From 2bfe803a48d21b093235b67975b83c074b65f77b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 16:39:27 +0100
Subject: [PATCH 01/19] python313Packages.dissect-cstruct: 4.5 -> 4.7

Diff: https://github.com/fox-it/dissect.cstruct/compare/4.5...4.7

Changelog: https://github.com/fox-it/dissect.cstruct/releases/tag/4.7
---
 .../development/python-modules/dissect-cstruct/default.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-cstruct/default.nix b/pkgs/development/python-modules/dissect-cstruct/default.nix
index 7b27df5d45c5..e211bcb3f19c 100644
--- a/pkgs/development/python-modules/dissect-cstruct/default.nix
+++ b/pkgs/development/python-modules/dissect-cstruct/default.nix
@@ -5,21 +5,18 @@
   setuptools,
   setuptools-scm,
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "dissect-cstruct";
-  version = "4.5";
+  version = "4.7";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.cstruct";
     tag = version;
-    hash = "sha256-2n7y6nHt7gJtJeJIKpobiC7A+dnD6O/o+psinfOnvT8=";
+    hash = "sha256-eEaKGFpArg0p3+/I2dH3mQ+eNIVJ8KsUbRcw4Ecrl7g=";
   };
 
   build-system = [

From 3c3244728bb7bea1b671159d6c6fd6fefeb36cd8 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 16:39:36 +0100
Subject: [PATCH 02/19] python313Packages.dissect-etl: 3.11 -> 3.14

Changelog: https://github.com/fox-it/dissect.etl/releases/tag/3.14
---
 pkgs/development/python-modules/dissect-etl/default.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-etl/default.nix b/pkgs/development/python-modules/dissect-etl/default.nix
index 3d04c3652f39..331fafeaf224 100644
--- a/pkgs/development/python-modules/dissect-etl/default.nix
+++ b/pkgs/development/python-modules/dissect-etl/default.nix
@@ -8,21 +8,18 @@
   setuptools,
   setuptools-scm,
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "dissect-etl";
-  version = "3.11";
+  version = "3.14";
   pyproject = true;
 
-  disabled = pythonOlder "3.10";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.etl";
     tag = version;
-    hash = "sha256-soJH7kx/029yXyOjv6OsWjWAMMHXKx711GLPBClDAK0=";
+    hash = "sha256-QmtFkzO57jLTQg16MawAgU7Vq8vgo7DkEDq+FEjnObs=";
   };
 
   build-system = [

From b126d6e2bc74408943ffa1489c66716859942a87 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 16:42:53 +0100
Subject: [PATCH 03/19] python313Packages.dissect-util: 3.21 -> 3.23

Diff: https://github.com/fox-it/dissect.util/compare/3.21...3.23

Changelog: https://github.com/fox-it/dissect.util/releases/tag/3.23
---
 .../python-modules/dissect-util/default.nix          | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-util/default.nix b/pkgs/development/python-modules/dissect-util/default.nix
index babe6356b0c6..8469e019b0d4 100644
--- a/pkgs/development/python-modules/dissect-util/default.nix
+++ b/pkgs/development/python-modules/dissect-util/default.nix
@@ -10,19 +10,17 @@
 
 buildPythonPackage rec {
   pname = "dissect-util";
-  version = "3.21";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.9";
+  version = "3.23";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.util";
     tag = version;
-    hash = "sha256-DCe1V3ZQxr2uQ5L4Lucqu0E1jVo7P6cEwC+4tuBmmqI=";
+    hash = "sha256-dHP5nyumuQxAS3hkw4XRaLR3DMFn+WEFkLRbKBODIFo=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     setuptools-scm
   ];
@@ -38,10 +36,10 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Dissect module implementing various utility functions for the other Dissect modules";
-    mainProgram = "dump-nskeyedarchiver";
     homepage = "https://github.com/fox-it/dissect.util";
     changelog = "https://github.com/fox-it/dissect.util/releases/tag/${version}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "dump-nskeyedarchiver";
   };
 }

From 8ba279473275f883eb8cff1f1b28ae2dac48cf5f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 16:44:07 +0100
Subject: [PATCH 04/19] python313Packages.dissect-util: modernize

