Merge commit 'cb21b77' into master.upstream

This is a partial merge of staging for builds which are working
2015-11-13 15:53:10 -08:00
parent 83aeb00a78 cb21b77ff1
commit 9579c9ec7f
392 changed files with 7282 additions and 7266 deletions
--- a/pkgs/development/libraries/at-spi2-atk/default.nix
+++ b/pkgs/development/libraries/at-spi2-atk/default.nix
@@ -2,14 +2,14 @@
 , intltool, dbus_glib, at_spi2_core, libSM }:

 stdenv.mkDerivation rec {
-  versionMajor = "2.16";
+  versionMajor = "2.18";
  versionMinor = "0";
  moduleName   = "at-spi2-atk";
  name = "${moduleName}-${versionMajor}.${versionMinor}";

  src = fetchurl {
    url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
-    sha256 = "1y9gfz1iz3wpja7s000f0bmyyvc6im5fcdl6bxwbz0v3qdgc9vvq";
+    sha256 = "0xgkrnx04vaklbkzc7bzym9s0qhj8aiz4knqlxgx3vxnacsb6vaa";
  };

  buildInputs = [ python pkgconfig popt atk libX11 libICE xorg.libXtst libXi
--- a/pkgs/development/libraries/at-spi2-core/default.nix
+++ b/pkgs/development/libraries/at-spi2-core/default.nix
@@ -2,14 +2,14 @@
 , libX11, xextproto, libSM, libICE, libXtst, libXi, gobjectIntrospection }:

 stdenv.mkDerivation rec {
-  versionMajor = "2.16";
+  versionMajor = "2.18";
  versionMinor = "0";
  moduleName   = "at-spi2-core";
  name = "${moduleName}-${versionMajor}.${versionMinor}";

  src = fetchurl {
    url = "mirror://gnome/sources/${moduleName}/${versionMajor}/${name}.tar.xz";
-    sha256 = "1l3l39mw23zyjlcqidvkyqlr4gwbhplzw2hcv3qvn6p8ikxpf2qw";
+    sha256 = "0xna0gnlqvzy6209klirywcm7ianazshg6pkk828g07bnrywgvhs";
  };

  outputs = [ "out" "doc" ];
--- a/pkgs/development/libraries/atk/default.nix
+++ b/pkgs/development/libraries/atk/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, pkgconfig, perl, glib, libintlOrEmpty, gobjectIntrospection }:

 let
-  ver_maj = "2.16";
+  ver_maj = "2.18";
  ver_min = "0";
 in
 stdenv.mkDerivation rec {
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/atk/${ver_maj}/${name}.tar.xz";
-    sha256 = "0qp5i91kfk6rhrlam3s8ha0cz88lkyp89vsyn4pb5856c1h9hpq9";
+    sha256 = "ce6c48d77bf951083029d5a396dd552d836fff3c1715d3a7022e917e46d0c92b";
  };

  buildInputs = libintlOrEmpty;
--- a/pkgs/development/libraries/audiofile/CVE-2015-7747.patch
+++ b/pkgs/development/libraries/audiofile/CVE-2015-7747.patch
@@ -0,0 +1,161 @@
+Description: fix buffer overflow when changing both sample format and
+ number of channels
+Origin: backport, https://github.com/mpruett/audiofile/pull/25
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/audiofile/+bug/1502721
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=801102
+
+Index: audiofile-0.3.6/libaudiofile/modules/ModuleState.cpp
+===================================================================
+--- audiofile-0.3.6.orig/libaudiofile/modules/ModuleState.cpp	2015-10-20 08:00:58.036128202 -0400
+++ audiofile-0.3.6/libaudiofile/modules/ModuleState.cpp	2015-10-20 08:00:58.036128202 -0400
+@@ -402,7 +402,7 @@
+		addModule(new Transform(outfc, in.pcm, out.pcm));
+
+	if (in.channelCount != out.channelCount)
+-		addModule(new ApplyChannelMatrix(infc, isReading,
+		addModule(new ApplyChannelMatrix(outfc, isReading,
+			in.channelCount, out.channelCount,
+			in.pcm.minClip, in.pcm.maxClip,
+			track->channelMatrix));
+Index: audiofile-0.3.6/test/Makefile.am
+===================================================================
+--- audiofile-0.3.6.orig/test/Makefile.am	2015-10-20 08:00:58.036128202 -0400
+++ audiofile-0.3.6/test/Makefile.am	2015-10-20 08:00:58.036128202 -0400
+@@ -26,6 +26,7 @@
+	VirtualFile \
+	floatto24 \
+	query2 \
+	sixteen-stereo-to-eight-mono \
+	sixteen-to-eight \
+	testchannelmatrix \
+	testdouble \
+@@ -139,6 +140,7 @@
+ printmarkers_LDADD = $(LIBAUDIOFILE) -lm
+
+ sixteen_to_eight_SOURCES = sixteen-to-eight.c TestUtilities.cpp TestUtilities.h
+sixteen_stereo_to_eight_mono_SOURCES = sixteen-stereo-to-eight-mono.c TestUtilities.cpp TestUtilities.h
+
+ testchannelmatrix_SOURCES = testchannelmatrix.c TestUtilities.cpp TestUtilities.h
+
+Index: audiofile-0.3.6/test/sixteen-stereo-to-eight-mono.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ audiofile-0.3.6/test/sixteen-stereo-to-eight-mono.c	2015-10-20 08:33:57.512286416 -0400
+@@ -0,0 +1,117 @@
+/*
+	Audio File Library
+
+	Copyright 2000, Silicon Graphics, Inc.
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License along
+	with this program; if not, write to the Free Software Foundation, Inc.,
+	51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+/*
+	sixteen-stereo-to-eight-mono.c
+
+	This program tests the conversion from 2-channel 16-bit integers to
+	1-channel 8-bit	integers.
+*/
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <limits.h>
+
+#include <audiofile.h>
+
+#include "TestUtilities.h"
+
+int main (int argc, char **argv)
+{
+	AFfilehandle file;
+	AFfilesetup setup;
+	int16_t frames16[] = {14298, 392, 3923, -683, 958, -1921};
+	int8_t frames8[] = {28, 6, -2};
+	int i, frameCount = 3;
+	int8_t byte;
+	AFframecount result;
+
+	setup = afNewFileSetup();
+
+	afInitFileFormat(setup, AF_FILE_WAVE);
+
+	afInitSampleFormat(setup, AF_DEFAULT_TRACK, AF_SAMPFMT_TWOSCOMP, 16);
+	afInitChannels(setup, AF_DEFAULT_TRACK, 2);
+
+	char testFileName[PATH_MAX];
+	if (!createTemporaryFile("sixteen-to-eight", testFileName))
+	{
+		fprintf(stderr, "Could not create temporary file.\n");
+		exit(EXIT_FAILURE);
+	}
+
+	file = afOpenFile(testFileName, "w", setup);
+	if (file == AF_NULL_FILEHANDLE)
+	{
+		fprintf(stderr, "could not open file for writing\n");
+		exit(EXIT_FAILURE);
+	}
+
+	afFreeFileSetup(setup);
+
+	afWriteFrames(file, AF_DEFAULT_TRACK, frames16, frameCount);
+
+	afCloseFile(file);
+
+	file = afOpenFile(testFileName, "r", AF_NULL_FILESETUP);
+	if (file == AF_NULL_FILEHANDLE)
+	{
+		fprintf(stderr, "could not open file for reading\n");
+		exit(EXIT_FAILURE);
+	}
+
+	afSetVirtualSampleFormat(file, AF_DEFAULT_TRACK, AF_SAMPFMT_TWOSCOMP, 8);
+	afSetVirtualChannels(file, AF_DEFAULT_TRACK, 1);
+
+	for (i=0; i<frameCount; i++)
+	{
+		/* Read one frame. */
+		result = afReadFrames(file, AF_DEFAULT_TRACK, &byte, 1);
+
+		if (result != 1)
+			break;
+
+		/* Compare the byte read with its precalculated value. */
+		if (memcmp(&byte, &frames8[i], 1) != 0)
+		{
+			printf("error\n");
+			printf("expected %d, got %d\n", frames8[i], byte);
+			exit(EXIT_FAILURE);
+		}
+		else
+		{
+#ifdef DEBUG
+			printf("got what was expected: %d\n", byte);
+#endif
+		}
+	}
+
+	afCloseFile(file);
+	unlink(testFileName);
+
+	exit(EXIT_SUCCESS);
+}
--- a/pkgs/development/libraries/audiofile/default.nix
+++ b/pkgs/development/libraries/audiofile/default.nix
@@ -10,6 +10,8 @@ stdenv.mkDerivation rec {
    sha256 = "0rb927zknk9kmhprd8rdr4azql4gn2dp75a36iazx2xhkbqhvind";
  };

