9 files changed, 38 insertions, 18 deletions
diff --git a/pkgs/applications/version-management/git-up/default.nix b/pkgs/applications/version-management/git-up/default.nix
index 4b6ba9398b4..45c97868c4b 100644
--- a/pkgs/applications/version-management/git-up/default.nix
+++ b/pkgs/applications/version-management/git-up/default.nix
@@ -31,5 +31,6 @@ python2Packages.buildPythonApplication rec {
     license = licenses.mit;
     maintainers = with maintainers; [ peterhoeg ];
     platforms = platforms.all;
+    broken = true; # Incompatible with Git 2.15 object store.
   };
 }
diff --git a/pkgs/applications/video/kodi/plugins.nix b/pkgs/applications/video/kodi/plugins.nix
index e98500f8e76..52c39e837a1 100644
--- a/pkgs/applications/video/kodi/plugins.nix
+++ b/pkgs/applications/video/kodi/plugins.nix
@@ -149,14 +149,14 @@ rec {
 
   joystick = mkKodiABIPlugin rec {
     namespace = "peripheral.joystick";
-    version = "1.3.6";
+    version = "1.3.2";
     plugin = namespace;
 
     src = fetchFromGitHub {
       owner = "kodi-game";
       repo = namespace;
-      rev = "5b480ccdd4a87f2ca3283a7b8d1bd69a114af0db";
-      sha256 = "1zf5zwghx96bqk7bx53qra27lfbgfdi1dsk4s3hwixr8ii72cqpp";
+      rev = "96171dd32899553ffe8fc775fca66e8df5ff5cf1";
+      sha256 = "18m61v8z9fbh4imvzhh4g9629r9df49g2yk9ycaczirg131dhfbh";
     };
 
     meta = with stdenv.lib; {
diff --git a/pkgs/applications/window-managers/awesome/default.nix b/pkgs/applications/window-managers/awesome/default.nix
index ec73150a506..4043c05e3d6 100644
--- a/pkgs/applications/window-managers/awesome/default.nix
+++ b/pkgs/applications/window-managers/awesome/default.nix
@@ -10,7 +10,7 @@
 with luaPackages; stdenv.mkDerivation rec {
   name = "awesome-${version}";
   version = "4.2";
-  
+
   src = fetchFromGitHub {
     owner = "awesomewm";
     repo = "awesome";
@@ -25,10 +25,10 @@ with luaPackages; stdenv.mkDerivation rec {
     imagemagick
     makeWrapper
     pkgconfig
-    xmlto docbook_xml_dtd_45 
+    xmlto docbook_xml_dtd_45
     docbook_xsl findXMLCatalogs
   ];
-   
+
   propagatedUserEnvPkgs = [ hicolor_icon_theme ];
   buildInputs = [ cairo librsvg dbus gdk_pixbuf gobjectIntrospection
                   git lgi libpthreadstubs libstartup_notification
@@ -49,8 +49,8 @@ with luaPackages; stdenv.mkDerivation rec {
   postInstall = ''
     wrapProgram $out/bin/awesome \
       --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
-      --prefix LUA_CPATH ";" '"${lgi}/lib/lua/${lua.luaversion}/?.so"' \
-      --prefix LUA_PATH ";" '"${lgi}/share/lua/${lua.luaversion}/?.lua;${lgi}/share/lua/${lua.luaversion}/lgi/?.lua"' \
+      --prefix LUA_CPATH ";" '${lgi}/lib/lua/${lua.luaversion}/?.so' \
+      --prefix LUA_PATH ";" '${lgi}/share/lua/${lua.luaversion}/?.lua' \
       --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
       --prefix LD_LIBRARY_PATH : "$LD_LIBRARY_PATH" \
       --prefix PATH : "${stdenv.lib.makeBinPath [ compton unclutter procps iproute coreutils curl alsaUtils findutils xterm ]}"
diff --git a/pkgs/development/compilers/reason/default.nix b/pkgs/development/compilers/reason/default.nix
index f3ae4036a2a..54d39d8fa63 100644
--- a/pkgs/development/compilers/reason/default.nix
+++ b/pkgs/development/compilers/reason/default.nix
@@ -3,13 +3,13 @@
 
 buildOcaml rec {
   name = "reason";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "reason";
-    rev = "v${version}";
-    sha256 = "1rpaazy0m76qidxwdr51qrgs3ryyz875rndwp9p30siqd04raswq";
+    rev = version;
+    sha256 = "19kp1cnxi6dq89xh07c14q7kzkawbxdkwrvn1rl48l78d04agnxx";
   };
 
   propagatedBuildInputs = [ menhir merlin_extend ppx_tools_versioned ];
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
index c56e2e804f8..d131fc13ced 100644
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, perl, texinfo, yasm
+{ stdenv, fetchurl, fetchpatch, pkgconfig, perl, texinfo, yasm
 , hostPlatform
 /*
  *  Licensing options (yes some are listed twice, filters and such are not listed)
@@ -238,7 +238,16 @@ stdenv.mkDerivation rec {
     sha256 = "1vzvpx8ixy8m44f8qwp833hv253hpghybgzbc4n8b3div3j0dvmf";
   };
 
