diff --git a/lib/licenses.nix b/lib/licenses.nix
index 2262ae9ebbc..e03ed38eb5e 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -2,7 +2,7 @@
 let
 
   spdx = lic: lic // {
-    url = "http://spdx.org/licenses/${lic.spdxId}";
+    url = "http://spdx.org/licenses/${lic.spdxId}.html";
   };
 
 in
@@ -580,6 +580,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "Vovida Software License v1.0";
   };
 
+  watcom = spdx {
+    spdxId = "Watcom-1.0";
+    fullName = "Sybase Open Watcom Public License 1.0";
+  };
+
   w3c = spdx {
     spdxId = "W3C";
     fullName = "W3C Software Notice and License";
@@ -614,5 +619,4 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     spdxId = "ZPL-2.1";
     fullName = "Zope Public License 2.1";
   };
-
 }
diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index 34fbbce1a7a..e72e320d41b 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -496,6 +496,7 @@
   nicknovitski = "Nick Novitski <nixpkgs@nicknovitski.com>";
   nico202 = "Nicolò Balzarotti <anothersms@gmail.com>";
   NikolaMandic = "Ratko Mladic <nikola@mandic.email>";
+  ninjatrappeur = "Félix Baylac-Jacqué <felix@alternativebit.fr>";
   nipav = "Niko Pavlinek <niko.pavlinek@gmail.com>";
   nixy = "Andrew R. M. <nixy@nixy.moe>";
   nmattia = "Nicolas Mattia <nicolas@nmattia.com>";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 35f5e87d7e5..01bd2960517 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -694,6 +694,7 @@
   ./services/x11/xserver.nix
   ./system/activation/activation-script.nix
   ./system/activation/top-level.nix
+  ./system/boot/binfmt.nix
   ./system/boot/coredump.nix
   ./system/boot/emergency-mode.nix
   ./system/boot/grow-partition.nix
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 22af7e876af..5ab331ac067 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -414,7 +414,10 @@ in
       postmasterAlias = mkOption {
         type = types.str;
         default = "root";
-        description = "Who should receive postmaster e-mail.";
+        description = "
+          Who should receive postmaster e-mail. Multiple values can be added by
+          separating values with comma.
+        ";
       };
 
       rootAlias = mkOption {
@@ -422,6 +425,7 @@ in
         default = "";
         description = "
           Who should receive root e-mail. Blank for no redirection.
+          Multiple values can be added by separating values with comma.
         ";
       };
 
diff --git a/nixos/modules/system/boot/binfmt.nix b/nixos/modules/system/boot/binfmt.nix
new file mode 100644
index 00000000000..15e84dc021e
--- /dev/null
+++ b/nixos/modules/system/boot/binfmt.nix
@@ -0,0 +1,139 @@
+{ config, lib, ... }:
+let
+  inherit (lib) mkOption types optionalString;
+
+  cfg = config.boot.binfmtMiscRegistrations;
+
+  makeBinfmtLine = name: { recognitionType, offset, magicOrExtension
+                         , mask, preserveArgvZero, openBinary
+                         , matchCredentials, fixBinary, ...
+                         }: let
+    type = if recognitionType == "magic" then "M" else "E";
+    offset' = toString offset;
+    mask' = toString mask;
+    interpreter = "/run/binfmt/${name}";
+    flags = if !(matchCredentials -> openBinary)
+              then throw "boot.binfmtMiscRegistrations.${name}: you can't specify openBinary = false when matchCredentials = true."
+            else optionalString preserveArgvZero "P" +
+                 optionalString (openBinary && !matchCredentials) "O" +
+                 optionalString matchCredentials "C" +
+                 optionalString fixBinary "F";
+  in ":${name}:${type}:${offset'}:${magicOrExtension}:${mask'}:${interpreter}:${flags}";
+
+  binfmtFile = builtins.toFile "binfmt_nixos.conf"
+    (lib.concatStringsSep "\n" (lib.mapAttrsToList makeBinfmtLine cfg));
+
+  activationSnippet = name: { interpreter, ... }:
+    "ln -sf ${interpreter} /run/binfmt/${name}";
+  activationScript = ''
+    mkdir -p -m 0755 /run/binfmt
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList activationSnippet cfg)}
+  '';
+in {
+  options = {
+    boot.binfmtMiscRegistrations = mkOption {
+      default = {};
+
+      description = ''
+        Extra binary formats to register with the kernel.
+        See https://www.kernel.org/doc/html/latest/admin-guide/binfmt-misc.html for more details.
+      '';
+
+      type = types.attrsOf (types.submodule ({ config, ... }: {
+        options = {
+          recognitionType = mkOption {
+            default = "magic";
+            description = "Whether to recognize executables by magic number or extension.";
+            type = types.enum [ "magic" "extension" ];
+          };
+
+          offset = mkOption {
+            default = null;
+            description = "The byte offset of the magic number used for recognition.";
+            type = types.nullOr types.int;
+          };
+
+          magicOrExtension = mkOption {
+            description = "The magic number or extension to match on.";
+            type = types.str;
+          };
+
+          mask = mkOption {
+            default = null;
+            description =
+              "A mask to be ANDed with the byte sequence of the file before matching";
+            type = types.nullOr types.str;
+          };
+
+          interpreter = mkOption {
+            description = ''
+              The interpreter to invoke to run the program.
+
+              Note that the actual registration will point to
+              /run/binfmt/''${name}, so the kernel interpreter length
+              limit doesn't apply.
+            '';
+            type = types.path;
+          };
+
+          preserveArgvZero = mkOption {
+            default = false;
+            description = ''
+              Whether to pass the original argv[0] to the interpreter.
+
+              See the description of the 'P' flag in the kernel docs
+              for more details;
+            '';
+            type = types.bool;
+          };
+
+          openBinary = mkOption {
+            default = config.matchCredentials;
+            description = ''
+              Whether to pass the binary to the interpreter as an open
+              file descriptor, instead of a path.
+            '';
+            type = types.bool;
+          };
+
+          matchCredentials = mkOption {
+            default = false;
+            description = ''
+              Whether to launch with the credentials and security
+              token of the binary, not the interpreter (e.g. setuid
+              bit).
+
+              See the description of the 'C' flag in the kernel docs
+              for more details.
+
+              Implies/requires openBinary = true.
+            '';
+            type = types.bool;
+          };
+
+          fixBinary = mkOption {
+            default = false;
+            description = ''
+              Whether to open the interpreter file as soon as the
+              registration is loaded, rather than waiting for a
+              relevant file to be invoked.
+
+              See the description of the 'F' flag in the kernel docs
+              for more details.
+            '';
+            type = types.bool;
+          };
+        };
+      }));
+    };
+  };
+
+  config = lib.mkIf (cfg != {}) {
+    environment.etc."binfmt.d/nixos.conf".source = binfmtFile;
+    system.activationScripts.binfmt = activationScript;
+    systemd.additionalUpstreamSystemUnits =
+      [ "proc-sys-fs-binfmt_misc.automount"
+        "proc-sys-fs-binfmt_misc.mount"
+      ];
+  };
+}
diff --git a/nixos/tests/home-assistant.nix b/nixos/tests/home-assistant.nix
index 5d7e0ec65e7..2e45dc78471 100644
--- a/nixos/tests/home-assistant.nix
+++ b/nixos/tests/home-assistant.nix
@@ -2,17 +2,27 @@ import ./make-test.nix ({ pkgs, ... }:
 
 let
   configDir = "/var/lib/foobar";
+  apiPassword = "secret";
 
 in {
   name = "home-assistant";
+  meta = with pkgs.stdenv.lib; {
+    maintainers = with maintainers; [ dotlambda ];
+  };
 
   nodes = {
     hass =
       { config, pkgs, ... }:
       {
+        environment.systemPackages = with pkgs; [
+          mosquitto
+        ];
         services.home-assistant = {
           inherit configDir;
           enable = true;
+          package = pkgs.home-assistant.override {
+            extraPackages = ps: with ps; [ hbmqtt ];
+          };
           config = {
             homeassistant = {
               name = "Home";
@@ -22,7 +32,16 @@ in {
               elevation = 0;
             };
             frontend = { };
-            http = { };
+            http.api_password = apiPassword;
+            mqtt = { }; # Use hbmqtt as broker
+            binary_sensor = [
+              {
+                platform = "mqtt";
+                state_topic = "home-assistant/test";
+                payload_on = "let_there_be_light";
+                payload_off = "off";
+              }
+            ];
           };
         };
       };
@@ -31,7 +50,7 @@ in {
   testScript = ''
     startAll;
     $hass->waitForUnit("home-assistant.service");
-    
+
     # Since config is specified using a Nix attribute set,
     # configuration.yaml is a link to the Nix store
     $hass->succeed("test -L ${configDir}/configuration.yaml");
@@ -39,8 +58,19 @@ in {
     # Check that Home Assistant's web interface and API can be reached
     $hass->waitForOpenPort(8123);
     $hass->succeed("curl --fail http://localhost:8123/states");
-    $hass->succeed("curl --fail http://localhost:8123/api/ | grep 'API running'");
+    $hass->succeed("curl --fail -H 'x-ha-access: ${apiPassword}' http://localhost:8123/api/ | grep -qF 'API running'");
 
+    # Toggle a binary sensor using MQTT
+    $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"off\"'");
+    $hass->waitUntilSucceeds("mosquitto_pub -V mqttv311 -t home-assistant/test -u homeassistant -P '${apiPassword}' -m let_there_be_light");
+    $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"on\"'");
+
+    # Check that no errors were logged
     $hass->fail("cat ${configDir}/home-assistant.log | grep -qF ERROR");
+
+    # Print log to ease debugging
+    my $log = $hass->succeed("cat ${configDir}/home-assistant.log");
+    print "\n### home-assistant.log ###\n";
+    print "$log\n";
   '';
 })
diff --git a/nixos/tests/networking.nix b/nixos/tests/networking.nix
index fa3dc053872..bcdbad3bab0 100644
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@@ -530,7 +530,7 @@ let
           $client->waitUntilSucceeds("ping -c 1 fd00:1234:5678:1::1");
 
           # Test address used is temporary
-          $client->succeed("! ip route get fd00:1234:5678:1::1 | grep -q ':[a-f0-9]*ff:fe[a-f0-9]*:'");
+          $client->waitUntilSucceeds("! ip route get fd00:1234:5678:1::1 | grep -q ':[a-f0-9]*ff:fe[a-f0-9]*:'");
         '';
     };
   };
diff --git a/pkgs/applications/editors/vscode/default.nix b/pkgs/applications/editors/vscode/default.nix
index 8599ff8e93e..4c825cc9891 100644
--- a/pkgs/applications/editors/vscode/default.nix
+++ b/pkgs/applications/editors/vscode/default.nix
@@ -2,7 +2,7 @@
   makeWrapper, libXScrnSaver, libxkbfile, libsecret }:
 
 let
-  version = "1.20.0";
+  version = "1.20.1";
   channel = "stable";
 
   plat = {
@@ -12,9 +12,9 @@ let
   }.${stdenv.system};
 
   sha256 = {
-    "i686-linux" = "0lhfljcdb05v0p3kc6zimgd2z057397blfp56bhr7v7wnsi6i40k";
-    "x86_64-linux" = "138kvqa5cixry62yry0lwzxlk9fs8hb4zqzmsd8ag1jjfma8y45k";
-    "x86_64-darwin" = "1adnwlqf2kw8wfjf86a3xg83j1yqnlsdckksw82b06x3j11g91i8";
+    "i686-linux" = "0gycz857bl9ikfrylim970qgmyw7rcy3gbg2zsjddp9cgdk9basn";
+    "x86_64-linux" = "0rx0qyxv173s9wjw97f94h61f12lh42grnmabgsvwd87b8zx4qim";
+    "x86_64-darwin" = "0mqxmmkp3bsmy1g35prsgan61zzq5368gp720v37cwx1rskl0bfg";
   }.${stdenv.system};
 
   archive_fmt = if stdenv.system == "x86_64-darwin" then "zip" else "tar.gz";
diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index 972fbfb7b07..6587305a770 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -54,14 +54,13 @@ let
 
 in pythonPackages.buildPythonApplication rec {
   name = "OctoPrint-${version}";
-  version = "1.3.5";
-  # 1.3.5, 2017-10-16, 77753ca02602d3a798d6b0a22535e6fd69ff448a
+  version = "1.3.6";
 
   src = fetchFromGitHub {
     owner = "foosel";
     repo = "OctoPrint";
     rev = version;
-    sha256 = "13krv9i6gm4jn4cb327q4qma4xwwashjnc0dia8vlnbjbbvkrni4";
+    sha256 = "0pgpkjw5zjnks5bky51gjaksq8mhrzkl52kpgf799hl35pd08xr3";
   };
 
