diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index 684bb3489b94..4b9fc86f67d1 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -97,6 +97,7 @@
   bradediger = "Brad Ediger <brad@bradediger.com>";
   bramd = "Bram Duvigneau <bram@bramd.nl>";
   bstrik = "Berno Strik <dutchman55@gmx.com>";
+  bugworm = "Roman Gerasimenko <bugworm@zoho.com>";
   bzizou = "Bruno Bzeznik <Bruno@bzizou.net>";
   c0bw3b = "Renaud <c0bw3b@gmail.com>";
   c0dehero = "CodeHero <codehero@nerdpol.ch>";
diff --git a/nixos/modules/services/mail/rspamd.nix b/nixos/modules/services/mail/rspamd.nix
index 6d403e448e04..b80aa48f2c86 100644
--- a/nixos/modules/services/mail/rspamd.nix
+++ b/nixos/modules/services/mail/rspamd.nix
@@ -31,6 +31,8 @@ let
       ${mkBindSockets cfg.bindUISocket}
         .include "$CONFDIR/worker-controller.inc"
       }
+
+      ${cfg.extraConfig}
    '';
 
 in
@@ -79,6 +81,15 @@ in
         '';
       };
 
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Extra configuration to add at the end of the rspamd configuration
+          file.
+        '';
+      };
+
       user = mkOption {
         type = types.string;
         default = "rspamd";
diff --git a/pkgs/applications/audio/gpodder/default.nix b/pkgs/applications/audio/gpodder/default.nix
index 3d074bf1e19e..fb1ed7280308 100644
--- a/pkgs/applications/audio/gpodder/default.nix
+++ b/pkgs/applications/audio/gpodder/default.nix
@@ -1,65 +1,66 @@
-{ stdenv, fetchurl, fetchpatch, python2Packages, mygpoclient, intltool
+{ stdenv, fetchFromGitHub, python3, python3Packages, intltool
+, glibcLocales, gnome3, gtk3, wrapGAppsHook
 , ipodSupport ? false, libgpod
-, gnome3
 }:
 
-python2Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   name = "gpodder-${version}";
+  version = "3.10.0";
 
-  version = "3.9.3";
+  format = "other";
 
-  src = fetchurl {
-    url = "http://gpodder.org/src/${name}.tar.gz";
-    sha256 = "1s83m90dic2zphwwv6wrvqx950y12v5sakm7q5nj5bnh5k9l2hgl";
+  src = fetchFromGitHub {
+    owner = "gpodder";
+    repo = "gpodder";
+    rev = version;
+    sha256 = "0f3m1kcj641xiwsxan66k81lvslkl3aziakn5z17y4mmdci79jv0";
   };
 
-  patches = [
-    (fetchpatch {
-     sha256 = "1xkl1wnp46546jrzsnb9p0yj23776byg3nvsqwbblhqbsfipl48w";
-     name = "Fix-soundcloud-feeds.patch";
-     url = "https://github.com/gpodder/gpodder/commit/e7f34ad090cd276d75c0cd8d92ed97243d75db38.patch";
-    })
-    (fetchpatch {
-     sha256 = "1jlldbinlxis1pi9p2lyczgbcv8nmdj66fxll6ph0klln0w8gvg4";
-     name = "use-https-urls-for-soundcloud.patch";
-     url = "https://github.com/gpodder/gpodder/commit/ef915dd3b6828174bf4f6f0911da410d9aca1b67.patch";
-    })
-    (fetchpatch {
-     sha256 = "1l37ihzk7gfqcl5nnphv0sv80psm6fsg4qkxn6abc6v476axyj9b";
-     name = "updates-soundcloud-support-to-recognize-https";
-     url = "https://github.com/gpodder/gpodder/commit/5c1507671d93096ad0118f908c20dd1f182a72e0.patch";
-    })
-  ];
-
   postPatch = with stdenv.lib; ''
     sed -i -re 's,^( *gpodder_dir *= *).*,\1"'"$out"'",' bin/gpodder
-
-    makeWrapperArgs="--suffix XDG_DATA_DIRS : '${concatStringsSep ":" [
-      "${gnome3.gnome_themes_standard}/share"
-      "$XDG_ICON_DIRS"
-      "$GSETTINGS_SCHEMAS_PATH"
-    ]}'"
   '';
 
-  buildInputs = [
-    intltool python2Packages.coverage python2Packages.minimock
-    gnome3.gnome_themes_standard gnome3.defaultIconTheme
-    gnome3.gsettings_desktop_schemas
+  nativeBuildInputs = [
+    intltool
+    python3Packages.wrapPython
+    wrapGAppsHook
+    glibcLocales
   ];
 
-  propagatedBuildInputs = with python2Packages; [
-    feedparser dbus-python mygpoclient pygtk eyeD3 podcastparser html5lib
+  buildInputs = [
+    python3
+  ];
+
+  checkInputs = with python3Packages; [
+    coverage minimock
+  ];
+
+  doCheck = true;
+
+  propagatedBuildInputs = with python3Packages; [
+    feedparser
+    dbus-python
+    mygpoclient
+    pygobject3
+    eyeD3
+    podcastparser
+    html5lib
+    gtk3
   ] ++ stdenv.lib.optional ipodSupport libgpod;
 
