diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 94da1f4183bf..aecb6f56a428 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22466,7 +22466,7 @@
     githubId = 38916722;
   };
   pradyuman = {
-    email = "me@pradyuman.co";
+    email = "me@pmn.co";
     github = "pradyuman";
     githubId = 9904569;
     name = "Pradyuman Vig";
diff --git a/nixos/modules/services/desktop-managers/cosmic.nix b/nixos/modules/services/desktop-managers/cosmic.nix
index 14fdda18c235..61e01c090d7a 100644
--- a/nixos/modules/services/desktop-managers/cosmic.nix
+++ b/nixos/modules/services/desktop-managers/cosmic.nix
@@ -20,7 +20,7 @@ let
     with pkgs;
     [
       cosmic-applets
-      cosmic-applibrary
+      cosmic-app-library
       cosmic-bg
       cosmic-comp
       cosmic-files
diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix
index d6331eeb3326..fe6c2e7eed5b 100644
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@@ -33,17 +33,11 @@ let
     else
       null;
 
-  # Build base configuration with systemd credential path override
   baseSettings =
     cfg.settings
-    // (
-      if effectiveKeyPath != null then
-        {
-          PrivateKeyPath = "/private-key";
-        }
-      else
-        { }
-    );
+    // lib.optionalAttrs (effectiveKeyPath != null) {
+      PrivateKeyPath = "/run/credentials/yggdrasil.service/private-key";
+    };
 
   # Remove null values that yggdrasil doesn't expect
   cleanSettings = lib.filterAttrs (n: v: v != null) baseSettings;
@@ -327,7 +321,6 @@ in
           StateDirectory = "yggdrasil";
           RuntimeDirectory = "yggdrasil";
           RuntimeDirectoryMode = "0750";
-          BindReadOnlyPaths = lib.optional (effectiveKeyPath != null) "%d/private-key:/private-key";
           LoadCredential = lib.optional (effectiveKeyPath != null) "private-key:${effectiveKeyPath}";
 
           AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
diff --git a/pkgs/applications/emulators/libretro/cores/dolphin.nix b/pkgs/applications/emulators/libretro/cores/dolphin.nix
index f1fe5b891b01..3975f8f5e6fc 100644
--- a/pkgs/applications/emulators/libretro/cores/dolphin.nix
+++ b/pkgs/applications/emulators/libretro/cores/dolphin.nix
@@ -20,13 +20,13 @@
 }:
 mkLibretroCore {
   core = "dolphin";
-  version = "0-unstable-2026-06-26";
+  version = "0-unstable-2026-06-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "dolphin";
-    rev = "fec5e8e106489e0d00e69dd4afaabc3d95688047";
-    hash = "sha256-GNAZgFHZCnokL3HYU+xsFtghpN09QbsZpwMW1eMtSvU=";
+    rev = "894fdda35688f3ac33c680ef6fe17ce965a16bf1";
+    hash = "sha256-Dkvv8EgQjLjyt0muSVF0Cnex/3xUcZXvWTzgUw61Sv0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/build-support/coq/default.nix b/pkgs/build-support/coq/default.nix
index c649a493c8ff..33305b6dd1a0 100644
--- a/pkgs/build-support/coq/default.nix
+++ b/pkgs/build-support/coq/default.nix
@@ -41,7 +41,7 @@ in
   pname,
   version ? null,
   fetcher ? null,
-  owner ? "coq-community",
+  owner ? "rocq-community",
   domain ? "github.com",
   repo ? pname,
   defaultVersion ? null,
@@ -98,7 +98,6 @@ let
       "dropAttrs"
       "dropDerivationAttrs"
       "keepAttrs"
-      "enableParallelBuilding"
     ]
     ++ dropAttrs
   ) keepAttrs;
@@ -158,27 +157,11 @@ let
   append-version = p: n: p + display-pkg n "" coqPackages.${n}.version + "-";
   prefix-name = foldl append-version "" namePrefix;
   useDune = args.useDune or (useDuneifVersion fetched.version);
-  coqlib-flags =
-    switch coq.coq-version
-      [
-        {
-          case = v: versions.isLe "8.6" v && v != "dev";
-          out = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
-        }
-      ]
-      [
-        "COQLIBINSTALL=$(out)/lib/coq/${coq.coq-version}/user-contrib"
-        "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)"
-      ];
-  docdir-flags =
-    switch coq.coq-version
-      [
-        {
-          case = v: versions.isLe "8.6" v && v != "dev";
-          out = [ "DOCDIR=$(out)/share/coq/${coq.coq-version}/" ];
-        }
-      ]
-      [ "COQDOCINSTALL=$(out)/share/coq/${coq.coq-version}/user-contrib" ];
+  coqlib-flags = [
+    "COQLIBINSTALL=$(out)/lib/coq/${coq.coq-version}/user-contrib"
+    "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)"
+  ];
+  docdir-flags = [ "COQDOCINSTALL=$(out)/share/coq/${coq.coq-version}/user-contrib" ];
 in
 
 stdenv.mkDerivation (
@@ -202,10 +185,7 @@ stdenv.mkDerivation (
         );
       buildInputs =
         args.overrideBuildInputs or ([ coq ] ++ (args.buildInputs or [ ]) ++ extraBuildInputs);
-      enableParallelBuilding =
-        lib.warnIf (args ? enableParallelBuilding && args.enableParallelBuilding == true)
-          "mkCoqDerivation: enableParallelBuilding is enabled by default; remove the explicit setting"
-          enableParallelBuilding;
+      inherit enableParallelBuilding;
 
       meta =
         (
diff --git a/pkgs/build-support/rocq/default.nix b/pkgs/build-support/rocq/default.nix
index 8b86867d67d4..a6b751a53b23 100644
--- a/pkgs/build-support/rocq/default.nix
+++ b/pkgs/build-support/rocq/default.nix
@@ -41,7 +41,7 @@ in
   pname,
   version ? null,
   fetcher ? null,
-  owner ? "coq-community",
+  owner ? "rocq-community",
   domain ? "github.com",
   repo ? pname,
   defaultVersion ? null,
diff --git a/pkgs/by-name/az/azure-cli/extensions-manual.nix b/pkgs/by-name/az/azure-cli/extensions-manual.nix
index 4b289cedf94e..c4c4a8296948 100644
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -247,6 +247,11 @@
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/interactive-1.0.0b1-py2.py3-none-any.whl";
     hash = "sha256-COvHDhvsigEEMYlMQ2hHFKzjX7WwdkwfT9id6z+Sj7w=";
     description = "Microsoft Azure Command-Line Interactive Shell";
+    # The wheel contains Requires-Dist entries for both spellings.
+    pythonRelaxDeps = [
+      "prompt_toolkit"
+      "prompt-toolkit"
+    ];
     propagatedBuildInputs = with python3Packages; [
       prompt-toolkit
     ];
diff --git a/pkgs/by-name/ca/cargo-tarpaulin/package.nix b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
index 388845f21469..500a392dcd7b 100644
--- a/pkgs/by-name/ca/cargo-tarpaulin/package.nix
+++ b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-tarpaulin";
-  version = "0.35.5";
+  version = "0.36.0";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
     tag = finalAttrs.version;
-    hash = "sha256-m822/s9HBKIxAfzgQEBOZeHcHU57MPGOumqlTc55Ro8=";
+    hash = "sha256-qd0PmCCUmd9Y4kUei+hZoc+rIYYZMf0s2ml9IoHtXX8=";
   };
 
-  cargoHash = "sha256-Qo06iUy/1ElEe/gkH23JZLw7AKPkBPw6aLXnvx9Hv4g=";
+  cargoHash = "sha256-EJTzITwwLEMVWdLdSE+A9D3Deh501561rxrlsqzmRKs=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ce/cedar/package.nix b/pkgs/by-name/ce/cedar/package.nix
index 4d9aa40d3251..ba2544fa9f25 100644
--- a/pkgs/by-name/ce/cedar/package.nix
+++ b/pkgs/by-name/ce/cedar/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cedar";
-  version = "4.11.0";
+  version = "4.11.2";
 
   src = fetchFromGitHub {
     owner = "cedar-policy";
     repo = "cedar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9IJ/AMWOtkNAoBbzTKqUZI87MvHPihdhNBwsmn0qpDA=";
+    hash = "sha256-pJiSnaq2oz1uZVkLp9s2HLPdG2sZ0EtURlO8R2V+dJs=";
   };
 