   # We need old Tornado
@@ -70,7 +69,7 @@ in pythonPackages.buildPythonApplication rec {
     semantic-version flask_principal werkzeug flaskbabel tornado
     psutil pyserial flask_login netaddr markdown sockjs-tornado
     pylru pyyaml sarge feedparser netifaces click websocket_client
-    scandir chainmap future dateutil futures wrapt
+    scandir chainmap future dateutil futures wrapt monotonic emoji
   ];
 
   buildInputs = with pythonPackages; [ nose mock ddt ];
diff --git a/pkgs/applications/misc/redshift/default.nix b/pkgs/applications/misc/redshift/default.nix
index 9871c559523..c0e481ae878 100644
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@@ -41,7 +41,10 @@ stdenv.mkDerivation rec {
   pythonPath = [ pygobject3 pyxdg ];
 
   preConfigure = "./bootstrap";
-  postFixup = "wrapPythonPrograms";
+  postFixup = ''
+    wrapPythonPrograms
+    rm "$out/share/icons/hicolor/icon-theme.cache"
+  '';
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 010f60881b5..12ea714fb23 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -71,7 +71,7 @@ let
             ++ lib.optionals (cfg.enableQuakeLive or false)
             (with xorg; [ stdenv.cc libX11 libXxf86dga libXxf86vm libXext libXt alsaLib zlib libudev ])
             ++ lib.optional (enableAdobeFlash && (cfg.enableAdobeFlashDRM or false)) hal-flash
-            ++ lib.optional (config.pulseaudio or false) libpulseaudio;
+            ++ lib.optional (config.pulseaudio or true) libpulseaudio;
       gst-plugins = with gst_all; [ gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-ffmpeg ];
       gtk_modules = [ libcanberra_gtk2 ];
 
diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index 006aa88f363..cd4f9509788 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   name = "palemoon-${version}";
-  version = "27.6.2";
+  version = "27.7.2";
 
   src = fetchFromGitHub {
     name   = "palemoon-src";
     owner  = "MoonchildProductions";
     repo   = "Pale-Moon";
     rev    = version + "_Release";
-    sha256 = "0ickxrwl36iyqj3v9qq6hnfl2y652f2ppwi949pfh4f6shm9x0ri";
+    sha256 = "19ki6gp6bhcvhjnclalviiyp93mqsgc22xjl0gm9x5y4sxdb5wlq";
   };
 
   desktopItem = makeDesktopItem {
@@ -101,10 +101,20 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A web browser";
+    longDescription = ''
+      Pale Moon is an Open Source, Goanna-based web browser focusing on
+      efficiency and customization.
+
+      Pale Moon offers you a browsing experience in a browser completely built
+      from its own, independently developed source that has been forked off from
+      Firefox/Mozilla code a number of years ago, with carefully selected
+      features and optimizations to improve the browser's stability and user
+      experience, while offering full customization and a growing collection of
+      extensions and themes to make the browser truly your own.
+    '';
     homepage    = https://www.palemoon.org/;
     license     = licenses.mpl20;
-    maintainers = with maintainers; [ rnhmjoj ];
+    maintainers = with maintainers; [ rnhmjoj AndersonTorres ];
     platforms   = platforms.linux;
   };
-
 }
diff --git a/pkgs/applications/networking/newsreaders/liferea/default.nix b/pkgs/applications/networking/newsreaders/liferea/default.nix
index 743da795806..ed6fe17cc7e 100644
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@@ -28,6 +28,7 @@ in stdenv.mkDerivation rec {
   pythonPath = with python3Packages; [ pygobject3 pycairo ];
 
   preFixup = ''
+    rm "$out/share/icons/hicolor/icon-theme.cache"
     buildPythonPath "$out $pythonPath"
     gappsWrapperArgs+=(--prefix PYTHONPATH : "$program_PYTHONPATH")
   '';
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 68ab979ecfb..48a9296fa97 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -18,8 +18,8 @@
 
 with stdenv.lib;
 let
-  version = "2.11.0";
-  sha256 = "1jvzw6rdhimn583dz6an8xiw07n3ycvxmj3jpv1s312scv3k9w64";
+  version = "2.11.1";
+  sha256 = "1jrcff0szyjxc3vywyiclwdzk0xgq4cxvjbvmcfyjcpdrq9j5pyr";
   audio = optionalString (hasSuffix "linux" stdenv.system) "alsa,"
     + optionalString pulseSupport "pa,"
     + optionalString sdlSupport "sdl,";
diff --git a/pkgs/applications/virtualization/qemu/riscv.nix b/pkgs/applications/virtualization/qemu/riscv.nix
new file mode 100644
index 00000000000..a900d943dab
--- /dev/null
+++ b/pkgs/applications/virtualization/qemu/riscv.nix
@@ -0,0 +1,20 @@
+{ qemu, fetchFromGitHub, lib }: let
+  src = fetchFromGitHub {
+    owner = "riscv";
+    repo = "riscv-qemu";
+    rev = "af435b709d4a5de3ec2e59ff4dcd05b0b295a730";
+    sha256 = "1kqcsn8yfdg3zyd991i4v5dxznd1l4a4hjry9304lvsm3sz2wllw";
+    fetchSubmodules = true;
+  };
+  version = "2.11.50";
+  revCount = "58771";
+  shortRev = "af435b709d";
+  targets = [ "riscv32-linux-user" "riscv32-softmmu"
+              "riscv64-linux-user" "riscv64-softmmu"
+            ];
+in lib.overrideDerivation qemu (orig: {
+  name = "${(builtins.parseDrvName qemu.name).name}-${version}pre${revCount}_${shortRev}";
+  inherit src;
+  configureFlags = orig.configureFlags ++ [ "--target-list=${lib.concatStringsSep "," targets}" ];
+  postInstall = null;
+})
diff --git a/pkgs/applications/virtualization/xen/4.8.nix b/pkgs/applications/virtualization/xen/4.8.nix
index 44a52a1026a..b1fcf36a46c 100644
--- a/pkgs/applications/virtualization/xen/4.8.nix
+++ b/pkgs/applications/virtualization/xen/4.8.nix
@@ -49,15 +49,9 @@ callPackage (import ./generic.nix (rec {
       src = fetchgit {
         url = https://xenbits.xen.org/git-http/qemu-xen.git;
         rev = "refs/tags/qemu-xen-${version}";
-        sha256 = "1v19pp86kcgwvsbkrdrn4rlaj02i4054avw8k70w1m0rnwgcsdbs";
+        sha256 = "1l4sygd8p0mc13bskr4r1m31qh1kr58h195qn1s52869s58jyhvm";
       };
       buildInputs = qemuDeps;
-      patches = [
-        (xsaPatch {
-          name = "216-qemuu";
-          sha256 = "06w2iw1r5gip2bpbg19cziws965h9in0f6np74cr31f76yy30yxn";
-        })
-      ];
       meta.description = "Xen's fork of upstream Qemu";
     };
   } // optionalAttrs withInternalTraditionalQemu {
diff --git a/pkgs/applications/virtualization/xen/packages.nix b/pkgs/applications/virtualization/xen/packages.nix
index 8f5262acb02..4b5f15c8ff4 100644
--- a/pkgs/applications/virtualization/xen/packages.nix
+++ b/pkgs/applications/virtualization/xen/packages.nix
@@ -58,10 +58,6 @@ rec {
   };
 
   xen_4_8-vanilla = callPackage ./4.8.nix {
-    # At the very least included seabios and etherboot need gcc49,
-    # so we have to build all of it with gcc49.
-    stdenv = overrideCC stdenv gcc49;
-
     meta = {
       description = "vanilla";
       longDescription = ''
diff --git a/pkgs/common-updater/scripts/update-source-version b/pkgs/common-updater/scripts/update-source-version
index ae2d023a039..4c32ae046f3 100755
--- a/pkgs/common-updater/scripts/update-source-version
+++ b/pkgs/common-updater/scripts/update-source-version
@@ -74,7 +74,7 @@ fi
 if [ -z "$newHash" ]; then
     nix-build --no-out-link -A "$attr.src" 2>"$attr.fetchlog" >/dev/null || true
     # FIXME: use nix-build --hash here once https://github.com/NixOS/nix/issues/1172 is fixed
-    newHash=$(egrep -v "killing process|dependencies couldn't be built" "$attr.fetchlog" | tail -n2 | sed "s~output path .* has .* hash \(.*\) when .* was expected|fixed-output derivation produced path '.*' with .* hash '\(.*\)' instead of the expected hash '.*'~\1\2~" | head -n1)
+    newHash=$(egrep -v "killing process|dependencies couldn't be built" "$attr.fetchlog" | tail -n2 | sed "s~output path .* has .* hash \(.*\) when .* was expected\|fixed-output derivation produced path '.*' with .* hash '\(.*\)' instead of the expected hash '.*'~\1\2~" | head -n1)
 fi
 
 if [ -z "$newHash" ]; then
diff --git a/pkgs/data/fonts/fixedsys-excelsior/default.nix b/pkgs/data/fonts/fixedsys-excelsior/default.nix
new file mode 100644
index 00000000000..b0c481dfcb5
--- /dev/null
+++ b/pkgs/data/fonts/fixedsys-excelsior/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchurl } :
+
+let 
+  major = "3";
+  minor = "00";
+  version = "${major}.${minor}";
+
+in
+
+stdenv.mkDerivation rec {
+  name = "fixedsys-excelsior-${version}";
+
+  src = fetchurl {
+    url = http://www.fixedsysexcelsior.com/fonts/FSEX300.ttf;
+    sha256 = "6ee0f3573bc5e33e93b616ef6282f49bc0e227a31aa753ac76ed2e3f3d02056d";
+  };
+
+  phases = [ "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/share/fonts/truetype/
+    cp $src $out/share/fonts/truetype/${name}.ttf
+  '';
+
+  outputHashMode = "recursive";
+
+  outputHashAlgo = "sha256";
+
+  outputHash = "32d6f07f1ff08c764357f8478892b2ba5ade23427af99759f34a0ba24bcd2e37";
+  
+  meta = {
+    description = "Pan-unicode version of Fixedsys, a classic DOS font.";
+    homepage = http://www.fixedsysexcelsior.com/;
+    platforms = stdenv.lib.platforms.all;
+    license = stdenv.lib.licenses.publicDomain;
+    maintainers = [ stdenv.lib.maintainers.ninjatrappeur ];
+  };
+}
diff --git a/pkgs/data/fonts/hack/default.nix b/pkgs/data/fonts/hack/default.nix
index 0edd27dab0e..eb794326539 100644
--- a/pkgs/data/fonts/hack/default.nix
+++ b/pkgs/data/fonts/hack/default.nix
@@ -1,20 +1,18 @@
 { stdenv, fetchzip }:
 
 let
-  version = "2.020";
+  version = "3.002";
 in fetchzip rec {
   name = "hack-font-${version}";
 
-  url = let
-    version_ = with stdenv.lib; concatStringsSep "_" (splitString "." version);
-  in "https://github.com/chrissimpkins/Hack/releases/download/v${version}/Hack-v${version_}-ttf.zip";
+  url = "https://github.com/chrissimpkins/Hack/releases/download/v${version}/Hack-v${version}-ttf.zip";
 
   postFetch = ''
     mkdir -p $out/share/fonts
     unzip -j $downloadedFile \*.ttf -d $out/share/fonts/hack
   '';
 
