diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3aeb6c6f3b37..195207a11aa9 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2747,6 +2747,12 @@
     githubId = 34620799;
     name = "Jacob Bachmann";
   };
+  bcooley = {
+    email = "bradley.m.cooley@gmail.com";
+    github = "Bradley-Cooley";
+    githubId = 5409401;
+    name = "Bradley Cooley";
+  };
   bcyran = {
     email = "bazyli@cyran.dev";
     github = "bcyran";
@@ -16672,6 +16678,13 @@
     github = "nipeharefa";
     githubId = 12620257;
   };
+  niraethm = {
+    name = "Rémi Akirazar";
+    email = "randormi@devcpu.co";
+    matrix = "@lysgonul:bark.lgbt";
+    github = "niraethm";
+    githubId = 20865531;
+  };
   NIS = {
     name = "NSC IT Solutions";
     github = "dev-nis";
diff --git a/maintainers/scripts/kde/generate-sources.py b/maintainers/scripts/kde/generate-sources.py
index e7c52368363a..b03ef3cc5f6b 100755
--- a/maintainers/scripts/kde/generate-sources.py
+++ b/maintainers/scripts/kde/generate-sources.py
@@ -5,7 +5,7 @@ import binascii
 import json
 import pathlib
 from typing import Optional
-from urllib.parse import urlparse
+from urllib.parse import urljoin, urlparse
 
 import bs4
 import click
@@ -72,32 +72,42 @@ def main(set: str, version: str, nixpkgs: pathlib.Path, sources_url: Optional[st
 
     if sources_url is None:
         set_url = {
-            "frameworks": "kf",
-            "gear": "releases",
-            "plasma": "plasma",
+            "frameworks": f"frameworks/{version}/",
+            "gear": f"release-service/{version}/src/",
+            "plasma": f"plasma/{version}/",
         }[set]
-        sources_url = f"https://kde.org/info/sources/source-{set_url}-{version}/"
+        sources_url = f"https://download.kde.org/stable/{set_url}"
 
-    sources = httpx.get(sources_url)
+    client = httpx.Client()
+    sources = client.get(sources_url)
     sources.raise_for_status()
     bs = bs4.BeautifulSoup(sources.text, features="html.parser")
 
     results = {}
-    for item in bs.select("tr")[1:]:
-        link = item.select_one("td:nth-child(1) a")
-        assert link
+    for item in bs.select("tr")[3:]:
+        link = item.select_one("td:nth-child(2) a")
+        if not link:
+            continue
 
-        hash = item.select_one("td:nth-child(3) tt")
-        assert hash
+        project_name, version_and_ext = link.text.rsplit("-", maxsplit=1)
 
-        project_name, version = link.text.rsplit("-", maxsplit=1)
         if project_name not in metadata.projects_by_name:
             print(f"Warning: unknown tarball: {project_name}")
 
+        if version_and_ext.endswith(".sig"):
+            continue
+
+        version = version_and_ext.removesuffix(".tar.xz")
+
+        url = urljoin(sources_url, link.attrs["href"])
+
+        hash = client.get(url + ".sha256").text.split(" ", maxsplit=1)[0]
+        assert hash
+
         results[project_name] = {
             "version": version,
-            "url": "mirror://kde" + urlparse(link.attrs["href"]).path,
-            "hash": to_sri(hash.text)
+            "url": "mirror://kde" + urlparse(url).path,
+            "hash": to_sri(hash)
         }
 
         pkg_dir = set_dir / project_name
diff --git a/nixos/tests/systemd-timesyncd.nix b/nixos/tests/systemd-timesyncd.nix
index d50b6386786c..b1f618d947cd 100644
--- a/nixos/tests/systemd-timesyncd.nix
+++ b/nixos/tests/systemd-timesyncd.nix
@@ -26,13 +26,18 @@ import ./make-test-python.nix (
           # create the path that should be migrated by our activation script when
           # upgrading to a newer nixos version
           system.stateVersion = "19.03";
-          systemd.tmpfiles.settings.systemd-timesyncd-test = {
-            "/var/lib/systemd/timesync".R = { };
-            "/var/lib/systemd/timesync".L.argument = "/var/lib/private/systemd/timesync";
-            "/var/lib/private/systemd/timesync".d = {
-              user = "systemd-timesync";
-              group = "systemd-timesync";
-            };
+          systemd.services.old-timesync-state-dir = {
+            requiredBy = [ "sysinit.target" ];
+            before = [ "systemd-timesyncd.service" ];
+            after = [ "local-fs.target" ];
+            unitConfig.DefaultDependencies = false;
+            serviceConfig.Type = "oneshot";
+            script = ''
+              rm -rf /var/lib/systemd/timesync
+              mkdir -p /var/lib/systemd /var/lib/private/systemd/timesync
+              ln -s /var/lib/private/systemd/timesync /var/lib/systemd/timesync
+              chown systemd-timesync: /var/lib/private/systemd/timesync
+            '';
           };
         }
       );
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
index 059e9c1733f3..2f5c42d5af2b 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/cmp-async-path/default.nix
@@ -7,7 +7,7 @@
 }:
 vimUtils.buildVimPlugin {
   pname = "cmp-async-path";
-  version = "unstable-2024-10-21";
+  version = "0-unstable-2024-10-21";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
@@ -19,7 +19,9 @@ vimUtils.buildVimPlugin {
 
   checkInputs = [ vimPlugins.nvim-cmp ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
 
   meta = {
     description = "Nvim-cmp source for filesystem paths with async processing";
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/nvim-julia-autotest/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/nvim-julia-autotest/default.nix
index 2a0fc95ef84b..032705f8359b 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/nvim-julia-autotest/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/nvim-julia-autotest/default.nix
@@ -6,7 +6,7 @@
 }:
 vimUtils.buildVimPlugin {
   pname = "nvim-julia-autotest";
-  version = "unstable-2022-10-31";
+  version = "0-unstable-2022-10-31";
 
   src = fetchFromGitLab {
     owner = "usmcamp0811";
@@ -15,7 +15,9 @@ vimUtils.buildVimPlugin {
     hash = "sha256-IaNsbBe5q7PB9Q/N/Z9nEnP6jlkQ6+xlkC0TCFnJpkk=";
   };
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
 
   meta = {
     description = "Automatically run Julia tests when you save runtest.jl file";
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/vim-stationeers-ic10-syntax/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/vim-stationeers-ic10-syntax/default.nix
index d6818ed03173..e78ad5e630f9 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/vim-stationeers-ic10-syntax/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/vim-stationeers-ic10-syntax/default.nix
@@ -6,7 +6,7 @@
 }:
 vimUtils.buildVimPlugin {
   pname = "vim-ic10";
-  version = "unstable-2025-01-08";
+  version = "0-unstable-2025-01-08";
 
   src = fetchFromGitLab {
     owner = "LittleMorph";
@@ -15,7 +15,9 @@ vimUtils.buildVimPlugin {
     hash = "sha256-4Q1JiDA7PBUWNBNfCIZC6nImhe2FJzOqrslHazAOs18=";
   };
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
 
   meta = {
     description = "Stationeers IC10 syntax highlighting for Vim";
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 4ca91ebe85bf..a0b59e0362a9 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3126,6 +3126,8 @@ let
         };
       };
 
+      marus25.cortex-debug = callPackage ./marus25.cortex-debug { };
+
       matangover.mypy = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "mypy";
diff --git a/pkgs/applications/editors/vscode/extensions/marus25.cortex-debug/default.nix b/pkgs/applications/editors/vscode/extensions/marus25.cortex-debug/default.nix
new file mode 100644
index 000000000000..e0fcee449198
--- /dev/null
+++ b/pkgs/applications/editors/vscode/extensions/marus25.cortex-debug/default.nix
@@ -0,0 +1,18 @@
+{ lib, vscode-utils }:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "cortex-debug";
+    publisher = "marus25";
+    version = "1.6.10";
+    hash = "sha256-6b3JDkX6Xd91VE1h7gYyeukxLsBkn/nNzDQgBm0axRA=";
+  };
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/marus25.cortex-debug/changelog";
+    description = "Visual Studio Code extension for enhancing debug capabilities for Cortex-M Microcontrollers";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=marus25.cortex-debug";
+    homepage = "https://github.com/Marus/cortex-debug";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.bcooley ];
+  };
+}
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index b513aa380489..d0d8a85bc199 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -220,6 +220,7 @@ stdenv.mkDerivation rec {
       "InstantMessaging"
     ];
     mimeTypes = [ "x-scheme-handler/discord" ];
+    startupWMClass = "discord";
   };
 
   passthru = {
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 5c29d3c718f1..33370e9815e7 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -527,6 +527,8 @@ in stdenv.mkDerivation (finalAttrs: {
   ] ++ (if variant == "fresh" then [
     "--with-system-rhino"
     "--with-rhino-jar=${rhino}/share/java/js.jar"
+
+    "--without-system-java-websocket"
   ] else [
     # our Rhino is too new for older versions
     "--without-system-rhino"
@@ -656,15 +658,15 @@ in stdenv.mkDerivation (finalAttrs: {
 
   requiredSystemFeatures = [ "big-parallel" ];
 
-  meta = with lib; {
+  meta = {
     changelog = "https://wiki.documentfoundation.org/ReleaseNotes/${lib.versions.majorMinor version}";
     description = "Comprehensive, professional-quality productivity suite, a variant of openoffice.org";
     homepage = "https://libreoffice.org/";
     # at least one jar in dependencies
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    license = licenses.lgpl3;
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    license = with lib.licenses; [ mpl20 lgpl3Plus asl20 ];
+    maintainers = with lib.maintainers; [ raskin ];
+    platforms = lib.platforms.linux;
     mainProgram = "libreoffice";
   };
 })
diff --git a/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch b/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch
index e19711b706e4..f1cd5c261d04 100644
--- a/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch
+++ b/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch
@@ -43,63 +43,6 @@
      createSwDoc("tdf150606-1-min.odt");
  
      SwXTextDocument* pTextDoc = dynamic_cast<SwXTextDocument*>(mxComponent.get());
---- a/sw/qa/extras/layout/layout3.cxx
-+++ b/sw/qa/extras/layout/layout3.cxx
-@@ -3354,6 +3354,9 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf104209VertRTL)
- 
- CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408LTR)
- {
-+    return; // requests Noto Sans Hebrew with charset=28, which the font does not have
-+            // FIXME: investigate
-+
-     // Verify that line breaking a first bidi portion correctly underflows in LTR text
-     createSwDoc("tdf56408-ltr.fodt");
-     auto pXmlDoc = parseLayoutDump();
-@@ -3368,6 +3371,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408LTR)
- 
- CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408RTL)
- {
-+    return; // same Noto Sans Hebrew issue
-+
-     // Verify that line breaking a first bidi portion correctly underflows in RTL text
-     createSwDoc("tdf56408-rtl.fodt");
-     auto pXmlDoc = parseLayoutDump();
-@@ -3382,6 +3387,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408RTL)
- 
- CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408NoUnderflow)
- {
-+    return; // same Noto Sans Hebrew issue
-+
-     // The fix for tdf#56408 introduced a change to line breaking between text with
-     // direction changes. This test verifies behavior in the trivial case, when a
-     // break opportunity exists at the direction change boundary.
-@@ -3398,6 +3405,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408NoUnderflow)
- 
- CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408AfterFieldCrash)
- {
-+    return; // same Noto Sans Hebrew issue
-+
-     // Verify there is no crash/assertion for underflow after a number field
-     createSwDoc("tdf56408-after-field.fodt");
- }
-@@ -3436,6 +3445,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf146081)
- 
- CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf157829LTR)
- {
-+    return; // same Noto Sans Hebrew issue
-+
-     // Verify that line breaking inside a bidi portion triggers underflow to previous bidi portions
-     createSwDoc("tdf157829-ltr.fodt");
-     auto pXmlDoc = parseLayoutDump();
-@@ -3450,6 +3461,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf157829LTR)
- 
- CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf157829RTL)
- {
-+    return; // same Noto Sans Hebrew issue
-+
-     // Verify that line breaking inside a bidi portion triggers underflow to previous bidi portions
-     createSwDoc("tdf157829-rtl.fodt");
-     auto pXmlDoc = parseLayoutDump();
 --- a/sw/qa/extras/tiledrendering/tiledrendering.cxx
 +++ b/sw/qa/extras/tiledrendering/tiledrendering.cxx
 @@ -4091,6 +4091,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testRedlineTooltip)
@@ -111,3 +54,63 @@
      SwXTextDocument* pXTextDocument = createDoc();
      int nView1 = SfxLokHelper::getView();
  
+--- a/sw/qa/extras/layout/layout4.cxx
++++ b/sw/qa/extras/layout/layout4.cxx
+@@ -1518,6 +1518,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf104209VertRTL)
+
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf56408LTR)
+ {
++    return; // fails due to missing font: Noto Sans Hebrew
+     // Verify that line breaking a first bidi portion correctly underflows in LTR text
+     createSwDoc("tdf56408-ltr.fodt");
+     auto pXmlDoc = parseLayoutDump();
+@@ -1532,6 +1532,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf56408LTR)
+ 
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf56408RTL)
+ {
++    return; // fails due to missing font: Noto Sans Hebrew
+     // Verify that line breaking a first bidi portion correctly underflows in RTL text
+     createSwDoc("tdf56408-rtl.fodt");
+     auto pXmlDoc = parseLayoutDump();
+@@ -1546,6 +1547,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf56408RTL)
+
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf56408NoUnderflow)
+ {
++    return; // fails due to missing font: Noto Sans Hebrew
+     // The fix for tdf#56408 introduced a change to line breaking between text with
+     // direction changes. This test verifies behavior in the trivial case, when a
+     // break opportunity exists at the direction change boundary.
+@@ -1562,6 +1563,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf56408NoUnderflow)
+ 
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf56408AfterFieldCrash)
+ {
++    return; // fails due to missing font: Noto Sans Hebrew
+     // Verify there is no crash/assertion for underflow after a number field
+     createSwDoc("tdf56408-after-field.fodt");
+ }
+@@ -1612,6 +1614,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf155229RowAtLeast)
+ 
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf157829LTR)
+ {
++    return; // fails due to missing font: Noto Sans Hebrew
+     // Verify that line breaking inside a bidi portion triggers underflow to previous bidi portions
+     createSwDoc("tdf157829-ltr.fodt");
+     auto pXmlDoc = parseLayoutDump();
+@@ -1626,6 +1629,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf157829LTR)
+ 
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter4, TestTdf157829RTL)
+ {
++    return; // fails due to missing font: Noto Sans Hebrew
+     // Verify that line breaking inside a bidi portion triggers underflow to previous bidi portions
+     createSwDoc("tdf157829-rtl.fodt");
+     auto pXmlDoc = parseLayoutDump();
+--- a/vcl/qa/cppunit/pdfexport/pdfexport2.cxx
++++ b/vcl/qa/cppunit/pdfexport/pdfexport2.cxx
+@@ -6079,6 +6079,7 @@ CPPUNIT_TEST_FIXTURE(PdfExportTest2, testTdf162750SmallCapsLigature)
+
+ CPPUNIT_TEST_FIXTURE(PdfExportTest2, testTdf164106SplitReorderedClusters)
+ {
++    return; // fails due to missing font: Noto Sans
+     saveAsPDF(u"tdf164106.fodt");
+
+     auto pPdfDocument = parsePDFExport();
diff --git a/pkgs/applications/office/libreoffice/skip-broken-tests-still.patch b/pkgs/applications/office/libreoffice/skip-broken-tests-still.patch
index e7064d108552..c3442d43c485 100644
--- a/pkgs/applications/office/libreoffice/skip-broken-tests-still.patch
+++ b/pkgs/applications/office/libreoffice/skip-broken-tests-still.patch
@@ -1,14 +1,24 @@
 --- a/sc/qa/extras/vba-macro-test.cxx
 +++ b/sc/qa/extras/vba-macro-test.cxx
-@@ -364,7 +364,7 @@ CPPUNIT_TEST_FIXTURE(VBAMacroTest, testVba)
+@@ -355,7 +355,7 @@ CPPUNIT_TEST_FIXTURE(VBAMacroTest, testVba)
  // Failed:  : Test change event for Range.FillRight:
  // Tests passed: 4
  // Tests failed: 4
 -#if !defined(_WIN32)
 +#if 0 // flaky, see above
-         { OUString("Ranges-3.xls"),
-           OUString(
-               "vnd.sun.Star.script:VBAProject.testMacros.test?language=Basic&location=document") },
+         { u"Ranges-3.xls"_ustr,
+           u"vnd.sun.Star.script:VBAProject.testMacros.test?language=Basic&location=document"_ustr },
+ #endif
+--- a/sc/qa/unit/tiledrendering/tiledrendering.cxx
++++ b/sc/qa/unit/tiledrendering/tiledrendering.cxx
+@@ -2954,6 +2954,7 @@ CPPUNIT_TEST_FIXTURE(ScTiledRenderingTest, testCommentCellCopyPaste)
+ 
+ CPPUNIT_TEST_FIXTURE(ScTiledRenderingTest, testInvalidEntrySave)
+ {
++    return; // hangs (forever?)
+     loadFromFile(u"validity.xlsx");
+ 
+     // .uno:Save modifies the original file, make a copy first
 --- a/sc/qa/unit/ucalc_formula.cxx
 +++ b/sc/qa/unit/ucalc_formula.cxx
 @@ -1507,6 +1507,8 @@ CPPUNIT_TEST_FIXTURE(TestFormula, testFormulaAnnotateTrimOnDoubleRefs)
@@ -17,13 +27,63 @@
  {
 +    return; // fails consistently on nixpkgs?
 +
-     m_pDoc->InsertTab(0, "Formula");
+     m_pDoc->InsertTab(0, u"Formula"_ustr);
  
      sc::AutoCalcSwitch aACSwitch(*m_pDoc, true); // turn auto calc on.
+--- a/sw/qa/extras/layout/layout3.cxx
++++ b/sw/qa/extras/layout/layout3.cxx
+@@ -3640,6 +3642,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf104209VertRTL)
+
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408LTR)
+ {
++    return; // fails due to missing font: Noto Sans Hebrew
+     // Verify that line breaking a first bidi portion correctly underflows in LTR text
+     createSwDoc("tdf56408-ltr.fodt");
+     auto pXmlDoc = parseLayoutDump();
+@@ -3654,6 +3656,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408LTR)
+ 
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408RTL)
+ {
++    return; // fails due to missing font: Noto Sans Hebrew
+     // Verify that line breaking a first bidi portion correctly underflows in RTL text
+     createSwDoc("tdf56408-rtl.fodt");
+     auto pXmlDoc = parseLayoutDump();
+@@ -3671,6 +3671,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408RTL)
+
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408NoUnderflow)
+ {
++    return; // fails due to missing font: Noto Sans Hebrew
+     // The fix for tdf#56408 introduced a change to line breaking between text with
+     // direction changes. This test verifies behavior in the trivial case, when a
+     // break opportunity exists at the direction change boundary.
+@@ -3684,6 +3687,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408NoUnderflow)
+ 
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408AfterFieldCrash)
+ {
++    return; // fails due to missing font: Noto Sans Hebrew
+     // Verify there is no crash/assertion for underflow after a number field
+     createSwDoc("tdf56408-after-field.fodt");
+ }
+@@ -3722,6 +3722,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf146081)
+
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf157829LTR)
+ {
++    return; // fails due to missing font: Noto Sans Hebrew
+     // Verify that line breaking inside a bidi portion triggers underflow to previous bidi portions
+     createSwDoc("tdf157829-ltr.fodt");
+     auto pXmlDoc = parseLayoutDump();
+@@ -3736,6 +3740,7 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf157829LTR)
+ 
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf157829RTL)
+ {
++    return; // fails due to missing Noto Sans Hebrew
+     // Verify that line breaking inside a bidi portion triggers underflow to previous bidi portions
+     createSwDoc("tdf157829-rtl.fodt");
+     auto pXmlDoc = parseLayoutDump();
 --- a/sw/qa/extras/tiledrendering/tiledrendering.cxx
 +++ b/sw/qa/extras/tiledrendering/tiledrendering.cxx
-@@ -685,6 +685,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testSearchAll)
-
+@@ -700,6 +700,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testSearchAll)
+ 
  CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testSearchAllNotifications)
  {
 +    return; // flaky on GTK
@@ -31,8 +91,8 @@
      SwXTextDocument* pXTextDocument = createDoc("search.odt");
      SwWrtShell* pWrtShell = pXTextDocument->GetDocShell()->GetWrtShell();
      setupLibreOfficeKitViewCallback(pWrtShell->GetSfxViewShell());
-@@ -949,6 +951,8 @@ namespace {
-
+@@ -970,6 +972,8 @@ namespace {
+ 
  CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testMissingInvalidation)
  {
 +    return; // flaky on GTK
@@ -40,8 +100,8 @@
      // Create two views.
      SwXTextDocument* pXTextDocument = createDoc("dummy.fodt");
      ViewCallback aView1;
-@@ -982,6 +986,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testMissingInvalidation)
-
+@@ -1003,6 +1007,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testMissingInvalidation)
+ 
  CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testViewCursors)
  {
 +    return; // flaky on GTK
@@ -49,8 +109,8 @@
      SwXTextDocument* pXTextDocument = createDoc("dummy.fodt");
      ViewCallback aView1;
      SfxLokHelper::createView();
-@@ -3189,6 +3189,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testRedlineNotificationDuringSave)
-
+@@ -3197,6 +3203,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testRedlineNotificationDuringSave)
+ 
  CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testHyperlink)
  {
 +    return; // flaky on GTK
@@ -58,12 +118,12 @@
      comphelper::LibreOfficeKit::setViewIdForVisCursorInvalidation(true);
      SwXTextDocument* pXTextDocument = createDoc("hyperlink.odt");
      SwWrtShell* pWrtShell = pXTextDocument->GetDocShell()->GetWrtShell();
-@@ -3399,6 +3401,8 @@ static void lcl_extractHandleParameters(std::string_view selection, sal_Int32& i
-
+@@ -3407,6 +3415,8 @@ static void lcl_extractHandleParameters(std::string_view selection, sal_Int32& i
+ 
  CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testMoveShapeHandle)
  {
 +    return; // flaky on GTK
 +
      comphelper::LibreOfficeKit::setActive();
      SwXTextDocument* pXTextDocument = createDoc("shape.fodt");
-
+ 
diff --git a/pkgs/applications/office/libreoffice/skip-broken-tests.patch b/pkgs/applications/office/libreoffice/skip-broken-tests.patch
index 3f45a7cda9db..959510958a7e 100644
--- a/pkgs/applications/office/libreoffice/skip-broken-tests.patch
+++ b/pkgs/applications/office/libreoffice/skip-broken-tests.patch
@@ -1,7 +1,7 @@
 --- a/desktop/qa/desktop_lib/test_desktop_lib.cxx
 +++ b/desktop/qa/desktop_lib/test_desktop_lib.cxx
-@@ -600,6 +600,8 @@ void DesktopLOKTest::testGetFilterTypes()
-
+@@ -595,6 +595,8 @@ void DesktopLOKTest::testGetFilterTypes()
+ 
  void DesktopLOKTest::testSearchCalc()
  {
 +    return; // flaky
@@ -9,8 +9,8 @@
      LibLibreOffice_Impl aOffice;
      LibLODocument_Impl* pDocument = loadDoc("search.ods");
      pDocument->pClass->initializeForRendering(pDocument, nullptr);
-@@ -630,6 +632,8 @@ void DesktopLOKTest::testSearchCalc()
-
+@@ -625,6 +627,8 @@ void DesktopLOKTest::testSearchCalc()
+ 
  void DesktopLOKTest::testSearchAllNotificationsCalc()
  {
 +    return; // flaky
@@ -30,8 +30,8 @@
    </switch>
 --- a/sw/qa/core/accessibilitycheck/AccessibilityCheckTest.cxx
 +++ b/sw/qa/core/accessibilitycheck/AccessibilityCheckTest.cxx
-@@ -284,6 +284,8 @@ void checkIssuePosition(std::shared_ptr<sfx::AccessibilityIssue> const& pIssue,
-
+@@ -361,6 +361,8 @@ void checkIssuePosition(std::shared_ptr<sfx::AccessibilityIssue> const& pIssue,
+ 
  CPPUNIT_TEST_FIXTURE(AccessibilityCheckTest, testOnlineNodeSplitAppend)
  {
 +    return; // flaky?
@@ -41,7 +41,7 @@
      // happen on editing all the time.
 --- a/sw/qa/core/text/text.cxx
 +++ b/sw/qa/core/text/text.cxx
-@@ -1577,6 +1577,8 @@ CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testParaUpperMarginFlyIntersect)
+@@ -1630,6 +1630,8 @@ CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testParaUpperMarginFlyIntersect)
  
  CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testTdf129810)
  {
@@ -52,7 +52,7 @@
      // even when the font is not installed.
 --- a/sw/qa/extras/htmlimport/htmlimport.cxx
 +++ b/sw/qa/extras/htmlimport/htmlimport.cxx
-@@ -306,6 +306,8 @@ CPPUNIT_TEST_FIXTURE(HtmlImportTest, testTableBorder1px)
+@@ -308,6 +308,8 @@ CPPUNIT_TEST_FIXTURE(HtmlImportTest, testTableBorder1px)
  
  CPPUNIT_TEST_FIXTURE(HtmlImportTest, testOutlineLevel)
  {
@@ -63,18 +63,18 @@
      // Heading 1 styles.
 --- a/sw/qa/extras/layout/layout3.cxx
 +++ b/sw/qa/extras/layout/layout3.cxx
-@@ -539,6 +539,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, testTdf120287c)
-
+@@ -1038,6 +1038,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, testTdf158658c)
+ 
  CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, testTdf155177)
  {
 +    return; // flaky
 +
      createSwDoc("tdf155177-1-min.odt");
-
-     uno::Reference<beans::XPropertySet> xStyle(getStyles("ParagraphStyles")->getByName("Body Text"),
+ 
+     uno::Reference<beans::XPropertySet> xStyle(
 --- a/sw/qa/extras/odfimport/odfimport.cxx
 +++ b/sw/qa/extras/odfimport/odfimport.cxx
-@@ -601,6 +601,8 @@ CPPUNIT_TEST_FIXTURE(Test, testFdo56272)
+@@ -602,6 +602,8 @@ CPPUNIT_TEST_FIXTURE(Test, testFdo56272)
  
