Merge master into staging-nixos

2026-08-25 17:55:21 +00:00 · 2026-08-22 12:06:20 +00:00
parent 6064079a0b 8cbc9a45c5
commit b52fcf751b
88 changed files with 1711 additions and 1109 deletions
--- a/nixos/doc/manual/development/settings-options.section.md
+++ b/nixos/doc/manual/development/settings-options.section.md
@@ -291,10 +291,17 @@ have a predefined type and string generator already declared under
    and returning a set with JSON-specific attributes `type` and
    `generate` as specified [below](#pkgs-formats-result).

-`pkgs.formats.yaml` { }
+`pkgs.formats.yaml` { *`tags`* ? false }

-:   A function taking an empty attribute set (for future extensibility)
-    and returning a set with YAML-specific attributes `type` and
+:   A function taking an attribute set with values
+
+    `tags`
+
+    :   A boolean for controlling whether YAML tags can be generated.
+        If set, attribute sets with a single key that starts with a "!"
+        will be interpreted as a YAML tag.
+
+    It returns a set with YAML-specific attributes `type` and
    `generate` as specified [below](#pkgs-formats-result).

 `pkgs.formats.ini` { *`listsAsDuplicateKeys`* ? false, *`listToValue`* ? null, \.\.\. }
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -258,6 +258,8 @@

 - `services.gitlab.registry` now uses PostgreSQL as database storage for new installations and supports old installations that use the filesystem as metadata storage. It creates the required PostgreSQL database and user. Users can manually migrate their filesystem based metadata storage. See [GitLab Container Registry Migration to database metadata store](#module-services-gitlab-registry-database-migration).

+- `services.fail2ban` now supports systemd socket activation via `fail2ban.socket`
+
 - Enabling [`services.userborn`](#opt-services.userborn.enable) on a system that was previously managed by the default `update-users-groups.pl` script now imports the legacy state from `/var/lib/nixos/` on the first switch. Locked stub entries are added to `/etc/passwd` and `/etc/group` for every name recorded in `uid-map`/`gid-map` that no longer has a live entry, so a previously-used UID/GID cannot be reassigned to a different user. Subordinate id ranges recorded in `auto-subuid-map` are seeded into the subid files as well. If the import fails, userborn does not start and the user database is left untouched. Inspect `journalctl -u userborn-import-legacy.service`, fix or remove the legacy state, and switch again. The import can be skipped entirely with [`services.userborn.importLegacyState`](#opt-services.userborn.importLegacyState)` = false`.

 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
--- a/nixos/modules/services/security/fail2ban.nix
+++ b/nixos/modules/services/security/fail2ban.nix
@@ -400,12 +400,8 @@ in
        # Security
        NoNewPrivileges = true;
        # Directory
-        RuntimeDirectory = "fail2ban";
        RuntimeDirectoryMode = "0750";
-        StateDirectory = "fail2ban";
        StateDirectoryMode = "0750";
-        LogsDirectory = "fail2ban";
-        LogsDirectoryMode = "0750";
        # Sandboxing
        ProtectSystem = "strict";
        ProtectHome = true;
@@ -417,6 +413,10 @@ in
        ProtectControlGroups = true;
      };
    };
+    systemd.sockets.fail2ban.wantedBy = [
+      "sockets.target"
+      "fail2ban.service"
+    ];

    # Defaults for the daemon settings
    services.fail2ban.daemonSettings.Definition = {
--- a/nixos/tests/fail2ban.nix
+++ b/nixos/tests/fail2ban.nix
@@ -2,7 +2,7 @@
 {
  name = "fail2ban";

-  nodes.machine = _: {
+  nodes.machine = { ... }: {
    services.fail2ban = {
      enable = true;
      bantime-increment.enable = true;
@@ -11,7 +11,7 @@
    networking.nftables.enable = true;
  };

-  nodes.client = _: {
+  nodes.client = { pkgs, ... }: {
    environment.systemPackages = [
      pkgs.sshpass
      pkgs.netcat
@@ -31,16 +31,41 @@
    client_addr = "2001:db8:1::1"
    machine_addr = "2001:db8:1::2"

+    # Verify that querying the version works
+    clientVersion = machine.succeed("fail2ban-client -V").rstrip()
+    t.assertEqual(clientVersion, "${pkgs.fail2ban.version}")
+    serverVersion = machine.succeed("fail2ban-server -V").rstrip()
+    t.assertEqual(serverVersion, "${pkgs.fail2ban.version}")
+
+    # Verify that fail2ban-client can communicate with the server
+    machine.succeed("fail2ban-client ping")
+
    # Verify there is not ban and the port is reachable from the client.
    machine.succeed(f"test 0 -eq $(fail2ban-client get sshd banned {client_addr})")
    client.succeed(f"nc -w3 -z {machine_addr} 22")

-    # Cause authentication failure log entries.
-    for _ in range(2):
-      client.fail(f"sshpass -p 'wrongpassword' ssh -o StrictHostKeyChecking=no {machine_addr}")
+    # Cause authentication failure log entries (detach second command since ban may cause timeout).
+    client.fail(f"sshpass -p 'wrongpassword' ssh -o StrictHostKeyChecking=no {machine_addr}")
+    client.execute(f"sshpass -p 'wrongpassword' ssh -o StrictHostKeyChecking=no {machine_addr} >&2 &")

    # Verify there is a ban and the port is unreachable from the client.
    machine.wait_until_succeeds(f"test 1 -eq $(fail2ban-client get sshd banned {client_addr})")
    client.fail(f"nc -w3 -z {machine_addr} 22")
+
+    # Verify that unbanning works
+    machine.succeed(f"fail2ban-client unban {client_addr}")
+    client.succeed(f"nc -w3 -z {machine_addr} 22")
+
+    # Verify that fail2ban-regex works
+    regex = r"^matching log entry: <HOST>$"
+    line = "matching log entry: 1.2.3.4"
+    matches = machine.succeed(f"fail2ban-regex -o matches '{line}' '{regex}'")
+    t.assertIn(line, matches)
+
+    # Verify that socket activation works
+    machine.succeed("systemctl stop fail2ban.service")
+    machine.fail("systemctl --quiet is-active fail2ban.service")
+    machine.succeed("fail2ban-client ping")
+    machine.succeed("systemctl --quiet is-active fail2ban.service")
  '';
 }
--- a/nixos/tests/jool.nix
+++ b/nixos/tests/jool.nix
@@ -71,6 +71,7 @@ in
        ];
      };

+      boot.kernelPackages = pkgs.linuxPackages_latest;
      networking.jool.enable = true;
      networking.jool.siit.default.global.pool6 = "fd::/96";
    };
@@ -191,6 +192,7 @@ in
        ];
      };

+      boot.kernelPackages = pkgs.linuxPackages_latest;
      networking.jool.enable = true;
      networking.jool.nat64.default = {
        bib = [
@@ -206,17 +208,17 @@ in
          {
            protocol = "TCP";
            prefix = "203.0.113.1/32";
-            "port range" = "40001-65535";
+            "port range" = "20000-29999";
          }
          {
            protocol = "UDP";
            prefix = "203.0.113.1/32";
-            "port range" = "40001-65535";
+            "port range" = "20000-29999";
          }
          {
            protocol = "ICMP";
            prefix = "203.0.113.1/32";
-            "port range" = "40001-65535";
+            "port range" = "20000-29999";
          }
          # Ports for static BIB entries
          {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -607,13 +607,13 @@
    "vendorHash": "sha256-n3+BGx8n1kN+kxg2tW90GGJ8zc7uXa/7morRuFXzwhY="
  },
  "hashicorp_http": {
-    "hash": "sha256-5zZSKmlhSuIaIiXUZhmTCFwfJ/3QxdDOg4RVooY7qcA=",
+    "hash": "sha256-1cdwtFS/nEbYk/F+uk5sTuLBCC+jcHbEMFppC93nrJE=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/http",
    "owner": "hashicorp",
    "repo": "terraform-provider-http",
-    "rev": "v3.6.0",
+    "rev": "v3.6.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-hh0tOG9HY0cWTda5vjpGwCGntD7I/wCJf6B92EMKRrQ="
+    "vendorHash": "sha256-m0KwW01xH4IIbg0eSnqVQOzGJ8UzMJB2AR6l/WuNbIs="
  },
  "hashicorp_kubernetes": {
    "hash": "sha256-B/BPhNlQytohgRWdO4oA1FcB8zneVieXlOqYzr+HJX4=",
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@@ -98,13 +98,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "obs-studio";
-  version = "32.1.2";
+  version = "32.2.1";

  src = fetchFromGitHub {
    owner = "obsproject";
    repo = "obs-studio";
    rev = finalAttrs.version;
-    hash = "sha256-9i7wLHpKqbcYzPlzSMF4xEpsTINQnVDPtneLJaSM+/I=";
+    hash = "sha256-MpwywBxZvj7rUIt7eu1KMLdFt/1B0es7ug/t+J26Jz8=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/ad/adpathfinder/package.nix
+++ b/pkgs/by-name/ad/adpathfinder/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  python3Packages,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "adpathfinder";
+  version = "1.2.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "NetSPI";
+    repo = "AD-PathFinder";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UZMULUs/0zm7iU7nh5E3z1oKHRMmUG6pYsYudNWaL/E=";
+  };
+
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
+    argcomplete
+    beautifulsoup4
+    colorama
+    neo4j
+    prompt-toolkit
+    requests
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Attack path mapping for Active Directory, ADCS, SCCM and MSSQL";
+    homepage = "https://github.com/NetSPI/AD-PathFinder";
+    changelog = "https://github.com/NetSPI/AD-PathFinder/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "adpathfinder";
+  };
+})
--- a/pkgs/by-name/am/amd-libflame/package.nix
+++ b/pkgs/by-name/am/amd-libflame/package.nix
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "amd-libflame";
-  version = "5.1";
+  version = "5.3.2";

  src = fetchFromGitHub {
    owner = "amd";
    repo = "libflame";
    tag = finalAttrs.version;
-    hash = "sha256-9Z0e6RCJfqQlq3oT4fBu8rwPH1OWEKQ52rVDa0Y0rJU=";
+    hash = "sha256-Zl9qw8pb2z7+SKJujHg3/NVt0m2gdmFE6cVXS7wGzAI=";
  };

  postPatch = ''
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@@ -16,12 +16,12 @@

 let
  pname = "autobrr";
-  version = "1.83.0";
+  version = "1.84.0";
  src = fetchFromGitHub {
    owner = "autobrr";
    repo = "autobrr";
    tag = "v${version}";
-    hash = "sha256-zVhrQrsv7+qLAGGYCSIcalzZPbmKuUVbgBpubzFuz04=";
+    hash = "sha256-LogNcJO4Zasi0tareJzlNv/xPgN65e8HkdUZOC279PE=";
  };

  autobrr-web = stdenvNoCC.mkDerivation {
@@ -46,7 +46,7 @@ let
        ;
      pnpm = pnpm_11;
      fetcherVersion = 4;
-      hash = "sha256-sb4nRsQQnf/j7BTKb5h1joDnV5OSTuY6Omjzaz8f+k4=";
+      hash = "sha256-wTbdQ3Stp4Wp0a89Bb+2uwCo78xuAi8JMpjPk501wXw=";
    };

    postBuild = ''
@@ -65,7 +65,7 @@ buildGoModule (finalAttrs: {
    src
    ;

-  vendorHash = "sha256-WOf3MCqRCGqR2BJ8CV3o/zl/AYVgaTYVDPC9cFw+8rs=";
+  vendorHash = "sha256-mf6luYjIelHYf0TtidY/S5wplIIUqUpadt8DvPq9154=";

  preBuild = ''
    cp -r ${finalAttrs.passthru.autobrr-web}/* web/dist
--- a/pkgs/by-name/aw/awakened-poe-trade/package.nix
+++ b/pkgs/by-name/aw/awakened-poe-trade/package.nix
@@ -13,11 +13,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "awakened-poe-trade";
-  version = "3.29.103";
+  version = "3.29.104";

  src = fetchurl {
    url = "https://github.com/SnosMe/awakened-poe-trade/releases/download/v${finalAttrs.version}/Awakened-PoE-Trade-${finalAttrs.version}.AppImage";
-    hash = "sha256-Nxq9b58nmpvXs3xKWYi0IpI9QyYbrLPWJplA1l6hKzE=";
+    hash = "sha256-ApZwjy1tJwUtevLA7QY8/zrnHI5Tt4aXMpTo+5VWGUg=";
  };

  passthru = {
--- a/pkgs/by-name/b3/b3sum/package.nix
+++ b/pkgs/by-name/b3/b3sum/package.nix
@@ -7,14 +7,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "b3sum";
-  version = "1.8.5";
+  version = "1.8.6";

  src = fetchCrate {
    inherit (finalAttrs) version pname;
-    hash = "sha256-odlO6J60wTrca+opzheDbz4lSDAgjDTFFUIHf6NoTXI=";
+    hash = "sha256-VWYsN/kNK/aR/Qc9nsTaXuJMO4PNBNOT6cfzwleKhD0=";
  };

