Merge staging-next into staging

2026-01-06 00:19:30 +00:00
parent c3bbe185bc 933041ade8
commit 3fa7bb6ca1
73 changed files with 936 additions and 642 deletions
@@ -92,14 +92,14 @@ Generate a script that can be used to run an interactive session in the given im

 ### Examples {#vm-tools-makeImageTestScript-examples}

-Create a script for running a Fedora 27 VM:
+Create a script for running a Fedora 43 VM:
 ```nix
-{ pkgs }: with pkgs; with vmTools; makeImageTestScript diskImages.fedora27x86_64
+{ pkgs }: pkgs.vmTools.makeImageTestScript pkgs.vmTools.diskImages.fedora43x86_64
 ```

-Create a script for running an Ubuntu 20.04 VM:
+Create a script for running an Ubuntu 24.04 VM:
 ```nix
-{ pkgs }: with pkgs; with vmTools; makeImageTestScript diskImages.ubuntu2004x86_64
+{ pkgs }: pkgs.vmTools.makeImageTestScript pkgs.vmTools.diskImages.ubuntu2404x86_64
 ```

 ## `vmTools.diskImageFuns` {#vm-tools-diskImageFuns}
@@ -109,30 +109,29 @@ A set of functions that build a predefined set of minimal Linux distributions im
 ### Images {#vm-tools-diskImageFuns-images}

 * Fedora
-  * `fedora26x86_64`
-  * `fedora27x86_64`
-* CentOS
-  * `centos6i386`
-  * `centos6x86_64`
-  * `centos7x86_64`
+  * `fedora42x86_64`
+  * `fedora43x86_64`
+* Rocky Linux
+  * `rocky9x86_64`
+  * `rocky10x86_64`
+* AlmaLinux
+  * `alma9x86_64`
+  * `alma10x86_64`
+* Oracle Linux
+  * `oracle9x86_64`
+* Amazon Linux
+  * `amazon2023x86_64`
 * Ubuntu
-  * `ubuntu1404i386`
-  * `ubuntu1404x86_64`
-  * `ubuntu1604i386`
-  * `ubuntu1604x86_64`
-  * `ubuntu1804i386`
-  * `ubuntu1804x86_64`
-  * `ubuntu2004i386`
-  * `ubuntu2004x86_64`
  * `ubuntu2204i386`
  * `ubuntu2204x86_64`
+  * `ubuntu2404x86_64`
 * Debian
-  * `debian10i386`
-  * `debian10x86_64`
  * `debian11i386`
  * `debian11x86_64`
  * `debian12i386`
  * `debian12x86_64`
+  * `debian13i386`
+  * `debian13x86_64`

 ### Attributes {#vm-tools-diskImageFuns-attributes}

@@ -144,9 +143,7 @@ A set of functions that build a predefined set of minimal Linux distributions im
 8GiB image containing Firefox in addition to the default packages:
 ```nix
 { pkgs }:
-with pkgs;
-with vmTools;
-diskImageFuns.ubuntu2004x86_64 {
+pkgs.vmTools.diskImageFuns.ubuntu2404x86_64 {
  extraPackages = [ "firefox" ];
  size = 8192;
 }
@@ -22305,6 +22305,11 @@
    github = "RhydianJenkins";
    githubId = 9198690;
  };
+  Rhys-T = {
+    name = "Rhys T.";
+    github = "Rhys-T";
+    githubId = 108157737;
+  };
  rhysmdnz = {
    email = "rhys@memes.nz";
    matrix = "@rhys:memes.nz";
@@ -1,5 +1,5 @@
 # QEMU-related utilities shared between various Nix expressions.
-{ lib, pkgs }:
+{ lib, stdenv }:

 let
  zeroPad =
@@ -17,19 +17,19 @@ rec {
  ];

  qemuSerialDevice =
-    if with pkgs.stdenv.hostPlatform; isx86 || isLoongArch64 || isMips64 || isRiscV then
+    if with stdenv.hostPlatform; isx86 || isLoongArch64 || isMips64 || isRiscV then
      "ttyS0"
-    else if (with pkgs.stdenv.hostPlatform; isAarch || isPower) then
+    else if (with stdenv.hostPlatform; isAarch || isPower) then
      "ttyAMA0"
    else
-      throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";
+      throw "Unknown QEMU serial device for system '${stdenv.hostPlatform.system}'";

  qemuBinary =
    qemuPkg:
    let
      hostStdenv = qemuPkg.stdenv;
      hostSystem = hostStdenv.system;
-      guestSystem = pkgs.stdenv.hostPlatform.system;
+      guestSystem = stdenv.hostPlatform.system;

      linuxHostGuestMatrix = {
        x86_64-linux = "${qemuPkg}/bin/qemu-system-x86_64 -machine accel=kvm:tcg -cpu max";
@@ -30,7 +30,7 @@ let
      ...
    }:
    let
-      qemu-common = import ../qemu-common.nix { inherit lib pkgs; };
+      qemu-common = import ../qemu-common.nix { inherit (pkgs) lib stdenv; };

      # Convert legacy VLANs to named interfaces and merge with explicit interfaces.
      vlansNumbered = forEach (zipLists config.virtualisation.vlans (range 1 255)) (v: {
@@ -14,7 +14,7 @@ with lib;
 let
  cfg = config.testing;

-  qemu-common = import ../../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };

  backdoorService = {
    requires = [
@@ -16,7 +16,7 @@ with lib;

 let

-  qemu-common = import ../../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };

  cfg = config.virtualisation;

@@ -8,7 +8,7 @@ with import ../lib/testing-python.nix { inherit system pkgs; };

 let
  lib = pkgs.lib;
-  qemu-common = import ../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };

  mkStartCommand =
    {
@@ -2,7 +2,7 @@
 { config, pkgs, ... }:
 let
  inherit (pkgs) lib;
-  qemu-common = import ../../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };
  vlanIfs = lib.range 1 (lib.length config.virtualisation.vlans);
 in
 {
@@ -59,6 +59,70 @@ let
      opt = map (x: x.plugin) pluginsPartitioned.right;
    };

+  /**
+    * Builds a vim package (see ':h packages') with additionnal info:
+    - the user lua configuration (specified by user)
+    - the advised and advised by nixpkgs in passthru.initLua)
+    - runtime dependencies (specified in plugins' "runtimeDeps")
+    - plugin dependencies (vim plugins, python deps)
+  */
+  makeVimPackageInfo =
+    # a list of neovim plugin derivations, for instance
+    #  plugins = [
+    # { plugin=vimPlugins.far-vim; config = "let g:far#source='rg'"; optional = false; }
+    # vimPlugins.vim-fugitive
+    # ]
+    plugins:
+
+    let
+      pluginsNormalized = normalizePlugins plugins;
+
+      vimPackage = normalizedPluginsToVimPackage pluginsNormalized;
+
+      userPluginLua = lib.foldl (
+        acc: p: if p.config != null then acc ++ [ p.config ] else acc
+      ) [ ] pluginsNormalized;
+
+      pluginAdvisedLua =
+        let
+          op =
+            acc: normalizedPlugin:
+            acc
+            ++ lib.optional (
+              normalizedPlugin.plugin.passthru ? initLua
+            ) normalizedPlugin.plugin.passthru.initLua;
+        in
+        lib.foldl' op [ ] pluginsNormalized;
+
+      getDeps = attrname: map (plugin: plugin.${attrname} or (_: [ ]));
+
+      requiredPlugins = vimUtils.requiredPluginsForPackage vimPackage;
+      pluginPython3Packages = getDeps "python3Dependencies" requiredPlugins;
+    in
+    {
+      # plugins' python dependencies
+      inherit pluginPython3Packages;
+
+      # lua config set by the user along with the plugin
+      inherit userPluginLua;
+
+      # recommanded configuration set in vim plugins ".passthru.initLua"
+      inherit pluginAdvisedLua;
+
+      # A Vim "package", see ':h packages'
+      # You most likely want to use vimPackage as follows:
+      #     packpathDirs.myNeovimPackages = vimPackage;
+      #     finalPackdir = neovimUtils.packDir packpathDirs;
+      inherit vimPackage;
+
+      runtimeDeps =
+        let
+          op = acc: normalizedPlugin: acc ++ normalizedPlugin.plugin.runtimeDeps or [ ];
+        in
+        lib.foldl' op [ ] pluginsNormalized;
+
+    };
+
  /*
    returns everything needed for the caller to wrap its own neovim:
    - the generated content of the future init.vim
@@ -297,7 +361,6 @@ let
    packages:
    let
      rawPackDir = vimUtils.packDir packages;
-
    in
    rawPackDir.override {
      postBuild = ''
@@ -311,6 +374,7 @@ let
 in
 {
  inherit makeNeovimConfig;
+  inherit makeVimPackageInfo;
  inherit generateProviderRc;
  inherit legacyWrapper;
  inherit grammarToPlugin;
@@ -81,9 +81,6 @@ let
    stdenv.mkDerivation (
      finalAttrs:
      let
-        pluginsNormalized = neovimUtils.normalizePlugins finalAttrs.plugins;
-
-        myVimPackage = neovimUtils.normalizedPluginsToVimPackage pluginsNormalized;

        rubyEnv = bundlerEnv {
          name = "neovim-ruby-env";
@@ -93,49 +90,38 @@ let
          '';
        };

-        pluginRC = lib.foldl (
-          acc: p: if p.config != null then acc ++ [ p.config ] else acc
-        ) [ ] pluginsNormalized;
-
        # a limited RC script used only to generate the manifest for remote plugins
        manifestRc = "";
+
+        # plugin-related information
+        vimPackageInfo = neovimUtils.makeVimPackageInfo finalAttrs.plugins;
+
        # we call vimrcContent without 'packages' to avoid the init.vim generation
        neovimRcContent' = lib.concatStringsSep "\n" (
-          pluginRC ++ lib.optional (neovimRcContent != null) neovimRcContent
+          vimPackageInfo.userPluginLua ++ lib.optional (neovimRcContent != null) neovimRcContent
        );

-        packpathDirs.myNeovimPackages = myVimPackage;
+        packpathDirs.myNeovimPackages = vimPackageInfo.vimPackage;
        finalPackdir = neovimUtils.packDir packpathDirs;

-        luaPluginRC =
-          let
-            op =
-              acc: normalizedPlugin:
-              acc
-              ++ lib.optional (
-                finalAttrs.autoconfigure && normalizedPlugin.plugin.passthru ? initLua
-              ) normalizedPlugin.plugin.passthru.initLua;
-          in
-          lib.foldl' op [ ] pluginsNormalized;
-
        rcContent = ''
          ${luaRcContent}
        ''
        + lib.optionalString (neovimRcContent' != "") ''
          vim.cmd.source "${writeText "init.vim" neovimRcContent'}"
        ''
-        + lib.concatStringsSep "\n" luaPluginRC;
-
-        getDeps = attrname: map (plugin: plugin.${attrname} or (_: [ ]));
-
-        requiredPlugins = vimUtils.requiredPluginsForPackage myVimPackage;
-        pluginPython3Packages = getDeps "python3Dependencies" requiredPlugins;
+        + lib.optionalString autoconfigure (lib.concatStringsSep "\n" vimPackageInfo.pluginAdvisedLua);

        python3Env =
          lib.warnIf (attrs ? python3Env)
            "Pass your python packages via the `extraPython3Packages`, e.g., `extraPython3Packages = ps: [ ps.pandas ]`"
            python3.pkgs.python.withPackages
-            (ps: [ ps.pynvim ] ++ (extraPython3Packages ps) ++ (lib.concatMap (f: f ps) pluginPython3Packages));
+            (
+              ps:
+              [ ps.pynvim ]
+              ++ (extraPython3Packages ps)
+              ++ (lib.concatMap (f: f ps) vimPackageInfo.pluginPython3Packages)
+            );

        wrapperArgsStr = if lib.isString wrapperArgs then wrapperArgs else lib.escapeShellArgs wrapperArgs;

@@ -234,14 +220,10 @@ let
        inherit wrapperArgs generatedWrapperArgs;