  CPPUNIT_TEST_FIXTURE(Test, testIncorrectSum)
  {
@@ -94,8 +94,8 @@
      SwXTextDocument* pXTextDocument = createDoc("dummy.fodt");
      ViewCallback aView1;
      int nView1 = SfxLokHelper::getView();
-@@ -3187,6 +3187,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testDoubleUnderlineAndStrikeOut)
-
+@@ -3048,6 +3050,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testDoubleUnderlineAndStrikeOut)
+ 
  CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testTdf43244_SpacesOnMargin)
  {
 +    return; // fails consistently
@@ -103,14 +103,21 @@
      // Load a document where the top left tile contains
      // paragraph and line break symbols with redlining.
      SwXTextDocument* pXTextDocument = createDoc("tdf43244_SpacesOnMargin.odt");
+@@ -4091,6 +4095,7 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testRedlineTooltip)
+ // toggling Formatting Marks on/off for one view should have no effect on other views
+ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testToggleFormattingMarks)
+ {
++    return; // fails
+     SwXTextDocument* pXTextDocument = createDoc();
+     int nView1 = SfxLokHelper::getView();
+ 
 --- a/sw/qa/extras/uiwriter/uiwriter5.cxx
 +++ b/sw/qa/extras/uiwriter/uiwriter5.cxx
-@@ -1613,6 +1613,8 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, testDateFormFieldCurrentDateHandling)
- #if !defined(_WIN32)
- CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, testDateFormFieldCurrentDateInvalidation)
+@@ -1571,6 +1571,7 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, testDateFormFieldContentOperations)
+ 
+ CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, testDateFormFieldCurrentDateHandling)
  {
 +    return; // flaky on KF6
-+
      createSwDoc();
      SwDoc* pDoc = getSwDoc();
      CPPUNIT_ASSERT(pDoc);
diff --git a/pkgs/applications/office/libreoffice/src-fresh/deps.nix b/pkgs/applications/office/libreoffice/src-fresh/deps.nix
index bfcb4b419add..a4bd62b5b8c1 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/deps.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/deps.nix
@@ -14,11 +14,11 @@
     md5name = "daf972a89577f8772602bf2eb38b6a3dd3d922bf5724d45e7f9589b5e830442c-phc-winner-argon2-20190702.tar.gz";
   }
   {
-    name = "boost_1_85_0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/boost_1_85_0.tar.xz";
-    sha256 = "4e23218ff5036d57afd20f7cdab2e94cdbf6ba9c509d656ace643a81c40a985a";
+    name = "boost_1_86_0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/boost_1_86_0.tar.xz";
+    sha256 = "efd6d4ce7e8571ba86f77a30bee2d3dd8dccd306721351464fc6998dd00b0c8c";
     md5 = "";
-    md5name = "4e23218ff5036d57afd20f7cdab2e94cdbf6ba9c509d656ace643a81c40a985a-boost_1_85_0.tar.xz";
+    md5name = "efd6d4ce7e8571ba86f77a30bee2d3dd8dccd306721351464fc6998dd00b0c8c-boost_1_86_0.tar.xz";
   }
   {
     name = "box2d-2.4.1.tar.gz";
@@ -56,11 +56,11 @@
     md5name = "4eebc4c2bad0402bc3f501db184417094657d111fb6c06f076a82ea191fe1faf-cairo-1.17.6.tar.xz";
   }
   {
-    name = "libcdr-0.1.7.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libcdr-0.1.7.tar.xz";
-    sha256 = "5666249d613466b9aa1e987ea4109c04365866e9277d80f6cd9663e86b8ecdd4";
+    name = "libcdr-0.1.8.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libcdr-0.1.8.tar.xz";
+    sha256 = "ced677c8300b29c91d3004bb1dddf0b99761bf5544991c26c2ee8f427e87193c";
     md5 = "";
-    md5name = "5666249d613466b9aa1e987ea4109c04365866e9277d80f6cd9663e86b8ecdd4-libcdr-0.1.7.tar.xz";
+    md5name = "ced677c8300b29c91d3004bb1dddf0b99761bf5544991c26c2ee8f427e87193c-libcdr-0.1.8.tar.xz";
   }
   {
     name = "clucene-core-2.3.3.4.tar.gz";
@@ -105,11 +105,11 @@
     md5name = "89c5c6665337f56fd2db36bc3805a5619709d51fb136e51937072f63fcc717a7-cppunit-1.15.1.tar.gz";
   }
   {
-    name = "curl-8.11.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/curl-8.11.0.tar.xz";
-    sha256 = "db59cf0d671ca6e7f5c2c5ec177084a33a79e04c97e71cf183a5cdea235054eb";
+    name = "curl-8.11.1.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/curl-8.11.1.tar.xz";
+    sha256 = "c7ca7db48b0909743eaef34250da02c19bc61d4f1dcedd6603f109409536ab56";
     md5 = "";
-    md5name = "db59cf0d671ca6e7f5c2c5ec177084a33a79e04c97e71cf183a5cdea235054eb-curl-8.11.0.tar.xz";
+    md5name = "c7ca7db48b0909743eaef34250da02c19bc61d4f1dcedd6603f109409536ab56-curl-8.11.1.tar.xz";
   }
   {
     name = "libe-book-0.1.3.tar.xz";
@@ -140,11 +140,11 @@
     md5name = "03e084b994cbeffc8c3dd13303b2cb805f44d8f2c3b79f7690d7e3fc7f6215ad-libepubgen-0.1.1.tar.xz";
   }
   {
-    name = "libetonyek-0.1.10.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libetonyek-0.1.10.tar.xz";
-    sha256 = "b430435a6e8487888b761dc848b7981626eb814884963ffe25eb26a139301e9a";
+    name = "libetonyek-0.1.12.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libetonyek-0.1.12.tar.xz";
+    sha256 = "b9fa82fbeb8cb7a701101060e4f3e1e4ef7c38f574b2859d3ecbe43604c21f83";
     md5 = "";
-    md5name = "b430435a6e8487888b761dc848b7981626eb814884963ffe25eb26a139301e9a-libetonyek-0.1.10.tar.xz";
+    md5name = "b9fa82fbeb8cb7a701101060e4f3e1e4ef7c38f574b2859d3ecbe43604c21f83-libetonyek-0.1.12.tar.xz";
   }
   {
     name = "expat-2.6.4.tar.xz";
@@ -224,18 +224,18 @@
     md5name = "1b6880e4b8df09c3b9e246d6084bfd94bf32a0ffff60cf2dcffd3622d0e2d79f-NotoKufiArabic-v2.109.zip";
   }
   {
-    name = "NotoSans-v2.014.zip";
-    url = "https://dev-www.libreoffice.org/src/NotoSans-v2.014.zip";
-    sha256 = "1dffbaf31a0a699ee2c57dfb60c1a628010425301dd076cfb485adbe017352c1";
+    name = "NotoSans-v2.015.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSans-v2.015.zip";
+    sha256 = "0c34df072a3fa7efbb7cbf34950e1f971a4447cffe365d3a359e2d4089b958f5";
     md5 = "";
-    md5name = "1dffbaf31a0a699ee2c57dfb60c1a628010425301dd076cfb485adbe017352c1-NotoSans-v2.014.zip";
+    md5name = "0c34df072a3fa7efbb7cbf34950e1f971a4447cffe365d3a359e2d4089b958f5-NotoSans-v2.015.zip";
   }
   {
-    name = "NotoSerif-v2.014.zip";
-    url = "https://dev-www.libreoffice.org/src/NotoSerif-v2.014.zip";
-    sha256 = "6abce0a80df4ef6d5a944d60c81099364481d6a7015b0721d87bc4c16acc1fd3";
+    name = "NotoSerif-v2.015.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSerif-v2.015.zip";
+    sha256 = "0e9a43c8a4b94ac76f55069ed1d7385bbcaf6b99527a94deb5619e032b7e76c1";
     md5 = "";
-    md5name = "6abce0a80df4ef6d5a944d60c81099364481d6a7015b0721d87bc4c16acc1fd3-NotoSerif-v2.014.zip";
+    md5name = "0e9a43c8a4b94ac76f55069ed1d7385bbcaf6b99527a94deb5619e032b7e76c1-NotoSerif-v2.015.zip";
   }
   {
     name = "NotoSerifHebrew-v2.004.zip";
@@ -315,11 +315,11 @@
     md5name = "b12a1ff762680681b7ce4d98dd29a7f54d90f5bcadd10c955afc640a27b3a268-NotoSansLisu-v2.102.zip";
   }
   {
-    name = "culmus-0.133.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/culmus-0.133.tar.gz";
-    sha256 = "c0c6873742d07544f6bacf2ad52eb9cb392974d56427938dc1dfbc8399c64d05";
+    name = "culmus-0.140.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/culmus-0.140.tar.gz";
+    sha256 = "6daed104481007752a76905000e71c0093c591c8ef3017d1b18222c277fc52e3";
     md5 = "";
-    md5name = "c0c6873742d07544f6bacf2ad52eb9cb392974d56427938dc1dfbc8399c64d05-culmus-0.133.tar.gz";
+    md5name = "6daed104481007752a76905000e71c0093c591c8ef3017d1b18222c277fc52e3-culmus-0.140.tar.gz";
   }
   {
     name = "libre-hebrew-1.0.tar.gz";
@@ -356,6 +356,55 @@
     md5 = "";
     md5name = "251c8817ceb87d9b661ce1d5b49e732a0116add10abc046be4b8ba5196e149b5-Scheherazade-2.100.zip";
   }
+  {
+    name = "Agdasima-2.002.zip";
+    url = "https://dev-www.libreoffice.org/src/Agdasima-2.002.zip";
+    sha256 = "b4c17499f8bc183320ffdcf1f8491c778dd68a237adc056dc08e1fcb2da488f3";
+    md5 = "";
+    md5name = "b4c17499f8bc183320ffdcf1f8491c778dd68a237adc056dc08e1fcb2da488f3-Agdasima-2.002.zip";
+  }
+  {
+    name = "Bacasime_Antique-2.000.zip";
+    url = "https://dev-www.libreoffice.org/src/Bacasime_Antique-2.000.zip";
+    sha256 = "81127cebc97d4ee0b950c2bc2d6be0ed29abfe0d5988435eb9a39e382557250a";
+    md5 = "";
+    md5name = "81127cebc97d4ee0b950c2bc2d6be0ed29abfe0d5988435eb9a39e382557250a-Bacasime_Antique-2.000.zip";
+  }
+  {
+    name = "Belanosima-2.000.zip";
+    url = "https://dev-www.libreoffice.org/src/Belanosima-2.000.zip";
+    sha256 = "9c30e9e7cdb0797b651113a77f6b789659b8d8598a466b2ba92754e9dec30449";
+    md5 = "";
+    md5name = "9c30e9e7cdb0797b651113a77f6b789659b8d8598a466b2ba92754e9dec30449-Belanosima-2.000.zip";
+  }
+  {
+    name = "Caprasimo-1.001.zip";
+    url = "https://dev-www.libreoffice.org/src/Caprasimo-1.001.zip";
+    sha256 = "f066d27cfc99b6601083be102d08b4039da8d2834e2795aabd890f16c6fd1b9b";
+    md5 = "";
+    md5name = "f066d27cfc99b6601083be102d08b4039da8d2834e2795aabd890f16c6fd1b9b-Caprasimo-1.001.zip";
+  }
+  {
+    name = "Lugrasimo-1.001.zip";
+    url = "https://dev-www.libreoffice.org/src/Lugrasimo-1.001.zip";
+    sha256 = "db24dff31e8ddf6a113556c947a219f9534b072852e9ce2079a08c94854a7503";
+    md5 = "";
+    md5name = "db24dff31e8ddf6a113556c947a219f9534b072852e9ce2079a08c94854a7503-Lugrasimo-1.001.zip";
+  }
+  {
+    name = "Lumanosimo-1.010.zip";
+    url = "https://dev-www.libreoffice.org/src/Lumanosimo-1.010.zip";
+    sha256 = "d4545ad6afded9a55d9a7728cfc7453cf5637861db87aafe0a730676a0cb960f";
+    md5 = "";
+    md5name = "d4545ad6afded9a55d9a7728cfc7453cf5637861db87aafe0a730676a0cb960f-Lumanosimo-1.010.zip";
+  }
+  {
+    name = "Lunasima-2.009.zip";
+    url = "https://dev-www.libreoffice.org/src/Lunasima-2.009.zip";
+    sha256 = "4302809cf4b95b481bec53de87484d919b391c90a518d065f6c775fd435a5393";
+    md5 = "";
+    md5name = "4302809cf4b95b481bec53de87484d919b391c90a518d065f6c775fd435a5393-Lunasima-2.009.zip";
+  }
   {
     name = "libfreehand-0.1.2.tar.xz";
     url = "https://dev-www.libreoffice.org/src/libfreehand-0.1.2.tar.xz";
@@ -364,18 +413,18 @@
     md5name = "0e422d1564a6dbf22a9af598535425271e583514c0f7ba7d9091676420de34ac-libfreehand-0.1.2.tar.xz";
   }
   {
-    name = "freetype-2.13.2.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/freetype-2.13.2.tar.xz";
-    sha256 = "12991c4e55c506dd7f9b765933e62fd2be2e06d421505d7950a132e4f1bb484d";
+    name = "freetype-2.13.3.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/freetype-2.13.3.tar.xz";
+    sha256 = "0550350666d427c74daeb85d5ac7bb353acba5f76956395995311a9c6f063289";
     md5 = "";
-    md5name = "12991c4e55c506dd7f9b765933e62fd2be2e06d421505d7950a132e4f1bb484d-freetype-2.13.2.tar.xz";
+    md5name = "0550350666d427c74daeb85d5ac7bb353acba5f76956395995311a9c6f063289-freetype-2.13.3.tar.xz";
   }
   {
-    name = "frozen-1.1.1.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/frozen-1.1.1.tar.gz";
-    sha256 = "f7c7075750e8fceeac081e9ef01944f221b36d9725beac8681cbd2838d26be45";
+    name = "frozen-1.2.0.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/frozen-1.2.0.tar.gz";
+    sha256 = "ed8339c017d7c5fe019ac2c642477f435278f0dc643c1d69d3f3b1e95915e823";
     md5 = "";
-    md5name = "f7c7075750e8fceeac081e9ef01944f221b36d9725beac8681cbd2838d26be45-frozen-1.1.1.tar.gz";
+    md5name = "ed8339c017d7c5fe019ac2c642477f435278f0dc643c1d69d3f3b1e95915e823-frozen-1.2.0.tar.gz";
   }
   {
     name = "glm-1.0.1.zip";
@@ -385,11 +434,11 @@
     md5name = "09c5716296787e1f7fcb87b1cbdbf26814ec1288ed6259ccd30d5d9795809fa5-glm-1.0.1.zip";
   }
   {
-    name = "gpgme-1.23.2.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/gpgme-1.23.2.tar.bz2";
-    sha256 = "9499e8b1f33cccb6815527a1bc16049d35a6198a6c5fae0185f2bd561bce5224";
+    name = "gpgme-1.24.1.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/gpgme-1.24.1.tar.bz2";
+    sha256 = "ea05d0258e71061d61716584ec34cef59330a91340571edc46b78374973ba85f";
     md5 = "";
-    md5name = "9499e8b1f33cccb6815527a1bc16049d35a6198a6c5fae0185f2bd561bce5224-gpgme-1.23.2.tar.bz2";
+    md5name = "ea05d0258e71061d61716584ec34cef59330a91340571edc46b78374973ba85f-gpgme-1.24.1.tar.bz2";
   }
   {
     name = "graphite2-minimal-1.3.14.tgz";
@@ -434,25 +483,25 @@
     md5name = "0e279003f5199f80031c6dcd08f79d6f65a0505139160e7df0d09b226bff4023-IAccessible2-1.3+git20231013.3d8c7f0.tar.gz";
   }
   {
-    name = "icu4c-74_2-src.tgz";
-    url = "https://dev-www.libreoffice.org/src/icu4c-74_2-src.tgz";
-    sha256 = "68db082212a96d6f53e35d60f47d38b962e9f9d207a74cfac78029ae8ff5e08c";
+    name = "icu4c-75_1-src.tgz";
+    url = "https://dev-www.libreoffice.org/src/icu4c-75_1-src.tgz";
+    sha256 = "cb968df3e4d2e87e8b11c49a5d01c787bd13b9545280fc6642f826527618caef";
     md5 = "";
-    md5name = "68db082212a96d6f53e35d60f47d38b962e9f9d207a74cfac78029ae8ff5e08c-icu4c-74_2-src.tgz";
+    md5name = "cb968df3e4d2e87e8b11c49a5d01c787bd13b9545280fc6642f826527618caef-icu4c-75_1-src.tgz";
   }
   {
-    name = "icu4c-74_2-data.zip";
-    url = "https://dev-www.libreoffice.org/src/icu4c-74_2-data.zip";
-    sha256 = "c28c3ca5f4ba3384781797138a294ca360988d4322674ad4d51e52f5d9b0a2b6";
+    name = "icu4c-75_1-data.zip";
+    url = "https://dev-www.libreoffice.org/src/icu4c-75_1-data.zip";
+    sha256 = "a5104212dc317a64f9b035723ea706f2f4fd5a0f37b7923fae7aeb9d1d0061b1";
     md5 = "";
-    md5name = "c28c3ca5f4ba3384781797138a294ca360988d4322674ad4d51e52f5d9b0a2b6-icu4c-74_2-data.zip";
+    md5name = "a5104212dc317a64f9b035723ea706f2f4fd5a0f37b7923fae7aeb9d1d0061b1-icu4c-75_1-data.zip";
   }
   {
-    name = "Java-WebSocket-1.5.6.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/Java-WebSocket-1.5.6.tar.gz";
-    sha256 = "167e86561cd7b5ed21b67d7543536134edcb14b373892739b28c417566a3832f";
+    name = "Java-WebSocket-1.6.0.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/Java-WebSocket-1.6.0.tar.gz";
+    sha256 = "f3ce29efde338707241d47ab4784b19a1e3658bfa0564b5bc5f80c27e5118728";
     md5 = "";
-    md5name = "167e86561cd7b5ed21b67d7543536134edcb14b373892739b28c417566a3832f-Java-WebSocket-1.5.6.tar.gz";
+    md5name = "f3ce29efde338707241d47ab4784b19a1e3658bfa0564b5bc5f80c27e5118728-Java-WebSocket-1.6.0.tar.gz";
   }
   {
     name = "flow-engine-0.9.4.zip";
@@ -539,11 +588,11 @@
     md5name = "2fdc3feb6e9deb17adec9bafa3321419aa19f8f4e5dea7bf8486844ca22207bf-libjpeg-turbo-2.1.5.1.tar.gz";
   }
   {
-    name = "language-subtag-registry-2024-06-14.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2024-06-14.tar.bz2";
-    sha256 = "75bc394dd83ddfd62b172a462db1b66bdb5950f40823ed63b8c7db6b71e37e75";
+    name = "language-subtag-registry-2025-01-21.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2025-01-21.tar.bz2";
+    sha256 = "06b37484c2736816e84b8bdd2075011d5961c2316865bc2795831230b925608d";
     md5 = "";
-    md5name = "75bc394dd83ddfd62b172a462db1b66bdb5950f40823ed63b8c7db6b71e37e75-language-subtag-registry-2024-06-14.tar.bz2";
+    md5name = "06b37484c2736816e84b8bdd2075011d5961c2316865bc2795831230b925608d-language-subtag-registry-2025-01-21.tar.bz2";
   }
   {
     name = "lcms2-2.16.tar.gz";
@@ -581,18 +630,18 @@
     md5name = "df0a59d413a5b202573d8d4f5159e33a8538da4f8e8e60979facc64d6290cebd-libexttextcat-3.4.7.tar.xz";
   }
   {
-    name = "libffi-3.4.4.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/libffi-3.4.4.tar.gz";
-    sha256 = "d66c56ad259a82cf2a9dfc408b32bf5da52371500b84745f7fb8b645712df676";
+    name = "libffi-3.4.6.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/libffi-3.4.6.tar.gz";
+    sha256 = "b0dea9df23c863a7a50e825440f3ebffabd65df1497108e5d437747843895a4e";
     md5 = "";
-    md5name = "d66c56ad259a82cf2a9dfc408b32bf5da52371500b84745f7fb8b645712df676-libffi-3.4.4.tar.gz";
+    md5name = "b0dea9df23c863a7a50e825440f3ebffabd65df1497108e5d437747843895a4e-libffi-3.4.6.tar.gz";
   }
   {
-    name = "libgpg-error-1.50.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/libgpg-error-1.50.tar.bz2";
-    sha256 = "69405349e0a633e444a28c5b35ce8f14484684518a508dc48a089992fe93e20a";
+    name = "libgpg-error-1.51.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/libgpg-error-1.51.tar.bz2";
+    sha256 = "be0f1b2db6b93eed55369cdf79f19f72750c8c7c39fc20b577e724545427e6b2";
     md5 = "";
-    md5name = "69405349e0a633e444a28c5b35ce8f14484684518a508dc48a089992fe93e20a-libgpg-error-1.50.tar.bz2";
+    md5name = "be0f1b2db6b93eed55369cdf79f19f72750c8c7c39fc20b577e724545427e6b2-libgpg-error-1.51.tar.bz2";
   }
   {
     name = "liblangtag-0.6.7.tar.bz2";
@@ -616,32 +665,32 @@
     md5name = "296272d93435991308eb73607600c034b558807a07e829e751142e65ccfa9d08-ltm-1.3.0.tar.xz";
   }
   {
-    name = "libwebp-1.4.0.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/libwebp-1.4.0.tar.gz";
-    sha256 = "61f873ec69e3be1b99535634340d5bde750b2e4447caa1db9f61be3fd49ab1e5";
+    name = "libwebp-1.5.0.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/libwebp-1.5.0.tar.gz";
+    sha256 = "7d6fab70cf844bf6769077bd5d7a74893f8ffd4dfb42861745750c63c2a5c92c";
     md5 = "";
-    md5name = "61f873ec69e3be1b99535634340d5bde750b2e4447caa1db9f61be3fd49ab1e5-libwebp-1.4.0.tar.gz";
+    md5name = "7d6fab70cf844bf6769077bd5d7a74893f8ffd4dfb42861745750c63c2a5c92c-libwebp-1.5.0.tar.gz";
   }
   {
-    name = "xmlsec1-1.3.5.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/xmlsec1-1.3.5.tar.gz";
-    sha256 = "2ffd4ad1f860ec93e47a680310ab2bc94968bd07566e71976bd96133d9504917";
+    name = "xmlsec1-1.3.6.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/xmlsec1-1.3.6.tar.gz";
+    sha256 = "952b626ad3f3be1a4598622dab52fdab2a8604d0837c1b00589f3637535af92f";
     md5 = "";
-    md5name = "2ffd4ad1f860ec93e47a680310ab2bc94968bd07566e71976bd96133d9504917-xmlsec1-1.3.5.tar.gz";
+    md5name = "952b626ad3f3be1a4598622dab52fdab2a8604d0837c1b00589f3637535af92f-xmlsec1-1.3.6.tar.gz";
   }
   {
-    name = "libxml2-2.12.9.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libxml2-2.12.9.tar.xz";
-    sha256 = "59912db536ab56a3996489ea0299768c7bcffe57169f0235e7f962a91f483590";
+    name = "libxml2-2.13.5.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libxml2-2.13.5.tar.xz";
+    sha256 = "74fc163217a3964257d3be39af943e08861263c4231f9ef5b496b6f6d4c7b2b6";
     md5 = "";
-    md5name = "59912db536ab56a3996489ea0299768c7bcffe57169f0235e7f962a91f483590-libxml2-2.12.9.tar.xz";
+    md5name = "74fc163217a3964257d3be39af943e08861263c4231f9ef5b496b6f6d4c7b2b6-libxml2-2.13.5.tar.xz";
   }
   {
-    name = "libxslt-1.1.41.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libxslt-1.1.41.tar.xz";
-    sha256 = "3ad392af91115b7740f7b50d228cc1c5fc13afc1da7f16cb0213917a37f71bda";
+    name = "libxslt-1.1.42.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libxslt-1.1.42.tar.xz";
+    sha256 = "85ca62cac0d41fc77d3f6033da9df6fd73d20ea2fc18b0a3609ffb4110e1baeb";
     md5 = "";
-    md5name = "3ad392af91115b7740f7b50d228cc1c5fc13afc1da7f16cb0213917a37f71bda-libxslt-1.1.41.tar.xz";
+    md5name = "85ca62cac0d41fc77d3f6033da9df6fd73d20ea2fc18b0a3609ffb4110e1baeb-libxslt-1.1.42.tar.xz";
   }
   {
     name = "lp_solve_5.5.tar.gz";
@@ -651,18 +700,18 @@
     md5name = "26b3e95ddf3d9c077c480ea45874b3b8-lp_solve_5.5.tar.gz";
   }
   {
-    name = "lxml-5.2.2.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/lxml-5.2.2.tar.gz";
-    sha256 = "bb2dc4898180bea79863d5487e5f9c7c34297414bad54bcd0f0852aee9cfdb87";
+    name = "lxml-5.3.0.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/lxml-5.3.0.tar.gz";
+    sha256 = "4e109ca30d1edec1ac60cdbe341905dc3b8f55b16855e03a54aaf59e51ec8c6f";
     md5 = "";
-    md5name = "bb2dc4898180bea79863d5487e5f9c7c34297414bad54bcd0f0852aee9cfdb87-lxml-5.2.2.tar.gz";
+    md5name = "4e109ca30d1edec1ac60cdbe341905dc3b8f55b16855e03a54aaf59e51ec8c6f-lxml-5.3.0.tar.gz";
   }
   {
-    name = "mariadb-connector-c-3.3.11-src.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/mariadb-connector-c-3.3.11-src.tar.gz";
-    sha256 = "f7ba02f70aa2ae2b13e9ee5acc78423f6bede38998afb91326a62be46cf5956a";
+    name = "mariadb-connector-c-3.3.13-src.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/mariadb-connector-c-3.3.13-src.tar.gz";
+    sha256 = "1c03c30b394871ab354dbdb47574beae19e2657da21a911ecc9e33e9388a3bef";
     md5 = "";
-    md5name = "f7ba02f70aa2ae2b13e9ee5acc78423f6bede38998afb91326a62be46cf5956a-mariadb-connector-c-3.3.11-src.tar.gz";
+    md5name = "1c03c30b394871ab354dbdb47574beae19e2657da21a911ecc9e33e9388a3bef-mariadb-connector-c-3.3.13-src.tar.gz";
   }
   {
     name = "mdds-2.1.1.tar.xz";
@@ -735,11 +784,11 @@
     md5name = "37206cf981e8409d048b59ac5839621ea107ff49af72beb9d7769a2f41da8d90-onlineupdate-c003be8b9727672e7d30972983b375f4c200233f-2.tar.xz";
   }
   {
-    name = "openldap-2.6.8.tgz";
-    url = "https://dev-www.libreoffice.org/src/openldap-2.6.8.tgz";
-    sha256 = "48969323e94e3be3b03c6a132942dcba7ef8d545f2ad35401709019f696c3c4e";
+    name = "openldap-2.6.9.tgz";
+    url = "https://dev-www.libreoffice.org/src/openldap-2.6.9.tgz";
+    sha256 = "2cb7dc73e9c8340dff0d99357fbaa578abf30cc6619f0521972c555681e6b2ff";
     md5 = "";
-    md5name = "48969323e94e3be3b03c6a132942dcba7ef8d545f2ad35401709019f696c3c4e-openldap-2.6.8.tgz";
+    md5name = "2cb7dc73e9c8340dff0d99357fbaa578abf30cc6619f0521972c555681e6b2ff-openldap-2.6.9.tgz";
   }
   {
     name = "openssl-3.0.15.tar.gz";
@@ -763,11 +812,11 @@
     md5name = "66adacd705a7d19895e08eac46d1e851332adf2e736c566bef1164e7a442519d-libpagemaker-0.0.4.tar.xz";
   }
   {
-    name = "pdfium-6425.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/pdfium-6425.tar.bz2";
-    sha256 = "fe0291b96d7352bac530d13ef2e5fd63ad9980e0128911f88b957b5992508f1c";
+    name = "pdfium-6764.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/pdfium-6764.tar.bz2";
+    sha256 = "59d5df3b38312b069d96a8de9d4f8d7f44a29835c9dc82bd792ea02be86c4e49";
     md5 = "";
-    md5name = "fe0291b96d7352bac530d13ef2e5fd63ad9980e0128911f88b957b5992508f1c-pdfium-6425.tar.bz2";
+    md5name = "59d5df3b38312b069d96a8de9d4f8d7f44a29835c9dc82bd792ea02be86c4e49-pdfium-6764.tar.bz2";
   }
   {
     name = "pixman-0.42.2.tar.gz";
@@ -777,11 +826,11 @@
     md5name = "ea1480efada2fd948bc75366f7c349e1c96d3297d09a3fe62626e38e234a625e-pixman-0.42.2.tar.gz";
   }
   {
-    name = "libpng-1.6.44.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libpng-1.6.44.tar.xz";
-    sha256 = "60c4da1d5b7f0aa8d158da48e8f8afa9773c1c8baa5d21974df61f1886b8ce8e";
+    name = "libpng-1.6.45.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libpng-1.6.45.tar.xz";
+    sha256 = "926485350139ffb51ef69760db35f78846c805fef3d59bfdcb2fba704663f370";
     md5 = "";
-    md5name = "60c4da1d5b7f0aa8d158da48e8f8afa9773c1c8baa5d21974df61f1886b8ce8e-libpng-1.6.44.tar.xz";
+    md5name = "926485350139ffb51ef69760db35f78846c805fef3d59bfdcb2fba704663f370-libpng-1.6.45.tar.xz";
   }
   {
     name = "tiff-4.7.0.tar.xz";
@@ -791,11 +840,11 @@
     md5name = "273a0a73b1f0bed640afee4a5df0337357ced5b53d3d5d1c405b936501f71017-tiff-4.7.0.tar.xz";
   }
   {
-    name = "poppler-24.08.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/poppler-24.08.0.tar.xz";
-    sha256 = "97453fbddf0c9a9eafa0ea45ac710d3d49bcf23a62e864585385d3c0b4403174";
+    name = "poppler-25.01.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/poppler-25.01.0.tar.xz";
+    sha256 = "7eefc122207bbbd72a303c5e0743f4941e8ae861e24dcf0501e18ce1d1414112";
     md5 = "";
-    md5name = "97453fbddf0c9a9eafa0ea45ac710d3d49bcf23a62e864585385d3c0b4403174-poppler-24.08.0.tar.xz";
+    md5name = "7eefc122207bbbd72a303c5e0743f4941e8ae861e24dcf0501e18ce1d1414112-poppler-25.01.0.tar.xz";
   }
   {
     name = "poppler-data-0.4.12.tar.gz";
@@ -805,18 +854,18 @@
     md5name = "c835b640a40ce357e1b83666aabd95edffa24ddddd49b8daff63adb851cdab74-poppler-data-0.4.12.tar.gz";
   }
   {
-    name = "postgresql-13.16.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/postgresql-13.16.tar.bz2";
-    sha256 = "c9cbbb6129f02328204828066bb3785c00a85c8ca8fd329c2a8a53c1f5cd8865";
+    name = "postgresql-14.15.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/postgresql-14.15.tar.bz2";
+    sha256 = "02e891e314b4e9ee24cbd78028dab7c73f9c1ba3e30835bcbef71fe220401fc5";
     md5 = "";
-    md5name = "c9cbbb6129f02328204828066bb3785c00a85c8ca8fd329c2a8a53c1f5cd8865-postgresql-13.16.tar.bz2";
+    md5name = "02e891e314b4e9ee24cbd78028dab7c73f9c1ba3e30835bcbef71fe220401fc5-postgresql-14.15.tar.bz2";
   }
   {
-    name = "Python-3.9.20.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/Python-3.9.20.tar.xz";
-    sha256 = "6b281279efd85294d2d6993e173983a57464c0133956fbbb5536ec9646beaf0c";
+    name = "Python-3.10.16.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/Python-3.10.16.tar.xz";
+    sha256 = "bfb249609990220491a1b92850a07135ed0831e41738cf681d63cf01b2a8fbd1";
     md5 = "";
-    md5name = "6b281279efd85294d2d6993e173983a57464c0133956fbbb5536ec9646beaf0c-Python-3.9.20.tar.xz";
+    md5name = "bfb249609990220491a1b92850a07135ed0831e41738cf681d63cf01b2a8fbd1-Python-3.10.16.tar.xz";
   }
   {
     name = "libqxp-0.0.2.tar.xz";
@@ -826,11 +875,11 @@
     md5name = "e137b6b110120a52c98edd02ebdc4095ee08d0d5295a94316a981750095a945c-libqxp-0.0.2.tar.xz";
   }
   {
-    name = "raptor2-2.0.15.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/a39f6c07ddb20d7dd2ff1f95fa21e2cd-raptor2-2.0.15.tar.gz";
-    sha256 = "ada7f0ba54787b33485d090d3d2680533520cd4426d2f7fb4782dd4a6a1480ed";
-    md5 = "a39f6c07ddb20d7dd2ff1f95fa21e2cd";
-    md5name = "a39f6c07ddb20d7dd2ff1f95fa21e2cd-raptor2-2.0.15.tar.gz";
+    name = "raptor2-2.0.16.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/raptor2-2.0.16.tar.gz";
+    sha256 = "089db78d7ac982354bdbf39d973baf09581e6904ac4c92a98c5caadb3de44680";
+    md5 = "";
+    md5name = "089db78d7ac982354bdbf39d973baf09581e6904ac4c92a98c5caadb3de44680-raptor2-2.0.16.tar.gz";
   }
   {
     name = "rasqal-0.9.33.tar.gz";
@@ -854,18 +903,18 @@
     md5name = "5892ca6796f7a2a93d580832e907e849b19d980b40d326a283b18877ab6de0c5-librevenge-0.0.5.tar.bz2";
   }
   {
-    name = "rhino-1.7.14.zip";
-    url = "https://dev-www.libreoffice.org/src/rhino-1.7.14.zip";
-    sha256 = "bf4d2d0c5ff8889fd494486db09291cb7965f0bf2f93ef005d3b08070a5a4f5c";
+    name = "rhino-1.7.15.zip";
+    url = "https://dev-www.libreoffice.org/src/rhino-1.7.15.zip";
+    sha256 = "42fce6baf1bf789b62bf938b8e8ec18a1ac92c989dd6e7221e9531454cbd97fa";
     md5 = "";
-    md5name = "bf4d2d0c5ff8889fd494486db09291cb7965f0bf2f93ef005d3b08070a5a4f5c-rhino-1.7.14.zip";
+    md5name = "42fce6baf1bf789b62bf938b8e8ec18a1ac92c989dd6e7221e9531454cbd97fa-rhino-1.7.15.zip";
   }
   {
-    name = "skia-m116-2ddcf183eb260f63698aa74d1bb380f247ad7ccd.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/skia-m116-2ddcf183eb260f63698aa74d1bb380f247ad7ccd.tar.xz";
-    sha256 = "2223ebce534458a37826e8fe4f24635b0712cde7ed1bd3208f089f6fdd796e01";
+    name = "skia-m130-3c64459d5df2fa9794b277f0959ed8a92552bf4c.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/skia-m130-3c64459d5df2fa9794b277f0959ed8a92552bf4c.tar.xz";
+    sha256 = "53f55303821158b6de9e6b90f1cc3a548611a7e430c1a0883ff159a8db89677d";
     md5 = "";
-    md5name = "2223ebce534458a37826e8fe4f24635b0712cde7ed1bd3208f089f6fdd796e01-skia-m116-2ddcf183eb260f63698aa74d1bb380f247ad7ccd.tar.xz";
+    md5name = "53f55303821158b6de9e6b90f1cc3a548611a7e430c1a0883ff159a8db89677d-skia-m130-3c64459d5df2fa9794b277f0959ed8a92552bf4c.tar.xz";
   }
   {
     name = "libstaroffice-0.0.7.tar.xz";
diff --git a/pkgs/applications/office/libreoffice/src-fresh/help.nix b/pkgs/applications/office/libreoffice/src-fresh/help.nix
index 9e0d85a01d75..47ce1f1ad9b0 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/help.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/help.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "04z77jzn816r19ig54fhl0p1arh3fpamn5bh2wc2v17rz73chp8y";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.8.3/libreoffice-help-24.8.3.2.tar.xz";
+  sha256 = "1pfkmv9ad9n4w0yic0l3kqx9qs7v6vjakslrqr7laa2pxyl04zsz";
+  url = "https://download.documentfoundation.org/libreoffice/src/25.2.0/libreoffice-help-25.2.0.3.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-fresh/main.nix b/pkgs/applications/office/libreoffice/src-fresh/main.nix
index 871d41255bb9..8158b2236efd 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/main.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/main.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "1sa7bxxh7v26p77vj1mspynhn2l2b1vnz1mpyczhnmcxcan9nw2x";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.8.3/libreoffice-24.8.3.2.tar.xz";
+  sha256 = "1d15sn9zq40qfjxwm9cqgj7big8mk4mviz6i825qbfzq6vblh94q";
+  url = "https://download.documentfoundation.org/libreoffice/src/25.2.0/libreoffice-25.2.0.3.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-fresh/translations.nix b/pkgs/applications/office/libreoffice/src-fresh/translations.nix
index cdc786d80e6a..9df9c51efc87 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/translations.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/translations.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "11qwbkn2i84g439ya5fw5by7wf4c8rs7is4k2v7yijpngrp9370a";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.8.3/libreoffice-translations-24.8.3.2.tar.xz";
+  sha256 = "1sxcmkclwbzbq34mjxwkjj58qj8xf4vgnlzpyfxnmawwhnsq9x9f";
+  url = "https://download.documentfoundation.org/libreoffice/src/25.2.0/libreoffice-translations-25.2.0.3.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-fresh/version.nix b/pkgs/applications/office/libreoffice/src-fresh/version.nix
index 42484acdfd9c..5e70b4c8f84e 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/version.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/version.nix
@@ -1 +1 @@
-"24.8.3.2"
+"25.2.0.3"
diff --git a/pkgs/applications/office/libreoffice/src-still/deps.nix b/pkgs/applications/office/libreoffice/src-still/deps.nix
index 5f406733814a..bcc3344b5bad 100644
--- a/pkgs/applications/office/libreoffice/src-still/deps.nix
+++ b/pkgs/applications/office/libreoffice/src-still/deps.nix
@@ -14,11 +14,11 @@
     md5name = "daf972a89577f8772602bf2eb38b6a3dd3d922bf5724d45e7f9589b5e830442c-phc-winner-argon2-20190702.tar.gz";
   }
   {
-    name = "boost_1_82_0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/boost_1_82_0.tar.xz";
-    sha256 = "e48ab6953fbd68ba47234bea5173e62427e9f6a7894e152305142895cfe955de";
+    name = "boost_1_85_0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/boost_1_85_0.tar.xz";
+    sha256 = "4e23218ff5036d57afd20f7cdab2e94cdbf6ba9c509d656ace643a81c40a985a";
     md5 = "";
-    md5name = "e48ab6953fbd68ba47234bea5173e62427e9f6a7894e152305142895cfe955de-boost_1_82_0.tar.xz";
+    md5name = "4e23218ff5036d57afd20f7cdab2e94cdbf6ba9c509d656ace643a81c40a985a-boost_1_85_0.tar.xz";
   }
   {
     name = "box2d-2.4.1.tar.gz";
@@ -35,11 +35,11 @@
     md5name = "c44a2e898895cfc13b42d2371ba4b88b0777d7782214d6cdc91c33720f3b0d91-breakpad-b324760c7f53667af128a6b77b790323da04fcb9.tar.xz";
   }
   {
-    name = "bsh-2.0b6-src.zip";
-    url = "https://dev-www.libreoffice.org/src/beeca87be45ec87d241ddd0e1bad80c1-bsh-2.0b6-src.zip";
-    sha256 = "9e93c73e23aff644b17dfff656444474c14150e7f3b38b19635e622235e01c96";
-    md5 = "beeca87be45ec87d241ddd0e1bad80c1";
-    md5name = "beeca87be45ec87d241ddd0e1bad80c1-bsh-2.0b6-src.zip";
+    name = "bsh-2.1.1-src.zip";
+    url = "https://dev-www.libreoffice.org/src/bsh-2.1.1-src.zip";
+    sha256 = "2248387ceaa319840434a3547a8b2fec12f95a8418ee039ce5ff5726053a139c";
+    md5 = "";
+    md5name = "2248387ceaa319840434a3547a8b2fec12f95a8418ee039ce5ff5726053a139c-bsh-2.1.1-src.zip";
   }
   {
     name = "bzip2-1.0.8.tar.gz";
@@ -56,11 +56,11 @@
