diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index d02e2cec53d..e64ecce1b4e 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -147,6 +147,7 @@
   skeidel = "Sven Keidel <svenkeidel@gmail.com>";
   smironov = "Sergey Mironov <ierton@gmail.com>";
   sprock = "Roger Mason <rmason@mun.ca>";
+  spwhitt = "Spencer Whitt <sw@swhitt.me>";
   sztupi = "Attila Sztupak <attila.sztupak@gmail.com>";
   tailhook = "Paul Colomiets <paul@colomiets.name>";
   thammers = "Tobias Hammerschmidt <jawr@gmx.de>";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 3965dc3e53e..85afcb824fb 100755
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -274,6 +274,7 @@
   ./services/networking/spiped.nix
   ./services/networking/ssh/lshd.nix
   ./services/networking/ssh/sshd.nix
+  ./services/networking/strongswan.nix
   ./services/networking/supybot.nix
   ./services/networking/syncthing.nix
   ./services/networking/tcpcrypt.nix
diff --git a/nixos/modules/services/networking/strongswan.nix b/nixos/modules/services/networking/strongswan.nix
new file mode 100644
index 00000000000..19ad635d07e
--- /dev/null
+++ b/nixos/modules/services/networking/strongswan.nix
@@ -0,0 +1,133 @@
+{ config, lib, pkgs, ... }:
+
+let
+
+  inherit (builtins) toFile;
+  inherit (lib) concatMapStringsSep concatStringsSep mapAttrsToList
+                mkIf mkEnableOption mkOption types;
+
+  cfg = config.services.strongswan;
+
+  ipsecSecrets = secrets: toFile "ipsec.secrets" (
+    concatMapStringsSep "\n" (f: "include ${f}") secrets
+  );
+
+  ipsecConf = {setup, connections, ca}:
+    let
+      # https://wiki.strongswan.org/projects/strongswan/wiki/IpsecConf
+      makeSections = type: sections: concatStringsSep "\n\n" (
+        mapAttrsToList (sec: attrs:
+          "${type} ${sec}\n" +
+            (concatStringsSep "\n" ( mapAttrsToList (k: v: "  ${k}=${v}") attrs ))
+        ) sections
+      );
+      setupConf       = makeSections "config" { inherit setup; };
+      connectionsConf = makeSections "conn" connections;
+      caConf          = makeSections "ca" ca;
+
+    in
+    builtins.toFile "ipsec.conf" ''
+      ${setupConf}
+      ${connectionsConf}
+      ${caConf}
+    '';
+
+  strongswanConf = {setup, connections, ca, secrets}: toFile "strongswan.conf" ''
+    charon {
+      plugins {
+        stroke {
+          secrets_file = ${ipsecSecrets secrets}
+        }
+      }
+    }
+
+    starter {
+      config_file = ${ipsecConf { inherit setup connections ca; }}
+    }
+  '';
+
+in
+{
+  options.services.strongswan = {
+    enable = mkEnableOption "strongSwan";
+
+    secrets = mkOption {
+      type = types.listOf types.path;
+      default = [];
+      example = [ "/run/keys/ipsec-foo.secret" ];
+      description = ''
+        A list of paths to IPSec secret files. These
+        files will be included into the main ipsec.secrets file with
+        the <literal>include</literal> directive. It is safer if these
+        paths are absolute.
+      '';
+    };
+
+    setup = mkOption {
+      type = types.attrsOf types.str;
+      default = {};
+      example = { cachecrls = "yes"; strictcrlpolicy = "yes"; };
+      description = ''
+        A set of options for the ‘config setup’ section of the
+        <filename>ipsec.conf</filename> file. Defines general
+        configuration parameters.
+      '';
+    };
+
+    connections = mkOption {
+      type = types.attrsOf (types.attrsOf types.str);
+      default = {};
+      example = {
+        "%default" = {
+          keyexchange = "ikev2";
+          keyingtries = "1";
+        };
+        roadwarrior = {
+          auto       = "add";
+          leftcert   = "/run/keys/moonCert.pem";
+          leftid     = "@moon.strongswan.org";
+          leftsubnet = "10.1.0.0/16";
+          right      = "%any";
+        };
+      };
+      description = ''
+        A set of connections and their options for the ‘conn xxx’
+        sections of the <filename>ipsec.conf</filename> file.
+      '';
+    };
+
+    ca = mkOption {
+      type = types.attrsOf (types.attrsOf types.str);
+      default = {};
+      example = {
+        strongswan = {
+          auto   = "add";
+          cacert = "/run/keys/strongswanCert.pem";
+          crluri = "http://crl2.strongswan.org/strongswan.crl";
+        };
+      };
+      description = ''
+        A set of CAs (certification authorities) and their options for
+        the ‘ca xxx’ sections of the <filename>ipsec.conf</filename>
+        file.
+      '';
+    };
+  };
+
+  config = with cfg; mkIf enable {
+    systemd.services.strongswan = {
+      description = "strongSwan IPSec Service";
+      wantedBy = [ "multi-user.target" ];
+      path = with pkgs; [ kmod ]; # XXX Linux
+      wants = [ "keys.target" ];
+      after = [ "network.target" "keys.target" ];
+      environment = {
+        STRONGSWAN_CONF = strongswanConf { inherit setup connections ca secrets; };
+      };
+      serviceConfig = {
+        ExecStart  = "${pkgs.strongswan}/sbin/ipsec start --nofork";
+      };
+    };
+  };
+}
+
diff --git a/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix b/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
index d7bdd81b7eb..c0ed2041639 100644
--- a/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix
@@ -4,6 +4,17 @@ with lib;
 
 let
 
+  httpd = serverInfo.serverConfig.package;
+
+  version24 = !versionOlder httpd.version "2.4";
+
+  allGranted = if version24 then ''
+    Require all granted
+  '' else ''
+    Order allow,deny
+    Allow from all
+  '';
+
   mediawikiConfig = pkgs.writeText "LocalSettings.php"
     ''
       <?php
@@ -121,8 +132,7 @@ in
         Alias ${config.urlPrefix}/images ${config.uploadDir}
 
         <Directory ${config.uploadDir}>
-            Order allow,deny
-            Allow from all
+            ${allGranted}
             Options -Indexes
         </Directory>
       ''}
@@ -142,8 +152,7 @@ in
       ''}
 
       <Directory ${mediawikiRoot}>
-          Order allow,deny
-          Allow from all
+          ${allGranted}
           DirectoryIndex index.php
       </Directory>
 
diff --git a/pkgs/applications/editors/idea/default.nix b/pkgs/applications/editors/idea/default.nix
index 8f055476dcd..7f69e1864c1 100644
--- a/pkgs/applications/editors/idea/default.nix
+++ b/pkgs/applications/editors/idea/default.nix
@@ -147,6 +147,7 @@ let
   buildRubyMine = { name, version, build, src, license, description }:
     (mkIdeaProduct rec {
       inherit name version build src;
+      patchSnappy = false;
       product = "RubyMine";
       meta = with stdenv.lib; {
         homepage = "https://www.jetbrains.com/ruby/";
@@ -208,62 +209,62 @@ in
 
   android-studio = buildAndroidStudio rec {
     name = "android-studio-${version}";
-    version = "0.8.12";
-    build = "135.1503853";
+    version = "1.0.0-rc1";
+    build = "135.1598475";
     description = "Android development environment based on IntelliJ IDEA";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://dl.google.com/dl/android/studio/ide-zips/${version}" +
             "/android-studio-ide-${build}-linux.zip";
-      sha256 = "225c8b2f90b9159c465eae5797132350660994184a568c631d4383313a510695";
+      sha256 = "1d0gj9c2hkrcij79xv8i5fy1z8zss1fp8szjp6h7z7zak989rsrf";
     };
   };
 
