diff --git a/pkgs/applications/graphics/solvespace/default.nix b/pkgs/applications/graphics/solvespace/default.nix
index d4500186502..ab5a81d6add 100644
--- a/pkgs/applications/graphics/solvespace/default.nix
+++ b/pkgs/applications/graphics/solvespace/default.nix
@@ -9,6 +9,12 @@ stdenv.mkDerivation {
     rev = "e587d0e";
   };
 
+  # Fixup build after glibc-2.25.
+  postPatch = ''
+    sed 's/\<CHAR_WIDTH\>/CHARWIDTH/g' \
+      -i src/{fltk/fltkmain.cpp,glhelper.cpp,textwin.cpp,toolbar.cpp,ui.h}
+  '';
+
   # e587d0e fails with undefined reference errors if make is called
   # twice. Ugly workaround: Build while installing.
   dontBuild = true;
diff --git a/pkgs/applications/networking/instant-messengers/ekiga/default.nix b/pkgs/applications/networking/instant-messengers/ekiga/default.nix
index 9c7204b7fa1..575759ad437 100644
--- a/pkgs/applications/networking/instant-messengers/ekiga/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ekiga/default.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
     description = "VOIP/Videoconferencing app with full SIP and H.323 support";
     maintainers = [ maintainers.raskin ];
     platforms = platforms.linux;
+    broken = true; # because of glibc-2.25
   };
 
   passthru = {
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix
index 78fa090f925..4c0e0f11e7b 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@@ -33,6 +33,9 @@ stdenv.mkDerivation rec {
      sed -i 's,etc/vmware-tools,''${prefix}/etc/vmware-tools,' services/vmtoolsd/Makefile.am
      sed -i 's,$(PAM_PREFIX),''${prefix}/$(PAM_PREFIX),' services/vmtoolsd/Makefile.am
      sed -i 's,$(UDEVRULESDIR),''${prefix}/$(UDEVRULESDIR),' udev/Makefile.am
+
+     # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
+     sed 1i'#include <sys/sysmacros.h>' -i lib/wiper/wiperPosix.c
   '';
 
   configureFlags = [ "--without-kernel-modules" "--without-xmlsecurity" ]
diff --git a/pkgs/applications/virtualization/xen/generic.nix b/pkgs/applications/virtualization/xen/generic.nix
index a697e2aa7ef..9943d70fa8c 100644
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@@ -74,6 +74,11 @@ stdenv.mkDerivation {
       ${flip concatMapStrings xenExtfiles (x: let src = fetchurl x; in ''
         cp ${src} xen_ext_files/${src.name}
       '')}
+
+      # Avoid a glibc >= 2.25 deprecation warnings that get fatal via -Werror.
+      sed 1i'#include <sys/sysmacros.h>' \
+        -i tools/blktap2/control/tap-ctl-allocate.c \
+        -i tools/libxl/libxl_device.c
   '';
 
   preConfigure = ''
diff --git a/pkgs/development/compilers/dmd/2.067.1.nix b/pkgs/development/compilers/dmd/2.067.1.nix
index 66264346102..4dbe922ce81 100644
--- a/pkgs/development/compilers/dmd/2.067.1.nix
+++ b/pkgs/development/compilers/dmd/2.067.1.nix
@@ -19,7 +19,11 @@ stdenv.mkDerivation {
       # Was not able to compile on darwin due to "__inline_isnanl"
       # being undefined.
       substituteInPlace src/dmd/root/port.c --replace __inline_isnanl __inline_isnan
-  '';
+  ''
+    + stdenv.lib.optionalString stdenv.isLinux ''
+        substituteInPlace src/dmd/root/port.c \
+          --replace "#include <bits/mathdef.h>" "#include <complex.h>"
+      '';
 
   # Buid and install are based on http://wiki.dlang.org/Building_DMD
   buildPhase = ''
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 15b21b5bed9..ccf9296e0bc 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -66,6 +66,8 @@ let
       # libuuid, slowing down program startup a lot).
       ./no-ldconfig.patch
 
