Merge remote-tracking branch 'origin/staging-next' into staging

Conflicts: - pkgs/os-specific/windows/mingw-w64/default.nix
2024-06-23 19:08:51 +02:00 · 2024-06-23 19:08:51 +02:00 · 2096642430
commit 2096642430
parent ce08ce6dac 5005a65bcc
534 changed files with 18568 additions and 8177 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -67,6 +67,9 @@
 /nixos/lib/make-disk-image.nix                 @raitobezarius

 # Nix, the package manager
+# @raitobezarius is not "code owner", but is listed here to be notified of changes
+# pertaining to the Nix package manager.
+# i.e. no authority over those files.
 pkgs/tools/package-management/nix/                    @raitobezarius
 nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius

--- a/doc/build-helpers/special/makesetuphook.section.md
+++ b/doc/build-helpers/special/makesetuphook.section.md
@ -9,22 +9,40 @@ pkgs.makeSetupHook {
  name = "something-hook";
  propagatedBuildInputs = [ pkgs.commandsomething ];
  depsTargetTargetPropagated = [ pkgs.libsomething ];
-} ./script.sh
+} ./script.sh;
 ```

 ### setup hook that depends on the hello package and runs hello and @shell@ is substituted with path to bash {#sec-pkgs.makeSetupHook-usage-example}

 ```nix
-pkgs.makeSetupHook {
+pkgs.makeSetupHook
+  {
    name = "run-hello-hook";
-    propagatedBuildInputs = [ pkgs.hello ];
-    substitutions = { shell = "${pkgs.bash}/bin/bash"; };
-    passthru.tests.greeting = callPackage ./test { };
-    meta.platforms = lib.platforms.linux;
-} (writeScript "run-hello-hook.sh" ''
-    #!@shell@
-    hello
-'')
+    # Put dependencies here if they have hooks or necessary dependencies propagated
+    # otherwise prefer direct paths to executables.
+    propagatedBuildInputs = [
+      pkgs.hello
+      pkgs.cowsay
+    ];
+    substitutions = {
+      shell = "${pkgs.bash}/bin/bash";
+      cowsay = "${pkgs.cowsay}/bin/cowsay";
+    };
+  }
+  (
+    writeScript "run-hello-hook.sh" ''
+      #!@shell@
+      # the direct path to the executable has to be here because
+      # this will be run when the file is sourced
+      # at which point '$PATH' has not yet been populated with inputs
+      @cowsay@ cow
+
+      _printHelloHook() {
+        hello
+      }
+      preConfigureHooks+=(_printHelloHook)
+    ''
+  );
 ```

 ## Attributes {#sec-pkgs.makeSetupHook-attributes}
--- a/lib/default.nix
+++ b/lib/default.nix
@ -64,22 +64,21 @@ let
    # linux kernel configuration
    kernel = callLibs ./kernel.nix;

-    inherit (builtins) add addErrorContext attrNames concatLists
-      deepSeq elem elemAt filter genericClosure genList getAttr
-      hasAttr head isAttrs isBool isInt isList isPath isString length
-      lessThan listToAttrs pathExists readFile replaceStrings seq
-      stringLength sub substring tail trace;
+    # TODO: For consistency, all builtins should also be available from a sub-library;
+    # these are the only ones that are currently not
+    inherit (builtins) addErrorContext isPath trace;
    inherit (self.trivial) id const pipe concat or and xor bitAnd bitOr bitXor
      bitNot boolToString mergeAttrs flip mapNullable inNixShell isFloat min max
      importJSON importTOML warn warnIf warnIfNot throwIf throwIfNot checkListOfEnum
      info showWarnings nixpkgsVersion version isInOldestRelease
-      mod compare splitByAndCompare
+      mod compare splitByAndCompare seq deepSeq lessThan add sub
      functionArgs setFunctionArgs isFunction toFunction mirrorFunctionArgs
-      toHexString toBaseDigits inPureEvalMode;
+      toHexString toBaseDigits inPureEvalMode isBool isInt pathExists
+      genericClosure readFile;
    inherit (self.fixedPoints) fix fix' converge extends composeExtensions
      composeManyExtensions makeExtensible makeExtensibleWithCustomName;
    inherit (self.attrsets) attrByPath hasAttrByPath setAttrByPath
-      getAttrFromPath attrVals attrValues getAttrs catAttrs filterAttrs
+      getAttrFromPath attrVals attrNames attrValues getAttrs catAttrs filterAttrs
      filterAttrsRecursive foldlAttrs foldAttrs collect nameValuePair mapAttrs
      mapAttrs' mapAttrsToList attrsToList concatMapAttrs mapAttrsRecursive
      mapAttrsRecursiveCond genAttrs isDerivation toDerivation optionalAttrs
@ -87,14 +86,16 @@ let
      recursiveUpdate matchAttrs mergeAttrsList overrideExisting showAttrPath getOutput
      getBin getLib getDev getMan chooseDevOutputs zipWithNames zip
      recurseIntoAttrs dontRecurseIntoAttrs cartesianProduct cartesianProductOfSets
-      mapCartesianProduct updateManyAttrsByPath intersectAttrs removeAttrs;
+      mapCartesianProduct updateManyAttrsByPath listToAttrs hasAttr getAttr isAttrs intersectAttrs removeAttrs;
    inherit (self.lists) singleton forEach map foldr fold foldl foldl' imap0 imap1
-      ifilter0 concatMap flatten remove findSingle findFirst any all count
+      filter ifilter0 concatMap flatten remove findSingle findFirst any all count
      optional optionals toList range replicate partition zipListsWith zipLists
      reverseList listDfs toposort sort sortOn naturalSort compareLists take
      drop sublist last init crossLists unique allUnique intersectLists
-      subtractLists mutuallyExclusive groupBy groupBy';
+      subtractLists mutuallyExclusive groupBy groupBy' concatLists genList
+      length head tail elem elemAt isList;
    inherit (self.strings) concatStrings concatMapStrings concatImapStrings
+      stringLength substring isString replaceStrings
      intersperse concatStringsSep concatMapStringsSep
      concatImapStringsSep concatLines makeSearchPath makeSearchPathOutput
      makeLibraryPath makeIncludePath makeBinPath optionalString
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -530,6 +530,13 @@ in mkLicense lset) ({
    fullName = "Unspecified free software license";
  };

+  fsl11Mit = {
+    fullName = "Functional Source License, Version 1.1, MIT Future License";
+    url = "https://fsl.software/FSL-1.1-MIT.template.md";
+    free = false;
+    redistributable = true;
+  };
+
  ftl = {
    spdxId = "FTL";
    fullName = "Freetype Project License";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1977,6 +1977,12 @@
    githubId = 12958979;
    name = "Mika Naylor";
  };
+  autra = {
+    email = "augustin.trancart@gmail.com";
+    github = "autra";
+    githubId = 1576598;
+    name = "Augustin Trancart";
+  };
  autrimpo = {
    email = "michal@koutensky.net";
    github = "autrimpo";
@ -3956,6 +3962,12 @@
    githubId = 40290417;
    name = "Seb Blair";
  };
+  CompileTime = {
+    email = "socialcoms@posteo.de";
+    github = "Compile-Time";
+    githubId = 18414241;
+    name = "Andreas Erdes";
+  };
  confus = {
    email = "con-f-use@gmx.net";
    github = "con-f-use";
@ -9971,6 +9983,12 @@
    githubId = 5802758;
    name = "Joshua Trees";
  };
+  jtszalay = {
+    email = "jamestszalay@gmail.com";
+    github = "jtszalay";
+    githubId = 589502;
+    name = "James Szalay";
+  };
  juancmuller = {
    email = "nix@juancmuller.com";
    githubId = 208500;
@ -11636,6 +11654,13 @@
    githubId = 10626;
    name = "Andreas Wagner";
  };
+  lpchaim = {
+    email = "lpchaim@gmail.comm";
+    matrix = "@lpchaim:matrix.org";
+    github = "lpchaim";
+    githubId = 4030336;
+    name = "Lucas Chaim";
+  };
  lpostula = {
    email = "lois@postu.la";
    github = "loispostula";
@ -15797,6 +15822,12 @@
    githubId = 4303706;
    keys = [ { fingerprint = "B00F E582 FD3F 0732 EA48  3937 F558 14E4 D687 4375"; } ];
  };
+  pladypus = {
+    name = "Peter Loftus";
+    email = "loftusp5976+nixpkgs@gmail.com";
+    github = "pladypus";
+    githubId = 56337621;
+  };
  plchldr = {
    email = "mail@oddco.de";
    github = "plchldr";
@ -21539,12 +21570,6 @@
    githubId = 11740700;
    name = "Andrei Pampu";
  };
-  wolfangaukang = {
-    email = "clone.gleeful135+nixpkgs@anonaddy.me";
-    github = "WolfangAukang";
-    githubId = 8378365;
-    name = "P. R. d. O.";
-  };
  wolfgangwalther = {
    name = "Wolfgang Walther";
    email = "walther@technowledgy.de";
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -453,7 +453,7 @@ In addition to numerous new and upgraded packages, this release has the followin

    The new names are as follows:
    - `bindAddress`: [`services.keycloak.settings.http-host`](#opt-services.keycloak.settings.http-host)
-    - `forceBackendUrlToFrontendUrl`: [`services.keycloak.settings.hostname-strict-backchannel`](#opt-services.keycloak.settings.hostname-strict-backchannel)
+    - `forceBackendUrlToFrontendUrl`: `services.keycloak.settings.hostname-strict-backchannel`
    - `httpPort`: [`services.keycloak.settings.http-port`](#opt-services.keycloak.settings.http-port)
    - `httpsPort`: [`services.keycloak.settings.https-port`](#opt-services.keycloak.settings.https-port)

--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -23,6 +23,10 @@

 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}

+- `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:
+  - `transmission-gtk`: `~/.config/transmission`
+  - `transmission-daemon` using NixOS module: `${config.services.transmission.home}/.config/transmission-daemon` (defaults to `/var/lib/transmission/.config/transmission-daemon`)
+
 - `androidenv.androidPkgs_9_0` has been removed, and replaced with `androidenv.androidPkgs` for a more complete Android SDK including support for Android 9 and later.

 - `wstunnel` has had a major version upgrade that entailed rewriting the program in Rust.
@ -35,11 +39,19 @@
  Also be aware that if you have set additional options in `services.wstunnel.{clients,servers}.<name>.extraArgs`,
  that those might have been removed or modified upstream.

+- `clang-tools_<version>` packages have been moved into `llvmPackages_<version>` (i.e. `clang-tools_18` is now `llvmPackages_18.clang-tools`).
+  - For convenience, the top-level `clang-tools` attribute remains and is now bound to `llvmPackages.clang-tools`.
+  - Top-level `clang_tools_<version>` attributes are now aliases; these will be removed in a future release.
+
 - `nginx` package no longer includes `gd` and `geoip` dependencies. For enabling it, override `nginx` package with the optionals `withImageFilter` and `withGeoIP`.

 - `openssh` and `openssh_hpn` are now compiled without Kerberos 5 / GSSAPI support in an effort to reduce the attack surface of the components for the majority of users. Users needing this support can
  use the new `opensshWithKerberos` and `openssh_hpnWithKerberos` flavors (e.g. `programs.ssh.package = pkgs.openssh_gssapi`).

+- `security.ipa.ipaHostname` now defaults to the value of `networking.fqdn` if
+  it is set, instead of the previous hardcoded default of
+  `${networking.hostName}.${security.ipa.domain}`.
+
 - `nvimpager` was updated to version 0.13.0, which changes the order of user and
  nvimpager settings: user commands in `-c` and `--cmd` now override the
  respective default settings because they are executed later.
@ -71,10 +83,19 @@
  for information on working around `output '...' is not allowed to refer to
  the following paths` errors caused by this change.

+- The `stalwart-mail` service now runs under the `stalwart-mail` system user
+  instead of a dynamically created one via `DynamicUser`, to avoid automatic
+  ownership changes on its large file store each time the service was started.
+  This change requires to manually move the state directory from
+  `/var/lib/private/stalwart-mail` to `/var/lib/stalwart-mail` and to
+  change the ownership of the directory and its content to `stalwart-mail`.
+
 - The `stalwart-mail` module now uses RocksDB as the default storage backend
  for `stateVersion` ≥ 24.11. (It was previously using SQLite for structured
  data and the filesystem for blobs).

+- `libe57format` has been updated to `>= 3.0.0`, which contains some backward-incompatible API changes. See the [release note](https://github.com/asmaloney/libE57Format/releases/tag/v3.0.0) for more details.
+
 - `zx` was updated to v8, which introduces several breaking changes.
  See the [v8 changelog](https://github.com/google/zx/releases/tag/8.0.0) for more information.

@ -87,6 +108,9 @@
  services.portunus.ldap.package = pkgs.openldap.override { libxcrypt = pkgs.libxcrypt-legacy; };
  ```

+- `keycloak` was updated to version 25, which introduces new hostname related options.
+  See [Upgrading Guide](https://www.keycloak.org/docs/25.0.1/upgrading/#migrating-to-25-0-0) for instructions.
+
 - The `tracy` package no longer works on X11, since it's moved to Wayland
  support, which is the intended default behavior by Tracy maintainers.
  X11 users have to switch to the new package `tracy-x11`.
--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@ -603,10 +603,11 @@ let format' = format; in let
      ${lib.optionalString installBootLoader ''
        # In this throwaway resource, we only have /dev/vda, but the actual VM may refer to another disk for bootloader, e.g. /dev/vdb
        # Use this option to create a symlink from vda to any arbitrary device you want.
-        ${optionalString (config.boot.loader.grub.enable && config.boot.loader.grub.device != "/dev/vda") ''
-            mkdir -p $(dirname ${config.boot.loader.grub.device})
-            ln -s /dev/vda ${config.boot.loader.grub.device}
-        ''}
+        ${optionalString (config.boot.loader.grub.enable) (lib.concatMapStringsSep " " (device:
+          lib.optionalString (device != "/dev/vda") ''
+            mkdir -p "$(dirname ${device})"
+            ln -s /dev/vda ${device}
+          '') config.boot.loader.grub.devices)}

