Running nixpkgs-update (https://nix-community.org/update-bot/) with UPDATE_INFO: cacert 0 -> 1
attrpath: cacert
Checking auto update branch...
[version] 
[version] skipping because derivation has updateScript
[rustCrateVersion] 
[rustCrateVersion] No cargoHash found
[golangModuleVersion] 
[golangModuleVersion] Not a buildGoModule package with vendorHash
[npmDepsVersion] 
[npmDepsVersion] No npmDepsHash
[updateScript] 
[updateScript] Success
[updateScript] this derivation will be built:
  /nix/store/8s9hywc8qmdfy6l8hzf6cp3j806z2517-packages.json.drv
building '/nix/store/8s9hywc8qmdfy6l8hzf6cp3j806z2517-packages.json.drv'...

Going to be running update for following packages:
 - nss-cacert-3.121

Press Enter key to continue...
Running update for:
Enqueuing group of 1 packages
 - nss-cacert-3.121: UPDATING ...
 - nss-cacert-3.121: DONE.

Packages updated!

Diff after rewrites:
diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
index ea2f21939844..8dd727f6ded3 100644
--- a/pkgs/by-name/ca/cacert/package.nix
+++ b/pkgs/by-name/ca/cacert/package.nix
@@ -20,7 +20,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  version = "3.121";
+  version = "3.123";
   meta = {
     homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
     description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
         "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
         "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
       ];
-    hash = "sha256-O5jU4/9XoybZWHwzYzA5yMOpzwtV98pYHXWY/zKesfM=";
+    hash = "sha256-dxMO+RITdyhEVh+9OqMdQTslwqx/V2/qO8O7/375NIk=";
   };
 
   unpackPhase = ''

No auto update branch exists
There might already be an open PR for this update:
- cacert: 3.121 -> 3.123
  URL "https://api.github.com/repos/NixOS/nixpkgs/issues/510733"