diff --git a/aerospike-7.yaml b/aerospike-7.yaml
index 9679dc453d..48d0127abb 100644
--- a/aerospike-7.yaml
+++ b/aerospike-7.yaml
@@ -1,6 +1,6 @@
 package:
   name: aerospike-7
-  version: 7.1.0.4
+  version: 7.1.0.5
   epoch: 0
   description: Aerospike Database Server - flash-optimized, in-memory, nosql database
   copyright:
@@ -27,7 +27,7 @@ pipeline:
     with:
       repository: https://github.com/aerospike/aerospike-server
       tag: ${{package.version}}
-      expected-commit: ee35082b44d9ad8d2f7dee29fde3325330565285
+      expected-commit: 6804834c703b9c64b428b21e48208fabe8a8b7a3
 
   - runs: git submodule update --init
 
diff --git a/aerospike.yaml b/aerospike.yaml
index 7c0cbfe3a9..cb516559ce 100644
--- a/aerospike.yaml
+++ b/aerospike.yaml
@@ -1,6 +1,6 @@
 package:
   name: aerospike
-  version: 6.4.0.21
+  version: 6.4.0.22
   epoch: 0
   description: Aerospike Database Server - flash-optimized, in-memory, nosql database
   copyright:
@@ -27,7 +27,7 @@ pipeline:
     with:
       repository: https://github.com/aerospike/aerospike-server
       tag: ${{package.version}}
-      expected-commit: 484bdc6dcd647ce539953db9e3f55f1ac5cc1037
+      expected-commit: 94479e6e01f7a6beb01616753aa4040cc303d658
 
   - runs: git submodule update --init
 
diff --git a/aws-c-common.yaml b/aws-c-common.yaml
index 69c1df1bc3..8b66617bd0 100644
--- a/aws-c-common.yaml
+++ b/aws-c-common.yaml
@@ -1,6 +1,6 @@
 package:
   name: aws-c-common
-  version: 0.9.26
+  version: 0.9.27
   epoch: 0
   description: Core c99 package for AWS SDK for C including cross-platform primitives, configuration, data structures, and error handling
   copyright:
@@ -19,7 +19,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 8419fe7077778b5ca40e8822f969665bbddc226c
+      expected-commit: 672cc0032eb28d69fbdd22c9463253c89d7a6f30
       repository: https://github.com/awslabs/aws-c-common
       tag: v${{package.version}}
 
diff --git a/aws-cli-v2.yaml b/aws-cli-v2.yaml
index 71d19b2409..392e2bdd2b 100644
--- a/aws-cli-v2.yaml
+++ b/aws-cli-v2.yaml
@@ -2,7 +2,7 @@
 #nolint:documentation
 package:
   name: aws-cli-v2
-  version: 2.17.28
+  version: 2.17.30
   epoch: 0
   description: "Universal Command Line Interface for Amazon Web Services (v2)"
   copyright:
@@ -30,7 +30,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/aws/aws-cli
-      expected-commit: 458138afdb03898bd5883a72152abe2697702e8d
+      expected-commit: 9f15513c705aed2a3a05f5e0e8c193f936ca9a2d
       tag: ${{package.version}}
 
   - runs: |
diff --git a/boost.yaml b/boost.yaml
index f08952ac27..c5d62e50c6 100644
--- a/boost.yaml
+++ b/boost.yaml
@@ -1,6 +1,6 @@
 package:
   name: boost
-  version: 1.85.0
+  version: 1.86.0
   epoch: 0
   description: "A library for interacting with the Linux kernel's Berkeley Packet Filter (BPF) facility from user space"
   copyright:
@@ -58,7 +58,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://boostorg.jfrog.io/artifactory/main/release/${{package.version}}/source/boost_${{vars.mangled-package-version}}.tar.gz
-      expected-sha256: be0d91732d5b0cc6fbb275c7939974457e79b54d6f07ce2e3dfdd68bef883b0b
+      expected-sha256: 2575e74ffc3ef1cd0babac2c1ee8bdb5782a0ee672b1912da40e5b4b591ca01f
 
   # Apply patches to fix build https://github.com/boostorg/bcp/pull/18
   - runs: |
diff --git a/bubblewrap.yaml b/bubblewrap.yaml
index d18776ead7..1a0a92b7f0 100644
--- a/bubblewrap.yaml
+++ b/bubblewrap.yaml
@@ -1,7 +1,7 @@
 package:
   name: bubblewrap
-  version: 0.9.0
-  epoch: 3
+  version: 0.10.0
+  epoch: 0
   description: "Unprivileged sandboxing tool"
   copyright:
     - license: LGPL-2.0-or-later
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/containers/bubblewrap
       tag: v${{package.version}}
-      expected-commit: 8e51677abd7e3338e4952370bf7d902e37d8cbb6
+      expected-commit: dc63ec667e6546f34e0b6c088cdf8ae7c7dea0f3
 
   - runs: |
       meson --prefix=/usr -Drequire_userns=true . output
diff --git a/cilium-1.16.yaml b/cilium-1.16.yaml
index 69d4ef8eb1..3b2f8c5889 100644
--- a/cilium-1.16.yaml
+++ b/cilium-1.16.yaml
@@ -1,8 +1,8 @@
 #nolint:valid-pipeline-git-checkout-commit,valid-pipeline-git-checkout-tag
 package:
   name: cilium-1.16
-  version: 1.16.0
-  epoch: 2
+  version: 1.16.1
+  epoch: 0
   description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane
   copyright:
     - license: Apache-2.0
@@ -68,7 +68,7 @@ pipeline:
     with:
       repository: https://github.com/cilium/cilium
       tag: v${{package.version}}
-      expected-commit: 82999990bc954699cf24853ef9747d9166ee24c8
+      expected-commit: 685790550b375380dd8fac71cc2a37427d78fc40
 
   - uses: go/bump
     with:
diff --git a/cilium-operator-aws.yaml b/cilium-operator-aws.yaml
index 199aad69fe..7f15117566 100644
--- a/cilium-operator-aws.yaml
+++ b/cilium-operator-aws.yaml
@@ -1,7 +1,7 @@
 package:
   name: cilium-operator-aws
-  version: 1.16.0
-  epoch: 2
+  version: 1.16.1
+  epoch: 0
   description: eBPF-based Networking, Security, and Observability
   copyright:
     - license: Apache-2.0
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/cilium/cilium
       tag: v${{package.version}}
-      expected-commit: 82999990bc954699cf24853ef9747d9166ee24c8
+      expected-commit: 685790550b375380dd8fac71cc2a37427d78fc40
 
