diff --git a/lang/python/pillow/Makefile b/lang/python/pillow/Makefile
index c974723a9..c6b1faf0e 100644
--- a/lang/python/pillow/Makefile
+++ b/lang/python/pillow/Makefile
@@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=pillow
-PKG_VERSION:=10.0.0
+PKG_VERSION:=10.1.0
 PKG_RELEASE:=1
 
 PYPI_NAME:=Pillow
-PKG_HASH:=9c82b5b3e043c7af0d95792d0d20ccf68f61a1fec6b3530e718b688422727396
+PKG_HASH:=e6bf8de6c36ed96c86ea3b6e1d5273c53f46ef518a062464cd7ef5dd2cf92e38
 
 PKG_BUILD_DEPENDS:=python-setuptools-scm/host
 
diff --git a/lang/python/pillow/patches/001-remove-setuptools-version-limit.patch b/lang/python/pillow/patches/001-remove-setuptools-version-limit.patch
index 3dc07d992..e5ac168cb 100644
--- a/lang/python/pillow/patches/001-remove-setuptools-version-limit.patch
+++ b/lang/python/pillow/patches/001-remove-setuptools-version-limit.patch
@@ -6,6 +6,6 @@
  requires = [
 -  "setuptools>=67.8",
 +  "setuptools",
-   "wheel",
  ]
  backend-path = [
+   "_custom_build",
diff --git a/lang/python/pillow/test.sh b/lang/python/pillow/test.sh
new file mode 100644
index 000000000..9bad29241
--- /dev/null
+++ b/lang/python/pillow/test.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+[ "$1" = "python3-pillow" ] || exit 0
+
+python3 - << EOF
+import sys
+from PIL import Image, ImageDraw
+
+if (Image.__version__ != "$2"):
+    print("Wrong version: " + Image.__version__)
+    sys.exit(1)
+
+from PIL import Image, ImageDraw
+img = Image.new('RGB', (100, 30), color = (73, 109, 137))
+d = ImageDraw.Draw(img)
+d.text((10,10), "Hello World", fill=(255,255,0))
+
+# Getting here means we did not get exceptions
+sys.exit(0)
+EOF
diff --git a/net/conntrack-tools/Makefile b/net/conntrack-tools/Makefile
index 9c063d84c..4a415e8c0 100644
--- a/net/conntrack-tools/Makefile
+++ b/net/conntrack-tools/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=conntrack-tools
-PKG_VERSION:=1.4.7
+PKG_VERSION:=1.4.8
 PKG_RELEASE:=1
 
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://www.netfilter.org/projects/conntrack-tools/files
-PKG_HASH:=099debcf57e81690ced57f516b493588a73518f48c14d656f823b29b4fc24b5d
+PKG_HASH:=067677f4c5f6564819e78ed3a9d4a8980935ea9273f3abb22a420ea30ab5ded6
 
