diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 9e06a46dcd94..5b73a0df83c4 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -45,13 +45,13 @@
     "vendorHash": "sha256-T2yIUO8DAuUC5s/bBxgsn99fCjJO1y6TzmPTuhT08FY="
   },
   "akamai": {
-    "hash": "sha256-ivIJvWKfL9oYvLZeoErvYKuCZLEwNaZD7jFrIGPlurI=",
+    "hash": "sha256-JALEVzmBVmHtCG4B1jNeNdSWb+SGZWDSZgUQ5voMQPg=",
     "homepage": "https://registry.terraform.io/providers/akamai/akamai",
     "owner": "akamai",
     "repo": "terraform-provider-akamai",
-    "rev": "v7.1.0",
+    "rev": "v8.0.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Sp65odS8Axdv5UpA5j2SXvbC/rfet4GlIawxk054Cs4="
+    "vendorHash": "sha256-sf6gCPsKnBVjMsCw7ZA4BKt9GAGtAcgU7vRZN8xzN9Q="
   },
   "alicloud": {
     "hash": "sha256-Jn4VzU6aPhMv6eMmXQ5gD5SA9IZfpmkRKpTrjRGrNF8=",
@@ -1237,13 +1237,13 @@
     "vendorHash": "sha256-K/44Jio2a1kKYuyI6o/5wwMNRaZvx9zrNEC85v56xdU="
   },
   "spacelift": {
-    "hash": "sha256-uRqZ5GRCP+oxm42cVVUdwUUixKLZbqfd6PjohbF7wNQ=",
+    "hash": "sha256-AptuuQV+uswWPU8ltjqSWqkPWTglPrrUkeVafD+RQ0U=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.22.0",
+    "rev": "v1.24.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-oEamCseBGmETqeBLiBHfh81oQNUHWfTrsegkFijvb20="
+    "vendorHash": "sha256-Tft0YjNUtwDH0SliSseXHqMKB2yzQTsAG1Wfc5ihpvE="
   },
   "spotinst": {
     "hash": "sha256-opJqvsqGqsFz2G+5T2JK1tpDxnFmMCxRVrUNYYnuN7s=",
@@ -1282,13 +1282,13 @@
     "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
   },
   "sumologic": {
-    "hash": "sha256-gTBgX1QHZz6qpizt2BP7BvE3j92q+dKhKHhP4bCTfvo=",
+    "hash": "sha256-7UjfkRCYay2bHUrnvLbadjSeCrhm6w6RzvRtUznpTDA=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v3.0.12",
+    "rev": "v3.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-S3SBp17+qqA64tWydD5DYc9KahycJ+qDrdXvFwu6Lbc="
+    "vendorHash": "sha256-jGGdSKXpg/N80lNsHFt1nU1t3oW5uDphGYHhBZmAgxE="
   },
   "sysdig": {
     "hash": "sha256-oJ51syzDKX7ZO8EJ3Ug1JNRO34N0t4Y8CzAszc5apOM=",
diff --git a/pkgs/applications/networking/discordo/default.nix b/pkgs/applications/networking/discordo/default.nix
index 9da33a368231..fe86c17638ca 100644
--- a/pkgs/applications/networking/discordo/default.nix
+++ b/pkgs/applications/networking/discordo/default.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "discordo";
-  version = "0-unstable-2025-05-23";
+  version = "0-unstable-2025-06-03";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = pname;
-    rev = "af2b0995ba6f6f2df8937cf6a6d5bee3adbc0d0c";
-    hash = "sha256-eBdPnpO9fZP7uq2/wVmeMu8Bf9UympsjUHTQlX2XKYw=";
+    rev = "23be8cd23591d3076712dd6c7c0b9e20571e1545";
+    hash = "sha256-hbgCxu48c+glnLN8jEAzFrOwxYxAdap3TaqKKtYtzqE=";
   };
 
