diff --git a/doc/stdenv.xml b/doc/stdenv.xml
index 6ec5c9f2814f..a2530e102ca8 100644
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@@ -1111,6 +1111,34 @@ functions.</para>
 <variablelist>
 
 
+  <varlistentry xml:id='fun-makeWrapper'>
+    <term><function>makeWrapper</function>
+    <replaceable>executable</replaceable>
+    <replaceable>wrapperfile</replaceable>
+    <replaceable>args</replaceable></term>
+    <listitem><para>Constructs a wrapper for a program with various
+    possible arguments. For example:
+
+<programlisting>
+# adds `FOOBAR=baz` to `$out/bin/foo`’s environment
+makeWrapper $out/bin/foo $wrapperfile --set FOOBAR baz
+
+# prefixes the binary paths of `hello` and `git`
+# Be advised that paths often should be patched in directly
+# (via string replacements or in `configurePhase`).
+makeWrapper $out/bin/foo $wrapperfile --prefix PATH : ${lib.makeBinPath [ hello git ]}
+</programlisting>
+
+    There’s many more kinds of arguments, they are documented in
+    <literal>nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh</literal>.</para>
+
+    <para><literal>wrapProgram</literal> is a convenience function you probably
+    want to use most of the time.</para>
+
+    </listitem>
+  </varlistentry>
+  
+
   <varlistentry xml:id='fun-substitute'>
     <term><function>substitute</function>
     <replaceable>infile</replaceable>
@@ -1268,6 +1296,22 @@ someVar=$(stripHash $name)
 
     </para></listitem>
   </varlistentry>
+  
+
+  <varlistentry xml:id='fun-wrapProgram'>
+    <term><function>wrapProgram</function>
+    <replaceable>executable</replaceable>
+    <replaceable>makeWrapperArgs</replaceable></term>
+    <listitem><para>Convenience function for <literal>makeWrapper</literal>
+    that automatically creates a sane wrapper file
+
+    It takes all the same arguments as <literal>makeWrapper</literal>,
+    except for <literal>--argv0</literal>.</para>
+
+    <para>It cannot be applied multiple times, since it will overwrite the wrapper
+    file.</para>
+    </listitem>
+  </varlistentry>
 
 
 </variablelist>
diff --git a/pkgs/applications/networking/irc/hexchat/default.nix b/pkgs/applications/networking/irc/hexchat/default.nix
index 80eea8219be2..f8acc1807000 100644
--- a/pkgs/applications/networking/irc/hexchat/default.nix
+++ b/pkgs/applications/networking/irc/hexchat/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, gtk2, lua, perl, python
+{ stdenv, fetchFromGitHub, pkgconfig, gtk2, lua, perl, python2
 , libtool, pciutils, dbus_glib, libcanberra_gtk2, libproxy
 , libsexy, enchant, libnotify, openssl, intltool
 , desktop_file_utils, hicolor_icon_theme
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gtk2 lua perl python pciutils dbus_glib libcanberra_gtk2 libproxy
+    gtk2 lua perl python2 pciutils dbus_glib libcanberra_gtk2 libproxy
     libsexy libnotify openssl desktop_file_utils hicolor_icon_theme
   ];
 
diff --git a/pkgs/build-support/setup-hooks/make-wrapper.sh b/pkgs/build-support/setup-hooks/make-wrapper.sh
index d922db5ccf58..4f55493ae483 100644
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@@ -1,8 +1,28 @@
+# construct an executable file that wraps the actual executable
+# makeWrapper EXECUTABLE ARGS
+
+# ARGS:
+# --argv0 NAME      : set name of executed process to NAME
+#                     (otherwise it’s called …-wrapped)
+# --set   VAR VAL   : add VAR with value VAL to the executable’s environment
+# --unset VAR       : remove VAR from the environment
+# --run   COMMAND   : run command before the executable
+#                     The command can push extra flags to a magic list variable
+#                     extraFlagsArray, which are then added to the invocation
+#                     of the executable
+# --add-flags FLAGS : add FLAGS to invocation of executable
+
+# --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
+# --suffix
+# --suffix-each     ENV SEP VALS  : like --suffix, but VALS is a list
+# --prefix-contents ENV SEP FILES : like --suffix-each, but contents of FILES
+#                                   are read first and used as VALS
+# --suffix-contents
 makeWrapper() {
     local original=$1
     local wrapper=$2
     local params varName value command separator n fileNames
-    local argv0 flagsBefore flags
+    local argv0 flagsBefore flags extraFlagsArray
 
