diff --git a/core/linux-odroid-c2/PKGBUILD b/core/linux-odroid-c2/PKGBUILD
index 19e2c62be..078cde34d 100644
--- a/core/linux-odroid-c2/PKGBUILD
+++ b/core/linux-odroid-c2/PKGBUILD
@@ -9,7 +9,7 @@ _srcname=linux-${_commit}
 _kernelname=${pkgbase#linux}
 _desc="ODROID-C2"
 pkgver=3.14.65
-pkgrel=6
+pkgrel=7
 arch=('aarch64')
 url="https://github.com/hardkernel/linux/tree/odroidc2-3.14.y"
 license=('GPL2')
@@ -24,7 +24,7 @@ source=("https://github.com/hardkernel/linux/archive/${_commit}.tar.gz"
 md5sums=('526a8606e22f0bfce21b0ed9d4f3a9f0'
          'SKIP'
          '3c4a5342ac88d86b4bf99e7d0b8b2977'
-         '28cee6ffbb83d72735362701a7d734a8'
+         '2bd05798183dd7915b92ae3b936972e3'
          '85fd3026c435ffa6d7c2d7f9767b4251'
          'b8956789318f49cec5b8bb0b41654a9b')
 
diff --git a/core/linux-odroid-c2/config b/core/linux-odroid-c2/config
index d78eee2ca..ec9b570c8 100644
--- a/core/linux-odroid-c2/config
+++ b/core/linux-odroid-c2/config
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm64 3.14.65-5 Kernel Configuration
+# Linux/arm64 3.14.65-7 Kernel Configuration
 #
 CONFIG_ARM64=y
 CONFIG_ARM64_HAS_SG_CHAIN=y
@@ -3822,29 +3822,30 @@ CONFIG_RTC_INTF_DEV=y
 #
 # I2C RTC drivers
 #
-# CONFIG_RTC_DRV_DS1307 is not set
-# CONFIG_RTC_DRV_DS1374 is not set
-# CONFIG_RTC_DRV_DS1672 is not set
-# CONFIG_RTC_DRV_DS3232 is not set
-# CONFIG_RTC_DRV_HYM8563 is not set
-# CONFIG_RTC_DRV_MAX6900 is not set
-# CONFIG_RTC_DRV_RS5C372 is not set
-# CONFIG_RTC_DRV_ISL1208 is not set
-# CONFIG_RTC_DRV_ISL12022 is not set
-# CONFIG_RTC_DRV_ISL12057 is not set
-# CONFIG_RTC_DRV_X1205 is not set
-# CONFIG_RTC_DRV_PCF2127 is not set
-# CONFIG_RTC_DRV_PCF8523 is not set
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_DS3232=m
+CONFIG_RTC_DRV_HYM8563=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_ISL12022=m
+CONFIG_RTC_DRV_ISL12057=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_DRV_PCF2127=m
+CONFIG_RTC_DRV_PCF8523=m
 CONFIG_RTC_DRV_PCF8563=m
-# CONFIG_RTC_DRV_PCF8583 is not set
-# CONFIG_RTC_DRV_M41T80 is not set
-# CONFIG_RTC_DRV_BQ32K is not set
-# CONFIG_RTC_DRV_S35390A is not set
-# CONFIG_RTC_DRV_FM3130 is not set
-# CONFIG_RTC_DRV_RX8581 is not set
-# CONFIG_RTC_DRV_RX8025 is not set
-# CONFIG_RTC_DRV_EM3027 is not set
-# CONFIG_RTC_DRV_RV3029C2 is not set
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_M41T80_WDT=y
+CONFIG_RTC_DRV_BQ32K=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_RX8025=m
+CONFIG_RTC_DRV_EM3027=m
+CONFIG_RTC_DRV_RV3029C2=m
 
