Merge staging-next into staging

2026-04-24 12:23:20 +00:00
parent 4fcc02b9c8 bb6c582617
commit 2571eafb31
77 changed files with 1590 additions and 714 deletions
@@ -21,12 +21,12 @@ Here is a simple package example to be called with `tclPackages.callPackage`.
 ```
 { lib, fetchzip, mkTclDerivation, openssl }:

-mkTclDerivation rec {
+mkTclDerivation (finalAttrs: {
  pname = "tcltls";
  version = "1.7.22";

  src = fetchzip {
-    url = "https://core.tcl-lang.org/tcltls/uv/tcltls-${version}.tar.gz";
+    url = "https://core.tcl-lang.org/tcltls/uv/tcltls-${finalAttrs.version}.tar.gz";
    hash = "sha256-TOouWcQc3MNyJtaAGUGbaQoaCWVe6g3BPERct/V65vk=";
  };

@@ -43,7 +43,7 @@ mkTclDerivation rec {
    license = lib.licenses.tcltk;
    platforms = lib.platforms.unix;
  };
-}
+})
 ```

 All Tcl libraries are declared in `pkgs/top-level/tcl-packages.nix` and are defined in `pkgs/development/tcl-modules/`.
@@ -73,7 +73,9 @@ in
      extraGroups = [ "video" ];
    };
    # Required for authentication
-    security.pam.services.cosmic-greeter = { };
+    security.pam.services.cosmic-greeter = {
+      allowNullPassword = true;
+    };

    hardware.graphics.enable = true;
    services.accounts-daemon.enable = true;
@@ -1378,6 +1378,7 @@ in
  qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
  qgis = handleTest ./qgis.nix { package = pkgs.qgis; };
  qgis-ltr = handleTest ./qgis.nix { package = pkgs.qgis-ltr; };
+  qlever = runTest ./qlever.nix;
  qownnotes = runTest ./qownnotes.nix;
  qtile = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./qtile/default.nix;
  qtile-extras = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./qtile-extras/default.nix;
@@ -0,0 +1,52 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  olympics-qleverfile = "${pkgs.qlever-control.src}/src/qlever/Qleverfiles/Qleverfile.olympics";
+
+  olympics-dataset = pkgs.fetchurl {
+    url = "https://github.com/wallscope/olympics-rdf/raw/54483d539082641d48e1d49873662b3af628ca4d/data/olympics-nt-nodup.zip";
+    hash = "sha256-dY28CQKaMDUUw/pw+p9yX0EtJOnbAAplodMFaedL1B8=";
+  };
+in
+
+{
+  name = "Basic QLever test";
+  meta.maintainers = lib.teams.ngi.members;
+
+  nodes = {
+    machine =
+      {
+        pkgs,
+        ...
+      }:
+      {
+        environment.systemPackages = with pkgs; [
+          qlever
+          qlever-control
+          unzip
+        ];
+      };
+  };
+
+  testScript =
+    # python
+    ''
+      machine.succeed("cp ${olympics-dataset} /tmp/olympics.zip")
+      machine.succeed("cp ${olympics-qleverfile} /tmp/Qleverfile")
+      machine.succeed("unzip -q olympics.zip")
+
+      # use qlever binary instead of docker
+      machine.succeed("sed -i 's/SYSTEM = docker/SYSTEM = native/' /tmp/Qleverfile")
+
+      machine.succeed("qlever index")
+
+      machine.succeed("qlever start")
+      machine.wait_for_open_port(7019) # default server port
+
+      machine.succeed("qlever query")
+    '';
+}
@@ -75,7 +75,7 @@ Because entries in the Nix store are inert and do nothing by themselves, package

 This section describes a general framework of understanding and exceptions might apply.

-Luckily it's pretty easy to maintain your own package set with Nix, which can then be added to the [Nix User Repository](https://github.com/nix-community/nur) project.
+Luckily it's pretty easy to maintain your own package set with Nix, which can then be added to the [Nix User Repository](https://github.com/nix-community/nur) project or included in [search.nixos.org's list of indexed 3rd-party flakes](https://github.com/NixOS/nixos-search/blob/main/flakes/manual.toml)

 ---

@@ -1194,6 +1194,13 @@ let
          # https://github.com/syl20bnr/flymake-elixir/issues/4
          flymake-elixir = addPackageRequires super.flymake-elixir [ self.flymake-easy ];

+          flymake-hadolint = super.flymake-hadolint.overrideAttrs (attrs: {
+            postPatch = attrs.postPatch or "" + ''
+              substituteInPlace flymake-hadolint.el \
+                --replace-fail 'flymake-hadolint-program "hadolint"' 'flymake-hadolint-program "${lib.getExe pkgs.hadolint}"'
+            '';
+          });
+
          flyparens = ignoreCompilationError super.flyparens; # elisp error

          fold-dwim-org = ignoreCompilationError super.fold-dwim-org; # elisp error
@@ -3322,6 +3322,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  codex-nvim = buildVimPlugin {
+    pname = "codex.nvim";
+    version = "1.1.0";
+    src = fetchFromGitHub {
+      owner = "johnseth97";
+      repo = "codex.nvim";
+      tag = "v1.1.0";
+      hash = "sha256-rx5/Iso5rWYfRTnQyZ8g16FCxqjj4FgWmG+r09ebVJc=";
+    };
+    meta.homepage = "https://github.com/johnseth97/codex.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  codi-vim = buildVimPlugin {
    pname = "codi.vim";
    version = "0-unstable-2023-02-28";
@@ -7475,6 +7488,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  just-nvim = buildVimPlugin {
+    pname = "just.nvim";
+    version = "1.0.0";
+    src = fetchFromGitHub {
+      owner = "nxuv";
+      repo = "just.nvim";
+      tag = "v1.0.0";
+      hash = "sha256-pwAlfwPFnWD2qfBAuhLxSoCQoOZD7gQHEy4Nnt0GOqE=";
+    };
+    meta.homepage = "https://github.com/nxuv/just.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  kanagawa-nvim = buildVimPlugin {
    pname = "kanagawa.nvim";
    version = "0-unstable-2026-04-20";
@@ -10244,6 +10270,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  neotab-nvim = buildVimPlugin {
+    pname = "neotab.nvim";
+    version = "0-unstable-2025-08-04";
+    src = fetchFromGitHub {
+      owner = "kawre";
+      repo = "neotab.nvim";
+      rev = "e99d3e28c5a2066d2d368dfe4ef3827c8d75d337";
+      hash = "sha256-pSLvpKqfi1hQrFAYmXTOUOYERtnr79M23z5so2JOGhE=";
+    };
+    meta.homepage = "https://github.com/kawre/neotab.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  neoterm = buildVimPlugin {
    pname = "neoterm";
    version = "0-unstable-2023-03-09";
@@ -11802,6 +11841,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  nvim-justice = buildVimPlugin {
+    pname = "nvim-justice";
+    version = "0-unstable-2026-04-13";
+    src = fetchFromGitHub {
+      owner = "chrisgrieser";
+      repo = "nvim-justice";
+      rev = "a3e0d2d73d1748d1bed45e6b1797fbc73961e53f";
+      hash = "sha256-gT+vPt9BWe1AylFqbZsoEXL8cXSpMjRdiY44Cxalwcg=";
+    };
+    meta.homepage = "https://github.com/chrisgrieser/nvim-justice/";
+    meta.hydraPlatforms = [ ];
+  };
+
  nvim-k8s-crd = buildVimPlugin {
    pname = "nvim-k8s-crd";
    version = "0-unstable-2026-02-16";
@@ -12308,6 +12360,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  nvim-sioyek-highlights = buildVimPlugin {
+    pname = "nvim-sioyek-highlights";
+    version = "0-unstable-2026-02-06";
+    src = fetchFromGitHub {
+      owner = "jbuck95";
+      repo = "nvim-sioyek-highlights";
+      rev = "b8ab0a71b24c052cebaed97afe376b01fba19bf0";
+      hash = "sha256-x2Q+96/YEky8fdy4CZ/QPwcLjaOLmwmtpWiYMnS657A=";
+    };
+    meta.homepage = "https://github.com/jbuck95/nvim-sioyek-highlights/";
+    meta.hydraPlatforms = [ ];
+  };
+
  nvim-snippets = buildVimPlugin {
    pname = "nvim-snippets";
    version = "1.0.0-unstable-2024-07-10";
@@ -1587,6 +1587,17 @@ assertNoAdditions {
    passthru.python3Dependencies = ps: [ ps.jupytext ];
  };

+  just-nvim = super.just-nvim.overrideAttrs {
+    checkInputs = with self; [
+      fidget-nvim
+      nvim-notify
+      telescope-nvim
+    ];
+    dependencies = with self; [
+      plenary-nvim
+    ];
+  };
+
  kanagawa-paper-nvim = super.kanagawa-paper-nvim.overrideAttrs {
    nvimSkipModules = [
      # skipping wezterm theme switcher since it relies on a wezterm module
@@ -254,6 +254,7 @@ https://github.com/franco-ruggeri/codecompanion-spinner.nvim/,,
 https://github.com/olimorris/codecompanion.nvim/,,
 https://github.com/mrjones2014/codesettings.nvim/,,
 https://github.com/gorbit99/codewindow.nvim/,,
+https://github.com/johnseth97/codex.nvim/,,
 https://github.com/metakirby5/codi.vim/,,
 https://github.com/archseer/colibri.vim/,,
 https://github.com/tjdevries/colorbuddy.nvim/,,
@@ -573,6 +574,7 @@ https://git.myzel394.app/Myzel394/jsonfly.nvim,,
 https://github.com/julelang/jule.nvim/,,
 https://github.com/JuliaEditorSupport/julia-vim/,,
 https://github.com/GCBallesteros/jupytext.nvim/,,
+https://github.com/nxuv/just.nvim/,,
 https://github.com/thesimonho/kanagawa-paper.nvim/,,
 https://github.com/rebelot/kanagawa.nvim/,,
 https://github.com/webhooked/kanso.nvim/,,
@@ -786,6 +788,7 @@ https://github.com/nvim-neorg/neorg-telescope/,,
 https://github.com/karb94/neoscroll.nvim/,,
 https://github.com/Shougo/neosnippet-snippets/,,
 https://github.com/Shougo/neosnippet.vim/,,
+https://github.com/kawre/neotab.nvim/,,
 https://github.com/kassio/neoterm/,,
 https://github.com/rcasia/neotest-bash/,,
 https://github.com/orjangj/neotest-ctest/,,
@@ -906,6 +909,7 @@ https://codeberg.org/mfussenegger/nvim-jdtls/,,
 https://github.com/gennaro-tedesco/nvim-jqx/,,
 https://gitlab.com/usmcamp0811/nvim-julia-autotest,,
 https://github.com/yorickpeterse/nvim-jump/,,
+https://github.com/chrisgrieser/nvim-justice/,,
 https://github.com/anasinnyk/nvim-k8s-crd/,,
 https://github.com/ethanholz/nvim-lastplace/,,
 https://github.com/kosayoda/nvim-lightbulb/,,
@@ -945,6 +949,7 @@ https://github.com/petertriho/nvim-scrollbar/,,
 https://github.com/dstein64/nvim-scrollview/,,
 https://github.com/s1n7ax/nvim-search-and-replace/,,
 https://github.com/michaelrommel/nvim-silicon/,,
+https://github.com/jbuck95/nvim-sioyek-highlights/,,
 https://github.com/garymjr/nvim-snippets/,,
 https://github.com/dcampos/nvim-snippy/,,
 https://github.com/ishan9299/nvim-solarized-lua/,,
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "bsnes";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "bsnes-libretro";
-    rev = "399bdedb20f6e847e75e8425ca240560ea0940a6";
-    hash = "sha256-T3pmZ6WJOXyubiTzOIDipMdRDpB+RiNRnd76XbOIl84=";
+    rev = "d62d219ac22f1ed179738d107d8a4da2c4289845";
+    hash = "sha256-XYCzXAFkSFNMlRjzH4zR3lpRguOqvAJM4TBcL9Feog8=";
  };

  makefile = "Makefile";
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "flycast";
-  version = "0-unstable-2026-04-12";
+  version = "0-unstable-2026-04-17";

  src = fetchFromGitHub {
    owner = "flyinghead";
    repo = "flycast";
-    rev = "321bdaf08b4b007a720f196ea072c1813b1b7efe";
-    hash = "sha256-9Ry5+krdhz2RCmZZh2l6DdcKTgMpcgHwOBG4c7fc/og=";
+    rev = "ae5416a5cb1df362382279172818ac4bb692dc97";
+    hash = "sha256-3eFkirJm3tBLvJrM0rcTX1tFnKnWag8s3eUL17nQc9w=";
    fetchSubmodules = true;
  };

@@ -4,6 +4,7 @@
  fetchurl,
  fetchFromGitHub,
  jdk11,
+  jdk17,
  gradle_8,
  metasploit,
  makeWrapper,
@@ -76,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  nativeBuildInputs = [
-    jdk11
+    jdk17
    gradle
    makeWrapper
    copyDesktopItems
@@ -1,23 +1,31 @@
 {
  lib,
  fetchFromGitHub,
-  buildGoModule,
+  # Requires Go 1.26, drop when that's the default.
+  buildGo126Module,
  nix-update-script,
  versionCheckHook,
+  applyPatches,
 }:

-buildGoModule (finalAttrs: {
+buildGo126Module (finalAttrs: {
  pname = "athens";
-  version = "0.16.2";
+  version = "0.17.0";

-  src = fetchFromGitHub {
-    owner = "gomods";
-    repo = "athens";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-Mv0fJ5EiU/Nxakr1sLx2rcJnQ9SEjFMn+2Gf4qsnN3w=";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "gomods";
+      repo = "athens";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-4KCPYqLtqz46zr5+LB4CyG4ZQrjQaPgMEhCuGOWIJKg=";
+    };
+    # Trim the patch version, not needed anyway.
+    postPatch = ''
+      sed -i 's/go 1.26.2/go 1.26/' go.mod
+    '';
  };

-  vendorHash = "sha256-bn3He7ImXxrl+Or2pqzVpM8VxbfqDDupwtZbdSMd4HI=";
+  vendorHash = "sha256-he7GNkCfqLgOXuCTahvqOnwW5TpbYjlCMfMGfKGwYZ4=";

  env.CGO_ENABLED = "0";
  ldflags = [
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "dnsproxy";
-  version = "0.81.1";
+  version = "0.81.2";

  src = fetchFromGitHub {
    owner = "AdguardTeam";
    repo = "dnsproxy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eY4nmaW3jjDb4RcGWcy2l1RScxZwtBGGYQpC1zh5hVE=";
+    hash = "sha256-YjiLhfwuwuGvefySCi+eWSBj4hIOQTy4vGSifFcPDcA=";
  };

  vendorHash = "sha256-liX+AMxVBkxJSv1Ltt924Hjf10fho4G6tyt82tkzWZA=";
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "famly-fetch";
-  version = "0.4.0";
+  version = "0.5.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jacobbunk";
    repo = "famly-fetch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uyLGBNV+GiYNqy4wWxPNx/xQL0lnMsIHfPIlaIu85HA=";
+    hash = "sha256-KsdypUXHU9drghAcDcur8FUUJvm8nIzq00QFdMqPnpc=";
  };

  build-system = with python3Packages; [
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ft2-clone";
-  version = "2.16";
+  version = "2.17";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "ft2-clone";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-+ifMydkwMmJ2d5DcYEaDzaX12JAHGAVCZLSBPrBDLFg=";
+    hash = "sha256-ebyFMZV2LBtEbf7yjO9o9mp3UEoECHAHUQm4lwUS/Ws=";
  };

  nativeBuildInputs = [ cmake ];
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+  gitMinimal,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "git-ls";
+  version = "5.10.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "llimllib";
+    repo = "git-ls";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ziG1TP+sg5v/JEJ+1J4reNHt6fpvIAfSz+esr2jucz8=";
+  };
+
+  vendorHash = "sha256-Bk6IBG+BrqY4FNVIlbSSSnqqAeL+8SJUtRXuIp4e8f8=";
+
+  ldflags = [ "-s" ];
+
+  nativeCheckInputs = [
+    gitMinimal
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "List files and git status in a repository";
+    homepage = "https://github.com/llimllib/git-ls";
+    changelog = "https://github.com/llimllib/git-ls/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.unlicense;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "git-ls";
+  };
+})
@@ -1,5 +1,5 @@
 {
-  "version": "2.53-c61120cf",
-  "rev": "c61120cf654250ac63bdcb5d5ee0bbb9caeae9cd",
-  "hash": "sha256-kTdpPQOuHNTXscgqbd/GOLPe8bEPiOeBlm5RppgMpUA="
+  "version": "2.53-e417bf29",
+  "rev": "e417bf2996fbd77acabbf354ed9b5adedacf91c9",
+  "hash": "sha256-enYjs2KODFwjU0hAylZeOmoV+DMEUH8pZH4JZ+P+eNI="
 }
@@ -7,7 +7,7 @@
 }:

 let
-  version = "18.10.3";
+  version = "18.11.1";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@@ -21,10 +21,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-edILaF/dW7yOm5W9nV9d7Cj4+W9kshagkOb/2mfIOtQ=";
+      hash = "sha256-se3JtkYR+Mi0Kse3fQXBwxQyHmbPu2DqTNGnRHZQdTc=";
    };

-    vendorHash = "sha256-W7ZI8IOaW/88zWrVymDkRQqzk+aLgvdO+rPycK70Bb0=";
+    vendorHash = "sha256-123WUtoUaPIyDywcTKEhiZP2SYYHxAQoOPyCebsHYRI=";

    ldflags = [
      "-X ${gitaly_package}/internal/version.version=${version}"
@@ -6,17 +6,17 @@

 buildGoModule (finalAttrs: {
  pname = "gitlab-pages";
-  version = "18.10.3";
+  version = "18.11.1";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-TsImrWD6cLvVoasatQpWVFCAuQw3/38EfFC+igikhVo=";
+    hash = "sha256-O9YzFUVhqy16sMmViLcJ4LMumyGsvPDehkQCGproSFs=";
  };

-  vendorHash = "sha256-EaTYw8ydHMA3Rmr8YJvUxWBIkPhyKLc8zNUsJRTlMmE=";
+  vendorHash = "sha256-PUW4cgAiM1GTtvja894OZ4pe0SWChf5JsL4/fkns2kI=";
  subPackages = [ "." ];

  ldflags = [
@@ -8,14 +8,14 @@

 buildGoModule (finalAttrs: {
  pname = "gitlab-shell";
-  version = "14.47.0";
+  version = "14.49.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-1FQH7Epa9mKxJMyN+NFDIir4shosmEbh6BHcXinuTyk=";
+    hash = "sha256-8PnFRwP5vctnOh6t45crxkoVF6Z03bfYry24KfFHCww=";
  };

  buildInputs = [
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
    ./remove-hardcoded-locations.patch
  ];

-  vendorHash = "sha256-KkIDo/jhBBMwa/T6VzCgeuy9kXIncJglMjab70wqYug=";
+  vendorHash = "sha256-JBKU134/Yyz49HWfU9Dw/EC4bI/o3Hs56Ou7wtzp5qM=";

  subPackages = [
    "cmd/gitlab-shell"
@@ -1,17 +1,17 @@
 {
-  "version": "18.10.3",
-  "repo_hash": "sha256-x8nmMKbL8hnmQfIrnAhbQHu6Mg2PnjMJeRXUBiI7QFA=",
-  "yarn_hash": "sha256-tWpPN//SdgnRONVa1ykagVHCNs7TCboTnQLQ5Sx0DQs=",
-  "frontend_islands_yarn_hash": "sha256-OkCoiyL9FFJcWcNUbeRSBGGSauYIm7l+yxNfA0CsNEQ=",
+  "version": "18.11.1",
+  "repo_hash": "sha256-ksqJuXklQYFAosyPKAtTDgcq+qJ6TRd2PJ4wu0JpMMI=",
+  "yarn_hash": "sha256-k8JHi0f/XfSV4kICyPW01Erk3YnKw33yeUWYrOaPdTM=",
+  "frontend_islands_yarn_hash": "sha256-EvGQin+5DqqIgM36jlVkVI49WcJzVvceYnkSS9ybfcY=",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v18.10.3-ee",
+  "rev": "v18.11.1-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "18.10.3",
-    "GITLAB_KAS_VERSION": "18.10.3",
-    "GITLAB_PAGES_VERSION": "18.10.3",
-    "GITLAB_SHELL_VERSION": "14.47.0",
+    "GITALY_SERVER_VERSION": "18.11.1",
+    "GITLAB_KAS_VERSION": "18.11.1",
+    "GITLAB_PAGES_VERSION": "18.11.1",
+    "GITLAB_SHELL_VERSION": "14.49.0",
    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.1",
-    "GITLAB_WORKHORSE_VERSION": "18.10.3"
+    "GITLAB_WORKHORSE_VERSION": "18.11.1"
  }
 }
@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
  pname = "gitlab-workhorse";

-  version = "18.10.3";
+  version = "18.11.1";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {

  sourceRoot = "${finalAttrs.src.name}/workhorse";

-  vendorHash = "sha256-dLM+xmpPK4RA0DnZkj8dXN9FdKiRLXXQCeVLI8SqZ3Y=";
+  vendorHash = "sha256-X1+neA2g61BR1VRKXzeqNath0+SYXRbU4vzEg1KD2sY=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${finalAttrs.version}" ];
  doCheck = false;
@@ -136,7 +136,7 @@ let
            cp Cargo.lock $out
          '';