+  makeFlags = [
+    "PREFIX=$(out)"
+    "share/applications/gpodder-url-handler.desktop"
+    "share/applications/gpodder.desktop"
+    "share/dbus-1/services/org.gpodder.service"
+  ];
+
   preBuild = ''
-    make PREFIX="$out" \
-      share/applications/gpodder-url-handler.desktop \
-      share/applications/gpodder.desktop \
-      share/dbus-1/services/org.gpodder.service
+    export LC_ALL="en_US.UTF-8"
   '';
 
-  checkPhase = ''
-    LC_ALL=C python -m gpodder.unittests
+  installCheckPhase = ''
+    LC_ALL=C PYTHONPATH=./src:$PYTHONPATH python3 -m gpodder.unittests
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/editors/vscode/default.nix b/pkgs/applications/editors/vscode/default.nix
index f997de0e7675..15477c5c7d45 100644
--- a/pkgs/applications/editors/vscode/default.nix
+++ b/pkgs/applications/editors/vscode/default.nix
@@ -2,7 +2,7 @@
   makeWrapper, libXScrnSaver, libxkbfile, libsecret }:
 
 let
-  version = "1.19.0";
+  version = "1.19.1";
   channel = "stable";
 
   plat = {
@@ -12,9 +12,9 @@ let
   }.${stdenv.system};
 
   sha256 = {
-    "i686-linux" = "036mdmma3b7iwinq1g6pxsn8vwx977hmjy3b4b0m84023phwm2x7";
-    "x86_64-linux" = "089j9plq96d2px56gh1q4m9dhclb5xy0ca4b97rnnpdw93hhx94n";
-    "x86_64-darwin" = "1q37bak2m966kfa5a87nzalnpa205gkjvb4zf1klmqipwqq4wm4d";
+    "i686-linux" = "0ypx1jrzg76f8p4yh9hi3bhsrc6w4r7rg6i2aa6q7s8ny0q9hrlx";
+    "x86_64-linux" = "1934wdiy2d1fzcjxjyf60dw1g1pp3lk2wv41xgrabfy5j2xfz14r";
+    "x86_64-darwin" = "1zbcddgdwvmnk1gpmgw6rz0rswhkfc72wcjdbvgghm4msfwcgvc8";
   }.${stdenv.system};
 
   archive_fmt = if stdenv.system == "x86_64-darwin" then "zip" else "tar.gz";
diff --git a/pkgs/applications/misc/airspy/default.nix b/pkgs/applications/misc/airspy/default.nix
index 211e8fd05411..c015a701ab08 100644
--- a/pkgs/applications/misc/airspy/default.nix
+++ b/pkgs/applications/misc/airspy/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, lib, fetchFromGitHub
 , cmake , pkgconfig, libusb
 }:
 
@@ -22,13 +22,14 @@ in
     nativeBuildInputs = [ cmake pkgconfig ];
     buildInputs = [ libusb ];
 
-    cmakeFlags = [ "-DINSTALL_UDEV_RULES=ON" ];
+    cmakeFlags =
+      lib.optionals stdenv.isLinux [ "-DINSTALL_UDEV_RULES=ON" ];
 
     meta = with stdenv.lib; {
       homepage = http://github.com/airspy/airspyone_host;
       description = "Host tools and driver library for the AirSpy SDR";
       license = licenses.free;
-      platforms = platforms.linux;
+      platforms = with platforms; linux ++ darwin;
       maintainers = with maintainers; [ markuskowa ];
     };
   }
diff --git a/pkgs/applications/misc/mupdf/darwin.patch b/pkgs/applications/misc/mupdf/darwin.patch
new file mode 100644
index 000000000000..e0c7d6a7a676
--- /dev/null
+++ b/pkgs/applications/misc/mupdf/darwin.patch
@@ -0,0 +1,35 @@
+diff --git a/Makerules b/Makerules
+--- a/Makerules
++++ b/Makerules
+@@ -81,22 +81,10 @@ HAVE_GLUT ?= yes
+ SYS_GLUT_CFLAGS := -Wno-deprecated-declarations
+ SYS_GLUT_LIBS := -framework GLUT -framework OpenGL
+ 
+-CC = xcrun cc
+-AR = xcrun ar
+-LD = xcrun ld
+-RANLIB_CMD = xcrun ranlib $@
+-
+-# Linux uses pkg-config for system libraries.
+-else ifeq "$(OS)" "Linux"
+-
+ HAVE_PTHREAD := yes
+ SYS_PTHREAD_CFLAGS :=
+ SYS_PTHREAD_LIBS := -lpthread
+ 
+-HAVE_GLUT := yes
+-SYS_GLUT_CFLAGS :=
+-SYS_GLUT_LIBS := -lglut -lGL
+-
+ ifeq "$(shell pkg-config --exists 'libcrypto <= 1.0.1t' && echo yes)" "yes"
+ HAVE_LIBCRYPTO := yes
+ SYS_LIBCRYPTO_CFLAGS := -DHAVE_LIBCRYPTO $(shell pkg-config --cflags libcrypto)
+@@ -113,7 +101,7 @@ SYS_CURL_CFLAGS += $(shell pkg-config --cflags openssl)
+ SYS_CURL_DEPS += $(shell pkg-config --libs openssl)
+ endif
+ endif
+-SYS_CURL_DEPS += -lpthread -lrt
++SYS_CURL_DEPS += -lpthread
+ 
+ ifeq "$(shell pkg-config --exists x11 xext && echo yes)" "yes"
+ HAVE_X11 := yes
diff --git a/pkgs/applications/misc/mupdf/default.nix b/pkgs/applications/misc/mupdf/default.nix
index 9dcba11b3faf..75d8463cf7f8 100644
--- a/pkgs/applications/misc/mupdf/default.nix
+++ b/pkgs/applications/misc/mupdf/default.nix
@@ -1,7 +1,8 @@
-{ stdenv, lib, fetchurl, fetchpatch, pkgconfig
-, freetype, harfbuzz, openjpeg, jbig2dec, libjpeg
-, enableX11 ? true, libX11, libXext
+{ stdenv, lib, fetchurl, fetchpatch, pkgconfig, freetype, harfbuzz, openjpeg
+, jbig2dec, libjpeg , darwin
+, enableX11 ? true, libX11, libXext, libXi, libXrandr
 , enableCurl ? true, curl, openssl
+, enableGL ? true, freeglut, mesa_glu
 }:
 
