Merge remote-tracking branch 'origin/master' into staging-next

2025-04-17 19:38:39 +00:00 · 2025-04-11 21:17:42 +03:00 · 2025-04-11 21:17:42 +03:00 · aece6a0c1f
commit aece6a0c1f
parent 049254d36c 99c18ee6ea
89 changed files with 823 additions and 376 deletions
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@ -59,6 +59,8 @@

 - The `config` triple for `aarch64-darwin` has been changed from `aarch64-apple-darwin` to `arm64-apple-darwin` to match the Apple toolchain and LLVM’s expectations.

+- The `electron` packages will now provide their headers (available via `electron.headers`) in extracted form instead of in a tarball.
+
 - [testers.shellcheck](https://nixos.org/manual/nixpkgs/unstable/#tester-shellcheck) now warns when `name` is not provided.
  The `name` argument will become mandatory in a future release.

--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -2830,6 +2830,42 @@ runTests {
    expected = "unknown";
  };

+  # https://github.com/NixOS/nixpkgs/issues/396849
+  "test: submodule definitions aren't unchecked when evaluating submodule documentation" = {
+    expr =
+      let
+        module =
+          { lib, ... }:
+          {
+            options.foo = lib.mkOption { type = lib.types.submodule submodule; };
+          };
+
+        submodule = {
+          options.bar = lib.mkOption { type = lib.types.int; };
+          config.submoduleWrong = throw "yikes";
+        };
+
+        options = (evalModules { modules = [ module ]; }).options;
+
+        renderableOpts = filter (o: !o.internal) (optionAttrSetToDocList options);
+        # Evaluate the whole docs
+      in
+      builtins.deepSeq renderableOpts
+        # Return the locations
+        (map (o: o.loc) renderableOpts);
+    expected = [
+      [
+        "_module"
+        "args"
+      ]
+      [ "foo" ]
+      [
+        "foo"
+        "bar"
+      ]
+    ];
+  };
+
  testFreeformOptions = {
    expr =
      let
--- a/lib/types.nix
+++ b/lib/types.nix
@ -290,6 +290,15 @@ let
      unparenthesize: t:
      if unparenthesize (t.descriptionClass or null) then t.description else "(${t.description})";

+    noCheckForDocsModule = {
+      # When generating documentation, our goal isn't to check anything.
+      # Quite the opposite in fact. Generating docs is somewhat of a
+      # challenge, evaluating modules in a *lacking* context. Anything
+      # that makes the docs avoid an error is a win.
+      config._module.check = lib.mkForce false;
+      _file = "<built-in module that disables checks for the purpose of documentation generation>";
+    };
+
    # When adding new types don't forget to document them in
    # nixos/doc/manual/development/option-types.section.md!
    types = rec {
@ -1209,7 +1218,14 @@ let
        in
        mkOptionType {
          inherit name;
-          description = if description != null then description else freeformType.description or name;
+          description =
+            if description != null then
+              description
+            else
+              let
+                docsEval = base.extendModules { modules = [ noCheckForDocsModule ]; };
+              in
+              docsEval._module.freeformType.description or name;
          check = x: isAttrs x || isFunction x || path.check x;
          merge =
            loc: defs:
@ -1222,7 +1238,18 @@ let
          };
          getSubOptions =
            prefix:
-            (base.extendModules { inherit prefix; }).options
+            let
+              docsEval = (
+                base.extendModules {
+                  inherit prefix;
+                  modules = [ noCheckForDocsModule ];
+                }
+              );
+              # Intentionally shadow the freeformType from the possibly *checked*
+              # configuration. See `noCheckForDocsModule` comment.
+              inherit (docsEval._module) freeformType;
+            in
+            docsEval.options
            // optionalAttrs (freeformType != null) {
              # Expose the sub options of the freeform type. Note that the option
              # discovery doesn't care about the attribute name used here, so this
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -189,6 +189,8 @@

 - [echoip](https://github.com/mpolden/echoip), a simple service for looking up your IP address. Available as [services.echoip](#opt-services.echoip.enable).

+- [whoami](https://github.com/traefik/whoami), a tiny Go server that prints OS information and HTTP request to output. Available as [services.whoami](#opt-services.whoami.enable).
+
 - [LiteLLM](https://github.com/BerriAI/litellm), a LLM Gateway to provide model access, fallbacks and spend tracking across 100+ LLMs. All in the OpenAI format. Available as [services.litellm](#opt-services.litellm.enable).

 - [Buffyboard](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/tree/master/buffyboard), a framebuffer on-screen keyboard. Available as [services.buffyboard](option.html#opt-services.buffyboard).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1639,6 +1639,7 @@
  ./services/web-apps/wakapi.nix
  ./services/web-apps/weblate.nix
  ./services/web-apps/whitebophir.nix
+  ./services/web-apps/whoami.nix
  ./services/web-apps/wiki-js.nix
  ./services/web-apps/windmill.nix
  ./services/web-apps/wordpress.nix
--- a/nixos/modules/services/desktop-managers/cosmic.nix
+++ b/nixos/modules/services/desktop-managers/cosmic.nix
@ -14,12 +14,7 @@ let
  cfg = config.services.desktopManager.cosmic;
 in
 {
-  meta.maintainers = with lib.maintainers; [
-    thefossguy
-    HeitorAugustoLN
-    nyabinary
-    ahoneybun
-  ];
+  meta.maintainers = lib.teams.cosmic.members;

  options = {
    services.desktopManager.cosmic = {
--- a/nixos/modules/services/display-managers/cosmic-greeter.nix
+++ b/nixos/modules/services/display-managers/cosmic-greeter.nix
@ -16,12 +16,7 @@ let
 in

 {
-  meta.maintainers = with lib.maintainers; [
-    thefossguy
-    HeitorAugustoLN
-    nyabinary
-    ahoneybun
-  ];
+  meta.maintainers = lib.teams.cosmic.members;

  options.services.displayManager.cosmic-greeter = {
    enable = lib.mkEnableOption "COSMIC greeter";
--- a/nixos/modules/services/web-apps/whoami.nix
+++ b/nixos/modules/services/web-apps/whoami.nix
@ -0,0 +1,90 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.whoami;
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.whoami = {
+    enable = lib.mkEnableOption "whoami";
+
+    package = lib.mkPackageOption pkgs "whoami" { };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      description = "The port whoami should listen on.";
+      default = 8000;
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = "Extra command line arguments to pass to whoami. See <https://github.com/traefik/whoami#flags> for details.";
+      default = [ ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.whoami = {
+      wantedBy = [ "multi-user.target" ];
+
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        User = "whoami";
+        Group = "whoami";
+        DynamicUser = true;
+        ExecStart = lib.escapeShellArgs (
+          [
+            (lib.getExe cfg.package)
+            "-port"
+            cfg.port
+          ]
+          ++ cfg.extraArgs
+        );
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SocketBindAllow = "tcp:${toString cfg.port}";
+        SocketBindDeny = "any";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -1447,6 +1447,7 @@ in
  webhook = runTest ./webhook.nix;
  weblate = handleTest ./web-apps/weblate.nix { };
  whisparr = handleTest ./whisparr.nix { };
+  whoami = runTest ./whoami.nix;
  whoogle-search = handleTest ./whoogle-search.nix { };
  wiki-js = runTest ./wiki-js.nix;
  wine = handleTest ./wine.nix { };
--- a/nixos/tests/cosmic.nix
+++ b/nixos/tests/cosmic.nix
@ -12,9 +12,7 @@

  meta = {
    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [
-      thefossguy
-    ];
+    maintainers = lib.teams.cosmic.members;
  };

  nodes.machine = {
--- a/nixos/tests/whoami.nix
+++ b/nixos/tests/whoami.nix
@ -0,0 +1,32 @@
+{ lib, ... }:
+
+{
+  name = "echoip";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.machine = {
+    services.whoami.enable = true;
+  };
+
+  interactive.nodes.machine = {
+    networking.firewall.allowedTCPPorts = [ 8000 ];
+    virtualisation.forwardPorts = [
+      {
+        from = "host";
+        host.port = 8000;
+        guest.port = 8000;
+      }
+    ];
+  };
+
+  testScript = ''
+    import re
+
+    machine.wait_for_unit("whoami.service")
+    machine.wait_for_open_port(8000)
+
+    response = machine.succeed("curl -H 'X-Test-Header: Hello World!' http://127.0.0.1:8000/test")
+    assert re.search(r"^GET /test", response, re.M)
+    assert re.search(r"^X-Test-Header: Hello World!", response, re.M)
+  '';
+}
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -44,12 +44,6 @@ let
  # need to be updated every time the latest electron gets a new abi version number
  electron = electron_33;

-  # unpack tarball containing electron's headers
-  electron-headers = runCommand "electron-headers" { } ''
-    mkdir -p $out
-    tar -C $out --strip-components=1 -xvf ${electron.headers}
-  '';
-
  mathJaxSrc = fetchzip {
    url = "https://s3.amazonaws.com/rstudio-buildtools/mathjax-27.zip";
    hash = "sha256-J7SZK/9q3HcXTD7WFHxvh++ttuCd89Vc4SEBrUEU0AI=";
@ -241,7 +235,7 @@ stdenv.mkDerivation rec {
        --replace-fail "npm ci && " ""

      # use electron's headers to make node-gyp compile against the electron ABI
-      export npm_config_nodedir="${electron-headers}"
+      export npm_config_nodedir="${electron.headers}"

      ### override the detected electron version
      substituteInPlace node_modules/@electron-forge/core-utils/dist/electron-version.js \
--- a/pkgs/by-name/am/amazon-q-cli/package.nix
+++ b/pkgs/by-name/am/amazon-q-cli/package.nix
@ -7,18 +7,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "amazon-q-cli";
-  version = "1.7.2";
+  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "amazon-q-developer-cli";
    tag = "v${version}";
-    hash = "sha256-uKsj7QBKomkO1xP5VgOGI5W8CHIgPQx4QsS2voghrVc=";
+    hash = "sha256-Hi0klNNxtWlZvcqobb8Y2hLsw/Pck1YQZB4AYBmcNKI=";
  };

  useFetchCargoVendor = true;

