Merge release-26.05 into staging-nixos-26.05

2026-07-20 23:51:03 +00:00 · 2026-07-13 00:36:50 +00:00
parent c197add285 74258951b6
commit f7cfa029cb
39 changed files with 732 additions and 538 deletions
--- a/nixos/modules/config/swap.nix
+++ b/nixos/modules/config/swap.nix
@@ -106,6 +106,11 @@ let
          description = "Path of the device or swap file.";
        };

+        isDevice = mkOption {
+          default = lib.substring 0 5 config.device == "/dev/";
+          internal = true;
+        };
+
        label = mkOption {
          example = "swap";
          type = types.str;
@@ -329,6 +334,7 @@ in
                  )
                } ${sw.device} ${sw.deviceName}
                mkswap ${sw.realDevice}
+                ${lib.optionalString sw.isDevice "udevadm trigger ${sw.realDevice}"}
              ''}
            '';
            enableStrictShellChecks = true;
--- a/nixos/modules/services/editors/emacs.nix
+++ b/nixos/modules/services/editors/emacs.nix
@@ -80,6 +80,9 @@ in
      unitConfig = lib.optionalAttrs cfg.startWithGraphical {
        After = "graphical-session.target";
      };
+
+      # Long-lived session that ought to only be restarted manually
+      restartIfChanged = false;
    }
    // lib.optionalAttrs cfg.enable {
      wantedBy = if cfg.startWithGraphical then [ "graphical-session.target" ] else [ "default.target" ];
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -221,7 +221,7 @@ stdenv.mkDerivation (finalAttrs: {

  dontUnpack = true;

-  inherit libPath;
+  inherit libPath stageModules;

  autoPatchelfIgnoreMissingDeps = [
    "libssl.so.1.1"
@@ -260,7 +260,7 @@ stdenv.mkDerivation (finalAttrs: {
        --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
        --prefix LD_LIBRARY_PATH : ${finalAttrs.libPath}:$out/opt/${binaryName} \
        ${lib.strings.optionalString disableUpdates "--run ${lib.getExe disableBreakingUpdates}"} \
-        --run "${stageModules} $out/opt/${binaryName}/modules" \
+        --run "${finalAttrs.stageModules} $out/opt/${binaryName}/modules" \
        --add-flags ${lib.escapeShellArg commandLineArgs}

    ln -s $out/opt/${binaryName}/${binaryName} $out/bin/
--- a/pkgs/by-name/ad/adw-bluetooth/package.nix
+++ b/pkgs/by-name/ad/adw-bluetooth/package.nix
@@ -15,13 +15,13 @@
 }:

 let
-  version = "1.1.0";
+  version = "1.1.2";

  src = fetchFromGitHub {
    owner = "ezratweaver";
    repo = "adw-bluetooth";
    tag = version;
-    hash = "sha256-h3cHtecwBsx3j33qXVn/zaq4FZext71P7flzunCHqHg=";
+    hash = "sha256-0rySzx03KeKeqtl0yrbnj/tVbpVPBAKDz+1qLQ5kZRc=";
  };

  daemon = buildGoModule {
--- a/pkgs/by-name/ap/apache-airflow/providers.nix
+++ b/pkgs/by-name/ap/apache-airflow/providers.nix
@@ -6,16 +6,25 @@
      "airflow.providers.airbyte"
      "airflow.providers.airbyte.get_provider_info"
    ];
-    version = "5.3.3";
+    version = "5.5.1";
+  };
+
+  akeyless = {
+    deps = [ ];
+    imports = [
+      "airflow.providers.akeyless"
+      "airflow.providers.akeyless.get_provider_info"
+    ];
+    version = "0.2.0";
  };

  alibaba = {
-    deps = [ "oss2" ];
+    deps = [ "alibabacloud-tea-openapi" ];
    imports = [
      "airflow.providers.alibaba"
      "airflow.providers.alibaba.get_provider_info"
    ];
-    version = "3.3.5";
+    version = "3.3.9";
  };

  amazon = {
@@ -41,7 +50,7 @@
      "airflow.providers.amazon"
      "airflow.providers.amazon.get_provider_info"
    ];
-    version = "9.23.0";
+    version = "9.31.0";
  };

  apache_beam = {
@@ -63,7 +72,7 @@
      "airflow.providers.apache.cassandra"
      "airflow.providers.apache.cassandra.get_provider_info"
    ];
-    version = "3.9.2";
+    version = "3.9.5";
  };

  apache_drill = {
@@ -72,7 +81,7 @@
      "airflow.providers.apache.drill"
      "airflow.providers.apache.drill.get_provider_info"
    ];
-    version = "3.3.0";
+    version = "3.3.3";
  };

  apache_druid = {
@@ -81,7 +90,7 @@
      "airflow.providers.apache.druid"
      "airflow.providers.apache.druid.get_provider_info"
    ];
-    version = "4.5.0";
+    version = "4.5.2";
  };

  apache_flink = {
@@ -90,7 +99,7 @@
      "airflow.providers.apache.flink"
      "airflow.providers.apache.flink.get_provider_info"
    ];
-    version = "1.8.3";
+    version = "1.8.5";
  };

  apache_hdfs = {
@@ -103,7 +112,7 @@
      "airflow.providers.apache.hdfs"
      "airflow.providers.apache.hdfs.get_provider_info"
    ];
-    version = "4.11.3";
+    version = "4.12.1";
  };

  apache_hive = {
@@ -117,16 +126,16 @@
      "airflow.providers.apache.hive"
      "airflow.providers.apache.hive.get_provider_info"
    ];
-    version = "9.4.0";
+    version = "9.5.0";
  };

  apache_iceberg = {
-    deps = [ ];
+    deps = [ "pyiceberg" ];
    imports = [
      "airflow.providers.apache.iceberg"
      "airflow.providers.apache.iceberg.get_provider_info"
    ];
-    version = "2.0.0";
+    version = "2.0.3";
  };

  apache_impala = {
@@ -138,7 +147,7 @@
      "airflow.providers.apache.impala"
      "airflow.providers.apache.impala.get_provider_info"
    ];
-    version = "1.9.0";
+    version = "1.9.3";
  };

  apache_kafka = {
@@ -150,7 +159,7 @@
      "airflow.providers.apache.kafka"
      "airflow.providers.apache.kafka.get_provider_info"
    ];
-    version = "1.13.0";
+    version = "1.14.0";
  };

  apache_kylin = {
@@ -159,7 +168,7 @@
      "airflow.providers.apache.kylin"
      "airflow.providers.apache.kylin.get_provider_info"
    ];
-    version = "3.10.2";
+    version = "3.10.5";
  };

  apache_livy = {
@@ -168,7 +177,7 @@
      "airflow.providers.apache.livy"
      "airflow.providers.apache.livy.get_provider_info"
    ];
-    version = "4.5.3";
+    version = "4.5.7";
  };

  apache_pig = {
@@ -177,7 +186,7 @@
      "airflow.providers.apache.pig"
      "airflow.providers.apache.pig.get_provider_info"
    ];
-    version = "4.8.2";
+    version = "4.8.5";
  };

  apache_pinot = {
@@ -186,19 +195,21 @@
      "airflow.providers.apache.pinot"
      "airflow.providers.apache.pinot.get_provider_info"
    ];
-    version = "4.10.0";
+    version = "4.10.3";
  };

  apache_spark = {
    deps = [
      "grpcio-status"
      "pyspark"
+      "requests"
+      "tenacity"
    ];
    imports = [
      "airflow.providers.apache.spark"
      "airflow.providers.apache.spark.get_provider_info"
    ];
-    version = "5.6.0";
+    version = "6.2.0";
  };

  apache_tinkerpop = {
@@ -207,7 +218,7 @@
      "airflow.providers.apache.tinkerpop"
      "airflow.providers.apache.tinkerpop.get_provider_info"
    ];
-    version = "1.1.1";
+    version = "1.1.4";
  };

  apprise = {
@@ -216,7 +227,7 @@
      "airflow.providers.apprise"
      "airflow.providers.apprise.get_provider_info"
    ];
-    version = "2.3.1";
+    version = "2.3.4";
  };

  arangodb = {
@@ -225,7 +236,7 @@
      "airflow.providers.arangodb"
      "airflow.providers.arangodb.get_provider_info"
    ];
-    version = "2.9.2";
+    version = "2.9.5";
  };

  asana = {
@@ -234,7 +245,7 @@
      "airflow.providers.asana"
      "airflow.providers.asana.get_provider_info"
    ];
-    version = "2.11.1";
+    version = "2.11.4";
  };

  atlassian_jira = {
@@ -243,7 +254,7 @@
      "airflow.providers.atlassian.jira"
      "airflow.providers.atlassian.jira.get_provider_info"
    ];
-    version = "3.3.1";
+    version = "3.3.4";
  };

  celery = {
@@ -255,7 +266,16 @@
      "airflow.providers.celery"
      "airflow.providers.celery.get_provider_info"
    ];
-    version = "3.17.1";
+    version = "3.20.0";
+  };
+
+  clickhousedb = {
+    deps = [ "clickhouse-connect" ];
+    imports = [
+      "airflow.providers.clickhousedb"
+      "airflow.providers.clickhousedb.get_provider_info"
+    ];
+    version = "1.0.0";
  };

  cloudant = {
@@ -264,7 +284,7 @@
      "airflow.providers.cloudant"
      "airflow.providers.cloudant.get_provider_info"
    ];
-    version = "4.3.2";
+    version = "4.3.5";
  };

  cncf_kubernetes = {
@@ -280,7 +300,7 @@
      "airflow.providers.cncf.kubernetes"
      "airflow.providers.cncf.kubernetes.get_provider_info"
    ];
-    version = "10.14.0";
+    version = "10.18.1";
  };

  cohere = {
@@ -292,19 +312,27 @@
      "airflow.providers.cohere"
      "airflow.providers.cohere.get_provider_info"
    ];
-    version = "1.6.3";
+    version = "1.6.6";
  };

  common_ai = {
    deps = [
+      "fastavro"
+      "langchain"
+      "llama-index-core"
+      "llama-index-embeddings-openai"
+      "llama-index-llms-openai"
+      "pyarrow"
      "pydantic-ai-slim"
+      "pypdf"
+      "python-docx"
      "sqlglot"
    ];
    imports = [
      "airflow.providers.common.ai"
      "airflow.providers.common.ai.get_provider_info"
    ];
-    version = "0.0.1";
+    version = "0.5.0";
  };

  common_compat = {
@@ -313,7 +341,7 @@
      "airflow.providers.common.compat"
      "airflow.providers.common.compat.get_provider_info"
    ];
-    version = "1.14.1";
+    version = "1.15.0";
  };

  common_io = {
@@ -322,7 +350,7 @@
      "airflow.providers.common.io"
      "airflow.providers.common.io.get_provider_info"
    ];
-    version = "1.7.1";
+    version = "1.7.3";
  };

