGAppsHook ];
diff --git a/pkgs/applications/version-management/git-and-tools/diff-so-fancy/default.nix b/pkgs/applications/version-management/git-and-tools/diff-so-fancy/default.nix
index b613898faaa..5878f3a8b74 100644
--- a/pkgs/applications/version-management/git-and-tools/diff-so-fancy/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/diff-so-fancy/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "diff-so-fancy-${version}";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "so-fancy";
     repo = "diff-so-fancy";
     rev = "v${version}";
-    sha256 = "0wd9npcfp41ggvddrbif8qr25pm7jlzxzd3xn5rlq0y0frwx5akj";
+    sha256 = "1hgppp8ngjbjzbi96529p36hzi0ysdndrh6d6m71gs21am8v4m9r";
   };
 
   # Perl is needed here for patchShebangs
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index b6e342cf9b5..160c3f85977 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -437,8 +437,8 @@ rec {
           echo "Unpacking base image..."
           tar -C image -xpf "$fromImage"
           # Do not import the base image configuration and manifest
+          chmod a+w image image/*.json
           rm -f image/*.json
-          rm -f image/manifest.json
 
           if [[ -z "$fromImageName" ]]; then
             fromImageName=$(jshon -k < image/repositories|head -n1)
diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index 5095fce8958..fbf9af36f27 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, writeText, nss, python
+{ stdenv, fetchurl, writeText, nss, python3
 , blacklist ? []
 , includeEmail ? false
 }:
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = nss.src;
 
-  nativeBuildInputs = [ python ];
+  nativeBuildInputs = [ python3 ];
 
   configurePhase = ''
     ln -s nss/lib/ckfw/builtins/certdata.txt
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 43270465775..317312823f9 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -603,6 +603,14 @@ self: super: {
 
   # Fine-tune the build.
   structured-haskell-mode = (overrideCabal super.structured-haskell-mode (drv: {
+    src = pkgs.fetchFromGitHub {
+      owner = "chrisdone";
+      repo = "structured-haskell-mode";
+      rev = "bd08a0b2297667e2ac7896e3b480033ae5721d4d";
+      sha256 = "14rl739z19ns31h9fj48sx9ppca4g4mqkc7ccpacagwwf55m259c";
+    };
+    version = "20170523-git";
+    editedCabalFile = null;
     # Statically linked Haskell libraries make the tool start-up much faster,
     # which is important for use in Emacs.
     enableSharedExecutables = false;
@@ -610,22 +618,22 @@ self: super: {
     # cannot easily byte-compile these files, unfortunately, because they
     # depend on a new version of haskell-mode that we don't have yet.
     postInstall = ''
-      local lispdir=( "$out/share/"*"-${self.ghc.name}/${drv.pname}-"*"/elisp" )
-      mkdir -p $out/share/emacs
-      ln -s $lispdir $out/share/emacs/site-lisp
+      local lispdir=( "$data/share/${self.ghc.name}/"*"/${drv.pname}-"*"/elisp" )
+      mkdir -p $data/share/emacs
+      ln -s $lispdir $data/share/emacs/site-lisp
     '';
   })).override {
     haskell-src-exts = self.haskell-src-exts_1_19_1;
   };
 
-  # # Make elisp files available at a location where people expect it.
+  # Make elisp files available at a location where people expect it.
   hindent = (overrideCabal super.hindent (drv: {
     # We cannot easily byte-compile these files, unfortunately, because they
     # depend on a new version of haskell-mode that we don't have yet.
     postInstall = ''
-      local lispdir=( "$out/share/"*"-${self.ghc.name}/${drv.pname}-${drv.version}/elisp" )
-      mkdir -p $out/share/emacs
-      ln -s $lispdir $out/share/emacs/site-lisp
+      local lispdir=( "$data/share/${self.ghc.name}/"*"/${drv.pname}-"*"/elisp" )
+      mkdir -p $data/share/emacs
+      ln -s $lispdir $data/share/emacs/site-lisp
     '';
     doCheck = false; # https://github.com/chrisdone/hindent/issues/299
   })).override {
diff --git a/pkgs/development/libraries/afflib/default.nix b/pkgs/development/libraries/afflib/default.nix
index 8b7dddf0e15..7c697d3e60c 100644
--- a/pkgs/development/libraries/afflib/default.nix
+++ b/pkgs/development/libraries/afflib/default.nix
@@ -3,19 +3,18 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.7.15";
+  version = "3.7.16";
   name = "afflib-${version}";
 
   src = fetchFromGitHub {
     owner = "sshock";
     repo = "AFFLIBv3";
     rev = "v${version}";
-    sha256 = "0ckg49m15lz5cxg0k12z2ys6v4smjr6l8bbazrvsqlm649gwd2bw";
+    sha256 = "0piwkmg7jn64h57cjf5cybyvyqxj2k752g9vrf4ycds7nhvvbnb6";
   };
 
   buildInputs = [ zlib curl expat fuse openssl autoreconfHook python ];
 
-
   meta = {
     homepage = http://afflib.sourceforge.net/;
     description = "Advanced forensic format library";
diff --git a/pkgs/development/libraries/allegro/5.nix b/pkgs/development/libraries/allegro/5.nix
index 7efccfad243..f1402e4ad9e 100644
--- a/pkgs/development/libraries/allegro/5.nix
+++ b/pkgs/development/libraries/allegro/5.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, texinfo, libXext, xextproto, libX11, xproto
+{ stdenv, fetchFromGitHub, texinfo, libXext, xextproto, libX11, xproto
 , libXpm, libXt, libXcursor, alsaLib, cmake, zlib, libpng, libvorbis
 , libXxf86dga, libXxf86misc, xf86dgaproto, xf86miscproto
 , xf86vidmodeproto, libXxf86vm, openal, mesa, kbproto, libjpeg, flac
@@ -9,11 +9,13 @@
 
 stdenv.mkDerivation rec {
   name = "allegro-${version}";
-  version = "5.2.1.1";
+  version = "5.2.2.0";
 
-  src = fetchurl {
-    url = "http://download.gna.org/allegro/allegro/${version}/${name}.tar.gz";
-    sha256 = "0waalic7lyaf6i33nikmkc29bndci5c5090c4ra2vmy67cqdzndm";
+  src = fetchFromGitHub {
+    owner = "liballeg";
+    repo = "allegro5";
+    rev = version;
+    sha256 = "1sf0dr0ahrzsy6gzzpvys9d7d9w0grayhak4cyymjv7w857hf51m";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/kerberos/heimdal.nix b/pkgs/development/libraries/kerberos/heimdal.nix
index f791f3a8d6e..81f878daaaa 100644
--- a/pkgs/development/libraries/kerberos/heimdal.nix
+++ b/pkgs/development/libraries/kerberos/heimdal.nix
@@ -11,13 +11,14 @@ let
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "${type}heimdal-2015-09-13";
+  name = "${type}heimdal-${version}";
+  version = "7.4.0";
 
   src = fetchFromGitHub {
     owner = "heimdal";
     repo = "heimdal";
-    rev = "c81572ab5dcee3062e715b9e25ca7a20f6ec456b";
-    sha256 = "1r60i4v6y5lpll0l2qpn0ycp6q6f1xjg7k1csi547zls8k96yk9s";
+    rev = "heimdal-${version}";
+    sha256 = "01ch6kqjrxi9fki54yjj2fhxhdkxijz161w2inh5k8mcixlf67vp";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig python2 perl yacc flex ]
diff --git a/pkgs/development/libraries/libite/default.nix b/pkgs/development/libraries/libite/default.nix
index 72b4469058c..479deb7593d 100644
--- a/pkgs/development/libraries/libite/default.nix
+++ b/pkgs/development/libraries/libite/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "libite-${version}";
-  version = "1.8.3";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "troglobit";
     repo = "libite";
     rev = "v${version}";
-    sha256 = "040idgbjqr239rkd68rqzwhylryiaa0z3qkwj2l2mlscv0aq8v0j";
+    sha256 = "1y2iylsgs8am5br7an0xkrgshq6k2zkk8jfsaa7vdw2dh3qvc9pr";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/development/libraries/libqalculate/default.nix b/pkgs/development/libraries/libqalculate/default.nix
index abc0eb4a228..2e748d26689 100644
--- a/pkgs/development/libraries/libqalculate/default.nix
+++ b/pkgs/development/libraries/libqalculate/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libqalculate-${version}";
-  version = "0.9.10";
+  version = "1.0.0a";
 
   src = fetchurl {
     url = "https://github.com/Qalculate/libqalculate/archive/v${version}.tar.gz";
-    sha256 = "0whzc15nwsrib6bpw4lqsm59yr0pfk44hny9sivfbwhidk0177zi";
+    sha256 = "12igmd1rn6zwrsg0mmn5pwy2bqj2gmc08iry0vcdxgzi7jc9x7ix";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/mbedtls/1.3.nix b/pkgs/development/libraries/mbedtls/1.3.nix
index e89fabb9fb3..764d50190b9 100644
--- a/pkgs/development/libraries/mbedtls/1.3.nix
+++ b/pkgs/development/libraries/mbedtls/1.3.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perl }:
 
 stdenv.mkDerivation rec {
-  name = "mbedtls-1.3.19";
+  name = "mbedtls-1.3.20";
 