-          hash = "sha256-YQEldpT1pCJe5hBJmLTVyvOjnilH10mGhgYfKDSOY3k=";
+          hash = "sha256-KIMs5Zed6mcbq06oxA2eVHLfifSlcfJvACZMblDQC3M=";
        };

        postPatch = ''
@@ -335,6 +335,9 @@ let
      yarn run postinstall
      popd

+      # Creates a `infection_scanner.json` needed for the assets compiler to succeed.
+      node scripts/frontend/infection_scanner/infection_scanner.mjs
+
      bundle exec rake gitlab:assets:compile RAILS_ENV=production NODE_ENV=production SKIP_YARN_INSTALL=true

      runHook postBuild
@@ -39,7 +39,7 @@ gem 'action_dispatch-draw_all',
 # Need by Rails
 gem 'drb', '~> 2.2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

-gem 'bootsnap', '~> 1.18.6', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'bootsnap', '~> 1.23.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

 # Avoid the precompiled native gems because Omnibus needs to build this to ensure
 # LD_LIBRARY_PATH is correct: https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/7730
@@ -73,8 +73,6 @@ gem 'view_component', '~> 3.23.2', feature_category: :shared # rubocop:todo Gemf
 # Supported DBs
 gem 'pg', '~> 1.6.1', feature_category: :database

-gem 'rugged', '~> 1.9', feature_category: :gitaly
-
 gem 'faraday', '~> 2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'faraday-retry', '~> 2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 # Logger is a dependency of Faraday, but Logger 1.6.0 does not work with Chef.
@@ -86,7 +84,7 @@ gem 'marginalia', '~> 1.11.1', feature_category: :database
 gem 'declarative_policy', '~> 2.1.0', feature_category: :permissions

 # For source code paths mapping
-gem 'coverband', '6.1.7', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'coverband', '6.2.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

 # Authentication libraries
 gem 'devise', '~> 4.9.3', feature_category: :system_access
@@ -179,7 +177,7 @@ gem 'gitlab-topology-service-client', '~> 0.1',
  feature_category: :cell

 # Duo Workflow
-gem 'gitlab-duo-workflow-service-client', '~> 0.6',
+gem 'gitlab-duo-workflow-service-client', '~> 0.7',
  path: 'vendor/gems/gitlab-duo-workflow-service-client',
  feature_category: :duo_agent_platform

@@ -434,14 +432,17 @@ gem 'prometheus-client-mmap', '~> 1.5.0', require: 'prometheus/client', feature_
 # Event-driven reactor for Ruby
 # Required manually in config/initializers/require_async_gem
 gem 'async', '~> 2.32.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-gem 'io-event', '~> 1.12', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'io-event', '~> 1.14', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

 # Security report schemas used to validate CI job artifacts of security jobs
-gem 'gitlab-security_report_schemas', '0.1.3.min15.0.0.max15.2.3', feature_category: :vulnerability_management
+gem 'gitlab-security_report_schemas', '0.2.0.min15.0.0.max15.2.4', feature_category: :vulnerability_management

 # Frontend bundling
-gem 'vite_rails', '~> 3.0.17', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-gem 'vite_ruby', '~> 3.9.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'vite_rails', '~> 3.10.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'vite_ruby', '~> 3.10.1', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+
+# Provide Rails path helpers to the frontend
+gem "js-routes", "~> 2.3", feature_category: :organization

 # OpenTelemetry
 group :opentelemetry do
@@ -505,9 +506,8 @@ group :development do
 end

 group :development, :test do
-  gem 'deprecation_toolkit', '~> 2.2.3', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'bullet', '~> 8.0.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-  gem 'parser', '= 3.3.10.1', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+  gem 'parser', '= 3.3.11.1', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'pry-byebug', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'pry-rails', '~> 0.3.9', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'pry-shell', '~> 0.6.4', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -594,7 +594,7 @@ group :test do
  gem 'webmock', '~> 3.26.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'rails-controller-testing', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'concurrent-ruby', '~> 1.1', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-  gem 'test-prof', '~> 1.5.0', feature_category: :tooling
+  gem 'test-prof', '~> 1.6.0', feature_category: :tooling
  gem 'rspec_junit_formatter', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'guard-rspec', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'axe-core-rspec', '~> 4.10.0', feature_category: :tooling
@@ -603,7 +603,7 @@ group :test do
  # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
  gem 'derailed_benchmarks', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

-  gem 'gitlab_quality-test_tooling', '~> 3.9.0', require: false, feature_category: :tooling
+  gem 'gitlab_quality-test_tooling', '~> 3.10.0', require: false, feature_category: :tooling
 end

 gem 'octokit', '~> 9.0', feature_category: :importers
@@ -639,7 +639,7 @@ gem 'ssh_data', '~> 2.0', feature_category: :shared # rubocop:todo Gemfile/Missi
 gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 18.8.0', feature_category: :gitaly
+gem 'gitaly', '~> 18.10.0', feature_category: :gitaly

 # KAS GRPC protocol definitions
 gem 'gitlab-kas-grpc', '~> 18.5.0-rc4', feature_category: :deployment_management
@@ -647,7 +647,7 @@ gem 'gitlab-kas-grpc', '~> 18.5.0-rc4', feature_category: :deployment_management
 # Knowledge Graph GRPC protocol definitions
 gem 'gitlab-gkg-proto', '~> 0.7.0', feature_category: :knowledge_graph

-gem 'grpc', '~> 1.78.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'grpc', '~> 1.80.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

 gem 'google-protobuf', '>= 3.25', '< 5.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

@@ -695,8 +695,8 @@ gem 'valid_email', '~> 0.1', feature_category: :shared # rubocop:todo Gemfile/Mi

 # JSON
 gem 'jsonb_accessor', '~> 1.4', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-gem 'json', '~> 2.13.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-gem 'json_schemer', '~> 2.3.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'json', '~> 2.19.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'json_schemer', '~> 2.4.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'oj', '~> 3.16.0', '>=3.16.16', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'oj-introspect', '~> 0.9', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'multi_json', '~> 1.17.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -759,4 +759,4 @@ gem "gitlab-cloud-connector", "~> 1.45", require: 'gitlab/cloud_connector', feat

 gem "gvltools", "~> 0.4.0", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

-gem 'gitlab_query_language', '~> 0.23.0', feature_category: :integrations
+gem 'gitlab_query_language', '~> 0.26.0', feature_category: :integrations
@@ -109,6 +109,7 @@ PATH
      activesupport (>= 6.1, < 8)
      gitlab_quality-test_tooling (>= 3.8, < 4)
      rspec (~> 3.0)
+      test-prof (~> 1.5)

 PATH
  remote: gems/gitlab-safe_request_store
@@ -131,7 +132,13 @@ PATH
      actionview (>= 6.1.7.2)
      activesupport (>= 6.1.7.2)
      addressable (~> 2.8)
+      batch-loader (~> 2.0)
+      bigdecimal (~> 3.2)
+      nokogiri (~> 1.0)
+      oj (~> 3.16)
      rake (~> 13.0)
+      toml-rb (~> 4.1)
+      yajl-ruby (~> 1.4)

 PATH
  remote: gems/ipynbdiff
@@ -162,7 +169,7 @@ PATH
 PATH
  remote: vendor/gems/gitlab-duo-workflow-service-client
  specs:
-    gitlab-duo-workflow-service-client (0.6)
+    gitlab-duo-workflow-service-client (0.7)
      grpc

