summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.github/CODEOWNERS3
-rw-r--r--doc/languages-frameworks/rust.md8
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/monitoring/prometheus/default.nix33
-rw-r--r--nixos/modules/services/networking/nghttpx/backend-params-submodule.nix131
-rw-r--r--nixos/modules/services/networking/nghttpx/backend-submodule.nix50
-rw-r--r--nixos/modules/services/networking/nghttpx/default.nix117
-rw-r--r--nixos/modules/services/networking/nghttpx/frontend-params-submodule.nix64
-rw-r--r--nixos/modules/services/networking/nghttpx/frontend-submodule.nix36
-rw-r--r--nixos/modules/services/networking/nghttpx/nghttpx-options.nix142
-rw-r--r--nixos/modules/services/networking/nghttpx/server-options.nix18
-rw-r--r--nixos/modules/services/networking/nghttpx/tls-submodule.nix21
-rw-r--r--nixos/release.nix1
-rw-r--r--nixos/tests/containers-bridge.nix6
-rw-r--r--nixos/tests/nghttpx.nix61
-rw-r--r--nixos/tests/zfs.nix85
-rw-r--r--pkgs/applications/editors/emacs-modes/proofgeneral/HEAD.nix6
-rw-r--r--pkgs/applications/editors/jetbrains/default.nix20
-rw-r--r--pkgs/applications/editors/sublime3/default.nix14
-rw-r--r--pkgs/applications/graphics/k3d/default.nix2
-rw-r--r--pkgs/applications/misc/octoprint/default.nix8
-rw-r--r--pkgs/applications/misc/qsyncthingtray/default.nix4
-rw-r--r--pkgs/applications/misc/qsyncthingtray/qsyncthingtray-0.5.8-qt-5.6.3.patch13
-rw-r--r--pkgs/applications/networking/dropbox/default.nix2
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix2
-rw-r--r--pkgs/applications/office/fava/default.nix4
-rw-r--r--pkgs/applications/office/zotero/default.nix124
-rwxr-xr-xpkgs/applications/science/biology/vcftools/default.nix24
-rw-r--r--pkgs/applications/video/shotcut/default.nix4
-rw-r--r--pkgs/applications/virtualization/bochs/bochs-2.6.9-glibc-2.26.patch14
-rw-r--r--pkgs/applications/virtualization/bochs/default.nix4
-rw-r--r--pkgs/applications/virtualization/vpcs/default.nix11
-rw-r--r--pkgs/applications/virtualization/vpcs/vpcs-0.8-glibc-2.26.patch14
-rw-r--r--pkgs/data/documentation/stdman/default.nix8
-rw-r--r--pkgs/desktops/enlightenment/enlightenment.suid-exes.patch4
-rw-r--r--pkgs/desktops/xfce/core/xfce4-panel.nix9
-rw-r--r--pkgs/desktops/xfce/core/xfce4-settings.nix37
-rw-r--r--pkgs/development/compilers/gcc/snapshot/default.nix2
-rw-r--r--pkgs/development/compilers/go/1.9.nix6
-rw-r--r--pkgs/development/compilers/go/go-1.9-skip-flaky-19608.patch12
-rw-r--r--pkgs/development/compilers/hhvm/default.nix2
-rw-r--r--pkgs/development/compilers/rust/rust-src.nix11
-rw-r--r--pkgs/development/libraries/breakpad/default.nix28
-rw-r--r--pkgs/development/libraries/kde-frameworks/fetch.sh2
-rw-r--r--pkgs/development/libraries/kde-frameworks/ktexteditor.nix5
-rw-r--r--pkgs/development/libraries/kde-frameworks/srcs.nix608
-rw-r--r--pkgs/development/libraries/libwnck/3.x.nix13
-rw-r--r--pkgs/development/libraries/qt-5/5.6/default.nix3
-rw-r--r--pkgs/development/libraries/qt-5/5.6/qtwebengine.patch874
-rw-r--r--pkgs/development/python-modules/pypcap/default.nix10
-rw-r--r--pkgs/development/tools/profiling/heaptrack/default.nix6
-rw-r--r--pkgs/development/tools/rust/racer/default.nix25
-rw-r--r--pkgs/development/tools/rust/racer/ignore-tests.patch22
-rw-r--r--pkgs/development/tools/rust/racer/rust-src.patch10
-rw-r--r--pkgs/games/factorio/default.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix4
-rw-r--r--pkgs/os-specific/linux/spl/default.nix11
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix6
-rw-r--r--pkgs/servers/mail/rspamd/default.nix8
-rw-r--r--pkgs/servers/matterbridge/default.nix4
-rw-r--r--pkgs/servers/mattermost/default.nix6
-rw-r--r--pkgs/servers/tvheadend/default.nix7
-rw-r--r--pkgs/shells/fish-foreign-env/default.nix2
-rw-r--r--pkgs/shells/fish-foreign-env/suppress-harmless-warnings.patch (renamed from pkgs/shells/fish-foreign-env/hide-path-warnings.patch)17
-rw-r--r--pkgs/tools/admin/certbot/default.nix4
-rw-r--r--pkgs/tools/admin/google-cloud-sdk/default.nix23
-rw-r--r--pkgs/tools/admin/simp_le/default.nix4
-rw-r--r--pkgs/tools/misc/fd/default.nix5
-rw-r--r--pkgs/tools/networking/inadyn/default.nix37
-rw-r--r--pkgs/tools/networking/network-manager/default.nix6
-rw-r--r--pkgs/tools/security/afl/default.nix8
-rw-r--r--pkgs/tools/security/afl/qemu-patches/qemu-2.3.0-glibc-2.26.patch121
-rw-r--r--pkgs/tools/security/afl/qemu.nix1
-rwxr-xr-xpkgs/tools/virtualization/nixos-container/nixos-container.pl2
-rw-r--r--pkgs/top-level/all-packages.nix40
-rw-r--r--pkgs/top-level/emacs-packages.nix14
-rw-r--r--pkgs/top-level/python-packages.nix6
77 files changed, 1609 insertions, 1477 deletions
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 297b91976a8..9e89cc78954 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -80,3 +80,6 @@
 
 # Eclipse
 /pkgs/applications/editors/eclipse @rycee
+
+# https://github.com/NixOS/nixpkgs/issues/31401
+/lib/maintainers.nix @ghost
diff --git a/doc/languages-frameworks/rust.md b/doc/languages-frameworks/rust.md
index 276b5496fbb..7c6955af812 100644
--- a/doc/languages-frameworks/rust.md
+++ b/doc/languages-frameworks/rust.md
@@ -24,9 +24,7 @@ overlay](#using-the-rust-nightlies-overlay).
 Rust applications are packaged by using the `buildRustPackage` helper from `rustPlatform`:
 
 ```
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   name = "ripgrep-${version}";
   version = "0.4.0";
 
@@ -40,9 +38,9 @@ buildRustPackage rec {
   cargoSha256 = "0q68qyl2h6i0qsz82z840myxlnjay8p1w5z7hfyr8fqp7wgwa9cx";
 
   meta = with stdenv.lib; {
-    description = "A utility that combines the usability of The Silver Searcher with the raw speed of grep";
+    description = "A fast line-oriented regex search tool, similar to ag and ack";
     homepage = https://github.com/BurntSushi/ripgrep;
-    license = with licenses; [ unlicense ];
+    license = licenses.unlicense;
     maintainers = [ maintainers.tailhook ];
     platforms = platforms.all;
   };
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 11f3245e58c..d6360648964 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -484,6 +484,7 @@
   ./services/networking/networkmanager.nix
   ./services/networking/nftables.nix
   ./services/networking/ngircd.nix
+  ./services/networking/nghttpx/default.nix
   ./services/networking/nix-serve.nix
   ./services/networking/nntp-proxy.nix
   ./services/networking/nsd.nix
diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index c12b5f35dea..85f39c2a43b 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -66,6 +66,16 @@ let
           How frequently to evaluate rules by default.
         '';
       };
+
+      external_labels = mkOption {
+        type = types.attrsOf types.str;
+        description = ''
+          The labels to add to any time series or alerts when
+          communicating with external systems (federation, remote
+          storage, Alertmanager).
+        '';
+        default = {};
+      };
     };
   };
 
@@ -100,6 +110,29 @@ let
           The HTTP resource path on which to fetch metrics from targets.
         '';
       };
+      honor_labels = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Controls how Prometheus handles conflicts between labels
+          that are already present in scraped data and labels that
+          Prometheus would attach server-side ("job" and "instance"
+          labels, manually configured target labels, and labels
+          generated by service discovery implementations).
+
+          If honor_labels is set to "true", label conflicts are
+          resolved by keeping label values from the scraped data and
+          ignoring the conflicting server-side labels.
+
+          If honor_labels is set to "false", label conflicts are
+          resolved by renaming conflicting labels in the scraped data
+          to "exported_<original-label>" (for example
+          "exported_instance", "exported_job") and then attaching
+          server-side labels. This is useful for use cases such as
+          federation, where all labels specified in the target should
+          be preserved.
+        '';
+      };
       scheme = mkOption {
         type = types.enum ["http" "https"];
         default = "http";
diff --git a/nixos/modules/services/networking/nghttpx/backend-params-submodule.nix b/nixos/modules/services/networking/nghttpx/backend-params-submodule.nix
new file mode 100644
index 00000000000..6523f4b8b9e
--- /dev/null
+++ b/nixos/modules/services/networking/nghttpx/backend-params-submodule.nix
@@ -0,0 +1,131 @@
+{ lib, ...}:
+{ options = {
+    proto = lib.mkOption {
+      type        = lib.types.enum [ "h2" "http/1.1" ];
+      default     = "http/1.1";
+      description = ''
+        This option configures the protocol the backend server expects
+        to use.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
+        for more detail.
+      '';
+    };
+
+    tls = lib.mkOption {
+      type        = lib.types.bool;
+      default     = false;
+      description = ''
+        This option determines whether nghttpx will negotiate its
+        connection with a backend server using TLS or not. The burden
+        is on the backend server to provide the TLS certificate!
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
+        for more detail.
+      '';
+    };
+
+    sni = lib.mkOption {
+      type        = lib.types.nullOr lib.types.str;
+      default     = null;
+      description = ''
+        Override the TLS SNI field value. This value (in nghttpx)
+        defaults to the host value of the backend configuration.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
+        for more detail.
+      '';
+    };
+
+    fall = lib.mkOption {
+      type        = lib.types.int;
+      default     = 0;
+      description = ''
+        If nghttpx cannot connect to the backend N times in a row, the
+        backend is assumed to be offline and is excluded from load
+        balancing. If N is 0 the backend is never excluded from load
+        balancing.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
+        for more detail.
+      '';
+    };
+
+    rise = lib.mkOption {
+      type        = lib.types.int;
+      default     = 0;
+      description = ''
+        If the backend is excluded from load balancing, nghttpx will
+        periodically attempt to make a connection to the backend. If
+        the connection is successful N times in a row the backend is
+        re-included in load balancing. If N is 0 a backend is never
+        reconsidered for load balancing once it falls.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
+        for more detail.
+      '';
+    };
+
+    affinity = lib.mkOption {
+      type        = lib.types.enum [ "ip" "none" ];
+      default     = "none";
+      description = ''
+        If "ip" is given, client IP based session affinity is
+        enabled. If "none" is given, session affinity is disabled.
+
+        Session affinity is enabled (by nghttpx) per-backend
+        pattern. If at least one backend has a non-"none" affinity,
+        then session affinity is enabled for all backend servers
+        sharing the same pattern.
+
+        It is advised to set affinity on all backends explicitly if
+        session affinity is desired. The session affinity may break if
+        one of the backend gets unreachable, or backend settings are
+        reloaded or replaced by API.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
+        for more detail.
+      '';
+    };
+
+    dns = lib.mkOption {
+      type        = lib.types.bool;
+      default     = false;
+      description = ''
+        Name resolution of a backends host name is done at start up,
+        or configuration reload. If "dns" is true, name resolution
+        takes place dynamically.
+
+        This is useful if a backends address changes frequently. If
+        "dns" is true, name resolution of a backend's host name at
+        start up, or configuration reload is skipped.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
+        for more detail.
+      '';
+    };
+
+    redirect-if-not-tls = lib.mkOption {
+      type        = lib.types.bool;
+      default     = false;
+      description = ''
+        If true, a backend match requires the frontend connection be
+        TLS encrypted. If it is not, nghttpx responds to the request
+        with a 308 status code and https URI the client should use
+        instead in the Location header.
+
+        The port number in the redirect URI is 443 by default and can
+        be changed using 'services.nghttpx.redirect-https-port'
+        option.
+
+        If at least one backend has "redirect-if-not-tls" set to true,
+        this feature is enabled for all backend servers with the same
+        pattern. It is advised to set "redirect-if-no-tls" parameter
+        to all backends explicitly if this feature is desired.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
+        for more detail.
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/nghttpx/backend-submodule.nix b/nixos/modules/services/networking/nghttpx/backend-submodule.nix
new file mode 100644
index 00000000000..eb559e926e7
--- /dev/null
+++ b/nixos/modules/services/networking/nghttpx/backend-submodule.nix
@@ -0,0 +1,50 @@
+{ lib, ... }:
+{ options = {
+    server = lib.mkOption {
+      type =
+        lib.types.either
+          (lib.types.submodule (import ./server-options.nix))
+          (lib.types.path);
+      example = {
+        host = "127.0.0.1";
+        port = 8888;
+      };
+      default = {
+        host = "127.0.0.1";
+        port = 80;
+      };
+      description = ''
+        Backend server location specified as either a host:port pair
+        or a unix domain docket.
+      '';
+    };
+
+    patterns = lib.mkOption {
+      type    = lib.types.listOf lib.types.str;
+      example = [
+        "*.host.net/v1/"
+        "host.org/v2/mypath"
+        "/somepath"
+      ];
+      default     = [];
+      description = ''
+        List of nghttpx backend patterns.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-b
+        for more information on the pattern syntax and nghttpxs behavior.
+      '';
+    };
+
+    params = lib.mkOption {
+      type    = lib.types.nullOr (lib.types.submodule (import ./backend-params-submodule.nix));
+      example = {
+        proto = "h2";
+        tls   = true;
+      };
+      default     = null;
+      description = ''
+        Parameters to configure a backend.
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/nghttpx/default.nix b/nixos/modules/services/networking/nghttpx/default.nix
new file mode 100644
index 00000000000..d6e1906e388
--- /dev/null
+++ b/nixos/modules/services/networking/nghttpx/default.nix
@@ -0,0 +1,117 @@
+{config, pkgs, lib, ...}:
+let
+  cfg = config.services.nghttpx;
+
+  # renderHost :: Either ServerOptions Path -> String
+  renderHost = server:
+    if builtins.isString server
+    then "unix://${server}"
+    else "${server.host},${builtins.toString server.port}";
+
+  # Filter out submodule parameters whose value is null or false or is
+  # the key _module.
+  #
+  # filterParams :: ParamsSubmodule -> ParamsSubmodule
+  filterParams = p:
+    lib.filterAttrs
+      (n: v: ("_module" != n) && (null != v) && (false != v))
+      (lib.optionalAttrs (null != p) p);
+
+  # renderBackend :: BackendSubmodule -> String
+  renderBackend = backend:
+    let
+      host = renderHost backend.server;
+      patterns = lib.concatStringsSep ":" backend.patterns;
+
+      # Render a set of backend parameters, this is somewhat
+      # complicated because nghttpx backend patterns can be entirely
+      # omitted and the params may be given as a mixed collection of
+      # 'key=val' pairs or atoms (e.g: 'proto=h2;tls')
+      params =
+        lib.mapAttrsToList
+          (n: v:
+            if builtins.isBool v
+            then n
+            else if builtins.isString v
+            then "${n}=${v}"
+            else "${n}=${builtins.toString v}")
+          (filterParams backend.params);
+
+      # NB: params are delimited by a ";" which is the same delimiter
+      # to separate the host;[pattern];[params] sections of a backend
+      sections =
+        builtins.filter (e: "" != e) ([
+          host
+          patterns
+        ]++params);
+      formattedSections = lib.concatStringsSep ";" sections;
+    in
+      "backend=${formattedSections}";
+
+  # renderFrontend :: FrontendSubmodule -> String
+  renderFrontend = frontend:
+    let
+      host   = renderHost frontend.server;
+      params0 =
+        lib.mapAttrsToList
+          (n: v: if builtins.isBool v then n else v)
+          (filterParams frontend.params);
+
+      # NB: nghttpx doesn't accept "tls", you must omit "no-tls" for
+      # the default behavior of turning on TLS.
+      params1 = lib.remove "tls" params0;
+          
+      sections          = [ host] ++ params1;
+      formattedSections = lib.concatStringsSep ";" sections;
+    in
+      "frontend=${formattedSections}";
+
+  configurationFile = pkgs.writeText "nghttpx.conf" ''
+    ${lib.optionalString (null != cfg.tls) ("private-key-file="+cfg.tls.key)}
+    ${lib.optionalString (null != cfg.tls) ("certificate-file="+cfg.tls.crt)}
+
+    user=nghttpx
+
+    ${lib.concatMapStringsSep "\n" renderFrontend cfg.frontends}
+    ${lib.concatMapStringsSep "\n" renderBackend  cfg.backends}
+
+    backlog=${builtins.toString cfg.backlog}
+    backend-address-family=${cfg.backend-address-family}
+
+    workers=${builtins.toString cfg.workers}
+    rlimit-nofile=${builtins.toString cfg.rlimit-nofile}
+
+    ${lib.optionalString cfg.single-thread "single-thread=yes"}
+    ${lib.optionalString cfg.single-process "single-process=yes"}
+
+    ${cfg.extraConfig}
+  '';
+in
+{ imports = [
+    ./nghttpx-options.nix
+  ];
+  
+  config = lib.mkIf cfg.enable {
+
+    users.groups.nghttpx = { };
+    users.users.nghttpx = {
+      group = config.users.groups.nghttpx.name;
+    };
+      
+
+    systemd.services = {
+      nghttpx = {
+        wantedBy = [ "multi-user.target" ];
+        after    = [ "network.target" ];
+        script   = ''
+          ${pkgs.nghttp2}/bin/nghttpx --conf=${configurationFile}
+        '';
+
+        serviceConfig = {
+          Restart    = "on-failure";
+          RestartSec = 60;
+        };
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/nghttpx/frontend-params-submodule.nix b/nixos/modules/services/networking/nghttpx/frontend-params-submodule.nix
new file mode 100644
index 00000000000..33c8572bd14
--- /dev/null
+++ b/nixos/modules/services/networking/nghttpx/frontend-params-submodule.nix
@@ -0,0 +1,64 @@
+{ lib, ...}:
+{ options = {
+    tls = lib.mkOption {
+      type        = lib.types.enum [ "tls" "no-tls" ];
+      default     = "tls";
+      description = ''
+        Enable or disable TLS. If true (enabled) the key and
+        certificate must be configured for nghttpx.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-f
+        for more detail.
+      '';
+    };
+
+    sni-fwd = lib.mkOption {
+      type    = lib.types.bool;
+      default = false;
+      description = ''
+        When performing a match to select a backend server, SNI host
+        name received from the client is used instead of the request
+        host. See --backend option about the pattern match.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-f
+        for more detail.
+      '';
+    };
+
+    api = lib.mkOption {
+      type        = lib.types.bool;
+      default     = false;
+      description = ''
+        Enable API access for this frontend. This enables you to
+        dynamically modify nghttpx at run-time therefore this feature
+        is disabled by default and should be turned on with care.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-f
+        for more detail.
+      '';
+    };
+
+    healthmon = lib.mkOption {
+      type        = lib.types.bool;
+      default     = false;
+      description = ''
+        Make this frontend a health monitor endpoint. Any request
+        received on this frontend is responded to with a 200 OK.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-f
+        for more detail.
+      '';
+    };
+
+    proxyproto = lib.mkOption {
+      type        = lib.types.bool;
+      default     = false;
+      description = ''
+        Accept PROXY protocol version 1 on frontend connection.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-f
+        for more detail.
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/nghttpx/frontend-submodule.nix b/nixos/modules/services/networking/nghttpx/frontend-submodule.nix
new file mode 100644
index 00000000000..887ef450213
--- /dev/null
+++ b/nixos/modules/services/networking/nghttpx/frontend-submodule.nix
@@ -0,0 +1,36 @@
+{ lib, ... }:
+{ options = {
+    server = lib.mkOption {
+      type =
+        lib.types.either
+          (lib.types.submodule (import ./server-options.nix))
+          (lib.types.path);
+      example = {
+        host = "127.0.0.1";
+        port = 8888;
+      };
+      default = {
+        host = "127.0.0.1";
+        port = 80;
+      };
+      description = ''
+        Frontend server interface binding specification as either a
+        host:port pair or a unix domain docket.
+
+        NB: a host of "*" listens on all interfaces and includes IPv6
+        addresses.
+      '';
+    };
+
+    params = lib.mkOption {
+      type    = lib.types.nullOr (lib.types.submodule (import ./frontend-params-submodule.nix));
+      example = {
+        tls   = "tls";
+      };
+      default     = null;
+      description = ''
+        Parameters to configure a backend.
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/nghttpx/nghttpx-options.nix b/nixos/modules/services/networking/nghttpx/nghttpx-options.nix
new file mode 100644
index 00000000000..cce65be321a
--- /dev/null
+++ b/nixos/modules/services/networking/nghttpx/nghttpx-options.nix
@@ -0,0 +1,142 @@
+{ config, lib, ... }:
+{ options.services.nghttpx = {
+    enable = lib.mkEnableOption "nghttpx";
+
+    frontends = lib.mkOption {
+      type        = lib.types.listOf (lib.types.submodule (import ./frontend-submodule.nix));
+      description = ''
+        A list of frontend listener specifications.
+      '';
+      example = [
+        { server = {
+            host = "*";
+            port = 80;
+          };
+
+          params = {
+            tls = "no-tls";
+          };
+        }
+      ];
+    };
+
+    backends  = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule (import ./backend-submodule.nix));
+      description = ''
+        A list of backend specifications.
+      '';
+      example = [
+        { server = {
+            host = "172.16.0.22";
+            port = 8443;
+          };
+          patterns = [ "/" ];
+          params   = {
+            proto               = "http/1.1";
+            redirect-if-not-tls = true;
+          };
+        }
+      ];
+    };
+
+    tls = lib.mkOption {
+      type        = lib.types.nullOr (lib.types.submodule (import ./tls-submodule.nix));
+      default     = null;
+      description = ''
+        TLS certificate and key paths. Note that this does not enable
+        TLS for a frontend listener, to do so, a frontend
+        specification must set <literal>params.tls</literal> to true.
+      '';
+      example = {
+        key = "/etc/ssl/keys/server.key";
+        crt = "/etc/ssl/certs/server.crt";
+      };
+    };
+
+    extraConfig = lib.mkOption {
+      type        = lib.types.lines;
+      default     = "";
+      description = ''
+        Extra configuration options to be appended to the generated
+        configuration file.