-  cargoHash = "sha256-sinfwdi3/ZFmdbxRiUbtmhsVGcJenn82HFu8mJz415I=";
+  cargoHash = "sha256-6AtFdE7vXoevOU3uWP4sgibakNHK8ffnuWCzJxFt/wo=";
 
   cargoBuildFlags = [
     "--bin"
diff --git a/pkgs/by-name/co/cosmic-applibrary/package.nix b/pkgs/by-name/co/cosmic-app-library/package.nix
similarity index 97%
rename from pkgs/by-name/co/cosmic-applibrary/package.nix
rename to pkgs/by-name/co/cosmic-app-library/package.nix
index b11295c763e4..73647cada606 100644
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-app-library/package.nix
@@ -10,7 +10,7 @@
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "cosmic-applibrary";
+  pname = "cosmic-app-library";
   version = "1.1.0";
 
   # nixpkgs-update: no auto update
diff --git a/pkgs/by-name/co/cosmic-comp/package.nix b/pkgs/by-name/co/cosmic-comp/package.nix
index 69552fdea6ad..f0d6a1b92d15 100644
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@@ -32,8 +32,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-ki+unf58rXBCpj5PCpBcg/6FWo16+MdPQWae+w1YkJ8=";
 
-  separateDebugInfo = true;
+  # Only default feature is systemd
+  buildNoDefaultFeatures = !useSystemd;
 
+  separateDebugInfo = true;
   __structuredAttrs = true;
 
   nativeBuildInputs = [
@@ -51,9 +53,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ]
   ++ lib.optional useSystemd systemd;
 
-  # Only default feature is systemd
-  buildNoDefaultFeatures = !useSystemd;
-
   makeFlags = [
     "prefix=${placeholder "out"}"
     "CARGO_TARGET_DIR=target/${stdenv.hostPlatform.rust.cargoShortTarget}"
diff --git a/pkgs/by-name/co/cosmic-edit/package.nix b/pkgs/by-name/co/cosmic-edit/package.nix
index c6148a0cf930..a96aabb57320 100644
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -26,16 +26,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-5DsnhaiJgmTakn+q9o2Q7IeuakAC/j0Ck3F3pfFx/EA=";
   };
 
-  cargoHash = "sha256-2E+98uWtahyQufoZTzdUtkwbuISsUHwlqOmMSpyi1O8=";
-
-  separateDebugInfo = true;
-
   postPatch = ''
     substituteInPlace justfile --replace-fail '#!/usr/bin/env' "#!$(command -v env)"
   '';
 
+  cargoHash = "sha256-2E+98uWtahyQufoZTzdUtkwbuISsUHwlqOmMSpyi1O8=";
+
+  separateDebugInfo = true;
   __structuredAttrs = true;
 
+  env.VERGEN_GIT_SHA = finalAttrs.src.tag;
+
   nativeBuildInputs = [
     just
     pkg-config
diff --git a/pkgs/by-name/co/cosmic-ext-tweaks/package.nix b/pkgs/by-name/co/cosmic-ext-tweaks/package.nix
index 53df717d345e..053aabe84074 100644
--- a/pkgs/by-name/co/cosmic-ext-tweaks/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-tweaks/package.nix
@@ -26,6 +26,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-mC19GLLHrjqYXl052HoNFscz9zzQWVBBm0OxzXoUd8U=";
 
   separateDebugInfo = true;
+  __structuredAttrs = true;
+
+  env.VERGEN_GIT_SHA = finalAttrs.src.tag;
 
   nativeBuildInputs = [
     libcosmicAppHook
diff --git a/pkgs/by-name/co/cosmic-files/package.nix b/pkgs/by-name/co/cosmic-files/package.nix
index cc0d584fd744..ce202aec8e60 100644
--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@@ -27,6 +27,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   separateDebugInfo = true;
   __structuredAttrs = true;
 
+  env.VERGEN_GIT_SHA = finalAttrs.src.tag;
+
   nativeBuildInputs = [
     just
     libcosmicAppHook
diff --git a/pkgs/by-name/co/cosmic-greeter/package.nix b/pkgs/by-name/co/cosmic-greeter/package.nix
index c9f04a86339b..c64dd85dfb4f 100644
--- a/pkgs/by-name/co/cosmic-greeter/package.nix
+++ b/pkgs/by-name/co/cosmic-greeter/package.nix
@@ -29,16 +29,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-oxXCAvBISkZu76VpvQ9AliFRJ8r5Ay7mjWf4sEwV0Xs=";
   };
 
+  postPatch = ''
+    substituteInPlace src/greeter.rs --replace-fail '/usr/bin/env' '${lib.getExe' coreutils "env"}'
+    substituteInPlace src/greeter.rs --replace-fail '/usr/bin/orca' '${lib.getExe orca}'
+  '';
+
   cargoHash = "sha256-mfY2hsMxBooRjmTB2jgUIKyKHBpGfZ9Qslwv+2aEQyg=";
 
-  separateDebugInfo = true;
-
-  env.VERGEN_GIT_SHA = finalAttrs.src.tag;
-
   cargoBuildFlags = [ "--all" ];
 
+  separateDebugInfo = true;
   __structuredAttrs = true;
 
+  env.VERGEN_GIT_SHA = finalAttrs.src.tag;
+
   nativeBuildInputs = [
     rustPlatform.bindgenHook
     cmake
@@ -66,11 +70,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
   ];
 
-  postPatch = ''
-    substituteInPlace src/greeter.rs --replace-fail '/usr/bin/env' '${lib.getExe' coreutils "env"}'
-    substituteInPlace src/greeter.rs --replace-fail '/usr/bin/orca' '${lib.getExe orca}'
-  '';
-
   preFixup = ''
     libcosmicAppWrapperArgs+=(
       --prefix PATH : ${lib.makeBinPath [ cosmic-randr ]}
diff --git a/pkgs/by-name/co/cosmic-icons/package.nix b/pkgs/by-name/co/cosmic-icons/package.nix
index 6e680b83e8fa..f7ef23983644 100644
--- a/pkgs/by-name/co/cosmic-icons/package.nix
+++ b/pkgs/by-name/co/cosmic-icons/package.nix
@@ -24,17 +24,17 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ just ];
 
+  propagatedBuildInputs = [
+    pop-icon-theme
+    hicolor-icon-theme
+  ];
+
   justFlags = [
     "--set"
     "prefix"
     (placeholder "out")
   ];
 
-  propagatedBuildInputs = [
-    pop-icon-theme
-    hicolor-icon-theme
-  ];
-
   dontDropIconThemeCache = true;
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/by-name/co/cosmic-idle/package.nix b/pkgs/by-name/co/cosmic-idle/package.nix
index 05c0e99f8ff1..00ba10327ef2 100644
--- a/pkgs/by-name/co/cosmic-idle/package.nix
+++ b/pkgs/by-name/co/cosmic-idle/package.nix
@@ -26,6 +26,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-0tcrOfVT5b57ev3b5F2U78F2QPGFwp94bqFVNyKH0Yk=";
   };
 
+  postPatch = ''
+    substituteInPlace src/main.rs --replace-fail '"/bin/sh"' '"${lib.getExe' bash "sh"}"'
+  '';
+
   cargoHash = "sha256-wAjFC6qAC3nllbnZf0KVaZTEztNYo6GTvwcp5FYmXLw=";
 
   separateDebugInfo = true;
@@ -48,10 +52,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
   ];
 
-  postPatch = ''
-    substituteInPlace src/main.rs --replace-fail '"/bin/sh"' '"${lib.getExe' bash "sh"}"'
-  '';
-
   passthru = {
     tests = {
       inherit (nixosTests)
diff --git a/pkgs/by-name/co/cosmic-initial-setup/package.nix b/pkgs/by-name/co/cosmic-initial-setup/package.nix
index cf7d5a6b55f1..e862e2929846 100644
--- a/pkgs/by-name/co/cosmic-initial-setup/package.nix
+++ b/pkgs/by-name/co/cosmic-initial-setup/package.nix
@@ -24,9 +24,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-UABqbmbwW2ZBOO7mq16/h0s55VCWRF2yyf/1TaubC88=";
   };
 
-  cargoHash = "sha256-DESnl5NjakU4++Ep6CHxDZzHn+o0Gi0eREpXk5BN5iY=";
+  postPatch = ''
+    # Installs in $out/etc/xdg/autostart instead of /etc/xdg/autostart
+    substituteInPlace justfile \
+      --replace-fail \
+      "autostart-dst := rootdir / 'etc' / 'xdg' / 'autostart' / desktop-entry" \
+      "autostart-dst := prefix / 'etc' / 'xdg' / 'autostart' / desktop-entry"
+  '';
 
-  separateDebugInfo = true;
+  cargoHash = "sha256-DESnl5NjakU4++Ep6CHxDZzHn+o0Gi0eREpXk5BN5iY=";
 
   buildFeatures = [ "nixos" ];
 
@@ -38,8 +44,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # https://github.com/rust-secure-code/cargo-auditable/issues/225
   auditable = false;
 
+  separateDebugInfo = true;
   __structuredAttrs = true;
 
