Merge master into staging-nixos

2026-07-06 17:13:24 -05:00 · 2026-07-04 12:14:15 +00:00 · 2026-07-04 12:14:15 +00:00 · 58203ceb74
commit 58203ceb74
parent 7668d1321c 437d419a80
92 changed files with 1554 additions and 269 deletions
--- a/nixos/modules/services/matrix/matrix-authentication-service.nix
+++ b/nixos/modules/services/matrix/matrix-authentication-service.nix
@ -11,16 +11,15 @@ let
    filter
    filterAttrs
    getExe
+    getExe'
    isAttrs
    isList
    mapAttrs
-    mkDefault
    mkEnableOption
    mkIf
    mkOption
    mkPackageOption
    optional
-    optionalAttrs
    types
    ;

@ -45,6 +44,11 @@ let
    else
      pruned;
  configFile = format.generate "config.yaml" finalSettings;
+
+  extraConfigFiles = lib.imap0 (
+    i: _: "$CREDENTIALS_DIRECTORY/config-${toString i}"
+  ) cfg.extraConfigFiles;
+  runtimeConfig = "/run/matrix-authentication-service/config.yaml";
 in
 {
  meta.maintainers = with lib.maintainers; [
@ -370,6 +374,23 @@ in
        such as the Matrix homeserver if it's running on the same host.
      '';
    };
+
+    credentials = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      description = ''
+        Mapping of credential name to  source file-path. Exposed to the unit via LoadCredential and
+        readable inside the service at `''${CREDENTIALS_DIRECTORY}/<name>`.
+
+        For example:
+
+        ```
+        services.matrix-authentication-service.credentials."synapse-secret" = "/run/agenix/synapse-shared";
+        services.matrix-authentication-service.settings.matrix.secret_file =
+          "\''${CREDENTIALS_DIRECTORY}/synapse-secret";
+        ```
+      '';
+    };
  };

  config = mkIf cfg.enable {
@ -390,13 +411,20 @@ in
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        DynamicUser = true;
-        ExecStartPre = ''
-          ${getExe cfg.package} config check \
-            ${concatMapStringsSep " " (x: "--config ${x}") ([ configFile ] ++ cfg.extraConfigFiles)}
+        LoadCredential =
+          (lib.imap0 (i: path: "config-${toString i}:${path}") cfg.extraConfigFiles)
+          ++ (lib.mapAttrsToList (name: path: "${name}:${path}") cfg.credentials);
+        ExecStartPre = pkgs.writeShellScript "mas-prepare" ''
+          ${getExe' pkgs.gettext "envsubst"} \
+            '$CREDENTIALS_DIRECTORY' \
+            < ${configFile} \
+            > /run/matrix-authentication-service/config.yaml
+          ${getExe cfg.package} config check --config ${runtimeConfig} \
+            ${concatMapStringsSep " " (x: "--config ${x}") extraConfigFiles}
        '';
        ExecStart = ''
-          ${getExe cfg.package} server \
-            ${concatMapStringsSep " " (x: "--config ${x}") ([ configFile ] ++ cfg.extraConfigFiles)}
+          ${getExe cfg.package} server --config ${runtimeConfig} \
+            ${concatMapStringsSep " " (x: "--config ${x}") extraConfigFiles}
        '';
        Restart = "on-failure";
        RestartSec = "1s";
@ -438,6 +466,7 @@ in
        # Working and state directories
        StateDirectory = "matrix-authentication-service";
        StateDirectoryMode = "0700";
+        RuntimeDirectory = "matrix-authentication-service";
        WorkingDirectory = "/var/lib/matrix-authentication-service";
      };
    };
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -1691,9 +1691,7 @@ in
      )
    );

-    environment.etc."nginx/nginx.conf" = mkIf cfg.enableReload {
-      source = configFile;
-    };
+    environment.etc."nginx/nginx.conf".source = configFile;

    security.acme.certs =
      let
--- a/nixos/tests/matrix/matrix-authentication-service.nix
+++ b/nixos/tests/matrix/matrix-authentication-service.nix
@ -237,13 +237,14 @@ in
              {
                id = masULID;
                client_id = oidcClientID;
-                client_secret = oidcClientSecret;
+                client_secret_file = "\${CREDENTIALS_DIRECTORY}/oidc_client_secret";
                issuer = "https://${dexDomain}:5556";
                scope = "openid email profile";
                token_endpoint_auth_method = "client_secret_post";
              }
            ];
          };
+          credentials.oidc_client_secret = "${pkgs.writeText "oidc-client-secret" oidcClientSecret}";
        };
        services.postgresql.authentication = pkgs.lib.mkOverride 10 ''
          local all all trust
--- a/pkgs/by-name/an/anyk/package.nix
+++ b/pkgs/by-name/an/anyk/package.nix
@ -36,7 +36,7 @@ let

    src = lib.sources.sourceFilesBySuffices ./. [ "pom.xml" ];

-    mvnHash = "sha256-4keHPzS8pbIIwODmBUMofJt27n5WqYh+IGqE6d9od7k=";
+    mvnHash = "sha256-6pezqcTIPR5NYFQUmLZ5Y3TOd+XRcB/eRmNSAEoBmls=";

    installPhase = ''
      mkdir -p $out/share/java
--- a/pkgs/by-name/au/autopush-rs/package.nix
+++ b/pkgs/by-name/au/autopush-rs/package.nix
@ -47,7 +47,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "autopush";
-  version = "1.81.3";
+  version = "1.82.1";

  __structuredAttrs = true;
  strictDeps = true;
@ -61,10 +61,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "mozilla-services";
    repo = "autopush-rs";
    tag = finalAttrs.version;
-    hash = "sha256-DP02mcEMoQoJqi5rw5eSuep0i7zeJ0LLYsakikt9hho=";
+    hash = "sha256-wOnuYh18q2XDAcCUBGsidAMvOi10s4njVKDLhtNJEoU=";
  };

-  cargoHash = "sha256-LqmuUtFF30TO6iw7LPFB7yJGrzrhh7R0OKCWMhe/OjU=";
+  cargoHash = "sha256-FiMEDc2wxQPkM50cNKzP8yo90HGMakn6JUl/xheaciQ=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/cl/clickhouse/lts.nix
+++ b/pkgs/by-name/cl/clickhouse/lts.nix
@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.3.15.4-lts";
-  rev = "3c767441a1ed9b5828b94806d87a25501d1f7364";
-  hash = "sha256-7vhnUjmZtHm2v8a7w2gBxgFz153kbbUi94oy04vheLo=";
+  version = "26.3.17.4-lts";
+  rev = "00f5ad7bc29d8bb65e1f7eb24208da15db3cf642";
+  hash = "sha256-RJSqcsn3ZOL145RTUs4QujPm6DHjDSYiL9jI1C1YCVE=";
  lts = true;
 }
--- a/pkgs/by-name/co/cockpit-zfs/package.nix
+++ b/pkgs/by-name/co/cockpit-zfs/package.nix
@ -15,7 +15,7 @@
  mbuffer,
  msmtp,
  nix-update-script,
-  nodejs,
+  nodejs_22,
  openssh,
  samba,
  shadow,
@ -27,6 +27,22 @@
  yarn-berry,
  zfs,
 }:
+let
+  # Pin to Node <24.15.0: Yarn Berry's PnP linker breaks `require.cache` on
+  # newer Node, which crashes tailwindcss mid-build (and ESLint, per
+  # yarnpkg/berry#7106). See NixOS/nixpkgs#530137.
+  #
+  # `nodejs` is rebound here (rather than touched at every call site below)
+  # so the rest of this file is unaffected.
+  #
+  # yarn-berry's own `yarn` binary gets patchShebang'd against whatever
+  # `nodejs` *it* was built with, so overriding nativeBuildInputs alone does
+  # nothing - we have to rebuild yarn-berry itself against nodejs_22, for
+  # both the host and build-platform (cross-compilation) variants.
+  nodejs = nodejs_22;
+  yarnBerry = yarn-berry.override { inherit nodejs; };
+  yarnBerryForBuild = buildPackages.yarn-berry.override { nodejs = buildPackages.nodejs_22; };
+in

 stdenv.mkDerivation (finalAttrs: {
  pname = "cockpit-zfs";
@ -49,17 +65,17 @@ stdenv.mkDerivation (finalAttrs: {
  missingHashes = ./missing-hashes.json;

  # Use buildPackages for cross-compilation support
-  offlineCache = buildPackages.yarn-berry.fetchYarnBerryDeps {
+  offlineCache = yarnBerryForBuild.fetchYarnBerryDeps {
    inherit (finalAttrs) src missingHashes patches;
    hash = "sha256-Tdxe5bXN9psSrnUXL1f+1nh4WPzuvOI7j0I+VPU2/1s=";
  };

  nativeBuildInputs = [
    makeWrapper
-    nodejs
+    nodejs_22
    jq
-    yarn-berry
-    buildPackages.yarn-berry.yarnBerryConfigHook
+    yarnBerry
+    yarnBerryForBuild.yarnBerryConfigHook
  ];

  disallowedRequisites = [ finalAttrs.offlineCache ];
@ -76,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
    lsscsi
    mbuffer
    msmtp
-    nodejs
+    nodejs_22
    openssh
    samba
    shadow
--- a/pkgs/by-name/co/commafeed/package.nix
+++ b/pkgs/by-name/co/commafeed/package.nix
@ -54,7 +54,7 @@ maven.buildMavenPackage {

  pname = "commafeed";

-  mvnHash = "sha256-jAU1zaTftMuB1WgOeFzU1i+fFHAw6JYxTGw2mY8VlQw=";
+  mvnHash = "sha256-P3pmU/ou/gErk91ANjD4QuBTldBPKHYtGJREJQVgde8=";
  mvnJdk = jdk25;

  mvnParameters = lib.escapeShellArgs [
--- a/pkgs/by-name/cr/credspy/package.nix
+++ b/pkgs/by-name/cr/credspy/package.nix
@ -0,0 +1,41 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "credspy";
+  version = "1.0.0-unstable-2026-06-22";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "RedByte1337";
+    repo = "CredSpy";
+    # https://github.com/RedByte1337/CredSpy/issues/2
+    rev = "0fa54595fd6e5d1f903d8d248a7e9f3203e7ec09";
+    hash = "sha256-PHSLke90obZw2cwY7zqp1DNnG26Hf+ixHunMwQHoU3o=";
+  };
+
+  build-system = with python3Packages; [ hatchling ];
+
+  dependencies = with python3Packages; [ requests ];
+
+  pythonImportsCheck = [ "credspy" ];
+
+  # Project has no tests
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Entra ID user enumeration and auth method discovery";
+    homepage = "https://github.com/RedByte1337/CredSpy";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "credspy";
+  };
+})
--- a/pkgs/by-name/cr/cryptomator-cli/package.nix
+++ b/pkgs/by-name/cr/cryptomator-cli/package.nix
@ -27,7 +27,7 @@ maven.buildMavenPackage rec {

  mvnJdk = jdk;
  mvnParameters = "-Dmaven.test.skip=true";
-  mvnHash = "sha256-54DT4C+WzyUBPxayA9YnB9I/Igd19iZygByUh5of51I=";
+  mvnHash = "sha256-oMfgWQ6mID1me0OP+BIwGJShCV5r/ahHlcAJ+S1KRBA=";

  env = {
    APP_VERSION = version;
--- a/pkgs/by-name/de/dependency-track/package.nix
+++ b/pkgs/by-name/de/dependency-track/package.nix
@ -84,7 +84,7 @@ maven.buildMavenPackage rec {
  '';

  mvnJdk = jre_headless;
-  mvnHash = "sha256-4N4KuJBF/RFZwpp3dIgXntxSEfKHyfvrShKQoUqY5bE=";
+  mvnHash = "sha256-eZuwBt+emThf4mxVaphFgBWNqP64Cs9WIKW+GPvHll4=";
  manualMvnArtifacts = [
    "com.coderplus.maven.plugins:copy-rename-maven-plugin:1.0.1"
    # added to saticfy protobuf compiler plugin dependency resolving
--- a/pkgs/by-name/di/digital/package.nix
+++ b/pkgs/by-name/di/digital/package.nix
@ -52,7 +52,7 @@ maven.buildMavenPackage rec {
  };

  inherit mvnParameters;
-  mvnHash = "sha256-wm/axWJucoW9P98dKqHI4bjrUnmBTfosCOdJg9VBJ+4=";
+  mvnHash = "sha256-qFJvpxK6PDmMfeL5fKVHUzK2NRLcQhQ3PJbwv2hYZqY=";

  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/by-name/dn/dnsproxy/package.nix
+++ b/pkgs/by-name/dn/dnsproxy/package.nix
@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "dnsproxy";
-  version = "0.81.4";
+  version = "0.82.1";

  src = fetchFromGitHub {
    owner = "AdguardTeam";
    repo = "dnsproxy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KHun1/Da6wfOuMc9D8AJrgZg5PwuXAY6IVajSHa3rRE=";
+    hash = "sha256-d/PZrfH8jR4kcBX5Ze/06vDcDTlKWxHZ2gvi7eJF2j8=";
  };

-  vendorHash = "sha256-dcT9miAerC7c9LsC8FoR61xFXLZjxm7LZlTRalB4oSU=";
+  vendorHash = "sha256-QsNhCfqhqPv01xM/ojO3K4ktyTrUgdR79cQICtP2y1g=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/do/doctoc/package.nix
+++ b/pkgs/by-name/do/doctoc/package.nix
@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "doctoc";
-  version = "2.2.0";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "thlorenz";
    repo = "doctoc";
    rev = "v${version}";
-    hash = "sha256-LYVxW8bZ4M87CmBvPyp4y0IeL9UFawwAKnUWHEWB5Gs=";
+    hash = "sha256-EmTZLy/eHtJ0Wi8EFP2lHdFKBut/8/aghRKZr1WHcNk=";
  };