---
 pkgs/development/python-modules/dissect-util/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-util/default.nix b/pkgs/development/python-modules/dissect-util/default.nix
index 8469e019b0d4..9a23dbabb1bb 100644
--- a/pkgs/development/python-modules/dissect-util/default.nix
+++ b/pkgs/development/python-modules/dissect-util/default.nix
@@ -5,7 +5,6 @@
   setuptools,
   setuptools-scm,
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -37,7 +36,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Dissect module implementing various utility functions for the other Dissect modules";
     homepage = "https://github.com/fox-it/dissect.util";
-    changelog = "https://github.com/fox-it/dissect.util/releases/tag/${version}";
+    changelog = "https://github.com/fox-it/dissect.util/releases/tag/${src.tag}";
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ fab ];
     mainProgram = "dump-nskeyedarchiver";

From 5d8a4e2186b75ec2c99664524528affe2db11dc4 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 16:45:10 +0100
Subject: [PATCH 05/19] python313Packages.dissect-fve: 4.2 -> 4.5

Diff: https://github.com/fox-it/dissect.fve/compare/4.2...4.5

Changelog: https://github.com/fox-it/dissect.fve/releases/tag/4.5
---
 .../python-modules/dissect-fve/default.nix            | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-fve/default.nix b/pkgs/development/python-modules/dissect-fve/default.nix
index cf05f4451e78..ae9a4badcf54 100644
--- a/pkgs/development/python-modules/dissect-fve/default.nix
+++ b/pkgs/development/python-modules/dissect-fve/default.nix
@@ -7,7 +7,6 @@
   dissect-target,
   fetchFromGitHub,
   pycryptodome,
-  pythonOlder,
   rich,
   setuptools-scm,
   setuptools,
@@ -15,22 +14,16 @@
 
 buildPythonPackage rec {
   pname = "dissect-fve";
-  version = "4.2";
+  version = "4.5";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.fve";
     tag = version;
-    hash = "sha256-OgagTnt4y6Fzd7jbsCgbkTzcsdnozImfdKI9ew9JaqI=";
+    hash = "sha256-Lg29WJfXvjdhGtkZowzXgH9zzockoGkei1s9hgLr/gg=";
   };
 
-  pythonRelaxDeps = [
-    "pycryptodome"
-  ];
-
   build-system = [
     setuptools
     setuptools-scm

From 618c18ac87b9a4f59ef19f5663d9a51951921411 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 16:50:55 +0100
Subject: [PATCH 06/19] python313Packages.dissect-apfs: init at 1.0.1

Dissect module implementing a parser for APFS

https://github.com/fox-it/dissect.apfs
---
 .../python-modules/dissect-apfs/default.nix   | 56 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 58 insertions(+)
 create mode 100644 pkgs/development/python-modules/dissect-apfs/default.nix

diff --git a/pkgs/development/python-modules/dissect-apfs/default.nix b/pkgs/development/python-modules/dissect-apfs/default.nix
new file mode 100644
index 000000000000..a47cb0989005
--- /dev/null
+++ b/pkgs/development/python-modules/dissect-apfs/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  asn1crypto,
+  buildPythonPackage,
+  dissect-cstruct,
+  dissect-fve,
+  dissect-util,
+  fetchFromGitHub,
+  pycryptodome,
+  pytestCheckHook,
+  setuptools-scm,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-apfs";
+  version = "1.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.apfs";
+    tag = version;
+    hash = "sha256-w8R8hoj3pqP0cKCd2S8jz8IRwxRp6eVN0xb0/6E2aKw=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    asn1crypto
+    dissect-fve
+    dissect-cstruct
+    dissect-util
+    pycryptodome
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "dissect.apfs" ];
+
+  disabledTestPaths = [
+    # Bad file
+    "tests/test_apfs.py"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for APFS";
+    homepage = "https://github.com/fox-it/dissect.apfs";
+    changelog = "https://github.com/fox-it/dissect.apfs/releases/tag/${src.tag}";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4ef277c2d54d..180fde65477a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3837,6 +3837,8 @@ self: super: with self; {
 
   dissect = callPackage ../development/python-modules/dissect { };
 