   src = fetchurl {
     url = "https://tls.mbed.org/download/${name}-gpl.tgz";
-    sha256 = "03mhlh8s2378ph23m1173i7wkhrs5i6d03mk5wa7a1d3qn24jrar";
+    sha256 = "0vv69c1c5rr7jcwwivx06fbfixgig90pjznh2c6cn841hgwm9z00";
   };
 
   nativeBuildInputs = [ perl ];
diff --git a/pkgs/development/libraries/mbedtls/default.nix b/pkgs/development/libraries/mbedtls/default.nix
index c5eab3f74b5..b4500c8f6d6 100644
--- a/pkgs/development/libraries/mbedtls/default.nix
+++ b/pkgs/development/libraries/mbedtls/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perl }:
 
 stdenv.mkDerivation rec {
-  name = "mbedtls-2.4.2";
+  name = "mbedtls-2.5.1";
 
   src = fetchurl {
     url = "https://tls.mbed.org/download/${name}-gpl.tgz";
-    sha256 = "17r9qs585gqghcf5yavb1cnvsigl0f8r0k8rklr5a855hrajs7yh";
+    sha256 = "1qny1amp54vn84wp0aaj8zvblad60zcp73pdwgnykn7h0q004bri";
   };
 
   nativeBuildInputs = [ perl ];
diff --git a/pkgs/development/libraries/openh264/default.nix b/pkgs/development/libraries/openh264/default.nix
index 8232af3e789..0a0b4c8d549 100644
--- a/pkgs/development/libraries/openh264/default.nix
+++ b/pkgs/development/libraries/openh264/default.nix
@@ -1,11 +1,14 @@
-{ stdenv, fetchurl, nasm }:
+{ stdenv, fetchFromGitHub, nasm }:
 
 stdenv.mkDerivation rec {
-  name = "openh264-1.5.0";
+  name = "openh264-${version}";
+  version = "1.7.0";
 
-  src = fetchurl {
-    url = "https://github.com/cisco/openh264/archive/v1.5.0.tar.gz";
-    sha256 = "1d97dh5hzmy46jamfw03flvcz8md1hxp6y5n0b787h8ks7apn1wq";
+  src = fetchFromGitHub {
+    owner = "cisco";
+    repo = "openh264";
+    rev = "v${version}";
+    sha256 = "0ywrqni05bh925ws5fmd24bm6h9n6z2wp1q19v545v06biiwr46a";
   };
 
   buildInputs = [ nasm ];
diff --git a/pkgs/development/libraries/x264/default.nix b/pkgs/development/libraries/x264/default.nix
index bf32969836c..06ed123c735 100644
--- a/pkgs/development/libraries/x264/default.nix
+++ b/pkgs/development/libraries/x264/default.nix
@@ -1,12 +1,12 @@
 {stdenv, fetchurl, yasm, enable10bit ? false}:
 
 stdenv.mkDerivation rec {
-  version = "20160615-2245";
+  version = "20170731-2245";
   name = "x264-${version}";
 
   src = fetchurl {
     url = "http://download.videolan.org/x264/snapshots/x264-snapshot-${version}-stable.tar.bz2";
-    sha256 = "0w5l77gm8bsmafzimzyc5s27kcw79r6nai3bpccqy0spyxhjsdc2";
+    sha256 = "01sgk1ps4qfifdnblwa3fxnd8ah6n6zbmfc1sy09cgqcdgzxgj0z";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/libraries/x265/default.nix b/pkgs/development/libraries/x265/default.nix
index c485cb6a05a..29d7ddf1fdc 100644
--- a/pkgs/development/libraries/x265/default.nix
+++ b/pkgs/development/libraries/x265/default.nix
@@ -16,14 +16,14 @@ in
 
 stdenv.mkDerivation rec {
   name = "x265-${version}";
-  version = "1.9";
+  version = "2.5";
 
   src = fetchurl {
     urls = [
       "http://get.videolan.org/x265/x265_${version}.tar.gz"
       "https://github.com/videolan/x265/archive/${version}.tar.gz"
     ];
-    sha256 = "1j0mbcf10aj6zi1nxql45f9817jd2ndcpd7x123sjmyr7q9m8iiy";
+    sha256 = "05rxbnfcc8yl05q3xqkl1kk90k7zn5ih305r46dxnzjaa2djalrf";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/zziplib/default.nix b/pkgs/development/libraries/zziplib/default.nix
index 20070d8f717..98215aa0c74 100644
--- a/pkgs/development/libraries/zziplib/default.nix
+++ b/pkgs/development/libraries/zziplib/default.nix
@@ -1,11 +1,12 @@
 { fetchurl, stdenv, perl, python2, zip, xmlto, zlib }:
 
 stdenv.mkDerivation rec {
-  name = "zziplib-0.13.58";
+  name = "zziplib-${version}";
+  version = "0.13.66";
 
   src = fetchurl {
-    url = "mirror://sourceforge/zziplib/${name}.tar.bz2";
-    sha256 = "13j9f6i8rx0qd5m96iwrcha78h34qpfk5qzi7cv098pms6gq022m";
+    url = "mirror://sourceforge/zziplib/zziplib13/${version}/${name}.tar.gz";
+    sha256 = "0zdx0s19slzv79xplnr6jx0xjb01dd71jzpscf6vlj6k9ry8rcar";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/ocaml-modules/containers/default.nix b/pkgs/development/ocaml-modules/containers/default.nix
index f44db615175..84ac3ae6133 100644
--- a/pkgs/development/ocaml-modules/containers/default.nix
+++ b/pkgs/development/ocaml-modules/containers/default.nix
@@ -6,18 +6,18 @@ let
   mkpath = p:
       "${p}/lib/ocaml/${ocaml.version}/site-lib";
 
-  version = "1.2";
+  version = "1.3";
 
 in
 
 stdenv.mkDerivation {
-  name = "ocaml-containers-${version}";
+  name = "ocaml${ocaml.version}-containers-${version}";
 
   src = fetchFromGitHub {
     owner = "c-cube";
     repo = "ocaml-containers";
     rev = "${version}";
-    sha256 = "0k1676bn12hhayjlpy8bxfc3sgq6wd7zkh0ca700zh8jxjrshjqk";
+    sha256 = "1gjs9d6759zpgp68djv296zwmvhdc6dqfb27aip7dhj6ic2bwgil";
   };
 
   buildInputs = [ ocaml findlib ocamlbuild cppo gen sequence qtest ounit ocaml_oasis qcheck ];
diff --git a/pkgs/development/ocaml-modules/gen/default.nix b/pkgs/development/ocaml-modules/gen/default.nix
index 6cbbd4adc1b..d9a1fb4770f 100644
--- a/pkgs/development/ocaml-modules/gen/default.nix
+++ b/pkgs/development/ocaml-modules/gen/default.nix
@@ -1,15 +1,15 @@
 { stdenv, fetchFromGitHub, ocaml, findlib, ocamlbuild, qtest, ounit }:
 
-let version = "0.4"; in
+let version = "0.4.0.1"; in
 
 stdenv.mkDerivation {
-  name = "ocaml-gen-${version}";
+  name = "ocaml${ocaml.version}-gen-${version}";
 
   src = fetchFromGitHub {
     owner = "c-cube";
     repo = "gen";
     rev = "${version}";
-    sha256 = "041dga300fh1y6fi8y0fkri2qda406lf2dmbrgllazw3rp07zkzj";
+    sha256 = "0gg94f5l899rni3r7s7wq8plgazmbsaw498xckp25kkgpmkk61ml";
   };
 
   buildInputs = [ ocaml findlib ocamlbuild qtest ounit ];
diff --git a/pkgs/development/python-modules/daphne/default.nix b/pkgs/development/python-modules/daphne/default.nix
index 562b29cf062..c90fb61ce03 100644
--- a/pkgs/development/python-modules/daphne/default.nix
+++ b/pkgs/development/python-modules/daphne/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, buildPythonPackage, fetchurl,
+{ stdenv, buildPythonPackage, fetchPypi,
   asgiref, autobahn, twisted, hypothesis
 }:
 buildPythonPackage rec {
   pname = "daphne";
   name = "${pname}-${version}";
-  version = "1.2.0";
+  version = "1.3.0";
 
-  src = fetchurl {
-    url = "mirror://pypi/d/daphne/${name}.tar.gz";
-    sha256 = "084216isw7rwy693i62rbd8kvpqx418jvf1q72cplv833wz3in7l";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1xmmjp21m1w88ljsgnkf6cbzw5nxamh9cfmfgzxffpn4cdmvn96i";
   };
 
   buildInputs = [ hypothesis ];
diff --git a/pkgs/development/tools/apktool/default.nix b/pkgs/development/tools/apktool/default.nix
index 4f87bcd1589..555cb313a62 100644
--- a/pkgs/development/tools/apktool/default.nix
+++ b/pkgs/development/tools/apktool/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "apktool-${version}";
-  version = "2.2.2";
+  version = "2.2.4";
 
   src = fetchurl {
     url = "https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_${version}.jar";
-    sha256 = "1a94jw0ml08xdwls1q9v5p1zak5qrbw2zyychnm5vch8znyws411";
+    sha256 = "0l9jxa393a52iiawh93v31vr1y6z2bwg6dqhpivqd6y0vip1h7qz";
   };
 
   phases = [ "installPhase" ];
diff --git a/pkgs/development/tools/packer/default.nix b/pkgs/development/tools/packer/default.nix
index bcf08712ccb..40501a78b1e 100644
--- a/pkgs/development/tools/packer/default.nix
+++ b/pkgs/development/tools/packer/default.nix
@@ -1,7 +1,7 @@
 { stdenv, buildGoPackage, fetchFromGitHub }:
 buildGoPackage rec {
   name = "packer-${version}";
-  version = "1.0.0";
+  version = "1.0.3";
 
   goPackagePath = "github.com/mitchellh/packer";
 