        runtimeDeps =
-          let
-            op = acc: normalizedPlugin: acc ++ normalizedPlugin.plugin.runtimeDeps or [ ];
-            runtimeDeps = lib.foldl' op [ ] pluginsNormalized;
-          in
          lib.optionals finalAttrs.waylandSupport [ wl-clipboard ]
          ++ lib.optional finalAttrs.withRuby rubyEnv
          ++ lib.optional finalAttrs.withNodeJs nodejs
-          ++ lib.optionals finalAttrs.autowrapRuntimeDeps runtimeDeps;
+          ++ lib.optionals finalAttrs.autowrapRuntimeDeps vimPackageInfo.runtimeDeps;

        luaRcContent = rcContent;
        # Remove the symlinks created by symlinkJoin which we need to perform
@@ -342,8 +324,7 @@ let
          lndir
        ];

-        # A Vim "package", see ':h packages'
-        vimPackage = myVimPackage;
+        vimPackage = vimPackageInfo.vimPackage;

        checkPhase = ''
          runHook preCheck
@@ -7,14 +7,14 @@
 }:
 vimUtils.buildVimPlugin {
  pname = "cmp-async-path";
-  version = "0-unstable-2025-11-04";
+  version = "0-unstable-2026-01-05";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "FelipeLema";
    repo = "cmp-async-path";
-    rev = "b8aade3a0626f2bc1d3cd79affcd7da9f47f7ab1";
-    hash = "sha256-gaK2aemMX4fzH85idIPuVZ1+ay5vCNqgxU15J4Jz5wU=";
+    rev = "a14d3a9c7f303551a0b8c64a0e4e6527ce39a8a2";
+    hash = "sha256-QOa2Oke3p5wGhTJ4TjcgTUphb0OdDUwmw8MiYp2LkhA=";
  };

  checkInputs = [ vimPlugins.nvim-cmp ];
@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
  core = "ppsspp";
-  version = "0-unstable-2025-12-30";
+  version = "0-unstable-2026-01-04";

  src = fetchFromGitHub {
    owner = "hrydgard";
    repo = "ppsspp";
-    rev = "34fde065b76805c851d7c4b5bc4c67a3d347aab9";
-    hash = "sha256-se8WptzipVwAE6Qwq2hTv7xBsY22HoACdVrPv+ssBDc=";
+    rev = "6c0aff3a28b8c1ee97e1346d0b2404179ce5e5c0";
+    hash = "sha256-X/d3qGpdTJx7r6qtW2P/l7COMsv4oJ1nqjZC0QRLYiQ=";
    fetchSubmodules = true;
  };

@@ -30,6 +30,15 @@ mkLibretroCore {
    })
  ];

+  postPatch = ''
+    # Fix sol2 compatibility with GCC 15 (construct -> emplace)
+    # https://github.com/ThePhD/sol2/issues/1657
+    sed -i 's/this->construct(std::forward<Args>(args)\.\.\.);/this->emplace(std::forward<Args>(args)...);/g' 3rdparty/sol2/sol/sol.hpp
+
+    # Fix missing cstdint include for uint8_t
+    sed -i '1i #include <cstdint>' src/lib/util/corestr.cpp
+  '';
+
  extraNativeBuildInputs = [ python3 ];
  extraBuildInputs = [
    alsa-lib
@@ -50,6 +50,9 @@ mkLibretroCore {
    cp -a ${libretro-deps-src}/* deps/libretro-deps
    chmod -R u+w deps/

+    # Fix conflicts with glibc index/rindex functions
+    sed -i 's/\bindex\b/faad_index/g; s/\brindex\b/faad_rindex/g' deps/libretro-deps/libfaad/libfaad/common.h
+
    patchShebangs ./scripts/*
  '';

@@ -7,9 +7,7 @@
  herbstluftwm,
 }:

-mkDerivationWith python3Packages.buildPythonApplication rec {
-  inherit stdenv;
-
+mkDerivationWith (python3Packages.buildPythonApplication.override { inherit stdenv; }) rec {
  pname = "webmacs";
  version = "0.8";
  format = "setuptools";
@@ -75,11 +75,11 @@ in

 mkDerivation rec {
  pname = "recoll";
-  version = "1.43.5";
+  version = "1.43.9";

  src = fetchurl {
    url = "https://www.recoll.org/${pname}-${version}.tar.gz";
-    hash = "sha256-Px3uK7I/MkrJbAOmV2ipVct/+p05SST6TLTYoDaLNdQ=";
+    hash = "sha256-irloDtMO9CBvtI+oEicUOy2myrGskieWoqNk5eapzU8=";
  };

  mesonFlags = [
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-gradient-source";
-  version = "0.3.2";
+  version = "0.3.3";

  src = fetchFromGitHub {
    owner = "exeldro";
    repo = "obs-gradient-source";
    rev = version;
-    sha256 = "sha256-5pll84UZYOTESrid2UuC1aWlaLrWf1LpXqlV09XKLug=";
+    sha256 = "sha256-Y9PTvaZr7ANwHhqgWsNIikRQLdKO8sA4OXI+mKyUnaM=";
  };

  nativeBuildInputs = [ cmake ];
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-retro-effects";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "FiniteSingularity";
    repo = "obs-retro-effects";
    rev = "${version}";
-    sha256 = "sha256-bWUGuCgCNAaSc0+NRRYsx/8EhrlWuPcipkuUlQZvWDk=";
+    sha256 = "sha256-oQGXBd/KGPGTK+CoomMjjgrnxTqVIefEKqKH11SPHSY=";
  };

  nativeBuildInputs = [ cmake ];
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "obs-source-clone";
-  version = "0.1.5";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "exeldro";
    repo = "obs-source-clone";
    tag = finalAttrs.version;
-    hash = "sha256-0rBtFPfqVvB333eeWRpVe4TgrJTiBTIzsV/SSe3EgOc=";
+    hash = "sha256-LvxeADojLM33N3CmdwEHQ2FuORMlbKq961do5J7891M=";
  };

  nativeBuildInputs = [ cmake ];
@@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-text-pthread";
-  version = "2.0.7";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "norihiro";
    repo = "obs-text-pthread";
    rev = version;
-    sha256 = "sha256-YjMZfDSO5VRIY+HBGniNV3HG5vs+zbiqfbrPKs9v804=";
+    sha256 = "sha256-Br7cX1/7VYIruLA5107+PjTMNEFAE2P/cvmu5EuXbWI=";
  };

  nativeBuildInputs = [
@@ -1,9 +1,37 @@
 {
  lib,
-  pkgs,
+  stdenv,
+  buildPackages,
+  bash,
+  bashInteractive,
+  busybox,
+  coreutils,
+  cpio,
+  dpkg,
+  e2fsprogs,
+  fetchurl,
+  glibc,
+  kmod,
+  linux,
+  makeInitrd,
+  makeModulesClosure,
+  mtdutils,
+  rpm,
+  runCommand,
+  util-linux,
+  virtiofsd,
+  writeScript,
+  writeText,
+  xz,
+  zstd,
+
+  # ----------------------------
+  # The following  arguments form the "interface" of `pkgs.vmTools`.
+  # Note that `img` is a real package, but is set to this default in `all-packages.nix`.
+  # ----------------------------
  customQemu ? null,
-  kernel ? pkgs.linux,
-  img ? pkgs.stdenv.hostPlatform.linux-kernel.target,
+  kernel ? linux,
+  img ? stdenv.hostPlatform.linux-kernel.target,
  storeDir ? builtins.storeDir,
  rootModules ? [
    "virtio_pci"
@@ -18,30 +46,11 @@
 }:

 let
-  inherit (pkgs)
-    bash
-    bashInteractive
-    busybox
-    cpio
-    coreutils
-    e2fsprogs
-    fetchurl
-    kmod
-    rpm
-    stdenv
-    util-linux
-    buildPackages
-    writeScript
-    writeText
-    runCommand
-    ;
-in
-rec {
-  qemu-common = import ../../../nixos/lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../../nixos/lib/qemu-common.nix { inherit lib stdenv; };

  qemu = buildPackages.qemu_kvm;

-  modulesClosure = pkgs.makeModulesClosure {
+  modulesClosure = makeModulesClosure {
    kernel = lib.getOutput "modules" kernel;
    inherit rootModules;
    firmware = kernel;
@@ -64,18 +73,18 @@ rec {

        # Copy what we need from Glibc.
        cp -p \
-          ${pkgs.stdenv.cc.libc}/lib/ld-*.so.? \
-          ${pkgs.stdenv.cc.libc}/lib/libc.so.* \
-          ${pkgs.stdenv.cc.libc}/lib/libm.so.* \
-          ${pkgs.stdenv.cc.libc}/lib/libresolv.so.* \
-          ${pkgs.stdenv.cc.libc}/lib/libpthread.so.* \
-          ${pkgs.zstd.out}/lib/libzstd.so.* \
-          ${pkgs.xz.out}/lib/liblzma.so.* \
+          ${stdenv.cc.libc}/lib/ld-*.so.? \
+          ${stdenv.cc.libc}/lib/libc.so.* \
+          ${stdenv.cc.libc}/lib/libm.so.* \
+          ${stdenv.cc.libc}/lib/libresolv.so.* \
+          ${stdenv.cc.libc}/lib/libpthread.so.* \
+          ${zstd.out}/lib/libzstd.so.* \
+          ${xz.out}/lib/liblzma.so.* \
          $out/lib

        # Copy BusyBox.
-        cp -pd ${pkgs.busybox}/bin/* $out/bin
-        cp -pd ${pkgs.kmod}/bin/* $out/bin
+        cp -pd ${busybox}/bin/* $out/bin
+        cp -pd ${kmod}/bin/* $out/bin

        # Run patchelf to make the programs refer to the copied libraries.
        for i in $out/bin/* $out/lib/*; do if ! test -L $i; then nuke-refs $i; fi; done
@@ -179,7 +188,7 @@ rec {
    exec switch_root /fs $command
  '';

-  initrd = pkgs.makeInitrd {
+  initrd = makeInitrd {
    contents = [
      {
        object = stage1Init;
@@ -294,8 +303,8 @@ rec {
      ''${diskImage:+diskImage=$diskImage}
      # GitHub Actions runners seems to not allow installing seccomp filter: https://github.com/rcambrj/nix-pi-loader/issues/1#issuecomment-2605497516
      # Since we are running in a sandbox already, the difference between seccomp and none is minimal
-      ${pkgs.virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-store.sock --sandbox none --seccomp none --shared-dir "${storeDir}" &
-      ${pkgs.virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-xchg.sock --sandbox none --seccomp none --shared-dir xchg &
+      ${virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-store.sock --sandbox none --seccomp none --shared-dir "${storeDir}" &
+      ${virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-xchg.sock --sandbox none --seccomp none --shared-dir xchg &

      # Wait until virtiofsd has created these sockets to avoid race condition.
      until [[ -e virtio-store.sock ]]; do ${coreutils}/bin/sleep 1; done
@@ -437,8 +446,8 @@ rec {
      stdenv.mkDerivation {
        name = "extract-file-mtd";
        buildInputs = [
-          pkgs.util-linux
-          pkgs.mtdutils
+          util-linux
+          mtdutils
        ];
        buildCommand = ''
          ln -s ${kernel}/lib /lib
@@ -548,9 +557,10 @@ rec {
          # Newer distributions like Fedora 18 require /lib etc. to be
          # symlinked to /usr.
          ${lib.optionalString unifiedSystemDir ''
-            mkdir -p /mnt/usr/bin /mnt/usr/sbin /mnt/usr/lib /mnt/usr/lib64
+            mkdir -p /mnt/usr/bin /mnt/usr/lib /mnt/usr/lib64
            ln -s /usr/bin /mnt/bin
-            ln -s /usr/sbin /mnt/sbin
+            ln -s /usr/bin /mnt/sbin
+            ln -s /usr/bin /mnt/usr/sbin
            ln -s /usr/lib /mnt/lib
            ln -s /usr/lib64 /mnt/lib64
            ${util-linux}/bin/mount -t proc none /mnt/proc
@@ -729,9 +739,9 @@ rec {

            PATH=$PATH:${
              lib.makeBinPath [
-                pkgs.dpkg
-                pkgs.glibc
-                pkgs.xz
+                dpkg
+                glibc
+                xz
              ]
            }

@@ -826,13 +836,32 @@ rec {
      {
        nativeBuildInputs = [
          buildPackages.perl
+          buildPackages.perlPackages.URI
          buildPackages.perlPackages.XMLSimple
+          buildPackages.zstd
        ];
        inherit archs;
      }
      ''
        ${lib.concatImapStrings (i: pl: ''
-          gunzip < ${pl} > ./packages_${toString i}.xml
+          echo "decompressing ${pl}..."
