diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index a5f20991425..08d6c8a8a71 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -389,8 +389,8 @@
   skeidel = "Sven Keidel <svenkeidel@gmail.com>";
   skrzyp = "Jakub Skrzypnik <jot.skrzyp@gmail.com>";
   sleexyz = "Sean Lee <freshdried@gmail.com>";
-  smironov = "Sergey Mironov <ierton@gmail.com>";
   solson = "Scott Olson <scott@solson.me>";
+  smironov = "Sergey Mironov <grrwlf@gmail.com>";
   spacefrogg = "Michael Raitza <spacefrogg-nixos@meterriblecrew.net>";
   spencerjanssen = "Spencer Janssen <spencerjanssen@gmail.com>";
   spinus = "Tomasz Czyż <tomasz.czyz@gmail.com>";
diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index 13668dfd8eb..40d49f1541b 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -94,14 +94,11 @@ let
     "--stringparam chunk.toc ${toc}"
   ];
 
-  olinkDB = stdenv.mkDerivation {
-    name = "manual-olinkdb";
-
-    inherit sources;
-
-    buildInputs = [ libxml2 libxslt ];
-
-    buildCommand = ''
+  olinkDB = runCommand "manual-olinkdb"
+    { inherit sources;
+      buildInputs = [ libxml2 libxslt ];
+    }
+    ''
       ${copySources}
 
       xsltproc \
@@ -133,15 +130,14 @@ let
       </targetset>
       EOF
     '';
-  };
 
 in rec {
 
   # The NixOS options in JSON format.
-  optionsJSON = stdenv.mkDerivation {
-    name = "options-json";
-
-    buildCommand = ''
+  optionsJSON = runCommand "options-json"
+    { meta.description = "List of NixOS options in JSON format";
+    }
+    ''
       # Export list of options in different format.
       dst=$out/share/doc/nixos
       mkdir -p $dst
@@ -154,18 +150,14 @@ in rec {
       echo "file json $dst/options.json" >> $out/nix-support/hydra-build-products
     ''; # */
 
-    meta.description = "List of NixOS options in JSON format";
-  };
-
   # Generate the NixOS manual.
-  manual = stdenv.mkDerivation {
-    name = "nixos-manual";
-
-    inherit sources;
-
-    buildInputs = [ libxml2 libxslt ];
-
-    buildCommand = ''
+  manual = runCommand "nixos-manual"
+    { inherit sources;
+      buildInputs = [ libxml2 libxslt ];
+      meta.description = "The NixOS manual in HTML format";
+      allowedReferences = ["out"];
+    }
+    ''
       ${copySources}
 
       # Check the validity of the manual sources.
@@ -192,20 +184,12 @@ in rec {
       echo "doc manual $dst" >> $out/nix-support/hydra-build-products
     ''; # */
 
-    meta.description = "The NixOS manual in HTML format";
 
-    allowedReferences = ["out"];
-  };
-
-
-  manualEpub = stdenv.mkDerivation {
-    name = "nixos-manual-epub";
-
-    inherit sources;
-
-    buildInputs = [ libxml2 libxslt zip ];
-
-    buildCommand = ''
+  manualEpub = runCommand "nixos-manual-epub"
+    { inherit sources;
+      buildInputs = [ libxml2 libxslt zip ];
+    }
+    ''
       ${copySources}
 
       # Check the validity of the manual sources.
@@ -234,17 +218,15 @@ in rec {
       mkdir -p $out/nix-support
       echo "doc-epub manual $manual" >> $out/nix-support/hydra-build-products
     '';
-  };
+
 
   # Generate the NixOS manpages.
-  manpages = stdenv.mkDerivation {
-    name = "nixos-manpages";
-
-    inherit sources;
-
-    buildInputs = [ libxml2 libxslt ];
-
-    buildCommand = ''
+  manpages = runCommand "nixos-manpages"
+    { inherit sources;
+      buildInputs = [ libxml2 libxslt ];
+      allowedReferences = ["out"];
+    }
+    ''
       ${copySources}
 
       # Check the validity of the man pages sources.
@@ -264,7 +246,4 @@ in rec {
         ./man-pages.xml
     '';
 
-    allowedReferences = ["out"];
-  };
-
 }
diff --git a/nixos/modules/i18n/input-method/default.nix b/nixos/modules/i18n/input-method/default.nix
index 693e1df66c6..7ed4a584d64 100644
--- a/nixos/modules/i18n/input-method/default.nix
+++ b/nixos/modules/i18n/input-method/default.nix
@@ -3,26 +3,27 @@
 with lib;
 let
   cfg = config.i18n.inputMethod;
-  gtk2_cache = pkgs.stdenv.mkDerivation {
-    preferLocalBuild = true; 
-    allowSubstitutes = false;
-    name = "gtk2-immodule.cache";
-    buildInputs = [ pkgs.gtk2 cfg.package ];
-    buildCommand = ''
+
+  gtk2_cache = pkgs.runCommand "gtk2-immodule.cache"
+    { preferLocalBuild = true;
+      allowSubstitutes = false;
+      buildInputs = [ pkgs.gtk2 cfg.package ];
+    }
+    ''
       mkdir -p $out/etc/gtk-2.0/
       GTK_PATH=${cfg.package}/lib/gtk-2.0/ gtk-query-immodules-2.0 > $out/etc/gtk-2.0/immodules.cache
     '';
-  };
-  gtk3_cache = pkgs.stdenv.mkDerivation {
-    preferLocalBuild = true; 
-    allowSubstitutes = false;
-    name = "gtk3-immodule.cache";
-    buildInputs = [ pkgs.gtk3 cfg.package ];
-    buildCommand = ''
+
+  gtk3_cache = pkgs.runCommand "gtk3-immodule.cache"
+    { preferLocalBuild = true;
+      allowSubstitutes = false;
+      buildInputs = [ pkgs.gtk3 cfg.package ];
+    }
+    ''
       mkdir -p $out/etc/gtk-3.0/
       GTK_PATH=${cfg.package}/lib/gtk-3.0/ gtk-query-immodules-3.0 > $out/etc/gtk-3.0/immodules.cache
     '';
-  };
+
 in
 {
   options.i18n = {
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix
index d14768bc107..dc8d76c63e1 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-kde.nix
@@ -96,15 +96,13 @@ with lib;
     '';
 
   in
-    pkgs.stdenv.mkDerivation {
-      inherit (pkg) name meta;
-
-      buildCommand = ''
+    pkgs.runCommand pkg.name
+      { inherit (pkg) meta; }
+      ''
         mkdir -p $out
         cp -prf ${pkg}/* $out/
         chmod a+w $out/share/apps/plasma-desktop/init
         cp -f ${plasmaInit} $out/share/apps/plasma-desktop/init/00-defaultLayout.js
       '';
-    };
 
 }
diff --git a/nixos/modules/programs/bash/bash.nix b/nixos/modules/programs/bash/bash.nix
index c09bcfb70e2..e23849d350b 100644
--- a/nixos/modules/programs/bash/bash.nix
+++ b/nixos/modules/programs/bash/bash.nix
@@ -16,7 +16,7 @@ let
     # programmable completion. If we do, enable all modules installed in
     # the system (and user profile).
     if shopt -q progcomp &>/dev/null; then
-      . "${pkgs.bashCompletion}/etc/profile.d/bash_completion.sh"
+      . "${pkgs.bash-completion}/etc/profile.d/bash_completion.sh"
       nullglobStatus=$(shopt -p nullglob)
       shopt -s nullglob
       for p in $NIX_PROFILES; do
diff --git a/nixos/modules/services/hardware/udev.nix b/nixos/modules/services/hardware/udev.nix
index 7c4c93d0fcb..14d65978c32 100644
--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@@ -32,13 +32,11 @@ let
   '';
 
   # Perform substitutions in all udev rules files.
-  udevRules = stdenv.mkDerivation {
-    name = "udev-rules";
-
-    preferLocalBuild = true;
-    allowSubstitutes = false;
-
-    buildCommand = ''
+  udevRules = pkgs.runCommand "udev-rules"
+    { preferLocalBuild = true;
+      allowSubstitutes = false;
+    }
+    ''
       mkdir -p $out
       shopt -s nullglob
       set +o pipefail
@@ -130,15 +128,12 @@ let
         ln -s /dev/null $out/80-drivers.rules
       ''}
     ''; # */
-  };
 
-  hwdbBin = stdenv.mkDerivation {
-    name = "hwdb.bin";
-
-    preferLocalBuild = true;
-    allowSubstitutes = false;
-
-    buildCommand = ''
+  hwdbBin = pkgs.runCommand "hwdb.bin"
+    { preferLocalBuild = true;
+      allowSubstitutes = false;
+    }
+    ''
       mkdir -p etc/udev/hwdb.d
       for i in ${toString ([udev] ++ cfg.packages)}; do
         echo "Adding hwdb files for package $i"
@@ -151,7 +146,6 @@ let
       ${udev}/bin/udevadm hwdb --update --root=$(pwd)
       mv etc/udev/hwdb.bin $out
     '';
-  };
 