     md5name = "4eebc4c2bad0402bc3f501db184417094657d111fb6c06f076a82ea191fe1faf-cairo-1.17.6.tar.xz";
   }
   {
-    name = "libcdr-0.1.7.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libcdr-0.1.7.tar.xz";
-    sha256 = "5666249d613466b9aa1e987ea4109c04365866e9277d80f6cd9663e86b8ecdd4";
+    name = "libcdr-0.1.8.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libcdr-0.1.8.tar.xz";
+    sha256 = "ced677c8300b29c91d3004bb1dddf0b99761bf5544991c26c2ee8f427e87193c";
     md5 = "";
-    md5name = "5666249d613466b9aa1e987ea4109c04365866e9277d80f6cd9663e86b8ecdd4-libcdr-0.1.7.tar.xz";
+    md5name = "ced677c8300b29c91d3004bb1dddf0b99761bf5544991c26c2ee8f427e87193c-libcdr-0.1.8.tar.xz";
   }
   {
     name = "clucene-core-2.3.3.4.tar.gz";
@@ -84,11 +84,11 @@
     md5name = "0082d0684f7db6f62361b76c4b7faba19e0c7ce5cb8e36c4b65fea8281e711b4-dtoa-20180411.tgz";
   }
   {
-    name = "libcmis-0.6.1.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libcmis-0.6.1.tar.xz";
-    sha256 = "d54d19d86153dbc88e2d468f7136269a2cfe71b73227e12fded01d29ac268074";
+    name = "libcmis-0.6.2.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libcmis-0.6.2.tar.xz";
+    sha256 = "1b5c2d7258ff93eb5f9958ff0e4dfd7332dc75a071bb717dde2217a26602a644";
     md5 = "";
-    md5name = "d54d19d86153dbc88e2d468f7136269a2cfe71b73227e12fded01d29ac268074-libcmis-0.6.1.tar.xz";
+    md5name = "1b5c2d7258ff93eb5f9958ff0e4dfd7332dc75a071bb717dde2217a26602a644-libcmis-0.6.2.tar.xz";
   }
   {
     name = "CoinMP-1.8.4.tgz";
@@ -105,11 +105,11 @@
     md5name = "89c5c6665337f56fd2db36bc3805a5619709d51fb136e51937072f63fcc717a7-cppunit-1.15.1.tar.gz";
   }
   {
-    name = "curl-8.10.1.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/curl-8.10.1.tar.xz";
-    sha256 = "73a4b0e99596a09fa5924a4fb7e4b995a85fda0d18a2c02ab9cf134bebce04ee";
+    name = "curl-8.11.1.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/curl-8.11.1.tar.xz";
+    sha256 = "c7ca7db48b0909743eaef34250da02c19bc61d4f1dcedd6603f109409536ab56";
     md5 = "";
-    md5name = "73a4b0e99596a09fa5924a4fb7e4b995a85fda0d18a2c02ab9cf134bebce04ee-curl-8.10.1.tar.xz";
+    md5name = "c7ca7db48b0909743eaef34250da02c19bc61d4f1dcedd6603f109409536ab56-curl-8.11.1.tar.xz";
   }
   {
     name = "libe-book-0.1.3.tar.xz";
@@ -140,18 +140,18 @@
     md5name = "03e084b994cbeffc8c3dd13303b2cb805f44d8f2c3b79f7690d7e3fc7f6215ad-libepubgen-0.1.1.tar.xz";
   }
   {
-    name = "libetonyek-0.1.10.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libetonyek-0.1.10.tar.xz";
-    sha256 = "b430435a6e8487888b761dc848b7981626eb814884963ffe25eb26a139301e9a";
+    name = "libetonyek-0.1.12.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libetonyek-0.1.12.tar.xz";
+    sha256 = "b9fa82fbeb8cb7a701101060e4f3e1e4ef7c38f574b2859d3ecbe43604c21f83";
     md5 = "";
-    md5name = "b430435a6e8487888b761dc848b7981626eb814884963ffe25eb26a139301e9a-libetonyek-0.1.10.tar.xz";
+    md5name = "b9fa82fbeb8cb7a701101060e4f3e1e4ef7c38f574b2859d3ecbe43604c21f83-libetonyek-0.1.12.tar.xz";
   }
   {
-    name = "expat-2.6.3.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/expat-2.6.3.tar.xz";
-    sha256 = "274db254a6979bde5aad404763a704956940e465843f2a9bd9ed7af22e2c0efc";
+    name = "expat-2.6.4.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/expat-2.6.4.tar.xz";
+    sha256 = "a695629dae047055b37d50a0ff4776d1d45d0a4c842cf4ccee158441f55ff7ee";
     md5 = "";
-    md5name = "274db254a6979bde5aad404763a704956940e465843f2a9bd9ed7af22e2c0efc-expat-2.6.3.tar.xz";
+    md5name = "a695629dae047055b37d50a0ff4776d1d45d0a4c842cf4ccee158441f55ff7ee-expat-2.6.4.tar.xz";
   }
   {
     name = "Firebird-3.0.7.33374-0.tar.bz2";
@@ -161,11 +161,11 @@
     md5name = "acb85cedafa10ce106b1823fb236b1b3e5d942a5741e8f8435cc8ccfec0afe76-Firebird-3.0.7.33374-0.tar.bz2";
   }
   {
-    name = "fontconfig-2.14.2.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/fontconfig-2.14.2.tar.xz";
-    sha256 = "dba695b57bce15023d2ceedef82062c2b925e51f5d4cc4aef736cf13f60a468b";
+    name = "fontconfig-2.15.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/fontconfig-2.15.0.tar.xz";
+    sha256 = "63a0658d0e06e0fa886106452b58ef04f21f58202ea02a94c39de0d3335d7c0e";
     md5 = "";
-    md5name = "dba695b57bce15023d2ceedef82062c2b925e51f5d4cc4aef736cf13f60a468b-fontconfig-2.14.2.tar.xz";
+    md5name = "63a0658d0e06e0fa886106452b58ef04f21f58202ea02a94c39de0d3335d7c0e-fontconfig-2.15.0.tar.xz";
   }
   {
     name = "crosextrafonts-20130214.tar.gz";
@@ -203,11 +203,11 @@
     md5name = "8879d89b5ff7b506c9fc28efc31a5c0b954bbe9333e66e5283d27d20a8519ea3-liberation-narrow-fonts-ttf-1.07.6.tar.gz";
   }
   {
-    name = "liberation-fonts-ttf-2.1.4.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/liberation-fonts-ttf-2.1.4.tar.gz";
-    sha256 = "26f85412dd0aa9d061504a1cc8aaf0aa12a70710e8d47d8b65a1251757c1a5ef";
+    name = "liberation-fonts-ttf-2.1.5.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/liberation-fonts-ttf-2.1.5.tar.gz";
+    sha256 = "7191c669bf38899f73a2094ed00f7b800553364f90e2637010a69c0e268f25d0";
     md5 = "";
-    md5name = "26f85412dd0aa9d061504a1cc8aaf0aa12a70710e8d47d8b65a1251757c1a5ef-liberation-fonts-ttf-2.1.4.tar.gz";
+    md5name = "7191c669bf38899f73a2094ed00f7b800553364f90e2637010a69c0e268f25d0-liberation-fonts-ttf-2.1.5.tar.gz";
   }
   {
     name = "LinLibertineG-20120116.zip";
@@ -224,18 +224,18 @@
     md5name = "1b6880e4b8df09c3b9e246d6084bfd94bf32a0ffff60cf2dcffd3622d0e2d79f-NotoKufiArabic-v2.109.zip";
   }
   {
-    name = "NotoSans-v2.012.zip";
-    url = "https://dev-www.libreoffice.org/src/NotoSans-v2.012.zip";
-    sha256 = "efef2f66ed2c5e005472cba156bd2afb68063a51bb628c6ee14143edc019d293";
+    name = "NotoSans-v2.015.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSans-v2.015.zip";
+    sha256 = "0c34df072a3fa7efbb7cbf34950e1f971a4447cffe365d3a359e2d4089b958f5";
     md5 = "";
-    md5name = "efef2f66ed2c5e005472cba156bd2afb68063a51bb628c6ee14143edc019d293-NotoSans-v2.012.zip";
+    md5name = "0c34df072a3fa7efbb7cbf34950e1f971a4447cffe365d3a359e2d4089b958f5-NotoSans-v2.015.zip";
   }
   {
-    name = "NotoSerif-v2.012.zip";
-    url = "https://dev-www.libreoffice.org/src/NotoSerif-v2.012.zip";
-    sha256 = "3d4566a0e51e7fc14528f5a1eecc6f12e5ffbbec6484470d3da48b0d8ead345a";
+    name = "NotoSerif-v2.015.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSerif-v2.015.zip";
+    sha256 = "0e9a43c8a4b94ac76f55069ed1d7385bbcaf6b99527a94deb5619e032b7e76c1";
     md5 = "";
-    md5name = "3d4566a0e51e7fc14528f5a1eecc6f12e5ffbbec6484470d3da48b0d8ead345a-NotoSerif-v2.012.zip";
+    md5name = "0e9a43c8a4b94ac76f55069ed1d7385bbcaf6b99527a94deb5619e032b7e76c1-NotoSerif-v2.015.zip";
   }
   {
     name = "NotoSerifHebrew-v2.004.zip";
@@ -280,11 +280,11 @@
     md5name = "b21c198a4c76ae598a304decefb3b5c2a4c2d4c3ae226728eff359185f291c6f-NotoSerifArmenian-v2.008.zip";
   }
   {
-    name = "NotoSansGeorgian-v2.003.zip";
-    url = "https://dev-www.libreoffice.org/src/NotoSansGeorgian-v2.003.zip";
-    sha256 = "bd75d1f0b9ef619b5ded0018d6258eeab2f9e976d8f8074bb7890f4e301648bf";
+    name = "NotoSansGeorgian-v2.005.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSansGeorgian-v2.005.zip";
+    sha256 = "10e85011008108308e6feab0408242acb07804da61ede3d3ff236461ae07ab1b";
     md5 = "";
-    md5name = "bd75d1f0b9ef619b5ded0018d6258eeab2f9e976d8f8074bb7890f4e301648bf-NotoSansGeorgian-v2.003.zip";
+    md5name = "10e85011008108308e6feab0408242acb07804da61ede3d3ff236461ae07ab1b-NotoSansGeorgian-v2.005.zip";
   }
   {
     name = "NotoSerifGeorgian-v2.003.zip";
@@ -343,11 +343,11 @@
     md5name = "926fe1bd7dfde8e55178281f645258bfced6420c951c6f2fd532fd21691bca30-Amiri-1.000.zip";
   }
   {
-    name = "ReemKufi-1.2.zip";
-    url = "https://dev-www.libreoffice.org/src/ReemKufi-1.2.zip";
-    sha256 = "c4fd68a23c0ea471cc084ae7efe888da372b925cb208eeb0322c26792d2ef413";
+    name = "ReemKufi-1.7.zip";
+    url = "https://dev-www.libreoffice.org/src/ReemKufi-1.7.zip";
+    sha256 = "2359f036c7bddeb4d5529d7b3c9139c3288c920cc26053d417cdbb563eafe0a4";
     md5 = "";
-    md5name = "c4fd68a23c0ea471cc084ae7efe888da372b925cb208eeb0322c26792d2ef413-ReemKufi-1.2.zip";
+    md5name = "2359f036c7bddeb4d5529d7b3c9139c3288c920cc26053d417cdbb563eafe0a4-ReemKufi-1.7.zip";
   }
   {
     name = "Scheherazade-2.100.zip";
@@ -364,11 +364,11 @@
     md5name = "0e422d1564a6dbf22a9af598535425271e583514c0f7ba7d9091676420de34ac-libfreehand-0.1.2.tar.xz";
   }
   {
-    name = "freetype-2.13.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/freetype-2.13.0.tar.xz";
-    sha256 = "5ee23abd047636c24b2d43c6625dcafc66661d1aca64dec9e0d05df29592624c";
+    name = "freetype-2.13.2.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/freetype-2.13.2.tar.xz";
+    sha256 = "12991c4e55c506dd7f9b765933e62fd2be2e06d421505d7950a132e4f1bb484d";
     md5 = "";
-    md5name = "5ee23abd047636c24b2d43c6625dcafc66661d1aca64dec9e0d05df29592624c-freetype-2.13.0.tar.xz";
+    md5name = "12991c4e55c506dd7f9b765933e62fd2be2e06d421505d7950a132e4f1bb484d-freetype-2.13.2.tar.xz";
   }
   {
     name = "frozen-1.1.1.tar.gz";
@@ -378,18 +378,18 @@
     md5name = "f7c7075750e8fceeac081e9ef01944f221b36d9725beac8681cbd2838d26be45-frozen-1.1.1.tar.gz";
   }
   {
-    name = "glm-0.9.9.8.zip";
-    url = "https://dev-www.libreoffice.org/src/glm-0.9.9.8.zip";
-    sha256 = "6bba5f032bed47c73ad9397f2313b9acbfb56253d0d0576b5873d3dcb25e99ad";
+    name = "glm-1.0.1.zip";
+    url = "https://dev-www.libreoffice.org/src/glm-1.0.1.zip";
+    sha256 = "09c5716296787e1f7fcb87b1cbdbf26814ec1288ed6259ccd30d5d9795809fa5";
     md5 = "";
-    md5name = "6bba5f032bed47c73ad9397f2313b9acbfb56253d0d0576b5873d3dcb25e99ad-glm-0.9.9.8.zip";
+    md5name = "09c5716296787e1f7fcb87b1cbdbf26814ec1288ed6259ccd30d5d9795809fa5-glm-1.0.1.zip";
   }
   {
-    name = "gpgme-1.23.2.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/gpgme-1.23.2.tar.bz2";
-    sha256 = "9499e8b1f33cccb6815527a1bc16049d35a6198a6c5fae0185f2bd561bce5224";
+    name = "gpgme-1.24.0.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/gpgme-1.24.0.tar.bz2";
+    sha256 = "61e3a6ad89323fecfaff176bc1728fb8c3312f2faa83424d9d5077ba20f5f7da";
     md5 = "";
-    md5name = "9499e8b1f33cccb6815527a1bc16049d35a6198a6c5fae0185f2bd561bce5224-gpgme-1.23.2.tar.bz2";
+    md5name = "61e3a6ad89323fecfaff176bc1728fb8c3312f2faa83424d9d5077ba20f5f7da-gpgme-1.24.0.tar.bz2";
   }
   {
     name = "graphite2-minimal-1.3.14.tgz";
@@ -399,11 +399,11 @@
     md5name = "b8e892d8627c41888ff121e921455b9e2d26836978f2359173d19825da62b8fc-graphite2-minimal-1.3.14.tgz";
   }
   {
-    name = "harfbuzz-8.2.2.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/harfbuzz-8.2.2.tar.xz";
-    sha256 = "e433ad85fbdf57f680be29479b3f964577379aaf319f557eb76569f0ecbc90f3";
+    name = "harfbuzz-8.5.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/harfbuzz-8.5.0.tar.xz";
+    sha256 = "77e4f7f98f3d86bf8788b53e6832fb96279956e1c3961988ea3d4b7ca41ddc27";
     md5 = "";
-    md5name = "e433ad85fbdf57f680be29479b3f964577379aaf319f557eb76569f0ecbc90f3-harfbuzz-8.2.2.tar.xz";
+    md5name = "77e4f7f98f3d86bf8788b53e6832fb96279956e1c3961988ea3d4b7ca41ddc27-harfbuzz-8.5.0.tar.xz";
   }
   {
     name = "hsqldb_1_8_0.zip";
@@ -434,25 +434,25 @@
     md5name = "0e279003f5199f80031c6dcd08f79d6f65a0505139160e7df0d09b226bff4023-IAccessible2-1.3+git20231013.3d8c7f0.tar.gz";
   }
   {
-    name = "icu4c-73_2-src.tgz";
-    url = "https://dev-www.libreoffice.org/src/icu4c-73_2-src.tgz";
-    sha256 = "818a80712ed3caacd9b652305e01afc7fa167e6f2e94996da44b90c2ab604ce1";
+    name = "icu4c-74_2-src.tgz";
+    url = "https://dev-www.libreoffice.org/src/icu4c-74_2-src.tgz";
+    sha256 = "68db082212a96d6f53e35d60f47d38b962e9f9d207a74cfac78029ae8ff5e08c";
     md5 = "";
-    md5name = "818a80712ed3caacd9b652305e01afc7fa167e6f2e94996da44b90c2ab604ce1-icu4c-73_2-src.tgz";
+    md5name = "68db082212a96d6f53e35d60f47d38b962e9f9d207a74cfac78029ae8ff5e08c-icu4c-74_2-src.tgz";
   }
   {
-    name = "icu4c-73_2-data.zip";
-    url = "https://dev-www.libreoffice.org/src/icu4c-73_2-data.zip";
-    sha256 = "ca1ee076163b438461e484421a7679fc33a64cd0a54f9d4b401893fa1eb42701";
+    name = "icu4c-74_2-data.zip";
+    url = "https://dev-www.libreoffice.org/src/icu4c-74_2-data.zip";
+    sha256 = "c28c3ca5f4ba3384781797138a294ca360988d4322674ad4d51e52f5d9b0a2b6";
     md5 = "";
-    md5name = "ca1ee076163b438461e484421a7679fc33a64cd0a54f9d4b401893fa1eb42701-icu4c-73_2-data.zip";
+    md5name = "c28c3ca5f4ba3384781797138a294ca360988d4322674ad4d51e52f5d9b0a2b6-icu4c-74_2-data.zip";
   }
   {
-    name = "Java-WebSocket-1.5.4.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/Java-WebSocket-1.5.4.tar.gz";
-    sha256 = "a6828b35d1f938fee2335945f3d3c563cbbfa58ce7eb0bf72778d0fa7a550720";
+    name = "Java-WebSocket-1.5.6.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/Java-WebSocket-1.5.6.tar.gz";
+    sha256 = "167e86561cd7b5ed21b67d7543536134edcb14b373892739b28c417566a3832f";
     md5 = "";
-    md5name = "a6828b35d1f938fee2335945f3d3c563cbbfa58ce7eb0bf72778d0fa7a550720-Java-WebSocket-1.5.4.tar.gz";
+    md5name = "167e86561cd7b5ed21b67d7543536134edcb14b373892739b28c417566a3832f-Java-WebSocket-1.5.6.tar.gz";
   }
   {
     name = "flow-engine-0.9.4.zip";
@@ -539,11 +539,11 @@
     md5name = "2fdc3feb6e9deb17adec9bafa3321419aa19f8f4e5dea7bf8486844ca22207bf-libjpeg-turbo-2.1.5.1.tar.gz";
   }
   {
-    name = "language-subtag-registry-2024-06-14.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2024-06-14.tar.bz2";
-    sha256 = "75bc394dd83ddfd62b172a462db1b66bdb5950f40823ed63b8c7db6b71e37e75";
+    name = "language-subtag-registry-2024-11-19.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2024-11-19.tar.bz2";
+    sha256 = "121f27bd1fabac9a74fb042cf68396b6df74cdf5d1ccc30f4c9b78584cc13864";
     md5 = "";
-    md5name = "75bc394dd83ddfd62b172a462db1b66bdb5950f40823ed63b8c7db6b71e37e75-language-subtag-registry-2024-06-14.tar.bz2";
+    md5name = "121f27bd1fabac9a74fb042cf68396b6df74cdf5d1ccc30f4c9b78584cc13864-language-subtag-registry-2024-11-19.tar.bz2";
   }
   {
     name = "lcms2-2.16.tar.gz";
@@ -553,18 +553,18 @@
     md5name = "d873d34ad8b9b4cea010631f1a6228d2087475e4dc5e763eb81acc23d9d45a51-lcms2-2.16.tar.gz";
   }
   {
-    name = "libassuan-2.5.7.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/libassuan-2.5.7.tar.bz2";
-    sha256 = "0103081ffc27838a2e50479153ca105e873d3d65d8a9593282e9c94c7e6afb76";
+    name = "libassuan-3.0.1.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/libassuan-3.0.1.tar.bz2";
+    sha256 = "c8f0f42e6103dea4b1a6a483cb556654e97302c7465308f58363778f95f194b1";
     md5 = "";
-    md5name = "0103081ffc27838a2e50479153ca105e873d3d65d8a9593282e9c94c7e6afb76-libassuan-2.5.7.tar.bz2";
+    md5name = "c8f0f42e6103dea4b1a6a483cb556654e97302c7465308f58363778f95f194b1-libassuan-3.0.1.tar.bz2";
   }
   {
-    name = "libatomic_ops-7.8.0.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/libatomic_ops-7.8.0.tar.gz";
-    sha256 = "15676e7674e11bda5a7e50a73f4d9e7d60452271b8acf6fd39a71fefdf89fa31";
+    name = "libatomic_ops-7.8.2.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/libatomic_ops-7.8.2.tar.gz";
+    sha256 = "d305207fe207f2b3fb5cb4c019da12b44ce3fcbc593dfd5080d867b1a2419b51";
     md5 = "";
-    md5name = "15676e7674e11bda5a7e50a73f4d9e7d60452271b8acf6fd39a71fefdf89fa31-libatomic_ops-7.8.0.tar.gz";
+    md5name = "d305207fe207f2b3fb5cb4c019da12b44ce3fcbc593dfd5080d867b1a2419b51-libatomic_ops-7.8.2.tar.gz";
   }
   {
     name = "libeot-0.01.tar.bz2";
@@ -574,11 +574,11 @@
     md5name = "cf5091fa8e7dcdbe667335eb90a2cfdd0a3fe8f8c7c8d1ece44d9d055736a06a-libeot-0.01.tar.bz2";
   }
   {
-    name = "libexttextcat-3.4.6.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libexttextcat-3.4.6.tar.xz";
-    sha256 = "6d77eace20e9ea106c1330e268ede70c9a4a89744ddc25715682754eca3368df";
+    name = "libexttextcat-3.4.7.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libexttextcat-3.4.7.tar.xz";
+    sha256 = "df0a59d413a5b202573d8d4f5159e33a8538da4f8e8e60979facc64d6290cebd";
     md5 = "";
-    md5name = "6d77eace20e9ea106c1330e268ede70c9a4a89744ddc25715682754eca3368df-libexttextcat-3.4.6.tar.xz";
+    md5name = "df0a59d413a5b202573d8d4f5159e33a8538da4f8e8e60979facc64d6290cebd-libexttextcat-3.4.7.tar.xz";
   }
   {
     name = "libffi-3.4.4.tar.gz";
@@ -588,11 +588,11 @@
     md5name = "d66c56ad259a82cf2a9dfc408b32bf5da52371500b84745f7fb8b645712df676-libffi-3.4.4.tar.gz";
   }
   {
-    name = "libgpg-error-1.48.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/libgpg-error-1.48.tar.bz2";
-    sha256 = "89ce1ae893e122924b858de84dc4f67aae29ffa610ebf668d5aa539045663d6f";
+    name = "libgpg-error-1.51.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/libgpg-error-1.51.tar.bz2";
+    sha256 = "be0f1b2db6b93eed55369cdf79f19f72750c8c7c39fc20b577e724545427e6b2";
     md5 = "";
-    md5name = "89ce1ae893e122924b858de84dc4f67aae29ffa610ebf668d5aa539045663d6f-libgpg-error-1.48.tar.bz2";
+    md5name = "be0f1b2db6b93eed55369cdf79f19f72750c8c7c39fc20b577e724545427e6b2-libgpg-error-1.51.tar.bz2";
   }
   {
     name = "liblangtag-0.6.7.tar.bz2";
@@ -616,18 +616,18 @@
     md5name = "296272d93435991308eb73607600c034b558807a07e829e751142e65ccfa9d08-ltm-1.3.0.tar.xz";
   }
   {
-    name = "libwebp-1.3.2.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/libwebp-1.3.2.tar.gz";
-    sha256 = "2a499607df669e40258e53d0ade8035ba4ec0175244869d1025d460562aa09b4";
+    name = "libwebp-1.4.0.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/libwebp-1.4.0.tar.gz";
+    sha256 = "61f873ec69e3be1b99535634340d5bde750b2e4447caa1db9f61be3fd49ab1e5";
     md5 = "";
-    md5name = "2a499607df669e40258e53d0ade8035ba4ec0175244869d1025d460562aa09b4-libwebp-1.3.2.tar.gz";
+    md5name = "61f873ec69e3be1b99535634340d5bde750b2e4447caa1db9f61be3fd49ab1e5-libwebp-1.4.0.tar.gz";
   }
   {
-    name = "xmlsec1-1.3.2.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/xmlsec1-1.3.2.tar.gz";
-    sha256 = "4003c56b3d356d21b1db7775318540fad6bfedaf5f117e8f7c010811219be3cf";
+    name = "xmlsec1-1.3.5.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/xmlsec1-1.3.5.tar.gz";
+    sha256 = "2ffd4ad1f860ec93e47a680310ab2bc94968bd07566e71976bd96133d9504917";
     md5 = "";
-    md5name = "4003c56b3d356d21b1db7775318540fad6bfedaf5f117e8f7c010811219be3cf-xmlsec1-1.3.2.tar.gz";
+    md5name = "2ffd4ad1f860ec93e47a680310ab2bc94968bd07566e71976bd96133d9504917-xmlsec1-1.3.5.tar.gz";
   }
   {
     name = "libxml2-2.12.9.tar.xz";
@@ -637,11 +637,11 @@
     md5name = "59912db536ab56a3996489ea0299768c7bcffe57169f0235e7f962a91f483590-libxml2-2.12.9.tar.xz";
   }
   {
-    name = "libxslt-1.1.39.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libxslt-1.1.39.tar.xz";
-    sha256 = "2a20ad621148339b0759c4d4e96719362dee64c9a096dbba625ba053846349f0";
+    name = "libxslt-1.1.41.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libxslt-1.1.41.tar.xz";
+    sha256 = "3ad392af91115b7740f7b50d228cc1c5fc13afc1da7f16cb0213917a37f71bda";
     md5 = "";
-    md5name = "2a20ad621148339b0759c4d4e96719362dee64c9a096dbba625ba053846349f0-libxslt-1.1.39.tar.xz";
+    md5name = "3ad392af91115b7740f7b50d228cc1c5fc13afc1da7f16cb0213917a37f71bda-libxslt-1.1.41.tar.xz";
   }
   {
     name = "lp_solve_5.5.tar.gz";
@@ -651,18 +651,18 @@
     md5name = "26b3e95ddf3d9c077c480ea45874b3b8-lp_solve_5.5.tar.gz";
   }
   {
-    name = "lxml-4.9.2.tgz";
-    url = "https://dev-www.libreoffice.org/src/lxml-4.9.2.tgz";
-    sha256 = "2455cfaeb7ac70338b3257f41e21f0724f4b5b0c0e7702da67ee6c3640835b67";
+    name = "lxml-5.2.2.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/lxml-5.2.2.tar.gz";
+    sha256 = "bb2dc4898180bea79863d5487e5f9c7c34297414bad54bcd0f0852aee9cfdb87";
     md5 = "";
-    md5name = "2455cfaeb7ac70338b3257f41e21f0724f4b5b0c0e7702da67ee6c3640835b67-lxml-4.9.2.tgz";
+    md5name = "bb2dc4898180bea79863d5487e5f9c7c34297414bad54bcd0f0852aee9cfdb87-lxml-5.2.2.tar.gz";
   }
   {
-    name = "mariadb-connector-c-3.3.11-src.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/mariadb-connector-c-3.3.11-src.tar.gz";
-    sha256 = "f7ba02f70aa2ae2b13e9ee5acc78423f6bede38998afb91326a62be46cf5956a";
+    name = "mariadb-connector-c-3.3.13-src.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/mariadb-connector-c-3.3.13-src.tar.gz";
+    sha256 = "1c03c30b394871ab354dbdb47574beae19e2657da21a911ecc9e33e9388a3bef";
     md5 = "";
-    md5name = "f7ba02f70aa2ae2b13e9ee5acc78423f6bede38998afb91326a62be46cf5956a-mariadb-connector-c-3.3.11-src.tar.gz";
+    md5name = "1c03c30b394871ab354dbdb47574beae19e2657da21a911ecc9e33e9388a3bef-mariadb-connector-c-3.3.13-src.tar.gz";
   }
   {
     name = "mdds-2.1.1.tar.xz";
@@ -686,11 +686,11 @@
     md5name = "ef36c1a1aabb2ba3b0bedaaafe717bf4480be2ba8de6f3894be5fd3702b013ba-libmspub-0.1.4.tar.xz";
   }
   {
-    name = "libmwaw-0.3.21.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libmwaw-0.3.21.tar.xz";
-    sha256 = "e8750123a78d61b943cef78b7736c8a7f20bb0a649aa112402124fba794fc21c";
+    name = "libmwaw-0.3.22.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libmwaw-0.3.22.tar.xz";
+    sha256 = "a1a39ffcea3ff2a7a7aae0c23877ddf4918b554bf82b0de5d7ce8e7f61ea8e32";
     md5 = "";
-    md5name = "e8750123a78d61b943cef78b7736c8a7f20bb0a649aa112402124fba794fc21c-libmwaw-0.3.21.tar.xz";
+    md5name = "a1a39ffcea3ff2a7a7aae0c23877ddf4918b554bf82b0de5d7ce8e7f61ea8e32-libmwaw-0.3.22.tar.xz";
   }
   {
     name = "mythes-1.2.5.tar.xz";
@@ -700,11 +700,11 @@
     md5name = "19279f70707bbe5ffa619f2dc319f888cec0c4a8d339dc0a21330517bd6f521d-mythes-1.2.5.tar.xz";
   }
   {
-    name = "nss-3.101.2-with-nspr-4.35.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/nss-3.101.2-with-nspr-4.35.tar.gz";
-    sha256 = "ff602c1fa86a4f841b27109918dfff60f41582e1caf6dbd651cfa72bdc8a64aa";
+    name = "nss-3.102.1-with-nspr-4.35.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/nss-3.102.1-with-nspr-4.35.tar.gz";
+    sha256 = "ddfdec73fb4b0eedce5fc4de09de9ba14d2ddbfbf67e42372903e1510f2d3d65";
     md5 = "";
-    md5name = "ff602c1fa86a4f841b27109918dfff60f41582e1caf6dbd651cfa72bdc8a64aa-nss-3.101.2-with-nspr-4.35.tar.gz";
+    md5name = "ddfdec73fb4b0eedce5fc4de09de9ba14d2ddbfbf67e42372903e1510f2d3d65-nss-3.102.1-with-nspr-4.35.tar.gz";
   }
   {
     name = "libodfgen-0.1.8.tar.xz";
@@ -735,11 +735,11 @@
     md5name = "37206cf981e8409d048b59ac5839621ea107ff49af72beb9d7769a2f41da8d90-onlineupdate-c003be8b9727672e7d30972983b375f4c200233f-2.tar.xz";
   }
   {
-    name = "openldap-2.6.7.tgz";
-    url = "https://dev-www.libreoffice.org/src/openldap-2.6.7.tgz";
-    sha256 = "cd775f625c944ed78a3da18a03b03b08eea73c8aabc97b41bb336e9a10954930";
+    name = "openldap-2.6.9.tgz";
+    url = "https://dev-www.libreoffice.org/src/openldap-2.6.9.tgz";
+    sha256 = "2cb7dc73e9c8340dff0d99357fbaa578abf30cc6619f0521972c555681e6b2ff";
     md5 = "";
-    md5name = "cd775f625c944ed78a3da18a03b03b08eea73c8aabc97b41bb336e9a10954930-openldap-2.6.7.tgz";
+    md5name = "2cb7dc73e9c8340dff0d99357fbaa578abf30cc6619f0521972c555681e6b2ff-openldap-2.6.9.tgz";
   }
   {
     name = "openssl-3.0.15.tar.gz";
@@ -763,11 +763,11 @@
     md5name = "66adacd705a7d19895e08eac46d1e851332adf2e736c566bef1164e7a442519d-libpagemaker-0.0.4.tar.xz";
   }
   {
-    name = "pdfium-6179.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/pdfium-6179.tar.bz2";
-    sha256 = "4d3f08fe0e2fda86246832085426616826dcca0912202874428bfbc24d13d95c";
+    name = "pdfium-6425.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/pdfium-6425.tar.bz2";
+    sha256 = "fe0291b96d7352bac530d13ef2e5fd63ad9980e0128911f88b957b5992508f1c";
     md5 = "";
-    md5name = "4d3f08fe0e2fda86246832085426616826dcca0912202874428bfbc24d13d95c-pdfium-6179.tar.bz2";
+    md5name = "fe0291b96d7352bac530d13ef2e5fd63ad9980e0128911f88b957b5992508f1c-pdfium-6425.tar.bz2";
   }
   {
     name = "pixman-0.42.2.tar.gz";
@@ -805,18 +805,18 @@
     md5name = "c835b640a40ce357e1b83666aabd95edffa24ddddd49b8daff63adb851cdab74-poppler-data-0.4.12.tar.gz";
   }
   {
-    name = "postgresql-13.16.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/postgresql-13.16.tar.bz2";
-    sha256 = "c9cbbb6129f02328204828066bb3785c00a85c8ca8fd329c2a8a53c1f5cd8865";
+    name = "postgresql-13.18.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/postgresql-13.18.tar.bz2";
+    sha256 = "ceea92abee2a8c19408d278b68de6a78b6bd3dbb4fa2d653fa7ca745d666aab1";
     md5 = "";
-    md5name = "c9cbbb6129f02328204828066bb3785c00a85c8ca8fd329c2a8a53c1f5cd8865-postgresql-13.16.tar.bz2";
+    md5name = "ceea92abee2a8c19408d278b68de6a78b6bd3dbb4fa2d653fa7ca745d666aab1-postgresql-13.18.tar.bz2";
   }
   {
-    name = "Python-3.8.20.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/Python-3.8.20.tar.xz";
-    sha256 = "6fb89a7124201c61125c0ab4cf7f6894df339a40c02833bfd28ab4d7691fafb4";
+    name = "Python-3.9.21.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/Python-3.9.21.tar.xz";
+    sha256 = "3126f59592c9b0d798584755f2bf7b081fa1ca35ce7a6fea980108d752a05bb1";
     md5 = "";
-    md5name = "6fb89a7124201c61125c0ab4cf7f6894df339a40c02833bfd28ab4d7691fafb4-Python-3.8.20.tar.xz";
+    md5name = "3126f59592c9b0d798584755f2bf7b081fa1ca35ce7a6fea980108d752a05bb1-Python-3.9.21.tar.xz";
   }
   {
     name = "libqxp-0.0.2.tar.xz";
@@ -847,18 +847,18 @@
     md5name = "e5be03eda13ef68aabab6e42aa67715e-redland-1.0.17.tar.gz";
   }
   {
-    name = "librevenge-0.0.4.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/librevenge-0.0.4.tar.bz2";
-    sha256 = "c51601cd08320b75702812c64aae0653409164da7825fd0f451ac2c5dbe77cbf";
+    name = "librevenge-0.0.5.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/librevenge-0.0.5.tar.bz2";
+    sha256 = "5892ca6796f7a2a93d580832e907e849b19d980b40d326a283b18877ab6de0c5";
     md5 = "";
-    md5name = "c51601cd08320b75702812c64aae0653409164da7825fd0f451ac2c5dbe77cbf-librevenge-0.0.4.tar.bz2";
+    md5name = "5892ca6796f7a2a93d580832e907e849b19d980b40d326a283b18877ab6de0c5-librevenge-0.0.5.tar.bz2";
   }
   {
-    name = "rhino1_5R5.zip";
-    url = "https://dev-www.libreoffice.org/src/798b2ffdc8bcfe7bca2cf92b62caf685-rhino1_5R5.zip";
-    sha256 = "1fb458d6aab06932693cc8a9b6e4e70944ee1ff052fa63606e3131df34e21753";
-    md5 = "798b2ffdc8bcfe7bca2cf92b62caf685";
-    md5name = "798b2ffdc8bcfe7bca2cf92b62caf685-rhino1_5R5.zip";
+    name = "rhino-1.7.14.zip";
+    url = "https://dev-www.libreoffice.org/src/rhino-1.7.14.zip";
+    sha256 = "bf4d2d0c5ff8889fd494486db09291cb7965f0bf2f93ef005d3b08070a5a4f5c";
+    md5 = "";
+    md5name = "bf4d2d0c5ff8889fd494486db09291cb7965f0bf2f93ef005d3b08070a5a4f5c-rhino-1.7.14.zip";
   }
   {
     name = "skia-m116-2ddcf183eb260f63698aa74d1bb380f247ad7ccd.tar.xz";
@@ -874,13 +874,6 @@
     md5 = "";
     md5name = "f94fb0ad8216f97127bedef163a45886b43c62deac5e5b0f5e628e234220c8db-libstaroffice-0.0.7.tar.xz";
   }
-  {
-    name = "swingExSrc.zip";
-    url = "https://dev-www.libreoffice.org/src/35c94d2df8893241173de1d16b6034c0-swingExSrc.zip";
-    sha256 = "64585ac36a81291a58269ec5347e7e3e2e8596dbacb9221015c208191333c6e1";
-    md5 = "35c94d2df8893241173de1d16b6034c0";
-    md5name = "35c94d2df8893241173de1d16b6034c0-swingExSrc.zip";
-  }
   {
     name = "twaindsm_2.4.1.orig.tar.gz";
     url = "https://dev-www.libreoffice.org/src/twaindsm_2.4.1.orig.tar.gz";
@@ -889,11 +882,11 @@
     md5name = "82c818be771f242388457aa8c807e4b52aa84dc22b21c6c56184a6b4cbb085e6-twaindsm_2.4.1.orig.tar.gz";
   }
   {
-    name = "libvisio-0.1.7.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libvisio-0.1.7.tar.xz";
-    sha256 = "8faf8df870cb27b09a787a1959d6c646faa44d0d8ab151883df408b7166bea4c";
+    name = "libvisio-0.1.8.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libvisio-0.1.8.tar.xz";
+    sha256 = "b4098ffbf4dcb9e71213fa0acddbd928f27bed30db2d80234813b15d53d0405b";
     md5 = "";
-    md5name = "8faf8df870cb27b09a787a1959d6c646faa44d0d8ab151883df408b7166bea4c-libvisio-0.1.7.tar.xz";
+    md5name = "b4098ffbf4dcb9e71213fa0acddbd928f27bed30db2d80234813b15d53d0405b-libvisio-0.1.8.tar.xz";
   }
   {
     name = "libwpd-0.10.3.tar.xz";
@@ -945,10 +938,10 @@
     md5name = "77d6c6ecb35952a8d8ce7f736b7a2bf466275c48210e309b73782d6b7e84dffd-zxcvbn-c-2.5.tar.gz";
   }
   {
-    name = "zxing-cpp-2.1.0.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/zxing-cpp-2.1.0.tar.gz";
-    sha256 = "6d54e403592ec7a143791c6526c1baafddf4c0897bb49b1af72b70a0f0c4a3fe";
+    name = "zxing-cpp-2.2.1.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/zxing-cpp-2.2.1.tar.gz";
+    sha256 = "02078ae15f19f9d423a441f205b1d1bee32349ddda7467e2c84e8f08876f8635";
     md5 = "";
-    md5name = "6d54e403592ec7a143791c6526c1baafddf4c0897bb49b1af72b70a0f0c4a3fe-zxing-cpp-2.1.0.tar.gz";
+    md5name = "02078ae15f19f9d423a441f205b1d1bee32349ddda7467e2c84e8f08876f8635-zxing-cpp-2.2.1.tar.gz";
   }
 ]
diff --git a/pkgs/applications/office/libreoffice/src-still/help.nix b/pkgs/applications/office/libreoffice/src-still/help.nix
index b61ff5be0e7b..2d3477707242 100644
--- a/pkgs/applications/office/libreoffice/src-still/help.nix
+++ b/pkgs/applications/office/libreoffice/src-still/help.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "0g31xfmmxjd5c1xg203gflzvq2d2jlgfi9gmg1wxl18l9gjk4hds";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.2.7/libreoffice-help-24.2.7.2.tar.xz";
+  sha256 = "0z09pif1xmivmrnf5rjbcqc72khj0sg44905qrphp8cgvbx4n3ph";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.8.4/libreoffice-help-24.8.4.2.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-still/main.nix b/pkgs/applications/office/libreoffice/src-still/main.nix
index 2bb8d53a4de6..7315b6e7b9bb 100644
--- a/pkgs/applications/office/libreoffice/src-still/main.nix
+++ b/pkgs/applications/office/libreoffice/src-still/main.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "1r8h8g5fs7z0fvf7f6fq44rw90q4v2z23kkwzdh1s8gaxlnb3sgm";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.2.7/libreoffice-24.2.7.2.tar.xz";
+  sha256 = "05qs12z0xkpqy3yl7378d99y82rswic101aw65k1macslcpdwr0m";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.8.4/libreoffice-24.8.4.2.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-still/translations.nix b/pkgs/applications/office/libreoffice/src-still/translations.nix
index fd248167fbc2..698f2eefb726 100644
--- a/pkgs/applications/office/libreoffice/src-still/translations.nix
+++ b/pkgs/applications/office/libreoffice/src-still/translations.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "0g2wp8s3gxhy3l685jv3h63gzaljfclgcah437922dl60kpm9yjq";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.2.7/libreoffice-translations-24.2.7.2.tar.xz";
+  sha256 = "0z84m2q5c9zjbb491m84s8sf2dgaxvvx03dl3f1qyajvpf1mnlld";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.8.4/libreoffice-translations-24.8.4.2.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-still/version.nix b/pkgs/applications/office/libreoffice/src-still/version.nix
index 351ceee22bf4..845b695dd16b 100644
--- a/pkgs/applications/office/libreoffice/src-still/version.nix
+++ b/pkgs/applications/office/libreoffice/src-still/version.nix
@@ -1 +1 @@
-"24.2.7.2"
+"24.8.4.2"
diff --git a/pkgs/by-name/as/asusctl/package.nix b/pkgs/by-name/as/asusctl/package.nix
index 3ff9cfb714dd..5de7b319bb37 100644
--- a/pkgs/by-name/as/asusctl/package.nix
+++ b/pkgs/by-name/as/asusctl/package.nix
@@ -17,17 +17,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "asusctl";
-  version = "6.1.1";
+  version = "6.1.2";
 
