diff --git a/.github/actions/docker-run/action.yaml b/.github/actions/docker-run/action.yaml
index 426862c2426..d85b8410265 100644
--- a/.github/actions/docker-run/action.yaml
+++ b/.github/actions/docker-run/action.yaml
@@ -6,7 +6,7 @@ inputs:
     required: true
   image:
     description: "The image to use"
-    default: "ghcr.io/wolfi-dev/sdk:latest@sha256:77da1186e7c2d9796bcaf4fb035e8675cd822d67a1d8a530cc0f1ceb5df80110"
+    default: "ghcr.io/wolfi-dev/sdk:latest@sha256:98d8669d2eb9c8d23984fa2f55a272b67a04b4bfd132c714682c4fd716a3d7be"
     required: false
   workdir:
     description: "The images working directory"
diff --git a/.github/chainguard/lifecycle-cve-dashboard.sts.yaml b/.github/chainguard/lifecycle-cve-dashboard.sts.yaml
new file mode 100644
index 00000000000..4fc174ebc3e
--- /dev/null
+++ b/.github/chainguard/lifecycle-cve-dashboard.sts.yaml
@@ -0,0 +1,8 @@
+issuer: https://accounts.google.com
+
+# have more than one service account
+# lc-cve-dashboard-bot@staging-enforce-cd1e.iam.gserviceaccount.com
+subject_pattern: "(107513915972546566458)"
+
+permissions:
+  contents: read
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 478e1f4a875..a5bf5b55677 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -29,7 +29,7 @@ jobs:
       contents: read
 
     container:
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:77da1186e7c2d9796bcaf4fb035e8675cd822d67a1d8a530cc0f1ceb5df80110
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:98d8669d2eb9c8d23984fa2f55a272b67a04b4bfd132c714682c4fd716a3d7be
       # TODO: Deprivilege
       options: |
         --cap-add NET_ADMIN --cap-add SYS_ADMIN --device /dev/fuse --security-opt seccomp=unconfined --security-opt apparmor:unconfined
@@ -175,7 +175,7 @@ jobs:
 
     container:
       # NOTE: This step only signs and uploads, so it doesn't need any privileges
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:77da1186e7c2d9796bcaf4fb035e8675cd822d67a1d8a530cc0f1ceb5df80110
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:98d8669d2eb9c8d23984fa2f55a272b67a04b4bfd132c714682c4fd716a3d7be
 
     steps:
       - name: Harden Runner
@@ -303,7 +303,7 @@ jobs:
 
     container:
       # NOTE: This step only signs and uploads, so it doesn't need any privileges
-      image: ghcr.io/wolfi-dev/sdk:latest@sha256:77da1186e7c2d9796bcaf4fb035e8675cd822d67a1d8a530cc0f1ceb5df80110
+      image: ghcr.io/wolfi-dev/sdk:latest@sha256:98d8669d2eb9c8d23984fa2f55a272b67a04b4bfd132c714682c4fd716a3d7be
 
     steps:
       - name: Harden Runner
diff --git a/Makefile b/Makefile
index 65e01078cf9..14618f421fc 100644
--- a/Makefile
+++ b/Makefile
@@ -167,7 +167,7 @@ dev-container:
 	    -v "${PWD}:${PWD}" \
 	    -w "${PWD}" \
 	    -e SOURCE_DATE_EPOCH=0 \
-	    ghcr.io/wolfi-dev/sdk:latest@sha256:77da1186e7c2d9796bcaf4fb035e8675cd822d67a1d8a530cc0f1ceb5df80110
+	    ghcr.io/wolfi-dev/sdk:latest@sha256:98d8669d2eb9c8d23984fa2f55a272b67a04b4bfd132c714682c4fd716a3d7be
 
 PACKAGES_CONTAINER_FOLDER ?= /work/packages
 # This target spins up a docker container that is helpful for testing local
@@ -235,6 +235,6 @@ dev-container-wolfi:
 		--mount type=bind,source="${PWD}/local-melange.rsa.pub",destination="/etc/apk/keys/local-melange.rsa.pub",readonly \
 		--mount type=bind,source="$(TMP_REPOS_FILE)",destination="/etc/apk/repositories",readonly \
 		-w "$(PACKAGES_CONTAINER_FOLDER)" \
-		ghcr.io/wolfi-dev/sdk:latest@sha256:77da1186e7c2d9796bcaf4fb035e8675cd822d67a1d8a530cc0f1ceb5df80110
+		ghcr.io/wolfi-dev/sdk:latest@sha256:98d8669d2eb9c8d23984fa2f55a272b67a04b4bfd132c714682c4fd716a3d7be
 	@rm "$(TMP_REPOS_FILE)"
 	@rmdir "$(TMP_REPOS_DIR)"
diff --git a/apache-arrow.yaml b/apache-arrow.yaml
index 4e805dd65cd..52f506678bb 100644
--- a/apache-arrow.yaml
+++ b/apache-arrow.yaml
@@ -1,6 +1,6 @@
 package:
   name: apache-arrow
-  version: 18.0.0
+  version: 18.1.0
   epoch: 0
   description: "multi-language toolbox for accelerated data interchange and in-memory processing"
   copyright:
@@ -74,7 +74,7 @@ pipeline:
     with:
       repository: https://github.com/apache/arrow
       tag: apache-arrow-${{package.version}}
-      expected-commit: 9105a4109a80a1c01eabb24ee4b9f7c94ee942cb
+      expected-commit: 6a0414bd9a91e890ec6a45369bf61f405180628c
 
   - working-directory: /home/build/apache-arrow/cpp
     uses: cmake/configure
diff --git a/apache2.yaml b/apache2.yaml
index c2f8da54928..5ae2384b71a 100644
--- a/apache2.yaml
+++ b/apache2.yaml
@@ -1,13 +1,14 @@
 package:
   name: apache2
   version: 2.4.62
-  epoch: 4
+  epoch: 5
   description: "Apache HTTP Server"
   copyright:
     - license: Apache-2.0
   dependencies:
     runtime:
       - libgcc
+      - lua5.4
 
 environment:
   contents:
@@ -45,6 +46,7 @@ pipeline:
       opts: |
         --prefix=/ \
         --enable-layout=Debian \
+        --sysconfdir=/etc/apache2 \
         --enable-so \
         --enable-suexec \
         --with-suexec-caller=www-data \
@@ -152,15 +154,15 @@ subpackages:
           mkdir -p "${{targets.subpkgdir}}"/usr/local/apache2/logs
 
           # Install necessary config files
-          mkdir -p "${{targets.subpkgdir}}"/etc/
-          cp "${{targets.destdir}}"/etc/original/httpd.conf "${{targets.subpkgdir}}"/etc/
-          cp -r "${{targets.destdir}}"/etc/original/extra/ "${{targets.subpkgdir}}"/etc/
+          mkdir -p "${{targets.subpkgdir}}"/etc/apache2
+          cp "${{targets.destdir}}"/etc/apache2/original/httpd.conf "${{targets.subpkgdir}}"/etc/apache2
+          cp -r "${{targets.destdir}}"/etc/apache2/original/extra/ "${{targets.subpkgdir}}"/etc/apache2
 
           # Create symlinks
-          ln -s /etc/httpd.conf "${{targets.subpkgdir}}"/usr/local/apache2/conf/
-          ln -s /etc/extra "${{targets.subpkgdir}}"/usr/local/apache2/conf/
-          ln -s /etc/mime.types "${{targets.subpkgdir}}"/usr/local/apache2/conf/
-          ln -s /etc/magic "${{targets.subpkgdir}}"/usr/local/apache2/conf/
+          ln -s /etc/apache2/httpd.conf "${{targets.subpkgdir}}"/usr/local/apache2/conf/
+          ln -s /etc/apache2/extra "${{targets.subpkgdir}}"/usr/local/apache2/conf/
+          ln -s /etc/apache2/mime.types "${{targets.subpkgdir}}"/usr/local/apache2/conf/
+          ln -s /etc/apache2/magic "${{targets.subpkgdir}}"/usr/local/apache2/conf/
           ln -s /usr/lib/apache2/modules/ "${{targets.subpkgdir}}"/usr/local/apache2/
           ln -s /usr/share/apache2/default-site/htdocs "${{targets.subpkgdir}}"/usr/local/apache2/
           ln -s /usr/lib/cgi-bin/ "${{targets.subpkgdir}}"/usr/local/apache2/
@@ -169,39 +171,39 @@ subpackages:
           sed -ri \
             -e 's!^(\s*User)\s+daemon\s*$!\1 www-data!g' \
             -e 's!^(\s*Group)\s+daemon\s*$!\1 www-data!g' \
-            "${{targets.subpkgdir}}"/etc/httpd.conf
+            "${{targets.subpkgdir}}"/etc/apache2/httpd.conf
 
           # Modify CustomLog/ErrorLog and verify changes are applied
           sed -ri \
             -e 's!^(\s*CustomLog)\s+\S+!\1 /proc/self/fd/1!g' \
             -e 's!^(\s*ErrorLog)\s+\S+!\1 /proc/self/fd/2!g' \
             -e 's!^(\s*TransferLog)\s+\S+!\1 /proc/self/fd/1!g' \
-            "${{targets.subpkgdir}}"/etc/httpd.conf \
-            "${{targets.subpkgdir}}"/etc/extra/httpd-ssl.conf;
+            "${{targets.subpkgdir}}"/etc/apache2/httpd.conf \
+            "${{targets.subpkgdir}}"/etc/apache2/extra/httpd-ssl.conf;
 
           # Modify module config to match upstream docker
           sed -ri \
              -e '/LoadModule mpm_prefork_module/s/^/#/g' \
              -e '/LoadModule mpm_event_module/s/^#//g' \
-             "${{targets.subpkgdir}}"/etc/httpd.conf
+             "${{targets.subpkgdir}}"/etc/apache2/httpd.conf
 
           ### Modify other paths to match upstream default config
           sed -ri \
             -e 's!^(\s*ServerRoot)\s+\S+!\1 "/usr/local/apache2"!g' \
             -e 's|usr/lib/apache2/modules|modules|g' \
-            -e 's|etc/mime.types|conf/mime.types|g' \
+            -e 's|etc/apache2/mime.types|conf/mime.types|g' \
             -e 's|usr/share/apache2/default-site/htdocs|usr/local/apache2/htdocs|g' \
             -e 's|usr/lib/cgi-bin|usr/local/apache2/cgi-bin|g' \
-            -e 's|etc/extra|conf/extra|g' \
-            -e 's|etc/magic|conf/magic|g' \
-            "${{targets.subpkgdir}}"/etc/httpd.conf \
-            "${{targets.subpkgdir}}"/etc/extra/httpd-ssl.conf;
+            -e 's|etc/apache2/extra|conf/extra|g' \
+            -e 's|etc/apache2/magic|conf/magic|g' \
+            "${{targets.subpkgdir}}"/etc/apache2/httpd.conf \
+            "${{targets.subpkgdir}}"/etc/apache2/extra/httpd-ssl.conf;
 
           ### Modify other paths
           sed -ri \
             -e 's|etc/|usr/local/apache2/conf/|g' \
             -e 's|/var/run/apache2/|usr/local/apache2/logs/|g' \
-            "${{targets.subpkgdir}}"/etc/extra/httpd-ssl.conf;
+            "${{targets.subpkgdir}}"/etc/apache2/extra/httpd-ssl.conf;
     test:
       environment:
         contents:
diff --git a/apicurio-registry.yaml b/apicurio-registry.yaml
new file mode 100644
index 00000000000..c04c3cabbe1
--- /dev/null
+++ b/apicurio-registry.yaml
@@ -0,0 +1,119 @@
+package:
+  name: apicurio-registry
+  version: 3.0.4
+  epoch: 0
+  description: An API/Schema registry - stores APIs and Schemas
+  copyright:
+    - license: Apache-2.0
+  target-architecture:
+    - x86_64 # Currently, we can't build for aarch64: https://github.com/Apicurio/apicurio-registry/issues/5633
+
+environment:
+  contents:
+    packages:
+      - bash
+      - build-base
+      - busybox
+      - ca-certificates-bundle
+      - curl
+      - go
+      - icu
+      - maven
+      - nodejs-20
+      - npm
+      - openjdk-17
+      - openjdk-17-default-jvm
+      - openssf-compiler-options
+  environment:
+    JAVA_HOME: /usr/lib/jvm/java-17-openjdk
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/Apicurio/apicurio-registry
+      tag: v${{package.version}}
+      expected-commit: f417d2192cdef84dc7587842d98ed721dc3901e3
+
+  - uses: patch
+    with:
+      patches: CVE-2024-31141.patch
+
+  - name: Build
+    runs: |
+      ./mvnw clean install \
+        -Pprod \
+        -DskipTests \
+        -T$(nproc)C \
+        --no-snapshot-updates \
+        --no-transfer-progress \
+        --fail-fast
+
+  - name: Install
+    runs: |
+      dest="${{targets.contextdir}}/usr/share/java/${{package.name}}"
+      mkdir -p "$dest"
+
+      install -Dm644 ./LICENSE "${dest}/LICENSE"
+      install -Dm644 ./README.md "${dest}/README.md"
+
+      tar -zxf ./app/target/apicurio-registry-app-${{package.version}}-all.tar.gz -C "$dest"
+      find . -type f -path "*/target/*-${{package.version}}.jar" -exec cp {} "$dest" \;
+      find . -type f -path "*/target/*-${{package.version}}-runner.jar" -exec cp {} "$dest" \;
+
+  - uses: strip
+
+subpackages:
+  - name: ${{package.name}}-ui
+    description: Web UI for Apicurio Registry (apicurio-registry-ui)
+    dependencies:
+      runtime:
+        - nodejs-20
+    pipeline:
+      - working-directory: ui
+        runs: |
+          npm install
+          npm audit fix --package-lock-only --legacy-peer-deps || true
+          npm run build
+
+          mkdir -p ${{targets.contextdir}}/opt/app-root/src
+          cp -r ui-app/dist/* ${{targets.contextdir}}/opt/app-root/src/
+
+update:
+  enabled: true
+  github:
+    identifier: Apicurio/apicurio-registry
+    use-tag: true
+    strip-prefix: v
+    tag-filter: v
+
+test:
+  environment:
+    contents:
+      packages:
+        - openjdk-17
+        - openjdk-17-default-jvm
+        - bash
+        - busybox
+        - curl
+        - jq
+    environment:
+      JAVA_HOME: /usr/lib/jvm/java-17-openjdk
+      DEST: /usr/share/java/apicurio-registry
+  pipeline:
+    - name: Validate essential JARs
+      runs: |
+        stat "$DEST/apicurio-registry-app-${{package.version}}.jar"
+        stat "$DEST/apicurio-registry-common-${{package.version}}.jar"
+        stat "$DEST/apicurio-registry-utils-tools-${{package.version}}.jar"
+    - name: Ensure lib dir
+      runs: stat "$DEST/lib"
+    - name: "Test runner"
+      uses: test/daemon-check-output
+      with:
+        start: "java -jar $DEST/apicurio-registry-app-${{package.version}}-runner.jar --server.port=8080"
+        timeout: 60
+        expected_output: |
+          constructed successfully
+          Initializing the Apicurio Registry
+        post: |
+          curl -s http://localhost:8080/apis/registry/v2 | grep -qi "Core Registry API"
diff --git a/apicurio-registry/CVE-2024-31141.patch b/apicurio-registry/CVE-2024-31141.patch
new file mode 100644
index 00000000000..6766daf9c9e
--- /dev/null
+++ b/apicurio-registry/CVE-2024-31141.patch
@@ -0,0 +1,26 @@
+From 496964795e4c1d2ec92c477dd5d1fe8f5dd59259 Mon Sep 17 00:00:00 2001
+From: Dentrax <furkan.turkal@chainguard.dev>
+Date: Sun, 1 Dec 2024 18:43:37 +0300
+Subject: [PATCH] CVE-2024-31141
+
+Signed-off-by: Dentrax <furkan.turkal@chainguard.dev>
+---
+ pom.xml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/pom.xml b/pom.xml
+index d520217..aa5bda7 100644
+--- a/pom.xml
++++ b/pom.xml
+@@ -215,7 +215,7 @@
+     <jboss-slf4j.version>1.2.1.Final</jboss-slf4j.version>
+     <httpclient.version>4.5.14</httpclient.version>
+     <apicurio-common-rest-client.version>0.1.18.Final</apicurio-common-rest-client.version>
+-    <kafka-clients.version>3.6.0</kafka-clients.version>
++    <kafka-clients.version>3.7.1</kafka-clients.version>
+     <debezium.version>2.6.2.Final</debezium.version>
+     <pulsar-clients.version>3.3.1</pulsar-clients.version>
+     <commons-beanutils.version>1.9.4</commons-beanutils.version>
+-- 
+2.39.5 (Apple Git-154)
+
diff --git a/argo-events.yaml b/argo-events.yaml
index b438a3c34bf..e2392904d87 100644
--- a/argo-events.yaml
+++ b/argo-events.yaml
@@ -1,7 +1,7 @@
 package:
   name: argo-events
-  version: 1.9.2
-  epoch: 2
+  version: 1.9.3
+  epoch: 0
   description: Event-driven Automation Framework for Kubernetes.
   copyright:
     - license: Apache-2.0
@@ -9,13 +9,13 @@ package:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 8dd63f1305746e6503269a7675288b1f65e53df5
+      expected-commit: 9c8bda9ad1d46bf75e91b851d2265acbf704efbc
       repository: https://github.com/argoproj/argo-events
       tag: v${{package.version}}
 
   - uses: go/bump
     with:
-      deps: github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.6.0 github.com/hashicorp/go-retryablehttp@v0.7.7 github.com/golang-jwt/jwt/v4@v4.5.1
+      deps: github.com/hamba/avro/v2@v2.13.0
       replaces: github.com/whilp/git-urls=github.com/chainguard-dev/git-urls@v1.0.2 github.com/hamba/avro=github.com/hamba/avro/v2@v2.13.0
 
   - uses: go/build
diff --git a/argo-workflows.yaml b/argo-workflows.yaml
index 7be57fa2a4c..695ac415ce3 100644
--- a/argo-workflows.yaml
+++ b/argo-workflows.yaml
@@ -1,7 +1,7 @@
 package:
   name: argo-workflows
-  version: 3.6.0
-  epoch: 1
+  version: 3.6.2
+  epoch: 0
   description: Workflow engine for Kubernetes.
   copyright:
     - license: Apache-2.0
@@ -21,14 +21,10 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: b26ed4aa4dee395844531efa4a76a022183bec22
+      expected-commit: 741ab0ef7b6432925e49882cb4294adccf5912ec
       repository: https://github.com/argoproj/argo-workflows
       tag: v${{package.version}}
 
-  - uses: go/bump
-    with:
-      deps: github.com/golang-jwt/jwt/v4@v4.5.1
-
   - uses: patch
     with:
       patches: CVE-GHSA-grv7-fg5c-xmjg-ui-upgrade-braces-to-3.0.3.patch
diff --git a/aws-c-common.yaml b/aws-c-common.yaml
index 9742f0c19c0..28e731e2048 100644
--- a/aws-c-common.yaml
+++ b/aws-c-common.yaml
@@ -1,6 +1,6 @@
 package:
   name: aws-c-common
-  version: 0.10.3
+  version: 0.10.5
   epoch: 0
   description: Core c99 package for AWS SDK for C including cross-platform primitives, configuration, data structures, and error handling
   copyright:
@@ -20,7 +20,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 63187b976a482309e23296c5f967fc19c4131746
+      expected-commit: fadfef492042ae53387d4369a6de652c930a5be4
       repository: https://github.com/awslabs/aws-c-common
       tag: v${{package.version}}
 
diff --git a/aws-c-s3.yaml b/aws-c-s3.yaml
index 7c8589a1680..55b1e897051 100644
--- a/aws-c-s3.yaml
+++ b/aws-c-s3.yaml
@@ -1,6 +1,6 @@
 package:
   name: aws-c-s3
-  version: 0.7.1
+  version: 0.7.4
   epoch: 0
   description: "AWS C99 library implementation for communicating with the S3 service"
   copyright:
@@ -37,7 +37,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 5877f40f87c77ccf2b278839995a6ee91983080f
+      expected-commit: 9c1bd193f43555ff5da5438e079118b04c022f5a
       repository: https://github.com/awslabs/aws-c-s3
       tag: v${{package.version}}
 
diff --git a/aws-crt-cpp.yaml b/aws-crt-cpp.yaml
index b4fa8abf644..21e327dca41 100644
--- a/aws-crt-cpp.yaml
+++ b/aws-crt-cpp.yaml
@@ -1,6 +1,6 @@
 package:
   name: aws-crt-cpp
-  version: 0.29.5
+  version: 0.29.6
   epoch: 0
   description: "C++ wrapper around the aws-c-* libraries. Provides Cross-Platform Transport Protocols and SSL/TLS implementations for C++"
   copyright:
@@ -33,7 +33,7 @@ pipeline:
     with:
       repository: https://github.com/awslabs/aws-crt-cpp
       tag: v${{package.version}}
-      expected-commit: 9ffe4ef8df4dcfdccb6eba7fa79590a84b29f29e
+      expected-commit: 57a0b8f03e11dc34b2c423519934e492ed96fa96
 
   - runs: |
       if [ "$CBUILD" != "$CHOST" ]; then
diff --git a/aws-eks-pod-identity-agent.yaml b/aws-eks-pod-identity-agent.yaml
index bae6de99beb..9d42742c592 100644
--- a/aws-eks-pod-identity-agent.yaml
+++ b/aws-eks-pod-identity-agent.yaml
@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates,valid-pipeline-git-checkout-tag
 package:
   name: aws-eks-pod-identity-agent
-  version: 0_git20241124
+  version: 0_git20241204
   epoch: 0
   description: EKS Pod Identity is a feature of Amazon EKS that simplifies the process for cluster administrators to configure Kubernetes applications with AWS IAM permissions
   copyright:
@@ -10,7 +10,7 @@ package:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 9e7ec777d96d27c627fd1b15effaf10e2cf4699e
+      expected-commit: 15b7d58b3975d03f7ab6f17b09ec955fb7d66028
       repository: https://github.com/aws/eks-pod-identity-agent
       branch: main
 
diff --git a/bats.yaml b/bats.yaml
index 2aff175ab1f..5c814390cf7 100644
--- a/bats.yaml
+++ b/bats.yaml
@@ -1,14 +1,14 @@
 package:
   name: bats
-  version: 1.11.0
-  epoch: 1
+  version: 1.11.1
+  epoch: 0
   description: Bash Automated Testing System
   copyright:
     - license: MIT
   dependencies:
     runtime:
       - bash
-      - coreutils
+      - busybox
       - ncurses
       - parallel
 
@@ -16,21 +16,39 @@ environment:
   contents:
     packages:
       - bash
-      - build-base
-      - busybox
-      - ca-certificates-bundle
+      - wget
 
 pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/bats-core/bats-core
       tag: v${{package.version}}
-      expected-commit: 5da66876b8b619235aee1eb3e54954eaca88059b
+      expected-commit: b640ec3cf2c7c9cfc9e6351479261186f76eeec8
 
   - runs: |
-      ./install.sh  "${{targets.contextdir}}/usr"
+      ./install.sh "${{targets.contextdir}}/usr"
+      mkdir -p "${{targets.contextdir}}/tmp/"
+      cp -r ./docker "${{targets.contextdir}}/tmp/docker"
+      "${{targets.contextdir}}/tmp/docker/install_libs.sh" support 0.3.0
+      "${{targets.contextdir}}/tmp/docker/install_libs.sh" file 0.4.0
+      "${{targets.contextdir}}/tmp/docker/install_libs.sh" assert 2.1.0
+      "${{targets.contextdir}}/tmp/docker/install_libs.sh" detik 1.3.1
+      find "${{targets.contextdir}}" -type f -perm /2000 -exec chmod g-s {} \;
+      rm -rf "${{targets.contextdir}}/tmp/"
 
 subpackages:
+  - name: bats-compat
+    pipeline:
+      - runs: |
+          mkdir -p "${{targets.contextdir}}/opt/bats/"
+          find . -maxdepth 1 \
+            -not -name '.*' \
+            -not -name 'melange-out' \
+            -exec mv {} "${{targets.contextdir}}/opt/bats/" \;
+          mkdir -p "${{targets.contextdir}}/usr/local/bin"
+          ln -s /opt/bats/bin/bats "${{targets.contextdir}}/usr/local/bin/bats"
+    description: bats compatibility package
+
   - name: bats-doc
     pipeline:
       - uses: split/manpages
@@ -44,6 +62,87 @@ update:
 
 test:
   pipeline:
-    # AUTOGENERATED
     - runs: |
         bats --version
+
+        # Create the example.sh script using heredocs
+        cat << 'EOF' > /tmp/example.sh
+        add_numbers() {
+          echo $(( $1 + $2 ))
+        }
+
+        file_exists() {
+          if [[ -f "$1" ]]; then
+            echo "true"
+          else
+            echo "false"
+          fi
+        }
+
+        string_contains() {
+          if [[ "$1" == *"$2"* ]]; then
+            echo "true"
+          else
+            echo "false"
+          fi
+        }
+        EOF
+
+        # Create the inline_test.bats script using heredocs
+        cat << 'EOF' > /tmp/inline_test.bats
+        #!/usr/bin/env bats
+
+        load_file() {
+          source "/tmp/example.sh"
+        }
+
+        setup() {
+          load_file
+        }
+
+        teardown() {
+          rm -f testfile.txt
+        }
+
+        @test "add_numbers should correctly add two numbers" {
+          run add_numbers 3 5
+          [ "$status" -eq 0 ]
+          [ "$output" -eq 8 ]
+        }
+
+        @test "file_exists should return true for existing file" {
+          touch testfile.txt
+          run file_exists testfile.txt
+          [ "$status" -eq 0 ]
+          [ "$output" = "true" ]
+        }
+
+        @test "file_exists should return false for non-existing file" {
+          run file_exists non_existing_file.txt
+          [ "$status" -eq 0 ]
+          [ "$output" = "false" ]
+        }
+
+        @test "string_contains should return true if substring is found" {
+          run string_contains "hello world" "hello"
+          [ "$status" -eq 0 ]
+          [ "$output" = "true" ]
+        }
+
+        @test "string_contains should return false if substring is not found" {
+          run string_contains "hello world" "bye"
+          [ "$status" -eq 0 ]
+          [ "$output" = "false" ]
+        }
+        EOF
+
+        # Make the scripts executable
+        chmod +x /tmp/example.sh
+        chmod +x /tmp/inline_test.bats
+
+        # Run the bats tests
+        bats /tmp/inline_test.bats
+
+        # Clean up
+        rm -f /tmp/example.sh
+        rm -f /tmp/inline_test.bats
diff --git a/bazelisk.yaml b/bazelisk.yaml
index 23b7a3aefac..e7c2bcf86e9 100644
--- a/bazelisk.yaml
+++ b/bazelisk.yaml
@@ -1,6 +1,6 @@
 package:
   name: bazelisk
-  version: 1.24.0
+  version: 1.24.1
   epoch: 0
   description: A user-friendly launcher for Bazel.
   copyright:
@@ -20,7 +20,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/bazelbuild/bazelisk
-      expected-commit: 1f492e508ca7ef784f01ece24b5249f787a88f63
+      expected-commit: 801dd3462b995155fb02bd9fe48cb64177ee7ba6
       tag: v${{package.version}}
 
   - uses: go/build
diff --git a/benchmark.yaml b/benchmark.yaml
index d6736a19e4c..107e48397c4 100644
--- a/benchmark.yaml
+++ b/benchmark.yaml
@@ -1,7 +1,7 @@
 package:
   name: benchmark
-  version: 1.9.0
-  epoch: 1
+  version: 1.9.1
+  epoch: 0
   description: "microbenchmark support library"
   copyright:
     - license: Apache-2.0
@@ -21,7 +21,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 12235e24652fc7f809373e7c11a5f73c5763fc4c
+      expected-commit: c58e6d0710581e3a08d65c349664128a8d9a2461
       repository: https://github.com/google/benchmark
       tag: v${{package.version}}
 
diff --git a/bmake.yaml b/bmake.yaml
index 649cfae3bfd..118af723cab 100644
--- a/bmake.yaml
+++ b/bmake.yaml
@@ -1,7 +1,7 @@
 package:
   name: bmake
-  version: "20240921"
-  epoch: 1
+  version: "20241124"
+  epoch: 0
   description: Portable version of the NetBSD make build tool
   copyright:
     - license: BSD-2-Clause
@@ -18,7 +18,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: b346579e82d296d1a4da29dea8594e3ee596130b20786dec0f3899a3e11275c2
+      expected-sha256: 4f66406091c2f85ea964b238d69eb8f71ab4baac9dca4687a71883ba6de4ddb2
       uri: https://www.crufty.net/ftp/pub/sjg/bmake-${{package.version}}.tar.gz
       strip-components: 0
 
diff --git a/brew.yaml b/brew.yaml
index b90152091e8..610971276f5 100644
--- a/brew.yaml
+++ b/brew.yaml
@@ -1,6 +1,6 @@
 package:
   name: brew
-  version: 4.4.6
+  version: 4.4.9
   epoch: 0
   description: "The homebrew package manager"
   copyright:
@@ -49,7 +49,7 @@ pipeline:
       repository: https://github.com/Homebrew/brew
       tag: ${{package.version}}
       destination: ./brew
-      expected-commit: cc0b5d6d05d1f3af5b2f53e9fbb1e7bfa0c332ab
+      expected-commit: 2e780004c92f16a96036d3d43569c2924c4e54f5
 
   - runs: |
       set -x
diff --git a/btrfs-progs.yaml b/btrfs-progs.yaml
index bc1bb958c85..a36127f9955 100644
--- a/btrfs-progs.yaml
+++ b/btrfs-progs.yaml
@@ -1,7 +1,7 @@
 package:
   name: btrfs-progs
-  version: "6.11"
-  epoch: 2
+  version: "6.12"
+  epoch: 0
   description: BTRFS filesystem utilities
   copyright:
     - license: GPL-2.0-or-later
@@ -37,7 +37,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://www.kernel.org/pub/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${{package.version}}.tar.xz
-      expected-sha512: fad3c7e908e2020a3983f9737a7e87367023e2ad35aea14197e2bfa71c1e0435bc3da3f7e6ef463de47c033323163f8b1b7933013042c6fcea673d0f4723ade1
+      expected-sha512: 57da37f460a33b5f5232a5c8e67eb5976fb13483a1437112bd433b179bc0e497a1aadfe24705eb4fb4e0a98d2a33fd3c46808b3ca161421475442a70b964c446
 
   - uses: autoconf/configure
     with:
diff --git a/buf.yaml b/buf.yaml
index a760c14d7ad..c9c7c59efb3 100644
--- a/buf.yaml
+++ b/buf.yaml
@@ -1,7 +1,7 @@
 package:
   name: buf
   version: 1.47.2
-  epoch: 0
+  epoch: 1
   description: A new way of working with Protocol Buffers.
   copyright:
     - license: Apache-2.0
@@ -19,6 +19,11 @@ pipeline:
       tag: v${{package.version}}
       expected-commit: 13828a3ee61f19d0fba7ad11a898e03d2db6ccea
 
+  - uses: go/bump
+    with:
+      deps: github.com/quic-go/quic-go@v0.48.2
+      modroot: .
+
   - uses: go/build
     with:
       packages: ./cmd/buf
diff --git a/buildkitd.yaml b/buildkitd.yaml
index 52997e0eb45..aac9ba1eb3c 100644
--- a/buildkitd.yaml
+++ b/buildkitd.yaml
@@ -1,6 +1,6 @@
 package:
   name: buildkitd
-  version: 0.17.2
+  version: 0.18.1
   description: "concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit"
   epoch: 0
   copyright:
@@ -27,11 +27,7 @@ pipeline:
     with:
       repository: https://github.com/moby/buildkit
       tag: v${{package.version}}
-      expected-commit: a3d734228b860a215f8a336e3983d35cbfaf08d8
-
-  - uses: go/bump
-    with:
-      deps: github.com/golang-jwt/jwt/v4@v4.5.1
+      expected-commit: eb68885955169461d72dc2b7e6d084100fcaba86
 
   - runs: |
       PKG=github.com/moby/buildkit
diff --git a/bun-bootstrap.yaml b/bun-bootstrap.yaml
index 99a1a1fb922..75c3d3e8ac4 100644
--- a/bun-bootstrap.yaml
+++ b/bun-bootstrap.yaml
@@ -1,6 +1,6 @@
 package:
   name: bun-bootstrap
-  version: 1.1.36
+  version: 1.1.38
   epoch: 0
   description: "Bun requires itself to bootstrap."
   copyright:
@@ -23,13 +23,13 @@ pipeline:
         uses: fetch
         with:
           uri: "https://github.com/oven-sh/bun/releases/download/bun-v${{package.version}}/bun-linux-aarch64.zip"
-          expected-sha256: "d5bbf74d49288bb69819c5459789dac06a0062d999a626d79d2f45b05b53597a"
+          expected-sha256: "3b08fd0b31f745509e1fed9c690c80d1a32ef2b3c8d059583f643f696639bd21"
           extract: false
       - if: ${{build.arch}} == 'x86_64'
         uses: fetch
         with:
           uri: "https://github.com/oven-sh/bun/releases/download/bun-v${{package.version}}/bun-linux-x64.zip"
-          expected-sha256: "c5261f4d7e342fe720bc6a5d736b1c94f4df2942c225a87652c6985181b1ec77"
+          expected-sha256: "a61da5357e28d4977fccd4851fed62ff4da3ea33853005c7dd93dac80bc53932"
           extract: false
 
   - runs: |
diff --git a/bun.yaml b/bun.yaml
index a54a92cd8e4..db12a74aad4 100644
--- a/bun.yaml
+++ b/bun.yaml
@@ -1,6 +1,6 @@
 package:
   name: bun
-  version: 1.1.36
+  version: 1.1.38
   epoch: 0
   description: "Incredibly fast JavaScript runtime, bundler, test runner, and package manager - all in one"
   copyright:
@@ -54,7 +54,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/oven-sh/bun
-      expected-commit: ededc168cf07afcdbe5ca34495c58df435ea526d
+      expected-commit: bf2f153f5ca45876bc88369273743cd6fa04881c
       tag: bun-v${{package.version}}
 
   - runs: |
diff --git a/caddy.yaml b/caddy.yaml
index 24e45f31142..a8c6eeff201 100644
--- a/caddy.yaml
+++ b/caddy.yaml
@@ -1,7 +1,7 @@
 package:
   name: caddy
   version: 2.8.4
-  epoch: 3
+  epoch: 4
   description: Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
   copyright:
     - license: Apache-2.0
@@ -27,6 +27,10 @@ pipeline:
 
   - runs: tar cfv caddy-src.tar .
 
+  - uses: go/bump
+    with:
+      deps: github.com/quic-go/quic-go@v0.48.2
+
   - uses: go/build
     with:
       ldflags: -s -w
diff --git a/cargo-audit.yaml b/cargo-audit.yaml
index 35e43c47c47..5a9e3b34a3d 100644
--- a/cargo-audit.yaml
+++ b/cargo-audit.yaml
@@ -1,7 +1,7 @@
 package:
   name: cargo-audit
   version: 0.21.0
-  epoch: 1
+  epoch: 2
   description: Audit your dependencies for crates with security vulnerabilities reported to the RustSec Advisory Database.
   copyright:
     - license: MIT OR Apache-2.0
@@ -22,6 +22,8 @@ pipeline:
       tag: cargo-audit/v${{package.version}}
       expected-commit: 78f9859ef6a78bc4a7c7219dac1d0b250446c84c
 
+  - uses: rust/cargobump
+
   - runs: |
       cd cargo-audit
       cargo update --precise 0.3.36 --package time
diff --git a/cargo-audit/cargobump-deps.yaml b/cargo-audit/cargobump-deps.yaml
new file mode 100644
index 00000000000..4d353f7d988
--- /dev/null
+++ b/cargo-audit/cargobump-deps.yaml
@@ -0,0 +1,3 @@
+packages:
+    - name: rustls
+      version: 0.23.18
diff --git a/cargo-c.yaml b/cargo-c.yaml
index b1cd8d3566d..e42425ce5ff 100644
--- a/cargo-c.yaml
+++ b/cargo-c.yaml
@@ -1,7 +1,7 @@
 package:
   name: cargo-c
-  version: 0.10.5
-  epoch: 1
+  version: 0.10.7
+  epoch: 0
   description: build and install C-compatible libraries
   copyright:
     - license: MIT
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/lu-zero/cargo-c
       tag: v${{package.version}}
-      expected-commit: b6081a47813aab0175645e332b14282c651c893d
+      expected-commit: 8914ddfa8d45a0c27abdb48708138a5bc32e5bd6
 
   - runs: |
       cargo  auditable build --release
diff --git a/cass-operator.yaml b/cass-operator.yaml
index a0253caabf9..2118a627cf0 100644
--- a/cass-operator.yaml
+++ b/cass-operator.yaml
@@ -1,6 +1,6 @@
 package:
   name: cass-operator
-  version: 1.22.4
+  version: 1.23.0
   epoch: 0
   description: Manages Cassandra cluster as standalone product or as part of the k8ssandra-operator
   copyright:
@@ -20,7 +20,7 @@ pipeline:
     with:
       repository: https://github.com/k8ssandra/cass-operator.git
       tag: v${{package.version}}
-      expected-commit: bbcc9042a34cdd44bf388b3e0935e76320b35266
+      expected-commit: 7906dd77230081b5896e1ed9630ef044b6b32f73
 
   - uses: go/build
     with:
diff --git a/cert-manager-istio-csr.yaml b/cert-manager-istio-csr.yaml
index 9a27a82252f..685dce72221 100644
--- a/cert-manager-istio-csr.yaml
+++ b/cert-manager-istio-csr.yaml
@@ -1,7 +1,7 @@
 package:
   name: cert-manager-istio-csr
-  version: 0.12.0
-  epoch: 1
+  version: 0.13.0
+  epoch: 0
   description: istio-csr is an agent that allows for Istio workload and control plane components to be secured using cert-manager.
   copyright:
     - license: Apache-2.0
@@ -9,14 +9,10 @@ package:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 13f57d622f9a01f8ac2f5739049b1691c30bef04
+      expected-commit: 6418780c2e2101f0786a9272f60f388ec178cf8d
       repository: https://github.com/cert-manager/istio-csr/
       tag: v${{package.version}}
 
-  - uses: go/bump
-    with:
-      deps: github.com/cert-manager/cert-manager@v1.15.4
-
   - uses: go/build
     with:
       ldflags: -X github.com/cert-manager/istio-csr//internal/version.AppVersion=${{package.version}} -X github.com/cert-manager/istio-csr/internal/version.GitCommit=$(git rev-parse HEAD)
diff --git a/certificate-transparency.yaml b/certificate-transparency.yaml
index 81ff7b157a7..9fbbc0b8ad0 100644
--- a/certificate-transparency.yaml
+++ b/certificate-transparency.yaml
@@ -1,6 +1,6 @@
 package:
   name: certificate-transparency
-  version: 1.2.2
+  version: 1.3.0
   epoch: 0
   description: Auditing for TLS certificates
   copyright:
@@ -31,7 +31,7 @@ pipeline:
     with:
       repository: https://github.com/google/certificate-transparency-go
       tag: v${{package.version}}
-      expected-commit: 6b2be7508011bf6c81c13a9ec532754e77c9bc79
+      expected-commit: 023c6366dacd63fe018e3ae39f3db089ae9722c6
 
 subpackages:
   - range: components
diff --git a/chezmoi.yaml b/chezmoi.yaml
index 20ef5f5a8e6..cd6433c5f48 100644
--- a/chezmoi.yaml
+++ b/chezmoi.yaml
@@ -1,6 +1,6 @@
 package:
   name: chezmoi
-  version: 2.54.0
+  version: 2.55.0
   epoch: 0
   description: Manage your dotfiles across multiple diverse machines, securely.
   copyright:
@@ -20,7 +20,7 @@ pipeline:
     with:
       repository: https://github.com/twpayne/chezmoi
       tag: v${{package.version}}
-      expected-commit: 92f8a9854bc9a234b937dab2f7d75764efdc0e80
+      expected-commit: 1fe5b499e4b47103b5e69904d7ce49d5338307db
 
   - uses: go/build
     with:
diff --git a/clang-19.yaml b/clang-19.yaml
index 266d8a2b23b..3f859c0d68a 100644
--- a/clang-19.yaml
+++ b/clang-19.yaml
@@ -1,6 +1,6 @@
 package:
   name: clang-19
-  version: 19.1.4
+  version: 19.1.5
   epoch: 0
   description: "C language family frontend for LLVM"
   copyright:
@@ -51,12 +51,12 @@ pipeline:
   - uses: fetch
     with:
       uri: https://github.com/llvm/llvm-project/releases/download/llvmorg-${{package.version}}/clang-${{package.version}}.src.tar.xz
-      expected-sha256: b6d123a4435f1869af709f3288c4c4db48173acaf621088400d91521bc5aa225
+      expected-sha256: e7dfc8050407b5cc564c1c1afe19517255c9229cccd886dbd5bac9b652828d85
 
   - uses: fetch
     with:
       uri: https://github.com/llvm/llvm-project/releases/download/llvmorg-${{package.version}}/clang-tools-extra-${{package.version}}.src.tar.xz
-      expected-sha256: e09d0becbbe4dc3dec45dbda44649357456e559b46a72004696674c963734fa6
+      expected-sha256: 9288a607dfb6350906e466ee49590e769ffb311a2f989889e9e52bd3e64c9398
       strip-components: 0
 
   - runs: |
diff --git a/clickhouse-24.9.yaml b/clickhouse-24.10.yaml
similarity index 97%
rename from clickhouse-24.9.yaml
rename to clickhouse-24.10.yaml
index 38e0fa8e984..32dcd21e845 100644
--- a/clickhouse-24.9.yaml
+++ b/clickhouse-24.10.yaml
@@ -1,6 +1,6 @@
 package:
-  name: clickhouse-24.9
-  version: 24.9.3.128
+  name: clickhouse-24.10
+  version: 24.10.3.21
   epoch: 0
   description: ClickHouse is the fastest and most resource efficient open-source database for real-time apps and analytics.
   copyright:
@@ -42,7 +42,7 @@ pipeline:
     with:
       repository: https://github.com/ClickHouse/ClickHouse
       tag: v${{package.version}}-stable
-      expected-commit: 9a816c73dd4eb5f2ff994b1d9a57c5829f3e4811
+      expected-commit: e668b927efb59d73cba8bbac238c6fa82efcdcb4
 
   # The default build script is defensive and tries to protect against defining cflags.
   - uses: patch
@@ -99,7 +99,7 @@ update:
     - '-stable$'
   github:
     identifier: ClickHouse/ClickHouse
-    tag-filter-prefix: v24.9.
+    tag-filter-prefix: v24.10.
     strip-prefix: v
     strip-suffix: -stable
 
diff --git a/clickhouse-24.9/allow_cflags.patch b/clickhouse-24.10/allow_cflags.patch
similarity index 100%
rename from clickhouse-24.9/allow_cflags.patch
rename to clickhouse-24.10/allow_cflags.patch
diff --git a/cni-plugins.yaml b/cni-plugins.yaml
index 0a3559d122b..69b010733e9 100644
--- a/cni-plugins.yaml
+++ b/cni-plugins.yaml
@@ -1,6 +1,6 @@
 package:
   name: cni-plugins
-  version: 1.6.0
+  version: 1.6.1
   epoch: 0
   description: Some reference and example networking plugins, maintained by the CNI team.
   copyright:
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/containernetworking/plugins
       tag: v${{package.version}}
-      expected-commit: fec2d62676cbe4f2fd587b4840c7fc021bead3f9
+      expected-commit: 7f756b411efc3d3730c707e2cc1f2baf1a66e28c
 
   - runs: |
       # Ensure we build statically since CNI plugins often get moved onto the
diff --git a/conda-build.yaml b/conda-build.yaml
index 959d9fecec0..4bac32e2213 100644
--- a/conda-build.yaml
+++ b/conda-build.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/conda-build/
 package:
   name: conda-build
-  version: 24.11.1
+  version: 24.11.2
   epoch: 0
   description: tools for building conda packages
   copyright:
@@ -35,7 +35,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 1d4235a8a8ced33c7b76ab31aff18a2fa0c7ec2b
+      expected-commit: 07a10e20fa71240bf828dda81bbee72912fe70d1
       repository: https://github.com/conda/conda-build
       tag: ${{package.version}}
 
diff --git a/confluent-kafka.yaml b/confluent-kafka.yaml
index 44a6809289f..8861914aa66 100644
--- a/confluent-kafka.yaml
+++ b/confluent-kafka.yaml
@@ -8,7 +8,7 @@ package:
   # with the `version:` field.
   # 2. Created a new variable `mangled-package-version` to append `-ccs` to the
   # version.
-  version: 8.0.0.153
+  version: 8.0.0.200
   epoch: 0
   description: Community edition of Confluent Kafka.
   copyright:
@@ -46,14 +46,10 @@ var-transforms:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 0d74eeb7e82cedcbbfd46481d9ff54ba035d365b
+      expected-commit: e0c917e0d52c5d1082916a3ebf3d859c96987dc9
       repository: https://github.com/confluentinc/kafka
       tag: v${{vars.mangled-package-version}}
 
-  - uses: patch
-    with:
-      patches: upgrade-netty-version-to-fix-CVE.patch
-
   - runs: |
       export JAVA_TOOL_OPTIONS=-Dfile.encoding=UTF8
 
diff --git a/confluent-kafka/upgrade-netty-version-to-fix-CVE.patch b/confluent-kafka/upgrade-netty-version-to-fix-CVE.patch
deleted file mode 100644
index d4259ad7042..00000000000
--- a/confluent-kafka/upgrade-netty-version-to-fix-CVE.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 9eb52f8de4cf58a25a441a594a0dcf8e2bc01cc8 Mon Sep 17 00:00:00 2001
-From: Batuhan Apaydin <batuhan.apaydin@chainguard.dev>
-Date: Sun, 17 Nov 2024 21:17:01 +0300
-Subject: [PATCH] upgrade netty version to fix CVE
-
-Signed-off-by: Batuhan Apaydin <batuhan.apaydin@chainguard.dev>
----
- gradle/dependencies.gradle | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
-index 2b0f617..0c37c65 100644
---- a/gradle/dependencies.gradle
-+++ b/gradle/dependencies.gradle
-@@ -113,7 +113,7 @@ versions += [
-   mavenArtifact: "3.9.6",
-   metrics: "2.2.0",
-   mockito: "5.14.2",
--  netty: "4.1.111.Final",
-+  netty: "4.1.115.Final",
-   opentelemetryProto: "1.0.0-alpha",
-   protobuf: "3.25.5", // a dependency of opentelemetryProto
-   pcollections: "4.0.1",
--- 
-2.39.3 (Apple Git-146)
-
diff --git a/coredns.yaml b/coredns.yaml
index 937fb4d6110..f2bb87bb525 100644
--- a/coredns.yaml
+++ b/coredns.yaml
@@ -1,7 +1,7 @@
 package:
   name: coredns
   version: 1.12.0
-  epoch: 0
+  epoch: 1
   description: CoreDNS is a DNS server that chains plugins
   copyright:
     - license: Apache-2.0
@@ -23,6 +23,10 @@ pipeline:
       # Generate code and fetch plugins
       make gen
 
+  - uses: go/bump
+    with:
+      deps: github.com/quic-go/quic-go@v0.48.2
+
   - uses: go/build
     with:
       ldflags: -X github.com/coredns/coredns/coremain.GitCommit=v${{package.version}}
diff --git a/cpp-httplib.yaml b/cpp-httplib.yaml
index 5cf7bc40c6b..943d630b7df 100644
--- a/cpp-httplib.yaml
+++ b/cpp-httplib.yaml
@@ -1,7 +1,7 @@
 # Generated from https://git.alpinelinux.org/aports/plain/main/cxxopts/APKBUILD
 package:
   name: cpp-httplib
-  version: 0.18.1
+  version: 0.18.2
   epoch: 0
   description: C++ header-only HTTP/HTTPS server and client library
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/yhirose/cpp-httplib.git
       tag: v${{package.version}}
-      expected-commit: 5c1a34e766817cf0865ca8bc5af5edeb0f9b2df4
+      expected-commit: 51dee793fec2fa70239f5cf190e165b54803880f
       recurse-submodules: true
 
   - uses: cmake/configure
diff --git a/crac-criu.yaml b/crac-criu.yaml
index b38e22b05a5..bf824a5c8e6 100644
--- a/crac-criu.yaml
+++ b/crac-criu.yaml
@@ -1,11 +1,17 @@
 package:
   name: crac-criu
-  version: 1.4.3
-  epoch: 1
+  version: 1.5.0.0.1
+  epoch: 0
   description: A project to implement checkpoint/restore functionality for Linux
   copyright:
     - license: GPL-2.0-only
 
+var-transforms:
+  - from: ${{package.version}}
+    match: ^(\d+\.\d+\.\d+)\.(\d+)\.(\d+)
+    replace: $1-$2"ubuntu"$3
+    to: mangled-package-version
+
 environment:
   contents:
     packages:
@@ -42,14 +48,9 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 352e2c730905bfca240a5e0f3e8085b6c27f606c
-      repository: https://github.com/canonical/crac-criu
-      tag: ${{package.version}}
-
-  # Remove what isn't used by OpenJDK CRaC
-  - uses: patch
-    with:
-      patches: modify-installation.patch
+      expected-commit: 5d2ab448ab95db3917ecebff31e4843a22167dda
+      repository: https://git.launchpad.net/ubuntu/+source/crac-criu
+      tag: applied/${{vars.mangled-package-version}}
 
   - uses: autoconf/make-install
     with:
@@ -59,8 +60,11 @@ pipeline:
 
 update:
   enabled: true
-  github:
-    identifier: canonical/crac-criu
+  version-transform:
+    - match: ^(.+)\-(\d+)"ubuntu"(\d+)
+      replace: $1.$2.$3
+  git:
+    strip-prefix: applied/
 
 test:
   pipeline:
diff --git a/crac-criu/modify-installation.patch b/crac-criu/modify-installation.patch
deleted file mode 100644
index e616c4e3dca..00000000000
--- a/crac-criu/modify-installation.patch
+++ /dev/null
@@ -1,104 +0,0 @@
-Description: Modify installation scripts for Ubuntu
-  The crac-criu package current serves as a dependency
-  for the openjdk-*-crac packages only. This patch
-  reduces the installation to only what the latter need
-  i.e. the usr/sbin/crac-criu binary. Other components
-  like crac-compel, shared libraries, man pages and the
-  Python bindings (crit) are not installed.
-Author: Pushkar Kulkarni <pushkar.kulkarni@canonical.com>
-Forwarded: not-needed
-Last-Update: 2024-08-09
-
---- a/lib/Makefile
-+++ b/lib/Makefile
-@@ -2,7 +2,7 @@
- CRIU_A			:= libcrac-criu.a
- UAPI_HEADERS		:= lib/c/criu.h images/rpc.proto images/rpc.pb-c.h criu/include/version.h
- 
--all-y	+= lib-c lib-a lib-py
-+all-y	+= lib-c lib-a
- 
- #
- # C language bindings.
-@@ -35,13 +35,12 @@
- 
- clean-lib:
- 	$(Q) $(MAKE) $(build)=lib/c clean
--	$(Q) $(MAKE) $(build)=lib/py clean
- .PHONY: clean-lib
- clean: clean-lib
- cleanup-y	+= lib/c/$(CRIU_SO) lib/c/$(CRIU_A) lib/c/criu.pc
- mrproper: clean
- 
--install: lib-c lib-a lib-py crit/crit lib/c/criu.pc.in
-+install: lib-c lib-a lib/c/criu.pc.in
- 	$(E) "  INSTALL " lib
- 	$(Q) mkdir -p $(DESTDIR)$(LIBDIR)
- 	$(Q) install -m 755 lib/c/$(CRIU_SO) $(DESTDIR)$(LIBDIR)/$(CRIU_SO).$(CRIU_SO_VERSION_MAJOR).$(CRIU_SO_VERSION_MINOR)
-@@ -54,10 +53,6 @@
- 	$(Q) mkdir -p $(DESTDIR)$(LIBDIR)/pkgconfig
- 	$(Q) sed -e 's,@version@,$(CRIU_VERSION),' -e 's,@libdir@,$(LIBDIR),' -e 's,@includedir@,$(dir $(INCLUDEDIR)/crac-criu/criu/),' lib/c/criu.pc.in > lib/c/criu.pc
- 	$(Q) install -m 644 lib/c/criu.pc $(DESTDIR)$(LIBDIR)/pkgconfig/crac-criu.pc
--ifeq ($(PYTHON),python3)
--	$(E) "  INSTALL " crit
--	$(Q) $(PYTHON) -m pip install --no-build-isolation --no-index --no-deps --progress-bar off --upgrade --force-reinstall --prefix=$(DESTDIR)$(PREFIX) ./crit
--endif
- .PHONY: install
- 
- uninstall:
-@@ -69,8 +64,4 @@
- 	$(Q) $(RM) $(addprefix $(DESTDIR)$(INCLUDEDIR)/crac-criu/criu/,$(notdir $(UAPI_HEADERS)))
- 	$(E) " UNINSTALL" pkgconfig/crac-criu.pc
- 	$(Q) $(RM) $(addprefix $(DESTDIR)$(LIBDIR)/pkgconfig/,crac-criu.pc)
--ifeq ($(PYTHON),python3)
--	$(E) " UNINSTALL" crit
--	$(Q) $(PYTHON) ./scripts/uninstall_module.py --prefix=$(DESTDIR)$(PREFIX) crit
--endif
- .PHONY: uninstall
---- a/crit/Makefile
-+++ b/crit/Makefile
-@@ -1,8 +1,8 @@
- 
- all-y	+= crit
- 
--crit/crit: crit/crit-$(PYTHON)
--	$(Q) cp $^ $@
-+crit/crit:
-+
- crit: crit/crit
- .PHONY: crit
- 
---- a/Makefile.install
-+++ b/Makefile.install
-@@ -50,7 +50,7 @@
- 	$(Q) $(MAKE) $(build)=compel/plugins install
- .PHONY: install-compel
- 
--install: install-man install-lib install-criu install-compel install-amdgpu_plugin ;
-+install: install-criu ;
- .PHONY: install
- 
- uninstall:
---- a/criu/Makefile
-+++ b/criu/Makefile
-@@ -141,10 +141,6 @@
- 	$(E) "  INSTALL " $(obj)/criu
- 	$(Q) mkdir -p $(DESTDIR)$(SBINDIR)
- 	$(Q) install -m 755 $(obj)/criu $(DESTDIR)$(SBINDIR)/crac-criu
--	$(Q) mkdir -p $(DESTDIR)$(INCLUDEDIR)/crac-criu/criu/
--	$(Q) install -m 644 $(UAPI_HEADERS) $(DESTDIR)$(INCLUDEDIR)/crac-criu/criu/
--	$(Q) mkdir -p $(DESTDIR)$(LIBEXECDIR)/criu/scripts
--	$(Q) install -m 755 scripts/systemd-autofs-restart.sh $(DESTDIR)$(LIBEXECDIR)/criu/scripts
- ifeq ($(PYTHON),python3)
- 	$(E) "  INSTALL " scripts/criu-ns
- 	$(Q) install -m 755 scripts/criu-ns $(DESTDIR)$(SBINDIR)/crac-criu-ns
-@@ -154,9 +150,6 @@
- uninstall:
- 	$(E) " UNINSTALL" criu
- 	$(Q) $(RM) $(addprefix $(DESTDIR)$(SBINDIR)/,crac-criu)
--	$(Q) $(RM) $(addprefix $(DESTDIR)$(SBINDIR)/,crac-criu-ns)
--	$(Q) $(RM) $(addprefix $(DESTDIR)$(INCLUDEDIR)/crac-criu/criu/,$(notdir $(UAPI_HEADERS)))
--	$(Q) $(RM) $(addprefix $(DESTDIR)$(LIBEXECDIR)/criu/scripts/,systemd-autofs-restart.sh)
- .PHONY: uninstall
- 
- all-y += check-packages $(obj)/criu
diff --git a/croc.yaml b/croc.yaml
index 09756747527..6a541c6c2ac 100644
--- a/croc.yaml
+++ b/croc.yaml
@@ -1,6 +1,6 @@
 package:
   name: croc
-  version: 10.1.0
+  version: 10.1.1
   epoch: 0
   description: Easily and securely send things from one computer to another
   copyright:
@@ -21,7 +21,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/schollz/croc
-      expected-commit: 53323cb8c43c05090543e5437fef8b1fa269aeea
+      expected-commit: f6012939f37cf64c45846d08a51be7eb8fb6249c
       tag: v${{package.version}}
 
