diff --git a/doc/languages-frameworks/ruby.xml b/doc/languages-frameworks/ruby.xml
index eb1696ad2248..4b48f7ffa1b9 100644
--- a/doc/languages-frameworks/ruby.xml
+++ b/doc/languages-frameworks/ruby.xml
@@ -4,10 +4,14 @@
 
 <title>Ruby</title>
 
-  <para>There currently is support to bundle applications that are packaged as Ruby gems. The utility "bundix" allows you to write a <filename>Gemfile</filename>, let bundler create a <filename>Gemfile.lock</filename>, and then convert
-  this into a nix expression that contains all Gem dependencies automatically.</para>
+<para>There currently is support to bundle applications that are packaged as
+Ruby gems. The utility "bundix" allows you to write a
+<filename>Gemfile</filename>, let bundler create a
+<filename>Gemfile.lock</filename>, and then convert this into a nix
+expression that contains all Gem dependencies automatically.
+</para>
 
-  <para>For example, to package sensu, we did:</para>
+<para>For example, to package sensu, we did:</para>
 
 <screen>
 <![CDATA[$ cd pkgs/servers/monitoring
@@ -38,14 +42,20 @@ bundlerEnv rec {
 }]]>
 </screen>
 
-<para>Please check in the <filename>Gemfile</filename>, <filename>Gemfile.lock</filename> and the <filename>gemset.nix</filename> so future updates can be run easily.
+<para>Please check in the <filename>Gemfile</filename>,
+<filename>Gemfile.lock</filename> and the
+<filename>gemset.nix</filename> so future updates can be run easily.
 </para>
 
-<para>For tools written in Ruby - i.e. where the desire is to install a package and then execute e.g. <command>rake</command> at the command line, there is an alternative builder called <literal>bundlerApp</literal>. Set up the <filename>gemset.nix</filename> the same way, and then, for example:
+<para>For tools written in Ruby - i.e. where the desire is to install
+a package and then execute e.g. <command>rake</command> at the command
+line, there is an alternative builder called <literal>bundlerApp</literal>.
+Set up the <filename>gemset.nix</filename> the same way, and then, for
+example:
 </para>
 
 <screen>
-  <![CDATA[{ lib, bundlerApp }:
+<![CDATA[{ lib, bundlerApp }:
 
 bundlerApp {
   pname = "corundum";
@@ -60,15 +70,33 @@ bundlerApp {
     platforms   = platforms.unix;
   };
 }]]>
+</screen>
 
-<para>The chief advantage of <literal>bundlerApp</literal> over <literal>bundlerEnv</literal> is the executables introduced in the environment are precisely those selected in the <literal>exes</literal> list, as opposed to <literal>bundlerEnv</literal> which adds all the executables made available by gems in the gemset, which can mean e.g. <command>rspec</command> or <command>rake</command> in unpredictable versions available from various packages.
+<para>The chief advantage of <literal>bundlerApp</literal> over
+<literal>bundlerEnv</literal> is the executables introduced in the
+environment are precisely those selected in the <literal>exes</literal>
+list, as opposed to <literal>bundlerEnv</literal> which adds all the
+executables made available by gems in the gemset, which can mean e.g.
+<command>rspec</command> or <command>rake</command> in unpredictable
+versions available from various packages.
+</para>
 
-<para>Resulting derivations for both builders also have two helpful attributes, <literal>env</literal> and <literal>wrapper</literal>. The first one allows one to quickly drop into
-<command>nix-shell</command> with the specified environment present. E.g. <command>nix-shell -A sensu.env</command> would give you an environment with Ruby preset
-so it has all the libraries necessary for <literal>sensu</literal> in its paths. The second one can be used to make derivations from custom Ruby scripts which have
-<filename>Gemfile</filename>s with their dependencies specified. It is a derivation with <command>ruby</command> wrapped so it can find all the needed dependencies.
-For example, to make a derivation <literal>my-script</literal> for a <filename>my-script.rb</filename> (which should be placed in <filename>bin</filename>) you should
-run <command>bundix</command> as specified above and then use <literal>bundlerEnv</literal> like this:</para>
+<para>Resulting derivations for both builders also have two helpful
+attributes, <literal>env</literal> and <literal>wrapper</literal>.
+The first one allows one to quickly drop into
+<command>nix-shell</command> with the specified environment present.
+E.g. <command>nix-shell -A sensu.env</command> would give you an
+environment with Ruby preset so it has all the libraries necessary
+for <literal>sensu</literal> in its paths. The second one can be
+used to make derivations from custom Ruby scripts which have
+<filename>Gemfile</filename>s with their dependencies specified. It is
+a derivation with <command>ruby</command> wrapped so it can find all
+the needed dependencies. For example, to make a derivation
+<literal>my-script</literal> for a <filename>my-script.rb</filename>
+(which should be placed in <filename>bin</filename>) you should run
+<command>bundix</command> as specified above and then use
+<literal>bundlerEnv</literal> like this:
+</para>
 
 <programlisting>
 <![CDATA[let env = bundlerEnv {
diff --git a/nixos/lib/make-ext4-fs.nix b/nixos/lib/make-ext4-fs.nix
index 23839ea487db..f06649e1991a 100644
--- a/nixos/lib/make-ext4-fs.nix
+++ b/nixos/lib/make-ext4-fs.nix
@@ -33,7 +33,7 @@ pkgs.stdenv.mkDerivation {
       echo "Creating an EXT4 image of $bytes bytes (numInodes=$numInodes, numDataBlocks=$numDataBlocks)"
 
       truncate -s $bytes $out
-      faketime "1970-01-01 00:00:00" mkfs.ext4 -L ${volumeLabel} -U 44444444-4444-4444-8888-888888888888 $out
+      faketime -f "1970-01-01 00:00:01" mkfs.ext4 -L ${volumeLabel} -U 44444444-4444-4444-8888-888888888888 $out
 