-  vendorHash = "sha256-gEwTpt/NPN1+YpTBmW8F34UotowrOcA0mfFgBdVFiTA=";
+  vendorHash = "sha256-Kx0dI53ordvsSY0GCp6H+1XiSBAHXLbcg0tQJVa86uw=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/az/az-pim-cli/package.nix b/pkgs/by-name/az/az-pim-cli/package.nix
index e595583cde3b..28862d6ee308 100644
--- a/pkgs/by-name/az/az-pim-cli/package.nix
+++ b/pkgs/by-name/az/az-pim-cli/package.nix
@@ -11,16 +11,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "az-pim-cli";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "netr0m";
     repo = "az-pim-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Zi/DNTroMews4PvPCeLWSq74xWdZ22NO2VtmW91zcfs=";
+    hash = "sha256-gf4VscHaUr3JtsJO5PAq1nyPeJxIwGPaiH/QdXKpvQ0=";
   };
 
-  vendorHash = "sha256-g4NcRNmHXS3mOtE0nbV96vFFoVzGFbAvcj/vkdXshoU=";
+  vendorHash = "sha256-PHrpUlAG/PBe3NKUGBQ1U7dCcqkSlErWX2dp9ZPB3+8=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/do/dolt/package.nix b/pkgs/by-name/do/dolt/package.nix
index 053b64ca72dc..eceb9cce4c70 100644
--- a/pkgs/by-name/do/dolt/package.nix
+++ b/pkgs/by-name/do/dolt/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "dolt";
-  version = "1.53.6";
+  version = "1.54.1";
 
   src = fetchFromGitHub {
     owner = "dolthub";
     repo = "dolt";
     rev = "v${version}";
-    sha256 = "sha256-T/o4Fdfyq5kK4wG11Gdfa66iHv2Zb58v1geebFk/Ouc=";
+    sha256 = "sha256-VVINhJRws1WEfSld3E0sAE6jJuQWwmiN1JPL1LZ1dLs=";
   };
 
   modRoot = "./go";
   subPackages = [ "cmd/dolt" ];
-  vendorHash = "sha256-irMXQGOsTP/zSyVAYOtWex/H1cdNSthuyPbbR5FwCNI=";
+  vendorHash = "sha256-+UHw4cDcgRtzl8TGXLjUbBkUwJFhnuUbrwy1JUbS1ko=";
   proxyVendor = true;
   doCheck = false;
 
diff --git a/pkgs/by-name/du/dust/package.nix b/pkgs/by-name/du/dust/package.nix
index bbcfa8fd96be..8a27503204b5 100644
--- a/pkgs/by-name/du/dust/package.nix
+++ b/pkgs/by-name/du/dust/package.nix
@@ -12,13 +12,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # Since then, `dust` has been freed up, allowing this package to take that attribute.
   # However in order for tools like `nix-env` to detect package updates, keep `du-dust` for pname.
   pname = "du-dust";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "bootandy";
     repo = "dust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MmlCTF7tZBBOCnyhUjTatDjajFMGd+Nk2kYyxjzZc04=";
+    hash = "sha256-3Mk2gPlnm2kTRbn74T1YDH/DnjAyhFZQFK83OQaDNeo=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-H2tfDZBhIRRrdak8TWjzzjeJBQmYZVWqXNtxTnBnbDk=";
+  cargoHash = "sha256-IZv4XQmBvxUp5k5bn5B4qTJAVBrRO0OZaUlqCni6NpI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
index 32792f207d93..d7ce4b4fedb9 100644
--- a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator-mcp";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "fluxcd-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SszWTuK3HVsyc669NThQn5VAVwD/7JQtKtqBJD6cTT0=";
+    hash = "sha256-fpqioVo9UtuyiXUOpHQmsrkssDaseUjllBmsQ7r39Ww=";
   };
 
