diff --git a/nixos/modules/config/nix-channel.nix b/nixos/modules/config/nix-channel.nix
index 5eb6e6883968..fead36e3f43d 100644
--- a/nixos/modules/config/nix-channel.nix
+++ b/nixos/modules/config/nix-channel.nix
@@ -3,8 +3,8 @@
   configuration to work.
 
   See also
-   - ./nix.nix
-   - ./nix-flakes.nix
+  - ./nix.nix
+  - ./nix-flakes.nix
  */
 { config, lib, ... }:
 let
@@ -28,9 +28,9 @@ in
             Whether the `nix-channel` command and state files are made available on the machine.
 
             The following files are initialized when enabled:
-             - `/nix/var/nix/profiles/per-user/root/channels`
-             - `/root/.nix-channels`
-             - `$HOME/.nix-defexpr/channels` (on login)
+              - `/nix/var/nix/profiles/per-user/root/channels`
+              - `/root/.nix-channels`
+              - `$HOME/.nix-defexpr/channels` (on login)
 
             Disabling this option will not remove the state files from the system.
           '';
@@ -48,7 +48,7 @@ in
             "nixos-config=/etc/nixos/configuration.nix"
             "/nix/var/nix/profiles/per-user/root/channels"
           ]
-          else [];
+          else [ ];
         defaultText = ''
           if nix.channel.enable
           then [
@@ -86,7 +86,7 @@ in
       '';
 
     environment.extraSetup = mkIf (!cfg.channel.enable) ''
-      rm $out/bin/nix-channel
+      rm --force $out/bin/nix-channel
     '';
 
     # NIX_PATH has a non-empty default according to Nix docs, so we don't unset
diff --git a/pkgs/applications/window-managers/weston/default.nix b/pkgs/applications/window-managers/weston/default.nix
index 13dd27e93865..e1b604f4a895 100644
--- a/pkgs/applications/window-managers/weston/default.nix
+++ b/pkgs/applications/window-managers/weston/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "weston";
-  version = "11.0.2";
+  version = "11.0.3";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/weston/-/releases/${version}/downloads/weston-${version}.tar.xz";
-    hash = "sha256-ckB1LO8LfeYiuvi9U0jmP8axnwLvgklhsq3Rd9llKVI=";
+    hash = "sha256-1VNLxwPy96aVuRSPvaqevFm1VAXVsD0ya4063frK5wc=";
   };
 
   depsBuildBuild = [ pkg-config ];
diff --git a/pkgs/development/compilers/go/1.19.nix b/pkgs/development/compilers/go/1.19.nix
index 3e25ed128619..0ce8fcc659a8 100644
--- a/pkgs/development/compilers/go/1.19.nix
+++ b/pkgs/development/compilers/go/1.19.nix
@@ -47,11 +47,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.19.10";
+  version = "1.19.12";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${version}.src.tar.gz";
-    hash = "sha256-E3VbzOUpdH1fKTDe4DRzDIbQK9PlIas+K77eVI07lT8=";
+    hash = "sha256-7l1Q4Kf9dLobE3y4eWCaqu+YgL9ytdF0IQDjiucrtVc=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/wolfssl/5.5.4-CVE-2023-3724.patch b/pkgs/development/libraries/wolfssl/5.5.4-CVE-2023-3724.patch
new file mode 100644
index 000000000000..dc057a5b5deb
--- /dev/null
+++ b/pkgs/development/libraries/wolfssl/5.5.4-CVE-2023-3724.patch
@@ -0,0 +1,40 @@
+based on upstream 00f1eddee429ff51390b20caadd2eb6afe51e1aa with
+minor adjustments to apply to 5.5.4
+
+diff --git a/src/tls.c b/src/tls.c
+index 27c1002b2..f8a9aaa48 100644
+--- a/src/tls.c
++++ b/src/tls.c
+@@ -8346,6 +8346,9 @@ static int TLSX_KeyShare_Parse(WOLFSSL* ssl, const byte* input, word16 length,
+         if (!WOLFSSL_NAMED_GROUP_IS_PQC(group))
+ #endif
+             ret = TLSX_KeyShare_Use(ssl, group, 0, NULL, NULL);
++
++        if (ret == 0)
++            ssl->session->namedGroup = ssl->namedGroup = group;
+     }
+     else {
+         /* Not a message type that is allowed to have this extension. */
+diff --git a/src/tls13.c b/src/tls13.c
+index 42eb7ffce..194870a69 100644
+--- a/src/tls13.c
++++ b/src/tls13.c
+@@ -4725,8 +4725,18 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
+         }
+ #endif
+ 
++        /* sanity check on PSK / KSE */
++        if (
++    #if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
++            ssl->options.pskNegotiated == 0 &&
++    #endif
++            ssl->session->namedGroup == 0) {
++            return EXT_MISSING;
++        }
++
+         ssl->keys.encryptionOn = 1;
+         ssl->options.serverState = SERVER_HELLO_COMPLETE;
++
+     }
+     else {
+         ssl->options.tls1_3 = 1;
diff --git a/pkgs/development/libraries/wolfssl/default.nix b/pkgs/development/libraries/wolfssl/default.nix
index b77ec4d3c4a8..314a5a01a50b 100644
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@@ -17,6 +17,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-sR/Gjk50kLej5oJzDH1I6/V+7OIRiwtyeg5tEE3fmHk=";
   };
 