       # Populate the image contents by piping a bunch of commands to the `debugfs` tool from e2fsprogs.
       # For example, to copy /nix/store/abcd...efg-coreutils-8.23/bin/sleep:
@@ -76,7 +76,7 @@ pkgs.stdenv.mkDerivation {
 
           echo sif $file gid 30000 # chgrp to nixbld
         done
-      ) | faketime "1970-01-01 00:00:00" debugfs -w $out -f /dev/stdin > errorlog 2>&1
+      ) | faketime -f "1970-01-01 00:00:01" debugfs -w $out -f /dev/stdin > errorlog 2>&1
 
       # The debugfs tool doesn't terminate on error nor exit with a non-zero status. Check manually.
       if egrep -q 'Could not allocate|File not found' errorlog; then
diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index 0e7ffbd3c2e1..a4715175cc95 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -527,7 +527,7 @@ in {
       input.gid = ids.gids.input;
     };
 
-    system.activationScripts.users = stringAfter [ "etc" ]
+    system.activationScripts.users = stringAfter [ "stdio" ]
       ''
         ${pkgs.perl}/bin/perl -w \
           -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl \
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index 31a588318f6a..be5bfaebf7d2 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -164,8 +164,6 @@ in
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
         path = [ data.package ];
-        restartTriggers = [ config.environment.etc."tinc/${network}/tinc.conf".source ]
-          ++ mapAttrsToList (host: _ : config.environment.etc."tinc/${network}/hosts/${host}".source) data.hosts;
         serviceConfig = {
           Type = "simple";
           PIDFile = "/run/tinc.${network}.pid";
diff --git a/nixos/modules/services/web-servers/lighttpd/default.nix b/nixos/modules/services/web-servers/lighttpd/default.nix
index 8c3f7b219acf..45a65965112a 100644
--- a/nixos/modules/services/web-servers/lighttpd/default.nix
+++ b/nixos/modules/services/web-servers/lighttpd/default.nix
@@ -37,8 +37,10 @@ let
     "mod_rrdtool"
     "mod_accesslog"
     # Remaining list of modules, order assumed to be unimportant.
+    "mod_authn_file"
+    "mod_authn_mysql"
     "mod_cml"
-    "mod_dirlisting"
+    "mod_deflate"
     "mod_evasive"
     "mod_extforward"
     "mod_flv_streaming"
@@ -47,6 +49,7 @@ let
     "mod_scgi"
     "mod_setenv"
     "mod_trigger_b4_dl"
+    "mod_uploadprogress"
     "mod_webdav"
   ];
 
@@ -86,14 +89,9 @@ let
       accesslog.use-syslog = "enable"
       server.errorlog-use-syslog = "enable"
 
-      mimetype.assign = (
-          ".html" => "text/html",
-          ".htm" => "text/html",
-          ".txt" => "text/plain",
-          ".jpg" => "image/jpeg",
-          ".png" => "image/png",
-          ".css" => "text/css"
-          )
+      ${lib.optionalString cfg.enableUpstreamMimeTypes ''
+      include "${pkgs.lighttpd}/share/lighttpd/doc/config/conf.d/mime.conf"
+      ''}
 
       static-file.exclude-extensions = ( ".fcgi", ".php", ".rb", "~", ".inc" )
       index-file.names = ( "index.html" )
@@ -165,6 +163,17 @@ in
         '';
       };
 
+      enableUpstreamMimeTypes = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to include the list of mime types bundled with lighttpd
+          (upstream). If you disable this, no mime types will be added by
+          NixOS and you will have to add your own mime types in
+          <option>services.lighttpd.extraConfig</option>.
+        '';
+      };
+
       mod_status = mkOption {
         default = false;
         type = types.bool;
diff --git a/nixos/modules/system/boot/networkd.nix b/nixos/modules/system/boot/networkd.nix
index b151b5688928..9d2cea3ad165 100644
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@@ -142,6 +142,18 @@ let
     (assertValueOneOf "EmitTimezone" boolValues)
   ];
 
+  # .network files have a [Link] section with different options than in .netlink files
+  checkNetworkLink = checkUnitConfig "Link" [
+    (assertOnlyFields [
+      "MACAddress" "MTUBytes" "ARP" "Unmanaged"
+    ])
+    (assertMacAddress "MACAddress")
+    (assertByteFormat "MTUBytes")
+    (assertValueOneOf "ARP" boolValues)
+    (assertValueOneOf "Unmanaged" boolValues)
+  ];
+
+
   commonNetworkOptions = {
 
     enable = mkOption {
@@ -371,6 +383,18 @@ let
       '';
     };
 
+    linkConfig = mkOption {
+      default = {};
+      example = { Unmanaged = true; };
+      type = types.addCheck (types.attrsOf unitOption) checkNetworkLink;
+      description = ''
+        Each attribute in this set specifies an option in the
+        <literal>[Link]</literal> section of the unit.  See
+        <citerefentry><refentrytitle>systemd.network</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+      '';
+    };
+
     name = mkOption {
       type = types.nullOr types.str;
       default = null;
@@ -581,6 +605,12 @@ let
     { inherit (def) enable;
       text = commonMatchText def +
         ''
+          ${optionalString (def.linkConfig != { }) ''
+            [Link]
+            ${attrsToSection def.linkConfig}
+
+          ''}
+
           [Network]
           ${attrsToSection def.networkConfig}
           ${concatStringsSep "\n" (map (s: "Address=${s}") def.address)}
diff --git a/nixos/modules/system/etc/etc.nix b/nixos/modules/system/etc/etc.nix
index fd6e58cd5b43..7d43ba07ca57 100644
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@@ -20,8 +20,8 @@ let
     sources = map (x: x.source) etc';
     targets = map (x: x.target) etc';
     modes = map (x: x.mode) etc';
-    uids  = map (x: x.uid) etc';
-    gids  = map (x: x.gid) etc';
+    users  = map (x: x.user) etc';
+    groups  = map (x: x.group) etc';
   };
 
 in
@@ -108,6 +108,26 @@ in
               '';
             };
 