   - uses: go/bump
     with:
diff --git a/cluster-api-controller.yaml b/cluster-api-controller.yaml
index 6a5384925b..270a344c6c 100644
--- a/cluster-api-controller.yaml
+++ b/cluster-api-controller.yaml
@@ -1,6 +1,6 @@
 package:
   name: cluster-api-controller
-  version: 1.8.0
+  version: 1.8.1
   epoch: 0
   description: Cluster API core controller
   copyright:
@@ -18,7 +18,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 69bbf3530777a81867328c9379b41f814b008cdb
+      expected-commit: 02769254e95db17afbd6ec4036aacbd294d9424c
       repository: https://github.com/kubernetes-sigs/cluster-api
       tag: v${{package.version}}
 
diff --git a/clusterctl.yaml b/clusterctl.yaml
index 4e6d01e44a..107de23ccf 100644
--- a/clusterctl.yaml
+++ b/clusterctl.yaml
@@ -1,6 +1,6 @@
 package:
   name: clusterctl
-  version: 1.8.0
+  version: 1.8.1
   epoch: 0
   description: A command line tool to manage clusters created by cluster API
   copyright:
@@ -23,7 +23,7 @@ pipeline:
     with:
       repository: https://github.com/kubernetes-sigs/cluster-api
       tag: v${{package.version}}
-      expected-commit: 69bbf3530777a81867328c9379b41f814b008cdb
+      expected-commit: 02769254e95db17afbd6ec4036aacbd294d9424c
 
   - uses: go/build
     with:
diff --git a/controller-gen.yaml b/controller-gen.yaml
index 7194d95cec..54509d9ecd 100644
--- a/controller-gen.yaml
+++ b/controller-gen.yaml
@@ -1,7 +1,7 @@
 package:
   name: controller-gen
-  version: 0.15.0
-  epoch: 6
+  version: 0.16.1
+  epoch: 0
   description: Tools to use with the controller-runtime libraries
   copyright:
     - license: Apache-2.0
@@ -20,7 +20,7 @@ pipeline:
     with:
       repository: https://github.com/kubernetes-sigs/controller-tools
       tag: v${{package.version}}
-      expected-commit: 473c02870bcfdc40955b2813ea2c73f0d3a34712
+      expected-commit: 897f14b1882854bbe8adb5cbd69fff4b0cf1e6a9
 
   - uses: go/build
     with:
diff --git a/crun.yaml b/crun.yaml
index 1d884fce86..c3c4442abf 100644
--- a/crun.yaml
+++ b/crun.yaml
@@ -1,6 +1,6 @@
 package:
   name: crun
-  version: "1.16"
+  version: 1.16.1
   epoch: 0
   description: "Fast and lightweight fully featured OCI runtime and C library for running containers"
   copyright:
@@ -26,7 +26,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://github.com/containers/crun/releases/download/${{package.version}}/crun-${{package.version}}.tar.gz
-      expected-sha512: 718e17abdb8c2a9e1fdd39f09e7e3e435d88c5785cc13c1e67f492847d7d938cf399aecc055ecf88720fa8f73b8539f057e3b0e53f10f4e382f5664a2243b959
+      expected-sha512: 5e22d74660e2c36726292c4160b1461782b27805a33ade769854ed42d8fd4027f5f88e646d393337aa785566cd8be3d0e5175da8e146f18232eb772b6034ea69
 
   - runs: |
       ./configure \
diff --git a/dotnet-8.yaml b/dotnet-8.yaml
index 84e8b956d7..a8a0c0c9ca 100644
--- a/dotnet-8.yaml
+++ b/dotnet-8.yaml
@@ -1,6 +1,6 @@
 package:
   name: dotnet-8
-  version: 8.0.7
+  version: 8.0.8
   epoch: 0
   description: ".NET SDK"
   copyright:
@@ -44,7 +44,7 @@ pipeline:
     with:
       repository: https://github.com/dotnet/dotnet
       tag: v${{package.version}}
-      expected-commit: 8be139ddde52d33e24c7d82f813248ff9fc54b97
+      expected-commit: e78e8a64f20e61e1fea4f24afca66ad1dc56285f
       destination: /home/build/src
 
   - working-directory: /home/build/src
diff --git a/enchant2.yaml b/enchant2.yaml
index b1655b4394..f4f1302944 100644
--- a/enchant2.yaml
+++ b/enchant2.yaml
@@ -1,6 +1,6 @@
 package:
   name: enchant2
-  version: 2.8.1
+  version: 2.8.2
   epoch: 0
   description: enchant spellchecking library
   copyright:
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/AbiWord/enchant
       tag: v${{package.version}}
-      expected-commit: 14e820123139e0a68a812f34578d4881fe279ad2
+      expected-commit: 2e2739acea4926ae2584823b5f75480243b191df
 
   - runs: ./bootstrap
 
diff --git a/fluent-bit-3.1.yaml b/fluent-bit-3.1.yaml
index 1fc6b8c67b..a4f1f16233 100644
--- a/fluent-bit-3.1.yaml
+++ b/fluent-bit-3.1.yaml
@@ -1,6 +1,6 @@
 package:
   name: fluent-bit-3.1
-  version: 3.1.5
+  version: 3.1.6
   epoch: 0
   description: Fast and Lightweight Log processor and forwarder
   copyright:
@@ -33,7 +33,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/fluent/fluent-bit
-      expected-commit: bec60340076215ee0908e60231ff361b2abc0c87
+      expected-commit: bda73d88500166a2b8cce95aa0bad9316a9639b9
       tag: v${{package.version}}
 
   - runs: |
diff --git a/fulcio.yaml b/fulcio.yaml
index bcf7a745d4..02583cf824 100644
--- a/fulcio.yaml
+++ b/fulcio.yaml
@@ -1,6 +1,6 @@
 package:
   name: fulcio
-  version: 1.6.0
+  version: 1.6.1
   epoch: 0
   description: Sigstore OIDC PKI
   copyright:
@@ -13,7 +13,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 50dbac4e408b645a0a2b4d087a6519be8f81c119
+      expected-commit: 9fd5c09f0a900aab832c65b7cf632cc49f6f2f08
       repository: https://github.com/sigstore/fulcio
       tag: v${{package.version}}
 
diff --git a/gitaly-17.2.yaml b/gitaly-17.2.yaml
index 41b8de2f2c..18660365aa 100644
--- a/gitaly-17.2.yaml
+++ b/gitaly-17.2.yaml
@@ -1,6 +1,6 @@
 package:
   name: gitaly-17.2
-  version: 17.2.2
+  version: 17.3.0
   epoch: 0
   description:
   copyright:
@@ -36,11 +36,7 @@ pipeline:
     with:
       repository: https://gitlab.com/gitlab-org/gitaly.git
       tag: v${{package.version}}
-      expected-commit: f361b25764d8001ad58f2b64c2fe8bbc898870df
-
-  - uses: go/bump
-    with:
-      deps: google.golang.org/grpc@v1.64.1
+      expected-commit: 6a0065b3fad38618a7afc98edb528f286bccb067
 
