diff --git a/pkgs/applications/misc/octoprint/default.nix b/pkgs/applications/misc/octoprint/default.nix
index 16937fa57b02..0c0dae0da42e 100644
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@@ -33,6 +33,22 @@ let
         (mkOverride "unidecode" "0.04.21" "280a6ab88e1f2eb5af79edff450021a0d3f0448952847cd79677e55e58bad051")
         (mkOverride "sarge" "0.1.5.post0" "1c1ll7pys9vra5cfi8jxlgrgaql6c27l6inpy15aprgqhc4ck36s")
 
+        # Requires websocket-client <1.0, >=0.57. Cannot do mkOverride b/c differing underscore/hyphen in pypi source name
+        (
+          self: super: {
+            websocket-client = super.websocket-client.overridePythonAttrs (
+              oldAttrs: rec {
+                version = "0.58.0";
+                src = oldAttrs.src.override {
+                  pname = "websocket_client";
+                  inherit version;
+                  sha256 = "63509b41d158ae5b7f67eb4ad20fecbb4eee99434e73e140354dc3ff8e09716f";
+                };
+              }
+            );
+          }
+        )
+
         # Octoprint needs zeroconf >=0.24 <0.25. While this should be done in
         # the mkOverride aboves, this package also has broken tests, so we need
         # a proper override.
diff --git a/pkgs/applications/networking/cluster/linkerd/default.nix b/pkgs/applications/networking/cluster/linkerd/default.nix
index 0dd6363d07e3..eeab5a1d02ec 100644
--- a/pkgs/applications/networking/cluster/linkerd/default.nix
+++ b/pkgs/applications/networking/cluster/linkerd/default.nix
@@ -1,27 +1,71 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib, fetchFromGitHub, buildGoModule, installShellFiles }:
 
-buildGoModule {
-  pname = "linkerd-unstable";
-  version = "2020-05-01";
+let generic = { channel, version, sha256, vendorSha256 }:
+  buildGoModule rec {
+    pname = "linkerd-${channel}";
+    inherit version vendorSha256;
 
-  src = fetchFromGitHub {
-    owner = "linkerd";
-    repo = "linkerd2";
-    rev = "9e9f3bb1e2aeab8cf20f98f5cad159bbb6f24883";
-    sha256 = "1pvj31wz1klwhcqga1m8kixdqsxwmppp9ix6r3wpp4dwfig45fm0";
+    src = fetchFromGitHub {
+      owner = "linkerd";
+      repo = "linkerd2";
+      rev = "${channel}-${version}";
+      inherit sha256;
+    };
+
+    subPackages = [ "cli" ];
+    runVend = true;
+
+    preBuild = ''
+      env GOFLAGS="" go generate ./pkg/charts/static
+      env GOFLAGS="" go generate ./jaeger/static
+      env GOFLAGS="" go generate ./multicluster/static
+      env GOFLAGS="" go generate ./viz/static
+    '';
+
+    buildFlagsArray = [
+      "-tags=prod"
+    ];
+
+    ldflags = [
+      "-s" "-w"
+      "-X github.com/linkerd/linkerd2/pkg/version.Version=${src.rev}"
+    ];
+
+    nativeBuildInputs = [ installShellFiles ];
+
+    postInstall = ''
+      mv $out/bin/cli $out/bin/linkerd
+      installShellCompletion --cmd linkerd \
+        --bash <($out/bin/linkerd completion bash) \
+        --zsh <($out/bin/linkerd completion zsh) \
+        --fish <($out/bin/linkerd completion fish)
+    '';
+
+    doInstallCheck = true;
+    installCheckPhase = ''
+      $out/bin/linkerd version --client | grep ${src.rev} > /dev/null
+    '';
+
+    meta = with lib; {
+      description = "A simple Kubernetes service mesh that improves security, observability and reliability";
+      downloadPage = "https://github.com/linkerd/linkerd2/";
+      homepage = "https://linkerd.io/";
+      license = licenses.asl20;
+      maintainers = with maintainers; [ Gonzih bryanasdev000 superherointj ];
+    };
   };
-
-  vendorSha256 = "0vls58ld50jca5yn73kvg3lx4z83cc7skky54a90pkbj737y58pz";
-
-  doCheck = false;
-
-  subPackages = [ "cli/cmd" ];
-
-  meta = with lib; {
-    description = "A service mesh for Kubernetes and beyond";
-    homepage = "https://linkerd.io/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ Gonzih ];
-    broken = true;
-  };
-}
+in
+  {
+    stable = generic {
+      channel = "stable";
+      version = "2.10.2";
+      sha256 = "sha256-dOD0S4FJ2lXE+1VZooi8tKvC8ndGEHAxmAvSqoWI/m0=";
+      vendorSha256 = "sha256-Qb0FZOvKL9GgncfUl538PynkYbm3V8Q6lUpApUoIp5s=";
+    };
+    edge = generic {
+      channel = "edge";
+      version = "21.6.2";
+      sha256 = "sha256-kgdKH+cIYRg5A3+wrJJ7jcY6Xl206EwBYa37PT3xn1k";
+      vendorSha256 = "sha256-QVLg1ZRsNQPM4lERVHpZLbd+I32JZ1pbGNSGIVTbseg=";
+    };
+  }
diff --git a/pkgs/applications/printing/pappl/default.nix b/pkgs/applications/printing/pappl/default.nix
index de0b9bada53c..9752ebc0e7ce 100644
--- a/pkgs/applications/printing/pappl/default.nix
+++ b/pkgs/applications/printing/pappl/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pappl";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "michaelrsweet";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-L4ptgAJAvyTUCVl6YotA8DnlISc9PwZM0WjXyOvxGJg=";
+    sha256 = "sha256-B3g6R0/li+5D4odFG21qj+SR3K4PFnzzxIGCwbk1buo=";
   };
 
