diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 20ce129c5a0a..b1c5a7a6c95f 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -853,8 +853,12 @@ in
       (mkIf (pkgs.stdenv.isAarch32 || pkgs.stdenv.isAarch64) [
         "-device virtio-gpu-pci" "-device usb-ehci,id=usb0" "-device usb-kbd" "-device usb-tablet"
       ])
-      (mkIf (!cfg.useBootLoader) [
-        "-kernel \${NIXPKGS_QEMU_KERNEL_${config.system.name}:-${config.system.build.toplevel}/kernel}"
+      (let
+        alphaNumericChars = lowerChars ++ upperChars ++ (map toString (range 0 9));
+        # Replace all non-alphanumeric characters with underscores
+        sanitizeShellIdent = s: concatMapStrings (c: if builtins.elem c alphaNumericChars then c else "_") (stringToCharacters s);
+      in mkIf (!cfg.useBootLoader) [
+        "-kernel \${NIXPKGS_QEMU_KERNEL_${sanitizeShellIdent config.system.name}:-${config.system.build.toplevel}/kernel}"
         "-initrd ${config.system.build.toplevel}/initrd"
         ''-append "$(cat ${config.system.build.toplevel}/kernel-params) init=${config.system.build.toplevel}/init regInfo=${regInfo}/registration ${consoles} $QEMU_KERNEL_PARAMS"''
       ])
diff --git a/pkgs/applications/audio/ocenaudio/default.nix b/pkgs/applications/audio/ocenaudio/default.nix
index 50697c6c81a9..c927d8997ed8 100644
--- a/pkgs/applications/audio/ocenaudio/default.nix
+++ b/pkgs/applications/audio/ocenaudio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ocenaudio";
-  version = "3.11.7";
+  version = "3.11.10";
 
   src = fetchurl {
     url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
-    sha256 = "sha256-fTeDRo7gCM1jXTQGm9MsmKu4KvTGDUogF3VSZWk91RM=";
+    sha256 = "sha256-Ah6Ni5EbFdIQ/wN7uGeMrSP5ybQfI4iy9gI1VT5LztU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/audio/plexamp/default.nix b/pkgs/applications/audio/plexamp/default.nix
index d86223dcdcb1..fa76b50f8ae6 100644
--- a/pkgs/applications/audio/plexamp/default.nix
+++ b/pkgs/applications/audio/plexamp/default.nix
@@ -2,12 +2,12 @@
 
 let
   pname = "plexamp";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchurl {
     url = "https://plexamp.plex.tv/plexamp.plex.tv/desktop/Plexamp-${version}.AppImage";
     name="${pname}-${version}.AppImage";
-    sha512 = "N+WkH6n7MWfRd2rsk/2b/rABL6pcjpKa1iBZSHslIOEc5fYWjGAxjwwTU0RgSaqptS1DyPeCUeWuphWPZJsQgw==";
+    sha512 = "yIdZoKTJJEpUzEqvixQ7JJBxzrtCRov31dGBDOjMiK/oA2q00Xo6XVDvAhYuIn6ocZqK+I5jHfmf4qYaRePDvg==";
   };
 
   appimageContents = appimageTools.extractType2 {
@@ -33,7 +33,7 @@ in appimageTools.wrapType2 {
   meta = with lib; {
     description = "A beautiful Plex music player for audiophiles, curators, and hipsters";
     homepage = "https://plexamp.com/";
-    changelog = "https://forums.plex.tv/t/plexamp-release-notes/221280/42";
+    changelog = "https://forums.plex.tv/t/plexamp-release-notes/221280/43";
     license = licenses.unfree;
     maintainers = with maintainers; [ killercup synthetica ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/editors/cudatext/default.nix b/pkgs/applications/editors/cudatext/default.nix
index c94ee471c28a..39984f93c586 100644
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.160.0";
+  version = "1.160.2";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    sha256 = "sha256-42V6RFa+mAXyaUuKeDQa9Voi1MjnzcVl+cOA65VabxM=";
+    sha256 = "sha256-moKuiW5kd0jdAk0lBLX8ZWeT/locxGAvM4oOqvMGsr4=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/editors/cudatext/deps.json b/pkgs/applications/editors/cudatext/deps.json
index efb179333bf2..ab490ebd7a40 100644
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@@ -26,8 +26,8 @@
   },
   "EControl": {
     "owner": "Alexey-T",
-    "rev": "2022.03.28",
-    "sha256": "sha256-jh3lqisiPNMxCapP6O5oJdUL3PLQ3JyomtgWix+bML0="
+    "rev": "2022.04.08",
+    "sha256": "sha256-pPlb8rr5loYVzKw/7R2kogSAosmViwGM3cehVwf4EYY="
   },
   "ATSynEdit_Ex": {
     "owner": "Alexey-T",
diff --git a/pkgs/applications/editors/jupyter-kernels/wolfram/default.nix b/pkgs/applications/editors/jupyter-kernels/wolfram/default.nix
new file mode 100644
index 000000000000..2d00d6e1fc2e
--- /dev/null
+++ b/pkgs/applications/editors/jupyter-kernels/wolfram/default.nix
@@ -0,0 +1,22 @@
+{ callPackage
+, wolfram-engine
+}:
+
+# To test:
+# $(nix-build -E 'with import ./. {}; jupyter.override { definitions = { wolfram = wolfram-for-jupyter-kernel.definition; }; }')/bin/jupyter-notebook
+let kernel = callPackage ./kernel.nix {};
+in {
+  definition = {
+    displayName = "Wolfram Language ${wolfram-engine.version}";
+    argv = [
+      "${wolfram-engine}/bin/wolfram"
+      "-script"
+      "${kernel}/share/Wolfram/WolframLanguageForJupyter/Resources/KernelForWolframLanguageForJupyter.wl"
+      "{connection_file}"
+      "ScriptInstall" # suppresses prompt
+    ];
+    language = "Wolfram Language";
+    logo32 = "${wolfram-engine}/share/icons/hicolor/32x32/apps/wolfram-wolframlanguage.png";
+    logo64 = "${wolfram-engine}/share/icons/hicolor/64x64/apps/wolfram-wolframlanguage.png";
+  };
+}
diff --git a/pkgs/applications/editors/jupyter-kernels/wolfram/kernel.nix b/pkgs/applications/editors/jupyter-kernels/wolfram/kernel.nix
new file mode 100644
index 000000000000..65b02bac59b8
--- /dev/null
+++ b/pkgs/applications/editors/jupyter-kernels/wolfram/kernel.nix
@@ -0,0 +1,32 @@
+{ stdenv, lib, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "wolfram-for-jupyter-kernel";
+  version = "0.9.2";
+
+  src = fetchFromGitHub {
+    owner = "WolframResearch";
+    repo = "WolframLanguageForJupyter";
+    rev = "v${version}";
+    sha256 = "19d9dvr0bv7iy0x8mk4f576ha7z7h7id39nyrggwf9cp7gymxf47";
+  };
+
+  dontConfigure = true;
+
+  installPhase = ''
+    patchShebangs ./configure-jupyter.wls
+    mkdir -p $out/share/Wolfram
+    cp -r {WolframLanguageForJupyter,images,extras,LICENSE} $out/share/Wolfram
+  '';
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A Jupyter kernel for Wolfram Language.";
+    homepage = "https://github.com/WolframResearch/WolframLanguageForJupyter";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fbeffa ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/editors/lapce/default.nix b/pkgs/applications/editors/lapce/default.nix
index 2653806a14f3..2da2a1f46773 100644
--- a/pkgs/applications/editors/lapce/default.nix
+++ b/pkgs/applications/editors/lapce/default.nix
@@ -21,18 +21,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lapce";
-  version = "0.0.10";
+  version = "0.0.12";
 
   src = fetchFromGitHub {
     owner = "lapce";
     repo = pname;
     rev = "v${version}";
-    sha256 = "tOVFm4DFQurFU4DtpPwxXQLbTGCZnrV1FfYKtvkRxRE=";
+    sha256 = "sha256-ZFQjQ5+G0b0Fgg3+du/drt+62rC/TCNR5MIdJXAkTrE=";
   };
 
