Merge master into staging-next

2026-05-19 00:43:21 +00:00
parent 4b976b66a1 cd22aef9a1
commit 157cee1df3
103 changed files with 1085 additions and 686 deletions
@@ -483,7 +483,6 @@ module.exports = async ({ github, context, core, dry }) => {
          dry,
          pull_request,
          reviews,
-          events,
          // TODO: Use maintainer map instead of the artifact.
          user_maintainers: Object.keys(
            JSON.parse(
@@ -494,7 +493,6 @@ module.exports = async ({ github, context, core, dry }) => {
          owners,
          getUser,
          getTeam,
-          getTeamMembers,
        })
      }
    }
@@ -6,38 +6,28 @@ async function handleReviewers({
  dry,
  pull_request,
  reviews,
-  events,
  user_maintainers,
  team_maintainers,
  owners,
  getUser,
  getTeam,
-  getTeamMembers,
 }) {
  const pull_number = pull_request.number

-  // Users currently requested for review (pending).
-  const pending_users = new Set(
-    pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
-  )
-  // Users who actually submitted a review in this PR (any state, including DISMISSED).
-  const users_engaged = new Set(
-    reviews.map(({ user }) => user.login.toLowerCase()),
-  )
-  // Users the PR has already reached: pending OR engaged.
-  const users_reached = pending_users.union(users_engaged)
+  // Users that the PR has already reached, e.g. they've left a review or have been requested for one
+  const users_reached = new Set([
+    ...pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
+    ...reviews.map(({ user }) => user.login.toLowerCase()),
+  ])
  log('reviewers - users_reached', Array.from(users_reached).join(', '))

-  // Same for teams. A team is engaged only via `onBehalfOf` reviews.
-  const pending_teams = new Set(
-    pull_request.requested_teams.map(({ slug }) => slug.toLowerCase()),
-  )
-  const teams_engaged = new Set(
-    reviews.flatMap(({ onBehalfOf }) =>
+  // Same for teams
+  const teams_reached = new Set([
+    ...pull_request.requested_teams.map(({ slug }) => slug.toLowerCase()),
+    ...reviews.flatMap(({ onBehalfOf }) =>
      onBehalfOf.nodes.map(({ slug }) => slug.toLowerCase()),
    ),
-  )
-  const teams_reached = pending_teams.union(teams_engaged)
+  ])
  log('reviewers - teams_reached', Array.from(teams_reached).join(', '))

  // Early sanity check, before we start making any API requests. The list of maintainers
@@ -159,120 +149,37 @@ async function handleReviewers({
  )
  log('reviewers - teams_not_yet_reached', teams_not_yet_reached.join(', '))

-  // Also keep members of teams_to_reach: GitHub's per-team code-review-assignment
-  // can turn a team request into individual bot-attributed adds.
-  const team_member_logins = new Set(
-    (
-      await Promise.all(
-        Array.from(teams_to_reach, async (slug) => {
-          const ms = await getTeamMembers(slug)
-          return ms.map(({ login }) => login.toLowerCase())
-        }),
-      )
-    ).flat(),
-  )
-  log(
-    'reviewers - team_member_logins',
-    Array.from(team_member_logins).join(', '),
-  )
-
-  const users_to_keep = users_to_reach.union(team_member_logins)
-
-  // The usernames of bots that make review requests we may auto-revoke.
-  const revokable_requesters = ['github-actions[bot]', 'nixpkgs-ci[bot]']
-
-  // Find latest `review_requested` actor per reviewer / team.
-  const last_request_actor_for_user = new Map()
-  const last_request_actor_for_team = new Map()
-  for (const ev of events) {
-    if (ev.event !== 'review_requested') continue
-    if (ev.requested_reviewer?.login) {
-      last_request_actor_for_user.set(
-        ev.requested_reviewer.login.toLowerCase(),
-        ev.actor?.login ?? '',
-      )
-    }
-    if (ev.requested_team?.slug) {
-      last_request_actor_for_team.set(
-        ev.requested_team.slug.toLowerCase(),
-        ev.actor?.login ?? '',
-      )
-    }
-  }
-
-  // Pending requests no longer in the to_reach set, excluding the engaged
-  // and anything not requested by our own bot.
-  const users_to_remove = Array.from(
-    pending_users.difference(users_to_keep).difference(users_engaged),
-  ).filter((login) =>
-    revokable_requesters.includes(last_request_actor_for_user.get(login)),
-  )
-  log('reviewers - users_to_remove', users_to_remove.join(', '))
-
-  // Same for teams.
-  const teams_to_remove = Array.from(
-    pending_teams.difference(teams_to_reach).difference(teams_engaged),
-  ).filter((slug) =>
-    revokable_requesters.includes(last_request_actor_for_team.get(slug)),
-  )
-  log('reviewers - teams_to_remove', teams_to_remove.join(', '))
-
-  const has_adds =
-    users_not_yet_reached.length > 0 || teams_not_yet_reached.length > 0
-  const has_removals = users_to_remove.length > 0 || teams_to_remove.length > 0
-
-  if (!has_adds && !has_removals) {
+  if (
+    users_not_yet_reached.length === 0 &&
+    teams_not_yet_reached.length === 0
+  ) {
    log('Has reviewer changes', 'false (skipped)')
  } else if (dry) {
-    if (has_adds) {
-      core.info(
-        `Requesting user reviewers for #${pull_number}: ${users_not_yet_reached.join(', ')} (dry)`,
-      )
-      core.info(
-        `Requesting team reviewers for #${pull_number}: ${teams_not_yet_reached.join(', ')} (dry)`,
-      )
-    }
-    if (has_removals) {
-      core.info(
-        `Revoking stale reviewers for #${pull_number}: users=[${users_to_remove.join(', ')}], teams=[${teams_to_remove.join(', ')}] (dry)`,
-      )
-    }
+    core.info(
+      `Requesting user reviewers for #${pull_number}: ${users_not_yet_reached.join(', ')} (dry)`,
+    )
+    core.info(
+      `Requesting team reviewers for #${pull_number}: ${teams_not_yet_reached.join(', ')} (dry)`,
+    )
  } else {
    // We had tried the "request all reviewers at once" thing in the past, but it didn't work out:
    //   https://github.com/NixOS/nixpkgs/commit/034613f860fcd339bd2c20c8f6bc259a2f9dc034
    // If we're hitting API errors here again, we'll need to investigate - and possibly reverse
    // course.
-    // Add and remove sets are disjoint by construction. Parallel is safe.
-    await Promise.all(
-      [
-        has_adds &&
-          github.rest.pulls.requestReviewers({
-            ...context.repo,
-            pull_number,
-            reviewers: users_not_yet_reached,
-            team_reviewers: teams_not_yet_reached,
-          }),
-        has_removals &&
-          github.rest.pulls.removeRequestedReviewers({
-            ...context.repo,
-            pull_number,
-            reviewers: users_to_remove,
-            team_reviewers: teams_to_remove,
-          }),
-      ].filter(Boolean),
-    )
+    await github.rest.pulls.requestReviewers({
+      ...context.repo,
+      pull_number,
+      reviewers: users_not_yet_reached,
+      team_reviewers: teams_not_yet_reached,
+    })
  }

-  // Subtract the just-revoked so revoking the last pending reviewer flips the label.
-  const users_still_reached = users_reached.difference(new Set(users_to_remove))
-  const teams_still_reached = teams_reached.difference(new Set(teams_to_remove))
-
  // Return a boolean on whether the "needs: reviewers" label should be set.
  return (
    users_not_yet_reached.length === 0 &&
    teams_not_yet_reached.length === 0 &&
-    users_still_reached.size === 0 &&
-    teams_still_reached.size === 0
+    users_reached.size === 0 &&
+    teams_reached.size === 0
  )
 }

@@ -37,16 +37,16 @@ runCommand "manual.epub"
      </book>
    '';

-    passAsFile = [ "epub" ];
+    __structuredAttrs = true;
  }
  ''
    mkdir scratch
-    xsltproc \
+    printf "%s" "$epub" | xsltproc \
      --param chapter.autolabel 0 \
      --nonet \
      --output scratch/ \
      ${docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \
-      $epubPath
+      -

    echo "application/epub+zip" > mimetype
    zip -0Xq -b "$TMPDIR" "$out" mimetype
@@ -250,17 +250,17 @@ rec {
            </chapter>
          </book>
        '';
-        passAsFile = [ "doc" ];
+        __structuredAttrs = true;
      }
      ''
        # Generate the epub manual.
        dst=$out/${common.outputPath}

-        xsltproc \
+        printf "%s" "$doc" | xsltproc \
          --param chapter.autolabel 0 \
          --nonet --xinclude --output $dst/epub/ \
          ${docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \
-          $docPath
+          -

        echo "application/epub+zip" > mimetype
        manual="$dst/nixos-manual.epub"
@@ -50,7 +50,7 @@ in
          epkgs: [
            epkgs.emms
            epkgs.magit
-            epkgs.proofgeneral
+            epkgs.proof-general
          ]
        '';
        description = ''
@@ -9,19 +9,8 @@

  imports = [
    (lib.mkRenamedOptionModule
-      [
-        "boot"
-        "initrd"
-        "systemd"
-        "enableTpm2"
-      ]
-      [
-        "boot"
-        "initrd"
-        "systemd"
-        "tpm2"
-        "enable"
-      ]
+      [ "boot" "initrd" "systemd" "enableTpm2" ]
+      [ "boot" "initrd" "systemd" "tpm2" "enable" ]
    )
  ];

@@ -31,13 +20,18 @@
      defaultText = "systemd.package.withTpm2Units";
    };

+    systemd.tpm2.pcrphases.enable = lib.mkEnableOption "systemd boot phase measurements";
+
    boot.initrd.systemd.tpm2.enable = lib.mkEnableOption "systemd initrd TPM2 support" // {
      default = config.boot.initrd.systemd.package.withTpm2Units;
      defaultText = "boot.initrd.systemd.package.withTpm2Units";
    };
+
+    boot.initrd.systemd.tpm2.pcrphases.enable =
+      lib.mkEnableOption "systemd initrd boot phase measurements";
  };

-  # TODO: pcrphase, pcrextend, pcrfs, pcrmachine
+  # TODO: pcrextend, pcrfs, pcrmachine
  config = lib.mkMerge [
    # Stage 2
    (
@@ -52,6 +46,19 @@
        ];
      }
    )
+    (
+      let
+        cfg = config.systemd;
+      in
+      lib.mkIf (cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) {
+        systemd.additionalUpstreamSystemUnits = [
+          "systemd-pcrphase.service"
+          "systemd-pcrphase-sysinit.service"
+        ];
+        systemd.services.systemd-pcrphase.wantedBy = [ "sysinit.target" ];
+        systemd.services.systemd-pcrphase-sysinit.wantedBy = [ "sysinit.target" ];
+      }
+    )

    # Stage 1
    (
@@ -77,5 +84,15 @@
        ];
      }
    )
+    (
+      let
+        cfg = config.boot.initrd.systemd;
+      in
+      lib.mkIf (cfg.enable && cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) {
+        boot.initrd.systemd.additionalUpstreamUnits = [ "systemd-pcrphase-initrd.service" ];
+        boot.initrd.systemd.services.systemd-pcrphase-initrd.wantedBy = [ "initrd.target" ];
+        boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ];
+      }
+    )
  ];
 }
@@ -7,7 +7,7 @@
  name = "music-assistant";
  meta.maintainers = with lib.maintainers; [ hexa ];

-  nodes.machine = {
+  containers.machine = {
    services.music-assistant = {
      enable = true;
    };
@@ -14,12 +14,9 @@ in
    soyouzpanda
  ];

-  nodes.machine =
+  containers.machine =
    { pkgs, ... }:
    {
-      virtualisation.diskSize = 4 * 1024;
-      virtualisation.memorySize = 4 * 1024;
-
      networking.hosts."127.0.0.1" = [ domain ];

      environment.systemPackages = with pkgs; [
@@ -11,13 +11,13 @@
 }:
 vimUtils.buildVimPlugin rec {
  pname = "codediff.nvim";
-  version = "2.43.15";
+  version = "2.45.0";

  src = fetchFromGitHub {
    owner = "esmuellert";
    repo = "codediff.nvim";
    tag = "v${version}";
-    hash = "sha256-gaPLjH33+nBgpSZJ8b/4aneodt8wg+Jy44yXAjemToA=";
+    hash = "sha256-Up4vH5yk13don0HrmHHpqrPIKtc1MTtDbZ6QcMHQYAU=";
  };

  dependencies = [ vimPlugins.nui-nvim ];
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "bluemsx";
-  version = "0-unstable-2026-04-11";
+  version = "0-unstable-2026-05-18";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "bluemsx-libretro";
-    rev = "0b23b79f6b8c19f300d2d86958e89fbe2f6d30bc";
-    hash = "sha256-/rILuViKZBKZFZkCjuFuuuOE3AvDiHQqHtWq4Q8XSMA=";
+    rev = "175438e5fe68ae0cfb7d04c29f81eed17635e6b4";
+    hash = "sha256-crFrG6OsmW3nNnQ+OHFtYz7cRuU9hTjWe3vq4PdYJqA=";
  };

  meta = {
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "puae";
-  version = "0-unstable-2026-05-01";
+  version = "0-unstable-2026-05-18";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-uae";
-    rev = "20e019d4405e33472a3c20824c53bcd79f474a1b";
-    hash = "sha256-4yQtwE7Ghm2/43u2Xcht4WctTNkQjAhMTZtXj4EoJTA=";
+    rev = "6fbf272e342387281484ae84f690fa129f0ab86e";
+    hash = "sha256-JwFIQfWaorQmDxYgHvpq/CEFMc0LVAsX6TyiGN6FhZA=";
  };