-  npmDepsHash = "sha256-TbAnFpiN/v6xjQQznL/B180f0W48HPRqW21cO9XZhYA=";
+  npmDepsHash = "sha256-rY9acsWMcR6cf9k0/rSoBvhuk96Yj8Yt8uhsC8dyQZU=";

  postInstall = ''
    find $out/lib/node_modules -xtype l -delete
--- a/pkgs/by-name/dr/drupal/package.nix
+++ b/pkgs/by-name/dr/drupal/package.nix
@ -8,18 +8,18 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "drupal";
-  version = "11.3.13";
+  version = "11.4.0";

  src = fetchFromGitLab {
    domain = "git.drupalcode.org";
    owner = "project";
    repo = "drupal";
    tag = finalAttrs.version;
-    hash = "sha256-t60EbgN3r9KmSyZcvLtUy+H4eRizqFyI3bLFHH1/ciY=";
+    hash = "sha256-om+WoR+uIGhHjttWpavBx3PJ4HUft4Hjtrr4F3csBsI=";
  };

  composerNoPlugins = false;
-  vendorHash = "sha256-DaKWrdFNHppZm4a8wexfwapSPDhlNL45ftVQ+YSY18s=";
+  vendorHash = "sha256-9MQ6C0gslubUlDeUSI5Tv4jO9SbxPzciOjry0KB7plI=";

  passthru = {
    tests = {
--- a/pkgs/by-name/ex/exificient/package.nix
+++ b/pkgs/by-name/ex/exificient/package.nix
@ -17,7 +17,7 @@ maven.buildMavenPackage rec {
    hash = "sha256-XrlZQf2BamYw8u1S2qQ6jV9mgyCEjBxKqPZCXMJzXmc=";
  };

-  mvnHash = "sha256-/72Pi8WbKhPXu7Zb9r30znY1FHJc7FM42f7uQJqJnWo=";
+  mvnHash = "sha256-8q8voXYxOhWcb3U2Nqg/LRhSru94puhymQa7Z9FR0+g=";

  mvnParameters = "package assembly:single -Dmaven.test.skip=true";

--- a/pkgs/by-name/fi/filius/package.nix
+++ b/pkgs/by-name/fi/filius/package.nix
@ -19,7 +19,7 @@ maven.buildMavenPackage rec {
    hash = "sha256-sIcYjbWONg8Cq+dHpoBYj07cyHV7oX06Xh1zK0CHn64=";
  };

-  mvnHash = "sha256-/gA49V1Kjh4zJTzDCzFNwZF30ERwPk2lG6lw/jxM2Qo=";
+  mvnHash = "sha256-41NirfgR9EhHLRT3V6P5KrakYKZ6dJTlXZu6rgCAK3I=";
  mvnParameters = "-Plinux";

  # tests want to create an X11 window which isn't often feasible
--- a/pkgs/by-name/fo/fop/package.nix
+++ b/pkgs/by-name/fo/fop/package.nix
@ -18,7 +18,7 @@ maven.buildMavenPackage (finalAttrs: {

  patches = [ ./fix-maven-plugin-versions.patch ];

-  mvnHash = "sha256-EaOIAy0+YPrF+yGsFKKqcA4bt90bq1Z86V57P9rMatE=";
+  mvnHash = "sha256-KfIcc1MWGs7vZHPjfNgy3NBCAyTMtyvRTZfcN4LQVv8=";

  buildOffline = true;
  doCheck = false;
--- a/pkgs/by-name/go/gol/package.nix
+++ b/pkgs/by-name/go/gol/package.nix
@ -17,7 +17,7 @@ maven.buildMavenPackage rec {
    hash = "sha256-AnPm5Mooww9kAMWLnM36z8DVRGfIIEiqUE65tgNuKm8=";
  };

-  mvnHash = "sha256-YD28YX0RKuxOEWuK12ToOnFFrUPqA9xZ+EmsCt1fDPI=";
+  mvnHash = "sha256-kLSMLt0TMMuyWLU65Y+4CpEn5PIm/+nLg1+oBR5w3pI=";
  mvnParameters = "compile assembly:single -Dmaven.test.skip=true";

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/gr/graphhopper/version.toml
+++ b/pkgs/by-name/gr/graphhopper/version.toml
@ -5,4 +5,4 @@ mapsBundle = "0.0.0-f171bcf55e447bf494348dd274cd377b73c951f6"
 [hash]
 src = "sha256-tK8zEX2szcU77ydHW+ak/GTjKKC6C5xlG0Uum7a/76I="
 mapsBundle = "sha256-ehwWBIuYBwXu7W7uHYYuGl0lS4s6Tm5c4BfKPkY+w0A="
-mvnDeps = "sha256-0B38C37QbkOhxd5e4SHfMg9SqcUZkuIf1g1S9SnCu7U="
+mvnDeps = "sha256-bP019enDiHdKVtXvFXvBmsg9CtDTXA1t3VVjX3Xf8M0="
--- a/pkgs/by-name/h2/h2/package.nix
+++ b/pkgs/by-name/h2/h2/package.nix
@ -24,7 +24,7 @@ maven.buildMavenPackage (finalAttrs: {
  };

  mvnParameters = "-f h2/pom.xml";
-  mvnHash = "sha256-ue1X0fswi3C9uqJ/cVCf/qd2XStMve1k1qA+IsREOGk=";
+  mvnHash = "sha256-j4Uso/bl4UhQbJc7Wre0btgC+9RKvuCHkn9euQFuTxk=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/ha/hacksguard/package.nix
+++ b/pkgs/by-name/ha/hacksguard/package.nix
@ -0,0 +1,41 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hacksguard";
+  version = "0.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Rhacknarok";
+    repo = "hacksguard";
+    tag = finalAttrs.version;
+    hash = "sha256-kS8VF1zD4VV9rSLz4euvNwtOUFWLeW2isAjgjw/iay0=";
+  };
+
+  cargoHash = "sha256-7Wt2cFKwWT82P2uxOy/lGEWZcCUSu0BNr9JdgRLwBnw=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Multi-threaded TUI malware analysis tool";
+    homepage = "https://github.com/Rhacknarok/hacksguard";
+    changelog = "https://github.com/Rhacknarok/hacksguard/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "hacksguard";
+  };
+})
--- a/pkgs/by-name/im/immich-kiosk/package.nix
+++ b/pkgs/by-name/im/immich-kiosk/package.nix
@ -3,68 +3,61 @@
  buildGoModule,
  fetchFromGitHub,
  nodejs,
-  pnpm_9,
-  fetchPnpmDeps,
-  pnpmConfigHook,
+  fetchNpmDeps,
+  npmHooks,
+  go-task,
 }:
+
 buildGoModule rec {
  pname = "immich-kiosk";
-  version = "0.31.0";
+  version = "0.39.3";

  src = fetchFromGitHub {
    owner = "damongolding";
    repo = "immich-kiosk";
    tag = "v${version}";
-    hash = "sha256-PHdHhhVy0RWMFzR4ZEyWLOiRYHROadLiPIdqkUZMTow=";
+    hash = "sha256-kdTEvH8MqL3oXe0QZlPTVpeByLpqAdNfPGfu5f2G6g0=";
  };

-  # Delete vendor directory to regenerate it consistently across platforms
  postPatch = ''
+    # Delete vendor directory to regenerate it consistently across platforms
    rm -rf vendor
+    # immich-kiosk bumps go at a faster cadence than nixpkgs
+    sed 's/^go 1\.26\.\d+$/go 1.26/' go.mod
  '';
-  vendorHash = "sha256-3M3fXwCkljfY8wjXf+PdcbqnkyPKaDCJWt9/nRA/+Dc=";
+  vendorHash = "sha256-y6Xl00G+mkhRKVGwMS0WCXZhQqqGGX5qY8PhMxtw7z8=";
  proxyVendor = true;

-  pnpmDeps = fetchPnpmDeps {
-    inherit
-      pname
-      version
-      src
-      ;
-    pnpm = pnpm_9;
+  npmDeps = fetchNpmDeps {
+    inherit src;
    sourceRoot = "${src.name}/frontend";
-    hash = "sha256-8iKug4zsX3u0vS68osKRW6iOP+A3OdjI3yxNPIJaQqM=";
-    fetcherVersion = 3;
+    hash = "sha256-lNON0/lxix2aczC0+m7Er5Te1+4fsSoLkk6Z2pYzQYQ=";
  };
-
  # Frontend is in a subdirectory
-  pnpmRoot = "frontend";
+  npmRoot = "frontend";

  nativeBuildInputs = [
    nodejs
-    pnpmConfigHook
-    pnpm_9
+    go-task
+    npmHooks.npmConfigHook
  ];

  # Generate templ templates during vendor hash calculation
-  # Don't run pnpm in this phase - filter out pnpmConfigHook
+  # Don't run npm in this phase - filter out npmConfigHook
  overrideModAttrs = oldAttrs: {
-    nativeBuildInputs = builtins.filter (drv: drv != pnpmConfigHook) (
+    nativeBuildInputs = builtins.filter (drv: drv != npmHooks.npmConfigHook) (
      oldAttrs.nativeBuildInputs or [ ]
    );
    preBuild = ''
-      go run github.com/a-h/templ/cmd/templ generate
+      go tool templ generate
    '';
  };

  # Generate templ templates and build frontend assets before Go build
  # Frontend assets are embedded into the binary via go:embed
  preBuild = ''
-    go run github.com/a-h/templ/cmd/templ generate
-
-    pushd frontend
-    pnpm build
-    popd
+    go tool templ generate
+    task frontend
  '';

  ldflags = [
--- a/pkgs/by-name/ir/iredis/package.nix
+++ b/pkgs/by-name/ir/iredis/package.nix
@ -1,34 +1,34 @@
 {
  lib,
  stdenv,
-  python3,
+  python3Packages,
  fetchFromGitHub,
+  versionCheckHook,
 }:

-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "iredis";
-  version = "1.15.2";
+  version = "1.16.1";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "laixintao";
    repo = "iredis";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-g/gQb9QOyfa7kyHCUZf/kLZRO5IE8389BUCYz8Sqr8o=";
+    hash = "sha256-m8XDNzHgMWBgcN3AyFlb8K/UNXbGhH4toKBiX5Q4/QY=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail 'packaging = "^23.0"' 'packaging = "*"' \
-      --replace-fail 'wcwidth = "0.1.9"' 'wcwidth = "*"' \
-      --replace-fail 'redis = "^5.0.0"' 'redis = "*"'
-  '';
+  pythonRelaxDeps = [
+    "packaging"
+    "redis"
+  ];

-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3Packages; [
    poetry-core
  ];

-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3Packages; [
    click
    configobj
    mistune
@ -37,10 +37,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    pygments
    python-dateutil
    redis
-    wcwidth
  ];

-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python3Packages; [
    freezegun
    pexpect
    pytestCheckHook
@ -65,6 +64,11 @@ python3.pkgs.buildPythonApplication (finalAttrs: {

  pythonImportsCheck = [ "iredis" ];

+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
  meta = {
    description = "Terminal Client for Redis with AutoCompletion and Syntax Highlighting";
    changelog = "https://github.com/laixintao/iredis/blob/${finalAttrs.src.tag}/CHANGELOG.md";
--- a/pkgs/by-name/ja/java-language-server/package.nix
+++ b/pkgs/by-name/ja/java-language-server/package.nix
@ -32,7 +32,7 @@ maven.buildMavenPackage {

  mvnFetchExtraArgs.dontConfigure = true;
  mvnJdk = jdk_headless;
-  mvnHash = "sha256-2uthmSjFQ43N5lgV11DsxuGce+ZptZsmRLTgjDo0M2w=";
+  mvnHash = "sha256-xxTR+2E+4nIkGwxCk0B+f0//rLdlqO/nwRaArxt3u8U=";

  nativeBuildInputs = [
    jdk_headless
--- a/pkgs/by-name/jc/jchempaint/package.nix
+++ b/pkgs/by-name/jc/jchempaint/package.nix
@ -22,7 +22,7 @@ maven.buildMavenPackage {
    hash = "sha256-pcHX6PdnD/jkLxAMSV/Ts8VVrK9xy2NWiMVVJ7jTrQc=";
  };

-  mvnHash = "sha256-VpYSTN5u9IhCakak48HhbwnT3FhMpPKlwRZztiNGEIw=";
+  mvnHash = "sha256-L5Gru4b8lMiDWapzaK9VXoKqRkJnXc1uKUn5Vjmnrqc=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/jm/jmc2obj/package.nix
+++ b/pkgs/by-name/jm/jmc2obj/package.nix
@ -18,7 +18,7 @@ maven.buildMavenPackage rec {
    hash = "sha256-3+vH1pGJ6I4oobb2vk+J5GrOQrSLNoCuBIC9OsWYCj0=";
  };

-  mvnHash = "sha256-ZU/5RGujCdmlBuxtHDaBpF/54e8W/Kca+2jtTudMXWo=";
+  mvnHash = "sha256-y+K6FR0USh4LUyv/w5n3pRVILtMRKg64+3D7yfE1IP8=";

  mvnParameters = "-Dmaven.gitcommitid.skip=true";

--- a/pkgs/by-name/jn/jnr-posix/package.nix
+++ b/pkgs/by-name/jn/jnr-posix/package.nix
@ -45,7 +45,7 @@ let
    '';

    outputHashMode = "recursive";
-    outputHash = "sha256-gOw0KUFyZEMONwLwlHSiV+ZZ7JQhjZwg708Q1IciUfo=";
+    outputHash = "sha256-Mtu67CcNY5uThfaa7CQr9cHHpjX+EMFktuSZOlLwyFg=";

    doCheck = false;
  };
--- a/pkgs/by-name/jo/jol/package.nix
+++ b/pkgs/by-name/jo/jol/package.nix
@ -17,7 +17,7 @@ maven.buildMavenPackage (finalAttrs: {
    hash = "sha256-ZJFuY2QYB8eUS3y3VRMGGwklCS93HHVkNe/dhyIx0SY=";
  };

