diff --git a/.github/workflows/sanity_checks.yml b/.github/workflows/sanity_checks.yml
index 62ab06f7a..94bc1c963 100644
--- a/.github/workflows/sanity_checks.yml
+++ b/.github/workflows/sanity_checks.yml
@@ -56,16 +56,12 @@ jobs:
           fetch-depth: 0
 
       # Install a 32-bit Python so building related stuff work.
-      - name: Setup x86 Python (1/2)
+      - name: Setup x86 Python
         if: matrix.platform == 'x86'
         uses: actions/setup-python@v5
         with:
           architecture: 'x86'
           python-version: '3.12'
-      - name: Setup x86 Python (2/2)
-        if: matrix.platform == 'x86'
-        # Note: GLib needs `packaging`.
-        run: python -m pip install packaging
 
       # https://github.com/actions/runner-images/issues/5459#issuecomment-1532856844
       - name: Remove bad Strawberry Perl patch binary in search path
@@ -155,14 +151,18 @@ jobs:
           fetch-depth: 0
 
       - run: brew update
-      # github actions overwrites brew's python. Force it to reassert itself, by running in a separate step.
-      - name: unbreak python in github actions
-        run: |
-          find $(brew --prefix)/bin -lname '*/Library/Frameworks/Python.framework/*' -delete
-          sudo rm -rf /Library/Frameworks/Python.framework/
-          brew install --force --quiet python3 && brew unlink python3 && brew unlink python3 && brew link --overwrite python3
-          # Work around PEP 668 nonsense…
-          find $(brew --prefix)/Cellar/python* -name EXTERNALLY-MANAGED -print0 | xargs -0 rm -vf
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - run: |
+          set -x
+          which python
+          python --version
+          which python3
+          python --version
+
       - name: Install packages
         run: |
           brew install ninja
diff --git a/ci_config.json b/ci_config.json
index ef8f412b1..ec760ea9a 100644
--- a/ci_config.json
+++ b/ci_config.json
@@ -260,8 +260,8 @@
     "alpine_packages": [
       "shared-mime-info"
     ],
-    "msys_packages": [
-      "python-packaging"
+    "python_packages": [
+      "packaging"
     ],
     "fatal_warnings": false,
     "skip_tests": true
@@ -334,14 +334,11 @@
     "alpine_packages": [
       "gettext-tiny-dev"
     ],
-    "brew_packages": [
-      "python-packaging"
-    ],
     "build_options": [
       "glib:tests=false"
     ],
-    "msys_packages": [
-      "python-packaging"
+    "python_packages": [
+      "packaging"
     ],
     "skip_dependency_check": [
       "gio-windows-2.0",
@@ -393,8 +390,10 @@
       "harfbuzz:icu=enabled"
     ],
     "msys_packages": [
-      "icu",
-      "python-packaging"
+      "icu"
+    ],
+    "python_packages": [
+      "packaging"
     ],
     "skip_dependency_check": [
       "harfbuzz-cairo"
diff --git a/releases.json b/releases.json
index 971a7dc71..ac497c755 100644
--- a/releases.json
+++ b/releases.json
@@ -398,6 +398,7 @@
       "cli11"
     ],
     "versions": [
+      "2.4.2-1",
       "2.4.1-1",
       "2.3.2-1",
       "2.2.0-1",
@@ -452,6 +453,7 @@
       "cpp-httplib"
     ],
     "versions": [
+      "0.17.3-1",
       "0.17.1-1",
       "0.16.3-1",
       "0.15.3-1",
@@ -2439,6 +2441,7 @@
       "nativefiledialog-extended"
     ],
     "versions": [
+      "1.2.1-1",
       "1.1.1-2",
       "1.1.1-1"
     ]
@@ -3086,6 +3089,7 @@
       "sdl2_test"
     ],
     "versions": [
+      "2.30.6-2",
       "2.30.6-1",
       "2.30.3-3",
       "2.30.3-2",
diff --git a/subprojects/cli11.wrap b/subprojects/cli11.wrap
index 76c5bdfe1..153942dd1 100644
--- a/subprojects/cli11.wrap
+++ b/subprojects/cli11.wrap
@@ -1,9 +1,9 @@
 [wrap-file]
-directory = CLI11-2.4.1
+directory = CLI11-2.4.2
 