+            user = mkOption {
+              default = "+${toString config.uid}";
+              type = types.str;
+              description = ''
+                User name of created file.
+                Only takes affect when the file is copied (that is, the mode is not 'symlink').
+                Changing this option takes precedence over <literal>uid</literal>.
+              '';
+            };
+
+            group = mkOption {
+              default = "+${toString config.gid}";
+              type = types.str;
+              description = ''
+                Group name of created file.
+                Only takes affect when the file is copied (that is, the mode is not 'symlink').
+                Changing this option takes precedence over <literal>gid</literal>.
+              '';
+            };
+
           };
 
           config = {
@@ -130,7 +150,7 @@ in
 
     system.build.etc = etc;
 
-    system.activationScripts.etc = stringAfter [ "stdio" ]
+    system.activationScripts.etc = stringAfter [ "users" "groups" ]
       ''
         # Set up the statically computed bits of /etc.
         echo "setting up /etc..."
diff --git a/nixos/modules/system/etc/make-etc.sh b/nixos/modules/system/etc/make-etc.sh
index 60d4ba1301a3..1ca4c3046f0e 100644
--- a/nixos/modules/system/etc/make-etc.sh
+++ b/nixos/modules/system/etc/make-etc.sh
@@ -6,8 +6,8 @@ set -f
 sources_=($sources)
 targets_=($targets)
 modes_=($modes)
-uids_=($uids)
-gids_=($gids)
+users_=($users)
+groups_=($groups)
 set +f
 
 for ((i = 0; i < ${#targets_[@]}; i++)); do
@@ -36,9 +36,9 @@ for ((i = 0; i < ${#targets_[@]}; i++)); do
         fi
         
         if test "${modes_[$i]}" != symlink; then
-            echo "${modes_[$i]}" > $out/etc/$target.mode
-            echo "${uids_[$i]}" > $out/etc/$target.uid
-            echo "${gids_[$i]}" > $out/etc/$target.gid
+            echo "${modes_[$i]}"  > $out/etc/$target.mode
+            echo "${users_[$i]}"  > $out/etc/$target.uid
+            echo "${groups_[$i]}" > $out/etc/$target.gid
         fi
         
     fi
diff --git a/nixos/modules/system/etc/setup-etc.pl b/nixos/modules/system/etc/setup-etc.pl
index efda74161ff8..eed20065087f 100644
--- a/nixos/modules/system/etc/setup-etc.pl
+++ b/nixos/modules/system/etc/setup-etc.pl
@@ -108,6 +108,8 @@ sub link {
             my $uid = read_file("$_.uid"); chomp $uid;
             my $gid = read_file("$_.gid"); chomp $gid;
             copy "$static/$fn", "$target.tmp" or warn;
+            $uid = getpwnam $uid unless $uid =~ /^\+/;
+            $gid = getgrnam $gid unless $gid =~ /^\+/;
             chown int($uid), int($gid), "$target.tmp" or warn;
             chmod oct($mode), "$target.tmp" or warn;
             rename "$target.tmp", $target or warn;
diff --git a/pkgs/applications/audio/baudline/default.nix b/pkgs/applications/audio/baudline/default.nix
index e3cef30ccdaa..deaa3f98e52e 100644
--- a/pkgs/applications/audio/baudline/default.nix
+++ b/pkgs/applications/audio/baudline/default.nix
@@ -1,10 +1,10 @@
-{ stdenv, fetchurl, libXmu, libXt, libX11, libXext, libXxf86vm, jack
+{ stdenv, fetchurl, libXmu, libXt, libX11, libXext, libXxf86vm, libjack2
 , makeWrapper
 }:
 
 let
   rpath = stdenv.lib.makeLibraryPath
-    [ libXmu libXt libX11 libXext libXxf86vm jack ];
+    [ libXmu libXt libX11 libXext libXxf86vm libjack2 ];
 in
 stdenv.mkDerivation rec {
   name = "baudline-${version}";
diff --git a/pkgs/applications/editors/vim/configurable.nix b/pkgs/applications/editors/vim/configurable.nix
index 3f588fdde585..97e430fded63 100644
--- a/pkgs/applications/editors/vim/configurable.nix
+++ b/pkgs/applications/editors/vim/configurable.nix
@@ -24,6 +24,10 @@ let
           let pluginname = substitute(d, ".*/", "", "")
           if !has_key(seen, pluginname)
             exec 'set runtimepath^='.d
+            let after = d."/after"
+            if isdirectory(after)
+              exec 'set runtimepath^='.after
+            endif
             let seen[pluginname] = 1
           endif
         endfor
diff --git a/pkgs/applications/graphics/ImageMagick/7.0.nix b/pkgs/applications/graphics/ImageMagick/7.0.nix
index 1a854a82bf07..5524f12077f9 100644
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@@ -13,8 +13,8 @@ let
     else throw "ImageMagick is not supported on this platform.";
 
