Merge branch 'master' into staging-next

2025-02-16 17:14:00 +00:00 · 2024-04-28 04:02:14 +02:00 · 2024-04-28 04:02:14 +02:00 · 7f45fee52a
commit 7f45fee52a
parent 19c30e016f 32a79f412e
285 changed files with 7544 additions and 2639 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1086,12 +1086,6 @@
    githubId = 153175;
    name = "Andrew Marshall";
  };
-  amaxine = {
-    email = "max@ine.dev";
-    github = "amaxine";
-    githubId = 35892750;
-    name = "Maxine Aubrey";
-  };
  ambroisie = {
    email = "bruno.nixpkgs@belanyi.fr";
    github = "ambroisie";
@ -1247,12 +1241,6 @@
    githubId = 962885;
    name = "Andrew Chambers";
  };
-  andrew-d = {
-    email = "andrew@du.nham.ca";
-    github = "andrew-d";
-    githubId = 1079173;
-    name = "Andrew Dunham";
-  };
  andrewrk = {
    email = "superjoe30@gmail.com";
    github = "andrewrk";
@ -4780,12 +4768,6 @@
    githubId = 150736012;
    email = "me+git@delliott.xyz";
  };
-  delroth = {
-    email = "delroth@gmail.com";
-    github = "delroth";
-    githubId = 202798;
-    name = "Pierre Bourdon";
-  };
  delta = {
    email = "d4delta@outlook.fr";
    github = "D4Delta";
@ -5963,12 +5945,6 @@
    name = "Zhenbo Li";
    matrix = "@zhenbo:matrix.org";
  };
-  endocrimes = {
-    email = "dani@builds.terrible.systems";
-    github = "endocrimes";
-    githubId = 1330683;
-    name = "Danielle Lancashire";
-  };
  enorris = {
    name = "Eric Norris";
    email = "erictnorris@gmail.com";
@ -6736,12 +6712,6 @@
    githubId = 5918766;
    name = "Franz Thoma";
  };
-  fogti = {
-    name = "Alain Fogtia Zscheile";
-    email = "fogti+devel@ytrizja.de";
-    github = "fogti";
-    githubId = 1618343;
-  };
  foo-dogsquared = {
    email = "foodogsquared@foodogsquared.one";
    github = "foo-dogsquared";
@ -13744,15 +13714,6 @@
    githubId = 3856390;
    email = "mschwaig+nixpkgs@eml.cc";
  };
-  msfjarvis = {
-    github = "msfjarvis";
-    githubId = 13348378;
-    name = "Harsh Shandilya";
-    email = "nixos@msfjarvis.dev";
-    keys = [{
-      fingerprint = "8F87 050B 0F9C B841 1515  7399 B784 3F82 3355 E9B9";
-    }];
-  };
  msiedlarek = {
    email = "mikolaj@siedlarek.pl";
    github = "msiedlarek";
@ -19053,12 +19014,6 @@
    githubId = 16364318;
    name = "Jeffrey Harmon";
  };
-  srapenne = {
-    email = "solene@perso.pw";
-    github = "rapenne-s";
-    githubId = 248016;
-    name = "Solène Rapenne";
-  };
  srghma = {
    email = "srghma@gmail.com";
    github = "srghma";
@ -22580,12 +22535,6 @@
    githubId = 393108;
    name = "Damien Diederen";
  };
-  zumorica = {
-    name = "Vera Aguilera Puerto";
-    email = "gradientvera+nix@outlook.com";
-    github = "Zumorica";
-    githubId = 6766154;
-  };
  zupo = {
    name = "Nejc Zupan";
    email = "nejczupan+nix@gmail.com";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -32,7 +32,6 @@ with lib.maintainers; {
  acme = {
    members = [
      aanderse
-      andrew-d
      arianvp
      emily
      flokli
@ -376,7 +375,6 @@ with lib.maintainers; {
      krav
      talyz
      yayayayaka
-      yuka
    ];
    scope = "Maintain gitlab packages.";
    shortName = "gitlab";
@ -404,7 +402,6 @@ with lib.maintainers; {
      hedning
      jtojnar
      dasj19
-      amaxine
    ];
    githubTeams = [
      "gnome"
--- a/nixos/doc/manual/configuration/profiles/graphical.section.md
+++ b/nixos/doc/manual/configuration/profiles/graphical.section.md
@ -6,5 +6,5 @@ graphical installation CD.
 It sets [](#opt-services.xserver.enable),
 [](#opt-services.displayManager.sddm.enable),
 [](#opt-services.xserver.desktopManager.plasma5.enable),
-and [](#opt-services.xserver.libinput.enable) to true. It also
+and [](#opt-services.libinput.enable) to true. It also
 includes glxinfo and firefox in the system packages list.
--- a/nixos/doc/manual/configuration/x-windows.chapter.md
+++ b/nixos/doc/manual/configuration/x-windows.chapter.md
@ -207,7 +207,7 @@ Latitude series) can be enabled as follows:

 ```nix
 {
-  services.xserver.libinput.enable = true;
+  services.libinput.enable = true;
 }
 ```

@ -216,7 +216,7 @@ For instance, the following disables tap-to-click behavior:

 ```nix
 {
-  services.xserver.libinput.touchpad.tapping = false;
+  services.libinput.touchpad.tapping = false;
 }
 ```

--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@ -193,6 +193,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m

 - [prometheus-nats-exporter](https://github.com/nats-io/prometheus-nats-exporter), a Prometheus exporter for NATS. Available as [services.prometheus.exporters.nats](#opt-services.prometheus.exporters.nats.enable).

+- [isolate](https://github.com/ioi/isolate), a sandbox for securely executing untrusted programs. Available as [security.isolate](#opt-security.isolate.enable).
+
 ## Backward Incompatibilities {#sec-release-24.05-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@ -185,7 +185,7 @@ in
        # };

        # Enable touchpad support (enabled default in most desktopManager).
-        # services.xserver.libinput.enable = true;
+        # services.libinput.enable = true;

        # Define a user account. Don't forget to set a password with ‘passwd’.
        # users.users.alice = {
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -325,6 +325,7 @@
  ./security/duosec.nix
  ./security/google_oslogin.nix
  ./security/ipa.nix
+  ./security/isolate.nix
  ./security/krb5
  ./security/lock-kernel-modules.nix
  ./security/misc.nix
@ -558,6 +559,7 @@
  ./services/hardware/joycond.nix
  ./services/hardware/kanata.nix
  ./services/hardware/lcd.nix
+  ./services/hardware/libinput.nix
  ./services/hardware/lirc.nix
  ./services/hardware/nvidia-container-toolkit
  ./services/hardware/monado.nix
@ -1472,7 +1474,6 @@
  ./services/x11/gdk-pixbuf.nix
  ./services/x11/hardware/cmt.nix
  ./services/x11/hardware/digimend.nix
-  ./services/x11/hardware/libinput.nix
  ./services/x11/hardware/synaptics.nix
  ./services/x11/hardware/wacom.nix
  ./services/x11/imwheel.nix
--- a/nixos/modules/profiles/graphical.nix
+++ b/nixos/modules/profiles/graphical.nix
@ -7,10 +7,12 @@
  services.xserver = {
    enable = true;
    desktopManager.plasma5.enable = true;
-    libinput.enable = true; # for touchpad support on many laptops
  };

-  services.displayManager.sddm.enable = true;
+  services = {
+    displayManager.sddm.enable = true;
+    libinput.enable = true; # for touchpad support on many laptops
+  };

  # Enable sound in virtualbox appliances.
  hardware.pulseaudio.enable = true;
--- a/nixos/modules/security/isolate.nix
+++ b/nixos/modules/security/isolate.nix
@ -0,0 +1,133 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkEnableOption mkPackageOption mkOption types mkIf maintainers;
+
+  cfg = config.security.isolate;
+  configFile = pkgs.writeText "isolate-config.cf" ''
+    box_root=${cfg.boxRoot}
+    lock_root=${cfg.lockRoot}
+    cg_root=${cfg.cgRoot}
+    first_uid=${toString cfg.firstUid}
+    first_gid=${toString cfg.firstGid}
+    num_boxes=${toString cfg.numBoxes}
+    restricted_init=${if cfg.restrictedInit then "1" else "0"}
+    ${cfg.extraConfig}
+  '';
+  isolate = pkgs.symlinkJoin {
+    name = "isolate-wrapped-${pkgs.isolate.version}";
+
+    paths = [ pkgs.isolate ];
+
+    nativeBuildInputs = [ pkgs.makeWrapper ];
+
+    postBuild = ''
+      wrapProgram $out/bin/isolate \
+        --set ISOLATE_CONFIG_FILE ${configFile}
+
+      wrapProgram $out/bin/isolate-cg-keeper \
+        --set ISOLATE_CONFIG_FILE ${configFile}
+    '';
+  };
+in
+{
+  options.security.isolate = {
+    enable = mkEnableOption ''
+      Sandbox for securely executing untrusted programs
+    '';
+
+    package = mkPackageOption pkgs "isolate-unwrapped" { };
+
+    boxRoot = mkOption {
+      type = types.path;
+      default = "/var/lib/isolate/boxes";
+      description = ''
+        All sandboxes are created under this directory.
+        To avoid symlink attacks, this directory and all its ancestors
+        must be writeable only by root.
+      '';
+    };
+
+    lockRoot = mkOption {
+      type = types.path;
+      default = "/run/isolate/locks";
+      description = ''
+        Directory where lock files are created.
+      '';
+    };
+
+    cgRoot = mkOption {
+      type = types.str;
+      default = "auto:/run/isolate/cgroup";
+      description = ''
+        Control group which subgroups are placed under.
+        Either an explicit path to a subdirectory in cgroupfs, or "auto:file" to read
+        the path from "file", where it is put by `isolate-cg-helper`.
+      '';
+    };
+
+    firstUid = mkOption {
+      type = types.numbers.between 1000 65533;
+      default = 60000;
+      description = ''
+        Start of block of UIDs reserved for sandboxes.
+      '';
+    };
+
+    firstGid = mkOption {
+      type = types.numbers.between 1000 65533;
+      default = 60000;
+      description = ''
+        Start of block of GIDs reserved for sandboxes.
+      '';
+    };
+
+    numBoxes = mkOption {
+      type = types.numbers.between 1000 65533;
+      default = 1000;
+      description = ''
+        Number of UIDs and GIDs to reserve, starting from
+        {option}`firstUid` and {option}`firstGid`.
+      '';
+    };
+
+    restrictedInit = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        If true, only root can create sandboxes.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.str;
+      default = "";
+      description = ''
+        Extra configuration to append to the configuration file.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [
+      isolate
+    ];
+
+    systemd.services.isolate = {
+      description = "Isolate control group hierarchy daemon";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "notify";
+        ExecStart = "${isolate}/bin/isolate-cg-keeper";
+        Slice = "isolate.slice";
+        Delegate = true;
+      };
+    };
+
+    systemd.slices.isolate = {
+      description = "Isolate sandbox slice";
+    };
+
+    meta.maintainers = with maintainers; [ virchau13 ];
+  };
+}
--- a/nixos/modules/services/desktop-managers/plasma6.nix
+++ b/nixos/modules/services/desktop-managers/plasma6.nix
@ -238,7 +238,7 @@ in {
    services.system-config-printer.enable = mkIf config.services.printing.enable (mkDefault true);
    services.udisks2.enable = true;
    services.upower.enable = config.powerManagement.enable;
-    services.xserver.libinput.enable = mkDefault true;
+    services.libinput.enable = mkDefault true;