-  mvnHash = "sha256-yQfiHlAZZgINGAYVlK5JflWX3d8Axtv1Ke89S7x86G4=";
+  mvnHash = "sha256-VXYY7XWRuSjju9mgQ6cvHlJwOK2BklE9j/uj0yczjcI=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/jo/joularjx/package.nix
+++ b/pkgs/by-name/jo/joularjx/package.nix
@ -17,7 +17,7 @@ maven.buildMavenPackage rec {
    hash = "sha256-hr8a3Qr1LdFfGBLVJVkm6hhCW7knG4VpXj7nCtcptuU=";
  };

-  mvnHash = "sha256-3y39873pxlQD7d02sbVtZ2I/zcQtPZ30XrA2qY84EzA=";
+  mvnHash = "sha256-XXqpajmHCjDxMZvYnW7EiCsPIuWF8tsE7RmI/gt3iZQ=";

  mvnParameters = "-DskipTests -Dmaven.javadoc.skip=true";

--- a/pkgs/by-name/js/jsign/package.nix
+++ b/pkgs/by-name/js/jsign/package.nix
@ -18,16 +18,16 @@ maven.buildMavenPackage rec {
  pname = "jsign";
  # For build from non-release, increment version by one and add -SNAPSHOT
  # e.g. 7.3-SNAPSHOT
-  version = "7.3";
+  version = "7.4";

  src = fetchFromGitHub {
    owner = "ebourg";
    repo = "jsign";
    tag = version;
-    hash = "sha256-FlVTKM1swdNP3kht8MELgUAHPv+FBpwt23WNl/moGjI=";
+    hash = "sha256-r19w9k6Iuk6AQGC3l2yu6Ocn740BtE7DjtFLXUdhdw8=";
  };

-  mvnHash = "sha256-N91gwM3vsDZQM/BptF5RgRQ/A8g56NOJ6bc2SkxLnBs=";
+  mvnHash = "sha256-zxlwb2id8yAw/yxTjD6jyAkPJx9IazrPQYGacQGLEK8=";

  nativeBuildInputs = [ makeBinaryWrapper ];

--- a/pkgs/by-name/ko/kotlin-interactive-shell/package.nix
+++ b/pkgs/by-name/ko/kotlin-interactive-shell/package.nix
@ -17,7 +17,7 @@ maven.buildMavenPackage (finalAttrs: {
    hash = "sha256-3DTyo7rPswpEVzFkcprT6FD+ITGJ+qCXFKXEGoCK+oE=";
  };

-  mvnHash = "sha256-UHtvBVw35QBwgCD+nSduR0924ANAOfwrr/a4qPEYsrM=";
+  mvnHash = "sha256-qGxpeb+8hP0ljbI0+aHnuO5efzXvVQWo8VFYMuRzYck=";
  mvnParameters = "compile";

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/le/lemminx/package.nix
+++ b/pkgs/by-name/le/lemminx/package.nix
@ -48,7 +48,7 @@ maven.buildMavenPackage rec {
  };

  mvnJdk = jdk_headless;
-  mvnHash = "sha256-0KnaXr5Mmwm0pV4o5bAX0MWKl6f/cvlO6cyV9UcgXeo=";
+  mvnHash = "sha256-IJBmztfNco5UF0BwfeU5QHwvr50bXsrZFOSIPoGBijA=";

  # Disable gitcommitid plugin which needs a .git folder which we don't have.
  # Disable failing tests which either need internet access or are flaky.
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@ -36,7 +36,7 @@ let

  pname = "librewolf-bin-unwrapped";

-  version = "152.0.2-1";
+  version = "152.0.4-1";
 in

 stdenv.mkDerivation {
@ -46,8 +46,8 @@ stdenv.mkDerivation {
    url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
    hash =
      {
-        x86_64-linux = "sha256-Tq2bj75oZXSH2YHXShjRRs4Aqxo86BuwONXu+IsdCuA=";
-        aarch64-linux = "sha256-xk3o5FODm5ge2I8JzgwXTpgu/SI6VcROIJ7005ew2PY=";
+        x86_64-linux = "sha256-4vmsv93ENtteE18uGJF2ZEhaRA3nGJg//WYYdBREIig=";
+        aarch64-linux = "sha256-Q1vT/9qOs2AiMRsLcofF7F2Y+5QJJloI/QSVZwA9gC8=";
      }
      .${stdenv.hostPlatform.system} or throwSystem;
  };
--- a/pkgs/by-name/ma/mariadb-connector-java/package.nix
+++ b/pkgs/by-name/ma/mariadb-connector-java/package.nix
@ -16,7 +16,7 @@ maven.buildMavenPackage rec {
    hash = "sha256-ScdrBSJKbVyD/omPrxiZvuaa5uOo2d3SqX/ozalMWHk=";
  };

-  mvnHash = "sha256-pQYLMsxNVdby4WkO/dznIqqeu2dTtiBjrpJ/A3MuJ5Y=";
+  mvnHash = "sha256-CiUXHrabVX+ragocKbd4erIWr7J4kuWYcKYCDycpIrs=";

  doCheck = false; # Requires networking

--- a/pkgs/by-name/ma/maven/package.nix
+++ b/pkgs/by-name/ma/maven/package.nix
@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "maven";
-  version = "3.9.12";
+  version = "3.9.16";

  src = fetchurl {
    url = "mirror://apache/maven/maven-3/${finalAttrs.version}/binaries/apache-maven-${finalAttrs.version}-bin.tar.gz";
-    hash = "sha256-+iyZSHKSlsI6/Rj9AakPYs3aCaRhkbVKi8N2TC7ugS4=";
+    hash = "sha256-gP/KIq7Z6LlxOiMvM5T9gdfyAyLfde/bKwR9vT46I7s=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/me/megabasterd/package.nix
+++ b/pkgs/by-name/me/megabasterd/package.nix
@ -19,7 +19,7 @@ maven.buildMavenPackage {
    hash = "sha256-6PKBzQA3lBa9/7J8bymGmnW3OPsRV4GgZ7dc7H6fOuE=";
  };

-  mvnHash = "sha256-DVfPmW0ep6y/GxnwNKXxo68W5idcTkoNqUEKm7ouTEY=";
+  mvnHash = "sha256-JZ8INISDHPVhxylKwQc2DybPqxfwcGpkWxDhq8Fpqt8=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@ -22,16 +22,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mise";
-  version = "2026.6.13";
+  version = "2026.7.0";

  src = fetchFromGitHub {
    owner = "jdx";
    repo = "mise";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/HE/2bHUz1gPpyLZnKZO5ZqT5oxOn+SZ0J4vyj67Ohs=";
+    hash = "sha256-F/hxgkqLk36906uhr56W+4Evwc8WLbYWw8pibGsq3EY=";
  };

-  cargoHash = "sha256-p7PCqwS0bI7kXvGYZm4bWpYhz1kkqILDCPGlEq32Cqo=";
+  cargoHash = "sha256-W88dlxvDEwN6C1j1WMtL/KodWQZ9UnI1VJc3xp1Lnqw=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/mm/mmj2/package.nix
+++ b/pkgs/by-name/mm/mmj2/package.nix
@ -25,7 +25,7 @@ maven.buildMavenPackage {
    hash = "sha256-WYBrLY04+bJGzjRMs8LgHnI6lMRhQKyz15DIoLeiE2s=";
  };

-  mvnHash = "sha256-fu/q6CTvSllrfgnKNX6aIuPO65H/q0IPCHFuWmOFOvM=";
+  mvnHash = "sha256-MTI393L/t9AXYbE9hvkIQ28WzYmjt9B22XbFSlLQQUk=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/mo/mo-viewer/package.nix
+++ b/pkgs/by-name/mo/mo-viewer/package.nix
@ -14,13 +14,13 @@

 buildGoModule (finalAttrs: {
  pname = "mo-viewer";
-  version = "1.6.2";
+  version = "1.6.3";

  src = fetchFromGitHub {
    owner = "k1LoW";
    repo = "mo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/dUAz55hsDYV+1rgNN52rdO798SCRyIyHXrL/ZGTwmY=";
+    hash = "sha256-DbcktOAdcg/v5q3gYgxMvSHVtwXODz9xHoPqiiWBaP4=";
  };

  frontend = stdenvNoCC.mkDerivation (finalFrontendAttrs: {
--- a/pkgs/by-name/mu/mustang-cli/package.nix
+++ b/pkgs/by-name/mu/mustang-cli/package.nix
@ -32,7 +32,7 @@ maven.buildMavenPackage (finalAttrs: {
  strictDeps = true;
  __structuredAttrs = true;

-  mvnHash = "sha256-ekSgGKY3OMFAEM3bNByBXrU3tpbDcbJ0fmCTRz7NIkA=";
+  mvnHash = "sha256-JjhKHcnLO6OZ6VAI7fFpvS90TK6yOVhX0wk4vrnbFFo=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/nz/nzbhydra2/package.nix
+++ b/pkgs/by-name/nz/nzbhydra2/package.nix
@ -44,7 +44,7 @@ maven.buildMavenPackage rec {
    hash = "sha256-A6Q6UoeyuOZP4FD4Y6oVOCu1a2bbIe+3xVHQIuOg0qk=";
  };

-  mvnHash = "sha256-mZ/mOF9k5URheNNxmrKkCiklP26zeTGKhDGxqRiDBuk=";
+  mvnHash = "sha256-mPNyJ4zijwQg8l0G+2cJPkwAVRFVbpCRfyFkA5ONBIE=";

  mvnFetchExtraArgs.preBuild = ''
    mvn -nsu "${timestampParameter}" --projects org.nzbhydra:github-release-plugin "-Dmaven.repo.local=$out/.m2" clean install
--- a/pkgs/by-name/op/open-pdf-sign/package.nix
+++ b/pkgs/by-name/op/open-pdf-sign/package.nix
@ -26,7 +26,7 @@ maven.buildMavenPackage rec {
    sed -i '/dirtyQualifier/d' ./pom.xml
  '';

-  mvnHash = "sha256-oEAvqgH4/vfywPHUfbrIpOIdbeqt+K4H+Pebx5EQqMA=";
+  mvnHash = "sha256-2+6OU1CysNfGnESvAUbqK9RvRDlgIiWGuGC9sHza39c=";

  # Disable test requires the network, we also set the version
  mvnParameters = lib.escapeShellArgs [
--- a/pkgs/by-name/op/openapi-generator-cli/package.nix
+++ b/pkgs/by-name/op/openapi-generator-cli/package.nix
@ -52,7 +52,7 @@ let
      })
    ];

-    mvnHash = "sha256-iWVWVEiwvCwc0ayVjH9joiDchyyNUOhEZjJTMH9CCEE=";
+    mvnHash = "sha256-oJnXNHAYZxWi9YDHw+RR1HWf7hlTKoZmnDIHxXNpp1M=";
    mvnParameters = "-Duser.home=$TMPDIR";
    doCheck = false;

--- a/pkgs/by-name/op/opendataloader-pdf/package.nix
+++ b/pkgs/by-name/op/opendataloader-pdf/package.nix
@ -22,7 +22,7 @@ maven.buildMavenPackage (finalAttrs: {

  sourceRoot = "${finalAttrs.src.name}/java";

-  mvnHash = "sha256-LK673DYibhntPsHXvCM676ZzsE7tYIWPlQ2LFoCVvpc=";
+  mvnHash = "sha256-TWp/vlxqlK+8zqDzQySBKpLRUpLCG7Oa1C/1dIlwmsw=";
  mvnParameters = "-Dproject.build.outputTimestamp=1980-01-01T00:00:02Z";

  nativeBuildInputs = [
--- a/pkgs/by-name/op/openrefine/package.nix
+++ b/pkgs/by-name/op/openrefine/package.nix
@ -56,7 +56,7 @@ maven.buildMavenPackage {

  mvnJdk = jdk;
  mvnParameters = "-pl !packaging";
-  mvnHash = "sha256-SV5nfyUeyRul/YfZZXor8O37ARdCtKkrHCLzQrmr96s=";
+  mvnHash = "sha256-95lyc+pimtSM6v8S58bLG16/TotbHGa4EhHDzfxwPAk=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/op/opensplat/package.nix
+++ b/pkgs/by-name/op/opensplat/package.nix
@ -20,20 +20,22 @@
  fetchpatch2,
 }:
 let
-  version = "1.1.4";
  torch = python3.pkgs.torch.override { inherit cudaSupport rocmSupport; };
  # Using a normal stdenv with cuda torch gives
  # ld: /nix/store/k1l7y96gv0nc685cg7i3g43i4icmddzk-python3.11-torch-2.2.1-lib/lib/libc10.so: undefined reference to `std::ios_base_library_init()@GLIBCXX_3.4.32'
  stdenv' = if cudaSupport then cudaPackages.backendStdenv else stdenv;
 in
-stdenv'.mkDerivation {
+stdenv'.mkDerivation (finalAttrs: {
  pname = "opensplat";
-  inherit version;
+  version = "1.1.4";
+
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "pierotofy";
    repo = "OpenSplat";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-u2UmD0O3sUWELYb4CjQE19i4HUjLMcaWqOinQH0PPTM=";
  };

@ -44,24 +46,34 @@ stdenv'.mkDerivation {
    })
  ];