-  sha256 = "0cpsglb9vnhmpsn496aqisfvmq3yxvjnj7c361dspy0fn6z8x60c";
+  sha256 = "11f3hl4nvxq6pvsmwr1c1r5wrxhrp7ixr5bshrz2dmqn7l8bxa63";
 
   meta = with stdenv.lib; {
     description = "A typeface designed for source code";
@@ -25,7 +23,7 @@ in fetchzip rec {
       The face has been re-designed with a larger glyph set, modifications of
       the original glyph shapes, and meticulous attention to metrics.
     '';
-    homepage = http://sourcefoundry.org/hack/;
+    homepage = https://sourcefoundry.org/hack/;
 
     /*
      "The font binaries are released under a license that permits unlimited
@@ -36,6 +34,7 @@ in fetchzip rec {
       the license is available in LICENSE.md" (From the GitHub page)
     */
     license = licenses.free;
+    maintainers = with maintainers; [ dywedir ];
     platforms = platforms.all;
   };
 }
diff --git a/pkgs/development/compilers/jwasm/default.nix b/pkgs/development/compilers/jwasm/default.nix
new file mode 100644
index 00000000000..9800b33e7a9
--- /dev/null
+++ b/pkgs/development/compilers/jwasm/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub
+, cmake }:
+
+with stdenv.lib;
+stdenv.mkDerivation rec {
+  name = "jwasm-${version}";
+  version = "git-2017-11-22";
+
+  src = fetchFromGitHub {
+    owner = "JWasm";
+    repo  = "JWasm";
+    rev    = "26f97c8b5c9d9341ec45538701116fa3649b7766";
+    sha256 = "0m972pc8vk8s9yv1pi85fsjgm6hj24gab7nalw2q04l0359nqi7w";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  installPhase = "mkdir -p $out/bin ; cp jwasm $out/bin/";
+
+  meta = {
+    description = "A MASM-compatible x86 assembler";
+    homepage = http://jwasm.github.io/;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = platforms.darwin ++ platforms.linux;
+  };
+}
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 54610467e7a..39b84ae6a36 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   name    = "sbcl-${version}";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchurl {
     url    = "mirror://sourceforge/project/sbcl/sbcl/${version}/${name}-source.tar.bz2";
-    sha256 = "1z8d11k6vc6jhmpwzy0nawj84qdd2jvibrvqmb1nmq3h8w64hlam";
+    sha256 = "1k6v5b8qv7vyxvh8asx6phf2hbapx5pp5p5j47hgnq123fwnh4fa";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 26511c22d0b..1983aab0e32 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -3,6 +3,7 @@
   apis ? ["*"]
 , # Whether to enable AWS' custom memory management.
   customMemoryManagement ? true
+, darwin
 }:
 
 let
@@ -29,7 +30,11 @@ in stdenv.mkDerivation rec {
   separateDebugInfo = stdenv.isLinux;
 
   nativeBuildInputs = [ cmake curl ];
-  buildInputs = [ zlib curl openssl ];
+  buildInputs = [ zlib curl openssl ]
+    ++ lib.optionals (stdenv.isDarwin &&
+                        ((builtins.elem "text-to-speech" apis) ||
+                         (builtins.elem "*" apis)))
+         (with darwin.apple_sdk.frameworks; [ CoreAudio AudioToolbox ]);
 
   cmakeFlags =
     lib.optional (!customMemoryManagement) "-DCUSTOM_MEMORY_MANAGEMENT=0"
diff --git a/pkgs/development/libraries/cpp-gsl/default.nix b/pkgs/development/libraries/cpp-gsl/default.nix
new file mode 100644
index 00000000000..ecd86354ee8
--- /dev/null
+++ b/pkgs/development/libraries/cpp-gsl/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, cmake, catch }:
+
+stdenv.mkDerivation rec {
+  pname = "GSL-unstable";
+  version = "2017-02-15";
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "Microsoft";
+    repo = "GSL";
+    rev = "c87c123d1b3e64ae2cf725584f0c004da4d90f1c";
+    sha256 = "0h8py468bvxnydkjs352d7a9s8hk0ihc7msjkcnzj2d7nzp5nsc1";
+  };
+
+  nativeBuildInputs = [ cmake catch ];
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/Microsoft/GSL;
+    description = "C++ Core Guideline support library";
+    longDescription = ''
+     The Guideline Support Library (GSL) contains functions and types that are suggested for
+     use by the C++ Core Guidelines maintained by the Standard C++ Foundation.
+     This package contains Microsoft's implementation of GSL.
+    '';
+    platforms = stdenv.lib.platforms.unix;
+    license = licenses.mit;
+    maintainers = with maintainers; [ yuriaisaka ];
+  };
+}
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
index 780008c9500..689b13a394d 100644
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -231,11 +231,11 @@ assert nvenc -> nvidia-video-sdk != null && nonfreeLicensing;
 
 stdenv.mkDerivation rec {
   name = "ffmpeg-full-${version}";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchurl {
     url = "https://www.ffmpeg.org/releases/ffmpeg-${version}.tar.xz";
-    sha256 = "1h4iz7q10wj04awr2wvmp60n7b09pfwrgwbbw9sgl7klcf52fxss";
+    sha256 = "0h6prjn1ijkzzhkyj8mazp0wpx7m0n9ycadjxagf9czqirbyk4ib";
   };
 
   prePatch = ''
diff --git a/pkgs/development/libraries/ffmpeg/3.4.nix b/pkgs/development/libraries/ffmpeg/3.4.nix
index f4cda16424c..98cbfdf43f6 100644
--- a/pkgs/development/libraries/ffmpeg/3.4.nix
+++ b/pkgs/development/libraries/ffmpeg/3.4.nix
@@ -6,7 +6,7 @@
 
 callPackage ./generic.nix (args // rec {
   version = "${branch}";
-  branch = "3.4.1";
-  sha256 = "0b2aaxx8l7g3pvs4zd3mzig44cc73savrxzfm6w0lnaa2lh3wi7k";
+  branch = "3.4.2";
+  sha256 = "0nkq4451masmzlx3p4vprqwc0sl2iwqxbzjrngmvj29q4azp00zb";
   darwinFrameworks = [ Cocoa CoreMedia ];
 })
diff --git a/pkgs/development/libraries/geis/default.nix b/pkgs/development/libraries/geis/default.nix
index 6e043f5994d..5796425e438 100644
--- a/pkgs/development/libraries/geis/default.nix
+++ b/pkgs/development/libraries/geis/default.nix
@@ -1,14 +1,20 @@
 { stdenv, fetchurl
 , pkgconfig
-, python3
+, python3Packages
+, wrapGAppsHook
+, atk
 , dbus_libs
 , evemu
 , frame
+, gdk_pixbuf
+, gobjectIntrospection
 , grail
+, gtk3
 , libX11
 , libXext
 , libXi
 , libXtst
+, pango
 , xorgserver
 }:
 
@@ -25,8 +31,23 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = "-Wno-format -Wno-misleading-indentation -Wno-error";
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ python3 dbus_libs evemu frame grail libX11 libXext libXi libXtst xorgserver ];
+  pythonPath = with python3Packages;
+    [ pygobject3  ];
+
+  nativeBuildInputs = [ pkgconfig wrapGAppsHook python3Packages.wrapPython];
+  buildInputs = [ atk dbus_libs evemu frame gdk_pixbuf gobjectIntrospection grail
+    gtk3 libX11 libXext libXi libXtst pango python3Packages.python xorgserver
+  ];
+
+  patchPhase = ''
+    substituteInPlace python/geis/geis_v2.py --replace \
+      "ctypes.util.find_library(\"geis\")" "'$out/lib/libgeis.so'"
+  '';
+
+  preFixup = ''
+    buildPythonPath "$out $pythonPath"
+    gappsWrapperArgs+=(--set PYTHONPATH "$program_PYTHONPATH")
+  '';
 