+      '';
+    };
+
+    single-process = lib.mkOption {
+      type        = lib.types.bool;
+      default     = false;
+      description = ''
+        Run this program in a single process mode for debugging
+        purpose. Without this option, nghttpx creates at least 2
+        processes: master and worker processes. If this option is
+        used, master and worker are unified into a single
+        process. nghttpx still spawns additional process if neverbleed
+        is used. In the single process mode, the signal handling
+        feature is disabled.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx--single-process
+      '';
+    };
+
+    backlog = lib.mkOption {
+      type        = lib.types.int;
+      default     = 65536;
+      description = ''
+        Listen backlog size.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx--backlog
+      '';
+    };
+
+    backend-address-family = lib.mkOption {
+      type = lib.types.enum [
+        "auto"
+        "IPv4"
+        "IPv6"
+      ];
+      default = "auto";
+      description = ''
+        Specify address family of backend connections. If "auto" is
+        given, both IPv4 and IPv6 are considered. If "IPv4" is given,
+        only IPv4 address is considered. If "IPv6" is given, only IPv6
+        address is considered.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx--backend-address-family
+      '';
+    };
+
+    workers = lib.mkOption {
+      type        = lib.types.int;
+      default     = 1;
+      description = ''
+        Set the number of worker threads.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx-n
+      '';
+    };
+
+    single-thread = lib.mkOption {
+      type        = lib.types.bool;
+      default     = false;
+      description = ''
+        Run everything in one thread inside the worker process. This
+        feature is provided for better debugging experience, or for
+        the platforms which lack thread support. If threading is
+        disabled, this option is always enabled.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx--single-thread
+      '';
+    };
+
+    rlimit-nofile = lib.mkOption {
+      type        = lib.types.int;
+      default     = 0;
+      description = ''
+        Set maximum number of open files (RLIMIT_NOFILE) to &lt;N&gt;. If 0
+        is given, nghttpx does not set the limit.
+
+        Please see https://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx--rlimit-nofile
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/nghttpx/server-options.nix b/nixos/modules/services/networking/nghttpx/server-options.nix
new file mode 100644
index 00000000000..ef23bfd793c
--- /dev/null
+++ b/nixos/modules/services/networking/nghttpx/server-options.nix
@@ -0,0 +1,18 @@
+{ lib, ... }:
+{ options = {
+    host = lib.mkOption {
+      type        = lib.types.str;
+      example     = "127.0.0.1";
+      description = ''
+        Server host address.
+      '';
+    };
+    port = lib.mkOption {
+      type        = lib.types.int;
+      example     = 5088;
+      description = ''
+        Server host port.
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/nghttpx/tls-submodule.nix b/nixos/modules/services/networking/nghttpx/tls-submodule.nix
new file mode 100644
index 00000000000..8f3cdaae2c8
--- /dev/null
+++ b/nixos/modules/services/networking/nghttpx/tls-submodule.nix
@@ -0,0 +1,21 @@
+{lib, ...}:
+{ options = {
+    key = lib.mkOption {
+      type        = lib.types.str;
+      example     = "/etc/ssl/keys/mykeyfile.key";
+      default     = "/etc/ssl/keys/server.key";
+      description = ''
+        Path to the TLS key file.
+      '';
+    };
+
+    crt = lib.mkOption {
+      type        = lib.types.str;
+      example     = "/etc/ssl/certs/mycert.crt";
+      default     = "/etc/ssl/certs/server.crt";
+      description = ''
+        Path to the TLS certificate file.
+      '';
+    };
+  };
+}
diff --git a/nixos/release.nix b/nixos/release.nix
index e02851ac45a..367fdadd0f4 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -303,6 +303,7 @@ in rec {
   tests.nfs3 = callTest tests/nfs.nix { version = 3; };
   tests.nfs4 = callTest tests/nfs.nix { version = 4; };
   tests.nginx = callTest tests/nginx.nix { };
+  tests.nghttpx = callTest tests/nghttpx.nix { };
   tests.leaps = callTest tests/leaps.nix { };
   tests.nsd = callTest tests/nsd.nix {};
   tests.openssh = callTest tests/openssh.nix {};
diff --git a/nixos/tests/containers-bridge.nix b/nixos/tests/containers-bridge.nix
index 598abd22e61..b8d4759684c 100644
--- a/nixos/tests/containers-bridge.nix
+++ b/nixos/tests/containers-bridge.nix
@@ -69,6 +69,12 @@ import ./make-test.nix ({ pkgs, ...} : {
       $machine->succeed("ping -n -c 1 $ip6");
       $machine->succeed("curl --fail http://[$ip6]/ > /dev/null");
 
+      # Check that nixos-container show-ip works in case of an ipv4 address with
+      # subnetmask in CIDR notation.
+      my $result = $machine->succeed("nixos-container show-ip webserver");
+      chomp $result;
+      $result eq $ip or die;
+
       # Stop the container.
       $machine->succeed("nixos-container stop webserver");
       $machine->fail("curl --fail --connect-timeout 2 http://$ip/ > /dev/null");
diff --git a/nixos/tests/nghttpx.nix b/nixos/tests/nghttpx.nix
new file mode 100644
index 00000000000..433562b9719
--- /dev/null
+++ b/nixos/tests/nghttpx.nix
@@ -0,0 +1,61 @@
+let
+  nginxRoot = "/var/run/nginx";
+in
+  import ./make-test.nix ({...}: {
+    name  = "nghttpx";
+    nodes = {
+      webserver = {
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        systemd.services.nginx = {
+          preStart = ''
+            mkdir -p ${nginxRoot}
+            echo "Hello world!" > ${nginxRoot}/hello-world.txt
+          '';
+        };
+
+        services.nginx = {
+          enable = true;
+          virtualHosts."server" = {
+            locations."/".root = nginxRoot;
+          };
+        };
+      };
+
+      proxy = {
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        services.nghttpx = {
+          enable = true;
+          frontends = [
+            { server = {
+                host = "*";
+                port = 80;
+              };
+
+              params = {
+                tls = "no-tls";
+              };
+            }
+          ];
+          backends = [
+            { server = {
+                host = "webserver";
+                port = 80;
+              };
+              patterns = [ "/" ];
+              params.proto = "http/1.1";
+            }
+          ];
+        };
+      };
+
+      client = {};
+    };
+
+    testScript = ''
+      startAll;
+
+      $webserver->waitForOpenPort("80");
+      $proxy->waitForOpenPort("80");
+      $client->waitUntilSucceeds("curl -s --fail http://proxy/hello-world.txt");
+    '';
+  })
diff --git a/nixos/tests/zfs.nix b/nixos/tests/zfs.nix
new file mode 100644
index 00000000000..a6908024de9
--- /dev/null
+++ b/nixos/tests/zfs.nix
@@ -0,0 +1,85 @@
+{ system ? builtins.currentSystem }:
+
+with import ../lib/testing.nix { inherit system; };
+
+let
+
+  makeTest = import ./make-test.nix;
+
+  makeZfsTest = name:
+    { kernelPackage ? pkgs.linuxPackages_latest
+    , enableUnstable ? false
+    , extraTest ? ""
+    }:
+    makeTest {
+      name = "zfs-" + name;
+      meta = with pkgs.stdenv.lib.maintainers; {
+        maintainers = [ adisbladis ];
+      };
+
+      machine = { config, lib, pkgs, ... }:
+        {
+          virtualisation.emptyDiskImages = [ 4096 ];
+          networking.hostId = "deadbeef";
+          boot.kernelPackages = kernelPackage;
+          boot.supportedFilesystems = [ "zfs" ];
+          boot.zfs.enableUnstable = enableUnstable;
+
+          environment.systemPackages = with pkgs; [
+            parted
+          ];
+        };
+
+      testScript = ''
+        $machine->succeed("modprobe zfs");
+        $machine->succeed("zpool status");
+
+        $machine->succeed("ls /dev");
+
+        $machine->succeed(
+          "mkdir /tmp/mnt",
+
+          "udevadm settle",
+          "parted --script /dev/vdb mklabel msdos",
+          "parted --script /dev/vdb -- mkpart primary 1024M -1s",
+          "udevadm settle",
+
+          "zpool create rpool /dev/vdb1",
+          "zfs create -o mountpoint=legacy rpool/root",
+          "mount -t zfs rpool/root /tmp/mnt",
+          "udevadm settle",
+
+          "umount /tmp/mnt",
+          "zpool destroy rpool",
+          "udevadm settle"
+
+        );
+
+      '' + extraTest;
+
+    };
+
+
+in {
+
+  stable = makeZfsTest "stable" { };
+
+  unstable = makeZfsTest "unstable" {
+    enableUnstable = true;
+    extraTest = ''
+      $machine->succeed(
+        "echo password | zpool create -o altroot='/tmp/mnt' -O encryption=aes-256-gcm -O keyformat=passphrase rpool /dev/vdb1",
+        "zfs create -o mountpoint=legacy rpool/root",
+        "mount -t zfs rpool/root /tmp/mnt",
+        "udevadm settle",
+
+        "umount /tmp/mnt",
+        "zpool destroy rpool",
+        "udevadm settle"
+      );
+    '';
+  };
+
+  installer = (import ./installer.nix { }).zfsroot;
+
+}
diff --git a/pkgs/applications/editors/emacs-modes/proofgeneral/HEAD.nix b/pkgs/applications/editors/emacs-modes/proofgeneral/HEAD.nix
index fd580ae9270..1cdcb9b8554 100644
--- a/pkgs/applications/editors/emacs-modes/proofgeneral/HEAD.nix
+++ b/pkgs/applications/editors/emacs-modes/proofgeneral/HEAD.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation (rec {
   name = "ProofGeneral-unstable-${version}";
-  version = "2017-05-06";
+  version = "2017-11-06";
 
   src = fetchFromGitHub {
     owner = "ProofGeneral";
     repo = "PG";
-    rev = "574b0992e3cb4b7a4ad88400b9a5ab0198a96ca5";
-    sha256 = "1c1pgdmy58h78s53g0ga9b5ilbsibz0dr2lk52xgbs3q5m22v5fh";
+    rev = "2eab72c33751768c8a6cde36b978ea4a36b91843";
+    sha256 = "1l3n48d6d4l5q3wkhdyp8dc6hzdw1ckdzr57dj8rdm78j87vh2cg";
   };
 
   buildInputs = [ emacs texinfo perl which ] ++ stdenv.lib.optional enableDoc texLive;
diff --git a/pkgs/applications/editors/jetbrains/default.nix b/pkgs/applications/editors/jetbrains/default.nix
index 41ad3164d6a..746da7534e6 100644
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -265,12 +265,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2017.2.5"; /* updated by script */
+    version = "2017.2.6"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "01p63wsy60icy4673ci435rmzpjfkyz7a8w413vw45i2bm76skhr"; /* updated by script */
+      sha256 = "150zq3wk7gsn1ibx5nkq9smfcf9n1lk347vj47yb1nwzcq0vmj2p"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IDEA_Release";
@@ -278,12 +278,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2017.2.5"; /* updated by script */
+    version = "2017.2.6"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jdk.tar.gz";
-      sha256 = "0pp49nck1cad6pz81bd95v4v55vmnvj7cbdzybmldglka1afqjb6"; /* updated by script */
+      sha256 = "1g0qcv14rn9kzf0yv17ca3w1ihl1274216n7niwkqwcjp5mvj030"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IDEA_Release";
@@ -304,12 +304,12 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2017.2.3"; /* updated by script */
+    version = "2017.2.4"; /* updated by script */
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1aik3jhggxfxnfv4kg9716gwsi013511jf9n20f2mqzdq8w2jmp8"; /* updated by script */
+      sha256 = "193f44s9vh5ksd7hs586h0j66lcqsh29wwxr5yhl05lq931la857"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm_Release";
@@ -317,12 +317,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2017.2.3"; /* updated by script */
+    version = "2017.2.4"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0ib96yaj7l0igiv2bcrqqpbfn2xn3ic7lxyjn99k6dh8ika1qvry"; /* updated by script */
+      sha256 = "0n1nps8jfk77i796yr90bvrx9j1vcdnl25sr4b5n4xznjrix4gki"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm_Release";
@@ -356,12 +356,12 @@ in
 
   webstorm = buildWebStorm rec {
     name = "webstorm-${version}";
-    version = "2017.2.4"; /* updated by script */
+    version = "2017.2.5"; /* updated by script */
     description = "Professional IDE for Web and JavaScript development";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "1dd2fbsyra4fm39w1kz2biljbrmcqwd866hvzsidigmjplhlzan0"; /* updated by script */
+      sha256 = "0apsfwcj8qfjwya794848h5iqfg9fay3h8bxqwclkw7lid9qwv7n"; /* updated by script */
     };
     wmClass = "jetbrains-webstorm";
     update-channel = "WS_Release";
diff --git a/pkgs/applications/editors/sublime3/default.nix b/pkgs/applications/editors/sublime3/default.nix
index 1ec24325460..9c8a75320a6 100644
--- a/pkgs/applications/editors/sublime3/default.nix
+++ b/pkgs/applications/editors/sublime3/default.nix
@@ -61,7 +61,7 @@ in let
 
     installPhase = ''
       # Correct sublime_text.desktop to exec `sublime' instead of /opt/sublime_text
-      sed -e 's,/opt/sublime_text/sublime_text,sublime,' -i sublime_text.desktop
+      sed -e "s,/opt/sublime_text/sublime_text,$out/sublime_text," -i sublime_text.desktop
 
       mkdir -p $out
       cp -prvd * $out/
@@ -89,9 +89,15 @@ in stdenv.mkDerivation {
 
   installPhase = ''
     mkdir -p $out/bin
-    ln -s $sublime/sublime_text $out/bin/subl
-    ln -s $sublime/sublime_text $out/bin/sublime
-    ln -s $sublime/sublime_text $out/bin/sublime3
+
+    cat > $out/bin/subl <<-EOF
+    #!/bin/sh
+    exec $sublime/sublime_text "\$@"
+    EOF
+    chmod +x $out/bin/subl
+
+    ln $out/bin/subl $out/bin/sublime
+    ln $out/bin/subl $out/bin/sublime3
     mkdir -p $out/share/applications
     ln -s $sublime/sublime_text.desktop $out/share/applications/sublime_text.desktop
     ln -s $sublime/Icon/256x256/ $out/share/icons
diff --git a/pkgs/applications/graphics/k3d/default.nix b/pkgs/applications/graphics/k3d/default.nix
index d8052f93345..ce315ebc512 100644
--- a/pkgs/applications/graphics/k3d/default.nix
+++ b/pkgs/applications/graphics/k3d/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
      cmake mesa zlib python expat libxml2 libsigcxx libuuid freetype libpng
-     boost boost doxygen cairomm pkgconfig imagemagick libjpeg libtiff
+     boost doxygen cairomm pkgconfig imagemagick libjpeg libtiff
      gettext intltool perl unzip ftgl glew asciidoc
      gtkmm2 glibmm gtkglext pangox_compat libXmu
     ];
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index 507b4f2cab9..a6d40c75c1c 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -54,13 +54,14 @@ let
 
 in pythonPackages.buildPythonApplication rec {
   name = "OctoPrint-${version}";
-  version = "1.3.4";
+  version = "1.3.5";
+  # 1.3.5, 2017-10-16, 77753ca02602d3a798d6b0a22535e6fd69ff448a
 
   src = fetchFromGitHub {
     owner = "foosel";
     repo = "OctoPrint";
     rev = version;
-    sha256 = "1hci8cfmbzcghla1vmrcn6zicm8nj50drm7gp2hkr0drglq5fgr2";
+    sha256 = "13krv9i6gm4jn4cb327q4qma4xwwashjnc0dia8vlnbjbbvkrni4";
   };
 
   # We need old Tornado
@@ -69,7 +70,7 @@ in pythonPackages.buildPythonApplication rec {
     semantic-version flask_principal werkzeug flaskbabel tornado
     psutil pyserial flask_login netaddr markdown sockjs-tornado
     pylru pyyaml sarge feedparser netifaces click websocket_client
-    scandir chainmap future dateutil
+    scandir chainmap future dateutil futures wrapt
   ];
 
   buildInputs = with pythonPackages; [ nose mock ddt ];
@@ -93,6 +94,7 @@ in pythonPackages.buildPythonApplication rec {
       -e 's,future>=[^"]*,future,g' \
       -e 's,pyserial>=[^"]*,pyserial,g' \
       -e 's,semantic_version>=[^"]*,semantic_version,g' \
+      -e 's,wrapt>=[^"]*,wrapt,g' \
       setup.py
   '';
 
diff --git a/pkgs/applications/misc/qsyncthingtray/default.nix b/pkgs/applications/misc/qsyncthingtray/default.nix
index f283c250b5b..bc909742c6d 100644
--- a/pkgs/applications/misc/qsyncthingtray/default.nix
+++ b/pkgs/applications/misc/qsyncthingtray/default.nix
@@ -20,6 +20,8 @@ mkDerivation rec {
 
   cmakeFlags = lib.optional preferQWebView "-DQST_BUILD_WEBKIT=1";
 
+  patches = [ ./qsyncthingtray-0.5.8-qt-5.6.3.patch ];
+
   postPatch = ''
     ${lib.optionalString stdenv.isLinux ''
       substituteInPlace includes/platforms/linux/posixUtils.hpp \
@@ -44,6 +46,8 @@ mkDerivation rec {
     runHook postInstall
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     homepage = https://github.com/sieren/QSyncthingTray/;
     description = "A Traybar Application for Syncthing written in C++";
diff --git a/pkgs/applications/misc/qsyncthingtray/qsyncthingtray-0.5.8-qt-5.6.3.patch b/pkgs/applications/misc/qsyncthingtray/qsyncthingtray-0.5.8-qt-5.6.3.patch
new file mode 100644
index 00000000000..424bbe17177
--- /dev/null
+++ b/pkgs/applications/misc/qsyncthingtray/qsyncthingtray-0.5.8-qt-5.6.3.patch
@@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b778d09..247b606 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -12,7 +12,7 @@ set(CMAKE_AUTOMOC ON)
+ 
+ set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11")
+ 
+-find_package(Qt5 5.6 COMPONENTS Widgets Network PrintSupport)
++find_package(Qt5 5.6 COMPONENTS Widgets Network PrintSupport WebEngineWidgets)
+ if (NOT Qt5_FOUND)
+   message(FATAL_ERROR
+     "Some components of Qt5 not found (see above messages for details. "
diff --git a/pkgs/applications/networking/dropbox/default.nix b/pkgs/applications/networking/dropbox/default.nix
index d15b1d545b4..e60fd82ff01 100644
--- a/pkgs/applications/networking/dropbox/default.nix
+++ b/pkgs/applications/networking/dropbox/default.nix
@@ -34,7 +34,7 @@ buildFHSUserEnv {
 
   targetPkgs = pkgs: with pkgs; with xlibs; [
     libICE libSM libX11 libXcomposite libXdamage libXext libXfixes libXrender
-    libXxf86vm libxcb
+    libXxf86vm libxcb xkeyboardconfig
     curl dbus fontconfig freetype gcc glib gnutar libxml2 libxslt zlib
   ];
 
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
index b56a1012806..3f438c62508 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@@ -1,6 +1,6 @@
 { mkDerivation, lib, fetchgit, pkgconfig, gyp, cmake
 , qtbase, qtimageformats
-, breakpad, gtk3, libappindicator-gtk3, dee
+, gtk3, libappindicator-gtk3, dee
 , ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio
 , gcc
 }:
diff --git a/pkgs/applications/office/fava/default.nix b/pkgs/applications/office/fava/default.nix
index 56a93e99009..fdbf9183d75 100644
--- a/pkgs/applications/office/fava/default.nix
+++ b/pkgs/applications/office/fava/default.nix
@@ -5,12 +5,12 @@ let
 in
 buildPythonApplication rec {
   pname = "fava";
-  version = "1.5";
+  version = "1.6";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0d3jncidzvfsxjplzg4cmflqr4mxrbrlj5bh6fpxj529pialpkk6";
+    sha256 = "0iif4imx76ra0lsisksrq5vf54wbivnrb3xqz6mkx9lik3pp5sbx";
   };
 
   doCheck = false;
diff --git a/pkgs/applications/office/zotero/default.nix b/pkgs/applications/office/zotero/default.nix
index a4b15b6626e..b259623bf91 100644
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@@ -1,82 +1,66 @@
-{ stdenv, fetchurl, lib, bash, firefox, perl, unzipNLS, xorg }:
+{ stdenv, fetchurl, buildFHSUserEnv, makeDesktopItem, runCommand, bash, wrapGAppsHook, gsettings_desktop_schemas, gtk3, gnome3 }:
 
 let
-
-  xpi = fetchurl {
-    url = "https://download.zotero.org/extension/zotero-${version}.xpi";
-    sha256 = "1dyf578yfj3xr9kkhmsvbkvraw2arghmh67ksi5c8qlxczx5i1xy";
-  };
-
-  version = "4.0.29";
-
-in
-stdenv.mkDerivation {
-  name = "zotero-${version}";
+version = "5.0.25";
+meta = with stdenv.lib; {
+  homepage = https://www.zotero.org;
+  description = "Collect, organize, cite, and share your research sources";
+  license = licenses.agpl3;
+  platforms = platforms.linux;
+};
+
+zoteroSrc = stdenv.mkDerivation rec {
   inherit version;
+  name = "zotero-${version}-pkg";
 
   src = fetchurl {
-    url = "https://github.com/zotero/zotero-standalone-build/archive/4.0.29.2.tar.gz";
-    sha256 = "0pfip6s5dawp7wp8r5czvzlnxvvdwjja64g71h9dxyxrh49v2mxa";
+    url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
+    sha256 = "1y3q5582xp4inpz137x0r9iscs1g0cjlqcfjpzl3klsq3yas688k";
   };
 
-  nativeBuildInputs = [ perl unzipNLS ];
-
-  inherit bash firefox;
-
-  phases = "unpackPhase installPhase fixupPhase";
+  buildInputs= [ wrapGAppsHook gsettings_desktop_schemas gtk3 gnome3.adwaita-icon-theme gnome3.dconf ];
+  phases = [ "unpackPhase" "installPhase" "fixupPhase"];
 
   installPhase = ''
-    mkdir -p "$out/libexec/zotero"
-    unzip "${xpi}" -d "$out/libexec/zotero"
-
-    BUILDID=`date +%Y%m%d`
-    GECKO_VERSION="${lib.removeSuffix "esr" firefox.passthru.version}"
-    UPDATE_CHANNEL="default"
-
-    # Copy branding
-    cp -R assets/branding "$out/libexec/zotero/chrome/branding"
-
-    # Adjust chrome.manifest
-    echo "" >> "$out/libexec/zotero/chrome.manifest"
-    cat assets/chrome.manifest >> "$out/libexec/zotero/chrome.manifest"
-
-    # Copy updater.ini
-    cp assets/updater.ini "$out/libexec/zotero"
-
-    # Adjust connector pref
-    perl -pi -e 's/pref\("extensions\.zotero\.httpServer\.enabled", false\);/pref("extensions.zotero.httpServer.enabled", true);/g' "$out/libexec/zotero/defaults/preferences/zotero.js"
-    perl -pi -e 's/pref\("extensions\.zotero\.connector\.enabled", false\);/pref("extensions.zotero.connector.enabled", true);/g' "$out/libexec/zotero/defaults/preferences/zotero.js"
-
-    # Copy icons
-    cp -r assets/icons "$out/libexec/zotero/chrome/icons"
-
-    # Copy application.ini and modify
-    cp assets/application.ini "$out/libexec/zotero/application.ini"
-    perl -pi -e "s/\{\{VERSION}}/$version/" "$out/libexec/zotero/application.ini"
-    perl -pi -e "s/\{\{BUILDID}}/$BUILDID/" "$out/libexec/zotero/application.ini"
-    perl -pi -e "s/^MaxVersion.*\$/MaxVersion=$GECKO_VERSION/" "$out/libexec/zotero/application.ini"
-
-    # Copy prefs.js and modify
-    cp assets/prefs.js "$out/libexec/zotero/defaults/preferences"
-    perl -pi -e 's/pref\("app\.update\.channel", "[^"]*"\);/pref\("app\.update\.channel", "'"$UPDATE_CHANNEL"'");/' "$out/libexec/zotero/defaults/preferences/prefs.js"
-    perl -pi -e 's/%GECKO_VERSION%/'"$GECKO_VERSION"'/g' "$out/libexec/zotero/defaults/preferences/prefs.js"
-
-    # Add platform-specific standalone assets
-    cp -R assets/unix "$out/libexec/zotero"
-
-    mkdir -p "$out/bin"
-    substituteAll "${./zotero.sh}" "$out/bin/zotero"
-    chmod +x "$out/bin/zotero"
+    mkdir -p $out/data
+    cp -r * $out/data
+    mkdir $out/bin
+    ln -s $out/data/zotero $out/bin/zotero
   '';
+};
 
-  doInstallCheck = true;
-  installCheckPhase = "$out/bin/zotero --version";
+fhsEnv = buildFHSUserEnv {
+  name = "zotero-fhs-env";
+  targetPkgs = pkgs: with pkgs; with xlibs; [
+    gtk3 dbus_glib
+    libXt nss
+  ];
+};
 
-  meta = with stdenv.lib; {
-    homepage = https://www.zotero.org;
-    description = "Collect, organize, cite, and share your research sources";
-    license = licenses.agpl3;
-    platforms = platforms.linux;
-    broken = true; # probably; see #20049
-  };
-}
+desktopItem = makeDesktopItem rec {
+  name = "zotero-${version}";
+  exec = "zotero -url %U";
+  icon = "zotero";
+  type = "Application";
+  comment = meta.description;
+  desktopName = "Zotero";
+  genericName = "Reference Management";
+  categories = "Office;Database;";
+  startupNotify = "true";
+};
+
+in runCommand "zotero-${version}" { inherit meta; } ''
+  mkdir -p $out/bin $out/share/applications
+  cat >$out/bin/zotero <<EOF
+#!${bash}/bin/bash
+${fhsEnv}/bin/zotero-fhs-env ${zoteroSrc}/bin/zotero
+EOF
+  chmod +x $out/bin/zotero
+
+  cp ${desktopItem}/share/applications/* $out/share/applications/
+
+  for size in 16 32 48 256; do
+    install -Dm444 ${zoteroSrc}/data/chrome/icons/default/default$size.png \
+      $out/share/icons/hicolor/''${size}x''${size}/apps/zotero.png
+  done
+''
diff --git a/pkgs/applications/science/biology/vcftools/default.nix b/pkgs/applications/science/biology/vcftools/default.nix
new file mode 100755
index 00000000000..ab3050955df
--- /dev/null
+++ b/pkgs/applications/science/biology/vcftools/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, htslib, zlib, autoreconfHook, pkgconfig, perl }:
+
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "vcftools";
+  version = "0.1.15";
+
+  src = fetchFromGitHub {
+    repo = pname;
+    owner = "vcftools";
+    rev = "v${version}";
+    sha256 = "15yxr4kidqb42gkbd6rjra6b07wpl6rgivlh9q73yavh5myafqk4";
+  };
+
+  buildInputs = [ autoreconfHook pkgconfig zlib perl ];
+
+  meta = with stdenv.lib; {
+    description = "A set of tools written in Perl and C++ for working with VCF files, such as those generated by the 1000 Genomes Project";
+    license = licenses.lgpl3;
+    platforms = platforms.linux;
+    homepage = https://vcftools.github.io/index.html;
+    maintainers = [ maintainers.rybern ];
+  };
+}
diff --git a/pkgs/applications/video/shotcut/default.nix b/pkgs/applications/video/shotcut/default.nix
index 2fd0d57b4e2..6b1389c97ab 100644
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   name = "shotcut-${version}";
-  version = "17.09";
+  version = "17.11";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "shotcut";
     rev = "v${version}";
-    sha256 = "061jmk1g2h7p82kyk2zgk19g0y3dgx3lppfnm6cdmi550b51qllb";
+    sha256 = "1bw2cjpzycddxi9b21haiaslv0ikia85wwgkfm2xl2m15w5j8510";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/virtualization/bochs/bochs-2.6.9-glibc-2.26.patch b/pkgs/applications/virtualization/bochs/bochs-2.6.9-glibc-2.26.patch
new file mode 100644
index 00000000000..a13b42ee35a
--- /dev/null
+++ b/pkgs/applications/virtualization/bochs/bochs-2.6.9-glibc-2.26.patch
@@ -0,0 +1,14 @@
+diff --git a/iodev/network/slirp/slirp.h b/iodev/network/slirp/slirp.h
+index 7c16aa3..202a1b7 100644
+--- a/iodev/network/slirp/slirp.h
++++ b/iodev/network/slirp/slirp.h
+@@ -33,8 +33,8 @@ typedef char *caddr_t;
+ #endif
+ 
+ #include <sys/types.h>
+-#if defined(__OpenBSD__)
+ #include <stdint.h>
++#if defined(__OpenBSD__)
+ #include <sys/wait.h>
+ #endif
+ #ifdef HAVE_SYS_BITYPES_H
diff --git a/pkgs/applications/virtualization/bochs/default.nix b/pkgs/applications/virtualization/bochs/default.nix
index 211bd2f39e0..4ad8f021326 100644
--- a/pkgs/applications/virtualization/bochs/default.nix
+++ b/pkgs/applications/virtualization/bochs/default.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
     sha256 = "1379cq4cnfprhw8mgh60i0q9j8fz8d7n3d5fnn2g9fdiv5znfnzf";
   };
 
+  patches = [ ./bochs-2.6.9-glibc-2.26.patch ];
+
   buildInputs = with stdenv.lib;
   [ pkgconfig libtool gtk2 mesa readline libX11 libXpm docbook_xml_dtd_45 docbook_xsl ]
   ++ optionals termSupport [ ncurses ]
@@ -107,6 +109,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" ];
 
+  enableParallelBuilding = true;
+
   meta = {
     description = "An open-source IA-32 (x86) PC emulator";
     longDescription = ''
diff --git a/pkgs/applications/virtualization/vpcs/default.nix b/pkgs/applications/virtualization/vpcs/default.nix
index cac997e43b5..af344eb82cf 100644
--- a/pkgs/applications/virtualization/vpcs/default.nix
+++ b/pkgs/applications/virtualization/vpcs/default.nix
@@ -6,26 +6,27 @@ stdenv.mkDerivation rec {
   version = "0.8";
 
   src = fetchurl {
+    name = "${name}.tar.bz2";
     url = "mirror://sourceforge/project/${pname}/${version}/${name}-src.tbz";
     sha256 = "14y9nflcyq486vvw0na0fkfmg5dac004qb332v4m5a0vaz8059nw";
   };
 
-  unpackCmd = "tar -xjf $src";
+  patches = [ ./vpcs-0.8-glibc-2.26.patch ];
 
   buildInputs = [ glibc.static ];
 
-  buildPhase = ''
+  buildPhase = ''(
     cd src
     ./mk.sh ${buildPlatform.platform.kernelArch}
-  '';
+  )'';
 
   installPhase = ''
-    cd ..