-  cargoPatches = [ ./fix-version.patch ];
-
-  cargoSha256 = "BwB3KgmI5XnZ5uHv6f+kGKBzpyxPWcoKvF7qw90eorI=";
+  cargoSha256 = "sha256-sMTootPsenaWzLLFImo6HWC1pcm2uFupPhVWsUJp1Ak=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/applications/editors/lapce/fix-version.patch b/pkgs/applications/editors/lapce/fix-version.patch
deleted file mode 100644
index 2a8d96be1696..000000000000
--- a/pkgs/applications/editors/lapce/fix-version.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index bc9a0f8..45a74ad 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -2165,7 +2165,7 @@ dependencies = [
- 
- [[package]]
- name = "lapce"
--version = "0.0.9"
-+version = "0.0.10"
- dependencies = [
-  "lapce-core",
-  "lapce-proxy",
-@@ -2173,7 +2173,7 @@ dependencies = [
- 
- [[package]]
- name = "lapce-core"
--version = "0.0.9"
-+version = "0.0.10"
- dependencies = [
-  "Inflector",
-  "alacritty_terminal 0.15.0",
-@@ -2233,7 +2233,7 @@ dependencies = [
- 
- [[package]]
- name = "lapce-proxy"
--version = "0.0.9"
-+version = "0.0.10"
- dependencies = [
-  "alacritty_terminal 0.16.0-rc2",
-  "anyhow",
diff --git a/pkgs/applications/graphics/unigine-tropics/default.nix b/pkgs/applications/graphics/unigine-tropics/default.nix
new file mode 100644
index 000000000000..1057c2fa6cad
--- /dev/null
+++ b/pkgs/applications/graphics/unigine-tropics/default.nix
@@ -0,0 +1,95 @@
+{ lib
+, stdenv
+, fetchurl
+, makeWrapper
+, autoPatchelfHook
+, libX11
+, libXext
+, libXrandr
+, libXinerama
+, libglvnd
+, openal
+, glibc
+, makeDesktopItem
+, copyDesktopItems
+, imagemagick
+}:
+let
+  version = "1.3";
+in
+stdenv.mkDerivation {
+  pname = "unigine-tropics";
+  inherit version;
+
+  src = fetchurl {
+    url = "http://m12-assets.unigine.com/d/Unigine_Tropics-${version}.run";
+    sha256 = "0icasdp46fjnic7gk83pknjx0gpap9j202dm0llcfg5zin5kbq7x";
+  };
+
+  libPath = lib.makeLibraryPath [
+    libglvnd
+    openal
+    glibc
+  ];
+
+  installPhase = ''
+    bash $src --target $name
+
+    install -D -m 0755 $name/bin/libUnigine_x86.so $out/lib/unigine/tropics/bin/libUnigine_x86.so
+    install -D -m 0755 $name/bin/Tropics $out/lib/unigine/tropics/bin/Tropics
+    install -D -m 0755 $name/1024x768_windowed.sh $out/bin/Tropics
+
+    cp -R $name/data $out/lib/unigine/tropics
+
+    wrapProgram $out/bin/Tropics \
+      --prefix LD_LIBRARY_PATH : $libPath:$out/lib/unigine/tropics/bin \
+      --run "cd $out/lib/unigine/tropics"
+
+    convert -size 256x256 xc:Transparent -fill gradient:'dodgerblue-white' -stroke Transparent -draw "roundrectangle 0,0 256,256 50,50"  $name/icon.png
+    convert $name/icon.png -fill white -stroke white -draw "polygon  69.2564,84.1261 117.9,84.1261 117.9,206.56 138.1,206.56 138.1,84.1261 186.744,84.1261 186.744,65.9877 69.2564,65.9877 69.2564,84.1261" $name/icon.png
+
+    for RES in 16 24 32 48 64 128 256
+    do
+        mkdir -p $out/share/icons/hicolor/"$RES"x"$RES"/apps
+        convert $name/icon.png -resize "$RES"x"$RES" $out/share/icons/hicolor/"$RES"x"$RES"/apps/Tropics.png
+    done
+    convert $name/icon.png -resize 128x128 $out/share/icons/Tropics.png
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Tropics";
+      exec = "Tropics";
+      genericName = "A GPU Stress test tool from the UNIGINE";
+      icon = "Tropics";
+      desktopName = "Tropics Benchmark";
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+    imagemagick
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    stdenv.cc.cc
+    libX11
+    libXext
+    libXrandr
+    libXinerama
+  ];
+
+  dontUnpack = true;
+
+  meta = {
+    description = "The Unigine Heaven GPU benchmarking tool";
+    homepage = "https://benchmark.unigine.com/tropics";
+    license = lib.licenses.unfree;
+    maintainers = [ lib.maintainers.BarinovMaxim ];
+    platforms = [ "x86_64-linux" "i686-linux" ];
+  };
+}
diff --git a/pkgs/applications/misc/hugo/default.nix b/pkgs/applications/misc/hugo/default.nix
index 81ee786aec6f..8be9c83e50ad 100644
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.92.2";
+  version = "0.96.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-kwqN/9H/ZI2eL09K/9bOMBWW9bow8LtKpbfxyfxIucA=";
+    sha256 = "sha256-3O+ZdOloh5gILPQssztt7s/MwRgDOnpJItwLn7FXnPU=";
   };
 
-  vendorSha256 = "sha256-7dJUl0IxsLj0ds2jqtChNCQEBiK9PahG159IhyFxwdM=";
+  vendorSha256 = "sha256-TgE/ToHBg2QBgtk0gPZTV/icIbQN14RpVAbL/8b+W0U=";
 
   doCheck = false;
 
@@ -27,9 +27,9 @@ buildGoModule rec {
     $out/bin/hugo gen man
     installManPage man/*
     installShellCompletion --cmd hugo \
-      --bash <($out/bin/hugo gen autocomplete --type=bash) \
-      --fish <($out/bin/hugo gen autocomplete --type=fish) \
-      --zsh <($out/bin/hugo gen autocomplete --type=zsh)
+      --bash <($out/bin/hugo completion bash) \
+      --fish <($out/bin/hugo completion fish) \
+      --zsh <($out/bin/hugo completion zsh)
   '';
 
   meta = with lib; {
diff --git a/pkgs/applications/networking/appgate-sdp/default.nix b/pkgs/applications/networking/appgate-sdp/default.nix
index 987f6e0c1ca2..7e4c5cfac888 100644
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@@ -87,11 +87,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "appgate-sdp";
-  version = "5.5.3";
+  version = "5.5.4";
 
   src = fetchurl {
     url = "https://bin.appgate-sdp.com/${versions.majorMinor version}/client/appgate-sdp_${version}_amd64.deb";
-    sha256 = "sha256-qSo4JX/Jj+JkeetZIMw88MK7SzOgT8aNbQby2kJ91oo=";
+    sha256 = "sha256-7qfgUYD7uPb+ZEierREVfnHoGz0/b/J+hcsX/duDFWU=";
   };
 