   meta = {
     description = "A library for input gesture recognition";
diff --git a/pkgs/development/libraries/glibc/2.27.nix b/pkgs/development/libraries/glibc/2.27.nix
new file mode 100644
index 00000000000..bb057ae899e
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.27.nix
@@ -0,0 +1,101 @@
+{ stdenv, callPackage
+, withLinuxHeaders ? true
+, installLocales ? true
+, profilingLibraries ? false
+, withGd ? false
+}:
+
+assert stdenv.cc.isGNU;
+
+callPackage ./common-2.27.nix { inherit stdenv; } {
+    name = "glibc" + stdenv.lib.optionalString withGd "-gd";
+
+    inherit withLinuxHeaders profilingLibraries installLocales withGd;
+
+    NIX_NO_SELF_RPATH = true;
+
+    postConfigure = ''
+      # Hack: get rid of the `-static' flag set by the bootstrap stdenv.
+      # This has to be done *after* `configure' because it builds some
+      # test binaries.
+      export NIX_CFLAGS_LINK=
+      export NIX_LDFLAGS_BEFORE=
+
+      export NIX_DONT_SET_RPATH=1
+      unset CFLAGS
+
+      # Apparently --bindir is not respected.
+      makeFlagsArray+=("bindir=$bin/bin" "sbindir=$bin/sbin" "rootsbindir=$bin/sbin")
+    '';
+
+    # The stackprotector and fortify hardening flags are autodetected by glibc
+    # and enabled by default if supported. Setting it for every gcc invocation
+    # does not work.
+    hardeningDisable = [ "stackprotector" "fortify" ];
+
+    # When building glibc from bootstrap-tools, we need libgcc_s at RPATH for
+    # any program we run, because the gcc will have been placed at a new
+    # store path than that determined when built (as a source for the
+    # bootstrap-tools tarball)
+    # Building from a proper gcc staying in the path where it was installed,
+    # libgcc_s will not be at {gcc}/lib, and gcc's libgcc will be found without
+    # any special hack.
+    preInstall = ''
+      if [ -f ${stdenv.cc.cc}/lib/libgcc_s.so.1 ]; then
+          mkdir -p $out/lib
+          cp ${stdenv.cc.cc}/lib/libgcc_s.so.1 $out/lib/libgcc_s.so.1
+          # the .so It used to be a symlink, but now it is a script
+          cp -a ${stdenv.cc.cc}/lib/libgcc_s.so $out/lib/libgcc_s.so
+      fi
+    '';
+
+    postInstall = ''
+      if test -n "$installLocales"; then
+          make -j''${NIX_BUILD_CORES:-1} -l''${NIX_BUILD_CORES:-1} localedata/install-locales
+      fi
+
+      test -f $out/etc/ld.so.cache && rm $out/etc/ld.so.cache
+
+      if test -n "$linuxHeaders"; then
+          # Include the Linux kernel headers in Glibc, except the `scsi'
+          # subdirectory, which Glibc provides itself.
+          (cd $dev/include && \
+           ln -sv $(ls -d $linuxHeaders/include/* | grep -v scsi\$) .)
+      fi
+
+      # Fix for NIXOS-54 (ldd not working on x86_64).  Make a symlink
+      # "lib64" to "lib".
+      if test -n "$is64bit"; then
+          ln -s lib $out/lib64
+      fi
+
+      # Get rid of more unnecessary stuff.
+      rm -rf $out/var $bin/bin/sln
+
+      # For some reason these aren't stripped otherwise and retain reference
+      # to bootstrap-tools; on cross-arm this stripping would break objects.
+      if [ -z "$crossConfig" ]; then
+        for i in "$out"/lib/*.a; do
+            [ "$i" = "$out/lib/libm.a" ] || strip -S "$i"
+        done
+      fi
+
+      # Put libraries for static linking in a separate output.  Note
+      # that libc_nonshared.a and libpthread_nonshared.a are required
+      # for dynamically-linked applications.
+      mkdir -p $static/lib
+      mv $out/lib/*.a $static/lib
+      mv $static/lib/lib*_nonshared.a $out/lib
+      # Some of *.a files are linker scripts where moving broke the paths.
+      sed "/^GROUP/s|$out/lib/lib|$static/lib/lib|g" \
+        -i "$static"/lib/*.a
+
+      # Work around a Nix bug: hard links across outputs cause a build failure.
+      cp $bin/bin/getconf $bin/bin/getconf_
+      mv $bin/bin/getconf_ $bin/bin/getconf
+    '';
+
+    separateDebugInfo = true;
+
+    meta.description = "The GNU C Library";
+  }
diff --git a/pkgs/development/libraries/glibc/common-2.27.nix b/pkgs/development/libraries/glibc/common-2.27.nix
new file mode 100644
index 00000000000..d493feb35fa
--- /dev/null
+++ b/pkgs/development/libraries/glibc/common-2.27.nix
@@ -0,0 +1,208 @@
+/* Build configuration used to build glibc, Info files, and locale
+   information.  */
+
+{ stdenv, lib
+, buildPlatform, hostPlatform
+, buildPackages
+, fetchurl
+, linuxHeaders ? null
+, gd ? null, libpng ? null
+, bison
+}:
+
+{ name
+, withLinuxHeaders ? false
+, profilingLibraries ? false
+, installLocales ? false
+, withGd ? false
+, meta
+, ...
+} @ args:
+
+let
+  version = "2.27";
+  patchSuffix = "";
+  sha256 = "0wpwq7gsm7sd6ysidv0z575ckqdg13cr2njyfgrbgh4f65adwwji";
+  cross = if buildPlatform != hostPlatform then hostPlatform else null;
+in
+
+assert withLinuxHeaders -> linuxHeaders != null;
+assert withGd -> gd != null && libpng != null;
+
+stdenv.mkDerivation ({
+  inherit  installLocales;
+  linuxHeaders = if withLinuxHeaders then linuxHeaders else null;
+
+  # The host/target system.
+  crossConfig = if cross != null then cross.config else null;
+
+  inherit (stdenv) is64bit;
+
+  enableParallelBuilding = true;
+
+  patches =
+    [
+      /* Have rpcgen(1) look for cpp(1) in $PATH.  */
+      ./rpcgen-path.patch
+
+      /* Allow NixOS and Nix to handle the locale-archive. */
+      ./nix-locale-archive-2.27.patch
+
+      /* Don't use /etc/ld.so.cache, for non-NixOS systems.  */
+      ./dont-use-system-ld-so-cache-2.27.patch
+
+      /* Don't use /etc/ld.so.preload, but /etc/ld-nix.so.preload.  */
+      ./dont-use-system-ld-so-preload.patch
+
+      /* The command "getconf CS_PATH" returns the default search path
+         "/bin:/usr/bin", which is inappropriate on NixOS machines. This
+         patch extends the search path by "/run/current-system/sw/bin". */
+      ./fix_path_attribute_in_getconf.patch
+
+      /* Allow running with RHEL 6 -like kernels.  The patch adds an exception
+        for glibc to accept 2.6.32 and to tag the ELFs as 2.6.32-compatible
+        (otherwise the loader would refuse libc).
+        Note that glibc will fully work only on their heavily patched kernels
+        and we lose early mismatch detection on 2.6.32.
+
+        On major glibc updates we should check that the patched kernel supports
+        all the required features.  ATM it's verified up to glibc-2.26-131.
+        # HOWTO: check glibc sources for changes in kernel requirements
+        git log -p glibc-2.25.. sysdeps/unix/sysv/linux/x86_64/kernel-features.h sysdeps/unix/sysv/linux/kernel-features.h
+        # get kernel sources (update the URL)
+        mkdir tmp && cd tmp
+        curl http://vault.centos.org/6.9/os/Source/SPackages/kernel-2.6.32-696.el6.src.rpm | rpm2cpio - | cpio -idmv
+        tar xf linux-*.bz2
+        # check syscall presence, for example
+        less linux-*?/arch/x86/kernel/syscall_table_32.S
+       */
+      ./allow-kernel-2.6.32.patch
+    ]
+    ++ lib.optional stdenv.isx86_64 ./fix-x64-abi.patch;
+
+  postPatch =
+    ''
+      # Needed for glibc to build with the gnumake 3.82
+      # http://comments.gmane.org/gmane.linux.lfs.support/31227
+      sed -i 's/ot \$/ot:\n\ttouch $@\n$/' manual/Makefile
+
+      # nscd needs libgcc, and we don't want it dynamically linked
+      # because we don't want it to depend on bootstrap-tools libs.
+      echo "LDFLAGS-nscd += -static-libgcc" >> nscd/Makefile
+    '';
+
+  configureFlags =
+    [ "-C"
+      "--enable-add-ons"
+      "--enable-obsolete-nsl"
+      "--enable-obsolete-rpc"
+      "--sysconfdir=/etc"
+      "--enable-stackguard-randomization"
+      (if withLinuxHeaders
+       then "--with-headers=${linuxHeaders}/include"
+       else "--without-headers")
+      (if profilingLibraries
+       then "--enable-profile"
+       else "--disable-profile")
+    ] ++ lib.optionals withLinuxHeaders [
+      "--enable-kernel=3.2.0" # can't get below with glibc >= 2.26
+    ] ++ lib.optionals (cross != null) [
+      (if cross ? float && cross.float == "soft" then "--without-fp" else "--with-fp")
+    ] ++ lib.optionals (cross != null) [
+      "--with-__thread"
+    ] ++ lib.optionals (cross == null && stdenv.isArm) [
+      "--host=arm-linux-gnueabi"
+      "--build=arm-linux-gnueabi"
+
+      # To avoid linking with -lgcc_s (dynamic link)
+      # so the glibc does not depend on its compiler store path
+      "libc_cv_as_needed=no"
+    ] ++ lib.optional withGd "--with-gd";
+
+  installFlags = [ "sysconfdir=$(out)/etc" ];
+
+  outputs = [ "out" "bin" "dev" "static" ];
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [ bison ];
+  buildInputs = lib.optionals withGd [ gd libpng ];
+
+  # Needed to install share/zoneinfo/zone.tab.  Set to impure /bin/sh to
+  # prevent a retained dependency on the bootstrap tools in the stdenv-linux
+  # bootstrap.
+  BASH_SHELL = "/bin/sh";
+}
+
+// (removeAttrs args [ "withLinuxHeaders" "withGd" ]) //
+
+{
+  name = name + "-${version}${patchSuffix}";
+
+  src = fetchurl {
+    url = "mirror://gnu/glibc/glibc-${version}.tar.xz";
+    inherit sha256;
+  };
+
+  # Remove absolute paths from `configure' & co.; build out-of-tree.
+  preConfigure = ''
+    export PWD_P=$(type -tP pwd)
+    for i in configure io/ftwtest-sh; do
+        # Can't use substituteInPlace here because replace hasn't been
+        # built yet in the bootstrap.
+        sed -i "$i" -e "s^/bin/pwd^$PWD_P^g"
+    done
+
+    mkdir ../build
+    cd ../build
+
+    configureScript="`pwd`/../$sourceRoot/configure"
+
+    ${lib.optionalString (stdenv.cc.libc != null)
+      ''makeFlags="$makeFlags BUILD_LDFLAGS=-Wl,-rpath,${stdenv.cc.libc}/lib"''
+    }
+
+
+  '' + lib.optionalString (cross != null) ''
+    sed -i s/-lgcc_eh//g "../$sourceRoot/Makeconfig"
+
+    cat > config.cache << "EOF"
+    libc_cv_forced_unwind=yes
+    libc_cv_c_cleanup=yes
+    libc_cv_gnu89_inline=yes
+    EOF
+  '';
+
+  preBuild = lib.optionalString withGd "unset NIX_DONT_SET_RPATH";
+
+  meta = {
+    homepage = http://www.gnu.org/software/libc/;
+    description = "The GNU C Library";
+
+    longDescription =
+      '' Any Unix-like operating system needs a C library: the library which
+         defines the "system calls" and other basic facilities such as
+         open, malloc, printf, exit...
+
+         The GNU C library is used as the C library in the GNU system and
+         most systems with the Linux kernel.
+      '';
+
+    license = lib.licenses.lgpl2Plus;
+
+    maintainers = [ lib.maintainers.eelco ];
+    platforms = lib.platforms.linux;
+  } // meta;
+}
+
+// lib.optionalAttrs (cross != null) {
+  preInstall = null; # clobber the native hook
+
+  dontStrip = true;
+
+  separateDebugInfo = false; # this is currently broken for crossDrv
+
+  # To avoid a dependency on the build system 'bash'.
+  preFixup = ''
+    rm -f $bin/bin/{ldd,tzselect,catchsegv,xtrace}
+  '';
+})
diff --git a/pkgs/development/libraries/glibc/dont-use-system-ld-so-cache-2.27.patch b/pkgs/development/libraries/glibc/dont-use-system-ld-so-cache-2.27.patch
new file mode 100644
index 00000000000..f84b1049adf
--- /dev/null
+++ b/pkgs/development/libraries/glibc/dont-use-system-ld-so-cache-2.27.patch
@@ -0,0 +1,46 @@
+diff -Naur glibc-2.27-orig/elf/ldconfig.c glibc-2.27/elf/ldconfig.c
+--- glibc-2.27-orig/elf/ldconfig.c	2018-02-01 11:17:18.000000000 -0500
++++ glibc-2.27/elf/ldconfig.c	2018-02-17 22:43:17.232175182 -0500
+@@ -51,7 +51,7 @@
+ #endif
+ 
+ #ifndef LD_SO_CONF
+-# define LD_SO_CONF SYSCONFDIR "/ld.so.conf"
++# define LD_SO_CONF PREFIX "/etc/ld.so.conf"
+ #endif
+ 
+ /* Get libc version number.  */
+diff -Naur glibc-2.27-orig/elf/Makefile glibc-2.27/elf/Makefile
+--- glibc-2.27-orig/elf/Makefile	2018-02-01 11:17:18.000000000 -0500
++++ glibc-2.27/elf/Makefile	2018-02-17 22:44:50.334006750 -0500
+@@ -559,13 +559,13 @@
+ 
+ $(objpfx)ldconfig: $(ldconfig-modules:%=$(objpfx)%.o)
+ 
+-SYSCONF-FLAGS := -D'SYSCONFDIR="$(sysconfdir)"'
+-CFLAGS-ldconfig.c += $(SYSCONF-FLAGS) -D'LIBDIR="$(libdir)"' \
++PREFIX-FLAGS := -D'PREFIX="$(prefix)"'
++CFLAGS-ldconfig.c += $(PREFIX-FLAGS) -D'LIBDIR="$(libdir)"' \
+ 		    -D'SLIBDIR="$(slibdir)"'
+ libof-ldconfig = ldconfig
+-CFLAGS-dl-cache.c += $(SYSCONF-FLAGS)
+-CFLAGS-cache.c += $(SYSCONF-FLAGS)
+-CFLAGS-rtld.c += $(SYSCONF-FLAGS)
++CFLAGS-dl-cache.c += $(PREFIX-FLAGS)
++CFLAGS-cache.c += $(PREFIX-FLAGS)
++CFLAGS-rtld.c += $(PREFIX-FLAGS)
+ 
+ cpp-srcs-left := $(all-rtld-routines:=.os)
+ lib := rtld
+diff -Naur glibc-2.27-orig/sysdeps/generic/dl-cache.h glibc-2.27/sysdeps/generic/dl-cache.h
+--- glibc-2.27-orig/sysdeps/generic/dl-cache.h	2018-02-01 11:17:18.000000000 -0500
++++ glibc-2.27/sysdeps/generic/dl-cache.h	2018-02-17 22:45:20.471598816 -0500
+@@ -28,7 +28,7 @@
+ #endif
+ 
+ #ifndef LD_SO_CACHE
+-# define LD_SO_CACHE SYSCONFDIR "/ld.so.cache"
++# define LD_SO_CACHE PREFIX "/etc/ld.so.cache"
+ #endif
+ 
+ #ifndef add_system_dir
diff --git a/pkgs/development/libraries/glibc/nix-locale-archive-2.27.patch b/pkgs/development/libraries/glibc/nix-locale-archive-2.27.patch
new file mode 100644
index 00000000000..1b3590db4fd
--- /dev/null
+++ b/pkgs/development/libraries/glibc/nix-locale-archive-2.27.patch
@@ -0,0 +1,118 @@
+diff -Naur glibc-2.27-orig/locale/loadarchive.c glibc-2.27/locale/loadarchive.c
+--- glibc-2.27-orig/locale/loadarchive.c	2018-02-01 11:17:18.000000000 -0500
++++ glibc-2.27/locale/loadarchive.c	2018-02-17 22:32:25.680169462 -0500
+@@ -123,6 +123,23 @@
+   return MAX (namehash_end, MAX (string_end, locrectab_end));
+ }
+ 
++static int
++open_locale_archive (void)
++{
++  int fd = -1;
++  char *versioned_path = getenv ("LOCAL_ARCHIVE_2_27");
++  char *path = getenv ("LOCAL_ARCHIVE");
++  if (versioned_path)
++    fd = __open_nocancel (versioned_path, O_RDONLY|O_LARGEFILE|O_CLOEXEC);
++  if (path && fd < 0)
++    fd = __open_nocancel (path, O_RDONLY|O_LARGEFILE|O_CLOEXEC);
++  if (fd < 0)
++    fd = __open_nocancel (archfname, O_RDONLY|O_LARGEFILE|O_CLOEXEC);
++  if (fd < 0)
++    fd = __open_nocancel ("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE|O_CLOEXEC);
++  return fd;
++}
++
+ 
+ /* Find the locale *NAMEP in the locale archive, and return the
+    internalized data structure for its CATEGORY data.  If this locale has
+@@ -202,7 +219,7 @@
+       archmapped = &headmap;
+ 
+       /* The archive has never been opened.  */
+-      fd = __open_nocancel (archfname, O_RDONLY|O_LARGEFILE|O_CLOEXEC);
++      fd = open_locale_archive ();
+       if (fd < 0)
+ 	/* Cannot open the archive, for whatever reason.  */
+ 	return NULL;
+@@ -397,8 +414,7 @@
+ 	  if (fd == -1)
+ 	    {
+ 	      struct stat64 st;
+-	      fd = __open_nocancel (archfname,
+-				    O_RDONLY|O_LARGEFILE|O_CLOEXEC);
++	      fd = open_locale_archive ();
+ 	      if (fd == -1)
+ 		/* Cannot open the archive, for whatever reason.  */
+ 		return NULL;
+diff -Naur glibc-2.27-orig/locale/programs/locale.c glibc-2.27/locale/programs/locale.c
+--- glibc-2.27-orig/locale/programs/locale.c	2018-02-01 11:17:18.000000000 -0500
++++ glibc-2.27/locale/programs/locale.c	2018-02-17 22:36:39.726293213 -0500
+@@ -633,6 +633,24 @@
+ 
+ 
+ static int
++open_locale_archive (void)
++{
++  int fd = -1;
++  char *versioned_path = getenv ("LOCAL_ARCHIVE_2_27");
++  char *path = getenv ("LOCAL_ARCHIVE");
++  if (versioned_path)
++    fd = open64 (versioned_path, O_RDONLY);
++  if (path && fd < 0)
++    fd = open64 (path, O_RDONLY);
++  if (fd < 0)
++    fd = open64 (ARCHIVE_NAME, O_RDONLY);
++  if (fd < 0)
++    fd = open64 ("/usr/lib/locale/locale-archive", O_RDONLY);
++  return fd;
++}
++
++
++static int
+ write_archive_locales (void **all_datap, char *linebuf)
+ {
+   struct stat64 st;
+@@ -644,7 +662,7 @@
+   int fd, ret = 0;
+   uint32_t cnt;
+ 
+-  fd = open64 (ARCHIVE_NAME, O_RDONLY);
++  fd = open_locale_archive ();
+   if (fd < 0)
+     return 0;
+ 
+diff -Naur glibc-2.27-orig/locale/programs/locarchive.c glibc-2.27/locale/programs/locarchive.c
+--- glibc-2.27-orig/locale/programs/locarchive.c	2018-02-01 11:17:18.000000000 -0500
++++ glibc-2.27/locale/programs/locarchive.c	2018-02-17 22:40:51.245293975 -0500
+@@ -117,6 +117,22 @@
+ }
+ 
+ 
++static int
++open_locale_archive (const char * archivefname, int flags)
++{
++  int fd = -1;
++  char *versioned_path = getenv ("LOCAL_ARCHIVE_2_27");
++  char *path = getenv ("LOCAL_ARCHIVE");
++  if (versioned_path)
++    fd = open64 (versioned_path, flags);
++  if (path && fd < 0)
++    fd = open64 (path, flags);
++  if (fd < 0)
++    fd = open64 (archivefname, flags);
++  return fd;
++}
++
++
+ static void
+ create_archive (const char *archivefname, struct locarhandle *ah)
+ {
+@@ -578,7 +594,7 @@
+   while (1)
+     {
+       /* Open the archive.  We must have exclusive write access.  */
+-      fd = open64 (archivefname, readonly ? O_RDONLY : O_RDWR);
++      fd = open_locale_archive (archivefname, readonly ? O_RDONLY : O_RDWR);
+       if (fd == -1)
+ 	{
+ 	  /* Maybe the file does not yet exist? If we are opening
diff --git a/pkgs/development/libraries/libav/default.nix b/pkgs/development/libraries/libav/default.nix
index 6a80a856df3..a069894f6c8 100644
--- a/pkgs/development/libraries/libav/default.nix
+++ b/pkgs/development/libraries/libav/default.nix
@@ -28,9 +28,9 @@ let inherit (stdenv.lib) optional optionals hasPrefix; in
 let
   result = {
     # e.g. https://libav.org/releases/libav-11.11.tar.xz.sha1
-    libav_0_8 = libavFun "0.8.20" "0c7a2417c3a01eb74072691bb93ce802ae1be08f";
-    libav_11  = libavFun "11.11"  "d7444fa4f135bdd7347cc962ab4b5228796b0f23";
-    libav_12  = libavFun "12.2"   "3784b15f88076ca0ab8fb6b0377e975b83a5c9f5";
+    libav_0_8 = libavFun "0.8.21" "d858f65128dad0bac1a8c3a51e5cbb27a7c79b3f";
+    libav_11  = libavFun "11.12"  "61d5dcab5fde349834af193a572b12a5fd6a4d42";
+    libav_12  = libavFun "12.3"   "386c18c8b857f23dfcf456ce40370716130211d9";
   };
 
