diff --git a/doc/build-helpers/special/vm-tools.section.md b/doc/build-helpers/special/vm-tools.section.md
index 142093274987..47988eb3f4a1 100644
--- a/doc/build-helpers/special/vm-tools.section.md
+++ b/doc/build-helpers/special/vm-tools.section.md
@@ -92,14 +92,14 @@ Generate a script that can be used to run an interactive session in the given im
 
 ### Examples {#vm-tools-makeImageTestScript-examples}
 
-Create a script for running a Fedora 27 VM:
+Create a script for running a Fedora 43 VM:
 ```nix
-{ pkgs }: with pkgs; with vmTools; makeImageTestScript diskImages.fedora27x86_64
+{ pkgs }: pkgs.vmTools.makeImageTestScript pkgs.vmTools.diskImages.fedora43x86_64
 ```
 
-Create a script for running an Ubuntu 20.04 VM:
+Create a script for running an Ubuntu 24.04 VM:
 ```nix
-{ pkgs }: with pkgs; with vmTools; makeImageTestScript diskImages.ubuntu2004x86_64
+{ pkgs }: pkgs.vmTools.makeImageTestScript pkgs.vmTools.diskImages.ubuntu2404x86_64
 ```
 
 ## `vmTools.diskImageFuns` {#vm-tools-diskImageFuns}
@@ -109,30 +109,29 @@ A set of functions that build a predefined set of minimal Linux distributions im
 ### Images {#vm-tools-diskImageFuns-images}
 
 * Fedora
-  * `fedora26x86_64`
-  * `fedora27x86_64`
-* CentOS
-  * `centos6i386`
-  * `centos6x86_64`
-  * `centos7x86_64`
+  * `fedora42x86_64`
+  * `fedora43x86_64`
+* Rocky Linux
+  * `rocky9x86_64`
+  * `rocky10x86_64`
+* AlmaLinux
+  * `alma9x86_64`
+  * `alma10x86_64`
+* Oracle Linux
+  * `oracle9x86_64`
+* Amazon Linux
+  * `amazon2023x86_64`
 * Ubuntu
-  * `ubuntu1404i386`
-  * `ubuntu1404x86_64`
-  * `ubuntu1604i386`
-  * `ubuntu1604x86_64`
-  * `ubuntu1804i386`
-  * `ubuntu1804x86_64`
-  * `ubuntu2004i386`
-  * `ubuntu2004x86_64`
   * `ubuntu2204i386`
   * `ubuntu2204x86_64`
+  * `ubuntu2404x86_64`
 * Debian
-  * `debian10i386`
-  * `debian10x86_64`
   * `debian11i386`
   * `debian11x86_64`
   * `debian12i386`
   * `debian12x86_64`
+  * `debian13i386`
+  * `debian13x86_64`
 
 ### Attributes {#vm-tools-diskImageFuns-attributes}
 
@@ -144,9 +143,7 @@ A set of functions that build a predefined set of minimal Linux distributions im
 8GiB image containing Firefox in addition to the default packages:
 ```nix
 { pkgs }:
-with pkgs;
-with vmTools;
-diskImageFuns.ubuntu2004x86_64 {
+pkgs.vmTools.diskImageFuns.ubuntu2404x86_64 {
   extraPackages = [ "firefox" ];
   size = 8192;
 }
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c972ea8a2618..856a3cfaa186 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22305,6 +22305,11 @@
     github = "RhydianJenkins";
     githubId = 9198690;
   };
+  Rhys-T = {
+    name = "Rhys T.";
+    github = "Rhys-T";
+    githubId = 108157737;
+  };
   rhysmdnz = {
     email = "rhys@memes.nz";
     matrix = "@rhys:memes.nz";
diff --git a/nixos/lib/qemu-common.nix b/nixos/lib/qemu-common.nix
index 5629b0b81d20..a43b624cdbce 100644
--- a/nixos/lib/qemu-common.nix
+++ b/nixos/lib/qemu-common.nix
@@ -1,5 +1,5 @@
 # QEMU-related utilities shared between various Nix expressions.
-{ lib, pkgs }:
+{ lib, stdenv }:
 
 let
   zeroPad =
@@ -17,19 +17,19 @@ rec {
   ];
 
   qemuSerialDevice =
-    if with pkgs.stdenv.hostPlatform; isx86 || isLoongArch64 || isMips64 || isRiscV then
+    if with stdenv.hostPlatform; isx86 || isLoongArch64 || isMips64 || isRiscV then
       "ttyS0"
-    else if (with pkgs.stdenv.hostPlatform; isAarch || isPower) then
+    else if (with stdenv.hostPlatform; isAarch || isPower) then
       "ttyAMA0"
     else
-      throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";
+      throw "Unknown QEMU serial device for system '${stdenv.hostPlatform.system}'";
 
   qemuBinary =
     qemuPkg:
     let
       hostStdenv = qemuPkg.stdenv;
       hostSystem = hostStdenv.system;
-      guestSystem = pkgs.stdenv.hostPlatform.system;
+      guestSystem = stdenv.hostPlatform.system;
 
       linuxHostGuestMatrix = {
         x86_64-linux = "${qemuPkg}/bin/qemu-system-x86_64 -machine accel=kvm:tcg -cpu max";
diff --git a/nixos/lib/testing/network.nix b/nixos/lib/testing/network.nix
index 1188e9bec505..e65767e7fb99 100644
--- a/nixos/lib/testing/network.nix
+++ b/nixos/lib/testing/network.nix
@@ -30,7 +30,7 @@ let
       ...
     }:
     let
-      qemu-common = import ../qemu-common.nix { inherit lib pkgs; };
+      qemu-common = import ../qemu-common.nix { inherit (pkgs) lib stdenv; };
 
       # Convert legacy VLANs to named interfaces and merge with explicit interfaces.
       vlansNumbered = forEach (zipLists config.virtualisation.vlans (range 1 255)) (v: {
diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix
index 3ec4fdc0e2a0..dce59a0a93b7 100644
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -14,7 +14,7 @@ with lib;
 let
   cfg = config.testing;
 
-  qemu-common = import ../../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };
 
   backdoorService = {
     requires = [
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index abded7525062..8a6c55cfc9fa 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -16,7 +16,7 @@ with lib;
 
 let
 
-  qemu-common = import ../../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };
 
   cfg = config.virtualisation;
 
diff --git a/nixos/tests/boot.nix b/nixos/tests/boot.nix
index 863d80e41dac..d1ac1a8769fe 100644
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -8,7 +8,7 @@ with import ../lib/testing-python.nix { inherit system pkgs; };
 
 let
   lib = pkgs.lib;
-  qemu-common = import ../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };
 
   mkStartCommand =
     {
diff --git a/nixos/tests/networking/router.nix b/nixos/tests/networking/router.nix
index 082f2bc7d227..ae9c64607a66 100644
--- a/nixos/tests/networking/router.nix
+++ b/nixos/tests/networking/router.nix
@@ -2,7 +2,7 @@
 { config, pkgs, ... }:
 let
   inherit (pkgs) lib;
-  qemu-common = import ../../lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../lib/qemu-common.nix { inherit (pkgs) lib stdenv; };
   vlanIfs = lib.range 1 (lib.length config.virtualisation.vlans);
 in
 {
diff --git a/pkgs/applications/editors/neovim/utils.nix b/pkgs/applications/editors/neovim/utils.nix
index 675aae8a9c57..6a7d1f83573f 100644
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@@ -59,6 +59,70 @@ let
       opt = map (x: x.plugin) pluginsPartitioned.right;
     };
 
+  /**
+    * Builds a vim package (see ':h packages') with additionnal info:
+    - the user lua configuration (specified by user)
+    - the advised and advised by nixpkgs in passthru.initLua)
+    - runtime dependencies (specified in plugins' "runtimeDeps")
+    - plugin dependencies (vim plugins, python deps)
+  */
+  makeVimPackageInfo =
+    # a list of neovim plugin derivations, for instance
+    #  plugins = [
+    # { plugin=vimPlugins.far-vim; config = "let g:far#source='rg'"; optional = false; }
+    # vimPlugins.vim-fugitive
+    # ]
+    plugins:
+
+    let
+      pluginsNormalized = normalizePlugins plugins;
+
+      vimPackage = normalizedPluginsToVimPackage pluginsNormalized;
+
+      userPluginLua = lib.foldl (
+        acc: p: if p.config != null then acc ++ [ p.config ] else acc
+      ) [ ] pluginsNormalized;
+
+      pluginAdvisedLua =
+        let
+          op =
+            acc: normalizedPlugin:
+            acc
+            ++ lib.optional (
+              normalizedPlugin.plugin.passthru ? initLua
+            ) normalizedPlugin.plugin.passthru.initLua;
+        in
+        lib.foldl' op [ ] pluginsNormalized;
+
+      getDeps = attrname: map (plugin: plugin.${attrname} or (_: [ ]));
+
+      requiredPlugins = vimUtils.requiredPluginsForPackage vimPackage;
+      pluginPython3Packages = getDeps "python3Dependencies" requiredPlugins;
+    in
+    {
+      # plugins' python dependencies
+      inherit pluginPython3Packages;
+
+      # lua config set by the user along with the plugin
+      inherit userPluginLua;
+
+      # recommanded configuration set in vim plugins ".passthru.initLua"
+      inherit pluginAdvisedLua;
+
+      # A Vim "package", see ':h packages'
+      # You most likely want to use vimPackage as follows:
+      #     packpathDirs.myNeovimPackages = vimPackage;
+      #     finalPackdir = neovimUtils.packDir packpathDirs;
+      inherit vimPackage;
+
+      runtimeDeps =
+        let
+          op = acc: normalizedPlugin: acc ++ normalizedPlugin.plugin.runtimeDeps or [ ];
+        in
+        lib.foldl' op [ ] pluginsNormalized;
+
+    };
+
   /*
     returns everything needed for the caller to wrap its own neovim:
     - the generated content of the future init.vim
@@ -297,7 +361,6 @@ let
     packages:
     let
       rawPackDir = vimUtils.packDir packages;
-
     in
     rawPackDir.override {
       postBuild = ''
@@ -311,6 +374,7 @@ let
 in
 {
   inherit makeNeovimConfig;
+  inherit makeVimPackageInfo;
   inherit generateProviderRc;
   inherit legacyWrapper;
   inherit grammarToPlugin;
diff --git a/pkgs/applications/editors/neovim/wrapper.nix b/pkgs/applications/editors/neovim/wrapper.nix
index 5c91bac0b11b..ef2372c54f34 100644
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@@ -81,9 +81,6 @@ let
     stdenv.mkDerivation (
       finalAttrs:
       let
-        pluginsNormalized = neovimUtils.normalizePlugins finalAttrs.plugins;
-
-        myVimPackage = neovimUtils.normalizedPluginsToVimPackage pluginsNormalized;
 
         rubyEnv = bundlerEnv {
           name = "neovim-ruby-env";
@@ -93,49 +90,38 @@ let
           '';
         };
 
-        pluginRC = lib.foldl (
-          acc: p: if p.config != null then acc ++ [ p.config ] else acc
-        ) [ ] pluginsNormalized;
-
         # a limited RC script used only to generate the manifest for remote plugins
         manifestRc = "";
+
+        # plugin-related information
+        vimPackageInfo = neovimUtils.makeVimPackageInfo finalAttrs.plugins;
+
         # we call vimrcContent without 'packages' to avoid the init.vim generation
         neovimRcContent' = lib.concatStringsSep "\n" (
-          pluginRC ++ lib.optional (neovimRcContent != null) neovimRcContent
+          vimPackageInfo.userPluginLua ++ lib.optional (neovimRcContent != null) neovimRcContent
         );
 
-        packpathDirs.myNeovimPackages = myVimPackage;
+        packpathDirs.myNeovimPackages = vimPackageInfo.vimPackage;
         finalPackdir = neovimUtils.packDir packpathDirs;
 
-        luaPluginRC =
-          let
-            op =
-              acc: normalizedPlugin:
-              acc
-              ++ lib.optional (
-                finalAttrs.autoconfigure && normalizedPlugin.plugin.passthru ? initLua
-              ) normalizedPlugin.plugin.passthru.initLua;
-          in
-          lib.foldl' op [ ] pluginsNormalized;
-
         rcContent = ''
           ${luaRcContent}
         ''
         + lib.optionalString (neovimRcContent' != "") ''
           vim.cmd.source "${writeText "init.vim" neovimRcContent'}"
         ''
-        + lib.concatStringsSep "\n" luaPluginRC;
-
-        getDeps = attrname: map (plugin: plugin.${attrname} or (_: [ ]));
-
-        requiredPlugins = vimUtils.requiredPluginsForPackage myVimPackage;
-        pluginPython3Packages = getDeps "python3Dependencies" requiredPlugins;
+        + lib.optionalString autoconfigure (lib.concatStringsSep "\n" vimPackageInfo.pluginAdvisedLua);
 
         python3Env =
           lib.warnIf (attrs ? python3Env)
             "Pass your python packages via the `extraPython3Packages`, e.g., `extraPython3Packages = ps: [ ps.pandas ]`"
             python3.pkgs.python.withPackages
-            (ps: [ ps.pynvim ] ++ (extraPython3Packages ps) ++ (lib.concatMap (f: f ps) pluginPython3Packages));
+            (
+              ps:
+              [ ps.pynvim ]
+              ++ (extraPython3Packages ps)
+              ++ (lib.concatMap (f: f ps) vimPackageInfo.pluginPython3Packages)
+            );
 
         wrapperArgsStr = if lib.isString wrapperArgs then wrapperArgs else lib.escapeShellArgs wrapperArgs;
 
@@ -234,14 +220,10 @@ let
         inherit wrapperArgs generatedWrapperArgs;
 
         runtimeDeps =
-          let
-            op = acc: normalizedPlugin: acc ++ normalizedPlugin.plugin.runtimeDeps or [ ];
-            runtimeDeps = lib.foldl' op [ ] pluginsNormalized;
-          in
           lib.optionals finalAttrs.waylandSupport [ wl-clipboard ]
           ++ lib.optional finalAttrs.withRuby rubyEnv
           ++ lib.optional finalAttrs.withNodeJs nodejs
