diff --git a/packages/lore/default.nix b/packages/lore/default.nix
index 400684b..8621d1a 100644
--- a/packages/lore/default.nix
+++ b/packages/lore/default.nix
@@ -14,16 +14,16 @@ let
   # aarch64-linux is the Graviton/Neoverse 512-tvb build upstream ships).
   sources = {
     x86_64-linux = {
-      url = "https://github.com/EpicGames/lore/releases/download/v0.8.5/lore-v0.8.5-x86_64-unknown-linux-gnu.tar.gz";
-      hash = "sha256-PVi9NsquwumRZInsfk/HGVqFjlHLcaO26Q1yrf4wYv8=";
+      url = "https://github.com/EpicGames/lore/releases/download/v0.8.6/lore-v0.8.6-x86_64-unknown-linux-gnu.tar.gz";
+      hash = "sha256-p6rrMqFfZnSjKOGQlsSNyrWymyg7pR03q9re3ZMIEq0=";
     };
     aarch64-linux = {
-      url = "https://github.com/EpicGames/lore/releases/download/v0.8.5/lore-v0.8.5-aarch64-unknown-linux-gnu-neoverse-512tvb.tar.gz";
-      hash = "sha256-xvxH0PoHBvjZedA5pmW8f7Xteooj6eaavNnKsFJ4ETQ=";
+      url = "https://github.com/EpicGames/lore/releases/download/v0.8.6/lore-v0.8.6-aarch64-unknown-linux-gnu-neoverse-512tvb.tar.gz";
+      hash = "sha256-wH2MIZIM42J37aSb/vIu0uii6iC1ad3/Flta/oytFRA=";
     };
     aarch64-darwin = {
-      url = "https://github.com/EpicGames/lore/releases/download/v0.8.5/lore-v0.8.5-aarch64-apple-darwin.tar.gz";
-      hash = "sha256-+6Tq+xI6/lmbXXUhIftqXaci8zsqPaM5AyS2VNMdx00=";
+      url = "https://github.com/EpicGames/lore/releases/download/v0.8.6/lore-v0.8.6-aarch64-apple-darwin.tar.gz";
+      hash = "sha256-2BnWoWiIwGznokYcDpYuZu6Rc1I2SXSS6IX+O7NYEQs=";
     };
   };
 
@@ -33,7 +33,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lore";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchurl {
     inherit (srcAttrs) url hash;
diff --git a/packages/loreserver/default.nix b/packages/loreserver/default.nix
index e5270b5..432f936 100644
--- a/packages/loreserver/default.nix
+++ b/packages/loreserver/default.nix
@@ -14,16 +14,16 @@ let
   # aarch64-linux is the Graviton/Neoverse 512-tvb build upstream ships).
   sources = {
     x86_64-linux = {
-      url = "https://github.com/EpicGames/lore/releases/download/v0.8.5/loreserver-v0.8.5-x86_64-unknown-linux-gnu.tar.gz";
-      hash = "sha256-4U7qykeu+Spl9woRElB/llHlRZ2cajS+KkG6gEPomzA=";
+      url = "https://github.com/EpicGames/lore/releases/download/v0.8.6/loreserver-v0.8.6-x86_64-unknown-linux-gnu.tar.gz";
+      hash = "sha256-8N6ExhdaR28Vd1T1cxa+A0YQW+UCyT+rtlu5COqw4eE=";
     };
     aarch64-linux = {
-      url = "https://github.com/EpicGames/lore/releases/download/v0.8.5/loreserver-v0.8.5-aarch64-unknown-linux-gnu-neoverse-512tvb.tar.gz";
-      hash = "sha256-AqDkfGcnSBNrJGfv5llhaF9c+3o0Ha4BFeBWTjpuyR0=";
+      url = "https://github.com/EpicGames/lore/releases/download/v0.8.6/loreserver-v0.8.6-aarch64-unknown-linux-gnu-neoverse-512tvb.tar.gz";
+      hash = "sha256-Aamr+HZDxGwQ2f19Mbs8kfNxtLZtZsOd+DhgTOTpwVE=";
     };
     aarch64-darwin = {
-      url = "https://github.com/EpicGames/lore/releases/download/v0.8.5/loreserver-v0.8.5-aarch64-apple-darwin.tar.gz";
-      hash = "sha256-ZqUhU7q5+DrkQnxHKDJMp4mUAA+Y7zlL8PLaJ964mlM=";
+      url = "https://github.com/EpicGames/lore/releases/download/v0.8.6/loreserver-v0.8.6-aarch64-apple-darwin.tar.gz";
+      hash = "sha256-SCgfzPcu07pK0ycRdVI1lQaSlfTzC5NuuxXC+lAZnks=";
     };
   };
 