   libavFun = version : sha1 : stdenv.mkDerivation rec {
@@ -125,7 +125,6 @@ let
       license = with licenses; if enableUnfree then unfree #ToDo: redistributable or not?
         else if enableGPL then gpl2Plus else lgpl21Plus;
       platforms = with platforms; linux ++ darwin;
-      maintainers = [ maintainers.vcunat ];
     };
   }; # libavFun
 
diff --git a/pkgs/development/libraries/qt-5/5.10/default.nix b/pkgs/development/libraries/qt-5/5.10/default.nix
index cf66e60d569..eeff3456833 100644
--- a/pkgs/development/libraries/qt-5/5.10/default.nix
+++ b/pkgs/development/libraries/qt-5/5.10/default.nix
@@ -101,10 +101,11 @@ let
       qtxmlpatterns = callPackage ../modules/qtxmlpatterns.nix {};
 
       env = callPackage ../qt-env.nix {};
-      full = env "qt-${qtbase.version}" ([
+      full = env "qt-full-${qtbase.version}" ([
         qtcharts qtconnectivity qtdeclarative qtdoc qtgraphicaleffects
-        qtimageformats qtlocation qtmultimedia qtquickcontrols qtscript
-        qtsensors qtserialport qtsvg qttools qttranslations qtwebsockets
+        qtimageformats qtlocation qtmultimedia qtquickcontrols qtquickcontrols2
+        qtscript qtsensors qtserialport qtsvg qttools qttranslations
+        qtvirtualkeyboard qtwebchannel qtwebengine qtwebkit qtwebsockets
         qtx11extras qtxmlpatterns
       ] ++ optional (!stdenv.isDarwin) qtwayland
         ++ optional (stdenv.isDarwin) qtmacextras);
diff --git a/pkgs/development/libraries/qt-5/5.6/default.nix b/pkgs/development/libraries/qt-5/5.6/default.nix
index 1200884a30c..8793b2bb9f0 100644
--- a/pkgs/development/libraries/qt-5/5.6/default.nix
+++ b/pkgs/development/libraries/qt-5/5.6/default.nix
@@ -113,7 +113,7 @@ let
       qtxmlpatterns = callPackage ../modules/qtxmlpatterns.nix {};
 
       env = callPackage ../qt-env.nix {};
-      full = env "qt-${qtbase.version}" [
+      full = env "qt-full-${qtbase.version}" [
         qtconnectivity qtdeclarative qtdoc qtgraphicaleffects qtimageformats
         qtlocation qtmultimedia qtquickcontrols qtquickcontrols2 qtscript
         qtsensors qtserialport qtsvg qttools qttranslations qtwayland
diff --git a/pkgs/development/libraries/qt-5/5.9/default.nix b/pkgs/development/libraries/qt-5/5.9/default.nix
index e0dab342162..5afcdaa430e 100644
--- a/pkgs/development/libraries/qt-5/5.9/default.nix
+++ b/pkgs/development/libraries/qt-5/5.9/default.nix
@@ -101,11 +101,12 @@ let
       qtxmlpatterns = callPackage ../modules/qtxmlpatterns.nix {};
 
       env = callPackage ../qt-env.nix {};
-      full = env "qt-${qtbase.version}" ([
+      full = env "qt-full-${qtbase.version}" ([
         qtcharts qtconnectivity qtdeclarative qtdoc qtgraphicaleffects
-        qtimageformats qtlocation qtmultimedia qtquickcontrols qtscript
-        qtsensors qtserialport qtsvg qttools qttranslations qtwebsockets
-        qtx11extras qtxmlpatterns qtvirtualkeyboard
+        qtimageformats qtlocation qtmultimedia qtquickcontrols qtquickcontrols2
+        qtscript qtsensors qtserialport qtsvg qttools qttranslations
+        qtvirtualkeyboard qtwebchannel qtwebengine qtwebkit qtwebsockets
+        qtx11extras qtxmlpatterns
       ] ++ optional (!stdenv.isDarwin) qtwayland
         ++ optional (stdenv.isDarwin) qtmacextras);
 
diff --git a/pkgs/development/libraries/qt-5/qt-env.nix b/pkgs/development/libraries/qt-5/qt-env.nix
index 728761689b4..49585f601d1 100644
--- a/pkgs/development/libraries/qt-5/qt-env.nix
+++ b/pkgs/development/libraries/qt-5/qt-env.nix
@@ -13,9 +13,9 @@ buildEnv {
     cat >"$out/bin/qt.conf" <<EOF
     [Paths]
     Prefix = $out
-    Plugins = $qtPluginPrefix
-    Qml2Imports = $qtQmlPrefix
-    Documentation = $qtDocPrefix
+    Plugins = ${qtbase.qtPluginPrefix}
+    Qml2Imports = ${qtbase.qtQmlPrefix}
+    Documentation = ${qtbase.qtDocPrefix}
     EOF
   '';
 }
diff --git a/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh b/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
index a1cfae0e606..522d2c25268 100755
--- a/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
+++ b/pkgs/development/lisp-modules/clwrapper/cl-wrapper.sh
@@ -1,4 +1,4 @@
-#!@stdenv_shell@
+#!@bash@/bin/bash
 # Part of NixPkgs package collection
 # This script can be used at your option under the same license as NixPkgs or
 # under MIT/X11 license
diff --git a/pkgs/development/lisp-modules/clwrapper/common-lisp.sh b/pkgs/development/lisp-modules/clwrapper/common-lisp.sh
index 9f5a2b80689..88948e3253d 100755
--- a/pkgs/development/lisp-modules/clwrapper/common-lisp.sh
+++ b/pkgs/development/lisp-modules/clwrapper/common-lisp.sh
@@ -1,3 +1,3 @@
-#! /bin/sh
+#!@bash@/bin/bash
 
 source "@out@"/bin/cl-wrapper.sh "${NIX_LISP_COMMAND:-$(@ls@ "@lisp@/bin"/* | @head@ -n 1)}" "$@"
diff --git a/pkgs/development/lisp-modules/clwrapper/default.nix b/pkgs/development/lisp-modules/clwrapper/default.nix
index fb4a090c702..c834ab7a305 100644
--- a/pkgs/development/lisp-modules/clwrapper/default.nix
+++ b/pkgs/development/lisp-modules/clwrapper/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, asdf, which, lisp ? null}:
+{stdenv, fetchurl, asdf, which, bash, lisp ? null}:
 stdenv.mkDerivation {
   name = "cl-wrapper-script";
 
