diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index b30b36ee5aed..a167754e8c9b 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -146,6 +146,8 @@
   Processes also now run as a dynamically allocated user by default instead of
   root.
 
+- The nvidia driver no longer defaults to the proprietary driver starting with version 560. You will need to manually set `hardware.nvidia.open` to select the proprietary or open driver.
+
 - `singularity-tools` have the `storeDir` argument removed from its override interface and use `builtins.storeDir` instead.
 
 - Two build helpers in `singularity-tools`, i.e., `mkLayer` and `shellScript`, are deprecated, as they are no longer involved in image-building. Maintainers will remove them in future releases.
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index ee8904da8572..8a8cd46cdf5a 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -254,10 +254,21 @@ in
         '';
       };
 
-      open = lib.mkEnableOption ''
-        the open source NVIDIA kernel module
+      open = lib.mkOption {
+        example = true;
+        description = "Whether to enable the open source NVIDIA kernel module.";
+        type = lib.types.bool;
+        defaultText = lib.literalExpression ''
+          lib.mkIf (lib.versionOlder config.hardware.nvidia.package.version "560") false
+        '';
+      };
+
+      gsp.enable = lib.mkEnableOption ''
+        the GPU System Processor (GSP) on the video card
       '' // {
-        defaultText = lib.literalExpression ''lib.versionAtLeast config.hardware.nvidia.package.version "560"'';
+        defaultText = lib.literalExpression ''
+          config.hardware.nvidia.open || lib.versionAtLeast config.hardware.nvidia.package.version "555"
+        '';
       };
     };
   };
@@ -308,7 +319,8 @@ in
           };
           environment.systemPackages = [ nvidia_x11.bin ];
 
-          hardware.nvidia.open = lib.mkDefault (lib.versionAtLeast nvidia_x11.version "560");
+          hardware.nvidia.open = lib.mkIf (lib.versionOlder nvidia_x11.version "560") (lib.mkDefault false);
+          hardware.nvidia.gsp.enable = lib.mkDefault (cfg.open || lib.versionAtLeast nvidia_x11.version "555");
         })
 
         # X11
@@ -367,8 +379,18 @@ in
             }
 
             {
-              assertion = cfg.open -> (cfg.package ? open && cfg.package ? firmware);
-              message = "This version of NVIDIA driver does not provide a corresponding opensource kernel driver";
+              assertion = cfg.gsp.enable -> (cfg.package ? firmware);
+              message = "This version of NVIDIA driver does not provide a GSP firmware.";
+            }
+
+            {
+              assertion = cfg.open -> (cfg.package ? open);
+              message = "This version of NVIDIA driver does not provide a corresponding opensource kernel driver.";
+            }
+
+            {
+              assertion = cfg.open -> cfg.gsp.enable;
+              message = "The GSP cannot be disabled when using the opensource kernel driver.";
             }
 
             {
@@ -555,7 +577,7 @@ in
 
           services.dbus.packages = lib.optional cfg.dynamicBoost.enable nvidia_x11.bin;
 
-          hardware.firmware = lib.optional (cfg.open || lib.versionAtLeast nvidia_x11.version "555") nvidia_x11.firmware;
+          hardware.firmware = lib.optional cfg.gsp.enable nvidia_x11.firmware;
 
           systemd.tmpfiles.rules =
             [
diff --git a/nixos/modules/services/audio/snapserver.nix b/nixos/modules/services/audio/snapserver.nix
index e624dacf34bf..7f781ee44e36 100644
--- a/nixos/modules/services/audio/snapserver.nix
+++ b/nixos/modules/services/audio/snapserver.nix
@@ -281,7 +281,7 @@ in {
       '') cfg.streams);
 
     systemd.services.snapserver = {
-      after = [ "network.target" ];
+      after = [ "network.target" "nss-lookup.target" ];
       description = "Snapserver";
       wantedBy = [ "multi-user.target" ];
       before = [ "mpd.service" "mopidy.service" ];
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index fb5d04f440b5..a9a9e7e5cce2 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -680,6 +680,7 @@ in {
   nix-config = handleTest ./nix-config.nix {};
   nix-ld = handleTest ./nix-ld.nix {};
   nix-misc = handleTest ./nix/misc.nix {};
+  nix-upgrade = handleTest ./nix/upgrade.nix {inherit (pkgs) nixVersions;};
   nix-required-mounts = runTest ./nix-required-mounts;
   nix-serve = handleTest ./nix-serve.nix {};
   nix-serve-ssh = handleTest ./nix-serve-ssh.nix {};
diff --git a/nixos/tests/kafka.nix b/nixos/tests/kafka.nix
index 8f843e1fc37d..5390e9d7f79f 100644
--- a/nixos/tests/kafka.nix
+++ b/nixos/tests/kafka.nix
@@ -105,6 +105,7 @@ let
 in with pkgs; {
   kafka_3_6 = makeKafkaTest "kafka_3_6" { kafkaPackage = apacheKafka_3_6; };
   kafka_3_7 = makeKafkaTest "kafka_3_7" { kafkaPackage = apacheKafka_3_7; };
+  kafka_3_8 = makeKafkaTest "kafka_3_8" { kafkaPackage = apacheKafka_3_8; };
   kafka = makeKafkaTest "kafka" { kafkaPackage = apacheKafka; };
   kafka_kraft = makeKafkaTest "kafka_kraft" { kafkaPackage = apacheKafka; mode = "kraft"; };
 }
diff --git a/nixos/tests/nix/upgrade.nix b/nixos/tests/nix/upgrade.nix
new file mode 100644
index 000000000000..c55441586b32
--- /dev/null
+++ b/nixos/tests/nix/upgrade.nix
@@ -0,0 +1,108 @@
+{ pkgs, nixVersions, ... }:
+let
+  lib = pkgs.lib;
+
+  fallback-paths-external = pkgs.writeTextDir "fallback-paths.nix" ''
+    {
+      ${pkgs.system} = "${nixVersions.latest}";
+    }'';
+
+  inputDrv = import ../.. {
+    configuration = {
+      imports = [ nixos-module ];
+      nix.package = nixVersions.latest;
+      boot.isContainer = true;
+
+      users.users.alice.isNormalUser = true;
+    };
+    system = pkgs.system;
+  };
+
+  nixos-module = builtins.toFile "nixos-module.nix" ''
+    { lib, pkgs, modulesPath, ... }:
+    {
+      imports = [
+        (modulesPath + "/profiles/minimal.nix")
+        (modulesPath + "/testing/test-instrumentation.nix")
+      ];
+
+      hardware.enableAllFirmware = lib.mkForce false;
+
+      nix.settings.substituters = lib.mkForce [];
+      nix.settings.hashed-mirrors = null;
+      nix.settings.connect-timeout = 1;
+      nix.extraOptions = "experimental-features = nix-command";
+
+      environment.localBinInPath = true;
+      users.users.alice = {
+        isNormalUser = true;
+        packages = [ pkgs.nixVersions.latest ];
+      };
+      documentation.enable = false;
+    }
+  '';
+in
+
+pkgs.testers.nixosTest {
+  name = "nix-upgrade-${nixVersions.stable.version}-${nixVersions.latest.version}";
+  meta.maintainers = with lib.maintainers; [ tomberek ];
+
+  nodes.machine = {
+    imports = [ nixos-module ];
+
+    nix.package = nixVersions.stable;
+    system.extraDependencies = [
+      fallback-paths-external
+      inputDrv.system
+    ];
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("nix-current"):
+        # Create a profile to pretend we are on non-NixOS
+
+        print(machine.succeed("nix --version"))
+        print(machine.succeed("nix-env -i /run/current-system/sw/bin/nix -p /root/.local"))
+
+    with subtest("nix-upgrade"):
+        print(machine.succeed("nix upgrade-nix --nix-store-paths-url file://${fallback-paths-external}/fallback-paths.nix --profile /root/.local"))
+        result = machine.succeed("nix --version")
+        print(result)
+
+        import re
+        match = re.match(r".*${nixVersions.latest.version}$",result)
+        if not match: raise Exception("Couldn't find new version in output: " + result)
+
+    with subtest("nix-build-with-mismatch-daemon"):
+        machine.succeed("runuser -u alice -- nix build --expr 'derivation {name =\"test\"; system = \"${pkgs.system}\";builder = \"/bin/sh\"; args = [\"-c\" \"echo test > $out\"];}' --print-out-paths")
+
+
+    with subtest("remove-new-nix"):
+        machine.succeed("rm -rf /root/.local")
+
+        result = machine.succeed("nix --version")
+        print(result)
+
+        import re
+        match = re.match(r".*${nixVersions.stable.version}$",result)
+
+    with subtest("upgrade-via-switch-to-configuration"):
+        # not using nixos-rebuild due to nix-instantiate being called and forcing all drv's to be rebuilt
+        print(machine.succeed("${inputDrv.system.outPath}/bin/switch-to-configuration switch"))
+        result = machine.succeed("nix --version")
+        print(result)
+
+        import re
+        match = re.match(r".*${nixVersions.latest.version}$",result)
+        if not match: raise Exception("Couldn't find new version in output: " + result)
+
+    with subtest("nix-build-with-new-daemon"):
+        machine.succeed("runuser -u alice -- nix build --expr 'derivation {name =\"test-new\"; system = \"${pkgs.system}\";builder = \"/bin/sh\"; args = [\"-c\" \"echo test > $out\"];}' --print-out-paths")
+
+    with subtest("nix-collect-garbage-with-old-nix"):
+        machine.succeed("${nixVersions.stable}/bin/nix-collect-garbage")
+  '';
+}
diff --git a/pkgs/applications/audio/keyfinder/default.nix b/pkgs/applications/audio/keyfinder/default.nix
deleted file mode 100644
index 24a72501db54..000000000000
--- a/pkgs/applications/audio/keyfinder/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ lib, mkDerivation, fetchFromGitHub, libav_0_8, libkeyfinder, qtbase, qtxmlpatterns, qmake, taglib }:
-
-mkDerivation rec {
-  pname = "keyfinder";
-  version = "2.4";
-
-  src = fetchFromGitHub {
-    sha256 = "11yhdwan7bz8nn8vxr54drckyrnlxynhx5s981i475bbccg8g7ls";
-    rev = "530034d6fe86d185f6a68b817f8db5f552f065d7"; # tag is missing
-    repo = "is_KeyFinder";
-    owner = "ibsh";
-  };
-
-  nativeBuildInputs = [ qmake ];
-  buildInputs = [ libav_0_8 libkeyfinder qtbase qtxmlpatterns taglib ];
-
-  postPatch = ''
-    substituteInPlace is_KeyFinder.pro \
-       --replace "-stdlib=libc++" "" \
-       --replace "\$\$[QT_INSTALL_PREFIX]" "$out"
-  '';
-
-  dontWrapQtApps = true;
-
-  meta = with lib; {
-    description = "Musical key detection for digital audio (graphical UI)";
-    longDescription = ''
-      KeyFinder is an open source key detection tool, for DJs interested in
-      harmonic and tonal mixing. Designed primarily for electronic and dance
-      music, it is highly configurable and can be applied to many genres. It
-      supports a huge range of codecs thanks to LibAV, and writes to metadata
-      tags using TagLib. It's intended to be very focused: no library
-      management, no track suggestions, no media player. Just a fast,
-      efficient workflow tool.
-    '';
-    homepage = "https://www.ibrahimshaath.co.uk/keyfinder/";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index b5fe818dfd9f..fe85fcf4b567 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1114,6 +1114,34 @@
     meta.homepage = "https://github.com/jose-elias-alvarez/minsnip.nvim/";
   };
 
+  moveline-nvim = let
+    version = "2024-07-25";
+    src = fetchFromGitHub {
+      owner = "willothy";
+      repo = "moveline.nvim";
+      rev = "9f67f4b9e752a87eea8205f0279f261a16c733d8";
+      sha256 = "sha256-B4t5+Q4Urx5bGm8glNpYkHhpp/rAhz+lDd2EpWFUYoY=";
+    };
+    moveline-lib = rustPlatform.buildRustPackage {
+      inherit src version;
+      pname = "moveline-lib";
+      cargoHash = "sha256-e9QB4Rfm+tFNrLAHN/nYUQ5PiTET8knQQIQkMH3UFkU=";
+    };
+  in buildVimPlugin {
+    inherit src version;
+    pname = "moveline-nvim";
+    preInstall = ''
+      mkdir -p lua
+      ln -s ${moveline-lib}/lib/libmoveline.so lua/moveline.so
+    '';
+    meta = {
+      description = "Neovim plugin for moving lines up and down";
+      homepage = "https://github.com/willothy/moveline.nvim";
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [ redxtech ];
+    };
+  };
+
   multicursors-nvim = super.multicursors-nvim.overrideAttrs {
     dependencies = with self; [ nvim-treesitter hydra-nvim ];
   };
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 1a45480cb3ee..7175287db1a0 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -49,13 +49,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-36";
+  version = "7.1.1-37";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-Y/tj8IAhsCFK7Yd0MXZ8X6AOLxICyVOIaSaQveMf17k=";
+    hash = "sha256-dlcyCJw/tytb6z5VaogblUlzBRYBtijUJbkX3vZdeEU=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
diff --git a/pkgs/applications/misc/tandoor-recipes/common.nix b/pkgs/applications/misc/tandoor-recipes/common.nix
index 7b0c1f3897d4..9d177a87d904 100644
--- a/pkgs/applications/misc/tandoor-recipes/common.nix
+++ b/pkgs/applications/misc/tandoor-recipes/common.nix
@@ -1,15 +1,15 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "1.5.16";
+  version = "1.5.19";
 
   src = fetchFromGitHub {
     owner = "TandoorRecipes";
     repo = "recipes";
     rev = version;
-    hash = "sha256-A5cPO3uybTmAV8zWY90S9vtU/tLgbh1Iqhi+ty0RLhM=";
+    hash = "sha256-HsBy2HzxBpnwh2RqFQJG0HYReWI0a7E7KsJ5TD+GokY=";
   };
 
-  yarnHash = "sha256-OAgVaXWTVlKqIgDgKNT1MWN3dYzTqrAGgNAnXLDHE+I=";
+  yarnHash = "sha256-BnOw9QRXRRoM+CW6OGbjWhLo4h6JX3ZR1kJd8Z/w02M=";
 
   meta = with lib; {
     homepage = "https://tandoor.dev/";
diff --git a/pkgs/applications/misc/tandoor-recipes/default.nix b/pkgs/applications/misc/tandoor-recipes/default.nix
index 489c1fefc7e7..b6d99325f120 100644
--- a/pkgs/applications/misc/tandoor-recipes/default.nix
+++ b/pkgs/applications/misc/tandoor-recipes/default.nix
@@ -165,8 +165,11 @@ python.pkgs.pythonPackages.buildPythonPackage rec {
 
   # flaky
   disabledTests = [
+    "test_add_duplicate"
+    "test_reset_inherit_space_fields"
     "test_search_count"
     "test_url_import_regex_replace"
+    "test_url_validator"
     "test_delete"
   ];
 
diff --git a/pkgs/applications/networking/browsers/librewolf/librewolf.nix b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
index d0f32f0dbe3f..46e9b1f77dd2 100644
--- a/pkgs/applications/networking/browsers/librewolf/librewolf.nix
+++ b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
@@ -33,9 +33,9 @@ rec {
     cat ${source}/patches/pref-pane/preferences.ftl >> browser/locales/en-US/browser/preferences/preferences.ftl
   '';
 
-  extraPrefsFiles = [ "${src.settings}/librewolf.cfg" ];
+  extraPrefsFiles = [ "${source}/settings/librewolf.cfg" ];
 
-  extraPoliciesFiles = [ "${src.settings}/distribution/policies.json" ];
+  extraPoliciesFiles = [ "${source}/settings/distribution/policies.json" ];
 
   extraPassthru = {
     librewolf = {
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 8fae46898abc..33f1e7d3b1cf 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -4,10 +4,6 @@
     "rev": "129.0.1-1",
     "sha256": "0pvv3v23q31hdjvqi1f3cqfyjrb8dbrrbfwxj2wacak1g0mzbxf4"
   },
-  "settings": {
-    "rev": "cbcf862e283669b49ecdf985d2d747eca9f4a794",
-    "sha256": "0aisg6l8xhk32wp8d9n532zgkk1nr4y4nsvqa9v8943g6vm4abb7"
-  },
   "firefox": {
     "version": "129.0.1",
     "sha512": "27c463e8277994c62bab85cf0e2f0cea16a9b272694b61fa56a6b3bd7c70d6481774288386094836a54df54c1b1144d61be67f4f5eac418c05479d452221c027"
diff --git a/pkgs/applications/networking/browsers/librewolf/src.nix b/pkgs/applications/networking/browsers/librewolf/src.nix
index 89e36dca8933..fd5b1aaa1f21 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.nix
+++ b/pkgs/applications/networking/browsers/librewolf/src.nix
@@ -10,12 +10,6 @@ in
     fetchSubmodules = true;
     inherit (src.source) rev sha256;
   };
-  settings = fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "librewolf";
-    repo = "settings";
-    inherit (src.settings) rev sha256;
-  };
   firefox = fetchurl {
     url =
       "mirror://mozilla/firefox/releases/${src.firefox.version}/source/firefox-${src.firefox.version}.source.tar.xz";
diff --git a/pkgs/applications/networking/browsers/librewolf/update.nix b/pkgs/applications/networking/browsers/librewolf/update.nix
index 147d7558dccd..f614509fba28 100644
--- a/pkgs/applications/networking/browsers/librewolf/update.nix
+++ b/pkgs/applications/networking/browsers/librewolf/update.nix
@@ -57,18 +57,9 @@ writeScript "update-librewolf" ''
   ffHash=$(grep '\.source\.tar\.xz$' "$HOME"/shasums | grep '^[^ ]*' -o)
   echo "ffHash=$ffHash"
 
-  # upstream does not specify settings rev, so just get the latest. see https://github.com/NixOS/nixpkgs/issues/252276
-  settingsRev=$(curl 'https://codeberg.org/api/v1/repos/librewolf/settings/commits?sha=master&limit=1' | jq -r .[0].sha)
-  echo "settingsRev=$settingsRev"
-  repoUrl=https://codeberg.org/librewolf/settings
-  nix-prefetch-git $repoUrl --quiet --rev $settingsRev > $prefetchOut
-  settingsSha256=$(jq -r .sha256 < $prefetchOut)
-
   jq ".source.rev = \"$latestTag\"" $srcJson | sponge $srcJson
   jq ".source.sha256 = \"$srcHash\"" $srcJson | sponge $srcJson
   jq ".firefox.version = \"$ffVersion\"" $srcJson | sponge $srcJson
   jq ".firefox.sha512 = \"$ffHash\"" $srcJson | sponge $srcJson
   jq ".packageVersion = \"$lwVersion\"" $srcJson | sponge $srcJson
-  jq ".settings.rev = \"$settingsRev\"" $srcJson | sponge $srcJson
-  jq ".settings.sha256 = \"$settingsSha256\"" $srcJson | sponge $srcJson
 ''
diff --git a/pkgs/applications/office/libreoffice/0001-Strip-away-BUILDCONFIG.patch b/pkgs/applications/office/libreoffice/0001-Strip-away-BUILDCONFIG.patch
deleted file mode 100644
index b477f902b2fb..000000000000
--- a/pkgs/applications/office/libreoffice/0001-Strip-away-BUILDCONFIG.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 982d38084f08950863b55043f36ce5548bd73635 Mon Sep 17 00:00:00 2001
-From: Maximilian Bosch <maximilian@mbosch.me>
-Date: Mon, 24 Jul 2023 19:12:25 +0200
-Subject: [PATCH] Strip away BUILDCONFIG
-
-The `BuildConfig` field in `libsofficeapp.so` includes the entire
-`PKG_CONFIG_PATH` and subsequently references to a lot of `dev` outputs
-of library dependencies blowing up the closure.
-
-Since this is not strictly needed and the inputs are comprehensible via
-`nix derivation show`, this doesn't bring a real benefit in the case of
-nixpkgs anyways.
----
- desktop/source/lib/init.cxx | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/desktop/source/lib/init.cxx b/desktop/source/lib/init.cxx
-index 8d830c0cbd00..fbdc86aa7115 100644
---- a/desktop/source/lib/init.cxx
-+++ b/desktop/source/lib/init.cxx
-@@ -7097,7 +7097,7 @@ static char* lo_getVersionInfo(SAL_UNUSED_PARAMETER LibreOfficeKit* /*pThis*/)
-         "\"ProductVersion\": \"%PRODUCTVERSION\", "
-         "\"ProductExtension\": \"%PRODUCTEXTENSION\", "
-         "\"BuildId\": \"%BUILDID\", "
--        "\"BuildConfig\": \""  BUILDCONFIG  "\" "
-+        "\"BuildConfig\": \"removed to avoid runtime dependencies against dev outputs of each dependency. Use 'nix derivation show' against the package to find out details about BuildConfig.\" "
-         "}"));
- }
- 
--- 
-2.40.1
-
diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index d5d48219beb7..656a79e87c8d 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -118,6 +118,7 @@
 , amiri
 , caladea
 , carlito
+, culmus
 , dejavu_fonts
 , rubik
 , liberation-sans-narrow
@@ -126,6 +127,10 @@
 , libertine-g
 , noto-fonts
 , noto-fonts-cjk-sans
+, rhino
+, lp_solve
+, xmlsec
+, libcmis
 # The rest are used only in passthru, for the wrapper
 , kauth ? null
 , kcompletion ? null
@@ -138,6 +143,7 @@
 , kxmlgui ? null
 , phonon ? null
 , qtdeclarative ? null
+, qtmultimedia ? null
 , qtquickcontrols ? null
 , qtsvg ? null
 , qttools ? null
@@ -152,13 +158,14 @@ let
     flatten flip
     concatMapStrings concatStringsSep
     getDev getLib
-    optionals optionalAttrs optionalString;
+    optionals optionalString;
 
   fontsConf = makeFontsConf {
     fontDirectories = [
       amiri
       caladea
       carlito
+      culmus
       dejavu_fonts
       rubik
       liberation-sans-narrow
@@ -211,6 +218,7 @@ let
     name = "libreoffice-kde-dependencies-${version}";
     paths = flatten (map (e: [ (getDev e) (getLib e) ]) [
       qtbase
+      qtmultimedia
       qtx11extras
       kconfig
       kcoreaddons
@@ -249,29 +257,24 @@ in stdenv.mkDerivation (finalAttrs: {
   patches = [
     # Skip some broken tests:
     # - tdf160386 does not fall back to a CJK font properly for some reason
-    # - the remaining tests have notes in the patch
+    # - the remaining tests have notes in the patches
     # FIXME: get rid of this ASAP
     ./skip-broken-tests.patch
+    (./skip-broken-tests- + variant + ".patch")
+
+    # Don't detect Qt paths from qmake, so our patched-in onese are used
+    ./dont-detect-qt-paths-from-qmake.patch
+
+    # Revert part of https://github.com/LibreOffice/core/commit/6f60670877208612b5ea320b3677480ef6508abb that broke zlib linking
+    ./readd-explicit-zlib-link.patch
+  ] ++ lib.optionals (lib.versionOlder version "24.8") [
     (fetchpatch2 {
       name = "icu74-compat.patch";
       url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-fresh/-/raw/main/libreoffice-7.5.8.2-icu-74-compatibility.patch?ref_type=heads.patch";
       hash = "sha256-OGBPIVQj8JTYlkKywt4QpH7ULAzKmet5jTLztGpIS0Y=";
     })
-  ] ++ lib.optionals (variant == "still") [
-    # Remove build config to reduce the amount of `-dev` outputs in the
-    # runtime closure. This behavior was introduced by upstream in commit
-    # cbfac11330882c7d0a817b6c37a08b2ace2b66f4
-    ./0001-Strip-away-BUILDCONFIG.patch
-    # See above
-    ./skip-broken-tests-still.patch
-  ] ++ lib.optionals (variant == "fresh" || variant == "collabora") [
-    # Revert part of https://github.com/LibreOffice/core/commit/6f60670877208612b5ea320b3677480ef6508abb that broke zlib linking
-    ./readd-explicit-zlib-link.patch
-    # See above
-    ./skip-broken-tests-fresh.patch
   ] ++ lib.optionals (variant == "collabora") [
     ./fix-unpack-collabora.patch
-    ./skip-broken-tests-collabora.patch
   ];
 
   postPatch = ''
@@ -353,6 +356,7 @@ in stdenv.mkDerivation (finalAttrs: {
     libargon2
     libatomic_ops
     libcdr
+    libcmis
     libe-book
     libepoxy
     libepubgen
@@ -379,6 +383,7 @@ in stdenv.mkDerivation (finalAttrs: {
     libxslt
     libzmf
     libwebp
+    lp_solve
     mdds
     mythes
     ncurses
@@ -397,6 +402,7 @@ in stdenv.mkDerivation (finalAttrs: {
     unzip
     util-linux
     which
+    xmlsec
     zip
     zlib
   ] ++ optionals kdeIntegration [
@@ -456,18 +462,6 @@ in stdenv.mkDerivation (finalAttrs: {
     "--enable-release-build"
     "--enable-epm"
     "--with-ant-home=${getLib ant}/lib/ant"
-    "--with-system-cairo"
-    "--with-system-libs"
-    "--with-system-headers"
-    "--with-system-openssl"
-    "--with-system-libabw"
-    "--with-system-liblangtag"
-    "--without-system-libcmis"
-    "--with-system-libwps"
-    "--with-system-mdds"
-    "--with-system-openldap"
-    "--with-system-coinmp"
-    "--with-system-postgresql"
 
