summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--nixos/doc/manual/development/writing-nixos-tests.xml29
-rw-r--r--nixos/doc/manual/installation/installing-usb.xml20
-rw-r--r--nixos/doc/manual/release-notes/rl-1803.xml13
-rw-r--r--nixos/modules/module-list.nix2
-rw-r--r--nixos/modules/rename.nix3
-rw-r--r--nixos/modules/services/hardware/usbmuxd.nix74
-rw-r--r--nixos/modules/services/misc/gitlab.nix11
-rw-r--r--nixos/modules/services/networking/dnscrypt-proxy.nix321
-rw-r--r--nixos/modules/services/networking/dnscrypt-proxy.xml69
-rw-r--r--nixos/release.nix1
-rw-r--r--nixos/tests/dnscrypt-proxy.nix32
-rw-r--r--pkgs/applications/audio/radiotray-ng/default.nix22
-rw-r--r--pkgs/applications/editors/eclipse/plugins.nix6
-rw-r--r--pkgs/applications/editors/tiled/default.nix8
-rw-r--r--pkgs/applications/misc/electrum/default.nix4
-rw-r--r--pkgs/applications/misc/josm/default.nix4
-rw-r--r--pkgs/applications/misc/pdfpc/default.nix4
-rw-r--r--pkgs/applications/networking/instant-messengers/pidgin/default.nix5
-rw-r--r--pkgs/applications/office/osmo/default.nix4
-rw-r--r--pkgs/applications/version-management/gitaly/Gemfile4
-rw-r--r--pkgs/applications/version-management/gitaly/Gemfile.lock39
-rw-r--r--pkgs/applications/version-management/gitaly/default.nix4
-rw-r--r--pkgs/applications/version-management/gitaly/gemset.nix123
-rw-r--r--pkgs/applications/version-management/gitlab-shell/default.nix8
-rw-r--r--pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch13
-rw-r--r--pkgs/applications/version-management/gitlab-workhorse/default.nix4
-rw-r--r--pkgs/applications/version-management/gitlab/Gemfile24
-rw-r--r--pkgs/applications/version-management/gitlab/Gemfile.lock173
-rw-r--r--pkgs/applications/version-management/gitlab/default.nix20
-rw-r--r--pkgs/applications/version-management/gitlab/gemset.nix228
-rw-r--r--pkgs/applications/version-management/gitlab/nulladapter.patch2
-rw-r--r--pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch19
-rw-r--r--pkgs/build-support/vm/default.nix6
-rw-r--r--pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix6
-rw-r--r--pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix5
-rw-r--r--pkgs/desktops/gnome-3/core/libcroco/default.nix15
-rw-r--r--pkgs/development/arduino/arduino-core/default.nix16
-rw-r--r--pkgs/development/arduino/arduino-core/downloads.nix39
-rw-r--r--pkgs/development/haskell-modules/make-package-set.nix1
-rw-r--r--pkgs/development/libraries/libfilezilla/default.nix4
-rw-r--r--pkgs/development/libraries/openslp/CVE-2016-4912.patch11
-rw-r--r--pkgs/development/libraries/openslp/default.nix1
-rw-r--r--pkgs/development/libraries/openssl/default.nix8
-rw-r--r--pkgs/development/ocaml-modules/otr/default.nix22
-rw-r--r--pkgs/development/python-modules/ipython/5.nix4
-rw-r--r--pkgs/development/python-modules/ldaptor/default.nix35
-rw-r--r--pkgs/development/tools/analysis/flow/default.nix4
-rw-r--r--pkgs/development/tools/analysis/snowman/default.nix6
-rw-r--r--pkgs/development/tools/continuous-integration/gitlab-runner/default.nix8
-rw-r--r--pkgs/development/tools/haskell/vaultenv/default.nix14
-rw-r--r--pkgs/development/tools/misc/lit/default.nix4
-rw-r--r--pkgs/development/tools/remarshal/default.nix4
-rw-r--r--pkgs/development/tools/remarshal/deps.nix20
-rw-r--r--pkgs/os-specific/linux/kernel/linux-samus-4.12.nix4
-rw-r--r--pkgs/servers/matrix-synapse/default.nix12
-rw-r--r--pkgs/tools/audio/abcmidi/default.nix4
-rw-r--r--pkgs/tools/backup/bup/default.nix15
-rw-r--r--pkgs/tools/filesystems/tmsu/default.nix4
-rw-r--r--pkgs/tools/graphics/svgcleaner/default.nix10
-rw-r--r--pkgs/tools/misc/fpp/default.nix4
-rw-r--r--pkgs/tools/misc/ttwatch/default.nix6
-rw-r--r--pkgs/tools/security/browserpass/default.nix4
-rw-r--r--pkgs/tools/security/browserpass/deps.nix4
-rw-r--r--pkgs/tools/text/miller/default.nix6
-rw-r--r--pkgs/tools/typesetting/pdftk/default.nix2
-rw-r--r--pkgs/top-level/all-packages.nix4
-rw-r--r--pkgs/top-level/python-packages.nix2
67 files changed, 786 insertions, 821 deletions
diff --git a/nixos/doc/manual/development/writing-nixos-tests.xml b/nixos/doc/manual/development/writing-nixos-tests.xml
index 7b25a39e83b8..a8f6aa00858e 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.xml
+++ b/nixos/doc/manual/development/writing-nixos-tests.xml
@@ -272,8 +272,37 @@ startAll;
     </listitem>
   </varlistentry>
 
+  <varlistentry>
+    <term><methodname>systemctl</methodname></term>
+    <listitem>
+      <para>Runs <literal>systemctl</literal> commands with optional support for
+      <literal>systemctl --user</literal></para>
+    <para>
+      <programlisting>
+        $machine->systemctl("list-jobs --no-pager"); // runs `systemctl list-jobs --no-pager`
+        $machine->systemctl("list-jobs --no-pager", "any-user"); // spawns a shell for `any-user` and runs `systemctl --user list-jobs --no-pager`
+      </programlisting>
+    </para>
+    </listitem>
+  </varlistentry>
+
 </variablelist>
 
 </para>
 
+<para>
+  To test user units declared by <literal>systemd.user.services</literal> the optional <literal>$user</literal>
+  argument can be used:
+
+  <programlisting>
+    $machine->start;
+    $machine->waitForX;
+    $machine->waitForUnit("xautolock.service", "x-session-user");
+  </programlisting>
+
+  This applies to <literal>systemctl</literal>, <literal>getUnitInfo</literal>,
+  <literal>waitForUnit</literal>, <literal>startJob</literal>
+  and <literal>stopJob</literal>.
+</para>
+
 </section>
diff --git a/nixos/doc/manual/installation/installing-usb.xml b/nixos/doc/manual/installation/installing-usb.xml
index 31d51816e39b..122a4745f194 100644
--- a/nixos/doc/manual/installation/installing-usb.xml
+++ b/nixos/doc/manual/installation/installing-usb.xml
@@ -11,10 +11,24 @@ a USB stick. You can use the <command>dd</command> utility to write the image:
 <command>dd if=<replaceable>path-to-image</replaceable>
 of=<replaceable>/dev/sdb</replaceable></command>. Be careful about specifying the
 correct drive; you can use the <command>lsblk</command> command to get a list of
-block devices. If you're on macOS you can run <command>diskutil list</command>
-to see the list of devices; the device you'll use for the USB must be ejected
-before writing the image.</para>
+block devices.</para>
 
+<para>On macOS:
+<programlisting>
+$ diskutil list
+[..]
+/dev/diskN (external, physical):
+   #:                       TYPE NAME                    SIZE       IDENTIFIER
+[..]
+$ diskutil unmountDisk diskN
+Unmount of all volumes on diskN was successful
+$ sudo dd bs=1m if=nix.iso of=/dev/rdiskN
+</programlisting>
+Using the 'raw' <command>rdiskN</command> device instead of <command>diskN</command>
+completes in minutes instead of hours. After <command>dd</command> completes, a GUI
+dialog "The disk you inserted was not readable by this computer" will pop up, which
+can be ignored.</para>
+         
 <para>The <command>dd</command> utility will write the image verbatim to the drive,
 making it the recommended option for both UEFI and non-UEFI installations. For
 non-UEFI installations, you can alternatively use
diff --git a/nixos/doc/manual/release-notes/rl-1803.xml b/nixos/doc/manual/release-notes/rl-1803.xml
index c8549e7c4adc..d2d4a0d32bb2 100644
--- a/nixos/doc/manual/release-notes/rl-1803.xml
+++ b/nixos/doc/manual/release-notes/rl-1803.xml
@@ -139,6 +139,12 @@ following incompatible changes:</para>
       will be accessible at <literal>/run/memcached/memcached.sock</literal>.
     </para>
   </listitem>
+  <listitem>
+    <para>
+      The DNSCrypt proxy module has been removed, the upstream project
+      is no longer maintained.
+    </para>
+  </listitem>
 </itemizedlist>
 
 </section>
@@ -234,6 +240,13 @@ following incompatible changes:</para>
       to your <literal>configuration.nix</literal>.
     </para>
   </listitem>
+  <listitem>
+    <para>
+      The NixOS test driver supports user services declared by <literal>systemd.user.services</literal>.
+      The methods <literal>waitForUnit</literal>, <literal>getUnitInfo</literal>, <literal>startJob</literal>
+      and <literal>stopJob</literal> provide an optional <literal>$user</literal> argument for that purpose.
+    </para>
+  </listitem>
 </itemizedlist>
 
 </section>
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index bea7d96ef097..8846bf9e8b12 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -245,6 +245,7 @@
   ./services/hardware/udev.nix
   ./services/hardware/udisks2.nix
   ./services/hardware/upower.nix
+  ./services/hardware/usbmuxd.nix
   ./services/hardware/thermald.nix
   ./services/logging/SystemdJournal2Gelf.nix
   ./services/logging/awstats.nix
@@ -445,7 +446,6 @@
   ./services/networking/dhcpd.nix
   ./services/networking/dnscache.nix
   ./services/networking/dnschain.nix
-  ./services/networking/dnscrypt-proxy.nix
   ./services/networking/dnscrypt-wrapper.nix
   ./services/networking/dnsmasq.nix
   ./services/networking/ejabberd.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 562be13a3f64..cd6ae35c0d9f 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -89,6 +89,9 @@ with lib;
     # Tarsnap
     (mkRenamedOptionModule [ "services" "tarsnap" "config" ] [ "services" "tarsnap" "archives" ])
 
+    # dnscrypt-proxy
+    (mkRemovedOptionModule [ "services" "dnscrypt-proxy" "enable" ] "")
+
     # ibus
     (mkRenamedOptionModule [ "programs" "ibus" "plugins" ] [ "i18n" "inputMethod" "ibus" "engines" ])
 
diff --git a/nixos/modules/services/hardware/usbmuxd.nix b/nixos/modules/services/hardware/usbmuxd.nix
new file mode 100644
index 000000000000..7ebd49fa01c2
--- /dev/null
+++ b/nixos/modules/services/hardware/usbmuxd.nix
@@ -0,0 +1,74 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  defaultUserGroup = "usbmux";
+  apple = "05ac";
+
+  cfg = config.services.usbmuxd;
+
+in
+
+{
+  options.services.usbmuxd = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable the usbmuxd ("USB multiplexing daemon") service. This daemon is
+        in charge of multiplexing connections over USB to an iOS device. This is
+        needed for transferring data from and to iOS devices (see ifuse). Also
+        this may enable plug-n-play tethering for iPhones.
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = defaultUserGroup;
+      description = ''
+        The user usbmuxd should use to run after startup.
+      '';
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = defaultUserGroup;
+      description = ''
+        The group usbmuxd should use to run after startup.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    users.extraUsers = optional (cfg.user == defaultUserGroup) {
+      name = cfg.user;
+      description = "usbmuxd user";
+      group = cfg.group;
+    };
+
+    users.extraGroups = optional (cfg.group == defaultUserGroup) {
+      name = cfg.group;
+    };
+
+    # Give usbmuxd permission for Apple devices
+    services.udev.extraRules = ''
+      SUBSYSTEM=="usb", ATTR{idVendor}=="${apple}", GROUP="${cfg.group}"
+    '';
+
+    systemd.services.usbmuxd = {
+      description = "usbmuxd";
+      wantedBy = [ "multi-user.target" ];
+      unitConfig.Documentation = "man:usbmuxd(8)";
+      serviceConfig = {
+        # Trigger the udev rule manually. This doesn't require replugging the
+        # device when first enabling the option to get it to work
+        ExecStartPre = "${pkgs.libudev}/bin/udevadm trigger -s usb -a idVendor=${apple}";
+        ExecStart = "${pkgs.usbmuxd}/bin/usbmuxd -U ${cfg.user} -f";
+      };
+    };
+
+  };
+}
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index b514d914eefb..9ed5875a0191 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -29,8 +29,12 @@ let
 
   gitalyToml = pkgs.writeText "gitaly.toml" ''
     socket_path = "${lib.escape ["\""] gitalySocket}"
+    bin_dir = "${cfg.packages.gitaly}/bin"
     prometheus_listen_addr = "localhost:9236"
 
+    [git]
+    bin_path = "${pkgs.git}/bin/git"
+
     [gitaly-ruby]
     dir = "${cfg.packages.gitaly.ruby}"
 
