diff --git a/pkgs/by-name/bo/boxflat/package.nix b/pkgs/by-name/bo/boxflat/package.nix
index 377ce8b80459..c583dc98dd6d 100644
--- a/pkgs/by-name/bo/boxflat/package.nix
+++ b/pkgs/by-name/bo/boxflat/package.nix
@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "boxflat";
-  version = "1.35.2";
+  version = "1.35.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lawstorant";
     repo = "boxflat";
     tag = "v${version}";
-    hash = "sha256-7JIIFti8LHBIDBr+GywImlP2l3Ct/hq4pb5+2/q+F0k=";
+    hash = "sha256-ayreXC73OLNpnwNuJe0ImC/ch5W+O0lnkuD31ztTqso=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/ka/kanata/package.nix b/pkgs/by-name/ka/kanata/package.nix
index dc28d596d754..c277f5472e70 100644
--- a/pkgs/by-name/ka/kanata/package.nix
+++ b/pkgs/by-name/ka/kanata/package.nix
@@ -16,16 +16,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kanata";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "jtroo";
     repo = "kanata";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-IicVuJZBHzBv9SNGQuWIIaLq2qpWfn/jMFh9KPvAThs=";
+    sha256 = "sha256-jzTK/ZK9UrXTP/Ow662ENBv3cim6klA8+DQv4DLVSNU=";
   };
 
-  cargoHash = "sha256-2DTL1u17jUFiRoVe7973L5/352GtKte/vakk01SSRwY=";
+  cargoHash = "sha256-qYFt/oHokR+EznugEaE/ZEn26IFVLXePgoYGxoPRi+g=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     (writeShellScriptBin "sw_vers" ''
diff --git a/pkgs/by-name/li/libphonenumber/package.nix b/pkgs/by-name/li/libphonenumber/package.nix
index a9aa13b05056..47887927a754 100644
--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libphonenumber";
-  version = "9.0.20";
+  version = "9.0.21";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "libphonenumber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-naIlf09phlgFS4GqNSLLqzQwM3DGp3bBu3cFinrUYFA=";
+    hash = "sha256-2YiTjudHEKl3JJMF4jV/DpQFZbBEb4z6WZxU+jdGVx0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/lo/lobtui/package.nix b/pkgs/by-name/lo/lobtui/package.nix
new file mode 100644
index 000000000000..67c8d974d7ca
--- /dev/null
+++ b/pkgs/by-name/lo/lobtui/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "lobtui";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "pythops";
+    repo = "lobtui";
+    rev = "v${version}";
+    hash = "sha256-Ig/KdCuQZYSiCydouN29IsIRKh8qngtzcOknTozDRRM=";
+  };
+
+  cargoHash = "sha256-Cj6hf/dizIv2pKbQvyRqqIz5k3AW3cdfpCaIHvk8G9o=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  meta = {
+    description = "TUI for lobste.rs website";
+    homepage = "https://github.com/pythops/lobtui";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      matthiasbeyer
+    ];
+    mainProgram = "lobtui";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/lu/lua-language-server/package.nix b/pkgs/by-name/lu/lua-language-server/package.nix
index f9c4049af785..47343ecd6937 100644
--- a/pkgs/by-name/lu/lua-language-server/package.nix
+++ b/pkgs/by-name/lu/lua-language-server/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lua-language-server";
-  version = "3.16.0";
+  version = "3.16.1";
 
   src = fetchFromGitHub {
     owner = "luals";
     repo = "lua-language-server";
     tag = finalAttrs.version;
-    hash = "sha256-SMSBUn6PtsdvK4u/UlWr82/YDoGK4MwA+bI9jgisHHA=";
+    hash = "sha256-HYtnTJYII548+/tp+1UjRgsBaTuDz27AIc2MvBjBh8o=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/lu/ludtwig/package.nix b/pkgs/by-name/lu/ludtwig/package.nix
index 085295467698..c16097ef05b6 100644
--- a/pkgs/by-name/lu/ludtwig/package.nix
+++ b/pkgs/by-name/lu/ludtwig/package.nix
@@ -6,18 +6,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ludtwig";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "MalteJanz";
     repo = "ludtwig";
     rev = "v${version}";
-    hash = "sha256-3E1W6AlGQ9AhMzLvTV5KBjlKiWXyi7rFwHOdU3CIp60=";
+    hash = "sha256-V0T+yinjTVkAXA604bfEGDzpCd0saNt5S71XFaFqdxg=";
   };
 
   checkType = "debug";
 