-          ++ lib.optionals finalAttrs.autowrapRuntimeDeps runtimeDeps;
+          ++ lib.optionals finalAttrs.autowrapRuntimeDeps vimPackageInfo.runtimeDeps;
 
         luaRcContent = rcContent;
         # Remove the symlinks created by symlinkJoin which we need to perform
@@ -342,8 +324,7 @@ let
           lndir
         ];
 
-        # A Vim "package", see ':h packages'
-        vimPackage = myVimPackage;
+        vimPackage = vimPackageInfo.vimPackage;
 
         checkPhase = ''
           runHook preCheck
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
index ff7883e7b4b4..663717cce39a 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
@@ -7,14 +7,14 @@
 }:
 vimUtils.buildVimPlugin {
   pname = "cmp-async-path";
-  version = "0-unstable-2025-11-04";
+  version = "0-unstable-2026-01-05";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "FelipeLema";
     repo = "cmp-async-path";
-    rev = "b8aade3a0626f2bc1d3cd79affcd7da9f47f7ab1";
-    hash = "sha256-gaK2aemMX4fzH85idIPuVZ1+ay5vCNqgxU15J4Jz5wU=";
+    rev = "a14d3a9c7f303551a0b8c64a0e4e6527ce39a8a2";
+    hash = "sha256-QOa2Oke3p5wGhTJ4TjcgTUphb0OdDUwmw8MiYp2LkhA=";
   };
 
   checkInputs = [ vimPlugins.nvim-cmp ];
diff --git a/pkgs/applications/emulators/libretro/cores/ppsspp.nix b/pkgs/applications/emulators/libretro/cores/ppsspp.nix
index 659b9c0c1dda..5d7c6373ae21 100644
--- a/pkgs/applications/emulators/libretro/cores/ppsspp.nix
+++ b/pkgs/applications/emulators/libretro/cores/ppsspp.nix
@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2025-12-30";
+  version = "0-unstable-2026-01-04";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "34fde065b76805c851d7c4b5bc4c67a3d347aab9";
-    hash = "sha256-se8WptzipVwAE6Qwq2hTv7xBsY22HoACdVrPv+ssBDc=";
+    rev = "6c0aff3a28b8c1ee97e1346d0b2404179ce5e5c0";
+    hash = "sha256-X/d3qGpdTJx7r6qtW2P/l7COMsv4oJ1nqjZC0QRLYiQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/same_cdi.nix b/pkgs/applications/emulators/libretro/cores/same_cdi.nix
index 517fd721caea..a92e4390b89e 100644
--- a/pkgs/applications/emulators/libretro/cores/same_cdi.nix
+++ b/pkgs/applications/emulators/libretro/cores/same_cdi.nix
@@ -30,6 +30,15 @@ mkLibretroCore {
     })
   ];
 
+  postPatch = ''
+    # Fix sol2 compatibility with GCC 15 (construct -> emplace)
+    # https://github.com/ThePhD/sol2/issues/1657
+    sed -i 's/this->construct(std::forward<Args>(args)\.\.\.);/this->emplace(std::forward<Args>(args)...);/g' 3rdparty/sol2/sol/sol.hpp
+
+    # Fix missing cstdint include for uint8_t
+    sed -i '1i #include <cstdint>' src/lib/util/corestr.cpp
+  '';
+
   extraNativeBuildInputs = [ python3 ];
   extraBuildInputs = [
     alsa-lib
diff --git a/pkgs/applications/emulators/libretro/cores/scummvm.nix b/pkgs/applications/emulators/libretro/cores/scummvm.nix
index acd4315d0ed5..fe52e890a40b 100644
--- a/pkgs/applications/emulators/libretro/cores/scummvm.nix
+++ b/pkgs/applications/emulators/libretro/cores/scummvm.nix
@@ -50,6 +50,9 @@ mkLibretroCore {
     cp -a ${libretro-deps-src}/* deps/libretro-deps
     chmod -R u+w deps/
 
+    # Fix conflicts with glibc index/rindex functions
+    sed -i 's/\bindex\b/faad_index/g; s/\brindex\b/faad_rindex/g' deps/libretro-deps/libfaad/libfaad/common.h
+
     patchShebangs ./scripts/*
   '';
 
diff --git a/pkgs/applications/networking/browsers/webmacs/default.nix b/pkgs/applications/networking/browsers/webmacs/default.nix
index 737affc42bb9..a3816002a53b 100644
--- a/pkgs/applications/networking/browsers/webmacs/default.nix
+++ b/pkgs/applications/networking/browsers/webmacs/default.nix
@@ -7,9 +7,7 @@
   herbstluftwm,
 }:
 
-mkDerivationWith python3Packages.buildPythonApplication rec {
-  inherit stdenv;
-
+mkDerivationWith (python3Packages.buildPythonApplication.override { inherit stdenv; }) rec {
   pname = "webmacs";
   version = "0.8";
   format = "setuptools";
diff --git a/pkgs/applications/search/recoll/default.nix b/pkgs/applications/search/recoll/default.nix
index 9692b6f0877b..fc88a70ce5a8 100644
--- a/pkgs/applications/search/recoll/default.nix
+++ b/pkgs/applications/search/recoll/default.nix
@@ -75,11 +75,11 @@ in
 
 mkDerivation rec {
   pname = "recoll";
-  version = "1.43.5";
+  version = "1.43.9";
 
   src = fetchurl {
     url = "https://www.recoll.org/${pname}-${version}.tar.gz";
-    hash = "sha256-Px3uK7I/MkrJbAOmV2ipVct/+p05SST6TLTYoDaLNdQ=";
+    hash = "sha256-irloDtMO9CBvtI+oEicUOy2myrGskieWoqNk5eapzU8=";
   };
 
   mesonFlags = [
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-gradient-source.nix b/pkgs/applications/video/obs-studio/plugins/obs-gradient-source.nix
index 1401e0284514..f0bb0d650247 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-gradient-source.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-gradient-source.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-gradient-source";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-gradient-source";
     rev = version;
-    sha256 = "sha256-5pll84UZYOTESrid2UuC1aWlaLrWf1LpXqlV09XKLug=";
+    sha256 = "sha256-Y9PTvaZr7ANwHhqgWsNIikRQLdKO8sA4OXI+mKyUnaM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-retro-effects.nix b/pkgs/applications/video/obs-studio/plugins/obs-retro-effects.nix
index d866db831f3e..e4072bc54fc2 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-retro-effects.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-retro-effects.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-retro-effects";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "FiniteSingularity";
     repo = "obs-retro-effects";
     rev = "${version}";
-    sha256 = "sha256-bWUGuCgCNAaSc0+NRRYsx/8EhrlWuPcipkuUlQZvWDk=";
+    sha256 = "sha256-oQGXBd/KGPGTK+CoomMjjgrnxTqVIefEKqKH11SPHSY=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix b/pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix
index 4229602144e9..405ef5ad2b6c 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-source-clone";
-  version = "0.1.5";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-source-clone";
     tag = finalAttrs.version;
-    hash = "sha256-0rBtFPfqVvB333eeWRpVe4TgrJTiBTIzsV/SSe3EgOc=";
+    hash = "sha256-LvxeADojLM33N3CmdwEHQ2FuORMlbKq961do5J7891M=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-text-pthread.nix b/pkgs/applications/video/obs-studio/plugins/obs-text-pthread.nix
index e4f748bc0a86..a236507f4d36 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-text-pthread.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-text-pthread.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-text-pthread";
-  version = "2.0.7";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "norihiro";
     repo = "obs-text-pthread";
     rev = version;
-    sha256 = "sha256-YjMZfDSO5VRIY+HBGniNV3HG5vs+zbiqfbrPKs9v804=";
+    sha256 = "sha256-Br7cX1/7VYIruLA5107+PjTMNEFAE2P/cvmu5EuXbWI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index bb877c2a7ae3..73325c0d81eb 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -1,9 +1,37 @@
 {
   lib,
-  pkgs,
+  stdenv,
+  buildPackages,
+  bash,
+  bashInteractive,
+  busybox,
+  coreutils,
+  cpio,
+  dpkg,
+  e2fsprogs,
+  fetchurl,
+  glibc,
+  kmod,
+  linux,
+  makeInitrd,
+  makeModulesClosure,
+  mtdutils,
+  rpm,
+  runCommand,
+  util-linux,
+  virtiofsd,
+  writeScript,
+  writeText,
+  xz,
+  zstd,
+
+  # ----------------------------
+  # The following  arguments form the "interface" of `pkgs.vmTools`.
+  # Note that `img` is a real package, but is set to this default in `all-packages.nix`.
+  # ----------------------------
   customQemu ? null,
-  kernel ? pkgs.linux,
-  img ? pkgs.stdenv.hostPlatform.linux-kernel.target,
+  kernel ? linux,
+  img ? stdenv.hostPlatform.linux-kernel.target,
   storeDir ? builtins.storeDir,
   rootModules ? [
     "virtio_pci"
@@ -18,30 +46,11 @@
 }:
 
 let
-  inherit (pkgs)
-    bash
-    bashInteractive
-    busybox
-    cpio
-    coreutils
-    e2fsprogs
-    fetchurl
-    kmod
-    rpm
-    stdenv
-    util-linux
-    buildPackages
-    writeScript
-    writeText
-    runCommand
-    ;
-in
-rec {
-  qemu-common = import ../../../nixos/lib/qemu-common.nix { inherit lib pkgs; };
+  qemu-common = import ../../../nixos/lib/qemu-common.nix { inherit lib stdenv; };
 
   qemu = buildPackages.qemu_kvm;
 
-  modulesClosure = pkgs.makeModulesClosure {
+  modulesClosure = makeModulesClosure {
     kernel = lib.getOutput "modules" kernel;
     inherit rootModules;
     firmware = kernel;
@@ -64,18 +73,18 @@ rec {
 
         # Copy what we need from Glibc.
         cp -p \
-          ${pkgs.stdenv.cc.libc}/lib/ld-*.so.? \
-          ${pkgs.stdenv.cc.libc}/lib/libc.so.* \
-          ${pkgs.stdenv.cc.libc}/lib/libm.so.* \
-          ${pkgs.stdenv.cc.libc}/lib/libresolv.so.* \
-          ${pkgs.stdenv.cc.libc}/lib/libpthread.so.* \
-          ${pkgs.zstd.out}/lib/libzstd.so.* \
-          ${pkgs.xz.out}/lib/liblzma.so.* \
+          ${stdenv.cc.libc}/lib/ld-*.so.? \
+          ${stdenv.cc.libc}/lib/libc.so.* \
+          ${stdenv.cc.libc}/lib/libm.so.* \
+          ${stdenv.cc.libc}/lib/libresolv.so.* \
+          ${stdenv.cc.libc}/lib/libpthread.so.* \
+          ${zstd.out}/lib/libzstd.so.* \
+          ${xz.out}/lib/liblzma.so.* \
           $out/lib
 
         # Copy BusyBox.
-        cp -pd ${pkgs.busybox}/bin/* $out/bin
-        cp -pd ${pkgs.kmod}/bin/* $out/bin
+        cp -pd ${busybox}/bin/* $out/bin
+        cp -pd ${kmod}/bin/* $out/bin
 
         # Run patchelf to make the programs refer to the copied libraries.
         for i in $out/bin/* $out/lib/*; do if ! test -L $i; then nuke-refs $i; fi; done
@@ -179,7 +188,7 @@ rec {
     exec switch_root /fs $command
   '';
 
-  initrd = pkgs.makeInitrd {
+  initrd = makeInitrd {
     contents = [
       {
         object = stage1Init;
@@ -294,8 +303,8 @@ rec {
       ''${diskImage:+diskImage=$diskImage}
       # GitHub Actions runners seems to not allow installing seccomp filter: https://github.com/rcambrj/nix-pi-loader/issues/1#issuecomment-2605497516
       # Since we are running in a sandbox already, the difference between seccomp and none is minimal
-      ${pkgs.virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-store.sock --sandbox none --seccomp none --shared-dir "${storeDir}" &
-      ${pkgs.virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-xchg.sock --sandbox none --seccomp none --shared-dir xchg &
+      ${virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-store.sock --sandbox none --seccomp none --shared-dir "${storeDir}" &
+      ${virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-xchg.sock --sandbox none --seccomp none --shared-dir xchg &
 
       # Wait until virtiofsd has created these sockets to avoid race condition.
       until [[ -e virtio-store.sock ]]; do ${coreutils}/bin/sleep 1; done
@@ -437,8 +446,8 @@ rec {
       stdenv.mkDerivation {
         name = "extract-file-mtd";
         buildInputs = [
-          pkgs.util-linux
-          pkgs.mtdutils
+          util-linux
+          mtdutils
         ];
         buildCommand = ''
           ln -s ${kernel}/lib /lib
@@ -548,9 +557,10 @@ rec {
           # Newer distributions like Fedora 18 require /lib etc. to be
           # symlinked to /usr.
           ${lib.optionalString unifiedSystemDir ''
-            mkdir -p /mnt/usr/bin /mnt/usr/sbin /mnt/usr/lib /mnt/usr/lib64
+            mkdir -p /mnt/usr/bin /mnt/usr/lib /mnt/usr/lib64
             ln -s /usr/bin /mnt/bin
-            ln -s /usr/sbin /mnt/sbin
+            ln -s /usr/bin /mnt/sbin
+            ln -s /usr/bin /mnt/usr/sbin
             ln -s /usr/lib /mnt/lib
             ln -s /usr/lib64 /mnt/lib64
             ${util-linux}/bin/mount -t proc none /mnt/proc
@@ -729,9 +739,9 @@ rec {
 
             PATH=$PATH:${
               lib.makeBinPath [
-                pkgs.dpkg
-                pkgs.glibc
-                pkgs.xz
+                dpkg
+                glibc
+                xz
               ]
             }
 
@@ -826,13 +836,32 @@ rec {
       {
         nativeBuildInputs = [
           buildPackages.perl
+          buildPackages.perlPackages.URI
           buildPackages.perlPackages.XMLSimple
+          buildPackages.zstd
         ];
         inherit archs;
       }
       ''
         ${lib.concatImapStrings (i: pl: ''
-          gunzip < ${pl} > ./packages_${toString i}.xml
+          echo "decompressing ${pl}..."