-source_url = https://github.com/CLIUtils/CLI11/archive/refs/tags/v2.4.1.tar.gz
-source_filename = CLI11-2.4.1.tar.gz
-source_hash = 73b7ec52261ce8fe980a29df6b4ceb66243bb0b779451dbd3d014cfec9fdbb58
+source_url = https://github.com/CLIUtils/CLI11/archive/refs/tags/v2.4.2.tar.gz
+source_filename = CLI11-2.4.2.tar.gz
+source_hash = f2d893a65c3b1324c50d4e682c0cdc021dd0477ae2c048544f39eed6654b699a
 
 [provide]
 cli11 = CLI11_dep
diff --git a/subprojects/cpp-httplib.wrap b/subprojects/cpp-httplib.wrap
index 16cd4a996..4b12831db 100644
--- a/subprojects/cpp-httplib.wrap
+++ b/subprojects/cpp-httplib.wrap
@@ -1,8 +1,8 @@
 [wrap-file]
-directory = cpp-httplib-0.17.1
-source_url = https://github.com/yhirose/cpp-httplib/archive/refs/tags/v0.17.1.tar.gz
-source_filename = cpp-httplib-0.17.1.tar.gz
-source_hash = 044c5a233da242e981d9543dd136a5945e0549c5641a0373934db88bbd192f41
+directory = cpp-httplib-0.17.3
+source_url = https://github.com/yhirose/cpp-httplib/archive/refs/tags/v0.17.3.tar.gz
+source_filename = cpp-httplib-0.17.3.tar.gz
+source_hash = 95bd6dba4241656c59d6f0854d408d14c220f7c71e673319ee27d30aee741aaa
 
 [provide]
 cpp-httplib = cpp_httplib_dep
diff --git a/subprojects/nativefiledialog-extended.wrap b/subprojects/nativefiledialog-extended.wrap
index 5ca29f404..a252eb14d 100644
--- a/subprojects/nativefiledialog-extended.wrap
+++ b/subprojects/nativefiledialog-extended.wrap
@@ -1,8 +1,8 @@
 [wrap-file]
-directory = nativefiledialog-extended-1.1.1
-source_url = https://github.com/btzy/nativefiledialog-extended/archive/refs/tags/v1.1.1.tar.gz
-source_filename = nativefiledialog-extended-1.1.1.tar.gz
-source_hash = 8cce60cb9c046a6fb86a86e7f71d95017dd3353e1596180a6c60f5592f7cc0cb
+directory = nativefiledialog-extended-1.2.1
+source_url = https://github.com/btzy/nativefiledialog-extended/archive/refs/tags/v1.2.1.tar.gz
+source_filename = nativefiledialog-extended-1.2.1.tar.gz
+source_hash = 443697a857c4efacbe08cdaf5182724fa9d9b9a79b8feff2a1601bde1df46b07
 patch_directory = nativefiledialog-extended
 
 [provide]
diff --git a/subprojects/packagefiles/nativefiledialog-extended/meson.build b/subprojects/packagefiles/nativefiledialog-extended/meson.build
index c7c840e6d..2384365f9 100644
--- a/subprojects/packagefiles/nativefiledialog-extended/meson.build
+++ b/subprojects/packagefiles/nativefiledialog-extended/meson.build
@@ -1,7 +1,7 @@
 project(
     'nativefiledialog-extended',
     'cpp',
-    version: '1.1.1',
+    version: '1.2.1',
     license: 'Zlib',
     meson_version: '>=1.2.0',
     default_options: {
diff --git a/subprojects/packagefiles/nativefiledialog-extended/meson_options.txt b/subprojects/packagefiles/nativefiledialog-extended/meson_options.txt
index 056479b6c..02d96ddbd 100644
--- a/subprojects/packagefiles/nativefiledialog-extended/meson_options.txt
+++ b/subprojects/packagefiles/nativefiledialog-extended/meson_options.txt
@@ -1,5 +1,4 @@
 