   - uses: go/build
diff --git a/crossplane.yaml b/crossplane.yaml
index 89048a42f15..6576cb16c22 100644
--- a/crossplane.yaml
+++ b/crossplane.yaml
@@ -1,6 +1,6 @@
 package:
   name: crossplane
-  version: 1.18.0
+  version: 1.18.1
   epoch: 0
   description: Cloud Native Control Planes
   copyright:
@@ -13,7 +13,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: e663a43ece850e93fe5cdebb2e478e2fb9762ad1
+      expected-commit: 0ca82e4f152067f69af11d907ab7b4a0a21fed37
       repository: https://github.com/crossplane/crossplane
       tag: v${{package.version}}
 
diff --git a/datadog-security-agent-policies.yaml b/datadog-security-agent-policies.yaml
index e9ec66dddc7..595e5849869 100644
--- a/datadog-security-agent-policies.yaml
+++ b/datadog-security-agent-policies.yaml
@@ -1,6 +1,6 @@
 package:
   name: datadog-security-agent-policies
-  version: 0.60.0
+  version: 0.61.0
   epoch: 0
   description: "Policies for Security Agent - compliance and runtime checks"
   copyright:
@@ -16,7 +16,7 @@ pipeline:
     with:
       repository: https://github.com/DataDog/security-agent-policies
       tag: v${{package.version}}
-      expected-commit: 190c4e2f71e5165c6bd53cf7de0b152f2988a890
+      expected-commit: 30a6bff39e8afc84015b8e54eb48ab95c74b073d
 
   - runs: |
       mkdir -p ${{targets.destdir}}/etc/datadog-agent/compliance.d
diff --git a/ddp-tool.yaml b/ddp-tool.yaml
index 3e724ba7931..778d9c23403 100644
--- a/ddp-tool.yaml
+++ b/ddp-tool.yaml
@@ -1,7 +1,7 @@
 #nolint:valid-pipeline-git-checkout-commit,valid-pipeline-git-checkout-tag
 package:
   name: ddp-tool
-  version: 1.0.34.0_git20241124
+  version: 1.0.34.0_git20241204
   epoch: 0
   description: Intel Dynamic Device Personalization Tool
   copyright:
@@ -18,7 +18,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 3868a732013b8e8817f6453b58a170f669d99a68
+      expected-commit: 3c9d350737420f943a57cf9ab67af6cc78a4024b
       repository: https://github.com/intel/ddp-tool/
       branch: master
 
diff --git a/debezium-3.0.yaml b/debezium-3.0.yaml
index ac26d448075..ca911dffbf6 100644
--- a/debezium-3.0.yaml
+++ b/debezium-3.0.yaml
@@ -1,7 +1,7 @@
 package:
   name: debezium-3.0
-  version: 3.0.2
-  epoch: 1
+  version: 3.0.3
+  epoch: 0
   description: Debezium is a change data capture (CDC) platform that achieves its durability, reliability, and fault tolerance qualities by reusing Kafka and Kafka Connect.
   copyright:
     - license: Apache-2.0
@@ -34,7 +34,7 @@ pipeline:
     with:
       repository: https://github.com/debezium/debezium
       tag: v${{package.version}}.Final
-      expected-commit: 73e255605d09a8c882f9cab7868aed33bcf6d346
+      expected-commit: 24968433b7655543f8bd09ecab400d1bf499e019
 
   - uses: maven/pombump
     with:
diff --git a/debezium-connect-entrypoint-3.0.yaml b/debezium-connect-entrypoint-3.0.yaml
index 70d34fa5215..a790e896e2d 100644
--- a/debezium-connect-entrypoint-3.0.yaml
+++ b/debezium-connect-entrypoint-3.0.yaml
@@ -1,7 +1,7 @@
 package:
   name: debezium-connect-entrypoint-3.0
-  version: 3.0.2
-  epoch: 2
+  version: 3.0.4
+  epoch: 0
   description: Helper package to provide necessary files for the Debezium images
   copyright:
     - license: Apache-2.0
@@ -39,7 +39,7 @@ pipeline:
     with:
       repository: https://github.com/debezium/container-images
       tag: v${{package.version}}.Final
-      expected-commit: 0565147b930179425f985bcd706682695057230a
+      expected-commit: dcb700d1c7db0dbd1532850c1d5b5d4bbc3e0bba
 
   - uses: patch
     with:
diff --git a/debezium-connector-db2-3.0.yaml b/debezium-connector-db2-3.0.yaml
index dc4459ac1b3..dddd4e47944 100644
--- a/debezium-connector-db2-3.0.yaml
+++ b/debezium-connector-db2-3.0.yaml
@@ -1,7 +1,7 @@
 package:
   name: debezium-connector-db2-3.0
-  version: 3.0.2
-  epoch: 1
+  version: 3.0.3
+  epoch: 0
   description: An incubating Debezium connector for Db2
   copyright:
     - license: Apache-2.0
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/debezium/debezium-connector-db2
       tag: v${{package.version}}.Final
-      expected-commit: 9d1b616700bef57b035eb4392f447c4cd7a914b6
+      expected-commit: d6a5d0c0addcda697ae07d97be06eb352a008bcb
 
   - name: Build
     runs: |
diff --git a/debezium-connector-ibmi-3.0.yaml b/debezium-connector-ibmi-3.0.yaml
index 8e12fe7f709..bb483d959f4 100644
--- a/debezium-connector-ibmi-3.0.yaml
+++ b/debezium-connector-ibmi-3.0.yaml
@@ -1,7 +1,7 @@
 package:
   name: debezium-connector-ibmi-3.0
-  version: 3.0.2
-  epoch: 1
+  version: 3.0.3
+  epoch: 0
   description: Debezium Connector for IBM i (AS/400)
   copyright:
     - license: Apache-2.0
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/debezium/debezium-connector-ibmi
       tag: v${{package.version}}.Final
-      expected-commit: ce4fd7fd48778da1c901a338157cc1a38694c2b6
+      expected-commit: d29d53735364582791481300ac629b4177d7c064
 
   - name: Build
     runs: |
diff --git a/debezium-connector-informix-3.0.yaml b/debezium-connector-informix-3.0.yaml
index 917d2590f17..eee6f9a3c24 100644
--- a/debezium-connector-informix-3.0.yaml
+++ b/debezium-connector-informix-3.0.yaml
@@ -1,7 +1,7 @@
 package:
   name: debezium-connector-informix-3.0
-  version: 3.0.2
-  epoch: 1
+  version: 3.0.3
+  epoch: 0
   description: An incubating Debezium CDC connector for IBM Informix database
   copyright:
     - license: Apache-2.0
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/debezium/debezium-connector-informix
       tag: v${{package.version}}.Final
-      expected-commit: 1abb9e1c4df5f00c6c05e1cfbdabd13c1d9e9c8f
+      expected-commit: 5eb88bd6c5fea761592e1e20b23fe08596593bd1
 
   - name: Build
     runs: |
diff --git a/debezium-connector-spanner-3.0.yaml b/debezium-connector-spanner-3.0.yaml
index 810dff89722..cc9c7e55c44 100644
--- a/debezium-connector-spanner-3.0.yaml
+++ b/debezium-connector-spanner-3.0.yaml
@@ -1,7 +1,7 @@
 package:
   name: debezium-connector-spanner-3.0
-  version: 3.0.2
-  epoch: 1
+  version: 3.0.3
+  epoch: 0
   description: An incubating Debezium CDC connector for Google Spanner
   copyright:
     - license: Apache-2.0
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/debezium/debezium-connector-spanner
       tag: v${{package.version}}.Final
-      expected-commit: 4e0f93021b2b653d0f7e36f18d8bacb092f5dc1f
+      expected-commit: ab66d031220eb7321a0424ac032bb7e98feae9d1
 
   - uses: maven/pombump
 
diff --git a/debezium-connector-vitess-3.0.yaml b/debezium-connector-vitess-3.0.yaml
index 096cade0703..a1ffbb1c3f3 100644
--- a/debezium-connector-vitess-3.0.yaml
+++ b/debezium-connector-vitess-3.0.yaml
@@ -1,7 +1,7 @@
 package:
   name: debezium-connector-vitess-3.0
-  version: 3.0.2
-  epoch: 1
+  version: 3.0.3
+  epoch: 0
   description: An incubating Debezium CDC connector for Vitess
   copyright:
     - license: Apache-2.0
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/debezium/debezium-connector-vitess
       tag: v${{package.version}}.Final
-      expected-commit: f1afd23b8e05d692755996d2a1d1e3aa7d9371ac
+      expected-commit: 28afab8314764989a33069fa2c2a05d4ec500561
 
   - uses: maven/pombump
 
diff --git a/deno.yaml b/deno.yaml
index 5f3053d07a9..e3a6e0cdb5f 100644
--- a/deno.yaml
+++ b/deno.yaml
@@ -1,6 +1,6 @@
 package:
   name: deno
-  version: 2.1.1
+  version: 2.1.2
   epoch: 0
   description: "A modern runtime for JavaScript and TypeScript."
   copyright:
@@ -30,7 +30,7 @@ pipeline:
     with:
       repository: https://github.com/denoland/deno
       tag: v${{package.version}}
-      expected-commit: 5d71b461530f7c374c08701cef5678a5a4ac5484
+      expected-commit: 2039abe8d2bc82fa800f4118707a48ac6f5e02ae
 
   - name: Configure and build
     runs: |
diff --git a/dependency-track.yaml b/dependency-track.yaml
index fdcbd0d55c1..f28ed321b7b 100644
--- a/dependency-track.yaml
+++ b/dependency-track.yaml
@@ -1,6 +1,6 @@
 package:
   name: dependency-track
-  version: 4.12.1
+  version: 4.12.2
   epoch: 0
   description:
   copyright:
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/DependencyTrack/dependency-track
       tag: ${{package.version}}
-      expected-commit: 1c94a22ddf690022026df67c17619dda0db22431
+      expected-commit: 29c633e04eff4bf24a822283672da9d7ca5157e7
 
   - uses: maven/pombump
 
diff --git a/docker-cli-buildx.yaml b/docker-cli-buildx.yaml
index 265cbb30c52..f9d23e7f6af 100644
--- a/docker-cli-buildx.yaml
+++ b/docker-cli-buildx.yaml
@@ -1,6 +1,6 @@
 package:
   name: docker-cli-buildx
-  version: 0.18.0
+  version: 0.19.1
   epoch: 0
   description: buildx is a Docker CLI plugin for extended build capabilities with BuildKit.
   copyright:
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/docker/buildx
       tag: v${{package.version}}
-      expected-commit: fa4461b9a1ec45c23d1b9e32dee0d0a8ed29900b
+      expected-commit: 5113f9ea89afd597302961caf99cecd142c7ba05
 
   - runs: |
       mkdir -p ${{targets.destdir}}/usr/libexec/docker/cli-plugins/
@@ -27,6 +27,11 @@ pipeline:
       chmod +x bin/build/docker-buildx
       cp bin/build/docker-buildx ${{targets.destdir}}/usr/libexec/docker/cli-plugins/
 
+test:
+  pipeline:
+    - runs: |
+        /usr/libexec/docker/cli-plugins/docker-buildx version | grep ${{package.version}}
+
 update:
   enabled: true
   github:
diff --git a/docker-compose.yaml b/docker-compose.yaml
index 46d39d593ea..2c4d1fd6e5e 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -1,6 +1,6 @@
 package:
   name: docker-compose
-  version: 2.30.3
+  version: 2.31.0
   epoch: 0
   description: Define and run multi-container applications with Docker
   copyright:
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/docker/compose
       tag: v${{package.version}}
-      expected-commit: a8bfbc147a8b77bb0c0f9553365babb643b0a4f7
+      expected-commit: a8469db83f514a5abe4681c7fee773061f1941c6
 
   - runs: |
       mkdir -p ${{targets.destdir}}/usr/bin
diff --git a/docker-nginx.yaml b/docker-nginx.yaml
index 6a9c3635520..7f8b2cc6a71 100644
--- a/docker-nginx.yaml
+++ b/docker-nginx.yaml
@@ -1,6 +1,6 @@
 package:
   name: docker-nginx
-  version: 1.27.2
+  version: 1.27.3
   epoch: 0
   description: NGINX Dockerfiles
   copyright:
@@ -18,7 +18,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 6a4c0cb4ac7e53bbbe473df71b61a5bf9f95252f
+      expected-commit: d21b4f2d90a1abb712a610678872e804267f4815
       repository: https://github.com/nginxinc/docker-nginx
       tag: ${{package.version}}
 
diff --git a/docker-selenium.yaml b/docker-selenium.yaml
index e930cf1087d..107a91a2514 100644
--- a/docker-selenium.yaml
+++ b/docker-selenium.yaml
@@ -4,7 +4,7 @@ package:
   # But the '-' is not a valid character according to APK versioning spec; and resulting
   # 'package format error' when trying to install the package. The workaround is
   # to replace '-' with '.', then mangling the version to replace back.
-  version: 4.26.0.20241101
+  version: 4.27.0.20241127
   epoch: 0
   description: Provides a simple way to run Selenium Grid with Chrome, Firefox, and Edge using Docker, making it easier to perform browser automation
   copyright:
@@ -57,7 +57,7 @@ pipeline:
     with:
       repository: https://github.com/SeleniumHQ/docker-selenium
       tag: ${{vars.mangled-package-version}}
-      expected-commit: 6ce652ba6ec1108d7ce05b4af5ea140d73873b59
+      expected-commit: c5e10a7c7f8e6538f5bee7079a7d6f7e0587368b
 
   - uses: patch
     with:
diff --git a/docker.yaml b/docker.yaml
index ff8210e449e..4088d5997de 100644
--- a/docker.yaml
+++ b/docker.yaml
@@ -1,7 +1,7 @@
 package:
   name: docker
   version: 27.3.1
-  epoch: 3
+  epoch: 4
   description: A meta package for Docker Engine and Docker CLI
   copyright:
     - license: Apache-2.0
@@ -111,23 +111,18 @@ subpackages:
 
   - name: docker-oci-entrypoint
     description: "docker OCI entrypoint"
-    dependencies:
-      runtime:
-        - docker
     pipeline:
       - runs: |
           install -Dm755 /home/docker-library/docker-entrypoint.sh "${{targets.subpkgdir}}"/usr/bin/docker-entrypoint.sh
     test:
       pipeline:
         - runs: |
-            docker-entrypoint.sh --version
-            docker-entrypoint.sh --help
+            stat /usr/bin/docker-entrypoint.sh
 
   - name: dockerd-oci-entrypoint
     description: "dockerd OCI entrypoint"
     dependencies:
       runtime:
-        - docker
         # Used as a fallback in the dockerd-entrypoint.sh script
         - docker-oci-entrypoint
         # Used as a fallback in the dockerd-entrypoint.sh script
@@ -138,8 +133,7 @@ subpackages:
     test:
       pipeline:
         - runs: |
-            dockerd-entrypoint.sh --version
-            dockerd-entrypoint.sh --help
+            stat /usr/bin/dockerd-entrypoint.sh
 
   - name: docker-rootless
     description: "dockerd rootless"
@@ -158,9 +152,6 @@ subpackages:
   # Ref: https://github.com/docker-library/docker/blob/master/Dockerfile-dind.template
   - name: docker-dind
     description: "Docker in Docker"
-    dependencies:
-      runtime:
-        - docker
     pipeline:
       - runs: |
           install -Dm755 /home/build/hack/dind "${{targets.subpkgdir}}"/usr/bin/dind
@@ -169,7 +160,6 @@ subpackages:
     description: "Systemd services for docker"
     dependencies:
       runtime:
-        - docker
         - containerd-service
         - systemd
     pipeline:
diff --git a/dotnet-9.yaml b/dotnet-9.yaml
index 3f861b3a40b..d663b2b3e21 100644
--- a/dotnet-9.yaml
+++ b/dotnet-9.yaml
@@ -1,6 +1,6 @@
 package:
   name: dotnet-9
-  version: 9.0.0
+  version: 9.0.101
   epoch: 0
   description: ".NET SDK"
   copyright:
@@ -50,7 +50,7 @@ pipeline:
     with:
       repository: https://github.com/dotnet/dotnet
       tag: v${{package.version}}
-      expected-commit: a2bc464e40415d625118f38fbb0556d1803783ff
+      expected-commit: f303476b533b0f90901c0a5e07a3bd2fb68777e3
       destination: /home/build/src
 
   - working-directory: /home/build/src
diff --git a/dynamic-localpv-provisioner.yaml b/dynamic-localpv-provisioner.yaml
index f2c96a3b6c1..adb36db7a85 100644
--- a/dynamic-localpv-provisioner.yaml
+++ b/dynamic-localpv-provisioner.yaml
@@ -1,7 +1,7 @@
 package:
   name: dynamic-localpv-provisioner
-  version: 4.1.1
-  epoch: 1
+  version: 4.1.2
+  epoch: 0
   description: Dynamic Local Volumes for Kubernetes Stateful workloads.
   copyright:
     - license: Apache-2.0
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/openebs/dynamic-localpv-provisioner
       tag: v${{package.version}}
-      expected-commit: 689f5cd6b655adb84a3f94d83bb705259d31c762
+      expected-commit: 86db732d589cbdebb2d53f2a19f8e44430cb345b
 
   - uses: go/bump
     with:
diff --git a/eksctl.yaml b/eksctl.yaml
index 033db322d4a..fdf2693c080 100644
--- a/eksctl.yaml
+++ b/eksctl.yaml
@@ -1,6 +1,6 @@
 package:
   name: eksctl
-  version: 0.194.0
+  version: 0.197.0
   epoch: 0
   description:
   copyright:
@@ -20,7 +20,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/weaveworks/eksctl
-      expected-commit: 02ef28ee3d600082f23020999041d6d816377de3
+      expected-commit: e96028b650e8be3c8d6781f53a2c50523b7ee82f
       tag: v${{package.version}}
 
   - runs: |
diff --git a/envoy-gateway.yaml b/envoy-gateway.yaml
index 2d919e509d5..fc57041abf6 100644
--- a/envoy-gateway.yaml
+++ b/envoy-gateway.yaml
@@ -1,6 +1,6 @@
 package:
   name: envoy-gateway
-  version: 1.2.1
+  version: 1.2.3
   epoch: 0
   description: Manages Envoy Proxy as a Standalone or Kubernetes-based Application Gateway
   copyright:
@@ -14,7 +14,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 1e7263bc05566559a67ed028b633fb3580f61682
+      expected-commit: 9fe25ce67e12e07ae6849a61d24ae0572aead970
       repository: https://github.com/envoyproxy/gateway
       tag: v${{package.version}}
 
diff --git a/envoy-ratelimit.yaml b/envoy-ratelimit.yaml
index f6f9bbc7526..7ca4c54b2c9 100644
--- a/envoy-ratelimit.yaml
+++ b/envoy-ratelimit.yaml
@@ -2,7 +2,7 @@
 package:
   name: envoy-ratelimit
   # This project doesn't do releases and everything is commit based.
-  version: 0.0.0_git20241118
+  version: 0.0.0_git20241202
   epoch: 0
   description: Go/gRPC service designed to enable generic rate limit scenarios from different types of applications.
   copyright:
@@ -16,7 +16,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 0e630f156ae7a3d4198daf971af2e6c595f19a70
+      expected-commit: b9bb97adb5c47dbb34423a8b7f3f7d0b0b5b1960
       repository: https://github.com/envoyproxy/ratelimit
       branch: main
 
diff --git a/eslint.yaml b/eslint.yaml
index 13439c58811..2ada5937ff7 100644
--- a/eslint.yaml
+++ b/eslint.yaml
@@ -1,6 +1,6 @@
 package:
   name: eslint
-  version: 9.15.0
+  version: 9.16.0
   epoch: 0
   description: An AST-based pattern checker for JavaScript
   copyright:
@@ -25,7 +25,7 @@ pipeline:
     with:
       repository: https://github.com/eslint/eslint
       tag: v${{package.version}}
-      expected-commit: 6f37b0747a14dfa9a9e3bdebc5caed1f39b6b0e2
+      expected-commit: cbf7db0ddfa3b789f7ebc27a66993c08a83e72cd
 
   - runs: |
       npm install --omit=dev --legacy-peer-deps
diff --git a/exploitdb.yaml b/exploitdb.yaml
index 11b0d12cadb..a6bb546e790 100644
--- a/exploitdb.yaml
+++ b/exploitdb.yaml
@@ -1,6 +1,6 @@
 package:
   name: exploitdb
-  version: 2024.11.16
+  version: 2024.11.26
   epoch: 0
   description: "the exploit database is an archive of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers"
   copyright:
@@ -24,7 +24,7 @@ pipeline:
     with:
       repository: https://gitlab.com/exploit-database/exploitdb.git
       tag: ${{vars.mangled-package-version}}
-      expected-commit: 773f5f480cc02f596e1015a968513a160757bf61
+      expected-commit: 731ce583a5022b84f6b4527019ad9599ad779d7c
       destination: exploitdb
 
   - runs: |
diff --git a/external-secrets-operator.yaml b/external-secrets-operator.yaml
index 58cd91a21e2..a7ad2eaf165 100644
--- a/external-secrets-operator.yaml
+++ b/external-secrets-operator.yaml
@@ -1,6 +1,6 @@
 package:
   name: external-secrets-operator
-  version: 0.10.7
+  version: 0.11.0
   epoch: 0
   description: Integrate external secret management systems with Kubernetes
   copyright:
@@ -11,7 +11,7 @@ pipeline:
     with:
       repository: https://github.com/external-secrets/external-secrets
       tag: v${{package.version}}
-      expected-commit: dc6be312cf592a294bfe370762856d98de29a64d
+      expected-commit: 0656bf33c5bde3b54afe6c5d21e246e58fb19be7
 
   - uses: go/build
     with:
diff --git a/eza.yaml b/eza.yaml
index 3333eac6b3c..c8f12a0d106 100644
--- a/eza.yaml
+++ b/eza.yaml
@@ -1,7 +1,7 @@
 package:
   name: eza
-  version: 0.20.9
-  epoch: 1
+  version: 0.20.10
+  epoch: 0
   description: "A modern, maintained replacement for ls"
   copyright:
     - license: EUPL-1.2
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/eza-community/eza
       tag: v${{package.version}}
-      expected-commit: 83ca7b3bde7e7d0000953c6e342325de9558ead4
+      expected-commit: 0862493ebded918454f97e7291537ce4e2643711
 
   - runs: |
       cargo fetch
diff --git a/falco-libs.yaml b/falco-libs.yaml
index 0ec45ddf443..6a3e16ed5b8 100644
--- a/falco-libs.yaml
+++ b/falco-libs.yaml
@@ -1,6 +1,6 @@
 package:
   name: falco-libs
-  version: 0.18.2
+  version: 0.19.0
   epoch: 0
   description: Foundational components necessary to build Falco
   copyright:
@@ -55,7 +55,7 @@ pipeline:
     with:
       repository: https://github.com/falcosecurity/libs
       tag: ${{package.version}}
-      expected-commit: a414ad33a20e4adc3d0afd11a2a82a0a73525a3a
+      expected-commit: 55ff79f8823e4c72399d9a3b7a80c9357b36bfcc
 
 data:
   - name: libs
diff --git a/falco.yaml b/falco.yaml
index f7718f6b027..77b75ea34d7 100644
--- a/falco.yaml
+++ b/falco.yaml
@@ -1,7 +1,7 @@
 package:
   name: falco
   version: 0.39.2 # on update check if we can remove the 'Patch falcosecurity-libs' pipeline below if https://github.com/falcosecurity/libs/pull/2079 is merged
-  epoch: 0
+  epoch: 1
   description: Cloud Native Runtime Security
   copyright:
     - license: Apache-2.0
diff --git a/falcosidekick.yaml b/falcosidekick.yaml
index 6f2a7b60a36..0d51f942e05 100644
--- a/falcosidekick.yaml
+++ b/falcosidekick.yaml
@@ -1,7 +1,7 @@
 package:
   name: falcosidekick
-  version: 2.29.0
-  epoch: 4
+  version: 2.30.0
+  epoch: 0
   description: Connect Falco to your ecosystem
   copyright:
     - license: MIT
@@ -18,14 +18,10 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 795594066d60f39e4188f23a10d5620557d99979
+      expected-commit: d4483901926f3ac55d0546fde2b51f1da9dc1aaa
       repository: https://github.com/falcosecurity/falcosidekick
       tag: ${{package.version}}
 
-  - uses: go/bump
-    with:
-      deps: google.golang.org/grpc@v1.64.1
-
   - runs: |
       make falcosidekick RELEASE=${{package.version}}
       mkdir -p ${{targets.destdir}}/usr/bin
diff --git a/file.yaml b/file.yaml
index 76a0394b536..57444f066a1 100644
--- a/file.yaml
+++ b/file.yaml
@@ -1,7 +1,7 @@
 package:
   name: file
-  version: "5.45"
-  epoch: 4
+  version: "5.46"
+  epoch: 0
   description: "file-type identification utility"
   copyright:
     - license: BSD-2-Clause
@@ -29,7 +29,7 @@ pipeline:
     with:
       repository: https://github.com/file/file.git
       tag: FILE${{vars.mangled-package-version}}
-      expected-commit: 4cbd5c8f0851201d203755b76cb66ba991ffd8be
+      expected-commit: c5aa4f7f8d5063fb3c37ad57bf54bb67ec641a09
 
   - runs: |
       autoreconf -vif
diff --git a/filebeat.yaml b/filebeat.yaml
deleted file mode 100644
index c0b6db38c08..00000000000
--- a/filebeat.yaml
+++ /dev/null
@@ -1,79 +0,0 @@
-package:
-  name: filebeat
-  version: 8.16.1
-  epoch: 0
-  description: Filebeat is an open source file harvester, mostly used to fetch logs files and feed them into logstash
-  copyright:
-    - license: Apache-2.0
-  dependencies:
-    runtime:
-      - tini
-
-environment:
-  contents:
-    packages:
-      - build-base
-      - busybox
-      - ca-certificates-bundle
-      - go
-      - make
-      - openssf-compiler-options
-      - python3
-
-pipeline:
-  - uses: git-checkout
-    with:
-      repository: https://github.com/elastic/beats
-      tag: v${{package.version}}
-      expected-commit: f17e0828f1de9f1a256d3f520324fa6da53daee5
-
-  - runs: |
-      cd filebeat
-      export GOBIN="$GOPATH/bin"
-      export PATH=$PATH:$GOPATH/bin
-      go install github.com/mitchellh/gox@latest
-      OS=$(go env GOOS)
-      ARCH=$(go env GOARCH)
-      make GOX_OS=$OS GOX_FLAGS=-arch="$ARCH" crosscompile
-
-      mkdir -p "${{targets.destdir}}"/usr/share/filebeat
-      mkdir -p "${{targets.destdir}}"/usr/bin
-      mkdir -p "${{targets.destdir}}"/usr/local/bin
-      mkdir -p "${{targets.destdir}}"/usr/share/filebeat/modules.d
-      mkdir -p "${{targets.destdir}}"/usr/share/filebeat/module
-
-      cp filebeat.docker.yml "${{targets.destdir}}"/usr/share/filebeat/filebeat.yml
-      cp filebeat.reference.yml "${{targets.destdir}}"/usr/share/filebeat/filebeat.reference.yml
-      mv ../x-pack/filebeat/module/ "${{targets.destdir}}"/usr/share/filebeat/
-      mv ../x-pack/filebeat/modules.d/ "${{targets.destdir}}"/usr/share/filebeat/
-
-      mv build/bin/filebeat-$OS-$ARCH "${{targets.destdir}}"/usr/share/filebeat/filebeat
-      ln -sf /usr/share/filebeat/filebeat ${{targets.destdir}}/usr/bin/filebeat
-
-      mkdir -p "${{targets.destdir}}"/usr/share/filebeat/data "${{targets.destdir}}"/usr/share/filebeat/logs
-
-      chown -R root:root "${{targets.destdir}}"/usr/share/filebeat && \
-        find "${{targets.destdir}}"/usr/share/filebeat -type d -exec chmod 0755 {} \; && \
-        find "${{targets.destdir}}"/usr/share/filebeat -type f -exec chmod 0644 {} \; && \
-        chmod 0755 "${{targets.destdir}}"/usr/share/filebeat/filebeat && \
-        chmod 0775 "${{targets.destdir}}"/usr/share/filebeat/modules.d && \
-        chmod 0775 "${{targets.destdir}}"/usr/share/filebeat/data "${{targets.destdir}}"/usr/share/filebeat/logs
-
-      sed 's/{{ \.BeatName }}/${{package.name}}/g' ../dev-tools/packaging/templates/docker/docker-entrypoint.tmpl > "${{targets.destdir}}"/usr/local/bin/docker-entrypoint
-      chmod 755 "${{targets.destdir}}"/usr/local/bin/docker-entrypoint
-
-  - uses: strip
-
-update:
-  enabled: true
-  github:
-    strip-prefix: v
-    identifier: elastic/beats
-
-test:
-  pipeline:
-    - runs: |
-        filebeat version
-        cd /usr/share/filebeat
-        filebeat modules list
-        filebeat --help
diff --git a/firefox.yaml b/firefox.yaml
index 8725684f61d..ccf753c8854 100644
--- a/firefox.yaml
+++ b/firefox.yaml
@@ -1,6 +1,6 @@
 package:
   name: firefox
-  version: 132.0.2
+  version: "133.0"
   epoch: 0
   description: Firefox web browser
   copyright:
diff --git a/fluent-bit-3.2.yaml b/fluent-bit-3.2.yaml
index 28521b44237..1b54138f70a 100644
--- a/fluent-bit-3.2.yaml
+++ b/fluent-bit-3.2.yaml
@@ -1,6 +1,6 @@
 package:
   name: fluent-bit-3.2
-  version: 3.2.1
+  version: 3.2.2
   epoch: 0
   description: Fast and Lightweight Log processor and forwarder
   copyright:
@@ -35,7 +35,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/fluent/fluent-bit
-      expected-commit: 600b5a955b5ef7b9d025e0c128432260d0c6a5f1
+      expected-commit: a59c8679248b26bec81ed653306996d93b6e711c
       tag: v${{package.version}}
 
   - runs: |
diff --git a/fluent-operator.yaml b/fluent-operator.yaml
index 163b58b501b..ea8ec06a511 100644
--- a/fluent-operator.yaml
+++ b/fluent-operator.yaml
@@ -1,7 +1,7 @@
 package:
   name: fluent-operator
   version: 3.2.0
-  epoch: 1
+  epoch: 3
   description: Operate Fluent Bit and Fluentd in the Kubernetes way - Previously known as FluentBit Operator
   copyright:
     - license: Apache-2.0
@@ -11,6 +11,16 @@ environment:
     packages:
       - go
 
+var-transforms:
+  - from: ${{package.version}}
+    match: ^(\d)\.(\d)\.(\d)$
+    replace: $1
+    to: fluent-major-version
+  - from: ${{package.version}}
+    match: ^(\d)\.(\d)\.(\d)$
+    replace: $2
+    to: fluent-minor-version
+
 pipeline:
   - uses: git-checkout
     with:
@@ -70,7 +80,7 @@ subpackages:
         # When this test fails, that likely means fluent-bit rolled forward to
         # a new version stream anad must be updated in the "replaces" block
         # below
-        - fluent-bit-3.1
+        - fluent-bit-${{vars.fluent-major-version}}.${{vars.fluent-minor-version}}
     pipeline:
       - runs: |
           mkdir -p "${{targets.contextdir}}"/fluent-bit/etc
diff --git a/fluent-plugin-detect-exceptions.yaml b/fluent-plugin-detect-exceptions.yaml
index 436470da357..36ab60bbc12 100644
--- a/fluent-plugin-detect-exceptions.yaml
+++ b/fluent-plugin-detect-exceptions.yaml
@@ -1,7 +1,7 @@
 package:
   name: fluent-plugin-detect-exceptions
-  version: 0.0.15
-  epoch: 4
+  version: 0.0.16
+  epoch: 0
   description: Fluentd output plugin which detects exception stack traces in a stream of JSON log messages and combines all single-line messages that belong to the same stack trace into one multi-line message. This is an official Google Ruby gem.
   copyright:
     - license: Apache-2.0
@@ -24,7 +24,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: fcaeb43ed5248df533d270ceae60c94c6f2e6174
+      expected-commit: 09e07e7fe431017a3a3491c544ab994bc86d0676
       repository: https://github.com/GoogleCloudPlatform/fluent-plugin-detect-exceptions
       tag: ${{package.version}}
 
diff --git a/fluent-plugin-label-router.yaml b/fluent-plugin-label-router.yaml
index b057048d446..a8cf7bd1a8f 100644
--- a/fluent-plugin-label-router.yaml
+++ b/fluent-plugin-label-router.yaml
@@ -1,7 +1,8 @@
+#nolint:valid-pipeline-git-checkout-tag
 package:
   name: fluent-plugin-label-router
-  version: "0.2.10_git20230928"
-  epoch: 6
+  version: 0.4.0_git20241204
+  epoch: 0
   description: Label-Router helps routing log messages based on their labels and namespace tag in a Kubernetes environment.
   copyright:
     - license: Apache-2.0
@@ -23,26 +24,34 @@ environment:
       - ruby-3.2-dev
 
 pipeline:
-  # Hack until they cut a release
-  - runs: |
-      git clone https://github.com/kube-logging/fluent-plugin-label-router
-      cd fluent-plugin-label-router
-      git checkout 695d289f3b170d4739e79b21ce062700b10acf16
-
-  - working-directory: fluent-plugin-label-router
-    pipeline:
-      - uses: ruby/build
-        with:
-          gem: ${{vars.gem}}
-      - uses: ruby/install
-        with:
-          gem: ${{vars.gem}}
-          # Hard-coding the version here to match with gemspec till they come with a release/tag
-          version: 0.2.10
-      - uses: ruby/clean
+  - uses: git-checkout
+    with:
+      expected-commit: 9ed269cc6e7eced5d91737ff5cb5e4519f50ba22
+      repository: https://github.com/kube-logging/fluent-plugin-label-router
+      branch: master
+
+  - uses: ruby/build
+    with:
+      gem: ${{vars.gem}}
+
+  - uses: ruby/install
+    with:
+      gem: ${{vars.gem}}
+      version: 0.4.0
+
+  - uses: ruby/clean
 
 vars:
   gem: fluent-plugin-label-router
 
 update:
-  enabled: false
+  enabled: true
+  schedule:
+    period: daily
+    reason: Upstream does not maintain tags or releases
+  git: {}
+
+test:
+  pipeline:
+    - runs: |
+        ruby -e "require 'fluent/plugin/out_label_router.rb'"
diff --git a/fluent-plugin-tag-normaliser.yaml b/fluent-plugin-tag-normaliser.yaml
index bcaed8ccd4b..a0efa2534cb 100644
--- a/fluent-plugin-tag-normaliser.yaml
+++ b/fluent-plugin-tag-normaliser.yaml
@@ -1,7 +1,7 @@
 #nolint:valid-pipeline-git-checkout-tag
 package:
   name: fluent-plugin-tag-normaliser
-  version: 0_git20241124
+  version: 0_git20241204
   epoch: 0
   description: Tag-normaliser is a `fluentd` plugin to help re-tag logs with Kubernetes metadata. It uses special placeholders to change tag.
   copyright:
diff --git a/flux-2.4.yaml b/flux-2.4.yaml
new file mode 100644
index 00000000000..7b343682d31
--- /dev/null
+++ b/flux-2.4.yaml
@@ -0,0 +1,59 @@
+package:
+  name: flux-2.4
+  version: 2.4.0
+  epoch: 0
+  description: Open and extensible continuous delivery solution for Kubernetes. Powered by GitOps Toolkit.
+  copyright:
+    - license: Apache-2.0
+
+environment:
+  contents:
+    packages:
+      - bash
+      - build-base
+      - busybox
+      - ca-certificates-bundle
+      - curl
+      - git
+      - go
+      - kustomize
+
+pipeline:
+  - uses: git-checkout
+    with:
+      expected-commit: 5350425cdcd5fa015337e09fa502153c0275bd4b
+      repository: https://github.com/fluxcd/flux2
+      tag: v${{package.version}}
+
+  - runs: |
+      mkdir -p "${{targets.destdir}}"/usr/bin
+      VERSION=${{package.version}} make build
+      install -Dm755 bin/flux ${{targets.destdir}}/usr/bin/flux
+
+  - runs: |
+      ${{targets.destdir}}/usr/bin/flux version --client| grep "flux: v${{package.version}}"
+
+  - uses: strip
+
+subpackages:
+  - name: "${{package.name}}-compat"
+    description: "Compatibility package to place binaries in the location expected by upstream helm charts"
+    pipeline:
+      - runs: |
+          # The helm chart expects the flux binaries to be in /usr/local/bin instead of /usr/bin
+          mkdir -p "${{targets.subpkgdir}}"/usr/local/bin
+          ln -sf /usr/bin/flux ${{targets.subpkgdir}}/usr/local/bin/flux
+
+update:
+  enabled: true
+  github:
+    identifier: fluxcd/flux2
+    strip-prefix: v
+    tag-filter: v2.4.
+
+test:
+  pipeline:
+    # AUTOGENERATED
+    - runs: |
+        flux --version
+        flux --help
diff --git a/font-padauk.yaml b/font-padauk.yaml
index 8a28a6ae1c2..97025a4d58f 100644
--- a/font-padauk.yaml
+++ b/font-padauk.yaml
@@ -1,6 +1,6 @@
 package:
   name: font-padauk
-  version: 5.001
+  version: "5.100"
   epoch: 0
   description: Padauk pan Myanmar font
   copyright:
@@ -25,7 +25,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/silnrsi/font-padauk
-      expected-commit: 278b8efb03c0ca0d7f29fb3edc1f52489ebb384f
+      expected-commit: a84fd3c83bc6e6ec120ca0a24b726c6e19e26bb1
       tag: v${{package.version}}
 
   - runs: |
diff --git a/freerdp.yaml b/freerdp.yaml
index cc6fa027897..e922e4d4568 100644
--- a/freerdp.yaml
+++ b/freerdp.yaml
@@ -1,7 +1,7 @@
 package:
   name: freerdp
   version: 2.11.7
-  epoch: 3
+  epoch: 4
   description: FreeRDP client
   copyright:
     - license: Apache-2.0
@@ -96,6 +96,9 @@ subpackages:
       runtime:
         - freerdp
     description: freerdp dev
+    test:
+      pipeline:
+        - uses: test/pkgconf
 
   - name: freerdp-libs
     pipeline:
diff --git a/gcc.yaml b/gcc.yaml
index 43ed9cc3b78..5ad0c7f7e46 100644
--- a/gcc.yaml
+++ b/gcc.yaml
@@ -1,7 +1,7 @@
 package:
   name: gcc
   version: 14.2.0
-  epoch: 5
+  epoch: 6
   description: "the GNU compiler collection"
   copyright:
     - license: GPL-3.0-or-later WITH GCC-exception-3.1
@@ -11,6 +11,7 @@ package:
   dependencies:
     runtime:
       - binutils
+      - libquadmath # This is a temporary workaround for issues with single-arch packages.
       - libstdc++-dev
       - openssf-compiler-options
       - posix-cc-wrappers
diff --git a/gh.yaml b/gh.yaml
index b096be0ae03..984ae5bc609 100644
--- a/gh.yaml
+++ b/gh.yaml
@@ -1,6 +1,6 @@
 package:
   name: gh
-  version: 2.62.0
+  version: 2.63.1
   epoch: 0
   description: GitHub's official command line tool
   copyright:
@@ -18,7 +18,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: cd3f2ad064fbeca17d330e321fef0591eaa0fea5
+      expected-commit: 1136764c369aaf0cae4ec2ee09dc35d871076932
       repository: https://github.com/cli/cli
       tag: v${{package.version}}
 
diff --git a/git-lfs.yaml b/git-lfs.yaml
index 9ddaae37778..5a55d111cd1 100644
--- a/git-lfs.yaml
+++ b/git-lfs.yaml
@@ -1,13 +1,20 @@
 package:
   name: git-lfs
   version: 3.6.0
-  epoch: 0
+  epoch: 2
   description: "large file support for git"
   copyright:
     - license: MIT
   dependencies:
     runtime:
       - git
+  scriptlets:
+    post-install: |
+      #!/bin/sh
+      git-lfs install --skip-repo --system
+    pre-deinstall: |
+      #!/bin/sh
+      git lfs uninstall --skip-repo --system
 
 pipeline:
   - uses: git-checkout
@@ -22,6 +29,18 @@ pipeline:
       packages: .
       output: git-lfs
 
+subpackages:
+  - name: git-lfs-config
+    description: system wide git-lfs config
+    dependencies:
+      runtime:
+        - git-lfs
+    pipeline:
+      - runs: |
+          ${{targets.destdir}}/usr/bin/git-lfs install --skip-repo --system
+          mkdir -p ${{targets.subpkgdir}}/etc/
+          cp /etc/gitconfig ${{targets.subpkgdir}}/etc/gitconfig
+
 update:
   enabled: true
   github:
diff --git a/git.yaml b/git.yaml
index 0463eea46d4..8049e9c45af 100644
--- a/git.yaml
+++ b/git.yaml
@@ -1,6 +1,6 @@
 package:
   name: git
-  version: 2.47.0
+  version: 2.47.1
   epoch: 0
   description: "distributed version control system"
   copyright:
@@ -26,13 +26,13 @@ pipeline:
   - uses: fetch
     with:
       uri: https://www.kernel.org/pub/software/scm/git/git-${{package.version}}.tar.xz
-      expected-sha256: 1ce114da88704271b43e027c51e04d9399f8c88e9ef7542dae7aebae7d87bc4e
+      expected-sha256: f3d8f9bb23ae392374e91cd9d395970dabc5b9c5ee72f39884613cd84a6ed310
 
   - uses: fetch
     working-directory: /home/build/git-manpages
     with:
       uri: https://www.kernel.org/pub/software/scm/git/git-manpages-${{package.version}}.tar.xz
-      expected-sha256: c8dfefa07bddc9e5c2aa48ff03e80a3461d9baa45f46b17b1a43c8e132b1fab8
+      expected-sha256: ffc2005a89b056c0727b667f6beda0068371619762ea4844ad0229091befee13
 
   - runs: |
       cat >> config.mak <<-EOF
diff --git a/gitaly-17.5.yaml b/gitaly-17.6.yaml
similarity index 96%
rename from gitaly-17.5.yaml
rename to gitaly-17.6.yaml
index 0bd64484c3e..391edab5828 100644
--- a/gitaly-17.5.yaml
+++ b/gitaly-17.6.yaml
@@ -1,6 +1,6 @@
 package:
-  name: gitaly-17.5
-  version: 17.5.2
+  name: gitaly-17.6
+  version: 17.6.1
   epoch: 0
   description:
   copyright:
@@ -36,7 +36,7 @@ pipeline:
     with:
       repository: https://gitlab.com/gitlab-org/gitaly.git
       tag: v${{package.version}}
-      expected-commit: cdf74a7601c8b2902eab0e674f9ec656b9929191
+      expected-commit: 8ff903b7156a5402d72f354dfa37696d00ef5ed6
 
   - runs: |
       make install DESTDIR="${{targets.destdir}}" PREFIX=/usr
@@ -105,7 +105,7 @@ update:
   enabled: true
   git:
     strip-prefix: v
-    tag-filter-prefix: v17.5
+    tag-filter-prefix: v17.6
 
 test:
   pipeline:
diff --git a/gitea.yaml b/gitea.yaml
index c0bbc44afed..1000ea328f0 100644
--- a/gitea.yaml
+++ b/gitea.yaml
@@ -1,7 +1,7 @@
 package:
   name: gitea
-  version: 1.22.3
-  epoch: 2
+  version: 1.22.4
+  epoch: 0
   description: self-hosted git service
   copyright:
     - license: MIT
@@ -19,7 +19,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 494017e4788d6defb5610ac68b9733fef5130f46
+      expected-commit: 293355777f334f9c3f09c2a19932f52253951298
       repository: https://github.com/go-gitea/gitea
       tag: v${{package.version}}
 
diff --git a/gitlab-kas-17.5.yaml b/gitlab-kas-17.5.yaml
index 843d8aefe0e..2757f3be01f 100644
--- a/gitlab-kas-17.5.yaml
+++ b/gitlab-kas-17.5.yaml
@@ -1,6 +1,6 @@
 package:
   name: gitlab-kas-17.5
-  version: 17.5.2
+  version: 17.5.3
   epoch: 0
   description: GitLab KAS is a component installed together with GitLab. It is required to manage the GitLab agent for Kubernetes.
   copyright:
@@ -20,7 +20,7 @@ pipeline:
     with:
       repository: https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent
       tag: v${{package.version}}
-      expected-commit: 847d7deea3b9937a8824fe8e783fd142ba426d8f
+      expected-commit: 08f9a6ed41a4f5e348ffefa87e5694a7c3dccb79
 
   - uses: go/build
     with:
diff --git a/gitlab-pages-17.5.yaml b/gitlab-pages-17.5.yaml
index 4944626fd4c..3f56e71b5fc 100644
--- a/gitlab-pages-17.5.yaml
+++ b/gitlab-pages-17.5.yaml
@@ -1,6 +1,6 @@
 package:
   name: gitlab-pages-17.5
-  version: 17.5.2
+  version: 17.5.3
   epoch: 0
   description: GitLab Pages daemon used to serve static websites for GitLab users.
   copyright:
@@ -20,7 +20,7 @@ pipeline:
     with:
       repository: https://gitlab.com/gitlab-org/gitlab-pages.git
       tag: v${{package.version}}
-      expected-commit: 086dfbdfe2337874e342b48dba5508b7d3f59626
+      expected-commit: 00734497b120604ef91ef6c45b2b72c806f34d94
 
   - uses: go/build
     with:
diff --git a/glab.yaml b/glab.yaml
index 06915c0b95e..1bc7045fb5c 100644
--- a/glab.yaml
+++ b/glab.yaml
@@ -4,7 +4,7 @@
 #nolint:git-checkout-must-use-github-updates
 package:
   name: glab
-  version: 1.49.0
+  version: 1.50.0
   epoch: 0
   description: A GitLab CLI tool bringing GitLab to your command line
   copyright:
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://gitlab.com/gitlab-org/cli
       tag: v${{package.version}}
-      expected-commit: 3e70664b62c2a06c5b1fced624612a99fc58a2ed
+      expected-commit: 2f23daa519be7cdd2562255235f6b1ad0da1931d
 
   - uses: go/build
     with:
diff --git a/go-1.22.yaml b/go-1.22.yaml
index 2735a9fc1c0..c09390994f9 100644
--- a/go-1.22.yaml
+++ b/go-1.22.yaml
@@ -1,6 +1,6 @@
 package:
   name: go-1.22
-  version: 1.22.9
+  version: 1.22.10
   epoch: 0
   description: "the Go programming language"
   copyright:
@@ -34,7 +34,7 @@ pipeline:
     with:
       repository: https://github.com/golang/go
       tag: go${{package.version}}
-      expected-commit: 8af39d30a4c4cf68d566345f26224c191960d9b0
+      expected-commit: 8f3f22eef807250155301822a8960afec160cc02
 
   - uses: patch
     with:
diff --git a/go-1.23.yaml b/go-1.23.yaml
index 60dca9bd9f8..739d9388330 100644
--- a/go-1.23.yaml
+++ b/go-1.23.yaml
@@ -1,7 +1,7 @@
 package:
   name: go-1.23
-  version: 1.23.3
-  epoch: 1
+  version: 1.23.4
+  epoch: 0
   description: "the Go programming language"
   copyright:
     - license: BSD-3-Clause
@@ -34,7 +34,7 @@ pipeline:
     with:
       repository: https://github.com/golang/go
       tag: go${{package.version}}
-      expected-commit: c390a1c22e8951263e6c01346a4281d604b25062
+      expected-commit: 194de8fbfaf4c3ed54e1a3c1b14fc67a830b8d95
 
   - uses: patch
     with:
diff --git a/go-discover.yaml b/go-discover.yaml
index fddabdd0065..d12d84b3bc5 100644
--- a/go-discover.yaml
+++ b/go-discover.yaml
@@ -1,7 +1,7 @@
 #nolint:valid-pipeline-git-checkout-tag
 package:
   name: go-discover
-  version: 0_git20241124
+  version: 0_git20241204
   epoch: 0
   description: go-discover is a Go (golang) library and command line tool to discover ip addresses of nodes in cloud environments based on meta information like tags provided by the environment.
   copyright:
diff --git a/golangci-lint.yaml b/golangci-lint.yaml
index 2fd33bd482a..2b05f02472a 100644
--- a/golangci-lint.yaml
+++ b/golangci-lint.yaml
@@ -1,6 +1,6 @@
 package:
   name: golangci-lint
-  version: 1.62.0
+  version: 1.62.2
   epoch: 0
   description: Fast linters Runner for Go
   copyright:
@@ -23,7 +23,7 @@ pipeline:
     with:
       repository: https://github.com/golangci/golangci-lint
       tag: v${{package.version}}
-      expected-commit: 22b58c9b648f027d699f305c069a2a97ed0c5b06
+      expected-commit: 89476e7a1eaa0a8a06c17343af960a5fd9e7edb7
 
   - runs: |
       make build
diff --git a/grafana-alloy.yaml b/grafana-alloy.yaml
index 325564f1dd6..b8bb4a0ba82 100644
--- a/grafana-alloy.yaml
+++ b/grafana-alloy.yaml
@@ -1,6 +1,6 @@
 package:
   name: grafana-alloy
-  version: 1.5.0
+  version: 1.5.1
   epoch: 0
   description: OpenTelemetry Collector distribution with programmable pipelines
   copyright:
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/grafana/alloy
       tag: v${{package.version}}
-      expected-commit: 3a39c06613073f2cc76dab03c7cf8210569871e9
+      expected-commit: dc8a365f875da905e3e6070b279f1a41ce9db885
 
   - name: Generate UI
     runs: make generate-ui
diff --git a/grafana-image-renderer.yaml b/grafana-image-renderer.yaml
index faf448568cd..85f1e98f181 100644
--- a/grafana-image-renderer.yaml
+++ b/grafana-image-renderer.yaml
@@ -1,7 +1,7 @@
 package:
   name: grafana-image-renderer
   version: 3.11.6
-  epoch: 0
+  epoch: 1
   description: A Grafana backend plugin that handles rendering of panels & dashboards to PNGs using headless browser (Chromium/Chrome)
   copyright:
     - license: Apache-2.0
@@ -9,6 +9,7 @@ package:
     - x86_64
   dependencies:
     runtime:
+      - busybox
       - chromium
       - dumb-init
       - nodejs
@@ -22,7 +23,6 @@ environment:
       - nodejs
       - scanelf
       - ttf-dejavu
-      - vim
       - yarn
 
 pipeline:
@@ -47,7 +47,7 @@ pipeline:
       cp -r ./proto ${{targets.destdir}}/usr/src/app/
       cp -r ./build ${{targets.destdir}}/usr/src/app/
       cp -r ./node_modules ${{targets.destdir}}/usr/src/app/
-      cp ./devenv/docker/custom-config/config.json ${{targets.destdir}}/usr/src/app/
+      cp ./default.json ${{targets.destdir}}/usr/src/app/config.json
       cp ./plugin.json ${{targets.destdir}}/usr/src/app/
 
 update:
@@ -62,7 +62,7 @@ test:
       working-directory: /usr/src/app
       uses: test/daemon-check-output
       with:
-        start: "env CHROME_BIN=/usr/bin/chromium-browser dumb-init -- node build/app.js server --config=config.json"
+        start: "dumb-init -- node build/app.js server --config=config.json"
         timeout: 5
         expected_output: |
           {"level":"info","message":"HTTP Server started, listening at http://localhost:8081"}
diff --git a/grafana-rollout-operator-0.14.yaml b/grafana-rollout-operator-0.14.yaml
deleted file mode 100644
index cbad96ad60f..00000000000
--- a/grafana-rollout-operator-0.14.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-package:
-  name: grafana-rollout-operator-0.14
-  version: 0.14.0
-  epoch: 4
-  description: Kubernetes Rollout Operator
-  copyright:
-    - license: Apache-2.0
-  dependencies:
-    provides:
-      - grafana-rollout-operator=${{package.full-version}}
-
-environment:
-  contents:
-    packages:
-      - build-base
-      - go
-  environment:
-    CGO_ENABLED: 0
-
-pipeline:
-  - uses: git-checkout
-    with:
-      repository: https://github.com/grafana/rollout-operator
-      tag: v${{package.version}}
-      expected-commit: 4dfc90339440982d07065cad294b32d9ba77e8ae
-
-  - uses: go/bump
-    with:
-      deps: golang.org/x/net@v0.23.0 google.golang.org/protobuf@v1.33.0
-
-  - uses: go/build
-    with:
-      modroot: .
-      packages: ./cmd/rollout-operator
-      output: rollout-operator
-      ldflags: '-extldflags "-static"'
-      go-package: go
-
-  - name: hardlinks
-    runs: |
-      mkdir -p ${{targets.contextdir}}/bin
-      ln -sf /usr/bin/rollout-operator ${{targets.contextdir}}/bin/rollout-operator
-
-  - uses: strip
-
-test:
-  pipeline:
-    - runs: |
-        rollout-operator --help
-
-update:
-  enabled: true
-  github:
-    identifier: grafana/rollout-operator
-    strip-prefix: v
-    use-tag: true
-    tag-filter: v0.14.
diff --git a/grafana-rollout-operator.yaml b/grafana-rollout-operator.yaml
new file mode 100644
index 00000000000..5529e1f3117
--- /dev/null
+++ b/grafana-rollout-operator.yaml
@@ -0,0 +1,38 @@
+package:
+  name: grafana-rollout-operator
+  version: 0.21.0
+  epoch: 0
+  description: Kubernetes Rollout Operator
+  copyright:
+    - license: Apache-2.0
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/grafana/rollout-operator
+      tag: v${{package.version}}
+      expected-commit: b1e8ac46d861e1759d321c91404e593a1db8ea39
+
+  - uses: go/build
+    with:
+      packages: ./cmd/rollout-operator
+      output: rollout-operator
+
+subpackages:
+  - name: ${{package.name}}-compat
+    description: "upstream image have executable placed at /bin"
+    pipeline:
+      - runs: |
+          mkdir -p ${{targets.contextdir}}/bin
+          ln -sf /usr/bin/rollout-operator ${{targets.contextdir}}/bin/rollout-operator
+
+test:
+  pipeline:
+    - runs: |
+        rollout-operator --help
+
+update:
+  enabled: true
+  github:
+    identifier: grafana/rollout-operator
+    strip-prefix: v
diff --git a/graphene.yaml b/graphene.yaml
index 7cead64590d..816f1c83bff 100644
--- a/graphene.yaml
+++ b/graphene.yaml
@@ -2,7 +2,7 @@
 package:
   name: graphene
   version: 1.10.8
-  epoch: 2
+  epoch: 3
   description: A thin layer of graphic data types
   copyright:
     - license: MIT
@@ -44,6 +44,9 @@ subpackages:
       runtime:
         - graphene
     description: graphene dev
+    test:
+      pipeline:
+        - uses: test/pkgconf
 
 update:
   enabled: true
diff --git a/grpc-1.66.yaml b/grpc-1.66.yaml
index c305e4a7831..b91d819ed78 100644
--- a/grpc-1.66.yaml
+++ b/grpc-1.66.yaml
@@ -1,7 +1,7 @@
 package:
   name: grpc-1.66
   version: 1.66.2
-  epoch: 0
+  epoch: 1
   description: The C based gRPC
   copyright:
     - license: Apache-2.0 AND BSD-3-Clause AND MIT
@@ -51,6 +51,9 @@ environment:
       - xxhash-dev
       - yaml-dev
       - zlib-dev
+  environment:
+    # https://github.com/wolfi-dev/os/issues/34568
+    GCC_SPEC_FILE: /dev/null
 
 pipeline:
   - uses: git-checkout
diff --git a/grpc-1.67.yaml b/grpc-1.67.yaml
index f7fe1a2bfc6..85c8cbdf562 100644
--- a/grpc-1.67.yaml
+++ b/grpc-1.67.yaml
@@ -1,7 +1,7 @@
 package:
   name: grpc-1.67
   version: 1.67.1
-  epoch: 1
+  epoch: 2
   description: The C based gRPC
   copyright:
     - license: Apache-2.0 AND BSD-3-Clause AND MIT
diff --git a/grpc-1.68.yaml b/grpc-1.68.yaml
new file mode 100644
index 00000000000..0158b7ccb89
--- /dev/null
+++ b/grpc-1.68.yaml
@@ -0,0 +1,165 @@
+package:
+  name: grpc-1.68
+  version: 1.68.2
+  epoch: 0
+  description: The C based gRPC
+  copyright:
+    - license: Apache-2.0 AND BSD-3-Clause AND MIT
+  resources:
+    cpu: 24
+    memory: 24Gi
+  dependencies:
+    provides:
+      - grpc=${{package.full-version}}
+
+var-transforms:
+  - from: ${{package.version}}
+    match: ^(\d+\.\d+)\.\d+$
+    replace: "$1"
+    to: major-minor-version
+
+vars:
+  pypi-package: grpcio
+  import: grpc
+
+data:
+  - name: py-versions
+    items:
+      3.10: '310'
+      3.11: '311'
+      3.12: '312'
+      3.13: '300'
+
+environment:
+  contents:
+    packages:
+      - abseil-cpp-dev
+      - autoconf
+      - automake
+      - benchmark-dev
+      - build-base
+      - busybox
+      - c-ares-dev
+      - ca-certificates-bundle
+      - chrpath
+      - cmake
+      - curl
+      - icu-dev
+      - libstdc++-dev
+      - libsystemd
+      - libtool
+      - linux-headers
+      - openssl-dev
+      - protobuf-dev
+      - py3-supported-build-base
+      - py3-supported-cython
+      - py3-supported-python-dev
+      - python3
+      - re2
+      - re2-dev
+      - samurai
+      - systemd-dev
+      - wolfi-base
+      - xxhash-dev
+      - yaml-dev
+      - zlib-dev
+  environment:
+    # https://github.com/wolfi-dev/os/issues/34568
+    GCC_SPEC_FILE: /dev/null
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/grpc/grpc
+      tag: v${{package.version}}
+      expected-commit: 859bc5216ba3955fb8925326bdec391fd93c8730
+
+  - runs: |
+      cd third_party
+      git submodule update --init --recursive
+
+  - runs: |
+      mkdir -p "${{targets.destdir}}"/usr/share/doc/grpc
+      cmake -B _build -G Ninja \
+      	-DCMAKE_BUILD_TYPE=None \
+      	-DCMAKE_INSTALL_PREFIX=/usr \
+      	-DCMAKE_CXX_STANDARD=17 \
+      	-DBUILD_SHARED_LIBS=True \
+      	-DgRPC_INSTALL=ON \
+      	-DgRPC_CARES_PROVIDER=package \
+      	-DgRPC_SSL_PROVIDER=package \
+      	-DgRPC_ZLIB_PROVIDER=package \
+        -DgRPC_PROTOBUF_PROVIDER=package \
+      	-DgRPC_ABSL_PROVIDER=package \
+        -DgRPC_RE2_PROVIDER=package \
+      	-DgRPC_BENCHMARK_PROVIDER=package \
+      	-DgRPC_BACKWARDS_COMPATIBILITY_MODE=OFF \
+      	-DgRPC_BUILD_TESTS=OFF
+      cmake --build _build
+
+  - runs: |
+      DESTDIR="${{targets.destdir}}" cmake --install _build
+      python3 setup.py install --skip-build --root="${{targets.destdir}}"
+      cd doc
+      find ./ -type f -print -exec install -Dm644 {} "${{targets.destdir}}"/usr/share/doc/grpc/{} \;
+      rm "${{targets.destdir}}"/usr/share/doc/grpc/.gitignore
+      find "${{targets.destdir}}" -type f -name roots.pem -exec \
+      sh -c 'rm $0 && ln -s /etc/ssl/certs/ca-certificates.crt $0' "{}" \;
+
+subpackages:
+  - range: py-versions
+    name: py${{range.key}}-grpcio-${{vars.major-minor-version}}
+    description: python${{range.key}} version of grpcio
+    dependencies:
+      provider-priority: ${{range.value}}
+      provides:
+        - py3-grpcio-${{vars.major-minor-version}}
+        - py3-grpcio
+        - py${{range.key}}-grpcio
+    pipeline:
+      - uses: py/pip-build-install
+        environment:
+          GRPC_PYTHON_CFLAGS: "-std=c++17"
+          GRPC_PYTHON_DISABLE_LIBC_COMPATIBILITY: "1"
+          GRPC_PYTHON_BUILD_SYSTEM_CARES: "1"
+          GRPC_PYTHON_BUILD_SYSTEM_OPENSSL: "1"
+          GRPC_PYTHON_BUILD_SYSTEM_ZLIB: "1"
+          GRPC_PYTHON_BUILD_SYSTEM_RE2: "1"
+          GRPC_PYTHON_BUILD_SYSTEM_ABSL: "1"
+        with:
+          python: python${{range.key}}
+      - uses: strip
+    test:
+      pipeline:
+        - uses: python/import
+          with:
+            python: python${{range.key}}
+            imports: |
+              import ${{vars.import}}
+
+  - name: py3-supported-grpcio-${{vars.major-minor-version}}
+    description: meta package providing ${{vars.pypi-package}} for supported python versions.
+    dependencies:
+      runtime:
+        - py3.10-grpcio-${{vars.major-minor-version}}
+        - py3.11-grpcio-${{vars.major-minor-version}}
+        - py3.12-grpcio-${{vars.major-minor-version}}
+        - py3.13-grpcio-${{vars.major-minor-version}}
+
+  - name: ${{package.name}}-dev
+    pipeline:
+      - uses: split/dev
+    dependencies:
+      runtime:
+        - ${{package.name}}
+      provides:
+        - grpc-dev=${{package.full-version}}
+    description: grpc dev
+
+update:
+  enabled: true
+  github:
+    identifier: grpc/grpc
+    strip-prefix: v
+    use-tag: true
+    tag-filter-prefix: v1.68.
diff --git a/grpcurl.yaml b/grpcurl.yaml
index b98ca6ee10f..97ee5582724 100644
--- a/grpcurl.yaml
+++ b/grpcurl.yaml
@@ -1,7 +1,7 @@
 package:
   name: grpcurl
-  version: 1.9.1
-  epoch: 6
+  version: 1.9.2
+  epoch: 0
   description: CLI tool to interact with gRPC servers
   copyright:
     - license: MIT
@@ -22,14 +22,10 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 400fa5f2d354f662c2e39c8b1f8ef71f50498075
+      expected-commit: b9a11e9fea796d968e2dd83573312ead4b6fd831
       repository: https://github.com/fullstorydev/grpcurl
       tag: v${{package.version}}
 