    # Extra UDEV rules used by Solid
    services.udev.packages = [
--- a/nixos/modules/services/display-managers/sddm.nix
+++ b/nixos/modules/services/display-managers/sddm.nix
@ -111,8 +111,8 @@ let
      let
        westonIni = (pkgs.formats.ini { }).generate "weston.ini" {
          libinput = {
-            enable-tap = xcfg.libinput.mouse.tapping;
-            left-handed = xcfg.libinput.mouse.leftHanded;
+            enable-tap = config.services.libinput.mouse.tapping;
+            left-handed = config.services.libinput.mouse.leftHanded;
          };
          keyboard = {
            keymap_model = xcfg.xkb.model;
--- a/nixos/modules/services/x11/hardware/libinput.nix
+++ b/nixos/modules/services/x11/hardware/libinput.nix
@ -2,7 +2,7 @@

 with lib;

-let cfg = config.services.xserver.libinput;
+let cfg = config.services.libinput;

    xorgBool = v: if v then "on" else "off";

@ -223,7 +223,7 @@ let cfg = config.services.xserver.libinput;
 in {

  imports =
-    (map (option: mkRenamedOptionModule ([ "services" "xserver" "libinput" option ]) [ "services" "xserver" "libinput" "touchpad" option ]) [
+    (map (option: mkRenamedOptionModule ([ "services" "xserver" "libinput" option ]) [ "services" "libinput" "touchpad" option ]) [
      "accelProfile"
      "accelSpeed"
      "buttonMapping"
@ -242,11 +242,15 @@ in {
      "transformationMatrix"
      "disableWhileTyping"
      "additionalOptions"
-    ]);
+    ]) ++ [
+      (mkRenamedOptionModule [ "services" "xserver" "libinput" "enable" ]   [ "services" "libinput" "enable" ])
+      (mkRenamedOptionModule [ "services" "xserver" "libinput" "mouse" ]    [ "services" "libinput" "mouse" ])
+      (mkRenamedOptionModule [ "services" "xserver" "libinput" "touchpad" ] [ "services" "libinput" "touchpad" ])
+    ];

  options = {

-    services.xserver.libinput = {
+    services.libinput = {
      enable = mkEnableOption "libinput" // {
        default = config.services.xserver.enable;
        defaultText = lib.literalExpression "config.services.xserver.enable";
--- a/nixos/modules/services/matrix/appservice-irc.nix
+++ b/nixos/modules/services/matrix/appservice-irc.nix
@ -214,8 +214,9 @@ in {
        RestrictRealtime = true;
        PrivateMounts = true;
        SystemCallFilter = [
-          "@system-service @pkey @chown"
+          "@system-service @pkey"
          "~@privileged @resources"
+          "@chown"
        ];
        SystemCallArchitectures = "native";
        # AF_UNIX is required to connect to a postgres socket.
--- a/nixos/modules/services/security/oauth2_proxy_nginx.nix
+++ b/nixos/modules/services/security/oauth2_proxy_nginx.nix
@ -87,9 +87,9 @@ in
        "/oauth2/auth" = let
          maybeQueryArg = name: value:
            if value == null then null
-            else "${name}=${lib.concatStringsSep "," value}";
+            else "${name}=${lib.concatStringsSep "," (builtins.map lib.escapeURL value)}";
          allArgs = lib.mapAttrsToList maybeQueryArg conf;
-          cleanArgs = builtins.map lib.escapeURL (builtins.filter (x: x != null) allArgs);
+          cleanArgs = builtins.filter (x: x != null) allArgs;
          cleanArgsStr = lib.concatStringsSep "&" cleanArgs;
        in {
          # nginx doesn't support passing query string arguments to auth_request,
--- a/nixos/modules/services/web-apps/akkoma.nix
+++ b/nixos/modules/services/web-apps/akkoma.nix
@ -957,7 +957,7 @@ in {
    assertions = optionals (cfg.config.":pleroma".":media_proxy".enabled && cfg.config.":pleroma".":media_proxy".base_url == null) [''
      `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set when the media proxy is enabled.
    ''];
-    warnings = optionals (with config.security; (!sudo.enable) && (!sudo-rs.enable)) [''
+    warnings = optionals (with config.security; cfg.installWrapper && (!sudo.enable) && (!sudo-rs.enable)) [''
      The pleroma_ctl wrapper enabled by the installWrapper option relies on
      sudo, which appears to have been disabled through security.sudo.enable.
    ''];
--- a/nixos/modules/services/x11/desktop-managers/budgie.nix
+++ b/nixos/modules/services/x11/desktop-managers/budgie.nix
@ -214,7 +214,7 @@ in {

    services.geoclue2.enable = mkDefault true; # for BCC's Privacy > Location Services panel.
    services.upower.enable = config.powerManagement.enable; # for Budgie's Status Indicator and BCC's Power panel.
-    services.xserver.libinput.enable = mkDefault true; # for BCC's Mouse panel.
+    services.libinput.enable = mkDefault true; # for BCC's Mouse panel.
    services.colord.enable = mkDefault true; # for BCC's Color panel.
    services.gnome.at-spi2-core.enable = mkDefault true; # for BCC's A11y panel.
    services.accounts-daemon.enable = mkDefault true; # for BCC's Users panel.
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@ -116,7 +116,7 @@ in
      services.touchegg.enable = mkDefault true;
      services.udisks2.enable = true;
      services.upower.enable = mkDefault config.powerManagement.enable;
-      services.xserver.libinput.enable = mkDefault true;
+      services.libinput.enable = mkDefault true;
      services.xserver.updateDbusEnvironment = true;
      networking.networkmanager.enable = mkDefault true;

--- a/nixos/modules/services/x11/desktop-managers/deepin.nix
+++ b/nixos/modules/services/x11/desktop-managers/deepin.nix
@ -61,7 +61,7 @@ in
      services.gnome.gnome-keyring.enable = mkDefault true;
      services.bamf.enable = mkDefault true;

-      services.xserver.libinput.enable = mkDefault true;
+      services.libinput.enable = mkDefault true;
      services.udisks2.enable = true;
      services.upower.enable = mkDefault config.powerManagement.enable;
      networking.networkmanager.enable = mkDefault true;
--- a/nixos/modules/services/x11/desktop-managers/enlightenment.nix
+++ b/nixos/modules/services/x11/desktop-managers/enlightenment.nix
@ -96,7 +96,7 @@ in

    services.udisks2.enable = true;
    services.upower.enable = config.powerManagement.enable;
-    services.xserver.libinput.enable = mkDefault true;
+    services.libinput.enable = mkDefault true;

    services.dbus.packages = [ e.efl ];

--- a/nixos/modules/services/x11/desktop-managers/gnome.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome.nix
@ -339,7 +339,7 @@ in
      # services.packagekit.enable = mkDefault true;
      services.udisks2.enable = true;
      services.upower.enable = config.powerManagement.enable;
-      services.xserver.libinput.enable = mkDefault true; # for controlling touchpad settings via gnome control center
+      services.libinput.enable = mkDefault true; # for controlling touchpad settings via gnome control center

      # Explicitly enabled since GNOME will be severely broken without these.
      xdg.mime.enable = true;
--- a/nixos/modules/services/x11/desktop-managers/lxqt.nix
+++ b/nixos/modules/services/x11/desktop-managers/lxqt.nix
@ -69,7 +69,7 @@ in

    services.upower.enable = config.powerManagement.enable;

-    services.xserver.libinput.enable = mkDefault true;
+    services.libinput.enable = mkDefault true;

    xdg.portal.lxqt.enable = mkDefault true;

--- a/nixos/modules/services/x11/desktop-managers/mate.nix
+++ b/nixos/modules/services/x11/desktop-managers/mate.nix
@ -88,7 +88,7 @@ in
      services.udev.packages = [ pkgs.mate.mate-settings-daemon ];
      services.gvfs.enable = true;
      services.upower.enable = config.powerManagement.enable;
-      services.xserver.libinput.enable = mkDefault true;
+      services.libinput.enable = mkDefault true;

      security.pam.services.mate-screensaver.unixAuth = true;

--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -159,7 +159,7 @@ in
      services.gsignond.plugins = with pkgs.gsignondPlugins; [ lastfm mail oauth ];
      services.udisks2.enable = true;
      services.upower.enable = config.powerManagement.enable;
-      services.xserver.libinput.enable = mkDefault true;
+      services.libinput.enable = mkDefault true;
      services.xserver.updateDbusEnvironment = true;
      services.zeitgeist.enable = mkDefault true;
      services.geoclue2.enable = mkDefault true;
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -348,7 +348,7 @@ in
      services.system-config-printer.enable = mkIf config.services.printing.enable (mkDefault true);
      services.udisks2.enable = true;
      services.upower.enable = config.powerManagement.enable;
-      services.xserver.libinput.enable = mkDefault true;
+      services.libinput.enable = mkDefault true;

      # Extra UDEV rules used by Solid
      services.udev.packages = [
--- a/nixos/modules/services/x11/desktop-managers/xfce.nix
+++ b/nixos/modules/services/x11/desktop-managers/xfce.nix
@ -164,7 +164,7 @@ in
    services.gvfs.enable = true;
    services.tumbler.enable = true;
    services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
-    services.xserver.libinput.enable = mkDefault true; # used in xfce4-settings-manager
+    services.libinput.enable = mkDefault true; # used in xfce4-settings-manager

    # Enable default programs
    programs.dconf.enable = true;
--- a/nixos/modules/services/x11/hardware/cmt.nix
+++ b/nixos/modules/services/x11/hardware/cmt.nix
@ -46,10 +46,10 @@ in {

    assertions = [
      {
-        assertion = !config.services.xserver.libinput.enable;
+        assertion = !config.services.libinput.enable;
        message = ''
          cmt and libinput are incompatible, meaning you cannot enable them both.
-          To use cmt you need to disable libinput with `services.xserver.libinput.enable = false`
+          To use cmt you need to disable libinput with `services.libinput.enable = false`
          If you haven't enabled it in configuration.nix, it's enabled by default on a
          different xserver module.
        '';
--- a/nixos/modules/services/x11/hardware/synaptics.nix
+++ b/nixos/modules/services/x11/hardware/synaptics.nix
@ -30,7 +30,7 @@ in {
      enable = mkOption {
        type = types.bool;
        default = false;
-        description = "Whether to enable touchpad support. Deprecated: Consider services.xserver.libinput.enable.";
+        description = "Whether to enable touchpad support. Deprecated: Consider services.libinput.enable.";
      };

      dev = mkOption {
@ -207,8 +207,8 @@ in {

    assertions = [
      {
-        assertion = !config.services.xserver.libinput.enable;
-        message = "Synaptics and libinput are incompatible, you cannot enable both (in services.xserver).";
+        assertion = !config.services.libinput.enable;
+        message = "Synaptics and libinput are incompatible, you cannot enable both.";
      }
    ];

