Merge branch 'staging'; security /cc #21642

41 files changed, 261 insertions, 183 deletions

diff --git a/pkgs/applications/misc/pcmanx-gtk2/default.nix b/pkgs/applications/misc/pcmanx-gtk2/default.nix
index fb655ceba5dc..87c4df3446ed 100644
--- a/pkgs/applications/misc/pcmanx-gtk2/default.nix
+++ b/pkgs/applications/misc/pcmanx-gtk2/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ gtk2 libXft intltool automake115x autoconf libtool pkgconfig ];
 
-  preConfigurePhases = ''
+  preConfigure = ''
     ./autogen.sh
   '';
 
diff --git a/pkgs/applications/networking/browsers/firefox/default.nix b/pkgs/applications/networking/browsers/firefox/default.nix
index 3b0eb1405169..6a688de02d08 100644
--- a/pkgs/applications/networking/browsers/firefox/default.nix
+++ b/pkgs/applications/networking/browsers/firefox/default.nix
@@ -44,7 +44,7 @@ common = { pname, version, sha512, updateScript }: stdenv.mkDerivation rec {
     ++ lib.optional enableGTK3 gtk3
     ++ lib.optionals (!passthru.ffmpegSupport) [ gstreamer gst_plugins_base ];
 
-  nativeBuildInputs = [autoconf213 which];
+  nativeBuildInputs = [ autoconf213 which gnused ];
 
   configureFlags =
     [ "--enable-application=browser"
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index 2ea0f6127de6..5f1483672b24 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -25,6 +25,13 @@ stdenv.mkDerivation rec {
     sha512 = "1f4579ac37b8ab98c91fe2e3e6742ba1b005ca9346d23f467d19e6af45eb457cab749bf91ed2a79f2058bd66f54da661da3ea5d5786f8c4b472d8a2a6c34db4b";
   };
 
+  # New sed no longer tolerates this mistake.
+  postPatch = ''
+    for f in mozilla/{js/src,}/configure; do
+      substituteInPlace "$f" --replace '[:space:]*' '[[:space:]]*'
+    done
+  '';
+
   buildInputs = # from firefox30Pkgs.xulrunner, without gstreamer and libvpx
     [ pkgconfig which libpng gtk2 perl zip libIDL libjpeg zlib bzip2
       python2 dbus dbus_glib pango freetype fontconfig xorg.libXi
diff --git a/pkgs/applications/office/zim/default.nix b/pkgs/applications/office/zim/default.nix
index 93f51ce3f8b2..313239581a1a 100644
--- a/pkgs/applications/office/zim/default.nix
+++ b/pkgs/applications/office/zim/default.nix
@@ -30,12 +30,13 @@ pythonPackages.buildPythonApplication rec {
     export makeWrapperArgs="--prefix XDG_DATA_DIRS : $out/share --argv0 $out/bin/.zim-wrapped"
   '';
 
-  postFixup = ''
-    substituteInPlace $out/bin/.zim-wrapped \
-    --replace "sys.argv[0] = 'zim'" "sys.argv[0] = '$out/bin/zim'"
+  # RuntimeError: could not create GtkClipboard object
+  doCheck = false;
+
+  checkPhase = ''
+    python test.py
   '';
 
-  doCheck = true;
 
   meta = {
       description = "A desktop wiki";
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index d1106a758473..220b2e06360f 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "root-${version}";
-  version = "6.04.18";
+  version = "6.08.02";
 
   src = fetchurl {
     url = "https://root.cern.ch/download/root_v${version}.source.tar.gz";
-    sha256 = "00f3v3l8nimfkcxpn9qpyh3h23na0mi4wkds2y5gwqh8wh3jryq9";
+    sha256 = "0530v1r4rvds52hgb13f00l3phhn76z6vii550mwv8bj3sl5070k";
   };
 
   buildInputs = [ cmake pcre pkgconfig python2 zlib lzma gsl ]
@@ -16,10 +16,6 @@ stdenv.mkDerivation rec {
     ;
 
   patches = [
-    (fetchpatch {
-      url = "https://github.com/root-mirror/root/commit/ee9964210c56e7c1868618a4434c5340fef38fe4.patch";
-      sha256 = "186i7ni75yvjydy6lpmaplqxfb5z2019bgpbhff1n6zn2qlrff2r";
-    })
     ./sw_vers.patch
 
     # this prevents thisroot.sh from setting $p, which interferes with stdenv setup
diff --git a/pkgs/applications/science/misc/root/sw_vers.patch b/pkgs/applications/science/misc/root/sw_vers.patch
index 3de2b839bf4b..c4632d62b4fe 100644
--- a/pkgs/applications/science/misc/root/sw_vers.patch
+++ b/pkgs/applications/science/misc/root/sw_vers.patch
@@ -42,12 +42,12 @@ diff --git a/cmake/modules/SetUpMacOS.cmake b/cmake/modules/SetUpMacOS.cmake
 @@ -38,27 +24,6 @@ if (CMAKE_SYSTEM_NAME MATCHES Darwin)
         SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -m64")
         SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -m64")
-        SET(CMAKE_FORTRAN_FLAGS "${CMAKE_FORTRAN_FLAGS} -m64")
+        SET(CMAKE_Fortran_FLAGS "${CMAKE_Fortran_FLAGS} -m64")
 -    else(${SYSCTL_OUTPUT} MATCHES 64)
 -       MESSAGE(STATUS "Found a 32bit system")
 -       SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -m32")
 -       SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -m32")
--       SET(CMAKE_FORTRAN_FLAGS "${CMAKE_FORTRAN_FLAGS} -m32")
+-       SET(CMAKE_Fortran_FLAGS "${CMAKE_Fortran_FLAGS} -m32")
 -    endif(${SYSCTL_OUTPUT} MATCHES 64)
 -  endif()
 -
diff --git a/pkgs/development/compilers/llvm/3.7/libc++/default.nix b/pkgs/development/compilers/llvm/3.7/libc++/default.nix
index 62402142a129..1196645b923e 100644
--- a/pkgs/development/compilers/llvm/3.7/libc++/default.nix
+++ b/pkgs/development/compilers/llvm/3.7/libc++/default.nix
@@ -14,7 +14,10 @@ stdenv.mkDerivation rec {
     cmakeFlagsArray=($cmakeFlagsArray -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$NIX_BUILD_TOP/libcxxabi-${version}.src/include")
   '';
 
