Merge staging-next into staging

2026-07-06 17:13:24 -05:00 · 2026-05-23 00:42:13 +00:00 · 2026-05-23 00:42:13 +00:00 · db9ec4692a
commit db9ec4692a
parent bae9d3752c b1310343e6
85 changed files with 13233 additions and 504 deletions
--- a/nixos/modules/services/web-servers/h2o/common.nix
+++ b/nixos/modules/services/web-servers/h2o/common.nix
@ -5,7 +5,6 @@
      lib.types.enum [
        "modern"
        "intermediate"
-        "old"
      ]
    );
    default = null;
@ -28,10 +27,6 @@
      : General-purpose servers with a variety of clients, recommended for
        almost all systems

-      old
-      : Compatible with a number of very old clients, & should be used only as
-        a last resort
-
      The default for all virtual hosts can be set with
      services.h2o.defaultTLSRecommendations, but this value can be overridden
      on a per-host basis using services.h2o.hosts.<name>.tls.recommmendations.
--- a/nixos/modules/services/web-servers/h2o/default.nix
+++ b/nixos/modules/services/web-servers/h2o/default.nix
@ -84,8 +84,8 @@ let
        # other settings with the tests @
        # `nixos/tests/web-servers/h2o/tls-recommendations.nix`
        # & run with `nix-build -A nixosTests.h2o.tls-recommendations`
-        version = "5.7";
-        git_tag = "v5.7.1";
+        version = "6.0";
+        git_tag = "v6.0";
        guidelinesJSON =
          lib.pipe
            {
@ -93,7 +93,7 @@ let
                "https://ssl-config.mozilla.org/guidelines/${version}.json"
                "https://raw.githubusercontent.com/mozilla/ssl-config-generator/refs/tags/${git_tag}/src/static/guidelines/${version}.json"
              ];
-              sha256 = "sha256:1mj2pcb1hg7q2wpgdq3ac8pc2q64wvwvwlkb9xjmdd9jm4hiyny7";
+              sha256 = "sha256-aHdzLNPo4c6jlbS+Fg3R0X5VcdPKtUky0oX5Q7Y94SQ=";
            }
            [
              pkgs.fetchurl
--- a/nixos/tests/web-servers/h2o/tls-recommendations.nix
+++ b/nixos/tests/web-servers/h2o/tls-recommendations.nix
@ -25,7 +25,6 @@ let
          lib.optionalAttrs
            (builtins.elem recommendations [
              "intermediate"
-              "old"
            ])
            {
              openssl = pkgs.openssl_legacy;
@ -83,24 +82,20 @@ in
  nodes = {
    server_modern = mkH2OServer "modern";
    server_intermediate = mkH2OServer "intermediate";
-    server_old = mkH2OServer "old";
  };

  testScript =
    { nodes, ... }:
    let
-      inherit (nodes) server_modern server_intermediate server_old;
+      inherit (nodes) server_modern server_intermediate;
      modernPortStr = toString server_modern.services.h2o.hosts.${domain}.tls.port;
      intermediatePortStr = toString server_intermediate.services.h2o.hosts.${domain}.tls.port;
-      oldPortStr = toString server_old.services.h2o.hosts.${domain}.tls.port;
    in
-    # python
-    ''
+    /* python */ ''
      curl_basic = "curl -v --tlsv1.3 --http2 'https://${domain}:{port}/'"
      curl_head = "curl -v --head 'https://${domain}:{port}/'"
      curl_max_tls1_2 ="curl -v --tlsv1.0 --tls-max 1.2 'https://${domain}:{port}/'"
      curl_max_tls1_2_intermediate_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' 'https://${domain}:{port}/'"
-      curl_max_tls1_2_old_cipher ="curl -v --tlsv1.0 --tls-max 1.2 --ciphers 'ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256' 'https://${domain}:{port}/'"

      start_all()

@ -120,16 +115,5 @@ in
      assert "strict-transport-security" in intermediate_head
      server_intermediate.succeed(curl_max_tls1_2.format(port="${intermediatePortStr}"))
      server_intermediate.succeed(curl_max_tls1_2_intermediate_cipher.format(port="${intermediatePortStr}"))
-      server_intermediate.fail(curl_max_tls1_2_old_cipher.format(port="${intermediatePortStr}"))
-
-      server_old.wait_for_unit("h2o.service")
-      server_old.wait_for_open_port(${oldPortStr})
-      old_response = server_old.succeed(curl_basic.format(port="${oldPortStr}"))
-      assert "Hello, old!" in old_response
-      old_head = server_modern.succeed(curl_head.format(port="${oldPortStr}"))
-      assert "strict-transport-security" in old_head
-      server_old.succeed(curl_max_tls1_2.format(port="${oldPortStr}"))
-      server_old.succeed(curl_max_tls1_2_intermediate_cipher.format(port="${oldPortStr}"))
-      server_old.succeed(curl_max_tls1_2_old_cipher.format(port="${oldPortStr}"))
    '';
 }
--- a/pkgs/applications/emulators/libretro/cores/mame2000.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2000.nix
@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
  core = "mame2000";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-05-22";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mame2000-libretro";
-    rev = "cee538f9b28f00039f298cb3c2b588203f07d0be";
-    hash = "sha256-QgVLa6ZgyHWZeWRTemrzQW3hFYA+H+/twsghvlf/Z4c=";
+    rev = "fd0e767bd6378b35b505a04ada2b32bd98ffe8fb";
+    hash = "sha256-gS+fwsJ0/Bel2y2ajI+cSsrKlV5kWlCyOgr/JkJns1o=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/emulators/libretro/cores/prboom.nix
+++ b/pkgs/applications/emulators/libretro/cores/prboom.nix
@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "prboom";
-  version = "0-unstable-2026-05-04";
+  version = "0-unstable-2026-05-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-prboom";
-    rev = "01b7411dab3ba8da6cdbc4fa83ac207f038f524d";
-    hash = "sha256-wNVUflrVAwwMvCfRk94k9SyANvVeHB3noN3yb5TpJpc=";
+    rev = "648223372e24773821a2041e0c39728f723badf4";
+    hash = "sha256-LyITrBmL5me5zWOfMRZAeCM9rDS19aV2TAFuU8QU/Kw=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -420,14 +420,14 @@ in

  docker_29 =
    let
-      version = "29.4.3";
+      version = "29.5.1";
    in
    callPackage dockerGen {
      inherit version;
      cliRev = "v${version}";
-      cliHash = "sha256-jGD+Z3koM0a2Te7cq2HdKFizZj39djvTQUmn815Mn4o=";
+      cliHash = "sha256-oobGr0UaeJL800hHx3K0tQs50HZbOn559WcLnSRiRhU=";
      mobyRev = "docker-v${version}";
-      mobyHash = "sha256-YWmxJZwjxh0gwqjHHJDpzZy1K1jS82Twmzb+uWtnejk=";
+      mobyHash = "sha256-ghYEOWr5RUDm0YLyupaDSpLd+8gFqxp3VjCt+3lztcA=";
      runcRev = "v1.3.5";
      runcHash = "sha256-Swphxbu/OLkUrfRjLMZIVGwYb7AN0xHdyxm0ysAVam0=";
      containerdRev = "v2.2.3";
--- a/pkgs/build-support/setup-hooks/install-fonts.sh
+++ b/pkgs/build-support/setup-hooks/install-fonts.sh
@ -20,7 +20,7 @@
 # This hook also provides an `installFont` function that can be used to install
 # additional fonts of a particular extension into their respective folder.
 #
-postInstallHooks+=(installFonts)
+preInstallHooks+=(installFonts)

 installFont() {
  if (($# != 2)); then
--- a/pkgs/by-name/al/algia/package.nix
+++ b/pkgs/by-name/al/algia/package.nix
@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "algia";
-  version = "0.0.112";
+  version = "0.0.120";

  src = fetchFromGitHub {
    owner = "mattn";
    repo = "algia";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-y0mOzgWuuRAJQnP6Zg9lvjeOGMsJrRQgvPTmznK1PRA=";
+    hash = "sha256-pKoBPPvNtgRPwsJMSy8GViIB1Gcl780vsTPDjnhsB0Q=";
  };

