From 1216c5fd958c1445c2c7aac46f9f806a5fd51af2 Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Tue, 23 Sep 2025 11:16:12 +0200
Subject: [PATCH 01/35] electron{,-bin,-chromedriver}: 37 -> 38

---
 pkgs/top-level/all-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0aa6e787e188..a651e50155c1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6436,9 +6436,9 @@ with pkgs;
       electron-source.electron_38
     else
       electron_38-bin;
-  electron = electron_37;
-  electron-bin = electron_37-bin;
-  electron-chromedriver = electron-chromedriver_37;
+  electron = electron_38;
+  electron-bin = electron_38-bin;
+  electron-chromedriver = electron-chromedriver_38;
 
   autoconf = callPackage ../development/tools/misc/autoconf { };
   autoconf269 = callPackage ../development/tools/misc/autoconf/2.69.nix { };

From 26ee2478319fbc2b1220087e0f034b8c9861c58d Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Thu, 25 Sep 2025 17:55:56 +0200
Subject: [PATCH 02/35] penpot-desktop: pin electron to electron_37

Currently does not build with electron_38
---
 pkgs/by-name/pe/penpot-desktop/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pe/penpot-desktop/package.nix b/pkgs/by-name/pe/penpot-desktop/package.nix
index 3c691db155ea..c2a9a1d8ae82 100644
--- a/pkgs/by-name/pe/penpot-desktop/package.nix
+++ b/pkgs/by-name/pe/penpot-desktop/package.nix
@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   copyDesktopItems,
-  electron,
+  electron_37,
   fetchFromGitHub,
   jq,
   makeDesktopItem,
@@ -15,6 +15,7 @@ let
   description = "Unofficial desktop application for the open-source design tool, Penpot";
   icon = "penpot";
   nodejs = nodejs_24;
+  electron = electron_37;
 in
 buildNpmPackage rec {
   pname = "penpot-desktop";

From 0579b9d14617c03f9138ff5eafbef11ada2f1e8b Mon Sep 17 00:00:00 2001
From: SkohTV <contact@skoh.dev>
Date: Fri, 10 Oct 2025 13:56:32 -0400
Subject: [PATCH 03/35] apfs-fuse: fix cmake 4 compatibility

---
 pkgs/by-name/ap/apfs-fuse/cmake-v4.patch | 18 ++++++++++++++++++
 pkgs/by-name/ap/apfs-fuse/package.nix    |  6 ++++++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/by-name/ap/apfs-fuse/cmake-v4.patch

diff --git a/pkgs/by-name/ap/apfs-fuse/cmake-v4.patch b/pkgs/by-name/ap/apfs-fuse/cmake-v4.patch
new file mode 100644
index 000000000000..cfad91543d87
--- /dev/null
+++ b/pkgs/by-name/ap/apfs-fuse/cmake-v4.patch
@@ -0,0 +1,18 @@
+From 523ef46031f0d805a651d95e3b193f73acc824ef Mon Sep 17 00:00:00 2001
+From: Skoh <101289702+SkohTV@users.noreply.github.com>
+Date: Fri, 10 Oct 2025 13:53:13 -0400
+Subject: [PATCH] Increase cmake_minimum_required: 3.0 -> 3.10
+
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 03acf26..84370f0 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 3.0)
++cmake_minimum_required(VERSION 3.0...3.10)
+ # set(CMAKE_C_COMPILER "clang")
+ # set(CMAKE_CXX_COMPILER "clang++")
diff --git a/pkgs/by-name/ap/apfs-fuse/package.nix b/pkgs/by-name/ap/apfs-fuse/package.nix
index 48f1a4243a03..4baa335c315c 100644
--- a/pkgs/by-name/ap/apfs-fuse/package.nix
+++ b/pkgs/by-name/ap/apfs-fuse/package.nix
@@ -22,6 +22,12 @@ stdenv.mkDerivation {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # fix for CMake v4
+    # https://github.com/sgan81/apfs-fuse/pull/211
+    ./cmake-v4.patch
+  ];
+
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace CMakeLists.txt \
       --replace "/usr/local/lib/libosxfuse.dylib" "fuse"

From f23f57ef3cdb49fb34594ab3166e9e92e00f0067 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Oct 2025 02:34:03 +0000
Subject: [PATCH 04/35] ansel: 0-unstable-2025-10-04 -> 0-unstable-2025-10-07

---
 pkgs/by-name/an/ansel/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/an/ansel/package.nix b/pkgs/by-name/an/ansel/package.nix
index 7a9e430b4f51..b38642dc3616 100644
--- a/pkgs/by-name/an/ansel/package.nix
+++ b/pkgs/by-name/an/ansel/package.nix
@@ -82,13 +82,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "0-unstable-2025-10-04";
+  version = "0-unstable-2025-10-07";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "dd5b73cd78d32618aca3f81a041e45c8d2adcece";
-    hash = "sha256-x8glXiweW1/mzPjGrGRDeCHIG1GqbjvEmAM4sEhor14=";
+    rev = "486d5585f3a3fe2075f2903f5b2e36518dd82e37";
+    hash = "sha256-jXTxgStRsp8+Z7JLtwI6+OLd0n/wX58Mxg1dbzDb0p0=";
     fetchSubmodules = true;
   };
 

From be38e0ab5974b973086c5ea572f7be13a193aa14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Chocholat=C3=BD?= <chocholaty.david@protonmail.com>
Date: Wed, 1 Oct 2025 19:59:47 +0200
Subject: [PATCH 05/35] maintainers: add dzervas

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f55f28805d45..154cef7c9328 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7157,6 +7157,12 @@
     githubId = 15128988;
     name = "Maksim Dzabraev";
   };
+  dzervas = {
+    name = "Dimitris Zervas";
+    email = "dzervas@dzervas.gr";
+    github = "dzervas";
+    githubId = 1029195;
+  };
   dzmitry-lahoda = {
     email = "dzmitry@lahoda.pro";
     github = "dzmitry-lahoda";

From cc72d3a8c01b98ac0ad7cee5533232718f6335ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Chocholat=C3=BD?= <chocholaty.david@protonmail.com>
Date: Mon, 6 Oct 2025 07:55:42 +0200
Subject: [PATCH 06/35] maintainers: add randoneering

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 154cef7c9328..fc8ab0a28b1b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21441,6 +21441,12 @@
     github = "randomdude16671";
     githubId = 210965013;
   };
+  randoneering = {
+    name = "randoneering";
+    email = "justin@randoneering.tech";
+    github = "randoneering";
+    githubId = 127273550;
+  };
   rane = {
     name = "Rane";
     email = "rane+git@junkyard.systems";

From a75588c6c505e6dc71b40154286f13601218ab0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Chocholat=C3=BD?= <chocholaty.david@protonmail.com>
Date: Wed, 1 Oct 2025 19:59:47 +0200
Subject: [PATCH 07/35] atuin-desktop: init at 0.1.3

