summary refs log tree commit diff
path: root/pkgs/development/libraries
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/development/libraries')
-rw-r--r--pkgs/development/libraries/accounts-qt/default.nix3
-rw-r--r--pkgs/development/libraries/ffmpeg-full/default.nix4
-rw-r--r--pkgs/development/libraries/ffmpeg/3.3.nix4
-rw-r--r--pkgs/development/libraries/freetype/cve-2017-8105.patch27
-rw-r--r--pkgs/development/libraries/freetype/cve-2017-8287.patch22
-rw-r--r--pkgs/development/libraries/freetype/default.nix3
-rw-r--r--pkgs/development/libraries/gnutls/3.5.nix4
-rw-r--r--pkgs/development/libraries/half/default.nix25
-rw-r--r--pkgs/development/libraries/irrlicht/default.nix2
-rw-r--r--pkgs/development/libraries/libao/default.nix3
-rw-r--r--pkgs/development/libraries/libcommuni/default.nix3
-rw-r--r--pkgs/development/libraries/libdrm/default.nix10
-rw-r--r--pkgs/development/libraries/libdwg/default.nix3
-rw-r--r--pkgs/development/libraries/libfilezilla/default.nix4
-rw-r--r--pkgs/development/libraries/libftdi/default.nix3
-rw-r--r--pkgs/development/libraries/libhdhomerun/default.nix34
-rw-r--r--pkgs/development/libraries/libinput/default.nix4
-rw-r--r--pkgs/development/libraries/libmnl/default.nix2
-rw-r--r--pkgs/development/libraries/libnetfilter_log/default.nix29
-rw-r--r--pkgs/development/libraries/libopus/default.nix11
-rw-r--r--pkgs/development/libraries/libproxy/default.nix4
-rw-r--r--pkgs/development/libraries/libressl/2.5.nix2
-rw-r--r--pkgs/development/libraries/libtasn1/default.nix8
-rw-r--r--pkgs/development/libraries/libtiff/default.nix6
-rw-r--r--pkgs/development/libraries/libuv/default.nix6
-rw-r--r--pkgs/development/libraries/libvirt/default.nix8
-rw-r--r--pkgs/development/libraries/lmdb/default.nix4
-rw-r--r--pkgs/development/libraries/mesa/default.nix13
-rw-r--r--pkgs/development/libraries/mesa/symlink-drivers.patch19
-rw-r--r--pkgs/development/libraries/ncurses/default.nix3
-rw-r--r--pkgs/development/libraries/openssl/default.nix4
-rw-r--r--pkgs/development/libraries/physics/cernlib/default.nix63
-rw-r--r--pkgs/development/libraries/physics/cernlib/patch186
-rw-r--r--pkgs/development/libraries/physics/cernlib/setup-hook.sh3
-rw-r--r--pkgs/development/libraries/polkit/default.nix29
-rw-r--r--pkgs/development/libraries/poppler/default.nix2
-rw-r--r--pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix4
-rw-r--r--pkgs/development/libraries/sqlite/sqlite3_analyzer.nix6
-rw-r--r--pkgs/development/libraries/webkitgtk/2.16.nix (renamed from pkgs/development/libraries/webkitgtk/2.14.nix)12
-rw-r--r--pkgs/development/libraries/webkitgtk/PR-152650-2.patch2
-rw-r--r--pkgs/development/libraries/webkitgtk/adding-libintl.patch10
42 files changed, 511 insertions, 87 deletions
diff --git a/pkgs/development/libraries/accounts-qt/default.nix b/pkgs/development/libraries/accounts-qt/default.nix
index 4f74c5fca355..a6d9a9381f9f 100644
--- a/pkgs/development/libraries/accounts-qt/default.nix
+++ b/pkgs/development/libraries/accounts-qt/default.nix
@@ -18,6 +18,9 @@ stdenv.mkDerivation rec {
     qmakeFlags="$qmakeFlags LIBDIR=$out/lib CMAKE_CONFIG_PATH=$out/lib/cmake"
   '';
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = with stdenv.lib; {
     description = "Qt library for accessing the online accounts database";
     homepage = "http://code.google.com/p/accounts-sso/";
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
index bdd3b5cea501..848cae09ed47 100644
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -230,11 +230,11 @@ assert nvenc -> nvidia-video-sdk != null && nonfreeLicensing;
 
 stdenv.mkDerivation rec {
   name = "ffmpeg-full-${version}";
-  version = "3.3";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "https://www.ffmpeg.org/releases/ffmpeg-${version}.tar.xz";
-    sha256 = "17anx7rnbi63if1ndr61836lf76dpn47n0y424hc48bj05y7z7jr";
+    sha256 = "0bwgm6z6k3khb91qh9xv15inykkfchpkm0lcdckkxhkacpyaf0mp";
   };
 
   patchPhase = ''patchShebangs .
diff --git a/pkgs/development/libraries/ffmpeg/3.3.nix b/pkgs/development/libraries/ffmpeg/3.3.nix
index 03bb9d44dda9..d6380b795af8 100644
--- a/pkgs/development/libraries/ffmpeg/3.3.nix
+++ b/pkgs/development/libraries/ffmpeg/3.3.nix
@@ -6,7 +6,7 @@
 
 callPackage ./generic.nix (args // rec {
   version = "${branch}";
-  branch = "3.3";
-  sha256 = "1p3brx0qa3i3569zlmcmpbxf17q73nrmbx2vp39s8h77r53qdq11";
+  branch = "3.3.1";
+  sha256 = "0c37bdqwmaziikr2d5pqp7504ail6i7a1mfcmc06mdpwfxxwvcpw";
   darwinFrameworks = [ Cocoa CoreMedia ];
 })
diff --git a/pkgs/development/libraries/freetype/cve-2017-8105.patch b/pkgs/development/libraries/freetype/cve-2017-8105.patch
new file mode 100644
index 000000000000..dc4327a52a88
--- /dev/null
+++ b/pkgs/development/libraries/freetype/cve-2017-8105.patch
@@ -0,0 +1,27 @@
+http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48ee43
+
+diff --git a/src/psaux/t1decode.c b/src/psaux/t1decode.c
+index af7b465..7dd4513 100644
+--- a/src/psaux/t1decode.c
++++ b/src/psaux/t1decode.c
+@@ -780,10 +780,19 @@
+             /* point without adding any point to the outline    */
+             idx = decoder->num_flex_vectors++;
+             if ( idx > 0 && idx < 7 )
++            {
++              /* in malformed fonts it is possible to have other */
++              /* opcodes in the middle of a flex (which don't    */
++              /* increase `num_flex_vectors'); we thus have to   */
++              /* check whether we can add a point                */
++              if ( FT_SET_ERROR( t1_builder_check_points( builder, 1 ) ) )
++                goto Syntax_Error;
++
+               t1_builder_add_point( builder,
+                                     x,
+                                     y,
+                                     (FT_Byte)( idx == 3 || idx == 6 ) );
++            }
+           }
+           break;
+ 
+
diff --git a/pkgs/development/libraries/freetype/cve-2017-8287.patch b/pkgs/development/libraries/freetype/cve-2017-8287.patch
new file mode 100644
index 000000000000..7ccf4f3278b7
--- /dev/null
+++ b/pkgs/development/libraries/freetype/cve-2017-8287.patch
@@ -0,0 +1,22 @@
+http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3774fc08b
+
+diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c
+index d18e821..0baf836 100644
+--- a/src/psaux/psobjs.c
++++ b/src/psaux/psobjs.c
+@@ -1718,6 +1718,14 @@
+     first = outline->n_contours <= 1
+             ? 0 : outline->contours[outline->n_contours - 2] + 1;
+ 
++    /* in malformed fonts it can happen that a contour was started */
++    /* but no points were added                                    */
++    if ( outline->n_contours && first == outline->n_points )
++    {
++      outline->n_contours--;
++      return;
++    }
++
+     /* We must not include the last point in the path if it */
+     /* is located on the first point.                       */
+     if ( outline->n_points > 1 )
+
diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index 287a07424407..9b2c6fe11e15 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -48,6 +48,9 @@ in stdenv.mkDerivation {
       ./pcf-config-long-family-names.patch
       ./disable-pcf-long-family-names.patch
       ./enable-table-validation.patch
+      # remove the two CVE patches after updating to >= 2.8
+      ./cve-2017-8105.patch
+      ./cve-2017-8287.patch
     ] ++
     optional useEncumberedCode ./enable-subpixel-rendering.patch;
 