-  cargoHash = "sha256-G99vb+7eomxDy9xFJjKA+KpCH2NUzitAKHZE5b62Db8=";
+  cargoHash = "sha256-XK6B2OTCnWMow3KHWU6OK1HsyQW7apcLoYRP7viTte0=";

  cargoBuildFlags = [
    "-p"
--- a/pkgs/by-name/an/anytype/package.nix
+++ b/pkgs/by-name/an/anytype/package.nix
@ -31,12 +31,6 @@ let
    rev = "687106c4e37297f86fab79f77ef83599b61ab65c";
    hash = "sha256-Y0irD0jzqYobnjtD2M1+hTDRUUYnuygUx9+tE1gUoTw=";
  };
-
-  electron-headers = runCommand "electron-headers" { } ''
-    mkdir -p $out
-    tar -C $out --strip-components=1 -xvf ${electron.headers}
-  '';
-
 in
 buildNpmPackage {
  inherit pname version src;
@ -55,7 +49,7 @@ buildNpmPackage {

  npmFlags = [
    # keytar needs to be built against electron's ABI
-    "--nodedir=${electron-headers}"
+    "--nodedir=${electron.headers}"
  ];

  buildPhase = ''
--- a/pkgs/by-name/bt/btcpayserver/package.nix
+++ b/pkgs/by-name/bt/btcpayserver/package.nix
@ -8,13 +8,13 @@

 buildDotnetModule rec {
  pname = "btcpayserver";
-  version = "2.0.8";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "btcpayserver";
    repo = "btcpayserver";
    tag = "v${version}";
-    sha256 = "sha256-OK2OqI4h2SLtnGM2Oen5IgmFKqCkd1ZPuXgCOx6Gixs=";
+    sha256 = "sha256-vojRe64STkCKNn/es5+TyBAXvSBXkjjGLbykuKTEa5k=";
  };

  projectFile = "BTCPayServer/BTCPayServer.csproj";
--- a/pkgs/by-name/ca/camset/package.nix
+++ b/pkgs/by-name/ca/camset/package.nix
@ -0,0 +1,67 @@
+{
+  python3Packages,
+  fetchFromGitHub,
+  copyDesktopItems,
+  makeDesktopItem,
+  gobject-introspection,
+  v4l-utils,
+  wrapGAppsHook3,
+  lib,
+}:
+
+python3Packages.buildPythonApplication {
+  pname = "camset";
+  version = "0-unstable-2023-05-20";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "azeam";
+    repo = "camset";
+    rev = "b813ba9b1d29f2d46fad268df67bf3615a324f3e";
+    hash = "sha256-vTF3MJQi9fZZDlbEj5800H22GGWOte3+KZCpSnsSTaQ=";
+  };
+
+  build-system = with python3Packages; [ setuptools ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook3
+    copyDesktopItems
+  ];
+
+  dependencies = with python3Packages; [
+    pygobject3
+    opencv-python
+  ];
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
+      --prefix PATH : ${lib.makeBinPath [ v4l-utils ]}
+    )
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "camset";
+      exec = "camset";
+      icon = "camera";
+      comment = "Adjust webcam settings";
+      desktopName = "Camset";
+      categories = [
+        "Utility"
+        "Video"
+      ];
+      type = "Application";
+    })
+  ];
+
+  meta = {
+    description = "GUI for Video4Linux adjustments of webcams";
+    homepage = "https://github.com/azeam/camset";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ averdow ];
+  };
+}
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@ -27,7 +27,7 @@ appimageTools.wrapType2 {

  passthru.updateScript = ''
    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl grep common-updater-scripts
+    #!nix-shell -i bash -p curl gnugrep common-updater-scripts
    version=$(curl -I -X GET https://chatboxai.app/install_chatbox/linux | grep -oP 'Chatbox-\K[0-9]+\.[0-9]+\.[0-9]+')
    update-source-version chatbox $version
  '';
--- a/pkgs/by-name/ch/chawan/package.nix
+++ b/pkgs/by-name/ch/chawan/package.nix
@ -11,7 +11,6 @@
  pkg-config,
  zlib,
  unstableGitUpdater,
-  libseccomp,
  replaceVars,
 }:

@ -48,7 +47,6 @@ stdenv.mkDerivation {

  buildInputs = [
    curlMinimal
-    libseccomp
    ncurses
    zlib
  ];
@ -83,6 +81,5 @@ stdenv.mkDerivation {
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ jtbx ];
    mainProgram = "cha";
-    broken = stdenv.hostPlatform.isDarwin; # pending PR #292043
  };
 }
--- a/pkgs/by-name/ci/cirrus-cli/package.nix
+++ b/pkgs/by-name/ci/cirrus-cli/package.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "cirrus-cli";
-  version = "0.140.8";
+  version = "0.141.0";

  src = fetchFromGitHub {
    owner = "cirruslabs";
    repo = "cirrus-cli";
    rev = "v${version}";
-    hash = "sha256-nh6nvH26mYPHmjixTk3sn65JXVT5QSj7cX8yfEYaoD4=";
+    hash = "sha256-ET7fQeEdev+CkH+DGiit2Y/UpISN+WYZl4+Fw3AxbGo=";
  };

-  vendorHash = "sha256-tOwVuOPBXqNB2aKOfqBGDziKskGnyjo+qllko9x39UA=";
+  vendorHash = "sha256-BVR/EEEYkilKSJjHA31g3dsXm0LBJFzoFGkrLUa0B4k=";

  ldflags = [
    "-X github.com/cirruslabs/cirrus-cli/internal/version.Version=v${version}"
--- a/pkgs/by-name/cl/cloud-provider-kind/package.nix
+++ b/pkgs/by-name/cl/cloud-provider-kind/package.nix
@ -0,0 +1,31 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitUpdater,
+  stdenv,
+}:
+buildGoModule rec {
+  pname = "cloud-provider-kind";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "kubernetes-sigs";
+    repo = "cloud-provider-kind";
+    tag = "v${version}";
+    hash = "sha256-6HdP6/uUCtLyZ7vjFGB2NLqe73v/yolRTUE5s/KyIIk=";
+  };
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  vendorHash = null;
+
+  checkFlags = lib.optional stdenv.isDarwin "-skip=^Test_firstSuccessfulProbe$";
+
+  meta = {
+    description = "Load Balancer implementation for Kubernetes-in-Docker";
+    homepage = "https://github.com/kubernetes-sigs/cloud-provider-kind";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nicoo ];
+    mainProgram = "cloud-provider-kind";
+  };
+}
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@ -167,15 +167,10 @@ stdenvNoCC.mkDerivation {

    ${lib.optionalString hostPlatform.isDarwin ''
      APP_DIR="$out/Applications"
-      CURSOR_APP="$APP_DIR/Cursor.app"
      mkdir -p "$APP_DIR"
      cp -Rp Cursor.app "$APP_DIR"
      mkdir -p "$out/bin"
-      cat << EOF > "$out/bin/cursor"
-      #!${stdenvNoCC.shell}
-      open -na "$CURSOR_APP" --args "\$@"
-      EOF
-      chmod +x "$out/bin/cursor"
+      ln -s "$APP_DIR/Cursor.app/Contents/Resources/app/bin/cursor" "$out/bin/cursor"
    ''}

    runHook postInstall
--- a/pkgs/by-name/co/conduit/package.nix
+++ b/pkgs/by-name/co/conduit/package.nix
@ -15,14 +15,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "conduit";
-  version = "0.9.3";
+  version = "0.9.4";

  src = fetchFromGitHub {
    owner = "LLNL";
    repo = "conduit";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-R7DiMwaMG9VfqDJiO3kFPb76j6P2GZl/6qLxDfVex8A=";
+    hash = "sha256-xs/9hsE1DLCegXp3CHSl6qpC4ap+niNAWX5lNlUxz9E=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@ -88,11 +88,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/pop-os/cosmic-applets";
    description = "Applets for the COSMIC Desktop Environment";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      qyliss
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-applibrary/package.nix
@ -67,10 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/pop-os/cosmic-applibrary";
    description = "Application Template for the COSMIC Desktop Environment";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
    mainProgram = "cosmic-app-library";
  };
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@ -65,10 +65,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/pop-os/cosmic-bg";
    description = "Applies Background for the COSMIC Desktop Environment";
    license = lib.licenses.mpl20;
-    maintainers = with lib.maintainers; [
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
    mainProgram = "cosmic-bg";
  };
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@ -82,11 +82,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Compositor for the COSMIC Desktop Environment";
    mainProgram = "cosmic-comp";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      qyliss
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-design-demo/package.nix
+++ b/pkgs/by-name/co/cosmic-design-demo/package.nix
@ -52,10 +52,7 @@ rustPlatform.buildRustPackage {
    homepage = "https://github.com/pop-os/cosmic-design-demo";
    description = "Design Demo for the COSMIC Desktop Environment";
    license = lib.licenses.mpl20;
-    maintainers = with lib.maintainers; [
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
    mainProgram = "cosmic-design-demo";
  };
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@ -99,10 +99,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Text Editor for the COSMIC Desktop Environment";
    mainProgram = "cosmic-edit";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [
-      ahoneybun
-      nyabinary
-    ];
+    maintainers = teams.cosmic.members;
    platforms = platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@ -105,11 +105,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "File Manager for the COSMIC Desktop Environment";
    license = lib.licenses.gpl3Only;
    mainProgram = "cosmic-files";
-    maintainers = with lib.maintainers; [
-      ahoneybun
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-greeter/package.nix
+++ b/pkgs/by-name/co/cosmic-greeter/package.nix
@ -94,10 +94,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Greeter for the COSMIC Desktop Environment";
    mainProgram = "cosmic-greeter";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-icons/package.nix
+++ b/pkgs/by-name/co/cosmic-icons/package.nix
@ -48,9 +48,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    license = with lib.licenses; [
      cc-by-sa-40
    ];
-    maintainers = with lib.maintainers; [
-      a-kenji
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
  };
 })
--- a/pkgs/by-name/co/cosmic-idle/package.nix
+++ b/pkgs/by-name/co/cosmic-idle/package.nix
@ -73,7 +73,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/pop-os/cosmic-idle";
    license = lib.licenses.gpl3Only;
    mainProgram = "cosmic-idle";
-    maintainers = with lib.maintainers; [ HeitorAugustoLN ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
    sourceProvenance = [ lib.sourceTypes.fromSource ];
  };
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@ -66,10 +66,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Launcher for the COSMIC Desktop Environment";
    mainProgram = "cosmic-launcher";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-notifications/package.nix
+++ b/pkgs/by-name/co/cosmic-notifications/package.nix
@ -77,7 +77,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Notifications for the COSMIC Desktop Environment";
    mainProgram = "cosmic-notifications";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ nyabinary ];
+    maintainers = teams.cosmic.members;
    platforms = platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@ -62,10 +62,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "OSD for the COSMIC Desktop Environment";
    mainProgram = "cosmic-osd";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-panel/package.nix
+++ b/pkgs/by-name/co/cosmic-panel/package.nix
@ -64,11 +64,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Panel for the COSMIC Desktop Environment";
    mainProgram = "cosmic-panel";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      qyliss
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@ -95,10 +95,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/pop-os/cosmic-player";
    description = "Media player for the COSMIC Desktop Environment";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      ahoneybun
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
    mainProgram = "cosmic-player";
  };
--- a/pkgs/by-name/co/cosmic-protocols/package.nix
+++ b/pkgs/by-name/co/cosmic-protocols/package.nix
@ -45,10 +45,7 @@ stdenv.mkDerivation {
      mit
      gpl3Only
    ];
-    maintainers = with lib.maintainers; [
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@ -66,10 +66,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/pop-os/cosmic-randr";
    description = "Library and utility for displaying and configuring Wayland outputs";
    license = lib.licenses.mpl20;
-    maintainers = with lib.maintainers; [
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
    mainProgram = "cosmic-randr";
  };
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@ -51,7 +51,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/pop-os/cosmic-screenshot";
    description = "Screenshot tool for the COSMIC Desktop Environment";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ nyabinary ];
+    maintainers = teams.cosmic.members;
    platforms = platforms.linux;
    mainProgram = "cosmic-screenshot";
  };
--- a/pkgs/by-name/co/cosmic-session/package.nix
+++ b/pkgs/by-name/co/cosmic-session/package.nix
@ -80,12 +80,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Session manager for the COSMIC desktop environment";
    license = lib.licenses.gpl3Only;
    mainProgram = "cosmic-session";
-    maintainers = with lib.maintainers; [
-      a-kenji
-      nyabinary
-      thefossguy
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-settings-daemon/package.nix
+++ b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
@ -62,10 +62,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Settings Daemon for the COSMIC Desktop Environment";
    mainProgram = "cosmic-settings-daemon";
    license = licenses.gpl3Only;
-    maintainers = with maintainers; [
-      nyabinary
-      drakon64
-    ];
+    maintainers = teams.cosmic.members;
    platforms = platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@ -102,10 +102,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/pop-os/cosmic-settings";
    license = lib.licenses.gpl3Only;
    mainProgram = "cosmic-settings";
-    maintainers = with lib.maintainers; [
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@ -74,11 +74,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/pop-os/cosmic-store";
    description = "App Store for the COSMIC Desktop Environment";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      ahoneybun
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@ -81,11 +81,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/pop-os/cosmic-term";
    description = "Terminal for the COSMIC Desktop Environment";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      ahoneybun
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
    mainProgram = "cosmic-term";
  };
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@ -52,10 +52,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      # round_moons_nasa.jpg: https://www.planetary.org/space-images/the-solar-systems-round-moons
      publicDomain
    ];
-    maintainers = with lib.maintainers; [
-      pandapip1
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
+++ b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
@ -3,6 +3,7 @@
  stdenv,
  rustPlatform,
  fetchFromGitHub,
+  cosmic-wallpapers,
  libcosmicAppHook,
  pkg-config,
  libinput,
@ -23,6 +24,22 @@ rustPlatform.buildRustPackage (finalAttrs: {
    hash = "sha256-3jivE0EaSddPxMYn9DDaYUMafPf60XeCwVeQegbt++c=";
  };