+  env = {
+    VERGEN_GIT_SHA = finalAttrs.src.tag;
+    DISABLE_IF_EXISTS = "/iso/nix-store.squashfs";
+  };
+
   nativeBuildInputs = [
     libcosmicAppHook
     just
@@ -52,18 +64,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     udev
   ];
 
-  postPatch = ''
-    # Installs in $out/etc/xdg/autostart instead of /etc/xdg/autostart
-    substituteInPlace justfile \
-      --replace-fail \
-      "autostart-dst := rootdir / 'etc' / 'xdg' / 'autostart' / desktop-entry" \
-      "autostart-dst := prefix / 'etc' / 'xdg' / 'autostart' / desktop-entry"
-  '';
-
-  preFixup = ''
-    libcosmicAppWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ killall ]})
-  '';
-
   dontUseJustBuild = true;
   dontUseJustCheck = true;
 
@@ -76,7 +76,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
   ];
 
-  env.DISABLE_IF_EXISTS = "/iso/nix-store.squashfs";
+  preFixup = ''
+    libcosmicAppWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ killall ]})
+  '';
 
   passthru = {
     tests = {
diff --git a/pkgs/by-name/co/cosmic-launcher/package.nix b/pkgs/by-name/co/cosmic-launcher/package.nix
index 2f790b30098d..67cd03835e20 100644
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@@ -26,6 +26,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   separateDebugInfo = true;
   __structuredAttrs = true;
 
+  env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" = "--cfg tokio_unstable";
+
   nativeBuildInputs = [
     just
     libcosmicAppHook
@@ -43,8 +45,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
   ];
 
-  env."CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_RUSTFLAGS" = "--cfg tokio_unstable";
-
   passthru = {
     tests = {
       inherit (nixosTests)
diff --git a/pkgs/by-name/co/cosmic-osd/package.nix b/pkgs/by-name/co/cosmic-osd/package.nix
index c3bdf6376f10..b77ec8ce3776 100644
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -30,6 +30,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   separateDebugInfo = true;
   __structuredAttrs = true;
 
+  env.POLKIT_AGENT_HELPER_1 = "/run/wrappers/bin/polkit-agent-helper-1";
+
   nativeBuildInputs = [
     just
     libcosmicAppHook
@@ -55,8 +57,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
   ];
 
-  env.POLKIT_AGENT_HELPER_1 = "/run/wrappers/bin/polkit-agent-helper-1";
-
   passthru = {
     tests = {
       inherit (nixosTests)
diff --git a/pkgs/by-name/co/cosmic-player/package.nix b/pkgs/by-name/co/cosmic-player/package.nix
index b12ec673f447..3f65b0933ac9 100644
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@@ -1,3 +1,7 @@
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: Lily Foster <lily@lily.flowers>
+# Portions of this code are adapted from nixos-cosmic
+# https://github.com/lilyinstarlight/nixos-cosmic
 {
   lib,
   stdenv,
@@ -33,6 +37,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   separateDebugInfo = true;
   __structuredAttrs = true;
 
+  env.VERGEN_GIT_SHA = finalAttrs.src.tag;
+
   nativeBuildInputs = [
     just
     pkg-config
@@ -40,9 +46,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rustPlatform.bindgenHook
   ];
 
-  # Largely based on lilyinstarlight's work linked below
-  # https://github.com/lilyinstarlight/nixos-cosmic/blob/main/pkgs/cosmic-player/package.nix
-
   buildInputs = [
     alsa-lib
     ffmpeg
@@ -67,7 +70,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
   ];
 
-  postInstall = ''
+  preFixup = ''
     libcosmicAppWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
   '';
 
diff --git a/pkgs/by-name/co/cosmic-protocols/package.nix b/pkgs/by-name/co/cosmic-protocols/package.nix
index 59601aa1f023..a8b83db04966 100644
--- a/pkgs/by-name/co/cosmic-protocols/package.nix
+++ b/pkgs/by-name/co/cosmic-protocols/package.nix
@@ -21,9 +21,10 @@ stdenv.mkDerivation {
   __structuredAttrs = true;
   strictDeps = true;
 
-  makeFlags = [ "PREFIX=${placeholder "out"}" ];
   nativeBuildInputs = [ wayland-scanner ];
 
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
   passthru = {
     tests = {
       inherit (nixosTests)
diff --git a/pkgs/by-name/co/cosmic-reader/package.nix b/pkgs/by-name/co/cosmic-reader/package.nix
index 3fd07573578c..e9aaa8d7d4cc 100644
--- a/pkgs/by-name/co/cosmic-reader/package.nix
+++ b/pkgs/by-name/co/cosmic-reader/package.nix
@@ -33,6 +33,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   separateDebugInfo = true;
   __structuredAttrs = true;
 
+  env.VERGEN_GIT_SHA = finalAttrs.src.rev;
+
   nativeBuildInputs = [
     just
     libcosmicAppHook
@@ -64,8 +66,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
   ];
 
-  env.VERGEN_GIT_SHA = finalAttrs.src.rev;
-
   passthru.updateScript = nix-update-script {
     extraArgs = [
       "--version"
diff --git a/pkgs/by-name/co/cosmic-session/package.nix b/pkgs/by-name/co/cosmic-session/package.nix
index cf4406a3cb21..f613444b3d6d 100644
--- a/pkgs/by-name/co/cosmic-session/package.nix
+++ b/pkgs/by-name/co/cosmic-session/package.nix
@@ -22,23 +22,25 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-FphY53MaOUUR2oQfZak3HbT+kvysUnw2AIc4L9O+TcU=";
   };
 
+  postPatch = ''
+    substituteInPlace data/start-cosmic \
+      --replace-fail '/usr/bin/cosmic-session' "$out/bin/cosmic-session" \
+      --replace-fail '/usr/bin/dbus-run-session' "${lib.getBin dbus}/bin/dbus-run-session"
+    substituteInPlace data/cosmic.desktop \
+      --replace-fail '/usr/bin/start-cosmic' "$out/bin/start-cosmic"
+  '';
+
   cargoHash = "sha256-5dLG40X+yxJo566guyHqOCLNp+uNSE+HONS8GIDm58A=";
 
   separateDebugInfo = true;
-
-  postPatch = ''
-    substituteInPlace data/start-cosmic \
-      --replace-fail '/usr/bin/cosmic-session' "${placeholder "out"}/bin/cosmic-session" \
-      --replace-fail '/usr/bin/dbus-run-session' "${lib.getBin dbus}/bin/dbus-run-session"
-    substituteInPlace data/cosmic.desktop \
-      --replace-fail '/usr/bin/start-cosmic' "${placeholder "out"}/bin/start-cosmic"
-  '';
-
   __structuredAttrs = true;
 
-  buildInputs = [ bash ];
+  env.ORCA = "orca"; # get orca from $PATH
+
   nativeBuildInputs = [ just ];
 
+  buildInputs = [ bash ];
+
   dontUseJustBuild = true;
 
   justFlags = [
@@ -53,8 +55,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
   ];
 
-  env.ORCA = "orca"; # get orca from $PATH
-
   passthru = {
     providedSessions = [ "cosmic" ];
     tests = {
diff --git a/pkgs/by-name/co/cosmic-store/package.nix b/pkgs/by-name/co/cosmic-store/package.nix
index d29231e0e70d..b18e93b8d886 100644
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@@ -30,6 +30,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   separateDebugInfo = true;
   __structuredAttrs = true;
 
+  env.VERGEN_GIT_SHA = finalAttrs.src.tag;
+
   nativeBuildInputs = [
     just
     pkg-config
diff --git a/pkgs/by-name/co/cosmic-term/package.nix b/pkgs/by-name/co/cosmic-term/package.nix
index b99fcc991196..7fe8ca7f71fc 100644
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@@ -30,6 +30,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   separateDebugInfo = true;
   __structuredAttrs = true;
 
+  env.VERGEN_GIT_SHA = finalAttrs.src.tag;
+
   nativeBuildInputs = [
     just
     pkg-config
diff --git a/pkgs/by-name/co/cosmic-wallpapers/package.nix b/pkgs/by-name/co/cosmic-wallpapers/package.nix
index a0ddd6e66db8..18ce48be87ef 100644
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@@ -19,11 +19,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-m2cYppfitpBDKK8CC9i/lUrC9rfSYTuqUSZSyIKKGyg=";
   };
 
-  makeFlags = [ "prefix=${placeholder "out"}" ];
-
   __structuredAttrs = true;
   strictDeps = true;
 
