diff --git a/lib/default.nix b/lib/default.nix
index ec7f536bbdde..e919509e724a 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -94,7 +94,8 @@ let
       concatImapStringsSep makeSearchPath makeSearchPathOutput
       makeLibraryPath makeBinPath optionalString
       hasInfix hasPrefix hasSuffix stringToCharacters stringAsChars escape
-      escapeShellArg escapeShellArgs escapeRegex escapeXML replaceChars lowerChars
+      escapeShellArg escapeShellArgs isValidPosixName toShellVar toShellVars
+      escapeRegex escapeXML replaceChars lowerChars
       upperChars toLower toUpper addContextFrom splitString
       removePrefix removeSuffix versionOlder versionAtLeast
       getName getVersion
diff --git a/lib/strings.nix b/lib/strings.nix
index 11066890ec3d..d3ef748fb71e 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -17,6 +17,7 @@ rec {
     head
     isInt
     isList
+    isAttrs
     isString
     match
     parseDrvName
@@ -324,6 +325,65 @@ rec {
   */
   escapeShellArgs = concatMapStringsSep " " escapeShellArg;
 
+  /* Test whether the given name is a valid POSIX shell variable name.
+
+     Type: string -> bool
+
+     Example:
+       isValidPosixName "foo_bar000"
+       => true
+       isValidPosixName "0-bad.jpg"
+       => false
+  */
+  isValidPosixName = name: match "[a-zA-Z_][a-zA-Z0-9_]*" name != null;
+
+  /* Translate a Nix value into a shell variable declaration, with proper escaping.
+
+     Supported value types are strings (mapped to regular variables), lists of strings
+     (mapped to Bash-style arrays) and attribute sets of strings (mapped to Bash-style
+     associative arrays). Note that "strings" include string-coercible values like paths.
+
+     Strings are translated into POSIX sh-compatible code; lists and attribute sets
+     assume a shell that understands Bash syntax (e.g. Bash or ZSH).
+
+     Type: string -> (string | listOf string | attrsOf string) -> string
+
+     Example:
+       ''
+         ${toShellVar "foo" "some string"}
+         [[ "$foo" == "some string" ]]
+       ''
+  */
+  toShellVar = name: value:
+    lib.throwIfNot (isValidPosixName name) "toShellVar: ${name} is not a valid shell variable name" (
+    if isAttrs value then
+      "declare -A ${name}=(${
+        concatStringsSep " " (lib.mapAttrsToList (n: v:
+          "[${escapeShellArg n}]=${escapeShellArg v}"
+        ) value)
+      })"
+    else if isList value then
+      "declare -a ${name}=(${escapeShellArgs value})"
+    else
+      "${name}=${escapeShellArg value}"
+    );
+
+  /* Translate an attribute set into corresponding shell variable declarations
+     using `toShellVar`.
+
+     Type: attrsOf (string | listOf string | attrsOf string) -> string
+
+     Example:
+       let
+         foo = "value";
+         bar = foo;
+       in ''
+         ${toShellVars { inherit foo bar; }}
+         [[ "$foo" == "$bar" ]]
+       ''
+  */
+  toShellVars = vars: concatStringsSep "\n" (lib.mapAttrsToList toShellVar vars);
+
   /* Turn a string into a Nix expression representing that string
 
      Type: string -> string
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index fcccf89cc888..c5d1d431677a 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -251,6 +251,26 @@ runTests {
     expected = ""test" 'test' < & >";
   };
 
+  testToShellVars = {
+    expr = ''
+      ${toShellVars {
+        STRing01 = "just a 'string'";
+        _array_ = [ "with" "more strings" ];
+        assoc."with some" = ''
+          strings
+          possibly newlines
+        '';
+      }}
+    '';
+    expected = ''
+      STRing01='just a '\'''string'\''''
+      declare -a _array_=('with' 'more strings')
+      declare -A assoc=(['with some']='strings
+      possibly newlines
+      ')
+    '';
+  };
+
 # LISTS
 
   testFilter = {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 0aa94408de94..ba584c0eb7fa 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -13563,6 +13563,13 @@
     github = "wunderbrick";
     githubId = 52174714;
   };
+  wyndon = {
+    email = "72203260+wyndon@users.noreply.github.com";
+    matrix = "@wyndon:envs.net";
+    github = "wyndon";
+    githubId = 72203260;
+    name = "wyndon";
+  };
   wyvie = {
     email = "elijahrum@gmail.com";
     github = "wyvie";
diff --git a/pkgs/applications/editors/okteta/default.nix b/pkgs/applications/editors/okteta/default.nix
index c775a493f167..aee98d9a612d 100644
--- a/pkgs/applications/editors/okteta/default.nix
+++ b/pkgs/applications/editors/okteta/default.nix
@@ -26,6 +26,8 @@ mkDerivation rec {
     kcrash
   ];
 
