summary refs log tree commit diff
path: root/pkgs/development/libraries
diff options
context:
space:
mode:
authorRobin Gloster <mail@glob.in>2016-05-30 19:39:34 +0000
committerRobin Gloster <mail@glob.in>2016-05-30 19:39:34 +0000
commit2d382f3d981fc9e4a350badb43736c252415d27c (patch)
tree3d5f7a96aa71be52c86f3c243b23424e319cc286 /pkgs/development/libraries
parent365379857fb561df949fc841e80458e317a1d682 (diff)
parent2661511cdb39bd7612dd5311b46420785fc1eac8 (diff)
downloadnixpkgs-2d382f3d981fc9e4a350badb43736c252415d27c.tar
nixpkgs-2d382f3d981fc9e4a350badb43736c252415d27c.tar.gz
nixpkgs-2d382f3d981fc9e4a350badb43736c252415d27c.tar.bz2
nixpkgs-2d382f3d981fc9e4a350badb43736c252415d27c.tar.lz
nixpkgs-2d382f3d981fc9e4a350badb43736c252415d27c.tar.xz
nixpkgs-2d382f3d981fc9e4a350badb43736c252415d27c.tar.zst
nixpkgs-2d382f3d981fc9e4a350badb43736c252415d27c.zip
Merge remote-tracking branch 'upstream/master' into hardened-stdenv
Diffstat (limited to 'pkgs/development/libraries')
-rw-r--r--pkgs/development/libraries/aalib/default.nix2
-rw-r--r--pkgs/development/libraries/apr-util/default.nix4
-rw-r--r--pkgs/development/libraries/at-spi2-atk/default.nix4
-rw-r--r--pkgs/development/libraries/at-spi2-core/default.nix6
-rw-r--r--pkgs/development/libraries/atk/default.nix4
-rw-r--r--pkgs/development/libraries/boost/generic.nix4
-rw-r--r--pkgs/development/libraries/box2d/2.0.1.nix83
-rw-r--r--pkgs/development/libraries/coprthr/default.nix2
-rw-r--r--pkgs/development/libraries/cyrus-sasl/default.nix2
-rw-r--r--pkgs/development/libraries/dbus-glib/default.nix4
-rw-r--r--pkgs/development/libraries/expat/CVE-2015-1283-refix.patch37
-rw-r--r--pkgs/development/libraries/expat/CVE-2015-1283.patch77
-rw-r--r--pkgs/development/libraries/expat/CVE-2016-0718-v2-2-1.patch755
-rw-r--r--pkgs/development/libraries/expat/default.nix12
-rw-r--r--pkgs/development/libraries/fltk/default.nix33
-rw-r--r--pkgs/development/libraries/fltk/fltk13.nix66
-rw-r--r--pkgs/development/libraries/gd/CVE-2016-3074.patch13
-rw-r--r--pkgs/development/libraries/gd/default.nix15
-rw-r--r--pkgs/development/libraries/gdal/default.nix8
-rw-r--r--pkgs/development/libraries/gdal/gdal-1_11.nix8
-rw-r--r--pkgs/development/libraries/ggz_base_libs/default.nix2
-rw-r--r--pkgs/development/libraries/glib/default.nix4
-rw-r--r--pkgs/development/libraries/goocanvas/default.nix10
-rw-r--r--pkgs/development/libraries/gtk+/2.x.nix4
-rw-r--r--pkgs/development/libraries/gtk+/3.x.nix4
-rw-r--r--pkgs/development/libraries/gupnp/default.nix2
-rw-r--r--pkgs/development/libraries/harfbuzz/default.nix4
-rw-r--r--pkgs/development/libraries/hiredis/default.nix4
-rw-r--r--pkgs/development/libraries/kerberos/heimdal.nix6
-rw-r--r--pkgs/development/libraries/ldns/default.nix2
-rw-r--r--pkgs/development/libraries/leatherman/default.nix4
-rw-r--r--pkgs/development/libraries/libclxclient/default.nix2
-rw-r--r--pkgs/development/libraries/libdrm/default.nix4
-rw-r--r--pkgs/development/libraries/libksi/default.nix2
-rw-r--r--pkgs/development/libraries/libmp3splt/default.nix12
-rw-r--r--pkgs/development/libraries/libndp/default.nix6
-rw-r--r--pkgs/development/libraries/libpipeline/default.nix2
-rw-r--r--pkgs/development/libraries/libpipeline/fix-on-osx.patch13
-rw-r--r--pkgs/development/libraries/libpng/default.nix6
-rw-r--r--pkgs/development/libraries/libpsl/default.nix6
-rw-r--r--pkgs/development/libraries/libuv/default.nix4
-rw-r--r--pkgs/development/libraries/libva/default.nix5
-rw-r--r--pkgs/development/libraries/libvirt/default.nix5
-rw-r--r--pkgs/development/libraries/libwacom/default.nix9
-rw-r--r--pkgs/development/libraries/libwps/default.nix9
-rw-r--r--pkgs/development/libraries/libxml2/default.nix15
-rw-r--r--pkgs/development/libraries/mesa/default.nix5
-rw-r--r--pkgs/development/libraries/mesa/symlink-drivers.patch72
-rw-r--r--pkgs/development/libraries/opencascade/6.5.nix2
-rw-r--r--pkgs/development/libraries/opencascade/default.nix2
-rw-r--r--pkgs/development/libraries/openldap/CVE-2015-6908.patch25
-rw-r--r--pkgs/development/libraries/openldap/default.nix2
-rw-r--r--pkgs/development/libraries/pango/default.nix4
-rw-r--r--pkgs/development/libraries/pcl/default.nix15
-rw-r--r--pkgs/development/libraries/pcre2/default.nix10
-rw-r--r--pkgs/development/libraries/postgis/default.nix2
-rw-r--r--pkgs/development/libraries/qt-5/5.5/qmake-hook.sh6
-rw-r--r--pkgs/development/libraries/qt-5/5.6/qmake-hook.sh6
-rw-r--r--pkgs/development/libraries/qt-5/5.6/qtbase/default.nix2
-rw-r--r--pkgs/development/libraries/science/math/cudnn/default.nix38
-rw-r--r--pkgs/development/libraries/science/math/magma/default.nix46
-rw-r--r--pkgs/development/libraries/serf/default.nix4
-rw-r--r--pkgs/development/libraries/silgraphite/default.nix2
-rw-r--r--pkgs/development/libraries/slang/default.nix2
-rw-r--r--pkgs/development/libraries/sqlite/default.nix2
-rw-r--r--pkgs/development/libraries/swiften/default.nix2
-rw-r--r--pkgs/development/libraries/tinyxml/2.6.2-cxx.patch17
-rw-r--r--pkgs/development/libraries/tinyxml/2.6.2.nix14
-rw-r--r--pkgs/development/libraries/vaapi-intel/default.nix5
-rw-r--r--pkgs/development/libraries/wayland/protocols.nix4
-rw-r--r--pkgs/development/libraries/wildmidi/default.nix4
-rw-r--r--pkgs/development/libraries/xine-lib/default.nix10
-rw-r--r--pkgs/development/libraries/zeitgeist/default.nix2
73 files changed, 1186 insertions, 404 deletions
diff --git a/pkgs/development/libraries/aalib/default.nix b/pkgs/development/libraries/aalib/default.nix
index 7ddb78d052e..a6cdf9eb860 100644
--- a/pkgs/development/libraries/aalib/default.nix
+++ b/pkgs/development/libraries/aalib/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ ncurses ];
 
-  configureFlags = "--without-x --with-ncurses=${ncurses}";
+  configureFlags = "--without-x --with-ncurses=${ncurses.dev}";
 
   postInstall = ''
     mkdir -p $dev/bin
diff --git a/pkgs/development/libraries/apr-util/default.nix b/pkgs/development/libraries/apr-util/default.nix
index 6f0956f1d1d..8df7be4a7d1 100644
--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@@ -27,9 +27,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = optional stdenv.isFreeBSD autoreconfHook;
 
-  configureFlags = [ "--with-apr=${apr}" "--with-expat=${expat}" ]
+  configureFlags = [ "--with-apr=${apr.dev}" "--with-expat=${expat.dev}" ]
     ++ optional (!stdenv.isCygwin) "--with-crypto"
-    ++ optional sslSupport "--with-openssl=${openssl}"
+    ++ optional sslSupport "--with-openssl=${openssl.dev}"
     ++ optional bdbSupport "--with-berkeley-db=${db}"
     ++ optional ldapSupport "--with-ldap=ldap"
     ++ optionals stdenv.isCygwin
diff --git a/pkgs/development/libraries/at-spi2-atk/default.nix b/pkgs/development/libraries/at-spi2-atk/default.nix
index f3538a12221..b8f86f1fa22 100644
--- a/pkgs/development/libraries/at-spi2-atk/default.nix
+++ b/pkgs/development/libraries/at-spi2-atk/default.nix
@@ -2,14 +2,14 @@
 , intltool, dbus_glib, at_spi2_core, libSM }:
 
 stdenv.mkDerivation rec {
-  versionMajor = "2.18";
+  versionMajor = "2.20";
   versionMinor = "1";
   moduleName   = "at-spi2-atk";
   name = "${moduleName}-${versionMajor}.${versionMinor}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
-    sha256 = "0bf1g5cj84rmx7p1q547vwbc0hlpcs2wrxnmv96lckfkhs9mzcf4";
+    sha256 = "2358a794e918e8f47ce0c7370eee8fc8a6207ff1afe976ec9ff547a03277bf8e";
   };
 
   buildInputs = [ python pkgconfig popt atk libX11 libICE xorg.libXtst libXi
diff --git a/pkgs/development/libraries/at-spi2-core/default.nix b/pkgs/development/libraries/at-spi2-core/default.nix
index e49569bc226..e3c558057c8 100644
--- a/pkgs/development/libraries/at-spi2-core/default.nix
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@@ -2,14 +2,14 @@
 , libX11, xextproto, libSM, libICE, libXtst, libXi, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
-  versionMajor = "2.18";
-  versionMinor = "3";
+  versionMajor = "2.20";
+  versionMinor = "1";
   moduleName   = "at-spi2-core";
   name = "${moduleName}-${versionMajor}.${versionMinor}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
-    sha256 = "0afn4x04j5l352vj0dccb2hkpzg3l2vhr8h1yv89fpqmjkfnm8md";
+    sha256 = "6ed858e781f5aa9a9662b3beb5ef82f733dac040afc8255d85dffd2097f16900";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/atk/default.nix b/pkgs/development/libraries/atk/default.nix
index 14e2e71c0bd..d75fd235301 100644
--- a/pkgs/development/libraries/atk/default.nix
+++ b/pkgs/development/libraries/atk/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, pkgconfig, perl, glib, libintlOrEmpty, gobjectIntrospection }:
 
 let
-  ver_maj = "2.18";
+  ver_maj = "2.20";
   ver_min = "0";
 in
 stdenv.mkDerivation rec {
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/atk/${ver_maj}/${name}.tar.xz";
-    sha256 = "ce6c48d77bf951083029d5a396dd552d836fff3c1715d3a7022e917e46d0c92b";
+    sha256 = "493a50f6c4a025f588d380a551ec277e070b28a82e63ef8e3c06b3ee7c1238f0";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 8ba8dc19009..f2da2624755 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -100,7 +100,7 @@ let
 
   commonConfigureFlags = [
     "--includedir=$(dev)/include"
-    "--libdir=$(lib)/lib"
+    "--libdir=$(out)/lib"
   ];
 
   fixup = ''
@@ -111,7 +111,7 @@ let
         -exec sed '1i#line 1 "{}"' -i '{}' \;
     )
   '' + optionalString (stdenv.cross.libc or null == "msvcrt") ''
-    ${stdenv.cross.config}-ranlib "$lib/lib/"*.a
+    ${stdenv.cross.config}-ranlib "$out/lib/"*.a
   '';
 
 in
diff --git a/pkgs/development/libraries/box2d/2.0.1.nix b/pkgs/development/libraries/box2d/2.0.1.nix
deleted file mode 100644
index 0d1f3bb14ee..00000000000
--- a/pkgs/development/libraries/box2d/2.0.1.nix
+++ /dev/null
@@ -1,83 +0,0 @@
-x@{builderDefsPackage
-  , unzip, cmake, mesa, freeglut, libX11, xproto
-  , inputproto, libXi
-  , ...}:
-builderDefsPackage
-(a :  
-let 
-  helperArgNames = ["stdenv" "fetchurl" "builderDefsPackage"] ++ 
-    [];
-
-  buildInputs = map (n: builtins.getAttr n x)
-    (builtins.attrNames (builtins.removeAttrs x helperArgNames));
-  sourceInfo = rec {
-    baseName="box2d";
-    version="2.0.1";
-    name="${baseName}-${version}";
-    url="http://box2d.googlecode.com/files/Box2D_v${version}.zip";
-    hash="62857048aa089b558561074154430883cee491eedd71247f75f488cba859e21f";
-  };
-in
-rec {
-  src = a.fetchurl {
-    url = sourceInfo.url;
-    sha256 = sourceInfo.hash;
-  };
-
-  inherit (sourceInfo) name version;
-  inherit buildInputs;
-
-  phaseNames = ["fixIncludes" "setVars" "changeSettings" "doMake" "doDeploy"];
-
-  goSrcDir = ''cd Box2D'';
-
-  fixIncludes = a.fullDepEntry ''
-    sed -i Source/Dynamics/Contacts/b2PolyContact.cpp \
-        -i Source/Dynamics/Contacts/b2CircleContact.cpp \
-        -i Source/Dynamics/Contacts/b2PolyAndCircleContact.cpp \
-        -i Source/Common/b2BlockAllocator.cpp \
-        -i Source/Collision/b2BroadPhase.cpp \
-        -i Examples/TestBed/Framework/Render.cpp \
-        -i Examples/TestBed/Tests/BroadPhaseTest.cpp \
-        -i Examples/TestBed/Tests/TestEntries.cpp \
-        -e '1i#include <string.h>'
-  '' ["minInit" "addInputs" "doUnpack"];
-
-  setVars = a.noDepEntry ''
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lX11 -lXi"
-  '';
-
-  doDeploy = a.fullDepEntry ''
-    mkdir -p "$out"/lib
-    mkdir -p "$out"/include/Box2D
-    cp Library/* Source/Gen/float/lib*.{a,so} "$out"/lib
-    cp -r Source "$out"/include/Box2D/Source
-    find "$out"/include/Box2D/Source ! -name '*.h' -exec rm '{}' ';'
-    sed -e s@../Source@Box2D/Source@ -i Include/Box2D.h
-    cp Include/Box2D.h "$out"/include/Box2D
-    mkdir -p "$out/share"
-    cp -r Examples "$out/share"
-  '' ["minInit" "addInputs" "doMake" "defEnsureDir"];
-
-  changeSettings = a.fullDepEntry ''
-    sed -i Source/Common/b2Settings.h -e 's@b2_maxPolygonVertices .*@b2_maxPolygonVertices = 15;@'
-  '' ["minInit" "addInputs" "doUnpack"];
-      
-  meta = {
-    description = "2D physics engine";
-    maintainers = with a.lib.maintainers;
-    [
-      raskin
-    ];
-    platforms = with a.lib.platforms;
-      linux;
-    license = "bsd";
-    branch = "2.0.1";
-  };
-  passthru = {
-    updateInfo = {
-      downloadPage = "http://code.google.com/p/box2d/downloads/list";
-    };
-  };
-}) x
-
diff --git a/pkgs/development/libraries/coprthr/default.nix b/pkgs/development/libraries/coprthr/default.nix
index 40be21131d2..5630daa0d93 100644
--- a/pkgs/development/libraries/coprthr/default.nix
+++ b/pkgs/development/libraries/coprthr/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   configureFlags =
     [ "--with-libelf=${libelf}"
-      "--with-libevent=${libevent}"
+      "--with-libevent=${libevent.dev}"
       "--with-libconfig=${libconfig}"
       "--with-opencl-icd-path=$out/etc/OpenCL/vendors"
       "--enable-user-install"
diff --git a/pkgs/development/libraries/cyrus-sasl/default.nix b/pkgs/development/libraries/cyrus-sasl/default.nix
index f1cd9d526e4..366e5f613a9 100644
--- a/pkgs/development/libraries/cyrus-sasl/default.nix
+++ b/pkgs/development/libraries/cyrus-sasl/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     );
 
   configureFlags = [
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
   ];
 
