diff --git a/.github/workflows/update-terraform-providers.yml b/.github/workflows/update-terraform-providers.yml
index 1ae78a4fb8f8..5a7a23f9c789 100644
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@@ -1,8 +1,8 @@
 name: "Update terraform-providers"
 
 on:
-  schedule:
-    - cron: "14 3 * * 0"
+  #schedule:
+  #  - cron: "14 3 * * 0"
   workflow_dispatch:
 
 permissions:
diff --git a/pkgs/applications/networking/cluster/clusterctl/default.nix b/pkgs/applications/networking/cluster/clusterctl/default.nix
index 5bcdf921bc3b..f6e5aa4952f8 100644
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "clusterctl";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "cluster-api";
     rev = "v${version}";
-    sha256 = "sha256-/0CZFvCBesATVGGCJoiM3GfYvCrmDJBHMXhn/o8xhKg=";
+    sha256 = "sha256-U9U1r74E4ryc8zUb1EogfBT57kfsd89i7DWO05tnQw4=";
   };
 
   vendorSha256 = "sha256-jM5qU/KaBf+CzKKOuVXjawn/QqwrCjXKaQFFomEPndg=";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index 312bf72f5a5a..ebeed89fdf61 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -4,6 +4,7 @@
 , fetchFromGitHub
 , callPackage
 , config
+, writeShellScript
 
 , cdrtools # libvirt
 }:
@@ -47,7 +48,12 @@ let
         '';
 
         # Keep the attributes around for later consumption
-        passthru = attrs;
+        passthru = attrs // {
+          updateScript = writeShellScript "update" ''
+            provider="$(basename ${provider-source-address})"
+            ./pkgs/applications/networking/cluster/terraform-providers/update-provider --no-build "$provider"
+          '';
+        };
       });
 
   list = lib.importJSON ./providers.json;
diff --git a/pkgs/applications/networking/cluster/terraform-providers/update-all-providers b/pkgs/applications/networking/cluster/terraform-providers/update-all-providers
index d7a05cf24a65..288c2f345c2c 100755
--- a/pkgs/applications/networking/cluster/terraform-providers/update-all-providers
+++ b/pkgs/applications/networking/cluster/terraform-providers/update-all-providers
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=../../../../.. -i bash -p jq
+#! nix-shell -i bash -p jq
 # shellcheck shell=bash
 
 # Update all providers which have specified provider source address
diff --git a/pkgs/applications/networking/cluster/terraform-providers/update-provider b/pkgs/applications/networking/cluster/terraform-providers/update-provider
index 482da6a60275..f0fa979b98cb 100755
--- a/pkgs/applications/networking/cluster/terraform-providers/update-provider
+++ b/pkgs/applications/networking/cluster/terraform-providers/update-provider
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=../../../../.. -i bash -p coreutils curl git jq moreutils nix nix-prefetch
+#! nix-shell -i bash -p coreutils curl git jq moreutils nix nix-prefetch
 # shellcheck shell=bash
 # vim: ft=sh
 #
@@ -100,6 +100,8 @@ echo_provider() {
   echo "== terraform-providers.${provider}: $* =="
 }
 
+pushd "$(dirname "$0")"
+
 if [[ ${provider} =~ ^[^/]+/[^/]+$ ]]; then
   echo_provider "init"
   source_address=registry.terraform.io/${provider}
@@ -164,3 +166,5 @@ if [[ ${build} == 1 ]]; then
   echo_provider "building"
   nix-build --no-out-link "${repo_root}" -A "terraform-providers.${provider}"
 fi
+
+popd
diff --git a/pkgs/applications/virtualization/lkl/default.nix b/pkgs/applications/virtualization/lkl/default.nix
index 3bb12836a032..1a6d80220e21 100644
--- a/pkgs/applications/virtualization/lkl/default.nix
+++ b/pkgs/applications/virtualization/lkl/default.nix
@@ -3,15 +3,15 @@
 
 stdenv.mkDerivation rec {
   pname = "lkl";
-  version = "2019-10-04";
+  version = "2022-05-18";
 
   outputs = [ "dev" "lib" "out" ];
 