 PATH
@@ -226,7 +233,7 @@ GEM
      nkf
      rexml
    RedCloth (4.3.4)
-    acme-client (2.0.30)
+    acme-client (2.0.31)
      base64 (~> 0.2)
      faraday (>= 1.0, < 3.0.0)
      faraday-retry (>= 1.0, < 3.0.0)
@@ -343,7 +350,6 @@ GEM
      encryptor (~> 3.0.0)
    attr_required (1.0.2)
    awesome_print (1.9.2)
-    awrence (1.2.1)
    aws-eventstream (1.3.0)
    aws-partitions (1.1001.0)
    aws-sdk-cloudformation (1.134.0)
@@ -384,7 +390,7 @@ GEM
    base32 (0.3.4)
    base64 (0.2.0)
    batch-loader (2.0.5)
-    bcrypt (3.1.21)
+    bcrypt (3.1.22)
    benchmark (0.4.1)
    benchmark-ips (2.14.0)
    benchmark-malloc (0.2.0)
@@ -393,10 +399,10 @@ GEM
    benchmark-perf (0.6.0)
    benchmark-trend (0.4.0)
    bigdecimal (3.2.3)
-    bindata (2.4.11)
+    bindata (2.5.1)
    binding_of_caller (1.0.0)
      debug_inspector (>= 0.0.1)
-    bootsnap (1.18.6)
+    bootsnap (1.23.0)
      msgpack (~> 1.2)
    browser (5.3.1)
    builder (3.3.0)
@@ -413,7 +419,7 @@ GEM
      rack-test (>= 0.6.3)
      regexp_parser (>= 1.5, < 3.0)
      xpath (~> 3.2)
-    capybara-screenshot (1.0.26)
+    capybara-screenshot (1.0.27)
      capybara (>= 1.0, < 4)
      launchy
    carrierwave (1.3.4)
@@ -421,7 +427,7 @@ GEM
      activesupport (>= 4.0.0)
      mime-types (>= 1.16)
      ssrf_filter (~> 1.0, < 1.1.0)
-    cbor (0.5.9.8)
+    cbor (0.5.10.1)
    cgi (0.5.0)
    character_set (1.8.0)
    charlock_holmes (0.7.9)
@@ -460,13 +466,13 @@ GEM
      json
    cork (0.3.0)
      colored2 (~> 3.1)
-    cose (1.3.0)
+    cose (1.3.1)
      cbor (~> 0.5.9)
      openssl-signature_algorithm (~> 1.0)
    countries (4.0.1)
      i18n_data (~> 0.13.0)
      sixarm_ruby_unaccent (~> 1.1)
-    coverband (6.1.7)
+    coverband (6.2.0)
      base64
      redis (>= 3.0)
    crack (0.4.3)
@@ -511,8 +517,6 @@ GEM
    debug_inspector (1.1.0)
    declarative (0.0.20)
    declarative_policy (2.1.0)
-    deprecation_toolkit (2.2.4)
-      activesupport (>= 6.1)
    derailed_benchmarks (2.2.1)
      base64
      benchmark-ips (~> 2)
@@ -732,7 +736,7 @@ GEM
    gemoji (3.0.1)
    get_process_mem (0.2.7)
      ffi (~> 1.0)
-    gettext (3.5.1)
+    gettext (3.5.2)
      erubi
      locale (>= 2.0.5)
      prime
@@ -743,7 +747,7 @@ GEM
    git (1.19.1)
      addressable (~> 2.8)
      rchardet (~> 1.8)
-    gitaly (18.8.3)
+    gitaly (18.10.0)
      grpc (~> 1.0)
    gitlab (4.19.0)
      httparty (~> 0.20)
@@ -807,7 +811,7 @@ GEM
      activesupport (>= 5.2.0)
      rake (~> 13.0)
      snowplow-tracker (~> 0.8.0)
-    gitlab-secret_detection (0.39.3)
+    gitlab-secret_detection (0.40.0)
      grpc (>= 1.63.0, < 2)
      grpc_reflection (~> 0.1)
      parallel (~> 1)
@@ -815,9 +819,9 @@ GEM
      sentry-ruby (~> 5.22)
      stackprof (~> 0.2.27)
      toml-rb (~> 4.1)
-    gitlab-security_report_schemas (0.1.3.min15.0.0.max15.2.3)
-      activesupport (>= 6, < 8)
-      json_schemer (~> 2.3.0)
+    gitlab-security_report_schemas (0.2.0.min15.0.0.max15.2.4)
+      activesupport (>= 6, < 8.1)
+      json_schemer (~> 2.4.0)
      mutex_m (~> 0.3.0)
    gitlab-styles (13.1.0)
      rubocop (= 1.71.1)
@@ -835,7 +839,7 @@ GEM
      omniauth (>= 1.3, < 3)
      pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
      rubyntlm (~> 0.5)
-    gitlab_quality-test_tooling (3.9.0)
+    gitlab_quality-test_tooling (3.10.1)
      activesupport (>= 7.0)
      amatch (~> 0.4.1)
      fog-google (~> 1.24, >= 1.24.1)
@@ -847,7 +851,7 @@ GEM
      rspec-parameterized (>= 1.0, < 3.0)
      table_print (= 1.5.7)
      zeitwerk (>= 2, < 3)
-    gitlab_query_language (0.23.0)
+    gitlab_query_language (0.26.0)
      rb_sys (~> 0.9.91)
    globalid (1.1.0)
      activesupport (>= 5.0)
@@ -899,11 +903,11 @@ GEM
      google-cloud-errors (~> 1.0)
      google-cloud-location (>= 0.4, < 2.a)
      grpc-google-iam-v1 (~> 1.1)
-    google-cloud-bigquery (1.52.1)
+    google-cloud-bigquery (1.62.0)
      bigdecimal (~> 3.0)
      concurrent-ruby (~> 1.0)
      google-apis-bigquery_v2 (~> 0.71)
-      google-apis-core (~> 0.13)
+      google-apis-core (>= 0.18, < 2)
      google-cloud-core (~> 1.6)
      googleauth (~> 1.9)
      mini_mime (~> 1.0)
@@ -997,7 +1001,7 @@ GEM
      logger (~> 1.6)
      ostruct (~> 0.6)
      sass-embedded (~> 1.58)
-    grpc (1.78.1)
+    grpc (1.80.0)
      google-protobuf (>= 3.25, < 5.0)
      googleapis-common-protos-types (~> 1.0)
    grpc-google-iam-v1 (1.11.0)
@@ -1064,7 +1068,8 @@ GEM
      csv
      mini_mime (>= 1.0.0)
      multi_xml (>= 0.5.2)
-    httpclient (2.8.3)
+    httpclient (2.9.0)
+      mutex_m
    i18n (1.14.7)
      concurrent-ruby (~> 1.0)
    i18n_data (0.13.1)
@@ -1078,7 +1083,7 @@ GEM
    invisible_captcha (2.3.0)
      rails (>= 5.2)
    io-console (0.8.0)
-    io-event (1.12.1)
+    io-event (1.14.5)
    ipaddress (0.8.3)
    irb (1.15.1)
      pp (>= 0.6.0)
@@ -1094,11 +1099,14 @@ GEM
      multipart-post
      oauth (~> 0.5, >= 0.5.0)
    jmespath (1.6.2)
+    js-routes (2.3.6)
+      railties (>= 5)
+      sorbet-runtime
    js_regex (3.13.0)
      character_set (~> 1.4)
      regexp_parser (~> 2.10)
      regexp_property_values (~> 1.0)
-    json (2.13.1)
+    json (2.19.2)
    json-jwt (1.16.6)
      activesupport (>= 4.2)
      aes_key_wrap
@@ -1106,7 +1114,7 @@ GEM
      bindata
      faraday (~> 2.0)
      faraday-follow_redirects
-    json_schemer (2.3.0)
+    json_schemer (2.4.0)
      bigdecimal
      hana (~> 1.3)
      regexp_parser (~> 2.0)
@@ -1133,8 +1141,8 @@ GEM
    kaminari-core (1.2.2)
    knapsack (4.0.0)
      rake
-    kramdown (2.5.1)
-      rexml (>= 3.3.9)
+    kramdown (2.5.2)
+      rexml (>= 3.4.4)
    kramdown-parser-gfm (1.1.0)
      kramdown (~> 2.0)
    kubeclient (4.12.0)
@@ -1182,7 +1190,7 @@ GEM
      activesupport (>= 4)
      railties (>= 4)
      request_store (~> 1.0)
-    loofah (2.25.0)
+    loofah (2.25.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
    lookbook (2.3.13)
@@ -1285,7 +1293,7 @@ GEM
    octokit (9.2.0)
      faraday (>= 1, < 3)
      sawyer (~> 0.9)
-    ohai (19.1.16)
+    ohai (19.1.24)
      base64
      chef-config (>= 14.12, < 20)
      chef-utils (>= 16.0, < 20)
@@ -1322,7 +1330,7 @@ GEM
    omniauth-github (2.0.1)
      omniauth (~> 2.0)
      omniauth-oauth2 (~> 1.8)
-    omniauth-google-oauth2 (1.2.1)
+    omniauth-google-oauth2 (1.2.2)
      jwt (>= 2.9.2)
      oauth2 (~> 2.0)
      omniauth (~> 2.0)
@@ -1566,7 +1574,7 @@ GEM
      activerecord (>= 6.1)
      request_store (~> 1.4)
    parallel (1.27.0)
-    parser (3.3.10.1)
+    parser (3.3.11.1)
      ast (~> 2.4.1)
      racc
    parslet (1.8.2)
@@ -1634,7 +1642,7 @@ GEM
    pyu-ruby-sasl (0.0.3.3)
    raabro (1.4.0)
    racc (1.8.1)
-    rack (2.2.22)
+    rack (2.2.23)
    rack-accept (0.4.5)
      rack (>= 0.4)
    rack-attack (6.8.0)
@@ -1865,8 +1873,8 @@ GEM
    rubyzip (2.4.1)
    rugged (1.9.0)
    safe_yaml (1.0.4)
-    safety_net_attestation (0.4.0)
-      jwt (~> 2.0)
+    safety_net_attestation (0.5.0)
+      jwt (>= 2.0, < 4.0)
    sanitize (6.0.2)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
@@ -1881,7 +1889,7 @@ GEM
    seed-fu (2.3.9)
      activerecord (>= 3.1)
      activesupport (>= 3.1)
-    selenium-webdriver (4.40.0)
+    selenium-webdriver (4.42.0)
      base64 (~> 0.2)
      logger (~> 1.4)
      rexml (~> 3.2, >= 3.2.5)
@@ -1956,6 +1964,7 @@ GEM
      yard-solargraph (~> 0.1)
    solargraph-rspec (0.5.4)
      solargraph (>= 0.52.0)
+    sorbet-runtime (0.6.12984)
    spamcheck (1.3.3)
      grpc (~> 1.63)
    spring (4.3.0)
@@ -2014,7 +2023,7 @@ GEM
      unicode-display_width (>= 1.1.1, < 3)
    terser (1.0.2)
      execjs (>= 0.3.0, < 3)
-    test-prof (1.5.2)
+    test-prof (1.6.1)
    test_file_finder (0.3.1)
      faraday (>= 1.0, < 3.0, != 2.0.0)
    text (1.3.1)
@@ -2030,7 +2039,7 @@ GEM
      citrus (~> 3.0, > 3.0)
      racc (~> 1.7)
    tomlrb (1.3.0)
-    tpm-key_attestation (0.12.0)
+    tpm-key_attestation (0.14.1)
      bindata (~> 2.4)
      openssl (> 2.0)
      openssl-signature_algorithm (~> 1.0)
@@ -2073,7 +2082,7 @@ GEM
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
    uber (0.1.0)
-    undercover (0.8.3)
+    undercover (0.8.4)
      base64
      bigdecimal
      imagen (>= 0.2.0)
@@ -2115,10 +2124,10 @@ GEM
      axiom-types (~> 0.1)
      coercible (~> 1.0)
      descendants_tracker (~> 0.0, >= 0.0.3)
-    vite_rails (3.0.19)
+    vite_rails (3.10.0)
      railties (>= 5.1, < 9)
      vite_ruby (~> 3.0, >= 3.2.2)
-    vite_ruby (3.9.2)
+    vite_ruby (3.10.1)
      dry-cli (>= 0.7, < 2)
      logger (~> 1.6)
      mutex_m
@@ -2128,20 +2137,19 @@ GEM
    warden (1.2.9)
      rack (>= 2.0.9)
    warning (1.5.0)
-    webauthn (3.0.0)
+    webauthn (3.4.3)
      android_key_attestation (~> 0.3.0)
-      awrence (~> 1.1)
      bindata (~> 2.4)
      cbor (~> 0.5.9)
      cose (~> 1.1)
      openssl (>= 2.2)
-      safety_net_attestation (~> 0.4.0)
-      tpm-key_attestation (~> 0.12.0)
+      safety_net_attestation (~> 0.5.0)
+      tpm-key_attestation (~> 0.14.0)
    webfinger (2.1.3)
      activesupport
      faraday (~> 2.0)
      faraday-follow_redirects
-    webmock (3.26.1)
+    webmock (3.26.2)
      addressable (>= 2.8.0)
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
@@ -2162,7 +2170,7 @@ GEM
    xpath (3.2.0)
      nokogiri (~> 1.8)
    yajl-ruby (1.4.3)
-    yard (0.9.37)
+    yard (0.9.38)
    yard-solargraph (0.1.0)
      yard (~> 0.9)
    zeitwerk (2.6.18)
@@ -2200,7 +2208,7 @@ DEPENDENCIES
  bcrypt (~> 3.1, >= 3.1.14)
  benchmark-ips (~> 2.14.0)
  benchmark-memory (~> 0.1)
-  bootsnap (~> 1.18.6)
+  bootsnap (~> 1.23.0)
  browser (~> 5.3.1)
  bullet (~> 8.0.0)
  bundler-checksum (~> 0.1.0)!
@@ -2214,7 +2222,7 @@ DEPENDENCIES
  concurrent-ruby (~> 1.1)
  connection_pool (~> 2.5.3)
  countries (~> 4.0.0)
-  coverband (= 6.1.7)
+  coverband (= 6.2.0)
  creole (~> 0.5.0)
  cssbundling-rails (= 1.4.3)
  csv_builder!
@@ -2222,7 +2230,6 @@ DEPENDENCIES
  database_cleaner-active_record (~> 2.2.0)
  debug (~> 1.11.0)
  declarative_policy (~> 2.1.0)
-  deprecation_toolkit (~> 2.2.3)
  derailed_benchmarks
  devfile (~> 0.5.0)
  device_detector
@@ -2265,14 +2272,14 @@ DEPENDENCIES
  gettext (~> 3.5, >= 3.5.1)
  gettext_i18n_rails (~> 1.13.0)
  git (~> 1.8)
-  gitaly (~> 18.8.0)
+  gitaly (~> 18.10.0)
  gitlab-active-context!
  gitlab-backup-cli!
  gitlab-chronic (~> 0.10.5)
  gitlab-cloud-connector (~> 1.45)
  gitlab-crystalball (~> 1.1.3)
  gitlab-dangerfiles (~> 4.10.0)
-  gitlab-duo-workflow-service-client (~> 0.6)!
+  gitlab-duo-workflow-service-client (~> 0.7)!
  gitlab-experiment (~> 1.3.0)
  gitlab-fog-azure-rm (~> 2.4.0)
  gitlab-gkg-proto (~> 0.7.0)
@@ -2292,15 +2299,15 @@ DEPENDENCIES
  gitlab-schema-validation!
  gitlab-sdk (~> 0.3.0)
  gitlab-secret_detection (< 1.0)
-  gitlab-security_report_schemas (= 0.1.3.min15.0.0.max15.2.3)
+  gitlab-security_report_schemas (= 0.2.0.min15.0.0.max15.2.4)
  gitlab-sidekiq-fetcher!
  gitlab-styles (~> 13.1.0)
  gitlab-topology-service-client (~> 0.1)!
  gitlab-utils!
  gitlab_chronic_duration (~> 0.12)
  gitlab_omniauth-ldap (~> 2.3.0)
-  gitlab_quality-test_tooling (~> 3.9.0)
-  gitlab_query_language (~> 0.23.0)
+  gitlab_quality-test_tooling (~> 3.10.0)
+  gitlab_query_language (~> 0.26.0)
  gon (~> 6.5.0)
  google-apis-androidpublisher_v3 (~> 0.92.0)
  google-apis-cloudbilling_v1 (~> 0.22.0)
@@ -2329,7 +2336,7 @@ DEPENDENCIES
  graphlyte (~> 1.0.0)
  graphql (= 2.5.11)
  graphql-docs (~> 5.2.0)
-  grpc (~> 1.78.0)
+  grpc (~> 1.80.0)
  gssapi (~> 1.3.1)
  guard-rspec
  gvltools (~> 0.4.0)
@@ -2344,13 +2351,14 @@ DEPENDENCIES
  i18n_data (~> 0.13.1)
  icalendar (~> 2.10.1)
  invisible_captcha (~> 2.3.0)
-  io-event (~> 1.12)
+  io-event (~> 1.14)
  ipaddress (~> 0.8.3)
  ipynbdiff!
  jira-ruby (~> 2.3.0)
+  js-routes (~> 2.3)
  js_regex (~> 3.8)
-  json (~> 2.13.0)
-  json_schemer (~> 2.3.0)
+  json (~> 2.19.0)
+  json_schemer (~> 2.4.0)
  jsonb_accessor (~> 1.4)
  jwt (~> 2.10.0)
  kaminari (~> 1.2.2)
@@ -2432,7 +2440,7 @@ DEPENDENCIES
  pact (~> 1.64)
  paper_trail (~> 16.0)
  parallel (~> 1.19)
-  parser (= 3.3.10.1)
+  parser (= 3.3.11.1)
  parslet (~> 1.8)
  peek (~> 1.1)
  pg (~> 1.6.1)
@@ -2483,7 +2491,6 @@ DEPENDENCIES
  ruby-progressbar (~> 1.10)
  ruby-saml (~> 1.18)
  rubyzip (~> 2.4.0)
-  rugged (~> 1.9)
  sanitize (~> 6.0.2)
  sd_notify (~> 0.1.0)
  seed-fu (~> 2.3.7)
@@ -2518,7 +2525,7 @@ DEPENDENCIES
  tanuki_emoji (~> 0.13)
  telesignenterprise (~> 2.6)
  terser (= 1.0.2)
-  test-prof (~> 1.5.0)
+  test-prof (~> 1.6.0)
  test_file_finder (~> 0.3.1)
  thrift (~> 0.22.0)
  timfel-krb5-auth (~> 0.8)
@@ -2534,8 +2541,8 @@ DEPENDENCIES
  validates_hostname (~> 1.0.13)
  version_sorter (~> 2.3)
  view_component (~> 3.23.2)
-  vite_rails (~> 3.0.17)
-  vite_ruby (~> 3.9.0)
+  vite_rails (~> 3.10.0)
+  vite_ruby (~> 3.10.1)
  vmstat (~> 2.3.0)
  warning (~> 1.5.0)
  webauthn (~> 3.0)
@@ -9,10 +9,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "05h6ly5jpdpvx18fvz8ryr86z0bxv3xkr9w0wg6l7qgmrdpqk1zx";
+      sha256 = "0q7kgz3kqlwanwaqzq2mp28vyk83y2lvmhmkrpd4ppaz06yw5ik9";
      type = "gem";
    };
-    version = "2.0.30";
+    version = "2.0.31";
  };
  action_dispatch-draw_all = {
    dependencies = [ "actionpack" ];
@@ -523,16 +523,6 @@ src: {
    };
    version = "1.9.2";
  };
-  awrence = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gj8f8c54r9cabkm41s59sa1ca5wpbipw7gq3sfl87x9296227fx";
-      type = "gem";
-    };
-    version = "1.2.1";
-  };
  aws-eventstream = {
    groups = [ "default" ];
    platforms = [ ];
@@ -739,10 +729,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1krd99p9828n07rcjjms56jaqv7v6s9pn7y6bppcfhhaflyn2r2r";
+      sha256 = "0clhya4p8lhjj7hp31inp321wgzb0b5wbwppmya5sw1dikl7400z";
      type = "gem";
    };
-    version = "3.1.21";
+    version = "3.1.22";
  };
  benchmark = {
    groups = [
@@ -846,10 +836,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0shg48ilaxn8ps8arvyb8pr6pqigdmccirks185c306dzychr3n3";
+      sha256 = "0n4ymlgik3xcg94h52dzmh583ss40rl3sn0kni63v56sq8g6l62k";
      type = "gem";
    };
-    version = "2.4.11";
+    version = "2.5.1";
  };
  binding_of_caller = {
    dependencies = [ "debug_inspector" ];
@@ -871,10 +861,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "003xl226y120cbq1n99805jw6w75gcz1gs941yz3h7li3qy3kqha";
+      sha256 = "057jsch213i42qgdsz2vg1b190n2xvvbi3hgprc8nmaqim2ly9f1";
      type = "gem";
    };
-    version = "1.18.6";
+    version = "1.23.0";
  };
  browser = {
    groups = [ "default" ];
@@ -971,10 +961,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0xqc7hdiw1ql42mklpfvqd2pyfsxmy55cpx0h9y0jlkpl1q96sw1";
+      sha256 = "1wklj5laypbvc23zy15amrhg0fwmwcy3p3affzhppxrxq9n8k8dg";
      type = "gem";
    };
-    version = "1.0.26";
+    version = "1.0.27";
  };
  carrierwave = {
    dependencies = [
@@ -997,10 +987,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1dsf9gjc2cj79vrnz2vgq573biqjw7ad4b0idm05xg6rb3y9gq4y";
+      sha256 = "1w3d5dhx4vjd707ihkcmq7fy78p5fgawcjdqw2byxnfw32gzgkbr";
      type = "gem";
    };
-    version = "0.5.9.8";
+    version = "0.5.10.1";
  };
  CFPropertyList = {
    dependencies = [
@@ -1290,10 +1280,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "00c6x4ha7qiaaf88qdbyf240mk146zz78rbm4qwyaxmwlmk7q933";
+      sha256 = "1rbdzl9n8ppyp38y75hw06s17kp922ybj6jfvhz52p83dg6xpm6m";
      type = "gem";
    };
-    version = "1.3.0";
+    version = "1.3.1";
  };
  countries = {
    dependencies = [
@@ -1318,10 +1308,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1kl48dkfy01jcpq7cbk455q655kv3sxr9jdcv4i728zglqijaw4l";
+      sha256 = "1awaiayn8fr81nkk04vqi4v4zjr3fkibcjvsc8vsnz93b5h94s97";
      type = "gem";
    };
-    version = "6.1.7";
+    version = "6.2.0";
  };
  crack = {
    dependencies = [ "safe_yaml" ];
@@ -1583,20 +1573,6 @@ src: {
    };
    version = "2.1.0";
  };
-  deprecation_toolkit = {
-    dependencies = [ "activesupport" ];
-    groups = [
-      "development"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "09i5rffqgn9idg7nk47zfhrf3lnwsjws1xlqxqkj7lncmrgdgnmi";
-      type = "gem";
-    };
-    version = "2.2.4";
-  };
  derailed_benchmarks = {
    dependencies = [
      "base64"
@@ -2759,10 +2735,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0aji3873pxn6gc5qkvnv5y9025mqk0p6h22yrpyz2b3yx9qpzv03";
+      sha256 = "0x1wpyy5mgn0523f4pyv7lpxs8b4s6pfvyi24nymd7vym9cjr85d";
      type = "gem";
    };
-    version = "3.5.1";
+    version = "3.5.2";
  };
  gettext_i18n_rails = {
    dependencies = [ "fast_gettext" ];
@@ -2800,10 +2776,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0dqm72anvgcic66zbsnn0l4jjimwdrcdk5hbf5kp9q89b12gajk8";
+      sha256 = "1v49b92vzc744pkl3ajg448p07lc7lc78ngm1fn86nc9l45rv03v";
      type = "gem";
    };
-    version = "18.8.3";
+    version = "18.10.0";
  };
  gitlab = {
    dependencies = [
@@ -2946,7 +2922,7 @@ src: {
      path = "${src}/vendor/gems/gitlab-duo-workflow-service-client";
      type = "path";
    };
-    version = "0.6";
+    version = "0.7";
  };
  gitlab-experiment = {
    dependencies = [
@@ -3142,6 +3118,7 @@ src: {
      "activesupport"
      "gitlab_quality-test_tooling"
      "rspec"
+      "test-prof"
    ];
    groups = [
      "development"
@@ -3227,10 +3204,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "01mbiqq9dfw2w68rh4bldgaldza4kg5rd440n3k9pj0bnsiglklr";
+      sha256 = "183ww04pc3dzaxdmip4318akfx50c92p7nigzw4sd9habcadxv6r";
      type = "gem";
    };
-    version = "0.39.3";
+    version = "0.40.0";
  };
  gitlab-security_report_schemas = {
    dependencies = [
@@ -3242,10 +3219,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1g8p0abh18h7xh84ga4a1z54qdixbsp7z62sab725vxlvln4lx1w";
+      sha256 = "1grrds0mr45mijagq6skk749m23jlrwjjldd4x1m20b1152prm3y";
      type = "gem";
    };
-    version = "0.1.3.min15.0.0.max15.2.3";
+    version = "0.2.0.min15.0.0.max15.2.4";
  };
  gitlab-sidekiq-fetcher = {
    dependencies = [
@@ -3301,7 +3278,13 @@ src: {
      "actionview"
      "activesupport"
      "addressable"
+      "batch-loader"
+      "bigdecimal"
+      "nokogiri"
+      "oj"
      "rake"
+      "toml-rb"
+      "yajl-ruby"
    ];
    groups = [ "monorepo" ];
    platforms = [ ];
@@ -3360,10 +3343,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0z3jsijb3q25pgyddhzyb30l58rk48pkj1m2dflfv3r7vv5jiszk";
+      sha256 = "0wi8fivbig3s8pifgby9hw36ax38wc2grb93w1dv3mv94cnplbjs";
      type = "gem";
    };
-    version = "3.9.0";
+    version = "3.10.1";
  };
  gitlab_query_language = {
    dependencies = [ "rb_sys" ];
@@ -3371,10 +3354,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0qanbk6c4j1rz6a81zipbr97b4k61vnac1f9ndfwzajyin4g8bda";
+      sha256 = "0pbcbv2r160sc26gbpjslg8vbrapgsznvf9v5z828v3n87hwaxil";
      type = "gem";
    };
-    version = "0.23.0";
+    version = "0.26.0";
  };
  globalid = {
    dependencies = [ "activesupport" ];
@@ -3636,10 +3619,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "04zswxhyakyr7kkc15p9r6r7xpsxv41ssf5b7b52vyn7qjnmnqr0";
+      sha256 = "0r8frzq74vxw790hfz78bzaf9rsjl6yhj2zpgpmygjlajxpjjizc";
      type = "gem";
    };
-    version = "1.52.1";
+    version = "1.62.0";
  };
  google-cloud-common = {
    dependencies = [
@@ -4030,10 +4013,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0n37kw2y42qvb0s154v99ggvypqlz4bg2yp1q4jkq9h1z56abs69";
+      sha256 = "0zfhcqjplzy63lg89zgrx6h8nxi007fh03krii5x7wx1qf5hrv9d";
      type = "gem";
    };
-    version = "1.78.1";
+    version = "1.80.0";
  };
  grpc-google-iam-v1 = {
    dependencies = [
@@ -4376,14 +4359,20 @@ src: {
    version = "0.24.2";
  };
  httpclient = {
-    groups = [ "default" ];
+    dependencies = [ "mutex_m" ];
+    groups = [
+      "default"
+      "development"
+      "monorepo"
+      "test"
+    ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "19mxmvghp7ki3klsxwrlwr431li7hm1lczhhj8z4qihl2acy8l99";
+      sha256 = "1j4qwj1nv66v3n9s4xqf64x2galvjm630bwa5xngicllwic5jr2b";
      type = "gem";
    };
-    version = "2.8.3";
+    version = "2.9.0";
  };
  i18n = {
    dependencies = [ "concurrent-ruby" ];
@@ -4494,10 +4483,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ky3rfkdf57kf3c03da0dhkb555150yxkh9kfylkan2kxkwnvjiv";
+      sha256 = "1cb3j76ybiq1sdjn93mmclxy5wps5lrnf2rfvhb391x369q3db38";
      type = "gem";
    };
-    version = "1.12.1";
+    version = "1.14.5";
  };
  ipaddress = {
    groups = [ "default" ];
@@ -4594,6 +4583,20 @@ src: {
    };
    version = "1.6.2";
  };
+  js-routes = {
+    dependencies = [
+      "railties"
+      "sorbet-runtime"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0x44b54yhwpdf1wyz12dshc382vwb04bkq51qx6yxwyxmnz20qm4";
+      type = "gem";
+    };
+    version = "2.3.6";
+  };
  js_regex = {
    dependencies = [
      "character_set"
@@ -4614,15 +4617,16 @@ src: {
      "danger"
      "default"
      "development"
+      "monorepo"
      "test"
    ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1z0gmgndcqrcp5hgmgfrf8qiq9c6g4ccfs98qrgsr2d78jxz8z4f";
+      sha256 = "1kw39sqnr0lprwsd2h0zx1ic96skhqf88i14xv7c8drcicqvvqg7";
      type = "gem";
    };
-    version = "2.13.1";
+    version = "2.19.2";
  };
  json-jwt = {
    dependencies = [
@@ -4653,10 +4657,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0dgbrps0ydiyxcgj5n4dny0cmzwj125x1s792l7m5jjrp1rs27wz";
+      sha256 = "093wb42zyy0a7kk7zxdvs0jivm0knlaz9lrsncjxjj2ppcbn3jsn";
      type = "gem";
    };
-    version = "2.3.0";
+    version = "2.4.0";
  };
  jsonb_accessor = {
    dependencies = [
@@ -4777,10 +4781,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "131nwypz8b4pq1hxs6gsz3k00i9b75y3cgpkq57vxknkv6mvdfw7";
+      sha256 = "1yh2gwpwhh0p4vc0aabzn0hb55av0wkcq3gh3w8zkdk69hh4598v";
      type = "gem";
    };
-    version = "2.5.1";
+    version = "2.5.2";
  };
  kramdown-parser-gfm = {
    dependencies = [ "kramdown" ];
@@ -5037,10 +5041,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1rk0n13c9nmk8di2x5gqk5r04vf8bkp7ff6z0b44wsmc7fndfpnz";
+      sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl";
      type = "gem";
    };
-    version = "2.25.0";
+    version = "2.25.1";
  };
  lookbook = {
    dependencies = [
@@ -5801,10 +5805,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1p8yimcg2wz7sqf8s6slla2izdclris4cgyyhm8j4kvbchcmix5y";
+      sha256 = "0n3prpm36kxxk0jx8qs90gj72382jw7az9rnqnaa88c35793ypx1";
      type = "gem";
    };
-    version = "19.1.16";
+    version = "19.1.24";
  };
  oj = {
    dependencies = [
@@ -5935,10 +5939,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1pdf3bx036l6ggz6lkkykv77m9k4jypwsiw1q7874czwh2v50768";
+      sha256 = "04dyy57rlgvrv69pq2pm4rsj658zbaqjy2a6i29qy10w4b8g7hvl";
      type = "gem";
    };
-    version = "1.2.1";
+    version = "1.2.2";
  };
  omniauth-oauth2 = {
    dependencies = [
@@ -6992,10 +6996,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1256ws3w3gnfqj7r3yz2i9y1y7k38fhjphxpybkyb4fds8jsgxh6";
+      sha256 = "0m2xqvn1la62hji1mn04y59giikww95p2hs0r4y2rrz3mdxcwyni";
      type = "gem";
    };
-    version = "3.3.10.1";
+    version = "3.3.11.1";
  };
  parslet = {
    groups = [
@@ -7404,10 +7408,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0hj5yq200wlq1clpdvh44pqwllbxll0k3gjajxnrcn95hxzhpky5";
+      sha256 = "175ni9qsai9x2ykwvdbd5dzfyncaxpyn6dhjxjw70iq60xz9vzm8";
      type = "gem";
    };
-    version = "2.2.22";
+    version = "2.2.23";
  };
  rack-accept = {
    dependencies = [ "rack" ];
@@ -8671,10 +8675,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1khq0y5w7lf2b9a220298hphf3pakd216jc9a4x4a9pdwxs2vgln";
+      sha256 = "1apjjd99bqsc22bfq66j27dp4im0amisy619hr9qbghdapfh3kf8";
      type = "gem";
    };
-    version = "0.4.0";
+    version = "0.5.0";
  };
  sanitize = {
    dependencies = [
@@ -8778,10 +8782,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0nsys7ghl99zn2n4zjw3bi697qqnm6pmmi7aaafln79whnlpmvqn";
+      sha256 = "0xywk9dlw8s5ahg56z4mhzv9x22197xfgijfbzf6rc43z78f3dqf";
      type = "gem";
    };
-    version = "4.40.0";
+    version = "4.42.0";
  };
  semver_dialects = {
    dependencies = [
@@ -9132,6 +9136,16 @@ src: {
    };
    version = "0.5.4";
  };
+  sorbet-runtime = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1r0gkq9p7261dfphyplbrp0iy4mchqcdcqq5468y38j7n6jj1zrz";
+      type = "gem";
+    };
+    version = "0.6.12984";
+  };
  spamcheck = {
    dependencies = [ "grpc" ];
    groups = [ "default" ];
@@ -9502,14 +9516,18 @@ src: {
    version = "1.0.2";
  };
  test-prof = {
-    groups = [ "test" ];
+    groups = [
+      "development"
+      "monorepo"
+      "test"
+    ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0xl51w3g37isibhs2l3s6a6f5ygg31bkx3n41rvv6i9pgpxkjn0q";
+      sha256 = "17j9cai2ykcndgn0800m9nb297sx0lpminxj8bcqw4bwkb1xjch3";
      type = "gem";
    };
-    version = "1.5.2";
+    version = "1.6.1";
  };
  test_file_finder = {
    dependencies = [ "faraday" ];
@@ -9666,10 +9684,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0v8y5dibsyskv1ncdgszhxwzq0gzmvb0zl7sgmx0xvsgy86dhcz1";
+      sha256 = "0gqr27hrmg35j7kcb6c2cx3xvkqfs42zpp9jcqw0mzbs79jy9m3z";
      type = "gem";
    };
-    version = "0.12.0";
+    version = "0.14.1";
  };
  traces = {
    groups = [ "default" ];
@@ -9914,10 +9932,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1wvldnkcry3q1mkssy87mi6kqmf8igb5pdj2xcki10p3kywf0am7";
+      sha256 = "176hb1i1fwknsvhzkyg3x981yhg97gdmzpq1ww38sb5vls9xz9lr";
      type = "gem";
    };
-    version = "0.8.3";
+    version = "0.8.4";
  };
  unf = {
    dependencies = [ "unf_ext" ];
@@ -10160,17 +10178,14 @@ src: {
      "railties"
      "vite_ruby"
    ];
-    groups = [
-      "development"
-      "test"
-    ];
+    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "005mbcprdhjqx27561mb54kssjwxwij157x6wya1yp60gdkl8p0r";
+      sha256 = "0yhh5b9zw87hvmv19micvrx187d00a9kfzgzv7l47h3h91ap2i4c";
      type = "gem";
    };
-    version = "3.0.19";
+    version = "3.10.0";
  };
  vite_ruby = {
    dependencies = [
@@ -10180,17 +10195,14 @@ src: {
      "rack-proxy"
      "zeitwerk"
    ];
-    groups = [
-      "development"
-      "test"
-    ];
+    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0wj9ia0s7vywn66pf2jn49pfsy5h5rncjjwhaymwq32r3f2pq2p1";
+      sha256 = "08nkhycypxqcyi7yxnmh2dinwsl924gk1lp7g096qqdcdgs82fzi";
      type = "gem";
    };
-    version = "3.9.2";
+    version = "3.10.1";
  };
  vmstat = {
    groups = [ "default" ];
@@ -10226,7 +10238,6 @@ src: {
  webauthn = {
    dependencies = [
      "android_key_attestation"
-      "awrence"
      "bindata"
      "cbor"
      "cose"
@@ -10238,10 +10249,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ri09bf640kkw4v6k2g90q2nw1mx2hsghhngaqgb7958q8id8xrz";
+      sha256 = "1z710ndfr9yajywhji8mr5gc3j3wnr0alq754q15nh7k73wgbrlv";
      type = "gem";
    };
-    version = "3.0.0";
+    version = "3.4.3";
  };
  webfinger = {
    dependencies = [
@@ -10268,10 +10279,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1mqw7ca931zmqgad0fq4gw7z3gwb0pwx9cmd1b12ga4hgjsnysag";
+      sha256 = "142cbab47mjxmg8gc89d94sd3h7an9ligh38r9n88wb3xbr5cibp";
      type = "gem";
    };
-    version = "3.26.1";
+    version = "3.26.2";
  };
  webrick = {
    groups = [
@@ -10423,16 +10434,16 @@ src: {
  };
  yard = {
    groups = [
-      "default"
      "development"
+      "test"
    ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "14k9lb9a60r9z2zcqg08by9iljrrgjxdkbd91gw17rkqkqwi1sd6";
+      sha256 = "03q1hf12csqy5q2inafzi44179zaq9n5yrb0k2j2llqhzcmbh7vj";
      type = "gem";
    };
-    version = "0.9.37";
+    version = "0.9.38";
  };
  yard-solargraph = {
    dependencies = [ "yard" ];
@@ -454,6 +454,7 @@ def commit_gitlab(old_version: str, new_version: str, new_rev: str) -> None:
            "pkgs/by-name/gi/gitlab-elasticsearch-indexer",
            "pkgs/by-name/gi/gitlab-kas",
            "pkgs/by-name/gi/gitlab-pages",
+            "pkgs/by-name/gi/gitlab-shell",
        ],
        cwd=NIXPKGS_PATH,
    )
@@ -3,6 +3,7 @@
  fetchFromGitHub,
  stdenv,
  lib,
+  fetchpatch,
  testers,

