diff --git a/packages/cloudflared/build.ncl b/packages/cloudflared/build.ncl
index 675461b9..ec19c12b 100644
--- a/packages/cloudflared/build.ncl
+++ b/packages/cloudflared/build.ncl
@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "2026.7.2" in
+let version = "2026.7.3" in
 {
   name = "cloudflared",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/cloudflare/cloudflared/archive/refs/tags/%{version}.tar.gz",
-      sha256 = "7c437dcf6c2b2efb25b93eaca4724f9be582d48fa97e020a11a177b36d14d606",
+      sha256 = "8e452b1630064f5951e18a2537e66274e006eb2e83daa0d42a0adb3fab3ee788",
       extract = true,
       strip_prefix = "cloudflared-%{version}",
     } | Source,
diff --git a/packages/crane/build.ncl b/packages/crane/build.ncl
index a3ef8c69..21ffa42a 100644
--- a/packages/crane/build.ncl
+++ b/packages/crane/build.ncl
@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "0.21.8" in
+let version = "0.21.9" in
 {
   name = "crane",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/google/go-containerregistry/archive/refs/tags/v%{version}.tar.gz",
-      sha256 = "29a1b525881f89bf07c50537e40ea3609e2fe5d6851b9f62cf7452ab1104445d",
+      sha256 = "6d8bce869afcc485b518cc0d59ea0ffe1090026db965806bc3be8793182528cc",
       extract = true,
       strip_prefix = "go-containerregistry-%{version}",
     } | Source,
diff --git a/packages/grafana/build.ncl b/packages/grafana/build.ncl
index 5ccd550b..15eaf2b7 100644
--- a/packages/grafana/build.ncl
+++ b/packages/grafana/build.ncl
@@ -1,12 +1,12 @@
-let { Attrs, BuildSpec, Local, OutputBin, OutputData, Source, .. } = import "minimal.ncl" in
+let { standaloneTest, Attrs, BuildSpec, Local, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
 let { target, .. } = import "config.ncl" in
 let base = import "../base/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "12.4.3" in
+let version = "13.1.2" in
 
-let amd64_sha256 = "64707f35d54a5441ecbc63c0b3b633b7e73fe404fac118e88574f56d70b08a93" in
-let arm64_sha256 = "825e31eb0aafcf026d7f04dd540042eedef42cb81a3d2832c296b27dacf7e95d" in
+let amd64_sha256 = "2215a38a59b573f114128e05f3836cb8708ac9b04b9283021ad28fdb88d71290" in
+let arm64_sha256 = "660cc31dbd159d98a3804ac5104b0aca0e0d95ee4e88a164ff63ddd72f9fda2e" in
 
 {
   name = "grafana",
@@ -42,8 +42,6 @@ let arm64_sha256 = "825e31eb0aafcf026d7f04dd540042eedef42cb81a3d2832c296b27dacf7
 
   outputs = {
     grafana = { glob = "usr/bin/grafana" } | OutputBin,
-    grafana-server = { glob = "usr/bin/grafana-server" } | OutputBin,
-    grafana-cli = { glob = "usr/bin/grafana-cli" } | OutputBin,
     public = { glob = "usr/share/grafana/public/**" } | OutputData,
     conf = { glob = "usr/share/grafana/conf/**" } | OutputData,
   },
@@ -58,4 +56,27 @@ let arm64_sha256 = "825e31eb0aafcf026d7f04dd540042eedef42cb81a3d2832c296b27dacf7
         repo = "grafana",
       },
     } | Attrs,
+
+  tests = {
+    # The package had NO tests until the 12.4.3 -> 13.1.2 bump failed at
+    # `install: cannot stat 'bin/grafana-server'`. That failure was loud only
+    # because build.sh runs with `set -e`; the shape it belongs to — upstream
+    # changing which binaries a tarball ships — is otherwise invisible until a
+    # user runs the missing command.
+    smoketest = standaloneTest "/bin/grafana --version",
+
+    subcommands_replace_the_dropped_bins =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [
+          # `grafana-server` and `grafana-cli` are gone as of 13. Assert the
+          # subcommands that replaced them actually exist, so "we dropped two
+          # bins" can never quietly become "we dropped the functionality".
+          ["/bin/bash", "-c", "/bin/grafana server --help >/dev/null"],
+          ["/bin/bash", "-c", "/bin/grafana cli --help >/dev/null"],
+        ],
+      }
+        | Test,
+  },
 } | BuildSpec
diff --git a/packages/grafana/build.sh b/packages/grafana/build.sh
index 9ec16c58..1c6bfd5c 100755
--- a/packages/grafana/build.sh
+++ b/packages/grafana/build.sh
@@ -4,9 +4,15 @@ set -ex
 mkdir -p $OUTPUT_DIR/usr/bin
 mkdir -p $OUTPUT_DIR/usr/share/grafana
 
