diff --git a/pkgs/applications/networking/browsers/firefox/packages.nix b/pkgs/applications/networking/browsers/firefox/packages.nix
index b1bd57f48b84..772c6e5ec503 100644
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@@ -29,11 +29,11 @@
 
   firefox-beta = buildMozillaMach rec {
     pname = "firefox-beta";
-    version = "121.0b3";
+    version = "121.0b4";
     applicationName = "Mozilla Firefox Beta";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "95dd68c50af5784c44e40ad3a8ac6b4fb259fa8f56bc5e5de940d03dec1838b143712680826b4d260fefdad314464d24679911f21b1095512a86cdf4eb2648c9";
+      sha512 = "b8c1be63be633744b249d2e0ffe77abcc92f0f70c0d7084395031643fb68c0b1fc32a6fcb55a25fc255e4eb8c40e818b209bb0077e416e652ae0c9463045fc12";
     };
 
     meta = {
@@ -57,12 +57,12 @@
 
   firefox-devedition = (buildMozillaMach rec {
     pname = "firefox-devedition";
-    version = "121.0b3";
+    version = "121.0b4";
     applicationName = "Mozilla Firefox Developer Edition";
     branding = "browser/branding/aurora";
     src = fetchurl {
       url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "a5ed25159e63122f27bd05810eaf665834022ae407c029734ad41ef1ed5e3956497873f5210b7c385245056718837bd17c47cfc2e2e438a4c3274d2462ce51f8";
+      sha512 = "11234fda39c80a217a715884524e12febf5f920a680b0828d3619ec6ae97fe6e377c36ac86353f1aadb0569e4f04e4105714c29b447eb80ea9bad18bdd664e75";
     };
 
     meta = {
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index afe766f841bc..9662b1b54e0d 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,15 +1,15 @@
 {
-  "packageVersion": "119.0.1-1",
+  "packageVersion": "120.0-1",
   "source": {
-    "rev": "119.0.1-1",
-    "sha256": "1ghxrylxrb5i37i4z2hrb8dn9lndhs75pjvhdafg079jmar5wfn7"
+    "rev": "120.0-1",
+    "sha256": "1wms3kyimmfzl64rbphgap2sm87lwkl0pr24rx4rxf3px3bq97f3"
   },
   "settings": {
-    "rev": "095f50ed91aa7db2de9c67763cf46bae09146a58",
-    "sha256": "0nwrzcqxa72wcbxjbilxl340i69m5l0qr7gq2s6a76bbzxg502gi"
+    "rev": "b587388bdbe63511c478cb8b5f82c2e80040414c",
+    "sha256": "03cw6wh7358pgld4qgs534pl2lnfvwc0xl2yyb3n3pyvmba6cyrp"
   },
   "firefox": {
-    "version": "119.0.1",
-    "sha512": "4f3201aee10e7b831cc384b2c7430a24f4de81f703115a917f9eb7acecb2ae1725f11af56c41257a056bb9d7a4d749d590cc9baffcd6e13852be45aaecf8163a"
+    "version": "120.0",
+    "sha512": "31d5f9e1d4173280c8de6d9b8551bc6bba5e2c49b84f944f50d42002d5b39c2fb743bc130f26c81160388a102b8301b94a0a378ecdfa6f943860f971a860df8c"
   }
 }
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
index a2eda0dc3c17..fa74f90bca4e 100644
--- a/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/browser.nix
@@ -1,4 +1,4 @@
-{ channel, version, revision, sha256 }:
+{ channel, version, revision, hash }:
 
 { stdenv
 , fetchurl
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/${baseName}-${channel}/${baseName}-${channel}_${version}-${revision}_amd64.deb";
-    inherit sha256;
+    inherit hash;
   };
 
   nativeBuildInputs = [
@@ -128,13 +128,13 @@ stdenv.mkDerivation rec {
       --set-rpath "${libPath.libGLESv2}" \
       opt/microsoft/${shortName}/libGLESv2.so
 