  common_messaging = {
@@ -331,7 +359,7 @@
      "airflow.providers.common.messaging"
      "airflow.providers.common.messaging.get_provider_info"
    ];
-    version = "2.0.2";
+    version = "2.0.4";
  };

  common_sql = {
@@ -349,7 +377,7 @@
      "airflow.providers.common.sql"
      "airflow.providers.common.sql.get_provider_info"
    ];
-    version = "1.33.0";
+    version = "2.0.1";
  };

  databricks = {
@@ -368,7 +396,7 @@
      "airflow.providers.databricks"
      "airflow.providers.databricks.get_provider_info"
    ];
-    version = "7.11.0";
+    version = "7.16.1";
  };

  datadog = {
@@ -377,7 +405,7 @@
      "airflow.providers.datadog"
      "airflow.providers.datadog.get_provider_info"
    ];
-    version = "3.10.2";
+    version = "3.10.5";
  };

  dbt_cloud = {
@@ -390,7 +418,7 @@
      "airflow.providers.dbt.cloud"
      "airflow.providers.dbt.cloud.get_provider_info"
    ];
-    version = "4.7.0";
+    version = "4.9.2";
  };

  dingding = {
@@ -399,7 +427,7 @@
      "airflow.providers.dingding"
      "airflow.providers.dingding.get_provider_info"
    ];
-    version = "3.9.2";
+    version = "3.9.5";
  };

  discord = {
@@ -408,7 +436,7 @@
      "airflow.providers.discord"
      "airflow.providers.discord.get_provider_info"
    ];
-    version = "3.12.0";
+    version = "3.12.3";
  };

  docker = {
@@ -420,7 +448,7 @@
      "airflow.providers.docker"
      "airflow.providers.docker.get_provider_info"
    ];
-    version = "4.5.3";
+    version = "4.5.7";
  };

  edge3 = {
@@ -434,16 +462,19 @@
      "airflow.providers.edge3"
      "airflow.providers.edge3.get_provider_info"
    ];
-    version = "3.2.0";
+    version = "4.0.0";
  };

  elasticsearch = {
-    deps = [ "elasticsearch" ];
+    deps = [
+      "elasticsearch"
+      "polars"
+    ];
    imports = [
      "airflow.providers.elasticsearch"
      "airflow.providers.elasticsearch.get_provider_info"
    ];
-    version = "6.5.0";
+    version = "6.7.0";
  };

  exasol = {
@@ -455,11 +486,12 @@
      "airflow.providers.exasol"
      "airflow.providers.exasol.get_provider_info"
    ];
-    version = "4.10.0";
+    version = "4.10.3";
  };

  fab = {
    deps = [
+      "authlib"
      "blinker"
      "cachetools"
      "flask"
@@ -481,7 +513,7 @@
      "airflow.providers.fab"
      "airflow.providers.fab.get_provider_info"
    ];
-    version = "3.5.0";
+    version = "3.7.0";
  };

  facebook = {
@@ -490,7 +522,7 @@
      "airflow.providers.facebook"
      "airflow.providers.facebook.get_provider_info"
    ];
-    version = "3.9.2";
+    version = "3.9.5";
  };

  ftp = {
@@ -499,7 +531,7 @@
      "airflow.providers.ftp"
      "airflow.providers.ftp.get_provider_info"
    ];
-    version = "3.14.1";
+    version = "3.15.1";
  };

  git = {
@@ -508,7 +540,7 @@
      "airflow.providers.git"
      "airflow.providers.git.get_provider_info"
    ];
-    version = "0.2.4";
+    version = "0.4.0";
  };

  github = {
@@ -517,7 +549,7 @@
      "airflow.providers.github"
      "airflow.providers.github.get_provider_info"
    ];
-    version = "2.11.0";
+    version = "2.11.3";
  };

  google = {
@@ -563,6 +595,7 @@
      "plyvel"
      "proto-plus"
      "pyarrow"
+      "pydantic"
      "python-slugify"
      "ray"
      "tenacity"
@@ -572,7 +605,7 @@
      "airflow.providers.google"
      "airflow.providers.google.get_provider_info"
    ];
-    version = "21.0.0";
+    version = "22.2.0";
  };

  grpc = {
@@ -585,7 +618,7 @@
      "airflow.providers.grpc"
      "airflow.providers.grpc.get_provider_info"
    ];
-    version = "3.9.2";
+    version = "3.9.5";
  };

  hashicorp = {
@@ -597,13 +630,14 @@
      "airflow.providers.hashicorp"
      "airflow.providers.hashicorp.get_provider_info"
    ];
-    version = "4.5.0";
+    version = "4.7.1";
  };

  http = {
    deps = [
      "aiohttp"
      "asgiref"
+      "pydantic"
      "requests"
      "requests-toolbelt"
    ];
@@ -611,7 +645,16 @@
      "airflow.providers.http"
      "airflow.providers.http.get_provider_info"
    ];
-    version = "6.0.0";
+    version = "6.0.4";
+  };
+
+  ibm_mq = {
+    deps = [ "asgiref" ];
+    imports = [
+      "airflow.providers.ibm.mq"
+      "airflow.providers.ibm.mq.get_provider_info"
+    ];
+    version = "0.1.0";
  };

  imap = {
@@ -620,28 +663,29 @@
      "airflow.providers.imap"
      "airflow.providers.imap.get_provider_info"
    ];
-    version = "3.11.0";
+    version = "3.11.3";
  };

  influxdb = {
    deps = [
      "influxdb-client"
+      "influxdb3-python"
      "requests"
    ];
    imports = [
      "airflow.providers.influxdb"
      "airflow.providers.influxdb.get_provider_info"
    ];
-    version = "2.10.2";
+    version = "2.11.0";
  };

  informatica = {
-    deps = [ ];
+    deps = [ "sqlglot" ];
    imports = [
      "airflow.providers.informatica"
      "airflow.providers.informatica.get_provider_info"
    ];
-    version = "0.1.1";
+    version = "0.2.0";
  };

  jdbc = {
@@ -653,7 +697,7 @@
      "airflow.providers.jdbc"
      "airflow.providers.jdbc.get_provider_info"
    ];
-    version = "5.4.1";
+    version = "5.5.0";
  };

  jenkins = {
@@ -662,7 +706,7 @@
      "airflow.providers.jenkins"
      "airflow.providers.jenkins.get_provider_info"
    ];
-    version = "4.2.3";
+    version = "4.2.6";
  };

  keycloak = {
@@ -671,7 +715,7 @@
      "airflow.providers.keycloak"
      "airflow.providers.keycloak.get_provider_info"
    ];
-    version = "0.6.0";
+    version = "0.8.0";
  };

  microsoft_azure = {
@@ -709,7 +753,7 @@
      "airflow.providers.microsoft.azure"
      "airflow.providers.microsoft.azure.get_provider_info"
    ];
-    version = "13.0.1";
+    version = "13.5.0";
  };

  microsoft_mssql = {
@@ -721,7 +765,7 @@
      "airflow.providers.microsoft.mssql"
      "airflow.providers.microsoft.mssql.get_provider_info"
    ];
-    version = "4.5.0";
+    version = "4.7.0";
  };

  microsoft_psrp = {
@@ -730,7 +774,7 @@
      "airflow.providers.microsoft.psrp"
      "airflow.providers.microsoft.psrp.get_provider_info"
    ];
-    version = "3.2.3";
+    version = "3.2.6";
  };

  microsoft_winrm = {
@@ -739,7 +783,7 @@
      "airflow.providers.microsoft.winrm"
      "airflow.providers.microsoft.winrm.get_provider_info"
    ];
-    version = "3.14.0";
+    version = "3.14.3";
  };

  mongo = {
@@ -751,12 +795,13 @@
      "airflow.providers.mongo"
      "airflow.providers.mongo.get_provider_info"
    ];
-    version = "5.3.3";
+    version = "5.4.0";
  };

  mysql = {
    deps = [
      "aiomysql"
+      "mysql-connector-python"
      "mysqlclient"
      "pymysql"
    ];
@@ -764,7 +809,7 @@
      "airflow.providers.mysql"
      "airflow.providers.mysql.get_provider_info"
    ];
-    version = "6.5.0";
+    version = "6.6.1";
  };

  neo4j = {
@@ -773,7 +818,7 @@
      "airflow.providers.neo4j"
      "airflow.providers.neo4j.get_provider_info"
    ];
-    version = "3.11.3";
+    version = "3.11.6";
  };

  odbc = {
@@ -782,7 +827,7 @@
      "airflow.providers.odbc"
      "airflow.providers.odbc.get_provider_info"
    ];
-    version = "4.12.0";
+    version = "4.12.3";
  };

  openai = {
@@ -791,7 +836,7 @@
      "airflow.providers.openai"
      "airflow.providers.openai.get_provider_info"
    ];
-    version = "1.7.2";
+    version = "1.7.5";
  };

  openfaas = {
@@ -800,7 +845,7 @@
      "airflow.providers.openfaas"
      "airflow.providers.openfaas.get_provider_info"
    ];
-    version = "3.9.2";
+    version = "3.9.5";
  };

  openlineage = {
@@ -812,7 +857,7 @@
      "airflow.providers.openlineage"
      "airflow.providers.openlineage.get_provider_info"
    ];
-    version = "2.12.0";
+    version = "2.18.1";
  };

  opensearch = {
@@ -821,7 +866,7 @@
      "airflow.providers.opensearch"
      "airflow.providers.opensearch.get_provider_info"
    ];
-    version = "1.8.4";
+    version = "1.10.0";
  };

  opsgenie = {
@@ -830,7 +875,7 @@
      "airflow.providers.opsgenie"
      "airflow.providers.opsgenie.get_provider_info"
    ];
-    version = "5.10.1";
+    version = "5.10.4";
  };

  oracle = {
@@ -842,7 +887,7 @@
      "airflow.providers.oracle"
      "airflow.providers.oracle.get_provider_info"
    ];
-    version = "4.5.1";
+    version = "4.6.1";
  };

  pagerduty = {
@@ -851,7 +896,7 @@
      "airflow.providers.pagerduty"
      "airflow.providers.pagerduty.get_provider_info"
    ];
-    version = "5.2.3";
+    version = "5.2.6";
  };

  papermill = {
@@ -865,7 +910,7 @@
      "airflow.providers.papermill"
      "airflow.providers.papermill.get_provider_info"
    ];
-    version = "3.12.1";
+    version = "3.13.1";
  };

  pgvector = {
@@ -874,7 +919,7 @@
      "airflow.providers.pgvector"
      "airflow.providers.pgvector.get_provider_info"
    ];
-    version = "1.7.0";
+    version = "1.7.2";
  };

  pinecone = {
@@ -883,7 +928,7 @@
      "airflow.providers.pinecone"
      "airflow.providers.pinecone.get_provider_info"
    ];
-    version = "2.4.2";
+    version = "2.4.5";
  };