 let
@@ -13,64 +14,28 @@ let
 
 
 in stdenv.mkDerivation rec {
-  version = "1.11";
+  version = "1.12.0";
   name = "mupdf-${version}";
 
   src = fetchurl {
     url = "http://mupdf.com/downloads/archive/${name}-source.tar.gz";
-    sha256 = "02phamcchgsmvjnb3ir7r5sssvx9fcrscn297z73b82n1jl79510";
+    sha256 = "0mc7a92zri27lk17wdr2iffarbfi4lvrmxhc53sz84hm5yl56qsw";
   };
 
   patches = [
     # Compatibility with new openjpeg
     (fetchpatch {
-      name = "mupdf-1.11-openjpeg-version.patch";
-      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/0001-mupdf-openjpeg.patch?h=packages/mupdf&id=c19349f42838e4dca02e564b97e0a5ab3e1b943f";
-      sha256 = "0sx7jq84sr8bj6sg2ahg9cdgqz8dh4w6r0ah2yil8vrsznn4la8r";
+      name = "mupdf-1.12-openjpeg-version.patch";
+      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/0001-mupdf-openjpeg.patch?h=packages/mupdf&id=a910cd33a2b311712f83710dc042fbe80c104306";
+      sha256 = "05i9v2ia586jyjqdb7g68ss4vkfwgp6cwhagc8zzggsba83azyqk";
     })
+  ]
 
-    (fetchurl {
-      name = "mupdf-1.11-CVE-2017-6060.patch";
-      url = "http://git.ghostscript.com/?p=mupdf.git;a=blobdiff_plain;f=platform/x11/jstest_main.c;h=f158d9628ed0c0a84e37fe128277679e8334422a;hp=13c3a0a3ba3ff4aae29f6882d23740833c1d842f;hb=06a012a42c9884e3cd653e7826cff1ddec04eb6e;hpb=34e18d127a02146e3415b33c4b67389ce1ddb614";
-      sha256 = "163bllvjrbm0gvjb25lv7b6sih4zr4g4lap3h0cbq8dvpjxx0jfc";
-    })
+  # Use shared libraries to decrease size
+  ++ stdenv.lib.optional (!stdenv.isDarwin) ./mupdf-1.12-shared_libs-1.patch
 
-    (fetchpatch {
-      name = "mupdf-1.11-shared_libs-1.patch";
-      url = "https://ftp.osuosl.org/pub/blfs/conglomeration/mupdf/mupdf-1.11-shared_libs-1.patch";
-      sha256 = "127x8jhyj3i9cn3mxw9mm5barw2yk43rvmghg54bhn4rjalx857j";
-    })
-
-    (fetchurl {
-      name = "mupdf-1.11-CVE-2017-14685.patch";
-      url = "http://git.ghostscript.com/?p=mupdf.git;a=patch;h=ab1a420613dec93c686acbee2c165274e922f82a";
-      sha256 = "120xapwj0af333n3a32ypxk0jmjv2ia476jg8pzsfqk9a5qqkx46";
-    })
-
-    (fetchurl {
-      name = "mupdf-1.11-CVE-2017-14686.patch";
-      url = "http://git.ghostscript.com/?p=mupdf.git;a=patch;h=0f0fbc07d9be31f5e83ec5328d7311fdfd8328b1";
-      sha256 = "0pkn7mfqhmnsyia4rh4mw4q435bzvlc22crqa1bxpaa0gcyky51c";
-    })
-
-    (fetchurl {
-      name = "mupdf-1.11-CVE-2017-14687.patch";
-      url = "http://git.ghostscript.com/?p=mupdf.git;a=patch;h=2b16dbd8f73269cb15ca61ece75cf8d2d196ed28";
-      sha256 = "01v41cwrdnz3k32fcadk2gk4knqrm3mavzp6pxhn19nwgmqkshjd";
-    })
-
-    (fetchurl {
-      name = "mupdf-1.11-CVE-2017-15587.patch";
-      url = "http://git.ghostscript.com/?p=mupdf.git;a=patch;h=82df2631d7d0446b206ea6b434ea609b6c28b0e8";
-      sha256 = "04kfww7y0wazg6372g44fa2k5kiiigq4616ihkvmp18rz86903n9";
-    })
-
-    (fetchurl {
-      name = "mupdf-1.11-CVE-2017-15369.patch";
-      url = "http://git.ghostscript.com/?p=mupdf.git;a=patch;h=c2663e51238ec8256da7fc61ad580db891d9fe9a";
-      sha256 = "0xx2mrbjcymi3gh0l3cq81m6bygp9dv79v1kyrbcvpl5z6wgl71y";
-    })
-  ];
+  ++ stdenv.lib.optional stdenv.isDarwin ./darwin.patch
+  ;
 
