diff --git a/modulesets/bootstrap.modules b/modulesets/bootstrap.modules
index 59f5796..8a2c56e 100644
--- a/modulesets/bootstrap.modules
+++ b/modulesets/bootstrap.modules
@@ -10,8 +10,8 @@
   <repository name="ftp.gnu.org"
               href="https://ftp.gnu.org/gnu/"
               type="tarball" />
-  <repository name="pkgconfig"
-              href="http://pkgconfig.freedesktop.org/releases/"
+  <repository name="pkgconf"
+              href="https://distfiles.ariadne.space/pkgconf/"
               type="tarball" />
   <repository name="sourceforge"
               href="http://downloads.sourceforge.net/sourceforge/"
@@ -32,6 +32,7 @@
               href="https://github.com"
               type="tarball" />
   <!---->
+<!-- NOTE: DO NOT UPGRADE TO 5.6.x! See https://nvd.nist.gov/vuln/detail/CVE-2024-3094 -->
   <autotools id="xz"
              autogen-sh="configure"
              bootstrap="true">
@@ -53,14 +54,26 @@
             repo="ftp.gnu.org" />
   </autotools>
   <!---->
+  <autotools id="libiconv"
+             autogen-sh="configure"
+             autogenargs="--disable-debug --disable-dependency-tracking --enable-extra-encodings">
+
+    <branch module="libiconv/libiconv-1.17.tar.gz"
+            version="1.17"
+            repo="ftp.gnu.org" />
+  </autotools>
+
   <autotools id="gettext"
              autogen-sh="configure"
              autogenargs="--without-emacs --disable-java --disable-native-java --disable-libasprintf --disable-csharp --with-included-glib --with-included-libcroco">
 
-    <branch module="gettext/gettext-0.22.tar.xz"
-            version="0.22"
-            hash="sha256:0e60393a47061567b46875b249b7d2788b092d6457d656145bb0e7e6a3e26d93"
+    <branch module="gettext/gettext-0.22.3.tar.xz"
+            version="0.22.3"
+            hash="sha256:b838228b3f8823a6c1eddf07297197c4db13f7e1b173b9ef93f3f945a63080b6"
             repo="ftp.gnu.org" />
+    <dependencies>
+      <dep package="libiconv" />
+    </dependencies>
   </autotools>
   <!--
     cmakes ./configure is picky about invalid flags so we manually set it
@@ -133,15 +146,15 @@
     </dependencies>
   </autotools>
   <!---->
-  <autotools id="pkg-config"
-             autogen-sh="configure"
-             autogenargs="--with-internal-glib"
-             bootstrap="true">
-    <branch module="pkg-config-0.29.2.tar.gz"
-            version="0.29.2"
-            hash="sha256:6fc69c01688c9458a57eb9a1664c9aba372ccda420a02bf4429fe610e7e7d591"
-            repo="pkgconfig" />
-  </autotools>
+  <meson id="pkgconf"
+         mesonargs="-Dwith-system-libdir=/usr/lib -Dwith-system-includedir=/usr/include" >
+    <branch module="pkgconf-2.2.0.tar.xz"
+            version="2.2.0"
+            hash="sha256:b06ff63a83536aa8c2f6422fa80ad45e4833f590266feb14eaddfe1d4c853c69"
+            repo="pkgconf" >
+      <patch file="pkgconf-link-pkg-config.patch" strip="1" />
+    </branch>
+  </meson>
   <!--
     macOS provides 2.3 (presumably the last GPL2 version, gstreamer
     requires 2.4.
@@ -193,12 +206,13 @@
   <metamodule id="meta-bootstrap">
     <dependencies>
       <dep package="xz" />
+      <dep package="libiconv"/>
       <dep package="gettext" />
       <dep package="cmake" />
       <dep package="autoconf-archive" />
       <dep package="libtool" />
       <dep package="automake" />
-      <dep package="pkg-config" />
+      <dep package="pkgconf" />
       <dep package="bison" />
       <dep package="flex" />
       <dep package="gtk-osx-docbook" />
diff --git a/modulesets/gtk-osx-network.modules b/modulesets/gtk-osx-network.modules
index d007133..0aa254b 100644
--- a/modulesets/gtk-osx-network.modules
+++ b/modulesets/gtk-osx-network.modules
@@ -97,9 +97,9 @@
   </autotools>
   <!---->
   <cmake id="zlib">
-    <branch module="zlib-1.3.tar.xz"
-            version="1.3"
-            hash="sha256:8a9ba2898e1d0d774eca6ba5b4627a11e5588ba85c8851336eb38de4683050a7"
+    <branch module="zlib-1.3.1.tar.xz"
+            version="1.3.1"
+            hash="sha256:38ef96b8dfe510d42707d9c781877914792541133e1870841463bfa73f883e32"
             repo="zlib" />
   </cmake>
   <!---->
@@ -123,9 +123,9 @@
              autogen-sh="autoreconf"
              autogenargs="--disable-doc --with-included-unistring">
              