---
 pkgs/by-name/at/atuin-desktop/package.nix | 89 +++++++++++++++++++++++
 1 file changed, 89 insertions(+)
 create mode 100644 pkgs/by-name/at/atuin-desktop/package.nix

diff --git a/pkgs/by-name/at/atuin-desktop/package.nix b/pkgs/by-name/at/atuin-desktop/package.nix
new file mode 100644
index 000000000000..a99683d663ac
--- /dev/null
+++ b/pkgs/by-name/at/atuin-desktop/package.nix
@@ -0,0 +1,89 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  wrapGAppsHook4,
+  nix-update-script,
+
+  cargo-tauri,
+  nodejs,
+  pkg-config,
+  pnpm,
+
+  glib-networking,
+  libappindicator-gtk3,
+  openssl,
+  webkitgtk_4_1,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "atuin-desktop";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "atuinsh";
+    repo = "desktop";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-woYWWDJ2JeyghlRh5IKhPfDy4WmcAGlBJgjBPg1hHq8=";
+  };
+
+  cargoRoot = "backend";
+  buildAndTestSubdir = finalAttrs.cargoRoot;
+  cargoHash = "sha256-tyN9gM8U8kOl62Z0N/plcpTOCbOPuT0kkLI/EKLv/mQ=";
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    fetcherVersion = 2;
+    hash = "sha256-y+WZF30R/+nvAVr50SWmMN5kfVb1kYiylAd1IBftoVA=";
+  };
+
+  nativeBuildInputs = [
+    cargo-tauri.hook
+    pnpm.configHook
+
+    nodejs
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ wrapGAppsHook4 ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    glib-networking
+    libappindicator-gtk3
+    openssl
+    webkitgtk_4_1
+  ];
+
+  env = {
+    # Used upstream: https://github.com/atuinsh/desktop/blob/2f9a90963c4a6299bf35d8a49b0a2ffb8a28ee32/.envrc.
+    NODE_OPTIONS = "--max-old-space-size=5120";
+  };
+
+  # Otherwise tauri will look for a private key we don't have.
+  tauriConf = builtins.toJSON { bundle.createUpdaterArtifacts = false; };
+  passAsFile = [ "tauriConf" ];
+  preBuild = ''
+    npm rebuild ts-tiny-activerecord
+    tauriBuildFlags+=(
+      "--config"
+      "$tauriConfPath"
+    )
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Local-first, executable runbook editor";
+    homepage = "https://atuin.sh";
+    downloadPage = "https://github.com/atuinsh/desktop";
+    changelog = "https://github.com/atuinsh/desktop/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      adda
+      dzervas
+      randoneering
+    ];
+    mainProgram = "atuin-desktop";
+    platforms = with lib.platforms; windows ++ darwin ++ linux;
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+})

From ffe2533248d0591744cca9eaa52b6c8e3dde917c Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Sun, 12 Oct 2025 23:09:20 +0400
Subject: [PATCH 08/35] direwolf: fix build with cmake 4

---
 pkgs/applications/radio/direwolf/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/applications/radio/direwolf/default.nix b/pkgs/applications/radio/direwolf/default.nix
index 487b96445f79..ef11484bb423 100644
--- a/pkgs/applications/radio/direwolf/default.nix
+++ b/pkgs/applications/radio/direwolf/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   alsa-lib,
   gpsd,
@@ -28,6 +29,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-Vbxc6a6CK+wrBfs15dtjfRa1LJDKKyHMrg8tqsF7EX4=";
   };
 
+  patches = [
+    # Fix the build with CMake 4.
+    (fetchpatch {
+      url = "https://github.com/wb2osz/direwolf/commit/c499496bbc237d0efdcacec5786607f5e17c1c7e.patch";
+      hash = "sha256-/gKi5dswMQM2nGHS3P72gAcHaT0nEF9O91heF8xmy2Y=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     udevCheckHook

From 60aa42accf2dd7a7195b7f64127033ec9cbfcf94 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Sun, 12 Oct 2025 23:54:54 +0200
Subject: [PATCH 09/35] aspcud: fix build with cmake4

---
 pkgs/by-name/as/aspcud/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/as/aspcud/package.nix b/pkgs/by-name/as/aspcud/package.nix
index 4c72083c2c76..85219aa1b1be 100644
--- a/pkgs/by-name/as/aspcud/package.nix
+++ b/pkgs/by-name/as/aspcud/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   boost,
   catch2,
   cmake,
@@ -20,6 +21,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-PdRfpmH7zF5dn+feoijtzdSUjaYhjHwyAUfuYoWCL9E=";
   };
 
+  patches = [
+    # Bump minimal version of cmake to 3.10
+    (fetchpatch {
+      url = "https://github.com/potassco/aspcud/commit/d88c1aad6f9c1c0081aa1a0eea94ecc7d4ebf855.patch?full_index=1";
+      hash = "sha256-JDNpXLb3ow4JnsZrQ8HqGrRpf/6H/ozJca52pIRVo2w=";
+      excludes = [ "cmake/FindRE2C.cmake" ];
+    })
+  ];
+
   postPatch = ''
     cp ${catch2}/include/catch2/catch.hpp libcudf/tests/catch.hpp
   '';

From c4d4caf20effb6f64bd6679c9f2c309bc38394f8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Oct 2025 01:20:50 +0000
Subject: [PATCH 10/35] organicmaps: 2025.10.05-7 -> 2025.10.07-1

---
 pkgs/applications/misc/organicmaps/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/organicmaps/default.nix b/pkgs/applications/misc/organicmaps/default.nix
index 6dce5c9a6320..c8964cdd63f7 100644
--- a/pkgs/applications/misc/organicmaps/default.nix
+++ b/pkgs/applications/misc/organicmaps/default.nix
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "organicmaps";
-  version = "2025.10.05-7";
+  version = "2025.10.07-1";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     tag = "${finalAttrs.version}-android";
-    hash = "sha256-U7CGXwClKByLVn2LAgEavZ96+AyvUlrZlB3HQLaQYH0=";
+    hash = "sha256-132C3k8KvnQNC/AOoBlikl+AsRQdaaH00U3AFA4jo1Q=";
     fetchSubmodules = true;
   };
 

From f0a14f597826430dbc1c08c7cf656500f10d774a Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 13 Oct 2025 11:39:17 +0200
Subject: [PATCH 11/35] tint2: fix build with CMake4

Also fix a warning about calling 'project' before setting the minimum required version.
---
 pkgs/by-name/ti/tint2/fix-cmake-version.patch | 22 +++++++++++++++++++
 pkgs/by-name/ti/tint2/package.nix             |  1 +
 2 files changed, 23 insertions(+)
 create mode 100644 pkgs/by-name/ti/tint2/fix-cmake-version.patch

diff --git a/pkgs/by-name/ti/tint2/fix-cmake-version.patch b/pkgs/by-name/ti/tint2/fix-cmake-version.patch
new file mode 100644
index 000000000000..f43ac804d7e9
--- /dev/null
+++ b/pkgs/by-name/ti/tint2/fix-cmake-version.patch
@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 336dff9..8b8a853 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,5 +1,5 @@
++cmake_minimum_required( VERSION 3.10 )
+ project( tint2 )
+-cmake_minimum_required( VERSION 2.8.5 )
+ 
+ option( ENABLE_BATTERY "Enable battery status plugin" ON )
+ option( ENABLE_TINT2CONF "Enable tint2conf build, a GTK+3 theme configurator for tint2" ON )
+diff --git a/src/tint2conf/CMakeLists.txt b/src/tint2conf/CMakeLists.txt
+index 747b9ac..cbe13bb 100644
+--- a/src/tint2conf/CMakeLists.txt
++++ b/src/tint2conf/CMakeLists.txt
+@@ -1,5 +1,5 @@
++cmake_minimum_required(VERSION 3.10)
+ project(tint2conf)
+-cmake_minimum_required(VERSION 2.6)
+ 
+ include( FindPkgConfig )
+ pkg_check_modules( X11_T2C REQUIRED x11 xcomposite xdamage xinerama xrender xrandr>=1.3 )
diff --git a/pkgs/by-name/ti/tint2/package.nix b/pkgs/by-name/ti/tint2/package.nix
index b00d34b131e8..c5271e49ffa3 100644
--- a/pkgs/by-name/ti/tint2/package.nix
+++ b/pkgs/by-name/ti/tint2/package.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.com/nick87720z/tint2/uploads/7de4501a4fa4fffa5ba8bb0fa3d19f78/glib.patch";
       hash = "sha256-K547KYlRkVl1s2THi3ZCRuM447EFJwTqUEBjKQnV8Sc=";
     })
+    ./fix-cmake-version.patch
   ];
 