+# Grafana 13 ships ONE binary. `grafana-server` and `grafana-cli` were removed
+# upstream — through 12.x they were two shims of 2,557,169 bytes each (identical
+# size, i.e. the same forwarder built twice) sitting next to the real ~500MB
+# `grafana`, long deprecated in favour of the `grafana server` / `grafana cli`
+# subcommands. Installing them unconditionally is what broke 12.4.3 -> 13.1.2:
+#   install: cannot stat 'bin/grafana-server': No such file or directory
+# Nothing else in pkgs referenced either name, so they are dropped rather than
+# re-created as local shims.
 install -m 755 bin/grafana $OUTPUT_DIR/usr/bin/grafana
-install -m 755 bin/grafana-server $OUTPUT_DIR/usr/bin/grafana-server
-install -m 755 bin/grafana-cli $OUTPUT_DIR/usr/bin/grafana-cli
 
 cp -r public $OUTPUT_DIR/usr/share/grafana/
 cp -r conf $OUTPUT_DIR/usr/share/grafana/
diff --git a/packages/grype/build.ncl b/packages/grype/build.ncl
index 59bf82fd..422cfba9 100644
--- a/packages/grype/build.ncl
+++ b/packages/grype/build.ncl
@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "0.116.0" in
+let version = "0.116.1" in
 {
   name = "grype",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/anchore/grype/v%{version}.tar.gz",
-      sha256 = "5e8aa8cf1ae21e46f1f5aa8349af1416153a9a3299cd80f5bb1ef38fd9d38252",
+      sha256 = "e64bd796bc93092ac9af1955193903d37f33ffbd4667a64a6b97c8f0dc61a2a7",
       extract = true,
       strip_prefix = "grype-%{version}",
     } | Source,
diff --git a/packages/mesa/build.ncl b/packages/mesa/build.ncl
index be799448..66d77f6d 100644
--- a/packages/mesa/build.ncl
+++ b/packages/mesa/build.ncl
@@ -22,17 +22,17 @@ let expat = import "../expat/build.ncl" in
 let zlib = import "../zlib/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "26.1.6" in
+let version = "26.2.0" in
 {
   name = "mesa",
   build_deps = [
     { file = "build.sh" } | Local,
     {
-      # https://archive.mesa3d.org/mesa-26.1.6.tar.xz
+      # https://archive.mesa3d.org/mesa-26.2.0.tar.xz
       # (mesa is developed at gitlab.freedesktop.org/mesa/mesa; archive.mesa3d.org
       #  serves the release tarballs. The gs:// URL is a staged mirror of that.)
       url = "gs://minimal-staging-archives/mesa-%{version}.tar.xz",
-      sha256 = "5296b88a0f1e012e2cb9ada150a2bbadf728ca81e5a4fb2ab43c83a4d2158606",
+      sha256 = "efd4bb08cdb7c365a812cd4e6c9202ab55b2f22cdcd13c7d6c4f9647b799a4ef",
       extract = true,
       strip_prefix = "mesa-%{version}",
     } | Source,
diff --git a/packages/pulumi/build.ncl b/packages/pulumi/build.ncl
index 98a6d800..30039489 100644
--- a/packages/pulumi/build.ncl
+++ b/packages/pulumi/build.ncl
@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "3.255.0" in
+let version = "3.256.0" in
 {
   name = "pulumi",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/pulumi/pulumi/v%{version}.tar.gz",
