diff --git a/nixos/modules/services/blockchain/ethereum/erigon.nix b/nixos/modules/services/blockchain/ethereum/erigon.nix
index 9ff7df0b15e5..8ebe0fcaff54 100644
--- a/nixos/modules/services/blockchain/ethereum/erigon.nix
+++ b/nixos/modules/services/blockchain/ethereum/erigon.nix
@@ -13,6 +13,12 @@ in {
     services.erigon = {
       enable = mkEnableOption (lib.mdDoc "Ethereum implementation on the efficiency frontier");
 
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        description = lib.mdDoc "Additional arguments passed to Erigon";
+        default = [ ];
+      };
+
       secretJwtPath = mkOption {
         type = types.path;
         description = lib.mdDoc ''
@@ -86,7 +92,7 @@ in {
 
       serviceConfig = {
         LoadCredential = "ERIGON_JWT:${cfg.secretJwtPath}";
-        ExecStart = "${pkgs.erigon}/bin/erigon --config ${configFile} --authrpc.jwtsecret=%d/ERIGON_JWT";
+        ExecStart = "${pkgs.erigon}/bin/erigon --config ${configFile} --authrpc.jwtsecret=%d/ERIGON_JWT ${lib.escapeShellArgs cfg.extraArgs}";
         DynamicUser = true;
         Restart = "on-failure";
         StateDirectory = "erigon";
diff --git a/pkgs/applications/audio/qmmp/default.nix b/pkgs/applications/audio/qmmp/default.nix
index 6eea4562de99..00931a21011c 100644
--- a/pkgs/applications/audio/qmmp/default.nix
+++ b/pkgs/applications/audio/qmmp/default.nix
@@ -1,21 +1,19 @@
-{ lib, mkDerivation, fetchurl, cmake, pkg-config
-, qtbase, qttools, qtmultimedia, qtx11extras
+{ lib, stdenv, fetchurl, cmake, pkg-config
+, qtbase, qttools, qtmultimedia, wrapQtAppsHook
 # transports
 , curl, libmms
 # input plugins
 , libmad, taglib, libvorbis, libogg, flac, libmpcdec, libmodplug, libsndfile
-, libcdio, cdparanoia, libcddb, faad2, ffmpeg, wildmidi
+, libcdio, cdparanoia, libcddb, faad2, ffmpeg, wildmidi, libbs2b, game-music-emu
 # output plugins
-, alsa-lib, libpulseaudio
+, alsa-lib, libpulseaudio, pipewire
 # effect plugins
 , libsamplerate
 }:
 
 # Additional plugins that can be added:
 #  wavpack (https://www.wavpack.com/)
-#  gme (Game music support)
 #  Ogg Opus support
-#  BS2B effect plugin (http://bs2b.sourceforge.net/)
 #  JACK audio support
 #  ProjectM visualization plugin
 
@@ -28,26 +26,27 @@
 # Qmmp installs working .desktop file(s) all by itself, so we don't need to
 # handle that.
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "qmmp";
-  version = "1.4.4";
+  version = "2.1.2";
 
   src = fetchurl {
-    url = "https://qmmp.ylsoftware.com/files/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-sZRZVhCf2ceETuV4AULA0kVkuIMn3C+aYdKThqvPnVQ=";
+    url = "https://qmmp.ylsoftware.com/files/qmmp/2.1/${pname}-${version}.tar.bz2";
+    hash = "sha256-U86LoAkg6mBFVa/cgB8kpCa5KwdkR0PMQmAGvf/KAXo=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
+
   buildInputs =
     [ # basic requirements
-      qtbase qttools qtmultimedia qtx11extras
+      qtbase qttools qtmultimedia
       # transports
       curl libmms
       # input plugins
       libmad taglib libvorbis libogg flac libmpcdec libmodplug libsndfile
-      libcdio cdparanoia libcddb faad2 ffmpeg wildmidi
+      libcdio cdparanoia libcddb faad2 ffmpeg wildmidi libbs2b game-music-emu
       # output plugins
-      alsa-lib libpulseaudio
+      alsa-lib libpulseaudio pipewire
       # effect plugins
       libsamplerate
     ];
diff --git a/pkgs/applications/editors/hexdino/default.nix b/pkgs/applications/editors/hexdino/default.nix
index 424295b12c98..cc3b39ed4bf7 100644
--- a/pkgs/applications/editors/hexdino/default.nix
+++ b/pkgs/applications/editors/hexdino/default.nix
@@ -1,19 +1,17 @@
-{ lib, fetchFromGitHub, rustPlatform, ncurses }:
+{ lib, fetchFromGitHub, rustPlatform }:
 
