diff --git a/pkgs/by-name/fl/flake-checker/package.nix b/pkgs/by-name/fl/flake-checker/package.nix
index 246de955fe4f..1be7b7a09349 100644
--- a/pkgs/by-name/fl/flake-checker/package.nix
+++ b/pkgs/by-name/fl/flake-checker/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "flake-checker";
-  version = "0.2.11";
+  version = "0.2.13";
 
   src = fetchFromGitHub {
     owner = "DeterminateSystems";
     repo = "flake-checker";
     rev = "v${version}";
-    hash = "sha256-0ftHzqFpFkKZKByWJ49/YySrXBU4lCxvcpbTuMY8ZXs=";
+    hash = "sha256-QE/Druzo/EDiuh7Vb+kipPgUxkIRPLsHFMSpSRMFIVw=";
   };
 
-  cargoHash = "sha256-5zzSLk5QT3X6rdGEPHPelXFd5nOxNtlbqDHwV7fFDKY=";
+  cargoHash = "sha256-kKEHYKXtccXRsa1cON0oMHOWagi3mVdnf3pEgkoNn/k=";
 
   meta = {
     description = "Health checks for your Nix flakes";
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index cb1b754ca7de..fbd77a0d4226 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -22,12 +22,14 @@ let
     # Requires running Docker daemon
     "TestDocker"
     "TestJobExecutor"
+    "TestRunContext_PrepareJobContainer/Overlapping"
     "TestRunExec"
     "TestRunner"
     "Test_validateCmd"
 
     # Docker network request for image
     "TestImageExistsLocally"
+    "TestStepDockerMain"
 
     # Reaches out to different websites
     "TestFindGitRemoteURL"
@@ -48,21 +50,22 @@ let
   ++ lib.optionals stdenv.isDarwin [
     # Uses docker-specific options, unsupported on Darwin
     "TestMergeJobOptions"
+    "TestNewEndpointHonoursTLSEnv"
   ];
 in
 buildGoModule (finalAttrs: {
   pname = "forgejo-runner";
-  version = "12.10.2";
+  version = "12.11.1";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Uo+x02HgpfOY+KXug7cmnW4d85AlX6wqz+nYGF/JrHk=";
+    hash = "sha256-Qc43zWDDCjL8RW9Q30H4N5VRSFT3LR4Pt8/P0NcMacU=";
   };
 
-  vendorHash = "sha256-0gOftkxkBPziU0Tm8lIiD72rXcMMY5M57G9/Bt/mneI=";
+  vendorHash = "sha256-du7fXehcxZ70Lsr5VCkz646G0Us/XwM4Sl98HXimoao=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/li/librewolf-unwrapped/package.nix b/pkgs/by-name/li/librewolf-unwrapped/package.nix
index d279ee6ccf2c..c6384d64ce5a 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/package.nix
@@ -40,6 +40,9 @@ in
     maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
     license = lib.licenses.mpl20;
     mainProgram = "librewolf";
+    knownVulnerabilities = [
+      "librewolf lacks an active committer in nixpkgs, consider using an alternative"
+    ];
   };
   tests = { inherit (nixosTests) librewolf; };
   updateScript = callPackage ./update.nix {
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 5fe46e372054..518689eb5725 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -170,11 +170,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "149.0.4022.52";
+  version = "149.0.4022.69";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-3lFhfxkS80P59dk00lpBp+8IIFUvSEJVGGTfAghxw4g=";
+    hash = "sha256-0Ur+0KKJQ7VTr7IMax5BIgwSf6jNhr0Aiz+So7Hj/OE=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/ms/msedgedriver/package.nix b/pkgs/by-name/ms/msedgedriver/package.nix
index 0dcbed31f1f2..b689c7e1a01b 100644
--- a/pkgs/by-name/ms/msedgedriver/package.nix
+++ b/pkgs/by-name/ms/msedgedriver/package.nix
@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "msedgedriver";
-  version = "149.0.4022.52";
+  version = "149.0.4022.69";
 