   # Set this variable at build-time to make sure $out can be evaluated.
diff --git a/pkgs/development/libraries/dbus-glib/default.nix b/pkgs/development/libraries/dbus-glib/default.nix
index d06a919cada..376c4de3b5f 100644
--- a/pkgs/development/libraries/dbus-glib/default.nix
+++ b/pkgs/development/libraries/dbus-glib/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, expat, gettext, libiconv, dbus, glib }:
 
 stdenv.mkDerivation rec {
-  name = "dbus-glib-0.104";
+  name = "dbus-glib-0.106";
 
   src = fetchurl {
     url = "${meta.homepage}/releases/dbus-glib/${name}.tar.gz";
-    sha256 = "1xi1v1msz75qs0s4lkyf1psrksdppa3hwkg0mznc6gpw5flg3hdz";
+    sha256 = "0in0i6v68ixcy0ip28i84hdczf10ykq9x682qgcvls6gdmq552dk";
   };
 
   outputs = [ "dev" "out" "docdev" ];
diff --git a/pkgs/development/libraries/expat/CVE-2015-1283-refix.patch b/pkgs/development/libraries/expat/CVE-2015-1283-refix.patch
new file mode 100644
index 00000000000..db9747ea0b3
--- /dev/null
+++ b/pkgs/development/libraries/expat/CVE-2015-1283-refix.patch
@@ -0,0 +1,37 @@
+From 29a11774d8ebbafe8418b4a5ffb4cc1160b194a1 Mon Sep 17 00:00:00 2001
+From: Pascal Cuoq <cuoq@trust-in-soft.com>
+Date: Sun, 15 May 2016 09:05:46 +0200
+Subject: [PATCH] Avoid relying on undefined behavior in CVE-2015-1283 fix. It
+ does not really work: https://godbolt.org/g/Zl8gdF
+
+---
+ expat/lib/xmlparse.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 13e080d..cdb12ef 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -1693,7 +1693,8 @@ XML_GetBuffer(XML_Parser parser, int len)
+   }
+ 
+   if (len > bufferLim - bufferEnd) {
+-    int neededSize = len + (int)(bufferEnd - bufferPtr);
++    /* Do not invoke signed arithmetic overflow: */
++    int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr));
+     if (neededSize < 0) {
+       errorCode = XML_ERROR_NO_MEMORY;
+       return NULL;
+@@ -1725,7 +1726,8 @@ XML_GetBuffer(XML_Parser parser, int len)
+       if (bufferSize == 0)
+         bufferSize = INIT_BUFFER_SIZE;
+       do {
+-        bufferSize *= 2;
++        /* Do not invoke signed arithmetic overflow: */
++        bufferSize = (int) (2U * (unsigned) bufferSize);
+       } while (bufferSize < neededSize && bufferSize > 0);
+       if (bufferSize <= 0) {
+         errorCode = XML_ERROR_NO_MEMORY;
+-- 
+2.8.2
+
diff --git a/pkgs/development/libraries/expat/CVE-2015-1283.patch b/pkgs/development/libraries/expat/CVE-2015-1283.patch
deleted file mode 100644
index 33b975912d4..00000000000
--- a/pkgs/development/libraries/expat/CVE-2015-1283.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-Found at https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c on 2015-07-27.  Modified: replaced path parser/expat/lib/xmlparse.c with lib/xmlparse.c.
-diff --git a/lib/xmlparse.c b/lib/xmlparse.c
---- a/lib/xmlparse.c
-+++ b/lib/xmlparse.c
-@@ -1646,29 +1646,40 @@ XML_ParseBuffer(XML_Parser parser, int l
-   XmlUpdatePosition(encoding, positionPtr, bufferPtr, &position);
-   positionPtr = bufferPtr;
-   return result;
- }
- 
- void * XMLCALL
- XML_GetBuffer(XML_Parser parser, int len)
- {
-+/* BEGIN MOZILLA CHANGE (sanity check len) */
-+  if (len < 0) {
-+    errorCode = XML_ERROR_NO_MEMORY;
-+    return NULL;
-+  }
-+/* END MOZILLA CHANGE */
-   switch (ps_parsing) {
-   case XML_SUSPENDED:
-     errorCode = XML_ERROR_SUSPENDED;
-     return NULL;
-   case XML_FINISHED:
-     errorCode = XML_ERROR_FINISHED;
-     return NULL;
-   default: ;
-   }
- 
-   if (len > bufferLim - bufferEnd) {
--    /* FIXME avoid integer overflow */
-     int neededSize = len + (int)(bufferEnd - bufferPtr);
-+/* BEGIN MOZILLA CHANGE (sanity check neededSize) */
-+    if (neededSize < 0) {
-+      errorCode = XML_ERROR_NO_MEMORY;
-+      return NULL;
-+    }
-+/* END MOZILLA CHANGE */
- #ifdef XML_CONTEXT_BYTES
-     int keep = (int)(bufferPtr - buffer);
- 
-     if (keep > XML_CONTEXT_BYTES)
-       keep = XML_CONTEXT_BYTES;
-     neededSize += keep;
- #endif  /* defined XML_CONTEXT_BYTES */
-     if (neededSize  <= bufferLim - buffer) {
-@@ -1687,17 +1698,25 @@ XML_GetBuffer(XML_Parser parser, int len
-     }
-     else {
-       char *newBuf;
-       int bufferSize = (int)(bufferLim - bufferPtr);
-       if (bufferSize == 0)
-         bufferSize = INIT_BUFFER_SIZE;
-       do {
-         bufferSize *= 2;
--      } while (bufferSize < neededSize);
-+/* BEGIN MOZILLA CHANGE (prevent infinite loop on overflow) */
-+      } while (bufferSize < neededSize && bufferSize > 0);
-+/* END MOZILLA CHANGE */
-+/* BEGIN MOZILLA CHANGE (sanity check bufferSize) */
-+      if (bufferSize <= 0) {
-+        errorCode = XML_ERROR_NO_MEMORY;
-+        return NULL;
-+      }
-+/* END MOZILLA CHANGE */
-       newBuf = (char *)MALLOC(bufferSize);
-       if (newBuf == 0) {
-         errorCode = XML_ERROR_NO_MEMORY;
-         return NULL;
-       }
-       bufferLim = newBuf + bufferSize;
- #ifdef XML_CONTEXT_BYTES
-       if (bufferPtr) {
-
-
-
-
diff --git a/pkgs/development/libraries/expat/CVE-2016-0718-v2-2-1.patch b/pkgs/development/libraries/expat/CVE-2016-0718-v2-2-1.patch
new file mode 100644
index 00000000000..92ff2682684
--- /dev/null
+++ b/pkgs/development/libraries/expat/CVE-2016-0718-v2-2-1.patch
@@ -0,0 +1,755 @@
+From cdfcb1b5c95e93b00ae9e9d25708b4a3bee72c15 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Mon, 2 May 2016 00:02:44 +0200
+Subject: [PATCH] Address CVE-2016-0718 (/patch/ version 2.2.1)
+
+* Out of bounds memory access when doing text conversion on malformed input
+* Integer overflow related to memory allocation
+
+Reported by Gustavo Grieco
+
+Patch credits go to
+* Christian Heimes
+* Karl Waclawek
+* Gustavo Grieco
+* Sebastian Pipping
+* Pascal Cuoq
+---
+ expat/lib/xmlparse.c    |  34 +++++++++-----
+ expat/lib/xmltok.c      | 115 +++++++++++++++++++++++++++++++++++-------------
+ expat/lib/xmltok.h      |  10 ++++-
+ expat/lib/xmltok_impl.c |  62 +++++++++++++-------------
+ 4 files changed, 146 insertions(+), 75 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index e308c79..13e080d 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -2426,11 +2426,11 @@ doContent(XML_Parser parser,
+           for (;;) {
+             int bufSize;
+             int convLen;
+-            XmlConvert(enc,
++            const enum XML_Convert_Result convert_res = XmlConvert(enc,
+                        &fromPtr, rawNameEnd,
+                        (ICHAR **)&toPtr, (ICHAR *)tag->bufEnd - 1);
+             convLen = (int)(toPtr - (XML_Char *)tag->buf);
+-            if (fromPtr == rawNameEnd) {
++            if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) {
+               tag->name.strLen = convLen;
+               break;
+             }
+@@ -2651,11 +2651,11 @@ doContent(XML_Parser parser,
+           if (MUST_CONVERT(enc, s)) {
+             for (;;) {
+               ICHAR *dataPtr = (ICHAR *)dataBuf;
+-              XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
++              const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
+               *eventEndPP = s;
+               charDataHandler(handlerArg, dataBuf,
+                               (int)(dataPtr - (ICHAR *)dataBuf));
+-              if (s == next)
++              if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+                 break;
+               *eventPP = s;
+             }
+@@ -3261,11 +3261,11 @@ doCdataSection(XML_Parser parser,
+           if (MUST_CONVERT(enc, s)) {
+             for (;;) {
+               ICHAR *dataPtr = (ICHAR *)dataBuf;
+-              XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
++              const enum XML_Convert_Result convert_res = XmlConvert(enc, &s, next, &dataPtr, (ICHAR *)dataBufEnd);
+               *eventEndPP = next;
+               charDataHandler(handlerArg, dataBuf,
+                               (int)(dataPtr - (ICHAR *)dataBuf));
+-              if (s == next)
++              if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+                 break;
+               *eventPP = s;
+             }
+@@ -5342,6 +5342,7 @@ reportDefault(XML_Parser parser, const ENCODING *enc,
+               const char *s, const char *end)
+ {
+   if (MUST_CONVERT(enc, s)) {
++    enum XML_Convert_Result convert_res;
+     const char **eventPP;
+     const char **eventEndPP;
+     if (enc == encoding) {
+@@ -5354,11 +5355,11 @@ reportDefault(XML_Parser parser, const ENCODING *enc,
+     }
+     do {
+       ICHAR *dataPtr = (ICHAR *)dataBuf;
+-      XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
++      convert_res = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)dataBufEnd);
+       *eventEndPP = s;
+       defaultHandler(handlerArg, dataBuf, (int)(dataPtr - (ICHAR *)dataBuf));
+       *eventPP = s;
+-    } while (s != end);
++    } while ((convert_res != XML_CONVERT_COMPLETED) && (convert_res != XML_CONVERT_INPUT_INCOMPLETE));
+   }
+   else
+     defaultHandler(handlerArg, (XML_Char *)s, (int)((XML_Char *)end - (XML_Char *)s));
+@@ -6163,8 +6164,8 @@ poolAppend(STRING_POOL *pool, const ENCODING *enc,
+   if (!pool->ptr && !poolGrow(pool))
+     return NULL;
+   for (;;) {
+-    XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
+-    if (ptr == end)
++    const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
++    if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+       break;
+     if (!poolGrow(pool))
+       return NULL;
+@@ -6248,8 +6249,13 @@ poolGrow(STRING_POOL *pool)
+     }
+   }
+   if (pool->blocks && pool->start == pool->blocks->s) {
+-    int blockSize = (int)(pool->end - pool->start)*2;
+-    BLOCK *temp = (BLOCK *)
++    BLOCK *temp;
++    int blockSize = (int)((unsigned)(pool->end - pool->start)*2U);
++
++    if (blockSize < 0)
++      return XML_FALSE;
++
++    temp = (BLOCK *)
+       pool->mem->realloc_fcn(pool->blocks,
+                              (offsetof(BLOCK, s)
+                               + blockSize * sizeof(XML_Char)));
+@@ -6264,6 +6270,10 @@ poolGrow(STRING_POOL *pool)
+   else {
+     BLOCK *tem;
+     int blockSize = (int)(pool->end - pool->start);
++
++    if (blockSize < 0)
++      return XML_FALSE;
++
+     if (blockSize < INIT_BLOCK_SIZE)
+       blockSize = INIT_BLOCK_SIZE;
+     else
+diff --git a/lib/xmltok.c b/lib/xmltok.c
+index bf09dfc..cb98ce1 100644
+--- a/lib/xmltok.c
++++ b/lib/xmltok.c
+@@ -318,39 +318,55 @@ enum {  /* UTF8_cvalN is value of masked first byte of N byte sequence */
+   UTF8_cval4 = 0xf0
+ };
+ 
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ utf8_toUtf8(const ENCODING *enc,
+             const char **fromP, const char *fromLim,
+             char **toP, const char *toLim)
+ {
++  enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
+   char *to;
+   const char *from;
+   if (fromLim - *fromP > toLim - *toP) {
+     /* Avoid copying partial characters. */
++    res = XML_CONVERT_OUTPUT_EXHAUSTED;
+     for (fromLim = *fromP + (toLim - *toP); fromLim > *fromP; fromLim--)
+       if (((unsigned char)fromLim[-1] & 0xc0) != 0x80)
+         break;
+   }
+-  for (to = *toP, from = *fromP; from != fromLim; from++, to++)
++  for (to = *toP, from = *fromP; (from < fromLim) && (to < toLim); from++, to++)
+     *to = *from;
+   *fromP = from;
+   *toP = to;
++
++  if ((to == toLim) && (from < fromLim))
++    return XML_CONVERT_OUTPUT_EXHAUSTED;
++  else
++    return res;
+ }
+ 
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ utf8_toUtf16(const ENCODING *enc,
+              const char **fromP, const char *fromLim,
+              unsigned short **toP, const unsigned short *toLim)
+ {
++  enum XML_Convert_Result res = XML_CONVERT_COMPLETED;
+   unsigned short *to = *toP;
+   const char *from = *fromP;
+-  while (from != fromLim && to != toLim) {
++  while (from < fromLim && to < toLim) {
+     switch (((struct normal_encoding *)enc)->type[(unsigned char)*from]) {
+     case BT_LEAD2:
++      if (fromLim - from < 2) {
++        res = XML_CONVERT_INPUT_INCOMPLETE;
++        break;
++      }
+       *to++ = (unsigned short)(((from[0] & 0x1f) << 6) | (from[1] & 0x3f));
+       from += 2;
+       break;
+     case BT_LEAD3:
++      if (fromLim - from < 3) {
++        res = XML_CONVERT_INPUT_INCOMPLETE;
++        break;
++      }
+       *to++ = (unsigned short)(((from[0] & 0xf) << 12)
+                                | ((from[1] & 0x3f) << 6) | (from[2] & 0x3f));
+       from += 3;
+@@ -358,8 +374,14 @@ utf8_toUtf16(const ENCODING *enc,
+     case BT_LEAD4:
+       {
+         unsigned long n;
+-        if (to + 1 == toLim)
++        if (toLim - to < 2) {
++          res = XML_CONVERT_OUTPUT_EXHAUSTED;
+           goto after;
++        }
++        if (fromLim - from < 4) {
++          res = XML_CONVERT_INPUT_INCOMPLETE;
++          goto after;
++        }
+         n = ((from[0] & 0x7) << 18) | ((from[1] & 0x3f) << 12)
+             | ((from[2] & 0x3f) << 6) | (from[3] & 0x3f);
+         n -= 0x10000;
+@@ -377,6 +399,7 @@ utf8_toUtf16(const ENCODING *enc,
+ after:
+   *fromP = from;
+   *toP = to;
++  return res;
+ }
+ 
+ #ifdef XML_NS
+@@ -425,7 +448,7 @@ static const struct normal_encoding internal_utf8_encoding = {
+   STANDARD_VTABLE(sb_) NORMAL_VTABLE(utf8_)
+ };
+ 
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ latin1_toUtf8(const ENCODING *enc,
+               const char **fromP, const char *fromLim,
+               char **toP, const char *toLim)
+@@ -433,30 +456,35 @@ latin1_toUtf8(const ENCODING *enc,
+   for (;;) {
+     unsigned char c;
+     if (*fromP == fromLim)
+-      break;
++      return XML_CONVERT_COMPLETED;
+     c = (unsigned char)**fromP;
+     if (c & 0x80) {
+       if (toLim - *toP < 2)
+-        break;
++        return XML_CONVERT_OUTPUT_EXHAUSTED;
+       *(*toP)++ = (char)((c >> 6) | UTF8_cval2);
+       *(*toP)++ = (char)((c & 0x3f) | 0x80);
+       (*fromP)++;
+     }
+     else {
+       if (*toP == toLim)
+-        break;
++        return XML_CONVERT_OUTPUT_EXHAUSTED;
+       *(*toP)++ = *(*fromP)++;
+     }
+   }
+ }
+ 
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ latin1_toUtf16(const ENCODING *enc,
+                const char **fromP, const char *fromLim,
+                unsigned short **toP, const unsigned short *toLim)
+ {
+-  while (*fromP != fromLim && *toP != toLim)
++  while (*fromP < fromLim && *toP < toLim)
+     *(*toP)++ = (unsigned char)*(*fromP)++;
++
++  if ((*toP == toLim) && (*fromP < fromLim))
++    return XML_CONVERT_OUTPUT_EXHAUSTED;
++  else
++    return XML_CONVERT_COMPLETED;
+ }
+ 
+ #ifdef XML_NS
+@@ -483,13 +511,18 @@ static const struct normal_encoding latin1_encoding = {
+   STANDARD_VTABLE(sb_)
+ };
+ 
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ ascii_toUtf8(const ENCODING *enc,
+              const char **fromP, const char *fromLim,
+              char **toP, const char *toLim)
+ {
+-  while (*fromP != fromLim && *toP != toLim)
++  while (*fromP < fromLim && *toP < toLim)
+     *(*toP)++ = *(*fromP)++;
++
++  if ((*toP == toLim) && (*fromP < fromLim))
++    return XML_CONVERT_OUTPUT_EXHAUSTED;
++  else
++    return XML_CONVERT_COMPLETED;
+ }
+ 
+ #ifdef XML_NS
+@@ -536,13 +569,14 @@ unicode_byte_type(char hi, char lo)
+ }
+ 
+ #define DEFINE_UTF16_TO_UTF8(E) \
+-static void  PTRCALL \
++static enum XML_Convert_Result  PTRCALL \
+ E ## toUtf8(const ENCODING *enc, \
+             const char **fromP, const char *fromLim, \