@@ -11,7 +11,7 @@ buildGoPackage rec {
     owner = "mitchellh";
     repo = "packer";
     rev = "v${version}";
-    sha256 = "16hdh3iwvdg1jk3pswa9r9lq4qkhds1lrqwl19vd1v2yz2r76kzi";
+    sha256 = "1bd0rv93pxlv58c0x1d4dsjq4pg5qwrm2p7qw83pca7izlncgvfr";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/games/0ad/data.nix b/pkgs/games/0ad/data.nix
index 68ef1fd5392..20dd30238fb 100644
--- a/pkgs/games/0ad/data.nix
+++ b/pkgs/games/0ad/data.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "0ad-data-${version}";
-  version = "0.0.21";
+  version = "0.0.22";
 
   src = fetchurl {
     url = "http://releases.wildfiregames.com/0ad-${version}-alpha-unix-data.tar.xz";
-    sha256 = "15xadyrpvq27lm9p1ny7bcmmv56m16h3xadbkdx69gfkzxc3razk";
+    sha256 = "0vknk9ay9h2p34r7mym2g066f3s3c5d5vmap0ckcs5b86h5cscjc";
   };
 
   installPhase = ''
diff --git a/pkgs/games/0ad/game.nix b/pkgs/games/0ad/game.nix
index 3a50196456c..cd0647cdee1 100644
--- a/pkgs/games/0ad/game.nix
+++ b/pkgs/games/0ad/game.nix
@@ -10,11 +10,11 @@ assert withEditor -> wxGTK != null;
 
 stdenv.mkDerivation rec {
   name = "0ad-${version}";
-  version = "0.0.21";
+  version = "0.0.22";
 
   src = fetchurl {
     url = "http://releases.wildfiregames.com/0ad-${version}-alpha-unix-build.tar.xz";
-    sha256 = "1kw3hqnr737ipx4f03khz3hvsh3ha7r8iy9njppk2faa53j27gln";
+    sha256 = "1cgmr4g5g9wv36v7ylbrvqhsjwgcsdgbqwc8zlqmnayk9zgkdpgx";
   };
 
   nativeBuildInputs = [ python2 perl pkgconfig ];
diff --git a/pkgs/misc/emulators/dolphin-emu/master.nix b/pkgs/misc/emulators/dolphin-emu/master.nix
index ed44ea59311..31e22240c3b 100644
--- a/pkgs/misc/emulators/dolphin-emu/master.nix
+++ b/pkgs/misc/emulators/dolphin-emu/master.nix
@@ -4,12 +4,12 @@
 , libpulseaudio ? null }:
 
 stdenv.mkDerivation rec {
-  name = "dolphin-emu-20170705";
+  name = "dolphin-emu-20170730";
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
-    rev = "29cc009706f133aac39ebaa7003d37555b926109";
-    sha256 = "0axd2z14lyqlaxrjssc0dkqnjdk3ccxh2fqrhya0jc2rsm8ighlz";
+    rev = "141fb0f03ca4e0d05f7ccbf3e020997097f60dbe";
+    sha256 = "1b4ygrfj1dpmyv7qqfnqrrvm96a3b68cwcnvv2pknrcpc17g52im";
   };
 
   cmakeFlags = ''
diff --git a/pkgs/os-specific/linux/batman-adv/alfred.nix b/pkgs/os-specific/linux/batman-adv/alfred.nix
index 7b800fe6f4f..3a1407aae1f 100644
--- a/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, gpsd, libcap, libnl }:
 
 let
-  ver = "2017.1";
+  ver = "2017.2";
 in
 stdenv.mkDerivation rec {
   name = "alfred-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "1c6zq8j0nb1wm9zzlzc2bn8a500pvqbn2vv9hrv6nvq7il2silzq";
+    sha256 = "00sagxzkx0gqdkvc84w4bjy833l7n10hqalxdwkfxxwqwammclix";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
index c34c7746b90..5f659eb9884 100644
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, libnl }:
 
 let
-  ver = "2017.1";
+  ver = "2017.2";
 in
 stdenv.mkDerivation rec {
   name = "batctl-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "1imb59iaaw50y76595z6zvqnbpjgqkkp79gq4s7w7nj8wikiqcgq";
+    sha256 = "0v2k9ylmk8i85p69dh6gh134f081gm1clq1vnhn6x4831n8x0q64";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index 8a96279c66b..4270f37594e 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, kernel }:
 
-let base = "batman-adv-2017.1"; in
+let base = "batman-adv-2017.2"; in
 
 stdenv.mkDerivation rec {
   name = "${base}-${kernel.version}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/${base}/${base}.tar.gz";
-    sha256 = "05cck0mlg8xsvbra69x6i25xclsq1xc49dggxq81gi086c14h67c";
+    sha256 = "0krr6waxkmms23cacfzngddxy1vq577s54wy2fgx6lyb4579g1yl";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index 8a6dfff3470..123a7d9395d 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "raspberrypi-firmware-${version}";
-  version = "1.20170427";
+  version = "1.20170515";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "firmware";
     rev = version;
-    sha256 = "0n79nij0rlwjx3zqs4p3wcyrgrgg9gmsf1a526r91c689r5lpwvl";
+    sha256 = "0liy0p69p9yr5cqgrfc23d3n243xkrx889gc8yqd9m2jpns4s361";
   };
 
   dontStrip = true;    # Stripping breaks some of the binaries
diff --git a/pkgs/os-specific/linux/ipsec-tools/default.nix b/pkgs/os-specific/linux/ipsec-tools/default.nix
index 466ecb1efee..30bd51473b5 100644
--- a/pkgs/os-specific/linux/ipsec-tools/default.nix
+++ b/pkgs/os-specific/linux/ipsec-tools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, linuxHeaders, readline, openssl, flex, kerberos, pam }:
+{ stdenv, fetchurl, fetchpatch, linuxHeaders, readline, openssl, flex, kerberos, pam }:
 
 # TODO: These tools are supposed to work under NetBSD and FreeBSD as
 # well, so I guess it's not appropriate to place this expression in
@@ -16,8 +16,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ readline openssl flex kerberos pam ];
 
-  patches = [ ./dont-create-localstatedir-during-install.patch
-              ./CVE-2015-4047.patch ];
+  patches = [
+    ./dont-create-localstatedir-during-install.patch
+    ./CVE-2015-4047.patch
+    (fetchpatch {
+      url = "https://anonscm.debian.org/cgit/pkg-ipsec-tools/pkg-ipsec-tools.git/plain/debian/patches/CVE-2016-10396.patch?id=62ac12648a4eb7c5ba5dba0f81998d1acf310d8b";
+      sha256 = "1kf7j2pf1blni52z7q41n0yisqb7gvk01lvldr319zaxxg7rm84a";
+    })
+  ];
 
   # fix build with newer gcc versions
   preConfigure = ''substituteInPlace configure --replace "-Werror" "" '';
diff --git a/pkgs/os-specific/linux/irqbalance/default.nix b/pkgs/os-specific/linux/irqbalance/default.nix
index 7c394753902..26cedf41a5a 100644
--- a/pkgs/os-specific/linux/irqbalance/default.nix
+++ b/pkgs/os-specific/linux/irqbalance/default.nix
@@ -1,20 +1,20 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, libtool, pkgconfig}:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, glib, ncurses, libcap_ng }:
 
 stdenv.mkDerivation rec {
-  name = "irqbalance-1.1.0";
+  name = "irqbalance-${version}";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "irqbalance";
     repo = "irqbalance";
-    rev = "a23de3c455b88060620d102f6946b1d8be9e2680";
-    sha256 = "06yq5k5v9wiwajqcjkbkk46g212qx78x323bygnyqshc5s25mp2x";
+    rev = "v${version}";
+    sha256 = "1xznxjbjzg6sds3fymdq9rk3g4cgq7xj7rz3dwbqqjqvd3k2nxw6";
   };
 
-  nativeBuildInputs = [ autoconf automake libtool pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ glib ncurses libcap_ng ];
 
-  preConfigure = ''
-    ./autogen.sh
-  '';
+  LDFLAGS = "-lncurses";
 
   meta = {
     homepage = https://github.com/Irqbalance/irqbalance;
diff --git a/pkgs/os-specific/linux/jool/cli.nix b/pkgs/os-specific/linux/jool/cli.nix
index c8775eee48c..6b79045ac67 100644
--- a/pkgs/os-specific/linux/jool/cli.nix
+++ b/pkgs/os-specific/linux/jool/cli.nix
@@ -1,7 +1,7 @@
-{ stdenv, fetchzip, autoreconfHook, pkgconfig, libnl }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, libnl }:
 
 let
-  sourceAttrs = (import ./source.nix) { inherit fetchzip; };
+  sourceAttrs = (import ./source.nix) { inherit fetchFromGitHub; };
 in
 
 stdenv.mkDerivation {
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
 
   src = sourceAttrs.src;
 