-  cargoHash = "sha256-00JHtrDffFl3h3IOH+h491qGOSfXIJH9NBmaqqUtQ6k=";
+  cargoHash = "sha256-qR7V7fvWsDsLDRwfvM5UV7iKLGxE722eXvYrZTBtGpQ=";
 
   meta = {
     description = "Linter / Formatter for Twig template files which respects HTML and your time";
diff --git a/pkgs/by-name/ng/nginx-sso/package.nix b/pkgs/by-name/ng/nginx-sso/package.nix
index 63c1c1a3bbf4..4714d6013342 100644
--- a/pkgs/by-name/ng/nginx-sso/package.nix
+++ b/pkgs/by-name/ng/nginx-sso/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nginx-sso";
-  version = "0.27.4";
+  version = "0.27.5";
 
   src = fetchFromGitHub {
     owner = "Luzifer";
     repo = "nginx-sso";
     rev = "v${version}";
-    hash = "sha256-fNMCskS8uXAykl2Zu4ZZqtIS2F5w7HV7C8hyPaWnav4=";
+    hash = "sha256-yiwKnOv/4Zy9bBvQZiIp8cH1XvgV88m9t4ptqQp1LG8=";
   };
 
-  vendorHash = "sha256-J3CObmSbrAn0D5MOaclRvlnqLqUYfQCkfD6om/tNKac=";
+  vendorHash = "sha256-KflzlrjOOTDZQq2yP0zQsDgULrbnoeRRxOVHxKINsYw=";
 
   postInstall = ''
     mkdir -p $out/share
diff --git a/pkgs/by-name/pr/prometheus-alertmanager/package.nix b/pkgs/by-name/pr/prometheus-alertmanager/package.nix
index 58178eee3b6c..ef47da8e95c3 100644
--- a/pkgs/by-name/pr/prometheus-alertmanager/package.nix
+++ b/pkgs/by-name/pr/prometheus-alertmanager/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "alertmanager";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "prometheus";
     repo = "alertmanager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2uP4JCbQEe7/en5sBq/k73kqK6YVmuLvfiUy1fqPitw=";
+    hash = "sha256-103Jb2CA/Zz+MBIJei3vhqcPyg7e5JkpFKqh1hjAhLc=";
   };
 
-  vendorHash = "sha256-bN1iV2JrrjwiiIXr5lp389HvEoQGteJQD94cug0/048=";
+  vendorHash = "sha256-LgGsXaJ97uXtqHHicsLOaMNx3PzlVPhz/xG+KvO4nLI=";
 
   subPackages = [
     "cmd/alertmanager"
diff --git a/pkgs/by-name/pr/protonvpn-gui/package.nix b/pkgs/by-name/pr/protonvpn-gui/package.nix
index 49a7b2669187..fc4b54a9cf62 100644
--- a/pkgs/by-name/pr/protonvpn-gui/package.nix
+++ b/pkgs/by-name/pr/protonvpn-gui/package.nix
@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "protonvpn-gui";
-  version = "4.12.0";
+  version = "4.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "proton-vpn-gtk-app";
     tag = "v${version}";
-    hash = "sha256-pDTzqTiGAisVEHwez526z9C9GzNkMWl6Cui8E6siIXo=";
+    hash = "sha256-1T8gh0aKYiVnkr4SLg2a5Hcc8FQn8llofCXxeZGwd8I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xm/xmage/package.nix b/pkgs/by-name/xm/xmage/package.nix
index 2824b281edeb..aa6be4344ab2 100644
--- a/pkgs/by-name/xm/xmage/package.nix
+++ b/pkgs/by-name/xm/xmage/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xmage";
-  version = "1.4.57-dev_2025-04-19_14-28";
+  version = "1.4.58-dev_2025-10-06_20-40";
 
   src = fetchurl {
     url = "http://xmage.today/files/mage-full_${finalAttrs.version}.zip";
-    sha256 = "sha256-EeaUd81fqiPDqHiMP86E9gtdFi545PIBfCgb1i5Z5i0=";
+    sha256 = "sha256-UOtxV+ykDIH+PLjLrC66Rut92IIw2iDHWwvJ2ytmUAs=";
   };
 