@@ -104,6 +108,7 @@ let
       ldap.enabled = false;
       omniauth.enabled = false;
       shared.path = "${cfg.statePath}/shared";
+      gitaly.client_path = "${cfg.packages.gitaly}/bin";
       backup.path = "${cfg.backupPath}";
       gitlab_shell = {
         path = "${cfg.packages.gitlab-shell}";
@@ -117,8 +122,6 @@ let
       };
       git = {
         bin_path = "git";
-        max_size = 20971520; # 20MB
-        timeout = 10;
       };
       monitoring = {
         ip_whitelist = [ "127.0.0.0/8" "::1/128" ];
@@ -489,7 +492,9 @@ in {
       after = [ "network.target" "gitlab.service" ];
       wantedBy = [ "multi-user.target" ];
       environment.HOME = gitlabEnv.HOME;
-      path = with pkgs; [ gitAndTools.git cfg.packages.gitaly.rubyEnv ];
+      environment.GEM_HOME = "${cfg.packages.gitaly.rubyEnv}/${ruby.gemPath}";
+      environment.GITLAB_SHELL_CONFIG_PATH = gitlabEnv.GITLAB_SHELL_CONFIG_PATH;
+      path = with pkgs; [ gitAndTools.git cfg.packages.gitaly.rubyEnv ruby ];
       serviceConfig = {
         #PermissionsStartOnly = true; # preStart must be run as root
         Type = "simple";
diff --git a/nixos/modules/services/networking/dnscrypt-proxy.nix b/nixos/modules/services/networking/dnscrypt-proxy.nix
deleted file mode 100644
index ed658258c7f9..000000000000
--- a/nixos/modules/services/networking/dnscrypt-proxy.nix
+++ /dev/null
@@ -1,321 +0,0 @@
-{ config, lib, pkgs, ... }:
-with lib;
-
-let
-  cfg = config.services.dnscrypt-proxy;
-
-  stateDirectory = "/var/lib/dnscrypt-proxy";
-
-  # The minisign public key used to sign the upstream resolver list.
-  # This is somewhat more flexible than preloading the key as an
-  # embedded string.
-  upstreamResolverListPubKey = pkgs.fetchurl {
-    url = https://raw.githubusercontent.com/jedisct1/dnscrypt-proxy/master/minisign.pub;
-    sha256 = "18lnp8qr6ghfc2sd46nn1rhcpr324fqlvgsp4zaigw396cd7vnnh";
-  };
-
-  # Internal flag indicating whether the upstream resolver list is used.
-  useUpstreamResolverList = cfg.customResolver == null;
-
-  # The final local address.
-  localAddress = "${cfg.localAddress}:${toString cfg.localPort}";
-
-  # The final resolvers list path.
-  resolverList = "${stateDirectory}/dnscrypt-resolvers.csv";
-
-  # Build daemon command line
-
-  resolverArgs =
-    if (cfg.customResolver == null)
-      then
-        [ "-L ${resolverList}"
-          "-R ${cfg.resolverName}"
-        ]
-      else with cfg.customResolver;
-        [ "-N ${name}"
-          "-k ${key}"
-          "-r ${address}:${toString port}"
-        ];
-
-  daemonArgs =
-       [ "-a ${localAddress}" ]
-    ++ resolverArgs
-    ++ cfg.extraArgs;
-in
-
-{
-  meta = {
-    maintainers = with maintainers; [ joachifm ];
-    doc = ./dnscrypt-proxy.xml;
-  };
-
-  options = {
-    # Before adding another option, consider whether it could
-    # equally well be passed via extraArgs.
-
-    services.dnscrypt-proxy = {
-      enable = mkOption {
-        default = false;
-        type = types.bool;
-        description = "Whether to enable the DNSCrypt client proxy";
-      };
-
-      localAddress = mkOption {
-        default = "127.0.0.1";
-        type = types.str;
-        description = ''
-          Listen for DNS queries to relay on this address. The only reason to
-          change this from its default value is to proxy queries on behalf
-          of other machines (typically on the local network).
-        '';
-      };
-
-      localPort = mkOption {
-        default = 53;
-        type = types.int;
-        description = ''
-          Listen for DNS queries to relay on this port. The default value
-          assumes that the DNSCrypt proxy should relay DNS queries directly.
-          When running as a forwarder for another DNS client, set this option
-          to a different value; otherwise leave the default.
-        '';
-      };
-
-      resolverName = mkOption {
-        default = "random";
-        example = "dnscrypt.eu-nl";
-        type = types.nullOr types.str;
-        description = ''
-          The name of the DNSCrypt resolver to use, taken from
-          <filename>${resolverList}</filename>.  The default is to
-          pick a random non-logging resolver that supports DNSSEC.
-        '';
-      };
-
-      customResolver = mkOption {
-        default = null;
-        description = ''
-          Use an unlisted resolver (e.g., a private DNSCrypt provider). For
-          advanced users only. If specified, this option takes precedence.
-        '';
-        type = types.nullOr (types.submodule ({ ... }: { options = {
-          address = mkOption {
-            type = types.str;
-            description = "IP address";
-            example = "208.67.220.220";
-          };
-
-          port = mkOption {
-            type = types.int;
-            description = "Port";
-            default = 443;
-          };
-
-          name = mkOption {
-            type = types.str;
-            description = "Fully qualified domain name";
-            example = "2.dnscrypt-cert.example.com";
-          };
-
-          key = mkOption {
-            type = types.str;
-            description = "Public key";
-            example = "B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79";
-          };
-        }; }));
-      };
-
-      extraArgs = mkOption {
-        default = [];
-        type = types.listOf types.str;
-        description = ''
-          Additional command-line arguments passed verbatim to the daemon.
-          See <citerefentry><refentrytitle>dnscrypt-proxy</refentrytitle>
-          <manvolnum>8</manvolnum></citerefentry> for details.
-        '';
-        example = [ "-X libdcplugin_example_cache.so,--min-ttl=60" ];
-      };
-    };
-  };
-
-  config = mkIf cfg.enable (mkMerge [{
-    assertions = [
-      { assertion = (cfg.customResolver != null) || (cfg.resolverName != null);
-        message   = "please configure upstream DNSCrypt resolver";
-      }
-    ];
-
-    users.users.dnscrypt-proxy = {
-      description = "dnscrypt-proxy daemon user";
-      isSystemUser = true;
-      group = "dnscrypt-proxy";
-    };
-    users.groups.dnscrypt-proxy = {};
-
-    systemd.sockets.dnscrypt-proxy = {
-      description = "dnscrypt-proxy listening socket";
-      documentation = [ "man:dnscrypt-proxy(8)" ];
-
-      wantedBy = [ "sockets.target" ];
-
-      socketConfig = {
-        ListenStream = localAddress;
-        ListenDatagram = localAddress;
-      };
-    };
-
-    systemd.services.dnscrypt-proxy = {
-      description = "dnscrypt-proxy daemon";
-      documentation = [ "man:dnscrypt-proxy(8)" ];
-
-      before = [ "nss-lookup.target" ];
-      after = [ "network.target" ];
-      requires = [ "dnscrypt-proxy.socket "];
-
-      serviceConfig = {
-        NonBlocking = "true";
-        ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy ${toString daemonArgs}";
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-
-        User = "dnscrypt-proxy";
-
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectHome = true;
-      };
-    };
-    }
-
-    (mkIf config.security.apparmor.enable {
-    systemd.services.dnscrypt-proxy.after = [ "apparmor.service" ];
-
-    security.apparmor.profiles = singleton (pkgs.writeText "apparmor-dnscrypt-proxy" ''
-      ${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy {
-        /dev/null rw,
-        /dev/urandom r,
-
-        /etc/passwd r,
-        /etc/group r,
-        ${config.environment.etc."nsswitch.conf".source} r,
-
-        ${getLib pkgs.glibc}/lib/*.so mr,
-        ${pkgs.tzdata}/share/zoneinfo/** r,
-
-        network inet stream,
-        network inet6 stream,
-        network inet dgram,
-        network inet6 dgram,
-
-        ${getLib pkgs.dnscrypt-proxy}/lib/dnscrypt-proxy/libdcplugin*.so mr,
-
-        ${getLib pkgs.gcc.cc}/lib/libssp.so.* mr,
-        ${getLib pkgs.libsodium}/lib/libsodium.so.* mr,
-        ${getLib pkgs.systemd}/lib/libsystemd.so.* mr,
-        ${getLib pkgs.xz}/lib/liblzma.so.* mr,
-        ${getLib pkgs.libgcrypt}/lib/libgcrypt.so.* mr,
-        ${getLib pkgs.libgpgerror}/lib/libgpg-error.so.* mr,
-        ${getLib pkgs.libcap}/lib/libcap.so.* mr,
-        ${getLib pkgs.lz4}/lib/liblz4.so.* mr,
-        ${getLib pkgs.attr}/lib/libattr.so.* mr, # */
-
-        ${resolverList} r,
-
-        /run/systemd/notify rw,
-      }
-    '');
-    })
-
-    (mkIf useUpstreamResolverList {
-    systemd.services.init-dnscrypt-proxy-statedir = {
-      description = "Initialize dnscrypt-proxy state directory";
-
-      wantedBy = [ "dnscrypt-proxy.service" ];
-      before = [ "dnscrypt-proxy.service" ];
-
-      script = ''
-        mkdir -pv ${stateDirectory}
-        chown -c dnscrypt-proxy:dnscrypt-proxy ${stateDirectory}
-        cp -uv \
-          ${pkgs.dnscrypt-proxy}/share/dnscrypt-proxy/dnscrypt-resolvers.csv \
-          ${stateDirectory}
-      '';
-
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-      };
-    };
-
-    systemd.services.update-dnscrypt-resolvers = {
-      description = "Update list of DNSCrypt resolvers";
-
-      requires = [ "init-dnscrypt-proxy-statedir.service" ];
-      after = [ "init-dnscrypt-proxy-statedir.service" ];
-
-      path = with pkgs; [ curl diffutils dnscrypt-proxy minisign ];
-      script = ''
-        cd ${stateDirectory}
-        domain=raw.githubusercontent.com
-        get="curl -fSs --resolve $domain:443:$(hostip -r 8.8.8.8 $domain | head -1)"
-        $get -o dnscrypt-resolvers.csv.tmp \
-          https://$domain/jedisct1/dnscrypt-proxy/master/dnscrypt-resolvers.csv
-        $get -o dnscrypt-resolvers.csv.minisig.tmp \
-          https://$domain/jedisct1/dnscrypt-proxy/master/dnscrypt-resolvers.csv.minisig
-        mv dnscrypt-resolvers.csv.minisig{.tmp,}
-        if ! minisign -q -V -p ${upstreamResolverListPubKey} \
-          -m dnscrypt-resolvers.csv.tmp -x dnscrypt-resolvers.csv.minisig ; then
-          echo "failed to verify resolver list!" >&2
-          exit 1
-        fi
-        [[ -f dnscrypt-resolvers.csv ]] && mv dnscrypt-resolvers.csv{,.old}
-        mv dnscrypt-resolvers.csv{.tmp,}
-        if cmp dnscrypt-resolvers.csv{,.old} ; then
-          echo "no change"
-        else
-          echo "resolver list updated"
-        fi
-      '';
-
-      serviceConfig = {
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectHome = true;
-        ProtectSystem = "strict";
-        ReadWritePaths = "${dirOf stateDirectory} ${stateDirectory}";
-        SystemCallFilter = "~@mount";
-      };
-    };
-
-    systemd.timers.update-dnscrypt-resolvers = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnBootSec = "5min";
-        OnUnitActiveSec = "6h";
-      };
-    };
-    })
-    ]);
-
-  imports = [
-    (mkRenamedOptionModule [ "services" "dnscrypt-proxy" "port" ] [ "services" "dnscrypt-proxy" "localPort" ])
-
-    (mkChangedOptionModule
-      [ "services" "dnscrypt-proxy" "tcpOnly" ]
-      [ "services" "dnscrypt-proxy" "extraArgs" ]
-      (config:
-        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "tcpOnly" ] config; in
-        optional val "-T"))
-
-    (mkChangedOptionModule
-      [ "services" "dnscrypt-proxy" "ephemeralKeys" ]
-      [ "services" "dnscrypt-proxy" "extraArgs" ]
-      (config:
-        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "ephemeralKeys" ] config; in
-        optional val "-E"))
-
-    (mkRemovedOptionModule [ "services" "dnscrypt-proxy" "resolverList" ] ''
-      The current resolver listing from upstream is always used
-      unless a custom resolver is specified.
-    '')
-  ];
-}
diff --git a/nixos/modules/services/networking/dnscrypt-proxy.xml b/nixos/modules/services/networking/dnscrypt-proxy.xml
deleted file mode 100644
index 555c6df4d551..000000000000
--- a/nixos/modules/services/networking/dnscrypt-proxy.xml
+++ /dev/null
@@ -1,69 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-dnscrypt-proxy">
-
-  <title>DNSCrypt client proxy</title>
-
-  <para>
-    The DNSCrypt client proxy relays DNS queries to a DNSCrypt enabled
-    upstream resolver. The traffic between the client and the upstream
-    resolver is encrypted and authenticated, mitigating the risk of MITM
-    attacks, DNS poisoning attacks, and third-party snooping (assuming the
-    upstream is trustworthy).
-  </para>
-
-  <sect1><title>Basic configuration</title>
-
-  <para>
-    To enable the client proxy, set
-    <programlisting>
-      services.dnscrypt-proxy.enable = true;
-    </programlisting>
-  </para>
-
-  <para>
-    Enabling the client proxy does not alter the system nameserver; to
-    relay local queries, prepend <literal>127.0.0.1</literal> to
-    <option>networking.nameservers</option>.
-  </para>
-
-  </sect1>
-
-  <sect1><title>As a forwarder for another DNS client</title>
-
-  <para>
-    To run the DNSCrypt proxy client as a forwarder for another
-    DNS client, change the default proxy listening port to a
-    non-standard value and point the other client to it:
-    <programlisting>
-      services.dnscrypt-proxy.localPort = 43;
-    </programlisting>
-  </para>
-
-  <sect2><title>dnsmasq</title>
-  <para>
-    <programlisting>
-      {
-        services.dnsmasq.enable = true;
-        services.dnsmasq.servers = [ "127.0.0.1#43" ];
-      }
-    </programlisting>
-  </para>
-  </sect2>
-
-  <sect2><title>unbound</title>
-  <para>
-    <programlisting>
-      {
-        services.unbound.enable = true;
-        services.unbound.forwardAddresses = [ "127.0.0.1@43" ];
-      }
-    </programlisting>
-  </para>
-  </sect2>
-
-  </sect1>
-
-</chapter>
diff --git a/nixos/release.nix b/nixos/release.nix
index cf3fe6abd48c..5ae32928240a 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -255,7 +255,6 @@ in rec {
   tests.docker = hydraJob (import tests/docker.nix { system = "x86_64-linux"; });
   tests.docker-edge = hydraJob (import tests/docker-edge.nix { system = "x86_64-linux"; });
   tests.dovecot = callTest tests/dovecot.nix {};
-  tests.dnscrypt-proxy = callTest tests/dnscrypt-proxy.nix { system = "x86_64-linux"; };
   tests.ecryptfs = callTest tests/ecryptfs.nix {};
   tests.etcd = hydraJob (import tests/etcd.nix { system = "x86_64-linux"; });
   tests.ec2-nixops = hydraJob (import tests/ec2.nix { system = "x86_64-linux"; }).boot-ec2-nixops;
diff --git a/nixos/tests/dnscrypt-proxy.nix b/nixos/tests/dnscrypt-proxy.nix
deleted file mode 100644
index 845623368250..000000000000
--- a/nixos/tests/dnscrypt-proxy.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-import ./make-test.nix ({ pkgs, ... }: {
-  name = "dnscrypt-proxy";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ joachifm ];
-  };
-
-  nodes = {
-    # A client running the recommended setup: DNSCrypt proxy as a forwarder
-    # for a caching DNS client.
-    client =
-    { config, pkgs, ... }:
-    let localProxyPort = 43; in
-    {
-      security.apparmor.enable = true;
-
-      services.dnscrypt-proxy.enable = true;
-      services.dnscrypt-proxy.localPort = localProxyPort;
-      services.dnscrypt-proxy.extraArgs = [ "-X libdcplugin_example.so" ];
-
-      services.dnsmasq.enable = true;
-      services.dnsmasq.servers = [ "127.0.0.1#${toString localProxyPort}" ];
-    };
-  };
-
-  testScript = ''
-    $client->waitForUnit("dnsmasq");
-
-    # The daemon is socket activated; sending a single ping should activate it.
-    $client->execute("${pkgs.iputils}/bin/ping -c1 example.com");
-    $client->succeed("systemctl is-active dnscrypt-proxy");
-  '';
-})
diff --git a/pkgs/applications/audio/radiotray-ng/default.nix b/pkgs/applications/audio/radiotray-ng/default.nix
index 4bc9371dd17b..e075d68cd285 100644
--- a/pkgs/applications/audio/radiotray-ng/default.nix
+++ b/pkgs/applications/audio/radiotray-ng/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchpatch
+{ stdenv, fetchFromGitHub
 , cmake, pkgconfig
 # Transport
 , curl
@@ -15,6 +15,7 @@
 , libappindicator-gtk3
 , libnotify
 , libxdg_basedir
+, wxGTK
 # GStreamer
 , gst_all_1
 # User-agent info
@@ -39,13 +40,13 @@ let
 in
 stdenv.mkDerivation rec {
   name = "radiotray-ng-${version}";
-  version = "0.1.7";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "ebruck";
     repo = "radiotray-ng";
     rev = "v${version}";
-    sha256 = "1m853gzh9r249crn0xyrq22x154r005j58b0kq3nsrgi5cps2zdv";
+    sha256 = "12mhi0q137cjdpmpczvrcr7szq1ja1r8bm0gh03b925y8xyrqp5z";
   };
 
   nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook makeWrapper ];
@@ -56,6 +57,7 @@ stdenv.mkDerivation rec {
     glibmm hicolor_icon_theme gnome3.gsettings_desktop_schemas libappindicator-gtk3 libnotify
     libxdg_basedir
     lsb-release
+    wxGTK
   ] ++ stdenv.lib.optional doCheck gmock
     ++ gstInputs
     ++ pythonInputs;
@@ -65,15 +67,13 @@ stdenv.mkDerivation rec {
       --replace /usr $out
     substituteInPlace include/radiotray-ng/common.hpp \
       --replace /usr $out
-  '';
 
-  patches = [
-    (fetchpatch {
-      # Fix menu separators and minor touchup to 'version'
-      url = "https://github.com/ebruck/radiotray-ng/commit/827e9f1baaa03ab4d8a5fb3aab043e72950eb965.patch";
-      sha256 = "1aykl6lq4pga34xg5r9mc616gxnd63q6gr8qzg57w6874cj3csrr";
-    })
-  ];
+    # We don't find the radiotray-ng-notification icon otherwise
+    substituteInPlace data/radiotray-ng.desktop \
+      --replace radiotray-ng-notification radiotray-ng-on
+    substituteInPlace data/rtng-bookmark-editor.desktop \
+      --replace radiotray-ng-notification radiotray-ng-on
+  '';
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/editors/eclipse/plugins.nix b/pkgs/applications/editors/eclipse/plugins.nix
index 611b995c08dd..769891423d7e 100644
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@@ -424,16 +424,16 @@ rec {
 
   spotbugs = buildEclipsePlugin rec {
     name = "spotbugs-${version}";
-    version = "3.1.0.r201710241414-11c9895";
+    version = "3.1.1.r201712011030-903b7a0";
 
     srcFeature = fetchurl {
       url = "https://spotbugs.github.io/eclipse/features/com.github.spotbugs.plugin.eclipse_${version}.jar";
-      sha256 = "084dj2bid5issh28j32hi5w9vx5xs829h7d5lbz5hqj1fyn9h6bs";
+      sha256 = "12z5dbs10h5k567wbmwz1w4pnidmqsls52qcfdb3zlgr0rqvz072";
     };
 
     srcPlugin = fetchurl {
       url = "https://spotbugs.github.io/eclipse/plugins/com.github.spotbugs.plugin.eclipse_${version}.jar";
-      sha256 = "1mqpl3gx06f54w13jm01qd8fbniab3x989mi3lysx078vrp23jas";
+      sha256 = "0dnkp2alymvyyql7g8w79i27b3c64inhdvpxx1v014ng9liv54xb";
     };
 
     meta = with stdenv.lib; {
diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
index d1c0ab274f06..0dde8fbe7297 100644
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@@ -1,17 +1,15 @@
 { stdenv, fetchFromGitHub, pkgconfig, qmake
 , python, qtbase, qttools, zlib }:
 