  postgres = {
@@ -899,7 +944,7 @@
      "airflow.providers.postgres"
      "airflow.providers.postgres.get_provider_info"
    ];
-    version = "6.6.1";
+    version = "6.8.0";
  };

  presto = {
@@ -913,7 +958,7 @@
      "airflow.providers.presto"
      "airflow.providers.presto.get_provider_info"
    ];
-    version = "5.11.0";
+    version = "5.12.0";
  };

  qdrant = {
@@ -922,7 +967,7 @@
      "airflow.providers.qdrant"
      "airflow.providers.qdrant.get_provider_info"
    ];
-    version = "1.5.3";
+    version = "1.5.6";
  };

  redis = {
@@ -931,7 +976,7 @@
      "airflow.providers.redis"
      "airflow.providers.redis.get_provider_info"
    ];
-    version = "4.4.2";
+    version = "4.5.0";
  };

  salesforce = {
@@ -943,7 +988,7 @@
      "airflow.providers.salesforce"
      "airflow.providers.salesforce.get_provider_info"
    ];
-    version = "5.12.3";
+    version = "5.14.1";
  };

  samba = {
@@ -952,7 +997,7 @@
      "airflow.providers.samba"
      "airflow.providers.samba.get_provider_info"
    ];
-    version = "4.12.3";
+    version = "4.12.6";
  };

  segment = {
@@ -961,23 +1006,21 @@
      "airflow.providers.segment"
      "airflow.providers.segment.get_provider_info"
    ];
-    version = "3.9.2";
+    version = "3.9.5";
  };

  sendgrid = {
-    deps = [
-      "sendgrid"
-      "werkzeug"
-    ];
+    deps = [ "sendgrid" ];
    imports = [
      "airflow.providers.sendgrid"
      "airflow.providers.sendgrid.get_provider_info"
    ];
-    version = "4.2.1";
+    version = "4.2.4";
  };

  sftp = {
    deps = [
+      "aiofiles"
      "asyncssh"
      "paramiko"
      "pysftp"
@@ -987,7 +1030,7 @@
      "airflow.providers.sftp"
      "airflow.providers.sftp.get_provider_info"
    ];
-    version = "5.7.1";
+    version = "5.8.2";
  };

  singularity = {
@@ -996,11 +1039,12 @@
      "airflow.providers.singularity"
      "airflow.providers.singularity.get_provider_info"
    ];
-    version = "3.9.2";
+    version = "3.9.4";
  };

  slack = {
    deps = [
+      "aiohttp"
      "asgiref"
      "slack-sdk"
    ];
@@ -1008,7 +1052,7 @@
      "airflow.providers.slack"
      "airflow.providers.slack.get_provider_info"
    ];
-    version = "9.8.0";
+    version = "9.10.2";
  };

  smtp = {
@@ -1017,7 +1061,7 @@
      "airflow.providers.smtp"
      "airflow.providers.smtp.get_provider_info"
    ];
-    version = "2.4.3";
+    version = "3.0.1";
  };

  snowflake = {
@@ -1032,7 +1076,7 @@
      "airflow.providers.snowflake"
      "airflow.providers.snowflake.get_provider_info"
    ];
-    version = "6.11.0";
+    version = "6.14.0";
  };

  sqlite = {
@@ -1041,20 +1085,19 @@
      "airflow.providers.sqlite"
      "airflow.providers.sqlite.get_provider_info"
    ];
-    version = "4.3.0";
+    version = "4.3.3";
  };

  ssh = {
    deps = [
      "asyncssh"
      "paramiko"
-      "sshtunnel"
    ];
    imports = [
      "airflow.providers.ssh"
      "airflow.providers.ssh.get_provider_info"
    ];
-    version = "4.3.2";
+    version = "5.0.3";
  };

  standard = {
@@ -1063,7 +1106,7 @@
      "airflow.providers.standard"
      "airflow.providers.standard.get_provider_info"
    ];
-    version = "1.12.1";
+    version = "1.15.0";
  };

  tableau = {
@@ -1072,7 +1115,7 @@
      "airflow.providers.tableau"
      "airflow.providers.tableau.get_provider_info"
    ];
-    version = "5.3.3";
+    version = "5.5.0";
  };

  telegram = {
@@ -1081,7 +1124,7 @@
      "airflow.providers.telegram"
      "airflow.providers.telegram.get_provider_info"
    ];
-    version = "4.9.2";
+    version = "4.9.5";
  };

  teradata = {
@@ -1090,7 +1133,7 @@
      "airflow.providers.teradata"
      "airflow.providers.teradata.get_provider_info"
    ];
-    version = "3.5.0";
+    version = "3.6.0";
  };

  trino = {
@@ -1099,7 +1142,7 @@
      "airflow.providers.trino"
      "airflow.providers.trino.get_provider_info"
    ];
-    version = "6.5.0";
+    version = "6.6.0";
  };

  vertica = {
@@ -1111,7 +1154,16 @@
      "airflow.providers.vertica"
      "airflow.providers.vertica.get_provider_info"
    ];
-    version = "4.3.0";
+    version = "4.4.0";
+  };
+
+  vespa = {
+    deps = [ ];
+    imports = [
+      "airflow.providers.vespa"
+      "airflow.providers.vespa.get_provider_info"
+    ];
+    version = "0.1.1";
  };

  weaviate = {
@@ -1124,7 +1176,7 @@
      "airflow.providers.weaviate"
      "airflow.providers.weaviate.get_provider_info"
    ];
-    version = "3.3.1";
+    version = "3.3.5";
  };

  yandex = {
@@ -1133,7 +1185,7 @@
      "airflow.providers.yandex"
      "airflow.providers.yandex.get_provider_info"
    ];
-    version = "4.4.0";
+    version = "4.5.0";
  };

  ydb = {
@@ -1142,7 +1194,7 @@
      "airflow.providers.ydb"
      "airflow.providers.ydb.get_provider_info"
    ];
-    version = "2.5.0";
+    version = "2.5.3";
  };

  zendesk = {
@@ -1151,7 +1203,7 @@
      "airflow.providers.zendesk"
      "airflow.providers.zendesk.get_provider_info"
    ];
-    version = "4.11.1";
+    version = "4.12.0";
  };

 }
--- a/pkgs/by-name/ap/apache-airflow/python-package.nix
+++ b/pkgs/by-name/ap/apache-airflow/python-package.nix
@@ -36,6 +36,7 @@
  hatchling,
  httpx,
  importlib-metadata,
+  isoduration,
  itsdangerous,
  jinja2,
  jsonschema,
@@ -88,355 +89,355 @@

  enabledProviders,
 }:
-let
-  version = "3.2.2";
+buildPythonPackage (
+  finalAttrs:
+  let
+    inherit (finalAttrs) src version;

-  src = fetchFromGitHub {
-    owner = "apache";
-    repo = "airflow";
-    tag = version;
-    hash = "sha256-nAFSLdcKmP2CNm3rx+/fwIsJnpju7wBl+fYWQV8p+sU=";
-  };
+    airflowUi = stdenv.mkDerivation (uiAttrs: {
+      pname = "airflow-ui-assets";
+      inherit src version;
+      sourceRoot = "${src.name}/airflow-core/src/airflow/ui";

-  pnpm = pnpm_10;
+      # vite build resolves "localhost" during the build, which the darwin
+      # sandbox blocks by default (getaddrinfo ENOTFOUND localhost).
+      __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;

-  airflowUi = stdenv.mkDerivation rec {
-    pname = "airflow-ui-assets";
-    inherit src version;
-    sourceRoot = "${src.name}/airflow-core/src/airflow/ui";
+      nativeBuildInputs = [
+        nodejs
+        pnpm_10
+        pnpmConfigHook
+      ];

-    # vite build resolves "localhost" during the build, which the darwin
-    # sandbox blocks by default (getaddrinfo ENOTFOUND localhost).
-    __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+      pnpmDeps = fetchPnpmDeps {
+        pname = "airflow-ui";
+        inherit src version;
+        pnpm = pnpm_10;
+        sourceRoot = uiAttrs.sourceRoot;
+        fetcherVersion = 3;
+        hash = "sha256-bKdZ4Y+enrXYuSpJ85eFHl2EM+QfZsMTGqQZ9yLfGEc=";
+      };

-    nativeBuildInputs = [
-      nodejs
-      pnpm
-      pnpmConfigHook
+      buildPhase = ''
+        pnpm install
+        pnpm build
+      '';
+
+      installPhase = ''
+        mkdir -p $out/share/airflow/ui
+        cp -r dist $out/share/airflow/ui/
+      '';
+    });
+
+    airflowSimpleAuthUi = stdenv.mkDerivation (simpleUiAttrs: {
+      pname = "airflow-simple-ui-assets";
+      inherit src version;
+      sourceRoot = "${src.name}/airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui";
+
+      __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+
+      nativeBuildInputs = [
+        nodejs
+        pnpm_10
+        pnpmConfigHook
+      ];
+
+      pnpmDeps = fetchPnpmDeps {
+        pname = "simple-auth-manager-ui";
+        inherit src version;
+        pnpm = pnpm_10;
+        sourceRoot = simpleUiAttrs.sourceRoot;
+        fetcherVersion = 3;
+        hash = "sha256-Ye8jRs9jgsf3YUd3JPldEcTzQFmgS4cvkOVP6tuZw+8=";
+      };
+
+      buildPhase = ''
+        pnpm install
+        pnpm build
+      '';
+
+      installPhase = ''
+        mkdir -p $out/share/airflow/simple-ui
+        cp -r dist $out/share/airflow/simple-ui/
+      '';
+    });
+
+    requiredProviders = [
+      "common_compat"
+      "common_io"
+      "common_sql"
+      "smtp"
+      "standard"
    ];

-    pnpmDeps = fetchPnpmDeps {
-      pname = "airflow-ui";
-      inherit
-        sourceRoot
-        src
-        version
-        pnpm
-        ;
-      fetcherVersion = 3;
-      hash = "sha256-wJ2u+y3umecL4IeVW/29/yDgYZ77ffOBQLHeplD3XlQ=";
-    };
+    providers = import ./providers.nix;

-    buildPhase = ''
-      pnpm install
-      pnpm build
-    '';
+    buildProvider =
+      provider:
+      buildPythonPackage {
+        pname = "apache-airflow-providers-${provider}";
+        version = providers.${provider}.version;
+        pyproject = true;

-    installPhase = ''
-      mkdir -p $out/share/airflow/ui
-      cp -r dist $out/share/airflow/ui/
-    '';
-  };
+        inherit src;
+        sourceRoot = "${src.name}/providers/${lib.replaceStrings [ "_" ] [ "/" ] provider}";