+          case ${pl} in
+            *.zst)
+              zstd -d < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *.xz | *.lzma)
+              xz -d < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *.bz2)
+              bunzip2 < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *.gz)
+              gunzip < ${pl} > ./packages_${toString i}.xml
+              ;;
+            *)
+              cp ${pl} ./packages_${toString i}.xml
+              ;;
+          esac
         '') packagesLists}
         perl -w ${rpm/rpm-closure.pl} \
           ${
@@ -990,25 +1019,246 @@ rec {
 
   # The set of supported RPM-based distributions.
 
-  rpmDistros = { };
+  rpmDistros = {
+    fedora42x86_64 = {
+      name = "fedora-42-x86_64";
+      fullName = "Fedora 42 (x86_64)";
+      packagesList = fetchurl {
+        url = "https://dl.fedoraproject.org/pub/fedora/linux/releases/42/Everything/x86_64/os/repodata/cd483b35df017d68b73a878a392bbf666a43d75db54c386e4720bc369eb5c3a3-primary.xml.zst";
+        hash = "sha256-zUg7Nd8BfWi3OoeKOSu/ZmpD1121TDhuRyC8Np61w6M=";
+      };
+      urlPrefix = "https://dl.fedoraproject.org/pub/fedora/linux/releases/42/Everything/x86_64/os";
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonFedoraPackages;
+      unifiedSystemDir = true;
+    };
+
+    fedora43x86_64 = {
+      name = "fedora-43-x86_64";
+      fullName = "Fedora 43 (x86_64)";
+      packagesList = fetchurl {
+        url = "https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os/repodata/fffa3e9f63fffd3d21b8ea5e9bb0fe349a7ed1d4e09777a618cec93a2bcc305f-primary.xml.zst";
+        hash = "sha256-//o+n2P//T0huOpem7D+NJp+0dTgl3emGM7JOivMMF8=";
+      };
+      urlPrefix = "https://dl.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os";
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonFedoraPackages ++ [ "gpgverify" ];
+      unifiedSystemDir = true;
+    };
+
+    # Rocky Linux's /pub/rocky/9/ URL is rolling and changes with each minor release. We use the
+    # vault instead, which provides stable URLs for specific minor versions.
+    rocky9x86_64 = {
+      name = "rocky-9.6-x86_64";
+      fullName = "Rocky Linux 9.6 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/9.6/BaseOS/x86_64/os/repodata/9965e429a90787a87a07eed62872d046411fb7dded524b96d74c4ce1eade327a-primary.xml.gz";
+          hash = "sha256-mWXkKakHh6h6B+7WKHLQRkEft93tUkuW10xM4ereMno=";
+        })
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/9.6/AppStream/x86_64/os/repodata/8cc9f795679c3365c06b6135f685ebf4188a5863a5f52f09f8cabd4f09c4dfa1-primary.xml.gz";
+          hash = "sha256-jMn3lWecM2XAa2E19oXr9BiKWGOl9S8J+Mq9TwnE36E=";
+        })
+      ];
+      urlPrefixes = [
+        "https://dl.rockylinux.org/vault/rocky/9.6/BaseOS/x86_64/os"
+        "https://dl.rockylinux.org/vault/rocky/9.6/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonRockyPackages ++ [
+        "annobin"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    # Rocky Linux's /pub/rocky/10/ URL is rolling and changes with each minor release. We use the
+    # vault instead, which provides stable URLs for specific minor versions.
+    rocky10x86_64 = {
+      name = "rocky-10.0-x86_64";
+      fullName = "Rocky Linux 10.0 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/10.0/BaseOS/x86_64/os/repodata/484d5c43cdb1058dd1328a6b891f45c85f1cb2620c528f2ef423d4b9feb9e2f0-primary.xml.gz";
+          hash = "sha256-SE1cQ82xBY3RMopriR9FyF8csmIMUo8u9CPUuf654vA=";
+        })
+        (fetchurl {
+          url = "https://dl.rockylinux.org/vault/rocky/10.0/AppStream/x86_64/os/repodata/32c93064142d89f3f19c11e92642c5abd8368418f7ab3f3bdd752e4afa9b5b23-primary.xml.gz";
+          hash = "sha256-MskwZBQtifPxnBHpJkLFq9g2hBj3qz873XUuSvqbWyM=";
+        })
+      ];
+      urlPrefixes = [
+        "https://dl.rockylinux.org/vault/rocky/10.0/BaseOS/x86_64/os"
+        "https://dl.rockylinux.org/vault/rocky/10.0/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonRockyPackages ++ [
+        "annobin-plugin-gcc"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    # AlmaLinux's repo.almalinux.org URLs are rolling and change with each minor release.
+    # We use vault.almalinux.org instead, which provides stable URLs for specific versions.
+    alma9x86_64 = {
+      name = "alma-9.6-x86_64";
+      fullName = "AlmaLinux 9.6 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://vault.almalinux.org/9.6/BaseOS/x86_64/os/repodata/26d6cf944c86ef850773e61919e892a375ff10bb2254003e1d71673db9900b07-primary.xml.gz";
+          hash = "sha256-JtbPlEyG74UHc+YZGeiSo3X/ELsiVAA+HXFnPbmQCwc=";
+        })
+        (fetchurl {
+          url = "https://vault.almalinux.org/9.6/AppStream/x86_64/os/repodata/afb5d18b78d819d826d3d0e32ba439da7b9e0fd91d726dd833366496b1b8ca20-primary.xml.gz";
+          hash = "sha256-r7XRi3jYGdgm09DjK6Q52nueD9kdcm3YMzZklrG4yiA=";
+        })
+      ];
+      urlPrefixes = [
+        "https://vault.almalinux.org/9.6/BaseOS/x86_64/os"
+        "https://vault.almalinux.org/9.6/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonAlmaPackages ++ [
+        "annobin"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    alma10x86_64 = {
+      name = "alma-10.0-x86_64";
+      fullName = "AlmaLinux 10.0 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://vault.almalinux.org/10.0/BaseOS/x86_64/os/repodata/4d88695fa7ccb6298897fa9682ac1ded4628df342ffe08312846225e4469e3e4-primary.xml.gz";
+          hash = "sha256-TYhpX6fMtimIl/qWgqwd7UYo3zQv/ggxKEYiXkRp4+Q=";
+        })
+        (fetchurl {
+          url = "https://vault.almalinux.org/10.0/AppStream/x86_64/os/repodata/11ac32065bae6f2c2451803458690fc550e79f93a4ea9f438930f0c228964791-primary.xml.gz";
+          hash = "sha256-EawyBluubywkUYA0WGkPxVDnn5Ok6p9DiTDwwiiWR5E=";
+        })
+      ];
+      urlPrefixes = [
+        "https://vault.almalinux.org/10.0/BaseOS/x86_64/os"
+        "https://vault.almalinux.org/10.0/AppStream/x86_64/os"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonAlmaPackages ++ [
+        "annobin-plugin-gcc"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    # Oracle provides versioned URLs for baseos (e.g., OL9/7/baseos/base/) but not for appstream.
+    # We can't mix versioned baseos with rolling appstream due to package version dependencies,
+    # so we use rolling URLs for both. These may need hash updates when Oracle releases new versions.
+    oracle9x86_64 = {
+      name = "oracle-9-x86_64";
+      fullName = "Oracle Linux 9 (x86_64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://yum.oracle.com/repo/OracleLinux/OL9/baseos/latest/x86_64/repodata/bc292d67f73fc606db1872d5ba8804da06a514efe64523247035f0d3b678fb63-primary.xml.gz";
+          hash = "sha256-vCktZ/c/xgbbGHLVuogE2galFO/mRSMkcDXw07Z4+2M=";
+        })
+        (fetchurl {
+          url = "https://yum.oracle.com/repo/OracleLinux/OL9/appstream/x86_64/repodata/6fabacadf7cdf22cbb21dc296f58e6b852d5b8ec9a927e214231477ef90083f9-primary.xml.gz";
+          hash = "sha256-b6usrffN8iy7Idwpb1jmuFLVuOyakn4hQjFHfvkAg/k=";
+        })
+      ];
+      urlPrefixes = [
+        "https://yum.oracle.com/repo/OracleLinux/OL9/baseos/latest/x86_64"
+        "https://yum.oracle.com/repo/OracleLinux/OL9/appstream/x86_64"
+      ];
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonOraclePackages ++ [
+        "annobin"
+      ];
+      unifiedSystemDir = true;
+    };
+
+    # Amazon Linux 2023 uses GUID-based URLs that don't allow directory listing.
+    # To update: The GUID corresponds to a specific AL2023 release version. You can find the
+    # current GUID by either:
+    #   1. Running an AL2023 container: `docker run -it amazonlinux:2023 dnf repolist -v`
+    #      and extracting the GUID from the Repo-baseurl field
+    #   2. Checking https://github.com/docker-library/repo-info/blob/master/repos/amazonlinux/local/latest.md
+    #      which tracks the repository URLs from the official Docker image
+    # Release notes: https://docs.aws.amazon.com/linux/al2023/release-notes/relnotes.html
+    amazon2023x86_64 = {
+      name = "amazon-2023-x86_64";
+      fullName = "Amazon Linux 2023 (x86_64)";
+      packagesList = fetchurl {
+        url = "https://cdn.amazonlinux.com/al2023/core/guids/6fa961924efb4835a7e8de43c89726dca28a5cf5906f891262d8f78a31ea3aaf/x86_64/repodata/primary.xml.gz";
+        hash = "sha256-Ezdsc8a2aOIbyXvQ/nyanWe1fl089VgtfegaPcu2oo4=";
+      };
+      urlPrefix = "https://cdn.amazonlinux.com/al2023/core/guids/6fa961924efb4835a7e8de43c89726dca28a5cf5906f891262d8f78a31ea3aaf/x86_64";
+      archs = [
+        "noarch"
+        "x86_64"
+      ];
+      packages = commonAmazonPackages ++ [
+        "annobin-plugin-gcc"
+      ];
+      unifiedSystemDir = true;
+    };
+
+  };
 
   # The set of supported Dpkg-based distributions.
 
   debDistros = {
+    # Ubuntu's snapshot service returns the same data for 22.04 regardless of the timestamp in the
+    # URL. The hashes don't change between mirror://ubuntu and snapshot.ubuntu.com, so this is fine.
     ubuntu2204i386 = {
       name = "ubuntu-22.04-jammy-i386";
       fullName = "Ubuntu 22.04 Jammy (i386)";
       packagesLists = [
         (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/main/binary-i386/Packages.xz";
-          sha256 = "sha256-iZBmwT0ep4v+V3sayybbOgZBOFFZwPGpOKtmuLMMVPQ=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/main/binary-i386/Packages.xz";
+          hash = "sha256-iZBmwT0ep4v+V3sayybbOgZBOFFZwPGpOKtmuLMMVPQ=";
         })
         (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/universe/binary-i386/Packages.xz";
-          sha256 = "sha256-DO2LdpZ9rDDBhWj2gvDWd0TJJVZHxKsYTKTi6GXjm1E=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/universe/binary-i386/Packages.xz";
+          hash = "sha256-DO2LdpZ9rDDBhWj2gvDWd0TJJVZHxKsYTKTi6GXjm1E=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/main/binary-i386/Packages.xz";
+          hash = "sha256-g95BtOoMxacZEHMBbcMes4a1P9HKf/QGOMOPr+OKayo=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/universe/binary-i386/Packages.xz";
+          hash = "sha256-VbazaDDJKSUyQchGmw5f+FYAr4PIXWZJSBF0WVC5j+0=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/main/binary-i386/Packages.xz";
+          hash = "sha256-SkP4PqjUAbEMtktR5WQm/3jQl9O0T2VOVTP9QIYIVkQ=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/universe/binary-i386/Packages.xz";
+          hash = "sha256-citjk8LAGSRlXgOXgf3oe9vBCUC6/DJGhRJl/3ppN9c=";
         })
       ];
-      urlPrefix = "mirror://ubuntu";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z";
       packages = commonDebPackages ++ [
         "diffutils"
         "libc-bin"
@@ -1020,15 +1270,31 @@ rec {
       fullName = "Ubuntu 22.04 Jammy (amd64)";
       packagesLists = [
         (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/main/binary-amd64/Packages.xz";
-          sha256 = "sha256-N8tX8VVMv6ccWinun/7hipqMF4K7BWjgh0t/9M6PnBE=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/main/binary-amd64/Packages.xz";
+          hash = "sha256-N8tX8VVMv6ccWinun/7hipqMF4K7BWjgh0t/9M6PnBE=";
         })
         (fetchurl {
-          url = "mirror://ubuntu/dists/jammy/universe/binary-amd64/Packages.xz";
-          sha256 = "sha256-0pyyTJP+xfQyVXBrzn60bUd5lSA52MaKwbsUpvNlXOI=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy/universe/binary-amd64/Packages.xz";
+          hash = "sha256-0pyyTJP+xfQyVXBrzn60bUd5lSA52MaKwbsUpvNlXOI=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/main/binary-amd64/Packages.xz";
+          hash = "sha256-I57YuLZ458RljXfp1xFxqQLGNJh9uu8kQC0hc88XZro=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-updates/universe/binary-amd64/Packages.xz";
+          hash = "sha256-ZXobWMi7tkakZ89GoyKpiRhRxMRXud0DOerSfzz5CPE=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/main/binary-amd64/Packages.xz";