diff --git a/pkgs/development/libraries/gnutls/3.5.nix b/pkgs/development/libraries/gnutls/3.5.nix
index 77ecd4957f75..8071cd4b46be 100644
--- a/pkgs/development/libraries/gnutls/3.5.nix
+++ b/pkgs/development/libraries/gnutls/3.5.nix
@@ -1,11 +1,11 @@
 { callPackage, fetchurl, libunistring, ... } @ args:
 
 callPackage ./generic.nix (args // rec {
-  version = "3.5.11";
+  version = "3.5.12";
 
   src = fetchurl {
     url = "ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-${version}.tar.xz";
-    sha256 = "13z2dxxyrsb7gfpl1k2kafqh2zaigi872y5xgykhs9cyaz2mqxji";
+    sha256 = "1jspvrmydqgz30c1ji94b55gr2dynz7p96p4y8fkhad0xajkkjv3";
   };
 
   # Skip two tests introduced in 3.5.11.  Probable reasons of failure:
diff --git a/pkgs/development/libraries/half/default.nix b/pkgs/development/libraries/half/default.nix
new file mode 100644
index 000000000000..d235c6cb0869
--- /dev/null
+++ b/pkgs/development/libraries/half/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchzip }:
+
+stdenv.mkDerivation rec {
+  version = "1.12.0";
+  name = "half-${version}";
+
+  src = fetchzip {
+    url = "mirror://sourceforge/half/${version}/half-${version}.zip";
+    sha256 = "0096xiw8nj86vxnn3lfcl94vk9qbi5i8lnydri9ws358ly6002vc";
+    stripRoot = false;
+  };
+
+  buildCommand = ''
+    mkdir -p $out/include $out/share/doc
+    cp $src/include/half.hpp               $out/include/
+    cp $src/{ChangeLog,LICENSE,README}.txt $out/share/doc/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "C++ library for half precision floating point arithmetics";
+    platforms = platforms.all;
+    license = licenses.mit;
+    maintainers = [ maintainers.volth ];
+  };
+}
diff --git a/pkgs/development/libraries/irrlicht/default.nix b/pkgs/development/libraries/irrlicht/default.nix
index 71bb871a45d7..bc3e1a20abba 100644
--- a/pkgs/development/libraries/irrlicht/default.nix
+++ b/pkgs/development/libraries/irrlicht/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildPhase = ''
-    make sharedlib NDEBUG=1
+    make sharedlib NDEBUG=1 "LDFLAGS=-lX11 -lGL -lXxf86vm"
   '';
 
   preInstall = ''
diff --git a/pkgs/development/libraries/libao/default.nix b/pkgs/development/libraries/libao/default.nix
index f7261e117389..d3cb1283331b 100644
--- a/pkgs/development/libraries/libao/default.nix
+++ b/pkgs/development/libraries/libao/default.nix
@@ -14,7 +14,8 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ pkgconfig ] ++
-    lib.optional stdenv.isLinux (if usePulseAudio then libpulseaudio else alsaLib) ++
+    lib.optional usePulseAudio libpulseaudio ++
+    lib.optional stdenv.isLinux alsaLib ++
     lib.optional stdenv.isLinux libcap ++
     lib.optionals stdenv.isDarwin [ CoreAudio CoreServices AudioUnit ];
 
diff --git a/pkgs/development/libraries/libcommuni/default.nix b/pkgs/development/libraries/libcommuni/default.nix
index 8e911a9b015f..3632fff43bde 100644
--- a/pkgs/development/libraries/libcommuni/default.nix
+++ b/pkgs/development/libraries/libcommuni/default.nix
@@ -25,6 +25,9 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = with stdenv.lib; {
     description = "A cross-platform IRC framework written with Qt";
     homepage = https://communi.github.io;
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index de219bee382f..a8cf28648079 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -1,17 +1,17 @@
-{ stdenv, fetchurl, pkgconfig, libpthreadstubs, libpciaccess, valgrind }:
+{ stdenv, fetchurl, pkgconfig, libpthreadstubs, libpciaccess, valgrind-light }:
 
 stdenv.mkDerivation rec {
-  name = "libdrm-2.4.79";
+  name = "libdrm-2.4.81";
 
   src = fetchurl {
     url = "http://dri.freedesktop.org/libdrm/${name}.tar.bz2";
-    sha256 = "c6aaf319293bce38023e9a637471b0f45c93c807d2a279060d741fc7a2e5b197";
+    sha256 = "8cc05c195ac8708199979a94c4e4d1a928c14ec338ecbcb38ead09f54dae11ae";
   };
 
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libpthreadstubs libpciaccess ];
+  buildInputs = [ libpthreadstubs libpciaccess valgrind-light ];
     # libdrm as of 2.4.70 does not actually do anything with udev.
 
   patches = stdenv.lib.optional stdenv.isDarwin ./libdrm-apple.patch;
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   preConfigure = stdenv.lib.optionalString stdenv.isDarwin
     "echo : \\\${ac_cv_func_clock_gettime=\'yes\'} > config.cache";
 
-  configureFlags = [ "--disable-valgrind" ]
+  configureFlags = [ ]
     ++ stdenv.lib.optionals (stdenv.isArm || stdenv.isAarch64) [ "--enable-tegra-experimental-api" "--enable-etnaviv-experimental-api" ]
     ++ stdenv.lib.optional stdenv.isDarwin "-C";
 
diff --git a/pkgs/development/libraries/libdwg/default.nix b/pkgs/development/libraries/libdwg/default.nix
index 2a2dfbb0be53..5ee92b463857 100644
--- a/pkgs/development/libraries/libdwg/default.nix
+++ b/pkgs/development/libraries/libdwg/default.nix
@@ -12,6 +12,9 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = {
     description = "Library reading dwg files";
     homepage = http://libdwg.sourceforge.net/en/;
diff --git a/pkgs/development/libraries/libfilezilla/default.nix b/pkgs/development/libraries/libfilezilla/default.nix
index d6c0c538a8fe..b0f1046aa594 100644
--- a/pkgs/development/libraries/libfilezilla/default.nix
+++ b/pkgs/development/libraries/libfilezilla/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libfilezilla-${version}";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchurl {
     url = "http://download.filezilla-project.org/libfilezilla/${name}.tar.bz2";
-    sha256 = "06ivj40bk5b76a36zwhnwqvg564hgccncnn5nb5cqc7kf4bkkchq";
+    sha256 = "1qrvddjqz5jv6920gcfqsrsjksi2845hn96g0z3vpcsm6nifhqn1";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libftdi/default.nix b/pkgs/development/libraries/libftdi/default.nix
index 36f4a04c9df6..f0d05c0b263f 100644
--- a/pkgs/development/libraries/libftdi/default.nix
+++ b/pkgs/development/libraries/libftdi/default.nix
@@ -12,6 +12,9 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ libusb ];
 
