diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 935097ed9d90..8451971f2cfb 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -8,7 +8,7 @@
 # Mentioned users will get code review requests.
 
 # Release managers, release branch only
-/ @jonringer
+* @jonringer
 
 # This file
 /.github/CODEOWNERS @edolstra
diff --git a/nixos/modules/hardware/hackrf.nix b/nixos/modules/hardware/hackrf.nix
new file mode 100644
index 000000000000..7f03b765bbda
--- /dev/null
+++ b/nixos/modules/hardware/hackrf.nix
@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.hardware.hackrf;
+
+in
+{
+  options.hardware.hackrf = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enables hackrf udev rules and ensures 'plugdev' group exists.
+        This is a prerequisite to using HackRF devices without being root, since HackRF USB descriptors will be owned by plugdev through udev.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.udev.packages = [ pkgs.hackrf ];
+    users.groups.plugdev = { };
+  };
+}
diff --git a/nixos/modules/hardware/rtl-sdr.nix b/nixos/modules/hardware/rtl-sdr.nix
index 9605c7967f61..e85fc04e29bb 100644
--- a/nixos/modules/hardware/rtl-sdr.nix
+++ b/nixos/modules/hardware/rtl-sdr.nix
@@ -5,10 +5,14 @@ let
 
 in {
   options.hardware.rtl-sdr = {
-    enable = lib.mkEnableOption ''
-      Enables rtl-sdr udev rules, ensures 'plugdev' group exists, and blacklists DVB kernel modules.
-      This is a prerequisite to using devices supported by rtl-sdr without being root, since rtl-sdr USB descriptors will be owned by plugdev through udev.
-    '';
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enables rtl-sdr udev rules, ensures 'plugdev' group exists, and blacklists DVB kernel modules.
+        This is a prerequisite to using devices supported by rtl-sdr without being root, since rtl-sdr USB descriptors will be owned by plugdev through udev.
+       '';
+    };
   };
 
   config = lib.mkIf cfg.enable {
diff --git a/nixos/modules/misc/meta.nix b/nixos/modules/misc/meta.nix
index 1410e33342a6..10b7fc6d95e4 100644
--- a/nixos/modules/misc/meta.nix
+++ b/nixos/modules/misc/meta.nix
@@ -54,6 +54,18 @@ in
         '';
       };
 
+      buildDocsInSandbox = mkOption {
+        type = types.bool // {
+          merge = loc: defs: defs;
+        };
+        internal = true;
+        default = false;
+        description = ''
+          This is an effectless placeholder, so modules from master don't fail to evaluate on systems based on nixos-21.11.
+          See <link xlink:href="https://github.com/NixOS/nixpkgs/pull/149532"/>
+        '';
+      };
+
     };
   };
 
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c397271e2f3e..d04243173cfb 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -51,6 +51,7 @@
   ./hardware/gkraken.nix
   ./hardware/flirc.nix
   ./hardware/i2c.nix
+  ./hardware/hackrf.nix
   ./hardware/sensor/hddtemp.nix
   ./hardware/sensor/iio.nix
   ./hardware/keyboard/teck.nix
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 6416400ce431..3c927246b2c4 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -907,7 +907,7 @@ in
         PrivateMounts = true;
         # System Call Filtering
         SystemCallArchitectures = "native";
-        SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid @mincore";
+        SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid";
       };
     };
 
diff --git a/nixos/modules/virtualisation/amazon-image.nix b/nixos/modules/virtualisation/amazon-image.nix
index fe248a94488b..bd7077ff7ea1 100644
--- a/nixos/modules/virtualisation/amazon-image.nix
+++ b/nixos/modules/virtualisation/amazon-image.nix
@@ -155,7 +155,7 @@ in
     systemd.services."serial-getty@ttyS0".enable = true;
 
     # Creates symlinks for block device names.
-    services.udev.packages = [ pkgs.ec2-utils ];
+    services.udev.packages = [ pkgs.amazon-ec2-utils ];
 