-  - uses: go/bump
-    with:
-      deps: golang.org/x/net@v0.23.0 google.golang.org/grpc@v1.61.0 google.golang.org/protobuf@v1.33.1-0.20240408130810-98873a205002
-
   - uses: go/build
     with:
       packages: ./cmd/grpcurl
diff --git a/gst-plugins-bad.yaml b/gst-plugins-bad.yaml
index bdf33927759..c0364046fdb 100644
--- a/gst-plugins-bad.yaml
+++ b/gst-plugins-bad.yaml
@@ -1,7 +1,7 @@
 package:
   name: gst-plugins-bad
-  version: 1.24.9
-  epoch: 1
+  version: 1.24.10
+  epoch: 0
   description: GStreamer streaming media framework bad plug-ins
   copyright:
     - license: GPL-2.0-or-later AND LGPL-2.0-or-later
@@ -47,7 +47,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 36fcf7a9af0a753b43bb03b9835246f74d72f7124369e66a1e2dc7b04f5a5cab
+      expected-sha256: 1707e3103950c9baed364a8af2ba0495d6b113fcd36e1062dda5f582b8f8904d
       uri: https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad-${{package.version}}.tar.xz
 
   - uses: meson/configure
diff --git a/gst-plugins-base.yaml b/gst-plugins-base.yaml
index 8914c2d4381..32111d8d979 100644
--- a/gst-plugins-base.yaml
+++ b/gst-plugins-base.yaml
@@ -1,7 +1,7 @@
 package:
   name: gst-plugins-base
-  version: 1.24.9
-  epoch: 2
+  version: 1.24.10
+  epoch: 0
   description: GStreamer streaming media framework base plug-ins
   copyright:
     - license: GPL-2.0-or-later AND LGPL-2.0-or-later
@@ -47,7 +47,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha512: 242f248010b90f5a38c0df3b6b2fb6af15554391c4073c74a2b325e650dd61077de340cb1732e07fdbd339e3fb9737276ebe044f759eebeb7dbf73548f88a2fd
+      expected-sha512: d5eae27c70999fd3a02294354a30e24d82ee9a7920e2e5f6bf63fcd8a321c7541dbbd402dbcee7c44ba4a67f9e5b0b264d28e295b91ccf67ce577c613f427244
       uri: https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-${{package.version}}.tar.xz
 
   - uses: meson/configure
diff --git a/gstreamer.yaml b/gstreamer.yaml
index ae751bae34d..633290204af 100644
--- a/gstreamer.yaml
+++ b/gstreamer.yaml
@@ -1,7 +1,7 @@
 # Generated from https://git.alpinelinux.org/aports/plain/main/gstreamer/APKBUILD
 package:
   name: gstreamer
-  version: 1.24.9
+  version: 1.24.10
   epoch: 0
   description: GStreamer streaming media framework
   copyright:
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/GStreamer/gstreamer
       tag: ${{package.version}}
-      expected-commit: b309f90bfde36e6d175b70bfa0c941f2829dd6a5
+      expected-commit: 5be4b6f03689ab438822f6cfcd13f1f300afe203
 
   - runs: |
       cd subprojects/gstreamer
diff --git a/gtk-2.0.yaml b/gtk-2.0.yaml
index 84465a202f5..5ff068f537b 100644
--- a/gtk-2.0.yaml
+++ b/gtk-2.0.yaml
@@ -1,7 +1,7 @@
 package:
   name: gtk-2.0
   version: 2.24.33
-  epoch: 3
+  epoch: 4
   description: The GTK+ Toolkit (v2)
   copyright:
     - license: LGPL-2.0-or-later
@@ -77,6 +77,9 @@ subpackages:
         - pango-dev
         - shared-mime-info
     description: gtk+2.0 dev
+    test:
+      pipeline:
+        - uses: test/pkgconf
 
   - name: gtk-2.0-doc
     pipeline:
diff --git a/haproxy-3.0.yaml b/haproxy-3.1.yaml
similarity index 95%
rename from haproxy-3.0.yaml
rename to haproxy-3.1.yaml
index 1178bf838d8..83fefe3daeb 100644
--- a/haproxy-3.0.yaml
+++ b/haproxy-3.1.yaml
@@ -1,6 +1,6 @@
 package:
-  name: haproxy-3.0
-  version: 3.0.6
+  name: haproxy-3.1
+  version: 3.1.0
   epoch: 0
   description: "A TCP/HTTP reverse proxy for high availability environments"
   copyright:
@@ -36,7 +36,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://www.haproxy.org/download/${{vars.major-minor-version}}/src/haproxy-${{package.version}}.tar.gz
-      expected-sha256: cf1bf58b5bc79c48db7b01667596ffd98343adb29a41096f075f00a8f90a7335
+      expected-sha256: 56a1468574ab411dcabde837f96bea6cf3c2eb90e279469f75ed1dcdc70fce11
   - uses: autoconf/make
     with:
       opts: |
diff --git a/haproxy-3.0/docker-entrypoint.sh b/haproxy-3.1/docker-entrypoint.sh
similarity index 100%
rename from haproxy-3.0/docker-entrypoint.sh
rename to haproxy-3.1/docker-entrypoint.sh
diff --git a/harbor-cli.yaml b/harbor-cli.yaml
index 4dc060ec188..6c313b7103c 100644
--- a/harbor-cli.yaml
+++ b/harbor-cli.yaml
@@ -1,7 +1,7 @@
 package:
   name: harbor-cli
   version: 0.0.2
-  epoch: 0
+  epoch: 1
   description: Official Harbor CLI
   copyright:
     - license: Apache-2.0
@@ -12,7 +12,7 @@ package:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 888b85925d937067857c4c2ff3a8241b22905759
+      expected-commit: cb5437e9d3ae6aeb50d2583efb883f140486f3f4
       repository: https://github.com/goharbor/harbor-cli
       tag: v${{package.version}}
 
diff --git a/hardening-check.yaml b/hardening-check.yaml
index 87e2ce99359..1e7029e6458 100644
--- a/hardening-check.yaml
+++ b/hardening-check.yaml
@@ -1,6 +1,6 @@
 package:
   name: hardening-check
-  version: 2.24.4
+  version: 2.24.5
   epoch: 0
   description: "Debian devscripts hardening-check"
   copyright:
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://salsa.debian.org/debian/devscripts.git
       tag: v${{package.version}}
-      expected-commit: 25ee5fe3ef007e4dadd7de854da0d1e38584b799
+      expected-commit: 002f25d4097b1e18c4dc46ae101d4b410bb757a2
 
   - runs: |
       mkdir -p "${{targets.destdir}}"/usr/bin
diff --git a/highway.yaml b/highway.yaml
index 0aaefa8f47f..55b34cb7939 100644
--- a/highway.yaml
+++ b/highway.yaml
@@ -1,7 +1,7 @@
 package:
   name: highway
   version: 1.2.0
-  epoch: 1
+  epoch: 2
   description: Performance-portable, length-agnostic SIMD with runtime dispatch
   copyright:
     - license: Apache-2.0
@@ -60,6 +60,9 @@ subpackages:
     pipeline:
       - uses: split/dev
     description: highway dev
+    test:
+      pipeline:
+        - uses: test/pkgconf
 
 update:
   enabled: true
diff --git a/hugo-extended.yaml b/hugo-extended.yaml
index eca3f7fdcd9..746fdfe2dfa 100644
--- a/hugo-extended.yaml
+++ b/hugo-extended.yaml
@@ -1,6 +1,6 @@
 package:
   name: hugo-extended
-  version: 0.139.2
+  version: 0.139.3
   epoch: 0
   description: The world's fastest framework for building websites.
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/gohugoio/hugo
       tag: v${{package.version}}
-      expected-commit: 770f548b47b39e6f0fd4da1cc80552024e5829e1
+      expected-commit: 2f6864387cd31b975914e8373d4bf38bddbd47bc
 
   - uses: go/build
     with:
diff --git a/hugo.yaml b/hugo.yaml
index 2993546df0e..b41d0e6c117 100644
--- a/hugo.yaml
+++ b/hugo.yaml
@@ -1,6 +1,6 @@
 package:
   name: hugo
-  version: 0.139.2
+  version: 0.139.3
   epoch: 0
   description: The world's fastest framework for building websites.
   copyright:
@@ -18,7 +18,7 @@ pipeline:
     with:
       repository: https://github.com/gohugoio/hugo
       tag: v${{package.version}}
-      expected-commit: 770f548b47b39e6f0fd4da1cc80552024e5829e1
+      expected-commit: 2f6864387cd31b975914e8373d4bf38bddbd47bc
 
   - uses: go/build
     with:
diff --git a/hwdata.yaml b/hwdata.yaml
index 1de85e1007c..dbf0538157b 100644
--- a/hwdata.yaml
+++ b/hwdata.yaml
@@ -1,7 +1,7 @@
 # Generated from https://git.alpinelinux.org/aports/plain/main/hwdata/APKBUILD
 package:
   name: hwdata
-  version: "0.389"
+  version: "0.390"
   epoch: 0
   description: Hardware identification and configuration data
   copyright:
@@ -26,7 +26,7 @@ var-transforms:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 34813e6821a5dab0f663a363026e4d17e880e5f5f2ed49244c42263b226ff98a
+      expected-sha256: f10684093d2a7780de8a96d3dd8a2dd544ed6136dd359197750c42bb08ce526f
       uri: https://github.com/vcrhonek/hwdata/archive/refs/tags/v${{vars.mangled-package-version}}.tar.gz
 
   - uses: autoconf/configure
diff --git a/hwloc.yaml b/hwloc.yaml
index f23e1fee45d..4a5e58eebf4 100644
--- a/hwloc.yaml
+++ b/hwloc.yaml
@@ -87,7 +87,8 @@ test:
         hwloc-diff --help
         hwloc-distrib --version
         hwloc-distrib --help
-        if [[ uname -m == 'x86_64']]; then
+        if [[ "$(uname -m)" == 'x86_64' ]]
+        then
           hwloc-gather-cpuid --version
           hwloc-gather-cpuid --help
         fi;
@@ -105,7 +106,8 @@ test:
         lstopo --help
         lstopo-no-graphics --version
         lstopo-no-graphics --help
-        if [[ uname -m == 'x86_64']]; then
+        if [[ "$(uname -m)" == 'x86_64' ]]
+        then
           hwloc-dump-hwdata --version
           hwloc-dump-hwdata --help
         fi
diff --git a/influxd.yaml b/influxd.yaml
index 7a88e01f73a..6eab49ea1e3 100644
--- a/influxd.yaml
+++ b/influxd.yaml
@@ -1,7 +1,7 @@
 package:
   name: influxd
-  version: 2.7.10
-  epoch: 3
+  version: 2.7.11
+  epoch: 0
   description: Scalable datastore for metrics, events, and real-time analytics
   copyright:
     - license: MIT
@@ -23,7 +23,7 @@ pipeline:
     with:
       repository: https://github.com/influxdata/influxdb
       tag: v${{package.version}}
-      expected-commit: f302d9730c3c66577bea7bc7199cfae773bf308e
+      expected-commit: fbf5d4ab5e65d3a3661aa52e1d05259d19a6a81b
       destination: influxdb
 
   - uses: go/bump
diff --git a/ipfs.yaml b/ipfs.yaml
index 5f4fb957203..fd5e0244c5b 100644
--- a/ipfs.yaml
+++ b/ipfs.yaml
@@ -1,7 +1,7 @@
 package:
   name: ipfs
   version: 0.32.1
-  epoch: 0
+  epoch: 1
   description: An IPFS implementation in Go
   copyright:
     - license: Apache-2.0
@@ -29,6 +29,10 @@ pipeline:
       repository: https://github.com/ipfs/kubo
       tag: v${{package.version}}
 
+  - uses: go/bump
+    with:
+      deps: github.com/quic-go/quic-go@v0.48.2
+
   - runs: |
       CGO_ENABLED=1 GOOS=$(go env GOOS) GOARCH=$(go env GOARCH) GOFLAGS=-buildvcs=false make build GOTAGS=openssl
       install -m755 -D ./cmd/ipfs/ipfs "${{targets.destdir}}"/usr/bin/ipfs
diff --git a/istio-1.24.yaml b/istio-1.24.yaml
index 37e0b3e8b0e..4c1c84ee67c 100644
--- a/istio-1.24.yaml
+++ b/istio-1.24.yaml
@@ -1,7 +1,7 @@
 package:
   name: istio-1.24
-  version: 1.24.0
-  epoch: 2
+  version: 1.24.1
+  epoch: 0
   description: Istio is an open source service mesh that layers transparently onto existing distributed applications.
   copyright:
     - license: Apache-2.0
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/istio/istio
       tag: ${{package.version}}
-      expected-commit: 8825a6b7f8c9a2d66005a5f8b64e98aaee0dda99
+      expected-commit: 5c178358f9c61c50d3d6149a0b05a609a0d7defd
 
 subpackages:
   - name: istio-cni-${{vars.major-minor-version}}
diff --git a/istio-envoy-1.24.yaml b/istio-envoy-1.24.yaml
index dbb224872ed..1486659bfdc 100644
--- a/istio-envoy-1.24.yaml
+++ b/istio-envoy-1.24.yaml
@@ -1,6 +1,6 @@
 package:
   name: istio-envoy-1.24
-  version: 1.24.0
+  version: 1.24.1
   epoch: 0
   description: Envoy with additional Istio plugins (wasm, telemetry, etc)
   copyright:
@@ -48,7 +48,7 @@ pipeline:
     with:
       repository: https://github.com/istio/proxy
       tag: ${{package.version}}
-      expected-commit: 739644f84930a8c0d416319aea97f58c2222f7ef
+      expected-commit: 147cca4e7da4e8b3f8006e9fe3d8b3d6abd89462
 
   - runs: |
       export JAVA_HOME=/usr/lib/jvm/java-11-openjdk
diff --git a/jenkins-docker.yaml b/jenkins-docker.yaml
index 1cc9d59b625..0c15a7c4fda 100644
--- a/jenkins-docker.yaml
+++ b/jenkins-docker.yaml
@@ -1,6 +1,6 @@
 package:
   name: jenkins-docker
-  version: "2.486"
+  version: "2.488"
   epoch: 0
   description: Docker compatbility scripts and tooling for Jenkins
   copyright:
@@ -31,7 +31,7 @@ pipeline:
     with:
       repository: https://github.com/jenkinsci/docker
       tag: ${{package.version}}
-      expected-commit: d4c76fef7550af0b97590d63450b09690f0a4765
+      expected-commit: 808955c05aa6abfdf143c68d7a50ea6522afcd30
 
   # https://github.com/jenkinsci/docker/blob/master/alpine/hotspot/Dockerfile#L136
   - runs: |
diff --git a/jenkins-entrypoint.yaml b/jenkins-entrypoint.yaml
index 6a69b3f24f5..61cf682ce0b 100644
--- a/jenkins-entrypoint.yaml
+++ b/jenkins-entrypoint.yaml
@@ -3,7 +3,7 @@
 # code, we need to fetch it and be able to auto-update.
 package:
   name: jenkins-entrypoint
-  version: "2.486"
+  version: "2.488"
   epoch: 0
   description: Fetches the jenkins entrypoint script from upstream docker repository.
   copyright:
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/jenkinsci/docker.git
       tag: ${{package.version}}
-      expected-commit: d4c76fef7550af0b97590d63450b09690f0a4765
+      expected-commit: 808955c05aa6abfdf143c68d7a50ea6522afcd30
 
   - runs: |
       mkdir -p ${{targets.destdir}}/usr/local/bin/
diff --git a/jenkins.yaml b/jenkins.yaml
index 0c4fd477bda..ed1c35dfbc5 100644
--- a/jenkins.yaml
+++ b/jenkins.yaml
@@ -1,6 +1,6 @@
 package:
   name: jenkins
-  version: "2.485"
+  version: "2.488"
   epoch: 0
   description: Open-source CI/CD application.
   copyright:
@@ -44,7 +44,7 @@ pipeline:
     with:
       repository: https://github.com/jenkinsci/jenkins
       tag: jenkins-${{package.version}}
-      expected-commit: a30309847a598d7d444f10bef744ee4d5c755e12
+      expected-commit: 82735d468ee0de1c5177ba0a214597447010abdb
 
   - uses: patch
     with:
diff --git a/k3d.yaml b/k3d.yaml
index eae7013bce9..46743283550 100644
--- a/k3d.yaml
+++ b/k3d.yaml
@@ -1,6 +1,6 @@
 package:
   name: k3d
-  version: 5.7.4
+  version: 5.7.5
   epoch: 0
   description: Little helper to run CNCF's k3s in Docker
   copyright:
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/k3d-io/k3d
       tag: v${{package.version}}
-      expected-commit: fbb0526b7eecca880df234bac3dbea60adf8e32a
+      expected-commit: b1c64bcb459e266b92ff1d0820a62a6541b1efb5
 
   - uses: go/bump
     with:
diff --git a/k3s.yaml b/k3s.yaml
index 6a8246048ba..f9ab85e1b2b 100644
--- a/k3s.yaml
+++ b/k3s.yaml
@@ -1,7 +1,7 @@
 package:
   name: k3s
   version: 1.31.2.1
-  epoch: 3
+  epoch: 4
   description:
   copyright:
     - license: Apache-2.0
@@ -9,7 +9,12 @@ package:
     runtime:
       - busybox
       - conntrack-tools
-      - containerd-shim-runc-v2
+      # containerd-shim-runc-v2 is now pulling in versions > 2.0.0 by default. (https://github.com/containerd/containerd/issues/10984)
+      # pinning is required because any version >2.0.0 is not compatible with daemon < 2.0.0
+      # daemon in this case is coming from k3s itself and they've not migrated yet to version > 2.0.0
+      # there's is an issue tracking k3s update to containerd > 2.0.0 (https://github.com/k3s-io/k3s/issues/11375)
+      # remove pin once upstream migrates to containerd > 2.0.0
+      - containerd-shim-runc-v2=~1
       - ip6tables # this pulls in iptables as well
       - kmod
       - libseccomp
@@ -65,10 +70,8 @@ pipeline:
       ./scripts/download
   - uses: go/bump
     with:
-      deps: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.54.0 google.golang.org/grpc@v1.67.0 github.com/golang-jwt/jwt/v4@v4.5.1
+      deps: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.54.0 google.golang.org/grpc@v1.67.0 github.com/golang-jwt/jwt/v4@v4.5.1 github.com/opencontainers/runc@v1.1.14
   - runs: |
-      sed -i '/VERSION_RUNC=$(get-module-version github.com\/opencontainers\/runc)/a VERSION_RUNC="v1.1.14"' ./scripts/version.sh
-
       # Override the go version check at runtime to always match the go version at build time
       # Ref: https://github.com/k3s-io/k3s/pull/9054
       GOVERSION=$(go env GOVERSION)
@@ -224,55 +227,6 @@ subpackages:
             portmap --version
             portmap --help
 
-  - name: k3s-images
-    description: "pre-packaged k3s core runtime images"
-    pipeline:
-      - runs: |
-          set -e -u -x
-
-          _arch=$(go env GOARCH)
-
-          images=""
-          while read -r line
-          do
-            repo=$(echo $line | cut -d ':' -f 1)
-            tag=$(echo $line | cut -d ':' -f 2)
-
-            # Replace upstream images with cgr.dev equivalents only if they exist
-            case $repo in
-              docker.io/rancher/klipper-helm|docker.io/rancher/klipper-lb|docker.io/rancher/local-path-provisioner|docker.io/rancher/mirrored-pause)
-                # TODO: Replace these known gaps with cgr variants
-                image="$repo:$tag@$(crane digest $repo:$tag)"
-                ;;
-              docker.io/rancher/mirrored-metrics-server)
-                image=$(crane digest --full-ref cgr.dev/chainguard/metrics-server:latest)
-                ;;
-              docker.io/rancher/mirrored-coredns-coredns)
-                image=$(crane digest --full-ref cgr.dev/chainguard/coredns:latest)
-                ;;
-              docker.io/rancher/mirrored-library-busybox)
-                image=$(crane digest --full-ref cgr.dev/chainguard/busybox:latest)
-                ;;
-              docker.io/rancher/mirrored-library-traefik)
-                image=$(crane digest --full-ref cgr.dev/chainguard/traefik:latest)
-                ;;
-              *)
-                echo "unaccounted for image: $repo:$tag"
-                exit 1
-                ;;
-            esac
-
-            images="$images $image"
-          done < ./scripts/airgap/image-list.txt
-
-          echo "Pulling images locally..."
-          echo $images
-
-          _images_path="${{targets.subpkgdir}}"/var/lib/rancher/k3s/agent/images
-          mkdir -p $_images_path
-
-          crane pull $images $_images_path/k3s-airgap-images-$_arch.tar
-
 update:
   enabled: true
   # Ignore any release-candidate tags
diff --git a/k8sgpt-operator.yaml b/k8sgpt-operator.yaml
index c1918447c9e..79e302a8b40 100644
--- a/k8sgpt-operator.yaml
+++ b/k8sgpt-operator.yaml
@@ -1,7 +1,7 @@
 package:
   name: k8sgpt-operator
-  version: 0.2.0
-  epoch: 1
+  version: 0.2.1
+  epoch: 0
   description: Automatic SRE Superpowers within your Kubernetes cluster
   copyright:
     - license: Apache-2.0
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/k8sgpt-ai/k8sgpt-operator
       tag: v${{package.version}}
-      expected-commit: d0edb3461a99b3cc8d1d2bc11792368295123e8c
+      expected-commit: ca92af04ef33f97812dd40f42cdc5e38503b5522
 
   - uses: go/build
     with:
diff --git a/k8sgpt.yaml b/k8sgpt.yaml
index a8c2fb5454d..673f63b7a96 100644
--- a/k8sgpt.yaml
+++ b/k8sgpt.yaml
@@ -1,6 +1,6 @@
 package:
   name: k8sgpt
-  version: 0.3.46
+  version: 0.3.47
   epoch: 0
   description: Giving Kubernetes Superpowers to everyone
   copyright:
@@ -23,7 +23,7 @@ pipeline:
     with:
       repository: https://github.com/k8sgpt-ai/k8sgpt
       tag: v${{package.version}}
-      expected-commit: 69fd7c7696a8ee24761360a2d694d910ed0eac15
+      expected-commit: c3f448693d7648a1a98dbf1f714464d1b0724f89
 
   - uses: go/bump
     with:
diff --git a/kapp-controller.yaml b/kapp-controller.yaml
index f060f66be69..3fee5cc2aa2 100644
--- a/kapp-controller.yaml
+++ b/kapp-controller.yaml
@@ -1,6 +1,6 @@
 package:
   name: kapp-controller
-  version: 0.53.1
+  version: 0.54.0
   epoch: 0
   description: Continuous delivery and package management for Kubernetes
   copyright:
@@ -22,7 +22,7 @@ package:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 00aa728d6823620c03e3f4917cd565119b17c7d2
+      expected-commit: 36280985b86416dd023682b7bb02e0ffe1c6171c
       repository: https://github.com/carvel-dev/kapp-controller
       tag: v${{package.version}}
 
diff --git a/keycloak-operator.yaml b/keycloak-operator.yaml
index d0aa53c14f6..f08a7453458 100644
--- a/keycloak-operator.yaml
+++ b/keycloak-operator.yaml
@@ -1,6 +1,6 @@
 package:
   name: keycloak-operator
-  version: 26.0.6
+  version: 26.0.7
   epoch: 0
   description: A Kubernetes Operator based on the Operator SDK for installing and managing Keycloak.
   copyright:
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/keycloak/keycloak
       tag: ${{package.version}}
-      expected-commit: 5ded193f7713fc9993c381177b70b6cbac0e92a0
+      expected-commit: 812d849c783dbee23fcfb7266ce66321665de2bd
 
   - uses: maven/pombump
 
diff --git a/keycloak.yaml b/keycloak.yaml
index d615dc09e25..fcce89ecf17 100644
--- a/keycloak.yaml
+++ b/keycloak.yaml
@@ -1,6 +1,6 @@
 package:
   name: keycloak
-  version: 26.0.6
+  version: 26.0.7
   epoch: 0
   description: Open Source Identity and Access Management For Modern Applications and Services
   copyright:
@@ -40,7 +40,7 @@ pipeline:
     with:
       repository: https://github.com/keycloak/keycloak
       tag: ${{package.version}}
-      expected-commit: 5ded193f7713fc9993c381177b70b6cbac0e92a0
+      expected-commit: 812d849c783dbee23fcfb7266ce66321665de2bd
 
   - uses: maven/pombump
 
diff --git a/kiali.yaml b/kiali.yaml
index 99864422740..67f9bc15e75 100644
--- a/kiali.yaml
+++ b/kiali.yaml
@@ -1,6 +1,6 @@
 package:
   name: kiali
-  version: 2.1.0
+  version: 2.2.0
   epoch: 0
   description: The Console for Istio Service Mesh
   copyright:
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/kiali/kiali
       tag: v${{package.version}}
-      expected-commit: db07c941bcec3312972cd9ce6bf6ad18bb65208a
+      expected-commit: cb33b859493abf0d2706068ddaaace5656dc0d4d
 
 subpackages:
   - name: ${{package.name}}-api
diff --git a/kots.yaml b/kots.yaml
index e160edb2c93..2c045afd1c8 100644
--- a/kots.yaml
+++ b/kots.yaml
@@ -1,6 +1,6 @@
 package:
   name: kots
-  version: 1.121.0
+  version: 1.121.2
   epoch: 0
   description: Kubernetes Off-The-Shelf (KOTS) Software
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/replicatedhq/kots
       tag: v${{package.version}}
-      expected-commit: 55b35f47fce43faf14bef8afb86d1fc15dcfad68
+      expected-commit: 2417b58d3166126d8d2927af7bb760d4939c7ee3
 
   - runs: |
       set -x
diff --git a/kube-rbac-proxy.yaml b/kube-rbac-proxy.yaml
index 3dc386e39f2..99d3fdb0d66 100644
--- a/kube-rbac-proxy.yaml
+++ b/kube-rbac-proxy.yaml
@@ -1,7 +1,7 @@
 package:
   name: kube-rbac-proxy
-  version: 0.18.1
-  epoch: 1
+  version: 0.18.2
+  epoch: 0
   description: Kubernetes RBAC authorizing HTTP proxy for a single upstream.
   copyright:
     - license: Apache-2.0
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/brancz/kube-rbac-proxy
       tag: v${{package.version}}
-      expected-commit: f5e3cbd44b367615b4f325499398634ecbaddcbd
+      expected-commit: 28ede67b07bfa78103e78a4c4ce43560d6b15dba
 
   - runs: |
       # Mitigate CVE-2023-45142/GHSA-rcjv-mgp8-qvmr
diff --git a/kubeflow-centraldashboard.yaml b/kubeflow-centraldashboard.yaml
index 756ad9be0b9..7e9ef162d69 100644
--- a/kubeflow-centraldashboard.yaml
+++ b/kubeflow-centraldashboard.yaml
@@ -1,7 +1,7 @@
 package:
   name: kubeflow-centraldashboard
   version: 1.9.2
-  epoch: 0
+  epoch: 2
   description: Landing page and central dashboard for Kubeflow deployments
   copyright:
     - license: MIT
@@ -20,6 +20,7 @@ environment:
       - nodejs-18
       - npm
       - openssl
+      - openssl-provider-legacy
       - wolfi-base
 
 pipeline:
@@ -56,7 +57,7 @@ pipeline:
         "path-to-regexp": "0.1.10",
         "serve-static": "^1.16.0",
         "cookie": "0.7.0",
-        "jsonpath-plus": "10.0.0"
+        "jsonpath-plus": "10.0.7"
       }'
 
       # Apply the overrides
diff --git a/kubeflow-jupyter-web-app.yaml b/kubeflow-jupyter-web-app.yaml
index 1059d576d6f..7aa71291916 100644
--- a/kubeflow-jupyter-web-app.yaml
+++ b/kubeflow-jupyter-web-app.yaml
@@ -1,7 +1,7 @@
 package:
   name: kubeflow-jupyter-web-app
   version: 1.9.2
-  epoch: 1
+  epoch: 2
   description: Kubeflow jupyter web app component
   copyright:
     - license: Apache-2.0
@@ -22,6 +22,7 @@ environment:
       - npm
       - openssf-compiler-options
       - openssl
+      - openssl-provider-legacy
       - py3-pip
       - py3-setuptools
       - py3-urllib3
diff --git a/kubeflow-volumes-web-app.yaml b/kubeflow-volumes-web-app.yaml
index 941edfffed4..646bad88fdb 100644
--- a/kubeflow-volumes-web-app.yaml
+++ b/kubeflow-volumes-web-app.yaml
@@ -1,7 +1,7 @@
 package:
   name: kubeflow-volumes-web-app
   version: 1.9.2
-  epoch: 1
+  epoch: 2
   description: Kubeflow volumes web app component
   copyright:
     - license: Apache-2.0
@@ -22,6 +22,7 @@ environment:
       - npm
       - openssf-compiler-options
       - openssl
+      - openssl-provider-legacy
       - py3-pip
       - py3-setuptools
       - py3-wheel
diff --git a/kubernetes-dns-node-cache.yaml b/kubernetes-dns-node-cache.yaml
index 2aadd0ac204..544465433b3 100644
--- a/kubernetes-dns-node-cache.yaml
+++ b/kubernetes-dns-node-cache.yaml
@@ -1,7 +1,7 @@
 package:
   name: kubernetes-dns-node-cache
   version: 1.23.1
-  epoch: 5
+  epoch: 6
   description: NodeLocal DNSCache improves Cluster DNS performance by running a DNS caching agent on cluster nodes as a DaemonSet.
   copyright:
     - license: Apache-2.0
@@ -24,7 +24,7 @@ pipeline:
 
   - uses: go/bump
     with:
-      deps: google.golang.org/protobuf@v1.33.0 golang.org/x/net@v0.23.0 github.com/quic-go/quic-go@v0.42.0 github.com/coredns/coredns@v1.11.2 k8s.io/kubernetes@v1.28.12
+      deps: google.golang.org/protobuf@v1.33.0 golang.org/x/net@v0.23.0 github.com/coredns/coredns@v1.11.2 k8s.io/kubernetes@v1.28.12 github.com/quic-go/quic-go@v0.48.2
       replaces: k8s.io/kube-openapi=k8s.io/kube-openapi@v0.0.0-20230501164219-8b0f38b5fd1f
 
   - uses: go/build
diff --git a/kubescape.yaml b/kubescape.yaml
index a6c948ba100..8aac924d7c8 100644
--- a/kubescape.yaml
+++ b/kubescape.yaml
@@ -1,6 +1,6 @@
 package:
   name: kubescape
-  version: 3.0.20
+  version: 3.0.21
   epoch: 0
   description: Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
   copyright:
@@ -20,14 +20,14 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 5b9c6491de8ab7b89c15d6b1b780987e2206a4c4
+      expected-commit: a9ac880356ec677e17472f08592d87b75229c681
       recurse-submodules: "true"
       repository: https://github.com/kubescape/kubescape
       tag: v${{package.version}}
 
   - uses: go/bump
     with:
-      deps: github.com/anchore/archiver/v3@v3.5.2
+      deps: github.com/mholt/archiver/v3@v3.5.2
       replaces: github.com/mholt/archiver/v3=github.com/anchore/archiver/v3@v3.5.2
 
   - runs: |
diff --git a/kyverno-policy-reporter-ui.yaml b/kyverno-policy-reporter-ui.yaml
index a3b373e0f7a..0079c530676 100644
--- a/kyverno-policy-reporter-ui.yaml
+++ b/kyverno-policy-reporter-ui.yaml
@@ -1,7 +1,7 @@
 package:
   name: kyverno-policy-reporter-ui
   version: 1.9.2
-  epoch: 9
+  epoch: 10
   description: Policy Reporter UI
   copyright:
     - license: Apache-2.0
@@ -20,6 +20,7 @@ environment:
       - nodejs-18
       - npm
       - openssl
+      - openssl-provider-legacy
       - python-3.11
       - wolfi-baselayout
 
diff --git a/lazydocker.yaml b/lazydocker.yaml
new file mode 100644
index 00000000000..79138dc8a1a
--- /dev/null
+++ b/lazydocker.yaml
@@ -0,0 +1,36 @@
+package:
+  name: lazydocker
+  version: 0.24.1
+  epoch: 0
+  description: The lazier way to manage everything docker
+  copyright:
+    - license: MIT
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/jesseduffield/lazydocker
+      tag: v${{package.version}}
+      expected-commit: be051153525b018a46f71a2b2ed42cde39a1110c
+
+  - uses: go/build
+    with:
+      packages: .
+      ldflags: |
+        -X main.version=${{package.version}}
+        -X main.commit=$(git rev-parse HEAD)
+        -X main.date=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+        -X main.buildSource=wolfiRelease
+      output: lazydocker
+
+update:
+  enabled: true
+  github:
+    identifier: jesseduffield/lazydocker
+    strip-prefix: v
+
+test:
+  pipeline:
+    - runs: |
+        lazydocker --version
+        lazydocker --help
diff --git a/lean4.yaml b/lean4.yaml
index 4190f1a7692..c9eaabd9198 100644
--- a/lean4.yaml
+++ b/lean4.yaml
@@ -1,7 +1,7 @@
 package:
   name: lean4
-  version: 4.13.0
-  epoch: 1
+  version: 4.14.0
+  epoch: 0
   description: "Secure Reliable Transport (SRT)"
   copyright:
     - license: Apache-2.0
@@ -30,7 +30,7 @@ pipeline:
     with:
       repository: https://github.com/leanprover/lean4
       tag: v${{package.version}}
-      expected-commit: 6d22e0e5cc5a4392466e3d6dd8522486d1fd038b
+      expected-commit: 410fab7284703f41660ca2454218dcca9b2ec896
 
   - runs: |
       # This doesn't work with Ninja so we can't use our default pipelines.
diff --git a/lerna.yaml b/lerna.yaml
index a5b6d2d6d14..bcd5f62d4a7 100644
--- a/lerna.yaml
+++ b/lerna.yaml
@@ -1,7 +1,7 @@
 package:
   name: lerna
   version: 8.1.9
-  epoch: 0
+  epoch: 1
   description: "Lerna is a fast, modern build system for managing and publishing multiple JavaScript/TypeScript packages from the same repository."
   copyright:
     - license: MIT
@@ -30,6 +30,9 @@ pipeline:
       # CVE GHSA-8hc4-vh64-cxmj
       npm install axios@1.7.4 -prefix ${{targets.destdir}}/usr/local/lib/node_modules/lerna/
 
+      # CVE GHSA-3xgq-45jj-v275
+      npm install cross-spawn@7.0.5 -prefix ${{targets.destdir}}/usr/local/lib/node_modules/lerna/
+
       # https://github.com/browserify/resolve/issues/288
       sed -i 's/monorepo-symlink-test/false-positive/g' ${{targets.destdir}}/usr/local/lib/node_modules/lerna/node_modules/resolve/test/resolver/multirepo/package.json
 
diff --git a/libdwarf.yaml b/libdwarf.yaml
index c1203d2ccbc..c14a534b6dd 100644
--- a/libdwarf.yaml
+++ b/libdwarf.yaml
@@ -1,6 +1,6 @@
 package:
   name: libdwarf
-  version: 0.11.0
+  version: 0.11.1
   epoch: 0
   description: Parsing library for DWARF2 and later debugging file format
   copyright:
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/davea42/libdwarf-code
       tag: v${{package.version}}
-      expected-commit: 285d9d34f3e9f56cc1c487d0055f6dc54a9c54a1
+      expected-commit: 909af3e46b68335df6c4a901ddd256ffa0d193d2
 
   - name: Configure libdwarf
     uses: meson/configure
diff --git a/libpulsar.yaml b/libpulsar.yaml
index f8e4c4d7520..c11b9f4aa12 100644
--- a/libpulsar.yaml
+++ b/libpulsar.yaml
@@ -1,7 +1,7 @@
 package:
   name: libpulsar
   version: 3.6.0
-  epoch: 1
+  epoch: 2
   description: Optimizer and compiler/toolchain library for WebAssembly
   copyright:
     - license: Apache-2.0
diff --git a/libreoffice-24.8.yaml b/libreoffice-24.8.yaml
index 0b2f160fe3d..df4583cc69e 100644
--- a/libreoffice-24.8.yaml
+++ b/libreoffice-24.8.yaml
@@ -1,6 +1,6 @@
 package:
   name: libreoffice-24.8
-  version: 24.8.3.1
+  version: 24.8.4.1
   epoch: 0
   description:
   # https://www.libreoffice.org/about-us/licenses
@@ -92,6 +92,8 @@ environment:
       - python-${{vars.python-version}}-dev
       - zip
   environment:
+    # https://github.com/wolfi-dev/os/issues/34075
+    GCC_SPEC_FILE: /dev/null
     JAVA_HOME: ${{vars.java-home}}
 
 pipeline:
@@ -99,7 +101,7 @@ pipeline:
     with:
       repository: https://github.com/LibreOffice/core
       tag: libreoffice-${{package.version}}
-      expected-commit: 65412f067af443213e726c93f137ccc85c9a1e06
+      expected-commit: 1be9007f5d86a3741c366527d13e2970cbeef057
 
   # patch rather than cherry-pick. The git fetch of main takes multiple minutes.
   - uses: patch
diff --git a/linkerd2-proxy.yaml b/linkerd2-proxy.yaml
index 097a729d36b..d5b4c0d40e1 100644
--- a/linkerd2-proxy.yaml
+++ b/linkerd2-proxy.yaml
@@ -1,6 +1,6 @@
 package:
   name: linkerd2-proxy
-  version: 2.268.0
+  version: 2.270.0
   epoch: 0
   description: "A program that validates linkerd networks"
   copyright:
@@ -25,7 +25,7 @@ pipeline:
     with:
       repository: https://github.com/linkerd/linkerd2-proxy
       tag: release/v${{package.version}}
-      expected-commit: d76dda33d6bbcea1b32aed2c867712b8dc7dceb7
+      expected-commit: 995a5b45291f2baed8e6f96c951a7a7fff4b6d10
 
   - runs: |
       cargo fetch
diff --git a/linkerd2.yaml b/linkerd2.yaml
index 65afe09f06f..8ca796b722f 100644
--- a/linkerd2.yaml
+++ b/linkerd2.yaml
@@ -1,6 +1,6 @@
 package:
   name: linkerd2
-  version: 24.11.5
+  version: 24.11.8
   epoch: 0
   description: "meta linkerd package"
   copyright:
@@ -25,7 +25,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 3c91fc64ce61208e3be01f908abe178e3786616f
+      expected-commit: 43335fd90603d511bc898942b40f0ac15671b593
       repository: https://github.com/linkerd/linkerd2/
       tag: edge-${{package.version}}
 
diff --git a/linux-headers.yaml b/linux-headers.yaml
index 14b98d7a101..f7dae03ba29 100644
--- a/linux-headers.yaml
+++ b/linux-headers.yaml
@@ -1,6 +1,6 @@
 package:
   name: linux-headers
-  version: 6.6.62
+  version: 6.6.63
   epoch: 0
   description: "the Linux kernel headers (cross compilation)"
   copyright:
@@ -20,7 +20,7 @@ pipeline:
     with:
       repository: https://github.com/gregkh/linux
       tag: v${{package.version}}
-      expected-commit: c1036e4f14d03aba549cdd9b186148d331013056
+      expected-commit: bff3e13adb72656356111d2549d8be7c872d6e15
 
   - runs: |
       make mrproper
diff --git a/llvm-19.yaml b/llvm-19.yaml
index fd69ce32e1c..a47f7d02e27 100644
--- a/llvm-19.yaml
+++ b/llvm-19.yaml
@@ -1,6 +1,6 @@
 package:
   name: llvm-19
-  version: 19.1.4
+  version: 19.1.5
   epoch: 0
   description: "low-level virtual machine - core frameworks"
   copyright:
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/llvm/llvm-project
       tag: llvmorg-${{package.version}}
-      expected-commit: aadaa00de76ed0c4987b97450dd638f63a385bed
+      expected-commit: ab4b5a2db582958af1ee308a790cfdb42bd24720
 
   - runs: |
       ffi_include_dir="$(pkg-config --cflags-only-I libffi | sed 's|^-I||g')"
diff --git a/logstash-8.yaml b/logstash-8.yaml
index 9bc714a2d8f..99af341b876 100644
--- a/logstash-8.yaml
+++ b/logstash-8.yaml
@@ -416,3 +416,4 @@ update:
     identifier: elastic/logstash
     strip-prefix: v
     use-tag: true
+    tag-filter: v8.
diff --git a/logstash-integration-jdbc.yaml b/logstash-integration-jdbc.yaml
index 922c53cd7a2..2a041959700 100644
--- a/logstash-integration-jdbc.yaml
+++ b/logstash-integration-jdbc.yaml
@@ -8,7 +8,7 @@
 #
 package:
   name: logstash-integration-jdbc
-  version: 5.5.0
+  version: 5.5.1
   epoch: 0
   description: Logstash Integration Plugin for JDBC, including Logstash Input and Filter Plugins
   copyright:
@@ -31,7 +31,7 @@ pipeline:
     with:
       repository: https://github.com/logstash-plugins/logstash-integration-jdbc
       tag: v${{package.version}}
-      expected-commit: 2c84d5fa0d9787e8e444ca7d6fed729cbb7b59ec
+      expected-commit: 1804cd7aa2c2eca222a2e178d318758001449fe8
   - runs: |
       # update the derby version to mitigate the CVE-2018-1313
       sed -i "s/def DERBY_VERSION = '10.14.1.0'/def DERBY_VERSION = '10.14.2.0'/g" build.gradle
diff --git a/lua5.3.yaml b/lua5.3.yaml
index b0a58b8f0cb..0922c79f6ab 100644
--- a/lua5.3.yaml
+++ b/lua5.3.yaml
@@ -1,11 +1,17 @@
 package:
   name: lua5.3
   version: 5.3.6
-  epoch: 5
-  description: "powerful lightweight programming language"
+  epoch: 6
+  description: Powerful light-weight programming language
   copyright:
     - license: MIT
 
+var-transforms:
+  - from: ${{package.version}}
+    match: (\d+\.\d+).\d
+    replace: "$1"
+    to: luaMM
+
 environment:
   contents:
     packages:
@@ -21,24 +27,20 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      uri: https://www.lua.org/ftp/lua-${{package.version}}.tar.gz
       expected-sha256: fc5fd69bb8736323f026672b1b7235da613d7177e72558893a0bdcd320466d60
+      uri: https://www.lua.org/ftp/lua-${{package.version}}.tar.gz
 
   - uses: patch
     with:
-      patches: lua-5.3-make.patch
-
-  - uses: patch
-    with:
-      patches: lua-5.3-module_paths.patch
-
-  - uses: patch
-    with:
-      patches: linenoise.patch
+      patches: |
+        linenoise.patch
+        module_paths.patch
+        make.patch
 
   - runs: |
       cat >configure.ac <<-EOF
         top_builddir=.
+
         AC_INIT(src/luaconf.h)
         AC_PROG_LIBTOOL
         AC_OUTPUT
@@ -48,43 +50,56 @@ pipeline:
       autoconf
       sed -i '/#define LUA_USE_READLINE/d' src/luaconf.h
 
-  - runs: |
-      ./configure --prefix=/usr
+  - uses: autoconf/configure
 
   - runs: |
-      make -C src V=5.3 \
-        CFLAGS="$CFLAGS -DLUA_USE_LINUX -DLUA_COMPAT_5_2 -DLUA_USE_LINENOISE" \
+      mm=${{vars.luaMM}}
+      major=${mm%.*}
+      minor=${mm#*.}
+      if [ "$minor" = "0" ]; then
+        echo "not using LUA_COMPAT as minor=-"
+      else
+        lastminor=$((minor-1))
+        compat="-DLUA_COMPAT_${major}_${lastminor}"
+        # just be careful do not pass flags that are nonsense.
+        # https://gitlab.alpinelinux.org/alpine/aports/-/issues/13257
+        grep -q -- "$compat" src/Makefile ||
+           { echo "Did not find compat flag $compat in src/Makefile"; exit 1; }
+        echo "Building with compat for $major.$lastminor via $compat"
+      fi
+
+      make -C src V=${{vars.luaMM}} \
+        CFLAGS="$CFLAGS -DLUA_USE_LINUX -DLUA_USE_LINENOISE $compat" \
         SYSLDFLAGS="$LDFLAGS" \
         RPATH="/usr/lib" \
         LIB_LIBS="-lpthread -lm -ldl -llinenoise" \
         alpine_all
 
   - runs: |
-      make V=5.3 \
+      make V=${{vars.luaMM}} \
         INSTALL_TOP="${{targets.destdir}}"/usr \
-        INSTALL_INC="${{targets.destdir}}"/usr/include/lua5.3 \
-        INSTALL_LIB="${{targets.destdir}}"/usr/lib/lua5.3 \
+        INSTALL_INC="${{targets.destdir}}"/usr/include/lua${{vars.luaMM}} \
+        INSTALL_LIB="${{targets.destdir}}"/usr/lib/lua${{vars.luaMM}} \
         alpine_install
-
-      chmod 755 "${{targets.destdir}}"/usr/lib/lua5.3/*.so*
+      chmod 755 "${{targets.destdir}}"/usr/lib/lua${{vars.luaMM}}/*.so*
 
   - runs: |
       for i in "${{targets.destdir}}"/usr/bin/* ; do
-        mv "$i" "$i"5.3
+        mv "$i" "$i"${{vars.luaMM}}
       done
-
-      for i in "${{targets.destdir}}"/usr/lib/lua5.3/*.so.*; do
-        ln -s lua5.3/${i##*/} "${{targets.destdir}}"/usr/lib/${i##*/}
+      for i in "${{targets.destdir}}"/usr/lib/lua${{vars.luaMM}}/*.so.*; do
+        ln -s lua${{vars.luaMM}}/${i##*/} "${{targets.destdir}}"/usr/lib/${i##*/}
       done
-
       for i in lua luac; do
         install -D -m 644 doc/$i.1 "${{targets.destdir}}"/usr/share/man/man1/"$i""$_luaver".1
       done
 
+      rm ${{targets.destdir}}/usr/lib/lua${{vars.luaMM}}/liblua.la \
+
       install -d "${{targets.destdir}}"/usr/lib/pkgconfig
-      cat > "${{targets.destdir}}"/usr/lib/pkgconfig/lua5.3.pc <<-EOF
+      cat > "${{targets.destdir}}"/usr/lib/pkgconfig/lua${{vars.luaMM}}.pc <<-EOF
       # lua.pc -- pkg-config data for Lua
-      V=5.3
+      V=${{vars.luaMM}}
       R=${{package.version}}
       prefix=/usr
       INSTALL_BIN=\${prefix}/bin
@@ -96,7 +111,6 @@ pipeline:
       exec_prefix=\${prefix}
       libdir=\${exec_prefix}/lib/${{package.name}}
       includedir=\${exec_prefix}/include/${{package.name}}
-
       Name: Lua
       Description: An extensible extension language
       Version: ${{package.version}}
@@ -108,19 +122,55 @@ pipeline:
   - uses: strip
 
 subpackages:
-  - name: "lua5.3-doc"
-    description: "lua documentation"
-    pipeline:
-      - uses: split/manpages
-
-  - name: "lua5.3-dev"
-    description: "lua development headers"
+  - name: lua${{vars.luaMM}}-dev
+    description: lua${{vars.luaMM}} dev
+    dependencies:
+      runtime:
+        - lua${{vars.luaMM}}
+        - lua${{vars.luaMM}}-libs
     pipeline:
       - uses: split/dev
     test:
       pipeline:
         - uses: test/pkgconf
 
+  - name: lua${{vars.luaMM}}-libs
+    pipeline:
+      - runs: |
+          mkdir -p ${{targets.contextdir}}/usr/lib
+          mv -v ${{targets.destdir}}/usr/lib/lib*.so.* \
+            ${{targets.contextdir}}/usr/lib/
+
+          mkdir -p ${{targets.contextdir}}/usr/lib/lua${{vars.luaMM}}
+          mv -v ${{targets.destdir}}/usr/lib/lua${{vars.luaMM}}/lib*.so.* \
+            ${{targets.contextdir}}/usr/lib/lua${{vars.luaMM}}/
+    test:
+      environment:
+        contents:
+          packages:
+            - apk-tools
+      pipeline:
+        - runs: |
+            set +x
+            mm=${{vars.luaMM}}
+            pkg="lua${mm}-libs"
+            soname="liblua-$mm.so.0"
+            pout=$(apk info --provides "$pkg" 2>/dev/null) ||
+              { echo "ERROR: 'apk info --provides $pkg' exited $?"; exit 1; }
+            if out=$(echo "$pout" | grep "so:$soname="); then
+              echo "PASS: $pkg provides $soname. [$out]"
+            else
+              echo "FAIL: $pkg did not provide so:$soname"
+              echo "$ apk info --provides $pkg"
+              echo "$pout"
+              exit 1
+            fi
+
+  - name: lua${{vars.luaMM}}-doc
+    description: lua${{vars.luaMM}} manpages
+    pipeline:
+      - uses: split/manpages
+
 update:
   enabled: true
   release-monitor:
@@ -128,7 +178,15 @@ update:
 
 test:
   pipeline:
-    # AUTOGENERATED
     - runs: |
-        lua5.3 -v
-        luac5.3 -v
+        set +x
+        mm=${{vars.luaMM}}
+        fail() { echo "FAIL:" "$@" 1>&2; exit 1; }
+        v="${{package.version}}"
+        for p in lua luac ; do
+          prog="$p$mm" # lua5.X
+          out=$($prog -v) || fail "$prog -v - exited $?"
+          echo "$out" | grep -q -F "$v" ||
+            fail "output of '$prog -v' did not contain '$v'. output: $out"
+            echo "PASS: $prog -v output contained expected '$v': $out"
+        done
diff --git a/lua5.3/lua-5.3-make.patch b/lua5.3/make.patch
similarity index 100%
rename from lua5.3/lua-5.3-make.patch
rename to lua5.3/make.patch
diff --git a/lua5.3/lua-5.3-module_paths.patch b/lua5.3/module_paths.patch
similarity index 100%
rename from lua5.3/lua-5.3-module_paths.patch
rename to lua5.3/module_paths.patch
diff --git a/lua5.4.yaml b/lua5.4.yaml
index 975900bdb74..9c01b19dd5c 100644
--- a/lua5.4.yaml
+++ b/lua5.4.yaml
@@ -1,11 +1,17 @@
 package:
   name: lua5.4
   version: 5.4.7
-  epoch: 1
+  epoch: 2
   description: Powerful light-weight programming language
   copyright:
     - license: MIT
 
+var-transforms:
+  - from: ${{package.version}}
+    match: (\d+\.\d+).\d
+    replace: "$1"
+    to: luaMM
+
 environment:
   contents:
     packages:
@@ -26,19 +32,14 @@ pipeline:
 
   - uses: patch
     with:
-      patches: lua-5.4-module_paths.patch
-
-  - uses: patch
-    with:
-      patches: lua-5.4-make.patch
-
-  - uses: patch
-    with:
-      patches: extern-c-for-cpp.patch
+      patches: |
+        module_paths.patch
+        make.patch
+        extern-c-for-cpp.patch
 
   - runs: |
-      cat > configure.ac <<-EOF
-        top_buildir=.
+      cat >configure.ac <<-EOF
+        top_builddir=.
 
