diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix
index fe00cd1e32b6..2249f866803a 100644
--- a/nixos/modules/services/hardware/fwupd.nix
+++ b/nixos/modules/services/hardware/fwupd.nix
@@ -126,6 +126,8 @@ in {
     services.udev.packages = [ cfg.package ];
 
     systemd.packages = [ cfg.package ];
+
+    security.polkit.enable = true;
   };
 
   meta = {
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index b1cf72258d17..0a62af95f8f1 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -3,6 +3,7 @@
 with lib;
 let
   cfg = config.services.paperless;
+  pkg = cfg.package;
 
   defaultUser = "paperless";
 
@@ -27,7 +28,7 @@ let
     setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
   in pkgs.writeShellScript "manage" ''
     ${setupEnv}
-    exec ${cfg.package}/bin/paperless-ngx "$@"
+    exec ${pkg}/bin/paperless-ngx "$@"
   '';
 
   # Secure the services
@@ -213,7 +214,7 @@ in
       description = "Paperless scheduler";
       serviceConfig = defaultServiceConfig // {
         User = cfg.user;
-        ExecStart = "${cfg.package}/bin/paperless-ngx qcluster";
+        ExecStart = "${pkg}/bin/paperless-ngx qcluster";
         Restart = "on-failure";
         # The `mbind` syscall is needed for running the classifier.
         SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "mbind" ];
@@ -229,9 +230,9 @@ in
 
         # Auto-migrate on first run or if the package has changed
         versionFile="${cfg.dataDir}/src-version"
-        if [[ $(cat "$versionFile" 2>/dev/null) != ${cfg.package} ]]; then
-          ${cfg.package}/bin/paperless-ngx migrate
-          echo ${cfg.package} > "$versionFile"
+        if [[ $(cat "$versionFile" 2>/dev/null) != ${pkg} ]]; then
+          ${pkg}/bin/paperless-ngx migrate
+          echo ${pkg} > "$versionFile"
         fi
       ''
       + optionalString (cfg.passwordFile != null) ''
@@ -241,7 +242,7 @@ in
         superuserStateFile="${cfg.dataDir}/superuser-state"
 
         if [[ $(cat "$superuserStateFile" 2>/dev/null) != $superuserState ]]; then
-          ${cfg.package}/bin/paperless-ngx manage_superuser
+          ${pkg}/bin/paperless-ngx manage_superuser
           echo "$superuserState" > "$superuserStateFile"
         fi
       '';
@@ -266,7 +267,7 @@ in
       description = "Paperless document consumer";
       serviceConfig = defaultServiceConfig // {
         User = cfg.user;
-        ExecStart = "${cfg.package}/bin/paperless-ngx document_consumer";
+        ExecStart = "${pkg}/bin/paperless-ngx document_consumer";
         Restart = "on-failure";
       };
       environment = env;
@@ -282,7 +283,7 @@ in
         User = cfg.user;
         ExecStart = ''
           ${pkgs.python3Packages.gunicorn}/bin/gunicorn \
-            -c ${cfg.package}/lib/paperless-ngx/gunicorn.conf.py paperless.asgi:application
+            -c ${pkg}/lib/paperless-ngx/gunicorn.conf.py paperless.asgi:application
         '';
         Restart = "on-failure";
 
@@ -295,8 +296,8 @@ in
         CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
       };
       environment = env // {
-        PATH = mkForce cfg.package.path;
-        PYTHONPATH = "${cfg.package.pythonPath}:${cfg.package}/lib/paperless-ngx/src";
+        PATH = mkForce pkg.path;
+        PYTHONPATH = "${pkg.python.pkgs.makePythonPath pkg.propagatedBuildInputs}:${pkg}/lib/paperless-ngx/src";
       };
       # Allow the web interface to access the private /tmp directory of the server.
       # This is required to support uploading files via the web interface.
diff --git a/nixos/tests/installed-tests/ibus.nix b/nixos/tests/installed-tests/ibus.nix
index a4bc2a7d7de0..028c20c29f2d 100644
--- a/nixos/tests/installed-tests/ibus.nix
+++ b/nixos/tests/installed-tests/ibus.nix
@@ -4,6 +4,7 @@ makeInstalledTest {
   tested = pkgs.ibus;
 
   testConfig = {
+    i18n.supportedLocales = [ "all" ];
     i18n.inputMethod.enabled = "ibus";
     systemd.user.services.ibus-daemon = {
       serviceConfig.ExecStart = "${pkgs.ibus}/bin/ibus-daemon --xim --verbose";
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index d34f680f5224..852dc53e75d3 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -69,7 +69,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
         server.wait_until_succeeds("curl -sf https://${serverDomain} | grep Kanidm")
         server.wait_until_succeeds("ldapsearch -H ldap://[::1]:636 -b '${ldapBaseDN}' -x '(name=test)'")
         client.wait_until_succeeds("kanidm login -D anonymous && kanidm self whoami | grep anonymous@${serverDomain}")
-        (rv, result) = server.execute("kanidmd recover_account -d quiet -c ${serverConfigFile} -n admin 2>&1 | rg -o '[A-Za-z0-9]{48}'")
+        rv, result = server.execute("kanidmd recover_account -c ${serverConfigFile} idm_admin 2>&1 | rg -o '[A-Za-z0-9]{48}'")
         assert rv == 0
       '';
   })
diff --git a/pkgs/applications/editors/helix/default.nix b/pkgs/applications/editors/helix/default.nix
index cc62190aeb1b..d3d0c7c2f939 100644
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@@ -1,4 +1,4 @@
-{ fetchzip, lib, rustPlatform, makeWrapper }:
+{ fetchzip, lib, rustPlatform, installShellFiles, makeWrapper }:
 
 rustPlatform.buildRustPackage rec {
   pname = "helix";
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-idItRkymr+cxk3zv2mPBR/frCGvzEUdSAhY7gghfR3M=";
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ installShellFiles makeWrapper ];
 
   postInstall = ''
     # not needed at runtime
@@ -22,6 +22,7 @@ rustPlatform.buildRustPackage rec {
 
     mkdir -p $out/lib
     cp -r runtime $out/lib
+    installShellCompletion contrib/completion/hx.{bash,fish,zsh}
   '';
   postFixup = ''
     wrapProgram $out/bin/hx --set HELIX_RUNTIME $out/lib/runtime
diff --git a/pkgs/applications/graphics/epick/default.nix b/pkgs/applications/graphics/epick/default.nix
index dbe745217a38..fda56c0d8cb7 100644
--- a/pkgs/applications/graphics/epick/default.nix
+++ b/pkgs/applications/graphics/epick/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "epick";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "vv9k";
     repo = pname;
     rev = version;
-    sha256 = "sha256-sZ0ZPst6PE6KQ+pmjqLdcD7bWU/gLRsGH84PtWTLdSQ=";
+    sha256 = "sha256-b4if2ggJY+8CsCX8jbnnWXy16k7sfB88CLlYYCrtltk=";
   };
 
