diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
index f88be3918795..20c64f2a6710 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@@ -717,6 +717,16 @@
           option was removed and HTTPS is always used.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The attribute <literal>linuxPackages_latest_hardened</literal>
+          was dropped because the hardened patches lag behind the
+          upstream kernel which made version bumps harder. If you want
+          to use a hardened kernel, please pin it explicitly with a
+          versioned attribute such as
+          <literal>linuxPackages_5_10_hardened</literal>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-notable-changes">
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md
index b7cb31883f67..87747e0fc1ba 100644
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@@ -183,6 +183,11 @@ To be able to access the web UI this port needs to be opened in the firewall.
 
 - The `kubernetes` package was upgraded to 1.22.  The `kubernetes.apiserver.kubeletHttps` option was removed and HTTPS is always used.
 
+- The attribute `linuxPackages_latest_hardened` was dropped because the hardened patches
+  lag behind the upstream kernel which made version bumps harder. If you want to use
+  a hardened kernel, please pin it explicitly with a versioned attribute such as
+  `linuxPackages_5_10_hardened`.
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}
 
 - The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix
index 485efc0fb78c..a0b629086b5a 100644
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@@ -33,18 +33,7 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : {
 
   testScript =
     let
-      hardened-malloc-tests = pkgs.stdenv.mkDerivation {
-        name = "hardened-malloc-tests-${pkgs.graphene-hardened-malloc.version}";
-        src = pkgs.graphene-hardened-malloc.src;
-        buildPhase = ''
-          cd test/simple-memory-corruption
-          make -j4
-        '';
-
-        installPhase = ''
-          find . -type f -executable -exec install -Dt $out/bin '{}' +
-        '';
-      };
+      hardened-malloc-tests = pkgs.graphene-hardened-malloc.ld-preload-tests;
     in
     ''
       machine.wait_for_unit("multi-user.target")
@@ -107,20 +96,7 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : {
           machine.fail("systemctl kexec")
 
 
-      # Test hardened memory allocator
-      def runMallocTestProg(prog_name, error_text):
-          text = "fatal allocator error: " + error_text
-          if not text in machine.fail(
-              "${hardened-malloc-tests}/bin/"
-              + prog_name
-              + " 2>&1"
-          ):
-              raise Exception("Hardened malloc does not work for {}".format(error_text))
-
-
       with subtest("The hardened memory allocator works"):
-          runMallocTestProg("double_free_large", "invalid free")
-          runMallocTestProg("unaligned_free_small", "invalid unaligned free")
-          runMallocTestProg("write_after_free_small", "detected write after free")
+          machine.succeed("${hardened-malloc-tests}/bin/run-tests")
     '';
 })
diff --git a/nixos/tests/kernel-generic.nix b/nixos/tests/kernel-generic.nix
index 62d80db2915b..5993d0e6ab78 100644
--- a/nixos/tests/kernel-generic.nix
+++ b/nixos/tests/kernel-generic.nix
@@ -33,5 +33,10 @@ with pkgs; {
   linux_5_10 = makeKernelTest "5.10" linuxPackages_5_10;
   linux_5_13 = makeKernelTest "5.13" linuxPackages_5_13;
 
+  linux_hardened_4_14 = makeKernelTest "4.14" linuxPackages_4_14_hardened;
+  linux_hardened_4_19 = makeKernelTest "4.19" linuxPackages_4_19_hardened;
+  linux_hardened_5_4 = makeKernelTest "5.4" linuxPackages_5_4_hardened;
+  linux_hardened_5_10 = makeKernelTest "5.10" linuxPackages_5_10_hardened;
+
   linux_testing = makeKernelTest "testing" linuxPackages_testing;
 }
diff --git a/pkgs/applications/audio/hqplayer-desktop/default.nix b/pkgs/applications/audio/hqplayer-desktop/default.nix
index a0443aa9a6ae..38b7e0406038 100644
--- a/pkgs/applications/audio/hqplayer-desktop/default.nix
+++ b/pkgs/applications/audio/hqplayer-desktop/default.nix
@@ -18,11 +18,11 @@
 
 mkDerivation rec {
   pname = "hqplayer-desktop";
-  version = "4.12.2-36";
+  version = "4.13.1-38";
 
   src = fetchurl {
     url = "https://www.signalyst.eu/bins/hqplayer/fc34/hqplayer4desktop-${version}.fc34.x86_64.rpm";
-    sha256 = "sha256-ng0Tkx6CSnzTxuunStaBhUYjxUmzx31ZaOY2gBWnH6Q=";
+    sha256 = "sha256-DEZWEGk5SfhcNQddehCBVbfeTH8KfVCdaxQ+F3MrRe8=";
   };
 
   unpackPhase = ''
diff --git a/pkgs/applications/blockchains/whirlpool-gui/default.nix b/pkgs/applications/blockchains/whirlpool-gui/default.nix
index c26270beef61..62c7c3b3da47 100644
--- a/pkgs/applications/blockchains/whirlpool-gui/default.nix
+++ b/pkgs/applications/blockchains/whirlpool-gui/default.nix
@@ -19,7 +19,7 @@ in stdenv.mkDerivation rec {
   yarnCache = stdenv.mkDerivation {
     name = "${pname}-${version}-${system}-yarn-cache";
     inherit src;
-    phases = [ "unpackPhase" "buildPhase" ];
+    dontInstall = true;
     nativeBuildInputs = [ yarn ];
     buildPhase = ''
       export HOME=$NIX_BUILD_ROOT
diff --git a/pkgs/applications/misc/sfm/default.nix b/pkgs/applications/misc/sfm/default.nix
index 1d9dc3811aae..355c5915db27 100644
--- a/pkgs/applications/misc/sfm/default.nix
+++ b/pkgs/applications/misc/sfm/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sfm";
-  version = "0.2";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "afify";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DwXKrSqcebNI5N9REXyMV16W2kr72IH9+sKSVehc5zw=";
+    hash = "sha256-NmafUezwKK9bYPAWDNhegyjqkb4GY/i1WEtQ9puIaig=";
   };
 
   configFile = lib.optionalString (conf!=null) (writeText "config.def.h" conf);
diff --git a/pkgs/applications/misc/wtf/default.nix b/pkgs/applications/misc/wtf/default.nix
index 962059600a4c..867dee5bcd30 100644
--- a/pkgs/applications/misc/wtf/default.nix
+++ b/pkgs/applications/misc/wtf/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "wtf";
-  version = "0.36.0";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "wtfutil";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-JVHcunpS+2/0d7XaUZ95m9QpVHCG1Tq8LJ9KNURSRy8=";
+    sha256 = "sha256-ZKv207pkjgXtCZ6kXGn94i8QtOBHpSkPKo1Sy2Nw9qQ=";
    };
 
-  vendorSha256 = "sha256-4uRhbRPfCRYwFlfucXOYhLruj7hkV4G9Sxjh9yQkDEQ=";
+  vendorSha256 = "sha256-E5sfT7uGnruVUfhhjkZM2mgauXzbmcLWS6s1J85nssE=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/cluster/istioctl/default.nix b/pkgs/applications/networking/cluster/istioctl/default.nix
index f3da97057959..747523103af8 100644
--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.10.3";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    sha256 = "sha256-MHERRJ9t7EG4sd4gevUnZLA25UnRqZprCXFWkp5roms=";
+    sha256 = "sha256-pQ8Xhhjpcp9RAUUqEDNWRf9JI7xkDVh2PG2KB0lmScs=";
   };
-  vendorSha256 = "sha256-lzRIXZXrNQOwgl774B9r6OW/O8QwykSk3Mv5oGmvDuY=";
+  vendorSha256 = "sha256-PBMPTrTk5AzzELitSVQijHnx8YDCiZ7R+cpetUfe2KU=";
 
   doCheck = false;
 
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/db-reencryption-wrapper.py b/pkgs/applications/networking/instant-messengers/signal-desktop/db-reencryption-wrapper.py
deleted file mode 100755
index 8556ee1e4d73..000000000000
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/db-reencryption-wrapper.py
+++ /dev/null
@@ -1,92 +0,0 @@
-#!@PYTHON@
-
-import json
-import os
-import re
-import shlex
-import sqlite3
-import subprocess
-import sys
-
-
-DB_PATH = os.path.join(os.environ['HOME'], '.config/Signal/sql/db.sqlite')
-DB_COPY = os.path.join(os.environ['HOME'], '.config/Signal/sql/db.tmp')
-CONFIG_PATH = os.path.join(os.environ['HOME'], '.config/Signal/config.json')
-
-
-def zenity_askyesno(title, text):
-    args = [
-        '@ZENITY@',
-        '--question',
-        '--title',
-        shlex.quote(title),
-        '--text',
-        shlex.quote(text)
-    ]
-    return subprocess.run(args).returncode == 0
-
-
-def start_signal():
-    os.execvp('@SIGNAL-DESKTOP@', ['@SIGNAL-DESKTOP@'] + sys.argv[1:])
-
-
-def copy_pragma(name):
-    result = subprocess.run([
-        '@SQLCIPHER@',
-        DB_PATH,
-        f"PRAGMA {name};"
-    ], check=True, capture_output=True).stdout
-    result = re.search(r'[0-9]+', result.decode()).group(0)
-    subprocess.run([
-        '@SQLCIPHER@',
-        DB_COPY,
-        f"PRAGMA key = \"x'{key}'\"; PRAGMA {name} = {result};"
-    ], check=True, capture_output=True)
-
-
-try:
-    # Test if DB is encrypted:
-    con = sqlite3.connect(f'file:{DB_PATH}?mode=ro', uri=True)
-    cursor = con.cursor()
-    cursor.execute("SELECT name FROM sqlite_master WHERE type='table';")
-    con.close()
-except:
-    # DB is encrypted, everything ok:
-    start_signal()
-
-
-# DB is unencrypted!
-answer = zenity_askyesno(
-        "Error: Signal-Desktop database is not encrypted",
-        "Should we try to fix this automatically?"
-        + "You likely want to backup ~/.config/Signal/ first."
-)
-if not answer:
-    answer = zenity_askyesno(
-            "Launch Signal-Desktop",
-            "DB is unencrypted, should we still launch Signal-Desktop?"
-            + "Warning: This could result in data loss!"
-    )
-    if not answer:
-        print('Aborted')
-        sys.exit(0)
-    start_signal()
-
-# Re-encrypt the DB:
-with open(CONFIG_PATH) as json_file:
-    key = json.load(json_file)['key']
-result = subprocess.run([
-    '@SQLCIPHER@',
-    DB_PATH,
-    f" ATTACH DATABASE '{DB_COPY}' AS signal_db KEY \"x'{key}'\";"
-    + " SELECT sqlcipher_export('signal_db');"
-    + " DETACH DATABASE signal_db;"
-]).returncode
-if result != 0:
-    print('DB encryption failed')
-    sys.exit(1)
-# Need to copy user_version and schema_version manually:
-copy_pragma('user_version')
-copy_pragma('schema_version')
-os.rename(DB_COPY, DB_PATH)
-start_signal()
diff --git a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
index f5078181ed67..9b58931eed2c 100644
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@@ -10,9 +10,6 @@
 , hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE"
 # For a full list of available languages:
 # $ cat pkgs/development/libraries/hunspell/dictionaries.nix | grep "dictFileName =" | awk '{ print $3 }'
-, python3
-, gnome
-, sqlcipher
 }:
 
 let
@@ -115,7 +112,7 @@ in stdenv.mkDerivation rec {
 
     # Symlink to bin
     mkdir -p $out/bin
-    ln -s $out/lib/Signal/signal-desktop $out/bin/signal-desktop-unwrapped
+    ln -s $out/lib/Signal/signal-desktop $out/bin/signal-desktop
 
     runHook postInstall
   '';
@@ -140,16 +137,6 @@ in stdenv.mkDerivation rec {
     patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc-x64.node
   '';
 