   clion = buildClion rec {
     name = "clion";
     version = "eap";
-    build = "138.2344.17";
+    build = "140.569.17";
     description  = "C/C++ IDE. New. Intelligent. Cross-platform.";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "http://download.jetbrains.com/cpp/${name}-${build}.tar.gz";
-      sha256 = "4b568d31132a787b748bc41c69b614dcd90229db69b02406677361bc077efab3";
+      sha256 = "1y4137dxbydf3g5s6c58bf015k2q7dsl8h4n0q2llqj5bprwcr23";
     };
   };
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "14";
-    build = "IC-139.224";
+    version = "14.0.1";
+    build = "IC-139.225";
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "http://download-ln.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "72e1e7659aa90c0b520eed8190fa96899e26bde7448a9fe4ed43929ef25c508a";
+      sha256 = "166m55q33q4jwfvzwxm8mak6ic32h63bvpxdnjd41si6bs19ynvg";
     };
   };
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "14";
-    build = "IU-139.224";
+    version = "14.0.1";
+    build = "IU-139.225";
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "http://download-ln.jetbrains.com/idea/ideaIU-${version}.tar.gz";
-      sha256 = "e1c86f0b39e74b3468f7512d299ad9e0ca0c492316e996e65089368aff5446c6";
+      sha256 = "0hh84f3297ak63n2kv76xv1rnf1fhjws9d3b2r5pwzgfd78zja4q";
     };
   };
 
   ruby-mine = buildRubyMine rec {
     name = "ruby-mine-${version}";
-    version = "6.3.3";
+    version = "7.0";
     build = "135.1104";
     description = "The Most Intelligent Ruby and Rails IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "http://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "58d555c2702a93fe62f3809a5cc34e566ecce0c3f1f15daaf87744402157dfac";
+      sha256 = "0xsx44gaddarkw5k4yjidzwkayf2xvsxklfzdnzcck4rg4vyk4v4";
     };
   };
 
diff --git a/pkgs/applications/gis/saga/default.nix b/pkgs/applications/gis/saga/default.nix
index a990e19dbc3..bb31b24bf5e 100644
--- a/pkgs/applications/gis/saga/default.nix
+++ b/pkgs/applications/gis/saga/default.nix
@@ -2,23 +2,22 @@
   libharu, opencv, vigra, postgresql }:
 
 stdenv.mkDerivation rec {
-  name = "saga-2.1.2";
+  name = "saga-2.1.4";
 
   buildInputs = [ gdal wxGTK30 proj libharu opencv vigra postgresql libiodbc lzma jasper ];
 
   enableParallelBuilding = true;
 
   src = fetchurl {
-    url = "http://sourceforge.net/projects/saga-gis/files/SAGA%20-%202.1/SAGA%202.1.2/saga_2.1.2.tar.gz";
-    sha256 = "51885446f717191210c4b13f0c35a1c5194c9d696d4f9b8f594bc1014809b2f5";
+    url = "http://sourceforge.net/projects/saga-gis/files/SAGA%20-%202.1/SAGA%202.1.4/saga_2.1.4.tar.gz";
+    sha256 = "694e4102f592f512c635328c40fdeff33493f74698d9466bb654baf3247e7b76";
   };
 
   meta = {
-    description = "SAGA - System for Automated Geoscientific Analyses";
+    description = "System for Automated Geoscientific Analyses";
     homepage = http://www.saga-gis.org;
     license = stdenv.lib.licenses.gpl2Plus;
     maintainers = [ stdenv.lib.maintainers.michelk ];
-    platforms = with stdenv.lib.platforms; linux;
-    broken = true;
+    platforms = ["x86_64-linux" ];
   };
 }
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index da2ca64d975..69bc2006666 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   name = "ImageMagick-${version}";
 
   src = fetchurl {
-    url = "mirror://imagemagick/${name}.tar.xz";
+    url = "mirror://imagemagick/releases/${name}.tar.xz";
     sha256 = "1c792hbwi308lm9xkml319xaa4w3bz6hwy6i92jwrm7kqr4h8di7";
   };
 
diff --git a/pkgs/applications/graphics/openimageio/default.nix b/pkgs/applications/graphics/openimageio/default.nix
index b0abecc7cae..473db68dc27 100644
--- a/pkgs/applications/graphics/openimageio/default.nix
+++ b/pkgs/applications/graphics/openimageio/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name = "oiio-${version}";
-  version = "1.4.14";
+  version = "1.4.15";
 
   src = fetchurl {
     url = "https://github.com/OpenImageIO/oiio/archive/Release-${version}.zip";
-    sha256 = "1wn51d7044wyh25bwykxiw8rysb0v0sy2cfj6pyk5fg6rsr9cx51";
+    sha256 = "1fc5v3qmrzf9qx765fd15r2dc3ccrz4xf4f9q4cwsrspmaxqyqzs";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 49ddaae04f9..cfdddf28856 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -69,7 +69,7 @@ let
     use_system_xdg_utils = true;
     use_system_yasm = true;
     use_system_zlib = false;
-    use_system_protobuf = versionOlder source.version "40.0.0.0";
+    use_system_protobuf = false; # needs newer protobuf
 
     use_system_harfbuzz = false;
     use_system_icu = false; # Doesn't support ICU 52 yet.
diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index f122e753b5c..75d5f1c248e 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -55,26 +55,33 @@ let
       "x-scheme-handler/ftp"
       "x-scheme-handler/mailto"
       "x-scheme-handler/webcal"
+      "x-scheme-handler/about"
+      "x-scheme-handler/unknown"
     ];
     categories = "Network;WebBrowser";
   };
 
+  suffix = if channel != "stable" then "-" + channel else "";
+
 in stdenv.mkDerivation {
-  name = "chromium${if channel != "stable" then "-" + channel else ""}-${chromium.browser.version}";
+  name = "chromium${suffix}-${chromium.browser.version}";
 
   buildInputs = [ makeWrapper ];
 
   buildCommand = let
     browserBinary = "${chromium.browser}/libexec/chromium/chromium";
     sandboxBinary = "${chromium.sandbox}/bin/chromium-sandbox";
-  in ''
+    mkEnvVar = key: val: "--set '${key}' '${val}'";
+    envVars = chromium.plugins.settings.envVars or {};
+    flags = chromium.plugins.settings.flags or [];
+  in with stdenv.lib; ''
     mkdir -p "$out/bin" "$out/share/applications"
 
     ln -s "${chromium.browser}/share" "$out/share"
     makeWrapper "${browserBinary}" "$out/bin/chromium" \
       --set CHROMIUM_SANDBOX_BINARY_PATH "${sandboxBinary}" \
-      --run "export ${chromium.plugins.envVarsEnabled}" \
-      --add-flags "${chromium.plugins.flagsEnabled}"
+      ${concatStrings (mapAttrsToList mkEnvVar envVars)} \
+      --add-flags "${concatStringsSep " " flags}"
 
     ln -s "$out/bin/chromium" "$out/bin/chromium-browser"
     ln -s "${chromium.browser}/share/icons" "$out/share/icons"
diff --git a/pkgs/applications/networking/browsers/chromium/plugins.nix b/pkgs/applications/networking/browsers/chromium/plugins.nix
index 8098ec74722..55e0cc4caa2 100644
--- a/pkgs/applications/networking/browsers/chromium/plugins.nix
+++ b/pkgs/applications/networking/browsers/chromium/plugins.nix
@@ -62,29 +62,38 @@ let
       install -vD PepperFlash/libpepflashplayer.so \
         "$flash/lib/libpepflashplayer.so"
       mkdir -p "$flash/nix-support"
-      echo "--ppapi-flash-path='$flash/lib/libpepflashplayer.so'" \
-           "--ppapi-flash-version=$flashVersion" \
-           > "$flash/nix-support/chromium-flags"
+      cat > "$flash/nix-support/chromium-plugin.nix" <<NIXOUT
+        { flags = [
+            "--ppapi-flash-path='$flash/lib/libpepflashplayer.so'"
+            "--ppapi-flash-version=$flashVersion"
+          ];
+        }
+      NIXOUT
 