-  cargoSha256 = "sha256-kMVjX4AWn8XFRzI7P9NRW8B7AHcIC8TG8LQk7tzkz5o=";
+  cargoSha256 = "sha256-HyGSmeLJ+2Twkg94p1QqXZDix0mU2jGFfEot6hgUg34=";
 
   nativeBuildInputs = lib.optional stdenv.isLinux python3;
 
diff --git a/pkgs/applications/misc/nwg-bar/default.nix b/pkgs/applications/misc/nwg-bar/default.nix
new file mode 100644
index 000000000000..28e736b008fb
--- /dev/null
+++ b/pkgs/applications/misc/nwg-bar/default.nix
@@ -0,0 +1,39 @@
+{ lib, buildGoModule, fetchFromGitHub, pkg-config, gtk3, gtk-layer-shell }:
+
+buildGoModule rec {
+  pname = "nwg-bar";
+  version = "unstable-2021-09-23";
+
+  src = fetchFromGitHub {
+    owner = "nwg-piotr";
+    repo = pname;
+    rev = "7dd7df3cd9a9e78fe477e88e0f3cb97309d50ff5";
+    sha256 = "sha256-piysF19WDjb/EGI9MBepYrOrQL9C1fsoq05AP8CYN58=";
+  };
+
+  patches = [ ./fix-paths.patch ];
+  postPatch = ''
+    substituteInPlace config/bar.json --subst-var out
+    substituteInPlace tools.go --subst-var out
+  '';
+
+  vendorSha256 = "sha256-dgOwflNRb+11umFykozL8DQ50dLbhbMCmCyKmLlW7rw=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ gtk3 gtk-layer-shell ];
+
+  preInstall = ''
+    mkdir -p $out/share/nwg-bar
+    cp -r config/* images $out/share/nwg-bar
+  '';
+
+  meta = with lib; {
+    description =
+      "GTK3-based button bar for sway and other wlroots-based compositors";
+    homepage = "https://github.com/nwg-piotr/nwg-bar";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ sei40kr ];
+  };
+}
diff --git a/pkgs/applications/misc/nwg-bar/fix-paths.patch b/pkgs/applications/misc/nwg-bar/fix-paths.patch
new file mode 100644
index 000000000000..9d4e98e9a7b7
--- /dev/null
+++ b/pkgs/applications/misc/nwg-bar/fix-paths.patch
@@ -0,0 +1,47 @@
+diff --git a/config/bar.json b/config/bar.json
+index 6c456e7..98527cb 100644
+--- a/config/bar.json
++++ b/config/bar.json
+@@ -2,21 +2,21 @@
+   {
+     "label": "Lock",
+     "exec": "swaylock -f -c 000000",
+-    "icon": "/usr/share/nwg-bar/images/system-lock-screen.svg"
++    "icon": "@out@/share/nwg-bar/images/system-lock-screen.svg"
+   },
+   {
+     "label": "Logout",
+     "exec": "swaymsg exit",
+-    "icon": "/usr/share/nwg-bar/images/system-log-out.svg"
++    "icon": "@out@/share/nwg-bar/images/system-log-out.svg"
+   },
+   {
+     "label": "Reboot",
+     "exec": "systemctl reboot",
+-    "icon": "/usr/share/nwg-bar/images/system-reboot.svg"
++    "icon": "@out@/share/nwg-bar/images/system-reboot.svg"
+   },
+   {
+     "label": "Shutdown",
+     "exec": "systemctl -i poweroff",
+-    "icon": "/usr/share/nwg-bar/images/system-shutdown.svg"
++    "icon": "@out@/share/nwg-bar/images/system-shutdown.svg"
+   }
+ ]
+\ No newline at end of file
+diff --git a/tools.go b/tools.go
+index f97751e..987163e 100644
+--- a/tools.go
++++ b/tools.go
+@@ -45,10 +45,7 @@ func configDir() string {
+ }
+ 
+ func getDataHome() string {
+-	if os.Getenv("XDG_DATA_HOME") != "" {
+-		return os.Getenv("XDG_DATA_HOME")
+-	}
+-	return "/usr/share/"
++	return "@out@/share/"
+ }
+ 
+ func createDir(dir string) {
diff --git a/pkgs/applications/misc/qelectrotech/default.nix b/pkgs/applications/misc/qelectrotech/default.nix
new file mode 100644
index 000000000000..038fe11763d6
--- /dev/null
+++ b/pkgs/applications/misc/qelectrotech/default.nix
@@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, mkDerivation
+, fetchzip
+, installShellFiles
+, pkg-config
+, qmake
+, qtbase
+, kcoreaddons
+, kwidgetsaddons
+}:
+
+mkDerivation rec {
+  pname = "qelectrotech";
+  version = "0.8.0";
+
+  src = fetchzip {
+    url = "https://git.tuxfamily.org/qet/qet.git/snapshot/qet-${version}.tar.gz";
+    sha256 = "sha256-op2vnMPF9bNnHGphWFB/HEeoThE6tX+9UvX8LWVwkzI=";
+  };
+
+  postPatch = ''
+    substituteInPlace qelectrotech.pro \
+      --replace 'GIT_COMMIT_SHA="\\\"$(shell git -C \""$$_PRO_FILE_PWD_"\" rev-parse --verify HEAD)\\\""' \
+                'GIT_COMMIT_SHA="\\\"${version}\\\""' \
+      --replace "COMPIL_PREFIX              = '/usr/local/'" \
+                "COMPIL_PREFIX              = '$out/'" \
+      --replace "INSTALL_PREFIX             = '/usr/local/'" \
+                "INSTALL_PREFIX             = '$out/'"
+  '';
+
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+    qmake
+  ];
+
+  buildInputs = [
+    kcoreaddons
+    kwidgetsaddons
+    qtbase
+  ];
+
+  qmakeFlags = [
+    "INSTALLROOT=$(out)"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm555 qelectrotech $out/bin/qelectrotech
+
+    install -Dm444 -t $out/share/applications misc/qelectrotech.desktop
+    install -Dm444 -t $out/share/applications misc/x-qet-titleblock.desktop
+    install -Dm444 -t $out/share/applications misc/x-qet-element.desktop
+    install -Dm444 -t $out/share/applications misc/x-qet-project.desktop
+
+    mkdir -p $out/share/qelectrotech
+    cp -r elements $out/share/qelectrotech
+    cp -r titleblocks $out/share/qelectrotech
+    cp -r lang $out/share/qelectrotech
+    cp -r examples $out/share/qelectrotech
+
+    mkdir -p $out/share/icons/hicolor
+    cp -r ico $out/share/icons/hicolor
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Free software to create electric diagrams";
+    homepage = "https://qelectrotech.org/";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ yvesf ];
+    platforms = qtbase.meta.platforms;
+  };
+}
diff --git a/pkgs/applications/office/paperless-ngx/default.nix b/pkgs/applications/office/paperless-ngx/default.nix
index a42ec844d115..1deb8e7efe6e 100644
--- a/pkgs/applications/office/paperless-ngx/default.nix
+++ b/pkgs/applications/office/paperless-ngx/default.nix
@@ -207,11 +207,7 @@ python.pkgs.pythonPackages.buildPythonApplication rec {
   '';
 
   passthru = {
-    inherit python;
-    # PYTHONPATH of all dependencies used by the package
-    pythonPath = python3.pkgs.makePythonPath propagatedBuildInputs;
-    inherit path;
-
+    inherit python path;
     tests = { inherit (nixosTests) paperless; };
   };
 
