diff --git a/doc/builders/fetchers.chapter.md b/doc/builders/fetchers.chapter.md
index e36724f295f9..5b28b2dcb398 100644
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@@ -82,4 +82,11 @@ This is used with repo.or.cz repositories. The arguments expected are very simil
 
 ## `fetchFromSourcehut` {#fetchfromsourcehut}
 
-This is used with sourcehut repositories. The arguments expected are very similar to fetchFromGitHub above. Don't forget the tilde (~) in front of the user name!
+This is used with sourcehut repositories. Similar to `fetchFromGitHub` above,
+it expects `owner`, `repo`, `rev` and `sha256`, but don't forget the tilde (~)
+in front of the username! Expected arguments also include `vc` ("git" (default)
+or "hg"), `domain` and `fetchSubmodules`.
+
+If `fetchSubmodules` is `true`, `fetchFromSourcehut` uses `fetchgit`
+or `fetchhg` with `fetchSubmodules` or `fetchSubrepos` set to `true`,
+respectively. Otherwise the fetcher uses `fetchzip`.
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 9e4d0e76a38a..9101f81efa0b 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -338,6 +338,15 @@
           files.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>fetchFromSourcehut</literal> now allows fetching
+          repositories recursively using <literal>fetchgit</literal> or
+          <literal>fetchhg</literal> if the argument
+          <literal>fetchSubmodules</literal> is set to
+          <literal>true</literal>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index 80e3d786aa15..987a6f7246cd 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -126,3 +126,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
 
 - The option `services.duplicati.dataDir` has been added to allow changing the location of duplicati's files.
+
+- `fetchFromSourcehut` now allows fetching repositories recursively
+  using `fetchgit` or `fetchhg` if the argument `fetchSubmodules`
+  is set to `true`.
diff --git a/nixos/modules/services/web-apps/bookstack.nix b/nixos/modules/services/web-apps/bookstack.nix
index 54c491f8b176..b509e4fff458 100644
--- a/nixos/modules/services/web-apps/bookstack.nix
+++ b/nixos/modules/services/web-apps/bookstack.nix
@@ -329,9 +329,6 @@ in {
         ${pkgs.php}/bin/php artisan cache:clear
         ${pkgs.php}/bin/php artisan config:clear
         ${pkgs.php}/bin/php artisan view:clear
-        ${pkgs.php}/bin/php artisan config:cache
-        ${pkgs.php}/bin/php artisan route:cache
-        ${pkgs.php}/bin/php artisan view:cache
       '';
     };
 
diff --git a/nixos/modules/services/web-apps/wordpress.nix b/nixos/modules/services/web-apps/wordpress.nix
index 8ebb72296627..629fd04dc033 100644
--- a/nixos/modules/services/web-apps/wordpress.nix
+++ b/nixos/modules/services/web-apps/wordpress.nix
@@ -359,7 +359,7 @@ in
 
             DirectoryIndex index.php
             Require all granted
-            Options +FollowSymLinks
+            Options +FollowSymLinks -Indexes
           </Directory>
 
           # https://wordpress.org/support/article/hardening-wordpress/#securing-wp-config-php
diff --git a/nixos/modules/system/boot/binfmt.nix b/nixos/modules/system/boot/binfmt.nix
index fdb4d0e4c7fb..5bc603530f7e 100644
--- a/nixos/modules/system/boot/binfmt.nix
+++ b/nixos/modules/system/boot/binfmt.nix
@@ -20,16 +20,20 @@ let
                  optionalString fixBinary "F";
   in ":${name}:${type}:${offset'}:${magicOrExtension}:${mask'}:${interpreter}:${flags}";
 
-  activationSnippet = name: { interpreter, ... }: ''
+  activationSnippet = name: { interpreter, wrapInterpreterInShell, ... }: if wrapInterpreterInShell then ''
     rm -f /run/binfmt/${name}
     cat > /run/binfmt/${name} << 'EOF'
     #!${pkgs.bash}/bin/sh
     exec -- ${interpreter} "$@"
     EOF
     chmod +x /run/binfmt/${name}
+  '' else ''
+    rm -f /run/binfmt/${name}
+    ln -s ${interpreter} /run/binfmt/${name}
   '';
 
   getEmulator = system: (lib.systems.elaborate { inherit system; }).emulator pkgs;
+  getQemuArch = system: (lib.systems.elaborate { inherit system; }).qemuArch;
 
   # Mapping of systems to “magicOrExtension” and “mask”. Mostly taken from:
   # - https://github.com/cleverca22/nixos-configs/blob/master/qemu.nix
@@ -238,6 +242,25 @@ in {
               '';
               type = types.bool;
             };
+
+            wrapInterpreterInShell = mkOption {
+              default = true;
+              description = ''
+                Whether to wrap the interpreter in a shell script.
+
+                This allows a shell command to be set as the interpreter.
+              '';
+              type = types.bool;
+            };
+
+            interpreterSandboxPath = mkOption {
+              internal = true;
+              default = null;
+              description = ''
+                Path of the interpreter to expose in the build sandbox.
+              '';
+              type = types.nullOr types.path;
+            };
           };
         }));
       };
@@ -258,16 +281,37 @@ in {
   config = {
     boot.binfmt.registrations = builtins.listToAttrs (map (system: {
       name = system;
-      value = {
+      value = let
         interpreter = getEmulator system;
+        qemuArch = getQemuArch system;
+
+        preserveArgvZero = "qemu-${qemuArch}" == baseNameOf interpreter;
+        interpreterReg = let
+          wrapperName = "qemu-${qemuArch}-binfmt-P";
+          wrapper = pkgs.wrapQemuBinfmtP wrapperName interpreter;
+        in
+          if preserveArgvZero then "${wrapper}/bin/${wrapperName}"
+          else interpreter;
+      in {
+        inherit preserveArgvZero;
+
+        interpreter = interpreterReg;
+        wrapInterpreterInShell = !preserveArgvZero;
+        interpreterSandboxPath = dirOf (dirOf interpreterReg);
       } // (magics.${system} or (throw "Cannot create binfmt registration for system ${system}"));
     }) cfg.emulatedSystems);
     # TODO: add a nix.extraPlatforms option to NixOS!
     nix.extraOptions = lib.mkIf (cfg.emulatedSystems != []) ''
       extra-platforms = ${toString (cfg.emulatedSystems ++ lib.optional pkgs.stdenv.hostPlatform.isx86_64 "i686-linux")}
     '';
-    nix.sandboxPaths = lib.mkIf (cfg.emulatedSystems != [])
-      ([ "/run/binfmt" "${pkgs.bash}" ] ++ (map (system: dirOf (dirOf (getEmulator system))) cfg.emulatedSystems));
+    nix.sandboxPaths = lib.mkIf (cfg.emulatedSystems != []) (
+      let
+        ruleFor = system: cfg.registrations.${system};
+        hasWrappedRule = lib.any (system: (ruleFor system).wrapInterpreterInShell) cfg.emulatedSystems;
+      in [ "/run/binfmt" ]
+        ++ lib.optional hasWrappedRule "${pkgs.bash}"
+        ++ (map (system: (ruleFor system).interpreterSandboxPath) cfg.emulatedSystems)
+      );
 