   - runs: |
       make install DESTDIR="${{targets.destdir}}" PREFIX=/usr
diff --git a/go-1.23.yaml b/go-1.23.yaml
new file mode 100644
index 0000000000..ec0e7633af
--- /dev/null
+++ b/go-1.23.yaml
@@ -0,0 +1,146 @@
+package:
+  name: go-1.23
+  version: 1.23.0
+  epoch: 0
+  description: "the Go programming language"
+  copyright:
+    - license: BSD-3-Clause
+  dependencies:
+    provides:
+      - go=${{package.full-version}}
+      - go-bootstrap=1.23
+    runtime:
+      - bash
+      - binutils-gold # Needed for cgo linking due to upstream issue #15696 which forces use of the gold linker.
+      - build-base
+
+environment:
+  contents:
+    packages:
+      - bash
+      - build-base
+      - busybox
+      - ca-certificates-bundle
+      - go-bootstrap~1.22
+
+# transform melange version to contain "+" rather than third "." so we can use a var in the fetch URL
+var-transforms:
+  - from: ${{package.version}}
+    match: \_
+    replace: ""
+    to: mangled-package-version
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/golang/go
+      tag: go${{package.version}}
+      expected-commit: 6885bad7dd86880be6929c02085e5c7a67ff2887
+
+  - uses: patch
+    with:
+      patches: cmd-go-always-emit-ldflags-version-information.patch
+
+  - runs: |
+      cd src
+      ./make.bash -v
+
+  - runs: |
+      mkdir -p "${{targets.destdir}}"/usr/bin "${{targets.destdir}}"/usr/lib/go/bin "${{targets.destdir}}"/usr/share/doc/go
+
+      for bin in go gofmt; do
+        install -Dm755 bin/$bin "${{targets.destdir}}"/usr/lib/go/bin/$bin
+        ln -s /usr/lib/go/bin/$bin "${{targets.destdir}}"/usr/bin/
+      done
+
+      cp -a pkg lib "${{targets.destdir}}"/usr/lib/go/
+      cp -r doc misc "${{targets.destdir}}"/usr/share/doc/go
+      cp -a src "${{targets.destdir}}"/usr/lib/go/
+      cp -p go.env "${{targets.destdir}}"/usr/lib/go/go.env
+
+      rm -rf "${{targets.destdir}}"/usr/lib/go/pkg/obj
+      rm -rf "${{targets.destdir}}"/usr/lib/go/pkg/bootstrap
+      rm -rf "${{targets.destdir}}"/usr/lib/go/pkg/tool/*/api
+      rm -rf "${{targets.destdir}}"/usr/lib/go/pkg/*/cmd
+      rm -rf "${{targets.destdir}}"/usr/lib/go/pkg/tool/*/api
+      rm -rf "${{targets.destdir}}"/usr/lib/go/pkg/tool/*/go_bootstrap
+      rm -rf "${{targets.destdir}}"/usr/lib/go/src/cmd/dist/dist
+
+      # Remove tests from /usr/lib/go/src, not needed at runtime
+      find "${{targets.destdir}}"/usr/lib/go/src \( -type f -a -name "*_test.go" \) \
+        -exec rm -rf \{\} \+
+      find "${{targets.destdir}}"/usr/lib/go/src \( -type d -a -name "testdata" \) \
+        -exec rm -rf \{\} \+
+      find "${{targets.destdir}}"/usr/lib/go/src \( -type f -a -name "*.rc" \) \
+        -exec rm -rf \{\} \+
+      find "${{targets.destdir}}"/usr/lib/go/src \( -type f -a -name "*.bat" \) \
+        -exec rm -rf \{\} \+
+      find "${{targets.destdir}}"/usr/lib/go/src \( -type f -a -name "*.pem" \) \
+        -exec rm -rf \{\} \+
+
+  - uses: strip
+
+subpackages:
+  - name: "${{package.name}}-doc"
+    description: "go documentation"
+    pipeline:
+      - runs: |
+          mkdir -p "${{targets.subpkgdir}}"/usr/share
+          mv "${{targets.destdir}}"/usr/share/doc "${{targets.subpkgdir}}"/usr/share/
+
+update:
+  enabled: true
+  shared: true
+  github:
+    identifier: golang/go
+    strip-prefix: go
+    tag-filter: go1.23
+    use-tag: true
+
+test:
+  environment:
+    contents:
+      packages:
+        - build-base
+  pipeline:
+    - name: Test Go installation
+      runs: |
+        # Write a simple "Hello World" Go program
+        cat <<EOF > hello.go
+        package main
+        import "fmt"
+        func main() {
+            fmt.Println("Hello World")
+        }
+        EOF
+
+        # Format the Go program
+        go fmt hello.go
+
+        # Run the Go program and check the output
+        go run hello.go | grep "Hello World"
+    - name: Test Go cross-compilation
+      runs: |
+        # Build the Go program for a different OS/architecture
+        GOOS=freebsd GOARCH=amd64 go build hello.go
+    - name: Test Go with cgo
+      runs: |
+        # Write a Go program that uses cgo
+        cat <<EOF > hello_cgo.go
+        package main
+        /*
+        #include <stdlib.h>
+        #include <stdio.h>
+        void hello() {
+            printf("%s\\n", "Hello from cgo!");
+            fflush(stdout);
+        }
+        */
+        import "C"
+        func main() {
+            C.hello()
+        }
+        EOF
+
+        # Run the Go program with cgo and check the output
+        go run hello_cgo.go | grep "Hello from cgo!"
diff --git a/go-1.23/cmd-go-always-emit-ldflags-version-information.patch b/go-1.23/cmd-go-always-emit-ldflags-version-information.patch
new file mode 100644
index 0000000000..8d69253fe1
--- /dev/null
+++ b/go-1.23/cmd-go-always-emit-ldflags-version-information.patch
@@ -0,0 +1,35 @@
+From b9f7deea41be0adeff7eee35f29ee096b9f2ff20 Mon Sep 17 00:00:00 2001
+From: Dimitri John Ledkov <dimitri.ledkov@chainguard.dev>
+Date: Thu, 2 May 2024 18:16:47 +0100
+Subject: [PATCH] cmd/go: always emit ldflags version information
+
+Even when -trimpath is active, emit full ldflags in the version
+information ELF note. Vulnerability scanners typically parse ldflags
+field to detect main package version, thus binaries that are built
+with -trimpath are currently actively evading vulnerability scanners.
+
+Fixes: https://github.com/golang/go/issues/63432
+
+Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@chainguard.dev>
+---
+ src/cmd/go/internal/load/pkg.go | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go
+index 1549800afb..010d60a9d1 100644
+--- a/src/cmd/go/internal/load/pkg.go
++++ b/src/cmd/go/internal/load/pkg.go
+@@ -2393,9 +2393,7 @@ func (p *Package) setBuildInfo(ctx context.Context, autoVCS bool) {
+ 		// determine whether they may refer to system paths. If we do that, we can
+ 		// redact only those paths from the recorded -ldflags setting and still
+ 		// record the system-independent parts of the flags.
+-		if !cfg.BuildTrimpath {
+-			appendSetting("-ldflags", ldflags)
+-		}
++		appendSetting("-ldflags", ldflags)
+ 	}
+ 	if cfg.BuildMSan {
+ 		appendSetting("-msan", "true")
+-- 
+2.43.0
+
diff --git a/golangci-lint.yaml b/golangci-lint.yaml
index fb05241a95..dee12198ae 100644
--- a/golangci-lint.yaml
+++ b/golangci-lint.yaml
@@ -1,7 +1,7 @@
 package:
   name: golangci-lint
-  version: 1.59.1
-  epoch: 1
+  version: 1.60.1
+  epoch: 0
   description: Fast linters Runner for Go
   copyright:
     - license: Apache-2.0
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/golangci/golangci-lint
       tag: v${{package.version}}
-      expected-commit: 1a55854aff4ef60cd8c4e709b650b281303ca7aa
+      expected-commit: 3298c104802d118670a487b330ddd3761f7afe20
 