-  postFixup = ''
-    # This hack is temporarily required to avoid data-loss for users:
-    cp ${./db-reencryption-wrapper.py} $out/bin/signal-desktop
-    substituteInPlace $out/bin/signal-desktop \
-      --replace '@PYTHON@' '${python3}/bin/python3' \
-      --replace '@ZENITY@' '${gnome.zenity}/bin/zenity' \
-      --replace '@SQLCIPHER@' '${sqlcipher}/bin/sqlcipher' \
-      --replace '@SIGNAL-DESKTOP@' "$out/bin/signal-desktop-unwrapped"
-  '';
-
   # Tests if the application launches and waits for "Link your phone to Signal Desktop":
   passthru.tests.application-launch = nixosTests.signal-desktop;
 
diff --git a/pkgs/applications/science/logic/tlaplus/tlaps.nix b/pkgs/applications/science/logic/tlaplus/tlaps.nix
index 89bdd979fea0..90a4aeb4f8ab 100644
--- a/pkgs/applications/science/logic/tlaplus/tlaps.nix
+++ b/pkgs/applications/science/logic/tlaplus/tlaps.nix
@@ -1,6 +1,12 @@
 { fetchurl
-, lib, stdenv
-, ocaml, isabelle, cvc3, perl, wget, which
+, lib
+, stdenv
+, ocaml
+, isabelle
+, cvc3
+, perl
+, wget
+, which
 }:
 
 stdenv.mkDerivation rec {
@@ -13,8 +19,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ocaml isabelle cvc3 perl wget which ];
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   installPhase = ''
     mkdir -pv "$out"
     export HOME="$out"
@@ -45,9 +49,9 @@ stdenv.mkDerivation rec {
       and scalable to large system specifications. It provides a
       consistent abstraction over the various “backend” verifiers.
     '';
-    homepage    = "https://tla.msr-inria.inria.fr/tlaps/content/Home.html";
-    license     = lib.licenses.bsd2;
-    platforms   = lib.platforms.unix;
+    homepage = "https://tla.msr-inria.inria.fr/tlaps/content/Home.html";
+    license = lib.licenses.bsd2;
+    platforms = lib.platforms.unix;
     maintainers = [ ];
   };
 
diff --git a/pkgs/applications/science/logic/tlaplus/toolbox.nix b/pkgs/applications/science/logic/tlaplus/toolbox.nix
index ef2d97ef6bfc..21c60d03ac1e 100644
--- a/pkgs/applications/science/logic/tlaplus/toolbox.nix
+++ b/pkgs/applications/science/logic/tlaplus/toolbox.nix
@@ -1,5 +1,13 @@
-{ lib, fetchzip, makeWrapper, makeDesktopItem, stdenv
-, gtk3, libXtst, glib, zlib, wrapGAppsHook
+{ lib
+, fetchzip
+, makeWrapper
+, makeDesktopItem
+, stdenv
+, gtk3
+, libXtst
+, glib
+, zlib
+, wrapGAppsHook
 }:
 
 let
@@ -17,7 +25,8 @@ let
   };
 
 
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
   pname = "tla-toolbox";
   version = "1.7.1";
   src = fetchzip {
@@ -31,8 +40,6 @@ in stdenv.mkDerivation rec {
 
   dontWrapGApps = true;
 
-  phases = [ "installPhase" ];
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/terminal-emulators/xterm/default.nix b/pkgs/applications/terminal-emulators/xterm/default.nix
index eafa8930371c..378fd7df01a6 100644
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@@ -4,23 +4,19 @@
 
 stdenv.mkDerivation rec {
   pname = "xterm";
-  version = "367";
+  version = "368";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
       "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
     ];
-    sha256 = "07y51l06n344pjyxdddq6sdvxw25nl10irl4avynkqjnqyqsiw97";
+    sha256 = "L/UWmTC2tJ7wuvteEzHJTxqYwxBEK7p3mK3YIcdq5xI=";
   };
 
   strictDeps = true;
 
-  nativeBuildInputs = [
-    makeWrapper
-    pkg-config
-    fontconfig
-  ];
+  nativeBuildInputs = [ makeWrapper pkg-config fontconfig ];
 
   buildInputs = [
     xorg.libXaw
diff --git a/pkgs/data/themes/marwaita-manjaro/default.nix b/pkgs/data/themes/marwaita-manjaro/default.nix
index d467526582c5..5cbf4c192085 100644
--- a/pkgs/data/themes/marwaita-manjaro/default.nix
+++ b/pkgs/data/themes/marwaita-manjaro/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , gdk-pixbuf
 , gtk-engine-murrine
@@ -8,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "marwaita-manjaro";
-  version = "2.0";
+  version = "10.3";
 
   src = fetchFromGitHub {
     owner = "darkomarko42";
     repo = pname;
     rev = version;
-    sha256 = "1si0gaa1njyf4194i6rbx4qjp31sw238svvb2x8r8cfhm8mkhm8d";
+    sha256 = "0qihxipk7ya6n3p9kg20bk6plnb85pg3ahwd02qq4bqfiw6mx3gw";
   };
 
   buildInputs = [
diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix
index 943a25dcf646..6c66561f29f2 100644
--- a/pkgs/development/libraries/freetype/default.nix
+++ b/pkgs/development/libraries/freetype/default.nix
@@ -9,13 +9,49 @@
   useEncumberedCode ? true
 }:
 
-let
-  inherit (lib) optional optionalString;
 
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "freetype";
   version = "2.11.0";
 
+  src = fetchurl {
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "sha256-i+45vTloxIBLcGFKCjrVlyma0OgkvIqtXOiq9IBnvec=";
+  };
+
+  propagatedBuildInputs = [ zlib bzip2 libpng ]; # needed when linking against freetype
+
+  # dependence on harfbuzz is looser than the reverse dependence
+  nativeBuildInputs = [ pkg-config which makeWrapper ]
+    # FreeType requires GNU Make, which is not part of stdenv on FreeBSD.
+    ++ lib.optional (!stdenv.isLinux) gnumake;
+
+  patches = [
+    ./enable-table-validation.patch
+  ] ++ lib.optional useEncumberedCode ./enable-subpixel-rendering.patch;
+
+  outputs = [ "out" "dev" ];
+
+  configureFlags = [ "--bindir=$(dev)/bin" "--enable-freetype-config" ];
+
+  # native compiler to generate building tool
+  CC_BUILD = "${buildPackages.stdenv.cc}/bin/cc";
+
+  # The asm for armel is written with the 'asm' keyword.
+  CFLAGS = lib.optionalString stdenv.isAarch32 "-std=gnu99";
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  postInstall = glib.flattenInclude + ''
+    substituteInPlace $dev/bin/freetype-config \
+      --replace ${buildPackages.pkg-config} ${pkgsHostHost.pkg-config}
+
+    wrapProgram "$dev/bin/freetype-config" \
+      --set PKG_CONFIG_PATH "$PKG_CONFIG_PATH:$dev/lib/pkgconfig"
+  '';
+
   meta = with lib; {
     description = "A font rendering engine";
     longDescription = ''
@@ -30,44 +66,4 @@ in stdenv.mkDerivation rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ ttuegel ];
   };
-
-  src = fetchurl {
-    url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-i+45vTloxIBLcGFKCjrVlyma0OgkvIqtXOiq9IBnvec=";
-  };
-
-  propagatedBuildInputs = [ zlib bzip2 libpng ]; # needed when linking against freetype
-
-  # dependence on harfbuzz is looser than the reverse dependence
-  nativeBuildInputs = [ pkg-config which makeWrapper ]
-    # FreeType requires GNU Make, which is not part of stdenv on FreeBSD.
-    ++ optional (!stdenv.isLinux) gnumake;
-
-  patches =
-    [ ./enable-table-validation.patch
-    ] ++
-    optional useEncumberedCode ./enable-subpixel-rendering.patch;
-
-  outputs = [ "out" "dev" ];
-
-  configureFlags = [ "--bindir=$(dev)/bin" "--enable-freetype-config" ];
-
-  # native compiler to generate building tool
-  CC_BUILD = "${buildPackages.stdenv.cc}/bin/cc";
-
-  # The asm for armel is written with the 'asm' keyword.
-  CFLAGS = optionalString stdenv.isAarch32 "-std=gnu99";
-
-  enableParallelBuilding = true;
-
-  doCheck = true;
-
-  postInstall = glib.flattenInclude + ''
-    substituteInPlace $dev/bin/freetype-config \
-      --replace ${buildPackages.pkg-config} ${pkgsHostHost.pkg-config}
-
-    wrapProgram "$dev/bin/freetype-config" \
-      --set PKG_CONFIG_PATH "$PKG_CONFIG_PATH:$dev/lib/pkgconfig"
-  '';
-
 }
diff --git a/pkgs/development/libraries/graphene-hardened-malloc/default.nix b/pkgs/development/libraries/graphene-hardened-malloc/default.nix
index 726666ec06f3..35a4d9362680 100644
--- a/pkgs/development/libraries/graphene-hardened-malloc/default.nix
+++ b/pkgs/development/libraries/graphene-hardened-malloc/default.nix
@@ -1,15 +1,23 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, python3, runCommand, makeWrapper, stress-ng }:
 
-stdenv.mkDerivation rec {
+lib.fix (self: stdenv.mkDerivation rec {
   pname = "graphene-hardened-malloc";
-  version = "2";
+  version = "8";
 
   src = fetchurl {
     url = "https://github.com/GrapheneOS/hardened_malloc/archive/${version}.tar.gz";
-    sha256 = "0zsl4vl65ic6lw5rzcjzvcxg8makg683abnwvy60zfap8hvijvjb";
+    sha256 = "0lipyd2pb1bmghkyv9zmg25jwcglj7m281f01zlh3ghz3xlfh0ym";
   };
 
+  doCheck = true;
+  checkInputs = [ python3 ];
+  # these tests cover use as a build-time-linked library
+  checkPhase = ''
+    make test
+  '';
+
   installPhase = ''
+    install -Dm444 -t $out/include include/*
     install -Dm444 -t $out/lib libhardened_malloc.so
 
     mkdir -p $out/bin
@@ -19,28 +27,51 @@ stdenv.mkDerivation rec {
 
   separateDebugInfo = true;
 
-  doInstallCheck = true;
-  installCheckPhase = ''
-    pushd test
-    make
-    $out/bin/preload-hardened-malloc ./offset
+  passthru = {
+    ld-preload-tests = stdenv.mkDerivation {
+      name = "${self.name}-ld-preload-tests";
+      src = self.src;
 
-    pushd simple-memory-corruption
-    make
+      nativeBuildInputs = [ makeWrapper ];
 