   # just patch interpreter
diff --git a/pkgs/applications/networking/browsers/brave/default.nix b/pkgs/applications/networking/browsers/brave/default.nix
index 7c0006f745c6..59018c3bfb50 100644
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@@ -37,6 +37,7 @@
 , pango
 , pipewire
 , udev
+, wayland
 , xorg
 , zlib
 , xdg-utils
@@ -82,6 +83,7 @@ rpath = lib.makeLibraryPath [
   pango
   pipewire
   udev
+  wayland
   xdg-utils
   xorg.libxcb
   zlib
@@ -160,6 +162,7 @@ stdenv.mkDerivation rec {
   preFixup = ''
     # Add command line args to wrapGApp.
     gappsWrapperArgs+=(--add-flags ${lib.escapeShellArg commandLineArgs})
+    gappsWrapperArgs+=(--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland}}")
   '';
 
   installCheckPhase = ''
diff --git a/pkgs/applications/networking/cluster/werf/default.nix b/pkgs/applications/networking/cluster/werf/default.nix
index 9a9f454ac003..9d6e91fd0a6b 100644
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildGoModule
 , fetchFromGitHub
+, installShellFiles
 , pkg-config
 , gpgme
 , glibc
@@ -11,18 +12,18 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.78";
+  version = "1.2.87";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-ehrzb7WvkYL8oj2RSzKc1KDagV0zg6vMzgpT2sPyhcI=";
+    sha256 = "sha256-DMP//gh79WuQ8VY4sV6lQlwR+k+rwqODf/pagOBP+4U=";
   };
-  vendorSha256 = "sha256-w8ZeAQbZIVOBoRa9fJhXgTeYRCYpkh/U4pwb5u6A9mQ=";
+  vendorSha256 = "sha256-OrvGDNj48W1tVAs3tdtAuesHnh8fHRsGd6KL0Uaf9Zg=";
   proxyVendor = true;
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ installShellFiles pkg-config ];
   buildInputs = [ gpgme ]
     ++ lib.optionals stdenv.isLinux [ glibc.static lvm2 btrfs-progs ];
 
@@ -44,6 +45,12 @@ buildGoModule rec {
 
   subPackages = [ "cmd/werf" ];
 
+  postInstall = ''
+    installShellCompletion --cmd werf \
+      --bash <($out/bin/werf completion --shell=bash) \
+      --zsh <($out/bin/werf completion --shell=zsh)
+  '';
+
   meta = with lib; {
     homepage = "https://github.com/werf/werf";
     description = "GitOps delivery tool";
diff --git a/pkgs/applications/networking/soju/default.nix b/pkgs/applications/networking/soju/default.nix
index f5ffc03dc0f2..dc20578cf021 100644
--- a/pkgs/applications/networking/soju/default.nix
+++ b/pkgs/applications/networking/soju/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "soju";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromSourcehut {
     owner = "~emersion";
     repo = "soju";
     rev = "v${version}";
-    sha256 = "sha256-j7LwWBBJvNUeg0+P632HaGliVtrrCD0VNxkynaZzidQ=";
+    sha256 = "sha256-4ixPEnSa1m52Hu1dzxMG8c0bkqGN04vRlIzvdZ/ES4A=";
   };
 
-  vendorSha256 = "sha256-fDfH2pQ5MtZDjiGx26vS5dBzxejVXPfflLX8N8VcJTA=";
+  vendorSha256 = "sha256-UVFi/QK2zwzhBkPXEJLYc5WSu3OOvWTVVGkMhrrufyc=";
 