     # Without these, configure does not finish
     "--without-junit"
@@ -486,12 +480,28 @@ in stdenv.mkDerivation (finalAttrs: {
     (lib.withFeature withFonts "fonts")
     "--without-doxygen"
 
-    # TODO: package these as system libraries
     "--with-system-beanshell"
-    "--without-system-hsqldb"
+    "--with-system-cairo"
+    "--with-system-coinmp"
+    "--with-system-headers"
+    "--with-system-libabw"
+    "--with-system-libcmis"
+    "--with-system-libepubgen"
+    "--with-system-libetonyek"
+    "--with-system-liblangtag"
+    "--with-system-libs"
+    "--with-system-libwps"
+    "--with-system-lpsolve"
+    "--with-system-mdds"
+    "--with-system-openldap"
+    "--with-system-openssl"
+    "--with-system-orcus"
+    "--with-system-postgresql"
+    "--with-system-xmlsec"
+
+    # TODO: package these as system libraries
     "--without-system-altlinuxhyph"
     "--without-system-frozen"
-    "--without-system-lpsolve"
     "--without-system-libfreehand"
     "--without-system-libmspub"
     "--without-system-libnumbertext"
@@ -501,20 +511,26 @@ in stdenv.mkDerivation (finalAttrs: {
     "--without-system-dragonbox"
     "--without-system-libfixmath"
 
+    # requires an oddly specific, old version
+    "--without-system-hsqldb"
+
+    # searches hardcoded paths that are wrong
+    "--without-system-zxing"
+
     # is packaged but headers can't be found because there is no pkg-config file
     "--without-system-zxcvbn"
-
-    "--with-system-orcus"
-    "--with-system-libepubgen"
-    "--with-system-libetonyek"
-    "--without-system-xmlsec"
-    "--without-system-zxing"
   ] ++ optionals kdeIntegration [
     "--enable-kf${qtMajor}"
     "--enable-qt${qtMajor}"
   ] ++ optionals (kdeIntegration && qtMajor == "5") [
     "--enable-gtk3-kde5"
-  ];
+  ] ++ (if variant == "fresh" then [
+    "--with-system-rhino"
+    "--with-rhino-jar=${rhino}/share/java/js.jar"
+  ] else [
+    # our Rhino is too new for older versions
+    "--without-system-rhino"
+  ]);
 
 
   env = {
@@ -598,6 +614,7 @@ in stdenv.mkDerivation (finalAttrs: {
       ki18n
       knotifications
       qtdeclarative
+      qtmultimedia
       qtquickcontrols
       qtwayland
       solid
@@ -618,6 +635,7 @@ in stdenv.mkDerivation (finalAttrs: {
       phonon
       qtbase
       qtdeclarative
+      qtmultimedia
       qtsvg
       qttools
       qtwayland
diff --git a/pkgs/applications/office/libreoffice/dont-detect-qt-paths-from-qmake.patch b/pkgs/applications/office/libreoffice/dont-detect-qt-paths-from-qmake.patch
new file mode 100644
index 000000000000..6be6598cfd3f
--- /dev/null
+++ b/pkgs/applications/office/libreoffice/dont-detect-qt-paths-from-qmake.patch
@@ -0,0 +1,22 @@
+diff --git a/configure.ac b/configure.ac
+index 2c11703cb3ff..302a006bbf75 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -13444,8 +13444,6 @@ then
+         fi
+     fi
+ 
+-    qt5_incdirs="`$QMAKE5 -query QT_INSTALL_HEADERS` $qt5_incdirs"
+-    qt5_libdirs="`$QMAKE5 -query QT_INSTALL_LIBS` $qt5_libdirs"
+     qt5_platformsdir="`$QMAKE5 -query QT_INSTALL_PLUGINS`/platforms"
+     QT5_PLATFORMS_SRCDIR="$qt5_platformsdir"
+ 
+@@ -13585,8 +13583,6 @@ then
+         AC_MSG_NOTICE([Detected Qt6 version: $qmake6_test_ver])
+     fi
+ 
+-    qt6_incdirs="`$QMAKE6 -query QT_INSTALL_HEADERS` $qt6_incdirs"
+-    qt6_libdirs="`$QMAKE6 -query QT_INSTALL_LIBS` $qt6_libdirs"
+     qt6_platformsdir="`$QMAKE6 -query QT_INSTALL_PLUGINS`/platforms"
+     QT6_PLATFORMS_SRCDIR="$qt6_platformsdir"
+ 
diff --git a/pkgs/applications/office/libreoffice/skip-broken-tests-collabora.patch b/pkgs/applications/office/libreoffice/skip-broken-tests-collabora.patch
index 4fcb5585d72b..f162d7c407f4 100644
--- a/pkgs/applications/office/libreoffice/skip-broken-tests-collabora.patch
+++ b/pkgs/applications/office/libreoffice/skip-broken-tests-collabora.patch
@@ -10,31 +10,44 @@
  	CppunitTest_sc_tiledrendering2 \
  ))
  endif
+--- a/sc/qa/extras/vba-macro-test.cxx
++++ b/sc/qa/extras/vba-macro-test.cxx
+@@ -364,7 +364,7 @@ CPPUNIT_TEST_FIXTURE(VBAMacroTest, testVba)
+ // Failed:  : Test change event for Range.FillRight:
+ // Tests passed: 4
+ // Tests failed: 4
+-#if !defined(_WIN32)
++#if 0 // flaky, see above
+         { OUString("Ranges-3.xls"),
+           OUString(
+               "vnd.sun.Star.script:VBAProject.testMacros.test?language=Basic&location=document") },
+--- a/sc/qa/unit/ucalc_formula.cxx
++++ b/sc/qa/unit/ucalc_formula.cxx
+@@ -1507,6 +1507,8 @@ CPPUNIT_TEST_FIXTURE(TestFormula, testFormulaAnnotateTrimOnDoubleRefs)
+ 
+ CPPUNIT_TEST_FIXTURE(TestFormula, testFormulaRefUpdate)
+ {
++    return; // fails consistently on nixpkgs?
++
+     m_pDoc->InsertTab(0, "Formula");
+ 
+     sc::AutoCalcSwitch aACSwitch(*m_pDoc, true); // turn auto calc on.
 --- a/sw/qa/extras/tiledrendering/tiledrendering.cxx
 +++ b/sw/qa/extras/tiledrendering/tiledrendering.cxx
 @@ -2948,6 +2948,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testHighlightNumbering_shd)
  
  CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testPilcrowRedlining)
  {
-+    return;
++    return; // flaky
 +
      // Load a document where the top left tile contains
      // paragraph and line break symbols with redlining.
      SwXTextDocument* pXTextDocument = createDoc("pilcrow-redlining.fodt");
-@@ -3057,6 +3059,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testDoubleUnderlineAndStrikeOut)
- 
- CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testTdf43244_SpacesOnMargin)
- {
-+    return;
-+
-     // Load a document where the top left tile contains
-     // paragraph and line break symbols with redlining.
-     SwXTextDocument* pXTextDocument = createDoc("tdf43244_SpacesOnMargin.odt");
 @@ -4100,6 +4104,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testRedlineTooltip)
  // toggling Formatting Marks on/off for one view should have no effect on other views
  CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testToggleFormattingMarks)
  {
-+    return;
++    return; // fails consistently
 +
      SwXTextDocument* pXTextDocument = createDoc();
      int nView1 = SfxLokHelper::getView();
@@ -45,7 +58,7 @@
  
  CPPUNIT_TEST_FIXTURE(VclComplexTextTest, testTdf107718)
  {
-+    return;
++    return; // fails to find the font
 +
  #if HAVE_MORE_FONTS
  #if !defined _WIN32 // TODO: Fails on jenkins but passes locally
diff --git a/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch b/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch
index d1971cfde4ba..7b6d1d90f3e9 100644
--- a/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch
+++ b/pkgs/applications/office/libreoffice/skip-broken-tests-fresh.patch
@@ -1,21 +1,93 @@
---- a/svgio/qa/cppunit/data/tdf160386.svg
-+++ b/svgio/qa/cppunit/data/tdf160386.svg
-@@ -8,7 +8,6 @@
-     <text systemLanguage="en">Hello!</text>
-     <text systemLanguage="es">Hola!</text>
-     <text systemLanguage="fr">Bonjour!</text>
--    <text systemLanguage="ja">こんにちは</text>
-     <text systemLanguage="ru">Привет!</text>
-     <text>☺</text>
-   </switch>
---- a/sw/qa/core/text/text.cxx
-+++ b/sw/qa/core/text/text.cxx
-@@ -1577,6 +1577,8 @@ CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testParaUpperMarginFlyIntersect)
+--- a/sc/Module_sc.mk
++++ b/sc/Module_sc.mk
+@@ -69,8 +69,8 @@ endif
  
- CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testTdf129810)
+ ifneq ($(DISABLE_GUI),TRUE)
+ ifeq ($(OS),LINUX)
++# CppunitTest_sc_tiledrendering hangs
+ $(eval $(call gb_Module_add_check_targets,sc,\
+-	CppunitTest_sc_tiledrendering \
+ 	CppunitTest_sc_tiledrendering2 \
+ ))
+ endif
+--- a/sc/qa/extras/vba-macro-test.cxx
++++ b/sc/qa/extras/vba-macro-test.cxx
+@@ -364,7 +364,7 @@ CPPUNIT_TEST_FIXTURE(VBAMacroTest, testVba)
+ // Failed:  : Test change event for Range.FillRight:
+ // Tests passed: 4
+ // Tests failed: 4
+-#if !defined(_WIN32)
++#if 0 // flaky, see above
+         { u"Ranges-3.xls"_ustr,
+           u"vnd.sun.Star.script:VBAProject.testMacros.test?language=Basic&location=document"_ustr },
+ #endif
+--- a/sc/qa/unit/ucalc_formula.cxx
++++ b/sc/qa/unit/ucalc_formula.cxx
+@@ -1507,6 +1507,8 @@ CPPUNIT_TEST_FIXTURE(TestFormula, testFormulaAnnotateTrimOnDoubleRefs)
+ 
+ CPPUNIT_TEST_FIXTURE(TestFormula, testFormulaRefUpdate)
  {
-+    return; // flaky?
++    return; // fails consistently on nixpkgs?
 +
-     // Load the document.
-     // The document embeds a subset of "Source Han Serif SC" so that it works
-     // even when the font is not installed.
+     m_pDoc->InsertTab(0, u"Formula"_ustr);
+ 
+     sc::AutoCalcSwitch aACSwitch(*m_pDoc, true); // turn auto calc on.
+--- a/sw/qa/extras/layout/layout3.cxx
++++ b/sw/qa/extras/layout/layout3.cxx
+@@ -3039,6 +3041,9 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf104209VertRTL)
+
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408LTR)
+ {
++    return; // requests Noto Sans Hebrew with charset=28, which the font does not have
++            // FIXME: investigate
++
+     // Verify that line breaking a first bidi portion correctly underflows in LTR text
+     createSwDoc("tdf56408-ltr.fodt");
+     auto pXmlDoc = parseLayoutDump();
+@@ -3053,6 +3058,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408LTR)
+
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408RTL)
+ {
++    return; // same Noto Sans Hebrew issue
++
+     // Verify that line breaking a first bidi portion correctly underflows in RTL text
+     createSwDoc("tdf56408-rtl.fodt");
+     auto pXmlDoc = parseLayoutDump();
+@@ -3083,6 +3090,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408NoUnderflow)
+
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf56408AfterFieldCrash)
+ {
++    return; // same Noto Sans Hebrew issue
++
+     // Verify there is no crash/assertion for underflow after a number field
+     createSwDoc("tdf56408-after-field.fodt");
+ }
+@@ -3121,6 +3130,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf146081)
+
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf157829LTR)
+ {
++    return; // same Noto Sans Hebrew issue
++
+     // Verify that line breaking inside a bidi portion triggers underflow to previous bidi portions
+     createSwDoc("tdf157829-ltr.fodt");
+     auto pXmlDoc = parseLayoutDump();
+@@ -3135,6 +3146,8 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf157829LTR)
+
+ CPPUNIT_TEST_FIXTURE(SwLayoutWriter3, TestTdf157829RTL)
+ {
++    return; // same Noto Sans Hebrew issue
++
+     // Verify that line breaking inside a bidi portion triggers underflow to previous bidi portions
+     createSwDoc("tdf157829-rtl.fodt");
+     auto pXmlDoc = parseLayoutDump();
+--- a/sw/qa/extras/tiledrendering/tiledrendering.cxx
++++ b/sw/qa/extras/tiledrendering/tiledrendering.cxx
+@@ -4230,6 +4232,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testRedlineTooltip)
+ // toggling Formatting Marks on/off for one view should have no effect on other views
+ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testToggleFormattingMarks)
+ {
++    return; // fails consistently
++
+     SwXTextDocument* pXTextDocument = createDoc();
+     int nView1 = SfxLokHelper::getView();
+
diff --git a/pkgs/applications/office/libreoffice/skip-broken-tests-still.patch b/pkgs/applications/office/libreoffice/skip-broken-tests-still.patch
index 24a813a1ac51..e7064d108552 100644
--- a/pkgs/applications/office/libreoffice/skip-broken-tests-still.patch
+++ b/pkgs/applications/office/libreoffice/skip-broken-tests-still.patch
@@ -1,11 +1,69 @@
---- a/sw/qa/core/text/text.cxx
-+++ b/sw/qa/core/text/text.cxx
-@@ -1369,6 +1369,8 @@ CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testParaUpperMarginFlyIntersect)
+--- a/sc/qa/extras/vba-macro-test.cxx
++++ b/sc/qa/extras/vba-macro-test.cxx
+@@ -364,7 +364,7 @@ CPPUNIT_TEST_FIXTURE(VBAMacroTest, testVba)
+ // Failed:  : Test change event for Range.FillRight:
+ // Tests passed: 4
+ // Tests failed: 4
+-#if !defined(_WIN32)
++#if 0 // flaky, see above
+         { OUString("Ranges-3.xls"),
+           OUString(
+               "vnd.sun.Star.script:VBAProject.testMacros.test?language=Basic&location=document") },
+--- a/sc/qa/unit/ucalc_formula.cxx
++++ b/sc/qa/unit/ucalc_formula.cxx
+@@ -1507,6 +1507,8 @@ CPPUNIT_TEST_FIXTURE(TestFormula, testFormulaAnnotateTrimOnDoubleRefs)
  
- CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testTdf129810)
+ CPPUNIT_TEST_FIXTURE(TestFormula, testFormulaRefUpdate)
  {
-+    return; // flaky?
++    return; // fails consistently on nixpkgs?
 +
-     // Load the document, which embeds a CJK font.
-     createSwDoc("tdf129810.odt");
+     m_pDoc->InsertTab(0, "Formula");
  