   outputs = [ "out" "dev" ];
diff --git a/pkgs/applications/virtualization/containerd/default.nix b/pkgs/applications/virtualization/containerd/default.nix
index 5435c88f58d6..ca9ae20f3468 100644
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@@ -1,6 +1,6 @@
 { lib
 , fetchFromGitHub
-, buildGoPackage
+, buildGoModule
 , btrfs-progs
 , go-md2man
 , installShellFiles
@@ -8,19 +8,20 @@
 , nixosTests
 }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "containerd";
-  version = "1.5.1";
+  version = "1.5.2";
+
+  outputs = [ "out" "man" ];
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = "containerd";
     rev = "v${version}";
-    sha256 = "sha256-jVyg+fyMuDnV/TM0Z2t+Cr17a6XBv11aWijhsqMnA5s=";
+    sha256 = "sha256-RDLAmPBjDHCx9al+gstUTrvKc/L0vAm8IEd/mvX5Als=";
   };
 
-  goPackagePath = "github.com/containerd/containerd";
-  outputs = [ "out" "man" ];
+  vendorSha256 = null;
 
   nativeBuildInputs = [ go-md2man installShellFiles util-linux ];
 
@@ -28,11 +29,9 @@ buildGoPackage rec {
 
   buildFlags = [ "VERSION=v${version}" "REVISION=${src.rev}" ];
 
-  BUILDTAGS = [ ]
-    ++ lib.optional (btrfs-progs == null) "no_btrfs";
+  BUILDTAGS = lib.optionals (btrfs-progs == null) [ "no_btrfs" ];
 
   buildPhase = ''
-    cd go/src/${goPackagePath}
     patchShebangs .
     make binaries man $buildFlags
   '';
diff --git a/pkgs/applications/virtualization/runc/default.nix b/pkgs/applications/virtualization/runc/default.nix
index 795971a74920..b3578e175d49 100644
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@@ -1,6 +1,6 @@
 { lib
 , fetchFromGitHub
-, buildGoPackage
+, buildGoModule
 , go-md2man
 , installShellFiles
 , pkg-config
@@ -14,7 +14,7 @@
 , nixosTests
 }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "runc";
   version = "1.0.0-rc95";
 