-  vendorHash = "sha256-5uT/pcfXrinyJ1hXmQ+vmWNuyO33c6d5PAjm6kwOZmY=";
+  vendorHash = "sha256-uR8FpJTzexFCM5M9K0h+80wlFnC0qNvQ/NMFnrVQWAo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ha/haproxy/package.nix b/pkgs/by-name/ha/haproxy/package.nix
index 68b49fbc45e6..6f6064061d31 100644
--- a/pkgs/by-name/ha/haproxy/package.nix
+++ b/pkgs/by-name/ha/haproxy/package.nix
@@ -42,11 +42,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "haproxy";
-  version = "3.1.7";
+  version = "3.2.0";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-o5UmRO+TmzYmDZHYGjNWNqqbRFcrTLi2ABJy+IVFxmY=";
+    hash = "sha256-92KuMbyhtR/rieQ5Xjbhf4Z8JTcqEIU8cNKSw90Xt7A=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/ju/jujutsu/package.nix b/pkgs/by-name/ju/jujutsu/package.nix
index 6a46439566f6..f01f4ae94198 100644
--- a/pkgs/by-name/ju/jujutsu/package.nix
+++ b/pkgs/by-name/ju/jujutsu/package.nix
@@ -4,10 +4,6 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
-  pkg-config,
-  libgit2,
-  libssh2,
-  openssl,
   git,
   gnupg,
   openssh,
@@ -18,29 +14,23 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jujutsu";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "jj-vcs";
     repo = "jj";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jyhjKppwK+emwLEXtOJKU0f4mPdLzDrQabnHhpyUzmw=";
+    hash = "sha256-l+E3os5At/PV4zKvUDSv4Aez9Bg0M+BZDvwVOHX+h9s=";
   };
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-1bb7YWXExS62s83rprHa0byUBJUCdw6JDYkQ3VZcje8=";
+  cargoHash = "sha256-5H4yPbJ5364CM8YEt40rTbks3+tuQsrb6OQ0wRUQZRw=";
 
   nativeBuildInputs = [
     installShellFiles
-    pkg-config
   ];
 
-  buildInputs = [
-    libgit2
-    libssh2
-  ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ openssl ];
-
   nativeCheckInputs = [
     git
     gnupg
diff --git a/pkgs/by-name/li/libsolv/package.nix b/pkgs/by-name/li/libsolv/package.nix
index 25103bd9523c..cd0b5e0eb43d 100644
--- a/pkgs/by-name/li/libsolv/package.nix
+++ b/pkgs/by-name/li/libsolv/package.nix
@@ -18,14 +18,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.32";
+  version = "0.7.33";
   pname = "libsolv";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "libsolv";
     rev = version;
-    hash = "sha256-2cvba2S/3CR+3sMLVEnmTxWYTQSAYZoUIoQHr+GZnyY=";
+    hash = "sha256-jOYz0p5oWMnPtQbpkCIUgw6e0W5PfR6teA9IdjYSghk=";
   };
 
   cmakeFlags =
diff --git a/pkgs/by-name/li/libvgm/package.nix b/pkgs/by-name/li/libvgm/package.nix
index 33c0241dd862..6c95a800020e 100644
--- a/pkgs/by-name/li/libvgm/package.nix
+++ b/pkgs/by-name/li/libvgm/package.nix
@@ -38,13 +38,13 @@ assert enableTools -> enableAudio && enableEmulation && enableLibplayer;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libvgm";
-  version = "0-unstable-2025-05-03";
+  version = "0-unstable-2025-05-30";
 