   postPatch = ''
     sed -i "s/__OPENJPEG__VERSION__/${openJpegVersion}/" source/fitz/load-jpx.c
@@ -78,9 +43,15 @@ in stdenv.mkDerivation rec {
 
   makeFlags = [ "prefix=$(out)" ];
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ freetype harfbuzz openjpeg jbig2dec libjpeg ]
-                ++ lib.optionals enableX11 [ libX11 libXext ]
-                ++ lib.optionals enableCurl [ curl openssl ];
+  buildInputs = [ freetype harfbuzz openjpeg jbig2dec libjpeg freeglut mesa_glu ]
+                ++ lib.optionals enableX11 [ libX11 libXext libXi libXrandr ]
+                ++ lib.optionals enableCurl [ curl openssl ]
+                ++ lib.optionals enableGL (
+                  if stdenv.isDarwin then
+                    with darwin.apple_sdk.frameworks; [ GLUT OpenGL ]
+                  else
+                    [ freeglut mesa_glu ])
+                ;
   outputs = [ "bin" "dev" "out" "man" "doc" ];
 
   preConfigure = ''
@@ -123,6 +94,6 @@ in stdenv.mkDerivation rec {
     description = "Lightweight PDF, XPS, and E-book viewer and toolkit written in portable C";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ viric vrthra fpletz ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/applications/misc/mupdf/mupdf-1.12-shared_libs-1.patch b/pkgs/applications/misc/mupdf/mupdf-1.12-shared_libs-1.patch
new file mode 100644
index 000000000000..b39f005ed74a
--- /dev/null
+++ b/pkgs/applications/misc/mupdf/mupdf-1.12-shared_libs-1.patch
@@ -0,0 +1,41 @@
+--- mupdf-1.12.0-source.orig/Makefile	2017-12-13 15:00:30.000000000 +0100
++++ mupdf-1.12.0-source/Makefile	2017-12-31 00:05:23.003277481 +0100
+@@ -14,7 +14,7 @@
+ # Do not specify CFLAGS or LIBS on the make invocation line - specify
+ # XCFLAGS or XLIBS instead. Make ignores any lines in the makefile that
+ # set a variable that was set on the command line.
+-CFLAGS += $(XCFLAGS) -Iinclude
++CFLAGS += $(XCFLAGS) -Iinclude -fPIC
+ LIBS += $(XLIBS) -lm
+ 
+ LIBS += $(FREETYPE_LIBS)
+@@ -312,9 +312,9 @@
+ 
+ # --- Library ---
+ 
+-MUPDF_LIB = $(OUT)/libmupdf.a
+-THIRD_LIB = $(OUT)/libmupdfthird.a
+-THREAD_LIB = $(OUT)/libmuthreads.a
++MUPDF_LIB = $(OUT)/libmupdf.so
++THIRD_LIB = $(OUT)/libmupdfthird.so
++THREAD_LIB = $(OUT)/libmuthreads.so
+ 
+ MUPDF_OBJ := \
+ 	$(FITZ_OBJ) \
+@@ -343,11 +343,14 @@
+ 
+ THREAD_OBJ := $(THREAD_OBJ)
+ 
+-$(MUPDF_LIB) : $(MUPDF_OBJ)
++$(MUPDF_LIB) : $(MUPDF_OBJ) $(THIRD_LIB) $(THREAD_LIB)
++	$(LINK_CMD) -shared -Wl,-soname -Wl,libmupdf.so -Wl,--no-undefined
+ $(THIRD_LIB) : $(THIRD_OBJ)
++	$(LINK_CMD) -shared -Wl,-soname -Wl,libmupdfthird.so -Wl,--no-undefined
+ $(THREAD_LIB) : $(THREAD_OBJ)
++	$(LINK_CMD) -shared -Wl,-soname -Wl,libmuthreads.so -Wl,--no-undefined -lpthread
+ 
+-INSTALL_LIBS := $(MUPDF_LIB) $(THIRD_LIB)
++INSTALL_LIBS := $(MUPDF_LIB) $(THIRD_LIB) $(THREAD_LIB)
+ 
+ # --- Tools and Apps ---
+ 
diff --git a/pkgs/applications/misc/udiskie/default.nix b/pkgs/applications/misc/udiskie/default.nix
index 1acf3dbda4ca..9f94b0aa48e9 100644
--- a/pkgs/applications/misc/udiskie/default.nix
+++ b/pkgs/applications/misc/udiskie/default.nix
@@ -1,13 +1,14 @@
 { stdenv, fetchFromGitHub, asciidoc-full, gettext
 , gobjectIntrospection, gtk3, hicolor_icon_theme, libnotify, librsvg
 , udisks2, wrapGAppsHook
+, buildPythonApplication
 , docopt
 , pygobject3
 , pyyaml
-, pythonPackages
+, ...
 }:
 
-pythonPackages.buildPythonApplication rec {
+buildPythonApplication rec {
   name = "udiskie-${version}";
   version = "1.7.3";
 
diff --git a/pkgs/applications/misc/xmr-stak/default.nix b/pkgs/applications/misc/xmr-stak/default.nix
index 4931a3f8a12b..c985f601447e 100644
--- a/pkgs/applications/misc/xmr-stak/default.nix
+++ b/pkgs/applications/misc/xmr-stak/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   name = "xmr-stak-${version}";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "fireice-uk";
     repo = "xmr-stak";
     rev = "v${version}";
-    sha256 = "0ijhimsd03v1psj7pyj70z4rrgfvphpf69y7g72p06010xq1agp8";
+    sha256 = "0n21y37d8khgfk9965mrhnh6y5ag7w0s6as1fmf76yx6vajvajsn";
   };
 