   # Udev has a 512-character limit for ENV{PATH}, so create a symlink
   # tree to work around this.
diff --git a/nixos/modules/services/system/dbus.nix b/nixos/modules/services/system/dbus.nix
index 6c4833afbe8..0f20725a9e4 100644
--- a/nixos/modules/services/system/dbus.nix
+++ b/nixos/modules/services/system/dbus.nix
@@ -20,13 +20,11 @@ let
     "<includedir>${d}/etc/dbus-1/session.d</includedir>"
   ]));
 
-  configDir = pkgs.stdenv.mkDerivation {
-    name = "dbus-conf";
-
-    preferLocalBuild = true;
-    allowSubstitutes = false;
-
-    buildCommand = ''
+  configDir = pkgs.runCommand "dbus-conf"
+    { preferLocalBuild = true;
+      allowSubstitutes = false;
+    }
+    ''
       mkdir -p $out
 
       sed '${./dbus-system-local.conf.in}' \
@@ -38,7 +36,6 @@ let
         -e 's,@extra@,${sessionExtraxml},' \
         > "$out/session-local.conf"
     '';
-  };
 
 in
 
diff --git a/nixos/modules/services/web-servers/apache-httpd/moodle.nix b/nixos/modules/services/web-servers/apache-httpd/moodle.nix
index 87b1fba5aa1..aa00e89967d 100644
--- a/nixos/modules/services/web-servers/apache-httpd/moodle.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/moodle.nix
@@ -63,6 +63,10 @@ let
         cp -r * $out
         cp ${moodleConfig} $out/config.php
       '';
+    # Marked as broken due to needing an update for security issues.
+    # See: https://github.com/NixOS/nixpkgs/issues/18856
+    meta.broken = true;
+
   };
 
 in
diff --git a/nixos/modules/services/x11/desktop-managers/gnome3.nix b/nixos/modules/services/x11/desktop-managers/gnome3.nix
index b3da2544802..dc71531759b 100644
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@@ -25,9 +25,8 @@ let
     '';
   };
 
-  nixos-gsettings-desktop-schemas = pkgs.stdenv.mkDerivation {
-    name = "nixos-gsettings-desktop-schemas";
-    buildCommand = ''
+  nixos-gsettings-desktop-schemas = pkgs.runCommand "nixos-gsettings-desktop-schemas" {}
+    ''
      mkdir -p $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas
      cp -rf ${gnome3.gsettings_desktop_schemas}/share/gsettings-schemas/gsettings-desktop-schemas*/glib-2.0/schemas/*.xml $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas
 
@@ -46,7 +45,6 @@ let
 
      ${pkgs.glib.dev}/bin/glib-compile-schemas $out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas/
     '';
-  };
 
 in {
 
diff --git a/nixos/modules/services/x11/display-managers/kdm.nix b/nixos/modules/services/x11/display-managers/kdm.nix
index d9f7f8f0dfc..8b51c621e11 100644
--- a/nixos/modules/services/x11/display-managers/kdm.nix
+++ b/nixos/modules/services/x11/display-managers/kdm.nix
@@ -54,19 +54,17 @@ let
       ''}
     '';
 
-  kdmrc = pkgs.stdenv.mkDerivation {
-    name = "kdmrc";
-    config = defaultConfig + cfg.extraConfig;
-    preferLocalBuild = true;
-    buildCommand =
-      ''
-        echo "$config" > $out
+  kdmrc = pkgs.runCommand "kdmrc"
+    { config = defaultConfig + cfg.extraConfig;
+      preferLocalBuild = true;
+    }
+    ''
+      echo "$config" > $out
 
-        # The default kdmrc would add "-nolisten tcp", and we already
-        # have that managed by nixos. Hence the grep.
-        cat ${kdebase_workspace}/share/config/kdm/kdmrc | grep -v nolisten >> $out
-      '';
-  };
+      # The default kdmrc would add "-nolisten tcp", and we already
+      # have that managed by nixos. Hence the grep.
+      cat ${kdebase_workspace}/share/config/kdm/kdmrc | grep -v nolisten >> $out
+    '';
 
 in
 
diff --git a/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix b/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix
index 543dd628ce6..dfda90978b1 100644
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix
@@ -16,11 +16,9 @@ let
   # The default greeter provided with this expression is the GTK greeter.
   # Again, we need a few things in the environment for the greeter to run with
   # fonts/icons.
-  wrappedGtkGreeter = stdenv.mkDerivation {
-    name = "lightdm-gtk-greeter";
-    buildInputs = [ pkgs.makeWrapper ];
-
-    buildCommand = ''
+  wrappedGtkGreeter = pkgs.runCommand "lightdm-gtk-greeter"
+    { buildInputs = [ pkgs.makeWrapper ]; }
+    ''
       # This wrapper ensures that we actually get themes
       makeWrapper ${pkgs.lightdm_gtk_greeter}/sbin/lightdm-gtk-greeter \
         $out/greeter \
@@ -40,7 +38,6 @@ let
       Type=Application
       EOF
     '';
-  };
 
   gtkGreeterConf = writeText "lightdm-gtk-greeter.conf"
     ''
diff --git a/nixos/modules/services/x11/display-managers/slim.nix b/nixos/modules/services/x11/display-managers/slim.nix
index ce44c9f54a3..ca2ae1a4772 100644
--- a/nixos/modules/services/x11/display-managers/slim.nix
+++ b/nixos/modules/services/x11/display-managers/slim.nix
@@ -26,15 +26,13 @@ let
   # Unpack the SLiM theme, or use the default.
   slimThemesDir =
     let
-      unpackedTheme = pkgs.stdenv.mkDerivation {
-        name = "slim-theme";
-        buildCommand = ''
+      unpackedTheme = pkgs.runCommand "slim-theme" {}
+        ''
           mkdir -p $out
           cd $out
           unpackFile ${cfg.theme}
           ln -s * default
         '';
-      };
     in if cfg.theme == null then "${pkgs.slim}/share/slim/themes" else unpackedTheme;
 
 in
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 6c6a1e79ed0..1bd578424ee 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -71,15 +71,11 @@ let
     monitors = reverseList (foldl mkMonitor [] xrandrHeads);
   in concatMapStrings (getAttr "value") monitors;
 
-  configFile = pkgs.stdenv.mkDerivation {
-    name = "xserver.conf";
-
-    xfs = optionalString (cfg.useXFS != false)
-      ''FontPath "${toString cfg.useXFS}"'';
-
-    inherit (cfg) config;
-
-    buildCommand =
+  configFile = pkgs.runCommand "xserver.conf"
+    { xfs = optionalString (cfg.useXFS != false)
+        ''FontPath "${toString cfg.useXFS}"'';
+      inherit (cfg) config;
+    }
       ''
         echo 'Section "Files"' >> $out
         echo $xfs >> $out
@@ -102,7 +98,6 @@ let
 
         echo "$config" >> $out
       ''; # */
-  };
 
 in
 
diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index 40e67fa5f8d..8d02cd81e0e 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -134,10 +134,9 @@ let
     ''; # */
 
 
-  udevRules = pkgs.stdenv.mkDerivation {
-    name = "udev-rules";
-    allowedReferences = [ extraUtils ];
-    buildCommand = ''
+  udevRules = pkgs.runCommand "udev-rules"
+    { allowedReferences = [ extraUtils ]; }
+    ''
       mkdir -p $out
 
       echo 'ENV{LD_LIBRARY_PATH}="${extraUtils}/lib"' > $out/00-env.rules
@@ -176,7 +175,6 @@ let
       substituteInPlace $out/60-persistent-storage.rules \
         --replace ID_CDROM_MEDIA_TRACK_COUNT_DATA ID_CDROM_MEDIA
     ''; # */
-  };
 