-let
-#  qtEnv = with qt5; env "qt-${qtbase.version}" [ qtbase qttools ];
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   name = "tiled-${version}";
-  version = "1.0.3";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "bjorn";
     repo = "tiled";
     rev = "v${version}";
-    sha256 = "1j8307h7xkxqwr8rpr9fn1svm5h10k61w6zxr4sgph1hiv8x33aa";
+    sha256 = "1c6n5xshadxv5qwv8kfrj1kbfnkvx6nyxc9p4mpzkjrkxw1b1qf1";
   };
 
   nativeBuildInputs = [ pkgconfig qmake ];
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 10f12885dcd8..8286057c1e1d 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   name = "electrum-${version}";
-  version = "3.0.3";
+  version = "3.0.4";
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "09h3s1mbkliwh8758prbdk3sm19bnma7wy3k10pl9q9fkarbhp75";
+    sha256 = "03vvxbyci9acss9sfdjcvdp0ny1fvyj29q261lxqr416vvfparjj";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/misc/josm/default.nix b/pkgs/applications/misc/josm/default.nix
index 46263f7d83b8..b908941d2bc9 100644
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "josm-${version}";
-  version = "13053";
+  version = "13265";
 
   src = fetchurl {
     url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-    sha256 = "0czsmx0gsml3vqzx6940jw2xpmh16idypydw0d4147k4fi9gzyz6";
+    sha256 = "0mmpxmf17lw1j1m1gfz2jrm3qj2416zgbwgcy7xbvn6qcd8k7dr5";
   };
 
   buildInputs = [ jre8 makeWrapper ];
diff --git a/pkgs/applications/misc/pdfpc/default.nix b/pkgs/applications/misc/pdfpc/default.nix
index 9fc14d0cae71..515127e12ebb 100644
--- a/pkgs/applications/misc/pdfpc/default.nix
+++ b/pkgs/applications/misc/pdfpc/default.nix
@@ -4,13 +4,13 @@
 stdenv.mkDerivation rec {
   name = "${product}-${version}";
   product = "pdfpc";
-  version = "4.0.7";
+  version = "4.1";
 
   src = fetchFromGitHub {
     repo = "pdfpc";
     owner = "pdfpc";
     rev = "v${version}";
-    sha256 = "00qfmmk8h762p53z46g976z7j4fbxyi16w5axzsv1ymvdq95ds8c";
+    sha256 = "02cp0x5prqrizxdp0sf2sk5ip0363vyw6fxsb3zwyx4dw0vz4g96";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/instant-messengers/pidgin/default.nix b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
index cf1893b198e5..bd3fc82f7cba 100644
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@@ -3,6 +3,7 @@
 , perl, perlXMLParser, libxml2, nss, nspr, farstream
 , libXScrnSaver, ncurses, avahi, dbus, dbus_glib, intltool, libidn
 , lib, python, libICE, libXext, libSM
+, cyrus_sasl ? null
 , openssl ? null
 , gnutls ? null
 , libgcrypt ? null
@@ -33,7 +34,7 @@ let unwrapped = stdenv.mkDerivation rec {
     libxml2 nss nspr farstream
     libXScrnSaver ncurses python
     avahi dbus dbus_glib intltool libidn
-    libICE libXext libSM
+    libICE libXext libSM cyrus_sasl
   ]
   ++ (lib.optional (openssl != null) openssl)
   ++ (lib.optional (gnutls != null) gnutls)
@@ -55,6 +56,7 @@ let unwrapped = stdenv.mkDerivation rec {
     "--disable-nm"
     "--disable-tcl"
   ]
+  ++ (lib.optionals (cyrus_sasl != null) [ "--enable-cyrus-sasl=yes" ])
   ++ (lib.optionals (gnutls != null) ["--enable-gnutls=yes" "--enable-nss=no"]);
 
   enableParallelBuilding = true;
@@ -78,4 +80,3 @@ in if plugins == [] then unwrapped
       inherit stdenv makeWrapper symlinkJoin plugins;
       pidgin = unwrapped;
     }
-
diff --git a/pkgs/applications/office/osmo/default.nix b/pkgs/applications/office/osmo/default.nix
index 23ee4da8e015..b5475ae337a3 100644
--- a/pkgs/applications/office/osmo/default.nix
+++ b/pkgs/applications/office/osmo/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "osmo-${version}";
-  version = "0.4.0-1";
+  version = "0.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/osmo-pim/${name}.tar.gz";
-    sha256 = "fb454718e071c44bd360ce3e56cb29926cbf44a0d06ec738fa9b40fe3cbf8a33";
+    sha256 = "1gjd4w9jckfpqr9n0bw0w25h3qhfyzw1xvilh3hqdadfinwyal2v";
   };
 
   nativeBuildInputs = [ pkgconfig gettext wrapGAppsHook ];
diff --git a/pkgs/applications/version-management/gitaly/Gemfile b/pkgs/applications/version-management/gitaly/Gemfile
index 7e8f9f2b2557..2aaf872d109b 100644
--- a/pkgs/applications/version-management/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitaly/Gemfile
@@ -1,8 +1,10 @@
 source 'https://rubygems.org'
 
 gem 'github-linguist', '~> 4.7.0', require: 'linguist'
-gem 'gitaly-proto', '~> 0.37.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.59.0', require: 'gitaly'
 gem 'activesupport'
+gem 'gollum-lib', '~> 4.2', require: false
+gem 'gollum-rugged_adapter', '~> 0.4.4', require: false
 
 group :development, :test do
   gem 'gitlab-styles', '~> 2.0.0', require: false
diff --git a/pkgs/applications/version-management/gitaly/Gemfile.lock b/pkgs/applications/version-management/gitaly/Gemfile.lock
index 5ea14855b97f..f4e4ab10883e 100644
--- a/pkgs/applications/version-management/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitaly/Gemfile.lock
@@ -11,10 +11,13 @@ GEM
     ast (2.3.0)
     charlock_holmes (0.7.5)
     concurrent-ruby (1.0.5)
+    diff-lcs (1.3)
     escape_utils (1.1.1)
     faraday (0.12.2)
       multipart-post (>= 1.2, < 3)
-    gitaly-proto (0.37.0)
+    gemojione (3.3.0)
+      json
+    gitaly-proto (0.59.0)
       google-protobuf (~> 3.1)
       grpc (~> 1.0)
     github-linguist (4.7.6)
@@ -22,10 +25,29 @@ GEM
       escape_utils (~> 1.1.0)
       mime-types (>= 1.19)
       rugged (>= 0.23.0b)
+    github-markup (1.6.1)
+    gitlab-grit (2.8.2)
+      charlock_holmes (~> 0.6)
+      diff-lcs (~> 1.1)
+      mime-types (>= 1.16)
+      posix-spawn (~> 0.3)
     gitlab-styles (2.0.0)
       rubocop (~> 0.49)
       rubocop-gitlab-security (~> 0.1.0)
       rubocop-rspec (~> 1.15)
+    gollum-grit_adapter (1.0.1)
+      gitlab-grit (~> 2.7, >= 2.7.1)
+    gollum-lib (4.2.7)
+      gemojione (~> 3.2)
+      github-markup (~> 1.6)
+      gollum-grit_adapter (~> 1.0)
+      nokogiri (>= 1.6.1, < 2.0)
+      rouge (~> 2.1)
+      sanitize (~> 2.1)
+      stringex (~> 2.6)
+    gollum-rugged_adapter (0.4.4)
+      mime-types (>= 1.15)
+      rugged (~> 0.25)
     google-protobuf (3.4.0.2)
     googleauth (0.5.3)
       faraday (~> 0.12)
@@ -39,6 +61,7 @@ GEM
       google-protobuf (~> 3.1)
       googleauth (~> 0.5.1)
     i18n (0.8.1)
+    json (2.1.0)
     jwt (1.5.6)
     little-plugger (1.1.4)
     logging (2.2.2)
@@ -48,18 +71,23 @@ GEM
     mime-types (3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2016.0521)
+    mini_portile2 (2.3.0)
     minitest (5.9.1)
     multi_json (1.12.1)
     multipart-post (2.0.0)
+    nokogiri (1.8.1)
+      mini_portile2 (~> 2.3.0)
     os (0.9.6)
     parallel (1.12.0)
     parser (2.4.0.0)
       ast (~> 2.2)
+    posix-spawn (0.3.13)
     powerpack (0.1.1)
     public_suffix (2.0.5)
     rainbow (2.2.2)
       rake
     rake (12.1.0)
+    rouge (2.2.1)
     rubocop (0.50.0)
       parallel (~> 1.10)
       parser (>= 2.3.3.1, < 3.0)
@@ -73,11 +101,14 @@ GEM
       rubocop (>= 0.50.0)
     ruby-progressbar (1.8.3)
     rugged (0.26.0)
+    sanitize (2.1.0)
+      nokogiri (>= 1.4.4)
     signet (0.7.3)
       addressable (~> 2.3)
       faraday (~> 0.9)
       jwt (~> 1.5)
       multi_json (~> 1.10)
+    stringex (2.7.1)
     thread_safe (0.3.6)
     tzinfo (1.2.2)
       thread_safe (~> 0.1)
@@ -88,9 +119,11 @@ PLATFORMS
 
 DEPENDENCIES
   activesupport
-  gitaly-proto (~> 0.37.0)
+  gitaly-proto (~> 0.59.0)
   github-linguist (~> 4.7.0)
   gitlab-styles (~> 2.0.0)
+  gollum-lib (~> 4.2)
+  gollum-rugged_adapter (~> 0.4.4)
 
 BUNDLED WITH
-   1.15.4
+   1.16.0
diff --git a/pkgs/applications/version-management/gitaly/default.nix b/pkgs/applications/version-management/gitaly/default.nix
index 63e5758107f7..43ac470dcd46 100644
--- a/pkgs/applications/version-management/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitaly/default.nix
@@ -7,14 +7,14 @@ let
     gemdir = ./.;
   };
 in buildGoPackage rec {
-  version = "0.43.1";
+  version = "0.59.2";
   name = "gitaly-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "19ggfc5nwv8q1wq739ab8qdfdngpi33431dgfa9593p6ad7v6hyq";
+    sha256 = "08f109rw3qxdr93l0kl8wxmrvn846a6vdkssvrp2zr40yn9wif7m";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitaly";
diff --git a/pkgs/applications/version-management/gitaly/gemset.nix b/pkgs/applications/version-management/gitaly/gemset.nix
index 57480f3f337e..81bb334085ac 100644
--- a/pkgs/applications/version-management/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitaly/gemset.nix
@@ -41,6 +41,14 @@
     };
     version = "1.0.5";
   };
+  diff-lcs = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18w22bjz424gzafv6nzv98h0aqkwz3d9xhm7cbr1wfbyas8zayza";
+      type = "gem";
+    };
+    version = "1.3";
+  };
   escape_utils = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -58,14 +66,23 @@
     };
     version = "0.12.2";
   };
+  gemojione = {
+    dependencies = ["json"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ayk8r147k1s38nj18pwk76npx1p7jhi86silk800nj913pjvrhj";
+      type = "gem";
+    };
+    version = "3.3.0";
+  };
   gitaly-proto = {
     dependencies = ["google-protobuf" "grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nqp9ib00q55ig8zf1r6ldf3xkqw0874ra1mbcsm8sl46l84lx11";
+      sha256 = "0s86126iqhbmkix6zs357ixlc1syyxmwk2blaimsav7f0x9swy82";
       type = "gem";
     };
-    version = "0.37.0";
+    version = "0.59.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -76,6 +93,23 @@
     };
     version = "4.7.6";
   };
+  github-markup = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1nyb9ck2c9z5qi86n7r52w0m126qpnvc93yh35cn8bwsnkjqx0iq";
+      type = "gem";
+    };
+    version = "1.6.1";
+  };
+  gitlab-grit = {
+    dependencies = ["charlock_holmes" "diff-lcs" "mime-types" "posix-spawn"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xgs3l81ghlc5nm75n0pz7b2cj3hpscfq5iy27c483nnjn2v5mc4";
+      type = "gem";
+    };
+    version = "2.8.2";
+  };
   gitlab-styles = {
     dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-rspec"];
     source = {
@@ -85,6 +119,33 @@
     };
     version = "2.0.0";
   };
+  gollum-grit_adapter = {
+    dependencies = ["gitlab-grit"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fcibm63v1afc0fj5rki0mm51m7nndil4cjcjjvkh3yigfn4nr4b";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
+  gollum-lib = {
+    dependencies = ["gemojione" "github-markup" "gollum-grit_adapter" "nokogiri" "rouge" "sanitize" "stringex"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1filwvjfj5q2m6w4q274ai36d6f0mrsv2l2khhk4bv1q6pqby2fq";
+      type = "gem";
+    };
+    version = "4.2.7";
+  };
+  gollum-rugged_adapter = {
+    dependencies = ["mime-types" "rugged"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0khfmakp65frlaj7ajs6ihqg4xi7yc9z96kpsf1b7giqi3fqhhv4";
+      type = "gem";
+    };
+    version = "0.4.4";
+  };
   google-protobuf = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -119,6 +180,14 @@
     };
     version = "0.8.1";
   };
+  json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "01v6jjpvh3gnq6sgllpfqahlgxzj50ailwhj9b3cd20hi2dx0vxp";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
   jwt = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -169,6 +238,14 @@
     };
     version = "3.2016.0521";
   };
+  mini_portile2 = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13d32jjadpjj6d2wdhkfpsmy68zjx90p49bgf8f7nkpz86r1fr11";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
   minitest = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -193,6 +270,15 @@
     };
     version = "2.0.0";
   };
+  nokogiri = {
+    dependencies = ["mini_portile2"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "105xh2zkr8nsyfaj2izaisarpnkrrl9000y3nyflg9cbzrfxv021";
+      type = "gem";
+    };
+    version = "1.8.1";
+  };
   os = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -218,6 +304,14 @@
     };
     version = "2.4.0.0";
   };
+  posix-spawn = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1pmxmpins57qrbr31bs3bm7gidhaacmrp4md6i962gvpq4gyfcjw";
+      type = "gem";
+    };
+    version = "0.3.13";
+  };
   powerpack = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -251,6 +345,14 @@
     };
     version = "12.1.0";
   };
+  rouge = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "02kpahk5nkc33yxnn75649kzxaz073wvazr2zyg491nndykgnvcs";
+      type = "gem";
+    };
+    version = "2.2.1";
+  };
   rubocop = {
     dependencies = ["parallel" "parser" "powerpack" "rainbow" "ruby-progressbar" "unicode-display_width"];
     source = {
@@ -294,6 +396,15 @@
     };
     version = "0.26.0";
   };
+  sanitize = {
+    dependencies = ["nokogiri"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xsv6xqrlz91rd8wifjknadbl3z5h6qphmxy0hjb189qbdghggn3";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
   signet = {
     dependencies = ["addressable" "faraday" "jwt" "multi_json"];
     source = {
@@ -303,6 +414,14 @@
     };
     version = "0.7.3";
   };
+  stringex = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zc93v00av643lc6njl09wwki7h5yqayhh1din8zqfylw814l1dv";
+      type = "gem";
+    };
+    version = "2.7.1";
+  };
   thread_safe = {
     source = {
       remotes = ["https://rubygems.org"];
diff --git a/pkgs/applications/version-management/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab-shell/default.nix
index ac05ca4c4847..ab0ff74f03f5 100644
--- a/pkgs/applications/version-management/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab-shell/default.nix
@@ -1,19 +1,17 @@
 { stdenv, ruby, bundler, fetchFromGitLab, go }:
 
 stdenv.mkDerivation rec {
-  version = "5.9.3";
+  version = "5.10.2";
   name = "gitlab-shell-${version}";
 
   srcs = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "12iil8ap9lbd7skj7xr2v6lsyjdd97svbmyj0n2j8m819fv0x27p";
+    sha256 = "16lwnzsppql7pkf8fka6cwkghdr57g225zvln9ii29w7nzz1hvaf";
   };
 