   src = fetchFromGitLab {
     owner = "asus-linux";
     repo = "asusctl";
     rev = version;
-    hash = "sha256-E2c4KhwLGAgorq4cHdPt/j45ebL0k+A/ktkXh71utxA=";
+    hash = "sha256-nhhlimr1w0tgfzPQTr/Opey2Hviy1YAdSVUe5YINnZE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-o+u4k6yGVThBO9Chv4EwVpkDZzZj64RN9iNZyAy0LHs=";
+  cargoHash = "sha256-qgnMPICq7K3UT5l2T/nEvvWfEeNBpxwJburVJeAhQSs=";
 
   postPatch = ''
     files="
diff --git a/pkgs/by-name/cl/cloudlist/package.nix b/pkgs/by-name/cl/cloudlist/package.nix
index 18fb694db7e0..0a7738c20a61 100644
--- a/pkgs/by-name/cl/cloudlist/package.nix
+++ b/pkgs/by-name/cl/cloudlist/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "cloudlist";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cloudlist";
     tag = "v${version}";
-    hash = "sha256-HV4qhQgeLKwkyrRFzRQibqjWRyjLBtoWVdliJ+iyyBc=";
+    hash = "sha256-6XgqhCL8ehK8k3k8fKLFZSmUz8G3MwqXhjEpA99F0K4=";
   };
 
-  vendorHash = "sha256-6J9AWONLP/FvR0dXt5Zx4n+kTpmnxF79HcWVFp9OZ0g=";
+  vendorHash = "sha256-4vR03dC8ZfBM7Jw3JqGxZ/DGxfTx8279j7CzSOQKPkQ=";
 
   subPackages = [ "cmd/cloudlist/" ];
 
diff --git a/pkgs/by-name/er/ergo/package.nix b/pkgs/by-name/er/ergo/package.nix
index 6eb6c6f574c1..b9d8f66439b8 100644
--- a/pkgs/by-name/er/ergo/package.nix
+++ b/pkgs/by-name/er/ergo/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "5.0.24";
+  version = "5.0.25";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-+dpSgqJGHUNzIBQBbfbeclB5t+NyaluGRTCZ4OESZu8=";
+    sha256 = "sha256-4Eoo1f9oLxYdFC1M46Bq1D9RbIeOoWh0qECzcBbv3KA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/go/goreleaser/package.nix b/pkgs/by-name/go/goreleaser/package.nix
index ff6c2dbe14a1..34ea472a0bdc 100644
--- a/pkgs/by-name/go/goreleaser/package.nix
+++ b/pkgs/by-name/go/goreleaser/package.nix
@@ -10,16 +10,16 @@
 }:
 buildGoModule rec {
   pname = "goreleaser";
-  version = "2.6.1";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = "goreleaser";
     rev = "v${version}";
-    hash = "sha256-MlI76xiHT+JZAaL7LnEqHOgt6UypVoBjZHTmQXrnNxs=";
+    hash = "sha256-tpUnoW2Hx/A+bmhAn0GctllILEx9QCfgpscJWJTxJUU=";
   };
 
-  vendorHash = "sha256-fYYPpf/Hnci5DCvhbWkmenTL+95PvqPtn1RdoRby+jI=";
+  vendorHash = "sha256-coO4Y+/ELu4yRusxop/Xc4cTlc+6HYAVIfiUbC2bLTw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ka/kanidm/1_5.nix b/pkgs/by-name/ka/kanidm/1_5.nix
new file mode 100644
index 000000000000..93afad5ee0f8
--- /dev/null
+++ b/pkgs/by-name/ka/kanidm/1_5.nix
@@ -0,0 +1,6 @@
+import ./generic.nix {
+  version = "1.5.0";
+  hash = "sha256-swrqyjA7Wgq17vd+753LDFcXrSFixVNLhTvj1bhG3DU=";
+  cargoHash = "sha256-72IwS8Nk1y6xDH9y8JW2LpbhFWaq0tpORx7JQSCF5/M=";
+  patchDir = ./patches/1_5;
+}
diff --git a/pkgs/by-name/ka/kanidm/README.md b/pkgs/by-name/ka/kanidm/README.md
new file mode 100644
index 000000000000..34a354596218
--- /dev/null
+++ b/pkgs/by-name/ka/kanidm/README.md
@@ -0,0 +1,47 @@
+# Kanidm release guide
+
+Kanidm supports one release at any given time, with a 30-day overlap to allow for upgrades from old to new version.
+Version upgrades are only supported on adjacent releases, with no support for jumping versions.
+
+To ensure we provide sufficient coverage for upgrading, we will aim to have two or three releases in tree at any given time.
+Unsupported versions will be marked as vulnerable (lacking an "unsupported" mechanism), but built by hydra to avoid pushing the very large rebuild on users.
+
+The default version will be updated with each new version, but the default will not be backported.
+It is expected that stable users will have to manually specify the version, and update that version, throughout the lifecycle of a NixOS release.
+
+## New release
+
+For example, when upgrading from 1.4 -> 1.5
+
+### Init new version
+
+1. `cp pkgs/by-name/ka/kanidm/1_4.nix pkgs/by-name/ka/kanidm/1_5.nix`
+1. `cp -r pkgs/by-name/ka/kanidm/patches/1_4 pkgs/by-name/ka/kanidm/patches/1_5`
+1. Update `1_5.nix` hashes/paths, and as needed for upstream changes, `generic.nix`
+1. Update `all-packages.nix` to add `kanidm_1_5` and `kanidmWithSecretProvisioning_1_5`, leave default
+1. Create commit, `kanidm_1_5: init at 1.5.0` - this is the only commit that will be backported
+
+### Mark previous version deprecated
+
+1. Update `pkgs/by-name/ka/kanidm/1_4.nix` by adding `deprecated = true;`
+1. Create commit `kanidm_1_4: update default to 1.5.0, deprecate 1.4.0`
+
+### Update default and mark deprecation
+
+1. `sed -i 's/1_4/1_5/' pkgs/by-name/ka/kanidm/package.nix`
+1. Update `all-packages.nix` and set `kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_5;`
+1. Create commit `kanidm: update default to 1.5.0`
+
+### Backport to stable
+
+1. Manually create a backport using _only_ the init commit
+
+## Remove release
+
+Kanidm versions are supported for 30 days after the release of new versions. Following the example above, 1.5.x superseding 1.4.x in 30 days, do the following near the end of the 30 day window
+
+1. Update `pkgs/top-level/release.nix` and add `kanidm_1_4-1.4.6` to `permittedInsecurePackages`
+1. Update `pkgs/top-level/release.nix` and remove `kanidm_1_3-1.3.3` from `permittedInsecurePackages`
+1. Remove the third oldest release from `all-packages.nix`, e.g. 1.3.x continuing the example. Remove `kanidm_1_3` and `kanidmWithSecretProvisioning_1_3`
+1. Update `pkgs/by-name/ka/kanidm/1_4.nix` by adding `unsupported = true;`
+1. Open a PR and backport it to stable
diff --git a/pkgs/by-name/ka/kanidm/generic.nix b/pkgs/by-name/ka/kanidm/generic.nix
index 8512f1fc357c..ddaaba190fff 100644
--- a/pkgs/by-name/ka/kanidm/generic.nix
+++ b/pkgs/by-name/ka/kanidm/generic.nix
@@ -4,6 +4,7 @@
   cargoHash,
   patchDir,
   extraMeta ? { },
+  unsupported ? false,
 }:
 