 
   # The init script of boot stage 1 (loading kernel modules for
@@ -230,16 +228,12 @@ let
         { object = pkgs.writeText "mdadm.conf" config.boot.initrd.mdadmConf;
           symlink = "/etc/mdadm.conf";
         }
-        { object = pkgs.stdenv.mkDerivation {
-            name = "initrd-kmod-blacklist-ubuntu";
-            builder = pkgs.writeText "builder.sh" ''
-              source $stdenv/setup
+        { object = pkgs.runCommand "initrd-kmod-blacklist-ubuntu"
+            { src = "${pkgs.kmod-blacklist-ubuntu}/modprobe.conf"; }
+            ''
               target=$out
-
               ${pkgs.perl}/bin/perl -0pe 's/## file: iwlwifi.conf(.+?)##/##/s;' $src > $out
             '';
-            src = "${pkgs.kmod-blacklist-ubuntu}/modprobe.conf";
-          };
           symlink = "/etc/modprobe.d/ubuntu.conf";
         }
         { object = pkgs.kmod-debian-aliases;
diff --git a/pkgs/applications/misc/ranger/default.nix b/pkgs/applications/misc/ranger/default.nix
index 3334daa4aed..0a32fdf748e 100644
--- a/pkgs/applications/misc/ranger/default.nix
+++ b/pkgs/applications/misc/ranger/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pythonPackages, w3m, file }:
+{ stdenv, fetchurl, pythonPackages, w3m, file, less }:
 
 pythonPackages.buildPythonApplication rec {
   name = "ranger-1.7.2";
@@ -20,6 +20,8 @@ pythonPackages.buildPythonApplication rec {
   preConfigure = ''
     substituteInPlace ranger/ext/img_display.py \
       --replace /usr/lib/w3m ${w3m}/libexec/w3m
+    substituteInPlace ranger/__init__.py \
+      --replace "DEFAULT_PAGER = 'less'" "DEFAULT_PAGER = '${stdenv.lib.getBin less}/bin/less'"
 
     for i in ranger/config/rc.conf doc/config/rc.conf ; do
       substituteInPlace $i --replace /usr/share $out/share
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
index 40955d0aeb0..3e89fb731d3 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/google-talk-plugin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, rpm, cpio, mesa, xorg, cairo
+{ stdenv, fetchurl, rpm, cpio, mesa_noglu, xorg, cairo
 , libpng, gtk2, glib, gdk_pixbuf, fontconfig, freetype, curl
 , dbus_glib, alsaLib, libpulseaudio, systemd, pango
 }:
@@ -10,7 +10,7 @@ let
   baseURL = "http://dl.google.com/linux/talkplugin/deb/pool/main/g/google-talkplugin";
 
   rpathPlugin = makeLibraryPath
-    [ mesa
+    [ mesa_noglu
       xorg.libXt
       xorg.libX11
       xorg.libXrender
diff --git a/pkgs/applications/networking/browsers/opera/default.nix b/pkgs/applications/networking/browsers/opera/default.nix
index f1d40150eb3..fe7cb477371 100644
--- a/pkgs/applications/networking/browsers/opera/default.nix
+++ b/pkgs/applications/networking/browsers/opera/default.nix
@@ -84,5 +84,8 @@ stdenv.mkDerivation rec {
     homepage = http://www.opera.com;
     description = "Web browser";
     license = stdenv.lib.licenses.unfree;
+    # Marked as broken due to needing an update for security issues.
+    # See: https://github.com/NixOS/nixpkgs/issues/18856
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/cluster/mesos/default.nix b/pkgs/applications/networking/cluster/mesos/default.nix
index 6768df2df02..ac7d94d5c9a 100644
--- a/pkgs/applications/networking/cluster/mesos/default.nix
+++ b/pkgs/applications/networking/cluster/mesos/default.nix
@@ -46,7 +46,7 @@ in stdenv.mkDerivation rec {
 
   preConfigure = ''
     substituteInPlace src/Makefile.am --subst-var-by mavenRepo ${mavenRepo}
-    
+
     substituteInPlace 3rdparty/libprocess/include/process/subprocess.hpp \
       --replace '"sh"' '"${bash}/bin/bash"'
 
@@ -64,7 +64,7 @@ in stdenv.mkDerivation rec {
 
     substituteInPlace src/launcher/executor.cpp \
       --replace '"sh"' '"${bash}/bin/bash"'
-    
+
     substituteInPlace src/launcher/fetcher.cpp \
       --replace '"gzip' '"${gzip}/bin/gzip'    \
       --replace '"tar' '"${gnutar}/bin/tar'    \
@@ -72,7 +72,7 @@ in stdenv.mkDerivation rec {
 
     substituteInPlace src/python/cli/src/mesos/cli.py \
      --replace "['mesos-resolve'" "['$out/bin/mesos-resolve'"
-    
+
     substituteInPlace src/slave/containerizer/mesos/launch.cpp \
       --replace '"sh"' '"${bash}/bin/bash"'
 
@@ -83,7 +83,7 @@ in stdenv.mkDerivation rec {
 
     substituteInPlace src/linux/perf.cpp       \
       --replace '"perf ' '"${perf}/bin/perf '
-    
+
     substituteInPlace src/linux/systemd.cpp \
       --replace 'os::realpath("/sbin/init")' '"${systemd}/lib/systemd/systemd"'
 
@@ -180,5 +180,8 @@ in stdenv.mkDerivation rec {
     description = "A cluster manager that provides efficient resource isolation and sharing across distributed applications, or frameworks";
     maintainers = with maintainers; [ cstrahan kevincox offline rushmorem ];
     platforms   = platforms.linux;
+    # Marked as broken due to needing an update for security issues.
+    # See: https://github.com/NixOS/nixpkgs/issues/18856
+    broken = true;
   };
 }
diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 99a9e7462c2..82e0cce47d6 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, go }:
 
 stdenv.mkDerivation rec {
-  version = "0.14.6";
+  version = "0.14.7";
   name = "syncthing-${version}";
 
   src = fetchFromGitHub {
-    owner = "syncthing";
-    repo = "syncthing";
-    rev = "v${version}";
-    sha256 = "1w8a46c6r3rddfl9xbx7j2mavai4dm9h8flpm4qr0bsd6whf60hz";
+    owner  = "syncthing";
+    repo   = "syncthing";
+    rev    = "v${version}";
+    sha256 = "1mcn2vmv3hvp0ni9jxbjj3qp0l6ls07qmq33amhvjhpfafqzn279";
   };
 
   buildInputs = [ go ];
diff --git a/pkgs/applications/science/logic/redprl/default.nix b/pkgs/applications/science/logic/redprl/default.nix
index 70b3008156c..0cbe1d1cb37 100644
--- a/pkgs/applications/science/logic/redprl/default.nix
+++ b/pkgs/applications/science/logic/redprl/default.nix
@@ -11,12 +11,11 @@ stdenv.mkDerivation {
   patchPhase = ''
     patchShebangs ./script/
   '';
-  builder = builtins.toFile "builder.sh" ''
-    source $stdenv/setup
-    mkdir -p $out/bin
-    cp -r $src/* .
-    chmod -R +w src
+  buildPhase = ''
     ./script/mlton.sh
+  '';
+  installPhase = ''
+    mkdir -p $out/bin
     mv ./bin/redprl $out/bin
   '';
   meta = {
diff --git a/pkgs/applications/version-management/redmine/default.nix b/pkgs/applications/version-management/redmine/default.nix
index 0cb498fec06..f2786b15f34 100644
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/applications/version-management/redmine/default.nix
@@ -67,5 +67,8 @@ in stdenv.mkDerivation rec {
     platforms = platforms.linux;
     maintainers = [ maintainers.garbas ];
     license = licenses.gpl2;
+    # Marked as broken due to needing an update for security issues.
+    # See: https://github.com/NixOS/nixpkgs/issues/18856
+    broken = true;
   };
 }
diff --git a/pkgs/applications/virtualization/openstack/neutron.nix b/pkgs/applications/virtualization/openstack/neutron.nix
index 3371eb428e6..ac839d9f914 100644
--- a/pkgs/applications/virtualization/openstack/neutron.nix
+++ b/pkgs/applications/virtualization/openstack/neutron.nix
@@ -62,5 +62,8 @@ pythonPackages.buildPythonApplication rec {
     description = "Virtual network service for Openstack";
     license = stdenv.lib.licenses.asl20;
     platforms = stdenv.lib.platforms.linux;
+    # Marked as broken due to needing an update for security issues.
+    # See: https://github.com/NixOS/nixpkgs/issues/18856
+    broken = true;
   };
 }
diff --git a/pkgs/build-support/trivial-builders.nix b/pkgs/build-support/trivial-builders.nix
index 8775286b117..398426bf9a4 100644
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@@ -97,12 +97,16 @@ rec {
       done < graph
     '';
 
+
   # Quickly create a set of symlinks to derivations.
   # entries is a list of attribute sets like { name = "name" ; path = "/nix/store/..."; }
   linkFarm = name: entries: runCommand name {} ("mkdir -p $out; cd $out; \n" +
     (lib.concatMapStrings (x: "ln -s '${x.path}' '${x.name}';\n") entries));
 
-  # Require file
+
+  # Print an error message if the file with the specified name and
+  # hash doesn't exist in the Nix store. Do not use this function; it
+  # produces packages that cannot be built automatically.
   requireFile = { name ? null
                 , sha256 ? null
                 , sha1 ? null
@@ -115,8 +119,8 @@ rec {
     let msg =
       if message != null then message
       else ''
-        Unfortunately, we may not download file ${name_} automatically.
-        Please, go to ${url} to download it yourself, and add it to the Nix store
+        Unfortunately, we cannot download file ${name_} automatically.
+        Please go to ${url} to download it yourself, and add it to the Nix store
         using either
           nix-store --add-fixed ${hashAlgo} ${name_}
         or
@@ -143,30 +147,6 @@ rec {
       '';
     };
 