-  postPatch = lib.optionalString rocmSupport ''
-        # ROCm CMake targets must be available before find_package(Torch)
-        # because Torch's Caffe2Targets.cmake references them in torch_hip_library
-        substituteInPlace CMakeLists.txt \
-          --replace-fail "find_package(Torch REQUIRED)" \
-            "find_package(hip REQUIRED)
-    find_package(hiprtc REQUIRED)
-    find_package(hipblas REQUIRED)
-    find_package(hipfft REQUIRED)
-    find_package(hiprand REQUIRED)
-    find_package(hipsparse REQUIRED)
-    find_package(hipsolver REQUIRED)
-    find_package(hipblaslt REQUIRED)
-    find_package(rocblas REQUIRED)
-    find_package(rocsolver REQUIRED)
-    find_package(miopen REQUIRED)
-    find_package(Torch REQUIRED)"
-  '';
+  postPatch = lib.optionalString rocmSupport (
+    # Recent PyTorch HIP builds no longer hipify the caching allocator namespace:
+    # the symbol stays c10::cuda::CUDACachingAllocator instead of c10::hip::HIPCachingAllocator.
+    ''
+      substituteInPlace model.cpp \
+        --replace-fail \
+          "c10::hip::HIPCachingAllocator::emptyCache();" \
+          "c10::cuda::CUDACachingAllocator::emptyCache();"
+    ''
+    # ROCm CMake targets must be available before find_package(Torch)
+    # because Torch's Caffe2Targets.cmake references them in torch_hip_library
+    + ''
+          substituteInPlace CMakeLists.txt \
+            --replace-fail "find_package(Torch REQUIRED)" \
+              "find_package(hip REQUIRED)
+      find_package(hiprtc REQUIRED)
+      find_package(hipblas REQUIRED)
+      find_package(hipfft REQUIRED)
+      find_package(hiprand REQUIRED)
+      find_package(hipsparse REQUIRED)
+      find_package(hipsolver REQUIRED)
+      find_package(hipblaslt REQUIRED)
+      find_package(rocblas REQUIRED)
+      find_package(rocsolver REQUIRED)
+      find_package(miopen REQUIRED)
+      find_package(Torch REQUIRED)"
+    ''
+  );

  nativeBuildInputs = [
    cmake
@ -107,7 +119,11 @@ stdenv'.mkDerivation {
      NIX_LDFLAGS = "-L${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs"; # fixes -lcuda not found
    }
    // lib.optionalAttrs rocmSupport {
-      HIPFLAGS = "-I${lib.getInclude rocmPackages.rocthrust}/include -I${lib.getInclude rocmPackages.rocprim}/include";
+      PYTORCH_ROCM_ARCH = torch.gpuTargetString;
+      HIPFLAGS = toString [
+        "-I${lib.getInclude rocmPackages.rocprim}/include"
+        "-I${lib.getInclude rocmPackages.rocthrust}/include"
+      ];
    };

  cmakeFlags = [
@ -139,4 +155,4 @@ stdenv'.mkDerivation {
    ];
    platforms = lib.platforms.linux ++ lib.optionals (!cudaSupport) lib.platforms.darwin;
  };
-}
+})
--- a/pkgs/by-name/op/opentofu-mcp-server/package.nix
+++ b/pkgs/by-name/op/opentofu-mcp-server/package.nix
@ -4,15 +4,15 @@
  fetchFromGitHub,
  fetchPnpmDeps,
  nodejs,
-  nix-update-script,
-  pnpm_8,
+  pnpm_10,
  pnpmConfigHook,
  makeWrapper,
+  nix-update-script,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "opentofu-mcp-server";
-  version = "1.0.0";
+  version = "1.0.0-unstable-2026-06-09";

  __structuredAttrs = true;
  strictDeps = true;
@ -20,20 +20,20 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "opentofu";
    repo = "opentofu-mcp-server";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-qgjAnoduzAjvxgbgG8QW53CMF3/bW0NQhDbVv3ebntw=";
+    rev = "59ee379fff12389a25e75dc26768f8602e505a91";
+    hash = "sha256-pPeqlJ/M7ylD7bniVbw/HqsFkZywHISmzpqsQG0VhoU=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    fetcherVersion = 3;
-    pnpm = pnpm_8;
-    hash = "sha256-8U+yGjUtgpASLU5LewUMRFT0uxz45trw27+HH/h+sdA=";
+    fetcherVersion = 4;
+    pnpm = pnpm_10;
+    hash = "sha256-N9+sbSsae1wOmHkOQ1+Km97w7T+BLuZKdskWZs8c4kw=";
  };

  nativeBuildInputs = [
    nodejs
-    pnpm_8
+    pnpm_10
    pnpmConfigHook
    makeWrapper
  ];
@ -54,12 +54,14 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };

  meta = {
    description = "OpenTofu MCP server for accessing the OpenTofu Registry";
    homepage = "https://github.com/opentofu/opentofu-mcp-server";
-    changelog = "https://github.com/opentofu/opentofu-mcp-server/releases/tag/${finalAttrs.src.tag}";
+    changelog = "https://github.com/opentofu/opentofu-mcp-server/commits/main";
    license = lib.licenses.mpl20;
    maintainers = with lib.maintainers; [ eana ];
    mainProgram = "opentofu-mcp-server";
--- a/pkgs/by-name/po/polyglot/package.nix
+++ b/pkgs/by-name/po/polyglot/package.nix
@ -33,10 +33,16 @@ maven.buildMavenPackage rec {

  mvnHash =
    {
-      aarch64-linux = "sha256-Tlz2I6xE8g3GqKz9N7VXRO0ObE1XOv6IfTrKZmVlscY=";
-      x86_64-linux = "sha256-nQScNCkA+eaeL3tcLCec1qIoYO6ct28FLxGp/Cm4nn4=";
+      aarch64-linux = "sha256-o5dFk1pghCOaaxAto7e5kXn2mrVEGAtb9kTwQQN2N8o=";
+      x86_64-linux = "sha256-KYgeVBhqBjP6dqwpSzoqH8dfsL4WpJcSiHEMfgk0CNE=";
    }
    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  mvnFetchExtraArgs.env = {
+    inherit (env) SOURCE_DATE_EPOCH;
+  };
+
+  # fix for "date 1980-01-01T00:00:00Z is not within the valid range 1980-01-01T00:00:02Z to 2099-12-31T23:59:59Z"
+  env.SOURCE_DATE_EPOCH = 315532802; # 1980-01-01T00:00:02Z

  mvnParameters = "-DskipTests";

--- a/pkgs/by-name/pr/pretender/package.nix
+++ b/pkgs/by-name/pr/pretender/package.nix
@ -6,26 +6,26 @@

 buildGoModule (finalAttrs: {
  pname = "pretender";
-  version = "1.3.2";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "RedTeamPentesting";
    repo = "pretender";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-c8uXN7UMj6UZPVt2aNSg6mRex8w+u7J5I7TAB7MzEWg=";
+    hash = "sha256-NwGjW0WvMuoG4NxBL3ygGbZF5b8dLXJPbYMadLodR8s=";
  };

-  vendorHash = "sha256-UzKprzkxqG7FOPWcFQGuZtn+gHMeMy4jqCLUSdyO2l0=";
+  vendorHash = "sha256-pzyattaJQIzEgCheYBx6qJ95br6ApEk9RfBfAqrPkjI=";

  # Tests require network access
  doCheck = false;

  meta = {
    description = "Tool for handling machine-in-the-middle tasks";
-    mainProgram = "pretender";
    homepage = "https://github.com/RedTeamPentesting/pretender";
-    changelog = "https://github.com/RedTeamPentesting/pretender/releases/tag/v${finalAttrs.version}";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/RedTeamPentesting/pretender/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "pretender";
  };
 })
--- a/pkgs/by-name/pr/prometheus-alertmanager/elm-srcs.nix
+++ b/pkgs/by-name/pr/prometheus-alertmanager/elm-srcs.nix
@ -0,0 +1,82 @@
+{
+
+  "NoRedInk/elm-json-decode-pipeline" = {
+    sha256 = "0y25xn0yx1q2xlg1yx1i0hg4xq1yxx6yfa99g272z8162si75hnl";
+    version = "1.0.0";
+  };
+
+  "elm/browser" = {
+    sha256 = "1apmvyax93nvmagwj00y16zx10kfv640cxpi64xgqbgy7d2wphy4";
+    version = "1.0.0";
+  };
+
+  "elm/core" = {
+    sha256 = "10kr86h4v5h4p0586q406a5wbl8xvr1jyrf6097zp2wb8sv21ylw";
+    version = "1.0.0";
+  };
+
+  "elm/html" = {
+    sha256 = "1n3gpzmpqqdsldys4ipgyl1zacn0kbpc3g4v3hdpiyfjlgh8bf3k";
+    version = "1.0.0";
+  };
+
+  "elm/http" = {
+    sha256 = "1igmm89ialzrjib1j8xagkxalq1x2gj4l0hfxcd66mpwmvg7psl8";
+    version = "1.0.0";
+  };
+
+  "elm/json" = {
+    sha256 = "1g0hafkqf2q633r7ir9wxpb1lnlzskhpsyi0h5bkzj0gl072zfnb";
+    version = "1.0.0";
+  };
+
+  "elm/parser" = {
+    sha256 = "0a3cxrvbm7mwg9ykynhp7vjid58zsw03r63qxipxp3z09qks7512";
+    version = "1.1.0";
+  };
+
+  "elm/regex" = {
+    sha256 = "0lijsp50w7n1n57mjg6clpn9phly8vvs07h0qh2rqcs0f1jqvsa2";
+    version = "1.0.0";
+  };
+
+  "elm/time" = {
+    sha256 = "0vch7i86vn0x8b850w1p69vplll1bnbkp8s383z7pinyg94cm2z1";
+    version = "1.0.0";
+  };
+
+  "elm/url" = {
+    sha256 = "0av8x5syid40sgpl5vd7pry2rq0q4pga28b4yykn9gd9v12rs3l4";
+    version = "1.0.0";
+  };
+
+  "justinmimbs/time-extra" = {
+    sha256 = "0s5r0w5dfyrwpkgx594p3z39zrvz2gnxfzb6qlddwfibiaj2nfz9";
+    version = "1.1.0";
+  };
+
+  "rtfeldman/elm-iso8601-date-strings" = {
+    sha256 = "1n4zhm00m37fgy4vb6cayplm4yz6k78ijbmqajrqfnbsyc26p8wr";
+    version = "1.1.2";
+  };
+
+  "elm/random" = {
+    sha256 = "138n2455wdjwa657w6sjq18wx2r0k60ibpc4frhbqr50sncxrfdl";
+    version = "1.0.0";
+  };
+
+  "elm/virtual-dom" = {
+    sha256 = "0hm8g92h7z39km325dlnhk8n00nlyjkqp3r3jppr37k2k13md6aq";
+    version = "1.0.0";
+  };
+
+  "justinmimbs/date" = {
+    sha256 = "0gl31dsbzryc29749wwi4jfnidsyicbplawmc8ar1vbxaa39ld0v";
+    version = "3.2.0";
+  };
+
+  "elm-explorations/test" = {
+    sha256 = "0rpynrm9irgzyynd1bws0xspww5lnwv7w7998750jb8kcrw39h0n";
+    version = "1.0.0";
+  };
+}
--- a/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix
+++ b/pkgs/by-name/pr/prometheus-alertmanager/elm-ui.nix
@ -0,0 +1,40 @@
+{
+  buildNpmPackage,
+  elmPackages,
+  prometheus-alertmanager,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "alertmanager-elm-ui";
+  inherit (prometheus-alertmanager) src version meta;
+
+  sourceRoot = "${finalAttrs.src.name}/ui/app";
+
+  postPatch = ''
+    # don't download elm from github
+    sed -i '/"elm":/d' package.json
+  '';
+
+  postConfigure = (
+    elmPackages.fetchElmDeps {
+      # elm2nix convert > elm-srcs.nix
+      elmPackages = import ./elm-srcs.nix;
+      elmVersion = elmPackages.elm.version;
+      # elm2nix snapshot > registry.dat
+      registryDat = ./registry.dat;
+    }
+  );
+
+  npmDepsHash = "sha256-2flvNJXsOhE0k10Eu8kWo3p3aAABFB/f3yeYNrIztpw=";
+
+  nativeBuildInputs = [
+    elmPackages.elm
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir $out
+    cp -r dist/* $out/
+    runHook postInstall
+  '';
+})
--- a/pkgs/by-name/pr/prometheus-alertmanager/package.nix
+++ b/pkgs/by-name/pr/prometheus-alertmanager/package.nix
@ -2,24 +2,37 @@
  lib,
  go,
  buildGoModule,
+  callPackage,
  fetchFromGitHub,
  installShellFiles,
  nixosTests,
  versionCheckHook,
+  common-updater-scripts,
+  curlMinimal,
+  elm2nix,
+  nix-update,
+  nixfmt,
+  writeShellApplication,
 }:

+let
+  elmUi = callPackage ./elm-ui.nix { };
+in
 buildGoModule (finalAttrs: {
  pname = "alertmanager";
-  version = "0.31.1";
+  version = "0.33.0";

  src = fetchFromGitHub {
    owner = "prometheus";
    repo = "alertmanager";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HkM2bpZ0vM/Uoj9cFEAKi56Cj5ixcx65dH1pJNkK6WQ=";
+    hash = "sha256-VXhu50KERPb4FDdcNDMftBqZVk2ipIphhejAE1wMSOk=";
  };

-  vendorHash = "sha256-X8BiQ9OSXj56mbjmb0AFaSsAWGwDhhMV/RztklxHYa4=";
+  postPatch = ''
+    cp -r ${elmUi}/. ui/app/dist
+  '';
+  vendorHash = "sha256-t5jQtccln3dfcHlnEOnLQHfjzfU9kY9Y7q+r4AigvBE=";

  subPackages = [
    "cmd/alertmanager"
@ -48,7 +61,34 @@ buildGoModule (finalAttrs: {
    installShellCompletion amtool.zsh
  '';

-  passthru.tests = { inherit (nixosTests.prometheus) alertmanager; };
+  passthru = {
+    inherit elmUi;
+    tests = { inherit (nixosTests.prometheus) alertmanager; };
+    updateScript = lib.getExe (writeShellApplication {
+      name = "alertmanager-update";
+      runtimeInputs = [
+        curlMinimal
+        common-updater-scripts
+        elm2nix
+        nix-update
+        nixfmt
+      ];
+      text = ''
+        TAG=$(list-git-tags --url="https://github.com/${finalAttrs.src.owner}/${finalAttrs.src.repo}" | sort -V | tail -n1)
+
+        pushd pkgs/by-name/pr/prometheus-alertmanager
+        wcurl --output="elm.json" "https://raw.githubusercontent.com/prometheus/alertmanager/refs/tags/''${TAG}/ui/app/elm.json"
+        elm2nix convert > elm-srcs.nix
+        elm2nix snapshot > registry.dat
+        rm elm.json
+        nixfmt elm-srcs.nix
+        popd
+
+        nix-update prometheus-alertmanager --version "''${TAG#v}"
+        nix-update prometheus-alertmanager.elmUi
+      '';
+    });
+  };