 rustPlatform.buildRustPackage rec {
   pname = "hexdino";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "Luz";
     repo = pname;
     rev = version;
-    sha256 = "1n8gizawx8h58hpyyqivp7vwy7yhn6scipl5rrbvkpnav8qpmk1r";
+    sha256 = "sha256-OFtOa6StpOuLgkULnY5MlqDcSTEiMxogowHIBEiGr4E=";
   };
 
-  cargoSha256 = "01869b1d7gbsprcxxj7h9z16pvnzb02j2hywh97gfq5x96gnmkz3";
-
-  buildInputs = [ ncurses ];
+  cargoSha256 = "sha256-lvLiRQNH3rpu+JTXWhQtXczmGRWGtnnLDknZaMp3d0s=";
 
   meta = with lib; {
     description = "A hex editor with vim like keybindings written in Rust";
diff --git a/pkgs/applications/misc/rlaunch/default.nix b/pkgs/applications/misc/rlaunch/default.nix
index 5622c94d427f..9b00abd14cd9 100644
--- a/pkgs/applications/misc/rlaunch/default.nix
+++ b/pkgs/applications/misc/rlaunch/default.nix
@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , rustPlatform
 , xorg
 }:
@@ -17,6 +18,15 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "00lnw48kn97gp45lylv5c6v6pil74flzpsq9k69xgvvjq9yqjzrx";
 
+  patches = [
+    # Fixes "error[E0308]: mismatched types; expected `u8`, found `i8`" on aarch64
+    # Remove with next version update
+    (fetchpatch {
+      url = "https://github.com/PonasKovas/rlaunch/commit/f78f36876bba45fe4e7310f58086ddc63f27a57e.patch";
+      hash = "sha256-rTS1khw1zt3i1AJ11BhAILcmaohAwVc7Qfl6Fc76Kvs=";
+    })
+  ];
+
   # The x11_dl crate dlopen()s these libraries, so we have to inject them into rpath.
   postFixup = ''
     patchelf --set-rpath ${lib.makeLibraryPath (with xorg; [ libX11 libXft libXinerama ])} $out/bin/rlaunch
@@ -26,6 +36,7 @@ rustPlatform.buildRustPackage rec {
     description = "A lightweight application launcher for X11";
     homepage = "https://github.com/PonasKovas/rlaunch";
     license = licenses.mit;
+    platforms = platforms.linux;
     maintainers = with maintainers; [ danc86 ];
   };
 }
diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index 3d3339d06b5e..c20eb7b1b90a 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -45,7 +45,7 @@ assert with lib.strings; (
 
 stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "31.3.1";
+  version = "31.4.0";
 
   src = fetchFromGitea {
     domain = "repo.palemoon.org";
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     repo = "Pale-Moon";
     rev = "${version}_Release";
     fetchSubmodules = true;
-    sha256 = "sha256-oLtCS5Izdk2ImyzKx2IXkzv6pJp86mvP99P0+XIteRA=";
+    sha256 = "sha256-x+o1Bb0HwtWsIhz1gI/s5a4qCdOrni7KsF0ZZAlJBzg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/palemoon/mozconfig b/pkgs/applications/networking/browsers/palemoon/mozconfig
index d680dc1ab44c..c481dbc29e8e 100644
--- a/pkgs/applications/networking/browsers/palemoon/mozconfig
+++ b/pkgs/applications/networking/browsers/palemoon/mozconfig
@@ -19,7 +19,7 @@ ac_add_options --enable-jemalloc
 ac_add_options --enable-strip
 ac_add_options --enable-devtools
 ac_add_options --enable-av1
-ac_add_options --enable-phoenix-extensions
+ac_add_options --enable-jxl
 