   cfg = {
-    version = "7.0.6-1";
-    sha256 = "1i3gsc0ps7cbvfmnk6fbi5hng18jwh4x4dqbz90a45x85023w9vs";
+    version = "7.0.6-4";
+    sha256 = "0fvkx9lf8g0sa9bccd9s5qyhcy0g1mqnkbpqly55ryxyg1ywxqaz";
     patches = [];
   };
 in
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index a9223749f399..169576f29bf8 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -13,8 +13,8 @@ let
     else throw "ImageMagick is not supported on this platform.";
 
   cfg = {
-    version = "6.9.9-0";
-    sha256 = "02xnvgjnmz2d4yv4iy1kh7an5w631p1s319jw23c8zpmqhfhk2ha";
+    version = "6.9.9-3";
+    sha256 = "1bfg334nxkxhsm6h0hb0vwd9aiz031qa0w8w8hmhdk8m4wawshrg";
     patches = [];
   }
     # Freeze version on mingw so we don't need to port the patch too often.
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
index 5de8e7892abe..aace37601b55 100644
--- a/pkgs/applications/graphics/feh/default.nix
+++ b/pkgs/applications/graphics/feh/default.nix
@@ -6,11 +6,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "feh-${version}";
-  version = "2.19";
+  version = "2.19.1";
 
   src = fetchurl {
     url = "http://feh.finalrewind.org/${name}.tar.bz2";
-    sha256 = "1sfhr6628xpj9p6bqihdq35y139x2gmrpydjlrwsl1rs77c2bgnf";
+    sha256 = "1d4ycmai3dpajl0bdr9i56646g4h5j1lb95jjn0nckwcddcj927c";
   };
 
   outputs = [ "out" "man" "doc" ];
diff --git a/pkgs/applications/misc/alacritty/default.nix b/pkgs/applications/misc/alacritty/default.nix
index a00e0ec8a48b..e84ee7ee16ba 100644
--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@@ -16,6 +16,18 @@
 
 with rustPlatform;
 
+let
+  rpathLibs = [
+    expat
+    freetype
+    fontconfig
+    libX11
+    libXcursor
+    libXxf86vm
+    libXi
+  ];
+in
+
 buildRustPackage rec {
   name = "alacritty-unstable-2017-07-25";
 
@@ -31,31 +43,25 @@ buildRustPackage rec {
   buildInputs = [
     cmake
     makeWrapper
-    freetype
-    fontconfig
     xclip
     pkgconfig
-    expat
-    libX11
-    libXcursor
-    libXxf86vm
-    libXi
-  ];
+  ] ++ rpathLibs;
 
   installPhase = ''
     mkdir -p $out/bin
     for f in $(find target/release -maxdepth 1 -type f); do
       cp $f $out/bin
     done;
-    wrapProgram $out/bin/alacritty --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath buildInputs}"
+    patchelf --set-rpath "${stdenv.lib.makeLibraryPath rpathLibs}" $out/bin/alacritty
   '';
 
+  dontPatchELF = true;
 
   meta = with stdenv.lib; {
     description = "GPU-accelerated terminal emulator";
     homepage = https://github.com/jwilm/alacritty;
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ mic92 ];
-    platforms = platforms.all;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/networking/remote/xrdp/default.nix b/pkgs/applications/networking/remote/xrdp/default.nix
index 8079a0aabe66..eff81e998579 100644
--- a/pkgs/applications/networking/remote/xrdp/default.nix
+++ b/pkgs/applications/networking/remote/xrdp/default.nix
@@ -3,13 +3,13 @@
 let
   xorgxrdp = stdenv.mkDerivation rec {
     name = "xorgxrdp-${version}";
-    version = "0.2.1";
-  
+    version = "0.2.3";
+
     src = fetchFromGitHub {
       owner = "neutrinolabs";
       repo = "xorgxrdp";
       rev = "v${version}";
-      sha256 = "13713qs1v79xa02iw6vaj9b2q62ix770a32z56ql05d6yvfdsfhi";
+      sha256 = "0l1b38j3q9mxyb8ffpdplbqs6rnabj92i8wngrwlkhfh2c88szn1";
     };
 
     nativeBuildInputs = [ pkgconfig autoconf automake which libtool nasm ];
@@ -34,16 +34,15 @@ let
   };
 
   xrdp = stdenv.mkDerivation rec {
-    version = "0.9.2";
-    rev = "48c26a3"; # Fixes https://github.com/neutrinolabs/xrdp/issues/609; not a patch on top of the official repo because "xorgxrdp.configureFlags" above includes "xrdp.src" which must be fixed already
-    name = "xrdp-${version}.${rev}";
-  
+    version = "0.9.3";
+    name = "xrdp-${version}";
+
     src = fetchFromGitHub {
       owner = "volth";
       repo = "xrdp";
-      rev = rev;
+      rev = "refs/heads/runtime-cfg-path-${version}";  # Fixes https://github.com/neutrinolabs/xrdp/issues/609; not a patch on top of the official repo because "xorgxrdp.configureFlags" above includes "xrdp.src" which must be patched already
       fetchSubmodules = true;
-      sha256 = "0zs03amshmvy65d26vsv31n9jflkjf43vsjhg4crzifka3vz9p16";
+      sha256 = "0xqyg3m688fj442zgg9fqmbz7nnzvqpd7a9ki2cwh1hyibacpmz7";
     };
 
     nativeBuildInputs = [ pkgconfig autoconf automake which libtool nasm ];
@@ -73,12 +72,12 @@ let
 