+          hash = "sha256-cifTPY1iyckkaLd7dp+VPRlF0viWKrWXhM8HVWaMuUw=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/jammy-security/universe/binary-amd64/Packages.xz";
+          hash = "sha256-LTSOGbzkv0KrF2JM6oVT1Ml2KQkySXMbKNMBb9AyfQM=";
         })
       ];
-      urlPrefix = "mirror://ubuntu";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z";
       packages = commonDebPackages ++ [
         "diffutils"
         "libc-bin"
@@ -1040,15 +1306,31 @@ rec {
       fullName = "Ubuntu 24.04 Noble (amd64)";
       packagesLists = [
         (fetchurl {
-          url = "mirror://ubuntu/dists/noble/main/binary-amd64/Packages.xz";
-          sha256 = "sha256-KmoZnhAxpcJ5yzRmRtWUmT81scA91KgqqgMjmA3ZJFE=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble/main/binary-amd64/Packages.xz";
+          hash = "sha256-KmoZnhAxpcJ5yzRmRtWUmT81scA91KgqqgMjmA3ZJFE=";
         })
         (fetchurl {
-          url = "mirror://ubuntu/dists/noble/universe/binary-amd64/Packages.xz";
-          sha256 = "sha256-upBX+huRQ4zIodJoCNAMhTif4QHQwUliVN+XI2QFWZo=";
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble/universe/binary-amd64/Packages.xz";
+          hash = "sha256-upBX+huRQ4zIodJoCNAMhTif4QHQwUliVN+XI2QFWZo=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-updates/main/binary-amd64/Packages.xz";
+          hash = "sha256-leBJ29a2C2qdIPdjSSuwkHKUSq8GEC9L0DgdxHWZ55s=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-updates/universe/binary-amd64/Packages.xz";
+          hash = "sha256-CWYA0A4ytptWdClW3ACdIH4hKscblDh5OgxExP4VdJA=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-security/main/binary-amd64/Packages.xz";
+          hash = "sha256-TYs8ugCYqzOleH2OebdrpB8E68PfxB+7sRb+PlfANEo=";
+        })
+        (fetchurl {
+          url = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z/dists/noble-security/universe/binary-amd64/Packages.xz";
+          hash = "sha256-bK9R8CUjLQ1V4GP7/KqZooSnKHF5+T5SuBs0butC82M=";
         })
       ];
-      urlPrefix = "mirror://ubuntu";
+      urlPrefix = "https://snapshot.ubuntu.com/ubuntu/20260101T000000Z";
       packages = commonDebPackages ++ [
         "diffutils"
         "libc-bin"
@@ -1056,137 +1338,147 @@ rec {
     };
 
     debian11i386 = {
-      name = "debian-11.8-bullseye-i386";
-      fullName = "Debian 11.8 Bullseye (i386)";
+      name = "debian-11.11-bullseye-i386";
+      fullName = "Debian 11.11 Bullseye (i386)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bullseye/main/binary-i386/Packages.xz";
-        hash = "sha256-0bKSLLPhEC7FB5D1NA2jaQP0wTe/Qp1ddiA/NDVjRaI=";
+        url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bullseye/main/binary-i386/Packages.xz";
+        hash = "sha256-kUg1VBUO6co/5bKloxncta49191oCeF05Hm399+UuDA=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
 
     debian11x86_64 = {
-      name = "debian-11.8-bullseye-amd64";
-      fullName = "Debian 11.8 Bullseye (amd64)";
+      name = "debian-11.11-bullseye-amd64";
+      fullName = "Debian 11.11 Bullseye (amd64)";
       packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bullseye/main/binary-amd64/Packages.xz";
-        hash = "sha256-CYPsGgQgJZkh3JmbcAQkYDWP193qrkOADOgrMETZIeo=";
+        url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bullseye/main/binary-amd64/Packages.xz";
+        hash = "sha256-HDQFREKX6thkcRwY5kvOSBDbY7SDQKL52BGC2fI1rXE=";
       };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
 
     debian12i386 = {
-      name = "debian-12.2-bookworm-i386";
-      fullName = "Debian 12.2 Bookworm (i386)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bookworm/main/binary-i386/Packages.xz";
-        hash = "sha256-OeN9Q2HFM3GsPNhOa4VhM7qpwT66yUNwC+6Z8SbGEeQ=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      name = "debian-12.12-bookworm-i386";
+      fullName = "Debian 12.12 Bookworm (i386)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm/main/binary-i386/Packages.xz";
+          hash = "sha256-nIijsNoHUYkrL6eiwN4FCLHnJy/Bv/RMvnbMIHvieVI=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm-backports/main/binary-i386/Packages.xz";
+          hash = "sha256-/ja7+DNIKc2ZUIXiocTjLbaD2EPsfeyZcd5ndEMapp4=";
+        })
+      ];
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
 
     debian12x86_64 = {
-      name = "debian-12.2-bookworm-amd64";
-      fullName = "Debian 12.2 Bookworm (amd64)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20231124T031419Z/dists/bookworm/main/binary-amd64/Packages.xz";
-        hash = "sha256-SZDElRfe9BlBwDlajQB79Qdn08rv8whYoQDeVCveKVs=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20231124T031419Z";
+      name = "debian-12.12-bookworm-amd64";
+      fullName = "Debian 12.12 Bookworm (amd64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm/main/binary-amd64/Packages.xz";
+          hash = "sha256-PfjQeu3tXmXZhH7foSD6WyFrvY4PfwSN/v5pBeShIBE=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/bookworm-backports/main/binary-amd64/Packages.xz";
+          hash = "sha256-S3NSvw1kX2zxzMh+WYhY58VUR7iLrTEIuXwwSK6itIs=";
+        })
+      ];
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
 
     debian13i386 = {
-      name = "debian-13.0-trixie-i386";
-      fullName = "Debian 13.0 Trixie (i386)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20250819T202603Z/dists/trixie/main/binary-i386/Packages.xz";
-        hash = "sha256-fXjhaG1Y+kn6iMEtqVZLwYN7lZ0cEQKVfMS3hSHJipY=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20250819T202603Z";
+      name = "debian-13.2-trixie-i386";
+      fullName = "Debian 13.2 Trixie (i386)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie/main/binary-i386/Packages.xz";
+          hash = "sha256-9zozvFZoWiv3wNe9rb+kPwSOgc5G5f4zmNpdoet5A78=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie-backports/main/binary-i386/Packages.xz";
+          hash = "sha256-hEBAQ73Jnv8zp9YvNXWLEObyrSlQNBNBj/XoofJL7eI=";
+        })
+      ];
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
 
     debian13x86_64 = {
-      name = "debian-13.0-trixie-amd64";
-      fullName = "Debian 13.0 Trixie (amd64)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20250819T202603Z/dists/trixie/main/binary-amd64/Packages.xz";
-        hash = "sha256-15cDoCcTv3m5fiZqP1hqWWnSG1BVUZSrm5YszTSKQs4=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20250819T202603Z";
+      name = "debian-13.2-trixie-amd64";
+      fullName = "Debian 13.2 Trixie (amd64)";
+      packagesLists = [
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie/main/binary-amd64/Packages.xz";
+          hash = "sha256-g7f+tKljUXAC4gxJfzSC8+j0GbiwRZjonv25tYuvxtU=";
+        })
+        (fetchurl {
+          url = "https://snapshot.debian.org/archive/debian/20260105T082626Z/dists/trixie-backports/main/binary-amd64/Packages.xz";
+          hash = "sha256-9OoR36FsyK7MQMLHLFMRJ9O11WKq9JCfGwnprpztxNw=";
+        })
+      ];
+      urlPrefix = "https://snapshot.debian.org/archive/debian/20260105T082626Z";
       packages = commonDebianPackages;
     };
   };
 
-  # Common packages for Fedora images.
-  commonFedoraPackages = [
+  # Base packages for all RHEL-family distros (Fedora, Rocky, Alma, etc.)
+  baseRHELFamilyPackages = [
     "autoconf"
     "automake"
     "basesystem"
     "bzip2"
     "curl"
     "diffutils"
+    "findutils"
+    "gawk"
+    "gcc-c++"
+    "glibc-gconv-extra"
+    "gzip"
+    "make"
+    "patch"
+    "perl"
+    "rpm"
+    "rpm-build"
+    "tar"
+    "unzip"
+  ];
+
+  commonFedoraPackages = baseRHELFamilyPackages ++ [
+    "annobin-plugin-gcc"
     "fedora-release"
-    "findutils"
-    "gawk"
-    "gcc-c++"
-    "gzip"
-    "make"
-    "patch"
-    "perl"
+    "gcc-plugin-annobin"
     "pkgconf-pkg-config"
-    "rpm"
-    "rpm-build"
-    "tar"
-    "unzip"
   ];
 
-  commonCentOSPackages = [
-    "autoconf"
-    "automake"
-    "basesystem"
-    "bzip2"
-    "curl"
-    "diffutils"
-    "centos-release"
-    "findutils"
-    "gawk"
-    "gcc-c++"
-    "gzip"
-    "make"
-    "patch"
-    "perl"
-    "pkgconfig"
-    "rpm"
-    "rpm-build"
-    "tar"
-    "unzip"
+  commonRockyPackages = baseRHELFamilyPackages ++ [
+    "gcc-plugin-annobin"
+    "pkgconf"
+    "rocky-release"
   ];
 
-  commonRHELPackages = [
-    "autoconf"
-    "automake"
-    "basesystem"
-    "bzip2"
-    "curl"
-    "diffutils"
-    "findutils"
-    "gawk"
-    "gcc-c++"
-    "gzip"
-    "make"
-    "patch"
-    "perl"
-    "pkgconfig"
-    "procps-ng"
-    "rpm"
-    "rpm-build"
-    "tar"
-    "unzip"
+  commonAlmaPackages = baseRHELFamilyPackages ++ [
+    "almalinux-release"
+    "gcc-plugin-annobin"
+    "pkgconf"
+  ];
+
+  commonOraclePackages = baseRHELFamilyPackages ++ [
+    "gcc-plugin-annobin"
+    "oraclelinux-release"
+    "pkgconf"
+  ];
+
+  commonAmazonPackages = baseRHELFamilyPackages ++ [
+    "gcc-plugin-annobin"
+    "pkgconf"
+    "system-release"
   ];
 
   # Common packages for openSUSE images.
@@ -1284,5 +1576,39 @@ rec {
     `debDistros' sets.
   */
   diskImages = lib.mapAttrs (name: f: f { }) diskImageFuns;
-
+in
+{
+  inherit
+    buildRPM
+    commonDebPackages
+    commonDebianPackages
+    commonFedoraPackages
+    commonOpenSUSEPackages
+    createEmptyImage
+    debClosureGenerator
+    debDistros
+    defaultCreateRootFS
+    diskImageExtraFuns
+    diskImageFuns
+    diskImages
+    extractFs
+    extractMTDfs
+    fillDiskWithDebs
+    fillDiskWithRPMs
+    hd
+    initrd
+    initrdUtils
+    makeImageFromDebDist
+    makeImageFromRPMDist
+    makeImageTestScript
+    modulesClosure
+    qemu
+    rpmClosureGenerator
+    rpmDistros
+    runInLinuxImage
+    runInLinuxVM
+    stage1Init
+    stage2Init
+    vmRunCommand
+    ;
 }
diff --git a/pkgs/build-support/vm/rpm/rpm-closure.pl b/pkgs/build-support/vm/rpm/rpm-closure.pl
index 6442cd91a957..a11adc27ac10 100644
--- a/pkgs/build-support/vm/rpm/rpm-closure.pl
+++ b/pkgs/build-support/vm/rpm/rpm-closure.pl
@@ -1,6 +1,7 @@
 use strict;
 use XML::Simple;
 use List::Util qw(min);
+use URI::Escape;
 
 my @packagesFiles = ();
 my @urlPrefixes = ();
@@ -156,7 +157,13 @@ sub closePackage {
 
 
 foreach my $pkgName (@toplevelPkgs) {
-    closePackage $pkgName;
+    # If the package doesn't exist by name, check if something provides it
+    if (!defined $pkgs{$pkgName} && defined $provides{$pkgName}) {
+        print STDERR "package $pkgName is provided by $provides{$pkgName}\n";
+        closePackage $provides{$pkgName};
+    } else {
+        closePackage $pkgName;
+    }
 }
 
 
@@ -168,8 +175,13 @@ print "[\n\n";
 
 foreach my $pkgName (@needed) {
     my $pkg = $pkgs{$pkgName};
+    # URL-encode each path segment separately to handle special characters like '+'
+    my $href = $pkg->{location}->{href};
+    my @segments = split('/', $href);
+    my @encoded_segments = map { uri_escape($_) } @segments;
+    my $encoded_href = join('/', @encoded_segments);
     print "  (fetchurl {\n";
-    print "    url = $pkg->{urlPrefix}/$pkg->{location}->{href};\n";
+    print "    url = \"$pkg->{urlPrefix}/$encoded_href\";\n";
     if ($pkg->{checksum}->{type} eq "sha") {
         print "    sha1 = \"$pkg->{checksum}->{content}\";\n";
     } elsif ($pkg->{checksum}->{type} eq "sha256") {
diff --git a/pkgs/build-support/vm/test.nix b/pkgs/build-support/vm/test.nix
index 313ca50e55f9..3a7adcbd216e 100644
--- a/pkgs/build-support/vm/test.nix
+++ b/pkgs/build-support/vm/test.nix
@@ -1,14 +1,12 @@
+{
+  hello,
+  patchelf,
+  pcmanfm,
+  stdenv,
+  vmTools,
+}:
 let
-  pkgs = import ../../.. { };
-
-  inherit (pkgs)
-    hello
-    patchelf
-    pcmanfm
-    stdenv
-    ;
-
-  inherit (pkgs.vmTools)
+  inherit (vmTools)
     buildRPM
     diskImages
     makeImageTestScript
@@ -18,12 +16,28 @@ let
 in
 
 {
-
-  # Run the PatchELF derivation in a VM.
