diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index ca2e8734c72e..bc264ef07d04 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -43,13 +43,13 @@ rec {
 
   thunderbird-115 = (buildMozillaMach rec {
     pname = "thunderbird";
-    version = "115.4.2";
+    version = "115.5.1";
     application = "comm/mail";
     applicationName = "Mozilla Thunderbird";
     binaryName = pname;
     src = fetchurl {
       url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-      sha512 = "44cedd5931edbac2ab0babfaf0e71a0262317c01fd7d71e8740bb8f54766c9b49b9e325f1d2796c3a233d4298457d8769b675213a21bef759c46086080bcc8bc";
+      sha512 = "5ddc39b3591427d283c5497f68a1d722409aba54d53342a36a259daa219d8135ecf88868b12235eb9536f46f825722cf6da2781b71a2e10b816281231394b4f9";
     };
     extraPatches = [
       # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 5426e169b092..cfe18b1450df 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -122,12 +122,6 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./sw_vers.patch
-  ] ++ lib.optionals (python.pkgs.pythonAtLeast "3.11") [
-    # Fix build against Python 3.11
-    (fetchpatch {
-      url = "https://github.com/root-project/root/commit/484deb056dacf768aba4954073b41105c431bffc.patch";
-      hash = "sha256-4qur2e3SxMIPgOg4IjlvuULR2BObuP7xdvs+LmNT2/s=";
-    })
   ];
 
   # Fix build against vanilla LLVM 9
diff --git a/pkgs/development/libraries/mbedtls/2.nix b/pkgs/development/libraries/mbedtls/2.nix
index 2dd5ae6dae58..18793114c219 100644
--- a/pkgs/development/libraries/mbedtls/2.nix
+++ b/pkgs/development/libraries/mbedtls/2.nix
@@ -1,6 +1,6 @@
 { callPackage }:
 
