From f7f0c4072e63fe039200925b2927c42868bcffca Mon Sep 17 00:00:00 2001
From: m3ta-chiron <m3ta-chiron@agentmail.to>
Date: Wed, 29 Apr 2026 18:40:49 +0200
Subject: [PATCH] fix(n8n): use stable tag target to get actual version

The previous jq filter grabbed the first non-stable release by creation date,
which incorrectly returned 1.123.38 instead of the latest stable 2.18.5.

Now query the 'stable' tag directly and extract version from its
target_commitish (e.g., 'release/2.18.5' -> '2.18.5'), ensuring we always
get the actual latest stable version.

Also bump version from 2.17.8 to 2.18.5 with updated hashes.
---
 pkgs/n8n/default.nix |  6 +++---
 pkgs/n8n/update.sh   | 17 +++++++++++------
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/pkgs/n8n/default.nix b/pkgs/n8n/default.nix
index f0a30f0..0621ecf 100644
--- a/pkgs/n8n/default.nix
+++ b/pkgs/n8n/default.nix
@@ -26,20 +26,20 @@
 in
   stdenv.mkDerivation (finalAttrs: {
     pname = "n8n";
-    version = "2.17.8";
+    version = "2.18.5";
 
     src = fetchFromGitHub {
       owner = "n8n-io";
       repo = "n8n";
       tag = "n8n@${finalAttrs.version}";
-      hash = "sha256-+Fr7zYca4+3R9J77TkHTGki8oz4FrE9MNsxOaDCF2GM=";
+      hash = "sha256-ws0DXGQFR+z3nVyd4Yn9pIM7yh+H6GnuCRSLxgvtPxo=";
     };
 
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
       pnpm = pnpm_10;
       fetcherVersion = 3;
-      hash = "sha256-MBSxAsZXCaxwQpstJVxOOCIAE+0RqwlIrgXtE/hiTJM=";
+      hash = "sha256-Ajgne0neNm6HgMK6z3jnEkUJJxVOTgzjpSaMaJgIndQ=";
     };
 
     nativeBuildInputs =
diff --git a/pkgs/n8n/update.sh b/pkgs/n8n/update.sh
index 9a157a8..5e94801 100755
--- a/pkgs/n8n/update.sh
+++ b/pkgs/n8n/update.sh
@@ -2,9 +2,14 @@
 #!nix-shell -i bash -p bash curl jq nix-update cacert git nix
 set -euo pipefail
 
-# n8n now publishes two releases per version: a "stable" tag and a "n8n@X.Y.Z" versioned tag.
-# Skip the "stable" tag and get the actual version from the next release.
-# Note: We removed --pure from the shebang because nix-update needs network access to prefetch hashes.
+# n8n releases are published with two tags per version:
+#   - "n8n@X.Y.Z" - the versioned tag
+#   - "stable"   - always points to the latest stable version
+#
+# We query the "stable" tag and extract the version from its target commitish (e.g., "release/2.18.5").
+# This ensures we always get the actual latest stable version, not the most recently created tag.
+
+set -euo pipefail
 
 # Get the directory where this script lives (should be pkgs/n8n/)
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -14,10 +19,10 @@ nixpkgs_root="$(cd "$script_dir/../.." && pwd)"
 
 cd "$nixpkgs_root"
 
-release_info=$(curl -s "https://api.github.com/repos/n8n-io/n8n/releases")
-new_version=$(echo "$release_info" | jq --raw-output 'map(select(.tag_name != "stable")) | .[0].tag_name | ltrimstr("n8n@")')
+# Query the "stable" tag and extract version from target_commitish (e.g., "release/2.18.5")
+new_version=$(curl -s "https://api.github.com/repos/n8n-io/n8n/releases/tags/stable" | jq --raw-output '.target_commitish | ltrimstr("release/")')
 
-echo "Latest version: n8n@${new_version}"
+echo "Latest stable version: n8n@${new_version}"
 echo "Running from: $(pwd)"
 
 # Use --flake --system to properly evaluate the flake-based package