diff --git a/pkgs/applications/science/biology/EZminc/default.nix b/pkgs/applications/science/biology/EZminc/default.nix
index 6c140b03ee4b..a4bb8c62f1c4 100644
--- a/pkgs/applications/science/biology/EZminc/default.nix
+++ b/pkgs/applications/science/biology/EZminc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libminc, bicpl, itk4, fftwFloat, gsl }:
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libminc, bicpl, itk, fftwFloat, gsl }:
 
 stdenv.mkDerivation rec {
   pname = "EZminc";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ itk4 libminc bicpl fftwFloat gsl ];
+  buildInputs = [ itk libminc bicpl fftwFloat gsl ];
 
   cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/cmake"
                  "-DEZMINC_BUILD_TOOLS=TRUE"
diff --git a/pkgs/applications/science/biology/ants/default.nix b/pkgs/applications/science/biology/ants/default.nix
index ac332f271662..873cb28b5161 100644
--- a/pkgs/applications/science/biology/ants/default.nix
+++ b/pkgs/applications/science/biology/ants/default.nix
@@ -1,26 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, makeWrapper, itk4, vtk_7, Cocoa }:
+{ lib, stdenv, fetchFromGitHub, cmake, makeWrapper, itk-unstable, vtk_8, Cocoa }:
 
 stdenv.mkDerivation rec {
   pname    = "ANTs";
-  version = "2.2.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner  = "ANTsX";
     repo   = "ANTs";
-    rev    = "37ad4e20be3a5ecd26c2e4e41b49e778a0246c3d";
-    sha256 = "1hrdwv3m9xh3yf7l0rm2ggxc2xzckfb8srs88g485ibfszx7i03q";
+    rev    = "v${version}";
+    sha256 = "sha256-sRZwRRqqU0xiu4K6xlLQV4xzVNnzMlnRsk+TPiv0wD0=";
   };
 
-  patches = [
-    # Fix build with gcc8
-    (fetchpatch {
-      url = "https://github.com/ANTsX/ANTs/commit/89af9b2694715bf8204993e032fa132f80cf37bd.patch";
-      sha256 = "1glkrwa1jmxxbmzihycxr576azjqby31jwpj165qc54c91pn0ams";
-    })
-  ];
-
   nativeBuildInputs = [ cmake makeWrapper ];
-  buildInputs = [ itk4 vtk_7 ] ++ lib.optionals stdenv.isDarwin [ Cocoa ];
+  buildInputs = [ itk-unstable vtk_8 ] ++ lib.optionals stdenv.isDarwin [ Cocoa ];
 
   cmakeFlags = [ "-DANTS_SUPERBUILD=FALSE" "-DUSE_VTK=TRUE" ];
 
diff --git a/pkgs/applications/science/biology/treemix/default.nix b/pkgs/applications/science/biology/treemix/default.nix
new file mode 100644
index 000000000000..7bf966919a67
--- /dev/null
+++ b/pkgs/applications/science/biology/treemix/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, stdenv
+, fetchurl
+, zlib
+, gsl
+, boost
+}:
+
+stdenv.mkDerivation rec {
+  pname = "treemix";
+  version = "1.13";
+
+  src = fetchurl {
+    url = "https://bitbucket.org/nygcresearch/treemix/downloads/${pname}-${version}.tar.gz";
+    sha256 = "1nd3rzsdgk47r8b8k43mdfvaagln533sm08s1jr0dz8km8nlym7y";
+  };
+
+  buildInputs = [ zlib gsl boost ];
+
+  meta = with lib ; {
+    description = "Inference of patterns of population splitting and mixing from genome-wide allele frequency data";
+    homepage = "https://bitbucket.org/nygcresearch/treemix/wiki/Home";
+    license = licenses.gpl3Only;
+    maintainers = [ maintainers.bzizou ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/terminal-emulators/foot/default.nix b/pkgs/applications/terminal-emulators/foot/default.nix
index 02c035914f3a..7ae2825f175a 100644
--- a/pkgs/applications/terminal-emulators/foot/default.nix
+++ b/pkgs/applications/terminal-emulators/foot/default.nix
@@ -27,7 +27,7 @@
 }:
 
 let
-  version = "1.13.0";
+  version = "1.13.1";
 
   # build stimuli file for PGO build and the script to generate it
   # independently of the foot's build, so we can cache the result
@@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
     owner = "dnkl";
     repo = pname;
     rev = version;
-    sha256 = "0cc262jpqp8l25p04pcqh3w671gw0p1d2zrr3d34ch8k9c6s4nzq";
+    sha256 = "0k0zbh6adwr99y9aazlyvp6s1k8zaq2j6x8kqb8q9a5qjjg56lay";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/applications/terminal-emulators/wezterm/default.nix b/pkgs/applications/terminal-emulators/wezterm/default.nix
index 70f933e7b206..0342b6817c66 100644
--- a/pkgs/applications/terminal-emulators/wezterm/default.nix
+++ b/pkgs/applications/terminal-emulators/wezterm/default.nix
@@ -29,14 +29,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wezterm";
-  version = "20220807-113146-c2fee766";
+  version = "20220903-194523-3bb1ed61";
 
   src = fetchFromGitHub {
     owner = "wez";
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    sha256 = "sha256-2krngcANqcwq8wNQZSz01srJ6yEOkk03QnO2sL7SuJA=";
+    sha256 = "sha256-R5DFBO6U1hVDCjvvNF2nDoldl+mzkrjaXR5rIPCosmM=";
   };
 
   postPatch = ''
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage rec {
     rm -r wezterm-ssh/tests
   '';
 
-  cargoSha256 = "sha256-ZkDGCR86VSCuvVlo4Pf9Ifax2BZuBicZpB/K/7bIMls=";
+  cargoSha256 = "sha256-x2n8ti9zk+h2MrwDg/FgRWTQJmCAckxE2fOHgrWdayA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/desktops/gnome/extensions/arcmenu/default.nix b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
index 74207e5bafe2..c95a36b8380e 100644
--- a/pkgs/desktops/gnome/extensions/arcmenu/default.nix
+++ b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-arcmenu";
-  version = "35";
+  version = "37";
 