+          case ${pl} in
+            *.zst)
+              zstd -d < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *.xz | *.lzma)
+              xz -d < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *.bz2)
+              bunzip2 < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *.gz)
+              gunzip < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *)
+              cp ${pl} ./packages_${toString i}.xml
+              ;;
+          esac
        '') packagesLists}
        perl -w ${rpm/rpm-closure.pl} \
          ${
@@ -990,25 +1019,246 @@ rec {

  # The set of supported RPM-based distributions.

-  rpmDistros = { };
+  rpmDistros = {
+    fedora42x86_64 = {
+      name = "fedora-42-x86_64";
+      fullName = "Fedora 42 (x86_64)";
+      packagesList = fetchurl {
+        url = "https://dl.fedoraproject.org/pub/fedora/linux/releases/42/Everything/x86_64/os/repodata/cd483b35df017d68b73a878a392bbf666a43d75db54c386e4720bc369eb5c3a3-primary.xml.zst";
+        hash = "sha256-zUg7Nd8BfWi3OoeKOSu/ZmpD1121TDhuRyC8Np61w6M=";
+      };
+      urlPrefix = "https://dl.fedoraproject.org/pub/fedora/linux/releases/42/Everything/x86_64/os";
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonFedoraPackages;
+      unifiedSystemDir = true;
+    };
+
+    fedora43x86_64 = {
+      name = "fedora-43-x86_64";
+      fullName = "Fedora 43 (x86_64)";
+      packagesList = fetchurl {
+        url = "https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os/repodata/fffa3e9f63fffd3d21b8ea5e9bb0fe349a7ed1d4e09777a618cec93a2bcc305f-primary.xml.zst";
+        hash = "sha256-//o+n2P//T0huOpem7D+NJp+0dTgl3emGM7JOivMMF8=";
+      };
+      urlPrefix = "https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os";
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonFedoraPackages ++ [ "gpgverify" ];
+      unifiedSystemDir = true;
+    };
+
+    # Rocky Linux's /pub/rocky/9/ URL is rolling and changes with each minor release. We use the
+    # vault instead, which provides stable URLs for specific minor versions.
+    rocky9x86_64 = {
+      name = "rocky-9.6-x86_64";
+      fullName = "Rocky Linux 9.6 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/9.6/BaseOS/x86_64/os/repodata/9965e429a90787a87a07eed62872d046411fb7dded524b96d74c4ce1eade327a-primary.xml.gz";
+          hash = "sha256-mWXkKakHh6h6B+7WKHLQRkEft93tUkuW10xM4ereMno=";
+        })
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/9.6/AppStream/x86_64/os/repodata/8cc9f795679c3365c06b6135f685ebf4188a5863a5f52f09f8cabd4f09c4dfa1-primary.xml.gz";
+          hash = "sha256-jMn3lWecM2XAa2E19oXr9BiKWGOl9S8J+Mq9TwnE36E=";
+        })
+      ];
+      urlPrefixes = [
+        "https://dl.rockylinux.org/vault/rocky/9.6/BaseOS/x86_64/os"
+        "https://dl.rockylinux.org/vault/rocky/9.6/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonRockyPackages ++ [
+        "annobin"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    # Rocky Linux's /pub/rocky/10/ URL is rolling and changes with each minor release. We use the
+    # vault instead, which provides stable URLs for specific minor versions.
+    rocky10x86_64 = {
+      name = "rocky-10.0-x86_64";
+      fullName = "Rocky Linux 10.0 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/10.0/BaseOS/x86_64/os/repodata/484d5c43cdb1058dd1328a6b891f45c85f1cb2620c528f2ef423d4b9feb9e2f0-primary.xml.gz";
+          hash = "sha256-SE1cQ82xBY3RMopriR9FyF8csmIMUo8u9CPUuf654vA=";
+        })
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/10.0/AppStream/x86_64/os/repodata/32c93064142d89f3f19c11e92642c5abd8368418f7ab3f3bdd752e4afa9b5b23-primary.xml.gz";
+          hash = "sha256-MskwZBQtifPxnBHpJkLFq9g2hBj3qz873XUuSvqbWyM=";
+        })
+      ];
+      urlPrefixes = [
+        "https://dl.rockylinux.org/vault/rocky/10.0/BaseOS/x86_64/os"
+        "https://dl.rockylinux.org/vault/rocky/10.0/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonRockyPackages ++ [
+        "annobin-plugin-gcc"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    # AlmaLinux's repo.almalinux.org URLs are rolling and change with each minor release.
+    # We use vault.almalinux.org instead, which provides stable URLs for specific versions.
+    alma9x86_64 = {
+      name = "alma-9.6-x86_64";
+      fullName = "AlmaLinux 9.6 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://vault.almalinux.org/9.6/BaseOS/x86_64/os/repodata/26d6cf944c86ef850773e61919e892a375ff10bb2254003e1d71673db9900b07-primary.xml.gz";
+          hash = "sha256-JtbPlEyG74UHc+YZGeiSo3X/ELsiVAA+HXFnPbmQCwc=";
+        })
+        (fetchurl {
+          url = "https://vault.almalinux.org/9.6/AppStream/x86_64/os/repodata/afb5d18b78d819d826d3d0e32ba439da7b9e0fd91d726dd833366496b1b8ca20-primary.xml.gz";
+          hash = "sha256-r7XRi3jYGdgm09DjK6Q52nueD9kdcm3YMzZklrG4yiA=";
+        })
+      ];
+      urlPrefixes = [
+        "https://vault.almalinux.org/9.6/BaseOS/x86_64/os"
+        "https://vault.almalinux.org/9.6/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonAlmaPackages ++ [
+        "annobin"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    alma10x86_64 = {
+      name = "alma-10.0-x86_64";
+      fullName = "AlmaLinux 10.0 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://vault.almalinux.org/10.0/BaseOS/x86_64/os/repodata/4d88695fa7ccb6298897fa9682ac1ded4628df342ffe08312846225e4469e3e4-primary.xml.gz";
+          hash = "sha256-TYhpX6fMtimIl/qWgqwd7UYo3zQv/ggxKEYiXkRp4+Q=";
+        })
+        (fetchurl {
+          url = "https://vault.almalinux.org/10.0/AppStream/x86_64/os/repodata/11ac32065bae6f2c2451803458690fc550e79f93a4ea9f438930f0c228964791-primary.xml.gz";
+          hash = "sha256-EawyBluubywkUYA0WGkPxVDnn5Ok6p9DiTDwwiiWR5E=";
+        })
+      ];
+      urlPrefixes = [
+        "https://vault.almalinux.org/10.0/BaseOS/x86_64/os"
+        "https://vault.almalinux.org/10.0/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonAlmaPackages ++ [
+        "annobin-plugin-gcc"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    # Oracle provides versioned URLs for baseos (e.g., OL9/7/baseos/base/) but not for appstream.
+    # We can't mix versioned baseos with rolling appstream due to package version dependencies,
+    # so we use rolling URLs for both. These may need hash updates when Oracle releases new versions.
+    oracle9x86_64 = {
+      name = "oracle-9-x86_64";
+      fullName = "Oracle Linux 9 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://yum.oracle.com/repo/OracleLinux/OL9/baseos/latest/x86_64/repodata/bc292d67f73fc606db1872d5ba8804da06a514efe64523247035f0d3b678fb63-primary.xml.gz";
+          hash = "sha256-vCktZ/c/xgbbGHLVuogE2galFO/mRSMkcDXw07Z4+2M=";
+        })
+        (fetchurl {
+          url = "https://yum.oracle.com/repo/OracleLinux/OL9/appstream/x86_64/repodata/6fabacadf7cdf22cbb21dc296f58e6b852d5b8ec9a927e214231477ef90083f9-primary.xml.gz";
+          hash = "sha256-b6usrffN8iy7Idwpb1jmuFLVuOyakn4hQjFHfvkAg/k=";
+        })
+      ];
+      urlPrefixes = [
+        "https://yum.oracle.com/repo/OracleLinux/OL9/baseos/latest/x86_64"
+        "https://yum.oracle.com/repo/OracleLinux/OL9/appstream/x86_64"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonOraclePackages ++ [
+        "annobin"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    # Amazon Linux 2023 uses GUID-based URLs that don't allow directory listing.
+    # To update: The GUID corresponds to a specific AL2023 release version. You can find the
+    # current GUID by either:
+    #   1. Running an AL2023 container: `docker run -it amazonlinux:2023 dnf repolist -v`
+    #      and extracting the GUID from the Repo-baseurl field
+    #   2. Checking https://github.com/docker-library/repo-info/blob/master/repos/amazonlinux/local/latest.md
+    #      which tracks the repository URLs from the official Docker image
+    # Release notes: https://docs.aws.amazon.com/linux/al2023/release-notes/relnotes.html
+    amazon2023x86_64 = {
+      name = "amazon-2023-x86_64";
+      fullName = "Amazon Linux 2023 (x86_64)";
+      packagesList = fetchurl {
+        url = "https://cdn.amazonlinux.com/al2023/core/guids/6fa961924efb4835a7e8de43c89726dca28a5cf5906f891262d8f78a31ea3aaf/x86_64/repodata/primary.xml.gz";
+        hash = "sha256-Ezdsc8a2aOIbyXvQ/nyanWe1fl089VgtfegaPcu2oo4=";
+      };
+      urlPrefix = "https://cdn.amazonlinux.com/al2023/core/guids/6fa961924efb4835a7e8de43c89726dca28a5cf5906f891262d8f78a31ea3aaf/x86_64";
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonAmazonPackages ++ [
+        "annobin-plugin-gcc"
+      ];
+      unifiedSystemDir = true;
+    };
+
+  };

  # The set of supported Dpkg-based distributions.

  debDistros = {
+    # Ubuntu's snapshot service returns the same data for 22.04 regardless of the timestamp in the
+    # URL. The hashes don't change between mirror://ubuntu and snapshot.ubuntu.com, so this is fine.
