Merge staging-next into staging

2026-07-19 07:01:12 +00:00 · 2026-07-08 00:32:53 +00:00
parent b989afae40 f8a22d2746
commit 41c8b60446
112 changed files with 1297 additions and 1443 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21952,8 +21952,8 @@
    name = "Petr Hodina";
  };
  phorcys420 = {
-    name = "Adele";
-    email = "adele@coder.com";
+    name = "Phorcys";
+    email = "nixpkgs@phorcys.net";
    github = "phorcys420";
    githubId = 57866459;
  };
--- a/nixos/modules/services/networking/sabnzbd/default.nix
+++ b/nixos/modules/services/networking/sabnzbd/default.nix
@@ -117,6 +117,28 @@ in
        default = [ ];
      };

+      secretValues = mkOption {
+        type = with types; attrsOf path;
+        description = ''
+          Attrset of patterns in the settings that should be replaced at
+          runtime, just before the service starts, with values read from the
+          given files. The files must be readable by the service user.
+
+          Compared to the secretFiles option, secretValues allows having the
+          full settings structure in Nix, and only externalizing the secret
+          values themselves.
+        '';
+        default = { };
+        example = lib.literalExpression ''
+          {
+            "@my_server_password@" = "/run/secrets/my_server_password";
+            "@my_server_username@" = "/run/secrets/my_server_username";
+            "@sabnzbd_api_key@" = "/run/secrets/sabnzbd_api_key";
+            "@sabnzbd_nzb_key@" = "/run/secrets/sabnzbd_nzb_key";
+          }
+        '';
+      };
+
      allowConfigWrite = mkOption {
        type = types.bool;
        description = ''
@@ -501,6 +523,12 @@ in
            "''${files[@]}" \
            > "$tmpfile"

+          ${lib.concatStringsSep "\n" (
+            lib.mapAttrsToList (n: v: ''
+              "${lib.getExe pkgs.replace-secret}" "${n}" "${v}" "$tmpfile"
+            '') cfg.secretValues
+          )}
+
          install -D \
            -m ${if cfg.allowConfigWrite then "600" else "400"} \
            -o '${cfg.user}' -g '${cfg.group}' \
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -621,7 +621,7 @@ def install_bootloader() -> None:
    paths[config_file_path] = True

    for dest_path, source_path in config("additionalFiles").items():
-        dest_path = os.path.join(limine_install_dir, dest_path)
+        dest_path = os.path.join(str(config("efiMountPoint")), dest_path)

        copy_file(source_path, dest_path)

--- a/nixos/tests/kea.nix
+++ b/nixos/tests/kea.nix
@@ -110,6 +110,13 @@
            };
          };
        };
+
+        services.prometheus.exporters.kea = {
+          enable = true;
+          controlSocketPaths = [
+            config.services.kea.dhcp4.settings.control-socket.socket-name
+          ];
+        };
      };

    nameserver =
@@ -217,5 +224,9 @@

      with subtest("DDNS"):
          nameserver.wait_until_succeeds("kdig +short client.lan.nixos.test @10.0.0.2 | grep -q 10.0.0.3")
+
+      with subtest("Prometheus Exporter"):
+        router.log(router.execute("curl 127.0.0.1:9547")[1])
+        router.succeed("curl --silent 127.0.0.1:9547 | grep -qE '^kea_dhcp4_addresses_assigned_total.*1.0$'")
    '';
 }
--- a/nixos/tests/limine/additional-files.nix
+++ b/nixos/tests/limine/additional-files.nix
@@ -0,0 +1,51 @@
+{ pkgs, lib, ... }:
+{
+  name = "additionalFiles";
+  meta.maintainers = with lib.maintainers; [
+    flokli
+  ];
+  meta.platforms = [
+    "x86_64-linux"
+  ];
+  nodes.machine =
+    { ... }:
+    {
+      virtualisation.useBootLoader = true;
+      virtualisation.useEFIBoot = true;
+      boot.loader.limine.enable = true;
+      boot.loader.limine.efiSupport = true;
+      boot.loader.timeout = 0;
+
+      specialisation.withAdditionalFiles.configuration = { ... }: {
+        boot.loader.limine.additionalFiles = {
+          "efi/memtest86/memtest86.efi" = "${pkgs.memtest86-efi}/BOOTX64.efi";
+        };
+      };
+      specialisation.withAdditionalFilesOther.configuration = { ... }: {
+        boot.loader.limine.additionalFiles = {
+          "efi/memtest86/memtest86.efi" = "${builtins.toFile "some-file" "some-content"}";
+        };
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      withAdditionalFiles =
+        nodes.machine.specialisation.withAdditionalFiles.configuration.system.build.toplevel;
+      withAdditionalFilesOther =
+        nodes.machine.specialisation.withAdditionalFilesOther.configuration.system.build.toplevel;
+    in
+    ''
+      machine.start()
+      machine.wait_for_unit("multi-user.target")
+
+      # switch to a generation with additional files and ensure they're present
+      machine.succeed("${withAdditionalFiles}/bin/switch-to-configuration switch")
+      machine.succeed("stat /boot/efi/memtest86/memtest86.efi")
+
+      # switch to the next generation with something else in there and ensure it got updated
+      machine.succeed("${withAdditionalFilesOther}/bin/switch-to-configuration switch")
+      assert machine.succeed("cat /boot/efi/memtest86/memtest86.efi").strip() == "some-content"
+    '';
+}
--- a/nixos/tests/limine/default.nix
+++ b/nixos/tests/limine/default.nix
@@ -3,6 +3,7 @@
  ...
 }:
 {
+  additionalFiles = runTest ./additional-files.nix;
  bios = runTest ./bios.nix;
  checksum = runTest ./checksum.nix;
  secureBoot = runTest ./secure-boot.nix;
--- a/nixos/tests/sabnzbd-module.nix
+++ b/nixos/tests/sabnzbd-module.nix
@@ -105,6 +105,26 @@ in
      };
    };

+  nodes.with_secret_values =
+    { pkgs, ... }:
+    {
+      config = {
+        services.sabnzbd = {
+          enable = true;
+          settings = {
+            misc.api_key = "@api_key@";
+            misc.nzb_key = "@nzb_key@";
+          };
+          secretValues = {
+            # Just for testing; don't use world readable files from the Nix
+            # store in production!
+            "@api_key@" = builtins.toFile "api_key" "dummyapikey";
+            "@nzb_key@" = builtins.toFile "nzb_key" "dummynzbkey";
+          };
+        };
+      };
+    };
+
  testScript = ''
    def wait_for_up(m):
      m.wait_for_unit("sabnzbd.service")
@@ -113,9 +133,12 @@ in
    wait_for_up(machine)
    wait_for_up(with_writeable_config)
    wait_for_up(with_raw_config_file)
+    wait_for_up(with_secret_values)

    machine.succeed("do_test")
    with_writeable_config.succeed("do_test")
    with_raw_config_file.succeed("do_test_2")
+    with_secret_values.succeed("grep dummyapikey /var/lib/sabnzbd/sabnzbd.ini")
+    with_secret_values.succeed("grep dummynzbkey /var/lib/sabnzbd/sabnzbd.ini")
  '';
 }
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
@@ -14,13 +14,13 @@ let

  pname = "ghostel";

-  version = "0.41.0-unstable-2026-07-05";
+  version = "0.41.0-unstable-2026-07-06";

  src = fetchFromGitHub {
    owner = "dakra";
    repo = "ghostel";
-    rev = "f77efee9172854abc08652637d23adc26faa25a2";
-    hash = "sha256-6ME+aStZ9X1pkTr0uwwhrJXEHu/uLStPHsKtbudXl9I=";
+    rev = "eb806d158df4ff302aee68e91caf257f11d66320";
+    hash = "sha256-Xz3Sy0iR/g5SoEzqJTZo2ymfMPYQ0NvnAOEoXiXhQFE=";
  };

  module = stdenv.mkDerivation (finalAttrs: {
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/modus-themes-exporter/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/modus-themes-exporter/package.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  melpaBuild,
+  fetchFromGitHub,
+  modus-themes,
+  nix-update-script,
+}:
+melpaBuild {
+  pname = "modus-themes-exporter";
+  version = "0-unstable-2026-04-24";
+
+  src = fetchFromGitHub {
+    owner = "protesilaos";
+    repo = "modus-themes-exporter";
+    rev = "a19c4b0f22d353afcd441fbbc6c0565858a86c9b";
+    hash = "sha256-/PCCArQUV1uhhbOC3fqSuUkgDqc4+QlLubTtjx8/vGc=";
+  };
+
+  packageRequires = [ modus-themes ];
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch=main" ]; };
+
+  meta = {
+    description = "Export a Modus themes to another application";
+    homepage = "https://github.com/protesilaos/modus-themes-exporter";
+    maintainers = [ lib.maintainers.HeitorAugustoLN ];
+    license = lib.licenses.gpl3Plus;
+  };
+}
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1226,8 +1226,8 @@ let
        mktplcRef = {
          name = "databricks";
          publisher = "databricks";
-          version = "2.12.0";
-          hash = "sha256-dDkJI9j79pFnZlEH9dokUoEYqjMmDyiU00IGGxzno1A=";
+          version = "2.12.1";
+          hash = "sha256-GKm3rZMvU/5Ii01GjUg7rE15TnOtDTh0LwkDVsuSLfY=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
@@ -3692,8 +3692,8 @@ let
        mktplcRef = {
          name = "ocaml-platform";
          publisher = "ocamllabs";
-          version = "2.0.1";
-          hash = "sha256-BFRGEH5a2kTSIZG3o0GkYPeZch5b7OBUN4+pKXSQ7SY=";
+          version = "2.3.0";
+          hash = "sha256-vb2tTtdHRmlF/TZRqUFjZNgE+5jizX/ky+NgzJYvXUg=";
        };
      };

--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "150.0.7871.46",
+    "version": "150.0.7871.100",
    "chromedriver": {
-      "version": "149.0.7827.201",
-      "hash_darwin": "sha256-MHCcid+7wdYm8uIdrUIlXrk8ADHNUUXzPyMPFGP98WY=",
-      "hash_darwin_aarch64": "sha256-Gwmdo9qNyV/BnCj18f0BFpNgDf28e8vjNF98e5/vVjQ="
+      "version": "150.0.7871.101",
+      "hash_darwin": "sha256-LJPfzeJjVcEHenRNqKNOGcEZLL/rHRH55yBefLFTlEs=",
+      "hash_darwin_aarch64": "sha256-+WZw22dgaDsDMOQUJTjTuCGyUZT1t1RBjutyqmumX/A="
    },
    "deps": {
      "depot_tools": {
@@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "5b586c06e0d27582900f17e2d59c5370d8d6e0bb",
-        "hash": "sha256-OAZNyZtR5WFWW42r74RSy9fT7Eb7CNZwzoIHhuoqR28=",
+        "rev": "b5a9b587b83512ef1fab99cb7510c58a06d22089",
+        "hash": "sha256-bylGmZC9NhUjcU6amK3mwuZ1it7uTm2hsC60DaKINr4=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -128,13 +128,13 @@
    "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
  },
  "buildkite_buildkite": {
-    "hash": "sha256-CfipoNGW0VofHfgXlbfcjIGYpkuE0UXewDM6UCutg9g=",
+    "hash": "sha256-egeZCTQFyhKG0giyjNK9C/W+OGMOGv2l+65Vg3iTi2A=",
    "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
    "owner": "buildkite",
    "repo": "terraform-provider-buildkite",
-    "rev": "v1.34.2",
+    "rev": "v1.35.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-uYyj6GSV5bWEfRTOODMuReEHe9wnF4cVoHM9rBMpgmM="
+    "vendorHash": "sha256-oYwtPTXNCkTizQWix2GYpb23mFvTmIzbcY3UTfB2Leo="
  },
  "camptocamp_pass": {
    "hash": "sha256-GQ2g7VyK+eeBqW3LMR4U0gMYsvQnG3y+KEKKkvnmfsk=",
@@ -724,11 +724,11 @@
    "vendorHash": "sha256-6knIcS3hkzt3R1IC1hA6EKOceJl51/pJXpftEaZjgtY="
  },
  "huaweicloud_huaweicloud": {
-    "hash": "sha256-Ao3CkaQBe172Ookcgl+ugeHH5ClbyOsSpLb4+j9DAZQ=",
+    "hash": "sha256-yuBbgu3DtnwMLwgFZtHpI6yo8p0Pzl6AtlqbW2cWi+c=",
    "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
    "owner": "huaweicloud",
    "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.93.0",
+    "rev": "v1.94.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/by-name/al/aliyun-cli/package.nix
+++ b/pkgs/by-name/al/aliyun-cli/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "aliyun-cli";
-  version = "3.4.2";
+  version = "3.4.5";

  src = fetchFromGitHub {
    owner = "aliyun";
    repo = "aliyun-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-x43yePNf1HVw9R7PqpAb7J2XYCEn90W81nx/zgfNQBg=";
+    hash = "sha256-Q3jFqWET3mB0kOrLX4JAtza6j/4bXAEBjXzvSGCFgqw=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/ar/ariang/package.nix
+++ b/pkgs/by-name/ar/ariang/package.nix
@@ -11,18 +11,18 @@

 buildNpmPackage rec {
  pname = "ariang";
-  version = "1.3.13";
+  version = "1.3.14";

  src = fetchFromGitHub {
    owner = "mayswind";
    repo = "AriaNg";
    tag = version;
-    hash = "sha256-u4MnjGMvnnb9EGHwK2QYpW7cuX1e1+6z2/1X1baR8iA=";
+    hash = "sha256-wPFZGNqVveDj9Dh0QSxyy93K7G91CACD4RzmgjaRxjI=";
  };

  nodejs = nodejs_22;

-  npmDepsHash = "sha256-kxoSEdM8H7M9s6U2dtCdfuvqVROEk35jAkO7MgyVVRg=";
+  npmDepsHash = "sha256-D+yqIDeJki0h6bT8eia8W8Xbokjgl4nlBXLApfhMwVc=";

  makeCacheWritable = true;