+             char **toP, const char *toLim) \
+ { \
+-  const char *from; \
+-  for (from = *fromP; from != fromLim; from += 2) { \
++  const char *from = *fromP; \
++  fromLim = from + (((fromLim - from) >> 1) << 1);  /* shrink to even */ \
++  for (; from < fromLim; from += 2) { \
+     int plane; \
+     unsigned char lo2; \
+     unsigned char lo = GET_LO(from); \
+@@ -552,7 +586,7 @@ E ## toUtf8(const ENCODING *enc, \
+       if (lo < 0x80) { \
+         if (*toP == toLim) { \
+           *fromP = from; \
+-          return; \
++          return XML_CONVERT_OUTPUT_EXHAUSTED; \
+         } \
+         *(*toP)++ = lo; \
+         break; \
+@@ -562,7 +596,7 @@ E ## toUtf8(const ENCODING *enc, \
+     case 0x4: case 0x5: case 0x6: case 0x7: \
+       if (toLim -  *toP < 2) { \
+         *fromP = from; \
+-        return; \
++        return XML_CONVERT_OUTPUT_EXHAUSTED; \
+       } \
+       *(*toP)++ = ((lo >> 6) | (hi << 2) |  UTF8_cval2); \
+       *(*toP)++ = ((lo & 0x3f) | 0x80); \
+@@ -570,7 +604,7 @@ E ## toUtf8(const ENCODING *enc, \
+     default: \
+       if (toLim -  *toP < 3)  { \
+         *fromP = from; \
+-        return; \
++        return XML_CONVERT_OUTPUT_EXHAUSTED; \
+       } \
+       /* 16 bits divided 4, 6, 6 amongst 3 bytes */ \
+       *(*toP)++ = ((hi >> 4) | UTF8_cval3); \
+@@ -580,7 +614,11 @@ E ## toUtf8(const ENCODING *enc, \
+     case 0xD8: case 0xD9: case 0xDA: case 0xDB: \
+       if (toLim -  *toP < 4) { \
+         *fromP = from; \
+-        return; \
++        return XML_CONVERT_OUTPUT_EXHAUSTED; \
++      } \
++      if (fromLim - from < 4) { \
++        *fromP = from; \
++        return XML_CONVERT_INPUT_INCOMPLETE; \
+       } \
+       plane = (((hi & 0x3) << 2) | ((lo >> 6) & 0x3)) + 1; \
+       *(*toP)++ = ((plane >> 2) | UTF8_cval4); \
+@@ -596,20 +634,32 @@ E ## toUtf8(const ENCODING *enc, \
+     } \
+   } \
+   *fromP = from; \
++  if (from < fromLim) \
++    return XML_CONVERT_INPUT_INCOMPLETE; \
++  else \
++    return XML_CONVERT_COMPLETED; \
+ }
+ 
+ #define DEFINE_UTF16_TO_UTF16(E) \
+-static void  PTRCALL \
++static enum XML_Convert_Result  PTRCALL \
+ E ## toUtf16(const ENCODING *enc, \
+              const char **fromP, const char *fromLim, \
+              unsigned short **toP, const unsigned short *toLim) \
+ { \
++  enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \
++  fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1);  /* shrink to even */ \
+   /* Avoid copying first half only of surrogate */ \
+   if (fromLim - *fromP > ((toLim - *toP) << 1) \
+-      && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) \
++      && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \
+     fromLim -= 2; \
+-  for (; *fromP != fromLim && *toP != toLim; *fromP += 2) \
++    res = XML_CONVERT_INPUT_INCOMPLETE; \
++  } \
++  for (; *fromP < fromLim && *toP < toLim; *fromP += 2) \
+     *(*toP)++ = (GET_HI(*fromP) << 8) | GET_LO(*fromP); \
++  if ((*toP == toLim) && (*fromP < fromLim)) \
++    return XML_CONVERT_OUTPUT_EXHAUSTED; \
++  else \
++    return res; \
+ }
+ 
+ #define SET2(ptr, ch) \
+@@ -1288,7 +1338,7 @@ unknown_isInvalid(const ENCODING *enc, const char *p)
+   return (c & ~0xFFFF) || checkCharRefNumber(c) < 0;
+ }
+ 
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ unknown_toUtf8(const ENCODING *enc,
+                const char **fromP, const char *fromLim,
+                char **toP, const char *toLim)
+@@ -1299,21 +1349,21 @@ unknown_toUtf8(const ENCODING *enc,
+     const char *utf8;
+     int n;
+     if (*fromP == fromLim)
+-      break;
++      return XML_CONVERT_COMPLETED;
+     utf8 = uenc->utf8[(unsigned char)**fromP];
+     n = *utf8++;
+     if (n == 0) {
+       int c = uenc->convert(uenc->userData, *fromP);
+       n = XmlUtf8Encode(c, buf);
+       if (n > toLim - *toP)
+-        break;
++        return XML_CONVERT_OUTPUT_EXHAUSTED;
+       utf8 = buf;
+       *fromP += (AS_NORMAL_ENCODING(enc)->type[(unsigned char)**fromP]
+                  - (BT_LEAD2 - 2));
+     }
+     else {
+       if (n > toLim - *toP)
+-        break;
++        return XML_CONVERT_OUTPUT_EXHAUSTED;
+       (*fromP)++;
+     }
+     do {
+@@ -1322,13 +1372,13 @@ unknown_toUtf8(const ENCODING *enc,
+   }
+ }
+ 
+-static void PTRCALL
++static enum XML_Convert_Result PTRCALL
+ unknown_toUtf16(const ENCODING *enc,
+                 const char **fromP, const char *fromLim,
+                 unsigned short **toP, const unsigned short *toLim)
+ {
+   const struct unknown_encoding *uenc = AS_UNKNOWN_ENCODING(enc);
+-  while (*fromP != fromLim && *toP != toLim) {
++  while (*fromP < fromLim && *toP < toLim) {
+     unsigned short c = uenc->utf16[(unsigned char)**fromP];
+     if (c == 0) {
+       c = (unsigned short)
+@@ -1340,6 +1390,11 @@ unknown_toUtf16(const ENCODING *enc,
+       (*fromP)++;
+     *(*toP)++ = c;
+   }
++
++  if ((*toP == toLim) && (*fromP < fromLim))
++    return XML_CONVERT_OUTPUT_EXHAUSTED;
++  else
++    return XML_CONVERT_COMPLETED;
+ }
+ 
+ ENCODING *
+@@ -1503,7 +1558,7 @@ initScan(const ENCODING * const *encodingTable,
+ {
+   const ENCODING **encPtr;
+ 
+-  if (ptr == end)
++  if (ptr >= end)
+     return XML_TOK_NONE;
+   encPtr = enc->encPtr;
+   if (ptr + 1 == end) {
+diff --git a/lib/xmltok.h b/lib/xmltok.h
+index ca867aa..752007e 100644
+--- a/lib/xmltok.h
++++ b/lib/xmltok.h
+@@ -130,6 +130,12 @@ typedef int (PTRCALL *SCANNER)(const ENCODING *,
+                                const char *,
+                                const char **);
+ 
++enum XML_Convert_Result {
++  XML_CONVERT_COMPLETED = 0,
++  XML_CONVERT_INPUT_INCOMPLETE = 1,
++  XML_CONVERT_OUTPUT_EXHAUSTED = 2  /* and therefore potentially input remaining as well */
++};
++
+ struct encoding {
+   SCANNER scanners[XML_N_STATES];
+   SCANNER literalScanners[XML_N_LITERAL_TYPES];
+@@ -158,12 +164,12 @@ struct encoding {
+                             const char *ptr,
+                             const char *end,
+                             const char **badPtr);
+-  void (PTRCALL *utf8Convert)(const ENCODING *enc,
++  enum XML_Convert_Result (PTRCALL *utf8Convert)(const ENCODING *enc,
+                               const char **fromP,
+                               const char *fromLim,
+                               char **toP,
+                               const char *toLim);
+-  void (PTRCALL *utf16Convert)(const ENCODING *enc,
++  enum XML_Convert_Result (PTRCALL *utf16Convert)(const ENCODING *enc,
+                                const char **fromP,
+                                const char *fromLim,
+                                unsigned short **toP,
+diff --git a/lib/xmltok_impl.c b/lib/xmltok_impl.c
+index 9c2895b..6c5a3ba 100644
+--- a/lib/xmltok_impl.c
++++ b/lib/xmltok_impl.c
+@@ -93,13 +93,13 @@ static int PTRCALL
+ PREFIX(scanComment)(const ENCODING *enc, const char *ptr,
+                     const char *end, const char **nextTokPtr)
+ {
+-  if (ptr != end) {
++  if (ptr < end) {
+     if (!CHAR_MATCHES(enc, ptr, ASCII_MINUS)) {
+       *nextTokPtr = ptr;
+       return XML_TOK_INVALID;
+     }
+     ptr += MINBPC(enc);
+-    while (ptr != end) {
++    while (ptr < end) {
+       switch (BYTE_TYPE(enc, ptr)) {
+       INVALID_CASES(ptr, nextTokPtr)
+       case BT_MINUS:
+@@ -147,7 +147,7 @@ PREFIX(scanDecl)(const ENCODING *enc, const char *ptr,
+     *nextTokPtr = ptr;
+     return XML_TOK_INVALID;
+   }
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     case BT_PERCNT:
+       if (ptr + MINBPC(enc) == end)
+@@ -233,7 +233,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
+     *nextTokPtr = ptr;
+     return XML_TOK_INVALID;
+   }
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+     case BT_S: case BT_CR: case BT_LF:
+@@ -242,7 +242,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr,
+         return XML_TOK_INVALID;
+       }
+       ptr += MINBPC(enc);
+-      while (ptr != end) {
++      while (ptr < end) {
+         switch (BYTE_TYPE(enc, ptr)) {
+         INVALID_CASES(ptr, nextTokPtr)
+         case BT_QUEST:
+@@ -305,7 +305,7 @@ static int PTRCALL
+ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
+                         const char *end, const char **nextTokPtr)
+ {
+-  if (ptr == end)
++  if (ptr >= end)
+     return XML_TOK_NONE;
+   if (MINBPC(enc) > 1) {
+     size_t n = end - ptr;
+@@ -348,7 +348,7 @@ PREFIX(cdataSectionTok)(const ENCODING *enc, const char *ptr,
+     ptr += MINBPC(enc);
+     break;
+   }
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+     case BT_LEAD ## n: \
+@@ -391,11 +391,11 @@ PREFIX(scanEndTag)(const ENCODING *enc, const char *ptr,
+     *nextTokPtr = ptr;
+     return XML_TOK_INVALID;
+   }
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+     case BT_S: case BT_CR: case BT_LF:
+-      for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++      for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+         switch (BYTE_TYPE(enc, ptr)) {
+         case BT_S: case BT_CR: case BT_LF:
+           break;
+@@ -432,7 +432,7 @@ static int PTRCALL
+ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
+                        const char *end, const char **nextTokPtr)
+ {
+-  if (ptr != end) {
++  if (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     case BT_DIGIT:
+     case BT_HEX:
+@@ -441,7 +441,7 @@ PREFIX(scanHexCharRef)(const ENCODING *enc, const char *ptr,
+       *nextTokPtr = ptr;
+       return XML_TOK_INVALID;
+     }
+-    for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++    for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+       switch (BYTE_TYPE(enc, ptr)) {
+       case BT_DIGIT:
+       case BT_HEX:
+@@ -464,7 +464,7 @@ static int PTRCALL
+ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
+                     const char *end, const char **nextTokPtr)
+ {
+-  if (ptr != end) {
++  if (ptr < end) {
+     if (CHAR_MATCHES(enc, ptr, ASCII_x))
+       return PREFIX(scanHexCharRef)(enc, ptr + MINBPC(enc), end, nextTokPtr);
+     switch (BYTE_TYPE(enc, ptr)) {
+@@ -474,7 +474,7 @@ PREFIX(scanCharRef)(const ENCODING *enc, const char *ptr,
+       *nextTokPtr = ptr;
+       return XML_TOK_INVALID;
+     }
+-    for (ptr += MINBPC(enc); ptr != end; ptr += MINBPC(enc)) {
++    for (ptr += MINBPC(enc); ptr < end; ptr += MINBPC(enc)) {
+       switch (BYTE_TYPE(enc, ptr)) {
+       case BT_DIGIT:
+         break;
+@@ -506,7 +506,7 @@ PREFIX(scanRef)(const ENCODING *enc, const char *ptr, const char *end,
+     *nextTokPtr = ptr;
+     return XML_TOK_INVALID;
+   }
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+     case BT_SEMI:
+@@ -529,7 +529,7 @@ PREFIX(scanAtts)(const ENCODING *enc, const char *ptr, const char *end,
+ #ifdef XML_NS
+   int hadColon = 0;
+ #endif
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ #ifdef XML_NS
+@@ -716,7 +716,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
+   hadColon = 0;
+ #endif
+   /* we have a start-tag */
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+ #ifdef XML_NS
+@@ -740,7 +740,7 @@ PREFIX(scanLt)(const ENCODING *enc, const char *ptr, const char *end,
+     case BT_S: case BT_CR: case BT_LF:
+       {
+         ptr += MINBPC(enc);
+-        while (ptr != end) {
++        while (ptr < end) {
+           switch (BYTE_TYPE(enc, ptr)) {
+           CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
+           case BT_GT:
+@@ -785,7 +785,7 @@ static int PTRCALL
+ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
+                    const char **nextTokPtr)
+ {
+-  if (ptr == end)
++  if (ptr >= end)
+     return XML_TOK_NONE;
+   if (MINBPC(enc) > 1) {
+     size_t n = end - ptr;
+@@ -832,7 +832,7 @@ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
+     ptr += MINBPC(enc);
+     break;
+   }
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+     case BT_LEAD ## n: \
+@@ -895,7 +895,7 @@ PREFIX(scanPercent)(const ENCODING *enc, const char *ptr, const char *end,
+     *nextTokPtr = ptr;
+     return XML_TOK_INVALID;
+   }
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+     case BT_SEMI:
+@@ -921,7 +921,7 @@ PREFIX(scanPoundName)(const ENCODING *enc, const char *ptr, const char *end,
+     *nextTokPtr = ptr;
+     return XML_TOK_INVALID;
+   }
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+     case BT_CR: case BT_LF: case BT_S:
+@@ -941,7 +941,7 @@ PREFIX(scanLit)(int open, const ENCODING *enc,
+                 const char *ptr, const char *end,
+                 const char **nextTokPtr)
+ {
+-  while (ptr != end) {
++  while (ptr < end) {
+     int t = BYTE_TYPE(enc, ptr);
+     switch (t) {
+     INVALID_CASES(ptr, nextTokPtr)
+@@ -973,7 +973,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
+                   const char **nextTokPtr)
+ {
+   int tok;
+-  if (ptr == end)
++  if (ptr >= end)
+     return XML_TOK_NONE;
+   if (MINBPC(enc) > 1) {
+     size_t n = end - ptr;
+@@ -1141,7 +1141,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
+     *nextTokPtr = ptr;
+     return XML_TOK_INVALID;
+   }
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
+     case BT_GT: case BT_RPAR: case BT_COMMA:
+@@ -1204,10 +1204,10 @@ PREFIX(attributeValueTok)(const ENCODING *enc, const char *ptr,
+                           const char *end, const char **nextTokPtr)
+ {
+   const char *start;
+-  if (ptr == end)
++  if (ptr >= end)
+     return XML_TOK_NONE;
+   start = ptr;
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+     case BT_LEAD ## n: ptr += n; break;
+@@ -1262,10 +1262,10 @@ PREFIX(entityValueTok)(const ENCODING *enc, const char *ptr,
+                        const char *end, const char **nextTokPtr)
+ {
+   const char *start;
+-  if (ptr == end)
++  if (ptr >= end)
+     return XML_TOK_NONE;
+   start = ptr;
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+ #define LEAD_CASE(n) \
+     case BT_LEAD ## n: ptr += n; break;
+@@ -1326,7 +1326,7 @@ PREFIX(ignoreSectionTok)(const ENCODING *enc, const char *ptr,
+       end = ptr + n;
+     }
+   }
+-  while (ptr != end) {
++  while (ptr < end) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     INVALID_CASES(ptr, nextTokPtr)
+     case BT_LT:
+@@ -1373,7 +1373,7 @@ PREFIX(isPublicId)(const ENCODING *enc, const char *ptr, const char *end,
+ {
+   ptr += MINBPC(enc);
+   end -= MINBPC(enc);
+-  for (; ptr != end; ptr += MINBPC(enc)) {
++  for (; ptr < end; ptr += MINBPC(enc)) {
+     switch (BYTE_TYPE(enc, ptr)) {
+     case BT_DIGIT:
+     case BT_HEX:
+@@ -1760,7 +1760,7 @@ PREFIX(updatePosition)(const ENCODING *enc,
+     case BT_CR:
+       pos->lineNumber++;
+       ptr += MINBPC(enc);
+-      if (ptr != end && BYTE_TYPE(enc, ptr) == BT_LF)
++      if (ptr < end && BYTE_TYPE(enc, ptr) == BT_LF)
+         ptr += MINBPC(enc);
+       pos->columnNumber = (XML_Size)-1;
+       break;
+-- 
+2.8.2
+
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index 774190278cb..1b663fc21a9 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -1,15 +1,13 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "expat-2.1.0";
+  name = "expat-2.1.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/expat/${name}.tar.gz";
-    sha256 = "11pblz61zyxh68s5pdcbhc30ha1b2vfjd83aiwfg4vc15x3hadw2";
+    url = "mirror://sourceforge/expat/${name}.tar.bz2";
+    sha256 = "0ryyjgvy7jq0qb7a9mhc1giy3bzn56aiwrs8dpydqngplbjq9xdg";
   };
 