+  outputs = [ "out" "dev" ];
+
   meta = with lib; {
     license = licenses.gpl2;
     description = "A hex editor";
diff --git a/pkgs/applications/kde/yakuake.nix b/pkgs/applications/kde/yakuake.nix
index 10bf27038ae9..7c98275b9173 100644
--- a/pkgs/applications/kde/yakuake.nix
+++ b/pkgs/applications/kde/yakuake.nix
@@ -23,6 +23,8 @@ mkDerivation {
     extra-cmake-modules kdoctools
   ];
 
+  outputs = [ "out" "dev" ];
+
   meta = {
     homepage = "https://yakuake.kde.org";
     description = "Quad-style terminal emulator for KDE";
diff --git a/pkgs/applications/misc/nnn/default.nix b/pkgs/applications/misc/nnn/default.nix
index 8ea024320c3e..87c43628c4f0 100644
--- a/pkgs/applications/misc/nnn/default.nix
+++ b/pkgs/applications/misc/nnn/default.nix
@@ -20,13 +20,13 @@ assert withNerdIcons -> withIcons == false;
 
 stdenv.mkDerivation rec {
   pname = "nnn";
-  version = "4.4";
+  version = "4.5";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-g9GaCc/IWKtih0/A2AZEPImjj7ymJIdYwC5I/6GUh5c=";
+    sha256 = "sha256-uToAgWpGaTPTMYJh1D0xgvE23GSIshv1OBlWxXI07Mk=";
   };
 
   configFile = lib.optionalString (conf != null) (builtins.toFile "nnn.h" conf);
diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index 13ee6f5f85cd..24e5264aeb4b 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -32,9 +32,9 @@
     }
   },
   "dev": {
-    "version": "102.0.5005.12",
-    "sha256": "11n03hz3g8h7srywxrjwrdrxybdjvmdjrnigjlrwjkydprg1l7ab",
-    "sha256bin64": "0hc56a98ikkbgdw36dpz9k6r15jmjmnm7faml8z59vixxlvkrw7y",
+    "version": "102.0.5005.22",
+    "sha256": "12s4w8qs71a7r13mm28w6kld2q21srwalsy2yfcys4kjmfp4gqfa",
+    "sha256bin64": "07jj7nvgalzvxacx6srccc82ggckzj4x10w1k2zskcyxpblnd7fc",
     "deps": {
       "gn": {
         "version": "2022-04-14",
diff --git a/pkgs/applications/networking/cluster/fluxcd/default.nix b/pkgs/applications/networking/cluster/fluxcd/default.nix
index 586272b18461..37afb77f43bc 100644
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.29.3";
-  sha256 = "02qdczd8x6dl6gsyjyrmga9i67shm54xixckxvva1lhl33zz5wwm";
-  manifestsSha256 = "0ar73dwz5j19qwcp85cd87gx0kwm7ys4xcyk91gj88s5i3djd9sl";
+  version = "0.29.4";
+  sha256 = "110wbz5dyzrzndr937in663cs9hwfs3glgm63f0md9gjj67mz0kk";
+  manifestsSha256 = "14vrkadv2gsz360s0naqr002sw8n5kvgskc13yx936mcz2vs465y";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-VWTtHquq/8/nKBGLuIdg2xkpGz1ofhPlQf3NTaQaHBI=";
+  vendorSha256 = "sha256-/8gRyaXTCWe+F4X3z5iT8QhE3LdiNEYKHjtoYKJB/HU=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests
diff --git a/pkgs/applications/science/misc/colmap/default.nix b/pkgs/applications/science/misc/colmap/default.nix
index c41c8593a5c4..8dc8f749897e 100644
--- a/pkgs/applications/science/misc/colmap/default.nix
+++ b/pkgs/applications/science/misc/colmap/default.nix
@@ -1,10 +1,14 @@
 { mkDerivation, lib, fetchFromGitHub, cmake, boost17x, ceres-solver, eigen,
   freeimage, glog, libGLU, glew, qtbase,
-  cudaSupport ? false, cudatoolkit ? null }:
+  cudaSupport ? false, cudaPackages }:
 
-assert !cudaSupport || cudatoolkit != null;
+assert cudaSupport -> cudaPackages != { };
 