         AC_INIT(src/luaconf.h)
         AC_PROG_LIBTOOL
@@ -51,36 +52,53 @@ pipeline:
   - uses: autoconf/configure
 
   - runs: |
-      make -C src V=5.4 \
-        CFLAGS="$CFLAGS -DLUA_USE_LINUX -DLUA_COMPAT_5_2 -DLUA_USE_READLINE" \
+      mm=${{vars.luaMM}}
+      major=${mm%.*}
+      minor=${mm#*.}
+      if [ "$minor" = "0" ]; then
+        echo "not using LUA_COMPAT as minor=-"
+      else
+        lastminor=$((minor-1))
+        compat="-DLUA_COMPAT_${major}_${lastminor}"
+        # just be careful do not pass flags that are nonsense.
+        # https://gitlab.alpinelinux.org/alpine/aports/-/issues/13257
+        grep -q -- "$compat" src/Makefile ||
+           { echo "Did not find compat flag $compat in src/Makefile"; exit 1; }
+        echo "Building with compat for $major.$lastminor via $compat"
+      fi
+
+      make -C src V=${{vars.luaMM}} \
+        CFLAGS="$CFLAGS -DLUA_USE_LINUX -DLUA_USE_READLINE $compat" \
         SYSLDFLAGS="$LDFLAGS" \
         RPATH="/usr/lib" \
         LIB_LIBS="-lpthread -lm -ldl -lreadline" \
         alpine_all
 
   - runs: |
-      make V=5.3 \
+      make V=${{vars.luaMM}} \
         INSTALL_TOP="${{targets.destdir}}"/usr \
-        INSTALL_INC="${{targets.destdir}}"/usr/include/lua5.4 \
-        INSTALL_LIB="${{targets.destdir}}"/usr/lib/lua5.4 \
+        INSTALL_INC="${{targets.destdir}}"/usr/include/lua${{vars.luaMM}} \
+        INSTALL_LIB="${{targets.destdir}}"/usr/lib/lua${{vars.luaMM}} \
         alpine_install
-      chmod 755 "${{targets.destdir}}"/usr/lib/lua5.4/*.so*
+      chmod 755 "${{targets.destdir}}"/usr/lib/lua${{vars.luaMM}}/*.so*
 
   - runs: |
       for i in "${{targets.destdir}}"/usr/bin/* ; do
-        mv "$i" "$i"5.4
+        mv "$i" "$i"${{vars.luaMM}}
       done
-      for i in "${{targets.destdir}}"/usr/lib/lua5.4/*.so.*; do
-        ln -s lua5.4/${i##*/} "${{targets.destdir}}"/usr/lib/${i##*/}
+      for i in "${{targets.destdir}}"/usr/lib/lua${{vars.luaMM}}/*.so.*; do
+        ln -s lua${{vars.luaMM}}/${i##*/} "${{targets.destdir}}"/usr/lib/${i##*/}
       done
       for i in lua luac; do
         install -D -m 644 doc/$i.1 "${{targets.destdir}}"/usr/share/man/man1/"$i""$_luaver".1
       done
 
+      rm ${{targets.destdir}}/usr/lib/lua${{vars.luaMM}}/liblua.la \
+
       install -d "${{targets.destdir}}"/usr/lib/pkgconfig
-      cat > "${{targets.destdir}}"/usr/lib/pkgconfig/lua5.4.pc <<-EOF
+      cat > "${{targets.destdir}}"/usr/lib/pkgconfig/lua${{vars.luaMM}}.pc <<-EOF
       # lua.pc -- pkg-config data for Lua
-      V=5.4
+      V=${{vars.luaMM}}
       R=${{package.version}}
       prefix=/usr
       INSTALL_BIN=\${prefix}/bin
@@ -103,21 +121,54 @@ pipeline:
   - uses: strip
 
 subpackages:
-  - name: lua5.4-dev
-    pipeline:
-      - uses: split/dev
+  - name: lua${{vars.luaMM}}-dev
+    description: lua${{vars.luaMM}} dev
     dependencies:
       runtime:
-        - lua5.4
-    description: lua5.4 dev
+        - lua${{vars.luaMM}}
+        - lua${{vars.luaMM}}-libs
+    pipeline:
+      - uses: split/dev
     test:
       pipeline:
         - uses: test/pkgconf
 
-  - name: lua5.4-doc
+  - name: lua${{vars.luaMM}}-libs
+    pipeline:
+      - runs: |
+          mkdir -p ${{targets.contextdir}}/usr/lib
+          mv -v ${{targets.destdir}}/usr/lib/lib*.so.* \
+            ${{targets.contextdir}}/usr/lib/
+
+          mkdir -p ${{targets.contextdir}}/usr/lib/lua${{vars.luaMM}}
+          mv -v ${{targets.destdir}}/usr/lib/lua${{vars.luaMM}}/lib*.so.* \
+            ${{targets.contextdir}}/usr/lib/lua${{vars.luaMM}}/
+    test:
+      environment:
+        contents:
+          packages:
+            - apk-tools
+      pipeline:
+        - runs: |
+            set +x
+            mm=${{vars.luaMM}}
+            pkg="lua${mm}-libs"
+            soname="liblua-$mm.so.0"
+            pout=$(apk info --provides "$pkg" 2>/dev/null) ||
+              { echo "ERROR: 'apk info --provides $pkg' exited $?"; exit 1; }
+            if out=$(echo "$pout" | grep "so:$soname="); then
+              echo "PASS: $pkg provides $soname. [$out]"
+            else
+              echo "FAIL: $pkg did not provide so:$soname"
+              echo "$ apk info --provides $pkg"
+              echo "$pout"
+              exit 1
+            fi
+
+  - name: lua${{vars.luaMM}}-doc
+    description: lua${{vars.luaMM}} manpages
     pipeline:
       - uses: split/manpages
-    description: lua5.4 manpages
 
 update:
   enabled: true
@@ -126,7 +177,15 @@ update:
 
 test:
   pipeline:
-    # AUTOGENERATED
     - runs: |
-        lua5.4 -v
-        luac5.4 -v
+        set +x
+        mm=${{vars.luaMM}}
+        fail() { echo "FAIL:" "$@" 1>&2; exit 1; }
+        v="${{package.version}}"
+        for p in lua luac ; do
+          prog="$p$mm" # lua5.X
+          out=$($prog -v) || fail "$prog -v - exited $?"
+          echo "$out" | grep -q -F "$v" ||
+            fail "output of '$prog -v' did not contain '$v'. output: $out"
+            echo "PASS: $prog -v output contained expected '$v': $out"
+        done
diff --git a/lua5.4/lua-5.4-make.patch b/lua5.4/make.patch
similarity index 100%
rename from lua5.4/lua-5.4-make.patch
rename to lua5.4/make.patch
diff --git a/lua5.4/lua-5.4-module_paths.patch b/lua5.4/module_paths.patch
similarity index 100%
rename from lua5.4/lua-5.4-module_paths.patch
rename to lua5.4/module_paths.patch
diff --git a/mailpit.yaml b/mailpit.yaml
index 09bc4506752..3010baafd7d 100644
--- a/mailpit.yaml
+++ b/mailpit.yaml
@@ -1,6 +1,6 @@
 package:
   name: mailpit
-  version: 1.21.4
+  version: 1.21.5
   epoch: 0
   description: An email and SMTP testing tool with API for developers
   copyright:
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/axllent/mailpit
       tag: v${{package.version}}
-      expected-commit: 6d115ceb86746c74cff2cd778bec8c0a7d44663f
+      expected-commit: 0277f4e9442aff4be26ebfcf99e8995187be27d0
 
   - runs: |
       npm install
diff --git a/management-api-for-apache-cassandra-5.0.yaml b/management-api-for-apache-cassandra-5.0.yaml
index 33900e8d6ee..7856037aed5 100644
--- a/management-api-for-apache-cassandra-5.0.yaml
+++ b/management-api-for-apache-cassandra-5.0.yaml
@@ -1,6 +1,6 @@
 package:
   name: management-api-for-apache-cassandra-5.0
-  version: 0.1.89
+  version: 0.1.90
   epoch: 0
   description: RESTful / Secure Management Sidecar for Apache Cassandra
   copyright:
@@ -26,7 +26,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/k8ssandra/management-api-for-apache-cassandra
-      expected-commit: e65215c742387792afaa779975bc2bc38b4f3d3a
+      expected-commit: 6476187ccf88198706c90d7a6b613f1b5d29addd
       tag: v${{package.version}}
 
   # We can't (currently), use pombump, as this repo places license info as
diff --git a/management-api-for-apache-cassandra-5.0/pom-xml.patch b/management-api-for-apache-cassandra-5.0/pom-xml.patch
index 08137e3b3cb..0bac7e1e93b 100644
--- a/management-api-for-apache-cassandra-5.0/pom-xml.patch
+++ b/management-api-for-apache-cassandra-5.0/pom-xml.patch
@@ -1,5 +1,5 @@
 diff --git a/pom.xml b/pom.xml
-index 1dc19a9..de742bb 100644
+index b8ac3c3..61fc59e 100644
 --- a/pom.xml
 +++ b/pom.xml
 @@ -16,7 +16,7 @@
@@ -8,7 +8,7 @@ index 1dc19a9..de742bb 100644
      <revision>0.1.0-SNAPSHOT</revision>
 -    <driver.version>4.15.0</driver.version>
 +    <driver.version>4.17.0</driver.version>
-     <cassandra4.version>4.0.14</cassandra4.version>
+     <cassandra4.version>4.0.15</cassandra4.version>
      <docker.java.version>3.3.6</docker.java.version>
      <junit.version>4.13.2</junit.version>
 @@ -24,7 +24,7 @@
diff --git a/mariadb-11.5.yaml b/mariadb-11.6.yaml
similarity index 98%
rename from mariadb-11.5.yaml
rename to mariadb-11.6.yaml
index 18f824c7573..d0dc1916039 100644
--- a/mariadb-11.5.yaml
+++ b/mariadb-11.6.yaml
@@ -1,7 +1,7 @@
 package:
-  name: mariadb-11.5
-  version: 11.5.2
-  epoch: 4
+  name: mariadb-11.6
+  version: 11.6.2
+  epoch: 0
   description: "The MariaDB open source relational database"
   copyright:
     - license: GPL-3.0-or-later
@@ -39,7 +39,7 @@ pipeline:
     with:
       repository: https://github.com/MariaDB/server.git
       tag: mariadb-${{package.version}}
-      expected-commit: ea75a0b6009b0251e83193cd38c3974e36b65e06
+      expected-commit: d8dad8c3b54cd09fefce7bc3b9749f427eed9709
 
   - name: "Cmake"
     runs: |
@@ -237,7 +237,7 @@ update:
     identifier: MariaDB/server
     strip-prefix: mariadb-
     use-tag: true
-    tag-filter: mariadb-11.5.
+    tag-filter: mariadb-11.6.
 
 test:
   pipeline:
diff --git a/mariadb-11.5/docker-entrypoint.sh b/mariadb-11.6/docker-entrypoint.sh
similarity index 100%
rename from mariadb-11.5/docker-entrypoint.sh
rename to mariadb-11.6/docker-entrypoint.sh
diff --git a/melange.yaml b/melange.yaml
index 6a7ebd82798..014357523b4 100644
--- a/melange.yaml
+++ b/melange.yaml
@@ -1,6 +1,6 @@
 package:
   name: melange
-  version: 0.15.14
+  version: 0.17.1
   epoch: 0
   description: build APKs from source code
   copyright:
@@ -20,7 +20,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 2fff904cdf10b30b8948fa803069f7e62487d93c
+      expected-commit: 6d88b8b81475c4c7b2bd7802bf90b8cf2dc3d887
       repository: https://github.com/chainguard-dev/melange
       tag: v${{package.version}}
 
diff --git a/mockery.yaml b/mockery.yaml
index f50604bf2ec..265d2f64c5d 100644
--- a/mockery.yaml
+++ b/mockery.yaml
@@ -1,6 +1,6 @@
 package:
   name: mockery
-  version: 2.49.0
+  version: 2.49.2
   epoch: 0
   description: A mock code autogenerator for Go
   copyright:
@@ -17,7 +17,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/vektra/mockery
-      expected-commit: a27cb03053efde18d2f77e76a228a78c567a2643
+      expected-commit: 7d8df225512ff1327813d0c5759a684fee75ec0f
       tag: v${{package.version}}
 
   - runs: |
diff --git a/mountpoint-s3.yaml b/mountpoint-s3.yaml
index 68322664f10..0b5538e92f1 100644
--- a/mountpoint-s3.yaml
+++ b/mountpoint-s3.yaml
@@ -1,6 +1,6 @@
 package:
   name: mountpoint-s3
-  version: 1.11.0
+  version: 1.13.0
   epoch: 0
   description: A simple, high-throughput file client for mounting an Amazon S3 bucket as a local file system.
   copyright:
@@ -25,7 +25,7 @@ pipeline:
     with:
       repository: https://github.com/awslabs/mountpoint-s3
       tag: v${{package.version}}
-      expected-commit: 848434133368799358f46695ad50e1f5c3b261b7
+      expected-commit: d14655adf91c734ef21f5dcdeeeed110e13de68a
       recurse-submodules: true
 
   - name: Configure and Build
diff --git a/multipath-tools.yaml b/multipath-tools.yaml
index 23ea32a6a93..516cb6afec6 100644
--- a/multipath-tools.yaml
+++ b/multipath-tools.yaml
@@ -1,7 +1,7 @@
 package:
   name: multipath-tools
   version: 0.10.0
-  epoch: 2
+  epoch: 3
   description: Device Mapper Multipathing Driver
   copyright:
     - license: LGPL-2.0-only
@@ -64,3 +64,4 @@ test:
         multipath -h
         mpathpersist -h
         [ -x /usr/sbin/kpartx ]
+    - uses: test/pkgconf
diff --git a/neon.yaml b/neon.yaml
index 39bd34a5830..00e5df2c65e 100644
--- a/neon.yaml
+++ b/neon.yaml
@@ -1,7 +1,7 @@
 package:
   name: neon
-  version: "7145"
-  epoch: 1
+  version: "7261"
+  epoch: 0
   description: "Serverless Postgres. We separated storage and compute to offer autoscaling, branching, and bottomless storage."
   copyright:
     - license: Apache-2.0
@@ -47,7 +47,7 @@ pipeline:
     with:
       repository: https://github.com/neondatabase/neon
       tag: release-${{package.version}}
-      expected-commit: 1388bbae73cc714ed65d82240f6e0935eef805c6
+      expected-commit: 73ad44ae25fa863cf19d091200cab2c6d2e36280
       recurse-submodules: true
 
   - runs: |
diff --git a/nerdctl.yaml b/nerdctl.yaml
index a75e093723a..71056f68cf7 100644
--- a/nerdctl.yaml
+++ b/nerdctl.yaml
@@ -1,6 +1,6 @@
 package:
   name: nerdctl
-  version: 2.0.0
+  version: 2.0.1
   epoch: 0
   description: Docker-compatible CLI for containerd, with support for Compose, Rootless, eStargz, OCIcrypt, IPFS, ...
   copyright:
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/containerd/nerdctl
       tag: v${{package.version}}
-      expected-commit: ef588dafa080e3dbc9c061ff3802affb66aef291
+      expected-commit: 47f31ff2c1615c1accb85c1ce4e7882ad739102f
 
   - runs: |
       make nerdctl
diff --git a/neuvector-manager.yaml b/neuvector-manager.yaml
index b89d9bb58c9..9952a1bcf66 100644
--- a/neuvector-manager.yaml
+++ b/neuvector-manager.yaml
@@ -1,6 +1,6 @@
 package:
   name: neuvector-manager
-  version: 5.4.0
+  version: 5.4.1
   epoch: 0
   description: NeuVector Security Center Admin Console.
   copyright:
@@ -11,7 +11,7 @@ package:
       - ca-certificates
       - iproute2
       - neuvector-manager-cli
-      - openjdk-11-default-jvm
+      - openjdk-17-default-jvm
       - procps
 
 environment:
@@ -21,10 +21,10 @@ environment:
     packages:
       - build-base
       - busybox
-      - nodejs
+      - nodejs-22 # Lock to (current) latest LTS as recommended during build process.
       - npm
-      - openjdk-11
-      - openjdk-11-default-jvm
+      - openjdk-17
+      - openjdk-17-default-jvm
       - py3-pip
       - python3
       - sbt
@@ -34,7 +34,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 3e1b728efd32feb7f575877866ee5be506e5b047
+      expected-commit: 0a304f70bc56c0dc111d451e804d0950047854c1
       repository: https://github.com/neuvector/manager
       tag: v${{package.version}}
 
@@ -51,11 +51,11 @@ pipeline:
 
       # Build and compress JAR
       sbt admin/assembly
-      zip -d admin/target/scala-2.11/admin-assembly-1.0.jar rest-management-private-classpath\*
+      zip -d admin/target/scala-3.3.4/admin-assembly-1.0.jar rest-management-private-classpath\*
 
       # Unfortunately, a lot of things are hardcoded to /usr/local/...
       mkdir -p ${{targets.contextdir}}/usr/local/bin
-      install -Dm755 admin/target/scala-2.11/admin-assembly-1.0.jar ${{targets.contextdir}}/usr/local/bin/
+      install -Dm755 admin/target/scala-3.3.4/admin-assembly-1.0.jar ${{targets.contextdir}}/usr/local/bin/
       install -Dm755 scripts/* ${{targets.contextdir}}/usr/local/bin/
 
   - uses: strip
diff --git a/newrelic-prometheus-configurator.yaml b/newrelic-prometheus-configurator.yaml
index 8bebf97d6f8..ef8af79048c 100644
--- a/newrelic-prometheus-configurator.yaml
+++ b/newrelic-prometheus-configurator.yaml
@@ -1,6 +1,6 @@
 package:
   name: newrelic-prometheus-configurator
-  version: 1.18.2
+  version: 1.18.3
   epoch: 0
   description: New Relic Prometheus Configurator
   copyright:
@@ -20,7 +20,7 @@ pipeline:
     with:
       repository: https://github.com/newrelic/newrelic-prometheus-configurator
       tag: v${{package.version}}
-      expected-commit: 9517d4255b9a233a52a648a64c5a40e63188c863
+      expected-commit: d206ffc3f27215de5b62c306d497898e83328895
 
   - runs: |
       GOOS=$(go env GOOS)
diff --git a/nfs-ganesha.yaml b/nfs-ganesha.yaml
index fa933400643..fdb23e0e596 100644
--- a/nfs-ganesha.yaml
+++ b/nfs-ganesha.yaml
@@ -1,6 +1,6 @@
 package:
   name: nfs-ganesha
-  version: "6.2"
+  version: "6.3"
   epoch: 0
   description: NFS-Ganesha is an NFSv3,v4,v4.1 fileserver that runs in user mode on most UNIX/Linux systems
   copyright:
@@ -30,7 +30,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: c9ff03bb11397d525e8b768772a2a26b84628796
+      expected-commit: f503dc4067aa1ef23f878635f18e8dfbc5786ced
       repository: https://github.com/nfs-ganesha/nfs-ganesha
       tag: V${{package.version}}
       recurse-submodules: true
diff --git a/nginx-mainline.yaml b/nginx-mainline.yaml
index a4837b1442c..3906f8ba7df 100644
--- a/nginx-mainline.yaml
+++ b/nginx-mainline.yaml
@@ -1,8 +1,8 @@
 package:
   name: nginx-mainline
   # Must also bump njs at the same time
-  version: 1.27.2
-  epoch: 1
+  version: 1.27.3
+  epoch: 0
   description: HTTP and reverse proxy server (mainline version)
   copyright:
     - license: BSD-2-Clause
@@ -55,7 +55,7 @@ pipeline:
     with:
       repository: https://github.com/nginx/nginx.git
       tag: release-${{package.version}}
-      expected-commit: e24f7ccc161f1a2a759eb27263ec9af4fc7c8e96
+      expected-commit: e7bd2557458c26839da89e694067017eeb214348
       destination: nginx-mainline
   - name: configure
     working-directory: nginx-mainline
diff --git a/nginx-prometheus-exporter.yaml b/nginx-prometheus-exporter.yaml
index cda2931da3c..ca4f5abcf13 100644
--- a/nginx-prometheus-exporter.yaml
+++ b/nginx-prometheus-exporter.yaml
@@ -1,6 +1,6 @@
 package:
   name: nginx-prometheus-exporter
-  version: 1.3.0
+  version: 1.4.0
   epoch: 0
   description: NGINX Prometheus Exporter for NGINX and NGINX Plus
   copyright:
@@ -9,7 +9,7 @@ package:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 9522f4e39ee1aed817d7d70a89514ccc0ae1594a
+      expected-commit: eb921f6062ff814acf8913cade92def952dfbe2e
       repository: https://github.com/nginxinc/nginx-prometheus-exporter
       tag: v${{package.version}}
 
diff --git a/ntpd-rs.yaml b/ntpd-rs.yaml
index 9b2918de669..e476923dc33 100644
--- a/ntpd-rs.yaml
+++ b/ntpd-rs.yaml
@@ -1,7 +1,7 @@
 package:
   name: ntpd-rs
-  version: 1.3.0
-  epoch: 1
+  version: 1.3.1
+  epoch: 0
   description: "An NTP implementation in Rust."
   copyright:
     - license: MIT
@@ -22,7 +22,9 @@ pipeline:
     with:
       repository: https://github.com/pendulum-project/ntpd-rs
       tag: v${{package.version}}
-      expected-commit: e8869f4378971ca470131e54fea6e72655a774c3
+      expected-commit: 6d72d3e724217e0740ae616dff8cccaf639d6f76
+
+  - uses: rust/cargobump
 
   - name: Configure and build
     runs: |
diff --git a/ntpd-rs/cargobump-deps.yaml b/ntpd-rs/cargobump-deps.yaml
new file mode 100644
index 00000000000..4d353f7d988
--- /dev/null
+++ b/ntpd-rs/cargobump-deps.yaml
@@ -0,0 +1,3 @@
+packages:
+    - name: rustls
+      version: 0.23.18
diff --git a/nuclei.yaml b/nuclei.yaml
index 185028a9fe2..c52d3ac90ad 100644
--- a/nuclei.yaml
+++ b/nuclei.yaml
@@ -1,6 +1,6 @@
 package:
   name: nuclei
-  version: 3.3.6
+  version: 3.3.7
   epoch: 0
   description: "yaml based vulnerability scanner"
   copyright:
@@ -18,7 +18,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 419f08f61ce5ca2d3f0eae9fe36dc7c44c1f532a
+      expected-commit: bf01be16826fc5c4106164f995279b366d1f9092
       repository: https://github.com/projectdiscovery/nuclei
       tag: v${{package.version}}
 
diff --git a/ollama.yaml b/ollama.yaml
index 23bcdd68d94..f59b16af4cd 100644
--- a/ollama.yaml
+++ b/ollama.yaml
@@ -1,6 +1,6 @@
 package:
   name: ollama
-  version: 0.4.4
+  version: 0.4.7
   epoch: 0
   description: Get up and running with Llama 2 and other large language models locally
   copyright:
@@ -20,7 +20,7 @@ pipeline:
     with:
       repository: https://github.com/ollama/ollama
       tag: v${{package.version}}
-      expected-commit: 3478b2cf14c3fa2661c03f7fd5764a63a496293a
+      expected-commit: 5f8051180e3b9aeafc153f6b5056e7358a939c88
 
   - runs: |
       go generate ./...
diff --git a/openbao.yaml b/openbao.yaml
index 294b842a2de..5c0c187bb49 100644
--- a/openbao.yaml
+++ b/openbao.yaml
@@ -1,6 +1,6 @@
 package:
   name: openbao
-  version: 2.0.3
+  version: 2.1.0
   epoch: 0
   description: OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/openbao/openbao
       tag: v${{package.version}}
-      expected-commit: a2522eb71d1854f83c7e2e02fdbfc01ae74c3a78
+      expected-commit: 93609bf0c73a18dd81ac8c7d21b95cbde1e4887c
   - runs: |
       # NOTE: uncomment when enabling embedding of UI
       # make ember-dist
diff --git a/openldap.yaml b/openldap.yaml
index 3d438ac8a8f..dc8d0d43ac2 100644
--- a/openldap.yaml
+++ b/openldap.yaml
@@ -1,7 +1,7 @@
 package:
   name: openldap
-  version: 2.6.8
-  epoch: 6
+  version: 2.6.9
+  epoch: 0
   description: LDAP Server
   copyright:
     - license: OLDAP-2.8
@@ -37,7 +37,7 @@ pipeline:
     with:
       repository: https://git.openldap.org/openldap/openldap.git
       tag: OPENLDAP_REL_ENG_${{vars.mangled-package-version}}
-      expected-commit: 29eea855250dd882d452d6c796dfd1b5ec79de94
+      expected-commit: e460f00874352c3d2cdbca8a00a4112c7bc633ab
 
   - uses: patch
     with:
diff --git a/openssl.yaml b/openssl.yaml
index 21757ba4c75..50fbb038442 100644
--- a/openssl.yaml
+++ b/openssl.yaml
@@ -2,19 +2,13 @@
 package:
   name: openssl
   version: 3.4.0
-  epoch: 2
+  epoch: 3
   description: "the OpenSSL cryptography suite"
   copyright:
     - license: Apache-2.0
   resources:
     cpu: 16
     memory: 16Gi
-  # For now, continue to install the legacy openssl provider if the parent openssl
-  # package is installed.  This is done because users may be installing the openssl
-  # package to gain that provider.
-  dependencies:
-    runtime:
-      - openssl-provider-legacy
 
 environment:
   contents:
diff --git a/opentelemetry-cpp.yaml b/opentelemetry-cpp.yaml
index 0181e8f4c3c..62128682735 100644
--- a/opentelemetry-cpp.yaml
+++ b/opentelemetry-cpp.yaml
@@ -1,7 +1,7 @@
 package:
   name: opentelemetry-cpp
-  version: 1.17.0
-  epoch: 2
+  version: 1.18.0
+  epoch: 1
   description: The OpenTelemetry C++ Client
   copyright:
     - license: Apache-2.0
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/open-telemetry/opentelemetry-cpp
       tag: v${{package.version}}
-      expected-commit: fa0a5200ddbe9ae6f487a228e658aedc102dab56
+      expected-commit: 955a807c0461544560429c2414b8967f6023e590
 
   - uses: cmake/configure
     with:
diff --git a/opentelemetry-java-contrib.yaml b/opentelemetry-java-contrib.yaml
new file mode 100644
index 00000000000..ed94e3e677f
--- /dev/null
+++ b/opentelemetry-java-contrib.yaml
@@ -0,0 +1,75 @@
+package:
+  name: opentelemetry-java-contrib
+  version: 1.41.0
+  epoch: 0
+  description: Helpful libraries and standalone OpenTelemetry-based utilities for opentelemetry java and java instrumentation
+  copyright:
+    - license: Apache-2.0
+
+environment:
+  contents:
+    packages:
+      - bash
+      - busybox
+      - ca-certificates-bundle
+      - openjdk-17-default-jdk
+  environment:
+    JAVA_HOME: /usr/lib/jvm/java-17-openjdk
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/open-telemetry/opentelemetry-java-contrib.git
+      tag: v${{package.version}}
+      expected-commit: e0775a738750d875462ca2170a3083a52fdfea7f
+      recurse-submodules: true
+
+data:
+  - name: contrib-components
+    items:
+      all: "."
+      aws-resources: "."
+      aws-xray: "."
+      aws-xray-propagator: "."
+      baggage-processor: "."
+      consistent-sampling: "."
+      disk-buffering: "."
+      gcp-resources: "."
+      inferred-spans: "."
+      jfr-connection: "."
+      jfr-events: "."
+      jmx-metrics: "."
+      kafka-exporter: "."
+      maven-extension: "."
+      micrometer-meter-provider: "."
+      noop-api: "."
+      opamp-client: "."
+      processors: "."
+      prometheus-client-bridge: "."
+      resource-providers: "."
+      samplers: "."
+      span-stacktrace: "."
+      static-instrumenter: "."
+
+subpackages:
+  - range: contrib-components
+    name: ${{package.name}}-${{range.key}}
+    pipeline:
+      - runs: |
+          ./gradlew :${{range.key}}:build -Potel.stable=true -x test
+      - runs: |
+          mkdir -p ${{targets.contextdir}}/usr/share/java/${{range.key}}
+          mv /home/build/${{range.key}}/build/libs/opentelemetry-${{range.key}}-${{package.version}}.jar ${{targets.contextdir}}/usr/share/java/${{range.key}}
+
+  - range: contrib-components
+    name: ${{package.name}}-${{range.key}}-compat
+    pipeline:
+      - runs: |
+          mkdir -p ${{targets.contextdir}}/opt
+          ln -sf /usr/share/java/${{range.key}}/opentelemetry-${{range.key}}-${{package.version}}.jar ${{targets.contextdir}}/opt/opentelemetry-${{range.key}}-${{package.version}}.jar
+
+update:
+  enabled: true
+  github:
+    identifier: open-telemetry/opentelemetry-java-contrib
+    strip-prefix: v
diff --git a/opentelemetry-plugin-nginx.yaml b/opentelemetry-plugin-nginx.yaml
index b276cefc308..73fdcee6121 100644
--- a/opentelemetry-plugin-nginx.yaml
+++ b/opentelemetry-plugin-nginx.yaml
@@ -1,7 +1,7 @@
 #nolint:valid-pipeline-git-checkout-tag
 package:
   name: opentelemetry-plugin-nginx
-  version: 0_git20241118
+  version: 0_git20241128
   epoch: 0
   description: Adds OpenTelemetry distributed tracing support to nginx. This is the otel community plugin for nginx, not the official nginx plugin for otel.
   copyright:
diff --git a/pango.yaml b/pango.yaml
index 6b4d87fb0e5..21e85257b01 100644
--- a/pango.yaml
+++ b/pango.yaml
@@ -4,8 +4,8 @@
 #nolint:git-checkout-must-use-github-updates
 package:
   name: pango
-  version: 1.54.0
-  epoch: 1
+  version: 1.55.0
+  epoch: 0
   description: library for layout and rendering of text
   copyright:
     - license: LGPL-2.1-or-later
@@ -38,7 +38,7 @@ pipeline:
     with:
       repository: https://gitlab.gnome.org/GNOME/pango.git
       tag: ${{package.version}}
-      expected-commit: 5b1551e933d069d15169eb7c8bd6b2e95cbfe230
+      expected-commit: b206e98a28491737c48ab051fd1df24c79354d45
 
   - uses: meson/configure
     with:
diff --git a/parallel.yaml b/parallel.yaml
index 53db19d0d32..bdfba7cb2e1 100644
--- a/parallel.yaml
+++ b/parallel.yaml
@@ -1,10 +1,16 @@
 package:
   name: parallel
   version: "20241122"
-  epoch: 0
+  epoch: 1
   description: "GNU parallel is a shell tool for executing jobs in parallel using one or more computers"
   copyright:
     - license: GPL-3.0-or-later
+  options:
+    # to avoid depending on shells that's being added as dependency to this package.
+    no-depends: true
+  dependencies:
+    runtime:
+      - perl
 
 environment:
   contents:
@@ -37,6 +43,15 @@ pipeline:
       ${{targets.contextdir}}/usr/bin/env_parallel.pdksh \
       ${{targets.contextdir}}/usr/bin/env_parallel.tcsh
 
+subpackages:
+  - name: parallel-doc
+    description: parallel documentation
+    pipeline:
+      - uses: split/manpages
+      - runs: |
+          mkdir -p "${{targets.subpkgdir}}"/usr/share
+          mv "${{targets.destdir}}"/usr/share/doc "${{targets.subpkgdir}}"/usr/share/
+
 update:
   enabled: true
   release-monitor:
diff --git a/percona-xtrabackup-8.4.yaml b/percona-xtrabackup-8.4.yaml
index 7c2c2784665..9260df46083 100644
--- a/percona-xtrabackup-8.4.yaml
+++ b/percona-xtrabackup-8.4.yaml
@@ -1,7 +1,7 @@
 package:
   name: percona-xtrabackup-8.4
   version: 8.4.0.1
-  epoch: 1
+  epoch: 2
   description: Open source hot backup tool for InnoDB and XtraDB databases
   copyright:
     - license: Apache-2.0
diff --git a/pgpool2-4.5.yaml b/pgpool2-4.5.yaml
new file mode 100644
index 00000000000..1242ea429ec
--- /dev/null
+++ b/pgpool2-4.5.yaml
@@ -0,0 +1,185 @@
+package:
+  name: pgpool2-4.5
+  version: 4.5.5
+  epoch: 2
+  description: Middleware that works between PostgreSQL servers and a PostgreSQL database client.
+  copyright:
+    - license: BSD-3-Clause AND MIT
+  dependencies:
+    provides:
+      - pgpool2=${{package.full-version}}
+
+environment:
+  contents:
+    packages:
+      - autoconf
+      - automake
+      - bison
+      - build-base
+      - busybox
+      - flex
+      - libtool
+      - openssl-dev
+      - postgresql-dev
+
+var-transforms:
+  - from: ${{package.version}}
+    match: \.
+    replace: _
+    to: mangled-package-version
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/pgpool/pgpool2
+      tag: V${{vars.mangled-package-version}}
+      expected-commit: 8010cde32d4277b06f84216fd5e0d4b735e95b71
+
+  - uses: autoconf/configure
+    with:
+      opts: |
+        --sysconfdir=/etc/pgpool2 --with-openssl
+
+  # build src/parser explicitly to avoid build failures due to missing parser files with -j flag
+  - runs: |
+      make -C src/parser V=1
+
+  - uses: autoconf/make
+
+  - uses: autoconf/make-install
+
+  - uses: strip
+
+  - runs: |
+      mkdir -p "${{targets.contextdir}}/var/run/pgpool"
+
+subpackages:
+  - name: ${{package.name}}-dev
+    pipeline:
+      - uses: split/dev
+    dependencies:
+      provides:
+        - pgpool2-dev=${{package.full-version}}
+      runtime:
+        - ${{package.name}}
+
+  - name: ${{package.name}}-bitnami-compat
+    dependencies:
+      provides:
+        - pgpool2-bitnami-compat=${{package.full-version}}
+      runtime:
+        - busybox
+        - coreutils
+        - openldap
+        - postgresql-client
+    pipeline:
+      - uses: bitnami/compat
+        with:
+          image: pgpool
+          version-path: 4/debian-12
+      # copy the patch file to patch the output form bitnami/compat and apply it
+      - runs: |
+          cp bitnami-compat-remove-os-flavour.patch "${{targets.contextdir}}/"
+      - uses: patch
+        working-directory: "${{targets.contextdir}}"
+        with:
+          patches: bitnami-compat-remove-os-flavour.patch
+      # remove patch file to prevent it from being packaged
+      - runs: |
+          rm "${{targets.contextdir}}/bitnami-compat-remove-os-flavour.patch"
+      - runs: |
+          mkdir -p "${{targets.contextdir}}/opt/bitnami/pgpool/bin"
+          # symlink all binaries to /opt/bitnami/pgpool/bin
+          for bin in \
+            pcp_attach_node pcp_detach_node pcp_health_check_stats pcp_node_count \
+            pcp_node_info pcp_pool_status pcp_proc_count pcp_proc_info pcp_promote_node \
+            pcp_recovery_node pcp_stop_pgpool pcp_watchdog_info \
+            pg_enc pg_md5 pgpool pgpool_setup pgproto watchdog_setup wd_cli \
+          ; do
+            ln -s "/usr/bin/${bin}" "${{targets.contextdir}}/opt/bitnami/pgpool/bin/${bin}"
+          done
+
+          # copy etc to pgpool/etc
+          mkdir -p "${{targets.contextdir}}/opt/bitnami/pgpool/etc"
+          cp -pr "${{targets.destdir}}/etc/pgpool2/." "${{targets.contextdir}}/opt/bitnami/pgpool/etc/"
+
+          # copy etc to pgpool/etc.default
+          mkdir -p "${{targets.contextdir}}/opt/bitnami/pgpool/etc.default"
+          cp -pr "${{targets.destdir}}/etc/pgpool2/." "${{targets.contextdir}}/opt/bitnami/pgpool/etc.default/"
+
+          # link postgres binaries to /opt/bitnami/postgresql/bin
+          mkdir -p "${{targets.contextdir}}/opt/bitnami/postgresql/bin"
+          for bin in \
+            pg_dump pg_dumpall pg_restore psql \
+          ; do
+            ln -s "/usr/bin/${bin}" "${{targets.contextdir}}/opt/bitnami/postgresql/bin/${bin}"
+          done
+    test:
+      environment:
+        contents:
+          packages:
+            - ${{package.name}}
+      pipeline:
+        - runs: |
+            test -f /opt/bitnami/pgpool/bin/pgpool
+            test -f /opt/bitnami/postgresql/bin/psql
+
+update:
+  enabled: false
+  manual: true
+  exclude-reason: Versions using underscore
+  github:
+    identifier: pgpool/pgpool2
+    strip-prefix: V
+
+test:
+  environment:
+    contents:
+      packages:
+        - postgresql
+        - postgresql-client
+        - shadow
+        - sudo-rs
+    environment:
+      PGDATA: /tmp/test_db
+      PGUSER: wolfi
+      PGPASSWORD: custompassword
+  pipeline:
+    - name: "Test binaries"
+      runs: |
+        pgpool --version
+        pgpool --help
+    - name: "Configure postgresql"
+      runs: |
+        useradd $PGUSER
+        sudo -u $PGUSER initdb -D /tmp/test_db
+        sudo -u $PGUSER pg_ctl -D /tmp/test_db -l /tmp/logfile start
+    - name: "Create database and table"
+      runs: |
+        createdb customdatabase
+        psql customdatabase -c "CREATE TABLE IF NOT EXISTS test_table (id INTEGER, str TEXT); INSERT INTO test_table VALUES(1, 'Test value');"
+    - name: "Configure and start pgpool"
+      runs: |
+        # 28b48ce7ae1f2db6539f7ed94728d992 = custompassword
+        echo "wolfi:28b48ce7ae1f2db6539f7ed94728d992" >/etc/pgpool2/pcp.conf
+        cp /etc/pgpool2/pool_hba.conf.sample /etc/pgpool2/pool_hba.conf
+        cat >/etc/pgpool2/pgpool.conf <<EOF
+        listen_addresses = '*'
+        port = 55432
+        backend_hostname0 = 'localhost'
+        backend_port0 = 5432
+        EOF
+        pgpool
+    - name: "Test query"
+      runs: |
+        # connect via pgpool and validate connection ; retry in case pgpool is not up yet
+        for attempt in $(seq 1 10) ; do
+          if ! psql -Uwolfi -h127.0.0.1 -p55432 customdatabase -c "SELECT * FROM test_table" \
+            | grep 'Test value' ; then
+            sleep 3
+          else
+            exit 0
+          fi
+        done
+        echo "Unable to query data"
+        exit 1
diff --git a/pgpool2-4.5/bitnami-compat-remove-os-flavour.patch b/pgpool2-4.5/bitnami-compat-remove-os-flavour.patch
new file mode 100644
index 00000000000..453473bd572
--- /dev/null
+++ b/pgpool2-4.5/bitnami-compat-remove-os-flavour.patch
@@ -0,0 +1,38 @@
+--- a/opt/bitnami/scripts/libldapclient.sh
++++ b/opt/bitnami/scripts/libldapclient.sh
+@@ -35,33 +35,20 @@
+ export LDAP_SEARCH_MAP="${LDAP_SEARCH_MAP:-}"
+ 
+ EOF
+-    if [[ "$OS_FLAVOUR" =~ ^debian-.*$ ]]; then
+-        cat <<"EOF"
+ export LDAP_NSLCD_GROUP="nslcd"
+-EOF
+-    elif [[ "$OS_FLAVOUR" =~ ^(photon)-.*$ ]]; then
+-        cat <<"EOF"
+-export LDAP_NSLCD_GROUP="ldap"
+-EOF
+-    fi
+ }
+ 
+ ########################
+ # Return LDAP config file path depending on distro
+ # Globals:
+-#   OS_FLAVOUR
++#   None
+ # Arguments:
+ #   None
+ # Returns:
+ #   (String) LDAP config file path
+ #########################
+ ldap_openldap_config_path() {
+-    local openldap_config
+-    case "$OS_FLAVOUR" in
+-    debian-* | ubuntu-*) openldap_config=/etc/ldap/ldap.conf ;;
+-    photon-* | redhatubi-*) openldap_config=/etc/openldap/ldap.conf ;;
+-    *) error "Unsupported OS flavor ${OS_FLAVOUR}" && exit 1 ;;
+-    esac
++    local openldap_config=/etc/ldap/ldap.conf
+     echo "$openldap_config"
+ }
+ 
diff --git a/php-8.1-grpc.yaml b/php-8.1-grpc.yaml
index 857140225e7..41a49656196 100644
--- a/php-8.1-grpc.yaml
+++ b/php-8.1-grpc.yaml
@@ -1,6 +1,6 @@
 package:
   name: php-8.1-grpc
-  version: 1.68.0
+  version: 1.68.2
   epoch: 0
   description: "A PHP extension for gRPC"
   copyright:
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/grpc/grpc
       tag: "v${{package.version}}"
-      expected-commit: 6b49ae626bc9cd7033e062f89dbe0e0576b1110e
+      expected-commit: 859bc5216ba3955fb8925326bdec391fd93c8730
 
   - name: Prepare build
     runs: cd src/php/ext/grpc && phpize
diff --git a/php-8.1-pecl-mongodb.yaml b/php-8.1-pecl-mongodb.yaml
index e6fdb5aa840..4b83a406ad9 100644
--- a/php-8.1-pecl-mongodb.yaml
+++ b/php-8.1-pecl-mongodb.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.1-pecl-mongodb
-  version: 1.20.0
-  epoch: 3
+  version: 1.20.1
+  epoch: 0
   description: "PHP ${{vars.phpMM}} MongoDB driver - PECL"
   copyright:
     - license: PHP-3.01
@@ -39,7 +39,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://pecl.php.net/get/mongodb-${{package.version}}.tgz
-      expected-sha512: 715b40616c9c61294dc2947ddbc1b2bf2ecac02654fcbcdec5394acf1e44365f1a96f15d3459b57e50fa2f125f44d406d7bdb6306c13b9ffa892686c4cdc3cee
+      expected-sha512: bb1914d6adcdbf8a3b3c513cb59119b09379d00c5736bff4622d578e616d5f85c79f2a54be7bb03fd6feb3f7c491ad34bdcfc66d929ee4bb4fcb26cf77668df4
 
   - name: phpize and configure
     runs: |
@@ -56,6 +56,27 @@ pipeline:
 
   - uses: strip
 
+test:
+  environment:
+    contents:
+      packages:
+        - php-${{vars.phpMM}}
+  pipeline:
+    - name: Verify Extension is Loaded
+      runs: |
+        echo "<?php
+        if (!extension_loaded('mongodb')) {
+            die('The MongoDB PHP extension is not loaded. Please install or enable it.\n');
+        }
+        ?>" > test.php
+        php test.php
+        if [ $? -ne 0 ]; then
+          echo "Test failed: Unable to use mongodb extension."
+          exit 1
+        else
+          echo "Test passed: mongodb extension is functional."
+        fi
+
 update:
   enabled: true
   release-monitor:
diff --git a/php-8.1-protobuf.yaml b/php-8.1-protobuf.yaml
index 93417869c55..a653a779f70 100644
--- a/php-8.1-protobuf.yaml
+++ b/php-8.1-protobuf.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.1-protobuf
-  version: 4.28.3
-  epoch: 1
+  version: 4.29.0
+  epoch: 0
   description: "Protocol Buffers - Google's data interchange format"
   copyright:
     - license: BSD-3-Clause
@@ -30,7 +30,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://pecl.php.net/get/protobuf-${{package.version}}.tgz
-      expected-sha512: 9c784c5e0e32fa795f86ab961664f93cb4b137ee5990e93383794c94252baceae4547ee5e1298f53bc8c22f80220987eb9a3fd7f21943d4a58e0fc04b4395289
+      expected-sha512: e7c4bca38af0a1122e530ebf6353cdd57a3c8cb71c31de818d0b187a0663589dbc0cdfd7124af8309cfb840de1b31928f6dab9d611b992a2783a7f87904eee81
 
   - name: Prepare build
     runs: phpize
diff --git a/php-8.1-swoole.yaml b/php-8.1-swoole.yaml
index 2aac130f610..1b2a774e9e5 100644
--- a/php-8.1-swoole.yaml
+++ b/php-8.1-swoole.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.1-swoole
-  version: 5.1.5
-  epoch: 1
+  version: 5.1.6
+  epoch: 0
   description: "Coroutine-based concurrency library for PHP"
   copyright:
     - license: Apache-2.0
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/swoole/swoole-src
       tag: "v${{package.version}}"
-      expected-commit: c713f73211c9f896e86e6f1744bff7f9fed9ee6f
+      expected-commit: df1f708b22440110aff8c125244d3de56569ed8c
 
   - name: Prepare build
     runs: phpize
diff --git a/php-8.1-xdebug.yaml b/php-8.1-xdebug.yaml
index 32ef3196f35..ef2c59ad208 100644
--- a/php-8.1-xdebug.yaml
+++ b/php-8.1-xdebug.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.1-xdebug
-  version: 3.3.2
-  epoch: 1
+  version: 3.4.0
+  epoch: 0
   description: "Step Debugger for PHP"
   copyright:
     - license: PHP-3.01
@@ -30,7 +30,7 @@ pipeline:
     with:
       repository: https://github.com/xdebug/xdebug
       tag: "${{package.version}}"
-      expected-commit: e978d755861a3a8d9dcef615bb6649b85f266658
+      expected-commit: 4284879cc0e3d749f872c2b7eec49521ca4b9ad0
 
   - name: Prepare build
     runs: phpize
diff --git a/php-8.2-grpc.yaml b/php-8.2-grpc.yaml
index 7b3b92c8a10..44b3d274196 100644
--- a/php-8.2-grpc.yaml
+++ b/php-8.2-grpc.yaml
@@ -1,6 +1,6 @@
 package:
   name: php-8.2-grpc
-  version: 1.68.0
+  version: 1.68.2
   epoch: 0
   description: "A PHP extension for gRPC"
   copyright:
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/grpc/grpc
       tag: "v${{package.version}}"
-      expected-commit: 6b49ae626bc9cd7033e062f89dbe0e0576b1110e
+      expected-commit: 859bc5216ba3955fb8925326bdec391fd93c8730
 
   - name: Prepare build
     runs: cd src/php/ext/grpc && phpize
diff --git a/php-8.2-pecl-mongodb.yaml b/php-8.2-pecl-mongodb.yaml
index ef934987906..f8a17c486fe 100644
--- a/php-8.2-pecl-mongodb.yaml
+++ b/php-8.2-pecl-mongodb.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.2-pecl-mongodb
-  version: 1.20.0
-  epoch: 3
+  version: 1.20.1
+  epoch: 0
   description: "PHP ${{vars.phpMM}} MongoDB driver - PECL"
   copyright:
     - license: PHP-3.01
@@ -39,7 +39,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://pecl.php.net/get/mongodb-${{package.version}}.tgz
-      expected-sha512: 715b40616c9c61294dc2947ddbc1b2bf2ecac02654fcbcdec5394acf1e44365f1a96f15d3459b57e50fa2f125f44d406d7bdb6306c13b9ffa892686c4cdc3cee
+      expected-sha512: bb1914d6adcdbf8a3b3c513cb59119b09379d00c5736bff4622d578e616d5f85c79f2a54be7bb03fd6feb3f7c491ad34bdcfc66d929ee4bb4fcb26cf77668df4
 
   - name: phpize and configure
     runs: |
@@ -56,6 +56,27 @@ pipeline:
 
   - uses: strip
 
+test:
+  environment:
+    contents:
+      packages:
+        - php-${{vars.phpMM}}
+  pipeline:
+    - name: Verify Extension is Loaded
+      runs: |
+        echo "<?php
+        if (!extension_loaded('mongodb')) {
+            die('The MongoDB PHP extension is not loaded. Please install or enable it.\n');
+        }
+        ?>" > test.php
+        php test.php
+        if [ $? -ne 0 ]; then
+          echo "Test failed: Unable to use mongodb extension."
+          exit 1
+        else
+          echo "Test passed: mongodb extension is functional."
+        fi
+
 update:
   enabled: true
   release-monitor:
diff --git a/php-8.2-protobuf.yaml b/php-8.2-protobuf.yaml
index 37f73299c04..de4f241f83e 100644
--- a/php-8.2-protobuf.yaml
+++ b/php-8.2-protobuf.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.2-protobuf
-  version: 4.28.3
-  epoch: 1
+  version: 4.29.0
+  epoch: 0
   description: "Protocol Buffers - Google's data interchange format"
   copyright:
     - license: BSD-3-Clause
@@ -30,7 +30,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://pecl.php.net/get/protobuf-${{package.version}}.tgz
-      expected-sha512: 9c784c5e0e32fa795f86ab961664f93cb4b137ee5990e93383794c94252baceae4547ee5e1298f53bc8c22f80220987eb9a3fd7f21943d4a58e0fc04b4395289
+      expected-sha512: e7c4bca38af0a1122e530ebf6353cdd57a3c8cb71c31de818d0b187a0663589dbc0cdfd7124af8309cfb840de1b31928f6dab9d611b992a2783a7f87904eee81
 
   - name: Prepare build
     runs: phpize
diff --git a/php-8.2-swoole.yaml b/php-8.2-swoole.yaml
index 380f15c92cf..7c0cb491d3d 100644
--- a/php-8.2-swoole.yaml
+++ b/php-8.2-swoole.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.2-swoole
-  version: 5.1.5
-  epoch: 1
+  version: 5.1.6
+  epoch: 0
   description: "Coroutine-based concurrency library for PHP"
   copyright:
     - license: Apache-2.0
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/swoole/swoole-src
       tag: "v${{package.version}}"
-      expected-commit: c713f73211c9f896e86e6f1744bff7f9fed9ee6f
+      expected-commit: df1f708b22440110aff8c125244d3de56569ed8c
 
   - name: Prepare build
     runs: phpize
diff --git a/php-8.2-xdebug.yaml b/php-8.2-xdebug.yaml
index b459362c7e6..11fbf4100cc 100644
--- a/php-8.2-xdebug.yaml
+++ b/php-8.2-xdebug.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.2-xdebug
-  version: 3.3.2
-  epoch: 1
+  version: 3.4.0
+  epoch: 0
   description: "Step Debugger for PHP"
   copyright:
     - license: PHP-3.01
@@ -30,7 +30,7 @@ pipeline:
     with:
       repository: https://github.com/xdebug/xdebug
       tag: "${{package.version}}"
-      expected-commit: e978d755861a3a8d9dcef615bb6649b85f266658
+      expected-commit: 4284879cc0e3d749f872c2b7eec49521ca4b9ad0
 
   - name: Prepare build
     runs: phpize
diff --git a/php-8.3-grpc.yaml b/php-8.3-grpc.yaml
index 6a8af115606..708d20bb59c 100644
--- a/php-8.3-grpc.yaml
+++ b/php-8.3-grpc.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.3-grpc
-  version: 1.68.0
-  epoch: 1
+  version: 1.68.2
+  epoch: 0
   description: "A PHP extension for gRPC"
   copyright:
     - license: Apache-2.0
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/grpc/grpc
       tag: "v${{package.version}}"
-      expected-commit: 6b49ae626bc9cd7033e062f89dbe0e0576b1110e
+      expected-commit: 859bc5216ba3955fb8925326bdec391fd93c8730
 
   - name: Prepare build
     runs: cd src/php/ext/grpc && phpize
diff --git a/php-8.3-pecl-mongodb.yaml b/php-8.3-pecl-mongodb.yaml
index fb1949e18d1..a710102cb4e 100644
--- a/php-8.3-pecl-mongodb.yaml
+++ b/php-8.3-pecl-mongodb.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.3-pecl-mongodb
-  version: 1.20.0
-  epoch: 3
+  version: 1.20.1
+  epoch: 0
   description: "PHP ${{vars.phpMM}} MongoDB driver - PECL"
   copyright:
     - license: PHP-3.01
@@ -39,7 +39,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://pecl.php.net/get/mongodb-${{package.version}}.tgz
-      expected-sha512: 715b40616c9c61294dc2947ddbc1b2bf2ecac02654fcbcdec5394acf1e44365f1a96f15d3459b57e50fa2f125f44d406d7bdb6306c13b9ffa892686c4cdc3cee
+      expected-sha512: bb1914d6adcdbf8a3b3c513cb59119b09379d00c5736bff4622d578e616d5f85c79f2a54be7bb03fd6feb3f7c491ad34bdcfc66d929ee4bb4fcb26cf77668df4
 
   - name: phpize and configure
     runs: |
@@ -56,6 +56,27 @@ pipeline:
 
   - uses: strip
 
+test:
+  environment:
+    contents:
+      packages:
+        - php-${{vars.phpMM}}
+  pipeline:
+    - name: Verify Extension is Loaded
+      runs: |
+        echo "<?php
+        if (!extension_loaded('mongodb')) {
+            die('The MongoDB PHP extension is not loaded. Please install or enable it.\n');
+        }
+        ?>" > test.php
+        php test.php
+        if [ $? -ne 0 ]; then
+          echo "Test failed: Unable to use mongodb extension."
+          exit 1
+        else
+          echo "Test passed: mongodb extension is functional."
+        fi
+
 update:
   enabled: true
   release-monitor:
diff --git a/php-8.3-protobuf.yaml b/php-8.3-protobuf.yaml
index d396a66836d..74b710f1434 100644
--- a/php-8.3-protobuf.yaml
+++ b/php-8.3-protobuf.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.3-protobuf
-  version: 4.28.3
-  epoch: 1
+  version: 4.29.0
+  epoch: 0
   description: "Protocol Buffers - Google's data interchange format"
   copyright:
     - license: BSD-3-Clause
@@ -30,7 +30,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://pecl.php.net/get/protobuf-${{package.version}}.tgz
-      expected-sha512: 9c784c5e0e32fa795f86ab961664f93cb4b137ee5990e93383794c94252baceae4547ee5e1298f53bc8c22f80220987eb9a3fd7f21943d4a58e0fc04b4395289
+      expected-sha512: e7c4bca38af0a1122e530ebf6353cdd57a3c8cb71c31de818d0b187a0663589dbc0cdfd7124af8309cfb840de1b31928f6dab9d611b992a2783a7f87904eee81
 
   - name: Prepare build
     runs: phpize
diff --git a/php-8.3-swoole.yaml b/php-8.3-swoole.yaml
index 54500daff43..0c1a4d32c5b 100644
--- a/php-8.3-swoole.yaml
+++ b/php-8.3-swoole.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.3-swoole
-  version: 5.1.5
-  epoch: 2
+  version: 5.1.6
+  epoch: 0
   description: "Coroutine-based concurrency library for PHP"
   copyright:
     - license: Apache-2.0
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/swoole/swoole-src
       tag: "v${{package.version}}"
-      expected-commit: c713f73211c9f896e86e6f1744bff7f9fed9ee6f
+      expected-commit: df1f708b22440110aff8c125244d3de56569ed8c
 
   - name: Prepare build
     runs: phpize
diff --git a/php-8.3-xdebug.yaml b/php-8.3-xdebug.yaml
index 07f456433c8..65024f53868 100644
--- a/php-8.3-xdebug.yaml
+++ b/php-8.3-xdebug.yaml
@@ -1,7 +1,7 @@
 package:
   name: php-8.3-xdebug
-  version: 3.3.2
-  epoch: 1
+  version: 3.4.0
+  epoch: 0
   description: "Step Debugger for PHP"
   copyright:
     - license: PHP-3.01
@@ -30,7 +30,7 @@ pipeline:
     with:
       repository: https://github.com/xdebug/xdebug
       tag: "${{package.version}}"
-      expected-commit: e978d755861a3a8d9dcef615bb6649b85f266658
+      expected-commit: 4284879cc0e3d749f872c2b7eec49521ca4b9ad0
 
   - name: Prepare build
     runs: phpize
diff --git a/php-8.4-grpc.yaml b/php-8.4-grpc.yaml
index 1f17b212414..61ab0179c30 100644
--- a/php-8.4-grpc.yaml
+++ b/php-8.4-grpc.yaml
@@ -1,6 +1,6 @@
 package:
   name: php-8.4-grpc
-  version: 1.68.0
+  version: 1.68.2
   epoch: 0
   description: "A PHP extension for gRPC"
   copyright:
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/grpc/grpc
       tag: "v${{package.version}}"
-      expected-commit: 6b49ae626bc9cd7033e062f89dbe0e0576b1110e
+      expected-commit: 859bc5216ba3955fb8925326bdec391fd93c8730
 
   - name: Prepare build
     runs: cd src/php/ext/grpc && phpize
diff --git a/php-8.4-pecl-mongodb.yaml b/php-8.4-pecl-mongodb.yaml
index 95f0f1ee7af..1f86abc7cdc 100644
--- a/php-8.4-pecl-mongodb.yaml
+++ b/php-8.4-pecl-mongodb.yaml
@@ -1,6 +1,6 @@
 package:
   name: php-8.4-pecl-mongodb
-  version: 1.20.0
+  version: 1.20.1
   epoch: 0
   description: "PHP ${{vars.phpMM}} MongoDB driver - PECL"
   copyright:
@@ -39,7 +39,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://pecl.php.net/get/mongodb-${{package.version}}.tgz
-      expected-sha512: 715b40616c9c61294dc2947ddbc1b2bf2ecac02654fcbcdec5394acf1e44365f1a96f15d3459b57e50fa2f125f44d406d7bdb6306c13b9ffa892686c4cdc3cee
+      expected-sha512: bb1914d6adcdbf8a3b3c513cb59119b09379d00c5736bff4622d578e616d5f85c79f2a54be7bb03fd6feb3f7c491ad34bdcfc66d929ee4bb4fcb26cf77668df4
 