-  patches = [ ./CVE-2015-1283.patch ];
-
   outputs = [ "dev" "out" ]; # TODO: fix referrers
   outputBin = "dev";
 
@@ -17,6 +15,10 @@ stdenv.mkDerivation rec {
 
   outputMan = "dev"; # tiny page for a dev tool
 
+  patches = [ ./CVE-2015-1283-refix.patch ./CVE-2016-0718-v2-2-1.patch ];
+
+  doCheck = true;
+
   meta = with stdenv.lib; {
     homepage = http://www.libexpat.org/;
     description = "A stream-oriented XML parser library written in C";
diff --git a/pkgs/development/libraries/fltk/default.nix b/pkgs/development/libraries/fltk/default.nix
index 6398e5542ac..772ea2030c2 100644
--- a/pkgs/development/libraries/fltk/default.nix
+++ b/pkgs/development/libraries/fltk/default.nix
@@ -1,19 +1,29 @@
-{ composableDerivation, fetchurl, pkgconfig, xlibsWrapper, inputproto, libXi
-, freeglut, mesa, libjpeg, zlib, libXinerama, libXft, libpng }:
+{ stdenv, composableDerivation, fetchurl, pkgconfig, xlibsWrapper, inputproto, libXi
+, freeglut, mesa, libjpeg, zlib, libXinerama, libXft, libpng
+, cfg ? {}
+}:
 
 let inherit (composableDerivation) edf; in
 
-composableDerivation.composableDerivation {} rec {
-  name = "fltk-2.0.x-alpha-r9296";
+let version = "1.3.3"; in
+composableDerivation.composableDerivation {} {
+  name = "fltk-${version}";
 
   src = fetchurl {
-    url = "ftp://ftp.easysw.com/pub/fltk/snapshots/${name}.tar.bz2";
-    sha256 = "0353ngb7gpyklc9mdz8629big2na3c73akfwhis8fhqp7jkbs9ih";
+    url = "http://fltk.org/pub/fltk/${version}/fltk-${version}-source.tar.gz";
+    sha256 = "15qd7lkz5d5ynz70xhxhigpz3wns39v9xcf7ggkl0792syc8sfgq";
   };
 
+  # http://www.fltk.org/str.php?L3156
+  postPatch = ''
+    substituteInPlace FL/x.H \
+      --replace 'class Fl_XFont_On_Demand' 'class FL_EXPORT Fl_XFont_On_Demand'
+  '';
+
+  nativeBuildInputs = [ pkgconfig ];
   propagatedBuildInputs = [ xlibsWrapper inputproto libXi freeglut ];
 
-  buildInputs = [ pkgconfig ];
+  enableParallelBuilding = true;
 
   flags =
     # this could be tidied up (?).. eg why does it require freeglut without glSupport?
@@ -39,10 +49,15 @@ composableDerivation.composableDerivation {} rec {
     localpngSupport = false;
     sharedSupport = true;
     threadsSupport = true;
-  };
+    xftSupport = true;
+  } // cfg;
 
   meta = {
-    description = "a C++ cross platform lightweight gui library binding";
+    description = "A C++ cross-platform lightweight GUI library";
     homepage = http://www.fltk.org;
+    platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.gpl2;
   };
+
 }
+
diff --git a/pkgs/development/libraries/fltk/fltk13.nix b/pkgs/development/libraries/fltk/fltk13.nix
deleted file mode 100644
index cb71724a360..00000000000
--- a/pkgs/development/libraries/fltk/fltk13.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-{ composableDerivation, fetchurl, pkgconfig, xlibsWrapper, inputproto, libXi
-, freeglut, mesa, libjpeg, zlib, libXinerama, libXft, libpng
-, cfg ? {}
-, automake, autoconf, libtool
-}:
-
-let inherit (composableDerivation) edf; in
-
-let version = "1.3.3"; in
-composableDerivation.composableDerivation {} {
-  name = "fltk-${version}";
-
-  src = fetchurl {
-    url = "http://fltk.org/pub/fltk/${version}/fltk-${version}-source.tar.gz";
-    sha256 = "15qd7lkz5d5ynz70xhxhigpz3wns39v9xcf7ggkl0792syc8sfgq";
-  };
-
-  # http://www.fltk.org/str.php?L3156
-  postPatch = ''
-    substituteInPlace FL/x.H \
-      --replace 'class Fl_XFont_On_Demand' 'class FL_EXPORT Fl_XFont_On_Demand'
-  '';
-
-  propagatedBuildInputs = [ xlibsWrapper inputproto libXi freeglut ];
-
-  enableParallelBilding = true;
-
-  nativeBuildInputs = [
-    pkgconfig
-    automake autoconf libtool # only required because of patch
-  ];
-
-  flags =
-    # this could be tidied up (?).. eg why does it require freeglut without glSupport?
-    edf { name = "cygwin"; }  #         use the CygWin libraries default=no
-    // edf { name = "debug"; }  #          turn on debugging default=no
-    // edf { name = "gl"; enable = { buildInputs = [ mesa ]; }; }  #             turn on OpenGL support default=yes
-    // edf { name = "shared"; }  #         turn on shared libraries default=no
-    // edf { name = "threads"; }  #        enable multi-threading support
-    // edf { name = "quartz"; enable = { buildInputs = "quartz"; }; }  # don't konw yet what quartz is #         use Quartz instead of Quickdraw (default=no)
-    // edf { name = "largefile"; } #     omit support for large files
-    // edf { name = "localjpeg"; disable = { buildInputs = [libjpeg]; }; } #       use local JPEG library, default=auto
-    // edf { name = "localzlib"; disable = { buildInputs = [zlib]; }; } #       use local ZLIB library, default=auto
-    // edf { name = "localpng"; disable = { buildInputs = [libpng]; }; } #       use local PNG library, default=auto
-    // edf { name = "xinerama"; enable = { buildInputs = [libXinerama]; }; } #       turn on Xinerama support default=no
-    // edf { name = "xft"; enable = { buildInputs=[libXft]; }; } #            turn on Xft support default=no
-    // edf { name = "xdbe"; };  #           turn on Xdbe support default=no
-
-  cfg = {
-    largefileSupport = true; # is default
-    glSupport = true; # doesn't build without it. Why?
-    localjpegSupport = false;
-    localzlibSupport = false;
-    localpngSupport = false;
-    sharedSupport = true;
-    threadsSupport = true;
-  } // cfg;
-
-  meta = {
-    description = "A C++ cross-platform light-weight GUI library binding";
-    homepage = http://www.fltk.org;
-  };
-
-  patches = [
-     ];
-}
diff --git a/pkgs/development/libraries/gd/CVE-2016-3074.patch b/pkgs/development/libraries/gd/CVE-2016-3074.patch
deleted file mode 100644
index 76994697729..00000000000
--- a/pkgs/development/libraries/gd/CVE-2016-3074.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/gd_gd2.c b/src/gd_gd2.c
-index 6f28461..a50b33d 100644
---- a/src/gd_gd2.c
-+++ b/src/gd_gd2.c
-@@ -165,6 +165,8 @@ _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy,
- 			if (gdGetInt (&cidx[i].size, in) != 1) {
- 				goto fail2;
- 			};
-+			if (cidx[i].offset < 0 || cidx[i].size < 0)
-+				goto fail2;
- 		};
- 		*chunkIdx = cidx;
- 	};
diff --git a/pkgs/development/libraries/gd/default.nix b/pkgs/development/libraries/gd/default.nix
index 47218a803c0..94dae10db3d 100644
--- a/pkgs/development/libraries/gd/default.nix
+++ b/pkgs/development/libraries/gd/default.nix
@@ -3,6 +3,7 @@
 , zlib
 , libjpeg
 , libpng
+, libwebp
 , libtiff ? null
 , libXpm ? null
 , fontconfig
@@ -11,21 +12,21 @@
 