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
 
   buildInputs = [which];
 
-  inherit asdf lisp;
+  inherit asdf lisp bash;
   stdenv_shell = stdenv.shell;
 
   setupHook = ./setup-hook.sh;
diff --git a/pkgs/development/ocaml-modules/lwt_ssl/default.nix b/pkgs/development/ocaml-modules/lwt_ssl/default.nix
new file mode 100644
index 00000000000..e53c835a291
--- /dev/null
+++ b/pkgs/development/ocaml-modules/lwt_ssl/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchzip, ocaml, findlib, jbuilder, ssl, lwt }:
+
+stdenv.mkDerivation rec {
+  version = "1.1.2";
+  name = "ocaml${ocaml.version}-lwt_ssl-${version}";
+
+  src = fetchzip {
+    url = "https://github.com/aantron/lwt_ssl/archive/${version}.tar.gz";
+    sha256 = "1q0an3djqjxv83v3iswi7m81braqx93kcrcwrxwmf6jzhdm4pn15";
+  };
+
+  buildInputs = [ ocaml findlib jbuilder ];
+  propagatedBuildInputs = [ ssl lwt ];
+
+  inherit (jbuilder) installPhase;
+
+  meta = {
+    homepage = "https://github.com/aantron/lwt_ssl";
+    description = "OpenSSL binding with concurrent I/O";
+    license = stdenv.lib.licenses.lgpl21;
+    maintainers = [ stdenv.lib.maintainers.vbgl ];
+    inherit (ocaml.meta) platforms;
+  };
+}
diff --git a/pkgs/development/python-modules/docker/default.nix b/pkgs/development/python-modules/docker/default.nix
index e0ab354173e..4ce013ac797 100644
--- a/pkgs/development/python-modules/docker/default.nix
+++ b/pkgs/development/python-modules/docker/default.nix
@@ -3,13 +3,13 @@
 , ipaddress, backports_ssl_match_hostname, docker_pycreds
 }:
 buildPythonPackage rec {
-  version = "3.0.0";
+  version = "2.7.0";
   pname = "docker";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://pypi/d/docker/${name}.tar.gz";
-    sha256 = "4a1083656c6ac7615c19094d9b5e052f36e38d0b07e63d7e506c9b5b32c3abe2";
+    sha256 = "144248308e8ea31c4863c6d74e1b55daf97cc190b61d0fe7b7313ab920d6a76c";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/micawber/default.nix b/pkgs/development/python-modules/micawber/default.nix
new file mode 100644
index 00000000000..5e3afe05ea7
--- /dev/null
+++ b/pkgs/development/python-modules/micawber/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, buildPythonPackage, fetchPypi, beautifulsoup4 }:
+
+buildPythonPackage rec {
+  pname = "micawber";
+  version = "0.3.5";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0pnq6j8f144virhri0drgf0058x6qcxfd5yrb0ynbwr8djh326yn";
+  };
+
+  propagatedBuildInputs = [ beautifulsoup4 ];
+
+  meta = with stdenv.lib; {
+    homepage = http://micawber.readthedocs.io/en/latest/;
+    description = "A small library for extracting rich content from urls";
+    license = licenses.mit;
+    longDescription = ''
+      micawber supplies a few methods for retrieving rich metadata
+      about a variety of links, such as links to youtube videos.
+      micawber also provides functions for parsing blocks of text and html
+      and replacing links to videos with rich embedded content.
+    '';
+    maintainers = with maintainers; [ davidak ];
+  };
+}
diff --git a/pkgs/development/python-modules/moinmoin/default.nix b/pkgs/development/python-modules/moinmoin/default.nix
new file mode 100644
index 00000000000..cedd45f2f22
--- /dev/null
+++ b/pkgs/development/python-modules/moinmoin/default.nix
@@ -0,0 +1,32 @@
+{ lib, buildPythonPackage, fetchurl, fetchpatch
+, pytest, werkzeug, pygments
+}:
+
+buildPythonPackage rec {
+  name = "moinmoin-${ver}";
+  ver = "1.9.9";
+
+  src = fetchurl {
+    url = "http://static.moinmo.in/files/moin-${ver}.tar.gz";
+    sha256 = "197ga41qghykmir80ik17f9hjpmixslv3zjgj7bj9qvs1dvdg5s3";
+  };
+
+  patches = [
+    # Recommended to install on their download page.
+    (fetchpatch {
+      url = "https://bitbucket.org/thomaswaldmann/moin-1.9/commits/561b7a9c2bd91b61d26cd8a5f39aa36bf5c6159e/raw";
+      sha256 = "1nscnl9nspnrwyf3n95ig0ihzndryinq9kkghliph6h55cncfc65";
+    })
+    ./fix_tests.patch
+  ];
+
+  checkInputs = [ pytest werkzeug pygments ];
+
+  meta = with lib; {
+    description = "Advanced, easy to use and extensible WikiEngine";
+
+    homepage = "http://moinmo.in/";
+
+    license = licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/development/python-modules/moinmoin/fix_tests.patch b/pkgs/development/python-modules/moinmoin/fix_tests.patch
new file mode 100644
index 00000000000..e9856eeffca
--- /dev/null
+++ b/pkgs/development/python-modules/moinmoin/fix_tests.patch
@@ -0,0 +1,16 @@
+diff -ru3 moin-1.9.9-old/MoinMoin/conftest.py moin-1.9.9-new/MoinMoin/conftest.py
+--- moin-1.9.9-old/MoinMoin/conftest.py	2016-10-31 23:44:02.000000000 +0300
++++ moin-1.9.9-new/MoinMoin/conftest.py	2018-02-18 12:13:19.551929093 +0300
+@@ -22,10 +22,11 @@
+ 
+ import atexit
+ import sys
++import os
+ 
+ import py
+ 
+-rootdir = py.magic.autopath().dirpath()
++rootdir = os.path.abspath(os.path.dirname(__file__))
+ moindir = rootdir.join("..")
+ sys.path.insert(0, str(moindir))
+ 
diff --git a/pkgs/development/python-modules/pymacaroons-pynacl/default.nix b/pkgs/development/python-modules/pymacaroons-pynacl/default.nix
new file mode 100644
index 00000000000..8bc644252c0
--- /dev/null
+++ b/pkgs/development/python-modules/pymacaroons-pynacl/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildPythonPackage, fetchFromGitHub, pynacl, six }:
+
+buildPythonPackage rec {
+  pname = "pymacaroons-pynacl";
+  version = "0.9.3";
+
+  src = fetchFromGitHub {
+    owner = "matrix-org";
+    repo = "pymacaroons";
+    rev = "v${version}";
+    sha256 = "0bykjk01zdndp6gjr30x46blsn0cvxa7j0zh5g8raxwaawchjhii";
+  };
+
+  propagatedBuildInputs = [ pynacl six ];
+
+  # Tests require an old version of hypothesis
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Macaroon library for Python";
+    homepage = https://github.com/matrix-org/pymacaroons;
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/development/python-modules/pynacl/default.nix b/pkgs/development/python-modules/pynacl/default.nix
index c23a90c095b..981427e46f3 100644
--- a/pkgs/development/python-modules/pynacl/default.nix
+++ b/pkgs/development/python-modules/pynacl/default.nix
@@ -11,11 +11,8 @@ buildPythonPackage rec {
     sha256 = "0z9i1z4hjzmp23igyhvg131gikbrr947506lwfb3fayf0agwfv8f";
   };
 
-  #remove deadline from tests, see https://github.com/pyca/pynacl/issues/370
-  preCheck = ''
-    sed -i 's/deadline=1500, //' tests/test_pwhash.py
-    sed -i 's/deadline=1500, //' tests/test_aead.py
-  '';
+  #set timeout to unlimited, remove deadline from tests, see https://github.com/pyca/pynacl/issues/370
+  patches = [ ./pynacl-no-timeout-and-deadline.patch ];
 
   checkInputs = [ pytest coverage hypothesis ];
   propagatedBuildInputs = [ libsodium cffi six ];
diff --git a/pkgs/development/python-modules/pynacl/pynacl-no-timeout-and-deadline.patch b/pkgs/development/python-modules/pynacl/pynacl-no-timeout-and-deadline.patch
new file mode 100644
index 00000000000..5f831df3c48
--- /dev/null
+++ b/pkgs/development/python-modules/pynacl/pynacl-no-timeout-and-deadline.patch
@@ -0,0 +1,49 @@
+diff --git a/tests/test_pwhash.py b/tests/test_pwhash.py
+index 9634c85..7f20316 100644
+--- a/tests/test_pwhash.py
++++ b/tests/test_pwhash.py
+@@ -20,7 +20,7 @@ import os
+ import sys
+ import unicodedata as ud
+ 
+-from hypothesis import given, settings
++from hypothesis import given, settings, unlimited
+ from hypothesis.strategies import integers, text
+ 
+ import pytest
+@@ -411,7 +411,7 @@ def test_str_verify_argon2_ref_fail(password_hash, password):
+        integers(min_value=1024 * 1024,
+                 max_value=16 * 1024 * 1024)
+        )
+-@settings(deadline=1500, max_examples=20)
++@settings(timeout=unlimited, deadline=None, max_examples=20)
+ def test_argon2i_str_and_verify(password, ops, mem):
+     _psw = password.encode('utf-8')
+     pw_hash = nacl.pwhash.argon2i.str(_psw, opslimit=ops, memlimit=mem)
+@@ -425,7 +425,7 @@ def test_argon2i_str_and_verify(password, ops, mem):
+        integers(min_value=1024 * 1024,
+                 max_value=16 * 1024 * 1024)
+        )
+-@settings(deadline=1500, max_examples=20)
++@settings(timeout=unlimited, deadline=None, max_examples=20)
+ def test_argon2id_str_and_verify(password, ops, mem):
+     _psw = password.encode('utf-8')
+     pw_hash = nacl.pwhash.argon2id.str(_psw, opslimit=ops, memlimit=mem)
+@@ -439,7 +439,7 @@ def test_argon2id_str_and_verify(password, ops, mem):
+        integers(min_value=1024 * 1024,
+                 max_value=16 * 1024 * 1024)
+        )
+-@settings(deadline=1500, max_examples=20)
++@settings(timeout=unlimited, deadline=None, max_examples=20)
+ def test_argon2i_str_and_verify_fail(password, ops, mem):
+     _psw = password.encode('utf-8')
+     pw_hash = nacl.pwhash.argon2i.str(_psw, opslimit=ops, memlimit=mem)
+@@ -448,7 +448,7 @@ def test_argon2i_str_and_verify_fail(password, ops, mem):
+ 
+ 
+ @given(text(alphabet=PASSWD_CHARS, min_size=5, max_size=20))
+-@settings(deadline=1500, max_examples=5)
++@settings(timeout=unlimited, deadline=None, max_examples=5)
+ def test_pwhash_str_and_verify(password):
+     _psw = password.encode('utf-8')
+ 
diff --git a/pkgs/development/python-modules/yarl/default.nix b/pkgs/development/python-modules/yarl/default.nix
index e40aa9d05f9..1953b1610ce 100644
--- a/pkgs/development/python-modules/yarl/default.nix
+++ b/pkgs/development/python-modules/yarl/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "yarl";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "162630v7f98l27h11msk9416lqwm2mpgxh4s636594nlbfs9by3a";
+    sha256 = "a69dd7e262cdb265ac7d5e929d55f2f3d07baaadd158c8f19caebf8dde08dfe8";
   };
 
   checkInputs = [ pytest pytestrunner ];
diff --git a/pkgs/development/qtcreator/default.nix b/pkgs/development/qtcreator/default.nix
index 0b3cf3b53f8..de94b7a8eff 100644
--- a/pkgs/development/qtcreator/default.nix
+++ b/pkgs/development/qtcreator/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "INSTALL_ROOT=$(out)" ] ++ optional withDocumentation "install_docs";
 