-  buildInputs = [
-    ruby bundler go
-  ];
+  buildInputs = [ ruby bundler go ];
 
   patches = [ ./remove-hardcoded-locations.patch ./fixes.patch ];
 
diff --git a/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch
index dd1ecafb8bf8..f28e74b88c50 100644
--- a/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch
@@ -25,3 +25,16 @@ index e7d0254..181ec8a 100644
    end
  
    def api
+diff --git a/go/internal/config/config.go b/go/internal/config/config.go
+index c57b4de..88cfc95 100644
+--- a/go/internal/config/config.go
++++ b/go/internal/config/config.go
+@@ -27,7 +27,7 @@ func New() (*Config, error) {
+ 	}
+ 	cfg.RootDir = dir
+ 
+-	configBytes, err := ioutil.ReadFile(path.Join(cfg.RootDir, configFile))
++	configBytes, err := ioutil.ReadFile(os.Getenv("GITLAB_SHELL_CONFIG_PATH"))
+ 	if err != nil {
+ 		return nil, err
+ 	}
diff --git a/pkgs/applications/version-management/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab-workhorse/default.nix
index 1f3407eddcf5..c43b5ab2a1b6 100644
--- a/pkgs/applications/version-management/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab-workhorse/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitLab, git, go }:
 
 stdenv.mkDerivation rec {
-  version = "3.2.0";
+  version = "3.3.1";
   name = "gitlab-workhorse-${version}";
 
   srcs = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-workhorse";
     rev = "v${version}";
-    sha256 = "1ivqlhvmxhdb8359yh469zl45j00n94b53naqi8jx06kijfsdz4r";
+    sha256 = "19x9ryp99xygj39kq2r756rahh9mxp6j83hxvv09y33vgz64y8xh";
   };
 
   buildInputs = [ git go ];
diff --git a/pkgs/applications/version-management/gitlab/Gemfile b/pkgs/applications/version-management/gitlab/Gemfile
index b4a457bff6e5..916314f42f93 100644
--- a/pkgs/applications/version-management/gitlab/Gemfile
+++ b/pkgs/applications/version-management/gitlab/Gemfile
@@ -1,6 +1,6 @@
 source 'https://rubygems.org'
 
-gem 'rails', '4.2.8'
+gem 'rails', '4.2.10'
 gem 'rails-deprecated_sanitizer', '~> 1.0.3'
 
 # Responders respond_to and respond_with
@@ -90,7 +90,7 @@ gem 'kaminari', '~> 1.0'
 gem 'hamlit', '~> 2.6.1'
 
 # Files attachments
-gem 'carrierwave', '~> 1.1'
+gem 'carrierwave', '~> 1.2'
 
 # Drag and Drop UI
 gem 'dropzonejs-rails', '~> 0.7.1'
@@ -102,7 +102,7 @@ gem 'fog-google', '~> 0.5'
 gem 'fog-local', '~> 0.3'
 gem 'fog-openstack', '~> 0.1'
 gem 'fog-rackspace', '~> 0.1.1'
-gem 'fog-aliyun', '~> 0.1.0'
+gem 'fog-aliyun', '~> 0.2.0'
 
 # for Google storage
 gem 'google-api-client', '~> 0.13.6'
@@ -111,7 +111,7 @@ gem 'google-api-client', '~> 0.13.6'
 gem 'unf', '~> 0.1.4'
 
 # Seed data
-gem 'seed-fu', '~> 2.3.5'
+gem 'seed-fu', '2.3.6' # Upgrade to > 2.3.7 once https://github.com/mbleigh/seed-fu/issues/123 is solved
 
 # Markdown and HTML processing
 gem 'html-pipeline', '~> 1.11.0'
@@ -171,7 +171,7 @@ gem 're2', '~> 1.1.1'
 gem 'version_sorter', '~> 2.1.0'
 
 # Cache
-gem 'redis-rails', '~> 5.0.1'
+gem 'redis-rails', '~> 5.0.2'
 
 # Redis
 gem 'redis', '~> 3.2'
@@ -245,7 +245,7 @@ gem 'font-awesome-rails', '~> 4.7'
 gem 'gemojione', '~> 3.3'
 gem 'gon', '~> 6.1.0'
 gem 'jquery-atwho-rails', '~> 1.3.2'
-gem 'jquery-rails', '~> 4.1.0'
+gem 'jquery-rails', '~> 4.3.1'
 gem 'request_store', '~> 1.3'
 gem 'select2-rails', '~> 3.5.9'
 gem 'virtus', '~> 1.0.1'
@@ -263,6 +263,8 @@ gem 'gettext_i18n_rails', '~> 1.8.0'
 gem 'gettext_i18n_rails_js', '~> 1.2.0'
 gem 'gettext', '~> 3.2.2', require: false, group: :development
 
+gem 'batch-loader'
+
 # Perf bar
 gem 'peek', '~> 1.0.1'
 gem 'peek-gc', '~> 0.0.2'
@@ -281,7 +283,7 @@ group :metrics do
   gem 'influxdb', '~> 0.2', require: false
 
   # Prometheus
-  gem 'prometheus-client-mmap', '~>0.7.0.beta18'
+  gem 'prometheus-client-mmap', '~> 0.7.0.beta43'
   gem 'raindrops', '~> 0.18'
 end
 
@@ -324,9 +326,9 @@ group :development, :test do
   # Generate Fake data
   gem 'ffaker', '~> 2.4'
 
-  gem 'capybara', '~> 2.15.0'
+  gem 'capybara', '~> 2.15'
   gem 'capybara-screenshot', '~> 1.0.0'
-  gem 'poltergeist', '~> 1.9.0'
+  gem 'selenium-webdriver', '~> 3.5'
 
   gem 'spring', '~> 2.0.0'
   gem 'spring-commands-rspec', '~> 1.0.4'
@@ -343,7 +345,7 @@ group :development, :test do
 
   gem 'benchmark-ips', '~> 2.3.0', require: false
 
-  gem 'license_finder', '~> 2.1.0', require: false
+  gem 'license_finder', '~> 3.1', require: false
   gem 'knapsack', '~> 1.11.0'
 
   gem 'activerecord_sane_schema_dumper', '0.2'
@@ -398,7 +400,7 @@ group :ed25519 do
 end
 
 # Gitaly GRPC client
-gem 'gitaly-proto', '~> 0.39.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.59.0', require: 'gitaly'
 
 gem 'toml-rb', '~> 0.3.15', require: false
 
diff --git a/pkgs/applications/version-management/gitlab/Gemfile.lock b/pkgs/applications/version-management/gitlab/Gemfile.lock
index fd3aab2d54ad..c8915e9172c5 100644
--- a/pkgs/applications/version-management/gitlab/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/Gemfile.lock
@@ -4,40 +4,40 @@ GEM
     RedCloth (4.3.2)
     abstract_type (0.0.7)
     ace-rails-ap (4.1.2)
-    actionmailer (4.2.8)
-      actionpack (= 4.2.8)
-      actionview (= 4.2.8)
-      activejob (= 4.2.8)
+    actionmailer (4.2.10)
+      actionpack (= 4.2.10)
+      actionview (= 4.2.10)
+      activejob (= 4.2.10)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.8)
-      actionview (= 4.2.8)
-      activesupport (= 4.2.8)
+    actionpack (4.2.10)
+      actionview (= 4.2.10)
+      activesupport (= 4.2.10)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.8)
-      activesupport (= 4.2.8)
+    actionview (4.2.10)
+      activesupport (= 4.2.10)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (4.2.8)
-      activesupport (= 4.2.8)
+    activejob (4.2.10)
+      activesupport (= 4.2.10)
       globalid (>= 0.3.0)
-    activemodel (4.2.8)
-      activesupport (= 4.2.8)
+    activemodel (4.2.10)
+      activesupport (= 4.2.10)
       builder (~> 3.1)
-    activerecord (4.2.8)
-      activemodel (= 4.2.8)
-      activesupport (= 4.2.8)
+    activerecord (4.2.10)
+      activemodel (= 4.2.10)
+      activesupport (= 4.2.10)
       arel (~> 6.0)
     activerecord-nulldb-adapter (0.3.7)
       activerecord (>= 2.0.0)
     activerecord_sane_schema_dumper (0.2)
       rails (>= 4, < 5)
-    activesupport (4.2.8)
+    activesupport (4.2.10)
       i18n (~> 0.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
@@ -75,6 +75,7 @@ GEM
       thread_safe (~> 0.3, >= 0.3.1)
     babosa (1.0.2)
     base32 (0.3.2)
+    batch-loader (1.1.1)
     bcrypt (3.1.11)
     bcrypt_pbkdf (1.0.0)
     benchmark-ips (2.3.0)
@@ -85,6 +86,7 @@ GEM
     bindata (2.4.1)
     binding_of_caller (0.7.2)
       debug_inspector (>= 0.0.1)
+    blankslate (2.1.2.4)
     bootstrap-sass (3.3.6)
       autoprefixer-rails (>= 5.2.1)
       sass (>= 3.3.4)
@@ -109,18 +111,19 @@ GEM
     capybara-screenshot (1.0.14)
       capybara (>= 1.0, < 3)
       launchy
-    carrierwave (1.1.0)
+    carrierwave (1.2.1)
       activemodel (>= 4.0.0)
       activesupport (>= 4.0.0)
       mime-types (>= 1.16)
     cause (0.1)
     charlock_holmes (0.7.5)
+    childprocess (0.7.0)
+      ffi (~> 1.0, >= 1.0.11)
     chronic (0.10.2)
     chronic_duration (0.10.6)
       numerizer (~> 0.1.1)
     chunky_png (1.3.5)
     citrus (3.0.2)
-    cliver (0.3.2)
     coderay (1.1.1)
     coercible (1.0.0)
       descendants_tracker (~> 0.0.1)
@@ -216,7 +219,7 @@ GEM
     flowdock (0.7.1)
       httparty (~> 0.7)
       multi_json
-    fog-aliyun (0.1.0)
+    fog-aliyun (0.2.0)
       fog-core (~> 1.27)
       fog-json (~> 1.0)
       ipaddress (~> 0.8)
@@ -275,7 +278,7 @@ GEM
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
     gherkin-ruby (0.3.2)
-    gitaly-proto (0.39.0)
+    gitaly-proto (0.59.0)
       google-protobuf (~> 3.1)
       grpc (~> 1.0)
     github-linguist (4.7.6)
@@ -293,14 +296,14 @@ GEM
       diff-lcs (~> 1.1)
       mime-types (>= 1.16)
       posix-spawn (~> 0.3)
-    gitlab-markup (1.6.2)
+    gitlab-markup (1.6.3)
     gitlab_omniauth-ldap (2.0.4)
       net-ldap (~> 0.16)
       omniauth (~> 1.3)
       pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
       rubyntlm (~> 0.5)
-    globalid (0.3.7)
-      activesupport (>= 4.1.0)
+    globalid (0.4.1)
+      activesupport (>= 4.2.0)
     gollum-grit_adapter (1.0.1)
       gitlab-grit (~> 2.7, >= 2.7.1)
     gollum-lib (4.2.7)
@@ -326,7 +329,7 @@ GEM
       mime-types (~> 3.0)
       representable (~> 3.0)
       retriable (>= 2.0, < 4.0)
-    google-protobuf (3.4.0.2)
+    google-protobuf (3.4.1.1)
     googleauth (0.5.3)
       faraday (~> 0.12)
       jwt (~> 1.4)
@@ -353,7 +356,7 @@ GEM
       rake
     grape_logging (1.7.0)
       grape
-    grpc (1.6.0)
+    grpc (1.4.5)
       google-protobuf (~> 3.1)
       googleauth (~> 0.5.1)
     haml (4.0.7)
@@ -396,7 +399,8 @@ GEM
       json (~> 1.8)
       multi_xml (>= 0.5.2)
     httpclient (2.8.2)
-    i18n (0.8.6)
+    i18n (0.9.1)
+      concurrent-ruby (~> 1.0)
     ice_nine (0.11.2)
     influxdb (0.2.3)
       cause
@@ -407,7 +411,7 @@ GEM
       multipart-post
       oauth (~> 0.5, >= 0.5.0)
     jquery-atwho-rails (1.3.2)
-    jquery-rails (4.1.1)
+    jquery-rails (4.3.1)
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
@@ -449,11 +453,13 @@ GEM
       actionmailer (>= 3.2)
       letter_opener (~> 1.0)
       railties (>= 3.2)
-    license_finder (2.1.0)
+    license_finder (3.1.1)
       bundler
       httparty
       rubyzip
       thor
+      toml (= 0.1.2)
+      with_env (> 1.0)
       xml-simple
     licensee (8.7.0)
       rugged (~> 0.24)
@@ -468,8 +474,8 @@ GEM
       railties (>= 4, < 5.2)
     loofah (2.0.3)
       nokogiri (>= 1.5.9)
-    mail (2.6.6)
-      mime-types (>= 1.16, < 4)
+    mail (2.7.0)
+      mini_mime (>= 0.1.1)
     mail_room (0.9.1)
     memoist (0.16.0)
     memoizable (0.4.2)
@@ -482,7 +488,6 @@ GEM
     mini_mime (0.1.4)
     mini_portile2 (2.3.0)
     minitest (5.7.0)
-    mmap2 (2.2.7)
     mousetrap-rails (1.4.6)
     multi_json (1.12.2)
     multi_xml (0.6.0)
@@ -567,8 +572,10 @@ GEM
     parallel (1.12.0)
     paranoia (2.3.1)
       activerecord (>= 4.0, < 5.2)
-    parser (2.4.0.0)
-      ast (~> 2.2)
+    parser (2.4.0.2)
+      ast (~> 2.3)
+    parslet (1.5.0)
+      blankslate (~> 2.0)
     path_expander (1.0.1)
     peek (1.0.1)
       concurrent-ruby (>= 0.9.0)
@@ -603,11 +610,6 @@ GEM
     pg (0.18.4)
     po_to_json (1.0.1)
       json (>= 1.6.0)
-    poltergeist (1.9.0)
-      capybara (~> 2.1)
-      cliver (~> 0.3.1)
-      multi_json (~> 1.0)
-      websocket-driver (>= 0.2.0)
     posix-spawn (0.3.13)
     powerpack (0.1.1)
     premailer (1.10.4)
@@ -622,8 +624,7 @@ GEM
       parser
       unparser
     procto (0.0.3)
-    prometheus-client-mmap (0.7.0.beta18)
-      mmap2 (~> 2.2, >= 2.2.7)
+    prometheus-client-mmap (0.7.0.beta43)
     pry (0.10.4)
       coderay (~> 1.1.0)
       method_source (~> 0.8.1)
@@ -653,16 +654,16 @@ GEM
       rack
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.2.8)
-      actionmailer (= 4.2.8)
-      actionpack (= 4.2.8)
-      actionview (= 4.2.8)
-      activejob (= 4.2.8)
-      activemodel (= 4.2.8)
-      activerecord (= 4.2.8)
-      activesupport (= 4.2.8)
+    rails (4.2.10)
+      actionmailer (= 4.2.10)
+      actionpack (= 4.2.10)
+      actionview (= 4.2.10)
+      activejob (= 4.2.10)
+      activemodel (= 4.2.10)
+      activerecord (= 4.2.10)
+      activesupport (= 4.2.10)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.8)
+      railties (= 4.2.10)
       sprockets-rails
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
@@ -675,15 +676,15 @@ GEM
     rails-i18n (4.0.9)
       i18n (~> 0.7)
       railties (~> 4.0)
-    railties (4.2.8)
-      actionpack (= 4.2.8)
-      activesupport (= 4.2.8)
+    railties (4.2.10)
+      actionpack (= 4.2.10)
+      activesupport (= 4.2.10)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
     rainbow (2.2.2)
       rake
     raindrops (0.18.0)
-    rake (12.1.0)
+    rake (12.3.0)
     rblineprof (0.3.6)
       debugger-ruby_core_source (~> 1.3)
     rbnacl (4.0.2)
@@ -698,24 +699,24 @@ GEM
     recursive-open-struct (1.0.0)
     redcarpet (3.4.0)
     redis (3.3.3)
-    redis-actionpack (5.0.1)
+    redis-actionpack (5.0.2)
       actionpack (>= 4.0, < 6)
       redis-rack (>= 1, < 3)
-      redis-store (>= 1.1.0, < 1.4.0)
-    redis-activesupport (5.0.1)
+      redis-store (>= 1.1.0, < 2)
+    redis-activesupport (5.0.4)
       activesupport (>= 3, < 6)
-      redis-store (~> 1.2.0)
+      redis-store (>= 1.3, < 2)
     redis-namespace (1.5.2)
       redis (~> 3.0, >= 3.0.4)
-    redis-rack (1.6.0)
-      rack (~> 1.5)
-      redis-store (~> 1.2.0)
-    redis-rails (5.0.1)
-      redis-actionpack (~> 5.0.0)
-      redis-activesupport (~> 5.0.0)
-      redis-store (~> 1.2.0)
-    redis-store (1.2.0)
-      redis (>= 2.2)
+    redis-rack (2.0.4)
+      rack (>= 1.5, < 3)
+      redis-store (>= 1.2, < 2)
+    redis-rails (5.0.2)
+      redis-actionpack (>= 5.0, < 6)
+      redis-activesupport (>= 5.0, < 6)
+      redis-store (>= 1.2, < 2)
+    redis-store (1.4.1)
+      redis (>= 2.2, < 5)
     representable (3.0.4)
       declarative (< 0.1.0)
       declarative-option (< 0.2.0)
@@ -817,6 +818,9 @@ GEM
       activesupport (>= 3.1)
     select2-rails (3.5.9.3)
       thor (~> 0.14)
+    selenium-webdriver (3.5.0)
+      childprocess (~> 0.5)
+      rubyzip (~> 1.0)
     sentry-raven (2.5.3)
       faraday (>= 0.7.6, < 1.0)
     settingslogic (2.0.9)
@@ -867,7 +871,7 @@ GEM
     sprockets (3.7.1)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.2.0)
+    sprockets-rails (3.2.1)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
@@ -898,12 +902,14 @@ GEM
     tilt (2.0.6)
     timecop (0.8.1)
     timfel-krb5-auth (0.8.3)
+    toml (0.1.2)
+      parslet (~> 1.5.0)
     toml-rb (0.3.15)
       citrus (~> 3.0, > 3.0)
     truncato (0.7.10)
       htmlentities (~> 4.3.1)
       nokogiri (~> 1.8.0, >= 1.7.0)
-    tzinfo (1.2.3)
+    tzinfo (1.2.4)
       thread_safe (~> 0.1)
     u2f (0.2.1)
     uber (0.1.0)
@@ -948,13 +954,11 @@ GEM
       hashdiff
     webpack-rails (0.9.10)
       railties (>= 3.2.0)
-    websocket-driver (0.6.3)
-      websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.2)
     wikicloth (0.8.1)
       builder
       expression_parser
       rinku
+    with_env (1.1.0)
     xml-simple (1.1.5)
     xpath (2.1.0)
       nokogiri (~> 1.3)
@@ -978,6 +982,7 @@ DEPENDENCIES
   awesome_print (~> 1.2.0)
   babosa (~> 1.0.2)
   base32 (~> 0.3.0)
+  batch-loader
   bcrypt_pbkdf (~> 1.0)
   benchmark-ips (~> 2.3.0)
   better_errors (~> 2.1.0)
@@ -988,9 +993,9 @@ DEPENDENCIES
   browser (~> 2.2)
   bullet (~> 5.5.0)
   bundler-audit (~> 0.5.0)
-  capybara (~> 2.15.0)
+  capybara (~> 2.15)
   capybara-screenshot (~> 1.0.0)
-  carrierwave (~> 1.1)
+  carrierwave (~> 1.2)
   charlock_holmes (~> 0.7.5)
   chronic (~> 0.10.2)
   chronic_duration (~> 0.10.6)
@@ -1015,7 +1020,7 @@ DEPENDENCIES
   flay (~> 2.8.0)
   flipper (~> 0.10.2)
   flipper-active_record (~> 0.10.2)
-  fog-aliyun (~> 0.1.0)
+  fog-aliyun (~> 0.2.0)
   fog-aws (~> 1.4)
   fog-core (~> 1.44)
   fog-google (~> 0.5)
@@ -1030,7 +1035,7 @@ DEPENDENCIES
   gettext (~> 3.2.2)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.2.0)
-  gitaly-proto (~> 0.39.0)
+  gitaly-proto (~> 0.59.0)
   github-linguist (~> 4.7.0)
   gitlab-flowdock-git-hook (~> 1.0.1)
   gitlab-markup (~> 1.6.2)
@@ -1055,14 +1060,14 @@ DEPENDENCIES
   influxdb (~> 0.2)
   jira-ruby (~> 1.4)
   jquery-atwho-rails (~> 1.3.2)
-  jquery-rails (~> 4.1.0)
+  jquery-rails (~> 4.3.1)
   json-schema (~> 2.8.0)
   jwt (~> 1.5.6)
   kaminari (~> 1.0)
   knapsack (~> 1.11.0)
   kubeclient (~> 2.2.0)
   letter_opener_web (~> 1.3.0)
-  license_finder (~> 2.1.0)
+  license_finder (~> 3.1)
   licensee (~> 8.7.0)
   lograge (~> 0.5)
   loofah (~> 2.0.3)
@@ -1104,16 +1109,15 @@ DEPENDENCIES
   peek-redis (~> 1.2.0)
   peek-sidekiq (~> 1.0.3)
   pg (~> 0.18.2)
-  poltergeist (~> 1.9.0)
   premailer-rails (~> 1.9.7)
-  prometheus-client-mmap (~> 0.7.0.beta18)
+  prometheus-client-mmap (~> 0.7.0.beta43)
   pry-byebug (~> 3.4.1)
   pry-rails (~> 0.3.4)
   rack-attack (~> 4.4.1)
   rack-cors (~> 0.4.0)
   rack-oauth2 (~> 1.2.1)
   rack-proxy (~> 0.6.0)
-  rails (= 4.2.8)
+  rails (= 4.2.10)
   rails-deprecated_sanitizer (~> 1.0.3)
   rails-i18n (~> 4.0.9)
   rainbow (~> 2.2)
@@ -1127,7 +1131,7 @@ DEPENDENCIES
   redcarpet (~> 3.4)
   redis (~> 3.2)
   redis-namespace (~> 1.5.2)
-  redis-rails (~> 5.0.1)
+  redis-rails (~> 5.0.2)
   request_store (~> 1.3)
   responders (~> 2.0)
   rouge (~> 2.0)
@@ -1148,8 +1152,9 @@ DEPENDENCIES
   sanitize (~> 2.0)
   sass-rails (~> 5.0.6)
   scss_lint (~> 0.54.0)
-  seed-fu (~> 2.3.5)
+  seed-fu (= 2.3.6)
   select2-rails (~> 3.5.9)
+  selenium-webdriver (~> 3.5)
   sentry-raven (~> 2.5.3)
   settingslogic (~> 2.0.9)
   sham_rack (~> 1.3.6)
@@ -1189,4 +1194,4 @@ DEPENDENCIES
   wikicloth (= 0.8.1)
 
