diff --git a/packages/chezmoi/build.ncl b/packages/chezmoi/build.ncl
index b742146e..7fd38831 100644
--- a/packages/chezmoi/build.ncl
+++ b/packages/chezmoi/build.ncl
@@ -3,14 +3,14 @@ let base = import "../base/build.ncl" in
 let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
-let version = "2.71.1" in
+let version = "2.72.0" in
 {
   name = "chezmoi",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/twpayne/chezmoi/v%{version}.tar.gz",
-      sha256 = "ecbba845ef7b924c510d32a7342727b9889cc8c77a289e3a04b777226ef8938c",
+      sha256 = "1d277142b26de2401b495eb883d9eb945a47c2d6edb9fefe2036a9048e39af82",
       extract = true,
       strip_prefix = "chezmoi-%{version}",
     } | Source,
diff --git a/packages/claude-code/build.ncl b/packages/claude-code/build.ncl
index 18e1346c..f8b530a0 100644
--- a/packages/claude-code/build.ncl
+++ b/packages/claude-code/build.ncl
@@ -11,9 +11,9 @@ let ripgrep = import "../ripgrep/build.ncl" in
 
 let { version, amd64_sha256, arm64_sha256, gcs_bucket } = {
   gcs_bucket = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases",
-  version = "2.1.220",
-  amd64_sha256 = "674f61f20ff306f3100cf9200e4c36c4b70278b5bef2884549819b942a89c863",
-  arm64_sha256 = "159e4a51d796f3bf14677577100f7efb845611b1ceaf0c30cbd8d4650d942185",
+  version = "2.1.221",
+  amd64_sha256 = "60db8e88d42c24b5199c92cfd56ec88370c510c3789c6f364af748354f087ada",
+  arm64_sha256 = "d3c59d6bcc4adcf4cd85abca3bc13fa1131a34cb32f982bdf030d83a3b11e700",
 }
 in
 
diff --git a/packages/next/build.ncl b/packages/next/build.ncl
index 97092443..ced4d823 100644
--- a/packages/next/build.ncl
+++ b/packages/next/build.ncl
@@ -10,14 +10,14 @@ let pnpm = import "../pnpm/build.ncl" in
 let python = import "../python/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 
-let version = "16.2.12" in
+let version = "16.3.0" in
 {
   name = "next",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/vercel/next.js/archive/refs/tags/v%{version}.tar.gz",
-      sha256 = "659f766845f4f7914fbed5d4836b6c8a85eefcf6f852b7126e5eb71d582be682",
+      sha256 = "9269716701c0aee3e8138530c01f11a22f5fc20c5dec0d3ce131b7e5741caa9b",
       extract = true,
       strip_prefix = "next.js-%{version}",
     } | Source,
diff --git a/packages/trivy/build.ncl b/packages/trivy/build.ncl
index 6e7d0ea4..96a26f9f 100644
--- a/packages/trivy/build.ncl
+++ b/packages/trivy/build.ncl
@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "0.72.0" in
+let version = "0.73.0" in
 {
   name = "trivy",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/aquasecurity/trivy/v%{version}.tar.gz",
-      sha256 = "2c6e0e5a4b1b08241aab8e379155dfb31855a50cb1d04fa790039cf3010477cf",
+      sha256 = "a2a6f9eee305dd6672ec3af92954c456e5f5439ab3a46d6f4dc06f53422752d0",
       extract = true,
       strip_prefix = "trivy-%{version}",
     } | Source,