-    <branch module="gcrypt/gnutls/v3.8/gnutls-3.8.0.tar.xz"
-            version="3.8.0"
-            hash="sha256:0ea0d11a1660a1e63f960f157b197abe6d0c8cb3255be24e1fb3815930b9bdc5"
+    <branch module="gcrypt/gnutls/v3.8/gnutls-3.8.5.tar.xz"
+            version="3.8.5"
+            hash="sha256:66269a2cfe0e1c2dabec87bdbbd8ab656f396edd9a40dd006978e003cfa52bfc"
             repo="gnupg.org">
       <patch file="gnutls-pkg-config-pc.patch"
              strip="1" />
diff --git a/modulesets/gtk-osx-python.modules b/modulesets/gtk-osx-python.modules
index 0290bf0..a51d9ea 100644
--- a/modulesets/gtk-osx-python.modules
+++ b/modulesets/gtk-osx-python.modules
@@ -54,6 +54,9 @@
       -->
       <dep package="openssl" />
     </dependencies>
+    <after>
+      <dep package="sqlite"/>
+    </after>
   </autotools>
   <!---->
   <meson id="pycairo">
diff --git a/modulesets/gtk-osx-random.modules b/modulesets/gtk-osx-random.modules
index a8f8625..871bc8a 100644
--- a/modulesets/gtk-osx-random.modules
+++ b/modulesets/gtk-osx-random.modules
@@ -32,12 +32,6 @@
   <repository name="sqlite"
               href="http://www.sqlite.org/"
               type="tarball" />
-  <repository name="fossies"
-              href="https://fossies.org/linux/misc/"
-              type="tarball" />
-  <repository name="paguire"
-              href="https://releases.pagure.org/"
-              type="tarball" />
   <repository name="itstool"
               href="http://files.itstool.org/"
               type="tarball" />
@@ -159,32 +153,6 @@
     </dependencies>
   </meson>
   <!---->
-  <autotools id="getopt"
-             autogen-sh="configure"
-             supports-non-srcdir-builds="no">
-    <branch module="getopt-1.1.6.tar.gz"
-            version="1.1.6"
-            hash="sha256:d0bf1dc642a993e7388a1cddfb9409bed375c21d5278056ccca3a0acd09dc5fe"
-            repo="fossies">
-      <patch file="getopt-autotools.patch"
-             strip="1" />
-    </branch>
-  </autotools>
-  <!---->
-  <autotools id="xmlto"
-             autogen-sh="autoreconf">
-    <branch module="xmlto/xmlto-0.0.28.tar.bz2"
-            version="0.0.28"
-            hash="sha256:1130df3a7957eb9f6f0d29e4aa1c75732a7dfb6d639be013859b5c7ec5421276"
-            repo="paguire">
-      <patch file="xmlto-allow-net-access.patch"
-             strip="1" />
-    </branch>
-    <dependencies>
-      <dep package="getopt" />
-    </dependencies>
-  </autotools>
-  <!---->
   <meson id="shared-mime-info">
     <branch module="2.2/shared-mime-info-2.2.tar.bz2"
             version="2.2"
@@ -192,7 +160,6 @@
             repo="shared-mime-info" />
     <dependencies>
       <dep package="glib" />
-      <dep package="xmlto" />
     </dependencies>
   </meson>
   <!---->
diff --git a/modulesets/gtk-osx.modules b/modulesets/gtk-osx.modules
index 1ee5859..b8b7ea0 100644
--- a/modulesets/gtk-osx.modules
+++ b/modulesets/gtk-osx.modules
@@ -157,7 +157,7 @@
   </autotools>
   <!---->
   <meson id="harfbuzz-no-cairo"
-         mesonargs="-Dcoretext=enabled -Dfreetype=enabled -Ddocs=disabled -Dbenchmark=disabled -Dintrospection=disabled">
+         mesonargs="-Dcoretext=enabled -Dfreetype=enabled -Ddocs=disabled -Dbenchmark=disabled -Dintrospection=disabled -Dtests=disabled">
 