-
 option(
     'tests',
     type: 'boolean',
@@ -11,7 +10,7 @@ option(
     'xdg-desktop-portal',
     type: 'feature',
     value: 'auto',
-    description: 'Use xdg-desktop-portal instead of GTK (linux only',
+    description: 'Use xdg-desktop-portal instead of GTK (linux only)',
 )
 
 option(
@@ -27,5 +26,3 @@ option(
     value: 'auto',
     description: 'Use allowedContentTypes for filter lists on macOS >= 11.0',
 )
-
-
diff --git a/subprojects/packagefiles/sdl2/meson.build b/subprojects/packagefiles/sdl2/meson.build
index 51ba95de9..54c05806c 100644
--- a/subprojects/packagefiles/sdl2/meson.build
+++ b/subprojects/packagefiles/sdl2/meson.build
@@ -759,7 +759,7 @@ foreach _spec : [
   _hdr = _spec[0]
   _spec = _spec.get(1, {})
   _deps = _spec.get('deps', [])
-  if not cc.has_header(_hdr, dependencies: _deps)
+  if not cc.check_header(_hdr, dependencies: _deps)
     continue
   endif
   cdata.set('HAVE_@0@'.format(_hdr.to_upper().underscorify()), 1)
diff --git a/tools/sanity_checks.py b/tools/sanity_checks.py
index 92ea92cd0..c6f550ce3 100755
--- a/tools/sanity_checks.py
+++ b/tools/sanity_checks.py
@@ -368,18 +368,19 @@ def check_new_release(self, name: str, builddir: str = '_build', deps=None, prog
         choco_packages = ci.get('choco_packages', [])
         msys_packages = ci.get('msys_packages', [])
         alpine_packages = ci.get('alpine_packages', [])
+        python_packages = ci.get('python_packages', [])
         meson_env = os.environ.copy()
-        def install_packages(cmd, packages):
+        def install_packages(kind, cmd, packages):
             if is_ci():
-                with ci_group('install packages'):
+                with ci_group('install {} packages'.format(kind)):
                     subprocess.check_call(cmd + packages)
             else:
                 s = ', '.join(packages)
                 print(f'The following packages could be required: {s}')
         if debian_packages and is_debianlike():
-            install_packages(['sudo', 'apt-get', '-y', 'install', '--no-install-recommends'], debian_packages)
+            install_packages('Debian', ['sudo', 'apt-get', '-y', 'install', '--no-install-recommends'], debian_packages)
         elif brew_packages and is_macos():
-            install_packages(['brew', 'install', '--quiet'], brew_packages)
+            install_packages('Homebrew', ['brew', 'install', '--quiet'], brew_packages)
             if is_ci():
                 # Ensure binaries from keg-only formulas are available (e.g. bison).
                 out = subprocess.check_output(['brew', '--prefix'] + brew_packages)
@@ -388,15 +389,17 @@ def install_packages(cmd, packages):
                     if bindir.exists():
                         meson_env['PATH'] = str(bindir) + ':' + meson_env['PATH']
         elif choco_packages and is_windows():
-            install_packages(['choco', 'install', '-y'], choco_packages)
+            install_packages('Chocolatey', ['choco', 'install', '-y'], choco_packages)
             if is_ci() and 'nasm' in choco_packages:
                 # nasm is not added into PATH by default:
                 # https://bugzilla.nasm.us/show_bug.cgi?id=3392224.
                 meson_env['PATH'] = 'C:\\Program Files\\NASM;' + meson_env['PATH']
         elif msys_packages and is_msys():
-            install_packages(['sh', '-lc', 'pacboy --noconfirm sync $(printf "%s:p " $@)', 'pacboy'], msys_packages)
+            install_packages('MSYS2', ['sh', '-lc', 'pacboy --noconfirm sync $(printf "%s:p " $@)', 'pacboy'], msys_packages)
         elif alpine_packages and is_alpinelike():
-            install_packages(['sudo', 'apk', 'add'], alpine_packages)
+            install_packages('Alpine', ['sudo', 'apk', 'add'], alpine_packages)
+        if python_packages:
+            install_packages('Python', [sys.executable, '-m', 'pip', 'install'], python_packages)
 
         res = subprocess.run(['meson', 'setup', builddir] + options, env=meson_env)
         log_file = Path(builddir, 'meson-logs', 'meson-log.txt')