+     sc::AutoCalcSwitch aACSwitch(*m_pDoc, true); // turn auto calc on.
+--- a/sw/qa/extras/tiledrendering/tiledrendering.cxx
++++ b/sw/qa/extras/tiledrendering/tiledrendering.cxx
+@@ -685,6 +685,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testSearchAll)
+
+ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testSearchAllNotifications)
+ {
++    return; // flaky on GTK
++
+     SwXTextDocument* pXTextDocument = createDoc("search.odt");
+     SwWrtShell* pWrtShell = pXTextDocument->GetDocShell()->GetWrtShell();
+     setupLibreOfficeKitViewCallback(pWrtShell->GetSfxViewShell());
+@@ -949,6 +951,8 @@ namespace {
+
+ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testMissingInvalidation)
+ {
++    return; // flaky on GTK
++
+     // Create two views.
+     SwXTextDocument* pXTextDocument = createDoc("dummy.fodt");
+     ViewCallback aView1;
+@@ -982,6 +986,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testMissingInvalidation)
+
+ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testViewCursors)
+ {
++    return; // flaky on GTK
++
+     SwXTextDocument* pXTextDocument = createDoc("dummy.fodt");
+     ViewCallback aView1;
+     SfxLokHelper::createView();
+@@ -3189,6 +3189,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testRedlineNotificationDuringSave)
+
+ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testHyperlink)
+ {
++    return; // flaky on GTK
++
+     comphelper::LibreOfficeKit::setViewIdForVisCursorInvalidation(true);
+     SwXTextDocument* pXTextDocument = createDoc("hyperlink.odt");
+     SwWrtShell* pWrtShell = pXTextDocument->GetDocShell()->GetWrtShell();
+@@ -3399,6 +3401,8 @@ static void lcl_extractHandleParameters(std::string_view selection, sal_Int32& i
+
+ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testMoveShapeHandle)
+ {
++    return; // flaky on GTK
++
+     comphelper::LibreOfficeKit::setActive();
+     SwXTextDocument* pXTextDocument = createDoc("shape.fodt");
+
diff --git a/pkgs/applications/office/libreoffice/skip-broken-tests.patch b/pkgs/applications/office/libreoffice/skip-broken-tests.patch
index aad3660b1819..3f45a7cda9db 100644
--- a/pkgs/applications/office/libreoffice/skip-broken-tests.patch
+++ b/pkgs/applications/office/libreoffice/skip-broken-tests.patch
@@ -18,28 +18,16 @@
      LibLibreOffice_Impl aOffice;
      LibLODocument_Impl* pDocument = loadDoc("search.ods");
      pDocument->pClass->initializeForRendering(pDocument, nullptr);
---- a/sc/qa/extras/vba-macro-test.cxx
-+++ b/sc/qa/extras/vba-macro-test.cxx
-@@ -364,7 +364,7 @@ CPPUNIT_TEST_FIXTURE(VBAMacroTest, testVba)
- // Failed:  : Test change event for Range.FillRight:
- // Tests passed: 4
- // Tests failed: 4
--#if !defined(_WIN32)
-+#if 0 // flaky, see above
-         { OUString("Ranges-3.xls"),
-           OUString(
-               "vnd.sun.Star.script:VBAProject.testMacros.test?language=Basic&location=document") },
---- a/sc/qa/unit/ucalc_formula.cxx
-+++ b/sc/qa/unit/ucalc_formula.cxx
-@@ -1507,6 +1507,8 @@ CPPUNIT_TEST_FIXTURE(TestFormula, testFormulaAnnotateTrimOnDoubleRefs)
- 
- CPPUNIT_TEST_FIXTURE(TestFormula, testFormulaRefUpdate)
- {
-+    return; // fails consistently on nixpkgs?
-+
-     m_pDoc->InsertTab(0, "Formula");
- 
-     sc::AutoCalcSwitch aACSwitch(*m_pDoc, true); // turn auto calc on.
+--- a/svgio/qa/cppunit/data/tdf160386.svg
++++ b/svgio/qa/cppunit/data/tdf160386.svg
+@@ -8,7 +8,6 @@
+     <text systemLanguage="en">Hello!</text>
+     <text systemLanguage="es">Hola!</text>
+     <text systemLanguage="fr">Bonjour!</text>
+-    <text systemLanguage="ja">こんにちは</text>
+     <text systemLanguage="ru">Привет!</text>
+     <text>☺</text>
+   </switch>
 --- a/sw/qa/core/accessibilitycheck/AccessibilityCheckTest.cxx
 +++ b/sw/qa/core/accessibilitycheck/AccessibilityCheckTest.cxx
 @@ -284,6 +284,8 @@ void checkIssuePosition(std::shared_ptr<sfx::AccessibilityIssue> const& pIssue,
@@ -51,6 +39,17 @@
      // Checks the a11y checker is setting the a11y issues to the nodes
      // correctly when splitting and appending nodes (through undo), which
      // happen on editing all the time.
+--- a/sw/qa/core/text/text.cxx
++++ b/sw/qa/core/text/text.cxx
+@@ -1577,6 +1577,8 @@ CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testParaUpperMarginFlyIntersect)
+ 
+ CPPUNIT_TEST_FIXTURE(SwCoreTextTest, testTdf129810)
+ {
++    return; // flaky?
++
+     // Load the document.
+     // The document embeds a subset of "Source Han Serif SC" so that it works
+     // even when the font is not installed.
 --- a/sw/qa/extras/htmlimport/htmlimport.cxx
 +++ b/sw/qa/extras/htmlimport/htmlimport.cxx
 @@ -306,6 +306,8 @@ CPPUNIT_TEST_FIXTURE(HtmlImportTest, testTableBorder1px)
@@ -95,6 +94,15 @@
      SwXTextDocument* pXTextDocument = createDoc("dummy.fodt");
      ViewCallback aView1;
      int nView1 = SfxLokHelper::getView();
+@@ -3187,6 +3187,8 @@ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testDoubleUnderlineAndStrikeOut)
+
+ CPPUNIT_TEST_FIXTURE(SwTiledRenderingTest, testTdf43244_SpacesOnMargin)
+ {
++    return; // fails consistently
++
+     // Load a document where the top left tile contains
+     // paragraph and line break symbols with redlining.
+     SwXTextDocument* pXTextDocument = createDoc("tdf43244_SpacesOnMargin.odt");
 --- a/sw/qa/extras/uiwriter/uiwriter5.cxx
 +++ b/sw/qa/extras/uiwriter/uiwriter5.cxx
 @@ -1613,6 +1613,8 @@ CPPUNIT_TEST_FIXTURE(SwUiWriterTest5, testDateFormFieldCurrentDateHandling)
diff --git a/pkgs/applications/office/libreoffice/src-fresh/deps.nix b/pkgs/applications/office/libreoffice/src-fresh/deps.nix
index d9ef29364fc8..38354245ba1e 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/deps.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/deps.nix
@@ -14,11 +14,11 @@
     md5name = "daf972a89577f8772602bf2eb38b6a3dd3d922bf5724d45e7f9589b5e830442c-phc-winner-argon2-20190702.tar.gz";
   }
   {
-    name = "boost_1_82_0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/boost_1_82_0.tar.xz";
-    sha256 = "e48ab6953fbd68ba47234bea5173e62427e9f6a7894e152305142895cfe955de";
+    name = "boost_1_85_0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/boost_1_85_0.tar.xz";
+    sha256 = "4e23218ff5036d57afd20f7cdab2e94cdbf6ba9c509d656ace643a81c40a985a";
     md5 = "";
-    md5name = "e48ab6953fbd68ba47234bea5173e62427e9f6a7894e152305142895cfe955de-boost_1_82_0.tar.xz";
+    md5name = "4e23218ff5036d57afd20f7cdab2e94cdbf6ba9c509d656ace643a81c40a985a-boost_1_85_0.tar.xz";
   }
   {
     name = "box2d-2.4.1.tar.gz";
@@ -35,11 +35,11 @@
     md5name = "c44a2e898895cfc13b42d2371ba4b88b0777d7782214d6cdc91c33720f3b0d91-breakpad-b324760c7f53667af128a6b77b790323da04fcb9.tar.xz";
   }
   {
-    name = "bsh-2.0b6-src.zip";
-    url = "https://dev-www.libreoffice.org/src/beeca87be45ec87d241ddd0e1bad80c1-bsh-2.0b6-src.zip";
-    sha256 = "9e93c73e23aff644b17dfff656444474c14150e7f3b38b19635e622235e01c96";
-    md5 = "beeca87be45ec87d241ddd0e1bad80c1";
-    md5name = "beeca87be45ec87d241ddd0e1bad80c1-bsh-2.0b6-src.zip";
+    name = "bsh-2.1.1-src.zip";
+    url = "https://dev-www.libreoffice.org/src/bsh-2.1.1-src.zip";
+    sha256 = "2248387ceaa319840434a3547a8b2fec12f95a8418ee039ce5ff5726053a139c";
+    md5 = "";
+    md5name = "2248387ceaa319840434a3547a8b2fec12f95a8418ee039ce5ff5726053a139c-bsh-2.1.1-src.zip";
   }
   {
     name = "bzip2-1.0.8.tar.gz";
@@ -84,11 +84,11 @@
     md5name = "0082d0684f7db6f62361b76c4b7faba19e0c7ce5cb8e36c4b65fea8281e711b4-dtoa-20180411.tgz";
   }
   {
-    name = "libcmis-0.6.1.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libcmis-0.6.1.tar.xz";
-    sha256 = "d54d19d86153dbc88e2d468f7136269a2cfe71b73227e12fded01d29ac268074";
+    name = "libcmis-0.6.2.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libcmis-0.6.2.tar.xz";
+    sha256 = "1b5c2d7258ff93eb5f9958ff0e4dfd7332dc75a071bb717dde2217a26602a644";
     md5 = "";
-    md5name = "d54d19d86153dbc88e2d468f7136269a2cfe71b73227e12fded01d29ac268074-libcmis-0.6.1.tar.xz";
+    md5name = "1b5c2d7258ff93eb5f9958ff0e4dfd7332dc75a071bb717dde2217a26602a644-libcmis-0.6.2.tar.xz";
   }
   {
     name = "CoinMP-1.8.4.tgz";
@@ -105,11 +105,11 @@
     md5name = "89c5c6665337f56fd2db36bc3805a5619709d51fb136e51937072f63fcc717a7-cppunit-1.15.1.tar.gz";
   }
   {
-    name = "curl-8.7.1.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/curl-8.7.1.tar.xz";
-    sha256 = "6fea2aac6a4610fbd0400afb0bcddbe7258a64c63f1f68e5855ebc0c659710cd";
+    name = "curl-8.9.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/curl-8.9.0.tar.xz";
+    sha256 = "ff09b2791ca56d25fd5c3f3a4927dce7c8a9dc4182200c487ca889fba1fdd412";
     md5 = "";
-    md5name = "6fea2aac6a4610fbd0400afb0bcddbe7258a64c63f1f68e5855ebc0c659710cd-curl-8.7.1.tar.xz";
+    md5name = "ff09b2791ca56d25fd5c3f3a4927dce7c8a9dc4182200c487ca889fba1fdd412-curl-8.9.0.tar.xz";
   }
   {
     name = "libe-book-0.1.3.tar.xz";
@@ -161,11 +161,11 @@
     md5name = "acb85cedafa10ce106b1823fb236b1b3e5d942a5741e8f8435cc8ccfec0afe76-Firebird-3.0.7.33374-0.tar.bz2";
   }
   {
-    name = "fontconfig-2.14.2.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/fontconfig-2.14.2.tar.xz";
-    sha256 = "dba695b57bce15023d2ceedef82062c2b925e51f5d4cc4aef736cf13f60a468b";
+    name = "fontconfig-2.15.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/fontconfig-2.15.0.tar.xz";
+    sha256 = "63a0658d0e06e0fa886106452b58ef04f21f58202ea02a94c39de0d3335d7c0e";
     md5 = "";
-    md5name = "dba695b57bce15023d2ceedef82062c2b925e51f5d4cc4aef736cf13f60a468b-fontconfig-2.14.2.tar.xz";
+    md5name = "63a0658d0e06e0fa886106452b58ef04f21f58202ea02a94c39de0d3335d7c0e-fontconfig-2.15.0.tar.xz";
   }
   {
     name = "crosextrafonts-20130214.tar.gz";
@@ -203,11 +203,11 @@
     md5name = "8879d89b5ff7b506c9fc28efc31a5c0b954bbe9333e66e5283d27d20a8519ea3-liberation-narrow-fonts-ttf-1.07.6.tar.gz";
   }
   {
-    name = "liberation-fonts-ttf-2.1.4.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/liberation-fonts-ttf-2.1.4.tar.gz";
-    sha256 = "26f85412dd0aa9d061504a1cc8aaf0aa12a70710e8d47d8b65a1251757c1a5ef";
+    name = "liberation-fonts-ttf-2.1.5.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/liberation-fonts-ttf-2.1.5.tar.gz";
+    sha256 = "7191c669bf38899f73a2094ed00f7b800553364f90e2637010a69c0e268f25d0";
     md5 = "";
-    md5name = "26f85412dd0aa9d061504a1cc8aaf0aa12a70710e8d47d8b65a1251757c1a5ef-liberation-fonts-ttf-2.1.4.tar.gz";
+    md5name = "7191c669bf38899f73a2094ed00f7b800553364f90e2637010a69c0e268f25d0-liberation-fonts-ttf-2.1.5.tar.gz";
   }
   {
     name = "LinLibertineG-20120116.zip";
@@ -224,18 +224,18 @@
     md5name = "1b6880e4b8df09c3b9e246d6084bfd94bf32a0ffff60cf2dcffd3622d0e2d79f-NotoKufiArabic-v2.109.zip";
   }
   {
-    name = "NotoSans-v2.012.zip";
-    url = "https://dev-www.libreoffice.org/src/NotoSans-v2.012.zip";
-    sha256 = "efef2f66ed2c5e005472cba156bd2afb68063a51bb628c6ee14143edc019d293";
+    name = "NotoSans-v2.013.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSans-v2.013.zip";
+    sha256 = "9fd595dd701d7ea103a9ba8a9cfdcf0c35c5574ef754fecabe718eadad8bccde";
     md5 = "";
-    md5name = "efef2f66ed2c5e005472cba156bd2afb68063a51bb628c6ee14143edc019d293-NotoSans-v2.012.zip";
+    md5name = "9fd595dd701d7ea103a9ba8a9cfdcf0c35c5574ef754fecabe718eadad8bccde-NotoSans-v2.013.zip";
   }
   {
-    name = "NotoSerif-v2.012.zip";
-    url = "https://dev-www.libreoffice.org/src/NotoSerif-v2.012.zip";
-    sha256 = "3d4566a0e51e7fc14528f5a1eecc6f12e5ffbbec6484470d3da48b0d8ead345a";
+    name = "NotoSerif-v2.013.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSerif-v2.013.zip";
+    sha256 = "fb4c6c75f10365f63b5c8ad5a1864ebe46dd0c70c40d0461cb0dc1b1b7c13a35";
     md5 = "";
-    md5name = "3d4566a0e51e7fc14528f5a1eecc6f12e5ffbbec6484470d3da48b0d8ead345a-NotoSerif-v2.012.zip";
+    md5name = "fb4c6c75f10365f63b5c8ad5a1864ebe46dd0c70c40d0461cb0dc1b1b7c13a35-NotoSerif-v2.013.zip";
   }
   {
     name = "NotoSerifHebrew-v2.004.zip";
@@ -280,11 +280,11 @@
     md5name = "b21c198a4c76ae598a304decefb3b5c2a4c2d4c3ae226728eff359185f291c6f-NotoSerifArmenian-v2.008.zip";
   }
   {
-    name = "NotoSansGeorgian-v2.003.zip";
-    url = "https://dev-www.libreoffice.org/src/NotoSansGeorgian-v2.003.zip";
-    sha256 = "bd75d1f0b9ef619b5ded0018d6258eeab2f9e976d8f8074bb7890f4e301648bf";
+    name = "NotoSansGeorgian-v2.005.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSansGeorgian-v2.005.zip";
+    sha256 = "10e85011008108308e6feab0408242acb07804da61ede3d3ff236461ae07ab1b";
     md5 = "";
-    md5name = "bd75d1f0b9ef619b5ded0018d6258eeab2f9e976d8f8074bb7890f4e301648bf-NotoSansGeorgian-v2.003.zip";
+    md5name = "10e85011008108308e6feab0408242acb07804da61ede3d3ff236461ae07ab1b-NotoSansGeorgian-v2.005.zip";
   }
   {
     name = "NotoSerifGeorgian-v2.003.zip";
@@ -343,11 +343,11 @@
     md5name = "926fe1bd7dfde8e55178281f645258bfced6420c951c6f2fd532fd21691bca30-Amiri-1.000.zip";
   }
   {
-    name = "ReemKufi-1.2.zip";
-    url = "https://dev-www.libreoffice.org/src/ReemKufi-1.2.zip";
-    sha256 = "c4fd68a23c0ea471cc084ae7efe888da372b925cb208eeb0322c26792d2ef413";
+    name = "ReemKufi-1.7.zip";
+    url = "https://dev-www.libreoffice.org/src/ReemKufi-1.7.zip";
+    sha256 = "2359f036c7bddeb4d5529d7b3c9139c3288c920cc26053d417cdbb563eafe0a4";
     md5 = "";
-    md5name = "c4fd68a23c0ea471cc084ae7efe888da372b925cb208eeb0322c26792d2ef413-ReemKufi-1.2.zip";
+    md5name = "2359f036c7bddeb4d5529d7b3c9139c3288c920cc26053d417cdbb563eafe0a4-ReemKufi-1.7.zip";
   }
   {
     name = "Scheherazade-2.100.zip";
@@ -364,11 +364,11 @@
     md5name = "0e422d1564a6dbf22a9af598535425271e583514c0f7ba7d9091676420de34ac-libfreehand-0.1.2.tar.xz";
   }
   {
-    name = "freetype-2.13.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/freetype-2.13.0.tar.xz";
-    sha256 = "5ee23abd047636c24b2d43c6625dcafc66661d1aca64dec9e0d05df29592624c";
+    name = "freetype-2.13.2.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/freetype-2.13.2.tar.xz";
+    sha256 = "12991c4e55c506dd7f9b765933e62fd2be2e06d421505d7950a132e4f1bb484d";
     md5 = "";
-    md5name = "5ee23abd047636c24b2d43c6625dcafc66661d1aca64dec9e0d05df29592624c-freetype-2.13.0.tar.xz";
+    md5name = "12991c4e55c506dd7f9b765933e62fd2be2e06d421505d7950a132e4f1bb484d-freetype-2.13.2.tar.xz";
   }
   {
     name = "frozen-1.1.1.tar.gz";
@@ -378,11 +378,11 @@
     md5name = "f7c7075750e8fceeac081e9ef01944f221b36d9725beac8681cbd2838d26be45-frozen-1.1.1.tar.gz";
   }
   {
-    name = "glm-0.9.9.8.zip";
-    url = "https://dev-www.libreoffice.org/src/glm-0.9.9.8.zip";
-    sha256 = "6bba5f032bed47c73ad9397f2313b9acbfb56253d0d0576b5873d3dcb25e99ad";
+    name = "glm-1.0.1.zip";
+    url = "https://dev-www.libreoffice.org/src/glm-1.0.1.zip";
+    sha256 = "09c5716296787e1f7fcb87b1cbdbf26814ec1288ed6259ccd30d5d9795809fa5";
     md5 = "";
-    md5name = "6bba5f032bed47c73ad9397f2313b9acbfb56253d0d0576b5873d3dcb25e99ad-glm-0.9.9.8.zip";
+    md5name = "09c5716296787e1f7fcb87b1cbdbf26814ec1288ed6259ccd30d5d9795809fa5-glm-1.0.1.zip";
   }
   {
     name = "gpgme-1.23.2.tar.bz2";
@@ -399,11 +399,11 @@
     md5name = "b8e892d8627c41888ff121e921455b9e2d26836978f2359173d19825da62b8fc-graphite2-minimal-1.3.14.tgz";
   }
   {
-    name = "harfbuzz-8.2.2.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/harfbuzz-8.2.2.tar.xz";
-    sha256 = "e433ad85fbdf57f680be29479b3f964577379aaf319f557eb76569f0ecbc90f3";
+    name = "harfbuzz-8.5.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/harfbuzz-8.5.0.tar.xz";
+    sha256 = "77e4f7f98f3d86bf8788b53e6832fb96279956e1c3961988ea3d4b7ca41ddc27";
     md5 = "";
-    md5name = "e433ad85fbdf57f680be29479b3f964577379aaf319f557eb76569f0ecbc90f3-harfbuzz-8.2.2.tar.xz";
+    md5name = "77e4f7f98f3d86bf8788b53e6832fb96279956e1c3961988ea3d4b7ca41ddc27-harfbuzz-8.5.0.tar.xz";
   }
   {
     name = "hsqldb_1_8_0.zip";
@@ -434,25 +434,25 @@
     md5name = "0e279003f5199f80031c6dcd08f79d6f65a0505139160e7df0d09b226bff4023-IAccessible2-1.3+git20231013.3d8c7f0.tar.gz";
   }
   {
-    name = "icu4c-73_2-src.tgz";
-    url = "https://dev-www.libreoffice.org/src/icu4c-73_2-src.tgz";
-    sha256 = "818a80712ed3caacd9b652305e01afc7fa167e6f2e94996da44b90c2ab604ce1";
+    name = "icu4c-74_2-src.tgz";
+    url = "https://dev-www.libreoffice.org/src/icu4c-74_2-src.tgz";
+    sha256 = "68db082212a96d6f53e35d60f47d38b962e9f9d207a74cfac78029ae8ff5e08c";
     md5 = "";
-    md5name = "818a80712ed3caacd9b652305e01afc7fa167e6f2e94996da44b90c2ab604ce1-icu4c-73_2-src.tgz";
+    md5name = "68db082212a96d6f53e35d60f47d38b962e9f9d207a74cfac78029ae8ff5e08c-icu4c-74_2-src.tgz";
   }
   {
-    name = "icu4c-73_2-data.zip";
-    url = "https://dev-www.libreoffice.org/src/icu4c-73_2-data.zip";
-    sha256 = "ca1ee076163b438461e484421a7679fc33a64cd0a54f9d4b401893fa1eb42701";
+    name = "icu4c-74_2-data.zip";
+    url = "https://dev-www.libreoffice.org/src/icu4c-74_2-data.zip";
+    sha256 = "c28c3ca5f4ba3384781797138a294ca360988d4322674ad4d51e52f5d9b0a2b6";
     md5 = "";
-    md5name = "ca1ee076163b438461e484421a7679fc33a64cd0a54f9d4b401893fa1eb42701-icu4c-73_2-data.zip";
+    md5name = "c28c3ca5f4ba3384781797138a294ca360988d4322674ad4d51e52f5d9b0a2b6-icu4c-74_2-data.zip";
   }
   {
-    name = "Java-WebSocket-1.5.4.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/Java-WebSocket-1.5.4.tar.gz";
-    sha256 = "a6828b35d1f938fee2335945f3d3c563cbbfa58ce7eb0bf72778d0fa7a550720";
+    name = "Java-WebSocket-1.5.6.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/Java-WebSocket-1.5.6.tar.gz";
+    sha256 = "167e86561cd7b5ed21b67d7543536134edcb14b373892739b28c417566a3832f";
     md5 = "";
-    md5name = "a6828b35d1f938fee2335945f3d3c563cbbfa58ce7eb0bf72778d0fa7a550720-Java-WebSocket-1.5.4.tar.gz";
+    md5name = "167e86561cd7b5ed21b67d7543536134edcb14b373892739b28c417566a3832f-Java-WebSocket-1.5.6.tar.gz";
   }
   {
     name = "flow-engine-0.9.4.zip";
@@ -553,18 +553,18 @@
     md5name = "d873d34ad8b9b4cea010631f1a6228d2087475e4dc5e763eb81acc23d9d45a51-lcms2-2.16.tar.gz";
   }
   {
-    name = "libassuan-2.5.7.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/libassuan-2.5.7.tar.bz2";
-    sha256 = "0103081ffc27838a2e50479153ca105e873d3d65d8a9593282e9c94c7e6afb76";
+    name = "libassuan-3.0.1.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/libassuan-3.0.1.tar.bz2";
+    sha256 = "c8f0f42e6103dea4b1a6a483cb556654e97302c7465308f58363778f95f194b1";
     md5 = "";
-    md5name = "0103081ffc27838a2e50479153ca105e873d3d65d8a9593282e9c94c7e6afb76-libassuan-2.5.7.tar.bz2";
+    md5name = "c8f0f42e6103dea4b1a6a483cb556654e97302c7465308f58363778f95f194b1-libassuan-3.0.1.tar.bz2";
   }
   {
-    name = "libatomic_ops-7.8.0.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/libatomic_ops-7.8.0.tar.gz";
-    sha256 = "15676e7674e11bda5a7e50a73f4d9e7d60452271b8acf6fd39a71fefdf89fa31";
+    name = "libatomic_ops-7.8.2.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/libatomic_ops-7.8.2.tar.gz";
+    sha256 = "d305207fe207f2b3fb5cb4c019da12b44ce3fcbc593dfd5080d867b1a2419b51";
     md5 = "";
-    md5name = "15676e7674e11bda5a7e50a73f4d9e7d60452271b8acf6fd39a71fefdf89fa31-libatomic_ops-7.8.0.tar.gz";
+    md5name = "d305207fe207f2b3fb5cb4c019da12b44ce3fcbc593dfd5080d867b1a2419b51-libatomic_ops-7.8.2.tar.gz";
   }
   {
     name = "libeot-0.01.tar.bz2";
@@ -574,11 +574,11 @@
     md5name = "cf5091fa8e7dcdbe667335eb90a2cfdd0a3fe8f8c7c8d1ece44d9d055736a06a-libeot-0.01.tar.bz2";
   }
   {
-    name = "libexttextcat-3.4.6.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libexttextcat-3.4.6.tar.xz";
-    sha256 = "6d77eace20e9ea106c1330e268ede70c9a4a89744ddc25715682754eca3368df";
+    name = "libexttextcat-3.4.7.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libexttextcat-3.4.7.tar.xz";
+    sha256 = "df0a59d413a5b202573d8d4f5159e33a8538da4f8e8e60979facc64d6290cebd";
     md5 = "";
-    md5name = "6d77eace20e9ea106c1330e268ede70c9a4a89744ddc25715682754eca3368df-libexttextcat-3.4.6.tar.xz";
+    md5name = "df0a59d413a5b202573d8d4f5159e33a8538da4f8e8e60979facc64d6290cebd-libexttextcat-3.4.7.tar.xz";
   }
   {
     name = "libffi-3.4.4.tar.gz";
@@ -588,11 +588,11 @@
     md5name = "d66c56ad259a82cf2a9dfc408b32bf5da52371500b84745f7fb8b645712df676-libffi-3.4.4.tar.gz";
   }
   {
-    name = "libgpg-error-1.48.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/libgpg-error-1.48.tar.bz2";
-    sha256 = "89ce1ae893e122924b858de84dc4f67aae29ffa610ebf668d5aa539045663d6f";
+    name = "libgpg-error-1.50.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/libgpg-error-1.50.tar.bz2";
+    sha256 = "69405349e0a633e444a28c5b35ce8f14484684518a508dc48a089992fe93e20a";
     md5 = "";
-    md5name = "89ce1ae893e122924b858de84dc4f67aae29ffa610ebf668d5aa539045663d6f-libgpg-error-1.48.tar.bz2";
+    md5name = "69405349e0a633e444a28c5b35ce8f14484684518a508dc48a089992fe93e20a-libgpg-error-1.50.tar.bz2";
   }
   {
     name = "liblangtag-0.6.7.tar.bz2";
@@ -616,32 +616,32 @@
     md5name = "296272d93435991308eb73607600c034b558807a07e829e751142e65ccfa9d08-ltm-1.3.0.tar.xz";
   }
   {
-    name = "libwebp-1.3.2.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/libwebp-1.3.2.tar.gz";
-    sha256 = "2a499607df669e40258e53d0ade8035ba4ec0175244869d1025d460562aa09b4";
+    name = "libwebp-1.4.0.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/libwebp-1.4.0.tar.gz";
+    sha256 = "61f873ec69e3be1b99535634340d5bde750b2e4447caa1db9f61be3fd49ab1e5";
     md5 = "";
-    md5name = "2a499607df669e40258e53d0ade8035ba4ec0175244869d1025d460562aa09b4-libwebp-1.3.2.tar.gz";
+    md5name = "61f873ec69e3be1b99535634340d5bde750b2e4447caa1db9f61be3fd49ab1e5-libwebp-1.4.0.tar.gz";
   }
   {
-    name = "xmlsec1-1.3.2.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/xmlsec1-1.3.2.tar.gz";
-    sha256 = "4003c56b3d356d21b1db7775318540fad6bfedaf5f117e8f7c010811219be3cf";
+    name = "xmlsec1-1.3.5.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/xmlsec1-1.3.5.tar.gz";
+    sha256 = "2ffd4ad1f860ec93e47a680310ab2bc94968bd07566e71976bd96133d9504917";
     md5 = "";
-    md5name = "4003c56b3d356d21b1db7775318540fad6bfedaf5f117e8f7c010811219be3cf-xmlsec1-1.3.2.tar.gz";
+    md5name = "2ffd4ad1f860ec93e47a680310ab2bc94968bd07566e71976bd96133d9504917-xmlsec1-1.3.5.tar.gz";
   }
   {
-    name = "libxml2-2.12.8.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libxml2-2.12.8.tar.xz";
-    sha256 = "43ad877b018bc63deb2468d71f95219c2fac196876ef36d1bee51d226173ec93";
+    name = "libxml2-2.12.9.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libxml2-2.12.9.tar.xz";
+    sha256 = "59912db536ab56a3996489ea0299768c7bcffe57169f0235e7f962a91f483590";
     md5 = "";
-    md5name = "43ad877b018bc63deb2468d71f95219c2fac196876ef36d1bee51d226173ec93-libxml2-2.12.8.tar.xz";
+    md5name = "59912db536ab56a3996489ea0299768c7bcffe57169f0235e7f962a91f483590-libxml2-2.12.9.tar.xz";
   }
   {
-    name = "libxslt-1.1.39.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libxslt-1.1.39.tar.xz";
-    sha256 = "2a20ad621148339b0759c4d4e96719362dee64c9a096dbba625ba053846349f0";
+    name = "libxslt-1.1.41.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libxslt-1.1.41.tar.xz";
+    sha256 = "3ad392af91115b7740f7b50d228cc1c5fc13afc1da7f16cb0213917a37f71bda";
     md5 = "";
-    md5name = "2a20ad621148339b0759c4d4e96719362dee64c9a096dbba625ba053846349f0-libxslt-1.1.39.tar.xz";
+    md5name = "3ad392af91115b7740f7b50d228cc1c5fc13afc1da7f16cb0213917a37f71bda-libxslt-1.1.41.tar.xz";
   }
   {
     name = "lp_solve_5.5.tar.gz";
@@ -651,11 +651,11 @@
     md5name = "26b3e95ddf3d9c077c480ea45874b3b8-lp_solve_5.5.tar.gz";
   }
   {
-    name = "lxml-4.9.2.tgz";
-    url = "https://dev-www.libreoffice.org/src/lxml-4.9.2.tgz";
-    sha256 = "2455cfaeb7ac70338b3257f41e21f0724f4b5b0c0e7702da67ee6c3640835b67";
+    name = "lxml-5.2.2.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/lxml-5.2.2.tar.gz";
+    sha256 = "bb2dc4898180bea79863d5487e5f9c7c34297414bad54bcd0f0852aee9cfdb87";
     md5 = "";
-    md5name = "2455cfaeb7ac70338b3257f41e21f0724f4b5b0c0e7702da67ee6c3640835b67-lxml-4.9.2.tgz";
+    md5name = "bb2dc4898180bea79863d5487e5f9c7c34297414bad54bcd0f0852aee9cfdb87-lxml-5.2.2.tar.gz";
   }
   {
     name = "mariadb-connector-c-3.3.8-src.tar.gz";
@@ -686,11 +686,11 @@
     md5name = "ef36c1a1aabb2ba3b0bedaaafe717bf4480be2ba8de6f3894be5fd3702b013ba-libmspub-0.1.4.tar.xz";
   }
   {
-    name = "libmwaw-0.3.21.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libmwaw-0.3.21.tar.xz";
-    sha256 = "e8750123a78d61b943cef78b7736c8a7f20bb0a649aa112402124fba794fc21c";
+    name = "libmwaw-0.3.22.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libmwaw-0.3.22.tar.xz";
+    sha256 = "a1a39ffcea3ff2a7a7aae0c23877ddf4918b554bf82b0de5d7ce8e7f61ea8e32";
     md5 = "";
-    md5name = "e8750123a78d61b943cef78b7736c8a7f20bb0a649aa112402124fba794fc21c-libmwaw-0.3.21.tar.xz";
+    md5name = "a1a39ffcea3ff2a7a7aae0c23877ddf4918b554bf82b0de5d7ce8e7f61ea8e32-libmwaw-0.3.22.tar.xz";
   }
   {
     name = "mythes-1.2.5.tar.xz";
@@ -700,11 +700,11 @@
     md5name = "19279f70707bbe5ffa619f2dc319f888cec0c4a8d339dc0a21330517bd6f521d-mythes-1.2.5.tar.xz";
   }
   {
-    name = "nss-3.99-with-nspr-4.35.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/nss-3.99-with-nspr-4.35.tar.gz";
-    sha256 = "5f29fea64b3234b33a615b6df40469e239a4168ac0909106bd00e6490b274c31";
+    name = "nss-3.102.1-with-nspr-4.35.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/nss-3.102.1-with-nspr-4.35.tar.gz";
+    sha256 = "ddfdec73fb4b0eedce5fc4de09de9ba14d2ddbfbf67e42372903e1510f2d3d65";
     md5 = "";
-    md5name = "5f29fea64b3234b33a615b6df40469e239a4168ac0909106bd00e6490b274c31-nss-3.99-with-nspr-4.35.tar.gz";
+    md5name = "ddfdec73fb4b0eedce5fc4de09de9ba14d2ddbfbf67e42372903e1510f2d3d65-nss-3.102.1-with-nspr-4.35.tar.gz";
   }
   {
     name = "libodfgen-0.1.8.tar.xz";
@@ -735,11 +735,11 @@
     md5name = "37206cf981e8409d048b59ac5839621ea107ff49af72beb9d7769a2f41da8d90-onlineupdate-c003be8b9727672e7d30972983b375f4c200233f-2.tar.xz";
   }
   {
-    name = "openldap-2.6.7.tgz";
-    url = "https://dev-www.libreoffice.org/src/openldap-2.6.7.tgz";
-    sha256 = "cd775f625c944ed78a3da18a03b03b08eea73c8aabc97b41bb336e9a10954930";
+    name = "openldap-2.6.8.tgz";
+    url = "https://dev-www.libreoffice.org/src/openldap-2.6.8.tgz";
+    sha256 = "48969323e94e3be3b03c6a132942dcba7ef8d545f2ad35401709019f696c3c4e";
     md5 = "";
-    md5name = "cd775f625c944ed78a3da18a03b03b08eea73c8aabc97b41bb336e9a10954930-openldap-2.6.7.tgz";
+    md5name = "48969323e94e3be3b03c6a132942dcba7ef8d545f2ad35401709019f696c3c4e-openldap-2.6.8.tgz";
   }
   {
     name = "openssl-3.0.14.tar.gz";
@@ -763,11 +763,11 @@
     md5name = "66adacd705a7d19895e08eac46d1e851332adf2e736c566bef1164e7a442519d-libpagemaker-0.0.4.tar.xz";
   }
   {
-    name = "pdfium-6179.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/pdfium-6179.tar.bz2";
-    sha256 = "4d3f08fe0e2fda86246832085426616826dcca0912202874428bfbc24d13d95c";
+    name = "pdfium-6425.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/pdfium-6425.tar.bz2";
+    sha256 = "fe0291b96d7352bac530d13ef2e5fd63ad9980e0128911f88b957b5992508f1c";
     md5 = "";
-    md5name = "4d3f08fe0e2fda86246832085426616826dcca0912202874428bfbc24d13d95c-pdfium-6179.tar.bz2";
+    md5name = "fe0291b96d7352bac530d13ef2e5fd63ad9980e0128911f88b957b5992508f1c-pdfium-6425.tar.bz2";
   }
   {
     name = "pixman-0.42.2.tar.gz";
@@ -784,18 +784,18 @@
     md5name = "6a5ca0652392a2d7c9db2ae5b40210843c0bbc081cbd410825ab00cc59f14a6c-libpng-1.6.43.tar.xz";
   }
   {
-    name = "tiff-4.6.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/tiff-4.6.0.tar.xz";
-    sha256 = "e178649607d1e22b51cf361dd20a3753f244f022eefab1f2f218fc62ebaf87d2";
+    name = "tiff-4.6.0t.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/tiff-4.6.0t.tar.xz";
+    sha256 = "d6da35c9986a4ec845eb96258b3693f8df515f7eb4c1e597ceb03e22788f305b";
     md5 = "";
-    md5name = "e178649607d1e22b51cf361dd20a3753f244f022eefab1f2f218fc62ebaf87d2-tiff-4.6.0.tar.xz";
+    md5name = "d6da35c9986a4ec845eb96258b3693f8df515f7eb4c1e597ceb03e22788f305b-tiff-4.6.0t.tar.xz";
   }
   {
-    name = "poppler-23.09.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/poppler-23.09.0.tar.xz";
-    sha256 = "80d1d44dd8bdf4ac1a47d56c5065075eb9991790974b1ed7d14b972acde88e55";
+    name = "poppler-24.06.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/poppler-24.06.0.tar.xz";
+    sha256 = "0cdabd495cada11f6ee9e75c793f80daf46367b66c25a63ee8c26d0f9ec40c76";
     md5 = "";
-    md5name = "80d1d44dd8bdf4ac1a47d56c5065075eb9991790974b1ed7d14b972acde88e55-poppler-23.09.0.tar.xz";
+    md5name = "0cdabd495cada11f6ee9e75c793f80daf46367b66c25a63ee8c26d0f9ec40c76-poppler-24.06.0.tar.xz";
   }
   {
     name = "poppler-data-0.4.12.tar.gz";
@@ -805,18 +805,18 @@
     md5name = "c835b640a40ce357e1b83666aabd95edffa24ddddd49b8daff63adb851cdab74-poppler-data-0.4.12.tar.gz";
   }
   {
-    name = "postgresql-13.14.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/postgresql-13.14.tar.bz2";
-    sha256 = "b8df078551898960bd500dc5d38a177e9905376df81fe7f2b660a1407fa6a5ed";
+    name = "postgresql-13.15.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/postgresql-13.15.tar.bz2";
+    sha256 = "42edd415446d33b8c242be76d1ad057531b2264b2e86939339b7075c6e4ec925";
     md5 = "";
-    md5name = "b8df078551898960bd500dc5d38a177e9905376df81fe7f2b660a1407fa6a5ed-postgresql-13.14.tar.bz2";
+    md5name = "42edd415446d33b8c242be76d1ad057531b2264b2e86939339b7075c6e4ec925-postgresql-13.15.tar.bz2";
   }
   {
-    name = "Python-3.8.19.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/Python-3.8.19.tar.xz";
-    sha256 = "d2807ac69f69b84fd46a0b93bbd02a4fa48d3e70f4b2835ff0f72a2885040076";
+    name = "Python-3.9.19.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/Python-3.9.19.tar.xz";
+    sha256 = "d4892cd1618f6458cb851208c030df1482779609d0f3939991bd38184f8c679e";
     md5 = "";
-    md5name = "d2807ac69f69b84fd46a0b93bbd02a4fa48d3e70f4b2835ff0f72a2885040076-Python-3.8.19.tar.xz";
+    md5name = "d4892cd1618f6458cb851208c030df1482779609d0f3939991bd38184f8c679e-Python-3.9.19.tar.xz";
   }
   {
     name = "libqxp-0.0.2.tar.xz";
@@ -847,18 +847,18 @@
     md5name = "e5be03eda13ef68aabab6e42aa67715e-redland-1.0.17.tar.gz";
   }
   {
-    name = "librevenge-0.0.4.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/librevenge-0.0.4.tar.bz2";
-    sha256 = "c51601cd08320b75702812c64aae0653409164da7825fd0f451ac2c5dbe77cbf";
+    name = "librevenge-0.0.5.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/librevenge-0.0.5.tar.bz2";
+    sha256 = "5892ca6796f7a2a93d580832e907e849b19d980b40d326a283b18877ab6de0c5";
     md5 = "";
-    md5name = "c51601cd08320b75702812c64aae0653409164da7825fd0f451ac2c5dbe77cbf-librevenge-0.0.4.tar.bz2";