     # Force getting the hostname from EC2.
     networking.hostName = mkDefault "";
diff --git a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
index 7bd27285fd47..2395a196f605 100644
--- a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jitsi-meet-electron";
-  version = "2.8.11";
+  version = "2022.1.1";
 
   src = fetchurl {
     url = "https://github.com/jitsi/jitsi-meet-electron/releases/download/v${version}/jitsi-meet-x86_64.AppImage";
-    sha256 = "sha256-DznbSwA1UISw3EkIfM5hGgmIToeXsH1b1HB7UOgDTKU=";
+    sha256 = "0x3fdqgjnsd570b7nszfx3h8l5c8x2kg32ig85n2a2g481c7xi6l";
     name = "${pname}-${version}.AppImage";
   };
 
diff --git a/pkgs/applications/networking/onionshare/default.nix b/pkgs/applications/networking/onionshare/default.nix
index 5b1a1fad5b1a..e7b661ae6ae7 100644
--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@@ -8,7 +8,7 @@
 , flask
 , flask-httpauth
 , flask-socketio
-, stem
+, cepa
 , psutil
 , pyqt5
 , pycrypto
@@ -21,15 +21,16 @@
 , unidecode
 , tor
 , obfs4
+, snowflake
 }:
 
 let
-  version = "2.4";
+  version = "2.5";
   src = fetchFromGitHub {
     owner = "onionshare";
     repo = "onionshare";
     rev = "v${version}";
-    sha256 = "sha256-Lclm7mIkaAkQpWcNILTRJtLA43dpiyHtWAeHS2r3+ZQ=";
+    sha256 = "xCAM+tjjyDg/gqAXr4YNPhM8R3n9r895jktisAGlpZo=";
   };
   meta = with lib; {
     description = "Securely and anonymously send and receive files";
@@ -55,16 +56,9 @@ let
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ lourkeur ];
   };
-  stem' = stem.overridePythonAttrs (_: rec {
-    version = "1.8.1";
 
-    src = fetchFromGitHub {
-      owner = "onionshare";
-      repo = "stem";
-      rev = version;
-      sha256 = "Dzpvx7CgAr5OtGmfubWAYDLqq5LkGqcwjr3bxpfL/3A=";
-    };
-  });
+  # TODO: package meek https://support.torproject.org/glossary/meek/
+  meek = "/meek-not-available";
 
 in
 rec {
@@ -76,7 +70,7 @@ rec {
       # hardcode store paths of dependencies
       (substituteAll {
         src = ./fix-paths.patch;
-        inherit tor obfs4;
+        inherit tor meek obfs4 snowflake;
         inherit (tor) geoip;
       })
     ];
@@ -86,7 +80,7 @@ rec {
       flask
       flask-httpauth
       flask-socketio
-      stem'
+      cepa
       psutil
       pycrypto
       pynacl
@@ -109,8 +103,6 @@ rec {
     '';
 
     disabledTests = [
-      "test_firefox_like_behavior"
-      "test_if_unmodified_since"
       "test_get_tor_paths_linux"  # expects /usr instead of /nix/store
     ] ++ lib.optionals stdenv.isDarwin [
       # on darwin (and only on darwin) onionshare attempts to discover
@@ -123,12 +115,12 @@ rec {
   onionshare-gui = buildPythonApplication {
     pname = "onionshare";
     inherit version meta;
-    src = "${src}/desktop/src";
+    src = "${src}/desktop";
     patches = [
       # hardcode store paths of dependencies
       (substituteAll {
         src = ./fix-paths-gui.patch;
-        inherit tor obfs4;
+        inherit tor meek obfs4 snowflake;
         inherit (tor) geoip;
       })
     ];
diff --git a/pkgs/applications/networking/onionshare/fix-paths-gui.patch b/pkgs/applications/networking/onionshare/fix-paths-gui.patch
index 841af8fa95af..4eb611c860db 100644
--- a/pkgs/applications/networking/onionshare/fix-paths-gui.patch
+++ b/pkgs/applications/networking/onionshare/fix-paths-gui.patch
@@ -1,25 +1,46 @@
 --- a/onionshare/gui_common.py
 +++ b/onionshare/gui_common.py
-@@ -391,29 +391,10 @@ class GuiCommon:
+@@ -410,52 +410,12 @@ class GuiCommon:
          }
  