  # passthru
@@ -11,16 +12,24 @@

 buildGoModule (finalAttrs: {
  pname = "goshs";
-  version = "2.0.1";
+  version = "2.0.3";

  src = fetchFromGitHub {
    owner = "patrickhener";
    repo = "goshs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Lh4jUz6dtbAwC9ErQrHe5FtxjHLL2gBRTSqLtj33GTc=";
+    hash = "sha256-DdGzX1qVz8mA+T9l+V2n7r6ngtV1moypT3sLO7f4OcY=";
  };

-  vendorHash = "sha256-wn+t6xY4zUK6NE5kZSefHYGpMq5whFZ644ij5bDs50I=";
+  patches = [
+    # Fixes the build for 2.0.3
+    (fetchpatch {
+      url = "https://github.com/patrickhener/goshs/commit/dc4a86e846b5a2e6f7cc97a29a73367dea26f91a.patch";
+      hash = "sha256-yXVBxOAp37yVdI5JlFMzSuSwiUaF2gWOfy4GfBVkGSI=";
+    })
+  ];
+
+  vendorHash = "sha256-R0U/cytan8U9nE/qYHmDUlUfIYhZAcjV2v/uIlZPTCs=";

  ldflags = [
    "-s"
@@ -42,12 +51,11 @@ buildGoModule (finalAttrs: {
    "-skip=^TestGetIPv4Addr$"
  ];

-  # Disabled until https://github.com/patrickhener/goshs/issues/137 is resolved
-  # passthru.tests.version = testers.testVersion {
-  #   package = goshs;
-  #   command = "goshs -v";
-  #   version = "goshs ${finalAttrs.version}";
-  # };
+  passthru.tests.version = testers.testVersion {
+    package = goshs;
+    command = "goshs -v";
+    version = "goshs ${finalAttrs.version}";
+  };

  meta = {
    description = "Simple, yet feature-rich web server written in Go";
@@ -21,16 +21,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "halloy";
-  version = "2026.5";
+  version = "2026.6";

  src = fetchFromGitHub {
    owner = "squidowl";
    repo = "halloy";
    tag = finalAttrs.version;
-    hash = "sha256-K+kNn7GPNZWXkXS+hfOjdmaWEjina6Vy4FfAJGZ5cPE=";
+    hash = "sha256-5lgsZnjoajYQi7y+ZWhNSc2x9IpxkGEEDTnQC8NJaP4=";
  };

-  cargoHash = "sha256-ij08oI0IIihVoHY4RS1FGpkvsWLcjCv2fp8voAae+DI=";
+  cargoHash = "sha256-9EVJGXWE4kfTWs+Ekr13rweH/mcSNG7jmXOMjEMn4hM=";

  nativeBuildInputs = [
    copyDesktopItems
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "kyverno";
-  version = "1.17.1";
+  version = "1.17.2";

  src = fetchFromGitHub {
    owner = "kyverno";
    repo = "kyverno";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-/5ax23jkD+DlR9566ok09kXX0E0fZTH4x5/AyopKnr4=";
+    hash = "sha256-RB+X1+eZ7v6YWzVhy/73JamxGCWbHmBQavvAPh2fDCA=";
  };

  ldflags = [
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
    "-X github.com/kyverno/kyverno/pkg/version.BuildTime=1970-01-01_00:00:00"
  ];

-  vendorHash = "sha256-GTleFbdf7LYmtPaCYYpQ5NUdsP1nstzXIFJe75HajBY=";
+  vendorHash = "sha256-vko/06bHxyGc33lFWlAAf+H06qibjyZaElcRv/jn0sc=";

  subPackages = [ "cmd/cli/kubectl-kyverno" ];

@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenvNoCC,
+  python3Packages,
+  qt6,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "optiland-python-env";
+  # Inheriting src too, to hint nix-update
+  inherit (python3Packages.optiland) version src;
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    qt6.wrapQtAppsHook
+  ];
+  buildInputs = [
+    qt6.qtbase
+  ];
+
+  dontUnpack = true;
+  dontConfigure = true;
+
+  passthru = {
+    pythonPaths = python3Packages.requiredPythonModules (
+      [
+        python3Packages.optiland
+        python3Packages.python
+      ]
+      ++ python3Packages.optiland.passthru.optional-dependencies.gui
+      ++ python3Packages.optiland.passthru.optional-dependencies.torch
+    );
+    pythonPath =
+      lib.makeSearchPathOutput "out" python3Packages.python.sitePackages
+        finalAttrs.finalPackage.passthru.pythonPaths;
+    makeWrapperArgs = [
+      # leaving here room for potential additional arguments
+    ];
+  };
+
+  # Modelded after `python.buildEnv`'s postBuild, but we don't link paths at
+  # all, only create $out/bin/optiland (and potentially more) executable(s).
+  buildPhase = ''
+    mkdir -p $out/bin
+    cd ${python3Packages.optiland}/bin
+    for prg in *; do
+      if [ -f "$prg" ] && [ -x "$prg" ]; then
+        makeWrapper "${python3Packages.optiland}/bin/$prg" "$out/bin/$prg" \
+          --set NIX_PYTHONPREFIX "$out" \
+          --set NIX_PYTHONEXECUTABLE "${placeholder "out"}/bin/${python3Packages.python.executable}" \
+          --set NIX_PYTHONPATH ${finalAttrs.finalPackage.passthru.pythonPath} \
+          --set PYTHONNOUSERSITE "true" \
+          ${lib.concatStringsSep " " finalAttrs.finalPackage.passthru.makeWrapperArgs}
+      fi
+    done
+  '';
+
+  dontInstall = true;
+
+  meta = python3Packages.optiland.meta // {
+    description = python3Packages.optiland.meta.description + "; The GUI";
+    mainProgram = "optiland";
+  };
+})
@@ -1,25 +1,36 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchFromGitLab,
  libogg,
  libao,
+  autoreconfHook,
  pkg-config,
  flac,
  opusfile,
  libopusenc,
+  versionCheckHook,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "opus-tools";
  version = "0.2";

-  src = fetchurl {
-    url = "https://downloads.xiph.org/releases/opus/opus-tools-${finalAttrs.version}.tar.gz";
-    sha256 = "11pzl27s4vcz4m18ch72nivbhww2zmzn56wspb7rll1y1nq6rrdl";
+  src = fetchFromGitLab {
+    domain = "gitlab.xiph.org";
+    owner = "xiph";
+    repo = "opus-tools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Tr+xvZKu1nuachgN7GXwqFyJYPQ/sWqaVJQHWhLAt+k=";
  };
+  postPatch = ''
+    echo 'PACKAGE_VERSION="${finalAttrs.version}"' > package_version
+  '';

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
  buildInputs = [
    libogg
    libao
@@ -28,6 +39,12 @@ stdenv.mkDerivation (finalAttrs: {
    libopusenc
  ];

+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/opusenc";
+
  meta = {
    description = "Tools to work with opus encoded audio streams";
    homepage = "https://www.opus-codec.org/";
@@ -0,0 +1,51 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+}:
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "qlever-control";
+  version = "0.5.46";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "qlever-dev";
+    repo = "qlever-control";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vXSVrNfz4gRBCrTi0D+sXtfsAZwv7HO67zs7wh98cOY=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+    wheel
+  ];
+
+  dependencies = with python3Packages; [
+    argcomplete
+    psutil
+    pyyaml
+    rdflib
+    requests-sse
+    termcolor
+    tqdm
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "qlever"
+  ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Command-line tool for controlling the QLever graph database";
+    homepage = "https://github.com/qlever-dev/qlever-control";
+    mainProgram = "qlever";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ eljamm ];
+    teams = with lib.teams; [ ngi ];
+  };
+})
@@ -0,0 +1,170 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  pkg-config,
+  cmake,
+
+  boost,
+  bzip2,
+  icu,
+  openssl,
+  zlib,
+  zstd,
+  jemalloc,
+
+  nixosTests,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "qlever";
+  version = "0.5.46";
+
+  src = fetchFromGitHub {
+    owner = "ad-freiburg";
+    repo = "qlever";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UUfSWy1mImmyL7Ha2xCbxm9srdY/rTJS4oUJbJiDtwQ=";
+    fetchSubmodules = true;
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    bzip2
+    icu
+    jemalloc
+    openssl
+    zlib
+    zstd
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    # fixes error: inlining failed in call to 'always_inline' ... :
+    # function body can be overwritten at link time
+    "-fno-semantic-interposition"
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_BUILD_TYPE" "Release")
+    (lib.cmakeFeature "LOGLEVEL" "INFO")
+    (lib.cmakeBool "USE_PARALLEL" true)
+    (lib.cmakeBool "_NO_TIMING_TESTS" true)
+    (lib.cmakeBool "JEMALLOC_MANUALLY_INSTALLED" true)
+
+    # disable fetching external dependencies
+    (lib.cmakeBool "USE_CONAN" false)
+    (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
+  ]
+  ++ (with finalAttrs.passthru.deps; [
+    # map external dependencies to FetchContent names
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FSST" "${fsst}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_RE2" "${re2}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_GOOGLETEST" "${googletest}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_NLOHMANN-JSON" "${nlohmann-json}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_ANTLR" "${antlr}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_RANGE-V3" "${range-v3}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_SPATIALJOIN" "${spatialjoin}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_CTRE" "${ctre}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_ABSEIL" "${abseil}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_S2" "${s2}")
+  ]);
+
+  passthru = {
+    deps = {
+      fsst = fetchFromGitHub {
+        owner = "cwida";
+        repo = "fsst";
+        rev = "b228af6356196095eaf9f8f5654b0635f969661e";
+        hash = "sha256-XuE/nalt2HEYaII9NytUs0rCLGHOUFEclO+0h7pu4V0=";
+      };
+
+      re2 = fetchFromGitHub {
+        owner = "google";
+        repo = "re2";
+        rev = "bc0faab533e2b27b85b8ad312abf061e33ed6b5d";
+        hash = "sha256-cKXe8r5MUag/z+seem4Zg/gmqIQjaCY7DBxiKlrnXPs=";
+      };
+
+      googletest = fetchFromGitHub {
+        owner = "google";
+        repo = "googletest";
+        rev = "7917641ff965959afae189afb5f052524395525c";
+        hash = "sha256-Pfkx/hgtqryPz3wI0jpZwlRRco0s2FLcvUX1EgTGFIw=";
+      };
+
+      nlohmann-json = fetchFromGitHub {
+        owner = "nlohmann";
+        repo = "json";
+        tag = "v3.12.0";
+        hash = "sha256-cECvDOLxgX7Q9R3IE86Hj9JJUxraDQvhoyPDF03B2CY=";
+      };
+
+      antlr = fetchFromGitHub {
+        owner = "antlr";
+        repo = "antlr4";
+        rev = "cc82115a4e7f53d71d9d905caa2c2dfa4da58899";
+        hash = "sha256-DxxRL+FQFA+x0RudIXtLhewseU50aScHKSCDX7DE9bY=";
+      };
+
+      range-v3 = fetchFromGitHub {
+        owner = "joka921";
+        repo = "range-v3";
+        rev = "42340ef354f7b4e4660268b788e37008d9cc85aa";
+        hash = "sha256-/17XLLLuEkcqeklVtqlgtu19tNTT3bLRHrU1aOPLhTw=";
+      };
+
+      spatialjoin = fetchFromGitHub {
+        owner = "ad-freiburg";
+        repo = "spatialjoin";
+        rev = "c358e479ebb5f40df99522e69a0b52d73416020b";
+        hash = "sha256-/BQzyCx1KxnOeLLZkvqno2KN/VHAEu228zrsJaqYu/c=";
+        fetchSubmodules = true;
+      };
+
+      ctre = fetchFromGitHub {
+        owner = "hanickadot";
+        repo = "compile-time-regular-expressions";
+        rev = "e34c26ba149b9fd9c34aa0f678e39739641a0d1e";
+        hash = "sha256-/44oZi6j8+a1D6ZGZpoy82GHjPtqzOvuS7d3SPbH7fs=";
+      };
+
+      abseil = fetchFromGitHub {
+        owner = "abseil";
+        repo = "abseil-cpp";
+        rev = "93ac3a4f9ee7792af399cebd873ee99ce15aed08";
+        hash = "sha256-a18+Yj9fvDigza4b2g38L96hge5feMwU6fgPmL/KVQU=";
+      };
+
+      s2 = fetchFromGitHub {
+        owner = "google";
+        repo = "s2geometry";
+        rev = "5b5eccd54a08ae03b4467e79ffbb076d0b5f221e";
+        hash = "sha256-VjgGcGgQlKmjUq+JU0JpyhOZ9pqwPcBUFEPGV9XoHc0=";
+      };
+    };
+
+    tests = nixosTests.qlever;
+
+    updateScript = ./update.sh;
+  };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Graph database implementing the RDF and SPARQL standards";
+    homepage = "https://github.com/ad-freiburg/qlever";
+    mainProgram = "qlever";
+    platforms = lib.platforms.all;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ eljamm ];
+    teams = with lib.teams; [ ngi ];
+  };
+})
@@ -0,0 +1,168 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p bash nix curl jq gawk gnused nixfmt
+
+set -euo pipefail
+
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+FILE_PATH="$SCRIPT_DIR/package.nix"
+
+LATEST_TAG=$(curl -s https://api.github.com/repos/ad-freiburg/qlever/releases/latest | jq -r '.tag_name')
+
+VERSION_OLD="${UPDATE_NIX_OLD_VERSION:-$(grep -oP '(?<=version = ")[^"]+' "$FILE_PATH")}"
+VERSION_NEW="${LATEST_TAG#v}"
+
+if [[ "$VERSION_NEW" == "$VERSION_OLD" ]]; then
+    echo "QLever already up to date: $VERSION_NEW"
+    exit 0
+fi
+
+CMAKE_URL="https://raw.githubusercontent.com/ad-freiburg/qlever/$LATEST_TAG/CMakeLists.txt"
+CMAKE_FILE=$(curl -s "$CMAKE_URL")
+
+prefetch_github_hash() {
+    local owner=$1
+    local repo=$2
+    local rev=$3
+    local fetch_submodules=${4:-false}
+
+    local expr="with import <nixpkgs> {}; fetchFromGitHub { \
+        owner = \"$owner\"; \
+        repo = \"$repo\"; \
+        rev = \"$rev\"; \
+        fetchSubmodules = $fetch_submodules; \
+        hash = \"\"; \
+    }"
+
+    output=$(nix-build --no-out-link -E "$expr" 2>&1)
+
+    echo "$output" | awk '/got:/ {print $NF}'
+}
+
+# Extract the pinned revision/tag for a FetchContent_Declare block.
+extract_git_tag() {
+    local dep_name=$1
+    local result
+
+    result=$(echo "$CMAKE_FILE" | awk -v dep="$dep_name" '
+        /FetchContent_Declare\(/ { expect_name=1; next }
+        expect_name {
+            gsub(/^[[:space:]]+|[[:space:]]+$/, "", $0)
+            in_block = ($0 == dep)
+            expect_name = 0
+            next
+        }
+        in_block && /GIT_TAG/ {
+            for (i=1; i<=NF; i++)
+                if ($i == "GIT_TAG") { print $(i+1); exit }
+        }
+        in_block && /[[:space:]]URL[[:space:]]/ && !/URL_HASH/ {
+            for (i=1; i<=NF; i++)
+                if ($i == "URL") { print "URL:" $(i+1); exit }
+        }
+        in_block && /^[[:space:]]*\)/ { in_block=0 }
+    ')
+
+    if [[ "$result" == URL:* ]]; then
+        # e.g. .../download/v3.12.0/json.tar.xz -> v3.12.0
+        echo "${result#URL:}" | grep -Po '(?<=/download/)[^/]+'
+    else
+        echo "$result"
+    fi
+}
+
+# Get the current revision/tag for a fetchFromGitHub block.
+get_current_git_tag() {
+    local attr_name=$1
+    local type=$2
+
+    awk "/$attr_name = fetchFromGitHub/,/};/" "$FILE_PATH" |
+        sed -n "s/.*$type = \"\([^\"]*\)\".*/\1/p"
+}
+
+FAILED=()
+
+update_dep() {
+    local cmake_dep=$1
+    local owner=$2
+    local repo=$3
+    local type=${4:-rev}
+    local submodules=${5:-false}
+
+    echo "- $cmake_dep:"
+
+    rev=$(extract_git_tag "$cmake_dep")
+    if [ -z "$rev" ]; then
+        echo "    Error: could not find GIT_TAG for '$cmake_dep' in CMakeLists.txt"
+        FAILED+=("$cmake_dep")
+        return 0
+    fi
+
+    current_rev=$(get_current_git_tag "$cmake_dep" "$type")
+    if [ "$current_rev" = "$rev" ]; then
+        echo "    Skipping: $type already up to date ($rev)"
+        return 0
+    fi
+
+    echo "    $type: $current_rev -> $rev. Prefetching hash..."
+
+    hash=$(prefetch_github_hash "$owner" "$repo" "$rev" "$submodules")
+    if [ -z "$hash" ]; then
+        echo "    Error: Failed to prefetch hash for $owner/$repo@$rev (Is the repository/rev valid?)"
+        FAILED+=("$cmake_dep")
+        return 0
+    fi
+
+    sed -i "/$cmake_dep = fetchFromGitHub {/,/};/ s|$type = \".*\";|$type = \"$rev\";|" "$FILE_PATH"
+    sed -i "/$cmake_dep = fetchFromGitHub {/,/};/ s|hash = \".*\";|hash = \"$hash\";|" "$FILE_PATH"
+    echo "    Done."
+}
+
+echo "Updating QLever to $VERSION_NEW"
+
+sed -i "s|version = \"$VERSION_OLD\"|version = \"$VERSION_NEW\"|" "$FILE_PATH"
+
+HASH=$(prefetch_github_hash "ad-freiburg" "qlever" "$LATEST_TAG" true)
+sed -i "/src = fetchFromGitHub {/,/};/ s|hash = \".*\";|hash = \"$HASH\";|" "$FILE_PATH"
+
+echo ""
+echo "Updating dependencies:"
+
+# NOTE: cmake_dep must match the identifier on the line after FetchContent_Declare(
+
+# Read configuration line-by-line. Skip empty lines and comments.
+while read -r cmake_dep owner repo type submodules; do
+    [[ -z "$cmake_dep" || "$cmake_dep" == \#* ]] && continue
+
+    # use "-" as a placeholder for visual alignment
+    [[ "$type" == "-" ]] && type=""
+    [[ "$submodules" == "-" ]] && submodules=""
+
+    update_dep "$cmake_dep" "$owner" "$repo" "${type:-rev}" "${submodules:-false}"
+done <<'EOF'
+# CMAKE_DEP        OWNER         REPO                                TYPE  SUBMODULES
+fsst               cwida         fsst                                -     -
+re2                google        re2                                 -     -
+googletest         google        googletest                          -     -
+nlohmann-json      nlohmann      json                                tag   -
+antlr              antlr         antlr4                              -     -
+range-v3           joka921       range-v3                            -     -
+spatialjoin        ad-freiburg   spatialjoin                         -     true
+ctre               hanickadot    compile-time-regular-expressions    -     -
+abseil             abseil        abseil-cpp                          -     -
+s2                 google        s2geometry                          -     -
+EOF
+
+echo ""
+echo "Formatting $FILE_PATH"
+
+nixfmt "$FILE_PATH"
+
+if [ ${#FAILED[@]} -gt 0 ]; then
+    echo ""
+    echo "Warning: the following deps could not be updated:"
+    printf '  - %s\n' "${FAILED[@]}"
+    exit 1
+fi
+
+echo ""
+echo "All dependencies updated for QLever $LATEST_TAG"
@@ -25,13 +25,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "radicle-desktop";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromRadicle {
    seed = "seed.radicle.xyz";
    repo = "z4D5UCArafTzTQpDZNQRuqswh3ury";
    tag = "releases/${finalAttrs.version}";
-    hash = "sha256-ruBHhJ0JvbtXd0GonL5rNp733mulVSQJsVzkikQKCK0=";
+    hash = "sha256-Tlb2RVhFUcfJZy5/FyJuSpkRZ0ZxhLe5ynAK2y7+f1Q=";
    leaveDotGit = true;
    postFetch = ''
      git -C $out rev-parse --short HEAD > $out/.git_head
@@ -55,7 +55,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    hash = "sha256-x0u75on1Kc+u1u1R1SLLOfmTG5kFVvn2PsaWdH/RB3w=";
  };