 ac_add_options --disable-eme
 ac_add_options --disable-webrtc
diff --git a/pkgs/applications/science/machine-learning/vowpal-wabbit/default.nix b/pkgs/applications/science/machine-learning/vowpal-wabbit/default.nix
index 8dd55efaeb52..88330a579015 100644
--- a/pkgs/applications/science/machine-learning/vowpal-wabbit/default.nix
+++ b/pkgs/applications/science/machine-learning/vowpal-wabbit/default.nix
@@ -1,42 +1,44 @@
-{ lib, stdenv, fetchFromGitHub, cmake, boost, flatbuffers, rapidjson, spdlog, zlib }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, boost, eigen, rapidjson, spdlog, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "vowpal-wabbit";
-  version = "9.0.1";
+  version = "9.6.0";
 
   src = fetchFromGitHub {
     owner = "VowpalWabbit";
     repo = "vowpal_wabbit";
     rev = version;
-    sha256 = "sha256-ZUurY2bmTKKIW4GR4oiIpLxb6DSRUNJI/EyNSOu9D9c=";
+    sha256 = "sha256-iSsxpeTRZjIhZaYBeoKLHl9j1aBIXWjONmAInmKvU/I=";
   };
 
+  patches = [
+    # Fix x86_64-linux build by adding missing include
+    # https://github.com/VowpalWabbit/vowpal_wabbit/pull/4275
+    (fetchpatch {
+      url = "https://github.com/VowpalWabbit/vowpal_wabbit/commit/0cb410dfc885ca1ecafd1f8a962b481574fb3b82.patch";
+      sha256 = "sha256-bX3eJ+vMTEMAo3EiESQTDryBP0h2GtnMa/Fz0rTeaNY=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [
     boost
-    flatbuffers
+    eigen
     rapidjson
     spdlog
     zlib
   ];
 
-  # -DBUILD_TESTS=OFF is set as both it saves time in the build and the default
-  # cmake flags appended by the builder include -DBUILD_TESTING=OFF for which
-  # this is the equivalent flag.
-  # Flatbuffers are an optional feature.
-  # BUILD_FLATBUFFERS=ON turns it on. This will still consume Flatbuffers as a
-  # system dependency
   cmakeFlags = [
     "-DVW_INSTALL=ON"
-    "-DBUILD_TESTS=OFF"
     "-DBUILD_JAVA=OFF"
     "-DBUILD_PYTHON=OFF"
-    "-DUSE_LATEST_STD=ON"
     "-DRAPIDJSON_SYS_DEP=ON"
     "-DFMT_SYS_DEP=ON"
     "-DSPDLOG_SYS_DEP=ON"
-    "-DBUILD_FLATBUFFERS=ON"
+    "-DVW_BOOST_MATH_SYS_DEP=ON"
+    "-DVW_EIGEN_SYS_DEP=ON"
   ];
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/git-and-tools/git-delete-merged-branches/default.nix b/pkgs/applications/version-management/git-and-tools/git-delete-merged-branches/default.nix
index 19e3a58baf40..e24003c85891 100644
--- a/pkgs/applications/version-management/git-and-tools/git-delete-merged-branches/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-delete-merged-branches/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "git-delete-merged-branches";
-  version = "7.2.0";
+  version = "7.2.2";
 
   src = fetchFromGitHub {
     owner = "hartwork";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-pdP+DDJOSqr/fUQPtb84l/8J4EA81nlk/U8h24X8n+I=";
+    sha256 = "sha256-Q83s0kkrArRndxQa+V+eZw+iaJje7VR+aPScB33l1W0=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/applications/video/mpv/scripts/sponsorblock.nix b/pkgs/applications/video/mpv/scripts/sponsorblock.nix
index 2db4cf53d004..b43ce6afdff8 100644
--- a/pkgs/applications/video/mpv/scripts/sponsorblock.nix
+++ b/pkgs/applications/video/mpv/scripts/sponsorblock.nix
@@ -1,4 +1,4 @@
-{ lib, stdenvNoCC, fetchFromGitHub, fetchpatch, python3 }:
+{ lib, stdenvNoCC, fetchFromGitHub, fetchpatch, python3, nix-update-script }:
 