--- a/pkgs/by-name/az/azure-cli/extensions-generated.json
+++ b/pkgs/by-name/az/azure-cli/extensions-generated.json
@@ -36,9 +36,9 @@
  },
  "aem": {
    "pname": "aem",
-    "version": "1.0.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aem-1.0.1-py2.py3-none-any.whl",
-    "hash": "sha256-QDkq7GjOpqZSUFXkxrL5OjJwSnGHmRH/8r6N/Amriq0=",
+    "version": "1.0.2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aem-1.0.2-py2.py3-none-any.whl",
+    "hash": "sha256-dviicXq9CP0j6YiMH9HLggxOphg4S7WqFZcSzBspUCM=",
    "description": "Manage Azure Enhanced Monitoring Extensions for SAP"
  },
  "ai-examples": {
@@ -50,9 +50,9 @@
  },
  "aks-preview": {
    "pname": "aks-preview",
-    "version": "21.0.0b4",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-21.0.0b4-py2.py3-none-any.whl",
-    "hash": "sha256-SQVpyKPmiVfN1gX7CnqhgAIoYVc8+ViPT/y0u8Km/EM=",
+    "version": "21.0.0b8",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-21.0.0b8-py2.py3-none-any.whl",
+    "hash": "sha256-qjmGi1RBxlmvwR0GnvQr1I272G0lcFinbftVLcJ0h2M=",
    "description": "Provides a preview for upcoming AKS features"
  },
  "alb": {
@@ -97,13 +97,6 @@
    "hash": "sha256-JGt61AOwZxk4oxZh4ohktQQH73cBnuHyHwvreev+xH0=",
    "description": "Azure CLI commands for working with Azure Kubernetes Application Network resources"
  },
-  "appservice-kube": {
-    "pname": "appservice-kube",
-    "version": "1.0.0b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/appservice_kube-1.0.0b1-py2.py3-none-any.whl",
-    "hash": "sha256-85HDcR5CwGoGG2ZXOK0aPGyUoE4aXK7QMnJH2vcohac=",
-    "description": "Microsoft Azure Command-Line Tools App Service on Kubernetes Extension"
-  },
  "arcgateway": {
    "pname": "arcgateway",
    "version": "1.0.0b1",
@@ -197,9 +190,9 @@
  },
  "blueprint": {
    "pname": "blueprint",
-    "version": "1.0.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/blueprint-1.0.0b2-py3-none-any.whl",
-    "hash": "sha256-KVtkhYL1+HnnJnmZt7AtZpfFvve/hcpmFw2EfzSHGLc=",
+    "version": "1.0.0b3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/blueprint-1.0.0b3-py3-none-any.whl",
+    "hash": "sha256-ZCw3lQztIN8b5Yk5DwGLUl4AMzVVyh+ZWnXAZLYAthY=",
    "description": "Microsoft Azure Command-Line Tools Blueprint Extension"
  },
  "carbon": {
@@ -223,6 +216,13 @@
    "hash": "sha256-SfF2Ghsa0pFpry7NV5PhDd7Hl+uyYQ58cOGxqyt1Emo=",
    "description": "Microsoft Azure Command-Line Tools ChangeAnalysis Extension"
  },
+  "chaos": {
+    "pname": "chaos",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/chaos-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-xRPEXb3ukZUJrgWlC8lSQvSrbFXmce57e+yskfN1Xkg=",
+    "description": "Support for Azure Chaos Studio v2 workspaces, scenario configuration, and fault-injection run management"
+  },
  "cli-translator": {
    "pname": "cli-translator",
    "version": "0.3.0",
@@ -281,9 +281,9 @@
  },
  "cosmosdb-preview": {
    "pname": "cosmosdb-preview",
-    "version": "1.6.2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/cosmosdb_preview-1.6.2-py2.py3-none-any.whl",
-    "hash": "sha256-le+/kTHWOoDqV/DDgl2yjTboQhx+X/S92PHt8Yqqpf4=",
+    "version": "1.7.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/cosmosdb_preview-1.7.0-py2.py3-none-any.whl",
+    "hash": "sha256-c04+FafVc2kwPFiA2IAMJjfEnblXvZMfEZEG1RGMFe0=",
    "description": "Microsoft Azure Command-Line Tools Cosmosdb-preview Extension"
  },
  "costmanagement": {
@@ -351,9 +351,9 @@
  },
  "dataprotection": {
    "pname": "dataprotection",
-    "version": "1.11.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/dataprotection-1.11.1-py3-none-any.whl",
-    "hash": "sha256-h/BgaqXzZYS8vZ8xQO1iuiZ1yTPjYa8IGzI0k4GNakY=",
+    "version": "1.11.3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/dataprotection-1.11.3-py3-none-any.whl",
+    "hash": "sha256-JAN0/BvOEKSqVcby0NoLBdPTz/Sc+RQx4jZgxYsujJQ=",
    "description": "Microsoft Azure Command-Line Tools DataProtectionClient Extension"
  },
  "datashare": {
@@ -435,9 +435,9 @@
  },
  "durabletask": {
    "pname": "durabletask",
-    "version": "1.0.0b7",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/durabletask-1.0.0b7-py3-none-any.whl",
-    "hash": "sha256-31AvidVj3oZtfgTcEo5qrf5+x4tOQiuq6aavoTKsquI=",
+    "version": "1.0.0b8",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/durabletask-1.0.0b8-py3-none-any.whl",
+    "hash": "sha256-ntQnvbQ9GemjMaN6Id2MWWqFxdGUXBC2P30E6r7zn38=",
    "description": "Microsoft Azure Command-Line Tools Durabletask Extension"
  },
  "dynatrace": {
@@ -533,9 +533,9 @@
  },
  "front-door": {
    "pname": "front-door",
-    "version": "2.2.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/front_door-2.2.0-py3-none-any.whl",
-    "hash": "sha256-5vj/OzbfMmv/SI8qS659o+QiMfPofoBCJR/mQV3XZNE=",
+    "version": "2.3.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/front_door-2.3.0-py3-none-any.whl",
+    "hash": "sha256-+Uq7J4afgPBzdZ1mt+ryCt/zeqqxQjS16nbVfjwGleU=",
    "description": "Manage networking Front Doors"
  },
  "fzf": {
@@ -580,6 +580,13 @@
    "hash": "sha256-rEoQ4sxkpNCBjkj/vN3+tDB91WuIdbwBwCaH1HPJ/ps=",
    "description": "Microsoft Azure Command-Line Tools AzureDedicatedHSMResourceProvider Extension"
  },
+  "health-models": {
+    "pname": "health-models",
+    "version": "1.0.0b2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/health_models-1.0.0b2-py3-none-any.whl",
+    "hash": "sha256-VNI/jJwfS0iaEYDW+jOZx8t/Os6mbZ1O017Amuo/d5E=",
+    "description": "Support for managing Azure Monitor health models, including entities, signals, relationships, authentication settings, and discovery rules"
+  },
  "healthbot": {
    "pname": "healthbot",
    "version": "1.1.0",
@@ -596,9 +603,9 @@
  },
  "horizondb": {
    "pname": "horizondb",
-    "version": "1.0.0b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/horizondb-1.0.0b1-py2.py3-none-any.whl",
-    "hash": "sha256-bvjD6FSGjkuMjnc1XYnglbzd2cLMDuwRiPW9+7n6efA=",
+    "version": "1.0.0b4",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/horizondb-1.0.0b4-py2.py3-none-any.whl",
+    "hash": "sha256-2p6sKyNhoBsrwneo7TUwr+MyE/6fhTxFP9apfqexP7Q=",
    "description": "Microsoft Azure Command-Line Tools HorizonDB Extension"
  },
  "hpc-cache": {
@@ -797,6 +804,13 @@
    "hash": "sha256-q5tuqnN94FS1opr9oLx2LHFYuFX6PTDaBmuvrByXTsI=",
    "description": "Microsoft Azure Command-Line Tools MulticloudConnector Extension"
  },
+  "napster": {
+    "pname": "napster",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/napster-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-gwnA5Wly3q12ylnbvkVOTEm/vxVJTEIgUVoS5j8Mzgk=",
+    "description": "Microsoft Azure Command-Line Tools Napster Extension"
+  },
  "network-analytics": {
    "pname": "network-analytics",
    "version": "1.0.0b1",
@@ -932,9 +946,9 @@
  },
  "qumulo": {
    "pname": "qumulo",
-    "version": "2.0.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/qumulo-2.0.1-py3-none-any.whl",
-    "hash": "sha256-HlMtkVEYvu86KqPPVBG/3i0zPg0S1P4qBedSnJwjIgg=",
+    "version": "3.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/qumulo-3.0.0-py3-none-any.whl",
+    "hash": "sha256-Gu30eY0y0Xr53UatKDPXK+3Mb5Y1EoxSAYCZoWbznJ8=",
    "description": "Microsoft Azure Command-Line Tools Qumulo Extension"
  },
  "quota": {
@@ -1058,9 +1072,9 @@
  },
  "staticwebapp": {
    "pname": "staticwebapp",
-    "version": "1.0.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/staticwebapp-1.0.0-py3-none-any.whl",
-    "hash": "sha256-+x3Nh2/C2CnMehzFRelEU2TUM1fYiLs97rNqcWuAVxc=",
+    "version": "1.0.1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/staticwebapp-1.0.1-py3-none-any.whl",
+    "hash": "sha256-7zEAwfO2Q6ySSBZrgJmTejeP6ntSd+jAmxfvdQ5dCCU=",
    "description": "Microsoft Azure Command-Line Tools Staticwebapp Extension"
  },
  "storage-actions": {
@@ -1086,9 +1100,9 @@
  },
  "storage-mover": {
    "pname": "storage-mover",
-    "version": "1.2.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/storage_mover-1.2.1-py3-none-any.whl",
-    "hash": "sha256-CWybGBqh6g8/+EsrqkFXlAZfkUMqrmKSAhq4d05WG/0=",
+    "version": "1.3.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/storage_mover-1.3.0-py3-none-any.whl",
+    "hash": "sha256-gPJWrRTS7q4cig11lCpnueSzO/EqjW++YW3yqa/U3oA=",
    "description": "Microsoft Azure Command-Line Tools StorageMover Extension"
  },
  "storagesync": {
@@ -1100,9 +1114,9 @@
  },
  "stream-analytics": {
    "pname": "stream-analytics",
-    "version": "1.0.3",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stream_analytics-1.0.3-py3-none-any.whl",
-    "hash": "sha256-FFRNCsg9Put3GcARODA6HpwGXbWfD1kb7qDvc+/TAkg=",
+    "version": "1.0.5",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stream_analytics-1.0.5-py3-none-any.whl",
+    "hash": "sha256-uIGEQu77eRFuo2J7WRhEmytTPO9LJQ4F3Uy+qcbDxQE=",
    "description": "Microsoft Azure Command-Line Tools StreamAnalyticsManagementClient Extension"
  },
  "subscription": {
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -379,12 +379,14 @@
  # Removed extensions
  adp = throw "The 'adp' extension for azure-cli was deprecated upstream"; # Added 2024-11-02, https://github.com/Azure/azure-cli-extensions/pull/8038
  akshybrid = throw "The 'akshybrid' extension for azure-cli was removed upstream"; # https://github.com/Azure/azure-cli-extensions/pull/8955
+  appservice-kube = throw "The 'appservice-kube' extensions for azure-cli was removed upstream"; # https://github.com/Azure/azure-cli-extensions/pull/10036
  azurestackhci = throw "The 'azurestackhci' extension for azure-cli was deprecated upstream"; # Added 2025-07-01, https://github.com/Azure/azure-cli-extensions/pull/8898
  blockchain = throw "The 'blockchain' extension for azure-cli was deprecated upstream"; # Added 2024-04-26, https://github.com/Azure/azure-cli-extensions/pull/7370
  compute-diagnostic-rp = throw "The 'compute-diagnostic-rp' extension for azure-cli was deprecated upstream"; # Added 2024-11-12, https://github.com/Azure/azure-cli-extensions/pull/8240
  connection-monitor-preview = throw "The 'connection-monitor-preview' extension for azure-cli was deprecated upstream"; # Added 2024-11-02, https://github.com/Azure/azure-cli-extensions/pull/8194
  csvmware = throw "The 'csvmware' extension for azure-cli was removed upstream"; # https://github.com/Azure/azure-cli-extensions/pull/8931
  deidservice = throw "The 'deidservice' extension for azure-cli was moved under healthcareapis"; # Added 2024-11-19, https://github.com/Azure/azure-cli-extensions/pull/8224
+  fileshares = throw "The 'fileshares' extensions for azure-cli was removed upstream"; # https://github.com/Azure/azure-cli-extensions/pull/9910
  hdinsightonaks = throw "The 'hdinsightonaks' extension for azure-cli was removed upstream"; # https://github.com/Azure/azure-cli-extensions/pull/8956
  logz = throw "The 'logz' extension for azure-cli was deprecated upstream"; # Added 2024-11-02, https://github.com/Azure/azure-cli-extensions/pull/8459
  mobile-network = throw "The 'mobile-network' extension for azure-cli was removed upstream"; # https://github.com/Azure/azure-cli-extensions/pull/9453
@@ -395,5 +397,4 @@
  spring = throw "The 'spring' extension for azure-cli was deprecated upstream"; # Added 2025-05-07, https://github.com/Azure/azure-cli-extensions/pull/8652
  spring-cloud = throw "The 'spring-cloud' extension for azure-cli was deprecated upstream"; # Added 2025-07-01 https://github.com/Azure/azure-cli-extensions/pull/8897
  weights-and-biases = throw "The 'weights-and-biases' extension for azure-cli was removed upstream"; # Added 2025-06-03, https://github.com/Azure/azure-cli-extensions/pull/8764
-  fileshares = throw "The 'fileshares' extensions for azure-cli was removed upstream"; # https://github.com/Azure/azure-cli-extensions/pull/9910
 }
--- a/pkgs/by-name/az/azure-cli/package.nix
+++ b/pkgs/by-name/az/azure-cli/package.nix
@@ -26,14 +26,14 @@
 }:

 let
-  version = "2.87.0";
+  version = "2.88.0";

  src = fetchFromGitHub {
    name = "azure-cli-${version}-src";
    owner = "Azure";
    repo = "azure-cli";
    tag = "azure-cli-${version}";
-    hash = "sha256-08GmSGjPt+veulW6d/03bKUeyhedQ0JfsFT9VDkaQ7w=";
+    hash = "sha256-9lDDzUuON1fkZzvV6oAzUOZcf+t7biDzPFufZIYQrAY=";
  };

  # put packages that needs to be overridden in the py package scope
--- a/pkgs/by-name/ba/badger/package.nix
+++ b/pkgs/by-name/ba/badger/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "badger";
-  version = "4.9.2";
+  version = "4.9.3";

  src = fetchFromGitHub {
    owner = "dgraph-io";
    repo = "badger";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-L6qGeOZlIl6I87t9Ohk57bA+WXT7NwMOJkiA3WaMFhM=";
+    hash = "sha256-B4DXzcgfkYcHqcK8F7NGbLcZWPmojMW4poRfCLv2DXI=";
  };

  vendorHash = "sha256-KDIwEH83nPMJPJGTN3UgO00pjYwR17XqGdPXioP1YcY=";
--- a/pkgs/by-name/bo/bomly/package.nix
+++ b/pkgs/by-name/bo/bomly/package.nix
@@ -11,7 +11,7 @@

 buildGoModule (finalAttrs: {
  pname = "bomly";
-  version = "0.16.0";
+  version = "0.16.1";

  __structuredAttrs = true;

@@ -19,10 +19,10 @@ buildGoModule (finalAttrs: {
    owner = "bomly-dev";
    repo = "bomly-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-y4FJCOzgEUprIBy/RuWVIlco4bI0XNUNabRr+2VebgM=";
+    hash = "sha256-RJqYRCnE4lqR68lP9hL9hTOxXS3cPEgspBn2JgvffyM=";
  };

-  vendorHash = "sha256-qptl09fBZigImxr0ReWIqdmvyeHqr372pZqDnyMHe5A=";
+  vendorHash = "sha256-W7FfqWV86D8fXZ4nm/0IVZuqocgo8/Sd9DA1Ef4SJ/4=";

  # .gitattributes excludes all testdata from the GitHub tarball
  postPatch = ''
--- a/pkgs/by-name/bo/bottom/package.nix
+++ b/pkgs/by-name/bo/bottom/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "bottom";
-  version = "0.14.2";
+  version = "0.14.3";

  src = fetchFromGitHub {
    owner = "ClementTsang";
    repo = "bottom";
    tag = finalAttrs.version;
-    hash = "sha256-0RaMkTmX6figTBjAxoH57330pHpVJJP8br33FxezqB0=";
+    hash = "sha256-DJ1Vw1YG4CXhXUwFh2pGyH6lqLw1oHG18AEXlC4xvZk=";
  };

-  cargoHash = "sha256-wCcc0t8MA0koeGdqVcz4uYKChU7gtHTQ8yqZGNigSxA=";
+  cargoHash = "sha256-SUR1O5Sm3CFxjkxkPWih7gnvf7L04D+x5SUFXvA/KgQ=";

  nativeBuildInputs = [
    autoAddDriverRunpath
--- a/pkgs/by-name/br/brutespray/package.nix
+++ b/pkgs/by-name/br/brutespray/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "brutespray";
-  version = "2.6.1";
+  version = "2.6.2";

  src = fetchFromGitHub {
    owner = "x90skysn3k";
    repo = "brutespray";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3CDvsYCiVuWr+Hp2NSzecmHl69Xf9Mcl1umqKW09OlQ=";
+    hash = "sha256-ckw5U0TAF8NI3B8jyk7iPJ8T+9YEwFxoa9dJqb7kygI=";
  };

-  vendorHash = "sha256-odRe6Jd0MIOyahoMfZJgSbv+AHeUUvWLeENaQFmT9R4=";
+  vendorHash = "sha256-bzyvh7Ty9kl/fZwxYGH2G60wZvp607/+KflaFiZgs60=";

  nativeBuildInputs = [ makeBinaryWrapper ];