  makefile = "Makefile";
@@ -499,13 +499,13 @@
    "vendorHash": null
  },
  "hashicorp_archive": {
-    "hash": "sha256-nR8bgFvhENwC3L3w580FBtDK5l8WDfJqxDQZeUvWyl0=",
+    "hash": "sha256-6Fw2D9PMCcYzu7i3WdloRWbtJlE1tvbiC+/UBSMg9wA=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/archive",
    "owner": "hashicorp",
    "repo": "terraform-provider-archive",
-    "rev": "v2.7.1",
+    "rev": "v2.8.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-MYVkNvJ+rbwGw0htClIbmxk3YX2OK/ZO/QOTyMRFiug="
+    "vendorHash": "sha256-ikBqIxD5aTOcwNHCMN6EaOwSHCAP5n/SULuqQXPLpOc="
  },
  "hashicorp_aws": {
    "hash": "sha256-+MvxcQn0pnsNDR6ERXFW85fLwQ+AG+UcBo5F25WN4mQ=",
@@ -1058,11 +1058,11 @@
    "vendorHash": null
  },
  "oracle_oci": {
-    "hash": "sha256-Yt46N9wVwgz8VbPSHQF1UQ4XT1ENIcE+yeKmO0JqnlM=",
+    "hash": "sha256-+/7ie5SBYMQ+fEvnrFvVRHnEJ6DGtcjKNzBpsYKItP0=",
    "homepage": "https://registry.terraform.io/providers/oracle/oci",
    "owner": "oracle",
    "repo": "terraform-provider-oci",
-    "rev": "v8.13.0",
+    "rev": "v8.14.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1292,13 +1292,13 @@
    "vendorHash": "sha256-HjrB7C0KaLJz9NVLfZdq5EZbNbF9lJPxSkQwnWUF978="
  },
  "tailscale_tailscale": {
-    "hash": "sha256-yR65w/o/VpwKINcvz4SBybAwsphGC7A/B+baKRcIT3I=",
+    "hash": "sha256-c1Hz8srHNaZJq1kJrSwm8ruoHcebM11yX2wQhWavoWE=",
    "homepage": "https://registry.terraform.io/providers/tailscale/tailscale",
    "owner": "tailscale",
    "repo": "terraform-provider-tailscale",
-    "rev": "v0.28.0",
+    "rev": "v0.29.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-+q2KR3ctotT30fBE0lcpQlUXQS7nfi5VACWYxwluuMc="
+    "vendorHash": "sha256-hl9govsnEXMd4VbOPqoSGLgSnImDA55enYTaDz2wKH0="
  },
  "telmate_proxmox": {
    "hash": "sha256-1aKKlOIk1mH4yx66eD635d1IaUWXIiBGHEt4A2F2mGM=",
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "air";
-  version = "1.65.1";
+  version = "1.65.2";

  src = fetchFromGitHub {
    owner = "air-verse";
    repo = "air";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-omyWDW5bE+HfXQ2EQZKthB9t+jBEFcPSVtPss5qeoMI=";
+    hash = "sha256-kQqWIqGJx8396rALn87ykdA3g+1IH+XGOpaICD02j2U=";
  };

  vendorHash = "sha256-03xZ3P/7xjznYdM9rv+8ZYftQlnjJ6ZTq0HdSvGpaWw=";
@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "aks-mcp-server";
-  version = "0.0.17";
+  version = "0.0.18";

  src = fetchFromGitHub {
    owner = "Azure";
    repo = "aks-mcp";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-3G7IDHDY3HfjGYM8aKK4Egey1/urDVeWv99PJcCaiSo=";
+    hash = "sha256-h/zLbnc2ffcQkx+KE6vglaSG6QAySZSg8EB4zyqH4sg=";
  };

-  vendorHash = "sha256-aMs7vABZwRPPIaP6BdTau1oFfGqnzYt8wxUk2mQSVlE=";
+  vendorHash = "sha256-HYIEGnQOVNNVJxzoOiLTXwRFOBvCwikAwqky18VqFSQ=";

  subPackages = [ "cmd/aks-mcp" ];

@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "bearer";
-  version = "2.0.1";
+  version = "2.0.2";

  src = fetchFromGitHub {
    owner = "bearer";
    repo = "bearer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VlKer94UNES/xbp+BI5lapQP2Ze1wgHKDQMj1g0VcDA=";
+    hash = "sha256-oYlW9sVyoJXOqcGLcF65c+QsTNquz0Ij1HnMjAbnZZI=";
  };

-  vendorHash = "sha256-p+Xe788WbvUl1u+3nEgGyHLZKEVoKCUR855TDpA6o58=";
+  vendorHash = "sha256-Y32HdEk+9fftDP4cttn6r3GMq3YqeyXpsRaU5ApkGa4=";

  subPackages = [ "cmd/bearer" ];

@@ -7,13 +7,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "blowfish-tools";
-  version = "1.10.0";
+  version = "1.13.1";

  src = fetchFromGitHub {
    owner = "nunocoracao";
    repo = "blowfish-tools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-90EKsRKOO2Hb64Wy3TlwzlPU2K8AAlSxc17ek5ZLoG0=";
+    hash = "sha256-QCc/T4SWifVGeN7YpH0YJTZZw+OMC9QapSEmGX5acSQ=";
  };

  dontNpmBuild = true;
@@ -30,7 +30,10 @@ buildNpmPackage (finalAttrs: {
    homepage = "https://blowfish.page";
    changelog = "https://github.com/nunocoracao/blowfish-tools/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ eripa ];
+    maintainers = with lib.maintainers; [
+      eripa
+      thattemperature
+    ];
    mainProgram = "blowfish-tools";
  };
 })
@@ -5,30 +5,36 @@
  installShellFiles,
  lib,
  stdenv,
+  nix-update-script,
  testers,
 }:

 buildGoModule (finalAttrs: {
  pname = "boring";
-  version = "0.11.7";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "alebeck";
    repo = "boring";
-    tag = finalAttrs.version;
-    hash = "sha256-RXLFIOGJEvE6kV14+rnN4zPV8bloikxjksdlSHQFwUU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9ei2Kl2590DY0S9jrc+MxsL5srxmwx8wD6uFlVQ6o4o=";
  };

  nativeBuildInputs = [
    installShellFiles
  ];

-  vendorHash = "sha256-/MAkVesn8ub2MrguWTueMI9+/lgCRdaXUEioHE/bg8w=";
+  subPackages = [ "cmd/boring" ];
+
+  vendorHash = "sha256-4YU0l2YhlMQzcKSMhXt3oEeCk87Yu90esiPelRs5/OQ=";

  ldflags = [
    "-s"
    "-w"
-    "-X main.version=${finalAttrs.version}"
+    "-X github.com/alebeck/boring/internal/buildinfo.Version=${finalAttrs.version}"
+    "-X github.com/alebeck/boring/internal/buildinfo.Commit=${
+      builtins.substring 0 5 finalAttrs.src.rev
+    }"
  ];

  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
@@ -38,10 +44,14 @@ buildGoModule (finalAttrs: {
      --zsh  <($out/bin/boring --shell zsh)
  '';

-  passthru.tests.version = testers.testVersion {
-    package = boring;
-    command = "boring version";
-    version = "boring ${finalAttrs.version}";
+  passthru = {
+    tests.version = testers.testVersion {
+      package = boring;
+      command = "boring version";
+      version = "boring ${finalAttrs.version}";
+    };
+
+    updateScript = nix-update-script { };
  };

  meta = {
@@ -16,16 +16,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "broot";
-  version = "1.56.2";
+  version = "1.56.4";

  src = fetchFromGitHub {
    owner = "Canop";
    repo = "broot";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Qp2Scugl5ZYxax/+RYDY+k9ScxC5p5IahvJpMXUJiR4=";
+    hash = "sha256-JqD4CSTVbrqg7nAkSRp4SaGpFKt1U3CYLxM31AJfcPA=";
  };

-  cargoHash = "sha256-ltwp4rM/bEj/FVwpOr7nZ+xW0dwXdvuWVWD4/D7obtE=";
+  cargoHash = "sha256-5VGgbrd+iDD+L6JFy4H6HFuRW6xtQDawSGGSQARjRU0=";

  nativeBuildInputs = [
    installShellFiles
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-llvm-lines";
-  version = "0.4.45";
+  version = "0.4.46";

  src = fetchFromGitHub {
    owner = "dtolnay";
    repo = "cargo-llvm-lines";
    tag = finalAttrs.version;
-    hash = "sha256-5Tf3vkDTCQCmYvfKW3OHCese6HEs9CNbcUeLyS7MsOE=";
+    hash = "sha256-Pyl3IGPMjw48mjOh/P4FffP7r+Yd0bJodyKSSGK/kCQ=";
  };

-  cargoHash = "sha256-JrH7W2zRDoPa1ENQCfE++2y2VEC3INg/cst5ob2hmy0=";
+  cargoHash = "sha256-/8Ch74qXamQIgi1uR5huK+EnqpvGfIpYaVygu7NgihI=";

  meta = {
    description = "Count the number of lines of LLVM IR across all instantiations of a generic function";
@@ -35,14 +35,14 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "checkov";
-  version = "3.2.528";
+  version = "3.2.529";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = "checkov";
    tag = finalAttrs.version;
-    hash = "sha256-bbGB6h9jhd3laeOTaSwZ2o3yu62vLMuCmYhS/qQBkeA=";
+    hash = "sha256-sfbwmeASE0gwN/jg+6l84G60tIZRbZc417QK0lqwr/s=";
  };

  pythonRelaxDeps = [
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ddccontrol-db";
-  version = "20260120";
+  version = "20260518";

  src = fetchFromGitHub {
    owner = "ddccontrol";
    repo = "ddccontrol-db";
    tag = finalAttrs.version;
-    sha256 = "sha256-XYa0WjVGtSainsosuFX3LU0JiWHGzycPzxirraNu8gw=";
+    sha256 = "sha256-/QAOeL1FruxklcWQfoysO1+WzCJB5v/wi81spO6V/Y8=";
  };

  nativeBuildInputs = [
@@ -179,7 +179,7 @@ GEM
    dotenv (3.2.0)
    drb (2.2.3)
    email_typo (0.2.3)
-    erb (6.0.2)
+    erb (6.0.4)
    erb_lint (0.9.0)
      activesupport
      better_html (>= 2.0.1)
@@ -256,7 +256,7 @@ GEM
      os (>= 0.9, < 2.0)
      signet (>= 0.16, < 2.a)
    hashdiff (1.2.1)
-    hexapdf (1.6.0)
+    hexapdf (1.7.0)
      cmdparse (~> 3.0, >= 3.0.3)
      geom2d (~> 0.4, >= 0.4.1)
      openssl (>= 2.2.1)
@@ -318,7 +318,7 @@ GEM
    multi_json (1.19.1)
    net-http (0.9.1)
      uri (>= 0.11.1)
-    net-imap (0.6.3)
+    net-imap (0.6.4)
      date
      net-protocol
    net-pop (0.1.2)
@@ -328,14 +328,14 @@ GEM
    net-smtp (0.5.1)
      net-protocol
    nio4r (2.7.5)
-    nokogiri (1.19.2)
+    nokogiri (1.19.3)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
-    nokogiri (1.19.2-aarch64-linux-musl)
+    nokogiri (1.19.3-aarch64-linux-musl)
      racc (~> 1.4)
-    nokogiri (1.19.2-arm64-darwin)
+    nokogiri (1.19.3-arm64-darwin)
      racc (~> 1.4)
-    nokogiri (1.19.2-x86_64-linux-musl)
+    nokogiri (1.19.3-x86_64-linux-musl)
      racc (~> 1.4)
    numo-narray-alt (0.10.3)
    oj (3.16.16)
@@ -661,4 +661,4 @@ DEPENDENCIES
  webmock

 BUNDLED WITH
-   2.7.2
+   2.6.9
@@ -868,10 +868,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0ar4nmvk1sk7drjigqyh9nnps3mxg625b8chfk42557p8i6jdrlz";
+      sha256 = "1ncmbdjf2bwmk0jf5cxywns9zbxyfiy4h4p3pzi7yddyjhv81qrq";
      type = "gem";
    };
-    version = "6.0.2";
+    version = "6.0.4";
  };
  erb_lint = {
    dependencies = [
@@ -1208,10 +1208,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "10i5826zgvk04jsn6yg7w72s1l5xghrapm6anay4g8w8l32jzqvq";
+      sha256 = "0ma1rv2hc51hlji4d3xflx610pq4222bw51sax434b7fayhh55fz";
      type = "gem";
    };
-    version = "1.6.0";
+    version = "1.7.0";
  };
  i18n = {
    dependencies = [ "concurrent-ruby" ];
@@ -1592,10 +1592,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1bgjhb65r1bl52wdym6wpbb0r3j7va8s44grggp0jvarfvw7bawv";
+      sha256 = "0ax0f0r97jm83q462vsrcbdxprs894fyyc44v62c48ihgb39hmcs";
      type = "gem";
    };
-    version = "0.6.3";
+    version = "0.6.4";
  };
  net-pop = {
    dependencies = [ "net-protocol" ];
@@ -1662,10 +1662,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mhp90nf3g3yy5vgjnwd34czi6rbi0p7057vgngfmmdkknsxiz9q";
+      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
      type = "gem";
    };
-    version = "1.19.2";
+    version = "1.19.3";
  };
  numo-narray-alt = {
    groups = [ "default" ];
@@ -4,10 +4,9 @@
  fetchFromGitHub,
  bundlerEnv,
  nixosTests,
-  ruby_3_4,
+  ruby_4_0,
  pdfium-binaries,
  makeWrapper,
-  bundler,
  fetchYarnDeps,
  yarn,
  yarnConfigHook,
@@ -16,23 +15,20 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "docuseal";
-  version = "2.4.4";
-
-  bundler = bundler.override { ruby = ruby_3_4; };
+  version = "2.5.3";

  src = fetchFromGitHub {
    owner = "docusealco";
    repo = "docuseal";
    tag = finalAttrs.version;
-    hash = "sha256-GjWR0jxVRTs5KNbFDEcgCbG/HTJlJGYpbKf8+0YBSmk=";
+    hash = "sha256-9fDEj9gOBZrn4dNWf+QRCZs3gUv3Mx/YZLRx55ShS7E=";
    # https://github.com/docusealco/docuseal/issues/505#issuecomment-3153802333
    postFetch = "rm $out/db/schema.rb";
  };

  rubyEnv = bundlerEnv {
    name = "docuseal-gems";
-    ruby = ruby_3_4;
-    inherit (finalAttrs) bundler;
+    ruby = ruby_4_0;
    gemdir = ./.;
  };

@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dolibarr";
-  version = "23.0.2";
+  version = "23.0.3";

  src = fetchFromGitHub {
    owner = "Dolibarr";
    repo = "dolibarr";
    tag = finalAttrs.version;
-    hash = "sha256-WfMMikTmC+13HxI0YCKwJTrn57CJreU3GsEyrOjr/hg=";
+    hash = "sha256-Yse1rUaxRnuXawgAk0m4U3GCZNlV0IPPpZ9Qml4heA8=";
  };

  dontBuild = true;
@@ -14,16 +14,16 @@

 buildGoModule (finalAttrs: {
  pname = "fence";
-  version = "0.1.57";
+  version = "0.1.58";

  src = fetchFromGitHub {
    owner = "Use-Tusk";
    repo = "fence";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YX+DqD20hr/+hAXLVddEQjj0J7jybhNNdtQM3tlSPek=";
+    hash = "sha256-ACe3N4bXYJW6QDQHtRChFWOTXTZTbEUbZ4d8cuFRqMY=";
  };