-
     install -D -m555 src/vpcs $out/bin/vpcs;
     install -D -m444 man/vpcs.1 $out/share/man/man1/vpcs.1;
   '';
 
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     description = "Virtual PC simulator";
     longDescription = ''
diff --git a/pkgs/applications/virtualization/vpcs/vpcs-0.8-glibc-2.26.patch b/pkgs/applications/virtualization/vpcs/vpcs-0.8-glibc-2.26.patch
new file mode 100644
index 00000000000..d94a39ccd64
--- /dev/null
+++ b/pkgs/applications/virtualization/vpcs/vpcs-0.8-glibc-2.26.patch
@@ -0,0 +1,14 @@
+diff --git a/src/getopt.h b/src/getopt.h
+index 4394aa2..bf59e10 100644
+--- a/src/getopt.h
++++ b/src/getopt.h
+@@ -49,9 +49,6 @@ extern int optind;
+ extern int opterr;
+ extern int optopt;
+ 
+-#ifndef FreeBSD
+-int getopt(int argc, char** argv, char* optstr);
+-#endif
+ int arg_to_int(const char* arg, int min, int max, int defalt);
+ 
+ #ifdef __cplusplus
diff --git a/pkgs/data/documentation/stdman/default.nix b/pkgs/data/documentation/stdman/default.nix
index 114c8ebce98..59a7612c6aa 100644
--- a/pkgs/data/documentation/stdman/default.nix
+++ b/pkgs/data/documentation/stdman/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "stdman-${version}";
-  version = "d860212";
+  version = "2017.04.02";
 
   src = fetchFromGitHub {
     owner = "jeaye";
     repo = "stdman";
-    rev = "d860212767ca60472e33aa3bad22a3eac834b1f8";
-    sha256 = "09c5gjhcz97ghfrv9zkgfb1wckvmqnhbzga0xidbm1ir7640di8l";
+    rev = "${version}";
+    sha256 = "1wfxd9ca8b9l976rnlhjd0sp364skfm99wxi633swwwjvhy26sgm";
   };
 
   outputDevdoc = "out";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ curl ];
 
   meta = with stdenv.lib; {
-    description = "Formatted C++11/14 stdlib man pages (cppreference)";
+    description = "Formatted C++17 stdlib man pages (cppreference)";
     longDescription = "stdman is a tool that parses archived HTML
       files from cppreference and generates groff-formatted manual
       pages for Unix-based systems. The goal is to provide excellent
diff --git a/pkgs/desktops/enlightenment/enlightenment.suid-exes.patch b/pkgs/desktops/enlightenment/enlightenment.suid-exes.patch
index 0553fcc16ba..7a89309c89f 100644
--- a/pkgs/desktops/enlightenment/enlightenment.suid-exes.patch
+++ b/pkgs/desktops/enlightenment/enlightenment.suid-exes.patch
@@ -1,5 +1,5 @@
 --- enlightenment-0.22.0.orig/meson/meson_inst.sh	2017-09-25 10:55:43.000000000 -0300
-+++ enlightenment-0.22.0/meson/meson_inst.sh	2017-11-12 09:04:33.356050746 -0200
++++ enlightenment-0.22.0/meson/meson_inst.sh	2017-11-15 08:31:03.336844920 -0200
 @@ -1,6 +1,19 @@
 -#!/bin/sh
 +#!/bin/sh -x
@@ -18,7 +18,7 @@
 +	b=$(basename "$f".orig)
 +	mv -v "$f"{,.orig}
 +	ln -sv /run/wrappers/bin/"$b" "$f"
-+	echo "    \"$b\".source = \"$f\";" >> $w
++	echo "    \"$b\".source = \"$f.orig\";" >> $w
  done
 +
 +echo "  };" >> $w
diff --git a/pkgs/desktops/xfce/core/xfce4-panel.nix b/pkgs/desktops/xfce/core/xfce4-panel.nix
index 9a5d390f3b8..e91a3ab25ee 100644
--- a/pkgs/desktops/xfce/core/xfce4-panel.nix
+++ b/pkgs/desktops/xfce/core/xfce4-panel.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, pkgconfig, intltool, gtk, libxfce4util, libxfce4ui
 , libxfce4ui_gtk3, libwnck, exo, garcon, xfconf, libstartup_notification
 , makeWrapper, xfce4mixer, hicolor_icon_theme
-, withGtk3 ? false, gtk3
+, withGtk3 ? false, gtk3, gettext
 }:
 let
   inherit (stdenv.lib) optional;
@@ -20,6 +20,12 @@ stdenv.mkDerivation rec {
   patches = [ ./xfce4-panel-datadir.patch ];
   patchFlags = "-p1";
 
+  postPatch = ''
+    for f in $(find . -name \*.sh); do
+      substituteInPlace $f --replace gettext ${gettext}/bin/gettext
+    done
+  '';
+
   outputs = [ "out" "dev" "devdoc" ];
 
   buildInputs =
@@ -47,4 +53,3 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.eelco ];
   };
 }
-
diff --git a/pkgs/desktops/xfce/core/xfce4-settings.nix b/pkgs/desktops/xfce/core/xfce4-settings.nix
index 8e3998c05f2..592b03e8954 100644
--- a/pkgs/desktops/xfce/core/xfce4-settings.nix
+++ b/pkgs/desktops/xfce/core/xfce4-settings.nix
@@ -1,5 +1,7 @@
-{ stdenv, fetchurl, pkgconfig, intltool, exo, gtk, libxfce4util, libxfce4ui
-, libglade, xfconf, xorg, libwnck, libnotify, libxklavier, garcon, upower }:
+{ stdenv, fetchurl, pkgconfig, intltool, exo, gtk, garcon, libxfce4util
+, libxfce4ui, xfconf, libXi, upower ? null, libnotify ? null
+, libXcursor ? null, xf86inputlibinput ? null, libxklavier ? null }:
+
 let
   p_name  = "xfce4-settings";
   ver_maj = "4.12";
@@ -15,17 +17,33 @@ stdenv.mkDerivation rec {
 
   patches = [ ./xfce4-settings-default-icon-theme.patch ];
 
-  nativeBuildInputs =
-    [ pkgconfig intltool
-    ];
+  postPatch = ''
+    for f in $(find . -name \*.c); do
+      substituteInPlace $f --replace \"libinput-properties.h\" '<xorg/libinput-properties.h>'
+    done
+  '';
+
+  nativeBuildInputs = [ pkgconfig intltool ];
 
-  buildInputs =
-    [ exo gtk libxfce4util libxfce4ui libglade upower xfconf
-      xorg.libXi xorg.libXcursor libwnck libnotify libxklavier garcon
-    ]; #TODO: optional packages
+  buildInputs = [
+    exo
+    gtk
+    garcon
+    libxfce4util
+    libxfce4ui
+    xfconf
+    libXi
+    upower
+    libnotify
+    libXcursor
+    xf86inputlibinput
+    libxklavier
+  ];
 
   configureFlags = [ "--enable-pluggable-dialogs" "--enable-sound-settings" ];
 
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     homepage = http://www.xfce.org/projects/xfce4-settings;
     description = "Settings manager for Xfce";
@@ -34,4 +52,3 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.eelco ];
   };
 }
-
diff --git a/pkgs/development/compilers/gcc/snapshot/default.nix b/pkgs/development/compilers/gcc/snapshot/default.nix
index e235be639c6..4ec92b7bdb6 100644
--- a/pkgs/development/compilers/gcc/snapshot/default.nix
+++ b/pkgs/development/compilers/gcc/snapshot/default.nix
@@ -541,6 +541,8 @@ stdenv.mkDerivation ({
       stdenv.lib.platforms.linux ++
       stdenv.lib.platforms.freebsd ++
       optionals (langAda == false) stdenv.lib.platforms.darwin;
+
+    broken = true;
   };
 }
 
diff --git a/pkgs/development/compilers/go/1.9.nix b/pkgs/development/compilers/go/1.9.nix
index 50fa2d97627..b8660008d94 100644
--- a/pkgs/development/compilers/go/1.9.nix
+++ b/pkgs/development/compilers/go/1.9.nix
@@ -118,11 +118,7 @@ stdenv.mkDerivation rec {
       ./ssl-cert-file-1.9.patch
       ./creds-test.patch
       ./remove-test-pie-1.9.patch
-
-      (fetchpatch {
-        url = "https://github.com/golang/go/commit/29415eb2b92e78481897c4161ba99f5b09fa6102.patch";
-        sha256 = "01jkm4b2dazzjnfla7rdd0w2clzplga3zza6ybpmkjkk3i4bp73d";
-      })
+      ./go-1.9-skip-flaky-19608.patch
     ];
 
   postPatch = optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/compilers/go/go-1.9-skip-flaky-19608.patch b/pkgs/development/compilers/go/go-1.9-skip-flaky-19608.patch
new file mode 100644
index 00000000000..a4d9f067479
--- /dev/null
+++ b/pkgs/development/compilers/go/go-1.9-skip-flaky-19608.patch
@@ -0,0 +1,12 @@
+diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go
+index 7137599..43cca2e 100644
+--- a/src/net/http/serve_test.go
++++ b/src/net/http/serve_test.go
+@@ -5361,6 +5361,7 @@ func testServerKeepAlivesEnabled(t *testing.T, h2 bool) {
+ // the server's doing its 1-byte background read between requests,
+ // waiting for the connection to maybe close.
+ func TestServerCancelsReadTimeoutWhenIdle(t *testing.T) {
++	testenv.SkipFlaky(t, 19608)
+ 	setParallel(t)
+ 	defer afterTest(t)
+ 	const timeout = 250 * time.Millisecond
diff --git a/pkgs/development/compilers/hhvm/default.nix b/pkgs/development/compilers/hhvm/default.nix
index 3a37ec13758..4159b7bd52b 100644
--- a/pkgs/development/compilers/hhvm/default.nix
+++ b/pkgs/development/compilers/hhvm/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  enableParallelBuilding = false; # occasional build problems;
+  enableParallelBuilding = true;
   dontUseCmakeBuildDir = true;
   NIX_LDFLAGS = "-lpam -L${pam}/lib";
 
diff --git a/pkgs/development/compilers/rust/rust-src.nix b/pkgs/development/compilers/rust/rust-src.nix
new file mode 100644
index 00000000000..1b819a7f606
--- /dev/null
+++ b/pkgs/development/compilers/rust/rust-src.nix
@@ -0,0 +1,11 @@
+{ stdenv, rustc }:
+
+stdenv.mkDerivation {
+  name = "rust-src";
+  src = rustc.src;
+  phases = [ "unpackPhase" "installPhase" ];
+  installPhase = ''
+    mv src $out
+    rm -rf $out/{ci,doc,driver,etc,grammar,llvm,rt,rtstartup,rustllvm,test,tools,vendor}
+  '';
+}
diff --git a/pkgs/development/libraries/breakpad/default.nix b/pkgs/development/libraries/breakpad/default.nix
deleted file mode 100644
index 7f3117fac42..00000000000
--- a/pkgs/development/libraries/breakpad/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ stdenv, fetchgit }:
-
-stdenv.mkDerivation {
-  name = "breakpad-2016-03-28";
-  
-  src = fetchgit {
-    url = "https://chromium.googlesource.com/breakpad/breakpad";
-    rev = "512cac3a1b69721ab727f3079f4d29e4580467b1";
-    sha256 = "1ksilbdpi1krycxkidqd1dlly95qf7air3zy8h5zfnagrlkz7zzx";
-  };
-
-  breakpad_lss = fetchgit {
-    url = "https://chromium.googlesource.com/linux-syscall-support";
-    rev = "08056836f2b4a5747daff75435d10d649bed22f6";
-    sha256 = "1ryshs2nyxwa0kn3rlbnd5b3fhna9vqm560yviddcfgdm2jyg0hz";
-  };
-
-  enableParallelBuilding = true;
-
-  prePatch = ''
-    cp -r $breakpad_lss src/third_party/lss
-    chmod +w -R src/third_party/lss
-  '';
-
-  meta = {
-    platforms = stdenv.lib.platforms.unix;
-  };
-}
diff --git a/pkgs/development/libraries/kde-frameworks/fetch.sh b/pkgs/development/libraries/kde-frameworks/fetch.sh
index 0e0372ad7ac..6453252b161 100644
--- a/pkgs/development/libraries/kde-frameworks/fetch.sh
+++ b/pkgs/development/libraries/kde-frameworks/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.39/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.40/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/kde-frameworks/ktexteditor.nix b/pkgs/development/libraries/kde-frameworks/ktexteditor.nix
index 7fc11b1505c..3efd4cf4e2a 100644
--- a/pkgs/development/libraries/kde-frameworks/ktexteditor.nix
+++ b/pkgs/development/libraries/kde-frameworks/ktexteditor.nix
@@ -14,9 +14,4 @@ mkDerivation {
     qtxmlpatterns sonnet syntax-highlighting qtquickcontrols
   ];
   propagatedBuildInputs = [ kparts ];
-  patches = [ (fetchpatch {
-    url = "https://cgit.kde.org/ktexteditor.git/patch/?id=aeebeadb5f5955995c17de56cf83ba7166a132dd";
-    sha256 = "10a61w1qyw3czffl06xgccgd3yycz7s0hpg2vj0a24v05jhqiigf";
-    name = "ktextedtor_fix_indenters.patch";
-  })];
 }
diff --git a/pkgs/development/libraries/kde-frameworks/srcs.nix b/pkgs/development/libraries/kde-frameworks/srcs.nix
index 3a8ed594655..f87d632af0c 100644
--- a/pkgs/development/libraries/kde-frameworks/srcs.nix
+++ b/pkgs/development/libraries/kde-frameworks/srcs.nix
@@ -3,611 +3,611 @@
 
 {
   attica = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/attica-5.39.0.tar.xz";
-      sha256 = "15972518n4g65k391imkcsjikfsfhx8livdm6n0whag0aiz55haf";
-      name = "attica-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/attica-5.40.0.tar.xz";
+      sha256 = "1ng76yhljl1ny0wvb7yckiivwqn3llmhk0h4j82zag5965q906iz";
+      name = "attica-5.40.0.tar.xz";
     };
   };
   baloo = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/baloo-5.39.0.tar.xz";
-      sha256 = "06y8mv7v9y7syz04x0zicdm628k6za3p366xrzwafc43m159wyms";
-      name = "baloo-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/baloo-5.40.0.tar.xz";
+      sha256 = "09hqw8xl34galpiv6rwnq2rrbdp6z9nkx9j71jf87ia22sclz55a";
+      name = "baloo-5.40.0.tar.xz";
     };
   };
   bluez-qt = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/bluez-qt-5.39.0.tar.xz";
-      sha256 = "0j0072q0zc9hdpjbkqciqv18pwpdij74qrjph7whh66csjkr5ad1";
-      name = "bluez-qt-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/bluez-qt-5.40.0.tar.xz";
+      sha256 = "0js212bi7h09bcbd2lr7ic10fy3z09w3v0d0r5210p989qd42a5a";
+      name = "bluez-qt-5.40.0.tar.xz";
     };
   };
   breeze-icons = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/breeze-icons-5.39.0.tar.xz";
-      sha256 = "132bpgma1lqhrly48zz1f8jyg5z5pvnn1wnqxz6psvqhipw7fh5x";
-      name = "breeze-icons-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/breeze-icons-5.40.0.tar.xz";
+      sha256 = "1gdpv6w9a6bhr0dgaldi9pj24a2qvz1ax4jya8i4ck7dl9cgkq96";
+      name = "breeze-icons-5.40.0.tar.xz";
     };
   };
   extra-cmake-modules = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/extra-cmake-modules-5.39.0.tar.xz";
-      sha256 = "1ldwzx2bzlzw7r31w8zy08j4cn9q7d1kszc5jb22zhfqpvbkc1dq";
-      name = "extra-cmake-modules-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/extra-cmake-modules-5.40.0.tar.xz";
+      sha256 = "02k3dr4w12l9rdgl3l1v3d8zhaf51km4w3p1c3sy8x24r24qir43";
+      name = "extra-cmake-modules-5.40.0.tar.xz";
     };
   };
   frameworkintegration = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/frameworkintegration-5.39.0.tar.xz";
-      sha256 = "136s8chyiac30czicqgkrc4abgm7c8b2ppnqwv9ngxpx7nsjgd2h";
-      name = "frameworkintegration-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/frameworkintegration-5.40.0.tar.xz";
+      sha256 = "1r480hx18irycaygbxbxsgf1qrk6cdj0ccfi4rqcygxkv52gcxxj";
+      name = "frameworkintegration-5.40.0.tar.xz";
     };
   };
   kactivities = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kactivities-5.39.0.tar.xz";
-      sha256 = "0nkc1p7n6yvybcib6aqmnz08hwn3ryj1f9wbkiimgs0svr00sslq";
-      name = "kactivities-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kactivities-5.40.0.tar.xz";
+      sha256 = "0c6dgmzs6l33kr4a7aivs8ijf6yw616pz5gmh7sdjw2ny4gxdzab";
+      name = "kactivities-5.40.0.tar.xz";
     };
   };
   kactivities-stats = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kactivities-stats-5.39.0.tar.xz";
-      sha256 = "18ghfqggwf38rmb1lkbv8ggxx71cp6ba3882kp5ccb7wwih51qcy";
-      name = "kactivities-stats-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kactivities-stats-5.40.0.tar.xz";
+      sha256 = "0cdnq2nh3p7baxcag0f1sid5mrmmidfpsd77bb9s0xj11jvs95bx";
+      name = "kactivities-stats-5.40.0.tar.xz";
     };
   };
   kapidox = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kapidox-5.39.0.tar.xz";
-      sha256 = "12nmsa1cg5amyawfxywlg8qsl01idi0jacrd8jzmvdj5m8sisw6n";
-      name = "kapidox-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kapidox-5.40.0.tar.xz";
+      sha256 = "1wvnbmxjxmrm0z1digbfbf5ssf6klzdmzf5lbw7ilf5mkah1bdpy";
+      name = "kapidox-5.40.0.tar.xz";
     };
   };
   karchive = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/karchive-5.39.0.tar.xz";
-      sha256 = "0rb8vr6lg8vx4f07swvlsyrxy4gj21aqfffk0cvhlsdz94j1phrw";
-      name = "karchive-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/karchive-5.40.0.tar.xz";
+      sha256 = "1cbvv6rdrnag2vjbrzdg59csmqi247d594xan7r319qb76ai860y";
+      name = "karchive-5.40.0.tar.xz";
     };
   };
   kauth = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kauth-5.39.0.tar.xz";
-      sha256 = "08bjxvv22y199skx4l9m8az165wz7inqqx7s8b7p5cjms4bvi15i";
-      name = "kauth-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kauth-5.40.0.tar.xz";
+      sha256 = "072wjhvscyyh2q61knxm8ipqr9r01dzhqd8dihp6c5zmbbpz29ss";
+      name = "kauth-5.40.0.tar.xz";
     };
   };
   kbookmarks = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kbookmarks-5.39.0.tar.xz";
-      sha256 = "1xfabyc7hxmi1p0wqld0va5pl6bfwh50px4mvpxbnjdna6anw6z5";
-      name = "kbookmarks-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kbookmarks-5.40.0.tar.xz";
+      sha256 = "1i28pic968llggh24hn84kiq9nhdcv3pn4hbhb0lqb4chrmm322i";
+      name = "kbookmarks-5.40.0.tar.xz";
     };
   };
   kcmutils = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kcmutils-5.39.0.tar.xz";
-      sha256 = "1cz4haj83j59szl16r0mfh4zx93szrwkmb9mq2r21v46c8k5ldw0";
-      name = "kcmutils-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kcmutils-5.40.0.tar.xz";
+      sha256 = "1pjvjidv9nx8kg5wvkmxanp9y6ins9f43cn933q6g9gczy2hfcbl";
+      name = "kcmutils-5.40.0.tar.xz";
     };
   };
   kcodecs = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kcodecs-5.39.0.tar.xz";
-      sha256 = "1q0l88nfbxgdy5lpm5xbcs749n9jyxhq7xsgqpf9c8irc7c1gw7f";
-      name = "kcodecs-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kcodecs-5.40.0.tar.xz";
+      sha256 = "0zq9d5006zhp0v31ydc7q0i117l6f8b04l5jgqcl719q1a2hk1x4";
+      name = "kcodecs-5.40.0.tar.xz";
     };
   };
   kcompletion = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kcompletion-5.39.0.tar.xz";
-      sha256 = "09jdc4pn7yjb7nagic38xiqdpv9fy4f2f4c1a5ynbli7x1r6l7ms";
-      name = "kcompletion-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kcompletion-5.40.0.tar.xz";
+      sha256 = "17dzal655xdxdsifk2dmgyj2hja03pcvdqvzpsyq259qbm42cal4";
+      name = "kcompletion-5.40.0.tar.xz";
     };
   };
   kconfig = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kconfig-5.39.0.tar.xz";
-      sha256 = "011i48f07470igqqcz4hychbw0q85p0bh5dykpla4zwdldllsl1w";
-      name = "kconfig-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kconfig-5.40.0.tar.xz";
+      sha256 = "0pr9ammqgbz3gkg6iczp3v9s36cfzzh40kbz2bz29qaxa966b5kb";
+      name = "kconfig-5.40.0.tar.xz";
     };
   };
   kconfigwidgets = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kconfigwidgets-5.39.0.tar.xz";
-      sha256 = "1i6cniqsmn9sds8nj7bcsnbmlkq9m1yjwvr45mhal9rkhaas4xzw";
-      name = "kconfigwidgets-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kconfigwidgets-5.40.0.tar.xz";