+  makeFlags = [ "prefix=${placeholder "out"}" ];
+
   passthru.updateScript = nix-update-script {
     extraArgs = [
       "--version-regex"
diff --git a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
index 92fa4090d020..27e938258398 100644
--- a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
+++ b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
@@ -27,7 +27,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-Z5dC3W8QoDBZWBjHwRj9MC8EScDjQwUiUcOPTRDToDA=";
 
   separateDebugInfo = true;
-
   __structuredAttrs = true;
 
   nativeBuildInputs = [
@@ -41,13 +40,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     udev
   ];
 
-  dontCargoInstall = true;
-
   makeFlags = [
     "prefix=${placeholder "out"}"
     "CARGO_TARGET_DIR=target/${stdenv.hostPlatform.rust.cargoShortTarget}"
   ];
 
+  dontCargoInstall = true;
+
   passthru = {
     tests = {
       inherit (nixosTests)
diff --git a/pkgs/by-name/do/docker-credential-helpers/package.nix b/pkgs/by-name/do/docker-credential-helpers/package.nix
index a48170c3140d..c98b49551dcb 100644
--- a/pkgs/by-name/do/docker-credential-helpers/package.nix
+++ b/pkgs/by-name/do/docker-credential-helpers/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "docker-credential-helpers";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "docker-credential-helpers";
     rev = "v${version}";
-    sha256 = "sha256-HgioRk6qz9H9KD0JWcYg2bIpqHZxnPHYc3idxMUKuD8=";
+    sha256 = "sha256-xioDtn0/4CZytaUhRXb2T5DHnP/yWdXPeNTQoKf9AoA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ek/eksctl/package.nix b/pkgs/by-name/ek/eksctl/package.nix
index 5c130c809433..f5f3a26596c3 100644
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "eksctl";
-  version = "0.226.0";
+  version = "0.229.0";
 
   src = fetchFromGitHub {
     owner = "eksctl-io";
     repo = "eksctl";
     rev = finalAttrs.version;
-    hash = "sha256-XjiM4o4xJPY+ZFtvWi5K99tQaZwNxiCla/jUeQQo+5E=";
+    hash = "sha256-lLpodO/y4Ho3AAuIVSerDPKhSBiKFIQmRyOJWYK1DCw=";
   };
 
-  vendorHash = "sha256-HP0EdZeM2Nz6LI3EjVT7qPl47Suh45OjWptEHgqqvhg=";
+  vendorHash = "sha256-6oSv3NrBPNraHrGsmJzMEeDlR9CcKn0M5FwoL5t+kd0=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/fa/factorio/versions.json b/pkgs/by-name/fa/factorio/versions.json
index f2b6cbf32025..1aace8201fa6 100644
--- a/pkgs/by-name/fa/factorio/versions.json
+++ b/pkgs/by-name/fa/factorio/versions.json
@@ -3,14 +3,14 @@
     "alpha": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio_linux_2.1.8.tar.xz"
+          "factorio_linux_2.1.9.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.1.8.tar.xz",
+        "name": "factorio_alpha_x64-2.1.9.tar.xz",
         "needsAuth": true,
-        "sha256": "307016173b824ddfa1a1be4067526273f3aafe6dc8a9c49aff7b2250c466b0b0",
+        "sha256": "9e2d3d9a6f323c2d34215f264751599d9c9a87a9af2c7c4bdcbee8fb8d7c7245",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.1.8/alpha/linux64",
-        "version": "2.1.8"
+        "url": "https://factorio.com/get-download/2.1.9/alpha/linux64",
+        "version": "2.1.9"
       },
       "stable": {
         "candidateHashFilenames": [
@@ -51,14 +51,14 @@
     "expansion": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.1.8.tar.xz"
+          "factorio-space-age_linux_2.1.9.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.1.8.tar.xz",
+        "name": "factorio_expansion_x64-2.1.9.tar.xz",
         "needsAuth": true,
-        "sha256": "92ec753d96eab63fc60f45ac45259a9427268f74bab0c15b63263f10aae0e786",
+        "sha256": "481d1b1b7f4652f6dd5bd1f3a20a3f8aaddfe8f6866f8bde086986601be190e5",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.1.8/expansion/linux64",
-        "version": "2.1.8"
+        "url": "https://factorio.com/get-download/2.1.9/expansion/linux64",
+        "version": "2.1.9"
       },
       "stable": {
         "candidateHashFilenames": [
@@ -75,15 +75,15 @@
     "headless": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.1.8.tar.xz",
-          "factorio_headless_x64_2.1.8.tar.xz"
+          "factorio-headless_linux_2.1.9.tar.xz",
+          "factorio_headless_x64_2.1.9.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.1.8.tar.xz",
+        "name": "factorio_headless_x64-2.1.9.tar.xz",
         "needsAuth": false,
-        "sha256": "16b122cd5f48118cd44bcaf1d27fd933aea60b9902bbd426fd26359440759f12",
+        "sha256": "2cf94327877c92b95857356f7629f674a1314abd2c09e5c992f345707d165980",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.1.8/headless/linux64",
-        "version": "2.1.8"
+        "url": "https://factorio.com/get-download/2.1.9/headless/linux64",
+        "version": "2.1.9"
       },
       "stable": {
         "candidateHashFilenames": [
diff --git a/pkgs/by-name/fr/frigate/package.nix b/pkgs/by-name/fr/frigate/package.nix
index 8cb605a69061..952c7c49c4f8 100644
--- a/pkgs/by-name/fr/frigate/package.nix
+++ b/pkgs/by-name/fr/frigate/package.nix
@@ -15,14 +15,14 @@
 }:
 
 let
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchFromGitHub {
     name = "frigate-${version}-source";
     owner = "blakeblackshear";
     repo = "frigate";
     tag = "v${version}";
-    hash = "sha256-jQQ54By77dOVSIu08YhJn+EUV0D03j1bcMQRk9404RE=";
+    hash = "sha256-8ujG5rVGqIJxM+IiQKvudrA0xqfz+3Uisl/zXwARPpY=";
   };
 
   frigate-web = callPackage ./web.nix {
@@ -239,9 +239,6 @@ python3Packages.buildPythonApplication rec {
     pytestCheckHook
   ];
 
-  # interpreter crash in onnxruntime on aarch64-linux
-  doCheck = !(stdenv.hostPlatform.system == "aarch64-linux");
-
   preCheck = ''
     # Unavailable in the build sandbox
     substituteInPlace frigate/const.py \
diff --git a/pkgs/by-name/fv/fvs2/package.nix b/pkgs/by-name/fv/fvs2/package.nix
index 2a2e310332d0..ff4fb1a1e201 100644
--- a/pkgs/by-name/fv/fvs2/package.nix
+++ b/pkgs/by-name/fv/fvs2/package.nix
@@ -13,16 +13,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "fvs2";
-  version = "0.1.5";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "fvs-lab";
     repo = "fvs2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YFtHWtkAPxHT2BqJyyKpPPwkrYyDoFEHq76mNPczJjI=";
+    hash = "sha256-wod+GzJ/tCl0dlAv0PM9I1TG9l96SujrOkSlEsgXp5U=";
   };
 
-  vendorHash = "sha256-onx9DxaDcNwDWXfSNSugOG9WoLG918b2A1KJIaeQNpI=";
+  vendorHash = "sha256-MDizWAeXJW0YTMrGEtk3Ulvx0InW0EgytrtE9O7T3Ps=";
 
   preBuild = ''
     cp -r ${core} ../core
diff --git a/pkgs/applications/virtualization/krunvm/default.nix b/pkgs/by-name/kr/krunvm/package.nix
similarity index 88%
rename from pkgs/applications/virtualization/krunvm/default.nix
rename to pkgs/by-name/kr/krunvm/package.nix
index 8dd4fc569e42..70b8dd4114f0 100644
--- a/pkgs/applications/virtualization/krunvm/default.nix
+++ b/pkgs/by-name/kr/krunvm/package.nix
@@ -7,29 +7,32 @@
   buildah,
   buildah-unwrapped,
   cargo,
+  darwin,
   libiconv,
   libkrun,
   makeWrapper,
   rustc,
-  sigtool,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "krunvm";
   version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "libkrun";
     repo = "krunvm";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-peOaPivQKOwioh5skPNFiA3ptHv9pSsnjpy43cms8O8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
+    inherit (finalAttrs) src;
     hash = "sha256-MRcQ0Vnd3PJqE2q981JpXPjwMUKT4t+RcOvzWptK7PQ=";
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   nativeBuildInputs = [
     rustPlatform.cargoSetupHook
     cargo
@@ -37,7 +40,7 @@ stdenv.mkDerivation rec {
     asciidoctor
     makeWrapper
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.sigtool ];
 
   buildInputs = [
     libkrun
@@ -77,4 +80,4 @@ stdenv.mkDerivation rec {
     platforms = libkrun.meta.platforms;
     mainProgram = "krunvm";
   };
-}
+})
diff --git a/pkgs/by-name/li/libcosmicAppHook/libcosmic-app-hook.sh b/pkgs/by-name/li/libcosmicAppHook/libcosmic-app-hook.sh
index e6a523191956..2263dd3db2ca 100644
--- a/pkgs/by-name/li/libcosmicAppHook/libcosmic-app-hook.sh
+++ b/pkgs/by-name/li/libcosmicAppHook/libcosmic-app-hook.sh
@@ -5,24 +5,25 @@
 