-let boost_static = boost17x.override { enableStatic = true; };
+let
+  boost_static = boost17x.override { enableStatic = true; };
+
+  # TODO: migrate to redist packages
+  inherit (cudaPackages) cudatoolkit;
 in
 mkDerivation rec {
   version = "3.7";
@@ -13,15 +17,27 @@ mkDerivation rec {
      owner = "colmap";
      repo = "colmap";
      rev = version;
-     sha256 = "sha256-uVAw6qwhpgIpHkXgxttKupU9zU+vD0Za0maw2Iv4x+I=";
+     hash = "sha256-uVAw6qwhpgIpHkXgxttKupU9zU+vD0Za0maw2Iv4x+I=";
   };
 
+  # TODO: rm once the gcc11 issue is closed, https://github.com/colmap/colmap/issues/1418#issuecomment-1049305256
+  cmakeFlags = lib.optionals cudaSupport [
+    "-DCUDA_ENABLED=ON"
+    "-DCUDA_NVCC_FLAGS=--std=c++14"
+  ];
+
   buildInputs = [
     boost_static ceres-solver eigen
     freeimage glog libGLU glew qtbase
-  ] ++ lib.optional cudaSupport cudatoolkit;
+  ] ++ lib.optionals cudaSupport [
+    cudatoolkit
+  ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+  ] ++ lib.optionals cudaSupport [
+    cudaPackages.autoAddOpenGLRunpathHook
+  ];
 
   meta = with lib; {
     description = "COLMAP - Structure-From-Motion and Multi-View Stereo pipeline";
diff --git a/pkgs/development/libraries/science/math/scalapack/default.nix b/pkgs/development/libraries/science/math/scalapack/default.nix
index bafb52be7ffb..7620844f8d1c 100644
--- a/pkgs/development/libraries/science/math/scalapack/default.nix
+++ b/pkgs/development/libraries/science/math/scalapack/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, openssh
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, openssh
 , mpi, blas, lapack
 } :
 
@@ -17,6 +17,13 @@ stdenv.mkDerivation rec {
 
   passthru = { inherit (blas) isILP64; };
 
+  # upstream patch, remove with next release
+  patches = [ (fetchpatch {
+    name = "gcc-10";
+    url = "https://github.com/Reference-ScaLAPACK/scalapack/commit/a0f76fc0c1c16646875b454b7d6f8d9d17726b5a.patch";
+    sha256 = "0civn149ikghakic30bynqg1bal097hr7i12cm4kq3ssrhq073bp";
+  })];
+
   # Required to activate ILP64.
   # See https://github.com/Reference-ScaLAPACK/scalapack/pull/19
   postPatch = lib.optionalString passthru.isILP64 ''
diff --git a/pkgs/development/python-modules/bsblan/default.nix b/pkgs/development/python-modules/bsblan/default.nix
index ed13a3a3a7ba..e371079b3605 100644
--- a/pkgs/development/python-modules/bsblan/default.nix
+++ b/pkgs/development/python-modules/bsblan/default.nix
@@ -1,19 +1,16 @@
 { lib
+, aiohttp
+, aresponses
 , buildPythonPackage
 , fetchFromGitHub
-, pytestCheckHook
-, aresponses
-, coverage
 , mypy
+, packaging
 , poetry-core
 , pydantic
 , pytest-asyncio
-, pytest-cov
 , pytest-mock
+, pytestCheckHook
 , pythonOlder
-, aiohttp
-, attrs
-, cattrs
 , yarl
 }:
 
@@ -22,13 +19,13 @@ buildPythonPackage rec {
   version = "0.5.5";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "liudger";
     repo = "python-bsblan";
     rev = "v${version}";
-    sha256 = "sha256-kq4cML7D9XC/QRPjGfaWcs0H78OOc2IXGua7qJpWYOQ=";
+    hash = "sha256-kq4cML7D9XC/QRPjGfaWcs0H78OOc2IXGua7qJpWYOQ=";
   };
 
   nativeBuildInputs = [
@@ -37,22 +34,26 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     aiohttp
-    attrs
-    cattrs
+    packaging
     pydantic
     yarl
   ];
 
   checkInputs = [
     aresponses
-    coverage
     mypy
     pytest-asyncio
-    pytest-cov
     pytest-mock
     pytestCheckHook
   ];
 