  vendorHash = "sha256-JTTWVs0KwceiLy6tpyd48zORiXLc18zwgG1c+ceivKU=";
--- a/pkgs/by-name/ar/archisteamfarm/deps.json
+++ b/pkgs/by-name/ar/archisteamfarm/deps.json
@ -281,8 +281,8 @@
  },
  {
    "pname": "Markdig.Signed",
-    "version": "1.1.2",
-    "hash": "sha256-I2d1n2NTV0xr+qasoTt7FdUArCPrinvLVqR4ZB5uWtI="
+    "version": "1.1.3",
+    "hash": "sha256-luLhgpC0d2ZTtvoSvaH/yaIc/IDppyf4P8M7sGbExJw="
  },
  {
    "pname": "Microsoft.ApplicationInsights",
@ -291,8 +291,8 @@
  },
  {
    "pname": "Microsoft.AspNetCore.OpenApi",
-    "version": "10.0.5",
-    "hash": "sha256-CQXAu6Tm8nOy/rrZksIKGaLW7USEP/N1kwKBMLoh7js="
+    "version": "10.0.7",
+    "hash": "sha256-WlAW49otxYzgrmuqHewUoBsjDcAZwhNz5WVbCT4EiIA="
  },
  {
    "pname": "Microsoft.CodeAnalysis.ResxSourceGenerator",
@ -301,13 +301,13 @@
  },
  {
    "pname": "Microsoft.CodeCoverage",
-    "version": "18.0.1",
-    "hash": "sha256-G6y5iyHZ3R2shlLCW/uTusio/UqcnWT79X+UAbxvDQY="
+    "version": "18.3.0",
+    "hash": "sha256-fqKglbYvEb/77+rmUvLyLZSwROM1P9OW03Ub307WYZ8="
  },
  {
    "pname": "Microsoft.DiaSymReader",
-    "version": "2.0.0",
-    "hash": "sha256-8hotZmh8Rb6Q6oD9Meb74SvAdbDo39Y/1m8h43HHjjw="
+    "version": "2.2.3",
+    "hash": "sha256-Wf2Hy/9o3xSKB9ZRXj3oUgr2CcUwu+BFn2BP2cX7KJQ="
  },
  {
    "pname": "Microsoft.Extensions.Configuration",
@ -396,28 +396,28 @@
  },
  {
    "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.17.0",
-    "hash": "sha256-AU+EMOZArc3rTdsnKYzAufFAtspuYQM3XYi8/VsQAio="
+    "version": "8.18.0",
+    "hash": "sha256-mkguJA4aXIVVQvSJ9Duq9mivbGXAIkLQp3a8PKy223A="
  },
  {
    "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.17.0",
-    "hash": "sha256-MH7vdhCNAae32p6UTvaDtmyvFDxa/W71qTsEQ6yC9xM="
+    "version": "8.18.0",
+    "hash": "sha256-MdqY9CGRs+fTLb3HYYcSfuzqDFo4Dpho4McFWWferjA="
  },
  {
    "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.17.0",
-    "hash": "sha256-IM6jsPMz+l9JA0cye/v2ke51xlfP0u5HtWBqc2aKDYM="
+    "version": "8.18.0",
+    "hash": "sha256-09WyYskyL8gjjVDzoZBQAGXgsPmyagWftALSBCdt4gg="
  },
  {
    "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.17.0",
-    "hash": "sha256-XcA0KXJbqMWt0I5LuHHMRLpgVQ18KcBej1BoySHeA1A="
+    "version": "8.18.0",
+    "hash": "sha256-sFhonZW9G6H4ooQ6N/78fkZvADZ2Hf5WAS3FKd/ue1E="
  },
  {
    "pname": "Microsoft.NET.Test.Sdk",
-    "version": "18.0.1",
-    "hash": "sha256-0c3/rp9di0w7E5UmfRh6Prrm3Aeyi8NOj5bm2i6jAh0="
+    "version": "18.3.0",
+    "hash": "sha256-o2bILLF5i+XUoi8xZYgolU3CxLTdql5R/tEVWVnKFPU="
  },
  {
    "pname": "Microsoft.OpenApi",
@ -426,73 +426,73 @@
  },
  {
    "pname": "Microsoft.Testing.Extensions.CodeCoverage",
-    "version": "18.4.1",
-    "hash": "sha256-GhxGUnM8Dvef4E0mPrNOEkoHD/sjcZX68rd78OytPPY="
+    "version": "18.5.2",
+    "hash": "sha256-PkIEXfbyEwlxOIG4h420/TpWbbzAy7eV8RUy7iXHVtk="
  },
  {
    "pname": "Microsoft.Testing.Extensions.Telemetry",
-    "version": "2.1.0",
-    "hash": "sha256-SawLiz1fB3QbkkyEVloEj8UpQTAIZR7U9FZfqwCkGr0="
+    "version": "2.2.2",
+    "hash": "sha256-4rXpgfroh8MnLWjYxUtYo/VcErYe9gpCaz80np3r1CI="
  },
  {
    "pname": "Microsoft.Testing.Extensions.TrxReport",
-    "version": "2.1.0",
-    "hash": "sha256-wNFj4ovblsnnDIYfDmhAE87hA5YWONhLSGLyTRuxbS4="
+    "version": "2.2.2",
+    "hash": "sha256-IOgroCb3Wvwas4z2Xxy4ils5AswZpKT/wvjQM5e95ig="
  },
  {
    "pname": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
-    "version": "2.1.0",
-    "hash": "sha256-X54qc4Ey+3hm0e5eCY1R2me8b4zGrWzjesm9fGJWXys="
+    "version": "2.2.2",
+    "hash": "sha256-aP+mw/Q5U6lfNmMJCzLqVMpZ+TnBMTqXH0VGhR2FvbI="
  },
  {
    "pname": "Microsoft.Testing.Extensions.VSTestBridge",
-    "version": "2.1.0",
-    "hash": "sha256-2m14uEmuEELn4Ci/CZNpKjhlnzq9vYvhgeiM03DZj7A="
-  },
-  {
-    "pname": "Microsoft.Testing.Platform",
-    "version": "2.0.2",
-    "hash": "sha256-K8B4tQaYslm+njUQ59nyvh4f4UgrbOo6DQgO9Hwt0aY="
+    "version": "2.2.2",
+    "hash": "sha256-rtyA0w70swCKfz+ly6ev/BlNXH8WUHurfxsaWoo1LbA="
  },
  {
    "pname": "Microsoft.Testing.Platform",
    "version": "2.1.0",
    "hash": "sha256-CbR0j0Dh65cMccO7L6ppx4b5iiXjqxjjfC9A85HeLuM="
  },
+  {
+    "pname": "Microsoft.Testing.Platform",
+    "version": "2.2.2",
+    "hash": "sha256-azYgL1c9oVE1JDYs0HUWTClaIumw1xvxgmNz4Mx0q30="
+  },
  {
    "pname": "Microsoft.Testing.Platform.MSBuild",
-    "version": "2.1.0",
-    "hash": "sha256-6T2tBSokr5/oiwqKASk18BieKqkIzDbYX32j1Hl1z1g="
+    "version": "2.2.2",
+    "hash": "sha256-uuhiI0aGFpM+I2ASh99rsfsRhKf8b/JUNx4Hcd2Ac6Q="
  },
  {
    "pname": "Microsoft.TestPlatform.ObjectModel",
-    "version": "18.0.1",
-    "hash": "sha256-oJbS7SZ46RzyOQ+gCysW7qJRy7V8RlQVa5d8uajb91M="
+    "version": "18.3.0",
+    "hash": "sha256-3Y3OxAQsXl6sunQlSjfq31aLWykHQTj2o/TOVI/uy88="
  },
  {
    "pname": "Microsoft.TestPlatform.TestHost",
-    "version": "18.0.1",
-    "hash": "sha256-OXYf5vg4piDr10ve0bZ2ZSb+nb3yOiHayJV3cu5sMV4="
+    "version": "18.3.0",
+    "hash": "sha256-OkR+XvipAHPQbHywTwN8lVcMpyRs2MUJKCxJ5OfKAFk="
  },
  {
    "pname": "MSTest",
-    "version": "4.1.0",
-    "hash": "sha256-uzieN/+aBExm5gKSzQLwkTxrNqGigGhozeAOaApI8bg="
+    "version": "4.2.2",
+    "hash": "sha256-hTD140FHBWOoUxKmCkmL261gvwgJRXnzAwSl37sp6XI="
  },
  {
    "pname": "MSTest.Analyzers",
-    "version": "4.1.0",
-    "hash": "sha256-FeMIXYRPxXJCAKOk3dKWCtoNX3wC36NqC/IduOd1xTE="
+    "version": "4.2.2",
+    "hash": "sha256-m6FRWUdYM9tuNnm7ehY+j1wIr2i12+0LeK5JcpJdp5M="
  },
  {
    "pname": "MSTest.TestAdapter",
-    "version": "4.1.0",
-    "hash": "sha256-g7MuXzSJ2+ydwPzdBRzE8WFsjWSI3tf1X0rLNy7a9qU="
+    "version": "4.2.2",
+    "hash": "sha256-QFjHNHVyijmuq29MuhUNMnaWEcJWPWGVp21BQj0Hb7M="
  },
  {
    "pname": "MSTest.TestFramework",
-    "version": "4.1.0",
-    "hash": "sha256-ELpj0a6VDEIzY7RWsdyF/DREK8I/6CZen3OYO5dvloI="
+    "version": "4.2.2",
+    "hash": "sha256-+yrzh3fmkvOMnqk+eYKQTC1267uKeUDcS3TV1+3Gnck="
  },
  {
    "pname": "Newtonsoft.Json",
@ -521,58 +521,58 @@
  },
  {
    "pname": "NLog",
-    "version": "6.1.1",
-    "hash": "sha256-4pxy5z5FyRxBmZNBw+n32SjgEQzMsgSHTuSSn+vxLzk="
+    "version": "6.1.3",
+    "hash": "sha256-s0sxfQ1tiWRSFVh/m/eIzEe4+ZgT02e9GZiwDAi7xp4="
  },
  {
    "pname": "NLog.Extensions.Logging",
-    "version": "6.1.2",
-    "hash": "sha256-H8Wu5NlzMrbQ3IlTD0hutb9ZAg73YBynnjjtTp9NMqk="
+    "version": "6.1.3",
+    "hash": "sha256-7Ryjk3FZqz6Cn8bCSK5OUf7VCQL9LA/bMCgwr5tpIys="
  },
  {
    "pname": "NLog.Web.AspNetCore",
-    "version": "6.1.2",
-    "hash": "sha256-m/MF3dljgRIeGdYdh5m20lKMaQkMadUgXBBp2k5OtaQ="
+    "version": "6.1.3",
+    "hash": "sha256-FXxcK5kXO6qy/jw0lnphzhs9QF3u/i5A4GD13jqclUA="
  },
  {
    "pname": "OpenTelemetry",
-    "version": "1.15.0",
-    "hash": "sha256-L/CK3hlDc4+G16XZbV9y3iqV2ckIOiQQr1k4inWRtVQ="
+    "version": "1.15.3",
+    "hash": "sha256-zOrEPW8noHfUINJtIWQYMTls2JLRUYm7aoyffjrMBLU="
  },
  {
    "pname": "OpenTelemetry.Api",
-    "version": "1.15.0",
-    "hash": "sha256-CwzaQ4MKSdJ1q6qNzPXKRKNEvOLy5N9DDHu+TWqRYkU="
+    "version": "1.15.3",
+    "hash": "sha256-vriWJD2xvBt6ir9u5o/aVPBqBJJA7S6IJhkjKDkeLfc="
  },
  {
    "pname": "OpenTelemetry.Api.ProviderBuilderExtensions",
-    "version": "1.15.0",
-    "hash": "sha256-nYCg/lvC5Z7nmjWl1ikZALBvuYbDTN/6eqvANwjiHjI="
+    "version": "1.15.3",
+    "hash": "sha256-Z4x0eA1dkCOJS5xYZ6ogMOk6H+ivvXuVj1mORyWMOSo="
  },
  {
    "pname": "OpenTelemetry.Exporter.Prometheus.AspNetCore",
-    "version": "1.15.0-beta.1",
-    "hash": "sha256-NcMQu+IA3Nj3EkQgs2/T6kr36KJwj0/WkDlXtiyPJoU="
+    "version": "1.15.3-beta.1",
+    "hash": "sha256-qgaIwTB9To17OifsThq1AsXg1Ms8sqnooAvf+gNJR8Y="
  },
  {
    "pname": "OpenTelemetry.Extensions.Hosting",
-    "version": "1.15.0",
-    "hash": "sha256-4Y/qP5ao56w5T6B93CVQ+9ktuPYfeMg20BTRHe7q1L4="
+    "version": "1.15.3",
+    "hash": "sha256-5Z5/80xNttniodCF71s9cGXvDCkIc8Qdvpr969K5G0c="
  },
  {
    "pname": "OpenTelemetry.Instrumentation.AspNetCore",
-    "version": "1.15.1",
-    "hash": "sha256-72oILNRkqztOpRTNC/SjIrqe63ihs33ZwTvgKeP7rws="
+    "version": "1.15.2",
+    "hash": "sha256-rfStn++qynwoTOa5H5IFwbAPn7sOgW/vebcfKvOusio="
  },
  {
    "pname": "OpenTelemetry.Instrumentation.Http",
-    "version": "1.15.0",
-    "hash": "sha256-0qhyaFFqkscIJ5VN2Ya8rPGOrui40G//pG3cQJflsmg="
+    "version": "1.15.1",
+    "hash": "sha256-VG3zmUmFcN+mk7BkIcss1RjkcrVWrQMn8AUDTM4wpus="
  },
  {
    "pname": "OpenTelemetry.Instrumentation.Runtime",
-    "version": "1.15.0",
-    "hash": "sha256-thtGamTazhUbxMP//ztbvLfAcNy3dtdtUStVkycW4Io="
+    "version": "1.15.1",
+    "hash": "sha256-wE0909zdzuGUB/KD/yEfLV9F5EvZGMmwjL2tpO4bOh4="
  },
  {
    "pname": "protobuf-net",
@ -586,8 +586,8 @@
  },
  {
    "pname": "Scalar.AspNetCore",
-    "version": "2.13.15",
-    "hash": "sha256-kT5XPl+ZuqMByeH3gLe3EKd3G3yzXViCnehC0fag0lM="
+    "version": "2.14.11",
+    "hash": "sha256-NOH8fyTW+uuvggup1581IwO1Gv1FyvpCQMsPWItBlwA="
  },
  {
    "pname": "SteamKit2",
@ -596,33 +596,33 @@
  },
  {
    "pname": "System.Composition",
-    "version": "10.0.5",
-    "hash": "sha256-+Vi5vhZm+McB1aYmUtvPiJDgylwB06PNiFMyCXz435g="
+    "version": "10.0.7",
+    "hash": "sha256-+D0uPBsF3vIl1IU3DZ1aCWpdQompwSvyFLvxprUErAE="
  },
  {
    "pname": "System.Composition.AttributedModel",
-    "version": "10.0.5",
-    "hash": "sha256-z81DulJ1fL+UBve882LNCyz/+/vaI4ZIN2FnGWuDTDk="
+    "version": "10.0.7",
+    "hash": "sha256-PxE1IuviKGncIzrCFNqhqFMNzEdnN5/A9kFHSyvg4P4="
  },
  {
    "pname": "System.Composition.Convention",
-    "version": "10.0.5",
-    "hash": "sha256-bG/OoFHQ2Uq3Ez+G6UKZrDCAoY+5kgeEBNAIIf7ClGc="
+    "version": "10.0.7",
+    "hash": "sha256-oPAOsNnNF0tOXHZoxnQt7PC2R4f+iqmzYKg++zPCdaA="
  },
  {
    "pname": "System.Composition.Hosting",
-    "version": "10.0.5",
-    "hash": "sha256-lWMeuR0MrTf/lahN/Sk7g0bppJ3VZvYAmbBFE3Zd73Y="
+    "version": "10.0.7",
+    "hash": "sha256-bBoobvUuurRqog2nqchZKTwkIn7Weq7M3auboVgwALA="
  },
  {
    "pname": "System.Composition.Runtime",
-    "version": "10.0.5",
-    "hash": "sha256-uzEeZ4NA4b9O2hVVUuR3haRYGUt/OROelrwis+spu94="
+    "version": "10.0.7",
+    "hash": "sha256-sZTjqpSbbEy4KsRMDoEKvvfjHkl7IL9pcD2N8kFVWro="
  },
  {
    "pname": "System.Composition.TypedParts",
-    "version": "10.0.5",
-    "hash": "sha256-nIWGm5I+eR5kx+VL+1PsOFXYgvKd2vwB7s/gPYOxKfI="
+    "version": "10.0.7",
+    "hash": "sha256-gqDp0guxUnnEJaB6I/9PSgxXWDbE5YhyrTa9Yu4s0OM="
  },
  {
    "pname": "System.IO.Hashing",
@ -631,13 +631,13 @@
  },
  {
    "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "10.0.5",
-    "hash": "sha256-Zyqq70EacxdKIx78p49cZ2rveGLxzU9VZxJsPtB2bK0="
+    "version": "10.0.7",
+    "hash": "sha256-IhiXDRoBQil9KAVV97PiCOhiIQCSTIJuKQOOfBECSz0="
  },
  {
    "pname": "Tmds.DBus.Protocol",
-    "version": "0.91.1",
-    "hash": "sha256-L7L4zp8NtS+VvLVjgqgBkVzCxElxfGSCTJwC5gWbq9A="
+    "version": "0.93.0",
+    "hash": "sha256-Oi2SDkrhTG3v9KXlRsmXQWsRJbQYVqg9bgiao1pUD0k="
  },
  {
    "pname": "ZstdSharp.Port",
--- a/pkgs/by-name/ar/archisteamfarm/package.nix
+++ b/pkgs/by-name/ar/archisteamfarm/package.nix
@ -21,13 +21,13 @@ in
 buildDotnetModule rec {
  pname = "archisteamfarm";
  # nixpkgs-update: no auto update
-  version = "6.3.4.2";
+  version = "6.3.6.0";