+      ./glibc-2.25-enosys.patch
+
     ] ++ optionals stdenv.isCygwin [
       ./2.5.2-ctypes-util-find_library.patch
       ./2.5.2-tkinter-x11.patch
diff --git a/pkgs/development/interpreters/python/cpython/2.7/glibc-2.25-enosys.patch b/pkgs/development/interpreters/python/cpython/2.7/glibc-2.25-enosys.patch
new file mode 100644
index 00000000000..31da78e35f1
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/2.7/glibc-2.25-enosys.patch
@@ -0,0 +1,15 @@
+https://bugs.python.org/issue29157
+https://github.com/python/cpython/commit/01bdbad3e951
+diff --git a/Python/random.c b/Python/random.c
+index 2f83b5d..0b775ec 100644
+--- a/Python/random.c
++++ b/Python/random.c
+@@ -98,7 +98,7 @@ win32_urandom(unsigned char *buffer, Py_ssize_t size, int raise)
+ 
+ /* Issue #25003: Don't use getentropy() on Solaris (available since
+  * Solaris 11.3), it is blocking whereas os.urandom() should not block. */
+-#elif defined(HAVE_GETENTROPY) && !defined(sun)
++#elif defined(HAVE_GETENTROPY) && !defined(sun) && !defined(linux)
+ #define PY_GETENTROPY 1
+ 
+ /* Fill buffer with size pseudo-random bytes generated by getentropy().
diff --git a/pkgs/development/interpreters/python/cpython/3.4/default.nix b/pkgs/development/interpreters/python/cpython/3.4/default.nix
index 66bdd2a4227..72419f8e194 100644
--- a/pkgs/development/interpreters/python/cpython/3.4/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.4/default.nix
@@ -57,7 +57,14 @@ in stdenv.mkDerivation {
 
   postPatch = optionalString (x11Support && (tix != null)) ''
     substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
-  '';
+  ''
+    # Avoid picking up getentropy() from glibc >= 2.25, as that would break
+    # on older kernels.  http://bugs.python.org/issue29157
+    + optionalString stdenv.isLinux
+      ''
+        substituteInPlace Python/random.c --replace 'defined(HAVE_GETENTROPY)' '0'
+        cat Python/random.c
+      '';
 
   preConfigure = ''
     for i in /usr /sw /opt /pkg; do	# improve purity
diff --git a/pkgs/development/interpreters/python/cpython/3.5/default.nix b/pkgs/development/interpreters/python/cpython/3.5/default.nix
index 6e0b7614c7c..215229086b7 100644
--- a/pkgs/development/interpreters/python/cpython/3.5/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.5/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ stdenv, fetchurl, fetchpatch
 , bzip2
 , gdbm
 , lzma
@@ -55,6 +55,14 @@ in stdenv.mkDerivation {
     substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
   '';
 
+  patches = [
+    (fetchpatch {
+      name = "glibc-2.25-enosys.patch";
+      url = https://github.com/python/cpython/commit/035ba5da3e53e.patch;
+      sha256 = "1y74ir1w5cq542w27rgzgp70chhq2x047db9911mihpab8p2nj71";
+    })
+  ];
+
   postPatch = optionalString (x11Support && (tix != null)) ''
     substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
   '';
diff --git a/pkgs/development/interpreters/python/cpython/3.6/default.nix b/pkgs/development/interpreters/python/cpython/3.6/default.nix
index 795bd746725..42f8d109af2 100644
--- a/pkgs/development/interpreters/python/cpython/3.6/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.6/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ stdenv, fetchurl, fetchpatch
 , glibc
 , bzip2
 , gdbm
@@ -55,6 +55,14 @@ in stdenv.mkDerivation {
     substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
   '';
 
