diff --git a/pkgs/applications/networking/browsers/chromium/browser.nix b/pkgs/applications/networking/browsers/chromium/browser.nix
index 41617d0182a..a0bdc70f9f5 100644
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@@ -12,9 +12,8 @@ mkChromiumDerivation (base: rec {
     cp -v "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
     cp -v "$buildPath/icudtl.dat" "$libExecPath/"
     cp -vLR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
-    cp -v "$buildPath/libffmpegsumo.so" "$libExecPath/"
-    ${optionalString (versionOlder base.version "42.0.0.0") ''
-      cp -v "$buildPath/libpdf.so" "$libExecPath/"
+    ${optionalString (versionOlder base.version "45.0.0.0") ''
+      cp -v "$buildPath/libffmpegsumo.so" "$libExecPath/"
     ''}
     cp -v "$buildPath/chrome" "$libExecPath/$packageName"
 
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index d3a0c86daf4..714058d81e0 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -21,6 +21,7 @@
 # package customization
 , enableSELinux ? false, libselinux ? null
 , enableNaCl ? false
+, enableHotwording ? false
 , useOpenSSL ? false, nss ? null, openssl ? null
 , gnomeSupport ? false, gnome ? null
 , gnomeKeyringSupport ? false, libgnome_keyring3 ? null
@@ -130,11 +131,7 @@ let
       chmod -R u+w third_party
     '';
 
-    postPatch = optionalString (versionOlder version "42.0.0.0") ''
-      sed -i -e '/base::FilePath exe_dir/,/^ *} *$/c \
-        sandbox_binary = base::FilePath(getenv("CHROMIUM_SANDBOX_BINARY_PATH"));
-      ' sandbox/linux/suid/client/setuid_sandbox_client.cc
-    '' + ''
+    postPatch = ''
       sed -i -e '/module_path *=.*libexif.so/ {
         s|= [^;]*|= base::FilePath().AppendASCII("${libexif}/lib/libexif.so")|
       }' chrome/utility/media_galleries/image_metadata_extractor.cc
@@ -158,11 +155,10 @@ let
       use_pulseaudio = pulseSupport;
       linux_link_pulseaudio = pulseSupport;
       disable_nacl = !enableNaCl;
+      enable_hotwording = enableHotwording;
       use_openssl = useOpenSSL;
       selinux = enableSELinux;
       use_cups = cupsSupport;
-    } // optionalAttrs (versionOlder version "42.0.0.0") {
-      linux_sandbox_chrome_path="${libExecPath}/${packageName}";
     } // {
       werror = "";
       clang = false;
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 85b2e9b8051..7a355cbf59a 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -4,6 +4,7 @@
 , channel ? "stable"
 , enableSELinux ? false
 , enableNaCl ? false
+, enableHotwording ? false
 , useOpenSSL ? false
 , gnomeSupport ? false
 , gnomeKeyringSupport ? false
@@ -26,9 +27,9 @@ let
     };
 
     mkChromiumDerivation = callPackage ./common.nix {
-      inherit enableSELinux enableNaCl useOpenSSL gnomeSupport
-              gnomeKeyringSupport proprietaryCodecs cupsSupport
-              pulseSupport hiDPISupport;
+      inherit enableSELinux enableNaCl enableHotwording useOpenSSL gnomeSupport
+              gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport
+              hiDPISupport;
     };
 
     browser = callPackage ./browser.nix { };
@@ -73,15 +74,12 @@ in stdenv.mkDerivation {
     sandboxBinary = "${chromium.sandbox}/bin/chromium-sandbox";
     mkEnvVar = key: val: "--set '${key}' '${val}'";
     envVars = chromium.plugins.settings.envVars or {};
-    isVer42 = !stdenv.lib.versionOlder chromium.browser.version "42.0.0.0";
     flags = chromium.plugins.settings.flags or [];
-    setBinPath = "--set CHROMIUM_SANDBOX_BINARY_PATH \"${sandboxBinary}\"";
   in with stdenv.lib; ''
     mkdir -p "$out/bin" "$out/share/applications"
 
     ln -s "${chromium.browser}/share" "$out/share"
     makeWrapper "${browserBinary}" "$out/bin/chromium" \
-      ${optionalString (!isVer42) setBinPath} \
       ${concatStrings (mapAttrsToList mkEnvVar envVars)} \
       --add-flags "${concatStringsSep " " flags}"
 
diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index b4766cee434..5bb6a93d8d7 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -21,10 +21,9 @@ let
       chan = if source.channel == "dev"    then "chrome-unstable"
         else if source.channel == "stable" then "chrome"
         else "chrome-${source.channel}";
-      cext = if versionOlder source.version "41.0.0.0" then "lzma" else "xz";
     in ''
       mkdir -p plugins
-      ar p "$src" data.tar.${cext} | tar xJ -C plugins --strip-components=4 \
+      ar p "$src" data.tar.xz | tar xJ -C plugins --strip-components=4 \
         ./opt/google/${chan}/PepperFlash \
         ./opt/google/${chan}/libwidevinecdm.so \
         ./opt/google/${chan}/libwidevinecdmadapter.so
diff --git a/pkgs/applications/networking/browsers/chromium/source/default.nix b/pkgs/applications/networking/browsers/chromium/source/default.nix
index a3a46631484..f9c5c6e0265 100644
--- a/pkgs/applications/networking/browsers/chromium/source/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, python
+{ stdenv, fetchurl, fetchpatch, patchutils, python
 , channel ? "stable"
 , useOpenSSL # XXX
 }:
@@ -19,6 +19,7 @@ let
   ]);
 
   pre44 = versionOlder version "44.0.0.0";
+  is44 = versionOlder version "45.0.0.0" && !pre44;
 
 in stdenv.mkDerivation {
   name = "chromium-source-${version}";
@@ -47,11 +48,39 @@ in stdenv.mkDerivation {
     done
   '';
 
-  patches = if pre44 then [
-    ./nix_plugin_paths_42.patch
-  ] else [
-    ./nix_plugin_paths_44.patch
-  ];
+  patches = let
+    baseURL = "https://codereview.chromium.org/download";
+
+    mkBlinkFix = issue: sha256: fetchpatch {
+      url = "${baseURL}/issue${issue}.diff";
+      inherit sha256;
+      postFetch = ''
+        sed -i -e 's,^\(---\|+++\) *[ab]/,&third_party/WebKit/,' "$out"
+      '';
+    };
+
+    fixes44 = [
+      # WebPluginContainer::setNeedsLayout
+      # https://codereview.chromium.org/1157943002/
+      (mkBlinkFix "1157943002_20001"
+                  "0932yd15zlh2g5a5bbm6qrnfvv22jlfdg8pj0w9z58m5zdzw1p82")
+      # WebRuntimeFeatures::enablePermissionsAPI
+      # https://codereview.chromium.org/1156113007/
+      (mkBlinkFix "1156113007_1"
+                  "1v76brrgdziv1q62ba4bimg0my2dmnkyl68b21nv2vw661v0hzwh")
+      # Revert of https://codereview.chromium.org/1150543002/
+      (fetchpatch {
+        url = "${baseURL}/issue1150543002_1.diff";
+        sha256 = "0x9sya0m1zcb2vcp2vfss88qqdrh6bzcbx2ngfiql7rkbynnpqn6";
+        postFetch = ''
+          ${patchutils}/bin/interdiff "$out" /dev/null > reversed.patch
+          mv reversed.patch "$out"
+        '';
+      })
+    ];
+    pluginPaths = if pre44 then singleton ./nix_plugin_paths_42.patch
+                  else singleton ./nix_plugin_paths_44.patch;
+  in pluginPaths ++ optionals is44 fixes44;
 