 # Usage: `pkgs.mpv.override { scripts = [ pkgs.mpvScripts.sponsorblock ]; }`
 stdenvNoCC.mkDerivation {
@@ -41,7 +41,10 @@ stdenvNoCC.mkDerivation {
 
   passthru = {
     scriptName = "sponsorblock.lua";
-    updateScript = ./update-sponsorblock.sh;
+    updateScript = nix-update-script {
+      attrPath = "mpvScripts.sponsorblock";
+      extraArgs = [ "--version=branch" ];
+    };
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/video/mpv/scripts/update-sponsorblock.sh b/pkgs/applications/video/mpv/scripts/update-sponsorblock.sh
deleted file mode 100755
index b4888365a6f3..000000000000
--- a/pkgs/applications/video/mpv/scripts/update-sponsorblock.sh
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p common-updater-scripts git jq nix nix-prefetch-git
-git_url='https://github.com/po5/mpv_sponsorblock.git'
-git_branch='master'
-git_dir='/var/tmp/mpv_sponsorblock.git'
-nix_file="$(dirname "${BASH_SOURCE[0]}")/sponsorblock.nix"
-pkg='mpvScripts.sponsorblock'
-
-set -euo pipefail
-
-info() {
-    if [ -t 2 ]; then
-        set -- '\033[32m%s\033[39m\n' "$@"
-    else
-        set -- '%s\n' "$@"
-    fi
-    printf "$@" >&2
-}
-
-old_rev=$(nix-instantiate --eval --strict --json -A "$pkg.src.rev" | jq -r)
-old_version=$(nix-instantiate --eval --strict --json -A "$pkg.version" | jq -r)
-today=$(LANG=C date -u +'%Y-%m-%d')
-
-info "fetching $git_url..."
-if [ ! -d "$git_dir" ]; then
-    git init --initial-branch="$git_branch" "$git_dir"
-    git -C "$git_dir" remote add origin "$git_url"
-fi
-git -C "$git_dir" fetch origin "$git_branch"
-
-# use latest commit before today, we should not call the version *today*
-# because there might still be commits coming
-# use the day of the latest commit we picked as version
-new_rev=$(git -C "$git_dir" log -n 1 --format='format:%H' --before="${today}T00:00:00Z" "origin/$git_branch")
-new_version="unstable-$(git -C "$git_dir" log -n 1 --format='format:%cs' "$new_rev")"
-info "latest commit before $today: $new_rev"
-
-if [ "$new_rev" = "$old_rev" ]; then
-    info "$pkg is up-to-date."
-    exit
-fi
-
-new_sha256=$(nix-prefetch-git --rev "$new_rev" "$git_dir" | jq -r .sha256)
-update-source-version "$pkg" \
-    "$new_version" \
-    "$new_sha256" \
-    --rev="$new_rev"
-git add "$nix_file"
-git commit --verbose --message "$pkg: $old_version -> $new_version"
diff --git a/pkgs/common-updater/nix-update.nix b/pkgs/common-updater/nix-update.nix
index 13b85bf52fff..bb547302b79a 100644
--- a/pkgs/common-updater/nix-update.nix
+++ b/pkgs/common-updater/nix-update.nix
@@ -1,5 +1,7 @@
 { nix-update }:
 
-{ attrPath }:
+{ attrPath
+, extraArgs ? []
+}:
 
-[ "${nix-update}/bin/nix-update" attrPath ]
+[ "${nix-update}/bin/nix-update" ] ++ extraArgs ++ [ attrPath ]
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index ddb178e35c44..d5cc59b41030 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.15.15";
+  version = "0.15.16";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    sha256 = "sha256-vWpm9tbzLZE+rrEHC6mBH+ajMdhdAk9Fwy5MBFG35ss=";
+    sha256 = "sha256-m23K1BH1Cw452GN14G9rmFi0a+sGnPwIdSyWXqTqiKw=";
   };
 