+  patches = [
+    (fetchpatch {
+      name = "glibc-2.25-failed-to-get-random-numbers.patch";
+      url = https://github.com/python/cpython/commit/ff558f5aba4.patch;
+      sha256 = "1k12gpn69np94cm942vaf40sv7gsxqf20rv1m3parzgi1gs4hqa3";
+    })
+  ];
+
   postPatch = optionalString (x11Support && (tix != null)) ''
     substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
   '';
diff --git a/pkgs/development/interpreters/python/wrap.sh b/pkgs/development/interpreters/python/wrap.sh
index f4b63b82640..55998bc5b41 100644
--- a/pkgs/development/interpreters/python/wrap.sh
+++ b/pkgs/development/interpreters/python/wrap.sh
@@ -47,7 +47,7 @@ wrapPythonProgramsIn() {
     buildPythonPath "$pythonPath"
 
     # Find all regular files in the output directory that are executable.
-    for f in $(find "$dir" -type f -perm -0100); do
+    find "$dir" -type f -perm -0100 -print0 | while read -d "" f; do
         # Rewrite "#! .../env python" to "#! /nix/store/.../python".
         # Strip suffix, like "3" or "2.7m" -- we don't have any choice on which
         # Python to use besides one with this hook anyway.
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 7075874adf8..6f7a845b809 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -6,8 +6,8 @@ assert x11Support -> libX11 != null
                   && libSM != null;
 
 let
-  version = "1.10.14";
-  sha256 = "10x0wvv2ly4lyyfd42k4xw0ar5qdbi9cksw3l5fcwf1y6mq8y8r3";
+  version = "1.10.16";
+  sha256 = "121kqkjsd3vgf8vca8364xl44qa5086h7qy5zs5f1l78ldpbmc57";
 
 self = stdenv.mkDerivation {
     name = "dbus-${version}";
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index 0130ee2a014..14983b744df 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -28,7 +28,17 @@ stdenv.mkDerivation rec {
       src = ./config-compat.patch;
       inherit configVersion;
     })
+    (fetchpatch {
+      name = "glibc-2.25.diff";
+      url = "https://cgit.freedesktop.org/fontconfig/patch/?id=1ab5258f7c";
+      sha256 = "0x2a4qx51j3gqcp1kp4lisdzmhrkw1zw0r851d82ksgjlc0vkbaz";
+    })
   ];
+  # additionally required for the glibc-2.25 patch; avoid requiring gperf
+  postPatch = ''
+    sed s/CHAR_WIDTH/CHARWIDTH/g -i src/fcobjshash.{h,gperf}
+    touch src/*
+  '';
 
   outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config
 
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 6ac8a134b1f..af4bfc0709e 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -3,14 +3,14 @@
 
 let
   ver_maj = "2.36";
-  ver_min = "4";
+  ver_min = "5";
 in
 stdenv.mkDerivation rec {
   name = "gdk-pixbuf-${ver_maj}.${ver_min}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdk-pixbuf/${ver_maj}/${name}.tar.xz";
-    sha256 = "0b19901c3eb0596141d2d48ddb9dac79ad1524bdf59366af58ab38fcb9ee7463";
+    sha256 = "7ace06170291a1f21771552768bace072ecdea9bd4a02f7658939b9a314c40fc";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index c7c704c641f..9eb71fc708f 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -43,7 +43,7 @@ let
   '';
 
   ver_maj = "2.50";
-  ver_min = "2";
+  ver_min = "3";
 in
 
 stdenv.mkDerivation rec {
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${ver_maj}/${name}.tar.xz";
-    sha256 = "be68737c1f268c05493e503b3b654d2b7f43d7d0b8c5556f7e4651b870acfbf5";
+    sha256 = "82ee94bf4c01459b6b00cb9db0545c2237921e3060c0b74cff13fbc020cfd999";
   };
 
   patches = optional stdenv.isDarwin ./darwin-compilation.patch ++ optional doCheck ./skip-timer-test.patch;
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 32c1b364737..7128f560619 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -10,8 +10,8 @@ cross:
 , preConfigure ? "", ... }@args:
 