        # Set up core system link, bootloader (sd-boot, GRUB, uboot, etc.), etc.

--- a/nixos/modules/programs/wayland/hyprland.nix
+++ b/nixos/modules/programs/wayland/hyprland.nix
@ -63,7 +63,7 @@ in

      systemd = lib.mkIf cfg.systemd.setPath.enable {
        user.extraConfig = ''
-          DefaultEnvironment="PATH=$PATH:/run/current-system/sw/bin:/etc/profiles/per-user/%u/bin:/run/wrappers/bin"
+          DefaultEnvironment="PATH=/run/wrappers/bin:/etc/profiles/per-user/%u/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:$PATH"
        '';
      };
    }
--- a/nixos/modules/programs/xonsh.nix
+++ b/nixos/modules/programs/xonsh.nix
@ -23,7 +23,7 @@ in
      };

      package = lib.mkPackageOption pkgs "xonsh" {
-        example = "xonsh.override { extraPackages = ps: [ ps.requests ]; }";
+        example = "xonsh.wrapper.override { extraPackages = ps: [ ps.requests ]; }";
      };

      config = lib.mkOption {
@ -61,17 +61,14 @@ in
              aliases['ls'] = _ls_alias
          del _ls_alias

-
      ${cfg.config}
    '';

    environment.systemPackages = [ cfg.package ];

-    environment.shells =
-      [ "/run/current-system/sw/bin/xonsh"
-        "${cfg.package}/bin/xonsh"
-      ];
-
+    environment.shells = [
+      "/run/current-system/sw/bin/xonsh"
+      "${lib.getExe cfg.package}"
+    ];
  };
-
 }
--- a/nixos/modules/security/ipa.nix
+++ b/nixos/modules/security/ipa.nix
@ -85,6 +85,18 @@ in {
        description = "Whether to cache credentials.";
      };

+      ipaHostname = mkOption {
+        type = types.str;
+        example = "myworkstation.example.com";
+        default = if config.networking.domain != null then config.networking.fqdn
+                  else "${config.networking.hostName}.${cfg.domain}";
+        defaultText = literalExpression ''
+          if config.networking.domain != null then config.networking.fqdn
+          else "''${networking.hostName}.''${security.ipa.domain}"
+        '';
+        description = "Fully-qualified hostname used to identify this host in the IPA domain.";
+      };
+
      ifpAllowedUids = mkOption {
        type = types.listOf types.str;
        default = ["root"];
@ -218,7 +230,7 @@ in {

      ipa_domain = ${cfg.domain}
      ipa_server = _srv_, ${cfg.server}
-      ipa_hostname = ${config.networking.hostName}.${cfg.domain}
+      ipa_hostname = ${cfg.ipaHostname}

      cache_credentials = ${pyBool cfg.cacheCredentials}
      krb5_store_password_if_offline = ${pyBool cfg.offlinePasswords}
@ -232,7 +244,6 @@ in {
      ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname, telephoneNumber:telephoneNumber, lock:nsaccountlock

      [sssd]
-      debug_level = 65510
      services = nss, sudo, pam, ssh, ifp
      domains = ${cfg.domain}

@ -244,7 +255,6 @@ in {
      pam_verbosity = 3

      [sudo]
-      debug_level = 65510

      [autofs]

--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@ -261,7 +261,7 @@ in {
          name = "service-account";
          CN = "system:service-account-signer";
          action = ''
-            systemctl reload \
+            systemctl restart \
              kube-apiserver.service \
              kube-controller-manager.service
          '';
--- a/nixos/modules/services/continuous-integration/jenkins/default.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/default.nix
@ -237,6 +237,8 @@ in {
      serviceConfig = {
        User = cfg.user;
        StateDirectory = mkIf (hasPrefix "/var/lib/jenkins" cfg.home) "jenkins";
+        # For (possible) socket use
+        RuntimeDirectory = "jenkins";
      };
    };
  };
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@ -264,9 +264,12 @@ in {
        enable = true;
        package = kdePackages.kwallet-pam;
      };
-      kde.kwallet = {
-        enable = true;
-        package = kdePackages.kwallet-pam;
+      kde = {
+        allowNullPassword = true;
+        kwallet = {
+          enable = true;
+          package = kdePackages.kwallet-pam;
+        };
      };
      kde-fingerprint = lib.mkIf config.services.fprintd.enable { fprintAuth = true; };
      kde-smartcard = lib.mkIf config.security.pam.p11.enable { p11Auth = true; };
--- a/nixos/modules/services/desktops/gnome/gnome-keyring.nix
+++ b/nixos/modules/services/desktops/gnome/gnome-keyring.nix
@ -1,45 +1,52 @@
 # GNOME Keyring daemon.

-{ config, pkgs, lib, ... }:
-
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.gnome.gnome-keyring;
+in
 {

  meta = {
    maintainers = lib.teams.gnome.members;
  };

-  ###### interface
-
  options = {
-
    services.gnome.gnome-keyring = {
-
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          Whether to enable GNOME Keyring daemon, a service designed to
-          take care of the user's security credentials,
-          such as user names and passwords.
-        '';
-      };
-
+      enable = lib.mkEnableOption ''
+        GNOME Keyring daemon, a service designed to
+        take care of the user's security credentials,
+        such as user names and passwords
+      '';
    };
-
  };

-
-  ###### implementation
-
-  config = lib.mkIf config.services.gnome.gnome-keyring.enable {
-
+  config = lib.mkIf cfg.enable {
    environment.systemPackages = [ pkgs.gnome.gnome-keyring ];

-    services.dbus.packages = [ pkgs.gnome.gnome-keyring pkgs.gcr ];
+    services.dbus.packages = [
+      pkgs.gnome.gnome-keyring
+      pkgs.gcr
+    ];

    xdg.portal.extraPortals = [ pkgs.gnome.gnome-keyring ];

-    security.pam.services.login.enableGnomeKeyring = true;
+    security.pam.services = lib.mkMerge [
+      {
+        login.enableGnomeKeyring = true;
+      }
+      (lib.mkIf config.services.xserver.displayManager.gdm.enable {
+        gdm-password.enableGnomeKeyring = true;
+        gdm-autologin.enableGnomeKeyring = true;
+      })
+      (lib.mkIf (config.services.xserver.displayManager.gdm.enable && config.services.fprintd.enable) {
+        gdm-fingerprint.enableGnomeKeyring = true;
+      })
+    ];

    security.wrappers.gnome-keyring-daemon = {
      owner = "root";
@ -47,7 +54,5 @@
      capabilities = "cap_ipc_lock=ep";
      source = "${pkgs.gnome.gnome-keyring}/bin/gnome-keyring-daemon";
    };
-
  };
-
 }
--- a/nixos/modules/services/mail/stalwart-mail.nix
+++ b/nixos/modules/services/mail/stalwart-mail.nix
@ -37,8 +37,6 @@ in {
        ansi = mkDefault false;  # no colour markers to journald
        enable = mkDefault true;
      };
-      queue.path = mkDefault "${dataDir}/queue";
-      report.path = mkDefault "${dataDir}/reports";
      store = if useLegacyStorage then {
        # structured data in SQLite, blobs on filesystem
        db.type = mkDefault "sqlite";
@ -83,9 +81,9 @@ in {
        after = [ "local-fs.target" "network.target" ];

        preStart = if useLegacyStorage then ''
-          mkdir -p ${dataDir}/{queue,reports,data/blobs}
+          mkdir -p ${dataDir}/data/blobs
        '' else ''
-          mkdir -p ${dataDir}/{queue,reports,db}
+          mkdir -p ${dataDir}/db
        '';

        serviceConfig = {
--- a/nixos/modules/services/misc/ollama.nix
+++ b/nixos/modules/services/misc/ollama.nix
@ -98,9 +98,25 @@ in
            - otherwise defaults to `false`
          - `false`: disable GPU, only use CPU
          - `"rocm"`: supported by most modern AMD GPUs
+            - may require overriding gpu type with `services.ollama.rocmOverrideGfx`
+              if rocm doesn't detect your AMD gpu
          - `"cuda"`: supported by most modern NVIDIA GPUs
        '';
      };
+      rocmOverrideGfx = lib.mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "10.3.0";
+        description = ''
+          Override what rocm will detect your gpu model as.
+          For example, make rocm treat your RX 5700 XT (or any other model)
+          as an RX 6900 XT using a value of `"10.3.0"` (gfx 1030).
+
+          This sets the value of `HSA_OVERRIDE_GFX_VERSION`. See [ollama's docs](
+          https://github.com/ollama/ollama/blob/main/docs/gpu.md#amd-radeon
+          ) for details.
+        '';
+      };
      environmentVariables = lib.mkOption {
        type = types.attrsOf types.str;
        default = { };
@ -136,6 +152,7 @@ in
        HOME = cfg.home;
        OLLAMA_MODELS = cfg.models;
        OLLAMA_HOST = "${cfg.host}:${toString cfg.port}";
+        HSA_OVERRIDE_GFX_VERSION = lib.mkIf (cfg.rocmOverrideGfx != null) cfg.rocmOverrideGfx;
      };
      serviceConfig = {
        ExecStart = "${lib.getExe ollamaPackage} serve";
--- a/nixos/modules/services/misc/tandoor-recipes.nix
+++ b/nixos/modules/services/misc/tandoor-recipes.nix
@ -22,7 +22,7 @@ let
    ${lib.toShellVars env}
    eval "$(${config.systemd.package}/bin/systemctl show -pUID,GID,MainPID tandoor-recipes.service)"
    exec ${pkgs.util-linux}/bin/nsenter \
-      -t $MainPID -m -S $UID -G $GID \
+      -t $MainPID -m -S $UID -G $GID --wdns=${env.MEDIA_ROOT} \
      ${pkg}/bin/tandoor-recipes "$@"
  '';
 in
@ -88,7 +88,7 @@ in
        Group = "tandoor_recipes";
        DynamicUser = true;
        StateDirectory = "tandoor-recipes";
-        WorkingDirectory = "/var/lib/tandoor-recipes";
+        WorkingDirectory = env.MEDIA_ROOT;
        RuntimeDirectory = "tandoor-recipes";

        BindReadOnlyPaths = [
--- a/nixos/modules/services/network-filesystems/davfs2.nix
+++ b/nixos/modules/services/network-filesystems/davfs2.nix
@ -4,7 +4,7 @@ let
  inherit (lib.attrsets) optionalAttrs;
  inherit (lib.generators) toINIWithGlobalSection;
  inherit (lib.lists) optional;
-  inherit (lib.modules) mkIf;
+  inherit (lib.modules) mkIf mkRemovedOptionModule;
  inherit (lib.options) literalExpression mkEnableOption mkOption;
  inherit (lib.strings) escape;
  inherit (lib.types) attrsOf bool int lines oneOf str submodule;
@ -27,6 +27,13 @@ let
 in
 {

+  imports = [
+    (mkRemovedOptionModule [ "services" "davfs2" "extraConfig" ] ''
+      The option extraConfig got removed, please migrate to
+      services.davfs2.settings instead.
+    '')
+  ];
+
  options.services.davfs2 = {
    enable = mkEnableOption "davfs2";

--- a/nixos/modules/services/networking/antennas.nix
+++ b/nixos/modules/services/networking/antennas.nix
@ -50,10 +50,7 @@ in
      };

      serviceConfig = {
-         ExecStart = "${pkgs.antennas}/bin/antennas";
-
-        # Antennas expects all resources like html and config to be relative to it's working directory
-        WorkingDirectory = "${pkgs.antennas}/libexec/antennas/deps/antennas/";
+        ExecStart = "${pkgs.antennas}/bin/antennas";

        # Hardening
        CapabilityBoundingSet = [ "" ];
--- a/nixos/modules/services/security/sslmate-agent.nix
+++ b/nixos/modules/services/security/sslmate-agent.nix
@ -6,7 +6,7 @@ let
  cfg = config.services.sslmate-agent;

 in {
-  meta.maintainers = with maintainers; [ wolfangaukang ];
+  meta.maintainers = [ ];

  options = {
    services.sslmate-agent = {
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@ -174,7 +174,10 @@ in
        };
      };

-      package = mkPackageOption pkgs "transmission" {};
+      package = mkPackageOption pkgs "transmission" {
+        default = "transmission_3";
+        example = "pkgs.transmission_4";
+      };

      downloadDirPermissions = mkOption {
        type = with types; nullOr str;
--- a/nixos/modules/services/web-apps/keycloak.md
+++ b/nixos/modules/services/web-apps/keycloak.md
@ -68,13 +68,11 @@ to `/auth`. See the option description
 for more details.
 :::

-[](#opt-services.keycloak.settings.hostname-strict-backchannel)
-determines whether Keycloak should force all requests to go
-through the frontend URL. By default,
-Keycloak allows backend requests to
-instead use its local hostname or IP address and may also
-advertise it to clients through its OpenID Connect Discovery
-endpoint.
+[](#opt-services.keycloak.settings.hostname-backchannel-dynamic)
+Keycloak has the capability to offer a separate URL for backchannel requests,
+enabling internal communication while maintaining the use of a public URL
+for frontchannel requests. Moreover, the backchannel is dynamically
+resolved based on incoming headers endpoint.