   NIX_CFLAGS_COMPILE = "-O3";
diff --git a/pkgs/applications/networking/browsers/google-chrome/default.nix b/pkgs/applications/networking/browsers/google-chrome/default.nix
index bc8aca5b1702..b868c434e234 100644
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@@ -4,7 +4,7 @@
 , glib, fontconfig, freetype, pango, cairo, libX11, libXi, atk, gconf, nss, nspr
 , libXcursor, libXext, libXfixes, libXrender, libXScrnSaver, libXcomposite, libxcb
 , alsaLib, libXdamage, libXtst, libXrandr, expat, cups
-, dbus_libs, gtk2, gtk3, gdk_pixbuf, gcc-unwrapped
+, dbus_libs, gtk2, gtk3, gdk_pixbuf, gcc-unwrapped, at_spi2_atk
 
 # command line arguments which are always set e.g "--disable-gpu"
 , commandLineArgs ? ""
@@ -57,7 +57,7 @@ let
     libexif
     liberation_ttf curl utillinux xdg_utils wget
     flac harfbuzz icu libpng opusWithCustomModes snappy speechd
-    bzip2 libcap
+    bzip2 libcap at_spi2_atk
   ] ++ optional pulseSupport libpulseaudio
     ++ [ gtk ];
 
diff --git a/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix b/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix
index fd05948864c0..1477d0674642 100644
--- a/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bitlbee-steam/default.nix
@@ -2,13 +2,14 @@
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "bitlbee-steam-2015-09-10";
+  version = "1.4.2";
+  name = "bitlbee-steam-${version}";
 
   src = fetchFromGitHub {
-    rev = "011375b2d3c67c15d51ca203de0ecaab3b4b7587";
-    owner = "jgeboski";
+    rev = "v${version}";
+    owner = "bitlbee";
     repo = "bitlbee-steam";
-    sha256 = "1m91x3208z9zxppz998i6060alcalfly9ix9jxismj45xyp6mdx7";
+    sha256 = "121r92mgwv445wwxzh35n19fs5k81ihr0j19k256ia5502b1xxaq";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index b9a334971744..691d4bb74dbf 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -102,7 +102,7 @@ rec {
     ];
   };
 
-  # 5. nix example to play with the container nix store
+  # 6. nix example to play with the container nix store
   # docker run -it --rm nix nix-store -qR $(nix-build '<nixpkgs>' -A nix)
   nix = buildImageWithNixDb {
     name = "nix";
diff --git a/pkgs/desktops/gnome-3/core/epiphany/default.nix b/pkgs/desktops/gnome-3/core/epiphany/default.nix
index 8c87609f85cc..6dafa160b1f8 100644
--- a/pkgs/desktops/gnome-3/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome-3/core/epiphany/default.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     # Patched meson does not add internal libraries to rpath
-    for f in bin/.epiphany-wrapped libexec/.epiphany-search-provider-wrapped libexec/epiphany/.ephy-profile-migrator-wrapped lib/epiphany/web-extensions/libephywebextension.so; do
-      patchelf --set-rpath "$out/lib/epiphany:$(patchelf --print-rpath $out/$f)" "$out/$f"
+    for f in $out/bin/.*-wrapped $out/libexec/.*-wrapped $out/libexec/epiphany/.*-wrapped $out/lib/epiphany/*.so $out/lib/epiphany/web-extensions/*.so; do
+      patchelf --set-rpath "$out/lib/epiphany:$(patchelf --print-rpath $f)" "$f"
     done
   '';
 
diff --git a/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix b/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
index 6a6722c3b60f..d4f5835ed3a2 100644
--- a/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-keyring/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" ];
 
   buildInputs = with gnome3; [
-    dbus libgcrypt pam gtk3 gconf libgnome_keyring
+    dbus libgcrypt pam gtk3 libgnome_keyring
     pango gcr gdk_pixbuf atk p11_kit
   ];
 
@@ -30,7 +30,8 @@ stdenv.mkDerivation rec {
     patchShebangs build
   '';
 
