Merge master into staging-next

2026-03-09 00:23:05 +00:00
parent f9287fae3d f7f03dc676
commit f0495fc1fc
92 changed files with 7098 additions and 1495 deletions
@@ -213,6 +213,8 @@

 - `vimPlugins.nvim-treesitter` has been updated to `main` branch, which is a full and incompatible rewrite. If you can't or don't want to update, you should use `vimPlugins.nvim-treesitter-legacy`.

+- `services.taskchampion-sync-server` module have been added an option `services.taskchampion-sync-server.dynamicUser` to use systemd's DynamicUser feature. This is enabled by default when stateVersion is at least 26.05, and disabled otherwise. If you need this feature, you need to set `services.taskchampion-sync-server.dynamicUser` to `true` and migrate `/var/lib/taskchampion-sync-server` to `/var/lib/private/taskchampion-sync-server`.
+
 ## Other Notable Changes {#sec-nixpkgs-release-26.05-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -274,7 +276,7 @@ gnuradioMinimal.override {

 - `mold` is now wrapped by default.

- `neovim` now disables by default the `python3` and `ruby` providers, unused by most users and reducing closure size from 365MiB to 240MiB.
+- `neovim` now disables by default the `python3` and `ruby` providers, unused by most users and reducing closure size from 365MiB to 240MiB. Host provider executables are not exposed anymore along with the neovim wrapper. You can still refer to those using the neovim provider variables (e.g., `python3_host_prog`).

 ### Deprecations {#sec-nixpkgs-release-26.05-lib-deprecations}

@@ -2688,12 +2688,6 @@
    githubId = 2530548;
    name = "Aaron VerDow";
  };
-  averelld = {
-    email = "averell+nixos@rxd4.com";
-    github = "averelld";
-    githubId = 687218;
-    name = "averelld";
-  };
  avery = {
    email = "nixpkgs@avery.cafe";
    github = "coolavery";
@@ -121,11 +121,17 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 - `services.oauth2-proxy.clientSecret` and `services.oauth2-proxy.cookie.secret` have been replaced with `services.oauth2-proxy.clientSecretFile` and `services.oauth2-proxy.cookie.secretFile` respectively. This was done to ensure secrets don't get made world-readable.

 - [`services.grafana.settings.security.secret_key`](#opt-services.grafana.settings.security.secret_key) doesn't have a
-  default value anymore. Please generate your own key or hard-code the old one explicitly.
+  default value anymore. Please generate your own key or hard-code the old one ("SW2YcwTIb9zpOOhoPsMm") explicitly.
  See the [upstream docs](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#secret_key) and
  the [instructions on how to rotate](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/#re-encrypt-secrets)
  for further information.

+  Please do note that there's no official way to rotate. On a single-node instance with the database and the secret-key being
+  on the same filesystem with the same permissions for Grafana only to read it's most likely OK to keep using the old key.
+
+  If you need to rotate, a [3rd-party tool, `grafana-secretkey-rotation-tool`](https://github.com/erooke/grafana-secretkey-rotation-tool/tree/d9dc788902fa5185e15cb15ce6129f7237ab6138) is a tested option.
+  When using a secret for this value, make sure to use [Grafana's variable expansion to inject secrets](https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#variable-expansion).
+
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.

 - `services.cgit` before always had the git-http-backend and its "export all" setting enabled, which sidestepped any access control configured in cgit's settings. Now you have to make a decision and either enable or disable `services.cgit.gitHttpBackend.checkExportOkFiles` (or disable the git-http-backend).
@@ -59,14 +59,20 @@ in
      type = types.listOf types.str;
      default = [ ];
    };
+    dynamicUser = lib.mkOption {
+      description = "Whether to use dynamic user";
+      type = types.bool;
+      default = lib.versionAtLeast config.system.stateVersion "26.05";
+    };
  };

  config = lib.mkIf cfg.enable {
-    users.users.${cfg.user} = lib.mkIf (cfg.user == defaultUser) {
+    users.users.${cfg.user} = lib.mkIf (!cfg.dynamicUser && cfg.user == defaultUser) {
      isSystemUser = true;
      inherit (cfg) group;
    };
-    users.groups.${cfg.group} = lib.mkIf (cfg.group == defaultGroup) { };
+    users.groups.${cfg.group} = lib.mkIf (!cfg.dynamicUser && cfg.group == defaultGroup) { };
+
    networking.firewall.allowedTCPPorts = lib.mkIf (cfg.openFirewall) [ cfg.port ];

    systemd.services.taskchampion-sync-server = {
@@ -75,12 +81,7 @@ in
      serviceConfig = {
        User = cfg.user;
        Group = cfg.group;
-        # If we enable DynamicUser, users need to move
-        # /var/lib/taskchampion-sync-server to
-        # /var/lib/private/taskchampion-sync-server manually, which is a
-        # breakage. So we keep the old behavior and we'll do the migration in
-        # another PR.
-        DynamicUser = false;
+        DynamicUser = cfg.dynamicUser;
        StateDirectory = lib.mkIf (cfg.dataDir == defaultDir) "taskchampion-sync-server";
        ExecStart = ''
          ${lib.getExe cfg.package} \
@@ -2070,6 +2070,11 @@ in
          for more information.

          See https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/#re-encrypt-secrets on how to re-encrypt.
+
+          As stated in the NixOS changelog for 26.05, there's no official way to rotate.
+          Either hard-code the old key ("SW2YcwTIb9zpOOhoPsMm") if your setup doesn't have any secrets in the DB that need
+          special protection or perform a rotation with a 3rd-party tool
+          (https://github.com/erooke/grafana-secretkey-rotation-tool/tree/d9dc788902fa5185e15cb15ce6129f7237ab6138).
        '';
      }
    ];
@@ -186,11 +186,15 @@ in
        "karakeep-workers.service"
      ];
      partOf = [ "karakeep.service" ];
-      environment = karakeepEnv;
+      environment = {
+        NEXT_CACHE_DIR = "%C/karakeep";
+      }
+      // karakeepEnv;
      serviceConfig = {
        ExecStart = "${cfg.package}/lib/karakeep/start-web";
        User = "karakeep";
        Group = "karakeep";
+        CacheDirectory = "karakeep";
        StateDirectory = "karakeep";
        EnvironmentFile = environmentFiles;
        PrivateTmp = "yes";
@@ -51,7 +51,7 @@ in
        with pkgs;
        [
          # `which` is used to test command availability
-          # See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java#L42
+          # See https://github.com/Stirling-Tools/Stirling-PDF/blob/main/app/core/src/main/java/stirling/software/SPDF/config/ExternalAppDepConfig.java#L262
          which
          unpaper
          libreoffice
@@ -117,5 +117,8 @@ in
    };
  };

-  meta.maintainers = with lib.maintainers; [ DCsunset ];
+  meta.maintainers = with lib.maintainers; [
+    DCsunset
+    timhae
+  ];
 }
@@ -28,7 +28,7 @@
              position = "start-of-file";
            }
          ];
-          vendorHash = "sha256-dNxHpXkiqz7B/JhZdxfZluIHFVXILlSm3XtB+v/EoMY=";
+          vendorHash = "sha256-MGgFbglyW/1CMhT1b83ETH70gRkz89s/Gp4seR2g7xI=";
        };
      };
    };
@@ -15,6 +15,7 @@
  perl,
  lndir,
  vimUtils,
+  runCommand,
 }:

 neovim-unwrapped:
@@ -154,14 +155,33 @@ let
          (lib.makeBinPath finalAttrs.runtimeDeps)
        ];

-        providerLuaRc = neovimUtils.generateProviderRc {
-          inherit (finalAttrs)
-            withPython3
-            withNodeJs
-            withPerl
-            withRuby
-            ;
-        };
+        providerLuaRc =
+          let
+            hostPython3 =
+              runCommand "nvim-host-${python3Env.name}"
+                {
+                  nativeBuildInputs = [
+                    makeWrapper
+                  ];
+                }
+                ''
+                  makeWrapper ${python3Env.interpreter} $out/bin/nvim-python3 --unset PYTHONPATH --unset PYTHONSAFEPATH
+                '';
+
+            genProviderCommand =
+              prog: withProg: exec:
+              if withProg then
+                "vim.g.${prog}_host_prog='${exec}'"
+              else
+                # speeds up neovim by bypassing provider discovery
+                "vim.g.loaded_${prog}_provider=0";
+          in
+          lib.concatStringsSep ";" [
+            (genProviderCommand "node" finalAttrs.withNodeJs "${neovim-node-client}/bin/neovim-node-host")
+            (genProviderCommand "perl" finalAttrs.withPerl "${perlEnv}/bin/perl")
+            (genProviderCommand "ruby" finalAttrs.withRuby "${finalAttrs.rubyEnv}/bin/neovim-ruby-host")
+            (genProviderCommand "python3" finalAttrs.withPython3 "${hostPython3}/bin/nvim-python3")
+          ];

        # If `configure` != {}, we can't generate the rplugin.vim file with e.g
        # NVIM_SYSTEM_RPLUGIN_MANIFEST *and* NVIM_RPLUGIN_MANIFEST env vars set in
@@ -236,18 +256,6 @@ let
            substitute ${neovim-unwrapped}/share/applications/nvim.desktop $out/share/applications/nvim.desktop \
              --replace-warn 'Name=Neovim' 'Name=Neovim wrapper'
          ''
-          + lib.optionalString finalAttrs.withPython3 ''
-            makeWrapper ${python3Env.interpreter} $out/bin/nvim-python3 --unset PYTHONPATH --unset PYTHONSAFEPATH
-          ''
-          + lib.optionalString (finalAttrs.withRuby) ''
-            ln -s ${finalAttrs.rubyEnv}/bin/neovim-ruby-host $out/bin/nvim-ruby
-          ''
-          + lib.optionalString finalAttrs.withNodeJs ''
-            ln -s ${neovim-node-client}/bin/neovim-node-host $out/bin/nvim-node
-          ''
-          + lib.optionalString finalAttrs.withPerl ''
-            ln -s ${perlEnv}/bin/perl $out/bin/nvim-perl
-          ''
          + lib.optionalString finalAttrs.vimAlias ''
            ln -s $out/bin/nvim $out/bin/vim
          ''
@@ -12,13 +12,13 @@
 }:
 mkLibretroCore {
  core = "mupen64plus-next";
-  version = "0-unstable-2026-01-20";
+  version = "0-unstable-2026-03-03";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "mupen64plus-libretro-nx";
-    rev = "bc43bcedc276861254b48526f56799d63a30723b";
-    hash = "sha256-0dofQP35EmVY6i5muwIARuF1G4+92jhFjAiWcwyJDTs=";
+    rev = "899eaf6d629b264fedc9afd45a5e01895045a90b";
+    hash = "sha256-FxRuCPMT3K0AeXj2/ZwgW7KQgB/iny1a9ydgGqnyfrQ=";
  };

  # Fix for GCC 14
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "nestopia";
-  version = "0-unstable-2026-01-10";
+  version = "0-unstable-2026-02-28";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "nestopia";
-    rev = "473d3072be67fa2542ca833c274ef6682cf0f0bc";
-    hash = "sha256-He60RyFhTL7A+juTPbr032tsXoOEOzK4JzCmF03l7gU=";
+    rev = "c0ae3bcbe78a1a21a20384b96b70774cc165d2c2";
+    hash = "sha256-T4SC2yH/il6fjYd+4cWK4c+VqHMBc0uR3sXzPF6Z4O0=";
  };

  makefile = "Makefile";
@@ -45,11 +45,11 @@
    "vendorHash": "sha256-btxzZZtvgeih+OUhc5QnF8ac22TxpGibffGNkljjq6c="
  },
  "aliyun_alicloud": {
-    "hash": "sha256-XSXK7PH5MezbtQfrDh+z7nRUFsgiXwCtNbI4clbtozU=",
+    "hash": "sha256-5KqzbCVLtpLo22BPOuZexkOS8Qv9i3/B9UCBWtGI5G8=",
    "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
    "owner": "aliyun",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.271.0",
+    "rev": "v1.272.1",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-Hvk2jckla1LcMankcdUTct8Kea0OznyxDxTJ+UrJHy0="
  },
@@ -778,13 +778,13 @@
    "vendorHash": "sha256-mnKXYT0GfIS+ODzBCS9l4rLF1ugadesmpgdOgj74nLg="
  },
  "jianyuan_sentry": {
-    "hash": "sha256-sZdF4YnrsjTt8wsgdDdocHciRZbv2+l+b8zOr/WZYiQ=",
+    "hash": "sha256-iiFDZfTM3DoYEd33P3YFjwsnEJ1klVrIyWIB4vVRIB0=",
    "homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
    "owner": "jianyuan",
    "repo": "terraform-provider-sentry",
-    "rev": "v0.14.10",
+    "rev": "v0.14.11",
    "spdx": "MIT",
-    "vendorHash": "sha256-vJmzsdY2Yt09X2ZQgC5SA0mntjH/rIanaxQfBuivE7M="
+    "vendorHash": "sha256-LGqH/XLNbU31acdzTO4RB5+LBxlNH2jEiK6SujUfX5U="
  },
  "joneshf_openwrt": {
    "hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",
@@ -896,13 +896,13 @@
    "vendorHash": "sha256-2IlD9IdiN+TBk/Eng2K4jZD8GB91IvQPeVAKhxI/6aY="
  },
  "metio_migadu": {
-    "hash": "sha256-FPUWuQnklyy66SXUY3QpCHza5f0oVMrticd+j/YwKNc=",
+    "hash": "sha256-z3xHms9rHbPa6pTspOwXNOrNG4i03yQCfLOR/Q0g0+Y=",
    "homepage": "https://registry.terraform.io/providers/metio/migadu",
    "owner": "metio",
    "repo": "terraform-provider-migadu",
-    "rev": "2026.2.26",
+    "rev": "2026.3.5",
    "spdx": "0BSD",
-    "vendorHash": "sha256-sxOopd49N1ABIZkp9XpP03N2BMIA5FO9reZPl8aSomU="
+    "vendorHash": "sha256-L1Pund4PgtvEu+76GWgfsPP6lUlN1xiDydW+n6nKNHE="
  },
  "mongey_kafka": {
    "hash": "sha256-rTa6c7jAMH027V7h/yUGVGz6TS0PDdObilxU0Vpr6FI=",
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "imapfilter";
-  version = "2.8.3";
+  version = "2.8.4";