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -399,6 +399,7 @@ in {
  honk = runTest ./honk.nix;
  installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
  invidious = handleTest ./invidious.nix {};
+  isolate = handleTest ./isolate.nix {};
  livebook-service = handleTest ./livebook-service.nix {};
  pyload = handleTest ./pyload.nix {};
  oci-containers = handleTestOn ["aarch64-linux" "x86_64-linux"] ./oci-containers.nix {};
@ -772,6 +773,7 @@ in {
  qgis = handleTest ./qgis.nix { qgisPackage = pkgs.qgis; };
  qgis-ltr = handleTest ./qgis.nix { qgisPackage = pkgs.qgis-ltr; };
  qownnotes = handleTest ./qownnotes.nix {};
+  qtile = handleTest ./qtile.nix {};
  quake3 = handleTest ./quake3.nix {};
  quicktun = handleTest ./quicktun.nix {};
  quorum = handleTest ./quorum.nix {};
--- a/nixos/tests/gvisor.nix
+++ b/nixos/tests/gvisor.nix
@ -3,7 +3,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
  name = "gvisor";
  meta = with pkgs.lib.maintainers; {
-    maintainers = [ andrew-d ];
+    maintainers = [ ];
  };

  nodes = {
--- a/nixos/tests/isolate.nix
+++ b/nixos/tests/isolate.nix
@ -0,0 +1,38 @@
+import ./make-test-python.nix ({ lib, ... }:
+{
+  name = "isolate";
+  meta.maintainers = with lib.maintainers; [ virchau13 ];
+
+  nodes.machine =
+    { ... }:
+    {
+      security.isolate = {
+        enable = true;
+      };
+    };
+
+  testScript = ''
+    bash_path = machine.succeed('realpath $(which bash)').strip()
+    sleep_path = machine.succeed('realpath $(which sleep)').strip()
+    def sleep_test(walltime, sleeptime):
+        return f'isolate --no-default-dirs --wall-time {walltime} ' + \
+            f'--dir=/box={box_path} --dir=/nix=/nix --run -- ' + \
+            f"{bash_path} -c 'exec -a sleep {sleep_path} {sleeptime}'"
+
+    def sleep_test_cg(walltime, sleeptime):
+        return f'isolate --cg --no-default-dirs --wall-time {walltime} ' + \
+            f'--dir=/box={box_path} --dir=/nix=/nix --processes=2 --run -- ' + \
+            f"{bash_path} -c '( exec -a sleep {sleep_path} {sleeptime} )'"
+
+    with subtest("without cgroups"):
+        box_path = machine.succeed('isolate --init').strip()
+        machine.succeed(sleep_test(1, 0.5))
+        machine.fail(sleep_test(0.5, 1))
+        machine.succeed('isolate --cleanup')
+    with subtest("with cgroups"):
+        box_path = machine.succeed('isolate --cg --init').strip()
+        machine.succeed(sleep_test_cg(1, 0.5))
+        machine.fail(sleep_test_cg(0.5, 1))
+        machine.succeed('isolate --cg --cleanup')
+  '';
+})
--- a/nixos/tests/libinput.nix
+++ b/nixos/tests/libinput.nix
@ -12,7 +12,7 @@ import ./make-test-python.nix ({ ... }:

      test-support.displayManager.auto.user = "alice";

-      services.xserver.libinput = {
+      services.libinput = {
        enable = true;
        mouse = {
          naturalScrolling = true;
--- a/nixos/tests/nginx-sso.nix
+++ b/nixos/tests/nginx-sso.nix
@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
  name = "nginx-sso";
  meta = {
-    maintainers = with pkgs.lib.maintainers; [ delroth ];
+    maintainers = with pkgs.lib.maintainers; [ ambroisie ];
  };

  nodes.machine = {
--- a/nixos/tests/qtile.nix
+++ b/nixos/tests/qtile.nix
@ -0,0 +1,34 @@
+import ./make-test-python.nix ({ lib, ...} : {
+  name = "qtile";
+
+  meta = {
+    maintainers = with lib.maintainers; [ sigmanificient ];
+  };
+
+  nodes.machine = { pkgs, lib, ... }: {
+    imports = [ ./common/x11.nix ./common/user-account.nix ];
+    test-support.displayManager.auto.user = "alice";
+
+    services.xserver.windowManager.qtile.enable = true;
+    services.displayManager.defaultSession = lib.mkForce "none+qtile";
+
+    environment.systemPackages = [ pkgs.kitty ];
+  };
+
+  testScript = ''
+    with subtest("ensure x starts"):
+        machine.wait_for_x()
+        machine.wait_for_file("/home/alice/.Xauthority")
+        machine.succeed("xauth merge ~alice/.Xauthority")
+
+    with subtest("ensure client is available"):
+        machine.succeed("qtile --version")
+
+    with subtest("ensure we can open a new terminal"):
+        machine.sleep(2)
+        machine.send_key("meta_l-ret")
+        machine.wait_for_window(r"alice.*?machine")
+        machine.sleep(2)
+        machine.screenshot("terminal")
+  '';
+})
--- a/nixos/tests/syncthing-relay.nix
+++ b/nixos/tests/syncthing-relay.nix
@ -1,6 +1,6 @@
 import ./make-test-python.nix ({ lib, pkgs, ... }: {
  name = "syncthing-relay";
-  meta.maintainers = with pkgs.lib.maintainers; [ delroth ];
+  meta.maintainers = with pkgs.lib.maintainers; [ ];

  nodes.machine = {
    environment.systemPackages = [ pkgs.jq ];
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pt2-clone";
-  version = "1.68";
+  version = "1.69.2";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-xlXwOxmJ5cL1ouTOnFwTvx959IDQIvJ0ZRk+G9p0HbA=";
+    sha256 = "sha256-Vy8b9rbYM/bK/mCUW4V4rPeAmoBN/wn7iVBANSboL2Q=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/audio/spot/default.nix
+++ b/pkgs/applications/audio/spot/default.nix
@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
    mainProgram = "spot";
    homepage = "https://github.com/xou816/spot";
    license = licenses.mit;
-    maintainers = with maintainers; [ msfjarvis ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/waylyrics/Cargo.lock
+++ b/pkgs/applications/audio/waylyrics/Cargo.lock
@ -1783,8 +1783,7 @@ dependencies = [
 [[package]]
 name = "ksni"
 version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b31b9cf486bcd22bcd09900b44538cf87b00f526fcd087d671a632dc0d271d0c"
+source = "git+https://github.com/waylyrics/ksni.git#af6fa6e6e29b7cb3779f98c1ca3aaeb8744ef4c4"
 dependencies = [
 "dbus",
 "dbus-codegen",
@ -2075,9 +2074,10 @@ dependencies = [
 ]

 [[package]]
-name = "ncmapi"
+name = "ncmapi2"
 version = "0.1.13"
-source = "git+https://github.com/waylyrics/ncmapi-rs.git?rev=6095abf7#6095abf7e54eedbb716676d311e0741b4ac2482e"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcd3c218f2db46fc0b26ac6263d3005b96c82d5ebec0d349c3c902eef8bd660c"
 dependencies = [
 "aes",
 "base64",
@ -2610,7 +2610,8 @@ dependencies = [
 [[package]]
 name = "qqmusic-rs"
 version = "0.1.0"
-source = "git+https://github.com/waylyrics/qqmusic-rs.git?rev=22e66ba#22e66ba62e63d97c6dffb45400655404e6f06b93"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7698cb357cfa1a75f5a2071469345ede01a6c4ee83a2ff2a88f9e481893f341"
 dependencies = [
 "serde",
 "serde_json",
@ -3817,7 +3818,7 @@ checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"

 [[package]]
 name = "waylyrics"
-version = "0.2.19"
+version = "0.3.5"
 dependencies = [
 "ahash 0.8.11",
 "anyhow",
@ -3835,7 +3836,7 @@ dependencies = [
 "md5",
 "mimalloc",
 "mpris",
- "ncmapi",
+ "ncmapi2",
 "once_cell",
 "opencc-rust",
 "qqmusic-rs",
--- a/pkgs/applications/audio/waylyrics/default.nix
+++ b/pkgs/applications/audio/waylyrics/default.nix
@ -9,20 +9,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "waylyrics";
-  version = "0.2.19";
+  version = "0.3.5";

  src = fetchFromGitHub {
-    owner = "poly000";
+    owner = "waylyrics";
    repo = "waylyrics";
    rev = "v${version}";
-    hash = "sha256-y8FBZ/BvCj7CBfQlNE1Ay2nuP41WC14dfTeOJhTbHYs=";
+    hash = "sha256-44O2+OLsBZhl0/0910RsdCe8cHt6UGhYF7CUfhsFQU8=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "ncmapi-0.1.13" = "sha256-gwFMmMzQywlsQC2GljgLwXoP2Cca0r24iEDmV0k/xG0=";
-      "qqmusic-rs-0.1.0" = "sha256-woLsO0n+m3EBUI+PRLio7iLp0UPQSliWK0djCSZEaZc=";
+      "ksni-0.2.1" = "sha256-kjirYZVDP9e7/933L7gwSgVrNInSTbsRCAfnhUqmcLI=";
    };
  };

@ -44,10 +43,12 @@ rustPlatform.buildRustPackage rec {
    install -d $WAYLYRICS_THEME_PRESETS_DIR
    cp -vr themes/* $WAYLYRICS_THEME_PRESETS_DIR
    # Install desktop entry
-    install -Dm644 io.poly000.waylyrics.desktop -t $out/share/applications
+    install -Dm644 metainfo/io.github.waylyrics.Waylyrics.desktop -t $out/share/applications
    # Install schema
-    install -Dm644 io.poly000.waylyrics.gschema.xml -t $out/share/gsettings-schemas/$name/glib-2.0/schemas
+    install -Dm644 metainfo/io.github.waylyrics.Waylyrics.gschema.xml -t $out/share/gsettings-schemas/$name/glib-2.0/schemas
    glib-compile-schemas $out/share/gsettings-schemas/$name/glib-2.0/schemas/
+    # Install metainfo
+    install -Dm644 metainfo/io.github.waylyrics.Waylyrics.metainfo.xml -t $out/share/metainfo
    # Install icons
    install -d $out/share/icons
    cp -vr res/icons/hicolor $out/share/icons/hicolor
@ -64,7 +65,7 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "Desktop lyrics with QQ and NetEase Music source";
    mainProgram = "waylyrics";
-    homepage = "https://github.com/poly000/waylyrics";
+    homepage = "https://github.com/waylyrics/waylyrics";
    license = with licenses; [ mit cc-by-40 ];
    maintainers = with maintainers; [ shadowrz aleksana ];
    platforms = platforms.linux;
--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@ -245,9 +245,9 @@ in runCommand
      # source-code itself).
      platforms = [ "x86_64-linux" ];
      maintainers = with maintainers; rec {
-        stable = [ alapshin msfjarvis ];
-        beta = [ alapshin msfjarvis ];
-        canary = [ alapshin msfjarvis ];
+        stable = [ alapshin ];
+        beta = [ alapshin ];
+        canary = [ alapshin ];
        dev = canary;
      }."${channel}";
      mainProgram = pname;
--- a/pkgs/applications/editors/hexedit/default.nix
+++ b/pkgs/applications/editors/hexedit/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
    homepage = "http://rigaux.org/hexedit.html";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ delroth ];
+    maintainers = with maintainers; [ ];
    mainProgram = "hexedit";
  };
 }
--- a/pkgs/applications/editors/pulsar/default.nix
+++ b/pkgs/applications/editors/pulsar/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , git
+, git-lfs
 , fetchurl
 , wrapGAppsHook3
 , alsa-lib
@ -139,14 +140,34 @@ stdenv.mkDerivation rec {
    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
      $opt/resources/app.asar.unpacked/node_modules/symbol-provider-ctags/vendor/ctags-linux