     environment.etc."binfmt.d/nixos.conf".source = builtins.toFile "binfmt_nixos.conf"
       (lib.concatStringsSep "\n" (lib.mapAttrsToList makeBinfmtLine config.boot.binfmt.registrations));
diff --git a/nixos/tests/systemd-binfmt.nix b/nixos/tests/systemd-binfmt.nix
index 2a676f3da98b..a3a6efac3e4d 100644
--- a/nixos/tests/systemd-binfmt.nix
+++ b/nixos/tests/systemd-binfmt.nix
@@ -1,24 +1,90 @@
 # Teach the kernel how to run armv7l and aarch64-linux binaries,
 # and run GNU Hello for these architectures.
-import ./make-test-python.nix ({ pkgs, ... }: {
-  name = "systemd-binfmt";
-  machine = {
-    boot.binfmt.emulatedSystems = [
-      "armv7l-linux"
-      "aarch64-linux"
-    ];
+
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+
+let
+  expectArgv0 = xpkgs: xpkgs.runCommandCC "expect-argv0" {
+    src = pkgs.writeText "expect-argv0.c" ''
+      #include <stdio.h>
+      #include <string.h>
+
+      int main(int argc, char **argv) {
+        fprintf(stderr, "Our argv[0] is %s\n", argv[0]);
+
+        if (strcmp(argv[0], argv[1])) {
+          fprintf(stderr, "ERROR: argv[0] is %s, should be %s\n", argv[0], argv[1]);
+          return 1;
+        }
+
+        return 0;
+      }
+    '';
+  } ''
+    $CC -o $out $src
+  '';
+in {
+  basic = makeTest {
+    name = "systemd-binfmt";
+    machine = {
+      boot.binfmt.emulatedSystems = [
+        "armv7l-linux"
+        "aarch64-linux"
+      ];
+    };
+
+    testScript = let
+      helloArmv7l = pkgs.pkgsCross.armv7l-hf-multiplatform.hello;
+      helloAarch64 = pkgs.pkgsCross.aarch64-multiplatform.hello;
+    in ''
+      machine.start()
+
+      assert "world" in machine.succeed(
+          "${helloArmv7l}/bin/hello"
+      )
+
+      assert "world" in machine.succeed(
+          "${helloAarch64}/bin/hello"
+      )
+    '';
   };
 
-  testScript = let
-    helloArmv7l = pkgs.pkgsCross.armv7l-hf-multiplatform.hello;
-    helloAarch64 = pkgs.pkgsCross.aarch64-multiplatform.hello;
-  in ''
-    machine.start()
-    assert "world" in machine.succeed(
-        "${helloArmv7l}/bin/hello"
-    )
-    assert "world" in machine.succeed(
-        "${helloAarch64}/bin/hello"
-    )
-  '';
-})
+  preserveArgvZero = makeTest {
+    name = "systemd-binfmt-preserve-argv0";
+    machine = {
+      boot.binfmt.emulatedSystems = [
+        "aarch64-linux"
+      ];
+    };
+    testScript = let
+      testAarch64 = expectArgv0 pkgs.pkgsCross.aarch64-multiplatform;
+    in ''
+      machine.start()
+      machine.succeed("exec -a meow ${testAarch64} meow")
+    '';
+  };
+
+  ldPreload = makeTest {
+    name = "systemd-binfmt-ld-preload";
+    machine = {
+      boot.binfmt.emulatedSystems = [
+        "aarch64-linux"
+      ];
+    };
+    testScript = let
+      helloAarch64 = pkgs.pkgsCross.aarch64-multiplatform.hello;
+      libredirectAarch64 = pkgs.pkgsCross.aarch64-multiplatform.libredirect;
+    in ''
+      machine.start()
+
+      assert "error" not in machine.succeed(
+          "LD_PRELOAD='${libredirectAarch64}/lib/libredirect.so' ${helloAarch64}/bin/hello 2>&1"
+      ).lower()
+    '';
+  };
+}
diff --git a/pkgs/applications/graphics/ovito/default.nix b/pkgs/applications/graphics/ovito/default.nix
index f0dc5f2b363e..45457ad8ebb1 100644
--- a/pkgs/applications/graphics/ovito/default.nix
+++ b/pkgs/applications/graphics/ovito/default.nix
@@ -1,16 +1,33 @@
-{ mkDerivation, lib, fetchFromGitLab, cmake
-, boost, netcdf, hdf5, fftwSinglePrec, muparser, openssl, ffmpeg, python
-, qtbase, qtsvg, qttools, qscintilla }:
+{ mkDerivation
+, lib
+, stdenv
+, fetchFromGitLab
+, cmake
+, boost
+, bzip2
+, ffmpeg
+, fftwSinglePrec
+, hdf5
+, muparser
+, netcdf
+, openssl
+, python3
+, qscintilla
+, qtbase
+, qtsvg
+, qttools
+, VideoDecodeAcceleration
+}:
 
 mkDerivation rec {
   pname = "ovito";
-  version = "3.4.0";
+  version = "3.6.0";
 
   src = fetchFromGitLab {
     owner = "stuko";
     repo = "ovito";
     rev = "v${version}";
-    sha256 = "1y3wr6yzpsl0qm7cicp2mppfszxd0fgx8hm99in9wff9qd0r16b5";
+    sha256 = "sha256-yQ8gSe/QM1RRNxk4bDJ+K5QX0eYjZ+iG3QOHj01tJhY=";
   };
 
   nativeBuildInputs = [
@@ -19,17 +36,20 @@ mkDerivation rec {
 
   buildInputs = [
     boost
-    netcdf
-    hdf5
-    fftwSinglePrec
-    muparser
-    openssl
+    bzip2
     ffmpeg
-    python
+    fftwSinglePrec
+    hdf5
+    muparser
+    netcdf
+    openssl
+    python3
+    qscintilla
     qtbase
     qtsvg
     qttools
-    qscintilla
+  ] ++ lib.optionals stdenv.isDarwin [
+    VideoDecodeAcceleration
   ];
 
   meta = with lib; {
@@ -37,5 +57,6 @@ mkDerivation rec {
     homepage = "https://ovito.org";
     license = with licenses;  [ gpl3Only mit ];
     maintainers = with maintainers; [ twhitehead ];
+    broken = stdenv.isDarwin; # clang-11: error: no such file or directory: '$-DOVITO_COPYRIGHT_NOTICE=...
   };
 }
diff --git a/pkgs/applications/networking/instant-messengers/baresip/default.nix b/pkgs/applications/networking/instant-messengers/baresip/default.nix
index 122433d197aa..95afcfae4f2b 100644
--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@@ -1,17 +1,60 @@
-{ lib, stdenv, fetchurl, zlib, openssl, libre, librem, pkg-config, gst_all_1
-, cairo, mpg123, alsa-lib, SDL, libv4l, celt, libsndfile, srtp, ffmpeg
-, gsm, speex, portaudio, spandsp, libuuid, libvpx
+{ lib
+, stdenv
+, fetchFromGitHub
+, zlib
+, openssl
+, libre
+, librem
+, pkg-config
+, gst_all_1
+, cairo
+, mpg123
+, alsa-lib
+, SDL2
+, libv4l
+, celt
+, libsndfile
+, srtp
+, ffmpeg
+, gsm
+, speex
+, portaudio
+, spandsp3
+, libuuid
+, libvpx
 }:
 stdenv.mkDerivation rec {
-  version = "0.6.5";
+  version = "1.1.0";
   pname = "baresip";
-  src=fetchurl {
-    url = "http://www.creytiv.com/pub/baresip-${version}.tar.gz";
-    sha256 = "13di0ycdcr2q2a20mjvyaqfmvk5xldwqaxklqsz7470jnbc5n0rb";
+  src = fetchFromGitHub {
+    owner = "baresip";
+    repo = "baresip";
+    rev = "v${version}";
+    sha256 = "sha256-9mc1Beo7/iNhDXSDC/jiTL+lJRt8ah/1xF1heoHTE+g=";
   };
+  postPatch = ''
+    patchShebangs modules/ctrl_dbus/gen.sh
+  '';
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [zlib openssl libre librem cairo mpg123
-    alsa-lib SDL libv4l celt libsndfile srtp ffmpeg gsm speex portaudio spandsp libuuid
+  buildInputs = [
+    zlib
+    openssl
+    libre
+    librem
+    cairo
+    mpg123
+    alsa-lib
+    SDL2
+    libv4l
+    celt
+    libsndfile
+    srtp
+    ffmpeg
+    gsm
+    speex
+    portaudio
+    spandsp3
+    libuuid
     libvpx
   ] ++ (with gst_all_1; [ gstreamer gst-libav gst-plugins-base gst-plugins-bad gst-plugins-good ]);
   makeFlags = [
@@ -23,30 +66,55 @@ stdenv.mkDerivation rec {
     "USE_VIDEO=1"
     "CCACHE_DISABLE=1"
 