  src = fetchFromGitHub {
    owner = "lefcha";
    repo = "imapfilter";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-9uPcdxZioXfdSuZO/fgtoIbQdWtc2DRr28iTonnG05U=";
+    sha256 = "sha256-ZuyRnN4khdE+z54Ag0b/coiGdUzn/9yT49GpDI4kr8Q=";
  };
  makeFlags = [
    "SSLCAFILE=/etc/ssl/certs/ca-bundle.crt"
@@ -281,8 +281,8 @@
  },
  {
    "pname": "Markdig.Signed",
-    "version": "0.44.0",
-    "hash": "sha256-3up6BkNjqNlJsishh9FY4ITemUHzit6QsbbkxO7ldXA="
+    "version": "1.0.0",
+    "hash": "sha256-wheTLXU+IO6TSvI/ab4MZIZ24vX6jQ2et19heytvr/8="
  },
  {
    "pname": "Microsoft.ApplicationInsights",
@@ -291,8 +291,8 @@
  },
  {
    "pname": "Microsoft.AspNetCore.OpenApi",
-    "version": "10.0.2",
-    "hash": "sha256-FU57fPXL4NUDRqi+rLresi4yKttv1KcAnLuEdPCyTos="
+    "version": "10.0.3",
+    "hash": "sha256-j7lAYuz2585j/j24XkptImH7WHx9rBp+tY8ZXqpC77k="
  },
  {
    "pname": "Microsoft.CodeAnalysis.ResxSourceGenerator",
@@ -336,8 +336,8 @@
  },
  {
    "pname": "Microsoft.Extensions.DependencyModel",
-    "version": "6.0.2",
-    "hash": "sha256-WVM/gshGie1J9q5l3YWRzrPWYlVvX6ISI+SiVMoPp5o="
+    "version": "8.0.2",
+    "hash": "sha256-PyuO/MyCR9JtYqpA1l/nXGh+WLKCq34QuAXN9qNza9Q="
  },
  {
    "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
@@ -386,23 +386,23 @@
  },
  {
    "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.15.0",
-    "hash": "sha256-LKTvERNUTMCEF7xs377tCMwOMRki93OS4kh6Yv0uXJ4="
+    "version": "8.16.0",
+    "hash": "sha256-OpTFQpTtg1A8I1bBIOqv/n9pwYXTqzMI8ZLXLZDti5w="
  },
  {
    "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.15.0",
-    "hash": "sha256-LwzKiGjcnORvmQ9tim6lomXpfVlPpd/fE8FKTFWKlpM="
+    "version": "8.16.0",
+    "hash": "sha256-Cctf2iuIXLMklTuCvzWv721v2mHs0HEBA47BqAKhp9I="
  },
  {
    "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.15.0",
-    "hash": "sha256-mMXwsjGcrrmHR1mG7BLTKg/30mX+m93QVX17/ynOOd4="
+    "version": "8.16.0",
+    "hash": "sha256-355u+3LIn/QfiCHFMXD+3ipdRTnbXLAQNzC4sWEFapQ="
  },
  {
    "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.15.0",
-    "hash": "sha256-7Lo/TsvqgNCEMyFssO3Om233521Pqgb9K9lUeHc5HMk="
+    "version": "8.16.0",
+    "hash": "sha256-6s8ZLnKw32W6+KbnahCVe1v9YzpoemnpHNQ3VbFSV4M="
  },
  {
    "pname": "Microsoft.NET.Test.Sdk",
@@ -416,33 +416,28 @@
  },
  {
    "pname": "Microsoft.Testing.Extensions.CodeCoverage",
-    "version": "18.1.0",
-    "hash": "sha256-sw6HGpoJ51ldPedpP516gpYxZS7Wi9/08LFYVvI5xgk="
+    "version": "18.4.1",
+    "hash": "sha256-GhxGUnM8Dvef4E0mPrNOEkoHD/sjcZX68rd78OytPPY="
  },
  {
    "pname": "Microsoft.Testing.Extensions.Telemetry",
-    "version": "2.0.2",
-    "hash": "sha256-8f23W3125L2ZAExRVwvXSft3a93k+pSb/0CZV0HlFi4="
+    "version": "2.1.0",
+    "hash": "sha256-SawLiz1fB3QbkkyEVloEj8UpQTAIZR7U9FZfqwCkGr0="
  },
  {
    "pname": "Microsoft.Testing.Extensions.TrxReport",
-    "version": "2.0.2",
-    "hash": "sha256-cLMtPX9TOOEKrlrrRwqKpsWE5qeIB7eS792+rDt+z20="
+    "version": "2.1.0",
+    "hash": "sha256-wNFj4ovblsnnDIYfDmhAE87hA5YWONhLSGLyTRuxbS4="
  },
  {
    "pname": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
-    "version": "2.0.2",
-    "hash": "sha256-ePhFIkoWZVt79Tkhu62MxYyIheFMBhf1NUbIimZIZ9c="
+    "version": "2.1.0",
+    "hash": "sha256-X54qc4Ey+3hm0e5eCY1R2me8b4zGrWzjesm9fGJWXys="
  },
  {
    "pname": "Microsoft.Testing.Extensions.VSTestBridge",
-    "version": "2.0.2",
-    "hash": "sha256-odn6fZO7yaPs3EaEUr12GraVH5anp0r/BabJpJl8q/c="
-  },
-  {
-    "pname": "Microsoft.Testing.Platform",
-    "version": "2.0.0",
-    "hash": "sha256-YXhxULoi2mrpVHhrf/hu3lSOREU6hueFzDDb1YAlGs4="
+    "version": "2.1.0",
+    "hash": "sha256-2m14uEmuEELn4Ci/CZNpKjhlnzq9vYvhgeiM03DZj7A="
  },
  {
    "pname": "Microsoft.Testing.Platform",
@@ -450,14 +445,14 @@
    "hash": "sha256-K8B4tQaYslm+njUQ59nyvh4f4UgrbOo6DQgO9Hwt0aY="
  },
  {
-    "pname": "Microsoft.Testing.Platform.MSBuild",
-    "version": "2.0.2",
-    "hash": "sha256-RbL2Ie/sQx07hffiao8ScR+yMyYqI8astlC0/uf3bzM="
+    "pname": "Microsoft.Testing.Platform",
+    "version": "2.1.0",
+    "hash": "sha256-CbR0j0Dh65cMccO7L6ppx4b5iiXjqxjjfC9A85HeLuM="
  },
  {
-    "pname": "Microsoft.TestPlatform.AdapterUtilities",
-    "version": "18.0.1",
-    "hash": "sha256-LE5xsyc75ERflV/EA4A4DV+ja2LAb0KR/DPinAG+AgI="
+    "pname": "Microsoft.Testing.Platform.MSBuild",
+    "version": "2.1.0",
+    "hash": "sha256-6T2tBSokr5/oiwqKASk18BieKqkIzDbYX32j1Hl1z1g="
  },
  {
    "pname": "Microsoft.TestPlatform.ObjectModel",
@@ -471,23 +466,23 @@
  },
  {
    "pname": "MSTest",
-    "version": "4.0.2",
-    "hash": "sha256-E52sXCyo0YiuKSM8VkwwHMCcHcUC/giuun/T0RahTG8="
+    "version": "4.1.0",
+    "hash": "sha256-uzieN/+aBExm5gKSzQLwkTxrNqGigGhozeAOaApI8bg="
  },
  {
    "pname": "MSTest.Analyzers",
-    "version": "4.0.2",
-    "hash": "sha256-SpQObHM9ir3tEWebiAAXG2G/TGQ3NB0fWGWOQLLpwmg="
+    "version": "4.1.0",
+    "hash": "sha256-FeMIXYRPxXJCAKOk3dKWCtoNX3wC36NqC/IduOd1xTE="
  },
  {
    "pname": "MSTest.TestAdapter",
-    "version": "4.0.2",
-    "hash": "sha256-p06FCoiJuRPfLUGXPmUv5gCu0Fadul0ZAO8A3DwjQuk="
+    "version": "4.1.0",
+    "hash": "sha256-g7MuXzSJ2+ydwPzdBRzE8WFsjWSI3tf1X0rLNy7a9qU="
  },
  {
    "pname": "MSTest.TestFramework",
-    "version": "4.0.2",
-    "hash": "sha256-R56Cr4JGR7HJlOGgtDeyyxCwfZLpTK0jm0ywJaGz09U="
+    "version": "4.1.0",
+    "hash": "sha256-ELpj0a6VDEIzY7RWsdyF/DREK8I/6CZen3OYO5dvloI="
  },
  {
    "pname": "Newtonsoft.Json",
@@ -516,18 +511,18 @@
  },
  {
    "pname": "NLog",
-    "version": "6.0.6",
-    "hash": "sha256-vLtwZ32e1GWB93SGwmDAdUogQOf/5GuIcovO9Pn6qj8="
+    "version": "6.1.0",
+    "hash": "sha256-VetdjDZIr6JseO6VXXqvfO25Nl5ux/TyRqLnqaafmoI="
  },
  {
    "pname": "NLog.Extensions.Logging",
-    "version": "6.1.0",
-    "hash": "sha256-Oyry9kBF1ZzABCYnJo864xJAoRhPPG5X/q+OtdmYtDY="
+    "version": "6.1.1",
+    "hash": "sha256-v2KIBN+hSKbx19+ku2ckEQdpOlM6Y0X6i9jTfHh9pGA="
  },
  {
    "pname": "NLog.Web.AspNetCore",
-    "version": "6.1.0",
-    "hash": "sha256-yR+to0WwIrO6/T92nm2Yy7WP7IrED9mquNJ6V7hrEow="
+    "version": "6.1.1",
+    "hash": "sha256-zFJPxSJP/8CX4POLZlELo6GWrhtq+qoox5v8zxgI+IM="
  },
  {
    "pname": "OpenTelemetry",
@@ -581,8 +576,8 @@
  },
  {
    "pname": "Scalar.AspNetCore",
-    "version": "2.12.18",
-    "hash": "sha256-dVZrNEmY/Yp04ocRbvwK79sMh44eDV30CNQDLRVPENA="
+    "version": "2.12.47",
+    "hash": "sha256-qkZ6+Ewo0Iz4lC3j55/iOmR2qrBzwZBIO/uTyy2QAbI="
  },
  {
    "pname": "SteamKit2",
@@ -591,33 +586,33 @@
  },
  {
    "pname": "System.Composition",
-    "version": "10.0.2",
-    "hash": "sha256-HHTaPyFHL3SLfTHe6cOcO3z3CrsWHYbUvlmIp3MCZ8w="
+    "version": "10.0.3",
+    "hash": "sha256-81CJpH6NkGt7WhvKc8KD8ou7cH9BQu7NLZix/pWkPEQ="
  },
  {
    "pname": "System.Composition.AttributedModel",
-    "version": "10.0.2",
-    "hash": "sha256-/pMEZjXy/x1+kF2Hj5xQMvJ4sSRCLqJvwC4XnEssgQU="
+    "version": "10.0.3",
+    "hash": "sha256-FhZN6OSjc4tNeNjkifqxkfMvPiQEcAG+T7NRhTpXWuw="
  },
  {
    "pname": "System.Composition.Convention",
-    "version": "10.0.2",
-    "hash": "sha256-Ae67mZbvI2WiuVtfgyUKT6xYvBSOly7np7NW192bFUs="
+    "version": "10.0.3",
+    "hash": "sha256-whirt1+xCPnBS3Sj1fZL7/RIJIuS58qox3GleD98ac8="
  },
  {
    "pname": "System.Composition.Hosting",
-    "version": "10.0.2",
-    "hash": "sha256-WZVIqnyqr0skssT/IM49r11N5ZYr6YkvzppJ9eOEOsE="
+    "version": "10.0.3",
+    "hash": "sha256-V0PMVPXrUUE1veGa9V4qanVs689hOm7DGoAuzw0yaQg="
  },
  {
    "pname": "System.Composition.Runtime",
-    "version": "10.0.2",
-    "hash": "sha256-5DhApAVO4L8gJ41ybpDIU0z7f++ptPeJMDsODfLuqGM="
+    "version": "10.0.3",
+    "hash": "sha256-IWDg2bHhwrKxHyDWbWtFdhCgVo8bOE1nK6HceOyHo2E="
  },
  {
    "pname": "System.Composition.TypedParts",
-    "version": "10.0.2",
-    "hash": "sha256-ztXCBCAVNvKQxcyOfnfkKY7unw24qWRMjb+dG1BtzTM="
+    "version": "10.0.3",
+    "hash": "sha256-JZFr57s6U4bIsblK+G1fUVDMns8j7jHz06trXEJQDvU="
  },
  {
    "pname": "System.IO.Hashing",
@@ -626,13 +621,13 @@
  },
  {
    "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "10.0.2",
-    "hash": "sha256-FnpxhnVrLdn3y35NmYRgxh7dw0odYYwco4RotlTuwsI="
+    "version": "10.0.3",
+    "hash": "sha256-JF/WTKv00v/C4ml4g/VL3j4JMPpZa1HBmVMvUnphHr4="
  },
  {
    "pname": "Tmds.DBus.Protocol",
-    "version": "0.23.0",
-    "hash": "sha256-YIkrazOeITsW7YDm15AvTqMKj7D2PDJtb+gqUuCdvLA="
+    "version": "0.90.3",
+    "hash": "sha256-jK/98C0WrkVqPPNMx+xkdGK7vhcFmDsMqX7hUmALAWM="
  },
  {
    "pname": "ZstdSharp.Port",
@@ -21,13 +21,13 @@ in
 buildDotnetModule rec {
  pname = "archisteamfarm";
  # nixpkgs-update: no auto update
-  version = "6.3.2.3";
+  version = "6.3.3.3";

  src = fetchFromGitHub {
    owner = "JustArchiNET";
    repo = "ArchiSteamFarm";
    rev = version;
-    hash = "sha256-bTaa7iRUcd2yHov9pBqUo8VxdjukuKFA6HO88bQ56sg=";
+    hash = "sha256-xLS9YUDY54nzt3MjOQv5TvT6TCNpiFo+goKMtiv+jjs=";
  };

  dotnet-runtime = dotnetCorePackages.aspnetcore_10_0;
@@ -22,5 +22,4 @@ fi

 $(nix-build -A archisteamfarm.fetch-deps --no-out-link)