-  '' + lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux") ''
    # Replace the bundled git with the one from nixpkgs
    dugite=$opt/resources/app.asar.unpacked/node_modules/dugite
    rm -f $dugite/git/bin/git
    ln -s ${git}/bin/git $dugite/git/bin/git
-    rm -f $dugite/git/libexec/git-core/git
-    ln -s ${git}/bin/git $dugite/git/libexec/git-core/git

+    # Not only do we need to replace the git binary itself, we also need to replace
+    # all the symlinks in dugite/git/libexec/git-core.
+    for file in "$dugite/git/libexec/git-core"/*; do
+      if [ -x "$file" ] && file "$file" | grep -q "ELF"; then
+          # Remove ELF executable
+          rm "$file"
+
+          # Get the corresponding filename in nixpkgs's git
+          filename=$(basename "$file")
+          git_executable="${git}/libexec/git-core/$filename"
+
+          # Create symlink to $git_executable
+          ln -s "$git_executable" "$file"
+
+          echo "Replaced $file with symlink to $git_executable"
+        fi
+    done
+
+    # Was symlinked in previous loop, but actually, nixpkgs has a separate package for git-lfs
+    # Unlink to avoid a "File exists" error and relink correctly
+    unlink $dugite/git/libexec/git-core/git-lfs
+    ln -s ${git-lfs}/bin/git-lfs $dugite/git/libexec/git-core/git-lfs
+  '' + lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux") ''
    # We have to patch a prebuilt binary in the asar archive
    # But asar complains because the node_gyp unpacked dependency uses a prebuilt Python3 itself

@ -208,7 +229,7 @@ stdenv.mkDerivation rec {
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.mit;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ colamaroro bryango ];
+    maintainers = with maintainers; [ bryango ];
    knownVulnerabilities = [
      "CVE-2023-5217"
      "CVE-2022-21718"
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@ -1911,7 +1911,7 @@ let
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=Gleam.gleam";
          homepage = "https://github.com/gleam-lang/vscode-gleam#readme";
          license = lib.licenses.asl20;
-          maintainers = [ lib.maintainers.msfjarvis ];
+          maintainers = [ ];
        };
      };

--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@ -12,8 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
    publisher = "myriad-dreamin";
    # Please update the corresponding binary (tinymist) when updating
    # this extension.
-    version = "0.11.5";
-    hash = "sha256-p97RREGKhTeXO5s4jP8qUsLtYxOj91ddQhsk6Q+50jc=";
+    version = "0.11.6";
+    hash = "sha256-qS+QY9RmJYXWRcohMcorF3SxoniBPE8SFcg0Ka1vvOE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@ -55,20 +55,20 @@
        "src": {
            "owner": "libretro",
            "repo": "beetle-pce-libretro",
-            "rev": "20b86372b5f490394099ee0ad06e0eb3a4fd5c2e",
-            "hash": "sha256-jYV2eiBSLj9H2RIau8NwYLGV2SY7GqygEYTJ3YVoMNc="
+            "rev": "ebd9f3f003f1268142785e41943e51616c3802b0",
+            "hash": "sha256-ccPMRfCzbFF509Q683rTo23tazk1jdeEbZVWMPpC55U="
        },
-        "version": "unstable-2024-03-22"
+        "version": "unstable-2024-04-26"
    },
    "beetle-pce-fast": {
        "fetcher": "fetchFromGitHub",
        "src": {
            "owner": "libretro",
            "repo": "beetle-pce-fast-libretro",
-            "rev": "6210d0f8c262dcdaa5b76c28057cca6077f488fe",
-            "hash": "sha256-5qONcwTrawd6vMa7157lexFmuj9jdzSDVqt+KUvEm0I="
+            "rev": "be9db7587571893377974575b7c9768e00833bc2",
+            "hash": "sha256-vmqJvfYJDriWf8UL79DgX6EG3YFGQMvo7xosK/1FdrA="
        },
-        "version": "unstable-2024-03-22"
+        "version": "unstable-2024-04-26"
    },
    "beetle-pcfx": {
        "fetcher": "fetchFromGitHub",
@ -438,10 +438,10 @@
        "src": {
            "owner": "libretro",
            "repo": "mame2003-plus-libretro",
-            "rev": "bb864ca20b40908b8fbc49a350939160d6af29f6",
-            "hash": "sha256-3AvjOpgBh/p0p9xq4rD8xSKqZWzulw7AKUGQ1o9B2Ck="
+            "rev": "d6732ad36aa3adf3198c565d89d763caa308e2e0",
+            "hash": "sha256-r95vwYMXzJec2GsienkPMbY4g305iEaST6kkzS7/hj0="
        },
-        "version": "unstable-2024-04-19"
+        "version": "unstable-2024-04-27"
    },
    "mame2010": {
        "fetcher": "fetchFromGitHub",
--- a/pkgs/applications/graphics/xournalpp/default.nix
+++ b/pkgs/applications/graphics/xournalpp/default.nix
@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
    homepage    = "https://xournalpp.github.io/";
    changelog   = "https://github.com/xournalpp/xournalpp/blob/v${version}/CHANGELOG.md";
    license     = licenses.gpl2Plus;
-    maintainers = with maintainers; [ andrew-d sikmir ];
+    maintainers = with maintainers; [ sikmir ];
    platforms   = platforms.unix;
    mainProgram = "xournalpp";
  };
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@ -59,7 +59,7 @@ let
    homepage = "https://1password.com/";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
-    maintainers = with maintainers; [ timstott savannidgerinel amaxine sebtm ];
+    maintainers = with maintainers; [ timstott savannidgerinel sebtm ];
    platforms = builtins.attrNames sources.${channel};
    mainProgram = "1password";
  };
--- a/pkgs/applications/misc/has/default.nix
+++ b/pkgs/applications/misc/has/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: rec {
  pname = "has";
-  version = "1.4.0";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "kdabir";
    repo = "has";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-3XsNSl4lQfJjEPNGoFj6ABXGkwOUsg9AFDAz8euZApE=";
+    hash = "sha256-TL8VwFx2tf+GkBwz0ILQg0pwcLJSTky57Wx9OW5+lS4=";
  };

  dontBuild = true;
--- a/pkgs/applications/misc/logseq/default.nix
+++ b/pkgs/applications/misc/logseq/default.nix
@ -14,11 +14,11 @@ stdenv.mkDerivation (finalAttrs: let

 in {
  pname = "logseq";
-  version = "0.10.8";
+  version = "0.10.9";

  src = fetchurl {
    url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    hash = "sha256-kVnQ33gozrL6BOWQxUfiMypiIZOffeT2cMVMHIfsaWg=";
+    hash = "sha256-XROuY2RlKnGvK1VNvzauHuLJiveXVKrIYPppoz8fCmc=";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/networking/cluster/acorn/default.nix
+++ b/pkgs/applications/networking/cluster/acorn/default.nix
@ -1,32 +0,0 @@
-{ lib, buildGoModule, fetchFromGitHub }:
-
-buildGoModule rec {
-  pname = "acorn";
-  version = "0.10.1";
-
-  src = fetchFromGitHub {
-    owner = "acorn-io";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Zw/OqN4d5iukh9oUXjczMvNKYkcGSUoDEwfti7uzZXQ=";
-  };
-
-  vendorHash = "sha256-d/1Rqh00THUwcMBWloevfKbScaWhVG5r/32Q4zYUaJg=";
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/acorn-io/acorn/pkg/version.Tag=v${version}"
-  ];
-
-  # integration tests require network and kubernetes master
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://docs.acorn.io";
-    changelog = "https://github.com/acorn-io/${pname}/releases/tag/v${version}";
-    description = "A simple application deployment framework for Kubernetes";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ urandom ];
-  };
-}
--- a/pkgs/applications/networking/cluster/kubectl-explore/default.nix
+++ b/pkgs/applications/networking/cluster/kubectl-explore/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kubectl-explore";
-  version = "0.7.2";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "keisku";
    repo = "kubectl-explore";
    rev = "v${version}";
-    hash = "sha256-OVPct3EvtchH9pmMulIddsiR9VFoCegx9+O7lkecoJc=";
+    hash = "sha256-3Gb8lgfes3QIIAdJnC/NlCC3mfzIInQb1rG+mJNXAUk=";
  };

-  vendorHash = "sha256-l6SANWkDQSuLbyixbO/Xr2oRG8HR/qquTT9b/IM+JVg=";
+  vendorHash = "sha256-xNB+qC36DcD7oUWk242QcIKNfTmjuK5xbyJEztdhcJM=";
  doCheck = false;

