diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index fdfd96c9e2cc..ad45fb65096d 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
index b43aca0541e6..9eb5911aadb5 100644
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -46,7 +46,7 @@ jobs:
       # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -56,7 +56,7 @@ jobs:
         run: npm install @actions/artifact bottleneck
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
-      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 46a4b7b4cf3f..7ea446842a3a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -52,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index a264e3ecba48..59b801f0c0d1 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           path: trusted
@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
index 16efc03bf6e5..feb770a24ecd 100644
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -23,14 +23,14 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
             ci/github-script
 
       # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
-      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/edited.yml b/.github/workflows/edited.yml
index b05eb973074c..cf16302421d9 100644
--- a/.github/workflows/edited.yml
+++ b/.github/workflows/edited.yml
@@ -36,7 +36,7 @@ jobs:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
       # We only need Pull Requests: write here, but the app is also used for backports.
-      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 9d8dc0b7deab..9146cff5631b 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -37,7 +37,7 @@ jobs:
     outputs:
       versions: ${{ steps.versions.outputs.versions }}
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           path: trusted
@@ -45,7 +45,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -89,7 +89,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -171,7 +171,7 @@ jobs:
       statuses: write
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -342,7 +342,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 06e04c57499c..95ad536571a8 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
diff --git a/.github/workflows/merge-group.yml b/.github/workflows/merge-group.yml
index 3bcb0891b145..299f56c09dfe 100644
--- a/.github/workflows/merge-group.yml
+++ b/.github/workflows/merge-group.yml
@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml
index d29f34e643c0..58e454d13cd6 100644
--- a/.github/workflows/periodic-merge.yml
+++ b/.github/workflows/periodic-merge.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/pull-request-target.yml b/.github/workflows/pull-request-target.yml
index a9bbf62c388d..9609a440ae89 100644
--- a/.github/workflows/pull-request-target.yml
+++ b/.github/workflows/pull-request-target.yml
@@ -31,7 +31,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
diff --git a/.github/workflows/review.yml b/.github/workflows/review.yml
index a6f2299d06cc..a458489f6886 100644
--- a/.github/workflows/review.yml
+++ b/.github/workflows/review.yml
@@ -20,14 +20,14 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
             ci/github-script
 
       # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
-      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
         id: app-token
         with:
diff --git a/.github/workflows/teams.yml b/.github/workflows/teams.yml
index 1b144af2a0b6..b815909c3472 100644
--- a/.github/workflows/teams.yml
+++ b/.github/workflows/teams.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered and to
       # request team member lists.
-      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         id: app-token
         with:
           app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -64,7 +64,7 @@ jobs:
           echo "git-string=$name <$email>" >> "$GITHUB_OUTPUT"
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           token: ${{ steps.app-token.outputs.token }}
           add-paths: maintainers/github-teams.json
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 63e055207c76..ae1681d8d9e3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity
diff --git a/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix b/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
index 3f9cee7f72e0..1c8fa95878a9 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
@@ -9140,10 +9140,10 @@
     elpaBuild {
       pname = "tramp";
       ename = "tramp";
-      version = "2.7.2.2";
+      version = "2.7.2.4";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/tramp-2.7.2.2.tar";
-        sha256 = "0nq441hdr9akpdklplnf4hcza4jgj4vq2718mvf2iznbqqs4b33k";
+        url = "https://elpa.gnu.org/packages/tramp-2.7.2.4.tar";
+        sha256 = "sha256-Cp6zZZRqji36zxAXIk3CwngHMRsGr7+X3Sn9IMiyNDM=";
       };
       packageRequires = [ ];
       meta = {
diff --git a/pkgs/by-name/bc/bcachefs-tools/package.nix b/pkgs/by-name/bc/bcachefs-tools/package.nix
index 32df260db0d1..17257758e19e 100644
--- a/pkgs/by-name/bc/bcachefs-tools/package.nix
+++ b/pkgs/by-name/bc/bcachefs-tools/package.nix
@@ -28,18 +28,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  version = "1.31.12";
+  version = "1.32.1";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gbSyybWTG38mI3r6kdOHFaEx7S82x25OMPEAWZql7Mo=";
+    hash = "sha256-SY1dKFAlLHOyAGaBmqCMDM6pAHKByHEyTcv1EAHQBVU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-w8dcbaJBCsn02JFPXzhOj2Ozuti0Xkr6mssdZhYKEFs=";
+    hash = "sha256-LLodbtdUc8WGUkZmwiKrmjd7EaxkFP7QqEbLoESAKAQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/gi/git-lfs/package.nix b/pkgs/by-name/gi/git-lfs/package.nix
index b73a41617b04..dc17e1f8fbcd 100644
--- a/pkgs/by-name/gi/git-lfs/package.nix
+++ b/pkgs/by-name/gi/git-lfs/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "git-lfs";
-  version = "3.6.1";
+  version = "3.7.1";
 