--- a/pkgs/by-name/ca/calceph/package.nix
+++ b/pkgs/by-name/ca/calceph/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "calceph";
-  version = "4.0.5";
+  version = "5.0.0";
  src = fetchFromGitLab {
    domain = "gitlab.obspm.fr";
    owner = "imcce_calceph";
    repo = "calceph";
    tag = "calceph_${builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-V4Hh3FItBv3zYerNqNPeRJ5Afj3QTfdG3Ps5xeiDASg=";
+    hash = "sha256-bSgHRVPo0M8SIlw5uqZ0nyt5cVyg3WmxcHistV1FugY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ca/cargo-audit/package.nix
+++ b/pkgs/by-name/ca/cargo-audit/package.nix
@@ -9,14 +9,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-audit";
-  version = "0.22.1";
+  version = "0.22.2";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-/K84iYr3mRNH8lbqHHa7Tsh7M3ykQ2hs6T1k/qrSsnA=";
+    hash = "sha256-hrkkDRJvXe2fltWjEW2A0/uKVFWq+9O+wRphsJjT1tE=";
  };

-  cargoHash = "sha256-Hr3CliJeb9ljHylx8mjkGyf4ybX79Fmt6CaFb6FMRts=";
+  cargoHash = "sha256-pdFoawDRzJ8gPYAAQHwrCVYeaa1ShSqYA8nwpCAnS1s=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/di/display3d/package.nix
+++ b/pkgs/by-name/di/display3d/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "display3d";
-  version = "0.2.2";
+  version = "0.2.3";

  src = fetchFromGitHub {
    owner = "renpenguin";
    repo = "display3d";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dFfU80/1fhBz9/0fVZigo+nZx6Lj66OsP52oMDpS+BY=";
+    hash = "sha256-f2iT+3xqtFY8e9kmwpEac0/WQLFVL6tXUk/lQgBQzaM=";
  };

-  cargoHash = "sha256-eXpoWKYonNZQqqIFrxO4RnLLX1s1osaZxZt3gVTYd4o=";
+  cargoHash = "sha256-IEaiehlOCQGun/CUIbPlCITAm6L/XV1uyQSmlBPnxGk=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
--- a/pkgs/by-name/do/documenso/package-lock.json.patch
+++ b/pkgs/by-name/do/documenso/package-lock.json.patch
--- a/pkgs/by-name/do/documenso/package.json.patch
+++ b/pkgs/by-name/do/documenso/package.json.patch
@@ -1,40 +1,21 @@
 diff --git a/package.json b/package.json
-index 1ff8701..e337979 100644
+index d0ffcb2..9b47856 100644
 --- a/package.json
 +++ b/package.json
-@@ -44,22 +44,22 @@
-     "@commitlint/cli": "^17.7.1",
-     "@commitlint/config-conventional": "^17.7.0",
-     "@lingui/cli": "^5.2.0",
-+    "@prisma/client": "^6.8.2",
-     "dotenv": "^16.5.0",
-     "dotenv-cli": "^8.0.0",
-     "eslint": "^8.40.0",
-     "eslint-config-custom": "*",
-     "husky": "^9.0.11",
-     "lint-staged": "^15.2.2",
-+    "nodemailer": "^6.10.1",
-     "playwright": "1.52.0",
-     "prettier": "^3.3.3",
-    "rimraf": "^5.0.1",
-    "turbo": "^1.9.3",
-    "vite": "^6.3.5",
-    "@prisma/client": "^6.8.2",
-     "prisma": "^6.8.2",
-     "prisma-extension-kysely": "^3.0.0",
-     "prisma-kysely": "^1.8.0",
-    "nodemailer": "^6.10.1"
-+    "rimraf": "^5.0.1",
-+    "turbo": "^2.5.8",
-+    "vite": "^6.3.5"
-   },
-   "name": "@documenso/root",
-   "workspaces": [
-@@ -71,7 +71,6 @@
-     "@documenso/prisma": "^0.0.0",
-     "@lingui/conf": "^5.2.0",
-     "@lingui/core": "^5.2.0",
-    "inngest-cli": "^0.29.1",
-     "luxon": "^3.5.0",
-     "mupdf": "^1.0.0",
-     "react": "^18",
+@@ -63,7 +63,6 @@
+     "dotenv-cli": "^11.0.0",
+     "husky": "^9.1.7",
+     "inngest": "^3.54.0",
+-    "inngest-cli": "^1.17.9",
+     "lint-staged": "^16.2.7",
+     "nanoid": "^5.1.6",
+     "nodemailer": "^8.0.5",
+@@ -78,7 +77,7 @@
+     "rimraf": "^6.1.2",
+     "superjson": "^2.2.5",
+     "syncpack": "^14.0.0-alpha.27",
+-    "turbo": "^1.13.4",
+    "turbo": "^2.10.1",
+     "vite": "^7.2.4",
+     "vite-plugin-static-copy": "^3.1.4",
+     "zod-openapi": "^4.2.4",
--- a/pkgs/by-name/do/documenso/package.nix
+++ b/pkgs/by-name/do/documenso/package.nix
@@ -1,30 +1,53 @@
 {
  lib,
+  stdenv,
  nodejs,
  node-gyp,
  node-pre-gyp,
  pixman,
  fetchFromGitHub,
+  fetchurl,
  buildNpmPackage,
  prisma_6,
  prisma-engines_6,
  vips,
  pkg-config,
+  gzip,
+  autoPatchelfHook,
  cairo,
  pango,
  bash,
  openssl,
 }:

+let
+  skiaCanvasVersion = "3.0.8";
+  skiaCanvasTriplet =
+    {
+      x86_64-linux = "linux-x64-glibc";
+      aarch64-linux = "linux-arm64-glibc";
+    }
+    .${stdenv.hostPlatform.system}
+      or (throw "unsupported skia-canvas platform ${stdenv.hostPlatform.system}");
+  skiaCanvasPrebuild = fetchurl {
+    url = "https://github.com/samizdatco/skia-canvas/releases/download/v${skiaCanvasVersion}/${skiaCanvasTriplet}.gz";
+    hash =
+      {
+        x86_64-linux = "sha256-9FklKQWZ1LfLUhHBI/re4nvImddVZpbi4zPQ76xpN7I=";
+        aarch64-linux = "sha256-BmXQemDAXZEqL9FFmus3cU6wRFwveEhAdjhUbD0uGnA=";
+      }
+      .${stdenv.hostPlatform.system};
+  };
+in
 buildNpmPackage (finalAttrs: {
  pname = "documenso";
-  version = "1.12.6";
+  version = "2.14.0";

  src = fetchFromGitHub {
    owner = "documenso";
    repo = "documenso";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-1TKjsOKJkv3COFgsE4tPAymI0MdeT+T8HiNgnoWHlAY=";
+    hash = "sha256-ZVcbOKBqjDnCo2pZKjaAuO3MK7r/S6k4kEHwBteHVGg=";
  };

  patches = [
@@ -33,9 +56,12 @@ buildNpmPackage (finalAttrs: {
    ./turbo.json.patch
  ];

-  npmDepsHash = "sha256-ZddRSBDasa3mMAS2dqXgXRMOc1nvspdXsuTZ7c+einw=";
+  npmDepsHash = "sha256-/Jt1ct/GSumu/pgTrmnVHdMhhg8J2Epvu7wnnCakqGs=";
+  npmDepsFetcherVersion = 2;

  nativeBuildInputs = [
+    autoPatchelfHook
+    gzip
    pkg-config
    vips
    node-gyp
@@ -47,9 +73,12 @@ buildNpmPackage (finalAttrs: {
    pixman
    cairo
    pango
+    stdenv.cc.cc.lib
    vips
  ];

+  npmRebuildFlags = [ "--ignore-scripts" ];
+
  env = {
    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD = "1";
    PRISMA_QUERY_ENGINE_LIBRARY = "${lib.getLib prisma-engines_6}/lib/libquery_engine.node";
@@ -60,6 +89,13 @@ buildNpmPackage (finalAttrs: {
    TURBO_REMOTE_CACHE_ENABLED = "false";
  };

+  preBuild = ''
+    mkdir -p node_modules/skia-canvas/lib
+    gzip -dc ${skiaCanvasPrebuild} > node_modules/skia-canvas/lib/skia.node
+
+    npm exec patch-package
+  '';
+
  buildPhase = ''
    runHook preBuild

@@ -81,7 +117,7 @@ buildNpmPackage (finalAttrs: {
    export PKG_CONFIG_PATH=${lib.getLib openssl.dev}/lib/pkgconfig;
    export PRISMA_QUERY_ENGINE_LIBRARY=${lib.getLib prisma-engines_6}/lib/libquery_engine.node
    export PRISMA_QUERY_ENGINE_BINARY=${lib.getExe' prisma-engines_6 "query-engine"}
-    export PRISMA_SCHEMA_ENGINE_BINARY=${prisma-engines_6}
+    export PRISMA_SCHEMA_ENGINE_BINARY=${lib.getExe' prisma-engines_6 "schema-engine"}
    cd $out/apps/remix
    ${lib.getExe prisma_6} migrate deploy --schema ../../packages/prisma/schema.prisma
    ${lib.getExe nodejs} build/server/main.js
@@ -91,6 +127,14 @@ buildNpmPackage (finalAttrs: {
          runHook postInstall
  '';

+  postInstall = ''
+    # These optional prebuilds are for musl libc and can make autoPatchelf link
+    # glibc addons against incompatible vendored libraries.
+    rm -rf $out/node_modules/*musl* $out/node_modules/@*/*musl*
+    rm -rf $out/node_modules/@datadog/pprof/prebuilds/linuxmusl-*
+    rm -rf $out/node_modules/aws-crt/dist/bin/linux-*-musl
+  '';
+
  # cleanup dangling symlinks for workspaces
  preFixup = ''
    rm -Rf $out/lib/node_modules/@documenso/root/node_modules/@documenso/assets
@@ -118,7 +162,10 @@ buildNpmPackage (finalAttrs: {
    homepage = "https://github.com/documenso/documenso";
    license = lib.licenses.agpl3Only;
    maintainers = with lib.maintainers; [ happysalada ];
-    platforms = lib.platforms.unix;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
    mainProgram = "documenso";
  };
 })
--- a/pkgs/by-name/do/documenso/turbo.json.patch
+++ b/pkgs/by-name/do/documenso/turbo.json.patch
@@ -1,104 +1,20 @@
 diff --git a/turbo.json b/turbo.json
-index d767b46..b2d1ad3 100644
+index c5c0db0..8c79030 100644
 --- a/turbo.json
 +++ b/turbo.json
-@@ -1,41 +1,8 @@
+@@ -1,6 +1,6 @@
 {
   "$schema": "https://turbo.build/schema.json",
 -  "pipeline": {
-    "build": {
-      "dependsOn": ["prebuild", "^build"],
-      "outputs": [".next/**", "!.next/cache/**"]
-    },
-    "prebuild": {
-      "cache": false,
-      "dependsOn": ["^prebuild"]
-    },
-    "lint": {
-      "cache": false
-    },
-    "lint:fix": {
-      "cache": false
-    },
-    "clean": {
-      "cache": false
-    },
-    "dev": {
-      "cache": false,
-      "persistent": true
-    },
-    "start": {
-      "dependsOn": ["^build"],
-      "cache": false,
-      "persistent": true
-    },
-    "dev:test": {
-      "cache": false
-    },
-    "test:e2e": {
-      "dependsOn": ["^build"],
-      "cache": false
-    }
-  },
-  "globalDependencies": ["**/.env.*local"],
-+  "globalDependencies": [
-+    "**/.env.*local"
-+  ],
-   "globalEnv": [
-     "APP_VERSION",
-     "NEXT_PRIVATE_ENCRYPTION_KEY",
-@@ -119,5 +86,53 @@
-     "E2E_TEST_AUTHENTICATE_USERNAME",
-     "E2E_TEST_AUTHENTICATE_USER_EMAIL",
-     "E2E_TEST_AUTHENTICATE_USER_PASSWORD"
+  "tasks": {
+     "build": {
+       "dependsOn": ["prebuild", "^build"],
+       "outputs": [".next/**", "!.next/cache/**"]
+@@ -152,5 +152,6 @@
+     "NEXT_PRIVATE_WEBHOOK_SSRF_BYPASS_HOSTS",
+     "NEXT_PUBLIC_TURNSTILE_SITE_KEY",
+     "NEXT_PRIVATE_TURNSTILE_SECRET_KEY"
 -  ]
 +  ],
-+  "tasks": {
-+    "build": {
-+      "dependsOn": [
-+        "prebuild",
-+        "^build"
-+      ],
-+      "outputs": [
-+        ".next/**",
-+        "!.next/cache/**"
-+      ]
-+    },
-+    "prebuild": {
-+      "cache": false,
-+      "dependsOn": [
-+        "^prebuild"
-+      ]
-+    },
-+    "lint": {
-+      "cache": false
-+    },
-+    "lint:fix": {
-+      "cache": false
-+    },
-+    "clean": {
-+      "cache": false
-+    },
-+    "dev": {
-+      "cache": false,
-+      "persistent": true
-+    },
-+    "start": {
-+      "dependsOn": [
-+        "^build"
-+      ],
-+      "cache": false,
-+      "persistent": true
-+    },
-+    "dev:test": {
-+      "cache": false
-+    },
-+    "test:e2e": {
-+      "dependsOn": [
-+        "^build"
-+      ],
-+      "cache": false
-+    }
-+  },
 +  "envMode": "loose"
 }
--- a/pkgs/by-name/do/documenso/update-from-upstream.sh
+++ b/pkgs/by-name/do/documenso/update-from-upstream.sh
@@ -1,55 +1,116 @@
 #!/usr/bin/env bash
-CMDS=();DESC=();NARGS=$#;ARG1=$1;make_command(){ CMDS+=($1);DESC+=("$2");};usage(){ printf "\nUsage: %s [command]\n\nCommands:\n" $0;line="              ";for((i=0;i<=$(( ${#CMDS[*]} -1));i++));do printf "  %s %s ${DESC[$i]}\n" ${CMDS[$i]} "${line:${#CMDS[$i]}}";done;echo;};runme(){ if test $NARGS -eq 1;then eval "$ARG1"||usage;else usage;fi;}
+set -euo pipefail

-version="1.12.6";
+version="2.14.0"

-make_command "about" "About this update script."
-about(){
-  echo "Documenso upstream needs some fixing before it can be build in a pure sandbox"
-  echo "environment. This script does the following:"
+usage() {
+  printf "Usage: %s {about|update} [version]\n" "$0"
+}
+
+about() {
+  echo "Documenso upstream needs some fixing before it can be built in a pure sandbox"
+  echo "environment. This script regenerates the JSON patches for a version bump:"
  echo "  - download documenso version ${version} from github in a temp dir"
-  echo "  - uninstall inngest-cli which runs a binary download script at build time."
-  echo "  - upgrade turborepo as the older upstream version 'phones home' at build time."
-  echo "  - update the turbo.json to make it work with preset environment vars"
-  echo "  - fix the lockfile by generating missing hash signatures"
+  echo "  - remove inngest-cli which runs a binary download script at build time"
+  echo "  - upgrade turborepo because the older upstream version phones home at build time"
+  echo "  - update turbo.json for the newer turborepo config"
+  echo "  - fix package-lock.json metadata needed by npmDepsFetcherVersion = 2"
  echo "  - create patches from changed json files"
 }