+  patches = [ ./CVE-2015-7747.patch ];
+
  meta = with stdenv.lib; {
    description = "Library for reading and writing audio files in various formats";
    homepage    = http://www.68k.org/~michael/audiofile/; 
--- a/pkgs/development/libraries/boost/1.55.nix
+++ b/pkgs/development/libraries/boost/1.55.nix
@@ -3,7 +3,7 @@
 callPackage ./generic.nix (args // rec {
  version = "1.55.0";

-  patches = [ ./clang-math.patch ./clang-math-2.patch ];
+  patches = [ ./clang-math.patch ./clang-math-2.patch ./gcc-5.patch ];

  src = fetchurl {
    url = "mirror://sourceforge/boost/boost_1_55_0.tar.bz2";
--- a/pkgs/development/libraries/boost/gcc-5.patch
+++ b/pkgs/development/libraries/boost/gcc-5.patch
@@ -0,0 +1,64 @@
+https://svn.boost.org/trac/boost/ticket/10125
+
+ boost/thread/pthread/once.hpp        | 6 +++---
+ boost/thread/pthread/once_atomic.hpp | 2 +-
+ boost/thread/win32/once.hpp          | 2 +-
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/boost/thread/pthread/once.hpp b/boost/thread/pthread/once.hpp
+index ccfb051..0bef038 100644
+--- a/boost/thread/pthread/once.hpp
+++ b/boost/thread/pthread/once.hpp
+@@ -42,7 +42,7 @@ namespace boost
+   }
+ 
+ #ifdef BOOST_THREAD_PROVIDES_ONCE_CXX11
+-#ifndef BOOST_NO_CXX11_VARIADIC_TEMPLATES
+#if !defined(BOOST_NO_CXX11_VARIADIC_TEMPLATES) && !defined(BOOST_NO_CXX11_RVALUE_REFERENCES)
+     template<typename Function, class ...ArgTypes>
+     inline void call_once(once_flag& flag, BOOST_THREAD_RV_REF(Function) f, BOOST_THREAD_RV_REF(ArgTypes)... args);
+ #else
+@@ -65,7 +65,7 @@ namespace boost
+   private:
+       volatile thread_detail::uintmax_atomic_t epoch;
+ 
+-#ifndef BOOST_NO_CXX11_VARIADIC_TEMPLATES
+#if !defined(BOOST_NO_CXX11_VARIADIC_TEMPLATES) && !defined(BOOST_NO_CXX11_RVALUE_REFERENCES)
+       template<typename Function, class ...ArgTypes>
+       friend void call_once(once_flag& flag, BOOST_THREAD_RV_REF(Function) f, BOOST_THREAD_RV_REF(ArgTypes)... args);
+ #else
+@@ -118,7 +118,7 @@ namespace boost
+     // http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2007/n2444.html
+ 
+ 
+-#ifndef BOOST_NO_CXX11_VARIADIC_TEMPLATES
+#if !defined(BOOST_NO_CXX11_VARIADIC_TEMPLATES) && !defined(BOOST_NO_CXX11_RVALUE_REFERENCES)
+ 
+ 
+   template<typename Function, class ...ArgTypes>
+diff --git a/boost/thread/pthread/once_atomic.hpp b/boost/thread/pthread/once_atomic.hpp
+index 9e2f876..923f07b 100644
+--- a/boost/thread/pthread/once_atomic.hpp
+++ b/boost/thread/pthread/once_atomic.hpp
+@@ -115,7 +115,7 @@ namespace boost
+ #endif
+ 
+ 
+-#ifndef BOOST_NO_CXX11_VARIADIC_TEMPLATES
+#if !defined(BOOST_NO_CXX11_VARIADIC_TEMPLATES) && !defined(BOOST_NO_CXX11_RVALUE_REFERENCES)
+ 
+   template<typename Function, class ...ArgTypes>
+   inline void call_once(once_flag& flag, BOOST_THREAD_RV_REF(Function) f, BOOST_THREAD_RV_REF(ArgTypes)... args)
+diff --git a/boost/thread/win32/once.hpp b/boost/thread/win32/once.hpp
+index cafcfd4..9b37b31 100644
+--- a/boost/thread/win32/once.hpp
+++ b/boost/thread/win32/once.hpp
+@@ -227,7 +227,7 @@ namespace boost
+         }
+     }
+ 
+-#ifndef BOOST_NO_CXX11_VARIADIC_TEMPLATES
+#if !defined BOOST_NO_CXX11_VARIADIC_TEMPLATES && !defined(BOOST_NO_CXX11_RVALUE_REFERENCES)
+ //#if defined(BOOST_THREAD_RVALUE_REFERENCES_DONT_MATCH_FUNTION_PTR)
+     inline void call_once(once_flag& flag, void (*f)())
+     {
--- a/pkgs/development/libraries/cairo/default.nix
+++ b/pkgs/development/libraries/cairo/default.nix
@@ -11,11 +11,11 @@ assert glSupport -> mesa_noglu != null;
 with { inherit (stdenv.lib) optional optionals; };

 stdenv.mkDerivation rec {
-  name = "cairo-1.14.2";
+  name = "cairo-1.14.4";

  src = fetchurl {
    url = "http://cairographics.org/releases/${name}.tar.xz";
-    sha1 = "c8da68aa66ca0855b5d0ff552766d3e8679e1d24";
+    sha256 = "05p75r914d809711yg9rapgmmi4hymzbarhd3w0yrfadhiy9rv7n";
  };