   buildPatchelfInVM = runInLinuxVM patchelf;
+  buildPatchelfInDebian = runInLinuxImage (
+    stdenv.mkDerivation {
+      inherit (patchelf) pname version src;
+
+      diskImage = diskImages.debian13x86_64;
+      diskImageFormat = "qcow2";
+      memSize = 512;
+    }
+  );
 
   buildHelloInVM = runInLinuxVM hello;
   buildStructuredAttrsHelloInVM = runInLinuxVM (hello.overrideAttrs { __structuredAttrs = true; });
+  buildHelloInFedora = runInLinuxImage (
+    stdenv.mkDerivation {
+      inherit (hello) pname version src;
+
+      diskImage = diskImages.fedora42x86_64;
+      diskImageFormat = "qcow2";
+      memSize = 512;
+    }
+  );
 
   buildPcmanrmInVM = runInLinuxVM (
     pcmanfm.overrideAttrs (old: {
@@ -32,28 +46,24 @@ in
     })
   );
 
-  testRPMImage = makeImageTestScript diskImages.fedora27x86_64;
-
-  buildPatchelfRPM = buildRPM {
-    name = "patchelf-rpm";
-    src = patchelf.src;
-    diskImage = diskImages.fedora27x86_64;
-    diskImageFormat = "qcow2";
-  };
-
-  testUbuntuImage = makeImageTestScript diskImages.ubuntu1804i386;
-
-  buildInDebian = runInLinuxImage (
-    stdenv.mkDerivation {
-      name = "deb-compile";
-      src = patchelf.src;
-      diskImage = diskImages.ubuntu1804i386;
-      diskImageFormat = "qcow2";
-      memSize = 512;
-      postHook = ''
-        dpkg-query --list
-      '';
-    }
-  );
+  # RPM-based distros
+  testFedora42Image = makeImageTestScript diskImages.fedora42x86_64;
+  testFedora43Image = makeImageTestScript diskImages.fedora43x86_64;
+  testRocky9Image = makeImageTestScript diskImages.rocky9x86_64;
+  testRocky10Image = makeImageTestScript diskImages.rocky10x86_64;
+  testAlma9Image = makeImageTestScript diskImages.alma9x86_64;
+  testAlma10Image = makeImageTestScript diskImages.alma10x86_64;
+  testOracle9Image = makeImageTestScript diskImages.oracle9x86_64;
+  testAmazon2023Image = makeImageTestScript diskImages.amazon2023x86_64;
 
+  # Debian-based distros
+  testDebian11i386Image = makeImageTestScript diskImages.debian11i386;
+  testDebian11x86_64Image = makeImageTestScript diskImages.debian11x86_64;
+  testDebian12i386Image = makeImageTestScript diskImages.debian12i386;
+  testDebian12x86_64Image = makeImageTestScript diskImages.debian12x86_64;
+  testDebian13i386Image = makeImageTestScript diskImages.debian13i386;
+  testDebian13x86_64Image = makeImageTestScript diskImages.debian13x86_64;
+  testUbuntu2204i386Image = makeImageTestScript diskImages.ubuntu2204i386;
+  testUbuntu2204x86_64Image = makeImageTestScript diskImages.ubuntu2204x86_64;
+  testUbuntu2404x86_64Image = makeImageTestScript diskImages.ubuntu2404x86_64;
 }
diff --git a/pkgs/by-name/ad/adguardhome/package.nix b/pkgs/by-name/ad/adguardhome/package.nix
index b175a5ea5a38..124f19ca0a04 100644
--- a/pkgs/by-name/ad/adguardhome/package.nix
+++ b/pkgs/by-name/ad/adguardhome/package.nix
@@ -9,15 +9,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "adguardhome";
-  version = "0.107.69";
+  version = "0.107.71";
   src = fetchFromGitHub {
     owner = "AdguardTeam";
     repo = "AdGuardHome";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eUMssp4rYmkreYdaSDlYP0bQsZgsrrN9e65UF7NseN8=";
+    hash = "sha256-uyDmS/C1nd0DEHy91tMw/2W5Rih/0j59yxGCwTjFjPc=";
   };
 
-  vendorHash = "sha256-qee3ifDDR1U23VZAu0gj1CPPaDrSQfwfrKte1OUZPlE=";
+  vendorHash = "sha256-KSDvI7SljFUZSUFytT1U76HzQydv3rNsOmDMKCXDl6M=";
 
   dashboard = buildNpmPackage {
     inherit (finalAttrs) src version;
@@ -45,7 +45,7 @@ buildGoModule (finalAttrs: {
 
   passthru = {
     updateScript = ./update.sh;
-    schema_version = 31;
+    schema_version = 32;
     tests.adguardhome = nixosTests.adguardhome;
     tests.version = testers.testVersion {
       package = finalAttrs.finalPackage;
diff --git a/pkgs/by-name/al/altair/package.nix b/pkgs/by-name/al/altair/package.nix
index 160c2e3cb69b..6f46cf3feabd 100644
--- a/pkgs/by-name/al/altair/package.nix
+++ b/pkgs/by-name/al/altair/package.nix
@@ -7,11 +7,11 @@
 
 let
   pname = "altair";
-  version = "8.3.0";
+  version = "8.5.0";
 
   src = fetchurl {
     url = "https://github.com/imolorhe/altair/releases/download/v${version}/altair_${version}_x86_64_linux.AppImage";
-    sha256 = "sha256-uLqtrF5WWJ5+6bN/h4u/vdvTlbQtZID1osujfuJad4U=";
+    sha256 = "sha256-ImcnV+Z1J+6wGs3HmlCpXmLb/BbyEcunY+IZ2cbD8Ns=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/by-name/aw/aws-vault/package.nix b/pkgs/by-name/aw/aws-vault/package.nix
index 0dfbf8311fee..d65ce380545a 100644
--- a/pkgs/by-name/aw/aws-vault/package.nix
+++ b/pkgs/by-name/aw/aws-vault/package.nix
@@ -10,17 +10,17 @@
 }:
 buildGoModule rec {
   pname = "aws-vault";
-  version = "7.8.6";
+  version = "7.8.7";
 
   src = fetchFromGitHub {
     owner = "ByteNess";
     repo = "aws-vault";
     rev = "v${version}";
-    hash = "sha256-nULl68DMTqrVXlPmJlp7M3EZ+MiGR9FsWKIRaa2i91I=";
+    hash = "sha256-q4I/sCFo8svf+XL+Eln5TWLvj1ggaRjUplSgV6M0f9s=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-tuOrD2NjcjmjosI1bW2F7xEwGLNOMDNxFpEfODF9FHs=";
+  vendorHash = "sha256-tsIyY+L3Bvv/3uvRVkCGK4cAZXQyZSa0mUPDg8Aqml8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/bi/biome/package.nix b/pkgs/by-name/bi/biome/package.nix
index b6e450ca832a..0b8119e4702c 100644
--- a/pkgs/by-name/bi/biome/package.nix
+++ b/pkgs/by-name/bi/biome/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "biome";
-  version = "2.3.9";
+  version = "2.3.11";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-2eW60IoEeh3pnnsnZLdS6paw0f6vf+2LBM95WyOKDwc=";
+    hash = "sha256-AWVFrzIDg+mVnUYTMLr10o8IOSvewVhVMcYd2wvT5y0=";
   };
 
-  cargoHash = "sha256-WSl/OObiOXx4MJcnGQtvGVfM2i5k8lLIQoPy9s+GT/U=";
+  cargoHash = "sha256-N2TauXj1pRrYnVD0qPtruy7qwdWBGJaa47++AaY8TMQ=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/du/dua/package.nix b/pkgs/by-name/du/dua/package.nix
index d86c9a566447..09711f351e85 100644
--- a/pkgs/by-name/du/dua/package.nix
+++ b/pkgs/by-name/du/dua/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dua";
-  version = "2.32.2";
+  version = "2.33.0";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "dua-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MB5uePy32jTvOtkQKcP9peFPqwR68E+NZ7UGMuLx8Eo=";
+    hash = "sha256-3Mlhz+vYeDSoVLuBFAtgJxrECwUchSWIusrLKqhxU30=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-6H0x6I3nkCezu4/Hguv0XTdl+3QiyPL8Ue1rqTQU7VA=";
+  cargoHash = "sha256-85I+rWomp+2G1DLbwowHDSrRm6dS4b99Ia24ffY7Fnk=";
 
   checkFlags = [
     # Skip interactive tests
diff --git a/pkgs/by-name/fi/fish/package.nix b/pkgs/by-name/fi/fish/package.nix
index eb8748075079..e9179633a25f 100644
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@@ -163,6 +163,8 @@ stdenv.mkDerivation (finalAttrs: {
     FISH_BUILD_VERSION = finalAttrs.version;
     # Skip tests that are known to be flaky in CI
     CI = 1;
+    # really skip them all https://github.com/fish-shell/fish-shell/issues/12253#issuecomment-3707996020
+    FISH_CI_SAN = 1;
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/by-name/in/inshellisense/package.nix b/pkgs/by-name/in/inshellisense/package.nix
index c535edbbd344..3ce3096982d6 100644
--- a/pkgs/by-name/in/inshellisense/package.nix
+++ b/pkgs/by-name/in/inshellisense/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildNpmPackage,
   fetchFromGitHub,
+  nodejs_22,
   cacert,
 }:
 
@@ -17,6 +18,10 @@ buildNpmPackage rec {
     hash = "sha256-zERwrvioPwGm/351kYuK9S3uOrrzs/6OFPRdNSSr7Tc=";
   };
 
+  # Building against nodejs-24 is not yet supported by upstream.
+  # https://github.com/microsoft/inshellisense/issues/369
+  nodejs = nodejs_22;
+
   npmDepsHash = "sha256-iD5SvkVbrHh0Hx44y6VtNerwBA8K7vSe/yfvhgndMEw=";
 
   # Needed for dependency `@homebridge/node-pty-prebuilt-multiarch`
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 5ee9c05a017d..238f21a95b06 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "10.6.0";
+  version = "10.6.1";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-rNLPfDHYVGOzO7pnv7w+l8kevmKPFFJ3O5MtPN6YlG4=";
+    hash = "sha256-juCivgLVpGY7hiHLMhZwhTTcIPA2CfYyKHTp8Oy33mI=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/lm/lms/package.nix b/pkgs/by-name/lm/lms/package.nix
index 59f17dcfd316..3137d88a0563 100644
--- a/pkgs/by-name/lm/lms/package.nix
+++ b/pkgs/by-name/lm/lms/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lms";
-  version = "3.73.0";
+  version = "3.74.0";
 
   src = fetchFromGitHub {
     owner = "epoupon";
     repo = "lms";
     rev = "v${version}";
-    hash = "sha256-9m1YvuYuiiEXAX8HFt61VGZN/ThYXdBcwOSeL05mwOU=";
+    hash = "sha256-D1Sg6XzZ8t/dFKrVh7k+KGLg2r6LeLGJk4FweVb4L1A=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/lu/lurk/package.nix b/pkgs/by-name/lu/lurk/package.nix
index f6ff6aee0e48..f3a737cefadd 100644
--- a/pkgs/by-name/lu/lurk/package.nix
+++ b/pkgs/by-name/lu/lurk/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lurk";
-  version = "0.3.10";
+  version = "0.3.11";
 
   src = fetchFromGitHub {
     owner = "jakwai01";
     repo = "lurk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5riwosaT7QjRFnIFRAcyLul7i1g8OpHyUuuJNOROTF0=";
+    hash = "sha256-Sng+mMMKDuI1aSgusJDRFMT5iKNUlp9arp9ruRn0bb0=";
   };
 
-  cargoHash = "sha256-CDrqcKNhQYbtDaasyCQ6VPGdIrW34VBKPDpbFeommAc=";
+  cargoHash = "sha256-Cmlhhda35FmNg/OvfMRPHBLPRXF5bs0ebBYT7KfierA=";
 
   postPatch = ''
     substituteInPlace src/lib.rs \
diff --git a/pkgs/by-name/ne/neverball/package.nix b/pkgs/by-name/ne/neverball/package.nix
index 9526c928c514..ecc9828ab8dd 100644
--- a/pkgs/by-name/ne/neverball/package.nix
+++ b/pkgs/by-name/ne/neverball/package.nix
@@ -12,6 +12,8 @@
   libvorbis,
   gettext,
   physfs,
+  iconv,
+  makeBinaryWrapper,
 }:
 
 stdenv.mkDerivation rec {
@@ -31,6 +33,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    iconv
+    makeBinaryWrapper
+  ];
   buildInputs = [
     libpng
     SDL2
@@ -38,9 +44,11 @@ stdenv.mkDerivation rec {
     libjpeg
     SDL2_ttf
     libvorbis
-    libX11
     gettext
     physfs
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    libX11
   ];
 
   dontPatchELF = true;
@@ -48,7 +56,21 @@ stdenv.mkDerivation rec {
   postPatch = ''
     sed -i -e 's@\./data@'$out/share/neverball/data@ share/base_config.h Makefile
     sed -i -e 's@\./locale@'$out/share/neverball/locale@ share/base_config.h Makefile
-    sed -i -e 's@-lvorbisfile@-lvorbisfile -lX11 -lgcc_s@' Makefile
+    sed -i -e 's@-lvorbisfile@-lvorbisfile${
+      lib.optionalString (!stdenv.hostPlatform.isDarwin) " -lX11"
+      + lib.optionalString stdenv.cc.isGNU " -lgcc_s"
+    }@' Makefile
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    for game in ball putt; do
+      pushd macosx/xcode/''${game}_items/
+      substituteInPlace Info.plist --replace-fail '1.5.3' "$version"
+      iconv -f UTF-16LE -t UTF-8 English.lproj/InfoPlist.strings > English.lproj/InfoPlist.strings.tmp
+      substituteInPlace English.lproj/InfoPlist.strings.tmp --replace-fail '1.5.3' "$version" --replace-fail '2002-2009' '2002-2014'
+      iconv -f UTF-8 -t UTF-16LE English.lproj/InfoPlist.strings.tmp > English.lproj/InfoPlist.strings
+      rm English.lproj/InfoPlist.strings.tmp
+      popd
+    done
   '';
 
   # The map generation code requires a writable HOME
@@ -57,8 +79,23 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin $out/share/neverball
     cp -R data locale $out/share/neverball
-    cp neverball $out/bin
-    cp neverputt $out/bin
+    ${
+      if stdenv.hostPlatform.isDarwin then
+        ''
+          mkdir -p $out/Applications/Never{ball,putt}.app/Contents/{MacOS,Resources}
+          for game in ball putt; do
+            cp never$game $out/Applications/Never$game.app/Contents/MacOS/Never$game
+            makeWrapper $out/Applications/Never$game.app/Contents/MacOS/Never$game $out/bin/never$game
+            cp macosx/xcode/''${game}_items/Info.plist $out/Applications/Never$game.app/Contents/Info.plist
+            cp -r macosx/icons/never$game.icns macosx/xcode/''${game}_items/English.lproj $out/Applications/Never$game.app/Contents/Resources/
+          done
+        ''
+      else
+        ''
+          cp neverball $out/bin
+          cp neverputt $out/bin
+        ''
+    }
     cp mapc $out/bin
   '';
 
@@ -73,7 +110,7 @@ stdenv.mkDerivation rec {
       mit
       gpl3Only
     ];
-    maintainers = [ ];
-    platforms = with lib.platforms; linux;
+    maintainers = with lib.maintainers; [ Rhys-T ];
+    platforms = with lib.platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/by-name/ne/newsraft/package.nix b/pkgs/by-name/ne/newsraft/package.nix
index 4443bc9943a4..8afd52549f36 100644
--- a/pkgs/by-name/ne/newsraft/package.nix
+++ b/pkgs/by-name/ne/newsraft/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "newsraft";
-  version = "0.34";
+  version = "0.35";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "newsraft";
     repo = "newsraft";
     rev = "newsraft-${finalAttrs.version}";
-    hash = "sha256-o02NAIkT98GJAcAlj04L6sVYcx/x+JOefxkK8llEqYM=";
+    hash = "sha256-c1IlPs+GxwDeUCpyQ6oy9iLC3YNLCJpjkj1gnwY7lxA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/ne/nezha-agent/package.nix b/pkgs/by-name/ne/nezha-agent/package.nix
index 5ac493fa03fc..4b99d7a475b6 100644
--- a/pkgs/by-name/ne/nezha-agent/package.nix
+++ b/pkgs/by-name/ne/nezha-agent/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "nezha-agent";
-  version = "1.14.1";
+  version = "1.14.3";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1p/YEAIa0+9FC+TuNHdv7WSXzDJBS7zgrocNJZ0Tuk0=";
+    hash = "sha256-/DDk57rUXiACQaXl4KTMiOFFMopHtYvRI4vnPORseFE=";
   };
 
   vendorHash = "sha256-A0oVUyCflbEY3vBbJwy7cF2m1x9vHCY2jAOsrm3659E=";
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 1d6076a7b127..7d91031028ed 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -9,16 +9,17 @@
   nix-update-script,
   ripgrep,
   testers,
+  installShellFiles,
   writableTmpDirAsHomeHook,
 }:
 let
   pname = "opencode";
-  version = "1.0.224";
+  version = "1.1.3";
   src = fetchFromGitHub {
-    owner = "sst";
+    owner = "anomalyco";
     repo = "opencode";
     tag = "v${version}";
-    hash = "sha256-4ozluoXTovh1wpWVzxCN4jUO7cMxZER/0KMOBsJFO64=";
+    hash = "sha256-uNeje6WZ/FJVOtxdTdWXbWhPl7BwMws+7/Iz2Hz/stw=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -70,7 +71,7 @@ let
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-+HEd3I11VqejTi7cikbTL5+DmNGyvUC4Cm4ysfujwes=";
+    outputHash = "sha256-LJ7xgKQP0ows76P8QVflS6SGGowVBYVvarkmCVkfe60=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };
@@ -85,8 +86,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     bun
+    installShellFiles
     makeBinaryWrapper
     models-dev
+    writableTmpDirAsHomeHook
   ];
 
   patches = [
@@ -197,6 +200,17 @@ stdenvNoCC.mkDerivation (finalAttrs: {
           $out/lib/opencode/node_modules/@opentui/$pkgName
       fi
     done
+
+    ${lib.optionalString
+      (
+        (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform)
+        && (stdenvNoCC.hostPlatform.system != "x86_64-darwin")
+      )
+      ''
+        installShellCompletion --cmd opencode \
+          --bash <($out/bin/opencode completion)
+      ''
+    }
   '';
 
   passthru = {
@@ -221,7 +235,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       It combines a TypeScript/JavaScript core with a Go-based TUI
       to provide an interactive AI coding experience.