   patchPhase = let
     diffmod = sym: "/^${sym} /{s/^${sym} //;${transform ""};s/^/${sym} /}";
diff --git a/pkgs/applications/networking/browsers/chromium/source/sources.nix b/pkgs/applications/networking/browsers/chromium/source/sources.nix
index 3adbbab8392..2ffb8c970e4 100644
--- a/pkgs/applications/networking/browsers/chromium/source/sources.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/sources.nix
@@ -1,21 +1,21 @@
 # This file is autogenerated from update.sh in the parent directory.
 {
   dev = {
-    version = "45.0.2421.0";
-    sha256 = "1qc80y0mhwnvxrvpc3csskgb536wq34c0fgk19h1qb4xc62lxhsk";
-    sha256bin32 = "1xqhyrlmh00md6i1q4wr0xihqbvcpshzscnjclrn53dlw5zs2s89";
-    sha256bin64 = "0akdhwwdfcbqfh65a82zigbhsi8sbhhw6904cjprb3bmv4l3c598";
+    version = "45.0.2431.0";
+    sha256 = "0irlrym8r1wa6zb5bg4paxy3h5fg300k5c9vkj3xmhdp567clfja";
+    sha256bin32 = "1lfrd7x7cav5mr7pg0a3d4a9dyy6f0rklarprfrcvqwipjkddb3f";
+    sha256bin64 = "1jzmkgiqn17ynbv0xljiifvlj1136jq98zrkd4hdmkgv8xrrzd74";
   };
   beta = {
-    version = "44.0.2403.39";
-    sha256 = "15c4adg0r9ym3pxya7vv4d148gv2pdwaaymxvvw511fjwffdv71n";
-    sha256bin32 = "1gaypkah10y31gb5f7vnyv0v73z5zjznmsp6vh2m4hfajx7s55jn";
-    sha256bin64 = "1j1ma6asl3ibjv3apyw24vhyi1qy64f586w8jizqzp4h962gj95c";
+    version = "44.0.2403.52";
+    sha256 = "0zgcqbxm2slxpj6i50w7r3xxql1k6kgd51qn8w8gwfzhmad4zxyx";
+    sha256bin32 = "1kfgl2l7j5fhj6wg4i3bsany2rlwspprypdy0z7k3pqiwwyiw658";
+    sha256bin64 = "1sabqqh1hii7appmx6xwabnapf4cv7smsy31nvz063fa5p6h21m8";
   };
   stable = {
-    version = "43.0.2357.124";
-    sha256 = "09m8bb5f17mx6cd3h5irslw07h2s0drda35v17vcr7qfhk8jdh92";
-    sha256bin32 = "15n2fla1ixrqzi0in0vyl8n5wkv20fpd96lff65rwr9diylz287p";
-    sha256bin64 = "0x6igpcf29zmwqgphvy9nm527k9g7na2cvgc5nimw4fs5dakzzjr";
+    version = "43.0.2357.125";
+    sha256 = "01alba50zrc50bn4p3f298khk8fam2rv5wyysz7rq3zrjg8785xg";
+    sha256bin32 = "0527bdlf4nd4b1ydmwn6rnxy377388qb98v9anicfd4bc2p9jjml";
+    sha256bin64 = "0yhgcjaxcpgk32l1sjrgkq447ywcj156a7372v87m22dcwl8fi01";
   };
 }
diff --git a/pkgs/build-support/fetchpatch/default.nix b/pkgs/build-support/fetchpatch/default.nix
index 29ff5c31e45..60785f42b54 100644
--- a/pkgs/build-support/fetchpatch/default.nix
+++ b/pkgs/build-support/fetchpatch/default.nix
@@ -18,5 +18,6 @@ fetchurl ({
         --strip=${toString stripLen} \
         --clean "$out" > "$tmpfile"
     mv "$tmpfile" "$out"
+    ${args.postFetch or ""}
   '';
 } // builtins.removeAttrs args ["stripLen"])
diff --git a/pkgs/servers/nosql/cassandra/2.0.nix b/pkgs/servers/nosql/cassandra/2.0.nix
index 4f27452a065..e3ed35241fa 100644
--- a/pkgs/servers/nosql/cassandra/2.0.nix
+++ b/pkgs/servers/nosql/cassandra/2.0.nix
@@ -10,8 +10,8 @@
 
 let
 
-  version = "2.0.15";
-  sha256 = "00rxmf8il9w1fmfpxfy9gbhbvgid5h8d80g3ljw25jscr00lcyh0";
+  version = "2.0.16";
+  sha256 = "1fpvgmakmxy1lnygccpc32q53pa36bwy0lqdvb6hsifkxymdw8y5";
 
 in
 
diff --git a/pkgs/servers/nosql/cassandra/2.1.nix b/pkgs/servers/nosql/cassandra/2.1.nix
index 94f920ffe11..2f8cb84117a 100644
--- a/pkgs/servers/nosql/cassandra/2.1.nix
+++ b/pkgs/servers/nosql/cassandra/2.1.nix
@@ -10,8 +10,8 @@
 
 let
 
-  version = "2.1.6";
-  sha256 = "1xq96h33f4xmld114mrd57z396f9ykcj0xy50fnnhy5mhafkn4n2";
+  version = "2.1.7";
+  sha256 = "12chnxcl9zg20d0l4rlzp13cnxvdqr8bx3bbvwbcpnh7ir5s7ldd";
 
 in
 
diff --git a/pkgs/servers/sql/mysql/5.5.x.nix b/pkgs/servers/sql/mysql/5.5.x.nix
index 8469ae4e948..0a95db91d87 100644
--- a/pkgs/servers/sql/mysql/5.5.x.nix
+++ b/pkgs/servers/sql/mysql/5.5.x.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "mysql-${version}";
-  version = "5.5.43";
+  version = "5.5.44";
 
   src = fetchurl {
     url = "http://mysql.mirrors.pair.com/Downloads/MySQL-5.5/${name}.tar.gz";
-    sha256 = "1kbl8xp6xi9yclc4q0q97s89rr498mm0avpbkmsa4ff8wmwxzls3";
+    sha256 = "1pp5ngm4ibnp8xnn9haz1db0favd1i7cxdgl5z4677mkgljmpw45";
   };
 
   patches = if stdenv.isCygwin then [