 # shellcheck shell=bash
 libcosmicAppWrapperArgs=()
+libcosmicAppWrapHookRanFor=()
 
 libcosmicAppVergenHook() {
-  if [ -z "${VERGEN_GIT_COMMIT_DATE-}" ]; then
-    # shellcheck disable=SC2155
-    export VERGEN_GIT_COMMIT_DATE="$(date --utc --date=@"$SOURCE_DATE_EPOCH" '+%Y-%m-%d')"
-  fi
+    if [ -z "${VERGEN_GIT_COMMIT_DATE-}" ]; then
+        # shellcheck disable=SC2155
+        export VERGEN_GIT_COMMIT_DATE="$(date --utc --date=@"$SOURCE_DATE_EPOCH" '+%Y-%m-%d')"
+    fi
 }
 
 libcosmicAppLinkerArgsHook() {
-  # Force linking to certain libraries like libEGL, which are always dlopen()ed
-  local flags="CARGO_TARGET_@cargoLinkerVar@_RUSTFLAGS"
+    # Force linking to certain libraries like libEGL, which are always dlopen()ed
+    local flags="CARGO_TARGET_@cargoLinkerVar@_RUSTFLAGS"
 
-  export "$flags"="${!flags-} -C link-arg=-Wl,--push-state,--no-as-needed"
-  # shellcheck disable=SC2043
-  for lib in @cargoLinkLibs@; do
-      export "$flags"="${!flags} -C link-arg=-l${lib}"
-  done
-  export "$flags"="${!flags} -C link-arg=-Wl,--pop-state"
+    export "$flags"="${!flags-} -C link-arg=-Wl,--push-state,--no-as-needed"
+    # shellcheck disable=SC2043
+    for lib in @cargoLinkLibs@; do
+        export "$flags"="${!flags} -C link-arg=-l${lib}"
+    done
+    export "$flags"="${!flags} -C link-arg=-Wl,--pop-state"
 }
 
 preConfigurePhases+=" libcosmicAppVergenHook libcosmicAppLinkerArgsHook"
@@ -51,9 +52,18 @@ wrapLibcosmicApp() {
 
 # Note: $libcosmicAppWrapperArgs still gets defined even if ${dontWrapLibcosmicApp-} is set
 libcosmicAppWrapHook() {
-    # guard against running multiple times (e.g. due to propagation)
-    [ -z "$libcosmicAppWrapHookHasRun" ] || return 0
-    libcosmicAppWrapHookHasRun=1
+    # guard against running multiple times for the same prefix (e.g. due to propagation)
+    for _ranFor in "${libcosmicAppWrapHookRanFor[@]}"; do
+        if [[ "$_ranFor" == "$prefix" ]]; then
+            echo "[libcosmicAppWrapHook] already ran for prefix='${prefix}', returning early"
+            return 0
+        fi
+    done
+    libcosmicAppWrapHookRanFor+=("$prefix")
+
+    echo "[libcosmicAppWrapHook] prefix='${prefix}'"
+    echo "[libcosmicAppWrapHook] dontWrapLibcosmicApp='${dontWrapLibcosmicApp:-}'"
+    echo "[libcosmicAppWrapHook] libcosmicAppWrapperArgs=(${libcosmicAppWrapperArgs[*]})"
 
     if [[ -z "${dontWrapLibcosmicApp:-}" ]]; then
         targetDirsThatExist=()
@@ -61,35 +71,47 @@ libcosmicAppWrapHook() {
 
         # wrap binaries
         targetDirs=("${prefix}/bin" "${prefix}/libexec")
+        echo "[libcosmicAppWrapHook] checking targetDirs: ${targetDirs[*]}"
         for targetDir in "${targetDirs[@]}"; do
+            echo "[libcosmicAppWrapHook] checking targetDir='${targetDir}' exists=$([ -d "${targetDir}" ] && echo yes || echo no)"
             if [[ -d "${targetDir}" ]]; then
                 targetDirsThatExist+=("${targetDir}")
                 targetDirsRealPath+=("$(realpath "${targetDir}")/")
+                echo "[libcosmicAppWrapHook] finding executables in '${targetDir}'"
                 find "${targetDir}" -type f -executable -print0 |
                     while IFS= read -r -d '' file; do
-                        echo "Wrapping program '${file}'"
+                        echo "[libcosmicAppWrapHook] wrapping program '${file}'"
                         wrapLibcosmicApp "${file}"
                     done
             fi
         done
 
+        echo "[libcosmicAppWrapHook] targetDirsThatExist=(${targetDirsThatExist[*]})"
+        echo "[libcosmicAppWrapHook] targetDirsRealPath=(${targetDirsRealPath[*]})"
+
         # wrap links to binaries that point outside targetDirs
         # Note: links to binaries within targetDirs do not need
         #       to be wrapped as the binaries have already been wrapped
         if [[ ${#targetDirsThatExist[@]} -ne 0 ]]; then
+            echo "[libcosmicAppWrapHook] finding symlinks in targetDirs"
             find "${targetDirsThatExist[@]}" -type l -xtype f -executable -print0 |
                 while IFS= read -r -d '' linkPath; do
                     linkPathReal=$(realpath "${linkPath}")
+                    echo "[libcosmicAppWrapHook] checking link '${linkPath}' -> '${linkPathReal}'"
                     for targetPath in "${targetDirsRealPath[@]}"; do
                         if [[ "$linkPathReal" == "$targetPath"* ]]; then
-                            echo "Not wrapping link: '$linkPath' (already wrapped)"
+                            echo "[libcosmicAppWrapHook] not wrapping link: '$linkPath' (already wrapped)"
                             continue 2
                         fi
                     done
-                    echo "Wrapping link: '$linkPath'"
+                    echo "[libcosmicAppWrapHook] wrapping link: '$linkPath'"
                     wrapLibcosmicApp "${linkPath}"
                 done
+        else
+            echo "[libcosmicAppWrapHook] no targetDirs exist, skipping symlink wrapping"
         fi
+    else
+        echo "[libcosmicAppWrapHook] dontWrapLibcosmicApp is set, skipping all wrapping"
     fi
 }
 
diff --git a/pkgs/by-name/mu/mutt/package.nix b/pkgs/by-name/mu/mutt/package.nix
index cf783fa97784..d2a1b3077d98 100644
--- a/pkgs/by-name/mu/mutt/package.nix
+++ b/pkgs/by-name/mu/mutt/package.nix
@@ -31,7 +31,7 @@ assert gpgmeSupport -> sslSupport;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "2.4.0";
+  version = "2.4.1";
   outputs = [
     "out"
     "doc"
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    hash = "sha256-j2yi70L48HzcjsOR6KpBpwJJDq5VrHIBawuU3fRK4pI=";
+    hash = "sha256-ViQyHwscwe/2yrnvCPJZVP9kxRsz1L87mUhM8e3Yz/8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/on/onedrivegui/package.nix b/pkgs/by-name/on/onedrivegui/package.nix
index 38de95965ed4..a89e7a717e74 100644
--- a/pkgs/by-name/on/onedrivegui/package.nix
+++ b/pkgs/by-name/on/onedrivegui/package.nix
@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "1.3.1";
+  version = "1.3.2";
 
   setupPy = writeText "setup.py" ''
     from setuptools import setup
@@ -36,7 +36,7 @@ python3Packages.buildPythonApplication rec {
     owner = "bpozdena";
     repo = "OneDriveGUI";
     tag = "v${version}";
-    hash = "sha256-hqo3e9YjfPpR4hLRfqozxEFN0LnEcgigleROOZqY6WY=";
+    hash = "sha256-KgpQShjSjZHNBC/aovpl/VQO5zhJZ8+8GLup75m0gJo=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/applications/networking/ostinato/drone_ini.patch b/pkgs/by-name/os/ostinato/drone_ini.patch
similarity index 100%
rename from pkgs/applications/networking/ostinato/drone_ini.patch
rename to pkgs/by-name/os/ostinato/drone_ini.patch
diff --git a/pkgs/applications/networking/ostinato/default.nix b/pkgs/by-name/os/ostinato/package.nix
similarity index 82%
rename from pkgs/applications/networking/ostinato/default.nix
rename to pkgs/by-name/os/ostinato/package.nix
index 09001da1999b..c7bae24b536b 100644
--- a/pkgs/applications/networking/ostinato/default.nix
+++ b/pkgs/by-name/os/ostinato/package.nix
@@ -3,13 +3,10 @@
   stdenv,
   fetchFromGitHub,
   fetchurl,
-  qmake,
+  qt5,
   copyDesktopItems,
-  wrapQtAppsHook,
   makeDesktopItem,
-  qtbase,
-  qtscript,
-  protobuf,
+  protobuf_21,
   libpcap,
   wireshark,
   gzip,
@@ -17,35 +14,42 @@
   gawk,
   libnl,
 }:
+let
+  protobuf = protobuf_21;
 