-    patchelf \
-      --set-rpath "${libPath.libsmartscreenn}" \
-      opt/microsoft/${shortName}/libsmartscreenn.so
-
     patchelf \
       --set-rpath "${libPath.liboneauth}" \
       opt/microsoft/${shortName}/liboneauth.so
+  '' + lib.optionalString (lib.versionOlder version "120") ''
+    patchelf \
+      --set-rpath "${libPath.libsmartscreenn}" \
+      opt/microsoft/${shortName}/libsmartscreenn.so
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/default.nix b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
index d034c68d85fa..51b3d6730862 100644
--- a/pkgs/applications/networking/browsers/microsoft-edge/default.nix
+++ b/pkgs/applications/networking/browsers/microsoft-edge/default.nix
@@ -1,20 +1,20 @@
 {
   stable = import ./browser.nix {
     channel = "stable";
-    version = "119.0.2151.44";
+    version = "119.0.2151.72";
     revision = "1";
-    sha256 = "sha256-QY9Dk4tcpuNJGVcAcaIaVXAT95K87rK7ZQo7COMDpVU=";
+    hash = "sha256-thBx/+6thNXXKppA11IOG5EiMx7pA9FA3vSkwa9+F0o=";
   };
   beta = import ./browser.nix {
     channel = "beta";
-    version = "119.0.2151.44";
+    version = "120.0.2210.22";
     revision = "1";
-    sha256 = "sha256-aLiitzCoMvJH2xAfo9bO7lEPMqKlb++BdJkrWx61SMc=";
+    hash = "sha256-GayVVZbtGLQmmXu+k4wdsD+rPwGiSPHnQwzVYyKWhHM=";
   };
   dev = import ./browser.nix {
     channel = "dev";
-    version = "120.0.2186.2";
+    version = "121.0.2220.3";
     revision = "1";
-    sha256 = "sha256-L/rtOddk4bt8ffkRnq0BYcVjrSb7RmDaay85S5vixSM=";
+    hash = "sha256-M3r+SLp3lQ7oWDYoM7aNZDC5wbMxFZggsu0Iuyyw/cw=";
   };
 }
diff --git a/pkgs/applications/networking/browsers/microsoft-edge/update.py b/pkgs/applications/networking/browsers/microsoft-edge/update.py
index c5a80d7e608e..856264101e47 100755
--- a/pkgs/applications/networking/browsers/microsoft-edge/update.py
+++ b/pkgs/applications/networking/browsers/microsoft-edge/update.py
@@ -50,7 +50,7 @@ def nix_expressions(latest: dict[str, Packages]):
               channel = "{channel}";
               version = "{version}";
               revision = "{revision}";
-              sha256 = "{sri}";
+              hash = "{sri}";
             }};'''
         )
         channel_strs.append(channel_str)
diff --git a/pkgs/applications/virtualization/open-vm-tools/default.nix b/pkgs/applications/virtualization/open-vm-tools/default.nix
index d1e701247588..457c484a9380 100644
--- a/pkgs/applications/virtualization/open-vm-tools/default.nix
+++ b/pkgs/applications/virtualization/open-vm-tools/default.nix
@@ -42,13 +42,13 @@
 
 stdenv.mkDerivation rec {
   pname = "open-vm-tools";
-  version = "12.2.0";
+  version = "12.3.0";
 
   src = fetchFromGitHub {
     owner = "vmware";
     repo = "open-vm-tools";
     rev = "stable-${version}";
-    hash = "sha256-ikodKEvlg+QU0af8IjiMjhMyQSV6icHVUczf0rWfVaI=";
+    hash = "sha256-YVpWomLED5sBKXKdJtuDjb7/aKB2flVIm2ED3xSsccE=";
   };
 