   vendorSha256 = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/development/tools/misc/patsh/default.nix b/pkgs/development/tools/misc/patsh/default.nix
new file mode 100644
index 000000000000..9d79fc8ba53e
--- /dev/null
+++ b/pkgs/development/tools/misc/patsh/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, runCommand
+, tree-sitter
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "patsh";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-KmQVZwZC7KHlzNnL2IKQ76wHUDNUZKz/aFaY4ujvBo4=";
+  };
+
+  cargoSha256 = "sha256-vozQKBxAVELdqTnqBpgHX0Wyk18EZAtpiRsKjwz8xKE=";
+
+  # tests fail on darwin due to rpath issues
+  doCheck = !stdenv.isDarwin;
+
+  TREE_SITTER_BASH = runCommand "tree-sitter-bash" { } ''
+    mkdir $out
+    ln -s ${tree-sitter.builtGrammars.tree-sitter-bash}/parser $out/libtree-sitter-bash.a
+  '';
+
+  meta = with lib; {
+    description = "A command-line tool for patching shell scripts inspired by resholve";
+    homepage = "https://github.com/nix-community/patsh";
+    changelog = "https://github.com/nix-community/patsh/blob/v${version}/CHANGELOG.md";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
diff --git a/pkgs/development/tools/okteto/default.nix b/pkgs/development/tools/okteto/default.nix
index e4cfa4338277..e0313950ebc4 100644
--- a/pkgs/development/tools/okteto/default.nix
+++ b/pkgs/development/tools/okteto/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "okteto";
-  version = "2.9.0";
+  version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     rev = version;
-    hash = "sha256-bcuGxz5Cn67SzGq+0fFR9ERnW829H4nKV2M+3/xu7s4=";
+    hash = "sha256-kdYuo+xtGvL+PGhDbW5jL3m0jsakxcZ1DE2i3KbmMQc=";
   };
 
   vendorHash = "sha256-/oR8R0/GC6cgCqXinCRH5x93qgRPeQmxHgZZGshrDr4=";
diff --git a/pkgs/development/tools/protoc-gen-connect-go/default.nix b/pkgs/development/tools/protoc-gen-connect-go/default.nix
index f95af13c2652..6aa0425811d2 100644
--- a/pkgs/development/tools/protoc-gen-connect-go/default.nix
+++ b/pkgs/development/tools/protoc-gen-connect-go/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "protoc-gen-connect-go";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "connect-go";
     rev = "v${version}";
-    sha256 = "sha256-v+WBO7gcoInI9MgEDxuz1kBSz0w5+RGpaXrqACE9WRA=";
+    sha256 = "sha256-h1zZ4xYGS/zemb/vPvDGHRiIm4bCLeghhqHft2ll+oY=";
   };
 
   vendorSha256 = "sha256-Bh2JCWTaML/QU/sLBsxLKMzzH++K22BTGusfcVW2GBw=";
diff --git a/pkgs/development/tools/zed/default.nix b/pkgs/development/tools/zed/default.nix
index 1eafbaab016c..54ba458bbb6b 100644
--- a/pkgs/development/tools/zed/default.nix
+++ b/pkgs/development/tools/zed/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "zed";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "brimdata";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-BK4LB37jr/9O0sjYgFtnEkbFqTsp/1+hcmCNMFDPiPM=";
+    sha256 = "sha256-DVQoWam5szELJ3OeIKHYF0CBZ0AJlhuIJRrdhqmyhQM=";
   };
 
-  vendorSha256 = "sha256-oAkQRUaEP/RNjpDH4U8XFVokf7KiLk0OWMX+U7qny70=";
+  vendorSha256 = "sha256-2zSSjAoeb+7Nk/dxpvp5P2/bSJXgkA0TieTQHK4ym1Y=";
 
   subPackages = [ "cmd/zed" "cmd/zq" ];
 
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index 6df91c317b9b..b7d890a83a09 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -4,9 +4,9 @@
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "09942dee6621e7047a63dffcc61b3bbf78cef2c6",
-    "sha256": "sha256-0Cb1Qsn6vnrzd4pZm1GZxlVQNn5dYKUR/xWMCG37GSk=",
-    "version": "unstable-2022-11-02"
+    "rev": "516efd2df3f7d242c2d1df416053b4991a554116",
+    "sha256": "sha256-4Rd8SZv2c61ROBPjOEMbVTZ8aFjerPROfU9iRt1KOg4=",
+    "version": "unstable-2022-11-17"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
diff --git a/pkgs/servers/nitter/update.sh b/pkgs/servers/nitter/update.sh
index e756eff5fb98..30405f34b22e 100755
--- a/pkgs/servers/nitter/update.sh
+++ b/pkgs/servers/nitter/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p common-updater-scripts curl jq nix nix-prefetch-git patchutils
+#!nix-shell -i bash -p curl jq nix nix-update patchutils
 set -euo pipefail
 