-  # Search in the environment if the same program exists with a set uid or
-  # set gid bit.  If it exists, run the first program found, otherwise run
-  # the default binary.
-  useSetUID = drv: path:
-    let
-      name = baseNameOf path;
-      bin = "${drv}${path}";
-    in assert name != "";
-      writeScript "setUID-${name}" ''
-        #!${stdenv.shell}
-        inode=$(stat -Lc %i ${bin})
-        for file in $(type -ap ${name}); do
-          case $(stat -Lc %a $file) in
-            ([2-7][0-7][0-7][0-7])
-              if test -r "$file".real; then
-                orig=$(cat "$file".real)
-                if test $inode = $(stat -Lc %i "$orig"); then
-                  exec "$file" "$@"
-                fi
-              fi;;
-          esac
-        done
-        exec ${bin} "$@"
-      '';
 
   # Copy a path to the Nix store.
   # Nix automatically copies files to the store before stringifying paths.
@@ -174,6 +154,7 @@ rec {
   # shortened to ${<path>}.
   copyPathToStore = builtins.filterSource (p: t: true);
 
+
   # Copy a list of paths to the Nix store.
   copyPathsToStore = builtins.map copyPathToStore;
 
diff --git a/pkgs/data/documentation/man-pages/default.nix b/pkgs/data/documentation/man-pages/default.nix
index 8eeebf40134..a488cb58e6f 100644
--- a/pkgs/data/documentation/man-pages/default.nix
+++ b/pkgs/data/documentation/man-pages/default.nix
@@ -10,6 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   makeFlags = [ "MANDIR=$(out)/share/man" ];
+  outputDocdev = "out";
 
   meta = with stdenv.lib; {
     description = "Linux development manual pages";
diff --git a/pkgs/development/idris-modules/wl-pprint.nix b/pkgs/development/idris-modules/wl-pprint.nix
index 66dd4cefe48..12e9b28d81c 100644
--- a/pkgs/development/idris-modules/wl-pprint.nix
+++ b/pkgs/development/idris-modules/wl-pprint.nix
@@ -4,25 +4,27 @@
 , base
 , lib
 , idris
-}: build-idris-package {
-  name = "wl-pprint";
+}:
+build-idris-package {
+  name = "wl-pprint-2016-09-28";
 
   src = fetchFromGitHub {
     owner = "shayan-najd";
     repo = "wl-pprint";
-    rev = "120f654b0b9838b57e10b163d3562d959439fb07";
-    sha256 = "1yymdl251zla6hv9rcg06x73gbp6xb0n6f6a02bsy5fqfmrfngcl";
+    rev = "4cc88a0865620a3b997863e4167d3b98e1a41b52";
+    sha256 = "1yxxh366k5njad75r0xci2q5c554cddvzgrwk43b0xn8rq0vm11x";
   };
 
+  # The tests for this package fail. We should attempt to enable them when
+  # updating this package again.
+  doCheck = false;
+
   propagatedBuildInputs = [ prelude base ];
 
   meta = {
     description = "Wadler-Leijen pretty-printing library";
-
     homepage = https://github.com/shayan-najd/wl-pprint;
-
     license = lib.licenses.bsd2;
-
     inherit (idris.meta) platforms;
   };
 }
diff --git a/pkgs/development/libraries/crypto++/default.nix b/pkgs/development/libraries/crypto++/default.nix
index 940af8c44e9..6fbd9451c56 100644
--- a/pkgs/development/libraries/crypto++/default.nix
+++ b/pkgs/development/libraries/crypto++/default.nix
@@ -45,6 +45,8 @@ stdenv.mkDerivation rec {
     license = licenses.boost;
     platforms = platforms.all;
     maintainers = [ ];
+    # Marked as broken due to needing an update for security issues.
+    # See: https://github.com/NixOS/nixpkgs/issues/18856
+    broken = true;
   };
 }
-
diff --git a/pkgs/development/libraries/fribidi/default.nix b/pkgs/development/libraries/fribidi/default.nix
index 35d67b63309..bdfbb97f021 100644
--- a/pkgs/development/libraries/fribidi/default.nix
+++ b/pkgs/development/libraries/fribidi/default.nix
@@ -2,15 +2,17 @@
 
 stdenv.mkDerivation rec {
   name = "fribidi-${version}";
-  version = "0.19.6";
+  version = "0.19.7";
 
   src = fetchurl {
     url = "http://fribidi.org/download/${name}.tar.bz2";
-    sha256 = "0zg1hpaml34ny74fif97j7ngrshlkl3wk3nja3gmlzl17i1bga6b";
+    sha256 = "13jsb5qadlhsaxkbrb49nqslmbh904vvzhsm5mm2ghmv29i2l8h8";
   };
 
   hardeningDisable = [ "format" ];
 
+  outputs = [ "out" "devdoc" ];
+
   meta = with stdenv.lib; {
     homepage = http://fribidi.org/;
     description = "GNU implementation of the Unicode Bidirectional Algorithm (bidi)";
diff --git a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
index eb55ae874e5..0e1e3c4897e 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gst-plugins-base/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
     patch -p1 < ${./gcc-4.9.patch}
   '';
 
+  outputs = [ "out" "dev" ];
+
   # TODO : v4l, libvisual
   buildInputs =
     [ pkgconfig glib cairo orc ]
diff --git a/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix b/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
index adda7697ffc..304d02087b4 100644
--- a/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
+++ b/pkgs/development/libraries/gstreamer/legacy/gstreamer/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "1nkid1n2l3rrlmq5qrf5yy06grrkwjh3yxl5g0w58w0pih8allci";
   };
 
+  outputs = [ "out" "dev" ];
+
   buildInputs = [ perl bison flex pkgconfig ];
   propagatedBuildInputs = [ glib libxml2 ] ++ libintlOrEmpty;
 
diff --git a/pkgs/development/libraries/libui/default.nix b/pkgs/development/libraries/libui/default.nix
index 50c42f4f10b..4db64186850 100644
--- a/pkgs/development/libraries/libui/default.nix
+++ b/pkgs/development/libraries/libui/default.nix
@@ -1,8 +1,9 @@
-{ stdenv, fetchgit, cmake, pkgconfig, gtk3 }:
+{ stdenv, fetchgit, cmake, pkgconfig, gtk3, darwin }:
 
 let
   shortName = "libui";
   version   = "3.1a";
+  backend   = if stdenv.isDarwin then "darwin" else "unix";
 in
   stdenv.mkDerivation rec {
     name = "${shortName}-${version}";
@@ -12,27 +13,42 @@ in
       sha256 = "1lpbfa298c61aarlzgp7vghrmxg1274pzxh1j9isv8x758gk6mfn";
     };
 
-    buildInputs = [ cmake pkgconfig gtk3 ];
+    buildInputs = [ cmake pkgconfig ] ++
+      (if stdenv.isDarwin then [darwin.apple_sdk.frameworks.Cocoa] else [gtk3]);
+
+    preConfigure = stdenv.lib.optionalString stdenv.isDarwin ''
+      sed -i 's/set(CMAKE_OSX_DEPLOYMENT_TARGET "10.8")//' ./CMakeLists.txt
+    '';
+    cmakeFlags = stdenv.lib.optionals stdenv.isDarwin [
+      "-DCMAKE_OSX_SYSROOT="
+      "-DCMAKE_OSX_DEPLOYMENT_TARGET="
+    ];
 
     installPhase = ''
       mkdir -p $out/{include,lib}
       mkdir -p $out/lib/pkgconfig
-
+    '' + stdenv.lib.optionalString stdenv.isLinux ''
       mv ./out/${shortName}.so.0 $out/lib/
       ln -s $out/lib/${shortName}.so.0 $out/lib/${shortName}.so
-
+    '' + stdenv.lib.optionalString stdenv.isDarwin ''
+      mv ./out/${shortName}.A.dylib $out/lib/
+      ln -s $out/lib/${shortName}.A.dylib $out/lib/${shortName}.dylib
+    '' + ''
       cp $src/ui.h $out/include
-      cp $src/ui_unix.h $out/include
+      cp $src/ui_${backend}.h $out/include
 
       cp ${./libui.pc} $out/lib/pkgconfig/${shortName}.pc
       substituteInPlace $out/lib/pkgconfig/${shortName}.pc \
         --subst-var-by out $out \
         --subst-var-by version "${version}"
     '';
+    postInstall = stdenv.lib.optionalString stdenv.isDarwin ''
+      install_name_tool -id $out/lib/${shortName}.A.dylib $out/lib/${shortName}.A.dylib
+    '';
 
     meta = {
       homepage    = https://github.com/andlabs/libui;
       description = "Simple and portable (but not inflexible) GUI library in C that uses the native GUI technologies of each platform it supports.";
-      platforms   = stdenv.lib.platforms.linux;
+      platforms   = stdenv.lib.platforms.unix;
     };
   }
diff --git a/pkgs/development/libraries/polkit-qt-1/qt-4.nix b/pkgs/development/libraries/polkit-qt-1/qt-4.nix
index 523189c3b2e..54e10b96592 100644
--- a/pkgs/development/libraries/polkit-qt-1/qt-4.nix
+++ b/pkgs/development/libraries/polkit-qt-1/qt-4.nix
@@ -10,10 +10,21 @@ stdenv.mkDerivation {
     sha256 = "1ip78x20hjqvm08kxhp6gb8hf6k5n6sxyx6kk2yvvq53djzh7yv7";
   };
 