-  patches = [ ./darwin.patch ];
+  patches = [
+    ./darwin.patch
+    ./r242056.patch
+  ];
 
   buildInputs = [ cmake libcxxabi ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
diff --git a/pkgs/development/compilers/llvm/3.7/libc++/r242056.patch b/pkgs/development/compilers/llvm/3.7/libc++/r242056.patch
new file mode 100644
index 000000000000..96245e76653a
--- /dev/null
+++ b/pkgs/development/compilers/llvm/3.7/libc++/r242056.patch
@@ -0,0 +1,16 @@
+--- a/include/string	2015/07/13 20:04:56	242056
++++ b/include/string	2015/07/18 20:40:46	242623
+@@ -1936,7 +1936,12 @@
+ template <class _CharT, class _Traits, class _Allocator>
+ inline _LIBCPP_INLINE_VISIBILITY
+ basic_string<_CharT, _Traits, _Allocator>::basic_string(const allocator_type& __a)
+-    : __r_(__a)
++#if _LIBCPP_STD_VER <= 14
++        _NOEXCEPT_(is_nothrow_copy_constructible<allocator_type>::value)
++#else
++        _NOEXCEPT
++#endif
++: __r_(__a)
+ {
+ #if _LIBCPP_DEBUG_LEVEL >= 2
+     __get_db()->__insert_c(this);
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 5842f6fb309a..15b21b5bed9b 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -6,7 +6,7 @@
 , openssl
 , readline
 , sqlite
-, tcl ? null, tk ? null, xlibsWrapper ? null, libX11 ? null, x11Support ? false
+, tcl ? null, tk ? null, tix ? null, xlibsWrapper ? null, libX11 ? null, x11Support ? false
 , zlib
 , callPackage
 , self
@@ -150,6 +150,10 @@ in stdenv.mkDerivation {
 
     setupHook = ./setup-hook.sh;
 
+    postPatch = optionalString (x11Support && (tix != null)) ''
+          substituteInPlace "Lib/lib-tk/Tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+    '';
+
     postInstall =
       ''
         # needed for some packages, especially packages that backport
diff --git a/pkgs/development/interpreters/python/cpython/3.3/default.nix b/pkgs/development/interpreters/python/cpython/3.3/default.nix
index 6a543a8a0ee0..3ab0de96704c 100644
--- a/pkgs/development/interpreters/python/cpython/3.3/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.3/default.nix
@@ -6,7 +6,7 @@
 , openssl
 , readline
 , sqlite
-, tcl ? null, tk ? null, libX11 ? null, xproto ? null, x11Support ? false
+, tcl ? null, tk ? null, tix ? null, libX11 ? null, xproto ? null, x11Support ? false
 , zlib
 , callPackage
 , self
@@ -50,6 +50,10 @@ in stdenv.mkDerivation {
 
   NIX_LDFLAGS = stdenv.lib.optionalString stdenv.isLinux "-lgcc_s";
 
+  postPatch = optionalString (x11Support && (tix != null)) ''
+    substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+  '';
+
   preConfigure = ''
     for i in /usr /sw /opt /pkg; do	# improve purity
       substituteInPlace ./setup.py --replace $i /no-such-path
diff --git a/pkgs/development/interpreters/python/cpython/3.4/default.nix b/pkgs/development/interpreters/python/cpython/3.4/default.nix
index 623fa5d74f64..e081a60c6bc4 100644
--- a/pkgs/development/interpreters/python/cpython/3.4/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.4/default.nix
@@ -6,7 +6,7 @@
 , openssl
 , readline
 , sqlite
-, tcl ? null, tk ? null, libX11 ? null, xproto ? null, x11Support ? false
+, tcl ? null, tk ? null, tix ? null, libX11 ? null, xproto ? null, x11Support ? false
 , zlib
 , callPackage
 , self
@@ -55,6 +55,10 @@ in stdenv.mkDerivation {
     substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
   '';
 
+  postPatch = optionalString (x11Support && (tix != null)) ''
+    substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+  '';
+
   preConfigure = ''
     for i in /usr /sw /opt /pkg; do	# improve purity
       substituteInPlace ./setup.py --replace $i /no-such-path
diff --git a/pkgs/development/interpreters/python/cpython/3.5/default.nix b/pkgs/development/interpreters/python/cpython/3.5/default.nix
index 7172e429f236..92f9d66ea52d 100644
--- a/pkgs/development/interpreters/python/cpython/3.5/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.5/default.nix
@@ -6,7 +6,7 @@
 , openssl
 , readline
 , sqlite
-, tcl ? null, tk ? null, libX11 ? null, xproto ? null, x11Support ? false
+, tcl ? null, tk ? null, tix ? null, libX11 ? null, xproto ? null, x11Support ? false
 , zlib
 , callPackage
 , self
@@ -55,6 +55,10 @@ in stdenv.mkDerivation {
     substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
   '';
 