      def get_tor_paths(self):
 -        if self.common.platform == "Linux":
--            tor_path = shutil.which("tor")
--            obfs4proxy_file_path = shutil.which("obfs4proxy")
--            prefix = os.path.dirname(os.path.dirname(tor_path))
--            tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
--            tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
--        elif self.common.platform == "Windows":
+-            base_path = self.get_resource_path("tor")
+-            if base_path and os.path.isdir(base_path):
+-                self.common.log(
+-                    "GuiCommon", "get_tor_paths", "using paths in resources"
+-                )
+-                tor_path = os.path.join(base_path, "tor")
+-                tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+-                tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
+-                obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-                snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-                meek_client_file_path = os.path.join(base_path, "meek-client")
+-            else:
+-                # Fallback to looking in the path
+-                self.common.log("GuiCommon", "get_tor_paths", "using paths from PATH")
+-                tor_path = shutil.which("tor")
+-                obfs4proxy_file_path = shutil.which("obfs4proxy")
+-                snowflake_file_path = shutil.which("snowflake-client")
+-                meek_client_file_path = shutil.which("meek-client")
+-                prefix = os.path.dirname(os.path.dirname(tor_path))
+-                tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
+-                tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-
+-        if self.common.platform == "Windows":
 -            base_path = self.get_resource_path("tor")
 -            tor_path = os.path.join(base_path, "Tor", "tor.exe")
 -            obfs4proxy_file_path = os.path.join(base_path, "Tor", "obfs4proxy.exe")
+-            snowflake_file_path = os.path.join(base_path, "Tor", "snowflake-client.exe")
+-            meek_client_file_path = os.path.join(base_path, "Tor", "meek-client.exe")
 -            tor_geo_ip_file_path = os.path.join(base_path, "Data", "Tor", "geoip")
 -            tor_geo_ipv6_file_path = os.path.join(base_path, "Data", "Tor", "geoip6")
 -        elif self.common.platform == "Darwin":
 -            base_path = self.get_resource_path("tor")
 -            tor_path = os.path.join(base_path, "tor")
 -            obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-            snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-            meek_client_file_path = os.path.join(base_path, "meek-client")
 -            tor_geo_ip_file_path = os.path.join(base_path, "geoip")
 -            tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
 -        elif self.common.platform == "BSD":
@@ -27,10 +48,14 @@
 -            tor_geo_ip_file_path = "/usr/local/share/tor/geoip"
 -            tor_geo_ipv6_file_path = "/usr/local/share/tor/geoip6"
 -            obfs4proxy_file_path = "/usr/local/bin/obfs4proxy"
+-            meek_client_file_path = "/usr/local/bin/meek-client"
+-            snowflake_file_path = "/usr/local/bin/snowflake-client"
 +        tor_path = "@tor@/bin/tor"
 +        tor_geo_ip_file_path = "@geoip@/share/tor/geoip"
 +        tor_geo_ipv6_file_path = "@geoip@/share/tor/geoip6"
 +        obfs4proxy_file_path = "@obfs4@/bin/obfs4proxy"
++        meek_client_file_path = "@meek@/bin/meek-client"
++        snowflake_file_path = "@snowflake@/bin/snowflake-client"
  