    ubuntu2204i386 = {
      name = "ubuntu-22.04-jammy-i386";
      fullName = "Ubuntu 22.04 Jammy (i386)";
      packagesLists = [
        (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/main/binary-i386/Packages.xz";
-          sha256 = "sha256-iZBmwT0ep4v+V3sayybbOgZBOFFZwPGpOKtmuLMMVPQ=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/main/binary-i386/Packages.xz";
+          hash = "sha256-iZBmwT0ep4v+V3sayybbOgZBOFFZwPGpOKtmuLMMVPQ=";
        })
        (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/universe/binary-i386/Packages.xz";
-          sha256 = "sha256-DO2LdpZ9rDDBhWj2gvDWd0TJJVZHxKsYTKTi6GXjm1E=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/universe/binary-i386/Packages.xz";
+          hash = "sha256-DO2LdpZ9rDDBhWj2gvDWd0TJJVZHxKsYTKTi6GXjm1E=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/main/binary-i386/Packages.xz";
+          hash = "sha256-g95BtOoMxacZEHMBbcMes4a1P9HKf/QGOMOPr+OKayo=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/universe/binary-i386/Packages.xz";
+          hash = "sha256-VbazaDDJKSUyQchGmw5f+FYAr4PIXWZJSBF0WVC5j+0=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/main/binary-i386/Packages.xz";
+          hash = "sha256-SkP4PqjUAbEMtktR5WQm/3jQl9O0T2VOVTP9QIYIVkQ=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/universe/binary-i386/Packages.xz";
+          hash = "sha256-citjk8LAGSRlXgOXgf3oe9vBCUC6/DJGhRJl/3ppN9c=";
        })
      ];
-      urlPrefix = "mirror://ubuntu";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z";
      packages = commonDebPackages ++ [
        "diffutils"
        "libc-bin"
@@ -1020,15 +1270,31 @@ rec {
      fullName = "Ubuntu 22.04 Jammy (amd64)";
      packagesLists = [
        (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/main/binary-amd64/Packages.xz";
-          sha256 = "sha256-N8tX8VVMv6ccWinun/7hipqMF4K7BWjgh0t/9M6PnBE=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/main/binary-amd64/Packages.xz";
+          hash = "sha256-N8tX8VVMv6ccWinun/7hipqMF4K7BWjgh0t/9M6PnBE=";
        })
        (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/universe/binary-amd64/Packages.xz";
-          sha256 = "sha256-0pyyTJP+xfQyVXBrzn60bUd5lSA52MaKwbsUpvNlXOI=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/universe/binary-amd64/Packages.xz";
+          hash = "sha256-0pyyTJP+xfQyVXBrzn60bUd5lSA52MaKwbsUpvNlXOI=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/main/binary-amd64/Packages.xz";
+          hash = "sha256-I57YuLZ458RljXfp1xFxqQLGNJh9uu8kQC0hc88XZro=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/universe/binary-amd64/Packages.xz";
+          hash = "sha256-ZXobWMi7tkakZ89GoyKpiRhRxMRXud0DOerSfzz5CPE=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/main/binary-amd64/Packages.xz";
+          hash = "sha256-cifTPY1iyckkaLd7dp+VPRlF0viWKrWXhM8HVWaMuUw=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/universe/binary-amd64/Packages.xz";
+          hash = "sha256-LTSOGbzkv0KrF2JM6oVT1Ml2KQkySXMbKNMBb9AyfQM=";
        })
      ];
-      urlPrefix = "mirror://ubuntu";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z";
      packages = commonDebPackages ++ [
        "diffutils"
        "libc-bin"
@@ -1040,15 +1306,31 @@ rec {
      fullName = "Ubuntu 24.04 Noble (amd64)";
      packagesLists = [
        (fetchurl {
-          url = "mirror://ubuntu/dists/noble/main/binary-amd64/Packages.xz";
-          sha256 = "sha256-KmoZnhAxpcJ5yzRmRtWUmT81scA91KgqqgMjmA3ZJFE=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble/main/binary-amd64/Packages.xz";
+          hash = "sha256-KmoZnhAxpcJ5yzRmRtWUmT81scA91KgqqgMjmA3ZJFE=";
        })
        (fetchurl {
-          url = "mirror://ubuntu/dists/noble/universe/binary-amd64/Packages.xz";
-          sha256 = "sha256-upBX+huRQ4zIodJoCNAMhTif4QHQwUliVN+XI2QFWZo=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble/universe/binary-amd64/Packages.xz";
+          hash = "sha256-upBX+huRQ4zIodJoCNAMhTif4QHQwUliVN+XI2QFWZo=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-updates/main/binary-amd64/Packages.xz";
+          hash = "sha256-leBJ29a2C2qdIPdjSSuwkHKUSq8GEC9L0DgdxHWZ55s=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-updates/universe/binary-amd64/Packages.xz";
+          hash = "sha256-CWYA0A4ytptWdClW3ACdIH4hKscblDh5OgxExP4VdJA=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-security/main/binary-amd64/Packages.xz";
+          hash = "sha256-TYs8ugCYqzOleH2OebdrpB8E68PfxB+7sRb+PlfANEo=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-security/universe/binary-amd64/Packages.xz";
+          hash = "sha256-bK9R8CUjLQ1V4GP7/KqZooSnKHF5+T5SuBs0butC82M=";
        })
      ];
-      urlPrefix = "mirror://ubuntu";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z";
      packages = commonDebPackages ++ [
        "diffutils"
        "libc-bin"
@@ -1056,137 +1338,147 @@ rec {
    };

    debian11i386 = {
-      name = "debian-11.8-bullseye-i386";
-      fullName = "Debian 11.8 Bullseye (i386)";
+      name = "debian-11.11-bullseye-i386";
+      fullName = "Debian 11.11 Bullseye (i386)";
      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bullseye/main/binary-i386/Packages.xz";
-        hash = "sha256-0bKSLLPhEC7FB5D1NA2jaQP0wTe/Qp1ddiA/NDVjRaI=";
+        url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bullseye/main/binary-i386/Packages.xz";
+        hash = "sha256-kUg1VBUO6co/5bKloxncta49191oCeF05Hm399+UuDA=";
      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
      packages = commonDebianPackages;
    };

    debian11x86_64 = {
-      name = "debian-11.8-bullseye-amd64";
-      fullName = "Debian 11.8 Bullseye (amd64)";
+      name = "debian-11.11-bullseye-amd64";
+      fullName = "Debian 11.11 Bullseye (amd64)";
      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bullseye/main/binary-amd64/Packages.xz";
-        hash = "sha256-CYPsGgQgJZkh3JmbcAQkYDWP193qrkOADOgrMETZIeo=";
+        url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bullseye/main/binary-amd64/Packages.xz";
+        hash = "sha256-HDQFREKX6thkcRwY5kvOSBDbY7SDQKL52BGC2fI1rXE=";
      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
      packages = commonDebianPackages;
    };

    debian12i386 = {
-      name = "debian-12.2-bookworm-i386";
-      fullName = "Debian 12.2 Bookworm (i386)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bookworm/main/binary-i386/Packages.xz";
-        hash = "sha256-OeN9Q2HFM3GsPNhOa4VhM7qpwT66yUNwC+6Z8SbGEeQ=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      name = "debian-12.12-bookworm-i386";
+      fullName = "Debian 12.12 Bookworm (i386)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm/main/binary-i386/Packages.xz";
+          hash = "sha256-nIijsNoHUYkrL6eiwN4FCLHnJy/Bv/RMvnbMIHvieVI=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm-backports/main/binary-i386/Packages.xz";
+          hash = "sha256-/ja7+DNIKc2ZUIXiocTjLbaD2EPsfeyZcd5ndEMapp4=";
+        })
+      ];
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
      packages = commonDebianPackages;
    };

    debian12x86_64 = {
-      name = "debian-12.2-bookworm-amd64";
-      fullName = "Debian 12.2 Bookworm (amd64)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bookworm/main/binary-amd64/Packages.xz";
-        hash = "sha256-SZDElRfe9BlBwDlajQB79Qdn08rv8whYoQDeVCveKVs=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      name = "debian-12.12-bookworm-amd64";
+      fullName = "Debian 12.12 Bookworm (amd64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm/main/binary-amd64/Packages.xz";
+          hash = "sha256-PfjQeu3tXmXZhH7foSD6WyFrvY4PfwSN/v5pBeShIBE=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm-backports/main/binary-amd64/Packages.xz";
+          hash = "sha256-S3NSvw1kX2zxzMh+WYhY58VUR7iLrTEIuXwwSK6itIs=";
+        })
+      ];
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
      packages = commonDebianPackages;
    };

    debian13i386 = {
-      name = "debian-13.0-trixie-i386";
-      fullName = "Debian 13.0 Trixie (i386)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20250819T202603Z/dists/trixie/main/binary-i386/Packages.xz";
-        hash = "sha256-fXjhaG1Y+kn6iMEtqVZLwYN7lZ0cEQKVfMS3hSHJipY=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20250819T202603Z";
+      name = "debian-13.2-trixie-i386";
+      fullName = "Debian 13.2 Trixie (i386)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie/main/binary-i386/Packages.xz";
+          hash = "sha256-9zozvFZoWiv3wNe9rb+kPwSOgc5G5f4zmNpdoet5A78=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie-backports/main/binary-i386/Packages.xz";
+          hash = "sha256-hEBAQ73Jnv8zp9YvNXWLEObyrSlQNBNBj/XoofJL7eI=";
+        })
+      ];
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
      packages = commonDebianPackages;
    };

    debian13x86_64 = {
-      name = "debian-13.0-trixie-amd64";
-      fullName = "Debian 13.0 Trixie (amd64)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20250819T202603Z/dists/trixie/main/binary-amd64/Packages.xz";
-        hash = "sha256-15cDoCcTv3m5fiZqP1hqWWnSG1BVUZSrm5YszTSKQs4=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20250819T202603Z";
+      name = "debian-13.2-trixie-amd64";
+      fullName = "Debian 13.2 Trixie (amd64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie/main/binary-amd64/Packages.xz";
+          hash = "sha256-g7f+tKljUXAC4gxJfzSC8+j0GbiwRZjonv25tYuvxtU=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie-backports/main/binary-amd64/Packages.xz";
+          hash = "sha256-9OoR36FsyK7MQMLHLFMRJ9O11WKq9JCfGwnprpztxNw=";
+        })
+      ];
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
      packages = commonDebianPackages;
    };
  };

-  # Common packages for Fedora images.
-  commonFedoraPackages = [
+  # Base packages for all RHEL-family distros (Fedora, Rocky, Alma, etc.)
+  baseRHELFamilyPackages = [
    "autoconf"
    "automake"
    "basesystem"
    "bzip2"
    "curl"
    "diffutils"
+    "findutils"
+    "gawk"
+    "gcc-c++"
+    "glibc-gconv-extra"
+    "gzip"
+    "make"
+    "patch"
+    "perl"
+    "rpm"
+    "rpm-build"
+    "tar"
+    "unzip"
+  ];
+
+  commonFedoraPackages = baseRHELFamilyPackages ++ [
+    "annobin-plugin-gcc"
    "fedora-release"
-    "findutils"
-    "gawk"
-    "gcc-c++"
-    "gzip"
-    "make"
-    "patch"
-    "perl"
+    "gcc-plugin-annobin"
    "pkgconf-pkg-config"
-    "rpm"
-    "rpm-build"
-    "tar"
-    "unzip"
  ];

-  commonCentOSPackages = [
-    "autoconf"
-    "automake"
-    "basesystem"
-    "bzip2"
-    "curl"
-    "diffutils"
-    "centos-release"
-    "findutils"
-    "gawk"
-    "gcc-c++"
-    "gzip"
-    "make"
-    "patch"
-    "perl"
-    "pkgconfig"
-    "rpm"
-    "rpm-build"
-    "tar"
-    "unzip"
+  commonRockyPackages = baseRHELFamilyPackages ++ [
+    "gcc-plugin-annobin"
+    "pkgconf"
+    "rocky-release"
  ];

-  commonRHELPackages = [
-    "autoconf"
-    "automake"
-    "basesystem"
-    "bzip2"
-    "curl"
-    "diffutils"
-    "findutils"
-    "gawk"
-    "gcc-c++"
-    "gzip"
-    "make"
-    "patch"
-    "perl"
-    "pkgconfig"
-    "procps-ng"
-    "rpm"
-    "rpm-build"
-    "tar"
-    "unzip"
+  commonAlmaPackages = baseRHELFamilyPackages ++ [
+    "almalinux-release"
+    "gcc-plugin-annobin"
+    "pkgconf"
+  ];
+
+  commonOraclePackages = baseRHELFamilyPackages ++ [
+    "gcc-plugin-annobin"
+    "oraclelinux-release"
+    "pkgconf"
+  ];
+
+  commonAmazonPackages = baseRHELFamilyPackages ++ [
+    "gcc-plugin-annobin"
+    "pkgconf"
+    "system-release"
  ];

  # Common packages for openSUSE images.
@@ -1284,5 +1576,39 @@ rec {
    `debDistros' sets.
  */
  diskImages = lib.mapAttrs (name: f: f { }) diskImageFuns;
-
+in
+{
+  inherit
+    buildRPM
+    commonDebPackages
+    commonDebianPackages
+    commonFedoraPackages
+    commonOpenSUSEPackages
+    createEmptyImage
+    debClosureGenerator
+    debDistros
+    defaultCreateRootFS
+    diskImageExtraFuns
+    diskImageFuns
+    diskImages
+    extractFs
+    extractMTDfs
+    fillDiskWithDebs
+    fillDiskWithRPMs
+    hd
+    initrd
+    initrdUtils
+    makeImageFromDebDist
+    makeImageFromRPMDist
+    makeImageTestScript
+    modulesClosure
+    qemu
+    rpmClosureGenerator
+    rpmDistros
+    runInLinuxImage
+    runInLinuxVM
+    stage1Init
+    stage2Init
+    vmRunCommand
+    ;
 }
@@ -1,6 +1,7 @@
 use strict;
 use XML::Simple;
 use List::Util qw(min);
+use URI::Escape;

 my @packagesFiles = ();
 my @urlPrefixes = ();
@@ -156,7 +157,13 @@ sub closePackage {


 foreach my $pkgName (@toplevelPkgs) {
-    closePackage $pkgName;
+    # If the package doesn't exist by name, check if something provides it
+    if (!defined $pkgs{$pkgName} && defined $provides{$pkgName}) {
+        print STDERR "package $pkgName is provided by $provides{$pkgName}\n";
+        closePackage $provides{$pkgName};
+    } else {
+        closePackage $pkgName;
+    }
 }


@@ -168,8 +175,13 @@ print "[\n\n";

 foreach my $pkgName (@needed) {
    my $pkg = $pkgs{$pkgName};
+    # URL-encode each path segment separately to handle special characters like '+'
+    my $href = $pkg->{location}->{href};
+    my @segments = split('/', $href);
+    my @encoded_segments = map { uri_escape($_) } @segments;
+    my $encoded_href = join('/', @encoded_segments);
    print "  (fetchurl {\n";
-    print "    url = $pkg->{urlPrefix}/$pkg->{location}->{href};\n";
+    print "    url = \"$pkg->{urlPrefix}/$encoded_href\";\n";
    if ($pkg->{checksum}->{type} eq "sha") {
        print "    sha1 = \"$pkg->{checksum}->{content}\";\n";
    } elsif ($pkg->{checksum}->{type} eq "sha256") {
@@ -1,14 +1,12 @@
+{
+  hello,
+  patchelf,
+  pcmanfm,
+  stdenv,
+  vmTools,
+}:
 let
-  pkgs = import ../../.. { };
-
-  inherit (pkgs)
-    hello
-    patchelf
-    pcmanfm
-    stdenv
-    ;
-
-  inherit (pkgs.vmTools)
+  inherit (vmTools)
    buildRPM
    diskImages
    makeImageTestScript
@@ -18,12 +16,28 @@ let
 in

 {
-
-  # Run the PatchELF derivation in a VM.