   src = fetchzip {
     url = "https://msedgedriver.microsoft.com/${finalAttrs.version}/edgedriver_linux64.zip";
-    hash = "sha256-GLPkBOlXDTpjYrrc9odDeHXXZ8vLPiw06v1bIN1zOpo=";
+    hash = "sha256-BtyQD+zkZWv5GhnxJOg4BkVLrCdBZr7KN1bvXyvp4B8=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/pl/plausible/package.nix b/pkgs/by-name/pl/plausible/package.nix
index b1acaae50a50..d0d7209c9e81 100644
--- a/pkgs/by-name/pl/plausible/package.nix
+++ b/pkgs/by-name/pl/plausible/package.nix
@@ -8,23 +8,23 @@
   runCommand,
   nixosTests,
   npm-lockfile-fix,
+  cmake,
   nix-update-script,
   brotli,
-  tailwindcss_3,
   esbuild,
   buildPackages,
 }:
 
 let
   pname = "plausible";
-  version = "3.0.1";
+  version = "3.2.1";
   mixEnv = "ce";
 
   src = fetchFromGitHub {
     owner = "plausible";
     repo = "analytics";
     rev = "v${version}";
-    hash = "sha256-DQIRsqkH2zgIkb3yezuJEKJ99PS031GJ+bDAeHMLNUY=";
+    hash = "sha256-2roIj0s2cybYdGmmJSPJ5Rc1gNunxlYew9JR5xxMv+k=";
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/assets/package-lock.json
       sed -ie '
@@ -46,7 +46,7 @@ let
     pname = "${pname}-assets";
     inherit version;
     src = "${src}/assets";
-    npmDepsHash = "sha256-hPbKEC8DE/gb483COG/ZbTuEP8Y44Fs7ppHMpXphCjg=";
+    npmDepsHash = "sha256-grYxPRzpu3pcv3lyTQxx0RDhmgFhsOKZoYbzd701xjA=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -59,7 +59,7 @@ let
     pname = "${pname}-tracker";
     inherit version;
     src = "${src}/tracker";
-    npmDepsHash = "sha256-kfqJVUw3xnMT0sOkc5O42CwBxPQXiYnOQ5WpdZwzxfE";
+    npmDepsHash = "sha256-hrsvQXvbcfRDUc1qinyUJ7Oh4yMM1e+UEdYudjYyJxk=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -68,6 +68,18 @@ let
     '';
   };
 
+  # lazy_html (new dep since 3.1.0) builds a NIF against lexbor
+  # its Makefile clones lexbor at build time (which sandbox forbids)
+  # pre-seed commit in lazy_html's mix.exs so the clone target is skipped
+  # and force a build in preBuild below
+  lexborCommit = "244b84956a6dc7eec293781d051354f351274c46";
+  lexborSrc = fetchFromGitHub {
+    owner = "lexbor";
+    repo = "lexbor";
+    rev = lexborCommit;
+    hash = "sha256-Oup/lGU8a9Dqfho4Llg39t9Y9n4xfUmGk0772OkpnLQ=";
+  };
+
   mixFodDeps = beamPackages.fetchMixDeps {
     inherit
       pname
@@ -75,7 +87,7 @@ let
       src
       mixEnv
       ;
-    hash = "sha256-caCbuMEDsLcxm8xehWEJiaTfgl435crBfnQFQpzGsLY";
+    hash = "sha256-fm/elkCNpu5sduBxly06i/z30Y9BMtt+qthXmLuvlUc=";
   };
 
   mjmlNif = rustPlatform.buildRustPackage {
@@ -83,7 +95,7 @@ let
     version = "";
     src = "${mixFodDeps}/mjml/native/mjml_nif";
 
-    cargoHash = "sha256-zDWOik65PWAMpIDDcG+DibprPVW/k+Q83+fjFI5vWaY=";
+    cargoHash = "sha256-a8xSRdFtMYF0n2rl7A5ZgHoaunUJLVJwHvrkc9uyZKo=";
     doCheck = false;
 
     env = {
@@ -108,7 +120,13 @@ let
           file=''${lib##*/}
           base=''${file%.*}
           ln -s "$lib" $out/mjml/priv/native/$base.so
+          # mjml >= 4.0 loads through RustlerPrecompiled (expects NIF name w/o lib prefix)
+          ln -s "$lib" $out/mjml/priv/native/''${base#lib}.so
         done
+
+        mkdir -p $out/lazy_html/_build/c/third_party/lexbor
+        cp -r --no-preserve=mode ${lexborSrc} \
+          $out/lazy_html/_build/c/third_party/lexbor/${lexborCommit}
       '';
 
 in
@@ -123,10 +141,22 @@ beamPackages.mixRelease rec {
   nativeBuildInputs = [
     nodejs
     brotli
+    cmake
   ];
 
+  dontUseCmakeConfigure = true;
+
   mixFodDeps = patchedMixFodDeps;
 