          return (
              tor_path,
diff --git a/pkgs/applications/networking/onionshare/fix-paths.patch b/pkgs/applications/networking/onionshare/fix-paths.patch
index 9280ec4d255a..fec4b4e0395b 100644
--- a/pkgs/applications/networking/onionshare/fix-paths.patch
+++ b/pkgs/applications/networking/onionshare/fix-paths.patch
@@ -1,41 +1,76 @@
 --- a/onionshare_cli/common.py
 +++ b/onionshare_cli/common.py
-@@ -308,33 +308,10 @@ class Common:
+@@ -318,67 +318,12 @@ class Common:
          return path
-
+ 
      def get_tor_paths(self):
 -        if self.platform == "Linux":
 -            tor_path = shutil.which("tor")
 -            if not tor_path:
 -                raise CannotFindTor()
 -            obfs4proxy_file_path = shutil.which("obfs4proxy")
+-            snowflake_file_path = shutil.which("snowflake-client")
+-            meek_client_file_path = shutil.which("meek-client")
 -            prefix = os.path.dirname(os.path.dirname(tor_path))
 -            tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
 -            tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
 -        elif self.platform == "Windows":
+-            # In Windows, the Tor binaries are in the onionshare package, not the onionshare_cli package
 -            base_path = self.get_resource_path("tor")
+-            base_path = base_path.replace("onionshare_cli", "onionshare")
 -            tor_path = os.path.join(base_path, "Tor", "tor.exe")
+-
+-            # If tor.exe isn't there, mayber we're running from the source tree
+-            if not os.path.exists(tor_path):
+-                base_path = os.path.join(os.getcwd(), "onionshare", "resources", "tor")
+-
+-                tor_path = os.path.join(base_path, "Tor", "tor.exe")
+-                if not os.path.exists(tor_path):
+-                    raise CannotFindTor()
+-
 -            obfs4proxy_file_path = os.path.join(base_path, "Tor", "obfs4proxy.exe")
+-            snowflake_file_path = os.path.join(base_path, "Tor", "snowflake-client.exe")
+-            meek_client_file_path = os.path.join(base_path, "Tor", "meek-client.exe")
 -            tor_geo_ip_file_path = os.path.join(base_path, "Data", "Tor", "geoip")
 -            tor_geo_ipv6_file_path = os.path.join(base_path, "Data", "Tor", "geoip6")
+-
 -        elif self.platform == "Darwin":
--            tor_path = shutil.which("tor")
--            if not tor_path:
--                raise CannotFindTor()
--            obfs4proxy_file_path = shutil.which("obfs4proxy")
--            prefix = os.path.dirname(os.path.dirname(tor_path))
--            tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
--            tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-            # Let's see if we have tor binaries in the onionshare GUI package
+-            base_path = self.get_resource_path("tor")
+-            base_path = base_path.replace("onionshare_cli", "onionshare")
+-            tor_path = os.path.join(base_path, "tor")
+-            if os.path.exists(tor_path):
+-                obfs4proxy_file_path = os.path.join(base_path, "obfs4proxy")
+-                snowflake_file_path = os.path.join(base_path, "snowflake-client")
+-                meek_client_file_path = os.path.join(base_path, "meek-client")
+-                tor_geo_ip_file_path = os.path.join(base_path, "geoip")
+-                tor_geo_ipv6_file_path = os.path.join(base_path, "geoip6")
+-            else:
+-                # Fallback to looking in the path
+-                tor_path = shutil.which("tor")
+-                if not os.path.exists(tor_path):
+-                    raise CannotFindTor()
+-
+-                obfs4proxy_file_path = shutil.which("obfs4proxy")
+-                snowflake_file_path = shutil.which("snowflake-client")
+-                meek_client_file_path = shutil.which("meek-client")
+-                prefix = os.path.dirname(os.path.dirname(tor_path))
+-                tor_geo_ip_file_path = os.path.join(prefix, "share/tor/geoip")
+-                tor_geo_ipv6_file_path = os.path.join(prefix, "share/tor/geoip6")
+-
 -        elif self.platform == "BSD":
 -            tor_path = "/usr/local/bin/tor"
 -            tor_geo_ip_file_path = "/usr/local/share/tor/geoip"
 -            tor_geo_ipv6_file_path = "/usr/local/share/tor/geoip6"
 -            obfs4proxy_file_path = "/usr/local/bin/obfs4proxy"
+-            snowflake_file_path = "/usr/local/bin/snowflake-client"
+-            meek_client_file_path = "/usr/local/bin/meek-client"
 +        tor_path = "@tor@/bin/tor"
 +        tor_geo_ip_file_path = "@geoip@/share/tor/geoip"
 +        tor_geo_ipv6_file_path = "@geoip@/share/tor/geoip6"
 +        obfs4proxy_file_path = "@obfs4@/bin/obfs4proxy"
-
++        snowflake_file_path = "@snowflake@/bin/snowflake-client"
++        meek_client_file_path = "@meek@/bin/meek-client"
+ 
          return (
              tor_path,
-
diff --git a/pkgs/desktops/gnome/core/evolution-data-server/default.nix b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
index 9c1fd1658ec1..048fe600797b 100644
--- a/pkgs/desktops/gnome/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome/core/evolution-data-server/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.42.1";
+  version = "3.42.3";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "5uZ/KnfQ/z5tpQsD3F+iZucWYmvNou9EFE4xfjXy9Sg=";
+    sha256 = "b1hHoSNHmQc+lYXbhhwhOBoJ7VUNwKISXwC6X5C9Nh0=";
   };
 
   patches = [
diff --git a/pkgs/development/ocaml-modules/janestreet/default.nix b/pkgs/development/ocaml-modules/janestreet/default.nix
index 679ef4a58e48..ee906a722501 100644
--- a/pkgs/development/ocaml-modules/janestreet/default.nix
+++ b/pkgs/development/ocaml-modules/janestreet/default.nix
@@ -299,9 +299,9 @@ with self;
   };
 
   core = janePackage {
-    version = "0.11.2";
+    version = "0.11.3";
     pname = "core";
-    hash = "0vpsvd75lxb09il2rnzyib9mlr51v1hzqdc9fdxgx353pb5agh8a";
+    hash = "0pzl8n09z4f3i7z2wq4cjxfqrr8mj6xcdp7rbg0nxap2zdhjgvrq";
     propagatedBuildInputs = [ core_kernel spawn ];
     meta.description = "Jane Street's standard library overlay";
   };
diff --git a/pkgs/development/ocaml-modules/ocsigen-server/default.nix b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
index 96a66874c759..67ec458a122d 100644
--- a/pkgs/development/ocaml-modules/ocsigen-server/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-server/default.nix
@@ -37,7 +37,7 @@ buildDunePackage rec {
     ocaml_pcre xml-light
   ];
 