-    # these tests don't actually appear to generate overflows currently
-    rm read_after_free_small string_overflow eight_byte_overflow_large
+      # reuse the projects tests to cover use with LD_PRELOAD. we have
+      # to convince the test programs to build as though they're naive
+      # standalone executables. this includes disabling tests for
+      # malloc_object_size, which doesn't make sense to use via LD_PRELOAD.
+      buildPhase = ''
+        pushd test/simple-memory-corruption
+        make LDLIBS= LDFLAGS=-Wl,--unresolved-symbols=ignore-all CXXFLAGS=-lstdc++
+        substituteInPlace test_smc.py \
+          --replace 'test_malloc_object_size' 'dont_test_malloc_object_size' \
+          --replace 'test_invalid_malloc_object_size' 'dont_test_invalid_malloc_object_size'
+        popd # test/simple-memory-corruption
+      '';
 
-    for t in `find . -regex ".*/[a-z_]+"` ; do
-      echo "Running $t..."
-      # the program being aborted (as it should be) would result in an exit code > 128
-      (($out/bin/preload-hardened-malloc $t) && false) \
-        || (test $? -gt 128 || (echo "$t was not aborted" && false))
-    done
-    popd
+      installPhase = ''
+        mkdir -p $out/test
+        cp -r test/simple-memory-corruption $out/test/simple-memory-corruption
 
-    popd
-  '';
+        mkdir -p $out/bin
+        makeWrapper ${python3.interpreter} $out/bin/run-tests \
+          --add-flags "-I -m unittest discover --start-directory $out/test/simple-memory-corruption"
+      '';
+    };
+    tests = {
+      ld-preload = runCommand "ld-preload-test-run" {} ''
+        ${self}/bin/preload-hardened-malloc ${self.ld-preload-tests}/bin/run-tests
+        touch $out
+      '';
+      # to compensate for the lack of tests of correct normal malloc operation
+      stress = runCommand "stress-test-run" {} ''
+        ${self}/bin/preload-hardened-malloc ${stress-ng}/bin/stress-ng \
+          --no-rand-seed \
+          --malloc 8 \
+          --malloc-ops 1000000 \
+          --verify
+        touch $out
+      '';
+    };
+  };
 
   meta = with lib; {
     homepage = "https://github.com/GrapheneOS/hardened_malloc";
@@ -54,4 +85,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ ris ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];
   };
-}
+})
diff --git a/pkgs/development/libraries/gusb/default.nix b/pkgs/development/libraries/gusb/default.nix
index c3ae6faecfd7..449a7a17623b 100644
--- a/pkgs/development/libraries/gusb/default.nix
+++ b/pkgs/development/libraries/gusb/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, gettext, gobject-introspection
+{ lib, stdenv, fetchurl, substituteAll, meson, ninja, pkg-config, gettext, gobject-introspection
 , gtk-doc, docbook_xsl, docbook_xml_dtd_412, docbook_xml_dtd_44, python3
 , glib, systemd, libusb1, vala, hwdata
 }:
@@ -10,15 +10,22 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gusb";
-  version = "0.3.5";
+  version = "0.3.7";
 
   outputs = [ "bin" "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/libgusb-${version}.tar.xz";
-    sha256 = "1pv5ivbwxb9anq2j34i68r8fgs8nwsi4hmss7h9v1i3wk7300ajv";
+    sha256 = "sha256-2l8l1oc2ImibM1FIbL4CjvwlRAP2Rt2BIl3+hULYxn0=";
   };
 
+  patches = [
+    (substituteAll {
+      src = ./fix-python-path.patch;
+      python = "${pythonEnv}/bin/python3";
+    })
+  ];
+
   nativeBuildInputs = [
     meson ninja pkg-config gettext pythonEnv
     gtk-doc docbook_xsl docbook_xml_dtd_412 docbook_xml_dtd_44
diff --git a/pkgs/development/libraries/gusb/fix-python-path.patch b/pkgs/development/libraries/gusb/fix-python-path.patch
new file mode 100644
index 000000000000..5f04387a537e
--- /dev/null
+++ b/pkgs/development/libraries/gusb/fix-python-path.patch
@@ -0,0 +1,14 @@
+diff --git a/gusb/meson.build b/gusb/meson.build
+index 8236a2b..282aa48 100644
+--- a/gusb/meson.build
++++ b/gusb/meson.build
+@@ -147,7 +147,7 @@ libgusb_gir = libgusb_girtarget[0]
+ libgusb_typelib = libgusb_girtarget[1]
+ 
+ pymod = import('python')
+-py_installation = pymod.find_installation()
++py_installation = pymod.find_installation('@python@')
+ 
+ # Verify the map file is correct -- note we can't actually use the generated
+ # file for two reasons:
+
diff --git a/pkgs/development/lisp-modules/shell.nix b/pkgs/development/lisp-modules/shell.nix
index bd6eea65f6f3..9fc0c0b2aa0a 100644
--- a/pkgs/development/lisp-modules/shell.nix
+++ b/pkgs/development/lisp-modules/shell.nix
@@ -10,7 +10,28 @@ self = rec {
     freetds
     lispPackages.quicklisp-to-nix lispPackages.quicklisp-to-nix-system-info
   ];
-  CPATH = "${libfixposix}/include";
-  LD_LIBRARY_PATH = "${openssl.out}/lib:${fuse}/lib:${libuv}/lib:${libev}/lib:${libmysqlclient}/lib:${libmysqlclient}/lib/mysql:${postgresql.lib}/lib:${sqlite.out}/lib:${libfixposix}/lib:${freetds}/lib:${openssl_lib_marked}/lib:${glib.out}/lib:${gdk-pixbuf}/lib:${cairo}/lib:${pango.out}/lib:${gtk3}/lib:${webkitgtk}/lib:${gobject-introspection}/lib";
+  CPATH = lib.makeSearchPath "include"
+    [ libfixposix
+    ];
+  LD_LIBRARY_PATH = lib.makeLibraryPath
+    [ cairo
+      freetds
+      fuse
+      gdk-pixbuf
+      glib
+      gobject-introspection
+      gtk3
+      libev
+      libfixposix
+      libmysqlclient
+      libuv
+      openssl
+      openssl_lib_marked
+      pango
+      postgresql
+      sqlite
+      webkitgtk
+    ]
+    + ":${libmysqlclient}/lib/mysql";
 };
 in stdenv.mkDerivation self
diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
index 04a3e11be3ef..1aa9dc2b1027 100644
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -5,11 +5,11 @@
 
 buildPythonPackage rec {
   pname = "apprise";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-yKzpyJHUIkVYVwrL6oCPMd+QSVML2czWmQHCemXWAMQ=";
+    sha256 = "sha256-Q7iZD9GG8vPxITpn87l3yGtU+L8jwvs2Qi329LHlKrI=";
   };
 
   nativeBuildInputs = [ Babel installShellFiles ];
diff --git a/pkgs/development/python-modules/pybids/default.nix b/pkgs/development/python-modules/pybids/default.nix
index 3ed34b4e73d7..97187abd7591 100644
--- a/pkgs/development/python-modules/pybids/default.nix
+++ b/pkgs/development/python-modules/pybids/default.nix
@@ -42,5 +42,8 @@ buildPythonPackage rec {
     homepage = "https://github.com/bids-standard/pybids";
     license = licenses.mit;
     maintainers = with maintainers; [ jonringer ];
+    # Doesn't support sqlalchemy >=1.4
+    # See https://github.com/bids-standard/pybids/issues/680
+    broken = true;
   };
 }
diff --git a/pkgs/development/tools/rnix-lsp/default.nix b/pkgs/development/tools/rnix-lsp/default.nix
index 27bad6b51d69..09c8531c938b 100644
--- a/pkgs/development/tools/rnix-lsp/default.nix
+++ b/pkgs/development/tools/rnix-lsp/default.nix
@@ -1,4 +1,4 @@
-{ callPackage, lib, fetchFromGitHub, rustPlatform }:
+{ lib, fetchFromGitHub, rustPlatform }:
 
 rustPlatform.buildRustPackage rec {
   pname = "rnix-lsp";
@@ -8,7 +8,6 @@ rustPlatform.buildRustPackage rec {
     owner = "nix-community";
     repo = "rnix-lsp";
     rev = "v${version}";
-
     sha256 = "0fy620c34kxl27sd62x9mj0555bcdmnmbsxavmyiwb497z1m9wnn";
   };
 
diff --git a/pkgs/games/factorio/versions.json b/pkgs/games/factorio/versions.json
index d8174417cb35..acbc0c4cbc22 100644
--- a/pkgs/games/factorio/versions.json
+++ b/pkgs/games/factorio/versions.json
@@ -10,30 +10,30 @@
         "version": "1.1.37"
       },
       "stable": {
-        "name": "factorio_alpha_x64-1.1.36.tar.xz",
+        "name": "factorio_alpha_x64-1.1.37.tar.xz",
         "needsAuth": true,
-        "sha256": "1x9a2lv6zbqawqlxg8bcbx04hjy0pq40macfa4sqi8w6h14wgww8",
+        "sha256": "0aj8w38lx8bx3d894qxr416x515ijadrlcynvvqjaj1zx3acldzh",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.36/alpha/linux64",
-        "version": "1.1.36"
+        "url": "https://factorio.com/get-download/1.1.37/alpha/linux64",
+        "version": "1.1.37"
       }
     },
     "demo": {
       "experimental": {
-        "name": "factorio_demo_x64-1.1.35.tar.xz",
+        "name": "factorio_demo_x64-1.1.37.tar.xz",
         "needsAuth": false,
-        "sha256": "0yqb4gf2avpxr4vwafws9pv74xyd9g84zggfikfc801ldc7sp29f",
+        "sha256": "06qwx9wd3990d3256y9y5qsxa0936076jgwhinmrlvjp9lxwl4ly",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.35/demo/linux64",
-        "version": "1.1.35"
+        "url": "https://factorio.com/get-download/1.1.37/demo/linux64",
+        "version": "1.1.37"
       },
       "stable": {
-        "name": "factorio_demo_x64-1.1.36.tar.xz",
+        "name": "factorio_demo_x64-1.1.37.tar.xz",
         "needsAuth": false,
-        "sha256": "15fl4pza7n107rrmmdm26kkc12fnrmpn6rjb4ampgzqzn1fq854s",
+        "sha256": "06qwx9wd3990d3256y9y5qsxa0936076jgwhinmrlvjp9lxwl4ly",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.36/demo/linux64",
-        "version": "1.1.36"
+        "url": "https://factorio.com/get-download/1.1.37/demo/linux64",
+        "version": "1.1.37"
       }
     },
     "headless": {
@@ -46,12 +46,12 @@
         "version": "1.1.37"
       },
       "stable": {
-        "name": "factorio_headless_x64-1.1.36.tar.xz",
+        "name": "factorio_headless_x64-1.1.37.tar.xz",
         "needsAuth": false,
-        "sha256": "1s8g030xp5nrlmnn21frrd8n4nd7jjmb5hbpj1vhxjrk6vpijh24",
+        "sha256": "0hawwjdaxgbrkb80vn9jk6dn0286mq35zkgg5vvv5zhi339pqwwg",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.36/headless/linux64",
-        "version": "1.1.36"
+        "url": "https://factorio.com/get-download/1.1.37/headless/linux64",
+        "version": "1.1.37"
       }
     }
   }
diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 9b80c6ce608a..24b60ea1d9e3 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -233,12 +233,12 @@ final: prev:
 