-make_command "update" "Get upstream and prepatch."
-update(){
+patch_sources() {
+  node <<'NODE'
+const fs = require('fs');
+
+const packageJsonPath = 'package.json';
+const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+delete packageJson.devDependencies['inngest-cli'];
+packageJson.devDependencies.turbo = '^2.10.1';
+fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`);
+
+const turboJsonPath = 'turbo.json';
+let turboJson = fs.readFileSync(turboJsonPath, 'utf8');
+turboJson = turboJson.replace('  "pipeline": {', '  "tasks": {');
+if (!turboJson.includes('  "envMode": "loose"')) {
+  turboJson = turboJson.replace('\n  ]\n}\n', '\n  ],\n  "envMode": "loose"\n}\n');
+}
+fs.writeFileSync(turboJsonPath, turboJson);
+NODE
+}
+
+fix_playwright_lockfile_metadata() {
+  local package_key="packages/app-tests/node_modules/@playwright/test"
+  local playwright_version resolved integrity
+
+  playwright_version=$(jq -r --arg key "$package_key" '.packages[$key].version // empty' package-lock.json)
+  if [[ -z "$playwright_version" ]]; then
+    return
+  fi
+
+  resolved=$(npm view "@playwright/test@${playwright_version}" dist.tarball)
+  integrity=$(npm view "@playwright/test@${playwright_version}" dist.integrity)
+
+  node - "$package_key" "$resolved" "$integrity" <<'NODE'
+const fs = require('fs');
+
+const [packageKey, resolved, integrity] = process.argv.slice(2);
+const path = 'package-lock.json';
+const lockfile = JSON.parse(fs.readFileSync(path, 'utf8'));
+const packageEntry = lockfile.packages[packageKey];
+const updated = {};
+for (const [key, value] of Object.entries(packageEntry)) {
+  updated[key] = value;
+  if (key === 'version') {
+    updated.resolved = resolved;
+    updated.integrity = integrity;
+  }
+}
+lockfile.packages[packageKey] = updated;
+fs.writeFileSync(path, `${JSON.stringify(lockfile, null, 2)}\n`);
+NODE
+}
+
+update() {
+  local update_version=${1:-$version}
+  local current_nixpkgs_dir temptarfile tempdir

  echo "updating documenso for nixpkgs packaging"
  current_nixpkgs_dir=${PWD}
-  temptarfile=/tmp/documenso-v${version}.tar.gz
-  tempdir=/tmp/documenso-v${version}
+  temptarfile="/tmp/documenso-v${update_version}.tar.gz"
+  tempdir="/tmp/documenso-v${update_version}"

-  if [ ! -f "$temptarfile" ]; then
-    echo "Tarball does not exist; downloading from github.";
-    wget https://github.com/documenso/documenso/archive/refs/tags/v${version}.tar.gz -O $temptarfile
+  if [[ ! -f "$temptarfile" ]]; then
+    echo "Tarball does not exist; downloading from github."
+    wget "https://github.com/documenso/documenso/archive/refs/tags/v${update_version}.tar.gz" -O "$temptarfile"
  fi

-  rm -Rf $tempdir
-  mkdir $tempdir
-  tar -xzvf /tmp/documenso-v${version}.tar.gz -C $tempdir --strip-components=1
-  cd $tempdir
+  rm -Rf "$tempdir"
+  mkdir "$tempdir"
+  tar -xzf "$temptarfile" -C "$tempdir" --strip-components=1
+  cd "$tempdir"
  git init
  git add package-lock.json package.json turbo.json
  git commit -m "commit4diff" package-lock.json package.json turbo.json

-  echo "rm inngest-cli from root"
-  npm uninstall inngest-cli
+  patch_sources
+  npm install --package-lock-only --ignore-scripts --no-audit --no-fund
+  fix_playwright_lockfile_metadata

-  npx @turbo/codemod migrate . --force
-
-  jq '.envMode="loose"' turbo.json > turbo-patched.json
-  cp turbo-patched.json turbo.json
-
-  echo "fix package-lock.json hashes"
-  nix run nixpkgs#npm-lockfile-fix -- package-lock.json
-
-  git diff package-lock.json > $current_nixpkgs_dir/package-lock.json.patch
-  git diff package.json > $current_nixpkgs_dir/package.json.patch
-  git diff turbo.json > $current_nixpkgs_dir/turbo.json.patch
+  git diff --src-prefix=a/ --dst-prefix=b/ -- package-lock.json > "$current_nixpkgs_dir/package-lock.json.patch"
+  git diff --src-prefix=a/ --dst-prefix=b/ -- package.json > "$current_nixpkgs_dir/package.json.patch"
+  git diff --src-prefix=a/ --dst-prefix=b/ -- turbo.json > "$current_nixpkgs_dir/turbo.json.patch"
 }

-runme
+case "${1:-}" in
+  about)
+    about
+    ;;
+  update)
+    shift
+    update "${1:-}"
+    ;;
+  *)
+    usage
+    exit 1
+    ;;
+esac
--- a/pkgs/by-name/fi/firefox-devtools-mcp/package.nix
+++ b/pkgs/by-name/fi/firefox-devtools-mcp/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  makeWrapper,
+  geckodriver,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "firefox-devtools-mcp";
+  version = "0.9.9";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "mozilla";
+    repo = "firefox-devtools-mcp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Bz6LkiUbgu81OnPv6xegmo7EYVgGJdlbB5HZsW4QO/Q=";
+  };
+
+  npmDepsHash = "sha256-JnAivSiThEm+EPm6gY08zQfD/aaF2sLfz6YSfsle9uE=";
+
+  # 0.9.9 ships a stale hardcoded server version (0.7.1) in constants.ts; upstream switched to
+  # build-time injection right after release (Bug 2050918), so this substitution should be dropped
+  # once that fix lands in a tagged release.
+  postPatch = ''
+    substituteInPlace src/config/constants.ts \
+      --replace-fail "'0.7.1'" "'${finalAttrs.version}'"
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  # The `geckodriver` npm dependency's install script downloads a prebuilt binary from the network,
+  # which is unavailable in the sandbox. The server locates geckodriver on PATH first (see
+  # src/firefox/core.ts), so skip the install scripts and provide geckodriver from nixpkgs via the
+  # wrapper below.
+  npmFlags = [ "--ignore-scripts" ];
+
+  # `npm run build` (tsup) emits dist/index.js, the package's bin entry point.
+  postInstall = ''
+    wrapProgram $out/bin/firefox-devtools-mcp \
+      --prefix PATH : ${lib.makeBinPath [ geckodriver ]}
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Model Context Protocol server for Firefox DevTools automation";
+    longDescription = ''
+      A Model Context Protocol (MCP) server that automates Firefox via WebDriver BiDi.
+      It works with MCP clients such as Claude Code, Claude Desktop, Cursor and Cline,
+      exposing tools to navigate pages, take snapshots, inspect the DOM, capture network requests
+      and console messages, take screenshots and more.
+
+      A local Firefox installation is required at runtime.
+    '';
+    homepage = "https://github.com/mozilla/firefox-devtools-mcp";
+    changelog = "https://github.com/mozilla/firefox-devtools-mcp/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ philiptaron ];
+    mainProgram = "firefox-devtools-mcp";
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/fl/flannel/package.nix
+++ b/pkgs/by-name/fl/flannel/package.nix
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "flannel";
-  version = "0.28.5";
+  version = "0.28.6";
  rev = "v${version}";

-  vendorHash = "sha256-TsMIH1L2LD+LxoAMwtvOa36sakiyxoJ2Av0oW5+dEJQ=";
+  vendorHash = "sha256-io2xUh5jM2x7P01MIpPgLAVXC/CAL22zrC6kfi4uYFs=";

  src = fetchFromGitHub {
    inherit rev;
    owner = "flannel-io";
    repo = "flannel";
-    sha256 = "sha256-cG6w2fErJ6lnEfnHXEVwk6dk056bSamPUWquRu1R0QU=";
+    sha256 = "sha256-djPi4dgG9iR7K5c9NhMVJI1xdBmCX39+G/zt6dDRZx8=";
  };

  ldflags = [ "-X github.com/flannel-io/flannel/pkg/version.Version=${rev}" ];
--- a/pkgs/by-name/ge/gearboy/package.nix
+++ b/pkgs/by-name/ge/gearboy/package.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gearboy";
-  version = "3.8.8";
+  version = "3.8.9";

  src = fetchFromGitHub {
    owner = "drhelius";
    repo = "Gearboy";
    tag = finalAttrs.version;
-    hash = "sha256-ZGhkcB7/WAvNaJ+tBNtka4lPHScnRI0hm9X1bUhpfRM=";
+    hash = "sha256-p6gIGWkcv4jJacF4baK8Uej2kwwPnd/ylvgmUHHPXnI=";
  };

  __structuredAttrs = true;
--- a/pkgs/by-name/gi/git-toolbelt/package.nix
+++ b/pkgs/by-name/gi/git-toolbelt/package.nix
@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "git-toolbelt";
-  version = "1.10.0";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "nvie";
    repo = "git-toolbelt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2jpgwB2DEoRtV+WGe81X1rnC7T4+FmJovOFx+4lifQw=";
+    hash = "sha256-5ywYbZeMqHU7/nnnINeR0BfVBxxgYmeXvjIuC45V43g=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/gi/gitwatch/package.nix
+++ b/pkgs/by-name/gi/gitwatch/package.nix
@@ -14,12 +14,12 @@
 runCommand "gitwatch"
  rec {
    pname = "gitwatch";
-    version = "0.5";
+    version = "0.6";
    src = fetchFromGitHub {
      owner = "gitwatch";
      repo = "gitwatch";
      rev = "v${version}";
-      hash = "sha256-zOJPCoXco59ufQeGH2DPGbCbKx6rSC/3iNZWoEeoQKk=";
+      hash = "sha256-O8Qk2fGBAT7NGJYd+PIGOaiDQAnexsDm1y+KFHabQEM=";
    };
    nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/gr/gruvbox-plus-icons/package.nix
+++ b/pkgs/by-name/gr/gruvbox-plus-icons/package.nix
@@ -11,13 +11,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "gruvbox-plus-icons";
-  version = "6.4.0";
+  version = "6.5.0";

  src = fetchFromGitHub {
    owner = "SylEleuth";
    repo = "gruvbox-plus-icon-pack";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-t4bQeK9jwaE3nRZEhks9QARKkxKdH9ZTSgPIby323Jc=";
+    hash = "sha256-EG8AmnLqqml7oGeeNqLLpnmMj6/KVAJOKuTjCUoor4s=";
  };

  patches = [ ./folder-color.patch ];
--- a/pkgs/by-name/ic/icoextract/package.nix
+++ b/pkgs/by-name/ic/icoextract/package.nix
@@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "icoextract";
-  version = "0.2.0";
+  version = "0.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jlu5";
    repo = "icoextract";
    rev = finalAttrs.version;
-    hash = "sha256-GJCe7oFUidJt21F4NmOXspxZGRQXIjQvFjFhMYsHLjk=";
+    hash = "sha256-uesnYwv1ig7cnakWpH7MKeN6cfjasxVYLHs1JYG0Tss=";
  };

  build-system = with python3Packages; [ setuptools ];
--- a/pkgs/by-name/in/inngest/package.nix
+++ b/pkgs/by-name/in/inngest/package.nix
@@ -99,7 +99,10 @@ buildGoModule (finalAttrs: {
    changelog = "https://github.com/inngest/inngest/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.sspl;
    sourceProvenance = with lib.sourceTypes; [ fromSource ];
-    maintainers = with lib.maintainers; [ kikos0 ];
+    maintainers = with lib.maintainers; [
+      albertchae
+      kikos0
+    ];
    mainProgram = "inngest";
    platforms = lib.lists.remove "x86_64-darwin" lib.platforms.all;
  };
--- a/pkgs/by-name/ka/karmor/package.nix
+++ b/pkgs/by-name/ka/karmor/package.nix
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "karmor";
-  version = "1.4.6";
+  version = "1.4.7";

  src = fetchFromGitHub {
    owner = "kubearmor";
    repo = "kubearmor-client";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-xOI6meI88GB5w19T9eSn+8dTnhrUxUCKHUBk/1EaDVI=";
+    hash = "sha256-hohzVj2mlch6rSdjsCl+VcTnX9zvYnRrRM97LwbNeNw=";
  };

-  vendorHash = "sha256-FL5WL44dsM0uPYXMNfYKRd37umId21rMGvj84rYTU3A=";
+  vendorHash = "sha256-DrrLromAT0xSr3SUqWTM78oGXTy73VCD2DJlMwSEGEs=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/ku/kubedock/package.nix
+++ b/pkgs/by-name/ku/kubedock/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "kubedock";
-  version = "0.21.1";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "joyrex2001";
    repo = "kubedock";
    rev = finalAttrs.version;
-    hash = "sha256-mxOvk2o2Ke8AEA9SyuyqHr+G9A2qpzlE9rqKG7INr4w=";
+    hash = "sha256-BaQT1UWHejcVkvQs88hKZdfyouUcGaghAlI2u/2kv9s=";
  };

-  vendorHash = "sha256-SROlRbpokMsnTscxF71upxmjhZPqTbkk50n0Htwh1lc=";
+  vendorHash = "sha256-2kr0nYKCRjHJkyp8/fdxssoDY6jJ03Bnc21Dw34GvB8=";

  # config.Build not defined as it would break r-ryantm
  ldflags = [
--- a/pkgs/by-name/la/lact/package.nix
+++ b/pkgs/by-name/la/lact/package.nix
@@ -10,6 +10,7 @@
  gdk-pixbuf,
  gtk4,
  libadwaita,
+  libdisplay-info,
  libdrm,
  ocl-icd,
  vulkan-loader,
@@ -25,16 +26,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lact";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "ilya-zlobintsev";
    repo = "LACT";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-c5GJf8AYgaAN3O6AVSEbJybEYb6lSHf7R24/1PKYhyM=";
+    hash = "sha256-/b5Cfexi/RtE3DkON5J3dc4aEX6aLZvIcAhsg6Kdv7M=";
  };

-  cargoHash = "sha256-Y+XdCmaDXdP7x22bYm//Ov7+IzlCr8GpFOgCXGFCfbA=";
+  cargoHash = "sha256-XV37VRbCaxySMgEqXmIA0TUpI9uR+6jGOzdMlEfWxDw=";

  nativeBuildInputs = [
    pkg-config
@@ -47,6 +48,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    gdk-pixbuf
    gtk4
    libadwaita
+    libdisplay-info
    libdrm
    ocl-icd
    vulkan-loader
@@ -55,6 +57,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
    fuse3
  ];

+  checkFlags = [
+    # Requires /dev/fuse, which is unavailable in the Nix build sandbox.
+    "--skip=tests::apply_settings"
+  ];
+
  # we do this here so that the binary is usable during integration tests
  env.RUSTFLAGS = lib.optionalString stdenv.targetPlatform.isElf (
    lib.concatStringsSep " " [
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -22,16 +22,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mise";
-  version = "2026.7.0";
+  version = "2026.7.1";

  src = fetchFromGitHub {
    owner = "jdx";
    repo = "mise";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-F/hxgkqLk36906uhr56W+4Evwc8WLbYWw8pibGsq3EY=";
+    hash = "sha256-t3IS7oTYa9wS8GhRewYC1fbSnhWu+1/EFLOq6CaRUgE=";
  };

-  cargoHash = "sha256-W88dlxvDEwN6C1j1WMtL/KodWQZ9UnI1VJc3xp1Lnqw=";
+  cargoHash = "sha256-ypEzqK+DkcSm5gxn/STkGcprFansQOARuHITg03PEFk=";

  nativeBuildInputs = [
    installShellFiles
@@ -75,9 +75,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
  checkFlags = [
    # last_modified will always be different in nix
    "--skip=tera::tests::test_last_modified"
-    # Nix's build sandbox strips setuid bits, so this round-trip assertion
-    # fails on both Linux and Darwin (cf. apko's TestSpecialModeBits).
-    "--skip=oci::layer::tests::preserve_metadata_dir_layer_keeps_special_permission_bits"
  ]
  ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
    # x86_64-darwin started failing mid-April 2025; aarch64 in Feb 2026
--- a/pkgs/by-name/mi/mistral-rs/no-native-cpu.patch
+++ b/pkgs/by-name/mi/mistral-rs/no-native-cpu.patch
@@ -1,20 +1,10 @@
 diff --git a/.cargo/config.toml b/.cargo/config.toml
-index 0ab50ad46..3f5fe0788 100644
+index d3e3031e1..96b624fb3 100644
 --- a/.cargo/config.toml
 +++ b/.cargo/config.toml
-@@ -1,15 +1,10 @@
+@@ -1,5 +1,2 @@
 -[build]
 -rustflags = ["-C", "target-cpu=native"]
 -
- [target.aarch64-apple-darwin]
- rustflags = [
-  "-C", "target-cpu=native",
-   "-C", "target-feature=+aes,+sha2,+fp16,+i8mm",
- ]
- 
- [target.x86_64-apple-darwin]
- rustflags = [
-  "-C", "target-cpu=native",
-   "-C", "target-feature=-avx,-avx2",
- ]
- 
+ [target.wasm32-unknown-unknown]
+ rustflags = ["-C", "target-feature=+simd128"]
--- a/pkgs/by-name/mi/mistral-rs/package.nix
+++ b/pkgs/by-name/mi/mistral-rs/package.nix
@@ -73,14 +73,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mistral-rs";
-  version = "0.8.4";
+  version = "0.9.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "EricLBuehler";
    repo = "mistral.rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BSP8fi4grbEzGOfR4tGCJVjIom/1d2mnFrK8O6BRWL4=";
+    hash = "sha256-3p/e7UZ8BLwT+dpb61NmzX2Z1QxxEgkgjlNzv5lWybM=";
  };

  patches = [
@@ -100,16 +100,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
    + lib.optionalString cudaSupport ''
      substituteInPlace mistralrs-flash-attn/build.rs \
        --replace-fail \
-          ".with_cutlass(Some(CUTLASS_COMMIT))" \
+          ".with_cutlass(Some(&cutlass_commit))" \
          ""

      substituteInPlace mistralrs-quant/build.rs \
        --replace-fail \
-          'builder = builder.with_cutlass(Some("7d49e6c7e2f8896c47f586706e67e1fb215529dc"));' \
+          "builder = builder.with_cutlass(Some(&cutlass_commit));" \
          ""
    '';