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" '';
+
   meta = {
     description = "A library to talk to FTDI chips using libusb";
     homepage = http://www.intra2net.com/en/developer/libftdi/;
diff --git a/pkgs/development/libraries/libhdhomerun/default.nix b/pkgs/development/libraries/libhdhomerun/default.nix
new file mode 100644
index 000000000000..08563ed53dd5
--- /dev/null
+++ b/pkgs/development/libraries/libhdhomerun/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchgit }:
+
+stdenv.mkDerivation {
+  name = "libhdhomerun-1efbcb";
+
+  src = fetchgit {
+    url = "git://github.com/Silicondust/libhdhomerun.git";
+    rev = "1efbcb2b87b17a82f2b3d873d1c9cc1c6a3a9b77";
+    sha256 = "11iyrfs98xb50n9iqnwfphmmnn5w3mq2l9cjjpf8qp29cvs33cgy";
+  };
+
+  patchPhase = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace Makefile --replace "gcc" "cc"
+    substituteInPlace Makefile --replace "-arch i386" ""
+  '';
+
+  installPhase = let
+    libSuff = if stdenv.isDarwin then "dylib" else "so";
+  in ''
+    mkdir -p $out/{bin,lib,include/hdhomerun}
+    install -Dm444 libhdhomerun.${libSuff} $out/lib
+    install -Dm555 hdhomerun_config $out/bin
+    cp *.h $out/include/hdhomerun
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Implements the libhdhomerun protocol for use with Silicondust HDHomeRun TV tuners";
+    homepage = "https://github.com/Silicondust/libhdhomerun";
+    repositories.git = "https://github.com/Silicondust/libhdhomerun.git";
+    license = stdenv.lib.licenses.lgpl2;
+    platforms = stdenv.lib.platforms.unix;
+    maintainers = [ maintainers.titanous ];
+  };
+}
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index f0257ed8a44b..17950b383bb1 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -17,11 +17,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "libinput-${version}";
-  version = "1.5.1";
+  version = "1.7.2";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/libinput/${name}.tar.xz";
-    sha256 = "d4f63933b0967bd691735af5e3919e2d29c2121d4e05867cc4e10ff3ae8e2dd8";
+    sha256 = "0b1e5a6c106ccc609ccececd9e33e6b27c8b01fc7457ddb4c1dd266e780d6bc2";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libmnl/default.nix b/pkgs/development/libraries/libmnl/default.nix
index 02e86cc688b8..33ccccea2e95 100644
--- a/pkgs/development/libraries/libmnl/default.nix
+++ b/pkgs/development/libraries/libmnl/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
       re-inventing the wheel.
     '';
     homepage = http://netfilter.org/projects/libmnl/index.html;
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = stdenv.lib.licenses.lgpl21Plus;
 
     platforms = stdenv.lib.platforms.linux;
   };
diff --git a/pkgs/development/libraries/libnetfilter_log/default.nix b/pkgs/development/libraries/libnetfilter_log/default.nix
new file mode 100644
index 000000000000..e3c8447549d1
--- /dev/null
+++ b/pkgs/development/libraries/libnetfilter_log/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchurl, pkgconfig, libnfnetlink, libmnl }:
+
+stdenv.mkDerivation rec {
+  name = "libnetfilter_log-${version}";
+  version = "1.0.1";
+
+  src = fetchurl {
+    url = "http://netfilter.org/projects/libnetfilter_log/files/${name}.tar.bz2";
+    sha256 = "089vjcfxl5qjqpswrbgklf4wflh44irmw6sk2k0kmfixfmszxq3l";
+  };
+
+  buildInputs = [ libmnl ];
+  propagatedBuildInputs = [ libnfnetlink ];
+  nativeBuildInputs = [ pkgconfig ];
+
+  meta = with stdenv.lib; {
+    description = "Userspace library providing interface to packets that have been logged by the kernel packet filter";
+    longDescription = ''
+      libnetfilter_log is a userspace library providing interface to packets
+      that have been logged by the kernel packet filter. It is is part of a
+      system that deprecates the old syslog/dmesg based packet logging. This
+      library has been previously known as libnfnetlink_log.
+    '';
+    homepage = http://netfilter.org/projects/libnetfilter_log/;
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ orivej nckx ];
+  };
+}
diff --git a/pkgs/development/libraries/libopus/default.nix b/pkgs/development/libraries/libopus/default.nix
index 559caf8928b8..328c5db0b65c 100644
--- a/pkgs/development/libraries/libopus/default.nix
+++ b/pkgs/development/libraries/libopus/default.nix
@@ -2,23 +2,16 @@
 , fixedPoint ? false, withCustomModes ? true }:
 
 let
-  version = "1.1.3";
+  version = "1.1.5";
 in
 stdenv.mkDerivation rec {
   name = "libopus-${version}";
 
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/opus/opus-${version}.tar.gz";
-    sha256 = "0cxnd7pjxbgh6l3cbzsw29phpr5cq28fikfhjlp1hc3y5s0gxdjq";
+    sha256 = "1r33nm7b052dw7gsc99809df1zmj5icfiljqbrfkw2pll0f9i17b";
   };
 
-  patches = [
-    (fetchpatch { # CVE-2017-0381
-      url = "https://github.com/xiph/opus/commit/79e8f527b0344b0897a65be35e77f7885bd99409.patch";
-      sha256 = "0clm4ixqkaj0a6i5rhaqfv3nnxyk33b2b8xlm7vyfd0y8kbh996q";
-    })
-  ];
-
   outputs = [ "out" "dev" ];
 
   configureFlags = stdenv.lib.optional fixedPoint "--enable-fixed-point"
diff --git a/pkgs/development/libraries/libproxy/default.nix b/pkgs/development/libraries/libproxy/default.nix
index 163357a0c0f8..cf3ad5f1ebba 100644
--- a/pkgs/development/libraries/libproxy/default.nix
+++ b/pkgs/development/libraries/libproxy/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, pkgconfig, cmake
-, dbus, networkmanager, webkitgtk214x, pcre, python2 }:
+, dbus, networkmanager, webkitgtk216x, pcre, python2 }:
 
 stdenv.mkDerivation rec {
   name = "libproxy-${version}";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig cmake ];
 
-  buildInputs = [ dbus networkmanager webkitgtk214x pcre ];
+  buildInputs = [ dbus networkmanager webkitgtk216x pcre ];
 
   cmakeFlags = [
     "-DWITH_WEBKIT3=ON"
diff --git a/pkgs/development/libraries/libressl/2.5.nix b/pkgs/development/libraries/libressl/2.5.nix
index 2284db5ad7d2..6ab072486553 100644
--- a/pkgs/development/libraries/libressl/2.5.nix
+++ b/pkgs/development/libraries/libressl/2.5.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "dev" "out" "man" ];
 