+  postPatch = optionalString (x11Support && (tix != null)) ''
+    substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+  '';
+
   preConfigure = ''
     for i in /usr /sw /opt /pkg; do	# improve purity
       substituteInPlace ./setup.py --replace $i /no-such-path
diff --git a/pkgs/development/interpreters/python/cpython/3.6/default.nix b/pkgs/development/interpreters/python/cpython/3.6/default.nix
index 8892b0f5c711..795bd7467253 100644
--- a/pkgs/development/interpreters/python/cpython/3.6/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.6/default.nix
@@ -7,7 +7,7 @@
 , openssl
 , readline
 , sqlite
-, tcl ? null, tk ? null, libX11 ? null, xproto ? null, x11Support ? false
+, tcl ? null, tk ? null, tix ? null, libX11 ? null, xproto ? null, x11Support ? false
 , zlib
 , callPackage
 , self
@@ -55,6 +55,10 @@ in stdenv.mkDerivation {
     substituteInPlace configure --replace '-Wl,-stack_size,1000000' ' '
   '';
 
+  postPatch = optionalString (x11Support && (tix != null)) ''
+    substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
+  '';
+
   preConfigure = ''
     for i in /usr /sw /opt /pkg; do	# improve purity
       substituteInPlace ./setup.py --replace $i /no-such-path
diff --git a/pkgs/development/interpreters/python/pypy/2.7/default.nix b/pkgs/development/interpreters/python/pypy/2.7/default.nix
index 467c9a078bba..163c3847db9b 100644
--- a/pkgs/development/interpreters/python/pypy/2.7/default.nix
+++ b/pkgs/development/interpreters/python/pypy/2.7/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, zlib ? null, zlibSupport ? true, bzip2, pkgconfig, libffi
-, sqlite, openssl, ncurses, python, expat, tcl, tk, xlibsWrapper, libX11
+, sqlite, openssl, ncurses, python, expat, tcl, tk, tix, xlibsWrapper, libX11
 , makeWrapper, callPackage, self, gdbm, db
 # For the Python package set
 , pkgs, packageOverrides ? (self: super: {})
@@ -35,6 +35,7 @@ let
       };
       in ''
       patch lib-python/2.7/test/test_pyexpat.py < '${expatch}'
+      substituteInPlace "lib-python/2.7/lib-tk/Tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
     '';
 
     buildInputs = [ bzip2 openssl pkgconfig python libffi ncurses expat sqlite tk tcl xlibsWrapper libX11 makeWrapper gdbm db ]
diff --git a/pkgs/development/interpreters/python/wrap-python.nix b/pkgs/development/interpreters/python/wrap-python.nix
index b965ff5350b1..1efd777bb052 100644
--- a/pkgs/development/interpreters/python/wrap-python.nix
+++ b/pkgs/development/interpreters/python/wrap-python.nix
@@ -35,7 +35,7 @@ makeSetupHook {
           import sys
           import site
           import functools
-          sys.argv[0] = '"'$(basename "$f")'"'
+          sys.argv[0] = '"'$(readlink -f "$f")'"'
           functools.reduce(lambda k, p: site.addsitedir(p, k), ['"$([ -n "$program_PYTHONPATH" ] && (echo "'$program_PYTHONPATH'" | sed "s|:|','|g") || true)"'], site._init_pathinfo())
         '';
 
diff --git a/pkgs/development/libraries/fontconfig-ultimate/default.nix b/pkgs/development/libraries/fontconfig-ultimate/default.nix
index efef59cad3b6..a2e5f69202c4 100644
--- a/pkgs/development/libraries/fontconfig-ultimate/default.nix
+++ b/pkgs/development/libraries/fontconfig-ultimate/default.nix
@@ -11,8 +11,6 @@ stdenv.mkDerivation {
     owner = "bohoomil";
   };
 
-  phases = "$prePhases unpackPhase installPhase $postPhases";
-
   installPhase = ''
     mkdir -p $out/etc/fonts/conf.d
     cp conf.d.infinality/*.conf $out/etc/fonts/conf.d
diff --git a/pkgs/development/libraries/soundtouch/default.nix b/pkgs/development/libraries/soundtouch/default.nix
index 14eb5a24056f..729967ea1b7f 100644
--- a/pkgs/development/libraries/soundtouch/default.nix
+++ b/pkgs/development/libraries/soundtouch/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ autoconf automake libtool ];
 
-  preConfigurePhases = "./bootstrap";
+  preConfigure = "./bootstrap";
 