  src = fetchFromGitHub {
    owner = "JustArchiNET";
    repo = "ArchiSteamFarm";
    rev = version;
-    hash = "sha256-h9wvMT7BIzIMSnHoinBiZLYbWYPELT3dO+ao+gwTfbw=";
+    hash = "sha256-S2T741eOO0s8a3pikHz0hy/PBPpw5fmtpzGv0cmRk0I=";
  };

  dotnet-runtime = dotnetCorePackages.aspnetcore_10_0;
--- a/pkgs/by-name/aw/aws-sam-cli/package.nix
+++ b/pkgs/by-name/aw/aws-sam-cli/package.nix
@ -2,7 +2,6 @@
  lib,
  python3,
  fetchFromGitHub,
-  fetchpatch2,
  git,
  testers,
  aws-sam-cli,
@ -12,14 +11,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "aws-sam-cli";
-  version = "1.154.0";
+  version = "1.160.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-sam-cli";
    tag = "v${version}";
-    hash = "sha256-wy6LZbWmK5rb0foFttPOvDOsFtrQNFc8mGBP9WTzVyw=";
+    hash = "sha256-IBxnBIgTSpPUNb/4yx3OqA7WFzudzRKgkKCFsJeyx08=";
  };

  build-system = with python3.pkgs; [ setuptools ];
@ -30,6 +29,7 @@ python3.pkgs.buildPythonApplication rec {
    "boto3"
    "boto3-stubs"
    "cfn-lint"
+    "click"
    "cookiecutter"
    "docker"
    "jsonschema"
@ -58,6 +58,7 @@ python3.pkgs.buildPythonApplication rec {
      flask
      jsonschema
      pyopenssl
+      python-dotenv
      pyyaml
      requests
      rich
@ -87,20 +88,6 @@ python3.pkgs.buildPythonApplication rec {
      ]
    );

-  patches = [
-    # Remove after aws-sam-cli > 1.154.0
-    (fetchpatch2 {
-      url = "https://github.com/aws/aws-sam-cli/commit/1e1664faae8ff799cbb03fe16ef1650689803587.patch";
-      hash = "sha256-HnOBrKkE/sIGZrgRq8G+ef1wnGvtALV4wma8J5eZfLc=";
-    })
-  ];
-
-  # Remove after upstream bumps click > 8.1.8
-  postPatch = ''
-    substituteInPlace requirements/base.txt --replace-fail \
-      'click==8.1.8' 'click==${python3.pkgs.click.version}'
-  '';
-
  postFixup = ''
    # Disable telemetry: https://github.com/aws/aws-sam-cli/issues/1272
    wrapProgram $out/bin/sam \
@ -129,9 +116,7 @@ python3.pkgs.buildPythonApplication rec {
    "-Wignore::DeprecationWarning"
  ];

-  enabledTestPaths = [
-    "tests"
-  ];
+  enabledTestPaths = [ "tests" ];

  disabledTestPaths = [
    # Disable tests that requires networking or complex setup
@ -158,6 +143,8 @@ python3.pkgs.buildPythonApplication rec {
    "test_delete_deployment"
    "test_request_with_no_data"
    "test_import_should_succeed_for_a_defined_hidden_package_540_pkg_resources_py2_warn"
+    "test_updates_imageuri_when_pointing_to_local_archive"
+    "test_subcommand_help_0_invoke"
  ];

  pythonImportsCheck = [ "samcli" ];
--- a/pkgs/by-name/bi/bitwarden-cli/package.nix
+++ b/pkgs/by-name/bi/bitwarden-cli/package.nix
@ -14,13 +14,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "bitwarden-cli";
-  version = "2026.4.1";
+  version = "2026.4.2";

  src = fetchFromGitHub {
    owner = "bitwarden";
    repo = "clients";
    tag = "cli-v${finalAttrs.version}";
-    hash = "sha256-QhkuGW3R577zHpTZ1+GPhEtSUdZAKrAN/WPJhA5AA7c=";
+    hash = "sha256-8UDzW93O+AvMGXcVHe1PTvYvmXewl/bXsxIdjoGRtcQ=";
  };

  postPatch = ''
@ -38,7 +38,7 @@ buildNpmPackage (finalAttrs: {
  nodejs = nodejs_22;
  npmDepsFetcherVersion = 2;

-  npmDepsHash = "sha256-QCN0fyXr/D39MJnwOyAvYu5hANj8flk3HMVuw9kaJwc=";
+  npmDepsHash = "sha256-3RQ0HRsLQlXMeJIHAPKbZsGi6I/70pSIg8NM/3uJvUo=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    perl
--- a/pkgs/by-name/ch/chafa/package.nix
+++ b/pkgs/by-name/ch/chafa/package.nix
@ -19,14 +19,14 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "1.18.1";
+  version = "1.18.2";
  pname = "chafa";

  src = fetchFromGitHub {
    owner = "hpjansson";
    repo = "chafa";
    tag = finalAttrs.version;
-    hash = "sha256-Is7N5WUjYVDFz1VKrKQqa7n48gXf2JtvDHB5vXMjoZg=";
+    hash = "sha256-M4TTLpaIV7H3aLj7/C7FHT0GNCxN9SRZ81FtxuWNzjo=";
  };

  outputs = [
--- a/pkgs/by-name/co/cohomcalg/package.nix
+++ b/pkgs/by-name/co/cohomcalg/package.nix
@ -49,5 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/BenjaminJurke/cohomCalg";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ coolcuber ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/co/comma/package.nix
+++ b/pkgs/by-name/co/comma/package.nix
@ -1,6 +1,5 @@
 {
  stdenv,
-  comma,
  fetchFromGitHub,
  installShellFiles,
  fzy,
@ -8,7 +7,7 @@
  nix-index-unwrapped,
  nix,
  rustPlatform,
-  testers,
+  versionCheckHook,
  buildPackages,
 }:

@ -16,10 +15,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "comma";
  version = "2.4.1";

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "nix-community";
    repo = "comma";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-XZB0zx4wyNzy0LggAmh2gT2aEWAqVI9NljRoOkeK0c8=";
  };

@ -56,9 +57,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    installManPage comma.1
  '';

-  passthru.tests = {
-    version = testers.testVersion { package = comma; };
-  };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;

  meta = {
    homepage = "https://github.com/nix-community/comma";
--- a/pkgs/by-name/db/dblab/package.nix
+++ b/pkgs/by-name/db/dblab/package.nix
@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "dblab";
-  version = "0.38.0";
+  version = "0.39.0";

  src = fetchFromGitHub {
    owner = "danvergara";
    repo = "dblab";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0tkIDWAub+wfoJ760m1kU7XYnGNner/zLtCod6UPF60=";
+    hash = "sha256-tiB1nX3sm/pZpOFgNyhgxDsEzk0QcJQjwTLYx17LQMI=";
  };

  vendorHash = "sha256-UGnbXjXnZ3EVcAk0ZTaV2wWWXv5nsbyNlTv8PMl2rP4=";
--- a/pkgs/by-name/de/deja/package.nix
+++ b/pkgs/by-name/de/deja/package.nix
@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "deja";
+  version = "0.2.5";
+  __structuredAttrs = true;
+  src = fetchFromGitHub {
+    owner = "Giammarco-Ferranti";
+    repo = "deja";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0eRXPtm+L1C4/fc/WLn9p2LV8uhJ4w+40hhA69+CEdw=";
+  };
+
+  vendorHash = "sha256-KmLdMK94cGOXMPJwWS6NgLB5OiNmJbszHdnLzauqJm8=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  doCheck = true;
+
+  nativeCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Predictive inline shell autosuggestions for zsh";
+    homepage = "https://github.com/Giammarco-Ferranti/deja";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ tomasrivera ];
+    mainProgram = "deja";
+  };
+})
--- a/pkgs/by-name/fi/fira-sans/package.nix
+++ b/pkgs/by-name/fi/fira-sans/package.nix
@ -21,7 +21,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    stripRoot = false;
  };

-  postInstall = ''
+  preInstall = ''
    rm -r "__MACOSX"
  '';

--- a/pkgs/by-name/fl/flare-signal/package.nix
+++ b/pkgs/by-name/fl/flare-signal/package.nix
@ -24,18 +24,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "flare";
-  version = "0.20.4";
+  version = "0.20.5";

  src = fetchFromGitLab {
    owner = "schmiddi-on-mobile";
    repo = "flare";
    tag = finalAttrs.version;
-    hash = "sha256-Py5NKH8kBIBMfq3tz59fz5MZdPE6DC6NS2m5HlhSf5M=";
+    hash = "sha256-ZxUIqfEQe7tv6HBwOMLKruYDNJLlRie3nztwVER6sAE=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-DD6bqw0RUClkjClS2QjYOt3PMKy3d9uRZVBf7bVR4hg=";
+    hash = "sha256-dNcHPLoKbHFj73Xtb4Ud42xKmmLy9eADUnsqPj9+l8Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fl/flexget/package.nix
+++ b/pkgs/by-name/fl/flexget/package.nix
@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "flexget";
-  version = "3.19.17";
+  version = "3.19.21";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Flexget";
    repo = "Flexget";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0NSK7yUWw/fUmhNdP+/KVgyKTpsk131yxtP5yMQMc2c=";
+    hash = "sha256-rwG+D1XE6Am5B2gt8iOyaTrfwRV1dCvkAj5BeQeX4cw=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/by-name/fo/fop/fix-maven-plugin-versions.patch
+++ b/pkgs/by-name/fo/fop/fix-maven-plugin-versions.patch
@ -0,0 +1,72 @@
+diff --git a/pom.xml b/pom.xml
+index 8f135d34c..f4e972e2d 100644
+--- a/pom.xml
+++ b/pom.xml
+@@ -92,6 +92,41 @@
+           <artifactId>maven-jar-plugin</artifactId>
+           <version>${jar.plugin.version}</version>
+         </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-site-plugin</artifactId>
+          <version>3.20.0</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-clean-plugin</artifactId>
+          <version>3.2.0</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-install-plugin</artifactId>
+          <version>3.1.3</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-deploy-plugin</artifactId>
+          <version>3.1.2</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-resources-plugin</artifactId>
+          <version>3.3.1</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-dependency-plugin</artifactId>
+          <version>3.7.0</version>
+        </plugin>
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-assembly-plugin</artifactId>
+          <version>3.7.1</version>
+        </plugin>
+         <plugin>
+           <groupId>org.apache.maven.plugins</groupId>
+           <artifactId>maven-project-info-reports-plugin</artifactId>
+@@ -107,6 +142,25 @@
+           <artifactId>spotbugs-maven-plugin</artifactId>
+           <version>${findbugs.plugin.version}</version>
+         </plugin>        
+        <plugin>
+          <groupId>org.apache.maven.plugins</groupId>
+          <artifactId>maven-enforcer-plugin</artifactId>
+          <version>3.5.0</version>
+          <configuration>
+            <rules>
+              <requirePluginVersions />
+            </rules>
+          </configuration>
+          <executions>
+            <execution>
+              <id>require-all-plugin-versions-to-be-set</id>
+              <phase>validate</phase>
+              <goals>
+                <goal>enforce</goal>
+              </goals>
+            </execution>
+          </executions>
+        </plugin>
+       </plugins>
+     </pluginManagement>
+   </build>
--- a/pkgs/by-name/fo/fop/package.nix
+++ b/pkgs/by-name/fo/fop/package.nix
@ -16,6 +16,8 @@ maven.buildMavenPackage rec {
    hash = "sha256-uY6cUjmyuenfK3jAWvugsYa5qg8rbnvRZZ6qA/g2fZM=";
  };

+  patches = [ ./fix-maven-plugin-versions.patch ];
+
  mvnHash = "sha256-EaOIAy0+YPrF+yGsFKKqcA4bt90bq1Z86V57P9rMatE=";

  buildOffline = true;
--- a/pkgs/by-name/fr/fragment-mono/package.nix
+++ b/pkgs/by-name/fr/fragment-mono/package.nix
@ -2,24 +2,24 @@
  lib,
  stdenvNoCC,
  fetchzip,
+  installFonts,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "fragment-mono";
  version = "1.21";

+  outputs = [
+    "out"
+    "webfont"
+  ];
+
  src = fetchzip {
    url = "https://github.com/weiweihuanghuang/fragment-mono/releases/download/${finalAttrs.version}/fragment-mono-${finalAttrs.version}.zip";
    hash = "sha256-H5s4rYDN2d0J+zVRgBzg8vfZXCA/jjHrGBV8o8Dxutc=";
  };