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/pr/prometheus-alertmanager/registry.dat
+++ b/pkgs/by-name/pr/prometheus-alertmanager/registry.dat
--- a/pkgs/by-name/re/revanity-go/package.nix
+++ b/pkgs/by-name/re/revanity-go/package.nix
@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  libsodium,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "revanity-go";
+  version = "0-unstable-2026-03-30";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "ratspeak";
+    repo = "revanity-go";
+    rev = "0689c73bdc95fe14957f67075891cc6653f3568c";
+    hash = "sha256-utf9YcVCdWj78oDGxRSvTXRRXnUPLMypk77yBdOI24c=";
+  };
+
+  vendorHash = null;
+
+  buildInputs = [
+    libsodium
+  ];
+
+  ldflags = [ "-s" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Go implementation of Revanity, a Reticulum/LXMF vanity address generator";
+    homepage = "https://github.com/ratspeak/revanity-go";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "revanity-go";
+  };
+})
--- a/pkgs/by-name/ro/roadrunner/package.nix
+++ b/pkgs/by-name/ro/roadrunner/package.nix
@ -4,31 +4,37 @@
  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
+  versionCheckHook,
 }:

 buildGoModule (finalAttrs: {
  pname = "roadrunner";
-  version = "2025.1.6";
+  version = "2025.1.14";

  src = fetchFromGitHub {
-    repo = "roadrunner";
    owner = "roadrunner-server";
+    repo = "roadrunner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qoPQxJbZ1BH9Gy06qmp9LGWF6YPJL0gRZX3+S5ej6XY=";
+    hash = "sha256-0Mfu/De28tWCygJ5/QJnOzxk88aajx4Oq/Xm0TOXR0M=";
  };

+  vendorHash = "sha256-KuATz7rVsDuGiyILvILaEpznI63sCHx0G+9D2vR+dx0=";
+  env.GOWORK = "off";
+
+  subPackages = [ "cmd/rr" ];
+
+  # Flags as provided by the build automation of the project:
+  # https://github.com/roadrunner-server/roadrunner/blob/3853ad693522e82d53d62950e5f1315402c910f2/.github/workflows/release.yml#L82
+  ldflags = [
+    "-s"
+    "-X=github.com/roadrunner-server/roadrunner/v${lib.versions.major finalAttrs.version}/internal/meta.version=${finalAttrs.version}"
+    "-X=github.com/roadrunner-server/roadrunner/v${lib.versions.major finalAttrs.version}/internal/meta.buildTime=1970-01-01T00:00:00Z"
+  ];
+
  nativeBuildInputs = [
    installShellFiles
  ];

-  # Flags as provided by the build automation of the project:
-  # https://github.com/roadrunner-server/roadrunner/blob/fe572d0eceae8fd05225fbd99ba50a9eb10c4393/.github/workflows/release.yml#L89
-  ldflags = [
-    "-s"
-    "-X=github.com/roadrunner-server/roadrunner/v2023/internal/meta.version=${finalAttrs.version}"
-    "-X=github.com/roadrunner-server/roadrunner/v2023/internal/meta.buildTime=1970-01-01T00:00:00Z"
-  ];
-
  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd rr \
      --bash <($out/bin/rr completion bash) \
@ -36,20 +42,10 @@ buildGoModule (finalAttrs: {
      --fish <($out/bin/rr completion fish)
  '';

-  postPatch = ''
-    substituteInPlace internal/rpc/client_test.go \
-      --replace "127.0.0.1:55555" "127.0.0.1:55554"
-
-    substituteInPlace internal/rpc/test/config_rpc_ok.yaml \
-      --replace "127.0.0.1:55555" "127.0.0.1:55554"
-
-    substituteInPlace internal/rpc/test/config_rpc_conn_err.yaml \
-      --replace "127.0.0.1:0" "127.0.0.1:55554"
-  '';
-
  __darwinAllowLocalNetworking = true;

-  vendorHash = "sha256-LSeQACVgBywJqHfRE2q6HxL1ADKZtrJP83U3Zd1oIDw=";
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];

  meta = {
    changelog = "https://github.com/roadrunner-server/roadrunner/blob/v${finalAttrs.version}/CHANGELOG.md";
@ -57,6 +53,6 @@ buildGoModule (finalAttrs: {
    homepage = "https://roadrunner.dev";
    license = lib.licenses.mit;
    mainProgram = "rr";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ moraxyc ];
  };
 })
--- a/pkgs/by-name/ru/runelite/package.nix
+++ b/pkgs/by-name/ru/runelite/package.nix
@ -23,7 +23,7 @@ maven.buildMavenPackage rec {
  };

  mvnJdk = jdk17;
-  mvnHash = "sha256-FpfHtGIfo84z6v9/nzc47+JeIM43MR9mWhVOPSi0xhM=";
+  mvnHash = "sha256-OI+m2xJZPnyPXM/HlAsaBJ/z/NCcRSP7+PW5CQOsPiY=";

  desktop = makeDesktopItem {
    name = "RuneLite";
--- a/pkgs/by-name/ru/rusthound-ce/package.nix
+++ b/pkgs/by-name/ru/rusthound-ce/package.nix
@ -10,14 +10,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rusthound-ce";
-  version = "2.4.9";
+  version = "2.4.91";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-FG63LZX62MiSquI56WnQc9oRdzvQAaf/wGPDjSmhvow=";
+    hash = "sha256-mOmTBj/NqWqsc3JfpD8vmafevWpaHTnwqM3wuKwxlxc=";
  };

-  cargoHash = "sha256-tN7sHqEC18NQs3PrLdY71JdbL31MBh2tuaBtTN/T9vE=";
+  cargoHash = "sha256-paMTih5b1RxmXUEjglnj4Hy6SRJE78m1FQP4lags6yo=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/rv/rvgl-launcher/package.nix
+++ b/pkgs/by-name/rv/rvgl-launcher/package.nix
@ -0,0 +1,100 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitLab,
+  copyDesktopItems,
+  makeDesktopItem,
+  buildFHSEnv,
+}:
+
+let
+  unwrapped = python3Packages.buildPythonApplication (finalAttrs: {
+    pname = "rvgl-launcher-unwrapped";
+    version = "0.1.23.1030a4-rev1";
+    pyproject = true;
+
+    src = fetchFromGitLab {
+      owner = "re-volt";
+      repo = "rvgl-launcher";
+      tag = finalAttrs.version;
+      hash = "sha256-Xq8gFE8rWMwufvZL5ZaWXbQ/Ls6nPGgmU3PjzFeQOuM=";
+    };
+
+    strictDeps = true;
+    __structuredAttrs = true;
+
+    build-system = with python3Packages; [ setuptools ];
+
+    dependencies = with python3Packages; [
+      wxpython
+      requests
+      appdirs
+      packaging
+    ];
+
+    postInstall = ''
+      install -Dm644 icons/icon.png $out/share/pixmaps/rvgl-launcher.png
+    '';
+
+    nativeBuildInputs = [ copyDesktopItems ];
+
+    desktopItems = [
+      (makeDesktopItem {
+        name = "rvgl-launcher";
+        desktopName = "RVGL Launcher";
+        icon = "rvgl-launcher";
+        exec = "rvgl-launcher";
+        comment = "Launcher and package manager for RVGL";
+        categories = [ "Game" ];
+      })
+    ];
+
+    meta = {
+      description = "Launcher and package manager for RVGL";
+      longDescription = "RVGL Launcher is a cross-platform installer, launcher and package manager for RVGL";
+      homepage = "https://re-volt.gitlab.io/rvgl-launcher";
+      downloadPage = "https://gitlab.com/re-volt/rvgl-launcher";
+      license = lib.licenses.gpl3Only;
+      maintainers = with lib.maintainers; [ andrewfield ];
+      mainProgram = "rvgl-launcher";
+      platforms = lib.platforms.linux;
+    };
+  });
+
+in
+(buildFHSEnv {
+  # The launcher works well with the unwrapped section but the game itself when launched seems to require an FHS environment.
+  pname = "rvgl-launcher";
+  inherit (unwrapped) version meta;
+
+  runScript = "rvgl-launcher";
+
+  targetPkgs =
+    pkgs: with pkgs; [
+      unwrapped
+
+      p7zip # Only needed by the actual game when launched, to manage the RVGL packages the game itself uses.
+
+      SDL2
+      SDL2_image
+      libvorbis
+      fluidsynth
+      gtk3
+    ];
+
+  extraInstallCommands = ''
+    mkdir -p $out/share/applications $out/share/pixmaps
+    ln -s ${unwrapped}/share/applications/rvgl-launcher.desktop $out/share/applications/rvgl-launcher.desktop
+    ln -s ${unwrapped}/share/pixmaps/rvgl-launcher.png $out/share/pixmaps/rvgl-launcher.png
+  '';
+
+  passthru = {
+    inherit unwrapped;
+  };
+}).overrideAttrs
+  (
+    finalAttrs: previousAttrs: {
+      strictDeps = true;
+      __structuredAttrs = true;
+    }
+  )
--- a/pkgs/by-name/sl/slipstream/package.nix
+++ b/pkgs/by-name/sl/slipstream/package.nix
@ -20,7 +20,7 @@ maven.buildMavenPackage rec {
  };

  mvnJdk = jdk;
-  mvnHash = "sha256-woOSkF5TuzaJ84EndryMoXTMbbK/V/BShM1k+WB8D/c=";
+  mvnHash = "sha256-PRgzlXEa5PWf2jwpLYKLMxY6RECKvdsGWBPKVNz/bnc=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/sq/sqlline/package.nix
+++ b/pkgs/by-name/sq/sqlline/package.nix
@ -18,7 +18,7 @@ maven.buildMavenPackage rec {
    hash = "sha256-rUlGtMgTfhciQVif0KaUcuY28wh+PrHsKen8qODom24=";
  };

-  mvnHash = "sha256-9qDzc6TRn9Yv3/nTATZgP6J+PTZEZCN1et/3GrRb7X4=";
+  mvnHash = "sha256-rqVKHMG/MKyo9P8DiMm87/Gc4YFgkkawagOjBUlrESU=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/ss/sshamble/package.nix
+++ b/pkgs/by-name/ss/sshamble/package.nix
@ -0,0 +1,39 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "sshamble";
+  version = "0.3.9";
+
+  src = fetchFromGitHub {
+    owner = "runZeroInc";
+    repo = "sshamble";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-304OXnCBBPyK7txmnvrkOCu4cfTSSiTpZZh6vOUSufc=";
+  };
+
+  vendorHash = "sha256-uVef5OvCYCZvVfWMh0JTYIN5cokqslvQvYoWHHxtd5g=";
+
+  # Disabled because tests rely on network requests
+  disabledTests = [
+    "TestCacheBasics"
+  ];
+  checkFlags = [
+    "-skip=${lib.concatStringsSep "|" finalAttrs.disabledTests}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+  meta = {
+    description = "SSH-protocol pentesting utility";
+    homepage = "https://github.com/runZeroInc/sshamble";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.YoshiRulz ];
+    mainProgram = "sshamble";
+  };
+})
--- a/pkgs/by-name/ta/tabula-java/package.nix
+++ b/pkgs/by-name/ta/tabula-java/package.nix
@ -17,7 +17,7 @@ maven.buildMavenPackage rec {
    hash = "sha256-lg8/diyGhfkUU0w7PEOlxb1WNpJZVDDllxMMsTIU/Cw=";
  };

-  mvnHash = "sha256-CXJm9YlYsYViChFcH9e2P9pxK0q/tLWODOzZPXZ8hK0=";
+  mvnHash = "sha256-XMrAwOqQCt0vDUqFXodLhmujnrz2/FRSBYkAxDz9Z8c=";
  mvnParameters = "compile assembly:single -Dmaven.test.skip=true";

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/tr/trimmomatic/package.nix
+++ b/pkgs/by-name/tr/trimmomatic/package.nix
@ -19,7 +19,7 @@ maven.buildMavenPackage rec {
    hash = "sha256-pLUjSVePN++G2XZrdKEdobgBO+UD0PZ9wlhSUlZ7na8=";
  };

-  mvnHash = "sha256-1XnVdud8nI2SuEPXnwEmbudM+QAeoSVTn0UZ8PKJH44=";
+  mvnHash = "sha256-J72B3qAVfRZ3lXpNyM1HYmBJQBkzj+J79fLIUJqyPTU=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/tu/tuxguitar/package.nix
+++ b/pkgs/by-name/tu/tuxguitar/package.nix
@ -60,9 +60,9 @@ let
  ];
  # FIXME: Makes hash stable across platforms and convert to a single hash.
  mvnHashByPlatform = {
-    "x86_64-linux" = "sha256-7UDFGuOMERvY74mkneusJyuAHfF3U6b4qV4MPHGQYdM=";
-    "aarch64-linux" = "sha256-7UDFGuOMERvY74mkneusJyuAHfF3U6b4qV4MPHGQYdM=";
-    "aarch64-darwin" = "sha256-lfO2YH+yKZWzh3MeQ7baESGmmW7zPdTLs8CjZ/FtLu0=";
+    "x86_64-linux" = "sha256-KYF7vSMXPgi6xvtgcSIIEOltK5RL4ynGQf1579Is5nM=";
+    "aarch64-linux" = "sha256-KYF7vSMXPgi6xvtgcSIIEOltK5RL4ynGQf1579Is5nM=";
+    "aarch64-darwin" = "sha256-uJXOACtuE4fKIb4a6C3Cy+MilI8OOdsuAgtJyklxHdw=";
  };
  wrapperArgs = [
    "\${gappsWrapperArgs[@]}"
--- a/pkgs/by-name/uc/ucx/package.nix
+++ b/pkgs/by-name/uc/ucx/package.nix
@ -42,13 +42,13 @@ stdenv.mkDerivation (finalAttrs: {
  strictDeps = true;

  pname = "ucx";
-  version = "1.20.1";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "openucx";
    repo = "ucx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CD8a7CoKAj5DuRa9C+Eef54qGcH3F0uNBXRlO0hneI4=";
+    hash = "sha256-jREdHE+DpT0OQ1pVEUgWnA9hTCP1IsGeATmDTT3YmcM=";
  };

  outputs = [
--- a/pkgs/by-name/um/umami/package.nix
+++ b/pkgs/by-name/um/umami/package.nix
@ -47,12 +47,12 @@ let
  # to guarantee compatibility.
  prisma-engines' = prisma-engines_7.overrideAttrs (
    finalAttrs: prevAttrs: {
-      version = "7.6.0";
+      version = "7.8.0";
      src = fetchFromGitHub {
        owner = "prisma";
        repo = "prisma-engines";
        tag = finalAttrs.version;
-        hash = "sha256-NMoAaiTa68i51lR6iMCyHyCAsFuuhPx2+tHFSSoqWqA=";
+        hash = "sha256-nquIcOmFz+ikD0x/YEPZ5NVKCFPCdR5MSCHldn+b9jI=";
      };
      cargoHash = "sha256-uiFvzxwVJXCW9LUDFRC6ZkzSa7LQk+9ZJcaJw8mrBX4=";