  buildPatchelfInVM = runInLinuxVM patchelf;
+  buildPatchelfInDebian = runInLinuxImage (
+    stdenv.mkDerivation {
+      inherit (patchelf) pname version src;
+
+      diskImage = diskImages.debian13x86_64;
+      diskImageFormat = "qcow2";
+      memSize = 512;
+    }
+  );

  buildHelloInVM = runInLinuxVM hello;
  buildStructuredAttrsHelloInVM = runInLinuxVM (hello.overrideAttrs { __structuredAttrs = true; });
+  buildHelloInFedora = runInLinuxImage (
+    stdenv.mkDerivation {
+      inherit (hello) pname version src;
+
+      diskImage = diskImages.fedora42x86_64;
+      diskImageFormat = "qcow2";
+      memSize = 512;
+    }
+  );

  buildPcmanrmInVM = runInLinuxVM (
    pcmanfm.overrideAttrs (old: {
@@ -32,28 +46,24 @@ in
    })
  );

-  testRPMImage = makeImageTestScript diskImages.fedora27x86_64;
-
-  buildPatchelfRPM = buildRPM {
-    name = "patchelf-rpm";
-    src = patchelf.src;
-    diskImage = diskImages.fedora27x86_64;
-    diskImageFormat = "qcow2";
-  };
-
-  testUbuntuImage = makeImageTestScript diskImages.ubuntu1804i386;
-
-  buildInDebian = runInLinuxImage (
-    stdenv.mkDerivation {
-      name = "deb-compile";
-      src = patchelf.src;
-      diskImage = diskImages.ubuntu1804i386;
-      diskImageFormat = "qcow2";
-      memSize = 512;
-      postHook = ''
-        dpkg-query --list
-      '';
-    }
-  );
+  # RPM-based distros
+  testFedora42Image = makeImageTestScript diskImages.fedora42x86_64;
+  testFedora43Image = makeImageTestScript diskImages.fedora43x86_64;
+  testRocky9Image = makeImageTestScript diskImages.rocky9x86_64;
+  testRocky10Image = makeImageTestScript diskImages.rocky10x86_64;
+  testAlma9Image = makeImageTestScript diskImages.alma9x86_64;
+  testAlma10Image = makeImageTestScript diskImages.alma10x86_64;
+  testOracle9Image = makeImageTestScript diskImages.oracle9x86_64;
+  testAmazon2023Image = makeImageTestScript diskImages.amazon2023x86_64;

+  # Debian-based distros
+  testDebian11i386Image = makeImageTestScript diskImages.debian11i386;
+  testDebian11x86_64Image = makeImageTestScript diskImages.debian11x86_64;
+  testDebian12i386Image = makeImageTestScript diskImages.debian12i386;
+  testDebian12x86_64Image = makeImageTestScript diskImages.debian12x86_64;
+  testDebian13i386Image = makeImageTestScript diskImages.debian13i386;
+  testDebian13x86_64Image = makeImageTestScript diskImages.debian13x86_64;
+  testUbuntu2204i386Image = makeImageTestScript diskImages.ubuntu2204i386;
+  testUbuntu2204x86_64Image = makeImageTestScript diskImages.ubuntu2204x86_64;
+  testUbuntu2404x86_64Image = makeImageTestScript diskImages.ubuntu2404x86_64;
 }
@@ -9,15 +9,15 @@

 buildGoModule (finalAttrs: {
  pname = "adguardhome";
-  version = "0.107.69";
+  version = "0.107.71";
  src = fetchFromGitHub {
    owner = "AdguardTeam";
    repo = "AdGuardHome";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eUMssp4rYmkreYdaSDlYP0bQsZgsrrN9e65UF7NseN8=";
+    hash = "sha256-uyDmS/C1nd0DEHy91tMw/2W5Rih/0j59yxGCwTjFjPc=";
  };

-  vendorHash = "sha256-qee3ifDDR1U23VZAu0gj1CPPaDrSQfwfrKte1OUZPlE=";
+  vendorHash = "sha256-KSDvI7SljFUZSUFytT1U76HzQydv3rNsOmDMKCXDl6M=";

  dashboard = buildNpmPackage {
    inherit (finalAttrs) src version;
@@ -45,7 +45,7 @@ buildGoModule (finalAttrs: {

  passthru = {
    updateScript = ./update.sh;
-    schema_version = 31;
+    schema_version = 32;
    tests.adguardhome = nixosTests.adguardhome;
    tests.version = testers.testVersion {
      package = finalAttrs.finalPackage;
@@ -7,11 +7,11 @@

 let
  pname = "altair";
-  version = "8.3.0";
+  version = "8.5.0";

  src = fetchurl {
    url = "https://github.com/imolorhe/altair/releases/download/v${version}/altair_${version}_x86_64_linux.AppImage";
-    sha256 = "sha256-uLqtrF5WWJ5+6bN/h4u/vdvTlbQtZID1osujfuJad4U=";
+    sha256 = "sha256-ImcnV+Z1J+6wGs3HmlCpXmLb/BbyEcunY+IZ2cbD8Ns=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
@@ -10,17 +10,17 @@
 }:
 buildGoModule rec {
  pname = "aws-vault";
-  version = "7.8.6";
+  version = "7.8.7";

  src = fetchFromGitHub {
    owner = "ByteNess";
    repo = "aws-vault";
    rev = "v${version}";
-    hash = "sha256-nULl68DMTqrVXlPmJlp7M3EZ+MiGR9FsWKIRaa2i91I=";
+    hash = "sha256-q4I/sCFo8svf+XL+Eln5TWLvj1ggaRjUplSgV6M0f9s=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-tuOrD2NjcjmjosI1bW2F7xEwGLNOMDNxFpEfODF9FHs=";
+  vendorHash = "sha256-tsIyY+L3Bvv/3uvRVkCGK4cAZXQyZSa0mUPDg8Aqml8=";

  nativeBuildInputs = [
    installShellFiles
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "biome";
-  version = "2.3.9";
+  version = "2.3.11";

  src = fetchFromGitHub {
    owner = "biomejs";
    repo = "biome";
    rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-2eW60IoEeh3pnnsnZLdS6paw0f6vf+2LBM95WyOKDwc=";
+    hash = "sha256-AWVFrzIDg+mVnUYTMLr10o8IOSvewVhVMcYd2wvT5y0=";
  };

-  cargoHash = "sha256-WSl/OObiOXx4MJcnGQtvGVfM2i5k8lLIQoPy9s+GT/U=";
+  cargoHash = "sha256-N2TauXj1pRrYnVD0qPtruy7qwdWBGJaa47++AaY8TMQ=";

  nativeBuildInputs = [ pkg-config ];

@@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "dua";
-  version = "2.32.2";
+  version = "2.33.0";

  src = fetchFromGitHub {
    owner = "Byron";
    repo = "dua-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MB5uePy32jTvOtkQKcP9peFPqwR68E+NZ7UGMuLx8Eo=";
+    hash = "sha256-3Mlhz+vYeDSoVLuBFAtgJxrECwUchSWIusrLKqhxU30=";
    # Remove unicode file names which leads to different checksums on HFS+
    # vs. other filesystems because of unicode normalisation.
    postFetch = ''
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    '';
  };

-  cargoHash = "sha256-6H0x6I3nkCezu4/Hguv0XTdl+3QiyPL8Ue1rqTQU7VA=";
+  cargoHash = "sha256-85I+rWomp+2G1DLbwowHDSrRm6dS4b99Ia24ffY7Fnk=";

  checkFlags = [
    # Skip interactive tests
@@ -163,6 +163,8 @@ stdenv.mkDerivation (finalAttrs: {
    FISH_BUILD_VERSION = finalAttrs.version;
    # Skip tests that are known to be flaky in CI
    CI = 1;
+    # really skip them all https://github.com/fish-shell/fish-shell/issues/12253#issuecomment-3707996020
+    FISH_CI_SAN = 1;
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
@@ -3,6 +3,7 @@
  stdenv,
  buildNpmPackage,
  fetchFromGitHub,
+  nodejs_22,
  cacert,
 }:

@@ -17,6 +18,10 @@ buildNpmPackage rec {
    hash = "sha256-zERwrvioPwGm/351kYuK9S3uOrrzs/6OFPRdNSSr7Tc=";
  };

+  # Building against nodejs-24 is not yet supported by upstream.
+  # https://github.com/microsoft/inshellisense/issues/369
+  nodejs = nodejs_22;
+
  npmDepsHash = "sha256-iD5SvkVbrHh0Hx44y6VtNerwBA8K7vSe/yfvhgndMEw=";

  # Needed for dependency `@homebridge/node-pty-prebuilt-multiarch`
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
  pname = "limine";
-  version = "10.6.0";
+  version = "10.6.1";

  # We don't use the Git source but the release tarball, as the source has a
  # `./bootstrap` script performing network access to download resources.
  # Packaging that in Nix is very cumbersome.
  src = fetchurl {
    url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-rNLPfDHYVGOzO7pnv7w+l8kevmKPFFJ3O5MtPN6YlG4=";
+    hash = "sha256-juCivgLVpGY7hiHLMhZwhTTcIPA2CfYyKHTp8Oy33mI=";
  };

  enableParallelBuilding = true;
@@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "lms";
-  version = "3.73.0";
+  version = "3.74.0";

  src = fetchFromGitHub {
    owner = "epoupon";
    repo = "lms";
    rev = "v${version}";
-    hash = "sha256-9m1YvuYuiiEXAX8HFt61VGZN/ThYXdBcwOSeL05mwOU=";
+    hash = "sha256-D1Sg6XzZ8t/dFKrVh7k+KGLg2r6LeLGJk4FweVb4L1A=";
  };

  strictDeps = true;
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lurk";
-  version = "0.3.10";
+  version = "0.3.11";

  src = fetchFromGitHub {
    owner = "jakwai01";
    repo = "lurk";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5riwosaT7QjRFnIFRAcyLul7i1g8OpHyUuuJNOROTF0=";
+    hash = "sha256-Sng+mMMKDuI1aSgusJDRFMT5iKNUlp9arp9ruRn0bb0=";
  };

-  cargoHash = "sha256-CDrqcKNhQYbtDaasyCQ6VPGdIrW34VBKPDpbFeommAc=";
+  cargoHash = "sha256-Cmlhhda35FmNg/OvfMRPHBLPRXF5bs0ebBYT7KfierA=";

  postPatch = ''
    substituteInPlace src/lib.rs \
@@ -12,6 +12,8 @@
  libvorbis,
  gettext,
  physfs,
+  iconv,
+  makeBinaryWrapper,
 }:

 stdenv.mkDerivation rec {
@@ -31,6 +33,10 @@ stdenv.mkDerivation rec {
    })
  ];

+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    iconv
+    makeBinaryWrapper
+  ];
  buildInputs = [
    libpng
    SDL2
@@ -38,9 +44,11 @@ stdenv.mkDerivation rec {
    libjpeg
    SDL2_ttf
    libvorbis
-    libX11
    gettext
    physfs
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    libX11
  ];

  dontPatchELF = true;
@@ -48,7 +56,21 @@ stdenv.mkDerivation rec {
  postPatch = ''
    sed -i -e 's@\./data@'$out/share/neverball/data@ share/base_config.h Makefile
    sed -i -e 's@\./locale@'$out/share/neverball/locale@ share/base_config.h Makefile
-    sed -i -e 's@-lvorbisfile@-lvorbisfile -lX11 -lgcc_s@' Makefile
+    sed -i -e 's@-lvorbisfile@-lvorbisfile${
+      lib.optionalString (!stdenv.hostPlatform.isDarwin) " -lX11"
+      + lib.optionalString stdenv.cc.isGNU " -lgcc_s"
+    }@' Makefile
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    for game in ball putt; do
+      pushd macosx/xcode/''${game}_items/
+      substituteInPlace Info.plist --replace-fail '1.5.3' "$version"
+      iconv -f UTF-16LE -t UTF-8 English.lproj/InfoPlist.strings > English.lproj/InfoPlist.strings.tmp
+      substituteInPlace English.lproj/InfoPlist.strings.tmp --replace-fail '1.5.3' "$version" --replace-fail '2002-2009' '2002-2014'
+      iconv -f UTF-8 -t UTF-16LE English.lproj/InfoPlist.strings.tmp > English.lproj/InfoPlist.strings
+      rm English.lproj/InfoPlist.strings.tmp
+      popd
+    done
  '';

  # The map generation code requires a writable HOME
@@ -57,8 +79,23 @@ stdenv.mkDerivation rec {
  installPhase = ''
    mkdir -p $out/bin $out/share/neverball
    cp -R data locale $out/share/neverball
-    cp neverball $out/bin
-    cp neverputt $out/bin
+    ${
+      if stdenv.hostPlatform.isDarwin then
+        ''
+          mkdir -p $out/Applications/Never{ball,putt}.app/Contents/{MacOS,Resources}
+          for game in ball putt; do
+            cp never$game $out/Applications/Never$game.app/Contents/MacOS/Never$game
+            makeWrapper $out/Applications/Never$game.app/Contents/MacOS/Never$game $out/bin/never$game
+            cp macosx/xcode/''${game}_items/Info.plist $out/Applications/Never$game.app/Contents/Info.plist
+            cp -r macosx/icons/never$game.icns macosx/xcode/''${game}_items/English.lproj $out/Applications/Never$game.app/Contents/Resources/
+          done
+        ''
+      else
+        ''
+          cp neverball $out/bin
+          cp neverputt $out/bin
+        ''
+    }
    cp mapc $out/bin
  '';

@@ -73,7 +110,7 @@ stdenv.mkDerivation rec {
      mit
      gpl3Only
    ];
-    maintainers = [ ];
-    platforms = with lib.platforms; linux;
+    maintainers = with lib.maintainers; [ Rhys-T ];
+    platforms = with lib.platforms; linux ++ darwin;
  };
 }
@@ -12,14 +12,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "newsraft";
-  version = "0.34";
+  version = "0.35";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "newsraft";
    repo = "newsraft";
    rev = "newsraft-${finalAttrs.version}";
-    hash = "sha256-o02NAIkT98GJAcAlj04L6sVYcx/x+JOefxkK8llEqYM=";
+    hash = "sha256-c1IlPs+GxwDeUCpyQ6oy9iLC3YNLCJpjkj1gnwY7lxA=";
  };

  nativeBuildInputs = [ pkg-config ];
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "nezha-agent";
-  version = "1.14.1";
+  version = "1.14.3";

  src = fetchFromGitHub {
    owner = "nezhahq";
    repo = "agent";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1p/YEAIa0+9FC+TuNHdv7WSXzDJBS7zgrocNJZ0Tuk0=";
+    hash = "sha256-/DDk57rUXiACQaXl4KTMiOFFMopHtYvRI4vnPORseFE=";
  };

  vendorHash = "sha256-A0oVUyCflbEY3vBbJwy7cF2m1x9vHCY2jAOsrm3659E=";
@@ -9,16 +9,17 @@
  nix-update-script,
  ripgrep,
  testers,
+  installShellFiles,
  writableTmpDirAsHomeHook,
 }:
 let
  pname = "opencode";
-  version = "1.0.224";
+  version = "1.1.3";
  src = fetchFromGitHub {
-    owner = "sst";
+    owner = "anomalyco";
    repo = "opencode";
    tag = "v${version}";
-    hash = "sha256-4ozluoXTovh1wpWVzxCN4jUO7cMxZER/0KMOBsJFO64=";
+    hash = "sha256-uNeje6WZ/FJVOtxdTdWXbWhPl7BwMws+7/Iz2Hz/stw=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@@ -70,7 +71,7 @@ let
    # NOTE: Required else we get errors that our fixed-output derivation references store paths
    dontFixup = true;

-    outputHash = "sha256-+HEd3I11VqejTi7cikbTL5+DmNGyvUC4Cm4ysfujwes=";
+    outputHash = "sha256-LJ7xgKQP0ows76P8QVflS6SGGowVBYVvarkmCVkfe60=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
@@ -85,8 +86,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    bun
+    installShellFiles
    makeBinaryWrapper
    models-dev
+    writableTmpDirAsHomeHook
  ];

  patches = [
@@ -197,6 +200,17 @@ stdenvNoCC.mkDerivation (finalAttrs: {
          $out/lib/opencode/node_modules/@opentui/$pkgName
      fi
    done
+
+    ${lib.optionalString
+      (
+        (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform)
+        && (stdenvNoCC.hostPlatform.system != "x86_64-darwin")
+      )
+      ''
+        installShellCompletion --cmd opencode \
+          --bash <($out/bin/opencode completion)
+      ''
+    }
  '';

  passthru = {
@@ -221,7 +235,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      It combines a TypeScript/JavaScript core with a Go-based TUI
      to provide an interactive AI coding experience.