       install -vD libwidevinecdm.so \
         "$widevine/lib/libwidevinecdm.so"
       install -vD libwidevinecdmadapter.so \
         "$widevine/lib/libwidevinecdmadapter.so"
       mkdir -p "$widevine/nix-support"
-      echo "--register-pepper-plugins='${wvModule}${wvInfo}'" \
-        > "$widevine/nix-support/chromium-flags"
-      echo "NIX_CHROMIUM_PLUGIN_PATH_WIDEVINE=$widevine/lib" \
-        > "$widevine/nix-support/chromium-env-vars"
+      cat > "$widevine/nix-support/chromium-plugin.nix" <<NIXOUT
+        { flags = [ "--register-pepper-plugins='${wvModule}${wvInfo}'" ];
+          envVars.NIX_CHROMIUM_PLUGIN_PATH_WIDEVINE = "$widevine/lib";
+        }
+      NIXOUT
     '';
 
     passthru = let
       enabledPlugins = optional enablePepperFlash plugins.flash
                     ++ optional enableWideVine    plugins.widevine;
-      getFlags = plugin: "$(< ${plugin}/nix-support/chromium-flags)";
-      getEnvVars = plugin: "$(< ${plugin}/nix-support/chromium-env-vars)";
+      getNix = plugin: import "${plugin}/nix-support/chromium-plugin.nix";
+      mergeAttrsets = let
+        f = v: if all isAttrs v then mergeAttrsets v
+          else if all isList  v then concatLists   v
+          else if tail v == []  then head          v
+          else head (tail v);
+      in fold (l: r: zipAttrsWith (_: f) [ l r ]) {};
     in {
-      flagsEnabled = concatStringsSep " " (map getFlags enabledPlugins);
-      envVarsEnabled = concatStringsSep " " (map getEnvVars enabledPlugins);
+      settings = mergeAttrsets (map getNix enabledPlugins);
     };
   };
 in plugins
diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index 7e48eb83653..3f85467fe31 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -151,11 +151,10 @@ stdenv.mkDerivation {
     '';
 
   meta = with stdenv.lib; {
-    description = "Mozilla Firefox, free web browser";
+    description = "Mozilla Firefox, free web browser (binary package)";
     homepage = http://www.mozilla.org/firefox/;
     license = {
-      shortName = "unfree"; # not sure
-      fullName = "unfree";
+      free = false;
       url = http://www.mozilla.org/en-US/foundation/trademarks/policy/;
     };
     platforms = platforms.linux;
diff --git a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer-11/default.nix b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer-11/default.nix
index 656a639b2c3..c742f414cd1 100644
--- a/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer-11/default.nix
+++ b/pkgs/applications/networking/browsers/mozilla-plugins/flashplayer-11/default.nix
@@ -36,7 +36,7 @@
 
 let
   # -> http://get.adobe.com/flashplayer/
-  version = "11.2.202.418";
+  version = "11.2.202.424";
 
   src =
     if stdenv.system == "x86_64-linux" then
@@ -47,7 +47,7 @@ let
       else rec {
         inherit version;
         url = "http://fpdownload.macromedia.com/get/flashplayer/pdc/${version}/install_flash_player_11_linux.x86_64.tar.gz";
-        sha256 = "0c7iid6apab99axrhl509hycbc4yc55k8xrh0pvr005q5jlmx99n";
+        sha256 = "1nkk77lbvvq9x17rlygwlkprq2pgnci5riwxvvriknkqr277dhz8";
       }
     else if stdenv.system == "i686-linux" then
       if debug then
@@ -60,7 +60,7 @@ let
       else rec {
         inherit version;
         url = "http://fpdownload.macromedia.com/get/flashplayer/pdc/${version}/install_flash_player_11_linux.i386.tar.gz";
-        sha256 = "17mpjvkvvb7wwmyvwz93w7q4lvjrpma1f9lcf83i927jqpzg8x73";
+        sha256 = "1zwlzc7z6q8vr5hjzx6jywjcx9r0g9jxz141hlf6lqzicf4x6qan";
       }
     else throw "Flash Player is not supported on this platform";
 
diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
index 41a24dc8a9f..55e5820a5d2 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
@@ -141,11 +141,10 @@ stdenv.mkDerivation {
     '';
 
   meta = with stdenv.lib; {
-    description = "Mozilla Thunderbird, a full-featured email client";
+    description = "Mozilla Thunderbird, a full-featured email client (binary package)";
     homepage = http://www.mozilla.org/thunderbird/;
     license = {
-      shortName = "unfree"; # not sure
-      fullName = "unfree";
+      free = false;
       url = http://www.mozilla.org/en-US/foundation/trademarks/policy/;
     };
     maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
diff --git a/pkgs/applications/office/zim/default.nix b/pkgs/applications/office/zim/default.nix
index 658f460793f..85ec081ea41 100644
--- a/pkgs/applications/office/zim/default.nix
+++ b/pkgs/applications/office/zim/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   name = "zim-${version}";
-  version = "0.60";
+  version = "0.62";
   namePrefix = "";
   
   src = fetchurl {
-    url = "http://zim-wiki.org/downloads/zim-0.61.tar.gz";
-    sha256 = "0jncxkf83bwra3022jbvjfwhk5w8az0jlwr8nsvm7wa1zfrajhsq";
+    url = "http://zim-wiki.org/downloads/${name}.tar.gz";
+    sha256 = "1hmx24jjazqvs3z6h10jl8wrqxyvvk0wc807v222vaf1sbmjmmhr";
   };
 
   propagatedBuildInputs = [ pythonPackages.sqlite3 pygtk /*pythonPackages.pyxdg*/ pygobject ];
@@ -100,4 +100,3 @@ buildPythonPackage rec {
       license = stdenv.lib.licenses.gpl2Plus;
   };
 }
-
diff --git a/pkgs/applications/version-management/git-and-tools/default.nix b/pkgs/applications/version-management/git-and-tools/default.nix
index 4cabe3a4e2a..71fb75a2157 100644
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@@ -99,4 +99,6 @@ rec {
   git-remote-hg = callPackage ./git-remote-hg { };
 
   gitRemoteGcrypt = callPackage ./git-remote-gcrypt { };
+
+  git-extras = callPackage ./git-extras { };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git-extras/default.nix b/pkgs/applications/version-management/git-and-tools/git-extras/default.nix
new file mode 100644
index 00000000000..3392c1c0021
--- /dev/null
+++ b/pkgs/applications/version-management/git-and-tools/git-extras/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "git-extras-${version}";
+  version = "2.2.0";
+
+  src = fetchurl {
+    url = "https://github.com/tj/git-extras/archive/${version}.tar.gz";
+    sha256 = "0qwgaj0r9lsmwricpnma9rm7llfrcqarcfk5iq3ilxkns8a334va";
+  };
+
+  phases = [ "unpackPhase" "installPhase" ];
+
+  makeFlags = "DESTDIR=$(out) PREFIX=";
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/tj/git-extras;
+    description = "GIT utilities -- repo summary, repl, changelog population, author commit percentages and more";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = [ maintainers.spwhitt ];
+  };
+}
diff --git a/pkgs/build-support/cabal/default.nix b/pkgs/build-support/cabal/default.nix
index 83294373c1e..ce0eca1a2bb 100644
--- a/pkgs/build-support/cabal/default.nix
+++ b/pkgs/build-support/cabal/default.nix
@@ -189,7 +189,16 @@ assert !enableStaticLibraries -> versionOlder "7.7" ghc.version;
             configurePhase = ''
               eval "$preConfigure"
 
-              ${optionalString self.jailbreak "${jailbreakCabal}/bin/jailbreak-cabal ${self.pname}.cabal"}
+              ${let newCabalFile = fetchurl {
+                      url = "http://hackage.haskell.org/package/${self.fname}/${self.pname}.cabal";
+                      sha256 = self.editedCabalFile;
+                    };
+                in
+                  optionalString (self.editedCabalFile or "" != "") ''
+                    echo "Replace Cabal file with edited version ${newCabalFile}."
+                    cp ${newCabalFile} ${self.pname}.cabal
+                  ''
+              }${optionalString self.jailbreak "${jailbreakCabal}/bin/jailbreak-cabal ${self.pname}.cabal"}
 
               for i in Setup.hs Setup.lhs ${defaultSetupHs}; do
                 test -f $i && break
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index b54088d047d..6284655e5e9 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -147,10 +147,10 @@ rec {
 
