diff --git a/pkgs/by-name/br/browsers/package.nix b/pkgs/by-name/br/browsers/package.nix
index bd9d28648c09..00315961502c 100644
--- a/pkgs/by-name/br/browsers/package.nix
+++ b/pkgs/by-name/br/browsers/package.nix
@@ -12,18 +12,18 @@
   pango,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "browsers";
-  version = "0.7.0";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "Browsers-software";
     repo = "browsers";
-    tag = version;
-    hash = "sha256-s03BEscaYdSitLtlqbX/tgGSLRHuXc9Ht+3RMCUIdY8=";
+    tag = finalAttrs.version;
+    hash = "sha256-1RWGAEiSJWDoScKuUB5LL1tQyTw5NRnld7Fi93vP0BA=";
   };
 
-  cargoHash = "sha256-tz4ju0NwgG5yb1VndYqyf+g631izPl904KYDUvawO28=";
+  cargoHash = "sha256-M1KAZPjNu4j5b5Ml2J9OHpD+/jeF8WRP6EzfmLnb0hY=";
 
   nativeBuildInputs = [
     pkg-config
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage rec {
     mv $out/share/applications/software.Browsers.template.desktop $out/share/applications/software.Browsers.desktop
     substituteInPlace \
         $out/share/applications/software.Browsers.desktop \
-        --replace-fail 'Exec=€ExecCommand€' 'Exec=${pname} %u'
+        --replace-fail 'Exec=€ExecCommand€' 'Exec=${finalAttrs.pname} %u'
     cp -r resources $out
     for size in 16 32 128 256 512; do
       install -m 444 \
@@ -58,9 +58,9 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Open the right browser at the right time";
     homepage = "https://browsers.software";
-    changelog = "https://github.com/Browsers-software/browsers/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/Browsers-software/browsers/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ravenz46 ];
     mainProgram = "browsers";
   };
-}
+})
diff --git a/pkgs/by-name/co/codeql/package.nix b/pkgs/by-name/co/codeql/package.nix
index a6ca9faf8fa7..0dc0bacc1a4f 100644
--- a/pkgs/by-name/co/codeql/package.nix
+++ b/pkgs/by-name/co/codeql/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.23.0";
+  version = "2.23.3";
 
   dontConfigure = true;
   dontBuild = true;
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-8T1aOy2okhwj2rFz3jUpUm2JaJcrXdB6KpSD8btCEx4=";
+    hash = "sha256-Y6E3itwm/BZuNAs4b1roynEEdpOArfKPh+vNQidu+y8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/da/davix/package.nix b/pkgs/by-name/da/davix/package.nix
index 5bdecbd6dff3..628c1d5b4cb6 100644
--- a/pkgs/by-name/da/davix/package.nix
+++ b/pkgs/by-name/da/davix/package.nix
@@ -1,12 +1,12 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchpatch,
+  fetchFromGitHub,
   cmake,
   pkg-config,
   openssl,
   libxml2,
-  boost,
   python3,
   libuuid,
   curl,
@@ -27,7 +27,7 @@ let
   boolToUpper = b: lib.toUpper (lib.boolToString b);
 in
 stdenv.mkDerivation rec {
-  version = "0.8.7";
+  version = "0.8.10";
   pname = "davix" + lib.optionalString enableThirdPartyCopy "-copy";
   nativeBuildInputs = [
     cmake
@@ -35,7 +35,6 @@ stdenv.mkDerivation rec {
     python3
   ];
   buildInputs = [
-    boost
     curl
     libxml2
     openssl
@@ -44,14 +43,11 @@ stdenv.mkDerivation rec {
   ++ lib.optional (!stdenv.hostPlatform.isDarwin) libuuid
   ++ lib.optional enableThirdPartyCopy gsoap;
 