   - runs: |
       make build
diff --git a/gradle-8.yaml b/gradle-8.yaml
index 01a7bc4c2f..f7163a3d34 100644
--- a/gradle-8.yaml
+++ b/gradle-8.yaml
@@ -1,6 +1,6 @@
 package:
   name: gradle-8
-  version: 8.9.0
+  version: 8.10.0
   # For version upgrades check whether patches are still needed.
   # Upstream changes are being tracked in https://github.com/gradle/gradle/issues/25945
   epoch: 0
@@ -35,7 +35,7 @@ pipeline:
     with:
       repository: https://github.com/gradle/gradle
       tag: v${{package.version}}
-      expected-commit: d536ef36a19186ccc596d8817123e5445f30fef8
+      expected-commit: fef2edbed8af1022cefaf44d4c0514c5f89d7b78
 
   - uses: patch
     with:
diff --git a/grafana-11.1.yaml b/grafana-11.1.yaml
index 893d2978c5..b0331b8e60 100644
--- a/grafana-11.1.yaml
+++ b/grafana-11.1.yaml
@@ -1,6 +1,6 @@
 package:
   name: grafana-11.1
-  version: 11.1.3
+  version: 11.1.4
   epoch: 0
   description: The open and composable observability and data visualization platform.
   copyright:
@@ -27,7 +27,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 9cdba084a9100c6b11d32eef9d2bd53656c6964a
+      expected-commit: 2355de00c61fdd6609a67f35ab506fae87f09a84
       repository: https://github.com/grafana/grafana
       tag: v${{package.version}}
 
diff --git a/helm.yaml b/helm.yaml
index 27bf9d488a..de6db9f0c2 100644
--- a/helm.yaml
+++ b/helm.yaml
@@ -1,7 +1,7 @@
 package:
   name: helm
-  version: 3.15.3
-  epoch: 2
+  version: 3.15.4
+  epoch: 0
   description: The Kubernetes Package Manager
   copyright:
     - license: Apache-2.0
@@ -23,7 +23,7 @@ pipeline:
     with:
       repository: https://github.com/helm/helm
       tag: v${{package.version}}
-      expected-commit: 3bb50bbbdd9c946ba9989fbe4fb4104766302a64
+      expected-commit: fa9efb07d9d8debbb4306d72af76a383895aa8c4
 
   - uses: go/bump
     with:
diff --git a/hugo-extended.yaml b/hugo-extended.yaml
index 52b6fa7d34..478d1bfa77 100644
--- a/hugo-extended.yaml
+++ b/hugo-extended.yaml
@@ -1,6 +1,6 @@
 package:
   name: hugo-extended
-  version: 0.132.1
+  version: 0.132.2
   epoch: 0
   description: The world's fastest framework for building websites.
   copyright:
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/gohugoio/hugo
       tag: v${{package.version}}
-      expected-commit: 1bde700dfc0770bb11eb8445aff1ab5abdccb46e
+      expected-commit: 3fd26c70dff5934ec1802b9563530130ed1bca75
 
   - uses: go/build
     with:
diff --git a/hugo.yaml b/hugo.yaml
index 4c5d61a414..800178f8b4 100644
--- a/hugo.yaml
+++ b/hugo.yaml
@@ -1,6 +1,6 @@
 package:
   name: hugo
-  version: 0.132.1
+  version: 0.132.2
   epoch: 0
   description: The world's fastest framework for building websites.
   copyright:
@@ -18,7 +18,7 @@ pipeline:
     with:
       repository: https://github.com/gohugoio/hugo
       tag: v${{package.version}}
-      expected-commit: 1bde700dfc0770bb11eb8445aff1ab5abdccb46e
+      expected-commit: 3fd26c70dff5934ec1802b9563530130ed1bca75
 
   - uses: go/build
     with:
diff --git a/karpenter.yaml b/karpenter.yaml
index b3c032eb25..dbd2e1f9cf 100644
--- a/karpenter.yaml
+++ b/karpenter.yaml
@@ -1,7 +1,7 @@
 package:
   name: karpenter
-  version: 0.37.0
-  epoch: 2
+  version: 1.0.0
+  epoch: 0
   description: Karpenter is a Kubernetes Node Autoscaler built for flexibility, performance, and simplicity.
   copyright:
     - license: Apache-2.0
@@ -13,7 +13,7 @@ pipeline:
     with:
       repository: https://github.com/aws/karpenter
       tag: v${{package.version}}
-      expected-commit: 490ef94addbaf7848c12c16d53dc6422424d5a3f
+      expected-commit: 5bdf9c3a9d6b01dc6934c3807dfa69160d411131
 