+  postPatch = ''
+    # Upstream doesn't set a version for the pyproject.toml
+    substituteInPlace pyproject.toml \
+      --replace 'version = "0.0.0"' 'version = "${version}"' \
+      --replace "--cov" ""
+  '';
+
   pythonImportsCheck = [
     "bsblan"
   ];
diff --git a/pkgs/development/python-modules/casbin/default.nix b/pkgs/development/python-modules/casbin/default.nix
index 433b7644e7a8..20602139d156 100644
--- a/pkgs/development/python-modules/casbin/default.nix
+++ b/pkgs/development/python-modules/casbin/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "casbin";
-  version = "1.15.5";
+  version = "1.16.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "pycasbin";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-7q9zTuqdIUAiipA5kh8CwQa/TeiXGsKuGGvYYwTjObw=";
+    sha256 = "sha256-fPojcHuz2d3Im2Ri6iCu79KLuRNucIG/IwWrUo0uYH8=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/http-message-signatures/default.nix b/pkgs/development/python-modules/http-message-signatures/default.nix
new file mode 100644
index 000000000000..fb67dd34c7b5
--- /dev/null
+++ b/pkgs/development/python-modules/http-message-signatures/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, buildPythonPackage
+, cryptography
+, fetchFromGitHub
+, http-sfv
+, pytestCheckHook
+, pythonOlder
+, setuptools-scm
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "http-message-signatures";
+  version = "0.4.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "pyauth";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-CMF9p913P04Hx/221ck1e0AoAsP7aXkX2UKp4S1nnU0=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    cryptography
+    http-sfv
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+    requests
+  ];
+
+  pytestFlagsArray = [
+    "test/test.py"
+  ];
+
+  pythonImportsCheck = [
+    "http_message_signatures"
+  ];
+
+  meta = with lib; {
+    description = "Requests authentication module for HTTP Signature";
+    homepage = "https://github.com/pyauth/http-message-signatures";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/http-sfv/default.nix b/pkgs/development/python-modules/http-sfv/default.nix
new file mode 100644
index 000000000000..264065b6efa1
--- /dev/null
+++ b/pkgs/development/python-modules/http-sfv/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "http-sfv";
+  version = "0.9.5";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "mnot";
+    repo = "http_sfv";
+    rev = "http_sfv-${version}";
+    hash = "sha256-hzg5vRX0vNKS/hYLF6n8mLK5qiwP7do4M8YMlBAA66I=";
+  };
+
+  propagatedBuildInputs = [
+    typing-extensions
+  ];
+
+  # Tests require external data (https://github.com/httpwg/structured-field-tests)
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "http_sfv"
+  ];
+
+  meta = with lib; {
+    description = "Module to parse and serialise HTTP structured field values";
+    homepage = "https://github.com/mnot/http_sfv";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pyezviz/default.nix b/pkgs/development/python-modules/pyezviz/default.nix
index 6499b91dda64..1d01f491676e 100644
--- a/pkgs/development/python-modules/pyezviz/default.nix
+++ b/pkgs/development/python-modules/pyezviz/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyezviz";
-  version = "0.2.0.7";
+  version = "0.2.0.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "baqs";
     repo = "pyEzviz";
     rev = version;
-    sha256 = "sha256-cQsjEH+e2/rNXmCnhNRv2Vg5i/ax0x88w1pit2eVO2c=";
+    sha256 = "sha256-W2JtqRyNVUo74esmCvCQygIMB1+v77OW/ll48IMVj/Y=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/requests-http-signature/default.nix b/pkgs/development/python-modules/requests-http-signature/default.nix
index c51e24e0ac9d..96ade3b45f6d 100644
--- a/pkgs/development/python-modules/requests-http-signature/default.nix
+++ b/pkgs/development/python-modules/requests-http-signature/default.nix
@@ -1,25 +1,37 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, cryptography
+, http-message-signatures
+, http-sfv
 , requests
 , pytestCheckHook
+, pythonOlder
+, setuptools-scm
 }:
 
 buildPythonPackage rec {
   pname = "requests-http-signature";
-  version = "0.2.0";
+  version = "0.7.1";
   format = "setuptools";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "pyauth";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-B45P/loXcRKOChSDeHOnlz+67mtmTeAMYlo21TOmV8s=";
+    hash = "sha256-sW2vYqT/nY27DvEKHdptc3dUpuqKmD7PLMs+Xp+cpeU=";
   };
 