 callPackage ./generic.nix {
-  version = "2.28.3";
-  hash = "sha256-w5bJErCNRZLE8rHcuZlK3bOqel97gPPMKH2cPGUR6Zw=";
+  version = "2.28.5";
+  hash = "sha256-Gl4UQMSvAwYbOi2b/AUMz+zgkOl1o0UA2VveF/3ek8o=";
 }
diff --git a/pkgs/development/libraries/mbedtls/3.4.0-CVE-2023-45199.patch b/pkgs/development/libraries/mbedtls/3.4.0-CVE-2023-45199.patch
new file mode 100644
index 000000000000..e114eb25ac36
--- /dev/null
+++ b/pkgs/development/libraries/mbedtls/3.4.0-CVE-2023-45199.patch
@@ -0,0 +1,78 @@
+Based on upstream 130938a80403647dc22a3e15ca442a500248647b, alterations
+mostly due to ecdh_psa_peerkey being renamed xxdh_psa_peerkey upstream
+
+--- a/library/ssl_tls12_client.c
++++ b/library/ssl_tls12_client.c
+@@ -1714,7 +1714,7 @@ static int ssl_parse_server_ecdh_params(mbedtls_ssl_context *ssl,
+                                         unsigned char *end)
+ {
+     uint16_t tls_id;
+-    uint8_t ecpoint_len;
++    size_t ecpoint_len;
+     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
+     psa_ecc_family_t ec_psa_family = 0;
+     size_t ec_bits = 0;
+@@ -2039,7 +2039,7 @@ static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl)
+     ret = mbedtls_ecp_point_write_binary(&peer_key->grp, &peer_key->Q,
+                                          MBEDTLS_ECP_PF_UNCOMPRESSED, &olen,
+                                          ssl->handshake->ecdh_psa_peerkey,
+-                                         MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH);
++                                         sizeof(ssl->handshake->ecdh_psa_peerkey));
+ 
+     if (ret != 0) {
+         MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ecp_point_write_binary"), ret);
+--- a/library/ssl_tls12_server.c
++++ b/library/ssl_tls12_server.c
+@@ -3667,22 +3667,32 @@ static int ssl_parse_client_key_exchange(mbedtls_ssl_context *ssl)
+         psa_status_t status = PSA_ERROR_GENERIC_ERROR;
+         mbedtls_ssl_handshake_params *handshake = ssl->handshake;
+ 
+-        MBEDTLS_SSL_DEBUG_MSG(1, ("Read the peer's public key."));
++        MBEDTLS_SSL_DEBUG_MSG(3, ("Read the peer's public key."));
+ 
+         /*
+          * We must have at least two bytes (1 for length, at least 1 for data)
+          */
+         if (buf_len < 2) {
+-            MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid buffer length"));
+-            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
++            MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid buffer length: %" MBEDTLS_PRINTF_SIZET,
++                                      buf_len));
++            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
+         }
+ 
+         if (data_len < 1 || data_len > buf_len) {
+-            MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid data length"));
+-            return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
++            MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid data length: %" MBEDTLS_PRINTF_SIZET
++                                      " > %" MBEDTLS_PRINTF_SIZET,
++                                      data_len, buf_len));
++            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
+         }
+ 
+         /* Store peer's ECDH public key. */
++        if (data_len > sizeof(handshake->ecdh_psa_peerkey)) {
++            MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid public key length: %" MBEDTLS_PRINTF_SIZET
++                                      " > %" MBEDTLS_PRINTF_SIZET,
++                                      data_len,
++                                      sizeof(handshake->ecdh_psa_peerkey)));
++            return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
++        }
+         memcpy(handshake->ecdh_psa_peerkey, p, data_len);
+         handshake->ecdh_psa_peerkey_len = data_len;
+ 
+--- a/library/ssl_tls13_generic.c
++++ b/library/ssl_tls13_generic.c
+@@ -1447,6 +1447,12 @@ int mbedtls_ssl_tls13_read_public_ecdhe_share(mbedtls_ssl_context *ssl,
+     MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, peerkey_len);
+ 
+     /* Store peer's ECDH public key. */
++    if (peerkey_len > sizeof(handshake->ecdh_psa_peerkey)) {
++        MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid public key length: %u > %" MBEDTLS_PRINTF_SIZET,
++                                  (unsigned) peerkey_len,
++                                  sizeof(handshake->ecdh_psa_peerkey)));
++        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
++    }
+     memcpy(handshake->ecdh_psa_peerkey, p, peerkey_len);
+     handshake->ecdh_psa_peerkey_len = peerkey_len;
+ 
diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix
index 67269717bb99..b3a07c8d4309 100644
--- a/pkgs/development/libraries/mbedtls/3.nix
+++ b/pkgs/development/libraries/mbedtls/3.nix
@@ -1,6 +1,14 @@
-{ callPackage }:
+{ callPackage, fetchpatch }:
 
 callPackage ./generic.nix {
   version = "3.4.0";
   hash = "sha256-1YA4hp/VEjph5k0qJqhhH4nBbTP3Qu2pl7WpuvPkVfg=";
+  patches = [
+    ./3.4.0-CVE-2023-45199.patch
+    (fetchpatch {
+      name = "CVE-2023-43615.patch";
+      url = "https://github.com/Mbed-TLS/mbedtls/commit/faf0b8604ac49456b0cff7a34ad27485ca145cce.patch";
+      hash = "sha256-GFx+7TmhthRbwBnTgTdNhokftsGwIY7cQGhxKf3WZcE=";
+    })
+  ];
 }
diff --git a/pkgs/development/libraries/mbedtls/generic.nix b/pkgs/development/libraries/mbedtls/generic.nix
index adc46adb75fb..3186f1982b40 100644
--- a/pkgs/development/libraries/mbedtls/generic.nix
+++ b/pkgs/development/libraries/mbedtls/generic.nix
@@ -3,6 +3,7 @@
 , version
 , hash
 , fetchFromGitHub
+, patches ? []
 