   meta = {
       description = "A program and library for changing the tempo, pitch and playback rate of audio";
diff --git a/pkgs/development/libraries/tix/default.nix b/pkgs/development/libraries/tix/default.nix
new file mode 100644
index 000000000000..7e18e7402273
--- /dev/null
+++ b/pkgs/development/libraries/tix/default.nix
@@ -0,0 +1,55 @@
+{ stdenv, fetchurl, tcl, tk, fetchpatch } :
+
+stdenv.mkDerivation rec {
+  version = "8.4.3";
+  name = "tix-${version}";
+  src = fetchurl {
+     url = "mirror://sourceforge/tix/tix/8.4.3/Tix8.4.3-src.tar.gz";
+     sha256 = "1jq3dkyk9mqkj4cg7mdk5r0cclqsby9l2b7wrysi0zk5yw7h8bsn";
+  };
+  patches = [ 
+  (fetchpatch {
+    name = "tix-8.4.3-tcl8.5.patch";
+    url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-tcltk/tix/files/tix-8.4.3-tcl8.5.patch?id=56bd759df1d0c750a065b8c845e93d5dfa6b549d";
+    sha256 = "0wzqmcxxq0rqpnjgxz10spw92yhfygnlwv0h8pcx2ycnqiljz6vj";
+    })
+  ] ++ stdenv.lib.optional (tcl.release == "8.6")
+  (fetchpatch {
+    name = "tix-8.4.3-tcl8.6.patch";
+    url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-tcltk/tix/files/tix-8.4.3-tcl8.6.patch?id=56bd759df1d0c750a065b8c845e93d5dfa6b549d";
+    sha256 = "1jaz0l22xj7x1k4rb9ia6i1psnbwk4pblgq4gfvya7gg7fbb7r36";
+    })
+  ;
+  buildInputs = [ tcl tk ];
+  # the configure script expects to find the location of the sources of
+  # tcl and tk in {tcl,tk}Config.sh
+  # In fact, it only needs some private headers. We copy them in 
+  # the private_headers folders and trick the configure script into believing
+  # the sources are here.
+  preConfigure = ''
+    mkdir -p private_headers/generic
+    < ${tcl}/lib/tclConfig.sh sed "s@TCL_SRC_DIR=.*@TCL_SRC_DIR=private_headers@" > tclConfig.sh
+    < ${tk}/lib/tkConfig.sh sed "s@TK_SRC_DIR=.*@TK_SRC_DIR=private_headers@" > tkConfig.sh
+    for i in ${tcl}/include/* ${tk.dev}/include/*; do
+      ln -s $i private_headers/generic;
+    done;
+    '';
+  configureFlags = ''
+      --with-tclinclude=${tcl}/include
+      --with-tclconfig=.
+      --with-tkinclude=${tk.dev}/include
+      --with-tkconfig=.
+      --libdir=''${prefix}/lib
+    '';
+
+  meta = with stdenv.lib; {
+    description = "A widget library for Tcl/Tk";
+    homepage    = http://tix.sourceforge.net/;
+    platforms   = platforms.all;
+    license     = with licenses; [
+      bsd2 # tix
+      gpl2 # patches from portage
+    ];
+  };
+}
+
diff --git a/pkgs/development/libraries/tk/generic.nix b/pkgs/development/libraries/tk/generic.nix
index 87a2edee3ca2..2258f28b9c48 100644
--- a/pkgs/development/libraries/tk/generic.nix
+++ b/pkgs/development/libraries/tk/generic.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation {
 
   postInstall = ''
     ln -s $out/bin/wish* $out/bin/wish
+    cp ../{unix,generic}/*.h $out/include
   '';
 
   configureFlags = [
diff --git a/pkgs/development/libraries/zimlib/default.nix b/pkgs/development/libraries/zimlib/default.nix
index 24cbc818cddb..77a7989baab4 100644
--- a/pkgs/development/libraries/zimlib/default.nix
+++ b/pkgs/development/libraries/zimlib/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
   };
   buildInputs = [ automake autoconf libtool lzma ];
   setSourceRoot = "cd openzim-*/zimlib; export sourceRoot=`pwd`";
-  preConfigurePhases = [ "./autogen.sh" ];
+  preConfigure = "./autogen.sh";
 
   meta = {
     description = "Library for reading and writing ZIM files (file format for storing Web content offline)";
diff --git a/pkgs/development/tools/misc/gnum4/default.nix b/pkgs/development/tools/misc/gnum4/default.nix
index 0696dc906449..fbbd6cc4d6f8 100644
--- a/pkgs/development/tools/misc/gnum4/default.nix
+++ b/pkgs/development/tools/misc/gnum4/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "gnum4-1.4.17";
+  name = "gnum4-1.4.18";
 
   src = fetchurl {
-    url = "mirror://gnu/m4/m4-1.4.17.tar.bz2";
-    sha256 = "0w0da1chh12mczxa5lnwzjk9czi3dq6gnnndbpa6w4rj76b1yklf";
+    url = "mirror://gnu/m4/m4-1.4.18.tar.bz2";
+    sha256 = "1xkwwq0sgv05cla0g0a01yzhk0wpsn9y40w9kh9miiiv0imxfh36";
   };
 
   doCheck = false;
diff --git a/pkgs/development/tools/parsing/flex/2.6.1.nix b/pkgs/development/tools/parsing/flex/2.6.1.nix
new file mode 100644
index 000000000000..7ee2e27e60ad
--- /dev/null
+++ b/pkgs/development/tools/parsing/flex/2.6.1.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchurl, bison, m4 }:
+
+stdenv.mkDerivation rec {
+  name = "flex-2.6.1";
+
+  src = fetchurl {
+    url = "https://github.com/westes/flex/releases/download/v2.6.1/flex-2.6.1.tar.gz";
+    sha256 = "0fy14c35yz2m1n1m4f02by3501fn0cca37zn7jp8lpp4b3kgjhrw";
+  };
+
+  buildInputs = [ bison ];
+
+  propagatedNativeBuildInputs = [ m4 ];
+
+  postConfigure = stdenv.lib.optionalString (stdenv.isDarwin || stdenv.isCygwin) ''
+    sed -i Makefile -e 's/-no-undefined//;'
+  '';
+
+  crossAttrs = {
+
+    # disable tests which can't run on build machine
+    postPatch = ''
+      substituteInPlace Makefile.in --replace "tests" " ";
+    '';
+
+    preConfigure = ''
+      export ac_cv_func_malloc_0_nonnull=yes
+      export ac_cv_func_realloc_0_nonnull=yes
+    '';
+  };
+
+  meta = {
+    homepage = https://github.com/westes/flex;
+    description = "A fast lexical analyser generator";
+    platforms = stdenv.lib.platforms.unix;
+  };
+}
diff --git a/pkgs/development/tools/parsing/flex/default.nix b/pkgs/development/tools/parsing/flex/default.nix
index 7ee2e27e60ad..3bb34f5bc907 100644
--- a/pkgs/development/tools/parsing/flex/default.nix
+++ b/pkgs/development/tools/parsing/flex/default.nix
@@ -1,11 +1,12 @@
 { stdenv, fetchurl, bison, m4 }:
 