-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 fonts/ttf/*.ttf -t $out/share/fonts/truetype
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    homepage = "https://github.com/weiweihuanghuang/fragment-mono";
--- a/pkgs/by-name/fr/frobby/package.nix
+++ b/pkgs/by-name/fr/frobby/package.nix
@ -65,5 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/Macaulay2/frobby";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ coolcuber ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/gi/gitea/package.nix
+++ b/pkgs/by-name/gi/gitea/package.nix
@ -30,7 +30,7 @@ let
      inherit (finalAttrs) pname version src;
      inherit pnpm;
      fetcherVersion = 3;
-      hash = "sha256-dewYYPO2wmNyYiQadoEKWJ10cghm6Lv7UE1iVlyNiEY=";
+      hash = "sha256-Qo0DLuZv+2GVLsBfCv/6CC9E/qhSE4HwV4StQL4HX4Y=";
    };

    nativeBuildInputs = [
@ -51,18 +51,18 @@ let
 in
 buildGoModule rec {
  pname = "gitea";
-  version = "1.26.1";
+  version = "1.26.2";

  src = fetchFromGitHub {
    owner = "go-gitea";
    repo = "gitea";
    tag = "v${gitea.version}";
-    hash = "sha256-UlPS+gcSEzKY+g5y+k3NsL3b8FRVHnlqkiuJTz5ijFM=";
+    hash = "sha256-S7KV7soOnVQbw+2Ru7+DOL3Q4uWmSSdR6K90yofQlqw=";
  };

  proxyVendor = true;

-  vendorHash = "sha256-JSyjJIdRePbSnKL6GHdjx5Xbnsniq6KHOlEFsYvMmbw=";
+  vendorHash = "sha256-7+M1n8RSgB3gZ/2na4RF9kYOf90H0bnsJZMDKpgAy64=";

  outputs = [
    "out"
@ -77,14 +77,14 @@ buildGoModule rec {
  overrideModAttrs = _: {
    postPatch = ''
      substituteInPlace go.mod \
-        --replace-fail "go 1.26.2" "go 1.26"
+        --replace-fail "go 1.26.3" "go 1.26"
    '';
  };

  postPatch = ''
    substituteInPlace modules/setting/server.go --subst-var data
    substituteInPlace go.mod \
-      --replace-fail "go 1.26.2" "go 1.26"
+      --replace-fail "go 1.26.3" "go 1.26"
  '';

  subPackages = [ "." ];
--- a/pkgs/by-name/gi/gitfs/package.nix
+++ b/pkgs/by-name/gi/gitfs/package.nix
@ -1,60 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  python3Packages,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "gitfs";
-  version = "0.5.2";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "PressLabs";
-    repo = "gitfs";
-    rev = version;
-    sha256 = "1jzwdwan8ndvp2lw6j7zbvg5k9rgf2d8dcxjrwc6bwyk59xdxn4p";
-  };
-
-  patchPhase = ''
-    # requirement checks are unnecessary at runtime
-    echo > requirements.txt
-
-    # NOTE: As of gitfs 0.5.2, The pygit2 release that upstream uses is a major
-    # version behind the one packaged in nixpkgs.
-    substituteInPlace gitfs/mounter.py --replace \
-      'from pygit2.remote import RemoteCallbacks' \
-      'from pygit2 import RemoteCallbacks'
-  '';
-
-  nativeCheckInputs = with python3Packages; [
-    pytestCheckHook
-    pytest-cov-stub
-    mock
-  ];
-  propagatedBuildInputs = with python3Packages; [
-    atomiclong
-    fusepy
-    pygit2
-    six
-  ];
-
-  pythonImportsCheck = [ "gitfs" ];
-
-  meta = {
-    description = "FUSE filesystem that fully integrates with git";
-    longDescription = ''
-      A git remote repository's branch can be mounted locally,
-      and any subsequent changes made to the files will be
-      automatically committed to the remote.
-    '';
-    homepage = "https://github.com/PressLabs/gitfs";
-    license = lib.licenses.asl20;
-    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.robbinch ];
-    mainProgram = "gitfs";
-    # requires <=python39, otherwise you get this at runtime:
-    # AttributeError: module 'collections' has no attribute 'MutableMapping'
-    broken = true;
-  };
-}
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "h2o";
-  version = "2.3.0-rolling-2026-04-30";
+  version = "2.3.0-rolling-2026-05-15";

  src = fetchFromGitHub {
    owner = "h2o";
    repo = "h2o";
-    rev = "8cb324bd2d5efb1926d0b8408b1d367687e50cfa";
-    hash = "sha256-4GS2hQzBJXA0C9ClWGppocBdjO4BHDK2Balm0O8Ps/I=";
+    rev = "9e7f283e5801bd0707cc5d48d0188c4c162fe7b3";
+    hash = "sha256-8FdUQLX67E+7f4HyoH6atLDxYzniVEFqc+jbjzTytFM=";
  };

  outputs = [
--- a/pkgs/by-name/ha/har-to-k6/package.nix
+++ b/pkgs/by-name/ha/har-to-k6/package.nix
@ -8,18 +8,18 @@

 buildNpmPackage rec {
  pname = "har-to-k6";
-  version = "0.14.14";
+  version = "0.14.15";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "har-to-k6";
    tag = "v${version}";
-    hash = "sha256-03WhzmdmncM7YqavYnivzxD3oo48MAkrn/1qTcK8w7o=";
+    hash = "sha256-8cMq0fWBRPR9SmPMSgjulA//BN91xZbFVPCYxxULRKQ=";
  };

  dontNpmBuild = true;

-  npmDepsHash = "sha256-ZVBlHjDB5LbOWXuoz4IIQF0lqDGANxpPE1sAy9roxbo=";
+  npmDepsHash = "sha256-7YPlXrBxO3Zdm+3vkHdcCABV1dUJ6BCPwCZ4IFKZjT4=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
--- a/pkgs/by-name/hl/hledger-fmt/package.nix
+++ b/pkgs/by-name/hl/hledger-fmt/package.nix
@ -9,20 +9,20 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "hledger-fmt";
-  version = "0.3.8";
+  version = "0.3.9";

  src = fetchFromGitHub {
    owner = "mondeja";
    repo = "hledger-fmt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GbDZ6fvzd6/flASqy86km1LZ+B+loy0odmRQRfdkcCs=";
+    hash = "sha256-knwrx1hfSBmgZLqmcAOf4Rtc5yVO50IdrzovAgOgQD0=";
  };

  nativeBuildInputs = [
    installShellFiles
  ];

-  cargoHash = "sha256-LN9D7EVbDUjNa/eCmuBT2kghzDqoXhMB5ihx40ixS1E=";
+  cargoHash = "sha256-/Tz5WqnBIU4vXKhGsODZKD1sFti797Ya6OHeg4I7Flk=";

  # Tests try to invoke the binary from "target/debug/hledger-fmt"
  # https://github.com/mondeja/hledger-fmt/blob/783abdb32eefb20195c7e9562858552935bb9c8e/src/cli/tests.rs#L5
--- a/pkgs/by-name/ip/ip2unix/package.nix
+++ b/pkgs/by-name/ip/ip2unix/package.nix
@ -20,24 +20,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ip2unix";
-  version = "2.2.1";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "nixcloud";
    repo = "ip2unix";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-+p5wQbX35LAjZ4vIE4AhI4M6gQ7gVviqf9jJDAr9xg8";
+    hash = "sha256-QWhOO2tHl8fwXy0k9W+I/XHPJI8OJyexMsgOSJes37s";
  };

-  patches = [
-    # https://github.com/nixcloud/ip2unix/pull/35
-    # fix out of range string_view access
-    (fetchpatch {
-      url = "https://github.com/nixcloud/ip2unix/commit/050ddf76b4b925f27e255fbb820b0700407ceb2b.patch";
-      hash = "sha256-5vaLmZmwuiMGV4KnVhuDSnXG1a390aBU51TShwpaMLs=";
-    })
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/by-name/li/libaec/package.nix
+++ b/pkgs/by-name/li/libaec/package.nix
@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  fetchFromGitLab,
+  fetchFromGitHub,
  cmake,
 }:

@ -9,9 +9,8 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "libaec";
  version = "1.1.6";

-  src = fetchFromGitLab {
-    domain = "gitlab.dkrz.de";
-    owner = "k202009";
+  src = fetchFromGitHub {
+    owner = "Deutsches-Klimarechenzentrum";
    repo = "libaec";
    tag = "v${finalAttrs.version}";
    hash = "sha256-cxDP+JNwokxgzH9hO2zw+rIcz8XG7E8ujbAbWpgUEW8=";
@ -24,7 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
  doCheck = true;

  meta = {
-    homepage = "https://gitlab.dkrz.de/k202009/libaec";
+    changelog = "https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v${finalAttrs.version}/CHANGELOG.md";
+    homepage = "https://github.com/Deutsches-Klimarechenzentrum/libaec";
    description = "Adaptive Entropy Coding library";
    license = lib.licenses.bsd2;
    maintainers = [ ];
--- a/pkgs/by-name/li/libodfgen/package.nix
+++ b/pkgs/by-name/li/libodfgen/package.nix
@ -2,22 +2,18 @@
  lib,
  stdenv,
  fetchurl,
-  boost,
  pkg-config,
-  cppunit,
-  zlib,
-  libwpg,
-  libwpd,
  librevenge,
+  libxml2,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "libodfgen";
-  version = "0.1.7";
+  version = "0.1.8";

  src = fetchurl {
    url = "mirror://sourceforge/project/libwpd/libodfgen/libodfgen-${finalAttrs.version}/libodfgen-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-Mj5JH5VsjKKrsSyZjjUGcJMKMjF7+WYrBhXdSzkiuDE=";
+    hash = "sha256-VSAAJ/1GYjub3d040nXnRS0bD/iu3crW+a5twl9hBiU=";
  };

  patches = [
@ -26,16 +22,26 @@ stdenv.mkDerivation (finalAttrs: {
    ./libodfgen-add-include-cstdint-gcc15.patch
  ];

+  enableParallelBuilding = true;
+
+  configureFlags = lib.optional finalAttrs.finalPackage.doCheck "--enable-test";
+
  nativeBuildInputs = [ pkg-config ];
+
  buildInputs = [
-    boost
-    cppunit
-    zlib
-    libwpg
-    libwpd
    librevenge
+    libxml2
  ];

+  doCheck = true;
+
+  checkFlags = [
+    "-C"
+    "test"
+  ];
+
+  checkTarget = "launch_all";
+
  meta = {
    description = "Base library for generating ODF documents";
    license = lib.licenses.mpl20;
--- a/pkgs/by-name/ma/macaulay2/package.nix
+++ b/pkgs/by-name/ma/macaulay2/package.nix
@ -294,5 +294,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://macaulay2.com/";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ coolcuber ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
  };
 })
--- a/pkgs/by-name/ma/mathic/package.nix
+++ b/pkgs/by-name/ma/mathic/package.nix
@ -61,5 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/Macaulay2/mathic";
    license = lib.licenses.lgpl2Plus;
    maintainers = with lib.maintainers; [ coolcuber ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/ma/mathicgb/package.nix
+++ b/pkgs/by-name/ma/mathicgb/package.nix
@ -58,5 +58,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/Macaulay2/mathicgb";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ coolcuber ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/me/mediainfo/package.nix
+++ b/pkgs/by-name/me/mediainfo/package.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mediainfo";
-  version = "26.01";
+  version = "26.05";

  src = fetchurl {
    url = "https://mediaarea.net/download/source/mediainfo/${finalAttrs.version}/mediainfo_${finalAttrs.version}.tar.xz";
-    hash = "sha256-FQZWytiO9O+k6Cmc/CTZt6cjVFdqaTSZIFiKzuLMPHY=";
+    hash = "sha256-+FIJP5BQAi1plgbuq7OLJNpVI9AhL6tk3E5NPka1beE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/me/memtailor/package.nix
+++ b/pkgs/by-name/me/memtailor/package.nix
@ -51,5 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/Macaulay2/memtailor";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ coolcuber ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "moonlight";
-  version = "2026.5.0";
+  version = "2026.5.2";

  src = fetchFromGitHub {
    owner = "moonlight-mod";
    repo = "moonlight";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RZ7fmgzENSt9bXuhPWW9wBaJ1dss/b23R1VS+tEU7io=";
+    hash = "sha256-eTya6Y7dw/otqohgYZudkqrcI50740jFUTe4Lyd6GKc=";
  };

  nativeBuildInputs = [
@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-veZx/b+cvpcRh1xXO8Y34dJtY2cgncqVSYYywb85Geo=";
+    hash = "sha256-+jxp3dD/SyGdskMyw0jhDzDRj7wXD4Egkx3ok3cMiyc=";
  };

  env = {
--- a/pkgs/by-name/n6/n64recomp/package.nix
+++ b/pkgs/by-name/n6/n64recomp/package.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "n64recomp";
-  version = "0-unstable-2026-01-17";
+  version = "0-unstable-2026-05-17";

  src = fetchFromGitHub {
    owner = "N64Recomp";
    repo = "N64Recomp";
-    rev = "81213c1831fab2521a6a5459c67b63437d67e253";
-    hash = "sha256-BfZTmKAXn+9b0lHg0SbTP4/ZTjk7IqvPc78ab8XNFoM=";
+    rev = "70a894aad8d3491ca0fccee1f94dae8190845686";
+    hash = "sha256-4y1Cb2lmVZi+IoIBY9AZuWa+XPoBejdd1rL/uTjM07E=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/oh/oh-my-posh/package.nix
+++ b/pkgs/by-name/oh/oh-my-posh/package.nix
@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "oh-my-posh";
-  version = "29.13.1";
+  version = "29.14.0";

  src = fetchFromGitHub {
    owner = "jandedobbeleer";
    repo = "oh-my-posh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mH727EMcIkORPEvI2OJRaGw+PAI4PRuUvwlVUfL67B8=";
+    hash = "sha256-Kjc9H/XVjlJQskWZyKN/y3Oy5HHIeIT5gLkAm2JBhOI=";
  };