 BUNDLED WITH
-   1.15.4
+   1.16.0
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index bc3ca9192bcb..ea4c9c8731d2 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -18,11 +18,11 @@ let
     };
   };
 
-  version = "10.1.1";
+  version = "10.3.3";
 
   gitlabDeb = fetchurl {
     url = "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/jessie/gitlab-ce_${version}-ce.0_amd64.deb/download";
-    sha256 = "0xvzxcygy6ffqm24rk6v9gs6g9r744vpwwvk9d00wjla7hwmq3w2";
+    sha256 = "0bnafl7mpm3vjhfkqwgf5ff1y1iixfdfvv25zmpl0yjd70fwx2aq";
   };
 
 in
@@ -30,17 +30,17 @@ in
 stdenv.mkDerivation rec {
   name = "gitlab-${version}";
 
-  buildInputs = [
-    rubyEnv ruby bundler tzdata git procps dpkg nettools
-  ];
-
   src = fetchFromGitHub {
     owner = "gitlabhq";
     repo = "gitlabhq";
     rev = "v${version}";
-    sha256 = "0p118msad6l12pd4q3vkvjggiiasbkh6pnl94riqyb5zkb7yrb1a";
+    sha256 = "1fhjijs8rvxrgx43fc7vp6f3vwshwq74gjwk41fi2yam8bri8p6k";
   };
 
+  buildInputs = [
+    rubyEnv ruby bundler tzdata git procps dpkg nettools
+  ];
+
   patches = [
     ./remove-hardcoded-locations.patch
     ./nulladapter.patch
@@ -74,7 +74,11 @@ stdenv.mkDerivation rec {
   buildPhase = ''
     mv config/gitlab.yml.example config/gitlab.yml
 
-    dpkg -x ${gitlabDeb} .
+    # work around unpacking deb containing binary with suid bit
+    ar p ${gitlabDeb} data.tar.gz | gunzip > gitlab-deb-data.tar
+    tar -f gitlab-deb-data.tar --delete ./opt/gitlab/embedded/bin/ksu
+    tar -xf gitlab-deb-data.tar
+
     mv -v opt/gitlab/embedded/service/gitlab-rails/public/assets public
     rm -rf opt
 
diff --git a/pkgs/applications/version-management/gitlab/gemset.nix b/pkgs/applications/version-management/gitlab/gemset.nix
index 4fb4c48b0dee..fe861e143046 100644
--- a/pkgs/applications/version-management/gitlab/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gemset.nix
@@ -19,55 +19,55 @@
     dependencies = ["actionpack" "actionview" "activejob" "mail" "rails-dom-testing"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pr3cmr0bpgg5d0f6wy1z6r45n14r9yin8jnr4hi3ssf402xpc0q";
+      sha256 = "1ivyjsapqgn1xfb2p8yqjrg2jldqm5r7hxrjxq6kdr05gk4fsg59";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.10";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09fbazl0ja80na2wadfp3fzmdmdy1lsb4wd2yg7anbj0zk0ap7a9";
+      sha256 = "0l6agrxdaishxjx2zc2x8md95plfp39bfskzgs6v9gsdp2y2arpx";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.10";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubis" "rails-dom-testing" "rails-html-sanitizer"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1mg4a8143q2wjhjq4mngl69jkv249z5jvg0jkdribdv4zkg586rp";
+      sha256 = "1jrx2pmkywk70z7n17gw3jrcdw3n03wdzvg45bnq8wxshl1lmbhv";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.10";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kazbpfgzz6cdmwjnlb9m671ps4qgggwv2hy8y9xi4h96djyyfqz";
+      sha256 = "10jsa5pqklcsd2npicqxr5abjlwi53di2brpzgz35k557fkpc1z8";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.10";
   };
   activemodel = {
     dependencies = ["activesupport" "builder"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11vhh7zmp92880s5sx8r32v2p0b7xg039mfr92pjynpkz4q901ld";
+      sha256 = "0c4vj9xajxa906bqbcjpni74nya6rh2nbb15gl8xm0vl9zf3ll9v";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.10";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport" "arel"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1kk4dhn8jfhqfsf1dmb3a183gix6k46xr6cjkxj0rp51w2za1ns0";
+      sha256 = "1lws9y4p9c2vnmv3ddfpv8jh6azlddppl3fi31vahaz14ifxjk5s";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.10";
   };
   activerecord-nulldb-adapter = {
     dependencies = ["activerecord"];
@@ -91,10 +91,10 @@
     dependencies = ["i18n" "minitest" "thread_safe" "tzinfo"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0wibdzd2f5l5rlsw1a1y3j3fhw2imrrbkxggdraa6q9qbdnc66hi";
+      sha256 = "0s12j8vl8vrxfngkdlz9g8bpz9akq1z42d57mx5r537b2pji8nr7";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.10";
   };
   acts-as-taggable-on = {
     dependencies = ["activerecord"];
@@ -248,6 +248,14 @@
     };
     version = "0.3.2";
   };
+  batch-loader = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1w4ysjfh74612wsgdnnaq3xqw25hzsr6ajb5syiv1ix7fi15y8bv";
+      type = "gem";
+    };
+    version = "1.1.1";
+  };
   bcrypt = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -298,6 +306,14 @@
     };
     version = "0.7.2";
   };
+  blankslate = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0jnnq5q5dwy2rbfcl769vd9bk1yn0242f6yjlb9mnqdm9627cdcx";
+      type = "gem";
+    };
+    version = "2.1.2.4";
+  };
   bootstrap-sass = {
     dependencies = ["autoprefixer-rails" "sass"];
     source = {
@@ -387,10 +403,10 @@
     dependencies = ["activemodel" "activesupport" "mime-types"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nms4w6vkm7djghdxwi9qzykhc2ynjwblgqwk87w61fhispqlq2c";
+      sha256 = "012b5jks7hxis1agiy7rbra5h4zhmwhy95gck3kr22nwdxfk71ii";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.1";
   };
   cause = {
     source = {
@@ -408,6 +424,15 @@
     };
     version = "0.7.5";
   };
+  childprocess = {
+    dependencies = ["ffi"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rqf595gv0bb48awck2cvipk78jy5pj08p1r4xbrfpd0i60jb9hd";
+      type = "gem";
+    };
+    version = "0.7.0";
+  };
   chronic = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -441,14 +466,6 @@
     };
     version = "3.0.2";
   };
-  cliver = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "096f4rj7virwvqxhkavy0v55rax10r4jqf8cymbvn4n631948xc7";
-      type = "gem";
-    };
-    version = "0.3.2";
-  };
   coderay = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -894,10 +911,10 @@
     dependencies = ["fog-core" "fog-json" "ipaddress" "xml-simple"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i76g8sdskyfc0gcnd6n9i757s7dmwg3wf6spcr2xh8wzyxkm1pj";
+      sha256 = "0x66xyrw4ahyr6f9masiqmz5q6h8scv46y59crnfp8dj7r52hw8m";
       type = "gem";
     };
-    version = "0.1.0";
+    version = "0.2.0";
   };
   fog-aws = {
     dependencies = ["fog-core" "fog-json" "fog-xml" "ipaddress"];
@@ -1071,10 +1088,10 @@
     dependencies = ["google-protobuf" "grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0irc3yfyr5li2ki6w03znsklnk0qx3srk4wrb7jav042c4kw325k";
+      sha256 = "0s86126iqhbmkix6zs357ixlc1syyxmwk2blaimsav7f0x9swy82";
       type = "gem";
     };
-    version = "0.39.0";
+    version = "0.59.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -1114,10 +1131,10 @@
   gitlab-markup = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "114jfbyyfwad609k1l1fcmbzszb3frdchh83gdwndkglllvprhjz";
+      sha256 = "1pvx257azpr00yvb74lgjpgnj72nwyd29l9a18280rgmp4cjniki";
       type = "gem";
     };
-    version = "1.6.2";
+    version = "1.6.3";
   };
   gitlab_omniauth-ldap = {
     dependencies = ["net-ldap" "omniauth" "pyu-ruby-sasl" "rubyntlm"];
@@ -1132,10 +1149,10 @@
     dependencies = ["activesupport"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "11plkgyl3w9k4y2scc1igvpgwyz4fnmsr63h2q4j8wkb48nlnhak";
+      sha256 = "02smrgdi11kziqi9zhnsy9i6yr2fnxrqlv3lllsvdjki3cd4is38";
       type = "gem";
     };
-    version = "0.3.7";
+    version = "0.4.1";
   };
   gollum-grit_adapter = {
     dependencies = ["gitlab-grit"];
@@ -1185,10 +1202,10 @@
   google-protobuf = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jh8axm5m75rvdf2i3s24pmi7p613armh9vk3p1d0ryfx159mqkl";
+      sha256 = "1l9b2f4msp1gkay2mqjbjs7kfhchf916zh1y365singiysrwn2i6";
       type = "gem";
     };
-    version = "3.4.0.2";
+    version = "3.4.1.1";
   };
   googleauth = {
     dependencies = ["faraday" "jwt" "logging" "memoist" "multi_json" "os" "signet"];
@@ -1248,10 +1265,10 @@
     dependencies = ["google-protobuf" "googleauth"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "056ipqai887x5jpbgcc215kdi0lfqjzcjbx3hx11cjrfww01zc52";
+      sha256 = "1zhci260088zlghpaz6ania1blz1dd7lgklsjnqk1vcymhpr6b38";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.4.5";
   };
   haml = {
     dependencies = ["tilt"];
@@ -1401,12 +1418,13 @@
     version = "2.8.2";
   };
   i18n = {
+    dependencies = ["concurrent-ruby"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1i3aqvzfsj786kwjj70jsjpxm6ffw5pwhalzr2abjfv2bdc7k9kw";
+      sha256 = "032wbfixfpwa67c893x5sn02ab0928vfqfshcs02bwkkxpqy9x8s";
       type = "gem";
     };
-    version = "0.8.6";
+    version = "0.9.1";
   };
   ice_nine = {
     source = {
@@ -1454,10 +1472,10 @@
     dependencies = ["rails-dom-testing" "railties" "thor"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1asbrr9hqf43q9qbjf87f5lm7fp12pndh76z89ks6jwxf1350fj1";
+      sha256 = "02ii77vwxc49f2lrkbdzww2168bp5nihwzakc9mqyrsbw394w7ki";
       type = "gem";
     };
-    version = "4.1.1";
+    version = "4.3.1";
   };
   json = {
     source = {
@@ -1582,13 +1600,13 @@
     version = "1.3.0";
   };
   license_finder = {
-    dependencies = ["httparty" "rubyzip" "thor" "xml-simple"];
+    dependencies = ["httparty" "rubyzip" "thor" "toml" "with_env" "xml-simple"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "092rwf1yjq1l63zbqanmbnbky8g5pj7c3g30mcqbyppbqrsflx80";
+      sha256 = "12p18a34q8dgzjwi2plgv889kxnxqnnmrqhvjs3ng2z26hv2zfag";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "3.1.1";
   };
   licensee = {
     dependencies = ["rugged"];
@@ -1643,13 +1661,13 @@
     version = "2.0.3";
   };
   mail = {
-    dependencies = ["mime-types"];
+    dependencies = ["mini_mime"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0d7lhj2dw52ycls6xigkfz6zvfhc6qggply9iycjmcyj9760yvz9";
+      sha256 = "10dyifazss9mgdzdv08p47p344wmphp5pkh5i73s7c04ra8y6ahz";
       type = "gem";
     };
-    version = "2.6.6";
+    version = "2.7.0";
   };
   mail_room = {
     source = {
@@ -1733,14 +1751,6 @@
     };
     version = "5.7.0";
   };
-  mmap2 = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1rgf4zhqa6632nbqj585hc0x69iz21s5c91mpijcr9i5wpj9p1s6";
-      type = "gem";
-    };
-    version = "2.2.7";
-  };
   mousetrap-rails = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -2081,10 +2091,19 @@
     dependencies = ["ast"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "130rfk8a2ws2fyq52hmi1n0xakylw39wv4x1qhai4z17x2b0k9cq";
+      sha256 = "0bqc29xx4zwlshvi6krrd0sl82d7xjfhcrxvgf38wvdqcl3b7ck3";
+      type = "gem";
+    };
+    version = "2.4.0.2";
+  };
+  parslet = {
+    dependencies = ["blankslate"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qp1m8n3m6k6g22nn1ivcfkvccq5jmbkw53vvcjw5xssq179l9z3";
       type = "gem";
     };
-    version = "2.4.0.0";
+    version = "1.5.0";
   };
   path_expander = {
     source = {
@@ -2192,15 +2211,6 @@
     };
     version = "1.0.1";
   };
-  poltergeist = {
-    dependencies = ["capybara" "cliver" "multi_json" "websocket-driver"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1fnkly1ks31nf5cdks9jd5c5vynbanrr8pwp801qq2i8bg78rwc0";
-      type = "gem";
-    };
-    version = "1.9.0";
-  };
   posix-spawn = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -2253,13 +2263,12 @@
     version = "0.0.3";
   };
   prometheus-client-mmap = {
-    dependencies = ["mmap2"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fgkilpiha338mvfkj5rwhny3vld0nb3v1vgbrlxbhnvch26wakh";
+      sha256 = "1wpk9zfbr7c1asvnq1v6jmc3ydbl8y17v24cj4vyhy3nkpds0cij";
       type = "gem";
     };
-    version = "0.7.0.beta18";
+    version = "0.7.0.beta43";
   };
   pry = {
     dependencies = ["coderay" "method_source" "slop"];
@@ -2378,10 +2387,10 @@
     dependencies = ["actionmailer" "actionpack" "actionview" "activejob" "activemodel" "activerecord" "activesupport" "railties" "sprockets-rails"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0dpbf3ybzbhqqkwg5vi60121860cr8fybvchrxk5wy3f2jcj0mch";
+      sha256 = "15vbdlkmlh470g7msqhmcmhxhi4finv3cjg595x9viafvphnf40l";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.10";
   };
   rails-deprecated_sanitizer = {
     dependencies = ["activesupport"];
@@ -2423,10 +2432,10 @@
     dependencies = ["actionpack" "activesupport" "rake" "thor"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bavl4hj7bnl3ryqi9rvykm410kflplgingkcxasfv1gdilddh4g";
+      sha256 = "0snymfqj2cql0gp51i6a44avcirdridc15yggnxjj9raa9f3229p";
       type = "gem";
     };
-    version = "4.2.8";
+    version = "4.2.10";
   };
   rainbow = {
     dependencies = ["rake"];
@@ -2448,10 +2457,10 @@
   rake = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0mfqgpp3m69s5v1rd51lfh5qpjwyia5p4rg337pw8c8wzm6pgfsw";
+      sha256 = "190p7cs8zdn07mjj6xwwsdna3g0r98zs4crz7jh2j2q5b0nbxgjf";
       type = "gem";
     };
-    version = "12.1.0";
+    version = "12.3.0";
   };
   rblineprof = {
     dependencies = ["debugger-ruby_core_source"];
@@ -2542,19 +2551,19 @@
     dependencies = ["actionpack" "redis-rack" "redis-store"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0gnkqi7cji2q5yfwm8b752k71pqrb3dqksv983yrf23virqnjfjr";
+      sha256 = "15k41gz7nygd4yydk2yd25gghya1j7q6zifk4mdrra6bwnwjbm63";
       type = "gem";
     };
-    version = "5.0.1";
+    version = "5.0.2";
   };
   redis-activesupport = {
     dependencies = ["activesupport" "redis-store"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0i0r23rv32k25jqwbr4cb73alyaxwvz9crdaw3gv26h1zjrdjisd";
+      sha256 = "0rq5dhrzc1l8c7f5gx9r7mvnsk5206dfwih3yv5si5rf42nx2ay5";
       type = "gem";
     };
-    version = "5.0.1";
+    version = "5.0.4";
   };
   redis-namespace = {
     dependencies = ["redis"];
@@ -2569,28 +2578,28 @@
     dependencies = ["rack" "redis-store"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fbxl5gv8krjf6n88gvn44xbzhfnsysnzawz7zili298ak98lsb3";
+      sha256 = "0px0wv8zripc6lrn3k0k61j6nlxda145q8sz50yvnig17wlk36gb";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "2.0.4";
   };
   redis-rails = {
     dependencies = ["redis-actionpack" "redis-activesupport" "redis-store"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04l2y26k4v30p3dx0pqf9gz257q73qzgrfqf3qv6bxwyv8z9f5hm";
+      sha256 = "0hjvkyaw5hgz7v6fgwdk8pb966z44h1gv8jarmb0gwhkqmjnsh40";
       type = "gem";
     };
-    version = "5.0.1";
+    version = "5.0.2";
   };
   redis-store = {
     dependencies = ["redis"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1da15wr3wc1d4hqy7h7smdc2k2jpfac3waa9d65si6f4dmqymkkq";
+      sha256 = "00yh8rhv91vxjlqs4ylic99m9npjxmgib2vjj8hgzk1174y6vcmq";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.4.1";
   };
   representable = {
     dependencies = ["declarative" "declarative-option" "uber"];
@@ -2954,6 +2963,15 @@
     };
     version = "3.5.9.3";
   };
+  selenium-webdriver = {
+    dependencies = ["childprocess" "rubyzip"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0w6r0k1w7hpk853qfw18lipyzxs0r0d6xr70zqsjfdn2dwr0rb30";
+      type = "gem";
+    };
+    version = "3.5.0";
+  };
   sentry-raven = {
     dependencies = ["faraday"];
     source = {
@@ -3141,10 +3159,10 @@
     dependencies = ["actionpack" "activesupport" "sprockets"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zr9vk2vn44wcn4265hhnnnsciwlmqzqc6bnx78if1xcssxj6x44";
+      sha256 = "0ab42pm8p5zxpv3sfraq45b9lj39cz9mrpdirm30vywzrwwkm5p1";
       type = "gem";
     };
-    version = "3.2.0";
+    version = "3.2.1";
   };
   sqlite3 = {
     source = {
@@ -3295,6 +3313,15 @@
     };
     version = "0.8.3";
   };
+  toml = {
+    dependencies = ["parslet"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1wnvi1g8id1sg6776fvzf98lhfbscchgiy1fp5pvd58a8ds2fq9v";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
   toml-rb = {
     dependencies = ["citrus"];
     source = {
@@ -3317,10 +3344,10 @@
     dependencies = ["thread_safe"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "05r81lk7q7275rdq7xipfm0yxgqyd2ggh73xpc98ypngcclqcscl";
+      sha256 = "09dpbrih054mn42flbbcdpzk2727mzfvjrgqb12zdafhx7p9rrzp";
       type = "gem";
     };
-    version = "1.2.3";
+    version = "1.2.4";
   };
   u2f = {
     source = {
@@ -3476,31 +3503,22 @@
     };
     version = "0.9.10";
   };
-  websocket-driver = {
-    dependencies = ["websocket-extensions"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1v39w1ig6ps8g55xhz6x1w53apl17ii6kpy0jg9249akgpdvb0k9";
-      type = "gem";
-    };
-    version = "0.6.3";
-  };
-  websocket-extensions = {
+  wikicloth = {
+    dependencies = ["builder" "expression_parser" "rinku"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "07qnsafl6203a2zclxl20hy4jq11c471cgvd0bj5r9fx1qqw06br";
+      sha256 = "1jp6c2yzyqbap8jdiw8yz6l08sradky1llhyhmrg934l1b5akj3s";
       type = "gem";
     };
-    version = "0.1.2";
+    version = "0.8.1";
   };
-  wikicloth = {
-    dependencies = ["builder" "expression_parser" "rinku"];
+  with_env = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jp6c2yzyqbap8jdiw8yz6l08sradky1llhyhmrg934l1b5akj3s";
+      sha256 = "1r5ns064mbb99hf1dyxsk9183hznc5i7mn3bi86zka6dlvqf9csh";
       type = "gem";
     };
-    version = "0.8.1";
+    version = "1.1.0";
   };
   xml-simple = {
     source = {
@@ -3519,4 +3537,4 @@
     };
     version = "2.1.0";
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/applications/version-management/gitlab/nulladapter.patch b/pkgs/applications/version-management/gitlab/nulladapter.patch
index 3b30ff03346b..a495ce63cc59 100644
--- a/pkgs/applications/version-management/gitlab/nulladapter.patch
+++ b/pkgs/applications/version-management/gitlab/nulladapter.patch
@@ -7,7 +7,7 @@ index 4861171ef5..f6e701c548 100644
  