   # ImageMagick mirrors, see http://www.imagemagick.org/script/download.php.
   imagemagick = [
-    http://ftp.nluug.nl/pub/ImageMagick/
-    ftp://ftp.sunet.se/pub/multimedia/graphics/ImageMagick/
+    ftp://ftp.nluug.nl/pub/ImageMagick/
     ftp://ftp.imagemagick.org/pub/ImageMagick/
     ftp://ftp.imagemagick.net/pub/ImageMagick/
+    ftp://ftp.sunet.se/pub/multimedia/graphics/ImageMagick/
   ];
 
   # CPAN mirrors.
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 3b4a4cc74c7..df3f3ec8224 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl }:
 
-let version = "2014i"; in
+let version = "2014j"; in
 
 stdenv.mkDerivation rec {
   name = "tzdata-${version}";
@@ -8,11 +8,11 @@ stdenv.mkDerivation rec {
   srcs =
     [ (fetchurl {
         url = "http://www.iana.org/time-zones/repository/releases/tzdata${version}.tar.gz";
-        sha256 = "0lv1i3ikibf9yn1l3hcy00x5ghwxn87k1myyp1cyr55psayk3wra";
+        sha256 = "038fvj6zf51k6z9sbbxbj87ajaf69l3whal2vwshbm4l0qr71n52";
       })
       (fetchurl {
         url = "http://www.iana.org/time-zones/repository/releases/tzcode${version}.tar.gz";
-        sha256 = "10s7x24lh2vm3magl7dq2xs9pw47hhyaq6xpi6c4aiqdzdsi0nb2";
+        sha256 = "1qpd12imy7q5hb5fhk48mfw65s0xlrkmms0zr2gk0mj88qjn3m3z";
       })
     ];
 
diff --git a/pkgs/desktops/gnome-3/3.12/core/evince/default.nix b/pkgs/desktops/gnome-3/3.12/core/evince/default.nix
index 2a585d78f4e..aaef1d59ed9 100644
--- a/pkgs/desktops/gnome-3/3.12/core/evince/default.nix
+++ b/pkgs/desktops/gnome-3/3.12/core/evince/default.nix
@@ -6,11 +6,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "evince-3.12.1";
+  name = "evince-3.12.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/3.12/${name}.tar.xz";
-    sha256 = "ef22cc29a7cbe70d2e7ce8c0b5b7ee774187ea69f3ae49a64c6d4a91559ef137";
+    sha256 = "30c243bbfde56338c25a39003b4848143be42157177e2163a368f14139909f7d";
   };
 
   buildInputs = [
diff --git a/pkgs/development/compilers/julia/0.3.2.nix b/pkgs/development/compilers/julia/0.3.3.nix
similarity index 80%
rename from pkgs/development/compilers/julia/0.3.2.nix
rename to pkgs/development/compilers/julia/0.3.3.nix
index 2040d62a0c8..10441fd785a 100644
--- a/pkgs/development/compilers/julia/0.3.2.nix
+++ b/pkgs/development/compilers/julia/0.3.3.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchgit, gfortran, perl, m4, llvm, gmp, pcre, zlib
  , readline, fftwSinglePrec, fftw, libunwind, suitesparse, glpk, fetchurl
- , ncurses, libunistring, lighttpd, patchelf, openblas, liblapack
+ , ncurses, libunistring, patchelf, openblas, liblapack
  , tcl, tk, xproto, libX11, git, mpfr, which
  } :
 
@@ -11,64 +11,59 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "julia";
-  version = "0.3.2";
+  version = "0.3.3";
   name = "${pname}-${version}";
 
   dsfmt_ver = "2.2";
   grisu_ver = "1.1.1";
-  openblas_ver = "v0.2.10";
+  openblas_ver = "v0.2.12";
   lapack_ver = "3.5.0";
   arpack_ver = "3.1.5";
-  lighttpd_ver = "1.4.29";
-  patchelf_ver = "0.6";
-  pcre_ver = "8.31";
+  patchelf_ver = "0.8";
+  pcre_ver = "8.36";
   utf8proc_ver = "1.1.6";
 
   dsfmt_src = fetchurl {
     url = "http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/SFMT/dSFMT-src-${dsfmt_ver}.tar.gz";
     name = "dsfmt-${dsfmt_ver}.tar.gz";
-    sha256 = "bc3947a9b2253a869fcbab8ff395416cb12958be9dba10793db2cd7e37b26899";
+    md5 = "cb61be3be7254eae39684612c524740d";
   };
   grisu_src = fetchurl {
     url = "http://double-conversion.googlecode.com/files/double-conversion-${grisu_ver}.tar.gz";
-    sha256 = "e1cabb73fd69e74f145aea91100cde483aef8b79dc730fcda0a34466730d4d1d";
+    md5 = "29b533ed4311161267bff1a9a97e2953";
   };
   openblas_src = fetchurl {
     url = "https://github.com/xianyi/OpenBLAS/tarball/${openblas_ver}";
     name = "openblas-${openblas_ver}.tar.gz";
-    sha256 = "06i0q4qnd5q5xljzrgvda0gjsczc6l2pl9hw6dn2qjpw38al73za";
+    md5 = "dfc868e0c134855639f036d2723bf4be";
   };
   arpack_src = fetchurl rec {
     url = "https://github.com/opencollab/arpack-ng/archive/${arpack_ver}.tar.gz";
-    sha256 = "164hc2qcvr7fvvf7bn2k7z40hyyv8hhhzjr6jq0mq6a7l80x02gn";
+    md5 = "d84e1b6108d9ee67c0d21aba7099e953";
     name = "arpack-ng-${arpack_ver}.tar.gz";
   };
   lapack_src = fetchurl {
     url = "http://www.netlib.org/lapack/lapack-${lapack_ver}.tgz";
     name = "lapack-${lapack_ver}.tgz";
-    sha256 = "0lk3f97i9imqascnlf6wr5mjpyxqcdj73pgj97dj2mgvyg9z1n4s";
-  };
-  lighttpd_src = fetchurl {
-    url = "http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-${lighttpd_ver}.tar.gz";
-    sha256 = "ff9f4de3901d03bb285634c5b149191223d17f1c269a16c863bac44238119c85";
+    md5 = "b1d3e3e425b2e44a06760ff173104bdf";
   };
   patchelf_src = fetchurl {
     url = "http://hydra.nixos.org/build/1524660/download/2/patchelf-${patchelf_ver}.tar.bz2";
-    sha256 = "00bw29vdsscsili65wcb5ay0gvg1w0ljd00sb5xc6br8bylpyzpw";
+    md5 = "5087261514b4b5814a39c3d3a36eb6ef";
   };
   pcre_src = fetchurl {
     url = "ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-${pcre_ver}.tar.bz2";
-    sha256 = "0g4c0z4h30v8g8qg02zcbv7n67j5kz0ri9cfhgkpwg276ljs0y2p";
+    md5 = "b767bc9af0c20bc9c1fe403b0d41ad97";
   };
   utf8proc_src = fetchurl {
     url = "http://www.public-software-group.org/pub/projects/utf8proc/v${utf8proc_ver}/utf8proc-v${utf8proc_ver}.tar.gz";
-    sha256 = "1rwr84pw92ajjlbcxq0da7yxgg3ijngmrj7vhh2qzsr2h2kqzp7y";
+    md5 = "2462346301fac2994c34f5574d6c3ca7";
   };
 
   src = fetchgit {
     url = "git://github.com/JuliaLang/julia.git";
     rev = "refs/tags/v${version}";
-    sha256 = "11w81mznhlfcnn6vcv1rhrbajnyz8aim29wvwl92zsllq8z9hv2i";
+    md5 = "84266f0201ad34abe8ca1474620fe891";
     name = "julia-git-v${version}";
   };
 