+  dissect-apfs = callPackage ../development/python-modules/dissect-apfs { };
+
   dissect-archive = callPackage ../development/python-modules/dissect-archive { };
 
   dissect-btrfs = callPackage ../development/python-modules/dissect-btrfs { };

From d0391026128cd48db7e80f4f039fea6047f82c61 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 16:57:42 +0100
Subject: [PATCH 07/19] python313Packages.dissect-database: init at 1.0

Dissect module implementing a parser for various database formats

https://github.com/fox-it/dissect.database
---
 .../dissect-database/default.nix              | 48 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 50 insertions(+)
 create mode 100644 pkgs/development/python-modules/dissect-database/default.nix

diff --git a/pkgs/development/python-modules/dissect-database/default.nix b/pkgs/development/python-modules/dissect-database/default.nix
new file mode 100644
index 000000000000..3b03fccf0179
--- /dev/null
+++ b/pkgs/development/python-modules/dissect-database/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  dissect-cstruct,
+  dissect-util,
+  fetchFromGitHub,
+  pytestCheckHook,
+  setuptools-scm,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-database";
+  version = "1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.database";
+    tag = version;
+    hash = "sha256-ZMiYPAiumPg9nd7+OAnrVAwrnx0I5reClRgIerStpfE=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  # Test files are not ready
+  doCheck = false;
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "dissect.database" ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for various database formats";
+    homepage = "https://github.com/fox-it/dissect.database";
+    changelog = "https://github.com/fox-it/dissect.database/releases/tag/${src.tag}";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 180fde65477a..fdd3e206cd5c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3853,6 +3853,8 @@ self: super: with self; {
 
   dissect-cstruct = callPackage ../development/python-modules/dissect-cstruct { };
 
+  dissect-database = callPackage ../development/python-modules/dissect-database { };
+
   dissect-esedb = callPackage ../development/python-modules/dissect-esedb { };
 
   dissect-etl = callPackage ../development/python-modules/dissect-etl { };

From 21b469d96373e4e6c7c643984ce830dfec700c28 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 16:58:54 +0100
Subject: [PATCH 08/19] python313Packages.dissect-esedb: 3.17 -> 3.18

Diff: https://github.com/fox-it/dissect.esedb/compare/3.17...3.18

Changelog: https://github.com/fox-it/dissect.esedb/releases/tag/3.18
---
 pkgs/development/python-modules/dissect-esedb/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-esedb/default.nix b/pkgs/development/python-modules/dissect-esedb/default.nix
index 4cdd57611c24..36ab10d7bdb2 100644
--- a/pkgs/development/python-modules/dissect-esedb/default.nix
+++ b/pkgs/development/python-modules/dissect-esedb/default.nix
@@ -5,7 +5,6 @@
   dissect-util,
   fetchFromGitHub,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
   setuptools-scm,
 }:
@@ -15,8 +14,6 @@ buildPythonPackage rec {
   version = "3.18";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.esedb";

From 1524ef2405c2c00395a13a6b5d748ef1305518b6 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 17:00:17 +0100
Subject: [PATCH 09/19] python313Packages.dissect-executable: 1.8 -> 1.11

Diff: https://github.com/fox-it/dissect.executable/compare/1.8...1.11

Changelog: https://github.com/fox-it/dissect.executable/releases/tag/1.11
---
 .../python-modules/dissect-executable/default.nix          | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-executable/default.nix b/pkgs/development/python-modules/dissect-executable/default.nix
index 790ef796d0fc..c22b3f65e143 100644
--- a/pkgs/development/python-modules/dissect-executable/default.nix
+++ b/pkgs/development/python-modules/dissect-executable/default.nix
@@ -6,21 +6,18 @@
   fetchFromGitHub,
   setuptools,
   setuptools-scm,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "dissect-executable";
-  version = "1.8";
+  version = "1.11";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.executable";
     tag = version;
-    hash = "sha256-6fEaXZTkygd0ZLPFWbtzWadA9VEsp3cd4/he0LxqhMw=";
+    hash = "sha256-TbygZJjdTfNvwEHmquiXfalu73XgNPZpar50YpxP6NA=";
   };
 
   build-system = [

From b570453418d3f25647e3a2c7419936049b0d2ddf Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 17:09:29 +0100
Subject: [PATCH 10/19] python313Packages.dissect-volume: remove disabled