+  dontGzipMan = if stdenv.isDarwin then true else null; # not sure what's wrong
+
   meta = with stdenv.lib; {
     description = "Free TLS/SSL implementation";
     homepage    = "http://www.libressl.org";
diff --git a/pkgs/development/libraries/libtasn1/default.nix b/pkgs/development/libraries/libtasn1/default.nix
index 3b74406d7bf1..dbd203b97cfc 100644
--- a/pkgs/development/libraries/libtasn1/default.nix
+++ b/pkgs/development/libraries/libtasn1/default.nix
@@ -8,6 +8,14 @@ stdenv.mkDerivation rec {
     sha256 = "00jsix5hny0g768zv4hk78dib7w0qmk5fbizf4jj37r51nd4s6k8";
   };
 
+  patches = [
+    (fetchurl {
+      name = "CVE-2017-6891.patch";
+      url = "https://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=patch;h=5520704d075802df25ce4ffccc010ba1641bd484";
+      sha256 = "000r6wb87zkx8yhzkf1c3h7p5akwhjw51cv8f1yjnplrqqrr7h2k";
+    })
+  ];
+
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "dev";
 
diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix
index c67057031490..a23e37040352 100644
--- a/pkgs/development/libraries/libtiff/default.nix
+++ b/pkgs/development/libraries/libtiff/default.nix
@@ -12,10 +12,10 @@ stdenv.mkDerivation rec {
   };
 
   prePatch =let
-      # https://lwn.net/Vulnerabilities/711777/
+      # https://lwn.net/Vulnerabilities/711777/ and more patched in *-6 -> *-7
       debian = fetchurl {
-        url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.7-5.debian.tar.xz;
-        sha256 = "1ribxdn89wx3nllcyh7ql3dx6wpr1h7z3waglz1w7dklxm43q67l";
+        url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.7-6.debian.tar.xz;
+        sha256 = "9c9048c28205bdbeb5ba36c7a194d0cd604bd137c70961607bfc8a079be5fa31";
       };
     in ''
       tar xf '${debian}'
diff --git a/pkgs/development/libraries/libuv/default.nix b/pkgs/development/libraries/libuv/default.nix
index 941ab6710c2e..fdf5191bf720 100644
--- a/pkgs/development/libraries/libuv/default.nix
+++ b/pkgs/development/libraries/libuv/default.nix
@@ -2,19 +2,19 @@
 , ApplicationServices, CoreServices }:
 
 stdenv.mkDerivation rec {
-  version = "1.11.0";
+  version = "1.12.0";
   name = "libuv-${version}";
 
   src = fetchFromGitHub {
     owner = "libuv";
     repo = "libuv";
     rev = "v${version}";
-    sha256 = "02sm7f3l0shpfz25b77q2jjvlypc1mmz4zpzfgfmiplhgxxaa6la";
+    sha256 = "0m025i0sfm4iv3aiic88x4y4bbhhdb204pmd9r383fsl458fck2p";
   };
 
   postPatch = let
     toDisable = [
-      "getnameinfo_basic" # probably network-dependent
+      "getnameinfo_basic" "udp_send_hang_loop" # probably network-dependent
       "spawn_setuid_fails" "spawn_setgid_fails" "fs_chown" # user namespaces
       "getaddrinfo_fail" "getaddrinfo_fail_sync"
     ]
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 9449a8f538f1..511f97eb3cd0 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -24,10 +24,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper pkgconfig ];
   buildInputs = [
     libxml2 gnutls perl python2 readline gettext libtasn1 libgcrypt yajl
-    attr libxslt xhtml1 perlPackages.XMLXPath curl libpcap parted
+    libxslt xhtml1 perlPackages.XMLXPath curl libpcap
   ] ++ optionals stdenv.isLinux [
     libpciaccess devicemapper lvm2 utillinux systemd libnl numad zfs
-    libapparmor libcap_ng numactl xen
+    libapparmor libcap_ng numactl xen attr parted
   ] ++ optionals stdenv.isDarwin [
      libiconv gmp
   ];
@@ -50,7 +50,6 @@ stdenv.mkDerivation rec {
     "--with-test"
     "--with-esx"
     "--with-remote"
-    "--with-storage-disk"
   ] ++ optionals stdenv.isLinux [
     "--with-attr"
     "--with-apparmor"
@@ -59,6 +58,7 @@ stdenv.mkDerivation rec {
     "--with-macvtap"
     "--with-virtualport"
     "--with-init-script=systemd+redhat"
+    "--with-storage-disk"
     "--with-storage-zfs"
   ] ++ optionals stdenv.isDarwin [
     "--with-init-script=none"
@@ -74,8 +74,8 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/libexec/libvirt-guests.sh \
       --replace "$out/bin" "${gettext}/bin" \
       --replace "lock/subsys" "lock"
-    rm $out/lib/systemd/system/{virtlockd,virtlogd}.*
   '' + optionalString stdenv.isLinux ''
+    rm $out/lib/systemd/system/{virtlockd,virtlogd}.*
     wrapProgram $out/sbin/libvirtd \
       --prefix PATH : ${makeBinPath [ iptables iproute pmutils numad numactl ]}
   '';
diff --git a/pkgs/development/libraries/lmdb/default.nix b/pkgs/development/libraries/lmdb/default.nix
index ec3e9997690e..30703fc7e3ed 100644
--- a/pkgs/development/libraries/lmdb/default.nix
+++ b/pkgs/development/libraries/lmdb/default.nix
@@ -3,13 +3,13 @@
 let optional = stdenv.lib.optional;
 in stdenv.mkDerivation rec {
   name = "lmdb-${version}";
-  version = "0.9.19";
+  version = "0.9.21";
 
   src = fetchFromGitHub {
     owner = "LMDB";
     repo = "lmdb";
     rev = "LMDB_${version}";
-    sha256 = "04qx803jdmhkcam748fn0az3cyzvj91lw28kcvwfyq0al7pmjkfs";
+    sha256 = "026a6himvg3y4ssnccdbgr3c2pq3w2d47nayn05v512875z4f2w3";
   };
 
   postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb";
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index e9edda698f44..a8561d22bf50 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -2,7 +2,7 @@
 , pkgconfig, intltool, autoreconfHook, substituteAll
 , file, expat, libdrm, xorg, wayland, openssl
 , llvmPackages, libffi, libomxil-bellagio, libva
-, libelf, libvdpau, python2
+, libelf, libvdpau
 , grsecEnabled ? false
 , enableRadv ? false
 # Texture floats are patented, see docs/patents.txt, so we don't enable them for full Mesa.
@@ -36,7 +36,7 @@ let
     then ["nouveau" "freedreno" "vc4" "etnaviv" "imx"]
     else if stdenv.isAarch64
     then ["nouveau" "vc4" ]
-    else ["i915" "ilo" "r300" "r600" "radeonsi" "nouveau"];
+    else ["i915" "r300" "r600" "radeonsi" "nouveau"];
   defaultDriDrivers =
     if (stdenv.isArm || stdenv.isAarch64)
     then ["nouveau"]
@@ -67,7 +67,7 @@ let
 in
 
