diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 63babbaf179..588f1a3c138 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -19,6 +19,7 @@
 
 ## backported libraries
 
+, nspr_latest
 , nss_latest
 , rust-cbindgen_latest
 
@@ -95,6 +96,7 @@ let
             then "/Applications/${binaryNameCapitalized}.app/Contents/MacOS"
             else "/bin";
 
+  nspr_pkg = if lib.versionAtLeast ffversion "91" then nspr_latest else nspr;
   rust-cbindgen_pkg = if lib.versionAtLeast ffversion "89" then rust-cbindgen_latest else rust-cbindgen;
 
   # 78 ESR won't build with rustc 1.47
@@ -185,7 +187,7 @@ buildStdenv.mkDerivation ({
     # yasm can potentially be removed in future versions
     # https://bugzilla.mozilla.org/show_bug.cgi?id=1501796
     # https://groups.google.com/forum/#!msg/mozilla.dev.platform/o-8levmLU80/SM_zQvfzCQAJ
-    nspr nss_pkg
+    nspr_pkg nss_pkg
   ]
   ++ lib.optional  alsaSupport alsaLib
   ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
@@ -371,7 +373,7 @@ buildStdenv.mkDerivation ({
     version = ffversion;
     inherit alsaSupport;
     inherit pipewireSupport;
-    inherit nspr;
+    inherit nspr_pkg;
     inherit ffmpegSupport;
     inherit gssSupport;
     inherit execdir;
diff --git a/pkgs/applications/version-management/gitea/default.nix b/pkgs/applications/version-management/gitea/default.nix
index bd61d984c62..65c85261cd4 100644
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@@ -16,12 +16,12 @@ with lib;
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.14.5";
+  version = "1.14.6";
 
   # not fetching directly from the git repo, because that lacks several vendor files for the web UI
   src = fetchurl {
     url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "sha256-8nwLVpe/5IjXJqO179lN80B/3WGUL3LKM8OWdh/bYOE=";
+    sha256 = "sha256-IIoOJlafMD6Kg8Zde3LcoK97PKLmqOUMQN3nmIgqe1o=";
   };
 
   unpackPhase = ''
diff --git a/pkgs/development/libraries/nspr/latest.nix b/pkgs/development/libraries/nspr/latest.nix
new file mode 100644
index 00000000000..c68354a18b6
--- /dev/null
+++ b/pkgs/development/libraries/nspr/latest.nix
@@ -0,0 +1,50 @@
+{ lib, stdenv, fetchurl
+, CoreServices ? null
+, buildPackages }:
+
+stdenv.mkDerivation rec {
+  pname = "nspr";
+  version = "4.32";
+
+  src = fetchurl {
+    url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
+    sha256 = "0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv";
+  };
+
+  patches = [
+    ./0001-Makefile-use-SOURCE_DATE_EPOCH-for-reproducibility.patch
+  ];
+
+  outputs = [ "out" "dev" ];
+  outputBin = "dev";
+
+  preConfigure = ''
+    cd nspr
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace configure --replace '@executable_path/' "$out/lib/"
+    substituteInPlace configure.in --replace '@executable_path/' "$out/lib/"
+  '';
+
+  HOST_CC = "cc";
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  configureFlags = [
+    "--enable-optimize"
+    "--disable-debug"
+  ] ++ lib.optional stdenv.is64bit "--enable-64bit";
+
+  postInstall = ''
+    find $out -name "*.a" -delete
+    moveToOutput share "$dev" # just aclocal
+  '';
+
+  buildInputs = [] ++ lib.optionals stdenv.isDarwin [ CoreServices ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "http://www.mozilla.org/projects/nspr/";
+    description = "Netscape Portable Runtime, a platform-neutral API for system-level and libc-like functions";
+    platforms = platforms.all;
+    license = licenses.mpl20;
+  };
+}
diff --git a/pkgs/development/libraries/nss/latest.nix b/pkgs/development/libraries/nss/latest.nix
index ced72d33e17..a175e76c27d 100644
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@@ -18,7 +18,7 @@ let
   #       It will rebuild itself using the version of this package (NSS) and if
   #       an update is required do the required changes to the expression.
   #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
-  version = "3.67";
+  version = "3.68";
   underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
 
 in stdenv.mkDerivation rec {
@@ -27,7 +27,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/${pname}-${version}.tar.gz";
-    sha256 = "0zyfi27lbdz1bmk9dmsivcya4phx25rzlxqcnjab69yd928rlm7n";
+    sha256 = "sha256-xAKzLKyDA07Bw9gm70MGzRSgZtfZpvTDDYKzvAQ8cls=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index da7b11b0bac..959d8cb2ea1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17167,6 +17167,10 @@ in
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
 
+  nspr_latest = callPackage ../development/libraries/nspr/latest.nix {
+    inherit (darwin.apple_sdk.frameworks) CoreServices;
+  };
+
   nss = lowPrio (callPackage ../development/libraries/nss { });
   nssTools = nss.tools;