+  outputs = [ "out" "dev" ];
+
   nativeBuildInputs = [ cmake pkgconfig automoc4 ];
 
   propagatedBuildInputs = [ polkit glib qt4 ];
 
+  postFixup =
+    ''
+      for i in $dev/lib/cmake/*/*.cmake; do
+        echo "fixing $i"
+        substituteInPlace $i \
+          --replace "\''${PACKAGE_PREFIX_DIR}/lib" $out/lib
+      done
+    '';
+
   meta = {
     description = "A Qt wrapper around PolKit";
     maintainers = with stdenv.lib.maintainers; [ ttuegel ];
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index a93ae2fc8ad..8526a5f5b82 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -36,6 +36,12 @@ stdenv.mkDerivation rec {
     sha256 = "183fca7n7439nlhxyg1z7aky0izgbyll3iwakw4gwivy16aj5272";
   };
 
+  outputs = [ "out" "dev" ];
+
+  outputInclude = "out";
+
+  setOutputFlags = false;
+
   # The version property must be kept because it will be included into the QtSDK package name
   version = vers;
 
@@ -87,8 +93,8 @@ stdenv.mkDerivation rec {
       -docdir $out/share/doc/${name}
       -plugindir $out/lib/qt4/plugins
       -importdir $out/lib/qt4/imports
-      -examplesdir $out/share/doc/${name}/examples
-      -demosdir $out/share/doc/${name}/demos
+      -examplesdir $TMPDIR/share/doc/${name}/examples
+      -demosdir $TMPDIR/share/doc/${name}/demos
       -datadir $out/share/${name}
       -translationdir $out/share/${name}/translations
     "
@@ -98,6 +104,7 @@ stdenv.mkDerivation rec {
   '';
 
   prefixKey = "-prefix ";
+
   configureFlags =
     ''
       -v -no-separate-debug-info -release -no-fast -confirm-license -opensource
@@ -153,6 +160,11 @@ stdenv.mkDerivation rec {
     sed -i 's/^\(LIBS[[:space:]]*=.*$\)/\1 -lobjc/' ./src/corelib/Makefile.Release
   '';
 
+  postInstall =
+    ''
+      rm -rf $out/tests
+    '';
+
   crossAttrs = let
     isMingw = stdenv.cross.libc == "msvcrt";
   in {
diff --git a/pkgs/development/tools/misc/global/default.nix b/pkgs/development/tools/misc/global/default.nix
index 3d09bc92cd3..d609b3b664c 100644
--- a/pkgs/development/tools/misc/global/default.nix
+++ b/pkgs/development/tools/misc/global/default.nix
@@ -3,11 +3,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "global-6.5.4";
+  name = "global-${version}";
+  version = "6.5.5";
 
   src = fetchurl {
     url = "mirror://gnu/global/${name}.tar.gz";
-    sha256 = "19hxajpwld6qx0faz4rzyh1hfs25ycjmws6bas8pavx4hskf05mg";
+    sha256 = "0yyg91qw8399lnxfai4bxkh9yq71qdwp9kvadgzp05cdqni44nxw";
   };
 
   nativeBuildInputs = [ libtool makeWrapper ];
@@ -51,7 +52,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = http://www.gnu.org/software/global/;
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ pSub ];
+    maintainers = with maintainers; [ pSub peterhoeg ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/profiling/systemtap/default.nix b/pkgs/development/tools/profiling/systemtap/default.nix
new file mode 100644
index 00000000000..b7872780245
--- /dev/null
+++ b/pkgs/development/tools/profiling/systemtap/default.nix
@@ -0,0 +1,52 @@
+{ fetchgit, pkgconfig, gettext, runCommand, makeWrapper
+, elfutils, kernel, gnumake }:
+let
+  ## fetchgit info
+  url = git://sourceware.org/git/systemtap.git;
+  rev = "a10bdceb7c9a7dc52c759288dd2e555afcc5184a";
+  sha256 = "1kllzfnh4ksis0673rma5psglahl6rvy0xs5v05qkqn6kl7irmg1";
+  version = "2016-09-16";
+
+  inherit (kernel) stdenv;
+  inherit (stdenv) lib;
+
+  ## stap binaries
+  stapBuild = stdenv.mkDerivation {
+    name = "systemtap-${version}";
+    src = fetchgit { inherit url rev sha256; };
+    buildInputs = [ elfutils pkgconfig gettext ];
+    enableParallelBuilding = true;
+  };
+
+  ## a kernel build dir as expected by systemtap
+  kernelBuildDir = runCommand "kbuild-${kernel.version}-merged" { } ''
+    mkdir -p $out
+    for f in \
+        ${kernel}/System.map \
+        ${kernel.dev}/vmlinux \
+        ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build/{*,.*}
+    do
+      ln -s $(readlink -f $f) $out
+    done
+  '';
+
+in runCommand "systemtap-${kernel.version}-${version}" {
+  inherit stapBuild kernelBuildDir;
+  buildInputs = [ makeWrapper ];
+  meta = {
+    homepage = https://sourceware.org/systemtap/;
+    repositories.git = url;
+    description = "Provides a scripting language for instrumentation on a live kernel plus user-space";
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.linux;
+  };
+} ''
+  mkdir -p $out/bin
+  for bin in $stapBuild/bin/*; do # hello emacs */
+    ln -s $bin $out/bin
+  done
+  rm $out/bin/stap
+  makeWrapper $stapBuild/bin/stap $out/bin/stap \
+    --add-flags "-r $kernelBuildDir" \
+    --prefix PATH : ${lib.makeBinPath [ stdenv.cc.cc elfutils gnumake ]}
+''
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index b15d66278d9..d4e9f1e7275 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -139,4 +139,13 @@ rec {
     };
 
   cpu-cgroup-v2 = import ./cpu-cgroup-v2-patches;
+
+  lguest_entry-linkage =
+    { name = "lguest-asmlinkage.patch";
+      patch = fetchpatch {
+        url = "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git"
+            + "/patch/drivers/lguest/x86/core.c?id=cdd77e87eae52";
+        sha256 = "04xlx6al10cw039av6jkby7gx64zayj8m1k9iza40sw0fydcfqhc";
+    };
+  };
 }
diff --git a/pkgs/os-specific/linux/pam_usb/default.nix b/pkgs/os-specific/linux/pam_usb/default.nix
index a96e951bf9b..cedb9bca1a0 100644
--- a/pkgs/os-specific/linux/pam_usb/default.nix
+++ b/pkgs/os-specific/linux/pam_usb/default.nix
@@ -1,6 +1,32 @@
-{stdenv, fetchurl, makeWrapper, useSetUID, dbus, libxml2, pam, pkgconfig, pmount, pythonPackages}:
+{ stdenv, fetchurl, makeWrapper, useSetUID, dbus, libxml2, pam, pkgconfig, pmount, pythonPackages, writeScript }:
 
 let
+
+  # Search in the environment if the same program exists with a set uid or
+  # set gid bit.  If it exists, run the first program found, otherwise run
+  # the default binary.
+  useSetUID = drv: path:
+    let
+      name = baseNameOf path;
+      bin = "${drv}${path}";
+    in assert name != "";
+      writeScript "setUID-${name}" ''
+        #!${stdenv.shell}
+        inode=$(stat -Lc %i ${bin})
+        for file in $(type -ap ${name}); do
+          case $(stat -Lc %a $file) in
+            ([2-7][0-7][0-7][0-7])
+              if test -r "$file".real; then
+                orig=$(cat "$file".real)
+                if test $inode = $(stat -Lc %i "$orig"); then
+                  exec "$file" "$@"
+                fi
+              fi;;
+          esac
+        done
+        exec ${bin} "$@"
+      '';
+
   pmountBin = useSetUID pmount "/bin/pmount";
   pumountBin = useSetUID pmount "/bin/pumount";
   inherit (pythonPackages) python dbus-python;
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index c38fa8843f4..56f14b30acd 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "rtl8812au-${kernel.version}-${version}";
-  version = "4.2.2-1";
+  version = "4.3.20";
 
   src = fetchFromGitHub {
-    owner = "csssuf";
-    repo = "rtl8812au";
-    rev = "874906aec694c800bfc29b146737b88dae767832";
-    sha256 = "14ifhplawipfd6971mxw76dv3ygwc0n8sbz2l3f0vvkin6x88bsj";
+    owner = "Grawp";
+    repo = "rtl8812au_rtl8821au";
+    rev = "9c5b2978ab079081dd1e981353be681a1cf495de";
+    sha256 = "0bx1vgs2qldwwhdgklbqz2vy9x4jg7cj3d6w6cpkndkcr7h0m5vz";
   };
 
   hardeningDisable = [ "pic" ];
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Driver for Realtek 802.11ac, rtl8812au, provides the 8812au mod";
-    homepage = "https://github.com/csssuf/rtl8812au";
+    homepage = "https://github.com/Grawp/rtl8812au_rtl8821au";
     license = stdenv.lib.licenses.gpl2;
     platforms = [ "x86_64-linux" "i686-linux" ];
     broken = (kernel.features.grsecurity or false);
diff --git a/pkgs/servers/asterisk/default.nix b/pkgs/servers/asterisk/default.nix
index bb45f0a00e6..ed772e7b247 100644
--- a/pkgs/servers/asterisk/default.nix
+++ b/pkgs/servers/asterisk/default.nix
@@ -57,5 +57,8 @@ stdenv.mkDerivation rec {
     homepage = http://www.asterisk.org/;
     license = licenses.gpl2;
     maintainers = with maintainers; [ auntie ];
+    # Marked as broken due to needing an update for security issues.
+    # See: https://github.com/NixOS/nixpkgs/issues/18856
+    broken = true;
   };
 }
diff --git a/pkgs/servers/samba/3.x.nix b/pkgs/servers/samba/3.x.nix
index e2818a1f648..858f60b3885 100644
--- a/pkgs/servers/samba/3.x.nix
+++ b/pkgs/servers/samba/3.x.nix
@@ -25,6 +25,12 @@ stdenv.mkDerivation rec {
     sha256 = "0l9pz2m67vf398q3c2dwn8jwdxsjb20igncf4byhv6yq5dzqlb4g";
   };
 