   src = fetchFromGitHub {
     owner = "git-lfs";
     repo = "git-lfs";
     tag = "v${version}";
-    hash = "sha256-zZ9VYWVV+8G3gojj1m74syvsYM1mX0YT4hKnpkdMAQk=";
+    hash = "sha256-N5ckTnyA3mueZre+rMhFZBiAFgEu4pmtzkiUidXnan8=";
   };
 
-  vendorHash = "sha256-JT0r/hs7ZRtsYh4aXy+v8BjwiLvRJ10e4yRirqmWVW0=";
+  vendorHash = "sha256-6H0KpLin+DqwEg5bdzaxj2CoNSneZ/ET43MTrrdF3h8=";
 
   nativeBuildInputs = [
     asciidoctor
diff --git a/pkgs/by-name/he/hedgedoc/missing-hashes.json b/pkgs/by-name/he/hedgedoc/missing-hashes.json
index a203ed4e54ca..755c9e97e4a9 100644
--- a/pkgs/by-name/he/hedgedoc/missing-hashes.json
+++ b/pkgs/by-name/he/hedgedoc/missing-hashes.json
@@ -1,27 +1,28 @@
 {
-  "@esbuild/aix-ppc64@npm:0.25.2": "3b5ee5599a8446074bd6aad732c5f2833a4b77e8af62cfcdee7508ded661daa054c481c2fa69f5341e65cc8846a2b3f026ffca12934cb24d76df93e4800e2979",
-  "@esbuild/android-arm64@npm:0.25.2": "556d958ea6f33073669a8a41645b0e51cecb2c0788ece8827a8752e666fd178ae28b2f9749b8a968f1e9c66b09dab7933be8d8b53e391ea9eca7bddf3f53b26a",
-  "@esbuild/android-arm@npm:0.25.2": "0ce9f260216520a4d53c2736b60e8e55b8c6569b944555cb7840fbe2ff16278d4e6591aedcbc38b3f69a6d98167367f36bba1d35b41d725e4d68a67f942e2a28",
-  "@esbuild/android-x64@npm:0.25.2": "57d0c438a3bcc25db5aa89c9d9b60827d3ee6d9553234d95a16f52f8a7780778e5e7a9975374e4d37a81e600d2b8f32bd46d5633bb83bcd958ee2f5162d1359b",
-  "@esbuild/darwin-arm64@npm:0.25.2": "e148927428c0c5d69e681ee8d4b47e0bcc5116296c47c41ed44068d686a0568b23dc493dc47b4d103e7b21894fafbaf5c2d64bf2420a5d6b6b22f71bf6c2fb08",
-  "@esbuild/darwin-x64@npm:0.25.2": "2bc37a902d7828f3973d28f486bcf26da13f6f421122348fc510551a4674bc706eb8e6f692ccd3d887523c373580b3228797f2fd73d641b2e106a6d44e3f20c7",
-  "@esbuild/freebsd-arm64@npm:0.25.2": "431ddf98e7c0b7c6a7d1a689454ab449df8eaacca242442153a4f149017d6bd03e16b7fda01e9fe26316d135176d74f5de09e9a21357648c320a3211a1c862a2",
-  "@esbuild/freebsd-x64@npm:0.25.2": "21545ec11969db7ed091819b63c88a9c4490edce8a98d64718f79352a5001927d1d85e6261170562850afdb5a7a2182ccf3d936eab0db615e51188ab6f95789b",
-  "@esbuild/linux-arm64@npm:0.25.2": "332ba0533f2a2bba21dfb3c9130f9a1cef5b420da29f67116e7fbff4cfd12039d06646b4a636952b873b22129a4e5c6ea6ea9b57286949980add7bab5d6684c1",
-  "@esbuild/linux-arm@npm:0.25.2": "a89613faa8ce9f307eea4c2b4ada8cdb56e378716d5250fc163674032bfbdda8b8aacc730c6b5fa05b5e5bff04a9a11dd02934d69b2233ecf0ff58af4ef5bb45",