-stdenv.mkDerivation rec {
+  ostinatoIcon = fetchurl {
+    url = "https://ostinato.org/images/site-logo.png";
+    hash = "sha256-9cBngj8pNOTTWNdvZaND79aa14OnrqvXq0zjzQNJDXA=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "ostinato";
   version = "1.3.0";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "pstavirs";
     repo = "ostinato";
-    rev = "v${version}";
-    sha256 = "sha256-/fPUxGeh5Cc3rb+1mR0chkiFPw5m+O6KtWDvzLn0iYo=";
-  };
-
-  ostinatoIcon = fetchurl {
-    url = "https://ostinato.org/images/site-logo.png";
-    sha256 = "f5c067823f2934e4d358d76f65a343efd69ad783a7aeabd7ab4ce3cd03490d70";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/fPUxGeh5Cc3rb+1mR0chkiFPw5m+O6KtWDvzLn0iYo=";
   };
 
   buildInputs = [
-    qtbase
+    qt5.qtbase
     protobuf
     libpcap
-    qtscript
+    qt5.qtscript
     libnl
   ];
 
   nativeBuildInputs = [
     copyDesktopItems
-    qmake
-    wrapQtAppsHook
+    qt5.qmake
+    qt5.wrapQtAppsHook
+    qt5.qtscript
+    protobuf
   ];
 
   patches = [ ./drone_ini.patch ];
@@ -92,4 +96,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ rick68 ];
     platforms = with lib.platforms; linux ++ darwin ++ cygwin;
   };
-}
+})
diff --git a/pkgs/by-name/ra/rassumfrassum/package.nix b/pkgs/by-name/ra/rassumfrassum/package.nix
index 888e4271c98b..88a5fa2ecc66 100644
--- a/pkgs/by-name/ra/rassumfrassum/package.nix
+++ b/pkgs/by-name/ra/rassumfrassum/package.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "0.3.3";
+  version = "0.3.4";
 in
 python3Packages.buildPythonApplication {
   pname = "rassumfrassum";
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication {
     owner = "joaotavora";
     repo = "rassumfrassum";
     tag = "v${version}";
-    hash = "sha256-3Hcews5f7o45GUmFdpLwkAHf0bthC1tUikkxau952Ec=";
+    hash = "sha256-q8Pv+E+UejK3z5xCw44Gji2xJ01uIo18qS5LHpLc5HE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index 6875b37b7c4e..fb04e282b187 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "0.44.3";
+  version = "0.44.6";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zb7JPgV78162NAWu0v5J+EbWt0AFdFrQfL1G63RDd7A=";
+    hash = "sha256-J8lvI5h3K7Ny8jkoBBLJX4qCSHkByDGWKHxDkVjAzUI=";
   };
 
   vendorHash = "sha256-AjckKD6NScBa8w9nWMdVExuNadz3vHnK854XXg3nj84=";
diff --git a/pkgs/by-name/rs/rsshub/package.nix b/pkgs/by-name/rs/rsshub/package.nix
index a097e9097c06..ff48489500e9 100644
--- a/pkgs/by-name/rs/rsshub/package.nix
+++ b/pkgs/by-name/rs/rsshub/package.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "rsshub";
-  version = "0-unstable-2026-06-09";
+  version = "0-unstable-2026-07-05";
 
   src = fetchFromGitHub {
     owner = "DIYgod";
     repo = "RSSHub";
-    rev = "7c3d43ca7d935c24bc767fb2fea83f57d7ea2354";
-    hash = "sha256-WmEvR0HbWyHetYUzalDn2OzQa9wGLWSjyqdYkITYNig=";
+    rev = "719cc1994b10bc96fcd17df6cf2046023d0cd9ba";
+    hash = "sha256-Db1nh42S2zrPheUT9nlHMRt7/qmKeMpHZ415rwWnedI=";
   };
 
   patches = [
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 3;
-    hash = "sha256-jLRZOz4c8MCr/cEvZBD4yTa6nmkPxXgM+h8Fybvklgc=";
+    hash = "sha256-ykKWrU9NCOXBuFb+I3TG5XFO81W4K9Y7fZk/KjB+5JI=";
     pnpm = pnpm_10;
   };
 
diff --git a/pkgs/by-name/sc/scalp/package.nix b/pkgs/by-name/sc/scalp/package.nix
index f574d7467d8c..b063c8afee9a 100644
--- a/pkgs/by-name/sc/scalp/package.nix
+++ b/pkgs/by-name/sc/scalp/package.nix
@@ -14,17 +14,16 @@
 
 stdenv.mkDerivation rec {
   pname = "scalp";
-  version = "0-unstable-2024-08-28";
+  version = "0-unstable-2026-06-29";
 
   src = fetchgit {
     url = "https://digidev.digi.e-technik.uni-kassel.de/git/scalp.git";
     # mirrored at https://git.sr.ht/~weijia/scalp
-    rev = "4a8e8b850a57328d9377ea7955c27c437394ebd3";
-    hash = "sha256-6OEf3yWFBmTKgeTMojRMRf/t9Ec1i851Lx3mQjCeOuw=";
+    rev = "91b4e52db746b0d25f6866143ee7a4a0defdeec5";
+    hash = "sha256-0VKBdz/XU2Pd9fsKBga/2KBexCqs/DyUpih1Qx2JLeA=";
   };
 
   postPatch = ''
-    sed -i "1i\#include <cstdint>" src/ScaLP/Solver.cpp
     substituteInPlace CMakeLists.txt \
       --replace-fail "cmake_minimum_required (VERSION 3.3.2)" "cmake_minimum_required (VERSION 3.5)" \
       --replace-fail "\''$ORIGIN" "\''${CMAKE_INSTALL_PREFIX}/lib" \
diff --git a/pkgs/by-name/sc/scx-loader/package.nix b/pkgs/by-name/sc/scx-loader/package.nix
index 1e2a932bd164..7746f33d4f96 100644
--- a/pkgs/by-name/sc/scx-loader/package.nix
+++ b/pkgs/by-name/sc/scx-loader/package.nix
@@ -7,15 +7,15 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "scx-loader";
-  version = "1.1.1";
+  version = "1.1.2";
 
-  cargoHash = "sha256-uX2lCVDa8eAKWi/bj94+JQHoOLll0OjKRHT0EPZELNc=";
+  cargoHash = "sha256-jzp1Z64p35Ap6TYuN977up8Ls8Jakfz9CeM5+brgtuQ=";
 
   src = fetchFromGitHub {
     owner = "sched-ext";
     repo = "scx-loader";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5OvdtW/Li+ubHDBSKe2ssE9ZyNSCcxNFSJffzxQ9WMk=";
+    hash = "sha256-SFolb2S7HGSsUPxXtiVCv/6N4XNqOU62c3GZX9axk9k=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix
index 996dc79064a9..0fab38250730 100644
--- a/pkgs/by-name/se/seaweedfs/package.nix
+++ b/pkgs/by-name/se/seaweedfs/package.nix
@@ -9,7 +9,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "seaweedfs";
-  version = "4.37";
+  version = "4.38";
 
   src = fetchFromGitHub {
     owner = "seaweedfs";
@@ -22,10 +22,10 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
       popd
     '';
-    hash = "sha256-/aX9f78AsdgvsesGv2vTPoWVcqAhehFuL3NkzOyZSXQ=";
+    hash = "sha256-aSgww0a79FOphPKXo8l24ZA8eiOPW6jYtbJYB59qV90=";
   };
 
-  vendorHash = "sha256-peRhKuZ1D+y8Uhw1+P8Ogc1HrOh1/kYVd29lR89+rIo=";
+  vendorHash = "sha256-xr1v41BMHSK/zxQM1CKzp8fCG6AdIEMb0TMsO2oaoXA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sk/skim/package.nix b/pkgs/by-name/sk/skim/package.nix
index f32e626687e0..d2a373310254 100644
--- a/pkgs/by-name/sk/skim/package.nix
+++ b/pkgs/by-name/sk/skim/package.nix
@@ -7,12 +7,12 @@
   nix-update-script,
   runtimeShell,
   rustPlatform,
-  skim,
-  testers,
+  versionCheckHook,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "skim";
-  version = "4.8.0";
+  version = "5.0.0";
+  __structuredAttrs = true;
 
   outputs = [
     "out"
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "skim-rs";
     repo = "skim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eU/OtURj/IriICi4qB5uUmyMzbsoZyEK18Kz40qKO08=";
+    hash = "sha256-fnpTEp2SXAgiK8stHR2AmRnefBDuXAS+gPoWbUDPirI=";
   };
 
   postPatch = ''
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "expand('<sfile>:h:h')" "'$out'"
   '';
 