       # remove all session types except Xorg (they are not supported by this setup)
       ${perl}/bin/perl -i -ne 'print unless /\[(X11rdp|Xvnc|console|vnc-any|sesman-any|rdp-any|neutrinordp-any)\]/ .. /^$/' $out/etc/xrdp/xrdp.ini
-   
+
       # remove all session types and then add Xorg
       ${perl}/bin/perl -i -ne 'print unless /\[(X11rdp|Xvnc|Xorg)\]/ .. /^$/' $out/etc/xrdp/sesman.ini
-   
+
       cat >> $out/etc/xrdp/sesman.ini <<EOF
-   
+
       [Xorg]
       param=${xorg.xorgserver}/bin/Xorg
       param=-modulepath
diff --git a/pkgs/applications/window-managers/awesome/default.nix b/pkgs/applications/window-managers/awesome/default.nix
index 6f56ff98998f..a441de5ed19f 100644
--- a/pkgs/applications/window-managers/awesome/default.nix
+++ b/pkgs/applications/window-managers/awesome/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchFromGitHub, luaPackages, cairo, librsvg, cmake, imagemagick, pkgconfig, gdk_pixbuf
+{ stdenv, fetchFromGitHub, luaPackages, cairo, librsvg, cmake, imagemagick, pkgconfig, gdk_pixbuf
 , xorg, libstartup_notification, libxdg_basedir, libpthreadstubs
 , xcb-util-cursor, makeWrapper, pango, gobjectIntrospection, unclutter
 , compton, procps, iproute, coreutils, curl, alsaUtils, findutils, xterm
@@ -9,13 +9,13 @@
 
 with luaPackages; stdenv.mkDerivation rec {
   name = "awesome-${version}";
-  version = "4.1";
+  version = "4.2";
   
   src = fetchFromGitHub {
     owner = "awesomewm";
     repo = "awesome";
     rev = "v${version}";
-    sha256 = "1qik8h5nwjq4535lpdpal85vas1k7am3s6l5r763kpdzxhfcyyaj";
+    sha256 = "1pcgagcvm6rdky8p8dd810j3ywaz0ncyk5xgaykslaixzrq60kff";
   };
 
   nativeBuildInputs = [
@@ -38,13 +38,6 @@ with luaPackages; stdenv.mkDerivation rec {
                   xorg.xcbutilrenderutil xorg.xcbutilwm libxkbcommon
                   xcbutilxrm ];
 
-  patches = [
-    (fetchurl {
-      url = "https://patch-diff.githubusercontent.com/raw/awesomeWM/awesome/pull/1639.patch";
-      sha256 = "00piynmbxajd2xbg960gmf0zlqn7m489f4ww482y49ravfy1jhsj";
-    })
-  ];
-
   #cmakeFlags = "-DGENERATE_MANPAGES=ON";
 
   LD_LIBRARY_PATH = "${stdenv.lib.makeLibraryPath [ cairo pango gobjectIntrospection ]}";
diff --git a/pkgs/data/misc/nixos-artwork/icons.nix b/pkgs/data/misc/nixos-artwork/icons.nix
index cee6e600cbe0..1c14bcc9f981 100644
--- a/pkgs/data/misc/nixos-artwork/icons.nix
+++ b/pkgs/data/misc/nixos-artwork/icons.nix
@@ -3,7 +3,7 @@
 stdenv.mkDerivation {
   name = "nixos-icons-2017-03-16";
   srcs = fetchFromGitHub {
-    owner = "nixos";
+    owner = "NixOS";
     repo = "nixos-artwork";
     rev = "783ca1249fc4cfe523ad4e541f37e2229891bc8b";
     sha256 = "0wp08b1gh2chs1xri43wziznyjcplx0clpsrb13wzyscv290ay5a";
diff --git a/pkgs/data/misc/nixos-artwork/wallpapers.nix b/pkgs/data/misc/nixos-artwork/wallpapers.nix
index 254f13825abc..2eebe61b142e 100644
--- a/pkgs/data/misc/nixos-artwork/wallpapers.nix
+++ b/pkgs/data/misc/nixos-artwork/wallpapers.nix
@@ -29,7 +29,7 @@ in
     name = "gnome-dark-2015-02-27";
     description = "Gnome Dark background for Nix";
     src = fetchurl {
-      url = https://raw.githubusercontent.com/Nix/nixos-artwork/7ece5356398db14b5513392be4b31f8aedbb85a2/gnome/Gnome_Dark.png;
+      url = https://raw.githubusercontent.com/NixOS/nixos-artwork/7ece5356398db14b5513392be4b31f8aedbb85a2/gnome/Gnome_Dark.png;
       sha256 = "0c7sl9k4zdjwvdz3nhlm8i4qv4cjr0qagalaa1a438jigixx27l7";
     };
   };
diff --git a/pkgs/development/compilers/openjdk/8.nix b/pkgs/development/compilers/openjdk/8.nix
index 0f0b42640c5d..d03443479699 100644
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@@ -97,6 +97,7 @@ let
       chmod +x configure
       substituteInPlace configure --replace /bin/bash "$shell"
       substituteInPlace hotspot/make/linux/adlc_updater --replace /bin/sh "$shell"
+      substituteInPlace hotspot/make/linux/makefiles/dtrace.make --replace /usr/include/sys/sdt.h "/no-such-path"
     '';
 
     configureFlags = [
diff --git a/pkgs/development/libraries/hspell/dicts.nix b/pkgs/development/libraries/hspell/dicts.nix
index fd456ca6209b..ec6b304dc3ce 100644
--- a/pkgs/development/libraries/hspell/dicts.nix
+++ b/pkgs/development/libraries/hspell/dicts.nix
@@ -4,6 +4,7 @@ let
   dict = a: stdenv.mkDerivation ({
     inherit (hspell) src patchPhase nativeBuildInputs;
     meta = hspell.meta // {
+      broken = true;
       description = "${a.buildFlags} Hebrew dictionary";
     } // (if a ? meta then a.meta else {});
   } // (removeAttrs a ["meta"]));
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 85b4d5627201..0443d00a258d 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -90,9 +90,14 @@ stdenv.mkDerivation rec {
       done
     '');
 