Changelog: https://github.com/fox-it/dissect.volume/releases/tag/3.17
---
 pkgs/development/python-modules/dissect-volume/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-volume/default.nix b/pkgs/development/python-modules/dissect-volume/default.nix
index c5a2524b03e6..2bac002d52db 100644
--- a/pkgs/development/python-modules/dissect-volume/default.nix
+++ b/pkgs/development/python-modules/dissect-volume/default.nix
@@ -7,7 +7,6 @@
   setuptools,
   setuptools-scm,
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
@@ -15,8 +14,6 @@ buildPythonPackage rec {
   version = "3.17";
   pyproject = true;
 
-  disabled = pythonOlder "3.13";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.volume";

From 26405c899d9a044e6bc8b545a1d0351fd6d10700 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 17:17:10 +0100
Subject: [PATCH 11/19] python313Packages.dissect-archive: 1.6 -> 1.8

Changelog: https://github.com/fox-it/dissect.archive/releases/tag/1.8
---
 .../python-modules/dissect-archive/default.nix  | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-archive/default.nix b/pkgs/development/python-modules/dissect-archive/default.nix
index 79a23a310d2d..e3f1ca21591a 100644
--- a/pkgs/development/python-modules/dissect-archive/default.nix
+++ b/pkgs/development/python-modules/dissect-archive/default.nix
@@ -4,23 +4,21 @@
   dissect-cstruct,
   dissect-util,
   fetchFromGitHub,
-  pythonOlder,
+  pytestCheckHook,
   setuptools,
   setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "dissect-archive";
-  version = "1.6";
+  version = "1.8";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.archive";
     tag = version;
-    hash = "sha256-TaNSgUL9Ia7Qz9qy+I+4vRFn5gGnsYxAgbsrI6iYrlo=";
+    hash = "sha256-HNbnluJPn275BYEdfBQdGtXlXlvZKFvDkJTpe0zgpdc=";
   };
 
   build-system = [
@@ -33,8 +31,17 @@ buildPythonPackage rec {
     dissect-util
   ];
 
+  nativeCheckInputs = [ pytestCheckHook ];
+
   pythonImportsCheck = [ "dissect.archive" ];
 
+  disabledTests = [
+    # Issue with archives
+    "test_vbk"
+    "test_vma"
+    "test_wim"
+  ];
+
   meta = with lib; {
     description = "Dissect module implementing parsers for various archive and backup formats";
     homepage = "https://github.com/fox-it/dissect.archive";

From 7123f9682e7aa21f1387f5c8facf7d8cac15340e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 17:17:54 +0100
Subject: [PATCH 12/19] python313Packages.dissect-btrfs: 1.7 -> 1.9

Diff: https://github.com/fox-it/dissect.btrfs/compare/1.7...1.9

Changelog: https://github.com/fox-it/dissect.btrfs/releases/tag/1.9
---
 pkgs/development/python-modules/dissect-btrfs/default.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-btrfs/default.nix b/pkgs/development/python-modules/dissect-btrfs/default.nix
index f1a5504d2418..f223bc6a46c6 100644
--- a/pkgs/development/python-modules/dissect-btrfs/default.nix
+++ b/pkgs/development/python-modules/dissect-btrfs/default.nix
@@ -6,7 +6,6 @@
   fetchFromGitHub,
   google-crc32c,
   python-lzo,
-  pythonOlder,
   setuptools,
   setuptools-scm,
   zstandard,
@@ -14,16 +13,14 @@
 
 buildPythonPackage rec {
   pname = "dissect-btrfs";
-  version = "1.7";
+  version = "1.9";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.btrfs";
     tag = version;
-    hash = "sha256-BREkGrQ1khz+uPahHeMwD0V8JytQY1K/oYa7nxP+bR0=";
+    hash = "sha256-qOyPMDZtudrvZNlyiL16gv513zuTCd2O14Q4QwHMmoc=";
   };
 
   nativeBuildInputs = [

From e3524281f92abb00940f666e146352feec042ce7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 17:22:26 +0100
Subject: [PATCH 13/19] python313Packages.dissect-ntfs: 3.14 -> 3.15