   auto-session = buildVimPluginFrom2Nix {
     pname = "auto-session";
-    version = "2021-07-15";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "rmagatti";
       repo = "auto-session";
-      rev = "f5e5dda7587db72b074edbc3b573d52df639f9a5";
-      sha256 = "1ddr28v44llmfsdf2l3ybgwijhv49dddghdk396nk0sw883a3hs8";
+      rev = "acd1a7031e71ed053348c2cd4ef3408f4fdfbb19";
+      sha256 = "0vxk17p37a2fs9gm68wdlfqfyw8jzw3hp1yjg0n3b4yppl9j50r5";
     };
     meta.homepage = "https://github.com/rmagatti/auto-session/";
   };
@@ -281,12 +281,12 @@ final: prev:
 
   barbar-nvim = buildVimPluginFrom2Nix {
     pname = "barbar-nvim";
-    version = "2021-08-14";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "romgrk";
       repo = "barbar.nvim";
-      rev = "0c4c37eb3188230b11493adac68aac491c5e6a07";
-      sha256 = "0pc5rrzhcrp7p5wwid4ggdakp5y05ki0hkm04bflq0y4ib4haa4c";
+      rev = "7a19aac3d401c997a6fb7067a7756a4a77184c2e";
+      sha256 = "1jbbnd7s2kql44zv7xkv9hmyj0482yjnm57l8nl0kdf8b61zzi3s";
     };
     meta.homepage = "https://github.com/romgrk/barbar.nvim/";
   };
@@ -437,12 +437,12 @@ final: prev:
 
   chadtree = buildVimPluginFrom2Nix {
     pname = "chadtree";
-    version = "2021-08-15";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "64c2f6151d9794b83af47a26717973625587d8ef";
-      sha256 = "1hysjkxd9g7lrwvsqw0c4ynnmshxijcbql4zl9mjww89fsz96i09";
+      rev = "80f2d03b1d7d8a5032689a17c9a234d464a67405";
+      sha256 = "0k5v490p22j3ghfb6c436z0i3fq18sj0y4x01axrl4iy1jpwn3v2";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -519,6 +519,90 @@ final: prev:
     meta.homepage = "https://github.com/bbchung/clighter8/";
   };
 
+  cmp-buffer = buildVimPluginFrom2Nix {
+    pname = "cmp-buffer";
+    version = "2021-08-11";
+    src = fetchFromGitHub {
+      owner = "hrsh7th";
+      repo = "cmp-buffer";
+      rev = "5742a1b18ebb4ffc21cd07a312bf8bacba4c81ae";
+      sha256 = "0nh53gqzbm500rvwc59hbl1sg12qzpk8za3z6rvsg04s6rqv479f";
+    };
+    meta.homepage = "https://github.com/hrsh7th/cmp-buffer/";
+  };
+
+  cmp-calc = buildVimPluginFrom2Nix {
+    pname = "cmp-calc";
+    version = "2021-08-08";
+    src = fetchFromGitHub {
+      owner = "hrsh7th";
+      repo = "cmp-calc";
+      rev = "bac4f988d14665a6a681df3646ff1baa2affc2da";
+      sha256 = "09g5pglbfzgnzl0lbn1fa27fh88a5pv2s2agmbw0gh4idnrvi66x";
+    };
+    meta.homepage = "https://github.com/hrsh7th/cmp-calc/";
+  };
+
+  cmp-emoji = buildVimPluginFrom2Nix {
+    pname = "cmp-emoji";
+    version = "2021-08-09";
+    src = fetchFromGitHub {
+      owner = "hrsh7th";
+      repo = "cmp-emoji";
+      rev = "a80d20b3461b802b3ff6f4cd60f7b99399fd7757";
+      sha256 = "0q70zbd4fw6x62zar7ph1dp6zwri6dqnyprl58p6w3k5n4xgpdrf";
+    };
+    meta.homepage = "https://github.com/hrsh7th/cmp-emoji/";
+  };
+
+  cmp-nvim-lsp = buildVimPluginFrom2Nix {
+    pname = "cmp-nvim-lsp";
+    version = "2021-08-16";
+    src = fetchFromGitHub {
+      owner = "hrsh7th";
+      repo = "cmp-nvim-lsp";
+      rev = "09e4ab0fb66ad07d64b311d1bd7916905bf3364b";
+      sha256 = "0573ywym8favv12g78qln4zx15j1ic26y8j2rbdlh8n22zll0v1x";
+    };
+    meta.homepage = "https://github.com/hrsh7th/cmp-nvim-lsp/";
+  };
+
+  cmp-path = buildVimPluginFrom2Nix {
+    pname = "cmp-path";
+    version = "2021-08-09";
+    src = fetchFromGitHub {
+      owner = "hrsh7th";
+      repo = "cmp-path";
+      rev = "175a3854242f7dd43d706e2e0acc4f08ab1ed9ee";
+      sha256 = "1pimzhp5hh9gg7f37x4mklxxg44a7fnzli7mv46p73b3w97vkbl4";
+    };
+    meta.homepage = "https://github.com/hrsh7th/cmp-path/";
+  };
+
+  cmp-vsnip = buildVimPluginFrom2Nix {
+    pname = "cmp-vsnip";
+    version = "2021-08-13";
+    src = fetchFromGitHub {
+      owner = "hrsh7th";
+      repo = "cmp-vsnip";
+      rev = "1f7c99719adbb2258c697dc43c31729ab73a8d99";
+      sha256 = "1a252mzi5nzcml2g52g5nwlih40dh19yshns6dlk5gmfwa0mf3z6";
+    };
+    meta.homepage = "https://github.com/hrsh7th/cmp-vsnip/";
+  };
+
+  cmp_luasnip = buildVimPluginFrom2Nix {
+    pname = "cmp_luasnip";
+    version = "2021-08-16";
+    src = fetchFromGitHub {
+      owner = "saadparwaiz1";
+      repo = "cmp_luasnip";
+      rev = "1852a9e9e3a0e0ba0363e3be6c87f46982fba549";
+      sha256 = "1ji3ys0k0sw23yh4yk3pgb2ab895jfsjnsjrpy0idvmxclk20l0m";
+    };
+    meta.homepage = "https://github.com/saadparwaiz1/cmp_luasnip/";
+  };
+
   coc-clap = buildVimPluginFrom2Nix {
     pname = "coc-clap";
     version = "2021-05-10";
@@ -593,12 +677,12 @@ final: prev:
 
   coc-nvim = buildVimPluginFrom2Nix {
     pname = "coc-nvim";
-    version = "2021-08-15";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "9b224047e4596636cbc1e112d38d7b6bb48a2c15";
-      sha256 = "105dsskbxir7w5665dfs5m2dwn4l85jwvmwflkqfvgf75538hgsw";
+      rev = "1296df441756a5249319369640f208089a10efe4";
+      sha256 = "1p6gikl6fw6fvbb7f76mb88ckcw6vp4llzz601k0f6rrna4xhjab";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
   };
@@ -1919,12 +2003,12 @@ final: prev:
 
   gitsigns-nvim = buildVimPluginFrom2Nix {
     pname = "gitsigns-nvim";
-    version = "2021-08-09";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "lewis6991";
       repo = "gitsigns.nvim";
-      rev = "083dc2f485571546144e287c38a96368ea2e79a1";
-      sha256 = "0vrb900p2rc323axb93hc7jwcxg8455zwqsvxm9vkd2mcsdpn33w";
+      rev = "7875d8c4d94f98f7a1a65b898499fa288e7969b3";
+      sha256 = "13hzghpzglw6cr4hwsp7qvp6a7dkh2fk2sg4nzzazgmfych485cm";
     };
     meta.homepage = "https://github.com/lewis6991/gitsigns.nvim/";
   };
@@ -2532,12 +2616,12 @@ final: prev:
 
   LeaderF = buildVimPluginFrom2Nix {
     pname = "LeaderF";
-    version = "2021-08-13";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "Yggdroot";
       repo = "LeaderF";
-      rev = "e7d0b761fd9d4f2c326a4e421592b4c5ea51ae44";
-      sha256 = "1zhq8wjpy4yx1mcyahscflfjm52hb7pfpxv51vmwlh2rp044b6j1";
+      rev = "303f4a17f06b41c99210afaa6b21a7a16da533db";
+      sha256 = "0rp1nc4hghn0i7ipbd6n0ja3zb5zv44pm9snfwlai2p5c8awi39z";
     };
     meta.homepage = "https://github.com/Yggdroot/LeaderF/";
   };
@@ -2676,12 +2760,12 @@ final: prev:
 
   lightspeed-nvim = buildVimPluginFrom2Nix {
     pname = "lightspeed-nvim";
-    version = "2021-08-15";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "ggandor";
       repo = "lightspeed.nvim";
-      rev = "d6edfefa60b067246e8007cbaa213f3a4f59d8ef";
-      sha256 = "0bw20bzh9z3r8fd4dd9ffrllk931g0nj26n91rrqq1pmx983i4ym";
+      rev = "d1084c0ac413d6ad1ed3ec290604e7e2fbe0aae1";
+      sha256 = "1qjs3wj4svjvbangivpvg7j4swm50d7s0ll1qsg61s59jchp1gjq";
     };
     meta.homepage = "https://github.com/ggandor/lightspeed.nvim/";
   };
@@ -3252,12 +3336,12 @@ final: prev:
 
   neogit = buildVimPluginFrom2Nix {
     pname = "neogit";
-    version = "2021-08-03";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "TimUntersberger";
       repo = "neogit";
-      rev = "3226b98318518bef47f55218041adfdf99c36e9a";
-      sha256 = "09r6k5afd940cf44gdb62ffnh0ns32qr20vxxqgsw3rdi5558wfc";
+      rev = "16de1b46e993e0b1e749c2345584c79ba14d11c1";
+      sha256 = "0171v70ywnzpgzaadrw344511l3z7q60wvm6y5892z9m8mnwlw58";
     };
     meta.homepage = "https://github.com/TimUntersberger/neogit/";
   };
@@ -3528,12 +3612,12 @@ final: prev:
 
   nord-nvim = buildVimPluginFrom2Nix {
     pname = "nord-nvim";
-    version = "2021-08-14";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "shaunsingh";
       repo = "nord.nvim";
-      rev = "296167d2625e478d90f711bc8c0f2be96533b311";
-      sha256 = "0m4qza9rzl2n2zcnb1wkj6idm3v6hdm427cd7yjy2rdbxk2cszb6";
+      rev = "4d1bef41e01fbdcb31a47d722e107b29a1f9f428";
+      sha256 = "1v9d7dsmchmkzqqf92rzhscv4n0n75jm0hqkq49m11d62dc5aic9";
     };
     meta.homepage = "https://github.com/shaunsingh/nord.nvim/";
   };
@@ -3564,12 +3648,12 @@ final: prev:
 
   null-ls-nvim = buildVimPluginFrom2Nix {
     pname = "null-ls-nvim";
-    version = "2021-08-15";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "jose-elias-alvarez";
       repo = "null-ls.nvim";
-      rev = "f5dc246c2edfd237ebcb0288250a18771019e810";
-      sha256 = "1mm89m7lfcrw2hxqbpnvxv610wl5lvinslb8m26j2xrpv0k2qnzb";
+      rev = "4db2c4e2b59d16143bd8903c9bc73776b535be50";
+      sha256 = "18dg3gdfwxhhz8snvw697r4nmc9aag3ylrzm7g84k67hpfir82r6";
     };
     meta.homepage = "https://github.com/jose-elias-alvarez/null-ls.nvim/";
   };
@@ -3682,6 +3766,18 @@ final: prev:
     meta.homepage = "https://github.com/roxma/nvim-cm-racer/";
   };
 