   subPackages = [
     "cmd/soju"
diff --git a/pkgs/applications/science/math/wolfram-engine/default.nix b/pkgs/applications/science/math/wolfram-engine/default.nix
new file mode 100644
index 000000000000..df9e2f88dfca
--- /dev/null
+++ b/pkgs/applications/science/math/wolfram-engine/default.nix
@@ -0,0 +1,143 @@
+{ lib
+, stdenv
+, autoPatchelfHook
+, requireFile
+, callPackage
+, makeWrapper
+, alsa-lib
+, dbus
+, fontconfig
+, freetype
+, gcc
+, glib
+, installShellFiles
+, libssh2
+, ncurses
+, opencv4
+, openssl
+, unixODBC
+, xkeyboard_config
+, xorg
+, zlib
+, libxml2
+, libuuid
+, lang ? "en"
+, libGL
+, libGLU
+}:
+
+let
+  l10n = import ./l10ns.nix {
+    lib = lib;
+    inherit requireFile lang;
+  };
+  dirName = "WolframEngine";
+in
+stdenv.mkDerivation rec {
+  inherit (l10n) version name src;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    installShellFiles
+    makeWrapper
+  ];
+
+  buildInputs = [
+    alsa-lib
+    dbus
+    fontconfig
+    freetype
+    gcc.cc
+    gcc.libc
+    glib
+    libssh2
+    ncurses
+    opencv4
+    openssl
+    stdenv.cc.cc.lib
+    unixODBC
+    xkeyboard_config
+    libxml2
+    libuuid
+    zlib
+    libGL
+    libGLU
+  ] ++ (with xorg; [
+    libX11
+    libXext
+    libXtst
+    libXi
+    libXmu
+    libXrender
+    libxcb
+    libXcursor
+    libXfixes
+    libXrandr
+    libICE
+    libSM
+  ]);
+
+  # some bundled libs are found through LD_LIBRARY_PATH
+  autoPatchelfIgnoreMissingDeps = true;
+
+  ldpath = lib.makeLibraryPath buildInputs
+    + lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux")
+      (":" + lib.makeSearchPathOutput "lib" "lib64" buildInputs);
+
+  unpackPhase = ''
+    # find offset from file
+    offset=$(${stdenv.shell} -c "$(grep -axm1 -e 'offset=.*' $src); echo \$offset" $src)
+    dd if="$src" ibs=$offset skip=1 | tar -xf -
+    cd Unix
+  '';
+
+  installPhase = ''
+    cd Installer
+    sed -i -e 's/^PATH=/# PATH=/' -e 's/=`id -[ug]`/=0/' MathInstaller
+
+    # Installer wants to write default config in HOME
+    export HOME=$(mktemp -d)
+
+    # Fix the installation script
+    patchShebangs MathInstaller
+    substituteInPlace MathInstaller \
+      --replace "`hostname`" "" \
+      --replace "chgrp" "# chgrp" \
+      --replace "chown" ": # chown"
+
+    # Install the desktop items
+    export XDG_DATA_HOME="$out/share"
+
+    ./MathInstaller -auto -createdir=y -execdir=$out/bin -targetdir=$out/libexec/${dirName} -silent
+
+    # Fix library paths
+    cd $out/libexec/${dirName}/Executables
+    for path in MathKernel WolframKernel math mcc wolfram; do
+      makeWrapper $out/libexec/${dirName}/Executables/$path $out/bin/$path --set LD_LIBRARY_PATH "${zlib}/lib:${stdenv.cc.cc.lib}/lib:${libssh2}/lib:\''${LD_LIBRARY_PATH}"
+    done
+
+    # ... and xkeyboard config path for Qt
+    for path in WolframPlayer wolframplayer; do
+      makeWrapper $out/libexec/${dirName}/Executables/$path $out/bin/$path \
+        --set LD_LIBRARY_PATH "${zlib}/lib:${stdenv.cc.cc.lib}/lib:${libssh2}/lib:\''${LD_LIBRARY_PATH}" \
+        --set QT_XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb"
+    done
+
+    # Install man pages
+    installManPage $out/libexec/${dirName}/SystemFiles/SystemDocumentation/Unix/*
+  '';
+
+  # This is primarily an IO bound build; there's little benefit to building remotely.
+  preferLocalBuild = true;
+
+  # Stripping causes the program to core dump.
+  dontStrip = true;
+
+  meta = with lib; {
+    description = "Wolfram Engine computational software system";
+    homepage = "https://www.wolfram.com/engine/";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ fbeffa ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/applications/science/math/wolfram-engine/l10ns.nix b/pkgs/applications/science/math/wolfram-engine/l10ns.nix
new file mode 100644
index 000000000000..9bee8052c6e3
--- /dev/null
+++ b/pkgs/applications/science/math/wolfram-engine/l10ns.nix
@@ -0,0 +1,51 @@
+{ lib
+, requireFile
+, lang
+, majorVersion ? null
+}:
+
+let allVersions = with lib; flip map
+  # N.B. Versions in this list should be ordered from newest to oldest.
+  [
+    {
+      version = "13.0.1";
+      lang = "en";
+      language = "English";
+      sha256 = "1rrxi7d51m02407k719fq829jzanh550wr810i22n3irhk8axqga";
+      installer = "WolframEngine_13.0.1_LINUX.sh";
+    }
+    {
+      version = "13.0.0";
+      lang = "en";
+      language = "English";
+      sha256 = "10cpwllz9plxz22iqdh6xgkxqphl9s9nq8ax16pafjll6j9kqy1q";
+      installer = "WolframEngine_13.0.0_LINUX.sh";
+    }
+  ]
+  ({ version, lang, language, sha256, installer }: {
+    inherit version lang;
+    name = "wolfram-engine-${version}" + optionalString (lang != "en") "-${lang}";
+    src = requireFile {
+      name = installer;
+      message = ''
+        This nix expression requires that ${installer} is
+        already part of the store. Download the file from
+        https://www.wolfram.com/engine/ and add it to the nix store
+        with nix-store --add-fixed sha256 <FILE>.
+      '';
+      inherit sha256;
+    };
+  });
+minVersion =
+  with lib;
+  if majorVersion == null
+  then elemAt (builtins.splitVersion (elemAt allVersions 0).version) 0
+  else majorVersion;
+maxVersion = toString (1 + builtins.fromJSON minVersion);
+in
+with lib;
+findFirst (l: (l.lang == lang
+               && l.version >= minVersion
+               && l.version < maxVersion))
+          (throw "Version ${minVersion} in language ${lang} not supported")
+          allVersions
diff --git a/pkgs/applications/science/math/wolfram-engine/notebook.nix b/pkgs/applications/science/math/wolfram-engine/notebook.nix
new file mode 100644
index 000000000000..85570eeca7fb
--- /dev/null
+++ b/pkgs/applications/science/math/wolfram-engine/notebook.nix
@@ -0,0 +1,9 @@
+{ lib, stdenv, writeScriptBin, jupyter, wolfram-for-jupyter-kernel }:
+
+let
+  wolfram-jupyter = jupyter.override { definitions = { wolfram = wolfram-for-jupyter-kernel.definition; }; };
+in
+  writeScriptBin "wolfram-notebook" ''
+    #! ${stdenv.shell}
+    ${wolfram-jupyter}/bin/jupyter-notebook
+  ''
diff --git a/pkgs/applications/terminal-emulators/wezterm/default.nix b/pkgs/applications/terminal-emulators/wezterm/default.nix
index 6d1276035c13..17ee157a4406 100644
--- a/pkgs/applications/terminal-emulators/wezterm/default.nix
+++ b/pkgs/applications/terminal-emulators/wezterm/default.nix
@@ -27,7 +27,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wezterm";
-  version = "20220319-142410-0fcdea07";
+  version = "20220408-101518-b908e2dd";
 
   outputs = [ "out" "terminfo" ];
 
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    sha256 = "sha256-KmIlfzSbVY003WesodN5srJ7qEQaU93izmrZW1MobCo=";
+    sha256 = "sha256-kuuoD+hqgj7QXFRIxa112oc4idtcK0ptFACDpI0bzGY=";
   };
 
   postPatch = ''
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage rec {
     rm -r wezterm-ssh/tests
   '';
 
-  cargoSha256 = "sha256-+Iu6/pd14O1QIsLkHe7fTP30XyI+8J0GiRY8cnRPS5I=";
+  cargoSha256 = "sha256-iIb2zLUZpn23ooEiOP+yQMYUUmvef/KqvjzgLOFmjs0=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/desktops/gnome/extensions/update-extensions.py b/pkgs/desktops/gnome/extensions/update-extensions.py
index d1fdfc1f1a53..581781fb11a8 100755
--- a/pkgs/desktops/gnome/extensions/update-extensions.py
+++ b/pkgs/desktops/gnome/extensions/update-extensions.py
@@ -77,7 +77,9 @@ def generate_extension_versions(
     - Filter out versions that only support old GNOME versions
     - Download the extension and hash it
     """
-    extension_versions: Dict[ShellVersion, Dict[str, str]] = {}
+
+    # Determine extension version per shell version
+    extension_versions: Dict[ShellVersion, ExtensionVersion] = {}
     for shell_version, version_prefix in supported_versions.items():
         # Newest compatible extension version
         extension_version: Optional[int] = max(
@@ -91,11 +93,24 @@ def generate_extension_versions(
         # Extension is not compatible with this GNOME version
         if not extension_version:
             continue
+
+        extension_versions[shell_version] = extension_version
+
+    # Download information once for all extension versions chosen above
+    extension_info_cache: Dict[ExtensionVersion, Tuple[str, str]] = {}
+    for extension_version in sorted(set(extension_versions.values())):
         logging.debug(
-            f"[{shell_version}] Downloading '{uuid}' v{extension_version}"
+            f"[{uuid}] Downloading v{extension_version}"
         )
-        sha256, metadata = fetch_extension_data(uuid, str(extension_version))
-        extension_versions[shell_version] = {
+        extension_info_cache[extension_version] = \
+            fetch_extension_data(uuid, str(extension_version))
+
+    # Fill map
+    extension_versions_full: Dict[ShellVersion, Dict[str, str]] = {}
+    for shell_version, extension_version in extension_versions.items():
+        sha256, metadata = extension_info_cache[extension_version]
+
+        extension_versions_full[shell_version] = {
             "version": str(extension_version),
             "sha256": sha256,
             # The downloads are impure, their metadata.json may change at any time.
@@ -103,7 +118,7 @@ def generate_extension_versions(
             # Upstream issue: https://gitlab.gnome.org/Infrastructure/extensions-web/-/issues/137
             "metadata": metadata,
         }
-    return extension_versions
+    return extension_versions_full
 