-  vendorHash = "sha256-Qct/M0zuggYzlN0gyO8nF58M5Av3HcYyMjrPab5Crr0=";
+  vendorHash = "sha256-sEGLnYC4gMo5jPCZxBXra3pmRigaq4bDcVFd52ru7rQ=";

  ldflags = [
    "-s"
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "files-cli";
-  version = "2.15.287";
+  version = "2.15.297";

  src = fetchFromGitHub {
    repo = "files-cli";
    owner = "files-com";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-iKVoQCyLcsGc51IKwUzCpLqG5VbkIASpZILVVX14Sv8=";
+    hash = "sha256-oXgAQikdzzcp0SxYSerqXvjZ4/hI8Wt9ZJio7tHlt38=";
  };

-  vendorHash = "sha256-K9XXwKFC0xVYSwpQz7EubOoA2XSP7ROa3ORU9A/Gehg=";
+  vendorHash = "sha256-SYi7Pq+vIMp0SH434cp0zJLV7ZkzODW3+FIarnX4ezs=";

  ldflags = [
    "-s"
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "fly";
-  version = "8.2.0";
+  version = "8.2.1";

  src = fetchFromGitHub {
    owner = "concourse";
    repo = "concourse";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-zQ7J04QHozRRFPWKjKtI5nB15x5ztYennfM16rpZpP8=";
+    hash = "sha256-YKa1hGqmmwFNcPX6N7iJUjUL6FnPJLi9DZTkcujzVkY=";
  };

  vendorHash = "sha256-dvE5rtJX3MIuYyswLgcwojd5LIkhD4WnPEL3HNfmhkA=";
@@ -2,25 +2,36 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  testers,
 }:
-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "gci";
-  version = "0.13.7";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "daixiang0";
    repo = "gci";
-    rev = "v${version}";
-    sha256 = "sha256-vSVa0fTGKf8H1cURFD0dha65TgOLMa43NuA043TEFu4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+qoHORHUMgr03v3RB+7+g9O/tlDkQKFmKybma0FdhVs=";
  };

-  vendorHash = "sha256-NWVhuJAWwZ9EPLq/PY8nqqRXXPgahGdFNVqBTDvCnMw=";
+  vendorHash = "sha256-MS6Ei58HpR/ueqdmGEx15WoSSSwDpQUcxAWz36UnhmA=";
+
+  excludedPackages = [ "v2" ];
+
+  ldflags = [
+    "-s"
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+  };

  meta = {
    description = "Controls golang package import order and makes it always deterministic";
    homepage = "https://github.com/daixiang0/gci";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ krostar ];
-    broken = true;
+    mainProgram = "gci";
  };
-}
+})
@@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gforth";
-  version = "0.7.9_20260508";
+  version = "0.7.9_20260513";

  src = fetchFromGitHub {
    owner = "forthy42";
    repo = "gforth";
    rev = finalAttrs.version;
-    hash = "sha256-XcGykMUEMmrNQ8y++SM1s0RPfMFgBTDXAIeAGKgU2Iw=";
+    hash = "sha256-hx1/CE18lepkyTnT6yymGwAAJtRM8u7DAhPsKTj0gdo=";
  };

  patches = [ ./use-nproc-instead-of-fhs.patch ];
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "gh-enhance";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "dlvhdr";
    repo = "gh-enhance";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-g6nhEcBt72sol/49FVlYSo9HKtWHfj+zKw7FZ0ZjKXI=";
+    hash = "sha256-sfTAhrZZPUOAyltlblDIgd/pKMSdugXQqCZ0fBqMcQM=";
  };

  vendorHash = "sha256-us25CXQC3cd3BTa+wOYArbBiMtwkgpfeCQoD3S7+3rU=";
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "gickup";
-  version = "0.10.42";
+  version = "0.10.44";

  src = fetchFromGitHub {
    owner = "cooperspencer";
    repo = "gickup";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nQermDp6w1OgZgRMknj2f6B7T9ufTZXuA8FuhGGpnWM=";
+    hash = "sha256-AbeV/0CngNgCaLUIwv/uy8VgpiKiOXWGSjnW+xrd7gk=";
  };

-  vendorHash = "sha256-lmPZlCiQXwe6FWwtDyZjqmF9I2609odpY4AjkEuqPUA=";
+  vendorHash = "sha256-lCeUEReVh0Fg1gyyTvWq2CIdQLuGCN20u9TftiokI0I=";

  ldflags = [ "-X main.version=${finalAttrs.version}" ];

@@ -15,13 +15,13 @@ in

 buildGoModule (finalAttrs: {
  pname = "go-containerregistry";
-  version = "0.21.5";
+  version = "0.21.6";

  src = fetchFromGitHub {
    owner = "google";
    repo = "go-containerregistry";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-2cC2fZe22K8mPIXa8YI1MgUlEn6p1z7RBEQhFjYNsxA=";
+    sha256 = "sha256-qqtcvpxqvOG+zVGse5vCdxaA8tgH3WrKjfLUTRLxA7s=";
  };
  vendorHash = null;

@@ -11,17 +11,17 @@

 buildGoModule (finalAttrs: {
  pname = "gomuks-web";
-  version = "26.04";
+  version = "26.05";

  src = fetchFromGitHub {
    owner = "gomuks";
    repo = "gomuks";
    tag = "v0.${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}.0";
-    hash = "sha256-IysL++H3ncAU1xqNWKy2Z9RKkF1hriVmIDdQu0SkDbQ=";
+    hash = "sha256-BoTD4c9ZhfyFytsxUCvTIoCoBiFbPW1T1uGWRDx+OIE=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-Ev6nmmOzLPjXp8XYj+7MRPElfGAv8fUcXJ5fXP8LCvs=";
+  vendorHash = "sha256-WJQmei6+T98k2Dkma3rHM2c7pzvze0hT8W5UnnARLok=";

  nativeBuildInputs = [
    nodejs
@@ -37,7 +37,7 @@ buildGoModule (finalAttrs: {
    npmRoot = "web";
    npmDeps = fetchNpmDeps {
      src = "${finalAttrs.src}/web";
-      hash = "sha256-NeQzz2+Vdi1OtVN7ZF8I33nFCO7OpccD1AjpPl7tML4=";
+      hash = "sha256-H76LUuhEqjuAh7PxjIjMBW5TvsOg9Ra2T7Y39SfktqM=";
    };
  };

@@ -28,11 +28,7 @@ buildGoLatestModule (finalAttrs: {

  doCheck = false;

-  # Only build gopls & modernize, not the integration tests or documentation generator.
-  subPackages = [
-    "."
-    "internal/analysis/modernize/cmd/modernize"
-  ];
+  subPackages = [ "." ];

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "gotip";
-  version = "0.6.3";
+  version = "0.6.4";

  src = fetchFromGitHub {
    owner = "lusingander";
    repo = "gotip";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9oLHvIY2GlBq7NdsWG1CC+jhH3LvnC9rxCwPtS2aN9o=";
+    hash = "sha256-CgTznW4SwKrJ4Q7dIo2ebn51G13nP36tv8n2G9T+MZ0=";
  };

-  vendorHash = "sha256-ft2mmOClDil5/bLNToJM8Ui6YDeoYjvTtbYX6Dy9yjo=";
+  vendorHash = "sha256-Sj7JzyWviGxp10O1zGONN49TXtwquXYJ1KoijIVcyj0=";

  ldflags = [
    "-s"
@@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitHub,
  fontforge,
+  installFonts,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -12,21 +13,28 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "aravindavk";
    repo = "gubbi";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    sha256 = "10w9i3pmjvs1b3xclrgn4q5a95ss4ipldbxbqrys2dmfivx7i994";
  };

-  nativeBuildInputs = [ fontforge ];
+  nativeBuildInputs = [
+    fontforge
+    installFonts
+  ];

  dontConfigure = true;

  preBuild = "patchShebangs generate.pe";

-  installPhase = "install -Dm444 -t $out/share/fonts/truetype/ Gubbi.ttf";
+  installPhase = ''
+    runHook preInstall
+    runHook postInstall
+  '';

  meta = {
    inherit (finalAttrs.src.meta) homepage;
    description = "Kannada font";
+    maintainers = with lib.maintainers; [ pancaek ];
    license = lib.licenses.gpl3Plus;
    platforms = lib.platforms.all;
  };
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "httpdirfs";
-  version = "1.2.7";
+  version = "1.2.10";

  src = fetchFromGitHub {
    owner = "fangfufu";
    repo = "httpdirfs";
    tag = finalAttrs.version;
-    hash = "sha256-6TGptKWX0hSNL3Z3ioP7puzozWLiMhCybN7hATQdD/k=";
+    hash = "sha256-dfMavLEBXry1cW4o2yQjuvBbYIvct1GXzACj+9Hh4wE=";
  };

  nativeBuildInputs = [
@@ -11,14 +11,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "jj-pre-push";
-  version = "0.4.4";
+  version = "0.5.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "acarapetis";
    repo = "jj-pre-push";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TekLYlx2b+gcf0UzLOqWv2VtwS6etE/uPBQwc99z1Lw=";
+    hash = "sha256-AIsLUI42ewYqmgOP9livXE0tGAVWTfSh9K7h+PMObJg=";
  };

  postPatch = ''
@@ -10,12 +10,12 @@
  kopia,
 }:
 let
-  version = "0.22.3";
+  version = "0.23.0";
  src = fetchFromGitHub {
    owner = "kopia";
    repo = "kopia";
    tag = "v${version}";
-    hash = "sha256-5oNam99Mij78snSO6jiGPYzeD68sXEBKM2dGQtTUrww=";
+    hash = "sha256-9xvgm+A8h2pAX3oHtiFSa2xNab5BDkEBEtXQZz3Fd5A=";
  };
 in
 buildNpmPackage {
@@ -24,7 +24,7 @@ buildNpmPackage {

  sourceRoot = "${src.name}/app";

-  npmDepsHash = "sha256-DRsPiIiikp0pCAo0np0E3TYT1L6HGKXAXwKuB1jX6lw=";
+  npmDepsHash = "sha256-Ctp41vNZPVbycwIzWiTh+1ej3NpCf1WJCqnJsyoyxlc=";
  makeCacheWritable = true;

  nativeBuildInputs = [
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  cmake,
  fixDarwinDylibNames,
 }:
@@ -17,6 +18,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-xZ8IFnqrGt47lN+C6/ibgbIWqpObDf4RHPaGMXw0WZ4=";
  };

+  patches = [
+    # Fix aarch64-darwin build.
+    (fetchpatch {
+      url = "https://github.com/LASzip/LASzip/commit/2274e52076c5f4cbe2d826d690c21713ddd842b4.patch";
+      hash = "sha256-C6AOJSY8JJCNNA5Fuz3OiQpzSFO/PwI6Wj+WBUW948k=";
+    })
+  ];
+
  hardeningDisable = [ "format" ]; # -Werror=format-security

  nativeBuildInputs = [
@@ -2,90 +2,34 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
-  fetchpatch,
-  stdenvNoCC,
-  nodejs,
-  pnpm_10,
  templ,
-  pnpmConfigHook,
-  fetchPnpmDeps,
  versionCheckHook,
  nix-update-script,
 }:

-let
-  version = "1.1.4";
+buildGoModule (finalAttrs: {
+  pname = "ldap-manager";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "netresearch";
    repo = "ldap-manager";
-    tag = "v${version}";
-    hash = "sha256-G4UUgjTbRmVmbLvSv95kwhqnTUCygW8plkdYFGcHBqE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wq/VZ+F/m13YQjJfCoN+UgaeAazWup2JINJ3I9KM3d0=";
  };

-  frontend = stdenvNoCC.mkDerivation {
-    pname = "ldap-manager-frontend";
-    inherit version src;
-
-    nativeBuildInputs = [
-      nodejs
-      pnpmConfigHook
-      pnpm_10
-    ];
-
-    pnpmDeps = fetchPnpmDeps {
-      pname = "ldap-manager";
-      inherit version src;
-      pnpm = pnpm_10;
-      fetcherVersion = 3;
-      hash = "sha256-XFdKb43NxslB60GEDIBbKFYRClq0SeUqPwA81SAZaug=";
-    };
-
-    buildPhase = ''
-      runHook preBuild
-
-      pnpm css:build
-
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out
-      cp -r internal/web/static $out/static
-
-      runHook postInstall
-    '';
-  };
-in
-
-buildGoModule (finalAttrs: {
-  pname = "ldap-manager";
-  inherit version src;
-
-  vendorHash = "sha256-ekgnjhO9GAml/A8pf9Hj6lseYJkvvf87f7tiwWixyKU=";
+  vendorHash = "sha256-sE8XGlQg6FLDfgYdioa5i5Gv8LyQo16p0oIaiyMOzZ4=";

  nativeBuildInputs = [
    templ
  ];

-  patches = [
-    # Add --version support
-    # https://github.com/netresearch/ldap-manager/pull/462
-    (fetchpatch {
-      url = "https://github.com/netresearch/ldap-manager/pull/462.patch";
-      hash = "sha256-OykLep7uGZ79/lqOC4KNnSThCqQsmDo6vDqaoWVX3XI=";
-    })
-  ];
-
  excludedPackages = [
    "internal/e2e"
    "internal/integration"
  ];

  preBuild = ''
-    cp -r ${frontend}/static/* internal/web/static/
    templ generate
  '';

@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "luau-lsp";
-  version = "1.66.1";
+  version = "1.67.0";

  src = fetchFromGitHub {
    owner = "JohnnyMorganz";
    repo = "luau-lsp";
    tag = finalAttrs.version;
-    hash = "sha256-Lz6tnCfkjQc7YhfCETaFLAvW6fTrRwmELxBNURavNeY=";
+    hash = "sha256-J2/ARONeRZ5gy/3RE25GgPNahDUkrgbwQaQLU5AxVhk=";
    fetchSubmodules = true;
  };