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
   propagatedBuildInputs = [
-    cryptography
+    http-message-signatures
+    http-sfv
     requests
   ];
 
diff --git a/pkgs/development/python-modules/srvlookup/default.nix b/pkgs/development/python-modules/srvlookup/default.nix
index f325d40ba92d..11f31c06550f 100644
--- a/pkgs/development/python-modules/srvlookup/default.nix
+++ b/pkgs/development/python-modules/srvlookup/default.nix
@@ -1,24 +1,41 @@
-{ lib, fetchPypi, buildPythonPackage
+{ lib
+, buildPythonPackage
 , dnspython
-, mock, nose
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "srvlookup";
-  version = "2.0.0";
+  version = "3.0.0";
+  format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1zf1v04zd5phabyqh0nhplr5a8vxskzfrzdh4akljnz1yk2n2a0b";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "gmr";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-iXbi25HsoNX0hnhwZoFik5ddlJ7i+xml3HGaezj3jgY=";
   };
 
-  propagatedBuildInputs = [ dnspython ];
-  checkInputs = [ mock nose ];
+  propagatedBuildInputs = [
+    dnspython
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "srvlookup"
+  ];
 
   meta = with lib; {
+    description = "Wrapper for dnspython to return SRV records for a given host, protocol, and domain name";
     homepage = "https://github.com/gmr/srvlookup";
-    license = [ licenses.bsd3 ];
-    description = "A small wrapper for dnspython to return SRV records for a given host, protocol, and domain name as a list of namedtuples.";
-    maintainers = [ maintainers.mmlb ];
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ mmlb ];
   };
 }
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 108db9391c5a..b97ed2b67672 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -32,13 +32,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.1085";
+  version = "2.0.1088";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    hash = "sha256-GJVKngSpYmMtcxiWL8JDtEOlJlQ19LbKZF9zcAMG9vA=";
+    hash = "sha256-g4kn8tdLgTnOFmeX8nywBvmAXL7WqCfX6ylgp7Z6Alk=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/ginkgo/default.nix b/pkgs/development/tools/ginkgo/default.nix
index 9985d43da2f7..d06a63d12f0b 100644
--- a/pkgs/development/tools/ginkgo/default.nix
+++ b/pkgs/development/tools/ginkgo/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "ginkgo";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "onsi";
     repo = "ginkgo";
     rev = "v${version}";
-    sha256 = "sha256-q+m1NDl9zd6ueyBTzbzlvHIQyoIul5dAfUQ6UK4wlrc=";
+    sha256 = "sha256-5MVOJingEJojJA79nHJDWwso3eunjox/d+JzX11X46Q=";
   };
-  vendorSha256 = "sha256-kMQ60HdsorZU27qoOY52DpwFwP+Br2bp8mRx+ZwnQlI=";
+  vendorSha256 = "sha256-RFI87HCw+/4J8YKLZ7Kt7D2PNmwr1qXEiHCCLlBHtPA=";
 
   # integration tests expect more file changes
   # types tests are missing CodeLocation
diff --git a/pkgs/development/tools/snazy/default.nix b/pkgs/development/tools/snazy/default.nix
new file mode 100644
index 000000000000..c284c18d015d
--- /dev/null
+++ b/pkgs/development/tools/snazy/default.nix
@@ -0,0 +1,34 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "snazy";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "chmouel";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-Pv+vLdbMTbDbdUVQhA07WY+o1PwtCiqdAXCj+UlP/ZQ=";
+  };
+  cargoSha256 = "sha256-96xgpkkWHsyb3kxEXM5f5jFSjbO+VEmX2uHltGJUPGk=";
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/snazy --help
+    $out/bin/snazy --version | grep "snazy ${version}"
+    runHook postInstallCheck
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/chmouel/snazy/";
+    changelog = "https://github.com/chmouel/snazy/releases/tag/v${version}";
+    description = "A snazzy json log viewer";
+    longDescription = ''
+      Snazy is a simple tool to parse json logs and output them in a nice format
+      with nice colors.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jk ];
+  };
+}
diff --git a/pkgs/servers/roon-server/default.nix b/pkgs/servers/roon-server/default.nix
index 32d0a1310eff..a9166985ead2 100644
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@@ -16,7 +16,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "roon-server";
-  version = "1.8-923";
+  version = "1.8-933";
 
   src =
     let
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     in
     fetchurl {
       url = "http://download.roonlabs.com/builds/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-      hash = "sha256-txf8W7SoPb20S7KcQDfExPEn5dubu9JVEX89dWngYFU=";
+      hash = "sha256-9vAp60hck1Zys0Yv4uibLp7GUAoPvkE9AxNp9DXsQfE=";
     };
 
   dontConfigure = true;
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index f917ce0d68ce..447dc5da78a1 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -5,15 +5,15 @@
 , git, nix, nixfmt, jq, coreutils, gnused, curl, cacert }:
 