 
 def pname_from_url(url: str) -> Tuple[str, str]:
diff --git a/pkgs/development/libraries/geos/3.9.nix b/pkgs/development/libraries/geos/3.9.nix
new file mode 100644
index 000000000000..fd0531fa747f
--- /dev/null
+++ b/pkgs/development/libraries/geos/3.9.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "geos";
+  version = "3.9.2";
+
+  src = fetchurl {
+    url = "https://download.osgeo.org/geos/${pname}-${version}.tar.bz2";
+    sha256 = "sha256-RKWpviHX1HNDa/Yhwt3MPPWou+PHhuEyKWGKO52GEpc=";
+  };
+
+  enableParallelBuilding = true;
+
+  # https://trac.osgeo.org/geos/ticket/993
+  configureFlags = lib.optional stdenv.isAarch32 "--disable-inline";
+
+  meta = with lib; {
+    description = "C++ port of the Java Topology Suite (JTS)";
+    homepage = "https://trac.osgeo.org/geos";
+    license = licenses.lgpl21Only;
+    maintainers = with lib.maintainers; [
+      willcohen
+    ];
+  };
+}
diff --git a/pkgs/development/libraries/geos/default.nix b/pkgs/development/libraries/geos/default.nix
index 355e9e5f07ff..c067a705d0bf 100644
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@@ -1,22 +1,31 @@
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "geos";
-  version = "3.9.1";
+  version = "3.10.2";
 
   src = fetchurl {
     url = "https://download.osgeo.org/geos/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-fmMFB9ysncB1ZdJJom8GoVyfWwxS3SkSmg49OB1+OCo=";
+    sha256 = "sha256-ULvFmaw4a0wrOWLcxBHwBAph8gSq7066ciXs3Qz0VxU=";
   };
 
-  enableParallelBuilding = true;
+  nativeBuildInputs = [ cmake ];
 
-  # https://trac.osgeo.org/geos/ticket/993
-  configureFlags = lib.optional stdenv.isAarch32 "--disable-inline";
+  postPatch = ''
+    substituteInPlace tools/geos-config.in \
+      --replace "@libdir@" "@prefix@/lib" \
+      --replace "@includedir@" "@prefix@/include"
+  '';
 
   meta = with lib; {
     description = "C++ port of the Java Topology Suite (JTS)";
     homepage = "https://trac.osgeo.org/geos";
     license = licenses.lgpl21Only;
+    maintainers = with lib.maintainers; [
+      willcohen
+    ];
   };
 }
diff --git a/pkgs/development/libraries/intel-media-driver/default.nix b/pkgs/development/libraries/intel-media-driver/default.nix
index 380f0c1f7e25..d97eac2a93db 100644
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-media-driver";
-  version = "22.2.2";
+  version = "22.3.0";
 
   outputs = [ "out" "dev" ];
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "media-driver";
     rev = "intel-media-${version}";
-    sha256 = "sha256-ksh8xx46x9OgXBrhJr3FnBI9g4PHXUDhLPbgpvccffM=";
+    sha256 = "sha256-TQmXU/Roij6U6NTt3oywhjpPJzaFeR4hhVor11mgaRE=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/jsoncpp/default.nix b/pkgs/development/libraries/jsoncpp/default.nix
index 9adf509f8aaa..77d49c700030 100644
--- a/pkgs/development/libraries/jsoncpp/default.nix
+++ b/pkgs/development/libraries/jsoncpp/default.nix
@@ -1,4 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python3, validatePkgConfig, fetchpatch }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, python3
+, validatePkgConfig
+, fetchpatch
+, secureMemory ? false
+, enableStatic ? stdenv.hostPlatform.isStatic
+}:
 
 stdenv.mkDerivation rec {
   pname = "jsoncpp";
@@ -30,6 +39,10 @@ stdenv.mkDerivation rec {
     export sourceRoot=${src.name}
   '';
 
+  postPatch = lib.optionalString secureMemory ''
+    sed -i 's/#define JSONCPP_USING_SECURE_MEMORY 0/#define JSONCPP_USING_SECURE_MEMORY 1/' include/json/version.h
+  '';
+
   # Hack to be able to run the test, broken because we use
   # CMAKE_SKIP_BUILD_RPATH to avoid cmake resetting rpath on install
   preBuild = if stdenv.isDarwin then ''
@@ -42,10 +55,21 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
-    "-DBUILD_STATIC_LIBS=OFF"
     "-DBUILD_OBJECT_LIBS=OFF"
     "-DJSONCPP_WITH_CMAKE_PACKAGE=ON"
-  ] ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "-DJSONCPP_WITH_TESTS=OFF";
+  ]
+    # the test's won't compile if secureMemory is used because there is no
+    # comparison operators and conversion functions between
+    # std::basic_string<..., Json::SecureAllocator<char>> vs.
+    # std::basic_string<..., [default allocator]>
+    ++ lib.optional ((stdenv.buildPlatform != stdenv.hostPlatform) || secureMemory) "-DJSONCPP_WITH_TESTS=OFF"
+    ++ lib.optional (!enableStatic) "-DBUILD_STATIC_LIBS=OFF";
+
+  # this is fixed and no longer necessary in 1.9.5 but there they use
+  # memset_s without switching to a different c++ standard in the cmake files
+  postInstall = lib.optionalString enableStatic ''
+    (cd $out/lib && ln -sf libjsoncpp_static.a libjsoncpp.a)
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/open-source-parsers/jsoncpp";
diff --git a/pkgs/development/libraries/pcmsolver/default.nix b/pkgs/development/libraries/pcmsolver/default.nix
index dd94a4a088cb..a957d517bf7a 100644
--- a/pkgs/development/libraries/pcmsolver/default.nix
+++ b/pkgs/development/libraries/pcmsolver/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, perl, gfortran, python2
+{ lib, stdenv, fetchFromGitHub, cmake, perl, gfortran, python3
 , boost, eigen, zlib
 } :
 
@@ -13,11 +13,18 @@ stdenv.mkDerivation rec {
     sha256= "0jrxr8z21hjy7ik999hna9rdqy221kbkl3qkb06xw7g80rc9x9yr";
   };
 
+  # Glibc 2.34 changed SIGSTKSZ to a dynamic value, which breaks
+  # PCMsolver. Replace SIGSTKZ by the backward-compatible _SC_SIGSTKSZ.
+  postPatch = ''
+    substituteInPlace external/Catch/catch.hpp \
+      --replace SIGSTKSZ _SC_SIGSTKSZ
+  '';
+
   nativeBuildInputs = [
     cmake
     gfortran
     perl
-    python2
+    python3
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/s2n-tls/default.nix b/pkgs/development/libraries/s2n-tls/default.nix
index c22ff6c37309..e6e35f9b2c42 100644
--- a/pkgs/development/libraries/s2n-tls/default.nix
+++ b/pkgs/development/libraries/s2n-tls/default.nix
@@ -25,6 +25,9 @@ stdenv.mkDerivation rec {
     "-DBUILD_SHARED_LIBS=ON"
     "-DCMAKE_SKIP_BUILD_RPATH=OFF"
     "-DUNSAFE_TREAT_WARNINGS_AS_ERRORS=OFF" # disable -Werror
+  ] ++ lib.optionals stdenv.hostPlatform.isMips64 [
+    # See https://github.com/aws/s2n-tls/issues/1592 and https://github.com/aws/s2n-tls/pull/1609
+    "-DS2N_NO_PQ=ON"
   ];
 