-      sha256 = "c0ed8c10910d73d484547ab5146b12de3f607d84b63414f7d51bed1017497a8b",
+      sha256 = "43887337b91f4d61cb81d917947193337d4718dfe3ad21497857b431b279d886",
       extract = true,
       strip_prefix = "pulumi-%{version}",
     } | Source,
diff --git a/packages/uv/build.ncl b/packages/uv/build.ncl
index 32b8ff1a..6b146844 100644
--- a/packages/uv/build.ncl
+++ b/packages/uv/build.ncl
@@ -6,14 +6,14 @@ let make = import "../make/build.ncl" in
 let rust = import "../rust/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 
-let version = "0.12.1" in
+let version = "0.12.2" in
 {
   name = "uv",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/uv-%{version}.tar.gz",
-      sha256 = "4e87a6c0e5feddb55e080ba2e8b7ecc1379361471d724071b0c0e0ba5df72981"
+      sha256 = "62e876d5ed5494f42bf72bc850022d6fb2137d0849503461176dd3fa27edbb81"
     } | Source,
     base,
     make,
diff --git a/packages/vim/build.ncl b/packages/vim/build.ncl
index 41f2fec2..fc08542a 100644
--- a/packages/vim/build.ncl
+++ b/packages/vim/build.ncl
@@ -6,14 +6,14 @@ let toolchain = import "../toolchain/build.ncl" in
 let acl = import "../acl/build.ncl" in
 let ncurses = import "../ncurses/build.ncl" in
 
-let version = "9.2.0901" in
+let version = "9.2.0914" in
 {
   name = "vim",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/vim-%{version}.tar.gz",
-      sha256 = "97389396da7de9bbcf6f4fa14dda5671557bbda8213324fd4040277057010b54"
+      sha256 = "94f44ff0d08ceb717140906b70cbe613f3f3016e20e79cac43034d11322c6280"
     } | Source,
     base,
     make,
diff --git a/packages/zola/build.ncl b/packages/zola/build.ncl
index 5c7ba1f5..2bd9ff51 100644
--- a/packages/zola/build.ncl
+++ b/packages/zola/build.ncl
@@ -7,14 +7,14 @@ let toolchain = import "../toolchain/build.ncl" in
 let make = import "../make/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 let gcc = import "../gcc/build.ncl" in
-let version = "0.22.1" in
+let version = "0.23.1" in
 {
   name = "zola",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/getzola/zola/v%{version}.tar.gz",
-      sha256 = "0f59479e05bce79e8d5860dc7e807ea818986094469ed8bf0bb46588ade95982",
+      sha256 = "331240b037bbef0a15e6c1db5a2eb572097f12a362deb075a331dbb849928f83",
       extract = true,
       strip_prefix = "zola-%{version}",
     } | Source,
@@ -37,7 +37,7 @@ let version = "0.22.1" in
     {
       upstream_version = version,
       source_provenance = { category = 'GithubRepo, owner = "getzola", repo = "zola" },
-      # zola relicensed to EUPL-1.2 at v0.22 (commit 3c9131d); v0.22.1 declares
+      # zola relicensed to EUPL-1.2 at v0.22 (commit 3c9131d); v0.23.1 declares
       # `license = "EUPL-1.2"` in Cargo.toml and ships only the EUPL LICENSE file.
       license_spdx = "EUPL-1.2",
     } | Attrs,