-  "@esbuild/linux-ia32@npm:0.25.2": "5907824945c067f092bb28807080a2617b5208583ef71b2091d57b6039df182735ba62ee0142e993260d80df3a5b7ae88c0fff28f2e4efd8254dd34de2f4ad95",
-  "@esbuild/linux-loong64@npm:0.25.2": "ed521bfa81db13fc628455fc0feec4e75150ed2248013baaf8fa7d6d278295d3a2b09196c79169b7331e50e6d3abf86ee5773ad28f8d5914bbe4034758a424c2",
-  "@esbuild/linux-mips64el@npm:0.25.2": "9961d5853e7ff048ae2cb3997136f96ca5180dcc483e88e2ae0d34ca8ec097af3cc7d7c8ac6303a3cf2582eadbe905fa97a38dd9b402f82b9e104a0070f04b79",
-  "@esbuild/linux-ppc64@npm:0.25.2": "9ee2360fa976e7c0e16b09fd551fba232e19ede65a326544d16bcae0c399e2937b853eab5649a52589e483c77dbc4ab5e082177ee70e6fd2de53c421314ea458",
-  "@esbuild/linux-riscv64@npm:0.25.2": "e6bff41e76d44a8d6f27a53b2aeb98c771f6215590d411a1b6b682aa41c96cc9ed8baa6d17412d09419b10778dc40ca75b6cfe71dc8e24f1bf5c1e7793e2c560",
-  "@esbuild/linux-s390x@npm:0.25.2": "34ca97c2506f1a1e646bc74f7cfff7bc7990052c3a2ade963c010c6bff6ae6135b9788f7972af2fb47e1a5380b26b8ca1b7a6c3f2bc9eaa7c9e7fdf227e38ab0",
-  "@esbuild/linux-x64@npm:0.25.2": "ac2c60f9dcbf9c55f66aef618b2a3218ddde92aad764aa6645b94b50c8c6242f1f97a0af956759738bca97686918dd71a0cfc82c73eadb0ab921918c9927a627",
-  "@esbuild/netbsd-arm64@npm:0.25.2": "6d820e86cbf10d305520ed7dbf4358bd4d75d333de39c100156dcc5619446916b4d5a1c1e07b838d22f6013aaf57bdd93187f2e97b1357a426e94e91b485e0e1",
-  "@esbuild/netbsd-x64@npm:0.25.2": "89153d1753254cd88f12b9e088a79398dcee11c0a1349a0886b54dd2db0ae2faf64ac0e364494f0cbd64163320cff94f02fc1fe827ff950daa0a27e50ef84a27",
-  "@esbuild/openbsd-arm64@npm:0.25.2": "71ede4e8f1086bece4e6d528b46ee3a493e0d33d749d5ac9050afd5471465badce7f36f1d04c1edddec75fde49e1229adb0f7758bcd508219a7598086b9a3c5c",
-  "@esbuild/openbsd-x64@npm:0.25.2": "95d90426c96d27980340d29c6d83f79ea2a22008041a5366c81820275ce36ba95ad0bf5e89ee199747a5921953587e7dcdc2e5a97368dec4efbcfc83ab5be4ee",
-  "@esbuild/sunos-x64@npm:0.25.2": "da59382e27897f98ee7261651eff1bcf42b1d659b078e500f664ef18137d70298f0bc0a50cf5af2311931e5b0454c6d3756a0ff9e560ab0a754ea56b0f04768c",
-  "@esbuild/win32-arm64@npm:0.25.2": "39f9a30d00a788ef168d7186f366397f7c471f1db3328efc0b9ff0861475f8a4484723b60ab6ab04c3bb27ebcdc8632e4883c28b5fa93b0606dd9f85f7904043",
-  "@esbuild/win32-ia32@npm:0.25.2": "74a7726d21a347faa1debdcd540e77fa5af9f96d5e0d625f2752d24a1616ac0fdea6582a0499935d9d964ee4c7a57ad8f30c6fe355089af2095bd0e41b70ea49",