 stdenv.mkDerivation rec {
-  name = "flex-2.6.1";
+  name = "flex-${version}";
+  version = "2.6.3";
 
   src = fetchurl {
-    url = "https://github.com/westes/flex/releases/download/v2.6.1/flex-2.6.1.tar.gz";
-    sha256 = "0fy14c35yz2m1n1m4f02by3501fn0cca37zn7jp8lpp4b3kgjhrw";
+    url = "https://github.com/westes/flex/releases/download/v${version}/flex-${version}.tar.gz";
+    sha256 = "1an2cn2z85mkpgqcinh1fhhcd7993qm2lil1yxic8iz76ci79ck8";
   };
 
   buildInputs = [ bison ];
diff --git a/pkgs/misc/emulators/wine/base.nix b/pkgs/misc/emulators/wine/base.nix
index 66ea152b2744..d556f94b78cb 100644
--- a/pkgs/misc/emulators/wine/base.nix
+++ b/pkgs/misc/emulators/wine/base.nix
@@ -1,6 +1,7 @@
 { stdenv, lib, pkgArches,
   name, version, src, monos, geckos, platforms,
-  pkgconfig, fontforge, makeWrapper, flex, bison,
+  # flex 2.6.3 causes: undefined reference to `yywrap'
+  pkgconfig, fontforge, makeWrapper, flex_2_6_1, bison,
   supportFlags,
   buildScript ? null, configureFlags ? ""
 }:
@@ -16,7 +17,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (! isNull buildScript) {
   inherit name src configureFlags;
 
   nativeBuildInputs = [
-    pkgconfig fontforge makeWrapper flex bison
+    pkgconfig fontforge makeWrapper flex_2_6_1 bison
   ];
 
   buildInputs = toBuildInputs pkgArches (with supportFlags; (pkgs:
diff --git a/pkgs/misc/themes/orion/default.nix b/pkgs/misc/themes/orion/default.nix
index 4872d62ae512..9ba8cd368cf7 100644
--- a/pkgs/misc/themes/orion/default.nix
+++ b/pkgs/misc/themes/orion/default.nix
@@ -11,7 +11,6 @@ stdenv.mkDerivation {
 
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
-  phases = "$prePhases unpackPhase installPhase fixupPhase $postPhases";
   installPhase = ''
     mkdir -p $out/share/themes/orion
     cp -r gtk-2.0 gtk-3.0 metacity-1 openbox-3 xfwm4 $out/share/themes/orion
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index 3021ce20b46b..0417bf59cfa3 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -13,10 +13,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ flex ];
 