@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "matrix-alertmanager-receiver";
-  version = "2026.5.6";
+  version = "2026.5.13";

  src = fetchFromGitHub {
    owner = "metio";
    repo = "matrix-alertmanager-receiver";
    tag = finalAttrs.version;
-    hash = "sha256-bx+zsMjODi3l6VXES5rKZMARGDFTBwHtD2eYAxBouW4=";
+    hash = "sha256-MCOEw8GxyqZgQFTWzOmCnMxHEGKkp5WupJUllclw9Vg=";
  };

  vendorHash = "sha256-YlWc8EkM6GfNdH7ot9JmDFB5Xko3+O1Qr5vVNlDNCvI=";
@@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "matrix-synapse-s3-storage-provider";
-  version = "1.6.0";
+  version = "1.6.1";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "matrix-org";
    repo = "synapse-s3-storage-provider";
    tag = "v${version}";
-    hash = "sha256-aeacw6Fpv4zFhZI4LdsJiV2pcOAMv3aV5CicnwYRxw8=";
+    hash = "sha256-vRDjN9BDp7Rta/F91OVEH8FWyiwxR67PQSqBCs3bDkM=";
  };

  postPatch = ''
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "namespace-cli";
-  version = "0.0.509";
+  version = "0.0.516";

  src = fetchFromGitHub {
    owner = "namespacelabs";
    repo = "foundation";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-jePgbLvXhQxwvE7lwTE/NtpadzEadQaD/qlmyzOVHp0=";
+    hash = "sha256-IVKqyANGPLbeogh058fy1/mr/jWbceuQml4qKdDUwFQ=";
  };

-  vendorHash = "sha256-FnmcBDPQIISPGiz28yqdfiD26ZrBBeiHPmJawdMYqwE=";
+  vendorHash = "sha256-XNCogbQkG/BQPWW04Lpzca2sEXeIvp2XC//BILbshwQ=";

  subPackages = [
    "cmd/nsc"
@@ -8,13 +8,13 @@

 stdenv.mkDerivation {
  pname = "nanosvg";
-  version = "0-unstable-2025-11-21";
+  version = "0-unstable-2026-05-18";

  src = fetchFromGitHub {
    owner = "memononen";
    repo = "nanosvg";
-    rev = "5cefd9847949af6df13f65027fd43af5a7513633";
-    hash = "sha256-BozXqp3pNxAew+aFUbh6M3ppVQ+U7XMmMCbGT1urfWE=";
+    rev = "48120e91e64b2f409ed600cdfd6d790a49ba11ab";
+    hash = "sha256-onjmiWQPftr4AWySwJOpMLZ3WQGvUp9wj9isdUyNIPc=";
  };

  nativeBuildInputs = [ cmake ];
@@ -1,29 +0,0 @@
-Kill google analytics from local documentation.
-
-diff -r bb0a2fbdc886 xslt/ga.xslt
--- a/xslt/ga.xslt	Mon Apr 06 11:17:11 2020 +0100
-+++ b/xslt/ga.xslt	Thu Apr 09 10:29:02 2020 -0400
-@@ -6,23 +6,6 @@
- <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
- 
- <xsl:template name="ga">
-
-    <script>
-        (function(w, d, s, l, i) {
-            w[l] = w[l] || [];
-            w[l].push({
-                'gtm.start': new Date().getTime(),
-                event: 'gtm.js'
-            });
-            var f = d.getElementsByTagName(s)[0],
-                j = d.createElement(s),
-                dl = l != 'dataLayer' ? '&amp;l=' + l : '';
-            j.async = true;
-            j.src = '//www.googletagmanager.com/gtm.js?id=' + i + dl;
-            f.parentNode.insertBefore(j, f);
-        })(window, document, 'script', 'dataLayer', 'GTM-TPSP33');
-    </script>
-
- </xsl:template>
- 
- </xsl:stylesheet>
@@ -3,7 +3,7 @@
  stdenv,
  libxml2,
  libxslt,
-  fetchhg,
+  fetchFromGitHub,
 }:

 # Upstream maintains documentation (sources of https://nginx.org) in separate
@@ -14,13 +14,13 @@
 # $out/bin/nginx, but we have no better options.
 stdenv.mkDerivation {
  pname = "nginx-doc-unstable";
-  version = "2022-05-05";
-  src = fetchhg {
-    url = "https://hg.nginx.org/nginx.org";
-    rev = "a3aee2697d4e";
-    sha256 = "029n4mnmjw94h01qalmjgf1c2h3h7wm798xv5knk3padxiy4m28b";
+  version = "0-unstable-2026-05-15";
+  src = fetchFromGitHub {
+    owner = "nginx";
+    repo = "nginx.org";
+    rev = "7884e3ae20269c6aa718dc104c0c578f797e5269";
+    hash = "sha256-ut2LRZg2gyGPbili7XcOH0wZ/nI3ArA2RGWJKcZTBOk=";
  };
-  patches = [ ./exclude-google-analytics.patch ];
  nativeBuildInputs = [
    libxslt
    libxml2
@@ -10,14 +10,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "oxker";
-  version = "0.13.1";
+  version = "0.13.2";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-NY++HK2mDcf3bWMEqJBeJr6zKVtD4qlzY+z+l/ZgPR4=";
+    hash = "sha256-9kJ+oUwv3hAYANJ8RtVc1P3f15ImfeqXur1h8DT90Vg=";
  };

-  cargoHash = "sha256-AC1E7NhES2SIp64JqSBEIWltulQztQz6NnQKAT4h+eA=";
+  cargoHash = "sha256-Tv1+M3Xupdj7ZHsLw5eObGbw1gmVhDDDd3faY4O6mqM=";

  # See https://github.com/mrjackwills/oxker/issues/73
  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -10,20 +10,20 @@

 buildGoModule (finalAttrs: {
  pname = "pangolin-cli";
-  version = "0.8.1";
+  version = "0.8.2";

  src = fetchFromGitHub {
    owner = "fosrl";
    repo = "cli";
    tag = finalAttrs.version;
-    hash = "sha256-3p2yazDYKORVanPOQNY0XDhj1RbvBcFztKa7oosFW98=";
+    hash = "sha256-LMLeJVYu2L1+FVOLNapEShj36zv8vCP9BVkU4Y/g0vc=";
  };

  ldflags = [
    "-X github.com/fosrl/cli/internal/version.Version=${finalAttrs.version}"
  ];

-  vendorHash = "sha256-J6dILAwneeUL/+c6505F24xjg6Nus8t4L3vUAMbaeHM=";
+  vendorHash = "sha256-r7Tbs05jRlIX1zLRMVqzvDth4+yaMUck2q6R3uPHAWs=";

  nativeBuildInputs = [ installShellFiles ];

@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "plasma-panel-colorizer";
-  version = "7.0.1";
+  version = "7.1.0";

  src = fetchFromGitHub {
    owner = "luisbocanegra";
    repo = "plasma-panel-colorizer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-T2LodP2E5R1NtuTNPxzUNenbs6P3Ur1kbEIHGRbzah0=";
+    hash = "sha256-OyOFQZzsWRbsvv0jAFRXWo4AMeu4t1KMtubg3R/jb50=";
  };

  nativeBuildInputs = [
@@ -4,6 +4,8 @@
  fetchFromGitHub,
  pkg-config,
  oniguruma,
+  versionCheckHook,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@@ -32,9 +34,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
    RUSTONIG_SYSTEM_LIBONIG = true;
  };

-  # thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: invalid option '--test-threads''
+  # Compatibility tests run against different regex implementations.
+  # Some can be run by providing `jdk*_headless` and `python3` `nativeCheckInputs`,
+  # while some cannot, i.e. `deno`-based requires network access and `dotnet-script` is not packaged,
+  # and they cannot be disabled partially.
  doCheck = false;

+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Portable, modern regular expression language";
    mainProgram = "pomsky";
@@ -44,6 +54,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
      mit # or
      asl20
    ];
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.progrm_jarvis ];
  };
 })
@@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "reredirect";
-  version = "0.3";
+  version = "unstable-2026-02-15";

  src = fetchFromGitHub {
    owner = "jerome-pouiller";
    repo = "reredirect";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-RHRamDo7afnJ4DlOVAqM8lQAC60YESGSMKa8Io2vcX0=";
+    rev = "b85df395e18d09b54e1fb73dfe344f8f04224a83";
+    sha256 = "sha256-lLhF8taK6PqWo4u6pMZDN2PZavnWwsz4NbEUT7EtULo=";
  };

  patches = [
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {

  postFixup = ''
    substituteInPlace ${placeholder "out"}/bin/relink \
-      --replace "reredirect" "${placeholder "out"}/bin/reredirect"
+      --replace-fail "reredirect" "${placeholder "out"}/bin/reredirect"
  '';

  meta = {
@@ -35,7 +35,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rerun";
-  version = "0.31.4";
+  version = "0.32.1";

  __structuredAttrs = true;
  strictDeps = true;
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "rerun-io";
    repo = "rerun";
    tag = finalAttrs.version;
-    hash = "sha256-gbN9aplPw+U4liGDU7Z0x+ySfxr+RlyriEkDsIA8gHA=";
+    hash = "sha256-WedZ5RZiin6jGx2aCe5obkkWJSnwzMoP4s+qQIyeq8Y=";
  };

  # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@@ -58,7 +58,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '"rerun_sdk/rerun_cli/rerun"' '"rerun_sdk/rerun"'
  '';

-  cargoHash = "sha256-N5JeZMbGy9FSiluE1MAtvg97dUq3ZoUZdABwORUlWlA=";
+  cargoHash = "sha256-LkZA3wcDGIGSjRkjPY7YhjlfVqlGWAMc+qIfDLFZUTE=";

  cargoBuildFlags = [
    "--package"
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "routedns";
-  version = "0.1.169";
+  version = "0.1.170";

  src = fetchFromGitHub {
    owner = "folbricht";
    repo = "routedns";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-VQ+8wGv46YZbCYedU1gYTNqd54+kjbuPKbaYRV3IHYc=";
+    hash = "sha256-hCjsyBnCHewMopnLue70ibKfTt+xUmg0/Kk+eKU/+JQ=";
  };

  vendorHash = "sha256-a4KcKb75yWv7+1vIYCypS9nnrFJ3zogXIPzUVVA7AXs=";
@@ -9,7 +9,7 @@
 }:

 let
-  version = "0.18.1";
+  version = "0.19.0";
 in
 buildGoModule {
  pname = "sbom-utility";
@@ -19,7 +19,7 @@ buildGoModule {
    owner = "CycloneDX";
    repo = "sbom-utility";
    tag = "v${version}";
-    hash = "sha256-LIyr9qu4FQ85EBWzNncztURy1U02VnLMCwEjHwCJvUM=";
+    hash = "sha256-G+0gQrQIWAgYsojFuvXU1IhMS2p3fHCejJLjZNaAU1I=";
  };

  vendorHash = "sha256-vyYSir5u6d5nv+2ScrHpasQGER4VFSoLb1FDUDIrtDM=";
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "tenv";
-  version = "4.12.0";
+  version = "4.12.2";

  src = fetchFromGitHub {
    owner = "tofuutils";
    repo = "tenv";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ph44Iy/yUdtSi3zkCeDZyWeSa+0l6nr34Co1JupD2eY=";
+    hash = "sha256-gWXBxw0dvaPCB9zCODFx5QM/6duVDuZgjI3l9VCPBtQ=";
  };

-  vendorHash = "sha256-CBAjiUMnyA7yq08Z1fOSOAeSy/8uSCra6l63C8fn6tU=";
+  vendorHash = "sha256-8RHWpJ6cxnaIMeX9aL1144lOFmuKf74EB8cbT1yCXJc=";

  excludedPackages = [ "tools" ];

@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "tinfoil-cli";
-  version = "0.14.0";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "tinfoilsh";
    repo = "tinfoil-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-J/jPKi2R3itM6NbizFVhyaRbjpoKRI1e0BO5n7y9B18=";
+    hash = "sha256-GK+RZWwfsRaQU0x2ror9d7XBV1bq/FaXS6Ugbbr9eeg=";
  };

  vendorHash = "sha256-b6UmayV913SVyV5+1BMZiRM7SV/Asau6xkx87DWTf9k=";
@@ -0,0 +1,12 @@
+diff --git a/3rd_party/bergamot-translator/3rd_party/marian-dev/src/microsoft/quicksand.h b/3rd_party/bergamot-translator/3rd_party/marian-dev/src/microsoft/quicksand.h
+index 87de194..85e85a1 100755
+--- a/3rd_party/bergamot-translator/3rd_party/marian-dev/src/microsoft/quicksand.h
+++ b/3rd_party/bergamot-translator/3rd_party/marian-dev/src/microsoft/quicksand.h
+@@ -5,6 +5,7 @@
+ #include <unordered_set>
+ #include <vector>
+ #include <set>
+#include <cstdint>
+ 
+ namespace marian {
+ 
@@ -33,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {

  patches = [
    ./version_without_git.patch
+    ./gcc15_compat_vnd_marian_missing_include.patch
  ];

  postPatch = ''
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "tsshd";
-  version = "0.1.7";
+  version = "0.1.8";

  src = fetchFromGitHub {
    owner = "trzsz";
    repo = finalAttrs.pname;
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9llfXzAAQgAOeaD+o3AVyhP0uL88uQsCNlqAPNfzDVw=";
+    hash = "sha256-YqSSJA/jP8WRbfwC5fxFE4su01ZEPQNmiNRr96pDE1g=";
  };