 For more information on hostname configuration, see the [Hostname
 section of the Keycloak Server Installation and Configuration
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@ -328,8 +328,7 @@ in
            };

            hostname = mkOption {
-              type = nullOr str;
-              default = null;
+              type = str;
              example = "keycloak.example.com";
              description = ''
                The hostname part of the public URL used as base for
@ -340,16 +339,13 @@ in
              '';
            };

-            hostname-strict-backchannel = mkOption {
+            hostname-backchannel-dynamic = mkOption {
              type = bool;
              default = false;
              example = true;
              description = ''
-                Whether Keycloak should force all requests to go
-                through the frontend URL. By default, Keycloak allows
-                backend requests to instead use its local hostname or
-                IP address and may also advertise it to clients
-                through its OpenID Connect Discovery endpoint.
+                Enables dynamic resolving of backchannel URLs,
+                including hostname, scheme, port and context path.

                See <https://www.keycloak.org/server/hostname>
                for more information about hostname configuration.
@ -482,12 +478,20 @@ in
            message = "Setting up a local PostgreSQL db for Keycloak requires `standard_conforming_strings` turned on to work reliably";
          }
          {
-            assertion = cfg.settings.hostname != null || cfg.settings.hostname-url or null != null;
-            message = "Setting the Keycloak hostname is required, see `services.keycloak.settings.hostname`";
+            assertion = cfg.settings.hostname-url or null == null;
+            message = ''
+              The option `services.keycloak.settings.hostname-url' has been removed.
+              Set `services.keycloak.settings.hostname' instead.
+              See [New Hostname options](https://www.keycloak.org/docs/25.0.0/upgrading/#new-hostname-options) for details.
+            '';
          }
          {
-            assertion = !(cfg.settings.hostname != null && cfg.settings.hostname-url or null != null);
-            message = "`services.keycloak.settings.hostname` and `services.keycloak.settings.hostname-url` are mutually exclusive";
+            assertion = cfg.settings.hostname-strict-backchannel or null == null;
+            message = ''
+              The option `services.keycloak.settings.hostname-strict-backchannel' has been removed.
+              Set `services.keycloak.settings.hostname-backchannel-dynamic' instead.
+              See [New Hostname options](https://www.keycloak.org/docs/25.0.0/upgrading/#new-hostname-options) for details.
+            '';
          }
        ];

--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -446,7 +446,13 @@ in {
      dbtableprefix = mkOption {
        type = types.nullOr types.str;
        default = null;
-        description = "Table prefix in Nextcloud's database.";
+        description = ''
+          Table prefix in Nextcloud's database.
+
+          __Note:__ since Nextcloud 20 it's not an option anymore to create a database
+          schema with a custom table prefix. This option only exists for backwards compatibility
+          with installations that were originally provisioned with Nextcloud <20.
+        '';
      };
      adminuser = mkOption {
        type = types.str;
@ -826,6 +832,13 @@ in {
          Using config.services.nextcloud.poolConfig is deprecated and will become unsupported in a future release.
          Please migrate your configuration to config.services.nextcloud.poolSettings.
        '')
+        ++ (optional (cfg.config.dbtableprefix != null) ''
+          Using `services.nextcloud.config.dbtableprefix` is deprecated. Fresh installations with this
+          option set are not allowed anymore since v20.
+
+          If you have an existing installation with a custom table prefix, make sure it is
+          set correctly in `config.php` and remove the option from your NixOS config.
+        '')
        ++ (optional (versionOlder cfg.package.version "25") (upgradeWarning 24 "22.11"))
        ++ (optional (versionOlder cfg.package.version "26") (upgradeWarning 25 "23.05"))
        ++ (optional (versionOlder cfg.package.version "27") (upgradeWarning 26 "23.11"))
--- a/nixos/modules/services/x11/desktop-managers/xfce.nix
+++ b/nixos/modules/services/x11/desktop-managers/xfce.nix
@ -116,7 +116,7 @@ in
    ] # TODO: NetworkManager doesn't belong here
      ++ optional config.networking.networkmanager.enable networkmanagerapplet
      ++ optional config.powerManagement.enable xfce4-power-manager
-      ++ optionals config.hardware.pulseaudio.enable [
+      ++ optionals (config.hardware.pulseaudio.enable || config.services.pipewire.pulse.enable) [
        pavucontrol
        # volume up/down keys support:
        # xfce4-pulseaudio-plugin includes all the functionalities of xfce4-volumed-pulse
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -958,6 +958,7 @@ in {
  systemd-homed = handleTest ./systemd-homed.nix {};
  systemtap = handleTest ./systemtap.nix {};
  tandoor-recipes = handleTest ./tandoor-recipes.nix {};
+  tandoor-recipes-script-name = handleTest ./tandoor-recipes-script-name.nix {};
  tang = handleTest ./tang.nix {};
  taskserver = handleTest ./taskserver.nix {};
  tayga = handleTest ./tayga.nix {};
@ -981,7 +982,7 @@ in {
  traefik = handleTestOn ["aarch64-linux" "x86_64-linux"] ./traefik.nix {};
  trafficserver = handleTest ./trafficserver.nix {};
  transfer-sh = handleTest ./transfer-sh.nix {};
-  transmission = handleTest ./transmission.nix { transmission = pkgs.transmission; };
+  transmission_3 = handleTest ./transmission.nix { transmission = pkgs.transmission_3; };
  transmission_4 = handleTest ./transmission.nix { transmission = pkgs.transmission_4; };
  # tracee requires bpf
  tracee = handleTestOn ["x86_64-linux"] ./tracee.nix {};
--- a/nixos/tests/keycloak.nix
+++ b/nixos/tests/keycloak.nix
@ -44,7 +44,6 @@ let
            };
            plugins = with config.services.keycloak.package.plugins; [
              keycloak-discord
-              keycloak-metrics-spi
            ];
          };
          environment.systemPackages = with pkgs; [
@ -122,14 +121,6 @@ let
                   | jq -r '"Authorization: bearer " + .access_token' >admin_auth_header
          """)

-          # Register the metrics SPI
-          keycloak.succeed(
-              """${pkgs.jre}/bin/keytool -import -alias snakeoil -file ${certs.ca.cert} -storepass aaaaaa -keystore cacert.jks -noprompt""",
-              """KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh config credentials --server '${frontendUrl}' --realm master --user admin --password "$(<${adminPasswordFile})" """,
-              """KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh update events/config -s 'eventsEnabled=true' -s 'adminEventsEnabled=true' -s 'eventsListeners+=metrics-listener'""",
-              """curl -sSf '${frontendUrl}/realms/master/metrics' | grep '^keycloak_admin_event_UPDATE'"""
-          )
-
          # Publish the realm, including a test OIDC client and user
          keycloak.succeed(
              "curl -sSf -H @admin_auth_header -X POST -H 'Content-Type: application/json' -d @${realmDataJson} '${frontendUrl}/admin/realms/'"
--- a/nixos/tests/nextcloud/basic.nix
+++ b/nixos/tests/nextcloud/basic.nix
@ -38,7 +38,6 @@ runTest ({ config, ... }: {
      services.nextcloud = {
        enable = true;
        datadir = "/var/lib/nextcloud-data";
-        config.dbtableprefix = "nixos_";
        autoUpdateApps = {
          enable = true;
          startAt = "20:00";
--- a/nixos/tests/tandoor-recipes-script-name.nix
+++ b/nixos/tests/tandoor-recipes-script-name.nix
@ -0,0 +1,95 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+  {
+    name = "tandoor-recipes-script-name";
+
+    nodes.machine =
+      { pkgs, nodes, ... }:
+      {
+        services.tandoor-recipes = {
+          enable = true;
+          extraConfig = {
+            SCRIPT_NAME = "/any/path";
+            STATIC_URL = "${nodes.machine.services.tandoor-recipes.extraConfig.SCRIPT_NAME}/static/";
+          };
+        };
+      };
+
+    testScript =
+      { nodes, ... }:
+      let
+        inherit (nodes.machine.services.tandoor-recipes) address port;
+        inherit (nodes.machine.services.tandoor-recipes.extraConfig) SCRIPT_NAME;
+      in
+      ''
+        from html.parser import HTMLParser
+
+        origin_url = "http://${address}:${toString port}"
+        base_url = f"{origin_url}${SCRIPT_NAME}"
+        login_path = "/admin/login/"
+        login_url = f"{base_url}{login_path}"
+
+        cookie_jar_path = "/tmp/cookies.txt"
+        curl = f"curl --cookie {cookie_jar_path} --cookie-jar {cookie_jar_path} --fail --header 'Origin: {origin_url}' --show-error --silent"
+
+        print("Wait for the service to respond")
+        machine.wait_for_unit("tandoor-recipes.service")
+        machine.wait_until_succeeds(f"{curl} {login_url}")
+
+        username = "username"
+        password = "password"
+
+        print("Create admin user")
+        machine.succeed(
+            f"DJANGO_SUPERUSER_PASSWORD='{password}' /var/lib/tandoor-recipes/tandoor-recipes-manage createsuperuser --no-input --username='{username}' --email=nobody@example.com"
+        )
+
+        print("Get CSRF token for later requests")
+        csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut --fields=7").rstrip()
+
+        print("Log in as admin user")
+        machine.succeed(
+            f"{curl} --data 'csrfmiddlewaretoken={csrf_token}' --data 'username={username}' --data 'password={password}' {login_url}"
+        )
+
+        print("Get the contents of the logged in main page")
+        logged_in_page = machine.succeed(f"{curl} --location {base_url}")
+
+        class UrlParser(HTMLParser):
+            def __init__(self):
+                super().__init__()
+
+                self.urls: list[str] = []
+
+            def handle_starttag(self, tag: str, attrs: list[tuple[str, str | None]]) -> None:
+                if tag == "form":
+                    for name, value in attrs:
+                        if name == "action" and value is not None:
+                            assert not value.endswith(login_path)
+                            break
+
+                if tag != "a":
+                    return
+
+                for name, value in attrs:
+                    if name == "href" and value is not None:
+                        if value.startswith(base_url):
+                            self.urls.append(value)
+                        elif value.startswith("/"):
+                            self.urls.append(f"{origin_url}{value}")
+                        else:
+                            print("Ignoring external URL: {value}")
+
+                        break
+
+        parser = UrlParser()
+        parser.feed(logged_in_page)
+
+        for url in parser.urls:
+            with subtest(f"Verify that {url} can be reached"):
+                machine.succeed(f"{curl} {url}")
+      '';
+
+    meta.maintainers = with lib.maintainers; [ l0b0 ];
+  }
+)
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@ -23,13 +23,13 @@ with lib.strings;

 let

-  version = "2.72.14";
+  version = "2.74.6";

  src = fetchFromGitHub {
    owner = "grame-cncm";
    repo = "faust";
    rev = version;
-    sha256 = "sha256-RdSXiOYwKsfyrfHEughCeSwa9VFM6/3pMg54yCMpzLU=";
+    sha256 = "sha256-0r7DjTrsNKZ5ZmWoA+Y9OXyJFUiUFZiPQb1skXXWYTw=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/audio/faustPhysicalModeling/default.nix
+++ b/pkgs/applications/audio/faustPhysicalModeling/default.nix
@ -1,13 +1,13 @@
 { stdenv, lib, fetchFromGitHub, faust2jaqt, faust2lv2 }:
 stdenv.mkDerivation rec {
  pname = "faustPhysicalModeling";
-  version = "2.72.14";
+  version = "2.74.6";

  src = fetchFromGitHub {
    owner = "grame-cncm";
    repo = "faust";
    rev = version;
-    sha256 = "sha256-UBMVU2oAfoAaSQXxZxV+LFq8dyb5dvy/0cCG4XywZVc=";
+    sha256 = "sha256-2qgw7pauDZBvEb5iySNiq2Fq+T+qw+AjVTwxaSQ9Eko=";
  };

  buildInputs = [ faust2jaqt faust2lv2 ];
--- a/pkgs/applications/audio/gnome-podcasts/default.nix
+++ b/pkgs/applications/audio/gnome-podcasts/default.nix
@ -15,6 +15,7 @@
 , desktop-file-utils
 , dbus
 , openssl
+, glib-networking
 , sqlite
 , gst_all_1
 , wrapGAppsHook4
@ -22,19 +23,19 @@

 stdenv.mkDerivation rec {
  pname = "gnome-podcasts";
-  version = "0.6.1";
+  version = "0.7.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "podcasts";
    rev = version;
-    hash = "sha256-LPwCYgAFgUMFQZ0i4ldiuGYGMMWcMqYct3/o7eTIhmU=";
+    hash = "sha256-KCjHT/4AeJ+RXCtawkhs6f4D8NCJotYIPk3tGr5YG9M=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit pname version src;
-    hash = "sha256-n3ZcUhqn1rvvgkBKSKvH0b8wbOCqcBGwpb2OqMe8h0s=";
+    hash = "sha256-XTfKqKs7874ak7Lzscxw8E2qcnJOWMZaaol8TpIB6Vw=";
  };

  nativeBuildInputs = [
@ -56,6 +57,7 @@ stdenv.mkDerivation rec {
    gettext
    dbus
    openssl
+    glib-networking
    sqlite
    gst_all_1.gstreamer
    gst_all_1.gst-plugins-base
@ -66,13 +68,13 @@ stdenv.mkDerivation rec {
  # tests require network
  doCheck = false;