 let
-  version = "17.0.4";
+  version = "17.1.1";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -82,7 +82,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "1269dc8545a193932a0779b2db5bce9be4a5f6813b98c38b93b372be8362a346";
+    sha256 = "aed503f94c0c1630a162a3e276f4ee12a86764cee4cb92338ea2dea99a04e7ef";
   };
 
   prePatch = "patchShebangs .";
@@ -103,7 +103,7 @@ stdenv.mkDerivation {
     "--localstatedir=/var"
     "--with-dri-driverdir=$(drivers)/lib/dri"
     "--with-dri-searchpath=${driverLink}/lib/dri"
-    "--with-egl-platforms=x11,wayland,drm"
+    "--with-platforms=x11,wayland,drm"
   ]
   ++ (optional (galliumDrivers != [])
       ("--with-gallium-drivers=" +
@@ -126,7 +126,7 @@ stdenv.mkDerivation {
     "--enable-glx"
     "--enable-glx-tls"
     "--enable-gallium-osmesa" # used by wine
-    "--enable-gallium-llvm"
+    "--enable-llvm"
     "--enable-egl"
     "--enable-xa" # used in vmware driver
     "--enable-gbm"
@@ -152,7 +152,6 @@ stdenv.mkDerivation {
     libX11 libXext libxcb libXt libXfixes libxshmfence
     libffi wayland libvdpau libelf libXvMC
     libomxil-bellagio libva libpthreadstubs openssl/*or another sha1 provider*/
-    (python2.withPackages (ps: [ ps.Mako ]))
   ];
 
 
diff --git a/pkgs/development/libraries/mesa/symlink-drivers.patch b/pkgs/development/libraries/mesa/symlink-drivers.patch
index 68c0f1da26b6..af2ec9fdb096 100644
--- a/pkgs/development/libraries/mesa/symlink-drivers.patch
+++ b/pkgs/development/libraries/mesa/symlink-drivers.patch
@@ -11,11 +11,12 @@ diff -ru -x '*~' mesa-12.0.3-orig/src/gallium/targets/dri/Makefile.am mesa-12.0.
  install-data-hook:
  	for i in $(TARGET_DRIVERS); do                                  \
 -		ln -f $(DESTDIR)$(dridir)/gallium_dri.so                \
-+		ln -srf $(DESTDIR)$(dridir)/gallium_dri.so               \
++		ln -srf $(DESTDIR)$(dridir)/gallium_dri.so              \
  		      $(DESTDIR)$(dridir)/$${i}_dri.so;                 \
  	done;                                                           \
--	$(RM) $(DESTDIR)$(dridir)/gallium_dri.*
-+	$(RM) $(DESTDIR)$(dridir)/gallium_dri.la
+-	$(RM) $(DESTDIR)$(dridir)/gallium_dri.*;                        \
++	$(RM) $(DESTDIR)$(dridir)/gallium_dri.la                        \
+ 	$(RM) -d $(DESTDIR)$(dridir) &>/dev/null || true
  
  uninstall-hook:
  	for i in $(TARGET_DRIVERS); do                                  \
@@ -60,8 +61,9 @@ diff -ru -x '*~' mesa-12.0.3-orig/src/gallium/targets/vdpau/Makefile.am mesa-12.
  		ln -sf $${l}						\
  		       $${dest_dir}/$${k};				\
  	done;								\
--	$(RM) $${dest_dir}/libvdpau_gallium.*
-+	$(RM) $${dest_dir}/libvdpau_gallium.la
+-	$(RM) $${dest_dir}/libvdpau_gallium.*;				\
++	$(RM) $${dest_dir}/libvdpau_gallium.la				\
+ 	$(RM) -d $${dest_dir} &>/dev/null || true
  
  uninstall-hook:
  	for i in $(TARGET_DRIVERS); do					\
@@ -73,7 +75,7 @@ diff -ru -x '*~' mesa-12.0.3-orig/src/gallium/targets/xvmc/Makefile.am mesa-12.0
  		k=libXvMC$${i}.$(LIB_EXT);				\
  		l=$${k}.$(XVMC_MAJOR).$(XVMC_MINOR).0;			\
 -		ln -f $${dest_dir}/$${j}.$(XVMC_MAJOR).$(XVMC_MINOR).0	\
-+		ln -srf $${dest_dir}/$${j}.$(XVMC_MAJOR).$(XVMC_MINOR).0	\
++		ln -srf $${dest_dir}/$${j}.$(XVMC_MAJOR).$(XVMC_MINOR).0 \
  		      $${dest_dir}/$${l};				\
  		ln -sf $${l}						\
  		       $${dest_dir}/$${k}.$(XVMC_MAJOR).$(XVMC_MINOR);	\
@@ -81,8 +83,9 @@ diff -ru -x '*~' mesa-12.0.3-orig/src/gallium/targets/xvmc/Makefile.am mesa-12.0
  		ln -sf $${l}						\
  		       $${dest_dir}/$${k};				\
  	done;								\
--	$(RM) $${dest_dir}/libXvMCgallium.*
-+	$(RM) $${dest_dir}/libXvMCgallium.la
+-	$(RM) $${dest_dir}/libXvMCgallium.*;				\
++	$(RM) $${dest_dir}/libXvMCgallium.la				\
+ 	$(RM) -d $${dest_dir} &>/dev/null || true
  
  uninstall-hook:
  	for i in $(TARGET_DRIVERS); do					\
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 9e7f2eef46bf..46283e371aa9 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -65,9 +65,6 @@ stdenv.mkDerivation rec {
     sed -i -e 's,LIB_SUFFIX="t,LIB_SUFFIX=",' configure
   '';
 
-  # Here only for native hash, remove on next mass rebuild
-  selfNativeBuildInput = buildPlatform == hostPlatform;
-
   enableParallelBuilding = true;
 
   doCheck = false;
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 2009daa1cc86..03d9aca5e6e9 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -114,8 +114,8 @@ in {
   };
 
   openssl_1_1_0 = common {
-    version = "1.1.0e";
-    sha256 = "0k47sdd9gs6yxfv6ldlgpld2lyzrkcv9kz4cf88ck04xjwc8dgjp";
+    version = "1.1.0f";
+    sha256 = "0r97n4n552ns571diz54qsgarihrxvbn7kvyv8wjyfs9ybrldxqj";
   };
 