     mkdir -p "$(dirname $wrapper)"
 
diff --git a/pkgs/data/fonts/redhat-liberation-fonts/default.nix b/pkgs/data/fonts/redhat-liberation-fonts/default.nix
index e9462f7a551b..a0511c6a353d 100644
--- a/pkgs/data/fonts/redhat-liberation-fonts/default.nix
+++ b/pkgs/data/fonts/redhat-liberation-fonts/default.nix
@@ -1,6 +1,8 @@
-{stdenv, fetchurl, fontforge, pythonPackages, python}:
+{stdenv, fetchurl, fontforge, python2}:
 
 let
+  inherit (python2.pkgs) fonttools;
+
   common =
     {version, url, sha256, buildInputs}:
     stdenv.mkDerivation rec {
@@ -47,7 +49,7 @@ in {
     version = "1.07.4";
     url = "https://fedorahosted.org/releases/l/i/liberation-fonts/liberation-fonts-${version}.tar.gz";
     sha256 = "01jlg88q2s6by7qv6fmnrlx0lwjarrjrpxv811zjz6f2im4vg65d";
-    buildInputs = [ fontforge pythonPackages.fonttools python ];
+    buildInputs = [ fontforge fonttools ];
   };
   liberation_ttf_v1_binary = common rec {
     version = "1.07.4";
@@ -59,7 +61,7 @@ in {
     version = "2.00.1";
     url = "https://fedorahosted.org/releases/l/i/liberation-fonts/liberation-fonts-${version}.tar.gz";
     sha256 = "1ymryvd2nw4jmw4w5y1i3ll2dn48rpkqzlsgv7994lk6qc9cdjvs";
-    buildInputs = [ fontforge pythonPackages.fonttools python ];
+    buildInputs = [ fontforge fonttools ];
   };
   liberation_ttf_v2_binary = common rec {
     version = "2.00.1";
@@ -67,4 +69,4 @@ in {
     sha256 = "010m4zfqan4w04b6bs9pm3gapn9hsb18bmwwgp2p6y6idj52g43q";
     buildInputs = [ ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index a0def65d5313..e6f990113ccc 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -544,7 +544,7 @@ stdenv.mkDerivation ({
 }
 
 # Strip kills static libs of other archs (hence cross != null)
-// optionalAttrs (!stripped || cross != null) { dontStrip = true; NIX_STRIP_DEBUG = 0; }
+// optionalAttrs (!stripped || cross != null) { dontStrip = true; }
 
 // optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
 )
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index 4b53bc35599f..eb03148a4b8d 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -551,7 +551,7 @@ stdenv.mkDerivation ({
 }
 
 # Strip kills static libs of other archs (hence cross != null)
-// optionalAttrs (!stripped || cross != null) { dontStrip = true; NIX_STRIP_DEBUG = 0; }
+// optionalAttrs (!stripped || cross != null) { dontStrip = true; }
 
 // optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
 
diff --git a/pkgs/development/compilers/gcc/5/default.nix b/pkgs/development/compilers/gcc/5/default.nix
index 3d75c0e76daa..1721eba325bf 100644
--- a/pkgs/development/compilers/gcc/5/default.nix
+++ b/pkgs/development/compilers/gcc/5/default.nix
@@ -547,7 +547,7 @@ stdenv.mkDerivation ({
 }
 