-  "@esbuild/win32-x64@npm:0.25.2": "1e3f44cc53acaff9d45e2cded9811c750b7eb946f7b76d1fec66b862a89da800f9291269607d7cbb8d7e6068504571904d93a0813692e74fbae1fc321fe46440"
+  "@esbuild/aix-ppc64@npm:0.25.12": "b2cc7e0cd348bc315907f6ce090ee545d4157a19fc44327ff0262ba9296f0fad19c57dd679b1b526a0a18f34f1971b128e15b41bca794c74a9b2c32238fdd537",
+  "@esbuild/android-arm64@npm:0.25.12": "f770937988ec42e289277abc03800ccf88902684dbda3013a8ab274bb9eca36d35619a75f0f0510e225bdb4c7cf9a426218c7d2641a98fed74287a52d60d8865",
+  "@esbuild/android-arm@npm:0.25.12": "7a5d507aa717d85470c595e11f3c03fbf4f0bffdd10d30f49e1a3f14c2553191f156b214eacd6911fa36719faef23c28be7d88ac876ec300995987964ea16e99",
+  "@esbuild/android-x64@npm:0.25.12": "cd459b0433b0541bae9ffafd274c57529125719a5b78f4ee92aa9f8a1f54b002a18d889bee19084a503c114412269ef4e740d21b4a2de811ec2a076e96b35f48",
+  "@esbuild/darwin-arm64@npm:0.25.12": "067f4588b9b64c93742c4a8cec35282dd076583006ce8089aae3095fcae5b606a2f60d86caf0527be6009be234178fb83d360af82698e2017a6f9fb9345e084d",
+  "@esbuild/darwin-x64@npm:0.25.12": "c29947d07adacadcb29092860b69d1b668d9c5abfaf525e2a7f3ece61c3f4e72a95c1c66ad0e80fbf31d01210ae4e8330d4ae6d9c6c9ad2b8aa159eb115f9a8d",
+  "@esbuild/freebsd-arm64@npm:0.25.12": "c51691aeb04e41c554a59cbb5ab8d917446f352aeec70e3d5a7f25409e9115ff2db930589052df3e7d60f03eff4c298bda89db62f2408d1a49b6a70e69c5d4a0",
+  "@esbuild/freebsd-x64@npm:0.25.12": "9b84c48176350811690751c34d1513005290641923a161f96cb433cbcbb8c072ecb92cef39ba641f48032071f74c6119e5f081b5788242109426c54f3ef1a01e",
+  "@esbuild/linux-arm64@npm:0.25.12": "1e9cc29569890f5944e7dbe2e597eb19d76e85fe07aef6253129b16800ccb5b33a79cea17873d7debdf681d34adf77e06ae99742fe06cab095f3db441b741b1e",
+  "@esbuild/linux-arm@npm:0.25.12": "fcf091d6a51834c9a942ee33b568342990c7fa29d2ff338ce628a41bc415696d09bca7ef502c2b04518973010f73ab3d13e37096030db9c8d393ab29408f104b",
+  "@esbuild/linux-ia32@npm:0.25.12": "ccd563c3189e5f651b479dd80d3bebd9d5c4747ce7448bb80266c804c3141eb3514b8c70445d77301899c54c1ff8c74614f8423704fde475a5c67efe86713235",
+  "@esbuild/linux-loong64@npm:0.25.12": "6df2710d99d84006ad8151a9ca26861dbb97524a15e61f56eb1a5a76786865ad03be838fe3d414a72b239262364964528f3136c2965b3c442c7ed85090b145c4",
+  "@esbuild/linux-mips64el@npm:0.25.12": "883bd8c4afd70b8e372db8a6bdb429d419ae30253a63987ff824994958d8431b6e51ead05e6372b2a233e025ea57f6f65b04ebaff8308e39acf54bfa73a5cae2",