@ -66,23 +66,23 @@ let
  );
  prisma' = (prisma_7.override { prisma-engines_7 = prisma-engines'; }).overrideAttrs (
    finalAttrs: prevAttrs: {
-      version = "7.6.0";
+      version = "7.8.0";
      src = fetchFromGitHub {
        owner = "prisma";
        repo = "prisma";
        tag = finalAttrs.version;
-        hash = "sha256-BesX2ySfgew6+9Q6fnhZ8gMnnxh4D4fefaA5BhehlHE=";
+        hash = "sha256-89q5433z54h3oGX+lEYDQykN2mNltGz4+LWlYSE75/E=";
      };
      pnpmDeps = prevAttrs.pnpmDeps.override {
        inherit (finalAttrs) src version;
-        hash = "sha256-ZOpNt+W5b1troicfkCi4wCCDtwhTB4VlPgxYMZetcs0=";
+        hash = "sha256-mrFU5SAF4QuTBJj5TP8tUkYDG4zchttjcQMLtx6OBnI=";
      };
    }
  );
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "umami";
-  version = "3.1.0";
+  version = "3.2.0";

  nativeBuildInputs = [
    makeWrapper
@ -96,7 +96,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "umami-software";
    repo = "umami";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-EH3ebwTbajcNasn25ets2w068ZmCQRYUY2XON39J5HA=";
+    hash = "sha256-0nfCcaST06cTg43Rz1rCV8GYYDjQLP+6TrVRJF2/Yuk=";
  };

  # Umami uses next/font/google, which tries to download from Google Fonts at build time.
@ -116,11 +116,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      src
      ;
    inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-QNWmCsVFh8xpsO4ZPTaKGszwuRaxTrWLMVh/6VV5oIw=";
+    fetcherVersion = 4;
+    hash = "sha256-6ho5xoVdqZdihThL5q8+RhVPfaSwu1y3+p9d8DnfO3o=";
  };

-  env.CYPRESS_INSTALL_BINARY = "0";
  env.NODE_ENV = "production";
  env.NEXT_TELEMETRY_DISABLED = "1";

@ -144,7 +143,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  checkPhase = ''
    runHook preCheck

-    pnpm test
+    # Tests fail if NODE_ENV=production
+    NODE_ENV=development pnpm test

    runHook postCheck
  '';
--- a/pkgs/by-name/um/umami/sources.json
+++ b/pkgs/by-name/um/umami/sources.json
@ -1,7 +1,7 @@
 {
  "geocities": {
-    "rev": "6a3ef689a4673ff2bf292548716e7cc6c5a2c903",
-    "date": "2026-04-16",
-    "hash": "sha256-GUUeFU1DKGL+NpzK1oJlsyB/VrFWe6Lj7U7yJXj8mNo="
+    "rev": "04017f13909e499135afea605a1e07427e845641",
+    "date": "2026-07-02",
+    "hash": "sha256-4IYGsxNGdzilI0mYXlwEo43auqNug307pYyPuilR3aw="
  }
 }
--- a/pkgs/by-name/va/vatprism/package.nix
+++ b/pkgs/by-name/va/vatprism/package.nix
@ -71,9 +71,9 @@ maven.buildMavenPackage rec {

  mvnHash = # OpenJFX artifacts are platform dependent
    if (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) then
-      "sha256-gerjxTj8UQEVthMO3unWPEG7SPseMt5JPPureC/wUsw="
+      "sha256-GeSO6aFXeWLVOF9DVvFZ4FNv//NYhF68Nd6rxgeBO70="
    else
-      "sha256-LoOiLisqc99gIGClpVe8tq5/2prmyyOzLDkpmuSgwVo=";
+      "sha256-j7SaDQKGMcXGdOKzv8zBFHpsqqFZzZzITW7I/ZXs+dI=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/by-name/vu/vue-language-server/add-pkg-pr-new-integrities.patch
+++ b/pkgs/by-name/vu/vue-language-server/add-pkg-pr-new-integrities.patch
@ -0,0 +1,32 @@
+--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
+@@ -870 +870 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-core@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+    resolution: {integrity: sha512-GntAKmJ45uB5NUKeEw15qGpNmL9i81HmTv2OtqreAxT2uQb5Adurtx5VouR150tRhnkXoYUiVPzYGs++U+WLfg==, tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-core@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -877 +877 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-dom@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+    resolution: {integrity: sha512-vbZgliMbBuVO1sYRhbczWWcQlwd8e+Wj6tGBh1PvRws6aJLu7nhMPb0LJU9wrW5EKFcjckGpwMtH3aOK/8padw==, tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-dom@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -884 +884 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-sfc@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+    resolution: {integrity: sha512-e10xJOKE+jTmuoManPxtkRCUgu+IzpV67ZEcddzdE5+Va4gQuPTm4dzCYo0yEztyBH57AuhN8P3H1hC5SxyFuw==, tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-sfc@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -891 +891 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-ssr@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+    resolution: {integrity: sha512-FxLmgdj7z0ljbHiT+PR4PtX+XNA+Pfb1Ror+9AP01fmHKGFb9ZVKqx0vBq4a2TtZXcgn5740IHiD0lovufBlFA==, tarball: https://pkg.pr.new/vuejs/core/@vue/compiler-ssr@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -898 +898 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/reactivity@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+    resolution: {integrity: sha512-U4sPiVx/HN+SU/3nRxSvebg7diEsDK1x+xnbCoNy1IwVpNuogxyRz/L9bOGBIB9vlMmgmxsntDBltZVzoelwcQ==, tarball: https://pkg.pr.new/vuejs/core/@vue/reactivity@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -902 +902 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/runtime-core@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+    resolution: {integrity: sha512-qKrCQUE2loNGO+zZ8S8TuSn2p0zaDTPZTom1RvaIVsriAYpd5AZdiy7b7PwT1OxdHK/OM3sZ1vvjysmQDUJLRg==, tarball: https://pkg.pr.new/vuejs/core/@vue/runtime-core@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -906 +906 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/runtime-dom@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+    resolution: {integrity: sha512-k6YZlI+NYcDvj98OEmEpNteTX1q9l1dL2KCUCwCDmyAw2Re9Yz1J4JFEEnLCMz0+YSKoXg12lGj9lYVsuS6osw==, tarball: https://pkg.pr.new/vuejs/core/@vue/runtime-dom@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -910 +910 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/server-renderer@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+    resolution: {integrity: sha512-yTJTHlRXU1qOXkQutMIF0w+s7zIfMACmiTrJQ4LZ50OAXKiWmt93nrSjXh6ePOP+KeRqvAOFBsZhlmnfxHHh/A==, tarball: https://pkg.pr.new/vuejs/core/@vue/server-renderer@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -919 +919 @@
+-    resolution: {tarball: https://pkg.pr.new/vuejs/core/@vue/shared@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+    resolution: {integrity: sha512-HCZjsf5q9+i2SxsraMsFVQvoSzW3/K6CC9Myg1CZJxP2MH+n6RYGqvJSEnjBCO3tX+JxLSrm06aYhn5FIZhhEw==, tarball: https://pkg.pr.new/vuejs/core/@vue/shared@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+@@ -1660 +1660 @@
+-    resolution: {tarball: https://pkg.pr.new/vue@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
+    resolution: {integrity: sha512-lSY4wGk59hpvPBRJ1femqnUMekvvWGZsy4ggQBTJ8Z6fhDxO6U/w2l+M5vU93qsw2mcf9v+iuzLbEIc41y6B9w==, tarball: https://pkg.pr.new/vue@e1bc0eb02e22bc0c236e1471c11d96a368764b72}
--- a/pkgs/by-name/vu/vue-language-server/package.nix
+++ b/pkgs/by-name/vu/vue-language-server/package.nix
@ -4,30 +4,40 @@
  fetchFromGitHub,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm_10_34_0,
+  pnpm_11,
  nodejs,
  nix-update-script,
  makeBinaryWrapper,
 }:
 let
-  pnpm = pnpm_10_34_0;
+  pnpm = pnpm_11;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "vue-language-server";
-  version = "3.2.9";
+  version = "3.3.6";

  src = fetchFromGitHub {
    owner = "vuejs";
    repo = "language-tools";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-q/5erEPVtXdpsyGnxuq+QySsZKibvKLvniDI1glIP0s=";
+    hash = "sha256-uiYhVVRiHyq+0S8czBY082vsqtCPqj29K9DjH0f+8u4=";
  };

+  patches = [ ./add-pkg-pr-new-integrities.patch ];
+
  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
+    inherit (finalAttrs)
+      patches
+      pname
+      src
+      version
+      ;
    inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-qm2hDQbOoC04c47w8KSwkdigND6UrkRUGp7YfkRu4as=";
+    fetcherVersion = 4;
+    prePnpmInstall = ''
+      pnpm config set --location project --json trustPolicyExclude '["volar-service-pug@0.0.71"]'
+    '';
+    hash = "sha256-6xu+z7rrI+YfmpcL5ycwjjeSAfDkkhSgeKBZO34p9Dw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/yl/yle-dl/package.nix
+++ b/pkgs/by-name/yl/yle-dl/package.nix
@ -8,13 +8,13 @@
 }:

 let
-  version = "20250730";
+  version = "20260624";