 let
-  version = "2.24";
-  sha256 = "1ghzp41ryvsqxn4rhrm8r25wc33m2jf8zrcc1pj3jxyk8ad9a0by";
+  version = "2.25";
+  sha256 = "067bd9bb3390e79aa45911537d13c3721f1d9d3769931a30c2681bfee66f23a0";
 in
 
 assert cross != null -> gccCross != null;
@@ -138,7 +138,7 @@ stdenv.mkDerivation ({
     lib.optionalString (cross != null) "-${cross.config}";
 
   src = fetchurl {
-    url = "mirror://gnu/glibc/glibc-${version}.tar.gz";
+    url = "mirror://gnu/glibc/glibc-${version}.tar.xz";
     inherit sha256;
   };
 
diff --git a/pkgs/development/libraries/glibc/default.nix b/pkgs/development/libraries/glibc/default.nix
index d6c496819da..4f9eb2d0714 100644
--- a/pkgs/development/libraries/glibc/default.nix
+++ b/pkgs/development/libraries/glibc/default.nix
@@ -81,7 +81,7 @@ in
       # to bootstrap-tools; on cross-arm this stripping would break objects.
       if [ -z "$crossConfig" ]; then
         for i in "$out"/lib/*.a; do
-            strip -S "$i"
+            [ "$i" = "$out/lib/libm.a" ] || strip -S "$i"
         done
       fi
 
@@ -91,6 +91,9 @@ in
       mkdir -p $static/lib
       mv $out/lib/*.a $static/lib
       mv $static/lib/lib*_nonshared.a $out/lib
+      # Some of *.a files are linker scripts where moving broke the paths.
+      sed "/^GROUP/s|$out/lib/lib|$static/lib/lib|g" \
+        -i "$static"/lib/*.a
 
       # Work around a Nix bug: hard links across outputs cause a build failure.
       cp $bin/bin/getconf $bin/bin/getconf_
diff --git a/pkgs/development/libraries/gnutls/3.4.nix b/pkgs/development/libraries/gnutls/3.4.nix
deleted file mode 100644
index 0cb2c67c501..00000000000
--- a/pkgs/development/libraries/gnutls/3.4.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{ callPackage, fetchurl, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "3.4.17";
-
-  src = fetchurl {
-    url = "ftp://ftp.gnutls.org/gcrypt/gnutls/v3.4/gnutls-${version}.tar.xz";
-    sha256 = "0bhp8cqrmw15yins65cn0zwbcpj1vmymr4wnbm151sfmf2kfhl4v";
-  };
-})
diff --git a/pkgs/development/libraries/gnutls/3.5.nix b/pkgs/development/libraries/gnutls/3.5.nix
index a5076b9d498..8bb1a2d97f7 100644
--- a/pkgs/development/libraries/gnutls/3.5.nix
+++ b/pkgs/development/libraries/gnutls/3.5.nix
@@ -7,6 +7,4 @@ callPackage ./generic.nix (args // rec {
     url = "ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-${version}.tar.xz";
     sha256 = "0l9971841jsfdcvcyhas17sk5rsby6x5vvwcmmj4x3zi9q60zcc2";
   };
-
-  buildInputs = [ libunistring ];
 })
diff --git a/pkgs/development/libraries/gnutls/generic.nix b/pkgs/development/libraries/gnutls/generic.nix
index 74737eb2389..cf298baf48a 100644
--- a/pkgs/development/libraries/gnutls/generic.nix
+++ b/pkgs/development/libraries/gnutls/generic.nix
@@ -1,6 +1,6 @@
 { lib, fetchurl, stdenv, zlib, lzo, libtasn1, nettle, pkgconfig, lzip
 , guileBindings, guile, perl, gmp, autogen, libidn, p11_kit, unbound, libiconv
-, tpmSupport ? false, trousers, nettools, bash
+, tpmSupport ? false, trousers, nettools, libunistring
 