   - name: phpize and configure
     runs: |
@@ -56,6 +56,27 @@ pipeline:
 
   - uses: strip
 
+test:
+  environment:
+    contents:
+      packages:
+        - php-${{vars.phpMM}}
+  pipeline:
+    - name: Verify Extension is Loaded
+      runs: |
+        echo "<?php
+        if (!extension_loaded('mongodb')) {
+            die('The MongoDB PHP extension is not loaded. Please install or enable it.\n');
+        }
+        ?>" > test.php
+        php test.php
+        if [ $? -ne 0 ]; then
+          echo "Test failed: Unable to use mongodb extension."
+          exit 1
+        else
+          echo "Test passed: mongodb extension is functional."
+        fi
+
 update:
   enabled: true
   release-monitor:
diff --git a/php-8.4-protobuf.yaml b/php-8.4-protobuf.yaml
index 58328a86f7c..a8e8c72c1ab 100644
--- a/php-8.4-protobuf.yaml
+++ b/php-8.4-protobuf.yaml
@@ -1,6 +1,6 @@
 package:
   name: php-8.4-protobuf
-  version: 4.28.3
+  version: 4.29.0
   epoch: 0
   description: "Protocol Buffers - Google's data interchange format"
   copyright:
@@ -30,7 +30,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://pecl.php.net/get/protobuf-${{package.version}}.tgz
-      expected-sha512: 9c784c5e0e32fa795f86ab961664f93cb4b137ee5990e93383794c94252baceae4547ee5e1298f53bc8c22f80220987eb9a3fd7f21943d4a58e0fc04b4395289
+      expected-sha512: e7c4bca38af0a1122e530ebf6353cdd57a3c8cb71c31de818d0b187a0663589dbc0cdfd7124af8309cfb840de1b31928f6dab9d611b992a2783a7f87904eee81
 
   - name: Prepare build
     runs: phpize
diff --git a/pixi.yaml b/pixi.yaml
index 79e930f6b73..25d8e5b0bf6 100644
--- a/pixi.yaml
+++ b/pixi.yaml
@@ -1,6 +1,6 @@
 package:
   name: pixi
-  version: 0.37.0
+  version: 0.39.0
   epoch: 0
   description: "Package management made easy"
   copyright:
@@ -23,7 +23,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/prefix-dev/pixi
-      expected-commit: fc901915c65c1a48c665d60a4c5c5bb4d6714b34
+      expected-commit: 656ecd6c38c4808a1415623b18c853d4c2a0c4a1
       tag: v${{package.version}}
 
   - uses: rust/cargobump
diff --git a/pixi/cargobump-deps.yaml b/pixi/cargobump-deps.yaml
index c477f6ccadc..c9ad5378116 100644
--- a/pixi/cargobump-deps.yaml
+++ b/pixi/cargobump-deps.yaml
@@ -3,3 +3,5 @@ packages:
       version: 1.0.0
     - name: quinn-proto
       version: 0.11.7
+    - name: rustls
+      version: 0.23.18
diff --git a/pixman.yaml b/pixman.yaml
index 8408d77569e..a0e23af183f 100644
--- a/pixman.yaml
+++ b/pixman.yaml
@@ -1,6 +1,6 @@
 package:
   name: pixman
-  version: 0.44.0
+  version: 0.44.2
   epoch: 0
   description: Low-level pixel manipulation library
   copyright:
@@ -20,7 +20,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: ea55473db5ec9f068bbf4d14ec3186b742804bf74fdc782fc89aa87d2656fc46
+      expected-sha256: 50baf820dde0c5ff9714d03d2df4970f606a3d3b1024f5404c0398a9821cc4b0
       uri: https://www.x.org/releases/individual/lib/pixman-${{package.version}}.tar.xz
 
   - runs: |
diff --git a/pnpm.yaml b/pnpm.yaml
index d8c233b77b5..8d76465754d 100644
--- a/pnpm.yaml
+++ b/pnpm.yaml
@@ -1,6 +1,6 @@
 package:
   name: pnpm
-  version: 9.14.2
+  version: 9.14.4
   epoch: 0
   description: "Fast, disk space efficient package manager"
   copyright:
@@ -29,7 +29,7 @@ pipeline:
     with:
       repository: https://github.com/pnpm/pnpm
       tag: v${{package.version}}
-      expected-commit: 1f371d1fbe89d95d813c3649f71936cfc663ae8b
+      expected-commit: cd08faf7e5ae5efdfdab4bc2b88596ab42b84588
 
   - name: "Update pnpm version in package.json"
     runs: |
diff --git a/poppler.yaml b/poppler.yaml
index cfeecb93462..b247a8bc5b2 100644
--- a/poppler.yaml
+++ b/poppler.yaml
@@ -1,6 +1,6 @@
 package:
   name: poppler
-  version: 24.11.0
+  version: 24.12.0
   epoch: 0
   description: Poppler is a PDF rendering library based on the xpdf-3.0 code base.
   copyright:
@@ -45,7 +45,7 @@ pipeline:
     with:
       repository: https://gitlab.freedesktop.org/poppler/poppler.git
       tag: poppler-${{package.version}}
-      expected-commit: 735fb475f7b7793c3827d3b3090356503e99075c
+      expected-commit: 30eada0d2bceb42c2d2a87361339063e0b9bea50
 
   - uses: cmake/configure
     with:
diff --git a/postgresql-17-bitnami-compat.yaml b/postgresql-17-bitnami-compat.yaml
index d5f42f6232a..4454e8a5939 100644
--- a/postgresql-17-bitnami-compat.yaml
+++ b/postgresql-17-bitnami-compat.yaml
@@ -1,7 +1,7 @@
 package:
   name: postgresql-17-bitnami-compat
   version: "17.0"
-  epoch: 0
+  epoch: 1
   description: "compat package with postgresql image"
   copyright:
     - license: BSD-3-Clause
@@ -29,10 +29,16 @@ pipeline:
       version-path: 17/debian-12
 
   - runs: |
-      mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/conf
-      mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/conf.default
-      mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/bin
+      mkdir -p ${{targets.contextdir}}/bitnami/postgresql
+      mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/conf/conf.d
+      mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/conf.default/conf.d
       mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/share
+      mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/tmp
+      mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/logs
+
+      # Provide necessary permissions as per Bitnami image
+      chmod -R u+rwX,g+rwX,o+rw ${{targets.contextdir}}/bitnami/postgresql
+      chmod -R u+rwX,g+rwX,o+rw ${{targets.contextdir}}/opt/bitnami/postgresql
 
       # Copy sample configs used to generate Bitnami config
       cp /usr/share/postgresql17/pg_hba.conf.sample ${{targets.contextdir}}/opt/bitnami/postgresql/share/pg_hba.conf.sample
@@ -48,10 +54,8 @@ pipeline:
       rm ${{targets.contextdir}}/opt/bitnami/postgresql/share/*.sample
 
       # Link binaries used by Bitnami config
-      ln -sf /usr/libexec/postgresql17/initdb ${{targets.contextdir}}/opt/bitnami/postgresql/bin/initdb
-      ln -sf /usr/libexec/postgresql17/pg_ctl ${{targets.contextdir}}/opt/bitnami/postgresql/bin/pg_ctl
-      ln -sf /usr/libexec/postgresql17/pg_rewind ${{targets.contextdir}}/opt/bitnami/postgresql/bin/pg_rewind
-      ln -sf /usr/libexec/postgresql17/pg_isready /${{targets.contextdir}}/opt/bitnami/postgresql/bin/pg_isready
+      ln -sf /usr/libexec/postgresql17 ${{targets.contextdir}}/opt/bitnami/postgresql/bin
+      ln -sf /usr/lib/postgresql17 ${{targets.contextdir}}/opt/bitnami/postgresql/lib
 
 test:
   pipeline:
diff --git a/proj.yaml b/proj.yaml
index 8121aa1f700..08a6a2a80f6 100644
--- a/proj.yaml
+++ b/proj.yaml
@@ -1,8 +1,8 @@
 # Generated from https://git.alpinelinux.org/aports/plain/community/proj/APKBUILD
 package:
   name: proj
-  version: 9.5.0
-  epoch: 2
+  version: 9.5.1
+  epoch: 0
   description: PROJ coordinate transformation software library
   copyright:
     - license: MIT
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/OSGeo/PROJ
       tag: ${{package.version}}
-      expected-commit: 0a407325fbb5bf42407a7dc5d4f948be9707e302
+      expected-commit: 41f79ccfe107d3951dac6826f289b55d17cc3b81
 
   - uses: cmake/configure
 
diff --git a/prometheus-2.55.yaml b/prometheus-3.0.yaml
similarity index 88%
rename from prometheus-2.55.yaml
rename to prometheus-3.0.yaml
index a0318ebf47e..ef80b9e0bdf 100644
--- a/prometheus-2.55.yaml
+++ b/prometheus-3.0.yaml
@@ -1,6 +1,6 @@
 package:
-  name: prometheus-2.55
-  version: 2.55.1
+  name: prometheus-3.0
+  version: 3.0.1
   epoch: 0
   description: The Prometheus monitoring system and time series database.
   copyright:
@@ -22,7 +22,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 6d7569113f1ca814f1e149f74176656540043b8d
+      expected-commit: 1f56e8492c31a558ccea833027db4bd7f8b6d0e9
       repository: https://github.com/prometheus/prometheus
       tag: v${{package.version}}
 
@@ -70,18 +70,6 @@ pipeline:
       install -Dm644 -t "${{targets.destdir}}"/etc/prometheus \
         documentation/examples/prometheus.yml
 
-      mkdir -p "${{targets.destdir}}"/etc/prometheus/console_libraries
-      for file in console_libraries/*
-      do
-        install -Dm644 -t "${{targets.destdir}}"/etc/prometheus/console_libraries/ "$file"
-      done
-
-      mkdir -p "${{targets.destdir}}"/etc/prometheus/consoles
-      for file in consoles/*
-      do
-        install -Dm644 -t "${{targets.destdir}}"/etc/prometheus/consoles/ "$file"
-      done
-
   - uses: strip
 
 subpackages:
@@ -113,7 +101,7 @@ update:
   github:
     identifier: prometheus/prometheus
     strip-prefix: v
-    tag-filter-prefix: v2.55
+    tag-filter-prefix: v3.0
 
 test:
   environment:
diff --git a/prometheus-2.55/disable-pprof.patch b/prometheus-3.0/disable-pprof.patch
similarity index 81%
rename from prometheus-2.55/disable-pprof.patch
rename to prometheus-3.0/disable-pprof.patch
index 11097d5f1e4..199d1c03509 100644
--- a/prometheus-2.55/disable-pprof.patch
+++ b/prometheus-3.0/disable-pprof.patch
@@ -1,15 +1,3 @@
-diff --git a/cmd/prometheus/main.go b/cmd/prometheus/main.go
-index 1d844ddba..efcdacf1f 100644
---- a/cmd/prometheus/main.go
-+++ b/cmd/prometheus/main.go
-@@ -22,7 +22,6 @@ import (
- 	"math/bits"
- 	"net"
- 	"net/http"
--	_ "net/http/pprof" // Comment this line to disable pprof endpoint.
- 	"net/url"
- 	"os"
- 	"os/signal"
 diff --git a/web/web.go b/web/web.go
 index 9426ed935..afedb193b 100644
 --- a/web/web.go
diff --git a/prometheus-2.55/prometheus.confd b/prometheus-3.0/prometheus.confd
similarity index 100%
rename from prometheus-2.55/prometheus.confd
rename to prometheus-3.0/prometheus.confd
diff --git a/prometheus-podman-exporter.yaml b/prometheus-podman-exporter.yaml
new file mode 100644
index 00000000000..aa36ff726e9
--- /dev/null
+++ b/prometheus-podman-exporter.yaml
@@ -0,0 +1,55 @@
+package:
+  name: prometheus-podman-exporter
+  version: 1.13.3
+  epoch: 0
+  description: Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information.
+  copyright:
+    - license: Apache-2.0
+
+environment:
+  contents:
+    packages:
+      - btrfs-progs-dev
+      - gpgme-dev
+  environment:
+    CGO_ENABLED: "0"
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/containers/prometheus-podman-exporter
+      tag: v${{package.version}}
+      expected-commit: fb5d46579cced8ea862611305e66f37fe5695326
+
+  - uses: go/bump
+    with:
+      deps: github.com/opencontainers/runc@v1.1.14
+
+  - uses: go/build
+    with:
+      packages: .
+      ldflags: |
+        -X github.com/containers/prometheus-podman-exporter.cmd.buildVersion=${{package.version}}
+        -X github.com/containers/prometheus-podman-exporter.cmd.buildRevision=$(cat VERSION  | grep REVISION | cut -d'=' -f2)
+        -X github.com/containers/prometheus-podman-exporter.cmd.buildBranch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+      tags: remote,containers_image_openpgp
+      output: podman_exporter
+
+subpackages:
+  - name: ${{package.name}}-compat
+    description: "upstream image have executable placed at /bin"
+    pipeline:
+      - runs: |
+          mkdir -p ${{targets.contextdir}}/bin/
+          ln -sf /usr/bin/podman_exporter ${{targets.contextdir}}/bin/podman_exporter
+
+update:
+  enabled: true
+  github:
+    identifier: containers/prometheus-podman-exporter
+    strip-prefix: v
+
+test:
+  pipeline:
+    - runs: |
+        podman_exporter --help
diff --git a/protobuf-c.yaml b/protobuf-c.yaml
index 403c4f858a8..78dd1fed2e8 100644
--- a/protobuf-c.yaml
+++ b/protobuf-c.yaml
@@ -1,7 +1,7 @@
 package:
   name: protobuf-c
   version: 1.5.0
-  epoch: 9
+  epoch: 10
   description: Protocol Buffers implementation in C
   copyright:
     - license: BSD-2-Clause
@@ -17,6 +17,9 @@ environment:
       - ca-certificates-bundle
       - libtool
       - protobuf-dev
+  environment:
+    # https://github.com/wolfi-dev/os/issues/34075
+    GCC_SPEC_FILE: /dev/null
 
 pipeline:
   - uses: git-checkout
diff --git a/protobuf.yaml b/protobuf.yaml
index b9653c644c7..1c66cc62a5e 100644
--- a/protobuf.yaml
+++ b/protobuf.yaml
@@ -1,7 +1,7 @@
 package:
   name: protobuf
-  version: 3.27.4
-  epoch: 1
+  version: 3.29.1
+  epoch: 0
   description: Library for extensible, efficient structure packing
   copyright:
     - license: BSD-3-Clause
@@ -28,13 +28,18 @@ environment:
       - libtool
       - samurai
       - zlib-dev
+  environment:
+    # https://github.com/wolfi-dev/os/issues/34075
+    GCC_SPEC_FILE: /dev/null
 
 pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/protocolbuffers/protobuf
       tag: v${{package.version}}
-      expected-commit: 80d48ae92d3007caac5eab0a8f8ee4e57f3a921e
+      expected-commit: 796e49f6ca82f763d1087d2ff7355d2f0d7b71b1
+      cherry-picks: |
+        main/ced605d0e6a7ad20985375b596b2ca6720e07737: utf8_range: add version marker to library
 
   - runs: |
       cd third_party
@@ -80,8 +85,8 @@ subpackages:
         - name: Verify protoc installation
           runs: |
             protoc --version || exit 1
-            protoc-27.4.0 --version
-            protoc-27.4.0 --help
+            protoc-${{vars.mangled-package-version}}.0 --version
+            protoc-${{vars.mangled-package-version}}.0 --help
         - name: Compile sample proto file
           runs: |
             echo 'syntax = "proto3"; message Test { string name = 1; }' > test.proto
@@ -93,6 +98,7 @@ subpackages:
       - runs: |
           mkdir -p "${{targets.subpkgdir}}"/usr/lib
           mv ${{targets.destdir}}/usr/lib/libprotoc*.so.* ${{targets.subpkgdir}}/usr/lib/
+          mv ${{targets.destdir}}/usr/lib/libutf8_validity*.so.* ${{targets.subpkgdir}}/usr/lib/
 
   - name: libprotobuf
     description: Runtime library for C++ users of protocol buffers
diff --git a/pulseaudio.yaml b/pulseaudio.yaml
index 759d0734510..cb3158e3fc8 100644
--- a/pulseaudio.yaml
+++ b/pulseaudio.yaml
@@ -187,6 +187,9 @@ subpackages:
     pipeline:
       - uses: split/dev
     description: pulseaudio dev
+    test:
+      pipeline:
+        - uses: test/pkgconf
 
   - name: pulseaudio-lang
     pipeline:
diff --git a/pulumi-language-dotnet.yaml b/pulumi-language-dotnet.yaml
index bab0d6ea57a..fe4870fd346 100644
--- a/pulumi-language-dotnet.yaml
+++ b/pulumi-language-dotnet.yaml
@@ -1,6 +1,6 @@
 package:
   name: pulumi-language-dotnet
-  version: 3.69.0
+  version: 3.70.0
   epoch: 0
   description: Pulumi Language SDK for Dotnet
   copyright:
@@ -17,7 +17,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: b37eee0097a7626f8a852b649ba3e725c461c021
+      expected-commit: 6435544caabf255387d39f3df64530bedfbf66a2
       repository: https://github.com/pulumi/pulumi-dotnet.git
       tag: v${{package.version}}
 
diff --git a/pulumi-language-java.yaml b/pulumi-language-java.yaml
index 4350f16c4d7..180d531eb2a 100644
--- a/pulumi-language-java.yaml
+++ b/pulumi-language-java.yaml
@@ -1,6 +1,6 @@
 package:
   name: pulumi-language-java
-  version: 0.17.0
+  version: 0.18.0
   epoch: 0
   description: Pulumi Language SDK for Java
   copyright:
@@ -17,7 +17,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 2a665a885bc967f1488e84a89ebdcf001ceb8e3f
+      expected-commit: b4614eb546eb461a2c2d11754c959d137d387f43
       repository: https://github.com/pulumi/pulumi-java.git
       tag: v${{package.version}}
 
diff --git a/pulumi.yaml b/pulumi.yaml
index 8abdf92e6f9..6047ce9a22b 100644
--- a/pulumi.yaml
+++ b/pulumi.yaml
@@ -1,6 +1,6 @@
 package:
   name: pulumi
-  version: 3.141.0
+  version: 3.142.0
   epoch: 0
   description: Infrastructure as Code in any programming language
   copyright:
@@ -26,7 +26,7 @@ pipeline:
   - uses: git-checkout
     with:
       destination: ${{package.name}}
-      expected-commit: 861144e19a0b41abe7e61eba2750b5cd6747d619
+      expected-commit: 1837a707182a1a9e2f9ed4898895e5bc562dbaa4
       repository: https://github.com/pulumi/pulumi.git
       tag: v${{package.version}}
 
diff --git a/py3-aiohappyeyeballs.yaml b/py3-aiohappyeyeballs.yaml
index f18ccd1d6d7..d0dd1e6b4e4 100644
--- a/py3-aiohappyeyeballs.yaml
+++ b/py3-aiohappyeyeballs.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/aiohttp/
 package:
   name: py3-aiohappyeyeballs
-  version: 2.4.3
+  version: 2.4.4
   epoch: 0
   description: Happy Eyeballs for pre-resolved hosts
   copyright:
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/aio-libs/aiohappyeyeballs
       tag: v${{package.version}}
-      expected-commit: e3519bbebf2069eee0aff0dfde50689c742ba97f
+      expected-commit: 3c4f2a6892d62170d5c14896dc65714e5938a494
 
 subpackages:
   - range: py-versions
diff --git a/py3-asttokens.yaml b/py3-asttokens.yaml
index 6fc08851e1d..ca46c8846a4 100644
--- a/py3-asttokens.yaml
+++ b/py3-asttokens.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-asttokens
-  version: 2.4.1
-  epoch: 3
+  version: 3.0.0
+  epoch: 0
   description: Annotate AST trees with source code positions
   copyright:
     - license: Apache-2.0
@@ -28,7 +28,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: ffb885b78ffeb803b8e835331f2a014e107ab16e
+      expected-commit: 0ebecde1cf50d67b24ba46f477d6a0b426b3ce8f
       repository: https://github.com/gristlabs/asttokens
       tag: v${{package.version}}
 
diff --git a/py3-awscrt.yaml b/py3-awscrt.yaml
index b058f8d1e03..aa00c167664 100644
--- a/py3-awscrt.yaml
+++ b/py3-awscrt.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-awscrt
-  version: 0.23.1
+  version: 0.23.2
   epoch: 0
   description: Python bindings for the AWS Common Runtime
   copyright:
@@ -38,9 +38,16 @@ pipeline:
     with:
       repository: https://github.com/awslabs/aws-crt-python
       tag: v${{package.version}}
-      expected-commit: e85656611c0172aea7fc990aa16fdf3bdbcc1218
+      expected-commit: 7e52d8a156d44e13afb571b674893441fc94541e
       recurse-submodules: true
 
+  - runs: |
+      # Update s2n to solve compilation error "implicit declaration of function 's2n_cleanup_final'; did you mean 's2n_cleanup_thread'?"
+      # Fix is available in s2n version 1.5.7 https://github.com/awslabs/aws-c-io/issues/688
+      # Bumping to that commit; this should be removable once aws-crt-python bumps the submodule version too.
+      cd crt/s2n
+      git checkout 9f4baecc753d6fe01c13e4f422d2e327c64d06b8
+
   - runs: |
       # Allow linking to shared libraries
       sed -i.dist '/:lib/d' setup.py
diff --git a/py3-bokeh.yaml b/py3-bokeh.yaml
index e1a97895692..1b8954b6517 100644
--- a/py3-bokeh.yaml
+++ b/py3-bokeh.yaml
@@ -1,8 +1,8 @@
 # Generated from https://pypi.org/project/bokeh/
 package:
   name: py3-bokeh
-  version: 3.6.1
-  epoch: 2
+  version: 3.6.2
+  epoch: 0
   description: Interactive plots and applications in the browser from Python
   copyright:
     - license: BSD-3-Clause
@@ -36,7 +36,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 04d3fb5fac871423f38e4535838164cd90c3d32e707bcb74c8bf991ed28878fc
+      expected-sha256: 2f3043d9ecb3d5dc2e8c0ebf8ad55727617188d4e534f3e7208b36357e352396
       uri: https://files.pythonhosted.org/packages/source/b/bokeh/bokeh-${{package.version}}.tar.gz
 
 subpackages:
diff --git a/py3-boto3.yaml b/py3-boto3.yaml
index f4279aa2304..da2f99f547c 100644
--- a/py3-boto3.yaml
+++ b/py3-boto3.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-boto3
-  version: 1.35.68
+  version: 1.35.74
   epoch: 0
   description: The AWS SDK for Python
   copyright:
@@ -28,7 +28,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 091d6bed1422370987a839bff3f8755df7404fc15e9fac2a48e8505356f07433
+      expected-sha256: 88370c6845ba71a4dae7f6b357099df29b3965da584be040c8e72c9902bc9492
       uri: https://files.pythonhosted.org/packages/source/b/boto3/boto3-${{package.version}}.tar.gz
 
 subpackages:
diff --git a/py3-botocore.yaml b/py3-botocore.yaml
index 3db9622d1bc..c1ed66aaab1 100644
--- a/py3-botocore.yaml
+++ b/py3-botocore.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-botocore
-  version: 1.35.68
+  version: 1.35.74
   epoch: 0
   description: The low-level, core functionality of Boto3
   copyright:
@@ -29,7 +29,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://files.pythonhosted.org/packages/source/b/botocore/botocore-${{package.version}}.tar.gz
-      expected-sha256: 42c3700583a82f2b5316281a073d644a521d6358837e2b446dc458ba5d990fb4
+      expected-sha256: de5c4fa9a24cef3a758974857b5c5820a12fad345ebf33c052a5988e88f33634
 
 subpackages:
   - range: py-versions
diff --git a/py3-cppy.yaml b/py3-cppy.yaml
index 69427ac9256..18fe2d10d79 100644
--- a/py3-cppy.yaml
+++ b/py3-cppy.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-cppy
-  version: 1.2.1
-  epoch: 3
+  version: 1.3.0
+  epoch: 0
   copyright:
     - license: BSD-3-Clause
   dependencies:
@@ -30,7 +30,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/nucleic/cppy
-      expected-commit: 13a67972ca9063951440c911270f204aa7fe631a
+      expected-commit: 9b9f448bc6fdc1f1f43a9b877a27d793df74a44a
       tag: ${{package.version}}
 
 subpackages:
diff --git a/py3-cryptography.yaml b/py3-cryptography.yaml
index 70312d7c247..b3a738d0437 100644
--- a/py3-cryptography.yaml
+++ b/py3-cryptography.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/cryptography/
 package:
   name: py3-cryptography
-  version: 43.0.3
+  version: 44.0.0
   epoch: 1
   description: cryptography is a package which provides cryptographic recipes and primitives to Python developers.
   copyright:
@@ -29,6 +29,7 @@ environment:
       - maturin
       - openssf-compiler-options
       - openssl-dev
+      - openssl-provider-legacy
       - py3-supported-cffi
       - py3-supported-maturin
       - py3-supported-pip
@@ -42,7 +43,7 @@ pipeline:
     with:
       repository: https://github.com/pyca/cryptography/
       tag: ${{package.version}}
-      expected-commit: c2afb4ffd2d65cc2e1a28c0af3fb52efb6cc688b
+      expected-commit: f299a48153650f2dd87716343f2daa7cd39a1f59
 
 subpackages:
   - range: py-versions
@@ -54,6 +55,7 @@ subpackages:
         - py3-${{vars.pypi-package}}
       runtime:
         - py${{range.key}}-cffi
+        - openssl-provider-legacy
     pipeline:
       - uses: py/pip-build-install
         with:
diff --git a/py3-fastjsonschema.yaml b/py3-fastjsonschema.yaml
index 59315454747..caa3ec6eff1 100644
--- a/py3-fastjsonschema.yaml
+++ b/py3-fastjsonschema.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-fastjsonschema
-  version: 2.20.0
-  epoch: 2
+  version: 2.21.1
+  epoch: 0
   description: Fastest Python implementation of JSON schema
   copyright:
     - license: BSD-3-Clause
@@ -28,7 +28,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: d2fbc8ffb6579ca4e3d6f206965570b7c3906784
+      expected-commit: 720e489b9da40448a5c78052d80f4f729d45a57f
       repository: https://github.com/horejsek/python-fastjsonschema
       tag: v${{package.version}}
 
diff --git a/py3-git-filter-repo.yaml b/py3-git-filter-repo.yaml
index f15f1a4485a..3177894c02e 100644
--- a/py3-git-filter-repo.yaml
+++ b/py3-git-filter-repo.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-git-filter-repo
-  version: 2.45.0
-  epoch: 1
+  version: 2.47.0
+  epoch: 0
   description: Quickly rewrite git repository history
   copyright:
     - license: MIT
@@ -28,7 +28,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: c67e73e593c04092fb1d14053b535c2b08ca218f
+      expected-commit: 6f79afc8c90c592a3052e6cc53c2ca8907515bca
       repository: https://github.com/newren/git-filter-repo
       tag: v${{package.version}}
 
diff --git a/py3-grpcio-gcp.yaml b/py3-grpcio-gcp.yaml
index 2976033acc8..6c7a267b134 100644
--- a/py3-grpcio-gcp.yaml
+++ b/py3-grpcio-gcp.yaml
@@ -1,38 +1,91 @@
-# Generated from https://pypi.org/project/grpcio-gcp/
 package:
   name: py3-grpcio-gcp
   version: 0.2.2
-  epoch: 2
+  epoch: 4
   description: gRPC extensions for Google Cloud Platform
   copyright:
     - license: Apache-2.0
   dependencies:
-    runtime:
-      - py3-grpcio
-      - python-3
+    provider-priority: 0
+
+vars:
+  pypi-package: grpcio-gcp
+  import: grpc_gcp
+
+data:
+  - name: py-versions
+    items:
+      3.10: '310'
+      3.11: '311'
+      3.12: '312'
+      3.13: '300'
 
 environment:
   contents:
     packages:
-      - build-base
-      - busybox
-      - ca-certificates-bundle
-      - py3-setuptools
-      - python-3
-      - wolfi-base
+      - py3-grpcio-tools
+      - py3-supported-build-base
+      - py3-supported-setuptools
+      - python3
 
 pipeline:
-  - uses: fetch
+  - uses: git-checkout
     with:
-      expected-sha256: e292605effc7da39b7a8734c719afb12ec4b5362add3528d8afad3aa3aa9057c
-      uri: https://files.pythonhosted.org/packages/source/g/grpcio-gcp/grpcio-gcp-${{package.version}}.tar.gz
+      repository: https://github.com/GoogleCloudPlatform/grpc-gcp-python
+      tag: v${{package.version}}
+      expected-commit: 8ef890243664ebd95ae0225cdf87e7442b570f9e
 
-  - name: Python Build
-    uses: python/build-wheel
+  - runs: |
+      cd src
+      # From src/setup.sh
+      cp -f ../template/version.py version.py
+      python3 -m grpc_tools.protoc -I. --python_out=grpc_gcp/proto grpc_gcp.proto
 
   - uses: strip
 
+subpackages:
+  - range: py-versions
+    name: py${{range.key}}-${{vars.pypi-package}}
+    description: python${{range.key}} version of ${{vars.pypi-package}}
+    dependencies:
+      provider-priority: ${{range.value}}
+      provides:
+        - py3-${{vars.pypi-package}}
+      runtime:
+        - py${{range.key}}-grpcio
+        - py${{range.key}}-protobuf
+    pipeline:
+      - uses: py/pip-build-install
+        with:
+          python: python${{range.key}}
+        working-directory: ./src
+      - uses: strip
+    test:
+      pipeline:
+        - uses: python/import
+          with:
+            python: python${{range.key}}
+            imports: |
+              import ${{vars.import}}
+
+  - name: py3-supported-${{vars.pypi-package}}
+    description: meta package providing ${{vars.pypi-package}} for supported python versions.
+    dependencies:
+      runtime:
+        - py3.10-${{vars.pypi-package}}
+        - py3.11-${{vars.pypi-package}}
+        - py3.12-${{vars.pypi-package}}
+        - py3.13-${{vars.pypi-package}}
+
+test:
+  pipeline:
+    - uses: python/import
+      with:
+        imports: |
+          import ${{vars.import}}
+
 update:
   enabled: true
-  release-monitor:
-    identifier: 100779
+  github:
+    identifier: GoogleCloudPlatform/grpc-gcp-python
+    strip-prefix: v
diff --git a/py3-grpcio-health-checking.yaml b/py3-grpcio-health-checking.yaml
index 2c79aa1855d..9126db02cfe 100644
--- a/py3-grpcio-health-checking.yaml
+++ b/py3-grpcio-health-checking.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-grpcio-health-checking
-  version: 1.68.0
+  version: 1.68.1
   epoch: 0
   description: Standard Health Checking Service for gRPC
   copyright:
@@ -27,7 +27,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 10064d39cf7307320f5768678fe5631f2eda93ba265b7c1d1e239e4145f3e8d0
+      expected-sha256: ea936cfa0c64a24afd8005873ea61b1acc83a941c00b56a6339c9b225c80a1a8
       uri: https://files.pythonhosted.org/packages/source/g/grpcio-health-checking/grpcio_health_checking-${{package.version}}.tar.gz
 
 subpackages:
diff --git a/py3-grpcio-reflection.yaml b/py3-grpcio-reflection.yaml
index 552c1c15690..3fbf1949757 100644
--- a/py3-grpcio-reflection.yaml
+++ b/py3-grpcio-reflection.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-grpcio-reflection
-  version: 1.68.0
+  version: 1.68.1
   epoch: 0
   description: Standard Protobuf Reflection Service for gRPC
   copyright:
@@ -27,7 +27,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 31a416001fc1b0ee32ba5aa67cf67fb8228f2bf1097001b6313c9fb08680322a
+      expected-sha256: cffcb33c4cbdde771a06fd55ca6fe149c6f89ec330c9a4010730bb2998597982
       uri: https://files.pythonhosted.org/packages/source/g/grpcio-reflection/grpcio_reflection-${{package.version}}.tar.gz
 
 subpackages:
diff --git a/py3-grpcio-status.yaml b/py3-grpcio-status.yaml
index 8c9ebc7f74b..cdd14cc3815 100644
--- a/py3-grpcio-status.yaml
+++ b/py3-grpcio-status.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-grpcio-status
-  version: 1.68.0
+  version: 1.68.1
   epoch: 0
   description: Status proto mapping for gRPC
   copyright:
@@ -27,7 +27,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 8369823de22ab6a2cddb3804669c149ae7a71819e127c2dca7c2322028d52bea
+      expected-sha256: e1378d036c81a1610d7b4c7a146cd663dd13fcc915cf4d7d053929dba5bbb6e1
       uri: https://files.pythonhosted.org/packages/source/g/grpcio-status/grpcio_status-${{package.version}}.tar.gz
 
 subpackages:
diff --git a/py3-grpcio-tools.yaml b/py3-grpcio-tools.yaml
index 82b221690be..46f783d413b 100644
--- a/py3-grpcio-tools.yaml
+++ b/py3-grpcio-tools.yaml
@@ -1,17 +1,24 @@
-# Generated from https://pypi.org/project/grpcio-tools/
 package:
   name: py3-grpcio-tools
-  version: 1.67.1
-  epoch: 1
+  version: 1.68.2
+  epoch: 0
   description: Protobuf code generator for gRPC
   copyright:
     - license: Apache-2.0
   dependencies:
-    runtime:
-      - py3-protobuf
-      - py3-grpcio
-      - py3-setuptools
-      - python3
+    provider-priority: 0
+
+vars:
+  pypi-package: grpcio-tools
+  import: grpc_tools.protoc
+
+data:
+  - name: py-versions
+    items:
+      3.10: '310'
+      3.11: '311'
+      3.12: '312'
+      3.13: '300'
 
 environment:
   contents:
@@ -19,65 +26,101 @@ environment:
       - build-base
       - busybox
       - ca-certificates-bundle
-      - cython
       - git
       - openssf-compiler-options
-      - py3-setuptools
-      - py3-wheel
+      - py3-supported-build-base
+      - py3-supported-cython
+      - py3-supported-python-dev
+      - py3-supported-setuptools
       - python3
-      - python3-dev
       - wolfi-base
+  environment:
+    # https://github.com/wolfi-dev/os/issues/34075
+    GCC_SPEC_FILE: /dev/null
+    GRPC_PYTHON_BUILD_WITH_CYTHON: 1
 
 pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/grpc/grpc
       tag: v${{package.version}}
-      expected-commit: d3286610f703a339149c3f9be69f0d7d0abb130a
+      expected-commit: 859bc5216ba3955fb8925326bdec391fd93c8730
 
   - runs: |
       git submodule update --init
       cd tools/distrib/python/grpcio_tools
-      python ../make_grpcio_tools.py
-      export GRPC_PYTHON_BUILD_WITH_CYTHON=1
-      python setup.py install --prefix=/usr --root="${{targets.destdir}}"
+      python3 ../make_grpcio_tools.py
 
   - uses: strip
 
+subpackages:
+  - range: py-versions
+    name: py${{range.key}}-${{vars.pypi-package}}
+    description: python${{range.key}} version of ${{vars.pypi-package}}
+    dependencies:
+      provider-priority: ${{range.value}}
+      provides:
+        - py3-${{vars.pypi-package}}
+      runtime:
+        - py${{range.key}}-grpcio
+        - py${{range.key}}-protobuf
+    pipeline:
+      - uses: py/pip-build-install
+        with:
+          python: python${{range.key}}
+        working-directory: tools/distrib/python/grpcio_tools
+      - uses: strip
+    test:
+      pipeline:
+        - name: Verify Installation
+          uses: python/import
+          with:
+            python: python${{range.key}}
+            imports: |
+              import ${{vars.import}}
+        - name: Test Protobuf Compilation
+          runs: |
+            # Create a temporary directory for testing
+            mkdir -p /home/build/test-grpcio-tools
+            cd /home/build/test-grpcio-tools
+
+            # Create a sample .proto file for testing
+            echo 'syntax = "proto3"; package test; message TestMessage { string test_field = 1; }' > test.proto
+
+            # Compile the .proto file using grpcio-tools
+            python${{range.key}} -m grpc_tools.protoc -I. --python_out=. --grpc_python_out=. test.proto || exit 1
+            echo "Protobuf file compiled successfully."
+
+            # Check if Python files were generated
+            if [ ! -f test_pb2.py ] || [ ! -f test_pb2_grpc.py ]; then
+              echo "Generated Python files not found!"
+              exit 1
+            fi
+            echo "Generated Python files found."
+        - name: Clean Up
+          runs: |
+            # Clean up the test files after the test
+            rm -rf /home/build/test-grpcio-tools
+
+  - name: py3-supported-${{vars.pypi-package}}
+    description: meta package providing ${{vars.pypi-package}} for supported python versions.
+    dependencies:
+      runtime:
+        - py3.10-${{vars.pypi-package}}
+        - py3.11-${{vars.pypi-package}}
+        - py3.12-${{vars.pypi-package}}
+        - py3.13-${{vars.pypi-package}}
+
+test:
+  pipeline:
+    - name: Verify Installation
+      uses: python/import
+      with:
+        import: ${{vars.import}}
+
 update:
   enabled: true
   github:
     identifier: grpc/grpc
     strip-prefix: v
     use-tag: true
-
-test:
-  pipeline:
-    - name: Verify Installation
-      runs: |
-        # Ensure that grpcio-tools is installed
-        python3 -c "import grpc_tools.protoc" || exit 1
-        echo "grpcio-tools package is installed."
-    - name: Test Protobuf Compilation
-      runs: |
-        # Create a temporary directory for testing
-        mkdir -p /home/build/test-grpcio-tools
-        cd /home/build/test-grpcio-tools
-
-        # Create a sample .proto file for testing
-        echo 'syntax = "proto3"; package test; message TestMessage { string test_field = 1; }' > test.proto
-
-        # Compile the .proto file using grpcio-tools
-        python3 -m grpc_tools.protoc -I. --python_out=. --grpc_python_out=. test.proto || exit 1
-        echo "Protobuf file compiled successfully."
-
-        # Check if Python files were generated
-        if [ ! -f test_pb2.py ] || [ ! -f test_pb2_grpc.py ]; then
-          echo "Generated Python files not found!"
-          exit 1
-        fi
-        echo "Generated Python files found."
-    - name: Clean Up
-      runs: |
-        # Clean up the test files after the test
-        rm -rf /home/build/test-grpcio-tools
diff --git a/py3-gyp-next.yaml b/py3-gyp-next.yaml
index 13a97f5d43f..3c87e4e0512 100644
--- a/py3-gyp-next.yaml
+++ b/py3-gyp-next.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-gyp-next
-  version: 0.18.3
+  version: 0.19.0
   epoch: 0
   description: A fork of the GYP build system for use in the Node.js projects
   copyright:
@@ -29,7 +29,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/nodejs/gyp-next
-      expected-commit: 2ff6d360b14d465bad8b26540b5fa1dab5b5942c
+      expected-commit: ef221b121942be9a7a409320d24fccf53ed7934f
       tag: v${{package.version}}
 
 subpackages:
diff --git a/py3-httpx.yaml b/py3-httpx.yaml
index 79816c190d4..b2b2108275e 100644
--- a/py3-httpx.yaml
+++ b/py3-httpx.yaml
@@ -1,8 +1,8 @@
 # Generated from https://pypi.org/project/httpx/
 package:
   name: py3-httpx
-  version: 0.27.2
-  epoch: 1
+  version: 0.28.0
+  epoch: 0
   description: The next generation HTTP client.
   copyright:
     - license: BSD-3-Clause
@@ -41,7 +41,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 609df7ecc0f7cb10a1c998aa9c269bba77337c5f
+      expected-commit: 80960fa31918d7663c3f4c3ad61661cf0e80628f
       repository: https://github.com/encode/httpx
       tag: ${{package.version}}
 
diff --git a/py3-huggingface-hub.yaml b/py3-huggingface-hub.yaml
index 64112ba7894..a5e43e6b902 100644
--- a/py3-huggingface-hub.yaml
+++ b/py3-huggingface-hub.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/huggingface-hub/
 package:
   name: py3-huggingface-hub
-  version: 0.26.2
+  version: 0.26.3
   epoch: 0
   description: Client library to download and publish models, datasets and other repos on the huggingface.co hub
   copyright:
@@ -34,7 +34,7 @@ data:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: ee4c1634ceacff86d95d933a1718ce4c2fcaf88e
+      expected-commit: d7bead5d64afbcaa6f03b37dcec31f9213d92d19
       repository: https://github.com/huggingface/huggingface_hub
       tag: v${{package.version}}
 
diff --git a/py3-influxdb-client.yaml b/py3-influxdb-client.yaml
index 89013ba6f27..97daf6f0432 100644
--- a/py3-influxdb-client.yaml
+++ b/py3-influxdb-client.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-influxdb-client
-  version: 1.47.0
-  epoch: 1
+  version: 1.48.0
+  epoch: 0
   description: InfluxDB 2.0 python client
   copyright:
     - license: MIT
@@ -30,7 +30,7 @@ pipeline:
     with:
       repository: https://github.com/influxdata/influxdb-client-python.git
       tag: v${{package.version}}
-      expected-commit: 06b71146b20d2f3e7d40eac4fe5d2d81e4b02c62
+      expected-commit: c8d806f1bb3357dec5bf62b0fe2eb84e1789b485
 
 subpackages:
   - range: py-versions
diff --git a/py3-jiter.yaml b/py3-jiter.yaml
index 0197b98c730..f4eb351c18c 100644
--- a/py3-jiter.yaml
+++ b/py3-jiter.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-jiter
-  version: 0.7.1
+  version: 0.8.2
   epoch: 0
   description: Fast iterable JSON parser
   copyright:
@@ -38,7 +38,7 @@ pipeline:
     with:
       repository: https://github.com/pydantic/jiter.git
       tag: v${{package.version}}
-      expected-commit: 1fbdb1e7d6d45a54496a4e59c60000ccaab92380
+      expected-commit: 5f208ea1feccc9d5dc7c0f18eab443a4e0400e13
 
 subpackages:
   - range: py-versions
diff --git a/py3-keras.yaml b/py3-keras.yaml
index 1a7d06759bf..2c2c9a7bae0 100644
--- a/py3-keras.yaml
+++ b/py3-keras.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-keras
-  version: 3.6.0
-  epoch: 1
+  version: 3.7.0
+  epoch: 0
   description: Deep learning for humans.
   copyright:
     - license: Apache-2.0
@@ -33,7 +33,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 7004f526cfd0933f407f1b4f530b865079aa9bef
+      expected-commit: 4ca4345afa17543e2979f2bcef9e6847f4402123
       repository: https://github.com/keras-team/keras
       tag: v${{package.version}}
 
diff --git a/py3-mako.yaml b/py3-mako.yaml
index bbf0061fac4..b7351306faa 100644
--- a/py3-mako.yaml
+++ b/py3-mako.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-mako
-  version: 1.3.6
+  version: 1.3.7
   epoch: 0
   description: Python3 fast templating language
   copyright:
@@ -30,7 +30,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 9ec3a1583713479fae654f83ed9fa8c9a4c16b7bb0daba0e6bbebff50c0d983d
+      expected-sha256: 20405b1232e0759f0e7d87b01f6bb94fce0761747f1cb876ecf90bd512d0b639
       uri: https://files.pythonhosted.org/packages/source/M/Mako/mako-${{package.version}}.tar.gz
 
 subpackages:
diff --git a/py3-maturin.yaml b/py3-maturin.yaml
index 5de5eb0a1de..02e7798021c 100644
--- a/py3-maturin.yaml
+++ b/py3-maturin.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-maturin
-  version: 1.7.4
-  epoch: 2
+  version: 1.7.8
+  epoch: 0
   description: Build and publish crates with pyo3, rust-cpython and cffi bindings as well as rust binaries as python packages
   copyright:
     - license: MIT OR Apache-2.0
@@ -38,7 +38,7 @@ data:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: aebadedec43a92a1ba0fe94980c84f37122aa5b3
+      expected-commit: e403fdf811d0ccae12001586adc160e977d47c16
       repository: https://github.com/pyo3/maturin
       tag: v${{package.version}}
 
diff --git a/py3-nbclient.yaml b/py3-nbclient.yaml
index bbdfdca0785..c10c6b408bf 100644
--- a/py3-nbclient.yaml
+++ b/py3-nbclient.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-nbclient
-  version: 0.10.0
-  epoch: 1
+  version: 0.10.1
+  epoch: 0
   description: A client library for executing notebooks. Formerly nbconvert's ExecutePreprocessor.
   copyright:
     - license: BSD-3-Clause
@@ -29,7 +29,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: a72fb94bb225f1bc2ec31ba3f5e95a3362d85fa4
+      expected-commit: 62d45a1417bed27ab81ac24b27fdafbf4e4edd26
       repository: https://github.com/jupyter/nbclient
       tag: v${{package.version}}
 
diff --git a/py3-nh3.yaml b/py3-nh3.yaml
index 4c26dd5a17b..159dd5a5d6f 100644
--- a/py3-nh3.yaml
+++ b/py3-nh3.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-nh3
-  version: 0.2.18
+  version: 0.2.19
   epoch: 0
   description: Python binding to Ammonia HTML sanitizer Rust crate
   copyright:
@@ -36,7 +36,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: ba2b2748e472c18f5595200438be55ed1f943f45
+      expected-commit: c71460cac4a0788dd7f28ca0a92a0aa67e81de1b
       repository: https://github.com/messense/nh3
       tag: v${{package.version}}
 
diff --git a/py3-oauthenticator.yaml b/py3-oauthenticator.yaml
index 9596384fecb..290a2c60f5f 100644
--- a/py3-oauthenticator.yaml
+++ b/py3-oauthenticator.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-oauthenticator
-  version: 17.1.0
-  epoch: 2
+  version: 17.2.0
+  epoch: 0
   description: 'OAuthenticator: Authenticate JupyterHub users with common OAuth providers'
   copyright:
     - license: BSD-3-Clause
@@ -28,7 +28,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: f3ac8a7f764c51fbf65189765f02f4d3a0ce591c
+      expected-commit: 7e07a64844e510562f2d872fd73a9ea89250ed01
       repository: https://github.com/jupyterhub/oauthenticator
       tag: ${{package.version}}
 
diff --git a/py3-onnx.yaml b/py3-onnx.yaml
index d130d13999b..b750340ebd0 100644
--- a/py3-onnx.yaml
+++ b/py3-onnx.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-onnx
   version: 1.17.0
-  epoch: 1
+  epoch: 2
   description: Open Neural Network Exchange
   copyright:
     - license: Apache-2.0
diff --git a/py3-openai.yaml b/py3-openai.yaml
index 3442311b8c8..4b8429b2ac9 100644
--- a/py3-openai.yaml
+++ b/py3-openai.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/openai/
 package:
   name: py3-openai
-  version: 1.55.0
+  version: 1.56.2
   epoch: 0
   description: Python client library for the OpenAI API
   copyright:
@@ -39,7 +39,7 @@ pipeline:
     with:
       repository: https://github.com/openai/openai-python.git
       tag: v${{package.version}}
-      expected-commit: 83091e96cf43f344d22799c22eea301aeae36d51
+      expected-commit: bb9c2de913279acc89e79f6154173a422f31de45
 
 subpackages:
   - range: py-versions
diff --git a/py3-pgspecial.yaml b/py3-pgspecial.yaml
index f29ff8ec51c..79854b0607f 100644
--- a/py3-pgspecial.yaml
+++ b/py3-pgspecial.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-pgspecial
-  version: 2.1.2
+  version: 2.1.3
   epoch: 0
   description: Meta-commands handler for Postgres Database.
   copyright:
@@ -27,7 +27,7 @@ pipeline:
     with:
       repository: https://github.com/dbcli/pgspecial
       tag: v${{package.version}}
-      expected-commit: 2be16abcaa88cccaf99ce3062cca6ecfc632eb67
+      expected-commit: 61b78f13b09551e43fc4b0ffbe6d0311f6551983
 
   - name: Python Build
     runs: python setup.py build
diff --git a/py3-pkginfo.yaml b/py3-pkginfo.yaml
index 24069ade9cd..f7946c7c558 100644
--- a/py3-pkginfo.yaml
+++ b/py3-pkginfo.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/pkginfo/
 package:
   name: py3-pkginfo
-  version: 1.11.2
+  version: 1.12.0
   epoch: 0
   description: Query metadata from sdists / bdists / installed packages.
   copyright:
@@ -32,7 +32,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: c6bc916b8298d159e31f2c216e35ee5b86da7da18874f879798d0a1983537c86
+      expected-sha256: 8ad91a0445a036782b9366ef8b8c2c50291f83a553478ba8580c73d3215700cf
       uri: https://files.pythonhosted.org/packages/source/p/pkginfo/pkginfo-${{package.version}}.tar.gz
 
 subpackages:
diff --git a/py3-prometheus-client.yaml b/py3-prometheus-client.yaml
index f84e1edf56e..2425f4c8a8a 100644
--- a/py3-prometheus-client.yaml
+++ b/py3-prometheus-client.yaml
@@ -1,8 +1,8 @@
 # Generated from https://pypi.org/project/prometheus-client/
 package:
   name: py3-prometheus-client
-  version: 0.21.0
-  epoch: 1
+  version: 0.21.1
+  epoch: 0
   description: Python client for the Prometheus monitoring system.
   copyright:
     - license: Apache-2.0
@@ -33,7 +33,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 3b183b44994454be226c208037e1fe4b9a89dfc5
+      expected-commit: b3f61b3ccf237424f03cc5aa3ac6ecc81c82455f
       repository: https://github.com/prometheus/client_python
       tag: v${{package.version}}
 
diff --git a/py3-propcache.yaml b/py3-propcache.yaml
index 9ed42f135fe..1963081d240 100644
--- a/py3-propcache.yaml
+++ b/py3-propcache.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-propcache
-  version: 0.2.0
+  version: 0.2.1
   epoch: 0
   description: Fast property caching
   copyright:
@@ -34,7 +34,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: f157b0a7b0b3a3c755764b9f03f4d90c43ee5cda
+      expected-commit: 24fd58a10551ec8e8db66d8612e10455774ca3aa
       repository: https://github.com/aio-libs/propcache
       tag: v${{package.version}}
 
diff --git a/py3-protobuf.yaml b/py3-protobuf.yaml
index 4d1b0ab47d7..99b8c5d18d8 100644
--- a/py3-protobuf.yaml
+++ b/py3-protobuf.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-protobuf
-  version: 5.28.3
+  version: 5.29.0
   epoch: 0
   copyright:
     - license: BSD-3-Clause
@@ -29,7 +29,12 @@ pipeline:
   - uses: fetch
     with:
       uri: https://files.pythonhosted.org/packages/source/p/protobuf/protobuf-${{package.version}}.tar.gz
-      expected-sha256: 64badbc49180a5e401f373f9ce7ab1d18b63f7dd4a9cdc43c92b9f0b481cef7b
+      expected-sha256: 445a0c02483869ed8513a585d80020d012c6dc60075f96fa0563a724987b1001
+
+  - uses: patch
+    with:
+      patches: 0001-Revert-Remove-deprecated-service.py-usages-from-test.patch
+      strip-components: 2
 
 subpackages:
   - range: py-versions
diff --git a/py3-protobuf/0001-Revert-Remove-deprecated-service.py-usages-from-test.patch b/py3-protobuf/0001-Revert-Remove-deprecated-service.py-usages-from-test.patch
new file mode 100644
index 00000000000..da48fd1abcc
--- /dev/null
+++ b/py3-protobuf/0001-Revert-Remove-deprecated-service.py-usages-from-test.patch
@@ -0,0 +1,39 @@
+From 5864b5078a0187a1a16d4d2ed6f55972511d0a94 Mon Sep 17 00:00:00 2001
+From: Jie Luo <jieluo@google.com>
+Date: Wed, 27 Nov 2024 14:28:39 -0800
+Subject: [PATCH] Revert "Remove deprecated service.py usages from test". For
+ 29.x only (#19434)
+
+This reverts commit 471ff7727031d7ca17c62f34c38314758142393e.
+---
+ python/google/protobuf/internal/generator_test.py        | 7 +++++++
+ .../google/protobuf/internal/service_reflection_test.py  | 9 ++++-----
+ python/google/protobuf/service.py                        | 8 ++++----
+ 3 files changed, 15 insertions(+), 9 deletions(-)
+
+[ dannf: Only include the changes to service.py, the other don't
+  apply to this repository ]
+diff --git a/python/google/protobuf/service.py b/python/google/protobuf/service.py
+index 8002c040f..38b821791 100644
+--- a/python/google/protobuf/service.py
++++ b/python/google/protobuf/service.py
+@@ -70,12 +70,12 @@ class Service(object):
+     Postconditions:
+ 
+     * "done" will be called when the method is complete.  This may be
+-     before CallMethod() returns or it may be at some point in the future.
++      before CallMethod() returns or it may be at some point in the future.
+     * If the RPC failed, the response value passed to "done" will be None.
+-     Further details about the failure can be found by querying the
+-     RpcController.
++      Further details about the failure can be found by querying the
++      RpcController.
+     """
+-   raise NotImplementedError
++    raise NotImplementedError
+ 
+   def GetRequestClass(self, method_descriptor):
+     """Returns the class of the request message for the specified method.
+-- 
+2.45.2
+
diff --git a/py3-psycopg2.yaml b/py3-psycopg2.yaml
index 2b144055a27..94f01623b6c 100644
--- a/py3-psycopg2.yaml
+++ b/py3-psycopg2.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-psycopg2
-  version: 2.9.9
-  epoch: 2
+  version: 2.9.10
+  epoch: 0
   description: psycopg2 - Python-PostgreSQL Database Adapter
   copyright:
     - license: LGPL-3.0-or-later
@@ -31,9 +31,7 @@ pipeline:
     with:
       repository: https://github.com/psycopg/psycopg2
       tag: ${{package.version}}
-      expected-commit: ad5bee7054519d87f25bc5828c502b2ebe197049
-      cherry-picks: |
-        master/829a7a2be93f5d0fb1edbc0feb104181f208efc6: Fix FTBFS with 3.13
+      expected-commit: a805acf59f402f554e95624b5e27518169ca7715
 
 subpackages:
   - range: py-versions
diff --git a/py3-pydantic.yaml b/py3-pydantic.yaml
index d1237daa202..9f942fa6c77 100644
--- a/py3-pydantic.yaml
+++ b/py3-pydantic.yaml
@@ -1,7 +1,7 @@
 # Generated from https://pypi.org/project/pydantic/
 package:
   name: py3-pydantic
-  version: 2.10.1
+  version: 2.10.3
   epoch: 0
   description: Data validation using Python type hints
   copyright:
@@ -44,7 +44,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 17e60fafd66133be47352cb0a9b887664b5a6f2d
+      expected-commit: c326748b0119f12e284c280825d4ab6d3576643c
       repository: https://github.com/pydantic/pydantic
       tag: v${{package.version}}
 
diff --git a/py3-pydot.yaml b/py3-pydot.yaml
index 21f0e8bdc51..3adef74855e 100644
--- a/py3-pydot.yaml
+++ b/py3-pydot.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-pydot
-  version: 3.0.2
-  epoch: 1
+  version: 3.0.3
+  epoch: 0
   description: Python interface to Graphviz's Dot
   copyright:
     - license: MIT
@@ -31,7 +31,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/pydot/pydot
-      expected-commit: 754f3e8ace78706371490ece5af2eda4ded2e31f
+      expected-commit: c254ceef8faace4778150e024c48f9c07e2bb09c
       tag: v${{package.version}}
 
 subpackages:
diff --git a/py3-pyjwt.yaml b/py3-pyjwt.yaml
index 49c86811681..7f50339835d 100644
--- a/py3-pyjwt.yaml
+++ b/py3-pyjwt.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-pyjwt
-  version: 2.10.0
+  version: 2.10.1
   epoch: 0
   description: JSON Web Token implementation in Python
   copyright:
@@ -37,7 +37,7 @@ pipeline:
     with:
       repository: https://github.com/jpadilla/pyjwt
       tag: ${{package.version}}
-      expected-commit: 783f324e5d2155462515ced45718fc164dd04db2
+      expected-commit: 3ebbb22f30f2b1b41727b269a08b427e9a85d6bb
 
 subpackages:
   - range: py-versions
diff --git a/py3-pyopenssl.yaml b/py3-pyopenssl.yaml
index 82d5b77b02e..ae76d559201 100644
--- a/py3-pyopenssl.yaml
+++ b/py3-pyopenssl.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-pyopenssl
-  version: 24.2.1
-  epoch: 1
+  version: 24.3.0
+  epoch: 0
   description: Python wrapper module around the OpenSSL library
   copyright:
     - license: Apache-2.0
@@ -28,7 +28,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 8dd94578656d47f854c087783b72431aaeb73d8e
+      expected-commit: 9f82d9715c6221c7e702a07d34c70ebb42240008
       repository: https://github.com/pyca/pyopenssl
       tag: ${{package.version}}
 
diff --git a/py3-pytest.yaml b/py3-pytest.yaml
index 30dcab406bd..531f9e0068a 100644
--- a/py3-pytest.yaml
+++ b/py3-pytest.yaml
@@ -1,8 +1,8 @@
 # Generated from https://pypi.org/project/pytest/
 package:
   name: py3-pytest
-  version: 8.3.3
-  epoch: 1
+  version: 8.3.4
+  epoch: 0
   description: 'pytest: simple powerful testing with Python'
   copyright:
     - license: MIT
@@ -34,7 +34,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: d0f136fe64f9374f18a04562305b178fb380d1ec
+      expected-commit: 53f8b4e634c5066c4f797a87b20060edbb086240
       repository: https://github.com/pytest-dev/pytest
       tag: ${{package.version}}
 
diff --git a/py3-python-daemon.yaml b/py3-python-daemon.yaml
index 1de0f420197..4ed51365de3 100644
--- a/py3-python-daemon.yaml
+++ b/py3-python-daemon.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-python-daemon
-  version: 3.1.0
+  version: 3.1.2
   epoch: 0
   description: Library to implement a well-behaved Unix daemon process.
   copyright:
@@ -30,7 +30,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: fdb621d7e5f46e74b4de1ad6b0fff6e69cd91b4f219de1476190ebdd0f4781df
+      expected-sha256: f7b04335adc473de877f5117e26d5f1142f4c9f7cd765408f0877757be5afbf4
       uri: https://files.pythonhosted.org/packages/source/p/python_daemon/python_daemon-${{package.version}}.tar.gz
 
 subpackages:
diff --git a/py3-python-gitlab.yaml b/py3-python-gitlab.yaml
index b148f780345..1a746042905 100644
--- a/py3-python-gitlab.yaml
+++ b/py3-python-gitlab.yaml
@@ -1,7 +1,7 @@
 package:
   name: py3-python-gitlab
-  version: 5.0.0
-  epoch: 1
+  version: 5.1.0
+  epoch: 0
   description: A python wrapper for the GitLab API
   url: https://python-gitlab.readthedocs.io
   copyright:
@@ -29,7 +29,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 90c72d815a653e48c2ac01ee69889f8a918481fa
+      expected-commit: 9877520fc2f1d30f009344416c884d44a0edcae9
       repository: https://github.com/python-gitlab/python-gitlab
       tag: v${{package.version}}
 
diff --git a/py3-rpds-py.yaml b/py3-rpds-py.yaml
index 22f754fd4b6..9b208acd4f4 100644
--- a/py3-rpds-py.yaml
+++ b/py3-rpds-py.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-rpds-py
-  version: 0.21.0
+  version: 0.22.1
   epoch: 0
   description: Python bindings to Rust's persistent data structures (rpds).
   copyright:
@@ -41,7 +41,7 @@ pipeline:
     with:
       repository: https://github.com/crate-py/rpds
       tag: v${{package.version}}
-      expected-commit: 73581d8dfc56a24eac6ee32c83e6759b4506bb71
+      expected-commit: 5ecc066c2b3a4b5a03d8ba4b5734a15af74d4607
 
 subpackages:
   - range: py-versions
diff --git a/py3-sqlglot.yaml b/py3-sqlglot.yaml
index 2a121be4d9b..6a52a6f0cb4 100644
--- a/py3-sqlglot.yaml
+++ b/py3-sqlglot.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-sqlglot
-  version: 25.32.0
+  version: 25.32.1
   epoch: 0
   description: An easily customizable SQL parser and transpiler
   copyright:
@@ -31,7 +31,7 @@ pipeline:
     with:
       repository: https://github.com/tobymao/sqlglot
       tag: v${{package.version}}
-      expected-commit: fddcd3dfc264a645909686c201d2288c0adf9047
+      expected-commit: 73afd0f435b7e7ccde831ee311c9a76c14797fdc
 
 subpackages:
   - range: py-versions
diff --git a/py3-tensorflow-model-analysis.yaml b/py3-tensorflow-model-analysis.yaml
index b67fbb3e4fe..9792fb9b306 100644
--- a/py3-tensorflow-model-analysis.yaml
+++ b/py3-tensorflow-model-analysis.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-tensorflow-model-analysis
-  version: 0.47.0
+  version: 0.47.1
   epoch: 0
   description: Model analysis tools for TensorFlow
   copyright:
@@ -50,7 +50,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 0497e049e70eef781f531e26ca50b94d438e4999
+      expected-commit: f2135cc32f7b4bacf5d07ae9a2ce0a0342f127f1
       repository: https://github.com/tensorflow/model-analysis
       tag: v${{package.version}}
 