-  vendorHash = "sha256-cVn5QCpYc5FIY8hNaQnJ+eL0ZtVf6u2dWnWmHYJoJRk=";
+  vendorHash = "sha256-MKq0o6YE31YYFCJMhrcNPzxv+UljHa2FPNJZPBk+pGA=";

  sourceRoot = "${finalAttrs.src.name}/src";

--- a/pkgs/by-name/pa/panache/package.nix
+++ b/pkgs/by-name/pa/panache/package.nix
@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "panache";
-  version = "2.45.0";
+  version = "2.47.0";

  src = fetchFromGitHub {
    owner = "jolars";
    repo = "panache";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-IBWZmDqbDt4zf2wL6hVhWGq+JAwte+NO90jUvVtr/YE=";
+    hash = "sha256-ZwTUEjzSeHvzAkRjqO136UxPC/il2wRm+QxZiOQIoyY=";
  };

-  cargoHash = "sha256-vXSVNPc4h3yAAdWxVg9/7Fkxq6PXEjDcWGjFj6FREEI=";
+  cargoHash = "sha256-bWRQNmOIBhEE++Pc4/GW9+Ck4U7cQQvYkW2XxE93lwU=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/pi/pimsync/package.nix
+++ b/pkgs/by-name/pi/pimsync/package.nix
@ -6,22 +6,23 @@
  sqlite,
  installShellFiles,
  makeWrapper,
+  xandikos,
  versionCheckHook,
  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "pimsync";
-  version = "0.5.7";
+  version = "0.5.9";

  src = fetchFromSourcehut {
    owner = "~whynothugo";
    repo = "pimsync";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-6glyZZ79tMaR0VckKNMew1+x7/SU4V93/to6PWaiIHU=";
+    hash = "sha256-bNE0YY7bws8lEGoVg/sXuepBU1/oJPWBdn1wBGzF8s8=";
  };

-  cargoHash = "sha256-TiywSVcNqnshkmDovQDY03tM6v8AMOfwzI/SLOlEXHw=";
+  cargoHash = "sha256-w3o3qxe/EADeH6LDwBxm0kvdYuwEcuj8GcoVPtBqylA=";

  env.PIMSYNC_VERSION = finalAttrs.version;

@ -35,6 +36,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    sqlite
  ];

+  nativeCheckInputs = [
+    xandikos
+  ];
+
  postInstall = ''
    installManPage pimsync.1 pimsync.conf.5 pimsync-migration.7
    installShellCompletion --zsh contrib/_pimsync
--- a/pkgs/by-name/pu/pulsar/package.nix
+++ b/pkgs/by-name/pu/pulsar/package.nix
@ -89,7 +89,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "pulsar";
-  version = "1.131.2";
+  version = "1.132.1";

  src =
    finalAttrs.passthru.srcs.${stdenv.hostPlatform.system}
@ -98,11 +98,11 @@ stdenv.mkDerivation (finalAttrs: {
  passthru.srcs = {
    x86_64-linux = fetchurl {
      url = "https://github.com/pulsar-edit/pulsar/releases/download/v${finalAttrs.version}/Linux.pulsar-${finalAttrs.version}.tar.gz";
-      hash = "sha256-9KziiAKvfzh1yERPRakMCuQmW0ZlUQiaNFI2plWgb/c=";
+      hash = "sha256-66kubyDMEHgRdT38TTESMIZ+wQPPXWHBc0jYY3aMSkU=";
    };
    aarch64-linux = fetchurl {
      url = "https://github.com/pulsar-edit/pulsar/releases/download/v${finalAttrs.version}/ARM.Linux.pulsar-${finalAttrs.version}-arm64.tar.gz";
-      hash = "sha256-0AG87yQfg/osTtCBV10/X/4MXkWxD7lkDXcyFIGKvEs=";
+      hash = "sha256-MTWqUlbfjJlIQVy0YBLbenMzA7Xgnkr34nr2t8nhofc=";
    };
  };

@ -264,6 +264,7 @@ stdenv.mkDerivation (finalAttrs: {
        coreutils
        curl
        jq
+        git
        nix-update
      ]
    }"
--- a/pkgs/by-name/sa/sahel-fonts/package.nix
+++ b/pkgs/by-name/sa/sahel-fonts/package.nix
@ -2,32 +2,32 @@
  lib,
  stdenvNoCC,
  fetchFromGitHub,
+  installFonts,
 }:

-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "sahel-fonts";
  version = "3.4.0";

+  outputs = [
+    "out"
+    "webfont"
+  ];
+
  src = fetchFromGitHub {
    owner = "rastikerdar";
    repo = "sahel-font";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-U4tIICXZFK9pk7zdzRwBPIPYFUlYXPSebnItUJUgGJY=";
  };

-  installPhase = ''
-    runHook preInstall
-
-    find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/sahel-fonts {} \;
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];

  meta = {
    homepage = "https://github.com/rastikerdar/sahel-font";
    description = "Persian (farsi) Font - فونت (قلم) فارسی ساحل";
    license = lib.licenses.ofl;
    platforms = lib.platforms.all;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ pancaek ];
  };
-}
+})
--- a/pkgs/by-name/sm/smpmgr/package.nix
+++ b/pkgs/by-name/sm/smpmgr/package.nix
@ -27,11 +27,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
    "smpclient"
  ];

-  dependencies = with python3Packages; [
-    readchar
-    smpclient
-    typer
-  ];
+  dependencies =
+    with python3Packages;
+    [
+      readchar
+      smpclient
+      typer
+    ]
+    ++ smpclient.optional-dependencies.all;

  nativeCheckInputs = with python3Packages; [
    pytestCheckHook
--- a/pkgs/by-name/su/sunsetr/package.nix
+++ b/pkgs/by-name/su/sunsetr/package.nix
@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sunsetr";
-  version = "0.11.1";
+  version = "0.12.2";

  src = fetchFromGitHub {
    owner = "psi4j";
    repo = "sunsetr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fV4yb8+a2AbXkvalL9TU9JmPGX04GNE60a8OnQKNuEU=";
+    hash = "sha256-M91eW8FKJDlR8pdvXcKte3OL3uJlpapShTUNpnA/Jvo=";
  };

-  cargoHash = "sha256-Cxdy/4lOf7nFoHaDeLekI0o7xT1ZUjV1yyKoGUcjNGs=";
+  cargoHash = "sha256-fFk/JPB6MGmYnwARMuKF1/fVZOf+W1C+YqQvuG/ub60=";

  checkFlags = [
    "--skip=config::tests::test_geo_toml_exists_before_config_creation"
--- a/pkgs/by-name/su/survex/package.nix
+++ b/pkgs/by-name/su/survex/package.nix
@ -19,11 +19,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "survex";
-  version = "1.4.20";
+  version = "1.4.21";

  src = fetchurl {
    url = "https://survex.com/software/${finalAttrs.version}/survex-${finalAttrs.version}.tar.gz";
-    hash = "sha256-mSq/O5nsjHqypTUg/P/dAeIMZKyi5QcCtiydkOhh4N0=";
+    hash = "sha256-9lmCFrAhI8Zko6wCjkRf7rv+LmKDBTOGekRM3lyz8wI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/to/topcom/package.nix
+++ b/pkgs/by-name/to/topcom/package.nix
@ -79,5 +79,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://www.wm.uni-bayreuth.de/de/team/rambau_joerg/TOPCOM/index.html";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ coolcuber ];
+    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/tr/trdl-client/package.nix
+++ b/pkgs/by-name/tr/trdl-client/package.nix
@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "trdl-client";
-  version = "0.12.2";
+  version = "0.12.3";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "trdl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0hyo32LjPG/Zu0n1WHg7O3f9blxiGUkfUD1i/80UIRE=";
+    hash = "sha256-RKFfljYRVEmfGTX3kqmSm6SDz5i3v0mX/bnSSPj8/ZI=";
  };

  sourceRoot = "${finalAttrs.src.name}/client";
--- a/pkgs/by-name/vi/vimcats/package.nix
+++ b/pkgs/by-name/vi/vimcats/package.nix
@ -8,18 +8,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "vimcats";
-  version = "1.1.1";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "mrcjkb";
    repo = "vimcats";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-BW1pU7NnW8yWePV0IQOUmcNa13NvV9lOZhfnEdQFBQQ=";
+    hash = "sha256-Pg6vIp/2H4YyqaGKF/pvuhsD/j3hBms/+4cAbH89oKs=";
  };

  buildFeatures = [ "cli" ];

-  cargoHash = "sha256-OGU7jwXOUf+tVECsyKwJQ9vRqTDoV8m/WOlAqTFdfUM=";
+  cargoHash = "sha256-EeCp1VFNFrlPmJnqthZoFBEzi4VV+U53lmXT0NmJWI8=";

  passthru.tests.version = testers.testVersion { package = vimcats; };

--- a/pkgs/by-name/vr/vrcx/deps.json
+++ b/pkgs/by-name/vr/vrcx/deps.json
@ -91,8 +91,8 @@
  },
  {
    "pname": "NLog",
-    "version": "6.0.7",
-    "hash": "sha256-Le6ocjCN29rtgRiAroVfjUbMXCrjk0pSv2GEtZZy0qU="
+    "version": "6.1.2",
+    "hash": "sha256-rcBEHtjkg3ZaG3zVoy5aPLTPxbuV2gMdEU3vPpneKfI="
  },
  {
    "pname": "runtime.native.System.Data.SqlClient.sni",
@ -146,8 +146,8 @@
  },
  {
    "pname": "System.CodeDom",
-    "version": "10.0.2",
-    "hash": "sha256-MAKLNGx7mczcSE6n7b3HvQOLPC8Afk5Mv6PUV2hlHC0="
+    "version": "10.0.7",
+    "hash": "sha256-6ZKsH6PnSzrPrvAuLZppePupB2RaQ+lddqpsY8kth54="
  },
  {
    "pname": "System.CodeDom",
@ -201,8 +201,8 @@
  },
  {
    "pname": "System.Management",
-    "version": "10.0.2",
-    "hash": "sha256-u0Dn4zJUvSpftmtvR24enqKPDxxAMXJpav2/sfiwYiE="
+    "version": "10.0.7",
+    "hash": "sha256-qIFAiT52Fkg2yMziif3O6E1ApvlUllqeMT1Iq48gsKg="
  },
  {
    "pname": "System.Memory",
--- a/pkgs/by-name/vr/vrcx/package-lock.json
+++ b/pkgs/by-name/vr/vrcx/package-lock.json
--- a/pkgs/by-name/vr/vrcx/package.nix
+++ b/pkgs/by-name/vr/vrcx/package.nix
@ -1,8 +1,8 @@
 {
  lib,
  stdenv,
-  nodejs_22,
-  electron_39,
+  nodejs_24,
+  electron_40,
  makeWrapper,
  fetchFromGitHub,
  buildNpmPackage,
@ -12,34 +12,34 @@
  dotnetCorePackages,
 }:
 let
-  node = nodejs_22;
-  electron = electron_39;
+  node = nodejs_24;
+  electron = electron_40;
  dotnet = dotnetCorePackages.dotnet_9;
 in
 buildNpmPackage (finalAttrs: {
  pname = "vrcx";
-  version = "2026.02.11";
+  version = "2026.05.03";

  src = fetchFromGitHub {
    repo = "VRCX";
    owner = "vrcx-team";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/CMxFjIcLqk2oTnXUV519NkrImsnq3/kUGiew5E3Zyw=";
+    hash = "sha256-TIRX1DllUaq73Aue5/2mg98luBnDoptiiMDQcZ9aBTM=";
  };

  nodejs = node;
  makeCacheWritable = true;
  npmFlags = [ "--ignore-scripts" ];
-  npmDepsHash = "sha256-bli8TKzxcASuCegEGwiHM5siMXGK4WuzhweNr5HaCvg=";
+  npmDepsHash = "sha256-hOfbDvBJgoPQ6QxnZ77kpeSHDXH9dSnidmrx9Mp9q08=";

  nativeBuildInputs = [
    makeWrapper
    copyDesktopItems
  ];