 # Version dependent args
 , version, src, patches ? [], postPatch ? "", nativeBuildInputs ? []
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ lzo lzip libtasn1 libidn p11_kit zlib gmp autogen ]
+  buildInputs = [ lzo lzip libtasn1 libidn p11_kit zlib gmp autogen libunistring ]
     ++ lib.optional doCheck nettools
     ++ lib.optional (stdenv.isFreeBSD || stdenv.isDarwin) libiconv
     ++ lib.optional (tpmSupport && stdenv.isLinux) trousers
@@ -58,6 +58,10 @@ stdenv.mkDerivation {
         -e 's,-L${gmp.dev}/lib,-L${gmp.out}/lib,' \
         -e 's,-lgmp,-L${gmp.out}/lib -lgmp,' \
         -i $out/lib/*.la "$dev/lib/pkgconfig/gnutls.pc"
+  '' + ''
+    # It seems only useful for static linking but basically noone does that.
+    substituteInPlace "$out/lib/libgnutls.la" \
+      --replace "-lunistring" ""
   '';
 
   meta = with lib; {
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index bf63c9425ae..d21fef3e674 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -13,7 +13,7 @@ with stdenv.lib;
 
 let
   ver_maj = "3.22";
-  ver_min = "7";
+  ver_min = "8";
   version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "a3a27564bfb1679ebbc75c37cd2bcd6e727c8bdfbcd3984d29305bf9ee60d432";
+    sha256 = "c7254a88df5c17e9609cee9e848c3d0104512707edad4c3b4f256b131f8d3af1";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 95946cb8284..662767b6678 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation rec {
 
   patches = stdenv.lib.optional stdenv.isDarwin [ ./clang.patch ];
 
+  outputs = [ "out" "dev" "info" "doc" ];
+
   propagatedBuildInputs = stdenv.lib.optional (!stdenv.isLinux) libiconv;
 
   configureFlags = [
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 2b062f58b24..2a1c82ec639 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -2,14 +2,14 @@
 , ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.10.1";
+  version = "1.11.0";
   name = "libuv-${version}";
 
   src = fetchFromGitHub {
     owner = "libuv";
     repo = "libuv";
     rev = "v${version}";
-    sha256 = "0gna53fgsjjs38kv1g20xfaalv0fk3xncb6abga3saswrv283hx0";
+    sha256 = "02sm7f3l0shpfz25b77q2jjvlypc1mmz4zpzfgfmiplhgxxaa6la";
   };
 
   postPatch = let
@@ -23,8 +23,8 @@ stdenv.mkDerivation rec {
       sed '/${tdRegexp}/d' -i test/test-list.h
     '';
 
-  buildInputs = [ automake autoconf libtool pkgconfig ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ ApplicationServices CoreServices ];
+  nativeBuildInputs = [ automake autoconf libtool pkgconfig ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ ApplicationServices CoreServices ];
 
   preConfigure = ''
     LIBTOOLIZE=libtoolize ./autogen.sh
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index abca82e6297..08fb80c8435 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -27,7 +27,7 @@ if ! lists.elem stdenv.system platforms.mesaPlatforms then
 else
 
 let
-  version = "13.0.4";
+  version = "13.0.5";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "a95d7ce8f7bd5f88585e4be3144a341236d8c0fc91f6feaec59bb8ba3120e726";
+    sha256 = "bfcea7e2c801525a60895c8aff11aa68457ee9aa35d01a4638e1f310a3f5ef87";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/tools/build-managers/cmake/default.nix b/pkgs/development/tools/build-managers/cmake/default.nix
index 31870fdaf20..9f607a60b59 100644
--- a/pkgs/development/tools/build-managers/cmake/default.nix
+++ b/pkgs/development/tools/build-managers/cmake/default.nix
@@ -13,7 +13,7 @@ with stdenv.lib;
 let
   os = stdenv.lib.optionalString;
   majorVersion = "3.7";
-  minorVersion = "1";
+  minorVersion = "2";
   version = "${majorVersion}.${minorVersion}";
 in
 