+  # deps are compiled in mixRelease configurePhase
+  # so the force_build switch must be in place before then
+  # preBuild would be too late
+  preConfigure = ''
+    cat >> config/config.exs <<EOF
+    config :elixir_make, :force_build, lazy_html: true
+    EOF
+  '';
+
   passthru = {
     tests = {
       inherit (nixosTests) plausible;
@@ -157,12 +187,15 @@ beamPackages.mixRelease rec {
   preBuild = ''
     rm -r assets tracker
     cp --no-preserve=mode -r ${assets} assets
-    cp -r ${tracker} tracker
+    # tracker must be writable since 3.1.0
+    # compile.js emits npm_package/plausible.js
+    cp --no-preserve=mode -r ${tracker} tracker
 
     # Fix cross-compilation with buildPackages
-    # since tailwindcss_3 is not available for RiscV
+    # since tailwindcss is not available for RiscV
+    # plausible >= 3.1.0 needs tailwind v4
     cat >> config/config.exs <<EOF
-    config :tailwind, path: "${lib.getExe buildPackages.tailwindcss_3}"
+    config :tailwind, path: "${lib.getExe buildPackages.tailwindcss_4}"
     config :esbuild, path: "${lib.getExe esbuild}"
     EOF
   '';
diff --git a/pkgs/by-name/pr/prowlarr/deps.json b/pkgs/by-name/pr/prowlarr/deps.json
index 5761afc2b7c3..2532117e86e4 100644
--- a/pkgs/by-name/pr/prowlarr/deps.json
+++ b/pkgs/by-name/pr/prowlarr/deps.json
@@ -1,8 +1,8 @@
 [
   {
     "pname": "AngleSharp",
-    "version": "1.3.0",
-    "hash": "sha256-xq+G2f9FCqS6PjIgfDdZjVRoaxVMiSyOXC7KtMzMpPU="
+    "version": "1.4.0",
+    "hash": "sha256-xHpoMkhYSj7ejeMmI2e7ygef84QGZhttPjYOnLjITd0="
   },
   {
     "pname": "AngleSharp.Xml",
@@ -11,18 +11,18 @@
   },
   {
     "pname": "Azure.Core",
-    "version": "1.47.1",
-    "hash": "sha256-YJR1bDI9H9lr6p/9QcOWEhnpMD8ePyxxO39S32VAOak="
+    "version": "1.50.0",
+    "hash": "sha256-8Pjz0/2wTLK5uY7G5qrxQr4CsmrjiR8gL4g6zJymj5s="
   },
   {
     "pname": "Azure.Identity",
-    "version": "1.14.2",
-    "hash": "sha256-PpGcGQrzcEzDtTm65gLmjWrt8yavst4VOKDlr+NuLQo="
+    "version": "1.17.1",
+    "hash": "sha256-pjNnhL/sCFy+BWNMAgj+l6aGoOp4ngrFO/61RIgzBEU="
   },
   {
     "pname": "BouncyCastle.Cryptography",
-    "version": "2.6.1",
-    "hash": "sha256-0NNwK/UZlnIK4Nb7bs4ya0XfoVluKQPUVQvaR88UHKo="
+    "version": "2.6.2",
+    "hash": "sha256-Yjk2+x/RcVeccGOQOQcRKCiYzyx1mlFnhS5auCII+Ms="
   },
   {
     "pname": "Castle.Core",
@@ -36,8 +36,8 @@
   },
   {
     "pname": "Dapper",
-    "version": "2.1.66",
-    "hash": "sha256-e5n/wnAFGPDSe30oQQ0fanXrvFZYYa+qCDSTHtfQmPw="
+    "version": "2.1.79",
+    "hash": "sha256-QIGZ+vlnwhSl+nnVZ//s3uwFh/vKJ5kDpgGkmpMjhmw="
   },
   {
     "pname": "Diacritical.Net",
@@ -106,13 +106,13 @@
   },
   {
     "pname": "IPAddressRange",
-    "version": "6.2.0",
-    "hash": "sha256-g3brzbKKPZS23cbttpr5CCYoZHm+dvH43/gXLuZYmFg="
+    "version": "6.3.0",