-  cargoHash = "sha256-z5fnwc7EjSvkyu4zTUyAvVfs6quwH2p9VFDK/TdzZJE=";
+  cargoHash = "sha256-ojb1gT2dOhdvUHxKR51t0EKjZdgCXYxzhC0lmh87Uq0=";

  twemojiAssets = fetchFromGitHub {
    owner = "twitter";
@@ -4,6 +4,7 @@
  git,
  grype,
  nix,
+  nixVersions,
  nix-visualize,
  python3,
  vulnix,
@@ -30,7 +31,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    "--prefix PATH : ${
      lib.makeBinPath [
        git
-        nix
+        # nix
+        # TODO: remove once sbomnix support new JSON format: https://github.com/tiiuae/sbomnix/issues/267
+        nixVersions.nix_2_31
        python3.pkgs.graphviz
        nix-visualize
        vulnix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "scooter";
-  version = "0.9.0";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "thomasschafer";
    repo = "scooter";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-AcHPJu8aDvrQVEXvvwj7f4v1vQ0dinA6da940zTOsYg=";
+    hash = "sha256-4pekZhk8g4BzyhNqWLocP24bLKpr0kLepRzp+NYfX1I=";
  };

-  cargoHash = "sha256-DNsQGbZSlNK7O4KcCtHAabe/XotlHykvSP6FI2+KFqQ=";
+  cargoHash = "sha256-Ac+iCZ2WoRq7yP9YlT9hp0grsMPny/JdYBrdWiSj/L8=";

  # Ensure that only the `scooter` package is built (excluding `xtask`)
  cargoBuildFlags = [
@@ -12,13 +12,13 @@

 buildGoModule (finalAttrs: {
  pname = "sendspin-go";
-  version = "1.5.0";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "Sendspin";
    repo = "sendspin-go";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vywxcGCDwJbOnQA4hW4SNxaRauokyGJbZA7u1UzKpWk=";
+    hash = "sha256-kCTW9eOSC/15c2PaXWiWsAqEOCWodKYcptqtWAQc9fQ=";
  };

  __structuredAttrs = true;
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "sentry-native";
-  version = "0.13.6";
+  version = "0.13.7";

  src = fetchFromGitHub {
    owner = "getsentry";
    repo = "sentry-native";
    tag = finalAttrs.version;
-    hash = "sha256-4ZHA/sUHAhYwduLPbFQ3Ju8Pjdz14oiIcSvpFMrbkgE=";
+    hash = "sha256-TrczlrPn9b0i5uJmt0bd0XOuH+R8WXIV2WQxLRnFYgA=";
  };

  nativeBuildInputs = [
@@ -7,13 +7,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "slint-tr-extractor";
-  version = "1.15.1";
+  version = "1.16.1";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-xpsoW/GgjlG0Jitj7aXv1dUxLm8f4OuPWWlOqxNIvQo=";
+    hash = "sha256-y3hsZ4a3tf2CDa6pkO928xZxeWAwsxK+H2LTa7MhcFs=";
  };
-  cargoHash = "sha256-XPUbSzdttHuV4s0UufrUbCjnGv/pESF+2/Qb5dvHYyM=";
+  cargoHash = "sha256-qmLELQ/PNMUW+XMsJGPK2CnqnLAhc3W4KqtizdxFGMM=";
  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];

@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "snapraid";
-  version = "14.3";
+  version = "14.4";

  src = fetchFromGitHub {
    owner = "amadvance";
    repo = "snapraid";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ULE+CtIcsmISK3qwbTGg2xGBHvJKkZjCeH+/0Et1b9M=";
+    hash = "sha256-zkKdJwRcOmrSWX7CHHTAlL2GYbVjLkNVFficBum86F8=";
  };

  env.VERSION = finalAttrs.version;
@@ -12,7 +12,7 @@

 ocamlPackages.buildDunePackage (finalAttrs: {
  pname = "soupault";
-  version = "5.2.1";
+  version = "5.3.0";

  minimalOCamlVersion = "5.3";

@@ -21,7 +21,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
      "https://github.com/PataphysicalSociety/soupault/archive/${finalAttrs.version}.tar.gz"
      "https://codeberg.org/PataphysicalSociety/soupault/archive/${finalAttrs.version}.tar.gz"
    ];
-    hash = "sha256-jwVos7KeQ6fBuBWUslFyvrwDuJ3Wgb7pieERm9+b3Zg=";
+    hash = "sha256-HrvLQQdjTISMO+9KPhRuEGyajFaOLGEevnaGUYzgz6M=";
  };

  nativeBuildInputs = [
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "stc";
-  version = "1.5.4";
+  version = "1.5.5";

  src = fetchFromGitHub {
    owner = "tenox7";
    repo = "stc";
    rev = finalAttrs.version;
-    sha256 = "sha256-ftlq7vrnTb4N2bqwiF9gtRj7hZlo6PTUMb/bk2hn/cU=";
+    sha256 = "sha256-/h5T7xzUvguHhrE1DyIep/z7Xt1jNdDFtWeQdpwq6iE=";
  };

-  vendorHash = "sha256-qLpWXikTr+vB2bIw2EqnoJ0uOxUc/qc6SdGEJQXwmTQ=";
+  vendorHash = "sha256-M86CoiTN03a7cXtUobsO8CYmfcRsVrHaekIPiYIeV50=";

  ldflags = [ "-X main.GitTag=${finalAttrs.version}" ];

@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "telemt";
-  version = "3.3.28";
+  version = "3.4.5";

  src = fetchFromGitHub {
    owner = "telemt";
    repo = "telemt";
    tag = version;
-    hash = "sha256-u5/HiFIinKvpTItUsBnLhsGhAXN3V2qeeUGmvcFlJI8=";
+    hash = "sha256-zOdVnW7RTPAbR6fpzDqPpwhOWjxknmg8TzGXmBCbWjg=";
  };

-  cargoHash = "sha256-FGXdWhjqlb0urBtSbU1afebgy3a/CLGB+aHv3ccIiy8=";
+  cargoHash = "sha256-/7Xd/6NEu6QqFdVUz4M+iz9+7K5lEDguyaprAKh86wo=";

  meta = {
    mainProgram = "telemt";
@@ -1,14 +1,14 @@
 {
  "darwin": {
-    "hash": "sha256-gkXz9pkv/0T9TR+wGj8PU7JOC4qEbCHoKSei6xdL8Qs=",
-    "version": "0.2026.04.08.08.36.stable_05"
+    "hash": "sha256-Mff9jfrWQJ2YovS+yW7/NhwGDGASIvUFEAaH04YF6rw=",
+    "version": "0.2026.04.15.08.45.stable_04"
  },
  "linux_x86_64": {
-    "hash": "sha256-Vt6NPu5u7LMnP8sxpl8p3JZSk3ymFf4PZmNdmiVMCO0=",
-    "version": "0.2026.04.08.08.36.stable_05"
+    "hash": "sha256-tGhC+pjPQTTd5XTKwQJ/ctnLcQY6lvvI6zRjXByon5g=",
+    "version": "0.2026.04.15.08.45.stable_04"
  },
  "linux_aarch64": {
-    "hash": "sha256-ZaZoRRUAxuemXS+vkIlP5skr1BpT5nWOI2jjVjCK+gw=",
-    "version": "0.2026.04.08.08.36.stable_05"
+    "hash": "sha256-U7gctUpWhJP2hfF62I7wh/cdE9ixVEVnKd6B1dOoLfc=",
+    "version": "0.2026.04.15.08.45.stable_04"
  }
 }
@@ -28,14 +28,14 @@ let
  nodejs = nodejs_22;

  pname = "zotero";
-  version = "9.0.0";
+  version = "9.0.1";

  src = fetchFromGitHub {
    owner = "zotero";
    repo = "zotero";
    tag = version;
    fetchSubmodules = true;
-    hash = "sha256-70kVFnypdF3YDXfrA+BFSoGkBfQAjDVa2pWOmaoetBI=";
+    hash = "sha256-51JSDrvvrwnmuxn7YZd8e0by4CJODvflHi4M4GAt2Lw=";
  };

  pdf-js = buildNpmPackage {
@@ -2,6 +2,7 @@
  lib,
  mkCoqDerivation,
  coq,
+  stdlib,
  version ? null,
 }:
 mkCoqDerivation {
@@ -12,11 +13,13 @@ mkCoqDerivation {
    with lib.versions;
    lib.switch coq.version [
      {
-        case = range "8.12" "8.20";
-        out = "0.5.4";
+        case = range "8.12" "9.2";
+        out = "0.5.6";
      }
    ] null;
  release = {
+    "0.5.6".sha256 = "sha256-ox9GaUsh/tWJGEPawPnNqXULI0kYglKmNmiTL8dF3uU=";
+    "0.5.5".sha256 = "sha256-Z7+alcN63hxJOtBAXPg9ExNdwS2SiB63ZjDEnPhGi6g=";
    "0.5.4".sha256 = "sha256-PaEC71FzJzHVGYpf3J1jvb/JsJzzMio0L5d5dPwiXuc=";
    "0.5.3".sha256 = "sha256-Myxwy749ZCBpqia6bf91cMTyJn0nRzXskD7Ue8kc37c=";
    "0.5.2".sha256 = "sha256-jf16EyLAnKm+42K+gTTHVFJqeOVQfIY2ozbxIs5x5DE=";
@@ -24,6 +27,7 @@ mkCoqDerivation {
    "0.5.0".sha256 = "sha256-Jq0LnR7TgRVcPqh8Ha6tIIK3KfRUgmzA9EhxeySgPnM=";
  };
  releaseRev = v: "v${v}";
+  propagatedBuildInputs = [ stdlib ];
  installPhase = ''
    make -f Makefile.coq COQMF_COQLIB=$out/lib/coq/${coq.coq-version}/ install
  '';
@@ -1,10 +1,39 @@
-{ backendStdenv, buildRedist }:
+{
+  lib,
+  backendStdenv,
+  buildRedist,
+  glibc,
+}:
 buildRedist {
  redistName = "cuda";
  pname = "cuda_crt";

  outputs = [ "out" ];

+  # Fix compatibility with glibc 2.42:
+  # CUDA >= 13.0 fixed sinpi/cospi (using __NV_IEC_60559_FUNCS_EXCEPTION_SPECIFIER), but
+  # rsqrt/rsqrtf in math_functions.h still lack noexcept, conflicting with glibc 2.42's
+  # declarations.
+  postInstall = lib.optionalString (lib.versionAtLeast glibc.version "2.42") ''
+    nixLog "Patching math_functions.h rsqrt signatures to match glibc's ones"
+    substituteInPlace "''${!outputInclude:?}/include/crt/math_functions.h" \
+      --replace-fail \
+        "rsqrt(double x);" \
+        "rsqrt(double x) noexcept (true);" \
+      --replace-fail \
+        "rsqrtf(float x);" \
+        "rsqrtf(float x) noexcept (true);"
+
+    nixLog "Patching math_functions.hpp rsqrt signatures to match glibc's ones"
+    substituteInPlace "''${!outputInclude:?}/include/crt/math_functions.hpp" \
+      --replace-fail \
+        "__func__(double rsqrt(const double a))" \
+        "__func__(double rsqrt(const double a) throw())" \
+      --replace-fail \
+        "__func__(float rsqrtf(const float a))" \
+        "__func__(float rsqrtf(const float a) throw())"
+  '';
+
  brokenAssertions = [
    # TODO(@connorbaker): Build fails on x86 when using pkgsLLVM.
    #  .../include/crt/host_defines.h:67:2:
@@ -168,6 +168,11 @@ buildRedist (finalAttrs: {
      # The cospi|sinpi|rsqrt function signatures in include/common/math_functions.h do not match
      # glibc 2.42's.
      # Indeed, there they are declared with noexcept(true) which is not the case in cuda_nvcc.
+      # - In CUDA < 13.0, sinpi/cospi/rsqrt all lack exception specifiers.
+      # - In CUDA >= 13.0, NVIDIA fixed sinpi/cospi (using __NV_IEC_60559_FUNCS_EXCEPTION_SPECIFIER)
+      #   but rsqrt/rsqrtf still lack noexcept, so we only patch those.
+      #   As the CRT headers (including math_functions.h) moved to the cuda_crt package, the glibc
+      #   2.42 compatibility patch is applied there instead.
      + lib.optionalString (cudaOlder "13.0" && lib.versionAtLeast glibc.version "2.42") ''
        nixLog "Patching math_functions.h signatures to match glibc's ones"
        substituteInPlace "''${!outputInclude:?}/include/crt/math_functions.h" \
@@ -213,6 +218,7 @@ buildRedist (finalAttrs: {
            "__func__(float cospif(const float a))" \
            "__func__(float cospif(const float a) throw())"
      ''
+
      # Fix clang CUDA compilation: host_defines.h redefines __noinline__ as
      # __attribute__((noinline)), which conflicts with libstdc++ >=12 using
      # __attribute__((__noinline__)) — the macro expands to
@@ -1,6 +1,6 @@
 genericBuilder:

 genericBuilder {
-  version = "28.4.3";
-  hash = "sha256-ZINtOyF84bRkmwf4xdlYzyXEWHDCiX3wMH12STecvBo=";
+  version = "28.5";
+  hash = "sha256-A4gIjfWsrfZR89xNWyynTAdJtGj6ZWth3xIQBMLqcpc=";
 }
@@ -1,34 +1,10 @@
-# Generic builder for tcl packages/applications, generally based on mk-python-derivation.nix
+# Generic builder for tcl packages/applications
 {
  tcl,
  lib,
  makeWrapper,
-  runCommand,
-  writeScript,
 }:

-{
-  buildInputs ? [ ],
-  nativeBuildInputs ? [ ],
-  propagatedBuildInputs ? [ ],
-  checkInputs ? [ ],
-  nativeCheckInputs ? [ ],
-
-  # true if we should skip the configuration phase altogether
-  dontConfigure ? false,
-
-  # Extra flags passed to configure step
-  configureFlags ? [ ],
-
-  # Whether or not we should add common Tcl-related configure flags
-  addTclConfigureFlags ? true,
-
-  meta ? { },
-  passthru ? { },
-  doCheck ? true,
-  ...
-}@attrs:
-
 let
  inherit (tcl) stdenv;
  inherit (lib) getBin optionalAttrs;
@@ -41,20 +17,35 @@ let
    "--enable-stubs"
  ];

-  self = (
-    stdenv.mkDerivation (
-      (removeAttrs attrs [
-        "addTclConfigureFlags"
-        "checkPhase"
-        "checkInputs"
-        "nativeCheckInputs"
-        "doCheck"
-      ])
-      // {
+in
+lib.extendMkDerivation {
+  constructDrv = stdenv.mkDerivation;
+  excludeDrvArgNames = [
+    "addTclConfigureFlags"
+    "checkPhase"
+    "checkInputs"
+    "nativeCheckInputs"
+    "doCheck"
+  ];
+  extendDrvArgs =
+    finalAttrs:
+    args@{
+      # true if we should skip the configuration phase altogether
+      dontConfigure ? false,
+
+      # Extra flags passed to configure step
+      configureFlags ? [ ],
+
+      # Whether or not we should add common Tcl-related configure flags
+      addTclConfigureFlags ? true,
+      ...
+    }:
+    (
+      {
+        buildInputs = args.buildInputs or [ ] ++ [ tcl.tclPackageHook ];

-        buildInputs = buildInputs ++ [ tcl.tclPackageHook ];
        nativeBuildInputs =
-          nativeBuildInputs
+          args.nativeBuildInputs or [ ]
          ++ [
            makeWrapper
            tcl
@@ -62,18 +53,14 @@ let
          ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
            tcl.tclRequiresCheckHook
          ];
-        propagatedBuildInputs = propagatedBuildInputs ++ [ tcl ];

-        env = {
-          TCLSH = "${getBin tcl}/bin/tclsh";
-        }
-        // (attrs.env or { });
+        propagatedBuildInputs = args.propagatedBuildInputs or [ ] ++ [ tcl ];

        # Run tests after install, at which point we've done all TCLLIBPATH setup
        doCheck = false;
-        doInstallCheck = attrs.doCheck or (attrs.doInstallCheck or false);
-        installCheckInputs = checkInputs ++ (attrs.installCheckInputs or [ ]);
-        nativeInstallCheckInputs = nativeCheckInputs ++ (attrs.nativeInstallCheckInputs or [ ]);
+        doInstallCheck = args.doCheck or (args.doInstallCheck or false);
+        installCheckInputs = args.checkInputs or [ ] ++ args.installCheckInputs or [ ];
+        nativeInstallCheckInputs = args.nativeCheckInputs or [ ] ++ args.nativeInstallCheckInputs or [ ];

        # Add typical values expected by TEA for configureFlags
        configureFlags =
@@ -82,17 +69,19 @@ let
          else
            configureFlags;

+        env = {
+          TCLSH = "${getBin tcl}/bin/tclsh";
+        }
+        // args.env or { };
+
        meta = {
          platforms = tcl.meta.platforms;
        }
-        // meta;
+        // args.meta or { };

      }
-      // optionalAttrs (attrs ? checkPhase) {
-        installCheckPhase = attrs.checkPhase;
+      // optionalAttrs (args ? checkPhase) {
+        installCheckPhase = args.checkPhase;
      }
-    )
-  );
-
-in
-lib.extendDerivation true passthru self
+    );
+}
@@ -5,8 +5,8 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert

 import ./generic.nix {
-  version = "3.123";
-  hash = "sha256-Ue98HQIvVWcn42xrbheOAdZmvfAdOTWp83VhHSGuAVc=";
+  version = "3.123.1";
+  hash = "sha256-SwgcOG0nl1oCOhy7Supxz1KigPozSrDCloypVaFMSOc=";
  filename = "latest.nix";
  versionRegex = "NSS_(\\d+)_(\\d+)(?:_(\\d+))?_RTM";
 }
@@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.42.93";
+  version = "1.42.95";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-wfZXcxWdaZOPbxgVOQRuYKu7A5BIgWa+2Z73Al6Z2+Y=";
+    hash = "sha256-5sPTA/eUY0vj21nWNr/p1Key5ZZjYraRE/PBD6BjcFQ=";
  };

  build-system = [ setuptools ];
@@ -13,14 +13,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "claude-agent-sdk";
-  version = "0.1.60";
+  version = "0.1.66";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "anthropics";
    repo = "claude-agent-sdk-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4pDR8YkzF5tt6JlWN5zfNxQah7hz97bqeputPUstqfY=";
+    hash = "sha256-Y8mWJDw/pYrNuA9tm3nAWplin+zGbd/x/I2KnKI8oww=";
  };

  build-system = [ hatchling ];
@@ -48,6 +48,8 @@ buildPythonPackage rec {
    "test_expr_asserts_ok"
    "test_fuzz_math_floats"
    "test_model_skip_helpers2"
+    # test does not pass on python314 because an error message has changed
+    "test_type_error__table"
  ];

  meta = {
@@ -8,7 +8,6 @@
  setuptools,

  # env
-  symlinkJoin,
  cudaPackages,

  # buildInputs
@@ -20,11 +19,6 @@
  cudaSupport ? config.cudaSupport,
 }:
 let
-  inherit (lib)
-    getBin
-    getInclude
-    ;
-
  minSupportedCudaCapability = "8.0"; # build fails with 7.5

  minCudaCapability = builtins.head (
@@ -66,31 +60,34 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {

      DISABLE_SM90_FEATURES = if disableSm90Features then "1" else "0";

-      CUDA_HOME = symlinkJoin {
-        name = "cuda-redist";
-        paths = with cudaPackages; [
-          (getBin cuda_nvcc)
-
-          (getInclude cuda_cccl) # <nv/target>
-          (getInclude cuda_cudart) # cuda_runtime.h
-          (getInclude libcublas) # cublas_v2.h
-          (getInclude libcusolver) # cusolverDn.h
-          (getInclude libcusparse) # cusparse.h
-        ];
-      };
+      CUDA_HOME = (lib.getBin cudaPackages.cuda_nvcc).outPath;
    }

    # nvshmem must be disabled (unsetting NVSHMEM_DIR) when supporting <9.0 capabilities
    # https://github.com/deepseek-ai/DeepEP/blob/v1.2.1/setup.py#L65
    // lib.optionalAttrs (!disableSm90Features) {
-      NVSHMEM_DIR = (getInclude cudaPackages.libnvshmem).outPath;
+      NVSHMEM_DIR = (lib.getInclude cudaPackages.libnvshmem).outPath;
    }
  );

  buildInputs = [
    pybind11
    rdma-core
-  ];
+  ]
+  ++ lib.optionals cudaSupport (
+    with cudaPackages;
+    [
+      cuda_cccl # <nv/target>
+      cuda_cudart # cuda_runtime.h
+      libcublas # cublas_v2.h
+      libcusolver # cusolverDn.h
+      libcusparse # cusparse.h
+    ]
+    # On CUDA >=13.0, crt/host_config.h is shipped in cudaPackages.cuda_crt
+    ++ lib.optionals cuda_crt.meta.available [
+      cuda_crt # crt/host_config.h
+    ]
+  );

  pythonImportsCheck = [ "deep_ep" ];

@@ -1,33 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  buildPythonPackage,
-  isPy3k,
-  unittestCheckHook,
-}:
-
-buildPythonPackage rec {
-  pname = "emailthreads";
-  version = "0.1.3";
-  format = "setuptools";
-  disabled = !isPy3k;
-
-  # pypi is missing files for tests
-  src = fetchFromGitHub {
-    owner = "emersion";
-    repo = "python-emailthreads";
-    rev = "v${version}";
-    hash = "sha256-7BhYS1DQCW9QpG31asPCq5qPyJy+WW2onZpvEHhwQCs=";
-  };
-
-  nativeCheckInputs = [ unittestCheckHook ];
-
-  env.PKGVER = version;
-
-  meta = {
-    homepage = "https://github.com/emersion/python-emailthreads";
-    description = "Python library to parse and format email threads";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ eadwu ];
-  };
-}
@@ -79,6 +79,11 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "h5py" ];

+  passthru = {
+    # To evaluate more easily *Support flags of it from within Python Packages.
+    inherit hdf5;
+  };
+
  meta = {
    changelog = "https://github.com/h5py/h5py/blob/${version}/docs/whatsnew/${lib.versions.majorMinor version}.rst";
    description = "Pythonic interface to the HDF5 binary data format";
@@ -15,14 +15,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "holidays";
-  version = "0.94";
+  version = "0.95";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "vacanza";
    repo = "python-holidays";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PJV1hIrj8Lblmzzqob3pmNpfkvl/9kwvc4od5rxZbk0=";
+    hash = "sha256-MyTOCHQw/TYvH9Xm3UcXHjza2f/2ICbb3vcTGt1Cpgg=";
  };

  build-system = [
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202604231";
+  version = "0.1.202604241";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tnPOYhbUmsdT5z7spF6AHhVAW6yNvFSWGBWbo5l/510=";
+    hash = "sha256-7efnhH/HdKGmiUVnKaxpv4YjunmnxHQCotSY02mwJMQ=";
  };

  __darwinAllowLocalNetworking = true;
@@ -41,6 +41,7 @@ buildPythonPackage (finalAttrs: {
  pname = "librosa";
  version = "0.11.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "librosa";
@@ -112,6 +113,11 @@ buildPythonPackage (finalAttrs: {
    "test_unknown_axis"
    "test_axis_bound_warning"
    "test_auto_aspect"
+
+    # audioread.exceptions.NoBackendError
+    "test_get_duration_audioread"
+    "test_get_samplerate_audioread"
+    "test_load_force_audioread"
  ]
  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
    # AssertionError (numerical comparison fails)
@@ -7,6 +7,7 @@
  setuptools,

  # dependencies
+  aiohttp,
  alembic,
  cachetools,
  click,
@@ -38,12 +39,12 @@
  requests,
  scikit-learn,
  scipy,
+  skops,
  sqlalchemy,
  sqlparse,
  uvicorn,

  # tests
-  aiohttp,
  azure-core,
  azure-storage-blob,
  azure-storage-file,
@@ -76,20 +77,20 @@

 buildPythonPackage rec {
  pname = "mlflow";
-  version = "3.8.1";
+  version = "3.11.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mlflow";
    repo = "mlflow";
    tag = "v${version}";
-    hash = "sha256-QjRFQRShVjTnCN7/+LJ0iiB/h0+P4GJJV4RaviQdS2U=";
+    hash = "sha256-Oe6nBnnOz7MvGUNCcCGhHl6ZbyDfAhQ0LlfMBF4p6Hc=";
  };

  pythonRelaxDeps = [
    "cryptography"
    "gunicorn"
-    "importlib-metadata"
+    "importlib_metadata"
    "packaging"
    "protobuf"
    "pytz"
@@ -99,6 +100,7 @@ buildPythonPackage rec {
  build-system = [ setuptools ];

  dependencies = [
+    aiohttp
    alembic
    cachetools
    click
@@ -132,6 +134,7 @@ buildPythonPackage rec {
    scikit-learn
    scipy
    shap
+    skops
    sqlalchemy
    sqlparse
    uvicorn
@@ -163,8 +163,8 @@ in
      "sha256-G3kwLm2IEgXNFrs8V2uCj0su2S3P72FzmWSOEYjlV4c=";

  mypy-boto3-batch =
-    buildMypyBoto3Package "batch" "1.42.76"
-      "sha256-lyBhjflCwnVm1o2k/vTEvb2+xFrEYBKVuKEcFtlAYZY=";
+    buildMypyBoto3Package "batch" "1.42.94"
+      "sha256-BpJmc4Dq72eN7RPSpo51FAfpfrYRz7X/p6QBUpj2wuk=";

  mypy-boto3-billingconductor =
    buildMypyBoto3Package "billingconductor" "1.42.7"
@@ -255,8 +255,8 @@ in
      "sha256-S2NgrjralqxjjGo39TwaUSStqspnhI/E2/BLXUGP0Hc=";

  mypy-boto3-cloudwatch =
-    buildMypyBoto3Package "cloudwatch" "1.42.90"
-      "sha256-JJOtHOlHDMYwjk4zEPArq7rmrlSINUxfd4etVVWGItw=";
+    buildMypyBoto3Package "cloudwatch" "1.42.95"
+      "sha256-vSHJoPnQi2X2pbQ51SrNN7pxEmBG5V63tp4M1fdLVdM=";

  mypy-boto3-codeartifact =
    buildMypyBoto3Package "codeartifact" "1.42.3"
@@ -443,8 +443,8 @@ in
      "sha256-92qhSUqTiLgbtvCdi/Mmgve18mcYR00ABL+bNy7/OnY=";

  mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.42.92"
-      "sha256-gwR4f9HgMN8f1geH2aL8ez1ws+uuHeJVnE0tfffLARg=";
+    buildMypyBoto3Package "ec2" "1.42.94"
+      "sha256-oBPuRTIinvGXQm3PDBt6oqC43PM+sW2C2+JLEI32f7c=";

  mypy-boto3-ec2-instance-connect =
    buildMypyBoto3Package "ec2-instance-connect" "1.42.3"
@@ -459,8 +459,8 @@ in
      "sha256-syjw4M02YXRXsJpM3e7OikE3sSTl/hIIJ3857PP2BII=";

  mypy-boto3-ecs =
-    buildMypyBoto3Package "ecs" "1.42.88"
-      "sha256-rAic7ide3nLM1I1o/h8vlwWyRFRlqcEh9GxvRugUt7o=";
+    buildMypyBoto3Package "ecs" "1.42.94"
+      "sha256-mvQIKuN6zhb7nmS4kejdpv9QgdHrPCQ3Ru6H0nLnVJc=";

  mypy-boto3-efs =
    buildMypyBoto3Package "efs" "1.42.3"
@@ -503,8 +503,8 @@ in
      "sha256-aSceDS6MkuNWdpvaZoeYGFeE8tApcoHus7FIlIlsX3M=";

  mypy-boto3-emr-serverless =
-    buildMypyBoto3Package "emr-serverless" "1.42.23"
-      "sha256-/6DQxeWrGSYhODipYuEaYnEbctT2LbNonuiOmd5Oo1Q=";
+    buildMypyBoto3Package "emr-serverless" "1.42.94"
+      "sha256-Q2iRC8QWm+bzqufeyxiIMSejauHjWvdJpPU+d7UdvJo=";

  mypy-boto3-entityresolution =
    buildMypyBoto3Package "entityresolution" "1.42.10"
@@ -690,12 +690,12 @@ in
      "sha256-8GAK05LdnC3ve/9Vma/Ej13uCSvTSSC1iYUGr/u3Qgk=";

  mypy-boto3-iotwireless =
-    buildMypyBoto3Package "iotwireless" "1.42.3"
-      "sha256-tov3sxMjqWU5A7Jr9rQVbi+R/sc9TMeexyjwvgOKuJg=";
+    buildMypyBoto3Package "iotwireless" "1.42.94"
+      "sha256-Q6ypzi2rIhj5oECPe/Xz6GoKU8Uu04PdpdGvMgxjpnc=";

  mypy-boto3-ivs =
-    buildMypyBoto3Package "ivs" "1.42.3"
-      "sha256-TzudGWLWWzTRWZb3585Tkar1iXmt5TtFNox+DJzvhS4=";
+    buildMypyBoto3Package "ivs" "1.42.94"
+      "sha256-deZSEEfLk/ml9447Y4G5PPSj3OJHt/XHRfeD1CdBWBE=";

  mypy-boto3-ivs-realtime =
    buildMypyBoto3Package "ivs-realtime" "1.42.86"
@@ -766,8 +766,8 @@ in
      "sha256-tMre640822/6JE0YVSHud03xqS4VbgJy9RJsN3eIEhE=";

  mypy-boto3-lambda =
-    buildMypyBoto3Package "lambda" "1.42.85"
-      "sha256-ukCJSNwcd/4cbCsK/skywVtR0E+hFAPpDa3/Phs8KOc=";
+    buildMypyBoto3Package "lambda" "1.42.94"
+      "sha256-yIj0FLRAzyWBJKAtCH5P+d/5ziG2Jc0+ngPXsUgzxfw=";

  mypy-boto3-lex-models =
    buildMypyBoto3Package "lex-models" "1.42.3"
@@ -966,8 +966,8 @@ in
      "sha256-h0urK602L1j2CtD1xsUOMaXizzc2CxbttMlaSNyQNoM=";

  mypy-boto3-opensearch =
-    buildMypyBoto3Package "opensearch" "1.42.81"
-      "sha256-0L6N0wVUGDwjuLRgz0Sd/Do1u/CoXRatk3OWFnGCgwM=";
+    buildMypyBoto3Package "opensearch" "1.42.95"
+      "sha256-CGCwYDcgttsyYSKUB2kVVeeOxtT6svLxR+fDFtjZ854=";

  mypy-boto3-opensearchserverless =
    buildMypyBoto3Package "opensearchserverless" "1.42.75"
@@ -986,8 +986,8 @@ in
      "sha256-sQqxy9tcynLqyBfXS4+FOgAcIQsttj8hiRf+GFK+tHE=";

  mypy-boto3-osis =
-    buildMypyBoto3Package "osis" "1.42.3"
-      "sha256-+t1Mh2gV7wu5YAFzp0jABFUC6/8P/FHMnBCHilIFXac=";
+    buildMypyBoto3Package "osis" "1.42.94"
+      "sha256-RKC8uHfIG+XE4ztIN+NTbAkcvCo8CAZh2Z/k8YkXyzc=";

  mypy-boto3-outposts =
    buildMypyBoto3Package "outposts" "1.42.86"
@@ -1158,12 +1158,12 @@ in
      "sha256-4/Q39UsUYaluauoaLm6BOej+Krl2VbO1xKKo1orRIkI=";

  mypy-boto3-s3 =
-    buildMypyBoto3Package "s3" "1.42.85"
-      "sha256-QB46GErAlzvAi1Vsw7JlXY8uVlcLbth85jUhDfT2Zvs=";
+    buildMypyBoto3Package "s3" "1.42.94"
+      "sha256-HZLXIs8AVzuBEemEk6s4bgwbWaFTC3/uSvd/LZocR30=";

  mypy-boto3-s3control =
-    buildMypyBoto3Package "s3control" "1.42.80"
-      "sha256-dKWK0wd1SYgz+68BDg0BDRV+bz9f8GqTfbhFpd3H+A8=";
+    buildMypyBoto3Package "s3control" "1.42.94"
+      "sha256-bGXhCT1/if/D2a4bKa+RuBVazjZ4w0BA7A8gYgbeKO0=";

  mypy-boto3-s3outposts =
    buildMypyBoto3Package "s3outposts" "1.42.3"
@@ -0,0 +1,118 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  matplotlib,
+  numba,
+  numpy,
+  pandas,
+  pyyaml,
+  requests,
+  scipy,
+  seaborn,
+  tabulate,
+  typing-extensions,
+  vtk,
+
+  # tests
+  pytestCheckHook,
+
+  # optional-dependencies
+  pyside6,
+  qtconsole,
+  torch,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "optiland";
+  version = "0.6.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "HarrisonKramer";
+    repo = "optiland";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-s+EFsfj+3VIgpqhBv8f6IblyxfxXHWnO/i1lO3bEke4=";
+  };
+
+  patches = [
+    # wayland is not supported, see:
+    # https://github.com/optiland/optiland/issues/556
+    (fetchpatch {
+      url = "https://github.com/optiland/optiland/commit/9644df6e06bd24c5a3a7cf36c8df9dd83050bccc.patch";
+      hash = "sha256-a74Z7rp3ji3+9lM8Q/RttMIzwlRBki1N2Y0YtBiVaEA=";
+    })
+    # A fixup for the above, see:
+    #
+    # - https://github.com/optiland/optiland/pull/564#discussion_r3106831922
+    # - https://github.com/optiland/optiland/pull/568
+    (fetchpatch {
+      url = "https://github.com/optiland/optiland/commit/652922bce5e1854f1d067e292422d95dee129a46.patch";
+      hash = "sha256-9O+DNbqBDDSAaRkwCy3o76lwy5MJ7WHQqzfcN1fcmnE=";
+    })
+  ];
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    matplotlib
+    numba
+    numpy
+    pandas
+    pyyaml
+    requests
+    scipy
+    seaborn
+    tabulate
+    typing-extensions
+    vtk
+  ];
+
+  passthru = {
+    optional-dependencies = {
+      gui = [
+        pyside6
+        qtconsole
+      ];
+      torch = [
+        torch
+      ];
+    };
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ]
+  # No need for optional-dependencies.gui, as the relevant tests requiring the
+  # gui dependencies are disabled below.
+  ++ finalAttrs.finalPackage.passthru.optional-dependencies.torch;
+
+  disabledTestPaths = [
+    # From some reason, importing pyside6 during tests causes a core dump of the
+    # python interpreter, so we disable all GUI tests.
+    "tests/gui/"
+  ];
+
+  pythonImportsCheck = [
+    "optiland"
+  ];
+
+  meta = {
+    description = "Comprehensive optical design, optimization, and analysis in Python, including GPU-accelerated and differentiable ray tracing via PyTorch";
+    homepage = "https://github.com/HarrisonKramer/optiland";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ doronbehar ];
+    # Intentionally not setting optiland meta.mainProgram, as it is not
+    # functional without additional qt6 and python libraries available. See
+    # pkgs/by-name/op/optiland/package.nix for a derivation with a working GUI.
+  };
+})
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  requests,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "requests-sse";
+  version = "0.5.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "overcat";
+    repo = "requests-sse";
+    tag = finalAttrs.version;
+    hash = "sha256-+Zv7k+cYux7aBZk9MN7ySZh+pQUHNa6KjwxQ4l4aFxA=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    requests
+  ];
+
+  pythonImportsCheck = [
+    "requests_sse"
+  ];
+
+  # tests require internet access
+  doCheck = false;
+
+  meta = {
+    description = "Server-sent events python client library based on requests";
+    homepage = "https://github.com/overcat/requests-sse";
+    changelog = "https://github.com/overcat/requests-sse/blob/${finalAttrs.src.rev}/CHANGES.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ eljamm ];
+    teams = with lib.teams; [ ngi ];
+  };
+})
@@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "tencentcloud-sdk-python";
-  version = "3.1.83";
+  version = "3.1.85";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = finalAttrs.version;
-    hash = "sha256-L3XAElFubSSifh4X8X5NFikLz5QnVjspMxhf5TnhE28=";
+    hash = "sha256-8uJNo4gDUlY4oX1cMrJtrwGYc0la2nac+rjHBRoPAj8=";
  };

  build-system = [ setuptools ];
@@ -37,14 +37,14 @@

 buildPythonPackage rec {
  pname = "textual";
-  version = "8.2.3";
+  version = "8.2.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Textualize";
    repo = "textual";
    tag = "v${version}";
-    hash = "sha256-9519UH723p9S9EO7RYJM4qM9e7TyMFDMkSVWqYt+RXg=";
+    hash = "sha256-827cm9pcj1o1FYeaoWKCJ6dEyXeDop4kYd205cySTfg=";
  };

  build-system = [ poetry-core ];
@@ -33,18 +33,21 @@
  # tests
  pytest-asyncio,
  pytestCheckHook,
+  h5py,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "xarray";
-  version = "2026.02.0";
+  version = "2026.04.0";
  pyproject = true;
+  # Needed mainly for pytestFlags with spaces
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "pydata";
    repo = "xarray";
-    tag = "v${version}";
-    hash = "sha256-g1cKI0Et3RToWOxn+bELtT5jAaB8e1N+k9doCU+OgfY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BsgL+Xo9fTMLLdz5AfScnKGuBa76cE85LuUzB4ZNLiY=";
  };

  postPatch = ''
@@ -63,7 +66,7 @@ buildPythonPackage rec {
    pandas
  ];

-  optional-dependencies = lib.fix (self: {
+  optional-dependencies = {
    accel = [
      bottleneck
      # flox
@@ -90,25 +93,36 @@ buildPythonPackage rec {
      # nc-time-axis
      seaborn
    ];
-    complete = with self; accel ++ io ++ etc ++ parallel ++ viz;
-  });
+    complete =
+      with finalAttrs.finalPackage.passthru.optional-dependencies;
+      accel ++ io ++ etc ++ parallel ++ viz;
+  };

  nativeCheckInputs = [
    pytest-asyncio
    pytestCheckHook
-    scipy
-  ];
-
-  disabledTestPaths = [
-    # https://github.com/pydata/xarray/issues/11183
-    "xarray/tests/test_dataarray.py::TestDataArray::test_curvefit_helpers" # Failed: DID NOT RAISE <class 'ValueError'>
-    "xarray/tests/test_variable.py::TestIndexVariable::test_concat_periods" # ValueError: Could not convert <xarray.IndexVariable 't' (t: 5)> Size: 40B
+  ]
+  # Besides scipy, these are not strictly needed for the tests, but adding all
+  # of these optional-dependencies extends the amount of tests from ~17k to
+  # ~21k.
+  ++ finalAttrs.finalPackage.optional-dependencies.io
+  ++ finalAttrs.finalPackage.optional-dependencies.accel
+  ++ finalAttrs.finalPackage.optional-dependencies.etc
+  ++ finalAttrs.finalPackage.optional-dependencies.parallel
+  # Not adding optional-dependencies.viz because adding cartopy causes infinite
+  # recursion, and doesn't cause more tests to be collected.
+  ;
+  pytestFlags = lib.optionals (!h5py.hdf5.szipSupport) [
+    "-k"
+    # Our h5py is built with hdf5 that is built without szip support, so we
+    # skip these tests
+    "not szip"
  ];

  pythonImportsCheck = [ "xarray" ];

  meta = {
-    changelog = "https://github.com/pydata/xarray/blob/${src.tag}/doc/whats-new.rst";
+    changelog = "https://github.com/pydata/xarray/blob/${finalAttrs.src.tag}/doc/whats-new.rst";
    description = "N-D labeled arrays and datasets in Python";
    homepage = "https://github.com/pydata/xarray";
    license = lib.licenses.asl20;
@@ -116,4 +130,4 @@ buildPythonPackage rec {
      doronbehar
    ];
  };
-}
+})
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 source "https://rubygems.org"