+    md5name = "5892ca6796f7a2a93d580832e907e849b19d980b40d326a283b18877ab6de0c5-librevenge-0.0.5.tar.bz2";
   }
   {
-    name = "rhino1_5R5.zip";
-    url = "https://dev-www.libreoffice.org/src/798b2ffdc8bcfe7bca2cf92b62caf685-rhino1_5R5.zip";
-    sha256 = "1fb458d6aab06932693cc8a9b6e4e70944ee1ff052fa63606e3131df34e21753";
-    md5 = "798b2ffdc8bcfe7bca2cf92b62caf685";
-    md5name = "798b2ffdc8bcfe7bca2cf92b62caf685-rhino1_5R5.zip";
+    name = "rhino-1.7.14.zip";
+    url = "https://dev-www.libreoffice.org/src/rhino-1.7.14.zip";
+    sha256 = "bf4d2d0c5ff8889fd494486db09291cb7965f0bf2f93ef005d3b08070a5a4f5c";
+    md5 = "";
+    md5name = "bf4d2d0c5ff8889fd494486db09291cb7965f0bf2f93ef005d3b08070a5a4f5c-rhino-1.7.14.zip";
   }
   {
     name = "skia-m116-2ddcf183eb260f63698aa74d1bb380f247ad7ccd.tar.xz";
@@ -874,13 +874,6 @@
     md5 = "";
     md5name = "f94fb0ad8216f97127bedef163a45886b43c62deac5e5b0f5e628e234220c8db-libstaroffice-0.0.7.tar.xz";
   }
-  {
-    name = "swingExSrc.zip";
-    url = "https://dev-www.libreoffice.org/src/35c94d2df8893241173de1d16b6034c0-swingExSrc.zip";
-    sha256 = "64585ac36a81291a58269ec5347e7e3e2e8596dbacb9221015c208191333c6e1";
-    md5 = "35c94d2df8893241173de1d16b6034c0";
-    md5name = "35c94d2df8893241173de1d16b6034c0-swingExSrc.zip";
-  }
   {
     name = "twaindsm_2.4.1.orig.tar.gz";
     url = "https://dev-www.libreoffice.org/src/twaindsm_2.4.1.orig.tar.gz";
@@ -945,10 +938,10 @@
     md5name = "77d6c6ecb35952a8d8ce7f736b7a2bf466275c48210e309b73782d6b7e84dffd-zxcvbn-c-2.5.tar.gz";
   }
   {
-    name = "zxing-cpp-2.1.0.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/zxing-cpp-2.1.0.tar.gz";
-    sha256 = "6d54e403592ec7a143791c6526c1baafddf4c0897bb49b1af72b70a0f0c4a3fe";
+    name = "zxing-cpp-2.2.1.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/zxing-cpp-2.2.1.tar.gz";
+    sha256 = "02078ae15f19f9d423a441f205b1d1bee32349ddda7467e2c84e8f08876f8635";
     md5 = "";
-    md5name = "6d54e403592ec7a143791c6526c1baafddf4c0897bb49b1af72b70a0f0c4a3fe-zxing-cpp-2.1.0.tar.gz";
+    md5name = "02078ae15f19f9d423a441f205b1d1bee32349ddda7467e2c84e8f08876f8635-zxing-cpp-2.2.1.tar.gz";
   }
 ]
diff --git a/pkgs/applications/office/libreoffice/src-fresh/help.nix b/pkgs/applications/office/libreoffice/src-fresh/help.nix
index 0f9f54905270..2a807c361595 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/help.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/help.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "090pi8dnj5izpvng94hgmjid14n7xvy3rlqqvang3pqdn35xnpsl";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.2.5/libreoffice-help-24.2.5.2.tar.xz";
+  sha256 = "1vbi2qbap3ccychc0sfn32z46klyzjh0hhk4in0sd7qkl97y6lvn";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.8.0/libreoffice-help-24.8.0.3.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-fresh/main.nix b/pkgs/applications/office/libreoffice/src-fresh/main.nix
index 69376e497a11..2bbbb6b3b0c2 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/main.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/main.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "03halzc9w4z8pfs8krpswp2qzrqq9rhnmms8v8ny88am87vy85lw";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.2.5/libreoffice-24.2.5.2.tar.xz";
+  sha256 = "1hbqgpgih3j9ic1dljxz3mz0rsjf0iyws7qm7g1hb35ns664c4av";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.8.0/libreoffice-24.8.0.3.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-fresh/translations.nix b/pkgs/applications/office/libreoffice/src-fresh/translations.nix
index b96943060182..d5890a86e2cb 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/translations.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/translations.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "0fri41y59zhm8lq0kh6hvf5rpdjdqx0lg1sl40mhh1d6lf1izc1w";
-  url = "https://download.documentfoundation.org/libreoffice/src/24.2.5/libreoffice-translations-24.2.5.2.tar.xz";
+  sha256 = "0p75xijrmp44kcda33xg5dr06xl1fcxwhxgvlcj396rkn2k0c9sy";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.8.0/libreoffice-translations-24.8.0.3.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-fresh/version.nix b/pkgs/applications/office/libreoffice/src-fresh/version.nix
index ede95eca68ce..e6bf645f8082 100644
--- a/pkgs/applications/office/libreoffice/src-fresh/version.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/version.nix
@@ -1 +1 @@
-"24.2.5.2"
+"24.8.0.3"
diff --git a/pkgs/applications/office/libreoffice/src-still/deps.nix b/pkgs/applications/office/libreoffice/src-still/deps.nix
index f9fa8532b336..d9ef29364fc8 100644
--- a/pkgs/applications/office/libreoffice/src-still/deps.nix
+++ b/pkgs/applications/office/libreoffice/src-still/deps.nix
@@ -6,6 +6,13 @@
     md5 = "";
     md5name = "e763a9dc21c3d2667402d66e202e3f8ef4db51b34b79ef41f56cacb86dcd6eed-libabw-0.1.3.tar.xz";
   }
+  {
+    name = "phc-winner-argon2-20190702.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/phc-winner-argon2-20190702.tar.gz";
+    sha256 = "daf972a89577f8772602bf2eb38b6a3dd3d922bf5724d45e7f9589b5e830442c";
+    md5 = "";
+    md5name = "daf972a89577f8772602bf2eb38b6a3dd3d922bf5724d45e7f9589b5e830442c-phc-winner-argon2-20190702.tar.gz";
+  }
   {
     name = "boost_1_82_0.tar.xz";
     url = "https://dev-www.libreoffice.org/src/boost_1_82_0.tar.xz";
@@ -84,11 +91,11 @@
     md5name = "d54d19d86153dbc88e2d468f7136269a2cfe71b73227e12fded01d29ac268074-libcmis-0.6.1.tar.xz";
   }
   {
-    name = "CoinMP-1.7.6.tgz";
-    url = "https://dev-www.libreoffice.org/src/CoinMP-1.7.6.tgz";
-    sha256 = "86c798780b9e1f5921fe4efe651a93cb420623b45aa1fdff57af8c37f116113f";
+    name = "CoinMP-1.8.4.tgz";
+    url = "https://dev-www.libreoffice.org/src/CoinMP-1.8.4.tgz";
+    sha256 = "3459fb0ccbdd39342744684338984ac4cc153fb0434f4cae8cf74bd67490a38d";
     md5 = "";
-    md5name = "86c798780b9e1f5921fe4efe651a93cb420623b45aa1fdff57af8c37f116113f-CoinMP-1.7.6.tgz";
+    md5name = "3459fb0ccbdd39342744684338984ac4cc153fb0434f4cae8cf74bd67490a38d-CoinMP-1.8.4.tgz";
   }
   {
     name = "cppunit-1.15.1.tar.gz";
@@ -98,11 +105,11 @@
     md5name = "89c5c6665337f56fd2db36bc3805a5619709d51fb136e51937072f63fcc717a7-cppunit-1.15.1.tar.gz";
   }
   {
-    name = "curl-8.6.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/curl-8.6.0.tar.xz";
-    sha256 = "3ccd55d91af9516539df80625f818c734dc6f2ecf9bada33c76765e99121db15";
+    name = "curl-8.7.1.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/curl-8.7.1.tar.xz";
+    sha256 = "6fea2aac6a4610fbd0400afb0bcddbe7258a64c63f1f68e5855ebc0c659710cd";
     md5 = "";
-    md5name = "3ccd55d91af9516539df80625f818c734dc6f2ecf9bada33c76765e99121db15-curl-8.6.0.tar.xz";
+    md5name = "6fea2aac6a4610fbd0400afb0bcddbe7258a64c63f1f68e5855ebc0c659710cd-curl-8.7.1.tar.xz";
   }
   {
     name = "libe-book-0.1.3.tar.xz";
@@ -210,11 +217,102 @@
     md5name = "e7a384790b13c29113e22e596ade9687-LinLibertineG-20120116.zip";
   }
   {
-    name = "noto-fonts-20171024.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/noto-fonts-20171024.tar.gz";
-    sha256 = "29acc15a4c4d6b51201ba5d60f303dfbc2e5acbfdb70413c9ae1ed34fa259994";
+    name = "NotoKufiArabic-v2.109.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoKufiArabic-v2.109.zip";
+    sha256 = "1b6880e4b8df09c3b9e246d6084bfd94bf32a0ffff60cf2dcffd3622d0e2d79f";
     md5 = "";
-    md5name = "29acc15a4c4d6b51201ba5d60f303dfbc2e5acbfdb70413c9ae1ed34fa259994-noto-fonts-20171024.tar.gz";
+    md5name = "1b6880e4b8df09c3b9e246d6084bfd94bf32a0ffff60cf2dcffd3622d0e2d79f-NotoKufiArabic-v2.109.zip";
+  }
+  {
+    name = "NotoSans-v2.012.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSans-v2.012.zip";
+    sha256 = "efef2f66ed2c5e005472cba156bd2afb68063a51bb628c6ee14143edc019d293";
+    md5 = "";
+    md5name = "efef2f66ed2c5e005472cba156bd2afb68063a51bb628c6ee14143edc019d293-NotoSans-v2.012.zip";
+  }
+  {
+    name = "NotoSerif-v2.012.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSerif-v2.012.zip";
+    sha256 = "3d4566a0e51e7fc14528f5a1eecc6f12e5ffbbec6484470d3da48b0d8ead345a";
+    md5 = "";
+    md5name = "3d4566a0e51e7fc14528f5a1eecc6f12e5ffbbec6484470d3da48b0d8ead345a-NotoSerif-v2.012.zip";
+  }
+  {
+    name = "NotoSerifHebrew-v2.004.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSerifHebrew-v2.004.zip";
+    sha256 = "99523f4f21051495f18cbd5169ed0d1e9b395eefe770fece1844a4a7a00c46da";
+    md5 = "";
+    md5name = "99523f4f21051495f18cbd5169ed0d1e9b395eefe770fece1844a4a7a00c46da-NotoSerifHebrew-v2.004.zip";
+  }
+  {
+    name = "NotoSansArabic-v2.010.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSansArabic-v2.010.zip";
+    sha256 = "a5a34ac1ea01d0d71c083f99440ebfb1f64224474a0d88bb7ef0e2f8d9a996d2";
+    md5 = "";
+    md5name = "a5a34ac1ea01d0d71c083f99440ebfb1f64224474a0d88bb7ef0e2f8d9a996d2-NotoSansArabic-v2.010.zip";
+  }
+  {
+    name = "NotoNaskhArabic-v2.019.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoNaskhArabic-v2.019.zip";
+    sha256 = "7a509e10c9c8d21f384a26807ef2f5fbbecec46fdb8626c5441bed6d894edb81";
+    md5 = "";
+    md5name = "7a509e10c9c8d21f384a26807ef2f5fbbecec46fdb8626c5441bed6d894edb81-NotoNaskhArabic-v2.019.zip";
+  }
+  {
+    name = "NotoSansHebrew-v3.001.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSansHebrew-v3.001.zip";
+    sha256 = "df0a71814b4e63644cf40fcc4529111b61266b7a2dafbe95068b29a7520cc3cb";
+    md5 = "";
+    md5name = "df0a71814b4e63644cf40fcc4529111b61266b7a2dafbe95068b29a7520cc3cb-NotoSansHebrew-v3.001.zip";
+  }
+  {
+    name = "NotoSansArmenian-v2.008.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSansArmenian-v2.008.zip";
+    sha256 = "eab89b99e134177ca6a3f9f0412a7cb812aafceb13175d686b4c45cb237f64ac";
+    md5 = "";
+    md5name = "eab89b99e134177ca6a3f9f0412a7cb812aafceb13175d686b4c45cb237f64ac-NotoSansArmenian-v2.008.zip";
+  }
+  {
+    name = "NotoSerifArmenian-v2.008.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSerifArmenian-v2.008.zip";
+    sha256 = "b21c198a4c76ae598a304decefb3b5c2a4c2d4c3ae226728eff359185f291c6f";
+    md5 = "";
+    md5name = "b21c198a4c76ae598a304decefb3b5c2a4c2d4c3ae226728eff359185f291c6f-NotoSerifArmenian-v2.008.zip";
+  }
+  {
+    name = "NotoSansGeorgian-v2.003.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSansGeorgian-v2.003.zip";
+    sha256 = "bd75d1f0b9ef619b5ded0018d6258eeab2f9e976d8f8074bb7890f4e301648bf";
+    md5 = "";
+    md5name = "bd75d1f0b9ef619b5ded0018d6258eeab2f9e976d8f8074bb7890f4e301648bf-NotoSansGeorgian-v2.003.zip";
+  }
+  {
+    name = "NotoSerifGeorgian-v2.003.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSerifGeorgian-v2.003.zip";
+    sha256 = "cfb41a264b97d463bab6807a5be937ba4a6ddcfa93d519a21b98b0ba73ca27d4";
+    md5 = "";
+    md5name = "cfb41a264b97d463bab6807a5be937ba4a6ddcfa93d519a21b98b0ba73ca27d4-NotoSerifGeorgian-v2.003.zip";
+  }
+  {
+    name = "NotoSansLao-v2.003.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSansLao-v2.003.zip";
+    sha256 = "5a87c31b1a40ef8147c1e84437e5f0ceba2d4dbbfc0b56a65821ad29870da8c0";
+    md5 = "";
+    md5name = "5a87c31b1a40ef8147c1e84437e5f0ceba2d4dbbfc0b56a65821ad29870da8c0-NotoSansLao-v2.003.zip";
+  }
+  {
+    name = "NotoSerifLao-v2.003.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSerifLao-v2.003.zip";
+    sha256 = "e96a303d3347790b0ef3db274971a989a736ce766ec9ea1bea0e1458568a80b2";
+    md5 = "";
+    md5name = "e96a303d3347790b0ef3db274971a989a736ce766ec9ea1bea0e1458568a80b2-NotoSerifLao-v2.003.zip";
+  }
+  {
+    name = "NotoSansLisu-v2.102.zip";
+    url = "https://dev-www.libreoffice.org/src/NotoSansLisu-v2.102.zip";
+    sha256 = "b12a1ff762680681b7ce4d98dd29a7f54d90f5bcadd10c955afc640a27b3a268";
+    md5 = "";
+    md5name = "b12a1ff762680681b7ce4d98dd29a7f54d90f5bcadd10c955afc640a27b3a268-NotoSansLisu-v2.102.zip";
   }
   {
     name = "culmus-0.133.tar.gz";
@@ -287,11 +385,11 @@
     md5name = "6bba5f032bed47c73ad9397f2313b9acbfb56253d0d0576b5873d3dcb25e99ad-glm-0.9.9.8.zip";
   }
   {
-    name = "gpgme-1.18.0.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/gpgme-1.18.0.tar.bz2";
-    sha256 = "361d4eae47ce925dba0ea569af40e7b52c645c4ae2e65e5621bf1b6cdd8b0e9e";
+    name = "gpgme-1.23.2.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/gpgme-1.23.2.tar.bz2";
+    sha256 = "9499e8b1f33cccb6815527a1bc16049d35a6198a6c5fae0185f2bd561bce5224";
     md5 = "";
-    md5name = "361d4eae47ce925dba0ea569af40e7b52c645c4ae2e65e5621bf1b6cdd8b0e9e-gpgme-1.18.0.tar.bz2";
+    md5name = "9499e8b1f33cccb6815527a1bc16049d35a6198a6c5fae0185f2bd561bce5224-gpgme-1.23.2.tar.bz2";
   }
   {
     name = "graphite2-minimal-1.3.14.tgz";
@@ -328,6 +426,13 @@
     md5 = "5ade6ae2a99bc1e9e57031ca88d36dad";
     md5name = "5ade6ae2a99bc1e9e57031ca88d36dad-hyphen-2.8.8.tar.gz";
   }
+  {
+    name = "IAccessible2-1.3+git20231013.3d8c7f0.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/IAccessible2-1.3+git20231013.3d8c7f0.tar.gz";
+    sha256 = "0e279003f5199f80031c6dcd08f79d6f65a0505139160e7df0d09b226bff4023";
+    md5 = "";
+    md5name = "0e279003f5199f80031c6dcd08f79d6f65a0505139160e7df0d09b226bff4023-IAccessible2-1.3+git20231013.3d8c7f0.tar.gz";
+  }
   {
     name = "icu4c-73_2-src.tgz";
     url = "https://dev-www.libreoffice.org/src/icu4c-73_2-src.tgz";
@@ -342,6 +447,13 @@
     md5 = "";
     md5name = "ca1ee076163b438461e484421a7679fc33a64cd0a54f9d4b401893fa1eb42701-icu4c-73_2-data.zip";
   }
+  {
+    name = "Java-WebSocket-1.5.4.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/Java-WebSocket-1.5.4.tar.gz";
+    sha256 = "a6828b35d1f938fee2335945f3d3c563cbbfa58ce7eb0bf72778d0fa7a550720";
+    md5 = "";
+    md5name = "a6828b35d1f938fee2335945f3d3c563cbbfa58ce7eb0bf72778d0fa7a550720-Java-WebSocket-1.5.4.tar.gz";
+  }
   {
     name = "flow-engine-0.9.4.zip";
     url = "https://dev-www.libreoffice.org/src/ba2930200c9f019c2d93a8c88c651a0f-flow-engine-0.9.4.zip";
@@ -427,32 +539,32 @@
     md5name = "2fdc3feb6e9deb17adec9bafa3321419aa19f8f4e5dea7bf8486844ca22207bf-libjpeg-turbo-2.1.5.1.tar.gz";
   }
   {
-    name = "language-subtag-registry-2023-08-02.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2023-08-02.tar.bz2";
-    sha256 = "59fdc026b5088e7947e1e6add482d2a40e1f7e25c50f198b456954216462c2eb";
+    name = "language-subtag-registry-2024-06-14.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/language-subtag-registry-2024-06-14.tar.bz2";
+    sha256 = "75bc394dd83ddfd62b172a462db1b66bdb5950f40823ed63b8c7db6b71e37e75";
     md5 = "";
-    md5name = "59fdc026b5088e7947e1e6add482d2a40e1f7e25c50f198b456954216462c2eb-language-subtag-registry-2023-08-02.tar.bz2";
+    md5name = "75bc394dd83ddfd62b172a462db1b66bdb5950f40823ed63b8c7db6b71e37e75-language-subtag-registry-2024-06-14.tar.bz2";
   }
   {
-    name = "lcms2-2.12.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/lcms2-2.12.tar.gz";
-    sha256 = "18663985e864100455ac3e507625c438c3710354d85e5cbb7cd4043e11fe10f5";
+    name = "lcms2-2.16.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/lcms2-2.16.tar.gz";
+    sha256 = "d873d34ad8b9b4cea010631f1a6228d2087475e4dc5e763eb81acc23d9d45a51";
     md5 = "";
-    md5name = "18663985e864100455ac3e507625c438c3710354d85e5cbb7cd4043e11fe10f5-lcms2-2.12.tar.gz";
+    md5name = "d873d34ad8b9b4cea010631f1a6228d2087475e4dc5e763eb81acc23d9d45a51-lcms2-2.16.tar.gz";
   }
   {
-    name = "libassuan-2.5.6.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/libassuan-2.5.6.tar.bz2";
-    sha256 = "e9fd27218d5394904e4e39788f9b1742711c3e6b41689a31aa3380bd5aa4f426";
+    name = "libassuan-2.5.7.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/libassuan-2.5.7.tar.bz2";
+    sha256 = "0103081ffc27838a2e50479153ca105e873d3d65d8a9593282e9c94c7e6afb76";
     md5 = "";
-    md5name = "e9fd27218d5394904e4e39788f9b1742711c3e6b41689a31aa3380bd5aa4f426-libassuan-2.5.6.tar.bz2";
+    md5name = "0103081ffc27838a2e50479153ca105e873d3d65d8a9593282e9c94c7e6afb76-libassuan-2.5.7.tar.bz2";
   }
   {
-    name = "libatomic_ops-7.6.8.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/libatomic_ops-7.6.8.tar.gz";
-    sha256 = "1d6a279edf81767e74d2ad2c9fce09459bc65f12c6525a40b0cb3e53c089f665";
+    name = "libatomic_ops-7.8.0.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/libatomic_ops-7.8.0.tar.gz";
+    sha256 = "15676e7674e11bda5a7e50a73f4d9e7d60452271b8acf6fd39a71fefdf89fa31";
     md5 = "";
-    md5name = "1d6a279edf81767e74d2ad2c9fce09459bc65f12c6525a40b0cb3e53c089f665-libatomic_ops-7.6.8.tar.gz";
+    md5name = "15676e7674e11bda5a7e50a73f4d9e7d60452271b8acf6fd39a71fefdf89fa31-libatomic_ops-7.8.0.tar.gz";
   }
   {
     name = "libeot-0.01.tar.bz2";
@@ -476,11 +588,11 @@
     md5name = "d66c56ad259a82cf2a9dfc408b32bf5da52371500b84745f7fb8b645712df676-libffi-3.4.4.tar.gz";
   }
   {
-    name = "libgpg-error-1.43.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/libgpg-error-1.43.tar.bz2";
-    sha256 = "a9ab83ca7acc442a5bd846a75b920285ff79bdb4e3d34aa382be88ed2c3aebaf";
+    name = "libgpg-error-1.48.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/libgpg-error-1.48.tar.bz2";
+    sha256 = "89ce1ae893e122924b858de84dc4f67aae29ffa610ebf668d5aa539045663d6f";
     md5 = "";
-    md5name = "a9ab83ca7acc442a5bd846a75b920285ff79bdb4e3d34aa382be88ed2c3aebaf-libgpg-error-1.43.tar.bz2";
+    md5name = "89ce1ae893e122924b858de84dc4f67aae29ffa610ebf668d5aa539045663d6f-libgpg-error-1.48.tar.bz2";
   }
   {
     name = "liblangtag-0.6.7.tar.bz2";
@@ -497,11 +609,11 @@
     md5name = "5dcb4db3b2340f81f601ce86d8d76b69e34d70f84f804192c901e4b7f84d5fb0-libnumbertext-1.0.11.tar.xz";
   }
   {
-    name = "ltm-1.2.1.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/ltm-1.2.1.tar.xz";
-    sha256 = "986025d7b374276fee2e30e99f3649e4ac0db8a02257a37ee10eae72abed0d1f";
+    name = "ltm-1.3.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/ltm-1.3.0.tar.xz";
+    sha256 = "296272d93435991308eb73607600c034b558807a07e829e751142e65ccfa9d08";
     md5 = "";
-    md5name = "986025d7b374276fee2e30e99f3649e4ac0db8a02257a37ee10eae72abed0d1f-ltm-1.2.1.tar.xz";
+    md5name = "296272d93435991308eb73607600c034b558807a07e829e751142e65ccfa9d08-ltm-1.3.0.tar.xz";
   }
   {
     name = "libwebp-1.3.2.tar.gz";
@@ -511,18 +623,18 @@
     md5name = "2a499607df669e40258e53d0ade8035ba4ec0175244869d1025d460562aa09b4-libwebp-1.3.2.tar.gz";
   }
   {
-    name = "xmlsec1-1.2.37.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/xmlsec1-1.2.37.tar.gz";
-    sha256 = "5f8dfbcb6d1e56bddd0b5ec2e00a3d0ca5342a9f57c24dffde5c796b2be2871c";
+    name = "xmlsec1-1.3.2.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/xmlsec1-1.3.2.tar.gz";
+    sha256 = "4003c56b3d356d21b1db7775318540fad6bfedaf5f117e8f7c010811219be3cf";
     md5 = "";
-    md5name = "5f8dfbcb6d1e56bddd0b5ec2e00a3d0ca5342a9f57c24dffde5c796b2be2871c-xmlsec1-1.2.37.tar.gz";
+    md5name = "4003c56b3d356d21b1db7775318540fad6bfedaf5f117e8f7c010811219be3cf-xmlsec1-1.3.2.tar.gz";
   }
   {
-    name = "libxml2-2.12.5.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libxml2-2.12.5.tar.xz";
-    sha256 = "a972796696afd38073e0f59c283c3a2f5a560b5268b4babc391b286166526b21";
+    name = "libxml2-2.12.8.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libxml2-2.12.8.tar.xz";
+    sha256 = "43ad877b018bc63deb2468d71f95219c2fac196876ef36d1bee51d226173ec93";
     md5 = "";
-    md5name = "a972796696afd38073e0f59c283c3a2f5a560b5268b4babc391b286166526b21-libxml2-2.12.5.tar.xz";
+    md5name = "43ad877b018bc63deb2468d71f95219c2fac196876ef36d1bee51d226173ec93-libxml2-2.12.8.tar.xz";
   }
   {
     name = "libxslt-1.1.39.tar.xz";
@@ -539,18 +651,18 @@
     md5name = "26b3e95ddf3d9c077c480ea45874b3b8-lp_solve_5.5.tar.gz";
   }
   {
-    name = "lxml-4.1.1.tgz";
-    url = "https://dev-www.libreoffice.org/src/lxml-4.1.1.tgz";
-    sha256 = "940caef1ec7c78e0c34b0f6b94fe42d0f2022915ffc78643d28538a5cfd0f40e";
+    name = "lxml-4.9.2.tgz";
+    url = "https://dev-www.libreoffice.org/src/lxml-4.9.2.tgz";
+    sha256 = "2455cfaeb7ac70338b3257f41e21f0724f4b5b0c0e7702da67ee6c3640835b67";
     md5 = "";
-    md5name = "940caef1ec7c78e0c34b0f6b94fe42d0f2022915ffc78643d28538a5cfd0f40e-lxml-4.1.1.tgz";
+    md5name = "2455cfaeb7ac70338b3257f41e21f0724f4b5b0c0e7702da67ee6c3640835b67-lxml-4.9.2.tgz";
   }
   {
-    name = "mariadb-connector-c-3.3.7-src.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/mariadb-connector-c-3.3.7-src.tar.gz";
-    sha256 = "975a9a862fed80f84e0206373f7ef05537aada5b65d99b71b36ab892b44240bf";
+    name = "mariadb-connector-c-3.3.8-src.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/mariadb-connector-c-3.3.8-src.tar.gz";
+    sha256 = "f9f076b4aa9fb22cc94b24f82c80f9ef063805ecd6533a2eb5d5060cf93833e8";
     md5 = "";
-    md5name = "975a9a862fed80f84e0206373f7ef05537aada5b65d99b71b36ab892b44240bf-mariadb-connector-c-3.3.7-src.tar.gz";
+    md5name = "f9f076b4aa9fb22cc94b24f82c80f9ef063805ecd6533a2eb5d5060cf93833e8-mariadb-connector-c-3.3.8-src.tar.gz";
   }
   {
     name = "mdds-2.1.1.tar.xz";
@@ -588,11 +700,11 @@
     md5name = "19279f70707bbe5ffa619f2dc319f888cec0c4a8d339dc0a21330517bd6f521d-mythes-1.2.5.tar.xz";
   }
   {
-    name = "nss-3.98-with-nspr-4.35.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/nss-3.98-with-nspr-4.35.tar.gz";
-    sha256 = "59bb55a59b02e4004fc26ad0aa1a13fe8d73c6c90c447dd2f2efb73fb81083ed";
+    name = "nss-3.99-with-nspr-4.35.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/nss-3.99-with-nspr-4.35.tar.gz";
+    sha256 = "5f29fea64b3234b33a615b6df40469e239a4168ac0909106bd00e6490b274c31";
     md5 = "";
-    md5name = "59bb55a59b02e4004fc26ad0aa1a13fe8d73c6c90c447dd2f2efb73fb81083ed-nss-3.98-with-nspr-4.35.tar.gz";
+    md5name = "5f29fea64b3234b33a615b6df40469e239a4168ac0909106bd00e6490b274c31-nss-3.99-with-nspr-4.35.tar.gz";
   }
   {
     name = "libodfgen-0.1.8.tar.xz";
@@ -616,18 +728,25 @@
     md5name = "8249374c274932a21846fa7629c2aa9b-officeotron-0.7.4-master.jar";
   }
   {
-    name = "openldap-2.6.6.tgz";
-    url = "https://dev-www.libreoffice.org/src/openldap-2.6.6.tgz";
-    sha256 = "082e998cf542984d43634442dbe11da860759e510907152ea579bdc42fe39ea0";
+    name = "onlineupdate-c003be8b9727672e7d30972983b375f4c200233f-2.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/onlineupdate-c003be8b9727672e7d30972983b375f4c200233f-2.tar.xz";
+    sha256 = "37206cf981e8409d048b59ac5839621ea107ff49af72beb9d7769a2f41da8d90";
     md5 = "";
-    md5name = "082e998cf542984d43634442dbe11da860759e510907152ea579bdc42fe39ea0-openldap-2.6.6.tgz";
+    md5name = "37206cf981e8409d048b59ac5839621ea107ff49af72beb9d7769a2f41da8d90-onlineupdate-c003be8b9727672e7d30972983b375f4c200233f-2.tar.xz";
   }
   {
-    name = "openssl-3.0.13.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/openssl-3.0.13.tar.gz";
-    sha256 = "88525753f79d3bec27d2fa7c66aa0b92b3aa9498dafd93d7cfa4b3780cdae313";
+    name = "openldap-2.6.7.tgz";
+    url = "https://dev-www.libreoffice.org/src/openldap-2.6.7.tgz";
+    sha256 = "cd775f625c944ed78a3da18a03b03b08eea73c8aabc97b41bb336e9a10954930";
     md5 = "";
-    md5name = "88525753f79d3bec27d2fa7c66aa0b92b3aa9498dafd93d7cfa4b3780cdae313-openssl-3.0.13.tar.gz";
+    md5name = "cd775f625c944ed78a3da18a03b03b08eea73c8aabc97b41bb336e9a10954930-openldap-2.6.7.tgz";
+  }
+  {
+    name = "openssl-3.0.14.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/openssl-3.0.14.tar.gz";
+    sha256 = "eeca035d4dd4e84fc25846d952da6297484afa0650a6f84c682e39df3a4123ca";
+    md5 = "";
+    md5name = "eeca035d4dd4e84fc25846d952da6297484afa0650a6f84c682e39df3a4123ca-openssl-3.0.14.tar.gz";
   }
   {
     name = "liborcus-0.19.2.tar.xz";
@@ -644,11 +763,11 @@
     md5name = "66adacd705a7d19895e08eac46d1e851332adf2e736c566bef1164e7a442519d-libpagemaker-0.0.4.tar.xz";
   }
   {
-    name = "pdfium-5778.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/pdfium-5778.tar.bz2";
-    sha256 = "b1052ff24e9ffb11af017c444bb0f6ad508d64c9a0fb88cacb0e8210245dde06";
+    name = "pdfium-6179.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/pdfium-6179.tar.bz2";
+    sha256 = "4d3f08fe0e2fda86246832085426616826dcca0912202874428bfbc24d13d95c";
     md5 = "";
-    md5name = "b1052ff24e9ffb11af017c444bb0f6ad508d64c9a0fb88cacb0e8210245dde06-pdfium-5778.tar.bz2";
+    md5name = "4d3f08fe0e2fda86246832085426616826dcca0912202874428bfbc24d13d95c-pdfium-6179.tar.bz2";
   }
   {
     name = "pixman-0.42.2.tar.gz";
@@ -658,11 +777,11 @@
     md5name = "ea1480efada2fd948bc75366f7c349e1c96d3297d09a3fe62626e38e234a625e-pixman-0.42.2.tar.gz";
   }
   {
-    name = "libpng-1.6.40.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/libpng-1.6.40.tar.xz";
-    sha256 = "535b479b2467ff231a3ec6d92a525906fb8ef27978be4f66dbe05d3f3a01b3a1";
+    name = "libpng-1.6.43.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/libpng-1.6.43.tar.xz";
+    sha256 = "6a5ca0652392a2d7c9db2ae5b40210843c0bbc081cbd410825ab00cc59f14a6c";
     md5 = "";
-    md5name = "535b479b2467ff231a3ec6d92a525906fb8ef27978be4f66dbe05d3f3a01b3a1-libpng-1.6.40.tar.xz";
+    md5name = "6a5ca0652392a2d7c9db2ae5b40210843c0bbc081cbd410825ab00cc59f14a6c-libpng-1.6.43.tar.xz";
   }
   {
     name = "tiff-4.6.0.tar.xz";
@@ -742,11 +861,11 @@
     md5name = "798b2ffdc8bcfe7bca2cf92b62caf685-rhino1_5R5.zip";
   }
   {
-    name = "skia-m111-a31e897fb3dcbc96b2b40999751611d029bf5404.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/skia-m111-a31e897fb3dcbc96b2b40999751611d029bf5404.tar.xz";
-    sha256 = "0d08a99ed46cde43b5ad2672b5d8770c8eb85d0d26cb8f1f85fd9befe1e9ceb9";
+    name = "skia-m116-2ddcf183eb260f63698aa74d1bb380f247ad7ccd.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/skia-m116-2ddcf183eb260f63698aa74d1bb380f247ad7ccd.tar.xz";
+    sha256 = "2223ebce534458a37826e8fe4f24635b0712cde7ed1bd3208f089f6fdd796e01";
     md5 = "";
-    md5name = "0d08a99ed46cde43b5ad2672b5d8770c8eb85d0d26cb8f1f85fd9befe1e9ceb9-skia-m111-a31e897fb3dcbc96b2b40999751611d029bf5404.tar.xz";
+    md5name = "2223ebce534458a37826e8fe4f24635b0712cde7ed1bd3208f089f6fdd796e01-skia-m116-2ddcf183eb260f63698aa74d1bb380f247ad7ccd.tar.xz";
   }
   {
     name = "libstaroffice-0.0.7.tar.xz";
@@ -819,10 +938,17 @@
     md5name = "27051a30cb057fdb5d5de65a1f165c7153dc76e27fe62251cbb86639eb2caf22-libzmf-0.0.2.tar.xz";
   }
   {
-    name = "zxing-cpp-2.0.0.tar.gz";
-    url = "https://dev-www.libreoffice.org/src/zxing-cpp-2.0.0.tar.gz";
-    sha256 = "12b76b7005c30d34265fc20356d340da179b0b4d43d2c1b35bcca86776069f76";
+    name = "zxcvbn-c-2.5.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/zxcvbn-c-2.5.tar.gz";
+    sha256 = "77d6c6ecb35952a8d8ce7f736b7a2bf466275c48210e309b73782d6b7e84dffd";
     md5 = "";
-    md5name = "12b76b7005c30d34265fc20356d340da179b0b4d43d2c1b35bcca86776069f76-zxing-cpp-2.0.0.tar.gz";
+    md5name = "77d6c6ecb35952a8d8ce7f736b7a2bf466275c48210e309b73782d6b7e84dffd-zxcvbn-c-2.5.tar.gz";
+  }
+  {
+    name = "zxing-cpp-2.1.0.tar.gz";
+    url = "https://dev-www.libreoffice.org/src/zxing-cpp-2.1.0.tar.gz";
+    sha256 = "6d54e403592ec7a143791c6526c1baafddf4c0897bb49b1af72b70a0f0c4a3fe";
+    md5 = "";
+    md5name = "6d54e403592ec7a143791c6526c1baafddf4c0897bb49b1af72b70a0f0c4a3fe-zxing-cpp-2.1.0.tar.gz";
   }
 ]
diff --git a/pkgs/applications/office/libreoffice/src-still/help.nix b/pkgs/applications/office/libreoffice/src-still/help.nix
index 8bdc4617e148..0f9f54905270 100644
--- a/pkgs/applications/office/libreoffice/src-still/help.nix
+++ b/pkgs/applications/office/libreoffice/src-still/help.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "1l543k603mbr3rnwlnv9j52mblmvkgj9y49w4v7w3xm8b15331rs";
-  url = "https://download.documentfoundation.org/libreoffice/src/7.6.7/libreoffice-help-7.6.7.2.tar.xz";
+  sha256 = "090pi8dnj5izpvng94hgmjid14n7xvy3rlqqvang3pqdn35xnpsl";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.2.5/libreoffice-help-24.2.5.2.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-still/main.nix b/pkgs/applications/office/libreoffice/src-still/main.nix
index d75aeb306351..69376e497a11 100644
--- a/pkgs/applications/office/libreoffice/src-still/main.nix
+++ b/pkgs/applications/office/libreoffice/src-still/main.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "159vbv4zhibfd4xjdamcqs4h0p3h5y79kcjwrmshvjhs23p55l3m";
-  url = "https://download.documentfoundation.org/libreoffice/src/7.6.7/libreoffice-7.6.7.2.tar.xz";
+  sha256 = "03halzc9w4z8pfs8krpswp2qzrqq9rhnmms8v8ny88am87vy85lw";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.2.5/libreoffice-24.2.5.2.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-still/translations.nix b/pkgs/applications/office/libreoffice/src-still/translations.nix
index fffb89108f09..b96943060182 100644
--- a/pkgs/applications/office/libreoffice/src-still/translations.nix
+++ b/pkgs/applications/office/libreoffice/src-still/translations.nix
@@ -1,5 +1,5 @@
 { fetchurl, ... }:
 fetchurl {
-  sha256 = "1bzmpa04bv8afhl3p68dlicamh0zyckmbdgqb3v72fjmx2h8i64a";
-  url = "https://download.documentfoundation.org/libreoffice/src/7.6.7/libreoffice-translations-7.6.7.2.tar.xz";
+  sha256 = "0fri41y59zhm8lq0kh6hvf5rpdjdqx0lg1sl40mhh1d6lf1izc1w";
+  url = "https://download.documentfoundation.org/libreoffice/src/24.2.5/libreoffice-translations-24.2.5.2.tar.xz";
 }
diff --git a/pkgs/applications/office/libreoffice/src-still/version.nix b/pkgs/applications/office/libreoffice/src-still/version.nix
index d7fc5122189f..ede95eca68ce 100644
--- a/pkgs/applications/office/libreoffice/src-still/version.nix
+++ b/pkgs/applications/office/libreoffice/src-still/version.nix
@@ -1 +1 @@
-"7.6.7.2"
+"24.2.5.2"
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
index 60ef72756c34..9a431ad88530 100644
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "17.2.2",
-  "repo_hash": "1gk29bwd6vzikjg28p30wgdq9a46l4qbnac5r0h2mwih1sm8hlbc",
+  "version": "17.2.4",
+  "repo_hash": "0hj1v7w68axzdy2lwwc320zpg2r2qv2f9rl23yisni6975p03ayi",
   "yarn_hash": "10y540bxwaz355p9r4q34199aibadrd5p4d9ck2y3n6735k0hm74",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v17.2.2-ee",
+  "rev": "v17.2.4-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "17.2.2",
-    "GITLAB_PAGES_VERSION": "17.2.2",
+    "GITALY_SERVER_VERSION": "17.2.4",
+    "GITLAB_PAGES_VERSION": "17.2.4",
     "GITLAB_SHELL_VERSION": "14.37.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.2.0",
-    "GITLAB_WORKHORSE_VERSION": "17.2.2"
+    "GITLAB_WORKHORSE_VERSION": "17.2.4"
   }
 }
diff --git a/pkgs/applications/version-management/gitlab/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index ab137a045933..c469613ec647 100644
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "17.2.2";
+  version = "17.2.4";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -20,7 +20,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-4K0unlvhAnTIiuyRUNm0dXG5sJsxIuo8HkUQvUK7ws4=";
+      hash = "sha256-Y+Yi5kH/0s+yMuD/90Tdxeshp9m0Mrx080jmWnq/zZ0=";
     };
 