 stdenv.mkDerivation rec {
   name = "gd-${version}";
-  version = "2.1.1";
+  version = "2.2.1";
 
   src = fetchurl {
     url = "https://github.com/libgd/libgd/releases/download/${name}/libgd-${version}.tar.xz";
-    sha256 = "11djy9flzxczphigqgp7fbbblbq35gqwwhn9xfcckawlapa1xnls";
+    sha256 = "0xmrqka1ggqgml84xbmkw1y0r0lg7qn657v5b1my8pry92p651vh";
   };
 
-  patches = [
-    ./CVE-2016-3074.patch
-  ];
-
   hardeningDisable = [ "format" ];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ zlib fontconfig freetype libjpeg libpng libtiff libXpm ];
+  buildInputs = [ zlib fontconfig freetype libjpeg libpng libwebp libtiff libXpm ];
+
+  outputs = [ "dev" "out" "bin" ];
+
+  postFixup = ''moveToOutput "bin/gdlib-config" $dev'';
 
   meta = with stdenv.lib; {
     homepage = https://libgd.github.io/;
diff --git a/pkgs/development/libraries/gdal/default.nix b/pkgs/development/libraries/gdal/default.nix
index 8f00bee8911..a748bb9ac8f 100644
--- a/pkgs/development/libraries/gdal/default.nix
+++ b/pkgs/development/libraries/gdal/default.nix
@@ -31,10 +31,10 @@ composableDerivation.composableDerivation {} (fixed: rec {
   preConfigure = "export CFLAGS=-O0 CXXFLAGS=-O0; unset CC CXX";
 
   configureFlags = [
-    "--with-jpeg=${libjpeg}"
-    "--with-libtiff=${libtiff}" # optional (without largetiff support)
-    "--with-libpng=${libpng}"   # optional
-    "--with-libz=${zlib}"       # optional
+    "--with-jpeg=${libjpeg.dev}"
+    "--with-libtiff=${libtiff.dev}" # optional (without largetiff support)
+    "--with-libpng=${libpng.dev}"   # optional
+    "--with-libz=${zlib.dev}"       # optional
 
     "--with-pg=${postgresql}/bin/pg_config"
     "--with-mysql=${mysql.lib}/bin/mysql_config"
diff --git a/pkgs/development/libraries/gdal/gdal-1_11.nix b/pkgs/development/libraries/gdal/gdal-1_11.nix
index 2640159725a..b62f87c2a21 100644
--- a/pkgs/development/libraries/gdal/gdal-1_11.nix
+++ b/pkgs/development/libraries/gdal/gdal-1_11.nix
@@ -26,10 +26,10 @@ composableDerivation.composableDerivation {} (fixed: rec {
   preConfigure = "export CFLAGS=-O0 CXXFLAGS=-O0; unset CC CXX";
 
   configureFlags = [
-    "--with-jpeg=${libjpeg}"
-    "--with-libtiff=${libtiff}" # optional (without largetiff support)
-    "--with-libpng=${libpng}"   # optional
-    "--with-libz=${zlib}"       # optional
+    "--with-jpeg=${libjpeg.dev}"
+    "--with-libtiff=${libtiff.dev}" # optional (without largetiff support)
+    "--with-libpng=${libpng.dev}"   # optional
+    "--with-libz=${zlib.dev}"       # optional
 
     "--with-pg=${postgresql}/bin/pg_config"
     "--with-mysql=${mysql.lib}/bin/mysql_config"
diff --git a/pkgs/development/libraries/ggz_base_libs/default.nix b/pkgs/development/libraries/ggz_base_libs/default.nix
index 5e3adb0ace2..631160487d8 100644
--- a/pkgs/development/libraries/ggz_base_libs/default.nix
+++ b/pkgs/development/libraries/ggz_base_libs/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ intltool openssl expat libgcrypt ];
 
   configureFlags = [
-    "--with-ssl-dir=${openssl}/"
+    "--with-ssl-dir=${openssl.dev}/"
     "--with-tls"
   ];
 
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index b3b9dfcef16..3c044bb6efa 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -40,7 +40,7 @@ let
   '';
 
   ver_maj = "2.48";
-  ver_min = "0";
+  ver_min = "1";
 in
 
 stdenv.mkDerivation rec {
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${ver_maj}/${name}.tar.xz";
-    sha256 = "0d3w2hblrw7vvpx60l1kbvb830ygn3v8zhwdz65cc5593j9ycjvl";
+    sha256 = "74411bff489cb2a3527bac743a51018841a56a4d896cc1e0d0d54f8166a14612";
   };
 
   patches = optional stdenv.isDarwin ./darwin-compilation.patch ++ optional doCheck ./skip-timer-test.patch;
diff --git a/pkgs/development/libraries/goocanvas/default.nix b/pkgs/development/libraries/goocanvas/default.nix
index 45442072d39..77af66f9724 100644
--- a/pkgs/development/libraries/goocanvas/default.nix
+++ b/pkgs/development/libraries/goocanvas/default.nix
@@ -1,11 +1,13 @@
 { stdenv, fetchurl, gtk, cairo, glib, pkgconfig }:
 
-stdenv.mkDerivation {
-  name = "goocanvas-0.10";
+stdenv.mkDerivation rec {
+  majVersion = "1.0";
+  version = "${majVersion}.0";
+  name = "goocanvas-${version}";
 
   src = fetchurl {
-    url = mirror://sourceforge/goocanvas/goocanvas-0.10.tar.gz;
-    sha256 = "0b49szbr3n7vpavly9w17ipa8q3ydicdcd177vxbdvbsnvg7aqp9";
+    url = "mirror://gnome/sources/goocanvas/${majVersion}/${name}.tar.bz2";
+    sha256 = "07kicpcacbqm3inp7zq32ldp95mxx4kfxpaazd0x5jk7hpw2w1qw";
   };
 
   buildInputs = [ gtk cairo glib pkgconfig ];
diff --git a/pkgs/development/libraries/gtk+/2.x.nix b/pkgs/development/libraries/gtk+/2.x.nix
index f3ebc189cd7..faaff415f5f 100644
--- a/pkgs/development/libraries/gtk+/2.x.nix
+++ b/pkgs/development/libraries/gtk+/2.x.nix
@@ -8,11 +8,11 @@ assert xineramaSupport -> xorg.libXinerama != null;
 assert cupsSupport -> cups != null;
 
 stdenv.mkDerivation rec {
-  name = "gtk+-2.24.29";
+  name = "gtk+-2.24.30";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/2.24/${name}.tar.xz";
-    sha256 = "1f1ifv1ijrda4jx831l24d3ww65v5gf56r464fi11n6k02bcah87";
+    sha256 = "0d15cec3b6d55c60eac205b1f3ba81a1ed4eadd9d0f8e7c508bc7065d0c4ca50";
   };
 
   outputs = [ "dev" "out" "docdev" ];
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index b1991ada402..e6c95963865 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -12,7 +12,7 @@ with stdenv.lib;
 
 let
   ver_maj = "3.20";
-  ver_min = "3";
+  ver_min = "5";
   version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "3834f3bf23b260b3e5ebfea41102e2026a8af29e36c3620edf4a5cf05e82f694";
+    sha256 = "9790b0267384904ad8a08e7f16e5f9ff1c4037de57788d48d1eaf528355b1564";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/gupnp/default.nix b/pkgs/development/libraries/gupnp/default.nix
index 45f5217d3c9..755a4e8fcdc 100644
--- a/pkgs/development/libraries/gupnp/default.nix
+++ b/pkgs/development/libraries/gupnp/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ glib gssdp libsoup libxml2 libuuid ];
 
   postInstall = ''
-    ln -sv ${libsoup}/include/*/libsoup $out/include
+    ln -sv ${libsoup.dev}/include/*/libsoup $out/include
     ln -sv ${libxml2.dev}/include/*/libxml $out/include
     ln -sv ${gssdp}/include/*/libgssdp $out/include
   '';
diff --git a/pkgs/development/libraries/harfbuzz/default.nix b/pkgs/development/libraries/harfbuzz/default.nix
index 2d84b1e73a8..4d8f005bf88 100644
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "1.1.2";
+  version = "1.2.7";
   inherit (stdenv.lib) optional optionals optionalString;
 in
 
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/harfbuzz/release/harfbuzz-${version}.tar.bz2";
-    sha256 = "07s6z3hbrb4rdfgzmln169wxz4nm5y7qbr02ik5c7drxpn85fb2a";
+    sha256 = "09lh8x6qj0cd950whgaqqi3c4pqbl6z7aw9ddm73i14bw056185v";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/hiredis/default.nix b/pkgs/development/libraries/hiredis/default.nix
index 86b1a2c72a5..7ff8ed61cab 100644
--- a/pkgs/development/libraries/hiredis/default.nix
+++ b/pkgs/development/libraries/hiredis/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "hiredis-${version}";
-  version = "0.13.1";
+  version = "0.13.3";
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "hiredis";
     rev = "v${version}";
-    sha256 = "15rzq7n7z9h143smrnd34f9gh24swwal6r9z9xlxsl0jxabiv71l";
+    sha256 = "1qxiv61bsp6s847hhkxqj7vnbdlac089r2qdp3zgxhhckaflhb7r";
   };
 
   PREFIX = "\${out}";
diff --git a/pkgs/development/libraries/kerberos/heimdal.nix b/pkgs/development/libraries/kerberos/heimdal.nix
index 175d0c7bc3b..3740cf18b1e 100644
--- a/pkgs/development/libraries/kerberos/heimdal.nix
+++ b/pkgs/development/libraries/kerberos/heimdal.nix
@@ -32,13 +32,13 @@ stdenv.mkDerivation rec {
     "--sysconfdir=/etc"
     "--localstatedir=/var"
     "--enable-hdb-openldap-module"
-    "--with-sqlite3=${sqlite}"
+    "--with-sqlite3=${sqlite.dev}"
     "--with-libedit=${libedit}"
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
     "--without-x"
     "--with-berkeley-db=${db}"
   ] ++ optionals (!libOnly) [
-    "--with-openldap=${openldap}"
+    "--with-openldap=${openldap.dev}"
   ] ++ optionals (!stdenv.isFreeBSD) [
     "--with-capng"
   ];
diff --git a/pkgs/development/libraries/ldns/default.nix b/pkgs/development/libraries/ldns/default.nix
index b1f81549ef0..c279d698e12 100644
--- a/pkgs/development/libraries/ldns/default.nix
+++ b/pkgs/development/libraries/ldns/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ perl ];
   buildInputs = [ openssl ];
 
-  configureFlags = [ "--with-ssl=${openssl}" "--with-drill" ];
+  configureFlags = [ "--with-ssl=${openssl.dev}" "--with-drill" ];
 
   meta = with stdenv.lib; {
     description = "Library with the aim of simplifying DNS programming in C";
diff --git a/pkgs/development/libraries/leatherman/default.nix b/pkgs/development/libraries/leatherman/default.nix
index 60205d7a856..bfb091f424a 100644
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "leatherman-${version}";
-  version = "0.4.2";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
-    sha256 = "07bgv99lzzhxy4l7mdyassxqy33zv7arvfw63bymsqavppphqlrr";
+    sha256 = "1m37zcr11a2g08wbkpxgav97m2fr14in2zhdhhv5krci5i2grzd7";
     rev = version;
     repo = "leatherman";
     owner = "puppetlabs";
diff --git a/pkgs/development/libraries/libclxclient/default.nix b/pkgs/development/libraries/libclxclient/default.nix
index 4dca6b57c75..9fb01df930a 100644
--- a/pkgs/development/libraries/libclxclient/default.nix
+++ b/pkgs/development/libraries/libclxclient/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libclthreads libX11 libXft xorg.xproto ];
 