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=GPL-2.0-or-later
diff --git a/net/net-snmp/Makefile b/net/net-snmp/Makefile
index 46aa5e273..1a1194955 100644
--- a/net/net-snmp/Makefile
+++ b/net/net-snmp/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=net-snmp
 PKG_VERSION:=5.9.1
-PKG_RELEASE:=6
+PKG_RELEASE:=7
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@SF/net-snmp
diff --git a/net/net-snmp/patches/203-if-mib-data_access-interface.c-plug-a-leak-with-pcre.patch b/net/net-snmp/patches/203-if-mib-data_access-interface.c-plug-a-leak-with-pcre.patch
new file mode 100644
index 000000000..e2da12f17
--- /dev/null
+++ b/net/net-snmp/patches/203-if-mib-data_access-interface.c-plug-a-leak-with-pcre.patch
@@ -0,0 +1,30 @@
+From e5aadf1e78c624a8e4147d4b70a7795497a50e73 Mon Sep 17 00:00:00 2001
+From: Niels Baggesen <nba@users.sourceforge.net>
+Date: Mon, 22 May 2023 18:44:36 +0200
+Subject: [PATCH] if-mib/data_access/interface.c: plug a leak with pcre2
+
+---
+ agent/mibgroup/if-mib/data_access/interface.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/agent/mibgroup/if-mib/data_access/interface.c
++++ b/agent/mibgroup/if-mib/data_access/interface.c
+@@ -845,7 +845,7 @@ int netsnmp_access_interface_include(con
+ {
+     netsnmp_include_if_list *if_ptr;
+ #if defined(HAVE_PCRE2_H)
+-    pcre2_match_data *ndx_match = pcre2_match_data_create(3, NULL);
++    pcre2_match_data *ndx_match;
+ #elif defined(HAVE_PCRE_H)
+     int                      found_ndx[3];
+ #endif
+@@ -860,6 +860,9 @@ int netsnmp_access_interface_include(con
+          */
+         return TRUE;
+ 
++#if defined(HAVE_PCRE2_H)
++    ndx_match = pcre2_match_data_create(3, NULL);
++#endif
+ 
+     for (if_ptr = include_list; if_ptr; if_ptr = if_ptr->next) {
+ #if defined(HAVE_PCRE2_H)
diff --git a/net/pdns/Makefile b/net/pdns/Makefile
index 39ac66747..eedc3c6d1 100644
--- a/net/pdns/Makefile
+++ b/net/pdns/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=pdns
-PKG_VERSION:=4.8.2
+PKG_VERSION:=4.8.3
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://downloads.powerdns.com/releases/
-PKG_HASH:=3b173fda4c51bb07b5a51d8c599eedd7962a02056b410e3c9d9d69ed97be35b9
+PKG_HASH:=77b91199bdf71874334501c67e26469c2667a373d8423803fe657417295c77ba
 
 PKG_MAINTAINER:=Peter van Dijk <peter.van.dijk@powerdns.com>
 PKG_LICENCE:=GPL-2.0-only
diff --git a/net/pdns/files/pdns.conf-dist b/net/pdns/files/pdns.conf-dist
index 9242373a2..2e417c4cb 100644
--- a/net/pdns/files/pdns.conf-dist
+++ b/net/pdns/files/pdns.conf-dist
@@ -140,6 +140,11 @@
 #
 # default-api-rectify=yes
 
+#################################
+# default-catalog-zone	Catalog zone to assign newly created primary zones (via the API) to
+#
+# default-catalog-zone=
+
 #################################
 # default-ksk-algorithm	Default KSK algorithm
 #
@@ -530,6 +535,11 @@
 #
 # secondary=no
 
+#################################
+# secondary-check-signature-freshness	Check signatures in SOA freshness check. Sets DO flag on SOA queries. Outside some very problematic scenarios, say yes here.
+#
+# secondary-check-signature-freshness=yes
+
 #################################
 # secondary-do-renotify	If this secondary should send out notifications after receiving zone transfers from a primary
 #
@@ -581,7 +591,7 @@
 # slave-renotify=no
 
 #################################
-# socket-dir	Where the controlsocket will live, /var/run/pdns when unset and not chrooted. Set to the RUNTIME_DIRECTORY environment variable when that variable has a value (e.g. under systemd).
+# socket-dir	Where the controlsocket will live, /var/run/pdns when unset and not chrooted
 #
 # socket-dir=
 
@@ -695,6 +705,11 @@
 #
 # webserver-print-arguments=no
 
+#################################
+# workaround-11804	Workaround for issue 11804: send single RR per AXFR chunk
+#
+# workaround-11804=no
+
 #################################
 # write-pid	Write a PID file
 #
diff --git a/net/rclone/Makefile b/net/rclone/Makefile
index 01d253a9a..5ae35a4e5 100644
--- a/net/rclone/Makefile
+++ b/net/rclone/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=rclone
-PKG_VERSION:=1.64.0
+PKG_VERSION:=1.64.1
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/rclone/rclone/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=3297838fdcf611a5ad605835f41c0e51031ce9f220c77a4ad0af6283b7805329
+PKG_HASH:=c94ad2c2fa79485667aae4a239ed04e786bd6e26bced05f9d95dda6d10f7a014
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE
diff --git a/utils/docker-compose/Makefile b/utils/docker-compose/Makefile
index 1d3e7424f..2f134c300 100644
--- a/utils/docker-compose/Makefile
+++ b/utils/docker-compose/Makefile
@@ -1,14 +1,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=compose
-PKG_VERSION:=2.22.0
+PKG_VERSION:=2.23.0
 PKG_RELEASE:=1
 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
 