@@ -78,7 +73,7 @@ stdenv.mkDerivation rec {
     ];
 
   configurePhase = ''
-    for i in GMP LLVM PCRE READLINE FFTW LIBUNWIND SUITESPARSE GLPK LIGHTTPD ZLIB MPFR;
+    for i in GMP LLVM PCRE READLINE FFTW LIBUNWIND SUITESPARSE GLPK ZLIB MPFR;
     do
       makeFlags="$makeFlags USE_SYSTEM_$i=1 "
     done
diff --git a/pkgs/development/compilers/lessc/default.nix b/pkgs/development/compilers/lessc/default.nix
index 84a3a37de48..82052b3d3ca 100644
--- a/pkgs/development/compilers/lessc/default.nix
+++ b/pkgs/development/compilers/lessc/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "lessc-${version}";
-  version = "1.7.5";
+  version = "1.7.5"; # Upgrade to > 2.x breaks twitter-bootstrap
 
   src = fetchgit {
     url = https://github.com/less/less.js.git;
diff --git a/pkgs/development/interpreters/racket/default.nix b/pkgs/development/interpreters/racket/default.nix
index 8c26d1f89ef..b626c8a1539 100644
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, cairo, file, fontconfig, glib, gtk, freefont_ttf
-, libjpeg, libpng, libtool, makeWrapper, openssl, pango, sqlite, which } :
+, libjpeg, libpng, libtool, makeWrapper, openssl, pango, sqlite, which, readline } :
 
 stdenv.mkDerivation rec {
   pname = "racket";
@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
 
   # Various Racket executables do runtime searches for these.
   ffiSharedLibs = "${cairo}/lib:${fontconfig}/lib:${glib}/lib:${gtk}/lib:${libjpeg}/lib:"
-                + "${libpng}/lib:${openssl}/lib:${pango}/lib:${sqlite}/lib";
+                + "${libpng}/lib:${openssl}/lib:${pango}/lib:${sqlite}/lib:"
+                + "${readline}/lib";
 
   buildInputs = [ file fontconfig freefont_ttf libtool makeWrapper sqlite which ];
 
diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index 72906232eff..bb8289b661e 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -32,10 +32,13 @@ stdenv.mkDerivation rec {
     ;
 
   patches = [
-    (fetchpatch {
-      url = "http://cgit.freedesktop.org/fontconfig/patch/?id=f44157c809d280e2a0ce87fb078fc4b278d24a67";
-      sha256 = "19s5irclg4irj2yxd7xw9yikbazs9263px8qbv4r21asw06nfalv";
-    })
+    (fetchpatch ({
+        url = "http://cgit.freedesktop.org/fontconfig/patch/?id=f44157c809d280e2a0ce87fb078fc4b278d24a67";
+        sha256 = "19s5irclg4irj2yxd7xw9yikbazs9263px8qbv4r21asw06nfalv";
+      } // stdenv.lib.optionalAttrs (!stdenv.isLinux) {
+        name = "fc-cache-bug-77252.patch"; # TODO: collapse on mass rebuild
+      }
+    ))
     (substituteAll {
       src = ./config-compat.patch;
       inherit configVersion;
diff --git a/pkgs/development/libraries/haskell/distributed-process-monad-control/default.nix b/pkgs/development/libraries/haskell/distributed-process-monad-control/default.nix
new file mode 100644
index 00000000000..14adad13844
--- /dev/null
+++ b/pkgs/development/libraries/haskell/distributed-process-monad-control/default.nix
@@ -0,0 +1,20 @@
+# This file was auto-generated by cabal2nix. Please do NOT edit manually!
+
+{ cabal, distributedProcess, monadControl, transformers
+, transformersBase
+}:
+
+cabal.mkDerivation (self: {
+  pname = "distributed-process-monad-control";
+  version = "0.5.0";
+  sha256 = "1ja6xwdpssm7wafv2id6c3f49iw7pkks2smk6l1n1dxkh029z8nk";
+  buildDepends = [
+    distributedProcess monadControl transformers transformersBase
+  ];
+  meta = {
+    homepage = "http://haskell-distributed.github.io";
+    description = "Orphan instances for MonadBase and MonadBaseControl";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+  };
+})
diff --git a/pkgs/development/libraries/haskell/distributed-process-p2p/default.nix b/pkgs/development/libraries/haskell/distributed-process-p2p/default.nix
new file mode 100644
index 00000000000..165b09d13bf
--- /dev/null
+++ b/pkgs/development/libraries/haskell/distributed-process-p2p/default.nix
@@ -0,0 +1,23 @@
+# This file was auto-generated by cabal2nix. Please do NOT edit manually!
+
+{ cabal, binary, distributedProcess, mtl, network, networkTransport
+, networkTransportTcp
+}:
+
+cabal.mkDerivation (self: {
+  pname = "distributed-process-p2p";
+  version = "0.1.3.0";
+  sha256 = "00lvi2x1s8r7lwfvsjnvzc9iwdk4ip8svw85p2h3ra4iqbzj70l2";
+  isLibrary = true;
+  isExecutable = true;
+  buildDepends = [
+    binary distributedProcess mtl network networkTransport
+    networkTransportTcp
+  ];
+  meta = {
+    homepage = "https://bitbucket.org/dpwiz/distributed-process-p2p/";
+    description = "Peer-to-peer node discovery for Cloud Haskell";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+  };
+})
diff --git a/pkgs/development/libraries/haskell/ekg-bosun/default.nix b/pkgs/development/libraries/haskell/ekg-bosun/default.nix
index 44a810d9039..23876662f2a 100644
--- a/pkgs/development/libraries/haskell/ekg-bosun/default.nix
+++ b/pkgs/development/libraries/haskell/ekg-bosun/default.nix
@@ -6,13 +6,12 @@
 
 cabal.mkDerivation (self: {
   pname = "ekg-bosun";
-  version = "1.0.0";
-  sha256 = "0r7ri2mfqhxypjm96s03d00b3fh28mw79wkj2cbhk4w23v2rhdv0";
+  version = "1.0.2";
+  sha256 = "0q32yvl5j59s22v357j8vx0i3b5cd0gygh7gyibym5ka5d5xd82m";
   buildDepends = [
     aeson ekgCore httpClient lens network networkUri text time
     unorderedContainers vector wreq
   ];
-  jailbreak = true;
   meta = {
     homepage = "http://github.com/ocharles/ekg-bosun";
     description = "Send ekg metrics to a Bosun instance";
diff --git a/pkgs/development/libraries/haskell/pandoc/default.nix b/pkgs/development/libraries/haskell/pandoc/default.nix
index f6a1966ddd0..3788c1f3bf8 100644
--- a/pkgs/development/libraries/haskell/pandoc/default.nix
+++ b/pkgs/development/libraries/haskell/pandoc/default.nix
@@ -9,19 +9,13 @@
 , tagsoup, temporary, testFramework, testFrameworkHunit
 , testFrameworkQuickcheck2, texmath, text, time
 , unorderedContainers, vector, xml, yaml, zipArchive, zlib
-, fetchurl
 }:
 