-  NIX_CFLAGS_COMPILE = "-I${xorg.xproto}/include -I${libXft}/include";
+  NIX_CFLAGS_COMPILE = "-I${xorg.xproto}/include -I${libXft.dev}/include";
 
   patchPhase = ''
     sed -e "s@ldconfig@@" -i Makefile
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index ad524ffeb02..d2bb05a3bb6 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libpthreadstubs, libpciaccess, udev, valgrind }:
 
 stdenv.mkDerivation rec {
-  name = "libdrm-2.4.66";
+  name = "libdrm-2.4.68";
 
   src = fetchurl {
     url = "http://dri.freedesktop.org/libdrm/${name}.tar.bz2";
-    sha256 = "79cb8e988749794edfb2d777b298d5292eff353bbbb71ed813589e61d2bc2d76";
+    sha256 = "5b4bd9a5922929bc716411cb74061fbf31b06ba36feb89bc1358a91a8d0ca9df";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/development/libraries/libksi/default.nix b/pkgs/development/libraries/libksi/default.nix
index 1dd71024681..39de886a0b7 100644
--- a/pkgs/development/libraries/libksi/default.nix
+++ b/pkgs/development/libraries/libksi/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl curl ];
 
   configureFlags = [
-    "--with-openssl=${openssl}"
+    "--with-openssl=${openssl.dev}"
     "--with-cafile=/etc/ssl/certs/ca-certificates.crt"
   ];
 
diff --git a/pkgs/development/libraries/libmp3splt/default.nix b/pkgs/development/libraries/libmp3splt/default.nix
index 9074eb470b6..08882291d1f 100644
--- a/pkgs/development/libraries/libmp3splt/default.nix
+++ b/pkgs/development/libraries/libmp3splt/default.nix
@@ -1,20 +1,22 @@
 { stdenv, fetchurl, libtool, libmad, libid3tag }:
 
 stdenv.mkDerivation rec {
-  name = "libmp3splt-0.9.1";
+  name = "libmp3splt-0.9.2";
 
   src = fetchurl {
-    url = "http://prdownloads.sourceforge.net/mp3splt/${name}.tar.gz";
-    sha256 = "17ar9d669cnirkz1kdrim687wzi36y8inapnj4svlsvr00vdzfxa";
+    url = "mirror://sourceforge/mp3splt/${name}.tar.gz";
+    sha256 = "1p1mn2hsmj5cp40fnc8g1yfvk72p8pjxi866gjdkgjsqrr7xdvih";
   };
 
-  buildInputs = [ libtool libmad libid3tag ];
+  outputs = [ "dev" "out" ];
+  nativeBuildInputs = [ libtool ];
+  buildInputs = [ libmad libid3tag ];
 
   configureFlags = "--disable-pcre";
 
   meta = with stdenv.lib; {
     homepage    = http://sourceforge.net/projects/mp3splt/;
-    description = "utility to split mp3, ogg vorbis and FLAC files without decoding";
+    description = "Utility to split mp3, ogg vorbis and FLAC files without decoding";
     maintainers = with maintainers; [ bosu ];
     platforms   = platforms.unix;
   };
diff --git a/pkgs/development/libraries/libndp/default.nix b/pkgs/development/libraries/libndp/default.nix
index c32e6999ecf..888fe423b47 100644
--- a/pkgs/development/libraries/libndp/default.nix
+++ b/pkgs/development/libraries/libndp/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "libndp-1.5";
+  name = "libndp-1.6";
 
   src = fetchurl {
     url = "http://libndp.org/files/${name}.tar.gz";
-    sha256 = "15f743hjc7yy2sv3hzvfc27s1gny4mh5aww59vn195fff2midwgs";
+    sha256 = "03mczwrxqbp54msafxzzyhaazkvjdwm2kipjkrb5xg8kw22glz8c";
   };
 
   meta = with stdenv.lib; {
@@ -16,4 +16,4 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl21;
   };
 
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/libraries/libpipeline/default.nix b/pkgs/development/libraries/libpipeline/default.nix
index 3f91540dc80..038556261a4 100644
--- a/pkgs/development/libraries/libpipeline/default.nix
+++ b/pkgs/development/libraries/libpipeline/default.nix
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "1vmrs4nvdsmb550bk10cankrd42ffczlibpsnafxpak306rdfins";
   };
 
+  patches = stdenv.lib.optionals stdenv.isDarwin [ ./fix-on-osx.patch ];
+
   meta = with stdenv.lib; {
     homepage = "http://libpipeline.nongnu.org";
     description = "C library for manipulating pipelines of subprocesses in a flexible and convenient way";
diff --git a/pkgs/development/libraries/libpipeline/fix-on-osx.patch b/pkgs/development/libraries/libpipeline/fix-on-osx.patch
new file mode 100644
index 00000000000..c539e2dde97
--- /dev/null
+++ b/pkgs/development/libraries/libpipeline/fix-on-osx.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/pipeline.c b/lib/pipeline.c
+index 26478f9..1612307 100644
+--- a/lib/pipeline.c
++++ b/lib/pipeline.c
+@@ -75,6 +75,8 @@
+ #   endif
+ #endif
+ 
++const char* program_name = "libpipeline";
++
+ #if defined(HAVE_SETENV) && !defined(HAVE_CLEARENV)
+ int clearenv (void)
+ {
diff --git a/pkgs/development/libraries/libpng/default.nix b/pkgs/development/libraries/libpng/default.nix
index a5a0e1d42a3..71b7b2e18ef 100644
--- a/pkgs/development/libraries/libpng/default.nix
+++ b/pkgs/development/libraries/libpng/default.nix
@@ -3,11 +3,11 @@
 assert zlib != null;
 
 let
-  version = "1.6.20";
-  sha256 = "12wis4rlisfnw79pj2778m42m94xpi9nq8m385hxk11lkyg9biam";
+  version = "1.6.21";
+  sha256 = "10r0xqasm8fi0dx95bpca63ab4myb8g600ypyndj2r4jxd4ii3vc";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${version}-apng.patch.gz";
-    sha256 = "11xgal9qk6fmqdgcb37xg55f2y58wizszw54p1pyq855d2xpwfz6";
+    sha256 = "0wwcc52yzjaxvpfkicz20j7yzpy02hpnsm4jjlvw74gy4qjhx9vd";
   };
   whenPatched = stdenv.lib.optionalString apngSupport;
 
diff --git a/pkgs/development/libraries/libpsl/default.nix b/pkgs/development/libraries/libpsl/default.nix
index 8540eccf2da..ea4db82c510 100644
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -3,10 +3,10 @@
 
 let
 
-  listVersion = "2016-05-10";
+  listVersion = "2016-05-23";
   listSources = fetchFromGitHub {
-    sha256 = "1bpdli2q5ap677yg0w0v7q5qmaxnm2y17wakzmc0k6k7m7xfyzw0";
-    rev = "2226f9cc92213d0d68a74ecb535b15b3af00388a";
+    sha256 = "1sld9s9d9g3fnppyvvn5w0xw50g1gq43d7yyk9yb710268kh31jc";
+    rev = "05f7a0a82e2fea5afb8ba3736db3c294db270849";
     repo = "list";
     owner = "publicsuffix";
   };
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index e039711e457..3c47a0453de 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -3,14 +3,14 @@
 , ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.9.0";
+  version = "1.9.1";
   name = "libuv-${version}";
 
   src = fetchFromGitHub {
     owner = "libuv";
     repo = "libuv";
     rev = "v${version}";
-    sha256 = "0sq8c8n7xixn2xxp35crprvh35ry18i5mcxgwh12lydwv9ks0d4k";
+    sha256 = "1kc386gkkkymgz9diz1z4r8impcsmki5k88dsiasd6v9bfvq04cc";
   };
 
   buildInputs = [ automake autoconf libtool pkgconfig ]
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index 9e22aa1d37c..1d293f9ffcb 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -4,11 +4,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "libva-1.6.2";
+  name = "libva-1.7.0";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/vaapi/releases/libva/${name}.tar.bz2";
-    sha256 = "1l4bij21shqbfllbxicmqgmay4v509v9hpxyyia9wm7gvsfg05y4";
+    sha256 = "0py9igf4kicj7ji22bjawkpd6my013qpg0s4ir2np9l1rk5vr2d6";
   };
 
   outputs = [ "dev" "out" "bin" ];
@@ -31,5 +31,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     description = "VAAPI library: Video Acceleration API";
     platforms = platforms.unix;
+    maintainers = with maintainers; [ garbas ];
   };
 }
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 16a4498f54c..d409d20a769 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -4,7 +4,7 @@
 , iproute, iptables, readline, lvm2, utillinux, systemd, libpciaccess, gettext
 , libtasn1, ebtables, libgcrypt, yajl, pmutils, libcap_ng
 , dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages
-, curl, libiconv, gmp, xen
+, curl, libiconv, gmp, xen, zfs
 }:
 # if you update, also bump pythonPackages.libvirt or it will break
 stdenv.mkDerivation rec {
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     libxslt xhtml1 perlPackages.XMLXPath curl libpcap
   ] ++ stdenv.lib.optionals stdenv.isLinux [
     libpciaccess devicemapper lvm2 utillinux systemd.udev.lib libcap_ng
-    libnl numad numactl xen
+    libnl numad numactl xen zfs
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
      libiconv gmp
   ];
@@ -52,6 +52,7 @@ stdenv.mkDerivation rec {
     "--with-macvtap"
     "--with-virtualport"
     "--with-init-script=redhat"
+    "--with-storage-zfs"
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
     "--with-init-script=none"
   ];
diff --git a/pkgs/development/libraries/libwacom/default.nix b/pkgs/development/libraries/libwacom/default.nix
index 12bb7c785ac..2356e5bddbd 100644
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -1,19 +1,20 @@
 { fetchurl, stdenv, glib, pkgconfig, udev, libgudev }:
 
 stdenv.mkDerivation rec {
-  name = "libwacom-0.15";
+  name = "libwacom-${version}";
+  version = "0.19";
 
   src = fetchurl {
     url = "mirror://sourceforge/linuxwacom/libwacom/${name}.tar.bz2";
-    sha256 = "04vppdj99cc0ya44n8p7zjk9yyw03v6fksw0a9n1gpnnsn4wardb";
+    sha256 = "1zsmp2l53fbfy6jykh4c0i127baf503lq2fvd5y1066ihp6qh3b2";
   };
 
-  buildInputs = [ glib pkgconfig udev libgudev ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ glib udev libgudev ];
 
   meta = with stdenv.lib; {
     platforms = platforms.linux;
     homepage = http://sourceforge.net/projects/linuxwacom/;
     description = "libraries, configuration, and diagnostic tools for Wacom tablets running under Linux";
   };
-
 }
diff --git a/pkgs/development/libraries/libwps/default.nix b/pkgs/development/libraries/libwps/default.nix
index 798284c3b89..b165631e23e 100644
--- a/pkgs/development/libraries/libwps/default.nix
+++ b/pkgs/development/libraries/libwps/default.nix
@@ -1,20 +1,19 @@
 { stdenv, fetchurl, boost, pkgconfig, librevenge, zlib }:
 
-let version = "0.4.2"; in
 stdenv.mkDerivation rec {
   name = "libwps-${version}";
+  version = "0.4.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/libwps/${name}.tar.gz";
-    sha256 = "0c90i3zafxxsj989bd9bs577blx3mrb90rj52iv6ijc4qivi4wkr";
+    url = "mirror://sourceforge/libwps/${name}.tar.bz2";
+    sha256 = "0v1a0hj96i4jhb5833336s4zcslzb6md5cnmnrvgywx8cmw40c0c";
   };
 
   buildInputs = [ boost pkgconfig librevenge zlib ];
 
   meta = with stdenv.lib; {
-    inherit version;
     homepage = http://libwps.sourceforge.net/;
-    description = "Microsoft Works file word processor format import filter library";
+    description = "Microsoft Works document format import filter library";
     platforms = platforms.linux;
     license = licenses.lgpl21;
   };
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 7229b10e01c..45ce1b55592 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -1,13 +1,20 @@
-{ stdenv, lib, fetchurl, zlib, xz, python, findXMLCatalogs, libiconv
+{ stdenv, lib, fetchurl, zlib, xz, python, findXMLCatalogs, libiconv, fetchpatch
 , supportPython ? (! stdenv ? cross) }:
 
 stdenv.mkDerivation rec {
   name = "libxml2-${version}";
-  version = "2.9.3";
+  version = "2.9.4";
 
   src = fetchurl {
     url = "http://xmlsoft.org/sources/${name}.tar.gz";
-    sha256 = "0bd17g6znn2r98gzpjppsqjg33iraky4px923j3k8kdl8qgy7sad";
+    sha256 = "0g336cr0bw6dax1q48bblphmchgihx9p1pjmxdnrd6sh3qci3fgz";
+  };
+
+  # https://bugzilla.gnome.org/show_bug.cgi?id=766834#c5
+  postPatch = "patch -R < " + fetchpatch {
+    name = "schemas-validity.patch";
+    url = "https://git.gnome.org/browse/libxml2/patch/?id=f6599c5164";
+    sha256 = "0i7a0nhxwkxx6dkm8917qn0bsfn1av6ghg2f4dxanxi4bn4b1jjn";
   };
 
   outputs = [ "dev" "out" "bin" "doc" ]
@@ -27,6 +34,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  doCheck = !stdenv.isDarwin;
+
   crossAttrs = lib.optionalAttrs (stdenv.cross.libc == "msvcrt") {
     # creating the DLL is broken ATM
     dontDisableStatic = true;
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index 6ac8acebfe8..5ddc7bf3ddb 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -23,7 +23,7 @@ else
 with { inherit (stdenv.lib) optional optionalString; };
 
 let
-  version = "11.1.3";
+  version = "11.2.2";
   # this is the default search path for DRI drivers
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -38,13 +38,14 @@ stdenv.mkDerivation {
         + head (splitString "." version) + ''.x/${version}/mesa-${version}.tar.xz'')
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "51f6658a214d75e4d9f05207586d7ed56ebba75c6b10841176fb6675efa310ac";
+    sha256 = "40e148812388ec7c6d7b6657d5a16e2e8dabba8b97ddfceea5197947647bdfb4";
   };
 
   prePatch = "patchShebangs .";
 