+      sha256 = "0g5xm3fm3d6a63hbdq1xxiv539z15bhrs36ariq93flc4f912pbz";
+      name = "kconfigwidgets-5.40.0.tar.xz";
     };
   };
   kcoreaddons = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kcoreaddons-5.39.0.tar.xz";
-      sha256 = "0qskv44siykyn8iiq99llibw3bk499ry7r3i8abx4ljjl717cvlz";
-      name = "kcoreaddons-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kcoreaddons-5.40.0.tar.xz";
+      sha256 = "0n4gvfayaiahvavrx1y3ass6anz30965zm81iczi2749hva9s415";
+      name = "kcoreaddons-5.40.0.tar.xz";
     };
   };
   kcrash = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kcrash-5.39.0.tar.xz";
-      sha256 = "1fv32l50h9rlc5s9iplyljcsrscivgdy2baghq7hbcs58xrjf1ws";
-      name = "kcrash-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kcrash-5.40.0.tar.xz";
+      sha256 = "01h41zz3x0m5hc3zm2v0mifzc42akp5bwxwjzaaryl8pcg8v5lln";
+      name = "kcrash-5.40.0.tar.xz";
     };
   };
   kdbusaddons = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kdbusaddons-5.39.0.tar.xz";
-      sha256 = "0hp85995n3193dvvdv48hv59b66dzd9p4iwnx2dmj797lghpnir3";
-      name = "kdbusaddons-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kdbusaddons-5.40.0.tar.xz";
+      sha256 = "09zbdy8lzhq6lvd9j9667r90k6p6a882bxans6am1yxx4y0jd9i4";
+      name = "kdbusaddons-5.40.0.tar.xz";
     };
   };
   kdeclarative = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kdeclarative-5.39.0.tar.xz";
-      sha256 = "1l8wnyfz6qjqmcpdzavsb6m1r3ay1b2r186myymsyknr80yr2d7p";
-      name = "kdeclarative-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kdeclarative-5.40.0.tar.xz";
+      sha256 = "10yp7g9awv4mdf5zl6ljxplfy50jzmixp45vdqcmcixiq72440d6";
+      name = "kdeclarative-5.40.0.tar.xz";
     };
   };
   kded = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kded-5.39.0.tar.xz";
-      sha256 = "0jv4ghl2gzfdkhk1in3vx39kigvpprvcb9xlzc5506mpfjc38ga5";
-      name = "kded-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kded-5.40.0.tar.xz";
+      sha256 = "0jf4xahsz86hiv50vs9yhwd2g410d5wjds8mdm5hi8085f7dcf84";
+      name = "kded-5.40.0.tar.xz";
     };
   };
   kdelibs4support = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/portingAids/kdelibs4support-5.39.0.tar.xz";
-      sha256 = "03xjzhdvs497sk9bpz79crxlzwff198ivj4n5f0mwmnqc0100dfp";
-      name = "kdelibs4support-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/portingAids/kdelibs4support-5.40.0.tar.xz";
+      sha256 = "1pwmi490hwnijpwjm80zdvbwanlslhnfh8nrlxmiham7ls551mzr";
+      name = "kdelibs4support-5.40.0.tar.xz";
     };
   };
   kdesignerplugin = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kdesignerplugin-5.39.0.tar.xz";
-      sha256 = "1b7rn66wsyn9aipgvfmn2pq18g0zdjxb469126dj18fahg2k777f";
-      name = "kdesignerplugin-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kdesignerplugin-5.40.0.tar.xz";
+      sha256 = "00wl4d001ix0ql2hzp818cvhyyr52g06b7zz92qhcyi4x1cf2mqd";
+      name = "kdesignerplugin-5.40.0.tar.xz";
     };
   };
   kdesu = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kdesu-5.39.0.tar.xz";
-      sha256 = "03avzhs6a0p3cjv4kk9vavf6f64ffgs3pzhbdkfr76fh58h1v6wx";
-      name = "kdesu-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kdesu-5.40.0.tar.xz";
+      sha256 = "13dv54c9cw6a2zcn7arrqnda08r3rw2q3nqagrrn013xd3dlrac7";
+      name = "kdesu-5.40.0.tar.xz";
     };
   };
   kdewebkit = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kdewebkit-5.39.0.tar.xz";
-      sha256 = "05f0l3zw8cnvyavwwijwy5jx8dairhdbvg6ynpn7r5l10vawcf6x";
-      name = "kdewebkit-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kdewebkit-5.40.0.tar.xz";
+      sha256 = "1n7cn3yg8ianfk9ymd7hgf1yr2qcck5pg2mcp2bam0zfk4clbcgf";
+      name = "kdewebkit-5.40.0.tar.xz";
     };
   };
   kdnssd = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kdnssd-5.39.0.tar.xz";
-      sha256 = "1c8d1wwr0hkdkgnq4k7lgkqwm1pj676i09l1kas256rzz6dcyl75";
-      name = "kdnssd-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kdnssd-5.40.0.tar.xz";
+      sha256 = "10la98wshran4my7s50w85ifvdibvbw3mb4007x8znz92x1ikdfj";
+      name = "kdnssd-5.40.0.tar.xz";
     };
   };
   kdoctools = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kdoctools-5.39.0.tar.xz";
-      sha256 = "17g4kf7mbjjxhii4nbhfpmhjs1q23mlh0d3fqyxxhm3pp02jg8ap";
-      name = "kdoctools-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kdoctools-5.40.0.tar.xz";
+      sha256 = "1zzgnqkysdvqc7dkb37gcmxfhwik0bkmd23c4y2av00ra6nzymim";
+      name = "kdoctools-5.40.0.tar.xz";
     };
   };
   kemoticons = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kemoticons-5.39.0.tar.xz";
-      sha256 = "132gs69v43ms117ibdqmnhbyzzs5by76pfz7bd2zqwl4mq94hpgh";
-      name = "kemoticons-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kemoticons-5.40.0.tar.xz";
+      sha256 = "1jqifvqbj441jif79j5jqrpksyajarill01v625l30kvd584042c";
+      name = "kemoticons-5.40.0.tar.xz";
     };
   };
   kfilemetadata = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kfilemetadata-5.39.0.tar.xz";
-      sha256 = "1mcxphjpayyq7v16b6c3zhb6c9vn67495xywfb9y8ysma1cdpshg";
-      name = "kfilemetadata-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kfilemetadata-5.40.0.tar.xz";
+      sha256 = "1yivydc32y4q6kd1myv529lhcs66j0y388g7qv4zjz4plv6kyxvb";
+      name = "kfilemetadata-5.40.0.tar.xz";
     };
   };
   kglobalaccel = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kglobalaccel-5.39.0.tar.xz";
-      sha256 = "0wcbnwfi98cx8f99a2mcz2kg7mggz3hipfxv9s8ks6c80865kar1";
-      name = "kglobalaccel-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kglobalaccel-5.40.0.tar.xz";
+      sha256 = "1qslksbln3yhhzal88b04zyi4iibffv687gbsm07i4f68pyp0sgn";
+      name = "kglobalaccel-5.40.0.tar.xz";
     };
   };
   kguiaddons = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kguiaddons-5.39.0.tar.xz";
-      sha256 = "1az9i5bg7xd7kv7ajq8j8jab7zly683gyi90rmk54vfnn6igbq3f";
-      name = "kguiaddons-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kguiaddons-5.40.0.tar.xz";
+      sha256 = "02hln4pafph1zny4jnmblydc4wnx66pjj4g6dqxafz6hpvdmncp1";
+      name = "kguiaddons-5.40.0.tar.xz";
     };
   };
   khtml = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/portingAids/khtml-5.39.0.tar.xz";
-      sha256 = "097nbwv8ba48xmrga62j1irlkkc0l0f3971fp7225pzh1g3cg152";
-      name = "khtml-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/portingAids/khtml-5.40.0.tar.xz";
+      sha256 = "0v73ia4dgpx5d7h3lpl54cy7p3qavgahj5h2x5vah7fb2gysy7z0";
+      name = "khtml-5.40.0.tar.xz";
     };
   };
   ki18n = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/ki18n-5.39.0.tar.xz";
-      sha256 = "1985qgihrch37b5gf7qw33bazahm3xb5v2nj43k6vdjxfg1clcay";
-      name = "ki18n-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/ki18n-5.40.0.tar.xz";
+      sha256 = "1nv89yi0f2wnb3lc929zfl6bjwznm2q3p449rp3yzp43lx00sym9";
+      name = "ki18n-5.40.0.tar.xz";
     };
   };
   kiconthemes = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kiconthemes-5.39.0.tar.xz";
-      sha256 = "1k4r263zz54497dgqaw9a74wqdklq4w353mc0g905k2g8arh7p9f";
-      name = "kiconthemes-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kiconthemes-5.40.0.tar.xz";
+      sha256 = "0i6yjx5fvpbh4hd15wbm69v2qqgxbyfhn1cqp7w7ghgb262b90vx";
+      name = "kiconthemes-5.40.0.tar.xz";
     };
   };
   kidletime = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kidletime-5.39.0.tar.xz";
-      sha256 = "01h5pcr5kn11jby0zsz6igiwzf31hzip7h63dcsa8h67li4sibd8";
-      name = "kidletime-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kidletime-5.40.0.tar.xz";
+      sha256 = "0q6s73vpasfvzxis5br01k2xl8hnxymq8i1k8l60i8b1v46abr99";
+      name = "kidletime-5.40.0.tar.xz";
     };
   };
   kimageformats = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kimageformats-5.39.0.tar.xz";
-      sha256 = "1mnfdsxqnqdzhw3as77n1f1ddxpmab4slqlpwi4ih55xmgl85455";
-      name = "kimageformats-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kimageformats-5.40.0.tar.xz";
+      sha256 = "1ld47qkb26gzwvr6bmqa16p4rwf3avi4fm15rpmmxjlbc9pm9n51";
+      name = "kimageformats-5.40.0.tar.xz";
     };
   };
   kinit = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kinit-5.39.0.tar.xz";
-      sha256 = "0a2wl1vhsbb2x1cjd3wz7j3bp9kz1pxfc6mml7gpnq70qgk8hsn2";
-      name = "kinit-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kinit-5.40.0.tar.xz";
+      sha256 = "1296dr1iln5g55j75fb1l5b8c1lj32lsccb82qvpaf57h22fp5ya";
+      name = "kinit-5.40.0.tar.xz";
     };
   };
   kio = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kio-5.39.0.tar.xz";
-      sha256 = "091g4dbnals6c5wrj3xh3ws29wszysmb9ksyvyqf3d1lp9dfmjwn";
-      name = "kio-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kio-5.40.0.tar.xz";
+      sha256 = "16rqmh0mdncyyq2vidfpyml94n7vmz7rx71v53salpwr3cihpsih";
+      name = "kio-5.40.0.tar.xz";
     };
   };
   kirigami2 = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kirigami2-5.39.0.tar.xz";
-      sha256 = "0spgylk4yjy74rs5d5b28qv72qz5ra9j3wfmk6vx2b6cvf1fw517";
-      name = "kirigami2-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kirigami2-5.40.0.tar.xz";
+      sha256 = "0a22cwxfrkp0hd5isisaz9bnx2sjixi2cm9l35yvbzdnlmm6qjrb";
+      name = "kirigami2-5.40.0.tar.xz";
     };
   };
   kitemmodels = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kitemmodels-5.39.0.tar.xz";
-      sha256 = "1bn0k0ya2phix6fyv8ax800ahncrkdzikz0sa3xrw5bq3iz1x6k9";
-      name = "kitemmodels-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kitemmodels-5.40.0.tar.xz";
+      sha256 = "0ij5q0g0cq793znslb7sz6qcrmcdlcx706an8ciznidlwayh9fx9";
+      name = "kitemmodels-5.40.0.tar.xz";
     };
   };
   kitemviews = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kitemviews-5.39.0.tar.xz";
-      sha256 = "0pl899d1lz1dymdbq70485a8332z9i3s38dxnxv3cdwbla3xlsfh";
-      name = "kitemviews-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kitemviews-5.40.0.tar.xz";
+      sha256 = "0347nx4n5sr0dz2zjzdp7s1ca5gnmcr9d881raj50knsgcwgb3m3";
+      name = "kitemviews-5.40.0.tar.xz";
     };
   };
   kjobwidgets = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kjobwidgets-5.39.0.tar.xz";
-      sha256 = "1z26555pkirdkfw8c9j1a863pqybklryfa30v3a59a0m9v2jdzfc";
-      name = "kjobwidgets-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kjobwidgets-5.40.0.tar.xz";
+      sha256 = "0m2bfa397mzifgxvpw8hpks95yx5krak0285qk14innr21n62qnk";
+      name = "kjobwidgets-5.40.0.tar.xz";
     };
   };
   kjs = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/portingAids/kjs-5.39.0.tar.xz";
-      sha256 = "0fkn308l6drj7pa94niqhcn2pqv7da7da5lq1nk8q6zlyg4nbcrn";
-      name = "kjs-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/portingAids/kjs-5.40.0.tar.xz";
+      sha256 = "0nkddm9zjjnsmky71112n8ik6f0am52dmhlarcym2i08zy05chdm";
+      name = "kjs-5.40.0.tar.xz";
     };
   };
   kjsembed = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/portingAids/kjsembed-5.39.0.tar.xz";
-      sha256 = "1i3qyxr409x82nqyck4qva63maxa2vvi07i0yxm6zqx5lvm9gkgb";
-      name = "kjsembed-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/portingAids/kjsembed-5.40.0.tar.xz";
+      sha256 = "0fc3454almq5llhwmkhrwpcl2m1nfjyyhvpnmm879yhrbjf7vnid";
+      name = "kjsembed-5.40.0.tar.xz";
     };
   };
   kmediaplayer = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/portingAids/kmediaplayer-5.39.0.tar.xz";
-      sha256 = "09ysw11br4k26bq6rvzcws2g565336p3gjkz4fxc8w2g3ma527p1";
-      name = "kmediaplayer-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/portingAids/kmediaplayer-5.40.0.tar.xz";
+      sha256 = "13pykc6zvcv6p0k6m9cqf1fx93jb39ilgn1zlvkws7s1jq4ifkpl";
+      name = "kmediaplayer-5.40.0.tar.xz";
     };
   };
   knewstuff = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/knewstuff-5.39.0.tar.xz";
-      sha256 = "1amflv96ybd6dqkc1chmz6d5crrl4dcq07fwsalxzx9mgr0z499r";
-      name = "knewstuff-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/knewstuff-5.40.0.tar.xz";
+      sha256 = "0i4ybzx165js2pl85k8si1waywn4yp47gj16szdx7snlrzvhmq3i";
+      name = "knewstuff-5.40.0.tar.xz";
     };
   };
   knotifications = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/knotifications-5.39.0.tar.xz";
-      sha256 = "0f38ca090p291d114fg3jz25lhwz7vad7s60ql4x3xwmdgaaw7dj";
-      name = "knotifications-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/knotifications-5.40.0.tar.xz";
+      sha256 = "013r52a6wl9ayp42mvzrq7s8r5mx73bk1j56zxk3yz45xv6gsm0v";
+      name = "knotifications-5.40.0.tar.xz";
     };
   };
   knotifyconfig = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/knotifyconfig-5.39.0.tar.xz";
-      sha256 = "09nk6sr6sp9a85lj4x9ac0ir4s5ac08835927b95d7m4ap2dbxrb";
-      name = "knotifyconfig-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/knotifyconfig-5.40.0.tar.xz";
+      sha256 = "1c89k1qnbqyq7d9dsccd9645cq7n6vfyn10sh9f7zraqybi75k3k";
+      name = "knotifyconfig-5.40.0.tar.xz";
     };
   };
   kpackage = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kpackage-5.39.0.tar.xz";
-      sha256 = "1ibppkg9m77p0dcpfshcd891vlxcfgx6rk205gq6d5qxyqizygki";
-      name = "kpackage-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kpackage-5.40.0.tar.xz";
+      sha256 = "17hhj8x5r3cpb6cx32f1chg6mklxvcwgmw16c3h2sh4p6bgmibmq";
+      name = "kpackage-5.40.0.tar.xz";
     };
   };
   kparts = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kparts-5.39.0.tar.xz";
-      sha256 = "1r32jf2qbhqdjih9ff4n0ajd6s1cdncpq367mp5am31fz1jv3sr6";
-      name = "kparts-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kparts-5.40.0.tar.xz";
+      sha256 = "1vvmgsqwgics6q86c413wx2yk9mgwvj4wm3fk6my0pi3l166djrl";
+      name = "kparts-5.40.0.tar.xz";
     };
   };
   kpeople = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kpeople-5.39.0.tar.xz";
-      sha256 = "1s78dld3zlldhpk66s08v34zwi1k5ghivzbi7ab290sgrjc9afar";
-      name = "kpeople-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kpeople-5.40.0.tar.xz";
+      sha256 = "1yfs0k3pwcgkzyf0x568jmmjb5gb757c7qdwmz7g0s3gdnhm1mbr";
+      name = "kpeople-5.40.0.tar.xz";
     };
   };
   kplotting = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kplotting-5.39.0.tar.xz";
-      sha256 = "1diy1f23n6pih0s91kv1bp4mnnypnjl3pmi1xqni1v2cfwy0mnba";
-      name = "kplotting-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kplotting-5.40.0.tar.xz";
+      sha256 = "1hnnvxvz74s7ir5bgqrvd0iv6fl7d18rqi6yjxy5j8b0f8bgrp7i";
+      name = "kplotting-5.40.0.tar.xz";
     };
   };
   kpty = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kpty-5.39.0.tar.xz";
-      sha256 = "02h6dg3w3k58d1ydzyz6mhd1y5gds3k64wdsb84fnpxvlw46dlhn";
-      name = "kpty-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kpty-5.40.0.tar.xz";
+      sha256 = "1r5lddjhr6g3gzwfmcs7mkc585mz4j6ngnn2m5mlgz2cf8bgf277";
+      name = "kpty-5.40.0.tar.xz";
     };
   };
   kross = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/portingAids/kross-5.39.0.tar.xz";
-      sha256 = "1gh9gicr7ba8y3c0r7qpw2fj651fbbrhsy8gps8yll71axhxqvfh";
-      name = "kross-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/portingAids/kross-5.40.0.tar.xz";
+      sha256 = "1y89sksha028rxdf534kc3ljnccm2zy111lfnb36vq22wzi7198p";
+      name = "kross-5.40.0.tar.xz";
     };
   };
   krunner = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/krunner-5.39.0.tar.xz";
-      sha256 = "0gxs9z8mlb3s615ccrgkwyxww4jly48d8fkay33zwjaanqhkhgfl";
-      name = "krunner-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/krunner-5.40.0.tar.xz";
+      sha256 = "19g02k7g2i92fv68gssyqrc1gwlhh924glmzhswp52rkwz4rqf2c";
+      name = "krunner-5.40.0.tar.xz";
     };
   };
   kservice = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kservice-5.39.0.tar.xz";
-      sha256 = "0abz878yc8yir7iv5scn55d0g2nljnzhr9c81wa6ggjsw0h077hl";
-      name = "kservice-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kservice-5.40.0.tar.xz";
+      sha256 = "0dpd7zpw6x4iqb27a13aazbk9rgbngrdkxz76pq4x32ynzrzzhzc";
+      name = "kservice-5.40.0.tar.xz";
     };
   };
   ktexteditor = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/ktexteditor-5.39.0.tar.xz";
-      sha256 = "1bk5wlvzjmfv7g9ab77asn055jp647zj69mfx2z3lvxb69swdnf5";
-      name = "ktexteditor-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/ktexteditor-5.40.0.tar.xz";
+      sha256 = "0xlhxgsj1cyvxrhj4d0ydcns1p18x51igh9bda66rp5p3wx8xm5n";
+      name = "ktexteditor-5.40.0.tar.xz";
     };
   };
   ktextwidgets = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/ktextwidgets-5.39.0.tar.xz";
-      sha256 = "0p6h165y03ir7qdf50kc77iq9plgvx39c8pz9dalvscvx42d2jaq";
-      name = "ktextwidgets-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/ktextwidgets-5.40.0.tar.xz";
+      sha256 = "0dm2nka8vyazz10hi55d1imi49ip2lfns1dimwnwbi15j3a14m6r";
+      name = "ktextwidgets-5.40.0.tar.xz";
     };
   };
   kunitconversion = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kunitconversion-5.39.0.tar.xz";
-      sha256 = "04r1b2nc6vi56nfh6glhhd3d9v0ywxn2waibryjbszwrr39yhlzv";
-      name = "kunitconversion-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kunitconversion-5.40.0.tar.xz";
+      sha256 = "1qp0jcds7khbdxbi025ngz62xbw0k35psy204yz95wrmg302hvnw";
+      name = "kunitconversion-5.40.0.tar.xz";
     };
   };
   kwallet = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kwallet-5.39.0.tar.xz";
-      sha256 = "1vlz9y3r1n6w7q9is60jsl9f7bm1djckdi9ibgzanwsp4k5ab0sz";
-      name = "kwallet-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kwallet-5.40.0.tar.xz";