    '';
-    homepage = "https://github.com/sst/opencode";
+    homepage = "https://github.com/anomalyco/opencode";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ delafthi ];
    sourceProvenance = with lib.sourceTypes; [ fromSource ];
@@ -10,14 +10,14 @@
 # Updating this package will force an update for prisma. The
 # version of prisma-engines and prisma must be the same for them to
 # function correctly.
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "prisma-engines_6";
  version = "6.19.1";

  src = fetchFromGitHub {
    owner = "prisma";
    repo = "prisma-engines";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-z3GdnrLEMJIGPKXXbz2wrbiGpuNlgYxqg3iYINYTnPI=";
  };

@@ -70,7 +70,7 @@ rustPlatform.buildRustPackage rec {
      aqrln
    ];
  };
-}
+})

 ### Troubleshooting
 # Here's an example application using Prisma with Nix: https://github.com/pimeys/nix-prisma-example
@@ -9,18 +9,18 @@
 # Updating this package will force an update for prisma. The
 # version of prisma-engines and prisma must be the same for them to
 # function correctly.
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "prisma-engines_7";
-  version = "7.0.1";
+  version = "7.2.0";

  src = fetchFromGitHub {
    owner = "prisma";
    repo = "prisma-engines";
-    tag = version;
-    hash = "sha256-+8k+M2+WySR2CeywYlhU/jd3av/4UeUoEOlO/qHUk5o=";
+    tag = finalAttrs.version;
+    hash = "sha256-1CwpUtNuqxGNjBmmmo/Aet8XrmnCQfDToI7vZaNupDI=";
  };

-  cargoHash = "sha256-n83hJfSlvuaoBb3w9Rk8+q2emjGCoPDHhFdoVzhf4sM=";
+  cargoHash = "sha256-U5d/HkuWnD/XSrAJr5AYh+WPVGDOcK/e4sC0udPZoyU=";

  # Use system openssl.
  OPENSSL_NO_VENDOR = 1;
@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage rec {
      aqrln
    ];
  };
-}
+})

 ### Troubleshooting
 # Here's an example application using Prisma with Nix: https://github.com/pimeys/nix-prisma-example
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "prisma_7";
-  version = "7.0.1";
+  version = "7.2.0";

  src = fetchFromGitHub {
    owner = "prisma";
    repo = "prisma";
    tag = finalAttrs.version;
-    hash = "sha256-bmmthEFMBMJAracWUCU/6Nyic05JglP5t1VAWPVKFnU=";
+    hash = "sha256-oDfb/RwSa63ErWHF86q5xPPUUsRUV2DwNHARTV5gxyk=";
  };

  nativeBuildInputs = [
@@ -36,8 +36,8 @@ stdenv.mkDerivation (finalAttrs: {
  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
-    fetcherVersion = 1;
-    hash = "sha256-sJmlMF8nay4/3LTHEWzBWaS8Xq91JRZlzKBfeMnJEMM=";
+    fetcherVersion = 3;
+    hash = "sha256-HZsrHYUh4nxUgwVbmJ+fV4/OZvEWDKkD4CT8hIt1SRY=";
  };

  patchPhase = ''
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "raffi";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "chmouel";
    repo = "raffi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-k0NJEv76f33yd+mtCJ7bxzaT3UAn0TOaLC/HlzEXUyo=";
+    hash = "sha256-CjgLxGsx0Ai5kB/XK0ylk8j0rd4ZomZwDHaQAGcYAQw=";
  };

-  cargoHash = "sha256-udXVIV6qDmpLR2QNF+/h69WNGbe7QRDD5YWQ3Sl5Ol0=";
+  cargoHash = "sha256-etWO77Um+SCyQU5at55F7V2ljw1cXJsTbex61gN/uUk=";

  nativeBuildInputs = [
    makeBinaryWrapper
@@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "sherpa";
-  version = "3.0.2";
+  version = "3.0.3";

  src = fetchFromGitLab {
    owner = "sherpa-team";
    repo = "sherpa";
    tag = "v${version}";
-    hash = "sha256-VlC5MnbrXp2fdO2EtBjtw45Gx6PhF/hcLy0ajlKp10E=";
+    hash = "sha256-bh5C0BYbuAkbPrp27P0oD0yoxd53ViRtmpUKfN7kZ90=";
  };

  postPatch = lib.optionalString (stdenv.hostPlatform.libc == "glibc") ''
@@ -21,13 +21,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "slade";
-  version = "3.2.9";
+  version = "3.2.10";

  src = fetchFromGitHub {
    owner = "sirjuddington";
    repo = "SLADE";
    tag = finalAttrs.version;
-    hash = "sha256-N+rCtrfvVJnkfj8kU4ahzF6o7lp1VWJbVmkvaZoxBv8=";
+    hash = "sha256-r1tfp0NomZEETY41wXIDvZbgCbBFEh4oW0qcnr/t/9E=";
  };

  nativeBuildInputs = [
@@ -27,7 +27,7 @@
  libXpm,
  libarchive,
  libass,
-  libbluray,
+  libbluray-full,
  libcaca,
  libcddb,
  libdc1394,
@@ -153,7 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
    libSM
    libarchive
    libass
-    libbluray
+    libbluray-full
    libcaca
    libcddb
    libdc1394
@@ -48,7 +48,7 @@
  withHtml ? true,
  xpra-html5,
  udevCheckHook,
-}@args:
+}:

 let
  inherit (python3.pkgs) cython buildPythonApplication;
@@ -86,14 +86,15 @@ let
    mkdir -p $out/include $out/lib/pkgconfig
    substituteAll ${cudaPackages.libnvjpeg.dev}/share/pkgconfig/nvjpeg.pc $out/lib/pkgconfig/nvjpeg.pc
  '';
+  effectiveBuildPythonApplication = buildPythonApplication.override {
+    stdenv = if withNvenc then cudaPackages.backendStdenv else stdenv;
+  };
 in
-buildPythonApplication rec {
+effectiveBuildPythonApplication rec {
  pname = "xpra";
  version = "6.3.6";
  format = "setuptools";

-  stdenv = if withNvenc then cudaPackages.backendStdenv else args.stdenv;
-
  src = fetchFromGitHub {
    owner = "Xpra-org";
    repo = "xpra";
@@ -327,22 +327,19 @@ stdenv.mkDerivation (
    };
  }
  // lib.optionalAttrs crossCompiling rec {
-    crossVersion = "1.6.2";
+    crossVersion = "1.6.4";

    perl-cross-src = fetchFromGitHub {
      name = "perl-cross-${crossVersion}";
      owner = "arsv";
      repo = "perl-cross";
      rev = crossVersion;
-      hash = "sha256-mG9ny+eXGBL4K/rXqEUPSbar+4Mq4IaQrGRFIHIyAAw=";
+      hash = "sha256-Qcysy7f887XHlq23iE5U92PhxDhpgaluITZBSdcc9Ck=";
    };
    patches = commonPatches ++ [
      # fixes build failure due to missing d_fdopendir/HAS_FDOPENDIR configure option
      # https://github.com/arsv/perl-cross/pull/159
      ./cross-fdopendir.patch
-      # Add patchset for 5.42.0 - Can hopefully be removed once perl-cross is updated
-      # https://github.com/arsv/perl-cross/pull/164
-      ./perl-5.42.0-cross.patch
    ];

    depsBuildBuild = [
@@ -1,186 +0,0 @@
-From b47ef629459076a5ccb3d0caf83ccfbb8ba0571b Mon Sep 17 00:00:00 2001
-From: Marcus Ramberg <marcus@means.no>
-Date: Wed, 3 Sep 2025 10:35:58 +0200
-Subject: [PATCH] patches for perl-5.42.0
-
---
- cnf/diffs/perl5-5.42.0/constant.patch       |  1 +
- cnf/diffs/perl5-5.42.0/dynaloader.patch     |  1 +
- cnf/diffs/perl5-5.42.0/findext.patch        |  1 +
- cnf/diffs/perl5-5.42.0/installscripts.patch |  1 +
- cnf/diffs/perl5-5.42.0/liblist.patch        | 80 +++++++++++++++++++++
- cnf/diffs/perl5-5.42.0/makemaker.patch      |  1 +
- cnf/diffs/perl5-5.42.0/posix-makefile.patch |  1 +
- cnf/diffs/perl5-5.42.0/test-checkcase.patch |  1 +
- cnf/diffs/perl5-5.42.0/test-makemaker.patch |  1 +
- cnf/diffs/perl5-5.42.0/xconfig.patch        |  1 +
- 10 files changed, 89 insertions(+)
- create mode 120000 cnf/diffs/perl5-5.42.0/constant.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/dynaloader.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/findext.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/installscripts.patch
- create mode 100644 cnf/diffs/perl5-5.42.0/liblist.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/makemaker.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/posix-makefile.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/test-checkcase.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/test-makemaker.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/xconfig.patch
-
-diff --git a/cnf/diffs/perl5-5.42.0/constant.patch b/cnf/diffs/perl5-5.42.0/constant.patch
-new file mode 120000
-index 0000000..065e198
--- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/constant.patch
-@@ -0,0 +1 @@
-+../perl5-5.22.3/constant.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/dynaloader.patch b/cnf/diffs/perl5-5.42.0/dynaloader.patch
-new file mode 120000
-index 0000000..ffb73eb
--- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/dynaloader.patch
-@@ -0,0 +1 @@
-+../perl5-5.22.3/dynaloader.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/findext.patch b/cnf/diffs/perl5-5.42.0/findext.patch
-new file mode 120000
-index 0000000..9efbe5b
--- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/findext.patch
-@@ -0,0 +1 @@
-+../perl5-5.22.3/findext.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/installscripts.patch b/cnf/diffs/perl5-5.42.0/installscripts.patch
-new file mode 120000
-index 0000000..1c05e0f
--- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/installscripts.patch
-@@ -0,0 +1 @@
-+../perl5-5.36.0/installscripts.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/liblist.patch b/cnf/diffs/perl5-5.42.0/liblist.patch
-new file mode 100644
-index 0000000..5e6331f
--- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/liblist.patch
-@@ -0,0 +1,80 @@
-+When deciding which libraries are available, the original Configure uses
-+shaky heuristics to physically locate library files.