Changelog: https://github.com/fox-it/dissect.ntfs/releases/tag/3.15
---
 .../python-modules/dissect-ntfs/default.nix       | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-ntfs/default.nix b/pkgs/development/python-modules/dissect-ntfs/default.nix
index dbceefc817c0..6d2670f1aabe 100644
--- a/pkgs/development/python-modules/dissect-ntfs/default.nix
+++ b/pkgs/development/python-modules/dissect-ntfs/default.nix
@@ -7,21 +7,18 @@
   setuptools,
   setuptools-scm,
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "dissect-ntfs";
-  version = "3.14";
+  version = "3.15";
   pyproject = true;
 
-  disabled = pythonOlder "3.11";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.ntfs";
     tag = version;
-    hash = "sha256-C2tve1RVR8Q7t1Xz7Of1xRZH6IuLP9nL2l1cHbycFQ4=";
+    hash = "sha256-dd0AGkOXd+7VB6RIGiLoq1AFi4Uns1axW4V8MN8W7ao=";
   };
 
   build-system = [
@@ -43,6 +40,14 @@ buildPythonPackage rec {
     "tests/test_index.py"
   ];
 
+  disabledTests = [
+    # Issue with archive
+    "test_mft"
+    "test_ntfs"
+    "test_secure"
+    "test_fragmented_mft"
+  ];
+
   meta = with lib; {
     description = "Dissect module implementing a parser for the NTFS file system";
     homepage = "https://github.com/fox-it/dissect.ntfs";

From ae1d13196fa1e8a238b92b7177ec7a491cf4ee04 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 17:30:03 +0100
Subject: [PATCH 14/19] python313Packages.flow-record: 3.20 -> 3.21

Changelog: https://github.com/fox-it/flow.record/releases/tag/3.21
---
 .../python-modules/flow-record/default.nix    | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/flow-record/default.nix b/pkgs/development/python-modules/flow-record/default.nix
index 9900ba47f2ae..415ecd45623d 100644
--- a/pkgs/development/python-modules/flow-record/default.nix
+++ b/pkgs/development/python-modules/flow-record/default.nix
@@ -11,25 +11,24 @@
   maxminddb,
   msgpack,
   pytest7CheckHook,
-  pythonOlder,
   pytz,
   setuptools-scm,
   setuptools,
+  structlog,
+  tqdm,
   zstandard,
 }:
 
 buildPythonPackage rec {
   pname = "flow-record";
-  version = "3.20";
+  version = "3.21";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "flow.record";
     tag = version;
-    hash = "sha256-3jXxKA+MHjKfzKqOuP0EJxVD5QPvwjWE3N4qhIEFNvM=";
+    hash = "sha256-hJZCWF81pMeHOZGc6zTA046hV1J0PNQGMlPD3mgyrRI=";
   };
 
   build-system = [
@@ -52,6 +51,12 @@ buildPythonPackage rec {
     geoip = [ maxminddb ];
     avro = [ fastavro ] ++ fastavro.optional-dependencies.snappy;
     splunk = [ httpx ];
+    # xlsx = [ openpyxl ]; # Not available
+    full = [
+      structlog
+      tqdm
+    ]
+    ++ optional-dependencies.compression;
   };
 
   nativeCheckInputs = [
@@ -63,8 +68,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "flow.record" ];
 
   disabledTestPaths = [
-    # Test requires rdump
-    "tests/test_rdump.py"
+    # Input not available
+    "tests/adapter/test_xlsx.py"
+    # Requires rdump
+    "tests/tools/test_rdump.py"
   ];
 
   disabledTests = [ "test_rdump_fieldtype_path_json" ];

From e8f3144427f035b93ffc119b8549985ad907bc87 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 17:30:46 +0100
Subject: [PATCH 15/19] python313Packages.dissect-target: 3.23.1 -> 3.24