+  postPatch = ''
+    # While the `kate-hazen-COSMIC-desktop-wallpaper.png` image is present
+    # in the `pop-wallpapers` package, we're using the Orion Nebula image
+    # from NASA available in the `cosmic-wallpapers` package. Mainly because
+    # the previous image was used in the GNOME shell extension and the
+    # Orion Nebula image is widely used in the Rust-based COSMIC DE's
+    # marketing materials. Another reason to use the Orion Nebula image
+    # is that it's actually the default wallpaper as configured by the
+    # `cosmic-bg` package's configuration in upstream [1] [2].
+    #
+    # [1]: https://github.com/pop-os/cosmic-bg/blob/epoch-1.0.0-alpha.6/config/src/lib.rs#L142
+    # [2]: https://github.com/pop-os/cosmic-bg/blob/epoch-1.0.0-alpha.6/data/v1/all#L3
+    substituteInPlace src/view/mod.rs \
+      --replace-fail '/usr/share/backgrounds/pop/kate-hazen-COSMIC-desktop-wallpaper.png' "${cosmic-wallpapers}/share/backgrounds/cosmic/orion_nebula_nasa_heic0601a.jpg"
+  '';
+
  useFetchCargoVendor = true;
  cargoHash = "sha256-l5y9bOG/h24EfiAFfVKjtzYCzjxU2TI8wh6HBUwoVcE=";

@ -70,10 +87,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Workspaces Epoch for the COSMIC Desktop Environment";
    mainProgram = "cosmic-workspaces";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/di/direnv/package.nix
+++ b/pkgs/by-name/di/direnv/package.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "direnv";
-  version = "2.35.0";
+  version = "2.36.0";

  src = fetchFromGitHub {
    owner = "direnv";
    repo = "direnv";
    rev = "v${version}";
-    hash = "sha256-C4FkBS+2MZGGlpWb7ng4Aa9IvqEuY716M5h2W3b8N1E=";
+    hash = "sha256-xqHc4Eb0mHQezmElJv20AMNQPgusXdvskNmlO+JP1lw=";
  };

-  vendorHash = "sha256-O2NZgWn00uKLstYPIj9LwyF4kmitJ1FXltazv8RrmZg=";
+  vendorHash = "sha256-+7HnbJ6cIzYHkEJVcp2IydHyuqD5PfdL6TUcq7Dpluk=";

  # we have no bash at the moment for windows
  BASH_PATH = lib.optionalString (!stdenv.hostPlatform.isWindows) "${bash}/bin/bash";
--- a/pkgs/by-name/el/element-desktop/keytar/default.nix
+++ b/pkgs/by-name/el/element-desktop/keytar/default.nix
@ -11,17 +11,10 @@
  fetchNpmDeps,
  npmHooks,
  electron,
-  runCommand,
 }:

 let
  pinData = lib.importJSON ./pin.json;
-
-  electron-headers = runCommand "electron-headers" { } ''
-    mkdir -p $out
-    tar -C $out --strip-components=1 -xvf ${electron.headers}
-  '';
-
 in
 stdenv.mkDerivation rec {
  pname = "keytar-forked";
@ -57,7 +50,7 @@ stdenv.mkDerivation rec {

  npmFlags = [
    # Make sure the native modules are built against electron's ABI
-    "--nodedir=${electron-headers}"
+    "--nodedir=${electron.headers}"
    # https://nodejs.org/api/os.html#osarch
    "--arch=${
      if stdenv.hostPlatform.parsed.cpu.name == "i686" then
--- a/pkgs/by-name/em/emulationstation-de/package.nix
+++ b/pkgs/by-name/em/emulationstation-de/package.nix
@ -5,6 +5,7 @@
  cmake,
  pkg-config,
  alsa-lib,
+  bluez,
  curl,
  ffmpeg,
  freeimage,
@ -20,11 +21,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "emulationstation-de";
-  version = "3.1.1";
+  version = "3.2.0";

  src = fetchzip {
    url = "https://gitlab.com/es-de/emulationstation-de/-/archive/v${finalAttrs.version}/emulationstation-de-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-pQHT/BEtIWc8tQXPjU5KFt8jED+4IqcZR+VMmAFc940=";
+    hash = "sha256-tW8+7ImcJ3mBhoIHVE8h4cba+4SQLP55kiFYE7N8jyI=";
  };

  patches = [
@ -45,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    alsa-lib
+    bluez
    curl
    ffmpeg
    freeimage
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@ -9,18 +9,18 @@
  nix-update-script,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "hugo";
-  version = "0.145.0";
+  version = "0.146.1";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
-    tag = "v${version}";
-    hash = "sha256-5SV6VzNWGnFQBD0fBugS5kKXECvV1ZE7sk7SwJCMbqY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WZJdojnjQCzmpZjM8Cjh9iAP+Qtcq+XAY4sRGdua0t4=";
  };

-  vendorHash = "sha256-aynhBko6ecYyyMG9XO5315kLerWDFZ6V8LQ/WIkvC70=";
+  vendorHash = "sha256-LSNy65sIuq/zK3swdUvxGwbo/3ulq+JP5ur7M7aTdAs=";

  checkFlags =
    let
@ -69,13 +69,13 @@ buildGoModule rec {
    versionCheckHook
  ];
  doInstallCheck = true;
-  versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
+  versionCheckProgram = "${placeholder "out"}/bin/hugo";
  versionCheckProgramArg = "version";

  passthru.updateScript = nix-update-script { };

  meta = {
-    changelog = "https://github.com/gohugoio/hugo/releases/tag/v${version}";
+    changelog = "https://github.com/gohugoio/hugo/releases/tag/v${finalAttrs.version}";
    description = "Fast and modern static website engine";
    homepage = "https://gohugo.io";
    license = lib.licenses.asl20;
@ -88,4 +88,4 @@ buildGoModule rec {
      federicoschonborn
    ];
  };
-}
+})
--- a/pkgs/by-name/it/iterm2/package.nix
+++ b/pkgs/by-name/it/iterm2/package.nix
@ -34,7 +34,7 @@ stdenvNoCC.mkDerivation rec {
    mkdir -p "$out/bin"
    cat << EOF > "$out/bin/iterm2"
    #!${stdenvNoCC.shell}
-    open -na "$APP_DIR" --args "$@"
+    open -na "$APP_DIR" --args "\$@"
    EOF
    chmod +x "$out/bin/iterm2"
    runHook postInstall
--- a/pkgs/by-name/kr/krillinai/package.nix
+++ b/pkgs/by-name/kr/krillinai/package.nix
@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  pkg-config,
+  xorg,
+  libGL,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "krillinai";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "krillinai";
+    repo = "KrillinAI";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AAlefejME+XLERcDJDeVgzySVX+KGrCMt7PJyWaxnoM=";
+  };
+
+  vendorHash = "sha256-mpvypCZmvVVljftGpcV1aea3s7Xmhr0jLfKZIZ0nkX8=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    xorg.libXinerama
+    xorg.libXxf86vm
+    xorg.libXcursor
+    xorg.libXrandr
+    xorg.libX11
+    xorg.libXi
+    libGL
+  ];
+
+  # open g:\bin\AI\tasks\gdQRrtQP\srt_no_ts_1.srt: no such file or directory
+  doCheck = false;
+
+  postInstall = ''
+    mv $out/bin/desktop $out/bin/krillinai-desktop
+    mv $out/bin/server $out/bin/krillinai-server
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Video translation and dubbing tool";
+    homepage = "https://github.com/krillinai/KrillinAI";
+    changelog = "https://github.com/krillinai/KrillinAI/releases/tag/v${finalAttrs.version}";
+    mainProgram = "krillinai-desktop";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ emaryn ];
+  };
+})
--- a/pkgs/by-name/la/landrun/package.nix
+++ b/pkgs/by-name/la/landrun/package.nix
@ -0,0 +1,110 @@
+{
+  stdenv,
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  which,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "landrun";
+  version = "0.1.15";
+
+  src = fetchFromGitHub {
+    owner = "Zouuup";
+    repo = "landrun";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yfK7Q3FKXp5pXVBNV0w/vN0xuoaTxWCq19ziBQnLapg=";
+  };
+
+  # Test script requires lots of patching for build sandbox.
+  # Networking tests are disabled, since they actually access the internet.
+  # Two tests that specifically target /usr/bin are disabled.
+  postPatch = ''
+    patchShebangs --build test.sh
+    substituteInPlace test.sh \
+      --replace-fail 'Basic access tests' '# Basic access tests' \
+      --replace-fail '--rox /usr --ro /lib --ro /lib64' '--rox ${builtins.storeDir}' \
+      --replace-fail '--rox /usr --ro /lib,/lib64,' '--rox ${builtins.storeDir} --ro ' \
+      --replace-fail '--rox /usr --ro  /etc -- whoami' '--help' \
+      --replace-fail '--rox /usr' '--rox ${builtins.storeDir}' \
+      --replace-fail '--ro /usr/bin' "" \
+      --replace-fail '#!/bin/bash' '#!${stdenv.shell}' \
+      --replace-fail '/usr/bin/true' '$(which true)' \
+      --replace-fail 'ls /usr | grep bin' '$(which ls) / | $(which grep) build' \
+      --replace-fail 'ls /usr' '$(which ls) /build' \
+      --replace-fail 'cat ' '$(which cat) ' \
+      --replace-fail 'grep ' '$(which grep) ' \
+      --replace-fail 'ls -la /usr/bin' 'ls -la /build' \
+      --replace-fail 'run_test "TCP connection' 'false && run_test "TCP' \
+      --replace-fail 'run_test "Unrestricted network access"' 'false && run_test ""' \
+      --replace-fail 'run_test "Restricted network access"' 'false && run_test ""' \
+      --replace-fail 'run_test "Execute from read-only paths regression test' 'false && run_test "' \
+      --replace-fail 'run_test "Root path' 'false && run_test "Root path'
+  '';
+
+  vendorHash = "sha256-Bs5b5w0mQj1MyT2ctJ7V38Dy60moB36+T8TFH38FA08=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    which
+  ];
+  postInstallCheck = ''
+    # only check functionality if the builder supports it (Linux 5.13+)
+    set +e
+    $out/bin/landrun --best-effort --rox ${builtins.storeDir} sh -c 'exit'
+    [[ $? != 0 ]] && set -e && return
+    set -e
+
+    # only run upstream tests if the builder supports all features (Linux 6.7+)
+    set +e
+    $out/bin/landrun --rox ${builtins.storeDir} sh -c 'exit'
+    [[ $? == 0 ]] && set -e && export PATH=$out/bin:"$PATH" && ./test.sh --use-system
+    set -e
+
+    pushd $(mktemp -d)
+
+    # check directory read/write restrictions work
+    mkdir dir1
+    echo content > dir1/file1
+
+    set +e
+    $out/bin/landrun --best-effort --rox ${builtins.storeDir} sh -c '< dir1/file1'
+    [[ $? == 0 ]] && die
+    set -e
+
+    $out/bin/landrun --best-effort --rox ${builtins.storeDir} --ro ./dir1 --env PATH sh -c 'cat dir1/file1' \
+      | grep content > /dev/null
+
+    set +e
+    $out/bin/landrun --best-effort --rox ${builtins.storeDir} --ro ./dir1 sh -c 'echo x > dir1/file1'
+    [[ $? == 0 ]] && die
+    set -e
+    cat dir1/file1 | grep content > /dev/null
+
+    $out/bin/landrun --best-effort --rox ${builtins.storeDir} --rw ./dir1 sh -c 'echo x > dir1/file1'
+    cat dir1/file1 | grep x > /dev/null
+
+    popd
+  '';
+
+  meta = {
+    description = "Lightweight, secure sandbox for running Linux processes using Landlock LSM";
+    mainProgram = "landrun";
+    longDescription = ''
+      Landrun is designed to make it practical to sandbox any command with fine-grained filesystem
+      and network access controls, without root/containers/SELinux/AppArmor.
+
+      It's lightweight, auditable, and wraps Landlock v5 features.
+
+      Linux 5.13+ is required for file access restrictions, Linux 6.7+ for TCP restrictions.
+    '';
+    homepage = "https://github.com/Zouuup/landrun";
+    changelog = "https://github.com/Zouuup/landrun/releases/tag/{finalAttrs.src.tag}";
+    license = lib.licenses.gpl2Only;
+    maintainers = [ lib.maintainers.fliegendewurst ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/li/libcosmicAppHook/package.nix
+++ b/pkgs/by-name/li/libcosmicAppHook/package.nix
@ -76,10 +76,6 @@ makeSetupHook {