-+This is a very very bad thing to do, *especially* when cross-compiling,
-+as said heiristics are likely to locate the host libraries, not the target ones.
-+
-+The only real need for this test is to make sure it's safe to pass -llibrary
-+to the compiler. So that's exactly what perl-cross does, pass -llibrary
-+and see if it breaks things.
-+
-+Note this is a part of MakeMaker, and only applies to module Makefiles.
-+
-+
-+--- a/cpan/ExtUtils-MakeMaker/lib/ExtUtils/Liblist/Kid.pm
-++++ b/cpan/ExtUtils-MakeMaker/lib/ExtUtils/Liblist/Kid.pm
-+@@ -20,9 +20,10 @@
-+ use File::Spec;
-+ 
-+ sub ext {
-+-    if    ( $^O eq 'VMS' )     { goto &_vms_ext; }
-+-    elsif ( $^O eq 'MSWin32' ) { goto &_win32_ext; }
-+-    else                       { goto &_unix_os2_ext; }
-++  if   ($Config{usemmldlt}){ goto &_ld_ext;       }
-++  elsif($^O eq 'VMS')      { goto &_vms_ext;      }
-++  elsif($^O eq 'MSWin32')  { goto &_win32_ext;    }
-++  else                     { goto &_unix_os2_ext; }
-+ }
-+ 
-+ sub _unix_os2_ext {
-+@@ -661,4 +662,51 @@
-+     wantarray ? ( $lib, '', $ldlib, '', ( $give_libs ? \@flibs : () ) ) : $lib;
-+ }
-+ 
-++# A direct test for -l validity.
-++# Because guessing real file names for -llib options when dealing
-++# with a cross compiler is generally a BAD IDEA^tm.
-++sub _ld_ext {
-++    my($self,$potential_libs, $verbose, $give_libs) = @_;
-++    $verbose ||= 0;
-++
-++    if ($^O =~ 'os2' and $Config{perllibs}) { 
-++	# Dynamic libraries are not transitive, so we may need including
-++	# the libraries linked against perl.dll again.
-++
-++	$potential_libs .= " " if $potential_libs;
-++	$potential_libs .= $Config{perllibs};
-++    }
-++    return ("", "", "", "", ($give_libs ? [] : ())) unless $potential_libs;
-++    warn "Potential libraries are '$potential_libs':\n" if $verbose;
-++
-++    my($ld)   = $Config{ld};
-++    my($ldflags)   = $Config{ldflags};
-++    my($libs) = defined $Config{perllibs} ? $Config{perllibs} : $Config{libs};
-++
-++    my $try = 'try_mm.c';
-++    my $tryx = 'try_mm.x';
-++    open(TRY, '>', $try) || die "Can't create MakeMaker test file $try: $!\n";
-++    print TRY "int main(void) { return 0; }\n";
-++    close(TRY);
-++
-++    my $testlibs = '';
-++    my @testlibs = ();
-++    foreach my $thislib (split ' ', $potential_libs) {
-++        $testlibs = join(' ', @testlibs);
-++	if($thislib =~ /^-L/) {
-++		push(@testlibs, $thislib);
-++		next
-++	};
-++	my $cmd = "$ld $ldflags -o $tryx $try $testlibs $thislib >/dev/null 2>&1";
-++	my $ret = system($cmd);
-++	warn "Warning (mostly harmless): " . "No library found for $thislib\n" if $ret;
-++	next if $ret;
-++	push @testlibs, $thislib;
-++    }
-++    unlink($try);
-++    unlink($tryx);
-++
-++    return (join(' ', @testlibs), '', join(' ', @testlibs), '');
-++}
-++
-+ 1;
-diff --git a/cnf/diffs/perl5-5.42.0/makemaker.patch b/cnf/diffs/perl5-5.42.0/makemaker.patch
-new file mode 120000
-index 0000000..d7bd609
--- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/makemaker.patch
-@@ -0,0 +1 @@
-+../perl5-5.38.0/makemaker.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/posix-makefile.patch b/cnf/diffs/perl5-5.42.0/posix-makefile.patch
-new file mode 120000
-index 0000000..29463b7
--- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/posix-makefile.patch
-@@ -0,0 +1 @@
-+../perl5-5.22.3/posix-makefile.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/test-checkcase.patch b/cnf/diffs/perl5-5.42.0/test-checkcase.patch
-new file mode 120000
-index 0000000..36c5186
--- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/test-checkcase.patch
-@@ -0,0 +1 @@
-+../perl5-5.22.3/test-checkcase.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/test-makemaker.patch b/cnf/diffs/perl5-5.42.0/test-makemaker.patch
-new file mode 120000
-index 0000000..4e970ff
--- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/test-makemaker.patch
-@@ -0,0 +1 @@
-+../perl5-5.34.0/test-makemaker.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/xconfig.patch b/cnf/diffs/perl5-5.42.0/xconfig.patch
-new file mode 120000
-index 0000000..1c22c96
--- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/xconfig.patch
-@@ -0,0 +1 @@
-+../perl5-5.41.3/xconfig.patch
-\ No newline at end of file
@@ -1,42 +1,42 @@
 {
  lib,
  buildPythonPackage,
-  fetchPypi,
-  pythonOlder,
-  poetry-core,
+  fetchFromGitHub,
  importlib-metadata,
  importlib-resources,
+  poetry-core,
+  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "cmudict";
-  version = "1.1.2";
+  version = "1.1.3";
  pyproject = true;

-  disabled = pythonOlder "3.9";
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-IhZd73NPGpwZHKFowGbX6lgsi42nkNo+g0TpZeJkfbg=";
+  src = fetchFromGitHub {
+    owner = "prosegrinder";
+    repo = "python-cmudict";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pOqzezrDlwlVsvBHreHmLKxYKDxllZNs0TgLwxBhy58=";
+    fetchSubmodules = true;
  };

-  build-system = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];

  dependencies = [
    importlib-metadata
    importlib-resources
  ];

-  pythonImportsCheck = [
-    "cmudict"
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "cmudict" ];

  meta = {
-    changelog = "https://github.com/prosegrinder/python-cmudict/blob/main/CHANGELOG.md";
-    description = "A versioned python wrapper package for The CMU Pronouncing Dictionary data files";
-    homepage = "https://pypi.org/project/cmudict/";
+    description = "Python wrapper package for The CMU Pronouncing Dictionary data files";
+    homepage = "https://github.com/prosegrinder/python-cmudict";
+    changelog = "https://github.com/prosegrinder/python-cmudict/blob/v${finalAttrs.version}/CHANGELOG.md";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ sandarukasa ];
  };
-}
+})
@@ -49,13 +49,11 @@ let
      outpaths ++ lib.concatMap (outpath: lib.map (output: outpath.${output}) outpath.outputs) outpaths;
  };
 in
-buildPythonPackage rec {
+buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
  pname = "cupy";
  version = "13.6.0";
  pyproject = true;

-  stdenv = cudaPackages.backendStdenv;
-
  src = fetchFromGitHub {
    owner = "cupy";
    repo = "cupy";
@@ -5,9 +5,8 @@
  more-itertools,
 }:

-buildPythonPackage {
+buildPythonPackage.override { inherit (dlib) stdenv; } {
  inherit (dlib)
-    stdenv
    pname
    version
    src
@@ -39,7 +39,7 @@
 let
  stdenvTarget = if cudaSupport then gcc13Stdenv else stdenv;
 in
-buildPythonPackage rec {
+buildPythonPackage.override { stdenv = stdenvTarget; } rec {
  pname = "llama-cpp-python";
  version = "0.3.16";
  pyproject = true;
@@ -108,8 +108,6 @@ buildPythonPackage rec {
    ]
  );

-  stdenv = stdenvTarget;
-
  dependencies = [
    diskcache
    jinja2
@@ -4,6 +4,7 @@
  callPackage,
  buildPythonPackage,
  fetchFromGitHub,
+  fetchpatch,
  pytestCheckHook,
  pythonOlder,
  replaceVars,
@@ -24,6 +25,7 @@
  pytest-asyncio,
  pytest-httpx,
  pytest-recording,
+  sqlite,
  sqlite-utils,
  syrupy,
  llm-echo,
@@ -179,7 +181,17 @@ let
      hash = "sha256-PMQGyBwP6UCIz7p94atWgepbw9IwW6ym60sfP/PBrCA=";
    };

-    patches = [ ./001-disable-install-uninstall-commands.patch ];
+    patches = [
+      ./001-disable-install-uninstall-commands.patch
+    ]
+    # See https://github.com/NixOS/nixpkgs/issues/476258 and https://github.com/simonw/llm/pull/1334
+    # TODO: Remove when sqlite 3.52.x is released.
