Merge branch 'staging-26.05' into staging-next-26.05

2026-08-26 02:05:02 +00:00 · 2026-08-13 07:37:45 +02:00
parent b97b7ecd27 f47d69e721
commit 3c9d970995
25 changed files with 212 additions and 60 deletions
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;

 stdenv.mkDerivation (finalAttrs: {
  pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.4";
+  version = "1.33.7";

  src = fetchurl {
    url = "mirror://sourceforge/mpg123/mpg123-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-OujJ/4Cpe/wOIuifvNdGh+yk/B2zFbEmB/J/ActaR9k=";
+    hash = "sha256-MdDjWkylZ+ybXr2mwwYrtENdbT6s1u8NlcrdeFTcA+4=";
  };

  outputs = [
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.

 let
-  version = "2.8.2";
+  version = "2.8.3";
  tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
    url =
      with finalAttrs;
      "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-OtibhYjmZEvU5JmBSA1IshKJ7rvNTwoaSvscKfmbarQ=";
+    hash = "sha256-9iVt+QyQZ3PTRNoIRAK30+TyLtQbGlnJiQmKg9PqDIU=";
  };

  strictDeps = true;
--- a/pkgs/by-name/gd/gdk-pixbuf/package.nix
+++ b/pkgs/by-name/gd/gdk-pixbuf/package.nix
@@ -1,7 +1,6 @@
 {
  stdenv,
  fetchurl,
-  fetchpatch,
  nixosTests,
  fixDarwinDylibNames,
  meson,
@@ -29,7 +28,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gdk-pixbuf";
-  version = "2.44.6";
+  version = "2.44.7";

  outputs = [
    "out"
@@ -41,19 +40,12 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gdk-pixbuf/${lib.versions.majorMinor finalAttrs.version}/gdk-pixbuf-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FAwtC4mfz4U+6SsmNzydwijbzeCCCkJGaT9DKKJ0Zvo=";
+    hash = "sha256-Fy+A42JuwxUgqXBADxo2lOBHGPbCzSiF91JQ+1pplaQ=";
  };

  patches = [
    # Move installed tests to a separate output
    ./installed-tests-path.patch
-
-    # Fix loading of xpm module if built-in
-    # https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/267
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/62b8f9fd0bb3b862823cd34afce4b389fbd27569.patch";
-      hash = "sha256-ECEIt8lq/jBtDdBetErKpap2PWGav10vqCXKCpIQSyA=";
-    })
  ];

  # gdk-pixbuf-thumbnailer is not wrapped therefore strictDeps will work
--- a/pkgs/by-name/gj/gjs/package.nix
+++ b/pkgs/by-name/gj/gjs/package.nix
@@ -41,7 +41,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gjs";
-  version = "1.88.0";
+  version = "1.88.1";

  outputs = [
    "out"
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-MKC58zF+jmCxiW2ykDxw6LDNM9+VPDKHVYA6dRkdxFM=";
+    hash = "sha256-dnurgOZl1nLLAFY8JfCzkqnsjCmW7R1EVMaYtMLwo9k=";
  };

  patches = [
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -82,7 +82,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "glib";
-  version = "2.88.1";
+  version = "2.88.3";

  outputs = [
    "bin"
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-UauATFb26rPlBFx3TRKQrF5Mkj1Pmj2OMxI77kXBhA4=";
+    hash = "sha256-qyTSTmmN+h5Ai3vNtQj0qvyQYYWouM5y/febu9ybODs=";
  };

  patches =
--- a/pkgs/by-name/gn/gn/package.nix
+++ b/pkgs/by-name/gn/gn/package.nix
@@ -36,6 +36,9 @@ stdenv.mkDerivation {
    '';
  };