+  patches = [(fetchurl {
+    url = "https://download.samba.org/pub/samba/patches/security/"
+        + "samba-3.6.25-security-2015-12-16.patch";
+    sha256 = "00dcjcn577825mfdwdp76jfy5kcrqw3s4d5c41gqdq5gfcdbmqdb";
+  })];
+
   buildInputs = [ readline pam openldap popt iniparser libunwind fam acl cups ]
     ++ stdenv.lib.optional useKerberos kerberos;
 
diff --git a/pkgs/servers/search/groonga/default.nix b/pkgs/servers/search/groonga/default.nix
index 7025ddbc12b..8587134ad39 100644
--- a/pkgs/servers/search/groonga/default.nix
+++ b/pkgs/servers/search/groonga/default.nix
@@ -7,11 +7,11 @@
 stdenv.mkDerivation rec {
 
   name    = "groonga-${version}";
-  version = "6.0.8";
+  version = "6.0.9";
 
   src = fetchurl {
     url    = "http://packages.groonga.org/source/groonga/${name}.tar.gz";
-    sha256 = "05mp6zkavxj87nbx0jr48rpjjcf7fzdczxa93sxp4zq2dsnn5s5r";
+    sha256 = "1n7kf25yimgy9wy04hv5qvp4rzdzdr0ar92lhwms812qkhp3i4mq";
   };
 
   buildInputs = with stdenv.lib; [ pkgconfig mecab kytea libedit ] ++
@@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
     ${optionalString lz4Support "--with-lz4"}
   '';
 
+  doInstallCheck = true;
+
+  installCheckPhase = "$out/bin/groonga --version";
+
   meta = with stdenv.lib; {
     homepage = http://groonga.org/;
     description = "An open-source fulltext search engine and column store";
diff --git a/pkgs/servers/sql/virtuoso/6.x.nix b/pkgs/servers/sql/virtuoso/6.x.nix
index 715720b335f..5f6b3904155 100644
--- a/pkgs/servers/sql/virtuoso/6.x.nix
+++ b/pkgs/servers/sql/virtuoso/6.x.nix
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0dx0lp7cngdchi0772hp93zzn6sdap7z8s3vay3mzb9xgf0sdgy6";
   };
 
+  outputs = [ "out" "dev" "doc" ];
+
   buildInputs = [ libxml2 openssl readline gawk ];
 
   CPP = "${stdenv.cc}/bin/gcc -E";
@@ -18,14 +20,22 @@ stdenv.mkDerivation rec {
     --enable-openssl=${openssl.dev}
     ";
 
-  postInstall=''
+  postInstall = ''
     echo Moving documentation
     mkdir -pv $out/share/doc
     mv -v $out/share/virtuoso/doc $out/share/doc/${name}
+
     echo Removing jars and empty directories
     find $out -name "*.a" -delete -o -name "*.jar" -delete -o -type d -empty -delete
-    '';
-  
+
+    for f in $out/lib/*.la; do
+      echo "Fixing $f"
+      substituteInPlace $f \
+        --replace "${readline.dev}" "${readline.out}/lib" \
+        --replace "${openssl.dev}/lib" "${openssl.out}/lib"
+    done
+  '';
+
   meta = with stdenv.lib; {
     description = "SQL/RDF database used by, e.g., KDE-nepomuk";
     homepage = http://virtuoso.openlinksw.com/dataspace/dav/wiki/Main/;
diff --git a/pkgs/shells/bash-completion/bash-4.3.patch b/pkgs/shells/bash-completion/bash-4.3.patch
deleted file mode 100644
index e893b501d31..00000000000
--- a/pkgs/shells/bash-completion/bash-4.3.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-commit a9c556ccad819869a6a5d932aac0a75a99372f08
-Author: Barry Warsaw <barry@python.org>
-Date:   Wed Sep 17 19:32:43 2014 +0300
-
-    _init_completion: Handle cword < 0 (LP: #1289597)
-    
-    Previously only bash 4.3 seemed to provoke this, but now with the
-    empty command consistency tweak it occurs with earlier as well.
-
-diff --git a/bash_completion b/bash_completion
-index 7e01ae4..3bb4bc2 100644
---- a/bash_completion
-+++ b/bash_completion
-@@ -727,7 +727,7 @@ _init_completion()
-         fi
-     done
- 
--    [[ $cword -eq 0 ]] && return 1
-+    [[ $cword -le 0 ]] && return 1
-     prev=${words[cword-1]}
- 
-     [[ ${split-} ]] && _split_longopt && split=true
diff --git a/pkgs/shells/bash-completion/default.nix b/pkgs/shells/bash-completion/default.nix
index 91d6b333541..ad4cc3d09d7 100644
--- a/pkgs/shells/bash-completion/default.nix
+++ b/pkgs/shells/bash-completion/default.nix
@@ -1,28 +1,21 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "bash-completion-2.1";
+  name = "bash-completion-${version}";
+  version = "2.4";
 
   src = fetchurl {
-    url = "http://bash-completion.alioth.debian.org/files/${name}.tar.bz2";
-    sha256 = "0kxf8s5bw7y50x0ksb77d3kv0dwadixhybl818w27y6mlw26hq1b";
+    url = "https://github.com/scop/bash-completion/releases/download/${version}/${name}.tar.xz";
+    sha256 = "1xlhd09sb2w3bw8qaypxgkr0782w082mcbx8zf7yzjgy0996pxy0";
   };
 
-  patches = [ ./bash-4.3.patch ];
-
   doCheck = true;
 
-  # nmcli is included in the network-manager package
-  postInstall = ''
-    rm $out/share/bash-completion/completions/nmcli
-  '';
-
-  meta = {
-    homepage = "http://bash-completion.alioth.debian.org/";
+  meta = with stdenv.lib; {
+    homepage = https://github.com/scop/bash-completion;
     description = "Programmable completion for the bash shell";
-    license = "GPL";
-
-    platforms = stdenv.lib.platforms.unix;
-    maintainers = [ stdenv.lib.maintainers.peti ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.peti ];
   };
 }
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 283a6d48ca2..05d8bd0990f 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -19,7 +19,7 @@
 , enableAlternatives   ? false
 , enableCopyArtifacts  ? false
 
-, bashInteractive, bashCompletion
+, bashInteractive, bash-completion
 }:
 
 assert enableAcoustid    -> pythonPackages.pyacoustid     != null;
@@ -70,7 +70,7 @@ let
   allEnabledPlugins = pluginsWithoutDeps ++ enabledOptionalPlugins;
 
   testShell = "${bashInteractive}/bin/bash --norc";
-  completion = "${bashCompletion}/share/bash-completion/bash_completion";
+  completion = "${bash-completion}/share/bash-completion/bash_completion";
 