  nativeBuildInputs = [ pkgconfig libiconv ] ++ libintlOrEmpty;
--- a/pkgs/development/libraries/clutter/1.24.nix
+++ b/pkgs/development/libraries/clutter/1.24.nix
@@ -0,0 +1,52 @@
+{ stdenv, fetchurl, glib, pkgconfig, mesa, libX11, libXext, libXfixes
+, libXdamage, libXcomposite, libXi, cogl, pango, atk, json_glib, 
+gobjectIntrospection 
+}:
+
+let
+  ver_maj = "1.24";
+  ver_min = "0";
+in
+stdenv.mkDerivation rec {
+  name = "clutter-${ver_maj}.${ver_min}";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/clutter/${ver_maj}/${name}.tar.xz";
+    sha256 = "85c87d5745b97af7633776419a47421aae7cea66c1b870f88cc5e06a4c5626e6";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  propagatedBuildInputs =
+    [ libX11 mesa libXext libXfixes libXdamage libXcomposite libXi cogl pango
+      atk json_glib gobjectIntrospection
+    ];
+
+  configureFlags = [ "--enable-introspection" ]; # needed by muffin AFAIK
+
+  #doCheck = true; # no tests possible without a display
+
+  meta = {
+    description = "Clutter, a library for creating fast, dynamic graphical user interfaces";
+
+    longDescription =
+      '' Clutter is free software library for creating fast, compelling,
+         portable, and dynamic graphical user interfaces.  It is a core part
+         of MeeGo, and is supported by the open source community.  Its
+         development is sponsored by Intel.
+
+         Clutter uses OpenGL for rendering (and optionally OpenGL|ES for use
+         on mobile and embedded platforms), but wraps an easy to use,
+         efficient, flexible API around GL's complexity.
+
+         Clutter enforces no particular user interface style, but provides a
+         rich, generic foundation for higher-level toolkits tailored to
+         specific needs.
+      '';
+
+    license = stdenv.lib.licenses.lgpl2Plus;
+    homepage = http://www.clutter-project.org/;
+
+    maintainers = with stdenv.lib.maintainers; [ urkud lethalman ];
+    platforms = stdenv.lib.platforms.mesaPlatforms;
+  };
+}
--- a/pkgs/development/libraries/cogl/1.22.nix
+++ b/pkgs/development/libraries/cogl/1.22.nix
@@ -0,0 +1,56 @@
+{ stdenv, fetchurl, pkgconfig, mesa_noglu, glib, gdk_pixbuf, xorg, libintlOrEmpty
+, pangoSupport ? true, pango, cairo, gobjectIntrospection
+, gstreamerSupport ? true, gst_all_1 }:
+
+let
+  ver_maj = "1.22";
+  ver_min = "0";
+in
+stdenv.mkDerivation rec {
+  name = "cogl-${ver_maj}.${ver_min}";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/cogl/${ver_maj}/${name}.tar.xz";
+    sha256 = "689dfb5d14fc1106e9d2ded0f7930dcf7265d0bc84fa846b4f03941633eeaa91";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  configureFlags = [
+    "--enable-introspection"
+    "--enable-kms-egl-platform"
+  ] ++ stdenv.lib.optional gstreamerSupport "--enable-cogl-gst"
+    ++ stdenv.lib.optionals (!stdenv.isDarwin) [ "--enable-gles1" "--enable-gles2" ];
+
+  propagatedBuildInputs = with xorg; [
+      glib gdk_pixbuf gobjectIntrospection
+      mesa_noglu libXrandr libXfixes libXcomposite libXdamage
+    ]
+    ++ libintlOrEmpty
+    ++ stdenv.lib.optionals gstreamerSupport [ gst_all_1.gstreamer
+                                               gst_all_1.gst-plugins-base ];
+
+  buildInputs = stdenv.lib.optionals pangoSupport [ pango cairo ];
+
+  COGL_PANGO_DEP_CFLAGS
+    = stdenv.lib.optionalString (stdenv.isDarwin && pangoSupport)
+      "-I${pango}/include/pango-1.0 -I${cairo}/include/cairo";
+
+  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lintl";
+
+  #doCheck = true; # all tests fail (no idea why)
+
+  meta = with stdenv.lib; {
+    description = "A small open source library for using 3D graphics hardware for rendering";
+    maintainers = with maintainers; [ lovek323 ];
+
+    longDescription = ''
+      Cogl is a small open source library for using 3D graphics hardware for
+      rendering. The API departs from the flat state machine style of OpenGL
+      and is designed to make it easy to write orthogonal components that can
+      render without stepping on each other's toes.
+    '';
+
+    platforms = stdenv.lib.platforms.mesaPlatforms;
+  };
+}
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -235,11 +235,11 @@ assert x11grabExtlib -> libX11 != null && libXv != null;

 stdenv.mkDerivation rec {
  name = "ffmpeg-full-${version}";
-  version = "2.7.2";
+  version = "2.8.1";

  src = fetchurl {
    url = "https://www.ffmpeg.org/releases/ffmpeg-${version}.tar.bz2";
-    sha256 = "1wlygd0jp34dk4qagi4h9psn4yk8zgyj7zy9lrpm5332mm87bsvw";
+    sha256 = "1qk6g2h993i0wgs9d2p3ahdc5bqr03mp74bk6r1zj6pfinr5mvg2";
  };

  patchPhase = ''patchShebangs .'';
--- a/pkgs/development/libraries/ffmpeg/2.6.nix
+++ b/pkgs/development/libraries/ffmpeg/2.6.nix
@@ -1,7 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "${branch}.3";
-  branch = "2.6";
-  sha256 = "1yqc3vm1xrwf866q262qd4nr9d6ifp4gg183pjdc4sl9np0rissr";
-})
--- a/pkgs/development/libraries/ffmpeg/2.7.nix
+++ b/pkgs/development/libraries/ffmpeg/2.7.nix
@@ -1,7 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic.nix (args // rec {
-  version = "${branch}.2";
-  branch = "2.7";
-  sha256 = "1wlygd0jp34dk4qagi4h9psn4yk8zgyj7zy9lrpm5332mm87bsvw";
-})
--- a/pkgs/development/libraries/ffmpeg/2.8.nix
+++ b/pkgs/development/libraries/ffmpeg/2.8.nix
@@ -0,0 +1,7 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  version = "${branch}.1";
+  branch = "2.8";
+  sha256 = "1qk6g2h993i0wgs9d2p3ahdc5bqr03mp74bk6r1zj6pfinr5mvg2";
+})
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -2,15 +2,15 @@
 , jasper, libintlOrEmpty, gobjectIntrospection, doCheck ? false }:

 let
-  ver_maj = "2.31";
-  ver_min = "7";
+  ver_maj = "2.32";
+  ver_min = "1";
 in
 stdenv.mkDerivation rec {
  name = "gdk-pixbuf-${ver_maj}.${ver_min}";