     vendorHash = "sha256-FqnGVRldhevJgBBvJcvGXzRaYWqSHzZiXIQmCNzJv+4=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
index 5c934a5afc83..0fecac629883 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "17.2.2";
+  version = "17.2.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-AtLsy2hHxqr3XyTItLfMoTmrUsM707Kme7jE2jAAfyc=";
+    hash = "sha256-7sB2MjU1iwqrOK8dNb7a14NFtrJ/7yoT07tzYVyCSJ8=";
   };
 
   vendorHash = "sha256-yNHeM8MExcLwv2Ga4vtBmPFBt/Rj7Gd4QQYDlnAIo+c=";
diff --git a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 77ba5813469d..a7d2c7d2c0fd 100644
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "17.2.2";
+  version = "17.2.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/applications/video/mplayer/default.nix b/pkgs/applications/video/mplayer/default.nix
index 6b546b5111eb..44654ae591b7 100644
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@@ -1,4 +1,4 @@
-{ config, lib, stdenv, fetchurl, fetchsvn, pkg-config, freetype, yasm, ffmpeg_6
+{ config, lib, stdenv, fetchurl, fetchsvn, pkg-config, freetype, yasm, ffmpeg_7
 , aalibSupport ? true, aalib
 , fontconfigSupport ? true, fontconfig, freefont_ttf
 , fribidiSupport ? true, fribidi
@@ -86,7 +86,7 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ pkg-config yasm ];
-  buildInputs = [ freetype ffmpeg_6 ]
+  buildInputs = [ freetype ffmpeg_7 ]
     ++ lib.optional aalibSupport aalib
     ++ lib.optional fontconfigSupport fontconfig
     ++ lib.optional fribidiSupport fribidi
diff --git a/pkgs/by-name/bi/bitwarden-desktop/package.nix b/pkgs/by-name/bi/bitwarden-desktop/package.nix
index 1e237c32aa63..2ce70a8372cf 100644
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -3,7 +3,7 @@
 , cargo
 , copyDesktopItems
 , dbus
-, electron_29
+, electron_31
 , fetchFromGitHub
 , glib
 , gnome-keyring
@@ -12,7 +12,6 @@
 , libsecret
 , makeDesktopItem
 , makeWrapper
-, moreutils
 , napi-rs-cli
 , nodejs_20
 , patchutils_0_4_2
@@ -26,41 +25,28 @@
 let
   description = "Secure and free password manager for all of your devices";
   icon = "bitwarden";
-  electron = electron_29;
+  electron = electron_31;
 in buildNpmPackage rec {
   pname = "bitwarden-desktop";
-  version = "2024.6.4";
+  version = "2024.8.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-oQ2VZoxePdYUC+xMKlRMpvPubSPULvt31XSh/OBw3Ec=";
+    hash = "sha256-szIa7fASDmeWKZPc6HtHKeXKerCAXrYZQWTVFMugAxk=";
   };
 
   patches = [
     ./electron-builder-package-lock.patch
   ];
 
-  # The nested package-lock.json from upstream is out-of-date, so copy the
-  # lock metadata from the root package-lock.json.
-  postPatch = ''
-    cat {,apps/desktop/src/}package-lock.json \
-      | ${lib.getExe jq} -s '
-        .[1].packages."".dependencies.argon2 = .[0].packages."".dependencies.argon2
-          | .[0].packages."" = .[1].packages.""
-          | .[1].packages = .[0].packages
-          | .[1]
-        ' \
-      | ${moreutils}/bin/sponge apps/desktop/src/package-lock.json
-  '';
-
   nodejs = nodejs_20;
 
   makeCacheWritable = true;
   npmFlags = [ "--engine-strict" "--legacy-peer-deps" ];
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-9d9pWrFYelAx/PPDHY3m92Frp8RSQuBqpiOjmWtm/1g=";
+  npmDepsHash = "sha256-5neEpU7ZhVO5OR181owsvAnFfl7lr0MymvqbRFCPs3M=";
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     name = "${pname}-${version}";
@@ -76,7 +62,7 @@ in buildNpmPackage rec {
       patches;
     patchFlags = [ "-p4" ];
     sourceRoot = "${src.name}/${cargoRoot}";
-    hash = "sha256-ZmblY1APVa8moAR1waVBZPhrf5Wt1Gi6dvAxkhizckQ=";
+    hash = "sha256-ya/5z5XpsyuWayziLxuETu/dY8LzZspaAMqL2p8jYN8=";
   };
   cargoRoot = "apps/desktop/desktop_native";
 
@@ -87,10 +73,9 @@ in buildNpmPackage rec {
     copyDesktopItems
     jq
     makeWrapper
-    moreutils
     napi-rs-cli
     pkg-config
-    python3
+    (python3.withPackages (ps: with ps; [ setuptools ]))
     rustc
     rustPlatform.cargoCheckHook
     rustPlatform.cargoSetupHook
@@ -102,18 +87,36 @@ in buildNpmPackage rec {
     libsecret
   ];
 