-  cargoHash = "sha256-T4TPm31fihx9ZvQ6jme67yrc0osl4c9CiAm4+rISgFs=";
+  cargoHash = "sha256-TULJ3mEAWp1ktPDPeBbUJGHhsEuo5T2qh3/JpS+8+ds=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ne/nerva/package.nix
+++ b/pkgs/by-name/ne/nerva/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "nerva";
-  version = "1.37.0";
+  version = "1.37.1";

  src = fetchFromGitHub {
    owner = "praetorian-inc";
    repo = "nerva";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8naI5r/nmzQKHfub0Yv3uhx1MAh4VCSnsTY/n4BOX5U=";
+    hash = "sha256-gBPZSrXAm7DPxeO//To97sNyovCEJdYoaa4viCvLPME=";
  };

  vendorHash = "sha256-Z0MSD+1/1VzrJ+pz5x0JvxrCxtJe59ckaTqHK/+TVN8=";
--- a/pkgs/by-name/ne/netscanner/package.nix
+++ b/pkgs/by-name/ne/netscanner/package.nix
@@ -8,7 +8,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "netscanner";
-  version = "0.6.41";
+  version = "0.6.43";

  nativeBuildInputs = [ makeWrapper ];

@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "Chleba";
    repo = "netscanner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8Srsts0FDLMT01YW5Guv3r8yx5i5ua7bhAFbQ5BMN74=";
+    hash = "sha256-LLzv8+wAlZgXrj1Ldc+uGDfhvDYDtRU25R7UbmGb+ok=";
  };

-  cargoHash = "sha256-vlV5SibQlJ/yhJJKweqg6KYinpgZmWUUnyzAS6LBBKw=";
+  cargoHash = "sha256-47bvcj+0ZRcHjyt0cpZ0PT+NRvYdvBQcTTf9tZHci2Q=";

  postFixup = ''
    wrapProgram $out/bin/netscanner \
--- a/pkgs/by-name/ni/nixfmt/generated-package.nix
+++ b/pkgs/by-name/ni/nixfmt/generated-package.nix
@@ -24,10 +24,10 @@
 }:
 mkDerivation {
  pname = "nixfmt";
-  version = "1.3.1";
+  version = "1.4.0";
  src = fetchzip {
-    url = "https://github.com/nixos/nixfmt/archive/v1.3.1.tar.gz";
-    sha256 = "1c0iz6hrzafld8vkldcmall7fvby6xgzzqgap8c3bxwhaxhq86hm";
+    url = "https://github.com/nixos/nixfmt/archive/v1.4.0.tar.gz";
+    sha256 = "123mc70ly0glvm8nm4a52fz4xa1619gf1g5k2m45cazb1d6di6z7";
  };
  isLibrary = true;
  isExecutable = true;
--- a/pkgs/by-name/nu/nu_scripts/package.nix
+++ b/pkgs/by-name/nu/nu_scripts/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "nu_scripts";
-  version = "0-unstable-2026-06-03";
+  version = "0-unstable-2026-07-02";

  src = fetchFromGitHub {
    owner = "nushell";
    repo = "nu_scripts";
-    rev = "ca79ff62bd3fe0d31cd50762dcb1c8a46883044e";
-    hash = "sha256-pk29HELNbBfQZDoXeLotUUZlRbQx7k168Rcw1JUOnvU=";
+    rev = "4af42d7f10993ee488ae37762a0e7034b9a004f6";
+    hash = "sha256-Q+RxZ7j1odpxbZXdex2gfJ7uUqmIpNk1W/Cq39K1g0s=";
  };

  installPhase = ''
--- a/pkgs/by-name/nv/nvimpager/package.nix
+++ b/pkgs/by-name/nv/nvimpager/package.nix
@@ -4,7 +4,7 @@
  stdenv,
  bash,
  ncurses,
-  neovim,
+  neovim-unwrapped,
  procps,
  scdoc,
  lua51Packages,
@@ -36,14 +36,14 @@ stdenv.mkDerivation (finalAttrs: {
  ];
  preBuild = ''
    patchShebangs nvimpager
-    substituteInPlace nvimpager --replace-fail ':-nvim' ':-${lib.getExe neovim}'
+    substituteInPlace nvimpager --replace-fail ':-nvim' ':-${lib.getExe neovim-unwrapped}'
  '';

  doCheck = true;
  nativeCheckInputs = [
    lua51Packages.busted
    ncurses # for tput
-    neovim
+    neovim-unwrapped
    procps # for nvim_get_proc() which uses ps(1)
    util-linux
  ];
--- a/pkgs/by-name/op/openrct2/package.nix
+++ b/pkgs/by-name/op/openrct2/package.nix
@@ -40,14 +40,14 @@
 }:

 let
-  objects-version = "1.7.9";
+  objects-version = "1.7.10";
  openmusic-version = "1.6.1";
  opensfx-version = "1.0.6";
  title-sequences-version = "0.4.26";

  objects = fetchurl {
    url = "https://github.com/OpenRCT2/objects/releases/download/v${objects-version}/objects.zip";
-    hash = "sha256-VUYe0gxugvFOmiec2ERlSwJkmZu5QDTVj6kS/e4m6tY=";
+    hash = "sha256-9IO+Jm3CIHe6hRe78y/+OIw1Q7LuWF4K+9QQLbRSgCE=";
  };
  openmusic = fetchurl {
    url = "https://github.com/OpenRCT2/OpenMusic/releases/download/v${openmusic-version}/openmusic.zip";
@@ -64,13 +64,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "openrct2";
-  version = "0.5.2";
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "OpenRCT2";
    repo = "OpenRCT2";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sKfNE57ZpTsHJk0uKG0YUQYg63xnOiAEwkgRaG4zgmo=";
+    hash = "sha256-my7fPBD5N0bO1yPaxwHUFqw6TvayQs10kcAX/NqPpIg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pi/picosnitch/package.nix
+++ b/pkgs/by-name/pi/picosnitch/package.nix
@@ -11,12 +11,12 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "picosnitch";
-  version = "2.1.1";
+  version = "2.1.2";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1d13fc48280f6a355bcb155d193f93817c1225475ee9670846a56cbd39e2014d";
+    sha256 = "sha256-JTvuZOPgSjdD5jJYLmsqzy8ATzuhtoAu+uGvOVsChks=";
  };

  build-system = with python3.pkgs; [ hatchling ];
--- a/pkgs/by-name/pr/prometheus-kea-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-kea-exporter/package.nix
@@ -1,19 +1,21 @@
 {
  lib,
  python3Packages,
-  fetchPypi,
+  fetchFromGitHub,
  nixosTests,
+  versionCheckHook,
 }:

-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "kea-exporter";
-  version = "0.7.0";
+  version = "0.7.1";
  pyproject = true;

-  src = fetchPypi {
-    pname = "kea_exporter";
-    inherit version;
-    hash = "sha256-kn2iwYWcyW90tgfWmzLF7rU06fJyLRzqYKNLOgu/Yqk=";
+  src = fetchFromGitHub {
+    owner = "mweinelt";
+    repo = "kea-exporter";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UwQYR01cBdPEUBhOo5TqwmptAvJpxln1OLU2boAFdn4=";
  };

  nativeBuildInputs = with python3Packages; [
@@ -26,21 +28,17 @@ python3Packages.buildPythonApplication rec {
    requests
  ];

-  checkPhase = ''
-    $out/bin/kea-exporter --help > /dev/null
-    $out/bin/kea-exporter --version | grep -q ${version}
-  '';
-
+  nativeInstallCheckInputs = [ versionCheckHook ];
  passthru.tests = {
    inherit (nixosTests) kea;
  };

  meta = {
-    changelog = "https://github.com/mweinelt/kea-exporter/blob/v${version}/HISTORY";
+    changelog = "https://github.com/mweinelt/kea-exporter/blob/v${finalAttrs.version}/HISTORY";
    description = "Export Kea Metrics in the Prometheus Exposition Format";
    mainProgram = "kea-exporter";
    homepage = "https://github.com/mweinelt/kea-exporter";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ hexa ];
  };
-}
+})
--- a/pkgs/by-name/pr/prusa-slicer/catch2_3_15.patch
+++ b/pkgs/by-name/pr/prusa-slicer/catch2_3_15.patch
@@ -0,0 +1,32 @@
+From 8abf7e1b707adf145d7434dbf53ad14c9c7cccd3 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@cryptomilk.org>
+Date: Fri, 12 Jun 2026 18:20:39 +0200
+Subject: [PATCH] Fix build with Catch2 v3: include
+ catch_interfaces_capture.hpp
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Catch::getResultCapture() requires an explicit include of
+<catch2/interfaces/catch_interfaces_capture.hpp> in Catch2 v3,
+which was not previously included.
+
+tests/sla_print/sla_test_utils.cpp:87:32: error: ‘getResultCapture’ is not a member of ‘Catch’
+    m.WriteOBJFile((Catch::getResultCapture().getCurrentTestName() + "_" +
+                           ^~~~~~~~~~~~~~~~
+---
+ tests/sla_print/sla_test_utils.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tests/sla_print/sla_test_utils.cpp b/tests/sla_print/sla_test_utils.cpp
+index 01eb222969c..c9355ca8e91 100644
+--- a/tests/sla_print/sla_test_utils.cpp
+++ b/tests/sla_print/sla_test_utils.cpp
+@@ -5,6 +5,7 @@
+ #include "libslic3r/SLA/BranchingTreeSLA.hpp"
+ 
+ #include <iomanip>
+#include <catch2/interfaces/catch_interfaces_capture.hpp>
+ 
+ void test_support_model_collision(
+     const std::string            &obj_filename,
--- a/pkgs/by-name/pr/prusa-slicer/package.nix
+++ b/pkgs/by-name/pr/prusa-slicer/package.nix
@@ -80,6 +80,9 @@ clangStdenv.mkDerivation (finalAttrs: {
    ./allow_wayland.patch
    # Pick https://github.com/prusa3d/PrusaSlicer/pull/14207 to remove unused and insecure ilmbase dependency
    ./no-ilmbase.patch
+    # catch2 3.15 support
+    # https://github.com/prusa3d/PrusaSlicer/pull/15462
+    ./catch2_3_15.patch
  ];

  # (not applicable to super-slicer fork)
--- a/pkgs/by-name/ps/pscale/package.nix
+++ b/pkgs/by-name/ps/pscale/package.nix
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "pscale";
-  version = "0.291.0";
+  version = "0.293.0";

  src = fetchFromGitHub {
    owner = "planetscale";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-dvWUriwAMgJMSkQPVNu5Ff4KFbp4KPE8lbY2OlttbzA=";
+    sha256 = "sha256-eROK3Bqp72rhUTUUZZlIUbMLTNmjEUXw2TBSsNVLONQ=";
  };

-  vendorHash = "sha256-n09VZjMHFnP/myZ0gqWdeD8QOQf3PpTJ9PUfb4x2zHo=";
+  vendorHash = "sha256-IkqXij3i3nUCHfu36yS7e4+5PM6ZHmPuYbgVo7Uv0X8=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/py/pyprland/package.nix
+++ b/pkgs/by-name/py/pyprland/package.nix
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "pyprland";
-  version = "3.4.2";
+  version = "3.4.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "hyprland-community";
    repo = "pyprland";
    tag = finalAttrs.version;
-    hash = "sha256-Bu2UumLJay3Fvd2aXhqWGbxApCVSdJKo51NLy1AC/+0=";
+    hash = "sha256-/CR07do2Ma9DYmQ3dNwaXYZmgIX4gQdVMdtEz+AM78E=";
  };

  build-system = [ python3Packages.hatchling ];
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -4,6 +4,7 @@
  rustPlatform,
  fetchFromGitHub,
  arrow-cpp,
+
  # nativeBuildInputs
  binaryen,
  lld,
@@ -12,6 +13,7 @@
  protobuf,
  rustfmt,
  nasm,
+
  # buildInputs
  freetype,
  glib,
@@ -19,7 +21,10 @@
  libxkbcommon,
  openssl,
  vulkan-loader,
+  # linux-only:
+  udev,
  wayland,
+
  versionCheckHook,
  # passthru
  nix-update-script,
@@ -35,10 +40,9 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rerun";
-  version = "0.33.1";
+  version = "0.34.1";

  __structuredAttrs = true;
-  strictDeps = true;

  outputs = [
    "out"
@@ -49,7 +53,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "rerun-io";
    repo = "rerun";
    tag = finalAttrs.version;
-    hash = "sha256-GCIrvNNktW9h2/s90tTxFOmiIRAbWQWOS3Ti03EZ/GM=";
+    hash = "sha256-z/9uzp/7+xxmJCcgV+LJqdWWEhE85+upgW1EFfyBvYM=";
  };

  # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@@ -58,7 +62,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '"rerun_sdk/rerun_cli/rerun"' '"rerun_sdk/rerun"'
  '';

-  cargoHash = "sha256-wCJKerOgOUWNn3wBeHEKn92qzGdICX6P52B2FT5wcZE=";
+  cargoHash = "sha256-nvLT+iIsi1C283aJ8qP3Ijw+oizrDKwnQpSG2OchMwE=";

  cargoBuildFlags = [
    "--package"
@@ -139,11 +143,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
    freetype
    glib
    gtk3
-    (lib.getDev openssl)
    libxkbcommon
+    openssl
    vulkan-loader
  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [ (lib.getLib wayland) ];
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    udev
+    (lib.getLib wayland)
+  ];

  propagatedBuildInputs = [ arrow-cpp ];

--- a/pkgs/by-name/ro/roxctl/package.nix
+++ b/pkgs/by-name/ro/roxctl/package.nix
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "roxctl";
-  version = "4.11.0";
+  version = "4.11.1";

  src = fetchFromGitHub {
    owner = "stackrox";
    repo = "stackrox";
    rev = finalAttrs.version;
-    sha256 = "sha256-rUNeRaqjGtAoMj4v/wE7bO1ifOECkvn7C6ui3OhJdIY=";
+    sha256 = "sha256-1+I/piqSFIJsy3PCSs1z7BNmi4Sz+SeuVfAoi0k11IU=";
  };

-  vendorHash = "sha256-SoHwodOcS0Yeg0fNunnMrjcRdYM16HCz3EGzw2TbRKE=";
+  vendorHash = "sha256-mNZCsk7qZVej7yN8z/gAYWgSheCBj2sTF7pkmJbkW1w=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/sa/sandbox-runtime/package.nix
+++ b/pkgs/by-name/sa/sandbox-runtime/package.nix
@@ -17,7 +17,7 @@

 buildNpmPackage (finalAttrs: {
  pname = "sandbox-runtime";
-  version = "0.0.63";
+  version = "0.0.64";