-  configureFlags = [ "--root $(out)" "--prefix /" ];
+  configureFlags = [ "--root $(out)" "--prefix /" "--temproot ''" ];
 
   dontAddPrefix = true;
   dontAddStaticConfigureFlags = true;
@@ -47,6 +47,10 @@ buildDunePackage rec {
     make -C src confs
   '';
 
+  postInstall = ''
+    make install.files
+  '';
+
   postFixup =
   ''
   rm -rf $out/var/run
diff --git a/pkgs/development/python-modules/cepa/default.nix b/pkgs/development/python-modules/cepa/default.nix
new file mode 100644
index 000000000000..f198d8b058dd
--- /dev/null
+++ b/pkgs/development/python-modules/cepa/default.nix
@@ -0,0 +1,32 @@
+{ lib, buildPythonPackage, fetchPypi, python, mock }:
+
+buildPythonPackage rec {
+  pname = "cepa";
+  version = "1.8.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "HcbwsyTTei7SyidGSOzo/SyWodL0QPWMDKF6/Ute3no=";
+  };
+
+  postPatch = ''
+    rm test/unit/installation.py
+    sed -i "/test.unit.installation/d" test/settings.cfg
+    # https://github.com/torproject/stem/issues/56
+    sed -i '/MOCK_VERSION/d' run_tests.py
+  '';
+
+  checkInputs = [ mock ];
+
+  checkPhase = ''
+    touch .gitignore
+    ${python.interpreter} run_tests.py -u
+  '';
+
+  meta = with lib; {
+    description = "Controller library that allows applications to interact with Tor";
+    homepage = "https://github.com/onionshare/cepa";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ lourkeur ];
+  };
+}
diff --git a/pkgs/development/r-modules/default.nix b/pkgs/development/r-modules/default.nix
index f48d41e25f2b..84474e20d3ce 100644
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@@ -285,13 +285,13 @@ let
     Biostrings = [ pkgs.zlib ];
     bnpmr = [ pkgs.gsl ];
     cairoDevice = [ pkgs.gtk2.dev ];
-    Cairo = with pkgs; [ libtiff libjpeg cairo.dev x11 fontconfig.lib ];
+    Cairo = with pkgs; [ libtiff libjpeg cairo.dev xlibsWrapper fontconfig.lib ];
     Cardinal = [ pkgs.which ];
     chebpol = [ pkgs.fftw ];
     ChemmineOB = with pkgs; [ openbabel pkg-config ];
     curl = [ pkgs.curl.dev ];
     data_table = [ pkgs.zlib.dev ] ++ lib.optional stdenv.isDarwin pkgs.llvmPackages.openmp;
-    devEMF = with pkgs; [ xorg.libXft.dev x11 ];
+    devEMF = with pkgs; [ xorg.libXft.dev xlibsWrapper ];
     diversitree = with pkgs; [ gsl fftw ];
     exactextractr = [ pkgs.geos ];
     EMCluster = [ pkgs.lapack ];
@@ -311,7 +311,7 @@ let
     h5vc = [ pkgs.zlib.dev ];
     HDF5Array = [ pkgs.zlib.dev ];
     HiCseg = [ pkgs.gsl ];
-    imager = [ pkgs.x11 ];
+    imager = [ pkgs.xlibsWrapper ];
     iBMQ = [ pkgs.gsl ];
     igraph = with pkgs; [ gmp libxml2.dev ];
     JavaGD = [ pkgs.jdk ];
diff --git a/pkgs/development/tools/database/clickhouse-backup/default.nix b/pkgs/development/tools/database/clickhouse-backup/default.nix
new file mode 100644
index 000000000000..6090bc1d75b7
--- /dev/null
+++ b/pkgs/development/tools/database/clickhouse-backup/default.nix
@@ -0,0 +1,27 @@
+{ buildGoModule, lib, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "clickhouse-backup";
+  version = "1.2.2";
+
+  src = fetchFromGitHub {
+    owner = "AlexAkulov";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-ThN1uvofIvV5Dt6dqxLpekTRy9pV4xb0bkVNRcfNJ2c=";
+  };
+
+  vendorSha256 = "sha256-OQGpWWerUv2asjpjMLAkgeb0Q+lMAsDXjFCh0I4ze20=";
+
+  postConfigure = ''
+    export CGO_ENABLED=0
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/AlexAkulov/clickhouse-backup";
+    description = "Tool for easy ClickHouse backup and restore with cloud storages support";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ma27 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/development/tools/electron/generic.nix b/pkgs/development/tools/electron/generic.nix
index f70767a05919..913cc99ca575 100644
--- a/pkgs/development/tools/electron/generic.nix
+++ b/pkgs/development/tools/electron/generic.nix
@@ -28,7 +28,7 @@ let
     maintainers = with maintainers; [ travisbhartwell manveru prusnak ];
     platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ]
       ++ optionals (versionAtLeast version "11.0.0") [ "aarch64-darwin" ];
-    knownVulnerabilities = optional (versionOlder version "13.0.0") "Electron version ${version} is EOL";
+    knownVulnerabilities = optional (versionOlder version "14.0.0") "Electron version ${version} is EOL";
   };
 