  src = fetchFromGitHub {
    owner = "aajanki";
    repo = "yle-dl";
    tag = "releases/${version}";
-    hash = "sha256-85Dj+r6heusvT3+y3SNYBBa5h/tje0G4XHmfJpCwkMY=";
+    hash = "sha256-7wI7GKMdj28ef6M8eqkeuLytliU0D3arE0IXk5uhVfg=";
  };
 in
 python3Packages.buildPythonApplication {
--- a/pkgs/development/python-modules/alphashape/default.nix
+++ b/pkgs/development/python-modules/alphashape/default.nix
@ -0,0 +1,65 @@
+{
+  lib,
+  buildPythonPackage,
+  click,
+  click-log,
+  fetchFromGitHub,
+  geopandas,
+  networkx,
+  numpy,
+  pytestCheckHook,
+  rtree,
+  scipy,
+  setuptools,
+  shapely,
+  trimesh,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alphashape";
+  version = "1.3.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bellockk";
+    repo = "alphashape";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-T2wyU6fpiYRA1+9n//5EtOLhO1fzccQsie+gQj729Vs=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    click
+    click-log
+    shapely
+    numpy
+    trimesh
+    networkx
+    rtree
+    scipy
+  ];
+
+  nativeCheckInputs = [
+    geopandas
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # TypeError
+    "test_given_a_four_point_polygon_with_no_alpha_return_input"
+    "test_given_a_point_return_a_point"
+  ];
+
+  pythonImportsCheck = [ "alphashape" ];
+
+  meta = with lib; {
+    description = "Toolbox for generating n-dimensional alpha shapes";
+    homepage = "https://github.com/bellockk/alphashape";
+    changelog = "https://github.com/bellockk/alphashape/releases/tag/${finalAttrs.src.tag}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.43.39";
+  version = "1.43.40";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-PzXmBl1uo+oNEuh1PFJ3BDqQiPRjL7vzF8DE9eBx5mM=";
+    hash = "sha256-5h8+Bf1ljDkoxwShyn+aAguxkCHJYcg5I5y3F7iv3JU=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/crawl4ai/default.nix
+++ b/pkgs/development/python-modules/crawl4ai/default.nix
@ -0,0 +1,269 @@
+{
+  lib,
+  aiofiles,
+  aiohttp,
+  aiosqlite,
+  alphashape,
+  anyio,
+  beautifulsoup4,
+  brotli,
+  buildPythonPackage,
+  chardet,
+  click,
+  cssselect,
+  fake-useragent,
+  fetchFromGitHub,
+  h2,
+  httpx,
+  humanize,
+  lark,
+  litellm,
+  lxml,
+  nltk,
+  numpy,
+  patchright,
+  pillow,
+  playwright-stealth,
+  playwright,
+  psutil,
+  pydantic,
+  pyopenssl,
+  pypdf,
+  pytest-asyncio,
+  pytestCheckHook,
+  python-dotenv,
+  pyyaml,
+  rank-bm25,
+  requests,
+  rich,
+  scikit-learn,
+  selenium,
+  sentence-transformers,
+  setuptools,
+  shapely,
+  snowballstemmer,
+  tokenizers,
+  torch,
+  transformers,
+  unclecode-litellm,
+  writableTmpDirAsHomeHook,
+  xxhash,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "crawl4ai";
+  version = "0.9.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "unclecode";
+    repo = "crawl4ai";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MHCnhp7itaJ6y++uUCnObBjiJ9Jw/aFBtd35WzDBz1A=";
+  };
+
+  pythonRelaxDeps = [
+    "lxml"
+    "snowballstemmer"
+  ];
+
+  pythonRemoveDeps = [ "patchright" ];
+
+  build-system = [
+    setuptools
+    writableTmpDirAsHomeHook
+  ];
+
+  dependencies = [
+    aiofiles
+    aiohttp
+    aiosqlite
+    alphashape
+    anyio
+    beautifulsoup4
+    brotli
+    chardet
+    click
+    cssselect
+    fake-useragent
+    httpx
+    humanize
+    lark
+    litellm
+    lxml
+    nltk
+    numpy
+    patchright
+    pillow
+    playwright
+    playwright-stealth
+    psutil
+    pydantic
+    pyopenssl
+    python-dotenv
+    pyyaml
+    rank-bm25
+    requests
+    rich
+    shapely
+    snowballstemmer
+    unclecode-litellm
+    xxhash
+  ];
+
+  optional-dependencies = {
+    all = [
+      nltk
+      pypdf
+      scikit-learn
+      selenium
+      sentence-transformers
+      tokenizers
+      torch
+      transformers
+    ];
+    cosine = [
+      nltk
+      sentence-transformers
+      torch
+      transformers
+    ];
+    pdf = [ pypdf ];
+    sync = [ selenium ];
+    torch = [
+      nltk
+      scikit-learn
+      torch
+    ];
+    transformer = [
+      sentence-transformers
+      tokenizers
+      transformers
+    ];
+  };
+
+  nativeCheckInputs = [
+    h2
+    pytest-asyncio
+    pytestCheckHook
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
+
+  pytestFlags = [ "--continue-on-collection-errors" ];
+
+  disabledTestPaths = [
+    # sys.exit(1) that crashes pytest
+    "tests/test_cloud_bugs_batch.py"
+    # Require docker, browser, LLM API, network and parts
+    "deploy/docker/"
+    "docs/examples/"
+    "tests/adaptive/"
+    "tests/async/"
+    "tests/browser/"
+    "tests/cache_validation/test_end_to_end.py"
+    "tests/cache_validation/test_real_domains.py"
+    "tests/deep_crawling/test_deep_crawl_resume_integration.py"
+    "tests/docker/test_config_object.py"
+    "tests/docker/test_docker.py"
+    "tests/docker/test_filter_deep_crawl.py"
+    "tests/docker/test_hooks_client.py"
+    "tests/docker/test_hooks_comprehensive.py"
+    "tests/docker/test_hooks_utility.py"
+    "tests/docker/test_llm_params.py"
+    "tests/docker/test_rest_api_deep_crawl.py"
+    "tests/docker/test_server.py"
+    "tests/docker/test_server_requests.py"
+    "tests/docker/test_server_token.py"
+    "tests/general/test_async_crawler_strategy.py"
+    "tests/general/test_async_url_seeder_bm25.py"
+    "tests/general/test_async_webcrawler.py"
+    "tests/general/test_bff_scoring.py"
+    "tests/general/test_cache_context.py"
+    "tests/general/test_crawlers.py"
+    "tests/general/test_deep_crawl_filters.py"
+    "tests/general/test_download_file.py"
+    "tests/general/test_http_crawler_strategy.py"
+    "tests/general/test_llm_filter.py"
+    "tests/general/test_max_scroll.py"
+    "tests/general/test_mhtml.py"
+    "tests/general/test_schema_builder.py"
+    "tests/mcp/"
+    "tests/memory/test_docker_config_gen.py"
+    "tests/integration/test_domain_mapper_e2e.py"
+    "tests/general/test_network_console_capture.py"
+    "tests/general/test_robot_parser.py"
+    "tests/general/test_stream.py"
+    "tests/general/test_stream_dispatch.py"
+    "tests/proxy/"
+    "tests/regression/"
+    "tests/releases/"
+    "tests/test_arun_many.py"
+    "tests/test_cdp_changes.py"
+    "tests/test_cli_docs.py"
+    "tests/test_config_selection.py"
+    "tests/test_docker.py"
+    "tests/test_docker_api_with_llm_provider.py"
+    "tests/test_eval_security_adversarial.py"
+    "tests/test_issue_1594_mcp_sse.py"
+    "tests/test_issue_1611_llm_provider.py"
+    "tests/test_issue_1748_screenshot_scroll_delay.py"
+    "tests/test_issue_1750_screenshot_scan_full_page.py"
+    "tests/test_issue_1850_mcp_sse.py"
+    "tests/test_link_extractor.py"
+    "tests/test_llm_extraction_parallel_issue_1055.py"
+    "tests/test_llm_simple_url.py"
+    "tests/test_llmtxt.py"
+    "tests/test_main.py"
+    "tests/test_multi_config.py"
+    "tests/test_prefetch_integration.py"
+    "tests/test_prefetch_regression.py"
+    "tests/test_pr_1435_redirected_status_code.py"
+    "tests/test_pr_1463_device_scale_factor.py"
+    "tests/test_pyopenssl_update.py"
+    "tests/test_raw_html_browser.py"
+    "tests/test_raw_html_edge_cases.py"
+    "tests/test_raw_html_redirected_url.py"
+    "tests/test_scraping_strategy.py"
+    "tests/test_virtual_scroll.py"
+    "tests/test_web_crawler.py"
+  ];
+
+  disabledTests = [
+    # Tests require network access
+    "test_client_is_built_once_and_reused"
+    "test_reused_client_extracts_from_multiple_urls"
+    "test_clones_share_one_client"
+    "test_reused_client_checks_multiple_urls"
+    "test_concurrent_host_scanning"
+    "test_domain_with_scheme"
+    "test_probe_without_crt"
+    "test_examples"
+    "test_missing_url"
+    "test_basic_crawl"
+    # Tests require LLM API
+    "test_map_query_uses_query_config"
+    "test_legacy_single_config_for_query"
+    # Assertions Errors
+    "allowed_types5"
+    "allowed_types16"
+    "test_empty_href"
+    "test_href_is_only_fragment"
+    "test_href_with_fragment"
+    "test_invalid_base_url_netloc"
+    "test_invalid_base_url_scheme"
+    # Test checks GitHub Actions version
+    "test_no_v4_or_v5_checkout_remaining"
+  ];
+
+  pythonImportsCheck = [ "crawl4ai" ];
+
+  meta = {
+    description = "LLM Friendly Web Crawler & Scraper";
+    homepage = "https://github.com/unclecode/crawl4ai";
+    changelog = "https://github.com/unclecode/crawl4ai/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/fake-http-header/default.nix
+++ b/pkgs/development/python-modules/fake-http-header/default.nix
@ -0,0 +1,35 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "fake-http-header";
+  version = "0.3.5-unstable-2025-07-09";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "MichaelTatarski";
+    repo = "fake-http-header";
+    # https://github.com/MichaelTatarski/fake-http-header/issues/4
+    rev = "0f110477d3ecae916e88608a123360227bfb6109";
+    hash = "sha256-CznvDjzUeA0THsiIhuzvEDb4gXsP8IujpSCjt857qSo=";
+  };
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "fake_http_header" ];
+
+  meta = with lib; {
+    description = "Generates random request fields for a http request header";
+    homepage = "https://github.com/MichaelTatarski/fake-http-header";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@ -30,14 +30,14 @@
 }:

 let
-  version = "7.3.0";
+  version = "7.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Labelbox";
    repo = "labelbox-python";
    tag = "v${version}";
-    hash = "sha256-3xsV7X5M6s1wXYrThFC2SdvWgXAt1Hlw4OGQB/bKCCY=";
+    hash = "sha256-l+2BSkfZIwu0d3hEB7jq3CzampRYkNA9jaJnMlode68=";
  };

  lbox-clients = buildPythonPackage {
@ -133,7 +133,7 @@ buildPythonPackage rec {
  meta = {
    description = "Platform API for LabelBox";
    homepage = "https://github.com/Labelbox/labelbox-python";
-    changelog = "https://github.com/Labelbox/labelbox-python/releases/tag/v.${src.tag}";
+    changelog = "https://github.com/Labelbox/labelbox-python/releases/tag/${src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ rakesh4g ];
  };
--- a/pkgs/development/python-modules/linode-api/default.nix
+++ b/pkgs/development/python-modules/linode-api/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "linode-api";
-  version = "5.39.0";
+  version = "5.45.0";
  pyproject = true;

  # Sources from Pypi exclude test fixtures
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "linode";
    repo = "python-linode-api";
    tag = "v${version}";
-    hash = "sha256-WYPKq+WSEnqQdqZ0R8cUm7QYgE6EYtQ/NXdBfV2d8dI=";
+    hash = "sha256-0FLF/LkU8SaR3itgMISbqOxmd4UZkGlTT3VDpmuv+QQ=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/livekit-protocol/default.nix
+++ b/pkgs/development/python-modules/livekit-protocol/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "livekit-protocol";
-  version = "1.1.2";
+  version = "1.1.17";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "livekit";
    repo = "python-sdks";
    tag = "protocol-v${version}";
-    hash = "sha256-/QXjIz3q5dF6Y1CkyCP+3hWoXMGs7+eUgtehBJBF7LY=";
+    hash = "sha256-XTBQi1ckwHw7bpd2jQWqwhDXO0iHQRirc2GjfDtYILA=";
  };

  pypaBuildFlags = [ "livekit-protocol" ];
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@ -311,8 +311,8 @@ in
      "sha256-CavBKgp+dEMR2poR+bG2PgZb+wX1zlNmuOyJsV3LfVM=";

  mypy-boto3-cognito-idp =
-    buildMypyBoto3Package "cognito-idp" "1.43.33"
-      "sha256-tNZluhU3Ano5b9ZYs4Zyut3WJrKyJgkCFc0ceM/NtmQ=";
+    buildMypyBoto3Package "cognito-idp" "1.43.40"
+      "sha256-Md4qwl+XC5zbtQFp2zteE+gWPyGEUaK8EyNcAlEQyj0=";

  mypy-boto3-cognito-sync =
    buildMypyBoto3Package "cognito-sync" "1.43.0"
@ -331,8 +331,8 @@ in
      "sha256-Y+cDD5dq7C8tiGW37YheNcHTMxFyYCX6P6JPSjN7ttA=";

  mypy-boto3-config =
-    buildMypyBoto3Package "config" "1.43.23"
-      "sha256-6FyB/VCGsMYDBFUu0VzWpge94lASfg6CVewhkmpxycQ=";
+    buildMypyBoto3Package "config" "1.43.40"
+      "sha256-fnCKbH54gAMo/XqzCFyHhZMnV431ldlDE5kbej+yzsU=";

  mypy-boto3-connect =
    buildMypyBoto3Package "connect" "1.43.39"
@ -363,8 +363,8 @@ in
      "sha256-pi0hMLpgYGrNU0/infONBg2WmES6NV0tfPgTjuRtWXk=";

  mypy-boto3-customer-profiles =
-    buildMypyBoto3Package "customer-profiles" "1.43.17"
-      "sha256-+/r5ocaFv/4ZF0PpJMSoGeZtiE3nkqaMLzG+sECyNss=";
+    buildMypyBoto3Package "customer-profiles" "1.43.40"
+      "sha256-3eL2AWChh+ct7DwLMNlnXyA95vovQ6QO9zlDGB1gII4=";

  mypy-boto3-databrew =
    buildMypyBoto3Package "databrew" "1.43.0"
@ -886,8 +886,8 @@ in
      "sha256-8K0Xm6PMo+daS6xt4kBqaVvO2/LruFV7PVvugI7sNDU=";

  mypy-boto3-mediatailor =
-    buildMypyBoto3Package "mediatailor" "1.43.4"
-      "sha256-HZuUYGeTGlBaEbBrm31HRV1Xtaw8+nAQL1nBpiwRur4=";
+    buildMypyBoto3Package "mediatailor" "1.43.40"
+      "sha256-Khj9f1GD4q8Bjk5LsI2yJQvtKm910epVlJMz5WxgPpw=";

  mypy-boto3-medical-imaging =
    buildMypyBoto3Package "medical-imaging" "1.43.4"
@ -990,8 +990,8 @@ in
      "sha256-0rAEnU+3VsESGKlu8OTnY//rzwRqvROhRFga+vnwd1k=";

  mypy-boto3-outposts =
-    buildMypyBoto3Package "outposts" "1.43.31"
-      "sha256-pCoCP49nPBy/qhPn4gYGiDdQSp4/4e6WlUCKv6q7uog=";
+    buildMypyBoto3Package "outposts" "1.43.40"
+      "sha256-f+z9dYLo4uhsRvaCUcR+dbYpEv7xmlfgvUR1+eM+NeU=";