  __structuredAttrs = true;

@@ -25,7 +25,7 @@ buildNpmPackage (finalAttrs: {
    owner = "anthropic-experimental";
    repo = "sandbox-runtime";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Y01JUdTmmAqs++3LpLIXZyBsq4jKvIxUeOI6zLfcI2g=";
+    hash = "sha256-kKXGZcK3hx3ugud+DxLrBC+IwnUzEe0Gae2lq7DU8hA=";
  };

  postPatch =
@@ -37,7 +37,7 @@ buildNpmPackage (finalAttrs: {

  strictDeps = true;

-  npmDepsHash = "sha256-fwk2A1oBv+/YrV+zjzSYlKhIB6oiAZO/88fE2UHWWbA=";
+  npmDepsHash = "sha256-3HOGoIG9syQJ407C8Bg7J7mtPpoIjVtUoFCdbSmT8BU=";

  postFixup =
    let
--- a/pkgs/by-name/sd/SDL_ttf/package.nix
+++ b/pkgs/by-name/sd/SDL_ttf/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "SDL_ttf";
-  version = "2.0.11-unstable-2024-04-23";
+  version = "2.0.11-unstable-2026-07-05";

  src = fetchFromGitHub {
    owner = "libsdl-org";
    repo = "SDL_ttf";
-    rev = "3c4233732b94ce08d5f6a868e597af39e13f8b23";
-    hash = "sha256-FX6Ko4CaOSCSKdpWVsJhTZXlWk1cnjbfVfMDiGG2+TU=";
+    rev = "3af6dd26174bb719c241447d1ea55e40597bb9a6";
+    hash = "sha256-OLPsLIddOnKpMjW+P9D1gEKyYC125X6sqpBbm44d8d8=";
  };

  buildInputs = [
--- a/pkgs/by-name/se/sentry-native/package.nix
+++ b/pkgs/by-name/se/sentry-native/package.nix
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "sentry-native";
-  version = "0.15.2";
+  version = "0.15.3";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-native";
    tag = finalAttrs.version;
-    hash = "sha256-119xEbCBmY61hJln0+ZncavZDXh+iY3oGrVtZPQZFsk=";
+    hash = "sha256-9UwF8B1dd4RhboMgkZCHI3UqAm8aZAhgLo9VzjwlW/I=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/so/sops/package.nix
+++ b/pkgs/by-name/so/sops/package.nix
@@ -12,7 +12,7 @@

 buildGoModule (finalAttrs: {
  pname = "sops";
-  version = "3.13.1";
+  version = "3.13.2";

  __structuredAttrs = true;

@@ -20,10 +20,10 @@ buildGoModule (finalAttrs: {
    owner = "getsops";
    repo = finalAttrs.pname;
    tag = "v${finalAttrs.version}";
-    hash = "sha256-df3CwJv+sROmikvWZbFGB1OrcSL1svuvFr6WJKYWhDc=";
+    hash = "sha256-en4MsPwqLRi8jlwuzWHgJ+ns42cBXuCzGbnZyGK9Vhk=";
  };

-  vendorHash = "sha256-cdaxcNCCHK2Rve96KvmO9lc9gZtgqu6rDeYb2vRvdHw=";
+  vendorHash = "sha256-qBtVnRJK/E545yTUwYXauVFBcpV8mUSxmush5vQMMrs=";

  subPackages = [ "cmd/sops" ];

--- a/pkgs/by-name/st/stalwart_0_15/package.nix
+++ b/pkgs/by-name/st/stalwart_0_15/package.nix
@@ -70,8 +70,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
  ++ lib.optionals withFoundationdb [ "foundationdb" ]
  ++ lib.optionals stalwartEnterprise [ "enterprise" ];

+  cargoBuildFlags = [
+    "-p"
+    "stalwart"
+  ];
+  cargoTestFlags = finalAttrs.cargoBuildFlags;
+
  env = {
+    # https://docs.rs/openssl/latest/openssl/#manual
    OPENSSL_NO_VENDOR = true;
+    OPENSSL_DIR = lib.getDev openssl;
+    OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
    ZSTD_SYS_USE_PKG_CONFIG = true;
    ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
    ROCKSDB_LIB_DIR = "${rocksdb}/lib";
@@ -166,6 +175,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    # No queue event received.
    # NOTE: Test unreliable on high load systems
    "smtp::management::queue::manage_queue"
+    "smtp::outbound::mta_sts::mta_sts_verify"
+    "smtp::outbound::dane::dane_verify"
    # thread 'responses::tests::parse_responses' panicked at crates/dav-proto/src/responses/mod.rs:671:17:
    # assertion `left == right` failed: failed for 008.xml
    #   left: ElementEnd
@@ -215,6 +226,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      oddlama
      pandapip1
      norpol
+      debtquity
    ];
  };
 })
--- a/pkgs/by-name/tr/transcribe/package.nix
+++ b/pkgs/by-name/tr/transcribe/package.nix
@@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "transcribe";
-  version = "9.51.1";
+  version = "9.60.0";

  src =
    if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchzip {
        url = "https://www.seventhstring.com/xscribe/downlo/xscsetup-${version}.tar.gz";
-        sha256 = "sha256-RgiclfufwWDr21NGIfc3/PgYJBBoTwiu9TxLgTU9Pgk=";
+        sha256 = "sha256-YGgZimAuIcdKiRK7SPK13oKElr8OFjGkho1jX40LqSk=";
      }
    else
      throw "Platform not supported";
--- a/pkgs/by-name/vt/vt-cli/package.nix
+++ b/pkgs/by-name/vt/vt-cli/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "vt-cli";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "VirusTotal";
    repo = "vt-cli";
    tag = finalAttrs.version;
-    hash = "sha256-B4SOoEc05nDFc93MYZDSj+LRt06jWjudocE4IKEw7jE=";
+    hash = "sha256-oYdF3UmPT43iXWYx4A3ctDIf96nAriwt0gasOIObhlU=";
  };

  vendorHash = "sha256-n44nEff0/neaqHfU6UbPjEAW46axJ0hIxrOnlq5QKA0=";
--- a/pkgs/by-name/wa/wasm-component-ld/package.nix
+++ b/pkgs/by-name/wa/wasm-component-ld/package.nix
@@ -6,7 +6,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wasm-component-ld";
-  version = "0.5.25";
+  version = "0.5.26";

  __structuredAttrs = true;

@@ -14,10 +14,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "bytecodealliance";
    repo = "wasm-component-ld";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-EQqNm3GRuMafbrOyzsdZ5e1pX4LH40wCyKVgSgm8A48=";
+    hash = "sha256-4hKHChIxVpTo18sfeUd8GzjQeb2ONAGeg4I7vKTAhSI=";
  };

-  cargoHash = "sha256-1e54TLWGjfNORwr6uLIe/XhdDDOkbalw/6/0UGuBiPk=";
+  cargoHash = "sha256-IQe4TLWbjlB/h7K5qH5ANxoqG8A2D3RF+UVDj4u6qFQ=";

  # Tests require a rustc that can target wasm32-wasip1, including std. This is awkward for
  # Nixpkgs to provide at the same time as providing a rustc that's targetting the actual target.
--- a/pkgs/by-name/xp/xpipe/package.nix
+++ b/pkgs/by-name/xp/xpipe/package.nix
@@ -39,7 +39,7 @@ let

  hash =
    {
-      x86_64-linux = "sha256-aPEyAlD7bpi30m7952gVzEDJZJr0BPJ7GJtKAg68aEc=";
+      x86_64-linux = "sha256-soypc4tPi9UexNqObZtKWvGgFA/4lPyv5ID3VEbjDDo=";
    }
    .${system} or throwSystem;

@@ -48,7 +48,7 @@ let
 in
 stdenvNoCC.mkDerivation rec {
  pname = "xpipe";
-  version = "23.5.2";
+  version = "23.6";

  src = fetchzip {
    url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";
--- a/pkgs/desktops/lomiri/default.nix
+++ b/pkgs/desktops/lomiri/default.nix
@@ -37,6 +37,7 @@ let
        withDocumentation = !useQt6;
      };
      lomiri-notifications = callPackage ./qml/lomiri-notifications { };
+      lomiri-push-qml = callPackage ./qml/lomiri-push-qml { };
      lomiri-ui-extras = callPackage ./qml/lomiri-ui-extras { };
      lomiri-ui-toolkit = callPackage ./qml/lomiri-ui-toolkit { };
      qqc2-suru-style = callPackage ./qml/qqc2-suru-style { };
@@ -90,7 +91,6 @@ let
      u1db-qt = callPackage ./development/u1db-qt { };

      #### QML / QML-related
-      lomiri-push-qml = callPackage ./qml/lomiri-push-qml { };
      lomiri-settings-components = callPackage ./qml/lomiri-settings-components { };

      #### Services
--- a/pkgs/desktops/lomiri/qml/lomiri-push-qml/default.nix
+++ b/pkgs/desktops/lomiri/qml/lomiri-push-qml/default.nix
@@ -11,22 +11,34 @@
  qtdeclarative,
 }:

+let
+  withQt6 = lib.versions.major qtbase.version == "6";
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "lomiri-push-qml";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/lomiri-push-qml";
    tag = finalAttrs.version;
-    hash = "sha256-QpkW/fbl0Px5HsKfz/gv+D1S+iSpMZM8TiZCuAq1myk=";
+    hash = "sha256-+D8F0H3S+lfU53CJarE7Wrsc66JvJywzih0IgGD8cJo=";
  };

-  postPatch = ''
-    # Queries QMake for QML install location, returns QtBase build path
-    substituteInPlace src/*/PushNotifications/CMakeLists.txt \
-      --replace-fail 'qmake -query QT_INSTALL_QML' 'echo ''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}'
-  '';
+  postPatch =
+    if (!withQt6) then
+      ''
+        # Queries QMake for QML install location, returns QtBase build path
+        substituteInPlace src/*/PushNotifications/CMakeLists.txt \
+          --replace-fail 'qmake -query QT_INSTALL_QML' 'echo ''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}'
+      ''
+    else
+      ''
+        substituteInPlace src/Lomiri/PushNotifications/CMakeLists.txt \
+          --replace-fail \
+            'set(QT_INSTALL_QML "''${CMAKE_INSTALL_LIBDIR}/qt6/qml/")' \
+            'set(QT_INSTALL_QML "''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}")'
+      '';

  strictDeps = true;

@@ -46,8 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
  dontWrapQtApps = true;

  cmakeFlags = [
-    (lib.cmakeBool "ENABLE_QT6" (lib.strings.versionAtLeast qtbase.version "6"))
-    (lib.cmakeBool "ENABLE_UBUNTU_COMPAT" (!lib.strings.versionAtLeast qtbase.version "6"))
+    (lib.cmakeBool "ENABLE_QT6" withQt6)
+    (lib.cmakeBool "ENABLE_UBUNTU_COMPAT" (!withQt6))
  ];

  preBuild = ''
--- a/pkgs/desktops/lomiri/services/lomiri-telephony-service/default.nix
+++ b/pkgs/desktops/lomiri/services/lomiri-telephony-service/default.nix
@@ -2,13 +2,13 @@
  stdenv,
  lib,
  fetchFromGitLab,
+  fetchpatch,
  gitUpdater,
  nixosTests,
  runCommand,
  ayatana-indicator-messages,
  bash,
  cmake,
-  ctestCheckHook,
  dbus,
  dbus-glib,
  dbus-test-runner,
@@ -53,6 +53,31 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-CNtJPMust7zCuoXw/CpaK4NVXijTXA3Xs4YMJiZyxes=";
  };

+  patches = [
+    # Fixes for test flakiness & newer libnotify compatibility
+    # Remove when version > 0.6.2
+    (fetchpatch {
+      name = "0001-lomiri-telephony-service-new-libnotify-needs-spec_version.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-telephony-service/-/commit/6b0b51a4fcfafcd10ae5fe4928d49c9f73f14d12.patch";
+      hash = "sha256-E9THrqE77GXBY8ftwrkwFzFCTSa/YpkaHiX4ivjH6mM=";
+    })
+    (fetchpatch {
+      name = "0002-lomiri-telephony-service-tests-depend-on-the-notification-mock.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-telephony-service/-/commit/8c5a3048492eb01354565f0892a61770eb27b957.patch";
+      hash = "sha256-nLN+Evyq4Yf9GN2wSSPXmzEzTPXHDl+Pl5FKOiwdDY8=";
+    })
+    (fetchpatch {
+      name = "0003-lomiri-telephony-service-approver-fix-race-condition-when-accepting-calls.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-telephony-service/-/commit/b3123f784ed692f9424c978e68867a8662d00083.patch";
+      hash = "sha256-/JEkoEEivFwFoNOrcdDleAGOjdUwS4SlUovMr9trNQQ=";
+    })
+    (fetchpatch {
+      name = "0004-lomiri-telephony-service-Robustness-fixes-for-tests.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-telephony-service/-/commit/e886fbdd016327634e935986f2b63b90833295be.patch";
+      hash = "sha256-Ie9kM7UHSjmORTOTNzZ1/qtM4ILkOnGjyQCXXo1PU88=";
+    })
+  ];
+
  postPatch = ''
    # Queries qmake for the QML installation path, which returns a reference to Qt5's build directory
    # Patch out failure if QMake is not found, since we don't use it
@@ -112,7 +137,6 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  nativeCheckInputs = [
-    ctestCheckHook
    dbus-test-runner
    dconf
    gnome-keyring
@@ -139,25 +163,6 @@ stdenv.mkDerivation (finalAttrs: {
  # Starts & talks to D-Bus services, breaks with parallelism
  enableParallelChecking = false;

-  disabledTests = [
-    # Flaky, randomly failing to launch properly & stuck until test timeout
-    # https://gitlab.com/ubports/development/core/lomiri-telephony-service/-/issues/70
-    "AccountEntryTest"
-    "AccountEntryFactoryTest"
-    "AuthHandlerTest"
-    "CallEntryTest"
-    "ChatManagerTest"
-    "HandlerTest"
-    "OfonoAccountEntryTest"
-    "PresenceRequestTest"
-    "TelepathyHelperSetupTest"
-
-    # Failing most of the time since libnotify 0.8.8
-    # https://gitlab.com/ubports/development/core/lomiri-telephony-service/-/issues/75
-    "ApproverTest"
-    "MessagingMenuTest"
-  ];
-
  preCheck = ''
    export QT_QPA_PLATFORM=minimal
    export QT_PLUGIN_PATH=${
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "go";
-  version = "1.25.11";
+  version = "1.25.12";

  src = fetchurl {
    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-e05bB5s8m8QgNzymhiGilrTRPBBzXUrKxBcZKNcPVIA=";
+    hash = "sha256-+Q3O5L0CP6N2N06gpabr5VNTeznEJv/YxolGm0VRmTI=";
  };

  strictDeps = true;
--- a/pkgs/development/python-modules/azure-mgmt-servicefabricmanagedclusters/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-servicefabricmanagedclusters/default.nix
@@ -10,12 +10,13 @@

 buildPythonPackage rec {
  pname = "azure-mgmt-servicefabricmanagedclusters";
-  version = "2.0.0";
+  version = "2.1.0b3";
  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Bw+pMc0H9Gk8t4vaaOgwSMZ/zqzUJHGZ7keH+ylZnVw=";
+    pname = "azure_mgmt_servicefabricmanagedclusters";
+    inherit version;
+    hash = "sha256-52i8y0V2qy3yDP/mJi7zATE0+qi5H+F8Zcjnoc2qQTU=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/boschshcpy/default.nix
+++ b/pkgs/development/python-modules/boschshcpy/default.nix
@@ -11,14 +11,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "boschshcpy";
-  version = "0.3.19";
+  version = "0.4.8";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tschamm";
    repo = "boschshcpy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VgARhj/RFwEgiP09eQBoCDpEggR6IQTF14klFUNAQ7U=";
+    hash = "sha256-VYraW9zeTQn2fvc1pdpF8Tx+iFRxoNQ6b98VphGao7k=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.43.40";
+  version = "1.43.41";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-5h8+Bf1ljDkoxwShyn+aAguxkCHJYcg5I5y3F7iv3JU=";
+    hash = "sha256-pXtT4D6Hh/2I3luQLYMDyfZB+8PQtCsSdR50vmQ2dds=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/dask-image/default.nix
+++ b/pkgs/development/python-modules/dask-image/default.nix
@@ -11,7 +11,6 @@
  dask,
  numpy,
  scipy,
-  pandas,
  pims,