+      sha256 = "0lyx3vdql9n2bwr37wjk6l0k9n2si16gx74vmn1f4r7vqyhij8nd";
+      name = "kwallet-5.40.0.tar.xz";
     };
   };
   kwayland = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kwayland-5.39.0.tar.xz";
-      sha256 = "0a9hi47nrsspkak88c9f6ind2i7q69zjmrgr5n7xsa4zxznwhx6x";
-      name = "kwayland-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kwayland-5.40.0.tar.xz";
+      sha256 = "00x4df45d80p1nvb0pjbg4y2vmcsghy9hnsr6mwyrhbkdrqdwkid";
+      name = "kwayland-5.40.0.tar.xz";
     };
   };
   kwidgetsaddons = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kwidgetsaddons-5.39.0.tar.xz";
-      sha256 = "1d0d3ags15vr7ck031m6n5n3hw347siskzhb8rsgzghn6xnmbfdb";
-      name = "kwidgetsaddons-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kwidgetsaddons-5.40.0.tar.xz";
+      sha256 = "16h65q1ibmwc5rmwf9jixxrawcd3jvrb5z4z2pcmh8242n1hyhk8";
+      name = "kwidgetsaddons-5.40.0.tar.xz";
     };
   };
   kwindowsystem = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kwindowsystem-5.39.0.tar.xz";
-      sha256 = "1dys70va4h00ixxgxv52wbg8wi3jgsqckaikjqr34fzrmjh1lxqp";
-      name = "kwindowsystem-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kwindowsystem-5.40.0.tar.xz";
+      sha256 = "0cw062m9phy7z5yg75yg7qwg2lpz8270mwbmmwcbw9bl6qqkbwzz";
+      name = "kwindowsystem-5.40.0.tar.xz";
     };
   };
   kxmlgui = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kxmlgui-5.39.0.tar.xz";
-      sha256 = "0zwy11rh3yphl2346hmcahajxkgmrnfz1m8pd3vlnjs175dwz115";
-      name = "kxmlgui-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kxmlgui-5.40.0.tar.xz";
+      sha256 = "07a7h9l0qwsnlwkh7pf50wmq21939mwynplm2zzzv3hkhfj89v6v";
+      name = "kxmlgui-5.40.0.tar.xz";
     };
   };
   kxmlrpcclient = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/kxmlrpcclient-5.39.0.tar.xz";
-      sha256 = "1j4a1n3ydln62m98h5p5lxlg1i7k5vzxb4f9kxkvzhw5gfpy78zs";
-      name = "kxmlrpcclient-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/kxmlrpcclient-5.40.0.tar.xz";
+      sha256 = "01zbgnqf2sfjgmx8nn6ljzpvqjg777j2yh2jm55rc4yh15qvvn0l";
+      name = "kxmlrpcclient-5.40.0.tar.xz";
     };
   };
   modemmanager-qt = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/modemmanager-qt-5.39.0.tar.xz";
-      sha256 = "0gdsp1017yjcfbq2jny7jz5rv7y4cavps5pfvg7zmylx0v057zk7";
-      name = "modemmanager-qt-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/modemmanager-qt-5.40.0.tar.xz";
+      sha256 = "0i0jpcy4c8zak9vv5jzcp4m78vk8mcv27dqi464jh9vaz9z7znfj";
+      name = "modemmanager-qt-5.40.0.tar.xz";
     };
   };
   networkmanager-qt = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/networkmanager-qt-5.39.0.tar.xz";
-      sha256 = "1jksv0zsdmkrid2f1m92fxw3gl6crcjaw43v5zra8h2m394iyr81";
-      name = "networkmanager-qt-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/networkmanager-qt-5.40.0.tar.xz";
+      sha256 = "178rm4c3304fn2h1jbfvf9zji8kkvnzkmnpnk0nkjh9dyqa80jvp";
+      name = "networkmanager-qt-5.40.0.tar.xz";
     };
   };
   oxygen-icons5 = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/oxygen-icons5-5.39.0.tar.xz";
-      sha256 = "1k1rns0fz5gvfnfwg60lrcw885cqmn814nzql9jvk07340w29s98";
-      name = "oxygen-icons5-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/oxygen-icons5-5.40.0.tar.xz";
+      sha256 = "057v69r3rvrw2qjqmb93k0m29ssgifb4sgm8xbfqx17b5iqms9f3";
+      name = "oxygen-icons5-5.40.0.tar.xz";
     };
   };
   plasma-framework = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/plasma-framework-5.39.0.tar.xz";
-      sha256 = "1gaxk9mzwlyld09gqk29y3shvi6a1g1q3l849a9kl1hd07gr53x3";
-      name = "plasma-framework-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/plasma-framework-5.40.0.tar.xz";
+      sha256 = "1mjgy3116pdzvmw43yqhrqz74nyw200yhnnynxk569krgymvalvg";
+      name = "plasma-framework-5.40.0.tar.xz";
     };
   };
   prison = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/prison-5.39.0.tar.xz";
-      sha256 = "1b0ji341xcamrd19z54r2nkm8cglbr4qfxyxmqzn8yc6icfl61nv";
-      name = "prison-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/prison-5.40.0.tar.xz";
+      sha256 = "18drqs6j1dx76224hlrp3xmk1hxq6q8638wpf5vmn6vqw8q304vw";
+      name = "prison-5.40.0.tar.xz";
     };
   };
   qqc2-desktop-style = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/qqc2-desktop-style-5.39.0.tar.xz";
-      sha256 = "1q8ihhrnk2dh6bbmwkz822l5vv15y11qaj7gig1lf7xw5nr1i27v";
-      name = "qqc2-desktop-style-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/qqc2-desktop-style-5.40.0.tar.xz";
+      sha256 = "0jpdnsq8yf58p4a7qsgvn3pp7ms7q1pgy4rwrlviyjdrlfc1pv49";
+      name = "qqc2-desktop-style-5.40.0.tar.xz";
     };
   };
   solid = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/solid-5.39.0.tar.xz";
-      sha256 = "19bl7hzg1fya613vqhdxllh09csm6amrndnhfqnx90w4gb31p36r";
-      name = "solid-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/solid-5.40.0.tar.xz";
+      sha256 = "1kj2rs771hyrbbn8qykbrj5fvdv8g7niajbrf6mydbdvqc96zj8x";
+      name = "solid-5.40.0.tar.xz";
     };
   };
   sonnet = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/sonnet-5.39.0.tar.xz";
-      sha256 = "1b5bfjbpb6l3c9j9k42shhnz9lqqxk2g607qx9ni0n2pr7w2p7w1";
-      name = "sonnet-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/sonnet-5.40.0.tar.xz";
+      sha256 = "1a947kgnx5dp7lv63dwzzlxm331c6h0cycv1lcdfcskan1wsmwk8";
+      name = "sonnet-5.40.0.tar.xz";
     };
   };
   syntax-highlighting = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/syntax-highlighting-5.39.0.tar.xz";
-      sha256 = "0b8sdkh9dqmqk3x48d25v4qhrqph0mv76v47skhvls9jspw7kzdc";
-      name = "syntax-highlighting-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/syntax-highlighting-5.40.0.tar.xz";
+      sha256 = "0xc06nd95q1mqw41pwrgh798jp9p994qylncabimxbcis39x138l";
+      name = "syntax-highlighting-5.40.0.tar.xz";
     };
   };
   threadweaver = {
-    version = "5.39.0";
+    version = "5.40.0";
     src = fetchurl {
-      url = "${mirror}/stable/frameworks/5.39/threadweaver-5.39.0.tar.xz";
-      sha256 = "101bk8rzdysb3vi3vbbkh2s7sb1dhnsa8ncdvdsxqyyaya9ns4aw";
-      name = "threadweaver-5.39.0.tar.xz";
+      url = "${mirror}/stable/frameworks/5.40/threadweaver-5.40.0.tar.xz";
+      sha256 = "0in3cp75n6nxlc38fr2pycfgh4k0azi70cnyzc8glyf3f2rw8d9g";
+      name = "threadweaver-5.40.0.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/libwnck/3.x.nix b/pkgs/development/libraries/libwnck/3.x.nix
index ed775fb4593..6a835157d96 100644
--- a/pkgs/development/libraries/libwnck/3.x.nix
+++ b/pkgs/development/libraries/libwnck/3.x.nix
@@ -1,11 +1,16 @@
 {stdenv, fetchurl, pkgconfig, libX11, gtk3, intltool}:
 
-stdenv.mkDerivation {
-  name = "libwnck-3.4.7";
+stdenv.mkDerivation rec{
+  name = "libwnck-${version}";
+  version = "${majorVer}.${minorVer}.${patchVer}";
+
+  majorVer = "3";
+  minorVer = "24";
+  patchVer = "1";
 
   src = fetchurl {
-    url = mirror://gnome/sources/libwnck/3.4/libwnck-3.4.7.tar.xz;
-    sha256 = "d48ac9c7f50c0d563097f63d07bcc83744c7d92a1b4ef65e5faeab32b5ccb723";
+    url = "mirror://gnome/sources/libwnck/${majorVer}.${minorVer}/${name}.tar.xz";
+    sha256 = "010zk9zvydggxqnxfml3scml5yxmpjy90irpqcayrzw26lldr9mg";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/qt-5/5.6/default.nix b/pkgs/development/libraries/qt-5/5.6/default.nix
index 8b01ce2749c..7930bd909aa 100644
--- a/pkgs/development/libraries/qt-5/5.6/default.nix
+++ b/pkgs/development/libraries/qt-5/5.6/default.nix
@@ -52,8 +52,7 @@ let
     qtserialport = [ ./qtserialport.patch ];
     qttools = [ ./qttools.patch ];
     qtwebengine =
-      [ ./qtwebengine.patch ]
-      ++ optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch;
+      optional stdenv.needsPax ./qtwebengine-paxmark-mksnapshot.patch;
     qtwebkit = [ ./qtwebkit.patch ];
   };
 
diff --git a/pkgs/development/libraries/qt-5/5.6/qtwebengine.patch b/pkgs/development/libraries/qt-5/5.6/qtwebengine.patch
deleted file mode 100644
index 65a604d2534..00000000000
--- a/pkgs/development/libraries/qt-5/5.6/qtwebengine.patch
+++ /dev/null
@@ -1,874 +0,0 @@
---- a/src/3rdparty/chromium/tools/clang/scripts/update.py	2016-05-26 04:58:54.000000000 -0800
-+++ b/src/3rdparty/chromium/tools/clang/scripts/update.py	2016-11-04 08:35:34.956154012 -0800
-@@ -3,12 +3,12 @@
- # Use of this source code is governed by a BSD-style license that can be
- # found in the LICENSE file.
- 
--"""Windows can't run .sh files, so this is a Python implementation of
--update.sh. This script should replace update.sh on all platforms eventually."""
-+"""This script is used to download prebuilt clang binaries.
-+
-+It is also used by package.py to build the prebuilt clang binaries."""
- 
- import argparse
--import contextlib
--import cStringIO
-+import distutils.spawn
- import glob
- import os
- import pipes
-@@ -18,6 +18,7 @@
- import stat
- import sys
- import tarfile
-+import tempfile
- import time
- import urllib2
- import zipfile
-@@ -25,19 +26,16 @@
- # Do NOT CHANGE this if you don't know what you're doing -- see
- # https://code.google.com/p/chromium/wiki/UpdatingClang
- # Reverting problematic clang rolls is safe, though.
--# Note: this revision is only used for Windows. Other platforms use update.sh.
--# TODO(thakis): Use the same revision on Windows and non-Windows.
--# TODO(thakis): Remove update.sh, use update.py everywhere.
--LLVM_WIN_REVISION = '239674'
-+CLANG_REVISION = '239674'
- 
- use_head_revision = 'LLVM_FORCE_HEAD_REVISION' in os.environ
- if use_head_revision:
--  LLVM_WIN_REVISION = 'HEAD'
-+  CLANG_REVISION = 'HEAD'
- 
- # This is incremented when pushing a new build of Clang at the same revision.
- CLANG_SUB_REVISION=1
- 
--PACKAGE_VERSION = "%s-%s" % (LLVM_WIN_REVISION, CLANG_SUB_REVISION)
-+PACKAGE_VERSION = "%s-%s" % (CLANG_REVISION, CLANG_SUB_REVISION)
- 
- # Path constants. (All of these should be absolute paths.)
- THIS_DIR = os.path.abspath(os.path.dirname(__file__))
-@@ -50,17 +48,26 @@
- CHROME_TOOLS_SHIM_DIR = os.path.join(LLVM_DIR, 'tools', 'chrometools')
- LLVM_BUILD_DIR = os.path.join(CHROMIUM_DIR, 'third_party', 'llvm-build',
-                               'Release+Asserts')
--COMPILER_RT_BUILD_DIR = os.path.join(LLVM_BUILD_DIR, '32bit-compiler-rt')
-+COMPILER_RT_BUILD_DIR = os.path.join(LLVM_BUILD_DIR, 'compiler-rt')
- CLANG_DIR = os.path.join(LLVM_DIR, 'tools', 'clang')
- LLD_DIR = os.path.join(LLVM_DIR, 'tools', 'lld')
--COMPILER_RT_DIR = os.path.join(LLVM_DIR, 'projects', 'compiler-rt')
-+# compiler-rt is built as part of the regular LLVM build on Windows to get
-+# the 64-bit runtime, and out-of-tree elsewhere.
-+# TODO(thakis): Try to unify this.
-+if sys.platform == 'win32':
-+  COMPILER_RT_DIR = os.path.join(LLVM_DIR, 'projects', 'compiler-rt')
-+else:
-+  COMPILER_RT_DIR = os.path.join(LLVM_DIR, 'compiler-rt')
- LIBCXX_DIR = os.path.join(LLVM_DIR, 'projects', 'libcxx')
- LIBCXXABI_DIR = os.path.join(LLVM_DIR, 'projects', 'libcxxabi')
- LLVM_BUILD_TOOLS_DIR = os.path.abspath(
-     os.path.join(LLVM_DIR, '..', 'llvm-build-tools'))
--STAMP_FILE = os.path.join(LLVM_DIR, '..', 'llvm-build', 'cr_build_revision')
-+STAMP_FILE = os.path.normpath(
-+    os.path.join(LLVM_DIR, '..', 'llvm-build', 'cr_build_revision'))
- BINUTILS_DIR = os.path.join(THIRD_PARTY_DIR, 'binutils')
--VERSION = '3.7.0'
-+VERSION = '3.8.0'
-+ANDROID_NDK_DIR = os.path.join(
-+    CHROMIUM_DIR, 'third_party', 'android_tools', 'ndk')
- 
- # URL for pre-built binaries.
- CDS_URL = 'https://commondatastorage.googleapis.com/chromium-browser-clang'
-@@ -74,40 +81,75 @@
-   """Download url into output_file."""
-   CHUNK_SIZE = 4096
-   TOTAL_DOTS = 10
--  sys.stdout.write('Downloading %s ' % url)
--  sys.stdout.flush()
--  response = urllib2.urlopen(url)
--  total_size = int(response.info().getheader('Content-Length').strip())
--  bytes_done = 0
--  dots_printed = 0
-+  num_retries = 3
-+  retry_wait_s = 5  # Doubled at each retry.
-+
-   while True:
--    chunk = response.read(CHUNK_SIZE)
--    if not chunk:
--      break
--    output_file.write(chunk)
--    bytes_done += len(chunk)
--    num_dots = TOTAL_DOTS * bytes_done / total_size
--    sys.stdout.write('.' * (num_dots - dots_printed))
--    sys.stdout.flush()
--    dots_printed = num_dots
--  print ' Done.'
-+    try:
-+      sys.stdout.write('Downloading %s ' % url)
-+      sys.stdout.flush()
-+      response = urllib2.urlopen(url)
-+      total_size = int(response.info().getheader('Content-Length').strip())
-+      bytes_done = 0
-+      dots_printed = 0
-+      while True:
-+        chunk = response.read(CHUNK_SIZE)
-+        if not chunk:
-+          break
-+        output_file.write(chunk)
-+        bytes_done += len(chunk)
-+        num_dots = TOTAL_DOTS * bytes_done / total_size
-+        sys.stdout.write('.' * (num_dots - dots_printed))
-+        sys.stdout.flush()
-+        dots_printed = num_dots
-+      if bytes_done != total_size:
-+        raise urllib2.URLError("only got %d of %d bytes" %
-+                               (bytes_done, total_size))
-+      print ' Done.'
-+      return
-+    except urllib2.URLError as e:
-+      sys.stdout.write('\n')
-+      print e
-+      if num_retries == 0 or isinstance(e, urllib2.HTTPError) and e.code == 404:
-+        raise e
-+      num_retries -= 1
-+      print 'Retrying in %d s ...' % retry_wait_s
-+      time.sleep(retry_wait_s)
-+      retry_wait_s *= 2
-+
-+
-+def EnsureDirExists(path):
-+  if not os.path.exists(path):
-+    print "Creating directory %s" % path
-+    os.makedirs(path)
-+
-+
-+def DownloadAndUnpack(url, output_dir):
-+  with tempfile.TemporaryFile() as f:
-+    DownloadUrl(url, f)
-+    f.seek(0)
-+    EnsureDirExists(output_dir)
-+    if url.endswith('.zip'):
-+      zipfile.ZipFile(f).extractall(path=output_dir)
-+    else:
-+      tarfile.open(mode='r:gz', fileobj=f).extractall(path=output_dir)
- 
- 
- def ReadStampFile():
-   """Return the contents of the stamp file, or '' if it doesn't exist."""
-   try:
-     with open(STAMP_FILE, 'r') as f:
--      return f.read()
-+      return f.read().rstrip()
-   except IOError:
-     return ''
- 
- 
- def WriteStampFile(s):
-   """Write s to the stamp file."""
--  if not os.path.exists(os.path.dirname(STAMP_FILE)):
--    os.makedirs(os.path.dirname(STAMP_FILE))
-+  EnsureDirExists(os.path.dirname(STAMP_FILE))
-   with open(STAMP_FILE, 'w') as f:
-     f.write(s)
-+    f.write('\n')
- 
- 
- def GetSvnRevision(svn_repo):
-@@ -129,6 +171,13 @@
-   shutil.rmtree(dir, onerror=ChmodAndRetry)
- 
- 
-+def RmCmakeCache(dir):
-+  """Delete CMakeCache.txt files under dir recursively."""
-+  for dirpath, _, files in os.walk(dir):
-+    if 'CMakeCache.txt' in files:
-+      os.remove(os.path.join(dirpath, 'CMakeCache.txt'))
-+
-+
- def RunCommand(command, msvc_arch=None, env=None, fail_hard=True):
-   """Run command and return success (True) or failure; or if fail_hard is
-      True, exit on failure.  If msvc_arch is set, runs the command in a
-@@ -170,8 +219,8 @@
- def CopyDirectoryContents(src, dst, filename_filter=None):
-   """Copy the files from directory src to dst
-   with an optional filename filter."""
--  if not os.path.exists(dst):
--    os.makedirs(dst)
-+  dst = os.path.realpath(dst)  # realpath() in case dst ends in /..
-+  EnsureDirExists(dst)
-   for root, _, files in os.walk(src):
-     for f in files:
-       if filename_filter and not re.match(filename_filter, f):
-@@ -181,9 +230,9 @@
- 
- def Checkout(name, url, dir):
-   """Checkout the SVN module at url into dir. Use name for the log message."""
--  print "Checking out %s r%s into '%s'" % (name, LLVM_WIN_REVISION, dir)
-+  print "Checking out %s r%s into '%s'" % (name, CLANG_REVISION, dir)
- 
--  command = ['svn', 'checkout', '--force', url + '@' + LLVM_WIN_REVISION, dir]
-+  command = ['svn', 'checkout', '--force', url + '@' + CLANG_REVISION, dir]
-   if RunCommand(command, fail_hard=False):
-     return
- 
-@@ -195,120 +244,9 @@
-   RunCommand(command)
- 
- 
--def RevertPreviouslyPatchedFiles():
--  print 'Reverting previously patched files'
--  files = [
--    '%(clang)s/test/Index/crash-recovery-modules.m',
--    '%(clang)s/unittests/libclang/LibclangTest.cpp',
--    '%(compiler_rt)s/lib/asan/asan_rtl.cc',
--    '%(compiler_rt)s/test/asan/TestCases/Linux/new_array_cookie_test.cc',
--    '%(llvm)s/test/DebugInfo/gmlt.ll',
--    '%(llvm)s/lib/CodeGen/SpillPlacement.cpp',
--    '%(llvm)s/lib/CodeGen/SpillPlacement.h',
--    '%(llvm)s/lib/Transforms/Instrumentation/MemorySanitizer.cpp',
--    '%(clang)s/test/Driver/env.c',
--    '%(clang)s/lib/Frontend/InitPreprocessor.cpp',
--    '%(clang)s/test/Frontend/exceptions.c',
--    '%(clang)s/test/Preprocessor/predefined-exceptions.m',
--    '%(llvm)s/test/Bindings/Go/go.test',
--    '%(clang)s/lib/Parse/ParseExpr.cpp',
--    '%(clang)s/lib/Parse/ParseTemplate.cpp',
--    '%(clang)s/lib/Sema/SemaDeclCXX.cpp',
--    '%(clang)s/lib/Sema/SemaExprCXX.cpp',
--    '%(clang)s/test/SemaCXX/default2.cpp',
--    '%(clang)s/test/SemaCXX/typo-correction-delayed.cpp',
--    '%(compiler_rt)s/lib/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc',
--    '%(compiler_rt)s/test/tsan/signal_segv_handler.cc',
--    '%(compiler_rt)s/lib/sanitizer_common/sanitizer_coverage_libcdep.cc',
--    '%(compiler_rt)s/cmake/config-ix.cmake',
--    '%(compiler_rt)s/CMakeLists.txt',
--    '%(compiler_rt)s/lib/ubsan/ubsan_platform.h',
--    ]
--  for f in files:
--    f = f % {
--        'clang': CLANG_DIR,
--        'compiler_rt': COMPILER_RT_DIR,
--        'llvm': LLVM_DIR,
--        }
--    if os.path.exists(f):
--      os.remove(f)  # For unversioned files.