-    "USE_ALSA=1" "USE_AMR=1" "USE_CAIRO=1" "USE_CELT=1"
-    "USE_CONS=1" "USE_EVDEV=1" "USE_FFMPEG=1"  "USE_GSM=1" "USE_GST1=1"
-    "USE_L16=1" "USE_MPG123=1" "USE_OSS=1" "USE_PLC=1" "USE_VPX=1"
-    "USE_PORTAUDIO=1" "USE_SDL=1" "USE_SNDFILE=1" "USE_SPEEX=1"
-    "USE_SPEEX_AEC=1" "USE_SPEEX_PP=1" "USE_SPEEX_RESAMP=1" "USE_SRTP=1"
-    "USE_STDIO=1" "USE_SYSLOG=1" "USE_UUID=1" "USE_V4L2=1" "USE_X11=1"
+    "USE_ALSA=1"
+    "USE_AMR=1"
+    "USE_CAIRO=1"
+    "USE_CELT=1"
+    "USE_CONS=1"
+    "USE_EVDEV=1"
+    "USE_FFMPEG=1"
+    "USE_GSM=1"
+    "USE_GST1=1"
+    "USE_L16=1"
+    "USE_MPG123=1"
+    "USE_OSS=1"
+    "USE_PLC=1"
+    "USE_VPX=1"
+    "USE_PORTAUDIO=1"
+    "USE_SDL=1"
+    "USE_SNDFILE=1"
+    "USE_SPEEX=1"
+    "USE_SPEEX_AEC=1"
+    "USE_SPEEX_PP=1"
+    "USE_SPEEX_RESAMP=1"
+    "USE_SRTP=1"
+    "USE_STDIO=1"
+    "USE_SYSLOG=1"
+    "USE_UUID=1"
+    "USE_V4L2=1"
+    "USE_X11=1"
 
-    "USE_BV32=" "USE_COREAUDIO=" "USE_G711=1" "USE_G722=1" "USE_G722_1="
-    "USE_ILBC=" "USE_OPUS=" "USE_SILK="
+    "USE_BV32="
+    "USE_COREAUDIO="
+    "USE_G711=1"
+    "USE_G722=1"
+    "USE_G722_1="
+    "USE_ILBC="
+    "USE_OPUS="
+    "USE_SILK="
   ]
   ++ lib.optional (stdenv.cc.cc != null) "SYSROOT_ALT=${stdenv.cc.cc}"
   ++ lib.optional (stdenv.cc.libc != null) "SYSROOT=${stdenv.cc.libc}"
   ;
 
-  NIX_CFLAGS_COMPILE='' -I${librem}/include/rem -I${gsm}/include/gsm
+  NIX_CFLAGS_COMPILE = '' -I${librem}/include/rem -I${gsm}/include/gsm
     -DHAVE_INTTYPES_H -D__GLIBC__
     -D__need_timeval -D__need_timespec -D__need_time_t '';
+
   meta = {
-    homepage = "http://www.creytiv.com/baresip.html";
-    platforms = with lib.platforms; linux;
-    maintainers = with lib.maintainers; [raskin];
+    description = "A modular SIP User-Agent with audio and video support";
+    homepage = "https://github.com/baresip/baresip";
+    maintainers = with lib.maintainers; [ elohmeier raskin ];
     license = lib.licenses.bsd3;
-    downloadPage = "http://www.creytiv.com/pub/";
-    updateWalker = true;
-    downloadURLRegexp = "/baresip-.*[.]tar[.].*";
   };
 }
diff --git a/pkgs/applications/office/libreoffice/src-fresh/download.nix b/pkgs/applications/office/libreoffice/src-fresh/download.nix
index ecce7cf18145..9bfccf4c3069 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/download.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/download.nix
@@ -714,11 +714,11 @@
     md5name = "505e70834d35383537b6491e7ae8641f1a4bed1876dbfe361201fc80868d88ca-libpng-1.6.37.tar.xz";
   }
   {
-    name = "poppler-21.01.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/poppler-21.01.0.tar.xz";
-    sha256 = "016dde34e5f868ea98a32ca99b643325a9682281500942b7113f4ec88d20e2f3";
+    name = "poppler-21.11.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/poppler-21.11.0.tar.xz";
+    sha256 = "31b76b5cac0a48612fdd154c02d9eca01fd38fb8eaa77c1196840ecdeb53a584";
     md5 = "";
-    md5name = "016dde34e5f868ea98a32ca99b643325a9682281500942b7113f4ec88d20e2f3-poppler-21.01.0.tar.xz";
+    md5name = "31b76b5cac0a48612fdd154c02d9eca01fd38fb8eaa77c1196840ecdeb53a584-poppler-21.11.0.tar.xz";
   }
   {
     name = "poppler-data-0.4.10.tar.gz";
diff --git a/pkgs/applications/office/libreoffice/src-fresh/primary.nix b/pkgs/applications/office/libreoffice/src-fresh/primary.nix
index f1a1478a3cf9..7d13558b9357 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/primary.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/primary.nix
@@ -8,8 +8,8 @@ rec {
 
   major = "7";
   minor = "2";
-  patch = "4";
-  tweak = "1";
+  patch = "5";
+  tweak = "2";
 
   subdir = "${major}.${minor}.${patch}";
 
@@ -17,13 +17,13 @@ rec {
 
   src = fetchurl {
     url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "sha256-Ymi5BmpgWGzwpfXtmWDN+Gpf9Yb+Zpm/TSltWA3gjyE=";
+    sha256 = "sha256-Z8G/sFnUMyhrAlKpFWJ7M69ju19LbslQnRO53UdVEqc=";
   };
 
   # FIXME rename
   translations = fetchSrc {
     name = "translations";
-    sha256 = "sha256-8nzCt7/J7gqJPtHOrVu7UTonJw1pxu4fnLWJyWOUHa8=";
+    sha256 = "sha256-9rnuRifsEX7RAUdsX6VVw/xQS6dZeS3RbKnoC39uMd8=";
   };
 
   # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
@@ -31,6 +31,6 @@ rec {
 
   help = fetchSrc {
     name = "help";
-    sha256 = "sha256-rZb1ej3GbgXOHOZWVKKJVuir2urLmvGmrdpB1vpcaCk=";
+    sha256 = "sha256-6vERLWh0fkQcSRkC37fw2HBqxVtbr9kPEhOyWXjMrfM=";
   };
 }
diff --git a/pkgs/applications/virtualization/qemu/binfmt-p-wrapper.c b/pkgs/applications/virtualization/qemu/binfmt-p-wrapper.c
new file mode 100644
index 000000000000..f956768862ec
--- /dev/null
+++ b/pkgs/applications/virtualization/qemu/binfmt-p-wrapper.c
@@ -0,0 +1,79 @@
+// This is a tiny wrapper that converts the extra arv[0] argument
+// from binfmt-misc with the P flag enabled to QEMU parameters.
+// It also prevents LD_* environment variables from being applied
+// to QEMU itself.
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#ifndef TARGET_QEMU
+#error "Define TARGET_QEMU to be the path to the qemu-user binary (e.g., -DTARGET_QEMU=\"/full/path/to/qemu-riscv64\")"
+#endif
+
+extern char **environ;
+
+int main(int argc, char *argv[]) {
+    if (argc < 3) {
+        fprintf(stderr, "%s: This should be run as the binfmt interpreter with the P flag\n", argv[0]);
+        fprintf(stderr, "%s: My preconfigured qemu-user binary: %s\n", argv[0], TARGET_QEMU);
+        return 1;
+    }
+
+    size_t environ_count = 0;
+    for (char **cur = environ; *cur != NULL; ++cur) {
+        environ_count++;
+    }
+
+    size_t new_argc = 3;
+    size_t new_argv_alloc = argc + 2 * environ_count + 2; // [ "-E", env ] for each LD_* env + [ "-0", argv0 ]
+    char **new_argv = (char**)malloc((new_argv_alloc + 1) * sizeof(char*));
+    if (!new_argv) {
+        fprintf(stderr, "FATAL: Failed to allocate new argv array\n");
+        abort();
+    }
+
+    new_argv[0] = TARGET_QEMU;
+    new_argv[1] = "-0";
+    new_argv[2] = argv[2];
+
+    // Pass all LD_ env variables as -E and strip them in `new_environ`
+    size_t new_environc = 0;
+    char **new_environ = (char**)malloc((environ_count + 1) * sizeof(char*));
+    if (!new_environ) {
+        fprintf(stderr, "FATAL: Failed to allocate new environ array\n");
+        abort();
+    }
+
+    for (char **cur = environ; *cur != NULL; ++cur) {
+        if (strncmp("LD_", *cur, 3) == 0) {
+            new_argv[new_argc++] = "-E";
+            new_argv[new_argc++] = *cur;
+        } else {
+            new_environ[new_environc++] = *cur;
+        }
+    }
+    new_environ[new_environc] = NULL;
+
+    size_t new_arg_start = new_argc;
+    new_argc += argc - 3 + 2; // [ "--", full_binary_path ]
+
+    if (argc > 3) {
+        memcpy(&new_argv[new_arg_start + 2], &argv[3], (argc - 3) * sizeof(char**));
+    }
+
+    new_argv[new_arg_start] = "--";
+    new_argv[new_arg_start + 1] = argv[1];
+    new_argv[new_argc] = NULL;
+
+#ifdef DEBUG
+    for (size_t i = 0; i < new_argc; ++i) {
+        fprintf(stderr, "argv[%zu] = %s\n", i, new_argv[i]);
+    }
+#endif
+
+    return execve(new_argv[0], new_argv, new_environ);
+}
+
+// vim: et:ts=4:sw=4
diff --git a/pkgs/applications/virtualization/qemu/binfmt-p-wrapper.nix b/pkgs/applications/virtualization/qemu/binfmt-p-wrapper.nix
new file mode 100644
index 000000000000..fada14569299
--- /dev/null
+++ b/pkgs/applications/virtualization/qemu/binfmt-p-wrapper.nix
@@ -0,0 +1,31 @@
+# binfmt preserve-argv[0] wrapper
+#
+# More details in binfmt-p-wrapper.c
+#
+# The wrapper has to be static so LD_* environment variables
+# cannot affect the execution of the wrapper itself.
+
+{ lib, stdenv, pkgsStatic, enableDebug ? false }:
+
+name: emulator:
+
+pkgsStatic.stdenv.mkDerivation {
+  inherit name;
+
+  src = ./binfmt-p-wrapper.c;
+
+  dontUnpack = true;
+  dontInstall = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    mkdir -p $out/bin
+    $CC -o $out/bin/${name} -static -std=c99 -O2 \
+        -DTARGET_QEMU=\"${emulator}\" \
+        ${lib.optionalString enableDebug "-DDEBUG"} \
+        $src
+
+    runHook postBuild
+  '';
+}
diff --git a/pkgs/build-support/fetchsourcehut/default.nix b/pkgs/build-support/fetchsourcehut/default.nix
index ed2f074200cd..2b1feaa496e4 100644
--- a/pkgs/build-support/fetchsourcehut/default.nix
+++ b/pkgs/build-support/fetchsourcehut/default.nix
@@ -1,10 +1,11 @@
-{ fetchzip, lib }:
+{ fetchgit, fetchhg, fetchzip, lib }:
 
 { owner
 , repo, rev
 , domain ? "sr.ht"
 , vc ? "git"
 , name ? "source"
+, fetchSubmodules ? false
 , ... # For hash agility
 } @ args:
 
@@ -14,12 +15,36 @@ assert (lib.assertOneOf "vc" vc [ "hg" "git" ]);
 
 let
   baseUrl = "https://${vc}.${domain}/${owner}/${repo}";
-
-in fetchzip (recursiveUpdate {
-  inherit name;
-  url = "${baseUrl}/archive/${rev}.tar.gz";
-  meta.homepage = "${baseUrl}/";
-  extraPostFetch = optionalString (vc == "hg") ''
-    rm -f "$out/.hg_archival.txt"
-  ''; # impure file; see #12002
-} (removeAttrs args [ "owner" "repo" "rev" "domain" "vc" ])) // { inherit rev; }
+  baseArgs = {
+    inherit name;
+  } // removeAttrs args [
+    "owner" "repo" "rev" "domain" "vc" "name" "fetchSubmodules"
+  ];
+  vcArgs = baseArgs // {
+    inherit rev;
+    url = baseUrl;
+  };
+  fetcher = if fetchSubmodules then vc else "zip";
+  cases = {
+    git = {
+      fetch = fetchgit;
+      arguments = vcArgs // { fetchSubmodules = true; };
+    };
+    hg = {
+      fetch = fetchhg;
+      arguments = vcArgs // { fetchSubrepos = true; };
+    };
+    zip = {
+      fetch = fetchzip;
+      arguments = baseArgs // {
+        url = "${baseUrl}/archive/${rev}.tar.gz";
+        extraPostFetch = optionalString (vc == "hg") ''
+          rm -f "$out/.hg_archival.txt"
+        ''; # impure file; see #12002
+      };
+    };
+  };
+in cases.${fetcher}.fetch cases.${fetcher}.arguments // {
+  inherit rev;
+  meta.homepage = "${baseUrl}";
+}
diff --git a/pkgs/development/libraries/arrow-cpp/default.nix b/pkgs/development/libraries/arrow-cpp/default.nix
index 5138a9654522..031b4fc46cc1 100644
--- a/pkgs/development/libraries/arrow-cpp/default.nix
+++ b/pkgs/development/libraries/arrow-cpp/default.nix
@@ -199,13 +199,7 @@ stdenv.mkDerivation rec {
         "S3RegionResolutionTest.PublicBucket"
         "S3RegionResolutionTest.RestrictedBucket"
         "TestMinioServer.Connect"
-        "TestS3FS.GetFileInfoRoot"
-        "TestS3FS.OpenOutputStreamBackgroundWrites"
-        "TestS3FS.OpenOutputStreamDestructorBackgroundWrites"
-        "TestS3FS.OpenOutputStreamDestructorSyncWrite"
-        "TestS3FS.OpenOutputStreamDestructorSyncWrites"
-        "TestS3FS.OpenOutputStreamMetadata"
-        "TestS3FS.OpenOutputStreamSyncWrites"
+        "TestS3FS.*"
         "TestS3FSGeneric.*"
       ] ++ lib.optionals enableGcs [
         "GcsFileSystem.FileSystemCompare"
diff --git a/pkgs/development/libraries/dyncall/default.nix b/pkgs/development/libraries/dyncall/default.nix
index f92f2f0affe4..3197e3abed9e 100644
--- a/pkgs/development/libraries/dyncall/default.nix
+++ b/pkgs/development/libraries/dyncall/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "dyncall";
-  version = "1.2";
+  version = "1.3";
 