+  strictDeps = true;
+  __structuredAttrs = true;
+
  nativeBuildInputs = [
    ninja
    python3
--- a/pkgs/by-name/li/libadwaita/package.nix
+++ b/pkgs/by-name/li/libadwaita/package.nix
@@ -23,7 +23,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libadwaita";
-  version = "1.9.2";
+  version = "1.9.3";

  outputs = [
    "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "GNOME";
    repo = "libadwaita";
    tag = finalAttrs.version;
-    hash = "sha256-XKKjnZz4CII6w9fKFptPK3aTNa5eMfyE7rcerbgaDco=";
+    hash = "sha256-1V3L10YgRnOoJud/lybfSj2AYOY0kRAJdfamJg+S1fo=";
  };

  depsBuildBuild = [
--- a/pkgs/by-name/li/libffiReal/package.nix
+++ b/pkgs/by-name/li/libffiReal/package.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libffi";
-  version = "3.7.1";
+  version = "3.8.0";

  src = fetchurl {
    url =
      with finalAttrs;
      "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-1emmY43b0lE921RRjrZ+S75vpwe8wBwQ9iEvCgiNgZ0=";
+    hash = "sha256-faPi2aFx6woDj1kuytP/K7JVDzSW2Hs7Ka0M9EMMDbQ=";
  };

  # Note: this package is used for bootstrapping fetchurl, and thus
--- a/pkgs/by-name/li/libssh/package.nix
+++ b/pkgs/by-name/li/libssh/package.nix
@@ -16,11 +16,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libssh";
-  version = "0.12.1";
+  version = "0.12.2";

  src = fetchurl {
    url = "https://www.libssh.org/files/${lib.versions.majorMinor finalAttrs.version}/libssh-${finalAttrs.version}.tar.xz";
-    hash = "sha256-05Qa8KLXjV2C7Xo2mI6RM5lDEvA1uWWabkP42zloeEw=";
+    hash = "sha256-SVYPZ32W43BqkErC3hEW4l82gJN9UeXJIZj8ukocHp8=";
  };

  outputs = [
--- a/pkgs/by-name/li/libssh2/package.nix
+++ b/pkgs/by-name/li/libssh2/package.nix
@@ -27,18 +27,21 @@ stdenv.mkDerivation (finalAttrs: {
    # https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1
    ./CVE-2026-7598.patch

+    # backport of https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d
    (fetchurl {
      name = "CVE-2025-15661.patch";
      url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2025-15661.patch";
      hash = "sha256-Rz6i/881CbObUDcZbcPlgVPaKizSp6ZRTdmJNJ9HLHE=";
    })

+    # backport of https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
    (fetchurl {
      name = "CVE-2026-55199.patch";
      url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2026-55199.patch";
      hash = "sha256-AFZa5kohha62aE0if5ckmAdJ0TZNcjfP32yDznoEhNo=";
    })

+    # backport of https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
    (fetchurl {
      name = "CVE-2026-55200.patch";
      url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2026-55200.patch";
@@ -53,16 +56,47 @@ stdenv.mkDerivation (finalAttrs: {
    })

    # https://github.com/libssh2/libssh2/issues/1925#issuecomment-4938515829
+    # backport of https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12
    (fetchurl {
      name = "CVE-2026-58050.patch";
      url = "https://raw.githubusercontent.com/JuliaPackaging/Yggdrasil/9404aa5dd96c945a790c425a5f49af19ed2a93b0/L/LibSSH2/LibSSH2%401.11/bundled/patches/CVE-2026-58050-3449752.patch";
      hash = "sha256-BZ1ewZgrroev2gkJwdoHCMFJK4wiRmA/Y4tzwaQqBd8=";
    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a
    (fetchurl {
      name = "CVE-2026-58051.patch";
      url = "https://github.com/JuliaPackaging/Yggdrasil/raw/9404aa5dd96c945a790c425a5f49af19ed2a93b0/L/LibSSH2/LibSSH2%401.11/bundled/patches/CVE-2026-58051-a9758da.patch";
      hash = "sha256-fduXIH02uwzqWV2RDidZmaDBy51V8yuC4XKlGYacjxg=";
    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0
+    (fetchurl {
+      name = "CVE-2026-66032.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66032.patch";
+      hash = "sha256-H6VXhVc7uCFxj/k3Xouyg+8GYpsn/9IecXZrPkzsgks=";
+    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6
+    (fetchurl {
+      name = "CVE-2026-66033.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66033.patch";
+      hash = "sha256-To2ul9ibaAkn0BWNu7fUbpaqHqEX+juUsBbjA0BGF6s=";
+    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9
+    (fetchurl {
+      name = "CVE-2026-66034.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66034.patch";
+      hash = "sha256-xYg9qh87KlExI38snAq5E5hF51mIoaJ1wOX9e1uEdmk=";
+    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4
+    (fetchurl {
+      name = "CVE-2026-66035.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66035.patch";
+      hash = "sha256-+Wr9dp+g347pgKaJYRNRx+EXHA3iOKgOO4tjxi7zkD8=";
+    })
  ];

  # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
--- a/pkgs/by-name/li/libxfont_2/package.nix
+++ b/pkgs/by-name/li/libxfont_2/package.nix
@@ -15,7 +15,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "libxfont_2";
-  version = "2.0.8";
+  version = "2.0.9";

  outputs = [
    "out"
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://xorg/individual/lib/libXfont2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-9VbA4Qk6TmkRzJC8SxBtIBkC7hh/10ryBv8WL35qJNU=";
+    hash = "sha256-8EKjcGZoFee5Qem3AZAkdVvRxsKVSvv6UVrzeCUXmeI=";
  };

  strictDeps = true;
@@ -41,6 +41,8 @@ stdenv.mkDerivation (finalAttrs: {

  propagatedBuildInputs = [ xorgproto ];

+  configureFlags = [ "--enable-fc" ];
+
  passthru = {
    updateScript = writeScript "update-${finalAttrs.pname}" ''
      #!/usr/bin/env nix-shell
--- a/pkgs/by-name/ll/llhttp/package.nix
+++ b/pkgs/by-name/ll/llhttp/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "llhttp";
-  version = "9.4.2";
+  version = "9.4.3";

  src = fetchFromGitHub {
    owner = "nodejs";
    repo = "llhttp";
    tag = "release/v${finalAttrs.version}";
-    hash = "sha256-LS8HS8CnXJ3X8WlIvtxBLc0h1wLL/HmTqZWHlvBjTEo=";
+    hash = "sha256-wz87FgdZn0vtdlTWOZL5/Ujhs/uzSwFMHzQ6D9S7dH8=";
  };

  outputs = [
--- a/pkgs/by-name/ns/nspr/package.nix
+++ b/pkgs/by-name/ns/nspr/package.nix
@@ -8,11 +8,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nspr";
-  version = "4.39";
+  version = "4.40";

  src = fetchurl {
    url = "mirror://mozilla/nspr/releases/v${finalAttrs.version}/src/nspr-${finalAttrs.version}.tar.gz";
-    hash = "sha256-u9Au6HpVZ2Bjpj5byBngIn3iZmtHMHsqATRBTN9CNo4=";
+    hash = "sha256-wMGITGJ/Pbeng/fHMUxpUiayBDaWeR0VUZ5+BXjBm9w=";
  };

  patches = [
@@ -53,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  meta = {
+    changelog = "https://github.com/mozilla/nspr/releases/tag/NSPR_${lib.concatStringsSep "_" (lib.splitVersion finalAttrs.version)}_RTM";
    homepage = "https://firefox-source-docs.mozilla.org/nspr/index.html";
    description = "Netscape Portable Runtime, a platform-neutral API for system-level and libc-like functions";
    maintainers = with lib.maintainers; [
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -63,13 +63,13 @@ assert lib.assertMsg (
 ) "unbound: withDoQ requires OpenSSL with QUIC support (OpenSSL >= 3.5)";
 stdenv.mkDerivation (finalAttrs: {
  pname = "unbound";
-  version = "1.25.2";
+  version = "1.26.0";

  src = fetchFromGitHub {
    owner = "NLnetLabs";
    repo = "unbound";
    tag = "release-${finalAttrs.version}";
-    hash = "sha256-zt0JpVmct7w6ay+p8CdH6SGt/rL/v//e7K3MT8KZfOY=";
+    hash = "sha256-ESRboc5vwsNZ/Yynl2JGRWhH1QEYZumoTzgSvN3NbSU=";
  };

  outputs = [
--- a/pkgs/development/compilers/zulu/common.nix
+++ b/pkgs/development/compilers/zulu/common.nix
@@ -79,6 +79,9 @@ let
    pname = "zulu-${javaPackage}";
    version = dist.jdkVersion;