   patches = [
     ./glx_ro_text_segm.patch # fix for grsecurity/PaX
+    ./symlink-drivers.patch
    # TODO: revive ./dricore-gallium.patch when it gets ported (from Ubuntu),
    #  as it saved ~35 MB in $drivers; watch https://launchpad.net/ubuntu/+source/mesa/+changelog
   ] ++ optional stdenv.isLinux
diff --git a/pkgs/development/libraries/mesa/symlink-drivers.patch b/pkgs/development/libraries/mesa/symlink-drivers.patch
new file mode 100644
index 00000000000..6c800e5dfce
--- /dev/null
+++ b/pkgs/development/libraries/mesa/symlink-drivers.patch
@@ -0,0 +1,72 @@
+diff -ru -x '*~' mesa-11.1.4-orig/src/gallium/targets/dri/Makefile.am mesa-11.1.4/src/gallium/targets/dri/Makefile.am
+--- mesa-11.1.4-orig/src/gallium/targets/dri/Makefile.am	2016-05-09 14:20:52.000000000 +0200
++++ mesa-11.1.4/src/gallium/targets/dri/Makefile.am	2016-05-22 17:56:03.396185082 +0200
+@@ -126,14 +126,13 @@
+ 	done;
+ endif
+ 
+-# hardlink each megadriver instance, but don't actually have
+-# gallium_dri.so in the set of final installed files.
++# symlink each megadriver instance.
+ install-data-hook:
+ 	for i in $(TARGET_DRIVERS); do                                  \
+-		ln -f $(DESTDIR)$(dridir)/gallium_dri.so                \
++		ln -sf $(DESTDIR)$(dridir)/gallium_dri.so               \
+ 		      $(DESTDIR)$(dridir)/$${i}_dri.so;                 \
+ 	done;                                                           \
+-	$(RM) $(DESTDIR)$(dridir)/gallium_dri.*
++	$(RM) $(DESTDIR)$(dridir)/gallium_dri.la
+ 
+ uninstall-hook:
+ 	for i in $(TARGET_DRIVERS); do                                  \
+diff -ru -x '*~' mesa-11.1.4-orig/src/gallium/targets/vdpau/Makefile.am mesa-11.1.4/src/gallium/targets/vdpau/Makefile.am
+--- mesa-11.1.4-orig/src/gallium/targets/vdpau/Makefile.am	2016-01-29 13:21:30.000000000 +0100
++++ mesa-11.1.4/src/gallium/targets/vdpau/Makefile.am	2016-05-22 20:54:12.722358242 +0200
+@@ -103,15 +103,14 @@
+ 	done;
+ endif
+ 
+-# hardlink each megadriver instance, but don't actually have
+-# libvdpau_gallium.so in the set of final installed files.
++# symlink each megadriver instance.
+ install-data-hook:
+ 	$(AM_V_GEN)dest_dir=$(DESTDIR)/$(vdpaudir);			\
+ 	for i in $(TARGET_DRIVERS); do					\
+ 		j=libvdpau_gallium.$(LIB_EXT);				\
+ 		k=libvdpau_$${i}.$(LIB_EXT);				\
+ 		l=$${k}.$(VDPAU_MAJOR).$(VDPAU_MINOR).0;		\
+-		ln -f $${dest_dir}/$${j}.$(VDPAU_MAJOR).$(VDPAU_MINOR).0 \
++		ln -sf $${dest_dir}/$${j}.$(VDPAU_MAJOR).$(VDPAU_MINOR).0 \
+ 		      $${dest_dir}/$${l};				\
+ 		ln -sf $${l}						\
+ 		       $${dest_dir}/$${k}.$(VDPAU_MAJOR).$(VDPAU_MINOR); \
+@@ -120,7 +119,7 @@
+ 		ln -sf $${l}						\
+ 		       $${dest_dir}/$${k};				\
+ 	done;								\
+-	$(RM) $${dest_dir}/libvdpau_gallium.*
++	$(RM) $${dest_dir}/libvdpau_gallium.la
+ 
+ uninstall-hook:
+ 	for i in $(TARGET_DRIVERS); do					\
+diff -ru -x '*~' mesa-11.1.4-orig/src/mesa/drivers/dri/Makefile.am mesa-11.1.4/src/mesa/drivers/dri/Makefile.am
+--- mesa-11.1.4-orig/src/mesa/drivers/dri/Makefile.am	2016-01-18 08:39:26.000000000 +0100
++++ mesa-11.1.4/src/mesa/drivers/dri/Makefile.am	2016-05-22 17:55:46.251244940 +0200
+@@ -86,14 +86,13 @@
+ 	done;
+ endif
+ 
+-# hardlink each megadriver instance, but don't actually have
+-# mesa_dri_drivers.so in the set of final installed files.
++# symink each megadriver instance.
+ install-data-hook:
+ 	for i in $(MEGADRIVERS); do \
+-		ln -f $(DESTDIR)$(dridir)/mesa_dri_drivers.so \
++		ln -sf $(DESTDIR)$(dridir)/mesa_dri_drivers.so \
+ 		      $(DESTDIR)$(dridir)/$$i; \
+ 	done;
+-	$(RM) $(DESTDIR)$(dridir)/mesa_dri_drivers.*
++	$(RM) $(DESTDIR)$(dridir)/mesa_dri_drivers.la
+ 
+ uninstall-hook:
+ 	for i in $(MEGADRIVERS); do \
diff --git a/pkgs/development/libraries/opencascade/6.5.nix b/pkgs/development/libraries/opencascade/6.5.nix
index 86ab85cbb9a..252a6bb0ad1 100644
--- a/pkgs/development/libraries/opencascade/6.5.nix
+++ b/pkgs/development/libraries/opencascade/6.5.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
-  configureFlags = [ "--with-tcl=${tcl}/lib" "--with-tk=${tk}/lib" "--with-qt=${qt4}" "--with-ftgl=${ftgl}" "--with-freetype=${freetype}" ];
+  configureFlags = [ "--with-tcl=${tcl}/lib" "--with-tk=${tk}/lib" "--with-qt=${qt4}" "--with-ftgl=${ftgl}" "--with-freetype=${freetype.dev}" ];
 
   postInstall = ''
     mv $out/inc $out/include
diff --git a/pkgs/development/libraries/opencascade/default.nix b/pkgs/development/libraries/opencascade/default.nix
index 79c24be7514..8a7f9970e65 100644
--- a/pkgs/development/libraries/opencascade/default.nix
+++ b/pkgs/development/libraries/opencascade/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   preUnpack = ''
     sourceRoot=`pwd`/ros/adm/cmake
-    cmakeFlags="$cmakeFlags -DINSTALL_DIR=$out -D3RDPARTY_TCL_DIR=${tcl} -D3RDPARTY_FREETYPE_DIR=${freetype}"
+    cmakeFlags="$cmakeFlags -DINSTALL_DIR=$out -D3RDPARTY_TCL_DIR=${tcl} -D3RDPARTY_FREETYPE_DIR=${freetype.dev}"
   '';
 
   # https://bugs.freedesktop.org/show_bug.cgi?id=83631
diff --git a/pkgs/development/libraries/openldap/CVE-2015-6908.patch b/pkgs/development/libraries/openldap/CVE-2015-6908.patch
deleted file mode 100644
index 5db36629475..00000000000
--- a/pkgs/development/libraries/openldap/CVE-2015-6908.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 6fe51a9ab04fd28bbc171da3cf12f1c1040d6629 Mon Sep 17 00:00:00 2001
-From: Howard Chu <hyc@openldap.org>
-Date: Thu, 10 Sep 2015 00:37:32 +0100
-Subject: [PATCH] ITS#8240 remove obsolete assert
-
----
- libraries/liblber/io.c |    2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libraries/liblber/io.c b/libraries/liblber/io.c
-index 85c3e23..c05dcf8 100644
---- a/libraries/liblber/io.c
-+++ b/libraries/liblber/io.c
-@@ -679,7 +679,7 @@ done:
- 		return (ber->ber_tag);
- 	}
- 
--	assert( 0 ); /* ber structure is messed up ?*/
-+	/* invalid input */
- 	return LBER_DEFAULT;
- }
- 
--- 
-1.7.10.4
-
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index cc5a26a557d..00b4139dc7c 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
       ++ stdenv.lib.optional (cyrus_sasl == null) "--without-cyrus-sasl"
       ++ stdenv.lib.optional stdenv.isFreeBSD "--with-pic";
 
+  dontPatchELF = 1; # !!!
+
   # Fixup broken libtool
   preFixup = ''
     sed -e 's,-lsasl2,-L${cyrus_sasl.out}/lib -lsasl2,' \
diff --git a/pkgs/development/libraries/pango/default.nix b/pkgs/development/libraries/pango/default.nix
index c4456035cca..105bfa1627b 100644
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -5,7 +5,7 @@
 with stdenv.lib;
 
 let
-  ver_maj = "1.38";
+  ver_maj = "1.40";
   ver_min = "1";
 in
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/pango/${ver_maj}/${name}.tar.xz";
-    sha256 = "1dsf45m51i4rcyvh5wlxxrjfhvn5b67d5ckjc6vdcxbddjgmc80k";
+    sha256 = "e27af54172c72b3ac6be53c9a4c67053e16c905e02addcf3a603ceb2005c1a40";
   };
 
   outputs = [ "dev" "out" "bin" "docdev" ];
diff --git a/pkgs/development/libraries/pcl/default.nix b/pkgs/development/libraries/pcl/default.nix
index 908d1ea856f..b38f1e5711a 100644
--- a/pkgs/development/libraries/pcl/default.nix
+++ b/pkgs/development/libraries/pcl/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchzip, cmake, qhull, flann, boost, vtk, eigen, pkgconfig, qt4
-, libusb1, libpcap, libXt, libpng
+, libusb1, libpcap, libXt, libpng, Cocoa, AGL, cf-private
 }:
 
 stdenv.mkDerivation rec {
@@ -14,13 +14,22 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   buildInputs = [ cmake qhull flann boost eigen pkgconfig libusb1 libpcap
-                  libpng vtk qt4 libXt ];
+                  libpng vtk qt4 libXt ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Cocoa AGL cf-private ];
+  cmakeFlags = stdenv.lib.optionals stdenv.isDarwin [
+    "-DCMAKE_OSX_SYSROOT=" "-DCMAKE_OSX_DEPLOYMENT_TARGET=" ];
+
+  preConfigure = stdenv.lib.optionalString stdenv.isDarwin ''
+    NIX_CFLAGS_COMPILE=$(echo "$NIX_CFLAGS_COMPILE" | sed "s,[[:space:]]*-F$NIX_STORE/[[:alnum:]]*-CF-osx-[[:digit:].]*/Library/Frameworks,,g")
+    sed -i 's,^\(      target_link_libraries("''${LIB_NAME}" "-framework Cocoa")\),\1\n      target_link_libraries("''${LIB_NAME}" "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"),' visualization/CMakeLists.txt
+    sed -i 's,^\(set(SUBSYS_DEPS common io kdtree geometry search)\),\1\nset(CMAKE_OSX_SYSROOT "")\nset(CMAKE_OSX_DEPLOYMENT_TARGET ""),' visualization/CMakeLists.txt
+  '';
 
   meta = {
     homepage = http://pointclouds.org/;
     description = "Open project for 2D/3D image and point cloud processing";
     license = stdenv.lib.licenses.bsd3;
     maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/development/libraries/pcre2/default.nix b/pkgs/development/libraries/pcre2/default.nix
index 4f8d5cf1aaa..447b8fe15ec 100644
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@@ -1,10 +1,10 @@
 { stdenv, fetchurl }:
 
-stdenv.mkDerivation {
-  name = "pcre2-10.20";
+stdenv.mkDerivation rec {
+  name = "pcre2-10.21";
   src = fetchurl {
-    url = "ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre2-10.20.tar.bz2";
-    sha256 = "0yj8mm9ll9zj3v47rvmmqmr1ybxk72rr2lym3rymdsf905qjhbik";
+    url = "ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/${name}.tar.bz2";
+    sha256 = "1q6lrj9b08l1q39vxipb0fi88x6ybvkr6439h8bjb9r8jd81fsn6";
   };
 
   configureFlags = [
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   ];
 
   meta = {
-    description = "Perl Compatible Regular Expressions";
+	description = "Perl Compatible Regular Expressions";
     homepage = "http://www.pcre.org/";
     license = stdenv.lib.licenses.bsd3;
     maintainers = [ stdenv.lib.maintainers.ttuegel ];
diff --git a/pkgs/development/libraries/postgis/default.nix b/pkgs/development/libraries/postgis/default.nix
index f3e2312f484..1886038dff3 100644
--- a/pkgs/development/libraries/postgis/default.nix
+++ b/pkgs/development/libraries/postgis/default.nix
@@ -96,7 +96,7 @@ in rec {
     dontDisableStatic = true;
     preConfigure = ''
       sed -i 's@/usr/bin/file@${file}/bin/file@' configure
-      configureFlags="$configureFlags --with-gdalconfig=${gdal}/bin/gdal-config --with-jsondir=${json_c}"
+      configureFlags="$configureFlags --with-gdalconfig=${gdal}/bin/gdal-config --with-jsondir=${json_c.dev}"
     '';
     postConfigure = ''
       sed -i "s|@mkdir -p \$(DESTDIR)\$(PGSQL_BINDIR)||g ;
diff --git a/pkgs/development/libraries/qt-5/5.5/qmake-hook.sh b/pkgs/development/libraries/qt-5/5.5/qmake-hook.sh
index 2669a396280..5401a71bc4c 100644
--- a/pkgs/development/libraries/qt-5/5.5/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-5/5.5/qmake-hook.sh
@@ -68,6 +68,10 @@ _qtMultioutModuleDevs() {
     fi
 }
 
+_qtRmQtOut() {
+    rm -fr "$qtOut"
+}
+
 qmakeConfigurePhase() {
     runHook preConfigure
 
@@ -109,6 +113,8 @@ fi
 if [ -n "$NIX_QT_SUBMODULE" ]; then
     postInstallHooks+=(_qtRmQmake _qtRmModules)
     preFixupHooks+=(_qtMultioutModuleDevs)
+else
+    postInstallHooks+=(_qtRmQtOut)
 fi
 
 fi
diff --git a/pkgs/development/libraries/qt-5/5.6/qmake-hook.sh b/pkgs/development/libraries/qt-5/5.6/qmake-hook.sh
index cf3803a1b9c..9fd4735209c 100644
--- a/pkgs/development/libraries/qt-5/5.6/qmake-hook.sh
+++ b/pkgs/development/libraries/qt-5/5.6/qmake-hook.sh
@@ -74,6 +74,10 @@ _qtModuleMultioutDevsPost() {
     fi
 }
 
+_qtRmQtOut() {
+    rm -fr "$qtOut"
+}
+
 qmakeConfigurePhase() {
     runHook preConfigure
 