-let
-  editedCabalFile = fetchurl {
-    url = "hackage.haskell.org/package/pandoc-1.13.1/pandoc.cabal";
-    sha256 = "1i57yk1pql4gv97cs86fk82hkwncics1wkzjqd9iz866204y4wrg";
-  };
-in
 cabal.mkDerivation (self: {
   pname = "pandoc";
   version = "1.13.1";
   sha256 = "0vvysa70xp4pskxrvslmddwdsalc479zb8wn6z1vmpvfssvvj6vv";
+  editedCabalFile = "1i57yk1pql4gv97cs86fk82hkwncics1wkzjqd9iz866204y4wrg";
   isLibrary = true;
   isExecutable = true;
   buildDepends = [
@@ -38,7 +32,6 @@ cabal.mkDerivation (self: {
     pandocTypes QuickCheck syb testFramework testFrameworkHunit
     testFrameworkQuickcheck2 text zipArchive
   ];
-  preConfigure = "cp ${editedCabalFile} pandoc.cabal";
   configureFlags = "-fhttps -fmake-pandoc-man-pages";
   jailbreak = true;
   doCheck = false;
diff --git a/pkgs/development/libraries/haskell/purescript/default.nix b/pkgs/development/libraries/haskell/purescript/default.nix
index a1d999d9a86..3a521ea121b 100644
--- a/pkgs/development/libraries/haskell/purescript/default.nix
+++ b/pkgs/development/libraries/haskell/purescript/default.nix
@@ -7,8 +7,8 @@
 
 cabal.mkDerivation (self: {
   pname = "purescript";
-  version = "0.6.1.1";
-  sha256 = "1wzaimcdddwivlzhb7m4888wwa58al2rccgdnhzng70r0r9qvpng";
+  version = "0.6.1.2";
+  sha256 = "0j1fmfcal2m75ji937xxl9cizzpw6v4pr31hxfjmal8fdcf677ma";
   isLibrary = true;
   isExecutable = true;
   buildDepends = [
diff --git a/pkgs/development/libraries/haskell/snap-error-collector/default.nix b/pkgs/development/libraries/haskell/snap-error-collector/default.nix
new file mode 100644
index 00000000000..fae4082d224
--- /dev/null
+++ b/pkgs/development/libraries/haskell/snap-error-collector/default.nix
@@ -0,0 +1,22 @@
+# This file was auto-generated by cabal2nix. Please do NOT edit manually!
+
+{ cabal, async, MonadCatchIOTransformers, monadLoops, snap, stm
+, time, transformers
+}:
+
+cabal.mkDerivation (self: {
+  pname = "snap-error-collector";
+  version = "1.0.0";
+  sha256 = "1rywfbc489kgbcm7svgrim3zihma5j9vy6cwhlc6dgvsb1rb37j2";
+  buildDepends = [
+    async MonadCatchIOTransformers monadLoops snap stm time
+    transformers
+  ];
+  meta = {
+    homepage = "http://github.com/ocharles/snap-error-collector";
+    description = "Collect errors in batches and dispatch them";
+    license = self.stdenv.lib.licenses.bsd3;
+    platforms = self.ghc.meta.platforms;
+    maintainers = with self.stdenv.lib.maintainers; [ ocharles ];
+  };
+})
diff --git a/pkgs/development/libraries/haskell/twitter-conduit/default.nix b/pkgs/development/libraries/haskell/twitter-conduit/default.nix
index 54d091ebb86..31542d43ebc 100644
--- a/pkgs/development/libraries/haskell/twitter-conduit/default.nix
+++ b/pkgs/development/libraries/haskell/twitter-conduit/default.nix
@@ -7,16 +7,11 @@
 , transformersBase, twitterTypes, twitterTypesLens, fetchurl
 }:
 
-let
-  editedCabalFile = fetchurl {
-    url = "http://hackage.haskell.org/package/twitter-conduit-0.1.0/twitter-conduit.cabal";
-    sha256 = "06z8dwvc17xhzpvb7cm0j6v63r5f3xirj36rr86bds3rw1zbnd0z";
-  };
-in
 cabal.mkDerivation (self: {
   pname = "twitter-conduit";
   version = "0.1.0";
   sha256 = "1cymgp3wlswxn5qfdr442cqq2ak48b5w1zcsr67n2g5p1izadwji";
+  editedCabalFile = "06z8dwvc17xhzpvb7cm0j6v63r5f3xirj36rr86bds3rw1zbnd0z";
   isLibrary = true;
   isExecutable = true;
   buildDepends = [
@@ -31,7 +26,6 @@ cabal.mkDerivation (self: {
     resourcet text time transformers transformersBase twitterTypes
     twitterTypesLens
   ];
-  preConfigure = "cp ${editedCabalFile} twitter-conduit.cabal";
   meta = {
     homepage = "https://github.com/himura/twitter-conduit";
     description = "Twitter API package with conduit interface and Streaming API support";
diff --git a/pkgs/development/libraries/protobuf/default.nix b/pkgs/development/libraries/protobuf/default.nix
index 0f52999bc0e..bba8481780a 100644
--- a/pkgs/development/libraries/protobuf/default.nix
+++ b/pkgs/development/libraries/protobuf/default.nix
@@ -1,41 +1,28 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, libtool, zlib, gtest }:
+{ fetchurl, stdenv, zlib }:
 
 stdenv.mkDerivation rec {
-  name = "protobuf-${version}";
-  version = "2.6.1";
+  name = "protobuf-2.5.0";
 
-  src = fetchFromGitHub {
-    owner = "google";
-    repo = "protobuf";
-    rev = version;
-    sha256 = "03df8zvx2sry3jz2x4pi3l32qyfqa7w8kj8jdbz30nzy0h7aa070";
+  src = fetchurl {
+    url = "http://protobuf.googlecode.com/files/${name}.tar.bz2";
+    sha256 = "0xxn9gxhvsgzz2sgmihzf6pf75clr05mqj6218camwrwajpcbgqk";
   };
 
-  postPatch = ''
-    sed -i -e '/gtest/d' Makefile.am
-    sed -i \
-      -e 's!\$(top_\(build\|src\)dir)/gtest!${gtest}!g' \
-      -e 's/\(libgtest[^.]*\.\)la/\1a/g' \
-      src/Makefile.am
-  '';
-
-  buildInputs = [ zlib autoconf automake libtool gtest ];
-
-  preConfigure = "autoreconf -vfi";
+  buildInputs = [ zlib ];
 
   doCheck = true;
 
   meta = {
     description = "Protocol Buffers - Google's data interchange format";
 
-    longDescription = ''
-      Protocol Buffers are a way of encoding structured data in an
-      efficient yet extensible format. Google uses Protocol Buffers for
-      almost all of its internal RPC protocols and file formats.
-    '';
+    longDescription =
+      '' Protocol Buffers are a way of encoding structured data in an
+         efficient yet extensible format.  Google uses Protocol Buffers for
+         almost all of its internal RPC protocols and file formats.
+      '';
 
-    license = stdenv.lib.licenses.bsd3;
+    license = "mBSD";
 
-    homepage = "https://developers.google.com/protocol-buffers/";
+    homepage = http://code.google.com/p/protobuf/;
   };
 }
diff --git a/pkgs/development/tools/build-managers/cargo/common.nix b/pkgs/development/tools/build-managers/cargo/common.nix
index e60efc18d29..447aed27570 100644
--- a/pkgs/development/tools/build-managers/cargo/common.nix
+++ b/pkgs/development/tools/build-managers/cargo/common.nix
@@ -14,16 +14,16 @@ rec {
     else throw "no snapshot to boostrap for this platform (missing platform url suffix)";
 
   snapshotHash = if stdenv.system == "i686-linux"
-    then "c92895421e6fa170dbd713e74334b8c3cf22b817"
+    then "3204c8a38721199f69d2971db887d1dc71a63825"
     else if stdenv.system == "x86_64-linux"
-    then "66ee4126f9e4820cd82e78181931f8ea365904de"
+    then "39ca0d02eac184bc764ff9c1f645ca361715c5c2"
     else if stdenv.system == "i686-darwin"
-    then "e2364b1f1ece338b9fc4c308c472fc2413bff04e"
+    then "ebc1836424c4b3ba49f9adef271c50d2a8e134c0"
     else if stdenv.system == "x86_64-darwin"
-    then "09f92f06ab4f048acf71d83dc0426ff1509779a9"
+    then "a2045e95984b65eab4a704152566f8ab9a3be518"
     else throw "no snapshot for platform ${stdenv.system}";
 