  meta = {
    description = "Setup hook for configuring and wrapping applications based on libcosmic";
-    maintainers = with lib.maintainers; [
-      HeitorAugustoLN
-      nyabinary
-      thefossguy
-    ];
+    maintainers = lib.teams.cosmic.members;
  };
 } ./libcosmic-app-hook.sh
--- a/pkgs/by-name/lo/logseq/package.nix
+++ b/pkgs/by-name/lo/logseq/package.nix
@ -24,14 +24,6 @@
  git,
 }:

-let
-  # unpack tarball containing electron's headers
-  electron-headers = runCommand "electron-headers" { } ''
-    mkdir -p $out
-    tar -C $out --strip-components=1 -xvf ${electron.headers}
-  '';
-in
-
 stdenv.mkDerivation (finalAttrs: {
  pname = "logseq";
  version = "0.10.9-unstable-2025-03-11";
@ -202,7 +194,7 @@ stdenv.mkDerivation (finalAttrs: {
    npm rebuild --verbose
    popd

-    export npm_config_nodedir=${electron-headers}
+    export npm_config_nodedir=${electron.headers}

    pushd static

@ -210,13 +202,13 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace node_modules/dugite/package.json \
      --replace-fail '"postinstall"' '"_postinstall"'

-    # this doesn't seem to build with electron-headers
+    # this doesn't seem to build with electron.headers
    rm node_modules/macos-alias/binding.gyp

    # the electron-rebuild command deadlocks for some reason, let's just use normal npm rebuild (since we overrode the nodedir anyways)
    npm rebuild --verbose

-    # remove most references to electron-headers
+    # remove most references to electron.headers
    # TODO: track down the remaining references
    find node_modules -type f \( -name "*.target.mk" -o -name "config.gypi" -o -name "Makefile" \) -delete

--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "namespace-cli";
-  version = "0.0.407";
+  version = "0.0.408";

  src = fetchFromGitHub {
    owner = "namespacelabs";
    repo = "foundation";
    rev = "v${version}";
-    hash = "sha256-ToAZacID91HxzsPRBKk+b8d9RHYmeDHjT0fQxOjXgRo=";
+    hash = "sha256-Cjxoh+fWI20KRTOgTCJ2KOtS3e7GuitreS85S2BbtNU=";
  };

-  vendorHash = "sha256-c5USwojzahlReI0GK6IvByICJJ7OGydnLCfIpeqHPKM=";
+  vendorHash = "sha256-OBFzi8n29gnyMvwLYsmJz8oLLvR2i6YRNrfWxkRwC/s=";

  subPackages = [
    "cmd/nsc"
--- a/pkgs/by-name/nb/nbxplorer/deps.json
+++ b/pkgs/by-name/nb/nbxplorer/deps.json
@ -166,13 +166,13 @@
  },
  {
    "pname": "NBitcoin",
-    "version": "7.0.50",
-    "hash": "sha256-l3H70u5OAbd2hevX/yeVBdQyee/dUn5mp4iGvTnTcjk="
+    "version": "8.0.4",
+    "hash": "sha256-9GxJVcByg3zHl9uR01KpTkFkwKuFyr2hm0uZWWlDGeE="
  },
  {
    "pname": "NBitcoin.Altcoins",
-    "version": "3.0.34",
-    "hash": "sha256-eh5Yft+UQqlLREJJ3kKAKLYYjAHOuMxhBI+tr3Ciya8="
+    "version": "4.0.4",
+    "hash": "sha256-fHG/dlTbEu9DjFnHpEVI6/LbVz0BSJdqkPOo6tQW0fg="
  },
  {
    "pname": "NETStandard.Library",
--- a/pkgs/by-name/nb/nbxplorer/package.nix
+++ b/pkgs/by-name/nb/nbxplorer/package.nix
@ -7,13 +7,13 @@

 buildDotnetModule rec {
  pname = "nbxplorer";
-  version = "2.5.23";
+  version = "2.5.25";

  src = fetchFromGitHub {
    owner = "dgarage";
    repo = "NBXplorer";
    rev = "v${version}";
-    sha256 = "sha256-T7pKIj7e4ZOX0JRawLc53eqjMrAV2CV8m6BRjukJ+t4=";
+    sha256 = "sha256-RTkKyckdAv6+wJSlDlR+Q8fw0aZEbi4AwB+OPHI7TR4=";
  };

  projectFile = "NBXplorer/NBXplorer.csproj";
--- a/pkgs/by-name/nb/nbxplorer/util/update-common.sh
+++ b/pkgs/by-name/nb/nbxplorer/util/update-common.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl jq common-updater-scripts dotnet-sdk_6 git gnupg nixFlakes
+#!nix-shell -i bash -p coreutils curl jq common-updater-scripts dotnet-sdk_8 git gnupg
 set -euo pipefail

 # This script uses the following env vars:
--- a/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
+++ b/pkgs/by-name/ne/nezha-theme-nazhua/package.nix
@ -12,13 +12,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "nezha-theme-nazhua";
-  version = "0.6.3";
+  version = "0.6.4";

  src = fetchFromGitHub {
    owner = "hi2shark";
    repo = "nazhua";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0tbCNj6kglI3/y4e1pp0J3Tw7rrNhaqIRHoM7mFPCow=";
+    hash = "sha256-9mBM8M9pPZMMyFcf4JOyY5rnhpiNEy8ZDDnEoopjcbg=";
  };

  yarnOfflineCache = fetchYarnDeps {
--- a/pkgs/by-name/pa/patroni/package.nix
+++ b/pkgs/by-name/pa/patroni/package.nix
@ -5,6 +5,7 @@
  versionCheckHook,
  nixosTests,
  nix-update-script,
+  writableTmpDirAsHomeHook,
 }:

 python3Packages.buildPythonApplication rec {
@ -46,12 +47,10 @@ python3Packages.buildPythonApplication rec {
    pytest-cov
    requests
    versionCheckHook
+    writableTmpDirAsHomeHook
  ];
  versionCheckProgramArg = "--version";

-  # Fix tests by preventing them from writing to /homeless-shelter.
-  preCheck = "export HOME=$(mktemp -d)";
-
  __darwinAllowLocalNetworking = true;

  passthru = {
--- a/pkgs/by-name/pi/picolibc/package.nix
+++ b/pkgs/by-name/pi/picolibc/package.nix
@ -96,7 +96,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "picolibc";
-  version = "1.8.9";
+  version = "1.8.9-2";
  strictDeps = true;

  outputs = [
@ -108,7 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "picolibc";
    repo = finalAttrs.pname;
    tag = finalAttrs.version;
-    hash = "sha256-W1zK9mLMfi5pbOpbSLxiB2qKdiyNjOSQu96NM94/fcY=";
+    hash = "sha256-djOZKkinsaaYD4tUEA6mKdo+5em0GP1/+rI0mIm7Vs8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/po/postman/darwin.nix
+++ b/pkgs/by-name/po/postman/darwin.nix
@ -50,7 +50,7 @@ stdenvNoCC.mkDerivation {
    cp -R . $out/Applications/${appName}
    cat > $out/bin/${pname} << EOF
    #!${stdenvNoCC.shell}
-    open -na $out/Applications/${appName} --args "$@"
+    open -na $out/Applications/${appName} --args "\$@"
    EOF
    chmod +x $out/bin/${pname}
    runHook postInstall
--- a/pkgs/by-name/pu/pulumi/package.nix
+++ b/pkgs/by-name/pu/pulumi/package.nix
@ -10,21 +10,25 @@
  callPackage,
  testers,
  pulumi,
+  pulumiPackages,
+  python3Packages,
+  nix-update-script,
+  _experimental-update-script-combinators,
 }:
 buildGoModule rec {
  pname = "pulumi";
-  version = "3.156.0";
+  version = "3.162.0";

  src = fetchFromGitHub {
    owner = "pulumi";
    repo = "pulumi";
    tag = "v${version}";
-    hash = "sha256-1iML+WCEkLMdAJ7e+F5XwBzM+pn3eZQsCaSi3Ui/JdM=";
+    hash = "sha256-avtqURmj3PL82j89kLmVsBWqJJHnOFqR1huoUESt4L4=";
    # Some tests rely on checkout directory name
    name = "pulumi";
  };

-  vendorHash = "sha256-2hpn1IKJvWtXgNKgf56dZABA4VO1aT0cDsHOmCEPrGo=";
+  vendorHash = "sha256-fJFpwhbRkxSI2iQfNJ9qdL9oYM1SVVMJ30VIymoZBmg=";

  sourceRoot = "${src.name}/pkg";

@ -56,6 +60,11 @@ buildGoModule rec {
    # Skip tests that fail in Nix sandbox.
    "-skip=^${
      lib.concatStringsSep "$|^" [
+        # Concurrent map modification in test case.
+        # TODO: remove after the fix is merged and released.
+        # https://github.com/pulumi/pulumi/pull/19200
+        "TestGetDocLinkForPulumiType"
+
        # Seems to require TTY.
        "TestProgressEvents"