-  # Temporary work-around for problems after flex security update:
-  # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=835542
-  NIX_CFLAGS_COMPILE = "-Wno-error=sign-compare";
-
   preBuild = ''
     makeFlagsArray+=("PREFIX=$out")
     makeFlagsArray+=("DESTDIR=$out")
diff --git a/pkgs/shells/bash/4.3.nix b/pkgs/shells/bash/4.3.nix
deleted file mode 100644
index 76c24323fca9..000000000000
--- a/pkgs/shells/bash/4.3.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-{ stdenv, fetchurl, readline ? null, interactive ? false, texinfo ? null, binutils ? null, bison }:
-
-assert interactive -> readline != null;
-assert stdenv.isDarwin -> binutils != null;
-
-let
-  version = "4.3";
-  realName = "bash-${version}";
-  shortName = "bash43";
-  baseConfigureFlags = if interactive then "--with-installed-readline" else "--disable-readline";
-  sha256 = "1m14s1f61mf6bijfibcjm9y6pkyvz6gibyl8p4hxq90fisi8gimg";
-
-  inherit (stdenv.lib) optional optionalString;
-in
-
-stdenv.mkDerivation rec {
-  name = "${realName}-p${toString (builtins.length patches)}";
-
-  src = fetchurl {
-    url = "mirror://gnu/bash/${realName}.tar.gz";
-    inherit sha256;
-  };
-
-  hardeningDisable = [ "format" ];
-
-  outputs = [ "out" "doc" "info" ];
-
-  # the man pages are small and useful enough
-  outputMan = if interactive then "out" else null;
-
-  NIX_CFLAGS_COMPILE = ''
-    -DSYS_BASHRC="/etc/bashrc"
-    -DSYS_BASH_LOGOUT="/etc/bash_logout"
-    -DDEFAULT_PATH_VALUE="/no-such-path"
-    -DSTANDARD_UTILS_PATH="/no-such-path"
-    -DNON_INTERACTIVE_LOGIN_SHELLS
-    -DSSH_SOURCE_BASHRC
-  '';
-
-  patchFlags = "-p0";
-
-  patches =
-    (let
-      patch = nr: sha256:
-        fetchurl {
-          url = "mirror://gnu/bash/${realName}-patches/${shortName}-${nr}";
-          inherit sha256;
-        };
-    in
-      import ./bash-4.3-patches.nix patch)
-      ++ optional stdenv.isCygwin ./cygwin-bash-4.3.33-1.src.patch;
-
-  crossAttrs = {
-    configureFlags = baseConfigureFlags +
-      " bash_cv_job_control_missing=nomissing bash_cv_sys_named_pipes=nomissing" +
-      optionalString stdenv.isCygwin ''
-        --without-libintl-prefix --without-libiconv-prefix
-        --with-installed-readline
-        bash_cv_dev_stdin=present
-        bash_cv_dev_fd=standard
-        bash_cv_termcap_lib=libncurses
-      '';
-  };
-
-  configureFlags = baseConfigureFlags;
-
-  # Note: Bison is needed because the patches above modify parse.y.
-  nativeBuildInputs = [bison]
-    ++ optional (texinfo != null) texinfo
-    ++ optional interactive readline
-    ++ optional stdenv.isDarwin binutils;
-
-  # Bash randomly fails to build because of a recursive invocation to
-  # build `version.h'.
-  enableParallelBuilding = false;
-
-  postInstall = ''
-    ln -s bash "$out/bin/sh"
-  '';
-
-  postFixup = if interactive
-    then ''
-      substituteInPlace "$out/bin/bashbug" \
-        --replace '${stdenv.shell}' "$out/bin/bash"
-    ''
-    # most space is taken by locale data
-    else ''
-      rm -r "$out/share" "$out/bin/bashbug"
-    '';
-
-  meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/bash/;
-    description =
-      "GNU Bourne-Again Shell, the de facto standard shell on Linux" +
-        (if interactive then " (for interactive use)" else "");
-
-    longDescription = ''
-      Bash is the shell, or command language interpreter, that will
-      appear in the GNU operating system.  Bash is an sh-compatible
-      shell that incorporates useful features from the Korn shell
-      (ksh) and C shell (csh).  It is intended to conform to the IEEE
-      POSIX P1003.2/ISO 9945.2 Shell and Tools standard.  It offers
-      functional improvements over sh for both programming and
-      interactive use.  In addition, most sh scripts can be run by
-      Bash without modification.
-    '';
-
-    license = licenses.gpl3Plus;
-
-    platforms = platforms.all;
-
-    maintainers = [ maintainers.peti ];
-  };
-
-  passthru = {
-    shellPath = "/bin/bash";
-  };
-}
diff --git a/pkgs/shells/bash/4.4.nix b/pkgs/shells/bash/4.4.nix
index 406ca4d08fd7..7dbb18324972 100644
--- a/pkgs/shells/bash/4.4.nix
+++ b/pkgs/shells/bash/4.4.nix
@@ -12,11 +12,21 @@ let
   baseConfigureFlags = if interactive then "--with-installed-readline" else "--disable-readline";
   sha256 = "1jyz6snd63xjn6skk7za6psgidsd53k05cr3lksqybi0q6936syq";
 
+  upstreamPatches =
+    let
+      patch = nr: sha256:
+        fetchurl {
+          url = "mirror://gnu/bash/${realName}-patches/${shortName}-${nr}";
+          inherit sha256;
+        };
+    in
+      import ./bash-4.4-patches.nix patch;
+
   inherit (stdenv.lib) optional optionalString;
 in
 
 stdenv.mkDerivation rec {
-  name = "${realName}-p${toString (builtins.length patches)}";
+  name = "${realName}-p${toString (builtins.length upstreamPatches)}";
 
   src = fetchurl {
     url = "mirror://gnu/bash/${realName}.tar.gz";
@@ -41,15 +51,14 @@ stdenv.mkDerivation rec {
 
   patchFlags = "-p0";
 
-  patches =
-    (let
-      patch = nr: sha256:
-        fetchurl {
-          url = "mirror://gnu/bash/${realName}-patches/${shortName}-${nr}";
-          inherit sha256;
-        };
-    in
-      import ./bash-4.4-patches.nix patch)
+  patches = upstreamPatches
+      ++ [ (fetchurl {
+              # https://security.gentoo.org/glsa/201701-02
+              url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-shells"
+                  + "/bash/files/bash-4.4-popd-offset-overflow.patch"
+                  + "?id=1bf1ceeb04a2f57e1e5e1636a8c288c4d0db6682";
+              sha256 = "02n08lw5spvsc2b1bll0gr6mg4qxcg7pzfjkw7ji5w7bjcikccbm";
+          }) ]
       ++ optional stdenv.isCygwin ./cygwin-bash-4.3.33-1.src.patch;
 
   crossAttrs = {
diff --git a/pkgs/shells/bash/bash-4.3-patches.nix b/pkgs/shells/bash/bash-4.3-patches.nix
index 83743938de32..a09e56e46993 100644
--- a/pkgs/shells/bash/bash-4.3-patches.nix
+++ b/pkgs/shells/bash/bash-4.3-patches.nix
@@ -47,4 +47,6 @@ patch: [
 (patch "044" "16bzaq9fs2kaw2n2k6vvljkjw5k5kx06isnq8hxkfrxz60384f4k")
 (patch "045" "08q02mj9imp2njpgm6f5q5m61i7qzp33rbxxzarixalyisbw6vms")
 (patch "046" "13v8dymwj83wcvrfayjqrs5kqar05bcj4zpiacrjkkchnsk5dd5k")
+(patch "047" "0jkwqviwkqdc13wv3q0g0kapjr68ggs1xzhqy696pfkqgvg4i4n6")
+(patch "048" "18nzlk1idwkq0xd54s83lx8kam8kcvz7yc0mw6hnq2ax3i2ib0jv")
 ]
diff --git a/pkgs/shells/bash/bash-4.4-patches.nix b/pkgs/shells/bash/bash-4.4-patches.nix
index b8019fb33502..c3ef5470aebf 100644
--- a/pkgs/shells/bash/bash-4.4-patches.nix
+++ b/pkgs/shells/bash/bash-4.4-patches.nix
@@ -1,4 +1,9 @@
 # Automatically generated by `update-patch-set.sh'; do not edit.
 