-  cargoHash = "sha256-umJBYmX3lSaH6OjsxFMRT8+Ymq8OZNxG0qPtZs+Dhh0=";
+  cargoHash = "sha256-o02x09q3s4qyHJcAwhgjC0/fN6xTN392D2vlkAgTReI=";
 
   nativeBuildInputs = [ installShellFiles ];
   nativeCheckInputs = [
@@ -69,8 +69,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     cargo nextest run --release --offline --lib --bins --examples --tests
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  __darwinAllowLocalNetworking = true;
+
   passthru = {
-    tests.version = testers.testVersion { package = skim; };
     updateScript = nix-update-script { };
   };
 
diff --git a/pkgs/by-name/sp/sparkle/package.nix b/pkgs/by-name/sp/sparkle/package.nix
index 873c7b9b229c..dfc94a9a5245 100644
--- a/pkgs/by-name/sp/sparkle/package.nix
+++ b/pkgs/by-name/sp/sparkle/package.nix
@@ -41,20 +41,20 @@ in
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sparkle";
-  version = "1.26.5";
+  version = "1.26.6";
 
   src = fetchFromGitHub {
     owner = "xishang0128";
     repo = "sparkle";
     tag = finalAttrs.version;
-    hash = "sha256-b4SidOlMDSi+DdbuF3LmOMlQTSBxd2CAf9oshYGXWrQ=";
+    hash = "sha256-IFK7rhT3i+Qct0FIEYFbgQpJ5cjS7JMKd2tmOq5ZSNg=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-UrMzBinZsTfZigkPMOySJ/Yjskh6Csna1M6XpBpq0vI=";
+    hash = "sha256-H8RR1QtWLZC2oKPEwB7BR7947kTQmZB/gZBGYMtqSKU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/starlark/package.nix b/pkgs/by-name/st/starlark/package.nix
index 7887c9b2aea9..12a09fc2acc4 100644
--- a/pkgs/by-name/st/starlark/package.nix
+++ b/pkgs/by-name/st/starlark/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule {
   pname = "starlark";
-  version = "0-unstable-2026-06-13";
+  version = "0-unstable-2026-06-30";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "starlark-go";
-    rev = "8ba36ccb83fb02b223182e27808a6d5d0636afb9";
-    hash = "sha256-TH97v0LZt2W/0P9jPuKBmBCa079o3FIcX2hHBidhC3Y=";
+    rev = "529d8e869a14da46efe75b7e904a6183dd26ae29";
+    hash = "sha256-/DTLgF5S0lzftLVF2XTk0k5auuGBWnZqjN092i0eOKA=";
   };
 
   vendorHash = "sha256-Ejw5f5ulEcLHm4WYKatwA7FZ9lfdqZTOE3SdkaK6jYE=";
diff --git a/pkgs/by-name/sy/systemdgenie/package.nix b/pkgs/by-name/sy/systemdgenie/package.nix
index 131854eaa09c..35fa333eb6c3 100644
--- a/pkgs/by-name/sy/systemdgenie/package.nix
+++ b/pkgs/by-name/sy/systemdgenie/package.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation {
   pname = "systemdgenie";
-  version = "0.99.0-unstable-2026-06-04";
+  version = "0.99.0-unstable-2026-07-03";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     repo = "SystemdGenie";
     owner = "system";
-    rev = "4c83c2d0babdc4168b07a90a5ed0accd6c8f9e9c";
-    hash = "sha256-quaJRTF2ERw0hDNViphnPHrlbz98MHW9KX7hD6Apfwo=";
+    rev = "5e30259b7a234291bb0e337c7c9e5b4892304c99";
+    hash = "sha256-C6CwoHYqc3GS5xvIJA+Jv2cbe7iw7vqdxwh9Sh67ucw=";
   };
 
   strictDeps = true;
diff --git a/pkgs/desktops/lomiri/services/hfd-service/default.nix b/pkgs/desktops/lomiri/services/hfd-service/default.nix
index 201a99c39c2a..2f1997125060 100644
--- a/pkgs/desktops/lomiri/services/hfd-service/default.nix
+++ b/pkgs/desktops/lomiri/services/hfd-service/default.nix
@@ -17,28 +17,28 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hfd-service";
-  version = "0.2.3";
+  version = "0.2.4";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/hfd-service";
     rev = finalAttrs.version;
-    hash = "sha256-PvZPdisqpKl9OSuQXIJW1y6EJ5moesJiEAQjpQjzyWQ=";
+    hash = "sha256-gk0LHRmHqcG42H3Syje7XfZLiQ6hwzb22XcFa0xf7pc=";
   };
 
   postPatch = ''
     substituteInPlace qt/feedback-plugin/CMakeLists.txt \
-      --replace "\''${CMAKE_INSTALL_LIBDIR}/qt5/plugins" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtPluginPrefix}"
+      --replace-fail "\''${CMAKE_INSTALL_LIBDIR}/qt5/plugins" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtPluginPrefix}"
 
     # Queries pkg-config via pkg_get_variable, can't override prefix
     substituteInPlace init/CMakeLists.txt \
-      --replace 'pkg_get_variable(SYSTEMD_SYSTEM_DIR systemd systemdsystemunitdir)' 'set(SYSTEMD_SYSTEM_DIR ''${CMAKE_INSTALL_PREFIX}/lib/systemd/system)'
+      --replace-fail 'pkg_get_variable(SYSTEMD_SYSTEM_DIR systemd systemdsystemunitdir)' 'set(SYSTEMD_SYSTEM_DIR ''${CMAKE_INSTALL_PREFIX}/lib/systemd/system)'
     substituteInPlace CMakeLists.txt \
-      --replace 'pkg_get_variable(AS_INTERFACES_DIR accountsservice interfacesdir)' 'set(AS_INTERFACES_DIR "''${CMAKE_INSTALL_FULL_DATADIR}/accountsservice/interfaces")' \
-      --replace '../../dbus-1/interfaces' "\''${CMAKE_INSTALL_PREFIX}/\''${DBUS_INTERFACES_DIR}" \
-      --replace 'DESTINATION ''${DBUS_INTERFACES_DIR}' 'DESTINATION ''${CMAKE_INSTALL_PREFIX}/''${DBUS_INTERFACES_DIR}'
+      --replace-fail 'pkg_get_variable(AS_INTERFACES_DIR accountsservice interfacesdir)' 'set(AS_INTERFACES_DIR "''${CMAKE_INSTALL_FULL_DATADIR}/accountsservice/interfaces")' \
+      --replace-fail '../../dbus-1/interfaces' "\''${CMAKE_INSTALL_PREFIX}/\''${DBUS_INTERFACES_DIR}" \
+      --replace-fail 'DESTINATION ''${DBUS_INTERFACES_DIR}' 'DESTINATION ''${CMAKE_INSTALL_PREFIX}/''${DBUS_INTERFACES_DIR}'
     substituteInPlace src/CMakeLists.txt \
-      --replace "\''${DBUS_INTERFACES_DIR}/org.freedesktop.Accounts.xml" '${accountsservice}/share/dbus-1/interfaces/org.freedesktop.Accounts.xml'
+      --replace-fail "\''${DBUS_INTERFACES_DIR}/org.freedesktop.Accounts.xml" '${accountsservice}/share/dbus-1/interfaces/org.freedesktop.Accounts.xml'
   '';
 
   strictDeps = true;
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 4b39aa9eae95..db679cbb294b 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -69,16 +69,16 @@ let
 in
 {
   php82 = mkPhp {
-    version = "8.2.31";
-    hash = "sha256-lIGD+gTPJhybk2PAL0KJd7nd+MC/3/jo4fuoFu1XCAM=";
+    version = "8.2.32";
+    hash = "sha256-jyHpiMpN1eFN2fuImIRIeENWbkhygAJ8Tvq2yTGIotE=";
   };
   php83 = mkPhp {
-    version = "8.3.31";
-    hash = "sha256-5phrH9N+slQCEn/kpyeKPgO3+QJbt6S9KSonG9+TD7k=";
+    version = "8.3.32";
+    hash = "sha256-93fKJGYZZvlLMfaEDNrUN88wUBU324uHKxt6HCRLjQI=";
   };
   php84 = mkPhp {
-    version = "8.4.22";
-    hash = "sha256-Sxbn4sOEziXgfSjrlJhVxLT+DRt7nsnI7r0F0M+pxTI=";
+    version = "8.4.23";
+    hash = "sha256-wULAY7EM/2jQcnZuP/v7NlSgibk4ZosIMDVkN+6V4Po=";
   };
   php85 = mkPhp {
     version = "8.5.7";
diff --git a/pkgs/development/python-modules/apache-beam/default.nix b/pkgs/development/python-modules/apache-beam/default.nix
index d76083747d1c..121ac7c9d1ef 100644
--- a/pkgs/development/python-modules/apache-beam/default.nix
+++ b/pkgs/development/python-modules/apache-beam/default.nix
@@ -66,7 +66,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apache-beam";
-  version = "2.73.0";
+  version = "2.74.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -74,7 +74,7 @@ buildPythonPackage (finalAttrs: {
     owner = "apache";
     repo = "beam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0xdz4pxyiXYgIe3+Rb+prgVMjWHQnTSFn504mdMD3Xg=";
+    hash = "sha256-30abjaQFYNQ798GhS+MRMDkBbgsJyr6CYb9ymENLrfA=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/sdks/python";
@@ -193,7 +193,6 @@ buildPythonPackage (finalAttrs: {
 