  # tests
@@ -20,24 +19,22 @@
  scikit-image,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "dask-image";
-  version = "2025.11.0";
+  version = "2026.5.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "dask";
    repo = "dask-image";
-    tag = "v${version}";
-    hash = "sha256-+nzYthnobcemunMcAWwRpHOQy6yFtjdib/7VZqWEiqc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SEbabXZx4u+C4IjzfVf81Y/gopxt6m0Jp0ZCN9hx5G8=";
  };

  postPatch = ''
-    sed -i "/--flake8/d" pyproject.toml
-
-    # https://numpy.org/doc/stable//release/2.4.0-notes.html#removed-numpy-in1d
-    substituteInPlace tests/test_dask_image/test_ndmeasure/test_core.py \
-      --replace-fail "np.in1d" "np.isin"
+    substituteInPlace pyproject.toml \
+      --replace-fail "--flake8" ""
  '';

  build-system = [
@@ -48,9 +45,8 @@ buildPythonPackage rec {
  dependencies = [
    dask
    numpy
-    scipy
-    pandas
    pims
+    scipy
  ];

  nativeCheckInputs = [
@@ -80,8 +76,8 @@ buildPythonPackage rec {
  meta = {
    description = "Distributed image processing";
    homepage = "https://github.com/dask/dask-image";
-    changelog = "https://github.com/dask/dask-image/releases/tag/v${version}";
+    changelog = "https://github.com/dask/dask-image/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.bsdOriginal;
    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
-}
+})
--- a/pkgs/development/python-modules/dask-jobqueue/default.nix
+++ b/pkgs/development/python-modules/dask-jobqueue/default.nix
@@ -11,13 +11,13 @@
  dask,
  distributed,

-  # checks
+  # tests
  cryptography,
  pytest-asyncio,
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "dask-jobqueue";
  version = "0.9.0";
  pyproject = true;
@@ -25,7 +25,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "dask";
    repo = "dask-jobqueue";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-YujfhjOJzl4xsjjsyrQkEu/CBR04RwJ79c1iSTcMIgw=";
  };

@@ -43,6 +43,9 @@ buildPythonPackage rec {
  ];

  disabledTests = [
+    # AssertionError: assert 1783413599.053456 < (1783413589.024546 + 10)
+    "test_runner"
+
    # Require some unavailable pytest fixtures
    "test_adapt"
    "test_adaptive"
@@ -100,4 +103,4 @@ buildPythonPackage rec {
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
-}
+})
--- a/pkgs/development/python-modules/dask-yarn/default.nix
+++ b/pkgs/development/python-modules/dask-yarn/default.nix
@@ -1,84 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  fetchpatch,
-  setuptools,
-  versioneer,
-  dask,
-  distributed,
-  grpcio,
-  skein,
-  pytestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "dask-yarn";
-  version = "0.9";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "dask";
-    repo = "dask-yarn";
-    tag = version;
-    hash = "sha256-/BTsxQSiVQrihrCa9DE7pueyg3aPAdjd/Dt4dpUwdtM=";
-  };
-
-  patches = [
-    (fetchpatch {
-      # https://github.com/dask/dask-yarn/pull/150
-      name = "address-deprecations-introduced-in-distributed-2021-07-0";
-      url = "https://github.com/dask/dask-yarn/pull/150/commits/459848afcdc22568905ee98622c74e4071496423.patch";
-      hash = "sha256-LS46QBdiAmsp4jQq4DdYdmmk1qzx5JZNTQUlRcRwY5k=";
-    })
-  ];
-
-  postPatch = ''
-    rm versioneer.py
-  '';
-
-  build-system = [
-    setuptools
-    versioneer
-  ];
-
-  dependencies = [
-    dask
-    distributed
-    grpcio
-    skein
-  ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  preCheck = ''
-    export HOME=$TMPDIR
-  '';
-
-  pythonImportsCheck = [ "dask_yarn" ];
-
-  disabledTests = [
-    # skein.exceptions.DriverError: Failed to start java process
-    "test_basic"
-    "test_adapt"
-    "test_from_specification"
-    "test_from_application_id"
-    "test_from_current"
-    "test_basic_async"
-    "test_widget_and_html_reprs"
-  ];
-
-  meta = {
-    description = "Deploy dask on YARN clusters";
-    mainProgram = "dask-yarn";
-    longDescription = ''
-      Dask-Yarn deploys Dask on YARN clusters,
-            such as are found in traditional Hadoop installations.
-            Dask-Yarn provides an easy interface to quickly start,
-            stop, and scale Dask clusters natively from Python.
-    '';
-    homepage = "https://yarn.dask.org/";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ illustris ];
-  };
-}
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -45,14 +45,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "dask";
-  version = "2026.3.0";
+  version = "2026.7.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "dask";
    repo = "dask";
    tag = finalAttrs.version;
-    hash = "sha256-JfCiABGSCJKKSz2/r8fvpVwdQSZqvoQICe+lDvuNhoM=";
+    hash = "sha256-Lp8l4luwCGUmLWzwhAYBn8lrXH2bLTnMO7JCD+TqrKU=";
  };

  patches = [
--- a/pkgs/development/python-modules/datafusion/default.nix
+++ b/pkgs/development/python-modules/datafusion/default.nix
@@ -25,8 +25,10 @@

 buildPythonPackage (finalAttrs: {
  pname = "datafusion";
-  version = "52.3.0";
+  # WARNING: Ensure rerun-sdk is compatible with this version of datafusion
+  version = "53.0.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    name = "datafusion-source";
@@ -35,12 +37,12 @@ buildPythonPackage (finalAttrs: {
    tag = finalAttrs.version;
    # Fetch arrow-testing and parquet-testing (tests assets)
    fetchSubmodules = true;
-    hash = "sha256-kyJoG65XKSF+RElZlsdfVTZp/ufWiUw0YdCpQ8Qcg78=";
+    hash = "sha256-3plgAJuh2rrnvzkQVy3gUgEoHHT4FSjDp5DZx1keD+g=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname src version;
-    hash = "sha256-7/YWJORUjhhZSLyyBT6NFD0RzARJ3SKd11gn4kJ7aYw=";
+    hash = "sha256-kHGlUaPNSs1Nh3HCU+yUVQq/IXp9PUwpDmfAon8eRBk=";
  };

  nativeBuildInputs = with rustPlatform; [
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@@ -21,20 +21,20 @@
  tblib,
  toolz,
  tornado,
-  urllib3,
  zict,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "distributed";
-  version = "2026.3.0";
+  version = "2026.7.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "dask";
    repo = "distributed";
    tag = finalAttrs.version;
-    hash = "sha256-lStJwJbhuyPuJ7Nbcm6S6f7tq1T5DtAy8zE1p2Mdrt0=";
+    hash = "sha256-JwN+Ey+Ii8mELa6oVS+SDiOPYyMcKdaiSjjMqDze+kc=";
  };

  build-system = [
@@ -58,7 +58,6 @@ buildPythonPackage (finalAttrs: {
    tblib
    toolz
    tornado
-    urllib3
    zict
  ];

--- a/pkgs/development/python-modules/django-tenants/default.nix
+++ b/pkgs/development/python-modules/django-tenants/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "django-tenants";
-  version = "3.10.0";
+  version = "3.11.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "django-tenants";
    repo = "django-tenants";
    tag = "v${version}";
-    hash = "sha256-MzpoA49LOORR8LRLdWKhVZ+zQbF9GKLqBBi/j8WecK8=";
+    hash = "sha256-J7poXEHbRxhULYwFbV4tktet5wdsvd7RNHgivETy9+8=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/fastgit/default.nix
+++ b/pkgs/development/python-modules/fastgit/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "fastgit";
-  version = "0.0.5";
+  version = "0.0.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "AnswerDotAI";
    repo = "fastgit";
    tag = finalAttrs.version;
-    hash = "sha256-rECQZAhtD6MsDwoED7K8I3HtYdbR8DqCZqP2AqNHroY=";
+    hash = "sha256-kasTNCeFrqEgska7wQ612c6lyQErnjsulqARo8WN9jA=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/gdsfactory/default.nix
+++ b/pkgs/development/python-modules/gdsfactory/default.nix
@@ -48,14 +48,14 @@
 }:
 buildPythonPackage (finalAttrs: {
  pname = "gdsfactory";
-  version = "9.44.0";
+  version = "9.45.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "gdsfactory";
    repo = "gdsfactory";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5iP359Sy93Pr5gmsCEEcTK47d0qbFUy9eEpcFZ6AJp4=";
+    hash = "sha256-BO/4SoD2qSPfNGwRJTMpkbeZc8Zez7Xy23CgX9CIqC0=";
  };

  build-system = [
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@@ -16,14 +16,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "holidays";
-  version = "0.99";
+  version = "0.100";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "vacanza";
    repo = "python-holidays";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-iIBkusWBwvDI9EMTvf62UVl/N8tlKhasCj/yPBh+lk4=";
+    hash = "sha256-PY2N/UysRcz8AWQQ8cA4WlY0jVV6mpxhzVE65uLuWPg=";
  };

  build-system = [
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202607061";
+  version = "0.1.202607071";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-IVJw7s3XvrYy1XlnKE9DMu5d39jWFKRiQTnqg5xANwM=";
+    hash = "sha256-gz2PMoEWE2+xUCfcmr8nI1AFTpKoEdrpuhD3HVoD4qM=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/lacuscore/default.nix
+++ b/pkgs/development/python-modules/lacuscore/default.nix
@@ -15,14 +15,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "lacuscore";
-  version = "1.25.0";
+  version = "1.25.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ail-project";
    repo = "LacusCore";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gCNu0piYtyqXFIYhPhjrVk6qcPPVOsXDcFB3BG/g9G8=";
+    hash = "sha256-wbs/EZuK6eK8mKOB7sb0l4Y/orhugmoEnwy1bclusoU=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/llama-index-workflows/default.nix
+++ b/pkgs/development/python-modules/llama-index-workflows/default.nix
@@ -10,13 +10,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "llama-index-workflows";
-  version = "2.22.1";
+  version = "2.22.2";
  pyproject = true;

  src = fetchPypi {
    pname = "llama_index_workflows";
    inherit (finalAttrs) version;
-    hash = "sha256-Y7JzEH9ZxOujMP0ftJL7knv9OIDqPZHfpt4ciYKHQ4U=";
+    hash = "sha256-l7ZLz3LnfhoDgAaM2gnl0HdLdavbiRCWxDNobC8pnj4=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/magika/default.nix
+++ b/pkgs/development/python-modules/magika/default.nix
@@ -26,7 +26,7 @@ let
 in
 buildPythonPackage (finalAttrs: {
  pname = "magika";
-  version = "1.0.2";
+  version = "1.0.3";
  pyproject = true;

  # Use pypi tarball instead of GitHub source
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
  # while GitHub source requires compiling magika-cli
  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-jtkS2PFNBE9D/b0X1r0svdbouCRuib5J9s1UcFNjZnc=";
+    hash = "sha256-rTIWAS9t0ze+NMI649+rNvBiO8Yvv7Mp+aGFLJrUAwQ=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -806,8 +806,8 @@ in
      "sha256-EunrKwNaYp0CDiwp8frI7zASilMF4wYHjDSuCsJ6aJM=";

  mypy-boto3-logs =
-    buildMypyBoto3Package "logs" "1.43.35"
-      "sha256-z43XDlXC123oIHrKLmEprJ3tfVXPDVg1wjLQJ9jM9WY=";
+    buildMypyBoto3Package "logs" "1.43.41"
+      "sha256-HAB24HG1jburH8wOPipqP1G1U7PX3i5BGp6mPUSa100=";

  mypy-boto3-lookoutequipment =
    buildMypyBoto3Package "lookoutequipment" "1.43.0"
@@ -966,8 +966,8 @@ in
      "sha256-1wQApBLsMnKRZ3lJZdd2W0+2Zz50QFdzYAhrOvEzByM=";

  mypy-boto3-opensearch =
-    buildMypyBoto3Package "opensearch" "1.43.39"
-      "sha256-ML0Y1a5twHRFUmR0MppMRopU2RG9n6y0HpQj4jUb/Dk=";
+    buildMypyBoto3Package "opensearch" "1.43.41"
+      "sha256-eJIlC3LWzy+2xUZ+8uao64+IeYGdVMX1+B0+VLeA/D8=";

  mypy-boto3-opensearchserverless =
    buildMypyBoto3Package "opensearchserverless" "1.43.17"
--- a/pkgs/development/python-modules/napari/default.nix
+++ b/pkgs/development/python-modules/napari/default.nix
@@ -58,14 +58,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "napari";
-  version = "0.7.0";
+  version = "0.7.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "napari";
    repo = "napari";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fDt9n4+yQcA03IO7sMhcpiP3TfOWfyvbCjY7ImEj+Qg=";
+    hash = "sha256-BRRJHVcCqxlOPN4kA5B0X9SOY4SiKgnBb7ov1m6aiZY=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/ngff-zarr/default.nix
+++ b/pkgs/development/python-modules/ngff-zarr/default.nix
@@ -1,44 +1,57 @@
 {
  lib,
  buildPythonPackage,
-  dask,
-  dask-image,
-  deepdiff,
  fetchFromGitHub,
+
+  # build-system
  hatchling,
+
+  # dependencies
+  dask,
  importlib-resources,
-  itk,
-  itkwasm-downsample,
-  itkwasm-image-io,
  itkwasm,
-  jsonschema,
-  nibabel,
-  imageio,
+  itkwasm-downsample,
  numpy,
-  imagecodecs,
  platformdirs,
-  pooch,
  psutil,
-  pytestCheckHook,
-  rich-argparse,
  rich,
-  tensorstore,
-  tifffile,
+  rich-argparse,
  typing-extensions,
-  writableTmpDirAsHomeHook,
  zarr,
+
+  # optional-dependencies
+  # dask-image:
+  dask-image,
+  # cli:
+  imagecodecs,
+  imageio,
+  itk,
+  itkwasm-image-io,
+  nibabel,
+  tifffile,
+  # tensorstore:
+  tensorstore,
+  # validate:
+  jsonschema,
+
+  # tests
+  deepdiff,
+  pooch,
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "ngff-zarr";
-  version = "0.37.0";
+  version = "0.37.1";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "fideus-labs";
    repo = "ngff-zarr";
    tag = "py-v${finalAttrs.version}";
-    hash = "sha256-v747oBJMKORiEgy3fVzzgl35+9uRbyGvtor+Ga4UkNI=";
+    hash = "sha256-73bduVeH+o7uirhwFcFpU33NUAOZe//GCVYMl6OYgC8=";
  };

  sourceRoot = "${finalAttrs.src.name}/py/";
@@ -87,7 +100,7 @@ buildPythonPackage (finalAttrs: {
    pytestCheckHook
    writableTmpDirAsHomeHook
  ]
-  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;

  pythonImportsCheck = [ "ngff_zarr" ];