-  sourceRoot = "Jool-${sourceAttrs.version}.zip/usr";
+  sourceRoot = "Jool-v${sourceAttrs.version}-src/usr";
 
   buildInputs = [ autoreconfHook pkgconfig libnl ];
 
diff --git a/pkgs/os-specific/linux/jool/default.nix b/pkgs/os-specific/linux/jool/default.nix
index 824bc3f9a18..37dd4d727ec 100644
--- a/pkgs/os-specific/linux/jool/default.nix
+++ b/pkgs/os-specific/linux/jool/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchzip, kernel }:
+{ stdenv, fetchFromGitHub, kernel }:
 
-assert stdenv.lib.versionOlder kernel.version "4.11";
+assert stdenv.lib.versionOlder kernel.version "4.13";
 
 let
-  sourceAttrs = (import ./source.nix) { inherit fetchzip; };
+  sourceAttrs = (import ./source.nix) { inherit fetchFromGitHub; };
 in
 
 stdenv.mkDerivation {
diff --git a/pkgs/os-specific/linux/jool/source.nix b/pkgs/os-specific/linux/jool/source.nix
index 2de2aeeff8f..ace103a92f9 100644
--- a/pkgs/os-specific/linux/jool/source.nix
+++ b/pkgs/os-specific/linux/jool/source.nix
@@ -1,9 +1,11 @@
-{ fetchzip }:
+{ fetchFromGitHub }:
 
 rec {
-  version = "3.5.3";
-  src = fetchzip {
-    url = "https://github.com/NICMx/releases/raw/master/Jool/Jool-${version}.zip";
-    sha256 = "1dh8qcb3grjpsk7j5d8p5dncrh4fljkrfd9b8sxd2c3kirczckmp";
+  version = "3.5.4";
+  src = fetchFromGitHub {
+    owner = "NICMx";
+    repo = "Jool";
+    rev = "v${version}";
+    sha256 = "09b9zcxgmy59jb778lkdyslx777bpsl216kkivw0zwfwsgd4pyz5";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 0e7f332e617..f1fabad24fb 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -1,8 +1,8 @@
 { stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 let
-  modDirVersion = "4.9.24";
-  tag = "1.20170427";
+  modDirVersion = "4.9.28";
+  tag = "1.20170515";
 in
 stdenv.lib.overrideDerivation (import ./generic.nix (args // rec {
   version = "${modDirVersion}-${tag}";
@@ -12,7 +12,7 @@ stdenv.lib.overrideDerivation (import ./generic.nix (args // rec {
     owner = "raspberrypi";
     repo = "linux";
     rev = "raspberrypi-kernel_${tag}-1";
-    sha256 = "0f7p2jc3a9yvz7k1fig6fardgz2lvp5kawbb3rfsx2p53yjlhmf9";
+    sha256 = "19cjvns6zs53l319k3a2angffr93dh2j9g0022ww6rmi6niq4fkf";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/pam_ldap/default.nix b/pkgs/os-specific/linux/pam_ldap/default.nix
index 1eee7dbdac2..e7f2c8278e1 100644
--- a/pkgs/os-specific/linux/pam_ldap/default.nix
+++ b/pkgs/os-specific/linux/pam_ldap/default.nix
@@ -1,18 +1,23 @@
-{stdenv, fetchurl, pam, openldap}:
-   
+{ stdenv, fetchurl, pam, openldap, perl }:
+
 stdenv.mkDerivation rec {
-  name = "pam_ldap-183";
-   
+  name = "pam_ldap-186";
+
   src = fetchurl {
     url = "http://www.padl.com/download/${name}.tar.gz";
-    sha256 = "1l0mlwvas9dnsfcgbszbzq3bzhdkibn1c3x15fczq3i82faf5g5a";
+    sha256 = "0lv4f7hc02jrd2l3gqxd247qq62z11sp3fafn8lgb8ymb7aj5zn8";
   };
 
+  postPatch = ''
+    patchShebangs ./vers_string
+  '';
+
   preInstall = "
     substituteInPlace Makefile --replace '-o root -g root' ''
   ";
 
-  buildInputs = [pam openldap];
+  nativeBuildInputs = [ perl ];
+  buildInputs = [ pam openldap ];
 
   meta = {
     homepage = http://www.padl.com/OSS/pam_ldap.html;
diff --git a/pkgs/servers/asterisk/default.nix b/pkgs/servers/asterisk/default.nix
index e6102c84f13..8a25188d595 100644
--- a/pkgs/servers/asterisk/default.nix
+++ b/pkgs/servers/asterisk/default.nix
@@ -97,8 +97,8 @@ in
   };
 
   asterisk-stable = common {
-    version = "14.4.0";
-    sha256 = "095slnhl74hs1c36rgg378azan9zwgryp8him7py4am60lbk3n3w";
+    version = "14.6.0";
+    sha256 = "1d3jjdapfv169d8yhfi92j75iwk9726brv1rjjy288d47jn3sm26";
     externals = {
       "externals_cache/pjproject-2.6.tar.bz2" = pjproject-26;
       "addons/mp3" = mp3-202;
diff --git a/pkgs/servers/caddy/default.nix b/pkgs/servers/caddy/default.nix
index 77c83630514..e221c67a2c0 100644
--- a/pkgs/servers/caddy/default.nix
+++ b/pkgs/servers/caddy/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "caddy-${version}";
-  version = "0.10.4";
+  version = "0.10.6";
 
   goPackagePath = "github.com/mholt/caddy";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     owner = "mholt";
     repo = "caddy";
     rev = "v${version}";
-    sha256 = "0zch19a38487dflx84dlkwz67by9g4v2v8d7wrslqhs14a0sifhk";
+    sha256 = "17k8518mx1l0q5bjlx0c6f249ibr9qdrcgwn3wpwhd244cbg44gn";
   };
 
   buildFlagsArray = ''
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index 45abcff2776..4534ccbe099 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -3,14 +3,14 @@
 
 assert enableSeccomp -> libseccomp != null;
 
-let version = "9.11.1-P2"; in
+let version = "9.11.2"; in
 
 stdenv.mkDerivation rec {
   name = "bind-${version}";
 
   src = fetchurl {
     url = "http://ftp.isc.org/isc/bind9/${version}/${name}.tar.gz";
-    sha256 = "19gyh7yij6cpvk5b199ghhns5wmsz67d2rpgvl91dbkm2m1wclxz";
+    sha256 = "0yn7wgi2y8mpmvbjbkl4va7p0xsnn48m4yjx6ynb1hzp423asikz";
   };
 
   outputs = [ "out" "lib" "dev" "man" "dnsutils" "host" ];
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 568b0ee6c04..30f8fbef119 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -16,12 +16,12 @@ assert ldapSupport -> aprutil.ldapSupport && openldap != null;
 assert http2Support -> nghttp2 != null;
 
 stdenv.mkDerivation rec {
-  version = "2.4.26";
+  version = "2.4.27";
   name = "apache-httpd-${version}";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    sha1 = "b10b0f569a0e5adfef61d8c7f0813d42046e399a";
+    sha1 = "699e4e917e8fb5fd7d0ce7e009f8256ed02ec6fc";
   };
 
   # FIXME: -dev depends on -doc
diff --git a/pkgs/servers/memcached/default.nix b/pkgs/servers/memcached/default.nix
index 166c5cdbf52..fabd5b83724 100644
--- a/pkgs/servers/memcached/default.nix
+++ b/pkgs/servers/memcached/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl, cyrus_sasl, libevent}:
 
 stdenv.mkDerivation rec {
-  name = "memcached-1.4.33";
+  name = "memcached-1.4.39";
 
   src = fetchurl {
     url = "http://memcached.org/files/${name}.tar.gz";
-    sha256 = "07bpd6xdhzw6q2ga6xc075bw4jd44nxjl1vk4dqmd315d26nqwl3";
+    sha256 = "0dfpmx0fqgp55j4vl06cz63fwx5kzhzipdm7n2kxjkvyg1ybzi13";
   };
 
   buildInputs = [cyrus_sasl libevent];
diff --git a/pkgs/servers/radarr/default.nix b/pkgs/servers/radarr/default.nix
index 23969dc2a23..088eef0830b 100644
--- a/pkgs/servers/radarr/default.nix
+++ b/pkgs/servers/radarr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, mono, libmediainfo, sqlite, makeWrapper }:
+{ stdenv, fetchurl, mono, libmediainfo, sqlite, curl, makeWrapper }:
 
 stdenv.mkDerivation rec {
   name = "radarr-${version}";
@@ -17,8 +17,8 @@ stdenv.mkDerivation rec {
 
     makeWrapper "${mono}/bin/mono" $out/bin/Radarr \
       --add-flags "$out/share/${name}/Radarr.exe" \
-      --prefix LD_LIBRARY_PATH ':' "${sqlite.out}/lib" \
-      --prefix LD_LIBRARY_PATH ':' "${libmediainfo}/lib"
+      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [
+          curl sqlite libmediainfo ]}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/sonarr/default.nix b/pkgs/servers/sonarr/default.nix
index bd921df6e52..3c096a0d52e 100644
--- a/pkgs/servers/sonarr/default.nix
+++ b/pkgs/servers/sonarr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, mono, libmediainfo, sqlite, makeWrapper, ... }:
+{ stdenv, fetchurl, mono, libmediainfo, sqlite, curl, makeWrapper, ... }:
 
 stdenv.mkDerivation rec {
   name = "sonarr-${version}";
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
 