@@ -33,7 +33,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "loreserver";
-  version = "0.8.5";
+  version = "0.8.6";
 
   src = fetchurl {
     inherit (srcAttrs) url hash;
diff --git a/packages/pullrun/default.nix b/packages/pullrun/default.nix
index cf37110..ec45b04 100644
--- a/packages/pullrun/default.nix
+++ b/packages/pullrun/default.nix
@@ -10,20 +10,20 @@ let
   # Each archive has pullrun-{os}-{arch} + pullrun-runtime-{os}-{arch} (static).
   sources = {
     x86_64-linux = {
-      url = "https://github.com/pullrun/pullrun/releases/download/v0.6.7/pullrun-0.6.7-linux-amd64.tar.gz";
-      hash = "sha256-aFIa59shNN+Ptt8vd39fRvY1Gjh5WghZLrAc7lmRtkw=";
+      url = "https://github.com/pullrun/pullrun/releases/download/v0.7.9/pullrun-0.7.9-linux-amd64.tar.gz";
+      hash = "sha256-NE3Ch5XH7VsLgKiCJnHqwzV9c3HurXfa83eqBCJN1l8=";
     };
     aarch64-linux = {
-      url = "https://github.com/pullrun/pullrun/releases/download/v0.6.7/pullrun-0.6.7-linux-arm64.tar.gz";
-      hash = "sha256-Ct0fm26gMwqx9tw96X8TW5xnUZpwC9HXgzn5tDr7cy4=";
+      url = "https://github.com/pullrun/pullrun/releases/download/v0.7.9/pullrun-0.7.9-linux-arm64.tar.gz";
+      hash = "sha256-jFy57LRxabOWCQnJTyABTb3IzHl0oHDD+r6gp5ox2Z8=";
     };
     x86_64-darwin = {
-      url = "https://github.com/pullrun/pullrun/releases/download/v0.6.7/pullrun-0.6.7-darwin-amd64.tar.gz";
-      hash = "sha256-f9xQJcH5CpcwbHSOZg7K7fWdRjipUkiYMCywbGQ025c=";
+      url = "https://github.com/pullrun/pullrun/releases/download/v0.7.9/pullrun-0.7.9-darwin-amd64.tar.gz";
+      hash = "sha256-tqWty9CjMTRd2v3veVz+SG+LUpnP8qgalF2f20l2AL0=";
     };
     aarch64-darwin = {
-      url = "https://github.com/pullrun/pullrun/releases/download/v0.6.7/pullrun-0.6.7-darwin-arm64.tar.gz";
-      hash = "sha256-tj1K0VKI2UnWUT8lqTiXC9MD4qM8R4iYy/AoNBLTr/8=";
+      url = "https://github.com/pullrun/pullrun/releases/download/v0.7.9/pullrun-0.7.9-darwin-arm64.tar.gz";
+      hash = "sha256-/hRQmxJ4/mzX1KVDOeHK7/xDVLcT36FD0uyMnSPsvtw=";
     };
   };
 
@@ -33,7 +33,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "pullrun";
-  version = "0.7.6";
+  version = "0.7.9";
 
   src = fetchurl {
     inherit (srcAttrs) url hash;
diff --git a/packages/spinel/default.nix b/packages/spinel/default.nix
index 99b96ab..c51cd43 100644
--- a/packages/spinel/default.nix
+++ b/packages/spinel/default.nix
@@ -27,13 +27,13 @@ in
 stdenv.mkDerivation (finalAttrs: {
   pname = "spinel";
   # No upstream tags yet — date-stamped unstable version of a pinned commit.
-  version = "0-unstable-2026-07-27";
+  version = "0-unstable-2026-08-01";
 
   src = fetchFromGitHub {
     owner = "matz";
     repo = "spinel";
-    rev = "eac3eecb2d9a860bbf9c0f3ad76554bc0c1f1826";
-    hash = "sha256-7uBw7ut+gMePaP/2Y5L7sBCYxXN9yRq7YTBlP01vGSg=";
+    rev = "53feb9dfbba276b2479c4a1ab2608b54a05e0b18";
+    hash = "sha256-pZAtd4bnFWy5xJ6CsKFg76SlCT/wnlBp84Hw5WE9Zuk=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/packages/vit/default.nix b/packages/vit/default.nix
index 3df91ef..b8300d6 100644
--- a/packages/vit/default.nix
+++ b/packages/vit/default.nix
@@ -6,13 +6,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "vit";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "solpbc";
     repo = "vit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-iICVLod9SnBxm/4nQuD/cecOobP7QHRgG4LZmZEUYRg=";
+    hash = "sha256-n9mniNcWly8XPhjLgsGlwJtjCYlYatNFvBuN7pz+7hg=";
   };
 