-  airflowSimpleAuthUi = stdenv.mkDerivation rec {
-    pname = "airflow-simple-ui-assets";
-    inherit src version;
-    sourceRoot = "${src.name}/airflow-core/src/airflow/api_fastapi/auth/managers/simple/ui";
+        buildInputs = [ flit-core ];

-    __darwinAllowLocalNetworking = stdenv.hostPlatform.isDarwin;
+        dependencies = map (dep: python.pkgs.${dep}) providers.${provider}.deps;

-    nativeBuildInputs = [
-      nodejs
-      pnpm
-      pnpmConfigHook
-    ];
+        pythonRemoveDeps = [
+          "apache-airflow"
+        ];

-    pnpmDeps = fetchPnpmDeps {
-      pname = "simple-auth-manager-ui";
-      inherit
-        sourceRoot
-        src
-        version
-        pnpm
-        ;
-      fetcherVersion = 3;
-      hash = "sha256-AKaafmDjIlg4eFJT1JGyelXVjcId8f0iXTR3JK4ZMq0=";
-    };
+        pythonRelaxDeps = [
+          "flit-core"
+        ];
+      };

-    buildPhase = ''
-      pnpm install
-      pnpm build
-    '';
-
-    installPhase = ''
-      mkdir -p $out/share/airflow/simple-ui
-      cp -r dist $out/share/airflow/simple-ui/
-    '';
-  };
-
-  requiredProviders = [
-    "common_compat"
-    "common_io"
-    "common_sql"
-    "smtp"
-    "standard"
-  ];
-
-  providers = import ./providers.nix;
-
-  buildProvider =
-    provider:
-    buildPythonPackage {
-      pname = "apache-airflow-providers-${provider}";
-      version = providers.${provider}.version;
+    taskSdk = buildPythonPackage {
+      pname = "task-sdk";
+      inherit src version;
      pyproject = true;

-      inherit src;
-      sourceRoot = "${src.name}/providers/${lib.replaceStrings [ "_" ] [ "/" ] provider}";
+      sourceRoot = "${src.name}/task-sdk";

-      buildInputs = [ flit-core ];
+      postPatch = ''
+        # resolve cyclic dependency
+        sed -i -E 's/"apache-airflow-core[^"]+",//' pyproject.toml

-      dependencies = map (dep: python.pkgs.${dep}) providers.${provider}.deps;
+        # relax dependencies
+        sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+        sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+        sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml

-      pythonRemoveDeps = [
-        "apache-airflow"
+        # task-sdk needs config.yml from core subpackage
+        mkdir -p src/airflow/config_templates
+        cp ../airflow-core/src/airflow/config_templates/* src/airflow/config_templates/
+      '';
+
+      build-system = [
+        hatchling
      ];

-      pythonRelaxDeps = [
-        "flit-core"
+      dependencies = [
+        asgiref
+        attrs
+        babel
+        colorlog
+        fsspec
+        greenback
+        httpx
+        isoduration
+        jinja2
+        jsonschema
+        methodtools
+        msgspec
+        opentelemetry-api
+        pendulum
+        psutil
+        pydantic
+        pygtrie
+        python-dateutil
+        requests
+        retryhttp
+        structlog
+        tenacity
+        types-requests
      ];
    };

-  airflowCore = buildPythonPackage {
-    pname = "apache-airflow-core";
-    inherit src version;
+    airflowCore = buildPythonPackage {
+      pname = "apache-airflow-core";
+      inherit src version;
+      pyproject = true;
+
+      sourceRoot = "${src.name}/airflow-core";
+
+      postPatch = ''
+        # remove cyclic dependency
+        sed -i -E 's/"apache-airflow-task-sdk[^"]+",//' pyproject.toml
+
+        # relax dependencies
+        sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+        sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+        sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
+        sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+        sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
+        sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
+
+        # Copy built UI assets
+        cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
+        cp -r ${airflowSimpleAuthUi}/share/airflow/simple-ui/dist src/airflow/api_fastapi/auth/managers/simple/ui/
+      '';
+
+      build-system = [
+        gitdb
+        gitpython
+        hatchling
+        packaging
+        smmap
+        tomli
+        trove-classifiers
+      ];
+
+      dependencies = [
+        a2wsgi
+        aiosqlite
+        alembic
+        argcomplete
+        asgiref
+        attrs
+        cachetools
+        cadwyn
+        colorlog
+        cron-descriptor
+        croniter
+        cryptography
+        deprecated
+        dill
+        fastapi
+        httpx
+        importlib-metadata
+        itsdangerous
+        jinja2
+        jsonschema
+        lazy-object-proxy
+        libcst
+        linkify-it-py
+        lockfile
+        methodtools
+        msgspec
+        natsort
+        opentelemetry-api
+        opentelemetry-exporter-otlp
+        packaging
+        pathspec
+        pendulum
+        pluggy
+        psutil
+        pydantic
+        pygments
+        pygtrie
+        pyjwt
+        python-daemon
+        python-dateutil
+        python-slugify
+        pyyaml
+        requests
+        rich
+        rich-argparse
+        rich-click
+        setproctitle
+        sqlalchemy
+        sqlalchemy-jsonfield
+        sqlalchemy-utils
+        starlette
+        structlog
+        svcs
+        tabulate
+        taskSdk
+        tenacity
+        termcolor
+        typing-extensions
+        universal-pathlib
+        uuid6
+        uvicorn
+      ]
+      ++ (map buildProvider requiredProviders);
+
+      pythonRelaxDeps = [ "starlette" ];
+    };
+  in
+  {
+    pname = "apache-airflow";
+    version = "3.3.0";
+
+    strictDeps = true;
+    __structuredAttrs = true;
+
+    src = fetchFromGitHub {
+      owner = "apache";
+      repo = "airflow";
+      tag = finalAttrs.version;
+      hash = "sha256-1DRaJCJ488BKUOEFaFMGnZjS2yxBx4pwHvIP67juu54=";
+    };
+
    pyproject = true;

-    sourceRoot = "${src.name}/airflow-core";
-
    postPatch = ''
-      # remove cyclic dependency
-      sed -i -E 's/"apache-airflow-task-sdk[^"]+",//' pyproject.toml
-
      # relax dependencies
      sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
      sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-      sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
      sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-      sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
      sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-
-      # Copy built UI assets
-      cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
-      cp -r ${airflowSimpleAuthUi}/share/airflow/simple-ui/dist src/airflow/api_fastapi/auth/managers/simple/ui/
    '';

+    nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+
    build-system = [
      gitdb
      gitpython
      hatchling
      packaging
+      pathspec
+      pluggy
      smmap
      tomli
      trove-classifiers
    ];

    dependencies = [
-      a2wsgi
-      aiosqlite
-      alembic
-      argcomplete
-      asgiref
-      attrs
-      cachetools
-      cadwyn
-      colorlog
-      cron-descriptor
-      croniter
-      cryptography
-      deprecated
-      dill
-      fastapi
-      httpx
-      importlib-metadata
-      itsdangerous
-      jinja2
-      jsonschema
-      lazy-object-proxy
-      libcst
-      linkify-it-py
-      lockfile
-      methodtools
-      msgspec
-      natsort
-      opentelemetry-api
-      opentelemetry-exporter-otlp
-      packaging
-      pathspec
-      pendulum
-      pluggy
-      psutil
-      pydantic
-      pygments
-      pygtrie
-      pyjwt
-      python-daemon
-      python-dateutil
-      python-slugify
-      pyyaml
-      requests
-      rich
-      rich-argparse
-      rich-click
-      setproctitle
-      sqlalchemy
-      sqlalchemy-jsonfield
-      sqlalchemy-utils
-      starlette
-      structlog
-      svcs
-      tabulate
-      taskSdk
-      tenacity
-      termcolor
-      typing-extensions
-      universal-pathlib
-      uuid6
-      uvicorn
+      airflowCore # subpackage from airflow src
+      taskSdk # subpackage from airflow src
    ]
-    ++ (map buildProvider requiredProviders);
+    ++ (map buildProvider enabledProviders);

-    pythonRelaxDeps = [ "starlette" ];
-  };
-
-  taskSdk = buildPythonPackage {
-    pname = "task-sdk";
-    inherit src version;
-    pyproject = true;
-
-    sourceRoot = "${src.name}/task-sdk";
-
-    postPatch = ''
-      # resolve cyclic dependency
-      sed -i -E 's/"apache-airflow-core[^"]+",//' pyproject.toml
-
-      # relax dependencies
-      sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
-      sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-      sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-      sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-
-      # task-sdk needs config.yml from core subpackage
-      mkdir -p src/airflow/config_templates
-      cp ../airflow-core/src/airflow/config_templates/* src/airflow/config_templates/
+    postInstall = ''
+      # Create a symlink to the airflow-core package
+      mkdir -p $out/bin
+      ln -s ${airflowCore}/bin/airflow $out/bin/airflow
    '';

-    build-system = [
-      hatchling
-    ];
+    installCheckPhase = ''
+      runHook preInstallCheck

-    dependencies = [
-      asgiref
-      attrs
-      babel
-      colorlog
-      fsspec
-      greenback
-      httpx
-      jinja2
-      jsonschema
-      methodtools
-      msgspec
-      pendulum
-      psutil
-      pydantic
-      pygtrie
-      python-dateutil
-      requests
-      retryhttp
-      structlog
-      tenacity
-      types-requests
-    ];
-  };
+      $out/bin/airflow version
+      $out/bin/airflow db reset -y

-in
-buildPythonPackage rec {
-  pname = "apache-airflow";
-  inherit src version;
-  pyproject = true;
+      runHook postInstallCheck
+    '';

-  postPatch = ''
-    # relax dependencies
-    sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
-    sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
-    sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
-    sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
-  '';
+    pythonImportsCheck = [
+      "airflow"
+    ]
+    ++ lib.concatMap (provider: providers.${provider}.imports) (requiredProviders ++ enabledProviders);

-  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+    passthru.updateScript = ./update.sh;
+    passthru.airflowUi = airflowUi;
+    passthru.airflowSimpleAuthUi = airflowSimpleAuthUi;

-  build-system = [
-    gitdb
-    gitpython
-    hatchling
-    packaging
-    pathspec
-    pluggy
-    smmap
-    tomli
-    trove-classifiers
-  ];
+    # Note on testing the web UI:
+    # You can (manually) test the web UI as follows:
+    #
+    #   nix shell .#apache-airflow
+    #   airflow version
+    #   airflow db reset  # WARNING: this will wipe any existing db state you might have!
+    #   airflow standalone
+    #
+    # Then navigate to the localhost URL using the credentials printed, try
+    # triggering the 'example_bash_operator' DAG and see if it reports success.