   - uses: go/build
     with:
diff --git a/kmod.yaml b/kmod.yaml
index 38bd097aab..c3e5d5fca9 100644
--- a/kmod.yaml
+++ b/kmod.yaml
@@ -1,7 +1,7 @@
 package:
   name: kmod
-  version: "32"
-  epoch: 3
+  version: "33"
+  epoch: 0
   description: Linux kernel module management utilities
   copyright:
     - license: GPL-2.0-or-later
@@ -19,6 +19,7 @@ environment:
       - libxslt
       - openssl-dev
       - pkgconf-dev
+      - scdoc
       - sed
       - tree
       - xz-dev
@@ -30,7 +31,7 @@ pipeline:
     with:
       repository: https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git
       tag: v${{package.version}}
-      expected-commit: af14bd8afa15e3a348b50352816517a07e315117
+      expected-commit: e193aeb99a04fb4b63ce47eb2c7f119db59446a0
 
   - runs: |
       ./autogen.sh
diff --git a/kubeadm-bootstrap-controller.yaml b/kubeadm-bootstrap-controller.yaml
index c3945c2969..79c8e7d18a 100644
--- a/kubeadm-bootstrap-controller.yaml
+++ b/kubeadm-bootstrap-controller.yaml
@@ -1,6 +1,6 @@
 package:
   name: kubeadm-bootstrap-controller
-  version: 1.8.0
+  version: 1.8.1
   epoch: 0
   description: Cluster API kubeadm bootstrap controller
   copyright:
@@ -18,7 +18,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 69bbf3530777a81867328c9379b41f814b008cdb
+      expected-commit: 02769254e95db17afbd6ec4036aacbd294d9424c
       repository: https://github.com/kubernetes-sigs/cluster-api
       tag: v${{package.version}}
 
diff --git a/kubeadm-controlplane-controller.yaml b/kubeadm-controlplane-controller.yaml
index 696411a5b0..7d72768b50 100644
--- a/kubeadm-controlplane-controller.yaml
+++ b/kubeadm-controlplane-controller.yaml
@@ -1,6 +1,6 @@
 package:
   name: kubeadm-controlplane-controller
-  version: 1.8.0
+  version: 1.8.1
   epoch: 0
   description: Cluster API kubeadm controlplane controller
   copyright:
@@ -18,7 +18,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 69bbf3530777a81867328c9379b41f814b008cdb
+      expected-commit: 02769254e95db17afbd6ec4036aacbd294d9424c
       repository: https://github.com/kubernetes-sigs/cluster-api
       tag: v${{package.version}}
 
diff --git a/linkerd2-proxy.yaml b/linkerd2-proxy.yaml
index d4f0df6cad..ea1906f944 100644
--- a/linkerd2-proxy.yaml
+++ b/linkerd2-proxy.yaml
@@ -1,6 +1,6 @@
 package:
   name: linkerd2-proxy
-  version: 2.247.0
+  version: 2.248.0
   epoch: 0
   description: "A program that validates linkerd networks"
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/linkerd/linkerd2-proxy
       tag: release/v${{package.version}}
-      expected-commit: 83f2c5f7ac1f7bf38b5a644ddaf384a1b1dc13e2
+      expected-commit: 02ce037bd5fa424a77bb85c1f56e7f78e15b332b
 
   - runs: |
       cargo fetch
diff --git a/minio-operator.yaml b/minio-operator.yaml
new file mode 100644
index 0000000000..91de5cdb06
--- /dev/null
+++ b/minio-operator.yaml
@@ -0,0 +1,59 @@
+package:
+  name: minio-operator
+  version: 6.0.2
+  epoch: 0
+  description: Minio Operator creates/configures/manages Minio on Kubernetes
+  copyright:
+    - license: AGPL-3.0-only
+
+environment:
+  contents:
+    packages:
+      - bash
+      - build-base
+      - ca-certificates-bundle
+      - go
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/minio/operator
+      tag: v${{package.version}}
+      expected-commit: 15c388bd4ce0a03084f1b3762f16a65679b83423
+
+  - uses: go/bump
+    with:
+      deps: github.com/docker/docker@v27.1.1
+      modroot: .
+
+  - uses: go/build
+    with:
+      modroot: ./cmd/operator
+      packages: .
+      output: minio-operator
+      ldflags: -s -w -X github.com/minio/operator/pkg.ReleaseTag=${{package.full-version}} -X github.com/minio/operator/pkg.Version=${{package.full-version}} -X github.com/minio/operator/pkg.ShortCommitID=$(git rev-parse HEAD)
+
+  - uses: strip
+
+  - runs: |
+      mkdir ${{targets.destdir}}/licenses
+      cp CREDITS LICENSE ${{targets.destdir}}/licenses/
+
+subpackages:
+  - name: ${{package.name}}-compat
+    description: compatibility symlinks package for minio-operator Dockerfile
+    pipeline:
+      - runs: |
+          mkdir -p ${{targets.contextdir}}/
+          ln -sf /usr/bin/minio-operator ${{targets.contextdir}}/minio-operator
+
+update:
+  enabled: true
+  github:
+    identifier: minio/operator
+    strip-prefix: v
+
+# comprehensive test with kwok and minio's kustomize want ephemeral storage, so just check version here
+test:
+  pipeline:
+    - runs: minio-operator --version
diff --git a/nginx-mainline.yaml b/nginx-mainline.yaml
index 2ffbbfde6a..e03828ea8a 100644
--- a/nginx-mainline.yaml
+++ b/nginx-mainline.yaml
@@ -1,7 +1,7 @@
 package:
   name: nginx-mainline
-  version: 1.27.0
-  epoch: 7
+  version: 1.27.1
+  epoch: 0
   description: HTTP and reverse proxy server (mainline version)
   copyright:
     - license: BSD-2-Clause
@@ -53,7 +53,7 @@ pipeline:
     with:
       repository: https://github.com/nginx/nginx.git
       tag: release-${{package.version}}
-      expected-commit: 0ddcae05b6725f78352d7cbe4ba441d9a411e2cf
+      expected-commit: e06bdbd4a20912c5223d7c6c6e2b3f0d6086c928
       destination: nginx-mainline
   - name: configure
     working-directory: nginx-mainline
diff --git a/nginx-stable.yaml b/nginx-stable.yaml
index 4836560146..53e7724b2a 100644
--- a/nginx-stable.yaml
+++ b/nginx-stable.yaml
@@ -1,7 +1,7 @@
 package:
   name: nginx-stable
-  version: 1.26.1
-  epoch: 7
+  version: 1.26.2
+  epoch: 0
   description: HTTP and reverse proxy server (stable version)
   copyright:
     - license: BSD-2-Clause
@@ -53,7 +53,7 @@ pipeline:
     with:
       repository: https://github.com/nginx/nginx.git
       tag: release-${{package.version}}
-      expected-commit: 02725ce722bc7b34fa307d611eac3956ef744efa
+      expected-commit: 37fe98355461d2f03d73e6a8e82ac4e4cd85d711
       destination: nginx-stable
   - name: configure
     working-directory: nginx-stable
diff --git a/ollama.yaml b/ollama.yaml
index 52ba9c07c1..dc9dc8a328 100644
--- a/ollama.yaml
+++ b/ollama.yaml
@@ -1,6 +1,6 @@
 package:
   name: ollama
-  version: 0.3.5
+  version: 0.3.6
   epoch: 0
   description: Get up and running with Llama 2 and other large language models locally
   copyright:
@@ -20,7 +20,7 @@ pipeline:
     with:
       repository: https://github.com/ollama/ollama
       tag: v${{package.version}}
-      expected-commit: 15c2d8fe149ba2b58aadbab615a6955f8821c7a9
+      expected-commit: 4c4fe3f87fe1858b35bd0d41e093a0039ec4cee4
 