-  doCheck = true;
+  # Tests are not deterministic https://bugzilla.gnome.org/show_bug.cgi?id=791932
+  doCheck = false;
   checkPhase = ''
     export HOME=$(mktemp -d)
     dbus-run-session \
diff --git a/pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix b/pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix
new file mode 100644
index 000000000000..2f0e39eb5c90
--- /dev/null
+++ b/pkgs/development/libraries/qtstyleplugin-kvantum-qt4/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchFromGitHub, qmake4Hook , qt4, libX11, libXext }:
+
+stdenv.mkDerivation rec {
+  name = "qtstyleplugin-kvantum-qt4-${version}";
+  version = "0.10.4";
+
+  src = fetchFromGitHub {
+    owner = "tsujan";
+    repo = "Kvantum";
+    rev = "0527bb03f2252269fd382e11181a34ca72c96b4b";
+    sha256 = "0ky44s1fgqxraywagx1mv07yz76ppgiz3prq447db78wkwqg2d8p";
+  };
+
+  nativeBuildInputs = [ qmake4Hook ];
+  buildInputs = [ qt4 libX11 libXext ];
+
+  postUnpack = "sourceRoot=\${sourceRoot}/Kvantum";
+
+  buildPhase = ''
+    qmake kvantum.pro
+    make
+  '';
+
+  installPhase = ''
+    mkdir $TMP/kvantum
+    make INSTALL_ROOT="$TMP/kvantum" install
+    mv $TMP/kvantum/usr/ $out
+    mv $TMP/kvantum/${qt4}/lib $out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "SVG-based Qt4 theme engine";
+    homepage = "https://github.com/tsujan/Kvantum";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.bugworm ];
+  };
+}
diff --git a/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
new file mode 100644
index 000000000000..5085d9bf5ef9
--- /dev/null
+++ b/pkgs/development/libraries/qtstyleplugin-kvantum/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, qmake, qtbase, qtsvg, qtx11extras, libX11, libXext, qttools }:
+
+stdenv.mkDerivation rec {
+  name = "qtstyleplugin-kvantum-${version}";
+  version = "0.10.4";
+
+  src = fetchFromGitHub {
+    owner = "tsujan";
+    repo = "Kvantum";
+    rev = "0527bb03f2252269fd382e11181a34ca72c96b4b";
+    sha256 = "0ky44s1fgqxraywagx1mv07yz76ppgiz3prq447db78wkwqg2d8p";
+  };
+
+  nativeBuildInputs = [ qmake qttools ];
+  buildInputs = [ qtbase qtsvg qtx11extras libX11 libXext  ];
+
+  postUnpack = "sourceRoot=\${sourceRoot}/Kvantum";
+
+  postInstall= ''
+    mkdir -p $out/$qtPluginPrefix/styles
+    mv $NIX_QT5_TMP/$qtPluginPrefix/styles/libkvantum.so $out/$qtPluginPrefix/styles/libkvantum.so
+  '';
+
+  meta = with stdenv.lib; {
+    description = "SVG-based Qt5 theme engine plus a config tool and extra themes";
+    homepage = "https://github.com/tsujan/Kvantum";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.bugworm ];
+  };
+}
diff --git a/pkgs/development/python-modules/conda/default.nix b/pkgs/development/python-modules/conda/default.nix
new file mode 100644
index 000000000000..a240ea21e3e4
--- /dev/null
+++ b/pkgs/development/python-modules/conda/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pycosat
+, requests
+, ruamel_yaml
+, isPy3k
+, enum34
+}:
+
+# Note: this installs conda as a library. The application cannot be used.
+# This is likely therefore NOT what you're looking for.
+
+buildPythonPackage rec {
+  pname = "conda";
+  version = "4.3.16";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "a91ef821343dea3ba9670f3d10b36c1ace4f4c36d70c175d8fc8886e94285953";
+  };
+
+  propagatedBuildInputs = [ pycosat requests ruamel_yaml ] ++ lib.optional (!isPy3k) enum34;
+
+  # No tests
+  doCheck = false;
+
+  meta = {
+    description = "OS-agnostic, system-level binary package manager";
+    homepage = https://github.com/conda/conda;
+    license = lib.licenses.bsd3;
+  };
+
+}
\ No newline at end of file
diff --git a/pkgs/development/python-modules/pybfd/default.nix b/pkgs/development/python-modules/pybfd/default.nix
index ee1a79955740..0ac437bfb293 100644
--- a/pkgs/development/python-modules/pybfd/default.nix
+++ b/pkgs/development/python-modules/pybfd/default.nix
@@ -1,15 +1,15 @@
 { lib, fetchFromGitHub, buildPythonPackage, isPyPy, isPy3k, libbfd, libopcodes }:
 
 buildPythonPackage rec {
-  name = "pybfd-0.1.1";
+  name = "pybfd-0.1.1.2017-12-31";
 
   disabled = isPyPy || isPy3k;
 
   src = fetchFromGitHub {
     owner = "orivej";
     repo = "pybfd";
-    rev = "a2c3a7b94a3c9f7a353b863f69a79174c6a41ebe";
-    sha256 = "0wrz234dz25hs0ajzcz5w8lzc1yzf64wqa8fj01hhr4yy23vjkcr";
+    rev = "a10ada53f2a79de7f62f209567806ef1e91794c7";
+    sha256 = "0sxzhlqjyvvx1zr3qrkb57z6s3g6k3ksyn65fdm9lvl0k4dv2k9w";
   };
 
   LIBBFD_INCLUDE_DIR = "${libbfd.dev}/include";
diff --git a/pkgs/development/python-modules/pycosat/default.nix b/pkgs/development/python-modules/pycosat/default.nix
new file mode 100644
index 000000000000..ad49e38d0658
--- /dev/null
+++ b/pkgs/development/python-modules/pycosat/default.nix
@@ -0,0 +1,21 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "pycosat";
+  version = "0.6.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    extension = "zip";
+    sha256 = "4c99874946a7e939bb941bbb019dd2c20e6068e3107c91366e7779c69d70e0ed";
+  };
+
+  meta = {
+    description = "Bindings to picosat SAT solver";
+    homepage = https://github.com/ContinuumIO/pycosat;
+    license = lib.licenses.mit;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/development/tools/pipenv/default.nix b/pkgs/development/tools/pipenv/default.nix
index 01433a6ce4d4..b017b1dc24b5 100644
--- a/pkgs/development/tools/pipenv/default.nix
+++ b/pkgs/development/tools/pipenv/default.nix
@@ -2,11 +2,11 @@
 with python3Packages; buildPythonApplication rec {
     name = "${pname}-${version}";
     pname = "pipenv";
-    version = "8.2.7";
+    version = "9.0.1";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "08wkxs6qqgzxamym523bjv7zahg8p9v18x0yi9vwclij5k91iyzm";
+      sha256 = "16k77iy1apbc1s5j78aimhjrcw89vbkq5irs80dmm70wayi0myz1";
     };
 