     <branch module="harfbuzz/harfbuzz/releases/download/7.3.0/harfbuzz-7.3.0.tar.xz"
             version="7.3.0"
diff --git a/modulesets/patches/pkgconf-link-pkg-config.patch b/modulesets/patches/pkgconf-link-pkg-config.patch
new file mode 100644
index 0000000..0885842
--- /dev/null
+++ b/modulesets/patches/pkgconf-link-pkg-config.patch
@@ -0,0 +1,10 @@
+--- a/meson.build	2024-03-27 11:39:43
++++ b/meson.build	2024-05-15 20:48:07
+@@ -131,6 +131,7 @@
+   c_args: build_static,
+   install : true)
+ 
++install_symlink('pkg-config', install_dir : 'bin', pointing_to : pkgconf_exe.full_path())
+ with_tests = get_option('tests')
+ kyua_exe = find_program('kyua', required : with_tests, disabler : true)
+ atf_sh_exe = find_program('atf-sh', required : with_tests, disabler : true)
diff --git a/modulesets/upstream-ref b/modulesets/upstream-ref
index 1ea5a13..490335b 100644
--- a/modulesets/upstream-ref
+++ b/modulesets/upstream-ref
@@ -1,5 +1,17 @@
-commit a27e8ff6ac5f98b2fc2743fd64fde05775d46293
+commit 37666f16db9e8eeef533aa22627e4d49e98becff
 Author: John Ralls <jralls@ceridwen.us>
-Date:   Sun Aug 20 11:01:48 2023 -0700
+Date:   Wed May 15 21:11:58 2024 -0700
 
-    Only set neon enabled when building on ARM.
+    Replace pkg-config with pkgconf.
+    
+    pkg-config is no longer being maintained and its ancient glib has caught
+    up with it. Many distros including RHEL and MSYS2 have already made the
+    replacement.
+    
+    We need a symlink to pkg-config for compatibility with some packages that
+    attempt to call it directly instead of using autotools/cmake/meson macros.
+    
+    pkgconf is a bit absolute about not emitting -L in --libs output if it
+    considers the path a system path, and its default system path is (prefix).
+    We tell it to use /usr/lib and /usr/include as the system paths instead so
+    that it will emit -L(prefix)/lib and -I(prefix)/inxclude.
diff --git a/pins.sh b/pins.sh
index 586be86..980a9db 100644
--- a/pins.sh
+++ b/pins.sh
@@ -1,7 +1,7 @@
 # https://gitlab.gnome.org/GNOME/gtk-osx/-/commits/master
-# use latest commit (2023-08-20)
-PIN_GTK_OSX_COMMIT='a27e8ff6'
+# use latest commit (2024-05-16)
+PIN_GTK_OSX_COMMIT='37666f16'
 
 # https://gitlab.gnome.org/GNOME/gtk-mac-bundler/-/commits/master
-# use latest commit (2023-08-17)
-PIN_GTK_MAC_BUNDLER_COMMIT='0a95b2d5'
+# use latest commit (2024-05-19)
+PIN_GTK_MAC_BUNDLER_COMMIT='90443a1d'