 {
@@ -60,8 +61,18 @@ rustPlatform.buildRustPackage rec {
       format = (formats.toml { }).generate "${KANIDM_BUILD_PROFILE}.toml";
       profile =
         {
-          admin_bind_path = "/run/kanidmd/sock";
           cpu_flags = if stdenv.hostPlatform.isx86_64 then "x86_64_legacy" else "none";
+        }
+        // lib.optionalAttrs (lib.versionAtLeast version "1.5") {
+          client_config_path = "/etc/kanidm/config";
+          resolver_config_path = "/etc/kanidm/unixd";
+          resolver_unix_shell_path = "${lib.getBin bashInteractive}/bin/bash";
+          server_admin_bind_path = "/run/kanidmd/sock";
+          server_config_path = "/etc/kanidm/server.toml";
+          server_ui_pkg_path = "@htmx_ui_pkg_path@";
+        }
+        // lib.optionalAttrs (lib.versionOlder version "1.5") {
+          admin_bind_path = "/run/kanidmd/sock";
           default_config_path = "/etc/kanidm/server.toml";
           default_unix_shell_path = "${lib.getBin bashInteractive}/bin/bash";
           htmx_ui_pkg_path = "@htmx_ui_pkg_path@";
@@ -160,6 +171,14 @@ rustPlatform.buildRustPackage rec {
         adamcstephens
         Flakebi
       ];
+      knownVulnerabilities = lib.optionals unsupported [
+        ''
+          kanidm ${version} has reached EOL.
+
+          Please upgrade by verifying `kanidmd domain upgrade-check` and choosing the next version with `services.kanidm.package = pkgs.kanidm_1_x;`
+          See upgrade guide at https://kanidm.github.io/kanidm/master/server_updates.html
+        ''
+      ];
     }
     // extraMeta;
 }
diff --git a/pkgs/by-name/ka/kanidm/package.nix b/pkgs/by-name/ka/kanidm/package.nix
index a7bf92b6be6d..0b9178b3d6a7 100644
--- a/pkgs/by-name/ka/kanidm/package.nix
+++ b/pkgs/by-name/ka/kanidm/package.nix
@@ -1 +1 @@
-import ./1_4.nix
+import ./1_5.nix
diff --git a/pkgs/by-name/ka/kanidm/patches/1_5/oauth2-basic-secret-modify.patch b/pkgs/by-name/ka/kanidm/patches/1_5/oauth2-basic-secret-modify.patch
new file mode 100644
index 000000000000..80bd4c16bd9b
--- /dev/null
+++ b/pkgs/by-name/ka/kanidm/patches/1_5/oauth2-basic-secret-modify.patch
@@ -0,0 +1,308 @@
+From e9dfca73e6fb80faf6fc106e7aee6b93c0908525 Mon Sep 17 00:00:00 2001
+From: oddlama <oddlama@oddlama.org>
+Date: Fri, 1 Nov 2024 12:26:17 +0100
+Subject: [PATCH 1/2] oauth2 basic secret modify
+
+---
+ server/core/src/actors/v1_write.rs | 42 ++++++++++++++++++++++++++++++
+ server/core/src/https/v1.rs        |  6 ++++-
+ server/core/src/https/v1_oauth2.rs | 29 +++++++++++++++++++++
+ server/lib/src/constants/acp.rs    |  6 +++++
+ 4 files changed, 82 insertions(+), 1 deletion(-)
+
+diff --git a/server/core/src/actors/v1_write.rs b/server/core/src/actors/v1_write.rs
+index 732e826c8..0fe66503f 100644
+--- a/server/core/src/actors/v1_write.rs
++++ b/server/core/src/actors/v1_write.rs
+@@ -317,20 +317,62 @@ impl QueryServerWriteV1 {
+         };
+ 
+         trace!(?del, "Begin delete event");
+ 
+         idms_prox_write
+             .qs_write
+             .delete(&del)
+             .and_then(|_| idms_prox_write.commit().map(|_| ()))
+     }
+ 
++    #[instrument(
++        level = "info",
++        skip_all,
++        fields(uuid = ?eventid)
++    )]
++    pub async fn handle_oauth2_basic_secret_write(
++        &self,
++        client_auth_info: ClientAuthInfo,
++        filter: Filter<FilterInvalid>,
++        new_secret: String,
++        eventid: Uuid,
++    ) -> Result<(), OperationError> {
++        // Given a protoEntry, turn this into a modification set.
++        let ct = duration_from_epoch_now();
++        let mut idms_prox_write = self.idms.proxy_write(ct).await?;
++        let ident = idms_prox_write
++            .validate_client_auth_info_to_ident(client_auth_info, ct)
++            .map_err(|e| {
++                admin_error!(err = ?e, "Invalid identity");
++                e
++            })?;
++
++        let modlist = ModifyList::new_purge_and_set(
++            Attribute::OAuth2RsBasicSecret,
++            Value::SecretValue(new_secret),
++        );
++
++        let mdf =
++            ModifyEvent::from_internal_parts(ident, &modlist, &filter, &idms_prox_write.qs_write)
++                .map_err(|e| {
++                admin_error!(err = ?e, "Failed to begin modify during handle_oauth2_basic_secret_write");
++                e
++            })?;
++
++        trace!(?mdf, "Begin modify event");
++
++        idms_prox_write
++            .qs_write
++            .modify(&mdf)
++            .and_then(|_| idms_prox_write.commit())
++    }
++
+     #[instrument(
+         level = "info",
+         skip_all,
+         fields(uuid = ?eventid)
+     )]
+     pub async fn handle_reviverecycled(
+         &self,
+         client_auth_info: ClientAuthInfo,
+         filter: Filter<FilterInvalid>,
+         eventid: Uuid,
+diff --git a/server/core/src/https/v1.rs b/server/core/src/https/v1.rs
+index c410a4b5d..cc67cac6c 100644
+--- a/server/core/src/https/v1.rs
++++ b/server/core/src/https/v1.rs
+@@ -1,17 +1,17 @@
+ //! The V1 API things!
+ 
+ use axum::extract::{Path, State};
+ use axum::http::{HeaderMap, HeaderValue};
+ use axum::middleware::from_fn;
+ use axum::response::{IntoResponse, Response};
+-use axum::routing::{delete, get, post, put};
++use axum::routing::{delete, get, post, put, patch};
+ use axum::{Extension, Json, Router};
+ use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
+ use compact_jwt::{Jwk, Jws, JwsSigner};
+ use kanidm_proto::constants::uri::V1_AUTH_VALID;
+ use std::net::IpAddr;
+ use uuid::Uuid;
+ 
+ use kanidm_proto::internal::{
+     ApiToken, AppLink, CUIntentToken, CURequest, CUSessionToken, CUStatus, CreateRequest,
+     CredentialStatus, DeleteRequest, IdentifyUserRequest, IdentifyUserResponse, ModifyRequest,
+@@ -3120,20 +3120,24 @@ pub(crate) fn route_setup(state: ServerState) -> Router<ServerState> {
+         )
+         .route(
+             "/v1/oauth2/:rs_name/_image",
+             post(super::v1_oauth2::oauth2_id_image_post)
+                 .delete(super::v1_oauth2::oauth2_id_image_delete),
+         )
+         .route(
+             "/v1/oauth2/:rs_name/_basic_secret",
+             get(super::v1_oauth2::oauth2_id_get_basic_secret),
+         )
++        .route(
++            "/v1/oauth2/:rs_name/_basic_secret",
++            patch(super::v1_oauth2::oauth2_id_patch_basic_secret),
++        )
+         .route(
+             "/v1/oauth2/:rs_name/_scopemap/:group",
+             post(super::v1_oauth2::oauth2_id_scopemap_post)
+                 .delete(super::v1_oauth2::oauth2_id_scopemap_delete),
+         )
+         .route(
+             "/v1/oauth2/:rs_name/_sup_scopemap/:group",
+             post(super::v1_oauth2::oauth2_id_sup_scopemap_post)
+                 .delete(super::v1_oauth2::oauth2_id_sup_scopemap_delete),
+         )
+diff --git a/server/core/src/https/v1_oauth2.rs b/server/core/src/https/v1_oauth2.rs
+index d3966a7ad..f89c02c69 100644
+--- a/server/core/src/https/v1_oauth2.rs
++++ b/server/core/src/https/v1_oauth2.rs
+@@ -144,20 +144,49 @@ pub(crate) async fn oauth2_id_get_basic_secret(
+ ) -> Result<Json<Option<String>>, WebError> {
+     let filter = oauth2_id(&rs_name);
+     state
+         .qe_r_ref
+         .handle_oauth2_basic_secret_read(client_auth_info, filter, kopid.eventid)
+         .await
+         .map(Json::from)
+         .map_err(WebError::from)
+ }
+ 
++#[utoipa::path(
++    patch,
++    path = "/v1/oauth2/{rs_name}/_basic_secret",
++    request_body=ProtoEntry,
++    responses(
++        DefaultApiResponse,
++    ),
++    security(("token_jwt" = [])),
++    tag = "v1/oauth2",
++    operation_id = "oauth2_id_patch_basic_secret"
++)]
++/// Overwrite the basic secret for a given OAuth2 Resource Server.
++#[instrument(level = "info", skip(state, new_secret))]
++pub(crate) async fn oauth2_id_patch_basic_secret(
++    State(state): State<ServerState>,
++    Extension(kopid): Extension<KOpId>,
++    VerifiedClientInformation(client_auth_info): VerifiedClientInformation,
++    Path(rs_name): Path<String>,
++    Json(new_secret): Json<String>,
++) -> Result<Json<()>, WebError> {
++    let filter = oauth2_id(&rs_name);
++    state
++        .qe_w_ref
++        .handle_oauth2_basic_secret_write(client_auth_info, filter, new_secret, kopid.eventid)
++        .await
++        .map(Json::from)
++        .map_err(WebError::from)
++}
++
+ #[utoipa::path(
+     patch,
+     path = "/v1/oauth2/{rs_name}",
+     request_body=ProtoEntry,
+     responses(
+         DefaultApiResponse,
+     ),
+     security(("token_jwt" = [])),
+     tag = "v1/oauth2",
+     operation_id = "oauth2_id_patch"
+diff --git a/server/lib/src/constants/acp.rs b/server/lib/src/constants/acp.rs
+index be1836345..ebf4445be 100644
+--- a/server/lib/src/constants/acp.rs
++++ b/server/lib/src/constants/acp.rs
+@@ -658,36 +658,38 @@ lazy_static! {
+             Attribute::Image,
+         ],
+         modify_present_attrs: vec![
+             Attribute::Description,
+             Attribute::DisplayName,
+             Attribute::OAuth2RsName,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::OAuth2AllowLocalhostRedirect,
+             Attribute::OAuth2RsClaimMap,
+             Attribute::Image,
+         ],
+         create_attrs: vec![
+             Attribute::Class,
+             Attribute::Description,
+             Attribute::DisplayName,
+             Attribute::OAuth2RsName,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::OAuth2AllowLocalhostRedirect,
+             Attribute::OAuth2RsClaimMap,
+             Attribute::Image,
+         ],
+         create_classes: vec![
+             EntryClass::Object,
+             EntryClass::OAuth2ResourceServer,
+@@ -759,37 +761,39 @@ lazy_static! {
+             Attribute::Image,
+         ],
+         modify_present_attrs: vec![
+             Attribute::Description,
+             Attribute::DisplayName,
+             Attribute::Name,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::OAuth2AllowLocalhostRedirect,
+             Attribute::OAuth2RsClaimMap,
+             Attribute::Image,
+         ],
+         create_attrs: vec![
+             Attribute::Class,
+             Attribute::Description,
+             Attribute::Name,
+             Attribute::DisplayName,
+             Attribute::OAuth2RsName,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::OAuth2AllowLocalhostRedirect,
+             Attribute::OAuth2RsClaimMap,
+             Attribute::Image,
+         ],
+         create_classes: vec![
+             EntryClass::Object,
+             EntryClass::Account,
+@@ -864,38 +868,40 @@ lazy_static! {
+             Attribute::OAuth2StrictRedirectUri,
+         ],
+         modify_present_attrs: vec![
+             Attribute::Description,
+             Attribute::DisplayName,
+             Attribute::Name,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::OAuth2AllowLocalhostRedirect,
+             Attribute::OAuth2RsClaimMap,
+             Attribute::Image,
+             Attribute::OAuth2StrictRedirectUri,
+         ],
+         create_attrs: vec![
+             Attribute::Class,
+             Attribute::Description,
+             Attribute::Name,
+             Attribute::DisplayName,
+             Attribute::OAuth2RsName,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::OAuth2AllowLocalhostRedirect,
+             Attribute::OAuth2RsClaimMap,
+             Attribute::Image,
+             Attribute::OAuth2StrictRedirectUri,
+         ],
+         create_classes: vec![
+             EntryClass::Object,
+-- 
+2.46.1
+
diff --git a/pkgs/by-name/ka/kanidm/patches/1_5/recover-account.patch b/pkgs/by-name/ka/kanidm/patches/1_5/recover-account.patch
new file mode 100644
index 000000000000..1ec61301f036
--- /dev/null
+++ b/pkgs/by-name/ka/kanidm/patches/1_5/recover-account.patch
@@ -0,0 +1,173 @@
+From c8ed69efe3f702b19834c2659be1dd3ec2d41c17 Mon Sep 17 00:00:00 2001
+From: oddlama <oddlama@oddlama.org>
+Date: Fri, 1 Nov 2024 12:27:43 +0100
+Subject: [PATCH 2/2] recover account
+
+---
+ server/core/src/actors/internal.rs |  3 ++-
+ server/core/src/admin.rs           |  6 +++---
+ server/daemon/src/main.rs          | 14 +++++++++++++-
+ server/daemon/src/opt.rs           |  4 ++++
+ 4 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/server/core/src/actors/internal.rs b/server/core/src/actors/internal.rs
+index 420e72c6c..5c4353116 100644
+--- a/server/core/src/actors/internal.rs
++++ b/server/core/src/actors/internal.rs
+@@ -171,25 +171,26 @@ impl QueryServerWriteV1 {
+     }
+ 
+     #[instrument(
+         level = "info",
+         skip(self, eventid),
+         fields(uuid = ?eventid)
+     )]
+     pub(crate) async fn handle_admin_recover_account(
+         &self,
+         name: String,
++        password: Option<String>,
+         eventid: Uuid,
+     ) -> Result<String, OperationError> {
+         let ct = duration_from_epoch_now();
+         let mut idms_prox_write = self.idms.proxy_write(ct).await?;
+-        let pw = idms_prox_write.recover_account(name.as_str(), None)?;
++        let pw = idms_prox_write.recover_account(name.as_str(), password.as_deref())?;
+ 
+         idms_prox_write.commit().map(|()| pw)
+     }
+ 
+     #[instrument(
+         level = "info",
+         skip_all,
+         fields(uuid = ?eventid)
+     )]
+     pub(crate) async fn handle_domain_raise(&self, eventid: Uuid) -> Result<u32, OperationError> {
+diff --git a/server/core/src/admin.rs b/server/core/src/admin.rs
+index 90ccb1927..85e31ddef 100644
+--- a/server/core/src/admin.rs
++++ b/server/core/src/admin.rs
+@@ -17,21 +17,21 @@ use tokio_util::codec::{Decoder, Encoder, Framed};
+ use tracing::{span, Instrument, Level};
+ use uuid::Uuid;
+ 
+ pub use kanidm_proto::internal::{
+     DomainInfo as ProtoDomainInfo, DomainUpgradeCheckReport as ProtoDomainUpgradeCheckReport,
+     DomainUpgradeCheckStatus as ProtoDomainUpgradeCheckStatus,
+ };
+ 
+ #[derive(Serialize, Deserialize, Debug)]
+ pub enum AdminTaskRequest {
+-    RecoverAccount { name: String },
++    RecoverAccount { name: String, password: Option<String> },
+     ShowReplicationCertificate,
+     RenewReplicationCertificate,
+     RefreshReplicationConsumer,
+     DomainShow,
+     DomainUpgradeCheck,
+     DomainRaise,
+     DomainRemigrate { level: Option<u32> },
+ }
+ 
+ #[derive(Serialize, Deserialize, Debug)]
+@@ -302,22 +302,22 @@ async fn handle_client(
+     let mut reqs = Framed::new(sock, ServerCodec);
+ 
+     trace!("Waiting for requests ...");
+     while let Some(Ok(req)) = reqs.next().await {
+         // Setup the logging span
+         let eventid = Uuid::new_v4();
+         let nspan = span!(Level::INFO, "handle_admin_client_request", uuid = ?eventid);
+ 
+         let resp = async {
+             match req {
+-                AdminTaskRequest::RecoverAccount { name } => {
+-                    match server_rw.handle_admin_recover_account(name, eventid).await {
++                AdminTaskRequest::RecoverAccount { name, password } => {
++                    match server_rw.handle_admin_recover_account(name, password, eventid).await {
+                         Ok(password) => AdminTaskResponse::RecoverAccount { password },
+                         Err(e) => {
+                             error!(err = ?e, "error during recover-account");
+                             AdminTaskResponse::Error
+                         }
+                     }
+                 }
+                 AdminTaskRequest::ShowReplicationCertificate => match repl_ctrl_tx.as_mut() {
+                     Some(ctrl_tx) => show_replication_certificate(ctrl_tx).await,
+                     None => {
+diff --git a/server/daemon/src/main.rs b/server/daemon/src/main.rs
+index 7486d34a8..784106352 100644
+--- a/server/daemon/src/main.rs
++++ b/server/daemon/src/main.rs
+@@ -903,27 +903,39 @@ async fn kanidm_main(
+             } else {
+                 let output_mode: ConsoleOutputMode = commonopts.output_mode.to_owned().into();
+                 submit_admin_req(
+                     config.adminbindpath.as_str(),
+                     AdminTaskRequest::RefreshReplicationConsumer,
+                     output_mode,
+                 )
+                 .await;
+             }
+         }
+-        KanidmdOpt::RecoverAccount { name, commonopts } => {
++        KanidmdOpt::RecoverAccount { name, from_environment, commonopts } => {
+             info!("Running account recovery ...");
+             let output_mode: ConsoleOutputMode = commonopts.output_mode.to_owned().into();
++            let password = if *from_environment {
++                match std::env::var("KANIDM_RECOVER_ACCOUNT_PASSWORD") {
++                    Ok(val) => Some(val),
++                    _ => {
++                        error!("Environment variable KANIDM_RECOVER_ACCOUNT_PASSWORD not set");
++                        return ExitCode::FAILURE;
++                    }
++                }
++            } else {
++                None
++            };
+             submit_admin_req(
+                 config.adminbindpath.as_str(),
+                 AdminTaskRequest::RecoverAccount {
+                     name: name.to_owned(),
++                    password,
+                 },
+                 output_mode,
+             )
+             .await;
+         }
+         KanidmdOpt::Database {
+             commands: DbCommands::Reindex(_copt),
+         } => {
+             info!("Running in reindex mode ...");
+             reindex_server_core(&config).await;
+diff --git a/server/daemon/src/opt.rs b/server/daemon/src/opt.rs
+index f1b45a5b3..9c013e32e 100644
+--- a/server/daemon/src/opt.rs
++++ b/server/daemon/src/opt.rs
+@@ -229,20 +229,24 @@ enum KanidmdOpt {
+     /// Create a self-signed ca and tls certificate in the locations listed from the
+     /// configuration. These certificates should *not* be used in production, they
+     /// are for testing and evaluation only!
+     CertGenerate(CommonOpt),
+     #[clap(name = "recover-account")]
+     /// Recover an account's password
+     RecoverAccount {
+         #[clap(value_parser)]
+         /// The account name to recover credentials for.
+         name: String,
++        /// Use the password given in the environment variable
++        /// `KANIDM_RECOVER_ACCOUNT_PASSWORD` instead of generating one.
++        #[clap(long = "from-environment")]
++        from_environment: bool,
+         #[clap(flatten)]
+         commonopts: CommonOpt,
+     },
+     /// Display this server's replication certificate
+     ShowReplicationCertificate {
+         #[clap(flatten)]
+         commonopts: CommonOpt,
+     },
+     /// Renew this server's replication certificate
+     RenewReplicationCertificate {
+-- 
+2.46.1
+
diff --git a/pkgs/by-name/ke/keycloak/package.nix b/pkgs/by-name/ke/keycloak/package.nix
index 0228d47de9a6..a9f729078196 100644
--- a/pkgs/by-name/ke/keycloak/package.nix
+++ b/pkgs/by-name/ke/keycloak/package.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "keycloak";
-  version = "26.1.1";
+  version = "26.1.2";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    hash = "sha256-glBfG/j9J3ZjTTmMrNIbJhHUUIOV0Kardc5P3ohT98Y=";
+    hash = "sha256-U9g3SIh6qAQBWqIUfv1GQRqmRVzNImwCHAzfQFEFNOk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/martian-mono/package.nix b/pkgs/by-name/ma/martian-mono/package.nix
index c6cf4cfb1698..223b22009c3e 100644
--- a/pkgs/by-name/ma/martian-mono/package.nix
+++ b/pkgs/by-name/ma/martian-mono/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "martian-mono";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchzip {
     url = "https://github.com/evilmartians/mono/releases/download/v${version}/martian-mono-${version}-otf.zip";
-    sha256 = "sha256-hC08IHWqg+x3qoEf4EL98ZbGeqdwjnMpDovEiWrWPpI=";
+    sha256 = "sha256-L+T9XxTH7+yFJwhZ8UXAlq3rAkPFn/8dRBoGfbiHuGA=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/nk/nkeys/package.nix b/pkgs/by-name/nk/nkeys/package.nix
index 80d791e60808..1272455703ea 100644
--- a/pkgs/by-name/nk/nkeys/package.nix
+++ b/pkgs/by-name/nk/nkeys/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "nkeys";
-  version = "0.4.9";
+  version = "0.4.10";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-5HmtCzY2EmlnBqg36JcjaaM2ivrM5f719bkWqpxekVI=";
+    hash = "sha256-vSjIqeGWS9sDGyrPD11u4ngiZrW6gZfYd08kKXUDXdU=";
   };
 
-  vendorHash = "sha256-AJrfHMNjuGO8LbuP4cAVClKWHkqkG+nPzQw+B+nRpxM=";
+  vendorHash = "sha256-TtplWIDLUsFXhT5OQVhW3KTfxh1MVY8Hssejy8GBYVQ=";
 
   meta = with lib; {
     description = "Public-key signature system for NATS";
diff --git a/pkgs/by-name/or/orchard/package.nix b/pkgs/by-name/or/orchard/package.nix
index 8058366d61d2..fecb1d610d09 100644
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "orchard";
-  version = "0.26.4";
+  version = "0.27.1";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = version;
-    hash = "sha256-XA4cu7Jou5kGYovGgIpRvpMFBSha0d8sk4WMbp7GpGc=";
+    hash = "sha256-2FaB+f2aXEDfqa50EkBo6GN6mStrBnij9+cpLXWIKIg=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -24,7 +24,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-R4KsR00VAq0fUxHM48212GWy8KJoIOM0R8ycVjjjMO4=";
+  vendorHash = "sha256-J0gCkH7B4JxZBQkr1cUvXWuaz7QDQhKPNARZtxq3uDw=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pr/probe-rs-tools/package.nix b/pkgs/by-name/pr/probe-rs-tools/package.nix
index be2490502562..99ef721a9216 100644
--- a/pkgs/by-name/pr/probe-rs-tools/package.nix
+++ b/pkgs/by-name/pr/probe-rs-tools/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "probe-rs-tools";
-  version = "0.26.0";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "probe-rs";
     repo = "probe-rs";
     tag = "v${version}";
-    hash = "sha256-cVRa5idgAi6UoQkEFvhFd27Mp9AVkfzEuGnWrThm9+Q=";
+    hash = "sha256-xtUaGJyzr0uQUb/A+7RmOVVgrXIctr2I9gLPU2/rXso=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-HTYpSm6Q/ZLQRxD1a9Xky3tFOadp8iJnPXAhwjcxfnM=";
+  cargoHash = "sha256-acGLTbWI0SHspFISWw5Lj+sqn5HE4du5jTC3NS5zzh8=";
 
   buildAndTestSubdir = pname;
 
diff --git a/pkgs/by-name/ra/rapidfuzz-cpp/package.nix b/pkgs/by-name/ra/rapidfuzz-cpp/package.nix
index d86f384429b2..42fdec694135 100644
--- a/pkgs/by-name/ra/rapidfuzz-cpp/package.nix
+++ b/pkgs/by-name/ra/rapidfuzz-cpp/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rapidfuzz-cpp";
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchFromGitHub {
     owner = "rapidfuzz";
     repo = "rapidfuzz-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-m8VSqvKF7oRZeVJHRebPePc9iOreXhdmV2rAtB3frKI=";
+    hash = "sha256-AuH0Vq0Le5T9vDCpEviEjfNpwJFnFtqj/taFJy+YoMY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ro/roadrunner/package.nix b/pkgs/by-name/ro/roadrunner/package.nix
index 828b9a837fb6..e74f247c9efb 100644
--- a/pkgs/by-name/ro/roadrunner/package.nix
+++ b/pkgs/by-name/ro/roadrunner/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "roadrunner";
-  version = "2024.3.2";
+  version = "2024.3.3";
 
   src = fetchFromGitHub {
     repo = "roadrunner";
     owner = "roadrunner-server";
     tag = "v${version}";
-    hash = "sha256-KkwJ/977PHp8mKMJYDohRCi4PY9Q/LsRvsIBMyElZKc=";
+    hash = "sha256-5AB+fGyQa5+/fGqqNSYu0KnFbIZwL/ZjXyYHYk00cV8=";
   };
 
   nativeBuildInputs = [
@@ -46,7 +46,7 @@ buildGoModule rec {
       --replace "127.0.0.1:0" "127.0.0.1:55554"
   '';
 
-  vendorHash = "sha256-vvO67zi3Zod7Kf/yEXlk9aSRpLPzf+kWmNnDFaGdCzA=";
+  vendorHash = "sha256-BsIZxeSTz7wv4VJKffpOACXo7dm/qwZ/MYbmNogtMvg=";
 
   meta = {
     changelog = "https://github.com/roadrunner-server/roadrunner/blob/v${version}/CHANGELOG.md";
diff --git a/pkgs/by-name/rs/rshim-user-space/package.nix b/pkgs/by-name/rs/rshim-user-space/package.nix
index 82a6e55aaea4..bd9a66095dcd 100644
--- a/pkgs/by-name/rs/rshim-user-space/package.nix
+++ b/pkgs/by-name/rs/rshim-user-space/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rshim-user-space";
-  version = "2.1.5";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "Mellanox";
     repo = pname;
     rev = "rshim-${version}";
-    hash = "sha256-moU6XxBVSAZiiR/usFfxse2CHk6+003Jb9t62szk1fk=";
+    hash = "sha256-z0Uk520vsBERbeVtxBqXPXSWhO0sLD5GCQy1dQsJdEg=";
   };
 
   nativeBuildInputs = [
@@ -76,6 +76,8 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/Mellanox/rshim-user-space";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nikstur ];
+    maintainers = with maintainers; [
+      thillux
+    ];
   };
 }
diff --git a/pkgs/by-name/te/telegraf/package.nix b/pkgs/by-name/te/telegraf/package.nix
index 5b89365b9de1..29ddef3535a2 100644
--- a/pkgs/by-name/te/telegraf/package.nix
+++ b/pkgs/by-name/te/telegraf/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule rec {
   pname = "telegraf";
-  version = "1.33.1";
+  version = "1.33.2";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -18,10 +18,10 @@ buildGoModule rec {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${version}";
-    hash = "sha256-35L83l1aa7TDis0bZss4xBrciK1QEofkKY04JInmRmo=";
+    hash = "sha256-DOsjECXi2OEhSFd+eDXGN0kIZgZdpng6hkNMh6cOQ88=";
   };
 
-  vendorHash = "sha256-JGG+IIYC0JKjetkrgTS6gwhk0/ehvSIxZi6ts234Gi4=";
+  vendorHash = "sha256-6valHYL2A4+rw1oMw4APT05O9gmj3+zUJQf226GDBaw=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/by-name/tp/tpnote/package.nix b/pkgs/by-name/tp/tpnote/package.nix
index 969d64711357..1430ba0efc27 100644
--- a/pkgs/by-name/tp/tpnote/package.nix
+++ b/pkgs/by-name/tp/tpnote/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tpnote";
-  version = "1.25.1";
+  version = "1.25.2";
 
   src = fetchFromGitHub {
     owner = "getreu";
     repo = "tp-note";
     rev = "v${version}";
-    hash = "sha256-TT34+r4f3TaurLwyXxQa5AZT1xPOKkDYPra/bgchoTc=";
+    hash = "sha256-8AUPNjrT4/Vu8ykTHuDSdnCteih3i61CrfRBfPMwCfY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-1uqUB+65sMjjp4LJbvHehg9hMcrjun3/1cEmPPnrx3Y=";
+  cargoHash = "sha256-+qtphGkypyVY8SZsEmejikhnu18WIuvABlYGNA3GDUw=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/va/vale/package.nix b/pkgs/by-name/va/vale/package.nix
index 15b83f7ec486..6df13eada593 100644
--- a/pkgs/by-name/va/vale/package.nix
+++ b/pkgs/by-name/va/vale/package.nix
@@ -11,7 +11,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "3.9.4";
+  version = "3.9.5";
 
   subPackages = [ "cmd/vale" ];
 
@@ -19,10 +19,10 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     rev = "v${version}";
-    hash = "sha256-F677sYL49U7egbseDdcWtMRomMkZV7NBeOvEKmz2LwE=";
+    hash = "sha256-l8B2nhMJ6C9Oattp6PYKEzG4ZpAiw0flkTMTE6CPMYU=";
   };
 
-  vendorHash = "sha256-zjJICe3T3fmyqf3HJbUOaOXOb2GdhAufSFiJTjxauZY=";
+  vendorHash = "sha256-ivHOUkX9a4mRsw/ruYr3CzVbAovYMGQI+ExmaB+lP5E=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/vi/vintagestory/package.nix b/pkgs/by-name/vi/vintagestory/package.nix
index b2700373da8a..ed2d596272d9 100644
--- a/pkgs/by-name/vi/vintagestory/package.nix
+++ b/pkgs/by-name/vi/vintagestory/package.nix
@@ -100,6 +100,7 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [
       artturin
       gigglesquid
+      niraethm
     ];
   };
 }
diff --git a/pkgs/by-name/xe/xeol/package.nix b/pkgs/by-name/xe/xeol/package.nix
index 787a9bd778bf..086b30c9c6d9 100644
--- a/pkgs/by-name/xe/xeol/package.nix
+++ b/pkgs/by-name/xe/xeol/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "xeol";
-  version = "0.10.3";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "xeol-io";
     repo = "xeol";
     tag = "v${version}";
-    hash = "sha256-zpggEl1tyzuxo/EcHMeupEVJ5/ALY51wYrw7eKEaMEw=";
+    hash = "sha256-zm8PIYWFLEiWuZGt5Fev35d8EYOfzduIXX6SmJZ27o0=";
   };
 
   vendorHash = "sha256-hPWjXTxk/jRkzvLYNgVlgj0hjzfikwel1bxSqWquVhk=";
@@ -22,7 +22,6 @@ buildGoModule rec {
   subPackages = [ "cmd/xeol/" ];
 
   ldflags = [
-    "-w"
     "-s"
     "-X=main.version=${version}"
     "-X=main.gitCommit=${src.rev}"
diff --git a/pkgs/by-name/ya/yamlfmt/package.nix b/pkgs/by-name/ya/yamlfmt/package.nix
index 9f4964ed7636..cadab5c8ba7d 100644
--- a/pkgs/by-name/ya/yamlfmt/package.nix
+++ b/pkgs/by-name/ya/yamlfmt/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "yamlfmt";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "yamlfmt";
     tag = "v${version}";
-    hash = "sha256-eAcHl4h7c3HU901cuqzAPs49qRldxKQDxrWBmccmwos=";
+    hash = "sha256-4PCwMLwFtCK55k7b6CgpPOKsxLdeU55DxYEDbYDWVYg=";
   };
 
-  vendorHash = "sha256-za95/Zj8MXJqt9tW6csaRlXFs+5ET/D4CUsCnGqcLQQ=";
+  vendorHash = "sha256-eOuLgNCxrI2HIFBwLAYRl6PwW/1hihQ0QsTtG1sxCL8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ya/yazi-unwrapped/package.nix b/pkgs/by-name/ya/yazi-unwrapped/package.nix
index 045291a208ec..574b9207f9a0 100644
--- a/pkgs/by-name/ya/yazi-unwrapped/package.nix
+++ b/pkgs/by-name/ya/yazi-unwrapped/package.nix
@@ -11,21 +11,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yazi";
-  version = "25.2.7";
+  version = "25.2.11";
 
   src = fetchFromGitHub {
     owner = "sxyazi";
     repo = "yazi";
     rev = "v${version}";
-    hash = "sha256-f8+C+L8eOugnyx4Zm2y3qAXH33BsI5F1JWecigPKuMg=";
+    hash = "sha256-yVpSoEmEA+/XF/jlJqKdkj86m8IZLAbrxDxz5ZnmP78=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-7ARj5TNZm//CfkOczqaaoY1KjpXpr5dtSvdUNygpL6U=";
+  cargoHash = "sha256-AfXi68PNrYj6V6CYIPZT0t2l5KYTYrIzJgrcEPLW8FM=";
 
   env.YAZI_GEN_COMPLETIONS = true;
   env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2025-02-07";
+  env.VERGEN_BUILD_DATE = "2025-02-11";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ Foundation ];
diff --git a/pkgs/desktops/xfce/core/thunar/default.nix b/pkgs/desktops/xfce/core/thunar/default.nix
index 31b5b15fa692..47c8aa2a6c2b 100644
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@@ -26,9 +26,9 @@
 let unwrapped = mkXfceDerivation {
   category = "xfce";
   pname = "thunar";
-  version = "4.20.1";
+  version = "4.20.2";
 
-  sha256 = "sha256-+Iz9tkP8foEtor1HFBB1/fyMXdLm3mXCoP9j9bug8po=";
+  sha256 = "sha256-tuINIJ5r1BXAUJxlmLiYe2z3AFGkXqbITJBskSx5D4s=";
 
   nativeBuildInputs = [
     docbook_xsl
diff --git a/pkgs/development/python-modules/gphoto2/default.nix b/pkgs/development/python-modules/gphoto2/default.nix
index 5cf5e39b45bb..67da4bd44503 100644
--- a/pkgs/development/python-modules/gphoto2/default.nix
+++ b/pkgs/development/python-modules/gphoto2/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchPypi,
-  fetchpatch,
   buildPythonPackage,
   pkg-config,
   libgphoto2,
@@ -19,13 +18,6 @@ buildPythonPackage rec {
     hash = "sha256-Jgh7ff+iUaeNQtBsXw2Jm+2gj1ctvrY3oahGrbxx3uE=";
   };
 