 +gem 'activerecord-nulldb-adapter'
 +
- gem 'rails', '4.2.8'
+ gem 'rails', '4.2.10'
  gem 'rails-deprecated_sanitizer', '~> 1.0.3'
  
 diff --git a/Gemfile.lock b/Gemfile.lock
diff --git a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
index 39c7c28847c4..acc615c63ca5 100644
--- a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
@@ -62,24 +62,15 @@ diff --git a/lib/gitlab/logger.rb b/lib/gitlab/logger.rb
 index 59b21149a9..4f4a39a06c 100644
 --- a/lib/gitlab/logger.rb
 +++ b/lib/gitlab/logger.rb
-@@ -13,7 +13,7 @@
+@@ -26,7 +26,7 @@
      end
  
-     def self.read_latest
--      path = Rails.root.join("log", file_name)
-+      path = File.join(ENV["GITLAB_LOG_PATH"], file_name)
- 
-       return [] unless File.readable?(path)
- 
-@@ -22,7 +22,7 @@
+     def self.full_log_path
+-      Rails.root.join("log", file_name)
++      File.join(ENV["GITLAB_LOG_PATH"], file_name)
      end
  
-     def self.build
--      new(Rails.root.join("log", file_name))
-+      new(File.join(ENV["GITLAB_LOG_PATH"], file_name))
-     end
-   end
- end
+     def self.cache_key
 diff --git a/lib/gitlab/uploads_transfer.rb b/lib/gitlab/uploads_transfer.rb
 index b5f4124052..f72c556983 100644
 --- a/lib/gitlab/uploads_transfer.rb
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index e31f513c6666..64f4a759e1be 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -208,7 +208,7 @@ rec {
       -device virtio-rng-pci \
       -virtfs local,path=${storeDir},security_model=none,mount_tag=store \
       -virtfs local,path=$TMPDIR/xchg,security_model=none,mount_tag=xchg \
-      -drive file=$diskImage,if=virtio,cache=unsafe,werror=report \
+      ''${diskImage:+-drive file=$diskImage,if=virtio,cache=unsafe,werror=report} \
       -kernel ${kernel}/${img} \
       -initrd ${initrd}/initrd \
       -append "console=ttyS0 panic=1 command=${stage2Init} out=$out mountDisk=$mountDisk loglevel=4" \
@@ -223,8 +223,6 @@ rec {
     mkdir xchg
     mv saved-env xchg/
 
-    diskImage=''${diskImage:-/dev/null}
-
     eval "$preVM"
 
     if [ "$enableParallelBuilding" = 1 ]; then
@@ -240,7 +238,7 @@ rec {
     # the -K option to preserve the temporary build directory).
     cat > ./run-vm <<EOF
     #! ${bash}/bin/sh
-    diskImage=$diskImage
+    ''${diskImage:+diskImage=$diskImage}
     TMPDIR=$TMPDIR
     cd $TMPDIR
     ${qemuCommand}
diff --git a/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix b/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix
index 2812e7673b40..b185778fe860 100644
--- a/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix
+++ b/pkgs/desktops/gnome-3/apps/nautilus-sendto/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchurl, meson, ninja, glib, pkgconfig, gnome3, appstream-glib, gettext }:
+{ stdenv, fetchurl, meson, ninja, glib, pkgconfig, gnome3, appstream-glib
+, gettext, gobjectIntrospection
+}:
 
 stdenv.mkDerivation rec {
   name = "nautilus-sendto-${version}";
@@ -10,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "164d7c6e8bae29c4579bcc67a7bf50d783662b1545b62f3008e7ea3c0410e04d";
   };
 
-  nativeBuildInputs = [ meson ninja pkgconfig appstream-glib gettext ];
+  nativeBuildInputs = [ meson ninja pkgconfig appstream-glib gettext gobjectIntrospection ];
   buildInputs = [ glib ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
index 69a967d6d247..8d1ab65c04da 100644
--- a/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-screenshot/default.nix
@@ -1,6 +1,6 @@
 { stdenv, gettext, libxml2, fetchurl, pkgconfig, libcanberra_gtk3
 , bash, gtk3, glib, meson, ninja, wrapGAppsHook, appstream-glib
-, gnome3, librsvg, gdk_pixbuf }:
+, gnome3, librsvg, gdk_pixbuf, gobjectIntrospection }:
 
 stdenv.mkDerivation rec {
   inherit (import ./src.nix fetchurl) name src;
@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
   propagatedUserEnvPkgs = [ gnome3.gnome_themes_standard ];
   propagatedBuildInputs = [ gdk_pixbuf gnome3.defaultIconTheme librsvg ];
 
-  nativeBuildInputs = [ meson ninja pkgconfig gettext appstream-glib libxml2 wrapGAppsHook ];
+  nativeBuildInputs = [ meson ninja pkgconfig gettext appstream-glib libxml2
+                        wrapGAppsHook gobjectIntrospection ];
   buildInputs = [ bash gtk3 glib libcanberra_gtk3
                   gnome3.gsettings_desktop_schemas ];
 
diff --git a/pkgs/desktops/gnome-3/core/libcroco/default.nix b/pkgs/desktops/gnome-3/core/libcroco/default.nix
index 4141afeb821d..744ec3c2fe62 100644
--- a/pkgs/desktops/gnome-3/core/libcroco/default.nix
+++ b/pkgs/desktops/gnome-3/core/libcroco/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libxml2, glib }:
+{ stdenv, fetchurl, pkgconfig, libxml2, glib, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name = "libcroco-0.6.12";
@@ -8,6 +8,19 @@ stdenv.mkDerivation rec {
     sha256 = "0q7qhi7z64i26zabg9dbs5706fa8pmzp1qhpa052id4zdiabbi6x";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2017-7960.patch";
+      url = "https://git.gnome.org/browse/libcroco/patch/?id=898e3a8c8c0314d2e6b106809a8e3e93cf9d4394";
+      sha256 = "1xjwdqijxf4b7mhdp3kkgnb6c14y0bn3b3gg79kyrm82x696d94l";
+    })
+    (fetchpatch {
+      name = "CVE-2017-7961.patch";
+      url = "https://git.gnome.org/browse/libcroco/patch/?id=9ad72875e9f08e4c519ef63d44cdbd94aa9504f7";
+      sha256 = "0zakd72ynzjgzskwyvqglqiznsb93j1bkvc1lgyrzgv9rwrbwv9s";
+    })
+  ];
+
   outputs = [ "out" "dev" ];
   outputBin = "dev";
 
diff --git a/pkgs/development/arduino/arduino-core/default.nix b/pkgs/development/arduino/arduino-core/default.nix
index fdb9d1be6ad2..a427023df56e 100644
--- a/pkgs/development/arduino/arduino-core/default.nix
+++ b/pkgs/development/arduino/arduino-core/default.nix
@@ -20,8 +20,8 @@ let
   externalDownloads = import ./downloads.nix {inherit fetchurl; inherit (lib) optionalAttrs; inherit (stdenv) system;};
   # Some .so-files are later copied from .jar-s to $HOME, so patch them beforehand
   patchelfInJars =
-       lib.optional (stdenv.system == "x86_64-linux") {jar = "share/arduino/lib/jssc-2.8.0.jar"; file = "libs/linux/libjSSC-2.8_x86_64.so";}
-    ++ lib.optional (stdenv.system == "i686-linux") {jar = "share/arduino/lib/jssc-2.8.0.jar"; file = "libs/linux/libjSSC-2.8_x86.so";}
+       lib.optional (stdenv.system == "x86_64-linux") {jar = "share/arduino/lib/jssc-2.8.0-arduino1.jar"; file = "libs/linux/libjSSC-2.8_x86_64.so";}
+    ++ lib.optional (stdenv.system == "i686-linux") {jar = "share/arduino/lib/jssc-2.8.0-arduino1.jar"; file = "libs/linux/libjSSC-2.8_x86.so";}
   ;
   # abiVersion 6 is default, but we need 5 for `avrdude_bin` executable
   ncurses5 = ncurses.override { abiVersion = "5"; };
@@ -54,25 +54,25 @@ let
              + stdenv.lib.optionalString (!withGui) "-core";
 in
 stdenv.mkDerivation rec {
-  version = "1.8.2";
+  version = "1.8.5";
   name = "${flavor}-${version}";
 