-  meta = with lib; {
+  meta = {
    description = "Listen to your favorite podcasts";
    mainProgram = "gnome-podcasts";
    homepage = "https://apps.gnome.org/Podcasts/";
-    license = licenses.gpl3Plus;
-    maintainers = teams.gnome.members;
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3Plus;
+    maintainers = lib.teams.gnome.members;
+    platforms = lib.platforms.unix;
    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/gnome-podcasts.x86_64-darwin
  };
 }
--- a/pkgs/applications/audio/go-musicfox/default.nix
+++ b/pkgs/applications/audio/go-musicfox/default.nix
@ -10,18 +10,18 @@

 buildGoModule rec {
  pname = "go-musicfox";
-  version = "4.4.1";
+  version = "4.5.3";

  src = fetchFromGitHub {
    owner = "go-musicfox";
    repo = "go-musicfox";
    rev = "v${version}";
-    hash = "sha256-pIfQ0ufn8W0opm+N6IPFBPWNxNWMOU7FudPtIFop51c=";
+    hash = "sha256-qf4XAAfWWlHAnNGhXaYpnjj+2z+/lWOHaTyv8R4UDgQ=";
  };

  deleteVendor = true;

-  vendorHash = "sha256-ey78zeCSEuRgteG5ZRb4uO88E6lwEgqSxKfjJg3NGT4=";
+  vendorHash = "sha256-oz/kVp/Jj2Lmo19UFOn2VPD/iWbSRCbmKy8fK8RdkYs=";

  subPackages = [ "cmd/musicfox.go" ];

--- a/pkgs/applications/audio/pocket-casts/default.nix
+++ b/pkgs/applications/audio/pocket-casts/default.nix
@ -52,7 +52,7 @@ buildNpmPackage rec {
    description = "Pocket Casts webapp, packaged for the Linux Desktop";
    homepage = "https://github.com/felicianotech/pocket-casts-desktop-app";
    license = licenses.mit;
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    mainProgram = "pocket-casts";
    platforms = platforms.linux;
  };
--- a/pkgs/applications/audio/spotify/linux.nix
+++ b/pkgs/applications/audio/spotify/linux.nix
@ -120,11 +120,15 @@ stdenv.mkDerivation {
  # Prevent double wrapping
  dontWrapGApps = true;

+  env = rec {
+    libdir = "${placeholder "out"}/lib/spotify";
+    librarypath = "${lib.makeLibraryPath deps}:${libdir}";
+  };
+
  installPhase =
    ''
      runHook preInstall

-      libdir=$out/lib/spotify
      mkdir -p $libdir
      mv ./usr/* $out/

@ -147,16 +151,6 @@ stdenv.mkDerivation {
        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
        --set-rpath $rpath $out/share/spotify/spotify

-      librarypath="${lib.makeLibraryPath deps}:$libdir"
-      wrapProgramShell $out/share/spotify/spotify \
-        ''${gappsWrapperArgs[@]} \
-        ${lib.optionalString (deviceScaleFactor != null) ''
-          --add-flags "--force-device-scale-factor=${toString deviceScaleFactor}" \
-        ''} \
-        --prefix LD_LIBRARY_PATH : "$librarypath" \
-        --prefix PATH : "${gnome.zenity}/bin" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
-
      # fix Icon line in the desktop file (#48062)
      sed -i "s:^Icon=.*:Icon=spotify-client:" "$out/share/spotify/spotify.desktop"

@ -175,6 +169,21 @@ stdenv.mkDerivation {
      runHook postInstall
    '';

+    fixupPhase = ''
+      runHook preFixup
+
+      wrapProgramShell $out/share/spotify/spotify \
+        ''${gappsWrapperArgs[@]} \
+        ${lib.optionalString (deviceScaleFactor != null) ''
+          --add-flags "--force-device-scale-factor=${toString deviceScaleFactor}" \
+        ''} \
+        --prefix LD_LIBRARY_PATH : "$librarypath" \
+        --prefix PATH : "${gnome.zenity}/bin" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+
+      runHook postFixup
+    '';
+
  meta = meta // {
    maintainers = with lib.maintainers; [ eelco ftrvxmtrx sheenobu timokau ma27 ];
  };
--- a/pkgs/applications/blockchains/bisq-desktop/default.nix
+++ b/pkgs/applications/blockchains/bisq-desktop/default.nix
@ -38,11 +38,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "bisq-desktop";
-  version = "1.9.15";
+  version = "1.9.16";

  src = fetchurl {
    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
-    sha256 = "0bz4yzfrzn9rwsmwwnsqdgxsqd42dyiz3vxi53qxj36h49nh8lzg";
+    sha256 = "sha256-DxYgZgDa3vOHj7svJqu/pdyXKZ+uBTy35Fchw49xxoA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/blockchains/dcrwallet/default.nix
+++ b/pkgs/applications/blockchains/dcrwallet/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dcrwallet";
-  version = "2.0.2";
+  version = "2.0.3";

  src = fetchFromGitHub {
    owner = "decred";
    repo = "dcrwallet";
    rev = "release-v${version}";
-    hash = "sha256-fsmil9YQNvXDyBxyt+Ei3F5U/dvbrzbZ01+v9o3+jVY=";
+    hash = "sha256-sRwGpOVydfZjgo7W+4RsHC4JElPyilbV5xhcHxPh2Wc=";
  };

-  vendorHash = "sha256-ehtgsBCFzMft8285IjpsQ6y9HPb/UpZmcj9X4m8ZKXo=";
+  vendorHash = "sha256-lVVIS3FL8XwthCpzRKdw59NVtHVxXQ0ouD7jYQzOecM=";

  subPackages = [ "." ];

--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@ -262,7 +262,7 @@ let
      inherit withSdk;
      sdk = androidSdk;
    };
-    meta = with lib; {
+    meta = {
      description = "Official IDE for Android (${channel} channel)";
      longDescription = ''
        Android Studio is the official IDE for Android app development, based on
@ -271,7 +271,7 @@ let
      homepage = if channel == "stable"
        then "https://developer.android.com/studio/index.html"
        else "https://developer.android.com/studio/preview/index.html";
-      license = with licenses; [ asl20 unfree ]; # The code is under Apache-2.0, but:
+      license = with lib.licenses; [ asl20 unfree ]; # The code is under Apache-2.0, but:
      # If one selects Help -> Licenses in Android Studio, the dialog shows the following:
      # "Android Studio includes proprietary code subject to separate license,
      # including JetBrains CLion(R) (www.jetbrains.com/clion) and IntelliJ(R)
@ -280,11 +280,11 @@ let
      # binaries are also distributed as proprietary software (unlike the
      # source-code itself).
      platforms = [ "x86_64-linux" ];
-      maintainers = with maintainers; rec {
-        stable = [ alapshin numinit ];
-        beta = [ alapshin numinit ];
-        canary = [ alapshin numinit ];
-        dev = canary;
+      maintainers = with lib.maintainers; rec {
+        stable = [ alapshin johnrtitor numinit ];
+        beta = stable;
+        canary = stable;
+        dev = stable;
      }."${channel}";
      mainProgram = pname;
    };
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -10,16 +10,16 @@ let
    inherit tiling_wm;
  };
  stableVersion = {
-    version = "2023.3.1.19"; # "Android Studio Jellyfish | 2023.3.1 Patch 1"
-    sha256Hash = "sha256-FyscJPusmK33UPIexV20GXQ4Z5X8mfNRFPu/2Xeg5ts=";
+    version = "2024.1.1.11"; # "Android Studio Koala | 2024.1.1"
+    sha256Hash = "sha256-2PqOz+QVtEUTNQkBUB4qD0KcoDPPGAUFSxyBbEpwRWU=";
  };
  betaVersion = {
-    version = "2023.3.1.17"; # "Android Studio Jellyfish | 2023.3.1.1 RC 2"
-    sha256Hash = "sha256-zROBKzQiP4V2P67HgOIkHgn8q/M0zy5MkZozVSiQsWU=";
+    version = "2024.1.1.10"; # "Android Studio Koala | 2024.1.1 RC 2"
+    sha256Hash = "sha256-84CpZfoAvJHUCO3ZBJqDbuz9xuGE/5xJfXoetJDXju8=";
  };
  latestVersion = {
-    version = "2024.1.1.4"; # "Android Studio Koala | 2024.1.1 Canary 6"
-    sha256Hash = "sha256-lfig7lFyF7XZowTQKpo6zGeR23VHq/f7vvUDWCs7jeo=";
+    version = "2024.1.2.7"; # "Android Studio Koala Feature Drop | 2024.1.2 Canary 7"
+    sha256Hash = "sha256-opoAKslh8DqS/iS5gw8AxX6x89t2BNX7yaU88XNd2kM=";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/jetbrains/patches/no-download.patch
+++ b/pkgs/applications/editors/jetbrains/patches/no-download.patch
@ -1,27 +1,20 @@
 --- a/build/deps/src/org/jetbrains/intellij/build/impl/BundledMavenDownloader.kt
 +++ b/build/deps/src/org/jetbrains/intellij/build/impl/BundledMavenDownloader.kt
-@@ -87,13 +87,13 @@
-           }
-           val targetFile = root.resolve("${split[1]}-${split[2]}.jar")
-           val uri = BuildDependenciesDownloader.getUriForMavenArtifact(
-            mavenRepository = BuildDependenciesConstants.MAVEN_CENTRAL_URL,
-+            mavenRepository = "MAVEN_REPO_HERE",
-             groupId = split[0],
-             artifactId = split[1],
-             version = split[2],
-             packaging = "jar"
-           )
-          targetFile to downloadFileToCacheLocation(uri.toString(), communityRoot)
-+          targetFile to Path.of(uri.toString())
-         }
+@@ -89,7 +89,7 @@
       }
-     }.asSequence().map { it.getCompleted() }.toMap()
-@@ -133,21 +133,6 @@
+       val file = root.resolve("${split[1]}-${split[2]}.jar")
+       val uri = BuildDependenciesDownloader.getUriForMavenArtifact(
+-        mavenRepository = BuildDependenciesConstants.MAVEN_CENTRAL_URL,
+        mavenRepository = "MAVEN_REPO_HERE",
+         groupId = split[0],
+         artifactId = split[1],
+         version = split[2],
+@@ -145,22 +145,7 @@
   }
- 
+
   suspend fun downloadMavenDistribution(communityRoot: BuildDependenciesCommunityRoot): Path {
 -    val extractDir = communityRoot.communityRoot.resolve("plugins/maven/maven36-server-impl/lib/maven3")
-    val properties = BuildDependenciesDownloader.getDependenciesProperties(communityRoot)
+-    val properties = BuildDependenciesDownloader.getDependencyProperties(communityRoot)
 -    val bundledMavenVersion = properties.property("bundledMavenVersion")
 -    mutex.withLock {
 -      val uri = BuildDependenciesDownloader.getUriForMavenArtifact(
@ -38,7 +31,8 @@
 -    return extractDir
 +    return Path.of("MAVEN_PATH_HERE")
   }
- }
+
+   suspend fun downloadMavenTelemetryDependencies(communityRoot: BuildDependenciesCommunityRoot): Path =
 --- a/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/BuildDependenciesDownloader.kt
 +++ b/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/BuildDependenciesDownloader.kt
@@ -70,7 +70,7 @@
@ -52,19 +46,19 @@
     return URI.create("${base}/${groupStr}/${artifactId}/${version}/${artifactId}-${version}${classifierStr}.${packaging}")
 --- a/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/JdkDownloader.kt
 +++ b/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/JdkDownloader.kt
-@@ -25,11 +25,7 @@
+@@ -33,11 +33,7 @@
   }
- 
-   fun getJdkHome(communityRoot: BuildDependenciesCommunityRoot, os: OS, arch: Arch, infoLog: (String) -> Unit): Path {
-    val jdkUrl = getUrl(communityRoot, os, arch)
-    val jdkArchive = BuildDependenciesDownloader.downloadFileToCacheLocation(communityRoot, jdkUrl)
-    val jdkExtracted = BuildDependenciesDownloader.extractFileToCacheLocation(
-      communityRoot, jdkArchive, BuildDependenciesExtractOptions.STRIP_ROOT)
-    infoLog("jps-bootstrap JDK is at $jdkExtracted")
+
+   suspend fun getJdkHome(communityRoot: BuildDependenciesCommunityRoot, os: OS, arch: Arch, infoLog: (String) -> Unit): Path {
+-    val jdkUrl = getUrl(communityRoot = communityRoot, os = os, arch = arch)
+-    val jdkArchive = downloadFileToCacheLocation(url = jdkUrl.toString(), communityRoot = communityRoot)
+-    val jdkExtracted = BuildDependenciesDownloader.extractFileToCacheLocation(communityRoot = communityRoot,
+-                                                                              archiveFile = jdkArchive,
+-                                                                              BuildDependenciesExtractOptions.STRIP_ROOT)
 +    val jdkExtracted = Path.of("JDK_PATH_HERE")
- 
-     val jdkHome: Path = if (os == OS.MACOSX) {
-       jdkExtracted.resolve("Contents").resolve("Home")
+     val jdkHome = if (os == OS.MACOSX) jdkExtracted.resolve("Contents").resolve("Home") else jdkExtracted
+     infoLog("JPS-bootstrap JDK (jdkHome=$jdkHome, executable=${getJavaExecutable(jdkHome)})")
+     return jdkHome
 --- a/platform/build-scripts/src/org/jetbrains/intellij/build/LinuxDistributionCustomizer.kt
 +++ b/platform/build-scripts/src/org/jetbrains/intellij/build/LinuxDistributionCustomizer.kt
@@ -46,7 +46,7 @@
@ -98,23 +92,24 @@
       val tarGzPath = buildTarGz(arch = arch, runtimeDir = runtimeDir, unixDistPath = osAndArchSpecificDistPath, suffix = suffix(arch))
 --- a/platform/build-scripts/src/org/jetbrains/intellij/build/impl/brokenPlugins.kt
 +++ b/platform/build-scripts/src/org/jetbrains/intellij/build/impl/brokenPlugins.kt
-@@ -11,6 +11,7 @@
- import java.nio.file.Files
- import java.nio.file.Path
+@@ -9,6 +9,8 @@
+ import java.io.ByteArrayOutputStream
+ import java.io.DataOutputStream
 import java.util.*
+import java.nio.file.Path
 +import kotlin.io.path.readText
- 
+
 private const val MARKETPLACE_BROKEN_PLUGINS_URL = "https://plugins.jetbrains.com/files/brokenPlugins.json"
- 
-@@ -22,7 +23,7 @@
- 
+
+@@ -19,7 +21,7 @@
+   val span = Span.current()
+
   val allBrokenPlugins = try {
-     val jsonFormat = Json { ignoreUnknownKeys = true }
 -    val content = downloadAsText(MARKETPLACE_BROKEN_PLUGINS_URL)
 +    val content = Path.of("BROKEN_PLUGINS_HERE").readText()
-     jsonFormat.decodeFromString(ListSerializer(MarketplaceBrokenPlugin.serializer()), content)
+     @Suppress("JSON_FORMAT_REDUNDANT")
+     Json { ignoreUnknownKeys = true }.decodeFromString(ListSerializer(MarketplaceBrokenPlugin.serializer()), content)
   }
-   catch (e: Exception) {
 --- a/platform/build-scripts/src/org/jetbrains/intellij/build/kotlin/KotlinCompilerDependencyDownloader.kt
 +++ b/platform/build-scripts/src/org/jetbrains/intellij/build/kotlin/KotlinCompilerDependencyDownloader.kt
@@ -23,31 +23,11 @@
@ -151,3 +146,17 @@
   }
 