   src = fetchurl {
     url = "https://www.dyncall.org/r${version}/dyncall-${version}.tar.gz";
-    # https://www.dyncall.org/r1.2/SHA256
-    sha256 = "sha256-6IFUwCQ0IVYHBPXHKUr73snpka+gYB1a3/UELqgYCNc=";
+    # https://www.dyncall.org/r1.3/SHA256
+    sha256 = "sha256-q/Ys/DHr1/IWWNqhNwp3gcxRQxYrwIaDhKwH3vnj05A=";
   };
 
   # XXX: broken tests, failures masked, lets avoid crashing a bunch for now :)
diff --git a/pkgs/development/libraries/libre/default.nix b/pkgs/development/libraries/libre/default.nix
index 7c91950a4c4e..36f1a288f1a5 100644
--- a/pkgs/development/libraries/libre/default.nix
+++ b/pkgs/development/libraries/libre/default.nix
@@ -1,24 +1,22 @@
-{lib, stdenv, fetchurl, zlib, openssl}:
+{ lib, stdenv, fetchFromGitHub, zlib, openssl }:
 stdenv.mkDerivation rec {
-  version = "0.6.1";
+  version = "2.0.1";
   pname = "libre";
-  src = fetchurl {
-    url = "http://www.creytiv.com/pub/re-${version}.tar.gz";
-    sha256 = "0hzyc0hdlw795nyx6ik7h2ihs8wapbj32x8c40xq0484ciwzqnyd";
+  src = fetchFromGitHub {
+    owner = "baresip";
+    repo = "re";
+    rev = "v${version}";
+    sha256 = "sha256-/1J9cs0W96CtnHAoX/jg3FLGD9coa0eOEgf8uMQHuUk=";
   };
   buildInputs = [ zlib openssl ];
   makeFlags = [ "USE_ZLIB=1" "USE_OPENSSL=1" "PREFIX=$(out)" ]
-  ++ lib.optional (stdenv.cc.cc != null) "SYSROOT_ALT=${stdenv.cc.cc}"
-  ++ lib.optional (stdenv.cc.libc != null) "SYSROOT=${lib.getDev stdenv.cc.libc}"
+    ++ lib.optional (stdenv.cc.cc != null) "SYSROOT_ALT=${stdenv.cc.cc}"
+    ++ lib.optional (stdenv.cc.libc != null) "SYSROOT=${lib.getDev stdenv.cc.libc}"
   ;
   meta = {
     description = "A library for real-time communications with async IO support and a complete SIP stack";
-    homepage = "http://www.creytiv.com/re.html";
-    platforms = with lib.platforms; linux;
-    maintainers = with lib.maintainers; [raskin];
+    homepage = "https://github.com/baresip/re";
+    maintainers = with lib.maintainers; [ elohmeier raskin ];
     license = lib.licenses.bsd3;
-    downloadPage = "http://www.creytiv.com/pub/";
-    updateWalker = true;
-    downloadURLRegexp = "/re-.*[.]tar[.].*";
   };
 }
diff --git a/pkgs/development/libraries/librem/default.nix b/pkgs/development/libraries/librem/default.nix
index 349384b4674c..23c1f2cc3457 100644
--- a/pkgs/development/libraries/librem/default.nix
+++ b/pkgs/development/libraries/librem/default.nix
@@ -1,12 +1,14 @@
-{lib, stdenv, fetchurl, zlib, openssl, libre}:
+{ lib, stdenv, fetchFromGitHub, zlib, openssl, libre }:
 stdenv.mkDerivation rec {
-  version = "0.6.0";
+  version = "1.0.0";
   pname = "librem";
-  src=fetchurl {
-    url = "http://www.creytiv.com/pub/rem-${version}.tar.gz";
-    sha256 = "0b17wma5w9acizk02isk5k83vv47vf1cf9zkmsc1ail677d20xj1";
+  src = fetchFromGitHub {
+    owner = "baresip";
+    repo = "rem";
+    rev = "v${version}";
+    sha256 = "sha256-6Xe9zT0qLLGe1+QCQ9NALoDTaRhHpaTLbCbA+kV7hOA=";
   };
-  buildInputs = [zlib openssl libre];
+  buildInputs = [ zlib openssl libre ];
   makeFlags = [
     "LIBRE_MK=${libre}/share/re/re.mk"
     "LIBRE_INC=${libre}/include/re"
@@ -16,13 +18,9 @@ stdenv.mkDerivation rec {
   ++ lib.optional (stdenv.cc.libc != null) "SYSROOT=${lib.getDev stdenv.cc.libc}"
   ;
   meta = {
-    description = " A library for real-time audio and video processing";
-    homepage = "http://www.creytiv.com/rem.html";
-    platforms = with lib.platforms; linux;
-    maintainers = with lib.maintainers; [raskin];
+    description = "A library for real-time audio and video processing";
+    homepage = "https://github.com/baresip/rem";
+    maintainers = with lib.maintainers; [ elohmeier raskin ];
     license = lib.licenses.bsd3;
-    downloadPage = "http://www.creytiv.com/pub/";
-    updateWalker = true;
-    downloadURLRegexp = "/rem-.*[.]tar[.].*";
   };
 }
diff --git a/pkgs/development/libraries/qscintilla-qt4/default.nix b/pkgs/development/libraries/qscintilla-qt4/default.nix
index 7cefdec97ca2..23daedd217e2 100644
--- a/pkgs/development/libraries/qscintilla-qt4/default.nix
+++ b/pkgs/development/libraries/qscintilla-qt4/default.nix
@@ -1,4 +1,9 @@
-{ stdenv, lib, fetchurl, unzip, qt4, qmake4Hook
+{ stdenv
+, lib
+, fetchurl
+, unzip
+, qt4
+, qmake4Hook
 }:
 
 stdenv.mkDerivation rec {
@@ -16,12 +21,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ unzip qmake4Hook ];
 