+    __structuredAttrs = true;
+    strictDeps = true;
+
    src = fetchurl {
      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-${platform}_${arch}.tar.gz";
      inherit (dist) hash;
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -20,10 +20,10 @@
        sourceVersion = {
          major = "3";
          minor = "13";
-          patch = "14";
+          patch = "15";
          suffix = "";
        };
-        hash = "sha256-Y55DJDxiCjCPloIT354A8vj2IzL3rbqnp+65eDBXxpA=";
+        hash = "sha256-HmanlFpIOQ7kwqQmig5BhYhAWaE8SqttFIqiCN7qSnY=";
      };
    };

@@ -79,10 +79,10 @@
      sourceVersion = {
        major = "3";
        minor = "14";
-        patch = "6";
+        patch = "7";
        suffix = "";
      };
-      hash = "sha256-FDsd3e+uw70uIeO4ObNKK3+5hCJyiDxXZCDWBenzDGM=";
+      hash = "sha256-O0jayPtZ9i6qZ6yDwesSvaG3oIQG3ShuJSwRpmvif4E=";
      inherit passthruFun;
    };

--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -193,6 +193,35 @@ stdenv.mkDerivation {
      extraPrefix = "libs/context/";
      sha256 = "sha256-bCfLL7bD1Rn4Ie/P3X+nIcgTkbXdCX6FW7B9lHsmVW8=";
    })
+    # Backports https://github.com/boostorg/context/pull/331, which prevents
+    # an optimisation that breaks coroutine migration between threads.
+    # (mostly needed to avoid conflicts when applying the patch below,
+    # but it's a meaningful standalone fix too).
+    ++
+      lib.optional (lib.versionAtLeast version "1.88.0" && lib.versionOlder version "1.92.0")
+        (fetchpatch {
+          url = "https://github.com/boostorg/context/commit/0921b9fd5c776aec7748475c6c10807e0d51bc6d.patch";
+          relative = "include";
+          hash = "sha256-nQYMd3HFsDLxijnGdyas0ZHs3ylQVMGQL14K7F6MkF0=";
+        })
+    # Backports https://github.com/boostorg/context/pull/337 which fixes a regression that breaks
+    # std::uncaught_exceptions for abandoned coroutines under libstdc++ and fcontext implementation.
+    # This bug also caused subtle breakage in Nix. See https://github.com/NixOS/nix/issues/16174.
+    ++
+      lib.optional (lib.versionAtLeast version "1.88.0" && lib.versionOlder version "1.93.0")
+        (fetchpatch {
+          url = "https://github.com/boostorg/context/commit/5883212311535a0046031d74d1568ae173c1e35b.patch";
+          relative = "include";
+          hash = "sha256-CytNLi2d0wjI/lY5lDv98mwwQaEt7qeIs4UkE6QgCBU=";
+        })
+    ++
+      # This also broke Nix https://github.com/NixOS/nix/issues/13145 and probably much more dependants too.
+      lib.optional (lib.versionAtLeast version "1.88.0" && lib.versionOlder version "1.89.0")
+        (fetchpatch {
+          url = "https://github.com/boostorg/context/commit/c79564d0de69422ed33f2fbc892908ad510e6a19.patch";
+          relative = "include";
+          hash = "sha256-5iZ+rSdtyOupBUYws6U8whd43XMkTlQlApW5xvE0ZB4=";
+        })
    # This fixes another issue regarding ill-formed constant expressions, which is a default error
    # in clang 16 and will be a hard error in clang 17.
    ++ lib.optional (lib.versionOlder version "1.80") (fetchpatch {
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -9,6 +9,7 @@
  cffi,
  cryptography-vectors ? (callPackage ./vectors.nix { }),
  fetchFromGitHub,
+  fetchpatch2,
  isPyPy,
  libiconv,
  openssl,
@@ -36,6 +37,27 @@ buildPythonPackage rec {
    hash = "sha256-mp+1Fw8xNBJD1DM8obAqYBP8erxXiP768+ifqRN1Uqs=";
  };