-  # This prevents cmake from using libraries in impure paths (which causes build failure on non NixOS)
+  # This prevents cmake from using libraries in impure paths (which
+  # causes build failure on non NixOS)
+  # Also, work around https://github.com/NixOS/nixpkgs/issues/26304 with
+  # what appears to be some stray headers in dnn/misc/tensorflow
+  # in contrib when generating the Python bindings:
   postPatch = ''
     sed -i '/Add these standard paths to the search paths for FIND_LIBRARY/,/^\s*$/{d}' CMakeLists.txt
+    sed -i -e 's|if len(decls) == 0:|if len(decls) == 0 or "opencv2/" not in hdr:|' ./modules/python/src2/gen2.py
   '';
 
   preConfigure =
diff --git a/pkgs/development/ruby-modules/bundled-common/default.nix b/pkgs/development/ruby-modules/bundled-common/default.nix
index 1bf6257f6559..64a88d8f7b83 100644
--- a/pkgs/development/ruby-modules/bundled-common/default.nix
+++ b/pkgs/development/ruby-modules/bundled-common/default.nix
@@ -61,7 +61,7 @@ let
 
   copyIfBundledByPath = { bundledByPath ? false, ...}@main:
   (if bundledByPath then
-      assert gemFiles.gemdir != null; "cp -a ${gemFiles.gemdir}/* $out/"
+      assert gemFiles.gemdir != null; "cp -a ${gemFiles.gemdir}/* $out/" #*/
     else ""
   );
 
@@ -109,11 +109,10 @@ let
     meta = { platforms = ruby.meta.platforms; } // meta;
 
     passthru = rec {
-      inherit ruby bundler gems mainGem confFiles envPaths;
+      inherit ruby bundler gems confFiles envPaths;
 
-      wrappedRuby =
-      stdenv.mkDerivation {
-        name = "wrapped-ruby-${pname}";
+      wrappedRuby = stdenv.mkDerivation {
+        name = "wrapped-ruby-${pname'}";
         nativeBuildInputs = [ makeWrapper ];
         buildCommand = ''
           mkdir -p $out/bin
@@ -137,7 +136,7 @@ let
           require 'bundler/setup'
         '';
         in stdenv.mkDerivation {
-          name = "${pname}-interactive-environment";
+          name = "${pname'}-interactive-environment";
           nativeBuildInputs = [ wrappedRuby basicEnv ];
           shellHook = ''
             export OLD_IRBRC=$IRBRC
diff --git a/pkgs/development/tools/build-managers/sbt/default.nix b/pkgs/development/tools/build-managers/sbt/default.nix
index cf9b42abefd2..8d121b28c956 100644
--- a/pkgs/development/tools/build-managers/sbt/default.nix
+++ b/pkgs/development/tools/build-managers/sbt/default.nix
@@ -2,11 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "sbt-${version}";
-  version = "0.13.15";
+  version = "0.13.16";
 
   src = fetchurl {
-    url = "https://dl.bintray.com/sbt/native-packages/sbt/${version}/${name}.tgz";
-    sha256 = "1vvsxpg1fwfzv3mcin69gnj44v6p7kfx3z9cm761sx01qbbp7q5n";
+    urls = [
+      "https://dl.bintray.com/sbt/native-packages/sbt/${version}/${name}.tgz"
+      "https://cocl.us/sbt01316tgz"
+    ];
+    sha256 = "033nvklclvbirhpsiy28d3ccmbm26zcs9vb7j8jndsc1ln09awi2";
   };
 
   patchPhase = ''
diff --git a/pkgs/os-specific/linux/acpi-call/default.nix b/pkgs/os-specific/linux/acpi-call/default.nix
index 65223a32bad6..fe8c0b65bb73 100644
--- a/pkgs/os-specific/linux/acpi-call/default.nix
+++ b/pkgs/os-specific/linux/acpi-call/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, kernel }:
+{ stdenv, fetchgit, fetchpatch, kernel }:
 
 stdenv.mkDerivation {
   name = "acpi-call-${kernel.version}";
@@ -9,6 +9,13 @@ stdenv.mkDerivation {
     sha256 = "0jl19irz9x9pxab2qp4z8c3jijv2m30zhmnzi6ygbrisqqlg4c75";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mkottman/acpi_call/pull/67.patch";
+      sha256 = "0z07apvdl8nvl8iwfk1sl1iidfjyx12fc0345bmp2nq1537kpbri";
+    })
+  ];
+
   hardeningDisable = [ "pic" ];
 
   preBuild = ''
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 5447f13abc4c..2548e33bf4cf 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -27,11 +27,11 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "busybox-1.27.0";
+  name = "busybox-1.27.1";
 
   src = fetchurl {
     url = "http://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "1kcr0jvik0c31ls4f3li359xv7w0b60hv64fknj28bwlkdgbvpx5";
+    sha256 = "0dprylmcignrp29g41nkwr1b30v7i5x21lwymp3b93i1zd9sr468";
   };
 
   hardeningDisable = [ "format" ] ++ lib.optional enableStatic [ "fortify" ];
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 63e2e4ef493c..ef6a538af79a 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -6,11 +6,11 @@ assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "3.10";
 let
   name = "wireguard-${version}";
 