-  patches = ./fix-qt4-build.patch;
+  patches = [
+    ./fix-qt4-build.patch
+  ];
 
   # Make sure that libqscintilla2.so is available in $out/lib since it is expected
   # by some packages such as sqlitebrowser
   postFixup = ''
-    ln -s $out/lib/libqscintilla2_qt?.so $out/lib/libqscintilla2.so
+    ln -s $out/lib/libqscintilla2_qt4.so $out/lib/libqscintilla2.so
   '';
 
   dontWrapQtApps = true;
diff --git a/pkgs/development/libraries/qscintilla/default.nix b/pkgs/development/libraries/qscintilla/default.nix
index 3dcbc22e15fe..88c44ece32cd 100644
--- a/pkgs/development/libraries/qscintilla/default.nix
+++ b/pkgs/development/libraries/qscintilla/default.nix
@@ -1,5 +1,9 @@
-{ stdenv, lib, fetchurl, unzip
-, qtbase, qtmacextras
+{ stdenv
+, lib
+, fetchurl
+, unzip
+, qtbase
+, qtmacextras
 , qmake
 , fixDarwinDylibNames
 }:
@@ -20,12 +24,12 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = lib.optionals stdenv.isDarwin [ qtmacextras ];
 
   nativeBuildInputs = [ unzip qmake ]
-    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;
+    ++ lib.optionals stdenv.isDarwin [ fixDarwinDylibNames ];
 
   # Make sure that libqscintilla2.so is available in $out/lib since it is expected
   # by some packages such as sqlitebrowser
   postFixup = ''
-    ln -s $out/lib/libqscintilla2_qt?.so $out/lib/libqscintilla2.so
+    ln -s $out/lib/libqscintilla2_qt5.so $out/lib/libqscintilla2.so
   '';
 
   dontWrapQtApps = true;
diff --git a/pkgs/development/python-modules/chainer/default.nix b/pkgs/development/python-modules/chainer/default.nix
index 1ccce2caeeb9..b7dbfca70e8a 100644
--- a/pkgs/development/python-modules/chainer/default.nix
+++ b/pkgs/development/python-modules/chainer/default.nix
@@ -5,7 +5,7 @@
 
 buildPythonPackage rec {
   pname = "chainer";
-  version = "7.8.0";
+  version = "7.8.1";
   disabled = !isPy3k; # python2.7 abandoned upstream
 
   # no tests in Pypi tarball
@@ -13,7 +13,7 @@ buildPythonPackage rec {
     owner = "chainer";
     repo = "chainer";
     rev = "v${version}";
-    sha256 = "1zfj3pk54gzxd4nid0qjx4kw1wdngwscvn4hk4cijxvwqi4a5zxj";
+    sha256 = "1n07zjzc4g92m1sbgxvnansl0z00y4jnhma2mw06vnahs7s9nrf6";
   };
 
   checkInputs = [
diff --git a/pkgs/development/python-modules/datashader/default.nix b/pkgs/development/python-modules/datashader/default.nix
index 587f73d81ed8..d4515b064833 100644
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@@ -25,19 +25,13 @@
 buildPythonPackage rec {
   pname = "datashader";
   version = "0.13.0";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "sha256-6JscHm1QjDmXOLLa83qhAvY/xwvlPM6duQ1lSxnCVV8=";
   };
 
-  # the complete extra is for usage with conda, which we
-  # don't care about
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "dask[complete]" "dask"
-  '';
-
   propagatedBuildInputs = [
     dask
     bokeh
@@ -56,13 +50,21 @@ buildPythonPackage rec {
 
   checkInputs = [
     pytestCheckHook
-    pytest-xdist # not needed
+    pytest-xdist
     nbsmoke
     fastparquet
     nbconvert
     netcdf4
   ];
 
+  # The complete extra is for usage with conda, which we
+  # don't care about
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "dask[complete]" "dask" \
+      --replace "xarray >=0.9.6" "xarray"
+  '';
+
   preCheck = ''
     export HOME=$TMPDIR
   '';
@@ -73,10 +75,10 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # not compatible with current version of bokeh
+    # Not compatible with current version of bokeh
     # see: https://github.com/holoviz/datashader/issues/1031
     "test_interactive_image_update"
-    # latest dask broken array marshalling
+    # Latest dask broken array marshalling
     # see: https://github.com/holoviz/datashader/issues/1032
     "test_raster_quadmesh_autorange_reversed"
   ];
@@ -86,10 +88,14 @@ buildPythonPackage rec {
     "datashader/tests/test_datatypes.py"
   ];
 
+  pythonImportsCheck = [
+    "datashader"
+  ];
+
   meta = with lib;{
     description = "Data visualization toolchain based on aggregating into a grid";
     homepage = "https://datashader.org";
     license = licenses.bsd3;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
   };
 }
diff --git a/pkgs/development/python-modules/google-cloud-storage/default.nix b/pkgs/development/python-modules/google-cloud-storage/default.nix
index 9d97437b8151..f74944a45e2e 100644
--- a/pkgs/development/python-modules/google-cloud-storage/default.nix
+++ b/pkgs/development/python-modules/google-cloud-storage/default.nix
@@ -13,11 +13,11 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-storage";
-  version = "1.43.0";
+  version = "1.44.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "f3b4f4be5c8a1b5727a8f7136c94d3bacdd4b7bf11f9553f51ae4c1d876529d3";
+    sha256 = "29edbfeedd157d853049302bf5d104055c6f0cb7ef283537da3ce3f730073001";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/liquidctl/default.nix b/pkgs/development/python-modules/liquidctl/default.nix
index c37183e22ec0..66a1a5f61f9e 100644
--- a/pkgs/development/python-modules/liquidctl/default.nix
+++ b/pkgs/development/python-modules/liquidctl/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "liquidctl";
-  version = "1.7.2";
+  version = "1.8.0";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-fPSvxdr329SxAe4N7lTa7hddFp1WVUplkhYD1oDQXAI=";
+    sha256 = "sha256-N0Ebd0zIHFmuiIozkAy4SV3o8rFA1wmrGd+dJo8jdk0=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/development/python-modules/mautrix/default.nix b/pkgs/development/python-modules/mautrix/default.nix
index 1be685e013b4..4e4e6dcc6345 100644
--- a/pkgs/development/python-modules/mautrix/default.nix
+++ b/pkgs/development/python-modules/mautrix/default.nix
@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.14.0";
+  version = "0.14.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5ad04e87bcf31eb3479fdd3cabd5082b257013e5c00f6b369539a2b584afadaf";
+    sha256 = "a7b41b522deafe47f8d3ce2b13f5a8a01f7bc715f09ebb5ca53a4af4f6987701";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/miniaudio/default.nix b/pkgs/development/python-modules/miniaudio/default.nix
index 0f3372a6048c..f0e5db4f0ecd 100644
--- a/pkgs/development/python-modules/miniaudio/default.nix
+++ b/pkgs/development/python-modules/miniaudio/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "miniaudio";
-  version = "1.45";
+  version = "1.46";
 
   disabled = pythonOlder "3.6";
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "irmen";
     repo = "pyminiaudio";
     rev = "v${version}";
-    sha256 = "1yx4n4zax103fmjzdiqzw37zibsh68b2p2l5qvgcnx2zrrjd31yl";
+    sha256 = "16llwmbbd9445rwhl4v66kf5zd7yl3a94zm9xyllq6ij7vnhg5jb";
   };
 