 info() {
@@ -11,19 +11,9 @@ info() {
     printf "$@" >&2
 }
 
-nitter_old_version=$(nix-instantiate --eval --strict --json -A nitter.version . | jq -r .)
 nitter_old_rev=$(nix-instantiate --eval --strict --json -A nitter.src.rev . | jq -r .)
-today=$(LANG=C date -u +'%Y-%m-%d')
-
-# use latest commit before today, we should not call the version *today*
-# because there might still be commits coming
-# use the day of the latest commit we picked as version
-commit=$(curl -Sfs "https://api.github.com/repos/zedeus/nitter/compare/$nitter_old_rev~1...master" \
-    | jq '.commits | map(select(.commit.committer.date < $today) | {sha, date: .commit.committer.date}) | .[-1]' --arg today "$today")
-nitter_new_rev=$(jq -r '.sha' <<< "$commit")
-nitter_new_version="unstable-$(jq -r '.date[0:10]' <<< "$commit")"
-info "latest commit before $today: $nitter_new_rev ($(jq -r '.date' <<< "$commit"))"
-
+nix-update --version=branch --commit nitter
+nitter_new_rev=$(nix-instantiate --eval --strict --json -A nitter.src.rev . | jq -r .)
 if [ "$nitter_new_rev" = "$nitter_old_rev" ]; then
     info "nitter is up-to-date."
     exit
@@ -33,8 +23,3 @@ if curl -Sfs "https://github.com/zedeus/nitter/compare/$nitter_old_rev...$nitter
 | lsdiff | grep -Fxe 'a/nitter.nimble' -e 'b/nitter.nimble' > /dev/null; then
     info "nitter.nimble changed, some dependencies probably need updating."
 fi
-
-nitter_new_sha256=$(nix-prefetch-git --rev "$nitter_new_rev" "https://github.com/zedeus/nitter.git" | jq -r .sha256)
-update-source-version nitter "$nitter_new_version" "$nitter_new_sha256" --rev="$nitter_new_rev"
-git commit --all --verbose --message "nitter: $nitter_old_version -> $nitter_new_version"
-info "Updated nitter to $nitter_new_version."
diff --git a/pkgs/servers/nosql/immudb/default.nix b/pkgs/servers/nosql/immudb/default.nix
index 753697518f50..e227f5f5a5dc 100644
--- a/pkgs/servers/nosql/immudb/default.nix
+++ b/pkgs/servers/nosql/immudb/default.nix
@@ -14,13 +14,13 @@ let
 in
 buildGoModule rec {
   pname = "immudb";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "codenotary";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-L8RvbMmq9DPJ2FvxlCE1KC8TRhmZA5CrzUPmr9JNy0Q=";
+    sha256 = "sha256-G6Oy+veZGQYtRyeOSpFmQ3Ehro3Ra69iCQVl9YnerAk=";
   };
 
   preBuild = ''
diff --git a/pkgs/tools/X11/sx/default.nix b/pkgs/tools/X11/sx/default.nix
index faddc7486809..f48e59c753eb 100644
--- a/pkgs/tools/X11/sx/default.nix
+++ b/pkgs/tools/X11/sx/default.nix
@@ -1,12 +1,11 @@
 { lib
-, bash
-, coreutils
+, stdenvNoCC
 , fetchFromGitHub
-, resholve
+, patsh
 , xorg
 }:
 
-resholve.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "sx";
   version = "2.1.7";
 
@@ -19,20 +18,16 @@ resholve.mkDerivation rec {
 
   makeFlags = [ "PREFIX=$(out)" ];
 
-  solutions = {
-    sx = {
-      scripts = [ "bin/sx" ];
-      interpreter = "${bash}/bin/sh";
-      inputs = [
-        coreutils
-        xorg.xauth
-        xorg.xorgserver
-      ];
-      execer = [
-        "cannot:${xorg.xorgserver}/bin/Xorg"
-      ];
-    };
-  };
+  nativeBuildInputs = [ patsh ];
+
+  buildInputs = [
+    xorg.xauth
+    xorg.xorgserver
+  ];
+
+  postInstall = ''
+    patsh -f $out/bin/sx -s ${builtins.storeDir}
+  '';
 