   fetcher = vers: tag: hash: fetchurl {
diff --git a/pkgs/servers/dns/knot-dns/default.nix b/pkgs/servers/dns/knot-dns/default.nix
index 1938e9c02b66..80939b8df45d 100644
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.1.5";
+  version = "3.1.6";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "2da6e50b0662297d55f80e349568224e07fe88cad20bee1d2e22f54bb32da064";
+    sha256 = "e9ba1305d750dc08fb08687aec7ac55737ca073deaa0b867c884e0c0f2fdb753";
   };
 
   outputs = [ "bin" "out" "dev" ];
diff --git a/pkgs/tools/admin/amazon-ec2-utils/default.nix b/pkgs/tools/admin/amazon-ec2-utils/default.nix
index 2dc91f037a98..f6e92bd5287e 100644
--- a/pkgs/tools/admin/amazon-ec2-utils/default.nix
+++ b/pkgs/tools/admin/amazon-ec2-utils/default.nix
@@ -2,36 +2,55 @@
 , lib
 , fetchFromGitHub
 , curl
+, gawk
 , python3
+, installShellFiles
 }:
 stdenv.mkDerivation rec {
   pname = "amazon-ec2-utils";
-  version = "1.3";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-ec2-utils";
-    rev = version;
-    hash = "sha256:04dpxaaca144a74r6d93q4lp0d5l32v07rldj7v2v1c6s9nsf4mv";
+    rev = "v${version}";
+    hash = "sha256-u1rHBV8uVcCywvQNYagtDleYB12tmhyqDbXTBzt45dk=";
   };
 
+  outputs = [ "out" "man" ];
+
+  strictDeps = true;
   buildInputs = [
     python3
   ];
-
-  propagatedBuildInputs = [
-    curl
+  nativeBuildInputs = [
+    installShellFiles
   ];
 
   installPhase = ''
-    mkdir -p $out/bin/
+    install -Dm755 -t $out/bin/ ebsnvme-id
+    install -Dm755 -t $out/bin/ ec2-metadata
+    install -Dm755 -t $out/bin/ ec2nvme-nsid
+    install -Dm755 -t $out/bin/ ec2udev-vbd
 
-    cp ebsnvme-id $out/bin/
-    cp ec2-metadata $out/bin/
-    cp ec2udev-vbd $out/bin/
-    cp ec2udev-vcpu $out/bin/
+    install -Dm644 -t $out/lib/udev/rules.d/ 51-ec2-hvm-devices.rules
+    install -Dm644 -t $out/lib/udev/rules.d/ 51-ec2-xen-vbd-devices.rules
+    install -Dm644 -t $out/lib/udev/rules.d/ 53-ec2-read-ahead-kb.rules
+    install -Dm644 -t $out/lib/udev/rules.d/ 70-ec2-nvme-devices.rules
+    install -Dm644 -t $out/lib/udev/rules.d/ 60-cdrom_id.rules
 