   # Upstream's package-lock.json (often produced via bun) is missing "resolved"
@@ -27,7 +27,7 @@ buildNpmPackage (finalAttrs: {
   #   1. Bump version/rev/src hash
   #   2. Regenerate packages/vit/package-lock.json (see README)
   #   3. Set npmDepsHash = lib.fakeHash, build once, paste the hash nix prints
-  npmDepsHash = "sha256-SNk+TDlrwgtVRLKD209iLvHba5laRQ9gmtMAsCgtZjU=";
+  npmDepsHash = "sha256-8PojaMjFF8mPYmFA9cM3qdaphyCMHoRvMLX/leFOf4A=";
 
   # Pure JS CLI — no compile step. Upstream Makefile runs `bun install` (dev only).
   dontNpmBuild = true;
diff --git a/packages/vit/package-lock.json b/packages/vit/package-lock.json
index 3b48b69..a1aa08b 100644
--- a/packages/vit/package-lock.json
+++ b/packages/vit/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "vit",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "vit",
-      "version": "0.6.1",
+      "version": "0.6.2",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
@@ -941,9 +941,9 @@
       }
     },
     "node_modules/cborg": {
-      "version": "5.1.7",
-      "resolved": "https://registry.npmjs.org/cborg/-/cborg-5.1.7.tgz",
-      "integrity": "sha512-rGg2MG9zZEUKtKqjkBppIWUecTXf9N1vs1Qru43vJWoDaODhCrtmzdehCaA/aq/c1cPI5A0kPrJ5Tf+jIfhV4w==",
+      "version": "5.1.11",
+      "resolved": "https://registry.npmjs.org/cborg/-/cborg-5.1.11.tgz",
+      "integrity": "sha512-oc6Pzg/gkTobxHZNgMmny+G99dOeBMbAmnGHcZWMKtolxZBIVwfi0Pj0khxEtNU8HMFdbT5sK0HmtgecDUPP0A==",
       "license": "Apache-2.0",
       "bin": {
         "cborg": "lib/bin.js"
@@ -1643,9 +1643,9 @@
       }
     },
     "node_modules/thingies": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/thingies/-/thingies-2.6.0.tgz",
-      "integrity": "sha512-rMHRjmlFLM1R96UYPvpmnc3LYtdFrT33JIB7L9hetGue1qAPfn1N2LJeEjxUSidu1Iku+haLZXDuEXUHNGO/lg==",
+      "version": "2.6.1",
+      "resolved": "https://registry.npmjs.org/thingies/-/thingies-2.6.1.tgz",
+      "integrity": "sha512-cV/CMGTK3M4MlnJ/0At6ismOw/A0EEniDNScajjz/Br3c1sqE72YD01rGpPTKwd27wAxI5Pr+6+0w8yofzFRYw==",
       "license": "MIT",
       "engines": {
         "node": ">=10.18"
@@ -1727,9 +1727,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.27.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
-      "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"
diff --git a/packages/whetuu/default.nix b/packages/whetuu/default.nix
index f0cc9d9..7e0510c 100644
--- a/packages/whetuu/default.nix
+++ b/packages/whetuu/default.nix
@@ -10,20 +10,20 @@ let
   # Asset names: whetuu-v{version}-{target}.tar.gz — each archive is a single `whetuu`.
   sources = {
     x86_64-linux = {
-      url = "https://github.com/yamafaktory/whetuu/releases/download/v0.1.5/whetuu-v0.1.5-x86_64-linux-musl.tar.gz";
-      hash = "sha256-YJ8IdY7fe1e9/H1TLer/3Dj5pl4cZUdBwR+oPuHW/4Q=";
+      url = "https://github.com/yamafaktory/whetuu/releases/download/v0.1.10/whetuu-v0.1.10-x86_64-linux-musl.tar.gz";
+      hash = "sha256-AjffM5kwAqni4UF57hm5krlv1LRjnex1KneNfO8QrUo=";
     };
     aarch64-linux = {
-      url = "https://github.com/yamafaktory/whetuu/releases/download/v0.1.5/whetuu-v0.1.5-aarch64-linux-musl.tar.gz";
-      hash = "sha256-H3EIRQH8GGuzELr5GAPt0tuvZVSaNn85fohu7Vkbq8o=";
+      url = "https://github.com/yamafaktory/whetuu/releases/download/v0.1.10/whetuu-v0.1.10-aarch64-linux-musl.tar.gz";
+      hash = "sha256-zZKD0Xn03bpxsQ7W2twKTuolOxxQs8+9ijIVYnfdybA=";
     };
     x86_64-darwin = {
-      url = "https://github.com/yamafaktory/whetuu/releases/download/v0.1.5/whetuu-v0.1.5-x86_64-macos.tar.gz";
-      hash = "sha256-8mkq3G4s7HFA6gC2pDUZ1aZBA3uAyqoK6zBgZG5nVAk=";
+      url = "https://github.com/yamafaktory/whetuu/releases/download/v0.1.10/whetuu-v0.1.10-x86_64-macos.tar.gz";
+      hash = "sha256-YKjtOrq7pTNfVQoondgnn1fzhMT4iXCZrAigqYEMvsM=";
     };
     aarch64-darwin = {
-      url = "https://github.com/yamafaktory/whetuu/releases/download/v0.1.5/whetuu-v0.1.5-aarch64-macos.tar.gz";
-      hash = "sha256-WTl+7W0zww7aMZTYfBxlSo/rofJy9EYrlhs9KrqlGyo=";
+      url = "https://github.com/yamafaktory/whetuu/releases/download/v0.1.10/whetuu-v0.1.10-aarch64-macos.tar.gz";
+      hash = "sha256-LesgX9KH09nRsu/uvPrQav/t4buXoEEsQY6DZncpH6c=";
     };
   };
 