 stdenv.mkDerivation rec {
-  version = "2022-04-22";
+  version = "2022-04-24";
   pname = "oh-my-zsh";
-  rev = "a879ff1515b6bd80eea695c03e22289bd6743718";
+  rev = "8f56a8bdf39d7727ab0e220f0164f78c77f9c50e";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "ohmyzsh";
     repo = "ohmyzsh";
-    sha256 = "GFIFxlKCU6XURqZxkCkgZB0a5PW/OuC9KePpmxLAIE4=";
+    sha256 = "yxuvVDjNCH7r/g6ZoF8kEzwirBB0s+CRQizBwRR4Sp4=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/admin/stripe-cli/default.nix b/pkgs/tools/admin/stripe-cli/default.nix
index e3241aacab69..a02e34df631d 100644
--- a/pkgs/tools/admin/stripe-cli/default.nix
+++ b/pkgs/tools/admin/stripe-cli/default.nix
@@ -1,27 +1,68 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles, stdenv }:
 
 buildGoModule rec {
   pname = "stripe-cli";
-  version = "1.8.4";
+  version = "1.8.8";
 
   src = fetchFromGitHub {
     owner = "stripe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TP366SozSNfxUGYXIOObfIul0BhQtIGQYZLwH/TPFs0=";
+    sha256 = "sha256-frVQ2nqOflY26ZZWVYJGMNMOdbLuIojQDu/79kLilBk=";
   };
-
   vendorSha256 = "sha256-1c+YtfRy1ey0z117YHHkrCnpb7g+DmM+LR1rjn1YwMQ=";
 
-  subPackages = [
-    "cmd/stripe"
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/stripe/stripe-cli/pkg/version.Version=${version}"
   ];
 
+  preCheck = ''
+    # the tests expect the Version ldflag not to be set
+    unset ldflags
+  '' + lib.optionalString (
+      # delete plugin tests on all platforms but exact matches
+      # https://github.com/stripe/stripe-cli/issues/850
+      ! lib.lists.any
+        (platform: lib.meta.platformMatch stdenv.hostPlatform platform)
+        [ "x86_64-linux" "x86_64-darwin" ]
+  ) ''
+    rm pkg/plugins/plugin_test.go
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd stripe \
+      --bash <($out/bin/stripe completion --write-to-stdout --shell bash) \
+      --zsh <($out/bin/stripe completion --write-to-stdout --shell zsh)
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/stripe --help
+    $out/bin/stripe --version | grep "${version}"
+    runHook postInstallCheck
+  '';
+
   meta = with lib; {
     homepage = "https://stripe.com/docs/stripe-cli";
+    changelog = "https://github.com/stripe/stripe-cli/releases/tag/v${version}";
     description = "A command-line tool for Stripe";
+    longDescription = ''
+      The Stripe CLI helps you build, test, and manage your Stripe integration
+      right from the terminal.
+
+      With the CLI, you can:
+      Securely test webhooks without relying on 3rd party software
+      Trigger webhook events or resend events for easy testing
+      Tail your API request logs in real-time
+      Create, retrieve, update, or delete API objects.
+    '';
     license = with licenses; [ asl20 ];
-    maintainers = with maintainers; [ RaghavSood ];
+    maintainers = with maintainers; [ RaghavSood jk ];
     mainProgram = "stripe";
   };
 }
diff --git a/pkgs/tools/filesystems/httm/default.nix b/pkgs/tools/filesystems/httm/default.nix
new file mode 100644
index 000000000000..5c0bc74245f6
--- /dev/null
+++ b/pkgs/tools/filesystems/httm/default.nix
@@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, rustPlatform, installShellFiles }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "httm";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "kimono-koans";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-uqzwS7+OQsPdMv3+fWdn3yVFJwtFZNd8kVWw//mQZj8=";
+  };
+
+  cargoSha256 = "sha256-EC3E5NawsDe+CU5WEu0G3FWVLuqW5nXOoUURN0iDPK0=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installManPage httm.1
+
+    installShellCompletion --cmd httm \
+      --zsh scripts/httm-key-bindings.zsh
+  '';
+
+  meta = with lib; {
+    description = "Interactive, file-level ZFS Time Machine-like tool";
+    homepage = "https://github.com/kimono-koans/httm";
+    license = licenses.mpl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ wyndon ];
+  };
+}
diff --git a/pkgs/tools/misc/bat-extras/default.nix b/pkgs/tools/misc/bat-extras/default.nix
index 985d2b112452..76e2906a9421 100644
--- a/pkgs/tools/misc/bat-extras/default.nix
+++ b/pkgs/tools/misc/bat-extras/default.nix
@@ -15,6 +15,8 @@
 # batdiff
 , gitMinimal
 , withDelta ? delta != null, delta ? null
+# batman
+, util-linux
 }:
 