   propagatedBuildInputs = [ openssl ]; # s2n-config has find_dependency(LibCrypto).
diff --git a/pkgs/development/libraries/unixODBCDrivers/default.nix b/pkgs/development/libraries/unixODBCDrivers/default.nix
index 9b4173a6da13..40ce63965938 100644
--- a/pkgs/development/libraries/unixODBCDrivers/default.nix
+++ b/pkgs/development/libraries/unixODBCDrivers/default.nix
@@ -21,7 +21,7 @@
 
     meta = with lib; {
       description = "Official PostgreSQL ODBC Driver";
-      homepage =  "https://odbc.postgresql.org/";
+      homepage = "https://odbc.postgresql.org/";
       license = licenses.lgpl2;
       platforms = platforms.linux;
     };
@@ -62,7 +62,7 @@
 
     meta = with lib; {
       description = "MariaDB ODBC database driver";
-      homepage =  "https://downloads.mariadb.org/connector-odbc/";
+      homepage = "https://downloads.mariadb.org/connector-odbc/";
       license = licenses.gpl2;
       platforms = platforms.linux ++ platforms.darwin;
     };
@@ -89,7 +89,7 @@
     };
 
     meta = with lib; {
-      description = "MariaDB ODBC database driver";
+      description = "MySQL ODBC database driver";
       homepage = "https://dev.mysql.com/downloads/connector/odbc/";
       license = licenses.gpl2;
       platforms = platforms.linux;
@@ -174,4 +174,47 @@
       maintainers = with maintainers; [ spencerjanssen ];
     };
   };
+
+  redshift = stdenv.mkDerivation rec {
+    pname = "redshift-odbc";
+    version = "1.4.49.1000";
+
+    src = fetchurl {
+      url = "https://s3.amazonaws.com/redshift-downloads/drivers/odbc/${version}/AmazonRedshiftODBC-64-bit-${version}-1.x86_64.deb";
+      sha256 = "sha256-r5HvsZjB7+x+ClxtWoONkE1/NAbz90NbHfzxC6tf7jA=";
+    };
+
+    nativeBuildInputs = [ dpkg ];
+
+    unpackPhase = ''
+      dpkg -x $src src
+      cd src
+    '';
+
+    # `unixODBC` is loaded with `dlopen`, so `autoPatchElfHook` cannot see it, and `patchELF` phase would strip the manual patchelf. Thus:
+    # - Manually patchelf with `unixODCB` libraries
+    # - Disable automatic `patchELF` phase
+    installPhase = ''
+      mkdir -p $out/lib
+      cp opt/amazon/redshiftodbc/lib/64/* $out/lib
+      patchelf --set-rpath ${unixODBC}/lib/ $out/lib/libamazonredshiftodbc64.so
+    '';
+
+    dontPatchELF = true;
+
+    buildInputs = [ unixODBC ];
+
+    passthru = {
+      fancyName = "Amazon Redshift (x64)";
+      driver = "lib/libamazonredshiftodbc64.so";
+    };
+
+    meta = with lib; {
+      description = "Amazon Redshift ODBC driver";
+      homepage = "https://docs.aws.amazon.com/redshift/latest/mgmt/configure-odbc-connection.html";
+      license = licenses.unfree;
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ sir4ur0n ];
+    };
+  };
 }
diff --git a/pkgs/development/libraries/valhalla/default.nix b/pkgs/development/libraries/valhalla/default.nix
index b3d61e6efd72..dded351d3105 100644
--- a/pkgs/development/libraries/valhalla/default.nix
+++ b/pkgs/development/libraries/valhalla/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config
 , zlib, curl, protobuf, prime-server, boost, sqlite, libspatialite
-, luajit, geos, python3, zeromq }:
+, luajit, geos39, python3, zeromq }:
 
 stdenv.mkDerivation rec {
   pname = "valhalla";
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [
     zlib curl protobuf prime-server boost sqlite libspatialite
-    luajit geos python3 zeromq
+    luajit geos39 python3 zeromq
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/python-modules/editables/default.nix b/pkgs/development/python-modules/editables/default.nix
index ee902d772c99..e5deb02af52f 100644
--- a/pkgs/development/python-modules/editables/default.nix
+++ b/pkgs/development/python-modules/editables/default.nix
@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "editables";
-  version = "0.2";
+  version = "0.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6918f16225258f24ef9800c2327e14eded42ddac344e77982380749464024f35";
+    sha256 = "sha256-FnUk43c1jtHxN05hwmjw16S/fb0EbGVve0EM3hYWGxo=";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index 9ec0dda4bc51..216168b51131 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "env-canada";
-  version = "0.5.22";
+  version = "0.5.23";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -22,8 +22,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "michaeldavie";
     repo = "env_canada";
-    rev = "v${version}";
-    sha256 = "sha256-3dqG3wlFlGCI3Ymq5rpoNpmeU36WCQ4Iya5m5mCAVFI=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-ksQQ3jujfu2XR0ZaR5fc8GNYDL8Tos+8U4OHS1mMyRY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/pytibber/default.nix b/pkgs/development/python-modules/pytibber/default.nix
index e2c788f1b3eb..3b2d924695ac 100644
--- a/pkgs/development/python-modules/pytibber/default.nix
+++ b/pkgs/development/python-modules/pytibber/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pytibber";
-  version = "0.22.1";
+  version = "0.22.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pyTibber";
     rev = version;
-    hash = "sha256-kzKY9ixsAkfee5En0IzYl5izeXq3xY/8bc5Kz/qkE7U=";
+    hash = "sha256-tM8Uu/TpP5a7y+ePFko0bMoZJWG2efYA861Ez8dPeFY=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sphinxext-opengraph/default.nix b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
index 8b68eea25668..76e5079e9163 100644
--- a/pkgs/development/python-modules/sphinxext-opengraph/default.nix
+++ b/pkgs/development/python-modules/sphinxext-opengraph/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "sphinxext-opengraph";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "wpilibsuite";
     repo = "sphinxext-opengraph";
     rev = "v${version}";
-    sha256 = "sha256-3bZFFtGW6j/3m/3F4+tapZujzpMZnrIcYTngDCNGylI=";
+    sha256 = "sha256-YR6TlsmND5IhLdbPbmtVhRN2vSZfx70g2a6Yn6y6L/M=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/sumo/default.nix b/pkgs/development/python-modules/sumo/default.nix
index 68f298de1080..86ab922c1bfb 100644
--- a/pkgs/development/python-modules/sumo/default.nix
+++ b/pkgs/development/python-modules/sumo/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "sumo";
-  version = "2.2.5";
+  version = "2.3.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -25,8 +25,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "SMTG-UCL";
     repo = "sumo";
-    rev = "v${version}";
-    sha256 = "1vwqyv215yf51j1278cn7l8mpqmy1grm9j7z3hxjlz4w65cff324";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-apI5Qt7Wrr4FXKL48iqqIQJDX2BIf3PPz/qIgSO7nuo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/build-managers/bloop/default.nix b/pkgs/development/tools/build-managers/bloop/default.nix
index 11b25bec3816..ab8c5856a1aa 100644
--- a/pkgs/development/tools/build-managers/bloop/default.nix
+++ b/pkgs/development/tools/build-managers/bloop/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   bloop-coursier-channel = fetchurl {
     url = "https://github.com/scalacenter/bloop/releases/download/v${version}/bloop-coursier.json";
-    sha256 = "bf3uHuGfmJukf0Qeudv8ZXz/9Uql/qsmvPS0XBb7oTQ=";
+    sha256 = "VbvBAz7mXhgQtbrlB6uCSmZXLcdYaROJRSREbazAReo=";
   };
 