-  vendorHash = "sha256-btTWkuLkT2e58TYqe0e/cE/0Try/g8XoahiABSSFaGU=";
+  vendorHash = "sha256-HJWxphZuBh3gXPoEqL/EVGtwdWyW+cMSQhKyfSymKG0=";

  ldflags = [
    "-s"
@@ -0,0 +1,225 @@
+From 53ff47b465808d581087f8ef657378e28e6170d4 Mon Sep 17 00:00:00 2001
+From: OPNA2608 <opna2608@protonmail.com>
+Date: Wed, 13 May 2026 13:30:14 +0200
+Subject: [PATCH] drm/amdgpu: Use inttypes.h format defines for *64_t types
+
+---
+ src/drm/amdgpu/amdgpu_renderer.c | 56 ++++++++++++++++++--------------
+ 1 file changed, 32 insertions(+), 24 deletions(-)
+
+diff --git a/src/drm/amdgpu/amdgpu_renderer.c b/src/drm/amdgpu/amdgpu_renderer.c
+index e7f47c34..80baf960 100644
+--- a/src/drm/amdgpu/amdgpu_renderer.c
+++ b/src/drm/amdgpu/amdgpu_renderer.c
+@@ -259,7 +259,7 @@ amdgpu_renderer_attach_resource(struct virgl_context *vctx, struct virgl_resourc
+          obj->bo = import.buf_handle;
+          amdgpu_bo_export(obj->bo, amdgpu_bo_handle_type_kms, &obj->base.handle);
+          amdgpu_object_set_res_id(ctx, obj, res->res_id);
+-         print(1, "imported dmabuf -> res_id=%u" PRIx64, res->res_id);
+         print(1, "imported dmabuf -> res_id=%u", res->res_id);
+       } else {
+          print(2, "Ignored res_id: %d (fd_type = %d)", res->res_id, fd_type);
+          if (fd_type != VIRGL_RESOURCE_FD_INVALID)
+@@ -411,7 +411,7 @@ amdgpu_renderer_get_blob(struct virgl_context *vctx, uint32_t res_id, uint64_t b
+ 
+    /* If GEM_NEW fails, we can end up here without a backing obj or if it's a dumb buffer. */
+    if (!obj) {
+-      print(0, "No object with blob_id=%ld", blob_id);
+      print(0, "No object with blob_id=%" PRIu64, blob_id);
+       return -ENOENT;
+    }
+ 
+@@ -424,7 +424,7 @@ amdgpu_renderer_get_blob(struct virgl_context *vctx, uint32_t res_id, uint64_t b
+     * to the same storage.
+     */
+    if (obj->exported) {
+-      print(0, "Already exported! blob_id:%ld", blob_id);
+      print(0, "Already exported! blob_id:%" PRIu64, blob_id);
+       return -EINVAL;
+    }
+ 
+@@ -436,7 +436,7 @@ amdgpu_renderer_get_blob(struct virgl_context *vctx, uint32_t res_id, uint64_t b
+       ret = amdgpu_bo_export(obj->bo, amdgpu_bo_handle_type_dma_buf_fd, (uint32_t *)&fd);
+ 
+       if (ret) {
+-         print(0, "Export to fd failed for blob_id:%ld r=%d (%s)", blob_id, ret, strerror(errno));
+         print(0, "Export to fd failed for blob_id:%" PRIu64 " r=%d (%s)", blob_id, ret, strerror(errno));
+          return ret;
+       }
+ 
+@@ -470,7 +470,7 @@ amdgpu_ccmd_query_info(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+    struct amdgpu_ccmd_query_info_rsp *rsp;
+    unsigned rsp_len;
+    if (__builtin_add_overflow(sizeof(*rsp), req->info.return_size, &rsp_len)) {
+-      print(1, "%s: Request size overflow: %zu + %" PRIu32 " > %u",
+      print(1, "%s: Request size overflow: %zu + %u > %u",
+             __FUNCTION__, sizeof(*rsp), req->info.return_size, UINT_MAX);
+       return -EINVAL;
+    }
+@@ -510,12 +510,12 @@ amdgpu_ccmd_gem_new(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+ 
+    if (req->r.__pad) {
+       print(0, "Invalid value for struct %s_req::r::__pad: "
+-            "0x%" PRIx32, __FUNCTION__, req->r.__pad);
+            "0x%x", __FUNCTION__, req->r.__pad);
+       ret = -EINVAL;
+       goto alloc_failed;
+    }
+    if (!drm_context_blob_id_valid(dctx, req->blob_id)) {
+-      print(0, "Invalid blob_id %ld", req->blob_id);
+      print(0, "Invalid blob_id %" PRIu64, req->blob_id);
+       ret = -EINVAL;
+       goto alloc_failed;
+    }
+@@ -553,7 +553,7 @@ amdgpu_ccmd_gem_new(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+ 
+    drm_context_object_set_blob_id(dctx, &obj->base, req->blob_id);
+ 
+-   print(2, "new object blob_id: %ld heap: %08x flags: %lx size: %ld",
+   print(2, "new object blob_id: %" PRIu64 " heap: %08x flags: %" PRIx64" size: %" PRIu64,
+          req->blob_id, req->r.preferred_heap, req->r.flags, req->r.alloc_size);
+ 
+    return 0;
+@@ -562,7 +562,7 @@ va_map_failed:
+    amdgpu_bo_free(bo_handle);
+ 
+ alloc_failed:
+-   print(2, "ERROR blob_id: %ld heap: %08x flags: %lx",
+   print(2, "ERROR blob_id: %" PRIu64 " heap: %08x flags: %" PRIx64,
+          req->blob_id, req->r.preferred_heap, req->r.flags);
+    if (ctx->shmem)
+       ctx->shmem->async_error++;
+@@ -593,7 +593,10 @@ amdgpu_ccmd_bo_va_op(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+    } else {
+       obj = amdgpu_get_object_from_res_id(ctx, req->res_id, __FUNCTION__);
+       if (!obj) {
+-         print(0, "amdgpu_bo_va_op_raw failed: op: %d res_id: %d offset: 0x%lx size: 0x%lx va: %" PRIx64 " r=%d",
+         print(0,
+            "amdgpu_bo_va_op_raw failed: "
+               "op: %d res_id: %d offset: 0x%" PRIx64 " "
+               "size: 0x%" PRIx64 " va: %" PRIx64 " r=%d",
+             req->op, obj->base.res_id, req->offset, req->vm_map_size, req->va, rsp->ret);
+ 
+          /* This is ok. This means the guest closed the GEM already. */
+@@ -609,11 +612,16 @@ amdgpu_ccmd_bo_va_op(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+       if (ctx->shmem)
+          ctx->shmem->async_error++;
+ 
+-      print(0, "amdgpu_bo_va_op_raw failed: op: %d res_id: %d offset: 0x%lx size: 0x%lx va: %" PRIx64 " r=%d",
+      print(0,
+         "amdgpu_bo_va_op_raw failed: "
+            "op: %d res_id: %d offset: 0x%" PRIx64 " "
+            "size: 0x%" PRIx64 " va: %" PRIx64 " r=%d",
+          req->op, req->res_id, req->offset, req->vm_map_size, req->va, rsp->ret);
+    } else {
+-      print(2, "va_op %d res_id: %u va: [0x%" PRIx64 ", 0x%" PRIx64 "] @offset 0x%" PRIx64,
+-            req->op, req->res_id, req->va, req->va + req->vm_map_size - 1, req->offset);
+      print(2,
+         "va_op %d res_id: %u "
+            "va: [0x%" PRIx64 ", 0x%" PRIx64 "] @offset 0x%" PRIx64,
+         req->op, req->res_id, req->va, req->va + req->vm_map_size - 1, req->offset);
+    }
+ 
+    return 0;
+@@ -646,7 +654,7 @@ amdgpu_ccmd_set_metadata(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+    metadata.size_metadata = req->size_metadata;
+    if (req->size_metadata) {
+       if (req->size_metadata > sizeof(metadata.umd_metadata)) {
+-         print(0, "Metadata size is too large for target buffer: %" PRIu32 " > %zu",
+         print(0, "Metadata size is too large for target buffer: %u > %zu",
+                req->size_metadata, sizeof(metadata.umd_metadata));
+          rsp->ret = -EINVAL;
+          return -1;
+@@ -655,7 +663,7 @@ amdgpu_ccmd_set_metadata(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+                                        offsetof(struct amdgpu_ccmd_set_metadata_req,
+                                                 umd_metadata));
+       if (requested_size > hdr->len) {
+-         print(0, "Metadata size is too large for source buffer: %zu > %" PRIu32,
+         print(0, "Metadata size is too large for source buffer: %zu > %u",
+                requested_size, hdr->len);
+          rsp->ret = -EINVAL;
+          return -1;
+@@ -736,7 +744,7 @@ amdgpu_ccmd_create_ctx(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+    }
+ 
+    if (req->flags & ~AMDGPU_CCMD_CREATE_CTX_DESTROY) {
+-      print(0, "Invalid flags 0x%" PRIu32, req->flags);
+      print(0, "Invalid flags 0x%u", req->flags);
+       rsp->hdr.ret = -EINVAL;
+       return -1;
+    }
+@@ -827,7 +835,7 @@ amdgpu_ccmd_cs_submit(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+    }
+    /* Do not allocate arbitrarily large buffer. */
+    if (req->num_chunks > AMDGPU_CCMD_CS_SUBMIT_MAX_NUM_CHUNKS) {
+-      print(1, "%s: Invalid num_chunks: %" PRIu32 " > %d",
+      print(1, "%s: Invalid num_chunks: %u > %d",
+             __FUNCTION__, req->num_chunks, AMDGPU_CCMD_CS_SUBMIT_MAX_NUM_CHUNKS);
+       rsp->ret = -EINVAL;
+       return -1;
+@@ -842,7 +850,7 @@ amdgpu_ccmd_cs_submit(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+    chunks = malloc((req->num_chunks + 1 /* syncobj_in */ + 1 /* syncobj_out */) *
+                    sizeof(*chunks));
+    if (chunks == NULL) {
+-      print(0, "Failed to allocate %" PRIu32 " chunks", req->num_chunks + 2);
+      print(0, "Failed to allocate %u chunks", req->num_chunks + 2);
+       r = -EINVAL;
+       goto end;
+    }
+@@ -858,7 +866,7 @@ amdgpu_ccmd_cs_submit(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+    size_t descriptors_len = size_add(offsetof(struct amdgpu_ccmd_cs_submit_req, payload),
+                                      size_mul(req->num_chunks, sizeof(struct desc)));
+    if (descriptors_len > hdr->len) {
+-      print(0, "Descriptors are out of bounds: %zu + %zu * %" PRIu32 " > %" PRIu32,
+      print(0, "Descriptors are out of bounds: %zu + %zu * %u > %u",
+             offsetof(struct amdgpu_ccmd_cs_submit_req, payload),
+             sizeof(struct desc), req->num_chunks, hdr->len);
+       r = -EINVAL;
+@@ -875,7 +883,7 @@ amdgpu_ccmd_cs_submit(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+       chunks[num_chunks].chunk_id = chunk_id;
+       /* Validate input. */
+       if (end > hdr->len) {
+-         print(0, "Descriptors are out of bounds: %zu > %" PRIu32, end, hdr->len);
+         print(0, "Descriptors are out of bounds: %zu > %u", end, hdr->len);
+          r = -EINVAL;
+          goto end;
+       }
+@@ -936,7 +944,7 @@ amdgpu_ccmd_cs_submit(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+          }
+          in = input;
+          if (in->offset % sizeof(uint64_t)) {
+-            print(0, "Invalid chunk offset %" PRIu32 " (not multiple of 8)", in->offset);
+            print(0, "Invalid chunk offset %u (not multiple of 8)", in->offset);
+             r = -EINVAL;
+             goto end;
+          }
+@@ -1043,7 +1051,7 @@ amdgpu_ccmd_cs_submit(struct drm_context *dctx, struct vdrm_ccmd_req *hdr)
+ 
+    drmSyncobjDestroy(amdgpu_device_get_fd(ctx->dev), syncobj_out.handle);
+ 
+-   print(3, "ctx: %d -> seqno={v=%d a=%ld} r=%d", req->ctx_id, hdr->seqno, seqno, r);
+   print(3, "ctx: %d -> seqno={v=%d a=%" PRIu64 "} r=%d", req->ctx_id, hdr->seqno, seqno, r);
+ 
+ end:
+    if (bo_list)
+@@ -1158,7 +1166,7 @@ amdgpu_renderer_submit_fence(struct virgl_context *vctx, uint32_t flags,
+ 
+    /* timeline is ring_idx-1 (because ring_idx 0 is host CPU timeline) */
+    if (ring_idx > AMDGPU_HW_IP_NUM) {
+-      print(0, "invalid ring_idx: %" PRIu32, ring_idx);
+      print(0, "invalid ring_idx: %u", ring_idx);
+       return -EINVAL;
+    }
+    /* ring_idx zero is used for the guest to synchronize with host CPU,
+@@ -1170,7 +1178,7 @@ amdgpu_renderer_submit_fence(struct virgl_context *vctx, uint32_t flags,
+       return 0;
+    }
+ 
+-   print(3, "ring_idx: %d fence_id: %lu", ring_idx, fence_id);
+   print(3, "ring_idx: %d fence_id: %" PRIu64, ring_idx, fence_id);
+    return drm_timeline_submit_fence(&ctx->timelines[ring_idx - 1], flags, fence_id);
+ }
+ 
+-- 
+2.51.2
+
@@ -32,6 +32,11 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-2RoKIjtxShJCaezbkCrtW+lSaWKnOoUZzpSEPCJHSC8=";
  };

+  patches = [
+    # https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/1624
+    ./1001-virglrenderer-amdgpu-Use-inttypes-format-defines.patch
+  ];
+
  separateDebugInfo = true;

  nativeBuildInputs = [
@@ -65,11 +70,17 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.mesonBool "venus" vulkanSupport)
    (lib.mesonOption "drm-renderers" (
      lib.optionalString nativeContextSupport (
-        lib.concatStringsSep "," [
-          "amdgpu-experimental"
-          "asahi"
-          "msm"
-        ]
+        lib.concatStringsSep "," (
+          [
+            "amdgpu-experimental"
+            "asahi"
+          ]
+          # "MSM renderer doesn't support 32bit ARM target"
+          # https://gitlab.freedesktop.org/virgl/virglrenderer/-/blob/ea7db39433c40e9799f2dfdbf63e0b4754a0dd3d/meson.build#L338-340
+          ++ lib.optionals (!stdenv.hostPlatform.isAarch32) [
+            "msm"
+          ]
+        )
      )
    ))
  ];
@@ -1,61 +1,165 @@
 {
  lib,
-  rustPlatform,
+  stdenv,
  fetchFromGitHub,
-  llvmPackages_18,
+  fetchurl,
+  rustPlatform,
+  cargo,
+  rustc,
+  nix-update,
+  curl,
+  writeShellApplication,
+  llvmPackages_21,
  libffi,
  libxml2,
-  withLLVM ? true,
-  withSinglepass ? true,
+  fixDarwinDylibNames,
+  withLLVM ?
+    stdenv.hostPlatform.isLinux || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64),
+  withV8 ? (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64),
 }:

-rustPlatform.buildRustPackage (finalAttrs: {
+let
+  v8Version = "11.9.2";
+
+  # Prebuilt V8 from wasmerio's custom builds, only evaluated when withV8 = true.
+
+  # Per-platform hashes, auto-updated via the general updateScript
+  v8Hashes = {
+    "v8-linux-amd64.tar.xz" = "sha256-nTCVdBKtyVMb7lE+Db4RDsShKkLbG/0r980ejd+EAvo=";
+    "v8-linux-musl-amd64.tar.xz" = "sha256-XgRs3I46B2PG7Jrv5E+KSeuNfXLhgB7R66cAkA/Bvv8=";
+    "v8-darwin-arm64.tar.xz" = "sha256-xAG1PcAGw8a0A9k8d78/whTUXnqdfRZBz8yrg/+iz0M=";
+  };
+
+  v8Prebuilt =
+    let
+      assetName =
+        if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 && stdenv.hostPlatform.isMusl then
+          "v8-linux-musl-amd64.tar.xz"
+        else if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 then
+          "v8-linux-amd64.tar.xz"
+        else if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 then
+          "v8-darwin-arm64.tar.xz"
+        else
+          throw "withV8 = true is not supported on ${stdenv.hostPlatform.system}";
+    in
+    stdenv.mkDerivation {
+      name = "wasmer-v8-prebuilt-${v8Version}";
+      src = fetchurl {
+        url = "https://github.com/wasmerio/v8-custom-builds/releases/download/${v8Version}/${assetName}";
+        hash = v8Hashes.${assetName};
+      };
+      sourceRoot = ".";
+      dontBuild = true;
+      installPhase = ''
+        cp -r . $out
+      '';
+
+      meta.sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    };
+in
+
+stdenv.mkDerivation (finalAttrs: {
  pname = "wasmer";
-  version = "5.0.4";
+  version = "7.1.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitHub {
    owner = "wasmerio";
    repo = "wasmer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rP0qvSb9PxsTMAq0hpB+zdSTHvridyCVdukLUYxdao8=";
+    hash = "sha256-A1SkZY+iSR9xlu6R1p9uZYsGFPAOifuYTHtEXaEgves=";
+    fetchSubmodules = true;
  };