-  preBuild = ''
-    # Build fails at executing dart from sass-embedded
-    rm -r node_modules/sass-embedded*
+  postPatch = ''
+    # V2026.05.03 seems to have an out of date lockfile
+    cp ${./package-lock.json} package-lock.json
  '';

  buildPhase = ''
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "werf";
-  version = "2.65.4";
+  version = "2.68.2";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rokgq74XSOVgA6n0aKgW3X/I+T8hfEnDazbJsxRiJdc=";
+    hash = "sha256-961fPVffLh11QaJJYXIkXZiS+gNLqDKzImZw7DtFzgw=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-hWivVUSsEWtXmxckiw4E+f7W/5Agy4fYkKEq0YTIuSk=";
+  vendorHash = "sha256-iMoR38Qb2utzdkhKUrCQ0Ohm8f6jdYTuLkeMhCLqvN4=";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs =
@ -65,6 +65,7 @@ buildGoModule (finalAttrs: {
    # Remove tests that fail or require external services.
    rm -rf \
      integration/suites \
+      pkg/container_backend/buildah_backend_data_archives_test.go \
      pkg/true_git/*_test.go \
      pkg/werf/exec/*_test.go \
      test/e2e \
--- a/pkgs/by-name/ze/zeekscript/package.nix
+++ b/pkgs/by-name/ze/zeekscript/package.nix
@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "zeekscript";
-  version = "1.3.4";
+  version = "1.3.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "zeek";
    repo = "zeekscript";
    tag = "v${version}";
-    hash = "sha256-icc5mMhl/MK0+0fLYJG07wqWaKKX2QFcpD1IIvdmASw=";
+    hash = "sha256-yky9w1G4e/dfzOGHXqKGxRgD8Uw9X8oJDjT4avJ9wKM=";
  };

  build-system = with python3.pkgs; [ setuptools ];
--- a/pkgs/development/cuda-modules/packages/tensorrt.nix
+++ b/pkgs/development/cuda-modules/packages/tensorrt.nix
@ -200,8 +200,14 @@ buildRedist (
      # the redistributables do. As such, we need to specify downloadPage manually.
      downloadPage = "https://developer.nvidia.com/downloads/compute/machine-learning/tensorrt";
      changelog = "https://docs.nvidia.com/deeplearning/tensorrt/latest/getting-started/release-notes.html#release-notes";
-
      license = _cuda.lib.licenses.tensorrt;
+
+      knownVulnerabilities =
+        # https://github.com/NixOS/nixpkgs/issues/522570
+        # https://nvidia.custhelp.com/app/answers/detail/a_id/5836
+        lib.optionals (lib.versionOlder finalAttrs.version "10.16.1") [
+          "CVE-2026-24188: OOB write"
+        ];
    };
  }
 )
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -2051,12 +2051,8 @@ with haskellLib;
  # The shipped Setup.hs file is broken.
  csv = overrideCabal (drv: { preCompileBuildDriver = "rm Setup.hs"; }) super.csv;

-  cabal-fmt = doJailbreak (
-    super.cabal-fmt.override {
-      # Needs newer Cabal-syntax version.
-      Cabal-syntax = self.Cabal-syntax_3_10_3_0;
-    }
-  );
+  # https://github.com/phadej/cabal-fmt/issues/98
+  cabal-fmt = doJailbreak super.cabal-fmt;

  # Pick bound changes from development branch, same commit also adds support for Cabal >= 3.14
  glirc = lib.pipe super.glirc [
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@ -10,23 +10,22 @@
  mirage-crypto-ec,
  mirage-crypto-pk,
  mirage-crypto-rng,
+  ptime,
  x509,
  ipaddr,
  alcotest,
  ounit2,
 }:

-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
  pname = "tls";
-  version = "2.0.2";
+  version = "2.1.0";

  src = fetchurl {
-    url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-${version}.tbz";
-    hash = "sha256-m6UP0M0gyb4bbJmA8NcTQ8wxdEbbVSF+s5k3rEqMsho=";
+    url = "https://github.com/mirleft/ocaml-tls/releases/download/v${finalAttrs.version}/tls-${finalAttrs.version}.tbz";
+    hash = "sha256-2nmWB4n6QYtiv4nNUk6ZgVxQEEE7wYnw8zlmuNC4htI=";
  };

-  minimalOCamlVersion = "4.08";
-
  propagatedBuildInputs = [
    domain-name
    fmt
@ -36,6 +35,7 @@ buildDunePackage rec {
    mirage-crypto-ec
    mirage-crypto-pk
    mirage-crypto-rng
+    ptime
    x509
    ipaddr
  ];
@ -52,4 +52,4 @@ buildDunePackage rec {
    license = lib.licenses.bsd2;
    maintainers = with lib.maintainers; [ sternenseemann ];
  };
-}
+})
--- a/pkgs/development/python-modules/aiocsv/default.nix
+++ b/pkgs/development/python-modules/aiocsv/default.nix
@ -10,16 +10,16 @@
  typing-extensions,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "aiocsv";
-  version = "1.4.0";
+  version = "1.4.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "MKuranowski";
    repo = "aiocsv";
-    tag = "v${version}";
-    hash = "sha256-cNoUrD0UP8F2W2HiSm7dQL3nhiL/h0Hr6TDsAKWb24M=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WENNtQKvpUuoYai6r8nTRamwCOloVA42YoAA3JGK9B8=";
  };

  build-system = [
@ -49,7 +49,8 @@ buildPythonPackage rec {
  meta = {
    description = "Library for for asynchronous CSV reading/writing";
    homepage = "https://github.com/MKuranowski/aiocsv";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/MKuranowski/aiocsv/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/aiorwlock/default.nix
+++ b/pkgs/development/python-modules/aiorwlock/default.nix
@ -5,32 +5,22 @@
  pytest-asyncio,
  pytestCheckHook,
  poetry-core,
-  fetchpatch,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "aiorwlock";
-  version = "1.5.0";
+  version = "1.5.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aio-libs";
    repo = "aiorwlock";
-    tag = "v${version}";
-    hash = "sha256-QwjwuXjaxE1Y+Jzn8hJXY4wKltAT8mdOM7jJ9MF+DhA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+favszX1mVuuLWqKCIk+i5frX+y2kOArAUVIAJG1otY=";
  };

  build-system = [ poetry-core ];

-  patches = [
-    # Fix cross-event-loop race condition in lock acquisition
-    # https://github.com/aio-libs/aiorwlock/pull/503
-    (fetchpatch {
-      url = "https://github.com/aio-libs/aiorwlock/commit/05608d401e4a68c69c6b9f421dd20535a9dbe523.patch?full_index=1";
-      hash = "sha256-97c6Li6nq7ViNvUIdPL8f/ATOSsmiAMaJeBFj+jPJcM=";
-    })
-  ];
-
  nativeCheckInputs = [
    pytest-asyncio
    pytestCheckHook
@ -41,8 +31,8 @@ buildPythonPackage rec {
  meta = {
    description = "Read write lock for asyncio";
    homepage = "https://github.com/aio-libs/aiorwlock";
-    changelog = "https://github.com/aio-libs/aiorwlock/releases/tag/v${version}";
+    changelog = "https://github.com/aio-libs/aiorwlock/releases/tag/v${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ billhuang ];
  };
-}
+})
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.43.11";
+  version = "1.43.13";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-PZ9xPo1eVRFtQCSYCHvRubj8m11abbrcp7uJus0ki0E=";
+    hash = "sha256-bjAYJbQILdjRIc8qpKx9nGVOm7MzOz/B0QAPTsSnClE=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/crossandra/default.nix
+++ b/pkgs/development/python-modules/crossandra/default.nix
@ -2,35 +2,34 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  setuptools,
+  hatchling,
+  hatch-mypyc,
+  pytestCheckHook,
  result,
-  mypy,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "crossandra";
-  version = "2.2.1";
+  version = "2.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "trag1c";
    repo = "crossandra";
    tag = finalAttrs.version;
-    hash = "sha256-/JhrjXRH7Rs2bUil9HRneBC9wlVYEyfwivjzb+eyRv8=";
+    hash = "sha256-xKMySbt+Bf+6BGyIKsmYHTZTl25HxlG8hY/HuUtDjSM=";
  };

  build-system = [
-    setuptools
-    mypy
+    hatchling
+    hatch-mypyc
  ];
+
  dependencies = [ result ];

+  nativeCheckInputs = [ pytestCheckHook ];
+
  pythonImportsCheck = [ "crossandra" ];
-  prePatch = ''
-    # pythonRelaxDepsHook did not work
-    substituteInPlace pyproject.toml \
-      --replace-fail "result ~= 0.9.0" "result >= 0.9.0"
-  '';

  meta = {
    changelog = "https://github.com/trag1c/crossandra/blob/${finalAttrs.src.tag}/CHANGELOG.md";
--- a/pkgs/development/python-modules/elevenlabs/default.nix
+++ b/pkgs/development/python-modules/elevenlabs/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "elevenlabs";
-  version = "2.47.0";
+  version = "2.49.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "elevenlabs";
    repo = "elevenlabs-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Q3lRllyLXFkHI7Ge6HMJNvcA/DjxhpqXiqyc699hMTU=";
+    hash = "sha256-ATZhkrM+IPCt9Y+7/C5Ng8gKcCFZPHTz1CN3OJ/9uZI=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/garminconnect/default.nix
+++ b/pkgs/development/python-modules/garminconnect/default.nix
@ -5,10 +5,9 @@
  garth,
  pdm-backend,
  requests,
-  withings-sync,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "garminconnect";
  version = "0.2.40";
  pyproject = true;
@ -16,21 +15,17 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "cyberjunky";
    repo = "python-garminconnect";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-EAmKrOmnJFn+vTfmAprd5onqW/uyOe/shSB1u0HVrIE=";
  };

-  pythonRelaxDeps = [
-    "garth"
-    "withings-sync"
-  ];
+  pythonRelaxDeps = [ "garth" ];

  build-system = [ pdm-backend ];

  dependencies = [
    garth
    requests
-    withings-sync
  ];

  # Tests require a token
@ -41,8 +36,8 @@ buildPythonPackage rec {
  meta = {
    description = "Garmin Connect Python API wrapper";
    homepage = "https://github.com/cyberjunky/python-garminconnect";
-    changelog = "https://github.com/cyberjunky/python-garminconnect/releases/tag/${src.tag}";
+    changelog = "https://github.com/cyberjunky/python-garminconnect/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/git-url-parse/default.nix
+++ b/pkgs/development/python-modules/git-url-parse/default.nix
@ -4,26 +4,30 @@
  fetchFromGitHub,
  pbr,
  pytestCheckHook,
+
  pytest-cov-stub,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "git-url-parse";
  version = "1.2.2";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "coala";
    repo = "git-url-parse";
-    rev = version;
+    tag = finalAttrs.version;
    hash = "sha256-+0V/C3wE02ppdDGn7iqdvmgsUwTR7THUakUilvkzoYg=";
  };

  # Manually set version because prb wants to get it from the git
  # upstream repository (and we are installing from tarball instead)
-  env.PBR_VERSION = version;
+  env.PBR_VERSION = finalAttrs.version;

-  propagatedBuildInputs = [ pbr ];
+  build-system = [ setuptools ];
+
+  dependencies = [ pbr ];

  pythonImportsCheck = [ "giturlparse" ];