 # Strip kills static libs of other archs (hence cross != null)
-// optionalAttrs (!stripped || cross != null) { dontStrip = true; NIX_STRIP_DEBUG = 0; }
+// optionalAttrs (!stripped || cross != null) { dontStrip = true; }
 
 // optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
 )
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index 3edfb177b118..c6fac16a76ca 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -545,7 +545,7 @@ stdenv.mkDerivation ({
 }
 
 # Strip kills static libs of other archs (hence cross != null)
-// optionalAttrs (!stripped || cross != null) { dontStrip = true; NIX_STRIP_DEBUG = 0; }
+// optionalAttrs (!stripped || cross != null) { dontStrip = true; }
 
 // optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
 )
diff --git a/pkgs/development/interpreters/python/cpython/3.4/default.nix b/pkgs/development/interpreters/python/cpython/3.4/default.nix
index e081a60c6bc4..66bdd2a42270 100644
--- a/pkgs/development/interpreters/python/cpython/3.4/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.4/default.nix
@@ -24,7 +24,7 @@ with stdenv.lib;
 
 let
   majorVersion = "3.4";
-  minorVersion = "5";
+  minorVersion = "6";
   minorVersionSuffix = "";
   pythonVersion = majorVersion;
   version = "${majorVersion}.${minorVersion}${minorVersionSuffix}";
@@ -45,7 +45,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://www.python.org/ftp/python/${version}/Python-${version}.tar.xz";
-    sha256 = "12l9klp778wklxmckhghniy5hklss8r26995pyd00qbllk4b2r7f";
+    sha256 = "0h2z248hkf8x1ix1z8npkqs9cq62i322sl4rcjdkp7mawsxjhd7i";
   };
 
   NIX_LDFLAGS = optionalString stdenv.isLinux "-lgcc_s";
diff --git a/pkgs/development/interpreters/python/cpython/3.5/default.nix b/pkgs/development/interpreters/python/cpython/3.5/default.nix
index 92f9d66ea52d..6e0b7614c7cb 100644
--- a/pkgs/development/interpreters/python/cpython/3.5/default.nix
+++ b/pkgs/development/interpreters/python/cpython/3.5/default.nix
@@ -24,7 +24,7 @@ with stdenv.lib;
 
 let
   majorVersion = "3.5";
-  minorVersion = "2";
+  minorVersion = "3";
   minorVersionSuffix = "";
   pythonVersion = majorVersion;
   version = "${majorVersion}.${minorVersion}${minorVersionSuffix}";
@@ -45,7 +45,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.python.org/ftp/python/${majorVersion}.${minorVersion}/Python-${version}.tar.xz";
-    sha256 = "0h6a5fr7ram2s483lh0pnmc4ncijb8llnpfdxdcl5dxr01hza400";
+    sha256 = "1c6v1n9nz4mlx9mw1125fxpmbrgniqdbbx9hnqx44maqazb2mzpf";
   };
 
   NIX_LDFLAGS = optionalString stdenv.isLinux "-lgcc_s";
diff --git a/pkgs/development/libraries/dbus/default.nix b/pkgs/development/libraries/dbus/default.nix
index 509e7dd00c81..7743c1e3f80b 100644
--- a/pkgs/development/libraries/dbus/default.nix
+++ b/pkgs/development/libraries/dbus/default.nix
@@ -9,8 +9,9 @@ let
   version = "1.10.14";
   sha256 = "10x0wvv2ly4lyyfd42k4xw0ar5qdbi9cksw3l5fcwf1y6mq8y8r3";
 
-self =  stdenv.mkDerivation {
+self = stdenv.mkDerivation {
     name = "dbus-${version}";
+    inherit version;
 
     src = fetchurl {
       url = "http://dbus.freedesktop.org/releases/dbus/dbus-${version}.tar.gz";
@@ -49,8 +50,6 @@ self =  stdenv.mkDerivation {
       "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
       "--with-systemduserunitdir=$(out)/etc/systemd/user"
       "--enable-user-session"
-      # this package installs nothing into those dirs and they create a dependency
-      "--datadir=/run/current-system/sw/share"
       "--libexecdir=$(out)/libexec" # we don't need dbus-daemon-launch-helper
     ] ++ lib.optional (!x11Support) "--without-x";
 