+  nvim-cmp = buildVimPluginFrom2Nix {
+    pname = "nvim-cmp";
+    version = "2021-08-16";
+    src = fetchFromGitHub {
+      owner = "hrsh7th";
+      repo = "nvim-cmp";
+      rev = "29ad715924eb8fafa8cd042b1a9eb66b03db0d0d";
+      sha256 = "0c8wy66743dwf04p3l3fphndr58g9crlg96x90xkx2kr2s64a9dd";
+    };
+    meta.homepage = "https://github.com/hrsh7th/nvim-cmp/";
+  };
+
   nvim-colorizer-lua = buildVimPluginFrom2Nix {
     pname = "nvim-colorizer-lua";
     version = "2020-06-11";
@@ -3732,12 +3828,12 @@ final: prev:
 
   nvim-dap-ui = buildVimPluginFrom2Nix {
     pname = "nvim-dap-ui";
-    version = "2021-08-03";
+    version = "2021-08-15";
     src = fetchFromGitHub {
       owner = "rcarriga";
       repo = "nvim-dap-ui";
-      rev = "90a4025a4da7ac7a261026c50439bbd1bdfc8563";
-      sha256 = "0apl84djyxy8ldcxv2xs0irgy7rjxcisqnl3wxcfi3fhvfsb0fz3";
+      rev = "c9fc568ca157429cd76986ca2bfaa60488a7d2fb";
+      sha256 = "09jk0v2ki0hsy1m2hg3dwi66yaqn670vnjbbrbdxrq55n260gds3";
     };
     meta.homepage = "https://github.com/rcarriga/nvim-dap-ui/";
   };
@@ -3840,12 +3936,12 @@ final: prev:
 
   nvim-lspconfig = buildVimPluginFrom2Nix {
     pname = "nvim-lspconfig";
-    version = "2021-08-15";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "nvim-lspconfig";
-      rev = "b4661ec91e4675a339289d5662a93e646aeabe6f";
-      sha256 = "1ax327j9p2bjrwni24s9ymp1zjhq5b1h5znxb4myjmh29q5x0pgm";
+      rev = "acb420880b83563c0ce83a3cea278cadfc7023e4";
+      sha256 = "16bfn1qkbnicpkpisf5i4snra8glfg4rawvi52fpjqghxj9g1xz2";
     };
     meta.homepage = "https://github.com/neovim/nvim-lspconfig/";
   };
@@ -4537,12 +4633,12 @@ final: prev:
 
   refactoring-nvim = buildVimPluginFrom2Nix {
     pname = "refactoring-nvim";
-    version = "2021-08-15";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "theprimeagen";
       repo = "refactoring.nvim";
-      rev = "48eeaf96bd78087dbf1df220fa6bf3e81906a481";
-      sha256 = "1h6vgw25fi7ar9gk8b1a5v61lc26myf7rr82hg2vfdrif4w9qgzq";
+      rev = "aabd4776d3fd756b76f9e264496e1ea81cab77c4";
+      sha256 = "168hpn3nxjsy3a5h3lvzk6gbhcfnh7k7p0xhpjxi67x1f99dnx0s";
     };
     meta.homepage = "https://github.com/theprimeagen/refactoring.nvim/";
   };
@@ -4995,12 +5091,12 @@ final: prev:
 
   sql-nvim = buildVimPluginFrom2Nix {
     pname = "sql-nvim";
-    version = "2021-08-12";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "tami5";
       repo = "sql.nvim";
-      rev = "957bae51700c7ec0da03ffd03f8f25b966c49ffe";
-      sha256 = "1v120mr4s012gx95fr99kplv0ggypkjy5br3mzx86k4nmz1djwiv";
+      rev = "cc7b7cc76427eb321955278587b84e84c0af246e";
+      sha256 = "0i2j3s6n9zmpn8jc5waxl3biqca23f5cbiapgr9gwgqj22f1xzd2";
     };
     meta.homepage = "https://github.com/tami5/sql.nvim/";
   };
@@ -6210,12 +6306,12 @@ final: prev:
 
   vim-clap = buildVimPluginFrom2Nix {
     pname = "vim-clap";
-    version = "2021-08-15";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "liuchengxu";
       repo = "vim-clap";
-      rev = "7307a7bdae675d131d1e4ada2ea3dd84d2ffc303";
-      sha256 = "0nqv1mqzizwx27jr8jmqqbb2a0dpyvlgpgbmv2fqk6gfqi44hkj8";
+      rev = "4a7e9bad08ccfebcf294ea0091d74ee64d98d236";
+      sha256 = "0b5ldixvf2f3bk7ivzb3s7zb8s4ir7gayli1i6bdq753flkjq0bx";
     };
     meta.homepage = "https://github.com/liuchengxu/vim-clap/";
   };
@@ -8277,12 +8373,12 @@ final: prev:
 
   vim-oscyank = buildVimPluginFrom2Nix {
     pname = "vim-oscyank";
-    version = "2021-08-09";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "ojroques";
       repo = "vim-oscyank";
-      rev = "1189ef91c95f522159f9fd267a6bd1ea4b070195";
-      sha256 = "12smb5p5lw3gakz6qbbdi11wcbyh8hap70csi8j0crr31fgjmsyf";
+      rev = "bc49a0c2b5ded3f13445e47aa3cf8d3a0f972926";
+      sha256 = "0l5gaf94p91xck6wn3a55dybd1d820dpq31v3sy3i2bxwfw0g8zd";
     };
     meta.homepage = "https://github.com/ojroques/vim-oscyank/";
   };
@@ -9538,12 +9634,12 @@ final: prev:
 
   vim-unimpaired = buildVimPluginFrom2Nix {
     pname = "vim-unimpaired";
-    version = "2021-08-01";
+    version = "2021-08-15";
     src = fetchFromGitHub {
       owner = "tpope";
       repo = "vim-unimpaired";
-      rev = "ee21252c035004efd6fea40335cd311e71cf7a33";
-      sha256 = "1grl78f5nhdryg1w0xh9j6fs1xd3j6dcv92vcvl9rp87ixgnmbag";
+      rev = "aee3455e19686ce84225752de678a9725866248b";
+      sha256 = "0j6xz4m8p351dmvhssi0f699609wpm5nz5q9xysy15vpwxds3nl9";
     };
     meta.homepage = "https://github.com/tpope/vim-unimpaired/";
   };
@@ -9947,12 +10043,12 @@ final: prev:
 
   vimtex = buildVimPluginFrom2Nix {
     pname = "vimtex";
-    version = "2021-08-15";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "lervag";
       repo = "vimtex";
-      rev = "6302a3db7e1fbf691feac65f3f1b2f031653c81f";
-      sha256 = "03xag1nqv6l26hw53pb707g6amqaq7kpa72wa7nmps41nxbgswdn";
+      rev = "cb71390373e793875efd3609e0ad800d816ff4af";
+      sha256 = "0l9yklk0pd7kgy39b09rirwpqbryy148ch9vffq3isyhdk6b3v10";
     };
     meta.homepage = "https://github.com/lervag/vimtex/";
   };
@@ -10067,12 +10163,12 @@ final: prev:
 
   wilder-nvim = buildVimPluginFrom2Nix {
     pname = "wilder-nvim";
-    version = "2021-08-15";
+    version = "2021-08-16";
     src = fetchFromGitHub {
       owner = "gelguy";
       repo = "wilder.nvim";
-      rev = "4d272abddc0d86e0b25ead5620ed150b96139b06";
-      sha256 = "074yipfzy5ca4hlds3gpls31ms5js2zbx458km3svii8zs80kszr";
+      rev = "f70f292f9e680b3645c8e24ebee524264a9e75e2";
+      sha256 = "1a45s282b85hjffdzd2375wv6c70dlli7l0wpcsq56ab4pyxamqz";
     };
     meta.homepage = "https://github.com/gelguy/wilder.nvim/";
   };
diff --git a/pkgs/misc/vim-plugins/overrides.nix b/pkgs/misc/vim-plugins/overrides.nix
index aa6b762fd850..5b6b9a2264d9 100644
--- a/pkgs/misc/vim-plugins/overrides.nix
+++ b/pkgs/misc/vim-plugins/overrides.nix
@@ -671,7 +671,7 @@ self: super: {
             libiconv
           ];
 
-          cargoSha256 = "sha256-wYxUo9zfflU7RTsTb7W9wc/WBsXhz3OLjC8CwUkRRiE=";
+          cargoSha256 = "16lcsi5mxmj79ky5lbpivravn8rjl4z3j3fsxrglb22ab4i7js3n";
         };
       in
       ''
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index c98cd6653ce5..39973d77e098 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -213,6 +213,13 @@ HerringtonDarkholme/yats.vim
 honza/vim-snippets
 hoob3rt/lualine.nvim
 hotwatermorning/auto-git-diff
+hrsh7th/cmp-buffer@main
+hrsh7th/cmp-calc@main
+hrsh7th/cmp-emoji@main
+hrsh7th/cmp-nvim-lsp@main
+hrsh7th/cmp-path@main
+hrsh7th/cmp-vsnip@main
+hrsh7th/nvim-cmp@main
 hrsh7th/nvim-compe
 hrsh7th/vim-vsnip
 hrsh7th/vim-vsnip-integ
@@ -607,6 +614,7 @@ ruifm/gitlinker.nvim
 rust-lang/rust.vim
 ryanoasis/vim-devicons
 ryvnf/readline.vim
+saadparwaiz1/cmp_luasnip
 sainnhe/edge
 sainnhe/gruvbox-material
 sainnhe/sonokai
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index 20f9f5aaa147..973e6d50adfe 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -88,7 +88,7 @@ assert (versionAtLeast version "4.9");
   INET_MPTCP_DIAG   = option no;
 
   # Use -fstack-protector-strong (gcc 4.9+) for best stack canary coverage.
-  CC_STACKPROTECTOR_REGULAR = whenOlder "4.18" no;
+  CC_STACKPROTECTOR_REGULAR = lib.mkForce (whenOlder "4.18" no);
   CC_STACKPROTECTOR_STRONG  = whenOlder "4.18" yes;
 