+  "@esbuild/linux-ppc64@npm:0.25.12": "71f8544a3b99b4c95d49604b66d144e9617ae9925914c1bd5bc6731d15d4e48e7f8e9bffd85835e1c93a88c3537b53f3e99b500e4dd2533af9483055b02f9d38",
+  "@esbuild/linux-riscv64@npm:0.25.12": "fe8048262c5c6a040c047a9b7ab8547b0e7a32ce50f622ea8dadc3ec22065676efbc9b36896ca96959f77839757319633a2d05af5f2de7b32389a03b80f027f1",
+  "@esbuild/linux-s390x@npm:0.25.12": "e5c023be1dfd75c915453763f944db8ab3da4f60a00c2b0e6f3b9349bc6c51e5ac5ce928db56e8f316e910213adf2172efd1b37abe070f6cda0c28583d770bab",
+  "@esbuild/linux-x64@npm:0.25.12": "8b2c7f5e00c40058f5c150df267cd303eae5907822f196902cd8e64af70475e800a7f132ac6388aa2b77b877d6314147e67f3fb67d97c867adccd54a2a6caaf6",
+  "@esbuild/netbsd-arm64@npm:0.25.12": "19bc5a1295697aa8787929472323494302d117ea1e592f17cfae443525c1e5917a5f77e6582fc1ec9de3a11a9e296bc12749c6b12cde0aab10695b5c25f29f73",
+  "@esbuild/netbsd-x64@npm:0.25.12": "8eb2ff51aa39b43a021e4b51411789b6299fd0dc38b3896719684333e32fd42ed4508ab67dcc88435631e5333573a4848dbfeec12569de46c2318dcdb39ad3ab",
+  "@esbuild/openbsd-arm64@npm:0.25.12": "5ff26a012d0d35673bc3800d28f284a62c310801a68c55b2d1ed8a7e09ef7568117fb8ab2d7ec7a6e7d73ce6a9e05150ee07335fc6447ba98658469b9da1cb2e",
+  "@esbuild/openbsd-x64@npm:0.25.12": "41dce65493548bc0dc411a6175e9fb109a93bbbf370ef444d1459698226ad2a3096ab7edd420c27eb3d15e6bbd0bc79357bd7c0a59c5527ace0fefac181638f8",
+  "@esbuild/openharmony-arm64@npm:0.25.12": "b3e0502067e760e5b92d3180e20372cbb2dba8267fbb56206d50bdeccd8895feb408020b98c3f17054eea0f1fba365385850cb91d1f79a25dfa3751032278825",
+  "@esbuild/sunos-x64@npm:0.25.12": "50ed9767e00ff74a1d98d94c5fe6027bc5e9e095a64735d1d0676ec72adc4b15b0095e97f5ac71602f2c5fcdcf3e9f6cfe005315e998d9d3e12ca93a2076b639",
+  "@esbuild/win32-arm64@npm:0.25.12": "4969d20da28a0c783ada6116724f51a542fad81dab043c4f6f9b7c8f4a68be558f03beb29d75bd550ab6e63f720535ebacb9ce1760099be7a63d4e1ec8351e2b",
+  "@esbuild/win32-ia32@npm:0.25.12": "60ce7d21c5e01c8b0c8c2c4660ff6d890a32b1acf09f5499f950a86bc5c6da17eee760c6bb7a720a0429f7633bbb38b2db517e444408d8a6ff6fc76157310980",
+  "@esbuild/win32-x64@npm:0.25.12": "bbdc69d57d85a6b8af85731c0979186aba54eb34c8d1de5eab4aa1d8fd45e3b38b5426c287cedf43228bb0794a741d9b2c55284c7db7d79335bc33dc389e7bb3"
 }
diff --git a/pkgs/by-name/he/hedgedoc/package.nix b/pkgs/by-name/he/hedgedoc/package.nix
index eae02d40d918..b7a9ec779d58 100644
--- a/pkgs/by-name/he/hedgedoc/package.nix
+++ b/pkgs/by-name/he/hedgedoc/package.nix
@@ -13,13 +13,13 @@
 }:
 