   fun getKotlinJpsPluginVersion(communityRoot: BuildDependenciesCommunityRoot): String {
+--- a/platform/build-scripts/downloader/src/ktor.kt
+++ b/platform/build-scripts/downloader/src/ktor.kt
+@@ -221,6 +221,11 @@
+   val lock = fileLocks.getLock(targetPath.hashCode())
+   lock.lock()
+   try {
+    if (url.startsWith("/")) {
+      var sourceUrl = Path.of(url)
+      Files.copy(sourceUrl, target)
+    }
+
+     if (Files.exists(target)) {
+       Span.current().addEvent("use asset from cache", Attributes.of(
+         AttributeKey.stringKey("url"), url,
--- a/pkgs/applications/editors/jetbrains/patches/restarter-no-static-crt-override.patch
+++ b/pkgs/applications/editors/jetbrains/patches/restarter-no-static-crt-override.patch
@ -1,9 +0,0 @@
--- a/.cargo/config.toml
-+++ b/.cargo/config.toml
-@@ -3,6 +3,3 @@
- 
- [target.'cfg(all(target_os = "macos", target_arch = "x86_64"))']
- rustflags = ["-C", "link-arg=-mmacosx-version-min=10.15"]
-
-[target.'cfg(all(target_os = "linux", target_arch = "x86_64"))']
-rustflags = ["-C", "target-feature=+crt-static"]
--- a/pkgs/applications/editors/jetbrains/source/brokenPlugins.json
+++ b/pkgs/applications/editors/jetbrains/source/brokenPlugins.json
--- a/pkgs/applications/editors/jetbrains/source/build.nix
+++ b/pkgs/applications/editors/jetbrains/source/build.nix
@ -115,7 +115,6 @@ let
    pname = "restarter";
    version = buildVer;
    inherit src;
-    patches = [ ../patches/restarter-no-static-crt-override.patch ];
    sourceRoot = "source/native/restarter";
    cargoHash = restarterHash;
  };
@ -188,11 +187,11 @@ let
      repoUrl = "https://cache-redirector.jetbrains.com/maven.pkg.jetbrains.space/kotlin/p/kotlin/kotlin-ide-plugin-dependencies";
      groupId = builtins.replaceStrings [ "." ] [ "/" ] "org.jetbrains.kotlin";
      artefactId = "kotlin-jps-plugin-classpath";
-      version = "1.9.10";
+      version = "1.9.22";
    in
    fetchurl {
      url = repoUrl + "/" + groupId + "/" + artefactId + "/" + version + "/" + artefactId + "-" + version + ".jar";
-      hash = "sha256-gpB4lg6wailtxSgPyyOrarXCL9+DszojaYGC4ULgU3c=";
+      hash = "sha256-ZPfEceGoIChDmjIAjjhDZpyMWQ7/DtP9Ll4YIrZN+PM=";
    };

    targetClass = if buildType == "pycharm" then "intellij.pycharm.community.build" else "intellij.idea.community.build";
@ -231,7 +230,7 @@ stdenvNoCC.mkDerivation rec {
      -e 's|MAVEN_REPO_HERE|${mvnRepo}/.m2/repository/|' \
      -e 's|MAVEN_PATH_HERE|${maven}/maven|' \
      -i build/deps/src/org/jetbrains/intellij/build/impl/BundledMavenDownloader.kt
-    echo '${buildVer}' > build.txt
+    echo '${buildVer}.SNAPSHOT' > build.txt
  '';

  configurePhase = ''
--- a/pkgs/applications/editors/jetbrains/source/default.nix
+++ b/pkgs/applications/editors/jetbrains/source/default.nix
@ -3,21 +3,21 @@

 {
  idea-community = callPackage ./build.nix {
-    buildVer = "233.13135.103";
+    buildVer = "241.17890.1";
    buildType = "idea";
-    ideaHash = "sha256-ld6qvc0ceERrLSJOC07JEgDmg3lEYdU/XgjZXgzWTAg=";
-    androidHash = "sha256-D8zKkmPOx4RliAtyq2Z8Up2u224blP0SjNjW3yO7nSQ=";
-    jpsHash = "sha256-0cmn0N1UVNzw1hNOpy+9HhkHHNq+rVKnfXM+LjHAQ40=";
-    restarterHash = "sha256-56GqBY/w8expWTXSP3Bad9u7QV3q8LpNN8nd8tk+Zzk=";
+    ideaHash = "sha256-jWFnewxRkriSmV6CgGX1r//uaErMINfx3Z+JpkE34jk=";
+    androidHash = "sha256-hX2YdRYNRg0guskNiYfxdl9osgZojRen82IhgA6G0Eo=";
+    jpsHash = "sha256-Abr7L1FyqzRoUSDtsJs3cTEdkhORY5DzsQnOo5irVRI=";
+    restarterHash = "sha256-XdjyuJUQMvhC0fl6sMj0sRWlqgUb3ZgBmKKXcD3egkk=";
    mvnDeps = ./idea_maven_artefacts.json;
  };
  pycharm-community = callPackage ./build.nix {
-    buildVer = "233.13135.95";
+    buildVer = "241.17890.14";
    buildType = "pycharm";
-    ideaHash = "sha256-avRdwIr+uSXZhcMeamfy7OMYy0Ez7qWljwPc5V6n/60=";
-    androidHash = "sha256-D8zKkmPOx4RliAtyq2Z8Up2u224blP0SjNjW3yO7nSQ=";
-    jpsHash = "sha256-0cmn0N1UVNzw1hNOpy+9HhkHHNq+rVKnfXM+LjHAQ40=";
-    restarterHash = "sha256-YW+5Jl0EWqBj7iRkk70NFL+gccK9/tAOlm/n08XKH8M=";
+    ideaHash = "sha256-tTB91/RHEWP/ZILPNFAbolVBLvgjLXTdD/uF/pdJ22Y=";
+    androidHash = "sha256-hX2YdRYNRg0guskNiYfxdl9osgZojRen82IhgA6G0Eo=";
+    jpsHash = "sha256-Abr7L1FyqzRoUSDtsJs3cTEdkhORY5DzsQnOo5irVRI=";
+    restarterHash = "sha256-TbTIz9pc5wqL54TAMRoQ/9Ax/qsDp+r+h5jn2ub0hes=";
    mvnDeps = ./idea_maven_artefacts.json;
  };
 }
--- a/pkgs/applications/editors/jetbrains/source/idea_maven_artefacts.json
+++ b/pkgs/applications/editors/jetbrains/source/idea_maven_artefacts.json
--- a/pkgs/applications/editors/lifeograph/default.nix
+++ b/pkgs/applications/editors/lifeograph/default.nix
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
    homepage = "https://lifeograph.sourceforge.net/wiki/Main_Page";
    description = "Lifeograph is an off-line and private journal and note taking application";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    mainProgram = "lifeograph";
    platforms = platforms.linux;
  };
--- a/pkgs/applications/editors/thiefmd/default.nix
+++ b/pkgs/applications/editors/thiefmd/default.nix
@ -66,6 +66,6 @@ stdenv.mkDerivation rec {
    mainProgram = "com.github.kmwallio.thiefmd";
    license = licenses.gpl3Only;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -2721,7 +2721,7 @@ let
            description = "CloudFormation Linter IDE integration, autocompletion, and documentation";
            homepage = "https://github.com/aws-cloudformation/cfn-lint-visual-studio-code";
            license = lib.licenses.asl20;
-            maintainers = [ lib.maintainers.wolfangaukang ];
+            maintainers = [ ];
          };
        };

@ -3962,6 +3962,31 @@ let
        };
      };

+      sdras.night-owl = buildVscodeMarketplaceExtension rec {
+        mktplcRef = {
+          name = "night-owl";
+          publisher = "sdras";
+          version = "2.0.1";
+          hash = "sha256-AqfcVV9GYZ+GLgusXfij9z4WzrU9cCHp3sdZb0i6HzE=";
+        };
+        meta = {
+          changelog = "https://github.com/sdras/night-owl-vscode-theme/blob/main/CHANGELOG.md#${
+            builtins.replaceStrings [ "." ] [ "" ] mktplcRef.version
+          }";
+          description = "A Visual Studio Code theme named Light Owl for daytime usage";
+          longDescription = ''
+            A VS Code theme for the night owls out there. Now introducing
+            Light Owl theme for daytime usage. Decisions were based
+            on meaningful contrast for reading comprehension and for
+            optimal razzle dazzle.
+          '';
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=sdras.night-owl";
+          homepage = "https://github.com/sdras/night-owl-vscode-theme";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.pladypus ];
+        };
+      };
+
      seatonjiang.gitmoji-vscode = buildVscodeMarketplaceExtension {
        mktplcRef = {
          publisher = "seatonjiang";
@ -4706,7 +4731,7 @@ let
        };
        meta = {
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.wolfangaukang ];
+          maintainers = [ ];
        };
      };

--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -30,21 +30,21 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "039yb1v4vcgsyp3gfvsfm7pxivf20ycyvidhrk26jfm54ghbbnlz";
-    x86_64-darwin = "1nkwww12yalkxja8vdln45kzrbybhrca8q0zxj8kk9s8bdzsvr5d";
-    aarch64-linux = "0pz8qji6n7j0vrm4l84vxw2sad6q3swz7jda4zyw1n13y7p9kpcj";
-    aarch64-darwin = "1a1b233f28x0v7rb7295jdivzxqvp812x585vacxx1qfmpn6mabl";
-    armv7l-linux = "12569045nzz5zsmaqd4xvq5lmajcl7w3qdv0n9m5rh2g6s32585c";
+    x86_64-linux = "0d0cgsiafmr1wmxqji7mi4hmms7zqql868bcfbq9lmkw96zw85dw";
+    x86_64-darwin = "1zga9zm25h33m42cdnbkpzx5vbcwm9n7036qapq8pgrb23mals7f";
+    aarch64-linux = "0wsdcny0y8xfvdf62qh792ifcq1am8i8xkchh5rscjc3xli6r86s";
+    aarch64-darwin = "13jd39lm667206ga8fqbdb7mdqbkmbgq1l7wid3h4yanz87zbm99";
+    armv7l-linux = "1xpvcypm0xnwjmbj2c1a245yav3nwi0g2k564x91vazfw4nmi7mv";
  }.${system} or throwSystem;
 in
  callPackage ./generic.nix rec {
    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.90.1";
+    version = "1.90.2";
    pname = "vscode" + lib.optionalString isInsiders "-insiders";

    # This is used for VS Code - Remote SSH test
-    rev = "611f9bfce64f25108829dd295f54a6894e87339d";
+    rev = "5437499feb04f7a586f677b155b039bc2b3669eb";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
    longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@ -68,7 +68,7 @@ in
      src = fetchurl {
        name = "vscode-server-${rev}.tar.gz";
        url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-        sha256 = "1j4fd3281jsm10ngq9lzwph3nil0xwbypc180sh5wifb66bmprf6";
+        sha256 = "18npvj29g9xwjyxv3a0fxipk30hgm487cfr3d91dvp5hxhl4dwwr";
      };
    };

--- a/pkgs/applications/file-managers/walk/default.nix
+++ b/pkgs/applications/file-managers/walk/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "walk";
-  version = "1.7.0";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "antonmedv";
    repo = "walk";
    rev = "v${version}";
-    hash = "sha256-hif62WAyJyFHpJoP3ph7gJk1QkEL7qkcv/BJuoXkwFU=";
+    hash = "sha256-xs9K8WrckkpyzHnjYlzRsicMW+o7nTMYCIZVWOwx4PU=";
  };