 #
 # SPI RTC drivers
diff --git a/core/systemd/PKGBUILD b/core/systemd/PKGBUILD
index acb473e51..80ef6931a 100644
--- a/core/systemd/PKGBUILD
+++ b/core/systemd/PKGBUILD
@@ -7,7 +7,7 @@
 
 pkgbase=systemd
 pkgname=('systemd' 'libsystemd' 'systemd-sysvcompat')
-pkgver=229
+pkgver=230
 pkgrel=3
 arch=('i686' 'x86_64')
 url="http://www.freedesktop.org/wiki/Software/systemd"
@@ -22,29 +22,34 @@ source=("git://github.com/systemd/systemd.git#tag=v$pkgver"
         'initcpio-install-udev'
         'arch.conf'
         'loader.conf'
-        'splash-arch.bmp')
+        'splash-arch.bmp'
+        'udev-hwdb.hook')
 md5sums=('SKIP'
          '90ea67a7bb237502094914622a39e281'
-         '976c5511b6493715e381f43f16cdb151'
+         'cfb3f8ea657ab24535cc061bb38ec4c1'
          '1b3aa3a0551b08af9305d33f85b5c2fc'
          '20ead378f5d6df4b2a3e670301510a7d'
          'ddaef54f68f6c86c6c07835fc668f62a'
-         '1e2f9a8b0fa32022bf0a8f39123e5f4e')
+         '1e2f9a8b0fa32022bf0a8f39123e5f4e'
+         'a475a5ed8f03fb0f6b58b4684998d05c')
+
+_backports=(
+  # Revert "rules: allow users to access frame buffer devices" (#3333)
+  e77813ca9f4e0735fd0e3e2caae4d7d1ee436011
+
+  # {machine,system}ctl: always pass &changes and &n_changes (#3350)
+  acc0269cad31d1aaef2034a055b34c07c88a353d
+
+  # systemctl: fix return values on success
+  5f056378b0ceffb6e6fba3513f7eae72e2d09dc8
+)
 
 prepare() {
   cd "$pkgbase"
 
-  # networkd: FIONREAD is not reliable on some sockets
-  git cherry-pick -n 4edc2c9b6b5b921873eb82e58719ed4d9e0d69bf
-
-  # fix assertion failure in src/core/timer.c on bootup (FS#48197)
-  git cherry-pick -n 3f51aec8647fe13f4b1e46b2f75ff635403adf91
-
-  # fix udevd error checking from cg_unified() (FS#48188)
-  git cherry-pick -n 6d2353394fc33e923d1ab464c8f88df2a5105ffb
-
-  # revert "core: resolve specifier in config_parse_exec()"
-  git cherry-pick -n bd1b973fb326e9b7587494fd6108e5ded46e9163
+  if (( ${#_backports[*]} > 0 )); then
+    git cherry-pick -n "${_backports[@]}"
+  fi
 
   ./autogen.sh
 }
@@ -58,16 +63,23 @@ build() {
   CFLAGS+=" -fno-lto"
   CXXFLAGS+=" -fno-lto"
 
-  ./configure \
-      --libexecdir=/usr/lib \
-      --localstatedir=/var \
-      --sysconfdir=/etc \
-      --enable-lz4 \
-      --disable-audit \
-      --disable-ima \
-      --with-sysvinit-path= \
-      --with-sysvrcnd-path= \
-      --with-ntp-servers="${timeservers[*]}"
+  local configure_options=(
+    --libexecdir=/usr/lib
+    --localstatedir=/var
+    --sysconfdir=/etc
+
+    --enable-lz4
+    --disable-audit
+    --disable-ima
+
+    --with-sysvinit-path=
+    --with-sysvrcnd-path=
+    --with-ntp-servers="${timeservers[*]}"
+    --with-default-dnssec=no
+    --without-kill-user-processes
+  )
+
+  ./configure "${configure_options[@]}"
 