@ -68,6 +77,10 @@ buildGoModule rec {
        "TestGenerateOnlyProjectCheck"
        "TestPulumiNewSetsTemplateTag"
        "TestPulumiPromptRuntimeOptions"
+        "TestPulumiNewOrgTemplate"
+        "TestPulumiNewWithOrgTemplates"
+        "TestPulumiNewWithoutPulumiAccessToken"
+        "TestPulumiNewWithoutTemplateSupport"

        # Connects to https://pulumi-testing.vault.azure.net/…
        "TestAzureCloudManager"
@ -117,12 +130,39 @@ buildGoModule rec {
  passthru = {
    pkgs = callPackage ./plugins.nix { };
    withPackages = callPackage ./with-packages.nix { };
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script { })
+      (nix-update-script {
+        attrPath = "pulumiPackages.pulumi-go";
+        extraArgs = [ "--version=skip" ];
+      })
+      (nix-update-script {
+        attrPath = "pulumiPackages.pulumi-nodejs";
+        extraArgs = [ "--version=skip" ];
+      })
+      (nix-update-script {
+        attrPath = "pulumiPackages.pulumi-python";
+        extraArgs = [ "--version=skip" ];
+      })
+    ];
    tests = {
      version = testers.testVersion {
        package = pulumi;
        version = "v${version}";
        command = "PULUMI_SKIP_UPDATE_CHECK=1 pulumi version";
      };
+      # Test building packages that reuse our version and src.
+      inherit (pulumiPackages) pulumi-go pulumi-nodejs pulumi-python;
+      # Pulumi currently requires protobuf4, but Nixpkgs defaults to a newer
+      # version. Test that we can actually build the package with protobuf4.
+      # https://github.com/pulumi/pulumi/issues/16828
+      # https://github.com/NixOS/nixpkgs/issues/351751#issuecomment-2462163436
+      pythonPackage =
+        (python3Packages.overrideScope (
+          final: _: {
+            protobuf = final.protobuf4;
+          }
+        )).pulumi;
      pulumiTestHookShellcheck = testers.shellcheck {
        name = "pulumi-test-hook-shellcheck";
        src = ./extra/pulumi-test-hook.sh;
--- a/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-go/package.nix
@ -9,7 +9,7 @@ buildGoModule rec {

  sourceRoot = "${src.name}/sdk/go/pulumi-language-go";

-  vendorHash = "sha256-MqqkDuCAHsxyzcofufMSzf1TpntnMy+sNHhBY5vr+TE=";
+  vendorHash = "sha256-3I9Kh3Zqpu0gT0pQNzg2mMwxQUdhEpjITZOrO7Yt50A=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-nodejs/package.nix
@ -12,7 +12,7 @@ buildGoModule rec {

  sourceRoot = "${src.name}/sdk/nodejs/cmd/pulumi-language-nodejs";

-  vendorHash = "sha256-Blhbjc9nNj2ZDKs6uO/IZ5RuFJJTkS2wJF/7Egc7VvA=";
+  vendorHash = "sha256-UvfSmHWRFRZkmcgzUrLkqktQAt8ZlVDEzP6y+pxUOGc=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix
+++ b/pkgs/by-name/pu/pulumi/plugins/pulumi-python/package.nix
@ -12,7 +12,7 @@ buildGoModule rec {

  sourceRoot = "${src.name}/sdk/python/cmd/pulumi-language-python";

-  vendorHash = "sha256-x3dWYM8/2cWWhTmfGEDdrGHntqIDObYwQicSHIXr1rw=";
+  vendorHash = "sha256-5tr3mQ5x6jMOa9meHK6gaoRjNgLoHkWiTiaYXXqmUDo=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/q2/q2pro/package.nix
+++ b/pkgs/by-name/q2/q2pro/package.nix
@ -32,18 +32,18 @@

 stdenv.mkDerivation (finalAttrs: rec {
  pname = "q2pro";
-  version = "0-unstable-2025-03-26";
+  version = "0-unstable-2025-04-03";

  src = fetchFromGitHub {
    owner = "skullernet";
    repo = "q2pro";
-    rev = "7b63f040fdc37389ff4fde074aa24cecbc407f13";
-    hash = "sha256-qJvxMRsB7pkKZrM+zWxg+ftDkmABx+7qFA49VZdRFqY=";
+    rev = "0e00beedaa892fd5f6e50d33231978846ab2d5de";
+    hash = "sha256-xw09M7EtXJ7i6myj/Em0Rtg5CmZtpbyRWmkPhCApu7I=";
  };

  # build date and rev number is displayed in the game's console
-  revCount = "3732"; # git rev-list --count ${src.rev}
-  SOURCE_DATE_EPOCH = "1742939506"; # git show -s --format=%ct ${src.rev}
+  revCount = "3749"; # git rev-list --count ${src.rev}
+  SOURCE_DATE_EPOCH = "1743706497"; # git show -s --format=%ct ${src.rev}

  nativeBuildInputs =
    [
--- a/pkgs/by-name/si/signal-desktop-source/package.nix
+++ b/pkgs/by-name/si/signal-desktop-source/package.nix
@ -8,7 +8,6 @@
  makeWrapper,
  callPackage,
  fetchFromGitHub,
-  runCommand,
  jq,
  makeDesktopItem,
  copyDesktopItems,
@ -39,11 +38,6 @@ let
    .${stdenv.hostPlatform.parsed.cpu.name}
      or (throw "unsupported platform ${stdenv.hostPlatform.parsed.cpu.name}");

-  electron-headers = runCommand "electron-headers" { } ''
-    mkdir -p $out
-    tar -C $out --strip-components=1 -xvf ${electron.headers}
-  '';
-
  libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };

  webrtc = callPackage ./webrtc.nix { };
@ -179,7 +173,7 @@ stdenv.mkDerivation (finalAttrs: {
  buildPhase = ''
    runHook preBuild

-    export npm_config_nodedir=${electron-headers}
+    export npm_config_nodedir=${electron.headers}
    cp -r ${electron.dist} electron-dist
    chmod -R u+w electron-dist
    cp -r ${sticker-creator} sticker-creator/dist
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@ -3,17 +3,20 @@
  buildGoModule,
  fetchFromGitHub,
  testers,
+  replaceVars,
  spicetify-cli,
 }:
-
-buildGoModule rec {
-  pname = "spicetify-cli";
+let
  version = "2.39.6";
+in
+buildGoModule {
+  pname = "spicetify-cli";
+  inherit version;

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = "cli";
-    rev = "v${version}";
+    tag = "v${version}";
    hash = "sha256-rdyHVHKVgl9fOviFYQuXY8Ko+/XwpKlKDfriQAgkusE=";
  };

@ -24,28 +27,41 @@ buildGoModule rec {
    "-X 'main.version=${version}'"
  ];

-  # used at runtime, but not installed by default
-  postInstall = ''
-    mv $out/bin/cli $out/bin/spicetify
-    ln -s $out/bin/spicetify $out/bin/spicetify-cli
-    cp -r ${src}/jsHelper $out/bin/jsHelper
-    cp -r ${src}/CustomApps $out/bin/CustomApps
-    cp -r ${src}/Extensions $out/bin/Extensions
-    cp -r ${src}/Themes $out/bin/Themes
-  '';
+  patches = [
+    # Stops spicetify from attempting to fetch a newer css-map.json
+    (replaceVars ./version.patch {
+      inherit version;
+    })
+  ];

-  doInstallCheck = true;
-  installCheckPhase = ''
-    $out/bin/spicetify --help > /dev/null
-  '';
+  postInstall =
+    /*
+      jsHelper and css-map.json are required at runtime
+      and are looked for in the directory of the spicetify binary
+      so here we move spicetify to /share/spicetify
+      so that css-map.json and jsHelper don't pollute PATH
+    */
+    ''
+      mkdir -p $out/share/spicetify
+
+      cp -r $src/jsHelper $out/share/spicetify/jsHelper
+      cp $src/css-map.json $out/share/spicetify/css-map.json
+
+      mv $out/bin/cli $out/share/spicetify/spicetify
+
+      ln -s $out/share/spicetify/spicetify $out/bin/spicetify
+    '';

  passthru.tests.version = testers.testVersion { package = spicetify-cli; };

-  meta = with lib; {
+  meta = {
    description = "Command-line tool to customize Spotify client";
    homepage = "https://github.com/spicetify/cli";
-    license = licenses.gpl3Plus;
-    maintainers = [ maintainers.mdarocha ];
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      mdarocha
+      gerg-l
+    ];
    mainProgram = "spicetify";
  };
 }
--- a/pkgs/by-name/sp/spicetify-cli/version.patch
+++ b/pkgs/by-name/sp/spicetify-cli/version.patch
@ -0,0 +1,14 @@
+diff --git a/src/preprocess/preprocess.go b/src/preprocess/preprocess.go
+index ac0f084..f38ece2 100644
+--- a/src/preprocess/preprocess.go
+++ b/src/preprocess/preprocess.go
+@@ -66,7 +66,7 @@ func Start(version string, extractedAppsPath string, flags Flag) {
+ 	var cssTranslationMap = make(map[string]string)
+ 	// readSourceMapAndGenerateCSSMap(appPath)
+ 
+-	if version != "Dev" {
+	if version != "@version@" {
+ 		tag, err := FetchLatestTagMatchingOrMain(version)
+ 		if err != nil {
+ 			utils.PrintWarning("Cannot fetch version tag for CSS mappings")
+
--- a/pkgs/by-name/th/thepeg/package.nix
+++ b/pkgs/by-name/th/thepeg/package.nix
@ -51,11 +51,15 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  meta = with lib; {
+  meta = {
    description = "Toolkit for High Energy Physics Event Generation";
    homepage = "https://herwig.hepforge.org/";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ veprbl ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ veprbl ];
+    platforms = lib.platforms.unix;
+    badPlatforms = [
+      # ../include/ThePEG/Config/std.h:101:12: error: no member named 'mem_fun' in namespace 'std'; did you mean 'mem_fn'?
+      lib.systems.inspect.patterns.isDarwin
+    ];
  };
 }
--- a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
  # Include absolute paths to layer libraries in their associated
  # layer definition json files.
  preFixup = ''
-    for f in "$out"/etc/vulkan/explicit_layer.d/*.json "$out"/etc/vulkan/implicit_layer.d/*.json; do
+    for f in "$out"/share/vulkan/explicit_layer.d/*.json "$out"/share/vulkan/implicit_layer.d/*.json; do
      jq <"$f" >tmp.json ".layer.library_path = \"$out/lib/\" + .layer.library_path"
      mv tmp.json "$f"
    done
--- a/pkgs/by-name/wh/whoami/package.nix
+++ b/pkgs/by-name/wh/whoami/package.nix
@ -2,16 +2,18 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  nixosTests,
+  nix-update-script,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "whoami";
  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "traefik";
    repo = "whoami";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-3jzLdCmmts/7S1Oxig9Dg3kRGh/H5l5UD7ztev0yvXY=";
  };

@ -21,14 +23,29 @@ buildGoModule rec {

  env.CGO_ENABLED = 0;