 in pythonPackages.buildPythonApplication rec {
   name = "beets-${version}";
diff --git a/pkgs/tools/filesystems/f3/default.nix b/pkgs/tools/filesystems/f3/default.nix
new file mode 100644
index 00000000000..e7f20b1e6b3
--- /dev/null
+++ b/pkgs/tools/filesystems/f3/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "f3-${version}";
+  version = "6.0";
+
+  enableParallelBuilding = true;
+
+  src = fetchFromGitHub {
+    owner = "AltraMayor";
+    repo = "f3";
+    rev = "v${version}";
+    sha256 = "1azi10ba0h9z7m0gmfnyymmfqb8380k9za8hn1rrw1s442hzgnz2";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+  patchPhase = "sed -i 's/-oroot -groot//' Makefile";
+
+  meta = {
+    description = "Fight Flash Fraud";
+    homepage = http://oss.digirati.com.br/f3/;
+    license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ makefu ];
+  };
+}
diff --git a/pkgs/tools/filesystems/mergerfs/default.nix b/pkgs/tools/filesystems/mergerfs/default.nix
new file mode 100644
index 00000000000..81f82108995
--- /dev/null
+++ b/pkgs/tools/filesystems/mergerfs/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchgit, fuse, pkgconfig, which, attr, pandoc, git }:
+
+stdenv.mkDerivation rec {
+  name = "mergerfs-${version}";
+  version = "2.16.1";
+
+  # not using fetchFromGitHub because of changelog being built with git log
+  src = fetchgit {
+    url = "https://github.com/trapexit/mergerfs";
+    rev = "refs/tags/${version}";
+    sha256 = "12fqgk54fnnibqiq82p4g2k6qnw3iy6dd64csmlf73yi67za5iwf";
+    deepClone = true;
+  };
+
+  buildInputs = [ fuse pkgconfig which attr pandoc git ];
+
+  makeFlags = [ "PREFIX=$(out)" "XATTR_AVAILABLE=1" ];
+
+  meta = {
+    description = "A FUSE based union filesystem";
+    homepage = https://github.com/trapexit/mergerfs;
+    license = stdenv.lib.licenses.isc;
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ makefu ];
+  };
+}
diff --git a/pkgs/tools/graphics/glxinfo/default.nix b/pkgs/tools/graphics/glxinfo/default.nix
index a99e42891b6..03be1e90930 100644
--- a/pkgs/tools/graphics/glxinfo/default.nix
+++ b/pkgs/tools/graphics/glxinfo/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, xlibsWrapper, mesa}:
+{ stdenv, fetchurl, xlibsWrapper, mesa_noglu }:
 
 let version = "8.3.0"; in
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "1vqb7s5m3fcg2csbiz45mha1pys2xx6rhw94fcyvapqdpm5iawy1";
   };
 
-  buildInputs = [xlibsWrapper mesa];
+  buildInputs = [ xlibsWrapper mesa_noglu ];
 
   configurePhase = "true";
 
diff --git a/pkgs/tools/misc/colord/default.nix b/pkgs/tools/misc/colord/default.nix
index 7e6c3f30784..6dc2c371e46 100644
--- a/pkgs/tools/misc/colord/default.nix
+++ b/pkgs/tools/misc/colord/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, fetchgit, bashCompletion
+{ stdenv, fetchzip, fetchgit, bash-completion
 , glib, polkit, pkgconfig, intltool, gusb, libusb1, lcms2, sqlite, systemd, dbus
 , automake, autoconf, libtool, gtk_doc, which, gobjectIntrospection, argyllcms
 , libgudev, sane-backends }:
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [ glib polkit pkgconfig intltool gusb libusb1 lcms2 sqlite systemd dbus gobjectIntrospection
-                  bashCompletion argyllcms automake autoconf libgudev sane-backends ];
+                  bash-completion argyllcms automake autoconf libgudev sane-backends ];
 
   postInstall = ''
     mkdir -p $out/etc/bash_completion.d
diff --git a/pkgs/tools/misc/xdxf2slob/default.nix b/pkgs/tools/misc/xdxf2slob/default.nix
new file mode 100644
index 00000000000..b5c3f937145
--- /dev/null
+++ b/pkgs/tools/misc/xdxf2slob/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchFromGitHub, python3Packages }:
+
+python3Packages.buildPythonApplication rec {
+  name = "xdxf2slob-unstable-2015-06-30";
+
+  src = fetchFromGitHub {
+    owner = "itkach";
+    repo = "xdxf2slob";
+    rev = "6831b93c3db8c73200900fa4ddcb17350a677e1b";
+    sha256 = "0m3dnc3816ja3kmik1wabb706dkqdf5sxvabwgf2rcrq891xcddd";
+  };
+
+  propagatedBuildInputs = [ python3Packages.PyICU python3Packages.slob ];
+
+  meta = with stdenv.lib; {
+    description = "Tool to convert XDXF dictionary files to slob format";
+    homepage = https://github.com/itkach/xdxf2slob/;
+    license = licenses.gpl3;
+    maintainer = [ maintainers.rycee ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/tools/networking/connman/default.nix b/pkgs/tools/networking/connman/default.nix
index 4c1fd1b5bba..565892181e4 100644
--- a/pkgs/tools/networking/connman/default.nix
+++ b/pkgs/tools/networking/connman/default.nix
@@ -51,10 +51,9 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "Provides a daemon for managing internet connections";
-    homepage = "https://connman.net/";
+    description = "A daemon for managing internet connections";
+    homepage = https://connman.net/;
     maintainers = [ maintainers.matejc ];
-    # tested only on linux, might work on others also
     platforms = platforms.linux;
     license = licenses.gpl2;
   };
diff --git a/pkgs/tools/networking/wol/default.nix b/pkgs/tools/networking/wol/default.nix
new file mode 100644
index 00000000000..5349abec161
--- /dev/null
+++ b/pkgs/tools/networking/wol/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "wol-${version}";
+  version = "0.7.1";
+  proj = "wake-on-lan";
+
+  enableParallelBuilding = true;
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${proj}/${name}.tar.gz";
+    sha256 = "08i6l5lr14mh4n3qbmx6kyx7vjqvzdnh3j9yfvgjppqik2dnq270";
+  };
+
+  meta = {
+    description = "Implements Wake On LAN functionality in a small program";
+    homepage = https://sourceforge.net/projects/wake-on-lan/;
+    license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ makefu ];
+  };
+}
diff --git a/pkgs/tools/package-management/createrepo_c/default.nix b/pkgs/tools/package-management/createrepo_c/default.nix
index eed1ed1e526..8d27dc8aef0 100644
--- a/pkgs/tools/package-management/createrepo_c/default.nix
+++ b/pkgs/tools/package-management/createrepo_c/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, bzip2, expat, glib, curl, libxml2, python, rpm, openssl, sqlite, file, xz, pcre, bashCompletion }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, bzip2, expat, glib, curl, libxml2, python, rpm, openssl, sqlite, file, xz, pcre, bash-completion }:
 
 stdenv.mkDerivation rec {
   rev  = "0.10.0";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
                 "set (PYTHON_INSTALL_DIR "$out/${python.sitePackages}")"
   '';
 
-  buildInputs = [ cmake pkgconfig bzip2 expat glib curl libxml2 python rpm openssl sqlite file xz pcre bashCompletion ];
+  buildInputs = [ cmake pkgconfig bzip2 expat glib curl libxml2 python rpm openssl sqlite file xz pcre bash-completion ];
 
   meta = with stdenv.lib; {
     description = "C implementation of createrepo";
diff --git a/pkgs/tools/package-management/packagekit/default.nix b/pkgs/tools/package-management/packagekit/default.nix
index af8a162357b..68d13f7f17f 100644
--- a/pkgs/tools/package-management/packagekit/default.nix
+++ b/pkgs/tools/package-management/packagekit/default.nix
@@ -3,7 +3,7 @@
 , gobjectIntrospection, vala_0_23, gtk_doc, autoreconfHook, autoconf-archive
 , nix, boost
 , enableCommandNotFound ? false
-, enableBashCompletion ? false, bashCompletion ? null }:
+, enableBashCompletion ? false, bash-completion ? null }:
 
 stdenv.mkDerivation rec {
   name = "packagekit-${version}";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ glib polkit systemd python gobjectIntrospection vala_0_23 ]
-                  ++ lib.optional enableBashCompletion bashCompletion;
+                  ++ lib.optional enableBashCompletion bash-completion;
   propagatedBuildInputs = [ sqlite nix boost ];
   nativeBuildInputs = [ intltool pkgconfig autoreconfHook autoconf-archive gtk_doc ];
 
diff --git a/pkgs/tools/security/lastpass-cli/default.nix b/pkgs/tools/security/lastpass-cli/default.nix
index bfd1343f5e5..88b7316e9d8 100644
--- a/pkgs/tools/security/lastpass-cli/default.nix
+++ b/pkgs/tools/security/lastpass-cli/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "lastpass-cli-${version}";
 
-  version = "0.9.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "lastpass";
     repo = "lastpass-cli";
     rev = "v${version}";
-    sha256 = "1iaz36bcyss2kahhlm92l7yh26rxvs12wnkkh1289yarl5wi0yld";
+    sha256 = "0hidx2qfr52bwjb6as4fbfa34jqh3zwvrcx590vbsji3bq4g7avb";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/text/ripgrep/default.nix b/pkgs/tools/text/ripgrep/default.nix
index ca08a237128..3c2ef2e9533 100644
--- a/pkgs/tools/text/ripgrep/default.nix
+++ b/pkgs/tools/text/ripgrep/default.nix
@@ -4,16 +4,16 @@ with rustPlatform;
 
 buildRustPackage rec {
   name = "ripgrep-${version}";
-  version = "0.1.17";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = "ripgrep";
     rev = "${version}";
-    sha256 = "18bpb1jl9fnipgp9icf1wwzm7934lk0ycbpvzlhvs2873zqhv6a6";
+    sha256 = "0whw6hqjkf6sysrfv931jaia2hqhy8m9aa5rxax1kygm4snz4j85";
   };
 