 patch: [
+(patch "001" "03vzy7qwjdd5qvl3ydg99naazas2qmyd0yhnrflgjbbm64axja1y")
+(patch "002" "0lrwq6vyqism3yqv9s7kzaf3dsl4q5w9r5svcqz279qp7qca083h")
+(patch "003" "1chqww2rj6g42b8s60q5zlzy0jzp684jkpsbrbfy1vzxja8mmpsi")
+(patch "004" "1cy8abf96hkrjhw921ndr0shlcnc52bg45rn6xri4v5clhq0l25d")
+(patch "005" "0a8515kyk4zsgmvlqvlganjfr7pq0j6kzpr4d6xx02kpbdr4n7i2")
 ]
diff --git a/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix b/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix
index af82788d3fa9..9f4a4517627e 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools-cross.nix
@@ -87,8 +87,9 @@ rec {
 
 
   coreutilsMinimal = (pkgs.coreutils.override (args: {
-    # We want coreutils without ACL support.
+    # We want coreutils without ACL/attr support.
     aclSupport = false;
+    attrSupport = false;
     # Our tooling currently can't handle scripts in bin/, only ELFs and symlinks.
     singleBinary = "symlinks";
   })).crossDrv;
diff --git a/pkgs/stdenv/linux/make-bootstrap-tools.nix b/pkgs/stdenv/linux/make-bootstrap-tools.nix
index e13fb88eff0b..d31253075c9d 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools.nix
@@ -6,8 +6,9 @@ rec {
 
 
   coreutilsMinimal = coreutils.override (args: {
-    # We want coreutils without ACL support.
+    # We want coreutils without ACL/attr support.
     aclSupport = false;
+    attrSupport = false;
     # Our tooling currently can't handle scripts in bin/, only ELFs and symlinks.
     singleBinary = "symlinks";
   });
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index 8b39e3711e11..9e66c6ba9181 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, perl, xz, gmp ? null
 , aclSupport ? false, acl ? null
+, attrSupport ? false, attr ? null
 , selinuxSupport? false, libselinux ? null, libsepol ? null
 , autoconf, automake114x, texinfo
 , withPrefix ? false
@@ -44,12 +45,14 @@ let
 
     buildInputs = [ gmp ]
       ++ optional aclSupport acl
+      ++ optional attrSupport attr
       ++ optionals stdenv.isCygwin [ autoconf automake114x texinfo ]   # due to patch
       ++ optionals selinuxSupport [ libselinux libsepol ];
 
     crossAttrs = {
       buildInputs = [ gmp.crossDrv ]
         ++ optional aclSupport acl.crossDrv
+        ++ optional attrSupport attr.crossDrv
         ++ optionals selinuxSupport [ libselinux.crossDrv libsepol.crossDrv ]
         ++ optional (stdenv.ccCross.libc ? libiconv)
           stdenv.ccCross.libc.libiconv.crossDrv;
@@ -90,8 +93,6 @@ let
 
     makeFlags = optionalString stdenv.isDarwin "CFLAGS=-D_FORTIFY_SOURCE=0";
 
-    postFixup = ""; # FIXME: remove on next mass rebuild
-
     meta = {
       homepage = http://www.gnu.org/software/coreutils/;
       description = "The basic file, shell and text manipulation utilities of the GNU operating system";
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index 15b1740638e2..eef1ac472280 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -54,6 +54,9 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "all" ];
 
+  # Work around a bug in the generated flex lexer (upstream flex bug?)
+  NIX_CFLAGS_COMPILE = "-Wno-error";
+
   preConfigure =
     '' for i in "tests/util/"*.in
        do
diff --git a/pkgs/tools/networking/unbound/default.nix b/pkgs/tools/networking/unbound/default.nix
index 4362dc57e682..83d3d88729df 100644
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "unbound-${version}";
-  version = "1.5.10";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "http://unbound.net/downloads/${name}.tar.gz";
-    sha256 = "11lli8jgq4n917gcx6nw728g1hqc2lszwlxa5mdb78m2ri7qp6x3";
+    sha256 = "1dzsxyp34ianp08wk4vf13qzl5ss5rr9v1p8zr1aggfywrsbhzbb";
   };
 
   outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
diff --git a/pkgs/tools/networking/unbound/python.nix b/pkgs/tools/networking/unbound/python.nix
index 5d7096ab168f..911afdd18bb0 100644
--- a/pkgs/tools/networking/unbound/python.nix
+++ b/pkgs/tools/networking/unbound/python.nix
@@ -5,11 +5,11 @@ let
 in stdenv.mkDerivation rec {
   pname = "pyunbound";
   name = "${pname}-${version}";
-  version = "1.5.9";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "http://unbound.net/downloads/unbound-${version}.tar.gz";
-    sha256 = "01328cfac99ab5b8c47115151896a244979e442e284eb962c0ea84b7782b6990";
+    sha256 = "1dzsxyp34ianp08wk4vf13qzl5ss5rr9v1p8zr1aggfywrsbhzbb";
   };
 