   # Fix build with gcc14

From 0c9e2f7605a188f340a10fc0b2bd0fc83db1354b Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 13 Oct 2025 11:40:00 +0200
Subject: [PATCH 12/35] tint2: remove 'with lib'

---
 pkgs/by-name/ti/tint2/package.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ti/tint2/package.nix b/pkgs/by-name/ti/tint2/package.nix
index c5271e49ffa3..0090f98026bf 100644
--- a/pkgs/by-name/ti/tint2/package.nix
+++ b/pkgs/by-name/ti/tint2/package.nix
@@ -91,11 +91,12 @@ stdenv.mkDerivation rec {
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
-  meta = with lib; {
+  meta = {
+    mainProgram = "tint2";
     homepage = "https://gitlab.com/nick87720z/tint2";
     description = "Simple panel/taskbar unintrusive and light (memory, cpu, aestetic)";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.romildo ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.romildo ];
   };
 }

From 76cefdabd5ae32ea43b62ed8fe1efd89c90302e1 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Mon, 13 Oct 2025 14:11:40 +0000
Subject: [PATCH 13/35] linuxPackages.rtl8821ce: 0-unstable-2025-08-20 ->
 0-unstable-2025-10-13

---
 pkgs/os-specific/linux/rtl8821ce/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/rtl8821ce/default.nix b/pkgs/os-specific/linux/rtl8821ce/default.nix
index d3bd7772888a..45f4f3f89cd8 100644
--- a/pkgs/os-specific/linux/rtl8821ce/default.nix
+++ b/pkgs/os-specific/linux/rtl8821ce/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rtl8821ce";
-  version = "0-unstable-2025-08-20";
+  version = "0-unstable-2025-10-13";
 
   src = fetchFromGitHub {
     owner = "tomaspinho";
     repo = "rtl8821ce";
-    rev = "5df613d114d1ca6072aeaf9f64666029896eed61";
-    hash = "sha256-JEaMfpu2F9Pcg7aLwKEUnRMMqC0Y0r1WRmHMCRba280=";
+    rev = "4e6b887f0d8c4091a4df9da9fcead9a8294b41ad";
+    hash = "sha256-fY0j6VzwAIsD62+snAWfIgGXcwne0mOwIE/Yh25lwTY=";
   };
 
   hardeningDisable = [ "pic" ];

From 8e382666f8e383a49e56f68f8e2328aa6b6b2b93 Mon Sep 17 00:00:00 2001
From: programmerlexi <lexi@reyer.name>
Date: Mon, 13 Oct 2025 16:59:09 +0200
Subject: [PATCH 14/35] limine: 10.1.0 -> 10.1.1

---
 pkgs/by-name/li/limine/package.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index fbaad5b4a2a4..5407319facd5 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -14,7 +14,6 @@
   biosSupport ? true,
   pxeSupport ? false,
 }:
-
 let
   stdenv = llvmPackages.stdenv;
 
@@ -37,19 +36,18 @@ let
     }
     .${target} or (throw "Unsupported target ${target}");
 in
-
 # The output of the derivation is a tool to create bootable images using Limine
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "10.1.0";
+  version = "10.1.1";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Hn1njCaHcdCocnKpAZhkcMXG6tAojVQQtVAW4pVUFGI=";
+    hash = "sha256-pDhA8N7a5cTorIW8OgCimOxxfZ2slUhp3K+cb8KIAzc=";
   };
 
   enableParallelBuilding = true;

From 7d5287ad0dadaa3ac2587241f2f05f9aa1b477f2 Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Mon, 13 Oct 2025 21:15:19 +0200
Subject: [PATCH 15/35] esdm: 1.2.0 -> 1.2.1

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/by-name/es/esdm/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/es/esdm/package.nix b/pkgs/by-name/es/esdm/package.nix
index 47ec9b4ff7a3..22995e7a076d 100644
--- a/pkgs/by-name/es/esdm/package.nix
+++ b/pkgs/by-name/es/esdm/package.nix
@@ -60,13 +60,13 @@ assert cryptoBackend == "openssl" || cryptoBackend == "botan" || cryptoBackend =
 
 stdenv.mkDerivation rec {
   pname = "esdm";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "smuellerDD";
     repo = "esdm";
     rev = "v${version}";
-    hash = "sha256-5XctrI02pfCgK1P76AaSkMjiQqav6LX3SMjKr4F44sw=";
+    hash = "sha256-41vc5mB2MiQJu0HXFzSjiudlu1sRj2IP8FcFPQfu5uo=";
   };
 
   nativeBuildInputs = [

From dd70cc61170c641e771bf42496167c05250a039a Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Mon, 13 Oct 2025 21:15:58 +0200
Subject: [PATCH 16/35] esdm: remove orichter from maintainers

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/by-name/es/esdm/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/es/esdm/package.nix b/pkgs/by-name/es/esdm/package.nix
index 22995e7a076d..7226f1e05ff4 100644
--- a/pkgs/by-name/es/esdm/package.nix
+++ b/pkgs/by-name/es/esdm/package.nix
@@ -135,7 +135,6 @@ stdenv.mkDerivation rec {
     ];
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [
-      orichter
       thillux
     ];
   };

From 093d9b43b57f32dfa48b7e0bb5086be60337d14b Mon Sep 17 00:00:00 2001
From: misuzu <bakalolka@gmail.com>
Date: Mon, 13 Oct 2025 21:55:29 +0300
Subject: [PATCH 17/35] telegram-bot-api: 8.2 -> 9.2

Release notes: https://core.telegram.org/bots/api#august-15-2025
Diff: https://github.com/tdlib/telegram-bot-api/compare/fa6706fc8f6e22b3c25b512ede6474613f32b32b...3b6a0b769c4a7fbe064087a4ad9fe6b1dbda498f
---
 pkgs/by-name/te/telegram-bot-api/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/telegram-bot-api/package.nix b/pkgs/by-name/te/telegram-bot-api/package.nix
index 4b8da01c0c21..56d99458b46d 100644
--- a/pkgs/by-name/te/telegram-bot-api/package.nix
+++ b/pkgs/by-name/te/telegram-bot-api/package.nix
@@ -11,13 +11,14 @@
 
 stdenv.mkDerivation {
   pname = "telegram-bot-api";
-  version = "8.2";
+  version = "9.2";
 
   src = fetchFromGitHub {
     owner = "tdlib";
     repo = "telegram-bot-api";
-    rev = "fa6706fc8f6e22b3c25b512ede6474613f32b32b";
-    hash = "sha256-0ra1sL121ksUIhpV738tL3y1gu1csMf0rK95G8ElMuo=";
+    # https://github.com/tdlib/telegram-bot-api/issues/783
+    rev = "3b6a0b769c4a7fbe064087a4ad9fe6b1dbda498f";
+    hash = "sha256-EpDO1ulIT/RIUjc06BtGRpqdQIMpma5+DRy7i8YVhiU=";
     fetchSubmodules = true;
   };
 

From cd1a062362a72a120ce5adf9f86c21e7303f590f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Oct 2025 20:20:16 +0000
Subject: [PATCH 18/35] ocamlPackages.ca-certs-nss: 3.115 -> 3.117