+  # node-argon2 builds with LTO, but that causes missing symbols. So disable it
+  # and rebuild. Then we need to copy it into the build output for
+  # electron-builder, as `apps/desktop/src/package.json` specifies `argon2` as
+  # a dependency and electron-builder will otherwise install a fresh (and
+  # broken) argon2. See https://github.com/ranisalt/node-argon2/pull/415
+  preConfigure = ''
+    pushd node_modules/argon2
+    substituteInPlace binding.gyp --replace-fail '"-flto", ' ""
+    "$npm_config_node_gyp" rebuild
+    popd
+    mkdir -p apps/desktop/build/node_modules
+    cp -r ./{,apps/desktop/build/}node_modules/argon2
+  '';
+
   preBuild = ''
     if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '^[0-9]+') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
       echo 'ERROR: electron version mismatch'
       exit 1
     fi
+
+    pushd apps/desktop/desktop_native/napi
+    npm run build
+    popd
   '';
 
   postBuild = ''
     pushd apps/desktop
 
     # desktop_native/index.js loads a file of that name regarldess of the libc being used
-    mv desktop_native/desktop_native.* desktop_native/desktop_native.linux-x64-musl.node
+    mv desktop_native/napi/desktop_napi.* desktop_native/napi/desktop_napi.linux-x64-musl.node
 
     npm exec electron-builder -- \
       --dir \
diff --git a/pkgs/by-name/bl/blanket/package.nix b/pkgs/by-name/bl/blanket/package.nix
index 72cb5c8faa65..a89dfeec382f 100644
--- a/pkgs/by-name/bl/blanket/package.nix
+++ b/pkgs/by-name/bl/blanket/package.nix
@@ -53,7 +53,7 @@ python3Packages.buildPythonApplication rec {
   postPatch = ''
     patchShebangs build-aux/meson/postinstall.py
     substituteInPlace build-aux/meson/postinstall.py \
-      --replace gtk-update-icon-cache gtk4-update-icon-cache
+      --replace-fail gtk-update-icon-cache gtk4-update-icon-cache
   '';
 
   dontWrapGApps = true;
diff --git a/pkgs/by-name/ge/gensort/package.nix b/pkgs/by-name/ge/gensort/package.nix
new file mode 100644
index 000000000000..fb15fa009dc4
--- /dev/null
+++ b/pkgs/by-name/ge/gensort/package.nix
@@ -0,0 +1,45 @@
+{
+  fetchurl,
+  lib,
+  zlib,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  name = "gensort";
+  version = "1.5";
+
+  src = fetchurl {
+    url = "https://www.ordinal.com/try.cgi/gensort-${finalAttrs.version}.tar.gz";
+    hash = "sha256-f3VzeD2CmM7z3Uqh24IlyRTeGgz+0oOWXqILaYOKZ60=";
+  };
+
+  buildInputs = [
+    zlib
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 gensort $out/bin/gensort
+    install -Dm755 valsort $out/bin/valsort
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Generate and validate records for the sorting benchmark";
+    longDescription = ''
+      The gensort program can be used to generate input records for the sort
+      benchmarks presented on www.sortbenchmark.org.
+
+      The valsort program can be used to validate the sort output file is
+      correct.
+    '';
+    homepage = "https://www.ordinal.com/gensort.html";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ zimeg ];
+    mainProgram = "gensort";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/op/openllm/package.nix b/pkgs/by-name/op/openllm/package.nix
new file mode 100644
index 000000000000..f25286d4608b
--- /dev/null
+++ b/pkgs/by-name/op/openllm/package.nix
@@ -0,0 +1,76 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+}:
+let
+  python = python3.override {
+    self = python;
+    packageOverrides = _: super: {
+      cattrs = super.cattrs.overridePythonAttrs (oldAttrs: rec {
+        version = "23.1.2";
+        build-system = [ super.poetry-core ];
+        src = oldAttrs.src.override {
+          rev = "refs/tags/v${version}";
+          hash = "sha256-YO4Clbo5fmXbysxwwM2qCHJwO5KwDC05VctRVFruJcw=";
+        };
+      });
+    };
+  };
+in
+
+python.pkgs.buildPythonApplication rec {
+  pname = "openllm";
+  version = "0.6.10";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bentoml";
+    repo = "openllm";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4KIpe6KjbBDDUj0IjzSccxjgZyBoaUVIQJYk1+W01Vo=";
+  };
+
+  pythonRemoveDeps = [
+    "pathlib"
+    "pip-requirements-parser"
+  ];
+
+  pythonRelaxDeps = [ "openai" ];
+
+  build-system = with python.pkgs; [
+    hatch-vcs
+    hatchling
+  ];
+
+  dependencies = with python.pkgs; [
+    accelerate
+    bentoml
+    dulwich
+    nvidia-ml-py
+    openai
+    psutil
+    pyaml
+    questionary
+    tabulate
+    typer
+    uv
+  ];
+
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "openllm" ];
+
+  meta = with lib; {
+    description = "Run any open-source LLMs, such as Llama 3.1, Gemma, as OpenAI compatible API endpoint in the cloud";
+    homepage = "https://github.com/bentoml/OpenLLM";
+    changelog = "https://github.com/bentoml/OpenLLM/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [
+      happysalada
+      natsukium
+    ];
+    mainProgram = "openllm";
+  };
+}
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index ccac7bdabd02..42eaecec89b1 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -5,11 +5,11 @@
 
 renode.overrideAttrs (finalAttrs: _: {
   pname = "renode-unstable";
-  version = "1.15.1+20240816gitb8fc56b69";
+  version = "1.15.2+20240823gitc4eea992a";
 
   src = fetchurl {
     url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-dotnet.tar.gz";
-    hash = "sha256-3J70pjIrGGQLDlVkKuPYjL7HcjrN9H/xF7248BaMwAs=";
+    hash = "sha256-y5y3jvTn3QPVODqX1IX4qq9LjRoxdTYJ68kURRfGCX8=";
   };
 
   passthru.updateScript =
diff --git a/pkgs/data/fonts/iosevka/comfy.nix b/pkgs/data/fonts/iosevka/comfy.nix
index 63dfca58d544..65d44c25e9d0 100644
--- a/pkgs/data/fonts/iosevka/comfy.nix
+++ b/pkgs/data/fonts/iosevka/comfy.nix
@@ -20,12 +20,12 @@ let
     "comfy-wide-motion-fixed" # Slab   | Wide    | Monospaced | No        |
     "comfy-wide-motion-duo" # | Slab   | Wide    | Duospaced  | Yes       |
   ];
-  version = "1.4.0";
+  version = "2.0.0";
   src = fetchFromGitHub {
     owner = "protesilaos";
     repo = "iosevka-comfy";
     rev = version;
-    sha256 = "sha256-kfEEJ6F1/dsG9CSLWcr0QOOnQxHPgPgb4QhgFrHTklE=";
+    sha256 = "sha256-wDcBaNXIzOQ3/LBuW3YUnx/fjtJMeI+jsxLRBlsd1M0=";
   };
   privateBuildPlan = src.outPath + "/private-build-plans.toml";
   makeIosevkaFont = set:
@@ -40,19 +40,11 @@ let
           src = fetchFromGitHub {
             owner = "be5invis";
             repo = "iosevka";
-            rev = "f6e57fbf0b1242ad3069d45c815d79b9d68871a2";
-            hash = "sha256-cS3SCKzUjVXF+n0Rt5eBLzieATB7W+hwEbzh6OQrMo4=";
+            rev = "v31.3.0";
+            hash = "sha256-WrRxVrBJeyUwv0/DYTIHLi52+k2PilC7ay0tc5yq3Pw=";
           };
 
-          npmDepsHash = "sha256-c+ltdh5e3+idclYfqp0Xh9IUwoj7XYP1uzJG6+a5gFU=";
-
-          installPhase = ''
-            runHook preInstall
-            fontdir="$out/share/fonts/truetype"
-            install -d "$fontdir"
-            install "dist/$pname/ttf"/* "$fontdir"
-            runHook postInstall
-          '';
+          npmDepsHash = "sha256-xw0GA1aIA/J5hfLQBSE+GJzXfbfWQI2k2pYdenlM9NY=";
 
           meta = with lib; {
             inherit (src.meta) homepage;
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 92156dec54ea..38a553ec8669 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -8,14 +8,11 @@
 , gstreamer
 , gst-plugins-base
 , gettext
-, libav
+, ffmpeg-headless
 # Checks meson.is_cross_build(), so even canExecute isn't enough.
 , enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform, hotdoc
 }:
 
-# Note that since gst-libav-1.6, libav is actually ffmpeg. See
-# https://gstreamer.freedesktop.org/releases/1.6/ for more info.
-
 stdenv.mkDerivation rec {
   pname = "gst-libav";
   version = "1.24.3";
@@ -40,7 +37,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gstreamer
     gst-plugins-base
-    libav
+    ffmpeg-headless
   ];
 
   mesonFlags = [
@@ -53,7 +50,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description = "FFmpeg/libav plugin for GStreamer";
+    description = "FFmpeg plugin for GStreamer";
     homepage = "https://gstreamer.freedesktop.org";
     license = licenses.lgpl2Plus;
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/lasso/default.nix b/pkgs/development/libraries/lasso/default.nix
index e3f91c3d827c..7b2965f1f730 100644
--- a/pkgs/development/libraries/lasso/default.nix
+++ b/pkgs/development/libraries/lasso/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv
 , autoreconfHook
 , fetchurl
+, fetchpatch
 , glib
 , gobject-introspection
 , gtk-doc
@@ -23,6 +24,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-ahgxv9v49CTHUIq6R7BF1RNB7A/ekSLziwuGsJbvUz4=";
   };
 
+  patches = [
+    # Fix build with xmlsec 1.3.0
+    (fetchpatch {
+      url = "https://git.entrouvert.org/entrouvert/lasso/commit/ffaddeb015a61db3e52c391de00430107a23e2f1.patch";
+      hash = "sha256-D2npxpIuR/KrNYiKO3KXCvHEb/XVXUKIP0HQUd+w56k=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/development/libraries/libav/default.nix b/pkgs/development/libraries/libav/default.nix
deleted file mode 100644
index 8cc098d81087..000000000000
--- a/pkgs/development/libraries/libav/default.nix
+++ /dev/null
@@ -1,137 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config, yasm, bzip2, zlib, perl, bash
-, mp3Support    ? true,   lame      ? null
-, speexSupport  ? true,   speex     ? null
-, theoraSupport ? true,   libtheora ? null
-, vorbisSupport ? true,   libvorbis ? null
-, vpxSupport    ? true,   libvpx    ? null
-, x264Support   ? false,  x264      ? null
-, xvidSupport   ? true,   xvidcore  ? null
-, faacSupport   ? false,  faac      ? null
-, vaapiSupport  ? true,   libva     ? null
-, vdpauSupport  ? true,   libvdpau  ? null
-, freetypeSupport ? true, freetype  ? null # it's small and almost everywhere
-, SDL # only for avplay in $bin, adds nontrivial closure to it
-, enableGPL ? true # ToDo: some additional default stuff may need GPL
-, enableUnfree ? faacSupport
-}:
-
-assert faacSupport -> enableUnfree;
-
-let inherit (lib) optional optionals hasPrefix enableFeature; in
-
-/* ToDo:
-    - more deps, inspiration: https://packages.ubuntu.com/raring/libav-tools
-    - maybe do some more splitting into outputs
-*/
-
-let
-  result = {
-    # e.g. https://libav.org/releases/libav-11.11.tar.xz.sha1
-    libav_0_8 = libavFun "0.8.21" "d858f65128dad0bac1a8c3a51e5cbb27a7c79b3f";
-    libav_11  = libavFun "11.12"  "61d5dcab5fde349834af193a572b12a5fd6a4d42";
-    libav_12  = libavFun "12.3"   "386c18c8b857f23dfcf456ce40370716130211d9";
-  };
-
-  libavFun = version : sha1 : stdenv.mkDerivation rec {
-    pname = "libav";
-    inherit version;
-
-    src = fetchurl {
-      url = "${meta.homepage}/releases/${pname}-${version}.tar.xz";
-      inherit sha1; # upstream directly provides sha1 of releases over https
-    };
-
-    patches = []
-      ++ optional (vpxSupport && hasPrefix "0.8." version) ./vpxenc-0.8.17-libvpx-1.5.patch
-      ++ optional (vpxSupport && hasPrefix "12." version) ./vpx-12.3-libvpx-1.8.patch
-      ;
-
-    postPatch = ''
-      patchShebangs .
-      # another shebang was hidden in a here document text
-      substituteInPlace ./configure --replace "#! /bin/sh" "#!${bash}/bin/sh"
-    '';
-
-    configurePlatforms = [];
-    configureFlags = assert lib.all (x: x!=null) buildInputs; [
-      "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
-      "--target_os=${stdenv.hostPlatform.parsed.kernel.name}"
-      #"--enable-postproc" # it's now a separate package in upstream
-      "--disable-avserver" # upstream says it's in a bad state
-      "--enable-avplay"
-      "--enable-shared"
-      "--enable-runtime-cpudetect"
-      "--cc=${stdenv.cc.targetPrefix}cc"
-      (enableFeature enableGPL "gpl")
-      (enableFeature enableGPL "swscale")
-      (enableFeature mp3Support "libmp3lame")
-      (enableFeature mp3Support "libmp3lame")
-      (enableFeature speexSupport "libspeex")
-      (enableFeature theoraSupport "libtheora")
-      (enableFeature vorbisSupport "libvorbis")
-      (enableFeature vpxSupport "libvpx")
-      (enableFeature x264Support "libx264")
-      (enableFeature xvidSupport "libxvid")
-      (enableFeature faacSupport "libfaac")
-      (enableFeature faacSupport "nonfree")
-      (enableFeature vaapiSupport "vaapi")
-      (enableFeature vdpauSupport "vdpau")
-      (enableFeature freetypeSupport "libfreetype")
-    ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      "--cross-prefix=${stdenv.cc.targetPrefix}"
-      "--enable-cross-compile"
-    ];
-
-  nativeBuildInputs = [ pkg-config perl ];
-    buildInputs = [ lame yasm zlib bzip2 SDL bash ]
-      ++ [ perl ] # for install-man target
-      ++ optional mp3Support lame
-      ++ optional speexSupport speex
-      ++ optional theoraSupport libtheora
-      ++ optional vorbisSupport libvorbis
-      ++ optional vpxSupport libvpx
-      ++ optional x264Support x264
-      ++ optional xvidSupport xvidcore
-      ++ optional faacSupport faac
-      ++ optional vaapiSupport libva
-      ++ optional vdpauSupport libvdpau
-      ++ optional freetypeSupport freetype
-      ;
-
-    enableParallelBuilding = true;
-
-    outputs = [ "bin" "dev" "out" ];
-    setOutputFlags = false;
-
-    # alltools to build smaller tools, incl. aviocat, ismindex, qt-faststart, etc.
-    buildFlags = [ "all" "alltools" "install-man" ];
-
-
-    postInstall = ''
-      moveToOutput bin "$bin"
-      # alltools target compiles an executable in tools/ for every C
-      # source file in tools/, so move those to $out
-      for tool in $(find tools -type f -executable); do
-        mv "$tool" "$bin/bin/"
-      done
-    '';
-
-    doInstallCheck = false; # fails randomly
-    installCheckTarget = "check"; # tests need to be run *after* installation
-
-    passthru = { inherit vdpauSupport; };
-
-    meta = with lib; {
-      homepage = "https://libav.org/";
-      description = "Complete, cross-platform solution to record, convert and stream audio and video (fork of ffmpeg)";
-      license = with licenses; if enableUnfree then unfree #ToDo: redistributable or not?
-        else if enableGPL then gpl2Plus else lgpl21Plus;
-      platforms = with platforms; linux ++ darwin;
-      knownVulnerabilities =
-        lib.optional (lib.versionOlder version "12.1") "CVE-2017-9051"
-        ++ lib.optionals (lib.versionOlder version "12.3") [ "CVE-2018-5684" "CVE-2018-5766" ]
-        ++ lib.optionals (lib.versionOlder version "12.4") [ "CVE-2019-9717" "CVE-2019-9720" ];
-    };
-  }; # libavFun
-
-in result
diff --git a/pkgs/development/libraries/libav/vpx-12.3-libvpx-1.8.patch b/pkgs/development/libraries/libav/vpx-12.3-libvpx-1.8.patch
deleted file mode 100644
index 8f8e5003284f..000000000000
--- a/pkgs/development/libraries/libav/vpx-12.3-libvpx-1.8.patch
+++ /dev/null
@@ -1,46 +0,0 @@
---- libav/libavcodec/libvpx.c.orig	2018-02-12 21:25:59 UTC
-+++ libav/libavcodec/libvpx.c
-@@ -25,6 +25,7 @@
- enum AVPixelFormat ff_vpx_imgfmt_to_pixfmt(vpx_img_fmt_t img)
- {
-     switch (img) {
-+#if VPX_IMAGE_ABI_VERSION < 5
-     case VPX_IMG_FMT_RGB24:     return AV_PIX_FMT_RGB24;
-     case VPX_IMG_FMT_RGB565:    return AV_PIX_FMT_RGB565BE;
-     case VPX_IMG_FMT_RGB555:    return AV_PIX_FMT_RGB555BE;
-@@ -36,10 +37,13 @@ enum AVPixelFormat ff_vpx_imgfmt_to_pixfmt(vpx_img_fmt
-     case VPX_IMG_FMT_ARGB_LE:   return AV_PIX_FMT_BGRA;
-     case VPX_IMG_FMT_RGB565_LE: return AV_PIX_FMT_RGB565LE;
-     case VPX_IMG_FMT_RGB555_LE: return AV_PIX_FMT_RGB555LE;
-+#endif
-     case VPX_IMG_FMT_I420:      return AV_PIX_FMT_YUV420P;
-     case VPX_IMG_FMT_I422:      return AV_PIX_FMT_YUV422P;
-     case VPX_IMG_FMT_I444:      return AV_PIX_FMT_YUV444P;
-+#if VPX_IMAGE_ABI_VERSION < 5
-     case VPX_IMG_FMT_444A:      return AV_PIX_FMT_YUVA444P;
-+#endif
- #if VPX_IMAGE_ABI_VERSION >= 3
-     case VPX_IMG_FMT_I440:      return AV_PIX_FMT_YUV440P;
-     case VPX_IMG_FMT_I42016:    return AV_PIX_FMT_YUV420P16BE;
-@@ -53,6 +57,7 @@ enum AVPixelFormat ff_vpx_imgfmt_to_pixfmt(vpx_img_fmt
- vpx_img_fmt_t ff_vpx_pixfmt_to_imgfmt(enum AVPixelFormat pix)
- {
-     switch (pix) {
-+#if VPX_IMAGE_ABI_VERSION < 5
-     case AV_PIX_FMT_RGB24:        return VPX_IMG_FMT_RGB24;
-     case AV_PIX_FMT_RGB565BE:     return VPX_IMG_FMT_RGB565;
-     case AV_PIX_FMT_RGB555BE:     return VPX_IMG_FMT_RGB555;
-@@ -64,10 +69,13 @@ vpx_img_fmt_t ff_vpx_pixfmt_to_imgfmt(enum AVPixelForm
-     case AV_PIX_FMT_BGRA:         return VPX_IMG_FMT_ARGB_LE;
-     case AV_PIX_FMT_RGB565LE:     return VPX_IMG_FMT_RGB565_LE;
-     case AV_PIX_FMT_RGB555LE:     return VPX_IMG_FMT_RGB555_LE;
-+#endif
-     case AV_PIX_FMT_YUV420P:      return VPX_IMG_FMT_I420;
-     case AV_PIX_FMT_YUV422P:      return VPX_IMG_FMT_I422;
-     case AV_PIX_FMT_YUV444P:      return VPX_IMG_FMT_I444;
-+#if VPX_IMAGE_ABI_VERSION < 5
-     case AV_PIX_FMT_YUVA444P:     return VPX_IMG_FMT_444A;
-+#endif
- #if VPX_IMAGE_ABI_VERSION >= 3
-     case AV_PIX_FMT_YUV440P:      return VPX_IMG_FMT_I440;
-     case AV_PIX_FMT_YUV420P16BE:  return VPX_IMG_FMT_I42016;
diff --git a/pkgs/development/libraries/libav/vpxenc-0.8.17-libvpx-1.5.patch b/pkgs/development/libraries/libav/vpxenc-0.8.17-libvpx-1.5.patch
deleted file mode 100644
index 456828c025ef..000000000000
--- a/pkgs/development/libraries/libav/vpxenc-0.8.17-libvpx-1.5.patch
+++ /dev/null
@@ -1,22 +0,0 @@
---- a/libavcodec/libvpxenc.c	2016-05-01 17:57:16.753852614 +0200
-+++ b/libavcodec/libvpxenc.c	2016-05-01 18:01:08.252147138 +0200
-@@ -67,19 +67,11 @@
- 
- /** String mappings for enum vp8e_enc_control_id */
- static const char *ctlidstr[] = {
--    [VP8E_UPD_ENTROPY]           = "VP8E_UPD_ENTROPY",
--    [VP8E_UPD_REFERENCE]         = "VP8E_UPD_REFERENCE",
--    [VP8E_USE_REFERENCE]         = "VP8E_USE_REFERENCE",
--    [VP8E_SET_ROI_MAP]           = "VP8E_SET_ROI_MAP",
--    [VP8E_SET_ACTIVEMAP]         = "VP8E_SET_ACTIVEMAP",
--    [VP8E_SET_SCALEMODE]         = "VP8E_SET_SCALEMODE",
-     [VP8E_SET_CPUUSED]           = "VP8E_SET_CPUUSED",
-     [VP8E_SET_ENABLEAUTOALTREF]  = "VP8E_SET_ENABLEAUTOALTREF",
-     [VP8E_SET_NOISE_SENSITIVITY] = "VP8E_SET_NOISE_SENSITIVITY",
--    [VP8E_SET_SHARPNESS]         = "VP8E_SET_SHARPNESS",
-     [VP8E_SET_STATIC_THRESHOLD]  = "VP8E_SET_STATIC_THRESHOLD",
-     [VP8E_SET_TOKEN_PARTITIONS]  = "VP8E_SET_TOKEN_PARTITIONS",
--    [VP8E_GET_LAST_QUANTIZER]    = "VP8E_GET_LAST_QUANTIZER",
-     [VP8E_SET_ARNR_MAXFRAMES]    = "VP8E_SET_ARNR_MAXFRAMES",
-     [VP8E_SET_ARNR_STRENGTH]     = "VP8E_SET_ARNR_STRENGTH",
-     [VP8E_SET_ARNR_TYPE]         = "VP8E_SET_ARNR_TYPE",
diff --git a/pkgs/development/libraries/libndctl/default.nix b/pkgs/development/libraries/libndctl/default.nix
index 6e82191e7558..d2ccec80a570 100644
--- a/pkgs/development/libraries/libndctl/default.nix
+++ b/pkgs/development/libraries/libndctl/default.nix
@@ -1,50 +1,76 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook
-, asciidoc, pkg-config, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt
-, json_c, kmod, which, util-linux, udev, keyutils
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  asciidoctor,
+  iniparser,
+  json_c,
+  keyutils,
+  kmod,
+  udev,
+  util-linux,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libndctl";
-  version = "71.1";
+  version = "79";
 
   src = fetchFromGitHub {
-    owner  = "pmem";
-    repo   = "ndctl";
-    rev    = "v${version}";
-    sha256 = "sha256-osux3DiKRh8ftHwyfFI+WSFx20+yJsg1nVx5nuoKJu4=";
+    owner = "pmem";
+    repo = "ndctl";
+    rev = "v${version}";
+    sha256 = "sha256-gG1Rz5AtDLzikGFr8A3l25ypd+VoLw2oWjszy9ogDLk=";
   };
 
-  outputs = [ "out" "lib" "man" "dev" ];
+  outputs = [
+    "out"
+    "man"
+    "dev"
+  ];
 
-  nativeBuildInputs =
-    [ autoreconfHook asciidoc pkg-config xmlto docbook_xml_dtd_45 docbook_xsl libxslt
-      which
-    ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    asciidoctor
+  ];
 
-  buildInputs =
-    [ json_c kmod util-linux udev keyutils
-    ];
+  buildInputs = [
+    iniparser
+    json_c
+    keyutils
+    kmod
+    udev
+    util-linux
+  ];
 
-  configureFlags =
-    [ "--without-bash"
-      "--without-systemd"
-      "--disable-asciidoctor" # depends on ruby 2.7, use asciidoc instead
-    ];
+  mesonFlags = [
+    (lib.mesonOption "rootprefix" "${placeholder "out"}")
+    (lib.mesonOption "sysconfdir" "${placeholder "out"}/etc/ndctl.conf.d")
+    (lib.mesonEnable "libtracefs" false)
+    # Use asciidoctor due to xmlto errors
+    (lib.mesonEnable "asciidoctor" true)
+    (lib.mesonEnable "systemd" false)
+    (lib.mesonOption "iniparserdir" "${iniparser}")
+  ];
 