   src = fetchFromGitHub {
     owner = "arduino";
     repo = "Arduino";
     rev = "${version}";
-    sha256 = "1ssznjmzmahayslj2xnci9b5wpsl53nyg85say54akng93qipmfb";
+    sha256 = "0ww72qfk7fyvprz15lc80i1axfdacb5fij4h5j5pakrg76mng2c3";
   };
 
   teensyduino_src = fetchurl {
-    url = "https://www.pjrc.com/teensy/td_136/TeensyduinoInstall.${teensy_architecture}";
+    url = "https://www.pjrc.com/teensy/td_140/TeensyduinoInstall.${teensy_architecture}";
     sha256 =
       lib.optionalString ("${teensy_architecture}" == "linux64")
-        "0qvb5z9y6nsqy0kzib9fvvbn8dakl50vib6r3nm6bnpvyxzwjl2r"
+        "0127a1ak31252dbmr5niqa5mkvbm8dnz1cfcnmydzx9qn9rk00ir"
       + lib.optionalString ("${teensy_architecture}" == "linux32")
-        "14ca62vq7cpx269vfd92shi80qj8spf0dzli8gfcb39ss2zc4jf1"
+        "01mxj5xsr7gka652c9rp4szy5mkcka8mljk044v4agk3sxvx3v3i"
       + lib.optionalString ("${teensy_architecture}" == "linuxarm")
-        "122z1gxcgkmwjb8wdklb2w8c3qkj5rc1ap5n4a8fi3kjz29va9rx";
+        "1dff3alhvk9x8qzy3n85qrg6rfmy6l9pj6fmrlzpli63lzykvv4i";
   };
 
   buildInputs = [ jdk ant libusb libusb1 unzip zlib ncurses5 readline
diff --git a/pkgs/development/arduino/arduino-core/downloads.nix b/pkgs/development/arduino/arduino-core/downloads.nix
index f74da9773724..e71c898dd555 100644
--- a/pkgs/development/arduino/arduino-core/downloads.nix
+++ b/pkgs/development/arduino/arduino-core/downloads.nix
@@ -1,5 +1,8 @@
 {fetchurl, optionalAttrs, system}:
-
+# This file preloads all the archives which Arduino's build/build.xml
+# would otherwise try to download itself. When updating this for a new
+# version of Arduino, check build.xml for version numbers and new
+# urls.
 {
   "build/shared/reference-1.6.6-3.zip" = fetchurl {
     url = "https://downloads.arduino.cc/reference-1.6.6-3.zip";
@@ -21,17 +24,17 @@
     url = "https://github.com/arduino-libraries/Bridge/archive/1.6.3.zip";
     sha256 = "1lha5wkzz63bgcn7bhx4rmgsh9ywa47lffycpyz6qjnl1pvm5mmj";
   };
-  "build/Robot_Control-1.0.3.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/Robot_Control/archive/1.0.3.zip";
-    sha256 = "1pc3b8skbpx7j32jnxa67mfqhnsmfz3876pc9mdyzpsad4mmcn62";
+  "build/Robot_Control-1.0.4.zip" = fetchurl {
+    url = "https://github.com/arduino-libraries/Robot_Control/archive/1.0.4.zip";
+    sha256 = "1pkabrghx3h8l60x571vwkbhfm02nhyn5x2vqz4vhx9cczr70zq7";
   };
-  "build/Robot_Motor-1.0.2.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/Robot_Motor/archive/1.0.2.zip";
-    sha256 = "0da21kfzy07kk2qnkprs3lj214fgkcjxlkk3hdp306jfv8ilmvy2";
+  "build/Robot_Motor-1.0.3.zip" = fetchurl {
+    url = "https://github.com/arduino-libraries/Robot_Motor/archive/1.0.3.zip";
+    sha256 = "1pkvrimg77jrhdsz4l81y59hv50h6cl7hvhk9w8ac7ckg70lvxkw";
   };
-  "build/RobotIRremote-1.0.2.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/RobotIRremote/archive/1.0.2.zip";
-    sha256 = "0wkya7dy4x0xyi7wn5aghmr1gj0d0wszd61pq18zgfdspz1gi6xn";
+  "build/RobotIRremote-2.0.0.zip" = fetchurl {
+    url = "https://github.com/arduino-libraries/RobotIRremote/archive/2.0.0.zip";
+    sha256 = "0j5smap74j8p3wc6k0h73b1skj4gkr7r25jbjh1j1cg052dxri86";
   };
   "build/SpacebrewYun-1.0.1.zip" = fetchurl {
     url = "https://github.com/arduino-libraries/SpacebrewYun/archive/1.0.1.zip";
@@ -61,9 +64,13 @@
     url = "https://github.com/arduino-libraries/Servo/archive/1.1.2.zip";
     sha256 = "14k1883qrx425wnm0r8kszzq32yvvs3jwxf3g7ybp7v0ga0q47l7";
   };
-  "build/Adafruit_CircuitPlayground-1.6.4.zip" = fetchurl {
-    url = "https://github.com/Adafruit/Adafruit_CircuitPlayground/archive/1.6.4.zip";
-    sha256 = "1ph7m0l1sfx9db56n2h6vi78pn3zyah813lfhqiqghncx34amrhj";
+  "build/LiquidCrystal-1.0.7.zip" = fetchurl {
+    url = "https://github.com/arduino-libraries/LiquidCrystal/archive/1.0.7.zip";
+    sha256 = "1wrxrqz3n4yrj9j1a2b7pdd7a1rlyi974ra7crv5amjng8817x9n";
+  };
+  "build/Adafruit_CircuitPlayground-1.6.8.zip" = fetchurl {
+    url = "https://github.com/Adafruit/Adafruit_CircuitPlayground/archive/1.6.8.zip";
+    sha256 = "0zm667xiaygx8v1ygcls43s6qd5n7pf21n0998n1z7nf18s35j41";
   };
   "build/libastylej-2.05.1-3.zip" = fetchurl {
     url = "https://downloads.arduino.cc/libastylej-2.05.1-3.zip";
@@ -73,9 +80,9 @@
     url = "https://downloads.arduino.cc/liblistSerials/liblistSerials-1.4.0.zip";
     sha256 = "129mfbyx7snq3znzhkfbdjiifdr85cwk6wjn8l9ia0wynszs5zyv";
   };
-  "build/shared/WiFi101-Updater-ArduinoIDE-Plugin-0.9.0.zip" = fetchurl {
-    url = "https://github.com/arduino-libraries/WiFi101-FirmwareUpdater-Plugin/releases/download/v0.9.0/WiFi101-Updater-ArduinoIDE-Plugin-0.9.0.zip";
-    sha256 = "1nkk87q2l3bs9y387hdxzgqllm0lqpmc5kdmr6my4hjz5lcpgbza";
+  "build/shared/WiFi101-Updater-ArduinoIDE-Plugin-0.9.1.zip" = fetchurl {
+    url = "https://github.com/arduino-libraries/WiFi101-FirmwareUpdater-Plugin/releases/download/v0.9.1/WiFi101-Updater-ArduinoIDE-Plugin-0.9.1.zip";
+    sha256 = "15przp8z1dp6lamcvqdx4daq6fqi3c1algc3sbinyh25pm69pq74";
   };
 }
 // optionalAttrs (system == "x86_64-linux") {
diff --git a/pkgs/development/haskell-modules/make-package-set.nix b/pkgs/development/haskell-modules/make-package-set.nix
index 6d11048cb6df..f85259e699bc 100644
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@@ -102,6 +102,7 @@ let
 
   withPackages = packages: buildPackages.callPackage ./with-packages-wrapper.nix {
     inherit (self) llvmPackages;
+    inherit ghc;
     inherit packages;
   };
 
diff --git a/pkgs/development/libraries/libfilezilla/default.nix b/pkgs/development/libraries/libfilezilla/default.nix
index 0df0f570b2e6..84e3517835e3 100644
--- a/pkgs/development/libraries/libfilezilla/default.nix
+++ b/pkgs/development/libraries/libfilezilla/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libfilezilla-${version}";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchurl {
     url = "http://download.filezilla-project.org/libfilezilla/${name}.tar.bz2";
-    sha256 = "1xv4is3zaz66h6iblj9pikapsjasjcbxx31bhkgn62xdq1sadfpc";
+    sha256 = "0wl42yxrha633dbh1vcbhrpsd7sv4zwskbmlpx549ygnzi39krcn";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/openslp/CVE-2016-4912.patch b/pkgs/development/libraries/openslp/CVE-2016-4912.patch
new file mode 100644
index 000000000000..06223deda89b
--- /dev/null
+++ b/pkgs/development/libraries/openslp/CVE-2016-4912.patch
@@ -0,0 +1,11 @@
+--- a/common/slp_xmalloc.c
++++ b/common/slp_xmalloc.c
+@@ -206,7 +206,7 @@ void * _xrealloc(const char * file, int line, void * ptr, size_t size)
+          if (newptr == 0)
+             return 0;
+          memcpy(newptr, ptr, x->size);
+-         _xfree(file, line, x);
++         _xfree(file, line, ptr);
+       }
+       return newptr;
+    }
diff --git a/pkgs/development/libraries/openslp/default.nix b/pkgs/development/libraries/openslp/default.nix
index 3ab3f68cde5e..3e178d92013e 100644
--- a/pkgs/development/libraries/openslp/default.nix
+++ b/pkgs/development/libraries/openslp/default.nix
@@ -19,6 +19,7 @@ stdenv.mkDerivation {
       url = "https://src.fedoraproject.org/cgit/rpms/openslp.git/plain/openslp-2.0.0-cve-2016-7567.patch";
       sha256 = "0zp61axx93b7nrbsyhn2x4dnw7n9y6g4rys21hyqxk4khrnc2yr9";
     })
+    ./CVE-2016-4912.patch
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 78792e5b8dc4..94c49af8c4f1 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchurl, buildPackages, perl
 , hostPlatform
+, fetchpatch
 , withCryptodev ? false, cryptodevHeaders
 , enableSSL2 ? false
 }:
@@ -114,6 +115,13 @@ in {
   openssl_1_1_0 = common {
     version = "1.1.0g";
     sha256 = "1bvka2wf33w2vxv7yw578nnjqyhz2b3chvfb0l4k2ffscw950kfy";
+    patches = [
+      (fetchpatch {
+        name = "CVE-2017-3738.patch";
+        url = "https://github.com/openssl/openssl/commit/563066.patch";
+        sha256 = "0ni9fwpxf8raw8b58pfa15akbqmxx4q64v0ldsm4b9dqhbxf8mkz";
+      })
+    ];
   };
 
 }
diff --git a/pkgs/development/ocaml-modules/otr/default.nix b/pkgs/development/ocaml-modules/otr/default.nix
index 189b3adf8739..ac853c94094b 100644
--- a/pkgs/development/ocaml-modules/otr/default.nix
+++ b/pkgs/development/ocaml-modules/otr/default.nix
@@ -1,22 +1,25 @@
-{ stdenv, buildOcaml, fetchFromGitHub, ocamlbuild, findlib, topkg, ocaml
-, ppx_tools, ppx_sexp_conv, cstruct, ppx_cstruct, sexplib, result, nocrypto, astring
+{ stdenv, fetchFromGitHub, ocaml, ocamlbuild, findlib, topkg
+, ppx_tools, ppx_sexp_conv, cstruct, ppx_cstruct, sexplib, rresult, nocrypto
+, astring
 }:
 
-buildOcaml rec {
-  name = "otr";
-  version = "0.3.3";
+if !stdenv.lib.versionAtLeast ocaml.version "4.03"
+then throw "otr is not available for OCaml ${ocaml.version}"
+else
 
-  minimumSupportedOcamlVersion = "4.02";
+stdenv.mkDerivation rec {
+  name = "ocaml${ocaml.version}-otr-${version}";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner  = "hannesm";
     repo   = "ocaml-otr";
     rev    = "${version}";
-    sha256 = "07zzix5mfsasqpqdx811m0x04gp8mq1ayf4b64998k98027v01rr";
+    sha256 = "0ixf0jvccmcbhk5mhzqakfzimvz200wkdkq3z2d0bdzyggslbdl4";
   };
 
-  buildInputs = [ ocamlbuild findlib topkg ppx_tools ppx_sexp_conv ppx_cstruct ];
-  propagatedBuildInputs = [ cstruct sexplib result nocrypto astring ];
+  buildInputs = [ ocaml ocamlbuild findlib topkg ppx_tools ppx_sexp_conv ppx_cstruct ];
+  propagatedBuildInputs = [ cstruct sexplib rresult nocrypto astring ];
 
   buildPhase = "${topkg.run} build --tests true";
 
@@ -26,6 +29,7 @@ buildOcaml rec {
   checkPhase = "${topkg.run} test";
 
   meta = with stdenv.lib; {
+    inherit (ocaml.meta) platforms;
     homepage = https://github.com/hannesm/ocaml-otr;
     description = "Off-the-record messaging protocol, purely in OCaml";
     license = licenses.bsd2;
diff --git a/pkgs/development/python-modules/ipython/5.nix b/pkgs/development/python-modules/ipython/5.nix
index b25039cc71e8..808853891e95 100644
--- a/pkgs/development/python-modules/ipython/5.nix
+++ b/pkgs/development/python-modules/ipython/5.nix
@@ -27,12 +27,12 @@
 
 buildPythonPackage rec {
   pname = "ipython";
-  version = "5.3.0";
+  version = "5.5.0";
   name = "${pname}-${version}";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "bf5e615e7d96dac5a61fbf98d9e2926d98aa55582681bea7e9382992a3f43c1d";
+    sha256 = "66469e894d1f09d14a1f23b971a410af131daa9ad2a19922082e02e0ddfd150f";
   };
 
   prePatch = stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/python-modules/ldaptor/default.nix b/pkgs/development/python-modules/ldaptor/default.nix
new file mode 100644
index 000000000000..4eab700ff140
--- /dev/null
+++ b/pkgs/development/python-modules/ldaptor/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, twisted
+, pycrypto
+, pyopenssl
+, pyparsing
+, zope_interface
+, isPy3k
+}:
+
+buildPythonPackage rec {
+  pname = "ldaptor";
+  version = "16.0.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "6b9ebe5814e9e7091703c4e3bfeae73b46508b4678e2ff403cddaedf8213815d";
+  };
+
+  propagatedBuildInputs = [
+    twisted pycrypto pyopenssl pyparsing zope_interface
+  ];
+
+  disabled = isPy3k;
+
+  # TypeError: None is neither bytes nor unicode
+  doCheck = false;
+
+  meta = {
+    description = "A Pure-Python Twisted library for LDAP";
+    homepage = https://github.com/twisted/ldaptor;
+    license = lib.licenses.mit;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index e1b11397b30f..1ae8a4ff4043 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -4,14 +4,14 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  version = "0.62.0";
+  version = "0.63.1";
   name = "flow-${version}";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     rev = "v${version}";
-    sha256 = "03la72wgsh7s063h2l171h74c84haqsinnnk8fwifq3id0gq6xk1";
+    sha256 = "1djcyf1c88xw5mv1gh4wggy16d2gi84ndj31n11y5qh99hh3lmfl";
   };
 
   installPhase = ''
diff --git a/pkgs/development/tools/analysis/snowman/default.nix b/pkgs/development/tools/analysis/snowman/default.nix
index 2caadfc62667..907e44420e95 100644
--- a/pkgs/development/tools/analysis/snowman/default.nix
+++ b/pkgs/development/tools/analysis/snowman/default.nix
@@ -6,13 +6,13 @@ assert qtbase != null -> qt4 == null;
 
 stdenv.mkDerivation rec {
   name = "snowman-${version}";
-  version = "2017-08-13";
+  version = "2017-11-19";
 
   src = fetchFromGitHub {
     owner = "yegord";
     repo = "snowman";
-    rev = "cd9edcddf873fc40d7bcb1bb1eae815faedd3a03";
-    sha256 = "10f3kd5m5xw7hqh92ba7dcczwbznxvk1qxg0yycqz7y9mfr2282n";
+    rev = "d03c2d6ffbf262c0011584df59d6bd69c020e08e";
+    sha256 = "0bzqp3zc100dzvybf57bj4dvnybvds0lmn1w2xjb19wkzm9liskn";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index 369f2f86bee6..cf4d5bcaa40c 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl, go-bindata }:
 
 let
-  version = "10.2.0";
+  version = "10.3.0";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/docker/prebuilt-x86_64.tar.xz";
-    sha256 = "191yzh9k6ivj7mdfi5mv7wgbdcclb5q99rcbry70h064vzwfgkp6";
+    sha256 = "0nhxxx2wxnli5nfz8vxqc0mwdjzj836zx3zmywnfyy1k2zybjijv";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/docker/prebuilt-arm.tar.xz";
-    sha256 = "1xvfsffwks5z74kxba6f4cilbabcsxhr0kskbxwczi90pn0rxsnn";
+    sha256 = "0jacimz4p9k5s9j510g3vn7gg8pybpa20j4cvz4pffrcwl1lgk4i";
   };
 in
 buildGoPackage rec {
@@ -29,7 +29,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "1psnajn4b3ym2fpvn6rizxqb093s78lvxcs3bysgrmf9q1ivf3a6";
+    sha256 = "0wjy5bbz6bw0na57vglcwzn17q980x6j24qkschqx49rjyk3fz2i";
   };
 
   patches = [ ./fix-shell-path.patch ];
diff --git a/pkgs/development/tools/haskell/vaultenv/default.nix b/pkgs/development/tools/haskell/vaultenv/default.nix
index 9bd818255c78..b607cc5604cd 100644
--- a/pkgs/development/tools/haskell/vaultenv/default.nix
+++ b/pkgs/development/tools/haskell/vaultenv/default.nix
@@ -1,17 +1,20 @@
-{ mkDerivation, fetchurl, async, base, bytestring, http-conduit, lens
-, lens-aeson, optparse-applicative, retry, stdenv, text, unix
+{ mkDerivation, fetchzip, async, base, bytestring, hpack, http-conduit
+, lens, lens-aeson, optparse-applicative, retry, stdenv, text, unix
 , unordered-containers, utf8-string
 }:
 
 mkDerivation rec {
   pname = "vaultenv";
-  version = "0.5.0";
+  version = "0.5.3";
 