   sourceRoot = "${src.name}/open-vm-tools";
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index a521360392d7..b6be53351a75 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,42 +1,42 @@
 {
     "testing": {
-        "version": "6.7-rc2",
-        "hash": "sha256:026aqfblls4zl2j8rpnl7rjh9ma82jlwb6x00jryvv44kvwm0fgs"
+        "version": "6.7-rc3",
+        "hash": "sha256:1bi80271g76pcajzmzr0dxcmzzlzicqddm38mr7pkz8zi0070arf"
     },
     "6.5": {
-        "version": "6.5.12",
-        "hash": "sha256:17rmkzxszp2jg1zx2mmdcy30ffrsd0qms513sxd14klp5k9w2saa"
+        "version": "6.5.13",
+        "hash": "sha256:1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq"
     },
     "6.4": {
         "version": "6.4.16",
         "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
     },
     "6.1": {
-        "version": "6.1.63",
-        "hash": "sha256:13bmy22mi4ybl21kr3hdy6qiaawiqz2jgl2gl9hwqkyx04xh97f2"
+        "version": "6.1.64",
+        "hash": "sha256:1ry7dp39010hfja1wial6r6q6ilgygwm7gdz22bg4rzaycwam7b2"
     },
     "5.15": {
-        "version": "5.15.139",
-        "hash": "sha256:0kh4v1224a7p7ib64pnmc1qid3d1lvg3c14l5s4rpr8qzq6w2s4w"
+        "version": "5.15.140",
+        "hash": "sha256:0isa9si9wjn10lw41431wdqsbp9y685ch5lzhwswng3g6j5ywaxy"
     },
     "5.10": {
-        "version": "5.10.201",
-        "hash": "sha256:0642y6qj2d4aww6jcki81ba53pvjyfazjxgzgj8brqx8ixchdz3a"
+        "version": "5.10.202",
+        "hash": "sha256:12zs2bz2plps6xp80sdg36zkyr00rf5l5c85jl4dd7b9klly04ij"
     },
     "5.4": {
-        "version": "5.4.261",
-        "hash": "sha256:1hsgnv2vcziflhzrrxiny2yp88ybdqda48fm60xhpaphhs0cgfii"
+        "version": "5.4.262",
+        "hash": "sha256:1p34x33gkvpv26zcrpx1i6dr7dknyxj8gnp6caqb8sj58h3slgkx"
     },
     "4.19": {
-        "version": "4.19.299",
-        "hash": "sha256:12p431p2jqjfsf0all3fgn47z9fr2cdqyxipfrf4s4mlw4hpbyy6"
+        "version": "4.19.300",
+        "hash": "sha256:0ilksl94gjpc4pzc90swfawsl8lvibpq14nkaxzl0831i219ahd8"
     },
     "4.14": {
-        "version": "4.14.330",
-        "hash": "sha256:0rwgzyfmrns6zir0dpxkwz2hm3z8c0af3wy11lmxamaa5i2wq3k7"
+        "version": "4.14.331",
+        "hash": "sha256:03sk82dgvccv70i3hy8gf2hw0n4m305f7rxjw93p7jnjrbpdrp1r"
     },
     "6.6": {
-        "version": "6.6.2",
-        "hash": "sha256:0zmpk5ls6282j88xpnymkr8z5hxpk2495hjjxm0jmb6ninnzdm3k"
+        "version": "6.6.3",
+        "hash": "sha256:19wmjkyyv5glv1w647qisrv829hhhpba5x905a7p7kch9wyzrv98"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 65ca352b53b8..ce26a38ed069 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.199-rt97"; # updated by ./update-rt.sh
+  version = "5.10.201-rt98"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1h944syk7n6c4j1djlx19n77alzwbxcdza77c9ykicgfynhpgsm0";
+    sha256 = "0642y6qj2d4aww6jcki81ba53pvjyfazjxgzgj8brqx8ixchdz3a";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "13k7md0a63q4r5vqqvbszmg3kzp5np0hdaj1siyl4yvs9j78d03s";
+      sha256 = "1g7xbjsfrgins3agz9sq9ia13h5k9605gak7s14z5i4vd34y8pk8";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/servers/jellyfin/web.nix b/pkgs/servers/jellyfin/web.nix
index 6f9d278091bb..bff9cd411aef 100644
--- a/pkgs/servers/jellyfin/web.nix
+++ b/pkgs/servers/jellyfin/web.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "jellyfin-web";
-  version = "10.8.11";
+  version = "10.8.12";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-web";
     rev = "v${version}";
-    hash = "sha256-Gl8eaC/AXBD956tAepwWVG3lSvL4rBCcgmkHeT/mrzM=";
+    hash = "sha256-T5MACoNg6yADfM7eike3f6V/ELZXrZYP+3Cz6ea8WtQ=";
   };
 
-  npmDepsHash = "sha256-HoRteA6KFCFxDdwGtDKrvwWCMYNfYQWlit52RAN1eAU=";
+  npmDepsHash = "sha256-s+14x/jucCAxDWlQjCngjGtLB+4PCuO6R0qxP+SZ1+s=";
 
   npmBuildScript = [ "build:production" ];
 
diff --git a/pkgs/servers/sftpgo/default.nix b/pkgs/servers/sftpgo/default.nix
index e0c4bf9a1903..ba510139ceb6 100644
--- a/pkgs/servers/sftpgo/default.nix
+++ b/pkgs/servers/sftpgo/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "sftpgo";
-  version = "2.5.0";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "drakkan";
     repo = "sftpgo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-UL/CSNRvT9e+WAmE7nwd/EU7YOJ1mwMSnOIrd0dQJrk=";
+    hash = "sha256-SW+8Lp2NNW2I1BoOGVRzIx+1+DsffxlmHf8xFCxTyNw=";
   };
 