   - runs: |
       go generate ./...
diff --git a/perl-test-simple.yaml b/perl-test-simple.yaml
index 43c83aaab6..0a34c06b04 100644
--- a/perl-test-simple.yaml
+++ b/perl-test-simple.yaml
@@ -1,7 +1,7 @@
 package:
   name: perl-test-simple
-  version: "1.302200"
-  epoch: 1
+  version: "1.302201"
+  epoch: 0
   description: Basic utilities for writing tests
   copyright:
     - license: GPL-1.0-or-later OR Artistic-1.0-Perl
@@ -24,7 +24,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha512: bda19f34abc7b5444225fb2fadfaa5f763e2b2129d1e7da82b210ef08e116f59e6127a9dc5876ea9c473997776e1752417c2fdecd8837e84d25ffd76afdb1127
+      expected-sha512: c767be05b62ff100b02ffcf2aebd715f82d88d5e7aebfbbff6c13b9805e285c1d94f91356e16fe57fb71566392de9f3b2c3f007e61f771f700a7b81d7a51dfda
       uri: https://cpan.metacpan.org/authors/id/E/EX/EXODIST/Test-Simple-${{package.version}}.tar.gz
 
   - uses: perl/make
diff --git a/pnpm.yaml b/pnpm.yaml
index ecf08de695..9880dd1971 100644
--- a/pnpm.yaml
+++ b/pnpm.yaml
@@ -1,6 +1,6 @@
 package:
   name: pnpm
-  version: 9.7.0
+  version: 9.7.1
   epoch: 0
   description: "Fast, disk space efficient package manager"
   copyright:
@@ -29,7 +29,7 @@ pipeline:
     with:
       repository: https://github.com/pnpm/pnpm
       tag: v${{package.version}}
-      expected-commit: 2d3a119bb4bd77db3d5b51efd6734bdbc82eb732
+      expected-commit: 56861a569a40cfdf6188fedfc44510c155af88d8
 
   - name: "Update pnpm version in package.json"
     runs: |
diff --git a/prometheus-2.54.yaml b/prometheus-2.54.yaml
index 5efbe12641..e5bf16d3a5 100644
--- a/prometheus-2.54.yaml
+++ b/prometheus-2.54.yaml
@@ -1,7 +1,7 @@
 package:
   name: prometheus-2.54
   version: 2.54.0
-  epoch: 1
+  epoch: 2
   description: The Prometheus monitoring system and time series database.
   copyright:
     - license: Apache-2.0
@@ -22,13 +22,13 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 4b67196da9733b25d01eeeae38187c6299e6fe82
+      expected-commit: 5354e87a70d3eb26b81b601b286d66ff983990f6
       repository: https://github.com/prometheus/prometheus
       tag: v${{package.version}}
 
   - uses: go/bump
     with:
-      deps: github.com/hashicorp/go-retryablehttp@v0.7.7 github.com/docker/docker@v27.1.1
+      deps: github.com/docker/docker@v27.1.1
 
   - runs: |
       GOLDFLAGS="-s -w -X github.com/prometheus/common/version.Version=${{package.version}}
diff --git a/prometheus-operator.yaml b/prometheus-operator.yaml
index 1611bda97f..5f5fa5b383 100644
--- a/prometheus-operator.yaml
+++ b/prometheus-operator.yaml
@@ -1,6 +1,6 @@
 package:
   name: prometheus-operator
-  version: 0.75.2
+  version: 0.76.0
   epoch: 0
   description: Prometheus Operator creates/configures/manages Prometheus clusters atop Kubernetes
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/prometheus-operator/prometheus-operator.git
       tag: v${{package.version}}
-      expected-commit: 35b0f457d8f705f1ac8282b4e22caa68a19c6c43
+      expected-commit: 022a289433e9e1a9a9c6ea161c6b87b7db801212
 
   - uses: autoconf/make
     with:
diff --git a/py3-boto3.yaml b/py3-boto3.yaml
index abcc0b45e4..e42b33c438 100644
--- a/py3-boto3.yaml
+++ b/py3-boto3.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/boto3/
 package:
   name: py3-boto3
-  version: 1.34.159
+  version: 1.34.161
   epoch: 0
   description: The AWS SDK for Python
   copyright:
@@ -25,7 +25,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: ffe7bbb88ba81b5d54bc8fa0cfb2f3b7fe63a6cffa0f9207df2ef5c22a1c0587
+      expected-sha256: a872d8fdb3203c1eb0b12fa9e9d879e6f7fd02983a485f02189e6d5914ccd834
       uri: https://files.pythonhosted.org/packages/source/b/boto3/boto3-${{package.version}}.tar.gz
 
   - name: Python Build
diff --git a/py3-botocore.yaml b/py3-botocore.yaml
index 8d8f876c84..06c5173018 100644
--- a/py3-botocore.yaml
+++ b/py3-botocore.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-botocore
-  version: 1.34.159
+  version: 1.34.161
   epoch: 0
   description: The low-level, core functionality of Boto3
   copyright:
@@ -26,7 +26,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://files.pythonhosted.org/packages/source/b/botocore/botocore-${{package.version}}.tar.gz
-      expected-sha256: dc28806eb21e3c8d690c422530dff8b4b242ac033cbe98f160a9d37796c09cb1
+      expected-sha256: 16381bfb786142099abf170ce734b95a402a3a7f8e4016358712ac333c5568b2
 