   # Detect out-of-bound reads/writes and use-after-free
diff --git a/pkgs/os-specific/linux/kernel/linux-xanmod.nix b/pkgs/os-specific/linux/kernel/linux-xanmod.nix
index e35df218b387..61b17260f718 100644
--- a/pkgs/os-specific/linux/kernel/linux-xanmod.nix
+++ b/pkgs/os-specific/linux/kernel/linux-xanmod.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildLinux, fetchFromGitHub, ... } @ args:
 
 let
-  version = "5.13.10";
+  version = "5.13.11";
   release = "1";
   suffix = "xanmod${release}-cacule";
 in
@@ -13,7 +13,7 @@ buildLinux (args // rec {
     owner = "xanmod";
     repo = "linux";
     rev = modDirVersion;
-    sha256 = "sha256-f7Re9Nt6f9wqdfUgtHAvnGtSEBv6ULRAXYgQXa8RvDM=";
+    sha256 = "sha256-55BRj0JNQKwmSvlquNHr6ZaI7x/sBYzfZPHIblxK4lY=";
   };
 
   structuredExtraConfig = with lib.kernel; {
diff --git a/pkgs/servers/dns/nsd/default.nix b/pkgs/servers/dns/nsd/default.nix
index ddded73391d7..8c64671251ea 100644
--- a/pkgs/servers/dns/nsd/default.nix
+++ b/pkgs/servers/dns/nsd/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nsd";
-  version = "4.3.5";
+  version = "4.3.7";
 
   src = fetchurl {
     url = "https://www.nlnetlabs.nl/downloads/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-faK0PjCz1/MHcixgj3Gb+xafDZhcdko0+gZp3DNIRHI=";
+    sha256 = "sha256-/TuexTu9Fo1Wegv83xQMlmUR/a94vVOdCRwaE8E76K0=";
   };
 
   prePatch = ''
diff --git a/pkgs/servers/hqplayerd/default.nix b/pkgs/servers/hqplayerd/default.nix
index 14fe83ea5cb3..095f09d19ab5 100644
--- a/pkgs/servers/hqplayerd/default.nix
+++ b/pkgs/servers/hqplayerd/default.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "hqplayerd";
-  version = "4.25.0-64";
+  version = "4.25.1-65";
 
   src = fetchurl {
     url = "https://www.signalyst.eu/bins/${pname}/fc34/${pname}-${version}.fc34.x86_64.rpm";
-    sha256 = "sha256-KLP7g1SQzVKu9Hnptb6s0FwmLSjhlAINJoJskja+bDM=";
+    sha256 = "sha256-1Gfnha0DRAH2q0HJQVZegFKjpnVVK+MxPUmYJsA8Xgc=";
   };
 
   unpackPhase = ''
diff --git a/pkgs/servers/matrix-synapse/0001-setup-add-homeserver-as-console-script.patch b/pkgs/servers/matrix-synapse/0001-setup-add-homeserver-as-console-script.patch
new file mode 100644
index 000000000000..eb70d21ed5cb
--- /dev/null
+++ b/pkgs/servers/matrix-synapse/0001-setup-add-homeserver-as-console-script.patch
@@ -0,0 +1,33 @@
+From 36ffbb7ad2c535180cae473b470a43f9db4fbdcd Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Mon, 16 Aug 2021 13:27:28 +0200
+Subject: [PATCH] setup: add homeserver as console script
+
+With this change, it will be added to `$out/bin` in `nixpkgs` directly.
+This became necessary since our old workaround, calling it as script,
+doesn't work anymore since the shebangs were removed[1].
+
+[1] https://github.com/matrix-org/synapse/pull/10415
+---
+ setup.py | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/setup.py b/setup.py
+index c47856351..27f1d842c 100755
+--- a/setup.py
++++ b/setup.py
+@@ -133,6 +133,11 @@ setup(
+     long_description=long_description,
+     long_description_content_type="text/x-rst",
+     python_requires="~=3.6",
++    entry_points={
++        'console_scripts': [
++            'homeserver = synapse.app.homeserver:main'
++        ]
++    },
+     classifiers=[
+         "Development Status :: 5 - Production/Stable",
+         "Topic :: Communications :: Chat",
+-- 
+2.31.1
+
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 982ced37df4b..4cac9bdcb3fe 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -12,16 +12,15 @@ let
 in
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.39.0";
+  version = "1.40.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-dErfNHDUo0yGLbrRQdwbNkMVfnMfbrO3f7bsRwgRQMM=";
+    sha256 = "sha256-5RCeKTAtuFERQSoz4WinGz36tMuKtijnupPR/X02hCU=";
   };
 
   patches = [
-    # adds an entry point for the service
-    ./homeserver-script.patch
+    ./0001-setup-add-homeserver-as-console-script.patch
   ];
 
   buildInputs = [ openssl ];
diff --git a/pkgs/servers/matrix-synapse/homeserver-script.patch b/pkgs/servers/matrix-synapse/homeserver-script.patch
deleted file mode 100644
index 554a2c5f66c1..000000000000
--- a/pkgs/servers/matrix-synapse/homeserver-script.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-diff --git a/homeserver b/homeserver
-new file mode 120000
-index 000000000..2f1d41351
---- /dev/null
-+++ b/homeserver
-@@ -0,0 +1 @@
-+synapse/app/homeserver.py
-\ No newline at end of file
-diff --git a/setup.py b/setup.py
-index 5ce06c898..f1ccd95bc 100755
---- a/setup.py
-+++ b/setup.py
-@@ -115,6 +115,6 @@ setup(
-         "Programming Language :: Python :: 3.6",
-         "Programming Language :: Python :: 3.7",
-     ],
--    scripts=["synctl"] + glob.glob("scripts/*"),
-+    scripts=["synctl", "homeserver"] + glob.glob("scripts/*"),
-     cmdclass={"test": TestCommand},
- )
--- 
-2.22.0
-
diff --git a/pkgs/tools/admin/daemontools/default.nix b/pkgs/tools/admin/daemontools/default.nix
index 6fafc1c253a9..ad12234bf27b 100644
--- a/pkgs/tools/admin/daemontools/default.nix
+++ b/pkgs/tools/admin/daemontools/default.nix
@@ -1,24 +1,25 @@
 { fetchurl, bash, glibc, lib, stdenv }:
 
 stdenv.mkDerivation rec {
-  name = "daemontools-0.76";
+  pname = "daemontools";
+  version = "0.76";
 
   src = fetchurl {
-    url = "https://cr.yp.to/daemontools/${name}.tar.gz";
+    url = "https://cr.yp.to/daemontools/daemontools-${version}.tar.gz";
     sha256 = "07scvw88faxkscxi91031pjkpccql6wspk4yrlnsbrrb5c0kamd5";
   };
 
   patches = [ ./fix-nix-usernamespace-build.patch ];
 
   configurePhase = ''
-    cd ${name}
+    cd daemontools-${version}
 
     sed -ie '1 s_$_ -include ${glibc.dev}/include/errno.h_' src/conf-cc
 
     substituteInPlace src/Makefile \
       --replace '/bin/sh' '${bash}/bin/bash -oxtrace'
 
-    sed -ie "s_^PATH=.*_PATH=$src/${name}/compile:''${PATH}_" src/rts.tests
+    sed -ie "s_^PATH=.*_PATH=$src/daemontools-${version}/compile:''${PATH}_" src/rts.tests
 
     cat ${glibc.dev}/include/errno.h
   '';
diff --git a/pkgs/tools/admin/tightvnc/default.nix b/pkgs/tools/admin/tightvnc/default.nix
index 1bfb3be113da..0da2e7875f08 100644
--- a/pkgs/tools/admin/tightvnc/default.nix
+++ b/pkgs/tools/admin/tightvnc/default.nix
@@ -1,11 +1,12 @@
 { lib, stdenv, fetchurl, xlibsWrapper, zlib, libjpeg, imake, gccmakedep, libXmu
 , libXaw, libXpm, libXp , perl, xauth, fontDirectories, openssh }:
 
-stdenv.mkDerivation {
-  name = "tightvnc-1.3.10";
+stdenv.mkDerivation rec {
+  pname = "tightvnc";
+  version = "1.3.10";
 
   src = fetchurl {
-    url = "mirror://sourceforge/vnc-tight/tightvnc-1.3.10_unixsrc.tar.bz2";
+    url = "mirror://sourceforge/vnc-tight/tightvnc-${version}_unixsrc.tar.bz2";
     sha256 = "f48c70fea08d03744ae18df6b1499976362f16934eda3275cead87baad585c0d";
   };
 
diff --git a/pkgs/tools/archivers/atool/default.nix b/pkgs/tools/archivers/atool/default.nix
index 419a7d04ee33..8303a1b4277b 100644
--- a/pkgs/tools/archivers/atool/default.nix
+++ b/pkgs/tools/archivers/atool/default.nix
@@ -1,9 +1,11 @@
 {lib, stdenv, fetchurl, perl, bash}:
 
-stdenv.mkDerivation {
-  name = "atool-0.39.0";
+stdenv.mkDerivation rec {
+  pname = "atool";
+  version = "0.39.0";
+
   src = fetchurl {
-    url = "mirror://savannah/atool/atool-0.39.0.tar.gz";
+    url = "mirror://savannah/atool/atool-${version}.tar.gz";
     sha256 = "aaf60095884abb872e25f8e919a8a63d0dabaeca46faeba87d12812d6efc703b";
   };
 
diff --git a/pkgs/tools/archivers/cabextract/default.nix b/pkgs/tools/archivers/cabextract/default.nix
index 3ed07544bb2b..4dddc4a5a6ae 100644
--- a/pkgs/tools/archivers/cabextract/default.nix
+++ b/pkgs/tools/archivers/cabextract/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "cabextract-1.9.1";
+  pname = "cabextract";
+  version = "1.9.1";
 
   src = fetchurl {
-    url = "https://www.cabextract.org.uk/${name}.tar.gz";
+    url = "https://www.cabextract.org.uk/cabextract-${version}.tar.gz";
     sha256 = "19qwhl2r8ip95q4vxzxg2kp4p125hjmc9762sns1dwwf7ikm7hmg";
   };
 
diff --git a/pkgs/tools/archivers/cromfs/default.nix b/pkgs/tools/archivers/cromfs/default.nix
index bed0485e44a2..899640d90c45 100644
--- a/pkgs/tools/archivers/cromfs/default.nix
+++ b/pkgs/tools/archivers/cromfs/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, pkg-config, fuse, perl }:
 
 stdenv.mkDerivation rec {
-  name = "cromfs-1.5.10.2";
+  pname = "cromfs";
+  version = "1.5.10.2";
 
   src = fetchurl {
-    url = "https://bisqwit.iki.fi/src/arch/${name}.tar.bz2";
+    url = "https://bisqwit.iki.fi/src/arch/cromfs-${version}.tar.bz2";
     sha256 = "0xy2x1ws1qqfp7hfj6yzm80zhrxzmhn0w2yns77im1lmd2h18817";
   };
 
diff --git a/pkgs/tools/archivers/innoextract/default.nix b/pkgs/tools/archivers/innoextract/default.nix
index 4822ea82d1e6..d2e1bebb3676 100644
--- a/pkgs/tools/archivers/innoextract/default.nix
+++ b/pkgs/tools/archivers/innoextract/default.nix
@@ -3,10 +3,11 @@
 , withGog ? false, unar ? null }:
 
 stdenv.mkDerivation rec {
-  name = "innoextract-1.9";
+  pname = "innoextract";
+  version = "1.9";
 
   src = fetchurl {
-    url = "https://constexpr.org/innoextract/files/${name}.tar.gz";
+    url = "https://constexpr.org/innoextract/files/innoextract-${version}.tar.gz";
     sha256 = "09l1z1nbl6ijqqwszdwch9mqr54qb7df0wp2sd77v17dq6gsci33";
   };
 
diff --git a/pkgs/tools/archivers/pxattr/default.nix b/pkgs/tools/archivers/pxattr/default.nix
index 79a40e6ca6be..57eb7e6f87a1 100644
--- a/pkgs/tools/archivers/pxattr/default.nix
+++ b/pkgs/tools/archivers/pxattr/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, gcc }:
 