   make
 }
@@ -75,7 +87,7 @@ build() {
 package_systemd() {
   pkgdesc="system and service manager"
   license=('GPL2' 'LGPL2.1')
-  depends=('acl' 'bash' 'dbus' 'glib2' 'iptables' 'kbd' 'kmod' 'hwids' 'libcap'
+  depends=('acl' 'bash' 'dbus' 'iptables' 'kbd' 'kmod' 'hwids' 'libcap'
            'libgcrypt' 'libsystemd' 'libidn' 'lz4' 'pam' 'libelf' 'libseccomp'
            'util-linux' 'xz')
   provides=('nss-myhostname' "systemd-tools=$pkgver" "udev=$pkgver")
@@ -95,7 +107,6 @@ package_systemd() {
           etc/dbus-1/system.d/org.freedesktop.import1.conf
           etc/dbus-1/system.d/org.freedesktop.network1.conf
           etc/pam.d/systemd-user
-          etc/systemd/bootchart.conf
           etc/systemd/coredump.conf
           etc/systemd/journald.conf
           etc/systemd/journal-remote.conf
@@ -156,6 +167,8 @@ package_systemd() {
   install -Dm644 "$srcdir/arch.conf" "$pkgdir"/usr/share/systemd/bootctl/arch.conf
   install -Dm644 "$srcdir/loader.conf" "$pkgdir"/usr/share/systemd/bootctl/loader.conf
   install -Dm644 "$srcdir/splash-arch.bmp" "$pkgdir"/usr/share/systemd/bootctl/splash-arch.bmp
+
+  install -Dm644 "$srcdir/udev-hwdb.hook" "$pkgdir/usr/share/libalpm/hooks/udev-hwdb.hook"
 }
 
 package_libsystemd() {
diff --git a/core/systemd/initcpio-install-systemd b/core/systemd/initcpio-install-systemd
index 96df98ada..d8d30aa3d 100644
--- a/core/systemd/initcpio-install-systemd
+++ b/core/systemd/initcpio-install-systemd
@@ -108,8 +108,6 @@ build() {
         /usr/lib/systemd/system-generators/systemd-gpt-auto-generator \
         /usr/lib/systemd/system-generators/systemd-hibernate-resume-generator
 
-    add_module "kdbus?"
-
     # udev rules and systemd units
     map add_udev_rule "$rules" \
             50-udev-default.rules \
@@ -123,6 +121,7 @@ build() {
             initrd-fs.target \
             initrd-parse-etc.service \
             initrd-root-fs.target \
+            initrd-root-device.target \
             initrd-switch-root.service \
             initrd-switch-root.target \
             initrd-udevadm-cleanup-db.service \
diff --git a/core/systemd/udev-hwdb.hook b/core/systemd/udev-hwdb.hook
new file mode 100644
index 000000000..7bc055b4e
--- /dev/null
+++ b/core/systemd/udev-hwdb.hook
@@ -0,0 +1,11 @@
+[Trigger]
+Type = File
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Target = usr/lib/udev/hwdb.d/*
+
+[Action]
+Description = Updating udev Hardware Database...
+When = PostTransaction
+Exec = /usr/bin/udevadm hwdb --update
diff --git a/extra/thunderbird/PKGBUILD b/extra/thunderbird/PKGBUILD
index 57df116cb..71c86857d 100644
--- a/extra/thunderbird/PKGBUILD
+++ b/extra/thunderbird/PKGBUILD
@@ -15,8 +15,8 @@ buildarch=28
 highmem=1
 