     makeWrapper "${mono}/bin/mono" $out/bin/NzbDrone \
       --add-flags "$out/bin/NzbDrone.exe" \
-      --prefix LD_LIBRARY_PATH ':' "${sqlite.out}/lib" \
-      --prefix LD_LIBRARY_PATH ':' "${libmediainfo}/lib"
+      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [
+          curl sqlite libmediainfo ]}
   '';
 
   meta = {
diff --git a/pkgs/servers/sql/mysql/5.5.x.nix b/pkgs/servers/sql/mysql/5.5.x.nix
index 820c3fc9605..6a85d956a0c 100644
--- a/pkgs/servers/sql/mysql/5.5.x.nix
+++ b/pkgs/servers/sql/mysql/5.5.x.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "mysql-${version}";
-  version = "5.5.54";
+  version = "5.5.57";
 
   src = fetchurl {
     url = "mirror://mysql/MySQL-5.5/${name}.tar.gz";
-    sha256 = "1f0sg72vbhavj1cbay0gyyrrw0mjcf2k0nf30zmn2h68ik7wnfr7";
+    sha256 = "113kynpfj45fffr62xack2657pds8mkhsgg77zj94ksj3qrbvhn1";
   };
 
   patches = if stdenv.isCygwin then [
diff --git a/pkgs/servers/sql/mysql/5.7.x.nix b/pkgs/servers/sql/mysql/5.7.x.nix
index be4ab80f705..5598a792633 100644
--- a/pkgs/servers/sql/mysql/5.7.x.nix
+++ b/pkgs/servers/sql/mysql/5.7.x.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "mysql-${version}";
-  version = "5.7.17";
+  version = "5.7.19";
 
   src = fetchurl {
     url = "mirror://mysql/MySQL-5.7/${name}.tar.gz";
-    sha256 = "0lcn9cm36n14g22bcppq5vf4nxbrl3khvlsp9hsixqdfb3l27gyf";
+    sha256 = "1c8y54yk756179nx4dgg79dijmjdq5n8l057cnqsg70pjdpyfl9y";
   };
 
   preConfigure = stdenv.lib.optional stdenv.isDarwin ''
diff --git a/pkgs/servers/unifi/default.nix b/pkgs/servers/unifi/default.nix
index 7237bbdcd96..ec3b255116b 100644
--- a/pkgs/servers/unifi/default.nix
+++ b/pkgs/servers/unifi/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   name = "unifi-controller-${version}";
-  version = "5.5.19";
+  version = "5.5.20";
 
   src = fetchurl {
     url = "https://www.ubnt.com/downloads/unifi/${version}/unifi_sysvinit_all.deb";
-    sha256 = "0bsfq48xjp230ir8pm9wpa5p4dh88zfy51lbi2xwpr454371ixcl";
+    sha256 = "14v38x46vgwm3wg28lzv4sz6kjgp6r1xkwxnxn6pzq2r7v6xkaz0";
   };
 
   buildInputs = [ dpkg ];
diff --git a/pkgs/servers/web-apps/searx/default.nix b/pkgs/servers/web-apps/searx/default.nix
new file mode 100644
index 00000000000..551f3a015a1
--- /dev/null
+++ b/pkgs/servers/web-apps/searx/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, pythonPackages, fetchFromGitHub }:
+
+pythonPackages.buildPythonApplication rec {
+  name = "searx-${version}";
+  version = "0.12.0";
+
+  src = fetchFromGitHub {
+    owner = "asciimoo";
+    repo = "searx";
+    rev = "v${version}";
+    sha256 = "196lk8dpv8fsjgmwlqik6j6rabvfid41fir6lzqy03hv7ydcw1k0";
+  };
+
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace 'certifi==2017.1.23' 'certifi' \
+      --replace 'lxml==3.7.3' 'lxml' \
+      --replace 'pyopenssl==16.2.0' 'pyopenssl' \
+      --replace 'pygments==2.1.3' 'pygments>=2.1,<3.0'
+  '';
+
+  propagatedBuildInputs = with pythonPackages; [
+    pyyaml lxml grequests flaskbabel flask requests
+    gevent speaklater Babel pytz dateutil pygments
+    pyasn1 pyasn1-modules ndg-httpsclient certifi pysocks
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/asciimoo/searx;
+    description = "A privacy-respecting, hackable metasearch engine";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ matejc fpletz profpatsch ];
+  };
+ }
diff --git a/pkgs/shells/zsh-completions/default.nix b/pkgs/shells/zsh-completions/default.nix
index a1f70822725..d2096ef811d 100644
--- a/pkgs/shells/zsh-completions/default.nix
+++ b/pkgs/shells/zsh-completions/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "zsh-completions-${version}";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "zsh-users";
     repo = "zsh-completions";
     rev = "${version}";
-    sha256 = "0hc56y0fvshzs05acbzxf4q37vqsk4q3zp4c7smh175v56wigy94";
+    sha256 = "16yhwf42a11v8bhnfb7nda0svxmglzph3c0cknvf8p5m6mkqj9s2";
   };
 
   installPhase= ''
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 1aec4209b4d..64ec5e9b418 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "lxd-${version}";
-  version = "2.14";
+  version = "2.16";
   rev = "lxd-${version}";
 
   goPackagePath = "github.com/lxc/lxd";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     inherit rev;
     owner = "lxc";
     repo = "lxd";
-    sha256 = "1jy60lb2m0497bnjj09qvflsj2rb0jjmlb8pm1xn5g4lpzibszjm";
+    sha256 = "0i2mq9m8k9kznwz1i0xb48plp1ffpzvbdrvqvagis4sm17yab3fn";
   };
 
   goDeps = ./deps.nix;
diff --git a/pkgs/tools/cd-dvd/brasero/default.nix b/pkgs/tools/cd-dvd/brasero/default.nix
index d033371cbcd..d62f2c25623 100644
--- a/pkgs/tools/cd-dvd/brasero/default.nix
+++ b/pkgs/tools/cd-dvd/brasero/default.nix
@@ -6,7 +6,7 @@
 
 let
   major = "3.12";
-  minor = "1";
+  minor = "2";
   binpath = lib.makeBinPath [ dvdauthor vcdimager ];
 
 in stdenv.mkDerivation rec {
@@ -15,7 +15,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://download.gnome.org/sources/brasero/${major}/${name}.tar.xz";
-    sha256 = "09vi2hyhl0bz7imv3ky6h7x5m3d546n968wcghydwrkvwm9ylpls";
+    sha256 = "0h90y674j26rvjahb8cc0w79zx477rb6zaqcj26wzvq8kmpic8k8";
   };
 
   nativeBuildInputs = [ pkgconfig itstool intltool wrapGAppsHook ];
diff --git a/pkgs/tools/filesystems/zerofree/default.nix b/pkgs/tools/filesystems/zerofree/default.nix
index 994777680db..593715b2068 100644
--- a/pkgs/tools/filesystems/zerofree/default.nix
+++ b/pkgs/tools/filesystems/zerofree/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "zerofree-${version}";
-  version = "1.0.4";
+  version = "1.1.0";
 
   src = fetchurl {
     url = "http://frippery.org/uml/${name}.tgz";
-    sha256 = "0f38mvn3wfacapayl54q04qlz4in417pfm6gapgm7dhyjs9y5yd7";
+    sha256 = "059g29x5r1xj6wcj4xj85l8w6qrxyl86yqbybjqqz6nxz4falxzf";
   };
 
   buildInputs = [ e2fsprogs ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 '';
 
   meta = {
-    homepage = http://frippery.org/uml/index.html;
+    homepage = https://frippery.org/uml/;
     description = "Zero free blocks from ext2, ext3 and ext4 file-systems";
     platforms = stdenv.lib.platforms.linux;
     maintainers = [ stdenv.lib.maintainers.theuni ];
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
new file mode 100644
index 00000000000..763ca668d18
--- /dev/null
+++ b/pkgs/tools/misc/fd/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  name = "fd-${version}";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "sharkdp";
+    repo = "fd";
+    rev = "v${version}";
+    sha256 = "1xs4y9zf5m0ykl95787jv98xg0a60gkcyyh7kg7qg4xrcgf4qz4j";
+  };
+
+  depsSha256 = "1hxf3j4584jgpwrwykx6yil6q6ka9l81qvx6zrbprdxk3pslp049";
+
+  meta = {
+    description = "A simple, fast and user-friendly alternative to find";
+    longDescription = ''
+      `fd` is a simple, fast and user-friendly alternative to `find`.
+
+      While it does not seek to mirror all of `find`'s powerful functionality,
+      it provides sensible (opinionated) defaults for 80% of the use cases.
+    '';
+    homepage = "https://github.com/sharkdp/fd";
+    license = stdenv.lib.licenses.mit;
+    platforms = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix
index b730d45c9e2..bf05cd9bf5c 100644
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -15,11 +15,11 @@ with stdenv.lib;
 buildPythonApplication rec {
 
   name = "youtube-dl-${version}";
-  version = "2017.07.09";
+  version = "2017.07.30.1";
 