@@ -25,7 +25,7 @@ buildGoPackage rec {
     sha256 = "sha256-q4sXcvJO9gyo7m0vlaMrwh7ZZHYa58FJy3GatWndS6M=";
   };
 
-  goPackagePath = "github.com/opencontainers/runc";
+  vendorSha256 = null;
   outputs = [ "out" "man" ];
 
   nativeBuildInputs = [ go-md2man installShellFiles makeWrapper pkg-config which ];
@@ -36,7 +36,6 @@ buildGoPackage rec {
 
   buildPhase = ''
     runHook preBuild
-    cd go/src/${goPackagePath}
     patchShebangs .
     make ${toString makeFlags} runc man
     runHook postBuild
diff --git a/pkgs/development/interpreters/duktape/default.nix b/pkgs/development/interpreters/duktape/default.nix
index 360666d898af..ba533a172761 100644
--- a/pkgs/development/interpreters/duktape/default.nix
+++ b/pkgs/development/interpreters/duktape/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, validatePkgConfig }:
 
 stdenv.mkDerivation rec {
   pname = "duktape";
@@ -8,6 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "19szwxzvl2g65fw95ggvb8h0ma5bd9vvnnccn59hwnc4dida1x4n";
   };
 
+  nativeBuildInputs = [ validatePkgConfig ];
+
   postPatch = ''
     substituteInPlace Makefile.sharedlibrary \
       --replace 'gcc' '${stdenv.cc.targetPrefix}cc' \
@@ -23,9 +25,10 @@ stdenv.mkDerivation rec {
   installPhase = ''
     install -d $out/bin
     install -m755 duk $out/bin/
-    install -d $out/lib
+    install -d $out/lib/pkgconfig
     install -d $out/include
     make -f Makefile.sharedlibrary install INSTALL_PREFIX=$out
+    substituteAll ${./duktape.pc.in} $out/lib/pkgconfig/duktape.pc
   '';
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/interpreters/duktape/duktape.pc.in b/pkgs/development/interpreters/duktape/duktape.pc.in
new file mode 100644
index 000000000000..d34edb320e2e
--- /dev/null
+++ b/pkgs/development/interpreters/duktape/duktape.pc.in
@@ -0,0 +1,10 @@
+prefix=@out@
+exec_prefix=${prefix}
+libdir=${exec_prefix}/lib
+includedir=${prefix}/include
+
+Name: duktape
+Description: An embeddable Javascript engine, with a focus on portability and compact footprint
+Version: @version@
+Libs: -L${libdir} -lduktape
+Cflags: -I${includedir}
diff --git a/pkgs/development/libraries/intel-media-sdk/default.nix b/pkgs/development/libraries/intel-media-sdk/default.nix
index 78e2ebae96ac..47a3ca4f9f99 100644
--- a/pkgs/development/libraries/intel-media-sdk/default.nix
+++ b/pkgs/development/libraries/intel-media-sdk/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-sdk";
-  version = "21.2.0";
+  version = "21.2.2";
 
   src = fetchFromGitHub {
     owner = "Intel-Media-SDK";
     repo = "MediaSDK";
     rev = "intel-mediasdk-${version}";
-    sha256 = "sha256-LusgmvlWOMEQjy47IpA9IYcl/cUTSMmvxSwvV/ihs2g=";
+    sha256 = "sha256-iSrr9g6C8YRcmu92sTyDCh76Cdu8wbDL3COwiVxox4Q=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/libraries/librime/default.nix b/pkgs/development/libraries/librime/default.nix
index eb9c514d59d2..3a2ca1e18c15 100644
--- a/pkgs/development/libraries/librime/default.nix
+++ b/pkgs/development/libraries/librime/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "librime";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "rime";
     repo = pname;
     rev = version;
-    sha256 = "023c7bpfnyf8wlrssn89ziwsjccflyanrxlaqmwcbx8a5dvipk01";
+    sha256 = "sha256-GzNMwyJR9PgJN0eGYbnBW6LS3vo4SUVLdyNG9kcEE18=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix b/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix
index 2dc34b883be7..ca96e63060da 100644
--- a/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix
+++ b/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix
@@ -1,5 +1,11 @@
-{ lib, buildPythonPackage, fetchPypi, requests
-, websocket-client, pythonOlder }:
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, requests
+, six
+, websocket-client
+}:
 