-cd "$asf_path/web-ui"
-./update.sh
+"$asf_path/web-ui/update.sh"
@@ -7,7 +7,7 @@

 buildNpmPackage rec {
  pname = "asf-ui";
-  version = "b8704cb1f5f2f57676b745e2e865af3cd6e7ca9a";
+  version = "a4d5a9a4fbd09ad2ed00ec09db8344175f120898";

  src = fetchFromGitHub {
    owner = "JustArchiNET";
@@ -15,10 +15,10 @@ buildNpmPackage rec {
    # updated by the update script
    # this is always the commit that should be used with asf-ui from the latest asf version
    rev = version;
-    hash = "sha256-AwZhmYHqrOcsbK2Vj4mB4ayysAS7qHruid1qKx9IBhg=";
+    hash = "sha256-PP9VT1F8EX5AgNr3OGsirDkUSVAzKHbBpJi6XBlEWeg=";
  };

-  npmDepsHash = "sha256-A+BH8oYInndabovBvD+SCMg/+9gfajwGaWVu9jULuoA=";
+  npmDepsHash = "sha256-bqwDKSaQt6ptfZC7B332Ig/BAZvJRQ/NaxPgA5VQ884=";

  installPhase = ''
    runHook preInstall
@@ -1,15 +1,16 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=../../../../.. -i bash -p curl gnused jq common-updater-scripts prefetch-npm-deps
+#! nix-shell -I nixpkgs=./. -i bash -p curl gnused jq common-updater-scripts prefetch-npm-deps
 set -eou pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"

-cd "$(dirname "$0")"/../../../../..
+cd ../../../../..
 version=$(nix-instantiate --strict --eval -A archisteamfarm.version | jq -r)
 cd -
 ui=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "https://api.github.com/repos/JustArchiNET/ArchiSteamFarm/contents/ASF-ui?ref=$version" | jq -r .sha)

 curl "https://raw.githubusercontent.com/JustArchiNET/ASF-ui/$ui/package-lock.json" -o package-lock.json

-cd -
+cd ../../../../..
 update-source-version archisteamfarm.ui "$ui"
 cd -

@@ -19,6 +19,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    "radixtarget"
    "regex"
    "tabulate"
+    "websockets"
  ];

  build-system = with python3.pkgs; [
@@ -69,7 +70,10 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    description = "OSINT automation for hackers";
    homepage = "https://pypi.org/project/bbot/";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ fab ];
+    maintainers = with lib.maintainers; [
+      fab
+      robsliwi
+    ];
    mainProgram = "bbot";
  };
 })
@@ -9,10 +9,10 @@
 }:
 let
  pname = "beeper";
-  version = "4.2.587";
+  version = "4.2.605";
  src = fetchurl {
    url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-x86_64.AppImage";
-    hash = "sha256-wcefnGwR8Yz13CE3wbMU6J4hglA2lfpaGE5pklqib6w=";
+    hash = "sha256-c+ISP/6kWR7RMV55LR8Ap4CIn9y1h6Vo9A92+7tpVL8=";
  };
  appimageContents = appimageTools.extract {
    inherit pname version src;
@@ -6,7 +6,7 @@
  installShellFiles,
  nixosTests,
  externalPlugins ? [ ],
-  vendorHash ? "sha256-3cY4Nd2RX5OKnJaQ7StYDsyq27qE1VY4wGaY4wiDeFQ=",
+  vendorHash ? "sha256-qodzzBee+4NeZ+XifMknFPayBcWDmbyYq1R6Xhuras0=",
 }:

 let
@@ -14,13 +14,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "coredns";
-  version = "1.14.1";
+  version = "1.14.2";

  src = fetchFromGitHub {
    owner = "coredns";
    repo = "coredns";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WcRX2BCWIQ8e0FYCIAzCdexz+Nl+/kKicQkhEw2AVMs=";
+    hash = "sha256-c0xXZnc0muXViPqMCJsD8TTGMbVCOKE49ElAHEPnKlw=";
  };

  inherit vendorHash;
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "firecracker";
-  version = "1.14.1";
+  version = "1.14.2";

  src = fetchFromGitHub {
    owner = "firecracker-microvm";
    repo = "firecracker";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-XMQNIIUo8LP/Ypgf5cGNE379tk4yFJ5ExIJc4+ukv7w=";
+    hash = "sha256-29ZI8RmHH3fz/nUb7EeD51qGUKEKj0UKURxbpmiwwzs=";
  };

-  cargoHash = "sha256-H9t2XUk/J7kcGlers8rQLWPMThGpr+XAiemWQisCjh4=";
+  cargoHash = "sha256-GtHIZJMLdMZNCXzVw6w3KjhzlxCJhC9eaKRDeVWwklY=";

  # For aws-lc-sys@0.22.0: use external bindgen.
  env.AWS_LC_SYS_EXTERNAL_BINDGEN = "true";
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "newt";
-  version = "1.10.1";
+  version = "1.10.2";

  src = fetchFromGitHub {
    owner = "fosrl";
    repo = "newt";
    tag = finalAttrs.version;
-    hash = "sha256-JU4aBwwdlxlBGHKmceyjcAVUZoT9voaWPFAkha4aXSE=";
+    hash = "sha256-CNE/YeO9dzH/YgCdVIaK79EFuANxYkxtLqpcTEapiCc=";
  };

-  vendorHash = "sha256-Sib6AUCpMgxlMpTc2Esvs+UU0yduVOxWUgT44FHAI+k=";
+  vendorHash = "sha256-vy6Dqjek7pLdASbCrM9snq5Dt9lbwNJ0AuQboy1JWNQ=";

  nativeInstallCheckInputs = [ versionCheckHook ];

@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "havn";
-  version = "0.3.4";
+  version = "0.3.5";

  src = fetchFromGitHub {
    owner = "mrjackwills";
    repo = "havn";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1NzOEnLgfvANE4N4Kt2HxJSxV8EdI1OWTsP993kUi4U=";
+    hash = "sha256-cYhhNhrMrPvqEIrb9Vznap8UW2ZNhGSzsAEmgtGfmy4=";
  };

-  cargoHash = "sha256-Ja99sc28n/djr+TpO9lQRMZ+fcc3nI7iO291p2qfjDI=";
+  cargoHash = "sha256-wcAdRS/ACBbnwN+vKmBLOpxw4SbrfTYo+E32PX6btTs=";

  checkFlags = [
    # Skip tests that require network access
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "infrastructure-agent";
-  version = "1.72.6";
+  version = "1.72.7";

  src = fetchFromGitHub {
    owner = "newrelic";
    repo = "infrastructure-agent";
    rev = finalAttrs.version;
-    hash = "sha256-wMQL0RAhJ/pGOWUQouiod735pDR6bFVJr0SXk0p0gyQ=";
+    hash = "sha256-XpUgv63q1zukjQq/LhPw3vecV0pMbyhtxUCR6oT+e14=";
  };

  vendorHash = "sha256-H41FxeJLrlaL/KbcBAS1WuMfVn6d+4So3egXb6E46/o=";
@@ -47,20 +47,32 @@ let
        doCheck = false;
      });

+      # ariadne 0.29+ is missing 'convert_kwargs_to_snake_case'
+      ariadne = prev.ariadne.overridePythonAttrs (oldAttrs: rec {
+        version = "0.28.0";
+        src = fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          hash = "sha256-gW66L7djPo4nHjd/UN18IPYFo956wzSqM+p1AZF/qnw=";
+        };
+        patches = [ ];
+        doCheck = false;
+      });
+
    };
  };
 in

 py.pkgs.buildPythonPackage (finalAttrs: {
  pname = "irrd";
-  version = "4.5.0";
+  version = "4.5.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "irrdnet";
    repo = "irrd";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6z94Ha2QQ0LE4o3hzsNl4y/nPv849cSP8on3UeegE4c=";
+    hash = "sha256-98DXooabwJtjI+m/HNMGBkZKT843bEbTaXJgflVdx/A=";
  };

  pythonRelaxDeps = true;
@@ -129,6 +141,7 @@ py.pkgs.buildPythonPackage (finalAttrs: {
      jinja2
      joserfc
      time-machine
+      service-identity
    ]
    ++ py.pkgs.uvicorn.optional-dependencies.standard;

@@ -96,6 +96,12 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postBuild
  '';

+  preInstall = ''
+    # provide a environment variable to override the cache directory
+    # https://github.com/vercel/next.js/discussions/58864
+    patch -p1 -i ${./patches/cache-from-env-not-nix-store.patch}
+  '';
+
  installPhase = ''
    runHook preInstall

@@ -0,0 +1,14 @@
+diff --git a/apps/web/.next/standalone/node_modules/next/dist/server/image-optimizer.js b/apps/web/.next/standalone/node_modules/next/dist/server/image-optimizer.js
+index cba8876..c3d7c43 100644
+--- a/apps/web/.next/standalone/node_modules/next/dist/server/image-optimizer.js
+++ b/apps/web/.next/standalone/node_modules/next/dist/server/image-optimizer.js
+@@ -409,7 +409,8 @@ class ImageOptimizerCache {
+         ]);
+     }
+     constructor({ distDir, nextConfig }){
+-        this.cacheDir = (0, _path.join)(distDir, "cache", "images");
+        const cacheDir = process.env["NEXT_CACHE_DIR"] || (0, _path.join)(distDir, "cache");
+        this.cacheDir = (0, _path.join)(cacheDir, "images");
+         this.nextConfig = nextConfig;
+     }
+     async get(cacheKey) {
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "kine";
-  version = "0.14.12";
+  version = "0.14.13";

  src = fetchFromGitHub {
    owner = "k3s-io";
    repo = "kine";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-/8qTtnlZhEDkb+V7KOB2VT9dkQRTYFSZN8Cmx2i9BGw=";
+    hash = "sha256-hIEkyDK3oSm7Lo/h5RRAb0plvuz+kpnb7RNT9pu1mhY=";
  };

-  vendorHash = "sha256-AVlq/1+ESjx8tcndaDHk5xDY0jFCJ7LqIjuj1Ccm/dE=";
+  vendorHash = "sha256-1CC950oKczvi3WjVtRiw6eH8O/T8WJKbnmpaLizTGbQ=";

  ldflags = [
    "-s"
@@ -42,9 +42,8 @@ stdenv.mkDerivation {
    description = "Go engine modeled after AlphaGo Zero";
    homepage = "https://github.com/gcp/leela-zero";
    license = lib.licenses.gpl3Plus;
-    maintainers = [
-      lib.maintainers.averelld
-      lib.maintainers.omnipotententity
+    maintainers = with lib.maintainers; [
+      omnipotententity
    ];
    platforms = lib.platforms.linux;
  };
@@ -27,16 +27,16 @@ let
 in
 phpPackage.buildComposerProject2 rec {
  pname = "librenms";
-  version = "25.12.0";
+  version = "26.2.0";

  src = fetchFromGitHub {
    owner = "librenms";
    repo = "librenms";
    tag = version;
-    hash = "sha256-d73izEdLWviOp0XcMbQ3goLWgLZupO4QtQv7WUxdfk8=";
+    hash = "sha256-cFFAUgUq+AxOdmHI92WYY6h9jSubXRUL4Jp8q+mDdHg=";
  };

-  vendorHash = "sha256-34+srnXDto82xuITDSPEiNnbCgmZbijvpqpmwlszCEg=";
+  vendorHash = "sha256-73E3fH1JUHxjphF6aPrmNJu3P1DZd28blmBxSiyuCTc=";

  php = phpPackage;