   src = fetchFromGitLab {
     owner = "arcmenu";
     repo = "ArcMenu";
     rev = "v${version}";
-    sha256 = "sha256-q869UCnekCHBbB0aGNmHl8Ln32hRWHLddu3oqIUinwo=";
+    sha256 = "sha256-dXGcdDq6RbvE8ICd2VhnyMlfOH+x2jqlG3Jerll9EE8=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/itk/4.x.nix b/pkgs/development/libraries/itk/4.x.nix
deleted file mode 100644
index 54a3c33cd017..000000000000
--- a/pkgs/development/libraries/itk/4.x.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, cmake, libX11, libuuid, xz, vtk_7, Cocoa }:
-
-stdenv.mkDerivation rec {
-  pname = "itk";
-  version = "4.13.3";
-
-  src = fetchFromGitHub {
-    owner = "InsightSoftwareConsortium";
-    repo = "ITK";
-    rev = "v${version}";
-    sha256 = "067vkh39jxcvyvn69qjh4vi3wa7vdvm9m6qsg3jmnmm7gzw0kjlm";
-  };
-
-  cmakeFlags = [
-    "-DBUILD_TESTING=OFF"
-    "-DBUILD_EXAMPLES=OFF"
-    "-DBUILD_SHARED_LIBS=ON"
-    "-DModule_ITKMINC=ON"
-    "-DModule_ITKIOMINC=ON"
-    "-DModule_ITKIOTransformMINC=ON"
-    "-DModule_ITKVtkGlue=ON"
-    "-DModule_ITKReview=ON"
-  ];
-
-  nativeBuildInputs = [ cmake xz ];
-  buildInputs = [ libX11 libuuid vtk_7 ] ++ lib.optionals stdenv.isDarwin [ Cocoa ];
-
-  meta = {
-    description = "Insight Segmentation and Registration Toolkit";
-    homepage = "https://www.itk.org/";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [viric];
-    platforms = with lib.platforms; linux ++ darwin;
-  };
-}
diff --git a/pkgs/development/libraries/itk/5.x.nix b/pkgs/development/libraries/itk/5.x.nix
new file mode 100644
index 000000000000..e50f2bbca494
--- /dev/null
+++ b/pkgs/development/libraries/itk/5.x.nix
@@ -0,0 +1,5 @@
+import ./generic.nix rec {
+  version = "5.2.1";
+  rev = "v${version}";
+  sourceSha256 = "sha256-KaVe9FMGm4ZVMpwAT12fA67T0qZS3ZueiI8z85+xSwE=";
+}
diff --git a/pkgs/development/libraries/itk/default.nix b/pkgs/development/libraries/itk/generic.nix
similarity index 94%
rename from pkgs/development/libraries/itk/default.nix
rename to pkgs/development/libraries/itk/generic.nix
index 6816c37b9be6..0d742b393b1d 100644
--- a/pkgs/development/libraries/itk/default.nix
+++ b/pkgs/development/libraries/itk/generic.nix
@@ -1,9 +1,11 @@
+{ version, rev, sourceSha256 }:
+
 { lib, stdenv, fetchFromGitHub, cmake, makeWrapper
 , pkg-config, libX11, libuuid, xz, vtk, Cocoa }:
 
 stdenv.mkDerivation rec {
   pname = "itk";
-  version = "5.2.1";
+  inherit version;
 
   itkGenericLabelInterpolatorSrc = fetchFromGitHub {
     owner = "InsightSoftwareConsortium";
@@ -22,8 +24,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "InsightSoftwareConsortium";
     repo = "ITK";
-    rev = "v${version}";
-    sha256 = "sha256-KaVe9FMGm4ZVMpwAT12fA67T0qZS3ZueiI8z85+xSwE=";
+    inherit rev;
+    sha256 = sourceSha256;
   };
 
   postPatch = ''
diff --git a/pkgs/development/libraries/itk/unstable.nix b/pkgs/development/libraries/itk/unstable.nix
new file mode 100644
index 000000000000..bb64d4afca9a
--- /dev/null
+++ b/pkgs/development/libraries/itk/unstable.nix
@@ -0,0 +1,5 @@
+import ./generic.nix {
+  version = "unstable-2022-07-02";
+  rev = "5e7aea957c82b67d4364b2b88999805616e3b01d";
+  sourceSha256 = "sha256-tjkoaHCuVdvgE6X+7Kb8mt9oxINWs4R0xD9cxdEeYKk=";
+}
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index 0726356ae118..b18d9a645eaf 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ehOIWUGSPyHhNitkkA8voVciuEsCoRWv1s3MVMmOT0c=";
+    sha256 = "sha256-Sn03nY80UmL5oeoK6ScPye1oSUmEKxgoz2VLHcvor3U=";
   };
 
   outputs = [ "out" "dev" "doc" ];
diff --git a/pkgs/development/libraries/vtk/7.x.nix b/pkgs/development/libraries/vtk/7.x.nix
deleted file mode 100644
index 615553f80f22..000000000000
--- a/pkgs/development/libraries/vtk/7.x.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-import ./generic.nix {
-  majorVersion = "7.1";
-  minorVersion = "1";
-  sourceSha256 = "0nm7xwwj7rnsxjdv2ssviys8nhci4n9iiiqm2y14s520hl2dsp1d";
-  patchesToFetch = [
-    {
-      url = "https://gitlab.kitware.com/vtk/vtk/-/commit/706f1b397df09a27ab8981ab9464547028d0c322.diff";
-      sha256 = "1q3pi5h40g05pzpbqp75xlgzvbfvyw8raza51svmi7d8dlslqybx";
-    }
-
-    {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sci-libs/vtk/files/vtk-8.2.0-gcc-10.patch?id=c4256f68d3589570443075eccbbafacf661f785f";
-      sha256 = "sha256:0bpwrdfmi15grsg4jy7bzj2z6511a0c160cmw5lsi65aabyh7cl5";
-    }
-
-    # Add missing include required with recent Qt.
-    {
-      url = "https://gitlab.kitware.com/vtk/vtk/-/commit/797f28697d5ba50c1fa2bc5596af626a3c277826.diff";
-      sha256 = "BFjoKws1hVD3Ly9RS4lGN62J6RTyI1E8ATHrZdzg7ds=";
-    }
-  ];
-}
diff --git a/pkgs/development/libraries/vtk/generic.nix b/pkgs/development/libraries/vtk/generic.nix
index 467abeead3e3..b88ddee6b249 100644
--- a/pkgs/development/libraries/vtk/generic.nix
+++ b/pkgs/development/libraries/vtk/generic.nix
@@ -96,6 +96,6 @@ in stdenv.mkDerivation rec {
     maintainers = with maintainers; [ knedlsepp tfmoraes lheckemann ];
     platforms = with platforms; unix;
     # /nix/store/xxxxxxx-apple-framework-Security/Library/Frameworks/Security.framework/Headers/Authorization.h:192:7: error: variably modified 'bytes' at file scope
-    broken = stdenv.isDarwin && (lib.versions.major majorVersion == "7" || lib.versions.major majorVersion == "8");
+    broken = stdenv.isDarwin && (lib.versions.major majorVersion == "8");
   };
 }
diff --git a/pkgs/development/python-modules/atomman/default.nix b/pkgs/development/python-modules/atomman/default.nix
index cdef83e999e2..d703240cec45 100644
--- a/pkgs/development/python-modules/atomman/default.nix
+++ b/pkgs/development/python-modules/atomman/default.nix
@@ -4,6 +4,7 @@
 , cython
 , datamodeldict
 , fetchFromGitHub
+, fetchpatch
 , matplotlib
 , numericalunits
 , numpy
@@ -12,6 +13,7 @@
 , potentials
 , pymatgen
 , pytest
+, pytestCheckHook
 , pythonOlder
 , pythonAtLeast
 , requests
@@ -21,19 +23,44 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.4.4";
+  version = "1.4.5";
   pname = "atomman";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6" || pythonAtLeast "3.10";
+  disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "usnistgov";
     repo = "atomman";
     rev = "v${version}";
-    hash = "sha256-iLAB0KMtrTCyGpx+81QfHDPVDhq8OA6CDL/ipVRpyo0=";
+    hash = "sha256-wXz/uHjXKHVKJu/HoFF2mADSBLp6UGF9ivOp2ZOz/Ys=";
   };
 