 buildPythonPackage rec {
   pname = "jellyfin-apiclient-python";
@@ -11,7 +17,11 @@ buildPythonPackage rec {
     sha256 = "sha256-nSLUa9/jAT6XrHo77kV5HYBxPO/lhcWKqPfpES7ul9A=";
   };
 
-  propagatedBuildInputs = [ requests websocket-client ];
+  propagatedBuildInputs = [
+    requests
+    six
+    websocket-client
+  ];
 
   doCheck = false; # no tests
   pythonImportsCheck = [ "jellyfin_apiclient_python" ];
diff --git a/pkgs/development/python-modules/websocket-client/default.nix b/pkgs/development/python-modules/websocket-client/default.nix
index b6b2c7ee0361..ee09ceb10504 100644
--- a/pkgs/development/python-modules/websocket-client/default.nix
+++ b/pkgs/development/python-modules/websocket-client/default.nix
@@ -1,27 +1,22 @@
 { lib
-, backports_ssl_match_hostname
 , buildPythonPackage
 , fetchPypi
-, isPy27
+, pythonOlder
 , pytestCheckHook
-, six
+, pysocks
 }:
 
 buildPythonPackage rec {
   pname = "websocket-client";
-  version = "0.58.0";
+  version = "1.1.0";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
-    pname = "websocket_client";
-    inherit version;
-    sha256 = "sha256-Y1CbQdFYrlt/Z+tK0g/su07umUNOc+FANU3D/44JcW8=";
+    inherit pname version;
+    sha256 = "sha256-to5JWdcEdo+iDjXJ1QjI3Cu8BB/Y0mfA1zRc/+KCRWg=";
   };
 
-  propagatedBuildInputs = [
-    six
-  ] ++ lib.optional isPy27 backports_ssl_match_hostname;
-
-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [ pytestCheckHook pysocks ];
 
   pythonImportsCheck = [ "websocket" ];
 
@@ -30,5 +25,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/websocket-client/websocket-client";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ fab ];
+    changelog = "https://github.com/websocket-client/websocket-client/blob/v${version}/ChangeLog";
   };
 }
diff --git a/pkgs/development/tools/azcopy/default.nix b/pkgs/development/tools/azcopy/default.nix
index 0be3f5c0b7ef..06bff61fcdd1 100644
--- a/pkgs/development/tools/azcopy/default.nix
+++ b/pkgs/development/tools/azcopy/default.nix
@@ -2,18 +2,18 @@
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
-  version = "10.10.0";
+  version = "10.11.0";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-storage-azcopy";
     rev = "v${version}";
-    sha256 = "sha256-gWU219QlV+24RxnTHqQzQeGZHzVwmBXNKU+3QI6WvHI=";
+    sha256 = "sha256-mti93UDFgHQKJt3z1sjCkT71TZtwh2YnhTyUCi5tS5c=";
   };
 
   subPackages = [ "." ];
 
-  vendorSha256 = "sha256-d965Rt8W74bsIZAZPZLe3twuUpp4wrnNc0qwjsKikOE=";
+  vendorSha256 = "sha256-NEW1qXOxFPmDFUTciJkqwutZd3+sVkHgoZgQO8Gsdwk=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/rust/cargo-make/default.nix b/pkgs/development/tools/rust/cargo-make/default.nix
index 2f20c66bbe25..d5fd7ee4a839 100644
--- a/pkgs/development/tools/rust/cargo-make/default.nix
+++ b/pkgs/development/tools/rust/cargo-make/default.nix
@@ -13,11 +13,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-make";
-  version = "0.33.0";
+  version = "0.34.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-OnCSWAGcxQsLq5aQmd/15lAQmdsCGPqLeRYWXQG0oG0=";
+    sha256 = "sha256-/9v9nedLoXwuFuqw3W4RjTwvNIlisbiPCcVF/0oH4fw=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration libiconv ];
 