-  snapshotDate = "2014-09-19";
+  snapshotDate = "2014-11-22";
   snapshotName = "cargo-nightly-${platform}.tar.gz";
 
   snapshot = stdenv.mkDerivation {
diff --git a/pkgs/development/libraries/haskell/c2hs/default.nix b/pkgs/development/tools/haskell/c2hs/default.nix
similarity index 95%
rename from pkgs/development/libraries/haskell/c2hs/default.nix
rename to pkgs/development/tools/haskell/c2hs/default.nix
index a464b622424..fe8992e9989 100644
--- a/pkgs/development/libraries/haskell/c2hs/default.nix
+++ b/pkgs/development/tools/haskell/c2hs/default.nix
@@ -15,8 +15,6 @@ cabal.mkDerivation (self: {
     filepath HUnit shelly testFramework testFrameworkHunit text
     transformers
   ];
-  jailbreak = true;
-  doCheck = false;
   meta = {
     homepage = "https://github.com/haskell/c2hs";
     description = "C->Haskell FFI tool that gives some cross-language type safety";
diff --git a/pkgs/development/libraries/haskell/c2hsc/default.nix b/pkgs/development/tools/haskell/c2hsc/default.nix
similarity index 100%
rename from pkgs/development/libraries/haskell/c2hsc/default.nix
rename to pkgs/development/tools/haskell/c2hsc/default.nix
diff --git a/pkgs/games/performous/default.nix b/pkgs/games/performous/default.nix
new file mode 100644
index 00000000000..ff4f370f04a
--- /dev/null
+++ b/pkgs/games/performous/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, gettext
+, glibmm, libxmlxx, pango, librsvg
+, SDL2, glew, boost, libav, portaudio
+}:
+
+stdenv.mkDerivation {
+  name = "performous-1.0";
+
+  meta = with stdenv.lib; {
+    description = "Karaoke, band and dancing game";
+    homepage    = "http://performous.org/";
+    license     = licenses.gpl2Plus;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ iyzsong ];
+  };
+
+  src = fetchFromGitHub {
+    owner = "performous";
+    repo = "performous";
+    rev = "1.0";
+    sha256 = "1wgydwnhadrjkj3mjzrhppfmphrxnqfljs361206imirmvs7s15l";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig gettext ];
+
+  buildInputs = [
+    glibmm libxmlxx pango librsvg
+    SDL2 glew boost libav portaudio
+  ];
+}
diff --git a/pkgs/misc/my-env/default.nix b/pkgs/misc/my-env/default.nix
index 1c0dc0cbfe9..7d37576e4cd 100644
--- a/pkgs/misc/my-env/default.nix
+++ b/pkgs/misc/my-env/default.nix
@@ -72,20 +72,21 @@ mkDerivation {
   phases = [ "buildPhase" "fixupPhase" ];
   setupNew = substituteAll {
     src = ../../stdenv/generic/setup.sh;
-    initialPath= (import ../../stdenv/common-path.nix) { inherit pkgs; };
     inherit gcc;
   };
 
-  buildPhase = ''
+  buildPhase = let
+    initialPath = import ../../stdenv/common-path.nix { inherit pkgs; };
+  in ''
     set -x
     mkdir -p "$out/dev-envs" "$out/nix-support" "$out/bin"
     s="$out/nix-support/setup-new-modified"
-    cp "$setupNew" "$s"
     # shut some warning up.., do not use set -e
     sed -e 's@set -e@@' \
         -e 's@assertEnvExists\s\+NIX_STORE@:@' \
         -e 's@trap.*@@' \
-        -i "$s"
+        -e '1i initialPath="${toString initialPath}"' \
+        "$setupNew" > "$s"
     cat >> "$out/dev-envs/''${name/env-/}" << EOF
       nativeBuildInputs="$nativeBuildInputs"
       propagatedBuildInputs="$propagatedBuildInputs2"
@@ -131,7 +132,7 @@ mkDerivation {
         echo "\$tmp/script";
         source "\$tmp/script";
       fi
-      rm -fr "\$tmp"
+      ${pkgs.coreutils}/bin/rm -fr "\$tmp"
       ${extraCmds}
 
       nix_cleanup() {
diff --git a/pkgs/servers/nosql/rethinkdb/default.nix b/pkgs/servers/nosql/rethinkdb/default.nix
index 727fb810e6e..1c8eac99737 100644
--- a/pkgs/servers/nosql/rethinkdb/default.nix
+++ b/pkgs/servers/nosql/rethinkdb/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, which, protobuf, gperftools, boost, zlib, curl, python, m4 }:
 
 stdenv.mkDerivation rec {
-  name = "rethinkdb-1.14.1";
+  name = "rethinkdb-1.15.2";
 
   src = fetchurl {
     url = "http://download.rethinkdb.com/dist/${name}.tgz";
-    sha256 = "0brsbb289hcsmipma4rsgrkqpqagwff2y6w46dvb25n95id65hx8";
+    sha256 = "1fpx9apqm62i332q2isanpdql8gwwab4qxwzrspqwgcka9zd6gy3";
   };
 
   preConfigure = ''
diff --git a/pkgs/tools/misc/bmon/default.nix b/pkgs/tools/misc/bmon/default.nix
index 4a1a272cc0f..1a24ba70051 100644
--- a/pkgs/tools/misc/bmon/default.nix
+++ b/pkgs/tools/misc/bmon/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "bmon-${version}";
-  version = "3.5";
+  version = "3.6";
 
   src = fetchFromGitHub {
     owner = "tgraf";
     repo = "bmon";
     rev = "v${version}";
-    sha256 = "0k6cwprwnrnilbs2fgkx7z9mg6rr11wf6djq6pjfc7fjn2fjvybi";
+    sha256 = "16qwazays2j448kmfckv6wvh4rhmhc9q4vp1s75hm9z02cmhvk8q";
   };
 
   buildInputs = [ autoconf automake pkgconfig ncurses confuse libnl ];
diff --git a/pkgs/tools/misc/parallel/default.nix b/pkgs/tools/misc/parallel/default.nix
index 5e4a6fb4d1b..61745c8bf49 100644
--- a/pkgs/tools/misc/parallel/default.nix
+++ b/pkgs/tools/misc/parallel/default.nix
@@ -1,11 +1,11 @@
 { fetchurl, stdenv, perl }:
 
 stdenv.mkDerivation rec {
-  name = "parallel-20141022";
+  name = "parallel-20141122";
 
   src = fetchurl {
     url = "mirror://gnu/parallel/${name}.tar.bz2";
-    sha256 = "1dpssybids6k6na4rh2gwv1m581h28rcmsvq0hs56hrrh7qpjmvp";
+    sha256 = "1kpd4ayd4lb867nfnpkam4b3mh86jl6cdy386x1rich938gbrg38";
   };
 
   patchPhase =
diff --git a/pkgs/tools/networking/i2pd/default.nix b/pkgs/tools/networking/i2pd/default.nix
index f163f73edb2..a0261686038 100644
--- a/pkgs/tools/networking/i2pd/default.nix
+++ b/pkgs/tools/networking/i2pd/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
 
   name = "i2pd-${version}";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchurl {
-    url = "https://github.com/PrivacySolutions/i2pd/archive/v${version}-1stbinrelease.tar.gz";
-    sha256 = "015y5v6w1mmzmnylfdc1l3r4qbmax3nywyz0r0pd651xgvvvinrv";
+    url = "https://github.com/PrivacySolutions/i2pd/archive/${version}.tar.gz";
+    sha256 = "1gab0ams8bwkiwq0wjiclkm5ms5m5p3x06gzhi2dpdc6vbdkzmlp";
   };
 
   buildInputs = [ boost cryptopp ];
diff --git a/pkgs/tools/networking/strongswan/default.nix b/pkgs/tools/networking/strongswan/default.nix
index e840d0507f6..a41bc5e5b8f 100644
--- a/pkgs/tools/networking/strongswan/default.nix
+++ b/pkgs/tools/networking/strongswan/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gmp, pkgconfig }:
+{ stdenv, fetchurl, gmp, pkgconfig, python }:
 
 stdenv.mkDerivation rec {
   name = "strongswan-5.2.1";
@@ -8,7 +8,9 @@ stdenv.mkDerivation rec {
     sha256 = "05cjjd7gg65bl6fswj2r2i13nn1nk4x86s06y75gwfdvnlrsnlga";
   };
 
-  buildInputs = [ gmp pkgconfig ];
+  dontPatchELF = true;
+
+  buildInputs = [ gmp pkgconfig python ];
 
   configureFlags = [ "--enable-swanctl" "--enable-cmd" ];
 
