diff --git a/pkgs/by-name/le/lego/package.nix b/pkgs/by-name/le/lego/package.nix
index aabc0e2d9026..b6f250d6ca91 100644
--- a/pkgs/by-name/le/lego/package.nix
+++ b/pkgs/by-name/le/lego/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "lego";
-  version = "4.31.0";
+  version = "4.35.2";
 
   src = fetchFromGitHub {
     owner = "go-acme";
     repo = "lego";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YzslAEZVJDAa8Q7/YTWb2pH0MiWwgHipL11A/UD+nYg=";
+    hash = "sha256-NBCvVlMDEEhlfWWG7X5T1Udg+42+ibS1Ph6F+/yrXF0=";
   };
 
-  vendorHash = "sha256-9ead3yA/fvNRP4uP2O6Wy6aRzVAig3iyin8UgMcA8mc=";
+  vendorHash = "sha256-Q85McGGSILE8BPwreCtih6my1nih9ameLKHFe1dgNWQ=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/pr/proftpd/package.nix b/pkgs/by-name/pr/proftpd/package.nix
index 8d664a8e0699..1a3af64bb3de 100644
--- a/pkgs/by-name/pr/proftpd/package.nix
+++ b/pkgs/by-name/pr/proftpd/package.nix
@@ -1,6 +1,7 @@
 {
   stdenv,
   lib,
+  fetchpatch,
   fetchFromGitHub,
   libcap,
   libsodium,
@@ -28,7 +29,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-SNLzIwMF6XU2SAc5B9LIW2Jeh1Fa4CVumQYd2O0XxRY=";
   };
 
-  patches = [ ./no-install-user.patch ];
+  patches = [
+    ./no-install-user.patch
+    (fetchpatch {
+      name = "CVE-2026-44331.patch";
+      url = "https://github.com/proftpd/proftpd/commit/5e06acc4687046c7bf794b55bd8c44a86a05ae61.patch";
+      hash = "sha256-1YM9yeiZJwU2CasPhf4g9O8Jf/B01ullFeUkERFe9WY=";
+    })
+  ];
 
   strictDeps = true;
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/rs/rsshub/package.nix b/pkgs/by-name/rs/rsshub/package.nix
index b14f2559691d..83bfa9fc21ea 100644
--- a/pkgs/by-name/rs/rsshub/package.nix
+++ b/pkgs/by-name/rs/rsshub/package.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "rsshub";
-  version = "0-unstable-2026-04-27";
+  version = "0-unstable-2026-05-05";
 
   src = fetchFromGitHub {
     owner = "DIYgod";
     repo = "RSSHub";
-    rev = "add0734e0f8c88af8e81e80f0d4ab70ad9ed920e";
-    hash = "sha256-IVVCOSXXCSsSVM1cczX3oTpd07uaJ2LAWMJxMylkRt0=";
+    rev = "1410f03e6dc98f0135cad0b458381179bdddec59";
+    hash = "sha256-l+GPfi6u2wYEWLtTowdjG3hRLM1QSDpRaw/BL74S6I8=";
   };
 
   patches = [
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 3;
-    hash = "sha256-zGchfq2Slr5GzeQrp+0JG+BlI/NPObJ7SJSn1I2MHQ0=";
+    hash = "sha256-jRfY9w84DdGkuUXAxcdKOhNEjJU5o0t8qJqtr7FXmZw=";
     pnpm = pnpm_10;
   };