  meta = with lib; {
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@ -41,7 +41,7 @@ let
        description = "A Distributed, Highly Available, Datacenter-Aware Scheduler";
        mainProgram = "nomad";
        inherit license;
-        maintainers = with maintainers; [ rushmorem pradeepchhetri endocrimes amaxine techknowlogick cottand ];
+        maintainers = with maintainers; [ rushmorem pradeepchhetri techknowlogick cottand ];
      };
    } // attrs');
 in
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -58,7 +58,6 @@ let
          Chili-Man
          babariviere
          kalbasit
-          amaxine
          timstott
          zimbatm
          zowoq
--- a/pkgs/applications/networking/instant-messengers/profanity/default.nix
+++ b/pkgs/applications/networking/instant-messengers/profanity/default.nix
@ -20,7 +20,7 @@
 , sqlite
 , autoAwaySupport ? true,       libXScrnSaver, libX11
 , notifySupport ? true,         libnotify, gdk-pixbuf
-, omemoSupport ? true,          libsignal-protocol-c, libgcrypt
+, omemoSupport ? true,          libsignal-protocol-c, libgcrypt, qrencode
 , pgpSupport ? true,            gpgme
 , pythonPluginSupport ? true,   python3
 , traySupport ? true,           gtk3
@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
    sqlite
  ] ++ lib.optionals autoAwaySupport     [ libXScrnSaver libX11 ]
    ++ lib.optionals notifySupport       [ libnotify gdk-pixbuf ]
-    ++ lib.optionals omemoSupport        [ libsignal-protocol-c libgcrypt ]
+    ++ lib.optionals omemoSupport        [ libsignal-protocol-c libgcrypt qrencode ]
    ++ lib.optionals pgpSupport          [ gpgme ]
    ++ lib.optionals pythonPluginSupport [ python3 ]
    ++ lib.optionals traySupport         [ gtk3 ];
--- a/pkgs/applications/networking/instant-messengers/qq/default.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/default.nix
@ -28,11 +28,11 @@ let
  sources = import ./sources.nix;
  srcs = {
    x86_64-linux = fetchurl {
-      url = "https://dldir1.qq.com/qqfile/qq/QQNT/${sources.urlhash}/linuxqq_${sources.version}_amd64.deb";
+      url = sources.amd64_url;
      hash = sources.amd64_hash;
    };
    aarch64-linux = fetchurl {
-      url = "https://dldir1.qq.com/qqfile/qq/QQNT/${sources.urlhash}/linuxqq_${sources.version}_arm64.deb";
+      url = sources.arm64_url;
      hash = sources.arm64_hash;
    };
  };
--- a/pkgs/applications/networking/instant-messengers/qq/sources.nix
+++ b/pkgs/applications/networking/instant-messengers/qq/sources.nix
@ -1,8 +1,9 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2024-02-16
+# Last updated: 2024-04-27
 {
-  version = "3.2.5-21453";
-  urlhash = "852276c1";
-  arm64_hash = "sha256-g0J1FWG07bkabDHp2nuS48MNut2+N7gk0k5zWcmuQVw=";
-  amd64_hash = "sha256-6Qe4bP3q9RLEIJn9EfqqYaVTF8FRBNcjtVPl+zY7v5c=";
+  version = "3.2.7";
+  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.7_240422_amd64_01.deb";
+  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.7_240422_arm64_01.deb";
+  arm64_hash = "sha256-MrLkPHri3ifVy3+WNNs/CKK4Myztw8ZjWFEZDr27mpM=";
+  amd64_hash = "sha256-eZMzMaqCF514Wij8BZ0sLoyzjKNArLSFe92tN9WAiu0=";
 }
--- a/pkgs/applications/networking/instant-messengers/qq/update.sh
+++ b/pkgs/applications/networking/instant-messengers/qq/update.sh
@ -9,8 +9,7 @@ payload=$(curl https://im.qq.com/rainbow/linuxQQDownload | grep -oP "var params=
 amd64_url=$(jq -r .x64DownloadUrl.deb <<< "$payload")
 arm64_url=$(jq -r .armDownloadUrl.deb <<< "$payload")

-urlhash=$(grep -oP "(?<=QQNT/)[a-f0-9]+(?=/linuxqq)" <<< "$amd64_url")
-version=$(grep -oP "(?<=/linuxqq_).*(?=_amd64.deb)" <<< "$amd64_url")
+version=$(grep -oP "(?<=/QQ_).*(?=_[0-9]{6})" <<< "$amd64_url")

 amd64_hash=$(nix-prefetch-url $amd64_url)
 arm64_hash=$(nix-prefetch-url $arm64_url)
@ -24,7 +23,8 @@ cat >sources.nix <<EOF
 # Last updated: $(date +%F)
 {
  version = "$version";
-  urlhash = "$urlhash";
+  amd64_url = "$amd64_url";
+  arm64_url = "$arm64_url";
  arm64_hash = "$arm64_hash";
  amd64_hash = "$amd64_hash";
 }
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -84,7 +84,7 @@ let
    changelog = "https://slack.com/release-notes";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
-    maintainers = with maintainers; [ mmahut amaxine ];
+    maintainers = with maintainers; [ mmahut ];
    platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-darwin" ];
    mainProgram = "slack";
  };
--- a/pkgs/applications/networking/irc/glowing-bear/default.nix
+++ b/pkgs/applications/networking/irc/glowing-bear/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
    description = "A web client for Weechat";
    homepage = "https://github.com/glowing-bear/glowing-bear";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ delroth ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/networking/remote/rustdesk/default.nix
+++ b/pkgs/applications/networking/remote/rustdesk/default.nix
@ -31,6 +31,7 @@
 , darwin
 , alsa-lib
 , makeDesktopItem
+, copyDesktopItems
 }:

 rustPlatform.buildRustPackage rec {
@ -83,6 +84,7 @@ rustPlatform.buildRustPackage rec {
  ];

  nativeBuildInputs = [
+    copyDesktopItems
    pkg-config
    rustPlatform.bindgenHook
    wrapGAppsHook3
--- a/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
+++ b/pkgs/applications/networking/remote/vmware-horizon-client/default.nix
@ -148,6 +148,6 @@ stdenv.mkDerivation {
    homepage = "https://www.vmware.com/go/viewclients";
    license = licenses.unfree;
    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ buckley310 ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@ -64,6 +64,6 @@ buildGoModule rec {
    changelog = "https://github.com/rclone/rclone/blob/v${version}/docs/content/changelog.md";
    license = licenses.mit;
    mainProgram = "rclone";
-    maintainers = with maintainers; [ SuperSandro2000 ];
+    maintainers = with maintainers; [ SuperSandro2000 tomfitzhenry ];
  };
 }
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -66,7 +66,7 @@ let
        description = "Open Source Continuous File Synchronization";
        changelog = "https://github.com/syncthing/syncthing/releases/tag/v${version}";
        license = licenses.mpl20;
-        maintainers = with maintainers; [ joko peterhoeg andrew-d ];
+        maintainers = with maintainers; [ joko peterhoeg ];
        mainProgram = target;
        platforms = platforms.unix;
      };
--- a/pkgs/applications/office/appflowy/default.nix
+++ b/pkgs/applications/office/appflowy/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "appflowy";
-  version = "0.5.4";
+  version = "0.5.5";

  src = fetchzip {
    url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${version}/AppFlowy-${version}-linux-x86_64.tar.gz";
-    hash = "sha256-gIM4CQvPkQIWvHXYPwr4yiDY1mUuOmubdqkOmHNssVo=";
+    hash = "sha256-sDA//ARuzU0q2V3jhFXGhaQaeF0jsDRbtdHCBTgIL8U=";
    stripRoot = false;
  };

--- a/pkgs/applications/radio/dsd/default.nix
+++ b/pkgs/applications/radio/dsd/default.nix
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/szechyjs/dsd";
    license = licenses.gpl2;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ andrew-d ];
+    maintainers = with maintainers; [ ];
    mainProgram = "dsd";
  };
 }
--- a/pkgs/applications/radio/gnuradio/default.nix
+++ b/pkgs/applications/radio/gnuradio/default.nix
@ -45,11 +45,11 @@
 # If one wishes to use a different src or name for a very custom build
 , overrideSrc ? {}
 , pname ? "gnuradio"
-, version ? "3.10.9.2"
+, version ? "3.10.10.0"
 }:

 let
-  sourceSha256 = "sha256-SMalZwIvATZ3rqAAqeSmf8/RJ1d9pp7NvoWO/YP0BMc=";
+  sourceSha256 = "sha256-pEVWhXDjOevrduDbZQbiDbODZY8PpsGY4O8yxrwlCcs=";
  featuresInfo = {
    # Needed always
    basic = {
--- a/pkgs/applications/science/astronomy/gildas/aarch64.patch
+++ b/pkgs/applications/science/astronomy/gildas/aarch64.patch
@ -1,12 +0,0 @@
-diff -ruN gildas-src-jul18a/admin/define-system.sh gildas-src-jul18a.aarch64/admin/define-system.sh
--- gildas-src-jul18a/admin/define-system.sh	2018-06-12 15:22:32.000000000 +0200
-+++ gildas-src-jul18a.aarch64/admin/define-system.sh	2018-07-21 13:05:52.000000000 +0200
-@@ -174,7 +174,7 @@
-     DEFAULT_CONFIG=          # Default config is empty
-     case `uname` in
-         Linux)
-            if [ `uname -m | grep -c "x86_64"` -ne 0 ]; then
-+            if [ `uname -m | grep -c "64"` -ne 0 ]; then
-         	GAG_MACHINE=x86_64
-             else
-         	GAG_MACHINE=pc
--- a/pkgs/applications/science/astronomy/gildas/clang.patch
+++ b/pkgs/applications/science/astronomy/gildas/clang.patch
@ -1,22 +1,77 @@
-diff -ruN gildas-src-jun18a/admin/define-system.sh gildas-src-jun18a.clang/admin/define-system.sh
--- gildas-src-jun18a/admin/define-system.sh	2018-03-12 11:07:57.000000000 +0100
-+++ gildas-src-jun18a.clang/admin/define-system.sh	2018-06-12 14:56:14.000000000 +0200
-@@ -218,13 +218,13 @@
+diff --git a/admin/Makefile.def b/admin/Makefile.def
+index 932d18f102..309114e339 100644
+--- a/admin/Makefile.def
+++ b/admin/Makefile.def
+@@ -310,7 +310,7 @@ endif
+ 
+ # Apple CLANG flags (identical to GCC)
+ ifeq ($(GAG_COMPILER_CKIND),clang)
+-  GLOBAL_CFLAGS += -pipe -fPIC
+  GLOBAL_CFLAGS += -fPIC
+   ifeq ($(RELEASE_MODE),no)
+     OPTION_CFLAGS += -Wall
+   endif
+@@ -360,7 +360,7 @@ endif
+ 
+ # GFORTRAN flags
+ ifeq ($(GAG_COMPILER_FKIND),gfortran)
+-  GLOBAL_FFLAGS += -J$(moddir) -pipe -fno-backslash -fno-range-check
+  GLOBAL_FFLAGS += -J$(moddir) -fno-backslash -fno-range-check
+   ifeq ($(GAG_USE_SANITIZE),yes)
+     GLOBAL_FFLAGS += -fsanitize=address -fsanitize=null
+     # Can not be used with our memory(ip):
+diff --git a/admin/define-system.sh b/admin/define-system.sh
+index b6eda9fdfd..704050a9ac 100644
+--- a/admin/define-system.sh
+++ b/admin/define-system.sh
+@@ -272,34 +272,23 @@ EOF
         	else
         	    GAG_MACHINE=pc
         	fi
 -                if which gcc > /dev/null 2>&1; then
 -                    DEFAULT_CCOMPILER=gcc
-+                if which clang > /dev/null 2>&1; then
-+                    DEFAULT_CCOMPILER=clang
-                 fi
+-                fi
 -                if which g++ > /dev/null 2>&1; then
 -                    DEFAULT_CXXCOMPILER=g++
 -                elif which clang++ > /dev/null 2>&1; then
-+                if which clang++ > /dev/null 2>&1; then
-                     DEFAULT_CXXCOMPILER=clang++
-+                elif which g++ > /dev/null 2>&1; then
-+                    DEFAULT_CXXCOMPILER=g++
-                 fi
-         	if which ifort > /dev/null 2>&1; then
-         	    DEFAULT_FCOMPILER=ifort
+-                    DEFAULT_CXXCOMPILER=clang++
+-                fi
+-        	if which ifort > /dev/null 2>&1; then
+-        	    DEFAULT_FCOMPILER=ifort
+-        	elif which gfortran > /dev/null 2>&1; then
+-        	    DEFAULT_FCOMPILER=gfortran
+-        	fi
+-            elif [ `uname -p` = "arm" ]; then
+	    elif [ `uname -p` = "arm" ]; then
+                 GAG_MACHINE=arm64
+-                if which gcc > /dev/null 2>&1; then
+-                    DEFAULT_CCOMPILER=gcc
+-                fi
+-                if which clang++ > /dev/null 2>&1; then
+-                    DEFAULT_CXXCOMPILER=clang++
+-                elif which g++ > /dev/null 2>&1; then
+-                    DEFAULT_CXXCOMPILER=g++
+-                fi
+-                if which ifort > /dev/null 2>&1; then
+-                    DEFAULT_FCOMPILER=ifort
+-                elif which gfortran > /dev/null 2>&1; then
+-                    DEFAULT_FCOMPILER=gfortran
+-                fi
+	    fi
+            if which clang > /dev/null 2>&1; then
+                DEFAULT_CCOMPILER=clang
+            elif which gcc > /dev/null 2>&1; then
+                DEFAULT_CCOMPILER=gcc
+	    fi
+	    if which clang++ > /dev/null 2>&1; then
+                DEFAULT_CXXCOMPILER=clang++
+            elif which g++ > /dev/null 2>&1; then
+                DEFAULT_CXXCOMPILER=g++
+            fi
+            if which ifort > /dev/null 2>&1; then
+        	DEFAULT_FCOMPILER=ifort
+            elif which gfortran > /dev/null 2>&1; then
+        	DEFAULT_FCOMPILER=gfortran
+             fi ;;
+         CYGWIN*)
+             if [ `uname -m | grep -c "x86_64"` -ne 0 ]; then
--- a/pkgs/applications/science/astronomy/gildas/cpp-darwin.patch
+++ b/pkgs/applications/science/astronomy/gildas/cpp-darwin.patch
@ -0,0 +1,17 @@
+diff --git a/admin/Makefile.def b/admin/Makefile.def
+index 0395d9d4f0..932d18f102 100644
+--- a/admin/Makefile.def
+++ b/admin/Makefile.def
+@@ -228,7 +228,11 @@ GLOBAL_DIRTY = $(builddir) *~ TAGS ChangeLog* Makefile.bak
+ # Fortran preprocessing
+ 
+ # Preprocessor command
+-CPP = cpp
+ifdef GAG_CPP
+   CPP = $(GAG_CPP)
+else
+   CPP = cpp
+endif
+ 
+ # Preprocessor generic flags
+ GLOBAL_CPPFLAGS += -P -traditional -C
--- a/pkgs/applications/science/astronomy/gildas/default.nix
+++ b/pkgs/applications/science/astronomy/gildas/default.nix
@ -7,8 +7,8 @@ let
 in