   - runs: |
       python3 setup.py build
diff --git a/py3-google-api-python-client.yaml b/py3-google-api-python-client.yaml
index be88b3c2ea..5eca1610d7 100644
--- a/py3-google-api-python-client.yaml
+++ b/py3-google-api-python-client.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/google-api-python-client/
 package:
   name: py3-google-api-python-client
-  version: 2.140.0
+  version: 2.141.0
   epoch: 0
   description: Google API Client Library for Python
   copyright:
@@ -28,7 +28,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 3427189dfd410694b8590c7ada89b2f9dc41bce5
+      expected-commit: dc825d5fb12ce91ea712d554c0014dd07d2f8022
       repository: https://github.com/googleapis/google-api-python-client
       tag: v${{package.version}}
 
diff --git a/py3-google-auth.yaml b/py3-google-auth.yaml
index 1156d8a9c3..995d1d0549 100644
--- a/py3-google-auth.yaml
+++ b/py3-google-auth.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-google-auth
-  version: 2.33.0
+  version: 2.34.0
   epoch: 0
   description: Google Authentication Library
   copyright:
@@ -29,7 +29,7 @@ pipeline:
     with:
       repository: https://github.com/googleapis/google-auth-library-python
       tag: v${{package.version}}
-      expected-commit: 5030b822368881cde2f47b0f8909dbac5e5a3b50
+      expected-commit: c6d99030b8d972105913006bd052cf762b94a976
 
   - name: Python Build
     runs: python setup.py build
diff --git a/py3-google-cloud-datastore.yaml b/py3-google-cloud-datastore.yaml
index 4b6510f105..6e0115396a 100644
--- a/py3-google-cloud-datastore.yaml
+++ b/py3-google-cloud-datastore.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/google-cloud-datastore/
 package:
   name: py3-google-cloud-datastore
-  version: 2.20.0
+  version: 2.20.1
   epoch: 0
   description: Google Cloud Datastore API client library
   copyright:
@@ -27,7 +27,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 66c5958a19c7ecb74378b118ee89e61c60f217ae
+      expected-commit: fe5e38c632c9c722443820560b14c39300001b12
       repository: https://github.com/googleapis/python-datastore
       tag: v${{package.version}}
 
diff --git a/py3-importlib-resources.yaml b/py3-importlib-resources.yaml
index 282d087c86..74e22b1869 100644
--- a/py3-importlib-resources.yaml
+++ b/py3-importlib-resources.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-importlib-resources
-  version: 6.4.0
-  epoch: 4
+  version: 6.4.2
+  epoch: 0
   description: Read resources from Python packages
   copyright:
     - license: MIT
@@ -33,7 +33,7 @@ pipeline:
     with:
       repository: https://github.com/python/importlib_resources
       tag: v${{package.version}}
-      expected-commit: 1f4d3f10a3ed5d65b3092a39369c08e71e30a97c
+      expected-commit: 509cabd46b54f5f6e372d923039c2bff8fff7d94
 
 subpackages:
   - range: py-versions
diff --git a/py3-pybind11.yaml b/py3-pybind11.yaml
index 8b9689ad6a..8a54bb0d5b 100644
--- a/py3-pybind11.yaml
+++ b/py3-pybind11.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-pybind11
-  version: 2.13.2
+  version: 2.13.3
   epoch: 0
   description: Seamless operability between C++11 and Python
   copyright:
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/pybind/pybind11
       tag: v${{package.version}}
-      expected-commit: 07f30430d4186c2712761f1ffaea50ede63f2b2b
+      expected-commit: bd67643652d3800837f1f41549a2a5adbaa3fafe
 
   - name: Python Build
     runs: python setup.py build
diff --git a/py3-pywin32-ctypes.yaml b/py3-pywin32-ctypes.yaml
index aba29724ec..fd8282af99 100644
--- a/py3-pywin32-ctypes.yaml
+++ b/py3-pywin32-ctypes.yaml
@@ -1,8 +1,8 @@
 # Generated from https://pypi.org/project/pywin32-ctypes/
 package:
   name: py3-pywin32-ctypes
-  version: 0.2.2
-  epoch: 4
+  version: 0.2.3
+  epoch: 0
   description: A (partial) reimplementation of pywin32 using ctypes/cffi
   copyright:
     - license: BSD-3-Clause
@@ -25,7 +25,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 5ea9c2696d1e243a6a26f5b0a9643e333d8985ff
+      expected-commit: 30d3d1345d22a0a1ccab86ceae5d25e438897077
       repository: https://github.com/enthought/pywin32-ctypes
       tag: v${{package.version}}
 
diff --git a/py3-setuptools-wheel.yaml b/py3-setuptools-wheel.yaml
index 29a9cf40aa..1966095fd9 100644
--- a/py3-setuptools-wheel.yaml
+++ b/py3-setuptools-wheel.yaml
@@ -4,7 +4,7 @@
 # python is compiled with --with-wheel-pkg-dir=/usr/share/python-wheels
 package:
   name: py3-setuptools-wheel
-  version: "72.1.0"
+  version: 72.2.0
   epoch: 0
   description: "python3 setuptools wheel from pypi"
   copyright:
@@ -19,7 +19,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://files.pythonhosted.org/packages/py3/s/setuptools/setuptools-${{package.version}}-py3-none-any.whl
-      expected-sha256: 5a03e1860cf56bb6ef48ce186b0e557fdba433237481a9a625176c2831be15d1
+      expected-sha256: f11dd94b7bae3a156a95ec151f24e4637fb4fa19c878e4d191bfb8b2d82728c4
       extract: false
 
   - name: Install wheel
diff --git a/py3-simplejson.yaml b/py3-simplejson.yaml
index 855b8a5fea..fa40acc160 100644
--- a/py3-simplejson.yaml
+++ b/py3-simplejson.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-simplejson
-  version: 3.19.2
-  epoch: 2
+  version: 3.19.3
+  epoch: 0
   description: Simple, fast, extensible JSON encoder/decoder for Python
   copyright:
     - license: MIT
@@ -20,7 +20,7 @@ pipeline:
     with:
       repository: https://github.com/simplejson/simplejson
       tag: v${{package.version}}
-      expected-commit: 532f41f870f6287ffe73882a313c2cc9c70f3cb6
+      expected-commit: 6932004966ab70ef47250a2b3152acd8c904e6b5
 
