diff --git a/pkgs/applications/editors/standardnotes/default.nix b/pkgs/applications/editors/standardnotes/default.nix
index d4e43b4f71de..461e8dc504dc 100644
--- a/pkgs/applications/editors/standardnotes/default.nix
+++ b/pkgs/applications/editors/standardnotes/default.nix
@@ -1,26 +1,14 @@
-{ lib, stdenv, appimageTools, autoPatchelfHook, desktop-file-utils
+{ callPackage, lib, stdenv, appimageTools, autoPatchelfHook, desktop-file-utils
 , fetchurl, libsecret  }:
 
 let
-  version = "3.23.69";
+  srcjson = builtins.fromJSON (builtins.readFile ./src.json);
+  version = srcjson.version;
   pname = "standardnotes";
   name = "${pname}-${version}";
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
-  plat = {
-    i686-linux = "i386";
-    x86_64-linux = "x86_64";
-  }.${stdenv.hostPlatform.system} or throwSystem;
-
-  sha256 = {
-    i686-linux = "sha256-/A2LjV8ky20bcKgs0ijwldryi5VkyROwz49vWYXYQus=";
-    x86_64-linux = "sha256-fA9WH9qUtvAHF9hTFRtxQdpz2dpK0joD0zX9VYBo10g=";
-  }.${stdenv.hostPlatform.system} or throwSystem;
-
-  src = fetchurl {
-    url = "https://github.com/standardnotes/app/releases/download/%40standardnotes%2Fdesktop%40${version}/standard-notes-${version}-linux-${plat}.AppImage";
-    inherit sha256;
-  };
+  src = fetchurl (srcjson.appimage.${stdenv.hostPlatform.system} or throwSystem);
 
   appimageContents = appimageTools.extract {
     inherit name src;
@@ -47,6 +35,8 @@ in appimageTools.wrapType2 rec {
     ln -s ${appimageContents}/usr/share/icons share
   '';
 
+  passthru.updateScript = callPackage ./update.nix {};
+
   meta = with lib; {
     description = "A simple and private notes app";
     longDescription = ''
@@ -55,8 +45,8 @@ in appimageTools.wrapType2 rec {
     '';
     homepage = "https://standardnotes.org";
     license = licenses.agpl3;
-    maintainers = with maintainers; [ mgregoire chuangzhu ];
+    maintainers = with maintainers; [ mgregoire chuangzhu squalus ];
     sourceProvenance = [ sourceTypes.binaryNativeCode ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = builtins.attrNames srcjson.appimage;
   };
 }
diff --git a/pkgs/applications/editors/standardnotes/src.json b/pkgs/applications/editors/standardnotes/src.json
new file mode 100644
index 000000000000..10c7ee38e9cd
--- /dev/null
+++ b/pkgs/applications/editors/standardnotes/src.json
@@ -0,0 +1,13 @@
+{
+  "version": "3.151.3",
+  "appimage": {
+    "x86_64-linux": {
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.151.3/standard-notes-3.151.3-linux-x86_64.AppImage",
+      "hash": "sha512-Wk31nB9OjR8E3cPFfh4KpUqQxXsnerzDt5TgaExXW4OeWLftv3ejyf2ROWXAoqG/8K87OclbunCqS3b2g8hAjA=="
+    },
+    "aarch64-linux": {
+      "url": "https://github.com/standardnotes/app/releases/download/%40standardnotes/desktop%403.151.3/standard-notes-3.151.3-linux-arm64.AppImage",
+      "hash": "sha512-nPTpEJs978wxZjG1pN15ETgUBdGBzl574QHCQNo2ShYvhi9Uf38jCaGQIsY0d779eT8kSHuMBXoAiE/flxfWMQ=="
+    }
+  }
+}
diff --git a/pkgs/applications/editors/standardnotes/update.nix b/pkgs/applications/editors/standardnotes/update.nix
new file mode 100644
index 000000000000..7b5f6616602b
--- /dev/null
+++ b/pkgs/applications/editors/standardnotes/update.nix
@@ -0,0 +1,54 @@
+{ writeScript
+, lib, curl, runtimeShell, jq, coreutils, moreutils, nix, gnused }:
+
+writeScript "update-standardnotes" ''
+  #!${runtimeShell}
+  PATH=${lib.makeBinPath [ jq curl nix coreutils moreutils gnused ]}
+
+  set -euo pipefail
+  set -x
+
+  tmpDir=$(mktemp -d)
+  srcJson=pkgs/applications/editors/standardnotes/src.json
+  jsonPath="$tmpDir"/latest
+
+  oldVersion=$(jq -r .version < "$srcJson")
+
+  curl https://api.github.com/repos/standardnotes/app/releases/latest > "$jsonPath"
+
+  tagName=$(jq -r .tag_name < "$jsonPath")
+
+  if [[ ! "$tagName" =~ "desktop" ]]; then
+    echo "latest release '$tagName' not a desktop release"
+    exit 1
+  fi
+
+  newVersion=$(jq -r .tag_name < "$jsonPath" | sed s,@standardnotes/desktop@,,g)
+
+  if [[ "$oldVersion" == "$newVersion" ]]; then
+    echo "version did not change"
+    exit 0
+  fi
+
+  function getDownloadUrl() {
+    jq -r ".assets[] | select(.name==\"standard-notes-$newVersion-$1.AppImage\") | .browser_download_url" < "$jsonPath"
+  }
+
+  function setJsonKey() {
+    jq "$1 = \"$2\"" "$srcJson" | sponge "$srcJson"
+  }
+
+  function updatePlatform() {
+    nixPlatform="$1"
+    upstreamPlatform="$2"
+    url=$(getDownloadUrl "$upstreamPlatform")
+    hash=$(nix-prefetch-url "$url" --type sha512)
+    sriHash=$(nix hash to-sri --type sha512 $hash)
+    setJsonKey .appimage[\""$nixPlatform"\"].url "$url"
+    setJsonKey .appimage[\""$nixPlatform"\"].hash "$sriHash"
+  }
+
+  updatePlatform x86_64-linux linux-x86_64
+  updatePlatform aarch64-linux linux-arm64
+  setJsonKey .version "$newVersion"
+''
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 472bbbe27142..a84b2a038ae7 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,8 +1,8 @@
 {
-  "packageVersion": "112.0.1-1",
+  "packageVersion": "112.0.1-2",
   "source": {
-    "rev": "112.0.1-1",
-    "sha256": "0bk3idpl11n4gwk8rgfi2pilwx9n56s8dpp7y599h17mlrsw8az4"
+    "rev": "112.0.1-2",
+    "sha256": "1pm4ilc2zx6qx3qqjl7ypl51mcfwq22abi850kq7l3pznb2z0ljw"
   },
   "firefox": {
     "version": "112.0.1",
diff --git a/pkgs/applications/networking/browsers/palemoon/default.nix b/pkgs/applications/networking/browsers/palemoon/default.nix
index b98ff57f97fc..69350e155599 100644
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@@ -45,7 +45,7 @@ assert with lib.strings; (
 
 stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "32.1.0";
+  version = "32.1.1";
 
   src = fetchFromGitea {
     domain = "repo.palemoon.org";
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     repo = "Pale-Moon";
     rev = "${version}_Release";
     fetchSubmodules = true;
-    sha256 = "sha256-yfXcHoPdTknryYFV8mBWHvzs68oELqsJjTC/nT4SMB8=";
+    sha256 = "sha256-Z9dBYO5AGDYRLlnEfHUu6thgc2a8OK/tPuRzwp0j9J8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
index 29d9412137a9..5b34ec8aba7c 100644
--- a/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/gitlab-runner/default.nix
@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitLab, fetchurl, bash }:
 
 let
-  version = "15.8.2";
+  version = "15.11.0";
 in
 buildGoModule rec {
   inherit version;
@@ -17,13 +17,13 @@ buildGoModule rec {
   # For patchShebangs
   buildInputs = [ bash ];
 
-  vendorSha256 = "sha256-YHBp6Grm+atGne/5Ia/1H2xQRODmfWsMGCqHAIE9P4k=";
+  vendorSha256 = "sha256-4eSfNo5S/eottEN4AptGJq6pBDHkNud0Nj5GrqutADM=";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "sha256-kb1xDvU2aP6bI9oziAlUfxbmIq8CgFXPs04hRUmaPyE=";
+    sha256 = "sha256-S4KdEepNWv8J5+r/GT8+8kAKU5fq2iwQU+qyoCY1s0o=";
   };
 
   patches = [
diff --git a/pkgs/tools/misc/screen/default.nix b/pkgs/tools/misc/screen/default.nix
index f9d546a30fe3..5b1e7e232a0a 100644
--- a/pkgs/tools/misc/screen/default.nix
+++ b/pkgs/tools/misc/screen/default.nix
@@ -1,4 +1,13 @@
-{ lib, stdenv, fetchurl, autoreconfHook, ncurses, libxcrypt, utmp, pam ? null }:
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, autoreconfHook
+, ncurses
+, libxcrypt
+, utmp
+, pam ? null
+}:
 
 stdenv.mkDerivation rec {
   pname = "screen";
@@ -9,6 +18,15 @@ stdenv.mkDerivation rec {
     sha256 = "1x1hqy4h47i7hk85f779lkwkm7gkq8h8mxwd0znkh5adpf0m4czr";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-24626.patch";
+      url = "https://git.savannah.gnu.org/cgit/screen.git/patch/?id=e9ad41bfedb4537a6f0de20f00b27c7739f168f7";
+      stripLen = 1;
+      sha256 = "sha256-NV6Uh4h9AK7kQMHqbxeuhjFEvwQH7OWdu7h8pZCGFog=";
+    })
+  ];
+
   configureFlags= [
     "--enable-telnet"
     "--enable-pam"