+  patches = [
+    # Fix several tests that are failing on master.
+    # https://github.com/usnistgov/atomman/pull/9
+    (fetchpatch {
+      name = "fix-tests-1.patch";
+      url = "https://github.com/usnistgov/atomman/commit/d255977a5e0ce4584e2c886f6c55ccb9f5932731.patch";
+      hash = "sha256-lBFOgcozY85JfQVsVjd51Jf9mrokwQuYdxa8l7VzkqU=";
+    })
+    (fetchpatch {
+      name = "fix-tests-2.patch";
+      url = "https://github.com/usnistgov/atomman/commit/de4177f28ad7c48d482cb606f323128e2fcb86aa.patch";
+      hash = "sha256-+YpwdKCT/OTue3b2GOk9Jagg26r1PTTV2Zg+GGBd8sM=";
+    })
+    (fetchpatch {
+      name = "fix-tests-3.patch";
+      url = "https://github.com/usnistgov/atomman/commit/10b168493ee883348699f1e42680423cec84bed5.patch";
+      hash = "sha256-b4f3POjiceq3xApfjnKAs9dEf1trCiTIyu7hMPL0ZTw=";
+    })
+    (fetchpatch {
+      name = "fix-tests-4.patch";
+      url = "https://github.com/usnistgov/atomman/commit/057d24c70427bab3c7c530251ceb5f4e27eb5c56.patch";
+      hash = "sha256-FTg/GNRZ5xigGW8SpUTIw2/GEzOxwb1rsv2wGebmZOk=";
+    })
+  ];
+
   propagatedBuildInputs = [
     cython
     datamodeldict
@@ -48,22 +75,25 @@ buildPythonPackage rec {
     xmltodict
   ];
 
+  preCheck = ''
+    # By default, pytestCheckHook imports atomman from the current directory
+    # instead of from where `pip` installs it and fails due to missing Cython
+    # modules. Fix this by removing atomman from the current directory.
+    #
+    rm -r atomman
+  '';
+
   checkInputs = [
     ase
     phonopy
     pymatgen
     pytest
+    pytestCheckHook
   ];
 
-  checkPhase = ''
-    # pytestCheckHook doesn't work
-    pytest tests -k "not test_rootdir and not test_version \
-      and not test_atomic_mass and not imageflags \
-      and not test_build_unit and not test_set_and_get_in_units \
-      and not test_set_literal and not test_scalar_model " \
-      --ignore tests/plot/test_interpolate.py \
-      --ignore tests/tools/test_vect_angle.py
-  '';
+  disabledTests = [
+    "test_unique_shifts_prototype" # needs network access to download database files
+  ];
 
   pythonImportsCheck = [
     "atomman"
diff --git a/pkgs/development/python-modules/jupyterlab_server/default.nix b/pkgs/development/python-modules/jupyterlab_server/default.nix
index 38f146a71d13..2ae55b6bacd3 100644
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@@ -1,5 +1,4 @@
-{ stdenv
-, lib
+{ lib
 , buildPythonPackage
 , fetchPypi
 , hatchling
@@ -14,33 +13,31 @@
 , pytest-timeout
 , pytest-tornasync
 , ruamel-yaml
-, strict-rfc3339
+, importlib-metadata
 }:
 
 buildPythonPackage rec {
   pname = "jupyterlab_server";
-  version = "2.15.0";
+  version = "2.15.1";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-qRxRXg55caj3w8mDS3SIV/faxQL5NgS/KDmHmR/Zh+8=";
+    sha256 = "sha256-MFMTlw4THFkM93u2uMp+mFkbwwQRHo0QO8kdIS6UeW8=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "--cov jupyterlab_server --cov-report term-missing --cov-report term:skip-covered" ""
-
-    # translation tests try to install additional packages into read only paths
-    rm -r tests/translations/
-  '';
-
   nativeBuildInputs = [
     hatchling
   ];
 
-  propagatedBuildInputs = [ requests jsonschema json5 babel jupyter_server ];
+  propagatedBuildInputs = [
+    requests
+    jsonschema
+    json5
+    babel
+    jupyter_server
+  ] ++ lib.optional (pythonOlder "3.10") importlib-metadata;
 
   checkInputs = [
     openapi-core
@@ -50,19 +47,25 @@ buildPythonPackage rec {
     ruamel-yaml
   ];
 
+  postPatch = ''
+    # translation tests try to install additional packages into read only paths
+    rm -r tests/translations/
+  '';
+
   preCheck = ''
     export HOME=$(mktemp -d)
   '';
 
   pytestFlagsArray = [
-    # DeprecationWarning: The distutils package is deprecated and slated for removal in Python 3.12. Use setuptools or check PEP 632 for potential alternatives
+    # DeprecationWarning: The distutils package is deprecated and slated for removal in Python 3.12.
+    # Use setuptools or check PEP 632 for potential alternatives.
     "-W ignore::DeprecationWarning"
   ];
 