   preferLocalBuild = true;
diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
index 3baf30be2a1a..bd18ff5a79f2 100644
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "25.3.1";
+  version = "25.3.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-ESaVKbAieCQcSs4WHyajSpBUWcHrldveXcb9PO63XWc=";
+    hash = "sha256-wvRKKSDA4QxLB4J7fLLZvEXl3xsPMIF21iHsgl0l5vg=";
   };
 
   meta = {
diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index d3aa9a725a27..11d0970720d3 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -21,7 +21,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "grafana";
-  version = "12.3.0";
+  version = "12.3.1";
 
   subPackages = [
     "pkg/cmd/grafana"
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
     owner = "grafana";
     repo = "grafana";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5DfPxsP8Lo8y8S44S/OkxOxWFL0JfAxPF7ZmT8FRPbw=";
+    hash = "sha256-OGk7dq5jr3rEGqkWLBHrna02ireXHfYoLWJcWIY6Ccg=";
   };
 
   # borrowed from: https://github.com/NixOS/nixpkgs/blob/d70d9425f49f9aba3c49e2c389fe6d42bac8c5b0/pkgs/development/tools/analysis/snyk/default.nix#L20-L22
@@ -49,12 +49,12 @@ buildGoModule (finalAttrs: {
   # Since this is not a dependency attribute the buildPackages has to be specified.
   offlineCache = buildPackages.yarn-berry_4-fetcher.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-CAEhdKsFMUuIs8DsJ9xSr2FRdBp4fPUWyvjC6FuiyG8=";
+    hash = "sha256-mdQC0QCqOcP+uQaS1j2QktigEQKUQxLD3wkiMBVVuHE=";
   };
 
   disallowedRequisites = [ finalAttrs.offlineCache ];
 
-  vendorHash = "sha256-qoku03G6lQlwTzm/UpnrEpPqIxJmPZAy8VJ/KfYXhHM=";
+  vendorHash = "sha256-xT99rvarFwidwpnxUGchv3Ny0v2hLHAcG8epV01Vc30=";
 
   # Grafana seems to just set it to the latest version available
   # nowadays.
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 577602cfca9e..0cd433d4fc0e 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -66,13 +66,13 @@ stdenv.mkDerivation (
   finalAttrs:
   {
     pname = "netdata";
-    version = "2.8.0";
+    version = "2.8.4";
 
     src = fetchFromGitHub {
       owner = "netdata";
       repo = "netdata";
       rev = "v${finalAttrs.version}";
-      hash = "sha256-QV9h+TMAuRCkYFr8KMOPhWq5fEnKpmA/HxQ8fV/jKBI=";
+      hash = "sha256-rrwoyTejfOwSWMZ0juTE4CzgeRVBrC7AISFUoFBMaIs=";
       fetchSubmodules = true;
     };
 
@@ -232,7 +232,7 @@ stdenv.mkDerivation (
         --replace-fail 'set(VARLIB_DIR "''${NETDATA_RUNTIME_PREFIX}/var/lib/netdata")' 'set(VARLIB_DIR "/var/lib/netdata")' \
         --replace-fail 'set(pkglibexecdir_POST "''${NETDATA_RUNTIME_PREFIX}/usr/libexec/netdata")' 'set(pkglibexecdir_POST "${placeholder "out"}/libexec/netdata")' \
         --replace-fail 'set(localstatedir_POST "''${NETDATA_RUNTIME_PREFIX}/var")' 'set(localstatedir_POST "/var")' \
-        --replace-fail 'set(BINDIR usr/sbin)' 'set(BINDIR "${placeholder "out"}/sbin")' \
+        --replace-fail 'set(BINDIR usr/sbin)' 'set(BINDIR "bin")' \
         --replace-fail 'set(BUILD_INFO_CMAKE_CACHE_ARCHIVE_PATH "usr/share/netdata")' 'set(BUILD_INFO_CMAKE_CACHE_ARCHIVE_PATH "${placeholder "out"}/share/netdata")'
     '';
 
@@ -266,7 +266,6 @@ stdenv.mkDerivation (
       ''}
 
       # Time to cleanup the output directory.
-      unlink $out/sbin
       cp $out/etc/netdata/edit-config $out/bin/netdata-edit-config
       mv $out/lib/netdata/conf.d $out/share/netdata/conf.d
       rm -rf $out/{var,usr,etc}