     LC_ALL = "en_US.UTF-8";
diff --git a/pkgs/games/simutrans/default.nix b/pkgs/games/simutrans/default.nix
index 9ea23423673a..ada2520a097c 100644
--- a/pkgs/games/simutrans/default.nix
+++ b/pkgs/games/simutrans/default.nix
@@ -163,7 +163,7 @@ let
       homepage = http://www.simutrans.com/;
       license = with licenses; [ artistic1 gpl1Plus ];
       maintainers = with maintainers; [ kkallio vcunat phile314 ];
-      platforms = with platforms; linux ++ darwin;
+      platforms = with platforms; linux; # TODO: ++ darwin;
     };
   };
 
diff --git a/pkgs/misc/themes/adapta/default.nix b/pkgs/misc/themes/adapta/default.nix
index ade47704bae3..9d63e9c3aafc 100644
--- a/pkgs/misc/themes/adapta/default.nix
+++ b/pkgs/misc/themes/adapta/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "adapta-gtk-theme-${version}";
-  version = "3.92.1.72";
+  version = "3.93.0.1";
 
   src = fetchFromGitHub {
     owner = "adapta-project";
     repo = "adapta-gtk-theme";
     rev = version;
-    sha256 = "19kav8m6aj4h7qg0z92k09lppzdgy6h9lxxv3qqqrl3hmg7bn0sx";
+    sha256 = "0l662l66ja8dsakcgwg6ab69lkl0va0r5h74dr6yjdsy0q4h2m7h";
   };
 
   preferLocalBuild = true;
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with stdenv.lib; {
-    description = "An adaptive Gtk+ theme based on Material Design";
+    description = "An adaptive Gtk+ theme based on Material Design Guidelines";
     homepage = https://github.com/adapta-project/adapta-gtk-theme;
     license = with licenses; [ gpl2 cc-by-sa-30 ];
     platforms = platforms.linux;
diff --git a/pkgs/misc/themes/kde2/default.nix b/pkgs/misc/themes/kde2/default.nix
new file mode 100644
index 000000000000..1d281b3ac90d
--- /dev/null
+++ b/pkgs/misc/themes/kde2/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub
+, cmake, extra-cmake-modules
+, qtbase, kcoreaddons, kdecoration }:
+
+let
+  version = "2017-03-15";
+in stdenv.mkDerivation rec {
+  name = "kde2-decoration-${version}";
+
+  src = fetchFromGitHub {
+    owner = "repos-holder";
+    repo = "kdecoration2-kde2";
+    rev = "2a9cf18ac0646b3532d4db2dd28bd73c4c229783";
+    sha256 = "0kilw6sd3blvm6gx9w4w5ivkjfxlv6wnyivw46pwwvhgxqymkbxk";
+  };
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ cmake extra-cmake-modules ];
+
+  buildInputs = [ qtbase kcoreaddons kdecoration ];
+
+  meta = with stdenv.lib; {
+    description = "KDE 2 window decoration ported to Plasma 5";
+    homepage = src.meta.homepage;
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/facetimehd/default.nix b/pkgs/os-specific/linux/facetimehd/default.nix
index 720bc34c4197..d65018c600ec 100644
--- a/pkgs/os-specific/linux/facetimehd/default.nix
+++ b/pkgs/os-specific/linux/facetimehd/default.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation rec {
   '';
 
   hardeningDisable = [ "pic" ];
+  
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   makeFlags = [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
diff --git a/pkgs/tools/audio/beets/default.nix b/pkgs/tools/audio/beets/default.nix
index 7e9d0ff9d860..c711881d528f 100644
--- a/pkgs/tools/audio/beets/default.nix
+++ b/pkgs/tools/audio/beets/default.nix
@@ -95,13 +95,13 @@ let
 
 in pythonPackages.buildPythonApplication rec {
   name = "beets-${version}";
-  version = "1.4.5";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "beetbox";
     repo = "beets";
     rev = "v${version}";
-    sha256 = "0fvfp9ckq3dhs4f8abg9fprfppyf0g6mv8br2xz99plg4wnffzmy";
+    sha256 = "0m8macydkn1fp4ymig0rg7bzw77rrm454q763gxdpq2kg08yl5py";
   };
 
   propagatedBuildInputs = [
@@ -194,7 +194,8 @@ in pythonPackages.buildPythonApplication rec {
     BEETS_TEST_SHELL="${testShell}" \
     BASH_COMPLETION_SCRIPT="${completion}" \
     HOME="$(mktemp -d)" \
-      nosetests -v
+      # Exclude failing test https://github.com/beetbox/beets/issues/2652
+      nosetests -v --exclude="test_single_month_nonmatch_"
 