   propagatedNativeBuildInputs = [ cffi ];
diff --git a/pkgs/development/python-modules/pyfftw/default.nix b/pkgs/development/python-modules/pyfftw/default.nix
index 96e807f8eba3..651ad1c439e3 100644
--- a/pkgs/development/python-modules/pyfftw/default.nix
+++ b/pkgs/development/python-modules/pyfftw/default.nix
@@ -2,12 +2,12 @@
 , fftw, fftwFloat, fftwLongDouble, numpy, scipy, cython, dask }:
 
 buildPythonPackage rec {
-  version = "0.12.0";
+  version = "0.13.0";
   pname = "pyFFTW";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "60988e823ca75808a26fd79d88dbae1de3699e72a293f812aa4534f8a0a58cb0";
+    sha256 = "da85102405c0bd95d57eb19e99b01a0729d8406cb204c3900894b873784253da";
   };
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/qscintilla-qt4/default.nix b/pkgs/development/python-modules/qscintilla-qt4/default.nix
index bc3f3596923f..a356bfddb934 100644
--- a/pkgs/development/python-modules/qscintilla-qt4/default.nix
+++ b/pkgs/development/python-modules/qscintilla-qt4/default.nix
@@ -1,6 +1,5 @@
 { lib
 , buildPythonPackage
-, disabledIf
 , isPy3k
 , isPyPy
 , pkgs
@@ -8,35 +7,36 @@
 , pyqt4
 }:
 
-disabledIf (isPy3k || isPyPy)
-  (buildPythonPackage {
-    pname = "qscintilla";
-    version = pkgs.qscintilla.version;
-    format = "other";
+buildPythonPackage {
+  pname = "qscintilla-qt4";
+  version = pkgs.qscintilla-qt4.version;
+  format = "other";
 
-    src = pkgs.qscintilla.src;
+  disabled = isPyPy;
 
-    nativeBuildInputs = [ pkgs.xorg.lndir ];
+  src = pkgs.qscintilla-qt4.src;
 
-    buildInputs = [ pyqt4.qt pyqt4 ];
+  nativeBuildInputs = [ pkgs.xorg.lndir ];
 
-    preConfigure = ''
-      mkdir -p $out
-      lndir ${pyqt4} $out
-      rm -rf "$out/nix-support"
-      cd Python
-      ${python.executable} ./configure-old.py \
-          --destdir $out/lib/${python.libPrefix}/site-packages/PyQt4 \
-          --apidir $out/api/${python.libPrefix} \
-          -n ${pkgs.qscintilla}/include \
-          -o ${pkgs.qscintilla}/lib \
-          --sipdir $out/share/sip
-    '';
+  buildInputs = [ pyqt4.qt pyqt4 ];
 
-    meta = with lib; {
-      description = "A Python binding to QScintilla, Qt based text editing control";
-      license = licenses.lgpl21Plus;
-      maintainers = with maintainers; [ danbst ];
-      platforms = platforms.linux;
-    };
-  })
+  preConfigure = ''
+    mkdir -p $out
+    lndir ${pyqt4} $out
+    rm -rf "$out/nix-support"
+    cd Python
+    ${python.executable} ./configure-old.py \
+        --destdir $out/lib/${python.libPrefix}/site-packages/PyQt4 \
+        --apidir $out/api/${python.libPrefix} \
+        -n ${pkgs.qscintilla-qt4}/include \
+        -o ${pkgs.qscintilla-qt4}/lib \
+        --sipdir $out/share/sip
+  '';
+
+  meta = with lib; {
+    description = "A Python binding to QScintilla, Qt based text editing control";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ danbst ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/python-modules/qscintilla-qt5/default.nix b/pkgs/development/python-modules/qscintilla-qt5/default.nix
index 11445c99f4f4..3e43b0d069ca 100644
--- a/pkgs/development/python-modules/qscintilla-qt5/default.nix
+++ b/pkgs/development/python-modules/qscintilla-qt5/default.nix
@@ -10,7 +10,7 @@
 let
   inherit (pythonPackages) buildPythonPackage isPy3k python sip sipbuild pyqt5 pyqt-builder;
 in buildPythonPackage rec {
-  pname = "qscintilla";
+  pname = "qscintilla-qt5";
   version = qscintilla.version;
   src = qscintilla.src;
   format = "pyproject";
diff --git a/pkgs/development/python-modules/qscintilla/default.nix b/pkgs/development/python-modules/qscintilla/default.nix
deleted file mode 100644
index 24719de779eb..000000000000
--- a/pkgs/development/python-modules/qscintilla/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ lib
-, buildPythonPackage
-, disabledIf
-, isPy3k
-, isPyPy
-, pkgs
-, python
-, pyqt4
-}:
-
-disabledIf (isPy3k || isPyPy)
-  (buildPythonPackage {
-    # TODO: Qt5 support
-    pname = "qscintilla";
-    version = pkgs.qscintilla.version;
-    format = "other";
-
-    src = pkgs.qscintilla.src;
-
-    nativeBuildInputs = [ pkgs.xorg.lndir ];
-
-    buildInputs = [ pyqt4.qt pyqt4 ];
-
-    preConfigure = ''
-      mkdir -p $out
-      lndir ${pyqt4} $out
-      rm -rf "$out/nix-support"
-      cd Python
-      ${python.executable} ./configure-old.py \
-          --destdir $out/lib/${python.libPrefix}/site-packages/PyQt4 \
-          --apidir $out/api/${python.libPrefix} \
-          -n ${pkgs.qscintilla}/include \
-          -o ${pkgs.qscintilla}/lib \
-          --sipdir $out/share/sip
-    '';
-
-    meta = with lib; {
-      description = "A Python binding to QScintilla, Qt based text editing control";
-      license = licenses.lgpl21Plus;
-      maintainers = with maintainers; [ danbst ];
-      platforms = platforms.unix;
-    };
-  })
diff --git a/pkgs/development/python-modules/tables/default.nix b/pkgs/development/python-modules/tables/default.nix
index 245e619e89e0..fbe99c6fa931 100644
--- a/pkgs/development/python-modules/tables/default.nix
+++ b/pkgs/development/python-modules/tables/default.nix
@@ -10,19 +10,19 @@
 , lzo
 , numpy
 , numexpr
-, setuptools
+, packaging
   # Test inputs
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "tables";
-  version = "3.6.1";
+  version = "3.7.0";
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0j8vnxh2m5n0cyk9z3ndcj5n1zj5rdxgc1gb78bqlyn2lyw75aa9";
+    sha256 = "sha256-6SqIetbyqYPlZKaZAt5KdkXDAGn8AavTU+xdolXF4f4=";
   };
 
   nativeBuildInputs = [ cython ];
@@ -36,17 +36,9 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     numpy
     numexpr
-    setuptools  # uses pkg_resources at runtime
+    packaging  # uses packaging.version at runtime
   ];
 