@@ -62,6 +62,12 @@ pipeline:
 
   - uses: strip
 
+test:
+  pipeline:
+    - uses: python/import
+      with:
+        imports: import tensorflow_model_analysis
+
 update:
   enabled: true
   manual: false
diff --git a/py3-tomli.yaml b/py3-tomli.yaml
index 070727c0b45..11a6655126e 100644
--- a/py3-tomli.yaml
+++ b/py3-tomli.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-tomli
-  version: 2.1.0
+  version: 2.2.1
   epoch: 0
   description: TOML parser
   copyright:
@@ -31,7 +31,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://files.pythonhosted.org/packages/py3/t/tomli/tomli-${{package.version}}-py3-none-any.whl
-      expected-sha256: a5c57c3d1c56f5ccdf89f6523458f60ef716e210fc47c4cfb188c5ba473e0391
+      expected-sha256: cb55c73c5f4408779d0cf3eef9f762b9c9f147a77de7b258bef0a5628adc85cc
       extract: false
 
 subpackages:
diff --git a/py3-virtualenv.yaml b/py3-virtualenv.yaml
index c72fa879483..efc26bfe9c2 100644
--- a/py3-virtualenv.yaml
+++ b/py3-virtualenv.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-virtualenv
-  version: 20.27.1
+  version: 20.28.0
   epoch: 0
   description: Virtual Python Environment builder
   copyright:
@@ -34,7 +34,7 @@ pipeline:
     with:
       repository: https://github.com/pypa/virtualenv
       tag: ${{package.version}}
-      expected-commit: cb20fdaeaebcb3a6e91037e1017a313883057fee
+      expected-commit: bfc04e3616d66edc55a31b9627bc5ef35efdf62a
 
 subpackages:
   - range: py-versions
diff --git a/py3-yarl.yaml b/py3-yarl.yaml
index 7c014364f53..504310b9ca4 100644
--- a/py3-yarl.yaml
+++ b/py3-yarl.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-yarl
-  version: 1.18.0
+  version: 1.18.3
   epoch: 0
   description: Yet another URL library
   copyright:
@@ -34,7 +34,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 2e8cd0d53a864d3316c15aed45f30ab2d3933b0a
+      expected-commit: 5862a36c1a228e28bd830eedb5c2ef2b39523657
       repository: https://github.com/aio-libs/yarl
       tag: v${{package.version}}
 
diff --git a/py3-zope.interface.yaml b/py3-zope.interface.yaml
index 412ddfaa340..6421f0db5bf 100644
--- a/py3-zope.interface.yaml
+++ b/py3-zope.interface.yaml
@@ -1,6 +1,6 @@
 package:
   name: py3-zope.interface
-  version: 7.1.1
+  version: "7.2"
   epoch: 0
   description: Interfaces for Python
   copyright:
@@ -28,7 +28,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 98296bdbc1173dc83a8ad89764f2dc37c6f2463c
+      expected-commit: d860f651c966bbc600faea9c9fb3885b1a183bc4
       repository: https://github.com/zopefoundation/zope.interface
       tag: ${{package.version}}
 
diff --git a/pylint.yaml b/pylint.yaml
index 4a2531e5af5..4f8f33bae26 100644
--- a/pylint.yaml
+++ b/pylint.yaml
@@ -1,6 +1,6 @@
 package:
   name: pylint
-  version: 3.3.1
+  version: 3.3.2
   epoch: 0
   description: A static code analyser for Python 2 and 3
   copyright:
@@ -32,7 +32,7 @@ pipeline:
     with:
       repository: https://github.com/pylint-dev/pylint
       tag: v${{package.version}}
-      expected-commit: 76bce72bc57cc8089e439cc9d22fed5806341ed4
+      expected-commit: a5a1bc3a9602d08f15ac90ad12f5b25bde375613
 
   - name: Python Build
     runs: python -m build
diff --git a/qemu.yaml b/qemu.yaml
new file mode 100644
index 00000000000..09f93393947
--- /dev/null
+++ b/qemu.yaml
@@ -0,0 +1,87 @@
+package:
+  name: qemu
+  version: 9.1.2
+  epoch: 1
+  description: "fast processor emulator"
+  copyright:
+    - license: GPL-2.0
+  dependencies:
+    runtime:
+      - glib
+
+environment:
+  contents:
+    packages:
+      - bash
+      - bison
+      - build-base
+      - flex
+      - git
+      - glib
+      - glib-dev
+      - glib-static
+      - ncurses
+      - ncurses-dev
+      - ninja-build
+      - perl
+      - py3-packaging
+      - py3-pip
+      - py3-sphinx
+      - python3
+      - samurai
+      - wolfi-base
+      - zlib-dev
+      - zlib-static
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/qemu/qemu
+      expected-commit: 508081a49b0d624930ca479b8a27bccdc50bdfb2
+      tag: v${{package.version}}
+
+  - runs: |
+      mkdir build
+      cd build
+      ../configure --enable-system --enable-slirp --target-list=x86_64-softmmu,aarch64-softmmu --prefix=${{targets.destdir}}/usr
+      make -j$(nproc)
+      make install
+      # Remove this firmware file, which we don't need, but requires so:dld.sl, which we don't have
+      rm -f ${{targets.destdir}}/usr/share/qemu/hppa-firmware64.img
+      # Can't use strip pipeline; there are some binaries that melange can't strip,
+      # causes a failed build, so here we do a lazy strip
+      find ${{targets.destdir}}/usr -type f -exec strip {} \; || true
+
+test:
+  pipeline:
+    - runs: |
+        for i in /usr/bin/qemu-system-*; do
+          $i --help 2>/dev/null && echo "$i --> OKAY" || echo "$i --> FAIL"
+          $i --version 2>/dev/null && echo "$i --> OKAY" || echo "$i --> FAIL"
+        done
+        qemu-edid version
+        qemu-edid help
+        qemu-ga --version
+        qemu-ga --help
+        qemu-img --version
+        qemu-img --help
+        qemu-io --version
+        qemu-io --help
+        qemu-nbd --version
+        qemu-nbd --help
+        qemu-pr-helper --version
+        qemu-pr-helper --help
+        qemu-storage-daemon --version
+        qemu-storage-daemon --help
+        qemu-system-aarch64 --version
+        qemu-system-aarch64 --help
+        qemu-system-x86_64 --version
+        qemu-system-x86_64 --help
+
+update:
+  enabled: true
+  github:
+    identifier: qemu/qemu
+    use-tag: true
+    strip-prefix: v
+    tag-filter: v
diff --git a/qt6-qtbase.yaml b/qt6-qtbase.yaml
index 5f73eb4f190..f26ced408b2 100644
--- a/qt6-qtbase.yaml
+++ b/qt6-qtbase.yaml
@@ -2,8 +2,8 @@
 #nolint:git-checkout-must-use-github-updates
 package:
   name: qt6-qtbase
-  version: 6.8.0
-  epoch: 3
+  version: 6.8.1
+  epoch: 0
   description: qt
   copyright:
     - license: LGPL-3.0-or-later
@@ -62,7 +62,7 @@ pipeline:
     with:
       repository: https://github.com/qt/qtbase
       tag: v${{vars.mangled-package-version}}
-      expected-commit: b839e9b36db3a4e50dfb34521d8ef8de1fd01969
+      expected-commit: 0db4321f2f13c6870283f3fcc0f1a462fd7cf663
 
   - runs: |
       pip install html5lib
diff --git a/rancher-agent-2.9.yaml b/rancher-agent-2.10.yaml
similarity index 85%
rename from rancher-agent-2.9.yaml
rename to rancher-agent-2.10.yaml
index 929ed05ff7e..c4e680596a4 100644
--- a/rancher-agent-2.9.yaml
+++ b/rancher-agent-2.10.yaml
@@ -1,6 +1,6 @@
 package:
-  name: rancher-agent-2.9
-  version: 2.9.4
+  name: rancher-agent-2.10
+  version: 2.10.0
   epoch: 0
   description: Complete container management platform - agent
   copyright:
@@ -49,11 +49,7 @@ pipeline:
     with:
       repository: https://github.com/rancher/rancher
       tag: v${{package.version}}
-      expected-commit: 4ec728e8aae3e51c86cf599d1618c555fd806ce8
-
-  - uses: go/bump
-    with:
-      deps: github.com/go-jose/go-jose/v3@v3.0.3 k8s.io/kubernetes@v1.30.3 k8s.io/apiserver@v0.30.3 github.com/golang-jwt/jwt/v4@v4.5.1
+      expected-commit: df45e368c82d4027410fa4700371982b9236b7c8
 
   - uses: go/build
     with:
@@ -80,4 +76,4 @@ update:
     identifier: rancher/rancher
     strip-prefix: v
     use-tag: true
-    tag-filter: v2.9.
+    tag-filter: v2.10.
diff --git a/rancher-charts-2.9.yaml b/rancher-charts-2.10.yaml
similarity index 92%
rename from rancher-charts-2.9.yaml
rename to rancher-charts-2.10.yaml
index 8e0dba2bcbb..ce335fe64b3 100644
--- a/rancher-charts-2.9.yaml
+++ b/rancher-charts-2.10.yaml
@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates,valid-pipeline-git-checkout-tag
 package:
-  name: rancher-charts-2.9
-  version: 0_git20241124
+  name: rancher-charts-2.10
+  version: 0_git20241203
   epoch: 0
   description: Complete container management platform - charts
   copyright:
@@ -20,8 +20,8 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/rancher/charts
-      branch: release-v2.9
-      expected-commit: b6884ede7840ae90dcacf7a4201e964a4fabe023
+      branch: release-v2.10
+      expected-commit: a72e39611d6c3fd0c11e7d738d11f943fc56e6df
       destination: ./charts
       depth: -1
 
diff --git a/rancher-helm3-charts.yaml b/rancher-helm3-charts.yaml
index 337adbd154c..32db4e80b4a 100644
--- a/rancher-helm3-charts.yaml
+++ b/rancher-helm3-charts.yaml
@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates,valid-pipeline-git-checkout-tag
 package:
   name: rancher-helm3-charts
-  version: 0_git20241124
+  version: 0_git20241204
   epoch: 0
   description: Complete container management platform - helm3 charts
   copyright:
diff --git a/rancher-kontainer-driver-metadata-2.9.yaml b/rancher-kontainer-driver-metadata-2.10.yaml
similarity index 85%
rename from rancher-kontainer-driver-metadata-2.9.yaml
rename to rancher-kontainer-driver-metadata-2.10.yaml
index 0031638725f..6bc4146bfd5 100644
--- a/rancher-kontainer-driver-metadata-2.9.yaml
+++ b/rancher-kontainer-driver-metadata-2.10.yaml
@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates,valid-pipeline-git-checkout-tag
 package:
-  name: rancher-kontainer-driver-metadata-2.9
-  version: 0_git20241124
+  name: rancher-kontainer-driver-metadata-2.10
+  version: 0_git20241126
   epoch: 0
   description: Complete container management platform - kontainer driver metadata
   copyright:
@@ -19,8 +19,8 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/rancher/kontainer-driver-metadata/
-      branch: release-v2.9
-      expected-commit: 81bdce159b2986c89152a2ca28a9b8a3181ea3ab
+      branch: release-v2.10
+      expected-commit: ff8d9bff7cdde065395f6bb67d4677d883b68bec
 
   - runs: |
       mkdir -p ${{targets.contextdir}}/var/lib/rancher-data/driver-metadata
@@ -34,7 +34,7 @@ test:
 
 update:
   enabled: true
-  git: {}
+  git:
   schedule:
     period: daily
     reason: Commit at head of branch moves frequently
diff --git a/rancher-partner-charts.yaml b/rancher-partner-charts.yaml
index 57788c5823f..f7290b901ec 100644
--- a/rancher-partner-charts.yaml
+++ b/rancher-partner-charts.yaml
@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates,valid-pipeline-git-checkout-tag
 package:
   name: rancher-partner-charts
-  version: 0_git20241124
+  version: 0_git20241204
   epoch: 0
   description: Complete container management platform - partner charts
   copyright:
@@ -19,7 +19,7 @@ pipeline:
       repository: https://github.com/rancher/partner-charts
       branch: main
       destination: ./charts
-      expected-commit: 09d37214df6aaf1ba3eaa2377cbdc9b246703e13
+      expected-commit: c66c4e777c474ddc56b179337855bd7cac406962
 
   - working-directory: ./charts
     runs: |
diff --git a/rancher-rke2-charts.yaml b/rancher-rke2-charts.yaml
index 871ed21d9db..3f6cb17f5d5 100644
--- a/rancher-rke2-charts.yaml
+++ b/rancher-rke2-charts.yaml
@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates,valid-pipeline-git-checkout-tag
 package:
   name: rancher-rke2-charts
-  version: 0_git20241124
+  version: 0_git20241203
   epoch: 0
   description: Complete container management platform - rke2 charts
   copyright:
@@ -19,7 +19,7 @@ pipeline:
       repository: https://github.com/rancher/rke2-charts
       branch: main
       destination: ./charts
-      expected-commit: ea4da1db74e8c486172a417a766e40eb9d7bcef9
+      expected-commit: d63cb45fa5eb804a9b649fa69f6f664607c43a16
 
   - working-directory: ./charts
     runs: |
diff --git a/rancher-system-charts-2.9.yaml b/rancher-system-charts-2.10.yaml
similarity index 92%
rename from rancher-system-charts-2.9.yaml
rename to rancher-system-charts-2.10.yaml
index 757b0d62e63..c1dacc9bdd3 100644
--- a/rancher-system-charts-2.9.yaml
+++ b/rancher-system-charts-2.10.yaml
@@ -1,7 +1,7 @@
 #nolint:git-checkout-must-use-github-updates,valid-pipeline-git-checkout-tag
 package:
-  name: rancher-system-charts-2.9
-  version: 0_git20241124
+  name: rancher-system-charts-2.10
+  version: 0_git20241204
   epoch: 0
   description: Complete container management platform - system charts
   copyright:
@@ -19,7 +19,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/rancher/system-charts
-      branch: release-v2.9
+      branch: release-v2.10
       destination: ${{targets.contextdir}}/var/lib/rancher-data/local-catalogs/system-library
       expected-commit: 653a0337600f04df3a975106468a17bd64d6e1f9
 
diff --git a/rclone.yaml b/rclone.yaml
index 9db4e2ed702..8b4892768fa 100644
--- a/rclone.yaml
+++ b/rclone.yaml
@@ -1,21 +1,15 @@
 package:
   name: rclone
   version: 1.68.2
-  epoch: 0
+  epoch: 1
   description: rsync for cloud storage - Google Drive, S3, Dropbox, Backblaze B2, One Drive, Swift, Hubic, Wasabi, Google Cloud Storage, Yandex Files
   copyright:
     - license: MIT
   dependencies:
     runtime:
+      - ca-certificates
       - fuse3
-
-environment:
-  contents:
-    packages:
-      - build-base
-      - busybox
-      - ca-certificates-bundle
-      - go
+      - tzdata
 
 pipeline:
   - uses: git-checkout
@@ -24,19 +18,20 @@ pipeline:
       repository: https://github.com/rclone/rclone
       tag: v${{package.version}}
 
-  - runs: |
-      CGO_ENABLED=0 make
-      mkdir -p ${{targets.destdir}}/usr/bin
-      mv rclone ${{targets.destdir}}/usr/bin/rclone
+  - uses: go/build
+    with:
+      packages: .
+      output: rclone
 
-  - uses: strip
+  - runs: |
+      mkdir -p ${{targets.destdir}}/etc
+      echo "user_allow_other" >> ${{targets.destdir}}/etc/fuse.conf
 
 update:
   enabled: true
   github:
     identifier: rclone/rclone
     strip-prefix: v
-    use-tag: true
 
 test:
   pipeline:
diff --git a/re2c.yaml b/re2c.yaml
index ec10984ea63..c63b427098f 100644
--- a/re2c.yaml
+++ b/re2c.yaml
@@ -1,7 +1,7 @@
 # Generated from https://git.alpinelinux.org/aports/plain/main/re2c/APKBUILD
 package:
   name: re2c
-  version: "4.0"
+  version: 4.0.1
   epoch: 0
   description: Lexer generator for C, C++ and Go
   copyright:
@@ -22,7 +22,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 6281c6bf52e684d5727ac293667c8031a4aa9010636512da5aee45f19987c1ee
+      expected-sha256: 7c35d54fdf2c4b5981b80362d1c742aec4d011589673e02f2e9566f7e66c44af
       uri: https://github.com/skvadrik/re2c/releases/download/${{package.version}}/re2c-${{package.version}}.tar.xz
 
   - uses: autoconf/configure
diff --git a/rekor.yaml b/rekor.yaml
index 5d08350cffc..d8fa9135184 100644
--- a/rekor.yaml
+++ b/rekor.yaml
@@ -1,7 +1,7 @@
 package:
   name: rekor
-  version: 1.3.6
-  epoch: 9
+  version: 1.3.7
+  epoch: 0
   description: Software Supply Chain Transparency Log
   copyright:
     - license: Apache-2.0
@@ -20,11 +20,7 @@ pipeline:
     with:
       repository: https://github.com/sigstore/rekor
       tag: v${{package.version}}
-      expected-commit: a6788566cd62facb0fb0450e9d2c2867f551e37c
-
-  - uses: go/bump
-    with:
-      deps: golang.org/x/net@v0.23.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.6.0 github.com/hashicorp/go-retryablehttp@v0.7.7 github.com/rs/cors@v1.11.0
+      expected-commit: 4caadbc05cd0e7d8ba85ec431f4abb38ee27c599
 
 subpackages:
   - name: ${{package.name}}-server
@@ -47,13 +43,13 @@ subpackages:
           ldflags: -w
       - uses: strip
 
-  - name: ${{package.name}}-backfill-redis
+  - name: ${{package.name}}-backfill-index
     pipeline:
       - uses: go/build
         with:
           modroot: .
-          packages: ./cmd/backfill-redis
-          output: backfill-redis
+          packages: ./cmd/backfill-index
+          output: backfill-index
           ldflags: -w
       - uses: strip
 
diff --git a/renovate.yaml b/renovate.yaml
index 490247ac21d..cce3ebed658 100644
--- a/renovate.yaml
+++ b/renovate.yaml
@@ -1,6 +1,6 @@
 package:
   name: renovate
-  version: 39.27.0
+  version: 39.47.0
   epoch: 0
   description: "Automated dependency updates. Multi-platform and multi-language."
   copyright:
diff --git a/repmgr.yaml b/repmgr.yaml
new file mode 100644
index 00000000000..997bd7232df
--- /dev/null
+++ b/repmgr.yaml
@@ -0,0 +1,294 @@
+package:
+  name: repmgr
+  version: 5.5.0
+  epoch: 3
+  description: "A lightweight replication manager for PostgreSQL"
+  copyright:
+    - license: GPL-3.0-only
+
+environment:
+  contents:
+    packages:
+      - autoconf
+      - automake
+      - build-base
+      - ca-certificates-bundle
+      - curl-dev
+      - docbook-xml
+      - flex
+      - git
+      - json-c-dev
+      - krb5-dev
+      - libedit-dev
+      - libpq-16
+      - libssl3
+      - libxml2-dev
+      - libxslt-dev
+      - linux-pam-dev
+      - openssf-compiler-options
+      - openssl-dev
+      - postgresql-16-dev
+      - readline-dev
+      - wolfi-base
+
+vars:
+  # This needs to be 16 since bitnami does not support 17 yet:
+  # https://github.com/bitnami/containers/tree/main/bitnami/postgresql-repmgr
+  # When newer versions are supported, this should be updated to the latest version
+  # along with the postgresql-dev and libpq dependencies above.
+  # NOTE: Even though upstream has the 17 version as of now, it still doesn't run properly,
+  # their Helm Chart throws the following error: (Let's wait a fix from upstream)
+  # "The data directory was initialized by PostgreSQL version 16, which is not compatible with this version 17.2."
+  PG_VERSION: 16
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/EnterpriseDB/repmgr
+      tag: v${{package.version}}
+      expected-commit: c0d9dc6dac34c4cb60c3d8805842eed18cca4e85
+
+  - uses: autoconf/configure
+
+  - uses: autoconf/make
+
+  - uses: autoconf/make-install
+
+  - name: Symlink repmgr binaries
+    runs: |
+      mkdir -p "${{targets.destdir}}/usr/bin"
+      ln -sf /usr/libexec/postgresql${{vars.PG_VERSION}}/repmgr ${{targets.destdir}}/usr/bin/repmgr
+      ln -sf /usr/libexec/postgresql${{vars.PG_VERSION}}/repmgrd ${{targets.destdir}}/usr/bin/repmgrd
+
+subpackages:
+  - name: "${{package.name}}-dev"
+    description: "${{package.name}} development headers"
+    pipeline:
+      - uses: split/dev
+    test:
+      pipeline:
+        - uses: test/pkgconf
+
+  - name: ${{package.name}}-bitnami-compat
+    description: "compat package with bitnami/repmgr image"
+    dependencies:
+      runtime:
+        - busybox
+        - posix-libc-utils
+        - glibc-locale-en
+        - curl
+        - coreutils
+        - bash
+        - brotli
+        - libcom_err
+        - libcurl-openssl4
+        - libedit
+        - libffi
+        - libgcc
+        - gnutls
+        - nettle
+        - net-tools
+        - icu-libs
+        - libidn
+        - krb5
+        - keyutils-libs
+        - libldap
+        - liblz4-1
+        - xz
+        - libmd
+        - libnghttp2-14
+        - p11-kit-trust
+        - pcre2
+        - libpsl
+        - readline
+        - librtmp
+        - sqlite-libs
+        - sed
+        - grep
+        - libssh
+        - libssl3
+        - libstdc++-6
+        - libtasn1
+        - ncurses
+        - libunistring
+        - libuuid
+        - libxml2
+        - libxslt
+        - libzstd1
+        - glibc-locales
+        - procps
+        - zlib
+        - samba-libs
+        - krb5-libs
+        - cyrus-sasl
+        - gmp
+        - postgresql-16
+        - postgresql-16-client
+        - pgaudit-16
+    pipeline:
+      - uses: bitnami/compat
+        with:
+          image: postgresql-repmgr
+          version-path: ${{vars.PG_VERSION}}/debian-12
+      - runs: |
+          mkdir -p ${{targets.contextdir}}/opt/bitnami/repmgr/bin
+          mkdir -p ${{targets.contextdir}}/opt/bitnami/repmgr/conf
+          mkdir -p ${{targets.contextdir}}/opt/bitnami/repmgr/tmp
+          mv ${{targets.contextdir}}/events ${{targets.contextdir}}/opt/bitnami/repmgr/events
+          ln -sf /usr/libexec/postgresql${{vars.PG_VERSION}}/repmgr ${{targets.contextdir}}/opt/bitnami/repmgr/bin/repmgr
+          ln -sf /usr/libexec/postgresql${{vars.PG_VERSION}}/repmgrd ${{targets.contextdir}}/opt/bitnami/repmgr/bin/repmgrd
+          chmod -R u+rwX,g+rwX,o+rw ${{targets.contextdir}}/opt/bitnami/
+          find / -perm /6000 -type f -exec chmod a-s {} \; || true
+      - name: PostgreSQL 16 Bitnami compat
+        runs: |
+          # Copy-paste from postgresql-17-bitnami-compat package with some modifications included.
+          # Having the postgresql-16-bitnami-compat package would be ideal, but it was retulting
+          # conflicts with the bitnami dirs that owned by this package.
+          mkdir -p ${{targets.contextdir}}/bitnami/postgresql
+          mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/conf
+          mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/conf/conf.d
+          mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/conf.default
+          mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/share
+          mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/tmp
+          mkdir -p ${{targets.contextdir}}/opt/bitnami/postgresql/logs
+
+          chmod -R u+rwX,g+rwX,o+rw ${{targets.contextdir}}/bitnami/postgresql
+          chmod -R u+rwX,g+rwX,o+rw ${{targets.contextdir}}/opt/bitnami/postgresql
+
+          # Copy sample configs used to generate Bitnami config
+          cp /usr/share/postgresql${{vars.PG_VERSION}}/pg_hba.conf.sample ${{targets.contextdir}}/opt/bitnami/postgresql/share/pg_hba.conf.sample
+          cp /usr/share/postgresql${{vars.PG_VERSION}}/postgresql.conf.sample ${{targets.contextdir}}/opt/bitnami/postgresql/share/postgresql.conf.sample
+
+          # Use package path while unpacking
+          find . -iname "*.sh" -exec sed 's#/opt/bitnami#${{targets.contextdir}}/opt/bitnami#g' -i {} \;
+            ${{targets.contextdir}}/opt/bitnami/scripts/postgresql/postunpack.sh || true
+          # Restore path
+          find ${{targets.contextdir}}/opt/bitnami -type f -exec sed 's#${{targets.contextdir}}##g' -i {} \;
+
+          # Link binaries used by Bitnami config
+          ln -sf /usr/libexec/postgresql${{vars.PG_VERSION}} ${{targets.contextdir}}/opt/bitnami/postgresql/bin
+          ln -sf /usr/lib/postgresql${{vars.PG_VERSION}} ${{targets.contextdir}}/opt/bitnami/postgresql/lib
+    test:
+      environment:
+        environment:
+          PATH: "/opt/bitnami/postgresql/bin:/opt/bitnami/repmgr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+          BITNAMI_APP_NAME: "postgresql-repmgr"
+          NSS_WRAPPER_LIB: "/opt/bitnami/common/lib/libnss_wrapper.so"
+        accounts:
+          groups:
+            - groupname: postgres
+              gid: 1001
+          users:
+            - username: postgres
+              gid: 1001
+              uid: 1001
+          run-as: 1001
+      pipeline:
+        - working-directory: /tmp # Workaround for "can't cd to /home/build: Permission denied" error
+          pipeline:
+            - name: "Launch the postgresql-repmgr"
+              uses: test/daemon-check-output
+              with:
+                start: |
+                  env REPMGR_PASSWORD=repmgrpass \
+                      REPMGR_NODE_NETWORK_NAME=pg-0 \
+                      REPMGR_NODE_NAME=pg-0 \
+                      REPMGR_PARTNER_NODES=pg-0 \
+                      REPMGR_PRIMARY_HOST=pg-0 \
+                      POSTGRESQL_PASSWORD=secretpass \
+                      /opt/bitnami/scripts/postgresql-repmgr/entrypoint.sh /opt/bitnami/scripts/postgresql-repmgr/run.sh
+                timeout: 60
+                expected_output: |
+                  Initializing Repmgr
+                  Starting PostgreSQL in background
+
+update:
+  enabled: true
+  ignore-regex-patterns:
+    - rc*
+  github:
+    identifier: EnterpriseDB/repmgr
+    use-tag: true
+    strip-prefix: v
+    tag-filter: v
+
+test:
+  environment:
+    contents:
+      packages:
+        - postgresql-16
+        - repmgr
+        - shadow
+        - sudo-rs
+        - glibc-locales
+        - postgresql-16-client
+    environment:
+      PGDATA: /tmp/test_db
+      PGUSER: repmgruser
+      PGPASS: repmgrpassword
+      PGDB: repmgr_test
+  pipeline:
+    - name: Create a non-root PostgreSQL user
+      runs: |
+        useradd repmgruser
+        echo "${PGUSER}:${PGPASS}" | chpasswd
+    - name: Initialize PostgreSQL as non-root user
+      runs: |
+        sudo -u ${PGUSER} initdb -D ${PGDATA}
+        sudo -u ${PGUSER} pg_ctl -D ${PGDATA} -l /tmp/logfile start
+        sudo -u ${PGUSER} createdb ${PGDB}
+        sudo -u ${PGUSER} psql -d ${PGDB} -c "GRANT ALL PRIVILEGES ON SCHEMA public TO ${PGUSER};"
+    - name: Configure primary for replication
+      runs: |
+        echo "host replication ${PGUSER} 127.0.0.1/32 md5" | sudo tee -a ${PGDATA}/pg_hba.conf
+        echo "host replication ${PGUSER} ::1/128 md5" | sudo tee -a ${PGDATA}/pg_hba.conf
+        echo "wal_level = replica" | sudo tee -a ${PGDATA}/postgresql.conf
+        echo "archive_mode = on" | sudo tee -a ${PGDATA}/postgresql.conf
+        echo "max_wal_senders = 5" | sudo tee -a ${PGDATA}/postgresql.conf
+        echo "hot_standby = on" | sudo tee -a ${PGDATA}/postgresql.conf
+        sudo -u ${PGUSER} pg_ctl -D ${PGDATA} restart
+    - name: Create repmgr configuration for primary
+      runs: |
+        cat <<EOF | sudo tee /etc/repmgr.conf
+        node_id=1
+        node_name=primary_node
+        conninfo='host=localhost port=5432 user=${PGUSER} dbname=${PGDB} password=${PGPASS}'
+        data_directory='${PGDATA}'
+        log_file='/tmp/repmgr_primary.log'
+        EOF
+        sudo chown ${PGUSER}:${PGUSER} /etc/repmgr.conf
+    - name: Register primary node
+      runs: |
+        sudo -u ${PGUSER} repmgr -f /etc/repmgr.conf primary register
+    - name: Initialize standby PostgreSQL node
+      runs: |
+        sudo -u ${PGUSER} pg_basebackup -D /tmp/test_db_standby -R -X stream -c fast -U ${PGUSER} -h localhost
+        echo "primary_conninfo = 'host=localhost port=5432 user=${PGUSER} password=${PGPASS} application_name=standby_node'" \
+        | sudo tee -a /tmp/test_db_standby/postgresql.auto.conf
+        echo "port = 5433" | sudo tee -a /tmp/test_db_standby/postgresql.auto.conf
+        sudo chown -R ${PGUSER}:${PGUSER} /tmp/test_db_standby
+    - name: Start standby PostgreSQL server
+      runs: |
+        sudo -u ${PGUSER} pg_ctl -D /tmp/test_db_standby -l /tmp/logfile_standby start
+    - name: Wait for standby to be ready
+      runs: |
+        until PGPASSWORD=${PGPASS} psql -p 5433 -U ${PGUSER} -d ${PGDB} -c "SELECT 1" >/dev/null 2>&1; do
+          echo "Waiting for standby to be ready..."
+          sleep 2
+        done
+    - name: Create repmgr configuration for standby
+      runs: |
+        cat <<EOF | sudo tee /etc/repmgr_standby.conf
+        node_id=2
+        node_name=standby_node
+        conninfo='host=localhost port=5433 user=${PGUSER} dbname=${PGDB} password=${PGPASS}'
+        data_directory='/tmp/test_db_standby'
+        log_file='/tmp/repmgr_standby.log'
+        EOF
+        sudo chown ${PGUSER}:${PGUSER} /etc/repmgr_standby.conf
+    - name: Start and register standby node
+      runs: |
+        sudo -u ${PGUSER} repmgr -f /etc/repmgr_standby.conf standby register --upstream-node-id=1
+    - name: Verify cluster configuration
+      runs: |
+        sudo -u ${PGUSER} repmgr cluster show
diff --git a/rqlite.yaml b/rqlite.yaml
index 5554f7daa98..c9ca4e15dbb 100644
--- a/rqlite.yaml
+++ b/rqlite.yaml
@@ -1,6 +1,6 @@
 package:
   name: rqlite
-  version: 8.34.1
+  version: 8.34.3
   epoch: 0
   description: The lightweight, distributed relational database built on SQLite
   copyright:
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/rqlite/rqlite
       tag: v${{package.version}}
-      expected-commit: 8cea072605b6accbfc1607553011d33ef7bb6f87
+      expected-commit: 5f587c5724fff9da49d74aad19516bac0c37abb1
 
   - runs: |
       # docker-entrypoint.sh: update hardcoded docker entrypoint
diff --git a/rrdtool.yaml b/rrdtool.yaml
index a75b27be6a5..d1b47c2c706 100644
--- a/rrdtool.yaml
+++ b/rrdtool.yaml
@@ -1,11 +1,15 @@
 package:
   name: rrdtool
   version: 1.9.0
-  epoch: 1
+  epoch: 2
   description: Data logging and graphing application
   copyright:
     - license: GPL-2.0-or-later
 
+vars:
+  lua-version: 5.4
+  py-version: 3.13
+
 environment:
   contents:
     packages:
@@ -30,8 +34,7 @@ environment:
       - libtool
       - libxft-dev
       - libxml2-dev
-      - lua5.4
-      - lua5.4-dev
+      - lua${{vars.lua-version}}-dev
       - openssf-compiler-options
       - pango
       - pango-dev
@@ -40,8 +43,9 @@ environment:
       - perl-xml-parser
       - pkgconf-dev
       - posix-libc-utils
-      - py3.12-setuptools
-      - python3-dev
+      - py${{vars.py-version}}-setuptools
+      - python-${{vars.py-version}}-base-dev
+      - readline-dev
       - zlib-dev
 
 pipeline:
@@ -52,7 +56,10 @@ pipeline:
       tag: v${{package.version}}
 
   - runs: |
-      export CPPFLAGS="-I/usr/include/pango-1.0/pango"
+      ln -sf lua${{vars.lua-version}} /usr/bin/lua
+      ln -sf lua5.4/liblua.so /usr/lib/liblua.so
+      ln -sf python${{vars.py-version}} /usr/bin/python3
+      ln -sf python${{vars.py-version}} /usr/bin/python
 
   - uses: autoconf/configure
     with:
@@ -72,6 +79,9 @@ pipeline:
       find "${{targets.destdir}}" -name '.packlist' -delete
       find "${{targets.destdir}}" -name 'perllocal.pod' -delete
 
+  - name: give owner write so strip can run as non-root
+    runs: chmod -R u+w ${{targets.destdir}}/usr/lib
+
   - uses: strip
 
 subpackages:
@@ -90,7 +100,12 @@ subpackages:
   - name: rrdtool-doc
     pipeline:
       - uses: split/manpages
-    description: rrdtool manpages
+      - runs: |
+          ushr=${{targets.subpkgdir}}/usr/share
+          mkdir -p "$ushr/doc" "$ushr/rrdtool"
+          mv ${{targets.destdir}}/usr/share/doc/rrdtool-${{package.version}} "$ushr/doc"
+          mv ${{targets.destdir}}/usr/share/rrdtool/examples "$ushr/rrdtool"
+    description: rrdtool manpages and docs
 
   - name: perl-rrd
     pipeline:
@@ -105,9 +120,21 @@ subpackages:
     pipeline:
       - runs: |
           mkdir -p "${{targets.subpkgdir}}"/usr/lib/
-          mv /usr/lib/lua* "${{targets.subpkgdir}}"/usr/lib/
+          mv ${{targets.destdir}}/usr/lib/lua* "${{targets.subpkgdir}}"/usr/lib/
     description: Lua interface for rrdtool
 
+  - name: py${{vars.py-version}}-rrdtool
+    pipeline:
+      - runs: |
+          mkdir -p "${{targets.subpkgdir}}"/usr/lib/
+          mv ${{targets.destdir}}/usr/lib/python* "${{targets.subpkgdir}}/usr/lib"
+    test:
+      pipeline:
+        - uses: python/import
+          with:
+            imports: |
+              import rrdtool
+
   - name: rrdtool-cached
     pipeline:
       - runs: |
@@ -148,6 +175,19 @@ subpackages:
           	"${{targets.destdir}}"/usr/bin/rrdupdate \
           	"${{targets.subpkgdir}}"/usr/bin
     description: RRDtool standalone create,update,info utilities
+    test:
+      pipeline:
+        - runs: |
+            set +x
+            fail() { echo "FAIL:" "$@" 1>&2; exit 1; }
+            for p in rrdinfo rrdcreate rrdupdate; do
+              # actually expect exit value 1, there is no -h or -v
+              out=$($p) && rc=$? || rc=$?
+              [ $rc -eq 0 -o $rc -eq 1 ] || fail "$p exited unexpected value $rc"
+              echo "$out" | grep -q "Usage: $p" ||
+                fail "$p output did not contain 'Usage: $p'. output: $output"
+              echo "PASS: $p output contained 'Usage: $p'"
+            done
 
 update:
   enabled: true
diff --git a/rtmpdump.yaml b/rtmpdump.yaml
index 415fdca62ac..a9c87e3d838 100644
--- a/rtmpdump.yaml
+++ b/rtmpdump.yaml
@@ -1,7 +1,7 @@
 #nolint:valid-pipeline-git-checkout-tag
 package:
   name: rtmpdump
-  version: 2.6_git20241124
+  version: 2.6_git20241204
   epoch: 0
   description: rtmpdump is a toolkit for RTMP streams
   copyright:
diff --git a/ruby3.2-date.yaml b/ruby3.2-date.yaml
index a65fe67b2b4..5bc665d2d0a 100644
--- a/ruby3.2-date.yaml
+++ b/ruby3.2-date.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.2-date
-  version: 3.4.0
+  version: 3.4.1
   epoch: 0
   description: A subclass of Object includes Comparable module for handling dates.
   copyright:
@@ -20,7 +20,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 94f8e51e65a03643a19d22562c350de13d4c6b09
+      expected-commit: a3295ad262773a80ad61526beb500b29e770b817
       repository: https://github.com/ruby/date
       tag: v${{package.version}}
 
diff --git a/ruby3.2-excon.yaml b/ruby3.2-excon.yaml
index c2f4fda3611..12d91198dd5 100644
--- a/ruby3.2-excon.yaml
+++ b/ruby3.2-excon.yaml
@@ -1,7 +1,7 @@
 # Generated from https://github.com/excon/excon
 package:
   name: ruby3.2-excon
-  version: 1.2.1
+  version: 1.2.2
   epoch: 0
   description: EXtended http(s) CONnections
   copyright:
@@ -21,7 +21,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/excon/excon
-      expected-commit: 239111877ffa6f56ccc6d8f43d0fae2dec17e164
+      expected-commit: 0403dc0ffc589884b3ecd6aeed3cf7589fa68086
       tag: v${{package.version}}
 
   - uses: ruby/build
diff --git a/ruby3.2-faraday-excon.yaml b/ruby3.2-faraday-excon.yaml
index 93ceac9fbe1..fa7cd49e1ec 100644
--- a/ruby3.2-faraday-excon.yaml
+++ b/ruby3.2-faraday-excon.yaml
@@ -42,6 +42,31 @@ pipeline:
 vars:
   gem: faraday-excon
 
+test:
+  environment:
+    contents:
+      packages:
+        - ruby${{vars.rubyMM}}-net-http
+  pipeline:
+    - runs: ruby -e "require 'faraday/excon'; puts 'Faraday Excon adapter loaded successfully!'"
+    - runs: |
+        ruby <<-EOF
+        require 'faraday'
+        require 'faraday/excon'
+
+        # Test the Faraday connection with Excon adapter
+        begin
+          conn = Faraday.new(url: 'https://example.com') do |f|
+            f.adapter :excon
+          end
+
+          response = conn.get('/')
+          puts "Faraday connection with Excon adapter configured successfully! Response status: \#{response.status}"
+        rescue StandardError => e
+          raise "Test failed with error: \#{e.message}"
+        end
+        EOF
+
 update:
   enabled: true
   github:
diff --git a/ruby3.2-faraday-follow_redirects.yaml b/ruby3.2-faraday-follow_redirects.yaml
index 1cae2beafe7..d6000547865 100644
--- a/ruby3.2-faraday-follow_redirects.yaml
+++ b/ruby3.2-faraday-follow_redirects.yaml
@@ -41,6 +41,36 @@ pipeline:
 vars:
   gem: faraday-follow_redirects
 
+test:
+  environment:
+    contents:
+      packages:
+        - ruby${{vars.rubyMM}}-net-http
+  pipeline:
+    - runs: ruby -e "require 'faraday/follow_redirects'; puts 'Faraday Follow Redirects middleware loaded successfully!'"
+    - runs: |
+        ruby <<-EOF
+        require 'faraday'
+        require 'faraday/follow_redirects'
+
+        # Test the Faraday connection with the Follow Redirects middleware
+        begin
+          conn = Faraday.new(url: 'http://httpbingo.org/redirect/1') do |f|
+            f.use Faraday::FollowRedirects::Middleware
+            f.adapter Faraday.default_adapter
+          end
+
+          response = conn.get
+          if response.status == 200
+            puts "Faraday connection with Follow Redirects middleware configured successfully! Final status: \#{response.status}"
+          else
+            raise "Unexpected response status: \#{response.status}"
+          end
+        rescue StandardError => e
+          raise "Test failed with error: \#{e.message}"
+        end
+        EOF
+
 update:
   enabled: true
   github:
diff --git a/ruby3.2-faraday-net_http.yaml b/ruby3.2-faraday-net_http.yaml
index 2a8a3e457e8..8e597cb7d6a 100644
--- a/ruby3.2-faraday-net_http.yaml
+++ b/ruby3.2-faraday-net_http.yaml
@@ -1,10 +1,13 @@
 package:
   name: ruby3.2-faraday-net_http
   version: 3.4.0
-  epoch: 0
+  epoch: 1
   description: Faraday adapter for Net::HTTP
   copyright:
     - license: MIT
+  dependencies:
+    runtime:
+      - ruby3.2-net-http
 
 environment:
   contents:
@@ -42,7 +45,6 @@ test:
     contents:
       packages:
         - ruby3.2-faraday
-        - ruby3.2-net-http
   pipeline:
     # Users do not import this package directly, see the following for a deeper
     # explanation: https://github.com/lostisland/faraday-net_http/issues/25
diff --git a/ruby3.2-faraday.yaml b/ruby3.2-faraday.yaml
index ffa1bc9e1bc..a26512007bb 100644
--- a/ruby3.2-faraday.yaml
+++ b/ruby3.2-faraday.yaml
@@ -42,17 +42,55 @@ vars:
   gem: faraday
 
 test:
+  environment:
+    contents:
+      packages:
+        - ruby${{vars.rubyMM}}-faraday-net_http
+        - ruby${{vars.rubyMM}}-net-http
   pipeline:
     - name: Verify library import
       runs: ruby -e "require 'faraday'"
     - name: Basic usage
       runs: |
-        cat <<EOF > /tmp/test.rb
+        cat <<EOF > /tmp/basic_usage_test.rb
         require 'faraday'
         response = Faraday.get("https://edu.chainguard.dev/open-source/wolfi/overview/")
-        print response.status
+        if response.status == 200
+          puts "Basic usage test passed! Status: \#{response.status}"
+        else
+          raise "Basic usage test failed. Unexpected status: \#{response.status}"
+        end
         EOF
-        ruby /tmp/test.rb
+        ruby /tmp/basic_usage_test.rb
+    - name: Functional test with middleware
+      runs: |
+        cat <<EOF > /tmp/functional_test_middleware.rb
+        require 'faraday'
+        require 'json'
+
+        # Configure Faraday connection with a middleware
+        conn = Faraday.new(url: "https://httpbin.org") do |f|
+          f.request :url_encoded
+          f.adapter :net_http
+        end
+
+        # Perform a POST request with some data
+        response = conn.post("/post") do |req|
+          req.headers['Content-Type'] = 'application/json'
+          req.body = { test_key: 'test_value' }.to_json
+        end
+
+        # Parse the JSON response
+        parsed_body = JSON.parse(response.body)
+
+        # Validate the response
+        if response.status == 200 && parsed_body["json"]["test_key"] == "test_value"
+          puts "Functional middleware test passed!"
+        else
+          raise "Functional middleware test failed."
+        end
+        EOF
+        ruby /tmp/functional_test_middleware.rb
 
 update:
   enabled: true
diff --git a/ruby3.2-faraday_middleware-aws-sigv4.yaml b/ruby3.2-faraday_middleware-aws-sigv4.yaml
index 052e14a50e1..8157945cf41 100644
--- a/ruby3.2-faraday_middleware-aws-sigv4.yaml
+++ b/ruby3.2-faraday_middleware-aws-sigv4.yaml
@@ -7,8 +7,8 @@ package:
     - license: MIT
   dependencies:
     runtime:
-      - ruby3.2-aws-sigv4
-      - ruby3.2-faraday
+      - ruby${{vars.rubyMM}}-aws-sigv4
+      - ruby${{vars.rubyMM}}-faraday
 
 environment:
   contents:
@@ -17,8 +17,8 @@ environment:
       - busybox
       - ca-certificates-bundle
       - git
-      - ruby-3.2
-      - ruby-3.2-dev
+      - ruby-${{vars.rubyMM}}
+      - ruby-${{vars.rubyMM}}-dev
 
 pipeline:
   - uses: git-checkout
@@ -49,5 +49,35 @@ update:
     use-tag: true
 
 test:
+  environment:
+    contents:
+      packages:
+        - ruby${{vars.rubyMM}}-net-http
   pipeline:
-    - runs: ruby -e "require 'faraday_middleware/aws_sigv4'"
+    - runs: ruby -e "require 'faraday_middleware/aws_sigv4'; puts 'faraday_middleware/aws_sigv4 loaded successfully!'"
+    - runs: |
+        ruby <<-EOF
+        require 'faraday'
+        require 'faraday_middleware/aws_sigv4'
+
+        # Test the middleware by configuring a Faraday connection
+        begin
+          conn = Faraday.new(url: 'https://example.com') do |f|
+            f.request :aws_sigv4,
+              service: 's3',
+              region: 'us-east-1',
+              access_key_id: 'fake_access_key',
+              secret_access_key: 'fake_secret_key'
+          end
+
+          puts "Faraday connection configured successfully with AWS SigV4 middleware!"
+        rescue StandardError => e
+          raise "Test failed with error: #{e.message}"
+        end
+        EOF
+
+var-transforms:
+  - from: ${{package.name}}
+    match: ^ruby(\d\.\d+)-.*
+    replace: $1
+    to: rubyMM
diff --git a/ruby3.2-filesize.yaml b/ruby3.2-filesize.yaml
index 4bc17c4a74c..e318e592c9e 100644
--- a/ruby3.2-filesize.yaml
+++ b/ruby3.2-filesize.yaml
@@ -38,6 +38,46 @@ pipeline:
 vars:
   gem: filesize
 
+test:
+  environment:
+    contents:
+      packages:
+        - ruby-${{vars.rubyMM}}
+  pipeline:
+    - name: Verify gem installation
+      runs: |
+        gem list filesize
+    - name: Basic functionality test
+      runs: |
+        ruby -e '
+          begin
+            require "filesize"
+            puts "Debug: Loading Filesize class..."
+
+            # Create size object directly with bytes
+            bytes = Filesize.new(1024)
+            puts "Debug: Created Filesize object: " + bytes.inspect
+
+            # Convert to KiB (binary kilobytes) since that is the default
+            kib = bytes.to("KiB")
+            puts "Debug: Converted to KiB: " + kib.inspect
+
+            size = kib.to_f
+            puts "Debug: Final float value: " + size.to_s
+
+            # Should be exactly 1.0 since 1024 bytes = 1 KiB
+            if size == 1.0
+              puts "Test passed: 1024 B = 1 KiB"
+              exit 0
+            else
+              raise "Test failed: Expected 1.0 KiB, got " + size.to_s
+            end
+          rescue => e
+            puts "Test failed with error: " + e.class.to_s + ": " + e.message
+            puts e.backtrace
+            exit 1
+          end '
+
 update:
   enabled: false
   exclude-reason: unmaintained, latest tag cut in 2018
diff --git a/ruby3.2-fluent-config-regexp-type.yaml b/ruby3.2-fluent-config-regexp-type.yaml
index 9c6e7498835..dd981569b3a 100644
--- a/ruby3.2-fluent-config-regexp-type.yaml
+++ b/ruby3.2-fluent-config-regexp-type.yaml
@@ -42,6 +42,29 @@ pipeline:
 
   - uses: ruby/clean
 
+test:
+  pipeline:
+    - runs: |
+        ruby -e '
+          require "fluent/config/regexp_type"
+
+          # Test timestamp pattern
+          regex = Fluent::Config::REGEXP_TYPE.call("/^\\d{4}-\\d{2}-\\d{2}/")
+
+          # Should match
+          raise "Valid date (2024-11-23) failed to match" unless regex.match?("2024-11-23")
+
+          # Should not match any of these
+          ["11-23-2024", "11-2-2024", "11-23-202", "202-11-23"].each do |invalid_date|
+            if regex.match?(invalid_date)
+              raise "Incorrectly matched #{invalid_date} which should not match pattern ^\\d{4}-\\d{2}-\\d{2}"
+            end
+          end
+
+          puts "All tests passed!"
+          puts "Pattern matches yyyy-mm-dd format only"
+        '
+
 update:
   enabled: true
   github:
diff --git a/ruby3.2-fluentd-1.17.yaml b/ruby3.2-fluentd-1.17.yaml
index 71ff1cd8d53..f89f4528276 100644
--- a/ruby3.2-fluentd-1.17.yaml
+++ b/ruby3.2-fluentd-1.17.yaml
@@ -92,6 +92,7 @@ update:
 
 test:
   pipeline:
+    # Keep existing daemon test
     - name: Daemon test
       uses: test/daemon-check-output
       with:
@@ -100,6 +101,8 @@ test:
           mkdir -p /etc/fluent/
           touch /etc/fluent/fluent.conf
         expected_output: fluentd worker is now running
+    # Keep command line tests
+    - name: Command line tests
       runs: |
         fluent-binlog-reader --version
         fluent-ca-generate --version
@@ -117,6 +120,61 @@ test:
         fluent-plugin-generate --help
         fluentd --version
         fluentd --help
+    - name: Basic IO test
+      runs: |
+        # Create minimal config
+        cat > test.conf <<EOF
+        <system>
+          log_level debug
+        </system>
+
+        <source>
+          @type forward
+          port 24224
+        </source>
+
+        <match test.**>
+          @type file
+          path /tmp/fluentd_test
+          append true
+          <buffer>
+            flush_mode immediate
+          </buffer>
+        </match>
+        EOF
+
+        # Start fluentd with logs
+        fluentd -c test.conf -d /tmp/fluentd.pid --log /tmp/fluentd.log
+
+        # Wait for start
+        sleep 5
+
+        # Send test message with specific content
+        echo '{"message":"test_message_content"}' | fluent-cat test.tag
+
+        # Wait for processing
+        sleep 5
+
+        # Check output files and content
+        if ls /tmp/fluentd_test.*.log > /dev/null 2>&1; then
+          OUTPUT=$(cat /tmp/fluentd_test.*.log)
+          echo "Output file contents: $OUTPUT"
+
+          if echo "$OUTPUT" | grep -q "test_message_content"; then
+            echo "Test passed: Message content verified"
+          else
+            echo "Test failed: Expected message content not found"
+            exit 1
+          fi
+        else
+          echo "Test failed: No output file"
+          echo "Fluentd logs:"
+          cat /tmp/fluentd.log
+          exit 1
+        fi
+
+        # Cleanup
+        kill $(cat /tmp/fluentd.pid)
 
 var-transforms:
   - from: ${{package.name}}
diff --git a/ruby3.2-gems.yaml b/ruby3.2-gems.yaml
index ac21a945115..6f9afaae5d0 100644
--- a/ruby3.2-gems.yaml
+++ b/ruby3.2-gems.yaml
@@ -49,6 +49,22 @@ test:
         print Gems.info 'rails'
         EOF
         ruby /tmp/test.rb
+    - name: Basic functionality test
+      runs: |
+        ruby -e '
+          require "gems"
+          require "json"
+
+          # Test search functionality
+          result = Gems.search("rake")
+          raise "Search failed" unless result.is_a?(Array) && !result.empty?
+
+          # Test version info
+          versions = Gems.versions("rake")
+          raise "Version lookup failed" unless versions.is_a?(Array) && !versions.empty?
+
+          puts "Tests passed - got valid responses for search and versions"
+        '
 
 update:
   enabled: true
diff --git a/ruby3.2-hashie.yaml b/ruby3.2-hashie.yaml
index 8732a9409b4..d92a616ed85 100644
--- a/ruby3.2-hashie.yaml
+++ b/ruby3.2-hashie.yaml
@@ -38,6 +38,43 @@ pipeline:
 vars:
   gem: hashie
 