-  cargoHash = "sha256-Fympp2A04viibo4U79FiBSJIeGDUWS34OOwebCks6S0=";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-wBEwGKjj9DdZESFlXS8T7B0Xdp7yMe08DYTGr4wnTVI=";
+  };

  nativeBuildInputs = [
+    cargo
+    rustc
+    rustPlatform.cargoSetupHook
    rustPlatform.bindgenHook
-  ];
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;

  buildInputs = lib.optionals withLLVM [
-    llvmPackages_18.llvm
+    llvmPackages_21.llvm
    libffi
    libxml2
  ];

-  # check references to `compiler_features` in Makefile on update
-  buildFeatures = [
-    "cranelift"
-    "wasmer-artifact-create"
-    "static-artifact-create"
-    "wasmer-artifact-load"
-    "static-artifact-load"
-  ]
-  ++ lib.optional withLLVM "llvm"
-  ++ lib.optional withSinglepass "singlepass";
+  postPatch =
+    # In 7.1.0 there is no nice flag to toggle napi/v8 on or off,
+    # so we manually delete the Makefile entry when we don't want v8
+    # TODO: v7.2.0 pre-release has a flag, when updating to 7.2.0
+    #  add "ENABLE_NAPI_V8=${if withV8 then "1" else "0"}" to makeFlags
+    lib.optionalString (!withV8) ''
+      substituteInPlace Makefile \
+        --replace-fail '	build_wasmer_extra_features += napi-v8' ""
+    ''
+    +
+      lib.optionalString stdenv.hostPlatform.isDarwin
+        # `install -Dm644 /dev/stdin DEST` fails on darwin with
+        # "skipping file '/dev/stdin', as it was replaced while being copied".
+        (
+          ''
+            substituteInPlace Makefile \
+              --replace-fail 'echo "$$pc" | install -Dm644 /dev/stdin "$(DESTDIR)"/lib/pkgconfig/wasmer.pc;' \
+                             'mkdir -p "$(DESTDIR)/lib/pkgconfig" && printf "%s\n" "$$pc" > "$(DESTDIR)/lib/pkgconfig/wasmer.pc";'
+          ''
+          # install-capi-lib hardcodes libwasmer.so and a Linux SONAME symlink chain
+          # (also marked Linux only in the Makefile)
+          + ''
+            substituteInPlace Makefile \
+              --replace-fail 'install-capi-lib ' ""
+          ''
+        );

-  cargoBuildFlags = [
-    "--manifest-path"
-    "lib/cli/Cargo.toml"
-    "--bin"
-    "wasmer"
+  makeFlags = [
+    "WASMER_INSTALL_PREFIX=${placeholder "out"}"
+    "DESTDIR=${placeholder "out"}"
+    "ENABLE_LLVM=${if withLLVM then "1" else "0"}"
  ];

-  env.LLVM_SYS_180_PREFIX = lib.optionalString withLLVM llvmPackages_18.llvm.dev;
+  # Default all target includes headless C API which doesn't get installed
+  # by their Makefile and is quite niche to include, so we opt out
+  buildFlags = [
+    "build-wasmer"
+    "build-capi"
+  ];
+
+  env =
+    lib.optionalAttrs withLLVM {
+      LLVM_SYS_211_PREFIX = llvmPackages_21.llvm.dev;
+    }
+    // lib.optionalAttrs withV8 {
+      # build.rs skips the download when these are set; see resolve_explicit_v8 in lib/napi/build.rs
+      NAPI_V8_INCLUDE_DIR = "${v8Prebuilt}/include";
+      V8_LIB_DIR = "${v8Prebuilt}/lib";
+    };
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    install -Dm755 target/release/libwasmer.dylib $out/lib/libwasmer.dylib
+  '';
+
+  passthru.updateScript = lib.getExe (writeShellApplication {
+    name = "update-wasmer";
+    runtimeInputs = [
+      nix-update
+      curl
+    ];
+    text = builtins.readFile ./update.sh;
+  });

  # Tests are failing due to `Cannot allocate memory` and other reasons
  doCheck = false;

  meta = {
+    sourceProvenance = with lib.sourceTypes; [ fromSource ] ++ lib.optional withV8 binaryNativeCode;
    description = "Universal WebAssembly Runtime";
    mainProgram = "wasmer";
    longDescription = ''
@@ -0,0 +1,49 @@
+old_version=$(grep -oP '^  version = "\K[^"]+(?=";)' pkgs/by-name/wa/wasmer/package.nix)
+echo "Current wasmer version: $old_version"
+
+nix-update wasmer "$@"
+
+new_version=$(grep -oP '^  version = "\K[^"]+(?=";)' pkgs/by-name/wa/wasmer/package.nix)
+if [ "$old_version" = "$new_version" ]; then
+  echo "Already at $old_version, nothing to do"
+  exit 0
+fi
+echo "Updated wasmer $old_version -> $new_version"
+
+# v8Version is pinned in package.nix to match PREBUILT_V8_VERSION in lib/napi/build.rs.
+# lib/napi is a submodule, so resolve its pinned SHA first, then fetch build.rs from that repo.
+echo "Fetching PREBUILT_V8_VERSION from lib/napi/build.rs..."
+napi_sha=$(curl -fsSL "https://api.github.com/repos/wasmerio/wasmer/contents/lib/napi?ref=v${new_version}" \
+           | grep -oP '"sha":\s*"\K[^"]+' | head -1)
+new_v8=$(curl -fsSL "https://raw.githubusercontent.com/wasmerio/napi/${napi_sha}/build.rs" \
+         | grep -oP 'PREBUILT_V8_VERSION\s*:\s*&str\s*=\s*"\K[^"]+')
+cur_v8=$(grep -oP '^  v8Version = "\K[^"]+(?=";)' pkgs/by-name/wa/wasmer/package.nix)
+echo "V8: current=$cur_v8, required=$new_v8"
+
+if [ "$new_v8" = "$cur_v8" ]; then
+  echo "V8 version unchanged, done"
+  exit 0
+fi
+
+echo "V8 bumped $cur_v8 -> $new_v8, fetching hashes for all platforms..."
+sed -i "s|^  v8Version = \"[^\"]*\";$|  v8Version = \"$new_v8\";|" \
+  pkgs/by-name/wa/wasmer/package.nix
+
+base="https://github.com/wasmerio/v8-custom-builds/releases/download/$new_v8"
+declare -A assets=(
+  ["v8-linux-amd64.tar.xz"]="$base/v8-linux-amd64.tar.xz"
+  ["v8-linux-musl-amd64.tar.xz"]="$base/v8-linux-musl-amd64.tar.xz"
+  ["v8-darwin-arm64.tar.xz"]="$base/v8-darwin-arm64.tar.xz"
+)
+
+for asset in "${!assets[@]}"; do
+  url="${assets[$asset]}"
+  echo "  Fetching hash for $asset..."
+  hash=$(nix-prefetch-url --type sha256 "$url" 2>/dev/null \
+         | xargs nix hash convert --hash-algo sha256 --to sri)
+  echo "  $asset -> $hash"
+  sed -i "s|\"$asset\" = \"[^\"]*\"|\"$asset\" = \"$hash\"|" \
+    pkgs/by-name/wa/wasmer/package.nix
+done
+
+echo "Done"
@@ -1,7 +1,7 @@
 import ./generic-builder.nix {
-  version = "1.20.0-rc.4";
-  hash = "sha256-sboB+GW3T+t9gEcOGtd6NllmIlyWio1+cgWyyxE+484=";
-  # https://hexdocs.pm/elixir/1.20.0-rc.4/compatibility-and-deprecations.html#between-elixir-and-erlang-otp
+  version = "1.20.0-rc.5";
+  hash = "sha256-D1lYpwD/nb9GyCSW4W9mVliqULb7Hs641OdtwPDfsME=";
+  # https://hexdocs.pm/elixir/1.20.0-rc.5/compatibility-and-deprecations.html#between-elixir-and-erlang-otp
  minimumOTPVersion = "27";
  maximumOTPVersion = "29";
 }
@@ -21,7 +21,6 @@
  ocaml_intrinsics ? null,
  prelude,
  ppx_enumerate,
-  rresult,
  scfg,
  yojson,
  z3,
@@ -32,13 +31,13 @@

 buildDunePackage (finalAttrs: {
  pname = "smtml";
-  version = "0.26.0";
+  version = "0.27.0";

  src = fetchFromGitHub {
    owner = "formalsec";
    repo = "smtml";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-7kshzfxWpOx2LyGOs/j/eaTB4b4ba4sp5n4yztGfFV4=";
+    hash = "sha256-YyzrPs6ykpUzHHZ63y3c82LG9lv0Pf4i01w5GWadumU=";
  };

  minimalOCamlVersion = "4.14";
@@ -68,7 +67,6 @@ buildDunePackage (finalAttrs: {
    ocaml_intrinsics
    ppx_enumerate
    prelude
-    rresult
    scfg
    yojson
    z3
@@ -28,14 +28,14 @@

 buildPythonPackage rec {
  pname = "aiogram";
-  version = "3.28.0";
+  version = "3.28.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aiogram";
    repo = "aiogram";
    tag = "v${version}";
-    hash = "sha256-jy0OOeDiDh2ff3wIR6mYc8P8dOIgVeK0WVQYeug4yEI=";
+    hash = "sha256-Xf8uE0W/YNCrXoPuxOTixsWdqH5k3dJZDh5AdSNHTFw=";
  };

  build-system = [ hatchling ];
@@ -7,16 +7,16 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "avea";
-  version = "1.6.1";
+  version = "1.7.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "k0rventen";
    repo = "avea";
-    tag = "v${version}";
-    hash = "sha256-IfD74nsuHYBrwXebpRE9tzPIwp+i3jdZjh49gz8NRz4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cBYS8Q70K5MXZ63uI6OGkUsskJ7rkgTBPjlAsxmtmVA=";
  };

  build-system = [ setuptools ];
@@ -34,8 +34,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python module for interacting with Elgato's Avea bulb";
    homepage = "https://github.com/k0rventen/avea";
-    changelog = "https://github.com/k0rventen/avea/releases/tag/${src.tag}";
+    changelog = "https://github.com/k0rventen/avea/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
@@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "biocframe";
-  version = "0.7.2";
+  version = "0.7.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "BiocPy";
    repo = "BiocFrame";
    tag = version;
-    hash = "sha256-2O4YINYo9ehiBuZSHZmBmNIwud7GkNzAMWEv2/7oSs8=";
+    hash = "sha256-NycHzlOdDRyXvpZLWDr7mg5eXxrBjsSk16AUHpQrDN0=";
  };

  build-system = [
@@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.43.7";
+  version = "1.43.9";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-fjPMhCzR6fa8zIjtU7HcyT9VIW9pupu6yQ0GLIcLdS8=";
+    hash = "sha256-r7neBhqlZnyjJHxHBX/Hkr8DtMSD2hZZaXwyMX4dLvo=";
  };

  build-system = [ setuptools ];
@@ -5,21 +5,24 @@
  pymeeus,
  pytz,
  pytestCheckHook,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "convertdate";
-  version = "2.4.0";
-  format = "setuptools";
+  version = "2.4.1";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "fitnr";
    repo = "convertdate";
-    rev = "v${version}";
-    hash = "sha256-iOHK3UJulXJJR50nhiVgfk3bt+CAtG3BRySJ8DkBuJE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YgLKUSg95j9rRejkmep+Levy5Rvnl/kXEiXuS7hazbY=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    pymeeus
    pytz
  ];
@@ -30,9 +33,10 @@ buildPythonPackage rec {

  meta = {
    description = "Utils for converting between date formats and calculating holidays";
-    mainProgram = "censusgeocode";
    homepage = "https://github.com/fitnr/convertdate";
+    changelog = "https://github.com/fitnr/convertdate/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ jluttine ];
+    mainProgram = "censusgeocode";
  };
-}
+})
@@ -21,14 +21,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "faraday-plugins";
-  version = "1.27.2";
+  version = "1.28.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "infobyte";
    repo = "faraday_plugins";
    tag = finalAttrs.version;
-    hash = "sha256-GcHZQJCpEnuHfnyynULFla/ou7BCl64JAmi6eFYr1tk=";
+    hash = "sha256-NSJBxOD6zgDcKopU7ko6zGiN7AhIXWGQaetCkydhRwo=";
  };

  postPatch = ''
@@ -13,14 +13,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "genai-prices";
-  version = "0.0.59";
+  version = "0.0.60";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "genai-prices";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ANYl6wxjAZYnzvKhMsmC2eyg33ngF8DaYd67KCBGHLg=";
+    hash = "sha256-txcaBPxIUssTlnDNhe2f9Jlr5LaZT1zIcJslMK3Bayk=";
  };

  sourceRoot = "${finalAttrs.src.name}/packages/python";
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202605171";
+  version = "0.1.202605181";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GOo1K3nDzF3S3sUp6kvzYWdoAoO94ttKOtNLiPliMY4=";
+    hash = "sha256-eNPjwnr75qXbY+Ctgz4UsJ1Vn/6WMtSq/PjYobFVDM0=";
  };