-  cargoHash = "sha256-a/KGCU0bZ1gqB8EH7f8SN6qTuYZMakXdqddtTKNVDPs=";
+  cargoHash = "sha256-KOzFTLgbmrzUV5KmqJV9N7GUsUhaM3cwSxi/WlkeQBM=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/ba/bant/package.nix
+++ b/pkgs/by-name/ba/bant/package.nix
@@ -20,13 +20,13 @@ let
 in
 buildBazelPackage rec {
  pname = "bant";
-  version = "0.3.4";
+  version = "0.3.5";

  src = fetchFromGitHub {
    owner = "hzeller";
    repo = "bant";
    rev = "v${version}";
-    hash = "sha256-sS907wkF1QN10FRSJZ9LBqHT1Z5z2BWIjXkneQT6h0Y=";
+    hash = "sha256-q22VdLYtCpVG1zNqOCeii+qB3uEYL18INMALJpS0W1o=";
  };

  bazelFlags = [
--- a/pkgs/by-name/bu/budgie-control-center/package.nix
+++ b/pkgs/by-name/bu/budgie-control-center/package.nix
@@ -20,12 +20,12 @@
  gst_all_1,
  gnome-desktop,
  gnome-settings-daemon,
+  gnome-tecla,
  gsettings-desktop-schemas,
  gsound,
  gtk3,
  ibus,
  libepoxy,
-  libgnomekbd,
  libgtop,
  libgudev,
  libhandy,
@@ -68,14 +68,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "budgie-control-center";
-  version = "2.1.2";
+  version = "2.1.3";

  src = fetchFromGitHub {
    owner = "BuddiesOfBudgie";
    repo = "budgie-control-center";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-y/3qXIn8HI4S7K02ovZGT4ec/KJ93k/U82g4Rw3ZJQA=";
+    hash = "sha256-zxhMRmRfwBX8a7T0G4hq+zf3xVyryOiCYSOl4BbSObc=";
  };

  patches = [
@@ -83,7 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
      budgie_desktop = budgie-desktop;
      inherit
        cups
-        libgnomekbd
        shadow
        ;
      inherit networkmanagerapplet tzdata;
@@ -111,6 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
    glib
    glib-networking
    gnome-desktop
+    gnome-tecla
    gst_all_1.gstreamer
    gnome-settings-daemon
    gsettings-desktop-schemas
--- a/pkgs/by-name/bu/budgie-control-center/paths.patch
+++ b/pkgs/by-name/bu/budgie-control-center/paths.patch
@@ -37,32 +37,6 @@ index 25cda02d3..db664bc56 100644
                             &contents,
                             &length,
                             &error))
-diff --git a/panels/keyboard/cc-input-list-box.c b/panels/keyboard/cc-input-list-box.c
-index 191207490..37e0fddc2 100644
--- a/panels/keyboard/cc-input-list-box.c
-+++ b/panels/keyboard/cc-input-list-box.c
-@@ -62,7 +62,7 @@ struct _CcInputListBox {
- };
- 
- G_DEFINE_TYPE (CcInputListBox, cc_input_list_box, GTK_TYPE_LIST_BOX)
- 
-+
- typedef struct
- {
-   CcInputListBox *panel;
-@@ -223,10 +223,10 @@ row_layout_cb (CcInputListBox *self,
-   layout_variant = cc_input_source_get_layout_variant (source);
- 
-   if (layout_variant && layout_variant[0])
-    commandline = g_strdup_printf ("gkbd-keyboard-display -l \"%s\t%s\"",
-+    commandline = g_strdup_printf ("@libgnomekbd@/bin/gkbd-keyboard-display -l \"%s\t%s\"",
- 				   layout, layout_variant);
-   else
-    commandline = g_strdup_printf ("gkbd-keyboard-display -l %s",
-+    commandline = g_strdup_printf ("@libgnomekbd@/bin/gkbd-keyboard-display -l %s",
- 				   layout);
- 
-   g_spawn_command_line_async (commandline, NULL);
 diff --git a/panels/network/connection-editor/net-connection-editor.c b/panels/network/connection-editor/net-connection-editor.c
 index 505b8ee25..62e94009f 100644
 --- a/panels/network/connection-editor/net-connection-editor.c
--- a/pkgs/by-name/bu/bugstalker/package.nix
+++ b/pkgs/by-name/bu/bugstalker/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "bugstalker";
-  version = "0.4.1";
+  version = "0.4.7";

  src = fetchFromGitHub {
    owner = "godzie44";
    repo = "BugStalker";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-9l6IVQBjZkpSS28ai/d27JUPBWj2Q17RVhsFrrI45TM=";
+    hash = "sha256-AAeSvy/rvyylPH2jTVBGN95QIc6gumREQYuruhRo2ZI=";
  };

-  cargoHash = "sha256-+VvKWY9CqUUkDKzG2nLG9ibkE6xwP3StTzlovBZH8O8=";
+  cargoHash = "sha256-GGi5hnrK5WpvnXHNckpsBch/SJ4lDvH7peSlrCdk218=";

  # Tests require rustup.
  doCheck = false;
--- a/pkgs/by-name/cb/cbmc/package.nix
+++ b/pkgs/by-name/cb/cbmc/package.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cbmc";
-  version = "6.10.0";
+  version = "6.11.0";

  src = fetchFromGitHub {
    owner = "diffblue";
    repo = "cbmc";
    tag = "cbmc-${finalAttrs.version}";
-    hash = "sha256-GCagpb2TFhOEH+lzMth+PWiJxlEw0L+H1DYUEQoMF3g=";
+    hash = "sha256-GHpgcGBE/AAhTVxGVzTPMdZ8BkuXa7/OgMumZJ8ENRc=";
  };

  srcglucose = fetchFromGitHub {
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -29,18 +29,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "codex";
-  version = "0.147.0";
+  version = "0.149.0";

  src = fetchFromGitHub {
    owner = "openai";
    repo = "codex";
    tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-NKeOxp9vLcx7tpghqhpS3ocPqUDP2PircNwkJNpHBPo=";
+    hash = "sha256-SMVTW/CcGz4xxyeFe3KUf3Ns6jp+2SRMTvtA2o2+y7Q=";
  };

  sourceRoot = "${finalAttrs.src.name}/codex-rs";

-  cargoHash = "sha256-MJuM2QLxvL+r/Gw8QXLjtsLS25QGVCqcqU5GJssSoQ4=";
+  cargoHash = "sha256-K58PL588Hhk75FyXgU6b8IEAco8FIz8oGd1S0WgOjyQ=";

  __structuredAttrs = true;

--- a/pkgs/by-name/da/dataform/package-lock.json
+++ b/pkgs/by-name/da/dataform/package-lock.json
@@ -1,12 +1,12 @@
 {
    "name": "@dataform/cli",
-    "version": "3.0.64",
+    "version": "3.0.65",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
        "": {
            "name": "@dataform/cli",
-            "version": "3.0.64",
+            "version": "3.0.65",
            "license": "Apache-2.0",
            "dependencies": {
                "@google-cloud/bigquery": "~8.3.0",
--- a/pkgs/by-name/da/dataform/package.nix
+++ b/pkgs/by-name/da/dataform/package.nix
@@ -13,7 +13,7 @@

 buildNpmPackage (finalAttrs: {
  pname = "dataform";
-  version = "3.0.64";
+  version = "3.0.65";

  __structuredAttrs = true;
  strictDeps = true;
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {

  src = fetchurl {
    url = "https://registry.npmjs.org/@dataform/cli/-/cli-${finalAttrs.version}.tgz";
-    hash = "sha256-ump4LsQzxkSsRzbBbJA4XxHW0C2abhfG+Wf10EZLt5g=";
+    hash = "sha256-Xs370Tq4vMUC2b4xxcv4U5Qmh1JrqpARaz7n/peBYcw=";
  };

  # Inject the locally committed lockfile into the extracted source
@@ -30,7 +30,7 @@ buildNpmPackage (finalAttrs: {
    cp ${./package-lock.json} package-lock.json
  '';

-  npmDepsHash = "sha256-2Uzh78D9KQzJSpDYOSi2DmJBeKqXbZpLYXlSy+a3Bs4=";
+  npmDepsHash = "sha256-WhungUwY5egN8hcpffmh4hvLcjJ34Ph6hkxR6mmelnk=";

  dontNpmBuild = true;

--- a/pkgs/by-name/ed/edk2/package.nix
+++ b/pkgs/by-name/ed/edk2/package.nix
@@ -37,14 +37,14 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "edk2";
-  version = "202605";
+  version = "202608";

  srcWithVendoring = fetchFromGitHub {
    owner = "tianocore";
    repo = "edk2";
    tag = "edk2-stable${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-sUqLocdX7lxN2pEdn84Cjh8pOzYqIeKqO144XhwKA30=";
+    hash = "sha256-LRq5SGAcqMl9PlSaV/Q2qE1HLMXHghozwgZP4A3FCts=";
  };

  src = applyPatches {
--- a/pkgs/by-name/en/engrampa/package.nix
+++ b/pkgs/by-name/en/engrampa/package.nix
@@ -24,14 +24,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "engrampa";
-  version = "1.28.3";
+  version = "1.28.5";

  src = fetchFromGitHub {
    owner = "mate-desktop";
    repo = "engrampa";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-bmqCsbGz49wda1sMiAvG3XTGpFEwMvDx8ojuzxZ9MAI=";
+    hash = "sha256-v23uDb9WC7t0fIAGK20z+7I3NzbgWPH+POuE28jBfSk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ex/exim/package.nix
+++ b/pkgs/by-name/ex/exim/package.nix
@@ -39,11 +39,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "exim";
-  version = "4.99.5";
+  version = "4.100";

  src = fetchurl {
    url = "https://ftp.exim.org/pub/exim/exim4/exim-${finalAttrs.version}.tar.xz";
-    hash = "sha256-wtL4Ctx8cdQk/YKkZlXqotfZtMoud4g+upB2lHt+5ic=";
+    hash = "sha256-W9Cj41Pb/NXIF0OIuCQxamHuJFXZBS6i8Id97pOdM7M=";
  };

  enableParallelBuilding = true;
@@ -205,6 +205,6 @@ stdenv.mkDerivation (finalAttrs: {
      helsinki-Jo
      tv
    ];
-    changelog = "https://github.com/Exim/exim/blob/exim-${finalAttrs.version}/doc/doc-txt/ChangeLog";
+    changelog = "https://code.exim.org/exim/exim/releases/tag/exim-${finalAttrs.version}";
  };
 })
--- a/pkgs/by-name/fa/fail2ban/package.nix
+++ b/pkgs/by-name/fa/fail2ban/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  python3,
  installShellFiles,
  nixosTests,
@@ -57,6 +58,16 @@ python3.pkgs.buildPythonApplication (finalAttrs: {

  doCheck = false;

+  patches = [
+    # fixes for systemd socket activation - remove next release
+    (fetchpatch {
+      url = "https://github.com/fail2ban/fail2ban/commit/403df4a91c8ad8f235a3cb9e17d0cc4d29c2dafd.patch";
+      hash = "sha256-HI/9qaB+TMbRu/2NPwV+kVcYK03YNnzcD+iaBOlM20w=";
+      # causes merge conflicts
+      excludes = [ "ChangeLog" ];
+    })
+  ];
+
  preInstall = ''
    substituteInPlace setup.py --replace /usr/share/doc/ share/doc/

--- a/pkgs/by-name/fr/froide/package.nix
+++ b/pkgs/by-name/fr/froide/package.nix
@@ -8,14 +8,14 @@
  geos,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
  nodejs,
  postgresql,
  postgresqlTestHook,
  playwright-driver,
 }:
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;

  python = python3Packages.python.override {
    packageOverrides = self: super: {
@@ -40,26 +40,20 @@ let
  };

 in
-python.pkgs.buildPythonApplication rec {
+python.pkgs.buildPythonApplication (finalAttrs: {
  pname = "froide";
-  version = "0-unstable-2025-09-10";
+  version = "0-unstable-2026-08-19";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "okfde";
    repo = "froide";
-    rev = "826415bbc402c3b71c62477f5eed112787169c95";
-    hash = "sha256-K9TMtDfYP6v/lbL7SXeHBa6EngK+fsHgU13C1hat/K0=";
+    rev = "a83f2c28e96f15c55f3009cdadbf2a8fcf17fda8";
+    hash = "sha256-hC/CfKh8PTuDiB8PvjdpbOjEVLwVGyR4lxBBcm9vcRg=";
  };

  patches = [ ./django_42_storages.patch ];