-  dependencies = [
-    airflowCore # subpackage from airflow src
-    taskSdk # subpackage from airflow src
-  ]
-  ++ (map buildProvider enabledProviders);
-
-  postInstall = ''
-    # Create a symlink to the airflow-core package
-    mkdir -p $out/bin
-    ln -s ${airflowCore}/bin/airflow $out/bin/airflow
-  '';
-
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    $out/bin/airflow version
-    $out/bin/airflow db reset -y
-
-    runHook postInstallCheck
-  '';
-
-  pythonImportsCheck = [
-    "airflow"
-  ]
-  ++ lib.concatMap (provider: providers.${provider}.imports) (requiredProviders ++ enabledProviders);
-
-  passthru.updateScript = ./update.sh;
-  passthru.airflowUi = airflowUi;
-  passthru.airflowSimpleAuthUi = airflowSimpleAuthUi;
-
-  # Note on testing the web UI:
-  # You can (manually) test the web UI as follows:
-  #
-  #   nix shell .#apache-airflow
-  #   airflow version
-  #   airflow db reset  # WARNING: this will wipe any existing db state you might have!
-  #   airflow standalone
-  #
-  # Then navigate to the localhost URL using the credentials printed, try
-  # triggering the 'example_bash_operator' DAG and see if it reports success.
-
-  meta = {
-    description = "Platform to programmatically author, schedule and monitor workflows";
-    homepage = "https://airflow.apache.org/";
-    changelog = "https://airflow.apache.org/docs/apache-airflow/${version}/release_notes.html";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      taranarmo
-    ];
-    mainProgram = "airflow";
-  };
-}
+    meta = {
+      description = "Platform to programmatically author, schedule and monitor workflows";
+      homepage = "https://airflow.apache.org/";
+      changelog = "https://airflow.apache.org/docs/apache-airflow/${finalAttrs.version}/release_notes.html";
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [
+        taranarmo
+      ];
+      mainProgram = "airflow";
+    };
+  }
+)
--- a/pkgs/by-name/ap/apache-airflow/update-providers.py
+++ b/pkgs/by-name/ap/apache-airflow/update-providers.py
@@ -27,6 +27,7 @@ PKG_PREFERENCES = {
    "protobuf": "protobuf",
    "pydantic": "pydantic",
    "requests_toolbelt": "requests-toolbelt",
+    "setuptools": "setuptools",
    "sqlalchemy": "sqlalchemy",
 }

--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@

 let
  pname = "brave";
-  version = "1.92.134";
+  version = "1.92.139";

  allArchives = {
    aarch64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-qo40t+PGl1RO2ajJ2Hev4G1FWvzTx7Ak5CVxjdxabLI=";
+      hash = "sha256-CkCpXgP4InjfjuhKqG66OjuZcqq7VLLK3/n+7fXpMj0=";
    };
    x86_64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-T3A/ejmLkIRYGWc8GXQmvIAZvQFwYEyhQJxssNDalhQ=";
+      hash = "sha256-UFQV8iBsa6HdUhGGngpi341o41yRoenkxbG2M90O62A=";
    };
    aarch64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-K1p5mAYfEDJNZFSmoOQV7kHNsA5RQuyUl3T2KVsNcbw=";
+      hash = "sha256-65qGzjXZfY5eTWbxTA9R3jN2F0CdkXnHXGVfw3spujo=";
    };
    x86_64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-IrhvRVFZGLoGSVNy10ppFL9rEy7MRTb/HIhzspDsrs8=";
+      hash = "sha256-XPKKB/X8w5Neuxeluc5OFZVN1thqZ0Cf/pFTP4GY2/o=";
    };
  };

--- a/pkgs/by-name/cl/cliamp/package.nix
+++ b/pkgs/by-name/cl/cliamp/package.nix
@@ -41,6 +41,11 @@ buildGoModule (finalAttrs: {
    alsa-lib
  ];

+  # macOS limits Unix socket paths to 104 bytes; use a shorter TMPDIR.
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export TMPDIR="$(mktemp -d /tmp/cliamp-XXXXXX)"
+  '';
+
  postInstall = ''
    wrapProgram $out/bin/cliamp \
      --prefix PATH : ${
@@ -60,6 +65,7 @@ buildGoModule (finalAttrs: {
    description = "Terminal Winamp - a retro terminal music player inspired by Winamp 2.x";
    homepage = "https://github.com/bjarneo/cliamp";
    license = lib.licenses.mit;
+    platforms = with lib.platforms; darwin ++ linux;
    maintainers = with lib.maintainers; [ supermarin ];
    mainProgram = "cliamp";
  };
--- a/pkgs/by-name/de/deadlock-mod-manager/package.nix
+++ b/pkgs/by-name/de/deadlock-mod-manager/package.nix
@@ -4,7 +4,7 @@
  rustPlatform,
  cargo-tauri,
  nodejs,
-  pnpm_9,
+  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
  pkg-config,
@@ -27,26 +27,26 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "deadlock-mod-manager";
-  version = "0.18.0";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "deadlock-mod-manager";
    repo = "deadlock-mod-manager";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+64Y6BFwgQIQhmFzZXOeJ/IGFn+OXV58I/ZdARVFt4w=";
+    hash = "sha256-tSOSjapAlAd63Xkc+MNFVKn1k4+AtW3w3GhicRTV9Pg=";
  };

  cargoRoot = "apps/desktop";
  buildAndTestSubdir = finalAttrs.cargoRoot;

-  cargoHash = "sha256-6ljyPdobcoBaYyarc7Iin5N24y1YXPafrYAk2xvBtvY=";
+  cargoHash = "sha256-x0lhn8nAV9xTgWbRAabJscATSCNpkKpzWvdnuZ4BEvw=";

  nativeBuildInputs = [
    rustPlatform.cargoSetupHook
    cargo-tauri.hook
    nodejs
    pnpmConfigHook
-    pnpm_9
+    pnpm_11
    pkg-config
    wrapGAppsHook3
  ];
@@ -76,10 +76,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
      version
      src
      ;
-    pnpm = pnpm_9;
+    pnpm = pnpm_11;
    fetcherVersion = 3;
    sourceRoot = "source";
-    hash = "sha256-6lMTvlkIeM9kkbFhHzS9jJsHk2bVZWZs6GPgn+X3Rss=";
+    hash = "sha256-zl+ZrI21EnMBeMInKvEkUObiZ0OA5SJLJjnHwu/Dagc=";
  };

  patches = [
@@ -88,9 +88,13 @@ rustPlatform.buildRustPackage (finalAttrs: {

  env.VITE_API_URL = "https://api.deadlockmods.app";

-  # Skip tests that require network access
  checkFlags = [
+    # Requires network access
    "--skip=download_manager::downloader::tests::test_download_file"
+    # Asserts that set_steam_dir rejects a non-Steam directory, but steamlocate
+    # 2.1.0's SteamDir::from_dir only checks that the path is a directory
+    # (further validation is an upstream TODO), so this fails in any environment.
+    "--skip=mod_manager::steam_manager::tests::set_steam_dir_rejects_invalid_directory"
  ];

  preFixup = ''
--- a/pkgs/by-name/fa/fastmail-desktop/linux.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/linux.nix
@@ -66,9 +66,18 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  '';

  # remove musl-libc dependencies before the autoPatchelfHook
-  preFixup = ''
-    rm -r "$out/opt/fastmail/app.asar.unpacked/node_modules/@img/"{sharp-linuxmusl-x64,sharp-libvips-linuxmusl-x64}
-  '';
+  preFixup =
+    let
+      suffix =
+        {
+          aarch64-linux = "arm64";
+          x86_64-linux = "x64";
+        }
+        .${stdenvNoCC.targetPlatform.system};
+    in
+    ''
+      rm -r "$out/opt/fastmail/app.asar.unpacked/node_modules/@img/"{sharp-linuxmusl-${suffix},sharp-libvips-linuxmusl-${suffix}}
+    '';

  meta = meta // {
    mainProgram = "fastmail";
--- a/pkgs/by-name/fa/fastmail-desktop/package.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/package.nix
@@ -26,6 +26,7 @@ callPackage (if isDarwin then ./darwin.nix else ./linux.nix) {
    ];
    platforms = [
      "aarch64-darwin"
+      "aarch64-linux"
      "x86_64-linux"
    ];
  };
--- a/pkgs/by-name/fa/fastmail-desktop/sources.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/sources.nix
@@ -1,19 +1,26 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2026-03-23
+# Last updated: 2026-07-11
 { fetchurl, fetchzip }:
 {
  aarch64-darwin = {
-    version = "1.2.1";
+    version = "1.4.0";
    src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.2.1-arm64-mac.zip";
-      hash = "sha512-bu6IeL8X8ogD1qSlAuApWTBTCYIk5QrjWrzjOv8fel+kqYfCIcDXP1DP1FdJwULe91zoZn4M/uDX8CoOPWa0cA==";
+      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.4.0-arm64-mac.zip";
+      hash = "sha512-QyZZu6pwFJ0SkVye0/OtvNTligl6qKsYbpJfdPeHojPj+OqVyV8bavz15Lest+v7ALJhACZ3x+2kBiWa0ZCSow==";
+    };
+  };
+  aarch64-linux = {
+    version = "1.4.0";
+    src = fetchurl {
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/arm64/com.fastmail.Fastmail-1.4.0-arm64.AppImage";
+      hash = "sha512-sw55AwedyijKTXWAAAaSi6sgGMGK0uF4nPtQRacp9VG5EwlC+0wedyO4ax2cWxhsVUSXnk9ngN4mkraSd07vag==";
    };
  };
  x86_64-linux = {
-    version = "1.2.1";
+    version = "1.4.0";
    src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/com.fastmail.Fastmail-1.2.1.AppImage";
-      hash = "sha512-xudOPNjOaumYxD7yZyjQnYhuiKqDO10cBwMdFJtVEOfHVia0jJMgdUTJx03otIBn9ijM3/1Qo6wsq1HF0A/zlQ==";
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/com.fastmail.Fastmail-1.4.0.AppImage";
+      hash = "sha512-0hNTRFNAnnLPq19isnaoVlXNl6za4Z5o6yh9ovU564JBMyAjsDNHk8h+2zArSSpydaUky6tIgAUsOhhWrIRtcg==";
    };
  };
 }
--- a/pkgs/by-name/fa/fastmail-desktop/update.sh
+++ b/pkgs/by-name/fa/fastmail-desktop/update.sh
@@ -6,15 +6,19 @@ set -euo pipefail
 cd "$(readlink -e "$(dirname "${BASH_SOURCE[0]}")")"

 x86_64_linux_info=$(curl -fsS "https://dl.fastmailcdn.com/desktop/production/linux/x64/latest-linux.yml")
+aarch64_linux_info=$(curl -fsS "https://dl.fastmailcdn.com/desktop/production/linux/arm64/latest-linux-arm64.yml")
 aarch64_darwin_info=$(curl -fsS "https://dl.fastmailcdn.com/desktop/production/mac/arm64/latest-mac.yml")