-  # only convert first 2 values from setuptools_version to ints to avoid
-  # parse errors if last value is a string.
-  patches = fetchpatch {
-    url = "https://github.com/jim-easterbrook/python-gphoto2/commit/d388971b63fea831eb986d2212d4828c6c553235.patch";
-    hash = "sha256-EXtXlhBx2jCKtMl7HmN87liqiHVAFSeXr11y830AlpY=";
-  };
-
   nativeBuildInputs = [
     pkg-config
     setuptools
diff --git a/pkgs/development/python-modules/gwcs/default.nix b/pkgs/development/python-modules/gwcs/default.nix
index af8aa9d36ef2..dd344dde1622 100644
--- a/pkgs/development/python-modules/gwcs/default.nix
+++ b/pkgs/development/python-modules/gwcs/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "gwcs";
-  version = "0.22.1";
+  version = "0.24.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "spacetelescope";
     repo = "gwcs";
     tag = version;
-    hash = "sha256-9s3HwKFpUXb0aqcSEJVL2SB6G2pQc8xQT5HdZYoHd/I=";
+    hash = "sha256-XxC61AzyZt0lVVwOr2yiN0/ldjcq/ABtzNDSQaGo9as=";
   };
 
   build-system = [
@@ -53,7 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to manage the Generalized World Coordinate System";
     homepage = "https://github.com/spacetelescope/gwcs";
-    changelog = "https://github.com/spacetelescope/gwcs/blob/${version}/CHANGES.rst";
+    changelog = "https://github.com/spacetelescope/gwcs/blob/${src.tag}/CHANGES.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/inequality/default.nix b/pkgs/development/python-modules/inequality/default.nix
index 810e9f7b824a..1c153b486dc3 100644
--- a/pkgs/development/python-modules/inequality/default.nix
+++ b/pkgs/development/python-modules/inequality/default.nix
@@ -6,14 +6,17 @@
   pythonOlder,
 
   libpysal,
+  mapclassify,
+  matplotlib,
   numpy,
   scipy,
+  seaborn,
   setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "inequality";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
   disabled = pythonOlder "3.10";
 
@@ -21,18 +24,23 @@ buildPythonPackage rec {
     owner = "pysal";
     repo = "inequality";
     tag = "v${version}";
-    hash = "sha256-tKMpmsP19K4dyBCj84FBoGkEvrmQuSi77sY3uQYvz5s=";
+    hash = "sha256-JVim2u+VF35dvD+y14WbA2+G4wktAGpin/GMe0uGhjc=";
   };
 
   build-system = [ setuptools-scm ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     libpysal
+    matplotlib
     numpy
     scipy
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    mapclassify
+    pytestCheckHook
+    seaborn
+  ];
 
   pythonImportsCheck = [ "inequality" ];
 
diff --git a/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix b/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
index b3ef5a841445..2fbc2c6212f6 100644
--- a/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-serialization-text/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "microsoft-kiota-serialization-text";
-  version = "1.9.1";
+  version = "1.9.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-serialization-text-v${version}";
-    hash = "sha256-ESRnI8prXG1h5H5RVD4eOQ1sQYSEMMLVHSk8yhzFGVw=";
+    hash = "sha256-ribVfvKmDMxGmeqj30SDcnbNGdRBfs1DmqQGXP3EHCk=";
   };
 
   sourceRoot = "source/packages/serialization/text/";
@@ -45,7 +45,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Text serialization implementation for Kiota generated clients in Python";
     homepage = "https://github.com/microsoft/kiota-python/tree/main/packages/serialization/text";
-    changelog = "https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-serialization-text-v${version}";
+    changelog = "https://github.com/microsoft/kiota-python/releases/tag/microsoft-kiota-serialization-text-${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 5c45bd8e3923..3a65414ef8b7 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -86,8 +86,8 @@ rec {
       "sha256-wqul7cHa1ui2Wbyl01bnwZgIUZZodniAn6EQ24bgfkI=";
 
   mypy-boto3-apigatewayv2 =
-    buildMypyBoto3Package "apigatewayv2" "1.36.0"
-      "sha256-UDfSHfLkzNNcecERrGCJIYnVJE27qCECZ2CRmFxvGRM=";
+    buildMypyBoto3Package "apigatewayv2" "1.36.17"
+      "sha256-VntzS1WAuNtSpl0+i6mTQk/Xs7yuDQgnu4IbdDaDabc=";
 
   mypy-boto3-appconfig =
     buildMypyBoto3Package "appconfig" "1.36.0"
@@ -230,8 +230,8 @@ rec {
       "sha256-g8YpVNduF0EAsCwheQCS2xX2yoIKuYTQ1DY/DRdwkt8=";
 
   mypy-boto3-cloudfront =
-    buildMypyBoto3Package "cloudfront" "1.36.0"
-      "sha256-6HRqoRpUsrvPVrNvVlQodzjWpfk5Eq472jCzNVMULzM=";
+    buildMypyBoto3Package "cloudfront" "1.36.17"
+      "sha256-jfYI2Kn4er6cG3LpxdVV0QacKbpTDzAiBmVzD5D76UI=";
 
   mypy-boto3-cloudhsm =
     buildMypyBoto3Package "cloudhsm" "1.36.0"
@@ -338,8 +338,8 @@ rec {
       "sha256-VK7/vxmSeMHYNow/ifwEYB8w/35PQfUiMhinyKNlDJ8=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.36.3"
-      "sha256-thT1nWwkUSsmhLQOyV5QiR17jGHvkxbxcwMGwV5gFXE=";
+    buildMypyBoto3Package "connect" "1.36.17"
+      "sha256-8uSSGygW+4wKLt09LGUdr8q07bJLiIAK8avQOhoKpQI=";
 
   mypy-boto3-connect-contact-lens =
     buildMypyBoto3Package "connect-contact-lens" "1.36.0"
@@ -414,8 +414,8 @@ rec {
       "sha256-si7pjgKzxg++SfVdOsIQP37rXG84IZM0ltcwc2+wn3I=";
 
   mypy-boto3-dms =
-    buildMypyBoto3Package "dms" "1.36.13"
-      "sha256-D8d8TAjSlxNw5xumOLyzIBb92C7Blh3f3Mo1WOPxzP4=";
+    buildMypyBoto3Package "dms" "1.36.17"
+      "sha256-XymlDkObpiUJqGjheovvypfDS8xDGLy6MKT4+mhBePs=";
 
   mypy-boto3-docdb =
     buildMypyBoto3Package "docdb" "1.36.0"
diff --git a/pkgs/development/python-modules/translate-toolkit/default.nix b/pkgs/development/python-modules/translate-toolkit/default.nix
index 3dccad83058f..ae8d0775503e 100644
--- a/pkgs/development/python-modules/translate-toolkit/default.nix
+++ b/pkgs/development/python-modules/translate-toolkit/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "translate-toolkit";
-  version = "3.14.6";
+  version = "3.14.7";
 
   pyproject = true;
   build-system = [ setuptools-scm ];
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "translate_toolkit";
     inherit version;
-    hash = "sha256-2FCt8D+GSEv5xeriA8kT7T2Rjb86jwCNmxVgKnKG554=";
+    hash = "sha256-5xpvNxEQBuMggHCb2RPCQ/lQWop6Hiep8BpRSey31R0=";
   };
 
   dependencies = [
diff --git a/pkgs/development/python-modules/yamlfix/default.nix b/pkgs/development/python-modules/yamlfix/default.nix
index 432592060be3..b91cb7bb5b11 100644
--- a/pkgs/development/python-modules/yamlfix/default.nix
+++ b/pkgs/development/python-modules/yamlfix/default.nix
@@ -12,6 +12,17 @@
   ruyaml,
   setuptools,
 }:
+let
+  maison143 = maison.overridePythonAttrs (old: rec {
+    version = "1.4.3";
+    src = fetchFromGitHub {
+      owner = "dbatten5";
+      repo = "maison";
+      tag = "v${version}";
+      hash = "sha256-2hUmk91wr5o2cV3un2nMoXDG+3GT7SaIOKY+QaZY3nw=";
+    };
+  });
+in
 
 buildPythonPackage rec {
   pname = "yamlfix";
@@ -34,7 +45,7 @@ buildPythonPackage rec {
 
   dependencies = [
     click
-    maison
+    maison143
     ruyaml
   ];
 
diff --git a/pkgs/development/tools/electron/binary/info.json b/pkgs/development/tools/electron/binary/info.json
index 1b5b01a7d77f..f817e8020dec 100644
--- a/pkgs/development/tools/electron/binary/info.json
+++ b/pkgs/development/tools/electron/binary/info.json
@@ -78,24 +78,24 @@
     },
     "33": {
         "hashes": {
-            "aarch64-darwin": "4c7ffa4927aec31912ae2047d8d6c33e801501e4b576c724947866da9346110c",
-            "aarch64-linux": "c55b6b66fe8018e0e05953cd794735782f05b7e3b2a117a86413eafcedfda7ef",
-            "armv7l-linux": "2e7f915c71b11e6cc1ec46aee8f87c28fdd029a0a90a9196117a8f0c7aa81aa8",
-            "headers": "07m9p2nz0rzl3asq466kqzdq1bdmlvxb5slrr24dj9awijlyrrb6",
-            "x86_64-darwin": "fa451db2991506cacebd2a836e84ca7eff73770ed987d5b958f9854637c12d3d",
-            "x86_64-linux": "13b99da4a78dae9bf0960309cd1e9476faf5f7260bbf930bd302189d490ff77c"
+            "aarch64-darwin": "90044a7aa13f18ca4077a33131190b55fdf3ca5cb0704c537ca630fd0e06369e",
+            "aarch64-linux": "6542b3152ea9d8dd005a1b8f55b6971dee0f954b3b4e0bab4d625d501a946093",
+            "armv7l-linux": "95d79d2d2a154783fa6435d937a3e98b4408f2ce75f6706e5781d0d7e2e49d44",
+            "headers": "00v71c9fy3na040bnp5llp6951fsqls6hnlvbds5gckw3wfdcymc",
+            "x86_64-darwin": "d66a1400fe3c446f93eabf51b9520a300cdd25805a03d96a4528bda089f4988e",
+            "x86_64-linux": "f854ceb7362f7eeafdcdfc4a8898493adb72e3433595c59f072427912115d41b"
         },
-        "version": "33.3.2"
+        "version": "33.4.0"
     },
     "34": {
         "hashes": {
-            "aarch64-darwin": "604e5f6c706383dd7a86c3b9a59f60525c687f65907b60ccdabf43358dbb8661",
-            "aarch64-linux": "98e711d7678670572b873aec1e4df3a2fa0002b88bc6283dbff8fc13ac401670",
-            "armv7l-linux": "cc3bb0110fafbf5a9ef6576470b82864dacb6380cc312650d6b0cdf404ac9d9f",
-            "headers": "1zcm8j3qqvy6y5jgdj9aypbqa1sq4wkk9ynj0382wnk994bzjs86",
-            "x86_64-darwin": "3b34acc7908a311e05509cab9e1926604113e1f650b4dbe1ecfde1dbf4397c37",
-            "x86_64-linux": "74e55edc5d7cf9e63ba61f1a670134779109fcf33990e568f1992c46c1d31b89"
+            "aarch64-darwin": "a38a624bee92ee601777c20e6bdbf040d1b2a5506ba1ccac8be1447b1c6b0bfd",
+            "aarch64-linux": "37d68cef35888c8ca8bbe2002be0a122e8e8ccaf762b60ade1af5e71918e080b",
+            "armv7l-linux": "741374570bd9e435037f41b42aea7ab640f7ef1e75afb4705cc12344f43ed04c",
+            "headers": "0b0djna1bprfff0y1pb2wdzsx82v1c1zk20gl2vivgjhslxf0igl",
+            "x86_64-darwin": "a2ba4f91882819801da2d499de3426dbb191a22f2fe4a6ec92b756f1a0dc2de8",
+            "x86_64-linux": "9fbca20baea84800f7f50a9b245302dddbfab3425dd762c482d79e867a5a6dbe"
         },
-        "version": "34.0.2"
+        "version": "34.1.1"
     }
 }
diff --git a/pkgs/development/tools/electron/chromedriver/info.json b/pkgs/development/tools/electron/chromedriver/info.json
index 96a57f01acd9..58ff11fa1758 100644
--- a/pkgs/development/tools/electron/chromedriver/info.json
+++ b/pkgs/development/tools/electron/chromedriver/info.json
@@ -45,24 +45,24 @@
     },
     "33": {
         "hashes": {
-            "aarch64-darwin": "96648a7aa64bff1b6fdce75da395451cca23aafdd06437c31544125962e25323",
-            "aarch64-linux": "a5bce192adbc7dfcb6134296c15409b8299a64b3ecc9c61d7d150a644a8187e6",
-            "armv7l-linux": "a921c696a7371712b14ed64e408a57ad874340fd8d61a447cbc83fcf79e599a3",
-            "headers": "07m9p2nz0rzl3asq466kqzdq1bdmlvxb5slrr24dj9awijlyrrb6",
-            "x86_64-darwin": "06ae393d176e8fdd67b1fb6a2b3f0771e3971de112e338d7d30d2ea1ffd0fe8c",
-            "x86_64-linux": "85e3d980a43f4792d1b6246a50dad745653c0e13b95dbc37adadc78078cfcc99"
+            "aarch64-darwin": "0b87f00cf22d2c73a795af554cf9548e0204769d22ffdc7f28183572d4f7fef0",
+            "aarch64-linux": "5387c7a22c93dfcac348ea5ec604fb8350926e8e2681ca189e0500ff993d58d0",
+            "armv7l-linux": "53e1fa127812bcfb5a095f781368ee2d9cceb4a91d83dcb32a7ecf072cf39034",
+            "headers": "00v71c9fy3na040bnp5llp6951fsqls6hnlvbds5gckw3wfdcymc",
+            "x86_64-darwin": "9a8ec97a21d41b146b010dfe7e4df71907a23bdf0500619036de623b4ddb1ce1",
+            "x86_64-linux": "ea57c5bafecd8502fa95df73c977efb2a061068eac965d97f99b824479d55de2"
         },
-        "version": "33.3.2"
+        "version": "33.4.0"
     },
     "34": {
         "hashes": {
-            "aarch64-darwin": "ae2ccc17a7f391869cf6cfe41d4b7c25013ccbf36861b5007fcdf62ac4db9eb0",
-            "aarch64-linux": "904c101b206e9d4de088c06ac6886563493e5abaac537cb55f129a8cfd2620c0",
-            "armv7l-linux": "0a295dc16833384dc51ac6baa0d7025f9767b587c30ac857d1461b41bc3246af",
-            "headers": "1zcm8j3qqvy6y5jgdj9aypbqa1sq4wkk9ynj0382wnk994bzjs86",
-            "x86_64-darwin": "f6419dca74fcd4affeb9c4a061abc343e52031cdc36d4abb01ece2b9ee731d7c",
-            "x86_64-linux": "fba4a47b7762142f4ca01f405746b99ddb36e0860316952c2118b4b90840897d"
+            "aarch64-darwin": "c2aa24978fbe0c3dfb8ae36816633a75f498b4af5052b059631a626925951e41",
+            "aarch64-linux": "df87d6f0b91a549996c764bb60eaf692c59e087496406562e3bcbb3f90a52d50",
+            "armv7l-linux": "74b53fff1d210066024476ebbfef7476b05c2c71cd141953b5b7e0a35d129a02",
+            "headers": "0b0djna1bprfff0y1pb2wdzsx82v1c1zk20gl2vivgjhslxf0igl",
+            "x86_64-darwin": "95239f35723eeca036ed1e29f7871a4de843c6eda16bccc04436402dddd938aa",
+            "x86_64-linux": "62734cb681a6da3c73b20504f49c7759c9dbb1c923e250d67c11888426e3cad0"
         },
-        "version": "34.0.2"
+        "version": "34.1.1"
     }
 }
diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json
index dae5e44a5ef8..07190692cd02 100644
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -988,10 +988,10 @@
             },
             "src/electron": {
                 "fetcher": "fetchFromGitHub",
-                "hash": "sha256-20ggSgks8zVYsFeMRHzqpnQFE9UazwOY2BVQYhVo/Vk=",
+                "hash": "sha256-1Sl36LYp/tePk5ChWKv9ZCVcoEZECMEDKKiKvpO8ea8=",
                 "owner": "electron",
                 "repo": "electron",
-                "rev": "v33.3.2"
+                "rev": "v33.4.0"
             },
             "src/media/cdm/api": {
                 "fetcher": "fetchFromGitiles",
@@ -1891,6 +1891,6 @@
         "electron_yarn_hash": "0bzsswcg62b39xinq5vikk7qz7d15276s2vc15v1gcb5wvh05ff8",
         "modules": "130",
         "node": "20.18.1",
-        "version": "33.3.2"
+        "version": "33.4.0"
     }
 }
diff --git a/pkgs/kde/gear/default.nix b/pkgs/kde/gear/default.nix
index ce0cadba3dd2..1ab627559e03 100644
--- a/pkgs/kde/gear/default.nix
+++ b/pkgs/kde/gear/default.nix
@@ -242,7 +242,6 @@
   skanlite = callPackage ./skanlite { };
   skanpage = callPackage ./skanpage { };
   skladnik = callPackage ./skladnik { };
-  spectacle = callPackage ./spectacle { };
   step = callPackage ./step { };
   svgpart = callPackage ./svgpart { };
   sweeper = callPackage ./sweeper { };
diff --git a/pkgs/kde/generated/sources/plasma.json b/pkgs/kde/generated/sources/plasma.json
index 70357307b834..4fcd394c04a1 100644
--- a/pkgs/kde/generated/sources/plasma.json
+++ b/pkgs/kde/generated/sources/plasma.json
@@ -1,332 +1,337 @@
 {
   "bluedevil": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/bluedevil-6.2.5.tar.xz",
-    "hash": "sha256-Tl9D6d2ddZDimkMhSK1Rq7vTHPMChXMUJfW+jyRE8ro="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/bluedevil-6.3.0.tar.xz",
+    "hash": "sha256-uqgVjWesGDHzIwx828RAw9Vt6BRwg8gZUv2i2azssoQ="
   },
   "breeze": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/breeze-6.2.5.tar.xz",
-    "hash": "sha256-HTvUSBu3zSdKE6xdWFK+Uf8pdeYghy38IvvVMbrQTiU="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/breeze-6.3.0.tar.xz",
+    "hash": "sha256-e7UN1mLjXf2u7JWPrUIU5sPBRISRmrEqVFoRCfvgiZU="
   },
   "breeze-grub": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/breeze-grub-6.2.5.tar.xz",
-    "hash": "sha256-AotNwvjw9mMDnl64Ayh8X549xPXz5f16RPxx1nbcOYk="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/breeze-grub-6.3.0.tar.xz",
+    "hash": "sha256-sQCf31ZSG9KEAnRjnM5AXRDiDldJKrYrWSuBWmGFvhw="
   },
   "breeze-gtk": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/breeze-gtk-6.2.5.tar.xz",
-    "hash": "sha256-IRXwC7zvjmulckfpxs4WM97fNw+S2gHS/Eqvyhp0018="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/breeze-gtk-6.3.0.tar.xz",
+    "hash": "sha256-Jrd9zu3h8mh99jZlxLoODnnbyarO/HSFhQL4Fu0yZfg="
   },
   "breeze-plymouth": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/breeze-plymouth-6.2.5.tar.xz",
-    "hash": "sha256-4D/NjM4Z3pjxstrzlw29WeF/Wfm2iN7/xOSgd6um4Uo="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/breeze-plymouth-6.3.0.tar.xz",
+    "hash": "sha256-BYlAsh647wIQ3RHMsOwfjiDBe2jOi404vE7qImBQBII="
   },
   "discover": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/discover-6.2.5.tar.xz",
-    "hash": "sha256-jMu4gTkqS61UCrC7RlY3oOIG72tT578C5xvI+2RTpKQ="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/discover-6.3.0.tar.xz",
+    "hash": "sha256-v1kqF0opluIQgfK+wGjb7umrlF3w7s8tRlvkSOAj6ps="
   },
   "drkonqi": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/drkonqi-6.2.5.tar.xz",
-    "hash": "sha256-+V7FbHAuscukhBH9FwnYcjhJ43D/jqaZgUgtbzpdXHM="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/drkonqi-6.3.0.tar.xz",
+    "hash": "sha256-ZSu8VecEccp6zxONgKI3/PXhB+QNKssOx58DqtUAlIk="
   },
   "flatpak-kcm": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/flatpak-kcm-6.2.5.tar.xz",
-    "hash": "sha256-JshyE62aOUorPcZhYFHWfFyqMji6qoipr7mV3YlnOy4="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/flatpak-kcm-6.3.0.tar.xz",
+    "hash": "sha256-9XmPHQzO6bUCicy0EHFdNf7N5f0a181ITJGPFJxtUSE="
   },
   "kactivitymanagerd": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kactivitymanagerd-6.2.5.tar.xz",
-    "hash": "sha256-824bvFwQD0w50a8AegPEdOo90VhFkgKf4k+72xz52tY="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kactivitymanagerd-6.3.0.tar.xz",
+    "hash": "sha256-Il9k5WjlWePm7I6aBS2E+zxVfhbp1PgbVnGZCBGnVe4="
   },
   "kde-cli-tools": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kde-cli-tools-6.2.5.tar.xz",
-    "hash": "sha256-HdpX90lQYKCGZYeWUZ1o1U9efaThL6bY1L9GFKxygAI="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kde-cli-tools-6.3.0.tar.xz",
+    "hash": "sha256-zMvNc38fQz8u6xfuHjuMwQtnOhO2hbwNYKORl4/Jezs="
   },
   "kde-gtk-config": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kde-gtk-config-6.2.5.tar.xz",
-    "hash": "sha256-KD+YA6FfE3NN5imFWPh1QGpcfA6kbp/7pWR/SAv8alg="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kde-gtk-config-6.3.0.tar.xz",
+    "hash": "sha256-9SkQ8j7zamMDfkASSozxU2JygK45s/ijHtHy20iHmE8="
   },
   "kdecoration": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kdecoration-6.2.5.tar.xz",
-    "hash": "sha256-cmxYzUs0/ElUZXhyekR8diQpOK3Vdyks0zS9YL+djyY="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kdecoration-6.3.0.tar.xz",
+    "hash": "sha256-dPf0r8oQoKN5FSM8gAM82zMqf59Fr8ZNDDjGCrotXdM="
   },
   "kdeplasma-addons": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kdeplasma-addons-6.2.5.tar.xz",
-    "hash": "sha256-V9E41RAa27gJLEJMWM63Ph0F0Mzj7Eo1RDJ0Tb0X5CY="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kdeplasma-addons-6.3.0.tar.xz",
+    "hash": "sha256-WZnR7hIK9Wc+cM8X8wMM5JK8zOeZfNTJLcBB+hgQmbk="
   },
   "kgamma": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kgamma-6.2.5.tar.xz",
-    "hash": "sha256-Pfdc3LAgrP0hbppyJATTgcik2XJivoX2cEsYnmZWEM4="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kgamma-6.3.0.tar.xz",
+    "hash": "sha256-yxNocFCZ9vbwmwjT+IVgHR9HkHSaK7xM6XdXTUTxcQI="
   },
   "kglobalacceld": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kglobalacceld-6.2.5.tar.xz",
-    "hash": "sha256-lLXMN4DKawdAk8SH7J5sNGD2Na5RRXgPh8D+hITYxsk="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kglobalacceld-6.3.0.tar.xz",
+    "hash": "sha256-YSSYgpexkQhGtK8qApAraSM5g4NENBL0G5XMiL8N4LM="
   },
   "kinfocenter": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kinfocenter-6.2.5.tar.xz",
-    "hash": "sha256-nth+2zokJWGJ+Nx5yCG49FWJqrcDLY3eeNXZTPBjn/k="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kinfocenter-6.3.0.tar.xz",
+    "hash": "sha256-IPtgc2bRZjkNwYvsqPkyGBOSQwWgrf7pH3leTgXq0xE="
   },
   "kmenuedit": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kmenuedit-6.2.5.tar.xz",
-    "hash": "sha256-CQhkX0/CSgCwI9BTfKxt7nt6utdceYC0oBxsCY3taEo="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kmenuedit-6.3.0.tar.xz",
+    "hash": "sha256-9oK736Q25leu7LRh+doF1w5dbNsCNt/bcWNdMHcXRWM="
   },
   "kpipewire": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kpipewire-6.2.5.tar.xz",
-    "hash": "sha256-20LVgfDKQnvYDuamfR+pzvARFCZsmu5/qizsvZc+Yxk="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kpipewire-6.3.0.tar.xz",
+    "hash": "sha256-N38NIPvx84BzE28XtZlcg+XH+oClCJZtVp41xPGA3yo="
   },
   "krdp": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/krdp-6.2.5.tar.xz",
-    "hash": "sha256-Go0349uR6AyuniK/HFmGmFxCed4kVrp7xIHHJcNKc/w="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/krdp-6.3.0.tar.xz",
+    "hash": "sha256-HpdFCwXazBteJamcSRVsQaGYZvsvGW7KHR4nWlfXJFA="
   },
   "kscreen": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kscreen-6.2.5.tar.xz",
-    "hash": "sha256-YjfEf+cDhNEObyDX8FjGqsylGkk9qSgHf87JGw72lkI="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kscreen-6.3.0.tar.xz",
+    "hash": "sha256-Vtngpgfy+3mDEeFx32eykJZBf1BkLfhxCTflCvTR1/U="
   },
   "kscreenlocker": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kscreenlocker-6.2.5.tar.xz",
-    "hash": "sha256-Oj7S0EA5TcKoDPJc3SpsQCIUaspU5yxErxbomC6Ljk4="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kscreenlocker-6.3.0.tar.xz",
+    "hash": "sha256-rYa6DX3IdUql3YCXqyUojN+qRMAeMaEIE6tNDWmH9l4="
   },
   "ksshaskpass": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/ksshaskpass-6.2.5.tar.xz",
-    "hash": "sha256-heccgDfV0hmfhhrnBxifQqfK7S8DdD6oO3Vww0oR63I="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/ksshaskpass-6.3.0.tar.xz",
+    "hash": "sha256-EXk3lsXE9ut7BgG8AD2Ezo5CFHvwUhLCpr0g38dKNiI="
   },
   "ksystemstats": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/ksystemstats-6.2.5.tar.xz",
-    "hash": "sha256-7/9W9V5v5e1CMaR6RMjQjT1G/RDXTRhjRO9PL82VlaE="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/ksystemstats-6.3.0.tar.xz",
+    "hash": "sha256-ZAr5jGsHagdDan1rka4wGOHlrImea4Q/BNSABZSydzo="
   },
   "kwallet-pam": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kwallet-pam-6.2.5.tar.xz",
-    "hash": "sha256-AWjU8jl64omuAnp9ICsP/V+NehmyM+v6ZBe4Q4Qb/UQ="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kwallet-pam-6.3.0.tar.xz",
+    "hash": "sha256-Gie/yXAB5MDFEg7sGjbTcwuqbvnfRPv2jyOjTNVRxn8="
   },
   "kwayland": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kwayland-6.2.5.tar.xz",
-    "hash": "sha256-KheozlZD/VHDz3h1QgMsEFDaOh+wDcyaMt6iiL0419I="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kwayland-6.3.0.tar.xz",
+    "hash": "sha256-L21ouJ2rIQN7puzJGmNT0fWjFPe4Bou25gW/XhtrJaw="
   },
   "kwayland-integration": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kwayland-integration-6.2.5.tar.xz",
-    "hash": "sha256-Brb7fdzxnHJ3FvR2tyJOIw9Jhsfj02Bm6RiFn9w7RBM="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kwayland-integration-6.3.0.tar.xz",
+    "hash": "sha256-S8VCEZQ4TZvDfFRqKg85ZT6VdPK6FqnONqvoyctUOv0="
   },
   "kwin": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kwin-6.2.5.tar.xz",
-    "hash": "sha256-XMRQpuQRBcjEmSm3JVCzMSN/lqr7KUaQ9HB73F93aEg="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kwin-6.3.0.tar.xz",
+    "hash": "sha256-Gtl4/FKyG/3SGIQ1VKAVskaJ4MBJBNHLAOLkr8pPSvQ="
   },
   "kwrited": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/kwrited-6.2.5.tar.xz",
-    "hash": "sha256-BHlPEJF6CpQWeWIBXPuwV8mAIGH/+RsCfeAaPmk315I="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/kwrited-6.3.0.tar.xz",
+    "hash": "sha256-/H0YFVieKNBsbalnsYMSzlB+rMJ+9YG9rtwYNzm2Llw="
   },
   "layer-shell-qt": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/layer-shell-qt-6.2.5.tar.xz",
-    "hash": "sha256-vAmHAhjfOHw3e60v7UsqjzkSHdvcXGuyikC+DBsADHc="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/layer-shell-qt-6.3.0.tar.xz",
+    "hash": "sha256-oJiKEqI2ZM/jV7AHDT2Mrs6jsIiC7lIIalpONLiF1EM="
   },
   "libkscreen": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/libkscreen-6.2.5.tar.xz",
-    "hash": "sha256-Xtr2+i7tbdzvS8R59LsV00gay2Ct8BUOn5oTgmB7vLg="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/libkscreen-6.3.0.tar.xz",
+    "hash": "sha256-nveR7vL1xulUKKnaP7c15NIjAIHFRyliyVyDU8AaZDo="
   },
   "libksysguard": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/libksysguard-6.2.5.tar.xz",
-    "hash": "sha256-lpTz1rUHi02C645u006yDi0QntfCI0xZpkC8MvMcdqs="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/libksysguard-6.3.0.tar.xz",
+    "hash": "sha256-vBu7OFslwGQj9vLQRLAMEGy9tVHFz4NIvVkixj1MvLk="
   },
   "libplasma": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/libplasma-6.2.5.tar.xz",
-    "hash": "sha256-r3cPX++XhRLHBJGIlRb7dp00DwCgInCYfS0dF3U2WOw="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/libplasma-6.3.0.tar.xz",
+    "hash": "sha256-nCzelhWpQ5faaOQpMYJ2jh+9wvQZzbjwDosTo2bVl40="
   },
   "milou": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/milou-6.2.5.tar.xz",
-    "hash": "sha256-gzvK6v4pLoXv81PgmwYx9gOuISHo0db+BhsfYyAXrM8="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/milou-6.3.0.tar.xz",
+    "hash": "sha256-gbSDavVLQsHY3zJ1KgcIWtkYYjft2KQ0RV6qk9m9xpE="
   },
   "ocean-sound-theme": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/ocean-sound-theme-6.2.5.tar.xz",
-    "hash": "sha256-AX0yXsZzu4DfykQrdu9xoXLMomkRwoojDMc5KwFdxQU="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/ocean-sound-theme-6.3.0.tar.xz",
+    "hash": "sha256-g9nF9oc8uQ4tcepUVUh8QnN+BTUTOM7xnj+MrT68JNo="
   },
   "oxygen": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/oxygen-6.2.5.tar.xz",
-    "hash": "sha256-bXct1QnCv9A9f4AeRe/xUfNEFykAuuBbsW2LovjTt9w="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/oxygen-6.3.0.tar.xz",
+    "hash": "sha256-SpCO5h552/wlIFJ8ZJPvuSeWVXUMxxXx4z2FKk8JaDQ="
   },
   "oxygen-sounds": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/oxygen-sounds-6.2.5.tar.xz",
-    "hash": "sha256-7gg8Zyt2AF3940CQLPAwLKCBs1nKpWZnkzTaln6PdbQ="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/oxygen-sounds-6.3.0.tar.xz",
+    "hash": "sha256-vqL+XEFKN65mnzmSLMutwUB3kkcEUpfsLQEfoX7MDys="
   },
   "plasma-activities": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-activities-6.2.5.tar.xz",
-    "hash": "sha256-d+pznHzlFw2S141vN2XhmjLw4kt0H1JVVdWdx94V5sc="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-activities-6.3.0.tar.xz",
+    "hash": "sha256-zLHKLcHeseI13UlvQjVfAFT1gGHs+adZ2fqgopmlbHs="
   },
   "plasma-activities-stats": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-activities-stats-6.2.5.tar.xz",
-    "hash": "sha256-zduiWSRlHg9d50pvqryJkDAYV7sx9O5KwfadegxIUyw="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-activities-stats-6.3.0.tar.xz",
+    "hash": "sha256-tKO4AhZgGP5NTTXNDXxBG1LRy3T/0iochOSUrTA1aC4="
   },
   "plasma-browser-integration": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-browser-integration-6.2.5.tar.xz",
-    "hash": "sha256-JdqQUWafIKG/m9iYfZViGy5mQTGjw4cBo8Xi+G2bXc4="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-browser-integration-6.3.0.tar.xz",
+    "hash": "sha256-nF7TyOy+Co7PFpdBbL+fNBaUHp339avhebZnvYB4+20="
   },
   "plasma-desktop": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-desktop-6.2.5.tar.xz",
-    "hash": "sha256-tz0pICAxtwSUhdhOYV170KPKiQ3LLCLYEW64/m/p0Gg="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-desktop-6.3.0.tar.xz",
+    "hash": "sha256-u9v6h0tsBOO7M2g+oNCeMmFt6CfflqG2ZKILL1nWnQ4="
   },
   "plasma-dialer": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-dialer-6.2.5.tar.xz",
-    "hash": "sha256-DWTYOXsRAbqJgyvjbyKazthzFQpUHRECNbXQWawPYEY="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-dialer-6.3.0.tar.xz",
+    "hash": "sha256-yVB0e4yD15DsY+5YXu0tMw10C3ZcYUFSPQlGNicgV6o="
   },
   "plasma-disks": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-disks-6.2.5.tar.xz",
-    "hash": "sha256-m1FKt/sL3gyxhxM0zp6oEV2JjdKJDpbuBo6lpCm+f3U="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-disks-6.3.0.tar.xz",
+    "hash": "sha256-p2meDmgZMRlSw1FZE5xqESYS3fOVHrdC60zf+2rYbT0="
   },
   "plasma-firewall": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-firewall-6.2.5.tar.xz",
-    "hash": "sha256-8Om32kgaODrEURIQuqmYuMJjYB8YIRsGVfXJ2YFX2mk="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-firewall-6.3.0.tar.xz",
+    "hash": "sha256-ll172oqLjZCW6UeLCcRqfR3Mh9z//tHCe3h3kdvjx/A="
   },
   "plasma-integration": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-integration-6.2.5.tar.xz",
-    "hash": "sha256-V5XlIoXe6hCHf9VkdEc9BhBxy0JbqHzvM2aDLVB2Ryk="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-integration-6.3.0.tar.xz",
+    "hash": "sha256-4IL0XHGAfkpBpf7g7uPyc0couMje0EHi+US3UwaGlDM="
   },
   "plasma-mobile": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-mobile-6.2.5.tar.xz",
-    "hash": "sha256-rs65urOS/D2f3qWRPCAqEQeMQGB5SSdyJYG9iOxlGNI="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-mobile-6.3.0.tar.xz",
+    "hash": "sha256-tDkNwsSouZcT1FxR8kG3H/7RGLmKuJqsQND4sL07s5E="
   },
   "plasma-nano": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-nano-6.2.5.tar.xz",
-    "hash": "sha256-czQB7HQ2hPWdrSGa1+ucFW3XMLjhcmv1WA2HlInfGsk="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-nano-6.3.0.tar.xz",
+    "hash": "sha256-q0uhUTOq8nPsHHkfw39FzjBPKH96FwaEn8TtrhtLHQM="
   },
   "plasma-nm": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-nm-6.2.5.tar.xz",
-    "hash": "sha256-FG12k2zphViDmpp88w+pUbfubNPap8MtcczfFXpPbGg="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-nm-6.3.0.tar.xz",
+    "hash": "sha256-IakXwSdy9+KBzi5rewgnN55E97VHomHfRhWdVy0NxeA="
   },
   "plasma-pa": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-pa-6.2.5.tar.xz",
-    "hash": "sha256-UXkzen6sQUWpU7RhRtSJmUXZxDNzrWD3ZpL/xCzxnUc="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-pa-6.3.0.tar.xz",
+    "hash": "sha256-3gT7Kgwe7H+Ek1DVoXyOhP+XLYILXjTTja4LiSJhae0="
   },
   "plasma-sdk": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-sdk-6.2.5.tar.xz",
-    "hash": "sha256-dr1i5e89nnF/fEX/WGOHMrgH56UTlCxiRywCsLKuNRE="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-sdk-6.3.0.tar.xz",
+    "hash": "sha256-PXXSJLK3p9ZcextB1NqxIizyXFnqTpwBcK23J9fvQWg="
   },
   "plasma-systemmonitor": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-systemmonitor-6.2.5.tar.xz",
-    "hash": "sha256-lXXUVi5oIJYnruLzWAcLCRIsw+Cf7lDJBFHfUr8Asso="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-systemmonitor-6.3.0.tar.xz",
+    "hash": "sha256-/kZ/X+uSlaAtoQNTCYoC8wBWu5ZAFjV+LOTQwH0wXIg="
   },
   "plasma-thunderbolt": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-thunderbolt-6.2.5.tar.xz",
-    "hash": "sha256-5sOMf+hE66ay04oGzz6fLFHpiYk5ZeFoORfEbZTrJNo="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-thunderbolt-6.3.0.tar.xz",
+    "hash": "sha256-oMPbVanG0+QMf0t49iH2uF4R9mzPwEkTMzn7jJzh/mw="
   },
   "plasma-vault": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-vault-6.2.5.tar.xz",
-    "hash": "sha256-a35z/DnGu14sBlc++IqJSO6lcGCKjh5J2RI4mu+lC04="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-vault-6.3.0.tar.xz",
+    "hash": "sha256-QU/lNg6xMv8kYyLs6aVkUEES+pWkxGKz8XK5hhPcJdg="
   },
   "plasma-welcome": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-welcome-6.2.5.tar.xz",
-    "hash": "sha256-6aKuDK2C75/q50cfYlYo199wmCVeqO5x+reO1IU5Jho="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-welcome-6.3.0.tar.xz",
+    "hash": "sha256-x+iEF4wc0aoKwmBzvZzxJNCjvjkmwCQLeXR3gGchGYQ="
   },
   "plasma-workspace": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-workspace-6.2.5.tar.xz",
-    "hash": "sha256-uCUR5G9i4bj2C5acgoyNjTL8eShAGnDMKMKfhfRsQS8="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-workspace-6.3.0.tar.xz",
+    "hash": "sha256-FBZ9trlmsVZ7S4uPt77RjZUvK02UR7Uiij9aH7s4xDk="
   },
   "plasma-workspace-wallpapers": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma-workspace-wallpapers-6.2.5.tar.xz",
-    "hash": "sha256-2LB6LMPTTRNDTzog6aSW7XUCgFJi47sYnrhG1XTxvIA="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma-workspace-wallpapers-6.3.0.tar.xz",
+    "hash": "sha256-1OhrrEgzpN8jmNCBXV+SwH6+W6+X2lIGP0b/XFEPEAo="
   },
   "plasma5support": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plasma5support-6.2.5.tar.xz",
-    "hash": "sha256-ysUkSqKWGtAg7SxDQnOJ4II0guyxeZSLX9ayIWBuiwQ="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plasma5support-6.3.0.tar.xz",
+    "hash": "sha256-uVIBaVez+AM9gfxY+QvxPwL5fuzWbKTmtrCAUHTKYoM="
   },
   "plymouth-kcm": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/plymouth-kcm-6.2.5.tar.xz",
-    "hash": "sha256-rfcELy5wmFWZUMQr1hAm/kYtZs1/u9u5l7RY9plrEEg="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/plymouth-kcm-6.3.0.tar.xz",
+    "hash": "sha256-pGqGc06TgiXSh8HPpJnVv3jWzFsAjAxD45rdmvd3JS4="
   },
   "polkit-kde-agent-1": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/polkit-kde-agent-1-6.2.5.tar.xz",
-    "hash": "sha256-sf+z5ETGxT24Iqj7THUFw48mE6gSrhe+JDTgL1DCk/s="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/polkit-kde-agent-1-6.3.0.tar.xz",
+    "hash": "sha256-4H+0PlDvqaRZn/Eo7FExy75nBJ8b/yRnPOkfVbXkQes="
   },
   "powerdevil": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/powerdevil-6.2.5.tar.xz",
-    "hash": "sha256-cCUDltXvrkvn0yAb6Hjg41/Y2b+zkGYNXgOUgosfRks="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/powerdevil-6.3.0.tar.xz",
+    "hash": "sha256-y0y+bKuw6j0JipkQNcEc/BhNnJvQZfu6nvNPbAgsE6g="
   },
   "print-manager": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/print-manager-6.2.5.tar.xz",
-    "hash": "sha256-BWAW67df4Co/LnG/pnmAbAwNwgvcZ240NFwu0Etf6sw="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/print-manager-6.3.0.tar.xz",
+    "hash": "sha256-wsR6LEvcOKMuzZaFbVvZzRa/UBFleeV1tbw6T3HHmAw="
   },
   "qqc2-breeze-style": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/qqc2-breeze-style-6.2.5.tar.xz",
-    "hash": "sha256-OAy2NpbKISYmVlnGGOBWNhk/KOf2pZc0HrkVr13R0Q8="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/qqc2-breeze-style-6.3.0.tar.xz",
+    "hash": "sha256-6x7qYWDPcFIoeYt+zv/DVP1+k/saimSobl059T64on8="
   },
   "sddm-kcm": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/sddm-kcm-6.2.5.tar.xz",
-    "hash": "sha256-+kARFrz8aQ/SVXwWzzlGH6nW4d4NkXpPSf+S431f31Y="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/sddm-kcm-6.3.0.tar.xz",
+    "hash": "sha256-o44ChGGmqwQkF9GfLyTFufTEKDias3E4Rjb3C8q3dkw="
   },
   "spacebar": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/spacebar-6.2.5.tar.xz",
-    "hash": "sha256-+La9PZgNuwCvjzMHAw6gXq2m2qzT5fI+wXki5mWPV6I="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/spacebar-6.3.0.tar.xz",
+    "hash": "sha256-Q56khGQDJ4FyYYFITcXkHcAOhfQX7Sbf81XY/U+lW0k="
+  },
+  "spectacle": {
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/spectacle-6.3.0.tar.xz",
+    "hash": "sha256-voCrvB6AvESTcRCJWAqQWEhJlgiiSXvj1+uBy7+HYJk="
   },
   "systemsettings": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/systemsettings-6.2.5.tar.xz",
-    "hash": "sha256-tQIvKUMl29PaFqvvtSoSwBjHOjx47aAy34kXPGmr03U="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/systemsettings-6.3.0.tar.xz",
+    "hash": "sha256-dxubbLveFf6GDKZewJo4xuF1yRSCnlVt5WwTYmkaxoA="
   },
   "wacomtablet": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/wacomtablet-6.2.5.tar.xz",
-    "hash": "sha256-5bNvjj5W1VwphX1tp8HjzsU49wPfihAldmOIoHrPOHs="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/wacomtablet-6.3.0.tar.xz",
+    "hash": "sha256-wFdo6kWRe1WZojxYze8xzRIcQhOvD/xwDK8qGcvBWDU="
   },
   "xdg-desktop-portal-kde": {
-    "version": "6.2.5",
-    "url": "mirror://kde/stable/plasma/6.2.5/xdg-desktop-portal-kde-6.2.5.tar.xz",
-    "hash": "sha256-Hoa/b33EM0AK3pM0dnHsnK2I44JTbdMJMAMORRRiOvE="
+    "version": "6.3.0",
+    "url": "mirror://kde/stable/plasma/6.3.0/xdg-desktop-portal-kde-6.3.0.tar.xz",
+    "hash": "sha256-swz1cWaFvqkWG3rD3LqqMRVmJzmYUNdFksBunNTdD1E="
   }
 }
\ No newline at end of file
diff --git a/pkgs/kde/plasma/breeze/default.nix b/pkgs/kde/plasma/breeze/default.nix
index 6768ffb94ecf..1e6652164854 100644
--- a/pkgs/kde/plasma/breeze/default.nix
+++ b/pkgs/kde/plasma/breeze/default.nix
@@ -1,6 +1,7 @@
 {
   mkKdeDerivation,
   qtbase,
+  qtsvg,
   libsForQt5,
 }:
 mkKdeDerivation {
@@ -12,6 +13,8 @@ mkKdeDerivation {
     "qt5"
   ];
 