-  # Relax dependency pinning
-  # Channels: https://github.com/okfde/froide/issues/995
-  pythonRelaxDeps = [
-    "channels"
-  ];
-
  build-system = [ python.pkgs.setuptools ];

  nativeBuildInputs = [
@@ -81,6 +75,7 @@ python.pkgs.buildPythonApplication rec {
    django-contrib-comments
    django-crossdomainmedia
    django-elasticsearch-dsl
+    django-extended-makemessages
    django-filingcabinet
    django-filter
    django-json-widget
@@ -121,14 +116,13 @@ python.pkgs.buildPythonApplication rec {
  ];

  pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit (finalAttrs)
      pname
      version
      src
-      pnpm
      ;
-    fetcherVersion = 3;
-    hash = "sha256-NbfCVD+gmtoxuYUCumTKj9P72utK787VdlnuU4lMMGc=";
+    fetcherVersion = 4;
+    hash = "sha256-+ywpcwF4H2s6s+ls71S+sy6l3gikz62haXCBuI4z+f4=";
  };

  postBuild = ''
@@ -138,7 +132,7 @@ python.pkgs.buildPythonApplication rec {
  postInstall = ''
    cp -r build manage.py $out/${python.sitePackages}/froide/
    makeWrapper $out/${python.sitePackages}/froide/manage.py $out/bin/froide \
-      --prefix PYTHONPATH : "${python3Packages.makePythonPath dependencies}" \
+      --prefix PYTHONPATH : "${python3Packages.makePythonPath finalAttrs.passthru.dependencies}" \
      --set GDAL_LIBRARY_PATH "${gdal}/lib/libgdal.so" \
      --set GEOS_LIBRARY_PATH "${geos}/lib/libgeos_c.so"
  '';
@@ -148,6 +142,7 @@ python.pkgs.buildPythonApplication rec {
    postgresqlTestHook
    pytest-django
    pytest-playwright
+    pytest-xdist
    pytestCheckHook
  ];

@@ -184,6 +179,21 @@ python.pkgs.buildPythonApplication rec {
    # Test hangs
    "test_collapsed_menu"
    "test_make_request_logged_out_with_existing_account"
+    # Requires live Elasticsearch on localhost:9200
+    "test_campaign_request_match_live"
+    "test_make_request_submit_multiple_times"
+    "test_edit_request_boilerplate"
+    "test_skip_search_similar"
+    "test_list_hide_project_duplicates_filter"
+    # pytest-asyncio/pytest-playwright event-loop
+    # incompatibility on Python 3.14 (RuntimeError: Runner.run()
+    "test_redaction"
+    # redaction regex doesn't match
+    # German "/anfrage/" URL path segment, only "/request/" and "/r/"
+    "test_redaction_urls"
+    # migration bug — changing LANGUAGES/LANGUAGE_CODE
+    # triggers an unwanted migration on foilawtranslation's unique
+    "test_no_migration_needed_when_languages_change"
  ];

  preCheck = ''
@@ -211,4 +221,4 @@ python.pkgs.buildPythonApplication rec {
    maintainers = [ lib.maintainers.onny ];
    mainProgram = "froide";
  };
-}
+})
--- a/pkgs/by-name/ft/ftxui/package.nix
+++ b/pkgs/by-name/ft/ftxui/package.nix
@@ -4,7 +4,6 @@
  fetchFromGitHub,

  cmake,
-  doxygen,
  gbenchmark,
  graphviz,
  gtest,
@@ -12,21 +11,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ftxui";
-  version = "6.1.9";
+  version = "7.0.3";

  src = fetchFromGitHub {
    owner = "ArthurSonzogni";
    repo = "ftxui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-plJxTLhOhUyuay5uYv4KLK9UTmM2vsoda+iDXVa4b+k=";
+    hash = "sha256-hKdmzraAgKwvOGQXpglD9lm0465j92AAn2MhS9ZM4jA=";
  };

  strictDeps = true;

  nativeBuildInputs = [
    cmake
-    doxygen
-    graphviz
  ];

  checkInputs = [
@@ -37,8 +34,6 @@ stdenv.mkDerivation (finalAttrs: {
  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

  cmakeFlags = [
-    (lib.cmakeBool "FTXUI_BUILD_EXAMPLES" false)
-    (lib.cmakeBool "FTXUI_BUILD_DOCS" true)
    (lib.cmakeBool "FTXUI_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
  ];

--- a/pkgs/by-name/ge/getsploit/package.nix
+++ b/pkgs/by-name/ge/getsploit/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  python3Packages,
+  versionCheckHook,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "getsploit";
+  version = "3.0.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "vulnersCom";
+    repo = "getsploit";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7rmSy5byVFYa8SPmdzS+eux6IPEgxKp3VOXOQGgCRjU=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.11.29,<0.12" "uv_build"
+  '';
+
+  pythonRelaxDeps = [ "rich" ];
+
+  build-system = with python3Packages; [ uv-build ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  dependencies = with python3Packages; [
+    click
+    detect-secrets
+    rich
+    vulners
+  ];
+
+  doInstallCheck = true;
+
+  pythonImportsCheck = [ "getsploit" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Search and download public exploits from the Vulners database";
+    homepage = "https://github.com/vulnersCom/getsploit";
+    changelog = "https://github.com/vulnersCom/getsploit/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "getsploit";
+  };
+})
--- a/pkgs/by-name/go/gogcli/package.nix
+++ b/pkgs/by-name/go/gogcli/package.nix
@@ -7,31 +7,31 @@

 buildGoModule (finalAttrs: {
  pname = "gogcli";
-  version = "0.29.0";
+  version = "0.36.0";

  src = fetchFromGitHub {
    owner = "openclaw";
    repo = "gogcli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JunPpEzbNp00uEiJ7AzouXyzFwyNLehLU7mwL3eh4bM=";
+    hash = "sha256-7XfjpAzUHH1VUJzgllKa/4GvQZhTCX8TePTXRB+oJRE=";
  };

-  vendorHash = "sha256-JrRIUYpw2lAD0ezi0HTZvS42OS7vP8DAHU3m0u3eCbM=";
+  vendorHash = "sha256-+Nbuwok3dY/82gUDKeGgrC0F1ZqXSW8IpV6Q1yzIPvo=";

  subPackages = [ "cmd/gog" ];

  ldflags = [
    "-s"
    "-w"
-    "-X github.com/steipete/gogcli/internal/cmd.version=v${finalAttrs.version}"
-    "-X github.com/steipete/gogcli/internal/cmd.commit=${finalAttrs.src.rev}"
-    "-X github.com/steipete/gogcli/internal/cmd.date=1970-01-01T00:00:00Z"
+    "-X github.com/openclaw/gogcli/internal/cmd.version=v${finalAttrs.version}"
+    "-X github.com/openclaw/gogcli/internal/cmd.commit=${finalAttrs.src.rev}"
+    "-X github.com/openclaw/gogcli/internal/cmd.date=1970-01-01T00:00:00Z"
  ];

  passthru.tests.version = testers.testVersion {
    package = finalAttrs.finalPackage;
    command = "gog --version";
-    version = "v${finalAttrs.version}";
+    version = "v${finalAttrs.version} (${finalAttrs.src.rev} 1970-01-01T00:00:00Z)";
  };

  meta = {
--- a/pkgs/by-name/gr/graphify/package.nix
+++ b/pkgs/by-name/gr/graphify/package.nix
@@ -8,14 +8,14 @@
 python3Packages.buildPythonApplication rec {
  __structuredAttrs = true;
  pname = "graphify";
-  version = "0.9.28";
+  version = "0.9.42";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Graphify-Labs";
    repo = "graphify";
    tag = "v${version}";
-    hash = "sha256-iu/ARF1ylyrDUWke70kLpji4azfIeBSDSQ6uS+CKYiw=";
+    hash = "sha256-QXdjA+xSgh6I+A2snvlaigHG2FQJWoFWIYQJfCmshGQ=";
  };

  build-system = [
--- a/pkgs/by-name/he/hedgewars/package.nix
+++ b/pkgs/by-name/he/hedgewars/package.nix
@@ -9,6 +9,7 @@
  libglut,
  lib,
  fetchurl,
+  fetchpatch,
  cmake,
  pkg-config,
  lua5_1,
@@ -51,6 +52,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-xcGHfAuuE1THXSuVJ7b5qfeemZMuXQix9vfeFwgGYTA=";
  };

+  patches = [
+    (fetchpatch {
+      name = "hedgewars-ffmpeg-9.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/hedgewars/-/raw/1b03bb9764d38fa6020552174676a9e024d8b18e/ffmpeg-9.patch?inline=false";
+      hash = "sha256-J8W8WvQgcteKoUUVDxBINVhMzmec+UuWWltKZ2aq9Go=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
--- a/pkgs/by-name/js/json-tui/package.nix
+++ b/pkgs/by-name/js/json-tui/package.nix
@@ -1,7 +1,6 @@
 {
  lib,
  stdenv,
-  fetchpatch2,
  fetchFromGitHub,

  cmake,
@@ -16,23 +15,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "json-tui";
-  version = "1.4.1";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "ArthurSonzogni";
    repo = "json-tui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qS2EbCxH8sUUJMu5hwm1+Nu6SsJRfLReX56YSd1RZU4=";
+    hash = "sha256-PXiTlTwF/qL/Nq1PSf8PHgKa0MD6QrA0tSWiFfm93Gk=";
  };

-  patches = [
-    # fixes tests - https://github.com/ArthurSonzogni/json-tui/pull/37
-    (fetchpatch2 {
-      url = "https://github.com/ArthurSonzogni/json-tui/commit/645060a016c1e1ca84b9e1dc638a926415aaa5fe.patch?full_index=1";
-      hash = "sha256-8AZEZgU8HHyaasb/7LegSwRAMo1iyonv3XUY284nYKg=";
-    })
-  ];
-
  strictDeps = true;

  buildInputs = [
--- a/pkgs/by-name/me/mergiraf/package.nix
+++ b/pkgs/by-name/me/mergiraf/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mergiraf";
-  version = "0.18.0";
+  version = "0.19.0";

  src = fetchFromCodeberg {
    owner = "mergiraf";
    repo = "mergiraf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PfGiPH7CU8z+Flj3X04XnRdWcv5K+hTZMfvHpM52Fic=";
+    hash = "sha256-eBq7xNuV0Z6DVdgaKVgk07WmGEgu7k14hkvVWwtplOo=";
  };

-  cargoHash = "sha256-1MDjaaH2PcvQz0DKSTADRB+8YEUWP1GN2edHk4EDVGA=";
+  cargoHash = "sha256-dxTR5mvov5FvnkIZalDMnl99BH8sBx6EsqJyGRMiPfQ=";

  nativeCheckInputs = [
    git
--- a/pkgs/by-name/mi/miru/package.nix
+++ b/pkgs/by-name/mi/miru/package.nix
@@ -16,7 +16,7 @@
 stdenv.mkDerivation (finalAttrs: {

  pname = "miru";
-  version = "0.5.0";
+  version = "0.6.0";

  __structuredAttrs = true;
  strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "Vaishnav-Sabari-Girish";
    repo = "miru";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pByU5wszZG0eh8f85XvSly4jzFwskd+IvUH+yBQRMVA=";
+    hash = "sha256-5hXXeATCySNbGyvn5XVj9XyEgBfKfGHyM1bdJYw+RJE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ne/netbird/package.nix
+++ b/pkgs/by-name/ne/netbird/package.nix
@@ -73,13 +73,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "netbird-${componentName}";
-  version = "0.77.0";
+  version = "0.77.1";

  src = fetchFromGitHub {
    owner = "netbirdio";
    repo = "netbird";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w72ylRblfC20X4h1E7vuycWziLfWE+cCHuIaf7czFb8=";
+    hash = "sha256-uGyo2J/3berl6yBCs+Qy0mXKMZNRM8o6gclBeiDxon8=";
  };

  overrideModAttrs = final: prev: {
@@ -93,7 +93,7 @@ buildGoModule (finalAttrs: {
  };

  proxyVendor = true;
-  vendorHash = "sha256-kbVBjQUZUp9VZ67Ug4VWtmp2qZw5hLtxLg8utyNCNGg=";
+  vendorHash = "sha256-IGCfMhcrZqHye83zcJuDf1Hyv7X4rKybxWOiyxGuYtY=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/op/openobserve/package.nix
+++ b/pkgs/by-name/op/openobserve/package.nix
@@ -15,155 +15,212 @@
  versionCheckHook,
  buildNpmPackage,
  gitUpdater,
+  installShellFiles,
+  # Enterprise Edition ships only as a prebuilt binary
+  enableEnterprise ? false,
 }:

-rustPlatform.buildRustPackage (
-  finalAttrs:
-  let
-    web = buildNpmPackage {
-      inherit (finalAttrs) src version;
-      pname = "openobserve-ui";
-
-      sourceRoot = "${finalAttrs.src.name}/web";
-
-      npmDepsHash = "sha256-te8uABzndzLRb6GQVSn33aaleQau2U/xo8LnMynTtx0=";
-
-      preBuild = ''
-        # Patch vite config to not open the browser to visualize plugin composition
-        substituteInPlace vite.config.ts \
-          --replace "open: true" "open: false";
-      '';
-
-      env = {
-        NODE_OPTIONS = "--max-old-space-size=8192";
-        # cypress tries to download binaries otherwise
-        CYPRESS_INSTALL_BINARY = 0;
-      };
-
-      installPhase = ''
-        runHook preInstall
-        mkdir -p $out/share
-        mv dist $out/share/openobserve-ui
-        runHook postInstall
-      '';
-    };
-  in
-  {
-    pname = "openobserve";
-    version = "0.91.5";
-
-    src = fetchFromGitHub {
-      owner = "openobserve";
-      repo = "openobserve";
-      tag = "v${finalAttrs.version}";
-      hash = "sha256-3K6xaXFmhWY0ElqiFgR8mEi0XUVBF/cRNwONqLhniPc=";
-    };
-
-    patches = [
-      # prevent using git to determine version info during build time
-      ./build.rs.patch
+let
+  version = "0.91.5";
+  updateScript = gitUpdater {
+    rev-prefix = "v";
+    ignoredVersions = "rc";
+  };
+  commonMeta = {
+    description = "Cloud-native observability platform built specifically for logs, metrics, traces, analytics & realtime user-monitoring";
+    mainProgram = "openobserve";
+    maintainers = with lib.maintainers; [
+      happysalada
+      kashw2
    ];
+  };
+in

-    preBuild = ''
-      cp -r ${web}/share/openobserve-ui web/dist
+if enableEnterprise then
+  stdenv.mkDerivation (finalAttrs: {
+    pname = "openobserve-ee";
+    inherit version;
+    strictDeps = true;
+    __structuredAttrs = true;
+
+    src = fetchurl {
+      url = "https://downloads.openobserve.ai/releases/o2-enterprise/v${finalAttrs.version}/openobserve-ee-v${finalAttrs.version}-linux-amd64-musl.tar.gz";
+      hash = "sha256-DFhK180XeoSDC644kBqBUD35FtdSmQya2VbzxEh4iSM=";
+    };
+
+    # The tarball is a single flat `openobserve` binary.
+    sourceRoot = ".";
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    nativeBuildInputs = [ installShellFiles ];
+
+    installPhase = ''
+      runHook preInstall
+      installBin openobserve
+      runHook postInstall
    '';

-    cargoHash = "sha256-PIhHHEP9kJmliOGtom1gDf7wt5C4RicWKgQe0hkW+4M=";
-
-    nativeBuildInputs = [
-      pkg-config
-      protobuf
-    ];
-
-    buildInputs = [
-      bzip2
-      oniguruma
-      sqlite
-      xz
-      zlib
-      zstd
-    ];
-
-    env = {
-      RUSTONIG_SYSTEM_LIBONIG = true;
-      ZSTD_SYS_USE_PKG_CONFIG = true;
-
-      RUSTC_BOOTSTRAP = 1; # uses experimental features
-
-      # the patched build.rs file sets these variables
-      GIT_VERSION = finalAttrs.src.tag;
-      GIT_COMMIT_HASH = "builtByNix";
-      GIT_BUILD_DATE = "1970-01-01T00:00:00Z";
-
-      RUSTFLAGS = "-C target-feature=+aes,+sse2";
-
-      SWAGGER_UI_DOWNLOAD_URL =
-        # When updating:
-        # - Look for the version of `utoipa-swagger-ui` at:
-        #   https://github.com/StractOrg/stract/blob/<STRACT-REV>/Cargo.toml#L183
-        # - Look at the corresponding version of `swagger-ui` at:
-        #   https://github.com/juhaku/utoipa/blob/utoipa-swagger-ui-<UTOPIA-SWAGGER-UI-VERSION>/utoipa-swagger-ui/build.rs#L21-L22
-        let
-          swaggerUiVersion = "5.17.14";
-          swaggerUi = fetchurl {
-            url = "https://github.com/swagger-api/swagger-ui/archive/refs/tags/v${swaggerUiVersion}.zip";
-            hash = "sha256-SBJE0IEgl7Efuu73n3HZQrFxYX+cn5UU5jrL4T5xzNw=";
-          };
-        in
-        "file://${swaggerUi}";
-    };
-
-    # swagger-ui will once more be copied in the target directory during the check phase
-    # Not deleting the existing unpacked archive leads to a `PermissionDenied` error
-    preCheck = ''
-      rm -rf target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/build/
-    '';
-
-    # Skip doctests: upstream release build for v0.50.3 runs cargo build only,
-    # and the doctest examples currently fail due to async context.
-    cargoTestFlags = [
-      "--lib"
-      "--bins"
-      "--tests"
-      "--examples"
-    ];
-
-    # requires network access or filesystem mutations
-    checkFlags = [
-      "--skip=cli::basic::http::tests::test_node_operations_network_failure"
-      "--skip=cli::basic::http::tests::test_query_valid_time_range"
-      "--skip=common::meta::telemetry::test_telemetry::test_telemetry_send_track_event_without_base_info_or_zo_data"
-      "--skip=handler::http::router::tests::test_get_proxy_routes"
-      "--skip=tests::e2e_test"
-      "--skip=tests::test_setup_logs"
-      "--skip=handler::http::router::middlewares::compress::Compress"
-      "--skip=service::alerts::destinations::tests::test_alert_destination_requires_template"
-      "--skip=service::enrichment_table::url_processor"
-      "--skip=service::github"
-      "--skip=service::sourcemaps"
-      # Tests are not threadsafe. Most likely can only run one test at a time,
-      # due to altering shared database state.
-      # This option already in upstream code: https://github.com/openobserve/openobserve/pull/7084
-      # Also see: https://github.com/NixOS/nixpkgs/pull/457421
-      "--test-threads=1"
-    ];
-
    doInstallCheck = true;
    nativeInstallCheckInputs = [ versionCheckHook ];

-    passthru.updateScript = gitUpdater {
-      rev-prefix = "v";
-      ignoredVersions = "rc";
-    };
+    passthru.updateScript = updateScript;

-    meta = {
-      description = "Cloud-native observability platform built specifically for logs, metrics, traces, analytics & realtime user-monitoring";
-      homepage = "https://github.com/openobserve/openobserve";
-      changelog = "https://github.com/openobserve/openobserve/releases/tag/v${finalAttrs.version}";
-      license = lib.licenses.asl20;
-      maintainers = with lib.maintainers; [ happysalada ];
-      mainProgram = "openobserve";
-      platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    meta = commonMeta // {
+      homepage = "https://openobserve.ai/";
+      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      license = {
+        fullName = "OpenObserve Enterprise Edition License Agreement";
+        url = "https://openobserve.ai/legal/enterprise-license/";
+        free = false;
+        redistributable = false;
+      };
+      platforms = lib.intersectLists lib.platforms.x86_64 lib.platforms.linux;
    };
-  }
-)
+  })
+else
+  rustPlatform.buildRustPackage (
+    finalAttrs:
+    let
+      web = buildNpmPackage {
+        inherit (finalAttrs) src version;
+        pname = "openobserve-ui";
+
+        sourceRoot = "${finalAttrs.src.name}/web";
+
+        npmDepsHash = "sha256-te8uABzndzLRb6GQVSn33aaleQau2U/xo8LnMynTtx0=";
+
+        preBuild = ''
+          # Patch vite config to not open the browser to visualize plugin composition
+          substituteInPlace vite.config.ts \
+            --replace "open: true" "open: false";
+        '';
+
+        env = {
+          NODE_OPTIONS = "--max-old-space-size=8192";
+          # cypress tries to download binaries otherwise
+          CYPRESS_INSTALL_BINARY = 0;
+        };
+
+        installPhase = ''
+          runHook preInstall
+          mkdir -p $out/share
+          mv dist $out/share/openobserve-ui
+          runHook postInstall
+        '';
+      };
+    in
+    {
+      pname = "openobserve";
+      inherit version;
+
+      src = fetchFromGitHub {
+        owner = "openobserve";
+        repo = "openobserve";
+        tag = "v${finalAttrs.version}";
+        hash = "sha256-3K6xaXFmhWY0ElqiFgR8mEi0XUVBF/cRNwONqLhniPc=";
+      };
+
+      patches = [
+        # prevent using git to determine version info during build time
+        ./build.rs.patch
+      ];
+
+      preBuild = ''
+        cp -r ${web}/share/openobserve-ui web/dist
+      '';
+
+      cargoHash = "sha256-PIhHHEP9kJmliOGtom1gDf7wt5C4RicWKgQe0hkW+4M=";
+
+      nativeBuildInputs = [
+        pkg-config
+        protobuf
+      ];
+
+      buildInputs = [
+        bzip2
+        oniguruma
+        sqlite
+        xz
+        zlib
+        zstd
+      ];
+
+      env = {
+        RUSTONIG_SYSTEM_LIBONIG = true;
+        ZSTD_SYS_USE_PKG_CONFIG = true;
+
+        RUSTC_BOOTSTRAP = 1; # uses experimental features
+
+        # the patched build.rs file sets these variables
+        GIT_VERSION = finalAttrs.src.tag;
+        GIT_COMMIT_HASH = "builtByNix";
+        GIT_BUILD_DATE = "1970-01-01T00:00:00Z";
+
+        RUSTFLAGS = "-C target-feature=+aes,+sse2";
+
+        SWAGGER_UI_DOWNLOAD_URL =
+          # When updating:
+          # - Look for the version of `utoipa-swagger-ui` at:
+          #   https://github.com/StractOrg/stract/blob/<STRACT-REV>/Cargo.toml#L183
+          # - Look at the corresponding version of `swagger-ui` at:
+          #   https://github.com/juhaku/utoipa/blob/utoipa-swagger-ui-<UTOPIA-SWAGGER-UI-VERSION>/utoipa-swagger-ui/build.rs#L21-L22
+          let
+            swaggerUiVersion = "5.17.14";
+            swaggerUi = fetchurl {
+              url = "https://github.com/swagger-api/swagger-ui/archive/refs/tags/v${swaggerUiVersion}.zip";
+              hash = "sha256-SBJE0IEgl7Efuu73n3HZQrFxYX+cn5UU5jrL4T5xzNw=";
+            };
+          in
+          "file://${swaggerUi}";
+      };
+
+      # swagger-ui will once more be copied in the target directory during the check phase
+      # Not deleting the existing unpacked archive leads to a `PermissionDenied` error
+      preCheck = ''
+        rm -rf target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/build/
+      '';
+
+      # Skip doctests: upstream release build for v0.50.3 runs cargo build only,
+      # and the doctest examples currently fail due to async context.
+      cargoTestFlags = [
+        "--lib"
+        "--bins"
+        "--tests"
+        "--examples"
+      ];
+
+      # requires network access or filesystem mutations
+      checkFlags = [
+        "--skip=cli::basic::http::tests::test_node_operations_network_failure"
+        "--skip=cli::basic::http::tests::test_query_valid_time_range"
+        "--skip=common::meta::telemetry::test_telemetry::test_telemetry_send_track_event_without_base_info_or_zo_data"
+        "--skip=handler::http::router::tests::test_get_proxy_routes"
+        "--skip=tests::e2e_test"
+        "--skip=tests::test_setup_logs"
+        "--skip=handler::http::router::middlewares::compress::Compress"
+        "--skip=service::alerts::destinations::tests::test_alert_destination_requires_template"
+        "--skip=service::enrichment_table::url_processor"
+        "--skip=service::github"
+        "--skip=service::sourcemaps"
+        # Tests are not threadsafe. Most likely can only run one test at a time,
+        # due to altering shared database state.
+        # This option already in upstream code: https://github.com/openobserve/openobserve/pull/7084
+        # Also see: https://github.com/NixOS/nixpkgs/pull/457421
+        "--test-threads=1"
+      ];
+
+      doInstallCheck = true;
+      nativeInstallCheckInputs = [ versionCheckHook ];
+
+      passthru.updateScript = updateScript;
+
+      meta = commonMeta // {
+        homepage = "https://github.com/openobserve/openobserve";
+        changelog = "https://github.com/openobserve/openobserve/releases/tag/v${finalAttrs.version}";
+        license = lib.licenses.asl20;
+        platforms = lib.platforms.linux ++ lib.platforms.darwin;
+      };
+    }
+  )
--- a/pkgs/by-name/pd/pdd/package.nix
+++ b/pkgs/by-name/pd/pdd/package.nix
@@ -17,11 +17,16 @@ python3Packages.buildPythonApplication rec {
  };

  postPatch = ''
+    # Fix typo (https://github.com/jarun/pdd/pull/33)
+    substituteInPlace Makefile --replace-fail \
+      'bash-completion/compilations/pdd' \
+      'bash-completion/completions/pdd'
+
    patchShebangs auto-completion/zsh/zsh_completion.py
  '';

  preInstall = ''
-    mkdir -p $out/share/bash-completion/compilations
+    mkdir -p $out/share/bash-completion/completions
    mkdir -p $out/share/zsh/site-functions
    mkdir -p $out/share/fish/vendor_completions.d
  '';
--- a/pkgs/by-name/ph/phpstan/package.nix
+++ b/pkgs/by-name/ph/phpstan/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "phpstan";
-  version = "2.2.8";
+  version = "2.2.9";

  src = fetchFromGitHub {
    owner = "phpstan";
    repo = "phpstan";
    tag = finalAttrs.version;
-    hash = "sha256-AqvcFS3COwPtRyhO1kHjTuObmYT0x9hIBO1z1SbThQk=";
+    hash = "sha256-xVguZK9giJuDgF2jDdY3z/AXZX7Nvghp3KnmidOre7o=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/rs/rspamd/package.nix
+++ b/pkgs/by-name/rs/rspamd/package.nix
@@ -46,13 +46,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "rspamd";
-  version = "4.1.4";
+  version = "4.1.5";

  src = fetchFromGitHub {
    owner = "rspamd";
    repo = "rspamd";
    tag = finalAttrs.version;
-    hash = "sha256-roDYMA8uPytPu50wAJ17zZVWl4KxJWaXO1kVVC3+t8g=";
+    hash = "sha256-2Sazb+7dC+d/biypU8PSJJ1v3detQy07wvKaPxwT4Zk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/se/serverpod_cli/package.nix
+++ b/pkgs/by-name/se/serverpod_cli/package.nix
@@ -8,14 +8,14 @@
 }:
 buildDartApplication rec {
  pname = "serverpod_cli";
-  version = "3.4.11";
+  version = "3.4.12";