--      RunCommand(['svn', 'revert', f])
--
--
--def ApplyLocalPatches():
--  # There's no patch program on Windows by default.  We don't need patches on
--  # Windows yet, and maybe this not working on Windows will motivate us to
--  # remove patches over time.
--  assert sys.platform != 'win32'
--
--  # Apply patch for tests failing with --disable-pthreads (llvm.org/PR11974)
--  clang_patches = [ r"""\
----- test/Index/crash-recovery-modules.m	(revision 202554)
--+++ test/Index/crash-recovery-modules.m	(working copy)
--@@ -12,6 +12,8 @@
-- 
-- // REQUIRES: crash-recovery
-- // REQUIRES: shell
--+// XFAIL: *
--+//    (PR11974)
-- 
-- @import Crash;
--""", r"""\
----- unittests/libclang/LibclangTest.cpp (revision 215949)
--+++ unittests/libclang/LibclangTest.cpp (working copy)
--@@ -431,7 +431,7 @@
--   EXPECT_EQ(0U, clang_getNumDiagnostics(ClangTU));
-- }
--
---TEST_F(LibclangReparseTest, ReparseWithModule) {
--+TEST_F(LibclangReparseTest, DISABLED_ReparseWithModule) {
--   const char *HeaderTop = "#ifndef H\n#define H\nstruct Foo { int bar;";
--   const char *HeaderBottom = "\n};\n#endif\n";
--   const char *MFile = "#include \"HeaderFile.h\"\nint main() {"
--"""
--      ]
--
--  # This Go bindings test doesn't work after bootstrap on Linux, PR21552.
--  llvm_patches = [ r"""\
----- test/Bindings/Go/go.test    (revision 223109)
--+++ test/Bindings/Go/go.test    (working copy)
--@@ -1,3 +1,3 @@
---; RUN: llvm-go test llvm.org/llvm/bindings/go/llvm
--+; RUN: true
-- 
-- ; REQUIRES: shell
--"""
--      ]
--
--  # The UBSan run-time, which is now bundled with the ASan run-time, doesn't
--  # work on Mac OS X 10.8 (PR23539).
--  compiler_rt_patches = [ r"""\
----- CMakeLists.txt	(revision 241602)
--+++ CMakeLists.txt	(working copy)
--@@ -305,6 +305,7 @@
--       list(APPEND SANITIZER_COMMON_SUPPORTED_OS iossim)
--     endif()
--   endif()
--+  set(SANITIZER_MIN_OSX_VERSION "10.7")
--   if(SANITIZER_MIN_OSX_VERSION VERSION_LESS "10.7")
--     message(FATAL_ERROR "Too old OS X version: ${SANITIZER_MIN_OSX_VERSION}")
--   endif()
--"""
--      ]
--
--  for path, patches in [(LLVM_DIR, llvm_patches),
--                        (CLANG_DIR, clang_patches),
--                        (COMPILER_RT_DIR, compiler_rt_patches)]:
--    print 'Applying patches in', path
--    for patch in patches:
--      print patch
--      p = subprocess.Popen( ['patch', '-p0', '-d', path], stdin=subprocess.PIPE)
--      (stdout, stderr) = p.communicate(input=patch)
--      if p.returncode != 0:
--        raise RuntimeError('stdout %s, stderr %s' % (stdout, stderr))
--
--
- def DeleteChromeToolsShim():
-+  OLD_SHIM_DIR = os.path.join(LLVM_DIR, 'tools', 'zzz-chrometools')
-+  shutil.rmtree(OLD_SHIM_DIR, ignore_errors=True)
-   shutil.rmtree(CHROME_TOOLS_SHIM_DIR, ignore_errors=True)
- 
- 
-@@ -337,6 +275,25 @@
-     f.write('endif (CHROMIUM_TOOLS_SRC)\n')
- 
- 
-+def MaybeDownloadHostGcc(args):
-+  """Downloads gcc 4.8.2 if needed and makes sure args.gcc_toolchain is set."""
-+  if not sys.platform.startswith('linux') or args.gcc_toolchain:
-+    return
-+
-+  if subprocess.check_output(['gcc', '-dumpversion']).rstrip() < '4.7.0':
-+    # We need a newer gcc version.
-+    gcc_dir = os.path.join(LLVM_BUILD_TOOLS_DIR, 'gcc482precise')
-+    if not os.path.exists(gcc_dir):
-+      print 'Downloading pre-built GCC 4.8.2...'
-+      DownloadAndUnpack(
-+          CDS_URL + '/tools/gcc482precise.tgz', LLVM_BUILD_TOOLS_DIR)
-+    args.gcc_toolchain = gcc_dir
-+  else:
-+    # Always set gcc_toolchain; llvm-symbolizer needs the bundled libstdc++.
-+    args.gcc_toolchain = \
-+        os.path.dirname(os.path.dirname(distutils.spawn.find_executable('gcc')))
-+
-+
- def AddCMakeToPath():
-   """Download CMake and add it to PATH."""
-   if sys.platform == 'win32':
-@@ -345,20 +302,10 @@
-                              'cmake-3.2.2-win32-x86', 'bin')
-   else:
-     suffix = 'Darwin' if sys.platform == 'darwin' else 'Linux'
--    zip_name = 'cmake310_%s.tgz' % suffix
--    cmake_dir = os.path.join(LLVM_BUILD_TOOLS_DIR, 'cmake310', 'bin')
-+    zip_name = 'cmake322_%s.tgz' % suffix
-+    cmake_dir = os.path.join(LLVM_BUILD_TOOLS_DIR, 'cmake322', 'bin')
-   if not os.path.exists(cmake_dir):
--    if not os.path.exists(LLVM_BUILD_TOOLS_DIR):
--      os.makedirs(LLVM_BUILD_TOOLS_DIR)
--    # The cmake archive is smaller than 20 MB, small enough to keep in memory:
--    with contextlib.closing(cStringIO.StringIO()) as f:
--      DownloadUrl(CDS_URL + '/tools/' + zip_name, f)
--      f.seek(0)
--      if zip_name.endswith('.zip'):
--        zipfile.ZipFile(f).extractall(path=LLVM_BUILD_TOOLS_DIR)
--      else:
--        tarfile.open(mode='r:gz', fileobj=f).extractall(path=
--            LLVM_BUILD_TOOLS_DIR)
-+    DownloadAndUnpack(CDS_URL + '/tools/' + zip_name, LLVM_BUILD_TOOLS_DIR)
-   os.environ['PATH'] = cmake_dir + os.pathsep + os.environ.get('PATH', '')
- 
- vs_version = None
-@@ -383,37 +330,61 @@
- 
- def UpdateClang(args):
-   print 'Updating Clang to %s...' % PACKAGE_VERSION
--  if ReadStampFile() == PACKAGE_VERSION:
--    print 'Already up to date.'
--    return 0
-+
-+  need_gold_plugin = 'LLVM_DOWNLOAD_GOLD_PLUGIN' in os.environ or (
-+      sys.platform.startswith('linux') and
-+      'buildtype=Official' in os.environ.get('GYP_DEFINES', '') and
-+      'branding=Chrome' in os.environ.get('GYP_DEFINES', ''))
-+
-+  if ReadStampFile() == PACKAGE_VERSION and not args.force_local_build:
-+    print 'Clang is already up to date.'
-+    if not need_gold_plugin or os.path.exists(
-+        os.path.join(LLVM_BUILD_DIR, "lib/LLVMgold.so")):
-+      return 0
- 
-   # Reset the stamp file in case the build is unsuccessful.
-   WriteStampFile('')
- 
-   if not args.force_local_build:
-     cds_file = "clang-%s.tgz" %  PACKAGE_VERSION
--    cds_full_url = CDS_URL + '/Win/' + cds_file
-+    if sys.platform == 'win32':
-+      cds_full_url = CDS_URL + '/Win/' + cds_file
-+    elif sys.platform == 'darwin':
-+      cds_full_url = CDS_URL + '/Mac/' + cds_file
-+    else:
-+      assert sys.platform.startswith('linux')
-+      cds_full_url = CDS_URL + '/Linux_x64/' + cds_file
- 
--    # Check if there's a prebuilt binary and if so just fetch that. That's
--    # faster, and goma relies on having matching binary hashes on client and
--    # server too.
--    print 'Trying to download prebuilt clang'
--
--    # clang packages are smaller than 50 MB, small enough to keep in memory.
--    with contextlib.closing(cStringIO.StringIO()) as f:
--      try:
--        DownloadUrl(cds_full_url, f)
--        f.seek(0)
--        tarfile.open(mode='r:gz', fileobj=f).extractall(path=LLVM_BUILD_DIR)
--        print 'clang %s unpacked' % PACKAGE_VERSION
--        WriteStampFile(PACKAGE_VERSION)
--        return 0
--      except urllib2.HTTPError:
--        print 'Did not find prebuilt clang %s, building locally' % cds_file
-+    print 'Downloading prebuilt clang'
-+    if os.path.exists(LLVM_BUILD_DIR):
-+      RmTree(LLVM_BUILD_DIR)
-+    try:
-+      DownloadAndUnpack(cds_full_url, LLVM_BUILD_DIR)
-+      print 'clang %s unpacked' % PACKAGE_VERSION
-+      # Download the gold plugin if requested to by an environment variable.
-+      # This is used by the CFI ClusterFuzz bot, and it's required for official
-+      # builds on linux.
-+      if need_gold_plugin:
-+        RunCommand(['python', CHROMIUM_DIR+'/build/download_gold_plugin.py'])
-+      WriteStampFile(PACKAGE_VERSION)
-+      return 0
-+    except urllib2.URLError:
-+      print 'Failed to download prebuilt clang %s' % cds_file
-+      print 'Use --force-local-build if you want to build locally.'
-+      print 'Exiting.'
-+      return 1
-+
-+  if args.with_android and not os.path.exists(ANDROID_NDK_DIR):
-+    print 'Android NDK not found at ' + ANDROID_NDK_DIR
-+    print 'The Android NDK is needed to build a Clang whose -fsanitize=address'
-+    print 'works on Android. See '
-+    print 'http://code.google.com/p/chromium/wiki/AndroidBuildInstructions'
-+    print 'for how to install the NDK, or pass --without-android.'
-+    return 1
- 
-+  MaybeDownloadHostGcc(args)
-   AddCMakeToPath()
- 
--  RevertPreviouslyPatchedFiles()
-   DeleteChromeToolsShim()
- 
-   Checkout('LLVM', LLVM_REPO_URL + '/llvm/trunk', LLVM_DIR)
-@@ -429,10 +400,24 @@
-     # into it too (since OS X 10.6 doesn't have libc++abi.dylib either).
-     Checkout('libcxxabi', LLVM_REPO_URL + '/libcxxabi/trunk', LIBCXXABI_DIR)
- 
--  if args.with_patches and sys.platform != 'win32':
--    ApplyLocalPatches()
--
-   cc, cxx = None, None
-+  libstdcpp = None
-+  if args.gcc_toolchain:  # This option is only used on Linux.
-+    # Use the specified gcc installation for building.
-+    cc = os.path.join(args.gcc_toolchain, 'bin', 'gcc')
-+    cxx = os.path.join(args.gcc_toolchain, 'bin', 'g++')
-+
-+    if not os.access(cc, os.X_OK):
-+      print 'Invalid --gcc-toolchain: "%s"' % args.gcc_toolchain
-+      print '"%s" does not appear to be valid.' % cc
-+      return 1
-+
-+    # Set LD_LIBRARY_PATH to make auxiliary targets (tablegen, bootstrap
-+    # compiler, etc.) find the .so.
-+    libstdcpp = subprocess.check_output(
-+        [cxx, '-print-file-name=libstdc++.so.6']).rstrip()
-+    os.environ['LD_LIBRARY_PATH'] = os.path.dirname(libstdcpp)
-+
-   cflags = cxxflags = ldflags = []
- 
-   # LLVM uses C++11 starting in llvm 3.5. On Linux, this means libstdc++4.7+ is
-@@ -462,8 +447,7 @@
- 
-   if args.bootstrap:
-     print 'Building bootstrap compiler'
--    if not os.path.exists(LLVM_BOOTSTRAP_DIR):
--      os.makedirs(LLVM_BOOTSTRAP_DIR)
-+    EnsureDirExists(LLVM_BOOTSTRAP_DIR)
-     os.chdir(LLVM_BOOTSTRAP_DIR)
-     bootstrap_args = base_cmake_args + [
-         '-DLLVM_TARGETS_TO_BUILD=host',
-@@ -473,11 +457,16 @@
-         ]
-     if cc is not None:  bootstrap_args.append('-DCMAKE_C_COMPILER=' + cc)
-     if cxx is not None: bootstrap_args.append('-DCMAKE_CXX_COMPILER=' + cxx)
-+    RmCmakeCache('.')
-     RunCommand(['cmake'] + bootstrap_args + [LLVM_DIR], msvc_arch='x64')
-     RunCommand(['ninja'], msvc_arch='x64')
-     if args.run_tests:
-       RunCommand(['ninja', 'check-all'], msvc_arch='x64')
-     RunCommand(['ninja', 'install'], msvc_arch='x64')
-+    if args.gcc_toolchain:
-+      # Copy that gcc's stdlibc++.so.6 to the build dir, so the bootstrap
-+      # compiler can start.
-+      CopyFile(libstdcpp, os.path.join(LLVM_BOOTSTRAP_INSTALL_DIR, 'lib'))
- 
-     if sys.platform == 'win32':
-       cc = os.path.join(LLVM_BOOTSTRAP_INSTALL_DIR, 'bin', 'clang-cl.exe')
-@@ -489,6 +478,12 @@
-     else:
-       cc = os.path.join(LLVM_BOOTSTRAP_INSTALL_DIR, 'bin', 'clang')
-       cxx = os.path.join(LLVM_BOOTSTRAP_INSTALL_DIR, 'bin', 'clang++')
-+
-+    if args.gcc_toolchain:
-+      # Tell the bootstrap compiler to use a specific gcc prefix to search
-+      # for standard library headers and shared object files.
-+      cflags = ['--gcc-toolchain=' + args.gcc_toolchain]
-+      cxxflags = ['--gcc-toolchain=' + args.gcc_toolchain]
-     print 'Building final compiler'
- 
-   if sys.platform == 'darwin':
-@@ -543,7 +538,7 @@
-     binutils_incdir = os.path.join(BINUTILS_DIR, 'Linux_x64/Release/include')
- 
-   # If building at head, define a macro that plugins can use for #ifdefing
--  # out code that builds at head, but not at LLVM_WIN_REVISION or vice versa.
-+  # out code that builds at head, but not at CLANG_REVISION or vice versa.
-   if use_head_revision:
-     cflags += ['-DLLVM_FORCE_HEAD_REVISION']
-     cxxflags += ['-DLLVM_FORCE_HEAD_REVISION']
-@@ -555,8 +550,15 @@
-     deployment_env = os.environ.copy()
-     deployment_env['MACOSX_DEPLOYMENT_TARGET'] = deployment_target
- 
--  cmake_args = base_cmake_args + [
-+  cmake_args = []
-+  # TODO(thakis): Unconditionally append this to base_cmake_args instead once
-+  # compiler-rt can build with clang-cl on Windows (http://llvm.org/PR23698)
-+  cc_args = base_cmake_args if sys.platform != 'win32' else cmake_args
-+  if cc is not None:  cc_args.append('-DCMAKE_C_COMPILER=' + cc)
-+  if cxx is not None: cc_args.append('-DCMAKE_CXX_COMPILER=' + cxx)
-+  cmake_args += base_cmake_args + [
-       '-DLLVM_BINUTILS_INCDIR=' + binutils_incdir,
-+      '-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly',
-       '-DCMAKE_C_FLAGS=' + ' '.join(cflags),
-       '-DCMAKE_CXX_FLAGS=' + ' '.join(cxxflags),
-       '-DCMAKE_EXE_LINKER_FLAGS=' + ' '.join(ldflags),
-@@ -565,35 +567,44 @@
-       '-DCMAKE_INSTALL_PREFIX=' + LLVM_BUILD_DIR,
-       '-DCHROMIUM_TOOLS_SRC=%s' % os.path.join(CHROMIUM_DIR, 'tools', 'clang'),
-       '-DCHROMIUM_TOOLS=%s' % ';'.join(args.tools)]
--  # TODO(thakis): Unconditionally append this to base_cmake_args instead once
--  # compiler-rt can build with clang-cl on Windows (http://llvm.org/PR23698)
--  cc_args = base_cmake_args if sys.platform != 'win32' else cmake_args
--  if cc is not None:  cc_args.append('-DCMAKE_C_COMPILER=' + cc)
--  if cxx is not None: cc_args.append('-DCMAKE_CXX_COMPILER=' + cxx)
- 
--  if not os.path.exists(LLVM_BUILD_DIR):
--    os.makedirs(LLVM_BUILD_DIR)
-+  EnsureDirExists(LLVM_BUILD_DIR)
-   os.chdir(LLVM_BUILD_DIR)
-+  RmCmakeCache('.')
-   RunCommand(['cmake'] + cmake_args + [LLVM_DIR],
-              msvc_arch='x64', env=deployment_env)
--  RunCommand(['ninja'], msvc_arch='x64')
-+
-+  if args.gcc_toolchain:
-+    # Copy in the right stdlibc++.so.6 so clang can start.
-+    if not os.path.exists(os.path.join(LLVM_BUILD_DIR, 'lib')):
-+      os.mkdir(os.path.join(LLVM_BUILD_DIR, 'lib'))
-+    libstdcpp = subprocess.check_output(
-+        [cxx] + cxxflags + ['-print-file-name=libstdc++.so.6']).rstrip()
-+    CopyFile(libstdcpp, os.path.join(LLVM_BUILD_DIR, 'lib'))
-+
-+  # TODO(thakis): Remove "-d explain" once http://crbug.com/569337 is fixed.
-+  RunCommand(['ninja', '-d', 'explain'], msvc_arch='x64')
- 
-   if args.tools:
-     # If any Chromium tools were built, install those now.
-     RunCommand(['ninja', 'cr-install'], msvc_arch='x64')
- 
-   if sys.platform == 'darwin':
--    CopyFile(os.path.join(LLVM_BUILD_DIR, 'libc++.1.dylib'),
-+    CopyFile(os.path.join(libcxxbuild, 'libc++.1.dylib'),
-              os.path.join(LLVM_BUILD_DIR, 'bin'))
-     # See http://crbug.com/256342
-     RunCommand(['strip', '-x', os.path.join(LLVM_BUILD_DIR, 'bin', 'clang')])
-   elif sys.platform.startswith('linux'):
-     RunCommand(['strip', os.path.join(LLVM_BUILD_DIR, 'bin', 'clang')])
- 
--  # Do an x86 build of compiler-rt to get the 32-bit ASan run-time.
-+  # Do an out-of-tree build of compiler-rt.
-+  # On Windows, this is used to get the 32-bit ASan run-time.
-   # TODO(hans): Remove once the regular build above produces this.
--  if not os.path.exists(COMPILER_RT_BUILD_DIR):
--    os.makedirs(COMPILER_RT_BUILD_DIR)
-+  # On Mac and Linux, this is used to get the regular 64-bit run-time.
-+  # Do a clobbered build due to cmake changes.
-+  if os.path.isdir(COMPILER_RT_BUILD_DIR):
-+    RmTree(COMPILER_RT_BUILD_DIR)
-+  os.makedirs(COMPILER_RT_BUILD_DIR)
-   os.chdir(COMPILER_RT_BUILD_DIR)
-   # TODO(thakis): Add this once compiler-rt can build with clang-cl (see
-   # above).
-@@ -606,11 +617,17 @@
-       '-DCMAKE_CXX_FLAGS=' + ' '.join(cxxflags)]
-   if sys.platform != 'win32':
-     compiler_rt_args += ['-DLLVM_CONFIG_PATH=' +
--                         os.path.join(LLVM_BUILD_DIR, 'bin', 'llvm-config')]
--  RunCommand(['cmake'] + compiler_rt_args + [LLVM_DIR],
--              msvc_arch='x86', env=deployment_env)
-+                         os.path.join(LLVM_BUILD_DIR, 'bin', 'llvm-config'),
-+                        '-DSANITIZER_MIN_OSX_VERSION="10.7"']
-+  # compiler-rt is part of the llvm checkout on Windows but a stand-alone
-+  # directory elsewhere, see the TODO above COMPILER_RT_DIR.
-+  RmCmakeCache('.')
-+  RunCommand(['cmake'] + compiler_rt_args +
-+             [LLVM_DIR if sys.platform == 'win32' else COMPILER_RT_DIR],
-+             msvc_arch='x86', env=deployment_env)
-   RunCommand(['ninja', 'compiler-rt'], msvc_arch='x86')
- 
-+  # Copy select output to the main tree.
-   # TODO(hans): Make this (and the .gypi and .isolate files) version number
-   # independent.
-   if sys.platform == 'win32':
-@@ -620,17 +637,35 @@
-   else:
-     assert sys.platform.startswith('linux')
-     platform = 'linux'
--  asan_rt_lib_src_dir = os.path.join(COMPILER_RT_BUILD_DIR, 'lib', 'clang',
--                                     VERSION, 'lib', platform)
-+  asan_rt_lib_src_dir = os.path.join(COMPILER_RT_BUILD_DIR, 'lib', platform)
-+  if sys.platform == 'win32':
-+    # TODO(thakis): This too is due to compiler-rt being part of the checkout
-+    # on Windows, see TODO above COMPILER_RT_DIR.
-+    asan_rt_lib_src_dir = os.path.join(COMPILER_RT_BUILD_DIR, 'lib', 'clang',
-+                                       VERSION, 'lib', platform)
-   asan_rt_lib_dst_dir = os.path.join(LLVM_BUILD_DIR, 'lib', 'clang',
-                                      VERSION, 'lib', platform)
--  CopyDirectoryContents(asan_rt_lib_src_dir, asan_rt_lib_dst_dir,
--                        r'^.*-i386\.lib$')
--  CopyDirectoryContents(asan_rt_lib_src_dir, asan_rt_lib_dst_dir,
--                        r'^.*-i386\.dll$')
-+  # Blacklists:
-+  CopyDirectoryContents(os.path.join(asan_rt_lib_src_dir, '..', '..'),
-+                        os.path.join(asan_rt_lib_dst_dir, '..', '..'),
-+                        r'^.*blacklist\.txt$')
-+  # Headers:
-+  if sys.platform != 'win32':
-+    CopyDirectoryContents(
-+        os.path.join(COMPILER_RT_BUILD_DIR, 'include/sanitizer'),
-+        os.path.join(LLVM_BUILD_DIR, 'lib/clang', VERSION, 'include/sanitizer'))
-+  # Static and dynamic libraries:
-+  CopyDirectoryContents(asan_rt_lib_src_dir, asan_rt_lib_dst_dir)
-+  if sys.platform == 'darwin':
-+    for dylib in glob.glob(os.path.join(asan_rt_lib_dst_dir, '*.dylib')):
-+      # Fix LC_ID_DYLIB for the ASan dynamic libraries to be relative to
-+      # @executable_path.
-+      # TODO(glider): this is transitional. We'll need to fix the dylib
-+      # name either in our build system, or in Clang. See also
-+      # http://crbug.com/344836.
-+      subprocess.call(['install_name_tool', '-id',
-+                       '@executable_path/' + os.path.basename(dylib), dylib])
- 
--  CopyFile(os.path.join(asan_rt_lib_src_dir, '..', '..', 'asan_blacklist.txt'),
--           os.path.join(asan_rt_lib_dst_dir, '..', '..'))