+    ++ lib.optionals (sqlite.version == "3.51.1") [
+      (fetchpatch {
+        url = "https://github.com/simonw/llm/commit/6e24b883c3e3c4ddd2ec9006714d0a9ec17b59da.patch";
+        hash = "sha256-4AKQdZCr6qxuWnjWoSW6I44hPL5e7tnvREx2Ns0WwNc=";
+      })
+    ];

    postPatch = ''
      substituteInPlace llm/cli.py \
@@ -33,6 +33,7 @@
  python,
  qt6,
  setuptools,
+  stdenv,
  onetbb,
  withDocs ? false,
  withOsl ? true,
@@ -61,8 +62,6 @@ buildPythonPackage rec {
    hash = "sha256-gxikEC4MqTkhgYaRsCVYtS/VmXClSaCMdzpQ0LmiR7Q=";
  };

-  stdenv = python.stdenv;
-
  outputs = [ "out" ] ++ lib.optional withDocs "doc";

  patches = [
@@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "pdfminer-six";
-  version = "20251107";
+  version = "20251227";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pdfminer";
    repo = "pdfminer.six";
    tag = version;
-    hash = "sha256-PuRxiKL1rLpfdabH3cMywkwBoeImu/yNgEhckLzr0Z4=";
+    hash = "sha256-O/9B04lLFNoqvvyGAFADuqzIGnthN50V1+PMAFt1ysc=";
  };

  build-system = [
@@ -10,24 +10,26 @@
  monotonic,
  openai,
  parameterized,
+  pytest-asyncio,
  pytestCheckHook,
  python-dateutil,
+  pythonAtLeast,
  requests,
  setuptools,
  six,
  typing-extensions,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "posthog";
-  version = "6.7.0";
+  version = "7.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "PostHog";
    repo = "posthog-python";
-    tag = "v${version}";
-    hash = "sha256-//PjAWZF6FYsiG9UDg+MPv1x06Yp4msBkYkNAU9Rjsc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YDW3FneQec09BOUh3wBbgz1ng3n6tkzoAZhIynp4wGA=";
  };

  build-system = [ setuptools ];
@@ -48,6 +50,7 @@ buildPythonPackage rec {
    mock
    openai
    parameterized
+    pytest-asyncio
    pytestCheckHook
  ];

@@ -62,19 +65,22 @@ buildPythonPackage rec {
    "test_upload"
    # AssertionError: 2 != 3
    "test_flush_interval"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # Pydantic V1 functionality isn't compatible with Python 3.14
+    "test_clean_pydantic"
  ];

  disabledTestPaths = [
-    # Revisit this at the next version bump, issue open upstream
-    # See https://github.com/PostHog/posthog-python/issues/234
-    "posthog/test/ai/openai/test_openai.py"
+    # Missing parts
+    "posthog/test/integrations/test_middleware.py"
  ];

  meta = {
    description = "Module for interacting with PostHog";
    homepage = "https://github.com/PostHog/posthog-python";
-    changelog = "https://github.com/PostHog/posthog-python/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/PostHog/posthog-python/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ happysalada ];
  };
-}
+})
@@ -14,8 +14,6 @@ buildPythonPackage rec {
  version = "7.1.3";
  pyproject = true;

-  inherit stdenv;
-
  src = fetchFromGitHub {
    owner = "giampaolo";
    repo = "psutil";
@@ -2,32 +2,47 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  fetchpatch,
  parameterized,
  unittestCheckHook,
+  setuptools,
 }:
-buildPythonPackage rec {
+
+buildPythonPackage (finalAttrs: {
  pname = "pypika";
  version = "0.49.0";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "kayak";
    repo = "pypika";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-Lawsc19sJ3U7rCOnYvDWhWqK/J+Hd3zKG6TrhDsTtVs=";
  };

-  pythonImportsCheck = [ "pypika" ];
+  patches = [
+    # Fix ast deprecation warnings, https://github.com/HENNGE/arsenic/pull/160
+    (fetchpatch {
+      name = "ast-deprecation.patch";
+      url = "https://github.com/pyctrl/pypika/commit/e302e4d1c26242bcff61b50e0e8f157f181e1bc0.patch";
+      hash = "sha256-pbJwOE5xaAapMKdm1xsNrISbCzHIKuhCgA2lA0vB1T8=";
+    })
+  ];
+
+  build-system = [ setuptools ];

  nativeCheckInputs = [
    parameterized
    unittestCheckHook
  ];

+  pythonImportsCheck = [ "pypika" ];
+
  meta = {
    description = "Python SQL query builder";
    homepage = "https://github.com/kayak/pypika";
+    changelog = "https://github.com/kayak/pypika/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = [ ];
  };
-}
+})
@@ -5,6 +5,7 @@
  replaceVars,
  isPyPy,
  python,
+  stdenv,
  setuptools,
  pillow,
  pycairo,
@@ -27,7 +28,7 @@
  pybind11,
 }:

-buildPythonPackage rec {
+buildPythonPackage {
  pname = "python-mapnik";
  version = "4.1.3.unstable-2025-09-25";
  pyproject = true;
@@ -49,8 +50,6 @@ buildPythonPackage rec {
    })
  ];

-  stdenv = python.stdenv;
-
  build-system = [ setuptools ];

  nativeBuildInputs = [
@@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "tencentcloud-sdk-python";
-  version = "3.1.25";
+  version = "3.1.26";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = finalAttrs.version;
-    hash = "sha256-z4GpifopGTRUo2WWWfA8GkN7L+T+FkIN8xYchA5V3DI=";
+    hash = "sha256-5A3IQUEz+LtsiirNJeVeHawrvlJ2s3UTXXYGAYrPM74=";
  };

  build-system = [ setuptools ];
@@ -74,14 +74,13 @@ let
    else
      throw "No GPU targets specified"
  );
+  stdenv = torch.stdenv;
 in
-buildPythonPackage rec {
+buildPythonPackage.override { inherit stdenv; } rec {
  pname = "torchaudio";
  version = "2.9.1";
  pyproject = true;

-  stdenv = torch.stdenv;
-
  src = fetchFromGitHub {
    owner = "pytorch";
    repo = "audio";
@@ -30,12 +30,10 @@ let
  pname = "torchvision";
  version = "0.24.1";
 in
-buildPythonPackage {
+buildPythonPackage.override { stdenv = torch.stdenv; } {
  format = "setuptools";
  inherit pname version;

-  stdenv = torch.stdenv;
-
  src = fetchFromGitHub {
    owner = "pytorch";
    repo = "vision";
@@ -1,17 +1,23 @@
 {
  lib,
  buildPythonPackage,
-  ed25519,
-  freezegun,
  fetchFromGitHub,
-  hatchling,
-  pytestCheckHook,
+
+  # build-system
  flit-core,
+  hatchling,
+
+  # dependencies
  requests,
  securesystemslib,
+
+  # tests
+  ed25519,
+  freezegun,
+  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "tuf";
  version = "6.0.0";
  pyproject = true;
@@ -19,13 +25,13 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "theupdateframework";
    repo = "python-tuf";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-CPbZOpUYi7MWKLMj7kwTsmEkxLCf4wU7IOCcbzMkPlU=";
  };

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace-fail  "hatchling==1.27.0" "hatchling"
+      --replace-fail "hatchling==1.27.0" "hatchling"
  '';

  build-system = [
@@ -42,12 +48,9 @@ buildPythonPackage rec {

  __darwinAllowLocalNetworking = true;

-  checkInputs = [
-    freezegun
-  ];
-
  nativeCheckInputs = [
    ed25519
+    freezegun
    pytestCheckHook
  ];

@@ -60,11 +63,11 @@ buildPythonPackage rec {
  meta = {
    description = "Python reference implementation of The Update Framework (TUF)";
    homepage = "https://github.com/theupdateframework/python-tuf";
-    changelog = "https://github.com/theupdateframework/python-tuf/blob/v${version}/docs/CHANGELOG.md";
+    changelog = "https://github.com/theupdateframework/python-tuf/blob/${finalAttrs.src.tag}/docs/CHANGELOG.md";
    license = with lib.licenses; [
      asl20
      mit
    ];
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
@@ -14,13 +14,11 @@
  zlib,
 }:

-buildPythonPackage rec {
+buildPythonPackage.override { stdenv = llvmPackages.stdenv; } rec {
  pname = "verilogae";
  version = "24.0.0mob-unstable-2025-07-21";
  pyproject = true;

-  stdenv = llvmPackages.stdenv;
-
  src = fetchFromGitHub {
    owner = "OpenVAF";
    repo = "OpenVAF-Reloaded";
@@ -313,13 +313,11 @@ let

 in

-buildPythonPackage rec {
+buildPythonPackage.override { stdenv = torch.stdenv; } rec {
  pname = "vllm";
  version = "0.13.0";
  pyproject = true;

-  stdenv = torch.stdenv;
-
  src = fetchFromGitHub {
    owner = "vllm-project";
    repo = "vllm";
@@ -43,7 +43,7 @@ let

  libmathdx = callPackage ./libmathdx.nix { };
 in
-buildPythonPackage {
+buildPythonPackage.override { stdenv = effectiveStdenv; } {
  pname = "warp-lang";
  inherit version;
  pyproject = true;
@@ -53,8 +53,6 @@ buildPythonPackage {
  # provided by NVCC.
  __structuredAttrs = true;

-  stdenv = effectiveStdenv;
-
  src = fetchFromGitHub {
    owner = "NVIDIA";
    repo = "warp";
@@ -35,8 +35,9 @@ let
  # version 0.0.32.post2 was confirmed to break CUDA.
  # Remove this note once the latest published revision "just works".
  version = "0.0.30";
+  effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
 in
-buildPythonPackage {
+buildPythonPackage.override { stdenv = effectiveStdenv; } {
  pname = "xformers";
  inherit version;
  pyproject = true;
@@ -66,8 +67,6 @@ buildPythonPackage {
    TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep ";" torch.cudaCapabilities}";
  };

-  stdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
-
  buildInputs =
    lib.optional stdenv.hostPlatform.isDarwin openmp
    ++ lib.optionals cudaSupport (
@@ -11,13 +11,13 @@

 buildDotnetModule rec {
  pname = "jackett";
-  version = "0.24.532";
+  version = "0.24.645";

  src = fetchFromGitHub {
    owner = "jackett";
    repo = "jackett";
    tag = "v${version}";
-    hash = "sha256-9dLBQOAyR2oyN1lGLPN/QLZtGLASRKUXUCLCdvqOmmE=";
+    hash = "sha256-nb5WDMhba4kTGxtX4rLLZdM9iJI6dM6kPBu3hht/CYk=";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
@@ -191,6 +191,8 @@ in

  trivial-builders = callPackage ../build-support/trivial-builders/test/default.nix { };

+  vmTools = callPackage ../build-support/vm/test.nix { };
+
  writers = callPackage ../build-support/writers/test.nix { };

  testers = callPackage ../build-support/testers/test/default.nix { };
@@ -446,20 +446,6 @@ let
        expr = package-stub-libcxx.stdenv;
        expected = pkgs.libcxxStdenv;
      };
-      overridePythonAttrs-stdenv-deprecated = {
-        expr =
-          (package-stub.overridePythonAttrs (_: {
-            stdenv = pkgs.clangStdenv;
-          })).stdenv;
-        expected = pkgs.clangStdenv;
-      };
-      overridePythonAttrs-override-clangStdenv-deprecated-nested = {
-        expr =
-          (package-stub-gcc.overridePythonAttrs {
-            stdenv = pkgs.clangStdenv;
-          }).stdenv;
-        expected = pkgs.clangStdenv;
-      };

      overridePythonAttrs = {
        expr = (applyOverridePythonAttrs package-stub).overridePythonAttrsFlag;
@@ -196,7 +196,6 @@ stdenv.mkDerivation (finalAttrs: {
    curl
    capnproto
    editline
-    libsodium
    openssl
    sqlite
    xz
@@ -295,9 +294,21 @@ stdenv.mkDerivation (finalAttrs: {
  ]
  ++
    lib.optionals
-      (stdenv.hostPlatform.isLinux && finalAttrs.doInstallCheck && lib.versionAtLeast version "2.94")
+      (
+        stdenv.hostPlatform.isLinux
+        && finalAttrs.doInstallCheck
+        && lib.versionAtLeast version "2.94"
+        && lib.versionOlder version "2.95"
+      )
      [
        (lib.mesonOption "build-test-shell" "${pkgsStatic.busybox}/bin")
+      ]
+  ++
+    lib.optionals
+      (stdenv.hostPlatform.isLinux && finalAttrs.doInstallCheck && lib.versionAtLeast version "2.95")
+      [
+        (lib.mesonOption "build-test-env" "${pkgsStatic.busybox}/bin")
+        (lib.mesonOption "build-test-shell" "${pkgsStatic.bash}/bin")
      ];

  ninjaFlags = [ "-v" ];
@@ -347,7 +358,8 @@ stdenv.mkDerivation (finalAttrs: {
    rapidcheck
  ];

-  doInstallCheck = true;
+  # Python splices are broken (https://github.com/NixOS/nixpkgs/issues/476822), causing build failure in `buildPackages.python3Packages.bcrypt`.
+  doInstallCheck = stdenv.buildPlatform == stdenv.hostPlatform;
  mesonInstallCheckFlags = [
    "--suite=installcheck"
    "--print-errorlogs"
@@ -265,14 +265,14 @@ lib.makeExtensible (
      attrName = "git";

      lix-args = rec {
-        version = "2.95.0-pre-20251121_${builtins.substring 0 12 src.rev}";
+        version = "2.95.0-pre-20260103_${builtins.substring 0 12 src.rev}";

        src = fetchFromGitea {
          domain = "git.lix.systems";
          owner = "lix-project";
          repo = "lix";
-          rev = "b707403a308030739dfeacc5b0aaaeef8ba3f633";
-          hash = "sha256-kas7FT2J86DVJlPH5dNNHM56OgdQQyfCE/dX/EOKDp8=";
+          rev = "d387c9113c73f04bed46dbdd59b6c36de2253d73";
+          hash = "sha256-jYUcmXA4FNwoJtxRgH+Be96wQv8h9Y9dByYf+KmcgK4=";
        };

        cargoDeps = rustPlatform.fetchCargoVendor {
@@ -280,8 +280,6 @@ lib.makeExtensible (
          inherit src;
          hash = "sha256-APm8m6SVEAO17BBCka13u85/87Bj+LePP7Y3zHA3Mpg=";
        };
-
-        patches = [ lixMdbookPatch ];
      };
    };

@@ -830,8 +830,9 @@ with pkgs;
    inherit (darwin) signingUtils;
  };

-  # No callPackage.  In particular, we don't want `img` *package* in parameters.
-  vmTools = makeOverridable (import ../build-support/vm) { inherit pkgs lib; };
+  vmTools = callPackage ../build-support/vm {
+    img = stdenv.hostPlatform.linux-kernel.target;
+  };

  releaseTools = callPackage ../build-support/release { };

@@ -18100,9 +18100,12 @@ with self;
      url = "mirror://cpan/authors/id/I/IS/ISHIGAKI/JSON-4.10.tar.gz";
      hash = "sha256-34tRQ9mn3pnEe1XxoXC9H2n3EZNcGGptwKtW3QV1jjU=";
    };
-    # Do not abort cross-compilation on failure to load native JSON module into host perl
+    # Force core provided JSON::PP backend when cross building since dynamic
+    # loading attempts of other backends presumably fail
    preConfigure = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-      substituteInPlace Makefile.PL --replace "exit 0;" ""
+      substituteInPlace lib/JSON.pm \
+        --replace-fail 'my $backend = exists $ENV{PERL_JSON_BACKEND} ? $ENV{PERL_JSON_BACKEND} : 1;' \
+                       'my $backend = "JSON::PP";'
    '';
    buildInputs = [ TestPod ];
    meta = {