+  patches = [
+    # CVE-2026-69247
+    (fetchpatch2 {
+      url = "https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f.patch?full_index=1";
+      excludes = [ "CHANGELOG.rst" ];
+      hash = "sha256-BBMsnFozpIJCkRejCYZrfiEikLJSJXCAMCBqa5vRL5E=";
+    })
+    # CVE-2026-69248
+    (fetchpatch2 {
+      url = "https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2.patch?full_index=1";
+      excludes = [ ".github/actions/**" ];
+      hash = "sha256-Uct2j+kMYVJ0PJ0WtPqQkACVFyqKjK4bi5LMuRHWCZo=";
+    })
+    # CVE-2026-69249
+    (fetchpatch2 {
+      url = "https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582.patch?full_index=1";
+      excludes = [ ".github/actions/**" ];
+      hash = "sha256-9WFoA+H/OMLLkSfJvhBf9cgSYrhuVokYKLr6WeNJAgI=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace pyproject.toml \
      --replace-fail "--benchmark-disable" ""
--- a/pkgs/development/python-modules/datamodel-code-generator/default.nix
+++ b/pkgs/development/python-modules/datamodel-code-generator/default.nix
@@ -3,15 +3,21 @@
  argcomplete,
  black,
  buildPythonPackage,
+  email-validator,
  fetchFromGitHub,
  genson,
  graphql-core,
+  grpcio-tools,
  hatch-vcs,
  hatchling,
  httpx,
+  hypothesis,
+  hypothesis-jsonschema,
  inflect,
  inline-snapshot,
  isort,
+  jsonschema,
+  msgspec,
  jinja2,
  openapi-spec-validator,
  packaging,
@@ -20,6 +26,8 @@
  pydantic,
  pysnooper,
  pytest-mock,
+  pytest-timeout,
+  pytest-xdist,
  pytestCheckHook,
  pyyaml,
  time-machine,
@@ -28,14 +36,14 @@

 buildPythonPackage rec {
  pname = "datamodel-code-generator";
-  version = "0.55.0";
+  version = "0.71.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "koxudaxi";
    repo = "datamodel-code-generator";
    tag = version;
-    hash = "sha256-zsLJv7gKhmnEIS/AUvnBzm+07QFQoMdiFo/PkfRyHek=";
+    hash = "sha256-0vh/iynZzmMzvdUXNScb+JWANdSrzPLT1qt+jyKleg4=";
  };

  pythonRelaxDeps = [
@@ -65,6 +73,7 @@ buildPythonPackage rec {
    debug = [ pysnooper ];
    graphql = [ graphql-core ];
    http = [ httpx ];
+    protobuf = [ grpcio-tools ];
    ruff = [ ruff ];
    validation = [
      openapi-spec-validator
@@ -76,20 +85,31 @@ buildPythonPackage rec {
  };

  nativeCheckInputs = [
+    email-validator
    inline-snapshot
+    hypothesis
+    hypothesis-jsonschema
+    jsonschema
+    msgspec
    pytest-mock
+    pytest-timeout
+    pytest-xdist
    pytestCheckHook
    time-machine
  ]
  ++ optional-dependencies.all;

-  pythonImportsCheck = [ "datamodel_code_generator" ];
+  pytestFlags = [
+    "--maxfail=2"
+  ];

  disabledTests = [
    # remote testing, name resolution failure.
    "test_openapi_parser_parse_remote_ref"
  ];

+  pythonImportsCheck = [ "datamodel_code_generator" ];
+
  meta = {
    description = "Pydantic model and dataclasses.dataclass generator for easy conversion of JSON, OpenAPI, JSON Schema, and YAML data sources";
    homepage = "https://github.com/koxudaxi/datamodel-code-generator";
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -41,14 +41,14 @@

 buildPythonPackage rec {
  pname = "django";
-  version = "5.2.16";
+  version = "5.2.17";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "django";
    repo = "django";
    tag = version;
-    hash = "sha256-DZa3OkqnrgXp1A/HerKYdUdanvi5jxHndo1DV4RVs0M=";
+    hash = "sha256-7it3opzsiN/hHhpipZz4ogmRKGz7E9/LmTF03/UYIB0=";
  };

  patches = [
@@ -69,6 +69,9 @@ buildPythonPackage rec {
  ];