 pkgname=thunderbird
-pkgver=45.1.0
-pkgrel=2
+pkgver=45.1.1
+pkgrel=1
 pkgdesc="Standalone mail and news reader from mozilla.org"
 arch=('i686' 'x86_64')
 license=('MPL' 'GPL' 'LGPL')
@@ -36,14 +36,14 @@ source=(https://ftp.mozilla.org/pub/mozilla.org/thunderbird/releases/$pkgver/sou
         vendor.js
         no-neon.patch)
 options=('!emptydirs' '!makeflags')
-sha256sums=('8ae9ebe536895d69d99f412f2b3aba645b7dd839e520959330da13892d672309'
+sha256sums=('107d103c30b4f666ede1ec197156f94456117783087518fe1af4557d548b718e'
             'e6ab613a6d15668ac6856b591d07efa4a338671dad4ce09e9254662848462ee5'
             '3fba13d88aeb003ab0811ef739463858172ce0662a1c7d62835df3d83ddbb8fb'
             '24599eab8862476744fe1619a9a53a5b8cdcab30b3fc5767512f31d3529bd05d'
             '4d1e1ddabc9e975ed39f49e134559a29e01cd49439e358233f1ede43bf5a52bf'
             '2588c567fec88b44b65f0cd111e8769361c138d4c964310684f7bb80066f8f9f'
             'd1ccbaf0973615c57f7893355e5cd3a89efb4e91071d0ec376e429b50cf6ed19'
-            '8f9ee921896b939e36d089c8ff544bc2b0a8b56dd5a2b4f5e75a19a6e1849284'
+            'e4ea8e6788163d9f8db8f1f40023db3ea0a1358f9a4510169f2d4c4fe6a887ed'
             '59f40d8b2480aa67bf76f4f119826b6828a6a59cc040caf1ab5a6e19eef44c6e')
 
 # Google API keys (see http://www.chromium.org/developers/how-tos/api-keys)
@@ -98,12 +98,17 @@ build() {
   # _FORTIFY_SOURCE causes configure failures
   CPPFLAGS+=" -O2"
 
+  # Hardening
+  LDFLAGS+=" -Wl,-z,now"
+
   # GCC 6
-  CFLAGS+=" -fno-delete-null-pointer-checks -fno-lifetime-dse"
-  CXXFLAGS+=" -fno-delete-null-pointer-checks -fno-lifetime-dse"
+  CFLAGS+=" -fno-delete-null-pointer-checks -fno-lifetime-dse -fno-schedule-insns2"
+  CXXFLAGS+=" -fno-delete-null-pointer-checks -fno-lifetime-dse -fno-schedule-insns2"
+
+  # Help with memory usage
+  LDFLAGS+=" -Wl,--no-keep-memory -Wl,--reduce-memory-overheads"
 
   export PATH="$srcdir/path:$PATH"
-  export LDFLAGS="$LDFLAGS -Wl,--no-keep-memory -Wl,--reduce-memory-overheads"
 
   make -f client.mk build
 }
diff --git a/extra/thunderbird/vendor.js b/extra/thunderbird/vendor.js
index e1341de4e..170b505a8 100644
--- a/extra/thunderbird/vendor.js
+++ b/extra/thunderbird/vendor.js
@@ -7,6 +7,3 @@ pref("mail.shell.checkDefaultMail", false);
 // Don't disable our bundled extensions in the application directory
 pref("extensions.autoDisableScopes", 11);
 pref("extensions.shownSelectionUI", true);
-
-// https://bugzilla.mozilla.org/show_bug.cgi?id=1245783
-pref("javascript.options.ion", false);
diff --git a/extra/webkit2gtk/PKGBUILD b/extra/webkit2gtk/PKGBUILD
index 51ae51666..c0834490b 100644
--- a/extra/webkit2gtk/PKGBUILD
+++ b/extra/webkit2gtk/PKGBUILD
@@ -8,7 +8,7 @@
 highmem=1
 
 pkgname=webkit2gtk
-pkgver=2.12.2
+pkgver=2.12.3
 pkgrel=1
 pkgdesc="GTK+ Web content engine library"
 arch=('i686' 'x86_64')
@@ -23,7 +23,7 @@ optdepends=('gtk2: Netscape plugin support'
             'gst-libav: nonfree media decoding')
 options=('!emptydirs')
 source=(http://webkitgtk.org/releases/webkitgtk-${pkgver}.tar.xz)
-sha256sums=('9dc49b908b1c37da739703e1402a7f07c4ea9093b8ecfb34f20e8f74e328f124')
+sha256sums=('173cbb9a2eca23eee52e99965483ab25aa9c0569ef5b57041fc0c129cc26c307')
 
 prepare() {
   mkdir build