   src = fetchFromGitHub {
     owner  = "lkl";
     repo   = "linux";
-    rev  = "06ca3ddb74dc5b84fa54fa1746737f2df502e047";
-    sha256 = "0qjp0r338bwgrqdsvy5mkdh7ryas23m47yvxfwdknfyl0k3ylq62";
+    rev  = "10c7b5dee8c424cc2ab754e519ecb73350283ff9";
+    sha256 = "sha256-D3HQdKzhB172L62a+8884bNhcv7vm/c941wzbYtbf4I=";
   };
 
   nativeBuildInputs = [ bc bison flex python3 ];
@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
     # Fix a /usr/bin/env reference in here that breaks sandboxed builds
     patchShebangs arch/lkl/scripts
 
+    patchShebangs scripts/ld-version.sh
+
     # Fixup build with newer Linux headers: https://github.com/lkl/linux/pull/484
     sed '1i#include <linux/sockios.h>' -i tools/lkl/lib/hijack/xlate.c
   '';
diff --git a/pkgs/development/libraries/cglm/default.nix b/pkgs/development/libraries/cglm/default.nix
index 50a9bf62c54b..9394eab133be 100644
--- a/pkgs/development/libraries/cglm/default.nix
+++ b/pkgs/development/libraries/cglm/default.nix
@@ -17,6 +17,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];
+
   meta = with lib; {
     homepage = "https://github.com/recp/cglm";
     description = "Highly Optimized Graphics Math (glm) for C";
diff --git a/pkgs/development/python-modules/diagrams/default.nix b/pkgs/development/python-modules/diagrams/default.nix
index 4c00657df14c..49fd55545178 100644
--- a/pkgs/development/python-modules/diagrams/default.nix
+++ b/pkgs/development/python-modules/diagrams/default.nix
@@ -13,15 +13,15 @@
 
 buildPythonPackage rec {
   pname = "diagrams";
-  version = "0.21.1";
+  version = "0.22.0";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "mingrammer";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-YoXV5ikkBCSVyGmzEqp+7JLy82d7z9sbwS+U/EN3BFk=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-LUuClvBJeOxtrg+S+lYLpP7T1RXCy5dNjFYQO3H54QE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/misc/circleci-cli/default.nix b/pkgs/development/tools/misc/circleci-cli/default.nix
index fa73ef702d91..2c83d2305563 100644
--- a/pkgs/development/tools/misc/circleci-cli/default.nix
+++ b/pkgs/development/tools/misc/circleci-cli/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib, fetchFromGitHub, buildGoModule, installShellFiles }:
 
 buildGoModule rec {
   pname = "circleci-cli";
@@ -13,10 +13,20 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-jrAd1G/NCjXfaJmzOhMjMZfJoGHsQ1bi3HudBM0e8rE=";
 
+  nativeBuildInputs = [ installShellFiles ];
+
   doCheck = false;
 
   ldflags = [ "-s" "-w" "-X github.com/CircleCI-Public/circleci-cli/version.Version=${version}" "-X github.com/CircleCI-Public/circleci-cli/version.Commit=${src.rev}" "-X github.com/CircleCI-Public/circleci-cli/version.packageManager=nix" ];
 
+  postInstall = ''
+    mv $out/bin/circleci-cli $out/bin/circleci
+
+    installShellCompletion --cmd circleci \
+      --bash <($out/bin/circleci completion bash --skip-update-check) \
+      --zsh <($out/bin/circleci completion zsh --skip-update-check)
+  '';
+
   meta = with lib; {
     # Box blurb edited from the AUR package circleci-cli
     description = ''
@@ -24,6 +34,7 @@ buildGoModule rec {
       run jobs as if they were running on the hosted CirleCI application.
     '';
     maintainers = with maintainers; [ synthetica ];
+    mainProgram = "circleci";
     license = licenses.mit;
     homepage = "https://circleci.com/";
   };
diff --git a/pkgs/development/tools/rust/probe-run/default.nix b/pkgs/development/tools/rust/probe-run/default.nix
index dea5d4be52ff..4135a26d0f12 100644
--- a/pkgs/development/tools/rust/probe-run/default.nix
+++ b/pkgs/development/tools/rust/probe-run/default.nix
@@ -3,21 +3,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "probe-run";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-7o0aRiCxWoDoMysXIPyiBqH/8TtFo87im6Y0OFL0cTA=";
+    sha256 = "sha256-xVxigZET2/7xr+bb3r80F3y0yaNV1JeGeJ2EF0GWa1A=";
   };
 