Changelog: https://github.com/fox-it/dissect.target/releases/tag/3.24
---
 .../python-modules/dissect-target/default.nix      | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-target/default.nix b/pkgs/development/python-modules/dissect-target/default.nix
index dca42e401eed..4c3f4bed3c4d 100644
--- a/pkgs/development/python-modules/dissect-target/default.nix
+++ b/pkgs/development/python-modules/dissect-target/default.nix
@@ -8,6 +8,7 @@
   dissect-cim,
   dissect-clfs,
   dissect-cstruct,
+  dissect-database,
   dissect-esedb,
   dissect-etl,
   dissect-eventlog,
@@ -33,28 +34,24 @@
   paho-mqtt,
   pycryptodome,
   pytestCheckHook,
-  pythonOlder,
   ruamel-yaml,
   setuptools,
   setuptools-scm,
   structlog,
-  tomli,
   yara-python,
   zstandard,
 }:
 
 buildPythonPackage rec {
   pname = "dissect-target";
-  version = "3.23.1";
+  version = "3.24";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.target";
     tag = version;
-    hash = "sha256-WOFtDFCN3OfhEjfhEgwtJN/tQVRGvd2RMQzcKtf0atU=";
+    hash = "sha256-i1oA7UVo880dHJkf19YRcmPV3Lwp1a8RokfRNDZ9gG0=";
     fetchLFS = true;
   };
 
@@ -71,6 +68,7 @@ buildPythonPackage rec {
   dependencies = [
     defusedxml
     dissect-cstruct
+    dissect-database
     dissect-eventlog
     dissect-evidence
     dissect-hypervisor
@@ -88,6 +86,7 @@ buildPythonPackage rec {
       dissect-btrfs
       dissect-cim
       dissect-clfs
+      dissect-database
       dissect-esedb
       dissect-etl
       dissect-extfs
@@ -103,8 +102,7 @@ buildPythonPackage rec {
       ruamel-yaml
       yara-python
       zstandard
-    ]
-    ++ lib.optionals (pythonOlder "3.11") [ tomli ];
+    ];
     yara = [ yara-python ] ++ optional-dependencies.full;
     smb = [ impacket ] ++ optional-dependencies.full;
     mqtt = [ paho-mqtt ] ++ optional-dependencies.full;

From ccefb83529e03d5c88b789d4edc7c68823fec638 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 19:53:28 +0100
Subject: [PATCH 16/19] python313Packages.dissect-vmfs: 3.11 -> 3.13

Changelog: https://github.com/fox-it/dissect.vmfs/releases/tag/3.13
---
 .../python-modules/dissect-vmfs/default.nix   | 28 ++++++++++++-------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-vmfs/default.nix b/pkgs/development/python-modules/dissect-vmfs/default.nix
index 8f91f46dcecc..c07ca0119c65 100644
--- a/pkgs/development/python-modules/dissect-vmfs/default.nix
+++ b/pkgs/development/python-modules/dissect-vmfs/default.nix
@@ -4,32 +4,29 @@
   dissect-cstruct,
   dissect-util,
   fetchFromGitHub,
-  setuptools,
-  setuptools-scm,
   pytestCheckHook,
-  pythonOlder,
+  setuptools-scm,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "dissect-vmfs";
-  version = "3.11";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.10";
+  version = "3.13";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.vmfs";
     tag = version;
-    hash = "sha256-jGPHZ26DDIcblgx4hP6L2BLHYY8YeIBcbxNR7bN/49g=";
+    hash = "sha256-4c3JVbQidGvXurWaO+/E0OehGgiY5shE5BiIBwMrCWM=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     dissect-cstruct
     dissect-util
   ];
@@ -38,6 +35,17 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "dissect.vmfs" ];
 
+  disabledTests = [
+    # Archive not present
+    "test_huge"
+    "test_lvm_basic"
+    "test_lvm_span"
+    "test_sparse"
+    "test_vmfs_basic"
+    "test_vmfs_content"
+    "test_vmfs_jbosf"
+  ];
+
   meta = with lib; {
     description = "Dissect module implementing a parser for the VMFS file system";
     homepage = "https://github.com/fox-it/dissect.vmfs";