-  version = "0.0.20170706";
+  version = "0.0.20170726";
 
   src = fetchurl {
     url    = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "0cvc2iv1836l6f0c3v3kqn3zqrr80i123f1cz5kilhk5c91vjqsp";
+    sha256 = "1nq1h9k1kf6p28ykids5mmdq50q6zpj0ylhsf94q1hjydcmlb4fv";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/servers/atlassian/confluence.nix b/pkgs/servers/atlassian/confluence.nix
index 20b7250d75df..3c1cdda8361f 100644
--- a/pkgs/servers/atlassian/confluence.nix
+++ b/pkgs/servers/atlassian/confluence.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "atlassian-confluence-${version}";
-  version = "6.2.2";
+  version = "6.3.1";
 
   src = fetchurl {
     url = "https://www.atlassian.com/software/confluence/downloads/binary/${name}.tar.gz";
-    sha256 = "1fpn799382m8x7b0s3w4mxzlhy1s62ya287i622gbadqscprhagg";
+    sha256 = "0f7hc8q4sigvr9bdxx8phnp6bkfkz9bccwkrx0xqyrvvdc5x5690";
   };
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" ];
diff --git a/pkgs/servers/atlassian/jira.nix b/pkgs/servers/atlassian/jira.nix
index 48678804c566..bd044975f224 100644
--- a/pkgs/servers/atlassian/jira.nix
+++ b/pkgs/servers/atlassian/jira.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "atlassian-jira-${version}";
-  version = "7.3.7";
+  version = "7.4.1";
 
   src = fetchurl {
     url = "https://downloads.atlassian.com/software/jira/downloads/atlassian-jira-software-${version}.tar.gz";
-    sha256 = "1ixnnw3yj2ip9ndr9pwxcmdy8gaixkmp517ahg3w8xzymr8wh2qp";
+    sha256 = "1ixkhc206z3zpiaj46v8z2gxmix24sxqs2d17fb64gkyml9s5gqb";
   };
 
   phases = [ "unpackPhase" "buildPhase" "installPhase" "fixupPhase" ];
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index 87efc41b1d68..e5f4ada33010 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -26,6 +26,15 @@ stdenv.mkDerivation rec {
     sed -i "s:/usr/bin/file:${file}/bin/file:g" configure
   '';
 
+  postInstall = ''
+    mkdir -p "$out/share/lighttpd/doc/config"
+    cp -vr doc/config "$out/share/lighttpd/doc/"
+    # Remove files that references needless store paths (dependency bloat)
+    rm "$out/share/lighttpd/doc/config/Makefile"*
+    rm "$out/share/lighttpd/doc/config/conf.d/Makefile"*
+    rm "$out/share/lighttpd/doc/config/vhosts.d/Makefile"*
+  '';
+
   meta = with stdenv.lib; {
     description = "Lightweight high-performance web server";
     homepage = http://www.lighttpd.net/;
diff --git a/pkgs/servers/sql/postgresql/pg_repack/default.nix b/pkgs/servers/sql/postgresql/pg_repack/default.nix
index 9a6410490c54..0a25b314506b 100644
--- a/pkgs/servers/sql/postgresql/pg_repack/default.nix
+++ b/pkgs/servers/sql/postgresql/pg_repack/default.nix
@@ -1,16 +1,17 @@
 { stdenv, fetchFromGitHub, postgresql, openssl, zlib, readline }:
 
 stdenv.mkDerivation rec {
-    name = "pg_repack-${version}";
-    version = "1.3.4";
+    name = "pg_repack-${version}.1";
+    version = "1.4.0";
+    rev = "ver_${version}.1";
 
     buildInputs = [ postgresql openssl zlib readline ];
 
     src = fetchFromGitHub {
       owner = "reorg";
       repo = "pg_repack";
-      rev = "ver_${version}";
-      sha256 = "1hig4x8iycchlp42q8565jzi6hkj8gpbhl9kpn73jvk7afl7z0c8";
+      inherit rev;
+      sha256 = "1ym2dlhgcizyy4p5dcfw7kadrq6g34pv3liyfx604irprzhw9k74";
     };
 
     installPhase = ''
diff --git a/pkgs/tools/graphics/facedetect/default.nix b/pkgs/tools/graphics/facedetect/default.nix
new file mode 100644
index 000000000000..02a3a70fe516
--- /dev/null
+++ b/pkgs/tools/graphics/facedetect/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchFromGitHub, python2Packages }:
+
+stdenv.mkDerivation rec {
+  name = "facedetect-${version}";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "wavexx";
+    repo = "facedetect";
+    rev = "v${version}";
+    sha256 = "0mddh71cjbsngpvjli406ndi2x613y39ydgb8bi4z1jp063865sd";
+  };
+
+  buildInputs = [ python2Packages.python python2Packages.wrapPython ];
+  pythonPath = [ python2Packages.numpy python2Packages.opencv ];
+
+  phases = [ "unpackPhase" "patchPhase" "installPhase" ];
+
+  patchPhase = ''
+    substituteInPlace facedetect \
+      --replace /usr/share/opencv "${python2Packages.opencv}/share/OpenCV"
+  '';
+
+  installPhase = ''
+    install -v -m644 -D README.rst $out/share/doc/${name}/README.rst
+    install -v -m755 -D facedetect $out/bin/facedetect
+    wrapPythonPrograms
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://www.thregr.org/~wavexx/software/facedetect/;
+    description = "A simple face detector for batch processing";
+    license = licenses.gpl2Plus;
+    platforms = platforms.all;
+    maintainers = [ maintainers.rycee ];
+  };
+}
diff --git a/pkgs/tools/graphics/fgallery/default.nix b/pkgs/tools/graphics/fgallery/default.nix
index 4b263b555d21..424cf5c1bdc6 100644
--- a/pkgs/tools/graphics/fgallery/default.nix
+++ b/pkgs/tools/graphics/fgallery/default.nix
@@ -1,24 +1,22 @@
-{ stdenv, fetchurl, unzip, makeWrapper, perl, ImageExifTool, JSON
-, coreutils, zip, imagemagick, pngcrush, lcms2, fbida
-}:
+{ stdenv, fetchurl, unzip, makeWrapper, perl, ImageExifTool
+, CpanelJSONXS, coreutils, zip, imagemagick, pngcrush, lcms2
+, facedetect, fbida }:
 