-  patchPhase = ''patchShebangs .
+  patches = [
+    (fetchurl {
+      name = "CVE-2017-16840.patch";
+      url = "http://git.videolan.org/?p=ffmpeg.git;a=patch;h=a94cb36ab2ad99d3a1331c9f91831ef593d94f74";
+      sha256 = "0zx0vh110hrykk7j863j04bx6igm2q8dlkv25mf5g4rbxafpqig3";
+    })
+  ];
+
+  prePatch = ''
+    patchShebangs .
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
     sed -i 's/#ifndef __MAC_10_11/#if 1/' ./libavcodec/audiotoolboxdec.c
   '' + stdenv.lib.optionalString (frei0r != null) ''
diff --git a/pkgs/development/libraries/ffmpeg/3.4.nix b/pkgs/development/libraries/ffmpeg/3.4.nix
index 513654e98f7..9890d030e44 100644
--- a/pkgs/development/libraries/ffmpeg/3.4.nix
+++ b/pkgs/development/libraries/ffmpeg/3.4.nix
@@ -1,4 +1,4 @@
-{ stdenv, callPackage
+{ stdenv, callPackage, fetchpatch
 # Darwin frameworks
 , Cocoa, CoreMedia
 , ...
@@ -9,4 +9,13 @@ callPackage ./generic.nix (args // rec {
   branch = "3.4";
   sha256 = "0pn8g3ab937ahslqd41crk0g4j4fh7kwimsrlfc0rl0pc3z132ax";
   darwinFrameworks = [ Cocoa CoreMedia ];
+
+  patches = [
+    (fetchpatch{
+      name = "CVE-2017-16840.patch";
+      url = "http://git.videolan.org/?p=ffmpeg.git;a=patch;h=a94cb36ab2ad99d3a1331c9f91831ef593d94f74";
+      sha256 = "1rjr9lc71cyy43wsa2zxb9ygya292h9jflvr5wk61nf0vp97gjg3";
+    })
+  ];
+
 })
diff --git a/pkgs/development/libraries/gnutls/3.5.10.nix b/pkgs/development/libraries/gnutls/3.5.10.nix
index a1eab1a84c1..a44e2b04ed7 100644
--- a/pkgs/development/libraries/gnutls/3.5.10.nix
+++ b/pkgs/development/libraries/gnutls/3.5.10.nix
@@ -4,7 +4,7 @@ callPackage ./generic.nix (args // rec {
   version = "3.5.10";
 
   src = fetchurl {
-    url = "ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-${version}.tar.xz";
+    url = "mirror://gnupg/gnutls/v3.5/gnutls-${version}.tar.xz";
     sha256 = "17apwvdkkazh5w8z8mbanpj2yj8s2002qwy46wz4v3akpa33wi5g";
   };
 })
diff --git a/pkgs/development/libraries/gnutls/3.6.nix b/pkgs/development/libraries/gnutls/3.6.nix
index 8b6090f3407..9dc6d5389d9 100644
--- a/pkgs/development/libraries/gnutls/3.6.nix
+++ b/pkgs/development/libraries/gnutls/3.6.nix
@@ -4,7 +4,7 @@ callPackage ./generic.nix (args // rec {
   version = "3.6.1";
 
   src = fetchurl {
-    url = "http://www.gnupg.org/ftp/gcrypt/gnutls/v3.6/gnutls-${version}.tar.xz";
+    url = "mirror://gnupg/gnutls/v3.6/gnutls-${version}.tar.xz";
     sha256 = "1vdsir53ddxyapnxh5fpnfyij3scx3818iri4hl07g4lk4n0vc90";
   };
 
diff --git a/pkgs/tools/networking/snabb/default.nix b/pkgs/tools/networking/snabb/default.nix
index 3b405561ef9..f3baddd2653 100644
--- a/pkgs/tools/networking/snabb/default.nix
+++ b/pkgs/tools/networking/snabb/default.nix
@@ -31,7 +31,9 @@ stdenv.mkDerivation rec {
     cp src/snabb $out/bin
   '';
 
-  enableParallelBuilding = true;
+  # Dependencies are underspecified: "make -C src obj/arch/sse2_c.o" fails with
+  # "Fatal error: can't create obj/arch/sse2_c.o: No such file or directory".
+  enableParallelBuilding = false;
 
   meta = with stdenv.lib; {
     homepage = https://github.com/SnabbCo/snabbswitch;
@@ -49,4 +51,3 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.lukego maintainers.domenkozar ];
   };
 }
-