@@ -33,7 +33,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "whetuu";
-  version = "0.1.9";
+  version = "0.1.10";
 
   src = fetchurl {
     inherit (srcAttrs) url hash;
diff --git a/packages/zed-preview/default.nix b/packages/zed-preview/default.nix
index 5d2df25..6c89786 100644
--- a/packages/zed-preview/default.nix
+++ b/packages/zed-preview/default.nix
@@ -16,11 +16,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "zed-preview";
   # Official preview channel tags are vX.Y.Z-pre (prerelease on GitHub).
-  version = "1.13.0-pre";
+  version = "1.14.1-pre";
 
   src = fetchurl {
     url = "https://github.com/zed-industries/zed/releases/download/v${finalAttrs.version}/zed-linux-x86_64.tar.gz";
-    hash = "sha256-KqqXibrYxLzt+HInAJla86wbqgVlDE4PKLha6BOflgc=";
+    hash = "sha256-K53O0foF1AJyRBcQ68AGutlY4iQohPvRHgJ5Jd+IqXk=";
   };
 
   sourceRoot = "zed-preview.app";
diff --git a/scripts/update-packages.sh b/scripts/update-packages.sh
index 4183122..4787034 100755
--- a/scripts/update-packages.sh
+++ b/scripts/update-packages.sh
@@ -91,8 +91,14 @@ set_npm_deps_hash() {
 import re, sys
 path, value = sys.argv[1], sys.argv[2]
 text = open(path).read()
-pat = re.compile(r"(npmDepsHash\s*=\s*)([^;]+)(;)")
-new, n = pat.subn(rf"\g<1>\"{value}\"\g<3>", text, count=1)
+# Line-anchored so comments mentioning npmDepsHash cannot swallow the real attr.
+pat = re.compile(r"^(\s*npmDepsHash\s*=\s*)([^;\n]+)(;)", re.M)
+
+def repl(m):
+    # Format with % to avoid quote/backslash issues inside bash single quotes.
+    return "%s\"%s\"%s" % (m.group(1), value, m.group(3))
+
+new, n = pat.subn(repl, text, count=1)
 if n != 1:
     sys.exit(f"failed to set npmDepsHash in {path} (matches={n})")
 open(path, "w").write(new)
@@ -208,13 +214,15 @@ regenerate_npm_lock() {
 set_fetch_from_github_field() {
   # set_fetch_from_github_field <file> <attr> <value>
   # Replaces attr = "..." inside the first fetchFromGitHub { ... } block.
+  # Allows one level of ${...} inside the block (e.g. rev = "v${finalAttrs.version}").
   local file="$1" attr="$2" value="$3"
   python3 -c '
 import re, sys
 path, attr, value = sys.argv[1], sys.argv[2], sys.argv[3]
 text = open(path).read()
+inner = r"(?:[^{}]|\$\{[^}]*\})*?"
 pat = re.compile(
-    rf"(fetchFromGitHub\s*\{{[^}}]*?{re.escape(attr)}\s*=\s*\")([^\"]+)(\")",
+    rf"(fetchFromGitHub\s*\{{{inner}{re.escape(attr)}\s*=\s*\")([^\"]+)(\")",
     re.S,
 )
 new, n = pat.subn(rf"\g<1>{value}\g<3>", text, count=1)
@@ -465,13 +473,15 @@ print(versions[-1])
 set_fetchurl_hash() {
   # set_fetchurl_hash <file> <value>
   # Replaces hash = "..." inside the first fetchurl { ... } block.
+  # Allows one level of ${...} in urls (e.g. v${finalAttrs.version}).
   local file="$1" value="$2"
   python3 -c '
 import re, sys
 path, value = sys.argv[1], sys.argv[2]
 text = open(path).read()
+inner = r"(?:[^{}]|\$\{[^}]*\})*?"
 pat = re.compile(
-    r"(fetchurl\s*\{[^}]*?hash\s*=\s*\")([^\"]+)(\")",
+    rf"(fetchurl\s*\{{{inner}hash\s*=\s*\")([^\"]+)(\")",
     re.S,
 )
 new, n = pat.subn(rf"\g<1>{value}\g<3>", text, count=1)
@@ -609,10 +619,12 @@ keys = [k for k in order if k in sources] + sorted(k for k in sources if k not i
 