  src = fetchurl {
    url = "mirror://gnome/sources/gdk-pixbuf/${ver_maj}/${name}.tar.xz";
-    sha256 = "046n9wz16kh3rpzxaiiwphf5bihxgj4g14cjn65wwmw82q4y0dj7";
+    sha256 = "1g7kjxv67jcdasi14n7jan4icrnnppd1m99wrdmpv32k4m7vfcj4";
  };

  setupHook = ./setup-hook.sh;
--- a/pkgs/development/libraries/glew/default.nix
+++ b/pkgs/development/libraries/glew/default.nix
@@ -3,11 +3,11 @@
 with stdenv.lib;

 stdenv.mkDerivation rec {
-  name = "glew-1.11.0";
+  name = "glew-1.13.0";

  src = fetchurl {
    url = "mirror://sourceforge/glew/${name}.tgz";
-    sha256 = "1mhkllxz49l1x680dmzrv2i82qjrq017sykah3xc90f2d8qcxfv9";
+    sha256 = "1iwb2a6wfhkzv6fa7zx2gz1lkwa0iwnd9ka1im5vdc44xm4dq9da";
  };

  nativeBuildInputs = [ xlibsWrapper libXmu libXi ];
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -39,8 +39,8 @@ let
    ln -sr -t "$out/include/" "$out"/lib/*/include/* 2>/dev/null || true
  '';

-  ver_maj = "2.44";
-  ver_min = "1";
+  ver_maj = "2.46";
+  ver_min = "2";
 in

 stdenv.mkDerivation rec {
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${ver_maj}/${name}.tar.xz";
-    sha256 = "01yabrfp64i11mrks3p1gcks99lw0zm7f5vhkc53sl4amyndw4c8";
+    sha256 = "5031722e37036719c1a09163cc6cf7c326e4c4f1f1e074b433c156862bd733db";
  };

  patches = optional stdenv.isDarwin ./darwin-compilation.patch ++ optional doCheck ./skip-timer-test.patch;
--- a/pkgs/development/libraries/glpk/default.nix
+++ b/pkgs/development/libraries/glpk/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv }:

 stdenv.mkDerivation rec {
-  name = "glpk-4.56";
+  name = "glpk-4.52.1";

  src = fetchurl {
    url = "mirror://gnu/glpk/${name}.tar.gz";
-    sha256 = "0syzix6qvpn0fzp08c84c8snansf1cam5vd0dk2w91mz2c85d18h";
+    sha256 = "0nz9ngmx23c8gbjr8l8ygnfaanxj2mwbl8awpg630bgrkxdnhc9j";
  };

  doCheck = true;
--- a/pkgs/development/libraries/gobject-introspection/default.nix
+++ b/pkgs/development/libraries/gobject-introspection/default.nix
@@ -5,7 +5,7 @@
 # In that case its about 6MB which could be separated

 let
-  ver_maj = "1.44";
+  ver_maj = "1.46";
  ver_min = "0";
 in
 stdenv.mkDerivation rec {
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/gobject-introspection/${ver_maj}/${name}.tar.xz";
-    sha256 = "1b972qg2yb51sdavfvb6kc19akwc15c1bwnbg81vadxamql2q33g";
+    sha256 = "6658bd3c2b8813eb3e2511ee153238d09ace9d309e4574af27443d87423e4233";
  };

  buildInputs = [ flex bison pkgconfig python ]
@@ -25,6 +25,10 @@ stdenv.mkDerivation rec {
  # other dependencies).
  configureFlags = [ "--disable-tests" ];

+  preConfigure = ''
+    sed 's|/usr/bin/env ||' -i tools/g-ir-tool-template.in
+  '';
+
  postInstall = "rm -rf $out/share/gtk-doc";

  setupHook = ./setup-hook.sh;
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -1,16 +1,16 @@
 { stdenv, fetchurl, pkgconfig, gettext, perl
 , expat, glib, cairo, pango, gdk_pixbuf, atk, at_spi2_atk, gobjectIntrospection
-, xorg, xlibsWrapper, wayland, libxkbcommon, epoxy
+, xlibs, x11, wayland, libxkbcommon, epoxy
 , xineramaSupport ? stdenv.isLinux
 , cupsSupport ? stdenv.isLinux, cups ? null
 }:

-assert xineramaSupport -> xorg.libXinerama != null;
+assert xineramaSupport -> xlibs.libXinerama != null;
 assert cupsSupport -> cups != null;

 let
-  ver_maj = "3.16";
-  ver_min = "7";
+  ver_maj = "3.18";
+  ver_min = "3";
  version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@@ -18,25 +18,25 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "1fkzdhqa1pjzb1qsh2ll3y2567ylyszks59qspx85lalvqa9ss0r";
+    sha256 = "f3c76791f93f51e260b03676f83007730b9875a0a9bf5cd42442e2f14e593546";
  };

  nativeBuildInputs = [ pkgconfig gettext gobjectIntrospection perl ];

  buildInputs = [ libxkbcommon epoxy ];
-  propagatedBuildInputs = with xorg; with stdenv.lib;
+  propagatedBuildInputs = with xlibs; with stdenv.lib;
    [ expat glib cairo pango gdk_pixbuf atk at_spi2_atk libXrandr libXrender libXcomposite libXi libXcursor ]
    ++ optionals stdenv.isLinux [ wayland ]
    ++ optional xineramaSupport libXinerama
    ++ optional cupsSupport cups;

+  NIX_LDFLAGS = if stdenv.isDarwin then "-lintl" else null;
+
  # demos fail to install, no idea where's the problem
  preConfigure = "sed '/^SRC_SUBDIRS /s/demos//' -i Makefile.in";

  enableParallelBuilding = true;

-  NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isDarwin "-lintl";
-
  postInstall = "rm -rf $out/share/gtk-doc";

  passthru = {
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
    ''; # workaround for bug of nix-mode for Emacs */ '';
  };

-  meta = with stdenv.lib; {
+  meta = {
    description = "A multi-platform toolkit for creating graphical user interfaces";

    longDescription = ''
@@ -62,9 +62,9 @@ stdenv.mkDerivation rec {

    homepage = http://www.gtk.org/;

-    license = licenses.lgpl2Plus;
+    license = stdenv.lib.licenses.lgpl2Plus;