  # Fetch the whole monorepo
  src = fetchFromGitHub {
    owner = "serverpod";
    repo = "serverpod";
    tag = version;
-    hash = "sha256-IYsTP1ruidXO/FNa72sU6n7w2hzZ181hSjR74HxBAFM=";
+    hash = "sha256-Za1AWzLkPL/EcJFunOrMwaE5C51/llTif7DYbTYirHs=";
  };

  sourceRoot = "${src.name}/tools/serverpod_cli";
--- a/pkgs/by-name/se/serverpod_cli/pubspec.lock.json
+++ b/pkgs/by-name/se/serverpod_cli/pubspec.lock.json
@@ -24,11 +24,11 @@
      "dependency": "direct main",
      "description": {
        "name": "archive",
-        "sha256": "a96e8b390886ee8abb49b7bd3ac8df6f451c621619f52a26e815fdcf568959ff",
+        "sha256": "be169cf6ac481e052c4538715d88841d567150dfe1df38aaec76461a4e7b39f2",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.0.9"
+      "version": "4.1.0"
    },
    "args": {
      "dependency": "direct main",
@@ -74,11 +74,11 @@
      "dependency": "transitive",
      "description": {
        "name": "built_value",
-        "sha256": "34e4067d30ce212937df995f03b69992eea683539ceeac7f679a1f1eba055b56",
+        "sha256": "31b24be6615ec7fcf70b3aa5a7469fe35826485e639a16dd7eb83ba30e4cc6a8",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "8.12.6"
+      "version": "8.12.7"
    },
    "checked_yaml": {
      "dependency": "transitive",
@@ -384,11 +384,11 @@
      "dependency": "direct main",
      "description": {
        "name": "meta",
-        "sha256": "c82594181e3312f3d0695fc95aaaf7758d75b8d4ae2bbecf223b9fd5109a059d",
+        "sha256": "307249ce4ff29d58a18e97f6345f539382eb9c9c29ecda628900f31de0443dd9",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.18.3"
+      "version": "1.19.0"
    },
    "mime": {
      "dependency": "transitive",
@@ -454,11 +454,11 @@
      "dependency": "transitive",
      "description": {
        "name": "posix",
-        "sha256": "185ef7606574f789b40f289c233efa52e96dead518aed988e040a10737febb07",
+        "sha256": "bc1bad54ad2b735816e31f8d4600cfde6c7839975085ddfbca48b6c9f7c4044e",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.5.0"
+      "version": "6.5.2"
    },
    "pub_api_client": {
      "dependency": "direct main",
@@ -514,51 +514,51 @@
      "dependency": "transitive",
      "description": {
        "name": "serverpod_client",
-        "sha256": "d79108bd64df3efea7cae0c6b9473049f308c40236039c0dd7397539062e5191",
+        "sha256": "abc79908adf3042c113dd7792dd0e183dc93208794299309bbf56821f3153d7c",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.4.11"
+      "version": "3.4.12"
    },
    "serverpod_lints": {
      "dependency": "direct dev",
      "description": {
        "name": "serverpod_lints",
-        "sha256": "bc4f763b57e9b82ce9c35c752c962726d593526af4aee5605ac63c50938e5b20",
+        "sha256": "0d16adb1de3ea4ea25172089bd609259708cba288a78fae7b8ecd9cf26a09bb6",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.4.11"
+      "version": "3.4.12"
    },
    "serverpod_serialization": {
      "dependency": "direct main",
      "description": {
        "name": "serverpod_serialization",
-        "sha256": "e159f298e9b980bfea720fbb91d66d5ad00ff6510f2fcd851932e9942ca0673d",
+        "sha256": "80d6bb6e4c8a01bc25b30fbbebc1991fd4c1ce301164599030942c39eee6a95b",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.4.11"
+      "version": "3.4.12"
    },
    "serverpod_service_client": {
      "dependency": "direct main",
      "description": {
        "name": "serverpod_service_client",
-        "sha256": "cd775b93d66f7fe67becad4aa1c38b560812441b637a99b84360aca753ef1266",
+        "sha256": "31f8fe432822cf07c75aa3ec38ca1614d008de7d0d8c83bb966f0ae52d2a0d5c",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.4.11"
+      "version": "3.4.12"
    },
    "serverpod_shared": {
      "dependency": "direct main",
      "description": {
        "name": "serverpod_shared",
-        "sha256": "515f5cf12cd68dc0a3934ab8d6478cbf0f011c700764a8c4c5d3ae9e967c79d0",
+        "sha256": "2fe566d6623af3e3f6423652feeb1b96613bad18d1b83590d78b746eeefdfa07",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.4.11"
+      "version": "3.4.12"
    },
    "shelf": {
      "dependency": "transitive",
@@ -614,11 +614,11 @@
      "dependency": "transitive",
      "description": {
        "name": "source_maps",
-        "sha256": "190222579a448b03896e0ca6eca5998fa810fda630c1d65e2f78b3f638f54812",
+        "sha256": "14c2945847669b44089bb1222f66873d7ff7103c58911917f2a63c5a62327898",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.10.13"
+      "version": "0.10.14"
    },
    "source_span": {
      "dependency": "direct main",
@@ -744,21 +744,21 @@
      "dependency": "direct main",
      "description": {
        "name": "uuid",
-        "sha256": "1fef9e8e11e2991bb773070d4656b7bd5d850967a2456cfc83cf47925ba79489",
+        "sha256": "9b129329f58692f6e6578329498a8fe9fbe98f090beb764ffbb8ee2eadd01dcd",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "4.5.3"
+      "version": "4.6.0"
    },
    "vm_service": {
      "dependency": "transitive",
      "description": {
        "name": "vm_service",
-        "sha256": "0016aef94fc66495ac78af5859181e3f3bf2026bd8eecc72b9565601e19ab360",
+        "sha256": "5f37239c4851efcef929cea7824e76df7f2f0970aef85d66bbc430afa40e72f0",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "15.2.0"
+      "version": "15.3.0"
    },
    "watcher": {
      "dependency": "direct main",
--- a/pkgs/by-name/st/stasis/package.nix
+++ b/pkgs/by-name/st/stasis/package.nix
@@ -11,17 +11,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "stasis";
-  version = "1.4.1";
+  version = "1.5.1";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "saltnpepper97";
    repo = "stasis";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w+TfwtoEwjVLZu/g9+kpwpIMZo+PZFg77ryd7DIk3Uk=";
+    hash = "sha256-kNgoBdJBBa8+aOshVc9LXtikwv1ar5ldI85uOOdlJ2M=";
  };

-  cargoHash = "sha256-DQ7Jir1kwWHiTh3Pso2cSRZNdy38trcu7NmbmlzW3bE=";
+  cargoHash = "sha256-7i6TEv+vo+ajWlDSK5MPQBtdw3kS99BhPXzEYBywgyo=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/st/sticky/package.nix
+++ b/pkgs/by-name/st/sticky/package.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "sticky";
-  version = "1.31";
+  version = "1.32";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "sticky";
    rev = finalAttrs.version;
-    hash = "sha256-OPn3SNHeHQ3rw71R3oqV3DHxRPq4Ta+qxwkYeegVxbU=";
+    hash = "sha256-z37upUUXQTQeMHJ1b3+1TlPuxwXJIvAphBTKqU7wvQs=";
  };

  postPatch = ''
--- a/pkgs/by-name/st/stress-ng/package.nix
+++ b/pkgs/by-name/st/stress-ng/package.nix
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "stress-ng";
-  version = "0.21.04";
+  version = "0.22.00";

  src = fetchFromGitHub {
    owner = "ColinIanKing";
    repo = "stress-ng";
    tag = "V${finalAttrs.version}";
-    hash = "sha256-v+IGPJZL54E0rSQLfj3tOHPdGTruK+v+IT+a2I2uriA=";
+    hash = "sha256-A0I/kU7pmr2ppoHl+4JN2ayuShFyWN5cv/ZZmZy6Hts=";
  };

  postPatch = ''
--- a/pkgs/by-name/sy/syswatch/package.nix
+++ b/pkgs/by-name/sy/syswatch/package.nix
@@ -7,18 +7,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "syswatch";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "matthart1983";
    repo = "syswatch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jGVgp4K51saPkbQDV798asCGqc/zhO5vJjbOuXtFWpE=";
+    hash = "sha256-EHijnB6hG3qrGteB0Q4Um9GgoIJqyZSflaMvQb2Zk8E=";
  };

  __structuredAttrs = true;

-  cargoHash = "sha256-VfwNasoraA/OqsvhIWzAw/DLc+bwSU3Wgla3xuqh0AE=";
+  cargoHash = "sha256-5qpjGoA5do1zHytxAMhM1gweWH+aTkiSPK84Ur9WPhI=";

  nativeCheckInputs = [ versionCheckHook ];

--- a/pkgs/by-name/tm/tmux/package.nix
+++ b/pkgs/by-name/tm/tmux/package.nix
@@ -25,7 +25,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tmux";
-  version = "3.7b";
+  version = "3.7c";

  outputs = [
    "out"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "tmux";
    repo = "tmux";
    tag = finalAttrs.version;
-    hash = "sha256-CTq06XP997M0ODxQihTq34dI9H6jSRLUXLYuTWOwDpc=";
+    hash = "sha256-TpZXTeXKQv6MV1vAPu5MIT52d3Pl6dYcOReZa7QANZY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/vu/vue-language-server/package.nix
+++ b/pkgs/by-name/vu/vue-language-server/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "vue-language-server";
-  version = "3.3.9";
+  version = "3.3.10";

  src = fetchFromGitHub {
    owner = "vuejs";
    repo = "language-tools";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-6WbD7IVOiVZI483OpPZByzo0Wnv3ELQyc5Wc6B/4+fs=";
+    hash = "sha256-3x3idLqfh3SiyyMWaCUencgvY82yjP2nTeOFASEBFbM=";
  };

  pnpmDeps = fetchPnpmDeps {
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-CsxZemXNRHrtVmoMLOFNgcOVj2xq7GqXY68AHnMw4pw=";
+    hash = "sha256-aUxUw3PjlSyUATb2FFQstpq+3P3ymPGZnmdiuYUQ3AE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aiowebostv/default.nix
+++ b/pkgs/development/python-modules/aiowebostv/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "aiowebostv";
-  version = "0.9.1";
+  version = "0.9.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "home-assistant-libs";
    repo = "aiowebostv";
    tag = "v${version}";
-    hash = "sha256-rHbGKJrEl/Rot7sW8KFK/a2bOF+XWfYbLlUs/1bqf2U=";
+    hash = "sha256-Bswq/8PvKUTSbOklJBJ/hKsEQyd+s1ZVDsKCbRN1Bc4=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -23,12 +23,12 @@