From 666d8b4b864c74e75edfba8366136d6215668499 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 19:54:53 +0100
Subject: [PATCH 17/19] python313Packages.dissect: 3.20.1 -> 3.21

Changelog: https://github.com/fox-it/dissect/releases/tag/3.21
---
 pkgs/development/python-modules/dissect/default.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/dissect/default.nix b/pkgs/development/python-modules/dissect/default.nix
index 0015349fb296..70d8aca0b4ea 100644
--- a/pkgs/development/python-modules/dissect/default.nix
+++ b/pkgs/development/python-modules/dissect/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   buildPythonPackage,
+  dissect-apfs,
   dissect-archive,
   dissect-btrfs,
   dissect-cim,
@@ -31,23 +32,20 @@
   dissect-volume,
   dissect-xfs,
   fetchFromGitHub,
-  pythonOlder,
   setuptools,
   setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "dissect";
-  version = "3.20.1";
+  version = "3.21";
   pyproject = true;
 
-  disabled = pythonOlder "3.11";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect";
     tag = version;
-    hash = "sha256-Zc9NBrRDbSP5Yk3gJoMG+6nAGFxBHiPKvvfQLMcu+tk=";
+    hash = "sha256-INqZwN3x5MzrACyaUOa2A7mrKvld9reN1PJVxkq837o=";
   };
 
   pythonRelaxDeps = true;
@@ -58,6 +56,7 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
+    dissect-apfs
     dissect-archive
     dissect-btrfs
     dissect-cim

From 6a9326f2c437337247169486e270abfa2cb44986 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 20:00:59 +0100
Subject: [PATCH 18/19] python313Packages.acquire: 3.20.1 -> 3.21

Diff: https://github.com/fox-it/acquire/compare/3.20.1...3.21

Changelog: https://github.com/fox-it/acquire/releases/tag/3.21
---
 pkgs/development/python-modules/acquire/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/acquire/default.nix b/pkgs/development/python-modules/acquire/default.nix
index 979cc397b533..3208ce2fa9f9 100644
--- a/pkgs/development/python-modules/acquire/default.nix
+++ b/pkgs/development/python-modules/acquire/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "acquire";
-  version = "3.20.1";
+  version = "3.21";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "acquire";
     tag = version;
-    hash = "sha256-QX7rPoJJqBPdvN2LzSBw8kGDSsIHLm65TJ0uXuhwB4Q=";
+    hash = "sha256-CVwPMMQFGqvyxm5tK7JMEX8/dgiF25wwRNaLNfLLWto=";
   };
 
   build-system = [

From 1fd2ee0871cfcee8957dcfb626e0c6fc32eccb66 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Thu, 27 Nov 2025 20:37:12 +0100
Subject: [PATCH 19/19] python313Packages.dissect-cobaltstrike: disable failing
 tests

---
 .../python-modules/dissect-cobaltstrike/default.nix      | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/dissect-cobaltstrike/default.nix b/pkgs/development/python-modules/dissect-cobaltstrike/default.nix
index 4c8bdc38dfae..6ddd40b8c620 100644
--- a/pkgs/development/python-modules/dissect-cobaltstrike/default.nix
+++ b/pkgs/development/python-modules/dissect-cobaltstrike/default.nix
@@ -13,7 +13,6 @@
   pyshark,
   pytest-httpserver,
   pytestCheckHook,
-  pythonOlder,
   rich,
 }:
 
@@ -22,8 +21,6 @@ buildPythonPackage rec {
   version = "1.2.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "dissect.cobaltstrike";
@@ -73,6 +70,12 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "dissect.cobaltstrike" ];
 
+  disabledTests = [
+    # Don't run tests with a beacon
+    "test_c2profile_beacon_gate"
+    "test_beacon_dump_guardrails"
+  ];
+
   meta = with lib; {
     description = "Dissect module implementing a parser for Cobalt Strike related data";
     homepage = "https://github.com/fox-it/dissect.cobaltstrike";