-  # using the url below since the github release page states
-  # "please ignore the GitHub-generated tarballs, as they are incomplete"
-  # https://github.com/cern-fts/davix/releases/tag/R_0_8_0
-  src = fetchurl {
-    url = "https://github.com/cern-fts/davix/releases/download/R_${
-      lib.replaceStrings [ "." ] [ "_" ] version
-    }/davix-${version}.tar.gz";
-    sha256 = "sha256-eMJOFO3X5OVgOS1nFH7IZYwqoNNkBBW99rxROvz2leY=";
+  src = fetchFromGitHub {
+    owner = "cern-fts";
+    repo = "davix";
+    rev = "refs/tags/R_${lib.replaceStrings [ "." ] [ "_" ] version}";
+    hash = "sha256-n4NeHBgQwGwgHAFQzPc3oEP9k3F/sqrTmkI/zHW+Miw=";
   };
 
   preConfigure = ''
@@ -61,6 +57,7 @@ stdenv.mkDerivation rec {
   '';
 
   cmakeFlags = [
+    "-DDAVIX_TESTS=OFF"
     "-DENABLE_TOOLS=${boolToUpper enableTools}"
     "-DEMBEDDED_LIBCURL=OFF"
     "-DLIBCURL_BACKEND_BY_DEFAULT=${boolToUpper defaultToLibcurl}"
@@ -69,6 +66,14 @@ stdenv.mkDerivation rec {
     "-DENABLE_THIRD_PARTY_COPY=${boolToUpper enableThirdPartyCopy}"
   ];
 
+  patches = [
+    # Update CMake minimum requirement and supported versions, backport from unreleased davix 0.8.11
+    (fetchpatch {
+      url = "https://github.com/cern-fts/davix/commit/687d424c9f87888c94d96f3ea010de11ef70cd23.patch";
+      hash = "sha256-FNXOQrY0gsMK+D4jwbJmYyEqD3lFui0giXUd+Rr0jLk=";
+    })
+  ];
+
   meta = with lib; {
     description = "Toolkit for Http-based file management";
 
diff --git a/pkgs/by-name/gf/gfal2/package.nix b/pkgs/by-name/gf/gfal2/package.nix
index 63ea071efaee..62e9714929b6 100644
--- a/pkgs/by-name/gf/gfal2/package.nix
+++ b/pkgs/by-name/gf/gfal2/package.nix
@@ -109,6 +109,36 @@ stdenv.mkDerivation (finalAttrs: {
     ]
   );
 
+  preConfigure =
+    let
+      cmakeFiles = [
+        "CMakeLists.txt"
+        "src/CMakeLists.txt"
+        "src/core/CMakeLists.txt"
+        "src/core/transfer/CMakeLists.txt"
+        "src/plugins/CMakeLists.txt"
+        "src/plugins/dcap/CMakeLists.txt"
+        "src/plugins/file/CMakeLists.txt"
+        "src/plugins/gridftp/CMakeLists.txt"
+        "src/plugins/http/CMakeLists.txt"
+        "src/plugins/lfc/CMakeLists.txt"
+        "src/plugins/mock/CMakeLists.txt"
+        "src/plugins/rfio/CMakeLists.txt"
+        "src/plugins/sftp/CMakeLists.txt"
+        "src/plugins/srm/CMakeLists.txt"
+        "src/plugins/xrootd/CMakeLists.txt"
+        "src/utils/CMakeLists.txt"
+        "src/version/CMakeLists.txt"
+      ];
+    in
+    ''
+      for f in ${lib.escapeShellArgs cmakeFiles}; do
+        substituteInPlace "$f" \
+          --replace-fail 'cmake_minimum_required (VERSION 2.6)' \
+                         'cmake_minimum_required (VERSION 3.10)'
+      done
+    '';
+
   cmakeFlags =
     (map (
       pluginName:
diff --git a/pkgs/by-name/ha/harsh/package.nix b/pkgs/by-name/ha/harsh/package.nix
index 036baf828565..0222ed4879af 100644
--- a/pkgs/by-name/ha/harsh/package.nix
+++ b/pkgs/by-name/ha/harsh/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "harsh";
-  version = "0.10.22";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "wakatara";
     repo = "harsh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TGhhiqFf6POR7x/Nc8m5/mBlj23EnjZlL5AL9IwXghk=";
+    hash = "sha256-mQhBQFDint6ZlS5yQ9oGLJVxmol9p+st9X7wRCBuc/g=";
   };
 