 }
diff --git a/pkgs/development/libraries/physics/cernlib/default.nix b/pkgs/development/libraries/physics/cernlib/default.nix
new file mode 100644
index 000000000000..dad138c8433a
--- /dev/null
+++ b/pkgs/development/libraries/physics/cernlib/default.nix
@@ -0,0 +1,63 @@
+{ stdenv, fetchurl, gfortran, gnumake, imake, makedepend, motif, xorg }:
+
+stdenv.mkDerivation rec {
+  version = "2006";
+  name = "cernlib-${version}";
+
+  src = fetchurl {
+    url = "http://cernlib.web.cern.ch/cernlib/download/${version}_source/tar/${version}_src.tar.gz";
+    sha256 = "0awla1rl96z82br7slcmg8ks1d2a7slk6dj79ywb871j2ksi3fky";
+  };
+
+  buildInputs = with xorg; [ gfortran motif libX11 libXft libXt ];
+  nativeBuildInputs = [ gnumake imake makedepend ];
+  sourceRoot = ".";
+
+  patches = [ ./patch ];
+
+  postPatch = ''
+    substituteInPlace 2006/src/config/site.def \
+      --replace "# define MakeCmd gmake" "# define MakeCmd make"
+  '';
+
+  configurePhase = ''
+    export CERN=`pwd`
+    export CERN_LEVEL=${version}
+    export CERN_ROOT=$CERN/$CERN_LEVEL
+    export CVSCOSRC=`pwd`/$CERN_LEVEL/src
+    export PATH=$PATH:$CERN_ROOT/bin
+  '';
+
+  buildPhase = ''
+    cd $CERN_ROOT
+    mkdir -p build bin lib
+
+    cd $CERN_ROOT/build
+    $CVSCOSRC/config/imake_boot
+    make bin/kuipc
+    make scripts/Makefile
+    pushd scripts
+    make install.bin
+    popd
+    make
+  '';
+
+  installPhase = ''
+    mkdir "$out"
+    cp -r "$CERN_ROOT/bin" "$out"
+    cp -r "$CERN_ROOT/lib" "$out"
+    mkdir "$out/$CERN_LEVEL"
+    ln -s "$out/bin" "$out/$CERN_LEVEL/bin"
+    ln -s "$out/lib" "$out/$CERN_LEVEL/lib"
+  '';
+
+  setupHook = ./setup-hook.sh;
+
+  meta = {
+    homepage = http://cernlib.web.cern.ch;
+    description = "Legacy collection of libraries and modules for data analysis in high energy physics";
+    platforms = stdenv.lib.platforms.unix;
+    maintainers = with stdenv.lib.maintainers; [ veprbl ];
+    license = stdenv.lib.licenses.gpl2;
+  };
+}
diff --git a/pkgs/development/libraries/physics/cernlib/patch b/pkgs/development/libraries/physics/cernlib/patch
new file mode 100644
index 000000000000..2d75b6bf0f88
--- /dev/null
+++ b/pkgs/development/libraries/physics/cernlib/patch
@@ -0,0 +1,186 @@
+diff --git a/2006/src/config/Imake.tmpl b/2006/src/config/Imake.tmpl
+index 054fb04..a3b3828 100644
+--- a/2006/src/config/Imake.tmpl
++++ b/2006/src/config/Imake.tmpl
+@@ -455,7 +455,7 @@ XCOMM the platform-specific parameters - edit site.def to change
+ #define NoRConst NO /* YES if const for structs of funcs is bad */
+ #endif
+ #ifndef InstPgmFlags
+-#define InstPgmFlags -s
++#define InstPgmFlags
+ #endif
+ #ifndef InstBinFlags
+ #define InstBinFlags -m 0755
+diff --git a/2006/src/config/biglib.rules b/2006/src/config/biglib.rules
+index c90e58a..9173bdc 100644
+--- a/2006/src/config/biglib.rules
++++ b/2006/src/config/biglib.rules
+@@ -368,7 +368,7 @@ define build-object-list						@@\
+ @ (set -e;\							@@\
+ 	 case '${MFLAGS}' in *[i]*) set +e;; esac; \		@@\
+ 	 subdirs=Quote(dirs);\					@@\
+-	 list=`/bin/pwd`/$@;\					@@\
++	 list=`pwd`/$@;\					@@\
+ 	 for dir in $$subdirs; do \				@@\
+ 	  (set -e;cd $$dir;SedCmd -e "\=^[^/]=s=^.=$$dir/&=" $@ >> $$list);\@@\
+ 	 done) || (rm $@; exit 1)				@@\
+diff --git a/2006/src/config/imake_boot b/2006/src/config/imake_boot
+index b52d0d3..69cf1b3 100755
+--- a/2006/src/config/imake_boot
++++ b/2006/src/config/imake_boot
+@@ -10,8 +10,8 @@ if [ "$CVSCOSRC" = "" ] ; then
+ fi
+ if [ -f Imakefile ] ; then
+ 	imake -DUseInstalled -I$CVSCOSRC/config \
+-		-DTOPDIR=`/bin/pwd` -DCURDIR= -fImakefile
++		-DTOPDIR=`pwd` -DCURDIR= -fImakefile
+ else
+ 	imake -DUseInstalled -I$CVSCOSRC/config \
+-		-DTOPDIR=`/bin/pwd` -DCURDIR= -f$CVSCOSRC/Imakefile
++		-DTOPDIR=`pwd` -DCURDIR= -f$CVSCOSRC/Imakefile
+ fi
+diff --git a/2006/src/config/linux-lp64.cf b/2006/src/config/linux-lp64.cf
+index e071b2f..3cc5c3b 100644
+--- a/2006/src/config/linux-lp64.cf
++++ b/2006/src/config/linux-lp64.cf
+@@ -173,7 +173,7 @@
+ #define FortranCmd		g77
+ #define XargsCmd		xargs
+ #define FortranSaveFlags	/* */ /* Everything static !? */
+-#define DefaultFCOptions	-fno-automatic -fno-second-underscore -fugly-complex
++#define DefaultFCOptions	-fno-automatic -fno-second-underscore
+ #define CernlibSystem	        -DCERNLIB_LINUX -DCERNLIB_UNIX -DCERNLIB_LNX -DCERNLIB_QMGLIBC -DCERNLIB_QMLXIA64
+ 
+ # endif
+diff --git a/2006/src/config/linux.cf b/2006/src/config/linux.cf
+index cc0bee5..a8dd954 100644
+--- a/2006/src/config/linux.cf
++++ b/2006/src/config/linux.cf
+@@ -258,7 +258,7 @@ endif									@@\
+ #define FortranCmd		g77
+ #define XargsCmd		xargs
+ #define FortranSaveFlags	/* */ /* Everything static !? */
+-#define DefaultFCOptions	-fno-automatic -fno-second-underscore -fugly-complex
++#define DefaultFCOptions	-fno-automatic -fno-second-underscore
+ #define CernlibSystem	        -DCERNLIB_LINUX -DCERNLIB_UNIX -DCERNLIB_LNX -DCERNLIB_QMGLIBC
+ 
+ # endif
+diff --git a/2006/src/packlib/kuip/code_kuip/kkern.c b/2006/src/packlib/kuip/code_kuip/kkern.c
+index 3a5579f..5f3c352 100644
+--- a/2006/src/packlib/kuip/code_kuip/kkern.c
++++ b/2006/src/packlib/kuip/code_kuip/kkern.c
+@@ -543,24 +543,6 @@ char *str0dup( const char *str )
+ 
+ 
+ /*
+- * like strdup() but string is n characters long and not terminated
+- */
+-char *strndup( const char *str,
+-              size_t len )
+-{
+-  size_t bytes = len + 1;
+-  char *p;
+-
+-  if( bytes < ALLOC_MIN_BYTES )
+-    bytes = ALLOC_MIN_BYTES;
+-
+-  p = strncpy( malloc( bytes ), str, len );
+-  p[len] = '\0';
+-  return p;
+-}
+-
+-
+-/*
+  * strdup() of character representation of integer n
+  */
+ char *stridup( int n )
+diff --git a/2006/src/packlib/kuip/code_kuip/kmenu.c b/2006/src/packlib/kuip/code_kuip/kmenu.c
+index f135b07..23007a8 100644
+--- a/2006/src/packlib/kuip/code_kuip/kmenu.c
++++ b/2006/src/packlib/kuip/code_kuip/kmenu.c
+@@ -1404,7 +1404,7 @@ void interactive_find( char *expr, int keym )
+          printf ("See also:\n    ");
+          for (i = 0; i < nval; i++) {
+              if (i == ncmd) continue;
+-             printf (flis_name[i]);
++             printf ("%s", flis_name[i]);
+              if (i < nval-1)
+                 printf (", ");
+              else
+diff --git a/2006/src/packlib/kuip/kuip/kstring.h b/2006/src/packlib/kuip/kuip/kstring.h
+index 7811f15..12a1344 100644
+--- a/2006/src/packlib/kuip/kuip/kstring.h
++++ b/2006/src/packlib/kuip/kuip/kstring.h
+@@ -21,7 +21,6 @@ extern "C" {
+  */
+ 
+ #ifndef WIN32
+-extern void* memmove( void* dst, const void* src, size_t n );
+ #endif
+ 
+ /* GF. make conform to kkern.c#if !defined(__convexc__)*/
+@@ -46,7 +45,6 @@ extern char* str4dup( const char* str1, const char* str2, const char* str3,
+                      const char* str4 );
+ extern char* str5dup( const char* str1, const char* str2, const char* str3,
+                      const char* str4, const char* str5 );
+-extern char* strndup( const char* buf, size_t n );
+ extern char* stridup( int i );
+ 
+ extern char* mstrcat( char* ptr, const char* str );
+diff --git a/2006/src/pawlib/paw/cpaw/bugrep.c b/2006/src/pawlib/paw/cpaw/bugrep.c
+index d503a45..d26e30f 100644
+--- a/2006/src/pawlib/paw/cpaw/bugrep.c
++++ b/2006/src/pawlib/paw/cpaw/bugrep.c
+@@ -432,51 +432,7 @@ br_add_config( char * tmp_file )
+ 
+ static int
+ br_mail_file( char *addr, char *subj, char *file )
+-#if (defined(CERNLIB_UNIX))&&(!defined(CERNLIB_WINNT))&&(!defined(CERNLIB_MACOSX))
+-{
+-        FILE            *mfp, *fp;
+-        char            line[1024], my_addr[L_cuserid];
+-        time_t          clock;
+-        struct tm       *ts;
+-
+-        fp = fopen( file, "r" );
+-        if ( fp == NULL ) {
+-                printf( "BUGREPORT: cannot (re)open temporary file\n" );
+-                return MAIL_ERROR;
+-        }
+-
+-        cuserid( my_addr );
+-
+-        sprintf( line, "/usr/lib/sendmail -t" );
+-        mfp = popen( line, "w" );
+-
+-        if ( mfp == NULL ) {
+-                printf( "BUGREPORT: cannot run sendmail\n" );
+-                return MAIL_ERROR;
+-        }
+-
+-
+-        clock = time( (time_t *) 0 );
+-        ts = localtime( &clock );
+-        strftime( line, sizeof( line ),
+-                "%a, %d %h %y %H:%M:%S", ts );
+-        fprintf ( mfp, "To: %s\n", addr );
+-        fprintf ( mfp, "Bcc: %s\n", my_addr );
+-        fprintf ( mfp, "Date: %s\n", line );
+-        fprintf ( mfp, "Subject: %s\n", subj );
+-        fprintf ( mfp, "\n" );
+-
+-        while( fgets( line, sizeof( line ), fp ) != NULL ) {
+-                fputs( line, mfp );
+-        }
+-        fclose( fp );
+-
+-        pclose( mfp );
+-
+-        return MAIL_OK;
+-}
+-#endif
+-#if defined(CERNLIB_MACOSX)
++#if (defined(CERNLIB_UNIX))&&(!defined(CERNLIB_WINNT))
+ {
+         FILE            *mfp, *fp;
+         char            line[1024], *my_addr;
diff --git a/pkgs/development/libraries/physics/cernlib/setup-hook.sh b/pkgs/development/libraries/physics/cernlib/setup-hook.sh
new file mode 100644
index 000000000000..d83759327760
--- /dev/null
+++ b/pkgs/development/libraries/physics/cernlib/setup-hook.sh
@@ -0,0 +1,3 @@
+export CERN_LEVEL=@version@
+export CERN=@out@
+export CERN_ROOT=$CERN/$CERN_LEVEL
diff --git a/pkgs/development/libraries/polkit/default.nix b/pkgs/development/libraries/polkit/default.nix
index c1f8725f6f7c..804bca5f8a5e 100644
--- a/pkgs/development/libraries/polkit/default.nix
+++ b/pkgs/development/libraries/polkit/default.nix
@@ -1,6 +1,8 @@
-{ stdenv, fetchurl, pkgconfig, glib, expat, pam, intltool, spidermonkey_17
-, gobjectIntrospection, libxslt, docbook_xsl, docbook_xml_dtd_412
-, useSystemd ? stdenv.isLinux, systemd }:
+{ stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig, glib, expat, pam
+, intltool, spidermonkey_17 , gobjectIntrospection, libxslt, docbook_xsl
+, docbook_xml_dtd_412, gtk_doc
+, useSystemd ? stdenv.isLinux, systemd
+}:
 