+test:
+  pipeline:
+    - name: Verify library import
+      runs: ruby -e "require 'hashie'"
+    - name: Basic functionality test
+      runs: |
+        ruby -e '
+          require "hashie"
+
+          # Test Mash functionality
+          mash = Hashie::Mash.new
+          mash.name = "Test"
+          mash.info = { lang: "Ruby" }
+
+          raise "Basic assignment failed" unless mash.name == "Test"
+          raise "Nested hash failed" unless mash.info.lang == "Ruby"
+
+          # Test indifferent access
+          mash[:test_key] = "value"
+          raise "Indifferent access failed" unless mash["test_key"] == "value" && mash.test_key == "value"
+
+          # Test key deletion
+          mash.delete(:test_key)
+          raise "Delete failed" if mash.key?(:test_key)
+
+          # Test default values
+          mash.default = "not found"
+          raise "Default value failed" unless mash.missing == "not found"
+
+          # Test merge
+          other = Hashie::Mash.new(a: 1, b: 2)
+          merged = mash.merge(other)
+          raise "Merge failed" unless merged.a == 1 && merged.info.lang == "Ruby"
+
+          puts "All tests passed!"
+        '
+
 update:
   enabled: true
   github:
diff --git a/ruby3.2-http.yaml b/ruby3.2-http.yaml
index c54b6801903..1db2ec5dd83 100644
--- a/ruby3.2-http.yaml
+++ b/ruby3.2-http.yaml
@@ -54,6 +54,23 @@ test:
         HTTP.get("https://github.com").to_s
         EOF
         ruby /tmp/test.rb
+    - name: Functional test with POST request
+      runs: |
+        cat <<EOF > /tmp/functional_test.rb
+        require "http"
+
+        # Perform a POST request to httpbin.org
+        response = HTTP.post("https://httpbin.org/post", json: { key: "value" })
+
+        # Validate the response
+        raise "Unexpected status code" unless response.status == 200
+
+        body = response.parse(:json)
+        raise "Unexpected response body" unless body["json"]["key"] == "value"
+
+        puts "Functional test passed!"
+        EOF
+        ruby /tmp/functional_test.rb
 
 update:
   enabled: true
diff --git a/ruby3.2-http_parser.rb.yaml b/ruby3.2-http_parser.rb.yaml
index 30df5b2661f..b98b0283d08 100644
--- a/ruby3.2-http_parser.rb.yaml
+++ b/ruby3.2-http_parser.rb.yaml
@@ -48,6 +48,62 @@ pipeline:
           version: ${{package.version}}
       - uses: ruby/clean
 
+test:
+  environment:
+    contents:
+      packages:
+        - ruby-${{vars.rubyMM}}
+  pipeline:
+    - name: Verify gem installation
+      runs: gem list http_parser.rb
+    - name: Basic import test
+      runs: |
+        ruby <<-EOF
+        begin
+          require 'http/parser'
+          puts "Basic import test passed! HTTP::Parser loaded successfully."
+        rescue LoadError => e
+          puts "Basic import test failed: #{e.message}"
+          exit 1
+        end
+        EOF
+    - name: Expanded functionality test
+      runs: |
+        ruby <<-EOF
+        require 'http/parser'
+
+        # Create a basic HTTP parser and parse a simple request
+        begin
+          parser = HTTP::Parser.new
+          parsed_headers = {}
+
+          # Define callbacks for parsing events
+          parser.on_headers_complete = proc do |headers|
+            parsed_headers.merge!(headers)
+            puts "Headers parsed successfully!"
+          end
+          parser.on_message_complete = proc { puts "Message parsed successfully!" }
+
+          # Feed the parser with a simple HTTP request
+          request = "GET /path/to/resource HTTP/1.1\r\n" \
+                    "Host: example.com\r\n" \
+                    "User-Agent: TestAgent\r\n\r\n"
+          parser << request
+
+          # Validate parsing results
+          raise "Unexpected HTTP method" unless parser.http_method == "GET"
+          raise "Unexpected request URL" unless parser.request_url == "/path/to/resource"
+          raise "Unexpected HTTP version" unless parser.http_version == [1, 1]
+          raise "Unexpected Host header" unless parsed_headers["Host"] == "example.com"
+          raise "Unexpected User-Agent header" unless parsed_headers["User-Agent"] == "TestAgent"
+
+          puts "Expanded functionality test passed with valid results!"
+        rescue => e
+          puts "Test failed: #{e.message}"
+          exit 1
+        end
+        EOF
+
 update:
   enabled: true
   github:
diff --git a/ruby3.2-i18n.yaml b/ruby3.2-i18n.yaml
index d7e97299ffb..b4a1f90c828 100644
--- a/ruby3.2-i18n.yaml
+++ b/ruby3.2-i18n.yaml
@@ -40,6 +40,24 @@ pipeline:
 vars:
   gem: i18n
 
+test:
+  pipeline:
+    - runs: ruby -e "require 'i18n'"
+    - name: Basic translation test
+      runs: |
+        ruby <<-EOF
+        require 'i18n'
+
+        # Create a translation directly in memory
+        I18n.backend.store_translations(:en, hello: "Hello, %{name}!")
+
+        # Test translation
+        greeting = I18n.t('hello', name: 'World')
+        raise "Translation test failed!" unless greeting == "Hello, World!"
+
+        puts "Basic translation test passed!"
+        EOF
+
 update:
   enabled: true
   github:
diff --git a/ruby3.2-io-console.yaml b/ruby3.2-io-console.yaml
index 14e5663f153..7d82a394eaa 100644
--- a/ruby3.2-io-console.yaml
+++ b/ruby3.2-io-console.yaml
@@ -1,8 +1,8 @@
 # Generated from https://github.com/ruby/io-console
 package:
   name: ruby3.2-io-console
-  version: 0.7.2
-  epoch: 1
+  version: 0.8.0
+  epoch: 0
   description: add console capabilities to IO instances.
   copyright:
     - license: Ruby
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/io-console.git
       tag: v${{package.version}}
-      expected-commit: 1f2877a18512ec6d90d4d6d3d9d3fdf8095575a8
+      expected-commit: 467508a0c64aa0dc4ae4f42179442570f52140f0
 
   - uses: ruby/build
     with:
@@ -44,7 +44,38 @@ vars:
 
 test:
   pipeline:
-    - runs: ruby -e "require 'io/console'"
+    - name: Verify gem installation
+      runs: |
+        gem list io-console
+    - name: Test core functionality
+      runs: |
+        ruby -e '
+          begin
+            require "io/console"
+
+            # Test basic require works
+            puts "Loaded io/console successfully"
+
+            # Test core methods
+            [:tty?, :winsize, :winsize=].each do |method|
+              unless IO.instance_methods.include?(method)
+                raise "Missing IO method: #{method}"
+              end
+            end
+
+            # Test STDIN responds to console methods
+            unless STDIN.respond_to?(:tty?)
+              raise "STDIN missing tty? method"
+            end
+
+            puts "Core functionality verified"
+            exit 0
+          rescue => e
+            puts "Test failed: #{e.class}: #{e.message}"
+            puts e.backtrace
+            exit 1
+          end
+        '
 
 update:
   enabled: true
diff --git a/ruby3.2-jar-dependencies.yaml b/ruby3.2-jar-dependencies.yaml
index 11eae1677c5..2b5ee7d07ed 100644
--- a/ruby3.2-jar-dependencies.yaml
+++ b/ruby3.2-jar-dependencies.yaml
@@ -1,8 +1,8 @@
 # Generated from https://github.com/mkristian/jar-dependencies
 package:
   name: ruby3.2-jar-dependencies
-  version: 0.4.2
-  epoch: 2
+  version: 0.5.0
+  epoch: 0
   description: manage jar dependencies for gems and keep track which jar was already loaded using maven artifact coordinates. it warns on version conflicts and loads only ONE jar assuming the first one is compatible to the second one otherwise your project needs to lock down the right version by providing a Jars.lock file.
   copyright:
     - license: MIT
@@ -20,7 +20,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: b1e99921627a481f2746f1b729920b4b95e93c83
+      expected-commit: e35accc9a7608f49a06b6b660e188d6e3f4674b0
       repository: https://github.com/mkristian/jar-dependencies
       tag: ${{package.version}}
 
@@ -49,6 +49,29 @@ test:
     # AUTOGENERATED
     - runs: |
         lock_jars --help
+    - name: Verify gem import
+      runs: ruby -e "require 'jar_dependencies'; puts 'jar_dependencies loaded successfully!'"
+    - name: Test basic functionality
+      runs: |
+        ruby -e '
+          begin
+            require "jar_dependencies"
+
+            # Test module definition
+            raise "Missing Jars module" unless defined?(Jars)
+
+            # Test basic methods exist
+            [:require_jar, :setup, :lock].each do |method|
+              raise "Missing method: Jars.#{method}" unless Jars.respond_to?(method)
+            end
+
+            puts "Basic jar-dependencies functionality verified"
+            exit 0
+          rescue => e
+            puts "Test failed: #{e.message}"
+            exit 1
+          end
+        '
 
 var-transforms:
   - from: ${{package.name}}
diff --git a/ruby3.2-jmespath.yaml b/ruby3.2-jmespath.yaml
index d134bf968e9..a3ecfd7f29b 100644
--- a/ruby3.2-jmespath.yaml
+++ b/ruby3.2-jmespath.yaml
@@ -37,6 +37,32 @@ pipeline:
 vars:
   gem: jmespath
 
+test:
+  pipeline:
+    - name: Verify gem import
+      runs: ruby -e "require 'jmespath'; puts 'jmespath loaded successfully!'"
+    - name: Basic JMESPath evaluation
+      runs: |
+        ruby <<-EOF
+        require 'jmespath'
+
+        # Basic JMESPath expression test
+        data = {
+          "foo" => {
+            "bar" => "value"
+          }
+        }
+        expression = "foo.bar"
+        result = JMESPath.search(expression, data)
+
+        # Validate the result
+        if result == "value"
+          puts "Basic JMESPath evaluation successful!"
+        else
+          raise "Expected 'value' but got '\#{result}'"
+        end
+        EOF
+
 update:
   enabled: true
   github:
diff --git a/ruby3.2-logger.yaml b/ruby3.2-logger.yaml
index 90c02242cdf..1bbe6ee8d9b 100644
--- a/ruby3.2-logger.yaml
+++ b/ruby3.2-logger.yaml
@@ -1,8 +1,8 @@
 # Generated from https://github.com/ruby/logger
 package:
   name: ruby3.2-logger
-  version: 1.6.1
-  epoch: 1
+  version: 1.6.2
+  epoch: 0
   description: Provides a simple logging utility for outputting messages.
   copyright:
     - license: Ruby
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/logger
       tag: v${{package.version}}
-      expected-commit: bda937b4cc9283e33c5f19d5f0b8976541dbdba2
+      expected-commit: 2d07f086f8aa0bd5923a072ce7bd15e5dd301f16
 
   - uses: ruby/build
     with:
diff --git a/ruby3.2-logstash-core-plugin-api.yaml b/ruby3.2-logstash-core-plugin-api.yaml
index 6698052f593..2216aa78bc0 100644
--- a/ruby3.2-logstash-core-plugin-api.yaml
+++ b/ruby3.2-logstash-core-plugin-api.yaml
@@ -1,7 +1,7 @@
 # Generated from http://www.elastic.co/guide/en/logstash/current/index.html
 package:
   name: ruby3.2-logstash-core-plugin-api
-  version: 8.16.0
+  version: 8.16.1
   epoch: 0
   description: Logstash plugin API
   copyright:
@@ -34,7 +34,7 @@ pipeline:
     with:
       repository: https://github.com/elastic/logstash
       tag: v${{package.version}}
-      expected-commit: e4cb5c1ff7b7e5c3c38dae35ba4c01d5478a3100
+      expected-commit: a769327be81a655ed66a0539cee42380de220c27
 
   - working-directory: logstash-core-plugin-api
     pipeline:
diff --git a/ruby3.2-logstash-core.yaml b/ruby3.2-logstash-core.yaml
index 2fcca4b26cb..78d8580b6ed 100644
--- a/ruby3.2-logstash-core.yaml
+++ b/ruby3.2-logstash-core.yaml
@@ -1,7 +1,7 @@
 # Generated from http://www.elastic.co/guide/en/logstash/current/index.html
 package:
   name: ruby3.2-logstash-core
-  version: 8.16.0
+  version: 8.16.1
   epoch: 0
   description: The core components of logstash, the scalable log and event management tool
   copyright:
@@ -45,7 +45,7 @@ pipeline:
     with:
       repository: https://github.com/elastic/logstash
       tag: v${{package.version}}
-      expected-commit: e4cb5c1ff7b7e5c3c38dae35ba4c01d5478a3100
+      expected-commit: a769327be81a655ed66a0539cee42380de220c27
 
   - working-directory: logstash-core
     pipeline:
diff --git a/ruby3.2-mime-types-data.yaml b/ruby3.2-mime-types-data.yaml
index 45266d58252..8885dd5cf9c 100644
--- a/ruby3.2-mime-types-data.yaml
+++ b/ruby3.2-mime-types-data.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.2-mime-types-data
-  version: 3.2024.1105
+  version: 3.2024.1203
   epoch: 0
   description: MIME Type registry data
   copyright:
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/mime-types/mime-types-data.git
       tag: v${{package.version}}
-      expected-commit: 06c34687e700b93869f4b9ad27b954cd9fddc28f
+      expected-commit: 4a5993ec84c3f860c37f2e9c297dd378e4e76c2a
 
   - uses: ruby/build
     with:
diff --git a/ruby3.2-net-http.yaml b/ruby3.2-net-http.yaml
index b60123edaa5..ceb04363d86 100644
--- a/ruby3.2-net-http.yaml
+++ b/ruby3.2-net-http.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.2-net-http
-  version: 0.5.0
+  version: 0.6.0
   epoch: 0
   description: "A rich library which can be used to build HTTP user-agents for Ruby"
   copyright:
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/net-http
       tag: v${{package.version}}
-      expected-commit: 28a4bf9295f65eeea693419c2640ddf22c116732
+      expected-commit: 6475fa68ba8483d4651b7a8e4d33f0aea2cf27db
 
   - uses: ruby/build
     with:
diff --git a/ruby3.2-protocol-http.yaml b/ruby3.2-protocol-http.yaml
index a8b31f40bb6..607f9ba6ce4 100644
--- a/ruby3.2-protocol-http.yaml
+++ b/ruby3.2-protocol-http.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.2-protocol-http
-  version: 0.44.0
+  version: 0.47.0
   epoch: 0
   description: Provides abstractions to handle HTTP protocols.
   copyright:
@@ -25,7 +25,7 @@ vars:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: bdabfd7e25a4949406d8c420f67427005518091c
+      expected-commit: 9c8431041ee28d782e5d3ee70685bfcd15a38191
       repository: https://github.com/socketry/protocol-http
       tag: v${{package.version}}
 
diff --git a/ruby3.2-protocol-http2.yaml b/ruby3.2-protocol-http2.yaml
index e8f1cd9c23d..a468c2303dc 100644
--- a/ruby3.2-protocol-http2.yaml
+++ b/ruby3.2-protocol-http2.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.2-protocol-http2
-  version: 0.20.0
+  version: 0.21.0
   epoch: 0
   description: A low level implementation of the HTTP/2 protocol.
   copyright:
@@ -27,7 +27,7 @@ vars:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 76a6cda55ac572af57ae7d87e12dc297930c9d42
+      expected-commit: 04362a916b5d6bd65c2a8982f2ed0583f1e02328
       repository: https://github.com/socketry/protocol-http2
       tag: v${{package.version}}
 
diff --git a/ruby3.2-psych.yaml b/ruby3.2-psych.yaml
index c1201d2102a..4f27c7c8a3d 100644
--- a/ruby3.2-psych.yaml
+++ b/ruby3.2-psych.yaml
@@ -1,7 +1,7 @@
 # Generated from https://github.com/ruby/psych
 package:
   name: ruby3.2-psych
-  version: 5.2.0
+  version: 5.2.1
   epoch: 0
   description: Psych is a YAML parser and emitter.
   copyright:
@@ -27,7 +27,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/psych.git
       tag: v${{package.version}}
-      expected-commit: 6ea07fdadd8245ed01d26122baacb56ff01662b8
+      expected-commit: 7c81f7db53cf2dbed9cf7a441867af62453c0011
 
   - uses: ruby/build
     with:
diff --git a/ruby3.2-reline.yaml b/ruby3.2-reline.yaml
index ca8660be54d..4e9612e45b1 100644
--- a/ruby3.2-reline.yaml
+++ b/ruby3.2-reline.yaml
@@ -1,7 +1,7 @@
 # Generated from https://github.com/ruby/reline
 package:
   name: ruby3.2-reline
-  version: 0.5.11
+  version: 0.5.12
   epoch: 0
   description: Alternative GNU Readline or Editline implementation by pure Ruby.
   copyright:
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/reline.git
       tag: v${{package.version}}
-      expected-commit: 4d90743409fbfbe79ea5b70c862a03d66e202e52
+      expected-commit: d4f6741e7eb942b5bf71b9c318492a4a79625c74
 
   - uses: ruby/build
     with:
diff --git a/ruby3.2-securerandom.yaml b/ruby3.2-securerandom.yaml
index 81d0cf1ffee..98cc6700e90 100644
--- a/ruby3.2-securerandom.yaml
+++ b/ruby3.2-securerandom.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.2-securerandom
-  version: 0.3.2
+  version: 0.4.0
   epoch: 0
   description: Interface for secure random number generator.
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/securerandom
       tag: v${{package.version}}
-      expected-commit: 9703d96a76ee72a278558a474d69cc0eb0bc0d6e
+      expected-commit: 53f97f31518a4aca129d5cff6b23ae8a2c7d2348
 
   - uses: ruby/build
     with:
diff --git a/ruby3.3-bouncy-castle-java.yaml b/ruby3.3-bouncy-castle-java.yaml
index 34961ff2f12..d29a4d272c6 100644
--- a/ruby3.3-bouncy-castle-java.yaml
+++ b/ruby3.3-bouncy-castle-java.yaml
@@ -2,7 +2,7 @@
 package:
   name: ruby3.3-bouncy-castle-java
   version: 1.5.0146.1
-  epoch: 0
+  epoch: 1
   description: Gem redistribution of "Legion of the Bouncy Castle Java cryptography APIs" jars at http://www.bouncycastle.org/java.html
   copyright:
     - license: MIT
@@ -19,7 +19,7 @@ environment:
       - ruby-${{vars.rubyMM}}-dev
   environment:
     # https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on
-    BCPROV_VERSION: 1.77
+    BCPROV_VERSION: 1.78
 
 pipeline:
   - uses: git-checkout
diff --git a/ruby3.3-date.yaml b/ruby3.3-date.yaml
index b6b9fb26bcc..a0c948aeea4 100644
--- a/ruby3.3-date.yaml
+++ b/ruby3.3-date.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.3-date
-  version: 3.4.0
+  version: 3.4.1
   epoch: 0
   description: A subclass of Object includes Comparable module for handling dates.
   copyright:
@@ -20,7 +20,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 94f8e51e65a03643a19d22562c350de13d4c6b09
+      expected-commit: a3295ad262773a80ad61526beb500b29e770b817
       repository: https://github.com/ruby/date
       tag: v${{package.version}}
 
diff --git a/ruby3.3-excon.yaml b/ruby3.3-excon.yaml
index 0643ec8163e..6a5b7894a07 100644
--- a/ruby3.3-excon.yaml
+++ b/ruby3.3-excon.yaml
@@ -1,7 +1,7 @@
 # Generated from https://github.com/excon/excon
 package:
   name: ruby3.3-excon
-  version: 1.2.1
+  version: 1.2.2
   epoch: 0
   description: EXtended http(s) CONnections
   copyright:
@@ -21,7 +21,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/excon/excon
-      expected-commit: 239111877ffa6f56ccc6d8f43d0fae2dec17e164
+      expected-commit: 0403dc0ffc589884b3ecd6aeed3cf7589fa68086
       tag: v${{package.version}}
 
   - uses: ruby/build
diff --git a/ruby3.3-faraday-excon.yaml b/ruby3.3-faraday-excon.yaml
index f1b888bf50a..5321b378abf 100644
--- a/ruby3.3-faraday-excon.yaml
+++ b/ruby3.3-faraday-excon.yaml
@@ -42,6 +42,31 @@ pipeline:
 vars:
   gem: faraday-excon
 
+test:
+  environment:
+    contents:
+      packages:
+        - ruby${{vars.rubyMM}}-net-http
+  pipeline:
+    - runs: ruby -e "require 'faraday/excon'; puts 'Faraday Excon adapter loaded successfully!'"
+    - runs: |
+        ruby <<-EOF
+        require 'faraday'
+        require 'faraday/excon'
+
+        # Test the Faraday connection with Excon adapter
+        begin
+          conn = Faraday.new(url: 'https://example.com') do |f|
+            f.adapter :excon
+          end
+
+          response = conn.get('/')
+          puts "Faraday connection with Excon adapter configured successfully! Response status: \#{response.status}"
+        rescue StandardError => e
+          raise "Test failed with error: \#{e.message}"
+        end
+        EOF
+
 update:
   enabled: true
   github:
diff --git a/ruby3.3-faraday-follow_redirects.yaml b/ruby3.3-faraday-follow_redirects.yaml
index c9e16e85207..0299b3427bf 100644
--- a/ruby3.3-faraday-follow_redirects.yaml
+++ b/ruby3.3-faraday-follow_redirects.yaml
@@ -41,6 +41,36 @@ pipeline:
 vars:
   gem: faraday-follow_redirects
 
+test:
+  environment:
+    contents:
+      packages:
+        - ruby${{vars.rubyMM}}-net-http
+  pipeline:
+    - runs: ruby -e "require 'faraday/follow_redirects'; puts 'Faraday Follow Redirects middleware loaded successfully!'"
+    - runs: |
+        ruby <<-EOF
+        require 'faraday'
+        require 'faraday/follow_redirects'
+
+        # Test the Faraday connection with the Follow Redirects middleware
+        begin
+          conn = Faraday.new(url: 'http://httpbingo.org/redirect/1') do |f|
+            f.use Faraday::FollowRedirects::Middleware
+            f.adapter Faraday.default_adapter
+          end
+
+          response = conn.get
+          if response.status == 200
+            puts "Faraday connection with Follow Redirects middleware configured successfully! Final status: \#{response.status}"
+          else
+            raise "Unexpected response status: \#{response.status}"
+          end
+        rescue StandardError => e
+          raise "Test failed with error: \#{e.message}"
+        end
+        EOF
+
 update:
   enabled: true
   github:
diff --git a/ruby3.3-faraday-net_http.yaml b/ruby3.3-faraday-net_http.yaml
index be0b7f3d665..06c67d7d15b 100644
--- a/ruby3.3-faraday-net_http.yaml
+++ b/ruby3.3-faraday-net_http.yaml
@@ -1,10 +1,13 @@
 package:
   name: ruby3.3-faraday-net_http
   version: 3.4.0
-  epoch: 0
+  epoch: 1
   description: Faraday adapter for Net::HTTP
   copyright:
     - license: MIT
+  dependencies:
+    runtime:
+      - ruby3.3-net-http
 
 environment:
   contents:
@@ -42,7 +45,6 @@ test:
     contents:
       packages:
         - ruby3.3-faraday
-        - ruby3.3-net-http
   pipeline:
     # Users do not import this package directly, see the following for a deeper
     # explanation: https://github.com/lostisland/faraday-net_http/issues/25
diff --git a/ruby3.3-faraday.yaml b/ruby3.3-faraday.yaml
index a8a05f39e2e..e3b38d6ce5d 100644
--- a/ruby3.3-faraday.yaml
+++ b/ruby3.3-faraday.yaml
@@ -42,17 +42,55 @@ vars:
   gem: faraday
 
 test:
+  environment:
+    contents:
+      packages:
+        - ruby${{vars.rubyMM}}-faraday-net_http
+        - ruby${{vars.rubyMM}}-net-http
   pipeline:
     - name: Verify library import
       runs: ruby -e "require 'faraday'"
     - name: Basic usage
       runs: |
-        cat <<EOF > /tmp/test.rb
+        cat <<EOF > /tmp/basic_usage_test.rb
         require 'faraday'
         response = Faraday.get("https://edu.chainguard.dev/open-source/wolfi/overview/")
-        print response.status
+        if response.status == 200
+          puts "Basic usage test passed! Status: \#{response.status}"
+        else
+          raise "Basic usage test failed. Unexpected status: \#{response.status}"
+        end
         EOF
-        ruby /tmp/test.rb
+        ruby /tmp/basic_usage_test.rb
+    - name: Functional test with middleware
+      runs: |
+        cat <<EOF > /tmp/functional_test_middleware.rb
+        require 'faraday'
+        require 'json'
+
+        # Configure Faraday connection with a middleware
+        conn = Faraday.new(url: "https://httpbin.org") do |f|
+          f.request :url_encoded
+          f.adapter :net_http
+        end
+
+        # Perform a POST request with some data
+        response = conn.post("/post") do |req|
+          req.headers['Content-Type'] = 'application/json'
+          req.body = { test_key: 'test_value' }.to_json
+        end
+
+        # Parse the JSON response
+        parsed_body = JSON.parse(response.body)
+
+        # Validate the response
+        if response.status == 200 && parsed_body["json"]["test_key"] == "test_value"
+          puts "Functional middleware test passed!"
+        else
+          raise "Functional middleware test failed."
+        end
+        EOF
+        ruby /tmp/functional_test_middleware.rb
 
 update:
   enabled: true
diff --git a/ruby3.3-faraday_middleware-aws-sigv4.yaml b/ruby3.3-faraday_middleware-aws-sigv4.yaml
new file mode 100644
index 00000000000..1c8fabc13ae
--- /dev/null
+++ b/ruby3.3-faraday_middleware-aws-sigv4.yaml
@@ -0,0 +1,83 @@
+package:
+  name: ruby3.3-faraday_middleware-aws-sigv4
+  version: 1.0.1
+  epoch: 0
+  description: Faraday middleware for AWS Signature Version 4 using aws-sigv4.
+  copyright:
+    - license: MIT
+  dependencies:
+    runtime:
+      - ruby${{vars.rubyMM}}-aws-sigv4
+      - ruby${{vars.rubyMM}}-faraday
+
+environment:
+  contents:
+    packages:
+      - build-base
+      - busybox
+      - ca-certificates-bundle
+      - git
+      - ruby-${{vars.rubyMM}}
+      - ruby-${{vars.rubyMM}}-dev
+
+pipeline:
+  - uses: git-checkout
+    with:
+      expected-commit: 8637e57de564df2b163bc459119dcae5b9b222de
+      repository: https://github.com/winebarrel/faraday_middleware-aws-sigv4
+      tag: v${{package.version}}
+
+  - uses: ruby/build
+    with:
+      gem: ${{vars.gem}}
+
+  - uses: ruby/install
+    with:
+      gem: ${{vars.gem}}
+      version: ${{package.version}}
+
+  - uses: ruby/clean
+
+vars:
+  gem: faraday_middleware-aws-sigv4
+
+update:
+  enabled: true
+  github:
+    identifier: winebarrel/faraday_middleware-aws-sigv4
+    strip-prefix: v
+    use-tag: true
+
+test:
+  environment:
+    contents:
+      packages:
+        - ruby${{vars.rubyMM}}-net-http
+  pipeline:
+    - runs: ruby -e "require 'faraday_middleware/aws_sigv4'; puts 'faraday_middleware/aws_sigv4 loaded successfully!'"
+    - runs: |
+        ruby <<-EOF
+        require 'faraday'
+        require 'faraday_middleware/aws_sigv4'
+
+        # Test the middleware by configuring a Faraday connection
+        begin
+          conn = Faraday.new(url: 'https://example.com') do |f|
+            f.request :aws_sigv4,
+              service: 's3',
+              region: 'us-east-1',
+              access_key_id: 'fake_access_key',
+              secret_access_key: 'fake_secret_key'
+          end
+
+          puts "Faraday connection configured successfully with AWS SigV4 middleware!"
+        rescue StandardError => e
+          raise "Test failed with error: #{e.message}"
+        end
+        EOF
+
+var-transforms:
+  - from: ${{package.name}}
+    match: ^ruby(\d\.\d+)-.*
+    replace: $1
+    to: rubyMM
diff --git a/ruby3.3-filesize.yaml b/ruby3.3-filesize.yaml
index bb9d88ccf81..a12e8912cf4 100644
--- a/ruby3.3-filesize.yaml
+++ b/ruby3.3-filesize.yaml
@@ -38,6 +38,46 @@ pipeline:
 vars:
   gem: filesize
 
+test:
+  environment:
+    contents:
+      packages:
+        - ruby-${{vars.rubyMM}}
+  pipeline:
+    - name: Verify gem installation
+      runs: |
+        gem list filesize
+    - name: Basic functionality test
+      runs: |
+        ruby -e '
+          begin
+            require "filesize"
+            puts "Debug: Loading Filesize class..."
+
+            # Create size object directly with bytes
+            bytes = Filesize.new(1024)
+            puts "Debug: Created Filesize object: " + bytes.inspect
+
+            # Convert to KiB (binary kilobytes) since that is the default
+            kib = bytes.to("KiB")
+            puts "Debug: Converted to KiB: " + kib.inspect
+
+            size = kib.to_f
+            puts "Debug: Final float value: " + size.to_s
+
+            # Should be exactly 1.0 since 1024 bytes = 1 KiB
+            if size == 1.0
+              puts "Test passed: 1024 B = 1 KiB"
+              exit 0
+            else
+              raise "Test failed: Expected 1.0 KiB, got " + size.to_s
+            end
+          rescue => e
+            puts "Test failed with error: " + e.class.to_s + ": " + e.message
+            puts e.backtrace
+            exit 1
+          end '
+
 update:
   enabled: false
   exclude-reason: unmaintained, latest tag cut in 2018
diff --git a/ruby3.3-fluent-config-regexp-type.yaml b/ruby3.3-fluent-config-regexp-type.yaml
index eef339a9439..a1f2d37857e 100644
--- a/ruby3.3-fluent-config-regexp-type.yaml
+++ b/ruby3.3-fluent-config-regexp-type.yaml
@@ -42,6 +42,29 @@ pipeline:
 
   - uses: ruby/clean
 
+test:
+  pipeline:
+    - runs: |
+        ruby -e '
+          require "fluent/config/regexp_type"
+
+          # Test timestamp pattern
+          regex = Fluent::Config::REGEXP_TYPE.call("/^\\d{4}-\\d{2}-\\d{2}/")
+
+          # Should match
+          raise "Valid date (2024-11-23) failed to match" unless regex.match?("2024-11-23")
+
+          # Should not match any of these
+          ["11-23-2024", "11-2-2024", "11-23-202", "202-11-23"].each do |invalid_date|
+            if regex.match?(invalid_date)
+              raise "Incorrectly matched #{invalid_date} which should not match pattern ^\\d{4}-\\d{2}-\\d{2}"
+            end
+          end
+
+          puts "All tests passed!"
+          puts "Pattern matches yyyy-mm-dd format only"
+        '
+
 update:
   enabled: true
   github:
diff --git a/ruby3.3-fluentd-1.17.yaml b/ruby3.3-fluentd-1.17.yaml
index 84383ec198d..040571dd011 100644
--- a/ruby3.3-fluentd-1.17.yaml
+++ b/ruby3.3-fluentd-1.17.yaml
@@ -92,6 +92,7 @@ update:
 
 test:
   pipeline:
+    # Keep existing daemon test
     - name: Daemon test
       uses: test/daemon-check-output
       with:
@@ -100,6 +101,8 @@ test:
           mkdir -p /etc/fluent/
           touch /etc/fluent/fluent.conf
         expected_output: fluentd worker is now running
+    # Keep command line tests
+    - name: Command line tests
       runs: |
         fluent-binlog-reader --version
         fluent-ca-generate --version
@@ -117,6 +120,61 @@ test:
         fluent-plugin-generate --help
         fluentd --version
         fluentd --help
+    - name: Basic IO test
+      runs: |
+        # Create minimal config
+        cat > test.conf <<EOF
+        <system>
+          log_level debug
+        </system>
+
+        <source>
+          @type forward
+          port 24224
+        </source>
+
+        <match test.**>
+          @type file
+          path /tmp/fluentd_test
+          append true
+          <buffer>
+            flush_mode immediate
+          </buffer>
+        </match>
+        EOF
+
+        # Start fluentd with logs
+        fluentd -c test.conf -d /tmp/fluentd.pid --log /tmp/fluentd.log
+
+        # Wait for start
+        sleep 5
+
+        # Send test message with specific content
+        echo '{"message":"test_message_content"}' | fluent-cat test.tag
+
+        # Wait for processing
+        sleep 5
+
+        # Check output files and content
+        if ls /tmp/fluentd_test.*.log > /dev/null 2>&1; then
+          OUTPUT=$(cat /tmp/fluentd_test.*.log)
+          echo "Output file contents: $OUTPUT"
+
+          if echo "$OUTPUT" | grep -q "test_message_content"; then
+            echo "Test passed: Message content verified"
+          else
+            echo "Test failed: Expected message content not found"
+            exit 1
+          fi
+        else
+          echo "Test failed: No output file"
+          echo "Fluentd logs:"
+          cat /tmp/fluentd.log
+          exit 1
+        fi
+
+        # Cleanup
+        kill $(cat /tmp/fluentd.pid)
 
 var-transforms:
   - from: ${{package.name}}
diff --git a/ruby3.3-gems.yaml b/ruby3.3-gems.yaml
index 791a8939b87..a90ef253b57 100644
--- a/ruby3.3-gems.yaml
+++ b/ruby3.3-gems.yaml
@@ -49,6 +49,22 @@ test:
         print Gems.info 'rails'
         EOF
         ruby /tmp/test.rb
+    - name: Basic functionality test
+      runs: |
+        ruby -e '
+          require "gems"
+          require "json"
+
+          # Test search functionality
+          result = Gems.search("rake")
+          raise "Search failed" unless result.is_a?(Array) && !result.empty?
+
+          # Test version info
+          versions = Gems.versions("rake")
+          raise "Version lookup failed" unless versions.is_a?(Array) && !versions.empty?
+
+          puts "Tests passed - got valid responses for search and versions"
+        '
 
 update:
   enabled: true
diff --git a/ruby3.3-hashie.yaml b/ruby3.3-hashie.yaml
index 5e7aa3f9149..142292282e2 100644
--- a/ruby3.3-hashie.yaml
+++ b/ruby3.3-hashie.yaml
@@ -38,6 +38,43 @@ pipeline:
 vars:
   gem: hashie
 
+test:
+  pipeline:
+    - name: Verify library import
+      runs: ruby -e "require 'hashie'"
+    - name: Basic functionality test
+      runs: |
+        ruby -e '
+          require "hashie"
+
+          # Test Mash functionality
+          mash = Hashie::Mash.new
+          mash.name = "Test"
+          mash.info = { lang: "Ruby" }
+
+          raise "Basic assignment failed" unless mash.name == "Test"
+          raise "Nested hash failed" unless mash.info.lang == "Ruby"
+
+          # Test indifferent access
+          mash[:test_key] = "value"
+          raise "Indifferent access failed" unless mash["test_key"] == "value" && mash.test_key == "value"
+
+          # Test key deletion
+          mash.delete(:test_key)
+          raise "Delete failed" if mash.key?(:test_key)
+
+          # Test default values
+          mash.default = "not found"
+          raise "Default value failed" unless mash.missing == "not found"
+
+          # Test merge
+          other = Hashie::Mash.new(a: 1, b: 2)
+          merged = mash.merge(other)
+          raise "Merge failed" unless merged.a == 1 && merged.info.lang == "Ruby"
+
+          puts "All tests passed!"
+        '
+
 update:
   enabled: true
   github:
diff --git a/ruby3.3-http.yaml b/ruby3.3-http.yaml
index eeced43c711..7849830cf06 100644
--- a/ruby3.3-http.yaml
+++ b/ruby3.3-http.yaml
@@ -54,6 +54,23 @@ test:
         HTTP.get("https://github.com").to_s
         EOF
         ruby /tmp/test.rb
+    - name: Functional test with POST request
+      runs: |
+        cat <<EOF > /tmp/functional_test.rb
+        require "http"
+
+        # Perform a POST request to httpbin.org
+        response = HTTP.post("https://httpbin.org/post", json: { key: "value" })
+
+        # Validate the response
+        raise "Unexpected status code" unless response.status == 200
+
+        body = response.parse(:json)
+        raise "Unexpected response body" unless body["json"]["key"] == "value"
+
+        puts "Functional test passed!"
+        EOF
+        ruby /tmp/functional_test.rb
 
 update:
   enabled: true
diff --git a/ruby3.3-http_parser.rb.yaml b/ruby3.3-http_parser.rb.yaml
index 504b59a7cef..7095fa9548c 100644
--- a/ruby3.3-http_parser.rb.yaml
+++ b/ruby3.3-http_parser.rb.yaml
@@ -48,6 +48,62 @@ pipeline:
           version: ${{package.version}}
       - uses: ruby/clean
 
+test:
+  environment:
+    contents:
+      packages:
+        - ruby-${{vars.rubyMM}}
+  pipeline:
+    - name: Verify gem installation
+      runs: gem list http_parser.rb
+    - name: Basic import test
+      runs: |
+        ruby <<-EOF
+        begin
+          require 'http/parser'
+          puts "Basic import test passed! HTTP::Parser loaded successfully."
+        rescue LoadError => e
+          puts "Basic import test failed: #{e.message}"
+          exit 1
+        end
+        EOF
+    - name: Expanded functionality test
+      runs: |
+        ruby <<-EOF
+        require 'http/parser'
+
+        # Create a basic HTTP parser and parse a simple request
+        begin
+          parser = HTTP::Parser.new
+          parsed_headers = {}
+
+          # Define callbacks for parsing events
+          parser.on_headers_complete = proc do |headers|
+            parsed_headers.merge!(headers)
+            puts "Headers parsed successfully!"
+          end
+          parser.on_message_complete = proc { puts "Message parsed successfully!" }
+
+          # Feed the parser with a simple HTTP request
+          request = "GET /path/to/resource HTTP/1.1\r\n" \
+                    "Host: example.com\r\n" \
+                    "User-Agent: TestAgent\r\n\r\n"
+          parser << request
+
+          # Validate parsing results
+          raise "Unexpected HTTP method" unless parser.http_method == "GET"
+          raise "Unexpected request URL" unless parser.request_url == "/path/to/resource"
+          raise "Unexpected HTTP version" unless parser.http_version == [1, 1]
+          raise "Unexpected Host header" unless parsed_headers["Host"] == "example.com"
+          raise "Unexpected User-Agent header" unless parsed_headers["User-Agent"] == "TestAgent"
+
+          puts "Expanded functionality test passed with valid results!"
+        rescue => e
+          puts "Test failed: #{e.message}"
+          exit 1
+        end
+        EOF
+
 update:
   enabled: true
   github:
diff --git a/ruby3.3-i18n.yaml b/ruby3.3-i18n.yaml
index f653d1a9d64..e6c692ce268 100644
--- a/ruby3.3-i18n.yaml
+++ b/ruby3.3-i18n.yaml
@@ -40,6 +40,24 @@ pipeline:
 vars:
   gem: i18n
 
+test:
+  pipeline:
+    - runs: ruby -e "require 'i18n'"
+    - name: Basic translation test
+      runs: |
+        ruby <<-EOF
+        require 'i18n'
+
+        # Create a translation directly in memory
+        I18n.backend.store_translations(:en, hello: "Hello, %{name}!")
+
+        # Test translation
+        greeting = I18n.t('hello', name: 'World')
+        raise "Translation test failed!" unless greeting == "Hello, World!"
+
+        puts "Basic translation test passed!"
+        EOF
+
 update:
   enabled: true
   github:
diff --git a/ruby3.3-io-console.yaml b/ruby3.3-io-console.yaml
index 06abb60af39..b40ec6ed736 100644
--- a/ruby3.3-io-console.yaml
+++ b/ruby3.3-io-console.yaml
@@ -1,7 +1,7 @@
 # Generated from https://github.com/ruby/io-console
 package:
   name: ruby3.3-io-console
-  version: 0.7.2
+  version: 0.8.0
   epoch: 0
   description: add console capabilities to IO instances.
   copyright:
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/io-console.git
       tag: v${{package.version}}
-      expected-commit: 1f2877a18512ec6d90d4d6d3d9d3fdf8095575a8
+      expected-commit: 467508a0c64aa0dc4ae4f42179442570f52140f0
 
   - uses: ruby/build
     with:
@@ -44,7 +44,38 @@ vars:
 
 test:
   pipeline:
-    - runs: ruby -e "require 'io/console'"
+    - name: Verify gem installation
+      runs: |
+        gem list io-console
+    - name: Test core functionality
+      runs: |
+        ruby -e '
+          begin
+            require "io/console"
+
+            # Test basic require works
+            puts "Loaded io/console successfully"
+
+            # Test core methods
+            [:tty?, :winsize, :winsize=].each do |method|
+              unless IO.instance_methods.include?(method)
+                raise "Missing IO method: #{method}"
+              end
+            end
+
+            # Test STDIN responds to console methods
+            unless STDIN.respond_to?(:tty?)
+              raise "STDIN missing tty? method"
+            end
+
+            puts "Core functionality verified"
+            exit 0
+          rescue => e
+            puts "Test failed: #{e.class}: #{e.message}"
+            puts e.backtrace
+            exit 1
+          end
+        '
 
 update:
   enabled: true
diff --git a/ruby3.3-jar-dependencies.yaml b/ruby3.3-jar-dependencies.yaml
index 2a25970c61d..2f71417c6ba 100644
--- a/ruby3.3-jar-dependencies.yaml
+++ b/ruby3.3-jar-dependencies.yaml
@@ -1,7 +1,7 @@
 # Generated from https://github.com/mkristian/jar-dependencies
 package:
   name: ruby3.3-jar-dependencies
-  version: 0.4.2
+  version: 0.5.0
   epoch: 0
   description: manage jar dependencies for gems and keep track which jar was already loaded using maven artifact coordinates. it warns on version conflicts and loads only ONE jar assuming the first one is compatible to the second one otherwise your project needs to lock down the right version by providing a Jars.lock file.
   copyright:
@@ -20,7 +20,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: b1e99921627a481f2746f1b729920b4b95e93c83
+      expected-commit: e35accc9a7608f49a06b6b660e188d6e3f4674b0
       repository: https://github.com/mkristian/jar-dependencies
       tag: ${{package.version}}
 
@@ -49,6 +49,29 @@ test:
     # AUTOGENERATED
     - runs: |
         lock_jars --help
+    - name: Verify gem import
+      runs: ruby -e "require 'jar_dependencies'; puts 'jar_dependencies loaded successfully!'"
+    - name: Test basic functionality
+      runs: |
+        ruby -e '
+          begin
+            require "jar_dependencies"
+
+            # Test module definition
+            raise "Missing Jars module" unless defined?(Jars)
+
+            # Test basic methods exist
+            [:require_jar, :setup, :lock].each do |method|
+              raise "Missing method: Jars.#{method}" unless Jars.respond_to?(method)
+            end
+
+            puts "Basic jar-dependencies functionality verified"
+            exit 0
+          rescue => e
+            puts "Test failed: #{e.message}"
+            exit 1
+          end
+        '
 
 var-transforms:
   - from: ${{package.name}}
diff --git a/ruby3.3-jmespath.yaml b/ruby3.3-jmespath.yaml
index 7cc5894939d..1f6a846225d 100644
--- a/ruby3.3-jmespath.yaml
+++ b/ruby3.3-jmespath.yaml
@@ -37,6 +37,32 @@ pipeline:
 vars:
   gem: jmespath
 
+test:
+  pipeline:
+    - name: Verify gem import
+      runs: ruby -e "require 'jmespath'; puts 'jmespath loaded successfully!'"
+    - name: Basic JMESPath evaluation
+      runs: |
+        ruby <<-EOF
+        require 'jmespath'
+
+        # Basic JMESPath expression test
+        data = {
+          "foo" => {
+            "bar" => "value"
+          }
+        }
+        expression = "foo.bar"
+        result = JMESPath.search(expression, data)
+
+        # Validate the result
+        if result == "value"
+          puts "Basic JMESPath evaluation successful!"
+        else
+          raise "Expected 'value' but got '\#{result}'"
+        end
+        EOF
+
 update:
   enabled: true
   github:
diff --git a/ruby3.3-json.yaml b/ruby3.3-json.yaml
index eb899c90e9f..e28955b6865 100644
--- a/ruby3.3-json.yaml
+++ b/ruby3.3-json.yaml
@@ -1,7 +1,7 @@
 # Generated from https://github.com/flori/json
 package:
   name: ruby3.3-json
-  version: 2.8.2
+  version: 2.9.0
   epoch: 0
   description: This is a JSON implementation as a Ruby extension in C.
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/flori/json
       tag: v${{package.version}}
-      expected-commit: d5e4a6e3fd10d4707a5bd0d5c1e8dcc771724ccf
+      expected-commit: 20b501a31d824449148c97385eb064f6f62ba127
 
   - runs: |
       # Upstream sometimes forgets to update the version in their version.rb file after a release.
diff --git a/ruby3.3-logger.yaml b/ruby3.3-logger.yaml
index abd48b154a1..e8b23025eb6 100644
--- a/ruby3.3-logger.yaml
+++ b/ruby3.3-logger.yaml
@@ -1,7 +1,7 @@
 # Generated from https://github.com/ruby/logger
 package:
   name: ruby3.3-logger
-  version: 1.6.1
+  version: 1.6.2
   epoch: 0
   description: Provides a simple logging utility for outputting messages.
   copyright:
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/logger
       tag: v${{package.version}}
-      expected-commit: bda937b4cc9283e33c5f19d5f0b8976541dbdba2
+      expected-commit: 2d07f086f8aa0bd5923a072ce7bd15e5dd301f16
 
   - uses: ruby/build
     with:
diff --git a/ruby3.3-logstash-core-plugin-api.yaml b/ruby3.3-logstash-core-plugin-api.yaml
index 5f32e8c6976..02f798f59ac 100644
--- a/ruby3.3-logstash-core-plugin-api.yaml
+++ b/ruby3.3-logstash-core-plugin-api.yaml
@@ -1,7 +1,7 @@
 # Generated from http://www.elastic.co/guide/en/logstash/current/index.html
 package:
   name: ruby3.3-logstash-core-plugin-api
-  version: 8.16.0
+  version: 8.16.1
   epoch: 0
   description: Logstash plugin API
   copyright:
@@ -34,7 +34,7 @@ pipeline:
     with:
       repository: https://github.com/elastic/logstash
       tag: v${{package.version}}
-      expected-commit: e4cb5c1ff7b7e5c3c38dae35ba4c01d5478a3100
+      expected-commit: a769327be81a655ed66a0539cee42380de220c27
 
   - working-directory: logstash-core-plugin-api
     pipeline:
diff --git a/ruby3.3-logstash-core.yaml b/ruby3.3-logstash-core.yaml
index 222a0f125c0..c62a370d1b8 100644
--- a/ruby3.3-logstash-core.yaml
+++ b/ruby3.3-logstash-core.yaml
@@ -1,7 +1,7 @@
 # Generated from http://www.elastic.co/guide/en/logstash/current/index.html
 package:
   name: ruby3.3-logstash-core
-  version: 8.16.0
+  version: 8.16.1
   epoch: 0
   description: The core components of logstash, the scalable log and event management tool
   copyright:
@@ -45,7 +45,7 @@ pipeline:
     with:
       repository: https://github.com/elastic/logstash
       tag: v${{package.version}}
-      expected-commit: e4cb5c1ff7b7e5c3c38dae35ba4c01d5478a3100
+      expected-commit: a769327be81a655ed66a0539cee42380de220c27
 
   - working-directory: logstash-core
     pipeline:
diff --git a/ruby3.3-mime-types-data.yaml b/ruby3.3-mime-types-data.yaml
index a1dfbe4b097..eec5ab498e7 100644
--- a/ruby3.3-mime-types-data.yaml
+++ b/ruby3.3-mime-types-data.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.3-mime-types-data
-  version: 3.2024.1105
+  version: 3.2024.1203
   epoch: 0
   description: MIME Type registry data
   copyright:
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/mime-types/mime-types-data.git
       tag: v${{package.version}}
-      expected-commit: 06c34687e700b93869f4b9ad27b954cd9fddc28f
+      expected-commit: 4a5993ec84c3f860c37f2e9c297dd378e4e76c2a
 
   - uses: ruby/build
     with:
diff --git a/ruby3.3-net-http.yaml b/ruby3.3-net-http.yaml
index 8f255175ff2..962f3aef64e 100644
--- a/ruby3.3-net-http.yaml
+++ b/ruby3.3-net-http.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.3-net-http
-  version: 0.5.0
+  version: 0.6.0
   epoch: 0
   description: "A rich library which can be used to build HTTP user-agents for Ruby"
   copyright:
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/net-http
       tag: v${{package.version}}
-      expected-commit: 28a4bf9295f65eeea693419c2640ddf22c116732
+      expected-commit: 6475fa68ba8483d4651b7a8e4d33f0aea2cf27db
 
   - uses: ruby/build
     with:
diff --git a/ruby3.3-protocol-http.yaml b/ruby3.3-protocol-http.yaml
index bb5bcd044ba..b29da6741c3 100644
--- a/ruby3.3-protocol-http.yaml
+++ b/ruby3.3-protocol-http.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.3-protocol-http
-  version: 0.44.0
+  version: 0.47.0
   epoch: 0
   description: Provides abstractions to handle HTTP protocols.
   copyright:
@@ -25,7 +25,7 @@ vars:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: bdabfd7e25a4949406d8c420f67427005518091c
+      expected-commit: 9c8431041ee28d782e5d3ee70685bfcd15a38191
       repository: https://github.com/socketry/protocol-http
       tag: v${{package.version}}
 
diff --git a/ruby3.3-protocol-http2.yaml b/ruby3.3-protocol-http2.yaml
index 9a38be1fdaf..2d20d1ccf32 100644
--- a/ruby3.3-protocol-http2.yaml
+++ b/ruby3.3-protocol-http2.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.3-protocol-http2
-  version: 0.20.0
+  version: 0.21.0
   epoch: 0
   description: A low level implementation of the HTTP/2 protocol.
   copyright:
@@ -27,7 +27,7 @@ vars:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 76a6cda55ac572af57ae7d87e12dc297930c9d42
+      expected-commit: 04362a916b5d6bd65c2a8982f2ed0583f1e02328
       repository: https://github.com/socketry/protocol-http2
       tag: v${{package.version}}
 
diff --git a/ruby3.3-psych.yaml b/ruby3.3-psych.yaml
index d6455cf2039..dd9f728dee8 100644
--- a/ruby3.3-psych.yaml
+++ b/ruby3.3-psych.yaml
@@ -1,7 +1,7 @@
 # Generated from https://github.com/ruby/psych
 package:
   name: ruby3.3-psych
-  version: 5.2.0
+  version: 5.2.1
   epoch: 0
   description: Psych is a YAML parser and emitter.
   copyright:
@@ -27,7 +27,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/psych.git
       tag: v${{package.version}}
-      expected-commit: 6ea07fdadd8245ed01d26122baacb56ff01662b8
+      expected-commit: 7c81f7db53cf2dbed9cf7a441867af62453c0011
 
   - uses: ruby/build
     with:
diff --git a/ruby3.3-reline.yaml b/ruby3.3-reline.yaml
index 2fa1283df54..1ee3e57e188 100644
--- a/ruby3.3-reline.yaml
+++ b/ruby3.3-reline.yaml
@@ -1,7 +1,7 @@
 # Generated from https://github.com/ruby/reline
 package:
   name: ruby3.3-reline
-  version: 0.5.11
+  version: 0.5.12
   epoch: 0
   description: Alternative GNU Readline or Editline implementation by pure Ruby.
   copyright:
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/reline.git
       tag: v${{package.version}}
-      expected-commit: 4d90743409fbfbe79ea5b70c862a03d66e202e52
+      expected-commit: d4f6741e7eb942b5bf71b9c318492a4a79625c74
 
   - uses: ruby/build
     with:
diff --git a/ruby3.3-securerandom.yaml b/ruby3.3-securerandom.yaml
index d3563a2bf70..0a0d73d6e7c 100644
--- a/ruby3.3-securerandom.yaml
+++ b/ruby3.3-securerandom.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruby3.3-securerandom
-  version: 0.3.2
+  version: 0.4.0
   epoch: 0
   description: Interface for secure random number generator.
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/ruby/securerandom
       tag: v${{package.version}}
-      expected-commit: 9703d96a76ee72a278558a474d69cc0eb0bc0d6e
+      expected-commit: 53f97f31518a4aca129d5cff6b23ae8a2c7d2348
 
   - uses: ruby/build
     with:
diff --git a/ruff.yaml b/ruff.yaml
index bba5e215e3d..b31585391ac 100644
--- a/ruff.yaml
+++ b/ruff.yaml
@@ -1,6 +1,6 @@
 package:
   name: ruff
-  version: 0.8.0
+  version: 0.8.1
   epoch: 0
   description: An extremely fast Python linter, written in Rust.
   copyright:
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/astral-sh/ruff
       tag: ${{package.version}}
-      expected-commit: a90e404c3f010446ab8c18b4793c78834eeb65b7
+      expected-commit: b3b2c982cdfb487bec7c38ca4e04cebbe0f1964e
 
   - runs: |
       cargo auditable build --release
diff --git a/rust-audit-info.yaml b/rust-audit-info.yaml
new file mode 100644
index 00000000000..9377242e51b
--- /dev/null
+++ b/rust-audit-info.yaml
@@ -0,0 +1,45 @@
+package:
+  name: rust-audit-info
+  version: 0.5.4
+  epoch: 0
+  description: Read audit information from rust binaries
+  copyright:
+    - license: MIT OR Apache-2.0
+
+environment:
+  contents:
+    packages:
+      - build-base
+      - busybox
+      - cargo-auditable
+      - openssf-compiler-options
+      - rust
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/rust-secure-code/cargo-auditable
+      tag: rust-audit-info/v${{package.version}}
+      expected-commit: a0ed9cb5b98a0c927fa8d78aed04065144b136e7
+
+  - name: Configure and build
+    runs: |
+      cd rust-audit-info/
+      cargo auditable build --release
+      mkdir -p ${{targets.destdir}}/usr/bin/
+      mv target/release/rust-audit-info ${{targets.destdir}}/usr/bin/
+
+  - uses: strip
+
+test:
+  pipeline:
+    - runs: |
+        rust-audit-info /usr/bin/rust-audit-info
+
+update:
+  enabled: true
+  github:
+    identifier: rust-secure-code/cargo-auditable
+    use-tag: true
+    tag-filter: rust-audit-info/v
+    strip-prefix: rust-audit-info/v
diff --git a/rustls-ffi.yaml b/rustls-ffi.yaml
index eafe84adca1..b409373a200 100644
--- a/rustls-ffi.yaml
+++ b/rustls-ffi.yaml
@@ -1,7 +1,7 @@
 package:
   name: rustls-ffi
   version: 0.14.1
-  epoch: 0
+  epoch: 1
   description: "C-to-rustls bindings"
   copyright:
     - license: MIT
@@ -13,6 +13,7 @@ environment:
       - build-base
       - busybox
       - ca-certificates-bundle
+      - cargo-auditable
       - cargo-c
       - openssf-compiler-options
       - rust
@@ -26,8 +27,8 @@ pipeline:
       expected-commit: 2014e6154074ba66c0023a683b27fdae93fbeabb
 
   - runs: |
-      cargo capi build --release
-      cargo capi install --prefix=/usr --destdir "${{targets.contextdir}}"
+      cargo auditable capi build --release
+      cargo auditable capi install --prefix=/usr --destdir "${{targets.contextdir}}"
 
   - uses: strip
 
@@ -40,6 +41,15 @@ subpackages:
       runtime:
         - ${{package.name}}
 
+test:
+  environment:
+    contents:
+      packages:
+        - rust-audit-info
+  pipeline:
+    - runs: |
+        rust-audit-info /usr/lib/librustls.so.0.*
+
 update:
   enabled: true
   github:
diff --git a/sbt.yaml b/sbt.yaml
index 9364b2bcdb8..bf7073de57a 100644
--- a/sbt.yaml
+++ b/sbt.yaml
@@ -1,6 +1,6 @@
 package:
   name: sbt
-  version: 1.10.5
+  version: 1.10.6
   epoch: 0
   description: A scala build tool
   copyright:
@@ -28,7 +28,7 @@ pipeline:
     with:
       repository: https://github.com/sbt/sbt
       tag: v${{package.version}}
-      expected-commit: 82d834a676f5f50fa49059cb352c2e31f0f0dcd9
+      expected-commit: 1b7d451d2a5bd06c4feacc98b868d8c8bd336a0e
 
   - runs: |
       cd launcher-package
diff --git a/scudo-malloc.yaml b/scudo-malloc.yaml
index 1f63c31e752..bf9766aca7e 100644
--- a/scudo-malloc.yaml
+++ b/scudo-malloc.yaml
@@ -1,6 +1,6 @@
 package:
   name: scudo-malloc
-  version: 19.1.4
+  version: 19.1.5
   epoch: 0
   description: "scudo-malloc aims at providing additional mitigation against heap based vulnerabilities, while maintaining good performance"
   copyright:
@@ -29,7 +29,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://github.com/llvm/llvm-project/releases/download/llvmorg-${{package.version}}/compiler-rt-${{package.version}}.src.tar.xz
-      expected-sha256: 433f9f513313b6e34626fab516e92a97ea087484fce40218e928b9538910cd27
+      expected-sha256: 2ab7fc54e814b4da16a60c640971b8a80d32d4692a0326861af499fea20f13f8
 