-  cargoSha256 = "sha256-BsE5+0bL9ctsdZ/PM1d6TfrXuzNMYHejoqA3bgH8140=";
+  cargoSha256 = "sha256-clav4lGDuWvwzq78Kw+vtz+boNcZnNH+NHH7ZaZYSC4=";
 
   # Some tests fail because they need network access.
   # However, Travis ensures a proper build.
diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index 13665b3531f4..1c54a455f7a3 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -452,6 +452,23 @@ let
         };
       };
 
+      foam.foam-vscode = buildVscodeMarketplaceExtension {
+        meta = with lib; {
+          changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
+          description = "A personal knowledge management and sharing system for VSCode ";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=foam.foam-vscode";
+          homepage = "https://foambubble.github.io/";
+          license = licenses.mit;
+          maintainers = with maintainers; [ ratsclub ];
+        };
+        mktplcRef = {
+          name = "foam-vscode";
+          publisher = "foam";
+          version = "0.13.7";
+          sha256 = "Y2pcd4iXPiuhJdD/9d+tbTJN18O4+kRMqUdOtbx8xy8=";
+        };
+      };
+
       formulahendry.auto-close-tag = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "auto-close-tag";
@@ -566,8 +583,8 @@ let
         mktplcRef = {
           name = "Go";
           publisher = "golang";
-          version = "0.18.1";
-          sha256 = "sha256-b2Wa3TULQQnBm1/xnDCB9SZjE+Wxz5wBttjDEtf8qlE=";
+          version = "0.25.1";
+          sha256 = "sha256-ZDUWN9lzDnR77W7xcMFQaaFl/6Lf/x1jgaBkwZPqGGw=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index f9c25f123688..1fedb688920b 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,32 +1,32 @@
 {
     "4.14": {
         "extra": "-hardened1",
-        "name": "linux-hardened-4.14.236-hardened1.patch",
-        "sha256": "08wnc1acx8fnnrpaz5hxw9gakgk7qxf3kq1pycljl7396dnsy6xg",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.236-hardened1/linux-hardened-4.14.236-hardened1.patch"
+        "name": "linux-hardened-4.14.237-hardened1.patch",
+        "sha256": "0iz7q29dazp11ii1f2kcffkpi14765w0ryrn6dsb8mlqcsw639lc",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.237-hardened1/linux-hardened-4.14.237-hardened1.patch"
     },
     "4.19": {
         "extra": "-hardened1",
-        "name": "linux-hardened-4.19.194-hardened1.patch",
-        "sha256": "102w5algxybffy5176zzgz7knafpdc0lp9y5wjdrf6yr65l4j5rj",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.194-hardened1/linux-hardened-4.19.194-hardened1.patch"
+        "name": "linux-hardened-4.19.195-hardened1.patch",
+        "sha256": "1h8v28kscaz4y2samww3vxpq4xvkbdvsnr0hybimn0ygwphshpqq",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.195-hardened1/linux-hardened-4.19.195-hardened1.patch"
     },
     "5.10": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.10.43-hardened1.patch",
-        "sha256": "0hx2g4brpk32phiin96w4kgsbibrcb69a22p0rsqcanxl76v48sz",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.43-hardened1/linux-hardened-5.10.43-hardened1.patch"
+        "name": "linux-hardened-5.10.44-hardened1.patch",
+        "sha256": "12bxv87w74lj73vqflpfk022x2ig81lfn4pf1gfanw9zxjrapw4m",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.44-hardened1/linux-hardened-5.10.44-hardened1.patch"
     },
     "5.12": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.12.10-hardened1.patch",
-        "sha256": "0wyw33kg3xih2j19hsff9mapxjll8ad38il74gkcbnhwci0ys1mc",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.12.10-hardened1/linux-hardened-5.12.10-hardened1.patch"
+        "name": "linux-hardened-5.12.11-hardened1.patch",
+        "sha256": "15qi1znszdg6c0v077k1p4gs0kbpvp6hqjcyg262yqjlpn1c7hcb",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.12.11-hardened1/linux-hardened-5.12.11-hardened1.patch"
     },
     "5.4": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.4.125-hardened1.patch",
-        "sha256": "1vc6jgiglc4i5my9iw24yw16wi0x1lxkvyb6i619z3k3zh39gm04",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.125-hardened1/linux-hardened-5.4.125-hardened1.patch"