   src = fetchurl {
     url = "https://yt-dl.org/downloads/${version}/${name}.tar.gz";
-    sha256 = "0phrfby2nk5y5x5173bbg3jcr2ajk849al3zji5y39z39dj36ba2";
+    sha256 = "1m1n5d06xh8hnild6kssiv9yaq2sm7vy0c8h506v3nff7i9wf0a7";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/networking/altermime/debian-patches.nix b/pkgs/tools/networking/altermime/debian-patches.nix
deleted file mode 100644
index cd0ae77511b..00000000000
--- a/pkgs/tools/networking/altermime/debian-patches.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-# Generated by debian-patches.sh from debian-patches.txt
-let
-  prefix = "http://patch-tracker.debian.org/patch/series/dl/altermime/0.3.10-7";
-in
-[
-  {
-    url = "${prefix}/15_fix_snprintf.diff";
-    sha256 = "0fbi99s7pc2jvg9s2zldvg18i6g5ca3pcyaxy47kyabnz956dris";
-  }
-  {
-    url = "${prefix}/10_fix_printk_warnings.diff";
-    sha256 = "1fqsym07r3gv8zllg7c956g5a04gsxnr1ibbgkjr3yx6nm5ci1j7";
-  }
-  {
-    url = "${prefix}/20_fix-unused-but-set-variables.diff";
-    sha256 = "0ski67k44amrgg2g3gwdjzrlix2gjg60r5rs5wbjingvq1n7255r";
-  }
-]
diff --git a/pkgs/tools/networking/altermime/debian-patches.txt b/pkgs/tools/networking/altermime/debian-patches.txt
deleted file mode 100644
index 77cb0ff10c1..00000000000
--- a/pkgs/tools/networking/altermime/debian-patches.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-altermime/0.3.10-7
-15_fix_snprintf.diff
-10_fix_printk_warnings.diff
-20_fix-unused-but-set-variables.diff
diff --git a/pkgs/tools/networking/altermime/default.nix b/pkgs/tools/networking/altermime/default.nix
index e532739ecd4..f05669a4e50 100644
--- a/pkgs/tools/networking/altermime/default.nix
+++ b/pkgs/tools/networking/altermime/default.nix
@@ -3,14 +3,14 @@
 stdenv.mkDerivation rec {
   baseName = "altermime";
   name = "${baseName}-${version}";
-  version = "0.3.10";
+  version = "0.3.11";
 
   src = fetchurl {
     url = "http://www.pldaniels.com/${baseName}/${name}.tar.gz";
-    sha256 = "0vn3vmbcimv0n14khxr1782m76983zz9sf4j2kz5v86lammxld43";
+    sha256 = "15zxg6spcmd35r6xbidq2fgcg2nzyv1sbbqds08lzll70mqx4pj7";
   };
 
-  patches = map fetchurl (import ./debian-patches.nix);
+  NIX_CFLAGS_COMPILE = "-Wno-error=format";
 
   postPatch = ''
     sed -i Makefile -e "s@/usr/local@$out@"
diff --git a/pkgs/tools/networking/inadyn/default.nix b/pkgs/tools/networking/inadyn/default.nix
index 4f9e8b045b0..3495d2d56f0 100644
--- a/pkgs/tools/networking/inadyn/default.nix
+++ b/pkgs/tools/networking/inadyn/default.nix
@@ -1,16 +1,25 @@
-{ stdenv, fetchurl, gnutls, autoreconfHook, pkgconfig, libite, libconfuse }:
+{ stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig
+, gnutls, libite, libconfuse }:
 
 let
-  version = "2.0";
+  version = "2.1";
 in
 stdenv.mkDerivation {
   name = "inadyn-${version}";
 
   src = fetchurl {
     url = "https://github.com/troglobit/inadyn/releases/download/v${version}/inadyn-${version}.tar.xz";
-    sha256 = "16nmbxj337vkqkk6f7vx7fa8mczjv6dl3ybaxy16c23h486y0mzh";
+    sha256 = "1b5khr2y5q1x2mn08zrnjf9hsals4y403mhsc1s7016w3my9lqw7";
   };
 
+  patches = [
+    ./remove-unused-macro.patch
+    (fetchpatch {
+      url = "https://github.com/troglobit/inadyn/commit/ed3a7761015441b5d5cacd691b7aa114da048bef.patch";
+      sha256 = "1passghmjd7gmrfcqkfqw9lvg8l22s91nm65ys3n3rylzsgaaq8i";
+     })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ gnutls libite libconfuse ];
 
diff --git a/pkgs/tools/networking/inadyn/remove-unused-macro.patch b/pkgs/tools/networking/inadyn/remove-unused-macro.patch
new file mode 100644
index 00000000000..0ee6a5d7757
--- /dev/null
+++ b/pkgs/tools/networking/inadyn/remove-unused-macro.patch
@@ -0,0 +1,242 @@
+From b5c70461822003238784ff56f4c8eead10cfc2c1 Mon Sep 17 00:00:00 2001
+From: Joachim Nilsson <troglobit@gmail.com>
+Date: Sun, 2 Jul 2017 21:01:33 +0200
+Subject: [PATCH] Remove UNUSED() macro and disable the compiler warning
+ instead
+
+Signed-off-by: Joachim Nilsson <troglobit@gmail.com>
+
+diff --git a/plugins/common.c b/plugins/common.c
+index 55c1ac3..9e7ba7b 100644
+--- a/plugins/common.c
++++ b/plugins/common.c
+@@ -64,7 +64,7 @@ int common_request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+  * DynDNS response validator -- common to many other DDNS providers as well
+  *  'good' or 'nochg' are the good answers,
+  */
+-int common_response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++int common_response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *body = trans->rsp_body;
+ 
+diff --git a/plugins/ddnss.c b/plugins/ddnss.c
+index fea41e9..5184db0 100644
+--- a/plugins/ddnss.c
++++ b/plugins/ddnss.c
+@@ -60,7 +60,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ 			info->user_agent);
+ }
+ 
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 
+diff --git a/plugins/dhis.c b/plugins/dhis.c
+index 11edd2c..b6e8e0b 100644
+--- a/plugins/dhis.c
++++ b/plugins/dhis.c
+@@ -65,7 +65,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ 			info->user_agent);
+ }
+ 
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *alias)
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *rsp = trans->rsp_body;
+ 
+diff --git a/plugins/dnsexit.c b/plugins/dnsexit.c
+index c456f38..4bf0a08 100644
+--- a/plugins/dnsexit.c
++++ b/plugins/dnsexit.c
+@@ -62,7 +62,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ 			info->user_agent);
+ }
+ 
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	int   code = -1;
+ 	char *tmp;
+diff --git a/plugins/dtdns.c b/plugins/dtdns.c
+index e7996fe..38f0977 100644
+--- a/plugins/dtdns.c
++++ b/plugins/dtdns.c
+@@ -58,7 +58,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ 			info->user_agent);
+ }
+ 
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 
+diff --git a/plugins/duckdns.c b/plugins/duckdns.c
+index 9ca46ae..66d9c25 100755
+--- a/plugins/duckdns.c
++++ b/plugins/duckdns.c
+@@ -78,7 +78,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ 			info->user_agent);
+ }
+ 
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 
+diff --git a/plugins/duiadns.c b/plugins/duiadns.c
+index 7c4ced3..7dc09c9 100644
+--- a/plugins/duiadns.c
++++ b/plugins/duiadns.c
+@@ -58,7 +58,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ 			info->user_agent);
+ }
+ 
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 
+diff --git a/plugins/dynv6-ipv4.c b/plugins/dynv6-ipv4.c
+index 5dab9f1..f37215a 100644
+--- a/plugins/dynv6-ipv4.c
++++ b/plugins/dynv6-ipv4.c
+@@ -59,7 +59,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ 			info->user_agent);
+ }
+ 
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 
+diff --git a/plugins/dynv6.c b/plugins/dynv6.c
+index 84b7c40..03b1b4c 100644
+--- a/plugins/dynv6.c
++++ b/plugins/dynv6.c
+@@ -59,7 +59,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ 			info->user_agent);
+ }
+ 
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 
+diff --git a/plugins/easydns.c b/plugins/easydns.c
+index c9d8059..7718c56 100644
+--- a/plugins/easydns.c
++++ b/plugins/easydns.c
+@@ -70,7 +70,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ /*
+  * NOERROR is the OK code here
+  */
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 
+diff --git a/plugins/freedns.c b/plugins/freedns.c
+index 2c56ca4..2a2991f 100644
+--- a/plugins/freedns.c
++++ b/plugins/freedns.c
+@@ -134,7 +134,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+     fail blabla and n.n.n.n
+     are the good answers. We search our own IP address in response and that's enough.
+ */
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *alias)
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 
+diff --git a/plugins/generic.c b/plugins/generic.c
+index 8f23de4..3cee1f2 100644
+--- a/plugins/generic.c
++++ b/plugins/generic.c
+@@ -238,7 +238,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ 	return ret;
+ }
+ 
+-static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 	size_t i;
+diff --git a/plugins/giradns.c b/plugins/giradns.c
+index 2d6043e..ea19f77 100644
+--- a/plugins/giradns.c
++++ b/plugins/giradns.c
+@@ -57,7 +57,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ 			info->server_name.name, info->user_agent);
+ }
+ 
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 
+diff --git a/plugins/sitelutions.c b/plugins/sitelutions.c
+index c484a62..611c865 100644
+--- a/plugins/sitelutions.c
++++ b/plugins/sitelutions.c
+@@ -64,7 +64,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ 			info->user_agent);
+ }
+ 
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 
+diff --git a/plugins/tunnelbroker.c b/plugins/tunnelbroker.c
+index 1f58990..17eb2b9 100644
+--- a/plugins/tunnelbroker.c
++++ b/plugins/tunnelbroker.c
+@@ -77,7 +77,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+  * Hurricate Electric IPv6 tunnelbroker specific response validator
+  * Own IP address and 'already in use' are the good answers.
+  */
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *alias)
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *resp = trans->rsp_body;
+ 
+diff --git a/plugins/tzo.c b/plugins/tzo.c
+index 0a36e87..eba3da4 100644
+--- a/plugins/tzo.c
++++ b/plugins/tzo.c
+@@ -66,7 +66,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+ }
+ 
+ /* TZO specific response validator. */
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	int code = -1;
+ 
+diff --git a/plugins/zerigo.c b/plugins/zerigo.c
+index 4fb29ab..cc71348 100644
+--- a/plugins/zerigo.c
++++ b/plugins/zerigo.c
+@@ -70,7 +70,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+  * Server error
+  *  Status: 5xx
+  */
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	char *ptr, *rsp = trans->rsp_body;
+ 
+diff --git a/plugins/zoneedit.c b/plugins/zoneedit.c
+index 7178b9c..464ed66 100644
+--- a/plugins/zoneedit.c
++++ b/plugins/zoneedit.c
+@@ -65,7 +65,7 @@ static int request(ddns_t *ctx, ddns_info_t *info, ddns_alias_t *alias)
+  *  CODE=200, 201
+  *  CODE=707, for duplicated updates
+  */
+-static int response(http_trans_t *trans, ddns_info_t *UNUSED(info), ddns_alias_t *UNUSED(alias))
++static int response(http_trans_t *trans, ddns_info_t *info, ddns_alias_t *alias)
+ {
+ 	int code = -1;
+ 
diff --git a/pkgs/tools/networking/openntpd/default.nix b/pkgs/tools/networking/openntpd/default.nix
index 6f3aab3082f..3ead2ef0f21 100644
--- a/pkgs/tools/networking/openntpd/default.nix
+++ b/pkgs/tools/networking/openntpd/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   name = "openntpd-${version}";
-  version = "6.0p1";
+  version = "6.2p1";
 