-  vendorHash = "sha256-q6GgaMlmBPjovCpLku9/ENlEc0lF8gck1fM+fpptti4=";
+  vendorHash = "sha256-IQg50z+X0dUOk2zEiGejywEE+8SCtS3mdgUAxIddcQs=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/admin/pgadmin/default.nix b/pkgs/tools/admin/pgadmin/default.nix
index 7e0ed163d93a..9984c7c24df6 100644
--- a/pkgs/tools/admin/pgadmin/default.nix
+++ b/pkgs/tools/admin/pgadmin/default.nix
@@ -2,6 +2,7 @@
 , python3
 , fetchFromGitHub
 , fetchYarnDeps
+, fetchpatch
 , zlib
 , nixosTests
 , postgresqlTestHook
@@ -43,6 +44,22 @@ pythonPackages.buildPythonApplication rec {
   format = "setuptools";
 
   patches = [
+    (fetchpatch {
+      name = "CVE-2023-5002.part-1.patch";
+      url = "https://github.com/pgadmin-org/pgadmin4/commit/02ecc82e73f12e84e54c3947ada943d80f746c87.patch";
+      excludes = [ "docs/en_US/release_notes_7_7.rst" ];
+      hash = "sha256-9a7X+UtHOMB2GgOvup0IgEbRgJu/mAcmTvc1GOrs1Vg=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-5002.part-2.patch";
+      url = "https://github.com/pgadmin-org/pgadmin4/commit/35f05e49b3632a0a674b9b36535a7fe2d93dd0c2.patch";
+      hash = "sha256-OHco1of/1BPKewDFvkxGZWEx7uazzZs9vr0ziDf7zhM=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-5002.part-3.patch";
+      url = "https://github.com/pgadmin-org/pgadmin4/commit/3b616b2fb1cf0dc31933aec751aea8ec266e5bcc.patch";
+      hash = "sha256-EhpnAdWN8yfVmUv2JxQT1hIcV6mJxxFcsSFwxXX0qYw=";
+    })
     # Expose setup.py for later use
     ./expose-setup.py.patch
     # check for permission of /etc/pgadmin/config_system and don't fail
diff --git a/pkgs/tools/graphics/vips/default.nix b/pkgs/tools/graphics/vips/default.nix
index 9c4099783e0c..85f9e4c3d9e7 100644
--- a/pkgs/tools/graphics/vips/default.nix
+++ b/pkgs/tools/graphics/vips/default.nix
@@ -39,7 +39,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vips";
-  version = "8.14.2";
+  version = "8.14.4";
 
   outputs = [ "bin" "out" "man" "dev" ] ++ lib.optionals (!stdenv.isDarwin) [ "devdoc" ];
 
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     owner = "libvips";
     repo = "libvips";
     rev = "v${version}";
-    hash = "sha256-QUWZ11t2JEJBdpNuIY2uRiSL/hffRbV0SV5HowxWaME=";
+    hash = "sha256-y2Tyi8rxal3s3jLURRGPuCAUuHITRPl1+zJZDp557+I=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
diff --git a/pkgs/tools/misc/zellij/default.nix b/pkgs/tools/misc/zellij/default.nix
index 6274dae69489..624fa1d15d5d 100644
--- a/pkgs/tools/misc/zellij/default.nix
+++ b/pkgs/tools/misc/zellij/default.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zellij";
-  version = "0.39.0";
+  version = "0.39.1";
 
   src = fetchFromGitHub {
     owner = "zellij-org";
     repo = "zellij";
     rev = "v${version}";
-    hash = "sha256-ZKtYXUNuBwQtEHTaPlptiRncFWattkkcAGGzbKalJZE=";
+    hash = "sha256-nT4P/ZlquJz48T8LCRQd5menL8vtGMBSUgZNJYx0Pn4=";
   };
 
-  cargoHash = "sha256-4XRCXQYJaYvnIfEK2b0VuLy/HIFrafLrK9BvZMnCKpY=";
+  cargoHash = "sha256-jp3FS+sEvQY0DtVPCkJjAZlEc2bJOiA20+Pdt//yat4=";
 
   nativeBuildInputs = [
     mandown