   buildInputs = [ openssl expat libevent swig python ];
diff --git a/pkgs/tools/text/gnused/422.nix b/pkgs/tools/text/gnused/422.nix
new file mode 100644
index 000000000000..037c2f17a63b
--- /dev/null
+++ b/pkgs/tools/text/gnused/422.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation {
+  name = "gnused-4.2.2";
+
+  src = fetchurl {
+    url = mirror://gnu/sed/sed-4.2.2.tar.bz2;
+    sha256 = "f048d1838da284c8bc9753e4506b85a1e0cc1ea8999d36f6995bcb9460cddbd7";
+  };
+
+  outputs = [ "out" "info" ];
+
+  meta = {
+    homepage = http://www.gnu.org/software/sed/;
+    description = "GNU sed, a batch stream editor";
+
+    longDescription = ''
+      Sed (stream editor) isn't really a true text editor or text
+      processor.  Instead, it is used to filter text, i.e., it takes
+      text input and performs some operation (or set of operations) on
+      it and outputs the modified text.  Sed is typically used for
+      extracting part of a file using pattern matching or substituting
+      multiple occurrences of a string within a file.
+    '';
+
+    license = stdenv.lib.licenses.gpl3Plus;
+
+    platforms = stdenv.lib.platforms.all;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index 037c2f17a63b..aa25101636e0 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -1,15 +1,19 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, perl }:
 
-stdenv.mkDerivation {
-  name = "gnused-4.2.2";
+stdenv.mkDerivation rec {
+  name = "gnused-${version}";
+  version = "4.3";
 
   src = fetchurl {
-    url = mirror://gnu/sed/sed-4.2.2.tar.bz2;
-    sha256 = "f048d1838da284c8bc9753e4506b85a1e0cc1ea8999d36f6995bcb9460cddbd7";
+    url = "mirror://gnu/sed/sed-${version}.tar.xz";
+    sha256 = "1anhdgah8h423hlmn9hwzxzr7hjbqjm6hxq3z1p7p7nf8640vhj7";
   };
 
   outputs = [ "out" "info" ];
 
+  nativeBuildInputs = [ perl ];
+  preConfigure = "patchShebangs ./build-aux/help2man";
+
   meta = {
     homepage = http://www.gnu.org/software/sed/;
     description = "GNU sed, a batch stream editor";
diff --git a/pkgs/tools/text/zimreader/default.nix b/pkgs/tools/text/zimreader/default.nix
index 449b1e9c3398..1c508a9cf7ec 100644
--- a/pkgs/tools/text/zimreader/default.nix
+++ b/pkgs/tools/text/zimreader/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   buildInputs = [ automake autoconf libtool zimlib cxxtools tntnet ];
   setSourceRoot = "cd openzim-*/zimreader; export sourceRoot=`pwd`";
-  preConfigurePhases = [ "./autogen.sh" ];
+  preConfigure = "./autogen.sh";
 
   meta = {
     description = "A tool to serve ZIM files using HTTP";
diff --git a/pkgs/tools/text/zimwriterfs/default.nix b/pkgs/tools/text/zimwriterfs/default.nix
index 62f0ff991237..db604d862b88 100644
--- a/pkgs/tools/text/zimwriterfs/default.nix
+++ b/pkgs/tools/text/zimwriterfs/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ automake autoconf libtool lzma pkgconfig zimlib file zlib ];
   setSourceRoot = "cd openzim-*/zimwriterfs; export sourceRoot=`pwd`";
-  preConfigurePhases = [ "./autogen.sh" ];
+  preConfigure = "./autogen.sh";
 
   meta = {
     description = "A console tool to create ZIM files";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 086cbcc048ed..52e4194fab1d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1277,6 +1277,7 @@ in
 
   coreutils = callPackage ../tools/misc/coreutils {
     aclSupport = stdenv.isLinux;
+    attrSupport = stdenv.isLinux;
   };
 
   coreutils-prefixed = coreutils.override { withPrefix = true; singleBinary = false; };
@@ -1932,6 +1933,8 @@ in
   gnuplot_aquaterm = gnuplot.override { aquaterm = true; };
 
   gnused = callPackage ../tools/text/gnused { };
+  # This is an easy work-around for [:space:] problems.
+  gnused_422 = callPackage ../tools/text/gnused/422.nix { };
 
   gnutar = callPackage ../tools/archivers/gnutar { };
 
@@ -4540,7 +4543,7 @@ in
 
   ### SHELLS
 
-  bash = lowPrio (callPackage ../shells/bash/4.3.nix {
+  bash = lowPrio (callPackage ../shells/bash/4.4.nix {
     texinfo = null;
     interactive = stdenv.isCygwin; # patch for cygwin requires readline support
   });
@@ -6270,6 +6273,7 @@ in
   jdepend = callPackage ../development/tools/analysis/jdepend { };
 
   flex_2_5_35 = callPackage ../development/tools/parsing/flex/2.5.35.nix { };
+  flex_2_6_1 = callPackage ../development/tools/parsing/flex/2.6.1.nix { };
   flex = callPackage ../development/tools/parsing/flex/default.nix { };
 
   flexcpp = callPackage ../development/tools/parsing/flexc++ { };
@@ -9536,6 +9540,8 @@ in
 
   tivodecode = callPackage ../applications/video/tivodecode { };
 
+  tix = callPackage ../development/libraries/tix { };
+
   tk = tk-8_6;
 
   tk-8_6 = callPackage ../development/libraries/tk/8.6.nix { };
@@ -13216,6 +13222,7 @@ in
     libpng = libpng_apng;
     enableGTK3 = false;
     python = python2;
+    gnused = gnused_422;
   }) firefox-unwrapped firefox-esr-unwrapped;
 
   firefox = wrapFirefox firefox-unwrapped { };