   src = fetchurl {
     url = "mirror://openbsd/OpenNTPD/${name}.tar.gz";
-    sha256 = "1s3plmxmybwpfrimq6sc54wxnn6ca7rb2g5k2bdjm4c88w4q1axi";
+    sha256 = "1g6hi03ylhv47sbar3xxgsrar8schqfwn4glckh6m6lni67ndq85";
   };
 
   configureFlags = [
diff --git a/pkgs/tools/networking/radvd/default.nix b/pkgs/tools/networking/radvd/default.nix
index a5008e91423..9ebce846e41 100644
--- a/pkgs/tools/networking/radvd/default.nix
+++ b/pkgs/tools/networking/radvd/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "radvd-${version}";
-  version = "2.16";
+  version = "2.17";
 
   src = fetchurl {
     url = "http://www.litech.org/radvd/dist/${name}.tar.xz";
-    sha256 = "1s3aqgn3db0wb4920b0mrvwb5isgijlb6izb1wliqhhashwffz1i";
+    sha256 = "1md6n63sg1n9x8yv0p7fwm1xxaiadj1q3mpadiqsvn14y1ddc2av";
   };
 
   nativeBuildInputs = [ pkgconfig bison flex check ];
diff --git a/pkgs/tools/networking/speedtest-cli/default.nix b/pkgs/tools/networking/speedtest-cli/default.nix
index 8ccc924d9f6..592a173df7e 100644
--- a/pkgs/tools/networking/speedtest-cli/default.nix
+++ b/pkgs/tools/networking/speedtest-cli/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "speedtest-cli-${version}";
-  version = "1.0.4";
-  
+  version = "1.0.6";
+
   src = fetchFromGitHub {
     owner = "sivel";
     repo = "speedtest-cli";
     rev = "v${version}";
-    sha256 = "13i7bvhvwv8h2lxnz9pfxq6jv915lb948d6xjiy5p7rqbki40ng2";
+    sha256 = "008a0wymn06h93gdkxwlgxg8039ybdni96i4blhpayj52jkbflnv";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/wavemon/default.nix b/pkgs/tools/networking/wavemon/default.nix
index ece252a9b6c..0457c1ce623 100644
--- a/pkgs/tools/networking/wavemon/default.nix
+++ b/pkgs/tools/networking/wavemon/default.nix
@@ -1,20 +1,26 @@
-{stdenv, fetchgit, ncurses, libnl, pkgconfig}:
+{ stdenv, fetchFromGitHub, ncurses, libnl, pkgconfig }:
+
 stdenv.mkDerivation rec {
-  version = "0.7.6.20151001";
-  baseName="wavemon";
-  name="${baseName}-${version}";
-  buildInputs = [ncurses libnl pkgconfig];
-  src = fetchgit {
-    url = https://github.com/uoaerg/wavemon.git ;
-    rev = "05753aed2ec5a786d602c7903c89fc6a230f8d42";
-    sha256 = "13y4bi4qz4596f11ng6zaqir5j234wv64z4670q3pzh3fqmzmpm4";
+  version = "0.8.1";
+  baseName = "wavemon";
+  name = "${baseName}-${version}";
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ ncurses libnl ];
+
+  src = fetchFromGitHub {
+    owner = "uoaerg";
+    repo = "wavemon";
+    rev = "v${version}";
+    sha256 = "0mx61rzl8a66pmigv2fh75zgdalxx75a5s1b7ydbviz18ihhjyls";
   };
-  meta = {
+
+  meta = with stdenv.lib; {
     inherit version;
-    description = "WiFi state monitor";
-    license = stdenv.lib.licenses.gpl3Plus ;
-    maintainers = [stdenv.lib.maintainers.raskin];
+    description = "Ncurses-based monitoring application for wireless network devices";
+    homepage = https://github.com/uoaerg/wavemon;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ raskin fpletz ];
     platforms = stdenv.lib.platforms.linux;
-    downloadPage = https://github.com/uoaerg/wavemon.git ;
   };
 }
diff --git a/pkgs/tools/networking/whois/default.nix b/pkgs/tools/networking/whois/default.nix
index fd1045d03d9..e6f25176864 100644
--- a/pkgs/tools/networking/whois/default.nix
+++ b/pkgs/tools/networking/whois/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, perl, gettext }:
 
 stdenv.mkDerivation rec {
-  version = "5.2.16";
+  version = "5.2.17";
   name = "whois-${version}";
 
   src = fetchFromGitHub {
     owner = "rfc1036";
     repo = "whois";
     rev = "v${version}";
-    sha256 = "1axkj3xp8ryw94ml8lkqgpdqkv56aygbyv18kynf2bcglxildyvv";
+    sha256 = "15jnzk0js8wxiapz1bw7jnck0fl3mcli56f9635z9x7vk63ss68z";
   };
 
   buildInputs = [ perl gettext ];
diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index e7a052c90f1..31f2262cd9f 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, python, pythonPackages, gamin }:
 
-let version = "0.9.6"; in
+let version = "0.9.7"; in
 
 pythonPackages.buildPythonApplication {
   name = "fail2ban-${version}";
@@ -9,7 +9,7 @@ pythonPackages.buildPythonApplication {
     owner  = "fail2ban";
     repo   = "fail2ban";
     rev    = version;
-    sha256 = "1a75xjjqhn98zd9i51k15vjvcy0ql0gmcv9xf8pbd0bpvblgdah8";
+    sha256 = "07l5pz93mz1r3g59xiyyznlpjfpv2zgvh3h9w0cbn79v7njim8kb";
   };
 
   propagatedBuildInputs = [ gamin ]
diff --git a/pkgs/tools/security/hashcat/hashcat3/default.nix b/pkgs/tools/security/hashcat/hashcat3/default.nix
index c8a8acf907d..1cb028a1a33 100644
--- a/pkgs/tools/security/hashcat/hashcat3/default.nix
+++ b/pkgs/tools/security/hashcat/hashcat3/default.nix
@@ -4,15 +4,15 @@ assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
   name    = "hashcat-${version}";
-  version = "3.10";
+  version = "3.6.0";
 
   src = fetchurl {
-    name = "${name}.tar.gz";
-    url = "https://hashcat.net/files_legacy/hashcat-${version}.tar.gz";
-    sha256 = "1sg30d9as6xsl7b0i7mz26igachbv0l0yimwb12nmarmgdgmwm9v";
+    url = "https://hashcat.net/files/hashcat-${version}.tar.gz";
+    sha256 = "127hdvq6ikah7r5vch63jnnkcsj7y61f9h8x79c3w25x9w55bxry";
   };
 