   meta = with lib; {
     description = "Simple alternative to both xinit and startx for starting a Xorg server";
diff --git a/pkgs/tools/networking/kapp/default.nix b/pkgs/tools/networking/kapp/default.nix
index 5a9bf692b930..19596e4cf13e 100644
--- a/pkgs/tools/networking/kapp/default.nix
+++ b/pkgs/tools/networking/kapp/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kapp";
-  version = "0.53.0";
+  version = "0.54.0";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-kapp";
     rev = "v${version}";
-    sha256 = "sha256-y4afSca87vPWPPWbSMS/Q3Y6TZg8fl0eu0Vw3udp3zA=";
+    sha256 = "sha256-68JIsL+qrXB3yLU+euznAVPv57cQd5qzvHn547nwHVI=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/tools/security/firefox_decrypt/default.nix b/pkgs/tools/security/firefox_decrypt/default.nix
index 3ca0774e22ea..86bfb5f72242 100644
--- a/pkgs/tools/security/firefox_decrypt/default.nix
+++ b/pkgs/tools/security/firefox_decrypt/default.nix
@@ -3,6 +3,7 @@
 , stdenvNoCC
 , nss
 , wrapPython
+, nix-update-script
 }:
 
 stdenvNoCC.mkDerivation rec {
@@ -34,7 +35,10 @@ stdenvNoCC.mkDerivation rec {
     wrapPythonPrograms
   '';
 
-  passthru.updateScript = ./update.sh;
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+    extraArgs = [ "--version=branch" ];
+  };
 
   meta = with lib; {
     homepage = "https://github.com/unode/firefox_decrypt";
diff --git a/pkgs/tools/security/firefox_decrypt/update.sh b/pkgs/tools/security/firefox_decrypt/update.sh
deleted file mode 100755
index a56807f0ba0c..000000000000
--- a/pkgs/tools/security/firefox_decrypt/update.sh
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p common-updater-scripts git jq nix nix-prefetch-git
-git_url='https://github.com/unode/firefox_decrypt.git'
-git_branch='master'
-git_dir='/var/tmp/firefox_decrypt.git'
-nix_file="$(dirname "${BASH_SOURCE[0]}")/default.nix"
-pkg='firefox_decrypt'
-
-set -euo pipefail
-
-info() {
-    if [ -t 2 ]; then
-        set -- '\033[32m%s\033[39m\n' "$@"
-    else
-        set -- '%s\n' "$@"
-    fi
-    printf "$@" >&2
-}
-
-old_rev=$(nix-instantiate --eval --strict --json -A "$pkg.src.rev" | jq -r)
-old_version=$(nix-instantiate --eval --strict --json -A "$pkg.version" | jq -r)
-today=$(LANG=C date -u +'%Y-%m-%d')
-
-info "fetching $git_url..."
-if [ ! -d "$git_dir" ]; then
-    git init --initial-branch="$git_branch" "$git_dir"
-    git -C "$git_dir" remote add origin "$git_url"
-fi
-git -C "$git_dir" fetch origin "$git_branch"
-
-# use latest commit before today, we should not call the version *today*
-# because there might still be commits coming
-# use the day of the latest commit we picked as version
-new_rev=$(git -C "$git_dir" log -n 1 --format='format:%H' --before="${today}T00:00:00Z" "origin/$git_branch")
-new_version="unstable-$(git -C "$git_dir" log -n 1 --format='format:%cs' "$new_rev")"
-info "latest commit before $today: $new_rev"
-
-if [ "$new_rev" = "$old_rev" ]; then
-    info "$pkg is up-to-date."
-    exit
-fi
-
-new_sha256=$(nix-prefetch-git --rev "$new_rev" "$git_dir" | jq -r .sha256)
-update-source-version "$pkg" \
-    "$new_version" \
-    "$new_sha256" \
-    --rev="$new_rev"
-git add "$nix_file"
-git commit --verbose --message "$pkg: $old_version -> $new_version"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e3cf6238235f..49089810f63f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17552,6 +17552,8 @@ with pkgs;
 
   patchelfUnstable = lowPrio (callPackage ../development/tools/misc/patchelf/unstable.nix { });
 
+  patsh = callPackage ../development/tools/misc/patsh { };
+
   pax-rs = callPackage ../development/tools/pax-rs { };
 
   perfect-hash = callPackage ../development/tools/misc/perfect-hash { };
@@ -31550,7 +31552,7 @@ with pkgs;
 
   qmidiroute = callPackage ../applications/audio/qmidiroute { };
 
-  qmmp = libsForQt5.callPackage ../applications/audio/qmmp { };
+  qmmp = qt6Packages.callPackage ../applications/audio/qmmp { };
 
   qnotero = libsForQt5.callPackage ../applications/office/qnotero { };