-  vendorHash = "sha256-e292ke0JiFEopLSozb+FkpwzSuhpIs/PdWOYuNI2M2o=";
+  vendorHash = "sha256-p92H4JqklrV0c4vp9puAgDzBzMpwI40WPz9ix0e77l8=";

  meta = with lib; {
    description = "Terminal file manager";
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -34,6 +34,7 @@
 , nixos-icons
 , perlPackages
 , python3
+, fetchpatch
 }:

 assert libXtSupport -> libX11Support;
@ -50,15 +51,24 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "imagemagick";
-  version = "7.1.1-32";
+  version = "7.1.1-33";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = finalAttrs.version;
-    hash = "sha256-9pDxnUNMmrwnP4rrR41OSZOJZjQnlVvedpLvMZJJnJo=";
+    hash = "sha256-URGcJDgvRdpYZoECyVeSd0ut1Nkl0Sx2pDhYpi8Yf6o=";
  };

+  patches = [
+    # Fixes 7.1.1-32 -> 7.1.1-33 regression that, notably, affects
+    # perlPackages.ImageMagick tests. Should be in the next release.
+    (fetchpatch {
+      url = "https://github.com/ImageMagick/ImageMagick/commit/bdc6c09cec64fd8e1570ee3edf5647acde336272.patch";
+      hash = "sha256-cfmti9DXFhvn0UasmW0vwrNp+Lfepyrnp6ijk+1sJo8=";
+    })
+  ];
+
  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
  outputMan = "out"; # it's tiny

--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@ -56,19 +56,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "4.6.1";
+  version = "4.8.0";
  pname = "darktable";

  src = fetchurl {
    url = "https://github.com/darktable-org/darktable/releases/download/release-${version}/darktable-${version}.tar.xz";
-    sha256 = "sha256-Fu3AoHApPi082k6hDkm9qb3pMuI/nmLi+i56x0rPev0=";
+    sha256 = "sha256-QZhJ6QFScOQHXyNBxrVTLT0czMz6jxlZLLLqOtF/klU=";
  };

-  patches = [
-    ./fix_darwin_x86_compile.patch
-  ];
-
-
  nativeBuildInputs = [ cmake ninja llvmPackages.llvm pkg-config intltool perl desktop-file-utils wrapGAppsHook3 ];

  buildInputs = [
--- a/pkgs/applications/graphics/darktable/fix_darwin_x86_compile.patch
+++ b/pkgs/applications/graphics/darktable/fix_darwin_x86_compile.patch
@ -1,22 +0,0 @@
-From 1620befa933fbe525d8851a8f465db9926b7a588 Mon Sep 17 00:00:00 2001
-From: Mario Zimmermann <mail@zisoft.de>
-Date: Wed, 14 Feb 2024 22:18:42 +0100
-Subject: [PATCH] fix xcode compiler segfault
-
---
- src/common/darktable.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/common/darktable.h b/src/common/darktable.h
-index e5bd1a28902c..2c43b4878bcf 100644
--- a/src/common/darktable.h
-+++ b/src/common/darktable.h
-@@ -140,7 +140,7 @@ extern "C" {
- /* Create cloned functions for various CPU SSE generations */
- /* See for instructions https://hannes.hauswedell.net/post/2017/12/09/fmv/ */
- /* TL;DR : use only on SIMD functions containing low-level paralellized/vectorized loops */
-#if __has_attribute(target_clones) && !defined(_WIN32) && !defined(NATIVE_ARCH)
-+#if __has_attribute(target_clones) && !defined(_WIN32) && !defined(NATIVE_ARCH) && !defined(__APPLE__)
- # if defined(__amd64__) || defined(__amd64) || defined(__x86_64__) || defined(__x86_64)
- #define __DT_CLONE_TARGETS__ __attribute__((target_clones("default", "sse2", "sse3", "sse4.1", "sse4.2", "popcnt", "avx", "avx2", "avx512f", "fma4")))
- # elif defined(__PPC64__)
--- a/pkgs/applications/graphics/djv/default.nix
+++ b/pkgs/applications/graphics/djv/default.nix
@ -17,6 +17,7 @@
 , libpng
 , opencolorio_1
 , freetype
+, openexr
 }:

 let
@ -145,11 +146,12 @@ stdenv.mkDerivation rec {
    ilmbase
    glm
    glfw3
-    zlib.dev
+    zlib
    libpng
    freetype
    opencolorio_1
    djv-deps
+    openexr
  ];

  postPatch = ''
@ -162,6 +164,13 @@ stdenv.mkDerivation rec {
    sed -i cmake/Modules/FindOCIO.cmake \
        -e 's/PATH_SUFFIXES static//' \
        -e '/OpenColorIO_STATIC/d'
+
+    # When searching for OpenEXR this looks for Iex.h, which exists in ilmbase,
+    # since it's a secondary inport, to find the correct OpenEXR lib, we search
+    # for something specifically in OpenEXR.
+
+    sed -i cmake/Modules/FindOpenEXR.cmake \
+        -e 's/find_path(OpenEXR_INCLUDE_DIR NAMES Iex.h PATH_SUFFIXES OpenEXR)/find_path(OpenEXR_INCLUDE_DIR NAMES ImfImage.h PATH_SUFFIXES OpenEXR)/'
  '';

  # GLFW requires a working X11 session.
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -14,14 +14,14 @@

 stdenv.mkDerivation rec {
  pname = "drawio";
-  version = "24.4.8";
+  version = "24.6.1";

  src = fetchFromGitHub {
    owner = "jgraph";
    repo = "drawio-desktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-dtkRi7oisdgMAbaltPcz5umxcd6/F1WOjKQpJUAFFY0=";
+    hash = "sha256-trBSNE5OBBNq18Dn/IwhHpD3ZQ7C5venwsBtyZxv+2k=";
  };

  # `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {

  offlineCache = fetchYarnDeps {
    yarnLock = src + "/yarn.lock";
-    hash = "sha256-JbDIaO5jgPAoSD3hkMaKp3vLU5Avt+G5h427bvWJ08k=";
+    hash = "sha256-9Hq08DXEiOK0P+x89Gl3Y2+dN5r7aS7GNrCSVDGMpFs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/f3d/default.nix
+++ b/pkgs/applications/graphics/f3d/default.nix
@ -6,11 +6,11 @@
 , gzip
 , vtk_9
 , autoPatchelfHook
-, libX11
-, libGL
 , Cocoa
 , OpenGL
+, python3Packages
 , withManual ? !stdenv.isDarwin
+, withPythonBinding ? false
 }:

 stdenv.mkDerivation rec {
@ -37,7 +37,16 @@ stdenv.mkDerivation rec {
    autoPatchelfHook
  ];

-  buildInputs = [ vtk_9 ] ++ lib.optionals stdenv.isDarwin [ Cocoa OpenGL ];
+  buildInputs = [
+    vtk_9
+  ] ++ lib.optionals stdenv.isDarwin [
+    Cocoa
+    OpenGL
+  ] ++ lib.optionals withPythonBinding [
+    python3Packages.python
+    # Using C++ header files, not Python import
+    python3Packages.pybind11
+  ];

  cmakeFlags = [
    # conflict between VTK and Nixpkgs;
@ -45,8 +54,11 @@ stdenv.mkDerivation rec {
    "-DCMAKE_INSTALL_LIBDIR=lib"
    "-DCMAKE_INSTALL_INCLUDEDIR=include"
    "-DCMAKE_INSTALL_BINDIR=bin"
+    "-DF3D_MODULE_EXTERNAL_RENDERING=ON"
  ] ++ lib.optionals withManual [
    "-DF3D_LINUX_GENERATE_MAN=ON"
+  ] ++ lib.optionals withPythonBinding [
+    "-DF3D_BINDINGS_PYTHON=ON"
  ];

  meta = with lib; {
--- a/pkgs/applications/graphics/figma-linux/default.nix
+++ b/pkgs/applications/graphics/figma-linux/default.nix
@ -4,6 +4,7 @@
 , fetchurl
 , autoPatchelfHook
 , dpkg
+, makeWrapper
 , wrapGAppsHook3
 , ...
 }:
@ -17,7 +18,12 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-ukUsNgWOtIRe54vsmRdI62syjIPwSsgNV7kITCw0YUQ=";
  };

-  nativeBuildInputs = [ autoPatchelfHook dpkg wrapGAppsHook3 ];
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+    makeWrapper
+    wrapGAppsHook3
+  ];

  buildInputs = with pkgs;[
    alsa-lib
@ -52,6 +58,10 @@ stdenv.mkDerivation (finalAttrs: {

  sourceRoot = ".";

+  # Instead of double wrapping the binary, simply pass the `gappsWrapperArgs`
+  # to `makeWrapper` directly
+  dontWrapGApps = true;
+
  installPhase = ''
    runHook preInstall

@ -60,6 +70,10 @@ stdenv.mkDerivation (finalAttrs: {

    cp -r usr/* $out

+    wrapProgramShell $out/bin/figma-linux \
+      "''${gappsWrapperArgs[@]}" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+
    runHook postInstall
  '';

--- a/pkgs/applications/graphics/pixeluvo/default.nix
+++ b/pkgs/applications/graphics/pixeluvo/default.nix
@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    mainProgram = "pixeluvo";
  };
 }
--- a/pkgs/applications/graphics/pixinsight/default.nix
+++ b/pkgs/applications/graphics/pixinsight/default.nix
@ -1,18 +1,60 @@
-{ stdenv, lib, requireFile, wrapQtAppsHook, autoPatchelfHook, makeWrapper, unixtools, fakeroot
-, mailcap, libGL, libpulseaudio, alsa-lib, nss, gd, gst_all_1, nspr, expat, fontconfig
-, dbus, glib, zlib, openssl, libdrm, cups, avahi-compat, xorg, wayland, libudev0-shim
-# Qt 5 subpackages
-, qtbase, qtgamepad, qtserialport, qtserialbus, qtvirtualkeyboard, qtmultimedia, qt3d, mlt
+{ stdenv
+, lib
+, requireFile
+, wrapQtAppsHook
+, autoPatchelfHook
+, makeWrapper
+, unixtools
+, fakeroot
+, mailcap
+, libGL
+, libpulseaudio
+, alsa-lib
+, nss
+, gd
+, gst_all_1
+, nspr
+, expat
+, fontconfig
+, dbus
+, glib
+, zlib
+, openssl
+, libdrm
+, cups
+, avahi-compat
+, xorg
+, wayland
+, libudev0-shim
+, bubblewrap
+, libjpeg8
+, gdk-pixbuf
+, gtk3
+, pango
+  # Qt 6 subpackages
+, qtbase
+, qtserialport
+, qtserialbus
+, qtvirtualkeyboard
+, qtmultimedia
+, qt3d
+, mlt
+, qtlocation
+, qtwebengine
+, qtquick3d
+, qtwayland
+, qtwebview
+, qtscxml
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "pixinsight";
-  version = "1.8.9-2";
+  version = "1.8.9-3";

  src = requireFile rec {
-    name = "PI-linux-x64-${version}-20230920-c.tar.xz";
+    name = "PI-linux-x64-${finalAttrs.version}-20240619-c.tar.xz";
    url = "https://pixinsight.com/";
-    hash = "sha256-g7paYTYv52XBg0w3d3YhVNrmt+iS20uobaUsvY6F3jM=";
+    hash = "sha256-WZrD+X7zE1i29+YsGJ+wbIXmlVon9bczHvvRAkQXz6M=";
    message = ''
      PixInsight is available from ${url} and requires a commercial (or trial) license.
      After a license has been obtained, PixInsight can be downloaded from the software distribution
@ -30,6 +72,7 @@ stdenv.mkDerivation rec {
    autoPatchelfHook
    mailcap
    libudev0-shim
+    bubblewrap
  ];

  buildInputs = [
@ -53,15 +96,25 @@ stdenv.mkDerivation rec {
    wayland
    cups
    avahi-compat
+    libjpeg8
+    gdk-pixbuf
+    gtk3
+    pango
    # Qt stuff
    qt3d
    mlt
    qtbase
-    qtgamepad
+    #qtgamepad
    qtserialport
    qtserialbus
    qtvirtualkeyboard
    qtmultimedia
+    qtlocation
+    qtwebengine
+    qtquick3d
+    qtwayland
+    qtwebview
+    qtscxml
  ] ++ (with xorg; [
    libX11
    libXdamage
@ -86,9 +139,8 @@ stdenv.mkDerivation rec {
  installPhase = ''
    mkdir -p $out/bin $out/opt/PixInsight $out/share/{applications,mime/packages,icons/hicolor}

-    fakeroot script -ec "./installer \
+    bwrap --bind /build /build --bind $out/opt /opt --bind /nix /nix --dev /dev fakeroot script -ec "./installer \
      --yes \
-      --install-dir=$out/opt/PixInsight \
      --install-desktop-dir=$out/share/applications \
      --install-mime-dir=$out/share/mime \
      --install-icons-dir=$out/share/icons/hicolor \
@ -97,6 +149,11 @@ stdenv.mkDerivation rec {

    rm -rf $out/opt/PixInsight-old-0
    ln -s $out/opt/PixInsight/bin/PixInsight $out/bin/.
+    ln -s $out/opt/PixInsight/bin/lib $out/lib
+
+    # Remove signatures of plugins, as they are only working if actually installed
+    # under /opt. In the Nix setup, they are causing trouble.
+    find $out/opt/PixInsight/ -name "*.xsgn" -exec rm {} \;
  '';