- 
-   if sys.platform == 'win32':
-     # Make an extra copy of the sanitizer headers, to be put on the include path
-@@ -640,22 +675,67 @@
-     aux_sanitizer_include_dir = os.path.join(LLVM_BUILD_DIR, 'lib', 'clang',
-                                              VERSION, 'include_sanitizer',
-                                              'sanitizer')
--    if not os.path.exists(aux_sanitizer_include_dir):
--      os.makedirs(aux_sanitizer_include_dir)
-+    EnsureDirExists(aux_sanitizer_include_dir)
-     for _, _, files in os.walk(sanitizer_include_dir):
-       for f in files:
-         CopyFile(os.path.join(sanitizer_include_dir, f),
-                  aux_sanitizer_include_dir)
- 
-+  if args.with_android:
-+    make_toolchain = os.path.join(
-+        ANDROID_NDK_DIR, 'build', 'tools', 'make-standalone-toolchain.sh')
-+    for target_arch in ['aarch64', 'arm', 'i686']:
-+      # Make standalone Android toolchain for target_arch.
-+      toolchain_dir = os.path.join(
-+          LLVM_BUILD_DIR, 'android-toolchain-' + target_arch)
-+      RunCommand([
-+          make_toolchain,
-+          '--platform=android-' + ('21' if target_arch == 'aarch64' else '19'),
-+          '--install-dir="%s"' % toolchain_dir,
-+          '--system=linux-x86_64',
-+          '--stl=stlport',
-+          '--toolchain=' + {
-+              'aarch64': 'aarch64-linux-android-4.9',
-+              'arm': 'arm-linux-androideabi-4.9',
-+              'i686': 'x86-4.9',
-+          }[target_arch]])
-+      # Android NDK r9d copies a broken unwind.h into the toolchain, see
-+      # http://crbug.com/357890
-+      for f in glob.glob(os.path.join(toolchain_dir, 'include/c++/*/unwind.h')):
-+        os.remove(f)
-+
-+      # Build ASan runtime for Android in a separate build tree.
-+      build_dir = os.path.join(LLVM_BUILD_DIR, 'android-' + target_arch)
-+      if not os.path.exists(build_dir):
-+        os.mkdir(os.path.join(build_dir))
-+      os.chdir(build_dir)
-+      cflags = ['--target=%s-linux-androideabi' % target_arch,
-+                '--sysroot=%s/sysroot' % toolchain_dir,
-+                '-B%s' % toolchain_dir]
-+      android_args = base_cmake_args + [
-+        '-DCMAKE_C_COMPILER=' + os.path.join(LLVM_BUILD_DIR, 'bin/clang'),
-+        '-DCMAKE_CXX_COMPILER=' + os.path.join(LLVM_BUILD_DIR, 'bin/clang++'),
-+        '-DLLVM_CONFIG_PATH=' + os.path.join(LLVM_BUILD_DIR, 'bin/llvm-config'),
-+        '-DCMAKE_C_FLAGS=' + ' '.join(cflags),
-+        '-DCMAKE_CXX_FLAGS=' + ' '.join(cflags),
-+        '-DANDROID=1']
-+      RmCmakeCache('.')
-+      RunCommand(['cmake'] + android_args + [COMPILER_RT_DIR])
-+      RunCommand(['ninja', 'libclang_rt.asan-%s-android.so' % target_arch])
-+
-+      # And copy it into the main build tree.
-+      runtime = 'libclang_rt.asan-%s-android.so' % target_arch
-+      for root, _, files in os.walk(build_dir):
-+        if runtime in files:
-+          shutil.copy(os.path.join(root, runtime), asan_rt_lib_dst_dir)
-+
-   # Run tests.
-   if args.run_tests or use_head_revision:
-     os.chdir(LLVM_BUILD_DIR)
--    RunCommand(GetVSVersion().SetupScript('x64') +
--               ['&&', 'ninja', 'cr-check-all'])
-+    RunCommand(['ninja', 'cr-check-all'], msvc_arch='x64')
-   if args.run_tests:
-     os.chdir(LLVM_BUILD_DIR)
--    RunCommand(GetVSVersion().SetupScript('x64') +
--               ['&&', 'ninja', 'check-all'])
-+    RunCommand(['ninja', 'check-all'], msvc_arch='x64')
- 
-   WriteStampFile(PACKAGE_VERSION)
-   print 'Clang update was successful.'
-@@ -663,31 +743,6 @@
- 
- 
- def main():
--  if not sys.platform in ['win32', 'cygwin']:
--    # For non-Windows, fall back to update.sh.
--    # TODO(hans): Make update.py replace update.sh completely.
--
--    # This script is called by gclient. gclient opens its hooks subprocesses
--    # with (stdout=subprocess.PIPE, stderr=subprocess.STDOUT) and then does
--    # custom output processing that breaks printing '\r' characters for
--    # single-line updating status messages as printed by curl and wget.
--    # Work around this by setting stderr of the update.sh process to stdin (!):
--    # gclient doesn't redirect stdin, and while stdin itself is read-only, a
--    # dup()ed sys.stdin is writable, try
--    #   fd2 = os.dup(sys.stdin.fileno()); os.write(fd2, 'hi')
--    # TODO: Fix gclient instead, http://crbug.com/95350
--    if '--no-stdin-hack' in sys.argv:
--      sys.argv.remove('--no-stdin-hack')
--      stderr = None
--    else:
--      try:
--        stderr = os.fdopen(os.dup(sys.stdin.fileno()))
--      except:
--        stderr = sys.stderr
--    return subprocess.call(
--        [os.path.join(os.path.dirname(__file__), 'update.sh')] + sys.argv[1:],
--        stderr=stderr)
--
-   parser = argparse.ArgumentParser(description='Build Clang.')
-   parser.add_argument('--bootstrap', action='store_true',
-                       help='first build clang with CC, then with itself.')
-@@ -695,26 +750,24 @@
-                       help="run only if the script thinks clang is needed")
-   parser.add_argument('--force-local-build', action='store_true',
-                       help="don't try to download prebuild binaries")
-+  parser.add_argument('--gcc-toolchain', help='set the version for which gcc '
-+                      'version be used for building; --gcc-toolchain=/opt/foo '
-+                      'picks /opt/foo/bin/gcc')
-   parser.add_argument('--print-revision', action='store_true',
-                       help='print current clang revision and exit.')
-+  parser.add_argument('--print-clang-version', action='store_true',
-+                      help='print current clang version (e.g. x.y.z) and exit.')
-   parser.add_argument('--run-tests', action='store_true',
-                       help='run tests after building; only for local builds')
-   parser.add_argument('--tools', nargs='*',
-                       help='select which chrome tools to build',
-                       default=['plugins', 'blink_gc_plugin'])
--  parser.add_argument('--without-patches', action='store_false',
--                      help="don't apply patches (default)", dest='with_patches',
--                      default=True)
--
--  # For now, these flags are only used for the non-Windows flow, but argparser
--  # gets mad if it sees a flag it doesn't recognize.
--  parser.add_argument('--no-stdin-hack', action='store_true')
--
-+  parser.add_argument('--without-android', action='store_false',
-+                      help='don\'t build Android ASan runtime (linux only)',
-+                      dest='with_android',
-+                      default=sys.platform.startswith('linux'))
-   args = parser.parse_args()
- 
--  if re.search(r'\b(make_clang_dir)=', os.environ.get('GYP_DEFINES', '')):
--    print 'Skipping Clang update (make_clang_dir= was set in GYP_DEFINES).'
--    return 0
-   if args.if_needed:
-     is_clang_required = False
-     # clang is always used on Mac and Linux.
-@@ -730,8 +783,16 @@
-       is_clang_required = True
-     if not is_clang_required:
-       return 0
-+    if re.search(r'\b(make_clang_dir)=', os.environ.get('GYP_DEFINES', '')):
-+      print 'Skipping Clang update (make_clang_dir= was set in GYP_DEFINES).'
-+      return 0
-+
-+  if use_head_revision:
-+    # TODO(hans): Remove after the next roll.
-+    global VERSION
-+    VERSION = '3.9.0'
- 
--  global LLVM_WIN_REVISION, PACKAGE_VERSION
-+  global CLANG_REVISION, PACKAGE_VERSION
-   if args.print_revision:
-     if use_head_revision:
-       print GetSvnRevision(LLVM_DIR)
-@@ -739,6 +800,10 @@
-       print PACKAGE_VERSION
-     return 0
- 
-+  if args.print_clang_version:
-+    sys.stdout.write(VERSION)
-+    return 0
-+
-   # Don't buffer stdout, so that print statements are immediately flushed.
-   # Do this only after --print-revision has been handled, else we'll get
-   # an error message when this script is run from gn for some reason.
-@@ -747,12 +812,13 @@
-   if use_head_revision:
-     # Use a real revision number rather than HEAD to make sure that the stamp
-     # file logic works.
--    LLVM_WIN_REVISION = GetSvnRevision(LLVM_REPO_URL)
--    PACKAGE_VERSION = LLVM_WIN_REVISION + '-0'
-+    CLANG_REVISION = GetSvnRevision(LLVM_REPO_URL)
-+    PACKAGE_VERSION = CLANG_REVISION + '-0'
- 
-     args.force_local_build = True
--    # Skip local patches when using HEAD: they probably don't apply anymore.
--    args.with_patches = False
-+    if 'OS=android' not in os.environ.get('GYP_DEFINES', ''):
-+      # Only build the Android ASan rt on ToT bots when targetting Android.
-+      args.with_android = False
- 
-   return UpdateClang(args)
- 
diff --git a/pkgs/development/python-modules/pypcap/default.nix b/pkgs/development/python-modules/pypcap/default.nix
index ab4c5f6034f..e2d4e1efe28 100644
--- a/pkgs/development/python-modules/pypcap/default.nix
+++ b/pkgs/development/python-modules/pypcap/default.nix
@@ -1,14 +1,13 @@
-{ stdenv, lib, writeText, buildPythonPackage, fetchPypi, isPy3k, libpcap, dpkt }:
+{ stdenv, lib, writeText, buildPythonPackage, fetchPypi, libpcap, dpkt }:
 
 buildPythonPackage rec {
   pname = "pypcap";
-  version = "1.1.6";
+  version = "1.2.0";
   name = "${pname}-${version}";
-  disabled = isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1cx7qm0w2a91g5z8k3kmlwz0b8dkr0h8dlb64rwgyhp2laa33syi";
+    sha256 = "0n01xjgg8n5mf1cs9yg9ljsx1kvir8cm6wwrd2069fawjxdbk0b9";
   };
 
   patches = [
@@ -31,7 +30,8 @@ buildPythonPackage rec {
       '')
   ];
 
-  buildInputs = [ libpcap dpkt ];
+  buildInputs = [ libpcap ];
+  nativeBuildInputs = [ dpkt ];
 
   meta = {
     homepage = https://github.com/pynetwork/pypcap;
diff --git a/pkgs/development/tools/profiling/heaptrack/default.nix b/pkgs/development/tools/profiling/heaptrack/default.nix
index 69aa84951a4..e97ff61a0dc 100644
--- a/pkgs/development/tools/profiling/heaptrack/default.nix
+++ b/pkgs/development/tools/profiling/heaptrack/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "heaptrack-${version}";
-  version = "2017-02-14";
+  version = "2017-10-30";
 
   src = fetchFromGitHub {
     owner = "KDE";
     repo = "heaptrack";
-    rev = "2469003b3172874e1df7e1f81c56e469b80febdb";
-    sha256 = "0dqchd2r4khv9gzj4n0qjii2nqygkj5jclkji8jbvivx5qwsqznc";
+    rev = "2bf49bc4fed144e004a9cabd40580a0f0889758f";
+    sha256 = "0sqxk5cc8r2vsj5k2dj9jkd1f2x2yj3mxgsp65g7ls01bgga0i4d";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];
diff --git a/pkgs/development/tools/rust/racer/default.nix b/pkgs/development/tools/rust/racer/default.nix
index 57b685e946d..77ab75d1446 100644
--- a/pkgs/development/tools/rust/racer/default.nix
+++ b/pkgs/development/tools/rust/racer/default.nix
@@ -1,32 +1,33 @@
-{ stdenv, fetchFromGitHub, rustPlatform, makeWrapper }:
+{ stdenv, fetchFromGitHub, rustPlatform, makeWrapper, rustup, substituteAll }:
 
 rustPlatform.buildRustPackage rec {
   name = "racer-${version}";
-  version = "2.0.9";
+  version = "2.0.12";
 
   src = fetchFromGitHub {
     owner = "racer-rust";
     repo = "racer";
     rev = version;
-    sha256 = "06k50f2vj2w08afh3nrlhs0amcvw2i45bhfwr70sgs395xicjswp";
+    sha256 = "0y1xlpjr8y8gsmmrjlykx4vwzf8akk42g35kg3kc419ry4fli945";
   };
 
-  cargoSha256 = "1w5imxyqlyv24dvzncq6dy01zn2x8p1aciyvzh8ac1x1wdjcacjc";
+  cargoSha256 = "1h3jv4hajdv6k309kjr6b6298kxmd0faw081i3788sl794k9mp0j";
 
-  buildInputs = [ makeWrapper ];
+  # rustup is required for test
+  buildInputs = [ makeWrapper rustup ];
 
   preCheck = ''
     export RUST_SRC_PATH="${rustPlatform.rustcSrc}"
   '';
-
+  patches = [
+    (substituteAll {
+      src = ./rust-src.patch;
+      inherit (rustPlatform) rustcSrc;
+    })
+    ./ignore-tests.patch
+  ];
   doCheck = true;
 
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -p target/release/racer $out/bin/
-    wrapProgram $out/bin/racer --set RUST_SRC_PATH "${rustPlatform.rustcSrc}"
-  '';
-
   meta = with stdenv.lib; {
     description = "A utility intended to provide Rust code completion for editors and IDEs";
     homepage = https://github.com/racer-rust/racer;
diff --git a/pkgs/development/tools/rust/racer/ignore-tests.patch b/pkgs/development/tools/rust/racer/ignore-tests.patch
new file mode 100644
index 00000000000..021217b4094
--- /dev/null
+++ b/pkgs/development/tools/rust/racer/ignore-tests.patch
@@ -0,0 +1,22 @@
+diff -Naur --strip-trailing-cr source.org/src/racer/nameres.rs source/src/racer/nameres.rs
+--- source.org/src/racer/nameres.rs	2017-11-15 20:37:38.571644733 +0000
++++ source/src/racer/nameres.rs	2017-11-15 20:23:20.521324031 +0000
+@@ -577,6 +577,7 @@
+     out.into_iter()
+ }
+ 
++#[ignore]
+ #[test]
+ fn test_do_file_search() {
+     let cache = core::FileCache::default();
+diff -Naur --strip-trailing-cr source.org/src/racer/util.rs source/src/racer/util.rs
+--- source.org/src/racer/util.rs	2017-11-15 19:37:55.095344120 +0000
++++ source/src/racer/util.rs	2017-11-15 20:22:53.746624158 +0000
+@@ -475,6 +475,7 @@
+ 
+ }
+ 
++#[ignore]
+ #[test]
+ fn test_get_rust_src_path_missing() {
+     use std::env;
diff --git a/pkgs/development/tools/rust/racer/rust-src.patch b/pkgs/development/tools/rust/racer/rust-src.patch
new file mode 100644
index 00000000000..2e794ac8887
--- /dev/null
+++ b/pkgs/development/tools/rust/racer/rust-src.patch
@@ -0,0 +1,10 @@
+--- source.org/src/racer/util.rs	1970-01-01 01:00:01.000000000 +0100
++++ source/src/racer/util.rs	2017-11-15 16:50:12.904216242 +0000
+@@ -384,6 +384,7 @@
+     debug!("Nope. Trying default paths: /usr/local/src/rust/src and /usr/src/rust/src");
+ 
+     let default_paths = [
++        "@rustcSrc@",
+         "/usr/local/src/rust/src",
+         "/usr/src/rust/src",
+     ];
diff --git a/pkgs/games/factorio/default.nix b/pkgs/games/factorio/default.nix
index f8d715ccc32..ba23db2fbdf 100644
--- a/pkgs/games/factorio/default.nix
+++ b/pkgs/games/factorio/default.nix
@@ -16,8 +16,8 @@ let
   #    where the ultimate "_" (before the version) is changed to a "-".
   binDists = {
     x86_64-linux = let bdist = bdistForArch { inUrl = "linux64"; inTar = "x64"; }; in {
-      alpha    = bdist { sha256 = "0phikwv00mbwpz4207wm6gz6blarm0b9p1f013ha2w5g7c2dxq4s"; fetcher = authenticatedFetch; };
-      headless = bdist { sha256 = "1m170cl8ji6k3d3jm6n48wx3b7xfsxp4wkaixh0qszaqzafsglp0"; };
+      alpha    = bdist { sha256 = "0y6d7pvf3dgyll175323xp4zmrbyrjn73zrb478y1gpl6dqh064d"; fetcher = authenticatedFetch; };
+      headless = bdist { sha256 = "1agkra3qq11la307ymsfb7v358wc2s2mdpmfbc5n0sb4gnmnqazq"; };
       demo     = bdist { sha256 = "03nwn4838yhqq0r76pf2m4wxi32rsq0knsxmq3qq4ycji89q1dyc"; version = "0.15.33"; };
     };
     i686-linux = let bdist = bdistForArch { inUrl = "linux32"; inTar = "i386"; }; in {
@@ -29,7 +29,7 @@ let
   actual = binDists.${stdenv.system}.${releaseType} or (throw "Factorio: unsupported platform");
 
   bdistForArch = arch: { sha256 ? null
-                       , version ? "0.15.34"
+                       , version ? "0.15.37"
                        , fetcher ? fetchurl
                        , nameMut ? x: x
                        }:
diff --git a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
index 55b40c9cd7d..99bfa0b57c0 100644
--- a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
+++ b/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
@@ -3,9 +3,9 @@
 with stdenv.lib;
 
 let
-  version = "4.13.12";
+  version = "4.13.13";
   revision = "a";
-  sha256 = "10zfdv0s5jdpp9nqbxi34wwf1pqh3fjflgcd60f7cbr95ivvkl9r";
+  sha256 = "1bph0cvmms16mi5iczr6q1wrz7fp5gl2kz5lk8b3cx04wpj65jfl";
 
   # modVersion needs to be x.y.z, will automatically add .0 if needed
   modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index 1c0705f0e2f..b2d090fa7ea 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -13,6 +13,7 @@ let
   common = { version
     , sha256
     , rev ? "spl-${version}"
+    , broken ? false
     } @ args : stdenv.mkDerivation rec {
       name = "spl-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
 
@@ -52,7 +53,7 @@ let
           kernel.