+    "hash": "sha256-RM3Bm07HzaKAMY64JiuJ2xCT399Bhj/Asyv1+o3kdNo="
   },
   {
     "pname": "MailKit",
-    "version": "4.14.0",
-    "hash": "sha256-vAFqKaKvLUUiFbpu1mJdL/W5CIlb6rh3U6ef883g+Bs="
+    "version": "4.16.0",
+    "hash": "sha256-4yyFxq8pJVTIgAJkyAYcuV2+/ZirENgUSk1OSD/gKIo="
   },
   {
     "pname": "Microsoft.ApplicationInsights",
@@ -121,29 +121,24 @@
   },
   {
     "pname": "Microsoft.AspNetCore.Cryptography.Internal",
-    "version": "8.0.16",
-    "hash": "sha256-uw/5GAPpefPeMrfG69EBOVciSHxBKs0E8Txkf+rttzs="
+    "version": "8.0.27",
+    "hash": "sha256-3GmpnUmBfk45cWCfkoeN+9ANom7LrJsakZvIT8kIagk="
   },
   {
     "pname": "Microsoft.AspNetCore.Cryptography.KeyDerivation",
-    "version": "8.0.16",
-    "hash": "sha256-Zpt7vlY0xdrk/6XDRtXb0t9MK6SiPP6sr3fC6gQ1/YQ="
+    "version": "8.0.27",
+    "hash": "sha256-FGqqp3fruL4r1ImEMcDRqvgl+uxkQqngkRRfXhc7EWI="
   },
   {
     "pname": "Microsoft.AspNetCore.WebUtilities",
-    "version": "8.0.16",
-    "hash": "sha256-ly0Ba+RUwjM4QrgW4GfCIYFZS6VEZ3lduHzN88bnHZA="
+    "version": "8.0.27",
+    "hash": "sha256-hf+9v8bC8jUx+O4oq5FPk2QhvuV33BDZen8Gaqk+fb0="
   },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
     "version": "8.0.0",
     "hash": "sha256-9aWmiwMJKrKr9ohD1KSuol37y+jdDxPGJct3m2/Bknw="
   },
-  {
-    "pname": "Microsoft.Bcl.Cryptography",
-    "version": "8.0.0",
-    "hash": "sha256-p9aO+aVi4Vl8bRsYRFGJyc9Mqd2wkQ12RwWDwBhdt4I="
-  },
   {
     "pname": "Microsoft.CodeCoverage",
     "version": "17.10.0",
@@ -156,8 +151,8 @@
   },
   {
     "pname": "Microsoft.Data.SqlClient",
-    "version": "6.1.1",
-    "hash": "sha256-IBVkAipJyF7KO9uid+5QyfVzWEeY/BbQUofKc6zQoW0="
+    "version": "6.1.5",
+    "hash": "sha256-XpGL/oKQWn+FmYNmKB6CMmWbPEuCDX/xdOMqljS0vvs="
   },
   {
     "pname": "Microsoft.Data.SqlClient.SNI.runtime",
@@ -351,24 +346,24 @@
   },
   {
     "pname": "Microsoft.Identity.Client",
-    "version": "4.73.1",
-    "hash": "sha256-cd5ArtDvQK4gdX8M0GHQEsCFWlqpdm6lxvaM2yMHkhc="
+    "version": "4.80.0",
+    "hash": "sha256-vtuXCu0ykTYJjvlSSWMjC9EGJQXZ1dqgpaMeD4FmlGQ="
   },
   {
     "pname": "Microsoft.Identity.Client.Extensions.Msal",
-    "version": "4.73.1",
-    "hash": "sha256-wc4oHBGKCJhAqNIyD4LlugCFvmyiW5iVzGYP88bnWqs="
-  },
-  {
-    "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "6.35.0",
-    "hash": "sha256-bxyYu6/QgaA4TQYBr5d+bzICL+ktlkdy/tb/1fBu00Q="
+    "version": "4.78.0",
+    "hash": "sha256-0s9wa8HkFhnzmAz+TGxtA3qTX3dZiIoPcTWGLgY8mAg="
   },
   {
     "pname": "Microsoft.IdentityModel.Abstractions",
     "version": "7.7.1",
     "hash": "sha256-v83O6Gb8s4wGhbRPvOA95t0LSX+MAhF6WpA6qZeK2XM="
   },
+  {
+    "pname": "Microsoft.IdentityModel.Abstractions",
+    "version": "8.14.0",
+    "hash": "sha256-bkCuz1Wj56N+LHWLvHKLcCtIRqBK+3k5vD2qfB7xXKk="
+  },