-stdenv.mkDerivation {
-  name = "pxattr-2.1.0";
+stdenv.mkDerivation rec {
+  pname = "pxattr";
+  version = "2.1.0";
 
   src = fetchurl {
-    url = "https://www.lesbonscomptes.com/pxattr/pxattr-2.1.0.tar.gz";
+    url = "https://www.lesbonscomptes.com/pxattr/pxattr-${version}.tar.gz";
     sha256 = "1dwcqc5z7gzma1zhis2md49bj2nq7m6jimh4zlx9szw6svisz56z";
   };
 
diff --git a/pkgs/tools/audio/gvolicon/default.nix b/pkgs/tools/audio/gvolicon/default.nix
index 9ef8eb43772a..852f538d6e31 100644
--- a/pkgs/tools/audio/gvolicon/default.nix
+++ b/pkgs/tools/audio/gvolicon/default.nix
@@ -1,7 +1,9 @@
 { lib, stdenv, makeWrapper, alsa-lib, pkg-config, fetchgit, gtk3, gnome, gdk-pixbuf, librsvg, wrapGAppsHook }:
 
 stdenv.mkDerivation {
-  name = "gvolicon-2014-04-28";
+  pname = "gvolicon";
+  version = "unstable-2014-04-28";
+
   src = fetchgit {
     url = "https://github.com/Unia/gvolicon";
     rev = "0d65a396ba11f519d5785c37fec3e9a816217a07";
diff --git a/pkgs/tools/audio/midicsv/default.nix b/pkgs/tools/audio/midicsv/default.nix
index cf55e0dd81d5..698205a2b076 100644
--- a/pkgs/tools/audio/midicsv/default.nix
+++ b/pkgs/tools/audio/midicsv/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "midicsv-1.1";
+  pname = "midicsv";
+  version = "1.1";
 
   src = fetchurl {
-    url = "http://www.fourmilab.ch/webtools/midicsv/${name}.tar.gz";
+    url = "http://www.fourmilab.ch/webtools/midicsv/midicsv-${version}.tar.gz";
     sha256 = "1vvhk2nf9ilfw0wchmxy8l13hbw9cnpz079nsx5srsy4nnd78nkw";
   };
 
diff --git a/pkgs/tools/audio/mpdsync/default.nix b/pkgs/tools/audio/mpdsync/default.nix
index 51f5ba656168..c89404fbba1c 100644
--- a/pkgs/tools/audio/mpdsync/default.nix
+++ b/pkgs/tools/audio/mpdsync/default.nix
@@ -1,7 +1,8 @@
 { stdenv, python2, fetchFromGitHub }:
 with python2.pkgs;
 stdenv.mkDerivation {
-  name = "mpdsync-2017-06-15";
+  pname = "mpdsync";
+  version = "unstable-2017-06-15";
 
   src = fetchFromGitHub {
     owner = "alphapapa";
diff --git a/pkgs/tools/audio/pa-applet/default.nix b/pkgs/tools/audio/pa-applet/default.nix
index 358e662ca1e0..6adc24e5300d 100644
--- a/pkgs/tools/audio/pa-applet/default.nix
+++ b/pkgs/tools/audio/pa-applet/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, fetchgit, libpulseaudio, pkg-config, gtk3, glibc, autoconf, automake, libnotify, libX11, xf86inputevdev }:
 
 stdenv.mkDerivation {
-  name = "pa-applet-2012-04-11";
+  pname = "pa-applet";
+  version = "unstable-2012-04-11";
 
   src = fetchgit {
     url = "git://github.com/fernandotcl/pa-applet.git";
diff --git a/pkgs/tools/audio/picotts/default.nix b/pkgs/tools/audio/picotts/default.nix
index 03f446dc215b..5c995f407a7b 100644
--- a/pkgs/tools/audio/picotts/default.nix
+++ b/pkgs/tools/audio/picotts/default.nix
@@ -1,7 +1,9 @@
 { lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, popt }:
 
 stdenv.mkDerivation {
-  name = "picotts-unstable-2018-10-19";
+  pname = "picotts";
+  version = "unstable-2018-10-19";
+
   src = fetchFromGitHub {
     repo = "picotts";
     owner = "naggety";
diff --git a/pkgs/tools/backup/dirvish/default.nix b/pkgs/tools/backup/dirvish/default.nix
index a26bdb0d9a3f..4f99e60f4dbe 100644
--- a/pkgs/tools/backup/dirvish/default.nix
+++ b/pkgs/tools/backup/dirvish/default.nix
@@ -1,9 +1,11 @@
 { fetchurl, lib, stdenv, makeWrapper, perl, perlPackages }:
 
 stdenv.mkDerivation rec {
-  name = "dirvish-1.2.1";
+  pname = "dirvish";
+  version = "1.2.1";
+
   src = fetchurl {
-    url = "http://dirvish.org/${name}.tgz";
+    url = "http://dirvish.org/dirvish${version}.tgz";
     sha256 = "6b7f29c3541448db3d317607bda3eb9bac9fb3c51f970611ffe27e9d63507dcd";
   };
 
diff --git a/pkgs/tools/backup/mt-st/default.nix b/pkgs/tools/backup/mt-st/default.nix
index 804c50830ce6..8c62ad6512e0 100644
--- a/pkgs/tools/backup/mt-st/default.nix
+++ b/pkgs/tools/backup/mt-st/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "mt-st-1.3";
+  pname = "mt-st";
+  version = "1.3";
 
   src = fetchurl {
-    url = "https://github.com/iustin/mt-st/releases/download/${name}/${name}.tar.gz";
+    url = "https://github.com/iustin/mt-st/releases/download/mt-st-${version}/mt-st-${version}.tar.gz";
     sha256 = "b552775326a327cdcc076c431c5cbc4f4e235ac7c41aa931ad83f94cccb9f6de";
   };
 
diff --git a/pkgs/tools/backup/mtx/default.nix b/pkgs/tools/backup/mtx/default.nix
index aa72b02afbbd..b8476954949e 100644
--- a/pkgs/tools/backup/mtx/default.nix
+++ b/pkgs/tools/backup/mtx/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "mtx-1.3.12";
+  pname = "mtx";
+  version = "1.3.12";
 
   src = fetchurl {
-    url = "mirror://gentoo/distfiles/${name}.tar.gz";
+    url = "mirror://gentoo/distfiles/mtx-${version}.tar.gz";
     sha256 = "0261c5e90b98b6138cd23dadecbc7bc6e2830235145ed2740290e1f35672d843";
   };
 
diff --git a/pkgs/tools/backup/partimage/default.nix b/pkgs/tools/backup/partimage/default.nix
index 2477fa6e4431..afb8489e1f42 100644
--- a/pkgs/tools/backup/partimage/default.nix
+++ b/pkgs/tools/backup/partimage/default.nix
@@ -9,12 +9,14 @@
 , slang
 , autoreconfHook
 }:
-stdenv.mkDerivation {
-  name = "partimage-0.6.9";
+stdenv.mkDerivation rec {
+  pname = "partimage";
+  version = "0.6.9";
+
   enableParallelBuilding = true;
 
   src = fetchurl {
-    url = "mirror://sourceforge/partimage/partimage-0.6.9.tar.bz2";
+    url = "mirror://sourceforge/partimage/partimage-${version}.tar.bz2";
     sha256 = "0db6xiphk6xnlpbxraiy31c5xzj0ql6k4rfkmqzh665yyj0nqfkm";
   };
 
diff --git a/pkgs/tools/backup/rsnapshot/default.nix b/pkgs/tools/backup/rsnapshot/default.nix
index 9322e62a3dc6..3ded8c6b8482 100644
--- a/pkgs/tools/backup/rsnapshot/default.nix
+++ b/pkgs/tools/backup/rsnapshot/default.nix
@@ -1,10 +1,11 @@
 { fetchurl, lib, stdenv, perl, openssh, rsync, logger }:
 
 stdenv.mkDerivation rec {
-  name = "rsnapshot-1.4.3";
+  pname = "rsnapshot";
+  version = "1.4.3";
 
   src = fetchurl {
-    url = "https://rsnapshot.org/downloads/${name}.tar.gz";
+    url = "https://rsnapshot.org/downloads/rsnapshot-${version}.tar.gz";
     sha256 = "1lavqmmsf53pim0nvming7fkng6p0nk2a51k2c2jdq0l7snpl31b";
   };
 
diff --git a/pkgs/tools/bluetooth/obex-data-server/default.nix b/pkgs/tools/bluetooth/obex-data-server/default.nix
index f580080e8796..cc6754b4a8c0 100644
--- a/pkgs/tools/bluetooth/obex-data-server/default.nix
+++ b/pkgs/tools/bluetooth/obex-data-server/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, pkg-config, libusb-compat-0_1, glib, dbus-glib, bluez, openobex, dbus }:
 
 stdenv.mkDerivation rec {
-  name = "obex-data-server-0.4.6";
+  pname = "obex-data-server";
+  version = "0.4.6";
 
   src = fetchurl {
-    url = "http://tadas.dailyda.com/software/${name}.tar.gz";
+    url = "http://tadas.dailyda.com/software/obex-data-server-${version}.tar.gz";
     sha256 = "0kq940wqs9j8qjnl58d6l3zhx0jaszci356xprx23l6nvdfld6dk";
   };
 
diff --git a/pkgs/tools/bluetooth/obexd/default.nix b/pkgs/tools/bluetooth/obexd/default.nix
index 6ddbcd5652de..c18aa3a1c263 100644
--- a/pkgs/tools/bluetooth/obexd/default.nix
+++ b/pkgs/tools/bluetooth/obexd/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, pkg-config, glib, dbus, openobex, bluez, libical }:
 
 stdenv.mkDerivation rec {
-  name = "obexd-0.48";
+  pname = "obexd";
+  version = "0.48";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/bluetooth/${name}.tar.bz2";
+    url = "mirror://kernel/linux/bluetooth/obexd-${version}.tar.bz2";
     sha256 = "1i20dnibvnq9lnkkhajr5xx3kxlwf9q5c4jm19kyb0q1klzgzlb8";
   };
 
diff --git a/pkgs/tools/bluetooth/obexfs/default.nix b/pkgs/tools/bluetooth/obexfs/default.nix
index b81e8c4ea55b..2783c63899df 100644
--- a/pkgs/tools/bluetooth/obexfs/default.nix
+++ b/pkgs/tools/bluetooth/obexfs/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, pkg-config, bluez, fuse, obexftp }:
 
 stdenv.mkDerivation rec {
-  name = "obexfs-0.12";
+  pname = "obexfs";
+  version = "0.12";
 
   src = fetchurl {
-    url = "mirror://sourceforge/openobex/${name}.tar.gz";
+    url = "mirror://sourceforge/openobex/obexfs-${version}.tar.gz";
     sha256 = "1g3krpygk6swa47vbmp9j9s8ahqqcl9ra8r25ybgzv2d9pmjm9kj";
   };
 
diff --git a/pkgs/tools/bluetooth/obexftp/default.nix b/pkgs/tools/bluetooth/obexftp/default.nix
index fc2ff6128f75..3d9eda383ddf 100644
--- a/pkgs/tools/bluetooth/obexftp/default.nix
+++ b/pkgs/tools/bluetooth/obexftp/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, pkg-config, openobex, bluez, cmake }:
 
 stdenv.mkDerivation rec {
-  name = "obexftp-0.24.2";
+  pname = "obexftp";
+  version = "0.24.2";
 
   src = fetchurl {
-    url = "mirror://sourceforge/openobex/${name}-Source.tar.gz";
+    url = "mirror://sourceforge/openobex/obexftp-${version}-Source.tar.gz";
     sha256 = "18w9r78z78ri5qc8fjym4nk1jfbrkyr789sq7rxrkshf1a7b83yl";
   };
 
diff --git a/pkgs/tools/bluetooth/openobex/default.nix b/pkgs/tools/bluetooth/openobex/default.nix
index 1079623cf2af..831644bd4ac0 100644
--- a/pkgs/tools/bluetooth/openobex/default.nix
+++ b/pkgs/tools/bluetooth/openobex/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, pkg-config, bluez, libusb-compat-0_1, cmake }:
 
 stdenv.mkDerivation rec {
-  name = "openobex-1.7.2";
+  pname = "openobex";
+  version = "1.7.2";
 
   src = fetchurl {
-    url = "mirror://sourceforge/openobex/${name}-Source.tar.gz";
+    url = "mirror://sourceforge/openobex/openobex-${version}-Source.tar.gz";
     sha256 = "1z6l7pbwgs5pjx3861cyd3r6vq5av984bdp4r3hgrw2jxam6120m";
   };
 
diff --git a/pkgs/tools/cd-dvd/ccd2iso/default.nix b/pkgs/tools/cd-dvd/ccd2iso/default.nix
index 10f8d9701d40..ad3fee9792c6 100644
--- a/pkgs/tools/cd-dvd/ccd2iso/default.nix
+++ b/pkgs/tools/cd-dvd/ccd2iso/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "ccd2iso-0.3";
+  pname = "ccd2iso";
+  version = "0.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/ccd2iso/${name}.tar.gz";
+    url = "mirror://sourceforge/ccd2iso/ccd2iso-${version}.tar.gz";
     sha256 = "1z000zi7hpr2h9cabj6hzf3n6a6gd6glmm8nn36v4b8i4vzbhx7q";
   };
 
diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index 3fca8b2cd3c6..c9d49cfd4390 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl, libvorbis, libmad, pkg-config, libao}:
 