  __darwinAllowLocalNetworking = true;
@@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "jianpu-ly";
-  version = "1.866";
+  version = "1.868";
  pyproject = true;

  src = fetchPypi {
    inherit version;
    pname = "jianpu_ly";
-    hash = "sha256-nLVLRot4ECZyQ+G6o3mc4fVN9uGP/ZX2RATwaA6pGBI=";
+    hash = "sha256-Jm3r3c4o/rMdwiPlaIe33JEyb0S4yIr9kupxZal06eU=";
  };

  dependencies = [ lilypond ];
@@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "mkdocs-git-revision-date-localized-plugin";
-  version = "1.5.1";
+  version = "1.5.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "timvink";
    repo = "mkdocs-git-revision-date-localized-plugin";
    tag = "v${version}";
-    hash = "sha256-y4hPiK9M0fcbZd30JCujdFpiYKEbsjXrlH8l4LEMtuY=";
+    hash = "sha256-h27LzLgOsobRuvieQsVwZSQkagJR3Vy5kUw/HqJ9BHE=";
  };

  build-system = [
@@ -0,0 +1,73 @@
+{
+  buildPythonPackage,
+  mlflow,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  cachetools,
+  click,
+  cloudpickle,
+  databricks-sdk,
+  fastapi,
+  gitpython,
+  importlib-metadata,
+  opentelemetry-api,
+  opentelemetry-proto,
+  opentelemetry-sdk,
+  packaging,
+  protobuf,
+  pydantic,
+  python-dotenv,
+  pyyaml,
+  requests,
+  sqlparse,
+  starlette,
+  typing-extensions,
+  uvicorn,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "mlflow-skinny";
+  inherit (mlflow) version src;
+  pyproject = true;
+  __structuredAttrs = true;
+
+  sourceRoot = "${finalAttrs.src.name}/libs/skinny";
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    cachetools
+    click
+    cloudpickle
+    databricks-sdk
+    fastapi
+    gitpython
+    importlib-metadata
+    opentelemetry-api
+    opentelemetry-proto
+    opentelemetry-sdk
+    packaging
+    protobuf
+    pydantic
+    python-dotenv
+    pyyaml
+    requests
+    sqlparse
+    starlette
+    typing-extensions
+    uvicorn
+  ];
+
+  pythonImportsCheck = [ "mlflow" ];
+
+  # No tests in the skinny subtree.
+  doCheck = false;
+
+  meta = mlflow.meta // {
+    description = "Lightweight version of MLflow that is designed to minimize package size";
+    homepage = "https://github.com/mlflow/mlflow/tree/master/libs/skinny";
+  };
+})
@@ -0,0 +1,58 @@
+{
+  lib,
+  buildPythonPackage,
+  mlflow,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  cachetools,
+  databricks-sdk,
+  opentelemetry-api,
+  opentelemetry-proto,
+  opentelemetry-sdk,
+  packaging,
+  protobuf,
+  pydantic,
+
+  # tests
+  pytestCheckHook,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "mlflow-tracing";
+  inherit (mlflow) version;
+  pyproject = true;
+  __structuredAttrs = true;
+
+  inherit (mlflow) src;
+
+  sourceRoot = "${finalAttrs.src.name}/libs/tracing";
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    cachetools
+    databricks-sdk
+    opentelemetry-api
+    opentelemetry-proto
+    opentelemetry-sdk
+    packaging
+    protobuf
+    pydantic
+  ];
+
+  pythonImportsCheck = [ "mlflow.tracing" ];
+
+  # No tests
+  doCheck = false;
+
+  meta = {
+    description = "Open-Source SDK for observability and monitoring GenAI applications";
+    homepage = "https://github.com/mlflow/mlflow/tree/master/libs/tracing";
+    inherit (mlflow.meta) license;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
@@ -9,195 +9,68 @@
  # dependencies
  aiohttp,
  alembic,
-  cachetools,
-  click,
-  cloudpickle,
  cryptography,
-  databricks-sdk,
  docker,
-  fastapi,
  flask,
  flask-cors,
-  gitpython,
  graphene,
  gunicorn,
  huey,
-  importlib-metadata,
-  jinja2,
-  markdown,
  matplotlib,
+  mlflow-skinny,
+  mlflow-tracing,
  numpy,
-  opentelemetry-api,
-  opentelemetry-proto,
-  opentelemetry-sdk,
-  packaging,
  pandas,
-  protobuf,
  pyarrow,
-  python-dotenv,
-  pyyaml,
-  requests,
  scikit-learn,
  scipy,
  skops,
  sqlalchemy,
-  sqlparse,
-  uvicorn,
-
-  # tests
-  azure-core,
-  azure-storage-blob,
-  azure-storage-file,
-  boto3,
-  botocore,
-  catboost,
-  datasets,
-  google-cloud-storage,
-  httpx,
-  jwt,
-  keras,
-  langchain,
-  librosa,
-  moto,
-  opentelemetry-exporter-otlp,
-  optuna,
-  pydantic,
-  pyspark,
-  pytestCheckHook,
-  pytorch-lightning,
-  sentence-transformers,
-  shap,
-  starlette,
-  statsmodels,
-  tensorflow,
-  torch,
-  transformers,
-  xgboost,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "mlflow";
-  version = "3.11.1";
+  version = "3.12.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mlflow";
    repo = "mlflow";
-    tag = "v${version}";
-    hash = "sha256-Oe6nBnnOz7MvGUNCcCGhHl6ZbyDfAhQ0LlfMBF4p6Hc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-OxhM+KCem0sb9cwtyzrUD/MGfoiiCfgU47qipYRDaFk=";
  };

-  pythonRelaxDeps = [
-    "cryptography"
-    "gunicorn"
-    "importlib_metadata"
-    "packaging"
-    "protobuf"
-    "pytz"
-    "pyarrow"
-  ];
+  # ppyproject.release.toml is the one shipped in the Pypi package, so we use it too.
+  postPatch = ''
+    mv pyproject.release.toml pyproject.toml
+  '';

  build-system = [ setuptools ];

  dependencies = [
    aiohttp
    alembic
-    cachetools
-    click
-    cloudpickle
    cryptography
-    databricks-sdk
    docker
-    fastapi
    flask
    flask-cors
-    gitpython
    graphene
    gunicorn
    huey
-    importlib-metadata
-    jinja2
-    markdown
    matplotlib
+    mlflow-skinny
+    mlflow-tracing
    numpy
-    opentelemetry-api
-    opentelemetry-proto
-    opentelemetry-sdk
-    packaging
    pandas
-    protobuf
    pyarrow
-    pydantic
-    python-dotenv
-    pyyaml
-    requests
    scikit-learn
    scipy
-    shap
    skops
    sqlalchemy
-    sqlparse
-    uvicorn
  ];

  pythonImportsCheck = [ "mlflow" ];

-  nativeCheckInputs = [
-    aiohttp
-    azure-core
-    azure-storage-blob
-    azure-storage-file
-    boto3
-    botocore
-    catboost
-    datasets
-    google-cloud-storage
-    httpx
-    jwt
-    keras
-    langchain
-    librosa
-    moto
-    opentelemetry-exporter-otlp
-    optuna
-    pydantic
-    pyspark
-    pytestCheckHook
-    pytorch-lightning
-    sentence-transformers
-    starlette
-    statsmodels
-    tensorflow
-    torch
-    transformers
-    uvicorn
-    xgboost
-  ];
-
-  disabledTestPaths = [
-    # Requires unpackaged `autogen`
-    "tests/autogen/test_autogen_autolog.py"
-
-    # Requires unpackaged `diviner`
-    "tests/diviner/test_diviner_model_export.py"
-
-    # Requires unpackaged `sktime`
-    "examples/sktime/test_sktime_model_export.py"
-
-    # Requires `fastai` which would cause a circular dependency
-    "tests/fastai/test_fastai_autolog.py"
-    "tests/fastai/test_fastai_model_export.py"
-
-    # Requires `spacy` which would cause a circular dependency
-    "tests/spacy/test_spacy_model_export.py"
-
-    # Requires `tensorflow.keras` which is not included in our outdated version of `tensorflow` (2.13.0)
-    "tests/gateway/providers/test_ai21labs.py"
-    "tests/tensorflow/test_keras_model_export.py"
-    "tests/tensorflow/test_keras_pyfunc_model_works_with_all_input_types.py"
-    "tests/tensorflow/test_mlflow_callback.py"
-  ];
-
  # I (@GaetanLepage) gave up at enabling tests:
  # - They require a lot of dependencies (some unpackaged);
  # - Many errors occur at collection time;
@@ -208,8 +81,10 @@ buildPythonPackage rec {
    description = "Open source platform for the machine learning lifecycle";
    mainProgram = "mlflow";
    homepage = "https://github.com/mlflow/mlflow";
-    changelog = "https://github.com/mlflow/mlflow/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/mlflow/mlflow/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.asl20;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+    ];
  };
-}
+})
@@ -227,8 +227,8 @@ in
      "sha256-W+hFvD3Buc29i2sHH618QtAiHUCHrAzHxbndIZsyRgY=";

  mypy-boto3-cloudfront =
-    buildMypyBoto3Package "cloudfront" "1.43.4"
-      "sha256-jAr6JmEYShdpmkDPZWOWazrCd15ZYMTdwbHoWbCYrTM=";
+    buildMypyBoto3Package "cloudfront" "1.43.8"
+      "sha256-5aJzk0WW/xf3JLiFuyJwSqAmnt7s1zExJ/YjxXWtyKM=";

  mypy-boto3-cloudhsm =
    buildMypyBoto3Package "cloudhsm" "1.43.0"
@@ -411,8 +411,8 @@ in
      "sha256-jkgV+/T/mGbAFQh46ZYBLTM66Rtd762XUUsbcFciJkk=";

  mypy-boto3-dms =
-    buildMypyBoto3Package "dms" "1.43.0"
-      "sha256-SDTUIwYwaIa8GTCU4P6x0gjZcjVtv+fY39ahC6rnYDQ=";
+    buildMypyBoto3Package "dms" "1.43.8"
+      "sha256-JsAuf1JbvbWQfiUT0Y0kQlS9/zzLuF2BeikZ5tMtUu4=";

  mypy-boto3-docdb =
    buildMypyBoto3Package "docdb" "1.43.0"
@@ -571,11 +571,11 @@ in
      "sha256-vMz4YKm78XMavlPUNiSVAYmAbyUBrJhUXbFrhxIvUJA=";

  mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.43.7"
-      "sha256-PD/CGMq+yciwF8aqvkllDICUaKt1oeHtlP8CteGfYlk=";
+    buildMypyBoto3Package "glue" "1.43.8"
+      "sha256-CJJviequ3qlGqjvK0p4Z1/MPG0XK6k7LM0CkOfh4LCc=";
  mypy-boto3-grafana =
-    buildMypyBoto3Package "grafana" "1.43.0"
-      "sha256-ciXs8g462XTc+GTyxuGDDEsoR9DMD+bOdSUFe0OLshM=";
+    buildMypyBoto3Package "grafana" "1.43.8"
+      "sha256-qjSN2N+pZSw4PXSziognGUE4U7W+4BIr/qcmcu6+M9o=";

  mypy-boto3-greengrass =
    buildMypyBoto3Package "greengrass" "1.43.0"
@@ -806,8 +806,8 @@ in
      "sha256-EunrKwNaYp0CDiwp8frI7zASilMF4wYHjDSuCsJ6aJM=";

  mypy-boto3-logs =
-    buildMypyBoto3Package "logs" "1.43.3"
-      "sha256-nHSEpvhI5+XDRqLqhWY8JNKCrnh5d0gyEReyYtbqhFw=";
+    buildMypyBoto3Package "logs" "1.43.9"
+      "sha256-z/0+HjEaoSPjLVQRXBjOShaU7xbj6ztQKdLFEqF/PXc=";

  mypy-boto3-lookoutequipment =
    buildMypyBoto3Package "lookoutequipment" "1.43.0"
@@ -874,8 +874,8 @@ in
      "sha256-5AqWiNGz9jemWb8dZkuGQXxPXIruMdDWcoRzbT+ZGro=";

  mypy-boto3-mediapackagev2 =
-    buildMypyBoto3Package "mediapackagev2" "1.43.0"
-      "sha256-bGxwx1LeiPWn6gz4Yqu6pIQ7sMgCro5W4oO/Wk72gok=";
+    buildMypyBoto3Package "mediapackagev2" "1.43.9"
+      "sha256-1SSjLgLoGB2C7nqpAJty+BX94cwIcwoBGk03lMOgMBg=";

  mypy-boto3-mediastore =
    buildMypyBoto3Package "mediastore" "1.43.0"
@@ -906,8 +906,8 @@ in
      "sha256-V6xgiUn87wqIlWJGOpc7Zu24EDzROAspAn3qkRifsFU=";

  mypy-boto3-mgn =
-    buildMypyBoto3Package "mgn" "1.43.0"
-      "sha256-YpSyhr87CmLo2+LGQzXU8q9uZt5YiDm23Ukpdh8eZIg=";
+    buildMypyBoto3Package "mgn" "1.43.8"
+      "sha256-qLvs7F/FPOLHsVnzvAGLqKRedZmdx6OWJNkP7QSLE7Q=";

  mypy-boto3-migration-hub-refactor-spaces =
    buildMypyBoto3Package "migration-hub-refactor-spaces" "1.43.0"
@@ -31,7 +31,6 @@
  mock,
  optax,
  portpicker,
-  pytest-xdist,
  pytestCheckHook,
  safetensors,
  torch,
@@ -39,14 +38,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "orbax-checkpoint";
-  version = "0.11.33";
+  version = "0.11.39";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "google";
    repo = "orbax";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ibHV+MwQvlh2USeDVAUWEJxCS1MGuPZRnZZTBWFO7UQ=";
+    hash = "sha256-KrehggcpKqMd51SdEo3uzYyvH8M15tmECHzvGLBhD/4=";
  };

  sourceRoot = "${finalAttrs.src.name}/checkpoint";
@@ -80,15 +80,10 @@ buildPythonPackage (finalAttrs: {
    mock
    optax
    portpicker
-    pytest-xdist
    pytestCheckHook
    safetensors
    torch
  ];
-  pythonImportsCheck = [
-    "orbax"
-    "orbax.checkpoint"
-  ];

  disabledTests = [
    # Flaky
@@ -107,6 +102,14 @@ buildPythonPackage (finalAttrs: {
    # AssertionError: False is not true
    "test_register_and_get"
    "test_register_different_modules"
+
+    # IndexError: list index out of range
+    "test_named_sharding"
+
+    # ValueError: cannot reshape array of size 1 into shape (0,2)
+    "test_get_leaf_memory_per_device"
+    "test_number_of_broadcasts"
+    "test_tree_memory_per_device"
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    # Probably failing because of a filesystem impurity
@@ -131,8 +134,14 @@ buildPythonPackage (finalAttrs: {
    # Description from first occurrence: Number of processes to use.
    # https://github.com/google/orbax/issues/1580
    "orbax/checkpoint/_src/testing/multiprocess_test.py"
+    "orbax/checkpoint/_src/testing/oss/multiprocess_test.py"
    "orbax/checkpoint/experimental/emergency/"

+    # ImportError: cannot import name 'tiering_service_pb2' from
+    # 'orbax.checkpoint.experimental.tiering_service.proto'
+    # (the protobuf module is not generated from the .proto file)
+    "orbax/checkpoint/experimental/tiering_service/server_test.py"
+
    # ValueError: Distributed system is not available; please initialize it via `jax.distributed.initialize()` at the start of your program.
    "orbax/checkpoint/_src/handlers/array_checkpoint_handler_test.py"