     '';
-    homepage = "https://github.com/sst/opencode";
+    homepage = "https://github.com/anomalyco/opencode";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ delafthi ];
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
diff --git a/pkgs/by-name/pr/prisma-engines_6/package.nix b/pkgs/by-name/pr/prisma-engines_6/package.nix
index c49edabc8d2d..74f5d5964d3d 100644
--- a/pkgs/by-name/pr/prisma-engines_6/package.nix
+++ b/pkgs/by-name/pr/prisma-engines_6/package.nix
@@ -10,14 +10,14 @@
 # Updating this package will force an update for prisma. The
 # version of prisma-engines and prisma must be the same for them to
 # function correctly.
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prisma-engines_6";
   version = "6.19.1";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma-engines";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-z3GdnrLEMJIGPKXXbz2wrbiGpuNlgYxqg3iYINYTnPI=";
   };
 
@@ -70,7 +70,7 @@ rustPlatform.buildRustPackage rec {
       aqrln
     ];
   };
-}
+})
 
 ### Troubleshooting
 # Here's an example application using Prisma with Nix: https://github.com/pimeys/nix-prisma-example
diff --git a/pkgs/by-name/pr/prisma-engines_7/package.nix b/pkgs/by-name/pr/prisma-engines_7/package.nix
index 88164ec1e541..91854e23a96e 100644
--- a/pkgs/by-name/pr/prisma-engines_7/package.nix
+++ b/pkgs/by-name/pr/prisma-engines_7/package.nix
@@ -9,18 +9,18 @@
 # Updating this package will force an update for prisma. The
 # version of prisma-engines and prisma must be the same for them to
 # function correctly.
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prisma-engines_7";
-  version = "7.0.1";
+  version = "7.2.0";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma-engines";
-    tag = version;
-    hash = "sha256-+8k+M2+WySR2CeywYlhU/jd3av/4UeUoEOlO/qHUk5o=";
+    tag = finalAttrs.version;
+    hash = "sha256-1CwpUtNuqxGNjBmmmo/Aet8XrmnCQfDToI7vZaNupDI=";
   };
 
-  cargoHash = "sha256-n83hJfSlvuaoBb3w9Rk8+q2emjGCoPDHhFdoVzhf4sM=";
+  cargoHash = "sha256-U5d/HkuWnD/XSrAJr5AYh+WPVGDOcK/e4sC0udPZoyU=";
 
   # Use system openssl.
   OPENSSL_NO_VENDOR = 1;
@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage rec {
       aqrln
     ];
   };
-}
+})
 
 ### Troubleshooting
 # Here's an example application using Prisma with Nix: https://github.com/pimeys/nix-prisma-example
diff --git a/pkgs/by-name/pr/prisma_7/package.nix b/pkgs/by-name/pr/prisma_7/package.nix
index 710c5d4b8051..113c33111ead 100644
--- a/pkgs/by-name/pr/prisma_7/package.nix
+++ b/pkgs/by-name/pr/prisma_7/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "prisma_7";
-  version = "7.0.1";
+  version = "7.2.0";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma";
     tag = finalAttrs.version;
-    hash = "sha256-bmmthEFMBMJAracWUCU/6Nyic05JglP5t1VAWPVKFnU=";
+    hash = "sha256-oDfb/RwSa63ErWHF86q5xPPUUsRUV2DwNHARTV5gxyk=";
   };
 
   nativeBuildInputs = [
@@ -36,8 +36,8 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
-    fetcherVersion = 1;
-    hash = "sha256-sJmlMF8nay4/3LTHEWzBWaS8Xq91JRZlzKBfeMnJEMM=";
+    fetcherVersion = 3;
+    hash = "sha256-HZsrHYUh4nxUgwVbmJ+fV4/OZvEWDKkD4CT8hIt1SRY=";
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/ra/raffi/package.nix b/pkgs/by-name/ra/raffi/package.nix
index edebe08a30fe..20af8bf80053 100644
--- a/pkgs/by-name/ra/raffi/package.nix
+++ b/pkgs/by-name/ra/raffi/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "raffi";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "chmouel";
     repo = "raffi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k0NJEv76f33yd+mtCJ7bxzaT3UAn0TOaLC/HlzEXUyo=";
+    hash = "sha256-CjgLxGsx0Ai5kB/XK0ylk8j0rd4ZomZwDHaQAGcYAQw=";
   };
 
-  cargoHash = "sha256-udXVIV6qDmpLR2QNF+/h69WNGbe7QRDD5YWQ3Sl5Ol0=";
+  cargoHash = "sha256-etWO77Um+SCyQU5at55F7V2ljw1cXJsTbex61gN/uUk=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
diff --git a/pkgs/by-name/sh/sherpa/package.nix b/pkgs/by-name/sh/sherpa/package.nix
index c05b4522f66c..8b79450dad1a 100644
--- a/pkgs/by-name/sh/sherpa/package.nix
+++ b/pkgs/by-name/sh/sherpa/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sherpa";
-  version = "3.0.2";
+  version = "3.0.3";
 
   src = fetchFromGitLab {
     owner = "sherpa-team";
     repo = "sherpa";
     tag = "v${version}";
-    hash = "sha256-VlC5MnbrXp2fdO2EtBjtw45Gx6PhF/hcLy0ajlKp10E=";
+    hash = "sha256-bh5C0BYbuAkbPrp27P0oD0yoxd53ViRtmpUKfN7kZ90=";
   };
 
   postPatch = lib.optionalString (stdenv.hostPlatform.libc == "glibc") ''
diff --git a/pkgs/by-name/sl/slade/package.nix b/pkgs/by-name/sl/slade/package.nix
index 85c3758264d1..3dd90e566256 100644
--- a/pkgs/by-name/sl/slade/package.nix
+++ b/pkgs/by-name/sl/slade/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slade";
-  version = "3.2.9";
+  version = "3.2.10";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
     tag = finalAttrs.version;
-    hash = "sha256-N+rCtrfvVJnkfj8kU4ahzF6o7lp1VWJbVmkvaZoxBv8=";
+    hash = "sha256-r1tfp0NomZEETY41wXIDvZbgCbBFEh4oW0qcnr/t/9E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vl/vlc/package.nix b/pkgs/by-name/vl/vlc/package.nix
index 3880b90314b7..94af6b973cc7 100644
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -27,7 +27,7 @@
   libXpm,
   libarchive,
   libass,
-  libbluray,
+  libbluray-full,
   libcaca,
   libcddb,
   libdc1394,
@@ -153,7 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
     libSM
     libarchive
     libass
-    libbluray
+    libbluray-full
     libcaca
     libcddb
     libdc1394
diff --git a/pkgs/by-name/xp/xpra/package.nix b/pkgs/by-name/xp/xpra/package.nix
index fd921eb40923..b2344e9477aa 100644
--- a/pkgs/by-name/xp/xpra/package.nix
+++ b/pkgs/by-name/xp/xpra/package.nix
@@ -48,7 +48,7 @@
   withHtml ? true,
   xpra-html5,
   udevCheckHook,
-}@args:
+}:
 
 let
   inherit (python3.pkgs) cython buildPythonApplication;
@@ -86,14 +86,15 @@ let
     mkdir -p $out/include $out/lib/pkgconfig
     substituteAll ${cudaPackages.libnvjpeg.dev}/share/pkgconfig/nvjpeg.pc $out/lib/pkgconfig/nvjpeg.pc
   '';
+  effectiveBuildPythonApplication = buildPythonApplication.override {
+    stdenv = if withNvenc then cudaPackages.backendStdenv else stdenv;
+  };
 in
-buildPythonApplication rec {
+effectiveBuildPythonApplication rec {
   pname = "xpra";
   version = "6.3.6";
   format = "setuptools";
 
-  stdenv = if withNvenc then cudaPackages.backendStdenv else args.stdenv;
-
   src = fetchFromGitHub {
     owner = "Xpra-org";
     repo = "xpra";
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index 7d8faef7f0f6..15fa0a48d5d5 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -327,22 +327,19 @@ stdenv.mkDerivation (
     };
   }
   // lib.optionalAttrs crossCompiling rec {
-    crossVersion = "1.6.2";
+    crossVersion = "1.6.4";
 
     perl-cross-src = fetchFromGitHub {
       name = "perl-cross-${crossVersion}";
       owner = "arsv";
       repo = "perl-cross";
       rev = crossVersion;
-      hash = "sha256-mG9ny+eXGBL4K/rXqEUPSbar+4Mq4IaQrGRFIHIyAAw=";
+      hash = "sha256-Qcysy7f887XHlq23iE5U92PhxDhpgaluITZBSdcc9Ck=";
     };
     patches = commonPatches ++ [
       # fixes build failure due to missing d_fdopendir/HAS_FDOPENDIR configure option
       # https://github.com/arsv/perl-cross/pull/159
       ./cross-fdopendir.patch
-      # Add patchset for 5.42.0 - Can hopefully be removed once perl-cross is updated
-      # https://github.com/arsv/perl-cross/pull/164
-      ./perl-5.42.0-cross.patch
     ];
 
     depsBuildBuild = [
diff --git a/pkgs/development/interpreters/perl/perl-5.42.0-cross.patch b/pkgs/development/interpreters/perl/perl-5.42.0-cross.patch
deleted file mode 100644
index 66b536b6973d..000000000000
--- a/pkgs/development/interpreters/perl/perl-5.42.0-cross.patch
+++ /dev/null
@@ -1,186 +0,0 @@
-From b47ef629459076a5ccb3d0caf83ccfbb8ba0571b Mon Sep 17 00:00:00 2001
-From: Marcus Ramberg <marcus@means.no>
-Date: Wed, 3 Sep 2025 10:35:58 +0200
-Subject: [PATCH] patches for perl-5.42.0
-
----
- cnf/diffs/perl5-5.42.0/constant.patch       |  1 +
- cnf/diffs/perl5-5.42.0/dynaloader.patch     |  1 +
- cnf/diffs/perl5-5.42.0/findext.patch        |  1 +
- cnf/diffs/perl5-5.42.0/installscripts.patch |  1 +
- cnf/diffs/perl5-5.42.0/liblist.patch        | 80 +++++++++++++++++++++
- cnf/diffs/perl5-5.42.0/makemaker.patch      |  1 +
- cnf/diffs/perl5-5.42.0/posix-makefile.patch |  1 +
- cnf/diffs/perl5-5.42.0/test-checkcase.patch |  1 +
- cnf/diffs/perl5-5.42.0/test-makemaker.patch |  1 +
- cnf/diffs/perl5-5.42.0/xconfig.patch        |  1 +
- 10 files changed, 89 insertions(+)
- create mode 120000 cnf/diffs/perl5-5.42.0/constant.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/dynaloader.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/findext.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/installscripts.patch
- create mode 100644 cnf/diffs/perl5-5.42.0/liblist.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/makemaker.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/posix-makefile.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/test-checkcase.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/test-makemaker.patch
- create mode 120000 cnf/diffs/perl5-5.42.0/xconfig.patch
-
-diff --git a/cnf/diffs/perl5-5.42.0/constant.patch b/cnf/diffs/perl5-5.42.0/constant.patch
-new file mode 120000
-index 0000000..065e198
---- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/constant.patch
-@@ -0,0 +1 @@
-+../perl5-5.22.3/constant.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/dynaloader.patch b/cnf/diffs/perl5-5.42.0/dynaloader.patch
-new file mode 120000
-index 0000000..ffb73eb
---- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/dynaloader.patch
-@@ -0,0 +1 @@
-+../perl5-5.22.3/dynaloader.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/findext.patch b/cnf/diffs/perl5-5.42.0/findext.patch
-new file mode 120000
-index 0000000..9efbe5b
---- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/findext.patch
-@@ -0,0 +1 @@
-+../perl5-5.22.3/findext.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/installscripts.patch b/cnf/diffs/perl5-5.42.0/installscripts.patch
-new file mode 120000
-index 0000000..1c05e0f
---- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/installscripts.patch
-@@ -0,0 +1 @@
-+../perl5-5.36.0/installscripts.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/liblist.patch b/cnf/diffs/perl5-5.42.0/liblist.patch
-new file mode 100644
-index 0000000..5e6331f
---- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/liblist.patch
-@@ -0,0 +1,80 @@
-+When deciding which libraries are available, the original Configure uses
-+shaky heuristics to physically locate library files.