+  patches = [
+    ./5.5.4-CVE-2023-3724.patch
+  ];
+
   postPatch = ''
     patchShebangs ./scripts
     # ocsp tests require network access
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 5d759c36acfe..b285ab30f342 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.320";
+  version = "4.14.321";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "09bn18jvazkc55bqdjbxy8fbca7vjhi9xl2h02w0sq3f1jf6g0pd";
+    sha256 = "058p6ba24gx0q1fxyf5gnbnl49r82iaz97z01h7c4z2lgba2pqyh";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index e71cdee98da8..938a790abaeb 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.289";
+  version = "4.19.290";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1cx33aa9v2071gixvp68pqpp4vxcx61dqg04rf6xns1qg48p93qi";
+    sha256 = "1kqflbf78aamnbdc2v973qk9ymignl1cy6q0rpw865brgm5y59cz";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index a6baeaac8901..3ef8b3238ac0 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.188";
+  version = "5.10.189";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "04k1mc23vqv3mr4m80rab1w7z1cwc0n1kcxzc5vfcfp26nmqnmf9";
+    sha256 = "1jcqj0yh8k81a02y8wq1psy109w9s0r5j5zgm8gmf5ylw5m520sc";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index f57635d8a2a0..ec49d21fab7f 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.124";
+  version = "5.15.125";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1v927z1grqwcwj6769qm14828fzjzi58lsd86al2l0ddc016l0q0";
+    sha256 = "1izyv1ibiy4dapwb8745dshfbb9b6xqyz77l6mhkmlkcnx33h3qm";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 5f3afdab8c2e..eda901585455 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.251";
+  version = "5.4.252";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1jhqnazgiyz1vvrhnq5byl3h1mxrr3555fpiz4byycc1sqz9bd5w";
+    sha256 = "0rw2b1rr3rb5498rv1zmj0ml3p67awrvd2ch66kp80wl4dsmhy1s";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index a99218168a63..92692d57af03 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.43";
+  version = "6.1.44";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "02588pl1z8jxgxpa03rsdyg5pr0r3v0aylzp8r5ykm32193lhli4";
+    sha256 = "19d1fdvdp8lc5mvlcawd8hcpzjh7pdr5gq6fczhjl20xw4gx8l9f";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.4.nix b/pkgs/os-specific/linux/kernel/linux-6.4.nix
index f7b043939d20..47e927fb39b1 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4.8";
+  version = "6.4.9";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1djqqhw542jphqsicpbn1259sgw9pwd08wwkdch31nw4kvhk97y5";
+    sha256 = "17ycanx738bgxg5wn536kbad4zzvj5ngygp9qhvz76draaca5f5q";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index cd11bcb9e210..b58d471680b5 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20230512";
+  version = "20230808";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    hash = "sha256-Ay907cXbT+LlE4foK4TODcDB5Rx/Zo7HY17erem71rw=";
+    hash = "sha256-xyb4FUV7vG2YSuN4H6eBaf8c4At70NZiUuepbgg2HNg=";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/pkgs/servers/monitoring/unpoller/default.nix b/pkgs/servers/monitoring/unpoller/default.nix
index 65d8b960781b..973ed9535cd8 100644
--- a/pkgs/servers/monitoring/unpoller/default.nix
+++ b/pkgs/servers/monitoring/unpoller/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "unpoller";
-  version = "2.7.14";
+  version = "2.7.20";
 
   src = fetchFromGitHub {
     owner = "unpoller";
     repo = "unpoller";
     rev = "v${version}";
-    hash = "sha256-rIAqR13TKHv4i7n8s7QehFlU4C3z/Cgw8lQaKFZcCt0=";
+    hash = "sha256-6uH437q3a77c+7tH7VdYmdON+M7z4gqY/Wvj1XyT9c8=";
   };
 
-  vendorHash = "sha256-fPUwMQQK8D0FA/X4E0yFEIP2ZO0iwyVapYctGCKyMjk=";
+  vendorHash = "sha256-XclpyB1IBKD/ALn0nbmTugiVlf5GCca+NF2/7uVTHKs=";
 
   ldflags = [
     "-w" "-s"
diff --git a/pkgs/tools/compression/bzip3/default.nix b/pkgs/tools/compression/bzip3/default.nix
index 07f738ba6d90..6e21a352d06f 100644
--- a/pkgs/tools/compression/bzip3/default.nix
+++ b/pkgs/tools/compression/bzip3/default.nix
@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bzip3";
-  version = "1.3.1";
+  version = "1.3.2";
 
   outputs = [ "bin" "dev" "out" ];
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "kspalaiologos";
     repo = "bzip3";
     rev = finalAttrs.version;
-    hash = "sha256-9yUd6FnobJEH/L5X4WMJFb9yLkJH9b8MAyhU2Wdtfig=";
+    hash = "sha256-nSmKpOwlbxbUN2TJwsS2CFP5UV2ODOKXFHAUsCje7mc=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 5b147799089e..6c77ec5bcd5e 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -168,8 +168,8 @@ in lib.makeExtensible (self: {
   };
 
   nix_2_13 = common {
-    version = "2.13.3";
-    hash = "sha256-jUc2ccTR8f6MGY2pUKgujm+lxSPNGm/ZAP+toX+nMNc=";
+    version = "2.13.5";
+    hash = "sha256-yHZMgMs/6/aQUwfMwmPUQov17JMGS7squLJsjmucnLc=";
   };
 
   nix_2_14 = common {