-    maintainers = with maintainers; [ urkud raskin vcunat lethalman ];
-    platforms = platforms.all;
+    maintainers = with stdenv.lib.maintainers; [ urkud raskin vcunat lethalman ];
+    platforms = stdenv.lib.platforms.all;
  };
 }
--- a/pkgs/development/libraries/gvfs/default.nix
+++ b/pkgs/development/libraries/gvfs/default.nix
@@ -1,25 +1,25 @@
 { stdenv, fetchurl, pkgconfig, intltool, libtool
-, glib, dbus, udev, udisks2, libgcrypt
+, glib, dbus, udev, libgudev, udisks2, libgcrypt
 , libgphoto2, avahi, libarchive, fuse, libcdio
 , libxml2, libxslt, docbook_xsl, samba, libmtp
 , gnomeSupport ? false, gnome,libgnome_keyring, gconf, makeWrapper }:

 let
  ver_maj = "1.22";
-  version = "${ver_maj}.2";
+  version = "${ver_maj}.4";
 in
 stdenv.mkDerivation rec {
  name = "gvfs-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/gvfs/${ver_maj}/${name}.tar.xz";
-    sha256 = "8d08c4927b6c20d990498c23280017e7033b31a386f09b4c3ce5bedd20316250";
+    sha256 = "57e33faad35aba72be3822099856aca847f391626cf3ec734b42e64ba31f6484";
  };

  nativeBuildInputs = [ pkgconfig intltool libtool ];

  buildInputs =
-    [ makeWrapper glib dbus.libs udev udisks2 libgcrypt
+    [ makeWrapper glib dbus.libs udev libgudev udisks2 libgcrypt
      libgphoto2 avahi libarchive fuse libcdio
      libxml2 libxslt docbook_xsl samba libmtp
      # ToDo: a ligther version of libsoup to have FTP/HTTP support?
--- a/pkgs/development/libraries/harfbuzz/default.nix
+++ b/pkgs/development/libraries/harfbuzz/default.nix
@@ -8,11 +8,11 @@
 # (icu is a ~30 MB dependency, the rest is very small in comparison)

 stdenv.mkDerivation rec {
-  name = "harfbuzz-1.0.3";
+  name = "harfbuzz-1.0.6";

  src = fetchurl {
    url = "http://www.freedesktop.org/software/harfbuzz/release/${name}.tar.bz2";
-    sha256 = "1xrxlrvgyr6mm9qjxmkif2kvcah082y94gf1vqi0f0bdl1g8gp7b";
+    sha256 = "09ivk5m4y09ar4zi9r6db7gp234cy05h0ach7w22g9kqvkxsf5pn";
  };

  outputs = [ "out" "doc" ];
--- a/pkgs/development/libraries/icu/default.nix
+++ b/pkgs/development/libraries/icu/default.nix
@@ -2,7 +2,7 @@

 let
  pname = "icu4c";
-  version = "55.1";
+  version = "56.1";
 in
 stdenv.mkDerivation {
  name = pname + "-" + version;
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
  src = fetchurl {
    url = "http://download.icu-project.org/files/${pname}/${version}/${pname}-"
      + (stdenv.lib.replaceChars ["."] ["_"] version) + "-src.tgz";
-    sha256 = "0ys5f5spizg45qlaa31j2lhgry0jka2gfha527n4ndfxxz5j4sz1";
+    sha256 = "05j86714qaj0lvhvyr2s1xncw6sk0h2dcghb3iiwykbkbh8fjr1s";
  };

  makeFlags = stdenv.lib.optionalString stdenv.isDarwin
--- a/pkgs/development/libraries/jemalloc/default.nix
+++ b/pkgs/development/libraries/jemalloc/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:

 stdenv.mkDerivation rec {
-  name = "jemalloc-4.0.2";
+  name = "jemalloc-4.0.3";

  src = fetchurl {
    url = "http://www.canonware.com/download/jemalloc/${name}.tar.bz2";
-    sha256 = "04a6iw9wiwiknd7v3l3i7vpmc5nvv52islnb1hz9idmdk259r2hd";
+    sha256 = "1mpnfaniaybv8kh7yjqq2g595l2i08m7adg238k5igzf61n6ixzi";
  };

  meta = with stdenv.lib; {
--- a/pkgs/development/libraries/libaccounts-glib/default.nix
+++ b/pkgs/development/libraries/libaccounts-glib/default.nix
@@ -22,4 +22,6 @@ stdenv.mkDerivation rec {
  configurePhase = ''
    HAVE_GCOV_FALSE="#" ./configure $configureFlags --prefix=$out
  '';
+
+  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations"; # since glib-2.46
 }
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, acl, openssl, libxml2, attr, zlib, bzip2, e2fsprogs, xz
+{ fetchurl, stdenv, acl, openssl, libxml2, attr, zlib, bzip2, e2fsprogs, xz, lzo
 , sharutils }:

 stdenv.mkDerivation rec {
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
      # ^ it's CVE-2015-2304 specific to libarchive
  ];

-  buildInputs = [ sharutils libxml2 zlib bzip2 openssl xz ] ++
+  buildInputs = [ sharutils libxml2 zlib bzip2 openssl xz lzo ] ++
    stdenv.lib.optionals stdenv.isLinux [ e2fsprogs attr acl ];

  preBuild = if stdenv.isCygwin then ''
@@ -26,7 +26,9 @@ stdenv.mkDerivation rec {
  '' else null;

  preFixup = ''
-    sed 's|-lcrypto|-L${openssl}/lib -lcrypto|' -i $out/lib/libarchive.la
+    sed -i $out/lib/libarchive.la \
+      -e 's|-lcrypto|-L${openssl}/lib -lcrypto|' \
+      -e 's|-llzo2|-L${lzo}/lib -llzo2|'
  '';

  meta = {
--- a/pkgs/development/libraries/libdnet/default.nix
+++ b/pkgs/development/libraries/libdnet/default.nix
@@ -10,9 +10,9 @@ stdenv.mkDerivation {
    sha1 = "71302be302e84fc19b559e811951b5d600d976f8";
  };

-  buildInputs = [ automake autoconf libtool ];
+  configureFlags = [ "--enable-shared" ]; # shared libs required by hyenae

-  CFLAGS="-fPIC";
+  buildInputs = [ automake autoconf libtool ];

  # .so endings are missing (quick and dirty fix)
  postInstall = ''
--- a/pkgs/development/libraries/libgudev/default.nix
+++ b/pkgs/development/libraries/libgudev/default.nix
@@ -0,0 +1,21 @@
+{ lib, stdenv, fetchurl, pkgconfig, udev, glib }:
+
+let version = "230"; in
+
+stdenv.mkDerivation rec {
+  name = "libgudev-${version}";
+
+  src = fetchurl {
+    url = "https://download.gnome.org/sources/libgudev/${version}/${name}.tar.xz";
+    sha256 = "a2e77faced0c66d7498403adefcc0707105e03db71a2b2abd620025b86347c18";
+  };
+
+  buildInputs = [ pkgconfig udev glib ];
+
+  meta = {
+    homepage = https://wiki.gnome.org/Projects/libgudev;
+    maintainers = [ lib.maintainers.eelco ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.lgpl2Plus;
+  };
+}
--- a/pkgs/development/libraries/libjpeg-turbo/default.nix
+++ b/pkgs/development/libraries/libjpeg-turbo/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, nasm }:

 stdenv.mkDerivation rec {
-  name = "libjpeg-turbo-1.4.1";
+  name = "libjpeg-turbo-1.4.2";

  src = fetchurl {
    url = "mirror://sourceforge/libjpeg-turbo/${name}.tar.gz";
-    sha256 = "027vz97064bjmwj7gdw2p47y1437w08j54frpgzmnql5rvabmxab";
+    sha256 = "0gi349hp1x7mb98s4mf66sb2xay2kjjxj9ihrriw0yiy0k9va6sj";
  };

  buildInputs = [ nasm ];
--- a/pkgs/development/libraries/libmbim/default.nix
+++ b/pkgs/development/libraries/libmbim/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, glib, python, udev }:
+{ stdenv, fetchurl, pkgconfig, glib, python, udev, libgudev }:

 stdenv.mkDerivation rec {
  name = "libmbim-1.12.2";
@@ -12,11 +12,11 @@ stdenv.mkDerivation rec {
    patchShebangs .
  '';

