diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
index b3cd9d8c140..f8cc0daccb9 100644
--- a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@@ -38,14 +38,17 @@
 , xdg-utils
 }:
 
+let
+  getFirst = n: v: builtins.concatStringsSep "." (lib.take n (lib.splitString "." v));
+in
+
 stdenv.mkDerivation rec {
   pname = "bluejeans";
-  version = "2.21.3";
-  buildNumber = "2";
+  version = "2.22.0.87";
 
   src = fetchurl {
-    url = "https://swdl.bluejeans.com/desktop-app/linux/${version}/BlueJeans_${version}.${buildNumber}.rpm";
-    sha256 = "sha256-a/REuxkqZmLLa7N3CUgUAdq74VMD9D10a/Sx2jOj1QA=";
+    url = "https://swdl.bluejeans.com/desktop-app/linux/${getFirst 3 version}/BlueJeans_${version}.rpm";
+    sha256 = "sha256-0nobn+YcvqakwvBdkoEJrzHoL+OGym2zJ806oUabYfo=";
   };
 
   nativeBuildInputs = [ rpmextract makeWrapper ];
@@ -106,7 +109,7 @@ stdenv.mkDerivation rec {
       --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
       opt/BlueJeans/resources/BluejeansHelper
 
-    cc $localtime64_stub -shared -o "$out"/opt/BlueJeans/liblocaltime64_stub.so
+    cc $localtime64_stub -shared -o "${placeholder "out"}"/opt/BlueJeans/liblocaltime64_stub.so
 
     makeWrapper $out/opt/BlueJeans/bluejeans-v2 $out/bin/bluejeans \
       --set LD_LIBRARY_PATH "${libPath}":"${placeholder "out"}"/opt/BlueJeans \
@@ -119,6 +122,8 @@ stdenv.mkDerivation rec {
     patchShebangs "$out"
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     description = "Video, audio, and web conferencing that works together with the collaboration tools you use every day";
     homepage = "https://www.bluejeans.com";
@@ -127,3 +132,4 @@ stdenv.mkDerivation rec {
     platforms = [ "x86_64-linux" ];
   };
 }
+
diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/update.sh b/pkgs/applications/networking/instant-messengers/bluejeans/update.sh
new file mode 100755
index 00000000000..2c527462003
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/update.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl pup common-updater-scripts
+
+set -eu -o pipefail
+
+version="$(curl -Ls https://www.bluejeans.com/download | \
+    pup 'a[aria-label~="Linux"] attr{href}' | \
+    #output contains *.deb and *.rpm
+    grep "\.rpm" | \
+    awk -F'[ ._ ]' '{printf $6"."$7"."$8"."$9"\n"}')"
+
+update-source-version bluejeans-gui "$version"
diff --git a/pkgs/development/libraries/libspf2/default.nix b/pkgs/development/libraries/libspf2/default.nix
index 6a9cb8b647c..dc46e356e2c 100644
--- a/pkgs/development/libraries/libspf2/default.nix
+++ b/pkgs/development/libraries/libspf2/default.nix
@@ -17,6 +17,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/shevek/libspf2/commit/5852828582f556e73751076ad092f72acf7fc8b6.patch";
       sha256 = "1v6ashqzpr0xidxq0vpkjd8wd66cj8df01kyzj678ljzcrax35hk";
     })
+    (fetchurl {
+      name = "0002-CVE-2021-20314.patch";
+      url = "https://github.com/shevek/libspf2/commit/c37b7c13c30e225183899364b9f2efdfa85552ef.patch";
+      sha256 = "190nnh7mlz6328829ba6jajad16s3md8kraspn81qnvhwh0nkiak";
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/development/tools/analysis/sparse/default.nix b/pkgs/development/tools/analysis/sparse/default.nix
index e0d9840472b..a234aa2d7cf 100644
--- a/pkgs/development/tools/analysis/sparse/default.nix
+++ b/pkgs/development/tools/analysis/sparse/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, pkg-config, libxml2, llvm }:
+{ fetchurl, lib, stdenv, pkg-config, libxml2, llvm, perl }:
 
 stdenv.mkDerivation rec {
   name = "sparse-0.5.0";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libxml2 llvm ];
+  buildInputs = [ libxml2 llvm perl ];
   doCheck = true;
 
   meta = {
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 24e23f2b7e9..4f3c3a79f5b 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -91,7 +91,7 @@ let
 
   self = stdenv.mkDerivation rec {
     pname = "fwupd";
-    version = "1.5.7";
+    version = "1.5.12";
 
     # libfwupd goes to lib
     # daemon, plug-ins and libfwupdplugin go to out
@@ -100,7 +100,7 @@ let
 
     src = fetchurl {
       url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-      sha256 = "16isrrv6zhdgccbfnz7km5g1cnvfnip7aiidkfhf5dlnrnyb2sxh";
+      sha256 = "sha256-BluwLlm6s/2H/USARQpAvDR0+X8WP/q0h8VvxA6Qftc=";
     };
 
     patches = [
@@ -296,7 +296,6 @@ let
         "fwupd/thunderbolt.conf"
         "fwupd/upower.conf"
         "fwupd/uefi_capsule.conf"
-        "pki/fwupd/GPG-KEY-Hughski-Limited"
         "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
         "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
         "pki/fwupd/LVFS-CA.pem"
diff --git a/pkgs/os-specific/linux/kernel/linux-zen.nix b/pkgs/os-specific/linux/kernel/linux-zen.nix
index 2b91a259232..712f3f08895 100644
--- a/pkgs/os-specific/linux/kernel/linux-zen.nix
+++ b/pkgs/os-specific/linux/kernel/linux-zen.nix
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub, buildLinux, ... } @ args:
 
 let
-  version = "5.13.7";
+  version = "5.13.9";
   suffix = "zen1";
 in
 
@@ -14,7 +14,7 @@ buildLinux (args // {
     owner = "zen-kernel";
     repo = "zen-kernel";
     rev = "v${version}-${suffix}";
-    sha256 = "sha256-ZvB5Ejt9MXP4QK5cj9CGQgFJIfDV03IW5xcknCxDui0=";
+    sha256 = "sha256-RuY6ZIIKU56R+IGMtQDV6mIubGDqonRpsIdlrpAHFXM=";
   };
 
   structuredExtraConfig = with lib.kernel; {