@@ -84,12 +84,10 @@ phpPackage.buildComposerProject2 rec {
      --replace-fail '"default": "rrdtool",' '"default": "${rrdtool}/bin/rrdtool",' \
      --replace-fail '"default": "snmpgetnext",' '"default": "${net-snmp}/bin/snmpgetnext",' \
      --replace-fail '"default": "traceroute",' '"default": "/run/wrappers/bin/traceroute",' \
-      --replace-fail '"default": "/usr/bin/dot",' '"default": "${graphviz}/bin/dot",' \
      --replace-fail '"default": "/usr/bin/ipmitool",' '"default": "${ipmitool}/bin/ipmitool",' \
      --replace-fail '"default": "/usr/bin/mtr",' '"default": "${mtr}/bin/mtr",' \
      --replace-fail '"default": "/usr/bin/nfdump",' '"default": "${nfdump}/bin/nfdump",' \
      --replace-fail '"default": "/usr/bin/nmap",' '"default": "${nmap}/bin/nmap",' \
-      --replace-fail '"default": "/usr/bin/sfdp",' '"default": "${graphviz}/bin/sfdp",' \
      --replace-fail '"default": "/usr/bin/snmpbulkwalk",' '"default": "${net-snmp}/bin/snmpbulkwalk",' \
      --replace-fail '"default": "/usr/bin/snmpget",' '"default": "${net-snmp}/bin/snmpget",' \
      --replace-fail '"default": "/usr/bin/snmptranslate",' '"default": "${net-snmp}/bin/snmptranslate",' \
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "livekit";
-  version = "1.9.11";
+  version = "1.9.12";

  src = fetchFromGitHub {
    owner = "livekit";
    repo = "livekit";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-mmDTY4nWUowSHPTSlvfVaNlv0Rp176H5FvJsYrNnt/8=";
+    hash = "sha256-GVhhej3VZY/+UDs/TgRpe1nRMRNbJeAUvGv2GNrQGt4=";
  };

-  vendorHash = "sha256-yEAIfef7Ryepcpq9Te+Iamod1SfqXZoluhFaYGYcsVc=";
+  vendorHash = "sha256-WzM1SzWvTeiygrt/TYjXXTG/LO2Wsp28Mf3PZMl0qmY=";

  subPackages = [ "cmd/server" ];

@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mkcal";
-  version = "0.7.30";
+  version = "0.7.31";

  src = fetchFromGitHub {
    owner = "sailfishos";
    repo = "mkcal";
    tag = finalAttrs.version;
-    hash = "sha256-Sr4THufulhpTOXvMEUG1BA41Lcky34AGALxJojR7sac=";
+    hash = "sha256-/txm7JBI3SvrhRN42Y+2XShoIv1AnKB0lbcfyri5aEE=";
  };

  outputs = [
@@ -0,0 +1,97 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  writeScript,
+
+  # nativeBuildInputs
+  cmake,
+  xxd,
+
+  # buildInputs
+  nlohmann_json,
+  nlohmann_json_schema_validator,
+  gtest,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mnxdom";
+  version = "3.0";
+
+  src = fetchFromGitHub {
+    owner = "rpatters1";
+    repo = "mnxdom";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zM8NRdVKY4RI9fNrVU/BpWOkhmmT9HLrOi21YKPGd0k=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    xxd
+  ];
+
+  propagatedBuildInputs = [
+    # nlohmann_json is a header only library, and we propagate it because it is
+    # being `#include`d in `${placeholder "dev"}/include`.
+    nlohmann_json
+  ];
+  buildInputs = [
+    nlohmann_json_schema_validator
+  ];
+
+  checkInputs = [
+    gtest
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "USE_SYSTEM_NLOHMANN_JSON" true)
+    (lib.cmakeBool "USE_SYSTEM_JSON_SCHEMA_VALIDATOR" true)
+    (lib.cmakeBool "USE_SYSTEM_GOOGLETEST" true)
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeFeature "MNX_W3C_SOURCE" (toString (finalAttrs.finalPackage.mnx_w3c)))
+  ];
+  doCheck = true;
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  passthru = {
+    # It is not a real package that needs building - it is just a bunch of
+    # files. It is comfortable though to have a pname & version for it, to be
+    # able to update it with automatic nix-update or alike. The meta.license is
+    # also slightly interesting.
+    mnx_w3c = stdenv.mkDerivation {
+      pname = "mnx";
+      version = "0-unstable-2026-02-17";
+
+      src = fetchFromGitHub {
+        owner = "w3c";
+        repo = "mnx";
+        rev = "d513cf7a28a84c803ed36e448b416cb49c3a22f9";
+        hash = "sha256-YFiy+2kV/he770BolhDllKW2a6izc+Zu1PdiZKW9mlY=";
+      };
+
+      builder = writeScript "builder.sh" ''
+        cp -r $src $out
+      '';
+
+      meta = {
+        description = "Music Notation CG next-generation music markup proposal";
+        homepage = "https://github.com/w3c/mnx";
+        license = lib.licenses.w3c;
+        platforms = lib.platforms.all;
+      };
+    };
+  };
+
+  meta = {
+    description = "MNX Document Object Model for C++17";
+    homepage = "https://github.com/rpatters1/mnxdom";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ doronbehar ];
+    mainProgram = "mnxdom";
+    platforms = lib.platforms.all;
+  };
+})
@@ -24,6 +24,10 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [ nlohmann_json ];
  nativeBuildInputs = [ cmake ];

+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+  ];
+
  meta = {
    description = "JSON schema validator for JSON for Modern C++";
    homepage = "https://github.com/pboettch/json-schema-validator";
@@ -23,13 +23,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "noto-fonts${suffix}";
-  version = "2026.02.01";
+  version = "2026.03.01";

  src = fetchFromGitHub {
    owner = "notofonts";
    repo = "notofonts.github.io";
    tag = "noto-monthly-release-${finalAttrs.version}";
-    hash = "sha256-vhu3jojG6QlgY5gP4bCbpJznsQ1gExAfcRT42FcZUp4=";
+    hash = "sha256-WWLNBT+Su8cKxmkJIUBZykhFQIAyhG3DV2r8ksqikL0=";
  };

  nativeBuildInputs = [
@@ -66,7 +66,6 @@ stdenv.mkDerivation rec {
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [
      raskin
-      averelld
    ];
    platforms = lib.platforms.unix;
    mainProgram = "pdftk";
@@ -13,18 +13,18 @@
 }:
 buildGo126Module (finalAttrs: {
  pname = "pocket-id";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "pocket-id";
    repo = "pocket-id";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2EK6+QMy2DSZRAHaKcUAfINUlHlRYjEoCtofUxq0w9c=";
+    hash = "sha256-lH8OYBJn1tsHs2wZCbqMqevjqK+tgAqG+Z+fsWP/fV4=";
  };

  sourceRoot = "${finalAttrs.src.name}/backend";

-  vendorHash = "sha256-E/LiovOJ+tKQOeX+rH1TfVFa803zmq3D895uzXUI4oI=";
+  vendorHash = "sha256-a/h8Ptvs4UTgfX9jweo1IyDbwTFafgYrzUSE5pRUjRI=";

  env.CGO_ENABLED = 0;
  ldflags = [
@@ -65,7 +65,7 @@ buildGo126Module (finalAttrs: {
      inherit (finalAttrs) pname version src;
      pnpm = pnpm_10;
      fetcherVersion = 3;
-      hash = "sha256-jaluy/rzArCZ8iI2G0jPHraBIqG/6GsPVFv44lAdXoI=";
+      hash = "sha256-vVCRfQWck9SR1hkJhUnoZ+0QDT8XmOiWeontgzv1e0s=";
    };

    env.BUILD_OUTPUT_PATH = "dist";
@@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "prek";
-  version = "0.3.0";
+  version = "0.3.4";

  src = fetchFromGitHub {
    owner = "j178";
    repo = "prek";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-J4onCCHZ6DT2CtZ8q0nrdOI74UGDJhVFG2nWj+p7moE=";
+    hash = "sha256-BwoeeWb+g4w29V85MqhoPT9B16zJtrsgzxMwjUa4zLI=";
  };

-  cargoHash = "sha256-pR5NibzX5m8DcMxer0W1wowTJCesYaF852wpGiVboVg=";
+  cargoHash = "sha256-7XbqXUvTyIKVE94vE/uRPYdtv8Ol05quPXVWlnCpeZg=";

  nativeBuildInputs = [
    installShellFiles
@@ -31,7 +31,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    Description: Simple and easy-to-use immediate-mode gui library
    URL: https://github.com/raysan5/raygui
    Version: ${finalAttrs.version}
-    Cflags: -I"{includedir}"
+    Cflags: -I$out/include
    EOF

    runHook postInstall
@@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "source-meta-json-schema";
-  version = "14.7.1";
+  version = "14.13.4";

  src = fetchFromGitHub {
    owner = "sourcemeta";
    repo = "jsonschema";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-zQ9GyJBaSzDL7i/PurOW4yJR59pX/0CLZ2DgDJmA6+s=";
+    hash = "sha256-APrlrYG6QTJqrI6+TBUd34x6Di1fCm15FqDGWrukhkQ=";
  };

  nativeBuildInputs = [
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "spicetify-cli";
-  version = "2.42.11";
+  version = "2.42.14";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-b8mk6yRM958NPU888aryAgoghEHtiVcHFNCp4J0F+qg=";
+    hash = "sha256-0ACf7GAWLquAkGrvsRaE+0YvmJqHZe+2pjHvf5eNtqI=";
  };

  vendorHash = "sha256-uuvlu5yocqnDh6OO5a4Ngp5SahqURc/14fcg1Kr9sec=";
@@ -0,0 +1,22 @@
+diff --git a/frontend/src-tauri/stirling-pdf.desktop b/frontend/src-tauri/stirling-pdf.desktop
+index 45db59c..8068696 100644
+--- a/frontend/src-tauri/stirling-pdf.desktop
+++ b/frontend/src-tauri/stirling-pdf.desktop
+@@ -3,13 +3,13 @@ Version=1.0
+ Type=Application
+ Name=Stirling-PDF
+ Comment=Locally hosted web application that allows you to perform various operations on PDF files
+-Exec=/usr/bin/stirling-pdf
+Exec=stirling-pdf
+ Icon={{icon}}
+ Terminal=false
+-MimeType=application/pdf;
+MimeType=application/pdf;x-scheme-handler/stirlingpdf;
+ Categories=Office;Graphics;Utility;
+ Actions=open-file;
+ 
+ [Desktop Action open-file]
+ Name=Open PDF File
+-Exec=/usr/bin/stirling-pdf %F
+\ No newline at end of file
+Exec=stirling-pdf %F
@@ -15,7 +15,7 @@
  wrapGAppsHook3,

  glib-networking,
-  jre,
+  jdk25,
  libsoup_3,
  openssl,
  webkitgtk_4_1,
@@ -31,21 +31,27 @@ assert isDesktopVariant -> !buildWithFrontend;

 let
  gradle = gradle_8;
+  jre = jdk25;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "stirling-pdf" + lib.optionalString isDesktopVariant "-desktop";
-  version = "2.4.5";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "Stirling-Tools";
    repo = "Stirling-PDF";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Fk6tuuoTI5ziZ6GjbrRdlvNdToEPb3f155T1OL47XQs=";
+    hash = "sha256-nsC/U+9kJo0i5Sh2u+OrjzDO6YREKjVAe+1KBKgtybY=";
  };

  patches = [
    # remove timestamp from the header of a generated .properties file
    ./remove-props-file-timestamp.patch
+
+    # Note: only affects the desktop variant
+    # fix path to the stirling-pdf binary
+    # and add support for the stirlingpdf:// protocol
+    ./fix-desktop-file.patch
  ];

  npmRoot = "frontend";
@@ -54,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
    inherit (finalAttrs) src patches;
    postPatch = "cd ${finalAttrs.npmRoot}";
-    hash = "sha256-cVVxbkXD5sz6YmHOwbXj1GYRa2s9PmRFtuNsz2tLRhI=";
+    hash = "sha256-uMWc/yoOWFtP2JTMr69V/nRPu9YfrGxqvBnOw2DZkQQ=";
  };

  cargoRoot = "frontend/src-tauri";
@@ -68,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
      patches
      cargoRoot
      ;
-    hash = "sha256-lO2IdJUAnhpSnF4vTEn4EdnyrxIXyEUvpNl0VWd2fFs=";
+    hash = "sha256-JvrZKgTmPGP6m95GBr/UJo1FLaR86KSmJ9LzLlzQhfE=";
  };

  mitmCache = gradle.fetchDeps {
@@ -81,7 +87,13 @@ stdenv.mkDerivation (finalAttrs: {
  # we'll trigger it manually in postBuild
  dontTauriBuild = true;

-  env.PUPPETEER_SKIP_DOWNLOAD = "1";
+  env = {
+    PUPPETEER_SKIP_DOWNLOAD = "1";
+    # taken from here https://github.com/Stirling-Tools/Stirling-PDF/blob/main/.github/workflows/tauri-build.yml#L346-L348
+    VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY = "sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb";
+    VITE_SAAS_SERVER_URL = "https://app.stirlingpdf.com";
+    VITE_SAAS_BACKEND_API_URL = "https://api.stirlingpdf.com";
+  };