 x86_64_linux_version=$(yq -r '.version' <<<"$x86_64_linux_info")
+aarch64_linux_version=$(yq -r '.version' <<<"$aarch64_linux_info")
 aarch64_darwin_version=$(yq -r '.version' <<<"$aarch64_darwin_info")

 x86_64_linux_url="https://dl.fastmailcdn.com/desktop/production/linux/x64/$(yq -r '.path' <<<"$x86_64_linux_info")"
+aarch64_linux_url="https://dl.fastmailcdn.com/desktop/production/linux/arm64/$(yq -r '.path' <<<"$aarch64_linux_info")"
 aarch64_darwin_url="https://dl.fastmailcdn.com/desktop/production/mac/arm64/$(yq -r '.path' <<<"$aarch64_darwin_info")"

 x86_64_linux_hash=$(nix-hash --type sha512 --to-sri "$(yq -r '.sha512' <<<"$x86_64_linux_info")")
+aarch64_linux_hash=$(nix-hash --type sha512 --to-sri "$(yq -r '.sha512' <<<"$aarch64_linux_info")")
 aarch64_darwin_hash=$(nix-hash --type sha512 --to-sri "$(yq -r '.sha512' <<<"$aarch64_darwin_info")")

 cat >sources.nix <<EOF
@@ -29,6 +33,13 @@ cat >sources.nix <<EOF
      hash = "$aarch64_darwin_hash";
    };
  };
+  aarch64-linux = {
+    version = "$aarch64_linux_version";
+    src = fetchurl {
+      url = "$aarch64_linux_url";
+      hash = "$aarch64_linux_hash";
+    };
+  };
  x86_64-linux = {
    version = "$x86_64_linux_version";
    src = fetchurl {
--- a/pkgs/by-name/gi/gittuf/package.nix
+++ b/pkgs/by-name/gi/gittuf/package.nix
@@ -3,41 +3,56 @@
  fetchFromGitHub,
  buildGoModule,
  git,
+  gnupg,
+  less,
  openssh,
+  versionCheckHook,
+  nix-update-script,
 }:

 buildGoModule (finalAttrs: {
  pname = "gittuf";
-  version = "0.12.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "gittuf";
    repo = "gittuf";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-/PKbo8LPvU6ZTav9n82mrj2h6z6AyJ225mCH7EfazVU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VWbM7y9XCs/pANJtPa3MDbDhuEtVQ97X5Cyo6yY0Rd8=";
  };

-  vendorHash = "sha256-unj9PpRkfNHWQzeCmcjppMFGAlHNcP0/j9EiGvpRzRc=";
+  vendorHash = "sha256-VTfS0bLq7B037qmFABO5JDrV98zik5ycR4s6NZr3H4s=";

  ldflags = [ "-X github.com/gittuf/gittuf/internal/version.gitVersion=${finalAttrs.version}" ];

+  __structuredAttrs = true;
+  strictDeps = true;
+
  nativeCheckInputs = [
    git
+    gnupg
+    less
    openssh
  ];
-  checkFlags = [
-    "-skip=TestLoadRepository"
-    "-skip=TestSSH"
-  ];
+  checkFlags = [ "-skip=TestLoadRepository|TestSSH" ];

-  postInstall = "rm $out/bin/cli"; # remove gendoc cli binary
+  postInstall = "rm $out/bin/cli $out/bin/sandbox"; # remove gendoc helper binaries
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };

  meta = {
-    changelog = "https://github.com/gittuf/gittuf/blob/v${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/gittuf/gittuf/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    description = "Security layer for Git repositories";
    homepage = "https://gittuf.dev";
    license = lib.licenses.asl20;
    mainProgram = "gittuf";
-    maintainers = with lib.maintainers; [ flandweber ];
+    maintainers = with lib.maintainers; [
+      flandweber
+      anish
+    ];
  };
 })
--- a/pkgs/by-name/la/lakefs/package.nix
+++ b/pkgs/by-name/la/lakefs/package.nix
@@ -12,13 +12,13 @@

 buildGoModule (finalAttrs: {
  pname = "lakefs";
-  version = "1.79.0";
+  version = "1.83.0";

  src = fetchFromGitHub {
    owner = "treeverse";
    repo = "lakeFS";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UL9JvrNvtHADI0POguLXMDNNvO1oKHXXwfr8tOyvFYc=";
+    hash = "sha256-5/2iI5/87x+VJ1MbYw7zPEDeTm1XVuLmSsI6KssRGRE=";
  };

  webui = buildNpmPackage {
@@ -30,7 +30,7 @@ buildGoModule (finalAttrs: {

    nodejs = nodejs_22;

-    npmDepsHash = "sha256-Z9oOIKK6Hm/Bg3E37f4FqFFL1exMIf0KNEHQXIyox+Q=";
+    npmDepsHash = "sha256-AKCsxBW2ZBQB5fPkS1adAt8z6mHuC/zGMHhRW8pVyYs=";

    installPhase = ''
      runHook preInstall
@@ -41,7 +41,7 @@ buildGoModule (finalAttrs: {

  subPackages = [ "cmd/lakefs" ];
  proxyVendor = true;
-  vendorHash = "sha256-6XOJBDdAERD6mcneQ7UFqAPGq+pXroNlzQGNvycpVBc=";
+  vendorHash = "sha256-UNDIqP79CG2+M8HKkHT1l7X2/Dt6YDTQzADR5T7klUg=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ol/olivetin/3k.nix
+++ b/pkgs/by-name/ol/olivetin/3k.nix
@@ -16,13 +16,13 @@

 buildGoModule (finalAttrs: {
  pname = "olivetin";
-  version = "3000.15.0";
+  version = "3000.17.0";

  src = fetchFromGitHub {
    owner = "OliveTin";
    repo = "OliveTin";
    tag = finalAttrs.version;
-    hash = "sha256-AztJqhSJV9hIsnhaYZoIMC8ZE17pUT37nRUdCZ6ZiCA=";
+    hash = "sha256-oLBXDd1grSFEbCvB4bK2XeVOZONSYro/6rvMJkG8eU0=";
  };

  modRoot = "service";
@@ -75,7 +75,7 @@ buildGoModule (finalAttrs: {
    '';

    outputHashMode = "recursive";
-    outputHash = "sha256-v7aSikl1VSFZdNKnIucs7RdqFWoaVNIH9u27YG9Ei90=";
+    outputHash = "sha256-X602MebKdmdxZ9OEtQ150u+/Z1O9FEvcxRtOhMorqyw=";
  };

  webui = buildNpmPackage {
--- a/pkgs/by-name/op/opencolorio/package.nix
+++ b/pkgs/by-name/op/opencolorio/package.nix
@@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "opencolorio";
-  version = "2.5.1";
+  version = "2.5.2";

  src = fetchFromGitHub {
    owner = "AcademySoftwareFoundation";
    repo = "OpenColorIO";
    rev = "v${version}";
-    hash = "sha256-iI32dnGZdizLBOs7IQtmLUYMPWxadvWNeqZjy49AWb0=";
+    hash = "sha256-b4tdQ9VH9M7hAD5Uuxu4QKwwpaVwroj/Bvg+Zsy0M1M=";
  };

  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
--- a/pkgs/by-name/op/openlist/frontend.nix
+++ b/pkgs/by-name/op/openlist/frontend.nix
@@ -12,18 +12,18 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "openlist-frontend";
-  version = "4.2.2";
+  version = "4.2.3";

  src = fetchFromGitHub {
    owner = "OpenListTeam";
    repo = "OpenList-Frontend";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RLuAGjiYELy+roip2TtvUXGOw6Vk+GkczT1LSI0Vx+8=";
+    hash = "sha256-33W0JCAmt3pjhAAOxoaZS7zBbJJbl4i85fqyKzoibz8=";
  };

  i18n = fetchzip {
    url = "https://github.com/OpenListTeam/OpenList-Frontend/releases/download/v${finalAttrs.version}/i18n.tar.gz";
-    hash = "sha256-ZO/ozyRNqh2W4/acQmGHoEMpjpf2jph7Gn/kOlwVSFs=";
+    hash = "sha256-nnsnYXbH4Uq+sux11txanUs11MB2dHIT0vCLMIzYQdg=";
    stripRoot = false;
  };

@@ -41,7 +41,7 @@ buildNpmPackage (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = openlistPnpm;
    fetcherVersion = 4;
-    hash = "sha256-ujsCuQexnKPNwoJzaWmhu3+4xMkZ0jR04m2exG674dI=";
+    hash = "sha256-V+YhQsfUvd8WHxIYEjuihEjTZE75eFfziq2GwW1rPbg=";
  };

  npmConfigHook = pnpmConfigHook;
--- a/pkgs/by-name/op/openlist/package.nix
+++ b/pkgs/by-name/op/openlist/package.nix
@@ -12,13 +12,13 @@

 buildGoModule (finalAttrs: {
  pname = "openlist";
-  version = "4.2.2";
+  version = "4.2.3";

  src = fetchFromGitHub {
    owner = "OpenListTeam";
    repo = "OpenList";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MxoF+hpzn/44knjVeaINo4/1T4ia7HG8mm+tbvJEsfQ=";
+    hash = "sha256-q7s6u/pQ+bvSbz19029uO9CzVc1KVoISpcStngVUffs=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -34,7 +34,7 @@ buildGoModule (finalAttrs: {
  frontend = callPackage ./frontend.nix { };

  proxyVendor = true;
-  vendorHash = "sha256-ScPfry0PtSlABdyG+7egMAndG7D3iz1+ceAAhLQPtkM=";
+  vendorHash = "sha256-a4v2JP/+feit3uTqnACWgl77fWZU8yVE/0Hm7qxoI8E=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/op/openllm/package.nix
+++ b/pkgs/by-name/op/openllm/package.nix
@@ -64,6 +64,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
    description = "Run any open-source LLMs, such as Llama 3.1, Gemma, as OpenAI compatible API endpoint in the cloud";
    homepage = "https://github.com/bentoml/OpenLLM";
    changelog = "https://github.com/bentoml/OpenLLM/releases/tag/${finalAttrs.src.tag}";
+    knownVulnerabilities = [
+      "CVE-2026-15035"
+    ];
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [
      happysalada
--- a/pkgs/by-name/pr/privatebin/package.nix
+++ b/pkgs/by-name/pr/privatebin/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "privatebin";
-  version = "2.0.4";
+  version = "2.0.5";

  src = fetchFromGitHub {
    owner = "PrivateBin";
    repo = "PrivateBin";
    tag = finalAttrs.version;
-    hash = "sha256-OyTEi1D+B33e0Dqr/l/uTBcPTlC7AAqc2atnClYhyGo=";
+    hash = "sha256-om0l9psEus4+XZ+aXQ3DK5iWtQeCfCi2D6lNP+9FM6U=";
  };

  installPhase = ''
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -6,7 +6,7 @@
  replaceVars,
  pandoc,
  nodejs,
-  pnpm_9,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  electron,
@@ -15,24 +15,22 @@
  copyDesktopItems,
  nix-update-script,
  xdg-utils,
+  darwin,
 }:

 let
+  inherit (stdenv.hostPlatform) isLinux isDarwin system;
+
+  pnpm = pnpm_10;
+
  platformIds = {
    "x86_64-linux" = "linux";
    "aarch64-linux" = "linux-arm64";
+    "x86_64-darwin" = "darwin";
+    "aarch64-darwin" = "darwin-arm64";
  };