+  extraBuildInputs = [ qtsvg ];
+
   # We can't add qt5 stuff to dependencies or the hooks blow up,
   # so manually point everything to everything. Oof.
   extraCmakeFlags = [
diff --git a/pkgs/kde/plasma/default.nix b/pkgs/kde/plasma/default.nix
index fb7846ed86fc..85ddce4b0807 100644
--- a/pkgs/kde/plasma/default.nix
+++ b/pkgs/kde/plasma/default.nix
@@ -63,6 +63,7 @@
   qqc2-breeze-style = callPackage ./qqc2-breeze-style { };
   sddm-kcm = callPackage ./sddm-kcm { };
   spacebar = callPackage ./spacebar { };
+  spectacle = callPackage ./spectacle { };
   systemsettings = callPackage ./systemsettings { };
   wacomtablet = callPackage ./wacomtablet { };
   xdg-desktop-portal-kde = callPackage ./xdg-desktop-portal-kde { };
diff --git a/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch b/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch
index 4ee9761fbd9d..54e5fbb1c2b4 100644
--- a/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch
+++ b/pkgs/kde/plasma/kinfocenter/0001-tool-paths.patch
@@ -1,8 +1,206 @@
+diff --git a/kcms/audio_information/kcm_audio_information.json b/kcms/audio_information/kcm_audio_information.json
+index d94ef1d0..13f1c377 100644
+--- a/kcms/audio_information/kcm_audio_information.json
++++ b/kcms/audio_information/kcm_audio_information.json
+@@ -80,7 +80,7 @@
+         "Name[zh_CN]": "音频",
+         "Name[zh_TW]": "音訊"
+     },
+-    "TryExec": "pactl",
++    "TryExec": "@pactl@",
+     "X-KDE-KInfoCenter-Category": "device_information",
+     "X-KDE-Keywords": "Pipewire,Audio,PulseAudio,pactl",
+     "X-KDE-Keywords[ar]": "Pipewire,Audio,PulseAudio,pactl,بايبواير,الصوت,بولس أوديو",
+diff --git a/kcms/audio_information/main.cpp b/kcms/audio_information/main.cpp
+index adb196fd..9d6c8675 100644
+--- a/kcms/audio_information/main.cpp
++++ b/kcms/audio_information/main.cpp
+@@ -16,7 +16,7 @@ public:
+     explicit KCMAudioInformation(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("pactl"), {"list"}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@pactl@"), {"list"}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/block_devices/kcm_block_devices.json b/kcms/block_devices/kcm_block_devices.json
+index a73e33ad..3a1ab4da 100644
+--- a/kcms/block_devices/kcm_block_devices.json
++++ b/kcms/block_devices/kcm_block_devices.json
+@@ -80,7 +80,7 @@
+         "Name[zh_CN]": "块设备",
+         "Name[zh_TW]": "區塊裝置"
+     },
+-    "TryExec": "lsblk",
++    "TryExec": "@lsblk@",
+     "X-KDE-KInfoCenter-Category": "device_information",
+     "X-KDE-Keywords": "lsblk,block device,partition,disk,drive,hdd,ssd,nvme",
+     "X-KDE-Keywords[ar]": "lsblk,block device,partition,disk,drive,hdd,ssd,nvme,قرص,قسم,قطاع جهاز",
+diff --git a/kcms/block_devices/main.cpp b/kcms/block_devices/main.cpp
+index 2de923f3..6b14f7fb 100644
+--- a/kcms/block_devices/main.cpp
++++ b/kcms/block_devices/main.cpp
+@@ -20,7 +20,7 @@ public:
+     {
+         // NOTE: careful when using -o, it tends to incorrectly print multiple mountpoints as a single path
+         // (e.g. when different btrfs subvolumes are mounted at various points in the system it ought to enumerate all mountpoints)
+-        m_outputContext = new CommandOutputContext(u"lsblk"_s, {}, parent);
++        m_outputContext = new CommandOutputContext(u"@lsblk@"_s, {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/cpu/kcm_cpu.json b/kcms/cpu/kcm_cpu.json
+index a783b5bc..5866c4d2 100644
+--- a/kcms/cpu/kcm_cpu.json
++++ b/kcms/cpu/kcm_cpu.json
+@@ -102,7 +102,7 @@
+         "Name[zh_CN]": "CPU",
+         "Name[zh_TW]": "CPU"
+     },
+-    "TryExec": "lscpu",
++    "TryExec": "@lscpu@",
+     "X-KDE-KInfoCenter-Category": "device_information",
+     "X-KDE-Keywords": "cpu,amd,intel,arm,instructions,cores,architecture,byte order",
+     "X-KDE-Keywords[ar]": "cpu,amd,intel,arm,instructions,cores,architecture,byte order,تعليمات,أنوية,معمارية",
+diff --git a/kcms/cpu/main.cpp b/kcms/cpu/main.cpp
+index 608381eb..8fd7914f 100644
+--- a/kcms/cpu/main.cpp
++++ b/kcms/cpu/main.cpp
+@@ -16,7 +16,7 @@ public:
+     explicit KCMCPU(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("lscpu"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@lscpu@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/edid/edid.sh b/kcms/edid/edid.sh
+index da803598..4e24eaaf 100755
+--- a/kcms/edid/edid.sh
++++ b/kcms/edid/edid.sh
+@@ -13,7 +13,7 @@ for card in /sys/class/drm/card*; do
+     # Try to read any data. If it fails continue. This prevents errors from di-edid-decode.
+     IFS= read -r data < "$edid" || continue
+ 
+-    data=$(di-edid-decode "$edid" 2>&1) || true
++    data=$(@di_edid_decode@ "$edid" 2>&1) || true
+     printf "# %s #######################\n" "$(basename "$card")"
+     printf "%s\n\n" "$data"
+ done
+diff --git a/kcms/edid/kcm_edid.json b/kcms/edid/kcm_edid.json
+index 68e4e670..19dfdc59 100644
+--- a/kcms/edid/kcm_edid.json
++++ b/kcms/edid/kcm_edid.json
+@@ -64,7 +64,7 @@
+         "Name[x-test]": "xxEDIDxx",
+         "Name[zh_CN]": "EDID"
+     },
+-    "TryExec": "di-edid-decode",
++    "TryExec": "@di_edid_decode@",
+     "X-KDE-KInfoCenter-Category": "graphical_information",
+     "X-KDE-Keywords": "EDID,Graphics",
+     "X-KDE-Keywords[ar]": "EDID,Graphics,الرسوميات,بيانات تعريف العرض الممتدة",
+diff --git a/kcms/edid/main.cpp b/kcms/edid/main.cpp
+index 9f04e7fd..8ef37d2c 100644
+--- a/kcms/edid/main.cpp
++++ b/kcms/edid/main.cpp
+@@ -20,7 +20,7 @@ public:
+     {
+         const QString executable =
+             QStandardPaths::locate(QStandardPaths::GenericDataLocation, QStringLiteral("kinfocenter/edid/edid.sh"), QStandardPaths::LocateFile);
+-        m_outputContext = new CommandOutputContext({QStringLiteral("di-edid-decode")}, QStringLiteral("/bin/sh"), {executable}, parent);
++        m_outputContext = new CommandOutputContext({QStringLiteral("@di_edid_decode@")}, QStringLiteral("/bin/sh"), {executable}, parent);
+     }
+     [[nodiscard]] CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/egl/kcm_egl.json b/kcms/egl/kcm_egl.json
+index 1cc89eb2..f1aed6c3 100644
+--- a/kcms/egl/kcm_egl.json
++++ b/kcms/egl/kcm_egl.json
+@@ -102,7 +102,7 @@
+         "Name[zh_CN]": "OpenGL (EGL)",
+         "Name[zh_TW]": "OpenGL (EGL)"
+     },
+-    "TryExec": "eglinfo",
++    "TryExec": "@eglinfo@",
+     "X-KDE-KInfoCenter-Category": "graphical_information",
+     "X-KDE-Keywords": "OpenGL,DRI,3D,VideoCard,Hardware Acceleration,Graphics,EGL",
+     "X-KDE-Keywords[ar]": "OpenGL,DRI,3D,VideoCard,Hardware Acceleration,Graphics,EGL,بطاقة الرسوميات,تسريع العتاد,رسوميات",
+diff --git a/kcms/egl/main.cpp b/kcms/egl/main.cpp
+index 1a509dac..886a62d8 100644
+--- a/kcms/egl/main.cpp
++++ b/kcms/egl/main.cpp
+@@ -16,7 +16,7 @@ public:
+     explicit KCMXServer(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("eglinfo"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@eglinfo@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/firmware_security/main.cpp b/kcms/firmware_security/main.cpp
+index eab20e0f..5a0d2499 100644
+--- a/kcms/firmware_security/main.cpp
++++ b/kcms/firmware_security/main.cpp
+@@ -20,7 +20,7 @@ public:
+         const QString executable = QStandardPaths::locate(QStandardPaths::GenericDataLocation,
+                                                           QStringLiteral("kinfocenter/firmware_security/fwupdmgr.sh"),
+                                                           QStandardPaths::LocateFile);
+-        m_outputContext = new CommandOutputContext({QStringLiteral("fwupdmgr"), QStringLiteral("aha")},
++        m_outputContext = new CommandOutputContext({QStringLiteral("fwupdmgr"), QStringLiteral("@aha@")},
+                                                    QStringLiteral("/bin/sh"),
+                                                    {executable},
+                                                    Qt::TextFormat::RichText,
+diff --git a/kcms/glx/kcm_glx.json b/kcms/glx/kcm_glx.json
+index 640ef4a5..791e8ce9 100644
+--- a/kcms/glx/kcm_glx.json
++++ b/kcms/glx/kcm_glx.json
+@@ -101,7 +101,7 @@
+         "Name[zh_CN]": "OpenGL (GLX)",
+         "Name[zh_TW]": "OpenGL (GLX)"
+     },
+-    "TryExec": "glxinfo",
++    "TryExec": "@glxinfo@",
+     "X-KDE-KInfoCenter-Category": "graphical_information",
+     "X-KDE-Keywords": "OpenGL,DRI,GLX,3D,VideoCard,Hardware Acceleration,Graphics,X,X11,Xserver,X-Server,XFree86,Display",
+     "X-KDE-Keywords[ar]": "OpenGL,DRI,GLX,3D,VideoCard,Hardware Acceleration,Graphics,X,X11,Xserver,X-Server,XFree86,Display,بطاقة الرسوميات,تسريع العتاد,الرسوميات",
+diff --git a/kcms/glx/main.cpp b/kcms/glx/main.cpp
+index a7317411..a6c5621d 100644
+--- a/kcms/glx/main.cpp
++++ b/kcms/glx/main.cpp
+@@ -16,7 +16,7 @@ public:
+     explicit KCMXServer(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("glxinfo"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@glxinfo@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/helpers/dmidecode-helper/helper.cpp b/kcms/helpers/dmidecode-helper/helper.cpp
+index 11921934..1160c5f0 100644
+--- a/kcms/helpers/dmidecode-helper/helper.cpp
++++ b/kcms/helpers/dmidecode-helper/helper.cpp
+@@ -20,10 +20,7 @@ auto make_array(Input &&...args) -> std::array<Output, sizeof...(args)> // NB: w
+ DMIDecodeHelper::DMIDecodeHelper(QObject *parent)
+     : QObject(parent)
+ {
+-    // PATH is super minimal when invoked through dbus
+-    setenv("PATH", "/usr/sbin:/sbin:/usr/local/sbin", 1);
+-
+-    m_dmidecodePath = QStandardPaths::findExecutable("dmidecode");
++    m_dmidecodePath = QStringLiteral("@dmidecode@");
+ }
+ 
+ KAuth::ActionReply DMIDecodeHelper::memoryinformation(const QVariantMap &args)
 diff --git a/kcms/kwinsupportinfo/kcm_kwinsupportinfo.json.in b/kcms/kwinsupportinfo/kcm_kwinsupportinfo.json.in
-index 0de6973e..30035768 100644
+index 24dc11a7..bc72f2af 100644
 --- a/kcms/kwinsupportinfo/kcm_kwinsupportinfo.json.in
 +++ b/kcms/kwinsupportinfo/kcm_kwinsupportinfo.json.in
-@@ -85,6 +85,6 @@
+@@ -93,6 +93,6 @@
          "Name[zh_CN]": "窗口管理器",
          "Name[zh_TW]": "視窗管理員"
      },
@@ -11,7 +209,7 @@ index 0de6973e..30035768 100644
      "X-KDE-KInfoCenter-Category": "graphical_information"
  }
 diff --git a/kcms/kwinsupportinfo/main.cpp b/kcms/kwinsupportinfo/main.cpp
-index 6ae168b5..89d0a2ff 100644
+index ddb55b5c..8dc6b668 100644
 --- a/kcms/kwinsupportinfo/main.cpp
 +++ b/kcms/kwinsupportinfo/main.cpp
 @@ -18,7 +18,7 @@ public:
@@ -23,116 +221,37 @@ index 6ae168b5..89d0a2ff 100644
                                                     {QStringLiteral("org.kde.KWin"), QStringLiteral("/KWin"), QStringLiteral("supportInformation")},
                                                     parent);
      }
-diff --git a/kcms/about-distro/src/dmidecode-helper/helper.cpp b/kcms/about-distro/src/dmidecode-helper/helper.cpp
-index 396b2d74..615e1057 100644
---- a/kcms/about-distro/src/dmidecode-helper/helper.cpp
-+++ b/kcms/about-distro/src/dmidecode-helper/helper.cpp
-@@ -20,13 +20,6 @@ KAuth::ActionReply DMIDecodeHelper::systeminformation(const QVariantMap &args)
- {
-     Q_UNUSED(args);
- 
--    // PATH is super minimal when invoked through dbus
--    setenv("PATH", "/usr/sbin:/sbin:/usr/local/sbin", 1);
--    const QString dmidecode = QStandardPaths::findExecutable("dmidecode");
--    if (dmidecode.isEmpty()) {
--        return KAuth::ActionReply::HelperErrorReply();
--    }
--
-     // NB: Microsoft also outlines a limited set of DMI values to be required for IOT OEM licensing, as such we
-     //   can rely on the same fields to have sound content . Since this only applies to OEMs we still need to filter
-     //   out dummy values though and because of that we can grab more fields, since we'll filter them anyway.
-@@ -38,7 +31,7 @@ KAuth::ActionReply DMIDecodeHelper::systeminformation(const QVariantMap &args)
-                             QStringLiteral("system-version"),
-                             QStringLiteral("system-serial-number")}) {
-         QProcess proc;
--        proc.start(dmidecode, {QStringLiteral("--string"), key});
-+        proc.start("@dmidecode@", {QStringLiteral("--string"), key});
-         proc.waitForFinished();
-         const QByteArray output = proc.readAllStandardOutput().trimmed();
- 
-diff --git a/kcms/audio_information/main.cpp b/kcms/audio_information/main.cpp
-index adb196fd..9d6c8675 100644
---- a/kcms/audio_information/main.cpp
-+++ b/kcms/audio_information/main.cpp
-@@ -16,7 +16,7 @@ class KCMAudioInformation : public KQuickConfigModule
-     explicit KCMAudioInformation(QObject *parent, const KPluginMetaData &data)
-         : KQuickConfigModule(parent, data)
-     {
--        m_outputContext = new CommandOutputContext(QStringLiteral("pactl"), {"list"}, parent);
-+        m_outputContext = new CommandOutputContext(QStringLiteral("@pactl@"), {"list"}, parent);
-     }
-     CommandOutputContext *outputContext() const
-     {
-diff --git a/kcms/block_devices/main.cpp b/kcms/block_devices/main.cpp
-index 2de923f3..6b14f7fb 100644
---- a/kcms/block_devices/main.cpp
-+++ b/kcms/block_devices/main.cpp
-@@ -20,7 +20,7 @@ class KCMBlockDevices : public KQuickConfigModule
-     {
-         // NOTE: careful when using -o, it tends to incorrectly print multiple mountpoints as a single path
-         // (e.g. when different btrfs subvolumes are mounted at various points in the system it ought to enumerate all mountpoints)
--        m_outputContext = new CommandOutputContext(u"lsblk"_s, {}, parent);
-+        m_outputContext = new CommandOutputContext(u"@lsblk@"_s, {}, parent);
-     }
-     CommandOutputContext *outputContext() const
-     {
-diff --git a/kcms/cpu/main.cpp b/kcms/cpu/main.cpp
-index 608381eb..8fd7914f 100644
---- a/kcms/cpu/main.cpp
-+++ b/kcms/cpu/main.cpp
-@@ -16,7 +16,7 @@ class KCMCPU : public KQuickConfigModule
-     explicit KCMCPU(QObject *parent, const KPluginMetaData &data)
-         : KQuickConfigModule(parent, data)
-     {
--        m_outputContext = new CommandOutputContext(QStringLiteral("lscpu"), {}, parent);
-+        m_outputContext = new CommandOutputContext(QStringLiteral("@lscpu@"), {}, parent);
-     }
-     CommandOutputContext *outputContext() const
-     {
-diff --git a/kcms/egl/main.cpp b/kcms/egl/main.cpp
-index 1a509dac..886a62d8 100644
---- a/kcms/egl/main.cpp
-+++ b/kcms/egl/main.cpp
-@@ -16,7 +16,7 @@ class KCMXServer : public KQuickConfigModule
-     explicit KCMXServer(QObject *parent, const KPluginMetaData &data)
-         : KQuickConfigModule(parent, data)
-     {
--        m_outputContext = new CommandOutputContext(QStringLiteral("eglinfo"), {}, parent);
-+        m_outputContext = new CommandOutputContext(QStringLiteral("@eglinfo@"), {}, parent);
-     }
-     CommandOutputContext *outputContext() const
-     {
-diff --git a/kcms/firmware_security/main.cpp b/kcms/firmware_security/main.cpp
-index 58e25458..890772c8 100644
---- a/kcms/firmware_security/main.cpp
-+++ b/kcms/firmware_security/main.cpp
-@@ -20,7 +20,7 @@ class KCMFirmwareSecurity : public KQuickConfigModule
-         const QString executable = QStandardPaths::locate(QStandardPaths::GenericDataLocation,
-                                                           QStringLiteral("kinfocenter/firmware_security/fwupdmgr.sh"),
-                                                           QStandardPaths::LocateFile);
--        m_outputContext = new CommandOutputContext({QStringLiteral("fwupdmgr"), QStringLiteral("aha")}, QStringLiteral("/bin/sh"), {executable}, parent);
-+        m_outputContext = new CommandOutputContext({QStringLiteral("fwupdmgr"), QStringLiteral("@aha@")}, QStringLiteral("/bin/sh"), {executable}, parent);
-     }
-     CommandOutputContext *outputContext() const
-     {
-diff --git a/kcms/glx/main.cpp b/kcms/glx/main.cpp
-index a7317411..a6c5621d 100644
---- a/kcms/glx/main.cpp
-+++ b/kcms/glx/main.cpp
-@@ -16,7 +16,7 @@ class KCMXServer : public KQuickConfigModule
-     explicit KCMXServer(QObject *parent, const KPluginMetaData &data)
-         : KQuickConfigModule(parent, data)
-     {
--        m_outputContext = new CommandOutputContext(QStringLiteral("glxinfo"), {}, parent);
-+        m_outputContext = new CommandOutputContext(QStringLiteral("@glxinfo@"), {}, parent);
-     }
-     CommandOutputContext *outputContext() const
-     {
+diff --git a/kcms/memory/kcm_memory.json b/kcms/memory/kcm_memory.json
+index 54f729ec..8e7aeb57 100644
+--- a/kcms/memory/kcm_memory.json
++++ b/kcms/memory/kcm_memory.json
+@@ -132,7 +132,7 @@
+         "Name[zh_CN]": "内存",
+         "Name[zh_TW]": "記憶體"
+     },
+-    "TryExec": "pkexec dmidecode",
++    "TryExec": "@dmidecode@",
+     "X-KDE-KInfoCenter-Category": "device_information",
+     "X-KDE-Keywords": "Memory,RAM,dmidecode",
+     "X-KDE-Keywords[ar]": "Memory,RAM,dmidecode,رام,ذاكرة,ذاكرة حية",
+diff --git a/kcms/network/kcm_network.json b/kcms/network/kcm_network.json
+index 65e929e2..20bc2289 100644
+--- a/kcms/network/kcm_network.json
++++ b/kcms/network/kcm_network.json
+@@ -147,7 +147,7 @@
+         "Name[zh_CN]": "网络接口",
+         "Name[zh_TW]": "網路介面"
+     },
+-    "TryExec": "ip",
++    "TryExec": "@ip@",
+     "X-KDE-KInfoCenter-Category": "network_information",
+     "X-KDE-Keywords": "network,nic,ip,ip address,mac,inet,eth,wlan,wifi",
+     "X-KDE-Keywords[ar]": "network,nic,ip,ip address,mac,inet,eth,wlan,wifi,الشبكة,شبكة الاتصال,عنوان IP,عنوان IP,جهاز Mac,شبكة الإنترنت,شبكة ETH,شبكة WLAN,شبكة Wi-Fi",
 diff --git a/kcms/network/main.cpp b/kcms/network/main.cpp
 index f02577a3..479e18df 100644
 --- a/kcms/network/main.cpp
 +++ b/kcms/network/main.cpp
-@@ -18,7 +18,7 @@ class KCMNetwork : public KQuickConfigModule
+@@ -18,7 +18,7 @@ public:
      explicit KCMNetwork(QObject *parent, const KPluginMetaData &data)
          : KQuickConfigModule(parent, data)
      {
@@ -141,11 +260,24 @@ index f02577a3..479e18df 100644
      }
      CommandOutputContext *outputContext() const
      {
+diff --git a/kcms/opencl/kcm_opencl.json b/kcms/opencl/kcm_opencl.json
+index 774dd42e..40e2076a 100644
+--- a/kcms/opencl/kcm_opencl.json
++++ b/kcms/opencl/kcm_opencl.json
+@@ -90,7 +90,7 @@
+         "Name[zh_CN]": "OpenCL",
+         "Name[zh_TW]": "OpenCL"
+     },
+-    "TryExec": "clinfo",
++    "TryExec": "@clinfo@",
+     "X-KDE-KInfoCenter-Category": "graphical_information",
+     "X-KDE-Keywords": "OpenCL,VideoCard,Hardware Acceleration,Graphics",
+     "X-KDE-Keywords[ar]": "OpenCL,VideoCard,Hardware Acceleration,Graphics,بطاقة الفيديو,تسريع العتاد,الرسوميات",
 diff --git a/kcms/opencl/main.cpp b/kcms/opencl/main.cpp
 index d58728ab..88733d46 100644
 --- a/kcms/opencl/main.cpp
 +++ b/kcms/opencl/main.cpp
-@@ -18,7 +18,7 @@ class KCMOpenCL : public KQuickConfigModule
+@@ -18,7 +18,7 @@ public:
      explicit KCMOpenCL(QObject *parent, const KPluginMetaData &data)
          : KQuickConfigModule(parent, data)
      {
@@ -154,45 +286,6 @@ index d58728ab..88733d46 100644
      }
      CommandOutputContext *outputContext() const
      {
-diff --git a/kcms/vulkan/main.cpp b/kcms/vulkan/main.cpp
-index 5665d9d2..008f1bf0 100644
---- a/kcms/vulkan/main.cpp
-+++ b/kcms/vulkan/main.cpp
-@@ -16,7 +16,7 @@ class KCMVulkan : public KQuickConfigModule
-     explicit KCMVulkan(QObject *parent, const KPluginMetaData &data)
-         : KQuickConfigModule(parent, data)
-     {
--        m_outputContext = new CommandOutputContext(QStringLiteral("vulkaninfo"), {}, parent);
-+        m_outputContext = new CommandOutputContext(QStringLiteral("@vulkaninfo@"), {}, parent);
-     }
-     CommandOutputContext *outputContext() const
-     {
-diff --git a/kcms/wayland/main.cpp b/kcms/wayland/main.cpp
-index 3a4825c7..2c6a6c43 100644
---- a/kcms/wayland/main.cpp
-+++ b/kcms/wayland/main.cpp
-@@ -16,7 +16,7 @@ class KCMWayland : public KQuickConfigModule
-     explicit KCMWayland(QObject *parent, const KPluginMetaData &data)
-         : KQuickConfigModule(parent, data)
-     {
--        m_outputContext = new CommandOutputContext(QStringLiteral("wayland-info"), {}, parent);
-+        m_outputContext = new CommandOutputContext(QStringLiteral("@waylandinfo@"), {}, parent);
-     }
-     CommandOutputContext *outputContext() const
-     {
-diff --git a/kcms/xserver/main.cpp b/kcms/xserver/main.cpp
-index df9af24a..e5983e22 100644
---- a/kcms/xserver/main.cpp
-+++ b/kcms/xserver/main.cpp
-@@ -16,7 +16,7 @@ class KCMXServer : public KQuickConfigModule
-     explicit KCMXServer(QObject *parent, const KPluginMetaData &data)
-         : KQuickConfigModule(parent, data)
-     {
--        m_outputContext = new CommandOutputContext(QStringLiteral("xdpyinfo"), {}, parent);
-+        m_outputContext = new CommandOutputContext(QStringLiteral("@xdpyinfo@"), {}, parent);
-     }
-     CommandOutputContext *outputContext() const
-     {
 diff --git a/kcms/pci/CMakeLists.txt b/kcms/pci/CMakeLists.txt
 index 36d82ef8..16ce2703 100644
 --- a/kcms/pci/CMakeLists.txt
@@ -200,8 +293,87 @@ index 36d82ef8..16ce2703 100644
 @@ -19,7 +19,7 @@ else()
      find_package(lspci)
      set_package_properties(lspci PROPERTIES TYPE RUNTIME)
-
+ 
 -    set(PCI_BACKEND lspci)
 +    set(PCI_BACKEND @lspci@)
      set(PCI_BACKEND_ARGUMENTS "-v")
  endif()
+ 
+diff --git a/kcms/vulkan/kcm_vulkan.json b/kcms/vulkan/kcm_vulkan.json
+index 78b42cfd..1ec93c91 100644
+--- a/kcms/vulkan/kcm_vulkan.json
++++ b/kcms/vulkan/kcm_vulkan.json
+@@ -100,7 +100,7 @@
+         "Name[zh_CN]": "Vulkan",
+         "Name[zh_TW]": "Vulkan"
+     },
+-    "TryExec": "vulkaninfo",
++    "TryExec": "@vulkaninfo@",
+     "X-KDE-KInfoCenter-Category": "graphical_information",
+     "X-KDE-Keywords": "Vulkan,VideoCard,Hardware Acceleration,Graphics",
+     "X-KDE-Keywords[ar]": "Vulkan,VideoCard,Hardware Acceleration,Graphics,فولكان,بطاقة الفيديو,تسريع الأجهزة,الرسومات",
+diff --git a/kcms/vulkan/main.cpp b/kcms/vulkan/main.cpp
+index 5665d9d2..008f1bf0 100644
+--- a/kcms/vulkan/main.cpp
++++ b/kcms/vulkan/main.cpp
+@@ -16,7 +16,7 @@ public:
+     explicit KCMVulkan(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("vulkaninfo"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@vulkaninfo@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/wayland/kcm_wayland.json b/kcms/wayland/kcm_wayland.json
+index 9ae953bb..27d98104 100644
+--- a/kcms/wayland/kcm_wayland.json
++++ b/kcms/wayland/kcm_wayland.json
+@@ -107,7 +107,7 @@
+         "Name[zh_CN]": "Wayland",
+         "Name[zh_TW]": "Wayland"
+     },
+-    "TryExec": "wayland-info",
++    "TryExec": "@waylandinfo@",
+     "X-KDE-KInfoCenter-Category": "graphical_information",
+     "X-KDE-Keywords": "Wayland,Compositor,Display,System Information",
+     "X-KDE-Keywords[ar]": "ويلاند,مراكب,عرض,معلومات النّظام",
+diff --git a/kcms/wayland/main.cpp b/kcms/wayland/main.cpp
+index 3a4825c7..4633927b 100644
+--- a/kcms/wayland/main.cpp
++++ b/kcms/wayland/main.cpp
+@@ -16,7 +16,7 @@ public:
+     explicit KCMWayland(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("wayland-info"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@waylandinfo@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
+diff --git a/kcms/xserver/kcm_xserver.json b/kcms/xserver/kcm_xserver.json
+index f5642e25..11f108a7 100644
+--- a/kcms/xserver/kcm_xserver.json
++++ b/kcms/xserver/kcm_xserver.json
+@@ -147,7 +147,7 @@
+         "Name[zh_CN]": "X 服务器",
+         "Name[zh_TW]": "X 伺服器"
+     },
+-    "TryExec": "xdpyinfo",
++    "TryExec": "@xdpyinfo@",
+     "X-DocPath": "kinfocenter/graphical.html#xserver",
+     "X-KDE-KInfoCenter-Category": "graphical_information",
+     "X-KDE-Keywords": "X,X-Server,XServer,XFree86,Display,VideoCard,System Information",
+diff --git a/kcms/xserver/main.cpp b/kcms/xserver/main.cpp
+index df9af24a..e5983e22 100644
+--- a/kcms/xserver/main.cpp
++++ b/kcms/xserver/main.cpp
+@@ -16,7 +16,7 @@ public:
+     explicit KCMXServer(QObject *parent, const KPluginMetaData &data)
+         : KQuickConfigModule(parent, data)
+     {
+-        m_outputContext = new CommandOutputContext(QStringLiteral("xdpyinfo"), {}, parent);
++        m_outputContext = new CommandOutputContext(QStringLiteral("@xdpyinfo@"), {}, parent);
+     }
+     CommandOutputContext *outputContext() const
+     {
diff --git a/pkgs/kde/plasma/kinfocenter/default.nix b/pkgs/kde/plasma/kinfocenter/default.nix
index ce85b92bfc12..d9a0c171dbdb 100644
--- a/pkgs/kde/plasma/kinfocenter/default.nix
+++ b/pkgs/kde/plasma/kinfocenter/default.nix
@@ -4,9 +4,11 @@
   dmidecode,
   iproute2,
   lib,
+  libdisplay-info,
   libusb1,
   mesa-demos,
   mkKdeDerivation,
+  pkg-config,
   pciutils,
   pulseaudio,
   qttools,
@@ -21,6 +23,7 @@ let
   tools = {
     aha = lib.getExe aha;
     clinfo = lib.getExe clinfo;
+    di_edid_decode = lib.getExe libdisplay-info;
     dmidecode = lib.getExe' dmidecode "dmidecode";
     eglinfo = lib.getExe' mesa-demos "eglinfo";
     glxinfo = lib.getExe' mesa-demos "glxinfo";
@@ -54,6 +57,7 @@ mkKdeDerivation {
       --replace-fail " aha " " ${lib.getExe aha} "
   '';
 