---
 pkgs/development/ocaml-modules/ca-certs-nss/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
index 761b56a605b9..506853cc491e 100644
--- a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@@ -14,13 +14,13 @@
 
 buildDunePackage rec {
   pname = "ca-certs-nss";
-  version = "3.115";
+  version = "3.117";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-${version}.tbz";
-    hash = "sha256-cjjvrekr6i7aEj0Ne/+Jhgdi7lf89xh07FlHuS5nOA8=";
+    hash = "sha256-SdcTJ3Og5h5XvqnDqp1flw/hwLWINjlqeT/vIwAg380=";
   };
 
   propagatedBuildInputs = [

From 2b489fb4fbd18a78cca8796a2deadac7463ea709 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Mon, 22 Sep 2025 00:16:02 -0400
Subject: [PATCH 19/35] cerberus: Fix runtime path look-up

---
 pkgs/by-name/ce/cerberus/package.nix | 65 ++++++++++++++++++++++++----
 1 file changed, 56 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/ce/cerberus/package.nix b/pkgs/by-name/ce/cerberus/package.nix
index 4d7c257dd995..f2d45151385e 100644
--- a/pkgs/by-name/ce/cerberus/package.nix
+++ b/pkgs/by-name/ce/cerberus/package.nix
@@ -1,12 +1,16 @@
 {
   lib,
+  fetchpatch,
   fetchFromGitHub,
-  writableTmpDirAsHomeHook,
-  unstableGitUpdater,
   ocamlPackages,
   opam,
+  makeBinaryWrapper,
+  writableTmpDirAsHomeHook,
+  unstableGitUpdater,
+  testers,
+  cerberus,
 }:
-ocamlPackages.buildDunePackage {
+ocamlPackages.buildDunePackage rec {
   pname = "cerberus";
   version = "0-unstable-2025-08-18";
 
@@ -17,15 +21,33 @@ ocamlPackages.buildDunePackage {
     hash = "sha256-++fCZvk4ee166eciipTQ8GId6DWrG6aonAzHpK/10f0=";
   };
 
+  patches = [
+    # https://github.com/rems-project/cerberus/pull/980
+    (fetchpatch {
+      name = "fix-runtime-lookup";
+      url = "https://github.com/rems-project/cerberus/commit/262c13331d4809dd3742069dbcd1deedee8227f2.patch";
+      hash = "sha256-yPhzswMDkpjvjYyobnqoF3900l4THe0kaGme1eZXLQc=";
+    })
+  ];
+
+  # Cerberus has not had a true release yet, and it parses out a git rev
+  # for version info. We just patch the "didn't find git revs" to
+  # our version since git is impure
+  postPatch = ''
+    substituteInPlace tools/gen_version.ml \
+      --replace-fail '"unknown"' '"${version}"'
+  '';
+
   minimalOCamlVersion = "4.12";
 
-  strictDeps = true;
+  depsBuildBuild = [
+    ocamlPackages.menhir
+    ocamlPackages.lem
+  ];
 
   nativeBuildInputs = [
-    opam
     writableTmpDirAsHomeHook
-    ocamlPackages.lem
-    ocamlPackages.menhir
+    makeBinaryWrapper
   ];
 
   buildInputs = with ocamlPackages; [
@@ -42,15 +64,33 @@ ocamlPackages.buildDunePackage {
     janeStreet.ppx_sexp_conv
   ];
 
+  # Need to set this or it complains. I don't
+  # think the actual value matters much
   env.OPAM_SWITCH_PREFIX = placeholder "out";
+
+  # Use the make file as it does some codegen
   buildPhase = ''
     runHook preBuild
 
-    make Q= cerberus
+    make DUNEFLAGS="--profile=release" Q= -j$NIX_BUILD_CORES cerberus
 
     runHook postBuild
   '';
 
+  # Must install both the stdlib
+  # and the executable itself
+  installPhase = ''
+    runHook preInstall
+
+    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR cerberus-lib --docdir $out/share/doc --mandir $out/share/man
+    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR cerberus --docdir $out/share/doc --mandir $out/share/man
+
+    wrapProgram "$out/bin/cerberus" \
+      --set CERB_INSTALL_PREFIX "$out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/"
+
+    runHook postInstall
+  '';
+
   doInstallCheck = true;
   installCheckPhase = ''
     runHook preInstallCheck
@@ -64,7 +104,14 @@ ocamlPackages.buildDunePackage {
     runHook postInstallCheck
   '';
 
-  passthru.updateScript = unstableGitUpdater { branch = "master"; };
+  passthru = {
+    updateScript = unstableGitUpdater { branch = "master"; };
+
+    # Ensure it still runs after outside the container
+    tests.version = testers.testVersion {
+      package = cerberus;
+    };
+  };
 
   meta = {
     homepage = "https://www.cl.cam.ac.uk/~pes20/cerberus/";

From 8054c4a5b6b7d8e29228301493826826ed92d101 Mon Sep 17 00:00:00 2001
From: Alexander Shpilkin <ashpilkin@gmail.com>
Date: Sat, 12 Jul 2025 04:58:18 +0300
Subject: [PATCH 20/35] fio: enable nbd engine

---
 pkgs/by-name/fi/fio/package.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fi/fio/package.nix b/pkgs/by-name/fi/fio/package.nix
index a297164ad7aa..edea623ffaf9 100644
--- a/pkgs/by-name/fi/fio/package.nix
+++ b/pkgs/by-name/fi/fio/package.nix
@@ -4,10 +4,13 @@
   fetchFromGitHub,
   makeWrapper,
   libaio,
+  pkg-config,
   python3,
   zlib,
   withGnuplot ? false,
-  gnuplot ? null,
+  gnuplot,
+  withLibnbd ? true,
+  libnbd,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,16 +28,20 @@ stdenv.mkDerivation rec {
     python3
     zlib
   ]
-  ++ lib.optional (!stdenv.hostPlatform.isDarwin) libaio;
+  ++ lib.optional (!stdenv.hostPlatform.isDarwin) libaio
+  ++ lib.optional withLibnbd libnbd;
 
   # ./configure does not support autoconf-style --build=/--host=.
   # We use $CC instead.
   configurePlatforms = [ ];
 
+  configureFlags = lib.optional withLibnbd "--enable-libnbd";
+
   dontAddStaticConfigureFlags = true;
 
   nativeBuildInputs = [
     makeWrapper
+    pkg-config
     python3.pkgs.wrapPython
   ];
 

From 5baf5a8bb2e529fe65f4c881c9fe1223193a3700 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Oct 2025 02:42:16 +0000
Subject: [PATCH 21/35] vacuum-tube: 1.3.19 -> 1.3.20

---
 pkgs/by-name/va/vacuum-tube/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/va/vacuum-tube/package.nix b/pkgs/by-name/va/vacuum-tube/package.nix
index d94106d4fb71..e34bddbe5876 100644
--- a/pkgs/by-name/va/vacuum-tube/package.nix
+++ b/pkgs/by-name/va/vacuum-tube/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "vacuum-tube";
-  version = "1.3.19";
+  version = "1.3.20";
 
   src = fetchFromGitHub {
     owner = "shy1132";
     repo = "VacuumTube";
     tag = "v${version}";
-    hash = "sha256-WJUxLS7rthRfnXbyHwcC53U/qUvqxlZL5EQk3IareFQ=";
+    hash = "sha256-DmuJ01xrA+rrKnzVQT3X2bfcIwqdn+plWg5o1GwyiS4=";
   };
 