-  buildInputs = [ pkgconfig glib udev python ];
+  buildInputs = [ pkgconfig glib udev libgudev python ];

  meta = with stdenv.lib; {
    homepage = http://www.freedesktop.org/software/libmbim/;
-    description = "talking to WWAN modems and devices which speak the Mobile Interface Broadband Model (MBIM) protocol";
+    description = "Library for talking to WWAN modems and devices which speak the Mobile Interface Broadband Model (MBIM) protocol";
    platforms = platforms.linux;
    license = licenses.gpl2;
    maintainers = with maintainers; [ wkennington ];
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -28,6 +28,10 @@ in stdenv.mkDerivation {
  buildInputs = [ icu libxslt ];
  nativeBuildInputs = [ autoreconfHook docbook_xsl gtk_doc pkgconfig ];

+  postPatch = ''
+    substituteInPlace src/psl.c --replace bits/stat.h sys/stat.h
+  '';
+
  preAutoreconf = ''
    mkdir m4
    gtkdocize
--- a/pkgs/development/libraries/libseccomp/default.nix
+++ b/pkgs/development/libraries/libseccomp/default.nix
@@ -1,17 +1,16 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, getopt }:
+{ stdenv, fetchurl, getopt }:
+
+let version = "2.2.3"; in

 stdenv.mkDerivation rec {
-  name    = "libseccomp-${version}";
-  version = "2.2.3";
+  name = "libseccomp-${version}";

-  src = fetchFromGitHub {
-    owner = "seccomp";
-    repo = "libseccomp";
-    rev = "v${version}";
-    sha256 = "0pl827qjls5b6kjj8qxxdwcn6rviqbm5xjqf0hgx6b04c836mswx";
+  src = fetchurl {
+    url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
+    sha256 = "d9b400b703cab7bb04b84b9b6e52076a630b673819d7541757bcc16467b6d49e";
  };

-  buildInputs = [ autoreconfHook getopt ];
+  buildInputs = [ getopt ];

  patchPhase = ''
    patchShebangs .
--- a/pkgs/development/libraries/libunwind/native.nix
+++ b/pkgs/development/libraries/libunwind/native.nix
@@ -0,0 +1,17 @@
+{ stdenv }:
+
+assert stdenv.isDarwin;
+
+stdenv.mkDerivation {
+  name = "libunwind-native";
+
+  unpackPhase = ":";
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cat /usr/lib/system/libunwind.dylib > $out/lib/libunwind.dylib
+  '';
+
+  meta.platforms = stdenv.lib.platforms.darwin;
+}
--- a/pkgs/development/libraries/libwacom/default.nix
+++ b/pkgs/development/libraries/libwacom/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, glib, pkgconfig, udev }:
+{ fetchurl, stdenv, glib, pkgconfig, udev, libgudev }:

 stdenv.mkDerivation rec {
  name = "libwacom-0.15";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
    sha256 = "04vppdj99cc0ya44n8p7zjk9yyw03v6fksw0a9n1gpnnsn4wardb";
  };

-  buildInputs = [ glib pkgconfig udev ];
+  buildInputs = [ glib pkgconfig udev libgudev ];

  meta = with stdenv.lib; {
    platforms = platforms.linux;
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -22,7 +22,7 @@ else
 */

 let
-  version = "10.6.8";
+  version = "11.0.4";
  # this is the default search path for DRI drivers
  driverLink = "/run/opengl-driver" + stdenv.lib.optionalString stdenv.isi686 "-32";
 in
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
      "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
      "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
    ];
-    sha256 = "e36ee5ceeadb3966fb5ce5b4cf18322dbb76a4f075558ae49c3bba94f57d58fd";
+    sha256 = "40201bf7fc6fa12a6d9edfe870b41eb4dd6669154e3c42c48a96f70805f5483d";
  };

  prePatch = "patchShebangs .";
--- a/pkgs/development/libraries/neon/default.nix
+++ b/pkgs/development/libraries/neon/default.nix
@@ -14,12 +14,11 @@ let
 in

 stdenv.mkDerivation rec {
-  version = "0.30.1";
-  name = "neon-${version}";
+  name = "neon-0.29.6";

  src = fetchurl {
    url = "http://www.webdav.org/neon/${name}.tar.gz";
-    sha256 = "1pawhk02x728xn396a1kcivy9gqm94srmgad6ymr9l0qvk02dih0";
+    sha256 = "0hzbjqdx1z8zw0vmbknf159wjsxbcq8ii0wgwkqhxj3dimr0nr4w";
  };

  patches = optionals stdenv.isDarwin [ ./0.29.6-darwin-fix-configure.patch ];
--- a/pkgs/development/libraries/nghttp2/default.nix
+++ b/pkgs/development/libraries/nghttp2/default.nix
@@ -34,12 +34,12 @@ let
 in
 stdenv.mkDerivation rec {
  name = "${prefix}nghttp2-${version}";
-  version = "1.2.1";
+  version = "1.3.4";

  # Don't use fetchFromGitHub since this needs a bootstrap curl
  src = fetchurl {
    url = "http://pub.wak.io/nixos/tarballs/nghttp2-${version}.tar.bz2";
-    sha256 = "8027461a231d205394890b2fee34d1c3751e28e7d3f7c1ebc1b557993ea4045e";
+    sha256 = "63c1d70e50f0c8514e261be88b66720df095269791aa008d76c09e0c3a4c085f";
  };

  # Configure script searches for a symbol which does not exist in jemalloc on Darwin
@@ -66,6 +66,7 @@ stdenv.mkDerivation rec {
    (mkWith   (optJemalloc != null) "jemalloc"        null)
    (mkWith   false                 "spdylay"         null)
    (mkWith   false                 "cython"          null)
+    (mkWith   false                 "mruby"           null)
  ];

  meta = with stdenv.lib; {
--- a/pkgs/development/libraries/pango/default.nix
+++ b/pkgs/development/libraries/pango/default.nix
@@ -3,26 +3,26 @@
 }:

 let
-  ver_maj = "1.36";
-  ver_min = "8";
+  ver_maj = "1.38";
+  ver_min = "0";
 in
 stdenv.mkDerivation rec {
  name = "pango-${ver_maj}.${ver_min}";

  src = fetchurl {
    url = "mirror://gnome/sources/pango/${ver_maj}/${name}.tar.xz";
-    sha256 = "01rdzjh68w8l5zn0648yibyarj8p6g7yfn59nw5awaz1i8dvbnqq";
+    sha256 = "0v12gi7f01iq3z852pclpnmkbcksbvpcmiazmklkx1dd9fbpakhx";
  };

  buildInputs = with stdenv.lib; [ gobjectIntrospection ]
-    ++ optionals stdenv.isDarwin [ fontconfig ];
+    ++ optional stdenv.isDarwin fontconfig;
  nativeBuildInputs = [ pkgconfig ];

  propagatedBuildInputs = [ xlibsWrapper glib cairo libpng fontconfig freetype harfbuzz ] ++ libintlOrEmpty;

  enableParallelBuilding = true;