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}files/v${majorVersion}/cmake-${version}.tar.gz";
-    # from https://cmake.org/files/v3.7/cmake-3.7.1-SHA-256.txt
-    sha256 = "449a5bce64dbd4d5b9517ebd1a1248ed197add6ad27934478976fd5f1f9330e1";
+    # from https://cmake.org/files/v3.7/cmake-3.7.2-SHA-256.txt
+    sha256 = "dc1246c4e6d168ea4d6e042cfba577c1acd65feea27e56f5ff37df920c30cae0";
   };
 
   prePatch = optionalString (!useSharedLibraries) ''
diff --git a/pkgs/development/tools/xcbuild/default.nix b/pkgs/development/tools/xcbuild/default.nix
index 99859ed9640..0fc56827de8 100644
--- a/pkgs/development/tools/xcbuild/default.nix
+++ b/pkgs/development/tools/xcbuild/default.nix
@@ -31,6 +31,12 @@ in stdenv.mkDerivation rec {
     cp -r --no-preserve=all ${linenoise} ThirdParty/linenoise
   '';
 
+  # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
+  postPatch = ''
+    sed 1i'#include <sys/sysmacros.h>' \
+      -i Libraries/xcassets/Headers/xcassets/Slot/SystemVersion.h
+  '';
+
   enableParallelBuilding = true;
 
   # TODO: instruct cmake not to put it in /usr, rather than cleaning up
diff --git a/pkgs/misc/emulators/dolphin-emu/default.nix b/pkgs/misc/emulators/dolphin-emu/default.nix
index bb5b12038f8..db510024241 100644
--- a/pkgs/misc/emulators/dolphin-emu/default.nix
+++ b/pkgs/misc/emulators/dolphin-emu/default.nix
@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
     sha256 = "07mlfnh0hwvk6xarcg315x7z2j0qbg9g7cm040df9c8psiahc3g6";
   };
 
+  postPatch = ''
+    substituteInPlace Source/Core/VideoBackends/OGL/RasterFont.cpp \
+      --replace " CHAR_WIDTH " " CHARWIDTH "
+  '';
+
   cmakeFlags = ''
     -DGTK2_GLIBCONFIG_INCLUDE_DIR=${glib.out}/lib/glib-2.0/include
     -DGTK2_GDKCONFIG_INCLUDE_DIR=${gtk2.out}/lib/gtk-2.0/include
diff --git a/pkgs/misc/emulators/dolphin-emu/master.nix b/pkgs/misc/emulators/dolphin-emu/master.nix
index 990870d35d6..499e1177c3e 100644
--- a/pkgs/misc/emulators/dolphin-emu/master.nix
+++ b/pkgs/misc/emulators/dolphin-emu/master.nix
@@ -12,6 +12,12 @@ stdenv.mkDerivation rec {
     fetchSubmodules = false;
   };
 
+  postPatch = ''
+    for f in Source/Core/VideoBackends/{Software,OGL}/RasterFont.{h,cpp}; do
+      substituteInPlace "$f" --replace " CHAR_WIDTH " " CHARWIDTH "
+    done
+  '';
+
   cmakeFlags = ''
     -DGTK2_GLIBCONFIG_INCLUDE_DIR=${glib.out}/lib/glib-2.0/include
     -DGTK2_GDKCONFIG_INCLUDE_DIR=${gtk2.out}/lib/gtk-2.0/include
diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix
index efca4c7bbb5..f04f6f89760 100644
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@@ -22,6 +22,9 @@ stdenv.mkDerivation rec {
     substituteInPlace ./criu/Makefile --replace "-I/usr/include/libnl3" "-I${libnl.dev}/include/libnl3"
     substituteInPlace ./Makefile --replace "tar-name := $(shell git tag -l v$(CRIU_VERSION))" "tar-name = 2.0" # --replace "-Werror" ""
     ln -sf ${protobuf}/include/google/protobuf/descriptor.proto ./images/google/protobuf/descriptor.proto
+
+    # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
+    sed 1i'#include <sys/sysmacros.h>' -i criu/include/util.h
   '';
 