-  buildInputs = [ opencl-headers makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ opencl-headers ];
 
   makeFlags = [ "OPENCL_HEADERS_KHRONOS=${opencl-headers}/include" ];
 
diff --git a/pkgs/tools/security/pcsclite/default.nix b/pkgs/tools/security/pcsclite/default.nix
index e3aaca2e5b2..74bb5cc5819 100644
--- a/pkgs/tools/security/pcsclite/default.nix
+++ b/pkgs/tools/security/pcsclite/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "pcsclite-${version}";
-  version = "1.8.21";
+  version = "1.8.22";
 
   src = fetchurl {
     # This URL changes in unpredictable ways, so it is not sensible
     # to put a version variable in there.
-    url = "https://alioth.debian.org/frs/download.php/file/4216/pcsc-lite-1.8.21.tar.bz2";
-    sha256 = "1b8kwl81f6s3y7qh68ahr8sp8a0w6m464v9b3s4zxq2cgpmnaczy";
+    url = "https://alioth.debian.org/frs/download.php/file/4225/pcsc-lite-1.8.22.tar.bz2";
+    sha256 = "01flkdyqs7kr6c63dv2qg8dwir3v9jlr9rzlw7vafrivxmhqydba";
   };
 
   patches = [ ./no-dropdir-literals.patch ];
diff --git a/pkgs/tools/system/ipmiutil/default.nix b/pkgs/tools/system/ipmiutil/default.nix
index 17477210726..90feb381ae5 100644
--- a/pkgs/tools/system/ipmiutil/default.nix
+++ b/pkgs/tools/system/ipmiutil/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   baseName = "ipmiutil";
-  version = "3.0.2";
+  version = "3.0.5";
   name = "${baseName}-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/${baseName}/${name}.tar.gz";
-    sha256 = "0nw12v7w9gx2px3b081i5mm5gl4l9n3vxhhk5n18vj1bs2jsxf4d";
+    sha256 = "0ppfxh04c0aj9dxpkzj3xv1kylc17k1kvqabp8r7h70k6ljzgmxj";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/text/catdoc/default.nix b/pkgs/tools/text/catdoc/default.nix
index fb0309e7532..2a06b25b11d 100644
--- a/pkgs/tools/text/catdoc/default.nix
+++ b/pkgs/tools/text/catdoc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "catdoc-${version}";
@@ -9,6 +9,13 @@ stdenv.mkDerivation rec {
     sha256 = "514a84180352b6bf367c1d2499819dfa82b60d8c45777432fa643a5ed7d80796";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://anonscm.debian.org/git/collab-maint/catdoc.git/diff/debian/patches/05-CVE-2017-11110.patch?id=21dd5b29b11be04149587657dd90253f52dfef0b";
+      sha256 = "0mdqa9w1p6cmli6976v4wi0sw9r4p5prkj7lzfd1877wk11c9c73";
+    })
+  ];
+
   configureFlags = "--disable-wordview";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/typesetting/pdfgrep/default.nix b/pkgs/tools/typesetting/pdfgrep/default.nix
index 6e5f98d4a71..0c288ca02cc 100644
--- a/pkgs/tools/typesetting/pdfgrep/default.nix
+++ b/pkgs/tools/typesetting/pdfgrep/default.nix
@@ -1,26 +1,28 @@
-{ fetchurl, stdenv, pkgconfig, poppler, makeWrapper }:
+{ stdenv, fetchurl, pkgconfig, poppler, libgcrypt, pcre, asciidoc }:
 
 stdenv.mkDerivation rec {
   name = "pdfgrep-${version}";
-  version = "1.3.1";
+  version = "2.0.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/pdfgrep/${version}/${name}.tar.gz";
-    sha256 = "6e8bcaf8b219e1ad733c97257a97286a94124694958c27506b2ea7fc8e532437";
+    url = "https://pdfgrep.org/download/${name}.tar.gz";
+    sha256 = "07llkrkcfjwd3ybai9ad10ybhr0biffcplmy7lw4fb87nd2dfw03";
   };
 
-  buildInputs = [ pkgconfig poppler makeWrapper ];
-
-  patchPhase = ''
-    sed -i -e "s%cpp/poppler-document.h%poppler/cpp/poppler-document.h%" pdfgrep.cc
-    sed -i -e "s%cpp/poppler-page.h%poppler/cpp/poppler-page.h%" pdfgrep.cc
+  postPatch = ''
+    for i in ./src/search.h ./src/pdfgrep.cc ./src/search.cc; do
+      substituteInPlace $i --replace '<cpp/' '<'
+    done
   '';
 
+  nativeBuildInputs = [ pkgconfig asciidoc ];
+  buildInputs = [ poppler libgcrypt pcre ];
+
   meta = {
-    description = "A tool to search text in PDF files";
-    homepage = http://pdfgrep.sourceforge.net/;
-    license = stdenv.lib.licenses.free;
-    maintainers = with stdenv.lib.maintainers; [qknight];
+    description = "Commandline utility to search text in PDF files";
+    homepage = https://pdfgrep.org/;
+    license = stdenv.lib.licenses.gpl2Plus;
+    maintainers = with stdenv.lib.maintainers; [ qknight fpletz ];
     platforms = with stdenv.lib.platforms; linux;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e6ed1a6715e..21ee6afaf24 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1011,6 +1011,8 @@ with pkgs;
     buildInputs = old.buildInputs ++ [phantomjs2];
   });
 
+  fd = callPackage ../tools/misc/fd { };
+
   filebench = callPackage ../tools/misc/filebench { };
 
   fsmon = callPackage ../tools/misc/fsmon { };
@@ -11578,6 +11580,8 @@ with pkgs;
 
   tt-rss = callPackage ../servers/tt-rss { };
 
+  searx = callPackages ../servers/web-apps/searx { };
+
   selfoss = callPackage ../servers/web-apps/selfoss { };
 
   shaarli = callPackage ../servers/web-apps/shaarli { };
@@ -19224,4 +19228,6 @@ with pkgs;
   undaemonize = callPackage ../tools/system/undaemonize {};
 
   houdini = callPackage ../applications/misc/houdini {};
+
+  xtermcontrol = callPackage ../applications/misc/xtermcontrol {};
 }
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0ce43937685..156be853ceb 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -9751,15 +9751,17 @@ let self = _self // overrides; _self = with self; {
   };
 
   Mouse = buildPerlModule rec {
-    name = "Mouse-v2.4.5";
+    name = "Mouse-v2.4.10";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SY/SYOHEX/${name}.tar.gz";
-      sha256 = "1f4dps68f2w1fwqjfpr4kllbcbwd744v3h1r9rkpwc2fhvq3q8hl";
+      url = "mirror://cpan/authors/id/G/GF/GFUJI/${name}.tar.gz";
+      sha256 = "053d28c4v8kj7llwfwj5hjkvc1kcs6mvcn24yg7vxklgj6hxv5dr";
     };
     buildInputs = [
       ModuleBuildXSUtil TestException TestLeakTrace TestRequires TestOutput
       TestFatal
     ];
+    NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.isi686 "-fno-stack-protector";
+    hardeningDisable = stdenv.lib.optional stdenv.isi686 "stackprotector";
   };
 
   MouseXNativeTraits = buildPerlPackage rec {
diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index c5e3ac0ac55..cec9674c8b5 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -235,11 +235,11 @@ let
 
   composer = pkgs.stdenv.mkDerivation rec {
     name = "composer-${version}";
-    version = "1.4.1";
+    version = "1.4.2";
 
     src = pkgs.fetchurl {
       url = "https://getcomposer.org/download/${version}/composer.phar";
-      sha256 = "1g2wsnjcx1ysbw1ps2xwyhgcl8kl3yfzxgwcnh5rigjk6k67glmb";
+      sha256 = "1x467ngxb976ba2r9kqba7jpvm95a0db8nwaa2z14zs7xv1la6bb";
     };
 
     phases = [ "installPhase" ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4ae21516f7d..f0fd99d1774 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -22299,13 +22299,13 @@ in {
   };
 
   supervisor = buildPythonPackage rec {
-    name = "supervisor-3.1.1";
+    name = "supervisor-3.1.4";
 
     disabled = isPy3k;
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/s/supervisor/${name}.tar.gz";
-      sha256 = "e3c3b35804c24b6325b5ba462553ebee80d5f4d1766274737b5c532cd4a11d59";
+      sha256 = "0kk0sv7780m4dzmrcb2m284krz907jh8jp7khz5a79qryy4m1xw2";
     };
 
     buildInputs = with self; [ mock ];
@@ -26379,42 +26379,6 @@ EOF
     };
   };
 
-  searx = buildPythonPackage rec {
-    name = "searx-${version}";
-    version = "0.11.0";
-
-    src = pkgs.fetchFromGitHub {
-      owner = "asciimoo";
-      repo = "searx";
-      rev = "v${version}";
-      sha256 = "1m6q7yd45lfk19yp30x1jmisff6npa1y348wqc9ixa3ywvb28ky8";
-    };
-
-    postPatch = ''
-      substituteInPlace requirements.txt \
-        --replace 'certifi==2016.9.26' 'certifi' \
-        --replace 'pyyaml==3.11' 'pyyaml' \
-        --replace 'lxml==3.7.1' 'lxml' \
-        --replace 'pyopenssl==16.2.0' 'pyopenssl' \
-        --replace 'requests[socks]==2.12.4' 'requests[socks]' \
-        --replace 'pygments==2.1.3' 'pygments>=2.1,<3.0' \
-        --replace 'python-dateutil==2.5.3' 'python-dateutil>=2.5,<3.0'
-    '';
-
-    propagatedBuildInputs = with self; [
-      pyyaml lxml grequests flaskbabel flask requests
-      gevent speaklater Babel pytz dateutil pygments
-      pyasn1 pyasn1-modules ndg-httpsclient certifi pysocks
-    ];
-
-    meta = {
-      homepage = https://github.com/asciimoo/searx;
-      description = "A privacy-respecting, hackable metasearch engine";
-      license = licenses.agpl3Plus;
-      maintainers = with maintainers; [ matejc fpletz profpatsch ];
-    };
-  };
-
   rpdb = buildPythonPackage rec {
     name = "rpdb-0.1.5";