  # disable spotless because it tries to fetch files not in deps.json
  # and also because it slows down the build process
@@ -96,7 +108,7 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    gradle
-    gradle.jdk # one of the tests also require that the `java` command is available on the command line
+    jre # one of the tests also require that the `java` command is available on the command line
    makeBinaryWrapper
  ]
  ++ lib.optionals (buildWithFrontend || isDesktopVariant) [
@@ -11,14 +11,14 @@

 buildGoModule (finalAttrs: {
  pname = "tinyauth";
-  version = "5.0.1";
+  version = "5.0.2";

  src = fetchFromGitHub {
    owner = "steveiliop56";
    repo = "tinyauth";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-ypM56yrUWF1OzCj5RBGyEhZzjyDcko7SPQ+eVhHEzmA=";
+    hash = "sha256-i074facoWTg7+c9OdGhcOEknP/GZ6st0IIdwwvHC7IQ=";
  };

  vendorHash = "sha256-qELLarAR78WkDoJKtqaqzIZaTBCuHP41JCyjLZ4aMtM=";
@@ -6,9 +6,9 @@
  twemoji-color-font,
  imagemagick,
  inkscape,
-  nodePackages,
  potrace,
  scfbuild,
+  svgo,
  which,
 }:

@@ -26,9 +26,9 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    imagemagick
    inkscape
-    nodePackages.svgo
    potrace
    scfbuild
+    svgo
    which
  ];

@@ -21,13 +21,13 @@ assert selinuxSupport -> lib.meta.availableOn stdenv.hostPlatform libselinux;

 stdenv.mkDerivation (finalAttrs: {
  pname = "uutils-coreutils";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "uutils";
    repo = "coreutils";
    tag = finalAttrs.version;
-    hash = "sha256-/GLDcqbNRO2NV+tW5yRZ0BdGJ+R3S3CPBPuBXpCIWuU=";
+    hash = "sha256-mS1KjnMUQzRqsmy1GCLDlDh2kOSfPhc59RnR9abqtu4=";
  };

  # error: linker `aarch64-linux-gnu-gcc` not found
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname src version;
-    hash = "sha256-DrDfbf7UMEeNRvCHsu1Kbr+4PWkckmMvy8sEpjEgJfg=";
+    hash = "sha256-jNFZEafyW0DGpG0tPiI3lzANBiAXYxoOnTsKoGjeOK0=";
  };

  buildInputs =
@@ -113,6 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/uutils/coreutils";
    changelog = "https://github.com/uutils/coreutils/releases/tag/${finalAttrs.version}";
    maintainers = with lib.maintainers; [
+      GaetanLepage
      siraben
      matthiasbeyer
    ];
@@ -12,16 +12,16 @@

 buildGoModule rec {
  pname = "vault";
-  version = "1.21.2";
+  version = "1.21.4";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "vault";
    rev = "v${version}";
-    hash = "sha256-G/6GroX9lBaUxB5mkd+hz53nNX/eF5DAtHryin3hzgU=";
+    hash = "sha256-1yBvcGKzLZYFWlZJL1iJgDFkiT4g2f84iZCjWi2CwDg=";
  };

-  vendorHash = "sha256-bJdEQkJnUiPI6MSVAsLCqDSsM4zuT5ORJ93jVC+EEAs=";
+  vendorHash = "sha256-LxWqJroDfGqqCrTej+jkpxEO/+ipXuqSPB2R3bg2v10=";

  proxyVendor = true;

@@ -9,13 +9,13 @@

 stdenv.mkDerivation {
  pname = "vgmtools";
-  version = "0.1-unstable-2026-02-23";
+  version = "0.1-unstable-2026-02-26";

  src = fetchFromGitHub {
    owner = "vgmrips";
    repo = "vgmtools";
-    rev = "728c8c75d770632244ac387307286344c2144cd3";
-    hash = "sha256-HIMOj9eWElHe/AozrM8prGNShV3gJEb8Zhd0irzELew=";
+    rev = "9962da3be999da57e0ea09e0deb1a479524e499f";
+    hash = "sha256-6P7i/BT+v26SvJtj/FH70XKwuTfp8PtSAChvHFY6aLw=";
  };

  nativeBuildInputs = [
@@ -1,6 +1,6 @@
 {
  lib,
-  buildGoModule,
+  buildGo126Module,
  fetchFromGitHub,
  nix-update-script,
  nixosTests,
@@ -8,15 +8,15 @@
  withVlAgent ? false,
 }:

-buildGoModule (finalAttrs: {
+buildGo126Module (finalAttrs: {
  pname = "VictoriaLogs";
-  version = "1.45.0";
+  version = "1.47.0";

  src = fetchFromGitHub {
    owner = "VictoriaMetrics";
    repo = "VictoriaLogs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pfNG9BuKqfoQGJTN8sVEB2UpUh38jot0kBJ8KnxHHMs=";
+    hash = "sha256-SrM6lDhbsGOJohmAFIALyzSAh/9C3A8/EQ2pFDlOEAw=";
  };

  vendorHash = null;
@@ -35,6 +35,7 @@ let
      django = prev.django_5;
    };
  };
+  python3Packages = python3.pkgs;

  GI_TYPELIB_PATH = lib.makeSearchPathOutput "out" "lib/girepository-1.0" [
    pango
@@ -45,10 +46,9 @@ let
    gobject-introspection
  ];
 in
-python.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "weblate";
-  version = "5.15.2";
-
+  version = "5.16.2";
  pyproject = true;

  outputs = [
@@ -59,15 +59,15 @@ python.pkgs.buildPythonApplication rec {
  src = fetchFromGitHub {
    owner = "WeblateOrg";
    repo = "weblate";
-    tag = "weblate-${version}";
-    hash = "sha256-qNv3aaPyQ/bOrPbK7u9vtq8R1MFqXLJzvLUZfVgjMK0=";
+    tag = "weblate-${finalAttrs.version}";
+    hash = "sha256-er3KtCAFtHh3UtM58Kni/PTBfXpWW/GOarRGJeAanL8=";
  };

  postPatch = ''
    sed -i 's|/bin/true|true|g' weblate/addons/example_pre.py
  '';

-  build-system = with python.pkgs; [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];

  nativeBuildInputs = [ gettext ];

@@ -93,11 +93,12 @@ python.pkgs.buildPythonApplication rec {

  pythonRelaxDeps = [
    "certifi"
+    "crispy-bootstrap5"
    "urllib3"
  ];

  dependencies =
-    with python.pkgs;
+    with python3Packages;
    [
      aeidon
      ahocorasick-rs
@@ -168,6 +169,7 @@ python.pkgs.buildPythonApplication rec {
      unidecode
      urllib3
      user-agents
+      weblate-fonts
      weblate-language-data
      weblate-schemas
    ]
@@ -180,7 +182,7 @@ python.pkgs.buildPythonApplication rec {
    ++ urllib3.optional-dependencies.zstd;

  # Commented entries are not packaged yet
-  optional-dependencies = with python.pkgs; {
+  optional-dependencies = with python3Packages; {
    alibaba = [
      aliyun-python-sdk-alimt
      aliyun-python-sdk-core
@@ -213,7 +215,7 @@ python.pkgs.buildPythonApplication rec {
  makeWrapperArgs = [ "--set GI_TYPELIB_PATH \"$GI_TYPELIB_PATH\"" ];

  nativeCheckInputs =
-    with python.pkgs;
+    with python3Packages;
    [
      pytestCheckHook
      postgresqlTestHook
@@ -241,7 +243,7 @@ python.pkgs.buildPythonApplication rec {
      openssh
    ]
    ++ social-auth-core.optional-dependencies.saml
-    ++ (lib.concatLists (builtins.attrValues optional-dependencies));
+    ++ (lib.concatLists (builtins.attrValues finalAttrs.passthru.optional-dependencies));

  env = {
    CI_DATABASE = "postgresql";
@@ -287,7 +289,7 @@ python.pkgs.buildPythonApplication rec {
  meta = {
    description = "Web based translation tool with tight version control integration";
    homepage = "https://weblate.org/";
-    changelog = "https://github.com/WeblateOrg/weblate/releases/tag/${src.tag}";
+    changelog = "https://github.com/WeblateOrg/weblate/releases/tag/${finalAttrs.src.tag}";
    license = with lib.licenses; [
      gpl3Plus
      mit
@@ -296,4 +298,4 @@ python.pkgs.buildPythonApplication rec {
    maintainers = with lib.maintainers; [ erictapen ];
    mainProgram = "weblate";
  };
-}
+})
@@ -172,6 +172,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "http://x2go.org/";
    platforms = lib.platforms.linux;
    license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ averelld ];
+    maintainers = [ ];
  };
 })
@@ -25,13 +25,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "biometryd";
-  version = "0.3.3";
+  version = "0.4.0";

  src = fetchFromGitLab {
    owner = "ubports";
    repo = "development/core/biometryd";
    rev = finalAttrs.version;
-    hash = "sha256-MIyWGd4No4Qj8oEH1FQYCE4rQhyetwiAf1y6em4zk2A=";
+    hash = "sha256-3igUyiTI47I0lf5byypmHLigyopgEQQUYURiCb6HFeg=";
  };

  outputs = [
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail 'pkg_get_variable(SYSTEMD_SYSTEM_UNIT_DIR systemd systemdsystemunitdir)' 'pkg_get_variable(SYSTEMD_SYSTEM_UNIT_DIR systemd systemdsystemunitdir DEFINE_VARIABLES prefix=''${CMAKE_INSTALL_PREFIX})'

    substituteInPlace src/biometry/qml/Biometryd/CMakeLists.txt \
-      --replace-fail "\''${CMAKE_INSTALL_FULL_LIBDIR}/qt5/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
+      --replace-fail "\''${CMAKE_INSTALL_FULL_LIBDIR}/qt\''${QT_VERSION_MAJOR}/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"

    # For our automatic pkg-config output patcher to work, prefix must be used here
    substituteInPlace data/biometryd.pc.in \
@@ -96,8 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
  dontWrapQtApps = true;

  cmakeFlags = [
-    # maybe-uninitialized warnings
-    (lib.cmakeBool "ENABLE_WERROR" false)
+    (lib.cmakeBool "ENABLE_QT6" (lib.strings.versionAtLeast qtbase.version "6"))
+    (lib.cmakeBool "ENABLE_WERROR" true)
    (lib.cmakeBool "WITH_HYBRIS" false)
  ];

@@ -7,6 +7,7 @@
  alsa-lib,
  rtmidi,
  pkg-config,
+  autoreconfHook,
 }:

 buildOctavePackage rec {
@@ -22,6 +23,7 @@ buildOctavePackage rec {

  nativeBuildInputs = [
    pkg-config
+    autoreconfHook
  ];

  propagatedBuildInputs = [
@@ -30,6 +32,21 @@ buildOctavePackage rec {
    rtmidi
  ];

+  # autoreconfHook provides an autoreconfPhase that is run as a
+  # preconfigurePhase, which means it runs AFTER the source is un-tarred, and
+  # before buildOctavePackage's buildPhase re-tars it up into a format for later
+  # consumption by Octave's "pkg build" command.
+  preAutoreconf = ''
+    pushd src
+    # Upstream's bootstrap script uses wget to fetch config.guess & config.sub
+    # and has them committed to the repository. We must remove them so autoreconf
+    # actually fires for our environment.
+    rm config.*
+  '';
+  postAutoreconf = ''
+    popd
+  '';
+
  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=release-(.*)" ]; };

  meta = {
@@ -38,6 +55,5 @@ buildOctavePackage rec {
    maintainers = with lib.maintainers; [ KarlJoad ];
    description = "Audio and MIDI Toolbox for GNU Octave";
    platforms = lib.platforms.linux; # Because of run-time dependency on jack2 and alsa-lib
-    broken = true;
  };
 }
@@ -3,6 +3,7 @@
  lib,
  fetchFromGitHub,
  nix-update-script,
+  autoreconfHook,
 }:

 buildOctavePackage rec {
@@ -16,6 +17,25 @@ buildOctavePackage rec {
    sha256 = "sha256-hr94VALlAEwpqNU7imEN63M0BdPFSu5IznhWOn/mNiQ=";
  };

+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  # autoreconfHook provides an autoreconfPhase that is run as a
+  # preconfigurePhase, which means it runs AFTER the source is un-tarred, and
+  # before buildOctavePackage's buildPhase re-tars it up into a format for later
+  # consumption by Octave's "pkg build" command.
+  preAutoreconf = ''
+    pushd src
+    # Upstream's bootstrap script uses wget to fetch config.guess & config.sub
+    # and has them committed to the repository. We must remove them so autoreconf
+    # actually fires for our environment.
+    rm config.*
+  '';
+  postAutoreconf = ''
+    popd
+  '';
+
  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=release-(.*)" ]; };

  meta = {
@@ -23,6 +43,6 @@ buildOctavePackage rec {
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ KarlJoad ];
    description = "Provides COM interface and additional functionality on Windows";
-    broken = true;
+    platforms = lib.platforms.windows;
  };
 }
@@ -30,9 +30,9 @@
  extraPackages ? _: [ ],
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "ansible-core";
-  version = "2.20.0";
+  version = "2.20.3";
  pyproject = true;

  disabled = pythonOlder "3.12";
@@ -40,8 +40,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "ansible";
    repo = "ansible";
-    tag = "v${version}";
-    hash = "sha256-4kTBzDHDfdHR/W4edxrGtWhg6TRLMtdEgUZYcn8cFQg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WLfLbQYYJOdMHApNnFZYiET4es3z2SeeLP0jbrFqxrU=";
  };