-    chmod +x $out/bin/*
+    installManPage doc/*.8
+  '';
+
+  postFixup = ''
+    for i in $out/etc/udev/rules.d/*.rules $out/lib/udev/rules.d/*.rules ; do
+      substituteInPlace "$i" \
+        --replace '/usr/sbin' "$out/bin" \
+        --replace '/bin/awk' '${gawk}/bin/awk'
+    done
+
+    substituteInPlace "$out/bin/ec2-metadata" \
+      --replace 'curl' '${curl}/bin/curl'
   '';
 
   doInstallCheck = true;
@@ -48,6 +67,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/aws/amazon-ec2-utils";
     description = "Contains a set of utilities and settings for Linux deployments in EC2";
     license = licenses.mit;
-    maintainers = with maintainers; [ ketzacoatl ];
+    maintainers = with maintainers; [ ketzacoatl thefloweringash ];
   };
 }
diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix
index 74d4b61064bd..bd231c02397e 100644
--- a/pkgs/tools/networking/mailutils/default.nix
+++ b/pkgs/tools/networking/mailutils/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mailutils";
-  version = "3.12";
+  version = "3.13";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0n51ng1f8yf5zfsnh8s0pj9bnw6icb2r0y78gl2kzijaghhzlhvd";
+    hash = "sha256-2SCXHctJh4oAmRF3T9ZATxPSe9EB4tWbZkooZZpAlMc=";
   };
 
   postPatch = ''
@@ -16,7 +16,6 @@ stdenv.mkDerivation rec {
            -e 's/chmod [24]755/chmod 0755/' \
       */Makefile{.in,.am}
     sed -i 's:/usr/lib/mysql:${libmysqlclient}/lib/mysql:' configure.ac
-    sed -i 's/0\.18/0.19/' configure.ac
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/networking/snowflake/default.nix b/pkgs/tools/networking/snowflake/default.nix
new file mode 100644
index 000000000000..8535f18567da
--- /dev/null
+++ b/pkgs/tools/networking/snowflake/default.nix
@@ -0,0 +1,21 @@
+{ lib, buildGoModule, fetchgit }:
+
+buildGoModule rec {
+  pname = "snowflake";
+  version = "2.0.1";
+
+  src = fetchgit {
+    url = "https://git.torproject.org/pluggable-transports/${pname}";
+    rev = "v${version}";
+    hash = "sha256-ULkqsh0DeFI1GsaVaHGSjoEY38EktvDVC52Sx6cQLOE=";
+  };
+
+  vendorSha256 = "D5A19UHL1WEE1ODT80jKT+PJ5CTXPjc9Eg6v2Nfm4aw=";
+
+  meta = with lib; {
+    description = "System to defeat internet censorship";
+    homepage = "https://snowflake.torproject.org/";
+    maintainers = with maintainers; [ lourkeur ];
+    license = licenses.bsd3;
+  };
+}
diff --git a/pkgs/tools/virtualization/ec2-utils/default.nix b/pkgs/tools/virtualization/ec2-utils/default.nix
deleted file mode 100644
index 1605bcfa43b6..000000000000
--- a/pkgs/tools/virtualization/ec2-utils/default.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ stdenv, lib, rpmextract, fetchurl, python2, tree }:
-
-stdenv.mkDerivation {
-  name = "ec2-utils";
-  version = "0.5.1";
-
-  # The url can be determined by booting an "Amazon Linux 2" and running:
-  # > yumdownloader --urls ec2-utils
-  src = fetchurl {
-    url = "http://amazonlinux.ap-northeast-1.amazonaws.com/blobstore/a3b4d2c35c2300518fe10381a05b3bd7936ff5cdd3d351143a11bf84073d9e00/ec2-utils-0.5-1.amzn2.0.1.noarch.rpm";
-    sha256 = "004y7l3q9gqi78a53lykrpsnz4yp7dds1083w67m2013bk1x5d53";
-  };
-
-  nativeBuildInputs = [ rpmextract ];
-
-  buildInputs = [ python2 ];
-
-  unpackPhase = ''
-    mkdir source
-    cd source
-    rpmextract "$src"
-  '';
-
-  installPhase = ''
-    mkdir $out
-
-    mv --target-directory $out \
-      etc sbin usr/bin usr/lib
-  '';
-
-  postFixup = ''
-    for i in $out/etc/udev/rules.d/*.rules; do
-      substituteInPlace "$i" \
-        --replace '/sbin' "$out/bin"
-    done
-
-    substituteInPlace "$out/etc/udev/rules.d/70-ec2-nvme-devices.rules" \
-      --replace 'ec2nvme-nsid' "$out/lib/udev/ec2nvme-nsid"
-  '';
-
-  meta = {
-    description = "A set of tools for running in EC2";
-    homepage = "https://aws.amazon.com/amazon-linux-ami/";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ thefloweringash ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 57299912397a..58c9f9b0986b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -215,6 +215,7 @@ mapAliases ({
   dwarf_fortress = dwarf-fortress; # added 2016-01-23
   dwm-git = throw "dwm-git has been removed from nixpkgs, as it had no updates for 2 years not serving it's purpose."; # added 2021-02-07
   dylibbundler = macdylibbundler; # added 2021-04-24
+  ec2-utils = amazon-ec2-utils; # added 2022-02-01
   ec2_ami_tools = ec2-ami-tools; # added 2021-10-08
   ec2_api_tools = ec2-api-tools; # added 2021-10-08
   elasticmq = throw "elasticmq has been removed in favour of elasticmq-server-bin"; # added 2021-01-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 04db63d0fd62..5cda15efd003 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1117,6 +1117,8 @@ with pkgs;
   mcaimi-st = callPackage ../applications/terminal-emulators/st/mcaimi-st.nix { };
   siduck76-st = callPackage ../applications/terminal-emulators/st/siduck76-st.nix { };
 