 let
-  version = "1.10.3";
+  version = "1.10.4";
 
   src = fetchFromGitHub {
     owner = "hedgedoc";
     repo = "hedgedoc";
     tag = version;
-    hash = "sha256-hXcPcGj+efvRVt3cHQc9KttE0/DOD9Bul6f3cY4ofgs=";
+    hash = "sha256-ysiHvRMOgVFTFKeMWjshZpIZAOTf+EbBQQm3dDeMB3I=";
   };
   missingHashes = ./missing-hashes.json;
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation {
 
   offlineCache = yarn-berry_4.fetchYarnBerryDeps {
     inherit src missingHashes;
-    hash = "sha256-V7ptquAohv0t5oA+3iTvlQOZoEtY5xWyhSoJP8jwYI8=";
+    hash = "sha256-jMJXNWvmlweCJu+xs2ucMtB6N+0r1cgP/aGt2zfH4iQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/matio/package.nix b/pkgs/by-name/ma/matio/package.nix
index 77a71345ae13..9cc0c0cf155a 100644
--- a/pkgs/by-name/ma/matio/package.nix
+++ b/pkgs/by-name/ma/matio/package.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "matio";
-  version = "1.5.28";
+  version = "1.5.29";
 
   src = fetchurl {
     url = "mirror://sourceforge/matio/matio-${finalAttrs.version}.tar.gz";
-    hash = "sha256-naaYk0ohVprwWOY0hWRmb0UCnmwrCHjKDY+WCb93uNg=";
+    hash = "sha256-2eX3ovLFlO/xX1UONHKbAZkc3VoCilWL6M5ZWzIjOvs=";
   };
 
   configureFlags = [ "ac_cv_va_copy=1" ];
diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index edd134a55ca1..52f9e328a51e 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -17,8 +17,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "24.11.0";
-  sha256 = "cf9c906d46446471f955b1f2c6ace8a461501d82d27e1ae8595dcb3b0e2c312a";
+  version = "24.11.1";
+  sha256 = "ea4da35f1c9ca376ec6837e1e30cee30d491847fe152a3f0378dc1156d954bbd";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -53,6 +53,12 @@ buildNodejs {
 
       # TODO: newer GYP versions have been patched to be more compatible with Nix sandbox. We need
       # to adapt our patch to this newer version, see https://github.com/NixOS/nixpkgs/pull/434742.
+      (fetchpatch2 {
+        url = "https://github.com/nodejs/node/commit/223c5e105d39eed57dd023c3efb129bbde6f5bfb.patch?full_index=1";
+        hash = "sha256-LjRfU83TimLqM5HaWxZxxcKpRShmSaWBckAEILrMlRw=";
+        includes = [ "tools/gyp/pylib/gyp/xcode_emulation.py" ];
+        revert = true;
+      })
       (fetchpatch2 {
         url = "https://github.com/nodejs/node/commit/886e4b3b534a9f3ad2facbc99097419e06615900.patch?full_index=1";
         hash = "sha256-dg/wVkD3iFS7RNjmvMDGw+ONScEjynlkRXqVxdF45TM=";
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 4150a1ecda11..fb4ec8f2ba09 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.12.59";
-      hash = "sha256-IvKN4osLSZmMPeQFUZ05W7YLZYS1HLsxDoAFbi7sxKQ=";
+      version = "6.12.60";
+      hash = "sha256-nS9vsdH76q+uUaWXEp3duikX7osVqv7hjBMFNzdtA7o=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "6.17.9";
-      hash = "sha256-M0M8jEflWgGMSUqQ2oEePISaYR5UIJbGrSmphCTIKYI=";
+      version = "6.17.10";
+      hash = "sha256-Y6WsimtxzT6SutR040tUK+fVNnxnACtiyA3DF+iiPVM=";
     };
   };