   buildPhase = "make PREFIX=$out";
diff --git a/pkgs/os-specific/linux/fatrace/default.nix b/pkgs/os-specific/linux/fatrace/default.nix
index 09da891a175..f68856f6b86 100644
--- a/pkgs/os-specific/linux/fatrace/default.nix
+++ b/pkgs/os-specific/linux/fatrace/default.nix
@@ -14,6 +14,9 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace power-usage-report \
       --replace "'which'" "'${which}/bin/which'"
+
+    # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
+    sed 1i'#include <sys/sysmacros.h>' -i fatrace.c
   '';
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/os-specific/linux/reptyr/default.nix b/pkgs/os-specific/linux/reptyr/default.nix
index 99f52dc5aed..e017426aed0 100644
--- a/pkgs/os-specific/linux/reptyr/default.nix
+++ b/pkgs/os-specific/linux/reptyr/default.nix
@@ -7,6 +7,12 @@ stdenv.mkDerivation rec {
     url = "https://github.com/nelhage/reptyr/archive/reptyr-${version}.tar.gz";
     sha256 = "07pfl0rkgm8m3f3jy8r9l2yvnhf8lgllpsk3mh57mhzdxq8fagf7";
   };
+
+  # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
+  postPatch = ''
+    sed 1i'#include <sys/sysmacros.h>' -i platform/linux/linux.c
+  '';
+
   makeFlags = ["PREFIX=$(out)"];
   meta = {
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index 87741cf0ac0..7354b92aaf9 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -13,7 +13,9 @@ stdenv.mkDerivation {
     librsvg wrapGAppsHook
   ];
 
-  makeFlags="PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  NIX_CFLAGS_COMPILE = [ "-D_POSIX_C_SOURCE" ];
 
   meta = {
     description = "A simple and lightweight volume icon that sits in your system tray";
diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index 086c72bdbb2..8bedbeb12fe 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ coreutils ]; # bin/updatedb script needs to call sort
 
-  doCheck = !stdenv.isDarwin;
+  # Since glibc-2.25 the i686 tests hang reliably right after test-sleep.
+  doCheck = !stdenv.isDarwin && (stdenv.system != "i686-linux");
 
   outputs = [ "out" "info" ];
 
diff --git a/pkgs/tools/networking/cjdns/default.nix b/pkgs/tools/networking/cjdns/default.nix
index 1c91235652a..3000aacafa3 100644
--- a/pkgs/tools/networking/cjdns/default.nix
+++ b/pkgs/tools/networking/cjdns/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, nodejs, which, python27, utillinux }:
+{ stdenv, fetchurl, fetchpatch, nodejs, which, python27, utillinux }:
 
 let version = "18"; in
 stdenv.mkDerivation {
@@ -9,6 +9,12 @@ stdenv.mkDerivation {
     sha256 = "1as7n730ppn93cpal7s6r6iq1qx46m0c45iwy8baypbpp42zxrap";
   };
 