+  preConfigure = ''
+    substituteInPlace src/plugins/plugins.pro \
+      --replace '$$[QT_INSTALL_QML]/QtQuick/Controls' '${qtquickcontrols}/${qtbase.qtQmlPrefix}/QtQuick/Controls'
+  '';
+
   preBuild = optional withDocumentation ''
     ln -s ${getLib qtbase}/$qtDocPrefix $NIX_QT5_TMP/share
   '';
diff --git a/pkgs/development/tools/continuous-integration/jenkins/default.nix b/pkgs/development/tools/continuous-integration/jenkins/default.nix
index 1586d636087..18ca5d4d897 100644
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "jenkins-${version}";
-  version = "2.105";
+  version = "2.89.3";
 
   src = fetchurl {
-    url = "http://mirrors.jenkins-ci.org/war/${version}/jenkins.war";
-    sha256 = "0q6xyjkqlrwjgf7rzmyy8m0w7lhqyavici76zzngg159xkyh5cfh";
+    url = "http://mirrors.jenkins.io/war-stable/${version}/jenkins.war";
+    sha256 = "0flqd3r1nip9wc8sy0kiqjivgx0zkpzlkbz6n3gb1plc73lpdwbr";
   };
 
   buildCommand = ''
diff --git a/pkgs/development/tools/misc/strace/default.nix b/pkgs/development/tools/misc/strace/default.nix
index 4c02b4daf1e..6c19c51c8c8 100644
--- a/pkgs/development/tools/misc/strace/default.nix
+++ b/pkgs/development/tools/misc/strace/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "strace-${version}";
-  version = "4.20";
+  version = "4.21";
 
   src = fetchurl {
     url = "mirror://sourceforge/strace/${name}.tar.xz";
-    sha256 = "08y5b07vb8jc7ak5xc3x2kx1ly6xiwv1gnppcqjs81kks66i9wsv";
+    sha256 = "1dvrwi6v9j6b9j6852zzlc61hxgiciadi1xsl89wzbzqlkxnahbd";
   };
 
   nativeBuildInputs = [ perl ];
diff --git a/pkgs/misc/apulse/default.nix b/pkgs/misc/apulse/default.nix
index 4b2323eaa71..343dbecb22c 100644
--- a/pkgs/misc/apulse/default.nix
+++ b/pkgs/misc/apulse/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "apulse-${version}";
-  version = "0.1.10";
+  version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "i-rinat";
     repo = "apulse";
     rev = "v${version}";
-    sha256 = "018gaxn647wz1vjbr49hfrch9svnv0d1nzijc8ckb4fsr8vv95a1";
+    sha256 = "16l278q0czca2794fj388ql6qn1zrw24a0p6k7bayrrf5h32fdzd";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/misc/apulse/pressureaudio.nix b/pkgs/misc/apulse/pressureaudio.nix
new file mode 100644
index 00000000000..255fca842a7
--- /dev/null
+++ b/pkgs/misc/apulse/pressureaudio.nix
@@ -0,0 +1,82 @@
+{ stdenv, apulse, libpulseaudio, pkgconfig, intltool, autoreconfHook }:
+
+stdenv.mkDerivation {
+  name = "libpressureaudio-${apulse.version}";
+
+  src = libpulseaudio.src;
+
+  nativeBuildInputs = [ pkgconfig intltool autoreconfHook ];
+
+  configurePhase = ":";
+
+  buildPhase = ":";
+
+  installPhase = ''
+    echo "Copying libraries from apulse."
+    mkdir -p $out/lib
+    ls ${apulse}/lib/apulse $out/lib
+    cp -a ${apulse}/lib/apulse/* $out/lib/
+
+    echo "Copying headers from pulseaudio."
+    mkdir -p $out/include/pulse
+    cp -a src/pulse/*.h $out/include/pulse
+
+    echo "Generating custom pkgconfig definitions."
+    mkdir -p $out/lib/pkgconfig
+    for a in libpulse.pc libpulse-simple.pc libpulse-mainloop-glib.pc ; do
+        cat > $out/lib/pkgconfig/$a << EOF
+    prefix=$out
+    libdir=$out/lib
+    includedir=$out/include
+
+    EOF
+    done
+
+    cat >> $out/lib/pkgconfig/libpulse.pc << EOF
+    Name: libpulse
+    Description: PulseAudio Client Interface
+    Version: ${libpulseaudio.version}-rebootstrapped
+    Libs: -L$out/lib -lpulse 
+    Cflags: -I$out/include -D_REENTRANT
+    EOF
+
+    cat >> $out/lib/pkgconfig/libpulse-simple.pc << EOF
+    Name: libpulse-simple
+    Description: PulseAudio Simplified Synchronous Client Interface
+    Version: ${libpulseaudio.version}-rebootstrapped
+    Libs: -L$out/lib -lpulse-simple 
+    Cflags: -I$out/include -D_REENTRANT
+    Requires: libpulse
+    EOF
+
+    cat >> $out/lib/pkgconfig/libpulse-mainloop-glib.pc << EOF
+    Name: libpulse-mainloop-glib
+    Description: PulseAudio GLib 2.0 Main Loop Wrapper
+    Version: ${libpulseaudio.version}-rebootstrapped
+    Libs: -L$out/lib -lpulse-mainloop-glib 
+    Cflags: -I$out/include -D_REENTRANT
+    Requires: libpulse glib-2.0
+    EOF
+  '';
+
+  meta = apulse.meta // {
+    description = "libpulseaudio without any sound daemons over pure ALSA";
+    longDescription = ''
+      apulse (${apulse.meta.homepage}) implements most of libpulseaudio
+      API over pure ALSA in 5% LOC of the original PulseAudio.
+
+      But apulse is made to be used as a wrapper that substitutes its
+      replacement libs into LD_LIBRARY_PATH. The problem with that is
+      that you still have to link against the original libpulseaudio.
+
+      pressureaudio (http://git.r-36.net/pressureaudio/) wraps apulse
+      with everything you need to replace libpulseaudio completely.
+
+      This derivation is a reimplementation of pressureaudio in pure
+      nix.
+
+      You can simply override libpulseaudio with this and most
+      packages would just work.
+    '';
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 96aa426b12e..b5fd5168cf8 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,13 +3,13 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.19";
+  version = "4.14.20";
 
   # branchVersion needs to be x.y
   extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0gj7mq0dnb914mm4rari9z2cxbybskv1587606aq6f9nv1qp3kn5";
+    sha256 = "14njnspxmyzpapjzm8macrv411ss63xb39nb00xix75glqmg9dsa";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.15.nix b/pkgs/os-specific/linux/kernel/linux-4.15.nix
index 83fbfa81bf3..4bdcfba5db7 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.15.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.15.3";
+  version = "4.15.4";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "055p02in09rj95z9hc1kjh4r12ydwdcl3ds2cp4dckhlnyhnxf4g";
+    sha256 = "0fla9k90y6vaqvyjk81f59smcifcwickx4yr662m4whzkhd7wgd2";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 4316ba4cf4b..94425f4d1e4 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.115";
+  version = "4.4.116";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1pxm4r09402h4k8zgl0w1wm4vfvcaa3y7l36h50jr5wgi6l8rx2q";
+    sha256 = "18sz68gbms5rvjiy51b1dg1jlr7pwazw9fg6q5ffczk22icflvsn";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 2bb8ac1d948..80db885170e 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.81";
+  version = "4.9.82";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1bjwca7m3ksab6d23a05ciphzaj6nv6qmc5n6dxrgim0yhjpmvk4";
+    sha256 = "105im51ax2cwfqkljfi1sqh6sap6sc76zh5l9n7fpbys04khnwab";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix b/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix
index 304c085f4aa..0e39bc421c9 100644
--- a/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix
+++ b/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix
@@ -3,9 +3,9 @@
 with stdenv.lib;
 
 let
-  version = "4.15.3";
+  version = "4.15.4";
   revision = "a";
-  sha256 = "1fxdllg60hwlbmjijcj7w6c3xz0rf9268f12qy45diahmydyccgc";
+  sha256 = "0j7nla8vjrxr82nfx8dl34qk8b56piwqbndqch9rv7plgl30hkj7";
 
   # modVersion needs to be x.y.z, will automatically add .0 if needed
   modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 3f511cd2545..43b2418db77 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "0.63.2";
+  version = "0.63.3";
   components = {
     "nuimo_controller" = ps: with ps; [  ];
     "bbb_gpio" = ps: with ps; [  ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index e61d4436901..edc3539b0bd 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -44,7 +44,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "0.63.2";
+  hassVersion = "0.63.3";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -57,7 +57,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "home-assistant";
     rev = version;
-    sha256 = "057xp3l3amzxbzzdqmgbmd0qk6fz29lpdbw3zcbjigjxbdi14h2l";
+    sha256 = "1lrdrn0x8i81vbqxziv5fgcc8ldz7x5r62kfz3nyg4g43rk3dqq8";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/servers/x11/quartz-wm/default.nix b/pkgs/servers/x11/quartz-wm/default.nix
index 45e4df2bb8b..d724a81debb 100644
--- a/pkgs/servers/x11/quartz-wm/default.nix
+++ b/pkgs/servers/x11/quartz-wm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, xorg, pixman, pkgconfig, AppKit, Xplugin }:
+{ stdenv, lib, fetchurl, xorg, pixman, pkgconfig, AppKit, Xplugin, darwin }:
 
 let version = "1.3.1";
 in stdenv.mkDerivation {
@@ -19,13 +19,11 @@ in stdenv.mkDerivation {
     xorg.libXext
     pixman
     pkgconfig
-    AppKit Xplugin
+    AppKit Xplugin darwin.apple_sdk.frameworks.Foundation
   ];
-  NIX_CFLAGS_COMPILE = "-F/System/Library/Frameworks -I/usr/include";
-  NIX_LDFLAGS = stdenv.lib.optional stdenv.isDarwin
-    "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation";
   meta = with lib; {
     license = licenses.apsl20;
     platforms = platforms.darwin;
+    maintainers = with maintainers; [ matthewbauer ];
   };
 }
diff --git a/pkgs/tools/misc/yle-dl/default.nix b/pkgs/tools/misc/yle-dl/default.nix
index 2967892521c..303722aac0b 100644
--- a/pkgs/tools/misc/yle-dl/default.nix
+++ b/pkgs/tools/misc/yle-dl/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "yle-dl-${version}";
-  version = "2.30";
+  version = "2.31";
 
   src = fetchFromGitHub {
     owner = "aajanki";
     repo = "yle-dl";
     rev = version;
-    sha256 = "08qqsg0rmp4xfzmla81f0a4vblqfw3rh90wvxm91vbm6937b4i7i";
+    sha256 = "0k93p9csyjm0w33diwl5s22kzs3g78jl3n9k8nxxpqrybfjl912f";
   };
 
   propagatedBuildInputs = with pythonPackages; [ lxml pyamf pycrypto requests future ffmpeg ];
diff --git a/pkgs/tools/networking/arping/default.nix b/pkgs/tools/networking/arping/default.nix
new file mode 100644
index 00000000000..4358d22142d
--- /dev/null
+++ b/pkgs/tools/networking/arping/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, libnet, libpcap }:
+
+stdenv.mkDerivation rec {
+  version = "2.19";
+  name = "arping-${version}";
+
+  buildInputs = [ libnet libpcap ];
+
+  src = fetchFromGitHub {
+    owner = "ThomasHabets";
+    repo = "arping";
+    rev = "arping-${version}";
+    sha256 = "10gpil6ic17x8v628vhz9s98rnw1k8ci2xs56i52pr103irirczw";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  meta = with stdenv.lib; {
+    description = "Broadcasts a who-has ARP packet on the network and prints answers";
+    homepage = https://github.com/ThomasHabets/arping;
+    license = with licenses; [ gpl2 ];
+    maintainers = [ maintainers.michalrus ];
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/networking/iperf/3.nix b/pkgs/tools/networking/iperf/3.nix
index b9e47ecd7f9..8b7187f07c7 100644
--- a/pkgs/tools/networking/iperf/3.nix
+++ b/pkgs/tools/networking/iperf/3.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, openssl, fetchpatch }:
 
 stdenv.mkDerivation rec {
-  name = "iperf-3.3";
+  name = "iperf-3.4";
 