-+This is a very very bad thing to do, *especially* when cross-compiling,
-+as said heiristics are likely to locate the host libraries, not the target ones.
-+
-+The only real need for this test is to make sure it's safe to pass -llibrary
-+to the compiler. So that's exactly what perl-cross does, pass -llibrary
-+and see if it breaks things.
-+
-+Note this is a part of MakeMaker, and only applies to module Makefiles.
-+
-+
-+--- a/cpan/ExtUtils-MakeMaker/lib/ExtUtils/Liblist/Kid.pm
-++++ b/cpan/ExtUtils-MakeMaker/lib/ExtUtils/Liblist/Kid.pm
-+@@ -20,9 +20,10 @@
-+ use File::Spec;
-+ 
-+ sub ext {
-+-    if    ( $^O eq 'VMS' )     { goto &_vms_ext; }
-+-    elsif ( $^O eq 'MSWin32' ) { goto &_win32_ext; }
-+-    else                       { goto &_unix_os2_ext; }
-++  if   ($Config{usemmldlt}){ goto &_ld_ext;       }
-++  elsif($^O eq 'VMS')      { goto &_vms_ext;      }
-++  elsif($^O eq 'MSWin32')  { goto &_win32_ext;    }
-++  else                     { goto &_unix_os2_ext; }
-+ }
-+ 
-+ sub _unix_os2_ext {
-+@@ -661,4 +662,51 @@
-+     wantarray ? ( $lib, '', $ldlib, '', ( $give_libs ? \@flibs : () ) ) : $lib;
-+ }
-+ 
-++# A direct test for -l validity.
-++# Because guessing real file names for -llib options when dealing
-++# with a cross compiler is generally a BAD IDEA^tm.
-++sub _ld_ext {
-++    my($self,$potential_libs, $verbose, $give_libs) = @_;
-++    $verbose ||= 0;
-++
-++    if ($^O =~ 'os2' and $Config{perllibs}) { 
-++	# Dynamic libraries are not transitive, so we may need including
-++	# the libraries linked against perl.dll again.
-++
-++	$potential_libs .= " " if $potential_libs;
-++	$potential_libs .= $Config{perllibs};
-++    }
-++    return ("", "", "", "", ($give_libs ? [] : ())) unless $potential_libs;
-++    warn "Potential libraries are '$potential_libs':\n" if $verbose;
-++
-++    my($ld)   = $Config{ld};
-++    my($ldflags)   = $Config{ldflags};
-++    my($libs) = defined $Config{perllibs} ? $Config{perllibs} : $Config{libs};
-++
-++    my $try = 'try_mm.c';
-++    my $tryx = 'try_mm.x';
-++    open(TRY, '>', $try) || die "Can't create MakeMaker test file $try: $!\n";
-++    print TRY "int main(void) { return 0; }\n";
-++    close(TRY);
-++
-++    my $testlibs = '';
-++    my @testlibs = ();
-++    foreach my $thislib (split ' ', $potential_libs) {
-++        $testlibs = join(' ', @testlibs);
-++	if($thislib =~ /^-L/) {
-++		push(@testlibs, $thislib);
-++		next
-++	};
-++	my $cmd = "$ld $ldflags -o $tryx $try $testlibs $thislib >/dev/null 2>&1";
-++	my $ret = system($cmd);
-++	warn "Warning (mostly harmless): " . "No library found for $thislib\n" if $ret;
-++	next if $ret;
-++	push @testlibs, $thislib;
-++    }
-++    unlink($try);
-++    unlink($tryx);
-++
-++    return (join(' ', @testlibs), '', join(' ', @testlibs), '');
-++}
-++
-+ 1;
-diff --git a/cnf/diffs/perl5-5.42.0/makemaker.patch b/cnf/diffs/perl5-5.42.0/makemaker.patch
-new file mode 120000
-index 0000000..d7bd609
---- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/makemaker.patch
-@@ -0,0 +1 @@
-+../perl5-5.38.0/makemaker.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/posix-makefile.patch b/cnf/diffs/perl5-5.42.0/posix-makefile.patch
-new file mode 120000
-index 0000000..29463b7
---- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/posix-makefile.patch
-@@ -0,0 +1 @@
-+../perl5-5.22.3/posix-makefile.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/test-checkcase.patch b/cnf/diffs/perl5-5.42.0/test-checkcase.patch
-new file mode 120000
-index 0000000..36c5186
---- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/test-checkcase.patch
-@@ -0,0 +1 @@
-+../perl5-5.22.3/test-checkcase.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/test-makemaker.patch b/cnf/diffs/perl5-5.42.0/test-makemaker.patch
-new file mode 120000
-index 0000000..4e970ff
---- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/test-makemaker.patch
-@@ -0,0 +1 @@
-+../perl5-5.34.0/test-makemaker.patch
-\ No newline at end of file
-diff --git a/cnf/diffs/perl5-5.42.0/xconfig.patch b/cnf/diffs/perl5-5.42.0/xconfig.patch
-new file mode 120000
-index 0000000..1c22c96
---- /dev/null
-+++ b/cnf/diffs/perl5-5.42.0/xconfig.patch
-@@ -0,0 +1 @@
-+../perl5-5.41.3/xconfig.patch
-\ No newline at end of file
diff --git a/pkgs/development/python-modules/cmudict/default.nix b/pkgs/development/python-modules/cmudict/default.nix
index b75eb3e66209..ad9878c10d9b 100644
--- a/pkgs/development/python-modules/cmudict/default.nix
+++ b/pkgs/development/python-modules/cmudict/default.nix
@@ -1,42 +1,42 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  pythonOlder,
-  poetry-core,
+  fetchFromGitHub,
   importlib-metadata,
   importlib-resources,
+  poetry-core,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "cmudict";
-  version = "1.1.2";
+  version = "1.1.3";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-IhZd73NPGpwZHKFowGbX6lgsi42nkNo+g0TpZeJkfbg=";
+  src = fetchFromGitHub {
+    owner = "prosegrinder";
+    repo = "python-cmudict";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pOqzezrDlwlVsvBHreHmLKxYKDxllZNs0TgLwxBhy58=";
+    fetchSubmodules = true;
   };
 
-  build-system = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
 
   dependencies = [
     importlib-metadata
     importlib-resources
   ];
 
-  pythonImportsCheck = [
-    "cmudict"
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "cmudict" ];
 
   meta = {
-    changelog = "https://github.com/prosegrinder/python-cmudict/blob/main/CHANGELOG.md";
-    description = "A versioned python wrapper package for The CMU Pronouncing Dictionary data files";
-    homepage = "https://pypi.org/project/cmudict/";
+    description = "Python wrapper package for The CMU Pronouncing Dictionary data files";
+    homepage = "https://github.com/prosegrinder/python-cmudict";
+    changelog = "https://github.com/prosegrinder/python-cmudict/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ sandarukasa ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/cupy/default.nix b/pkgs/development/python-modules/cupy/default.nix
index 0eb635c06a15..3af28161ba4e 100644
--- a/pkgs/development/python-modules/cupy/default.nix
+++ b/pkgs/development/python-modules/cupy/default.nix
@@ -49,13 +49,11 @@ let
       outpaths ++ lib.concatMap (outpath: lib.map (output: outpath.${output}) outpath.outputs) outpaths;
   };
 in
-buildPythonPackage rec {
+buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
   pname = "cupy";
   version = "13.6.0";
   pyproject = true;
 
-  stdenv = cudaPackages.backendStdenv;
-
   src = fetchFromGitHub {
     owner = "cupy";
     repo = "cupy";
diff --git a/pkgs/development/python-modules/dlib/default.nix b/pkgs/development/python-modules/dlib/default.nix
index d8b863ade3f8..5868705f1127 100644
--- a/pkgs/development/python-modules/dlib/default.nix
+++ b/pkgs/development/python-modules/dlib/default.nix
@@ -5,9 +5,8 @@
   more-itertools,
 }:
 
-buildPythonPackage {
+buildPythonPackage.override { inherit (dlib) stdenv; } {
   inherit (dlib)
-    stdenv
     pname
     version
     src
diff --git a/pkgs/development/python-modules/llama-cpp-python/default.nix b/pkgs/development/python-modules/llama-cpp-python/default.nix
index 27781bd0c2c2..5e9e79e390c8 100644
--- a/pkgs/development/python-modules/llama-cpp-python/default.nix
+++ b/pkgs/development/python-modules/llama-cpp-python/default.nix
@@ -39,7 +39,7 @@
 let
   stdenvTarget = if cudaSupport then gcc13Stdenv else stdenv;
 in
-buildPythonPackage rec {
+buildPythonPackage.override { stdenv = stdenvTarget; } rec {
   pname = "llama-cpp-python";
   version = "0.3.16";
   pyproject = true;
@@ -108,8 +108,6 @@ buildPythonPackage rec {
     ]
   );
 
-  stdenv = stdenvTarget;
-
   dependencies = [
     diskcache
     jinja2
diff --git a/pkgs/development/python-modules/llm/default.nix b/pkgs/development/python-modules/llm/default.nix
index f04cd5b18be8..c93fe1269bb0 100644
--- a/pkgs/development/python-modules/llm/default.nix
+++ b/pkgs/development/python-modules/llm/default.nix
@@ -4,6 +4,7 @@
   callPackage,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   pytestCheckHook,
   pythonOlder,
   replaceVars,
@@ -24,6 +25,7 @@
   pytest-asyncio,
   pytest-httpx,
   pytest-recording,
+  sqlite,
   sqlite-utils,
   syrupy,
   llm-echo,
@@ -179,7 +181,17 @@ let
       hash = "sha256-PMQGyBwP6UCIz7p94atWgepbw9IwW6ym60sfP/PBrCA=";
     };
 
-    patches = [ ./001-disable-install-uninstall-commands.patch ];
+    patches = [
+      ./001-disable-install-uninstall-commands.patch
+    ]
+    # See https://github.com/NixOS/nixpkgs/issues/476258 and https://github.com/simonw/llm/pull/1334
+    # TODO: Remove when sqlite 3.52.x is released.