  mypy-boto3-panorama =
    buildMypyBoto3Package "panorama" "1.43.0"
--- a/pkgs/development/python-modules/patchright/default.nix
+++ b/pkgs/development/python-modules/patchright/default.nix
@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  playwright,
+  setuptools,
+  toml,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "patchright";
+  version = "1.58.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Kaliiiiiiiiii-Vinyzu";
+    repo = "patchright-python";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-msV0CbVbTDSAB1BgxkUOpuzQDr8vMK2/wxJy1SSUU80=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    playwright
+    toml
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  # pythonImportsCheck disabled: module attempts filesystem writes at import time
+  pythonImportsCheck = [ ];
+
+  meta = {
+    description = "Undetected Python version of the Playwright testing and automation library";
+    homepage = "https://github.com/Kaliiiiiiiiii-Vinyzu/patchright-python";
+    changelog = "https://github.com/Kaliiiiiiiiii-Vinyzu/patchright-python/releases/tag/v${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/pydeep2/default.nix
+++ b/pkgs/development/python-modules/pydeep2/default.nix
@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  setuptools,
+  ssdeep,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pydeep2";
+  version = "0.5.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "JakubOnderka";
+    repo = "pydeep";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qeE+ckYIDOeXaDC3Rxh4LmS0oN+Tqvjwe2tGDDt7YgA=";
+  };
+
+  build-system = [ setuptools ];
+
+  buildInputs = [ ssdeep ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail '"/usr/local/include/"' '"${ssdeep}/include"' \
+      --replace-fail '"/usr/local/lib/"' '"${ssdeep}/lib"'
+  '';
+
+  pythonImportsCheck = [ "pydeep" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Python bindings for ssdeep";
+    homepage = "https://github.com/JakubOnderka/pydeep";
+    changelog = "https://github.com/JakubOnderka/pydeep/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/pymisp/default.nix
+++ b/pkgs/development/python-modules/pymisp/default.nix
@ -0,0 +1,119 @@
+{
+  lib,
+  beautifulsoup4,
+  buildPythonPackage,
+  deprecated,
+  docutils,
+  extract-msg,
+  fetchFromGitHub,
+  lief,
+  myst-parser,
+  neo4j,
+  nix-update-script,
+  oletools,
+  poetry-core,
+  pure-magic-rs,
+  pydeep2,
+  pyfaup-rs,
+  pytestCheckHook,
+  python-dateutil,
+  reportlab,
+  requests,
+  rtfde,
+  sphinx-autodoc-typehints,
+  sphinx,
+  urllib3,
+  validators,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pymisp";
+  version = "2.5.34.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "MISP";
+    repo = "PyMISP";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-68XJ6lqoNGnUneNIu0ZOKZhrumrt6CPLAt45UaZC5q0=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    deprecated
+    python-dateutil
+    requests
+  ];
+
+  optional-dependencies = {
+    brotli = [ urllib3 ];
+    docs = [
+      docutils
+      myst-parser
+      sphinx
+      sphinx-autodoc-typehints
+    ];
+    email = [
+      extract-msg
+      oletools
+      rtfde
+    ];
+    fileobjects = [
+      lief
+      pure-magic-rs
+      pydeep2
+    ];
+    neo4j = [ neo4j ];
+    openioc = [ beautifulsoup4 ];
+    pdfexport = [ reportlab ];
+    url = [ pyfaup-rs ];
+    virustotal = [ validators ];
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
+
+  disabledTestPaths = [
+    # Test requires network access
+    "tests/test_reportlab.py"
+  ];
+
+  disabledTests = [
+    # AttributeError
+    "test_analyst_data_object_object_attribute_alternative"
+    "test_analyst_data_on_object"
+    "test_analyst_data_on_object_alternative"
+    "test_analyst_data_on_object_attribute"
+    "test_bom_encoded"
+    "test_default_attributes"
+    "test_feed"
+    "test_git_vuln_finder"
+    "test_handling_of_various_email_types"
+    "test_mail_1"
+    "test_mail_1_headers_only"
+    "test_mail_multiple_to"
+    "test_mimeType"
+    "test_msg"
+    "test_obj_default_values"
+    "test_object_galaxy"
+    "test_object_tag"
+    "test_to_dict_json_format"
+  ];
+
+  pythonImportsCheck = [ "pymisp" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Python library using the MISP Rest API";
+    homepage = "https://github.com/MISP/PyMISP";
+    changelog = "https://github.com/MISP/PyMISP/blob/${finalAttrs.src.rev}/CHANGELOG.txt";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/stix2-patterns/default.nix
+++ b/pkgs/development/python-modules/stix2-patterns/default.nix
@ -5,26 +5,24 @@
  fetchFromGitHub,
  pytestCheckHook,
  setuptools,
-  six,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "stix2-patterns";
-  version = "2.0.0";
+  version = "2.1.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "oasis-open";
    repo = "cti-pattern-validator";
-    tag = "v${version}";
-    hash = "sha256-lFgnvI5a7U7/Qj4Pqjr3mx4TNDnC2/Ru7tVG7VggR7Y=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ngRxUeT8ifFM4bpFRtS1ILtTz9lPXtyD8+0MYijWKoM=";
  };

  build-system = [ setuptools ];

  dependencies = [
    antlr4-python3-runtime
-    six
  ];

  nativeCheckInputs = [ pytestCheckHook ];
@ -32,12 +30,11 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "stix2patterns" ];

  meta = {
-    broken = lib.versionAtLeast antlr4-python3-runtime.version "4.10";
    description = "Validate patterns used to express cyber observable content in STIX Indicators";
-    mainProgram = "validate-patterns";
    homepage = "https://github.com/oasis-open/cti-pattern-validator";
-    changelog = "https://github.com/oasis-open/cti-pattern-validator/blob/${version}/CHANGELOG.rst";
+    changelog = "https://github.com/oasis-open/cti-pattern-validator/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "validate-patterns";
  };
-}
+})
--- a/pkgs/development/python-modules/stix2-validator/default.nix
+++ b/pkgs/development/python-modules/stix2-validator/default.nix
@ -12,16 +12,16 @@
  stix2-patterns,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "stix2-validator";
-  version = "3.2.0";
+  version = "3.3.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "oasis-open";
    repo = "cti-stix-validator";
-    tag = "v${version}";
-    hash = "sha256-OI1SXILyCRGl1ZsoyYDl+/RsBhTP24eqECtW3uazS2k=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-w9SlRspt5tRLdqqEr6UJ+cmq3KM08cN9BqMvdSYay0Y=";
  };

  build-system = [ setuptools ];
@ -45,8 +45,8 @@ buildPythonPackage rec {
  meta = {
    description = "Validator for STIX 2.0 JSON normative requirements and best practices";
    homepage = "https://github.com/oasis-open/cti-stix-validator/";
-    changelog = "https://github.com/oasis-open/cti-stix-validator/blob/${src.rev}/CHANGELOG";
+    changelog = "https://github.com/oasis-open/cti-stix-validator/blob/${finalAttrs.src.tag}/CHANGELOG";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/stix2/default.nix
+++ b/pkgs/development/python-modules/stix2/default.nix
@ -14,16 +14,16 @@
  taxii2-client,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "stix2";
-  version = "3.0.1";
+  version = "3.0.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "oasis-open";
    repo = "cti-python-stix2";
-    tag = "v${version}";
-    hash = "sha256-1bILZUZgPOWmFWRu4p/fmgi4QPEE1lFQH9mxoWd/saI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qm6VFufD9A4rSBHaDkqeYqOLRvE97SY0++o4ND0l3I0=";
  };

  build-system = [ setuptools ];
@ -55,8 +55,8 @@ buildPythonPackage rec {
  meta = {
    description = "Produce and consume STIX 2 JSON content";
    homepage = "https://stix2.readthedocs.io/en/latest/";
-    changelog = "https://github.com/oasis-open/cti-python-stix2/blob/v${version}/CHANGELOG";
+    changelog = "https://github.com/oasis-open/cti-python-stix2/blob/${finalAttrs.src.tag}/CHANGELOG";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ PapayaJackal ];
  };
-}
+})
--- a/pkgs/development/python-modules/tf-playwright-stealth/default.nix
+++ b/pkgs/development/python-modules/tf-playwright-stealth/default.nix
@ -0,0 +1,62 @@
+{
+  lib,
+  buildPythonPackage,
+  fake-http-header,
+  fetchFromGitHub,
+  idna,
+  mockito,
+  playwright,
+  poetry-core,
+  pytestCheckHook,
+  urllib3,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "tf-playwright-stealth";
+  version = "1.2.2-unstable-2026-06-30";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "tinyfish-io";
+    repo = "tf-playwright-stealth";
+    rev = "01b1b7a436edee4363a5d6f78f626a602550138b";
+    hash = "sha256-dUU0JqnEda0s6nVzJNmU1l536YZ05SI3DYhb7onuBwY=";
+  };
+
+  pythonRelaxDeps = [
+    "idna"
+    "urllib3"
+  ];
+
+  pythonRemoveDeps = [ "agentql" ];
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    fake-http-header
+    idna
+    playwright
+    urllib3
+  ];
+
+  nativeCheckInputs = [
+    mockito
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "playwright_stealth" ];
+
+  disabledTestPaths = [
+    # Requires agentql
+    "tests/e2e/"
+  ];
+
+  meta = with lib; {
+    description = "Module for using playwright stealthy";
+    homepage = "https://github.com/tinyfish-io/tf-playwright-stealth";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/torchaudio/default.nix
+++ b/pkgs/development/python-modules/torchaudio/default.nix
@ -23,8 +23,6 @@
  sentencepiece,
  soundfile,
  unidecode,
-  # linux-only:
-  fairseq,

  # passthru
  torchaudio,
@ -114,9 +112,6 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
    librosa
    requests
    soundfile
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    fairseq
  ];

  disabledTestPaths = [
--- a/pkgs/development/python-modules/unclecode-litellm/default.nix
+++ b/pkgs/development/python-modules/unclecode-litellm/default.nix
@ -0,0 +1,64 @@
+{
+  lib,
+  aiohttp,
+  buildPythonPackage,
+  click,
+  fastuuid,
+  fetchPypi,
+  httpx,
+  importlib-metadata,
+  jinja2,
+  jsonschema,
+  nix-update-script,
+  openai,
+  pydantic,
+  python-dotenv,
+  setuptools,
+  tiktoken,
+  tokenizers,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "unclecode-litellm";
+  version = "1.81.13";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "unclecode_litellm";
+    inherit (finalAttrs) version;
+    hash = "sha256-23DjTj6FnAoH8CywLqpkT4+ktOzF4vO+mli9fRw/7tw=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    click
+    fastuuid
+    httpx
+    importlib-metadata
+    jinja2
+    jsonschema
+    openai
+    pydantic
+    python-dotenv
+    tiktoken
+    tokenizers
+  ];
+
+  # tests require access network
+  doCheck = false;
+
+  pythonImportsCheck = [ "litellm" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Pre-compromise fork of litellm to interface with LLM API providers";
+    homepage = "https://pypi.org/project/unclecode-litellm";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/valhallaapi/default.nix
+++ b/pkgs/development/python-modules/valhallaapi/default.nix
@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  configparser,
+  fetchFromGitHub,
+  nix-update-script,
+  packaging,
+  requests,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "valhallaapi";
+  version = "0.5.2";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "NextronSystems";
+    repo = "valhallaAPI";
+    tag = finalAttrs.version;
+    hash = "sha256-B4nF1t+d6J7XXu51NjbvIUercBn/pQaXWkWpX99ok/M=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    configparser
+    packaging
+    requests
+  ];
+
+  pythonImportsCheck = [ "valhallaAPI" ];
+
+  # Tests require network access
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Valhalla API Client";
+    homepage = "https://github.com/NextronSystems/valhallaAPI";
+    changelog = "https://github.com/NextronSystems/valhallaAPI/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/tools/security/ghidra/extensions/ghidra-delinker-extension/binary-file-toolkit.nix
+++ b/pkgs/tools/security/ghidra/extensions/ghidra-delinker-extension/binary-file-toolkit.nix
@ -14,7 +14,7 @@ maven.buildMavenPackage (finalAttrs: {
    hash = "sha256-HMzRh/Q06Ik33mEkmh5U6qLiWk7ZCEstYq3Ll/pFhXM=";
  };

-  mvnHash = "sha256-Ek2qulMSHd1ZJfEloo6fIe+QMqub/Ftna/TzTt01ky8=";
+  mvnHash = "sha256-UrvPqh5zxhTQ6MJNJ7CSAA6dg5DX+Jdx6/wKr4/1brs=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -778,6 +778,8 @@ self: super: with self; {

  alphaessopenapi = callPackage ../development/python-modules/alphaessopenapi { };

+  alphashape = callPackage ../development/python-modules/alphashape { };
+
  altair = callPackage ../development/python-modules/altair { };

  altcha = callPackage ../development/python-modules/altcha { };
@ -3402,6 +3404,8 @@ self: super: with self; {

  crate = callPackage ../development/python-modules/crate { };

+  crawl4ai = callPackage ../development/python-modules/crawl4ai { };
+
  crayons = callPackage ../development/python-modules/crayons { };

  crc = callPackage ../development/python-modules/crc { };
@ -5505,6 +5509,8 @@ self: super: with self; {
    };
  };

+  fake-http-header = callPackage ../development/python-modules/fake-http-header { };
+
  fake-useragent = callPackage ../development/python-modules/fake-useragent { };

  faker = callPackage ../development/python-modules/faker { };
@ -12567,6 +12573,8 @@ self: super: with self; {

  patchpy = callPackage ../development/python-modules/patchpy { };

+  patchright = callPackage ../development/python-modules/patchright { };
+
  path = callPackage ../development/python-modules/path { };

  path-and-address = callPackage ../development/python-modules/path-and-address { };
@ -14061,6 +14069,8 @@ self: super: with self; {

  pydeconz = callPackage ../development/python-modules/pydeconz { };

+  pydeep2 = callPackage ../development/python-modules/pydeep2 { inherit (pkgs) ssdeep; };
+
  pydelijn = callPackage ../development/python-modules/pydelijn { };

  pydemumble = callPackage ../development/python-modules/pydemumble { };
@ -14771,6 +14781,8 @@ self: super: with self; {

  pymilvus = callPackage ../development/python-modules/pymilvus { };

+  pymisp = callPackage ../development/python-modules/pymisp { };
+
  pymitsubishi = callPackage ../development/python-modules/pymitsubishi { };

  pymitv = callPackage ../development/python-modules/pymitv { };
@ -19886,6 +19898,8 @@ self: super: with self; {

  tf-keras = callPackage ../development/python-modules/tf-keras { };

+  tf-playwright-stealth = callPackage ../development/python-modules/tf-playwright-stealth { };
+
  tf2onnx = callPackage ../development/python-modules/tf2onnx { };

  tflearn = callPackage ../development/python-modules/tflearn { };
@ -21138,6 +21152,8 @@ self: super: with self; {

  uncertainties = callPackage ../development/python-modules/uncertainties { };

+  unclecode-litellm = callPackage ../development/python-modules/unclecode-litellm { };
+
  uncompresspy = callPackage ../development/python-modules/uncompresspy { };

  uncompyle6 = callPackage ../development/python-modules/uncompyle6 { };
@ -21356,6 +21372,8 @@ self: super: with self; {
    callPackage ../development/python-modules/vacuum-map-parser-roborock
      { };

+  valhallaapi = callPackage ../development/python-modules/valhallaapi { };
+
  validate-email = callPackage ../development/python-modules/validate-email { };

  validator-collection = callPackage ../development/python-modules/validator-collection { };