  # Some very exotic Qt libraries are not available in nixpkgs
@ -118,7 +175,7 @@ stdenv.mkDerivation rec {
  ];
  dontWrapQtApps = true;
  postFixup = ''
-    wrapProgram $out/opt/PixInsight/bin/PixInsight ${builtins.toString qtWrapperArgs}
+    wrapProgram $out/opt/PixInsight/bin/PixInsight ${builtins.toString finalAttrs.qtWrapperArgs}
  '';

  meta = with lib; {
@ -128,7 +185,7 @@ stdenv.mkDerivation rec {
    license = licenses.unfree;
    platforms = [ "x86_64-linux" ];
    maintainers = [ maintainers.sheepforce ];
-    hydraPlatforms = [];
+    hydraPlatforms = [ ];
    mainProgram = "PixInsight";
  };
-}
+})
--- a/pkgs/applications/misc/cobang/default.nix
+++ b/pkgs/applications/misc/cobang/default.nix
@ -97,7 +97,7 @@ buildPythonApplication rec {
    description = "QR code scanner desktop app for Linux";
    homepage = "https://github.com/hongquan/CoBang";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    mainProgram = "cobang";
    platforms = [ "x86_64-linux" ];
  };
--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "CopyQ";
-  version = "8.0.0";
+  version = "9.0.0";

  src = fetchFromGitHub {
    owner = "hluk";
    repo = "CopyQ";
    rev = "v${version}";
-    hash = "sha256-Ewunl4k9f0aDjilhKAsVxwR3S6uSZ1xwtu6ccNsNOgk=";
+    hash = "sha256-Dxiytspqs4+bcnUM+B3lO8iQp9rrCvMfI+WMFMCtM7g=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/diebahn/default.nix
+++ b/pkgs/applications/misc/diebahn/default.nix
@ -21,19 +21,19 @@

 stdenv.mkDerivation rec {
  pname = "diebahn";
-  version = "2.5.0";
+  version = "2.6.0";

  src = fetchFromGitLab {
    owner = "schmiddi-on-mobile";
    repo = "railway";
    rev = version;
-    hash = "sha256-Oj+y3BFAVzWUt+S0iOtKzFBiJGOGHuTj41FHHuOrWh8=";
+    hash = "sha256-cVCq7iVurX5SlCs7A5FSds6KaxMW3Qv/JIhhO69FTrk=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    name = "${pname}-${src}";
    inherit src;
-    hash = "sha256-//tr1CLn5Qoc+XMFzwNIvmsQD4SrjNRTX3hUPqlhwNs=";
+    hash = "sha256-J8KOmvSiUNBpt4qSFnNEwSKFJMSaTFd14G2INDYwPUE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/firefly-desktop/default.nix
+++ b/pkgs/applications/misc/firefly-desktop/default.nix
@ -27,7 +27,7 @@ in appimageTools.wrapType2 {
    description = "IOTA's New Wallet";
    homepage = "https://firefly.iota.org";
    license = licenses.asl20;
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    platforms = [ "x86_64-linux" ];
    mainProgram = "firefly-desktop";
  };
--- a/pkgs/applications/misc/mobilecoin-wallet/default.nix
+++ b/pkgs/applications/misc/mobilecoin-wallet/default.nix
@ -33,7 +33,7 @@ in appimageTools.wrapType2 {
    description = "User-friendly desktop wallet with support for transaction history, encrypted contact book, gift codes, and payments";
    homepage = "https://github.com/mobilecoinofficial/desktop-wallet";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    mainProgram = "mobilecoin-wallet";
    platforms = [ "x86_64-linux" ];
  };
--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@ -29,13 +29,13 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "organicmaps";
-  version = "2024.06.02-12";
+  version = "2024.06.19-3";

  src = fetchFromGitHub {
    owner = "organicmaps";
    repo = "organicmaps";
    rev = "${version}-android";
-    hash = "sha256-TOKBEnSa9kzfGsiNpMllLjcJtdhYfz9m4uAg0lUF8Z4=";
+    hash = "sha256-LB3yLBoO6nXRvfuWWB2JofeAgQQFtEgqNo2QFQ3k/vc=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/safeeyes/default.nix
+++ b/pkgs/applications/misc/safeeyes/default.nix
@ -18,11 +18,11 @@ with python3.pkgs;

 buildPythonApplication rec {
  pname = "safeeyes";
-  version = "2.1.8";
+  version = "2.1.9";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-65U/j6P6X4JzhL0aEOnzKa/Al6SYprOOxix2dtcusJQ=";
+    hash = "sha256-Z1c1DVwCwPiOPvCYNsoXJBMfVzIQA+/6wStV8BShahc=";
  };

  postPatch = ''
--- a/pkgs/applications/misc/sticky/default.nix
+++ b/pkgs/applications/misc/sticky/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "sticky";
-  version = "1.20";
+  version = "1.21";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = pname;
    rev = version;
-    hash = "sha256-HzTXaJgDu72pWM0mGNNBy2yFB0u0rqATFK9JzyOw8oE=";
+    hash = "sha256-EH5EyvI3iAZr+aSV3DKM9RLkPmUcwKKXlOXSU0ECsPI=";
  };

  postPatch = ''
--- a/pkgs/applications/misc/tandoor-recipes/default.nix
+++ b/pkgs/applications/misc/tandoor-recipes/default.nix
@ -165,7 +165,7 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
    updateScript = ./update.sh;

    tests = {
-      inherit (nixosTests) tandoor-recipes;
+      inherit (nixosTests) tandoor-recipes tandoor-recipes-script-name;
    };
  };

--- a/pkgs/applications/misc/thedesk/default.nix
+++ b/pkgs/applications/misc/thedesk/default.nix
@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
    homepage = "https://thedesk.top";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    platforms = [ "x86_64-linux" ];
    mainProgram = "thedesk";
  };
--- a/pkgs/applications/misc/transifex-cli/default.nix
+++ b/pkgs/applications/misc/transifex-cli/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "transifex-cli";
-  version = "1.6.13";
+  version = "1.6.14";

  src = fetchFromGitHub {
    owner = "transifex";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-SVXrrpkz2veA1L5p88iGQxHAUtySiYge0ffY2HyVCr0=";
+    sha256 = "sha256-yKkRoeq0hPYMjZcoL9h3l8FimnCjjVSlk9whliEnkzE=";
  };

  vendorHash = "sha256-rcimaHr3fFeHSjZXw1w23cKISCT+9t8SgtPnY/uYGAU=";
--- a/pkgs/applications/misc/tzupdate/default.nix
+++ b/pkgs/applications/misc/tzupdate/default.nix
@ -1,24 +1,28 @@
-{ lib, python3, fetchPypi }:
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:

-let
-  inherit (python3.pkgs) buildPythonApplication requests;
-in
-buildPythonApplication rec {
+rustPlatform.buildRustPackage rec {
  pname = "tzupdate";
-  version = "2.1.0";
+  version = "3.1.0";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "5b55795c390e4ccc90e649c8cc387447daaf30a21d68f7196b49824cbcba8adc";
+  src = fetchFromGitHub {
+    owner = "cdown";
+    repo = "tzupdate";
+    rev = version;
+    hash = "sha256-eod4yFzX7pATNQmG7jU+r9mnC9nprJ55ufMXpKjw/YI=";
  };

-  propagatedBuildInputs = [ requests ];
+  cargoHash = "sha256-5+lp5xlwJxFDqzVxptJPX7z0iLoMkgdwHxvRVIXHF7Y=";

  meta = with lib; {
-    description = "Update timezone information based on geoip";
-    mainProgram = "tzupdate";
+    description = "Set the system timezone based on IP geolocation";
    homepage = "https://github.com/cdown/tzupdate";
-    maintainers = [ ];
-    license = licenses.unlicense;
+    license = licenses.mit;
+    maintainers = with maintainers; [ camillemndn ];
+    platforms = platforms.linux;
+    mainProgram = "tzupdate";
  };
 }
--- a/pkgs/applications/misc/upwork/default.nix
+++ b/pkgs/applications/misc/upwork/default.nix
@ -63,6 +63,6 @@ stdenv.mkDerivation rec {
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ zakkor wolfangaukang ];
+    maintainers = with maintainers; [ zakkor ];
  };
 }
--- a/pkgs/applications/misc/whalebird/default.nix
+++ b/pkgs/applications/misc/whalebird/default.nix
@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
    homepage = "https://whalebird.social";
    changelog = "https://github.com/h3poteto/whalebird-desktop/releases/tag/v${version}";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ wolfangaukang weathercold ];
+    maintainers = with maintainers; [ weathercold ];
    platforms = [ "x86_64-linux" "aarch64-linux" ];
  };
 }
--- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix
+++ b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
@ -90,7 +90,7 @@ let
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "13.0.16";
+  version = "13.5";

  sources = {
    x86_64-linux = fetchurl {
@ -102,7 +102,7 @@ let
        "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-+8jur2Fc+fhrWO9xyaSuwzUZnLLhTP/uz15+EX6E7K4=";
+      hash = "sha256-Wz1gYK1CqfK4aa7K2PR8wKx7VcvALquYKA2vetUAdeU=";
    };
  };

--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@ -20,7 +20,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "palemoon-bin";
-  version = "33.1.1";
+  version = "33.2.0";

  src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";

@ -158,11 +158,11 @@ stdenv.mkDerivation (finalAttrs: {
    in {
      gtk3 = fetchzip {
        urls = urlRegionVariants "gtk3";
-        hash = "sha256-0i0hXC6mC1SY2V6ANMXHS4LZ/HZk8FUsSDQfQUE14IM=";
+        hash = "sha256-h6ohLm9I6esvVa9bek/j2s/jiIcEOwjd8/dCyUvqyLw=";
      };
      gtk2 = fetchzip {
        urls = urlRegionVariants "gtk2";
-        hash = "sha256-RnBlCxIsWxm6BbtAS0YKHtix93N6t9jihFItqhtLhRU=";
+        hash = "sha256-To/41og5hxFL6efJhNfRNJw/fOXZA5Le16DZsSJrXfc=";
      };
    };

--- a/pkgs/applications/networking/browsers/tor-browser/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser/default.nix
@ -101,7 +101,7 @@ lib.warnIf (useHardenedMalloc != null)
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "13.0.16";
+  version = "13.5";

  sources = {
    x86_64-linux = fetchurl {
@ -111,7 +111,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-gSV2G9U0fh+PAe/vCInIjssBFk0ciiD6h0rpZUxVzs0=";
+      hash = "sha256-npqrGyCwqMeZ8JssR/EpvDClkLQ3K0xEfE19fHn+GDs=";
    };

    i686-linux = fetchurl {
@ -121,7 +121,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
      ];
-      hash = "sha256-Lh9rHrqX+eeQ47Z8e9ChRH8qWeDwSbyR5TnNfwHAb9M=";
+      hash = "sha256-qeXLBFhcCPDWRuCZiLL1wOY6BRWsk0h36jWe5U6eCJ8=";
    };
  };

--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.11.15";
+  version = "0.11.16";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    hash = "sha256-tfJ9LTPu8B6xlIkAKmbl2d2GLY9p4VcOQGOC5TTx9Cs=";
+    hash = "sha256-i/wEgUK4NxFonZXJKuhLHBgCXQ25A/UDyavhJdjuJ+M=";
  };

  CGO_ENABLED = 0;
--- a/pkgs/applications/networking/cluster/cmctl/default.nix
+++ b/pkgs/applications/networking/cluster/cmctl/default.nix
@ -8,18 +8,18 @@

 buildGoModule rec {
  pname = "cmctl";
-  version = "1.14.5";
+  version = "1.14.7";

  src = fetchFromGitHub {
    owner = "cert-manager";
    repo = "cert-manager";
    rev = "v${version}";
-    hash = "sha256-WitYq3/veaARZQHoseJnT5h0AGmXVlLzRe8KCOJuY0w=";
+    hash = "sha256-ZvrR8k1jiyAMUKM9VA6vKH2uhMKnd22OQe08CIlxXjs=";
  };

  sourceRoot = "${src.name}/cmd/ctl";