 stdenv.mkDerivation rec {
-  srcVersion = "aug23a";
-  version = "20230801_a";
+  srcVersion = "apr24a";
+  version = "20240401_a";
  pname = "gildas";

  src = fetchurl {
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    # source code of the previous release to a different directory
    urls = [ "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
      "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz" ];
-    sha256 = "sha256-jlyv2K1V+510C4uLek4oofm13d40nGJ46wqjW+tjfq4=";
+    sha256 = "sha256-Eq6S5S8xrhkCo6O2wUaHnoMDVG9WeiSurGvOc+2JKbM=";
  };

  nativeBuildInputs = [ pkg-config groff perl getopt gfortran which ];
@ -24,10 +24,14 @@ stdenv.mkDerivation rec {
  buildInputs = [ gtk2-x11 lesstif cfitsio python3Env ncurses ]
    ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ CoreFoundation ]);

-  patches = [ ./wrapper.patch ./clang.patch ./aarch64.patch ];
+  patches = [ ./wrapper.patch ]
+    ++ lib.optionals stdenv.isDarwin ([ ./clang.patch ./cpp-darwin.patch ]);

  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unused-command-line-argument";

+  # Workaround for https://github.com/NixOS/nixpkgs/issues/304528
+  env.GAG_CPP = lib.optionalString stdenv.isDarwin "${gfortran.outPath}/bin/cpp";
+
  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin (with darwin.apple_sdk.frameworks; "-F${CoreFoundation}/Library/Frameworks");

  configurePhase=''
@ -66,7 +70,6 @@ stdenv.mkDerivation rec {
    license = lib.licenses.free;
    maintainers = [ lib.maintainers.bzizou lib.maintainers.smaret ];
    platforms = lib.platforms.all;
-    broken = stdenv.isDarwin && stdenv.isAarch64;
  };

 }
--- a/pkgs/applications/science/electronics/simulide/default.nix
+++ b/pkgs/applications/science/electronics/simulide/default.nix
@ -1,36 +1,33 @@
-{ lib
-, fetchbzr
-, mkDerivation
-, qmake
-, qtserialport
-, qtmultimedia
-, qttools
-, qtscript
+{
+  lib,
+  fetchbzr,
+  mkDerivation,
+  qmake,
+  qtserialport,
+  qtmultimedia,
+  qttools,
+  qtscript,
 }:

 let
  generic =
-    { version
-    , release
-    , branch
-    , rev
-    , sha256
-    , extraPostPatch ? ""
-    , extraBuildInputs ? [ ]
-    , iconPath ? "resources/icons/simulide.png"
-    , installFiles ? ''
+    {
+      version,
+      release,
+      rev,
+      src,
+      extraPostPatch ? "",
+      extraBuildInputs ? [ ],
+      iconPath ? "resources/icons/simulide.png",
+      installFiles ? ''
        cp -r data examples $out/share/simulide
        cp simulide $out/bin/simulide
-      ''
+      '',
    }:
    mkDerivation {
      pname = "simulide";
      version = "${version}-${release}";
-
-      src = fetchbzr {
-        url = "https://code.launchpad.net/~arcachofo/simulide/${branch}";
-        inherit rev sha256;
-      };
+      inherit src;

      postPatch = ''
        sed -i resources/simulide.desktop \
@ -51,9 +48,7 @@ let
        cd build_XX
      '';

-      nativeBuildInputs = [
-        qmake
-      ];
+      nativeBuildInputs = [ qmake ];

      buildInputs = [
        qtserialport
@ -85,18 +80,25 @@ let
        homepage = "https://simulide.com/";
        license = lib.licenses.gpl3Only;
        mainProgram = "simulide";
-        maintainers = with lib.maintainers; [ carloscraveiro tomasajt ];
+        maintainers = with lib.maintainers; [
+          carloscraveiro
+          tomasajt
+        ];
        platforms = [ "x86_64-linux" ];
      };
    };
 in
 {
-  simulide_0_4_15 = generic {
+  simulide_0_4_15 = generic rec {
    version = "0.4.15";
    release = "SR10";
-    branch = "simulide_0.4.14"; # the branch name does not mach the version for some reason
    rev = "291";
-    sha256 = "sha256-BBoZr/S2pif0Jft5wrem8y00dXl08jq3kFiIUtOr3LM=";
+    src = fetchbzr {
+      # the branch name does not mach the version for some reason
+      url = "https://code.launchpad.net/~arcachofo/simulide/simulide_0.4.14";
+      sha256 = "sha256-BBoZr/S2pif0Jft5wrem8y00dXl08jq3kFiIUtOr3LM=";
+      inherit rev;
+    };
    extraPostPatch = ''
      # GCC 13 needs the <cstdint> header explicitly included
      sed -i src/gpsim/value.h -e '1i #include <cstdint>'
@ -110,20 +112,26 @@ in
    '';
  };

-  simulide_1_0_0 = generic {
+  simulide_1_0_0 = generic rec {
    version = "1.0.0";
    release = "SR2";
-    branch = "1.0.0";
    rev = "1449";
-    sha256 = "sha256-rJWZvnjVzaKXU2ktbde1w8LSNvu0jWkDIk4dq2l7t5g=";
+    src = fetchbzr {
+      url = "https://code.launchpad.net/~arcachofo/simulide/1.0.0";
+      sha256 = "sha256-rJWZvnjVzaKXU2ktbde1w8LSNvu0jWkDIk4dq2l7t5g=";
+      inherit rev;
+    };
    extraBuildInputs = [ qtscript ];
  };

-  simulide_1_1_0 = generic {
+  simulide_1_1_0 = generic rec {
    version = "1.1.0";
    release = "SR0";
-    branch = "1.1.0";
    rev = "1917";
-    sha256 = "sha256-qNBaGWl89Le9uC1VFK+xYhrLzIvOIWjkQbutnrAmZ2M=";
+    src = fetchbzr {
+      url = "https://code.launchpad.net/~arcachofo/simulide/1.1.0";
+      sha256 = "sha256-qNBaGWl89Le9uC1VFK+xYhrLzIvOIWjkQbutnrAmZ2M=";
+      inherit rev;
+    };
  };
 }
--- a/pkgs/applications/version-management/git-absorb/default.nix
+++ b/pkgs/applications/version-management/git-absorb/default.nix
@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/tummychow/git-absorb";
    description = "git commit --fixup, but automatic";
    license = [ licenses.bsd3 ];
-    maintainers = [ ];
+    maintainers = with maintainers; [ tomfitzhenry ];
    mainProgram = "git-absorb";
  };
 }
--- a/pkgs/applications/version-management/git-branchless/default.nix
+++ b/pkgs/applications/version-management/git-branchless/default.nix
@ -71,6 +71,6 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/arxanas/git-branchless";
    license = licenses.gpl2Only;
    mainProgram = "git-branchless";
-    maintainers = with maintainers; [ msfjarvis nh2 hmenke ];
+    maintainers = with maintainers; [ nh2 hmenke ];
  };
 }
--- a/pkgs/applications/version-management/git-quickfix/default.nix
+++ b/pkgs/applications/version-management/git-quickfix/default.nix
@ -35,7 +35,7 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/siedentop/git-quickfix";
    license = licenses.gpl3;
    platforms = platforms.all;
-    maintainers = with maintainers; [ msfjarvis ];
+    maintainers = with maintainers; [ ];
    mainProgram = "git-quickfix";
  };
 }
--- a/pkgs/applications/video/kodi/addons/keymap/default.nix
+++ b/pkgs/applications/video/kodi/addons/keymap/default.nix
@ -3,11 +3,11 @@
 buildKodiAddon rec {
  pname = "keymap";
  namespace = "script.keymap";
-  version = "1.1.5";
+  version = "1.2.1";