  # ansible_connection is already wrapped, so don't pass it through
@@ -102,7 +102,7 @@ buildPythonPackage rec {
  doCheck = false;

  meta = {
-    changelog = "https://github.com/ansible/ansible/blob/v${version}/changelogs/CHANGELOG-v${lib.versions.majorMinor version}.rst";
+    changelog = "https://github.com/ansible/ansible/blob/v${finalAttrs.version}/changelogs/CHANGELOG-v${lib.versions.majorMinor finalAttrs.version}.rst";
    description = "Radically simple IT automation";
    homepage = "https://www.ansible.com";
    license = lib.licenses.gpl3Plus;
@@ -111,4 +111,4 @@ buildPythonPackage rec {
      robsliwi
    ];
  };
-}
+})
@@ -10,19 +10,19 @@
  pandas,
 }:
 let
-  version = "0.5.1";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "kylebarron";
    repo = "arro3";
    tag = "py-v${version}";
-    hash = "sha256-RTr+mf5slfxxvXp9cwPuy08AZUswPtIIRz+vngdg/k0=";
+    hash = "sha256-Zlc+M+h8pgYLLhEGgv2W6YfahYtdm9Q8ezVK+Kwd2lw=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit version src;
    pname = "arro3-vendor";
-    hash = "sha256-YQA8Z86Ul8yAHncMgYrGmNe10KSpubHjaokCjaqTAxo=";
+    hash = "sha256-f36qIkQIu6Jl2hb3HJaMpnLbWVaR3z4WrQ1aLZr4VvQ=";
  };

  commonMeta = {
@@ -40,7 +40,7 @@ let
      pythonImportsCheck,
      dependencies ? [ ],
    }:
-    buildPythonPackage rec {
+    buildPythonPackage {
      inherit
        pname
        version
@@ -28,17 +28,17 @@
  scipy,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "correctionlib";
-  version = "2.7.0";
+  version = "2.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cms-nanoAOD";
    repo = "correctionlib";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-aLTeyDOo80p8xzl/IPnpT3BOjS2qOYn/Z7pidcLoEY8=";
+    hash = "sha256-zIKxMulID6JomaSDuI57cHA7xAZIfGBOOYCKS7Xrkaw=";
  };

  postPatch = ''
@@ -81,8 +81,8 @@ buildPythonPackage rec {
    description = "Provides a well-structured JSON data format for a wide variety of ad-hoc correction factors encountered in a typical HEP analysis";
    mainProgram = "correction";
    homepage = "https://cms-nanoaod.github.io/correctionlib/";
-    changelog = "https://github.com/cms-nanoAOD/correctionlib/releases/tag/v${version}";
+    changelog = "https://github.com/cms-nanoAOD/correctionlib/releases/tag/${finalAttrs.src.tag}";
    license = with lib.licenses; [ bsd3 ];
    maintainers = with lib.maintainers; [ veprbl ];
  };
-}
+})
@@ -26,14 +26,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "dask-awkward";
-  version = "2026.2.0";
+  version = "2026.2.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "dask-contrib";
    repo = "dask-awkward";
    tag = finalAttrs.version;
-    hash = "sha256-iAecPdLbg1UhHn5rZEMYbeQGSpxYWkEFjq/mxzazG3E=";
+    hash = "sha256-ICgJTV7DdESWD3QjxYw8pE20SeOmG5fU5b37Yojyylk=";
  };

  build-system = [
@@ -70,7 +70,11 @@ buildPythonPackage rec {
    torch
  ];

-  disabledTests = [ "test_experimentstarter" ];
+  disabledTests = [
+    "test_experimentstarter"
+    # https://github.com/ChrisReinke/exputils/issues/4
+    "test_different_datatypes"
+  ];

  pythonImportsCheck = [ "exputils" ];

@@ -25,6 +25,6 @@ buildPythonPackage rec {
    description = "Turn Python scripts into handouts with Markdown and figures";
    homepage = "https://github.com/danijar/handout";
    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ averelld ];
+    maintainers = [ ];
  };
 }
@@ -15,6 +15,7 @@
  dataclasses-json,
  numpy,
  pandas,
+  pycryptodome,
  pytest-asyncio,
  pytest-mock,
  pytestCheckHook,
@@ -24,19 +25,19 @@
  gitUpdater,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "langgraph-checkpoint";
-  version = "4.0.0";
+  version = "4.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langgraph";
-    tag = "checkpoint==${version}";
-    hash = "sha256-IE9Y+kFkDN49SuwvTNwa2kK+Hig18sJPZmZCqHUP3DM=";
+    tag = "checkpoint==${finalAttrs.version}";
+    hash = "sha256-NJSmpVshj/x6ws+jFYXGarNKNztbk5OIIMA1neFOyIY=";
  };

-  sourceRoot = "${src.name}/libs/checkpoint";
+  sourceRoot = "${finalAttrs.src.name}/libs/checkpoint";

  build-system = [ hatchling ];

@@ -53,6 +54,7 @@ buildPythonPackage rec {
    dataclasses-json
    numpy
    pandas
+    pycryptodome
    pytest-asyncio
    pytest-mock
    pytestCheckHook
@@ -68,7 +70,7 @@ buildPythonPackage rec {
  };

  meta = {
-    changelog = "https://github.com/langchain-ai/langgraph/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langgraph/releases/tag/${finalAttrs.src.tag}";
    description = "Library with base interfaces for LangGraph checkpoint savers";
    homepage = "https://github.com/langchain-ai/langgraph/tree/main/libs/checkpoint";
    license = lib.licenses.mit;
@@ -76,4 +78,4 @@ buildPythonPackage rec {
      sarahec
    ];
  };
-}
+})
@@ -22,19 +22,19 @@
  gitUpdater,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "langgraph-cli";
-  version = "0.4.11";
+  version = "0.4.14";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langgraph";
-    tag = "cli==${version}";
-    hash = "sha256-sr3AtcrG9V0c5UBdSXyaX3bCxzrSONpY28L5jlomZuM=";
+    tag = "cli==${finalAttrs.version}";
+    hash = "sha256-DtIIGNcpgcYMvvihH9GwgCn2PRWq+LEcHVtitA71T04=";
  };

-  sourceRoot = "${src.name}/libs/cli";
+  sourceRoot = "${finalAttrs.src.name}/libs/cli";

  build-system = [ hatchling ];

@@ -56,7 +56,7 @@ buildPythonPackage rec {
    pytestCheckHook
    docker-compose
  ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;

  enabledTestPaths = [ "tests/unit_tests" ];

@@ -91,9 +91,9 @@ buildPythonPackage rec {
  meta = {
    description = "Official CLI for LangGraph API";
    homepage = "https://github.com/langchain-ai/langgraph/tree/main/libs/cli";
-    changelog = "https://github.com/langchain-ai/langgraph/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langgraph/releases/tag/${finalAttrs.src.tag}";
    mainProgram = "langgraph";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ sarahec ];
  };
-}
+})
@@ -29,19 +29,19 @@
 }:
 # langgraph-prebuilt isn't meant to be a standalone package but is bundled into langgraph at build time.
 # It exists so the langgraph team can iterate on it without having to rebuild langgraph.
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "langgraph-prebuilt";
-  version = "1.0.7";
+  version = "1.0.8";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langgraph";
-    tag = "prebuilt==${version}";
-    hash = "sha256-gwug+eVzFa0mL+dvASHQ/cLq4/nIzl6CvigPIep7v1E=";
+    tag = "prebuilt==${finalAttrs.version}";
+    hash = "sha256-Gsh2bCcity0zf9A+FENxwktK5j3WhQOG/jZmhJ18KVE=";
  };

-  sourceRoot = "${src.name}/libs/prebuilt";
+  sourceRoot = "${finalAttrs.src.name}/libs/prebuilt";

  build-system = [ hatchling ];

@@ -72,7 +72,7 @@ buildPythonPackage rec {
  ];

  preCheck = ''
-    export PYTHONPATH=${src}/libs/langgraph:$PYTHONPATH
+    export PYTHONPATH=${finalAttrs.src}/libs/langgraph:$PYTHONPATH
  '';

  pytestFlags = [
@@ -100,8 +100,8 @@ buildPythonPackage rec {
  meta = {
    description = "Prebuilt agents add-on for Langgraph. Should always be bundled with langgraph";
    homepage = "https://github.com/langchain-ai/langgraph/tree/main/libs/prebuilt";
-    changelog = "https://github.com/langchain-ai/langgraph/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langgraph/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ sarahec ];
  };
-}
+})
@@ -4,6 +4,7 @@
  fetchPypi,
  hatchling,
  blockbuster,
+  croniter,
  langgraph,
  langgraph-checkpoint,
  sse-starlette,
@@ -13,20 +14,21 @@

 buildPythonPackage (finalAttrs: {
  pname = "langgraph-runtime-inmem";
-  version = "0.23.2";
+  version = "0.26.0";
  pyproject = true;

  # Not available in any repository
  src = fetchPypi {
    pname = "langgraph_runtime_inmem";
    inherit (finalAttrs) version;
-    hash = "sha256-HrmkC6llvww1FBSbQRpo4KfWdU16XxcSY2tmRsUg/Ns=";
+    hash = "sha256-ucWH0TOTIKKlSlcKIa7K9Z7rxL4HzvHYpbA18/LGHWo=";
  };

  build-system = [ hatchling ];

  dependencies = [
    blockbuster
+    croniter
    langgraph
    langgraph-checkpoint
    sse-starlette
@@ -16,19 +16,19 @@
  gitUpdater,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "langgraph-sdk";
-  version = "0.3.6";
+  version = "0.3.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langgraph";
-    tag = "sdk==${version}";
-    hash = "sha256-8Cnftu0uFzyBa3IBN9ktUoXZ1FRaDVaCuFxjVnqfDNU=";
+    tag = "sdk==${finalAttrs.version}";
+    hash = "sha256-E/GM0p9x2/hNfL2u4TsG9UxnnMX42f5PjeIo9KfRY0k=";
  };

-  sourceRoot = "${src.name}/libs/sdk-py";
+  sourceRoot = "${finalAttrs.src.name}/libs/sdk-py";

  build-system = [ hatchling ];

@@ -54,8 +54,8 @@ buildPythonPackage rec {
  meta = {
    description = "SDK for interacting with the LangGraph Cloud REST API";
    homepage = "https://github.com/langchain-ai/langgraph/tree/main/libs/sdk-py";
-    changelog = "https://github.com/langchain-ai/langgraph/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langgraph/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ sarahec ];
  };
-}
+})
@@ -25,6 +25,7 @@
  langgraph-checkpoint-sqlite,
  langsmith,
  psycopg,
+  pycryptodome,
  pytest-asyncio,
  pytest-mock,
  pytest-repeat,
@@ -38,16 +39,16 @@
  # passthru
  nix-update-script,
 }:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "langgraph";
-  version = "1.0.8";
+  version = "1.0.10";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langgraph";
-    tag = version;
-    hash = "sha256-VuvO2s6ttS3ZBs0Zz5CHOOkUSdJkfY3AnhIoCgnQOhs=";
+    tag = finalAttrs.version;
+    hash = "sha256-NJSmpVshj/x6ws+jFYXGarNKNztbk5OIIMA1neFOyIY=";
  };

  postgresqlTestSetupPost = ''
@@ -57,7 +58,7 @@ buildPythonPackage rec {
      --replace-fail "DEFAULT_POSTGRES_URI = \"postgres://postgres:postgres@localhost:5442/\"" "DEFAULT_POSTGRES_URI = \"postgres:///$PGDATABASE\""
  '';

-  sourceRoot = "${src.name}/libs/langgraph";
+  sourceRoot = "${finalAttrs.src.name}/libs/langgraph";

  build-system = [ hatchling ];

@@ -95,6 +96,7 @@ buildPythonPackage rec {
    langsmith
    psycopg
    psycopg.pool
+    pycryptodome
    pydantic
    pytest-asyncio
    pytest-mock
@@ -121,6 +123,7 @@ buildPythonPackage rec {
    "test_no_modifier"
    "test_pending_writes_resume"
    "test_remove_message_via_state_update"
+    "test_interrupt_functional_pydantic"
  ];

  disabledTestPaths = [
@@ -130,6 +133,8 @@ buildPythonPackage rec {
    "tests/test_large_cases_async.py"
    "tests/test_pregel.py"
    "tests/test_pregel_async.py"
+    "tests/test_subgraph_persistence.py"
+    "tests/test_subgraph_persistence_async.py"
  ];

  # Since `langgraph` is the only unprefixed package, we have to use an explicit match
@@ -147,8 +152,8 @@ buildPythonPackage rec {
  meta = {
    description = "Build resilient language agents as graphs";
    homepage = "https://github.com/langchain-ai/langgraph";
-    changelog = "https://github.com/langchain-ai/langgraph/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langgraph/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ sarahec ];
  };
-}
+})
@@ -32,13 +32,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "llama-stack-client";
-  version = "0.5.1";
+  version = "0.5.2";
  pyproject = true;

  src = fetchPypi {
    pname = "llama_stack_client";
    inherit (finalAttrs) version;
-    hash = "sha256-ITq9iHKwjvY8yYCaqWhi2lWCbE2Tl3QqTU649D9VDJc=";
+    hash = "sha256-F8G7rZD3aZ2k6zyuJW6II8qk0r6UVRKkXIxviauJnyg=";
  };

  postPatch = ''
@@ -10,6 +10,7 @@ toPythonModule (
    {
      nativeBuildInputs ? [ ],
      configureFlags ? [ ],
+      env ? { },
      ...
    }:
    {
@@ -28,12 +29,14 @@ toPythonModule (
        "--disable-man-pages"
      ];