@@ -64,7 +63,7 @@ self =  stdenv.mkDerivation {
 
     doCheck = true;
 
-    installFlags = "sysconfdir=$(out)/etc datadir=$(out)/share";
+    installFlags = [ "sysconfdir=$(out)/etc" ];
 
     # it's executed from $lib by absolute path
     postFixup = ''
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 1245381efcd6..6ac8a134b1f5 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -3,14 +3,14 @@
 
 let
   ver_maj = "2.36";
-  ver_min = "3";
+  ver_min = "4";
 in
 stdenv.mkDerivation rec {
   name = "gdk-pixbuf-${ver_maj}.${ver_min}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdk-pixbuf/${ver_maj}/${name}.tar.xz";
-    sha256 = "5223138f7d31afc6b356a049930304ec0abd6ac1113a5d3d1dba5cd4a4d639ec";
+    sha256 = "0b19901c3eb0596141d2d48ddb9dac79ad1524bdf59366af58ab38fcb9ee7463";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
diff --git a/pkgs/development/libraries/gnutls/generic.nix b/pkgs/development/libraries/gnutls/generic.nix
index 67a969b1178e..74737eb23893 100644
--- a/pkgs/development/libraries/gnutls/generic.nix
+++ b/pkgs/development/libraries/gnutls/generic.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ lzo lzip nettle libtasn1 libidn p11_kit zlib gmp autogen ]
+  buildInputs = [ lzo lzip libtasn1 libidn p11_kit zlib gmp autogen ]
     ++ lib.optional doCheck nettools
     ++ lib.optional (stdenv.isFreeBSD || stdenv.isDarwin) libiconv
     ++ lib.optional (tpmSupport && stdenv.isLinux) trousers
@@ -47,6 +47,8 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ perl pkgconfig ] ++ nativeBuildInputs;
 
+  propagatedBuildInputs = [ nettle ];
+
   inherit doCheck;
 
   # Fixup broken libtool and pkgconfig files
diff --git a/pkgs/development/libraries/gtk+/3.x.nix b/pkgs/development/libraries/gtk+/3.x.nix
index 45c21df4696f..bf63c9425ae7 100644
--- a/pkgs/development/libraries/gtk+/3.x.nix
+++ b/pkgs/development/libraries/gtk+/3.x.nix
@@ -13,7 +13,7 @@ with stdenv.lib;
 
 let
   ver_maj = "3.22";
-  ver_min = "6";
+  ver_min = "7";
   version = "${ver_maj}.${ver_min}";
 in
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk+/${ver_maj}/gtk+-${version}.tar.xz";
-    sha256 = "eba75a216a117f4391beb2971ba20ff8a1823f109893f0ab6c2eac2210ea172f";
+    sha256 = "a3a27564bfb1679ebbc75c37cd2bcd6e727c8bdfbcd3984d29305bf9ee60d432";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libclc/default.nix b/pkgs/development/libraries/libclc/default.nix
index de3f51752b9d..289fa20335a0 100644
--- a/pkgs/development/libraries/libclc/default.nix
+++ b/pkgs/development/libraries/libclc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, python, llvm, clang }:
+{ stdenv, fetchFromGitHub, python2, llvm, clang }:
 
 stdenv.mkDerivation {
   name = "libclc-2015-08-07";
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "10n9qk1dild9yjkjjkzpmp9zid3ysdgvqrad554azcf755frch7g";
   };
 