 let
 
@@ -22,11 +24,28 @@ stdenv.mkDerivation rec {
     sha256 = "109w86kfqrgz83g9ivggplmgc77rz8kx8646izvm2jb57h4rbh71";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "http://pkgs.fedoraproject.org/cgit/rpms/polkit.git/plain/polkit-0.113-agent-leaks.patch?id=fa6fd575804de92886c95d3bc2b7eb2abcd13760";
+      sha256 = "1cxnhj0y30g7ldqq1y6zwsbdwcx7h97d3mpd3h5jy7dhg3h9ym91";
+    })
+    (fetchpatch {
+      url = "http://pkgs.fedoraproject.org/cgit/rpms/polkit.git/plain/polkit-0.113-polkitpermission-leak.patch?id=fa6fd575804de92886c95d3bc2b7eb2abcd13760";
+      sha256 = "1h1rkd4avqyyr8q6836zzr3w10jf521gcqnvhrhzwdpgp1ay4si7";
+    })
+    (fetchpatch {
+      url = "http://pkgs.fedoraproject.org/cgit/rpms/polkit.git/plain/polkit-0.113-itstool.patch?id=fa6fd575804de92886c95d3bc2b7eb2abcd13760";
+      sha256 = "0bxmjwp8ahy1y5g1l0kxmld0l3mlvb2l0i5n1qabia3d5iyjkyfh";
+    })
+  ];
+
   outputs = [ "bin" "dev" "out" ]; # small man pages in $bin
 
+  nativeBuildInputs =
+    [ gtk_doc pkgconfig autoreconfHook ]
+    ++ [ libxslt docbook_xsl docbook_xml_dtd_412 ]; # man pages
   buildInputs =
-    [ pkgconfig glib expat pam intltool spidermonkey_17 gobjectIntrospection ]
-    ++ [ libxslt docbook_xsl docbook_xml_dtd_412 ] # man pages
+    [ glib expat pam intltool spidermonkey_17 gobjectIntrospection ]
     ++ stdenv.lib.optional useSystemd systemd;
 