-  doCheck = false;
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/whoami --help 2> /dev/null
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    tests = { inherit (nixosTests) whoami; };
+    updateScript = nix-update-script { };
+  };

  meta = {
    description = "Tiny Go server that prints os information and HTTP request to output";
    mainProgram = "whoami";
    homepage = "https://github.com/traefik/whoami";
-    changelog = "https://github.com/traefik/whoami/releases/tag/v${version}";
+    changelog = "https://github.com/traefik/whoami/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ dvcorreia ];
+    maintainers = with lib.maintainers; [
+      dvcorreia
+      defelo
+    ];
  };
-}
+})
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@ -95,10 +95,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/pop-os/xdg-desktop-portal-cosmic";
    description = "XDG Desktop Portal for the COSMIC Desktop Environment";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      nyabinary
-      HeitorAugustoLN
-    ];
+    maintainers = lib.teams.cosmic.members;
    mainProgram = "xdg-desktop-portal-cosmic";
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/xr/xrootd/package.nix
+++ b/pkgs/by-name/xr/xrootd/package.nix
@ -30,14 +30,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xrootd";
-  version = "5.7.1";
+  version = "5.8.0";

  src = fetchFromGitHub {
    owner = "xrootd";
    repo = "xrootd";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-ZU31nsQgs+Gz9mV8LVv4utJ7g8TXN5OxHjNDfQlt38M=";
+    hash = "sha256-i0gVKk2nFQQGxvUI2zqPWL82SFJdNglAuZ5gNdNhg2M=";
  };

  postPatch =
@ -46,6 +46,17 @@ stdenv.mkDerivation (finalAttrs: {
      substituteInPlace cmake/XRootDConfig.cmake.in \
        --replace-fail "@PACKAGE_CMAKE_INSTALL_" "@CMAKE_INSTALL_FULL_"
    ''
+    # Upstream started using an absolute path in an install's DESTINATION directive.
+    # This causes our build to fail in `fixupPhase` with:
+    #   Moving /nix/store/jbh4667k5zm74h9wv8y1j11x89cv6pnd-xrootd-5.8.0/include to /nix/store/6vnmipw8p1hc6cmkrsq9v1ay7j6iycq2-xrootd-5.8.0-dev/include
+    #   mv: cannot overwrite '/nix/store/6vnmipw8p1hc6cmkrsq9v1ay7j6iycq2-xrootd-5.8.0-dev/include/xrootd': Directory not empty
+    # Patch submitted upstream: https://github.com/xrootd/xrootd/pull/2478
+    + ''
+      substituteInPlace src/XrdPfc.cmake \
+        --replace-fail \
+        'DESTINATION ''${CMAKE_INSTALL_PREFIX}/include/xrootd/XrdPfc' \
+        'DESTINATION ''${CMAKE_INSTALL_INCLUDEDIR}/xrootd/XrdPfc'
+    ''
    + lib.optionalString stdenv.hostPlatform.isDarwin ''
      sed -i cmake/XRootDOSDefs.cmake -e '/set( MacOSX TRUE )/ainclude( GNUInstallDirs )'
    '';
--- a/pkgs/development/python-modules/bindep/default.nix
+++ b/pkgs/development/python-modules/bindep/default.nix
@ -3,10 +3,13 @@
  buildPythonPackage,
  distro,
  fetchPypi,
+  fixtures,
+  libredirect,
  packaging,
  parsley,
  pbr,
-  setuptools,
+  pytestCheckHook,
+  testtools,
 }:

 buildPythonPackage rec {
@ -23,7 +26,6 @@ buildPythonPackage rec {

  build-system = [
    pbr
-    setuptools
  ];

  dependencies = [
@ -33,8 +35,21 @@ buildPythonPackage rec {
    distro
  ];

-  # Checks moved to 'passthru.tests' to workaround infinite recursion
-  doCheck = false;
+  nativeCheckInputs = [
+    fixtures
+    libredirect.hook
+    pytestCheckHook
+    testtools
+  ];
+
+  preCheck = ''
+    echo "ID=nixos
+    " > os-release
+    export NIX_REDIRECTS=/etc/os-release=$(realpath os-release)
+    export PATH=$PATH:$out/bin
+  '';
+
+  pytestFlagsArray = [ "-s" ];

  pythonImportsCheck = [ "bindep" ];

--- a/pkgs/development/python-modules/pulumi/default.nix
+++ b/pkgs/development/python-modules/pulumi/default.nix
@ -70,9 +70,9 @@ buildPythonPackage {
  # https://github.com/pulumi/pulumi/blob/0acaf8060640fdd892abccf1ce7435cd6aae69fe/sdk/python/scripts/test_fast.sh#L16
  installCheckPhase = ''
    runHook preInstallCheck
-    ${python.executable} -m pytest --ignore=lib/test/automation lib/test
+    ${python.executable} -m pytest --junit-xml= --ignore=lib/test/automation lib/test
    pushd lib/test_with_mocks
-    ${python.executable} -m pytest
+    ${python.executable} -m pytest --junit-xml=
    popd
    runHook postInstallCheck
  '';
--- a/pkgs/development/python-modules/tableauserverclient/default.nix
+++ b/pkgs/development/python-modules/tableauserverclient/default.nix
@ -5,7 +5,6 @@
  fetchPypi,
  packaging,
  pytestCheckHook,
-  pythonOlder,
  requests,
  requests-mock,
  setuptools,
@ -18,18 +17,11 @@ buildPythonPackage rec {
  version = "0.37";
  pyproject = true;

-  disabled = pythonOlder "3.9";
-
  src = fetchPypi {
    inherit pname version;
    hash = "sha256-3jQtEuKABN0P2AmQ7NEKsabbokd73RIjFvbBpa52pfg=";
  };

-  postPatch = ''
-    # Remove vendorized versioneer
-    rm versioneer.py
-  '';
-
  pythonRelaxDeps = [
    "defusedxml"
    "urllib3"
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@ -3,6 +3,7 @@
  stdenv,
  makeWrapper,
  fetchurl,
+  fetchzip,
  wrapGAppsHook3,
  glib,
  gtk3,
@ -69,7 +70,8 @@ let

  headersFetcher =
    vers: hash:
-    fetchurl {
+    fetchzip {
+      name = "electron-${vers}-headers";
      url = "https://artifacts.electronjs.org/headers/dist/v${vers}/node-v${vers}-headers.tar.gz";
      sha256 = hash;
    };
--- a/pkgs/development/tools/electron/binary/info.json
+++ b/pkgs/development/tools/electron/binary/info.json
@ -4,7 +4,7 @@
            "aarch64-darwin": "67e5f8ce2c395b6b5a4c896ee1f2558b0003d0a54a7f4aef3b7760409ffc5825",
            "aarch64-linux": "6b18f435855284852be2b2c1b49e58df380a56784d78b358a13ea77bbace4a8a",
            "armv7l-linux": "a067329d55cc6648e9f783fd8b01b93da45ac21892b8096d758b30a87505c1a7",
-            "headers": "0pb06wlx5zz0asrh05c90q0np14c4swkvhzrcqmcyfz7ihczqh5a",
+            "headers": "13all8fl0zafswszd6lwlhd7bvflglawpglhwal68vliz5sz0p9a",
            "x86_64-darwin": "0499216feffc2ba56438d8c4ac89cf40117baee6335099f5b12457d339f465a6",
            "x86_64-linux": "0e1f1540492e48e3b8805f87c5096c3b99995c4c1b581ee57e9c836538bae813"
        },
@ -15,7 +15,7 @@
            "aarch64-darwin": "b1425938a053b47bdf1c3c28abd146defb7372a8e645adb0a2f2a9650ca6a36d",
            "aarch64-linux": "0f7350d2aa0d03b4e57aced4cc921a71fa15a0a5528ee463651771cb415e0381",
            "armv7l-linux": "153938fe15bf90e2ff6429d1f7db19144b01b8ec12a00a351fdb9fee56c585c3",
-            "headers": "1ji9mxjh2pigx1ldvp6m9ydlkcyvl6mrrpqsbvzvxd2spppzih0d",
+            "headers": "0gwin292x5ryx41kw0c801b4ipin9q1agnigdv31vcd4y0na2p3s",
            "x86_64-darwin": "38d247a3540650e21ee8d99a8e07b3c9f40439ad09cc176628adb2af948070f6",
            "x86_64-linux": "ae5cb348d7697f4acfb6d19dddc4ffc9fae1a687be5bee66684279a82fd8621b"
        },
@ -26,7 +26,7 @@
            "aarch64-darwin": "5a142772493b25ad22dda774a1d4da78887024adae8e83b0e74ad0ba64a7f55a",
            "aarch64-linux": "d22f1778894393414d7da01aa3f85d6f11f2cb5a5c7623d9d8339bcd824df4cb",
            "armv7l-linux": "29af72e24c74da70c85bfdce1ed6492b7efbe85f88cfb3da642844b51e5d7259",
-            "headers": "175n6wkz5gyj7plbjbcd6nkhbc108i2ng8ms2wvjya042mshzlqi",
+            "headers": "1jyc5riakfry5gmlcx7nmvl29iq6a01013k7zcfrcmijpkdw0p9z",
            "x86_64-darwin": "618156b4c923adcc2bf3d0a81d82dc874f27129893b7b3c349d0ca13651619e8",
            "x86_64-linux": "18ebcf0d2b681e273eb003ea0d77bb4fb91ed891f39778ad9c22b41972ed1975"
        },
@ -37,7 +37,7 @@
            "aarch64-darwin": "ad701bedd2b969eddad8676c8dfa69a21d18896ae58fbd7310a358dd21c7d0eb",
            "aarch64-linux": "a1a71be2bb826b59a1da726a59895025481ee335896c175fcffdc2fcfc432675",
            "armv7l-linux": "28186a0edb4e83c9d7afeb32923f26794d26c39f28a3706462a060d4b0e3bc5f",
-            "headers": "1y6d1nygfg6hdcjlzzgdz12hvh8j3xihhg9sg7p6fkmqkll4fyyb",
+            "headers": "1la2xfr8lyvq7dc4mxllj3qksrrwxmz3nc2fnr2h0l08bfn2y1ay",
            "x86_64-darwin": "858f17d67ea811711802b209d041cfca8caa14e6c8f0960de48df14892a0c632",
            "x86_64-linux": "ab6d4bceff76a070ebf3264ee516a3f96a040947f462d26ba202aa754e54d852"
        },
--- a/pkgs/development/tools/electron/binary/update.py
+++ b/pkgs/development/tools/electron/binary/update.py
@ -81,6 +81,7 @@ def get_headers(version: str) -> str:
        called_process: subprocess.CompletedProcess = subprocess.run(
            [
                "nix-prefetch-url",
+                "--unpack",
                f"https://artifacts.electronjs.org/headers/dist/v{version}/node-v{version}-headers.tar.gz",
            ],
            capture_output=True,
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@ -10,7 +10,6 @@
  yarn,
  libnotify,
  unzip,
-  pkgs,
  pkgsBuildHost,
  pipewire,
  libsecret,
@ -37,6 +36,9 @@ in
    "headers"
  ];

+  # don't automatically move the include directory from $headers back into $out
+  moveToDev = false;
+
  nativeBuildInputs = base.nativeBuildInputs ++ [
    nodejs
    yarn
@ -221,11 +223,8 @@ in
    mkdir -p $libExecPath
    unzip -d $libExecPath out/Release/dist.zip