@ -35,8 +39,8 @@ buildPythonPackage rec {
  meta = {
    description = "Simple GIT URL parser";
    homepage = "https://github.com/coala/git-url-parse";
-    changelog = "https://github.com/coala/git-url-parse/blob/${src.rev}/CHANGELOG.rst";
+    changelog = "https://github.com/coala/git-url-parse/blob/${finalAttrs.version}/CHANGELOG.rst";
    license = lib.licenses.mit;
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-secret-manager/default.nix
@ -13,13 +13,13 @@

 buildPythonPackage rec {
  pname = "google-cloud-secret-manager";
-  version = "2.27.0";
+  version = "2.28.0";
  pyproject = true;

  src = fetchPypi {
    pname = "google_cloud_secret_manager";
    inherit version;
-    hash = "sha256-avhkwlK9PBHbe7ArgMsLFKjJoz/H7E1vJF8z2M4ffNE=";
+    hash = "sha256-V2P0KkScJ1l/tC1A+pPixWsC2866DEHaIC+5foEMsng=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202605211";
+  version = "0.1.202605221";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-539pWIwXaYOWsXViIxeruU4ZK146jOl0XCf6VohWlyY=";
+    hash = "sha256-GstgvzhYFTFTUIXXajfcSYDYlGcoZCftUzHlJYhrbbo=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/jsbeautifier/default.nix
+++ b/pkgs/development/python-modules/jsbeautifier/default.nix
@ -5,19 +5,21 @@
  editorconfig,
  pytestCheckHook,
  six,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "jsbeautifier";
  version = "1.15.4";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    hash = "sha256-W7GNnvuTMdglc1+8U2DujxqsXlJ4AEKAOUOqf4VPdZI=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+  dependencies = [
    editorconfig
    six
  ];
@ -32,8 +34,8 @@ buildPythonPackage rec {
    description = "JavaScript unobfuscator and beautifier";
    mainProgram = "js-beautify";
    homepage = "http://jsbeautifier.org";
-    changelog = "https://github.com/beautify-web/js-beautify/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/beautify-web/js-beautify/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ apeyroux ];
  };
-}
+})
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@ -163,8 +163,8 @@ in
      "sha256-FZuhcgbPBohluThfTy99inR5nyG0r3q/AsxNEvtgJU4=";

  mypy-boto3-batch =
-    buildMypyBoto3Package "batch" "1.43.7"
-      "sha256-4Xj/9Sq0wIs5ldX+WsnUkVKqGmT0xB9fpw8G6Km0hjw=";
+    buildMypyBoto3Package "batch" "1.43.13"
+      "sha256-IKmXHaiMMKM3qwpD3Vwec8BO5C/K+LRfBsxBsYhQ8xo=";

  mypy-boto3-billingconductor =
    buildMypyBoto3Package "billingconductor" "1.43.7"
@ -207,8 +207,8 @@ in
      "sha256-Vtu56EDQljvG3JZbiqt3CJzhquUIbYY2/Kn7QXw4Poc=";

  mypy-boto3-cleanrooms =
-    buildMypyBoto3Package "cleanrooms" "1.43.0"
-      "sha256-iQRlqBZZG4pnuy57HXKwFYJ64+wkS9v7h/pKl19R5sg=";
+    buildMypyBoto3Package "cleanrooms" "1.43.13"
+      "sha256-y9b/pwcRa4VFZ0v0rDwzdzYTnCyn6lgeNmk9JTLRtEI=";

  mypy-boto3-cloud9 =
    buildMypyBoto3Package "cloud9" "1.43.0"
@ -363,8 +363,8 @@ in
      "sha256-pi0hMLpgYGrNU0/infONBg2WmES6NV0tfPgTjuRtWXk=";

  mypy-boto3-customer-profiles =
-    buildMypyBoto3Package "customer-profiles" "1.43.0"
-      "sha256-P+3AG1/Dj29UUJyAfXJcLvBxnLq6miVReVirg+/ewks=";
+    buildMypyBoto3Package "customer-profiles" "1.43.12"
+      "sha256-oOc34HWsr7PyUpweMBi3pjorIWKFbi5qNXDdPBF2VXA=";

  mypy-boto3-databrew =
    buildMypyBoto3Package "databrew" "1.43.0"
@ -758,8 +758,8 @@ in
      "sha256-SjI/irHvvEjhPyjQcEf1VAWM80ZLH76EFs/1JFDuTi4=";

  mypy-boto3-kms =
-    buildMypyBoto3Package "kms" "1.43.0"
-      "sha256-x7burzJDYflPJr+SFtUMjL1DJ0qwRHe1GL79TCZBWDg=";
+    buildMypyBoto3Package "kms" "1.43.12"
+      "sha256-pNI/AYQip5vEqIZnb2PrpUipiwb13NA5XkJNfEcus0A=";

  mypy-boto3-lakeformation =
    buildMypyBoto3Package "lakeformation" "1.43.0"
@ -854,8 +854,8 @@ in
      "sha256-Ob9sh8Ng8I3sWiy/qwu+lfSvf+W2KQiprWX6QCNiSLM=";

  mypy-boto3-mediaconnect =
-    buildMypyBoto3Package "mediaconnect" "1.43.0"
-      "sha256-OT4bGX7DaTrMuzEdK71GemaeWzPa7MbDd4+bApuPZLw=";
+    buildMypyBoto3Package "mediaconnect" "1.43.13"
+      "sha256-4hBMy4j3GdSdq7MyeU8a1WHYrM0mb56OlqPeKkdbt7w=";

  mypy-boto3-mediaconvert =
    buildMypyBoto3Package "mediaconvert" "1.43.0"
@ -934,8 +934,8 @@ in
      "sha256-Igsngmg9PeJcyqX/Ih+fgzUuBotaf+2UWHK9RKEePL4=";

  mypy-boto3-mwaa =
-    buildMypyBoto3Package "mwaa" "1.43.5"
-      "sha256-TKqSy42P9Pmd9jbfsUadZT2qn4SRE8PPbad4gbUHUo0=";
+    buildMypyBoto3Package "mwaa" "1.43.12"
+      "sha256-K6PcvRVHUGRXbsro9CbPJ9GQQ8mrjsrgU6nr/MXV4vg=";

  mypy-boto3-neptune =
    buildMypyBoto3Package "neptune" "1.43.0"
@ -1002,8 +1002,8 @@ in
      "sha256-0O67JQj59+esJWCBGVzRNj73yBbnldhay28rxh7nlN0=";

  mypy-boto3-payment-cryptography-data =
-    buildMypyBoto3Package "payment-cryptography-data" "1.43.0"
-      "sha256-Npyleoivecba7q9HyHNFRjs66fwNGR5dsAsu4e51luo=";
+    buildMypyBoto3Package "payment-cryptography-data" "1.43.12"
+      "sha256-SvSi3Mzf+Er3keeO4BeeIrfPKkzwZtKENKuAbaEz28c=";

  mypy-boto3-pca-connector-ad =
    buildMypyBoto3Package "pca-connector-ad" "1.43.0"
@ -1170,8 +1170,8 @@ in
      "sha256-T+JIJpHxD7IzAwq8yxgq6zbVMj/btpbhKnylMyfFvvU=";

  mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.43.11"
-      "sha256-fajK9mOIDbfYcEftRqZDbktC1nOLa9xWIEnOzUwiLYA=";
+    buildMypyBoto3Package "sagemaker" "1.43.13"
+      "sha256-CJ76WLP0ZpfjCb7tjjpRE0G5b+Xi9bygNHOWjZtdBsE=";

  mypy-boto3-sagemaker-a2i-runtime =
    buildMypyBoto3Package "sagemaker-a2i-runtime" "1.43.0"
@ -1374,8 +1374,8 @@ in
      "sha256-3gP5TN3PkxdmGXMMACoCASgaJnlRp1hdnzfHRLjYiWo=";

  mypy-boto3-verifiedpermissions =
-    buildMypyBoto3Package "verifiedpermissions" "1.43.0"
-      "sha256-iuOLfL7+iJAL2AOxDmL7aPUG3PEgTB+BsdwepYKTZ1E=";
+    buildMypyBoto3Package "verifiedpermissions" "1.43.13"
+      "sha256-TtndYsK7U4b9f1LWtXadwD3SyRPkx3uhjRIGYxybW1s=";

  mypy-boto3-voice-id =
    buildMypyBoto3Package "voice-id" "1.43.0"
--- a/pkgs/development/python-modules/pip-requirements-parser/default.nix
+++ b/pkgs/development/python-modules/pip-requirements-parser/default.nix
@ -5,26 +5,39 @@
  packaging,
  pyparsing,
  pytestCheckHook,
+  setuptools,
  setuptools-scm,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "pip-requirements-parser";
  version = "32.0.1";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "nexB";
    repo = "pip-requirements-parser";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-UMrwDXxk+sD3P2jk7s95y4OX6DRBjWWZZ8IhkR6tnZ4=";
  };

+  patches = [
+    # packaging 26.0 changed the string representation of requirements with
+    # URLs to contain an extra space before the `@`.
+    # https://github.com/pypa/packaging/pull/953
+    # https://github.com/aboutcode-org/pip-requirements-parser/issues/27
+    # https://github.com/aboutcode-org/pip-requirements-parser/pull/28
+    ./packaging-26.patch
+  ];
+
  dontConfigure = true;

-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];

-  propagatedBuildInputs = [
+  dependencies = [
    packaging
    pyparsing
  ];
@ -42,8 +55,8 @@ buildPythonPackage rec {
  meta = {
    description = "Module to parse pip requirements";
    homepage = "https://github.com/nexB/pip-requirements-parser";
-    changelog = "https://github.com/nexB/pip-requirements-parser/blob/v${version}/CHANGELOG.rst";
+    changelog = "https://github.com/nexB/pip-requirements-parser/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/pip-requirements-parser/packaging-26.patch
+++ b/pkgs/development/python-modules/pip-requirements-parser/packaging-26.patch
@ -0,0 +1,112 @@
+From b50963dfe2b8ecd57dab9627b19d5616c369a044 Mon Sep 17 00:00:00 2001
+From: Steve Kowalik <steven@wedontsleep.org>
+Date: Mon, 2 Feb 2026 12:56:48 +1100
+Subject: [PATCH] Support packaging 26.0 changes
+
+Packaging 26.0 changed the string representation of requirements with
+URLs, sprinkle in more spaces.
+
+Closes #27
+
+Signed-off-by: Steve Kowalik <steven@wedontsleep.org>
+---
+ tests/pip_requirements_parser_tests/unit/test_req.py   |  4 ++--
+ .../unit/test_req_file.py                              | 10 +++++-----
+ tests/test_pip_api_parse_requirements.py               |  8 ++++----
+ 3 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/tests/pip_requirements_parser_tests/unit/test_req.py b/tests/pip_requirements_parser_tests/unit/test_req.py
+index 1348fcab..f811045b 100644
+--- a/tests/pip_requirements_parser_tests/unit/test_req.py
+++ b/tests/pip_requirements_parser_tests/unit/test_req.py
+@@ -44,13 +44,13 @@ def test_url_with_query(self) -> None:
+     def test_pep440_wheel_link_requirement(self) -> None:
+         line = "test @ https://whatever.com/test-0.4-py2.py3-bogus-any.whl"
+         req = build_install_req(line)
+-        assert str(req.req) == "test@ https://whatever.com/test-0.4-py2.py3-bogus-any.whl"
+        assert str(req.req) == "test @ https://whatever.com/test-0.4-py2.py3-bogus-any.whl"
+         assert str(req.link) == "https://whatever.com/test-0.4-py2.py3-bogus-any.whl"
+ 
+     def test_pep440_url_link_requirement(self) -> None:
+         line = "foo @ git+http://foo.com@ref#egg=foo"
+         req = build_install_req(line)
+-        assert str(req.req) == "foo@ git+http://foo.com@ref#egg=foo"
+        assert str(req.req) == "foo @ git+http://foo.com@ref#egg=foo"
+         assert str(req.link) == "git+http://foo.com@ref#egg=foo"
+ 
+     def test_url_with_authentication_link_requirement(self) -> None:
+diff --git a/tests/pip_requirements_parser_tests/unit/test_req_file.py b/tests/pip_requirements_parser_tests/unit/test_req_file.py
+index 4ac6375b..d71108d1 100644
+--- a/tests/pip_requirements_parser_tests/unit/test_req_file.py
+++ b/tests/pip_requirements_parser_tests/unit/test_req_file.py
+@@ -358,7 +358,7 @@ def test_parse_name_at_url_to_wheel_with_packaging(self, parse_requirement_text)
+         assert r.name == "SomeProject"
+         assert not r.specifier
+         assert r.extras == set()
+-        assert str(r) == "SomeProject@ http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+        assert str(r) == "SomeProject @ http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+ 
+     def test_parse_name_at_url__with_packaging(self, parse_requirement_text) -> None:
+         from packaging.requirements import Requirement
+@@ -369,7 +369,7 @@ def test_parse_name_at_url__with_packaging(self, parse_requirement_text) -> None
+         assert r.name == "SomeProject"
+         assert not r.specifier
+         assert r.extras == set()
+-        assert str(r) == "SomeProject@ http://my.package.repo/SomeProject2.tgz"
+        assert str(r) == "SomeProject @ http://my.package.repo/SomeProject2.tgz"
+ 
+     def test_parse_name_at_vcs_url_to_wheel_with_packaging(self, parse_requirement_text) -> None:
+         from packaging.requirements import Requirement
+@@ -380,7 +380,7 @@ def test_parse_name_at_vcs_url_to_wheel_with_packaging(self, parse_requirement_t
+         assert r.name == "SomeProject"
+         assert not r.specifier
+         assert r.extras == set()
+-        assert str(r) == "SomeProject@ git+http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+        assert str(r) == "SomeProject @ git+http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+ 
+     def test_can_dumps_name_at_url_to_wheel(self, parse_requirement_text) -> None:
+         text = "SomeProject@http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+@@ -394,7 +394,7 @@ def test_can_dumps_name_at_url_to_wheel(self, parse_requirement_text) -> None:
+         assert not r.specifier
+         assert r.link.url == "http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+         assert r.extras == set()
+-        assert str(r.req) ==  "SomeProject@ http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+        assert str(r.req) ==  "SomeProject @ http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+         assert r.dumps() == text
+ 
+     def test_can_dumps_name_at_url_to_wheel_with_space(self, parse_requirement_text) -> None:
+@@ -409,7 +409,7 @@ def test_can_dumps_name_at_url_to_wheel_with_space(self, parse_requirement_text)
+         assert not r.specifier
+         assert r.link.url == "http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+         assert r.extras == set()
+-        assert str(r.req) == "SomeProject@ http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+        assert str(r.req) == "SomeProject @ http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+         assert r.dumps() == "SomeProject@http://my.package.repo/SomeProject2-1.2.3-py33-none-any.whl"
+ 
+     def test_can_dumps_name_at_vcs_url_to_wheel(self, parse_requirement_text) -> None:
+diff --git a/tests/test_pip_api_parse_requirements.py b/tests/test_pip_api_parse_requirements.py
+index 974f6401..e9afe892 100644
+--- a/tests/test_pip_api_parse_requirements.py
+++ b/tests/test_pip_api_parse_requirements.py
+@@ -114,8 +114,8 @@ class Pep508Test(NamedTuple):
+             req_name="pip",
+             req_url="https://github.com/pypa/pip/archive/1.3.1.zip#sha1=da9234ee9982d4",
+             link_url="https://github.com/pypa/pip/archive/1.3.1.zip#sha1=da9234ee9982d4",
+-            # Note extra space after @
+-            req_string="pip@ https://github.com/pypa/pip/archive/1.3.1.zip#sha1=da9234ee9982d4",
+            # Note extra space before and after @
+            req_string="pip @ https://github.com/pypa/pip/archive/1.3.1.zip#sha1=da9234ee9982d4",
+             req_spec="",
+         ),
+         Pep508Test(
+@@ -124,8 +124,8 @@ class Pep508Test(NamedTuple):
+             req_name="pip",
+             req_url="https://github.com/pypa/pip/archive/1.3.1.zip#sha1=da9234ee9982d4",
+             link_url="https://github.com/pypa/pip/archive/1.3.1.zip#sha1=da9234ee9982d4",
+-            # Note extra space after @
+-            req_string="pip@ https://github.com/pypa/pip/archive/1.3.1.zip#sha1=da9234ee9982d4",
+            # Note extra space before and after @
+            req_string="pip @ https://github.com/pypa/pip/archive/1.3.1.zip#sha1=da9234ee9982d4",
+             req_spec="",
+         ),
+         Pep508Test(
--- a/pkgs/development/python-modules/prowlpy/default.nix
+++ b/pkgs/development/python-modules/prowlpy/default.nix
@ -14,16 +14,16 @@
  xmltodict,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "prowlpy";
-  version = "2.0.0";
+  version = "2.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "OMEGARAZER";
    repo = "prowlpy";
-    tag = "v${version}";
-    hash = "sha256-S+hhZndOb5O9okrrnXGt7D0N4VRIThbMN1LYVPGzFy8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-92r1E/dsXLRzaLXQdahXAPCmSG4T1Ihh/eDFDG3GlmY=";
  };