         '';
 
-        broken = kernel != null && stdenv.lib.versionAtLeast kernel.version "4.14";
+        inherit broken;
 
         homepage = http://zfsonlinux.org/;
         platforms = platforms.linux;
@@ -67,11 +68,13 @@ in
     splStable = common {
       version = "0.7.3";
       sha256 = "0j8mb9ky3pjz9hnz5w6fajpzajl15jq3p0xvxb6lhpqj3rjzsqxb";
+
+      broken = kernel != null && stdenv.lib.versionAtLeast kernel.version "4.14";
     };
 
     splUnstable = common {
-      version = "2017-10-31";
-      rev = "35a44fcb8d6e346f51be82dfe57562c2ea0c6a9c";
-      sha256 = "193clx7b4p4qhgivmhc88dva0186rnhyv58fx0fwnb5zbx70dam1";
+      version = "2017-11-16";
+      rev = "ed19bccfb651843fa208232b3a2d3d22a4152bc8";
+      sha256 = "08ihjbf5fhcnhq9zavcwswg9djlbalbx1bil4rcv6i3d617wammb";
     };
 }
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 65a743f5f12..e932f516375 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -159,10 +159,10 @@ in {
     incompatibleKernelVersion = null;
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2017-11-12";
+    version = "2017-11-16";
 
-    rev = "5277f208f290ea4e2204800a66c3ba20a03fe503";  
-    sha256 = "0hhlhv4g678j1w45813xfrk8zza0af59cdkmib9bkxy0cn0jsnd6";
+    rev = "d4a72f23863382bdf6d0ae33196f5b5decbc48fd";
+    sha256 = "0q2gkkj11hy8m8cjd70g99bs69ldxvc17ym0x1pgwvs4722hzpha";
     isUnstable = true;
 
     extraPatches = [
diff --git a/pkgs/servers/mail/rspamd/default.nix b/pkgs/servers/mail/rspamd/default.nix
index 13834f95282..2b81edf48ba 100644
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@@ -1,22 +1,22 @@
 { stdenv, fetchFromGitHub, cmake, perl
-, file, glib, gmime, libevent, luajit, openssl, pcre, pkgconfig, sqlite, ragel }:
+, file, glib, gmime, libevent, luajit, openssl, pcre, pkgconfig, sqlite, ragel, icu, libfann }:
 
 let libmagic = file;  # libmagic provided by file package ATM
 in
 
 stdenv.mkDerivation rec {
   name = "rspamd-${version}";
-  version = "1.4.3";
+  version = "1.6.5";
 
   src = fetchFromGitHub {
     owner = "vstakhov";
     repo = "rspamd";
     rev = version;
-    sha256 = "1wrqi8vsd61rc48x2gyhc0xrir9pr372lpkyhwgx1rpxzdxsdwh9";
+    sha256 = "1idy81absr5w677d4jlzic33hsrn0zjzbfhhdn6viym9vr8dvjx9";
   };
 
   nativeBuildInputs = [ cmake pkgconfig perl ];
-  buildInputs = [ glib gmime libevent libmagic luajit openssl pcre sqlite ragel ];
+  buildInputs = [ glib gmime libevent libmagic luajit openssl pcre sqlite ragel icu libfann];
 
   postPatch = ''
     substituteInPlace conf/common.conf --replace "\$CONFDIR/rspamd.conf.local" "/etc/rspamd/rspamd.conf.local"
diff --git a/pkgs/servers/matterbridge/default.nix b/pkgs/servers/matterbridge/default.nix
index 1fe07a74f83..5b2335c73f6 100644
--- a/pkgs/servers/matterbridge/default.nix
+++ b/pkgs/servers/matterbridge/default.nix
@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   name = "matterbridge-${version}";
-  version = "1.1.0";
+  version = "1.4.1";
 
   goPackagePath = "github.com/42wim/matterbridge";
 
   src = fetchurl {
     url = "https://github.com/42wim/matterbridge/archive/v${version}.tar.gz";
-    sha256 = "1br3rf500jdklzpxg1lkagglvmqshhligfkhndi8plg9hmzpd8qp";
+    sha256 = "0m0phv8rngrp9gfn71gd2z184n60rng1fmvmv5nkmzsclr2y7x8b";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/mattermost/default.nix b/pkgs/servers/mattermost/default.nix
index 2bfe929784b..5fab7e7b29f 100644
--- a/pkgs/servers/mattermost/default.nix
+++ b/pkgs/servers/mattermost/default.nix
@@ -2,18 +2,18 @@
 
 buildGoPackage rec {
   name = "mattermost-${version}";
-  version = "4.3.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "mattermost";
     repo = "mattermost-server";
     rev = "v${version}";
-    sha256 = "05119h3x81p8plfjq99khfywc3plv2zynvf83vkhj48zqk61wvbq";
+    sha256 = "0imda96wgr2nkkxs2jfcqszx1fqgmbbrh7zqmgjh6ks3an1v4m3c";
   };
 
   webApp = fetchurl {
     url = "https://releases.mattermost.com/${version}/mattermost-team-${version}-linux-amd64.tar.gz";
-    sha256 = "0d30zj036nz6vwpiv0mn656j5r4br6y4x8iqc5jn785fiwk2pdls";
+    sha256 = "1ifxx17sm24c6sihg38lzpnb5x24m04bk25nn5hrw9iwc37lfzlp";
   };
 
   goPackagePath = "github.com/mattermost/mattermost-server";
diff --git a/pkgs/servers/tvheadend/default.nix b/pkgs/servers/tvheadend/default.nix
index 7ff0796811a..d8cfadbfab2 100644
--- a/pkgs/servers/tvheadend/default.nix
+++ b/pkgs/servers/tvheadend/default.nix
@@ -3,7 +3,7 @@
 , which, zlib }:
 
 let
-  version = "4.2.1";
+  version = "4.2.4";
 
 in stdenv.mkDerivation rec {
   name = "tvheadend-${version}";
@@ -12,7 +12,7 @@ in stdenv.mkDerivation rec {
     owner  = "tvheadend";
     repo   = "tvheadend";
     rev    = "v${version}";
-    sha256 = "1lhk8psvifmn4kjwyfxjj21z0apyr59zizzsfd4j22v7bk66rrl9";
+    sha256 = "1kydjmgv0nrllgi2s6aczq4x9ag01c8qm8w962qb52fzdfw7fs6k";
   };
 
   buildInputs = [
@@ -39,7 +39,8 @@ in stdenv.mkDerivation rec {
   preConfigure = ''
     patchShebangs ./configure
 
-    substituteInPlace src/config.c --replace /usr/bin/tar ${gnutar}/bin/tar
+    substituteInPlace src/config.c \
+      --replace /usr/bin/tar ${gnutar}/bin/tar
 
     # the version detection script `support/version` reads this file if it
     # exists, so let's just use that
diff --git a/pkgs/shells/fish-foreign-env/default.nix b/pkgs/shells/fish-foreign-env/default.nix
index 76a979bcda1..445e961c649 100644
--- a/pkgs/shells/fish-foreign-env/default.nix
+++ b/pkgs/shells/fish-foreign-env/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
         -i $out/share/fish-foreign-env/functions/*
   '';
 
-  patches = [ ./hide-path-warnings.patch ];
+  patches = [ ./suppress-harmless-warnings.patch ];
 
   meta = with stdenv.lib; {
     description = "A foreign environment interface for Fish shell";
diff --git a/pkgs/shells/fish-foreign-env/hide-path-warnings.patch b/pkgs/shells/fish-foreign-env/suppress-harmless-warnings.patch
index b7ac4edc518..5e4569f0a15 100644
--- a/pkgs/shells/fish-foreign-env/hide-path-warnings.patch
+++ b/pkgs/shells/fish-foreign-env/suppress-harmless-warnings.patch
@@ -1,16 +1,23 @@
 diff --git a/functions/fenv.apply.fish b/functions/fenv.apply.fish
-index 34a25e3..6837e7f 100644
+index 34a25e3..3d94135 100644
 --- a/functions/fenv.apply.fish
 +++ b/functions/fenv.apply.fish
-@@ -30,8 +30,9 @@ function fenv.apply
+@@ -27,11 +27,17 @@ function fenv.apply
+     for variable in $variables
+         set key (echo $variable | sed 's/=.*//')
+         set value (echo $variable | sed 's/[^=]*=//')
++        set ignore PATH _
  
          if test "$key" = 'PATH'
            set value (echo $value | tr ':' '\n')
+         end
+ 
+-        set -g -x $key $value
++        if contains $key $ignore
 +          set -g -x $key $value ^/dev/null
 +        else
 +          set -g -x $key $value
-         end
--
--        set -g -x $key $value
++        end
++
      end
  end
diff --git a/pkgs/tools/admin/certbot/default.nix b/pkgs/tools/admin/certbot/default.nix
index 9ac6ed17f66..78a38e07cc2 100644
--- a/pkgs/tools/admin/certbot/default.nix
+++ b/pkgs/tools/admin/certbot/default.nix
@@ -4,13 +4,13 @@
 
 python2Packages.buildPythonApplication rec {
   name = "certbot-${version}";
-  version = "0.11.1";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "certbot";
     repo = "certbot";
     rev = "v${version}";
-    sha256 = "0f8s6wzj69gnqld6iaskmmwyg5zy5v3zwhp1n1izxixm0vhkzgrq";
+    sha256 = "14i3q59v7j0q2pa1dri420fhil4h0vgl4vb471hp81f4y14gq6h7";
   };
 
   propagatedBuildInputs = with python2Packages; [
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 3622b981cc4..6dec65892b0 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -1,23 +1,34 @@
-{ stdenv, lib, fetchurl, python, cffi, cryptography, pyopenssl, crcmod, google-compute-engine, makeWrapper }:
+# Make sure that the "with-gce" flag is set when building `google-cloud-sdk`
+# for GCE hosts. This flag prevents "google-compute-engine" from being a
+# default dependency which is undesirable because this package is
+#
+#   1) available only on GNU/Linux (requires `systemd` in particular)
+#   2) intended only for GCE guests (and is useless elsewhere)
+#   3) used by `google-cloud-sdk` only on GCE guests
+#
+
+{ stdenv, lib, fetchurl, makeWrapper, python, cffi, cryptography, pyopenssl,
+  crcmod, google-compute-engine, with-gce ? false }:
 
-# other systems not supported yet
 let
-  pythonInputs = [ cffi cryptography pyopenssl crcmod google-compute-engine ];
+  pythonInputs = [ cffi cryptography pyopenssl crcmod ]
+                 ++ lib.optional (with-gce) google-compute-engine;
   pythonPath = lib.makeSearchPath python.sitePackages pythonInputs;
 
+  baseUrl = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads";
   sources = name: system: {
     i686-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86.tar.gz";
+      url = "${baseUrl}/${name}-linux-x86.tar.gz";
       sha256 = "0aq938s1w9mzj60avmcc68kgll54pl7635vl2mi89f6r56n0xslp";
     };
 
     x86_64-darwin = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-darwin-x86_64.tar.gz";
+      url = "${baseUrl}/${name}-darwin-x86_64.tar.gz";
       sha256 = "13k2i1svry9q800s1jgf8jss0rzfxwk6qci3hsy1wrb9b2mwlz5g";
     };
 
     x86_64-linux = {
-      url = "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/${name}-linux-x86_64.tar.gz";
+      url = "${baseUrl}/${name}-linux-x86_64.tar.gz";
       sha256 = "1kvaz8p1iflsi85wwi7lb6km6frj70xsricyz1ah0sw3q71zyqmc";
     };
   }.${system};
diff --git a/pkgs/tools/admin/simp_le/default.nix b/pkgs/tools/admin/simp_le/default.nix
index 4eb0cacdea9..f66fd6b00af 100644
--- a/pkgs/tools/admin/simp_le/default.nix
+++ b/pkgs/tools/admin/simp_le/default.nix
@@ -2,12 +2,12 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "simp_le-client";
-  version = "0.2.0";
+  version = "0.6.1";
   name = "${pname}-${version}";
 
   src = pythonPackages.fetchPypi {
     inherit pname version;
-    sha256 = "1zg18jfry9mvkri3yd2f5mwfsl27ac9zmnll3bm93jb91jhd6ssh";
+    sha256 = "0x4fky9jizs3xi55cdy217cvm3ikpghiabysan71b07ackkdfj6k";
   };
 
   checkPhase = ''
diff --git a/pkgs/tools/misc/fd/default.nix b/pkgs/tools/misc/fd/default.nix
index 09debd461dc..5ac5233c916 100644
--- a/pkgs/tools/misc/fd/default.nix
+++ b/pkgs/tools/misc/fd/default.nix
@@ -16,6 +16,11 @@ rustPlatform.buildRustPackage rec {
   preFixup = ''
     mkdir -p "$out/man/man1"
     cp "$src/doc/fd.1" "$out/man/man1"
+
+    mkdir -p "$out/share/"{bash-completion/completions,fish/completions,zsh/site-functions}
+    cp target/release/build/fd-find-*/out/fd.bash-completion "$out/share/bash-completion/completions/"
+    cp target/release/build/fd-find-*/out/fd.fish "$out/share/fish/completions/"
+    cp target/release/build/fd-find-*/out/_fd "$out/share/zsh/site-functions/"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/networking/inadyn/default.nix b/pkgs/tools/networking/inadyn/default.nix
index 3495d2d56f0..219a993b8a2 100644
--- a/pkgs/tools/networking/inadyn/default.nix
+++ b/pkgs/tools/networking/inadyn/default.nix
@@ -1,33 +1,28 @@
-{ stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig
+{ stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkgconfig
 , gnutls, libite, libconfuse }:
 
-let
-  version = "2.1";
-in
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   name = "inadyn-${version}";
+  version = "2.2.1";
 
-  src = fetchurl {
-    url = "https://github.com/troglobit/inadyn/releases/download/v${version}/inadyn-${version}.tar.xz";
-    sha256 = "1b5khr2y5q1x2mn08zrnjf9hsals4y403mhsc1s7016w3my9lqw7";
+  src = fetchFromGitHub {
+    owner = "troglobit";
+    repo = "inadyn";
+    rev = "v${version}";
+    sha256 = "1nkrvd33mnj98m86g3xs27l88l2678qjzjhwpq1k9n8v9k255pd6";
   };
 
-  patches = [
-    ./remove-unused-macro.patch
-    (fetchpatch {
-      url = "https://github.com/troglobit/inadyn/commit/ed3a7761015441b5d5cacd691b7aa114da048bef.patch";
-      sha256 = "1passghmjd7gmrfcqkfqw9lvg8l22s91nm65ys3n3rylzsgaaq8i";
-     })
-  ];
-
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
+
   buildInputs = [ gnutls libite libconfuse ];
 
-  meta = {
-    homepage = http://inadyn.sourceforge.net/;
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    homepage = http://troglobit.com/project/inadyn/;
     description = "Free dynamic DNS client";
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ viric ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/tools/networking/network-manager/default.nix b/pkgs/tools/networking/network-manager/default.nix
index ace568d6900..6005314ea97 100644
--- a/pkgs/tools/networking/network-manager/default.nix
+++ b/pkgs/tools/networking/network-manager/default.nix
@@ -8,12 +8,12 @@
 stdenv.mkDerivation rec {
   name    = "network-manager-${version}";
   pname   = "NetworkManager";
-  major   = "1.8";
-  version = "${major}.2";
+  major   = "1.10";
+  version = "${major}.0";
 
   src = fetchurl {
     url    = "mirror://gnome/sources/${pname}/${major}/${pname}-${version}.tar.xz";
-    sha256 = "1x0vzxvrck0snga2n3pc7g74m20zz74cr4r8gfspl8sckv6yz9bi";
+    sha256 = "1ph45rqpl8p9k4rirhss0hpf104clm8fp322p6kh6q75y06ddfwa";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/tools/security/afl/default.nix b/pkgs/tools/security/afl/default.nix
index ae80b5ec0b5..51701590b8e 100644
--- a/pkgs/tools/security/afl/default.nix
+++ b/pkgs/tools/security/afl/default.nix
@@ -11,11 +11,11 @@ in
 
 stdenv.mkDerivation rec {
   name    = "afl-${version}";
-  version = "2.51b";
+  version = "2.52b";
 
   src = fetchurl {
     url    = "http://lcamtuf.coredump.cx/afl/releases/${name}.tgz";
-    sha256 = "15xvjma2lpawg1wasnja9wmgrpss5mnm3f5xmh5yli5q6m5vjdfl";
+    sha256 = "0ig0ij4n1pwry5dw1hk4q88801jzzy2cric6y2gd6560j55lnqa3";
   };
 
   # Note: libcgroup isn't needed for building, just for the afl-cgroup
@@ -58,6 +58,10 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru = {
+    qemu = afl-qemu;
+  };
+
   meta = {
     description = "Powerful fuzzer via genetic algorithms and instrumentation";
     longDescription = ''
diff --git a/pkgs/tools/security/afl/qemu-patches/qemu-2.3.0-glibc-2.26.patch b/pkgs/tools/security/afl/qemu-patches/qemu-2.3.0-glibc-2.26.patch
new file mode 100644
index 00000000000..1c447c4051e
--- /dev/null
+++ b/pkgs/tools/security/afl/qemu-patches/qemu-2.3.0-glibc-2.26.patch
@@ -0,0 +1,121 @@
+diff --git a/user-exec.c b/user-exec.c
+index 8f57e8a..957f9f7 100644
+--- a/user-exec.c
++++ b/user-exec.c
+@@ -57,7 +57,7 @@ static void exception_action(CPUState *cpu)
+ void cpu_resume_from_signal(CPUState *cpu, void *puc)
+ {
+ #ifdef __linux__
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+ #elif defined(__OpenBSD__)
+     struct sigcontext *uc = puc;
+ #endif
+@@ -171,7 +171,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+ #elif defined(__OpenBSD__)
+     struct sigcontext *uc = puc;
+ #else
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+ #endif
+     unsigned long pc;
+     int trapno;
+@@ -226,7 +226,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+ #elif defined(__OpenBSD__)
+     struct sigcontext *uc = puc;
+ #else
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+ #endif
+ 
+     pc = PC_sig(uc);
+@@ -288,7 +288,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+ 
+ #ifdef __APPLE__
+ #include <sys/ucontext.h>
+-typedef struct ucontext SIGCONTEXT;
++typedef ucontext_t SIGCONTEXT;
+ /* All Registers access - only for local access */
+ #define REG_sig(reg_name, context)              \
+     ((context)->uc_mcontext->ss.reg_name)
+@@ -331,7 +331,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+ #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
+     ucontext_t *uc = puc;
+ #else
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+ #endif
+     unsigned long pc;
+     int is_write;
+@@ -358,7 +358,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+                            void *puc)
+ {
+     siginfo_t *info = pinfo;
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+     uint32_t *pc = uc->uc_mcontext.sc_pc;
+     uint32_t insn = *pc;
+     int is_write = 0;
+@@ -456,7 +456,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+ #if defined(__NetBSD__)
+     ucontext_t *uc = puc;
+ #else
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+ #endif
+     unsigned long pc;
+     int is_write;
+@@ -483,7 +483,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+ int cpu_signal_handler(int host_signum, void *pinfo, void *puc)
+ {
+     siginfo_t *info = pinfo;
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+     uintptr_t pc = uc->uc_mcontext.pc;
+     uint32_t insn = *(uint32_t *)pc;
+     bool is_write;
+@@ -512,7 +512,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+                        void *puc)
+ {
+     siginfo_t *info = pinfo;
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+     unsigned long pc;
+     int is_write;
+ 
+@@ -534,7 +534,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+ int cpu_signal_handler(int host_signum, void *pinfo, void *puc)
+ {
+     siginfo_t *info = pinfo;
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+     unsigned long ip;
+     int is_write = 0;
+ 
+@@ -565,7 +565,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+                        void *puc)
+ {
+     siginfo_t *info = pinfo;
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+     unsigned long pc;
+     uint16_t *pinsn;
+     int is_write = 0;
+@@ -618,7 +618,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+                        void *puc)
+ {
+     siginfo_t *info = pinfo;
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+     greg_t pc = uc->uc_mcontext.pc;
+     int is_write;
+ 
+@@ -634,7 +634,7 @@ int cpu_signal_handler(int host_signum, void *pinfo,
+                        void *puc)
+ {
+     siginfo_t *info = pinfo;
+-    struct ucontext *uc = puc;
++    ucontext_t *uc = puc;
+     unsigned long pc = uc->uc_mcontext.sc_iaoq[0];
+     uint32_t insn = *(uint32_t *)pc;
+     int is_write = 0;
diff --git a/pkgs/tools/security/afl/qemu.nix b/pkgs/tools/security/afl/qemu.nix
index 0e91e287123..d21500960fe 100644
--- a/pkgs/tools/security/afl/qemu.nix
+++ b/pkgs/tools/security/afl/qemu.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
       ./qemu-patches/no-etc-install.patch
       ./qemu-patches/translate-all.patch
       ./qemu-patches/syscall.patch
+      ./qemu-patches/qemu-2.3.0-glibc-2.26.patch
     ];
 
   preConfigure = ''
diff --git a/pkgs/tools/virtualization/nixos-container/nixos-container.pl b/pkgs/tools/virtualization/nixos-container/nixos-container.pl
index 207177133a5..fefdcd614a5 100755
--- a/pkgs/tools/virtualization/nixos-container/nixos-container.pl
+++ b/pkgs/tools/virtualization/nixos-container/nixos-container.pl
@@ -331,7 +331,7 @@ elsif ($action eq "run") {
 
 elsif ($action eq "show-ip") {
     my $s = read_file($confFile) or die;
-    $s =~ /^LOCAL_ADDRESS=([0-9\.]+)$/m or die "$0: cannot get IP address\n";
+    $s =~ /^LOCAL_ADDRESS=([0-9\.]+)(\/[0-9]+)?$/m or die "$0: cannot get IP address\n";
     print "$1\n";
 }
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4e70061eb03..1f47193e4c3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1408,7 +1408,6 @@ with pkgs;
   cksfv = callPackage ../tools/networking/cksfv { };
 
   clementine = callPackage ../applications/audio/clementine {
-    boost = boost155;
     gst_plugins =
       with gst_all_1; [ gst-plugins-base gst-plugins-good gst-plugins-ugly gst-libav ];
   };
@@ -2364,6 +2363,7 @@ with pkgs;
   google-authenticator = callPackage ../os-specific/linux/google-authenticator { };
 
   google-cloud-sdk = python2.pkgs.google-cloud-sdk;
+  google-cloud-sdk-gce = python2.pkgs.google-cloud-sdk-gce;
 
   google-fonts = callPackage ../data/fonts/google-fonts { };
 
@@ -2796,7 +2796,9 @@ with pkgs;
 
   jaaa = callPackage ../applications/audio/jaaa { };
 
-  jackett = callPackage ../servers/jackett { };
+  jackett = callPackage ../servers/jackett {
+    mono = mono50;
+  };
 
   jade = callPackage ../tools/text/sgml/jade { };
 
@@ -4860,6 +4862,8 @@ with pkgs;
 
   vboot_reference = callPackage ../tools/system/vboot_reference { };
 
+  vcftools = callPackage ../applications/science/biology/vcftools { };
+
   vcsh = callPackage ../applications/version-management/vcsh {
     inherit (perlPackages) ShellCommand TestMost;
   };
@@ -5831,9 +5835,7 @@ with pkgs;
   haxePackages = recurseIntoAttrs (callPackage ./haxe-packages.nix { });
   inherit (haxePackages) hxcpp;
 
-  hhvm = callPackage ../development/compilers/hhvm {
-    boost = boost160;
-  };
+  hhvm = callPackage ../development/compilers/hhvm { };
 
   hop = callPackage ../development/compilers/hop { };
 
@@ -6251,13 +6253,9 @@ with pkgs;
         inherit rust;
       };
 
-      rustcSrc = stdenv.mkDerivation {
-        name = "rust-src";
-        src = rust.rustc.src;
-        phases = ["unpackPhase" "installPhase"];
-        installPhase = "mv src $out";
+      rustcSrc = callPackage ../development/compilers/rust/rust-src.nix {
+        inherit (rust) rustc;
       };
-
     });
 
   cargo-edit = callPackage ../tools/package-management/cargo-edit { };
@@ -7865,8 +7863,6 @@ with pkgs;
 
   box2d = callPackage ../development/libraries/box2d { };
 
-  breakpad = callPackage ../development/libraries/breakpad { };
-
   buddy = callPackage ../development/libraries/buddy { };
 
   bwidget = callPackage ../development/libraries/bwidget { };
@@ -11475,9 +11471,7 @@ with pkgs;
 
   charybdis = callPackage ../servers/irc/charybdis {};
 
-  clickhouse = callPackage ../servers/clickhouse {
-    boost = boost160;
-  };
+  clickhouse = callPackage ../servers/clickhouse { };
 
   couchdb = callPackage ../servers/http/couchdb {
     spidermonkey = spidermonkey_1_8_5;
@@ -14811,9 +14805,7 @@ with pkgs;
 
   fomp = callPackage ../applications/audio/fomp { };
 
-  freecad = callPackage ../applications/graphics/freecad {
-    boost = boost155;
-  };
+  freecad = callPackage ../applications/graphics/freecad { };
 
   freemind = callPackage ../applications/misc/freemind { };
 
@@ -15332,7 +15324,6 @@ with pkgs;
 
   k3d = callPackage ../applications/graphics/k3d {
     inherit (pkgs.gnome2) gtkglext;
-    boost = boost155;
   };
 
   k9copy = libsForQt5.callPackage ../applications/video/k9copy {};
@@ -16258,7 +16249,6 @@ with pkgs;
   pythonmagick = callPackage ../applications/graphics/PythonMagick { };
 
   qbittorrent = libsForQt5.callPackage ../applications/networking/p2p/qbittorrent {
-    boost = boost;
     libtorrentRasterbar = libtorrentRasterbar_1_0;
   };
 
@@ -16511,9 +16501,7 @@ with pkgs;
 
   sbagen = callPackage ../applications/misc/sbagen { };
 
-  scantailor = callPackage ../applications/graphics/scantailor {
-    boost = boost155;
-  };
+  scantailor = callPackage ../applications/graphics/scantailor { };
 
   sc-im = callPackage ../applications/misc/sc-im { };
 
@@ -17641,9 +17629,7 @@ with pkgs;
 
   zoom-us = callPackage ../applications/networking/instant-messengers/zoom-us { };
 
-  zotero = callPackage ../applications/office/zotero {
-    firefox = firefox-esr-unwrapped;
-  };
+  zotero = callPackage ../applications/office/zotero { };
 
   zscroll = callPackage ../applications/misc/zscroll {};
 
diff --git a/pkgs/top-level/emacs-packages.nix b/pkgs/top-level/emacs-packages.nix
index a01dc2b74ad..3acc6d0ebec 100644
--- a/pkgs/top-level/emacs-packages.nix
+++ b/pkgs/top-level/emacs-packages.nix
@@ -75,24 +75,14 @@ let
 
   ## START HERE
 
-  tablist = melpaBuild rec {
-    pname = "tablist";
-    inherit (pdf-tools) src version;
-    fileSpecs = [ "lisp/tablist.el" "lisp/tablist-filter.el" ];
-    meta = {
-      description = "Extended tabulated-list-mode";
-      license = gpl3;
-    };
-  };
-
   pdf-tools = melpaBuild rec {
     pname = "pdf-tools";
-    version = "0.70";
+    version = "0.80";
     src = fetchFromGitHub {
       owner = "politza";
       repo = "pdf-tools";
       rev = "v${version}";
-      sha256 = "19sy49r3ijh36m7hl4vspw5c4i8pnfqdn4ldm2sqchxigkw56ayl";
+      sha256 = "1i4647vax5na73basc5dz4lh9kprir00fh8ps4i0l1y3ippnjs2s";
     };
     nativeBuildInputs = [ external.pkgconfig ];
     buildInputs = with external; [ autoconf automake libpng zlib poppler ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 30433a509f4..6606dee344d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5445,6 +5445,7 @@ in {
   };
 
   google-cloud-sdk = callPackage ../tools/admin/google-cloud-sdk { };
+  google-cloud-sdk-gce = callPackage ../tools/admin/google-cloud-sdk { with-gce=true; };
 
   google-compute-engine = callPackage ../tools/virtualization/google-compute-engine { };
 
@@ -8030,11 +8031,12 @@ in {
 
   hg-git = buildPythonPackage rec {
     name = "hg-git-${version}";
-    version = "0.8.5";
+    version = "0.8.10";
+    disabled = isPy3k;
 
     src = pkgs.fetchurl {
       url = "mirror://pypi/h/hg-git/${name}.tar.gz";
-      sha256 = "10j7l1p2wx7s5nb6s35z1f3mcz2svz9ilcm26f3la9h9c76b7jpm";
+      sha256 = "03dzcs4l7hzq59sgjhngxgmi34xfyd7jcxyjl0f68rwq8b1yqrp3";
     };
 
     propagatedBuildInputs = with self; [ dulwich ];