-  npmDepsHash = "sha256-Q9a+B+kRj5n8XcZD1Ue+HMx/VP8/LfYb8Jm6SIPNY0U=";
+  npmDepsHash = "sha256-L/2qSPkHNH7H0Pk4WrX0gfwJs1Dy5DDyJmggCO/ET9s=";
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = true;

From 9bc45ff782a82b20fd1eda442de4741068504b01 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Oct 2025 06:03:15 +0000
Subject: [PATCH 22/35] vscode-extensions.jnoortheen.nix-ide: 0.4.24 -> 0.5.0

---
 pkgs/applications/editors/vscode/extensions/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 9a962cd3935f..3a67e781f335 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2537,8 +2537,8 @@ let
         mktplcRef = {
           publisher = "jnoortheen";
           name = "nix-ide";
-          version = "0.4.24";
-          hash = "sha256-xtMXd8GVHygl9+9X+QamI5YXXSlvEWOoYKf3OWmIoHw=";
+          version = "0.5.0";
+          hash = "sha256-jVuGQzMspbMojYq+af5fmuiaS3l3moG8L8Kyf40vots=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/jnoortheen.nix-ide/changelog";

From 5f853977a73d5e3a610105d79a3af11011fbedba Mon Sep 17 00:00:00 2001
From: Caleb Norton <n0603919@outlook.com>
Date: Tue, 14 Oct 2025 01:16:45 -0500
Subject: [PATCH 23/35] trilium-desktop: update electron version

---
 pkgs/by-name/tr/trilium-desktop/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/tr/trilium-desktop/package.nix b/pkgs/by-name/tr/trilium-desktop/package.nix
index ec5dba01cd2e..151a132289ad 100644
--- a/pkgs/by-name/tr/trilium-desktop/package.nix
+++ b/pkgs/by-name/tr/trilium-desktop/package.nix
@@ -5,7 +5,7 @@
   fetchurl,
   makeBinaryWrapper,
   # use specific electron since it has to load a compiled module
-  electron_37,
+  electron_38,
   autoPatchelfHook,
   makeDesktopItem,
   copyDesktopItems,
@@ -111,7 +111,7 @@ let
       asar pack $tmp/ $out/share/trilium/resources/app.asar
       rm -rf $tmp
 
-      makeWrapper ${lib.getExe electron_37} $out/bin/trilium \
+      makeWrapper ${lib.getExe electron_38} $out/bin/trilium \
         "''${gappsWrapperArgs[@]}" \
         --set-default ELECTRON_IS_DEV 0 \
         --add-flags $out/share/trilium/resources/app.asar

From 068845e5c8e70c8dfbebf74884e542ab3edb94f7 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Tue, 14 Oct 2025 08:39:13 +0200
Subject: [PATCH 24/35] tdnf: fix build with cmake4

---
 pkgs/by-name/td/tdnf/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/td/tdnf/package.nix b/pkgs/by-name/td/tdnf/package.nix
index 6e26431d65dd..0ec93418cba4 100644
--- a/pkgs/by-name/td/tdnf/package.nix
+++ b/pkgs/by-name/td/tdnf/package.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://patch-diff.githubusercontent.com/raw/vmware/tdnf/pull/410.patch";
       hash = "sha256-p/ix5O1J/lj2fw7qJokT+wPN4ROoulnVqByfxgFvuEo=";
     })
+    # Bump minimal cmake version
+    (fetchpatch2 {
+      url = "https://github.com/vmware/tdnf/commit/24211f2077d2423e511c43f21cd5ee5b53fa4021.patch?full_index=1";
+      hash = "sha256-twzyVV+VgtRljj1E70Tq5U0sNEiSWU/rG9buoAYDF0o=";
+    })
   ];
 
   nativeBuildInputs = [

From 550a765e8252e87087c7cde8e5da1b9f3b774411 Mon Sep 17 00:00:00 2001
From: onatustun <git@onatustun.com>
Date: Tue, 14 Oct 2025 09:26:39 +0100
Subject: [PATCH 25/35] maintainers: add onatustun

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index f0deaf982651..1c261b01456b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -19295,6 +19295,12 @@
     githubId = 1538622;
     name = "Michael Reilly";
   };
+  onatustun = {
+    email = "contact@onatustun.com";
+    name = "Onat Ustun";
+    github = "onatustun";
+    githubId = 41642110;
+  };
   ondt = {
     name = "Ondrej Telka";
     email = "nix@ondt.dev";

From e12e058f03b90373be0ccac06168ee59cc3bb027 Mon Sep 17 00:00:00 2001
From: onatustun <git@onatustun.com>
Date: Tue, 14 Oct 2025 09:28:49 +0100
Subject: [PATCH 26/35] hyprmon: init at 0.0.12

---
 pkgs/by-name/hy/hyprmon/package.nix | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 pkgs/by-name/hy/hyprmon/package.nix

diff --git a/pkgs/by-name/hy/hyprmon/package.nix b/pkgs/by-name/hy/hyprmon/package.nix
new file mode 100644
index 000000000000..71996ccea9fa
--- /dev/null
+++ b/pkgs/by-name/hy/hyprmon/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "hyprmon";
+  version = "0.0.12";
+
+  src = fetchFromGitHub {
+    owner = "erans";
+    repo = "hyprmon";
+    rev = "v${version}";
+    hash = "sha256-jZUtdOMmpd75CyjaXdrqXcYxcQ9q7G2YGBHoUUvycX8=";
+  };
+
+  vendorHash = "sha256-THfdsr8jSvbcV1C2C2IJNvjeeonSZDfmCo6Ws2WreBA=";
+
+  meta = with lib; {
+    description = "TUI monitor configuration tool for Hyprland with visual layout, drag-and-drop, and profile management";
+    homepage = "https://github.com/erans/hyprmon";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ onatustun ];
+    mainProgram = "hyprmon";
+  };
+}

From cc6d1e3e1d488545256956792f768ff09b192989 Mon Sep 17 00:00:00 2001
From: onatustun <git@onatustun.com>
Date: Tue, 14 Oct 2025 10:13:36 +0100
Subject: [PATCH 27/35] hyprmon: init at 0.0.12

---
 pkgs/by-name/hy/hyprmon/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/hy/hyprmon/package.nix b/pkgs/by-name/hy/hyprmon/package.nix
index 71996ccea9fa..d2a7bbdacddb 100644
--- a/pkgs/by-name/hy/hyprmon/package.nix
+++ b/pkgs/by-name/hy/hyprmon/package.nix
@@ -17,12 +17,12 @@ buildGoModule rec {
 
   vendorHash = "sha256-THfdsr8jSvbcV1C2C2IJNvjeeonSZDfmCo6Ws2WreBA=";
 
-  meta = with lib; {
+  meta = {
     description = "TUI monitor configuration tool for Hyprland with visual layout, drag-and-drop, and profile management";
     homepage = "https://github.com/erans/hyprmon";
-    license = licenses.asl20;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ onatustun ];
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ onatustun ];
     mainProgram = "hyprmon";
   };
 }

From 5816f0b2de9d706bf89f5a2c910676d8558f9e8c Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 14 Oct 2025 11:21:04 +0200
Subject: [PATCH 28/35] tint2: add provenance for patch and another fix

---
 pkgs/by-name/ti/tint2/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/ti/tint2/package.nix b/pkgs/by-name/ti/tint2/package.nix
index 0090f98026bf..976badf097d8 100644
--- a/pkgs/by-name/ti/tint2/package.nix
+++ b/pkgs/by-name/ti/tint2/package.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.com/nick87720z/tint2/uploads/7de4501a4fa4fffa5ba8bb0fa3d19f78/glib.patch";
       hash = "sha256-K547KYlRkVl1s2THi3ZCRuM447EFJwTqUEBjKQnV8Sc=";
     })
+    # https://gitlab.com/nick87720z/tint2/-/merge_requests/4
     ./fix-cmake-version.patch
   ];
 