-  doCheck = false; # test-layout fails on 1.36.8
+  doCheck = false; # test-layout fails on 1.38.0
  # jww (2014-05-05): The tests currently fail on Darwin:
  #
  # ERROR:testiter.c:139:iter_char_test: assertion failed: (extents.width == x1 - x0)
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {

  postInstall = "rm -rf $out/share/gtk-doc";

-  meta = {
+  meta = with stdenv.lib; {
    description = "A library for laying out and rendering of text, with an emphasis on internationalization";

    longDescription = ''
@@ -43,9 +43,9 @@ stdenv.mkDerivation rec {
    '';

    homepage = http://www.pango.org/;
-    license = stdenv.lib.licenses.lgpl2Plus;
+    license = licenses.lgpl2Plus;

-    maintainers = with stdenv.lib.maintainers; [ raskin urkud ];
-    hydraPlatforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
+    maintainers = with maintainers; [ raskin urkud ];
+    platforms = with platforms; linux ++ darwin;
  };
 }
--- a/pkgs/development/libraries/pcre/cve-2015-3210.patch
+++ b/pkgs/development/libraries/pcre/cve-2015-3210.patch
@@ -0,0 +1,87 @@
+From 68ff1beb43bb3d4d8838f3285c97023d1e50513a Mon Sep 17 00:00:00 2001
+From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date: Fri, 15 May 2015 17:17:03 +0000
+Subject: [PATCH] Fix buffer overflow for named recursive back reference when
+ the name is duplicated.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Upstream commit ported to pcre-8.37:
+
+commit 4b79af6b4cbeb5326ae5e4d83f3e935e00286c19
+Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date:   Fri May 15 17:17:03 2015 +0000
+
+    Fix buffer overflow for named recursive back reference when the name is
+    duplicated.
+
+    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1558 2f5784b3-3f2a-0410-8824-cb99058d5e15
+
+This fixes CVE-2015-3210.
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ pcre_compile.c       | 16 ++++++++++++++--
+ testdata/testinput2  |  2 ++
+ testdata/testoutput2 |  2 ++
+ 3 files changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/pcre_compile.c b/pcre_compile.c
+index 0efad26..6f06912 100644
+--- a/pcre_compile.c
+++ b/pcre_compile.c
+@@ -7173,14 +7173,26 @@ for (;; ptr++)
+           number. If the name is not found, set the value to 0 for a forward
+           reference. */
+ 
+          recno = 0;
+           ng = cd->named_groups;
+           for (i = 0; i < cd->names_found; i++, ng++)
+             {
+             if (namelen == ng->length &&
+                 STRNCMP_UC_UC(name, ng->name, namelen) == 0)
+-              break;
+              {
+              open_capitem *oc;
+              recno = ng->number;
+              if (is_recurse) break;
+              for (oc = cd->open_caps; oc != NULL; oc = oc->next)         
+                {          
+                if (oc->number == recno)                                     
+                  {               
+                  oc->flag = TRUE;                                      
+                  break;
+                  }                                                         
+                }                          
+              }    
+             }
+-          recno = (i < cd->names_found)? ng->number : 0;
+ 
+           /* Count named back references. */
+ 
+diff --git a/testdata/testinput2 b/testdata/testinput2
+index 58fe53b..83bb471 100644
+--- a/testdata/testinput2
+++ b/testdata/testinput2
+@@ -4152,4 +4152,6 @@ backtracking verbs. --/
+ 
+ /((?2){73}(?2))((?1))/
+ 
+"(?J)(?'d'(?'d'\g{d}))"
+
+ /-- End of testinput2 --/
+diff --git a/testdata/testoutput2 b/testdata/testoutput2
+index b718df0..7dff52a 100644
+--- a/testdata/testoutput2
+++ b/testdata/testoutput2
+@@ -14423,4 +14423,6 @@ Failed: lookbehind assertion is not fixed length at offset 17
+ 
+ /((?2){73}(?2))((?1))/
+ 
+"(?J)(?'d'(?'d'\g{d}))"
+
+ /-- End of testinput2 --/
+-- 
+2.4.3
+
--- a/pkgs/development/libraries/pcre/cve-2015-5073.patch
+++ b/pkgs/development/libraries/pcre/cve-2015-5073.patch
@@ -0,0 +1,68 @@
+From 354e1f8e921dcb9cf2f3a5eac93cd826d01a7d8a Mon Sep 17 00:00:00 2001
+From: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date: Tue, 23 Jun 2015 16:34:53 +0000
+Subject: [PATCH] Fix buffer overflow for forward reference within backward
+ assertion with excess closing parenthesis. Bugzilla 1651.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is upstream commit ported to 8.37:
+
+commit 764692f9aea9eab50fdba6cb537441d8b34c6c37
+Author: ph10 <ph10@2f5784b3-3f2a-0410-8824-cb99058d5e15>
+Date:   Tue Jun 23 16:34:53 2015 +0000
+
+    Fix buffer overflow for forward reference within backward assertion with excess
+    closing parenthesis. Bugzilla 1651.
+
+    git-svn-id: svn://vcs.exim.org/pcre/code/trunk@1571 2f5784b3-3f2a-0410-8824-cb99058d5e15
+
+It fixes CVE-2015-5073.
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ pcre_compile.c       | 2 +-
+ testdata/testinput2  | 2 ++
+ testdata/testoutput2 | 3 +++
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/pcre_compile.c b/pcre_compile.c
+index 6f06912..b66b1f6 100644
+--- a/pcre_compile.c
+++ b/pcre_compile.c
+@@ -9392,7 +9392,7 @@ OP_RECURSE that are not fixed length get a diagnosic with a useful offset. The
+ exceptional ones forgo this. We scan the pattern to check that they are fixed
+ length, and set their lengths. */
+ 
+-if (cd->check_lookbehind)
+if (errorcode == 0 && cd->check_lookbehind)
+   {
+   pcre_uchar *cc = (pcre_uchar *)codestart;
+ 
+diff --git a/testdata/testinput2 b/testdata/testinput2
+index 83bb471..5cc9ce6 100644
+--- a/testdata/testinput2
+++ b/testdata/testinput2
+@@ -4154,4 +4154,6 @@ backtracking verbs. --/
+ 
+ "(?J)(?'d'(?'d'\g{d}))"
+ 
+/(?=di(?<=(?1))|(?=(.))))/
+
+ /-- End of testinput2 --/
+diff --git a/testdata/testoutput2 b/testdata/testoutput2
+index 7dff52a..4decb8d 100644
+--- a/testdata/testoutput2
+++ b/testdata/testoutput2
+@@ -14425,4 +14425,7 @@ Failed: lookbehind assertion is not fixed length at offset 17
+ 
+ "(?J)(?'d'(?'d'\g{d}))"
+ 
+/(?=di(?<=(?1))|(?=(.))))/
+Failed: unmatched parentheses at offset 23
+
+ /-- End of testinput2 --/
+-- 
+2.4.3
+
--- a/pkgs/development/libraries/pcre/default.nix
+++ b/pkgs/development/libraries/pcre/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, unicodeSupport ? true, cplusplusSupport ? true
+{ stdenv, fetchurl, unicodeSupport ? true, cplusplusSupport ? true
 , windows ? null
 }:

@@ -12,12 +12,10 @@ stdenv.mkDerivation rec {
    sha256 = "17bqykp604p7376wj3q2nmjdhrb6v1ny8q08zdwi7qvc02l9wrsi";
  };

-  nativeBuildInputs = [ autoreconfHook ];
-
-  # A bundle of fixes which should be removed for 8.38
-  patchPhase = ''
-    patch -p0 -i ${./fixes.patch}
-  '';
+  patches =
+    [ ./cve-2015-3210.patch
+      ./cve-2015-5073.patch
+    ];

  outputs = [ "out" "doc" "man" ];

--- a/pkgs/development/libraries/pcre/fixes.patch
+++ b/pkgs/development/libraries/pcre/fixes.patch
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@@ -1,26 +1,28 @@
-{ fetchurl, stdenv, pkgconfig, perl, libpng, glib /*just passthru*/ }:
+{ fetchurl, stdenv, pkgconfig, libpng, glib /*just passthru*/ }:

 stdenv.mkDerivation rec {
-  name = "pixman-0.32.6";
+  name = "pixman-0.32.8";

  src = fetchurl {
-    url = "http://cairographics.org/releases/${name}.tar.gz";
-    sha256 = "0129g4zdrw5hif5783li7rzcr4vpbc2cfia91azxmsk0h0xx3zix";
+    url = "mirror://xorg/individual/lib/${name}.tar.bz2";
+    sha1 = "5c57045622265b877c9bf02d531973eadf942140";
  };

-  nativeBuildInputs = [ pkgconfig perl ];
-
-  buildInputs = [ libpng ]; # NOT in closure anyway
-
-  postInstall = glib.flattenInclude;
-
  patches = stdenv.lib.optional stdenv.isDarwin ./fix-clang36.patch;

-  configureFlags = if stdenv.isArm then ["--disable-arm-iwmmxt"] else null;
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = stdenv.lib.optional doCheck libpng;

-  meta = {
+  configureFlags = stdenv.lib.optional stdenv.isArm "--disable-arm-iwmmxt";
+
+  doCheck = true;
+
+  postInstall = glib.flattenInclude;
+
+  meta = with stdenv.lib; {
    homepage = http://pixman.org;
    description = "A low-level library for pixel manipulation";
-    license = stdenv.lib.licenses.mit;
+    license = licenses.mit;
+    platforms = platforms.all;
  };
 }
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -5,8 +5,8 @@
 }:

 let # beware: updates often break cups_filters build
-  version = "0.34.0"; # even major numbers are stable
-  sha256 = "1c2wa4pfzqmvzq1jpp3ps5nmzz745gcg8dnpwqpfdccy5ydbm90v";
+  version = "0.36.0"; # even major numbers are stable
+  sha256 = "13i440kv873wgmw50rs4d1v05cj0r7bqnghd70hp9vy44dxhdk4k";
 in
 stdenv.mkDerivation rec {
  name = "poppler-${suffix}-${version}";
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -3,11 +3,11 @@
 assert interactive -> readline != null && ncurses != null;

 stdenv.mkDerivation {
-  name = "sqlite-3.8.11.1";
+  name = "sqlite-3.9.2";

  src = fetchurl {
-    url = "http://sqlite.org/2015/sqlite-autoconf-3081101.tar.gz";
-    sha1 = "d0e22d7e361b6f50830a3cdeafe35311443f8f9a";
+    url = "http://sqlite.org/2015/sqlite-autoconf-3090200.tar.gz";
+    sha1 = "dae1ae5297fece9671ae0c434a7ecd0cda09c76a";
  };

  buildInputs = lib.optionals interactive [ readline ncurses ];
@@ -17,6 +17,7 @@ stdenv.mkDerivation {
  NIX_CFLAGS_COMPILE = [
    "-DSQLITE_ENABLE_COLUMN_METADATA"
    "-DSQLITE_ENABLE_DBSTAT_VTAB"
+    "-DSQLITE_ENABLE_JSON1"
    "-DSQLITE_ENABLE_FTS3"
    "-DSQLITE_ENABLE_FTS3_PARENTHESIS"
    "-DSQLITE_ENABLE_FTS4"
--- a/pkgs/development/libraries/wayland/default.nix
+++ b/pkgs/development/libraries/wayland/default.nix
@@ -8,11 +8,11 @@ assert expat != null;

 stdenv.mkDerivation rec {
  name = "wayland-${version}";
-  version = "1.8.1";
+  version = "1.9.0";

  src = fetchurl {
    url = "http://wayland.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "1j3gfzn8i0xhk3j34mwb2srrscjxfyi279jhyq80mz943j6r6z7i";
+    sha256 = "1yhy62vkbq8j8c9zaa6yzvn75cd99kfa8n2zfdwl80x019r711ww";
  };

  configureFlags = "--with-scanner --disable-documentation";
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, perl, python, ruby, bison, gperf, cmake
-, pkgconfig, gettext, gobjectIntrospection
+, pkgconfig, gettext, gobjectIntrospection, libnotify
 , gtk2, gtk3, wayland, libwebp, enchant
 , libxml2, libsoup, libsecret, libxslt, harfbuzz, libpthreadstubs
 , enableGeoLocation ? true, geoclue2, sqlite
@@ -11,7 +11,7 @@ assert enableGeoLocation -> geoclue2 != null;
 with stdenv.lib;
 stdenv.mkDerivation rec {
  name = "webkitgtk-${version}";
-  version = "2.8.5";
+  version = "2.10.0";

  meta = {
    description = "Web content rendering engine, GTK+ port";
@@ -25,12 +25,12 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://webkitgtk.org/releases/${name}.tar.xz";
-    sha256 = "082dw0d8jxvsapx30ypmy5h2srzfzi42c3zr9pbkzx1m959hq7rx";
+    sha256 = "0vb8ca6dd9hxb5ycp54bdyykp10blbq5b6qkbak4yf9mxwi5ccj2";
  };

  patches = [ ./finding-harfbuzz-icu.patch ];

-  cmakeFlags = [ "-DPORT=GTK" ];
+  cmakeFlags = [ "-DPORT=GTK" "-DUSE_LIBHYPHEN=0" ];

  # XXX: WebKit2 missing include path for gst-plugins-base.
  # Filled: https://bugs.webkit.org/show_bug.cgi?id=148894
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    gtk2 wayland libwebp enchant
+    gtk2 wayland libwebp enchant libnotify
    libxml2 libsecret libxslt harfbuzz libpthreadstubs
    gst-plugins-base
  ] ++ optional enableGeoLocation geoclue2;
@@ -51,5 +51,5 @@ stdenv.mkDerivation rec {
    libsoup gtk3
  ];

-  enableParallelBuilding = true; # build problems on Hydra
+  enableParallelBuilding = true;
 }