   __darwinAllowLocalNetworking = true;
 
   meta = with lib; {
-    description = "JupyterLab Server";
+    description = "A set of server components for JupyterLab and JupyterLab like applications";
     homepage = "https://jupyter.org";
     license = licenses.bsdOriginal;
     maintainers = [ maintainers.costrouc ];
diff --git a/pkgs/development/python-modules/pylibdmtx/default.nix b/pkgs/development/python-modules/pylibdmtx/default.nix
new file mode 100644
index 000000000000..2152ac54241d
--- /dev/null
+++ b/pkgs/development/python-modules/pylibdmtx/default.nix
@@ -0,0 +1,47 @@
+{ fetchFromGitHub
+, buildPythonPackage
+, pillow
+, numpy
+, libdmtx
+, lib
+}:
+
+buildPythonPackage rec {
+  pname = "pylibdmtx";
+  version = "0.1.10";
+
+  src = fetchFromGitHub {
+    owner = "NaturalHistoryMuseum";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-vNWzhO4V0mj4eItZ0Z5UG9RBCqprIcgMGNyIe1+mXWY=";
+  };
+
+  # Change:
+  # def load():
+  #     """Loads the libdmtx shared library.
+  #
+  # To:
+  # def load():
+  #     return cdll.LoadLibrary("/nix/store/.../lib/libdmtx.so")
+  #     """Loads the libdmtx shared library.
+  postPatch = ''
+    sed -i '\#def load.*#a\    return cdll.LoadLibrary("${libdmtx}/lib/libdmtx.so")' \
+        pylibdmtx/dmtx_library.py
+
+    # Checks that the loader works in various scenarios, but we just
+    # forced it to only work one way.
+    rm pylibdmtx/tests/test_dmtx_library.py
+  '';
+
+  propagatedBuildInputs = [ pillow numpy ];
+
+  pythonImportsCheck = [ "pylibdmtx" ];
+
+  meta = with lib; {
+    description = "Read and write Data Matrix barcodes from Python 2 and 3 using the libdmtx library";
+    homepage = "https://github.com/NaturalHistoryMuseum/pylibdmtx/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ grahamc ];
+  };
+}
diff --git a/pkgs/development/python-modules/remi/default.nix b/pkgs/development/python-modules/remi/default.nix
new file mode 100644
index 000000000000..4e2b9acdf64b
--- /dev/null
+++ b/pkgs/development/python-modules/remi/default.nix
@@ -0,0 +1,61 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, matplotlib
+, python-snap7
+, opencv4
+}:
+
+buildPythonPackage rec {
+  pname = "remi";
+  version = "2022.7.27";
+
+  src = fetchFromGitHub {
+    owner = "rawpython";
+    repo = pname;
+    rev = version;
+    hash = "sha256-VQn+Uzp6oGSit8ot0e8B0C2N41Q8+J+o91skyVN1gDA=";
+  };
+
+  preCheck = ''
+    # for some reason, REMI already deal with these using try blocks, but they fail
+    substituteInPlace test/test_widget.py \
+      --replace \
+        "from html_validator import " \
+        "from .html_validator import "
+    substituteInPlace test/test_examples_app.py \
+      --replace \
+        "from mock_server_and_request import " \
+        "from .mock_server_and_request import " \
+      --replace \
+        "from html_validator import " \
+        "from .html_validator import "
+    # Halves number of warnings
+    substituteInPlace test/test_*.py \
+      --replace \
+        "self.assertEquals(" \
+        "self.assertEqual("
+  '';
+
+  checkInputs = [
+    pytestCheckHook
+    python-snap7
+    opencv4
+    matplotlib
+  ];
+
+  pythonImportsCheck = [
+    "remi"
+    "editor"
+    "editor.widgets"
+  ];
+
+  meta = with lib; {
+    description = "Pythonic, lightweight and websocket-based webui library";
+    homepage = "https://github.com/rawpython/remi";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ pbsds ];
+  };
+}
diff --git a/pkgs/development/tools/buf/default.nix b/pkgs/development/tools/buf/default.nix
index aae1c7af173b..95d919155cc6 100644
--- a/pkgs/development/tools/buf/default.nix
+++ b/pkgs/development/tools/buf/default.nix
@@ -26,6 +26,10 @@ buildGoModule rec {
     ./skip_test_requiring_network.patch
     # Skip TestWorkspaceGit which requires .git and commits.
     ./skip_test_requiring_dotgit.patch
+    # Skips the invalid_upstream test as it is flakey. Based on upstream commit
+    # 27930caf2eb35c2592a77f59ed5afe4d9e2fb7ea.
+    # This patch may be removed on the next buf update.
+    ./skip_test_invalid_upstream_flakey.patch
   ];
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/tools/buf/skip_test_invalid_upstream_flakey.patch b/pkgs/development/tools/buf/skip_test_invalid_upstream_flakey.patch
new file mode 100644
index 000000000000..db62f6a40260
--- /dev/null
+++ b/pkgs/development/tools/buf/skip_test_invalid_upstream_flakey.patch
@@ -0,0 +1,24 @@
+diff --git a/private/bufpkg/bufstudioagent/bufstudioagent_test.go b/private/bufpkg/bufstudioagent/bufstudioagent_test.go
+index 6e010937..9cacc082 100644
+--- a/private/bufpkg/bufstudioagent/bufstudioagent_test.go
++++ b/private/bufpkg/bufstudioagent/bufstudioagent_test.go
+@@ -186,6 +186,19 @@ func testPlainPostHandlerErrors(t *testing.T, upstreamServer *httptest.Server) {
+ 	})
+ 
+ 	t.Run("invalid_upstream", func(t *testing.T) {
++		// TODO: unskip this test. This is flaky because of two reasons:
++		//
++		// 1. When a connection is closed, the underlying HTTP client does not
++		// always knows it, since the http handler implementation in go has no way
++		// of changing the connection timeout. See:
++		// https://github.com/golang/go/issues/16100
++		//
++		// 2. The expected status code is `StatusBadGateway` since the issue
++		// happened client-side (a response never came back from the server). This
++		// is not deterministic in the business logic because we're based on the
++		// connect error code that's returned. See
++		// https://linear.app/bufbuild/issue/BSR-383/flaky-test-in-bufstudioagent-testgo
++		t.SkipNow()
+ 		listener, err := net.Listen("tcp", "127.0.0.1:")
+ 		require.NoError(t, err)
+ 		go func() {
diff --git a/pkgs/development/tools/flyway/default.nix b/pkgs/development/tools/flyway/default.nix
index f3e5bd0337ed..0208235de3ae 100644
--- a/pkgs/development/tools/flyway/default.nix
+++ b/pkgs/development/tools/flyway/default.nix
@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl, jre_headless, makeWrapper }:
 stdenv.mkDerivation rec{
   pname = "flyway";
-  version = "9.2.0";
+  version = "9.2.2";
   src = fetchurl {
     url = "mirror://maven/org/flywaydb/flyway-commandline/${version}/flyway-commandline-${version}.tar.gz";
-    sha256 = "sha256-vNTL1yIGYgldjC69Yhj8fGShvfaDv5zM82cxwZMpzQw=";
+    sha256 = "sha256-aHsBey1WzmRhcrCeHeAeVuEvX4iaxbIb/C7N6tCOyuY=";
   };
   nativeBuildInputs = [ makeWrapper ];
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch b/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
index c136f935e03e..2a6ae96cef11 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
@@ -1,5 +1,16 @@
+diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
+index b0ff5b106..13ac380d0 100644
+--- a/data/bios-settings.d/meson.build
++++ b/data/bios-settings.d/meson.build
+@@ -1,5 +1,5 @@
+ if build_standalone and host_machine.system() == 'linux'
+ install_data('README.md',
+-  install_dir: join_paths(sysconfdir, 'fwupd', 'bios-settings.d')
++  install_dir: join_paths(sysconfdir_install, 'fwupd', 'bios-settings.d')
+ )
+ endif
 diff --git a/data/meson.build b/data/meson.build
-index d8494020d..7c896fa0d 100644
+index 3a77a7bfc..747bd1988 100644
 --- a/data/meson.build
 +++ b/data/meson.build
 @@ -26,7 +26,7 @@ endif
@@ -83,7 +94,7 @@ index 1d1698a7e..5469d00a6 100644
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index e6b717078..f8a7a7455 100644
+index e7980e965..2c66e2dc4 100644
 --- a/meson.build
 +++ b/meson.build
 @@ -195,6 +195,12 @@ endif
@@ -100,7 +111,7 @@ index e6b717078..f8a7a7455 100644
  gio = dependency('gio-2.0', version: '>= 2.45.8')
  giounix = dependency('gio-unix-2.0', version: '>= 2.45.8', required: false)
 diff --git a/meson_options.txt b/meson_options.txt
-index 06d242371..d9e517fc0 100644
+index 6cf92e72e..2e8568292 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -1,3 +1,4 @@
@@ -121,7 +132,7 @@ index 67bd3b9d9..ad04a91b6 100644
  )
  endif
 diff --git a/plugins/msr/meson.build b/plugins/msr/meson.build
-index 13f03ccd4..9235ebe33 100644
+index d626c3ad3..5a2f847d5 100644
 --- a/plugins/msr/meson.build
 +++ b/plugins/msr/meson.build
 @@ -10,7 +10,7 @@ install_data(['fwupd-msr.conf'],
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 541bef93a8a3..66cfbef940bf 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -114,7 +114,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "fwupd";
-    version = "1.8.3";
+    version = "1.8.4";
 