 def fmt_entry(sysname):
     e = sources[sysname]
+    # Double-quoted dict keys: this snippet is embedded in bash single quotes.
+    url, h = e["url"], e["hash"]
     return (
         f"    {sysname} = {{\n"
-        f"      url = \"{e['url']}\";\n"
-        f"      hash = \"{e['hash']}\";\n"
+        f"      url = \"{url}\";\n"
+        f"      hash = \"{h}\";\n"
         f"    }};"
     )
 
@@ -775,13 +787,15 @@ open(path, "w").write(new)
 set_fetch_from_gitlab_field() {
   # set_fetch_from_gitlab_field <file> <attr> <value>
   # Replaces attr = "..." inside the first fetchFromGitLab { ... } block.
+  # Allows one level of ${...} inside the block.
   local file="$1" attr="$2" value="$3"
   python3 -c '
 import re, sys
 path, attr, value = sys.argv[1], sys.argv[2], sys.argv[3]
 text = open(path).read()
+inner = r"(?:[^{}]|\$\{[^}]*\})*?"
 pat = re.compile(
-    rf"(fetchFromGitLab\s*\{{[^}}]*?{re.escape(attr)}\s*=\s*\")([^\"]+)(\")",
+    rf"(fetchFromGitLab\s*\{{{inner}{re.escape(attr)}\s*=\s*\")([^\"]+)(\")",
     re.S,
 )
 new, n = pat.subn(rf"\g<1>{value}\g<3>", text, count=1)
@@ -980,30 +994,36 @@ for name in "${PACKAGES[@]}"; do
   [[ -f "$pkg_dir/default.nix" ]] || die "${name}: missing packages/${name}/default.nix"
 
   type="$(read_field "$pkg_dir/upstream.json" type)"
-  status=0
+  # Run each updater in a subshell with set -e so mid-function failures (hash
+  # rewrite, nix build) actually abort. A bare `fn || status=$?` OR-list would
+  # disable errexit inside fn; `set +e; fn; status=$?` alone inherits +e into fn.
+  set +e
   case "$type" in
     npm-github)
-      update_npm_github "$name" || status=$?
+      ( set -euo pipefail; update_npm_github "$name" )
       ;;
     github-unstable)
-      update_github_unstable "$name" || status=$?
+      ( set -euo pipefail; update_github_unstable "$name" )
       ;;
     github-release-binary)
-      update_github_release_binary "$name" || status=$?
+      ( set -euo pipefail; update_github_release_binary "$name" )
       ;;
     url-manifest-binary)
-      update_url_manifest_binary "$name" || status=$?
+      ( set -euo pipefail; update_url_manifest_binary "$name" )
       ;;
     gitlab-tag)
-      update_gitlab_tag "$name" || status=$?
+      ( set -euo pipefail; update_gitlab_tag "$name" )
       ;;
     github-tag)
-      update_github_tag "$name" || status=$?
+      ( set -euo pipefail; update_github_tag "$name" )
       ;;
     *)
+      set -e
       die "${name}: unsupported upstream type '${type}'"
       ;;
   esac
+  status=$?
+  set -e
   if [[ $status -eq 10 ]]; then
     OUTDATED=$((OUTDATED + 1))
   elif [[ $status -ne 0 ]]; then