+  patches = [(fetchpatch {
+    name = "glibc-2.25.diff";
+    url = https://github.com/cjdelisle/cjdns/pull/1017.diff;
+    sha256 = "1k05d1w04lngcki56b6brkwg9xakzsbr5ibkcba8112v6jdzw51f";
+  })];
+
   buildInputs = [ which python27 nodejs ] ++
     # for flock
     stdenv.lib.optional stdenv.isLinux utillinux;
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index de841be3f05..48f8edf7c44 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -21,14 +21,14 @@ assert scpSupport -> libssh2 != null;
 assert c-aresSupport -> c-ares != null;
 
 stdenv.mkDerivation rec {
-  name = "curl-7.52.1";
+  name = "curl-7.53.0";
 
   src = fetchurl {
     url = "http://curl.haxx.se/download/${name}.tar.bz2";
-    sha256 = "16rqhyzlpnivifin8n7l2fr9ihay9v2nw2drsniinb6bcykqaqfi";
+    sha256 = "008833dd9w4l2277q9r0bsq1vqmm0fr7qqyzvqlw5d47xy5mld5j";
   };
 
-  patches = [ ./issue-1174.patch ];
+  patches = [ ];
 
   outputs = [ "bin" "dev" "out" "man" "devdoc" ];
 
diff --git a/pkgs/tools/networking/curl/issue-1174.patch b/pkgs/tools/networking/curl/issue-1174.patch
deleted file mode 100644
index eceeef8b001..00000000000
--- a/pkgs/tools/networking/curl/issue-1174.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-commit a7b38c9dc98481e4a5fc37e51a8690337c674dfb
-Author: Daniel Stenberg <daniel@haxx.se>
-Date:   Mon Dec 26 00:06:33 2016 +0100
-
-    vtls: s/SSLEAY/OPENSSL
-    
-    Fixed an old leftover use of the USE_SSLEAY define which would make a
-    socket get removed from the applications sockets to monitor when the
-    multi_socket API was used, leading to timeouts.
-    
-    Bug: #1174
-
-diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
-index b808e1c..707f24b 100644
---- a/lib/vtls/vtls.c
-+++ b/lib/vtls/vtls.c
-@@ -484,7 +484,7 @@ void Curl_ssl_close_all(struct Curl_easy *data)
-   curlssl_close_all(data);
- }
- 
--#if defined(USE_SSLEAY) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \
-+#if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \
-     defined(USE_DARWINSSL) || defined(USE_NSS)
- /* This function is for OpenSSL, GnuTLS, darwinssl, and schannel only. */
- int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks,
-@@ -518,7 +518,7 @@ int Curl_ssl_getsock(struct connectdata *conn,
-   (void)numsocks;
-   return GETSOCK_BLANK;
- }
--/* USE_SSLEAY || USE_GNUTLS || USE_SCHANNEL || USE_DARWINSSL || USE_NSS */
-+/* USE_OPENSSL || USE_GNUTLS || USE_SCHANNEL || USE_DARWINSSL || USE_NSS */
- #endif
- 
- void Curl_ssl_close(struct connectdata *conn, int sockindex)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 00030f68f21..31c793a481f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7549,11 +7549,7 @@ with pkgs;
 
   gnu-efi = callPackage ../development/libraries/gnu-efi { };
 
-  gnutls = gnutls34;
-
-  gnutls34 = callPackage ../development/libraries/gnutls/3.4.nix {
-    guileBindings = config.gnutls.guile or false;
-  };
+  gnutls = gnutls35;
 
   gnutls35 = callPackage ../development/libraries/gnutls/3.5.nix {
     guileBindings = config.gnutls.guile or false;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1eea8420334..6df45b3508f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -19926,12 +19926,12 @@ in {
   };
 
   pycurl = buildPythonPackage (rec {
-    name = "pycurl-7.19.5";
+    name = "pycurl-7.19.5.1";
     disabled = isPyPy; # https://github.com/pycurl/pycurl/issues/208
 
     src = pkgs.fetchurl {
       url = "http://pycurl.sourceforge.net/download/${name}.tar.gz";
-      sha256 = "0hqsap82zklhi5fxhc69kxrwzb0g9566f7sdpz7f9gyxkmyam839";
+      sha256 = "0v5w66ir3siimfzg3kc8hfrrilwwnbxq5bvipmrpyxar0kw715vf";
     };
 
     propagatedBuildInputs = with self; [ pkgs.curl pkgs.openssl.out ];