@@ -116,6 +120,8 @@ if [ -n "$NIX_QT_SUBMODULE" ]; then
     postInstallHooks+=(_qtRmQmake _qtRmModules)
     preFixupHooks+=(_qtModuleMultioutDevsPre)
     postFixupHooks+=(_qtModuleMultioutDevsPost)
+else
+    postInstallHooks+=(_qtRmQtOut)
 fi
 
 fi
diff --git a/pkgs/development/libraries/qt-5/5.6/qtbase/default.nix b/pkgs/development/libraries/qt-5/5.6/qtbase/default.nix
index 6ab5a48951f..8cc876de3d1 100644
--- a/pkgs/development/libraries/qt-5/5.6/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-5/5.6/qtbase/default.nix
@@ -87,7 +87,7 @@ stdenv.mkDerivation {
         --replace "@mesa_lib@" "${mesa.out}"
       substituteInPlace qtbase/mkspecs/common/linux.conf \
         --replace "@mesa_lib@" "${mesa.out}" \
-        --replace "@mesa_inc@" "${mesa.dev}"
+        --replace "@mesa_inc@" "${mesa.dev or mesa}"
     '';
 
 
diff --git a/pkgs/development/libraries/science/math/cudnn/default.nix b/pkgs/development/libraries/science/math/cudnn/default.nix
new file mode 100644
index 00000000000..80975c8dc7b
--- /dev/null
+++ b/pkgs/development/libraries/science/math/cudnn/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, requireFile }:
+
+stdenv.mkDerivation rec {
+  version = "4.0";
+
+  name = "cudnn-${version}";
+
+  src = requireFile rec {
+    name = "cudnn-7.0-linux-x64-v${version}-prod.tgz";
+    message = '' 
+      This nix expression requires that ${name} is
+      already part of the store. Register yourself to NVIDIA Accelerated Computing Developer Program
+      and download cuDNN library at https://developer.nvidia.com/cudnn, and store it to the nix store with nix-store --add-fixed sha256 <FILE>.
+    '';
+    sha256 = "0zgr6qdbc29qw6sikhrh6diwwz7150rqc8a49f2qf37j2rvyyr2f";
+
+  };
+
+  phases = "unpackPhase installPhase fixupPhase";
+
+  installPhase = ''
+    mkdir -p $out
+    cp -a include $out/include
+    cp -a lib64 $out/lib64
+  '';
+
+  # all binaries are already stripped
+  #dontStrip = true;
+
+  # we did this in prefixup already
+  #dontPatchELF = true;
+
+  meta = {
+    description = "NVIDIA CUDA Deep Neural Network library (cuDNN)";
+    homepage = "https://developer.nvidia.com/cudnn";
+    license = stdenv.lib.licenses.unfree;
+  };
+}
diff --git a/pkgs/development/libraries/science/math/magma/default.nix b/pkgs/development/libraries/science/math/magma/default.nix
new file mode 100644
index 00000000000..21805092c76
--- /dev/null
+++ b/pkgs/development/libraries/science/math/magma/default.nix
@@ -0,0 +1,46 @@
+{ stdenv, fetchurl, cmake, gfortran, cudatoolkit, libpthreadstubs, liblapack }:
+
+with stdenv.lib;
+
+let version = "2.0.2";
+
+in stdenv.mkDerivation {
+  name = "magma-${version}";
+  src = fetchurl {
+    url = "http://icl.cs.utk.edu/projectsfiles/magma/downloads/magma-${version}.tar.gz";
+    sha256 = "0w3z6k1npfh0d3r8kpw873f1m7lny29sz2bvvfxzk596d4h083lk";
+    name = "magma-${version}.tar.gz";
+  };
+
+  buildInputs = [ gfortran cudatoolkit libpthreadstubs liblapack cmake ];
+
+  doCheck = false;
+  #checkTarget = "tests";
+
+  enableParallelBuilding=true;
+
+  # MAGMA's default CMake setup does not care about installation. So we copy files directly.
+  installPhase = ''
+    mkdir -p $out
+    mkdir -p $out/include
+    mkdir -p $out/lib
+    mkdir -p $out/lib/pkgconfig
+    cp -a ../include/*.h $out/include
+    #cp -a sparse-iter/include/*.h $out/include
+    cp -a lib/*.a $out/lib
+    cat ../lib/pkgconfig/magma.pc.in                   | \
+    sed -e s:@INSTALL_PREFIX@:"$out":          | \
+    sed -e s:@CFLAGS@:"-I$out/include":    | \
+    sed -e s:@LIBS@:"-L$out/lib -lmagma -lmagma_sparse": | \
+    sed -e s:@MAGMA_REQUIRED@::                       \
+        > $out/lib/pkgconfig/magma.pc
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Matrix Algebra on GPU and Multicore Architectures";
+    license = licenses.bsd3;
+    homepage = "http://icl.cs.utk.edu/magma/index.html";
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ ianwookim ];
+  };
+}
diff --git a/pkgs/development/libraries/serf/default.nix b/pkgs/development/libraries/serf/default.nix
index 20ce1dabf9a..86212eaeb47 100644
--- a/pkgs/development/libraries/serf/default.nix
+++ b/pkgs/development/libraries/serf/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
   '';
 
   buildPhase = ''
-    scons PREFIX="$out" OPENSSL="${openssl}" ZLIB="${zlib}" APR="$(echo "${apr}"/bin/*-config)" \
-        APU="$(echo "${aprutil}"/bin/*-config)" CC="${
+    scons PREFIX="$out" OPENSSL="${openssl.dev}" ZLIB="${zlib.dev}" APR="$(echo "${apr.dev}"/bin/*-config)" \
+        APU="$(echo "${aprutil.dev}"/bin/*-config)" CC="${
           if stdenv.cc.isClang then "clang" else "${stdenv.cc}/bin/gcc"
         }" ${
           if (stdenv.isDarwin || stdenv.isCygwin) then "" else "GSSAPI=\"${kerberos}\""
diff --git a/pkgs/development/libraries/silgraphite/default.nix b/pkgs/development/libraries/silgraphite/default.nix
index 8e8cdc0ce1c..f124b313d74 100644
--- a/pkgs/development/libraries/silgraphite/default.nix
+++ b/pkgs/development/libraries/silgraphite/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [pkgconfig freetype libXft pango fontconfig];
 
-  NIX_CFLAGS_COMPILE = "-I${freetype}/include/freetype2";
+  NIX_CFLAGS_COMPILE = "-I${freetype.dev}/include/freetype2";
 
   meta = {
     description = "An advanced font engine";
diff --git a/pkgs/development/libraries/slang/default.nix b/pkgs/development/libraries/slang/default.nix
index e83718673aa..df2b5db89a7 100644
--- a/pkgs/development/libraries/slang/default.nix
+++ b/pkgs/development/libraries/slang/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sed -i -e "s|/bin/ln|ln|" src/Makefile.in
     sed -i -e "s|-ltermcap|-lncurses|" ./configure
   '';
-  configureFlags = "--with-png=${libpng} --with-z=${zlib} --with-pcre=${pcre} --with-readline=${readline}";
+  configureFlags = "--with-png=${libpng.dev} --with-z=${zlib.dev} --with-pcre=${pcre.dev} --with-readline=${readline.dev}";
   buildInputs = [ pcre libpng zlib readline ];
   propagatedBuildInputs = [ ncurses ];
 
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index b34e2f648ec..f38e48c87c2 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   buildInputs = lib.optionals interactive [ readline ncurses ];
 
-  configureFlags = [ "--enable-threadsafe" ];
+  configureFlags = [ "--enable-threadsafe" ] ++ lib.optional interactive "--enable-readline";
 
   NIX_CFLAGS_COMPILE = [
     "-DSQLITE_ENABLE_COLUMN_METADATA"
diff --git a/pkgs/development/libraries/swiften/default.nix b/pkgs/development/libraries/swiften/default.nix
index 46ecada9668..e6fb5a2b685 100644
--- a/pkgs/development/libraries/swiften/default.nix
+++ b/pkgs/development/libraries/swiften/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   
   buildPhase = ''
     patchShebangs ./scons
-    ./scons openssl=${openssl} \
+    ./scons openssl=${openssl.dev} \
             boost_includedir=${boost.dev}/include \
             boost_libdir=${boost.out}/lib \
             boost_bundled_enable=false \
diff --git a/pkgs/development/libraries/tinyxml/2.6.2-cxx.patch b/pkgs/development/libraries/tinyxml/2.6.2-cxx.patch
new file mode 100644
index 00000000000..e55d0be43bc
--- /dev/null
+++ b/pkgs/development/libraries/tinyxml/2.6.2-cxx.patch
@@ -0,0 +1,17 @@
+diff -u a/Makefile b/Makefile
+--- a/Makefile	2011-05-14 22:24:57.000000000 -0400
++++ b/Makefile	2016-04-01 14:53:05.000000000 -0400
+@@ -19,9 +19,9 @@
+ 
+ #****************************************************************************
+ 
+-CC     := gcc
+-CXX    := g++
+-LD     := g++
++CC     ?= gcc
++CXX    ?= g++
++LD     ?= g++
+ AR     := ar rc
+ RANLIB := ranlib
+ 
+Common subdirectories: a/docs and b/docs
diff --git a/pkgs/development/libraries/tinyxml/2.6.2.nix b/pkgs/development/libraries/tinyxml/2.6.2.nix
index 7f0a343eba2..231550cd557 100644
--- a/pkgs/development/libraries/tinyxml/2.6.2.nix
+++ b/pkgs/development/libraries/tinyxml/2.6.2.nix
@@ -2,6 +2,7 @@
 
 let
   version = "2.6.2";
+  SHLIB_EXT = if stdenv.isDarwin then "dylib" else "so";
 in stdenv.mkDerivation {
   name = "tinyxml-${version}";
 
@@ -16,7 +17,14 @@ in stdenv.mkDerivation {
 
     # http://sourceforge.net/tracker/index.php?func=detail&aid=3031828&group_id=13559&atid=313559
     ./2.6.2-entity.patch
+
+    # Use CC, CXX, and LD from environment
+    ./2.6.2-cxx.patch
   ];
+  preConfigure = "export LD=${if stdenv.isDarwin then "clang++" else "g++"}";
+
+  NIX_CFLAGS_COMPILE =
+    stdenv.lib.optional stdenv.isDarwin "-mmacosx-version-min=10.9";
 
   buildInputs = [ unzip ];
   buildPhase = ''
@@ -28,9 +36,9 @@ in stdenv.mkDerivation {
     make
 
     # build the lib as a shared library
-    g++ -Wall -O2 -shared -fpic tinyxml.cpp \
+    ''${CXX} -Wall -O2 -shared -fpic tinyxml.cpp \
     tinyxmlerror.cpp tinyxmlparser.cpp      \
-    tinystr.cpp -o libtinyxml.so
+    tinystr.cpp -o libtinyxml.${SHLIB_EXT}
   '';
 
   doCheck = true;
@@ -47,7 +55,7 @@ in stdenv.mkDerivation {
     mkdir -pv $out/lib/pkgconfig/
     mkdir -pv $out/share/doc/tinyxml/
 
-    cp -v libtinyxml.so $out/lib/
+    cp -v libtinyxml.${SHLIB_EXT} $out/lib/
     cp -v *.h $out/include/
 
     substituteInPlace tinyxml.pc --replace "@out@" "$out"
diff --git a/pkgs/development/libraries/vaapi-intel/default.nix b/pkgs/development/libraries/vaapi-intel/default.nix
index 6942107d146..0bc3c196c46 100644
--- a/pkgs/development/libraries/vaapi-intel/default.nix
+++ b/pkgs/development/libraries/vaapi-intel/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "libva-intel-driver-1.6.2";
+  name = "libva-intel-driver-1.7.0";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/vaapi/releases/libva-intel-driver/${name}.tar.bz2";
-    sha256 = "1zl51mdxfmnn33r4b0y5qxwlkqfw919aqphsq60d50pwrvdmk1xz";
+    sha256 = "032w8d0whymi5ac8fk7c5d8nnxxsjgwymw644g7gp959i73xc6cx";
   };
 
   patchPhase = ''
@@ -33,5 +33,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     description = "Intel driver for the VAAPI library";
     platforms = platforms.unix;
+    maintainers = with maintainers; [ garbas ];
   };
 }
diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index 0ae9d9d59c8..57d3664447a 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "wayland-protocols-${version}";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchurl {
     url = "http://wayland.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "0byqvrsm6bkvylvzqy8wh5wpszwl5ra1z0yjqzqmw8przlrhdkbb";
+    sha256 = "0wpm7mz7ww6nn3vrgz7a9iyk7mk6za73wnq0n54lzl8yq8irljh1";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/development/libraries/wildmidi/default.nix b/pkgs/development/libraries/wildmidi/default.nix
index 4dec0555ae9..9d22833e1c0 100644
--- a/pkgs/development/libraries/wildmidi/default.nix
+++ b/pkgs/development/libraries/wildmidi/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, cmake, alsaLib, freepats }:
 
 stdenv.mkDerivation rec {
-  name = "wildmidi-0.3.8";
+  name = "wildmidi-0.3.9";
 
   src = fetchurl {
     url = "https://github.com/Mindwerks/wildmidi/archive/${name}.tar.gz";
-    sha256 = "1z324wkmkf0lapfammviiyclhc7i8in2x2gvgc2r6sq69lcwbn7g";
+    sha256 = "1fbcsvzn8akvvy7vg6vmnikcc8gh405b4gp1r016bq7yginljwwp";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/xine-lib/default.nix b/pkgs/development/libraries/xine-lib/default.nix
index 89b2d77db82..3a37afc1cbe 100644
--- a/pkgs/development/libraries/xine-lib/default.nix
+++ b/pkgs/development/libraries/xine-lib/default.nix
@@ -5,11 +5,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "xine-lib-1.2.4";
-  
+  name = "xine-lib-1.2.6";
+
   src = fetchurl {
     url = "mirror://sourceforge/xine/${name}.tar.xz";
-    sha256 = "1pdv7bs683ily548arv4wsxabslyf3x3laij5jb921dxyx71nnww";
+    sha256 = "01d0nv4zhr4k8id5n4rmw13llrjsv9dhwg1a773c1iqpi1ris15x";
   };
 
   nativeBuildInputs = [ pkgconfig perl ];
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     libcaca libpulseaudio libmng libcdio libv4l vcdimager libmpcdec
   ];
 
-  NIX_LDFLAGS = "-rpath ${libdvdcss}/lib -L${libdvdcss}/lib -ldvdcss";
-  
+  NIX_LDFLAGS = "-lxcb-shm";
+
   propagatedBuildInputs = [zlib];
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/zeitgeist/default.nix b/pkgs/development/libraries/zeitgeist/default.nix
index d0de624890b..ced0844f3e1 100644
--- a/pkgs/development/libraries/zeitgeist/default.nix
+++ b/pkgs/development/libraries/zeitgeist/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "07pnc7kmjpd0ncm32z6s3ny5p4zl52v9lld0n0f8sp6cw87k12p0";
   };
 
-  NIX_CFLAGS_COMPILE = "-I${glib}/include/gio-unix-2.0";
+  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
 
   configureScript = "./autogen.sh";