   - runs: |
       unset cflags_crc32
diff --git a/selenium.yaml b/selenium.yaml
index ec66ba940c7..a150e2eeac3 100644
--- a/selenium.yaml
+++ b/selenium.yaml
@@ -1,7 +1,7 @@
 package:
   name: selenium
-  version: 4.26.0
-  epoch: 1
+  version: 4.27.0
+  epoch: 0
   description: A browser automation framework and ecosystem.
   copyright:
     - license: Apache-2.0
@@ -40,7 +40,7 @@ pipeline:
     with:
       repository: https://github.com/SeleniumHQ/selenium
       tag: selenium-${{package.version}}
-      expected-commit: 69f9e5eae1cfcabd794327bef2f81102f213fae6
+      expected-commit: d6e718d134987d62cd8ffff476821fb3ca1797c2
 
   - uses: patch
     with:
diff --git a/sftpgo.yaml b/sftpgo.yaml
index daca6ae73e9..2fe7540e06e 100644
--- a/sftpgo.yaml
+++ b/sftpgo.yaml
@@ -1,6 +1,6 @@
 package:
   name: sftpgo
-  version: 2.6.3
+  version: 2.6.4
   epoch: 0
   description: "Full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob"
   copyright:
@@ -11,7 +11,7 @@ pipeline:
     with:
       repository: https://github.com/drakkan/sftpgo
       tag: v${{package.version}}
-      expected-commit: cf3e1d3ec0c3061a6ad629f0d6d5a48a2456b7c3
+      expected-commit: 386448e6cbe47de3fad572fb3776aeda4b35d6ed
 
   - runs: |
       # Modify the default configuration file
diff --git a/snyk-cli.yaml b/snyk-cli.yaml
index b4550ad6485..1a6f3e7637a 100644
--- a/snyk-cli.yaml
+++ b/snyk-cli.yaml
@@ -1,6 +1,6 @@
 package:
   name: snyk-cli
-  version: 1.1294.1
+  version: 1.1294.2
   epoch: 0
   description: Snyk CLI scans and monitors your projects for security vulnerabilities
   copyright:
@@ -31,7 +31,7 @@ pipeline:
     with:
       repository: https://github.com/snyk/cli
       tag: v${{package.version}}
-      expected-commit: cd36cab09c7fd9683d2bbd550442f6e7779b8e20
+      expected-commit: 486c3ffcaf833a2ecf3cce41858df9032e1cb212
 
   - uses: go/bump
     with:
diff --git a/spark-3.5.yaml b/spark-3.5.yaml
index 84f28d00251..c8a90c1ec03 100644
--- a/spark-3.5.yaml
+++ b/spark-3.5.yaml
@@ -1,7 +1,7 @@
 package:
   name: spark-3.5
   version: 3.5.3
-  epoch: 4
+  epoch: 5
   description: Unified engine for large-scale data analytics
   copyright:
     - license: Apache-2.0
@@ -198,6 +198,9 @@ subpackages:
 
   - name: ${{package.name}}-bitnami-compat
     description: Bitnami compat for spark 3.5
+    dependencies:
+      runtime:
+        - coreutils # needed for cp -nr command
     pipeline:
       - uses: bitnami/compat
         with:
diff --git a/spiffe-helper.yaml b/spiffe-helper.yaml
new file mode 100644
index 00000000000..d60550e443a
--- /dev/null
+++ b/spiffe-helper.yaml
@@ -0,0 +1,42 @@
+package:
+  name: spiffe-helper
+  version: 0.9.0
+  epoch: 0
+  description: A helper utility for SPIFFE (Secure Production Identity Framework For Everyone) operations.
+  copyright:
+    - license: Apache-2.0
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/spiffe/spiffe-helper.git
+      expected-commit: 71c089743733add8c6d36a3a15c12f1b16b9b21a
+      tag: v${{package.version}}
+
+  - uses: go/build
+    with:
+      packages: "./cmd/spiffe-helper"
+      output: spiffe-helper
+
+subpackages:
+  - name: ${{package.name}}-compat
+    description: Compatibility package for spiffe-helper
+    pipeline:
+      - runs: |
+          mkdir -p ${{targets.subpkgdir}}/
+          ln -sf /usr/bin/spiffe-helper "${{targets.subpkgdir}}"/spiffe-helper
+    test:
+      pipeline:
+        - name: stat on symlink
+          runs: stat /spiffe-helper
+
+update:
+  enabled: true
+  github:
+    identifier: spiffe/spiffe-helper
+    strip-prefix: v
+
+test:
+  pipeline:
+    - runs: |
+        spiffe-helper --help
diff --git a/splunk-otel-collector.yaml b/splunk-otel-collector.yaml
new file mode 100644
index 00000000000..0ff7fc3fc25
--- /dev/null
+++ b/splunk-otel-collector.yaml
@@ -0,0 +1,77 @@
+package:
+  name: splunk-otel-collector
+  version: 0.113.0
+  epoch: 2
+  description: Splunk OpenTelemetry Collector is a distribution of the OpenTelemetry Collector. It provides a unified way to receive, process, and export metric, trace, and log data for Splunk Observability Cloud
+  copyright:
+    - license: Apache-2.0
+  dependencies:
+    runtime:
+      - systemd
+
+environment:
+  contents:
+    packages:
+      - go
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/signalfx/splunk-otel-collector
+      tag: v${{package.version}}
+      expected-commit: afd65d06be2164c95fb50a9d6ab2f42af9e86383
+
+  - runs: go generate ./...
+
+  - uses: go/build
+    with:
+      modroot: cmd/otelcol
+      packages: .
+      ldflags: -X github.com/signalfx/splunk-otel-collector/internal/version.Version=v${{package.version}} -X go.opentelemetry.io/collector/internal/version.Version=${{package.version}}
+      output: otelcol
+
+  - name: copy config files
+    runs: |
+      mkdir -p ${{targets.contextdir}}/etc/otel/collector
+      cp cmd/otelcol/config/collector/gateway_config.yaml ${{targets.contextdir}}/etc/otel/collector/gateway_config.yaml
+      cp cmd/otelcol/config/collector/otlp_config_linux.yaml ${{targets.contextdir}}/etc/otel/collector/otlp_config_linux.yaml
+      cp cmd/otelcol/config/collector/agent_config.yaml ${{targets.contextdir}}/etc/otel/collector/agent_config.yaml
+      cp cmd/otelcol/config/collector/fargate_config.yaml ${{targets.contextdir}}/etc/otel/collector/fargate_config.yaml
+      cp cmd/otelcol/config/collector/ecs_ec2_config.yaml ${{targets.contextdir}}/etc/otel/collector/ecs_ec2_config.yaml
+
+subpackages:
+  - name: ${{package.name}}-compat
+    description: Symlink for the otel binary in the root folder
+    pipeline:
+      - runs: |
+          ln -sf /usr/bin/otelcol ${{targets.contextdir}}/
+
+  - name: ${{package.name}}-doc
+    description: Documentation for Splunk OTel Collector
+    pipeline:
+      - name: install-docs
+        runs: mkdir -p ${{targets.contextdir}}/usr/share mv docs "${{targets.contextdir}}/usr/share"
+
+  - name: ${{package.name}}-migratecheckpoint
+    description: migrate checkpoint package
+    pipeline:
+      - uses: go/build
+        with:
+          modroot: cmd/migratecheckpoint
+          packages: .
+          ldflags: -X github.com/signalfx/splunk-otel-collector/internal/version.Version=v${{package.version}} -X go.opentelemetry.io/collector/internal/version.Version=${{package.version}}
+          output: migratecheckpoint
+    test:
+      pipeline:
+        - runs: migratecheckpoint --help
+
+update:
+  enabled: true
+  github:
+    identifier: signalfx/splunk-otel-collector
+    strip-prefix: v
+
+test:
+  pipeline:
+    - runs: otelcol --help
+    - runs: otelcol --version | grep ${{package.version}}
diff --git a/sql_exporter.yaml b/sql_exporter.yaml
new file mode 100644
index 00000000000..66775006f7d
--- /dev/null
+++ b/sql_exporter.yaml
@@ -0,0 +1,44 @@
+package:
+  name: sql_exporter
+  version: 0.16.0
+  epoch: 0
+  description: Database-agnostic SQL Exporter for Prometheus
+  copyright:
+    - license: Apache-2.0
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/burningalchemist/sql_exporter
+      tag: ${{package.version}}
+      expected-commit: a1726ff66775980c1de3ad44bfffb169525b2dd1
+
+  - uses: go/build
+    with:
+      packages: ./cmd/sql_exporter
+      ldflags: |
+        -X github.com/prometheus/common/version.Version=${{package.version}}
+        -X github.com/prometheus/common/version.Revision=$(git rev-parse HEAD)
+        -X github.com/prometheus/common/version.Branch=$(git rev-parse --abbrev-ref HEAD)
+        -X github.com/prometheus/common/version.BuildUser=$(whoami)@$HOSTNAME
+        -X github.com/prometheus/common/version.BuildDate=$(date -u -d "@${SOURCE_DATE_EPOCH:-$(date +%s)}" "+%Y-%m-%dT%H:%M:%SZ")
+      output: sql_exporter
+
+subpackages:
+  - name: ${{package.name}}-compat
+    description: "upstream image have executable placed at /bin"
+    pipeline:
+      - runs: |
+          mkdir -p "${{targets.contextdir}}"/bin
+          ln -sf /usr/bin/sql_exporter "${{targets.contextdir}}"/bin/sql_exporter
+
+update:
+  enabled: true
+  github:
+    identifier: burningalchemist/sql_exporter
+
+test:
+  pipeline:
+    - name: Version Check
+      runs: |
+        /usr/bin/sql_exporter --version | grep "version ${{package.version}}"
diff --git a/sqlpad.yaml b/sqlpad.yaml
index 46e6003c1b7..c25b3af4fcb 100644
--- a/sqlpad.yaml
+++ b/sqlpad.yaml
@@ -1,7 +1,7 @@
 package:
   name: sqlpad
   version: 7.5.1 # when updating check the patch below as it contains dependency version updates which may downgrade if upstream upgrades them
-  epoch: 0
+  epoch: 1
   description: Web-based SQL editor. Legacy project in maintenance mode.
   copyright:
     - license: MIT
@@ -27,6 +27,10 @@ pipeline:
       expected-commit: fe788bf1cd50072148e5a7e9db729bd62ee97dc2
       tag: v${{package.version}}
 
+  - uses: patch
+    with:
+      patches: GHSA-3xgq-45jj-v275-fix-cross-spawn.patch
+
   - working-directory: /home/build/server
     runs: |
       # Create "resolutions" section of package.json
diff --git a/sqlpad/GHSA-3xgq-45jj-v275-fix-cross-spawn.patch b/sqlpad/GHSA-3xgq-45jj-v275-fix-cross-spawn.patch
new file mode 100644
index 00000000000..b2c66c7132c
--- /dev/null
+++ b/sqlpad/GHSA-3xgq-45jj-v275-fix-cross-spawn.patch
@@ -0,0 +1,51 @@
+diff --git a/client/yarn.lock b/client/yarn.lock
+index 5ac7fb27d..1b73bdcc4 100644
+--- a/client/yarn.lock
++++ b/client/yarn.lock
+@@ -910,9 +910,9 @@ convert-source-map@^2.0.0:
+   integrity sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==
+ 
+ cross-spawn@^7.0.2:
+-  version "7.0.3"
+-  resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.3.tgz#f73a85b9d5d41d045551c177e2882d4ac85728a6"
+-  integrity sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==
++  version "7.0.6"
++  resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.6.tgz#8a58fe78f00dcd70c370451759dfbfaf03e8ee9f"
++  integrity sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==
+   dependencies:
+     path-key "^3.1.0"
+     shebang-command "^2.0.0"
+diff --git a/server/yarn.lock b/server/yarn.lock
+index 2f8350496..2189dacf1 100644
+--- a/server/yarn.lock
++++ b/server/yarn.lock
+@@ -1345,9 +1345,9 @@ core-util-is@~1.0.0:
+   integrity sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==
+ 
+ cross-spawn@^7.0.0, cross-spawn@^7.0.2:
+-  version "7.0.3"
+-  resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.3.tgz#f73a85b9d5d41d045551c177e2882d4ac85728a6"
+-  integrity sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==
++  version "7.0.6"
++  resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.6.tgz#8a58fe78f00dcd70c370451759dfbfaf03e8ee9f"
++  integrity sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==
+   dependencies:
+     path-key "^3.1.0"
+     shebang-command "^2.0.0"
+diff --git a/yarn.lock b/yarn.lock
+index 84ea979f1..7c4ac1e55 100644
+--- a/yarn.lock
++++ b/yarn.lock
+@@ -57,9 +57,9 @@ commander@~12.1.0:
+   integrity sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==
+ 
+ cross-spawn@^7.0.3:
+-  version "7.0.3"
+-  resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.3.tgz#f73a85b9d5d41d045551c177e2882d4ac85728a6"
+-  integrity sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==
++  version "7.0.6"
++  resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.6.tgz#8a58fe78f00dcd70c370451759dfbfaf03e8ee9f"
++  integrity sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==
+   dependencies:
+     path-key "^3.1.0"
+     shebang-command "^2.0.0"
diff --git a/stress-ng.yaml b/stress-ng.yaml
index f55fe9b1876..d218068695f 100644
--- a/stress-ng.yaml
+++ b/stress-ng.yaml
@@ -1,6 +1,6 @@
 package:
   name: stress-ng
-  version: 0.18.06
+  version: 0.18.07
   epoch: 0
   description: "stress-ng will stress test a computer system in various selectable ways"
   copyright:
@@ -31,7 +31,7 @@ pipeline:
     with:
       repository: https://github.com/ColinIanKing/stress-ng
       tag: V${{package.version}}
-      expected-commit: 8357df5586a8f8f435ef532c53b770d9c2802c3d
+      expected-commit: 27f1171ff0718e67eac0730df34cbfd97aca587b
 
   - uses: autoconf/make
     with:
diff --git a/subversion.yaml b/subversion.yaml
index 5855e8c7b4c..a912f00c0f8 100644
--- a/subversion.yaml
+++ b/subversion.yaml
@@ -1,7 +1,7 @@
 package:
   name: subversion
   version: 1.14.4
-  epoch: 2
+  epoch: 3
   description: Replacement for CVS, another versioning system (svn)
   copyright:
     - license: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND HPND-Markus-Kuhn AND MIT AND Unicode-DFS-2015 AND FSFAP
@@ -49,6 +49,9 @@ subpackages:
       runtime:
         - subversion-libs
     description: subversion development files
+    test:
+      pipeline:
+        - uses: test/pkgconf
 
   - name: subversion-doc
     pipeline:
diff --git a/supervisor.yaml b/supervisor.yaml
index e71bf6b52c5..1d64edf6358 100644
--- a/supervisor.yaml
+++ b/supervisor.yaml
@@ -66,6 +66,7 @@ pipeline:
         notifempty
         nocompress
       }
+      EOF
 
       chmod 600 ${{targets.destdir}}/etc/supervisord.conf
       chmod 644 ${{targets.destdir}}/etc/logrotate.d/supervisord
diff --git a/svt-av1.yaml b/svt-av1.yaml
index bafcdc9e101..e8afdb7c697 100644
--- a/svt-av1.yaml
+++ b/svt-av1.yaml
@@ -1,6 +1,6 @@
 package:
   name: svt-av1
-  version: 2.2.1
+  version: 2.3.0
   epoch: 0
   description: "Scalable Video Technology for AV1 (SVT-AV1 Encoder)"
   copyright:
@@ -11,21 +11,28 @@ environment:
     packages:
       - build-base
       - busybox
+      - clang
       - cmake
       - nasm
       - openssf-compiler-options
       - samurai
+      - yasm
 
 pipeline:
   - uses: git-checkout
     with:
       repository: https://gitlab.com/AOMediaCodec/SVT-AV1.git
-      expected-commit: 55a01def732bb9e7016d23cc512384f7a88d6e86
+      expected-commit: 6e69def4ec283fe0b71195671245c3b768bebdef
       tag: v${{package.version}}
 
+  - runs: ln -s /usr/lib/llvm-19/lib/LLVMgold.so /usr/lib/LLVMgold.so
+
   - uses: cmake/configure
     with:
-      opts: -DSVT_AV1_LTO=ON
+      opts: |
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_C_COMPILER=clang \
+        -DCMAKE_CXX_COMPILER=clang++ \
 
   - uses: cmake/build
 
diff --git a/tealdeer.yaml b/tealdeer.yaml
index 76e440da81f..d474104d4b4 100644
--- a/tealdeer.yaml
+++ b/tealdeer.yaml
@@ -1,7 +1,7 @@
 package:
   name: tealdeer
   version: 1.7.1
-  epoch: 0
+  epoch: 1
   description: A very fast implementation of tldr in Rust.
   copyright:
     - license: Apache-2.0
@@ -17,6 +17,8 @@ pipeline:
       tag: v${{package.version}}
       expected-commit: 1d9153e37e131ca56071213ba40ec01b16158ebf
 
+  - uses: rust/cargobump
+
   - name: Configure and Build
     uses: cargo/build
     with:
diff --git a/tealdeer/cargobump-deps.yaml b/tealdeer/cargobump-deps.yaml
new file mode 100644
index 00000000000..4d353f7d988
--- /dev/null
+++ b/tealdeer/cargobump-deps.yaml
@@ -0,0 +1,3 @@
+packages:
+    - name: rustls
+      version: 0.23.18
diff --git a/tekton-pipelines.yaml b/tekton-pipelines.yaml
index e72050340d9..b1af9997ced 100644
--- a/tekton-pipelines.yaml
+++ b/tekton-pipelines.yaml
@@ -1,6 +1,6 @@
 package:
   name: tekton-pipelines
-  version: 0.65.2
+  version: 0.65.3
   epoch: 0
   description: A cloud-native Pipeline resource.
   copyright:
@@ -15,7 +15,7 @@ pipeline:
     with:
       repository: https://github.com/tektoncd/pipeline
       tag: v${{package.version}}
-      expected-commit: 7b76131b656adca53b12c6bf0f07b7ee97a656df
+      expected-commit: 4e8eec7e90ecd638f0ffb24a8c05cc345e93f5af
       destination: tekton
 
   - uses: go/bump
diff --git a/teleport.yaml b/teleport.yaml
index eedc9282074..611daf3986a 100644
--- a/teleport.yaml
+++ b/teleport.yaml
@@ -1,6 +1,6 @@
 package:
   name: teleport
-  version: 17.0.1
+  version: 17.0.3
   epoch: 0
   description: The easiest, and most secure way to access and protect all of your infrastructure.
   copyright:
@@ -18,6 +18,7 @@ environment:
       - build-base
       - busybox
       - ca-certificates-bundle
+      - cargo-auditable
       - corepack
       - go
       - node-gyp
@@ -26,6 +27,7 @@ environment:
       - openssl-dev
       - pnpm
       - python3
+      - rust
       - rustup
       - wasm-pack
       - yarn
@@ -35,7 +37,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/gravitational/teleport
-      expected-commit: dc5837102a82fdfc4807a8c760839f4ca4be08a9
+      expected-commit: 1bcff22e55a87bed13cd0d88d33ed39f69222b9d
       tag: v${{package.version}}
 
   - uses: go/bump
@@ -43,24 +45,38 @@ pipeline:
       deps: github.com/golang-jwt/jwt/v4@v4.5.1
 
   - runs: |
-      # https://github.com/gravitational/teleport#building-teleport
       mkdir -p "${{targets.contextdir}}"/var/lib/teleport
       mkdir -p "${{targets.contextdir}}"/usr/local/bin
 
-      # This build requires the stable version of rust, managed by rustup, because it requires a few other toolchains too.
       rustup install stable
+      rustup default stable
+      ARCH=$(uname -m)
+      export PATH="$HOME/.rustup/toolchains/stable-${ARCH}-unknown-linux-gnu/bin:$PATH"
       rustup target add wasm32-unknown-unknown
 
-      # This is a bit of a hack, but it's the easiest way to get the right version of rustc and cargo in the path.
-      export PATH="$HOME/.rustup/toolchains/stable-${{host.triplet.rust}}/bin:$PATH"
-      make full
+      pnpm config set package-import-method copy
 
-      # create me a for loop that iterates over the binaries in build/
-      # and installs them to "${{targets.contextdir}}"/usr/local/bin
-      for bin in build/*; do
-        echo "Installing $bin to /usr/local/bin"
-        install -Dm755 $bin -t "${{targets.contextdir}}"/usr/local/bin
-      done
+      # Install dependencies and build web assets
+      make ensure-js-deps
+      make ensure-webassets
+
+  - uses: go/build
+    with:
+      packages: ./tool/teleport
+      prefix: usr/local
+      output: ./
+      tags: webassets_embed,kustomize_disable_go_plugin_support
+
+  - uses: go/build
+    with:
+      packages: ./tool/tctl ./tool/tsh ./tool/tbot ./tool/teleport-update
+      prefix: usr/local
+      output: ./
+      tags: kustomize_disable_go_plugin_support
+
+  - runs: |
+      cd tool/fdpass-teleport && cargo auditable build --release --locked
+      install -Dm755 target/release/fdpass-teleport "${{targets.contextdir}}"/usr/local/bin/
 
   - uses: strip
 
@@ -75,18 +91,10 @@ test:
     contents:
       packages:
         - wait-for-it
+        - curl
   pipeline:
-    - runs: |
-        teleport configure -o file
-        teleport start -c /etc/teleport.yaml &
-
-        # wait for teleport to start :3080
-        wait-for-it localhost:3080 -t 10
-
-        echo "Teleport is running on port 3080!"
-
-        # create a user
-        tctl get roles --format=text
+    - name: Check binary versions
+      runs: |
         tbot version
         tbot --help
         tctl version
@@ -95,3 +103,121 @@ test:
         teleport --help
         tsh version
         tsh --help
+    - name: Test auth service and tctl
+      runs: |
+        #!/bin/bash
+        set -e
+
+        # Create required directories
+        mkdir -p /tmp/teleport
+        mkdir -p /var/lib/teleport
+
+        # Create minimal config file for auth server
+        cat <<-EOF > /tmp/teleport-auth.yaml
+        version: v3
+        teleport:
+          data_dir: /tmp/teleport
+          log:
+            output: stderr
+            severity: DEBUG
+        auth_service:
+          enabled: "yes"
+          cluster_name: "test-cluster"
+          listen_addr: 127.0.0.1:3025
+          tokens:
+            - "proxy,node:test123"
+        proxy_service:
+          enabled: "no"
+        ssh_service:
+          enabled: "no"
+        EOF
+
+        # Initialize auth server with static UUID for tctl
+        echo "00000000-0000-0000-0000-000000000000" > /var/lib/teleport/host_uuid
+        chmod 644 /var/lib/teleport/host_uuid
+
+        # Start auth server
+        teleport start --config=/tmp/teleport-auth.yaml --roles=auth &
+        AUTH_PID=$!
+
+        # Wait for auth server
+        wait-for-it 127.0.0.1:3025 -t 30 || (kill $AUTH_PID; exit 1)
+
+        # Give auth server time to initialize
+        sleep 5
+
+        # Test tctl
+        TCTL_CONFIG=$(base64 /tmp/teleport-auth.yaml)
+        TELEPORT_CONFIG="$TCTL_CONFIG" tctl get roles --format=text
+
+        echo "Auth service test successful!"
+        kill $AUTH_PID
+    - name: Test proxy service
+      runs: |
+        #!/bin/bash
+        set -e
+
+        # Create required directories
+        mkdir -p /tmp/teleport-auth /tmp/teleport-proxy
+
+        # Create auth server config
+        cat <<-EOF > /tmp/teleport-auth.yaml
+        version: v3
+        teleport:
+          data_dir: /tmp/teleport-auth
+          log:
+            output: stderr
+            severity: DEBUG
+        auth_service:
+          enabled: "yes"
+          cluster_name: "test-cluster"
+          listen_addr: 127.0.0.1:3025
+          tokens:
+            - "proxy,node:test123"
+        proxy_service:
+          enabled: "no"
+        ssh_service:
+          enabled: "no"
+        EOF
+
+        # Create proxy config
+        cat <<-EOF > /tmp/teleport-proxy.yaml
+        version: v3
+        teleport:
+          data_dir: /tmp/teleport-proxy
+          auth_token: "test123"
+          auth_server: "127.0.0.1:3025"
+        proxy_service:
+          enabled: "yes"
+          web_listen_addr: "127.0.0.1:3080"
+          listen_addr: "127.0.0.1:3023"
+        auth_service:
+          enabled: "no"
+        ssh_service:
+          enabled: "no"
+        EOF
+
+        # Start auth server
+        teleport start --config=/tmp/teleport-auth.yaml --roles=auth &
+        AUTH_PID=$!
+
+        # Wait for auth server
+        wait-for-it 127.0.0.1:3025 -t 30 || (kill $AUTH_PID; exit 1)
+
+        # Start proxy
+        teleport start --config=/tmp/teleport-proxy.yaml --roles=proxy &
+        PROXY_PID=$!
+
+        # Wait for proxy
+        wait-for-it 127.0.0.1:3080 -t 30 || (kill $AUTH_PID $PROXY_PID; exit 1)
+
+        # Test proxy web interface with HTTPS
+        HTTP_CODE=$(curl -k -s -o /dev/null -w "%{http_code}" https://127.0.0.1:3080/webapi/ping)
+        if [ "$HTTP_CODE" != "200" ]; then
+          echo "Proxy web interface test failed with HTTP code: $HTTP_CODE"
+          kill $AUTH_PID $PROXY_PID
+          exit 1
+        fi
+
+        echo "Proxy test successful!"
+        kill $AUTH_PID $PROXY_PID
diff --git a/temporal.yaml b/temporal.yaml
index e12322711d9..9cc0a63a61d 100644
--- a/temporal.yaml
+++ b/temporal.yaml
@@ -1,7 +1,7 @@
 package:
   name: temporal
-  version: 1.1.1
-  epoch: 1
+  version: 1.1.2
+  epoch: 0
   description: Command-line interface for running Temporal Server and interacting with Workflows, Activities, Namespaces, and other parts of Temporal
   copyright:
     - license: MIT
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/temporalio/cli
       tag: v${{package.version}}
-      expected-commit: 8a133d95ace58c936d9ec52633b6b6835a6f6ed8
+      expected-commit: 804e291ac80a3abdde97dbb67c15fb7a49f5479b
 
   - uses: go/bump
     with:
diff --git a/terraform-provider-aws.yaml b/terraform-provider-aws.yaml
index a592619f7b6..d0cea0ade67 100644
--- a/terraform-provider-aws.yaml
+++ b/terraform-provider-aws.yaml
@@ -1,6 +1,6 @@
 package:
   name: terraform-provider-aws
-  version: 5.77.0
+  version: 5.79.0
   epoch: 0
   description: Terraform AWS provider
   copyright:
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/hashicorp/terraform-provider-aws
       tag: v${{package.version}}
-      expected-commit: 6ea8ba35a5ce809541a45b3f99076f9537c37baa
+      expected-commit: 8dad2d3a602c8fc103a7eacb1fc9f4d3a9ac3994
 
   - uses: go/build
     with:
diff --git a/terraform-provider-azurerm.yaml b/terraform-provider-azurerm.yaml
index 7335e34891d..7cd75bc2031 100644
--- a/terraform-provider-azurerm.yaml
+++ b/terraform-provider-azurerm.yaml
@@ -1,6 +1,6 @@
 package:
   name: terraform-provider-azurerm
-  version: 4.11.0
+  version: 4.12.0
   epoch: 0
   description: Terraform provider for Azure Resource Manager
   copyright:
@@ -14,7 +14,7 @@ package:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 391b16585e8d190054563615f7e96a01e03bb18e
+      expected-commit: 764d84dcbb987458e3a3c0f36dcb48d3d8936af9
       repository: https://github.com/hashicorp/terraform-provider-azurerm
       tag: v${{package.version}}
 
diff --git a/terragrunt.yaml b/terragrunt.yaml
index aa51594ff07..f9253ec1842 100644
--- a/terragrunt.yaml
+++ b/terragrunt.yaml
@@ -1,6 +1,6 @@
 package:
   name: terragrunt
-  version: 0.69.1
+  version: 0.69.7
   epoch: 0
   description: Thin wrapper for Terraform providing extra tools
   copyright:
@@ -21,7 +21,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: f3210dd7b2e5f3de19d8af8a1abe08a8c1f26b01
+      expected-commit: cfe02c5737f7dba486d48efec27c4f58fd6b90de
       repository: https://github.com/gruntwork-io/terragrunt
       tag: v${{package.version}}
 
diff --git a/thanos.yaml b/thanos.yaml
index 6bcabc0209c..03facd41b41 100644
--- a/thanos.yaml
+++ b/thanos.yaml
@@ -1,7 +1,7 @@
 package:
   name: thanos
-  version: 0.36.1
-  epoch: 1
+  version: 0.37.1
+  epoch: 0
   description: Highly available Prometheus setup with long term storage capabilities.
   copyright:
     - license: Apache-2.0
@@ -18,14 +18,10 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 99a5742a15f107d4607d280c825eca5b7f09a253
+      expected-commit: e0812e2f46f81af3324686d910d885d8f2751d46
       repository: https://github.com/thanos-io/thanos
       tag: v${{package.version}}
 
-  - uses: go/bump
-    with:
-      deps: github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.6.0
-
   - runs: |
       make build
 
diff --git a/tigerbeetle.yaml b/tigerbeetle.yaml
index ecf90174493..cff6be3c297 100644
--- a/tigerbeetle.yaml
+++ b/tigerbeetle.yaml
@@ -1,6 +1,6 @@
 package:
   name: tigerbeetle
-  version: 0.16.13
+  version: 0.16.16
   epoch: 0
   description: "The distributed financial accounting database designed for mission critical safety and performance."
   copyright:
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/tigerbeetledb/tigerbeetle
       tag: ${{package.version}}
-      expected-commit: 48a896c43d08ffeb1c735e95ce570e184c72685e
+      expected-commit: 398416ef4ecab274f87c97e707b5fc74b7756612
 
   - runs: |
       zig build -Drelease
diff --git a/tileserver-gl.yaml b/tileserver-gl.yaml
index 4daddeb52b4..640e417dc42 100644
--- a/tileserver-gl.yaml
+++ b/tileserver-gl.yaml
@@ -1,7 +1,7 @@
 package:
   name: tileserver-gl
   version: 5.0.0
-  epoch: 2
+  epoch: 4
   description: Vector and raster maps with GL styles. Server side rendering by MapLibre GL Native. Map tile server for MapLibre GL JS, Android, iOS, Leaflet, OpenLayers, GIS via WMTS, etc.
   copyright:
     - license: BSD-2-Clause
@@ -54,6 +54,8 @@ pipeline:
       tag: v${{package.version}}
       expected-commit: 6cda7a0b384940b781838be7415b2ae448edcd29
       destination: app
+      cherry-picks: |
+        master/93f72c1fe7671429f234c853e81f202e635522e9: GHSA-3xgq-45jj-v275 fix. Bumps cross-spawn to fix version.
 
   # patch and install npm dependencies
   - uses: patch
diff --git a/tkn.yaml b/tkn.yaml
index 90a56ef1c13..c4d0e82ded5 100644
--- a/tkn.yaml
+++ b/tkn.yaml
@@ -1,7 +1,7 @@
 package:
   name: tkn
-  version: 0.38.1
-  epoch: 2
+  version: 0.39.0
+  epoch: 0
   description: A CLI for interacting with Tekton!
   copyright:
     - license: Apache-2.0
@@ -20,11 +20,7 @@ pipeline:
     with:
       repository: https://github.com/tektoncd/cli
       tag: v${{package.version}}
-      expected-commit: 1da09c088bf9f3f82eeee7508bbddf0e7c28fa4b
-
-  - uses: go/bump
-    with:
-      deps: github.com/golang-jwt/jwt/v4@v4.5.1
+      expected-commit: cb2f6797bf2c48dc60d5b4e23f015e35f5f42d78
 
   - runs: |
       make bin/tkn
diff --git a/traefik-3.2.yaml b/traefik-3.2.yaml
index 691fb7e9566..5d14f1cadf8 100644
--- a/traefik-3.2.yaml
+++ b/traefik-3.2.yaml
@@ -1,7 +1,7 @@
 package:
   name: traefik-3.2
   version: 3.2.1
-  epoch: 0
+  epoch: 1
   description: The Cloud Native Application Proxy
   copyright:
     - license: MIT
@@ -32,6 +32,11 @@ pipeline:
       yarn install
       yarn build
 
+  - uses: go/bump
+    with:
+      deps: github.com/quic-go/quic-go@v0.48.2
+      modroot: .
+
   - uses: go/build
     with:
       modroot: .
diff --git a/trafficserver-9.yaml b/trafficserver-9.yaml
index 04770b16522..0eee5df3057 100644
--- a/trafficserver-9.yaml
+++ b/trafficserver-9.yaml
@@ -1,6 +1,6 @@
 package:
   name: trafficserver-9
-  version: 9.2.6
+  version: 9.2.7
   epoch: 0
   description: Apache Traffic Server™ is a fast, scalable and extensible HTTP/1.1 and HTTP/2 compliant caching proxy server.
   copyright:
@@ -24,7 +24,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: de3e58726f6f58a95266a41eaa31ff3c6fc14336
+      expected-commit: a07ba676ad37ff9742d8083bab976782d4434f10
       repository: https://github.com/apache/trafficserver
       tag: ${{package.version}}
 
diff --git a/trillian.yaml b/trillian.yaml
index 747215e30e7..498d13a65de 100644
--- a/trillian.yaml
+++ b/trillian.yaml
@@ -1,7 +1,7 @@
 package:
   name: trillian
-  version: 1.6.1
-  epoch: 1
+  version: 1.7.0
+  epoch: 0
   description: Merkle tree implementation used in Sigstore
   copyright:
     - license: Apache-2.0
@@ -20,7 +20,7 @@ pipeline:
     with:
       repository: https://github.com/google/trillian
       tag: v${{package.version}}
-      expected-commit: 68ab90ccb3406f22e1040b9e3d822845c063bb96
+      expected-commit: 1d737957373d705b4956d288513541ade4d26f43
 
 subpackages:
   - name: ${{package.name}}-logserver
diff --git a/trivy.yaml b/trivy.yaml
index 2e1cd108765..860aff5b6a2 100644
--- a/trivy.yaml
+++ b/trivy.yaml
@@ -1,6 +1,6 @@
 package:
   name: trivy
-  version: 0.57.1
+  version: 0.58.0
   epoch: 0
   description: Simple and comprehensive vulnerability scanner for containers
   copyright:
@@ -9,14 +9,10 @@ package:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: b7947b37ee47ea79dff550462c297164eb47aa9e
+      expected-commit: cd01f230315a364b0eea35edb8db1c4c73c7019a
       repository: https://github.com/aquasecurity/trivy
       tag: v${{package.version}}
 
-  - uses: go/bump
-    with:
-      deps: github.com/golang-jwt/jwt/v4@v4.5.1
-
   - uses: go/build
     with:
       packages: ./cmd/trivy
diff --git a/trust-manager.yaml b/trust-manager.yaml
index 6d0f14c4633..c23a7aa97cb 100644
--- a/trust-manager.yaml
+++ b/trust-manager.yaml
@@ -1,7 +1,7 @@
 package:
   name: trust-manager
-  version: 0.13.0
-  epoch: 1
+  version: 0.14.0
+  epoch: 0
   description: trust-manager is an operator for distributing trust bundles across a Kubernetes cluster.
   copyright:
     - license: Apache-2.0
@@ -25,7 +25,7 @@ pipeline:
     with:
       repository: https://github.com/cert-manager/trust-manager
       tag: v${{package.version}}
-      expected-commit: e6319417f515e6d8ea9fa6e9b79872ccf33d3899
+      expected-commit: f3cd2f5dbecd7c4f0fee2b12b99dcae5eb0f68a2
       destination: trust-manager
 
   - runs: |
diff --git a/ugrep.yaml b/ugrep.yaml
index 6f811b32434..2ac28e36df5 100644
--- a/ugrep.yaml
+++ b/ugrep.yaml
@@ -1,7 +1,7 @@
 # Generated from https://git.alpinelinux.org/aports/plain/community/ugrep/APKBUILD
 package:
   name: ugrep
-  version: 7.1.0
+  version: 7.1.1
   epoch: 0
   description: Ultra fast grep with interactive query UI and fuzzy search
   copyright:
@@ -29,7 +29,7 @@ pipeline:
   - uses: git-checkout
     with:
       repository: https://github.com/Genivia/ugrep
-      expected-commit: 66ff2282ebf9fa277dab50ea9585a5a34d8e8a25
+      expected-commit: be49264fce5fd03246325be4c3fabcd8a7c9b8fe
       tag: v${{package.version}}
 
   - uses: autoconf/configure
diff --git a/uv.yaml b/uv.yaml
index 81e1738d8e2..695c9d7c73b 100644
--- a/uv.yaml
+++ b/uv.yaml
@@ -1,6 +1,6 @@
 package:
   name: uv
-  version: 0.5.4
+  version: 0.5.6
   epoch: 0
   description: An extremely fast Python package installer and resolver, written in Rust.
   copyright:
@@ -24,7 +24,9 @@ pipeline:
     with:
       repository: https://github.com/astral-sh/uv
       tag: ${{package.version}}
-      expected-commit: c62c83c37ada63eae4efb77551e2ec7a0f0113d8
+      expected-commit: b70c4f30eeb47c15fbabd54173f952877d5cfc43
+
+  - uses: rust/cargobump
 
   - runs: |
       cargo auditable build --locked --release
diff --git a/uv/cargobump-deps.yaml b/uv/cargobump-deps.yaml
new file mode 100644
index 00000000000..4d353f7d988
--- /dev/null
+++ b/uv/cargobump-deps.yaml
@@ -0,0 +1,3 @@
+packages:
+    - name: rustls
+      version: 0.23.18
diff --git a/varnish-modules.yaml b/varnish-modules.yaml
index f828e3200e8..b6d99b74416 100644
--- a/varnish-modules.yaml
+++ b/varnish-modules.yaml
@@ -1,7 +1,7 @@
 package:
   name: varnish-modules
   version: 0.25.0
-  epoch: 0
+  epoch: 1
   description: "Collection of Varnish Cache modules (vmods) by Varnish Software"
   copyright:
     - license: BSD-2-Clause
@@ -22,6 +22,7 @@ environment:
       - pkgconf-dev
       - py3-docutils
       - py3-sphinx
+      - python3-dev
       - varnish-dev
       - wolfi-baselayout
 
diff --git a/vector.yaml b/vector.yaml
index c48c4dd1a69..b5010cb4256 100644
--- a/vector.yaml
+++ b/vector.yaml
@@ -1,7 +1,7 @@
 package:
   name: vector
-  version: 0.42.0
-  epoch: 1
+  version: 0.43.0
+  epoch: 0
   description: End-to-end observability data pipeline
   copyright:
     - license: MPL-2.0
@@ -31,7 +31,7 @@ pipeline:
     with:
       repository: https://github.com/vectordotdev/vector
       tag: v${{package.version}}
-      expected-commit: 3d16e345232bb3cb9b104ee6461e9dd0b4c361da
+      expected-commit: 88e017ff11bf7e8d688b4cbbe4a9831d52a27022
 
   - runs: |
       sed -i '7s/deny/allow/' src/lib.rs
diff --git a/victoriametrics-cluster.yaml b/victoriametrics-cluster.yaml
index a562fb48c0c..f709b1e39b5 100644
--- a/victoriametrics-cluster.yaml
+++ b/victoriametrics-cluster.yaml
@@ -1,6 +1,6 @@
 package:
   name: victoriametrics-cluster
-  version: 1.106.1
+  version: 1.107.0
   epoch: 0
   description: VictoriaMetrics is a fast, cost-effective, and scalable monitoring solution and time series database designed for high performance and reliability. It supports both single-server and clustered installations, providing flexibility for various deployment needs, and integrates well with tools like Grafana for data visualization.
   copyright:
@@ -18,7 +18,7 @@ data:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 0babe43391442208f5414f1ba97997cc63bd0a27
+      expected-commit: 27e11b6f11e21384f6a997ef2b4f96dc1c937e9f
       repository: https://github.com/VictoriaMetrics/VictoriaMetrics
       tag: v${{package.version}}-cluster
 
diff --git a/victoriametrics-operator.yaml b/victoriametrics-operator.yaml
index 071a77b58dd..0f4b3ccd8bc 100644
--- a/victoriametrics-operator.yaml
+++ b/victoriametrics-operator.yaml
@@ -1,6 +1,6 @@
 package:
   name: victoriametrics-operator
-  version: 0.49.1
+  version: 0.50.0
   epoch: 0
   description: Kubernetes operator for Victoria Metrics
   copyright:
@@ -9,7 +9,7 @@ package:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 593d5237127af436087245a036970145ef4042f4
+      expected-commit: 4f8fafb9ca1965cb48d40d40749c66b72b64dffd
       repository: https://github.com/VictoriaMetrics/operator
       tag: v${{package.version}}
 
diff --git a/victoriametrics.yaml b/victoriametrics.yaml
index 75b6e7f56ed..a75e4592179 100644
--- a/victoriametrics.yaml
+++ b/victoriametrics.yaml
@@ -1,6 +1,6 @@
 package:
   name: victoriametrics
-  version: 1.106.1
+  version: 1.107.0
   epoch: 0
   description: VictoriaMetrics is a fast, cost-effective, and scalable monitoring solution and time series database designed for high performance and reliability. It supports both single-server and clustered installations, providing flexibility for various deployment needs, and integrates well with tools like Grafana for data visualization.
   copyright:
@@ -16,7 +16,7 @@ data:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: 4b74baf6968b7638e19298f7fc9ccce2a256cd46
+      expected-commit: 61b84e902168d55f16713cf297eca11692ee0a98
       repository: https://github.com/VictoriaMetrics/VictoriaMetrics
       tag: v${{package.version}}
 
diff --git a/vim.yaml b/vim.yaml
index fd4f7e9c9a2..1c1c4976715 100644
--- a/vim.yaml
+++ b/vim.yaml
@@ -1,6 +1,6 @@
 package:
   name: vim
-  version: 9.1.0886
+  version: 9.1.0888
   epoch: 0
   description: "Improved vi-style text editor"
   copyright:
@@ -23,7 +23,7 @@ pipeline:
     with:
       repository: https://github.com/vim/vim
       tag: v${{package.version}}
-      expected-commit: 57b947e3c3b8d52b914158979263855d785445d5
+      expected-commit: 0a850673e3d4193d55f47bcbbc0b0da5f155307d
 
   - runs: |
       # vim seems to manually set FORTIFY_SOURCE=1, and setting both breaks the build
diff --git a/vite.yaml b/vite.yaml
index bdba4464ac8..01174073d1b 100644
--- a/vite.yaml
+++ b/vite.yaml
@@ -1,6 +1,6 @@
 package:
   name: vite
-  version: 5.4.11
+  version: 6.0.2
   epoch: 0
   description: Vite (French word for "quick", pronounced /vit/, like "veet") is a build tool that aims to provide a faster and leaner development experience for modern web projects.
   copyright:
diff --git a/vitess-20.0.yaml b/vitess-20.0.yaml
index d5005b77314..5d19ca78297 100644
--- a/vitess-20.0.yaml
+++ b/vitess-20.0.yaml
@@ -1,7 +1,7 @@
 package:
   name: vitess-20.0
   version: 20.0.3
-  epoch: 0
+  epoch: 1
   description: Autoscaling components for Kubernetes
   copyright:
     - license: Apache-2.0
@@ -75,6 +75,10 @@ pipeline:
     working-directory: web/vtadmin
     runs: |
       npm install --omit=dev
+
+      # CVE GHSA-3xgq-45jj-v275
+      npm install cross-spawn@7.0.5
+
       npm prune --production
       npm install vite --save-dev
       npm run build
diff --git a/vulkan-headers.yaml b/vulkan-headers.yaml
index faf9443d492..1a70b4018f6 100644
--- a/vulkan-headers.yaml
+++ b/vulkan-headers.yaml
@@ -1,7 +1,7 @@
 package:
   name: vulkan-headers
-  version: 1.3.302
-  epoch: 0
+  version: 1.4.303
+  epoch: 1
   description: Vulkan header files and API registry
   copyright:
     - license: Apache-2.0
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/KhronosGroup/Vulkan-Headers
       tag: v${{package.version}}
-      expected-commit: 36872f9062b17b1a30b8ed1d81ca5ea6bb608a72
+      expected-commit: 6a74a7d65cafa19e38ec116651436cce6efd5b2e
 
   - runs: |
       cmake -G Ninja -B build \
diff --git a/vulkan-loader.yaml b/vulkan-loader.yaml
index 0ff36591ca6..4ea4dbd7927 100644
--- a/vulkan-loader.yaml
+++ b/vulkan-loader.yaml
@@ -1,6 +1,6 @@
 package:
   name: vulkan-loader
-  version: 1.3.302
+  version: 1.4.303
   epoch: 0
   description: Vulkan Installable Client Driver (ICD) Loader
   copyright:
@@ -26,7 +26,7 @@ pipeline:
     with:
       repository: https://github.com/KhronosGroup/Vulkan-Loader
       tag: v${{package.version}}
-      expected-commit: 71f4d83c8d025f5f3d61fc2a96ac6973017728f3
+      expected-commit: ce2d68b24b66a91ed798d870ca205f899ee6e79d
 
   - runs: |
       cmake -B build -G Ninja \
diff --git a/wadm.yaml b/wadm.yaml
index a166ba3cc16..ff62dc8fa90 100644
--- a/wadm.yaml
+++ b/wadm.yaml
@@ -1,7 +1,7 @@
 package:
   name: wadm
   version: 0.18.0
-  epoch: 1
+  epoch: 2
   description: "Wasm-native orchestrator for managing and scaling declarative wasmCloud applications"
   copyright:
     - license: Apache-2.0
@@ -23,6 +23,8 @@ pipeline:
       tag: v${{package.version}}
       expected-commit: 6f29e729325ee1fa1735df2ae545ae606413c379
 
+  - uses: rust/cargobump
+
   - name: Configure and build
     runs: |
       cargo auditable build --release --bin wadm
diff --git a/wadm/cargobump-deps.yaml b/wadm/cargobump-deps.yaml
new file mode 100644
index 00000000000..4d353f7d988
--- /dev/null
+++ b/wadm/cargobump-deps.yaml
@@ -0,0 +1,3 @@
+packages:
+    - name: rustls
+      version: 0.23.18
diff --git a/wasm-pack.yaml b/wasm-pack.yaml
index e4a3dbb8ac0..268827efa30 100644
--- a/wasm-pack.yaml
+++ b/wasm-pack.yaml
@@ -1,7 +1,7 @@
 package:
   name: wasm-pack
   version: 0.13.1
-  epoch: 0
+  epoch: 1
   description: rust to wasm build tool
   copyright:
     - license: Apache-2.0
@@ -30,6 +30,8 @@ pipeline:
       expected-commit: 24bdca457abad34e444912e6165eb71422a51046
       tag: v${{package.version}}
 
+  - uses: rust/cargobump
+
   - runs: |
       # prepare
       rm -rf Cargo.lock
diff --git a/wasm-pack/cargobump-deps.yaml b/wasm-pack/cargobump-deps.yaml
new file mode 100644
index 00000000000..4d353f7d988
--- /dev/null
+++ b/wasm-pack/cargobump-deps.yaml
@@ -0,0 +1,3 @@
+packages:
+    - name: rustls
+      version: 0.23.18
diff --git a/wasm-tools.yaml b/wasm-tools.yaml
index a70b8401d74..37177bd1163 100644
--- a/wasm-tools.yaml
+++ b/wasm-tools.yaml
@@ -1,6 +1,6 @@
 package:
   name: wasm-tools
-  version: 1.220.0
+  version: 1.221.2
   epoch: 0
   description: "Low level tooling for WebAssembly in Rust"
   copyright:
@@ -21,7 +21,7 @@ pipeline:
     with:
       repository: https://github.com/bytecodealliance/wasm-tools
       tag: v${{package.version}}
-      expected-commit: aab1ac81bb31762509b5ea4b39973070725b5d73
+      expected-commit: 549c283b2e14c4eba75daa35573b71cdcc110c5d
 
   - name: Configure and build
     runs: |
diff --git a/wazero.yaml b/wazero.yaml
index a4ca0ac3c82..f66ce313f3a 100644
--- a/wazero.yaml
+++ b/wazero.yaml
@@ -1,6 +1,6 @@
 package:
   name: wazero
-  version: 1.8.1
+  version: 1.8.2
   epoch: 0
   description: The zero dependency WebAssembly runtime for Go developers
   copyright:
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/tetratelabs/wazero
       tag: v${{package.version}}
-      expected-commit: 6016a705fa6077f517731d4ce148a82968de02dd
+      expected-commit: 610c202ec48f3a7c729f2bf11707330127ab3689
 
   - runs: |
       make build/wazero_linux_$(go env GOARCH)/wazero
diff --git a/weaviate.yaml b/weaviate.yaml
index 79642b7a715..0bb84840218 100644
--- a/weaviate.yaml
+++ b/weaviate.yaml
@@ -1,6 +1,6 @@
 package:
   name: weaviate
-  version: 1.27.5
+  version: 1.27.6
   epoch: 0
   description: Weaviate is an open source vector database that stores both objects and vectors, allowing for combining vector search with structured filtering with the fault-tolerance and scalability of a cloud-native database, all accessible through GraphQL, REST, and various language clients.
   copyright:
@@ -17,7 +17,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: cfdbdd0552d19345ebaaad13897c14380d60b1f9
+      expected-commit: 4bec043d083a27be2f85c429f999e45648ab0c1e
       repository: https://github.com/weaviate/weaviate
       tag: v${{package.version}}
 
diff --git a/wit-bindgen.yaml b/wit-bindgen.yaml
index b9da47c6006..f8c32b64ee4 100644
--- a/wit-bindgen.yaml
+++ b/wit-bindgen.yaml
@@ -1,6 +1,6 @@
 package:
   name: wit-bindgen
-  version: 0.35.0
+  version: 0.36.0
   epoch: 0
   description: "A language binding generator for WebAssembly interface types"
   copyright:
@@ -22,7 +22,7 @@ pipeline:
     with:
       repository: https://github.com/bytecodealliance/wit-bindgen
       tag: v${{package.version}}
-      expected-commit: af2d6e8d9086efbe00258bbdac4767a46ae9ee53
+      expected-commit: d1387cc70f67c53e31e2668a30a1e4fc8bdcb95a
 
   - name: Configure and build
     runs: |
diff --git a/withdrawn-packages.txt b/withdrawn-packages.txt
index 2f8b7f7db20..699c5033332 100644
--- a/withdrawn-packages.txt
+++ b/withdrawn-packages.txt
@@ -1,4 +1 @@
-istio-install-cni-1.22-1.23.0-r0.apk
-istio-install-cni-1.22-compat-1.23.0-r0.apk
-istio-install-cni-1.22-1.23.0-r1.apk
-istio-install-cni-1.22-compat-1.23.0-r1.apk
+vim-9.0.2100-r0.apk
diff --git a/wolfictl.yaml b/wolfictl.yaml
index 8ba2cff5e5b..ed187b20293 100644
--- a/wolfictl.yaml
+++ b/wolfictl.yaml
@@ -1,6 +1,6 @@
 package:
   name: wolfictl
-  version: 0.26.0
+  version: 0.26.1
   epoch: 0
   description: Helper CLI for managing Wolfi
   copyright:
@@ -11,7 +11,7 @@ pipeline:
     with:
       repository: https://github.com/wolfi-dev/wolfictl
       tag: v${{package.version}}
-      expected-commit: f64935c37fb39fa2df31e6fe9838af2b00390eae
+      expected-commit: fa691041a5ad654b0f6da1409c456e134e7fe107
 
   - uses: go/build
     with:
diff --git a/xfsprogs.yaml b/xfsprogs.yaml
index ba9bebebf31..85192ec1682 100644
--- a/xfsprogs.yaml
+++ b/xfsprogs.yaml
@@ -1,6 +1,6 @@
 package:
   name: xfsprogs
-  version: 6.11.0
+  version: 6.12.0
   epoch: 0
   description: XFS filesystem utilities
   copyright:
@@ -31,7 +31,7 @@ pipeline:
   - uses: fetch
     with:
       uri: https://mirrors.edge.kernel.org/pub/linux/utils/fs/xfs/xfsprogs/xfsprogs-${{package.version}}.tar.xz
-      expected-sha512: 209b479e510e5d5c558430b523bebd90f34b2effeac46f783aad4ec45a9f39998ca1efc67155c54c22e778859968f4b275b0ca6f225603f17ae4cc5c7596a4ca
+      expected-sha512: 020810b4a261f4ab4eb94aae813f22b26bb9f17705967198189509e684422361dd80af938e4a77cf326353d5d61d5aeaaee9a34e8a7b8ed1dddd63b7ad1b0510
 
   - uses: autoconf/configure
     with:
diff --git a/xh.yaml b/xh.yaml
index e942f09c517..306b8b1ccfc 100644
--- a/xh.yaml
+++ b/xh.yaml
@@ -1,7 +1,7 @@
 package:
   name: xh
   version: 0.23.0
-  epoch: 1
+  epoch: 3
   description: Friendly and fast tool for sending HTTP requests.
   copyright:
     - license: MIT
@@ -23,6 +23,8 @@ pipeline:
       tag: v${{package.version}}
       expected-commit: 0fb0a13ecb64a3a1af35cfaf13a6970f78c38dfb
 
+  - uses: rust/cargobump
+
   - runs: |
       cargo auditable build --locked --release
       install -Dm755 target/release/xh "${{targets.destdir}}"/usr/bin/xh
diff --git a/xh/cargobump-deps.yaml b/xh/cargobump-deps.yaml
index 345caf806ab..8ba19a342fc 100644
--- a/xh/cargobump-deps.yaml
+++ b/xh/cargobump-deps.yaml
@@ -1,3 +1,5 @@
 packages:
     - name: rustls
-      version: 0.22.4
+      version: 0.23.18
+    - name: ruzstd
+      version: 0.7.3
diff --git a/xterm.yaml b/xterm.yaml
index 8c07c9f5041..7b247c23009 100644
--- a/xterm.yaml
+++ b/xterm.yaml
@@ -1,6 +1,6 @@
 package:
   name: xterm
-  version: "395"
+  version: "396"
   epoch: 0
   description: X Terminal Emulator
   copyright:
@@ -35,7 +35,7 @@ environment:
 pipeline:
   - uses: fetch
     with:
-      expected-sha256: 286e3caa5938eae38e202827621567629dfeaae689e8070b413ca11398093dc8
+      expected-sha256: 43f94b6d0eecb4219a99f46352e746f2ab5558e40d922d411acff96cc778a6a5
       uri: https://invisible-island.net/archives/xterm/xterm-${{package.version}}.tgz
 
   - uses: autoconf/configure
diff --git a/yam.yaml b/yam.yaml
index bf44ac1dedc..c1701a2d235 100644
--- a/yam.yaml
+++ b/yam.yaml
@@ -1,6 +1,6 @@
 package:
   name: yam
-  version: 0.2.3
+  version: 0.2.4
   epoch: 0
   description: A sweet little formatter for YAML
   copyright:
@@ -11,7 +11,7 @@ pipeline:
     with:
       repository: https://github.com/chainguard-dev/yam
       tag: v${{package.version}}
-      expected-commit: 3eba0a7cdfc15e2f97336dad564dfed9b75a3883
+      expected-commit: b5796da12c88732ffa8c4b56df8d8da82bc625ab
 
   - uses: go/build
     with:
diff --git a/zfs.yaml b/zfs.yaml
index a46f04e61ef..03f9df216e2 100644
--- a/zfs.yaml
+++ b/zfs.yaml
@@ -63,6 +63,9 @@ subpackages:
     pipeline:
       - uses: split/dev
     description: zfs dev
+    test:
+      pipeline:
+        - uses: test/pkgconf
 
   - name: zfs-doc
     pipeline:
diff --git a/ztunnel-1.24.yaml b/ztunnel-1.24.yaml
index f7b183db7b4..8498a320eb9 100644
--- a/ztunnel-1.24.yaml
+++ b/ztunnel-1.24.yaml
@@ -1,7 +1,7 @@
 package:
   name: ztunnel-1.24
-  version: 1.24.0
-  epoch: 0
+  version: 1.24.1
+  epoch: 1
   description: The `ztunnel` component of istio ambient mesh.
   copyright:
     - license: Apache-2.0
@@ -34,7 +34,9 @@ pipeline:
     with:
       repository: https://github.com/istio/ztunnel
       tag: ${{package.version}}
-      expected-commit: 1226c1b35f50938f428c71f7dcad3602ea991675
+      expected-commit: 4c7cdf1b62ddcc786402499c03eff0d5172c95ef
+
+  - uses: rust/cargobump
 
   - runs: |
       export ZTUNNEL_BUILD_buildStatus=clean
diff --git a/ztunnel-1.24/cargobump-deps.yaml b/ztunnel-1.24/cargobump-deps.yaml
new file mode 100644
index 00000000000..4d353f7d988
--- /dev/null
+++ b/ztunnel-1.24/cargobump-deps.yaml
@@ -0,0 +1,3 @@
+packages:
+    - name: rustls
+      version: 0.23.18