-  vendorHash = "sha256-27XvT33S/vgGo5MQDpHzTN+K1nNPR6OOFggzLhatygI=";
+  vendorHash = "sha256-qaSzAPNVe25Fbbfqy0OFFnMJ21IlWuoJKwnT7y2wmOs=";

  ldflags = [
    "-s"
--- a/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix
+++ b/pkgs/applications/networking/feedreaders/gnome-feeds/default.nix
@ -1,89 +0,0 @@
-{ lib
-, callPackage
-
-, fetchFromGitLab
-
-, appstream
-, gobject-introspection
-, meson
-, ninja
-, pkg-config
-, wrapGAppsHook3
-
-, glib
-, glib-networking
-, gtk3
-, libhandy
-, listparser ? callPackage ./listparser.nix { }
-, webkitgtk
-, python3
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "gnome-feeds";
-  version = "0.16.2";
-
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "World";
-    repo = "gfeeds";
-    rev = version;
-    sha256 = "sha256-66dwVR9owg050aHCHJek7jYnT+/yyCKo4AaUE0hCqBA=";
-  };
-
-  format = "other";
-
-  nativeBuildInputs = [
-    appstream
-    glib # for glib-compile-schemas
-    gobject-introspection
-    meson
-    ninja
-    pkg-config
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    glib
-    glib-networking
-    gtk3
-    libhandy
-    webkitgtk
-  ];
-
-  propagatedBuildInputs = with python3.pkgs; [
-    beautifulsoup4
-    python-dateutil
-    feedparser
-    html5lib
-    listparser
-    lxml
-    pillow
-    pygments
-    pygobject3
-    readability-lxml
-    pytz
-    requests
-  ];
-
-  dontWrapGApps = true;
-
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-
-  passthru = {
-    inherit listparser;
-  };
-
-  meta = with lib; {
-    description = "RSS/Atom feed reader for GNOME";
-    mainProgram = "gfeeds";
-    homepage = "https://gitlab.gnome.org/World/gfeeds";
-    license = licenses.gpl3Plus;
-    maintainers = [
-      maintainers.pbogdan
-    ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/networking/feedreaders/gnome-feeds/listparser.nix
+++ b/pkgs/applications/networking/feedreaders/gnome-feeds/listparser.nix
@ -1,33 +0,0 @@
-{ lib
-, python3
-, fetchPypi
-}:
-
-python3.pkgs.buildPythonPackage rec {
-  pname = "listparser";
-  version = "0.18";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0hdqs1mmayw1r8yla43hgb4d9y3zqs5483vgf8j9ygczkd2wrq2b";
-  };
-
-  propagatedBuildInputs = with python3.pkgs; [
-    requests
-    six
-  ];
-
-  checkPhase = ''
-    ${python3.interpreter} lptest.py
-  '';
-
-  meta = with lib; {
-    description = "Parser for subscription lists";
-    homepage = "https://github.com/kurtmckee/listparser";
-    license = licenses.lgpl3Plus;
-    maintainers = [
-      maintainers.pbogdan
-    ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@ -3,16 +3,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "newsboat";
-  version = "2.35";
+  version = "2.36";

  src = fetchFromGitHub {
    owner = "newsboat";
    repo = "newsboat";
    rev = "r${version}";
-    hash = "sha256-WbicKP46N8MVjUeerYUdcHJO5Qf7rQFyYCpxexd2wDY=";
+    hash = "sha256-RnDnyRAZ71aE5st5wUcUKjFFGY288oFpiyDXAno15MQ=";
  };

-  cargoHash = "sha256-B6U+DxIRm9Sn4x+dZCfNKENNDsTUVZFT6i0Yz47gjTs=";
+  cargoHash = "sha256-0z3G8j0Qk0HEDUKA7fmjFfNW956rRtzKO+0ltNQR4es=";

  # TODO: Check if that's still needed
  postPatch = lib.optionalString stdenv.isDarwin ''
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
    homepage = "https://alfaview.com";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
-    maintainers = with maintainers; [ wolfangaukang hexchen ];
+    maintainers = with maintainers; [ hexchen ];
    mainProgram = "alfaview";
    platforms = [ "x86_64-linux" ];
  };
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -4,7 +4,7 @@ let
    if stdenv.isLinux then {
      stable = "0.0.56";
      ptb = "0.0.90";
-      canary = "0.0.422";
+      canary = "0.0.431";
      development = "0.0.19";
    } else {
      stable = "0.0.307";
@ -25,7 +25,7 @@ let
      };
      canary = fetchurl {
        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-MTC079WTN0Vw57aLro1WkHRL09IKYjnUsfBAMiiHjI0=";
+        hash = "sha256-59Sv3U3osfk+QoXgorpqK7CU0nJBdpFOMkoGRgHN3v8=";
      };
      development = fetchurl {
        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
--- a/pkgs/applications/networking/instant-messengers/element/pin.nix
+++ b/pkgs/applications/networking/instant-messengers/element/pin.nix
@ -1,9 +1,9 @@
 {
-  "version" = "1.11.68";
+  "version" = "1.11.69";
  "hashes" = {
-    "desktopSrcHash" = "sha256-L3rto0V0RIf5ILWYGFnuGpwciwc55rR2+Zqj/azuWlo=";
+    "desktopSrcHash" = "sha256-sSEWnvWZ6sfrHL3mqbq3T90At131C1W7N72Hb/BHKCk=";
    "desktopYarnHash" = "0awz1dscksx4zvp99p08mdl2h6i7gbwjddanl3bhxkysxqdnwqb1";
-    "webSrcHash" = "sha256-IRgEV4H0fYo0ijLWF8ICdewqencgTJlqstzsGzlJI0k=";
-    "webYarnHash" = "092m0bhc3pp9dpaz6kri3hi723kqq1pbja4vf2xbxyx4x4yf0vlz";
+    "webSrcHash" = "sha256-oFSaKtig1z3jepLpwJW4i5VskMBhKUIbPsCfLQuCgMY=";
+    "webYarnHash" = "1rzq05dnkwjglira52wllsl5nqw1g8whvamjfxzgvp0nyby46nha";
  };
 }
--- a/pkgs/applications/networking/instant-messengers/revolt-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/revolt-desktop/default.nix
@ -1,62 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, appimageTools
-, makeWrapper
-, electron
-}:
-
-stdenv.mkDerivation rec {
-  pname = "revolt-desktop";
-  version = "1.0.6";
-
-  src = fetchurl {
-    url = "https://github.com/revoltchat/desktop/releases/download/v${version}/Revolt-linux.AppImage";
-    sha256 = "sha256-Wsm6ef2Reenq3/aKGaP2yzlOuLKaxKtRHCLLMxvWUUY=";
-  };
-
-  appimageContents = appimageTools.extractType2 {
-    name = "${pname}-${version}";
-    inherit src;
-  };
-
-  dontUnpack = true;
-  dontConfigure = true;
-  dontBuild = true;
-
-  nativeBuildInputs = [
-    makeWrapper
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin $out/share/{applications,revolt-desktop}
-
-    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
-    cp -a ${appimageContents}/revolt-desktop.desktop $out/share/applications/${pname}.desktop
-    cp -a ${appimageContents}/usr/share/icons $out/share/icons
-
-    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace 'Exec=AppRun' 'Exec=${pname}'
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/resources/app.asar \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations}}"
-  '';
-
-  meta = with lib; {
-    description = "Open source user-first chat platform";
-    homepage = "https://revolt.chat/";
-    changelog = "https://github.com/revoltchat/desktop/releases/tag/v${version}";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ heyimnova ];
-    platforms = platforms.linux;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    mainProgram = "revolt-desktop";
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop-beta";
  dir = "Signal Beta";
-  version = "7.13.0-beta.1";
+  version = "7.14.0-beta.1";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-DvYRvIA+rg4RKXbqWjWj7oFnfLboEiMeP7HgGYkRBDM=";
+  hash = "sha256-SC7CCqylPkc/qmlSYlXJcVWGi1+hvRQ9qBGR6wqo6sk=";
 }
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix
@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
  pname = "signal-desktop";
  dir = "Signal";
-  version = "7.12.0";
+  version = "7.13.0";
  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-k8Dp3MiWRNpWEGqYtt5o8FtL3fJ9AkIm+hjvW8r6qG0=";
+  hash = "sha256-lwo5O8UAjjMuaeM8J804oN+y72uYZBL+eP/NwpnD4H0=";
 }
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix
@ -64,14 +64,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "telegram-desktop";
-  version = "5.1.7";
+  version = "5.1.8";

  src = fetchFromGitHub {
    owner = "telegramdesktop";
    repo = "tdesktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-OH9+cH5CQyrp4DSKXEMs6csGiH+GAtxJT4P9YidmAcM=";
+    hash = "sha256-YTCvniC8THoz0BUM/gkr97rhbbSVQ+SCE1H3qS68lIM=";
  };

  patches = [
--- a/pkgs/applications/networking/instant-messengers/threema-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/threema-desktop/default.nix
@ -122,7 +122,7 @@ buildNpmPackage rec {
    homepage = "https://threema.ch";
    license = licenses.agpl3Only;
    mainProgram = "threema";
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix
+++ b/pkgs/applications/networking/instant-messengers/twitch-tui/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "twitch-tui";
-  version = "2.6.11";
+  version = "2.6.12";

  src = fetchFromGitHub {
    owner = "Xithrius";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-3Ibf9UULQ0NQ6+oVvLVxUsSSaQ4ilxLehBPZhkrzILQ=";
+    hash = "sha256-mEpeuopMzZhWOAikEP7Er8xcgNkGbCTkJJYrQr7GrBQ=";
  };

-  cargoHash = "sha256-GK9P+IytkfhfogvPLuYF9+ngs2vr6Quv+v+Rai2cgx8=";
+  cargoHash = "sha256-U9L4SrYTAUcQ9/2f8tD7jxByVQS9P6OXpra6QvbhNNg=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -48,23 +48,23 @@ let
  # and often with different versions.  We write them on three lines
  # like this (rather than using {}) so that the updater script can
  # find where to edit them.
-  versions.aarch64-darwin = "6.0.11.35001";
-  versions.x86_64-darwin = "6.0.11.35001";
-  versions.x86_64-linux = "6.0.12.5501";
+  versions.aarch64-darwin = "6.1.0.35886";
+  versions.x86_64-darwin = "6.1.0.35886";
+  versions.x86_64-linux = "6.1.0.198";

  srcs = {
    aarch64-darwin = fetchurl {
      url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
      name = "zoomusInstallerFull.pkg";
-      hash = "sha256-U8CdizMicbBLrKWYSRYl8u5tD/1276HwdHlr4kVHbiQ=";
+      hash = "sha256-jAH/3r2AM8WAzfHE8CvKBrr53sM/9DH624C+EiJIdXs=";
    };
    x86_64-darwin = fetchurl {
      url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-iAETUWviaaQeEg6/FM1GWSJ3Qyvc0zBfuqOfA6X7HpY=";
+      hash = "sha256-nKJPZQbyVG+P974hP4+4eAtupEQOf5Kl64Zp+jV/Ka0=";
    };
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-h9gjVd7xqChaoC2BZWEhR5WdyfQrPiBjM2WHXMgp8uQ=";
+      hash = "sha256-R4f0dnwqkODFeo8mPBecAI/AGQLwYkcNtJq6UVXCPfI=";
    };
  };

--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@ -36,14 +36,14 @@ let
  in
    assert lib.all (p: p.enabled -> ! (builtins.elem null p.buildInputs)) plugins;
    stdenv.mkDerivation rec {
-      version = "4.3.2";
+      version = "4.3.3";
      pname = "weechat";

      hardeningEnable = [ "pie" ];

      src = fetchurl {
        url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-        hash = "sha256-4fMd490+4ZiRVvTATp9L9hOdpq1Qwk9pH8EFfkz8N8Y=";
+        hash = "sha256-VYfbbOoziVvaEBxGptCen8COD8p2/4rDsUTasysQXtg=";
      };

      # Why is this needed? https://github.com/weechat/weechat/issues/2031
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@ -30,7 +30,7 @@ appimageTools.wrapType2 rec {
    changelog = "https://github.com/tutao/tutanota/releases/tag/tutanota-desktop-release-${version}";
    license = licenses.gpl3Only;
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    mainProgram = "tutanota-desktop";
    platforms = [ "x86_64-linux" ];
  };
--- a/pkgs/applications/networking/newsreaders/liferea/default.nix
+++ b/pkgs/applications/networking/newsreaders/liferea/default.nix
@ -24,11 +24,11 @@

 stdenv.mkDerivation rec {
  pname = "liferea";
-  version = "1.15.6";
+  version = "1.15.7";

  src = fetchurl {
    url = "https://github.com/lwindolf/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-4P/0fwHofsRjZcLuFdkUKxWIp/9P5yXA2ED/zqTGd94=";
+    hash = "sha256-vv6hrvfD1T+eH/Bi1ID0yoxB4747Q+nMvklT49uaX38=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/newsreaders/raven-reader/default.nix
+++ b/pkgs/applications/networking/newsreaders/raven-reader/default.nix
@ -31,7 +31,7 @@ appimageTools.wrapType2 {
    mainProgram = "raven-reader";
    homepage = "https://ravenreader.app/";
    license = licenses.mit;
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/networking/p2p/torrential/default.nix
+++ b/pkgs/applications/networking/p2p/torrential/default.nix
@ -17,7 +17,7 @@
 , libevent
 , libgee
 , libnatpmp
-, libtransmission
+, libtransmission_3
 , libutp
 , miniupnpc
 , openssl
@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    libevent
    libgee
    libnatpmp
-    libtransmission
+    libtransmission_3
    libutp
    miniupnpc
    openssl
--- a/pkgs/applications/networking/protonvpn-cli/default.nix
+++ b/pkgs/applications/networking/protonvpn-cli/default.nix
@ -33,7 +33,7 @@ buildPythonApplication rec {
  meta = with lib; {
    description = "Linux command-line client for ProtonVPN";
    homepage = "https://github.com/protonvpn/linux-cli";
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    mainProgram = "protonvpn-cli";
--- a/pkgs/applications/networking/protonvpn-gui/default.nix
+++ b/pkgs/applications/networking/protonvpn-gui/default.nix
@ -98,6 +98,6 @@ buildPythonApplication rec {
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
    mainProgram = "protonvpn-app";
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/applications/networking/protonvpn-gui/legacy.nix
+++ b/pkgs/applications/networking/protonvpn-gui/legacy.nix
@ -71,7 +71,7 @@ buildPythonApplication rec {
  meta = with lib; {
    description = "Official ProtonVPN Linux app";
    homepage = "https://github.com/ProtonVPN/linux-app";
-    maintainers = with maintainers; [ wolfangaukang ];
+    maintainers = [ ];
    license = licenses.gpl3Plus;
    mainProgram = "protonvpn";
    platforms = platforms.linux;
--- a/Show More
+++ b/Show More