   # Ugly hack to overwrite hardcoded directories
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index 89368282f2c9..20e35fa3e089 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, fetchpatch, pkgconfig, libiconv, libintlOrEmpty
 , zlib, curl, cairo, freetype, fontconfig, lcms, libjpeg, openjpeg
-, withData ? false, poppler_data
+, withData ? true, poppler_data
 , qt4Support ? false, qt4 ? null
 , qt5Support ? false, qtbase ? null
 , introspectionSupport ? false, gobjectIntrospection ? null
diff --git a/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix b/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix
index 915a6bcae8a8..23a45dd44ed2 100644
--- a/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix
+++ b/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix
@@ -31,5 +31,9 @@ qtSubmodule {
         };
     in optionals flashplayerFix [ dlopen-webkit-nsplugin dlopen-webkit-gtk ]
     ++ [ dlopen-webkit-udev ];
+
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" '';
+
   meta.maintainers = with stdenv.lib.maintainers; [ abbradar ];
 }
diff --git a/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix b/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix
index 881acb442e8b..bee3786ef32e 100644
--- a/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix
+++ b/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix
@@ -39,5 +39,9 @@ qtSubmodule {
     in optionals flashplayerFix [ dlopen-webkit-nsplugin dlopen-webkit-gtk ]
     ++ optionals (!stdenv.isDarwin) [ dlopen-webkit-udev ]
     ++ optionals (stdenv.isDarwin) [ ./0004-icucore-darwin.patch ];
+
+  # Hack to avoid TMPDIR in RPATHs.
+  preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" '';
+
   meta.maintainers = with stdenv.lib.maintainers; [ abbradar periklis ];
 }
diff --git a/pkgs/development/libraries/sqlite/sqlite3_analyzer.nix b/pkgs/development/libraries/sqlite/sqlite3_analyzer.nix
index d450cd21aecd..e5fffc076f7b 100644
--- a/pkgs/development/libraries/sqlite/sqlite3_analyzer.nix
+++ b/pkgs/development/libraries/sqlite/sqlite3_analyzer.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, unzip, tcl }:
 
 stdenv.mkDerivation {
-  name = "sqlite3_analyzer-3.17.0";
+  name = "sqlite3_analyzer-3.19.2";
 
   src = fetchurl {
-    url = "https://www.sqlite.org/2017/sqlite-src-3170000.zip";
-    sha256 = "1hs8nzk2pjr4fhhrwcyqwpa24gd4ndp6f0japykg5wfadgp4nxc6";
+    url = "https://www.sqlite.org/2017/sqlite-src-3190200.zip";
+    sha256 = "1hdbs41mdyyy641gix87pllsd29p8dim7gj4qvmiyfra2q5kg749";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/development/libraries/webkitgtk/2.14.nix b/pkgs/development/libraries/webkitgtk/2.16.nix
index a1b220948552..4431972b5dd7 100644
--- a/pkgs/development/libraries/webkitgtk/2.14.nix
+++ b/pkgs/development/libraries/webkitgtk/2.16.nix
@@ -12,7 +12,7 @@ assert enableGeoLocation -> geoclue2 != null;
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "webkitgtk-${version}";
-  version = "2.14.5";
+  version = "2.16.3";
 
   meta = {
     description = "Web content rendering engine, GTK+ port";
@@ -25,9 +25,9 @@ stdenv.mkDerivation rec {
 
   postConfigure = optionalString stdenv.isDarwin ''
     substituteInPlace Source/WebKit2/CMakeFiles/WebKit2.dir/link.txt \
-    	  --replace "../../lib/libWTFGTK.a" ""
+        --replace "../../lib/libWTFGTK.a" ""
     substituteInPlace Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/link.txt \
-    	  --replace "../../lib/libbmalloc.a" ""
+        --replace "../../lib/libbmalloc.a" ""
     sed -i "s|[\./]*\.\./lib/lib[^\.]*\.a||g" \
         Source/JavaScriptCore/CMakeFiles/LLIntOffsetsExtractor.dir/link.txt \
         Source/JavaScriptCore/shell/CMakeFiles/jsc.dir/link.txt \
@@ -37,18 +37,18 @@ stdenv.mkDerivation rec {
         Source/WebKit2/CMakeFiles/webkit2gtkinjectedbundle.dir/link.txt \
         Source/WebKit2/CMakeFiles/WebProcess.dir/link.txt
     substituteInPlace Source/JavaScriptCore/CMakeFiles/JavaScriptCore.dir/link.txt \
-    	  --replace "../../lib/libWTFGTK.a" "-Wl,-all_load ../../lib/libWTFGTK.a"
+        --replace "../../lib/libWTFGTK.a" "-Wl,-all_load ../../lib/libWTFGTK.a"
   '';
 
   src = fetchurl {
     url = "http://webkitgtk.org/releases/${name}.tar.xz";
-    sha256 = "17rnjs7yl198bkghzcc2cgh30sb5i03irb6wag3xchwv7b1z3a1w";
+    sha256 = "04mmfxm8284zrlkrhkcn9gq1l4lpm1q6wwb5hyybj081v8qr2ki0";
   };
 
   # see if we can clean this up....
 
   patches = [ ./finding-harfbuzz-icu.patch ]
-  	++ optionals stdenv.isDarwin [
+     ++ optionals stdenv.isDarwin [
     ./PR-152650-2.patch
     ./PR-153138.patch
     ./PR-157554.patch
diff --git a/pkgs/development/libraries/webkitgtk/PR-152650-2.patch b/pkgs/development/libraries/webkitgtk/PR-152650-2.patch
index db84a4a6b26e..f87b8ee73e23 100644
--- a/pkgs/development/libraries/webkitgtk/PR-152650-2.patch
+++ b/pkgs/development/libraries/webkitgtk/PR-152650-2.patch
@@ -38,9 +38,9 @@ index 6b01f1a..b443d10 100644
 -    set(ENABLE_GTKDOC OFF)
 -endif ()
 -
- set(DERIVED_SOURCES_GOBJECT_DOM_BINDINGS_DIR ${DERIVED_SOURCES_DIR}/webkitdom)
  set(DERIVED_SOURCES_WEBKITGTK_DIR ${DERIVED_SOURCES_DIR}/webkitgtk)
  set(DERIVED_SOURCES_WEBKITGTK_API_DIR ${DERIVED_SOURCES_WEBKITGTK_DIR}/webkit)
+ set(DERIVED_SOURCES_WEBKIT2GTK_DIR ${DERIVED_SOURCES_DIR}/webkit2gtk)
 diff --git a/Tools/gtk/gtkdoc.py b/Tools/gtk/gtkdoc.py
 index 4c8237b..a628ae0 100644
 --- a/Tools/gtk/gtkdoc.py
diff --git a/pkgs/development/libraries/webkitgtk/adding-libintl.patch b/pkgs/development/libraries/webkitgtk/adding-libintl.patch
deleted file mode 100644
index b6e8b073c9d4..000000000000
--- a/pkgs/development/libraries/webkitgtk/adding-libintl.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- webkitgtk-2.10.4-orig/Source/WebKit2/CMakeLists.txt	2015-11-11 02:42:51.000000000 -0500
-+++ webkitgtk-2.10.4/Source/WebKit2/CMakeLists.txt	2016-01-31 18:27:49.000000000 -0500
-@@ -738,6 +738,7 @@
- set(WebKit2_LIBRARIES
-     JavaScriptCore
-     WebCore
-+    intl
- )
- 
- set(PluginProcess_LIBRARIES