-      # Nix treats nativeBuildInputs specially for cross-compilation, but in this
-      # case, cross-compilation is accounted for explicitly. Using the variables
-      # ensures that the platform setup isn't messed with further. It also allows
-      # regular Python to be added in the future if it is ever needed.
-      PYTHON = "${python.pythonOnBuildForHost}/bin/python";
-      PYTHON_CONFIG = "${python.pythonOnBuildForHost}/bin/python-config";
+      env = env // {
+        # Nix treats nativeBuildInputs specially for cross-compilation, but in this
+        # case, cross-compilation is accounted for explicitly. Using the variables
+        # ensures that the platform setup isn't messed with further. It also allows
+        # regular Python to be added in the future if it is ever needed.
+        PYTHON = "${python.pythonOnBuildForHost}/bin/python";
+        PYTHON_CONFIG = "${python.pythonOnBuildForHost}/bin/python-config";
+      };
    }
  )
 )
@@ -24,14 +24,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "mlx-lm";
-  version = "0.30.7";
+  version = "0.31.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ml-explore";
    repo = "mlx-lm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Jc+JyReOH8Wja8sh9BvOO6X090xutKrVSbv+lEODPls=";
+    hash = "sha256-1YZt2HtHyhP4h3WOcSytbN0sN2x58OYAmQtoxisNt1o=";
  };

  build-system = [
@@ -16,14 +16,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "moyopy";
-  version = "0.7.7";
+  version = "0.7.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "spglib";
    repo = "moyo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+esZ6LiPJG1Oof+6e3i6wZCLEYPdKfTbgXXucJW01sc=";
+    hash = "sha256-XPXLBEGDGX8MTaM91K0Y7Zjyafq6zscSVELRk3HWIYM=";
  };

  sourceRoot = "${finalAttrs.src.name}/moyopy";
@@ -46,7 +46,7 @@ buildPythonPackage (finalAttrs: {
      sourceRoot
      cargoRoot
      ;
-    hash = "sha256-xVSAEEbqZ5Z7CnLECyFw1OMPmjiHtdnzoI65sESd8D8=";
+    hash = "sha256-DB9hyf1z6tEt7ErswfyFtXCrhEG9z8DSlGqvRRho0xo=";
  };

  build-system = [
@@ -10,10 +10,13 @@
  rustc,

  # dependencies
+  arro3-core,
  arviz,
+  obstore,
  pandas,
  pyarrow,
  xarray,
+  zarr,

  # tests
  # bridgestan, (not packaged)
@@ -29,21 +32,21 @@
  writableTmpDirAsHomeHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "nutpie";
-  version = "0.15.2";
+  version = "0.16.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pymc-devs";
    repo = "nutpie";
-    tag = "v${version}";
-    hash = "sha256-9rcQtEdaafMyuNb/ezcqUmrwXbQFa9hdajGAtANdHOw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pZlUS8Rd8uNAau7q3yogtdRUvDkN8MiTWj+3lZolBSY=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-6JWBJYGhSNUL8KYiEE2ZBW9xP4CmkCcwwhsO6aOvZyA=";
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-F9WuFPyJd7IVaboUHnFpf3GiLB5AWap8RBScuqlZB3s=";
  };

  build-system = [
@@ -54,15 +57,14 @@ buildPythonPackage rec {
    rustc
  ];

-  pythonRelaxDeps = [
-    "xarray"
-  ];
-
  dependencies = [
+    arro3-core
    arviz
+    obstore
    pandas
    pyarrow
    xarray
+    zarr
  ];

  pythonImportsCheck = [ "nutpie" ];
@@ -81,10 +83,6 @@ buildPythonPackage rec {
    writableTmpDirAsHomeHook
  ];

-  pytestFlags = [
-    "-v"
-  ];
-
  disabledTests = lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
    # flaky (assert np.float64(0.0017554642626285276) > 0.01)
    "test_normalizing_flow"
@@ -98,8 +96,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python wrapper for nuts-rs";
    homepage = "https://github.com/pymc-devs/nutpie";
-    changelog = "https://github.com/pymc-devs/nutpie/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/pymc-devs/nutpie/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
-}
+})
@@ -0,0 +1,110 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  rustPlatform,
+
+  # tests
+  arro3-core,
+  docker,
+  fsspec,
+  minio,
+  polars,
+  pyarrow,
+  pystac-client,
+  pytest-asyncio,
+  pytest-mypy-plugins,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "obstore";
+  version = "0.9.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "developmentseed";
+    repo = "obstore";
+    tag = "py-v${finalAttrs.version}";
+    hash = "sha256-1zMIcr36VrNX3GT4k7w4sIhAwQSWUuuomf73fnCwueY=";
+  };
+
+  postPatch = ''
+    ln -sf ${./Cargo.lock} Cargo.lock
+  '';
+
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "pyo3-file-0.15.0" = "sha256-8OVShM+jWHOZ/bOXJI2PEDzmOAFY1MBwbkg5ita25cg=";
+    };
+  };
+
+  build-system = [
+    rustPlatform.maturinBuildHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  maturinBuildFlags = [
+    "-m"
+    "obstore/Cargo.toml"
+  ];
+
+  pythonImportsCheck = [ "obstore" ];
+
+  nativeCheckInputs = [
+    arro3-core
+    docker
+    fsspec
+    minio
+    polars
+    pyarrow
+    pystac-client
+    pytest-asyncio
+    pytest-mypy-plugins
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # Requires internet access
+    "tests/auth/test_planetary_computer.py"
+
+    # error: Cannot find implementation or library stub for module named "obspec"
+    "tests/obspec/test-store.yml"
+  ];
+
+  disabledTests = [
+    # docker.errors.DockerException: Error while fetching server API version:
+    # ('Connection aborted.', FileNotFoundError(2, 'No such file or directory'))
+    "test_cat_ranges_error"
+    "test_cat_ranges_one"
+    "test_cat_ranges_two"
+    "test_construct_store_cache_diff_bucket_name"
+    "test_construct_store_cache_same_bucket_name"
+    "test_delete_prefix"
+    "test_fsspec_filesystem_cache"
+    "test_get_async"
+    "test_info"
+    "test_info_async"
+    "test_list"
+    "test_list_async"
+    "test_multi_file_ops"
+    "test_put_files"
+    "test_put_files_async"
+    "test_remote_parquet"
+    "test_split_path"
+
+    # Require internet access
+    # obstore.exceptions.GenericError: Generic S3 error: Error performing list request
+    "test_from_url"
+    "test_pickle"
+  ];
+
+  meta = {
+    description = "Simple, high-throughput Python interface to S3, GCS & Azure Storage, powered by Rust";
+    homepage = "https://github.com/developmentseed/obstore";
+    changelog = "https://github.com/developmentseed/obstore/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
@@ -246,6 +246,8 @@ buildPythonPackage (finalAttrs: {
    "tests/ir/graph_view_test.py"
    "tests/ir/serde_roundtrip_test.py"
    "tests/optimizer/test_models.py"
+    # Wants GPU on ROCm
+    "tests/function_libs/torch_lib/ops_test.py"
  ];

  # Importing onnxruntime in the sandbox crashes on aarch64-linux:
@@ -4,7 +4,7 @@
  fetchFromGitHub,

  # build-system
-  setuptools,
+  hatchling,

  # dependencies
  colorama,
@@ -13,7 +13,7 @@
  sympy,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "onnxslim";
  version = "0.1.82";
  pyproject = true;
@@ -21,12 +21,12 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "inisis";
    repo = "OnnxSlim";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-hrrCodLaHVo/YRq0HczxogcZQSwZKxZthyLYxz/+XJ0=";
  };

  build-system = [
-    setuptools
+    hatchling
  ];

  dependencies = [
@@ -46,4 +46,4 @@ buildPythonPackage rec {
    homepage = "https://pypi.org/project/onnxslim/";
    license = lib.licenses.mit;
  };
-}
+})
@@ -32,14 +32,14 @@

 buildPythonPackage rec {
  pname = "plotpy";
-  version = "2.8.3";
+  version = "2.8.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PlotPyStack";
    repo = "PlotPy";
    tag = "v${version}";
-    hash = "sha256-MhJY9ENKAbsD0usHeCQhJFDKP2SoDVPXlnQ8OMi2YjU=";
+    hash = "sha256-h2cB0sFZ5o4VPqQZ8rXio0iNsKTVLHsOJddACYlPyLs=";
  };

  build-system = [
@@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "psnawp";
-  version = "3.0.2";
+  version = "3.0.3";
  pyproject = true;

  src = fetchFromCodeberg {
    owner = "YoshikageKira";
    repo = "psnawp";
    tag = "v${version}";
-    hash = "sha256-RpJYQNG9+N5XUOIySOZvVLCT6kiLYGaq0Lt8CTLRvBA=";
+    hash = "sha256-vAz1HDvPRWgrWMKwWNMA2nhA2wLCN92lDb06ZQiZnO0=";
  };

  build-system = [ poetry-core ];
@@ -16,14 +16,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyportainer";
-  version = "1.0.31";
+  version = "1.0.33";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "erwindouna";
    repo = "pyportainer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-s+F+V6vJr1Y7Xark/XAthwrVi6prp8hK6vyAzpdm/54=";
+    hash = "sha256-DWfe/N/YMiD5/4CnkVnWhgWoLE5tx1iaU93hQdmwXSQ=";
  };

  build-system = [ hatchling ];
@@ -1,20 +1,29 @@
 {
  lib,
  stdenv,
-  ansible-compat,
-  ansible-core,
  buildPythonPackage,
-  coreutils,
  fetchFromGitHub,
-  packaging,
-  pytest,
-  pytest-xdist,
-  pytestCheckHook,
+  coreutils,
+
+  # build-system
  setuptools,
  setuptools-scm,
+
+  # dependencies
+  ansible-compat,
+  ansible-core,
+  packaging,
+  pytest-xdist,
+
+  # buildInputs
+  pytest,
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "pytest-ansible";
  version = "26.2.0";
  pyproject = true;
@@ -22,7 +31,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "ansible";
    repo = "pytest-ansible";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-3pppBAgAfkwJNPRsI6CH4UDMqyZ45+mFNejlQwX5bCg=";
  };

@@ -45,11 +54,10 @@ buildPythonPackage rec {
    pytest-xdist
  ];

-  nativeCheckInputs = [ pytestCheckHook ];
-
-  preCheck = ''
-    export HOME=$TMPDIR
-  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];

  enabledTestPaths = [ "tests/" ];

@@ -72,6 +80,14 @@ buildPythonPackage rec {
  disabledTestPaths = [
    # Test want s to execute pytest in a subprocess
    "tests/integration/test_molecule.py"
+
+    # TypeError: Cannot define type '_AnsibleLazyTemplateDict' since '_AnsibleLazyTemplateDict'
+    # already extends '_AnsibleTaggedDict'.
+    "tests/test_host_manager.py"
+
+    # assert <ExitCode.TESTS_FAILED: 1> == <ExitCode.OK: 0>
+    "tests/test_fixtures.py"
+    "tests/test_params.py"
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    # These tests fail in the Darwin sandbox
@@ -88,10 +104,10 @@ buildPythonPackage rec {
  meta = {
    description = "Plugin for pytest to simplify calling ansible modules from tests or fixtures";
    homepage = "https://github.com/jlaska/pytest-ansible";
-    changelog = "https://github.com/ansible-community/pytest-ansible/releases/tag/${src.tag}";
+    changelog = "https://github.com/ansible-community/pytest-ansible/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      robsliwi
    ];
  };
-}
+})
@@ -1,78 +1,85 @@
 {
-  buildPythonPackage,
-  fetchPypi,
-  fetchpatch,
  lib,
+  buildPythonPackage,
+  fetchFromGitHub,

  # build-system
+  cysignals,
  cython,
-  pkg-config,
  setuptools,

  # native dependencies
+  pkg-config,
  leptonica,
-  tesseract4,
+  tesseract5,

  # dependencies
  pillow,

  # tests
-  unittestCheckHook,
+  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "tesserocr";
-  version = "2.8.0";
-  format = "setuptools";
+  version = "2.10.0";
+  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-vlGNGxtf9UwRqtoeD9EpQlCepwWB4KizmipHOgstvTY=";
+  src = fetchFromGitHub {
+    owner = "sirfz";
+    repo = "tesserocr";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-y/3MXkocO4hRMjREPT6yvqH87EZm79zerinp5TUHNP4=";
  };

-  patches = [
-    # Backport https://github.com/sirfz/tesserocr/pull/364 to fix tests
-    (fetchpatch {
-      url = "https://github.com/sirfz/tesserocr/commit/853a885d0154a0345e1ea7db80febe04893a3da8.patch";
-      hash = "sha256-s51s9EIV9AZT6UoqwTuQ8lOjToqwIIUkDLjsvCsyYFU=";
-    })
-  ];
-
-  # https://github.com/sirfz/tesserocr/issues/314
  postPatch = ''
-    sed -i '/allheaders.h/a\    pass\n\ncdef extern from "leptonica/pix_internal.h" nogil:' tesserocr/tesseract.pxd
-
    substituteInPlace setup.py \
-      --replace-fail "Cython>=0.23,<3.1.0" Cython
+      --replace-fail \
+        "Cython>=3.0.0,<3.2.0" \
+        "Cython"
  '';

  build-system = [
+    cysignals
    cython
-    pkg-config
    setuptools
  ];

