diff --git a/packages/cosign/build.ncl b/packages/cosign/build.ncl
index 83747c69..64f69ef1 100644
--- a/packages/cosign/build.ncl
+++ b/packages/cosign/build.ncl
@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "3.1.1" in
+let version = "3.1.2" in
 {
   name = "cosign",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/sigstore/cosign/v%{version}.tar.gz",
-      sha256 = "2b44374321cd19b0eb27026ee16e519393139edd7ffe01860c2d78d6084c68eb",
+      sha256 = "cddaacb84071a1f843bf0d46f02232b35c808f4eadbfe1e0be452069dc03816f",
       extract = true,
       strip_prefix = "cosign-%{version}",
     } | Source,
diff --git a/packages/crane/build.ncl b/packages/crane/build.ncl
index d6c44071..a3ef8c69 100644
--- a/packages/crane/build.ncl
+++ b/packages/crane/build.ncl
@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "0.21.7" in
+let version = "0.21.8" in
 {
   name = "crane",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/google/go-containerregistry/archive/refs/tags/v%{version}.tar.gz",
-      sha256 = "4fa695c6a1f79793598d804cab380a3ba4f03539c0dbd4f0b9f38cdaf175ef3b",
+      sha256 = "29a1b525881f89bf07c50537e40ea3609e2fe5d6851b9f62cf7452ab1104445d",
       extract = true,
       strip_prefix = "go-containerregistry-%{version}",
     } | Source,
diff --git a/packages/diffoscope/build.ncl b/packages/diffoscope/build.ncl
index 67b50491..1330ef0d 100644
--- a/packages/diffoscope/build.ncl
+++ b/packages/diffoscope/build.ncl
@@ -4,14 +4,14 @@ let toolchain = import "../toolchain/build.ncl" in
 let uv = import "../uv/build.ncl" in
 let python = import "../python/build.ncl" in
 let libarchive = import "../libarchive/build.ncl" in
-let version = "325" in
+let version = "326" in
 {
   name = "diffoscope",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/diffoscope-%{version}.tar.gz",
-      sha256 = "d74a2edb0555a9ee306d5362b921f80c144bb941c0a6d61794473d1540d729ad"
+      sha256 = "21aaa977a9fbdf6e2b70b675a700ad1f80e878ac1dac59cf6fb0ba5f319616c7"
     } | Source,
     base,
     toolchain,
diff --git a/packages/diffoscope/build.sh b/packages/diffoscope/build.sh
index e29ee641..540d7bf7 100755
--- a/packages/diffoscope/build.sh
+++ b/packages/diffoscope/build.sh
@@ -1,8 +1,8 @@
 #!/bin/sh
 set -e
 
-tar -xof diffoscope-325.tar.gz
-cd diffoscope-325
+tar -xof diffoscope-326.tar.gz
+cd diffoscope-326
 
 pip3 install --root $OUTPUT_DIR .
 
diff --git a/packages/gcloud/build.ncl b/packages/gcloud/build.ncl
index a4b656fb..06d5c3e2 100644
--- a/packages/gcloud/build.ncl
+++ b/packages/gcloud/build.ncl
@@ -5,7 +5,7 @@ let python = import "../python/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 let sqlite = import "../sqlite/build.ncl" in
 
-let version = "577.0.0" in
+let version = "579.0.0" in
 # Google's per-version GCS bucket; explicit per-version path. The
 # previous rapid-channel URL
 # (dl.google.com/dl/cloudsdk/channels/rapid/downloads) has the
@@ -16,8 +16,8 @@ let version = "577.0.0" in
 let dl_base = "https://storage.googleapis.com/cloud-sdk-release" in
 
 let { amd64_sha256, arm64_sha256 } = {
-  amd64_sha256 = "0b32d330446ce7b0f57f253e7efab4636c18fb1f87a3ac31c6c3f2a2a697525e",
-  arm64_sha256 = "dbac26bdf80d72b5d13538e3a215dcbfe2781edfd2d69723effbeef3839cffb8",
+  amd64_sha256 = "a9a7fbe51cda37cf6142b1bbcff12227550e60a6c67e8cf84644fb301371c4de",
+  arm64_sha256 = "edc914b75f8c5d50e1efc78b849d6fa636c4412346784c148c4130f5dc3eba00",
 }
 in
 
diff --git a/packages/gopls/build.ncl b/packages/gopls/build.ncl
index a041f9e9..21e45485 100644
--- a/packages/gopls/build.ncl
+++ b/packages/gopls/build.ncl
@@ -4,14 +4,14 @@ let glibc = import "../glibc/build.ncl" in
 let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 
-let version = "0.21.1" in
+let version = "0.23.0" in
 {
   name = "gopls",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/golang/tools/archive/refs/tags/gopls/v%{version}.tar.gz",
-      sha256 = "af211e00c3ffe44fdf2dd3efd557e580791e09f8dbb4284c917bd120bc3c8f9c",
+      sha256 = "1ba41875b918db73c6a409ad8f552b85f72dfeea43ffb541b798322ff6b4152b",
       extract = true,
       strip_prefix = "tools-gopls-v%{version}",
     } | Source,
diff --git a/packages/just/build.ncl b/packages/just/build.ncl
index 693a7764..536ca9a4 100644
--- a/packages/just/build.ncl
+++ b/packages/just/build.ncl
@@ -6,14 +6,14 @@ let toolchain = import "../toolchain/build.ncl" in
 let gcc = import "../gcc/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "1.57.0" in
+let version = "1.58.0" in
 {
   name = "just",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/casey/just/archive/refs/tags/%{version}.tar.gz",
-      sha256 = "905c556aad3c0a4b0376db98b706a9aa3485fcf50a30377d50737bf20f3792cb",
+      sha256 = "c8a36e6e9397f2fdfcb0cc246fcdb790b52a784f3c8cabc0d8baeb031852a148",
       extract = true,
       strip_prefix = "just-%{version}",
     } | Source,
diff --git a/packages/opencode/build.ncl b/packages/opencode/build.ncl
index 62236ab8..28509610 100644
--- a/packages/opencode/build.ncl
+++ b/packages/opencode/build.ncl
@@ -5,14 +5,14 @@ let git = import "../git/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 let ripgrep = import "../ripgrep/build.ncl" in
 
-let version = "1.18.11" in
+let version = "1.18.13" in
 {
   name = "opencode",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/anomalyco/opencode/archive/refs/tags/v%{version}.tar.gz",
-      sha256 = "b46549b94fe2286e121c9eeabf6a9cedb556af435fb06f1bf5e4f8532f87a777",
+      sha256 = "a3328aed885d7154fcf378ec722ba0e5f3def2f68b4c001481084d30aef5f44d",
     } | Source,
     base,
     bun,
diff --git a/packages/prek/build.ncl b/packages/prek/build.ncl
index c03f451b..9f4ff517 100644
--- a/packages/prek/build.ncl
+++ b/packages/prek/build.ncl
@@ -6,14 +6,14 @@ let toolchain = import "../toolchain/build.ncl" in
 let gcc = import "../gcc/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "0.4.11" in
+let version = "0.4.12" in
 {
   name = "prek",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/j178/prek/v%{version}.tar.gz",
-      sha256 = "60695658e54faaf2ab2268480d09189e6bdc0e4ebdecaee7b78283b62a8646e5",
+      sha256 = "e2744b62521f1dbf080a04270d41609c45a279ed028c3d083b1ffdcf52de6219",
       extract = true,
       strip_prefix = "prek-%{version}",
     } | Source,