+        "name": "linux-hardened-5.4.126-hardened1.patch",
+        "sha256": "05bjry8390iy01nfvkp12x78brgndwm5rsqhnl7yp6vwgdi0fyj1",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.126-hardened1/linux-hardened-5.4.126-hardened1.patch"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 9f40429f0ada..a550008b9d50 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.236";
+  version = "4.14.237";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0albmgxj3cb1dvjagj54l0ffa7kwi8brh7bqwj6gvzpylsby5sp4";
+    sha256 = "0kib9p61hhwjbr8zhir9aw86qik7k6bm95503n3k09ayyachajpq";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_4_14 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index e42a1646791d..42d98f1485e8 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.194";
+  version = "4.19.195";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "15l80psfgffa756vpjxmjkwjqif2gpx441hpzr473xwryp6bvbma";
+    sha256 = "02rdy5mdmwxli0cin5n7ab492y9fs01hhqxrjq6b4idwv5baa42m";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_4_19 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 4fc2985b586e..d06d5133b477 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,13 +1,13 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.272";
+  version = "4.4.273";
   extraMeta.branch = "4.4";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1ar468ymk96v2pq9x209z2z4wbypppb91jpw8g22aa30pr9aagyi";
+    sha256 = "1pd39cak0zhda3m9nvn9yxgd070wxvckaha5wl8pi7c8i6jfpclb";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_4_4 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index d0cb868f1722..d614464bf2ae 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,13 +1,13 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.272";
+  version = "4.9.273";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0n0hrszaijdpnbdvd8bvz15m7g268is0zw84w4vaf37418whrgzq";
+    sha256 = "0jjarv3xfkc21j1xhgch53w8wm6rq3xw1i03rjw9fv5i9k4x6qsw";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_4_9 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 50ef93c04b97..7606af512763 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.43";
+  version = "5.10.44";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "00yl1g6irpwy3sy0d43qvlk7x1gfk4v1dyv460afxy527d1ixf43";
+    sha256 = "0ry7hfcj07xc6l9mrm5f0ylz54ca3aklgf9x6plf2k45kjjyzgkp";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_10 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-5.12.nix b/pkgs/os-specific/linux/kernel/linux-5.12.nix
index 6ae39a84891b..9c70f150e2d9 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.12.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.12.10";
+  version = "5.12.11";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "03v3wzpbxb78gf4wsnc5wv6683g439cm2bzcjj4q657dagy9km68";
+    sha256 = "0ykzyvb4c6mqcy0fl3wvpn4laj1cllsg80dxnv0gssjz6q836z5f";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_12 ];
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 94d5f6bd3ff6..751295f435d2 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.125";
+  version = "5.4.126";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,7 +13,7 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0g73xfkmj4sahrk7gx72hm2i4m98gqghswqyf8yqh77b9857bvhp";
+    sha256 = "0xsjcdgiix8slykzi9c12pl5hk2fnz1bqrxxdcr79d9nmfc7kzf7";
   };
 
   kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_4 ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 069321939def..22e0ec90d066 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -24912,7 +24912,9 @@ in
 
   fluxcd = callPackage ../applications/networking/cluster/fluxcd { };
 
-  linkerd = callPackage ../applications/networking/cluster/linkerd { };
+  linkerd_stable = (callPackage ../applications/networking/cluster/linkerd { }).stable;
+  linkerd_edge = (callPackage ../applications/networking/cluster/linkerd { }).edge;
+  linkerd = linkerd_edge;
 
   kile-wl = callPackage ../applications/misc/kile-wl { };