@@ -81,6 +82,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     # Add missing dependency on libm
+    # https://gitlab.com/nick87720z/tint2/-/merge_requests/3
     substituteInPlace src/tint2conf/CMakeLists.txt \
       --replace-fail "RSVG_LIBRARIES} )" "RSVG_LIBRARIES} m)"
 

From c5e8cd7128f557826fd848039f465725d874f7d2 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Tue, 14 Oct 2025 19:14:45 +1000
Subject: [PATCH 29/35] terraform-providers: fix openstack alias

follow up from f26770b12e9a69cd2391469f234e5dc9d04644bb
---
 .../networking/cluster/terraform-providers/default.nix          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index 620052e8c253..b39f437f904d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -242,7 +242,7 @@ let
     okta = lib.warnOnInstantiate "terraform-providers.okta has been renamed to terraform-providers.okta_okta" actualProviders.okta_okta;
     oktaasa = lib.warnOnInstantiate "terraform-providers.oktaasa has been renamed to terraform-providers.oktadeveloper_oktaasa" actualProviders.oktadeveloper_oktaasa;
     opennebula = lib.warnOnInstantiate "terraform-providers.opennebula has been renamed to terraform-providers.opennebula_opennebula" actualProviders.opennebula_opennebula;
-    openstack = lib.warnOnInstantiate "terraform-providers.openstack has been renamed to terraform-providers.openstack_openstack" actualProviders.openstack_openstack;
+    openstack = lib.warnOnInstantiate "terraform-providers.openstack has been renamed to terraform-providers.terraform-provider-openstack_openstack" actualProviders.terraform-provider-openstack_openstack;
     opentelekomcloud = lib.warnOnInstantiate "terraform-providers.opentelekomcloud has been renamed to terraform-providers.opentelekomcloud_opentelekomcloud" actualProviders.opentelekomcloud_opentelekomcloud;
     opsgenie = lib.warnOnInstantiate "terraform-providers.opsgenie has been renamed to terraform-providers.opsgenie_opsgenie" actualProviders.opsgenie_opsgenie;
     oci = lib.warnOnInstantiate "terraform-providers.oci has been renamed to terraform-providers.oracle_oci" actualProviders.oracle_oci;

From b7f40d25ebe0e89abb8d557e162592e9088f240e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 9 Oct 2025 15:05:51 +0100
Subject: [PATCH 30/35] nixos/facter: add initial commit

This is the first step to upstream nixos-facter-modules into
nixpkgs/nixos:

https://github.com/numtide/nixos-facter-modules/

We tried to stick close to the semantics nixos-generate-config + some
extra features. We choose a new prefix for hardware.facter to live in so
that existing users of nixos-facter-modules can continue using it while
the upstreaming is in progress.

The reason for upstreaming is to make it easier to have nixos-facter as
choice for hardware detection as part of our normal NixOS installation workflow.
Hardware from my experience takes many hands since it is hard to test
without having access to a large variety of hardware.

We hope that with nixos-facter we can reduce the boiler code required in
the nixos-hardware project and provide better out-of-the-box support,
even if a model has not been explicitly added to nixos-hardware.
I.e. unlike ubuntu we don't have support for detecting required GPU
drivers. We believe that nixos-hardware will be still required for some
vendor specific quirks, but we could in future automatically select the
profiles based on reported SKU from facter.

For more details watch the 2024 NixCon talk: https://www.youtube.com/watch?v=3H3YUqibC6c
---
 nixos/modules/hardware/facter/default.nix | 40 +++++++++++++++++++++++
 nixos/modules/module-list.nix             |  1 +
 2 files changed, 41 insertions(+)
 create mode 100644 nixos/modules/hardware/facter/default.nix

diff --git a/nixos/modules/hardware/facter/default.nix b/nixos/modules/hardware/facter/default.nix
new file mode 100644
index 000000000000..0d3163185b98
--- /dev/null
+++ b/nixos/modules/hardware/facter/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  meta.maintainers = with lib.maintainers; [ mic92 ];
+
+  options.hardware.facter = with lib; {
+    report = mkOption {
+      type = types.attrsOf types.anything;
+      default =
+        if config.hardware.facter.reportPath == null then
+          { }
+        else
+          builtins.fromJSON (builtins.readFile config.hardware.facter.reportPath);
+      defaultText = "A JSON import from config.hardware.facter.reportPath (if not null), {} otherwise.";
+      description = ''
+        Hardware report data generated by nixos-facter.
+
+        See <https://nix-community.github.io/nixos-facter/> for more information.
+      '';
+    };
+
+    reportPath = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Path to a hardware report generated by nixos-facter.
+
+        To generate a report, run the following as root:
+        ```
+        nix-shell -p nixos-facter --run nixos-facter > facter.json
+        ```
+
+        See <https://nix-community.github.io/nixos-facter/> for more information.
+      '';
+    };
+  };
+}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 5b285ee24580..45351dd2b145 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -66,6 +66,7 @@
   ./hardware/decklink.nix
   ./hardware/device-tree.nix
   ./hardware/digitalbitbox.nix
+  ./hardware/facter
   ./hardware/flipperzero.nix
   ./hardware/flirc.nix
   ./hardware/fw-fanctrl.nix

From 3bed74c089a6df053e758ae7c02f5b29d8454758 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 9 Oct 2025 16:53:07 +0100
Subject: [PATCH 31/35] nixos-facter: add passthru.tests

---
 nixos/tests/all-tests.nix                |  1 +
 nixos/tests/facter/default.nix           | 29 ++++++++++++++++++++++
 nixos/tests/facter/facter.json           | 31 ++++++++++++++++++++++++
 pkgs/by-name/ni/nixos-facter/package.nix |  5 ++++
 4 files changed, 66 insertions(+)
 create mode 100644 nixos/tests/facter/default.nix
 create mode 100644 nixos/tests/facter/facter.json