 buildPythonPackage (finalAttrs: {
  pname = "apprise";
-  version = "1.11.0";
+  version = "1.13.0";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-Ox5vU2WzAtH64nDAyAB5WOVCJLm3gIrOxpAG6if1uKI=";
+    hash = "sha256-mlaWS/PKAEs+DbmKuKjYf60FHY7bN3vBZtxL6CZmbIE=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.43.76";
+  version = "1.43.78";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-owrhzX/uEE+cDB2tGQE3/YTjb7D5oFCDvsquz6yZ6wE=";
+    hash = "sha256-TosHjxSZH4l0/IOrjZb8cuaRP8iiRy1x3qD+ItaHZQ8=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/cyclopts/default.nix
+++ b/pkgs/development/python-modules/cyclopts/default.nix
@@ -28,14 +28,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "cyclopts";
-  version = "4.23.0";
+  version = "4.23.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "BrianPugh";
    repo = "cyclopts";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-XNrskQvz/W0kqzKCq4pHaIdMaYjm0JwAWeXUKh6ib84=";
+    hash = "sha256-5MJWwtQr63cTJ9Pkp369W2jnFsydarvz8T7A+eGtGwc=";
  };

  pythonRelaxDeps = [ "rich-rst" ];
--- a/pkgs/development/python-modules/django-extended-makemessages/default.nix
+++ b/pkgs/development/python-modules/django-extended-makemessages/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  django,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "django-extended-makemessages";
+  version = "1.9.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "michalpokusa";
+    repo = "django-extended-makemessages";
+    tag = finalAttrs.version;
+    hash = "sha256-Ev0LJJxYM0VZ4bgDRqqOMMXo/qZtz7pemw7lbcc831Q=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    django
+  ];
+
+  pythonImportsCheck = [ "django_extended_makemessages" ];
+
+  meta = {
+    description = "Extended version of Django's makemessages command";
+    homepage = "https://github.com/michalpokusa/django-extended-makemessages";
+    changelog = "https://github.com/michalpokusa/django-extended-makemessages/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ onny ];
+  };
+})
--- a/pkgs/development/python-modules/django-filingcabinet/default.nix
+++ b/pkgs/development/python-modules/django-filingcabinet/default.nix
@@ -31,26 +31,27 @@
  playwright-driver,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
  nodejs,
  markdown,
  nh3,
 }:
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
 in
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "django-filingcabinet";
-  version = "0.17-unstable-2025-08-14";
+  version = "0.17-unstable-2026-05-07";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "okfde";
    repo = "django-filingcabinet";
    # No release tagged yet on GitHub
    # https://github.com/okfde/django-filingcabinet/issues/69
-    rev = "e1713921d6d14e0abc8b81315545d7fb6f08c39f";
-    hash = "sha256-R/JNI+PZb0H09ZoYCGV3nbAowkf/YlKia4xkgAgqoNM=";
+    rev = "53fe999d9c984bed84bf0e76aca5d0dab9d2954b";
+    hash = "sha256-RIl3x6UrcS9IIlnKanI+XIjPPJeBDPsrlMdMDEREEbg=";
  };

  postPatch = ''
@@ -98,14 +99,13 @@ buildPythonPackage rec {
  };

  pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit (finalAttrs)
      pname
      version
      src
-      pnpm
      ;
-    fetcherVersion = 3;
-    hash = "sha256-p+RpEDVbdYmeSD4bB0oUMrTpsVDGYkqME13awnoTNd0=";
+    fetcherVersion = 4;
+    hash = "sha256-7MZIp4OD+h0G77U0GT7vblQ4fX53sg6xHE2fjie/90U=";
  };

  postBuild = ''
@@ -150,8 +150,8 @@ buildPythonPackage rec {
  meta = {
    description = "Django app that manages documents with pages, annotations and collections";
    homepage = "https://github.com/okfde/django-filingcabinet";
-    changelog = "https://github.com/feincms/django-cabinet/blob/${version}/CHANGELOG.rst";
+    changelog = "https://github.com/feincms/django-cabinet/blob/${finalAttrs.version}/CHANGELOG.rst";
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.onny ];
  };
-}
+})
--- a/pkgs/development/python-modules/django-treebeard/default.nix
+++ b/pkgs/development/python-modules/django-treebeard/default.nix
@@ -10,14 +10,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "django-treebeard";
-  version = "4.8.0";
+  version = "7.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "django-treebeard";
    repo = "django-treebeard";
    tag = finalAttrs.version;
-    hash = "sha256-DrjI0HlrJhNqrYul3SO0xkkFwjWRn94OgvTA/Z3wv84=";
+    hash = "sha256-GvW5QjCuour56NhAt2o2eQ6g2UoXZnukXGVWop1tjSk=";
  };

  build-system = [ setuptools ];
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
  meta = {
    description = "Efficient tree implementations for Django";
    homepage = "https://tabo.pe/projects/django-treebeard/";
-    changelog = "https://github.com/django-treebeard/django-treebeard/blob/${finalAttrs.src.tag}/CHANGES.md";
+    changelog = "https://github.com/django-treebeard/django-treebeard/blob/${finalAttrs.version}/CHANGES.md";
    license = lib.licenses.asl20;
  };
 })
--- a/pkgs/development/python-modules/fastspec/default.nix
+++ b/pkgs/development/python-modules/fastspec/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fastcore,
+  fasttransport,
+  fetchFromGitHub,
+  nix-update-script,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "fastspec";
+  version = "0.2.3";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "AnswerDotAI";
+    repo = "fastspec";
+    tag = finalAttrs.version;
+    hash = "sha256-bSD3x/oqxfPfUAe5jl5UhXknsvJ39j5voVIX6zDntW4=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    fastcore
+    fasttransport
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "fastspec" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Dynamic OpenAPI and discovery spec client for Python";
+    homepage = "https://github.com/AnswerDotAI/fastspec";
+    changelog = "https://github.com/AnswerDotAI/fastspec/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/fasttransport/default.nix
+++ b/pkgs/development/python-modules/fasttransport/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  fastcore,
+  httpx2,
+  cachy,
+  nix-update-script,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "fasttransport";
+  version = "0.0.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "AnswerDotAI";
+    repo = "fasttransport";
+    tag = finalAttrs.version;
+    hash = "sha256-A/24Q/xf92eQan/cKWbgCAMyO3J5WXKpNYdTJhESK5Q=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    fastcore
+    httpx2
+  ];
+
+  optional-dependencies = {
+    dev = [ cachy ];
+  };
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "fasttransport" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Sync and async HTTP transports over httpx2, plus base classes for small REST clients";
+    homepage = "https://github.com/AnswerDotAI/fasttransport";
+    changelog = "https://github.com/AnswerDotAI/fasttransport/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/ghapi/default.nix
+++ b/pkgs/development/python-modules/ghapi/default.nix
@@ -3,26 +3,28 @@
  buildPythonPackage,
  fetchFromGitHub,
  fastcore,
+  fastspec,
  packaging,
  setuptools,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "ghapi";
-  version = "1.0.15";
+  version = "2.1.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "fastai";
    repo = "ghapi";
    tag = finalAttrs.version;
-    hash = "sha256-H1DuoESnGtU3nsKzW3Zj0RdGNXj1bBGpt6W3mprpVeg=";
+    hash = "sha256-o54xFz7AgTGbsI7OSjXx3d/Prv8OPKPBRNSpK6kCrIY=";
  };

  build-system = [ setuptools ];

  dependencies = [
    fastcore
+    fastspec
    packaging
  ];

--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -18,14 +18,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "ical";
-  version = "14.1.0";
+  version = "14.1.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "allenporter";
    repo = "ical";
    tag = finalAttrs.version;
-    hash = "sha256-YbYZbgSEqfQP4VQ/g25o+NbCBLU0dxA0laoeP7c54Fw=";
+    hash = "sha256-Rl/tEOG+n7MCd/kHmoluBS4YI8+Jd4pxgvmUyp9eOag=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/jsonmerge/default.nix
+++ b/pkgs/development/python-modules/jsonmerge/default.nix
@@ -4,28 +4,32 @@
  fetchPypi,
  jsonschema,
  pytestCheckHook,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "jsonmerge";
  version = "1.9.2";

-  format = "setuptools";
+  __structuredAttrs = true;
+  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    hash = "sha256-xDdX4BgLDhm3rkwTCtQqB8xYDDGRL2H0gj6Ory+jlKM=";
  };

-  propagatedBuildInputs = [ jsonschema ];
+  build-system = [ setuptools ];
+
+  dependencies = [ jsonschema ];

  nativeCheckInputs = [ pytestCheckHook ];

  meta = {
    description = "Merge a series of JSON documents";
    homepage = "https://github.com/avian2/jsonmerge";
-    changelog = "https://github.com/avian2/jsonmerge/blob/jsonmerge-${version}/ChangeLog";
+    changelog = "https://github.com/avian2/jsonmerge/blob/jsonmerge-${finalAttrs.version}/ChangeLog";
    license = lib.licenses.mit;
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/development/python-modules/msmart-ng/default.nix
+++ b/pkgs/development/python-modules/msmart-ng/default.nix
@@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "msmart-ng";
-  version = "2026.7.0";
+  version = "2026.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mill1000";
    repo = "midea-msmart";
    tag = version;
-    hash = "sha256-OW5++yd+o2KqaFWTo/RiLjK1HO2l9WSDxkiX3lYtaUs=";
+    hash = "sha256-UbRL42jQk3A8VYe/eLj3XNTFPhyVjBMzB/lTNs0tyRM=";
  };

  build-system = [
@@ -51,7 +51,6 @@ buildPythonPackage rec {
    mainProgram = "msmart-ng";
    maintainers = with lib.maintainers; [
      hexa
-      emilylange
    ];
  };
 }
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -155,8 +155,8 @@ in
      "sha256-imuX16TqfUAoPqzJTclvPMWiVnDSh6nJ8QbSksLEKps=";

  mypy-boto3-backup =
-    buildMypyBoto3Package "backup" "1.43.66"
-      "sha256-7T19wui6KEHjIDVQ9Bl2G0mfNtlHF3AS219/YDES/gM=";
+    buildMypyBoto3Package "backup" "1.43.78"
+      "sha256-kERQjzlMwcmJ6e5W/7Q4qZuK3Mix+Q9Seel2xEf2AZc=";

  mypy-boto3-backup-gateway =
    buildMypyBoto3Package "backup-gateway" "1.43.55"
@@ -255,8 +255,8 @@ in
      "sha256-PVskBSuwqSfNybHDtLLfVpDG0dwR/Q1LhrHz1imsR8A=";

  mypy-boto3-cloudwatch =
-    buildMypyBoto3Package "cloudwatch" "1.43.54"
-      "sha256-g15yEndLsA3aVj3XKw0UlbFbYRDhXXsTkZDvoGsecLI=";
+    buildMypyBoto3Package "cloudwatch" "1.43.78"
+      "sha256-gPJbV1Dmthocp49ENiO9ND7ewUTuAhXV/nAsxkw+UGA=";

  mypy-boto3-codeartifact =
    buildMypyBoto3Package "codeartifact" "1.43.0"
@@ -391,8 +391,8 @@ in
      "sha256-cQqctK2DnuHUuhMb+07M60JkyuBveerK2ybTt4bM+kA=";

  mypy-boto3-devicefarm =
-    buildMypyBoto3Package "devicefarm" "1.43.66"
-      "sha256-yP7EUJb22oi8m64wg1wodx2u/2VieMFMQnYc5KBsGZQ=";
+    buildMypyBoto3Package "devicefarm" "1.43.78"
+      "sha256-KLcJ+s1kHHTgH/42bNXsPP6s73mvu+8nWqHlGXLq+78=";

  mypy-boto3-devops-guru =
    buildMypyBoto3Package "devops-guru" "1.43.0"
@@ -726,8 +726,8 @@ in
      "sha256-f36IwT8zw4RvLqbZgGas6euLVdKR5gJJl7eLBF8PjaE=";

  mypy-boto3-kinesis =
-    buildMypyBoto3Package "kinesis" "1.43.0"
-      "sha256-VRGpxnoRDh17SvfHg0mHwlCShMwKrkwqPHtXJoFlJXU=";
+    buildMypyBoto3Package "kinesis" "1.43.78"
+      "sha256-VEFubvAX5fQSaoZASKcvdar/DyLiCKVg07nNuUOT4hU=";

  mypy-boto3-kinesis-video-archived-media =
    buildMypyBoto3Package "kinesis-video-archived-media" "1.43.0"
@@ -1394,8 +1394,8 @@ in
      "sha256-zwxwpve6uEpXNyMQzaFPIEqDI/JoP5ks2wmO5gqLf7c=";

  mypy-boto3-wafv2 =
-    buildMypyBoto3Package "wafv2" "1.43.63"
-      "sha256-8hUgFNVUOcsjOyECvMlw0S0uG6A8XTv2EBWi06Cj2QY=";
+    buildMypyBoto3Package "wafv2" "1.43.78"
+      "sha256-KXzvLywcMSxSswUbgqdJJBMBuQ3O4EAk3nuX+n94ONE=";

  mypy-boto3-wellarchitected =
    buildMypyBoto3Package "wellarchitected" "1.43.70"
--- a/pkgs/development/python-modules/nsapi/default.nix
+++ b/pkgs/development/python-modules/nsapi/default.nix
@@ -2,27 +2,24 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  pyprojectVersionPatchHook,
  pytz,
  setuptools,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "nsapi";
-  version = "3.2.1";
+  version = "3.1.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aquatix";
    repo = "ns-api";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eZT6DU68wcEYyoFejECuluzit9MDA269zaKVFWpSuc8=";
+    hash = "sha256-Buhc0643WeX/4ZU/RkzNWiFjfEAJUtNL6uJ98unTnCg=";
  };

  build-system = [ setuptools ];