 let
@@ -136,7 +138,7 @@ in
 {
   batdiff = script "batdiff" ([ less coreutils gitMinimal ] ++ optionalDep withDelta delta);
   batgrep = script "batgrep" [ less coreutils ripgrep ];
-  batman = script "batman" [];
+  batman = script "batman" [ util-linux ];
   batwatch = script "batwatch" ([ less coreutils ] ++ optionalDep withEntr entr);
   prettybat = script "prettybat" ([]
     ++ optionalDep withShFmt shfmt
diff --git a/pkgs/tools/misc/ntfy-sh/default.nix b/pkgs/tools/misc/ntfy-sh/default.nix
index f7c55dfa91a1..17e26fc33d19 100644
--- a/pkgs/tools/misc/ntfy-sh/default.nix
+++ b/pkgs/tools/misc/ntfy-sh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ntfy-sh";
-  version = "1.20.0";
+  version = "1.21.2";
 
   src = fetchFromGitHub {
     owner = "binwiederhier";
     repo = "ntfy";
     rev = "v${version}";
-    sha256 = "sha256-JwRI58FadN7DH4MOO033EYmcbqCIuPxw5wWeafoInSg=";
+    sha256 = "sha256-bMVClVt+D+LSvlD0m82MHJc+dcUuqGKo6gxtSqFwkHM=";
   };
 
-  vendorSha256 = "sha256-nzcCLDN/vJ6DS6isCSLL9ycxFkIyUwy4Um6M7NWAPTk=";
+  vendorSha256 = "sha256-Sx6l5GJ72A0SHEHyVtlte8Ed9fuJzZAkJzC0zpCbvK8=";
 
   doCheck = false;
 
diff --git a/pkgs/tools/security/cosign/default.nix b/pkgs/tools/security/cosign/default.nix
index 2d24c8292b68..b4d33a172916 100644
--- a/pkgs/tools/security/cosign/default.nix
+++ b/pkgs/tools/security/cosign/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cosign";
-  version = "1.7.2";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Jxtu4f3JeQ1LH2IjSc5hRKDrWXllczQWWHBa4eTzOIY=";
+    sha256 = "sha256-9zA50tnUWR8dglPvMagiGcJDkPHs7yXuqYV2jnRdWqA=";
   };
 
   buildInputs = lib.optional (stdenv.isLinux && pivKeySupport) (lib.getDev pcsclite)
@@ -16,7 +16,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ pkg-config installShellFiles ];
 
-  vendorSha256 = "sha256-fBmSuxjguNc1LOoXqOue0/Ki3979NpqJTzuuqqsjooM=";
+  vendorSha256 = "sha256-buOdutDZUFu+GbjyF0Ql8QAXpNEv2ej0mwjSZMHDmdA=";
 
   subPackages = [
     "cmd/cosign"
diff --git a/pkgs/tools/security/fulcio/default.nix b/pkgs/tools/security/fulcio/default.nix
index 4098a1015180..86ba5a9b3bf4 100644
--- a/pkgs/tools/security/fulcio/default.nix
+++ b/pkgs/tools/security/fulcio/default.nix
@@ -2,47 +2,50 @@
 
 buildGoModule rec {
   pname = "fulcio";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jcmjfNGruDhQPhVn5R2hdUr+d42qQnIVj8+CCX5HMMM=";
+    sha256 = "sha256-WxSN1pZ8E5vKMoqR5EkGgKnLuHYb5Wl2vzqPcPEkXWE=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
       git rev-parse HEAD > $out/COMMIT
-      # '0000-00-00T00:00:00Z'
-      date -u -d "@$(git log -1 --pretty=%ct)" "+'%Y-%m-%dT%H:%M:%SZ'" > $out/SOURCE_DATE_EPOCH
+      # 0000-00-00T00:00:00Z
+      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorSha256 = "sha256-WQ0MuNEJWCxKTjkyqA66bGPoMrS/7W/YTiGU3yd+Ge8=";
+  vendorSha256 = "sha256-v3H+uUERDHZB2ArruCOClCQFEEW8ANeReObww+1VKOI=";
 
-  # install completions post-install
   nativeBuildInputs = [ installShellFiles ];
 