-  cargoSha256 = "sha256-vREz3FTZXMrc18LXIycJXX6SgW6IKGIgL/+79dMfNjk=";
+  cargoSha256 = "sha256-MK3F3Kt80Xdbbm68Jv1uh78nAj1LzJ90H54NYdn+Oms=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libusb1 ]
     ++ lib.optionals stdenv.isDarwin [ libiconv AppKit IOKit ];
 
   meta = with lib; {
-    description = "Run embedded programs just like native ones.";
+    description = "Run embedded programs just like native ones";
     homepage = "https://github.com/knurling-rs/probe-run";
     changelog = "https://github.com/knurling-rs/probe-run/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 /* or */ mit ];
diff --git a/pkgs/development/web/cypress/default.nix b/pkgs/development/web/cypress/default.nix
index 0b1ce3de7580..8212c9a34b92 100644
--- a/pkgs/development/web/cypress/default.nix
+++ b/pkgs/development/web/cypress/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cypress";
-  version = "10.3.1";
+  version = "10.8.0";
 
   src = fetchzip {
     url = "https://cdn.cypress.io/desktop/${version}/linux-x64/cypress.zip";
-    sha256 = "sha256-LfvTnvOGFFZn7tUQ150fCO0gw7TK6JJj+Ys75VjJJ2M=";
+    sha256 = "sha256-QKzdK/3WGcNoPPgsCO08rmOFgwgYTI9yvP70HoGvojg=";
   };
 
   # don't remove runtime deps
@@ -70,6 +70,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Fast, easy and reliable testing for anything that runs in a browser";
     homepage = "https://www.cypress.io";
+    mainProgram = "Cypress";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mit;
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 028799298d09..5dae4eee3832 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "5.19.7"; #zen
-    suffix = "zen2"; #zen
-    sha256 = "19hvjbw845g8jhfy6mhjizlkcq26si4mm9nchd3jl5mmbps4k2sp"; #zen
+    version = "5.19.8"; #zen
+    suffix = "zen1"; #zen
+    sha256 = "1jqzny85gl2wc029wp96v5x48wpn6nyx6zx9xrxqw0bhrlczzgq7"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "5.19.7"; #lqx
-    suffix = "lqx1"; #lqx
-    sha256 = "0zackpfnc4fmf9hvlcbmw9sdw3hag023k3ppy0iaakrfq44zqnis"; #lqx
+    version = "5.19.8"; #lqx
+    suffix = "lqx2"; #lqx
+    sha256 = "1k1i9fqc0d5p2kp9bwdsp0ccbdfimavx4wpxv48mcnb7b93bpln2"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/tools/games/er-patcher/default.nix b/pkgs/tools/games/er-patcher/default.nix
index 9d58f718e818..f5e7ddf7de16 100644
--- a/pkgs/tools/games/er-patcher/default.nix
+++ b/pkgs/tools/games/er-patcher/default.nix
@@ -6,13 +6,13 @@
 
 runCommandLocal "er-patcher" rec {
   pname = "er-patcher";
-  version = "1.06-1";
+  version = "1.06-2";
 
   src = fetchFromGitHub {
     owner = "gurrgur";
     repo = "er-patcher";
     rev = "v${version}";
-    sha256 = "sha256-tjGvM+LNvHYX2VbVjwL404jpWWCzJ6j5jRPg/wib4e8=";
+    sha256 = "sha256-rFIuswn55FNVmBoDfIpG2cKxybNDaTwOeIUFFoncGF0=";
   };
 
   buildInputs = [
diff --git a/pkgs/tools/networking/megatools/default.nix b/pkgs/tools/networking/megatools/default.nix
index b4d420ea22da..2fbd7e88466b 100644
--- a/pkgs/tools/networking/megatools/default.nix
+++ b/pkgs/tools/networking/megatools/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     description = "Command line client for Mega.co.nz";
     homepage = "https://megatools.megous.com/";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ viric AndersonTorres zowoq ];
+    maintainers = with maintainers; [ viric AndersonTorres ];
     platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/security/semgrep/common.nix b/pkgs/tools/security/semgrep/common.nix
index 2c4a377efab6..a721448124e4 100644
--- a/pkgs/tools/security/semgrep/common.nix
+++ b/pkgs/tools/security/semgrep/common.nix
@@ -1,13 +1,13 @@
 { lib, fetchFromGitHub, fetchzip, stdenv }:
 