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index e471baaf7849..b7a3065c5cf1 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -512,6 +512,7 @@ in
   etebase-server = runTest ./etebase-server.nix;
   etesync-dav = runTest ./etesync-dav.nix;
   evcc = runTest ./evcc.nix;
+  facter = runTest ./facter;
   fail2ban = runTest ./fail2ban.nix;
   fakeroute = runTest ./fakeroute.nix;
   fancontrol = runTest ./fancontrol.nix;
diff --git a/nixos/tests/facter/default.nix b/nixos/tests/facter/default.nix
new file mode 100644
index 000000000000..7083d5d8bd09
--- /dev/null
+++ b/nixos/tests/facter/default.nix
@@ -0,0 +1,29 @@
+{ lib, pkgs, ... }:
+{
+  name = "facter";
+  meta = with lib.maintainers; {
+    maintainers = [ mic92 ];
+  };
+
+  nodes.machine = {
+    hardware.facter.reportPath = ./facter.json;
+    environment.systemPackages = [ pkgs.nixos-facter ];
+  };
+
+  testScript = ''
+    from pprint import pprint
+
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("Run nixos-facter and verify it produces valid JSON"):
+      import json
+      # Run nixos-facter and check it produces valid output
+      output = machine.succeed("nixos-facter")
+      # Parse JSON to verify it's valid
+      report = json.loads(output)
+      pprint(report)
+      assert "version" in report, "Expected version field in nixos-facter output"
+      assert "system" in report, "Expected system field in nixos-facter output"
+      assert report["version"] == 1, f"Expected version 1, got {report['version']}"
+  '';
+}
diff --git a/nixos/tests/facter/facter.json b/nixos/tests/facter/facter.json
new file mode 100644
index 000000000000..37d6ba87c14d
--- /dev/null
+++ b/nixos/tests/facter/facter.json
@@ -0,0 +1,31 @@
+{
+  "version": 1,
+  "system": "x86_64-linux",
+  "virtualisation": "kvm",
+  "hardware": {
+    "bios": {
+      "smbios_version": 520
+    },
+    "cpu": [
+      {
+        "architecture": "x86_64",
+        "vendor_name": "AuthenticAMD",
+        "family": 25,
+        "model": 33
+      }
+    ],
+    "system": {
+      "form_factor": "desktop"
+    }
+  },
+  "smbios": {
+    "bios": {
+      "vendor": "SeaBIOS",
+      "version": "test"
+    },
+    "system": {
+      "manufacturer": "QEMU",
+      "product": "Standard PC"
+    }
+  }
+}
diff --git a/pkgs/by-name/ni/nixos-facter/package.nix b/pkgs/by-name/ni/nixos-facter/package.nix
index 8c519a65256f..6b75db216fc4 100644
--- a/pkgs/by-name/ni/nixos-facter/package.nix
+++ b/pkgs/by-name/ni/nixos-facter/package.nix
@@ -7,6 +7,7 @@
   gcc,
   pkg-config,
   makeWrapper,
+  nixosTests,
   stdenv,
   systemdMinimal,
 }:
@@ -61,6 +62,10 @@ buildGoModule rec {
     "-X github.com/numtide/nixos-facter/pkg/build.System=${stdenv.hostPlatform.system}"
   ];
 
+  passthru.tests = {
+    inherit (nixosTests) facter;
+  };
+
   meta = {
     description = "Declarative hardware configuration for NixOS";
     homepage = "https://github.com/numtide/nixos-facter";

From 5faeb6dba4d02be9c73f597935d865e177396448 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C3=A9o=20Haf?= <leo@haf.ovh>
Date: Tue, 14 Oct 2025 09:42:19 +0000
Subject: [PATCH 32/35] bitcoin-knots: 29.1.knots20250903 -> 29.2.knots20251010

---
 .../blockchains/bitcoin-knots/default.nix          | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix
index dfee589502a3..97337f435042 100644
--- a/pkgs/applications/blockchains/bitcoin-knots/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@@ -31,19 +31,19 @@
   # The list can be found at https://github.com/bitcoinknots/guix.sigs/tree/knots/builder-keys
   builderKeys ? [
     "1A3E761F19D2CC7785C5502EA291A2C45D0C504A" # luke-jr.gpg
-    "55058E8947E136A64F9E8AD5C4512A878E4AC2BF" # nsvrn
+    "C1BCB7169AF1A07A0C5E471A047509FA0A6D7350" # ataraxia
     "DAED928C727D3E613EC46635F5073C4F4882FFFC" # leo-haf.gpg
   ],
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = if withGui then "bitcoin-knots" else "bitcoind-knots";
-  version = "29.1.knots20250903";
+  version = "29.2.knots20251010";
 
   src = fetchurl {
     url = "https://bitcoinknots.org/files/29.x/${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz";
     # hash retrieved from signed SHA256SUMS
-    hash = "sha256-2DlJlGNrCOe8UouZ+TLdZ2OahU18AWL6K/KI1YA29QY=";
+    hash = "sha256-p3omcfgX57reHXQX3IG8FPmMy8MHSCN0+D9Hhb24Wck=";
   };
 
   nativeBuildInputs = [
@@ -87,18 +87,18 @@ stdenv.mkDerivation (finalAttrs: {
       publicKeys = fetchFromGitHub {
         owner = "bitcoinknots";
         repo = "guix.sigs";
-        rev = "d441685d5179b91070fadbc764be3a41616f36df";
-        sha256 = "sha256-XO/E51yOFrRYrGnxsyH/ZPF4Yf192x+lT2FPdilkacA=";
+        rev = "7ee29a9ffbd1c26ba065ba06055242a01c3e63ff";
+        sha256 = "sha256-ZW1I7Y35Pi4WZhgCCYSI5gPhcvbfnpBObhOUTqZGVvM=";
       };
 
       checksums = fetchurl {
         url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS";
-        hash = "sha256-CH5p+u2XvIpWC/yv+UrP3JSq/dcAxq/eCZ+fPzqaI+Q=";
+        hash = "sha256-DQQg2Iahp2H5jDYA9XX5n/ypRzmFggincGNoIH2t5iU=";
       };
 
       signatures = fetchurl {
         url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS.asc";
-        hash = "sha256-abCiaE3etiXfqC1nrmHMP77HO94L+ZZv4B2s08p1d2k=";
+        hash = "sha256-jy4gxuczCSsJQkkH3axMljuf7k2VdmLp4PkgRoQnoSY=";
       };
 
       verifyBuilderKeys =

From 555d0623c2935204c28f5752bd552e7be39782fd Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Mon, 13 Oct 2025 21:16:21 +0200
Subject: [PATCH 33/35] esdm: cleanup options and adapt to 1.2.1

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/by-name/es/esdm/package.nix | 73 ++++++++++++++++----------------
 1 file changed, 37 insertions(+), 36 deletions(-)

diff --git a/pkgs/by-name/es/esdm/package.nix b/pkgs/by-name/es/esdm/package.nix
index 7226f1e05ff4..2c96a1aefc77 100644
--- a/pkgs/by-name/es/esdm/package.nix
+++ b/pkgs/by-name/es/esdm/package.nix
@@ -18,45 +18,42 @@
   # A brief explanation is given.
 
   # general options
-  selinux ? false, # enable selinux support
-  drngHashDrbg ? true, # set the default drng callback
-  drngChaCha20 ? false, # set the default drng callback
-  ais2031 ? false, # set the seeding strategy to be compliant with AIS 20/31
-  sp80090c ? false, # set compliance with NIST SP800-90C
-  cryptoBackend ? "builtin", # set backend for hash and drbg operations
+  selinux ? true, # enable selinux support
+  fips140 ? true, # enable FIPS 140 checksum support
+  ais2031 ? true, # set the seeding strategy to be compliant with AIS 20/31
+  sp80090c ? true, # set compliance with NIST SP800-90C
+  cryptoBackend ? "botan", # set backend for hash and drbg operations
   linuxDevFiles ? true, # enable linux /dev/random and /dev/urandom support
   linuxGetRandom ? true, # enable linux getrandom support
-  hashSha512 ? false, # set the conditioning hash: SHA2-512
-  hashSha3_512 ? true, # set the conditioning hash: SHA3-512
-  openSSLRandProvider ? false, # build ESDM provider for OpenSSL 3.x
-  botanRng ? false, # build ESDM class for Botan 3.x
-
-  # client-related options (handle with care, consult source code and meson options)
-  # leave as is if in doubt
-  connectTimeoutExponent ? 28, # (1 << EXPONENT nanoseconds)
-  rxTxTimeoutExponent ? 28, # (1 << EXPONENT nanoseconds)
-  reconnectAttempts ? 10, # how often to attempt unix socket connection before giving up
+  openSSLRandProvider ? true, # build ESDM provider for OpenSSL 3.x
+  maxThreads ? 1024, # number of RPC handler threads
+  validationHelpers ? true, # used to analyze entropy output from esdm_es
+  numAuxPools ? 128, # use multiple hash pools for e.g. smartcard input
+  serverTermOnSignal ? false, # use select with timeout in server watch loop
 