-  buildInputs = [ python llvm clang ];
+  buildInputs = [ python2 llvm clang ];
 
   postPatch = ''
     sed -i 's,llvm_clang =.*,llvm_clang = "${clang}/bin/clang",' configure.py
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   '';
 
   configurePhase = ''
-    python2 ./configure.py --prefix=$out
+    ${python2.interpreter} ./configure.py --prefix=$out
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/libctemplate/default.nix b/pkgs/development/libraries/libctemplate/default.nix
index d2c202b970a1..cdaeb4969ae4 100644
--- a/pkgs/development/libraries/libctemplate/default.nix
+++ b/pkgs/development/libraries/libctemplate/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, python }:
+{ stdenv, fetchurl, python2 }:
 
 stdenv.mkDerivation rec {
   name = "ctemplate-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0mi5g2xlws10z1g4x0cj6kd1r673kkav35pgzyqxa1w47xnwprcr";
   };
 
-  buildInputs = [ python ];
+  buildInputs = [ python2 ];
 
   postPatch = ''
     patchShebangs .
diff --git a/pkgs/development/libraries/libdrm/default.nix b/pkgs/development/libraries/libdrm/default.nix
index 3dddd1384388..3dfbdd7040f2 100644
--- a/pkgs/development/libraries/libdrm/default.nix
+++ b/pkgs/development/libraries/libdrm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libpthreadstubs, libpciaccess, valgrind }:
 
 stdenv.mkDerivation rec {
-  name = "libdrm-2.4.74";
+  name = "libdrm-2.4.75";
 
   src = fetchurl {
     url = "http://dri.freedesktop.org/libdrm/${name}.tar.bz2";
-    sha256 = "d80dd5a76c401f4c8756dcccd999c63d7e0a3bad258d96a829055cfd86ef840b";
+    sha256 = "2d5a500eef412cc287d12268eed79d571e262d4957a2ec9258073f305985054f";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/development/libraries/libimobiledevice/default.nix b/pkgs/development/libraries/libimobiledevice/default.nix
index cfc31c120b45..cef9cc0af6b2 100644
--- a/pkgs/development/libraries/libimobiledevice/default.nix
+++ b/pkgs/development/libraries/libimobiledevice/default.nix
@@ -1,10 +1,10 @@
-{ stdenv, fetchurl, fetchpatch, python, pkgconfig, usbmuxd, glib, libgcrypt,
+{ stdenv, fetchurl, fetchpatch, python2, pkgconfig, usbmuxd, glib, libgcrypt,
   libtasn1, libplist, readline, libusbmuxd, openssl }:
 
 stdenv.mkDerivation rec {
   name = "libimobiledevice-1.2.0";
 
-  nativeBuildInputs = [ python libplist.swig pkgconfig ];
+  nativeBuildInputs = [ python2 libplist.swig pkgconfig ];
   buildInputs = [ readline ];
   propagatedBuildInputs = [ libusbmuxd glib libgcrypt libtasn1 libplist openssl ];
 
diff --git a/pkgs/development/libraries/libpsl/default.nix b/pkgs/development/libraries/libpsl/default.nix
index a2a19d6217e6..c35c7e1bc0f5 100644
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, autoreconfHook, docbook_xsl, gtk_doc, icu
-, libxslt, pkgconfig, python }:
+, libxslt, pkgconfig, python2 }:
 
 let
 
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
   };
 
   buildInputs = [ icu libxslt ];
-  nativeBuildInputs = [ autoreconfHook docbook_xsl gtk_doc pkgconfig python ];
+  nativeBuildInputs = [ autoreconfHook docbook_xsl gtk_doc pkgconfig python2 ];
 
   postPatch = ''
     substituteInPlace src/psl.c --replace bits/stat.h sys/stat.h
diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix
index 0c1c92a0f6fd..025a2ee37ff5 100644
--- a/pkgs/development/libraries/libssh/default.nix
+++ b/pkgs/development/libraries/libssh/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, cmake, zlib, openssl, libsodium }:
 
 stdenv.mkDerivation rec {
-  name = "libssh-0.7.3";
+  name = "libssh-0.7.4";
 