   src = fetchFromGitHub {
     owner = "ValleyBell";
     repo = "libvgm";
-    rev = "47581c5cf51748c8c948cfc1a8473e563529e9bb";
-    hash = "sha256-BJBQ/qAOZ2ykU2+zZ+FaGK2gK0R4Bu3+u3WmJVnjgMw=";
+    rev = "82ba45d3906a0b54b6de2555468dd9e9598f617d";
+    hash = "sha256-+EMI8hGDE+oiOK4pHRfDJxmGAZ3SBecNhCoPhS95NAk=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/lu/lunar-client/package.nix b/pkgs/by-name/lu/lunar-client/package.nix
index 92dff5e16573..99527086416f 100644
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunarclient";
-  version = "3.3.8";
+  version = "3.3.9";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}.AppImage";
-    hash = "sha512-H4v2fpOvjU8Cxxf0kxHf2CB/NwjarMp8EjjfGb2IbrVM0aXQQyvW+cHRwfsLnkyOxNYLWNC50Px0Ur/0rpj4bg==";
+    hash = "sha512-XeaxhpAuOOwsUSdzR/Tb58A8P1MZQDUBFST+NVX3z54BCfLkc8JNHnIKphwBfdf3bj3CF0a93rPTWNnd850aWA==";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/oa/oama/generated-package.nix b/pkgs/by-name/oa/oama/generated-package.nix
index e78d118a8e0b..046adf971b9a 100644
--- a/pkgs/by-name/oa/oama/generated-package.nix
+++ b/pkgs/by-name/oa/oama/generated-package.nix
@@ -4,8 +4,10 @@
   mkDerivation,
   aeson,
   base,
+  base64-bytestring,
   bytestring,
   containers,
+  cryptohash-sha256,
   directory,
   fetchgit,
   hsyslog,
@@ -18,6 +20,7 @@
   optparse-applicative,
   pretty-simple,
   process,
+  random,
   streaming-commons,
   string-qq,
   strings,
@@ -31,11 +34,11 @@
 }:
 mkDerivation {
   pname = "oama";
-  version = "0.20.1";
+  version = "0.20.2";
   src = fetchgit {
     url = "https://github.com/pdobsan/oama.git";
-    sha256 = "sha256-59tKAHL7rCZJyfraD7NnwFR5iP6784IcgH82hfsFHiA=";
-    rev = "99659a8567808b28885ed241abe4df03f37e92fc";
+    sha256 = "1zr2a77b3azdqyk6hzchhg573gwwb5h0d7x382srggm25lp3isk9";
+    rev = "bbe5a6d9f87659c8a24b6515694acf1b522a396b";
     fetchSubmodules = true;
   };
   isLibrary = true;
@@ -43,8 +46,10 @@ mkDerivation {
   libraryHaskellDepends = [
     aeson
     base
+    base64-bytestring
     bytestring
     containers
+    cryptohash-sha256
     directory
     hsyslog
     http-conduit
@@ -55,6 +60,7 @@ mkDerivation {
     optparse-applicative
     pretty-simple
     process
+    random
     streaming-commons
     string-qq
     strings
@@ -69,8 +75,10 @@ mkDerivation {
   executableHaskellDepends = [
     aeson
     base
+    base64-bytestring
     bytestring
     containers
+    cryptohash-sha256
     directory
     hsyslog
     http-conduit
@@ -81,6 +89,7 @@ mkDerivation {
     optparse-applicative
     pretty-simple
     process
+    random
     streaming-commons
     string-qq
     strings
diff --git a/pkgs/by-name/op/openlibm/package.nix b/pkgs/by-name/op/openlibm/package.nix
index be0cb6996efc..09f459ca5fcf 100644
--- a/pkgs/by-name/op/openlibm/package.nix
+++ b/pkgs/by-name/op/openlibm/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openlibm";
-  version = "0.8.6";
+  version = "0.8.7";
 
   src = fetchFromGitHub {
     owner = "JuliaLang";
     repo = "openlibm";
     rev = "v${version}";
-    sha256 = "sha256-HFSRrTdIhbbSyeU/FSo5e2ZI5tff2ZDEFgYcI412ATU=";
+    sha256 = "sha256-fSEszCJ1PXkSydTLk8KAyu7zffUrKf+7a1ZDf3Wl/lE=";
   };
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/se/servo/package.nix b/pkgs/by-name/se/servo/package.nix
index 103d7283f1e8..685a983fae63 100644
--- a/pkgs/by-name/se/servo/package.nix
+++ b/pkgs/by-name/se/servo/package.nix
@@ -61,13 +61,13 @@ in
 
 rustPlatform.buildRustPackage {
   pname = "servo";
-  version = "0-unstable-2025-05-25";
+  version = "0-unstable-2025-06-04";
 
   src = fetchFromGitHub {
     owner = "servo";
     repo = "servo";
-    rev = "3a04f4195eb650f092c44d5a05fee178b9e84fbe";
-    hash = "sha256-7dbt7h4qUPWgsKBt0wo9by6yTB4034SzlzdqMXmw2Xg=";
+    rev = "e78c033b5bc36a9576530869b38eba88080342d1";
+    hash = "sha256-BG0zQRLEM9bghjkB+He5fqpfinowRcn1k1oqhODzaPI=";
     # Breaks reproducibility depending on whether the picked commit
     # has other ref-names or not, which may change over time, i.e. with
     # "ref-names: HEAD -> main" as long this commit is the branch HEAD
@@ -78,7 +78,7 @@ rustPlatform.buildRustPackage {
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-XTtM7yU1kpzK2cspnYdgp7yrt4Xk7xeQ98rmBgu46Tg=";
+  cargoHash = "sha256-7jbaJSmz7isAiOYVXJ3gXorA2lhDEiVpL+l8gkOnQuM=";
 