-  patchPhase = ''
+  postPatch = ''
     patchShebangs test
 
-    substituteInPlace git-version --replace /bin/bash ${stdenv.shell}
-    substituteInPlace git-version-gen --replace /bin/sh ${stdenv.shell}
+    substituteInPlace git-version --replace-fail /bin/bash ${stdenv.shell}
+    substituteInPlace git-version-gen --replace-fail /bin/sh ${stdenv.shell}
 
     echo "m4_define([GIT_VERSION], [${version}])" > version.m4;
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Tools for managing the Linux Non-Volatile Memory Device sub-system";
-    homepage    = "https://github.com/pmem/ndctl";
-    license     = licenses.lgpl21;
-    maintainers = with maintainers; [ thoughtpolice ];
-    platforms   = platforms.linux;
+    homepage = "https://github.com/pmem/ndctl";
+    license = lib.licenses.lgpl21;
+    maintainers = with lib.maintainers; [ thoughtpolice ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/development/libraries/nghttp3/default.nix b/pkgs/development/libraries/nghttp3/default.nix
index cff650f5971d..2a264dbe6c46 100644
--- a/pkgs/development/libraries/nghttp3/default.nix
+++ b/pkgs/development/libraries/nghttp3/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nghttp3";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ZbgByLTkQWd3gfWW2V1kkboblfF9v+0HcNhxrjYpX28=";
+    hash = "sha256-sVEMFTe3+r11yz4gzV+0VC8ngaanoj27DLW5hakyc4Y=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/rocksdb/default.nix b/pkgs/development/libraries/rocksdb/default.nix
index b8b30e585f6e..fddb72fa7be8 100644
--- a/pkgs/development/libraries/rocksdb/default.nix
+++ b/pkgs/development/libraries/rocksdb/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocksdb";
-  version = "9.4.0";
+  version = "9.5.2";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "rocksdb";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-eABOzOuaSMAipX8yuXDfZPTHDyIInyPzreE42MwAcYg=";
+    hash = "sha256-+0gUtWhvCBISm0/67ylynNfihxbIg5wFh1gOOQp4sCI=";
   };
 
   patches = lib.optional (lib.versionAtLeast finalAttrs.version "6.29.3" && enableLiburing) ./fix-findliburing.patch;
diff --git a/pkgs/development/libraries/xmlsec/default.nix b/pkgs/development/libraries/xmlsec/default.nix
index c0194ed8435d..8040cf25813c 100644
--- a/pkgs/development/libraries/xmlsec/default.nix
+++ b/pkgs/development/libraries/xmlsec/default.nix
@@ -1,25 +1,21 @@
-{ stdenv, fetchurl, fetchpatch, libxml2, gnutls, libxslt, pkg-config, libgcrypt, libtool
+{ stdenv, fetchurl, libxml2, gnutls, libxslt, pkg-config, libgcrypt, libtool
 , openssl, nss, lib, runCommandCC, writeText }:
 
 lib.fix (self:
 stdenv.mkDerivation rec {
   pname = "xmlsec";
-  version = "1.2.34";
+  version = "1.3.5";
 
   src = fetchurl {
     url = "https://www.aleksey.com/xmlsec/download/xmlsec1-${version}.tar.gz";
-    sha256 = "sha256-Us7UlD81vX0IGKOCmMFSjKSsilRED9cRNKB9LRNwomI=";
+    sha256 = "sha256-L/1K0fhg7JPkemgDEKsryUlovQdWbnGXa9lhM9lQSRc=";
   };
 
   patches = [
     ./lt_dladdsearchdir.patch
+    ./remove_bsd_base64_decode_flag.patch
+  ];
 
-    # Fix build with libxml2 2.12
-    (fetchpatch {
-      url = "https://github.com/lsh123/xmlsec/commit/ffb327376f5bb69e8dfe7f805529e45a40118c2b.patch";
-      hash = "sha256-o8CLemOiGIHJsYfVQtNzJNVyk03fdmCbvgA8c3OYxo4=";
-    })
-  ] ++ lib.optionals stdenv.isDarwin [ ./remove_bsd_base64_decode_flag.patch ];
   postPatch = ''
     substituteAllInPlace src/dl.c
   '';
@@ -39,9 +35,8 @@ stdenv.mkDerivation rec {
   doCheck = true;
   nativeCheckInputs = [ nss.tools ];
   preCheck = ''
-    substituteInPlace tests/testrun.sh \
-      --replace 'timestamp=`date +%Y%m%d_%H%M%S`' 'timestamp=19700101_000000' \
-      --replace 'TMPFOLDER=/tmp' '$(mktemp -d)'
+    export TMPFOLDER=$(mktemp -d)
+    substituteInPlace tests/testrun.sh --replace 'timestamp=`date +%Y%m%d_%H%M%S`' 'timestamp=19700101_000000'
   '';
 
   # enable deprecated soap headers required by lasso
diff --git a/pkgs/development/libraries/xmlsec/remove_bsd_base64_decode_flag.patch b/pkgs/development/libraries/xmlsec/remove_bsd_base64_decode_flag.patch
index 700fad7e3dd4..ba75343029b5 100644
--- a/pkgs/development/libraries/xmlsec/remove_bsd_base64_decode_flag.patch
+++ b/pkgs/development/libraries/xmlsec/remove_bsd_base64_decode_flag.patch
@@ -1,11 +1,11 @@
---- a/tests/testEnc.sh	2020-04-20 14:30:32.000000000 -0400
-+++ b/tests/testEnc.sh	2020-10-21 22:09:25.000000000 -0400
-@@ -405,9 +405,6 @@
+--- a/tests/testEnc.sh
++++ b/tests/testEnc.sh
+@@ -1181,9 +1181,6 @@ for aesgcm_k_l in $aesgcm_key_lengths ; do
              else
                  # generate binary file out of base64
                  DECODE="-d"
 -                if [ "`uname`" = "Darwin" ]; then
--		    DECODE="-D"
+-		            DECODE="-D"
 -                fi
                  cat "$topfolder/$base_test_name.data" | base64 $DECODE > $tmpfile.3
                  execEncTest "$res_success" \
diff --git a/pkgs/development/python-modules/av/default.nix b/pkgs/development/python-modules/av/default.nix
index 57fca04c0a4b..a030344e8f4c 100644
--- a/pkgs/development/python-modules/av/default.nix
+++ b/pkgs/development/python-modules/av/default.nix
@@ -94,7 +94,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "Pythonic bindings for FFmpeg/Libav";
+    description = "Pythonic bindings for FFmpeg";
     mainProgram = "pyav";
     homepage = "https://github.com/PyAV-Org/PyAV";
     changelog = "https://github.com/PyAV-Org/PyAV/blob/v${version}/CHANGELOG.rst";
diff --git a/pkgs/development/python-modules/bentoml/default.nix b/pkgs/development/python-modules/bentoml/default.nix
index 828021217c41..f7d480485c69 100644
--- a/pkgs/development/python-modules/bentoml/default.nix
+++ b/pkgs/development/python-modules/bentoml/default.nix
@@ -7,6 +7,7 @@
   hatchling,
   hatch-vcs,
   aiohttp,
+  aiosqlite,
   attrs,
   cattrs,
   circus,
@@ -15,25 +16,38 @@
   cloudpickle,
   deepmerge,
   fs,
+  fs-s3fs,
+  grpcio,
+  grpcio-channelz,
+  grpcio-health-checking,
+  grpcio-reflection,
   httpx,
   httpx-ws,
   inflection,
+  inquirerpy,
   jinja2,
   numpy,
   nvidia-ml-py,
   opentelemetry-api,
+  opentelemetry-exporter-otlp,
+  opentelemetry-exporter-otlp-proto-http,
   opentelemetry-instrumentation,
   opentelemetry-instrumentation-aiohttp-client,
   opentelemetry-instrumentation-asgi,
+  opentelemetry-instrumentation-grpc,
   opentelemetry-sdk,
   opentelemetry-semantic-conventions,
   opentelemetry-util-http,
   packaging,
+  pandas,
   pathspec,
+  pillow,
   pip-requirements-parser,
-  pip-tools,
   prometheus-client,
+  protobuf,
   psutil,
+  pyarrow,
+  pydantic,
   python-dateutil,
   python-json-logger,
   python-multipart,
@@ -44,25 +58,10 @@
   starlette,
   tomli,
   tomli-w,
+  tritonclient,
+  uv,
   uvicorn,
   watchfiles,
-  fs-s3fs,
-  grpcio,
-  grpcio-health-checking,
-  opentelemetry-instrumentation-grpc,
-  protobuf,
-  grpcio-channelz,
-  grpcio-reflection,
-  pillow,
-  pydantic,
-  pandas,
-  pyarrow,
-  opentelemetry-exporter-otlp-proto-http,
-  # https://pypi.org/project/opentelemetry-exporter-jaeger-proto-grpc/
-  # , opentelemetry-exporter-jaeger # support for this exporter ends in july 2023
-  opentelemetry-exporter-otlp,
-  # , opentelemetry-exporter-zipkin
-  tritonclient,
   # native check inputs
   pytestCheckHook,
   pytest-xdist,
@@ -75,7 +74,7 @@
 }:
 
 let
-  version = "1.2.18";
+  version = "1.3.3";
   aws = [ fs-s3fs ];
   grpc = [
     grpcio
@@ -90,7 +89,10 @@ let
   ];
   grpc-reflection = grpc ++ [ grpcio-reflection ];
   grpc-channelz = grpc ++ [ grpcio-channelz ];
-  monitor-otlp = [ opentelemetry-exporter-otlp-proto-http ];
+  monitor-otlp = [
+    opentelemetry-exporter-otlp-proto-http
+    opentelemetry-instrumentation-grpc
+  ];
   # tracing-jaeger = [ opentelemetry-exporter-jaeger ];
   tracing-otlp = [ opentelemetry-exporter-otlp ];
   # tracing-zipkin = [ opentelemetry-exporter-zipkin ];
@@ -126,7 +128,7 @@ buildPythonPackage {
     owner = "bentoml";
     repo = "BentoML";
     rev = "refs/tags/v${version}";
-    hash = "sha256-giZteSikwS9YEcVMPCC9h2khbBgvUPRW1biAyixO13Y=";
+    hash = "sha256-PjmXPSPukLJ+iCpBdUynhcWCfFqplmdsgj0LYpodE/c=";
   };
 
   pythonRelaxDeps = [
@@ -148,6 +150,7 @@ buildPythonPackage {
 
   dependencies = [
     aiohttp
+    aiosqlite
     attrs
     cattrs
     circus
@@ -159,6 +162,7 @@ buildPythonPackage {
     httpx
     httpx-ws
     inflection
+    inquirerpy
     jinja2
     numpy
     nvidia-ml-py
@@ -172,7 +176,6 @@ buildPythonPackage {
     packaging
     pathspec
     pip-requirements-parser
-    pip-tools
     prometheus-client
     psutil
     pydantic
@@ -185,6 +188,7 @@ buildPythonPackage {
     simple-di
     starlette
     tomli-w
+    uv
     uvicorn
     watchfiles
   ] ++ lib.optionals (pythonOlder "3.11") [ tomli ];
diff --git a/pkgs/development/python-modules/fhir-py/default.nix b/pkgs/development/python-modules/fhir-py/default.nix
index f03666938c48..518687e15d7e 100644
--- a/pkgs/development/python-modules/fhir-py/default.nix
+++ b/pkgs/development/python-modules/fhir-py/default.nix
@@ -10,12 +10,13 @@
   pytestCheckHook,
   pytest-asyncio,
   pytest-cov-stub,
+  pydantic,
   responses,
 }:
 
 buildPythonPackage rec {
   pname = "fhir-py";
-  version = "1.4.2";
+  version = "2.0.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     owner = "beda-software";
     repo = "fhir-py";
     rev = "refs/tags/v${version}";
-    hash = "sha256-kYqoRso1ypN5novRxMMzz1h2NGNybbw5lK4+HErG79I=";
+    hash = "sha256-WDYDQqeNwt4cKEgF+HqMOuEwUezS10YUOZp+eAui6nM=";
   };
 
   build-system = [ flit-core ];
@@ -39,6 +40,7 @@ buildPythonPackage rec {
     pytestCheckHook
     pytest-asyncio
     pytest-cov-stub
+    pydantic
     responses
   ];
 
diff --git a/pkgs/development/python-modules/labelbox/default.nix b/pkgs/development/python-modules/labelbox/default.nix
index 04f3b74c95fd..cdd195c7a260 100644
--- a/pkgs/development/python-modules/labelbox/default.nix
+++ b/pkgs/development/python-modules/labelbox/default.nix
@@ -4,20 +4,24 @@
   fetchFromGitHub,
   geojson,
   google-api-core,
+  hatchling,
   imagesize,
+  mypy,
   nbconvert,
   nbformat,
   numpy,
   opencv4,
-  packaging,
   pillow,
   pydantic,
   pyproj,
+  pytest-cov-stub,
+  pytest-order,
+  pytest-rerunfailures,
+  pytest-xdist,
   pytestCheckHook,
   python-dateutil,
   pythonOlder,
   requests,
-  setuptools,
   shapely,
   strenum,
   tqdm,
@@ -27,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "labelbox";
-  version = "3.72.2";
+  version = "3.77.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -36,22 +40,16 @@ buildPythonPackage rec {
     owner = "Labelbox";
     repo = "labelbox-python";
     rev = "refs/tags/v.${version}";
-    hash = "sha256-gor1LFT/XrWxWPwGn8lOkF46p/yrRILZp6fpeV+xvto=";
+    hash = "sha256-kB+w4UWBlnYSqLnv14iB9+10O9z1mwKGit8XLUUdhnk=";
   };
 
-  postPatch = ''
-    substituteInPlace pytest.ini \
-      --replace-fail "--reruns 2 --reruns-delay 10 --durations=20 -n 10" ""
-
-    # disable pytest_plugins which requires `pygeotile`
-    substituteInPlace tests/conftest.py \
-      --replace-fail "pytest_plugins" "_pytest_plugins"
-  '';
-
+  sourceRoot = "${src.name}/libs/labelbox";
 
   pythonRelaxDeps = [ "python-dateutil" ];
 
-  build-system = [ setuptools ];
+  pythonRemoveDeps = [ "opencv-python-headless" ];
+
+  build-system = [ hatchling ];
 
   dependencies = [
     google-api-core
@@ -60,12 +58,13 @@ buildPythonPackage rec {
     requests
     strenum
     tqdm
+    geojson
+    mypy
   ];
 
   optional-dependencies = {
     data = [
       shapely
-      geojson
       numpy
       pillow
       opencv4
@@ -74,13 +73,16 @@ buildPythonPackage rec {
       pyproj
       # pygeotile
       typing-extensions
-      packaging
     ];
   };
 
   nativeCheckInputs = [
     nbconvert
     nbformat
+    pytest-cov-stub
+    pytest-order
+    pytest-rerunfailures
+    pytest-xdist
     pytestCheckHook
   ] ++ optional-dependencies.data;
 
@@ -89,6 +91,7 @@ buildPythonPackage rec {
     "tests/integration"
     # Missing requirements
     "tests/data"
+    "tests/unit/test_label_data_type.py"
   ];
 
   pythonImportsCheck = [ "labelbox" ];
diff --git a/pkgs/development/python-modules/open-clip-torch/default.nix b/pkgs/development/python-modules/open-clip-torch/default.nix
index 7efac863326c..dc3bf4d78591 100644
--- a/pkgs/development/python-modules/open-clip-torch/default.nix
+++ b/pkgs/development/python-modules/open-clip-torch/default.nix
@@ -1,43 +1,46 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
-  braceexpand,
+  fetchFromGitHub,
+
+  # build-system
+  pdm-backend,
+
+  # dependencies
   ftfy,
   huggingface-hub,
-  pandas,
   protobuf,
-  pytestCheckHook,
   regex,
   sentencepiece,
   timm,
   torch,
   torchvision,
   tqdm,
+
+  # checks
+  pytestCheckHook,
+  braceexpand,
+  pandas,
   transformers,
-  setuptools,
   webdataset,
-  wheel,
-  fetchFromGitHub,
+
+  stdenv,
 }:
 buildPythonPackage rec {
   pname = "open-clip-torch";
-  version = "2.24.0";
+  version = "2.26.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mlfoundations";
     repo = "open_clip";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ugbXnXiOY9FrNvr8ZxnAgZO/SLCVoXbRgupi8cUwflU=";
+    hash = "sha256-XjPOsGet8VNzwEwzz14f1nF3XOgpkb4OERIc6VrDDZ8=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
-  ];
+  build-system = [ pdm-backend ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     ftfy
     huggingface-hub
     protobuf
@@ -59,7 +62,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "open_clip" ];
 
-  disabledTestPaths = lib.optionals (stdenv.isAarch64 || stdenv.isDarwin) [ "tests/test_wds.py" ];
+  # -> On Darwin:
+  # AttributeError: Can't pickle local object 'build_params.<locals>.<lambda>'
+  # -> On Linux:
+  # KeyError: Caught KeyError in DataLoader worker process 0
+  disabledTestPaths = [ "tests/test_wds.py" ];
 
   disabledTests =
     [
@@ -79,11 +86,14 @@ buildPythonPackage rec {
       "test_training_clip_with_jit"
     ];
 
-  meta = with lib; {
+  meta = {
     description = "Open source implementation of CLIP";
     homepage = "https://github.com/mlfoundations/open_clip";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ iynaix ];
+    changelog = "https://github.com/mlfoundations/open_clip/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ iynaix ];
     mainProgram = "open-clip";
+    # Segfaults during pythonImportsCheck phase
+    broken = stdenv.hostPlatform.system == "x86_64-darwin";
   };
 }
diff --git a/pkgs/development/python-modules/openllm-client/default.nix b/pkgs/development/python-modules/openllm-client/default.nix
deleted file mode 100644
index 1cb07bc76d05..000000000000
--- a/pkgs/development/python-modules/openllm-client/default.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  pythonOlder,
-  bentoml,
-  hatch-fancy-pypi-readme,
-  hatch-vcs,
-  hatchling,
-  anyio,
-  distro,
-  httpx,
-  httpx-auth,
-  openllm-core,
-  soundfile,
-  transformers,
-}:
-
-buildPythonPackage rec {
-  inherit (openllm-core) src version;
-  pname = "openllm-client";
-  pyproject = true;
-
-  disabled = pythonOlder "3.8";
-
-  sourceRoot = "${src.name}/openllm-client";
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "hatchling==1.18.0" "hatchling" \
-      --replace-fail "hatch-vcs==0.3.0" "hatch-vcs" \
-      --replace-fail "hatch-fancy-pypi-readme==23.1.0" "hatch-fancy-pypi-readme"
-  '';
-
-  build-system = [
-    hatch-fancy-pypi-readme
-    hatch-vcs
-    hatchling
-  ];
-
-  dependencies = [
-    anyio
-    distro
-    httpx
-    openllm-core
-  ];
-
-  optional-dependencies = {
-    grpc = [ bentoml ] ++ bentoml.optional-dependencies.grpc;
-    auth = [ httpx-auth ];
-    agents = [
-      transformers
-      # diffusers
-      soundfile
-    ] ++ transformers.optional-dependencies.agents;
-    full = optional-dependencies.grpc ++ optional-dependencies.agents;
-  };
-
-  # there is no tests
-  doCheck = false;
-
-  pythonImportsCheck = [ "openllm_client" ];
-
-  meta = with lib; {
-    description = "Interacting with OpenLLM HTTP/gRPC server, or any BentoML server";
-    homepage = "https://github.com/bentoml/OpenLLM/tree/main/openllm-client";
-    changelog = "https://github.com/bentoml/OpenLLM/blob/${src.rev}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ natsukium ];
-  };
-}
diff --git a/pkgs/development/python-modules/openllm-core/default.nix b/pkgs/development/python-modules/openllm-core/default.nix
deleted file mode 100644
index 1da77dee3242..000000000000
--- a/pkgs/development/python-modules/openllm-core/default.nix
+++ /dev/null
@@ -1,106 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pythonOlder,
-  accelerate,
-  attrs,
-  bitsandbytes,
-  bentoml,
-  cattrs,
-  click-option-group,
-  datasets,
-  deepmerge,
-  hatch-fancy-pypi-readme,
-  hatch-vcs,
-  hatchling,
-  inflection,
-  mypy-extensions,
-  orjson,
-  peft,
-  pydantic,
-  transformers,
-  typing-extensions,
-}:
-
-buildPythonPackage rec {
-  pname = "openllm-core";
-  version = "0.5.7";
-  pyproject = true;
-
-  disabled = pythonOlder "3.8";
-
-  src = fetchFromGitHub {
-    owner = "bentoml";
-    repo = "OpenLLM";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-sEZLszzoo39WUnziHGp7zWNO0YaqkXeXAoIxvyhw42w=";
-  };
-
-  sourceRoot = "${src.name}/openllm-core";
-
-
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "hatch-vcs==" "hatch-vcs>=" \
-      --replace-fail "hatchling==" "hatchling>=" \
-      --replace-fail "hatch-fancy-pypi-readme==" "hatch-fancy-pypi-readme>="
-  '';
-
-  pythonRelaxDeps = [ "cattrs" ];
-
-  build-system = [
-    hatch-fancy-pypi-readme
-    hatch-vcs
-    hatchling
-  ];
-
-  dependencies = [
-    attrs
-    cattrs
-    pydantic
-    # not listed in pyproject.toml, but required at runtime
-    click-option-group
-    deepmerge
-    inflection
-    mypy-extensions
-    orjson
-    typing-extensions
-  ];
-
-  optional-dependencies = {
-    vllm = [
-      # vllm
-    ];
-    bentoml = [ bentoml ];
-    fine-tune = [
-      accelerate
-      bitsandbytes
-      datasets
-      peft
-      transformers
-      # trl
-    ] ++ transformers.optional-dependencies.torch ++ transformers.optional-dependencies.tokenizers;
-    full =
-      with optional-dependencies;
-      (
-        vllm
-        # use absolute path to disambiguate with derivbation argument
-        ++ optional-dependencies.bentoml
-        ++ fine-tune
-      );
-  };
-
-  # there is no tests
-  doCheck = false;
-
-  pythonImportsCheck = [ "openllm_core" ];
-
-  meta = with lib; {
-    description = "Core components for OpenLLM";
-    homepage = "https://github.com/bentoml/OpenLLM/tree/main/openllm-core";
-    changelog = "https://github.com/bentoml/OpenLLM/blob/${src.rev}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ natsukium ];
-  };
-}
diff --git a/pkgs/development/python-modules/openllm/default.nix b/pkgs/development/python-modules/openllm/default.nix
deleted file mode 100644
index ccb32de341ea..000000000000
--- a/pkgs/development/python-modules/openllm/default.nix
+++ /dev/null
@@ -1,200 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  hatch-fancy-pypi-readme,
-  hatch-vcs,
-  hatchling,
-  pytestCheckHook,
-  pythonOlder,
-  accelerate,
-  bentoml,
-  bitsandbytes,
-  build,
-  click,
-  ctranslate2,
-  datasets,
-  docker,
-  einops,
-  ghapi,
-  huggingface-hub,
-  hypothesis,
-  ipython,
-  jupyter,
-  jupytext,
-  nbformat,
-  notebook,
-  openai,
-  openllm-client,
-  openllm-core,
-  optimum,
-  peft,
-  pytest-mock,
-  pytest-randomly,
-  pytest-rerunfailures,
-  pytest-xdist,
-  safetensors,
-  scipy,
-  sentencepiece,
-  soundfile,
-  syrupy,
-  tabulate,
-  tiktoken,
-  transformers,
-  triton,
-  xformers,
-}:
-
-buildPythonPackage rec {
-  inherit (openllm-core) src version;
-  pname = "openllm";
-  pyproject = true;
-
-  disabled = pythonOlder "3.8";
-
-  sourceRoot = "${src.name}/openllm-python";
-
-
-  pythonRemoveDeps = [
-    # remove cuda-python as it has an unfree license
-    "cuda-python"
-  ];
-
-  build-system = [
-    hatch-fancy-pypi-readme
-    hatch-vcs
-    hatchling
-  ];
-
-  dependencies =
-    [
-      accelerate
-      bentoml
-      bitsandbytes
-      build
-      click
-      einops
-      ghapi
-      openllm-client
-      openllm-core
-      optimum
-      safetensors
-      scipy
-      sentencepiece
-      transformers
-    ]
-    ++ bentoml.optional-dependencies.io
-    ++ tabulate.optional-dependencies.widechars
-    ++ transformers.optional-dependencies.tokenizers
-    ++ transformers.optional-dependencies.torch;
-
-  optional-dependencies = {
-    agents = [
-      # diffusers
-      soundfile
-      transformers
-    ] ++ transformers.optional-dependencies.agents;
-    awq = [
-      # autoawq
-    ];
-    baichuan = [
-      # cpm-kernels
-    ];
-    chatglm = [
-      # cpm-kernels
-    ];
-    ctranslate = [ ctranslate2 ];
-    falcon = [ xformers ];
-    fine-tune = [
-      datasets
-      huggingface-hub
-      peft
-      # trl
-    ];
-    ggml = [
-      # ctransformers
-    ];
-    gptq = [
-      # auto-gptq
-    ]; # ++ autogptq.optional-dependencies.triton;
-    grpc = [ bentoml ] ++ bentoml.optional-dependencies.grpc;
-    mpt = [ triton ];
-    openai = [
-      openai
-      tiktoken
-    ] ++ openai.optional-dependencies.datalib;
-    playground = [
-      ipython
-      jupyter
-      jupytext
-      nbformat
-      notebook
-    ];
-    starcoder = [ bitsandbytes ];
-    vllm = [
-      # vllm
-    ];
-    full =
-      with optional-dependencies;
-      (
-        agents
-        ++ awq
-        ++ baichuan
-        ++ chatglm
-        ++ ctranslate
-        ++ falcon
-        ++ fine-tune
-        ++ ggml
-        ++ gptq
-        ++ mpt
-        # disambiguate between derivation input and passthru field
-        ++ optional-dependencies.openai
-        ++ playground
-        ++ starcoder
-        ++ vllm
-      );
-    all = optional-dependencies.full;
-  };
-
-  nativeCheckInputs = [
-    docker
-    hypothesis
-    pytest-mock
-    pytest-randomly
-    pytest-rerunfailures
-    pytest-xdist
-    pytestCheckHook
-    syrupy
-  ];
-
-  preCheck = ''
-    export HOME=$TMPDIR
-    # skip GPUs test on CI
-    export GITHUB_ACTIONS=1
-    # disable hypothesis' deadline
-    export CI=1
-  '';
-
-  disabledTestPaths = [
-    # require network access
-    "tests/models"
-  ];
-
-  disabledTests = [
-    # incompatible with recent TypedDict
-    # https://github.com/bentoml/OpenLLM/blob/f3fd32d596253ae34c68e2e9655f19f40e05f666/openllm-python/tests/configuration_test.py#L18-L21
-    "test_missing_default"
-  ];
-
-  pythonImportsCheck = [ "openllm" ];
-
-  meta = with lib; {
-    description = "Operating LLMs in production";
-    homepage = "https://github.com/bentoml/OpenLLM/tree/main/openllm-python";
-    changelog = "https://github.com/bentoml/OpenLLM/blob/${src.rev}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
-      happysalada
-      natsukium
-    ];
-  };
-}
diff --git a/pkgs/development/python-modules/pandoc-latex-environment/default.nix b/pkgs/development/python-modules/pandoc-latex-environment/default.nix
index c2cdf7e679a2..5548785e5fa9 100644
--- a/pkgs/development/python-modules/pandoc-latex-environment/default.nix
+++ b/pkgs/development/python-modules/pandoc-latex-environment/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pandoc-latex-environment";
-  version = "1.1.6.5";
+  version = "1.1.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chdemko";
     repo = "pandoc-latex-environment";
     rev = "refs/tags/${version}";
-    hash = "sha256-yBVxQW042mGQAksTG5Vr8fExcKt2YnuiPL1cSZRJJYA=";
+    hash = "sha256-iKzveVTScqF8dAGPx7JU66Z5oyoZ82t101z5xeiHYqw=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyblu/default.nix b/pkgs/development/python-modules/pyblu/default.nix
index 0ffb06f06e64..74526592d833 100644
--- a/pkgs/development/python-modules/pyblu/default.nix
+++ b/pkgs/development/python-modules/pyblu/default.nix
@@ -4,29 +4,31 @@
   buildPythonPackage,
   fetchFromGitHub,
   lib,
+  lxml,
   poetry-core,
   pytest-asyncio,
   pytestCheckHook,
-  xmltodict,
 }:
 
 buildPythonPackage rec {
   pname = "pyblu";
-  version = "0.5.2";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LouisChrist";
     repo = "pyblu";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2gpd7oDDmjUVm7bEED2ZK/27a8XUITxU0ylRfxeg/qU=";
+    hash = "sha256-Ue6czsgeQjqPtbKmvvU+f49gKSzXJ8Yx9EzycUTtxE0=";
   };
 