-    # Create reproducible tarball, per instructions at https://reproducible-builds.org/docs/archives/
-    tar --sort=name \
-      --mtime="@$SOURCE_DATE_EPOCH" \
-      --owner=0 --group=0 --numeric-owner \
-      -czf $headers -C out/Release/gen node_headers
+    mkdir -p $headers
+    cp -r out/Release/gen/node_headers/* $headers/

    runHook postInstall
  '';
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@ -54,20 +54,20 @@ let
 in
 {
  nextcloud29 = generic {
-    version = "29.0.14";
-    hash = "sha256-mjMuAywSnD6Sp6EBkktfJnsJNvaJdJxF0DE0PIikavs=";
+    version = "29.0.15";
+    hash = "sha256-iqvCDILYxxJk7oxAmXaaBbwzUWKAAd5aNHAswRKBfMA=";
    packages = nextcloud29Packages;
  };

  nextcloud30 = generic {
-    version = "30.0.8";
-    hash = "sha256-uwhqES+zUW50SSHXrhSCzBvVN+39HxQFHBNI1LatWKI=";
+    version = "30.0.9";
+    hash = "sha256-gkWL1whsCCqHrR8UldkjuJ4jMRCajZXosA5jm70OHxY=";
    packages = nextcloud30Packages;
  };

  nextcloud31 = generic {
-    version = "31.0.2";
-    hash = "sha256-ALVyERt8K5iELZXARt5570Y8z63IoEtUAGx4bh+UwxA=";
+    version = "31.0.3";
+    hash = "sha256-koOuvY/aWtc5zaVvfKuqg1zDv5j3lTbDbczXMJ4rMFo=";
    packages = nextcloud31Packages;
  };