   # set `HOME` to a temp dir for write access
   # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)
diff --git a/pkgs/by-name/sp/spider/package.nix b/pkgs/by-name/sp/spider/package.nix
index 146baa27c695..f1cdbc4360a5 100644
--- a/pkgs/by-name/sp/spider/package.nix
+++ b/pkgs/by-name/sp/spider/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spider";
-  version = "2.37.79";
+  version = "2.37.91";
 
   src = fetchFromGitHub {
     owner = "spider-rs";
     repo = "spider";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uYgdYIZ+T5G9TvgFCdErvex9KXN0pJn3MngMKpT/PVo=";
+    hash = "sha256-1WDsvEIoeWOUIN2HbTJeLkTlUgUZhExurPtN7ef/Egs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-uJ69BxeYhU/xVTKqOsxoqfS4At9+BtqurJfYUFEnKtA=";
+  cargoHash = "sha256-0DEJltTM8hH5Nsx5j2S9kURO7kLm/Mnv0M/QrarojaU=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/st/static-web-server/package.nix b/pkgs/by-name/st/static-web-server/package.nix
index 83f1cb8cb49d..86fbb36443cc 100644
--- a/pkgs/by-name/st/static-web-server/package.nix
+++ b/pkgs/by-name/st/static-web-server/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "static-web-server";
-  version = "2.36.1";
+  version = "2.37.0";
 
   src = fetchFromGitHub {
     owner = "static-web-server";
     repo = "static-web-server";
     rev = "v${version}";
-    hash = "sha256-labHPDsPRyF/cxHFoOJ5n+tBFn1KF2QdB/hZnDGWf1Q=";
+    hash = "sha256-haQYouLUaDkYo9c0CA07twaEohgmSa2hn8xJevEVNFU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Sri2NTCN5vIf/5KVI+BtyOBAjkXoGpOJjP2iOh/M5NU=";
+  cargoHash = "sha256-1e3of8qC1cJ9ZZt1mrfe10wjkLzUICS25TDu+HfkTyU=";
 
   # Some tests rely on timestamps newer than 18 Nov 1974 00:00:00
   preCheck = ''
diff --git a/pkgs/by-name/ta/tana/package.nix b/pkgs/by-name/ta/tana/package.nix
index 49fc649df40e..8a1e3fde0b85 100644
--- a/pkgs/by-name/ta/tana/package.nix
+++ b/pkgs/by-name/ta/tana/package.nix
@@ -62,7 +62,7 @@ let
     stdenv.cc.cc
     stdenv.cc.libc
   ];
-  version = "1.0.31";
+  version = "1.0.32";
 in
 stdenv.mkDerivation {
   pname = "tana";
@@ -70,7 +70,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/tanainc/tana-desktop-releases/releases/download/v${version}/tana_${version}_amd64.deb";
-    hash = "sha256-+KJ2peQWb378h6nWmoj5J4zAmSi4AHvR6fqrjRC/c8w=";
+    hash = "sha256-oAW9Vx4z0TOweKA6bsmCm7DY72pFWBnPLG0dS05oCw8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tr/traefik/package.nix b/pkgs/by-name/tr/traefik/package.nix
index 581d92c0847f..2dbf47816805 100644
--- a/pkgs/by-name/tr/traefik/package.nix
+++ b/pkgs/by-name/tr/traefik/package.nix
@@ -8,16 +8,16 @@
 