   src = fetchurl {
-    url = "https://red.libssh.org/attachments/download/195/${name}.tar.xz";
-    sha256 = "165g49i4kmm3bfsjm0n8hm21kadv79g9yjqyq09138jxanz4dvr6";
+    url = "https://red.libssh.org/attachments/download/210/${name}.tar.xz";
+    sha256 = "03bcp9ksqp0s1pmwfmzhcknvkxay5k0mjzzxp3rjlifbng1vxq9r";
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/mapnik/default.nix b/pkgs/development/libraries/mapnik/default.nix
index e5845fee3041..661e1270e7f6 100644
--- a/pkgs/development/libraries/mapnik/default.nix
+++ b/pkgs/development/libraries/mapnik/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchzip
 , boost, cairo, freetype, gdal, harfbuzz, icu, libjpeg, libpng, libtiff
-, libwebp, libxml2, proj, python, scons, sqlite, zlib
+, libwebp, libxml2, proj, python2, scons, sqlite, zlib
 }:
 
 stdenv.mkDerivation rec {
@@ -16,11 +16,11 @@ stdenv.mkDerivation rec {
   # a distinct dev output makes python-mapnik fail
   outputs = [ "out" ];
 
-  nativeBuildInputs = [ python scons ];
+  nativeBuildInputs = [ python2 scons ];
 
   buildInputs =
     [ boost cairo freetype gdal harfbuzz icu libjpeg libpng libtiff
-      libwebp libxml2 proj python sqlite zlib
+      libwebp libxml2 proj python2 sqlite zlib
     ];
 
   configurePhase = ''
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index c4b042545fce..abca82e62979 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -27,7 +27,7 @@ if ! lists.elem stdenv.system platforms.mesaPlatforms then
 else
 
 let
-  version = "13.0.3";
+  version = "13.0.4";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "d9aa8be5c176d00d0cd503cb2f64a5a403ea471ec819c022581414860d7ba40e";
+    sha256 = "a95d7ce8f7bd5f88585e4be3144a341236d8c0fc91f6feaec59bb8ba3120e726";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index dca6483dc84d..5d96299380ed 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, static ? false }:
 
-let version = "1.2.10"; in
+let version = "1.2.11"; in
 
 stdenv.mkDerivation rec {
   name = "zlib-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
       [ "http://www.zlib.net/fossils/${name}.tar.gz"  # stable archive path
         "mirror://sourceforge/libpng/zlib/${version}/${name}.tar.gz"
       ];
-    sha256 = "05w0jwsqib44jz5jazh7cqz311z4g7znnzn6w6v8g1z4iilryzld";
+    sha256 = "c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1";
   };
 
   postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
diff --git a/pkgs/development/tools/pydb/default.nix b/pkgs/development/tools/pydb/default.nix
index 1b5a2ca674f4..e174184835a4 100644
--- a/pkgs/development/tools/pydb/default.nix
+++ b/pkgs/development/tools/pydb/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, python, emacs }:
+{ stdenv, fetchurl, python2, emacs }:
 
 stdenv.mkDerivation {
   name = "pydb-1.26";
@@ -8,14 +8,14 @@ stdenv.mkDerivation {
     sha256 = "1wlkz1hd5d4gkzhkjkzcm650c1lchj28hj36jx96mklglm41h4q1";
   };
 
-  buildInputs = [ python emacs /* emacs is optional */ ];
+  buildInputs = [ python2 emacs /* emacs is optional */ ];
 
   preConfigure = ''
     p="$(toPythonPath $out)"
-    configureFlags="$configureFlags --with-python=${python}/bin/python --with-site-packages=$p"
+    configureFlags="$configureFlags --with-python=${python2.interpreter} --with-site-packages=$p"
   '';
 