-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.106"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.128"

 gem "syslog", "~> 0.3.0"
 gem 'mini_portile2', '~> 2.8.0'
@@ -1,9 +1,9 @@
 GIT
  remote: https://github.com/rapid7/metasploit-framework
-  revision: a8698e72f54049c520b47322b7d5e4df59110abc
-  ref: refs/tags/6.4.106
+  revision: 7ea8df5679ba6cb46799115c0090511e448c7cd4
+  ref: refs/tags/6.4.128
  specs:
-    metasploit-framework (6.4.106)
+    metasploit-framework (6.4.128)
      aarch64
      abbrev
      actionpack (~> 7.2.0)
@@ -46,11 +46,11 @@ GIT
      lru_redux
      metasm
      metasploit-concern
-      metasploit-credential
+      metasploit-credential (>= 6.0.21)
      metasploit-model
-      metasploit-payloads (= 2.0.237)
-      metasploit_data_models (>= 6.0.7)
-      metasploit_payloads-mettle (= 1.0.45)
+      metasploit-payloads (= 2.0.245)
+      metasploit_data_models (>= 6.0.15)
+      metasploit_payloads-mettle (= 1.0.46)
      mqtt
      msgpack (~> 1.6.0)
      mutex_m
@@ -104,7 +104,7 @@ GIT
      rinda
      ruby-macho
      ruby-mysql
-      ruby_smb (~> 3.3.15)
+      ruby_smb (~> 3.3.17)
      rubyntlm
      rubyzip
      sinatra (~> 3.2)
@@ -129,12 +129,11 @@ GEM
  remote: https://rubygems.org/
  specs:
    Ascii85 (2.0.1)
-    aarch64 (2.1.0)
-      racc (~> 1.6)
+    aarch64 (3.0.0)
    abbrev (0.1.2)
-    actionpack (7.2.3)
-      actionview (= 7.2.3)
-      activesupport (= 7.2.3)
+    actionpack (7.2.3.1)
+      actionview (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
      cgi
      nokogiri (>= 1.8.5)
      racc
@@ -144,20 +143,20 @@ GEM
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
      useragent (~> 0.16)
-    actionview (7.2.3)
-      activesupport (= 7.2.3)
+    actionview (7.2.3.1)
+      activesupport (= 7.2.3.1)
      builder (~> 3.1)
      cgi
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-    activemodel (7.2.3)
-      activesupport (= 7.2.3)
-    activerecord (7.2.3)
-      activemodel (= 7.2.3)
-      activesupport (= 7.2.3)
+    activemodel (7.2.3.1)
+      activesupport (= 7.2.3.1)
+    activerecord (7.2.3.1)
+      activemodel (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
      timeout (>= 0.4.0)
-    activesupport (7.2.3)
+    activesupport (7.2.3.1)
      base64
      benchmark (>= 0.3)
      bigdecimal
@@ -166,17 +165,17 @@ GEM
      drb
      i18n (>= 1.6, < 2)
      logger (>= 1.4.2)
-      minitest (>= 5.1)
+      minitest (>= 5.1, < 6)
      securerandom (>= 0.3)
      tzinfo (~> 2.0, >= 2.0.5)
-    addressable (2.8.8)
+    addressable (2.9.0)
      public_suffix (>= 2.0.2, < 8.0)
    afm (1.0.0)
    arel-helpers (2.17.0)
      activerecord (>= 3.1.0)
    aws-eventstream (1.4.0)
-    aws-partitions (1.1201.0)
-    aws-sdk-core (3.241.2)
+    aws-partitions (1.1240.0)
+    aws-sdk-core (3.245.0)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
@@ -184,34 +183,34 @@ GEM
      bigdecimal
      jmespath (~> 1, >= 1.6.1)
      logger
-    aws-sdk-ec2 (1.588.0)
-      aws-sdk-core (~> 3, >= 3.241.0)
+    aws-sdk-ec2 (1.612.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-ec2instanceconnect (1.67.0)
-      aws-sdk-core (~> 3, >= 3.241.0)
+    aws-sdk-ec2instanceconnect (1.70.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-iam (1.138.0)
-      aws-sdk-core (~> 3, >= 3.241.0)
+    aws-sdk-iam (1.142.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-kms (1.119.0)
-      aws-sdk-core (~> 3, >= 3.241.0)
+    aws-sdk-kms (1.123.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.210.1)
-      aws-sdk-core (~> 3, >= 3.241.0)
+    aws-sdk-s3 (1.219.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
-    aws-sdk-ssm (1.208.0)
-      aws-sdk-core (~> 3, >= 3.241.0)
+    aws-sdk-ssm (1.212.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
      aws-sigv4 (~> 1.5)
    aws-sigv4 (1.12.1)
      aws-eventstream (~> 1, >= 1.0.2)
    base64 (0.3.0)
-    bcrypt (3.1.21)
+    bcrypt (3.1.22)
    bcrypt_pbkdf (1.1.2)
    benchmark (0.5.0)
-    bigdecimal (4.0.1)
+    bigdecimal (4.1.2)
    bindata (2.4.15)
-    bootsnap (1.20.1)
+    bootsnap (1.23.0)
      msgpack (~> 1.2)
    bson (5.2.0)
    builder (3.3.0)
@@ -242,12 +241,12 @@ GEM
    em-socksify (0.3.3)
      base64
      eventmachine (>= 1.0.0.beta.4)
-    erb (6.0.1)
+    erb (6.0.4)
    erubi (1.13.1)
    eventmachine (1.2.7)
-    faker (3.5.3)
+    faker (3.8.0)
      i18n (>= 1.8.11, < 2)
-    faraday (2.14.0)
+    faraday (2.14.1)
      faraday-net_http (>= 2.0, < 3.5)
      json
      logger
@@ -274,7 +273,7 @@ GEM
      ed25519 (~> 1.2)
      hrr_rb_ssh (>= 0.4)
    http-accept (1.7.0)
-    http-cookie (1.1.0)
+    http-cookie (1.1.6)
      domain_name (~> 0.5)
    http_parser.rb (0.8.1)
    httpclient (2.9.0)
@@ -283,32 +282,33 @@ GEM
      concurrent-ruby (~> 1.0)
    io-console (0.8.2)
    ipaddr (1.2.8)
-    irb (1.16.0)
+    irb (1.18.0)
      pp (>= 0.6.0)
+      prism (>= 1.3.0)
      rdoc (>= 4.0.0)
      reline (>= 0.4.2)
    jmespath (1.6.2)
    jsobfu (0.4.2)
      rkelly-remix
-    json (2.18.0)
+    json (2.19.4)
    little-plugger (1.1.4)
    logger (1.7.0)
    logging (2.4.0)
      little-plugger (~> 1.1)
      multi_json (~> 1.14)
-    loofah (2.25.0)
+    loofah (2.25.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
    lru_redux (1.1.0)
    metasm (1.0.5)
-    metasploit-concern (5.0.5)
-      activemodel (~> 7.0)
-      activesupport (~> 7.0)
+    metasploit-concern (5.0.6)
+      activemodel (>= 7.0, < 8.1)
+      activesupport (>= 7.0, < 8.1)
      drb
      mutex_m
-      railties (~> 7.0)
+      railties (>= 7.0, < 8.1)
      zeitwerk
-    metasploit-credential (6.0.16)
+    metasploit-credential (6.0.23)
      bigdecimal
      csv
      drb
@@ -321,47 +321,45 @@ GEM
      railties
      rex-socket
      rubyntlm
-      rubyzip
-    metasploit-model (5.0.4)
-      activemodel (~> 7.0)
-      activesupport (~> 7.0)
+      rubyzip (< 3.0.0)
+    metasploit-model (5.0.5)
+      activemodel (>= 7.0, < 8.1)
+      activesupport (>= 7.0, < 8.1)
      bigdecimal
      drb
      mutex_m
-      railties (~> 7.0)
-    metasploit-payloads (2.0.237)
-    metasploit_data_models (6.0.11)
-      activerecord (~> 7.0)
-      activesupport (~> 7.0)
+      railties (>= 7.0, < 8.1)
+    metasploit-payloads (2.0.245)
+    metasploit_data_models (6.0.18)
+      activerecord (>= 7.0, < 8.1)
+      activesupport (>= 7.0, < 8.1)
      arel-helpers
      bigdecimal
      drb
      metasploit-concern
-      metasploit-model (>= 3.1)
+      metasploit-model (>= 5.0.4)
      mutex_m
      pg
-      railties (~> 7.0)
+      railties (>= 7.0, < 8.1)
      recog
      webrick
-    metasploit_payloads-mettle (1.0.45)
+    metasploit_payloads-mettle (1.0.46)
    mime-types (3.7.0)
      logger
      mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2025.0924)
+    mime-types-data (3.2026.0414)
    mini_portile2 (2.8.9)
-    minitest (6.0.1)
-      prism (~> 1.5)
+    minitest (5.27.0)
    mqtt (0.7.0)
      logger
    msgpack (1.6.1)
-    multi_json (1.19.1)
-    mustermann (3.0.4)
-      ruby2_keywords (~> 0.0.1)
+    multi_json (1.20.1)
+    mustermann (3.1.1)
    mutex_m (0.3.0)
    nessus_rest (0.1.6)
    net-http (0.9.1)
      uri (>= 0.11.1)
-    net-imap (0.6.2)
+    net-imap (0.6.3)
      date
      net-protocol
    net-ldap (0.20.0)
@@ -373,12 +371,12 @@ GEM
      net-ssh (>= 5.0.0, < 8.0.0)
    net-smtp (0.5.1)
      net-protocol
-    net-ssh (7.3.0)
+    net-ssh (7.3.2)
    netrc (0.11.0)
    network_interface (0.0.4)
    nexpose (7.3.0)
    nio4r (2.7.5)
-    nokogiri (1.19.0)
+    nokogiri (1.19.2)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
    nori (2.7.1)
@@ -395,7 +393,7 @@ GEM
    ostruct (0.6.3)
    packetfu (2.0.0)
      pcaprub (~> 0.13.1)
-    parallel (1.27.0)
+    parallel (2.0.1)
    patch_finder (1.0.2)
    pcaprub (0.13.3)
    pdf-reader (2.15.1)
@@ -408,15 +406,15 @@ GEM
    pp (0.6.3)
      prettyprint
    prettyprint (0.2.0)
-    prism (1.7.0)
+    prism (1.9.0)
    psych (5.3.1)
      date
      stringio
-    public_suffix (7.0.2)
-    puma (7.1.0)
+    public_suffix (7.0.5)
+    puma (8.0.0)
      nio4r (~> 2.0)
    racc (1.8.1)
-    rack (2.2.21)
+    rack (2.2.23)
    rack-protection (3.2.0)
      base64 (>= 0.1.0)
      rack (~> 2.2, >= 2.2.4)
@@ -431,12 +429,12 @@ GEM
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.2)
-      loofah (~> 2.21)
+    rails-html-sanitizer (1.7.0)
+      loofah (~> 2.25)
      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.2.3)
-      actionpack (= 7.2.3)
-      activesupport (= 7.2.3)
+    railties (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
      cgi
      irb (~> 1.13)
      rackup (>= 1.0.0)
@@ -444,15 +442,15 @@ GEM
      thor (~> 1.0, >= 1.2.2)
      tsort (>= 0.2)
      zeitwerk (~> 2.6)
-    rake (13.3.1)
+    rake (13.4.2)
    rasn1 (0.14.0)
      strptime (~> 0.2.5)
    rb-readline (0.5.5)
-    rdoc (7.0.3)
+    rdoc (7.2.0)
      erb
      psych (>= 4.0.0)
      tsort
-    recog (3.1.25)
+    recog (3.1.26)
      nokogiri
    redcarpet (3.6.1)
    reline (0.6.3)
@@ -462,16 +460,16 @@ GEM
      http-cookie (>= 1.0.2, < 2.0)
      mime-types (>= 1.16, < 4.0)
      netrc (~> 0.8)
-    rex-arch (0.1.18)
+    rex-arch (0.1.19)
      rex-text
-    rex-bin_tools (0.1.12)
+    rex-bin_tools (0.1.16)
      metasm
      rex-arch
      rex-core
      rex-struct2
      rex-text
-    rex-core (0.1.35)
-    rex-encoder (0.1.8)
+    rex-core (0.1.36)
+    rex-encoder (0.1.10)
      metasm
      rex-arch
      rex-text
@@ -505,7 +503,7 @@ GEM
      metasm
      rex-core
      rex-text
-    rex-socket (0.1.64)
+    rex-socket (0.1.66)
      dnsruby
      rex-core
    rex-sslscan (0.1.13)
@@ -513,7 +511,7 @@ GEM
      rex-socket
      rex-text
    rex-struct2 (0.1.5)
-    rex-text (0.2.61)
+    rex-text (0.2.62)
      bigdecimal
    rex-zip (0.1.6)
      rex-text
@@ -523,11 +521,10 @@ GEM
      forwardable
      ipaddr
    rkelly-remix (0.0.7)
-    ruby-macho (4.1.0)
+    ruby-macho (5.0.0)
    ruby-mysql (4.2.1)
    ruby-rc4 (0.1.5)
-    ruby2_keywords (0.0.5)
-    ruby_smb (3.3.16)
+    ruby_smb (3.3.17)
      bindata (= 2.4.15)
      openssl-ccm
      openssl-cmac
@@ -535,7 +532,7 @@ GEM
      windows_error (>= 0.1.4)
    rubyntlm (0.6.5)
      base64
-    rubyzip (3.2.2)
+    rubyzip (2.4.1)
    sawyer (0.9.3)
      addressable (>= 2.3.5)
      faraday (>= 0.17.3, < 3)
@@ -559,15 +556,15 @@ GEM
      eventmachine (~> 1.0, >= 1.0.4)
      rack (>= 1, < 3)
    thor (1.5.0)
-    tilt (2.6.1)
-    timeout (0.6.0)
+    tilt (2.7.0)
+    timeout (0.6.1)
    tsort (0.2.0)
    ttfunk (1.7.0)
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2025.3)
+    tzinfo-data (1.2026.1)
      tzinfo (>= 1.0.0)
-    unix-crypt (1.3.1)
+    unix-crypt (1.3.2)
    uri (1.1.1)
    useragent (0.16.11)
    warden (1.2.9)
@@ -592,9 +589,10 @@ GEM
    xdr (3.0.3)
      activemodel (>= 4.2, < 8.0)
      activesupport (>= 4.2, < 8.0)
-    xmlrpc (0.3.3)
+    xmlrpc (0.3.4)
+      rexml
      webrick
-    zeitwerk (2.7.4)
+    zeitwerk (2.7.5)

 PLATFORMS
  ruby
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "metasploit-framework";
-  version = "6.4.106";
+  version = "6.4.128";

  src = fetchFromGitHub {
    owner = "rapid7";
    repo = "metasploit-framework";
    tag = finalAttrs.version;
-    hash = "sha256-FpSx6CuVa2fOCoJesQcK+Nft+6k8iPDKyGvTec8TMbo=";
+    hash = "sha256-rIWk5lkPtwIrCF/JmyvZgkeX6vM81Rl4edJWAloOksU=";
  };