   bloop-bash = fetchurl {
@@ -60,8 +60,8 @@ stdenv.mkDerivation rec {
 
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash = if stdenv.isLinux && stdenv.isx86_64 then "sha256-jqcecAM51qEDmTim2VBNm8IO8wQmwU19R57Zk4pxwSA="
-    else if stdenv.isDarwin && stdenv.isx86_64 then "sha256-WJytRIbsygi4zoIVfkJmzWyFe2p8mQuT4DDO5KDKopY="
+    outputHash = if stdenv.isLinux && stdenv.isx86_64 then "sha256-AiF/ih15Jd0WuDP/0vU0vdaSo3FGjWXos+hNVBayFz4="
+    else if stdenv.isDarwin && stdenv.isx86_64 then "sha256-LD23YpcNhWfioGDMqb1plqLy87ZHzT0zvIyc4O4WP5g="
     else throw "unsupported platform";
   };
 
diff --git a/pkgs/development/tools/gopls/default.nix b/pkgs/development/tools/gopls/default.nix
index 8d533d359df5..4ff3ef5715a0 100644
--- a/pkgs/development/tools/gopls/default.nix
+++ b/pkgs/development/tools/gopls/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "gopls";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "tools";
     rev = "gopls/v${version}";
-    sha256 = "sha256-ypuZQt6iF1QRk/FsoTKnJlb5CWIEkvK7r37t4rSxhmU=";
+    sha256 = "sha256-BXalq73nXMDQg7+x/SJOAeiBK3yLVxH6pPPqPYWZ7KY=";
   };
 
   modRoot = "gopls";
-  vendorSha256 = "sha256-SY08322wuJl8F790oXGmYo82Yadi14kDpoVGCGVMF0c=";
+  vendorSha256 = "sha256-oH3w/17Vem+q2MahM1A5gmEniWLNhTXi0L7ozhza15o=";
 
   doCheck = false;
 
diff --git a/pkgs/development/tools/ktlint/default.nix b/pkgs/development/tools/ktlint/default.nix
index ad41cf6e4af7..0f75662d7076 100644
--- a/pkgs/development/tools/ktlint/default.nix
+++ b/pkgs/development/tools/ktlint/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ktlint";
-  version = "0.45.1";
+  version = "0.45.2";
 
   src = fetchurl {
     url = "https://github.com/pinterest/ktlint/releases/download/${version}/ktlint";
-    sha256 = "sha256-fEMLZ8lV1RNFlf5ApfJOG9jI8JumpgP673+XSOWgsKI=";
+    sha256 = "sha256-iUkeqGXTabOc+sotz2Czitvc10mF9eAXDAu3MDQAATU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/tools/quick-lint-js/default.nix b/pkgs/development/tools/quick-lint-js/default.nix
index 82a31ea52b10..b420d62daab5 100644
--- a/pkgs/development/tools/quick-lint-js/default.nix
+++ b/pkgs/development/tools/quick-lint-js/default.nix
@@ -1,19 +1,24 @@
-{ cmake, fetchFromGitHub, lib, ninja, stdenv }:
+{ cmake, fetchFromGitHub, lib, ninja, stdenv, testVersion, quick-lint-js }:
+
 
 stdenv.mkDerivation rec {
   pname = "quick-lint-js";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "quick-lint";
     repo = "quick-lint-js";
     rev = version;
-    sha256 = "1ay59pmprcswip6zzbqfy5g2rdv4lgmps8vrxay4l9w6xn9lg03v";
+    sha256 = "sha256-3DiK7c+RuCIy9B2j6ozSaVIRf63o9S8uH27SZZJHjes=";
   };
 
   nativeBuildInputs = [ cmake ninja ];
   doCheck = true;
 
+  passthru.tests = {
+    version = testVersion { package = quick-lint-js; };
+  };
+
   meta = with lib; {
     description = "Find bugs in Javascript programs";
     homepage = "https://quick-lint-js.com";
diff --git a/pkgs/os-specific/linux/kernel/linux-zen.nix b/pkgs/os-specific/linux/kernel/linux-zen.nix
index 0e6cc394a549..0d9d34588a9e 100644
--- a/pkgs/os-specific/linux/kernel/linux-zen.nix
+++ b/pkgs/os-specific/linux/kernel/linux-zen.nix
@@ -2,7 +2,7 @@
 
 let
   # having the full version string here makes it easier to update
-  modDirVersion = "5.17.0-zen1";
+  modDirVersion = "5.17.2-zen3";
   parts = lib.splitString "-" modDirVersion;
   version = lib.elemAt parts 0;
   suffix = lib.elemAt parts 1;
@@ -20,7 +20,7 @@ buildLinux (args // {
     owner = "zen-kernel";
     repo = "zen-kernel";
     inherit rev;
-    sha256 = "sha256-8DCcO2oPnwXjjm3PW7vNZKbB3S7XsEB/svAMhbPRJIo=";
+    sha256 = "sha256-q6Cc3wQHDXzyt2hx3+CS8N74myC6ra/Y+8IHQxTkoLo=";
   };
 
   structuredExtraConfig = with lib.kernel; {
diff --git a/pkgs/servers/monitoring/prometheus/process-exporter.nix b/pkgs/servers/monitoring/prometheus/process-exporter.nix
index e4bfed9821b7..135551db5660 100644
--- a/pkgs/servers/monitoring/prometheus/process-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/process-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "process-exporter";
-  version = "0.7.5";
+  version = "0.7.10";
 
   src = fetchFromGitHub {
     owner = "ncabatoff";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0v1q8mi8p01smzfxaf52kbqnjz9fx4rp64jqhgbcx0s45q3bph9l";
+    sha256 = "sha256-TAgMA9IV3i8dpgOBDmnlt4iyGlmWN5Nj3BexXb5vzlc=";
   };
 
-  vendorSha256 = "19y2w1vplf7qqkzcpi01ssawv9badhwpglh2gz69fgl6xc3mxfmp";
+  vendorSha256 = "sha256-LAEnXJ3qShfCGjtsYAGyW5x/TTFQxQxXM0hebJrqiW4=";
 
   postPatch = ''
     substituteInPlace proc/read_test.go --replace /bin/cat cat
diff --git a/pkgs/tools/games/joystickwake/default.nix b/pkgs/tools/games/joystickwake/default.nix
index f8f962f6eef7..cd18b8b09df5 100644
--- a/pkgs/tools/games/joystickwake/default.nix
+++ b/pkgs/tools/games/joystickwake/default.nix
@@ -12,6 +12,11 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [ pyudev xlib ];
 
+  postInstall = ''
+    # autostart file
+    ln -s $out/${python3.sitePackages}/etc $out/etc
+  '';
+
   meta = with lib; {
     description = "A joystick-aware screen waker";
     longDescription = ''
diff --git a/pkgs/tools/misc/nix-direnv/default.nix b/pkgs/tools/misc/nix-direnv/default.nix
index 731278cafe0e..7323a5fdf17d 100644
--- a/pkgs/tools/misc/nix-direnv/default.nix
+++ b/pkgs/tools/misc/nix-direnv/default.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nix-direnv";
-  version = "1.6.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nix-direnv";
     rev = version;
-    sha256 = "sha256-WgNfo9GRqIrXsIgNRhoNPU2/uwyPd8xG8xEEImEy4KY=";
+    sha256 = "sha256-0gBb/U7tNNSjazJE/Z2qAxHPX53wRSPMJ8rHc7HtCNg=";
   };
 