   src = fetchurl {
     url = "http://downloads.es.net/pub/iperf/${name}.tar.gz";
-    sha256 = "1n442bjkm1dvzmcj8z1i99yrmba489yz3f5v27ybymhh4mqn4nbg";
+    sha256 = "04ciywjhklzfrnp40675ssnkqxv90ad4v56i8vh8bpsiswr86lki";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/tools/package-management/conda/default.nix b/pkgs/tools/package-management/conda/default.nix
new file mode 100644
index 00000000000..4589cfcec88
--- /dev/null
+++ b/pkgs/tools/package-management/conda/default.nix
@@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, fetchurl
+, runCommand
+, makeWrapper
+, buildFHSUserEnv
+, libselinux
+, xorg
+# Conda installs its packages and environments under this directory
+, installationPath ? "~/.conda"
+# Conda manages most pkgs itself, but expects a few to be on the system.
+, condaDeps ? [ stdenv.cc xorg.libSM xorg.libICE xorg.libXrender libselinux ]
+# Any extra nixpkgs you'd like available in the FHS env for Conda to use
+, extraPkgs ? [ ]
+}:
+
+# How to use this package?
+#
+# First-time setup: this nixpkg downloads the conda installer and provides a FHS
+# env in which it can run. On first use, the user will need to install conda to
+# the installPath using the installer:
+# $ nix-env -iA conda
+# $ conda-shell
+# $ conda-install
+#
+# Under normal usage, simply call `conda-shell` to activate the FHS env,
+# and then use conda commands as normal:
+# $ conda-shell
+# $ conda install spyder
+let
+  version = "4.3.31";
+  src = fetchurl {
+      url = "https://repo.continuum.io/miniconda/Miniconda3-${version}-Linux-x86_64.sh";
+      sha256 = "1rklq81s9v7xz1q0ha99w2sl6kyc5vhk6b21cza0jr3b8cgz0lam";
+  };
+
+  conda = runCommand "conda-install" { buildInputs = [ makeWrapper ]; }
+    ''
+      mkdir -p $out/bin
+      cp ${src} $out/bin/miniconda-installer.sh
+      chmod +x $out/bin/miniconda-installer.sh
+
+      makeWrapper                            \
+        $out/bin/miniconda-installer.sh      \
+        $out/bin/conda-install               \
+        --add-flags "-p ${installationPath}" \
+        --add-flags "-b"
+    '';
+in
+  buildFHSUserEnv {
+    name = "conda-shell";
+    targetPkgs = pkgs: (builtins.concatLists [ [ conda ] condaDeps extraPkgs]);
+    profile = ''
+      # Add conda to PATH
+      export PATH=${installationPath}/bin:$PATH
+      # Paths for gcc if compiling some C sources with pip
+      export NIX_CFLAGS_COMPILE="-I${installationPath}/include"
+      export NIX_CFLAGS_LINK="-L${installationPath}lib"
+      # Some other required environment variables
+      export FONTCONFIG_FILE=/etc/fonts/fonts.conf
+      export QTCOMPOSE=${xorg.libX11}/share/X11/locale
+    '';
+
+    meta = {
+      description = "Conda is a package manager for Python";
+      homepage = https://conda.io/;
+      platforms = lib.platforms.linux;
+      license = lib.licenses.bsd3;
+      maintainers = with lib.maintainers; [ jluttine bhipple ];
+    };
+  }
diff --git a/pkgs/tools/system/ddrescue/default.nix b/pkgs/tools/system/ddrescue/default.nix
index e6af7abeda2..fc42c3b856f 100644
--- a/pkgs/tools/system/ddrescue/default.nix
+++ b/pkgs/tools/system/ddrescue/default.nix
@@ -6,11 +6,11 @@
 let inherit (stdenv.lib) optionals; in
 
 stdenv.mkDerivation rec {
-  name = "ddrescue-1.22";
+  name = "ddrescue-1.23";
 
   src = fetchurl {
     url = "mirror://gnu/ddrescue/${name}.tar.lz";
-    sha256 = "19qhx9ggkkjl0g3a88g501wmybkj1y4n5lm5kp0km0blh0p7p189";
+    sha256 = "13cd6c0x91zq10vdlyl6r5rib47bmsn5sshmkin3igwj8pa2vbm9";
   };
 
   nativeBuildInputs = [ lzip ];
diff --git a/pkgs/tools/system/fio/default.nix b/pkgs/tools/system/fio/default.nix
index 89fb5f05ac9..1c98f712693 100644
--- a/pkgs/tools/system/fio/default.nix
+++ b/pkgs/tools/system/fio/default.nix
@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, libaio, python, zlib }:
 
 let
-  version = "3.3";
-  sha256 = "0ipdpdn6rlsbppqjddyyk8c6rg1dl17d62dwwm0ijybi0m7imy1p";
+  version = "3.4";
+  sha256 = "0img4288ygil36bsgpr4yh06zfbp3mdkf7zbyqjcrjgpr4mai9zf";
 in
 
 stdenv.mkDerivation rec {
diff --git a/pkgs/tools/text/catdocx/default.nix b/pkgs/tools/text/catdocx/default.nix
new file mode 100644
index 00000000000..adf9d17815b
--- /dev/null
+++ b/pkgs/tools/text/catdocx/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, lib, fetchFromGitHub, makeWrapper, unzip, catdoc }:
+
+stdenv.mkDerivation {
+  name = "catdocx-20170102";
+
+  src = fetchFromGitHub {
+    owner = "jncraton";
+    repo = "catdocx";
+    rev = "04fa0416ec1f116d4996685e219f0856d99767cb";
+    sha256 = "1sxiqhkvdqn300ygfgxdry2dj2cqzjhkzw13c6349gg5vxfypcjh";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    mkdir -p $out/libexec $out/bin
+    cp catdocx.sh $out/libexec
+    chmod +x $out/libexec/catdocx.sh
+    wrapProgram $out/libexec/catdocx.sh --prefix PATH : "${lib.makeBinPath [ unzip catdoc ]}"
+    ln -s $out/libexec/catdocx.sh $out/bin/catdocx
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Extracts plain text from docx files";
+    homepage = https://github.com/jncraton/catdocx;
+    license = with licenses; [ bsd3 ];
+    maintainers = [ maintainers.michalrus ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7e5a97490ad..925cd63a714 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -489,6 +489,8 @@ with pkgs;
 
   apulse = callPackage ../misc/apulse { };
 
+  libpressureaudio = callPackage ../misc/apulse/pressureaudio.nix { };
+
   archivemount = callPackage ../tools/filesystems/archivemount { };
 
   arandr = callPackage ../tools/X11/arandr { };
@@ -929,6 +931,8 @@ with pkgs;
 
   catdoc = callPackage ../tools/text/catdoc { };
 
+  catdocx = callPackage ../tools/text/catdocx { };
+
   catclock = callPackage ../applications/misc/catclock { };
 
   cde = callPackage ../tools/package-management/cde { };
@@ -1366,6 +1370,8 @@ with pkgs;
 
   appdata-tools = callPackage ../tools/misc/appdata-tools { };
 
+  arping = callPackage ../tools/networking/arping { };
+
   asciidoc = callPackage ../tools/typesetting/asciidoc {
     inherit (python2Packages) matplotlib numpy aafigure recursivePthLoader;
     w3m = w3m-batch;
@@ -1675,6 +1681,8 @@ with pkgs;
 
   checkbashisms = callPackage ../development/tools/misc/checkbashisms { };
 
+  ckb = libsForQt5.callPackage ../tools/misc/ckb { };
+
   clamav = callPackage ../tools/security/clamav { };
 
   clex = callPackage ../tools/misc/clex { };
@@ -1697,10 +1705,10 @@ with pkgs;
 
   cloud-utils = callPackage ../tools/misc/cloud-utils { };
 
-  ckb = libsForQt5.callPackage ../tools/misc/ckb { };
-
   compass = callPackage ../development/tools/compass { };
 
+  conda = callPackage ../tools/package-management/conda { };
+
   convmv = callPackage ../tools/misc/convmv { };
 
   convoy = callPackage ../tools/filesystems/convoy { };
@@ -5746,7 +5754,8 @@ with pkgs;
 
   compcert = callPackage ../development/compilers/compcert { };
 
-
+  cpp-gsl = callPackage ../development/libraries/cpp-gsl { };
+  
   # Users installing via `nix-env` will likely be using the REPL,
   # which has a hard dependency on Z3, so make sure it is available.
   cryptol = haskellPackages.cryptol.overrideDerivation (oldAttrs: {
@@ -6366,6 +6375,8 @@ with pkgs;
 
   julia = julia_06;
 
+  jwasm =  callPackage ../development/compilers/jwasm { };
+
   kotlin = callPackage ../development/compilers/kotlin { };
 
   lazarus = callPackage ../development/compilers/fpc/lazarus.nix {
@@ -8743,6 +8754,9 @@ with pkgs;
   glibc = callPackage ../development/libraries/glibc {
     installLocales = config.glibc.locales or false;
   };
+  glibc_2_27 = callPackage ../development/libraries/glibc/2.27.nix {
+    installLocales = config.glibc.locales or false;
+  };
 
   glibc_memusage = callPackage ../development/libraries/glibc {
     installLocales = false;
@@ -13874,6 +13888,8 @@ with pkgs;
 
   faba-mono-icons = callPackage ../data/icons/faba-mono-icons { };
 
+  fixedsys-excelsior = callPackage ../data/fonts/fixedsys-excelsior { };
+
   emacs-all-the-icons-fonts = callPackage ../data/fonts/emacs-all-the-icons-fonts { };
 
   emojione = callPackage ../data/fonts/emojione {
@@ -16894,6 +16910,8 @@ with pkgs;
     inherit (darwin.stubs) rez setfile;
   };
 
+  qemu-riscv = callPackage ../applications/virtualization/qemu/riscv.nix {};
+
   qgis = callPackage ../applications/gis/qgis {};
 
   qgroundcontrol = libsForQt5.callPackage ../applications/science/robotics/qgroundcontrol { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index c44124c3fff..1fffa3fa800 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -375,6 +375,10 @@ let
       lwt = lwt3;
     };
 
+    lwt_ssl = callPackage ../development/ocaml-modules/lwt_ssl {
+      lwt = lwt3;
+    };
+
     macaque = callPackage ../development/ocaml-modules/macaque { };
 
     magic-mime = callPackage ../development/ocaml-modules/magic-mime { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 5608cd85ef2..0eebd578c3a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10139,6 +10139,8 @@ in {
     };
   };
 
+  micawber = callPackage ../development/python-modules/micawber { };
+
   minimock = buildPythonPackage rec {
     version = "1.2.8";
     name = "minimock-${version}";
@@ -10372,24 +10374,8 @@ in {
     };
   };
 
-  moinmoin = buildPythonPackage (rec {
-    name = "moinmoin-${ver}";
-    disabled = isPy3k;
-    ver = "1.9.8";
-
-    src = pkgs.fetchurl {
-      url = "http://static.moinmo.in/files/moin-${ver}.tar.gz";
-      sha256 = "19hi16iy75lpx9ch799djc4hr4gai5rmvi542n29x6zhikysfjx7";
-    };
-
-    meta = {
-      description = "Advanced, easy to use and extensible WikiEngine";
-
-      homepage = http://moinmo.in/;
-
-      license = licenses.gpl2Plus;
-    };
-  });
+  # Needed here because moinmoin is loaded as a Python library.
+  moinmoin = callPackage ../development/python-modules/moinmoin { };
 
   moretools = callPackage ../development/python-modules/moretools { };
 
@@ -19960,18 +19946,7 @@ EOF
     propagatedBuildInputs = with self; [];
   };
 
-  pymacaroons-pynacl = buildPythonPackage rec {
-    name = "pymacaroons-pynacl-${version}";
-    version = "0.9.3";
-
-    src = pkgs.fetchgit {
-      url = "https://github.com/matrix-org/pymacaroons.git";
-      rev = "refs/tags/v${version}";
-      sha256 = "0bykjk01zdndp6gjr30x46blsn0cvxa7j0zh5g8raxwaawchjhii";
-    };
-
-    propagatedBuildInputs = with self; [ pynacl six ];
-  };
+  pymacaroons-pynacl = callPackage ../development/python-modules/pymacaroons-pynacl { };
 
   pynacl = callPackage ../development/python-modules/pynacl { };