     # libfwupd goes to lib
     # daemon, plug-ins and libfwupdplugin go to out
@@ -123,7 +123,7 @@ let
 
     src = fetchurl {
       url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-      sha256 = "sha256-ciIpd86KhmJRH/o8CIFWb2xFjsjWHSUNlGYRfWEiOOw=";
+      sha256 = "sha256-rfoHQ0zcKexBxA/vRg6Nlwlj/gx+hJ3sfzkyrbFh+IY=";
     };
 
     patches = [
@@ -322,6 +322,7 @@ let
 
     passthru = {
       filesInstalledToEtc = [
+        "fwupd/bios-settings.d/README.md"
         "fwupd/daemon.conf"
         "fwupd/remotes.d/lvfs-testing.conf"
         "fwupd/remotes.d/lvfs.conf"
diff --git a/pkgs/servers/dns/bind/default.nix b/pkgs/servers/dns/bind/default.nix
index 1406cc7d7700..41b5b2918b06 100644
--- a/pkgs/servers/dns/bind/default.nix
+++ b/pkgs/servers/dns/bind/default.nix
@@ -48,6 +48,15 @@ stdenv.mkDerivation rec {
     for f in "$lib/lib/"*.la "$dev/bin/"bind*-config; do
       sed -i "$f" -e 's|-L${openssl.dev}|-L${lib.getLib openssl}|g'
     done
+
+    cat <<EOF >$out/etc/rndc.conf
+    include "/etc/bind/rndc.key";
+    options {
+        default-key "rndc-key";
+        default-server 127.0.0.1;
+        default-port 953;
+    };
+    EOF
   '';
 
   doCheck = false; # requires root and the net
diff --git a/pkgs/servers/kanidm/default.nix b/pkgs/servers/kanidm/default.nix
index f160886fb640..0984a622330c 100644
--- a/pkgs/servers/kanidm/default.nix
+++ b/pkgs/servers/kanidm/default.nix
@@ -17,16 +17,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "kanidm";
-  version = "1.1.0-alpha.8";
+  version = "1.1.0-alpha.9";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-zMtbE6Y9wXFPBqhmiTMJ3m6bLVZl+c6lRY39DWDlJNo=";
+    rev = "985462590b1c49b26a0b0ee01e24b1eb01942165";
+    hash = "sha256-JtoDuA3NCKmX+wDqav30VwrLeDALYat1iKFWpbYOO1s=";
   };
 
-  cargoSha256 = "sha256:1l7xqp457zfd9gfjp6f4lzgadfp6112jbip4irazw4084qwj0z6x";
+  cargoSha256 = "sha256-pkBkXIG2PF5YMeighQwHwhURWbJabfveyszRIdrQjcA=";
 
   KANIDM_BUILD_PROFILE = "release_nixos_${arch}";
 
@@ -56,25 +56,22 @@ rustPlatform.buildRustPackage rec {
     pam
   ];
 
-  # Failing tests, probably due to network issues
-  checkFlags = [
-    "--skip default_entries"
-    "--skip oauth2_openid_basic_flow"
-    "--skip test_server"
-    "--skip test_cache"
-  ];
+  # The UI needs to be in place before the tests are run.
+  postBuild = ''
+    # We don't compile the wasm-part form source, as there isn't a rustc for
+    # wasm32-unknown-unknown in nixpkgs yet.
+    mkdir $out
+    cp -r kanidmd_web_ui/pkg $out/ui
+  '';
 
   preFixup = ''
-    installShellCompletion --bash $releaseDir/build/completions/*.bash
-    installShellCompletion --zsh  $releaseDir/build/completions/_*
+    installShellCompletion \
+      --bash $releaseDir/build/completions/*.bash \
+      --zsh $releaseDir/build/completions/_*
 
     # PAM and NSS need fix library names
     mv $out/lib/libnss_kanidm.so $out/lib/libnss_kanidm.so.2
     mv $out/lib/libpam_kanidm.so $out/lib/pam_kanidm.so
-
-    # We don't compile the wasm-part form source, as there isn't a rustc for
-    # wasm32-unknown-unknown in nixpkgs yet.
-    cp -r kanidmd_web_ui/pkg $out/ui
   '';
 
   passthru.tests = { inherit (nixosTests) kanidm; };
diff --git a/pkgs/shells/carapace/default.nix b/pkgs/shells/carapace/default.nix
new file mode 100644
index 000000000000..f85937576dea
--- /dev/null
+++ b/pkgs/shells/carapace/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildGo117Module, fetchFromGitHub }:
+
+buildGo117Module rec {
+  pname = "carapace";
+  version = "0.8.10";
+
+  src = fetchFromGitHub {
+    owner = "rsteube";
+    repo = "${pname}-bin";
+    rev = "v${version}";
+    sha256 = "0j60fvrmjm4440gj9hib2ar386zxcblw7yifigsnchr7p3i2187n";
+  };
+
+  vendorSha256 = "1s1sws79cyz1rl63wayzf7yhb04x29a4a1mkifqnl4cc2pv806jf";
+
+  subPackages = [ "./cmd/carapace" ];
+
+  tags = [ "release" ];
+
+  preBuild = ''
+    go generate ./...
+  '';
+
+  meta = with lib; {
+    description = "Multi-shell multi-command argument completer";
+    homepage = "https://rsteube.github.io/carapace-bin/";
+    maintainers = with maintainers; [ mredaelli ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index c25340e38350..c73598fd6ca1 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -1,7 +1,5 @@
 { lib, stdenv
 , substituteAll
-, fetchurl
-, fetchpatch
 , fetchFromGitHub
 , autoreconfHook
 , gettext
@@ -60,22 +58,16 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus";
-  version = "1.5.26";
+  version = "1.5.27";
 
   src = fetchFromGitHub {
     owner = "ibus";
     repo = "ibus";
     rev = version;
-    sha256 = "7Vuj4Gyd+dLUoCkR4SPkfGPwVQPRo2pHk0pRAsmtjxc=";
+    sha256 = "sha256-DwX7SYRb18C0Lz2ySPS3yV99Q1xQezs0Ls2P7Rbtk5Q=";
   };
 