+  extraNativeBuildInputs = [ pkg-config ];
   extraBuildInputs = [ libusb1 ];
 
   # fix wrong symlink of infocenter pointing to a 'systemsettings5' binary in
diff --git a/pkgs/kde/plasma/plasma-desktop/default.nix b/pkgs/kde/plasma/plasma-desktop/default.nix
index 53c270cb5905..7933541b4501 100644
--- a/pkgs/kde/plasma/plasma-desktop/default.nix
+++ b/pkgs/kde/plasma/plasma-desktop/default.nix
@@ -16,6 +16,7 @@
   xkeyboard_config,
   xorg,
   libcanberra,
+  libwacom,
   libxkbfile,
   ibus,
 }:
@@ -53,6 +54,7 @@ mkKdeDerivation {
 
     SDL2
     libcanberra
+    libwacom
     libxkbfile
     xkeyboard_config
 
diff --git a/pkgs/kde/plasma/plasma-workspace/default.nix b/pkgs/kde/plasma/plasma-workspace/default.nix
index 6aa092b2a757..a5b80f8ab351 100644
--- a/pkgs/kde/plasma/plasma-workspace/default.nix
+++ b/pkgs/kde/plasma/plasma-workspace/default.nix
@@ -29,7 +29,6 @@ mkKdeDerivation {
       qdbus = lib.getExe' qttools "qdbus";
       xmessage = lib.getExe xorg.xmessage;
       xrdb = lib.getExe xorg.xrdb;
-      xsetroot = lib.getExe xorg.xsetroot;
       # @QtBinariesDir@ only appears in the *removed* lines of the diff
       QtBinariesDir = null;
     })
@@ -66,7 +65,7 @@ mkKdeDerivation {
   # Hardcoded as QStrings, which are UTF-16 so Nix can't pick these up automatically
   postFixup = ''
     mkdir -p $out/nix-support
-    echo "${lsof} ${xorg.xmessage} ${xorg.xrdb} ${xorg.xsetroot}" > $out/nix-support/depends
+    echo "${lsof} ${xorg.xmessage} ${xorg.xrdb}" > $out/nix-support/depends
   '';
 
   passthru.providedSessions = [
diff --git a/pkgs/kde/plasma/plasma-workspace/dependency-paths.patch b/pkgs/kde/plasma/plasma-workspace/dependency-paths.patch
index 561655dde280..b4d46cd869bb 100644
--- a/pkgs/kde/plasma/plasma-workspace/dependency-paths.patch
+++ b/pkgs/kde/plasma/plasma-workspace/dependency-paths.patch
@@ -1,5 +1,5 @@
 diff --git a/applets/devicenotifier/plugin/deviceerrormonitor_p.cpp b/applets/devicenotifier/plugin/deviceerrormonitor_p.cpp
-index 8c2bc13a74..7b3cd72363 100644
+index ba214a555d..421d940738 100644
 --- a/applets/devicenotifier/plugin/deviceerrormonitor_p.cpp
 +++ b/applets/devicenotifier/plugin/deviceerrormonitor_p.cpp
 @@ -155,7 +155,7 @@ void DeviceErrorMonitor::queryBlockingApps(const QString &devicePath)
@@ -25,7 +25,7 @@ index e27e21a7bd..abbf7f32e1 100644
      p.write(input);
      p.closeWriteChannel();
 diff --git a/kcms/fonts/fonts.cpp b/kcms/fonts/fonts.cpp
-index a75f313880..a1e649c1f6 100644
+index 96417c440a..8c9bc2e9ab 100644
 --- a/kcms/fonts/fonts.cpp
 +++ b/kcms/fonts/fonts.cpp
 @@ -137,7 +137,7 @@ void KFonts::save()
@@ -38,7 +38,7 @@ index a75f313880..a1e649c1f6 100644
              proc.write("Xft.dpi\n");
              proc.closeWriteChannel();
 diff --git a/kcms/kfontinst/kcmfontinst/FcQuery.cpp b/kcms/kfontinst/kcmfontinst/FcQuery.cpp
-index f5034455c9..8ea57813a1 100644
+index e4d1ad4311..d45bdfad98 100644
 --- a/kcms/kfontinst/kcmfontinst/FcQuery.cpp
 +++ b/kcms/kfontinst/kcmfontinst/FcQuery.cpp
 @@ -46,7 +46,7 @@ void CFcQuery::run(const QString &query)
@@ -51,10 +51,10 @@ index f5034455c9..8ea57813a1 100644
  
  void CFcQuery::procExited()
 diff --git a/kcms/krdb/krdb.cpp b/kcms/krdb/krdb.cpp
-index 39bcb7317d..b0363afde9 100644
+index f3c9956921..09c818739d 100644
 --- a/kcms/krdb/krdb.cpp
 +++ b/kcms/krdb/krdb.cpp
-@@ -423,7 +423,7 @@ void runRdb(unsigned int flags)
+@@ -425,7 +425,7 @@ void runRdb(unsigned int flags)
              contents += "Xft.dpi: "_L1 + QString::number(dpi) + u'\n';
          else {
              KProcess queryProc;
@@ -63,7 +63,7 @@ index 39bcb7317d..b0363afde9 100644
              queryProc.setOutputChannelMode(KProcess::OnlyStdoutChannel);
              queryProc.start();
              if (queryProc.waitForFinished()) {
-@@ -443,7 +443,7 @@ void runRdb(unsigned int flags)
+@@ -445,7 +445,7 @@ void runRdb(unsigned int flags)
                  }
  
                  KProcess loadProc;
@@ -72,7 +72,7 @@ index 39bcb7317d..b0363afde9 100644
                  loadProc.start();
                  if (loadProc.waitForStarted()) {
                      loadProc.write(db);
-@@ -461,14 +461,14 @@ void runRdb(unsigned int flags)
+@@ -463,9 +463,9 @@ void runRdb(unsigned int flags)
  
      KProcess proc;
  #ifndef NDEBUG
@@ -84,12 +84,6 @@ index 39bcb7317d..b0363afde9 100644
  #endif
      proc.execute();
  
-     // Needed for applications that don't set their own cursor.
--    QProcess::execute(QStringLiteral("xsetroot"), {QStringLiteral("-cursor_name"), QStringLiteral("left_ptr")});
-+    QProcess::execute(QStringLiteral("@xsetroot@"), {QStringLiteral("-cursor_name"), QStringLiteral("left_ptr")});
- 
-     applyGtkStyles(1);
-     applyGtkStyles(2);
 diff --git a/ksmserver/plasma-restoresession.service.in b/ksmserver/plasma-restoresession.service.in
 index 2c52a4b87d..fd7fdc8ac1 100644
 --- a/ksmserver/plasma-restoresession.service.in
@@ -135,7 +129,7 @@ index 4d31c6f408..17418b1ff7 100644
      }
      return p;
 diff --git a/startkde/systemd/plasma-ksplash-ready.service.in b/startkde/systemd/plasma-ksplash-ready.service.in
-index 1e903130a9..1d807a8526 100644
+index 1e903130a9..0861c3d136 100644
 --- a/startkde/systemd/plasma-ksplash-ready.service.in
 +++ b/startkde/systemd/plasma-ksplash-ready.service.in
 @@ -6,5 +6,5 @@ PartOf=graphical-session.target
diff --git a/pkgs/kde/plasma/plasma5support/default.nix b/pkgs/kde/plasma/plasma5support/default.nix
index f1c0632fdcf3..b5226ca56c4a 100644
--- a/pkgs/kde/plasma/plasma5support/default.nix
+++ b/pkgs/kde/plasma/plasma5support/default.nix
@@ -1,4 +1,21 @@
-{ mkKdeDerivation }:
+{
+  mkKdeDerivation,
+  pkg-config,
+  kidletime,
+  networkmanager-qt,
+  plasma-activities,
+  gpsd,
+}:
 mkKdeDerivation {
   pname = "plasma5support";
+
+  extraNativeBuildInputs = [ pkg-config ];
+
+  extraBuildInputs = [
+    kidletime
+    networkmanager-qt
+    plasma-activities
+
+    gpsd
+  ];
 }
diff --git a/pkgs/kde/gear/spectacle/default.nix b/pkgs/kde/plasma/spectacle/default.nix
similarity index 100%
rename from pkgs/kde/gear/spectacle/default.nix
rename to pkgs/kde/plasma/spectacle/default.nix
diff --git a/pkgs/os-specific/linux/freeipa/default.nix b/pkgs/os-specific/linux/freeipa/default.nix
index 212080d23365..3a7edb9abbb9 100644
--- a/pkgs/os-specific/linux/freeipa/default.nix
+++ b/pkgs/os-specific/linux/freeipa/default.nix
@@ -64,6 +64,7 @@ let
     jinja2
     augeas
     samba
+    ifaddr
   ];
 in
 stdenv.mkDerivation rec {
diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
index c6287084d57f..fef42f0b48ab 100644
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -83,7 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
   preConfigure =
     ''
       export SGML_CATALOG_FILES="${docbookFiles}"
-      export PYTHONPATH=$(find ${python3.pkgs.python-ldap} -type d -name site-packages)
       export PATH=$PATH:${openldap}/libexec
 
       configureFlagsArray=(
@@ -129,7 +128,12 @@ stdenv.mkDerivation (finalAttrs: {
     samba
     nfs-utils
     p11-kit
-    python3
+    (python3.withPackages (
+      p: with p; [
+        distutils
+        python-ldap
+      ]
+    ))
     popt
     talloc
     tdb
@@ -147,7 +151,6 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt
     libxml2
     libuuid
-    python3.pkgs.python-ldap
     systemd
     nspr
     check
diff --git a/pkgs/servers/sql/postgresql/ext/pgrouting.nix b/pkgs/servers/sql/postgresql/ext/pgrouting.nix
index f795ad8618fb..4aef42af2579 100644
--- a/pkgs/servers/sql/postgresql/ext/pgrouting.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgrouting.nix
@@ -11,7 +11,7 @@
 
 buildPostgresqlExtension rec {
   pname = "pgrouting";
-  version = "3.7.2";
+  version = "3.7.3";
 
   nativeBuildInputs = [
     cmake
@@ -23,7 +23,7 @@ buildPostgresqlExtension rec {
     owner = "pgRouting";
     repo = "pgrouting";
     rev = "v${version}";
-    hash = "sha256-dzt1fVqbOE37A/qcQbuQuyiZpYuCwavQhnN/ZwFy1KM=";
+    hash = "sha256-jaevnDCJ6hRQeDhdAkvMTvnnFWElMNvo9gZRW53proQ=";
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
index e3b93c16d1be..4ca7244ba407 100644
--- a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
+++ b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
@@ -9,13 +9,13 @@
 
 buildPostgresqlExtension (finalAttrs: {
   pname = "plpgsql-check";
-  version = "2.7.13";
+  version = "2.7.15";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = "plpgsql_check";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-9xfL/nhjvVb2hQj0OLOFYdpRfuEXikgTC7rSsEZ8ws8=";
+    hash = "sha256-JF0aTYakoHMRdiWcA70mYFvzTiwMhOJZfqRj+6JC6n0=";
   };
 
   passthru.tests.extension = postgresqlTestExtension {
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 03631de86122..18f842accbc6 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,7 +13,7 @@
 
 buildPostgresqlExtension rec {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.18.0";
+  version = "2.18.1";
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [
@@ -25,7 +25,7 @@ buildPostgresqlExtension rec {
     owner = "timescale";
     repo = "timescaledb";
     rev = version;
-    hash = "sha256-wDjzahlhUlBDXppk9HLNUOc7mlVqv56M2VGE/C04gUo=";
+    hash = "sha256-Ckrs22lPQb+zx9JNHHB3TQDx9ry+q8+FimvR3OT3npg=";
   };
 
   cmakeFlags =
diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index 6f0efb5fc4ee..d2a46860416a 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -106,11 +106,11 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "287";
+  version = "288";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-0s7pT8pAMCE+csd9/+Dv4AbCK0qxDacQ9fNcMYCNDbw=";
+    hash = "sha256-HeJfqjmuduVc/C0kfaAsiQuoKrrwlW69lkfYDz1uFlg=";
   };
 
   outputs = [
@@ -121,11 +121,11 @@ python.pkgs.buildPythonApplication rec {
   patches = [ ./ignore_links.patch ];
 
   postPatch = ''
-    # Upstream doesn't provide a PKG-INFO file
-    sed -i setup.py -e "/'rpm-python',/d"
-
     # When generating manpage, use the installed version
-    substituteInPlace doc/Makefile --replace "../bin" "$out/bin"
+    substituteInPlace doc/Makefile --replace-fail "../bin" "$out/bin"
+
+    substituteInPlace diffoscope/comparators/apk.py \
+      --replace-fail "from androguard.core.bytecodes import apk" "from androguard.core import apk"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fd2b75bb5c47..3f2d0a702a06 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5322,10 +5322,8 @@ with pkgs;
   globalprotect-openconnect = libsForQt5.callPackage ../tools/networking/globalprotect-openconnect { };
 
   sssd = callPackage ../os-specific/linux/sssd {
+    # NOTE: freeipa and sssd need to be built with the same version of python
     inherit (perlPackages) Po4a;
-    # python312Packages.python-ldap is broken
-    # https://github.com/NixOS/nixpkgs/issues/326296
-    python3 = python311;
   };
 
   sentry-cli = callPackage ../development/tools/sentry-cli {
@@ -8811,6 +8809,7 @@ with pkgs;
   };
 
   freeipa = callPackage ../os-specific/linux/freeipa {
+    # NOTE: freeipa and sssd need to be built with the same version of python
     kerberos = krb5.override {
       withVerto = true;
     };
@@ -11365,8 +11364,9 @@ with pkgs;
 
   kanidm_1_3 = callPackage ../by-name/ka/kanidm/1_3.nix { };
   kanidm_1_4 = callPackage ../by-name/ka/kanidm/1_4.nix { };
+  kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix { };
 
-  kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_4;
+  kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_5;
 
   kanidmWithSecretProvisioning_1_3 = callPackage ../by-name/ka/kanidm/1_3.nix {
     enableSecretProvisioning = true;
@@ -11376,6 +11376,10 @@ with pkgs;
     enableSecretProvisioning = true;
   };
 
+  kanidmWithSecretProvisioning_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix {
+    enableSecretProvisioning = true;
+  };
+
   knot-resolver = callPackage ../servers/dns/knot-resolver {
     systemd = systemdMinimal; # in closure already anyway
   };
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 49fd9c7ece37..3bf08ddf5be8 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -295,6 +295,28 @@
     };
     version = "1.0.0";
   };
+  cf-uaa-lib = {
+    dependencies = ["addressable" "httpclient" "multi_json"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "f03e5fc4630511d39d42d802715d65997abfc5cdd113564fa21aebb610f63a46";
+      type = "gem";
+    };
+    version = "4.0.8";
+  };
+  cf-uaac = {
+    dependencies = ["cf-uaa-lib" "em-http-request" "eventmachine" "highline" "json_pure" "launchy" "rack"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "f31cbbe93f8d791fac8ed6c9ede370f29d58654913b81177b6918c476b675528";
+      type = "gem";
+    };
+    version = "4.27.0";
+  };
   charlock_holmes = {
     groups = ["default"];
     platforms = [];
@@ -305,6 +327,17 @@
     };
     version = "0.7.7";
   };
+  childprocess = {
+    dependecnies = ["logger"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "9a8d484be2fd4096a0e90a0cd3e449a05bc3aa33f8ac9e4d6dcef6ac1455b6ec";
+      type = "gem";
+    };
+    version = "5.1.0";
+  };
   claide = {
     groups = ["default"];
     platforms = [];
@@ -717,6 +750,16 @@
     };
     version = "4.0.4";
   };
+  cookiejar = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "11b16acfc4baf7a0f463c21a6212005e04e25f5554d4d9f24d97f3492dfda0df";
+      type = "gem";
+    };
+    version = "0.3.4";
+  };
   crass = {
     groups = ["default"];
     platforms = [];
@@ -922,6 +965,28 @@
     };
     version = "0.1.0";
   };
+  em-http-request = {
+    dependencies = ["addressable" "cookiejar" "em-socksify" "eventmachine" "http_parser.rb"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1azx5rgm1zvx7391sfwcxzyccs46x495vb34ql2ch83f58mwgyqn";
+      type = "gem";
+    };
+    version = "1.1.7";
+  };
+  em-socksify = {
+    dependencies = ["eventmachine"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rk43ywaanfrd8180d98287xv2pxyl7llj291cwy87g1s735d5nk";
+      type = "gem";
+    };
+    version = "0.3.3";
+  };
   elftools = {
     dependencies = ["bindata"];
     groups = ["default"];
@@ -2080,6 +2145,17 @@
     };
     version = "1.7.8";
   };
+  launchy = {
+    dependencies = ["addressable" "childprocess" "logger"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "4964ae775cd802f5a57ae5584fbdb1151a8908cb0c626341563430d614a59572";
+      type = "gem";
+    };
+    version = "3.1.0";
+  };
   language_server-protocol = {
     groups = ["default"];
     platforms = [];
@@ -2172,6 +2248,16 @@
     };
     version = "2.1.4";
   };
+  logger = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "c3cfe56d01656490ddd103d38b8993d73d86296adebc5f58cefc9ec03741e56b";
+      type = "gem";
+    };
+    version = "1.6.5";
+  };
   loofah = {
     dependencies = ["crass" "nokogiri"];
     groups = ["default"];