 PKG_SOURCE:=v$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/docker/compose/tar.gz/v${PKG_VERSION}?
-PKG_HASH:=82bd4622729cff061b3489bad96b54849a7f4b462345aade1bd374c879db9019
+PKG_HASH:=805ff38df265d05c7b0c9d5df1b77e9391f7995ac5ec66bde0325b03563e7b23
 
 PKG_MAINTAINER:=Javier Marcet <javier@marcet.info>
 
diff --git a/utils/nerdctl/Makefile b/utils/nerdctl/Makefile
new file mode 100644
index 000000000..7ae268bad
--- /dev/null
+++ b/utils/nerdctl/Makefile
@@ -0,0 +1,38 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=nerdctl
+PKG_VERSION:=1.6.0
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/containerd/nerdctl/tar.gz/v$(PKG_VERSION)?
+PKG_HASH:=a369b1c517d9c3d53d00b29633a6176a05811214a44dd25d339c32cc6a901579
+
+PKG_LICENSE:=Apache-2.0
+PKG_LICENSE_FILES:=LICENSE
+PKG_MAINTAINER:=Luca Barbato <lu_zero@gentoo.org>
+
+PKG_BUILD_DEPENDS:=golang/host
+PKG_BUILD_PARALLEL:=1
+PKG_BUILD_FLAGS:=no-mips16
+
+GO_PKG:=github.com/containerd/nerdctl
+
+include $(INCLUDE_DIR)/package.mk
+include ../../lang/golang/golang-package.mk
+
+define Package/nerdctl
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=contaiNERD CTL - Docker-compatible CLI for containerd
+  URL:=https://containerd.io
+  DEPENDS:=$(GO_ARCH_DEPENDS)
+endef
+
+define Package/nerdctl/description
+  Docker-compatible CLI for containerd, with support for Compose, Rootless,
+  eStargz, OCIcrypt, IPFS, ...
+endef
+
+$(eval $(call GoBinPackage,nerdctl))
+$(eval $(call BuildPackage,nerdctl))
diff --git a/utils/quectel-timesync/Makefile b/utils/quectel-timesync/Makefile
new file mode 100644
index 000000000..f624683c2
--- /dev/null
+++ b/utils/quectel-timesync/Makefile
@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=quectel-timesync
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL=https://github.com/freifunk-darmstadt/quectel-timesync.git
+PKG_SOURCE_DATE:=2023-10-08
+PKG_SOURCE_VERSION:=4333888cb8025b92511597a95859943fae0a0bc8
+PKG_MIRROR_HASH:=696b878891f884318847069b0590cbdbab2ff48461864ecb418e4575935a29e3
+
+PKG_MAINTAINER:=David Bauer <mail@david-bauer.net>
+PKG_LICENSE:=GPL-2.0-only
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/quectel-timesync
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=Tool for configuring system clock using Quectel cellular modems
+  DEPENDS:=+kmod-usb-serial-option
+endef
+
+define Package/quectel-timesync/description
+This tool allows for acquiring the current time from
+the cellular network for configuring the local clock.
+Compared to NTP, this has the advantage of nut using up
+mobile traffic.
+
+It takes advantage of the AT+QLTS command found on Quectel
+modems. This functionality depends on support of the mobile
+network.
+endef
+
+define Package/quectel-timesync/conffiles
+/etc/config/quectel-timesync
+endef
+
+define Package/quectel-timesync/install
+	$(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/init.d $(1)/etc/config
+
+	$(CP) $(PKG_BUILD_DIR)/openwrt/quectel-timesync/files/quectel-timesync.config $(1)/etc/config/quectel-timesync
+
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/openwrt/quectel-timesync/files/quectel-timesync.init $(1)/etc/init.d/quectel-timesync	
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/quectel-timesync $(1)/usr/sbin/quectel-timesync
+endef
+
+$(eval $(call BuildPackage,quectel-timesync))