-  meta = { 
+  meta = {
     description = "Python debugger with GDB-like commands and Emacs bindings";
     homepage = http://bashdb.sourceforge.net/pydb/;
     license = stdenv.lib.licenses.gpl3;
diff --git a/pkgs/misc/my-env/loadenv.sh b/pkgs/misc/my-env/loadenv.sh
index 816c1b8a7111..1688d2f158fb 100644
--- a/pkgs/misc/my-env/loadenv.sh
+++ b/pkgs/misc/my-env/loadenv.sh
@@ -10,7 +10,6 @@ PATH="$PATH:$OLDPATH"
 export PS1="\n@name@:[\u@\h:\w]\$ "
 export NIX_MYENV_NAME="@name@"
 export buildInputs
-export NIX_STRIP_DEBUG=0
 export TZ="$OLDTZ"
 export http_proxy="$OLD_http_proxy"
 export ftp_proxy="$OLD_ftp_proxy"
diff --git a/pkgs/servers/amqp/qpid-cpp/default.nix b/pkgs/servers/amqp/qpid-cpp/default.nix
index c03ec8eb7f9a..adbf156730eb 100644
--- a/pkgs/servers/amqp/qpid-cpp/default.nix
+++ b/pkgs/servers/amqp/qpid-cpp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, python, boost, libuuid, ruby }:
+{ stdenv, fetchurl, cmake, python2, boost, libuuid, ruby }:
 
 stdenv.mkDerivation rec {
   name = "qpid-cpp-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "07ibwvw5lm7xabv32zai5x03r7l9mxm0zk7h9lbfkzmav0f41w0w";
   };
 
-  buildInputs = [ cmake python boost libuuid ruby ];
+  buildInputs = [ cmake python2 boost libuuid ruby ];
 
   # the subdir managementgen wants to install python stuff in ${python} and
   # the installation tries to create some folders in /var
diff --git a/pkgs/tools/misc/i3minator/default.nix b/pkgs/tools/misc/i3minator/default.nix
index 0b26dbc06e2b..7ffab069779c 100644
--- a/pkgs/tools/misc/i3minator/default.nix
+++ b/pkgs/tools/misc/i3minator/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pythonPackages }:
+{ stdenv, fetchurl, pythonPackages, glibcLocales }:
 
 pythonPackages.buildPythonApplication rec {
   name = "i3minator-${version}";
@@ -9,8 +9,13 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "11dn062788kwfs8k2ry4v8zr2gn40r6lsw770s9g2gvhl5n469dw";
   };
 
+  LC_ALL = "en_US.UTF-8";
+  buildInputs = [ glibcLocales ];
   propagatedBuildInputs = [ pythonPackages.pyyaml pythonPackages.i3-py ];
 
+  # No tests
+  doCheck = false;
+
   meta = with stdenv.lib; {
     description = "i3 project manager similar to tmuxinator";
     longDescription = ''
diff --git a/pkgs/tools/networking/curl/default.nix b/pkgs/tools/networking/curl/default.nix
index a80069974224..de841be3f052 100644
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@@ -4,6 +4,7 @@
 , ldapSupport ? false, openldap ? null
 , zlibSupport ? false, zlib ? null
 , sslSupport ? false, openssl ? null
+, gnutlsSupport ? false, gnutls ? null
 , scpSupport ? false, libssh2 ? null
 , gssSupport ? false, gss ? null
 , c-aresSupport ? false, c-ares ? null
@@ -14,6 +15,8 @@ assert idnSupport -> libidn != null;
 assert ldapSupport -> openldap != null;
 assert zlibSupport -> zlib != null;
 assert sslSupport -> openssl != null;
+assert !(gnutlsSupport && sslSupport);
+assert gnutlsSupport -> gnutls != null;
 assert scpSupport -> libssh2 != null;
 assert c-aresSupport -> c-ares != null;
 
@@ -44,6 +47,7 @@ stdenv.mkDerivation rec {
     optional gssSupport gss ++
     optional c-aresSupport c-ares ++
     optional sslSupport openssl ++
+    optional gnutlsSupport gnutls ++
     optional scpSupport libssh2;
 