     runHook postCheck
   '';
diff --git a/pkgs/tools/backup/bdsync/default.nix b/pkgs/tools/backup/bdsync/default.nix
new file mode 100644
index 000000000000..8ef846a8dca3
--- /dev/null
+++ b/pkgs/tools/backup/bdsync/default.nix
@@ -0,0 +1,43 @@
+{ stdenv, fetchFromGitHub, openssl, coreutils, which }:
+
+stdenv.mkDerivation rec {
+
+  name = "${pname}-${version}";
+  pname = "bdsync";
+  version = "0.10.1";
+
+  src = fetchFromGitHub {
+    owner = "TargetHolding";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "144hlbk3k29l7sja6piwhd2jsnzzsak13fcjbahd6m8yimxyb2nf";
+  };
+
+  postPatch = ''
+    patchShebangs ./tests.sh
+    patchShebangs ./tests/
+  '';
+
+  buildInputs = [ openssl coreutils which ];
+
+  doCheck = true;
+  checkPhase = ''
+    make test
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/man/man1
+    cp bdsync $out/bin/
+    cp bdsync.1 $out/share/man/man1/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Fast block device synchronizing tool";
+    homepage = https://github.com/TargetHolding/bdsync;
+    license = licenses.gpl2;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ jluttine ];
+  };
+
+}
diff --git a/pkgs/tools/misc/hakuneko/default.nix b/pkgs/tools/misc/hakuneko/default.nix
index e50df02a1189..be5e1371cd45 100644
--- a/pkgs/tools/misc/hakuneko/default.nix
+++ b/pkgs/tools/misc/hakuneko/default.nix
@@ -21,5 +21,8 @@ stdenv.mkDerivation rec {
     homepage = https://sourceforge.net/projects/hakuneko/;
     license = stdenv.lib.licenses.mit;
     platforms = stdenv.lib.platforms.linux;
+
+    # This project was abandoned upstream.
+    broken = true;
   };
 }
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 38642b815f85..a6b1ac6c9f42 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -4,7 +4,7 @@
 */
 { stdenv, lib, fetchurl, runCommand, writeText, buildEnv
 , callPackage, ghostscriptX, harfbuzz, poppler_min
-, makeWrapper, perl522, python, ruby
+, makeWrapper, python, ruby, perl
 , useFixedHashes ? true
 , recurseIntoAttrs
 }:
@@ -28,8 +28,7 @@ let
   # function for creating a working environment from a set of TL packages
   combine = import ./combine.nix {
     inherit bin combinePkgs buildEnv fastUnique lib makeWrapper writeText
-      stdenv python ruby;
-    perl = perl522; # avoid issues like #26890, probably remove after texlive upgrade
+      stdenv python ruby perl;
     ghostscript = ghostscriptX; # could be without X, probably, but we use X above
   };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f76f01e18ce6..dfa997e145cd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1336,6 +1336,8 @@ with pkgs;
 
   bats = callPackage ../development/interpreters/bats { };
 
+  bdsync = callPackage ../tools/backup/bdsync { };
+
   beanstalkd = callPackage ../servers/beanstalkd { };
 
   beegfs = callPackage ../os-specific/linux/beegfs { };
@@ -2935,6 +2937,8 @@ with pkgs;
 
   kdbplus = callPackage_i686 ../applications/misc/kdbplus { };
 
+  kde2-decoration = libsForQt5.callPackage ../misc/themes/kde2 { };
+
   keepalived = callPackage ../tools/networking/keepalived { };
 
   kexectools = callPackage ../os-specific/linux/kexectools { };
@@ -8683,6 +8687,8 @@ with pkgs;
 
   qt-gstreamer1 = callPackage ../development/libraries/gstreamer/qt-gstreamer { boost = boost155;};
 
+  qtstyleplugin-kvantum-qt4 = callPackage ../development/libraries/qtstyleplugin-kvantum-qt4 { };
+
   gnet = callPackage ../development/libraries/gnet { };
 
   gnu-config = callPackage ../development/libraries/gnu-config { };
@@ -10672,6 +10678,8 @@ with pkgs;
 
     qtstyleplugins = callPackage ../development/libraries/qtstyleplugins { };
 
+    qtstyleplugin-kvantum = libsForQt5.callPackage ../development/libraries/qtstyleplugin-kvantum { };
+
     quazip = callPackage ../development/libraries/quazip { };
 
     qwt = callPackage ../development/libraries/qwt/6.nix { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b4ec2cf73fc7..471eb1f52a26 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2694,6 +2694,7 @@ in {
     };
   };
 
+  conda = callPackage ../development/python-modules/conda { };
 
   configobj = buildPythonPackage (rec {
     name = "configobj-5.0.6";
@@ -13642,27 +13643,6 @@ in {
     };
   };
 
-  pycosat = buildPythonPackage rec {
-    name = "pycosat-0.6.0";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/p/pycosat/${name}.tar.gz";
-      sha256 = "02sdn2998jlrm35smn1530hix3kzwyc1jv49cjdcnvfvrqqi3rww";
-    };
-
-    meta = {
-      description = "Python bindings for PicoSAT";
-      longDescription = ''PicoSAT is a popular SAT solver written by Armin
-          Biere in pure C. This package provides efficient Python bindings
-          to picosat on the C level, i.e. when importing pycosat, the
-          picosat solver becomes part of the Python process itself. For
-          ease of deployment, the picosat source (namely picosat.c and
-          picosat.h) is included in this project.'';
-      homepage = https://github.com/ContinuumIO/pycosat;
-      license = licenses.mit;
-    };
-  };
-
   pygit2 = callPackage ../development/python-modules/pygit2 { };
 
   Babel = buildPythonPackage (rec {
@@ -13815,6 +13795,7 @@ in {
 
   };
 
+  pycosat = callPackage ../development/python-modules/pycosat { };
 
   pycryptopp = buildPythonPackage (rec {
     name = "pycryptopp-0.6.0.1206569328141510525648634803928199668821045408958";