-  excludedPackages = [ "federation" "test/prometheus" ];
+  subPackages = [ "." ];
 
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/sigstore/fulcio/cmd/app.gitVersion=v${version}"
-    "-X github.com/sigstore/fulcio/cmd/app.gitTreeState=clean"
+    "-X github.com/sigstore/fulcio/pkg/api.gitVersion=v${version}"
+    "-X github.com/sigstore/fulcio/pkg/api.gitTreeState=clean"
   ];
 
   # ldflags based on metadata from git and source
   preBuild = ''
-    ldflags+=" -X github.com/sigstore/fulcio/cmd/app.gitCommit=$(cat COMMIT)"
-    ldflags+=" -X github.com/sigstore/fulcio/cmd/app.buildDate=$(cat SOURCE_DATE_EPOCH)"
+    ldflags+=" -X github.com/sigstore/fulcio/pkg/api.gitCommit=$(cat COMMIT)"
+    ldflags+=" -X github.com/sigstore/fulcio/pkg/api.buildDate=$(cat SOURCE_DATE_EPOCH)"
   '';
 
   preCheck = ''
-    # remove test that requires networking
-    rm pkg/config/config_test.go
+    # test all paths
+    unset subPackages
+
+    # skip test that requires networking
+    substituteInPlace pkg/config/config_test.go \
+      --replace "TestLoad" "SkipLoad"
   '';
 
   postInstall = ''
@@ -55,10 +58,8 @@ buildGoModule rec {
   doInstallCheck = true;
   installCheckPhase = ''
     runHook preInstallCheck
-
     $out/bin/fulcio --help
     $out/bin/fulcio version | grep "v${version}"
-
     runHook postInstallCheck
   '';
 
@@ -66,8 +67,17 @@ buildGoModule rec {
     homepage = "https://github.com/sigstore/fulcio";
     changelog = "https://github.com/sigstore/fulcio/releases/tag/v${version}";
     description = "A Root-CA for code signing certs - issuing certificates based on an OIDC email address";
+    longDescription = ''
+      Fulcio is a free code signing Certificate Authority, built to make
+      short-lived certificates available to anyone. Based on an Open ID Connect
+      email address, Fulcio signs x509 certificates valid for under 20 minutes.
+
+      Fulcio was designed to run as a centralized, public-good instance backed
+      up by other transparency logs. Development is now underway to support
+      different delegation models, and to deploy and run Fulcio as a
+      disconnected instance.
+    '';
     license = licenses.asl20;
     maintainers = with maintainers; [ lesuisse jk ];
-    mainProgram = "fulcio-server";
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a0fb3ad911ee..0050a9a1fa4c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1134,6 +1134,8 @@ with pkgs;
 
   headsetcontrol = callPackage ../tools/audio/headsetcontrol { };
 
+  httm = callPackage ../tools/filesystems/httm { };
+
   ksnip = libsForQt5.callPackage ../tools/misc/ksnip { };
 
   license-generator = callPackage ../tools/misc/license-generator { };
@@ -4119,6 +4121,8 @@ with pkgs;
 
   simg2img = callPackage ../tools/filesystems/simg2img { };
 
+  snazy = callPackage ../development/tools/snazy { };
+
   snippetpixie = callPackage ../tools/text/snippetpixie { };
 
   snowcat = callPackage ../tools/security/snowcat { };
@@ -12212,8 +12216,8 @@ with pkgs;
 
   colm = callPackage ../development/compilers/colm { };
 
-  colmap = libsForQt5.callPackage ../applications/science/misc/colmap { };
-  colmapWithCuda = colmap.override { cudaSupport = true; cudatoolkit = cudatoolkit_11; };
+  colmap = libsForQt5.callPackage ../applications/science/misc/colmap { cudaSupport = config.cudaSupport or false; };
+  colmapWithCuda = colmap.override { cudaSupport = true; };
 
   chickenPackages_4 = callPackage ../development/compilers/chicken/4 { };
   chickenPackages_5 = callPackage ../development/compilers/chicken/5 { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0af17eff5175..2214db668cdf 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3887,8 +3887,12 @@ in {
 
   httplib2 = callPackage ../development/python-modules/httplib2 { };
 
+  http-message-signatures = callPackage ../development/python-modules/http-message-signatures { };
+
   http-parser = callPackage ../development/python-modules/http-parser { };
 
+  http-sfv = callPackage ../development/python-modules/http-sfv { };
+
   httpretty = callPackage ../development/python-modules/httpretty { };
 
   httpserver = callPackage ../development/python-modules/httpserver { };