  nativeBuildInputs = [
@@ -4,10 +4,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1c0hkbm94prkw0nb76l0il7fhz1xz5dkgzh6wwyrs88lwggv9avh";
+      sha256 = "0986jw4b3g4z841lz8svi4fn2bhy0mkcxw211z0b33ldgf53bdj4";
      type = "gem";
    };
-    version = "2.1.0";
+    version = "3.0.0";
  };
  abbrev = {
    groups = [ "default" ];
@@ -24,60 +24,60 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1kq7fbgb5yfsjd1na2ghc7assk18ca24kbvsx90p0xwm8v3f851a";
+      sha256 = "1jp4w493wvfh9246wxk7g00m1a3vmzkvs0rznq62fwvjjdzzwsmn";
      type = "gem";
    };
-    version = "7.2.3";
+    version = "7.2.3.1";
  };
  actionview = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1cpc91crvavdgvc3jqj1nqr9q6s581bm64894pbh8f5l85x7shhz";
+      sha256 = "0z7zy6ibfpsdj9jbdm54bx3ws4dszcq7qa564jn645rr8dlbh6fy";
      type = "gem";
    };
-    version = "7.2.3";
+    version = "7.2.3.1";
  };
  activemodel = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1nrr8w3hxkssgx13bcph8lb876hg57w01fbapy7fj4ijp6p6dbxv";
+      sha256 = "1l60a6mqx1wgp15ki1cp68djci0czgrikpydii5bd877hndqdq9r";
      type = "gem";
    };
-    version = "7.2.3";
+    version = "7.2.3.1";
  };
  activerecord = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1mx087zngip62400z44p969l6fja1fjxliq6kym6npzbii3vgb3g";
+      sha256 = "0pd0f1hy6rvyanmrklqir33xq0jb2my4jajz7hc38nysfpi175dq";
      type = "gem";
    };
-    version = "7.2.3";
+    version = "7.2.3.1";
  };
  activesupport = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "043vbilaw855c91n5l7g0k0wxj63kngj911685qy74xc1mvwjxan";
+      sha256 = "0d6bhg9cim83g8cypjd7cms45ng4p9ga69v26i3vp823d98yvsqi";
      type = "gem";
    };
-    version = "7.2.3";
+    version = "7.2.3.1";
  };
  addressable = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mxhjgihzsx45l9wh2n0ywl9w0c6k70igm5r0d63dxkcagwvh4vw";
+      sha256 = "1by7h2lwziiblizpd5yx87jsq8ppdhzvwf08ga34wzqgcv1nmpvz";
      type = "gem";
    };
-    version = "2.8.8";
+    version = "2.9.0";
  };
  afm = {
    groups = [ "default" ];
@@ -124,80 +124,80 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "00c7qzr1dnv82ajyaz6hjhn9qvk5yryi9wbwhdw9ck8af56hjxja";
+      sha256 = "19z43maygafxjq3k4cbjn24i6zyjdrsk9152asf6kbgx28bv51dq";
      type = "gem";
    };
-    version = "1.1201.0";
+    version = "1.1240.0";
  };
  aws-sdk-core = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "17qwgdnnvkc97f249q2i7sqvffkpmph5704gyaqrylhpfflz8v4z";
+      sha256 = "1bdl9hlb2wy4ndglvq9dr5kvchaq3j0izlxk4lb6yd4ca103px4l";
      type = "gem";
    };
-    version = "3.241.2";
+    version = "3.245.0";
  };
  aws-sdk-ec2 = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0z94vvvy10fg459a3kkmr4r767rp81inyx722lp04s5vp519yxlw";
+      sha256 = "0dm0qbcqadgbza4919d7m9bhrj8ami41rgv0p9pqnb8s8ppk1789";
      type = "gem";
    };
-    version = "1.588.0";
+    version = "1.612.0";
  };
  aws-sdk-ec2instanceconnect = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0cl1ajpdlsnwh4g88bmp1i3l323l0zvvzlygm5pj9x5bmpn35ji2";
+      sha256 = "0ln5gqbni3z635k5fxvajn05mbx9j1i6qd20x7dblkxcryy7dmyi";
      type = "gem";
    };
-    version = "1.67.0";
+    version = "1.70.0";
  };
  aws-sdk-iam = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "07akwflj7zmpbyywsp94bwlxbvk46h5pxxk3xavbk802id7dnzvd";
+      sha256 = "0jx5xrpw40nv5pfv8rvz7y8xhvxm756igcn4nr08agxd6byv7jk1";
      type = "gem";
    };
-    version = "1.138.0";
+    version = "1.142.0";
  };
  aws-sdk-kms = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0wikgvniig4m84frj86h52fc7507ss3b3q9sis53v50qmwzwk6gm";
+      sha256 = "080zh4g1lcjl0bz2l0gjm8vmpd60cvi0p658bh235ypqh9zg61fl";
      type = "gem";
    };
-    version = "1.119.0";
+    version = "1.123.0";
  };
  aws-sdk-s3 = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "018h0hq7k1r2i2mf0gdx0l9cmz82sixcfmbvqfb0difli1rygq2g";
+      sha256 = "1iziq88dwja5gjimqm875g72h0d1lrf1ha9widsjb1cpfxrmsxba";
      type = "gem";
    };
-    version = "1.210.1";
+    version = "1.219.0";
  };
  aws-sdk-ssm = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "197jfhw70n2qlzigj091byh7ivfq7aswri6ic8vxgwb5x7zmcxjj";
+      sha256 = "1nkv1vz1ziw7myj20cdvha0bw36ax3bw98bj8v8jkqzqhkkpq4w9";
      type = "gem";
    };
-    version = "1.208.0";
+    version = "1.212.0";
  };
  aws-sigv4 = {
    groups = [ "default" ];
@@ -224,10 +224,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1krd99p9828n07rcjjms56jaqv7v6s9pn7y6bppcfhhaflyn2r2r";
+      sha256 = "0clhya4p8lhjj7hp31inp321wgzb0b5wbwppmya5sw1dikl7400z";
      type = "gem";
    };
-    version = "3.1.21";
+    version = "3.1.22";
  };
  bcrypt_pbkdf = {
    groups = [ "default" ];
@@ -254,10 +254,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "19y406nx17arzsbc515mjmr6k5p59afprspa1k423yd9cp8d61wb";
+      sha256 = "1g9zi8c4i7g8zz0c3hxrw6mblrjvgn7akys60clb9si7c1k1gljk";
      type = "gem";
    };
-    version = "4.0.1";
+    version = "4.1.2";
  };
  bindata = {
    groups = [ "default" ];
@@ -274,10 +274,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "14qb2gy6ypnqri92v9x8szbq7fzw27pc1z5cl367n5f5cpd2rmks";
+      sha256 = "057jsch213i42qgdsz2vg1b190n2xvvbi3hgprc8nmaqim2ly9f1";
      type = "gem";
    };
-    version = "1.20.1";
+    version = "1.23.0";
  };
  bson = {
    groups = [ "default" ];
@@ -464,10 +464,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1rcpq49pyaiclpjp3c3qjl25r95hqvin2q2dczaynaj7qncxvv18";
+      sha256 = "1ncmbdjf2bwmk0jf5cxywns9zbxyfiy4h4p3pzi7yddyjhv81qrq";
      type = "gem";
    };
-    version = "6.0.1";
+    version = "6.0.4";
  };
  erubi = {
    groups = [ "default" ];
@@ -494,20 +494,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0rfp6y0pc2slv83vcnayiypfjsanja5qg9wfm6wwq5dvq0nlhqdr";
+      sha256 = "1z1yfmqwml3gr1hjnjx6qbchmvr29j6z317wlhkhzabkvw4b6iy1";
      type = "gem";
    };
-    version = "3.5.3";
+    version = "3.8.0";
  };
  faraday = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ka175ci0q9ylpcy651pjj580diplkaskycn4n7jcmbyv7jwz6c6";
+      sha256 = "077n5ss3z3ds4vj54w201kd12smai853dp9c9n7ii7g3q7nwwg54";
      type = "gem";
    };
-    version = "2.14.0";
+    version = "2.14.1";
  };
  faraday-net_http = {
    groups = [ "default" ];
@@ -654,10 +654,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "06dvmngd4hwrr6k774i1h6c50h2l8nww9f1id0wvrvi72l6yd99q";
+      sha256 = "1aga7z4p0dka4zcqw9i05wa4ab1q7h7cgnj328ldqqfycjz84jxs";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.1.6";
  };
  "http_parser.rb" = {
    groups = [ "default" ];
@@ -714,10 +714,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "01h8bdksg0cr8bw5dhlhr29ix33rp822jmshy6rdqz4lmk4mdgia";
+      sha256 = "1qs8a9vprg7s8krgq4s0pygr91hclqqyz98ik15p0m1sf2h5956y";
      type = "gem";
    };
-    version = "1.16.0";
+    version = "1.18.0";
  };
  jmespath = {
    groups = [ "default" ];
@@ -744,10 +744,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "01fmiz052cvnxgdnhb3qwcy88xbv7l3liz0fkvs5qgqqwjp0c1di";
+      sha256 = "1b1rabz30grash5wh0lcv109w2ggggmmbclwnajqrcdk7wrps2k7";
      type = "gem";
    };
-    version = "2.18.0";
+    version = "2.19.4";
  };
  little-plugger = {
    groups = [ "default" ];
@@ -784,10 +784,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1rk0n13c9nmk8di2x5gqk5r04vf8bkp7ff6z0b44wsmc7fndfpnz";
+      sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl";
      type = "gem";
    };
-    version = "2.25.0";
+    version = "2.25.1";
  };
  lru_redux = {
    groups = [ "default" ];
@@ -814,72 +814,72 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "15ffx2xm9rvdpzx866z0cz6qig5knjdvndynwavdb804kd51pjpz";
+      sha256 = "11frhqg5vh9dqk3q3lv5grdd3r8yhxz2qpq87wrr3cl31569bg1p";
      type = "gem";
    };
-    version = "5.0.5";
+    version = "5.0.6";
  };
  metasploit-credential = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0fn91ylz0ji7yb7c8flgzxbfpjmvwz3a3gnp5c731l7klmzzgpjd";
+      sha256 = "1czk0s3nrf0a2f72l1jg81fdi9a91bfw88m6y11xsm2g1wpw8x1f";
      type = "gem";
    };
-    version = "6.0.16";
+    version = "6.0.23";
  };
  metasploit-framework = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      fetchSubmodules = false;
-      rev = "a8698e72f54049c520b47322b7d5e4df59110abc";
-      sha256 = "1fii2g7pklvbr35g121wm7xyvmzq183v2pl21b76fswm5glb350n";
+      rev = "7ea8df5679ba6cb46799115c0090511e448c7cd4";
+      sha256 = "1icj1rd04mnjg5w1km9wygm9fiw2v4mrpjaz10mh5dqgb7ka91dc";
      type = "git";
      url = "https://github.com/rapid7/metasploit-framework";
    };
-    version = "6.4.106";
+    version = "6.4.128";
  };
  metasploit-model = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1rlp50vg4gwxm9vj6abln4837j40ynmbpkqaipwjscmkbk2pdjk7";
+      sha256 = "0b6d18pd56ghcvkkzxdda9g0m3ydmppv8fjjpppzplnx18ccs1sj";
      type = "gem";
    };
-    version = "5.0.4";
+    version = "5.0.5";
  };
  metasploit-payloads = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "07kr41hz8hiwqrysmql0vds0s503w7dykxbri4b6svyjfr9wmhr5";
+      sha256 = "1cry73lkmg5p32ah7kn7scfawmgxc78i24nm559yzrrm1dqr2brx";
      type = "gem";
    };
-    version = "2.0.237";
+    version = "2.0.245";
  };
  metasploit_data_models = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0dqvv58w47jbwrm1zmqgmm7z144afxv7s7jvgqkmzym5jz21pmbl";
+      sha256 = "13f5kn8q6p7wvxyi1pxdlf9v0nmfh2fc93n4fwms6g83xc30sdmh";
      type = "gem";
    };
-    version = "6.0.11";
+    version = "6.0.18";
  };
  metasploit_payloads-mettle = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1cf4253l2225yika6av9pds5q2gl4ycvi6ddh07xzqcc1d7gm7iy";
+      sha256 = "0i179sc2acy1d6kh24yry4sdg23gllzwc3kkbwsm41fdhqhkd10y";
      type = "gem";
    };
-    version = "1.0.45";
+    version = "1.0.46";
  };
  mime-types = {
    groups = [ "default" ];
@@ -896,10 +896,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0a27k4jcrx7pvb0p59fn1frh14iy087c2aygrdkmgwsrbshvqxpj";
+      sha256 = "1k28j6ww8rf43r5i8278jvm2cq3pnzsvqm7yqpb4p93kadjlq726";
      type = "gem";
    };
-    version = "3.2025.0924";
+    version = "3.2026.0414";
  };
  mini_portile2 = {
    groups = [ "default" ];
@@ -916,10 +916,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1fslin1vyh60snwygx8jnaj4kwhk83f3m0v2j2b7bsg2917wfm3q";
+      sha256 = "1mbpz92ml19rcxxfjrj91gmkif9khb1xpzyw38f81rvglgw1ffrd";
      type = "gem";
    };
-    version = "6.0.1";
+    version = "5.27.0";
  };
  mqtt = {
    groups = [ "default" ];
@@ -946,20 +946,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1drisvysgvnjlz49a0qcbs294id6mvj3i8iik5rvym68ybwfzvvs";
+      sha256 = "0vfaab23d85617ps412ydb8ap4ci1sfzi8ainn8yyifc0pl38f9g";
      type = "gem";
    };
-    version = "1.19.1";
+    version = "1.20.1";
  };
  mustermann = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "08ma2fmxlm6i7lih4mc3har2fzsbj1pl4hhva65kljf6nfvdryl5";
+      sha256 = "163i29mdcr1h0nximk3d51a1fgp7vz3sfasn8p1rjm2d4g3p0qac";
      type = "gem";
    };
-    version = "3.0.4";
+    version = "3.1.1";
  };
  mutex_m = {
    groups = [ "default" ];
@@ -996,10 +996,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1imc50a9ic3ynsl3k0japhmb0ggrgp2c186cfqbcclv892nsrjh8";
+      sha256 = "1bgjhb65r1bl52wdym6wpbb0r3j7va8s44grggp0jvarfvw7bawv";
      type = "gem";
    };
-    version = "0.6.2";
+    version = "0.6.3";
  };
  net-ldap = {
    groups = [ "default" ];
@@ -1046,10 +1046,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1w1ypxa3n6mskkwb00b489314km19l61p5h3bar6zr8cng27c80p";
+      sha256 = "1m1d6rs40rjvdb6df34fi3za1c2ajdiydv4jzpjj03iq7hhrw0k5";
      type = "gem";
    };
-    version = "7.3.0";
+    version = "7.3.2";
  };
  netrc = {
    groups = [ "default" ];
@@ -1100,10 +1100,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "15anyh2ir3kdji93kw770xxwm5rspn9rzx9b9zh1h9gnclcd4173";
+      sha256 = "0mhp90nf3g3yy5vgjnwd34czi6rbi0p7057vgngfmmdkknsxiz9q";
      type = "gem";
    };
-    version = "1.19.0";
+    version = "1.19.2";
  };
  nori = {
    groups = [ "default" ];
@@ -1190,10 +1190,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0c719bfgcszqvk9z47w2p8j2wkz5y35k48ywwas5yxbbh3hm3haa";
+      sha256 = "0z9cbfdfr83k8xhrh1nr4f4z8ryfivfr3gv3fpk22hczwg9q4xrk";
      type = "gem";
    };
-    version = "1.27.0";
+    version = "2.0.1";
  };
  patch_finder = {
    groups = [ "default" ];
@@ -1260,10 +1260,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "00silqnlzzm97gn21lm39q95hjn058waqky44j25r67p9drjy1hh";
+      sha256 = "11ggfikcs1lv17nhmhqyyp6z8nq5pkfcj6a904047hljkxm0qlvv";
      type = "gem";
    };
-    version = "1.7.0";
+    version = "1.9.0";
  };
  psych = {
    groups = [ "default" ];
@@ -1280,20 +1280,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mx84s7gn3xabb320hw8060v7amg6gmcyyhfzp0kawafiq60j54i";
+      sha256 = "08znfv30pxmdkjyihvbjqbvv874dj3nybmmyscl958dy3f7v12qs";
      type = "gem";
    };
-    version = "7.0.2";
+    version = "7.0.5";
  };
  puma = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1pa9zpr51kqnsq549p6apvnr95s9flx6bnwqii24s8jg2b5i0p74";
+      sha256 = "122b6vwqpjsb43wccgz4cg84rimfnrcanm9j0g9v3yk0ic5hb08n";
      type = "gem";
    };
-    version = "7.1.0";
+    version = "8.0.0";
  };
  racc = {
    groups = [ "default" ];
@@ -1310,10 +1310,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0fgpa9qm5qgza69fjnagg2alxs2wmj41aq7z4kj5yib50wpzgqhl";
+      sha256 = "175ni9qsai9x2ykwvdbd5dzfyncaxpyn6dhjxjw70iq60xz9vzm8";
      type = "gem";
    };
-    version = "2.2.21";
+    version = "2.2.23";
  };
  rack-protection = {
    groups = [ "default" ];
@@ -1370,30 +1370,30 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0q55i6mpad20m2x1lg5pkqfpbmmapk0sjsrvr1sqgnj2hb5f5z1m";
+      sha256 = "128y5g3fyi8fds41jasrr4va1jrs7hcamzklk1523k7rxb64bc98";
      type = "gem";
    };
-    version = "1.6.2";
+    version = "1.7.0";
  };
  railties = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "08h44mkf91861agp7xw778gqpf5mppydsfgphgkj7wp6pyk11c3f";
+      sha256 = "0np1m8xqb4wbzwpg66yjnqjban0di92lbjzcrgnwwhq2w4z3k8xf";
      type = "gem";
    };
-    version = "7.2.3";
+    version = "7.2.3.1";
  };
  rake = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "175iisqb211n0qbfyqd8jz2g01q6xj038zjf4q0nm8k6kz88k7lc";
+      sha256 = "009p524zl0p0kfa65nii8wdmaigkmawv9pbvlcffky7islmmp0nb";
      type = "gem";
    };
-    version = "13.3.1";
+    version = "13.4.2";
  };
  rasn1 = {
    groups = [ "default" ];
@@ -1420,20 +1420,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1yc1xa3wckwwan518qii22jagqzlr5bypflx3nkvpdqr3ncd1qyz";
+      sha256 = "14iiyb4yi1chdzrynrk74xbhmikml3ixgdayjma3p700singfl46";
      type = "gem";
    };
-    version = "7.0.3";
+    version = "7.2.0";
  };
  recog = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1s99rxjfd52yvnpna85b1yv7f7wcgr8ffirc3m19n5v4mi04da8i";
+      sha256 = "1b7kx4d9gmifph452fflx0ddp1bns53sb4p3xp4qnaw0ix4s6wm7";
      type = "gem";
    };
-    version = "3.1.25";
+    version = "3.1.26";
  };
  redcarpet = {
    groups = [ "default" ];
@@ -1470,40 +1470,40 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1b0sa6p171zm5c8axzliipmkk7yq73g3dz8kq1zmqj7v3birbiaf";
+      sha256 = "080avj9lqd7pr3g3cfrs4sh22c2fadhzc4q72plfsh13cfgchflz";
      type = "gem";
    };
-    version = "0.1.18";
+    version = "0.1.19";
  };
  rex-bin_tools = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ih0n4cd44jj8n939rxbfsjfa9z62xj9risvvnki910gzv7mgx4j";
+      sha256 = "0b755sz6h9hn3f7qbx033h4j7pwx1r2ykyzqil8alpp8983li0h0";
      type = "gem";
    };
-    version = "0.1.12";
+    version = "0.1.16";
  };
  rex-core = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "09px9sp412qr226ngm7gik9nnd1m9bg9wbsanr7xhn80w71wn5b4";
+      sha256 = "0pqcxrx09lbbachpdhzwlfcrnnzspighysqslz3slfhcskygqq3s";
      type = "gem";
    };
-    version = "0.1.35";
+    version = "0.1.36";
  };
  rex-encoder = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1b1m0qmjv62npd1m8q8p9w0857pix11mwbl8wxgylc43b03m2klx";
+      sha256 = "0sqxbmm2yj009ihiy3a1iyy2f1576idix7v3r2sy66575q0f45la";
      type = "gem";
    };
-    version = "0.1.8";
+    version = "0.1.10";
  };
  rex-exploitation = {
    groups = [ "default" ];
@@ -1600,10 +1600,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "11cwgr4nr6jm62as4qkmhgq7wf9v1s5r9g92hkf6586i5xalwz9k";
+      sha256 = "0qjvlk214vm2nj5kxw47iy595vai0pp9x4c5vns2nlllij21734x";
      type = "gem";
    };
-    version = "0.1.64";
+    version = "0.1.66";
  };
  rex-sslscan = {
    groups = [ "default" ];
@@ -1630,10 +1630,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1z5cawbl959hf9ll9m2dm5zj2cra0isgl82d7vrih38ja31zwpdh";
+      sha256 = "0b3pr6v6b376ca40xsixbsg5qvnzkjsr3yqn9693gl0543dx2gp7";
      type = "gem";
    };
-    version = "0.2.61";
+    version = "0.2.62";
  };
  rex-zip = {
    groups = [ "default" ];
@@ -1680,10 +1680,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0859xi0shidwb9cfbczxsk8qrbi3qkmkp9xzyca1xzp0gmzv7ni3";
+      sha256 = "09x31652m0nfic91riab0wah6gj9gvjs1lxi7jhbq6pvx3cw755q";
      type = "gem";
    };
-    version = "4.1.0";
+    version = "5.0.0";
  };
  ruby-mysql = {
    groups = [ "default" ];
@@ -1705,25 +1705,15 @@
    };
    version = "0.1.5";
  };
-  ruby2_keywords = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1vz322p8n39hz3b4a9gkmz9y7a5jaz41zrm2ywf31dvkqm03glgz";
-      type = "gem";
-    };
-    version = "0.0.5";
-  };
  ruby_smb = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0vx0aky54jpjx21yngrprxib0dyyfnax4j526amva5ha7vjw9fyy";
+      sha256 = "0xv1s1b7xv5r2q2bclpqwf41cks128n5vipzzlci5w3r49zry8dh";
      type = "gem";
    };
-    version = "3.3.16";
+    version = "3.3.17";
  };
  rubyntlm = {
    groups = [ "default" ];
@@ -1740,10 +1730,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0g2vx9bwl9lgn3w5zacl52ax57k4zqrsxg05ixf42986bww9kvf0";
+      sha256 = "05an0wz87vkmqwcwyh5rjiaavydfn5f4q1lixcsqkphzvj7chxw5";
      type = "gem";
    };
-    version = "3.2.2";
+    version = "2.4.1";
  };
  sawyer = {
    groups = [ "default" ];
@@ -1870,20 +1860,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0w27v04d7rnxjr3f65w1m7xyvr6ch6szjj2v5wv1wz6z5ax9pa9m";
+      sha256 = "1cvaikq1dcbfl008i16c1pi1gmdax7vfkvmhch64jdkakyk9nnqd";
      type = "gem";
    };
-    version = "2.6.1";
+    version = "2.7.0";
  };
  timeout = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1bz11pq7n1g51f50jqmgyf5b1v64p1pfqmy5l21y6vpr37b2lwkd";
+      sha256 = "1jxcji88mh6xsqz0mfzwnxczpg7cyniph7wpavnavfz7lxl77xbq";
      type = "gem";
    };
-    version = "0.6.0";
+    version = "0.6.1";
  };
  tsort = {
    groups = [ "default" ];
@@ -1920,20 +1910,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0qlm97fqcwhvfa7jg2gnq8la3mnk617b5bwsc460mi75wpqy4imm";
+      sha256 = "1z896q8kzig9x6g3bcp38apns05y36jhf4j7ml7wzqjsmqcnb8sf";
      type = "gem";
    };
-    version = "1.2025.3";
+    version = "1.2026.1";
  };
  unix-crypt = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "11p5ij6iasr46fbzz0z3jibaiwf242bq8xwav33rljwcwh85sy5y";
+      sha256 = "08scg2kq184jjip3ynywj43jlynchj86jh2psxh4ms4rfykb46sw";
      type = "gem";
    };
-    version = "1.3.1";
+    version = "1.3.2";
  };
  uri = {
    groups = [ "default" ];
@@ -2040,19 +2030,19 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0fwfnccagsjrbvrav5nbk3zracj9zncr7i375nn20jd4cfy4cggc";
+      sha256 = "0hjlvq952c80khrj084a3csawrwlshd1v3n8abv5hbpqry6y18jk";
      type = "gem";
    };
-    version = "0.3.3";
+    version = "0.3.4";
  };
  zeitwerk = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "12zcvhzfnlghzw03czy2ifdlyfpq0kcbqcmxqakfkbxxavrr1vrb";
+      sha256 = "1pbkiwwla5gldgb3saamn91058nl1sq1344l5k36xsh9ih995nnq";
      type = "gem";
    };
-    version = "2.7.4";
+    version = "2.7.5";
  };
 }
@@ -14831,10 +14831,10 @@ with self;

  GitAutofixup = buildPerlPackage {
    pname = "App-Git-Autofixup";
-    version = "0.004007";
+    version = "0.005000";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TO/TORBIAK/App-Git-Autofixup-0.004007.tar.gz";
-      hash = "sha256-2pe/dnKAlbO27nHaGfC/GUMBsvRd9HietU23Tt0hCjs=";
+      url = "mirror://cpan/authors/id/T/TO/TORBIAK/App-Git-Autofixup-0.005.tar.gz";
+      hash = "sha256-4mPAOzbD+mDZ7co5xyMyA2x1u6645pYw4Q4yHRqYUTM=";
    };
    meta = {
      description = "Create fixup commits for topic branches";
@@ -191,6 +191,7 @@ mapAliases {
  editdistance-s = throw "editdistance-s has been removed since it was added solely for the identity package, which has moved on to ukkonen"; # added 2025-08-04
  elegy = throw "elegy has been removed because it has transitively been marked as broken since 2023."; # Added 2025-10-11
  email_validator = throw "'email_validator' has been renamed to/replaced by 'email-validator'"; # Converted to throw 2025-10-29
+  emailthreads = throw "'emailthreads' has been removed because the upstream repository was archived in 2024"; # Added 2026-04-09
  embreex = throw "embreex has been removed, as it required embree2"; # added 2025-09-14
  enocean = throw "'enocean' was removed because Home Assistant switched to 'enocean-async'"; # added 2026-03-31
  eris = throw "eris has been removed due to a hostile upstream moving tags and breaking src FODs"; # Added 2025-09-01
@@ -4988,8 +4988,6 @@ self: super: with self; {

  email-validator = callPackage ../development/python-modules/email-validator { };

-  emailthreads = callPackage ../development/python-modules/emailthreads { };
-
  embedding-reader = callPackage ../development/python-modules/embedding-reader { };

  emborg = callPackage ../development/python-modules/emborg { };
@@ -11847,6 +11845,8 @@ self: super: with self; {

  optax = callPackage ../development/python-modules/optax { };

+  optiland = callPackage ../development/python-modules/optiland { };
+
  optimistix = callPackage ../development/python-modules/optimistix { };

  optimum = callPackage ../development/python-modules/optimum { };
@@ -16830,6 +16830,8 @@ self: super: with self; {

  requests-ratelimiter = callPackage ../development/python-modules/requests-ratelimiter { };

+  requests-sse = callPackage ../development/python-modules/requests-sse { };
+
  requests-toolbelt = callPackage ../development/python-modules/requests-toolbelt { };

  requests-unixsocket = callPackage ../development/python-modules/requests-unixsocket { };