 buildGo124Module (finalAttrs: {
   pname = "traefik";
-  version = "3.4.0";
+  version = "3.4.1";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${finalAttrs.version}/traefik-v${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-9OCrIkeiqX8Kc21wWDy6cuSOw7l27YzgD/u8IiPc70w=";
+    hash = "sha256-cE4Pivu1wUZqd1i+aYZqirNQse1ExgEV6550CawRwJM=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-KtLWecErTstGpzByzDRvHXdq9qi9L4Q1iIfy0Lx7EOE=";
+  vendorHash = "sha256-eaeuTYjwv4Pa48YZ2yDOIRDRrSSw6fNhJIN8imV5dNM=";
 
   subPackages = [ "cmd/traefik" ];
 
diff --git a/pkgs/by-name/wa/wasm-tools/package.nix b/pkgs/by-name/wa/wasm-tools/package.nix
index 0a9877d93599..389f79ea0d72 100644
--- a/pkgs/by-name/wa/wasm-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-tools/package.nix
@@ -6,20 +6,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-tools";
-  version = "1.232.0";
+  version = "1.233.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasm-tools";
     rev = "v${version}";
-    hash = "sha256-iEHZXxE/cOs438KVXJ5o7+LobrODKtXGt92TPKxtOpU=";
+    hash = "sha256-Xx5ukiMIMQSptEe035Dq6NWidU/MN/Hxg0C0y6aUCJ0=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
   useFetchCargoVendor = true;
-  cargoHash = "sha256-W01pqmqJWwEOLv/ng0ZRFcPpOPO9s0IqcaEM7IN7v9g=";
+  cargoHash = "sha256-OFF8tUZ5Xhc+GQ2v0gYpAogIHeXjYEDxUn+78WsuHHs=";
   cargoBuildFlags = [
     "--package"
     "wasm-tools"
diff --git a/pkgs/by-name/xc/xchm/package.nix b/pkgs/by-name/xc/xchm/package.nix
index 3472dbfa0d57..cc53ca5f208d 100644
--- a/pkgs/by-name/xc/xchm/package.nix
+++ b/pkgs/by-name/xc/xchm/package.nix
@@ -5,6 +5,7 @@
   autoreconfHook,
   wxGTK32,
   chmlib,
+  desktopToDarwinBundle,
 }:
 
 stdenv.mkDerivation rec {
@@ -18,9 +19,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-UMn8ds4nheuYSu0PesxdGoyxyn5AcKq9WByeRUxxx3k=";
   };
 
-  nativeBuildInputs = [
-    autoreconfHook
-  ];
+  nativeBuildInputs =
+    [
+      autoreconfHook
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      desktopToDarwinBundle
+    ];
 
   buildInputs = [
     wxGTK32
@@ -30,7 +35,7 @@ stdenv.mkDerivation rec {
   configureFlags = [ "--with-wx-prefix=${wxGTK32}" ];
 
   preConfigure = ''
-    export LDFLAGS="$LDFLAGS $(${wxGTK32}/bin/wx-config --libs | sed -e s@-pthread@@) -lwx_gtk3u_aui-3.2"
+    export LDFLAGS="$LDFLAGS $(${wxGTK32}/bin/wx-config --libs std,aui | sed -e s@-pthread@@)"
   '';
 
   meta = with lib; {
@@ -38,7 +43,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/rzvncj/xCHM";
     license = licenses.gpl2;
     maintainers = with maintainers; [ sikmir ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     mainProgram = "xchm";
   };
 }
diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
index 5d5bfd2fbd88..6d4cd1704617 100644
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "25.1.1";
+  version = "25.1.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-Vk5sE7D8XHDOtxq0ax2a3FmQFWp7IDP4Y510EpnKWo4=";
+    hash = "sha256-oE1QZyCBFdWCFq5T+Unf0GYpvCssVNOEQtPQgPbatQQ=";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/asf-search/default.nix b/pkgs/development/python-modules/asf-search/default.nix
index e7428da5d02d..65cd8a9c255a 100644
--- a/pkgs/development/python-modules/asf-search/default.nix
+++ b/pkgs/development/python-modules/asf-search/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "asf-search";
-  version = "8.2.3";
+  version = "8.3.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "asfadmin";
     repo = "Discovery-asf_search";
     tag = "v${version}";
-    hash = "sha256-K1aGkI5lBw2HmLAeCNqcpgsDG/fAoi7l1RTBxziJBL8=";
+    hash = "sha256-MzHE3PNoV8SCGaajeSqdHaJwk7BuNiaP77YHo9soQO8=";
   };
 