-  nativeBuildInputs = [ pyprojectVersionPatchHook ];
-
  dependencies = [ pytz ];

  # Project has no tests
--- a/pkgs/development/python-modules/opensfm/default.nix
+++ b/pkgs/development/python-modules/opensfm/default.nix
@@ -53,15 +53,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "opensfm";
-  version = "0.5.1-unstable-2026-07-13";
+  version = "0.5.1-unstable-2026-08-17";
  pyproject = true;
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "mapillary";
    repo = "OpenSfM";
-    rev = "238744cdf3b5d50149c50d136a87f7fea25ad5cd";
-    hash = "sha256-3T9wjuuN5AjM/MtSo3xGoHJcvXOI8Keyxcqv7BQavlw=";
+    rev = "36034bb0939fced472b6173d93a4d9bddb570fc0";
+    hash = "sha256-Au8rf2gmm7abpFmYZ9zBBmVMfMZE+k3K2ngDZ2g8ojY=";
  };

  patches = [
--- a/pkgs/development/python-modules/prefect/default.nix
+++ b/pkgs/development/python-modules/prefect/default.nix
@@ -7,7 +7,6 @@
  pytestCheckHook,
  pythonAtLeast,
  pythonOlder,
-  replaceVars,
  writableTmpDirAsHomeHook,
  writeShellScriptBin,

@@ -79,6 +78,7 @@
  semver,
  sniffio,
  sqlalchemy,
+  starlette,
  toml,
  typing-extensions,
  uv,
@@ -92,14 +92,17 @@

 buildPythonPackage (finalAttrs: {
  pname = "prefect";
-  version = "3.7.0";
+  version = "3.8.3";
  pyproject = true;

+  # keeps list elements containing spaces intact, which disabledTests below needs
+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "PrefectHQ";
    repo = "prefect";
    tag = finalAttrs.version;
-    hash = "sha256-AfiXH9u6W6UpE8hepNzPGIm1cxC+5RonhtBYWMu2IaQ=";
+    hash = "sha256-C20gFzsswVOVfJiz2UcDamUSSMbvm+KVIM115ZAzEyM=";
  };

  postPatch = ''
@@ -115,9 +118,11 @@ buildPythonPackage (finalAttrs: {
        '__development_base_path__: pathlib.Path = pathlib.Path("${finalAttrs.src}")'
  '';

-  # versioningit: NotVCSError: Git not installed; assuming this isn't a Git repository
  nativeBuildInputs = [
+    # versioningit: NotVCSError: Git not installed; assuming this isn't a Git repository
    (writeShellScriptBin "git" "false")
+    # prefect wants to create ~/.prefect on import, which pythonImportsCheck triggers
+    writableTmpDirAsHomeHook
  ];

  build-system = [
@@ -177,6 +182,7 @@ buildPythonPackage (finalAttrs: {
    ruamel-yaml-clib
    semver
    sniffio
+    starlette
    toml
    typing-extensions
    uvicorn
@@ -258,12 +264,15 @@ buildPythonPackage (finalAttrs: {
    ];
  };

-  passthru.tests = {
-    inherit (nixosTests) prefect;
+  passthru = {
+    tests = {
+      inherit (nixosTests) prefect;
+    };

+    # Upstream publishes every pre‐release (3.8.4.dev1, …) as a GitHub release,
+    # so restrict the updater to plain three‐component stable tags.
    updateScript = nix-update-script {
      extraArgs = [
-        # avoid pre‐releases
        "--version-regex"
        "^(\\d+\\.\\d+\\.\\d+)$"
      ];
@@ -271,6 +280,7 @@ buildPythonPackage (finalAttrs: {
  };

  # FIXME: build killed at ~30%
+
  doCheck = false;
  nativeCheckInputs = [
    pytestCheckHook
@@ -295,6 +305,7 @@ buildPythonPackage (finalAttrs: {
  meta = {
    description = "Workflow orchestration framework for building resilient data pipelines in Python";
    homepage = "https://github.com/PrefectHQ/prefect";
+    changelog = "https://github.com/PrefectHQ/prefect/releases/tag/${finalAttrs.version}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [
      happysalada
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@@ -22,14 +22,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyenphase";
-  version = "3.2.2";
+  version = "4.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pyenphase";
    repo = "pyenphase";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-K23i3/BEZx9VCxlwue1g4nS7hz4ckJL6FIZqdFaTtAQ=";
+    hash = "sha256-fMfQApK8e6Oi81H7tMJZOsAPr4EoRrkP6gdKexg6jVg=";
  };

  pythonRelaxDeps = [ "tenacity" ];
--- a/pkgs/development/python-modules/rembg/default.nix
+++ b/pkgs/development/python-modules/rembg/default.nix
@@ -46,14 +46,14 @@ let
 in
 buildPythonPackage (finalAttrs: {
  pname = "rembg";
-  version = "2.0.80";
+  version = "2.0.81";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "danielgatis";
    repo = "rembg";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fHaLiAmRk+sJMOKB2tEsKCxfqCdBOSxpRm0+6UGIJ+Y=";
+    hash = "sha256-5d0/WAZ90lUrDcQ3+bg0abLej67zXuoKsjMMCAqgdM4=";
  };

  env.POETRY_DYNAMIC_VERSIONING_BYPASS = finalAttrs.version;
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "reolink-aio";
-  version = "0.21.8";
+  version = "0.21.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "starkillerOG";
    repo = "reolink_aio";
    tag = finalAttrs.version;
-    hash = "sha256-b4VmYHrSf1NBiWI09IWdQQWrm9kMJlm2ScUaG08MC38=";
+    hash = "sha256-t1mmmHhh5J9i28ISVbZp8PbRQTXv8YUcAVl6ZtSCF1o=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/stream-inflate/default.nix
+++ b/pkgs/development/python-modules/stream-inflate/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  cython,
+  fetchFromGitHub,
+  nix-update-script,
+  pyprojectVersionPatchHook,
+  pytest-cov-stub,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "stream-inflate";
+  version = "0.0.43";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "michalc";
+    repo = "stream-inflate";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GWO262lMKk5RlMvW4SaTk1WCQZjP7ZzTzMMvOXyEtfU=";
+  };
+
+  build-system = [
+    cython
+    setuptools
+  ];
+
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+  ];
+
+  pythonImportsCheck = [ "stream_inflate" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Uncompress Deflate and Deflate64 streams";
+    homepage = "https://github.com/michalc/stream-inflate";
+    changelog = "https://github.com/michalc/stream-inflate/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/stream-unzip/default.nix
+++ b/pkgs/development/python-modules/stream-unzip/default.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  buildPythonPackage,
+  cargo,
+  fetchFromGitHub,
+  nix-update-script,
+  pycryptodome,
+  pyprojectVersionPatchHook,
+  rustc,
+  rustPlatform,
+  stream-inflate,
+  trio,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "stream-unzip";
+  version = "0.0.101";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "uktrade";
+    repo = "stream-unzip";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JTMJdc61wR2nqYq3BMkLgi+krKsDUKBAgzbqlvYx8L0=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-CKtu4ERN0L7XoZxFAQhgZSymLqGkBdP0eSy9DhFPwZk=";
+  };
+
+  build-system = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
+  dependencies = [
+    pycryptodome
+    stream-inflate
+  ];
+
+  optional-dependencies = {
+    ci = [
+      pycryptodome
+      stream-inflate
+    ];
+  };
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "stream_unzip" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Python function to stream unzip all the files in a ZIP archive on the fly";
+    homepage = "https://github.com/uktrade/stream-unzip";
+    changelog = "https://github.com/uktrade/stream-unzip/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/types-aiobotocore-packages/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore-packages/default.nix
--- a/pkgs/development/python-modules/volvocarsapi/default.nix
+++ b/pkgs/development/python-modules/volvocarsapi/default.nix
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "volvocarsapi";
-  version = "0.4.3";
+  version = "0.4.4";
  pyproject = true;

  disabled = pythonOlder "3.12";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "thomasddn";
    repo = "volvo-cars-api";
    tag = "v${version}";
-    hash = "sha256-GC2vktTFWh4z/sO+2hhsVKInSl5GQCtzq4q0YtfkfKg=";
+    hash = "sha256-8ASR7IE84Hrv+u4ORULMTSgBnn7TMIKwzFKiKWhQLIg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/vulners/default.nix
+++ b/pkgs/development/python-modules/vulners/default.nix
@@ -0,0 +1,96 @@
+{
+  lib,
+  brotli,
+  buildPythonPackage,
+  fastmcp,
+  fetchFromGitHub,
+  h2,
+  httpx,
+  ijson,
+  isal,
+  nix-update-script,
+  opentelemetry-api,
+  orjson,
+  pydantic,
+  pytest-asyncio,
+  pytestCheckHook,
+  respx,
+  stream-unzip,
+  typing-extensions,
+  typing-inspection,
+  uv-build,
+  zstandard,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "vulners";
+  version = "4.3.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "vulnersCom";
+    repo = "api";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SoU1I+3ERHCKrsb4ej+X5JIoaoWtGyJCXw1rnQ6MeNk=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.11.29,<0.12" "uv_build"
+  '';
+
+  pythonRelaxDeps = [
+    "h2"
+    "typing-inspection"
+  ];
+
+  build-system = [ uv-build ];
+
+  dependencies = [
+    brotli
+    h2
+    httpx
+    ijson
+    isal
+    orjson
+    pydantic
+    stream-unzip
+    typing-extensions
+    typing-inspection
+    zstandard
+  ];
+
+  optional-dependencies = {
+    mcp = [
+      fastmcp
+    ];
+    otel = [
+      opentelemetry-api
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytestCheckHook
+    respx
+  ];
+
+  pythonImportsCheck = [ "vulners" ];
+
+  disabledTestPaths = [
+    # Smoke tests are failing
+    "tests/test_smoke.py"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Python SDK for the Vulners vulnerability-intelligence API";
+    homepage = "https://github.com/vulnersCom/api";
+    changelog = "https://github.com/vulnersCom/api/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
--- a/pkgs/development/python-modules/wagtail-localize/default.nix
+++ b/pkgs/development/python-modules/wagtail-localize/default.nix
@@ -26,18 +26,18 @@
 let
  pname = "wagtail-localize";

-  version = "1.13.1";
+  version = "1.14.5";

  src = fetchFromGitHub {
    repo = "wagtail-localize";
    owner = "wagtail";
    tag = "v${version}";
-    hash = "sha256-iJwX/N8/aaAjinU1htVasp88fuuZCOomVPgJ1Ymxre4=";
+    hash = "sha256-3T3o2whNNWSbsggNhPI6vnxeONGpNdD2/BMiFl/nWmo=";
  };

  assets = buildNpmPackage {
    pname = "${pname}-assets";
-    npmDepsHash = "sha256-mLZaa3BBvbbgaSgZhsdUVPRXR6X5xy/sWRiOXnzV2cQ=";
+    npmDepsHash = "sha256-5TKYDFYF8H1UrSUWeKDd/lf0Twk1mVKrPL9ywsdSdz4=";

    NODE_OPTIONS = "--openssl-legacy-provider";

@@ -48,7 +48,7 @@ let

      mkdir $out

-      for static_dir in wagtail_localize/static; do
+      for static_dir in src/wagtail_localize/static; do
        cp --parents -r $static_dir $out
      done

@@ -84,12 +84,9 @@ buildPythonPackage rec {
  ];

  preBuild = ''
-    cp -r ${assets}/wagtail_localize .
+    cp -r ${assets}/src/wagtail_localize/static src/wagtail_localize/
  '';

-  # See https://github.com/wagtail/wagtail-localize/issues/922
-  patches = [ ./failing-test.patch ];
-
  checkPhase = ''
    runHook preCheck