     # These tests depend on the availability of specific servers backends.
     "apache_beam/runners/portability/flink_runner_test.py"
-    "apache_beam/runners/portability/samza_runner_test.py"
     "apache_beam/runners/portability/spark_runner_test.py"
 
     # Fails starting from dill 0.3.6 because it tries to pickle pytest globals:
diff --git a/pkgs/development/python-modules/dirsearch/default.nix b/pkgs/development/python-modules/dirsearch/default.nix
index f29892dec108..fd976d1a8000 100644
--- a/pkgs/development/python-modules/dirsearch/default.nix
+++ b/pkgs/development/python-modules/dirsearch/default.nix
@@ -33,14 +33,14 @@
   urllib3,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "dirsearch";
   version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "maurosoria";
     repo = "dirsearch";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-eXB103qUB3m7V/9hlq2xv3Y3bIz89/pGJsbPZQ+AZXs=";
   };
 
@@ -114,11 +114,11 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/maurosoria/dirsearch/releases/tag/${version}";
+    changelog = "https://github.com/maurosoria/dirsearch/releases/tag/${finalAttrs.src.tag}";
     description = "Command-line tool for brute-forcing directories and files in webservers, AKA a web path scanner";
     homepage = "https://github.com/maurosoria/dirsearch";
     license = lib.licenses.gpl2Only;
     mainProgram = "dirsearch";
     maintainers = with lib.maintainers; [ quantenzitrone ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/fava-dashboards/default.nix b/pkgs/development/python-modules/fava-dashboards/default.nix
index 05801e2c29a6..b34f4f92e99e 100644
--- a/pkgs/development/python-modules/fava-dashboards/default.nix
+++ b/pkgs/development/python-modules/fava-dashboards/default.nix
@@ -11,14 +11,14 @@
 }:
 buildPythonPackage rec {
   pname = "fava-dashboards";
-  version = "2.0.0";
+  version = "2.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "andreasgerstmayr";
     repo = "fava-dashboards";
     tag = "v${version}";
-    hash = "sha256-VmTdo6FUnGyy+7o5azE81SqQFsY4zaHzz7dK83SVbpg=";
+    hash = "sha256-48WS5ymgTN3843Rx3Va5/0ZoLsImrFat8BExOqvhL/c=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mypyllant/default.nix b/pkgs/development/python-modules/mypyllant/default.nix
index 6272dc3e58f9..bc453006d9b2 100644
--- a/pkgs/development/python-modules/mypyllant/default.nix
+++ b/pkgs/development/python-modules/mypyllant/default.nix
@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "mypyllant";
-  version = "0.9.15";
+  version = "0.9.16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "signalkraft";
     repo = "myPyllant";
     tag = "v${version}";
-    hash = "sha256-MaEk1IU0wCuR/rE3PYhSAjG925K/9N+1i6hVdgDg7YQ=";
+    hash = "sha256-Uzy7W+ZwdBDKKayl0z6FIj/NK9uA/IsWFFJCeO0o4vQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix
index 4b2c00f8aca5..0833fb4a5239 100644
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oelint-data";
-  version = "1.5.8";
+  version = "1.5.9";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = finalAttrs.version;
-    hash = "sha256-cjQAJtslRGZ7FwjlVoxgGVoPmdx6J8qlHcxbl/auf0I=";
+    hash = "sha256-kVTuRhP9T6kyhgavLsKtxNQz/7fW7LYDLR23rj+WGRM=";
   };
 
   build-system = [
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 5da7c32252b6..81fac05ef276 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "7.2-rc1",
-        "hash": "sha256:1gpwr6n3cc2hqg36gy9g9w4rxawpz3y126j752z4zyls6h80b43v",
+        "version": "7.2-rc2",
+        "hash": "sha256:0fmmgckfjcld0ljwdz3jzc1bpkyfsj0i8q90mzzy92j07s28nffh",
         "lts": false
     },
     "6.1": {
diff --git a/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix b/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix
index a8e01e0b5d4d..6d474ff2c305 100644
--- a/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/mypyllant/package.nix
@@ -19,13 +19,13 @@
 buildHomeAssistantComponent rec {
   owner = "signalkraft";
   domain = "mypyllant";
-  version = "0.9.16";
+  version = "0.9.17";
 
   src = fetchFromGitHub {
     owner = "signalkraft";
     repo = "mypyllant-component";
     tag = "v${version}";
-    hash = "sha256-+v8FqmP92FkfywJRH9JPvpTRyOAuTKAjNnnLXy6sLV8=";
+    hash = "sha256-OUNWju1g3vBjrUd/ZzQCMS08PWUyQUMnUkqElss9KaQ=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-forecast-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-forecast-card/package.nix
new file mode 100644
index 000000000000..797d12b749b7
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-forecast-card/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  nodejs,
+  pnpm,
+  pnpmConfigHook,
+  stdenvNoCC,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "weather-forecast-card";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "troinine";
+    repo = "ha-weather-forecast-card";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-N3bE6HSXx6Vst6ZiMsJ490XBnlDQJDm+MoEunlLusnQ=";
+  };
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-DDJpfkblo3E6YxWThs0rtkMabhRuDW2k5fszTo4Gud8=";
+  };
+
+  nativeBuildInputs = [
+    pnpmConfigHook
+    pnpm
+    nodejs
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out"
+    cp dist/* "$out"
+
+    runHook postInstall
+  '';
+
+  passthru.entrypoint = "weather-forecast-card.js";
+
+  meta = {
+    description = "Slightly improved weather forecast card for Home Assistant";
+    homepage = "https://github.com/troinine/ha-weather-forecast-card";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d9776439e60f..9473f70ff694 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -577,6 +577,7 @@ mapAliases {
   cordless = throw "'cordless' has been removed due to being archived upstream. Consider using 'discordo' instead."; # Added 2025-06-07
   corepack_latest = throw "'corepack_latest' has been removed, use 'corepack.override { nodejs-slim = pkgs.nodejs-slim_latest; }' instead"; # Added 2025-10-25
   coreth = throw "'coreth' has been moved to 'avalanchego' by upstream"; # Added 2026-01-15
+  cosmic-applibrary = warnAlias "'cosmic-applibrary' has been renamed to 'cosmic-app-library'" cosmic-app-library; # Added 2026-07-01
   cosmic-tasks = throw "'cosmic-tasks' has been renamed to/replaced by 'tasks'"; # Converted to throw 2025-10-27
   cotton = throw "'cotton' has been removed since it is vulnerable to CVE-2025-62518 and upstream is unmaintained"; # Added 2025-10-26
   cpp-ipfs-api = throw "'cpp-ipfs-api' has been renamed to/replaced by 'cpp-ipfs-http-client'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 52eb08682e15..3232fa6a0260 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2356,10 +2356,6 @@ with pkgs;
 
   keybase-gui = callPackage ../tools/security/keybase/gui.nix { };
 
-  krunvm = callPackage ../applications/virtualization/krunvm {
-    inherit (darwin) sigtool;
-  };
-
   limine-full = limine.override { enableAll = true; };
 
   logstash7 = callPackage ../tools/misc/logstash/7.x.nix {
@@ -9166,10 +9162,6 @@ with pkgs;
 
   ninja_1_11 = callPackage ../by-name/ni/ninja/package.nix { ninjaRelease = "1.11"; };
 
-  ostinato = libsForQt5.callPackage ../applications/networking/ostinato {
-    protobuf = protobuf_21;
-  };
-
   pcmanfm-qt = lxqt.pcmanfm-qt;
 
   pijuice = with python3Packages; toPythonApplication pijuice;