 , cmake
 , ninja
@@ -14,7 +15,7 @@
 
 stdenv.mkDerivation rec {
   pname = "mbedtls";
-  inherit version;
+  inherit version patches;
 
   src = fetchFromGitHub {
     owner = "Mbed-TLS";
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 8c30f8b6c423..c7c73f79db6f 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.7-rc4",
-        "hash": "sha256:1igynlm5pv62brfkyjh6w8lzvmmy8c3g8phrn5wgdyy8svc48r8h"
+        "version": "6.7-rc5",
+        "hash": "sha256:125zdj2sxcwkfvm2ckjk3mbwfll8950bn7kr38s5pvlx2a10zv04"
     },
     "6.5": {
         "version": "6.5.13",
@@ -12,8 +12,8 @@
         "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
     },
     "6.1": {
-        "version": "6.1.66",
-        "hash": "sha256:030sxwzqlf9jg57j1hvd46ffkc9yfplbk3b81faycfa2dk6n57j1"
+        "version": "6.1.67",
+        "hash": "sha256:11cjqll3b7iq3mblwyzjrd5ph8avgk23f4mw4shm8j6ai5rdndvm"
     },
     "5.15": {
         "version": "5.15.142",
@@ -36,7 +36,7 @@
         "hash": "sha256:1f4q0acbp917myjmgiy4haxp78yak5h1rj5g937r6mkykwb6nb14"
     },
     "6.6": {
-        "version": "6.6.5",
-        "hash": "sha256:17miac3h4kvj4yyf042qsmpsivpq243db5v0ay6233d6aic7k4kw"
+        "version": "6.6.6",
+        "hash": "sha256:1j14n8b012pv3r7i9p762jyabzn2nv1ranxyw5lk3c9lg68hmxzb"
     }
 }
diff --git a/pkgs/servers/http/couchdb/3.nix b/pkgs/servers/http/couchdb/3.nix
index 3ce5272c1d93..b6d1ce59b8ba 100644
--- a/pkgs/servers/http/couchdb/3.nix
+++ b/pkgs/servers/http/couchdb/3.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "couchdb";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchurl {
     url = "mirror://apache/couchdb/source/${version}/apache-${pname}-${version}.tar.gz";
-    hash = "sha256-PWgj1C0Qzw1PhsnE/lnJkyyJ1oV4/LbEtCeNx2kwjao=";
+    hash = "sha256-eiAHtfZz1L4iolyaER2QZpGdhy3bkTWn3OwBIimb054=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/misc/yt-dlp/default.nix b/pkgs/tools/misc/yt-dlp/default.nix
index 8fe478716ede..5f1005506a6e 100644
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -9,6 +9,7 @@
 , pycryptodomex
 , websockets
 , mutagen
+, requests
 , secretstorage
 , atomicparsleySupport ? true
 , ffmpegSupport ? true
@@ -22,11 +23,11 @@ buildPythonPackage rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2023.10.13";
+  version = "2023.11.14";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4CbqHENf827vEhW8TFu4xHmTi5AFSZe6mfY6RUH+Y7Q=";
+    hash = "sha256-s8JTU7oQaSLYcKWlnk1qLrhXg+vRfinsQ1vD4XZN6L4=";
   };
 
   propagatedBuildInputs = [
@@ -34,6 +35,7 @@ buildPythonPackage rec {
     certifi
     mutagen
     pycryptodomex
+    requests
     secretstorage  # "optional", as in not in requirements.txt, needed for `--cookies-from-browser`
     websockets
   ];
@@ -62,6 +64,11 @@ buildPythonPackage rec {
     ln -s "$out/bin/yt-dlp" "$out/bin/youtube-dl"
   '';
 
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "requests>=2.31.0" "requests>=2.29.0"
+  '';
+
   passthru.updateScript = [ update-python-libraries (toString ./.) ];
 
   meta = with lib; {