   {
     "pname": "Microsoft.IdentityModel.JsonWebTokens",
     "version": "7.7.1",
@@ -396,8 +391,8 @@
   },
   {
     "pname": "Microsoft.Net.Http.Headers",
-    "version": "8.0.16",
-    "hash": "sha256-6sB9B+GLETiyGhRMyD4U6ZuQpFtCL/oIPQr+9lB4peU="
+    "version": "8.0.27",
+    "hash": "sha256-OBZqkFILqXVYV8QdpNRM2Y2HwFbvWus+46tnRUhw3zQ="
   },
   {
     "pname": "Microsoft.NET.Test.Sdk",
@@ -496,8 +491,8 @@
   },
   {
     "pname": "MimeKit",
-    "version": "4.14.0",
-    "hash": "sha256-06dqA6w2V2D+miq387smCuJ/8fk1FVc0rvRjmglAWyM="
+    "version": "4.16.0",
+    "hash": "sha256-yWGXVm+EHvBSsZlVHdWdD+rVwdf/5hHxsUfJMSd2Afo="
   },
   {
     "pname": "Mono.Nat",
@@ -547,18 +542,23 @@
   },
   {
     "pname": "NLog",
-    "version": "5.4.0",
-    "hash": "sha256-l2R0UHHCL02KPMC96e62AL2ONFD0PAty619y9UnD25A="
+    "version": "5.5.0",
+    "hash": "sha256-WkuKGo3iEqJruQuRZXMksqIbAQjZbFIANcm0zZr/fYE="
+  },
+  {
+    "pname": "NLog",
+    "version": "5.5.1",
+    "hash": "sha256-cLAAj2QWWhbfh4vgnE/fLq5Rpr3uTe4ufnVWTig0nEo="
   },
   {
     "pname": "NLog.Extensions.Logging",
-    "version": "5.4.0",
-    "hash": "sha256-9pVBguAKnjmbtKM3wBVBEzovXkoEXgqvB4IhiayAkVo="
+    "version": "5.5.0",
+    "hash": "sha256-gdhJP9V5lDHgRS8gpFDgW6CkkLKo+tACCqPvERLaZ68="
   },
   {
     "pname": "NLog.Layouts.ClefJsonLayout",
-    "version": "1.0.3",
-    "hash": "sha256-Rgf3s3Q9TXdzZHwb+VCBupazvmrgAPZcrKGBhV9Jh6Q="
+    "version": "1.0.5",
+    "hash": "sha256-mBHH0OlpW0dCa34jI2xBTg1J7EDfmNJqjdRJOA3khWQ="
   },
   {
     "pname": "NLog.Targets.Syslog",
@@ -567,8 +567,8 @@
   },
   {
     "pname": "Npgsql",
-    "version": "9.0.3",
-    "hash": "sha256-X3F05GNj3vNVl++VOV5TMYE5dvEe6cx0k+5yWo2Q/+o="
+    "version": "9.0.5",
+    "hash": "sha256-5AF0qiVQwfKUqCXSFb+oJhe3Q1wwK9F9+Q9/A4RTIdo="
   },
   {
     "pname": "NUnit",
@@ -587,8 +587,8 @@
   },
   {
     "pname": "Polly",
-    "version": "8.6.4",
-    "hash": "sha256-Z+ZbhnHWMu55qgQkxvw3yMiMd+zIMzzQiFhvn/PeQ3I="
+    "version": "8.6.6",
+    "hash": "sha256-0BrOttCw+HQYB24Y2uMy2vo0P5/txUlhELC8FlyLKps="
   },
   {
     "pname": "Polly.Contrib.WaitAndRetry",
@@ -597,8 +597,8 @@
   },
   {
     "pname": "Polly.Core",
-    "version": "8.6.4",
-    "hash": "sha256-4Xrg/H481Y/WOHk1sGvFNEOfgaGrdKi+4U54PTXhh9I="
+    "version": "8.6.6",
+    "hash": "sha256-y6/a4OWrUlRfe0J8qdhBRmYRDi6K2y+kwhEVCIUOjvU="
   },
   {
     "pname": "RestSharp",
@@ -832,8 +832,8 @@
   },
   {
     "pname": "SourceGear.sqlite3",
-    "version": "3.50.4.2",
-    "hash": "sha256-NsahZ3lW1JYXMq4NOH5nM/EhdjV05sbrhjsGNIinb+M="
+    "version": "3.50.4.5",
+    "hash": "sha256-yPOyLiK4QoTfE3IED0hFl1JJYjmt8RBB3fp1a1CwvqE="
   },
   {
     "pname": "Swashbuckle.AspNetCore.Swagger",
@@ -857,8 +857,8 @@
   },
   {
     "pname": "System.ClientModel",
-    "version": "1.5.1",