-  src = fetchurl {
+  src = fetchzip {
     url = "https://github.com/channable/vaultenv/archive/v${version}.tar.gz";
-    sha256 = "0hdcxq88cf3ygnikkppyg3fcf7xmwm9zif7274j3n34p9vd8xci3";
+    sha256 = "1kxq2pp8l8xf7xwjyd9cwyi7z192013s6psq5fk8jrkkhrk8z3li";
   };
 
+  buildTools = [ hpack ];
+  preConfigure = "hpack .";
+
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
@@ -23,5 +26,4 @@ mkDerivation rec {
   description = "Runs processes with secrets from HashiCorp Vault";
   license = stdenv.lib.licenses.bsd3;
   maintainers = with stdenv.lib.maintainers; [ lnl7 ];
-  broken = true;  # https://hydra.nixos.org/build/66706385
 }
diff --git a/pkgs/development/tools/misc/lit/default.nix b/pkgs/development/tools/misc/lit/default.nix
index af792c0c6b96..05229e4be7b2 100644
--- a/pkgs/development/tools/misc/lit/default.nix
+++ b/pkgs/development/tools/misc/lit/default.nix
@@ -2,12 +2,12 @@
 
 python2.pkgs.buildPythonApplication rec {
   pname = "lit";
-  version = "0.5.0";
+  version = "0.5.1";
   name = "${pname}-${version}";
 
   src = python2.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "3ea4251e78ebeb2e07be2feb33243d1f8931d956efc96ccc2b0846ced212b58c";
+    sha256 = "0z651m3vkbk85y41larnsjxrszkbi58x9gzml3lb6ga7qwcrsg97";
   };
 
   # Non-standard test suite. Needs custom checkPhase.
diff --git a/pkgs/development/tools/remarshal/default.nix b/pkgs/development/tools/remarshal/default.nix
index ac4a39f06920..baba4fd75ea9 100644
--- a/pkgs/development/tools/remarshal/default.nix
+++ b/pkgs/development/tools/remarshal/default.nix
@@ -2,13 +2,13 @@
 
 pythonPackages.buildPythonApplication rec {
   name = "remarshal-${version}";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner  = "dbohdan";
     repo   = "remarshal";
     rev    = "v${version}";
-    sha256 = "0jslawpzghv3chamrfddnyn5p5068kjxy8d38fxvi5h06qgfb4wp";
+    sha256 = "1wsgvzfp40lvly7nyyhv9prip4vi32rfc8kdji587jpw28zc1dfb";
   };
 
   propagatedBuildInputs = with pythonPackages; [
diff --git a/pkgs/development/tools/remarshal/deps.nix b/pkgs/development/tools/remarshal/deps.nix
deleted file mode 100644
index 32f9f6eb0bb5..000000000000
--- a/pkgs/development/tools/remarshal/deps.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-[
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "a83829b6f1293c91addabc89d0571c246397bbf4";
-      sha256 = "1m4dsmk90sbi17571h6pld44zxz7jc4lrnl4f27dpd1l8g5xvjhh";
-    };
-  }
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "056c9bc7be7190eaa7715723883caffa5f8fa3e4";
-      sha256 = "0gkgkw04ndr5y7hrdy0r4v2drs5srwfcw2bs1gyas066hwl84xyw";
-    };
-  }
-]
diff --git a/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix b/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
index f262dfe34b79..32c684668d6b 100644
--- a/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
@@ -1,7 +1,5 @@
 { stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ncurses, ... } @ args:
 
-assert stdenv.is64bit;
-
 import ./generic.nix (args // rec {
   version = "4.12.2";
   extraMeta.branch = "4.12-2";
@@ -14,5 +12,5 @@ import ./generic.nix (args // rec {
       sha256 = "1dr74i79p8r13522w2ppi8gnjd9bhngc9d2hsn91ji6f5a8fbxx9";
     }; in "${upstream}/build/linux";
 
-  extraMeta.hydraPlatforms = [];
+  extraMeta.platforms = [ "x86_64-linux" ];
 } // (args.argsOverride or {}))
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 99045570a718..e499dc5de04b 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -10,27 +10,29 @@ let
     };
   };
   matrix-synapse-ldap3 = pythonPackages.buildPythonPackage rec {
-    name = "matrix-synapse-ldap3-${version}";
-    version = "0.1.2";
+    pname = "matrix-synapse-ldap3";
+    version = "0.1.3";
 
     src = fetchFromGitHub {
       owner = "matrix-org";
       repo = "matrix-synapse-ldap3";
       rev = "v${version}";
-      sha256 = "16pivz1lhs1c3z84rxxy8khyvn0hqxwxaz552br1y9ri0maa0aq8";
+      sha256 = "0ss7ld3bpmqm8wcs64q1kb7vxlpmwk9lsgq0mh21a9izyfc7jb2l";
     };
 
     propagatedBuildInputs = with pythonPackages; [ service-identity ldap3 twisted ];
+
+    checkInputs = with pythonPackages; [ ldaptor mock ];
   };
 in pythonPackages.buildPythonApplication rec {
   name = "matrix-synapse-${version}";
-  version = "0.25.1";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse";
     rev = "v${version}";
-    sha256 = "110558l147n1dqpylzrdzp8spj36nack88c5kknsxn69gr8yb7j2";
+    sha256 = "1ggdnb4c8y835j9lxsglxry6fqy7d190s70rccjrc3rj0p5vwlyj";
   };
 
   patches = [ ./matrix-synapse.patch ];
diff --git a/pkgs/tools/audio/abcmidi/default.nix b/pkgs/tools/audio/abcmidi/default.nix
index 8113b67db88b..55f0f2e92bd1 100644
--- a/pkgs/tools/audio/abcmidi/default.nix
+++ b/pkgs/tools/audio/abcmidi/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "abcMIDI-${version}";
-  version = "2017.12.20";
+  version = "2018.01.02";
 
   # You can find new releases on http://ifdo.ca/~seymour/runabc/top.html
   src = fetchzip {
     url = "http://ifdo.ca/~seymour/runabc/${name}.zip";
-    sha256 = "0lkbwrh701djbyqmybvx860p8csy25i6p3p7hr0cpndpa496nm07";
+    sha256 = "0s8wm637dgzgpgdxba3a6fh06i0c4iwvv9cdghh8msnx428k68iw";
   };
 
   # There is also a file called "makefile" which seems to be preferred by the standard build phase
diff --git a/pkgs/tools/backup/bup/default.nix b/pkgs/tools/backup/bup/default.nix
index d7c14a91efb4..f24e89fcc840 100644
--- a/pkgs/tools/backup/bup/default.nix
+++ b/pkgs/tools/backup/bup/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, fetchurl, makeWrapper
+{ stdenv, fetchFromGitHub, makeWrapper
 , perl, pandoc, python2Packages, git
 , par2cmdline ? null, par2Support ? true
 }:
@@ -19,7 +19,12 @@ stdenv.mkDerivation rec {
     sha256 = "0wdr399jf64zzzsdvldhrwvnh5xpbghjvslr1j2cwr5y4i36znxf";
   };
 
-  buildInputs = [ git python2Packages.python ];
+  buildInputs = [
+    git
+    (python2Packages.python.withPackages
+      (p: with p; [ setuptools tornado ]
+        ++ stdenv.lib.optionals (!stdenv.isDarwin) [ pyxattr pylibacl fuse ]))
+  ];
   nativeBuildInputs = [ pandoc perl makeWrapper ];
 
   postPatch = ''
@@ -41,11 +46,7 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     wrapProgram $out/bin/bup \
-      --prefix PATH : ${git}/bin \
-      --prefix PYTHONPATH : ${concatStringsSep ":" (map (x: "$(toPythonPath ${x})")
-        (with python2Packages;
-         [ setuptools tornado ]
-         ++ stdenv.lib.optionals (!stdenv.isDarwin) [ pyxattr pylibacl fuse ]))}
+      --prefix PATH : ${git}/bin
   '';
 
   meta = {
diff --git a/pkgs/tools/filesystems/tmsu/default.nix b/pkgs/tools/filesystems/tmsu/default.nix
index 03d5bd145ac4..89e5c0f35f05 100644
--- a/pkgs/tools/filesystems/tmsu/default.nix
+++ b/pkgs/tools/filesystems/tmsu/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "tmsu-${version}";
-  version = "0.6.1";
+  version = "0.7.0";
 
   go-sqlite3 = fetchgit {
     url = "git://github.com/mattn/go-sqlite3";
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "oniony";
     repo = "tmsu";
     rev = "v${version}";
-    sha256 = "08mz08pw59zaljp7dcndklnfdbn36ld27capivq3ifbq96nnqdf3";
+    sha256 = "0vccxb8mlr7wf92xawnqpvzwlw2xs3b962hjn09dnd6yxqscql64";
   };
 
   buildInputs = [ go fuse ];
diff --git a/pkgs/tools/graphics/svgcleaner/default.nix b/pkgs/tools/graphics/svgcleaner/default.nix
index 7beb3767b26b..266221de1735 100644
--- a/pkgs/tools/graphics/svgcleaner/default.nix
+++ b/pkgs/tools/graphics/svgcleaner/default.nix
@@ -1,19 +1,17 @@
 { stdenv, fetchFromGitHub, rustPlatform }:
 
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   name = "svgcleaner-${version}";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "RazrFalcon";
     repo = "svgcleaner";
     rev = "v${version}";
-    sha256 = "0l75a2kqh2syl14pmywrkxhr19fcnfpzjj9gj3503aw0r800g16m";
+    sha256 = "1jpnqsln37kkxz98vj7gly3c2170v6zamd876nc9nfl9vns41s0f";
   };
 
-  cargoSha256 = "1hl04wqdgspajf2w664i00vgp13yi0sxvjjpfs5vfhm641z3j69y";
+  cargoSha256 = "0d5jlq301s55xgdg9mv26hbj75pkjkyxfny7vbiqp9igj128lza3";
 
   meta = with stdenv.lib; {
     description = "A tool for tidying and optimizing SVGs";
diff --git a/pkgs/tools/misc/fpp/default.nix b/pkgs/tools/misc/fpp/default.nix
index 2f43dd40f13e..6271eb599b58 100644
--- a/pkgs/tools/misc/fpp/default.nix
+++ b/pkgs/tools/misc/fpp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "fpp-${version}";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "PathPicker";
     rev = version;
-    sha256 = "1mfyr9k5s3l1sg3c9vlyiqg8n1wwppzb981az2xaxqyk95wwl1sa";
+    sha256 = "03n8sc2fvs2vk46jv6qfkjbyqz85yxnphvabji7qnmd3jv631w47";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/ttwatch/default.nix b/pkgs/tools/misc/ttwatch/default.nix
index 3ea58546acec..b816b5225ca4 100644
--- a/pkgs/tools/misc/ttwatch/default.nix
+++ b/pkgs/tools/misc/ttwatch/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "ttwatch-${version}";
-  version = "2017-10-31";
+  version = "2017-12-31";
 
   src = fetchFromGitHub {
     owner = "ryanbinns";
     repo = "ttwatch";
-    rev = "f4103bdeb612a216ac21747941b3df943d67c48c";
-    sha256 = "0fylycdi0g119d21l11yz23cjjhr3qdxjv02vz86zkc15kyvgsas";
+    rev = "a261851d91e3304a47a04995758f6940747bc54a";
+    sha256 = "0llcai1yxikh8nvzry71rr1zz365rg0k0lwp24np5w74kzza3kwx";
   };
 
   nativeBuildInputs = [ cmake perl ];
diff --git a/pkgs/tools/security/browserpass/default.nix b/pkgs/tools/security/browserpass/default.nix
index 7230d30c7955..edebd95303a9 100644
--- a/pkgs/tools/security/browserpass/default.nix
+++ b/pkgs/tools/security/browserpass/default.nix
@@ -3,7 +3,7 @@
 
 buildGoPackage rec {
   name = "browserpass-${version}";
-  version = "2.0.7";
+  version = "2.0.10";
 
   goPackagePath = "github.com/dannyvankooten/browserpass";
 
@@ -13,7 +13,7 @@ buildGoPackage rec {
     repo = "browserpass";
     owner = "dannyvankooten";
     rev = version;
-    sha256 = "1dbp5za5qh6xmgh3w2cx5fbw13mh1szgj2y7ilmq0jh2ik09fbnd";
+    sha256 = "0clkalw2wz2zs0p5hsq57iqp2bdp7y17zf5l2d0y7xfddff9sd82";
   };
 
   postInstall = ''
diff --git a/pkgs/tools/security/browserpass/deps.nix b/pkgs/tools/security/browserpass/deps.nix
index 4a86966a9fc0..763317aafc7b 100644
--- a/pkgs/tools/security/browserpass/deps.nix
+++ b/pkgs/tools/security/browserpass/deps.nix
@@ -14,8 +14,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/mattn/go-zglob";
-      rev = "4b74c24375b3b1ee226867156e01996f4e19a8d6";
-      sha256 = "1qc502an4q3wgvrd9zw6zprgm28d90d2f98bdamdf4js03jj22xn";
+      rev = "4959821b481786922ac53e7ef25c61ae19fb7c36";
+      sha256 = "0rwkdw143kphpmingsrw1zp030zf3p08f64h347jpdm4lz8z5449";
     };
   }
   {
diff --git a/pkgs/tools/text/miller/default.nix b/pkgs/tools/text/miller/default.nix
index 7e0d2b4a14c2..a17c348c4cc1 100644
--- a/pkgs/tools/text/miller/default.nix
+++ b/pkgs/tools/text/miller/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   name = "miller-${version}";
 
-  version = "5.2.2";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = "johnkerl";
     repo = "miller";
-    rev = "v${version}";
-    sha256 = "1i5lyknsf4vif601l070xh5sz8jy2h359jrb0kc0s0pl8lypxs4i";
+    rev = "${version}";
+    sha256 = "0abw2n6mi4wbgwihcv3y2xccqx4sj0gdgwvdrg2jkcgraa78sw8v";
   };
 
   nativeBuildInputs = [ autoreconfHook flex libtool ];
diff --git a/pkgs/tools/typesetting/pdftk/default.nix b/pkgs/tools/typesetting/pdftk/default.nix
index 11baa176b88d..71cc1738837c 100644
--- a/pkgs/tools/typesetting/pdftk/default.nix
+++ b/pkgs/tools/typesetting/pdftk/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "1hdq6zm2dx2f9h7bjrp6a1hfa1ywgkwydp14i2sszjiszljnm3qi";
   };
 
-  buildInputs = [ gcj unzip ];
+  nativeBuildInputs = [ gcj unzip ];
 
   hardeningDisable = [ "fortify" "format" ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b2a6958fca47..3008f2975eaf 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16688,7 +16688,9 @@ with pkgs;
 
   renoise = callPackage ../applications/audio/renoise {};
 
-  radiotray-ng = callPackage ../applications/audio/radiotray-ng { };
+  radiotray-ng = callPackage ../applications/audio/radiotray-ng {
+    wxGTK = wxGTK30;
+  };
 
   rapcad = libsForQt56.callPackage ../applications/graphics/rapcad { boost = boost159; };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ef528812d9ee..6ff4a30b24fc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9765,6 +9765,8 @@ in {
 
   };
 
+  ldaptor = callPackage ../development/python-modules/ldaptor { };
+
   le = buildPythonPackage rec {
     name = "le-${version}";
     version = "1.4.29";