  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools>=83" "setuptools"
+
    substituteInPlace tests/utils_tests/test_autoreload.py \
      --replace-fail "/usr/bin/python" "${python.interpreter}"
  '';
--- a/pkgs/development/python-modules/gitpython/default.nix
+++ b/pkgs/development/python-modules/gitpython/default.nix
@@ -10,14 +10,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "gitpython";
-  version = "3.1.50";
+  version = "3.1.58";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "gitpython-developers";
    repo = "GitPython";
    tag = finalAttrs.version;
-    hash = "sha256-oHJrN/iYaAZUNPgOLS+8Ekr1eLES8APfXynmR4OySwk=";
+    hash = "sha256-C6hrN7SRWngwkD/NYvsoEVQUagdurkxzWbnn42EJOHE=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/hypothesis-jsonschema/default.nix
+++ b/pkgs/development/python-modules/hypothesis-jsonschema/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  hypothesis,
+  jsonschema,
+  pytest-cov-stub,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "hypothesis-jsonschema";
+  version = "0.23.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  # no git tags
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-9KwDICQ0KkFJoQJTmE9aVza4Kz/ir7CIjzg0oxFT8hU=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    hypothesis
+    jsonschema
+  ];
+
+  doCheck = false; # sdist does not include everything to run the tests
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "hypothesis_jsonschema"
+  ];
+
+  meta = {
+    description = "Generate test data from JSON schemata with Hypothesis";
+    homepage = "https://github.com/Zac-HD/hypothesis-jsonschema";
+    license = lib.licenses.mpl20;
+  };
+})
--- a/pkgs/development/python-modules/inline-snapshot/default.nix
+++ b/pkgs/development/python-modules/inline-snapshot/default.nix
@@ -21,14 +21,14 @@

 buildPythonPackage rec {
  pname = "inline-snapshot";
-  version = "0.32.5";
+  version = "0.34.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "15r10nk";
    repo = "inline-snapshot";
    tag = version;
-    hash = "sha256-xnooMIm0UiNOWrZ4JZwbpFzliGsTF7b1DAXi1fxMb30=";
+    hash = "sha256-4Uvc925/6RxJRHjP3SZaB7T+gqky5KlL9agHy/14Jd0=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -29,22 +29,13 @@ let
      [ ];
 in
 buildNodejs {
-  version = "24.18.1";
-  sha256 = "86d40d594bbdfcf69009a62fdf43cb19ae72b6cb5822d2bdd8349c5a1b2fa628";
+  version = "24.19.0";
+  sha256 = "f6d95e10a0431ee1067fc6aabe9f762908b4716dd35324e1ddb4b1466b76659f";
  patches =
-    (
-      if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
-        [
-          ./configure-emulator.patch
-        ]
-      else
-        [
-          (fetchpatch2 {
-            url = "https://raw.githubusercontent.com/buildroot/buildroot/2f0c31bffdb59fb224387e35134a6d5e09a81d57/package/nodejs/nodejs-src/0003-include-obj-name-in-shared-intermediate.patch";
-            hash = "sha256-3g4aS+NmmUYNOYRNc6UMJKYoaTlpP5Knt9UHegx+o0Y=";
-          })
-        ]
-    )
+    (lib.optional (!(stdenv.hostPlatform.emulatorAvailable buildPackages)) (fetchpatch2 {
+      url = "https://raw.githubusercontent.com/buildroot/buildroot/2f0c31bffdb59fb224387e35134a6d5e09a81d57/package/nodejs/nodejs-src/0003-include-obj-name-in-shared-intermediate.patch";
+      hash = "sha256-3g4aS+NmmUYNOYRNc6UMJKYoaTlpP5Knt9UHegx+o0Y=";
+    }))
    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.isFreeBSD) [
      # This patch is concerning.
      # https://github.com/nodejs/node/issues/54576
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7415,6 +7415,8 @@ self: super: with self; {

  hypothesis-auto = callPackage ../development/python-modules/hypothesis-auto { };

+  hypothesis-jsonschema = callPackage ../development/python-modules/hypothesis-jsonschema { };
+
  hypothesis_6_136 = callPackage ../development/python-modules/hypothesis/hypothesis_6_136.nix { };

  hypothesmith = callPackage ../development/python-modules/hypothesmith { };