+  snowflake = callPackage ../tools/networking/snowflake { };
+
   stupidterm = callPackage ../applications/terminal-emulators/stupidterm {
     gtk = gtk3;
   };
@@ -1430,8 +1432,6 @@ with pkgs;
 
   ec2-metadata-mock = callPackage ../development/tools/ec2-metadata-mock { };
 
-  ec2-utils = callPackage ../tools/virtualization/ec2-utils { };
-
   exoscale-cli = callPackage ../tools/admin/exoscale-cli { };
 
   altermime = callPackage ../tools/networking/altermime {};
@@ -20677,6 +20677,8 @@ with pkgs;
 
   clickhouse-cli = with python3Packages; toPythonApplication clickhouse-cli;
 
+  clickhouse-backup = callPackage ../development/tools/database/clickhouse-backup { };
+
   couchdb3 = callPackage ../servers/http/couchdb/3.nix {
     erlang = erlangR22;
   };
@@ -33763,7 +33765,7 @@ with pkgs;
     jami-daemon jami-libclient jami-client-gnome jami-client-qt;
 
   jitsi-meet-electron = callPackage ../applications/networking/instant-messengers/jitsi-meet-electron {
-    electron = electron_13;
+    electron = electron_16;
   };
 
   zenstates = callPackage ../os-specific/linux/zenstates {};
diff --git a/pkgs/top-level/make-tarball.nix b/pkgs/top-level/make-tarball.nix
index c5a5a4376999..a63432236471 100644
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -64,7 +64,7 @@ pkgs.releaseTools.sourceTarball {
     header "generating packages.json"
     mkdir -p $out/nix-support
     echo -n '{"version":2,"packages":' > tmp
-    nix-env -f . -I nixpkgs=$src -qa --json --arg config 'import ${./packages-config.nix}' "''${opts[@]}" >> tmp
+    nix-env -f . -I nixpkgs=$src -qa --meta --json --arg config 'import ${./packages-config.nix}' "''${opts[@]}" >> tmp
     echo -n '}' >> tmp
     packages=$out/packages.json.br
     < tmp sed "s|$(pwd)/||g" | jq -c | brotli -9 > $packages
diff --git a/pkgs/top-level/packages-config.nix b/pkgs/top-level/packages-config.nix
index d7dfbf5860bb..ddd235e393a0 100644
--- a/pkgs/top-level/packages-config.nix
+++ b/pkgs/top-level/packages-config.nix
@@ -13,7 +13,6 @@
       fdbPackages
       fusePackages
       gns3Packages
-      haskellPackages
       idrisPackages
       nodePackages
       nodePackages_latest
@@ -31,6 +30,13 @@
       zeroadPackages
     ;
 
+    haskellPackages = super.haskellPackages // {
+      # mesos, which this depends on, has been removed from nixpkgs. We are keeping
+      # the error message for now, so users will get an error message they can make
+      # sense of, but need to work around it here.
+      hs-mesos = null;
+    };
+
     # This is an alias which we disallow by default; explicitly allow it
     emacs27Packages = emacs27.pkgs;
   };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4cd67fbbba56..31d14238ec4b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1440,6 +1440,8 @@ in {
 
   coqpit = callPackage ../development/python-modules/coqpit { };
 
+  cepa = callPackage ../development/python-modules/cepa { };
+
   cerberus = callPackage ../development/python-modules/cerberus { };
 
   cert-chain-resolver = callPackage ../development/python-modules/cert-chain-resolver { };