-  vendorHash = "sha256-m+5MSgzuRUZuP1GhEUCttLRLL63kphMi8N9tDUaTaOQ=";
+  vendorHash = "sha256-+yHIpUttvrdiTt0IuMTT4iCN34hNOb3JjZTmi5qb8yI=";
 
   nativeCheckInputs = [ writableTmpDirAsHomeHook ];
 
diff --git a/pkgs/by-name/lo/logstalgia/package.nix b/pkgs/by-name/lo/logstalgia/package.nix
index d23dff56d9fa..52ffb5aca6aa 100644
--- a/pkgs/by-name/lo/logstalgia/package.nix
+++ b/pkgs/by-name/lo/logstalgia/package.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
       a Miscellaneous section.
     '';
 
-    platforms = platforms.gnu ++ platforms.linux;
+    platforms = platforms.gnu ++ platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ pSub ];
     mainProgram = "logstalgia";
   };
diff --git a/pkgs/by-name/mu/museum/package.nix b/pkgs/by-name/mu/museum/package.nix
index 7fab7e2d0482..1e7f96439ff2 100644
--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@@ -10,17 +10,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "museum";
-  version = "1.2.8";
+  version = "1.2.11";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     tag = "photos-v${finalAttrs.version}";
-    hash = "sha256-CHdDtIEohEWKULkEZMs2+fsQR0HL++ejdCL2KA9SXt0=";
+    hash = "sha256-GSHWEbnBn2nS2aQ1lQU8Vpp8lEQiPBfmU7BsfXADVXs=";
   };
 
-  vendorHash = "sha256-iltf6TVTzMhNpQxLtp/wqOCVXeJCmPvmlfWARbNgc4g=";
+  vendorHash = "sha256-5o2nOFBwMY3qHyMWp+NDRkxf/2egTzWCiGMzY3No4OY=";
 
   sourceRoot = "${finalAttrs.src.name}/server";
 
diff --git a/pkgs/by-name/ve/velocity/package.nix b/pkgs/by-name/ve/velocity/package.nix
index f75c40a88885..eeaa7d7a482f 100644
--- a/pkgs/by-name/ve/velocity/package.nix
+++ b/pkgs/by-name/ve/velocity/package.nix
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "velocity";
-  version = "3.4.0-unstable-2025-10-11";
+  version = "3.4.0-unstable-2025-10-16";
 
   src = fetchFromGitHub {
     owner = "PaperMC";
     repo = "Velocity";
-    rev = "806b386cdb8da23051a9679682ed6a76370b9818";
-    hash = "sha256-2Wy9mnIvGab/vgH6fVK+HJcpOUwPMkgncXOGcZPnDhg=";
+    rev = "4cd3b6869729484887b4fa58b7a6c3b007710a10";
+    hash = "sha256-SGZqKsAI8QW65B2u0tn7NwciwjViExvxv6UdoHkzheI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/games/papermc/update.py b/pkgs/games/papermc/update.py
index 2eb4e7c2790e..7bfc8ee3a0b7 100755
--- a/pkgs/games/papermc/update.py
+++ b/pkgs/games/papermc/update.py
@@ -47,7 +47,7 @@ class VersionManager:
 
         # we only want versions that are no pre-releases
         release_versions = filter(
-            lambda v_name: 'pre' not in v_name, response.json()["versions"])
+            lambda v_name: all(s not in v_name for s in ["pre", "rc"]), response.json()["versions"])
 
         for version_name in release_versions:
 
diff --git a/pkgs/games/papermc/versions.json b/pkgs/games/papermc/versions.json
index 9f9530e39f20..1a6a735d7de1 100644
--- a/pkgs/games/papermc/versions.json
+++ b/pkgs/games/papermc/versions.json
@@ -86,5 +86,9 @@
     "1.21.8": {
         "hash": "sha256-jefFLDsCQDUD0W+sWAA/Hv733XoCVnhoQ5J/qS7lfx4=",
         "version": "1.21.8-60"
+    },
+    "1.21.9": {
+        "hash": "sha256-YXZVx7iTC3EViKM8r4SKBLgArd0JcZ9jziZuBtWBYOc=",
+        "version": "1.21.9-41"
     }
 }