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [ "lxml" ];
+
   dependencies = [
     aiohttp
-    xmltodict
+    lxml
   ];
 
   pythonImportsCheck = [ "pyblu" ];
diff --git a/pkgs/development/python-modules/recipe-scrapers/default.nix b/pkgs/development/python-modules/recipe-scrapers/default.nix
index 690a5def8ef2..f64e8e68c8e2 100644
--- a/pkgs/development/python-modules/recipe-scrapers/default.nix
+++ b/pkgs/development/python-modules/recipe-scrapers/default.nix
@@ -11,11 +11,12 @@
   responses,
   setuptools,
   pythonOlder,
+  nixosTests,
 }:
 
 buildPythonPackage rec {
   pname = "recipe-scrapers";
-  version = "14.56.0";
+  version = "15.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +25,7 @@ buildPythonPackage rec {
     owner = "hhursev";
     repo = "recipe-scrapers";
     rev = "refs/tags/${version}";
-    hash = "sha256-+9oQLCuR+rRCG5tnyofHd8WMkQ5QPsWfLCnwIDU5d9o=";
+    hash = "sha256-7tCLzMj5/K+7i8a1hFcilOgU+0Y5R6VdYJK5CK06LLw=";
   };
 
   nativeBuildInputs = [ setuptools ];
@@ -49,6 +50,12 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "recipe_scrapers" ];
 
+  passthru = {
+    tests = {
+      inherit (nixosTests) mealie tandoor-recipes;
+    };
+  };
+
   meta = with lib; {
     description = "Python package for scraping recipes data";
     homepage = "https://github.com/hhursev/recipe-scrapers";
diff --git a/pkgs/development/python-modules/salmon-mail/default.nix b/pkgs/development/python-modules/salmon-mail/default.nix
index 02ed82ac640f..72df3f89e3b9 100644
--- a/pkgs/development/python-modules/salmon-mail/default.nix
+++ b/pkgs/development/python-modules/salmon-mail/default.nix
@@ -1,39 +1,45 @@
 {
-  stdenv,
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  setuptools,
   dnspython,
   chardet,
-  lmtpd,
   python-daemon,
-  six,
   jinja2,
-  mock,
   click,
+  unittestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "salmon-mail";
-  version = "3.2.0";
-  format = "setuptools";
+  version = "3.3.0";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0q2m6xri1b7qv46rqpv2qfdgk2jvswj8lpaacnxwjna3m685fhfx";
+  src = fetchFromGitHub {
+    owner = "moggers87";
+    repo = "salmon";
+    rev = "refs/tags/${version}";
+    hash = "sha256-ysBO/ridfy7YPoTsVwAxar9UvfM/qxrx2dp0EtDNLvE=";
   };
 
   nativeCheckInputs = [
     jinja2
-    mock
+    unittestCheckHook
   ];
-  propagatedBuildInputs = [
+
+  build-system = [ setuptools ];
+
+  dependencies = [
     chardet
-    dnspython
-    lmtpd
-    python-daemon
-    six
     click
+    dnspython
+    python-daemon
+  ];
+
+  pythonImportsCheck = [
+    "salmon"
+    "salmon.handlers"
   ];
 
   # Darwin tests fail without this. See:
@@ -42,15 +48,13 @@ buildPythonPackage rec {
 
   # The tests use salmon executable installed by salmon itself so we need to add
   # that to PATH
-  checkPhase = ''
-    # tests fail and pytest is not supported
-    rm tests/server_tests.py
-    PATH=$out/bin:$PATH python setup.py test
+  preCheck = ''
+    export PATH=$out/bin:$PATH
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     homepage = "https://salmon-mail.readthedocs.org/";
+    changelog = "https://github.com/moggers87/salmon/blob/${src.rev}/CHANGELOG.rst";
     description = "Pythonic mail application server";
     mainProgram = "salmon";
     license = licenses.gpl3Only;
diff --git a/pkgs/development/python-modules/universal-pathlib/default.nix b/pkgs/development/python-modules/universal-pathlib/default.nix
index e44fed7b9752..b01e2dab57f1 100644
--- a/pkgs/development/python-modules/universal-pathlib/default.nix
+++ b/pkgs/development/python-modules/universal-pathlib/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "universal-pathlib";
-  version = "0.2.2";
+  version = "0.2.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "universal_pathlib";
     inherit version;
-    hash = "sha256-a8IVVIeSrV2zVTcIscGbr9ni+hZn3JJe1ATJXlKuLxM=";
+    hash = "sha256-IvXyif7exLZjlWWWdCZS4hd7yiRmG2yKFz9ZdM/uAFI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/wfuzz/default.nix b/pkgs/development/python-modules/wfuzz/default.nix
index ab11125bb379..71577257d228 100644
--- a/pkgs/development/python-modules/wfuzz/default.nix
+++ b/pkgs/development/python-modules/wfuzz/default.nix
@@ -4,11 +4,11 @@
   buildPythonPackage,
   chardet,
   colorama,
+  distutils,
   fetchFromGitHub,
   netaddr,
   pycurl,
   pyparsing,
-  pytest,
   pytestCheckHook,
   pythonOlder,
   setuptools,
@@ -19,14 +19,14 @@
 buildPythonPackage rec {
   pname = "wfuzz";
   version = "3.1.0";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "xmendez";
-    repo = pname;
-    rev = "v${version}";
+    repo = "wfuzz";
+    rev = "refs/tags/v${version}";
     hash = "sha256-RM6QM/iR00ymg0FBUtaWAtxPHIX4u9U/t5N/UT/T6sc=";
   };
 
@@ -41,15 +41,14 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "pyparsing>=2.4*" "pyparsing>=2.4"
-
-    # fix distutils use for Python 3.12
-    substituteInPlace src/wfuzz/plugin_api/base.py \
-      --replace-fail "from distutils import util" "from setuptools._distutils import util"
+      --replace-fail "pyparsing>=2.4*" "pyparsing>=2.4"
   '';
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     chardet
+    distutils # src/wfuzz/plugin_api/base.py
     pycurl
     six
     setuptools
@@ -58,7 +57,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     netaddr
-    pytest
     pytestCheckHook
   ];
 
@@ -82,6 +80,7 @@ buildPythonPackage rec {
   '';
 
   meta = with lib; {
+    changelog = "https://github.com/xmendez/wfuzz/releases/tag/v${version}";
     description = "Web content fuzzer to facilitate web applications assessments";
     longDescription = ''
       Wfuzz provides a framework to automate web applications security assessments
diff --git a/pkgs/development/python-modules/ytmusicapi/default.nix b/pkgs/development/python-modules/ytmusicapi/default.nix
index 4d99219d05a2..da34c7442a28 100644
--- a/pkgs/development/python-modules/ytmusicapi/default.nix
+++ b/pkgs/development/python-modules/ytmusicapi/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "ytmusicapi";
-  version = "1.8.0";
+  version = "1.8.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "sigma67";
     repo = "ytmusicapi";
     rev = "refs/tags/${version}";
-    hash = "sha256-PuGGUyQ199Awo0Dqi6xUAAt53WZjvaLiW7bIT4zlMT0=";
+    hash = "sha256-zjJ/Kkym4zHYYIlITgTas+q41vv9ow/f6AqfTd64iB8=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 06303d0337fd..61ea120772b4 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -81,6 +81,9 @@ installPhase() {
         mkdir $i/lib/vdpau
         mv $i/lib/libvdpau* $i/lib/vdpau
 
+        # Compatibility with openssl 1.1, unused
+        rm -f $i/lib/libnvidia-pkcs11.so*
+
         # Install ICDs, make absolute paths.
         # Be careful not to modify any original files because this runs twice.
 
diff --git a/pkgs/servers/apache-kafka/default.nix b/pkgs/servers/apache-kafka/default.nix
index b69a9d62d81c..e513cc143427 100644
--- a/pkgs/servers/apache-kafka/default.nix
+++ b/pkgs/servers/apache-kafka/default.nix
@@ -2,6 +2,12 @@
 
 let
   versionMap = {
+    "3_8" = {
+      kafkaVersion = "3.8.0";
+      scalaVersion = "2.13";
+      sha256 = "sha256-4Cl8xv2wnvnZkFdRsl0rYpwXUo+GKbYFYe7/h84pCZw=";
+      jre = jdk17_headless;
+    };
     "3_7" = {
       kafkaVersion = "3.7.1";
       scalaVersion = "2.13";
diff --git a/pkgs/servers/home-automation/evcc/default.nix b/pkgs/servers/home-automation/evcc/default.nix
index 6ba83ed21abd..0c715b57d74f 100644
--- a/pkgs/servers/home-automation/evcc/default.nix
+++ b/pkgs/servers/home-automation/evcc/default.nix
@@ -16,16 +16,16 @@
 
 buildGo123Module rec {
   pname = "evcc";
-  version = "0.130.2";
+  version = "0.130.3";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     rev = version;
-    hash = "sha256-ec/Lfxe7c8IUCA/jz3yj6DJOY7ksTymFtjjPR/C2Crg=";
+    hash = "sha256-1IZyNIsXtMBDpa006/Q94Ssfj5kPV7gUDxzTcPkXSL8=";
   };
 
-  vendorHash = "sha256-Oj5+bmhlZHyOfcJf10EK8mvJauIWk88k0qj2NBkRvFQ=";
+  vendorHash = "sha256-x3tcYcxDca0Us9XEljiOB8YBwHphQUKlrIj2rMcSEc8=";
 
   npmDeps = fetchNpmDeps {
     inherit src;
diff --git a/pkgs/servers/search/meilisearch/Cargo.lock b/pkgs/servers/search/meilisearch/Cargo.lock
index 3c728f348192..51df0ea7bbb1 100644
--- a/pkgs/servers/search/meilisearch/Cargo.lock
+++ b/pkgs/servers/search/meilisearch/Cargo.lock
@@ -5098,9 +5098,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.34"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
@@ -5121,9 +5121,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
  "num-conv",
  "time-core",
diff --git a/pkgs/servers/search/meilisearch/default.nix b/pkgs/servers/search/meilisearch/default.nix
index efbef3bed8fd..cbb440086976 100644
--- a/pkgs/servers/search/meilisearch/default.nix
+++ b/pkgs/servers/search/meilisearch/default.nix
@@ -23,6 +23,11 @@ rustPlatform.buildRustPackage {
     hash = "sha256-fPXhayS8OKiiiDvVvBry3njZ74/W6oVL0p85Z5qf3KA==";
   };
 
+  cargoPatches = [
+    # fix build with Rust 1.80
+    ./time-crate.patch
+  ];
+
   cargoBuildFlags = [ "--package=meilisearch" ];
 
   cargoLock = {
diff --git a/pkgs/servers/search/meilisearch/time-crate.patch b/pkgs/servers/search/meilisearch/time-crate.patch
new file mode 100644
index 000000000000..b0b81f65026d
--- /dev/null
+++ b/pkgs/servers/search/meilisearch/time-crate.patch
@@ -0,0 +1,28 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 3c728f348..51df0ea7b 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -5098,9 +5098,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "time"
+-version = "0.3.34"
++version = "0.3.36"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
++checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+ dependencies = [
+  "deranged",
+  "itoa",
+@@ -5121,9 +5121,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+ 
+ [[package]]
+ name = "time-macros"
+-version = "0.2.17"
++version = "0.2.18"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
++checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+ dependencies = [
+  "num-conv",
+  "time-core",
diff --git a/pkgs/servers/sql/postgresql/ext/hypopg.nix b/pkgs/servers/sql/postgresql/ext/hypopg.nix
index 62f2e9263e76..534a21bb6d69 100644
--- a/pkgs/servers/sql/postgresql/ext/hypopg.nix
+++ b/pkgs/servers/sql/postgresql/ext/hypopg.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, postgresql }:
+{ lib, stdenv, fetchFromGitHub, postgresql, gitUpdater }:
 
 stdenv.mkDerivation rec {
   pname = "hypopg";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "HypoPG";
     repo = "hypopg";
     rev = version;
-    hash = "sha256-YzQnkQi9BlDryUySnWHWeTanhgfVUXjHjOqj+nQucCY=";
+    hash = "sha256-88uKPSnITRZ2VkelI56jZ9GWazG/Rn39QlyHKJKSKMM=";
   };
 
   buildInputs = [ postgresql ];
@@ -19,6 +19,12 @@ stdenv.mkDerivation rec {
     install -D -t $out/share/postgresql/extension *.sql
   '';
 
+  passthru = {
+    updateScript = gitUpdater {
+      ignoredVersions = "beta";
+    };
+  };
+
   meta = with lib; {
     description = "Hypothetical Indexes for PostgreSQL";
     homepage = "https://hypopg.readthedocs.io";
diff --git a/pkgs/tools/misc/viddy/default.nix b/pkgs/tools/misc/viddy/default.nix
index 2f23f77b166e..ece009cc6ca3 100644
--- a/pkgs/tools/misc/viddy/default.nix
+++ b/pkgs/tools/misc/viddy/default.nix
@@ -1,30 +1,39 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
 
-buildGoModule rec {
+rustPlatform.buildRustPackage rec {
   pname = "viddy";
-  version = "0.4.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "sachaos";
-    repo = pname;
+    repo = "viddy";
     rev = "v${version}";
-    hash = "sha256-iF5b5e3HPT3GJLRDxz9wN1U5rO9Ey51Cpw4p2zjffTI=";
+    hash = "sha256-HFqkWJu1whShwEsSUZe5orWTNYyY3oZ6tBzAJF3SFDw=";
   };
 
-  vendorHash = "sha256-/lx2D2FIByRnK/097M4SQKRlmqtPTvbFo1dwbThJ5Fs=";
+  cargoHash = "sha256-oEzsJoVD9aSvphchm21dlmkwePMDSaxD7eoR850NbRk=";
 
-  ldflags = [
-    "-s"
-    "-w"
-    "-X"
-    "main.version=${version}"
-  ];
+  # requires nightly features
+  env.RUSTC_BOOTSTRAP = 1;
+
+  env.VERGEN_BUILD_DATE = "2024-08-24"; # managed via the update script
+  env.VERGEN_GIT_DESCRIBE = "Nixpkgs";
+
+  passthru.updateScript.command = [ ./update.sh ];
 
   meta = with lib; {
-    description = "Modern watch command";
+    description = "Modern watch command, time machine and pager etc.";
+    changelog = "https://github.com/sachaos/viddy/releases";
     homepage = "https://github.com/sachaos/viddy";
     license = licenses.mit;
-    maintainers = with maintainers; [ j-hui ];
+    maintainers = with maintainers; [
+      j-hui
+      phanirithvij
+    ];
     mainProgram = "viddy";
   };
 }
diff --git a/pkgs/tools/misc/viddy/update.sh b/pkgs/tools/misc/viddy/update.sh
new file mode 100755
index 000000000000..4740effde4a2
--- /dev/null
+++ b/pkgs/tools/misc/viddy/update.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash nix-update curl coreutils jq common-updater-scripts nix-prefetch
+
+# adapted from pkgs/by-name/ya/yazi-unwrapped/update.sh
+
+set -eou pipefail
+
+NIXPKGS_DIR="$PWD"
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+
+# Get latest release
+VIDDY_RELEASE=$(
+    curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
+        https://api.github.com/repos/sachaos/viddy/releases/latest
+)
+
+# Get release information
+latestBuildDate=$(echo "$VIDDY_RELEASE" | jq -r ".published_at")
+latestVersion=$(echo "$VIDDY_RELEASE" | jq -r ".tag_name")
+
+latestBuildDate="${latestBuildDate%T*}" # remove the timestamp and get the date
+latestVersion="${latestVersion:1}"      # remove first char 'v'
+
+oldVersion=$(nix eval --raw -f "$NIXPKGS_DIR" viddy.version)
+
+if [[ "$oldVersion" == "$latestVersion" ]]; then
+    echo "viddy is up-to-date: ${oldVersion}"
+    exit 0
+fi
+
+echo "Updating viddy"
+
+# Version
+update-source-version viddy "${latestVersion}"
+
+pushd "$SCRIPT_DIR"
+# Build date
+sed -i 's#env.VERGEN_BUILD_DATE = "[^"]*"#env.VERGEN_BUILD_DATE = "'"${latestBuildDate}"'"#' default.nix
+
+# Hashes
+# https://github.com/msteen/nix-prefetch/issues/51
+cargoHash=$(nix-prefetch --option extra-experimental-features flakes "{ sha256 }: (import $NIXPKGS_DIR {}).viddy.cargoDeps.overrideAttrs (_: { outputHash = sha256; })")
+sed -i -E 's#\bcargoHash = ".*?"#cargoHash = "'"$cargoHash"'"#' default.nix
+popd
diff --git a/pkgs/tools/package-management/nix/common.nix b/pkgs/tools/package-management/nix/common.nix
index 27ea4a075bdc..205cda250e21 100644
--- a/pkgs/tools/package-management/nix/common.nix
+++ b/pkgs/tools/package-management/nix/common.nix
@@ -65,6 +65,7 @@ in
 , mdbook-linkcheck
 , nlohmann_json
 , nixosTests
+, nixVersions
 , openssl
 , perl
 , pkg-config
@@ -261,6 +262,7 @@ self = stdenv.mkDerivation {
       # Basic smoke test that needs to pass when upgrading nix.
       # Note that this test does only test the nixVersions.stable attribute.
       misc = nixosTests.nix-misc.default;
+      upgrade = nixosTests.nix-upgrade;
 
       srcVersion = runCommand "nix-src-version" {
         inherit version;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f005a0f1217f..f0bdce1c01c0 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -722,6 +722,7 @@ mapAliases ({
   keepkey_agent = keepkey-agent; # added 2024-01-06
   kerberos = krb5; # moved from top-level 2021-03-14
   kexectools = kexec-tools; # Added 2021-09-03
+  keyfinger = throw "keyfinder has been removed as it was abandoned upstream and did not build; consider using mixxx or keyfinder-cli"; # Addd 2024-08-25
   keysmith = libsForQt5.kdeGear.keysmith; # Added 2021-07-14
   kfctl = throw "kfctl is broken and has been archived by upstream"; # Added 2023-08-21
   kgx = gnome-console; # Added 2022-02-19
@@ -750,6 +751,11 @@ mapAliases ({
   lfs = dysk; # Added 2023-07-03
   llvmPackages_rocm = throw "'llvmPackages_rocm' has been replaced with 'rocmPackages.llvm'"; # Added 2023-10-08
   libAfterImage = throw "'libAfterImage' has been removed from nixpkgs, as it's no longer in development for a long time"; # Added 2024-06-01
+  libav = throw "libav has been removed as it was insecure and abandoned upstream for over half a decade; please use FFmpeg"; # Added 2024-08-25
+  libav_0_8 = libav; # Added 2024-08-25
+  libav_11 = libav; # Added 2024-08-25
+  libav_12 = libav; # Added 2024-08-25
+  libav_all = libav; # Added 2024-08-25
   libayatana-indicator-gtk3 = libayatana-indicator; # Added 2022-10-18
   libayatana-appindicator-gtk3 = libayatana-appindicator; # Added 2022-10-18
   libbencodetools = bencodetools; # Added 2022-07-30
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 20601391ceb5..8a285cd9920e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17375,9 +17375,10 @@ with pkgs;
 
   inherit (callPackages ../servers/apache-kafka { })
     apacheKafka_3_6
-    apacheKafka_3_7;
+    apacheKafka_3_7
+    apacheKafka_3_8;
 
-  apacheKafka = apacheKafka_3_7;
+  apacheKafka = apacheKafka_3_8;
 
   apng2gif = callPackage ../tools/graphics/apng2gif { };
 
@@ -20503,7 +20504,7 @@ with pkgs;
   gsettings-qt = libsForQt5.callPackage ../development/libraries/gsettings-qt { };
 
   gst_all_1 = recurseIntoAttrs(callPackage ../development/libraries/gstreamer {
-    callPackage = newScope (gst_all_1 // { libav = pkgs.ffmpeg-headless; });
+    callPackage = newScope gst_all_1;
     inherit (darwin.apple_sdk.frameworks) AudioToolbox AVFoundation Cocoa CoreFoundation CoreMedia CoreServices CoreVideo DiskArbitration Foundation IOKit MediaToolbox OpenGL Security SystemConfiguration VideoToolbox;
   });
 
@@ -21160,10 +21161,6 @@ with pkgs;
 
   libaudec = callPackage ../development/libraries/libaudec { };
 
-  libav = libav_11; # branch 11 is API-compatible with branch 10
-  libav_all = callPackages ../development/libraries/libav { };
-  inherit (libav_all) libav_0_8 libav_11 libav_12;
-
   libavc1394 = callPackage ../development/libraries/libavc1394 { };
 
   libavif = callPackage ../development/libraries/libavif { };
@@ -31221,8 +31218,6 @@ with pkgs;
 
   khronos = callPackage ../applications/office/khronos { };
 
-  keyfinder = libsForQt5.callPackage ../applications/audio/keyfinder { };
-
   keyfinder-cli = callPackage ../applications/audio/keyfinder-cli { };
 
   kfilt = callPackage ../applications/networking/cluster/kfilt { };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 8f066dfa1949..a978222a5fd7 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -355,6 +355,9 @@ mapAliases ({
   openai-triton-no-cuda = triton-no-cuda; # added 2024-07-18
   openapi-schema-pydantic = throw "openapi-schema-pydantic has been removed, since it is no longer maintained"; # added 2023-10-30
   opencv3 = throw "opencv3 has been removed as it is obsolete"; # added 2023-10-12
+  openllm = throw "openllm has moved to pkgs.openllm"; # added 2021-12-31
+  openllm-client = throw "openllm-client has been removed, since it is abandoned due to a change in philosophy"; # added 2024-08-24
+  openllm-core = throw "openllm-core has been removed, since it is abandoned due to a change in philosophy"; # added 2024-08-24
   opsdroid_get_image_size = opsdroid-get-image-size; # added 2023-10-16
   ordereddict = throw "ordereddict has been removed because it is only useful on unsupported python versions."; # added 2022-05-28
   pafy = throw "pafy has been removed because it is unmaintained and only a dependency of mps-youtube, itself superseded by yewtube"; # Added 2023-01-19
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 35672a3e50e4..4d0500c9086e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4649,14 +4649,6 @@ self: super: with self; {
 
   oelint-parser = callPackage ../development/python-modules/oelint-parser { };
 
-  openllm = callPackage ../development/python-modules/openllm {
-    triton = self.triton-cuda;
-  };
-
-  openllm-client = callPackage ../development/python-modules/openllm-client { };
-
-  openllm-core = callPackage ../development/python-modules/openllm-core { };
-
   openstep-parser = callPackage ../development/python-modules/openstep-parser { };
 
   openstep-plist = callPackage ../development/python-modules/openstep-plist { };