   # for the second line see http://curl.haxx.se/mail/tracker-2014-03/0087.html
@@ -56,6 +60,7 @@ stdenv.mkDerivation rec {
       "--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt"
       "--disable-manual"
       ( if sslSupport then "--with-ssl=${openssl.dev}" else "--without-ssl" )
+      ( if gnutlsSupport then "--with-gnutls=${gnutls.dev}" else "--without-gnutls" )
       ( if scpSupport then "--with-libssh2=${libssh2.dev}" else "--without-libssh2" )
       ( if ldapSupport then "--enable-ldap" else "--disable-ldap" )
       ( if ldapSupport then "--enable-ldaps" else "--disable-ldaps" )
@@ -70,6 +75,10 @@ stdenv.mkDerivation rec {
   postInstall = ''
     moveToOutput bin/curl-config "$dev"
     sed '/^dependency_libs/s|${libssh2.dev}|${libssh2.out}|' -i "$out"/lib/*.la
+  '' + stdenv.lib.optionalString gnutlsSupport ''
+    ln $out/lib/libcurl.so $out/lib/libcurl-gnutls.so
+    ln $out/lib/libcurl.so $out/lib/libcurl-gnutls.so.4
+    ln $out/lib/libcurl.so $out/lib/libcurl-gnutls.so.4.4.0
   '';
 
   crossAttrs = {
@@ -77,6 +86,7 @@ stdenv.mkDerivation rec {
     # For the 'urandom', maybe it should be a cross-system option
     configureFlags = [
         ( if sslSupport then "--with-ssl=${openssl.crossDrv}" else "--without-ssl" )
+        ( if gnutlsSupport then "--with-gnutls=${gnutls.crossDrv}" else "--without-gnutls" )
         "--with-random /dev/urandom"
       ];
   };
diff --git a/pkgs/tools/package-management/librepo/default.nix b/pkgs/tools/package-management/librepo/default.nix
index ceef483c8cce..4b9b593655b7 100644
--- a/pkgs/tools/package-management/librepo/default.nix
+++ b/pkgs/tools/package-management/librepo/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, python, pkgconfig, expat, glib, pcre, openssl, curl, check, attr, gpgme }:
+{ stdenv, fetchFromGitHub, cmake, python2, pkgconfig, expat, glib, pcre, openssl, curl, check, attr, gpgme }:
 
 stdenv.mkDerivation rec {
   version = "1.7.18";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
       --replace ' ''${PYTHON_INSTALL_DIR}' " $out/lib/python2.7/site-packages"
   '';
 
-  buildInputs = [ cmake python pkgconfig expat glib pcre openssl curl check attr gpgme ];
+  buildInputs = [ cmake python2 pkgconfig expat glib pcre openssl curl check attr gpgme ];
 
   # librepo/fastestmirror.h includes curl/curl.h, and pkg-config specfile refers to others in here
   propagatedBuildInputs = [ curl gpgme expat ];
diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index ca038b3ccb49..72d632533ffa 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "gnused-${version}";
-  version = "4.3";
+  version = "4.4";
 
   src = fetchurl {
     url = "mirror://gnu/sed/sed-${version}.tar.xz";
-    sha256 = "1anhdgah8h423hlmn9hwzxzr7hjbqjm6hxq3z1p7p7nf8640vhj7";
+    sha256 = "0fv88bcnraixc8jvpacvxshi30p5x9m7yb8ns1hfv07hmb2ypmnb";
   };
 
   outputs = [ "out" "info" ];
diff --git a/pkgs/tools/text/xml/xpf/default.nix b/pkgs/tools/text/xml/xpf/default.nix
index 7d7cd3c49d9b..b35053d362bb 100644
--- a/pkgs/tools/text/xml/xpf/default.nix
+++ b/pkgs/tools/text/xml/xpf/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, python, libxml2}:
+{stdenv, fetchurl, python2, libxml2}:
 
 assert libxml2.pythonSupport == true;
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
     sha256 = "0ljx91w68rnh4871c0xlq2whlmhqz8dr39wcdczfjjpniqz1fmpz";
   };
   
-  buildInputs = [python libxml2];
+  buildInputs = [ python2 libxml2 ];
 
   meta = {
     description = "XML Pipes and Filters - command line tools for manipulating and querying XML data";