-    "hash": "sha256-n4PHKtjmFXo37s5yhfUQ9UbfnWplqHpC+wsvlHxctow="
+    "version": "1.8.0",
+    "hash": "sha256-ZWVhuw3IRk9rZXkXERhesEET2KMMzHjUH/HDI288WK8="
   },
   {
     "pname": "System.Collections",
@@ -917,8 +917,8 @@
   },
   {
     "pname": "System.Data.SQLite",
-    "version": "2.0.2",
-    "hash": "sha256-s++mcixhc+QaQKzdXZ6quK8kH5WWWmU0mESZNNuP/ck="
+    "version": "2.0.3",
+    "hash": "sha256-2TzEFt0nJjK1g8Gi5RMII7TOpG4vi9UzvJI3JxuPnKA="
   },
   {
     "pname": "System.Diagnostics.Debug",
@@ -937,8 +937,8 @@
   },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
-    "version": "6.0.1",
-    "hash": "sha256-Xi8wrUjVlioz//TPQjFHqcV/QGhTqnTfUcltsNlcCJ4="
+    "version": "8.0.1",
+    "hash": "sha256-zmwHjcJgKcbkkwepH038QhcnsWMJcHys+PEbFGC0Jgo="
   },
   {
     "pname": "System.Diagnostics.EventLog",
@@ -962,8 +962,8 @@
   },
   {
     "pname": "System.Drawing.Common",
-    "version": "8.0.19",
-    "hash": "sha256-KDCdLN8aKxQmQCe8D5iCyZKo2+mhx00tg7CqTILE/v0="
+    "version": "8.0.27",
+    "hash": "sha256-lxN0ZYNBAHdT0x45JuNSJ2L2uBdruqsDCAT4KVrmejs="
   },
   {
     "pname": "System.Dynamic.Runtime",
@@ -1140,11 +1140,6 @@
     "version": "4.3.0",
     "hash": "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="
   },
-  {
-    "pname": "System.Runtime.CompilerServices.Unsafe",
-    "version": "6.0.0",
-    "hash": "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="
-  },
   {
     "pname": "System.Runtime.Extensions",
     "version": "4.3.0",
@@ -1332,8 +1327,8 @@
   },
   {
     "pname": "System.ValueTuple",
-    "version": "4.6.1",
-    "hash": "sha256-Hb87MPcNdHQRlREDzFEKU8ZqtKN26bjyAiimJmm6LWI="
+    "version": "4.6.2",
+    "hash": "sha256-dv0ONmorkGVf0V1Vewt5UEGXdINYy1eP4xk/bZe92ao="
   },
   {
     "pname": "System.Xml.ReaderWriter",
diff --git a/pkgs/by-name/pr/prowlarr/package.nix b/pkgs/by-name/pr/prowlarr/package.nix
index 9a0c1b363d63..059e018fa173 100644
--- a/pkgs/by-name/pr/prowlarr/package.nix
+++ b/pkgs/by-name/pr/prowlarr/package.nix
@@ -20,7 +20,7 @@
   applyPatches,
 }:
 let
-  version = "2.3.5.5327";
+  version = "2.4.0.5397";
   # The dotnet8 compatibility patches also change `yarn.lock`, so we must pass
   # the already patched lockfile to `fetchYarnDeps`.
   src = applyPatches {
@@ -28,7 +28,7 @@ let
       owner = "Prowlarr";
       repo = "Prowlarr";
       tag = "v${version}";
-      hash = "sha256-mHYEY49uczfo0lAaweCmA04dHDxRMFq5lYybKGirlQk=";
+      hash = "sha256-cLFzCPSG0cB2K3KPNrN0zNnmZMEX3olJajNFGxmYoAM=";
     };
     postPatch = ''
       mv src/NuGet.config NuGet.Config
@@ -50,7 +50,7 @@ buildDotnetModule {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-FYLfOR5gm9lg1F8RGyDN6MkFAcaxWIdIxd/IDBVUMUQ=";
+    hash = "sha256-PZw+Q7CcHkbb2bhZKSPE0kvPIhWxWQIqr7/UZlPdqtY=";
   };
 
   postConfigure = ''