  src = fetchzip {
    url = "https://mirrors.kodi.tv/addons/${lib.toLower rel}/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-wSztipTEGIqw1icsz+ziNxYuRZOFt3C66T1Ifap/ta0=";
+    sha256 = "sha256-AtIufZbOi3MW7aSOAlON8csJheJqAbuBtKIX0sX6zIw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/video/wf-recorder/default.nix
+++ b/pkgs/applications/video/wf-recorder/default.nix
@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
    inherit (src.meta) homepage;
    changelog = "https://github.com/ammen99/wf-recorder/releases/tag/v${version}";
    license = licenses.mit;
-    maintainers = with maintainers; [ yuka ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
    mainProgram = "wf-recorder";
  };
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@ -50,7 +50,7 @@ buildGoModule rec {
    homepage = "https://containerd.io/";
    description = "A daemon to control runC";
    license = licenses.asl20;
-    maintainers = with maintainers; [ offline vdemeester endocrimes ];
+    maintainers = with maintainers; [ offline vdemeester ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/virtualization/firecracker/default.nix
+++ b/pkgs/applications/virtualization/firecracker/default.nix
@ -54,6 +54,6 @@ stdenv.mkDerivation {
    mainProgram = "firecracker";
    license = licenses.asl20;
    platforms = [ "x86_64-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ thoughtpolice endocrimes qjoly ];
+    maintainers = with maintainers; [ thoughtpolice qjoly ];
  };
 }
--- a/pkgs/applications/window-managers/hyprwm/hyprland/plugins.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland/plugins.nix
@ -24,13 +24,13 @@ let
    hy3 = { fetchFromGitHub, cmake, hyprland }:
      mkHyprlandPlugin hyprland {
        pluginName = "hy3";
-        version = "0.38.0";
+        version = "0.39.1";

        src = fetchFromGitHub {
          owner = "outfoxxed";
          repo = "hy3";
-          rev = "hl0.38.0";
-          hash = "sha256-ZVwX5yM97R6MLk64dQG5KqYOR4L4HxEEV+xzQi+NGrk=";
+          rev = "hl0.39.1";
+          hash = "sha256-PqVld+oFziSt7VZTNBomPyboaMEAIkerPQFwNJL/Wjw=";
        };

        nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/ai/airlift/package.nix
+++ b/pkgs/by-name/ai/airlift/package.nix
@ -10,11 +10,11 @@ python3.pkgs.buildPythonApplication rec {

  pname = "airlift";
  pyproject = true;
-  version = "0.3.1";
+  version = "0.4.0";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-EAt3xxr9jtMaOugAV+ySjhorO8SrhBn00PZ84ZG80oI=";
+    hash = "sha256-JcW2FXl+SrdveRmG5bD1ttf6F3LwvGZQF4ZCTpDpPa8=";
  };

  postPatch = ''
--- a/pkgs/by-name/bn/bngblaster/package.nix
+++ b/pkgs/by-name/bn/bngblaster/package.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bngblaster";
-  version = "0.8.47";
+  version = "0.8.49";

  src = fetchFromGitHub {
    owner = "rtbrick";
    repo = "bngblaster";
    rev = finalAttrs.version;
-    hash = "sha256-ad2vVBXN5hUCaFnq4WYc7UTKvyLg4HY+l+PGlc5ylmw=";
+    hash = "sha256-ZxFC8ZGcheYWmbqaZJYkqQkxn8F3RGjCsCNeQWnLKv0=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/bp/bpftop/package.nix
+++ b/pkgs/by-name/bp/bpftop/package.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "bpftop";
-  version = "0.4.1";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "Netflix";
    repo = "bpftop";
    rev = "v${version}";
-    hash = "sha256-OLPebPzb2FKiV1Gc8HTK3sXU2UDMyhFA/XLix/lWxgU=";
+    hash = "sha256-zYCv3L+xDFAJ4Wo9xwfHJrqPQUv5KiFDbhCdC1Z6qNo=";
  };

-  cargoHash = "sha256-UYCbNECsos71cwwE5avtaijPaPGhLEU7J9i84wPkObI=";
+  cargoHash = "sha256-6uPfMxjSrSGrAgJcvzTY/i1ckoW/wIi7D5noOafCvZE=";

  buildInputs = [
    elfutils
--- a/pkgs/by-name/ce/cert-viewer/package.nix
+++ b/pkgs/by-name/ce/cert-viewer/package.nix
@ -1,7 +1,9 @@
 { buildGoModule
+, buildPackages
 , fetchFromGitHub
 , lib
 , installShellFiles
+, stdenv
 }:

 buildGoModule rec {
@ -21,10 +23,17 @@ buildGoModule rec {
    installShellFiles
  ];

-  postInstall = ''
-    $out/bin/cert-viewer --help-man > cert-viewer.1
-    installManPage cert-viewer.1
-  '';
+  postInstall =
+    let
+      prog =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform
+        then "$out/bin/cert-viewer"
+        else lib.getExe buildPackages.cert-viewer;
+    in
+      ''
+        ${prog} --help-man > cert-viewer.1
+        installManPage cert-viewer.1
+      '';

  meta = {
    description = "Admin tool to view and inspect multiple x509 Certificates";
--- a/pkgs/by-name/du/dumbpipe/package.nix
+++ b/pkgs/by-name/du/dumbpipe/package.nix
@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "dumbpipe";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "n0-computer";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-lPAqDZCyA+j0kiPrQDp+zjOg6l9PN02aUSy/5q2EVbI=";
+  };
+
+  cargoHash = "sha256-vAXBBtJ/tGKTaN+IumRBr8pALbjhzgPGxHUfq6CNvpo=";
+
+  buildInputs = lib.optionals stdenv.isDarwin (
+    with darwin.apple_sdk.frameworks; [
+      SystemConfiguration
+    ]
+  );
+
+  meta = with lib; {
+    description = "Connect A to B - Send Data";
+    homepage = "https://www.dumbpipe.dev/";
+    license = with licenses; [ asl20 mit ];
+    maintainers = with maintainers; [ cameronfyfe ];
+    mainProgram = "dumbpipe";
+  };
+}
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "files-cli";
-  version = "2.13.7";
+  version = "2.13.14";

  src = fetchFromGitHub {
    repo = "files-cli";
    owner = "files-com";
    rev = "v${version}";
-    hash = "sha256-ozHHoPIpT0kpUUWnnaAbYeW7knZDN4kFB3edQ4NKpes=";
+    hash = "sha256-fECf3s9XKJq/DOyypfMgFRJjEIMKMUeWgCJca88vqJw=";
  };

-  vendorHash = "sha256-K3Dabeh3RcfTgBJ33k3/Ox6zcthFj5qK3fWBN2Jivz8=";
+  vendorHash = "sha256-adPPXElmQgnFOSWZCoQ65MheYdT6lyqhIICA2Ci7+b4=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@ -39,14 +39,14 @@ let
 in
 buildGoModule rec {
  pname = "forgejo";
-  version = "7.0.0";
+  version = "7.0.1";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "forgejo";
    repo = "forgejo";
    rev = "v${version}";
-    hash = "sha256-oIx1aPrHgOWx13ocA3t7N5UdTgr+64tgC0XcEnhA/eE=";
+    hash = "sha256-HTTbIS+GBEuhYuKSI5jlhoX6hl6BsXp77h8JSQZyknI=";
  };

  vendorHash = "sha256-UcjaMi/4XYLdaJhi2j3UWqHqkpTbZBo6EwNXxdRIKLw=";
--- a/pkgs/by-name/gi/gitu/package.nix
+++ b/pkgs/by-name/gi/gitu/package.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "gitu";
-  version = "0.17.1";
+  version = "0.19.2";

  src = fetchFromGitHub {
    owner = "altsem";
    repo = "gitu";
    rev = "v${version}";
-    hash = "sha256-9OY6zBW7UA4lTH+NI61xuil5p2ChQESXrG2zTxdJblE=";
+    hash = "sha256-6gjXsuxKGv8OrbBg8NDOj5ITpLI3S33VsjpCbK5SaIk=";
  };

-  cargoHash = "sha256-gVmoKneAtC5dJh5Z+3aXwxCixrPZTRcxQRpoSh4S1e4=";
+  cargoHash = "sha256-W73sSZ/OjeRcI2NNTp2gkabtC6krXOnv8nRAbNbXOp4=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/gv/gvisor/package.nix
+++ b/pkgs/by-name/gv/gvisor/package.nix
@ -46,7 +46,7 @@ buildGoModule {
    description = "Application Kernel for Containers";
    homepage = "https://github.com/google/gvisor";
    license = licenses.asl20;
-    maintainers = with maintainers; [ andrew-d gpl ];
+    maintainers = with maintainers; [ gpl ];
    platforms = [ "x86_64-linux" "aarch64-linux" ];
  };
 }
--- a/pkgs/by-name/hy/hyprland-activewindow/package.nix
+++ b/pkgs/by-name/hy/hyprland-activewindow/package.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "hyprland-activewindow";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "FieldOfClay";
    repo = "hyprland-activewindow";
    rev = "v${version}";
-    hash = "sha256-8pzm8uIyvlz4nHbxtmbMblFIj38M2VsenaKzJ9di1Do=";
+    hash = "sha256-kF2dNb9hiC6RcL2XG8k18da5he94Jpv3v+HdfHbeW3E=";
  };

-  cargoHash = "sha256-wIF0qa1dyZlcsLPL2TflFQFPm4Pe9TWHe1F2L1YccZ8=";
+  cargoHash = "sha256-YCzAfVLKDECGG/1fs3vyVB0oglxLFSE+2cnmLc7RoEo=";

  meta = with lib; {
    description = "A multi-monitor-aware Hyprland workspace widget helper";
--- a/pkgs/by-name/lx/lxgw-neoxihei/package.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@ -5,11 +5,11 @@

 stdenvNoCC.mkDerivation rec {
  pname = "lxgw-neoxihei";
-  version = "1.120.2";
+  version = "1.121";

  src = fetchurl {
    url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-RN0OmNS3aSRMK19nNiqXYJ4PIAQh6u5W/+L8DCeqMcE=";
+    hash = "sha256-3+th4alWV+i9kRT4F5tx8kOD4j8emcN2melcyN/mMMQ=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/ma/maa-cli/package.nix
+++ b/pkgs/by-name/ma/maa-cli/package.nix
@ -13,13 +13,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "maa-cli";
-  version = "0.4.6";
+  version = "0.4.7";

  src = fetchFromGitHub {
    owner = "MaaAssistantArknights";
    repo = "maa-cli";
    rev = "v${version}";
-    hash = "sha256-fvMSYcYWYEVvDuAEjSmQJltl90EoLKkjYD2P3OsHS3c=";
+    hash = "sha256-FR0sUHAxxW49c/lnZteJGzgfvTskWNyc8gmQvghtrB8=";
  };

  nativeBuildInputs = [
@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
  buildNoDefaultFeatures = true;
  buildFeatures = [ "git2" "core_installer" ];

-  cargoHash = "sha256-LQWjgMRxtSs2MX1R6YsxDAWUvoUJfOWmp/zj/hlTxyw=";
+  cargoHash = "sha256-iy9myT3bVW1TXCZx3ddiiDoDXx5BWqeQnSsJ97bc4IA=";