-  depsSha256 = "0fzjk5qynxivxmmz7r1za7mzdbdwzwwvxlc5a6cmxmzwnix2lby3";
+  depsSha256 = "10f7pkgaxwizl7kzhkry7wx1rgm9wsybwkk92myc29s7sqir2mx4";
 
   meta = with stdenv.lib; {
     description = "An untility that combines the usability of The Silver Searcher with the raw speed of grep";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index cc09abc49b5..14c3e513d6c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -24,6 +24,7 @@ doNotDisplayTwice rec {
   asciidocFull = asciidoc-full;  # added 2014-06-22
   bar = lemonbar;  # added 2015-01-16
   bar-xft = lemonbar-xft;  # added 2015-01-16
+  bashCompletion = bash-completion; # Added 2016-09-28
   bridge_utils = bridge-utils;  # added 2015-02-20
   btrfsProgs = btrfs-progs; # added 2016-01-03
   bundler_HEAD = bundler; # added 2015-11-15
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 532ed12a30a..4dc6aa218ce 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -815,6 +815,8 @@ in
 
   ent = callPackage ../tools/misc/ent { };
 
+  f3 = callPackage ../tools/filesystems/f3 { };
+
   facter = callPackage ../tools/system/facter {
     ruby = ruby_2_1;
   };
@@ -4175,6 +4177,8 @@ in
 
   wml = callPackage ../development/web/wml { };
 
+  wol = callPackage ../tools/networking/wol { };
+
   wring = nodePackages.wring;
 
   wrk = callPackage ../tools/networking/wrk { };
@@ -4230,6 +4234,8 @@ in
 
   xdummy = callPackage ../tools/misc/xdummy { };
 
+  xdxf2slob = callPackage ../tools/misc/xdxf2slob { };
+
   xe-guest-utilities = callPackage ../tools/virtualization/xe-guest-utilities { };
 
   xflux = callPackage ../tools/misc/xflux { };
@@ -4333,7 +4339,7 @@ in
     interactive = true;
   });
 
-  bashCompletion = callPackage ../shells/bash-completion { };
+  bash-completion = callPackage ../shells/bash-completion { };
 
   dash = callPackage ../shells/dash { };
 
@@ -8295,6 +8301,8 @@ in
 
   menu-cache = callPackage ../development/libraries/menu-cache { };
 
+  mergerfs = callPackage ../tools/filesystems/mergerfs { };
+
   mesaSupported = lib.elem system lib.platforms.mesaPlatforms;
 
   mesaDarwinOr = alternative: if stdenv.isDarwin
@@ -8314,6 +8322,7 @@ in
   mesa_drivers = mesaDarwinOr (
     let mo = mesa_noglu.override {
       grsecEnabled = config.grsecurity or false;
+      wayland = wayland_1_9; # work-around for #16779
     };
     in mo.drivers
   );
@@ -10678,7 +10687,7 @@ in
   };
 
   linux_3_10 = callPackage ../os-specific/linux/kernel/linux-3.10.nix {
-    kernelPatches = with kernelPatches; [ bridge_stp_helper ]
+    kernelPatches = with kernelPatches; [ bridge_stp_helper lguest_entry-linkage ]
       ++ lib.optionals ((platform.kernelArch or null) == "mips")
       [ kernelPatches.mips_fpureg_emu
         kernelPatches.mips_fpu_sigill
@@ -10867,6 +10876,8 @@ in
 
     sysdig = callPackage ../os-specific/linux/sysdig {};
 
+    systemtap = callPackage ../development/tools/profiling/systemtap { };
+
     tp_smapi = callPackage ../os-specific/linux/tp_smapi { };
 
     v86d = callPackage ../os-specific/linux/v86d { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3687d4b6789..31be94fd022 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7016,6 +7016,33 @@ in modules // {
     };
   };
 
+  grip = buildPythonPackage rec {
+    version = "4.3.2";
+    name = "grip-${version}";
+
+    src = pkgs.fetchFromGitHub {
+      owner = "joeyespo";
+      repo = "grip";
+      rev = "v${version}";
+      sha256 = "05a169sfaj280k7gibbc1rznjn43l5m6l1gpl6a5cmp5r8827khs";
+    };
+    buildInputs = with self; [ pytest responses ];
+
+    propagatedBuildInputs = with self; [ docopt flask markdown path-and-address pygments requests2 ];
+
+    checkPhase = ''
+      export PATH="$PATH:$out/bin"
+      py.test -xm "not assumption"
+    '';
+
+    meta = with stdenv.lib; {
+      description = "Preview GitHub Markdown files like Readme locally before committing them";
+      homepage = https://github.com/joeyespo/grip;
+      license = licenses.mit;
+      maintainers = with maintainers; [ koral ];
+    };
+  };
+
   gst-python = callPackage ../development/libraries/gstreamer/python {
     gst-plugins-base = pkgs.gst_all_1.gst-plugins-base;
   };
@@ -7977,6 +8004,30 @@ in modules // {
     };
   };
 
+  path-and-address = buildPythonPackage rec {
+    version = "2.0.1";
+    name = "path-and-address-${version}";
+
+    buildInputs = with self; [ pytest ];
+
+    checkPhase = "py.test";
+
+    src = pkgs.fetchFromGitHub {
+      owner = "joeyespo";
+      repo = "path-and-address";
+      rev = "v${version}";
+      sha256 = "0b0afpsaim06mv3lhbpm8fmawcraggc11jhzr6h72kdj1cqjk5h6";
+    };
+
+    meta = {
+      description = "Functions for server CLI applications used by humans";
+      homepage = https://github.com/joeyespo/path-and-address;
+      license = licenses.mit;
+      maintainers = with maintainers; [ koral];
+    };
+  };
+
+
   pdfminer = buildPythonPackage rec {
     version = "20140328";
     name = "pdfminer-${version}";
@@ -19533,6 +19584,33 @@ in modules // {
     };
   };
 
+  PyICU = buildPythonPackage rec {
+    name = "PyICU-1.9.3";
+
+    src = pkgs.fetchurl {
+      url = "mirror://pypi/P/PyICU/${name}.tar.gz";
+      sha256 = "0hps2314w7ddiwhqgw249m3hgqnny7qn542vz26jxr5k5hhrcyhs";
+    };
+
+    buildInputs = [ pkgs.icu ];
+
+    patches = [
+      # Fixes a bug in the test suite.
+      (pkgs.fetchpatch {
+        url = "https://github.com/ovalhub/pyicu/commit/6ab20d48d85638acb3a811c8676f713bd26f0df9.patch";
+        sha256 = "0z4585r6bi0xxvrr93n450ka43vixx9zd063qna078vck0i3bkjg";
+      })
+    ];
+
+    meta = {
+      homepage = https://pypi.python.org/pypi/PyICU/;
+      description = "Python extension wrapping the ICU C++ API";
+      license = licenses.mit;
+      platforms = platforms.all;
+      maintainers = [ maintainers.rycee ];
+    };
+  };
+
   pyinotify = buildPythonPackage rec {
     name = "pyinotify";
     version = "0.9.6";
@@ -22329,6 +22407,31 @@ in modules // {
     };
   };
 
+  slob = buildPythonPackage rec {
+    name = "slob-unstable-2016-03-04";
+
+    disabled = !isPy3k;
+
+    src = pkgs.fetchFromGitHub {
+      owner = "itkach";
+      repo = "slob";
+      rev = "31ad0e769360a5b10a4893f686587bb8e48c3895";
+      sha256 = "06yn510178awhjsvy88cpjz7rlmyviqd5g58gc8gf4ivyqdlqbsl";
+    };
+
+    propagatedBuildInputs = [ self.PyICU ];
+
+    checkPhase = "python3 -m unittest slob";
+
+    meta = {
+      homepage = https://github.com/itkach/slob/;
+      description = "Reference implementation of the slob (sorted list of blobs) format";
+      license = licenses.gpl3;
+      platforms = platforms.all;
+      maintainers = [ maintainers.rycee ];
+    };
+  };
+
   slowaes = buildPythonPackage rec {
     name = "slowaes-${version}";
     version = "0.1a1";
diff --git a/pkgs/top-level/rust-packages.nix b/pkgs/top-level/rust-packages.nix
index d6eebf58092..20cc1396653 100644
--- a/pkgs/top-level/rust-packages.nix
+++ b/pkgs/top-level/rust-packages.nix
@@ -7,9 +7,9 @@
 { runCommand, fetchFromGitHub, git }:
 
 let
-  version = "2016-09-23";
-  rev = "e2ac19b6236468033ba0c66ac23293b7ed9e3486";
-  sha256 = "16kwzjjx67pigs9b8pxdfl685l812a8ja47s61h6gshxrg3j1cs7";
+  version = "2016-09-29";
+  rev = "12dc47026cadf5aa2823c9d0fdd055b9f2c0f52c";
+  sha256 = "0la6wlnbiwjixcxbq6k0d8m5js8lk5wz5f3mvdx8hwl5car20w6m";
 
   src = fetchFromGitHub {
       inherit rev;