-  patches = [
-    (fetchpatch {
-      # Needed for numpy >= 1.20.0
-      name = "tables-pr-862-use-lowercase-numpy-dtypes.patch";
-      url = "https://github.com/PyTables/PyTables/commit/93a3272b8fe754095637628b4d312400e24ae654.patch";
-      sha256 = "00czgxnm1dxp9763va9xw1nc7dd7kxh9hjcg9klim52519hkbhi4";
-    })
-  ];
   # When doing `make distclean`, ignore docs
   postPatch = ''
     substituteInPlace Makefile --replace "src doc" "src"
diff --git a/pkgs/development/python-modules/tensorly/default.nix b/pkgs/development/python-modules/tensorly/default.nix
index 54f32d182c0c..e780aba22822 100644
--- a/pkgs/development/python-modules/tensorly/default.nix
+++ b/pkgs/development/python-modules/tensorly/default.nix
@@ -1,45 +1,36 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytest
-, nose
+, pytestCheckHook
 , isPy27
 , numpy
 , scipy
 , sparse
-, pytorch
 }:
 
 buildPythonPackage rec {
   pname = "tensorly";
-  version = "0.4.5";
+  version = "0.7.0";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1ml91yaxwx4msisxbm92yf22qfrscvk58f3z2r1jhi96pw2k4i7x";
+    sha256 = "VcX3pCczZQUYZaD7xrrkOcj0QPJt28cYTwpZm5D/X3c=";
   };
 
-  propagatedBuildInputs = [ numpy scipy sparse ]
-    ++ lib.optionals (!doCheck) [ nose ]; # upstream added nose to install_requires
-
-  checkInputs = [ pytest nose pytorch ];
-  # also has a cupy backend, but the tests are currently broken
-  # (e.g. attempts to access cupy.qr instead of cupy.linalg.qr)
-  # and this backend also adds a non-optional CUDA dependence,
-  # as well as tensorflow and mxnet backends, but the tests don't
-  # seem to exercise these backend by default
-
-  # uses >= 140GB of ram to test
-  doCheck = false;
-  checkPhase = ''
-    runHook preCheck
-    nosetests -e "test_cupy"
-    runHook postCheck
+  # nose is not actually required for anything
+  # (including testing with the minimal dependencies)
+  postPatch = ''
+    substituteInPlace setup.py --replace ", 'nose'" ""
   '';
 
+  propagatedBuildInputs = [ numpy scipy sparse ];
+
+  checkInputs = [ pytestCheckHook ];
+  pytestFlagsArray = [ "tensorly" ];
+
   pythonImportsCheck = [ "tensorly" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/uritemplate/default.nix b/pkgs/development/python-modules/uritemplate/default.nix
index 5077267528a5..814e7fd8c19a 100644
--- a/pkgs/development/python-modules/uritemplate/default.nix
+++ b/pkgs/development/python-modules/uritemplate/default.nix
@@ -1,25 +1,38 @@
-{ lib, buildPythonPackage, fetchPypi, simplejson, pytest, glibcLocales }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, simplejson
+, pytestCheckHook
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "uritemplate";
-  version = "3.0.1";
+  version = "4.1.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "5af8ad10cec94f215e3f48112de2022e1d5a37ed427fbd88652fa908f2ab7cae";
+    sha256 = "sha256-Q0bt/Fw7efaUvM1tYJmjIrvrYo2/LNhu6lWkVs5RJPA=";
   };
 
-  propagatedBuildInputs = [ simplejson ];
+  propagatedBuildInputs = [
+    simplejson
+  ];
 
-  checkInputs = [ pytest glibcLocales ];
+  checkInputs = [
+    pytestCheckHook
+  ];
 
-  checkPhase = ''
-    LC_ALL=en_US.UTF-8 py.test
-  '';
+  pythonImportsCheck = [
+    "uritemplate"
+  ];
 
   meta = with lib; {
+    description = "Implementation of RFC 6570 URI templates";
     homepage = "https://github.com/python-hyper/uritemplate";
-    description = "URI template parsing for Humans";
     license = with licenses; [ asl20 bsd3 ];
     maintainers = with maintainers; [ matthiasbeyer ];
   };
diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 6283e7d33e84..ee3009a633c9 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -46,13 +46,13 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.0.706";
+  version = "2.0.707";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = version;
-    sha256 = "sha256-j9exVvGY3A23sTY5y4daWlZr7awkY1tQhTDykW9tsJU=";
+    sha256 = "sha256-AsKsv3fKubFZZMZHBRuVmgeGJB1zTe00J2kmqikBiD8=";
   };
 
   nativeBuildInputs = with py.pkgs; [
diff --git a/pkgs/development/tools/misc/clojure-lsp/default.nix b/pkgs/development/tools/misc/clojure-lsp/default.nix
index 5e3c750852df..2e11ad9f8add 100644
--- a/pkgs/development/tools/misc/clojure-lsp/default.nix
+++ b/pkgs/development/tools/misc/clojure-lsp/default.nix
@@ -17,10 +17,14 @@ buildGraalvmNativeImage rec {
   };
 
   # https://github.com/clojure-lsp/clojure-lsp/blob/2021.11.02-15.24.47/graalvm/native-unix-compile.sh#L18-L27
-  DTLV_LIB_EXTRACT_DIR = "/tmp";
+  # Needs to be inject on `nativeImageBuildArgs` inside shell environment,
+  # otherwise we can't expand to the value set in `mktemp -d` call
+  preBuild = ''
+    export DTLV_LIB_EXTRACT_DIR="$(mktemp -d)"
+    nativeImageBuildArgs+=("-H:CLibraryPath=$DTLV_LIB_EXTRACT_DIR")
+  '';
 
   extraNativeImageBuildArgs = [
-    "-H:CLibraryPath=${DTLV_LIB_EXTRACT_DIR}"
     "--no-fallback"
     "--native-image-info"
   ];
diff --git a/pkgs/tools/security/quark-engine/default.nix b/pkgs/tools/security/quark-engine/default.nix
index 00e495f718d9..4db3ce4167f3 100644
--- a/pkgs/tools/security/quark-engine/default.nix
+++ b/pkgs/tools/security/quark-engine/default.nix
@@ -7,8 +7,7 @@
 python3.pkgs.buildPythonApplication rec {
   pname = "quark-engine";
   version = "21.10.2";
-
-  disabled = python3.pythonOlder "3.6";
+  format = "setuptools";
 
   src = fetchFromGitHub {
     owner = pname;
@@ -31,10 +30,17 @@ python3.pkgs.buildPythonApplication rec {
     tqdm
   ];
 
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "prompt-toolkit==3.0.19" "prompt-toolkit>=3.0.19"
+  '';
+
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "quark" ];
+  pythonImportsCheck = [
+    "quark"
+  ];
 
   meta = with lib; {
     description = "Android malware (analysis and scoring) system";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 13868fee3c9d..98754dfb8370 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8536,7 +8536,9 @@ with pkgs;
 
   ovh-ttyrec = callPackage ../tools/misc/ovh-ttyrec { };
 
-  ovito = libsForQt5.callPackage ../applications/graphics/ovito { };
+  ovito = libsForQt5.callPackage ../applications/graphics/ovito {
+    inherit (darwin.apple_sdk.frameworks) VideoDecodeAcceleration;
+  };
 
   owncloud-client = libsForQt5.callPackage ../applications/networking/owncloud-client { };
 
@@ -28138,6 +28140,8 @@ with pkgs;
 
   qemu-utils = callPackage ../applications/virtualization/qemu/utils.nix {};
 
+  wrapQemuBinfmtP = callPackage ../applications/virtualization/qemu/binfmt-p-wrapper.nix { };
+
   qgis-unwrapped = libsForQt5.callPackage ../applications/gis/qgis/unwrapped.nix {
     withGrass = false;
   };