@@ -96,16 +109,19 @@ buildPythonPackage (finalAttrs: {
    "test/test_cli_input_to_ngff_image.py"
    "test/test_cli_output.py"
    "test/test_cli_relative_paths.py"
+
    # Attribute errors
    "test/test_pyramid_integrity.py"
    "test/test_multiscales_type.py"
    "test/test_convert_ome_zarr_version.py"
    "test/test_itk_image_to_ngff_image.py"
+
    # Data missing
    "test/test_hcs.py"
    "test/test_hcs_simple.py"
    "test/test_ngff_validation.py"
    "test/test_nibabel_image_to_ngff_image.py"
+
    # Network access
    "test/test_from_ngff_zarr_tensorstore.py"
    "test/test_from_ngff_zarr.py"
@@ -120,16 +136,46 @@ buildPythonPackage (finalAttrs: {
    "test/test_to_ngff_zarr_sharding.py"
    "test/test_to_ngff_zarr_tensorstore.py"
    "test/test_to_ngff_zarr_v3_compression.py"
+
    # Missing dependencies
    "test/test_lif_to_ngff_image.py"
  ];

  disabledTests = [
+    # ValueError: zarr 3.2.1 < 3 is not supported
+    "test_clean_tiff_emits_no_structural_warning"
+    "test_multiseries_tiff_to_directory_keeps_per_series_stores"
+    "test_multiseries_tiff_to_ozx_creates_requested_file"
+    "test_non_rgb_multichannel_tiff_no_channel_colors"
+    "test_ome_tiff_channel_colors_from_xml"
+    "test_ome_tiff_rgb_s_axis_overrides_xml_colors"
+    "test_pyramidal_grayscale_tiff"
+    "test_pyramidal_rgb_tiff_channel_consistency"
+    "test_tiff_file_to_ngff_images_2d"
+    "test_tiff_file_to_ngff_images_all_series"
+    "test_tiff_file_to_ngff_images_no_ome_metadata"
+    "test_tiff_file_to_ngff_images_partial_ome_metadata"
+    "test_tiff_file_to_ngff_images_series_all"
+    "test_tiff_file_to_ngff_images_simple_rgb"
+    "test_tiff_file_to_ngff_images_single_series_by_index"
+    "test_tiff_file_to_ngff_images_unit_normalization"
+    "test_tiff_file_to_ngff_images_unsupported_axis_warning"
+    "test_tiff_file_to_ngff_images_with_channel_names"
+    "test_tiff_file_to_ngff_images_with_channels"
+    "test_tiff_file_to_ngff_images_with_ome_metadata"
+    "test_tiff_file_to_ngff_images_with_partial_channel_names"
+    "test_tiff_file_to_ngff_images_with_sample_axis"
+    "test_tiff_file_to_ngff_images_without_channel_names"
+    "test_tiff_sample_axis_rgba_sets_four_channel_colors"
+    "test_tiff_sample_axis_sets_rgb_channel_colors"
+    "test_truncated_tiff_emits_warning"
+
    # Assertion errors
    "test_2d_yx"
    "test_3d_zyx"
    "test_smaller_dask_graph"
    "test_tensorstore_compression"
+
    # Test requires network access
    "test_cli_orientation_preset_end_to_end"
    "test_cli_itk_input_writes_orientation_automatically"
--- a/pkgs/development/python-modules/odc-geo/default.nix
+++ b/pkgs/development/python-modules/odc-geo/default.nix
@@ -24,20 +24,22 @@

  # tests
  geopandas,
+  imagecodecs,
  matplotlib,
  pytestCheckHook,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "odc-geo";
-  version = "0.5.1";
+  version = "0.5.2";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "opendatacube";
    repo = "odc-geo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rFhCY5rkZgVXM8aqsV0PoT8iPPpgNEQRI9MVqk6OQFQ=";
+    hash = "sha256-iubxn3ysx7aIMSrlrPPnfKYI8K7wSugM0/Zp2YIXeIg=";
  };

  build-system = [
@@ -77,6 +79,7 @@ buildPythonPackage (finalAttrs: {

  nativeCheckInputs = [
    geopandas
+    imagecodecs
    matplotlib
    pytestCheckHook
  ]
@@ -85,19 +88,14 @@ buildPythonPackage (finalAttrs: {
  disabledTestMarks = [ "network" ];

  disabledTests = [
-    # AttributeError (fixes: https://github.com/opendatacube/odc-geo/pull/202)
-    "test_azure_multipart_upload"
-    # network access
-    "test_empty_cog"
-    # urllib url open error
+    # Require internet access
    "test_country_geom"
    "test_from_geopandas"
    "test_geoboxtiles_intersect"
    "test_warp_nan"
-    # requires imagecodecs package (currently not available on nixpkgs)
+
+    # imagecodecs.ImcdError: imcd_byteshuffle returned IMCD_VALUE_ERROR
    "test_cog_with_dask_smoke_test"
-    # xarray compat issue
-    "test_xr_reproject"
  ];

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/odfdo/default.nix
+++ b/pkgs/development/python-modules/odfdo/default.nix
@@ -9,14 +9,14 @@
 }:
 buildPythonPackage (finalAttrs: {
  pname = "odfdo";
-  version = "3.22.8";
+  version = "3.22.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jdum";
    repo = "odfdo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-N256BtTV3zUXLL/ynXOTWqyoBorVsTEgevxdmLfRoJw=";
+    hash = "sha256-H/aJhWqkQGtG7bppM1AxWo/GBGYR6qAF7d/nxrby30M=";
  };

  build-system = [ uv-build ];
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -13,14 +13,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "oelint-parser";
-  version = "8.11.4";
+  version = "8.11.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "priv-kweihmann";
    repo = "oelint-parser";
    tag = finalAttrs.version;
-    hash = "sha256-l2An1JQrDA8Sf0R3Xu0qp84fksUQu/3aPkwHGmfv6AY=";
+    hash = "sha256-DwbpF1H5fY854YKqB/8ppg6gMS2VhMzoyY8yr/DsfBk=";
  };

  pythonRelaxDeps = [ "regex" ];
--- a/pkgs/development/python-modules/ome-zarr/default.nix
+++ b/pkgs/development/python-modules/ome-zarr/default.nix
@@ -26,7 +26,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "ome-zarr";
-  version = "0.16.0";
+  version = "0.18.0";
  pyproject = true;
  __structuredAttrs = true;

@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
    owner = "ome";
    repo = "ome-zarr-py";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hrk+F1a1yJzaIb7G80sGdqeMb2POIAD2gLOfK57A22A=";
+    hash = "sha256-cuvPlPvhCoivMPpesARnc0+fUqwxjeHyZ2E1e1iHUb8=";
  };

  build-system = [
@@ -66,6 +66,8 @@ buildPythonPackage (finalAttrs: {

  disabledTests = [
    # attempts to access network
+    "test_class_reader"
+    "test_class_reader_legacy"
    "test_s3_info"

    # AssertionError: assert {'blocksize':... 'blosc', ...} == {'blocksize':... 'blosc', ...}
@@ -75,25 +77,6 @@ buildPythonPackage (finalAttrs: {
  ];

  disabledTestPaths = [
-    # Fail with RecursionError
-    # https://github.com/ome/ome-zarr-py/issues/352
-    "tests/test_cli.py::TestCli::test_astronaut_download"
-    "tests/test_cli.py::TestCli::test_astronaut_info"
-    "tests/test_cli.py::TestCli::test_coins_info"
-    "tests/test_emitter.py::test_close"
-    "tests/test_emitter.py::test_create_wrong_encoding"
-    "tests/test_node.py::TestNode::test_image"
-    "tests/test_node.py::TestNode::test_label"
-    "tests/test_node.py::TestNode::test_labels"
-    "tests/test_ome_zarr.py::TestOmeZarr::test_download"
-    "tests/test_ome_zarr.py::TestOmeZarr::test_info"
-    "tests/test_reader.py::TestReader::test_image"
-    "tests/test_reader.py::TestReader::test_label"
-    "tests/test_reader.py::TestReader::test_labels"
-    "tests/test_starting_points.py::TestStartingPoints::test_label"
-    "tests/test_starting_points.py::TestStartingPoints::test_labels"
-    "tests/test_starting_points.py::TestStartingPoints::test_top_level"
-
    # tries to access network:
    "ome_zarr/io.py"
  ];
--- a/pkgs/development/python-modules/openrazer/common.nix
+++ b/pkgs/development/python-modules/openrazer/common.nix
@@ -1,17 +1,18 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "3.12.3";
+  version = "3.12.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "openrazer";
    repo = "openrazer";
    tag = "v${version}";
-    hash = "sha256-X1NPqbugBdxD5Nt9wIwQADV4CuydGLpgKhlNazVdrIY=";
+    hash = "sha256-WgDYs0ehnzWlX/wvfur0UhFLbZv7jZ6FMybqDaFDuLg=";
  };

  meta = {
    homepage = "https://openrazer.github.io/";
+    changelog = "https://github.com/openrazer/openrazer/releases/tag/${src.tag}";
    license = lib.licenses.gpl2Only;
    maintainers = with lib.maintainers; [ evanjs ];
    platforms = lib.platforms.linux;
--- a/pkgs/development/python-modules/opensfm/default.nix
+++ b/pkgs/development/python-modules/opensfm/default.nix
@@ -3,52 +3,65 @@
  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
-  runCommand,
-  srcOnly,
-  bashNonInteractive,
-  cmake,
-  ceres-solver,
-  suitesparse,
-  metis,
-  eigen,
+  pythonAtLeast,
+
+  # build-system
+  ninja,
+  scikit-build-core,
  setuptools,
-  pkg-config,
-  pybind11,
-  numpy,
-  pyyaml,
-  flask,
-  fpdf2,
-  opencv-python,
-  lapack,
-  gtest,
+
+  # nativeBuildInputs
+  cmake,
+
+  # buildInputs
+  bashNonInteractive,
+  ceres-solver,
+  eigen,
  gflags,
  glog,
-  pytestCheckHook,
-  networkx,
-  pillow,
+  gtest,
+  lapack,
+  metis,
+  pybind11,
+  suitesparse,
+
+  # dependencies
+  cloudpickle,
  exifread,
+  flask,
+  fpdf2,
+  joblib,
+  matplotlib,
+  networkx,
+  numpy,
+  opencv-python,
+  pillow,
  pyproj,
  python-dateutil,
-  joblib,
-  xmltodict,
-  cloudpickle,
+  pyyaml,
  scipy,
-  sphinx,
-  matplotlib,
-  scikit-build-core,
-  ninja,
+  xmltodict,
+
+  # tests
+  pytestCheckHook,
+
+  # passthru
+  runCommand,
+  srcOnly,
+  nix-update-script,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "opensfm";
-  version = "0.5.1-unstable-2026-05-04";
+  version = "odm-4-unstable-2026-07-01";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "mapillary";
    repo = "OpenSfM";
-    rev = "1dc5b95b5c8c4cadd653bdc9f6eb97c0ac1602ba";
-    sha256 = "sha256-K3+H8QSzTxIGAtYDGqOuJFTVaqk+B/R/MDMepJ/bRxY=";
+    rev = "a677b6f0648ff3caf439aebbe9aad0ca8abc175b";
+    hash = "sha256-Bxpfaj87N2QxP/AczpP3fOl6G8ciMJq5jaaIn7oGR9g=";
  };

  patches = [
@@ -80,9 +93,9 @@ buildPythonPackage (finalAttrs: {
  dontUseCmakeConfigure = true;

  build-system = [
-    setuptools
-    scikit-build-core
    ninja
+    scikit-build-core
+    setuptools
  ];

  nativeBuildInputs = [
@@ -90,34 +103,34 @@ buildPythonPackage (finalAttrs: {
  ];

  buildInputs = [
-    ceres-solver
-    suitesparse
-    metis
-    eigen
-    lapack
-    gflags
-    gtest
-    glog
-    pybind11
    bashNonInteractive # for patchShebangs
+    ceres-solver
+    eigen
+    gflags
+    glog
+    gtest
+    lapack
+    metis
+    pybind11
+    suitesparse
  ];

  dependencies = [
-    numpy
-    scipy
-    pyyaml
+    cloudpickle
+    exifread
    flask
    fpdf2
-    opencv-python
-    networkx
-    pillow
+    joblib
    matplotlib
-    exifread
+    networkx
+    numpy
+    opencv-python
+    pillow
    pyproj
    python-dateutil
-    joblib
+    pyyaml
+    scipy
    xmltodict
-    cloudpickle
  ];

  nativeCheckInputs = [
@@ -139,6 +152,11 @@ buildPythonPackage (finalAttrs: {
    # flaky
    "test_match_candidates_from_metadata_bow"
  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # _pickle.UnpicklingError: global 'numpy._core.numeric._frombuffer' is forbidden
+    "test_run_all"
+    "test_shot_view_ref_count"
+  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    "test_reconstruction_incremental"
    "test_reconstruction_triangulation"
@@ -146,26 +164,32 @@ buildPythonPackage (finalAttrs: {

  pythonImportsCheck = [ "opensfm" ];

-  # https://opensfm.org/docs/using.html#quickstart
-  passthru.tests = lib.genAttrs' [ "berlin" "lund" ] (
-    name:
-    lib.nameValuePair "integration-test-${name}" (
-      runCommand "opensfm-integration-test-${name}"
-        {
-          nativeBuildInputs = [ finalAttrs.finalPackage ];
-        }
-        ''
-          set -euo pipefail
-          opensfm --help
-          cp -r ${srcOnly finalAttrs.finalPackage}/data/${name} data
-          chmod -R +w data/
-          bash -x $(command -v opensfm_run_all) data/
-          if [[ -s data/camera_models.json && -s data/undistorted/reconstruction.json ]]; then
-            touch $out
-          fi
-        ''
-    )
-  );
+  passthru = {
+    # https://opensfm.org/docs/using.html#quickstart
+    tests = lib.genAttrs' [ "berlin" "lund" ] (
+      name:
+      lib.nameValuePair "integration-test-${name}" (
+        runCommand "opensfm-integration-test-${name}"
+          {
+            nativeBuildInputs = [ finalAttrs.finalPackage ];
+          }
+          ''
+            set -euo pipefail
+            opensfm --help
+            cp -r ${srcOnly finalAttrs.finalPackage}/data/${name} data
+            chmod -R +w data/
+            bash -x $(command -v opensfm_run_all) data/
+            if [[ -s data/camera_models.json && -s data/undistorted/reconstruction.json ]]; then
+              touch $out
+            fi
+          ''
+      )
+    );
+
+    updateScript = nix-update-script {
+      extraArgs = [ "--version=branch" ];
+    };
+  };

  meta = {
    broken = stdenv.hostPlatform.isDarwin;
--- a/pkgs/development/python-modules/perplexityai/default.nix
+++ b/pkgs/development/python-modules/perplexityai/default.nix
@@ -34,7 +34,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "perplexityai";
-  version = "0.38.0";
+  version = "0.39.0";
  pyproject = true;
  __structuredAttrs = true;

@@ -42,7 +42,7 @@ buildPythonPackage (finalAttrs: {
    owner = "perplexityai";
    repo = "perplexity-py";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Yp5A3aoKtAjWRPZ1Un2OYwezZohWirNm2JhAWLhd6uQ=";
+    hash = "sha256-2uBWvur6R7i1Y8oT2MTac1j+f/UMEmdbaKowDbrc0pA=";
  };

  # Can't use relaxPythonDeps as this is a version lock in the build system
--- a/pkgs/development/python-modules/pymc/default.nix
+++ b/pkgs/development/python-modules/pymc/default.nix
@@ -22,7 +22,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "pymc";
-  version = "6.0.0";
+  version = "6.1.0";
  pyproject = true;
  __structuredAttrs = true;

@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
    owner = "pymc-devs";
    repo = "pymc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-djioOgEtfKxXcbxYJGjPjCQOxcXi54xXNowJJhUWjE4=";
+    hash = "sha256-veJ42myRo23JXh33qC1OXxiGVI0VAARuYKVs7ObFr+Q=";
  };

  build-system = [
--- a/pkgs/development/python-modules/pytensor/default.nix
+++ b/pkgs/development/python-modules/pytensor/default.nix
@@ -33,7 +33,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "pytensor";
-  version = "3.0.7";
+  version = "3.1.2";
  pyproject = true;
  __structuredAttrs = true;

@@ -44,7 +44,7 @@ buildPythonPackage (finalAttrs: {
    postFetch = ''
      sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${finalAttrs.src.tag})"/' $out/pytensor/_version.py
    '';
-    hash = "sha256-/ECRFuRSTXZtBD8EUY3dg0Z4SxLG1+7DzHSWFSAnsoU=";
+    hash = "sha256-kKfbVSWsaA9ytii4GXeEmE+Oq8Qi7QNUOozgemqJI+k=";
  };

  build-system = [
--- a/pkgs/development/python-modules/pytest-responses/default.nix
+++ b/pkgs/development/python-modules/pytest-responses/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "pytest-responses";
-  version = "0.5.1";
+  version = "0.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "pytest-responses";
    tag = version;
-    hash = "sha256-6QAiNWCJbo4rmaByrc8VNw39/eF3uqFOss3GJuCvpZg=";
+    hash = "sha256-sn11MX5nab6dDhgZkV/cy4yGnOhB2MyrC+l/RGKEU/8=";
  };

  build-system = [ setuptools ];
--- a/Show More
+++ b/Show More