   # Substitute instead of wrapping because the resulting file is
diff --git a/pkgs/tools/misc/powerline-go/default.nix b/pkgs/tools/misc/powerline-go/default.nix
index 85d9ed59ff43..3eb29c874418 100644
--- a/pkgs/tools/misc/powerline-go/default.nix
+++ b/pkgs/tools/misc/powerline-go/default.nix
@@ -16,8 +16,6 @@ buildGoModule rec {
 
   vendorSha256 = "sha256-HYF6aKz+P241EKmupEoretadlrh9FBRx6nIER66jofg=";
 
-  doCheck = false;
-
   meta = with lib; {
     description = "A Powerline like prompt for Bash, ZSH and Fish";
     homepage = "https://github.com/justjanne/powerline-go";
diff --git a/pkgs/tools/networking/checkip/default.nix b/pkgs/tools/networking/checkip/default.nix
index fb30ad59dff3..7959bdaa83ea 100644
--- a/pkgs/tools/networking/checkip/default.nix
+++ b/pkgs/tools/networking/checkip/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "checkip";
-  version = "0.19.0";
+  version = "0.24.5";
 
   src = fetchFromGitHub {
     owner = "jreisinger";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-h8YZGTjEEQb68TrwMDnAqCJWkNPSuWSAJKcOMLXwXio=";
+    sha256 = "sha256-/sTagdlWU6hU3TTeJcZ8WK4TqmvxgUbC5eLBz2FH6Jo=";
   };
 
   vendorSha256 = "sha256-NHu1hZFPT2k8izrvvz7w0vlVe/nKH0nS4oXUGS8CWcc=";
diff --git a/pkgs/tools/networking/dnsproxy/default.nix b/pkgs/tools/networking/dnsproxy/default.nix
index 2800496aae9a..c9044cb92ac4 100644
--- a/pkgs/tools/networking/dnsproxy/default.nix
+++ b/pkgs/tools/networking/dnsproxy/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnsproxy";
-  version = "0.42.0";
+  version = "0.42.1";
 
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-UXFDFS2TFzo7DcExazt4h0TTnGeMf6d3FAiPXZWB7Ys=";
+    sha256 = "sha256-m4Xc5ZorsO6WcbHmJGROJ8SsPCm/KmFapQRQZTZIQKw=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/security/feroxbuster/default.nix b/pkgs/tools/security/feroxbuster/default.nix
index 8c006020f644..bc1df5eb5692 100644
--- a/pkgs/tools/security/feroxbuster/default.nix
+++ b/pkgs/tools/security/feroxbuster/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "feroxbuster";
-  version = "2.6.2";
+  version = "2.6.4";
 
   src = fetchFromGitHub {
     owner = "epi052";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-SRVCtyl0+GRQ6MUHDY3gi7eg0l42d74c+Ct7G70MJfw=";
+    hash = "sha256-aTyjZc+bsA4rvbcFTLArK+zbfF6thHEYyPbMx9vLcMo=";
   };
 
-  cargoSha256 = "sha256-5SCJqVA5CEyILc5Ojr5ZsFiK8y6qfgggXyp9e8i5pdo=";
+  cargoSha256 = "sha256-PLrIMgn0o+fFB6Zv9sf7X4gZyHwVSd6BOM1/KUo3TAg=";
 
   OPENSSL_NO_VENDOR = true;
 
diff --git a/pkgs/tools/system/fio/default.nix b/pkgs/tools/system/fio/default.nix
index 859fbe72d631..42ece88147ba 100644
--- a/pkgs/tools/system/fio/default.nix
+++ b/pkgs/tools/system/fio/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fio";
-  version = "3.29";
+  version = "3.30";
 
   src = fetchFromGitHub {
     owner  = "axboe";
     repo   = "fio";
     rev    = "fio-${version}";
-    sha256 = "sha256-SSQFZK8oVarenp/I37QX/N4F4Es2r2bVyWw6U2OcCHw=";
+    sha256 = "sha256-X2B8xlCLSHDgTaH55TUJq4WcaObZy/fvfkQ0j3J9Kzo=";
   };
 
   buildInputs = [ python3 zlib ]
diff --git a/pkgs/tools/text/difftastic/default.nix b/pkgs/tools/text/difftastic/default.nix
index 1bc18749c652..12ad1a764fb2 100644
--- a/pkgs/tools/text/difftastic/default.nix
+++ b/pkgs/tools/text/difftastic/default.nix
@@ -1,17 +1,19 @@
-{ lib, fetchFromGitHub, rustPlatform, tree-sitter }:
+{ lib, fetchFromGitHub, rustPlatform, tree-sitter, difftastic, testVersion }:
 
 rustPlatform.buildRustPackage rec {
   pname = "difftastic";
-  version = "0.26.0";
+  version = "0.26.3";
 
   src = fetchFromGitHub {
     owner = "wilfred";
     repo = pname;
     rev = version;
-    sha256 = "sha256-bluiRWueb9+UG+8jCwm+Xc483dSvoxwu+HP02I0DZBs=";
+    sha256 = "11qvl78dskhawmzjbff2cd4icwvlfhg8hzf1law5w5cr768zv7yn";
   };
 
-  cargoSha256 = "sha256-nVYPvYt3Sr1VxoXiaFhpiAh+vngklsr6vn1jfBUg4C4=";
+  cargoSha256 = "1kmwd9m94kl3j6ajfndr7rjx66fsqvnn2jh0m54ac5qd5r9hhdc8";
+
+  passthru.tests.version = testVersion { package = difftastic; };
 
   meta = with lib; {
     description = "A syntax-aware diff";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4b1c304c5d11..40279eee91cc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16890,6 +16890,8 @@ with pkgs;
 
   geos = callPackage ../development/libraries/geos { };
 
+  geos39 = callPackage ../development/libraries/geos/3.9.nix { };
+
   getdata = callPackage ../development/libraries/getdata { };
 
   inherit (callPackages ../development/libraries/getdns { })
@@ -26509,7 +26511,7 @@ with pkgs;
 
   haunt = callPackage ../applications/misc/haunt { };
 
-  hugo = callPackage ../applications/misc/hugo { };
+  hugo = callPackage ../applications/misc/hugo { buildGoModule = buildGo118Module; };
 
   go-org = callPackage ../applications/misc/go-org { };
 
@@ -29662,6 +29664,8 @@ with pkgs;
 
   unigine-heaven = callPackage ../applications/graphics/unigine-heaven { };
 
+  unigine-tropics = pkgsi686Linux.callPackage ../applications/graphics/unigine-tropics { };
+
   unigine-superposition = libsForQt5.callPackage ../applications/graphics/unigine-superposition { };
 
   unipicker = callPackage ../applications/misc/unipicker { };
@@ -32509,6 +32513,12 @@ with pkgs;
 
   trilinos-mpi = callPackage ../development/libraries/science/math/trilinos { withMPI = true; };
 
+  wolfram-engine = callPackage ../applications/science/math/wolfram-engine { };
+
+  wolfram-for-jupyter-kernel = callPackage ../applications/editors/jupyter-kernels/wolfram { };
+
+  wolfram-notebook = callPackage ../applications/science/math/wolfram-engine/notebook.nix { };
+
   ipopt = callPackage ../development/libraries/science/math/ipopt { };
 
   gmsh = callPackage ../applications/science/math/gmsh { };