@@ -19,6 +21,6 @@ stdenv.mkDerivation rec {
     description = "OpenSource IPsec-based VPN Solution";
     homepage = https://www.strongswan.org;
     license = stdenv.lib.licenses.gpl2Plus;
-    inherit (stdenv.gcc.gcc.meta) platforms;
+    platforms = stdenv.lib.platforms.all;
   };
 }
diff --git a/pkgs/tools/security/afl/default.nix b/pkgs/tools/security/afl/default.nix
new file mode 100644
index 00000000000..402071b61c8
--- /dev/null
+++ b/pkgs/tools/security/afl/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchurl, bash }:
+
+stdenv.mkDerivation rec {
+  name    = "afl-${version}";
+  version = "0.68b";
+
+  src = fetchurl {
+    url    = "http://lcamtuf.coredump.cx/afl/releases/${name}.tgz";
+    sha256 = "07z5lnkl82d6rpm63wr7lxs3g49wb7lw8zi9wwazzv2hi7l2vcs7";
+  };
+
+  buildPhase   = "make PREFIX=$out";
+  installPhase = "make install PREFIX=$out";
+
+  meta = {
+    description = "Powerful fuzzer via genetic algorithms and instrumentation";
+    longDescription = ''
+      American fuzzy lop is a fuzzer that employs a novel type of
+      compile-time instrumentation and genetic algorithms to
+      automatically discover clean, interesting test cases that
+      trigger new internal states in the targeted binary. This
+      substantially improves the functional coverage for the fuzzed
+      code. The compact synthesized corpora produced by the tool are
+      also useful for seeding other, more labor or resource-intensive
+      testing regimes down the road.
+    '';
+    homepage    = "http://lcamtuf.coredump.cx/afl/";
+    license     = stdenv.lib.licenses.asl20;
+    platforms   = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}
diff --git a/pkgs/tools/security/tmin/default.nix b/pkgs/tools/security/tmin/default.nix
new file mode 100644
index 00000000000..2c16e936a69
--- /dev/null
+++ b/pkgs/tools/security/tmin/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchurl, bash }:
+
+stdenv.mkDerivation rec {
+  name    = "tmin-${version}";
+  version = "0.05";
+
+  src = fetchurl {
+    url    = "https://tmin.googlecode.com/files/${name}.tar.gz";
+    sha256 = "0166kcfs4b0da4hs2aqyn41f5l09i8rwxpi20k7x17qsxbmjbpd5";
+  };
+
+  buildPhase   = ''
+    gcc -O3 -funroll-loops -fno-strict-aliasing -Wno-pointer-sign tmin.c -o tmin
+  '';
+  installPhase = "mkdir -p $out/bin && mv tmin $out/bin";
+
+  meta = {
+    description = "Fuzzing tool test-case optimizer";
+    homepage    = "https://code.google.com/p/tmin";
+    license     = stdenv.lib.licenses.asl20;
+    platforms   = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c81db70d1b1..4904f053d34 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -468,6 +468,8 @@ let
 
   aescrypt = callPackage ../tools/misc/aescrypt { };
 
+  afl = callPackage ../tools/security/afl { };
+
   ahcpd = callPackage ../tools/networking/ahcpd { };
 
   aide = callPackage ../tools/security/aide { };
@@ -2440,7 +2442,7 @@ let
 
   stunnel = callPackage ../tools/networking/stunnel { };
 
-  strongswan = callPackage ../tools/networking/strongswan { stdenv = clangStdenv; };
+  strongswan = callPackage ../tools/networking/strongswan { };
 
   su = shadow.su;
 
@@ -2515,6 +2517,8 @@ let
 
   tmux = callPackage ../tools/misc/tmux { };
 
+  tmin = callPackage ../tools/security/tmin { };
+
   tor = callPackage ../tools/security/tor { };
 
   torbutton = callPackage ../tools/security/torbutton { };
@@ -3446,17 +3450,16 @@ let
     openblas = openblas_0_2_2;
   };
 
-  julia032 = let
+  julia033 = let
     liblapack = liblapack_3_5_0.override {shared = true;};
-  in callPackage ../development/compilers/julia/0.3.2.nix {
+  in callPackage ../development/compilers/julia/0.3.3.nix {
     inherit liblapack;
     suitesparse = suitesparse.override {
       inherit liblapack;
     };
-    llvm = llvm_34;
-    openblas = openblas_0_2_10;
+    llvm = llvm_33;
   };
-  julia = julia032;
+  julia = julia033;
 
   lazarus = callPackage ../development/compilers/fpc/lazarus.nix {
     fpc = fpc;
@@ -9154,6 +9157,7 @@ let
     channel = "stable";
     pulseSupport = config.pulseaudio or true;
     enablePepperFlash = config.chromium.enablePepperFlash or false;
+    enableWideVine = config.chromium.enableWideVine or false;
     hiDPISupport = config.chromium.hiDPISupport or false;
   };
 
@@ -11502,6 +11506,8 @@ let
 
   openxcom = callPackage ../games/openxcom { };
 
+  performous = callPackage ../games/performous { };
+
   pingus = callPackage ../games/pingus {};
 
   pioneers = callPackage ../games/pioneers { };
diff --git a/pkgs/top-level/haskell-packages.nix b/pkgs/top-level/haskell-packages.nix
index 6d54c2e8b1c..7ebbdd80ef6 100644
--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -339,9 +339,9 @@ self : let callPackage = x : y : modifyPrio (newScope self x y); in
 
   bzlib = callPackage ../development/libraries/haskell/bzlib {};
 
-  c2hs = callPackage ../development/libraries/haskell/c2hs {};
+  c2hs = callPackage ../development/tools/haskell/c2hs {};
 
-  c2hsc = callPackage ../development/libraries/haskell/c2hsc {};
+  c2hsc = callPackage ../development/tools/haskell/c2hsc {};
 
   Cabal_1_16_0_3 = callPackage ../development/libraries/haskell/Cabal/1.16.0.3.nix {};
   Cabal_1_18_1_3 = callPackage ../development/libraries/haskell/Cabal/1.18.1.3.nix {};
@@ -678,6 +678,10 @@ self : let callPackage = x : y : modifyPrio (newScope self x y); in
 
   distributedProcess = callPackage ../development/libraries/haskell/distributed-process {};
 
+  distributedProcessMonadControl = callPackage ../development/libraries/haskell/distributed-process-monad-control {};
+
+  distributedProcessP2p = callPackage ../development/libraries/haskell/distributed-process-p2p {};
+
   distributedProcessPlatform = callPackage ../development/libraries/haskell/distributed-process-platform {};
 
   distributive = callPackage ../development/libraries/haskell/distributive {};
@@ -2236,6 +2240,8 @@ self : let callPackage = x : y : modifyPrio (newScope self x y); in
 
   snapletAcidState = callPackage ../development/libraries/haskell/snaplet-acid-state {};
 
+  snapErrorCollector = callPackage ../development/libraries/haskell/snap-error-collector {};
+
   snapletPostgresqlSimple = callPackage ../development/libraries/haskell/snaplet-postgresql-simple {};
 
   snapletRedis = callPackage ../development/libraries/haskell/snaplet-redis {};
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e5d9ca58e14..f211ee98680 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8142,6 +8142,28 @@ let
     };
   };
 
+  robomachine = buildPythonPackage rec {
+    name = "robomachine-0.6";
+
+    src = pkgs.fetchurl {
+      url = "https://pypi.python.org/packages/source/R/RoboMachine/RoboMachine-0.6.tar.gz";
+      md5 = "4e95eaa43afda0f363c78a88e9da7159";
+    };
+
+    propagatedBuildInputs = with self; [ pyparsing argparse robotframework ];
+
+    # Remove Windows .bat files
+    postInstall = ''
+      rm "$out"/bin/*.bat
+    '';
+
+    meta = with stdenv.lib; {
+      description = "Test data generator for Robot Framework";
+      homepage = https://github.com/mkorpela/RoboMachine;
+      license = licenses.asl20;
+      maintainers = [ maintainers.bjornfor ];
+    };
+  };
 
   robotframework = buildPythonPackage rec {
     version = "2.8.5";