--- a/pkgs/servers/nextcloud/packages/29.json
+++ b/pkgs/servers/nextcloud/packages/29.json
@ -70,9 +70,9 @@
    ]
  },
  "deck": {
-    "hash": "sha256-kDo4L6RlJDbxNbbFrnz0cxuYAuTLvC3shMi0G3IADTw=",
-    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.13.4/deck-v1.13.4.tar.gz",
-    "version": "1.13.4",
+    "hash": "sha256-n+d5WdVuXJIyor/Ko5tVd5r7ew6Htn/spu5g6jv06NY=",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.13.5/deck-v1.13.5.tar.gz",
+    "version": "1.13.5",
    "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
    "homepage": "https://github.com/nextcloud/deck",
    "licenses": [
@ -120,9 +120,9 @@
    ]
  },
  "forms": {
-    "hash": "sha256-0CqZmvjILDNdDMoI8H9H0uphXOkLavTvXpSsoeBP6fk=",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.3.10/forms-v4.3.10.tar.gz",
-    "version": "4.3.10",
+    "hash": "sha256-5UWL9ePH6sdfrVcjAN+vP5cTkWGj1O1/5fx7UmyT92I=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v4.3.12/forms-v4.3.12.tar.gz",
+    "version": "4.3.12",
    "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
    "homepage": "https://github.com/nextcloud/forms",
    "licenses": [
@ -220,9 +220,9 @@
    ]
  },
  "music": {
-    "hash": "sha256-lqWdzi41YZfd8eH8l8Dm46XzgoZJ2CPV3+hzlNyd+v8=",
-    "url": "https://github.com/owncloud/music/releases/download/v2.1.3/music_2.1.3_for_nextcloud.tar.gz",
-    "version": "2.1.3",
+    "hash": "sha256-h83Xc292/NQPWOTRIbUSgqHUH/Sp4fYJ8GAHSiJWHP0=",
+    "url": "https://github.com/owncloud/music/releases/download/v2.1.4/music_2.1.4_for_nextcloud.tar.gz",
+    "version": "2.1.4",
    "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Advanced search to freely use and combine dozens of search criteria\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on dozens of external apps on Android, iOS, Windows, Linux, etc.\n- Widget for the Nextcloud Dashboard",
    "homepage": "https://github.com/owncloud/music",
    "licenses": [
@ -260,9 +260,9 @@
    ]
  },
  "onlyoffice": {
-    "hash": "sha256-Bh0CGw0qdJI+NzJ/dmzoqSZdVYzcFbqSJa70gvZhDGs=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.7.0/onlyoffice.tar.gz",
-    "version": "9.7.0",
+    "hash": "sha256-lOkVGOo2ylTaRVDFGD31DMUb3IbteWgFkHEj0Ox0D84=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.8.0/onlyoffice.tar.gz",
+    "version": "9.8.0",
    "description": "ONLYOFFICE app allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
    "homepage": "https://www.onlyoffice.com",
    "licenses": [
@ -280,9 +280,9 @@
    ]
  },
  "polls": {
-    "hash": "sha256-fnZT4iuwlD66AVwiNPE0yurszO5/9IQsJfA1OB/dEVU=",
-    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.4.1/polls-v7.4.1.tar.gz",
-    "version": "7.4.1",
+    "hash": "sha256-zatPm8JY1WkeO2Uvm9BUVPXrJp0df12jspqSNNuZVh0=",
+    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.4.2/polls-v7.4.2.tar.gz",
+    "version": "7.4.2",
    "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
    "homepage": "https://github.com/nextcloud/polls",
    "licenses": [
@ -320,9 +320,9 @@
    ]
  },
  "registration": {
-    "hash": "sha256-1Y1mZWqaJu8Xtwbo8ziqzzdszNNoiWJLO3Sy5Ko7rys=",
-    "url": "https://github.com/nextcloud-releases/registration/releases/download/v2.6.0/registration-v2.6.0.tar.gz",
-    "version": "2.6.0",
+    "hash": "sha256-iskmm8s32Nj65dyhx1ZO/Rg6fPi+usF/O/dYou+Ujjk=",
+    "url": "https://github.com/nextcloud-releases/registration/releases/download/v2.7.0/registration-v2.7.0.tar.gz",
+    "version": "2.7.0",
    "description": "User registration\n\nThis app allows users to register a new account.\n\n# Features\n\n- Add users to a given group\n- Allow-list with email domains (including wildcard) to register with\n- Administrator will be notified via email for new user creation or require approval\n- Supports Nextcloud's Client Login Flow v1 and v2 - allowing registration in the mobile Apps and Desktop clients\n\n# Web form registration flow\n\n1. User enters their email address\n2. Verification link is sent to the email address\n3. User clicks on the verification link\n4. User is lead to a form where they can choose their username and password\n5. New account is created and is logged in automatically",
    "homepage": "https://github.com/nextcloud/registration",
    "licenses": [
@ -350,9 +350,9 @@
    ]
  },
  "spreed": {
-    "hash": "sha256-Wu228AT3cRcHZs1yk14LK8s/Rhpzhzl/qnZl2ZcL6qU=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v19.0.14/spreed-v19.0.14.tar.gz",
-    "version": "19.0.14",
+    "hash": "sha256-j+TPhm7JO23wTVTcyEYXVKrrJcGIMDute3ANjmbscMg=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v19.0.15/spreed-v19.0.15.tar.gz",
+    "version": "19.0.15",
    "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
    "homepage": "https://github.com/nextcloud/spreed",
    "licenses": [
--- a/pkgs/servers/nextcloud/packages/30.json
+++ b/pkgs/servers/nextcloud/packages/30.json
@ -20,9 +20,9 @@
    ]
  },
  "calendar": {
-    "hash": "sha256-mAH/A5oiPwIh6K6bb9wd55CmqMoEAaKQVVr8zFNbXE8=",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v5.2.0/calendar-v5.2.0.tar.gz",
-    "version": "5.2.0",
+    "hash": "sha256-tzlJJsP3uDA57LuOtfbYjd5yu2fkEunTqDM90LxVgnI=",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v5.2.1/calendar-v5.2.1.tar.gz",
+    "version": "5.2.1",
    "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 Search! Find your events at ease\n* ☑️ Tasks! See tasks with a due date directly in the calendar\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
    "homepage": "https://github.com/nextcloud/calendar/",
    "licenses": [
@ -40,9 +40,9 @@
    ]
  },
  "contacts": {
-    "hash": "sha256-aBrbzXKWb3QzeBLWPR/4rWeM40haBiEQB9gFUNT3q/A=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.0.4/contacts-v7.0.4.tar.gz",
-    "version": "7.0.4",
+    "hash": "sha256-suiKZfa+nL9xMFkkZwlrrGiicoIf5zyxpNXS3q7nCC8=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.0.5/contacts-v7.0.5.tar.gz",
+    "version": "7.0.5",
    "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
    "homepage": "https://github.com/nextcloud/contacts#readme",
    "licenses": [
@ -120,9 +120,9 @@
    ]
  },
  "forms": {
-    "hash": "sha256-WA2sj3zjf0XuLbSaT9AZkgLYab9O2wVUIazeJXrMAxs=",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.0.4/forms-v5.0.4.tar.gz",
-    "version": "5.0.4",
+    "hash": "sha256-t4/1Rq99VH+g43zLcms5P714bSYv5h6RTaI4Q7jvD+Y=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.1.0/forms-v5.1.0.tar.gz",
+    "version": "5.1.0",
    "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
    "homepage": "https://github.com/nextcloud/forms",
    "licenses": [
@ -190,9 +190,9 @@
    ]
  },
  "mail": {
-    "hash": "sha256-pqZmLPR01a1l3QCMo97yS6tpY8gwkDoZcMOvmHGE5Q0=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.3.3/mail-v4.3.3.tar.gz",
-    "version": "4.3.3",
+    "hash": "sha256-PeDfYIaU1HNONCI/aNwsMv0gBUArATj/dXKUW52ejW8=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.3.6/mail-v4.3.6.tar.gz",
+    "version": "4.3.6",
    "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
    "homepage": "https://github.com/nextcloud/mail#readme",
    "licenses": [
@ -220,9 +220,9 @@
    ]
  },
  "music": {
-    "hash": "sha256-lqWdzi41YZfd8eH8l8Dm46XzgoZJ2CPV3+hzlNyd+v8=",
-    "url": "https://github.com/owncloud/music/releases/download/v2.1.3/music_2.1.3_for_nextcloud.tar.gz",
-    "version": "2.1.3",
+    "hash": "sha256-h83Xc292/NQPWOTRIbUSgqHUH/Sp4fYJ8GAHSiJWHP0=",
+    "url": "https://github.com/owncloud/music/releases/download/v2.1.4/music_2.1.4_for_nextcloud.tar.gz",
+    "version": "2.1.4",
    "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Advanced search to freely use and combine dozens of search criteria\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on dozens of external apps on Android, iOS, Windows, Linux, etc.\n- Widget for the Nextcloud Dashboard",
    "homepage": "https://github.com/owncloud/music",
    "licenses": [
@ -260,9 +260,9 @@
    ]
  },
  "onlyoffice": {
-    "hash": "sha256-Bh0CGw0qdJI+NzJ/dmzoqSZdVYzcFbqSJa70gvZhDGs=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.7.0/onlyoffice.tar.gz",
-    "version": "9.7.0",
+    "hash": "sha256-lOkVGOo2ylTaRVDFGD31DMUb3IbteWgFkHEj0Ox0D84=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.8.0/onlyoffice.tar.gz",
+    "version": "9.8.0",
    "description": "ONLYOFFICE app allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
    "homepage": "https://www.onlyoffice.com",
    "licenses": [
@ -280,9 +280,9 @@
    ]
  },
  "polls": {
-    "hash": "sha256-fnZT4iuwlD66AVwiNPE0yurszO5/9IQsJfA1OB/dEVU=",
-    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.4.1/polls-v7.4.1.tar.gz",
-    "version": "7.4.1",
+    "hash": "sha256-zatPm8JY1WkeO2Uvm9BUVPXrJp0df12jspqSNNuZVh0=",
+    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.4.2/polls-v7.4.2.tar.gz",
+    "version": "7.4.2",
    "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
    "homepage": "https://github.com/nextcloud/polls",
    "licenses": [
@ -320,9 +320,9 @@
    ]
  },
  "registration": {
-    "hash": "sha256-1Y1mZWqaJu8Xtwbo8ziqzzdszNNoiWJLO3Sy5Ko7rys=",
-    "url": "https://github.com/nextcloud-releases/registration/releases/download/v2.6.0/registration-v2.6.0.tar.gz",
-    "version": "2.6.0",
+    "hash": "sha256-iskmm8s32Nj65dyhx1ZO/Rg6fPi+usF/O/dYou+Ujjk=",
+    "url": "https://github.com/nextcloud-releases/registration/releases/download/v2.7.0/registration-v2.7.0.tar.gz",
+    "version": "2.7.0",
    "description": "User registration\n\nThis app allows users to register a new account.\n\n# Features\n\n- Add users to a given group\n- Allow-list with email domains (including wildcard) to register with\n- Administrator will be notified via email for new user creation or require approval\n- Supports Nextcloud's Client Login Flow v1 and v2 - allowing registration in the mobile Apps and Desktop clients\n\n# Web form registration flow\n\n1. User enters their email address\n2. Verification link is sent to the email address\n3. User clicks on the verification link\n4. User is lead to a form where they can choose their username and password\n5. New account is created and is logged in automatically",
    "homepage": "https://github.com/nextcloud/registration",
    "licenses": [
@ -330,9 +330,9 @@
    ]
  },
  "richdocuments": {
-    "hash": "sha256-A+d3fHOrna0DR4hbB6nn8NwLzZqxXErXkj2Npzvi+Ls=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.5.5/richdocuments-v8.5.5.tar.gz",
-    "version": "8.5.5",
+    "hash": "sha256-4J4tEwwVjSUgJa6A1Luz8u0x8wjlkA6nukaqtt1VOZc=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.5.6/richdocuments-v8.5.6.tar.gz",
+    "version": "8.5.6",
    "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
    "homepage": "https://collaboraoffice.com/",
    "licenses": [
@ -350,9 +350,9 @@
    ]
  },
  "spreed": {
-    "hash": "sha256-Ld/1UKhch7QYsfxGHpcjviGPna3moMsLCOMOGi937SI=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v20.1.5/spreed-v20.1.5.tar.gz",
-    "version": "20.1.5",
+    "hash": "sha256-KldJD49vxL1cRxsS8eOXTc0uYfj8ctChEwYMKicfJgY=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v20.1.6/spreed-v20.1.6.tar.gz",
+    "version": "20.1.6",
    "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
    "homepage": "https://github.com/nextcloud/spreed",
    "licenses": [
--- a/pkgs/servers/nextcloud/packages/31.json
+++ b/pkgs/servers/nextcloud/packages/31.json
@ -20,9 +20,9 @@
    ]
  },
  "calendar": {
-    "hash": "sha256-mAH/A5oiPwIh6K6bb9wd55CmqMoEAaKQVVr8zFNbXE8=",
-    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v5.2.0/calendar-v5.2.0.tar.gz",
-    "version": "5.2.0",
+    "hash": "sha256-tzlJJsP3uDA57LuOtfbYjd5yu2fkEunTqDM90LxVgnI=",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v5.2.1/calendar-v5.2.1.tar.gz",
+    "version": "5.2.1",
    "description": "The Calendar app is a user interface for Nextcloud's CalDAV server. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Contacts - more to come.\n* 🌐 **WebCal Support!** Want to see your favorite team’s matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚️ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 Search! Find your events at ease\n* ☑️ Tasks! See tasks with a due date directly in the calendar\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
    "homepage": "https://github.com/nextcloud/calendar/",
    "licenses": [
@ -40,9 +40,9 @@
    ]
  },
  "contacts": {
-    "hash": "sha256-aBrbzXKWb3QzeBLWPR/4rWeM40haBiEQB9gFUNT3q/A=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.0.4/contacts-v7.0.4.tar.gz",
-    "version": "7.0.4",
+    "hash": "sha256-suiKZfa+nL9xMFkkZwlrrGiicoIf5zyxpNXS3q7nCC8=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v7.0.5/contacts-v7.0.5.tar.gz",
+    "version": "7.0.5",
    "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
    "homepage": "https://github.com/nextcloud/contacts#readme",
    "licenses": [
@ -120,9 +120,9 @@
    ]
  },
  "forms": {
-    "hash": "sha256-WA2sj3zjf0XuLbSaT9AZkgLYab9O2wVUIazeJXrMAxs=",
-    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.0.4/forms-v5.0.4.tar.gz",
-    "version": "5.0.4",
+    "hash": "sha256-t4/1Rq99VH+g43zLcms5P714bSYv5h6RTaI4Q7jvD+Y=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.1.0/forms-v5.1.0.tar.gz",
+    "version": "5.1.0",
    "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
    "homepage": "https://github.com/nextcloud/forms",
    "licenses": [
@ -190,9 +190,9 @@
    ]
  },
  "mail": {
-    "hash": "sha256-pqZmLPR01a1l3QCMo97yS6tpY8gwkDoZcMOvmHGE5Q0=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.3.3/mail-v4.3.3.tar.gz",
-    "version": "4.3.3",
+    "hash": "sha256-PeDfYIaU1HNONCI/aNwsMv0gBUArATj/dXKUW52ejW8=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v4.3.6/mail-v4.3.6.tar.gz",
+    "version": "4.3.6",
    "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
    "homepage": "https://github.com/nextcloud/mail#readme",
    "licenses": [
@ -210,9 +210,9 @@
    ]
  },
  "music": {
-    "hash": "sha256-lqWdzi41YZfd8eH8l8Dm46XzgoZJ2CPV3+hzlNyd+v8=",
-    "url": "https://github.com/owncloud/music/releases/download/v2.1.3/music_2.1.3_for_nextcloud.tar.gz",
-    "version": "2.1.3",
+    "hash": "sha256-h83Xc292/NQPWOTRIbUSgqHUH/Sp4fYJ8GAHSiJWHP0=",
+    "url": "https://github.com/owncloud/music/releases/download/v2.1.4/music_2.1.4_for_nextcloud.tar.gz",
+    "version": "2.1.4",
    "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from m3u, m3u8, and pls files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Advanced search to freely use and combine dozens of search criteria\n- Play internet radio and podcast channels\n- Setup Last.fm connection to see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on dozens of external apps on Android, iOS, Windows, Linux, etc.\n- Widget for the Nextcloud Dashboard",
    "homepage": "https://github.com/owncloud/music",
    "licenses": [
@ -250,9 +250,9 @@
    ]
  },
  "onlyoffice": {
-    "hash": "sha256-Bh0CGw0qdJI+NzJ/dmzoqSZdVYzcFbqSJa70gvZhDGs=",
-    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.7.0/onlyoffice.tar.gz",
-    "version": "9.7.0",
+    "hash": "sha256-lOkVGOo2ylTaRVDFGD31DMUb3IbteWgFkHEj0Ox0D84=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v9.8.0/onlyoffice.tar.gz",
+    "version": "9.8.0",
    "description": "ONLYOFFICE app allows you to view, edit and collaborate on text documents, spreadsheets and presentations within Nextcloud using ONLYOFFICE Docs. This will create a new Edit in ONLYOFFICE action within the document library for Office documents. This allows multiple users to co-author documents in real time from the familiar web interface and save the changes back to your file storage.",
    "homepage": "https://www.onlyoffice.com",
    "licenses": [
@ -270,9 +270,9 @@
    ]
  },
  "polls": {
-    "hash": "sha256-fnZT4iuwlD66AVwiNPE0yurszO5/9IQsJfA1OB/dEVU=",
-    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.4.1/polls-v7.4.1.tar.gz",
-    "version": "7.4.1",
+    "hash": "sha256-zatPm8JY1WkeO2Uvm9BUVPXrJp0df12jspqSNNuZVh0=",
+    "url": "https://github.com/nextcloud-releases/polls/releases/download/v7.4.2/polls-v7.4.2.tar.gz",
+    "version": "7.4.2",
    "description": "A polls app, similar to Doodle/Dudle with the possibility to restrict access (members, certain groups/users, hidden and public).",
    "homepage": "https://github.com/nextcloud/polls",
    "licenses": [
@ -310,9 +310,9 @@
    ]
  },
  "registration": {
-    "hash": "sha256-1Y1mZWqaJu8Xtwbo8ziqzzdszNNoiWJLO3Sy5Ko7rys=",
-    "url": "https://github.com/nextcloud-releases/registration/releases/download/v2.6.0/registration-v2.6.0.tar.gz",
-    "version": "2.6.0",
+    "hash": "sha256-iskmm8s32Nj65dyhx1ZO/Rg6fPi+usF/O/dYou+Ujjk=",
+    "url": "https://github.com/nextcloud-releases/registration/releases/download/v2.7.0/registration-v2.7.0.tar.gz",
+    "version": "2.7.0",
    "description": "User registration\n\nThis app allows users to register a new account.\n\n# Features\n\n- Add users to a given group\n- Allow-list with email domains (including wildcard) to register with\n- Administrator will be notified via email for new user creation or require approval\n- Supports Nextcloud's Client Login Flow v1 and v2 - allowing registration in the mobile Apps and Desktop clients\n\n# Web form registration flow\n\n1. User enters their email address\n2. Verification link is sent to the email address\n3. User clicks on the verification link\n4. User is lead to a form where they can choose their username and password\n5. New account is created and is logged in automatically",
    "homepage": "https://github.com/nextcloud/registration",
    "licenses": [
@ -320,9 +320,9 @@
    ]
  },
  "richdocuments": {
-    "hash": "sha256-/Qj9P9QZO2GLD/dZTsx++wgCT+8b13lJ67UGdkTnI2s=",
-    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.6.3/richdocuments-v8.6.3.tar.gz",
-    "version": "8.6.3",
+    "hash": "sha256-jwwp3nnHxxO31dNwfv4OG6sPmTO2VmnFzNxylMVNVYo=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v8.6.4/richdocuments-v8.6.4.tar.gz",
+    "version": "8.6.4",
    "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
    "homepage": "https://collaboraoffice.com/",
    "licenses": [
@ -340,9 +340,9 @@
    ]
  },
  "spreed": {
-    "hash": "sha256-ztc0u9lYd5rZmzFPt1J4fmSBP3ZINswTaqVr4QZtidQ=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v21.0.1/spreed-v21.0.1.tar.gz",
-    "version": "21.0.1",
+    "hash": "sha256-lNct7bAJ7uyucSUvBwcDf3lPJiKx3N2k7+fi5Y5xLqg=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v21.0.2/spreed-v21.0.2.tar.gz",
+    "version": "21.0.2",
    "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
    "homepage": "https://github.com/nextcloud/spreed",
    "licenses": [
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -15387,9 +15387,7 @@ self: super: with self; {

  scikit-image = callPackage ../development/python-modules/scikit-image { };

-  scikit-learn = callPackage ../development/python-modules/scikit-learn {
-    inherit (pkgs) gfortran glibcLocales;
-  };
+  scikit-learn = callPackage ../development/python-modules/scikit-learn { };

  scikit-learn-extra = callPackage ../development/python-modules/scikit-learn-extra { };