fix(n8n): use stable tag target to get actual version

The previous jq filter grabbed the first non-stable release by creation date,
which incorrectly returned 1.123.38 instead of the latest stable 2.18.5.

Now query the 'stable' tag directly and extract version from its
target_commitish (e.g., 'release/2.18.5' -> '2.18.5'), ensuring we always
get the actual latest stable version.

Also bump version from 2.17.8 to 2.18.5 with updated hashes.

pkgs/kestractl/sources.json

@@ -1,13 +1,13 @@
 {
-  "version": "1.2.2",
+  "version": "1.3.0",
   "sources": {
     "aarch64-linux": {
-      "url": "https://github.com/kestra-io/kestractl/releases/download/1.2.2/kestractl_1.2.2_linux_arm64.tar.gz",
-      "hash": "sha256-sidFsCZPnJ07PM5QayPBqaqlBBJTLEdecfd0AWnL7Yo="
+      "url": "https://github.com/kestra-io/kestractl/releases/download/1.3.0/kestractl_1.3.0_linux_arm64.tar.gz",
+      "hash": "sha256-/18F6CZnnLbet4BmI1oQ5pZWkJwIshCq30qd+cm0GGA="
     },
     "x86_64-linux": {
-      "url": "https://github.com/kestra-io/kestractl/releases/download/1.2.2/kestractl_1.2.2_linux_amd64.tar.gz",
-      "hash": "sha256-0C2naN2ougBJSY2z2m6eORnLkLen87HD+a+gvtrUvdw="
+      "url": "https://github.com/kestra-io/kestractl/releases/download/1.3.0/kestractl_1.3.0_linux_amd64.tar.gz",
+      "hash": "sha256-xmsBiqNKvob8xHDyU253o6c25YIubHanNdLqzWaOvSA="
     }
   }
 }

pkgs/n8n/default.nix

@@ -26,20 +26,20 @@
 in
   stdenv.mkDerivation (finalAttrs: {
     pname = "n8n";
-    version = "2.17.8";
+    version = "2.18.5";
 
     src = fetchFromGitHub {
       owner = "n8n-io";
       repo = "n8n";
       tag = "n8n@${finalAttrs.version}";
-      hash = "sha256-+Fr7zYca4+3R9J77TkHTGki8oz4FrE9MNsxOaDCF2GM=";
+      hash = "sha256-ws0DXGQFR+z3nVyd4Yn9pIM7yh+H6GnuCRSLxgvtPxo=";
     };
 
     pnpmDeps = fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
       pnpm = pnpm_10;
       fetcherVersion = 3;
-      hash = "sha256-MBSxAsZXCaxwQpstJVxOOCIAE+0RqwlIrgXtE/hiTJM=";
+      hash = "sha256-Ajgne0neNm6HgMK6z3jnEkUJJxVOTgzjpSaMaJgIndQ=";
     };
 
     nativeBuildInputs =

pkgs/n8n/update.sh

@@ -2,9 +2,14 @@
 #!nix-shell -i bash -p bash curl jq nix-update cacert git nix
 set -euo pipefail
 
-# n8n now publishes two releases per version: a "stable" tag and a "n8n@X.Y.Z" versioned tag.
-# Skip the "stable" tag and get the actual version from the next release.
-# Note: We removed --pure from the shebang because nix-update needs network access to prefetch hashes.
+# n8n releases are published with two tags per version:
+#   - "n8n@X.Y.Z" - the versioned tag
+#   - "stable"   - always points to the latest stable version
+#
+# We query the "stable" tag and extract the version from its target commitish (e.g., "release/2.18.5").
+# This ensures we always get the actual latest stable version, not the most recently created tag.
+
+set -euo pipefail
 
 # Get the directory where this script lives (should be pkgs/n8n/)
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -14,10 +19,10 @@ nixpkgs_root="$(cd "$script_dir/../.." && pwd)"
 
 cd "$nixpkgs_root"
 
-release_info=$(curl -s "https://api.github.com/repos/n8n-io/n8n/releases")
-new_version=$(echo "$release_info" | jq --raw-output 'map(select(.tag_name != "stable")) | .[0].tag_name | ltrimstr("n8n@")')
+# Query the "stable" tag and extract version from target_commitish (e.g., "release/2.18.5")
+new_version=$(curl -s "https://api.github.com/repos/n8n-io/n8n/releases/tags/stable" | jq --raw-output '.target_commitish | ltrimstr("release/")')
 
-echo "Latest version: n8n@${new_version}"
+echo "Latest stable version: n8n@${new_version}"
 echo "Running from: $(pwd)"
 
 # Use --flake --system to properly evaluate the flake-based package