+    ++ lib.optionals (sqlite.version == "3.51.1") [
+      (fetchpatch {
+        url = "https://github.com/simonw/llm/commit/6e24b883c3e3c4ddd2ec9006714d0a9ec17b59da.patch";
+        hash = "sha256-4AKQdZCr6qxuWnjWoSW6I44hPL5e7tnvREx2Ns0WwNc=";
+      })
+    ];
 
     postPatch = ''
       substituteInPlace llm/cli.py \
diff --git a/pkgs/development/python-modules/openusd/default.nix b/pkgs/development/python-modules/openusd/default.nix
index 0354d1c923a6..7b7a8cf09168 100644
--- a/pkgs/development/python-modules/openusd/default.nix
+++ b/pkgs/development/python-modules/openusd/default.nix
@@ -33,6 +33,7 @@
   python,
   qt6,
   setuptools,
+  stdenv,
   onetbb,
   withDocs ? false,
   withOsl ? true,
@@ -61,8 +62,6 @@ buildPythonPackage rec {
     hash = "sha256-gxikEC4MqTkhgYaRsCVYtS/VmXClSaCMdzpQ0LmiR7Q=";
   };
 
-  stdenv = python.stdenv;
-
   outputs = [ "out" ] ++ lib.optional withDocs "doc";
 
   patches = [
diff --git a/pkgs/development/python-modules/pdfminer-six/default.nix b/pkgs/development/python-modules/pdfminer-six/default.nix
index 653ad14c40df..7cfcac144c7f 100644
--- a/pkgs/development/python-modules/pdfminer-six/default.nix
+++ b/pkgs/development/python-modules/pdfminer-six/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pdfminer-six";
-  version = "20251107";
+  version = "20251227";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdfminer";
     repo = "pdfminer.six";
     tag = version;
-    hash = "sha256-PuRxiKL1rLpfdabH3cMywkwBoeImu/yNgEhckLzr0Z4=";
+    hash = "sha256-O/9B04lLFNoqvvyGAFADuqzIGnthN50V1+PMAFt1ysc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index f2411acfa845..7d99bb575b18 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -10,24 +10,26 @@
   monotonic,
   openai,
   parameterized,
+  pytest-asyncio,
   pytestCheckHook,
   python-dateutil,
+  pythonAtLeast,
   requests,
   setuptools,
   six,
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "posthog";
-  version = "6.7.0";
+  version = "7.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
-    tag = "v${version}";
-    hash = "sha256-//PjAWZF6FYsiG9UDg+MPv1x06Yp4msBkYkNAU9Rjsc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YDW3FneQec09BOUh3wBbgz1ng3n6tkzoAZhIynp4wGA=";
   };
 
   build-system = [ setuptools ];
@@ -48,6 +50,7 @@ buildPythonPackage rec {
     mock
     openai
     parameterized
+    pytest-asyncio
     pytestCheckHook
   ];
 
@@ -62,19 +65,22 @@ buildPythonPackage rec {
     "test_upload"
     # AssertionError: 2 != 3
     "test_flush_interval"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # Pydantic V1 functionality isn't compatible with Python 3.14
+    "test_clean_pydantic"
   ];
 
   disabledTestPaths = [
-    # Revisit this at the next version bump, issue open upstream
-    # See https://github.com/PostHog/posthog-python/issues/234
-    "posthog/test/ai/openai/test_openai.py"
+    # Missing parts
+    "posthog/test/integrations/test_middleware.py"
   ];
 
   meta = {
     description = "Module for interacting with PostHog";
     homepage = "https://github.com/PostHog/posthog-python";
-    changelog = "https://github.com/PostHog/posthog-python/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/PostHog/posthog-python/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ happysalada ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index d1d2f609d652..8a60fac56e20 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -14,8 +14,6 @@ buildPythonPackage rec {
   version = "7.1.3";
   pyproject = true;
 
-  inherit stdenv;
-
   src = fetchFromGitHub {
     owner = "giampaolo";
     repo = "psutil";
diff --git a/pkgs/development/python-modules/pypika/default.nix b/pkgs/development/python-modules/pypika/default.nix
index 11fa9455b4bf..bd29b60e11f6 100644
--- a/pkgs/development/python-modules/pypika/default.nix
+++ b/pkgs/development/python-modules/pypika/default.nix
@@ -2,32 +2,47 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   parameterized,
   unittestCheckHook,
+  setuptools,
 }:
-buildPythonPackage rec {
+
+buildPythonPackage (finalAttrs: {
   pname = "pypika";
   version = "0.49.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kayak";
     repo = "pypika";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Lawsc19sJ3U7rCOnYvDWhWqK/J+Hd3zKG6TrhDsTtVs=";
   };
 
-  pythonImportsCheck = [ "pypika" ];
+  patches = [
+    # Fix ast deprecation warnings, https://github.com/HENNGE/arsenic/pull/160
+    (fetchpatch {
+      name = "ast-deprecation.patch";
+      url = "https://github.com/pyctrl/pypika/commit/e302e4d1c26242bcff61b50e0e8f157f181e1bc0.patch";
+      hash = "sha256-pbJwOE5xaAapMKdm1xsNrISbCzHIKuhCgA2lA0vB1T8=";
+    })
+  ];
+
+  build-system = [ setuptools ];
 
   nativeCheckInputs = [
     parameterized
     unittestCheckHook
   ];
 
+  pythonImportsCheck = [ "pypika" ];
+
   meta = {
     description = "Python SQL query builder";
     homepage = "https://github.com/kayak/pypika";
+    changelog = "https://github.com/kayak/pypika/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/python-mapnik/default.nix b/pkgs/development/python-modules/python-mapnik/default.nix
index 5a37c6cc8d32..8c5874ea7f19 100644
--- a/pkgs/development/python-modules/python-mapnik/default.nix
+++ b/pkgs/development/python-modules/python-mapnik/default.nix
@@ -5,6 +5,7 @@
   replaceVars,
   isPyPy,
   python,
+  stdenv,
   setuptools,
   pillow,
   pycairo,
@@ -27,7 +28,7 @@
   pybind11,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "python-mapnik";
   version = "4.1.3.unstable-2025-09-25";
   pyproject = true;
@@ -49,8 +50,6 @@ buildPythonPackage rec {
     })
   ];
 
-  stdenv = python.stdenv;
-
   build-system = [ setuptools ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index dfc0d6cc201e..35f6c25eca4a 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.25";
+  version = "3.1.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-z4GpifopGTRUo2WWWfA8GkN7L+T+FkIN8xYchA5V3DI=";
+    hash = "sha256-5A3IQUEz+LtsiirNJeVeHawrvlJ2s3UTXXYGAYrPM74=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/torchaudio/default.nix b/pkgs/development/python-modules/torchaudio/default.nix
index 1b22d4efdf59..afea38e2ab98 100644
--- a/pkgs/development/python-modules/torchaudio/default.nix
+++ b/pkgs/development/python-modules/torchaudio/default.nix
@@ -74,14 +74,13 @@ let
     else
       throw "No GPU targets specified"
   );
+  stdenv = torch.stdenv;
 in
-buildPythonPackage rec {
+buildPythonPackage.override { inherit stdenv; } rec {
   pname = "torchaudio";
   version = "2.9.1";
   pyproject = true;
 
-  stdenv = torch.stdenv;
-
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "audio";
diff --git a/pkgs/development/python-modules/torchvision/default.nix b/pkgs/development/python-modules/torchvision/default.nix
index c13be8dfb523..ce38cc74401c 100644
--- a/pkgs/development/python-modules/torchvision/default.nix
+++ b/pkgs/development/python-modules/torchvision/default.nix
@@ -30,12 +30,10 @@ let
   pname = "torchvision";
   version = "0.24.1";
 in
-buildPythonPackage {
+buildPythonPackage.override { stdenv = torch.stdenv; } {
   format = "setuptools";
   inherit pname version;
 
-  stdenv = torch.stdenv;
-
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "vision";
diff --git a/pkgs/development/python-modules/tuf/default.nix b/pkgs/development/python-modules/tuf/default.nix
index e22c473fa5ff..69e6e86710b4 100644
--- a/pkgs/development/python-modules/tuf/default.nix
+++ b/pkgs/development/python-modules/tuf/default.nix
@@ -1,17 +1,23 @@
 {
   lib,
   buildPythonPackage,
-  ed25519,
-  freezegun,
   fetchFromGitHub,
-  hatchling,
-  pytestCheckHook,
+
+  # build-system
   flit-core,
+  hatchling,
+
+  # dependencies
   requests,
   securesystemslib,
+
+  # tests
+  ed25519,
+  freezegun,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "tuf";
   version = "6.0.0";
   pyproject = true;
@@ -19,13 +25,13 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "theupdateframework";
     repo = "python-tuf";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-CPbZOpUYi7MWKLMj7kwTsmEkxLCf4wU7IOCcbzMkPlU=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail  "hatchling==1.27.0" "hatchling"
+      --replace-fail "hatchling==1.27.0" "hatchling"
   '';
 
   build-system = [
@@ -42,12 +48,9 @@ buildPythonPackage rec {
 
   __darwinAllowLocalNetworking = true;
 
-  checkInputs = [
-    freezegun
-  ];
-
   nativeCheckInputs = [
     ed25519
+    freezegun
     pytestCheckHook
   ];
 
@@ -60,11 +63,11 @@ buildPythonPackage rec {
   meta = {
     description = "Python reference implementation of The Update Framework (TUF)";
     homepage = "https://github.com/theupdateframework/python-tuf";
-    changelog = "https://github.com/theupdateframework/python-tuf/blob/v${version}/docs/CHANGELOG.md";
+    changelog = "https://github.com/theupdateframework/python-tuf/blob/${finalAttrs.src.tag}/docs/CHANGELOG.md";
     license = with lib.licenses; [
       asl20
       mit
     ];
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/verilogae/default.nix b/pkgs/development/python-modules/verilogae/default.nix
index 2e159af68a70..a60e2498e9d0 100644
--- a/pkgs/development/python-modules/verilogae/default.nix
+++ b/pkgs/development/python-modules/verilogae/default.nix
@@ -14,13 +14,11 @@
   zlib,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage.override { stdenv = llvmPackages.stdenv; } rec {
   pname = "verilogae";
   version = "24.0.0mob-unstable-2025-07-21";
   pyproject = true;
 
-  stdenv = llvmPackages.stdenv;
-
   src = fetchFromGitHub {
     owner = "OpenVAF";
     repo = "OpenVAF-Reloaded";
diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index 22211f4d38bd..ea1a1c1f625f 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -313,13 +313,11 @@ let
 
 in
 
-buildPythonPackage rec {
+buildPythonPackage.override { stdenv = torch.stdenv; } rec {
   pname = "vllm";
   version = "0.13.0";
   pyproject = true;
 
-  stdenv = torch.stdenv;
-
   src = fetchFromGitHub {
     owner = "vllm-project";
     repo = "vllm";
diff --git a/pkgs/development/python-modules/warp-lang/default.nix b/pkgs/development/python-modules/warp-lang/default.nix
index ca97757e3ff3..d9550d87bd0f 100644
--- a/pkgs/development/python-modules/warp-lang/default.nix
+++ b/pkgs/development/python-modules/warp-lang/default.nix
@@ -43,7 +43,7 @@ let
 
   libmathdx = callPackage ./libmathdx.nix { };
 in
-buildPythonPackage {
+buildPythonPackage.override { stdenv = effectiveStdenv; } {
   pname = "warp-lang";
   inherit version;
   pyproject = true;
@@ -53,8 +53,6 @@ buildPythonPackage {
   # provided by NVCC.
   __structuredAttrs = true;
 
-  stdenv = effectiveStdenv;
-
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "warp";
diff --git a/pkgs/development/python-modules/xformers/default.nix b/pkgs/development/python-modules/xformers/default.nix
index a39f5154cf3d..8054520520d9 100644
--- a/pkgs/development/python-modules/xformers/default.nix
+++ b/pkgs/development/python-modules/xformers/default.nix
@@ -35,8 +35,9 @@ let
   # version 0.0.32.post2 was confirmed to break CUDA.
   # Remove this note once the latest published revision "just works".
   version = "0.0.30";
+  effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
 in
-buildPythonPackage {
+buildPythonPackage.override { stdenv = effectiveStdenv; } {
   pname = "xformers";
   inherit version;
   pyproject = true;
@@ -66,8 +67,6 @@ buildPythonPackage {
     TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep ";" torch.cudaCapabilities}";
   };
 
-  stdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
-
   buildInputs =
     lib.optional stdenv.hostPlatform.isDarwin openmp
     ++ lib.optionals cudaSupport (
diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 6e3775e63816..2e68bcfc40c2 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -11,13 +11,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.24.532";
+  version = "0.24.645";
 
   src = fetchFromGitHub {
     owner = "jackett";
     repo = "jackett";
     tag = "v${version}";
-    hash = "sha256-9dLBQOAyR2oyN1lGLPN/QLZtGLASRKUXUCLCdvqOmmE=";
+    hash = "sha256-nb5WDMhba4kTGxtX4rLLZdM9iJI6dM6kPBu3hht/CYk=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index ebbe1b007347..6f35098a9698 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -191,6 +191,8 @@ in
 
   trivial-builders = callPackage ../build-support/trivial-builders/test/default.nix { };
 
+  vmTools = callPackage ../build-support/vm/test.nix { };
+
   writers = callPackage ../build-support/writers/test.nix { };
 
   testers = callPackage ../build-support/testers/test/default.nix { };
diff --git a/pkgs/test/overriding.nix b/pkgs/test/overriding.nix
index 9ee13e3778d2..9d2d0612d23a 100644
--- a/pkgs/test/overriding.nix
+++ b/pkgs/test/overriding.nix
@@ -446,20 +446,6 @@ let
         expr = package-stub-libcxx.stdenv;
         expected = pkgs.libcxxStdenv;
       };
-      overridePythonAttrs-stdenv-deprecated = {
-        expr =
-          (package-stub.overridePythonAttrs (_: {
-            stdenv = pkgs.clangStdenv;
-          })).stdenv;
-        expected = pkgs.clangStdenv;
-      };
-      overridePythonAttrs-override-clangStdenv-deprecated-nested = {
-        expr =
-          (package-stub-gcc.overridePythonAttrs {
-            stdenv = pkgs.clangStdenv;
-          }).stdenv;
-        expected = pkgs.clangStdenv;
-      };
 
       overridePythonAttrs = {
         expr = (applyOverridePythonAttrs package-stub).overridePythonAttrsFlag;
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index f792ad9b561d..7e0ddc4f4846 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -196,7 +196,6 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     capnproto
     editline
-    libsodium
     openssl
     sqlite
     xz
@@ -295,9 +294,21 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++
     lib.optionals
-      (stdenv.hostPlatform.isLinux && finalAttrs.doInstallCheck && lib.versionAtLeast version "2.94")
+      (
+        stdenv.hostPlatform.isLinux
+        && finalAttrs.doInstallCheck
+        && lib.versionAtLeast version "2.94"
+        && lib.versionOlder version "2.95"
+      )
       [
         (lib.mesonOption "build-test-shell" "${pkgsStatic.busybox}/bin")
+      ]
+  ++
+    lib.optionals
+      (stdenv.hostPlatform.isLinux && finalAttrs.doInstallCheck && lib.versionAtLeast version "2.95")
+      [
+        (lib.mesonOption "build-test-env" "${pkgsStatic.busybox}/bin")
+        (lib.mesonOption "build-test-shell" "${pkgsStatic.bash}/bin")
       ];
 
   ninjaFlags = [ "-v" ];
@@ -347,7 +358,8 @@ stdenv.mkDerivation (finalAttrs: {
     rapidcheck
   ];
 
-  doInstallCheck = true;
+  # Python splices are broken (https://github.com/NixOS/nixpkgs/issues/476822), causing build failure in `buildPackages.python3Packages.bcrypt`.
+  doInstallCheck = stdenv.buildPlatform == stdenv.hostPlatform;
   mesonInstallCheckFlags = [
     "--suite=installcheck"
     "--print-errorlogs"
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index 80df0b52c248..814bd457e050 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -265,14 +265,14 @@ lib.makeExtensible (
       attrName = "git";
 
       lix-args = rec {
-        version = "2.95.0-pre-20251121_${builtins.substring 0 12 src.rev}";
+        version = "2.95.0-pre-20260103_${builtins.substring 0 12 src.rev}";
 
         src = fetchFromGitea {
           domain = "git.lix.systems";
           owner = "lix-project";
           repo = "lix";
-          rev = "b707403a308030739dfeacc5b0aaaeef8ba3f633";
-          hash = "sha256-kas7FT2J86DVJlPH5dNNHM56OgdQQyfCE/dX/EOKDp8=";
+          rev = "d387c9113c73f04bed46dbdd59b6c36de2253d73";
+          hash = "sha256-jYUcmXA4FNwoJtxRgH+Be96wQv8h9Y9dByYf+KmcgK4=";
         };
 
         cargoDeps = rustPlatform.fetchCargoVendor {
@@ -280,8 +280,6 @@ lib.makeExtensible (
           inherit src;
           hash = "sha256-APm8m6SVEAO17BBCka13u85/87Bj+LePP7Y3zHA3Mpg=";
         };
-
-        patches = [ lixMdbookPatch ];
       };
     };
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9582c7ee6320..58751c6cc763 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -830,8 +830,9 @@ with pkgs;
     inherit (darwin) signingUtils;
   };
 
-  # No callPackage.  In particular, we don't want `img` *package* in parameters.
-  vmTools = makeOverridable (import ../build-support/vm) { inherit pkgs lib; };
+  vmTools = callPackage ../build-support/vm {
+    img = stdenv.hostPlatform.linux-kernel.target;
+  };
 
   releaseTools = callPackage ../build-support/release { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 968612bf3171..e15319aa85d9 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -18100,9 +18100,12 @@ with self;
       url = "mirror://cpan/authors/id/I/IS/ISHIGAKI/JSON-4.10.tar.gz";
       hash = "sha256-34tRQ9mn3pnEe1XxoXC9H2n3EZNcGGptwKtW3QV1jjU=";
     };
-    # Do not abort cross-compilation on failure to load native JSON module into host perl
+    # Force core provided JSON::PP backend when cross building since dynamic
+    # loading attempts of other backends presumably fail
     preConfigure = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-      substituteInPlace Makefile.PL --replace "exit 0;" ""
+      substituteInPlace lib/JSON.pm \
+        --replace-fail 'my $backend = exists $ENV{PERL_JSON_BACKEND} ? $ENV{PERL_JSON_BACKEND} : 1;' \
+                       'my $backend = "JSON::PP";'
     '';
     buildInputs = [ TestPod ];
     meta = {