   pythonRelaxDeps = [ "tenacity" ];
diff --git a/pkgs/development/python-modules/google-cloud-pubsub/default.nix b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
index 9c46626f6869..ac4b5e0d6c8d 100644
--- a/pkgs/development/python-modules/google-cloud-pubsub/default.nix
+++ b/pkgs/development/python-modules/google-cloud-pubsub/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-pubsub";
-  version = "2.29.0";
+  version = "2.29.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_pubsub";
     inherit version;
-    hash = "sha256-uCD41BDJath7jaecaWuXnhoYKhcNDAYCYm9bnYy/Ie4=";
+    hash = "sha256-X0sFNMWHOU3SBTjBuuq31OvO14lWEFhzlVXrRNeSTOQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-picnic-api2/default.nix b/pkgs/development/python-modules/python-picnic-api2/default.nix
index 3a0cffd1ef4e..246a2ce8bb54 100644
--- a/pkgs/development/python-modules/python-picnic-api2/default.nix
+++ b/pkgs/development/python-modules/python-picnic-api2/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "python-picnic-api2";
-  version = "1.3.0";
+  version = "1.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "codesalatdev";
     repo = "python-picnic-api";
     tag = "v${version}";
-    hash = "sha256-lr8xlSu5kvkNNEM22Pc+PFGs4re+Ytw2ct97h6ydY04=";
+    hash = "sha256-xa3Ir3OcePFwXemHSR78HhebtCVPObo9oM0h9K1DIQk=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/shiboken6/default.nix b/pkgs/development/python-modules/shiboken6/default.nix
index 9cce2a77d10b..6aeafa2d10bd 100644
--- a/pkgs/development/python-modules/shiboken6/default.nix
+++ b/pkgs/development/python-modules/shiboken6/default.nix
@@ -13,11 +13,11 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "shiboken6";
-  version = "6.9.0";
+  version = "6.9.1";
 
   src = fetchurl {
     url = "mirror://qt/official_releases/QtForPython/pyside6/PySide6-${finalAttrs.version}-src/pyside-setup-everywhere-src-${finalAttrs.version}.tar.xz";
-    hash = "sha256-MVtzu3Vw1bnmeTqNP6/R0t1/Q9Ne67AdK1VOogaq2I4=";
+    hash = "sha256-BMcSxbkjSt0Nm1qjwBoMrt5kpVtJYSd1H11SojDP90g=";
   };
 
   sourceRoot = "pyside-setup-everywhere-src-${finalAttrs.version}/sources/shiboken6";
diff --git a/pkgs/os-specific/linux/corefreq/default.nix b/pkgs/os-specific/linux/corefreq/default.nix
index 0fdb0d350cfe..18efe6dae441 100644
--- a/pkgs/os-specific/linux/corefreq/default.nix
+++ b/pkgs/os-specific/linux/corefreq/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "corefreq";
-  version = "2.0.3";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "cyring";
     repo = "CoreFreq";
     rev = version;
-    hash = "sha256-3XBcSR2Yud7zZnyHE81S99Wq3gVjXUJixIuPOLzMJpE=";
+    hash = "sha256-9RANWw0zdsNFHdHPc0AjPQTZSlaejChsrZmxNXeBzK0=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/servers/web-apps/freshrss/default.nix b/pkgs/servers/web-apps/freshrss/default.nix
index 47fd945d0e05..7b4f54db4dd0 100644
--- a/pkgs/servers/web-apps/freshrss/default.nix
+++ b/pkgs/servers/web-apps/freshrss/default.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "FreshRSS";
-  version = "1.26.2";
+  version = "1.26.3";
 
   src = fetchFromGitHub {
     owner = "FreshRSS";
     repo = "FreshRSS";
     rev = version;
-    hash = "sha256-TVtyX0/HKtLHFjHHjZDwOOcbHJ7Bq0NrlI3drlm6Gy4=";
+    hash = "sha256-/573UMMALfU46uJefxf/DMhEcIMiI+CVR9lg9kXFdF0=";
   };
 
   postPatch = ''