-  platformId = platformIds.${stdenv.system} or (throw "Unsupported platform: ${stdenv.system}");
-
-  desktopEntry = makeDesktopItem {
-    name = "siyuan";
-    desktopName = "SiYuan";
-    comment = "Refactor your thinking";
-    icon = "siyuan";
-    exec = "siyuan %U";
-    categories = [ "Utility" ];
-  };
+  platformId = platformIds.${system} or (throw "Unsupported platform: ${system}");
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "siyuan";
@@ -69,9 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
    # Set flags and tags as per upstream's Dockerfile
    ldflags = [
      "-s"
-      "-w"
-      "-X"
-      "github.com/siyuan-note/siyuan/kernel/util.Mode=prod"
+      "-X 'github.com/siyuan-note/siyuan/kernel/util.Mode=prod'"
    ];
    tags = [ "fts5" ];
  };
@@ -85,9 +81,14 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    nodejs
    pnpmConfigHook
-    pnpm_9
+    pnpm
+  ]
+  ++ lib.optionals isLinux [
    makeWrapper
    copyDesktopItems
+  ]
+  ++ lib.optionals isDarwin [
+    darwin.autoSignDarwinBinariesHook
  ];

  pnpmDeps = fetchPnpmDeps {
@@ -98,9 +99,9 @@ stdenv.mkDerivation (finalAttrs: {
      sourceRoot
      postPatch
      ;
-    pnpm = pnpm_9;
+    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-GAbP9H+c+JXymH0/vpeYOJrkkFJGVyKcpJYFeyRLSKc=";
+    hash = "sha256-M2Fdie0XK2Pck/fP7Djxb7XNAQXpJO2i2kSJrDj1G0E=";
  };

  sourceRoot = "${finalAttrs.src.name}/app";
@@ -114,6 +115,9 @@ stdenv.mkDerivation (finalAttrs: {
    # link kernel into the correct starting place so that electron-builder can copy it to it's final location
    mkdir kernel-${platformId}
    ln -s ${finalAttrs.kernel}/bin/kernel kernel-${platformId}/SiYuan-Kernel
+
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
  '';

  buildPhase = ''
@@ -121,19 +125,36 @@ stdenv.mkDerivation (finalAttrs: {

    pnpm build

-    npm exec electron-builder -- \
-        --dir \
-        --config electron-builder-${platformId}.yml \
-        -c.electronDist=${electron.dist} \
-        -c.electronVersion=${electron.version}
+    electronBuilderArgs=(
+      --dir
+      --config electron-builder-${platformId}.yml
+      -c.electronDist=electron-dist
+      -c.electronVersion=${electron.version}
+      -c.mac.identity=null
+    )
+
+    npm exec electron-builder -- "''${electronBuilderArgs[@]}"

    runHook postBuild
  '';

  installPhase = ''
    runHook preInstall
+  ''
+  + lib.optionalString isDarwin ''
+    mkdir -p $out/Applications $out/bin

+    cp -R build/mac*/*.app $out/Applications/SiYuan.app
+
+    cat > $out/bin/siyuan << EOF
+    #!${stdenv.shell}
+    exec open -na "$out/Applications/SiYuan.app" --args "\$@"
+    EOF
+    chmod +x $out/bin/siyuan
+  ''
+  + lib.optionalString isLinux ''
    mkdir -p $out/share/siyuan
+
    cp -r build/*-unpacked/{locales,resources{,.pak}} $out/share/siyuan

    makeWrapper ${lib.getExe electron} $out/bin/siyuan \
@@ -145,20 +166,26 @@ stdenv.mkDerivation (finalAttrs: {
        --inherit-argv0

    install -Dm644 src/assets/icon.svg $out/share/icons/hicolor/scalable/apps/siyuan.svg
-
+  ''
+  + ''
    runHook postInstall
  '';

-  desktopItems = [ desktopEntry ];
+  desktopItems = lib.optional isLinux (makeDesktopItem {
+    name = "siyuan";
+    desktopName = "SiYuan";
+    comment = "Refactor your thinking";
+    icon = "siyuan";
+    exec = "siyuan %U";
+    categories = [ "Utility" ];
+  });

-  passthru = {
-    inherit (finalAttrs.kernel) goModules; # this tricks nix-update into also updating the kernel goModules FOD
-    updateScript = nix-update-script {
-      extraArgs = [
-        "--version-regex"
-        "^v(\\d+\\.\\d+\\.\\d+)$"
-      ];
-    };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^v(\\d+\\.\\d+\\.\\d+)$"
+      "--subpackage=kernel"
+    ];
  };

  meta = {
--- a/pkgs/by-name/sp/space-station-14-launcher/package.nix
+++ b/pkgs/by-name/sp/space-station-14-launcher/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  config,
+  nix-update-script,
  buildDotnetModule,
  dotnetCorePackages,
  fetchFromGitHub,
@@ -39,7 +40,7 @@
 }:
 let
  pname = "space-station-14-launcher";
-  version = "0.39.0";
+  version = "0.39.1";
 in
 buildDotnetModule rec {
  inherit pname;
@@ -52,7 +53,7 @@ buildDotnetModule rec {
    owner = "space-wizards";
    repo = "SS14.Launcher";
    tag = "v${version}";
-    hash = "sha256-i5jcaB1wa+Toj6orpEQ9sK3EX1CLWadnhTEQDOU7QU4=";
+    hash = "sha256-u3tsPWAFMckWSHhiPqL50i9BMxR+VrLnpUSWGRRu9AA=";
    fetchSubmodules = true;
  };

@@ -133,6 +134,8 @@ buildDotnetModule rec {
    icoFileToHiColorTheme SS14.Launcher/Assets/icon.ico ${pname} $out
  '';

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Launcher for Space Station 14, a multiplayer game about paranoia and disaster";
    homepage = "https://spacestation14.io";
--- a/pkgs/by-name/sy/syncyomi/package.nix
+++ b/pkgs/by-name/sy/syncyomi/package.nix
@@ -6,7 +6,7 @@
  libredirect,
  buildGoModule,
  nodejs,
-  pnpm_9,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  esbuild,
@@ -51,15 +51,15 @@ buildGoModule (finalAttrs: {
        src
        sourceRoot
        ;
-      pnpm = pnpm_9;
-      fetcherVersion = 3;
-      hash = "sha256-paCYfh7tjDuPm8JCpzhCNjL1ZsyQTNxofW8UNIKjqmE=";
+      pnpm = pnpm_10;
+      fetcherVersion = 4;
+      hash = "sha256-i4ji/NjK6/hpqrma+DJ2x5kKq/YEN3Cy8mKQLy1M+dU=";
    };

    nativeBuildInputs = [
      nodejs
      pnpmConfigHook
-      pnpm_9
+      pnpm_10
    ];

    env.ESBUILD_BINARY_PATH = lib.getExe lockedEsbuild;
--- a/pkgs/by-name/ta/tandoor-recipes/common.nix
+++ b/pkgs/by-name/ta/tandoor-recipes/common.nix
@@ -1,15 +1,15 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "2.6.9";
+  version = "2.6.13";

  src = fetchFromGitHub {
    owner = "TandoorRecipes";
    repo = "recipes";
    tag = version;
-    hash = "sha256-g151bUOpAp+7+K92kF+eK5SR2aCHPHdFc3UXqOO4aSw=";
+    hash = "sha256-7620qMp3Trg2be51CP0LKas/1egk3Rmo+aaMp0pe83k=";
  };

-  yarnHash = "sha256-Un5pHocZZrXajY3AGfqV1kjT9twE8B93rwoJMi4CILg=";
+  yarnHash = "sha256-EpmFGyuWZeqzdi8wPX7ABjfJKWP8r5qqpdfNKdOFiso=";

  meta = {
    homepage = "https://tandoor.dev/";
--- a/pkgs/by-name/ta/tandoor-recipes/pytest-xdist.patch
+++ b/pkgs/by-name/ta/tandoor-recipes/pytest-xdist.patch
@@ -9,6 +9,3 @@ index 2755dc99..4026b96e 100644
 -addopts = -n auto --cov=. --cov-report=html:docs/reports/coverage --cov-report=xml:docs/reports/coverage/coverage.xml --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
 +addopts = -n @NIX_BUILD_CORES@ --cov=. --cov-report=html:docs/reports/coverage --cov-report=xml:docs/reports/coverage/coverage.xml --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
 # addopts = -n auto --junitxml=docs/reports/tests/pytest.xml --html=docs/reports/tests/tests.html
-asyncio_default_fixture_loop_scope = fixture
-\ No newline at end of file
-+asyncio_default_fixture_loop_scope = function
--- a/pkgs/by-name/ty/typst/build-universe-package.nix
+++ b/pkgs/by-name/ty/typst/build-universe-package.nix
@@ -45,6 +45,8 @@ lib.extendMkDerivation {
          RossSmyth
        ];
        license = lib.map (lib.flip lib.getAttr lib.licensesSpdx) license;
+        # Sending a bunch of trivial jobs to Hydra is not that great.
+        hydraPlatforms = [ ];
      }
      // lib.optionalAttrs (homepage != null) { inherit homepage; };
    };
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -14,13 +14,13 @@

 buildGoModule (finalAttrs: {
  pname = "VictoriaMetrics";
-  version = "1.145.0";
+  version = "1.146.0";

  src = fetchFromGitHub {
    owner = "VictoriaMetrics";
    repo = "VictoriaMetrics";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nKG2ei1Gn1mU5TtD5YLYUHaJrM4fSxm/uUdY4tIGeVE=";
+    hash = "sha256-EWRVbUeugyLsExP3NyPVLd7v2kwbRg5OjFg2WAY1FuM=";
  };

  vendorHash = null;
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -67,7 +67,7 @@

 stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "8.0.4033.54";
+  version = "8.1.4087.48";

  suffix =
    {
@@ -80,8 +80,8 @@ stdenv.mkDerivation rec {
    url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
    hash =
      {
-        aarch64-linux = "sha256-i2FAMp3MFsnXTjQoF4Y/BuB6j+x3ugfsu0ePGI/h5Po=";
-        x86_64-linux = "sha256-a4ZLX/DpygZgPPjt4BQxTuRbFoPmNuRgdZFiI6UclQI=";
+        aarch64-linux = "sha256-T6mBi4FpHz2iGXeF91giTbuVp4KjFG1DUnPNpKEV06c=";
+        x86_64-linux = "sha256-/Bgh+Y6DHWe7al9vLsWWH1HM5JQGwv91KUxQ9TNkqjs=";
      }
      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
--- a/pkgs/by-name/zo/zotero/package.nix
+++ b/pkgs/by-name/zo/zotero/package.nix
@@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitHub,
  buildNpmPackage,
+  darwin,
  nodejs_22,
  perl,
  python3,
@@ -28,14 +29,14 @@ let
  nodejs = nodejs_22;

  pname = "zotero";
-  version = "9.0.4";
+  version = "9.0.6";

  src = fetchFromGitHub {
    owner = "zotero";
    repo = "zotero";
    tag = version;
    fetchSubmodules = true;
-    hash = "sha256-YMaDCYdCNJQ8zXfCkV5tb3RA3foXRlKo2TWv6pgk8VM=";
+    hash = "sha256-9Rku6iF7Sczqekw8ms8hluIc+B/5BE9zHlBqp7vGlY4=";
  };

  pdf-js = buildNpmPackage {
@@ -181,10 +182,11 @@ buildNpmPackage (finalAttrs: {
    rsync
    copyDesktopItems
  ]
-  ++ lib.optionals stdenv.targetPlatform.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    makeBinaryWrapper
+    darwin.autoSignDarwinBinariesHook
  ]
-  ++ lib.optionals (!stdenv.targetPlatform.isDarwin) [
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
    wrapGAppsHook3
  ];