@@ -148,6 +157,9 @@ buildPythonPackage (finalAttrs: {
    # '/build/absl_testing/DefaultSnapshotTest/runTest/root/path/to/source/data.txt'
    "orbax/checkpoint/_src/path/snapshot/snapshot_test.py"

+    # Expects to run on 8 devices
+    "orbax/checkpoint/_src/multihost/multihost_test.py"
+
    # Circular dependency flax
    "orbax/checkpoint/_src/handlers/pytree_checkpoint_handler_test.py"
    "orbax/checkpoint/_src/metadata/empty_values_test.py"
@@ -160,6 +172,12 @@ buildPythonPackage (finalAttrs: {
    "orbax/checkpoint/checkpoint_manager_test.py"
    "orbax/checkpoint/single_host_test.py"
    "orbax/checkpoint/transform_utils_test.py"
+    "orbax/checkpoint/_src/handlers/standard_checkpoint_handler_test.py"
+  ];
+
+  pythonImportsCheck = [
+    "orbax"
+    "orbax.checkpoint"
  ];

  meta = {
@@ -11,6 +11,8 @@
  pytest-cov-stub,
  pytest-timeout,
  pytestCheckHook,
+  pythonAtLeast,
+  pythonOlder,
  pyzmq,
  setproctitle,
  setuptools,
@@ -38,11 +40,14 @@ buildPythonPackage rec {
  ];

  optional-dependencies = {
-    influxdb = [ influxdb-client ];
    kubernetes = [ kubernetes ];
    mongodb = [ pymongo ];
    # opentsdb = [ opentsdb-py ];
    prometheus = [ prometheus-client ];
+  }
+  // lib.optionalAttrs (pythonOlder "3.14") {
+    # influxdb-client depends on reactivex, which is disabled on 3.14
+    influxdb = [ influxdb-client ];
  };

  nativeCheckInputs = [
@@ -55,7 +60,8 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "powerapi" ];

-  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+  # multiprocessing pickling fails: darwin sandbox + py3.14 weakref change
+  disabledTests = lib.optionals (stdenv.hostPlatform.isDarwin || pythonAtLeast "3.14") [
    "test_puller"
    "TestDispatcher"
    "TestK8sProcessor"
@@ -20,14 +20,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydantic-ai-slim";
-  version = "1.95.1";
+  version = "1.97.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "pydantic-ai";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JE5ufIfwEVtJ9OOdPnuQPiOOvmo63l6D7IsNIats39c=";
+    hash = "sha256-L18K1g77PeHlc7BdWalrMPOaBmdRErIXogiLcW57lq8=";
  };

  sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
@@ -16,14 +16,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydantic-graph";
-  version = "1.95.1";
+  version = "1.97.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pydantic";
    repo = "pydantic-ai";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JE5ufIfwEVtJ9OOdPnuQPiOOvmo63l6D7IsNIats39c=";
+    hash = "sha256-L18K1g77PeHlc7BdWalrMPOaBmdRErIXogiLcW57lq8=";
  };

  sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
@@ -9,12 +9,12 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyexploitdb";
-  version = "0.3.26";
+  version = "0.3.27";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-EkLew8BpNK7OzlLd3BOvFKtG8OTVLuUUNxOKM+W0WFA=";
+    hash = "sha256-B4xd+wXaZC3gl+uyGlM+y3bahU20ny8v34USCkJJhlQ=";
  };

  build-system = [ setuptools ];
@@ -17,12 +17,12 @@

 buildPythonPackage rec {
  pname = "pyfxa";
-  version = "0.8.1";
+  version = "0.8.2";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-3zxXWzFOjWcnX8hAQpRzGlzTmnXjZjn9jF+MdsHuGkw=";
+    hash = "sha256-gq/OfpKjw6BSbGKTXbRa2crxleJJoj0BN4Ful1npWlw=";
  };

  build-system = [ hatchling ];
@@ -9,19 +9,19 @@

 buildPythonPackage rec {
  pname = "python-bidi";
-  version = "0.6.9";
+  version = "0.6.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "MeirKriheli";
    repo = "python-bidi";
    tag = "v${version}";
-    hash = "sha256-fnKaKQz0qMHIXQj6tH8WcoxDk+TASl77VM/0BFEoKag=";
+    hash = "sha256-IFLuUpOTZgI9KoZmeQKMlNPRQizXuaRhE0k/jk0fZvs=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-iUpY/gmbY+wIWwVd2ubMOnE/srBKDLHNchdteMUVmpE=";
+    hash = "sha256-YW5BSnb4wSCTfQZ4ytiAxDmzrkyDAwTt4T1YzcZeiNY=";
  };

  buildInputs = [ libiconv ];
@@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "python-xapp";
-  version = "3.0.2";
+  version = "3.0.3";

  pyproject = false;

@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "linuxmint";
    repo = "python-xapp";
    rev = version;
-    hash = "sha256-+wN4BYAS7KYQT0vhyOSdyrJpOhGyv+2FAloClgZOyH0=";
+    hash = "sha256-KJ5mzilUg//FvwyhTHjzaUI3661RhN74r5qDIzdDOl8=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,49 @@
+{
+  buildPythonPackage,
+  rerun,
+  fetchPypi,
+
+  # dependencies
+  anywidget,
+  ipykernel,
+  jupyter-ui-poll,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "rerun-notebook";
+  inherit (rerun) version;
+  format = "wheel";
+  __structuredAttrs = true;
+
+  # Building this package from source is very cumbersome (it requires a wasm web-viewer
+  # cross-compile via cargo + an npm/esbuild bundle). Using the upstream wheel for now.
+  src = fetchPypi {
+    pname = "rerun_notebook";
+    inherit (finalAttrs) version;
+    format = "wheel";
+    python = "py2.py3";
+    hash = "sha256-meHaELZC6ujtn3AQB/vxXZxno54XrS99y4rFKMWa6BU=";
+  };
+
+  pythonRelaxDeps = [
+    # Upstream pins ipykernel<7.0.0 to dodge ipython/ipykernel#1450.
+    "ipykernel"
+  ];
+  dependencies = [
+    anywidget
+    ipykernel
+    jupyter-ui-poll
+  ];
+
+  pythonImportsCheck = [ "rerun_notebook" ];
+
+  meta = {
+    description = "Implementation helper for running rerun-sdk in notebooks";
+    homepage = "https://github.com/rerun-io/rerun/tree/main/rerun_notebook";
+    inherit (rerun.meta)
+      changelog
+      license
+      maintainers
+      ;
+  };
+})
@@ -19,13 +19,16 @@
  typing-extensions,

  # tests
+  av,
  datafusion,
  inline-snapshot,
  polars,
  pytest-snapshot,
  pytestCheckHook,
+  rerun-notebook,
  tomli,
  torch,
+  torchvision,
 }:

 buildPythonPackage {
@@ -86,13 +89,16 @@ buildPythonPackage {
  pythonImportsCheck = [ "rerun" ];

  nativeCheckInputs = [
+    av
    datafusion
    inline-snapshot
    polars
    pytest-snapshot
    pytestCheckHook
+    rerun-notebook
    tomli
    torch
+    torchvision
  ];

  inherit (rerun) addDlopenRunpaths addDlopenRunpathsPhase;
@@ -111,9 +117,25 @@ buildPythonPackage {
    # TypeError: 'Snapshot' object is not callable
    "test_chunk_record_batch"
    "test_schema_recording"
+
+    # pytest_snapshot mismatch: serialized schema/summary output drifted in 0.32.0
+    "test_schema"
+    "test_summary_format"
+
+    # AttributeError: 'datetime.datetime' object has no attribute 'value'
+    "test_lenses_time_extraction"
+
+    # av.InvalidDataError: the mp4 asset is a Git LFS pointer, not the real
+    # video (rerun.src is fetched without fetchLFS).
+    "test_collect_optimize_video_stream_summary"
  ];

  disabledTestPaths = [
+    # RuntimeError: MCAP error: Bad magic number. The .mcap test assets are
+    # Git LFS pointer files, not real binaries (rerun.src is fetched without
+    # fetchLFS).
+    "rerun_py/tests/integration/test_mcap_reader.py"
+
    # "fixture 'benchmark' not found"
    "tests/python/log_benchmark/test_log_benchmark.py"
    "tests/python/log_benchmark/test_micro_benchmark.py"
@@ -8,23 +8,24 @@

  # dependencies
  boto3,
-  mlflow,
+  mlflow-skinny,

  # tests
  pytestCheckHook,
  scikit-learn,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "sagemaker-mlflow";
-  version = "0.3.0";
+  version = "0.4.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "sagemaker-mlflow";
-    tag = "v${version}";
-    hash = "sha256-riCoUpao9QIrQMb7r9stJO/xTSsDfL+uNS664W5GRQc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QE40ZBW7N3GPC+eJqj5uzS3L+A6Wu2/LgHOiUsEXKMw=";
  };

  build-system = [
@@ -33,7 +34,7 @@ buildPythonPackage rec {

  dependencies = [
    boto3
-    mlflow
+    mlflow-skinny
  ];

  pythonImportsCheck = [ "sagemaker_mlflow" ];
@@ -56,16 +57,24 @@ buildPythonPackage rec {
    "test_presigned_url"
    "test_presigned_url_with_fields"

+    # Exercises a `sqlite://` model-registry store, only available with the
+    # sqlalchemy backend of the full `mlflow` package (not `mlflow-skinny`).
+    "test_store_instantiation_none"
+  ];
+
+  disabledTestPaths = [
+    # `from mlflow.models import infer_signature` fails to import at collection
+    # time: `infer_signature` is only available in the full `mlflow` package,
+    # not in `mlflow-skinny`. Also see:
    # https://github.com/aws/sagemaker-mlflow/issues/16
-    # TypeError: LogisticRegression.__init__() got an unexpected keyword argument 'multi_class'
-    "test_model_registry"
+    "test/integration/tests/test_model_registry.py"
  ];

  meta = {
    description = "MLFlow plugin for SageMaker";
    homepage = "https://github.com/aws/sagemaker-mlflow";
-    changelog = "https://github.com/aws/sagemaker-mlflow/releases/tag/v${version}";
+    changelog = "https://github.com/aws/sagemaker-mlflow/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
-}
+})
@@ -10,14 +10,14 @@

 buildPythonPackage rec {
  pname = "tabledata";
-  version = "1.3.4";
+  version = "1.3.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "thombashi";
    repo = "tabledata";
    tag = "v${version}";
-    hash = "sha256-kZAEKUOcxb3fK3Oh6+4byJJlB/xzDAEGNpUDEKyVkhs=";
+    hash = "sha256-yt71e2ZPJ5WpDLs6sU4kYQGR13IgJB7gMEzhaCHblos=";
  };

  build-system = [ setuptools-scm ];
@@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "tencentcloud-sdk-python";
-  version = "3.1.97";
+  version = "3.1.98";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = finalAttrs.version;
-    hash = "sha256-wBDCzuk/YS1n8aW9FxtzfgupPOfJ2VOpXrrjTa/izbE=";
+    hash = "sha256-Zz4XsH5X/NbpPmWLC1KiOxe/DJ3tdH3dBV+1ucoGx/8=";
  };

  build-system = [ setuptools ];
@@ -29,14 +29,14 @@

 buildPythonPackage rec {
  pname = "textnets";
-  version = "0.10.4";
+  version = "0.10.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jboynyc";
    repo = "textnets";
    tag = "v${version}";
-    hash = "sha256-GbJH+6EqfP+miqpYitnBwNDO6uQQq3h9Fy58nVaF1vw=";
+    hash = "sha256-0KBKpA4nnHxem65tZTtZcXl/EVS1ifWOXGT7a/750Gk=";
  };

  build-system = [
@@ -12,19 +12,19 @@

 buildPythonPackage (finalAttrs: {
  pname = "typst";
-  version = "0.14.8";
+  version = "0.14.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "messense";
    repo = "typst-py";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hJOAcP4MyI7TCY8M99OVaMhFhp2RbhBekCc1mjqBvcc=";
+    hash = "sha256-BiheOVvXPoLGtOzObZte38RkMVkUMOsFURn5DU1cw+o=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-trmnUSIYr5X3UyJjbd7VYko71ziPsvR7l1c0XfFzC80=";
+    hash = "sha256-PM0WntALVI/ks7N/Uk5tjcb0XBr2PSUY+O1nalFg2JQ=";
  };

  build-system = [
@@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "victron-mqtt";
-  version = "2026.5.0";
+  version = "2026.5.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tomer-w";
    repo = "victron_mqtt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0VGDGtuMs1Bw+98ddI0Gggxm1nWEWWn4Z/RbuTfzqoY=";
+    hash = "sha256-oiik7n2eT71v814N0LhebTNecT5FuZSObbwqmon6BZI=";
  };

  build-system = [
@@ -11,16 +11,16 @@
  xarray,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "xarray-einstats";
-  version = "0.9.1";
+  version = "0.10.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "arviz-devs";
    repo = "xarray-einstats";
-    tag = "v${version}";
-    hash = "sha256-CgyMc2Yvut+1LfH9F2FAd62HuLu+58Xr50txbWj4mYU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-R/CbCaToW9U0+WqayE33gSyx5wKrhlZd7w4kjyxoxrk=";
  };

  build-system = [ flit-core ];
@@ -36,7 +36,10 @@ buildPythonPackage rec {
    numba = [ numba ];
  };

-  nativeCheckInputs = [ pytestCheckHook ] ++ lib.concatAttrValues optional-dependencies;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);

  pythonImportsCheck = [ "xarray_einstats" ];

@@ -48,7 +51,8 @@ buildPythonPackage rec {
  meta = {
    description = "Stats, linear algebra and einops for xarray";
    homepage = "https://github.com/arviz-devs/xarray-einstats";
+    changelog = "https://github.com/arviz-devs/xarray-einstats/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
@@ -26,12 +26,12 @@ let

      stdenvNoCC.mkDerivation (finalAttrs: {
        pname = "coreboot-toolchain-${arch}";
-        version = "25.12";
+        version = "26.03";

        src = fetchgit {
          url = "https://review.coreboot.org/coreboot";
          rev = finalAttrs.version;
-          hash = "sha256-zm1M+iveBxE/8/vIXZz1KoFkMaKW+bsQM4me5T6WqVY=";
+          hash = "sha256-9ollzu6vtU+uHibvV/B5N70ZVl701kuI/orWlFZLjIU=";
          fetchSubmodules = false;
          leaveDotGit = true;
          postFetch = ''
--- a/Show More
+++ b/Show More