--- a/pkgs/development/python-modules/wagtail-localize/failing-test.patch
+++ b/pkgs/development/python-modules/wagtail-localize/failing-test.patch
@@ -1,19 +0,0 @@
-diff --git a/wagtail_localize/tests/test_edit_translation.py b/wagtail_localize/tests/test_edit_translation.py
-index 4bbe5a1..033b6bf 100644
--- a/wagtail_localize/tests/test_edit_translation.py
-+++ b/wagtail_localize/tests/test_edit_translation.py
-@@ -1,5 +1,6 @@
- import json
- import tempfile
-+import unittest
- import uuid
- 
- from unittest.mock import patch
-@@ -1718,6 +1719,7 @@ def test_cant_edit_snippet_translation_without_perms(self):
-             "Sorry, you do not have permission to access this area.\n\n\n\n\n",
-         )
- 
-+    @unittest.skip
-     def test_edit_nested_snippet_translation(self):
-         for permission in Permission.objects.filter(
-             content_type=ContentType.objects.get_for_model(Header)
--- a/pkgs/development/python-modules/wagtail/default.nix
+++ b/pkgs/development/python-modules/wagtail/default.nix
@@ -35,6 +35,15 @@
  callPackage,
 }:

+let
+  # updating django-treebeard regularly requires changes in code
+  django-treebeard' = django-treebeard.overridePythonAttrs (old: {
+    version = "5.3.1";
+    src = old.src.override {
+      hash = "sha256-s2s/cN1daeST9YxvjwJSH4mbT/gg5/J3n4F6g+S15Rc=";
+    };
+  });
+in
 buildPythonPackage (finalAttrs: {
  pname = "wagtail";
  version = "7.4.2";
@@ -67,11 +76,6 @@ buildPythonPackage (finalAttrs: {
    setuptools
  ];

-  pythonRelaxDeps = [
-    "django-tasks"
-    "modelsearch"
-  ];
-
  dependencies = [
    anyascii
    beautifulsoup4
@@ -80,7 +84,7 @@ buildPythonPackage (finalAttrs: {
    django-modelcluster
    django-taggit
    django-tasks
-    django-treebeard
+    django-treebeard'
    djangorestframework
    draftjs-exporter
    laces
--- a/pkgs/development/python-modules/xclim/default.nix
+++ b/pkgs/development/python-modules/xclim/default.nix
@@ -35,14 +35,14 @@
 }:
 buildPythonPackage rec {
  pname = "xclim";
-  version = "0.61.1";
+  version = "0.62.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Ouranosinc";
    repo = "xclim";
    tag = "v${version}";
-    hash = "sha256-a1RjI8Gz2B60FEWx+PFz8RHKJlV3HRR1tIqzKudOvRE=";
+    hash = "sha256-1XuviMw8roOmrzRJZOX9x7Xf7HjElmbE1GC50RKg9XY=";
  };

  build-system = [
--- a/pkgs/os-specific/linux/jool/default.nix
+++ b/pkgs/os-specific/linux/jool/default.nix
@@ -19,10 +19,11 @@ stdenv.mkDerivation (finalAttrs: {

  src = sourceAttrs.src;

-  patches = lib.optionals (lib.versionAtLeast kernel.version "6.18.0") [
+  patches = lib.optionals (lib.versionAtLeast kernel.version "7.2") [
+    # https://github.com/NICMx/Jool/pull/456
    (fetchpatch {
-      url = "https://gitlab.alpinelinux.org/alpine/aports/-/raw/3.23-stable/community/jool-modules-lts/kernel-6.18.patch";
-      hash = "sha256-EtV95YaOzPU3e/8NQvUtAH/RWiV16djeKrnvSgYybCQ=";
+      url = "https://github.com/NICMx/Jool/commit/47a8c7426f08e50505e69eef7ff607a04fbab52e.diff";
+      hash = "sha256-EcfBwFKOSFQOBWl8s5Pa2/RJg9lH1ziGzvV4ap2505M=";
    })
  ];

--- a/pkgs/os-specific/linux/jool/source.nix
+++ b/pkgs/os-specific/linux/jool/source.nix
@@ -1,11 +1,11 @@
 { fetchFromGitHub }:

 rec {
-  version = "4.1.14";
+  version = "4.1.15";
  src = fetchFromGitHub {
    owner = "NICMx";
    repo = "Jool";
    tag = "v${version}";
-    hash = "sha256-fAs289FFdUnddkikm4ceA9d/w1qqqaWuPXmAiq3cIA8=";
+    hash = "sha256-I+cgxOONq8LZWlpVaqXW+MmEKts/dQAr7Hs8uC6N8/w=";
  };
 }
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -162,7 +162,9 @@ optionalAttrs allowAliases aliases
  yaml = yaml_1_1;

  yaml_1_1 =
-    { }:
+    {
+      tags ? false,
+    }:
    {
      generate =
        name: value:
@@ -176,7 +178,7 @@ optionalAttrs allowAliases aliases
              __structuredAttrs = true;
            }
            ''
-              remarshal --from json --to yaml-1.1 ${
+              remarshal --from json --to yaml-1.1${lib.optionalString tags " --yaml-tags"} ${
                # attributes with null values are omitted from the JSON with structured attrs
                # yaml_1_1Null test keeps this in check
                if value == null then ''<(echo "null")'' else ''--unwrap value "$NIX_ATTRS_JSON_FILE"''
@@ -189,7 +191,9 @@ optionalAttrs allowAliases aliases
    };

  yaml_1_2 =
-    { }:
+    {
+      tags ? false,
+    }:
    {
      generate =
        name: value:
@@ -203,7 +207,7 @@ optionalAttrs allowAliases aliases
              __structuredAttrs = true;
            }
            ''
-              json2yaml ${
+              json2yaml${lib.optionalString tags " --yaml-tags"} ${
                # attributes with null values are omitted from the JSON with structured attrs
                # yaml_1_2Null test keeps this in check
                if value == null then ''<(echo "null")'' else ''--unwrap value "$NIX_ATTRS_JSON_FILE"''
--- a/pkgs/pkgs-lib/tests/formats.nix
+++ b/pkgs/pkgs-lib/tests/formats.nix
@@ -240,6 +240,46 @@ runBuildTests {
    '';
  };

+  yaml_1_1Tags = shouldPass {
+    format = formats.yaml_1_1 { tags = true; };
+    input = {
+      tag1 = {
+        "!mytag" = {
+          k1 = "v1";
+        };
+      };
+      tag2 = {
+        "!anothertag" = true;
+      };
+    };
+    expected = ''
+      %YAML 1.1
+      ---
+      tag1: !mytag
+        k1: v1
+      tag2: !anothertag true
+    '';
+  };
+
+  yaml_1_2Tags = shouldPass {
+    format = formats.yaml_1_2 { tags = true; };
+    input = {
+      tag1 = {
+        "!mytag" = {
+          k1 = "v1";
+        };
+      };
+      tag2 = {
+        "!anothertag" = true;
+      };
+    };
+    expected = ''
+      tag1: !mytag
+        k1: v1
+      tag2: !anothertag true
+    '';
+  };
+
  iniAtoms = shouldPass {
    format = formats.ini { };
    input = {
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2026.8.2";
+  version = "2026.8.3";
  components = {
    "3_day_blinds" =
      ps: with ps; [
--- a/pkgs/servers/home-assistant/custom-components/gtfs-realtime/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/gtfs-realtime/package.nix
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent rec {
  owner = "bcpearce";
  domain = "gtfs_realtime";
-  version = "0.4.8";
+  version = "0.4.9";

  src = fetchFromGitHub {
    owner = "bcpearce";
    repo = "homeassistant-gtfs-realtime";
    tag = version;
-    hash = "sha256-rf11yej0IsB3Og5D4n4iAsehWODJcjC930RzcGCsIT4=";
+    hash = "sha256-a9ZL5NQvmMi58rfTG3REDpYAkg8Y4PmeYn/brBz5K3U=";
  };

  dependencies = [ gtfs-station-stop ];
--- a/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/local_openai/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent (finalAttrs: {
  owner = "skye-harris";
  domain = "local_openai";
-  version = "1.10.0";
+  version = "1.11.1";

  src = fetchFromGitHub {
    inherit (finalAttrs) owner;
    repo = "hass_local_openai_llm";
    tag = finalAttrs.version;
-    hash = "sha256-rDvZtNwfw3GI0qvKRLT8BsQ60au8S0hPw36CdAlBgIw=";
+    hash = "sha256-mwHpQGxVL6jkvn7uYKe06549W0MNvgxme3Z7qZicITw=";
  };

  dependencies = [
--- a/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
  owner = "mill1000";
  domain = "midea_ac";
-  version = "2026.7.2";
+  version = "2026.8.2";

  src = fetchFromGitHub {
    owner = "mill1000";
    repo = "midea-ac-py";
    tag = version;
-    hash = "sha256-ErQDCU17qJ3hO7PBawNEn8mj/Gt9kWns6PV5T9OFYqw=";
+    hash = "sha256-FFSp89d1NDtKmVgt9fI3fFWPL0Xm9h1Kqxl8Rvof6R8=";
  };

  dependencies = [ msmart-ng ];
@@ -33,7 +33,6 @@ buildHomeAssistantComponent rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      hexa
-      emilylange
    ];
  };
 }
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -270,7 +270,7 @@ let
  extraBuildInputs = extraPackages python3Packages;

  # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2026.8.2";
+  hassVersion = "2026.8.3";

 in
 python3Packages.buildPythonApplication rec {
@@ -291,13 +291,13 @@ python3Packages.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    tag = version;
-    hash = "sha256-u8vXAsO1jQpUpvqSRuYMOR8eY0Oqk7T4A/aRneE88Qg=";
+    hash = "sha256-bM4YYwV4MNKnVe+1Gzh2DIY2LE2IvGexP/F0RR0R7Y0=";
  };

  # Secondary source is pypi sdist for translations
  sdist = fetchPypi {
    inherit pname version;
-    hash = "sha256-ImLh7LxH/p08y2kPmfFxdp+vUgFyCLf/Zsnbv79w990=";
+    hash = "sha256-f1zG2rBz4hKJ0lhMqk25Xp5INWgs6bEisF7vEQV7UPg=";
  };

  build-system = with python3Packages; [
--- a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
+++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
@@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "pytest-homeassistant-custom-component";
-  version = "0.13.356";
+  version = "0.13.357";
  pyproject = true;

  disabled = pythonOlder "3.13";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "MatthewFlamm";
    repo = "pytest-homeassistant-custom-component";
    tag = version;
-    hash = "sha256-NBGHtEtk3JGqG0VES3UhZ4WLfamDS4EPsLAhYZdl0n4=";
+    hash = "sha256-FnkR+AhTPIznIdr7bOYLd6IHsoHz2nV855gYwgvrfXU=";
  };

  patches = [
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "homeassistant-stubs";
-  version = "2026.8.2";
+  version = "2026.8.3";
  pyproject = true;

  disabled = python.version != home-assistant.python3Packages.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "KapJI";
    repo = "homeassistant-stubs";
    tag = version;
-    hash = "sha256-cLGvesBrD76vrkG46PnCaadSTLVUZmz0zTBJep15QjM=";
+    hash = "sha256-2dpEUiNBPyQltkZM9slKkZpbWyxC2f4dzpLJCHeKJ4I=";
  };

  build-system = [
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2587,6 +2587,10 @@ with pkgs;
    privsepPath = "/var/empty";
  };

+  openobserve-ee = callPackage ../by-name/op/openobserve/package.nix {
+    enableEnterprise = true;
+  };
+
  openrgb-with-all-plugins = openrgb.withPlugins [
    openrgb-plugin-effects
    openrgb-plugin-hardwaresync
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4623,6 +4623,10 @@ self: super: with self; {

  django-error-report-2 = callPackage ../development/python-modules/django-error-report-2 { };

+  django-extended-makemessages =
+    callPackage ../development/python-modules/django-extended-makemessages
+      { };
+
  django-extensions = callPackage ../development/python-modules/django-extensions { };

  django-filer = callPackage ../development/python-modules/django-filer { };
@@ -5945,10 +5949,14 @@ self: super: with self; {

  fastrlock = callPackage ../development/python-modules/fastrlock { };

+  fastspec = callPackage ../development/python-modules/fastspec { };
+
  fasttext = callPackage ../development/python-modules/fasttext { };

  fasttransform = callPackage ../development/python-modules/fasttransform { };

+  fasttransport = callPackage ../development/python-modules/fasttransport { };
+
  fastuuid = callPackage ../development/python-modules/fastuuid { };

  faust-cchardet = callPackage ../development/python-modules/faust-cchardet { };
@@ -19970,6 +19978,10 @@ self: super: with self; {

  strct = callPackage ../development/python-modules/strct { };

+  stream-inflate = callPackage ../development/python-modules/stream-inflate { };
+
+  stream-unzip = callPackage ../development/python-modules/stream-unzip { };
+
  streamcontroller-plugin-tools =
    callPackage ../development/python-modules/streamcontroller-plugin-tools
      { };
@@ -22287,6 +22299,8 @@ self: super: with self; {

  vulkan = callPackage ../development/python-modules/vulkan { };

+  vulners = callPackage ../development/python-modules/vulners { };
+
  vultr = callPackage ../development/python-modules/vultr { };

  vulture = callPackage ../development/python-modules/vulture { };