   - name: Python Build
     uses: python/build-wheel
diff --git a/py3-sqlglot.yaml b/py3-sqlglot.yaml
index 8800121b8a..723c124601 100644
--- a/py3-sqlglot.yaml
+++ b/py3-sqlglot.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/sqlglot/
 package:
   name: py3-sqlglot
-  version: 25.11.0
+  version: 25.11.3
   epoch: 0
   description: An easily customizable SQL parser and transpiler
   copyright:
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/tobymao/sqlglot
       tag: v${{package.version}}
-      expected-commit: bea3c08e46a020d8545b702c77f0db18c99f1c55
+      expected-commit: 57f7aa9108ed38c0e83ef5bf4fac900434fac777
 
   - name: Python Build
     runs: python setup.py build
diff --git a/py3-tomlkit.yaml b/py3-tomlkit.yaml
index 4321631c15..e84a255713 100644
--- a/py3-tomlkit.yaml
+++ b/py3-tomlkit.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/tomlkit/
 package:
   name: py3-tomlkit
-  version: 0.13.0
+  version: 0.13.2
   epoch: 0
   description: Style preserving TOML library
   copyright:
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/sdispater/tomlkit
       tag: ${{package.version}}
-      expected-commit: 4d06dff4bc4a1cc16e0f600f71df8f41724efcec
+      expected-commit: e6e5d3803ba2942c5e19e3c083d289009c27338c
 
   - name: Python Build
     runs: |
diff --git a/renovate.yaml b/renovate.yaml
index 5df8418866..2edf06636f 100644
--- a/renovate.yaml
+++ b/renovate.yaml
@@ -1,6 +1,6 @@
 package:
   name: renovate
-  version: 38.27.0
+  version: 38.32.0
   epoch: 0
   description: "Automated dependency updates. Multi-platform and multi-language."
   copyright:
diff --git a/rqlite.yaml b/rqlite.yaml
index e9f6b83736..acda2b6bab 100644
--- a/rqlite.yaml
+++ b/rqlite.yaml
@@ -1,6 +1,6 @@
 package:
   name: rqlite
-  version: 8.28.0
+  version: 8.28.1
   epoch: 0
   description: The lightweight, distributed relational database built on SQLite
   copyright:
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/rqlite/rqlite
       tag: v${{package.version}}
-      expected-commit: 4e25e80a94fe996434072b5eaae7b81b4fe61057
+      expected-commit: 2a685d1cf41fd7ad03907b83a184b357d6ce5b24
 
   - uses: patch
     with:
diff --git a/ruby3.2-async-http.yaml b/ruby3.2-async-http.yaml
index cec26d1c0d..c7ab809f24 100644
--- a/ruby3.2-async-http.yaml
+++ b/ruby3.2-async-http.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.2-async-http
-  version: 0.69.0
+  version: 0.70.0
   epoch: 0
   description: A HTTP client and server library.
   copyright:
@@ -32,7 +32,7 @@ vars:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 6a10cc4b4725bdb4bdeb1021d490bad1e1543ecc
+      expected-commit: d61fb8f5032ee3ca539179ce3d8e05f2998d60f8
       repository: https://github.com/socketry/async-http
       tag: v${{package.version}}
 
diff --git a/terraform-provider-google.yaml b/terraform-provider-google.yaml
index 0ae4a90f66..3ec3fa66d4 100644
--- a/terraform-provider-google.yaml
+++ b/terraform-provider-google.yaml
@@ -1,6 +1,6 @@
 package:
   name: terraform-provider-google
-  version: 5.40.0
+  version: 5.41.0
   epoch: 0
   description: Terraform GCP provider
   copyright:
@@ -16,7 +16,7 @@ pipeline:
     with:
       repository: https://github.com/hashicorp/terraform-provider-google
       tag: v${{package.version}}
-      expected-commit: 7ed1a156da8faf83fbd3e67681bd50c6f044de4b
+      expected-commit: 6523d841a45fecff37500777084044f37a3e937c
 
   - uses: go/build
     with:
diff --git a/uv.yaml b/uv.yaml
index 78c8e12e40..0b5f091ad1 100644
--- a/uv.yaml
+++ b/uv.yaml
@@ -1,6 +1,6 @@
 package:
   name: uv
-  version: 0.2.35
+  version: 0.2.36
   epoch: 0
   description: An extremely fast Python package installer and resolver, written in Rust.
   copyright:
@@ -23,7 +23,7 @@ pipeline:
     with:
       repository: https://github.com/astral-sh/uv
       tag: ${{package.version}}
-      expected-commit: e097f948c9eca7fb09948d73ac03248363c8ce7a
+      expected-commit: 8d66718077f40d1db9c1f94a14616fd73e012aa3
 
   - runs: |
       cargo auditable build --locked --release
diff --git a/vim.yaml b/vim.yaml
index 36b6674b97..54ea784d74 100644
--- a/vim.yaml
+++ b/vim.yaml
@@ -1,6 +1,6 @@
 package:
   name: vim
-  version: 9.1.0669
+  version: 9.1.0675
   epoch: 0
   description: "Improved vi-style text editor"
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/vim/vim
       tag: v${{package.version}}
-      expected-commit: 1c032e36a689932e58a2b3f0b0c890c773ca00d8
+      expected-commit: ded1677dd20ae795fadc8d6f3c01f012b1338fe1
 
   - runs: |
       # vim seems to manually set FORTIFY_SOURCE=1, and setting both breaks the build
diff --git a/vt-cli.yaml b/vt-cli.yaml
index a2f641c6d8..c38e482a1b 100644
--- a/vt-cli.yaml
+++ b/vt-cli.yaml
@@ -1,7 +1,7 @@
 package:
   name: vt-cli
   version: 1.0.1
-  epoch: 0
+  epoch: 1
   description: "VirusTotal Command Line Interface"
   copyright:
     - license: Apache-2.0
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/VirusTotal/vt-cli
       tag: ${{package.version}}
-      expected-commit: 6039af32014a94fb387f4d6c98cdaafc55ba015a
+      expected-commit: 4ece259925ad5b08ea5883d595437e57ce2e3d6e
 
   - uses: go/build
     with:
diff --git a/wazero.yaml b/wazero.yaml
index 48faeae559..f174d777d2 100644
--- a/wazero.yaml
+++ b/wazero.yaml
@@ -1,7 +1,7 @@
 package:
   name: wazero
-  version: 1.7.3
-  epoch: 1
+  version: 1.8.0
+  epoch: 0
   description: The zero dependency WebAssembly runtime for Go developers
   copyright:
     - license: Apache-2.0
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/tetratelabs/wazero
       tag: v${{package.version}}
-      expected-commit: 8b3af37da0c2e16d9733886fa0b193239fbfa6ad
+      expected-commit: 5ed4c174cce718e1655d4e1cb95e2611d1a29e73
 
   - runs: |
       make build/wazero_linux_$(go env GOARCH)/wazero