+  nativeBuildInputs = [
+    pkg-config
+  ];
+
  buildInputs = [
    leptonica
-    tesseract4
+    tesseract5
  ];

-  dependencies = [ pillow ];
+  dependencies = [
+    cysignals # also needed at runtime
+    pillow
+  ];

  pythonImportsCheck = [ "tesserocr" ];

-  nativeCheckInputs = [ unittestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];

  preCheck = ''
    rm -rf tesserocr
  '';

+  disabledTests = [
+    # AssertionError: '.bl' != '.tif'
+    "test_init_full"
+  ];
+
  meta = {
-    changelog = "https://github.com/sirfz/tesserocr/releases/tag/v${version}";
    description = "Simple, Pillow-friendly, wrapper around the tesseract-ocr API for Optical Character Recognition (OCR)";
    homepage = "https://github.com/sirfz/tesserocr";
+    changelog = "https://github.com/sirfz/tesserocr/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ mtrsk ];
    platforms = lib.platforms.unix;
  };
-}
+})
@@ -33,14 +33,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "torchao";
-  version = "0.15.0";
+  version = "0.16.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pytorch";
    repo = "ao";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-N5s2AzkK9HmUT+qVq2owrB/53izDlzd25fqThjA3hPQ=";
+    hash = "sha256-FyBsIVb3zdKtA8Vqjt301bRrGIoyeqiOUADVFGxiRPY=";
  };

  # AttributeError: 'typing.Union' object has no attribute '__module__' and no __dict__ for setting
@@ -304,6 +304,16 @@ buildPythonPackage (finalAttrs: {
    "test/quantization/pt2e/test_arm_inductor_quantizer.py"
    "test/quantization/pt2e/test_x86inductor_fusion.py"
    "test/quantization/pt2e/test_x86inductor_quantizer.py"
+
+    # TypeError: Trying to convert Float8_e4m3fn to the MPS backend but it does not have support for that dtype.
+    "test/quantization/quantize_/workflows/float8/test_float8_tensor.py"
+
+    # AssertionError: Torch not compiled with CUDA enabled
+    "test/integration/test_integration.py"
+
+    # Wants network access
+    "test/test_low_bit_optim.py::TestQuantize::test_bf16_stochastic_round_dtensor_device_mps_compile_False"
+    "test/test_low_bit_optim.py::TestQuantize::test_bf16_stochastic_round_dtensor_device_mps_compile_True"
  ];

  meta = {
@@ -37,14 +37,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "torchtune";
-  version = "0.6.1";
+  version = "0.6.2-unstable-2026-02-19";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "meta-pytorch";
    repo = "torchtune";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-evhQBpZiUXriL0PAYkEzGypH21iRs37Ix6Nl5YAyeQ0=";
+    rev = "6f2aa7254458145f99d7004cbd6ebc8e53a06404";
+    hash = "sha256-ryR5iO3IwkoLdMLSFGhHCLl0P8yD+GQdZFEE6M/EYh0=";
  };

  build-system = [
@@ -103,12 +103,16 @@ buildPythonPackage (finalAttrs: {
    "test_deprecated"

    # Flaky
-    # AssertionError: actual: -83.3048095703125, expected: -83.15229797363281
+    # AssertionError: (numbers slightly different than expected))
    "test_forward"
    "test_forward_kv_cache"
    "test_forward_with_2d_pos_ids"
    "test_forward_with_curr_pos"
    "test_forward_with_packed_pos"
+    "test_local_kv_cache"
+
+    # TypeError: exceptions must be derived from Warning, not <class 'NoneType'>
+    "test_deprecate_parameter"
  ]
  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64) [
    # RuntimeError: Error in dlopen:
@@ -133,12 +137,17 @@ buildPythonPackage (finalAttrs: {
    "tests/torchtune/_cli/test_download.py::TestTuneDownloadCommand::test_download_calls_snapshot"
    "tests/torchtune/_cli/test_download.py::TestTuneDownloadCommand::test_gated_repo_error_no_token"
    "tests/torchtune/_cli/test_download.py::TestTuneDownloadCommand::test_gated_repo_error_with_token"
+
+    # NameError: name 'TypeVar' is not defined
+    "tests/torchtune/rlhf/loss/test_dpo_loss.py"
+    "tests/torchtune/rlhf/loss/test_ppo_loss.py"
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    # fail due to floating-point precision differences
    "tests/torchtune/models/flux/test_flux_autoencoder.py::TestFluxAutoencoder::test_encode"
    "tests/torchtune/modules/peft/test_dora.py::TestDoRALinear::test_qdora_parity[True-dtype1]"
    "tests/torchtune/modules/peft/test_lora.py::TestLoRALinear::test_qlora_parity[True-dtype1]"
+    "tests/torchtune/modules/test_common_utils.py::TestLocalKVCache::test_local_kv_cache[llama_decoder_model]"

    # hangs
    "tests/torchtune/utils"
@@ -147,7 +156,7 @@ buildPythonPackage (finalAttrs: {
  meta = {
    description = "PyTorch native post-training library";
    homepage = "https://github.com/meta-pytorch/torchtune";
-    changelog = "https://github.com/meta-pytorch/torchtune/releases/tag/${finalAttrs.src.tag}";
+    # changelog = "https://github.com/meta-pytorch/torchtune/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [
      GaetanLepage
@@ -7,10 +7,12 @@
  setuptools-scm,

  # dependencies
+  lxml,
  unicode-segmentation-rs,
  urllib3,
+
+  # optional-dependencies
  tomlkit,
-  lxml,

  # tests
  aeidon,
@@ -28,25 +30,24 @@
  vobject,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "translate-toolkit";
-  version = "3.18.1";
-
+  version = "3.19.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "translate";
    repo = "translate";
-    tag = version;
-    hash = "sha256-T7Zo2/jx9P+Tz8jwRKRCV1lVv7XIaIoQTIjIVdEj/ZQ=";
+    tag = finalAttrs.version;
+    hash = "sha256-k+gCrY2r1ILeSvjdEHT3wE2LF9Qn76ENe9RRVcaHmq4=";
  };

  build-system = [ setuptools-scm ];

  dependencies = [
+    lxml
    unicode-segmentation-rs
    urllib3
-    lxml
  ];

  optional-dependencies = {
@@ -85,8 +86,8 @@ buildPythonPackage rec {
  meta = {
    description = "Useful localization tools for building localization & translation systems";
    homepage = "https://toolkit.translatehouse.org/";
-    changelog = "https://docs.translatehouse.org/projects/translate-toolkit/en/latest/releases/${src.tag}.html";
+    changelog = "https://docs.translatehouse.org/projects/translate-toolkit/en/latest/releases/${finalAttrs.src.tag}.html";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ erictapen ];
  };
-}
+})
@@ -27,7 +27,7 @@

 buildPythonPackage rec {
  pname = "weaviate-client";
-  version = "4.20.1";
+  version = "4.20.3";
  pyproject = true;

  disabled = pythonOlder "3.12";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
    owner = "weaviate";
    repo = "weaviate-python-client";
    tag = "v${version}";
-    hash = "sha256-KnO+xXI6q5a3pJgZuDrjvWgH+civXZwWLtnEJmBWLt4=";
+    hash = "sha256-O78gUY5+OojZMwOKGcDAQ8J4tVVmmvAyS5xWQyl3Ppk=";
  };

  pythonRelaxDeps = [
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  uv-build,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "weblate-fonts";
+  version = "2026.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "WeblateOrg";
+    repo = "fonts";
+    tag = finalAttrs.version;
+    hash = "sha256-JFnLi7ezme3yNo8e0Xjmvf/ejSaeTzzaJD5CMK4I9QM=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail \
+        "uv_build>=0.9.15,<0.10.0" \
+        "uv_build"
+  '';
+
+  build-system = [
+    uv-build
+  ];
+
+  pythonImportsCheck = [ "weblate_fonts" ];
+
+  meta = {
+    description = "Weblate fonts collection";
+    homepage = "https://github.com/WeblateOrg/fonts";
+    changelog = "https://github.com/WeblateOrg/fonts/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      cc0
+      ofl
+    ];
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
@@ -1,20 +1,21 @@
 {
  lib,
  buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
  setuptools,
  translate-toolkit,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "weblate-language-data";
-  version = "2026.2";
+  version = "2026.3";
  pyproject = true;

-  src = fetchPypi {
-    pname = "weblate_language_data";
-    inherit version;
-    hash = "sha256-0mGkNbJomRRzS9P3fuUUGl7uipAfZhesoyc7t+Ymyf4=";
+  src = fetchFromGitHub {
+    owner = "WeblateOrg";
+    repo = "language-data";
+    tag = finalAttrs.version;
+    hash = "sha256-v64YlcgHT94SCTGebR//Cnjj+NeH3TJZsXB8EztJk9s=";
  };

  build-system = [ setuptools ];
@@ -29,9 +30,8 @@ buildPythonPackage rec {
  meta = {
    description = "Language definitions used by Weblate";
    homepage = "https://github.com/WeblateOrg/language-data";
-    changelog = "https://github.com/WeblateOrg/language-data/releases/tag/${version}";
+    changelog = "https://github.com/WeblateOrg/language-data/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ erictapen ];
  };
-
-}
+})
@@ -118,14 +118,25 @@ rec {
  };

  # data center driver compatible with current default cudaPackages
-  dc = dc_570;
+  dc = dc_580;

-  dc_535 = generic rec {
-    version = "535.288.01";
+  dc_590 = generic rec {
+    version = "590.48.01";
    url = "https://us.download.nvidia.com/tesla/${version}/NVIDIA-Linux-x86_64-${version}.run";
-    sha256_64bit = "sha256-8gwy/W7NH3BcbfJ5fAwIQlPs9/9I8sNH+Co5YZiC7OE=";
-    persistencedSha256 = "sha256-q061VN6om3UzbpWD7+tJJVgU/e2YCJF4IgEv53qx9ZA=";
-    fabricmanagerSha256 = "sha256-bVOnPmAa2ADGC1FCIz0TAyS9lccNPa3K5pJQhgX45pQ=";
+    sha256_64bit = "sha256-ueL4BpN4FDHMh/TNKRCeEz3Oy1ClDWto1LO/LWlr1ok=";
+    persistencedSha256 = "sha256-wsNeuw7IaY6Qc/i/AzT/4N82lPjkwfrhxidKWUtcwW8=";
+    fabricmanagerSha256 = "sha256-f/AQ8HrgoqBQyXNrXA/UaI4OMQ9QcjjYWIhr1/5uM74=";
+    useSettings = false;
+    usePersistenced = true;
+    useFabricmanager = true;
+  };
+
+  dc_580 = generic rec {
+    version = "580.126.09";
+    url = "https://us.download.nvidia.com/tesla/${version}/NVIDIA-Linux-x86_64-${version}.run";
+    sha256_64bit = "sha256-TKxT5I+K3/Zh1HyHiO0kBZokjJ/YCYzq/QiKSYmG7CY=";
+    persistencedSha256 = "sha256-J1UwS0o/fxz45gIbH9uaKxARW+x4uOU1scvAO4rHU5Y=";
+    fabricmanagerSha256 = "sha256-tyCHKIr8nxVfZIqcWKAwRoMLzmGlsOUhDlO5V/9W97Y=";
    useSettings = false;
    usePersistenced = true;
    useFabricmanager = true;
@@ -493,7 +493,6 @@ in
        nvidia_x11_production = nvidiaPackages.production;
        nvidia_x11_vulkan_beta = nvidiaPackages.vulkan_beta;
        nvidia_dc = nvidiaPackages.dc;
-        nvidia_dc_535 = nvidiaPackages.dc_535;

        # this is not a replacement for nvidia_x11*
        # only the opensource kernel driver exposed for hydra to build
@@ -724,6 +723,7 @@ in
        phc-intel = throw "phc-intel drivers are no longer supported by any kernel >=4.17"; # added 2025-07-18
        prl-tools = throw "Parallel Tools no longer provide any kernel module, please use pkgs.prl-tools instead."; # added 2025-10-04
        nvidia_dc_565 = throw "nvidiaPackages.dc_565 has reached end of life, see https://endoflife.date/nvidia"; # added 2026-02-10
+        nvidia_dc_535 = throw "nvidiaPackages.dc_535 removed, soon reaches end of life, see https://endoflife.date/nvidia"; # added 2026-03-08
      }
    )).extend
      (lib.fixedPoints.composeManyExtensions kernelPackagesExtensions);
@@ -11277,6 +11277,8 @@ self: super: with self; {

  obspy = callPackage ../development/python-modules/obspy { };

+  obstore = callPackage ../development/python-modules/obstore { };
+
  oca-port = callPackage ../development/python-modules/oca-port { };

  ochre = callPackage ../development/python-modules/ochre { };
@@ -20886,6 +20888,8 @@ self: super: with self; {

  webio-api = callPackage ../development/python-modules/webio-api { };

+  weblate-fonts = callPackage ../development/python-modules/weblate-fonts { };
+
  weblate-language-data = callPackage ../development/python-modules/weblate-language-data { };

  weblate-schemas = callPackage ../development/python-modules/weblate-schemas { };