   patches = [
-    # Fixes systemd unit installation path https://github.com/ibus/ibus/pull/2388
-    (fetchpatch {
-      url = "https://github.com/ibus/ibus/commit/33b4b3932bfea476a841f8df99e20049b83f4b0e.patch";
-      sha256 = "kh8SBR+cqsov/B0A2YXLJVq1F171qoSRUKbBPHjPRHI=";
-    })
-
     (substituteAll {
       src = ./fix-paths.patch;
       pythonInterpreter = python3Runtime.interpreter;
diff --git a/pkgs/tools/misc/findup/default.nix b/pkgs/tools/misc/findup/default.nix
new file mode 100644
index 000000000000..0b7d687922f4
--- /dev/null
+++ b/pkgs/tools/misc/findup/default.nix
@@ -0,0 +1,39 @@
+{ lib, stdenv, fetchFromGitHub, zig, testers, findup }:
+
+stdenv.mkDerivation rec {
+  pname = "findup";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "hiljusti";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-erlKIiYYlWnhoeD3FnKdxnHjfGmmJVXk44DUja5Unig=";
+  };
+
+  nativeBuildInputs = [ zig ];
+
+  # Builds and installs (at the same time) with Zig.
+  dontConfigure = true;
+  dontBuild = true;
+
+  # Give Zig a directory for intermediate work.
+  preInstall = ''
+    export HOME=$TMPDIR
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    zig build -Drelease-safe -Dcpu=baseline --prefix $out
+    runHook postInstall
+  '';
+
+  passthru.tests.version = testers.testVersion { package = findup; };
+
+  meta = with lib; {
+    homepage = "https://github.com/hiljusti/findup";
+    description = "Search parent directories for sentinel files";
+    license = licenses.mit;
+    maintainers = with maintainers; [ hiljusti ];
+  };
+}
diff --git a/pkgs/tools/misc/lsd/default.nix b/pkgs/tools/misc/lsd/default.nix
index 3568d785eecb..c8e369e28c29 100644
--- a/pkgs/tools/misc/lsd/default.nix
+++ b/pkgs/tools/misc/lsd/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lsd";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "Peltoche";
     repo = pname;
     rev = version;
-    sha256 = "sha256-YeSEaamtIjip2nLBw/1/RSkr6ZL0p1GG2pHU14Ry6XU=";
+    sha256 = "sha256-E0STOvHeKC5uJ4l3+UU7L1gK9oKL/EChM7yVWCPqxLg=";
   };
 
-  cargoSha256 = "sha256-JsPGw5hjNy+yTZiSBeF05o9Zl6pYXxEI4kIDLY6Q54Q=";
+  cargoSha256 = "sha256-jO/3BGZIx7XibaAqd+vO1mwku3BG91/vkwpHvrUYV+Y=";
 
   nativeBuildInputs = [ installShellFiles pandoc ];
   postInstall = ''
diff --git a/pkgs/tools/networking/chrony/default.nix b/pkgs/tools/networking/chrony/default.nix
index 8c8972d0cb5d..585117b5cc73 100644
--- a/pkgs/tools/networking/chrony/default.nix
+++ b/pkgs/tools/networking/chrony/default.nix
@@ -5,11 +5,11 @@ assert stdenv.isLinux -> libcap != null;
 
 stdenv.mkDerivation rec {
   pname = "chrony";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/chrony/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Jz+f0Vwyjtbzpfa6a67DWkIaNKc7tyVgUymxcSBI25o=";
+    sha256 = "sha256-nQ2oiahl8ImlohYQ/7ZxPjyUOM4wOmO0nC+26v9biAQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 86c3f270b273..5051cf246f07 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6345,6 +6345,8 @@ with pkgs;
 
   findutils = callPackage ../tools/misc/findutils { };
 
+  findup = callPackage ../tools/misc/findup { };
+
   bsd-finger = callPackage ../tools/networking/bsd-finger { };
   bsd-fingerd = bsd-finger.override({ buildClient = false; });
 
@@ -12795,6 +12797,8 @@ with pkgs;
 
   undistract-me = callPackage ../shells/bash/undistract-me { };
 
+  carapace = callPackage ../shells/carapace { };
+
   dash = callPackage ../shells/dash { };
 
   dasht = callPackage ../tools/misc/dasht { };
@@ -18921,15 +18925,16 @@ with pkgs;
     nodejs = nodejs-14_x;
   };
 
-  itk4 = callPackage ../development/libraries/itk/4.x.nix {
-    stdenv = if stdenv.cc.isGNU && stdenv.system == "x86_64-linux" then gcc10Stdenv else stdenv;
+  itk_5 = callPackage ../development/libraries/itk/5.x.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
-  itk = callPackage ../development/libraries/itk {
+  itk-unstable = callPackage ../development/libraries/itk/unstable.nix {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
+  itk = itk_5;
+
   jama = callPackage ../development/libraries/jama { };
 
   jansson = callPackage ../development/libraries/jansson { };
@@ -22014,14 +22019,6 @@ with pkgs;
 
   vte_290 = callPackage ../development/libraries/vte/2.90.nix { };
 
-  vtk_7 = libsForQt515.callPackage ../development/libraries/vtk/7.x.nix {
-    stdenv = gcc9Stdenv;
-    inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.libs) xpc;
-    inherit (darwin.apple_sdk.frameworks) Cocoa CoreServices DiskArbitration
-                                          IOKit CFNetwork Security ApplicationServices
-                                          CoreText IOSurface ImageIO OpenGL GLUT;
-  };
   vtk_8 = libsForQt515.callPackage ../development/libraries/vtk/8.x.nix {
     stdenv = gcc9Stdenv;
     inherit (darwin) libobjc;
@@ -29761,6 +29758,8 @@ with pkgs;
 
   novnc = callPackage ../applications/networking/novnc { };
 
+  nwg-bar = callPackage ../applications/misc/nwg-bar { };
+
   nwg-drawer = callPackage ../applications/misc/nwg-drawer { };
 
   nwg-launchers = callPackage ../applications/misc/nwg-launchers { };
@@ -30492,6 +30491,8 @@ with pkgs;
 
   qcomicbook = libsForQt5.callPackage ../applications/graphics/qcomicbook { };
 
+  qelectrotech = libsForQt5.callPackage ../applications/misc/qelectrotech { };
+
   eiskaltdcpp = libsForQt5.callPackage ../applications/networking/p2p/eiskaltdcpp { };
 
   qdirstat = libsForQt5.callPackage ../applications/misc/qdirstat {};
@@ -34137,7 +34138,6 @@ with pkgs;
   angsd = callPackage ../applications/science/biology/angsd { };
 
   ants = callPackage ../applications/science/biology/ants {
-    stdenv = if stdenv.cc.isGNU && stdenv.system == "x86_64-linux" then gcc10Stdenv else stdenv;
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
@@ -34366,6 +34366,8 @@ with pkgs;
 
   tebreak = callPackage ../applications/science/biology/tebreak { };
 
+  treemix = callPackage ../applications/science/biology/treemix { };
+
   trimal = callPackage ../applications/science/biology/trimal { };
 
   truvari = callPackage ../applications/science/biology/truvari { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 77ae4f75fb51..55712c162f19 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7872,6 +7872,8 @@ in {
 
   pylibconfig2 = callPackage ../development/python-modules/pylibconfig2 { };
 
+  pylibdmtx = callPackage ../development/python-modules/pylibdmtx { };
+
   pylibftdi = callPackage ../development/python-modules/pylibftdi {
     inherit (pkgs) libusb1;
   };
@@ -9437,6 +9439,8 @@ in {
 
   remarshal = callPackage ../development/python-modules/remarshal { };
 
+  remi = callPackage ../development/python-modules/remi { };
+
   renault-api = callPackage ../development/python-modules/renault-api { };
 
   rencode = callPackage ../development/python-modules/rencode { };