  # maa-cli would only seach libMaaCore.so and resources in itself's path
  # https://github.com/MaaAssistantArknights/maa-cli/issues/67
--- a/pkgs/applications/emulators/mgba/default.nix
+++ b/pkgs/applications/emulators/mgba/default.nix
@ -1,20 +1,21 @@
-{ lib
-, SDL2
-, cmake
-, fetchFromGitHub
-, ffmpeg
-, discord-rpc
-, libedit
-, elfutils
-, libepoxy
-, libsForQt5
-, libzip
-, lua
-, minizip
-, pkg-config
-, stdenv
-, wrapGAppsHook3
-, enableDiscordRpc ? false
+{
+  lib,
+  SDL2,
+  cmake,
+  fetchFromGitHub,
+  ffmpeg,
+  discord-rpc,
+  libedit,
+  elfutils,
+  libepoxy,
+  libsForQt5,
+  libzip,
+  lua,
+  minizip,
+  pkg-config,
+  stdenv,
+  wrapGAppsHook3,
+  enableDiscordRpc ? false,
 }:

 let
@ -92,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://raw.githubusercontent.com/mgba-emu/mgba/${finalAttrs.src.rev}/CHANGES";
    license = with lib.licenses; [ mpl20 ];
    mainProgram = "mgba";
-    maintainers = with lib.maintainers; [ MP2E AndersonTorres ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
    platforms = lib.platforms.linux;
    broken = enableDiscordRpc; # Some obscure `ld` error
  };
--- a/pkgs/by-name/mi/mixxc/package.nix
+++ b/pkgs/by-name/mi/mixxc/package.nix
@ -0,0 +1,64 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+  pkg-config,
+  libpulseaudio,
+  gtk4-layer-shell,
+  gtk4,
+  wrapGAppsHook4,
+  libxcb,
+  installShellFiles,
+  enableWayland ? true,
+  enableSass ? true,
+  enableX11 ? true,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "mixxc";
+  version = "0.2.2";
+
+  src = fetchCrate {
+    pname = "mixxc";
+    inherit version;
+    hash = "sha256-Y/9l8t6Vz7yq9T1AyoHnWmIcju1rfcV0S74hiK1fEjo=";
+  };
+
+  cargoHash = "sha256-l9inqqUiLObrqd/8pNobwBbLaiPJD39YK/38CWfDh+Q=";
+
+  cargoBuildFlags = [ "--locked" ];
+  buildFeatures = with lib; [
+    (optionals enableWayland "Wayland")
+    (optionals enableX11 "X11")
+    (optionals enableSass "Sass")
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    installShellFiles
+    wrapGAppsHook4
+  ];
+  buildInputs = with lib; [
+    libpulseaudio
+    gtk4
+    (optionals enableWayland gtk4-layer-shell)
+    (optionals enableX11 libxcb)
+  ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  postInstall = ''
+    installManPage $src/doc/mixxc.1
+  '';
+
+  meta = with lib; {
+    description = "A minimalistic and customizable volume mixer";
+    homepage = "https://github.com/Elvyria/mixxc";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ daru-san ];
+    mainProgram = "mixxc";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/by-name/mk/mkjson/generated.nix
+++ b/pkgs/by-name/mk/mkjson/generated.nix
@ -0,0 +1,46 @@
+{ mkDerivation, lib, fetchFromGitHub
+, aeson, base, bytestring, containers, criterion
+, doctest, Glob, mersenne-random-pure64, mtl
+, optparse-applicative, parsec, random, regex-tdfa, scientific
+, text, time, unordered-containers, uuid, vector
+}:
+
+mkDerivation rec {
+  pname = "mkjson";
+  version = "0.4.0";
+  src = fetchFromGitHub {
+    owner = "mfussenegger";
+    repo = "mkjson";
+    rev = "${version}";
+    hash = "sha256-+NDLFtsWWxHv/6XC9hJOAHPU6YED5oHqS/j5BPwNsqA=";
+  };
+
+  isLibrary = false;
+  isExecutable = true;
+  libraryHaskellDepends = [
+    aeson base bytestring containers mersenne-random-pure64 mtl
+    optparse-applicative parsec random regex-tdfa scientific text time
+    unordered-containers uuid vector
+  ];
+  executableHaskellDepends = [
+    aeson base bytestring containers mersenne-random-pure64 mtl
+    optparse-applicative parsec random regex-tdfa scientific text time
+    unordered-containers uuid vector
+  ];
+  testHaskellDepends = [
+    aeson base bytestring containers doctest Glob
+    mersenne-random-pure64 mtl optparse-applicative parsec random
+    regex-tdfa scientific text time unordered-containers uuid vector
+  ];
+  benchmarkHaskellDepends = [
+    aeson base bytestring containers criterion mersenne-random-pure64
+    mtl optparse-applicative parsec random regex-tdfa scientific text
+    time unordered-containers uuid vector
+  ];
+
+  description = "A commandline tool to generate static or random JSON records";
+  homepage = "https://github.com/mfussenegger/mkjson";
+  license = lib.licenses.mit;
+  maintainers = with lib.maintainers; [ athas ];
+  mainProgram = "mkjson";
+}
--- a/pkgs/by-name/mk/mkjson/package.nix
+++ b/pkgs/by-name/mk/mkjson/package.nix
@ -0,0 +1 @@
+{ haskell, haskellPackages }: haskell.lib.justStaticExecutables (haskellPackages.callPackage ./generated.nix { })
--- a/pkgs/by-name/na/nanoboyadvance/dont-fetch-glad.patch
+++ b/pkgs/by-name/na/nanoboyadvance/dont-fetch-glad.patch
@ -0,0 +1,14 @@
+diff --git a/src/platform/core/CMakeLists.txt b/src/platform/core/CMakeLists.txt
+index 2bc6d8c..3175c14 100644
+--- a/src/platform/core/CMakeLists.txt
+++ b/src/platform/core/CMakeLists.txt
+@@ -18,8 +18,7 @@ find_package(OpenGL REQUIRED)
+ 
+ include(FetchContent)
+ FetchContent_Declare(glad
+-  GIT_REPOSITORY https://github.com/Dav1dde/glad.git
+-  GIT_TAG        adc3d7a1d704e099581ca25bc5bbdf728c2db67b # v2.0.5-2-gadc3d7a
+  SOURCE_DIR @gladSrc@
+   SOURCE_SUBDIR  cmake
+ )
+ FetchContent_MakeAvailable(glad)
--- a/pkgs/by-name/na/nanoboyadvance/package.nix
+++ b/pkgs/by-name/na/nanoboyadvance/package.nix
@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  substituteAll,
+  cmake,
+  python3Packages,
+  libsForQt5,
+  SDL2,
+  fmt,
+  toml11,
+  libunarr,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nanoboyadvance";
+  version = "1.8.1";
+
+  src = fetchFromGitHub {
+    owner = "nba-emu";
+    repo = "NanoBoyAdvance";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-du3dPTg3OxNTWXDQo2m9W0rJxtrkn+lQSh/XGiu/eGg=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./dont-fetch-glad.patch;
+      gladSrc = fetchFromGitHub {
+        owner = "Dav1dde";
+        repo = "glad";
+        rev = "v2.0.5";
+        hash = "sha256-Ba7nbd0DxDHfNXXu9DLfnxTQTiJIQYSES9CP5Bfq4K0=";
+      };
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    python3Packages.jinja2
+    libsForQt5.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    libsForQt5.qtbase
+    SDL2
+    fmt
+    toml11
+    libunarr
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "USE_SYSTEM_FMT" true)
+    (lib.cmakeBool "USE_SYSTEM_TOML11" true)
+    (lib.cmakeBool "USE_SYSTEM_UNARR" true)
+  ];
+
+  meta = {
+    description = "A cycle-accurate Nintendo Game Boy Advance emulator";
+    homepage = "https://github.com/nba-emu/NanoBoyAdvance";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "NanoBoyAdvance";
+    maintainers = with lib.maintainers; [ tomasajt ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/ng/nginx-sso/package.nix
+++ b/pkgs/by-name/ng/nginx-sso/package.nix
@ -30,7 +30,7 @@ buildGoModule rec {
    description = "SSO authentication provider for the auth_request nginx module";
    homepage = "https://github.com/Luzifer/nginx-sso";
    license = licenses.asl20;
-    maintainers = with maintainers; [ delroth ];
+    maintainers = with maintainers; [ ambroisie ];
    mainProgram = "nginx-sso";
  };
 }
--- a/pkgs/by-name/pi/pixi/Cargo.lock
+++ b/pkgs/by-name/pi/pixi/Cargo.lock
--- a/pkgs/by-name/pi/pixi/package.nix
+++ b/pkgs/by-name/pi/pixi/package.nix
@ -13,21 +13,21 @@

 rustPlatform.buildRustPackage rec {
  pname = "pixi";
-  version = "0.19.1";
+  version = "0.20.0";

  src = fetchFromGitHub {
    owner = "prefix-dev";
    repo = "pixi";
    rev = "v${version}";
-    hash = "sha256-rCnW2Ghh6SN1G9u4ybk0jUUFYevH6FozeSjXZfJhW8s=";
+    hash = "sha256-7ah5u3E9nodo/0YSuaswRY07zz8EQgvttbVKjw/USCc=";
  };

  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "async_zip-0.0.16" = "sha256-M94ceTCtyQc1AtPXYrVGplShQhItqZZa/x5qLiL+gs0=";
-      "cache-key-0.0.1" = "sha256-XsBTfe2+J5CGdjYZjhgxiP20OA7+VTCvD9JniLOjhKs=";
-      "pubgrub-0.2.1" = "sha256-SdgxoJ37cs+XwWRCFX4uKhJ9Juu9R/jENb6tzUMam4k=";
+      "async_zip-0.0.17" = "sha256-Q5fMDJrQtob54CTII3+SXHeozy5S5s3iLOzntevdGOs=";
+      "cache-key-0.0.1" = "sha256-qGFjI/LNf2p11BOgacYHU0hoXvCEjjnyAcAAIcD7YTo=";
+      "pubgrub-0.2.1" = "sha256-sqC7R2mtqymYFULDW0wSbM/MKCZc8rP7Yy/gaQpjYEI=";
    };
  };

@ -68,6 +68,8 @@ rustPlatform.buildRustPackage rec {
    "--skip=test_compressed_mapping_catch_missing_package"
    "--skip=test_incremental_lock_file"
    "--skip=test_purl_are_added_for_pypi"
+
+    "--skip=test_task_with_env" # `/usr/bin/env` required
  ];

  postInstall = ''
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@ -5,11 +5,11 @@

 renode.overrideAttrs (finalAttrs: _: {
  pname = "renode-unstable";
-  version = "1.15.0+20240418git228a25674";
+  version = "1.15.0+20240426git72f3c383b";

  src = fetchurl {
    url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-portable.tar.gz";
-    hash = "sha256-v8fWQQM2NZkE+Wsg8pyww6esYLggJzehavqIhzI+EaQ=";
+    hash = "sha256-BOQT5nG6Vu12RyAkCwnh6PYfNQTcYGdV4XHDpi/8kPE=";
  };

  passthru.updateScript =
--- a/Show More
+++ b/Show More
				`@ -0,0 +1 @@`
				`{ haskell, haskellPackages }: haskell.lib.justStaticExecutables (haskellPackages.callPackage ./generated.nix { })`