 rec {
-  version = "0.108.0";
+  version = "0.112.1";
 
   src = fetchFromGitHub {
     owner = "returntocorp";
     repo = "semgrep";
     rev = "v${version}";
-    sha256 = "sha256-Vdrv7lVPsBsxkwwfviD5zRAdsD02RfWmM+IlaThduQs=";
+    sha256 = "sha256-SZtxZz4x6YUKw1uO5HQTU4lRY989SoCNsPQphJr+L0Y=";
   };
 
   # submodule dependencies
@@ -17,25 +17,25 @@ rec {
   langsSrc = fetchFromGitHub {
     owner = "returntocorp";
     repo = "semgrep-langs";
-    rev = "98e4aacb0d58539b50a642a28d916a5d749e2a42";
-    sha256 = "sha256-7w+8vLmzqBjbeV+a4Br7kLQ2bJv3aZJw8cB0R9d/D+E=";
+    rev = "91e288062eb794e8a5e6967d1009624237793491";
+    sha256 = "sha256-z2t2bTRyj5zu9h/GBg2YeRFimpJsd3dA7dK8VBaKzHo=";
   };
 
   interfacesSrc = fetchFromGitHub {
     owner = "returntocorp";
     repo = "semgrep-interfaces";
-    rev = "bad298d06a5dc50e69b6818ba73f0cc9b9a17b58";
-    sha256 = "sha256-AgNSvjVsP4b4zwkmq6BoNcOX3xdCSnQmXK+fVSkDXxQ=";
+    rev = "7bc457a32e088ef21adf1529fa0ddeea634b9131";
+    sha256 = "sha256-xN8Qm1/YLa49k9fZKDoPPmHASI2ipI3mkKlwEK2ajO4=";
   };
 
   # fetch pre-built semgrep-core since the ocaml build is complex and relies on
   # the opam package manager at some point
   coreRelease = if stdenv.isDarwin then fetchzip {
       url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}-osx.zip";
-      sha256 = "sha256-f3ah4yGvtUL3Ievz+3hhh5Am1YMplRxsRQzdRAoF9uU=";
+      sha256 = "sha256-JiOH39vMDL6r9WKuPO0CDkRwGZtzl/GIFoSegVddFpw=";
   } else fetchzip {
       url = "https://github.com/returntocorp/semgrep/releases/download/v${version}/semgrep-v${version}-ubuntu-16.04.tgz";
-      sha256 = "sha256-qie9svlzRoAsI33W+Sxh4YTVk1iPV0NVXfzfKlEUul4=";
+      sha256 = "sha256-V6r+VQrgz8uVSbRa2AmW4lnLxovk63FL7LqVKD46RBw=";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/security/semgrep/default.nix b/pkgs/tools/security/semgrep/default.nix
index 35a2a459587c..1df7c515e305 100644
--- a/pkgs/tools/security/semgrep/default.nix
+++ b/pkgs/tools/security/semgrep/default.nix
@@ -4,6 +4,7 @@
 , semgrep-core
 , buildPythonApplication
 , pythonPackages
+, pythonRelaxDepsHook
 
 , pytestCheckHook
 , git
@@ -19,12 +20,15 @@ buildPythonApplication rec {
 
   SEMGREP_CORE_BIN = "${semgrep-core}/bin/semgrep-core";
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "typing-extensions~=4.2" "typing-extensions" \
-      --replace "jsonschema~=3.2" "jsonschema" \
-      --replace "boltons~=21.0" "boltons"
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
+  pythonRelaxDeps = [
+    "attrs"
+    "boltons"
+    "jsonschema"
+    "typing-extensions"
+  ];
 
+  postPatch = ''
     # remove git submodule placeholders
     rm -r ./src/semgrep/{lang,semgrep_interfaces}
     # link submodule dependencies