-stdenv.mkDerivation {
-  name = "cdrdao-1.2.3";
+stdenv.mkDerivation rec {
+  pname = "cdrdao";
+  version = "1.2.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/cdrdao/cdrdao-1.2.3.tar.bz2";
+    url = "mirror://sourceforge/cdrdao/cdrdao-${version}.tar.bz2";
     sha256 = "0pmpgx91j984snrsxbq1dgf3ximks2dfh1sqqmic72lrls7wp4w1";
   };
 
diff --git a/pkgs/tools/cd-dvd/cdrkit/default.nix b/pkgs/tools/cd-dvd/cdrkit/default.nix
index 28ed61ebd55e..1bc84cf59dfe 100644
--- a/pkgs/tools/cd-dvd/cdrkit/default.nix
+++ b/pkgs/tools/cd-dvd/cdrkit/default.nix
@@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl, cmake, libcap, zlib, bzip2, perl}:
 
 stdenv.mkDerivation rec {
-  name = "cdrkit-1.1.11";
+  pname = "cdrkit";
+  version = "1.1.11";
 
   src = fetchurl {
-    url = "http://cdrkit.org/releases/${name}.tar.gz";
+    url = "http://cdrkit.org/releases/cdrkit-${version}.tar.gz";
     sha256 = "1nj7iv3xrq600i37na9a5idd718piiiqbs4zxvpjs66cdrsk1h6i";
   };
 
diff --git a/pkgs/tools/cd-dvd/uif2iso/default.nix b/pkgs/tools/cd-dvd/uif2iso/default.nix
index ac0879e32172..7a8a6569e533 100644
--- a/pkgs/tools/cd-dvd/uif2iso/default.nix
+++ b/pkgs/tools/cd-dvd/uif2iso/default.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, unzip, zlib }:
 
 stdenv.mkDerivation rec {
-  nameNoVer = "uif2iso";
-  name = "${nameNoVer}-0.1.7";
+  pname = "uif2iso";
+  version = "0.1.7";
 
   src = fetchurl {
-    url = "http://aluigi.altervista.org/mytoolz/${nameNoVer}.zip";
+    url = "http://aluigi.altervista.org/mytoolz/uif2iso.zip";
     sha256 = "1v18fmlzhkkhv8xdc9dyvl8vamwg3ka4dsrg7vvmk1f2iczdx3dp";
   };
 
diff --git a/pkgs/tools/cd-dvd/vobcopy/default.nix b/pkgs/tools/cd-dvd/vobcopy/default.nix
index a31354670a04..2ebe9e5e0a35 100644
--- a/pkgs/tools/cd-dvd/vobcopy/default.nix
+++ b/pkgs/tools/cd-dvd/vobcopy/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, libdvdread, libdvdcss }:
 
 stdenv.mkDerivation rec {
-  name = "vobcopy-1.2.0";
+  pname = "vobcopy";
+  version = "1.2.0";
 
   src = fetchurl {
-    url = "http://www.vobcopy.org/download/${name}.tar.bz2";
+    url = "http://www.vobcopy.org/download/vobcopy-${version}.tar.bz2";
     sha256 = "01l1yihbd73srzghzzx5dgfg3yfb5kml5dix52mq0snhjp8h89c9";
   };
 
diff --git a/pkgs/tools/cd-dvd/vobsub2srt/default.nix b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
index 5262fe06963b..54df481cd676 100644
--- a/pkgs/tools/cd-dvd/vobsub2srt/default.nix
+++ b/pkgs/tools/cd-dvd/vobsub2srt/default.nix
@@ -1,10 +1,9 @@
 { lib, stdenv, fetchgit, cmake, libtiff, pkg-config, tesseract }:
 
-let rev = "a6abbd61127a6392d420bbbebdf7612608c943c2";
-    shortRev = builtins.substring 0 7 rev;
-in
-stdenv.mkDerivation {
-  name = "vobsub2srt-git-20140817-${shortRev}";
+stdenv.mkDerivation rec {
+  pname = "vobsub2srt-git";
+  version = "20140817-${builtins.substring 0 7 rev}";
+  rev = "a6abbd61127a6392d420bbbebdf7612608c943c2";
 
   src = fetchgit {
     inherit rev;
diff --git a/pkgs/tools/compression/lzham/default.nix b/pkgs/tools/compression/lzham/default.nix
index 7f4273163a3e..5915d1439dff 100644
--- a/pkgs/tools/compression/lzham/default.nix
+++ b/pkgs/tools/compression/lzham/default.nix
@@ -1,12 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake } :
 
-stdenv.mkDerivation {
-  name = "lzham-1.0";
+stdenv.mkDerivation rec {
+  pname = "lzham";
+  version = "1.0";
 
   src = fetchFromGitHub {
     owner = "richgel999";
     repo = "lzham_codec";
-    rev = "v1_0_release";
+    rev = "v${lib.replaceStrings ["."] ["_"] version}_release";
     sha256 = "14c1zvzmp1ylp4pgayfdfk1kqjb23xj4f7ll1ra7b18wjxc9ja1v";
   };
 
diff --git a/pkgs/tools/networking/croc/default.nix b/pkgs/tools/networking/croc/default.nix
index 485ce66dbd7c..9deb7d6c9409 100644
--- a/pkgs/tools/networking/croc/default.nix
+++ b/pkgs/tools/networking/croc/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "9.2.1";
+  version = "9.3.0";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-pEW20IbPVywNq2udfdQ/U71aDEku73+JGiy2iRADJ8Y=";
+    sha256 = "sha256-chSVAQXGtcAFs4GzqywjAUM9qng9j6j7KOrlQalxdOw=";
   };
 
-  vendorSha256 = "sha256-z5G56PiBisceNc4tfZJVKh9tZmUkyamQBYG2mQ6kuXg=";
+  vendorSha256 = "sha256-z8xU1IH+xemx/kxE4crj90roF73QW5D9jFLpykH7meo=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/networking/oapi-codegen/default.nix b/pkgs/tools/networking/oapi-codegen/default.nix
index ce490cafef6a..41e80a3e12cb 100644
--- a/pkgs/tools/networking/oapi-codegen/default.nix
+++ b/pkgs/tools/networking/oapi-codegen/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "oapi-codegen";
-  version = "1.6.0";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "deepmap";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-doJ1ceuJ/gL9vlGgV/hKIJeAErAseH0dtHKJX2z7pV0=";
+    sha256 = "sha256-8hyRuGKspWqv+uBeSz4i12Grl83EQVPWB1weEVf9yhA=";
   };
 
-  vendorSha256 = "sha256-Y4WM+o+5jiwj8/99UyNHLpBNbtJkKteIGW2P1Jd9L6M=";
+  vendorSha256 = "sha256-YCZzIsu1mMAAjLGHISrDkfY4Lx0az2SZV8bnZOMalx8=";
 
   # Tests use network
   doCheck = false;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 7387d7188384..eaeff814e13b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -448,6 +448,20 @@ mapAliases ({
   linuxPackages_xen_dom0_hardened = linuxPackages_hardened;
   linuxPackages_latest_xen_dom0_hardened = linuxPackages_latest_hardened;
 
+  # added 2021-08-16
+  linuxPackages_latest_hardened = throw ''
+    The attribute `linuxPackages_hardened_latest' was dropped because the hardened patches
+    frequently lag behind the upstream kernel. In some cases this meant that this attribute
+    had to refer to an older kernel[1] because the latest hardened kernel was EOL and
+    the latest supported kernel didn't have patches.
+
+    If you want to use a hardened kernel, please check which kernel minors are supported
+    and use a versioned attribute, e.g. `linuxPackages_5_10_hardened'.
+
+    [1] for more context: https://github.com/NixOS/nixpkgs/pull/133587
+  '';
+  linux_latest_hardened = linuxPackages_latest_hardened;
+
   linux-steam-integration = throw "linux-steam-integration has been removed, as the upstream project has been abandoned"; # added 2020-05-22
   loadcaffe = throw "loadcaffe has been removed, as the upstream project has been abandoned"; # added 2020-03-28
   lobster-two = google-fonts; # added 2021-07-22
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 84d13b2cab9f..1694eee0b253 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21535,11 +21535,8 @@ with pkgs;
   linuxPackages_testing_bcachefs = recurseIntoAttrs (linuxPackagesFor pkgs.linux_testing_bcachefs);
 
   # Hardened Linux
-  hardenedLinuxPackagesFor = kernel': overrides:
-    let # Note: We use this hack since the hardened patches can lag behind and we don't want to delay updates:
-      linux_latest_for_hardened = pkgs.linux_5_10;
-      kernel = (if kernel' == pkgs.linux_latest then linux_latest_for_hardened else kernel').override overrides;
-    in linuxPackagesFor (kernel.override {
+  hardenedLinuxPackagesFor = kernel: overrides:
+    linuxPackagesFor (kernel.override {
       structuredExtraConfig = import ../os-specific/linux/kernel/hardened/config.nix {
         inherit lib;
         inherit (kernel) version;
@@ -21554,8 +21551,17 @@ with pkgs;
   linuxPackages_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux { });
   linux_hardened = linuxPackages_hardened.kernel;
 
-  linuxPackages_latest_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_latest { });
-  linux_latest_hardened = linuxPackages_latest_hardened.kernel;
+  linuxPackages_4_14_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_4_14 { });
+  linux_4_14_hardened = linuxPackages_4_14_hardened.kernel;
+
+  linuxPackages_4_19_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_4_19 { });
+  linux_4_19_hardened = linuxPackages_4_19_hardened.kernel;
+
+  linuxPackages_5_4_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_5_4 { });
+  linux_5_4_hardened = linuxPackages_5_4_hardened.kernel;
+
+  linuxPackages_5_10_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_5_10 { });
+  linux_5_10_hardened = linuxPackages_5_10_hardened.kernel;
 
   # Hardkernel (Odroid) kernels.
   linuxPackages_hardkernel_4_14 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_hardkernel_4_14);