@@ -246,12 +248,12 @@ buildNpmPackage (finalAttrs: {
      # The correct firefox version can be found in zotero/app/config.sh at `GECKO_VERSION_LINUX`.
      mkdir -p app/xulrunner/
    ''
-    + lib.optionalString stdenv.targetPlatform.isDarwin ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
      cp -r "${firefox-esr-140-unwrapped}/Applications/Firefox ESR.app" app/xulrunner/Firefox.app
    ''
-    + lib.optionalString (!stdenv.targetPlatform.isDarwin) ''
-      cp -r "${firefox-esr-140-unwrapped}/lib/firefox" "app/xulrunner/firefox-${stdenv.targetPlatform.parsed.kernel.name}-${
-        lib.replaceString "aarch64" "arm64" stdenv.targetPlatform.parsed.cpu.name
+    + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+      cp -r "${firefox-esr-140-unwrapped}/lib/firefox" "app/xulrunner/firefox-${stdenv.hostPlatform.parsed.kernel.name}-${
+        lib.replaceString "aarch64" "arm64" stdenv.hostPlatform.parsed.cpu.name
      }"
    ''
    + ''
@@ -260,9 +262,7 @@ buildNpmPackage (finalAttrs: {
      build_dir=$(mktemp -d)
      ./app/scripts/prepare_build -s ./build -o "$build_dir" -c release
      ./app/build.sh -d "$build_dir" -c release -s \
-        ${
-          if stdenv.targetPlatform.isDarwin then "-p m" else "-p l -a ${zoteroArch stdenv.targetPlatform}"
-        }
+        ${if stdenv.hostPlatform.isDarwin then "-p m" else "-p l -a ${zoteroArch stdenv.hostPlatform}"}

      runHook postBuild
    '';
@@ -306,12 +306,12 @@ buildNpmPackage (finalAttrs: {
  installPhase = ''
    runHook preInstall
  ''
-  + lib.optionalString stdenv.targetPlatform.isDarwin ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
    # Copy package contents
    mkdir -p $out/Applications
    cp -r app/staging/Zotero.app $out/Applications/
  ''
-  + lib.optionalString (!stdenv.targetPlatform.isDarwin) ''
+  + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
    # Copy package contents
    mkdir -p $out/lib/
    cp -r app/staging/*/. $out/lib/
@@ -330,7 +330,7 @@ buildNpmPackage (finalAttrs: {
    runHook postInstall
  '';

-  preFixup = lib.optionalString (!stdenv.targetPlatform.isDarwin) ''
+  preFixup = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
    gappsWrapperArgs+=(--suffix LD_LIBRARY_PATH : ${
      lib.makeLibraryPath [
        libGL
@@ -340,7 +340,7 @@ buildNpmPackage (finalAttrs: {
    })
  '';

-  postFixup = lib.optionalString stdenv.targetPlatform.isDarwin ''
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
    mkdir -p $out/bin
    makeWrapper $out/Applications/Zotero.app/Contents/MacOS/zotero $out/bin/zotero
  '';
--- a/pkgs/development/python-modules/bentoml/default.nix
+++ b/pkgs/development/python-modules/bentoml/default.nix
@@ -248,6 +248,14 @@ buildPythonPackage {
    description = "Build Production-Grade AI Applications";
    homepage = "https://github.com/bentoml/BentoML";
    changelog = "https://github.com/bentoml/BentoML/releases/tag/${src.tag}";
+    knownVulnerabilities = [
+      "CVE-2026-27905"
+      "CVE-2026-33744"
+      "CVE-2026-35043"
+      "CVE-2026-35044"
+      "CVE-2026-44345"
+      "CVE-2026-44346"
+    ];
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [
      happysalada
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -43,7 +43,6 @@
  python-dotenv,
  python-multipart,
  pyyaml,
-  requests,
  resend,
  restrictedpython,
  rich,
@@ -62,19 +61,19 @@

 buildPythonPackage rec {
  pname = "litellm";
-  version = "1.83.14";
+  version = "1.86.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "BerriAI";
    repo = "litellm";
-    tag = "v${version}-stable";
-    hash = "sha256-SZow0qof9DRlohWjT3J/NHtmhe96OLLcdHt55RQ7Zmw=";
+    tag = "v${version}";
+    hash = "sha256-uInjKBUduDAfXHg5dQj5/qqqMJhlDeTri1kULkz5unM=";
  };

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace-fail "uv_build==0.10.7" "uv_build"
+      --replace-fail "uv_build==0.11.8" "uv_build"
  '';

  build-system = [ uv-build ];
@@ -90,7 +89,6 @@ buildPythonPackage rec {
    openai
    pydantic
    python-dotenv
-    requests
    tiktoken
    tokenizers
  ];
@@ -175,7 +173,7 @@ buildPythonPackage rec {
    updateScript = nix-update-script {
      extraArgs = [
        "--version-regex"
-        "v([0-9]+\\.[0-9]+\\.[0-9]+)-stable"
+        "v([0-9]+\\.[0-9]+\\.[0-9]+)"
      ];
    };
  };
--- a/pkgs/development/python-modules/plover/5.nix
+++ b/pkgs/development/python-modules/plover/5.nix
@@ -40,14 +40,14 @@ buildPythonPackage (finalAttrs: {
  __structuredAttrs = true;

  pname = "plover";
-  version = "5.3.0";
+  version = "5.4.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "openstenoproject";
    repo = "plover";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1NpZmUDq806geKANqswPYglHwInxum/c/Hxq7JhTpbc=";
+    hash = "sha256-qaEuzPVqh+e3qq778VdUaRufGzOx9HyUnygIbA0+6kw=";
  };

  # pythonRelaxDeps seemingly doesn't work here
--- a/pkgs/development/python-modules/protego/default.nix
+++ b/pkgs/development/python-modules/protego/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "protego";
-  version = "0.6.1";
+  version = "0.6.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "scrapy";
    repo = "protego";
    tag = finalAttrs.version;
-    hash = "sha256-Me+bSJnHHJH0ryPoSS7EN2Px5FNElCWQzvKrmWll4mQ=";
+    hash = "sha256-vAX7l0Xq2itQwBkNYobOWae1qHVVcD7M/o43GpIwEVo=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/sqlalchemy/1.3-0001-fix-create-new-event-loop-if-not-exists.patch
+++ b/pkgs/development/python-modules/sqlalchemy/1.3-0001-fix-create-new-event-loop-if-not-exists.patch
@@ -0,0 +1,26 @@
+From 98fd6e87243c6d5992429a9b90426af73dbcc3ff Mon Sep 17 00:00:00 2001
+From: Bart Oostveen <bart@bartoostveen.nl>
+Date: Fri, 10 Jul 2026 13:59:21 +0200
+Subject: [PATCH] fix: create new event loop if not exists
+
+---
+ lib/sqlalchemy/util/_concurrency_py3k.py | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/sqlalchemy/util/_concurrency_py3k.py b/lib/sqlalchemy/util/_concurrency_py3k.py
+index 1e4ffef..5aaf12c 100644
+--- a/lib/sqlalchemy/util/_concurrency_py3k.py
+++ b/lib/sqlalchemy/util/_concurrency_py3k.py
+@@ -190,6 +190,8 @@ def get_event_loop():
+         try:
+             return asyncio.get_running_loop()
+         except RuntimeError:
+-            return asyncio.get_event_loop_policy().get_event_loop()
+            loop = asyncio.new_event_loop()
+            asyncio.set_event_loop(loop)
+            return loop
+     else:
+         return asyncio.get_event_loop()
+-- 
+2.54.0
+
--- a/pkgs/development/python-modules/sqlalchemy/1_3.nix
+++ b/pkgs/development/python-modules/sqlalchemy/1_3.nix
@@ -37,6 +37,8 @@ buildPythonPackage (finalAttrs: {
    hash = "sha256-6qAjyqMVrugABHssAQuql3z1YHTAOSm5hARJuJXJJvo=";
  };

+  patches = [ ./1.3-0001-fix-create-new-event-loop-if-not-exists.patch ];
+
  postPatch = ''
    sed -i '/tag_build = dev/d' setup.cfg
  '';
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -605,9 +605,21 @@ buildPythonPackage.override { stdenv = torch.stdenv; } (finalAttrs: {
      "x86_64-darwin"
    ];
    knownVulnerabilities = [
+      "CVE-2026-25960"
      "CVE-2026-27893"
+      "CVE-2026-41523"
      "CVE-2026-44222"
      "CVE-2026-44223"
+      "CVE-2026-47155"
+      "CVE-2026-48746"
+      "CVE-2026-53923"
+      "CVE-2026-54232"
+      "CVE-2026-54233"
+      "CVE-2026-54234"
+      "CVE-2026-54235"
+      "CVE-2026-54236"
+      "CVE-2026-55514"
+      "CVE-2026-55574"
    ];
  };
 })
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -53,8 +53,8 @@ let
      hash = "sha256-WOFDJYhx31FYm2UcBiBdq+xIdmpdu6PCWZm2m1C+WY4=";
    };
    "11" = {
-      version = "11.10.0";
-      hash = "sha256-YgtmBepPYvxWptCphzP0eQcdAyHgPkhrUix+mnRhdDE=";
+      version = "11.11.0";
+      hash = "sha256-he8u/yFqGukIBMAMjfv6ZoU1NkRlDRCQaok8Ba7c2IQ=";
    };
  };