diff --git a/NEWS b/NEWS
index f183d874c..c106d80fb 100644
--- a/NEWS
+++ b/NEWS
@@ -27,9 +27,16 @@ ver 0.24 (not yet released)
 * remove Haiku support
 * require libfmt 7 or later
 
-ver 0.23.12 (not yet released)
+ver 0.23.12 (2023/01/17)
+* input
+  - curl: require CURL 7.55.0 or later
+* decoder
+  - mad: fix integer underflow with very small files
 * tags
   - fix crash bug due to race condition
+* output
+  - pipewire: adjust to PipeWire 0.3.64 API change
+* fix build failures with GCC 13
 
 ver 0.23.11 (2022/11/28)
 * database
diff --git a/meson.build b/meson.build
index 91bfaf075..226dce99b 100644
--- a/meson.build
+++ b/meson.build
@@ -204,7 +204,6 @@ enable_daemon = not is_windows and not is_android and get_option('daemon')
 conf.set('ENABLE_DAEMON', enable_daemon)
 
 conf.set('HAVE_GETPWNAM_R', compiler.has_function('getpwnam_r'))
-conf.set('HAVE_GETPWUID_R', compiler.has_function('getpwuid_r'))
 conf.set('HAVE_INITGROUPS', compiler.has_function('initgroups'))
 conf.set('HAVE_FNMATCH', compiler.has_function('fnmatch'))
 
diff --git a/python/build/libs.py b/python/build/libs.py
index 4f35588e8..c9cebf372 100644
--- a/python/build/libs.py
+++ b/python/build/libs.py
@@ -393,8 +393,8 @@ openssl = OpenSSLProject(
 )
 
 curl = CmakeProject(
-    'https://curl.se/download/curl-7.86.0.tar.xz',
-    '2d61116e5f485581f6d59865377df4463f2e788677ac43222b496d4e49fb627b',
+    'https://curl.se/download/curl-7.87.0.tar.xz',
+    'ee5f1a1955b0ed413435ef79db28b834ea5f0fb7c8cfb1ce47175cc3bee08fff',
     'lib/libcurl.a',
     [
         '-DBUILD_CURL_EXE=OFF',
@@ -450,7 +450,7 @@ jack = JackProject(
 )
 
 boost = BoostProject(
-    'https://boostorg.jfrog.io/artifactory/main/release/1.80.0/source/boost_1_80_0.tar.bz2',
-    '1e19565d82e43bc59209a168f5ac899d3ba471d55c7610c677d4ccf2c9c500c0',
+    'https://boostorg.jfrog.io/artifactory/main/release/1.81.0/source/boost_1_81_0.tar.bz2',
+    '71feeed900fbccca04a3b4f2f84a7c217186f28a940ed8b7ed4725986baf99fa',
     'include/boost/version.hpp',
 )
diff --git a/src/decoder/plugins/MadDecoderPlugin.cxx b/src/decoder/plugins/MadDecoderPlugin.cxx
index 5fc652960..d551145d4 100644
--- a/src/decoder/plugins/MadDecoderPlugin.cxx
+++ b/src/decoder/plugins/MadDecoderPlugin.cxx
@@ -798,6 +798,8 @@ MadDecoder::UpdateTimerNextFrame() noexcept
 DecoderCommand
 MadDecoder::SubmitPCM(size_t i, size_t pcm_length) noexcept
 {
+	assert(i <= pcm_length);
+
 	size_t num_samples = pcm_length - i;
 
 	mad_fixed_to_24_buffer(output_buffer, synth.pcm,
@@ -843,7 +845,7 @@ MadDecoder::SynthAndSubmit() noexcept
 	size_t pcm_length = synth.pcm.length;
 	if (drop_end_samples &&
 	    current_frame == max_frames - drop_end_frames - 1) {
-		if (drop_end_samples >= pcm_length)
+		if (i + drop_end_samples >= pcm_length)
 			return DecoderCommand::STOP;
 
 		pcm_length -= drop_end_samples;
diff --git a/src/fs/StandardDirectory.cxx b/src/fs/StandardDirectory.cxx
index da0426f9f..e9c55dd31 100644
--- a/src/fs/StandardDirectory.cxx
+++ b/src/fs/StandardDirectory.cxx
@@ -34,7 +34,6 @@
 #include <shlobj.h>
 #else
 #include <stdlib.h>
-#include <unistd.h>
 #include <pwd.h>
 #endif
 
@@ -83,16 +82,7 @@ public:
 		return result != nullptr;
 	}
 
-	bool ReadByUid(uid_t uid) noexcept {
-#ifdef HAVE_GETPWUID_R
-		getpwuid_r(uid, &pw, buf.data(), buf.size(), &result);
-#else
-		result = getpwuid(uid);
-#endif
-		return result != nullptr;
-	}
-
-	const passwd *operator->() noexcept {
+	const passwd *operator->() {
 		assert(result != nullptr);
 		return result;
 	}
@@ -415,10 +405,8 @@ GetHomeDir() noexcept
 #ifndef ANDROID
 	if (const auto home = GetExistingEnvDirectory("HOME"); home != nullptr)
 		return AllocatedPath{home};
-
-	if (PasswdEntry pw; pw.ReadByUid(getuid()))
-		return SafePathFromFS(pw->pw_dir);
 #endif
+
 	return nullptr;
 }
 
diff --git a/src/lib/curl/meson.build b/src/lib/curl/meson.build
index a0f9647fb..e1cc8adcf 100644
--- a/src/lib/curl/meson.build
+++ b/src/lib/curl/meson.build
@@ -1,4 +1,4 @@
-curl_dep = dependency('libcurl', version: '>= 7.33', required: get_option('curl'))
+curl_dep = dependency('libcurl', version: '>= 7.55', required: get_option('curl'))
 conf.set('ENABLE_CURL', curl_dep.found())
 if not curl_dep.found()
   subdir_done()
diff --git a/src/output/plugins/PipeWireOutputPlugin.cxx b/src/output/plugins/PipeWireOutputPlugin.cxx
index 6a063df1d..1c21f75df 100644
--- a/src/output/plugins/PipeWireOutputPlugin.cxx
+++ b/src/output/plugins/PipeWireOutputPlugin.cxx
@@ -522,7 +522,13 @@ PipeWireOutput::Open(AudioFormat &audio_format)
 		pw_properties_setf(props, PW_KEY_REMOTE_NAME, "%s", remote);
 
 	if (target != nullptr && target_id == PW_ID_ANY)
-		pw_properties_setf(props, PW_KEY_NODE_TARGET, "%s", target);
+		pw_properties_setf(props,
+#if PW_CHECK_VERSION(0, 3, 64)
+				   PW_KEY_TARGET_OBJECT,
+#else
+				   PW_KEY_NODE_TARGET,
+#endif
+				   "%s", target);
 
 #ifdef PW_KEY_NODE_RATE
 	/* ask PipeWire to change the graph sample rate to ours