  build-system = [ setuptools ];
@ -48,7 +48,7 @@ buildPythonPackage rec {
    pytestCheckHook
    respx
  ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;

  preCheck = ''
    # Without this pyreqwest fails with
@ -60,11 +60,11 @@ buildPythonPackage rec {
  pytestFlags = [ "-v" ];

  meta = {
-    changelog = "https://github.com/OMEGARAZER/prowlpy/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/OMEGARAZER/prowlpy/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    description = "Send push notifications to iPhones using the Prowl API";
    homepage = "https://github.com/OMEGARAZER/prowlpy";
    license = lib.licenses.gpl3Only;
    mainProgram = "prowlpy";
    maintainers = [ lib.maintainers.dotlambda ];
  };
-}
+})
--- a/pkgs/development/python-modules/serialx/default.nix
+++ b/pkgs/development/python-modules/serialx/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "serialx";
-  version = "1.7.3";
+  version = "1.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "puddly";
    repo = "serialx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KZeKH0sy5GZESwbwWOr/j51UtQjwm98E1Phu0D+Ailo=";
+    hash = "sha256-JNaS7nRzqNr6y+Qj8bG4U0vwtvfNmllr9vpS4IcSjV4=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
--- a/pkgs/development/python-modules/smp/default.nix
+++ b/pkgs/development/python-modules/smp/default.nix
@ -22,6 +22,11 @@ buildPythonPackage rec {
    hash = "sha256-dATsVGG0b5SBZh7R7NT1deJFDRYi7BwtWzT7/QPjkJw=";
  };

+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'version = "0"' 'version = "${version}"'
+  '';
+
  build-system = [
    poetry-core
  ];
--- a/pkgs/development/python-modules/smpclient/default.nix
+++ b/pkgs/development/python-modules/smpclient/default.nix
@ -4,9 +4,9 @@
  bleak,
  buildPythonPackage,
  fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
  intelhex,
-  poetry-core,
-  poetry-dynamic-versioning,
  pyserial,
  pytest-asyncio,
  pytestCheckHook,
@ -15,38 +15,41 @@

 buildPythonPackage rec {
  pname = "smpclient";
-  version = "6.0.0";
+  version = "7.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "intercreate";
    repo = "smpclient";
    tag = version;
-    hash = "sha256-1FyrJivP+sOKXVFuH5NbvIlOTOkuiUO3uIRasH8D+d8=";
+    hash = "sha256-5o2z+cyOVpTNpOdc9GfFNmqcOhbGgbFM0qGng44E1xE=";
  };

-  pythonRelaxDeps = [
-    "bleak"
-    "smp"
-  ];
+  env.HATCH_BUILD_HOOK_VCS_VERSION = version;

  build-system = [
-    poetry-core
-    poetry-dynamic-versioning
+    hatchling
+    hatch-vcs
  ];

  dependencies = [
    async-timeout
-    bleak
    intelhex
-    pyserial
    smp
  ];

+  optional-dependencies = {
+    serial = [ pyserial ];
+    ble = [ bleak ];
+    udp = [ ];
+    all = lib.concatAttrValues (lib.removeAttrs optional-dependencies [ "all" ]);
+  };
+
  nativeCheckInputs = [
    pytest-asyncio
    pytestCheckHook
-  ];
+  ]
+  ++ optional-dependencies.all;

  pythonImportsCheck = [ "smpclient" ];

--- a/pkgs/development/python-modules/telnetlib3/default.nix
+++ b/pkgs/development/python-modules/telnetlib3/default.nix
@ -18,14 +18,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "telnetlib3";
-  version = "4.0.2";
+  version = "4.0.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jquast";
    repo = "telnetlib3";
    tag = finalAttrs.version;
-    hash = "sha256-MLNnmTuxrMV83FsM4Avlb31eH9s8/aFAoEbCsNyTmLY=";
+    hash = "sha256-eSgyIGRi8MQly7VmeKBVGHdqGWjBYdUNqjvX3sh8g9g=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/tree-sitter-zeek/default.nix
+++ b/pkgs/development/python-modules/tree-sitter-zeek/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "tree-sitter-zeek";
-  version = "0.2.13";
+  version = "0.2.15";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "zeek";
    repo = "tree-sitter-zeek";
    tag = "v${version}";
-    hash = "sha256-okm65ls/38PnzHpfdNT1McouaZ1r1dBflXcGUzaM9Z0=";
+    hash = "sha256-gxBHNhldyzAQdsMb5QwPAB8z+k/hFAS6SrSQmAAfi9Q=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/tstr/default.nix
+++ b/pkgs/development/python-modules/tstr/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "tstr";
-  version = "0.4.0.post1";
+  version = "0.4.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ilotoki0804";
    repo = "tstr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0IWisLpgJETGCBk1cqOnmlf1yvpNUajEiY+Qn2gxH0w=";
+    hash = "sha256-vQ+PNbcrBRSskQDRwD++135SEIzbYKHDcy87Qj2oMNg=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/unittest-data-provider/default.nix
+++ b/pkgs/development/python-modules/unittest-data-provider/default.nix
@ -1,23 +0,0 @@
-{
-  buildPythonPackage,
-  lib,
-  fetchPypi,
-}:
-
-buildPythonPackage rec {
-  version = "1.0.1";
-  format = "setuptools";
-  pname = "unittest-data-provider";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1gn2ka4vqpayx4cpbp8712agqjh3wdpk9smdxnp709ccc2v7zg46";
-  };
-
-  meta = {
-    description = "PHPUnit-like @dataprovider decorator for unittest";
-    homepage = "https://github.com/yourlabs/unittest-data-provider";
-    license = lib.licenses.mit;
-    maintainers = [ ];
-  };
-}
--- a/pkgs/development/python-modules/withings-sync/default.nix
+++ b/pkgs/development/python-modules/withings-sync/default.nix
@ -2,7 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  garth,
+  garminconnect,
  importlib-resources,
  lxml,
  poetry-core,
@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "withings-sync";
-  version = "5.3.2";
+  version = "6.0.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jaroslawhartman";
    repo = "withings-sync";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1pDM5paSXPQCOG5LRFxnp19K1iHcsfrGC9e7SEyxUDs=";
+    hash = "sha256-z0rVUFBbPff6xfItLQqbt+uN5Qe/BbVLAH1xMVUSfpA=";
  };

  postPatch = ''
@ -27,10 +27,12 @@ buildPythonPackage (finalAttrs: {
      --replace-fail "1.0.0.dev1" "${finalAttrs.version}"
  '';

+  pythonRelaxDeps = [ "garminconnect" ];
+
  build-system = [ poetry-core ];

  dependencies = [
-    garth
+    garminconnect
    importlib-resources
    lxml
    python-dotenv
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -12,7 +12,7 @@ let
  # override options if they need using lib.mkForce (that has 50 priority)
  mkKernelOverride = lib.mkOverride 90;

-  suffix = "zen1";
+  suffix = "zen2";
 in

 buildLinux (
@ -27,7 +27,7 @@ buildLinux (
      owner = "zen-kernel";
      repo = "zen-kernel";
      rev = "v${version}-${suffix}";
-      sha256 = "vu6rRldDBp/N6kkMzZEgz9aMsGa/VWPdnkZTCF/Yobo=";
+      sha256 = "1x2s9pv8frq77fish833mnwrrdglxssbqrsjnnizj3ayylw41qkd";
    };

    # This is based on the following source:
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -851,6 +851,7 @@ mapAliases {
  gimp3-with-plugins = gimp-with-plugins; # Added 2025-10-03
  gimp3Plugins = gimpPlugins; # Added 2025-10-03
  gitAndTools = throw "gitAndTools has been removed, as the packages are now available at the top level"; # Converted to throw 2025-10-26
+  gitfs = throw "'gitfs' has been removed, as it is broken and unmaintained upstream"; # Added 2026-05-22
  gitversion = throw "'gitversion' has been removed because it produced a broken build and was unmaintained"; # Added 2025-08-30
  gjay = throw "'gjay' has been removed as it is unmaintained upstream"; # Added 2025-05-25
  glabels = throw "'glabels' has been removed because it is no longer maintained. Consider using 'glabels-qt', which is an active fork."; # Added 2025-09-16
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@ -616,6 +616,7 @@ mapAliases {
  ufoLib2 = throw "'ufoLib2' has been renamed to/replaced by 'ufolib2'"; # Converted to throw 2025-10-29
  unicode-slugify = throw "'unicode-slugify' has been removed becaues it was broken and unmaintained. Consider using 'python-slugify' instead."; # added 2025-10-05
  unifi = throw "'unifi' has been removed as upstream was archived in 2017"; # Added 2025-08-25
+  unittest-data-provider = throw "'unittest-data-provider' has been removed as it was unused, unmaintained, and upstream suggests 'pytest parameterize' instead."; # Added 2026-05-22
  update_checker = throw "'update_checker' has been renamed to/replaced by 'update-checker'"; # Converted to throw 2025-10-29
  vcver = throw "vcver has been removed, since it was an unused leaf package"; # added 2025-08-25
  vega_datasets = throw "'vega_datasets' has been renamed to/replaced by 'vega-datasets'"; # Converted to throw 2025-10-29
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -20826,8 +20826,6 @@ self: super: with self; {
    inherit (pkgs) units-llnl;
  };

-  unittest-data-provider = callPackage ../development/python-modules/unittest-data-provider { };
-
  unittest-xml-reporting = callPackage ../development/python-modules/unittest-xml-reporting { };

  univers = callPackage ../development/python-modules/univers { };
--- a/pkgs/top-level/release-cuda.nix
+++ b/pkgs/top-level/release-cuda.nix
@ -25,6 +25,9 @@ in
  nixpkgsArgs ? {
    config = {
      allowUnfreePredicate = cudaLib.allowUnfreeCudaPredicate;
+      # [CVE-2026-24188](https://github.com/NixOS/nixpkgs/issues/522570):
+      # OOB write
+      allowInsecurePredicate = p: lib.getName p == "tensorrt";
      "${variant}Support" = true;
      inHydra = true;