 # TODO: add optional dependencies (snippet from fgallery source):
 #
 # if(system("jpegoptim -V >/dev/null 2>&1")) {
 #   $jpegoptim = 0;
 # }
-# if($facedet && system("facedetect -h >/dev/null 2>&1")) {
-#   fatal("cannot run \"facedetect\" (see http://www.thregr.org/~wavexx/hacks/facedetect/)");
 
 stdenv.mkDerivation rec {
-  name = "fgallery-1.8";
+  name = "fgallery-1.8.2";
 
   src = fetchurl {
     url = "http://www.thregr.org/~wavexx/software/fgallery/releases/${name}.zip";
-    sha256 = "1n237sk7fm4yrpn69qaz9fwbjl6i94y664q7d16bhngrcil3bq1d";
+    sha256 = "18wlvqbxcng8pawimbc8f2422s8fnk840hfr6946lzsxr0ijakvf";
   };
 
-  buildInputs = [ unzip makeWrapper perl ImageExifTool JSON ];
+  buildInputs = [ unzip makeWrapper perl ImageExifTool CpanelJSONXS ];
 
   installPhase = ''
     mkdir -p "$out/bin"
@@ -35,7 +33,7 @@ stdenv.mkDerivation rec {
     wrapProgram "$out/share/fgallery/fgallery" \
         --set PERL5LIB "$PERL5LIB" \
         --set PATH "${stdenv.lib.makeBinPath
-                     [ coreutils zip imagemagick pngcrush lcms2 fbida ]}"
+                     [ coreutils zip imagemagick pngcrush lcms2 facedetect fbida ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/graphics/maim/default.nix b/pkgs/tools/graphics/maim/default.nix
index 39933e70e39f..791f1bf09e10 100644
--- a/pkgs/tools/graphics/maim/default.nix
+++ b/pkgs/tools/graphics/maim/default.nix
@@ -1,22 +1,22 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig
 , zlib, libpng, libjpeg
-, mesa, glm, libX11, libXext, libXfixes, libXrandr, libXcomposite, slop }:
+, mesa, glm, libX11, libXext, libXfixes, libXrandr, libXcomposite, slop, icu }:
 
 stdenv.mkDerivation rec {
   name = "maim-${version}";
-  version = "5.4.64";
+  version = "5.4.65";
 
   src = fetchFromGitHub {
     owner = "naelstrof";
     repo = "maim";
     rev = "v${version}";
-    sha256 = "16ipqs4s5hn7a7380n8w1ijj26d9n356bqwl1h8z5i1skbj4w7hj";
+    sha256 = "0jkvsqzwsb986bm424xpfj73d46afkvbimf1ipdss2vg2y77vmj3";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs =
     [ zlib libpng libjpeg mesa glm libX11 libXext libXfixes libXrandr
-      libXcomposite slop ];
+      libXcomposite slop icu ];
 
   doCheck = false;
 
diff --git a/pkgs/tools/misc/slop/default.nix b/pkgs/tools/misc/slop/default.nix
index d2bf060edd08..570c2f260dd2 100644
--- a/pkgs/tools/misc/slop/default.nix
+++ b/pkgs/tools/misc/slop/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "slop-${version}";
-  version = "6.3.47";
+  version = "6.3.48";
 
   src = fetchFromGitHub {
     owner = "naelstrof";
     repo = "slop";
     rev = "v${version}";
-    sha256 = "05saxp5z2saq6b5hslxdc5kd7ln00svr5pazabcnchzydfhnkmsd";
+    sha256 = "152xnisdbwx2zh1wzspy8djm937d1cm9zvcz1x22z8ia50ajm107";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0c04cd248841..971c939957aa 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -997,6 +997,8 @@ with pkgs;
 
   f3 = callPackage ../tools/filesystems/f3 { };
 
+  facedetect = callPackage ../tools/graphics/facedetect { };
+
   facter = callPackage ../tools/system/facter {
     boost = boost160;
   };
@@ -1909,7 +1911,7 @@ with pkgs;
   ferm = callPackage ../tools/networking/ferm { };
 
   fgallery = callPackage ../tools/graphics/fgallery {
-    inherit (perlPackages) ImageExifTool JSON;
+    inherit (perlPackages) ImageExifTool CpanelJSONXS;
   };
 
   flannel = callPackage ../tools/networking/flannel { };
@@ -13452,9 +13454,7 @@ with pkgs;
 
   batti = callPackage ../applications/misc/batti { };
 
-  baudline = callPackage ../applications/audio/baudline {
-    jack = jack1;
-  };
+  baudline = callPackage ../applications/audio/baudline { };
 
 
   bazaar = callPackage ../applications/version-management/bazaar { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e7234018508e..0ce439376853 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -2483,6 +2483,18 @@ let self = _self // overrides; _self = with self; {
     };
   };
 
+  CpanelJSONXS = buildPerlPackage rec {
+    name = "Cpanel-JSON-XS-3.0237";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/${name}.tar.gz";
+      sha256 = "da86fffdbe6c1b7a023e95e2b8db7d6b45a08871c8312f23e45253c78e662d07";
+    };
+    meta = {
+      description = "CPanel fork of JSON::XS, fast and correct serializing";
+      license = with stdenv.lib.licenses; [ artistic1 gpl1Plus ];
+    };
+  };
+
   CPANChanges = buildPerlPackage rec {
     name = "CPAN-Changes-0.400002";
     src = fetchurl {