   # entropy sources
   esJitterRng ? true, # enable support for the entropy source: jitter rng (running in user space)
   esJitterRngEntropyRate ? 256, # amount of entropy to account for jitter rng source
-  esJitterRngKernel ? true, # enable support for the entropy source: jitter rng (running in kernel space)
+  esJitterRngEntropyBlocks ? 128, # number of cached entropy blocks for jitterentropy
+  esJitterRngKernel ? false, # enable support for the entropy source: jitter rng (running in kernel space)
   esJitterRngKernelEntropyRate ? 256, # amount of entropy to account for kernel jitter rng source
   esCPU ? true, # enable support for the entropy source: cpu-based entropy
-  esCPUEntropyRate ? 8, # amount of entropy to account for cpu rng source
-  esKernel ? true, # enable support for the entropy source: kernel-based entropy
-  esKernelEntropyRate ? 128, # amount of entropy to account for kernel-based source
+  esCPUEntropyRate ? 256, # amount of entropy to account for cpu rng source
+  esKernel ? false, # enable support for the entropy source: kernel-based entropy
+  esKernelEntropyRate ? 256, # amount of entropy to account for kernel-based source
   esIRQ ? false, # enable support for the entropy source: interrupt-based entropy
   esIRQEntropyRate ? 256, # amount of entropy to account for interrupt-based source (only set irq XOR sched != 0)
   esSched ? false, # enable support for the entropy source: scheduler-based entropy
   esSchedEntropyRate ? 0, # amount of entropy to account for interrupt-based source (only set irq XOR sched != 0)
   esHwrand ? true, # enable support for the entropy source: /dev/hwrng
-  esHwrandEntropyRate ? 128, # amount of entropy to account for /dev/hwrng-based sources
+  esHwrandEntropyRate ? 256, # amount of entropy to account for /dev/hwrng-based sources
+
+  # kernel seeding
+  linuxKernelReseedInterval ? 60, # how often to push entropy into Linux kernel, iff seeder service is started
+  linuxKernelReseedEntropyRate ? 256, # how many bits to account on kernel (re-)seeding
 }:
 
-assert drngHashDrbg != drngChaCha20;
-assert hashSha512 != hashSha3_512;
-assert cryptoBackend == "openssl" || cryptoBackend == "botan" || cryptoBackend == "builtin";
+assert cryptoBackend == "openssl" || cryptoBackend == "botan";
 
 stdenv.mkDerivation rec {
   pname = "esdm";
@@ -76,7 +73,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs =
-    lib.optional (cryptoBackend == "botan" || botanRng) botan3
+    lib.optional (cryptoBackend == "botan") botan3
     ++ lib.optional (cryptoBackend == "openssl" || openSSLRandProvider) openssl
     ++ lib.optional selinux libselinux
     ++ lib.optional esJitterRng jitterentropy
@@ -86,20 +83,19 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ protobufc ];
 
   mesonFlags = [
-    (lib.mesonBool "b_lto" false)
-    (lib.mesonBool "fips140" false)
+    (lib.mesonBool "b_lto" true)
+    (lib.mesonBool "fips140" fips140)
     (lib.mesonBool "ais2031" ais2031)
     (lib.mesonBool "sp80090c" sp80090c)
     (lib.mesonEnable "node" true) # multiple DRNGs
-    (lib.mesonOption "threading_max_threads" (toString 64))
+    (lib.mesonEnable "systemd" true) # systemd notify and socket support
+    (lib.mesonOption "threading_max_threads" (toString maxThreads))
     (lib.mesonOption "crypto_backend" cryptoBackend)
     (lib.mesonEnable "linux-devfiles" linuxDevFiles)
     (lib.mesonEnable "linux-getrandom" linuxGetRandom)
-    (lib.mesonOption "client-connect-timeout-exponent" (toString connectTimeoutExponent))
-    (lib.mesonOption "client-rx-tx-timeout-exponent" (toString rxTxTimeoutExponent))
-    (lib.mesonOption "client-reconnect-attempts" (toString reconnectAttempts))
     (lib.mesonEnable "es_jent" esJitterRng)
     (lib.mesonOption "es_jent_entropy_rate" (toString esJitterRngEntropyRate))
+    (lib.mesonOption "es_jent_entropy_blocks" (toString esJitterRngEntropyBlocks))
     (lib.mesonEnable "es_jent_kernel" esJitterRngKernel)
     (lib.mesonOption "es_jent_kernel_entropy_rate" (toString esJitterRngKernelEntropyRate))
     (lib.mesonEnable "es_cpu" esCPU)
@@ -112,15 +108,20 @@ stdenv.mkDerivation rec {
     (lib.mesonOption "es_sched_entropy_rate" (toString esSchedEntropyRate))
     (lib.mesonEnable "es_hwrand" esHwrand)
     (lib.mesonOption "es_hwrand_entropy_rate" (toString esHwrandEntropyRate))
-    (lib.mesonEnable "hash_sha512" hashSha512)
-    (lib.mesonEnable "hash_sha3_512" hashSha3_512)
     (lib.mesonEnable "selinux" selinux)
-    (lib.mesonEnable "drng_hash_drbg" drngHashDrbg)
-    (lib.mesonEnable "drng_chacha20" drngChaCha20)
     (lib.mesonEnable "openssl-rand-provider" openSSLRandProvider)
-    (lib.mesonEnable "botan-rng" botanRng)
+    (lib.mesonOption "linux-reseed-interval" (toString linuxKernelReseedInterval))
+    (lib.mesonOption "linux-reseed-entropy-count" (toString linuxKernelReseedEntropyRate))
+    (lib.mesonEnable "validation-helpers" validationHelpers)
+    (lib.mesonOption "num-aux-pools" (toString numAuxPools))
+    (lib.mesonBool "esdm-server-term-on-signal" serverTermOnSignal)
   ];
 
+  postFixup = lib.optionals fips140 ''
+    $out/bin/esdm-tool --fips-checkfile $out/bin/.esdm-server.hmac \
+                       --fips-targetfile $out/bin/esdm-server
+  '';
+
   doCheck = true;
 
   strictDeps = true;

From e7478ce547eca8df175e646c47dd43c7831aeba4 Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Mon, 13 Oct 2025 21:16:34 +0200
Subject: [PATCH 34/35] botanEsdm: init at 3.9.0

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/top-level/all-packages.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c5d04515ace3..8ac2dac7d225 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7072,6 +7072,7 @@ with pkgs;
     botan2
     botan3
     ;
+  botanEsdm = botan3.override { withEsdm = true; };
 
   c-ares = callPackage ../development/libraries/c-ares { };
 

From 6e19ebafa0e03a1c9ef2063cf3307fae5f678f71 Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Mon, 13 Oct 2025 21:21:36 +0200
Subject: [PATCH 35/35] nixos/esdm: add kernel seeder service and cleanup
 maintainers

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 nixos/modules/services/security/esdm.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/esdm.nix b/nixos/modules/services/security/esdm.nix
index 398bd8a08917..44a74813fe01 100644
--- a/nixos/modules/services/security/esdm.nix
+++ b/nixos/modules/services/security/esdm.nix
@@ -45,6 +45,7 @@ in
       {
         systemd.packages = [ cfg.package ];
         systemd.services."esdm-server".wantedBy = [ "basic.target" ];
+        systemd.services."esdm-kernel-seeder".wantedBy = [ "basic.target" ];
       }
       # It is necessary to set those options for these services to be started by systemd in NixOS
       (lib.mkIf cfg.enableLinuxCompatServices {
@@ -64,7 +65,6 @@ in
   );
 
   meta.maintainers = with lib.maintainers; [
-    orichter
     thillux
   ];
 }