144 files changed, 2003 insertions, 2566 deletions
diff --git a/meta-networking/recipes-connectivity/cloudflared/cloudflared_2026.3.0.bb b/meta-networking/recipes-connectivity/cloudflared/cloudflared_2026.3.0.bb
new file mode 100644
index 0000000000..f0b8530a69
--- /dev/null
+++ b/meta-networking/recipes-connectivity/cloudflared/cloudflared_2026.3.0.bb
@@ -0,0 +1,36 @@
+SUMMARY = "Cloudflare Tunnel client"
+DESCRIPTION = "cloudflared is the command-line client for Cloudflare Tunnel, \
+a tunneling daemon that proxies traffic from the Cloudflare network to your origins."
+HOMEPAGE = "https://github.com/cloudflare/cloudflared"
+SECTION = "networking"
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://src/${GO_IMPORT}/LICENSE;md5=175792518e4ac015ab6696d16c4f607e"
+SRC_URI = "git://github.com/cloudflare/cloudflared.git;protocol=https;branch=master;destsuffix=${GO_SRCURI_DESTSUFFIX} \
+           file://cloudflared.service \
+           file://default \
+           "
+SRCREV = "d2a87e9b93456ad7f82417400f4209d513668487"
+GO_IMPORT = "github.com/cloudflare/cloudflared"
+GO_INSTALL = "${GO_IMPORT}/cmd/cloudflared"
+GO_LINKSHARED = ""
+SRCREV_SHORT = "${@d.getVar('SRCREV')[:8]}"
+GO_EXTRA_LDFLAGS = "-X main.Version=${PV}-${SRCREV_SHORT}"
+inherit go-mod systemd
+SYSTEMD_SERVICE:${PN} = "cloudflared.service"
+do_install:append() {
+    install -d ${D}${systemd_system_unitdir}
+    install -m 0644 ${UNPACKDIR}/cloudflared.service ${D}${systemd_system_unitdir}/cloudflared.service
+    install -d ${D}${sysconfdir}/default
+    install -m 0644 ${UNPACKDIR}/default ${D}${sysconfdir}/default/cloudflared
+}
+FILES:${PN}-src += "${libdir}/go/src"
+# Fix shebang and QA Issue with scripts with /bin/bash and /usr/bin/python3
+INSANE_SKIP:${PN}-dev = "file-rdeps"
diff --git a/meta-networking/recipes-connectivity/cloudflared/files/cloudflared.service b/meta-networking/recipes-connectivity/cloudflared/files/cloudflared.service
new file mode 100644
index 0000000000..decaf0e329
--- /dev/null
+++ b/meta-networking/recipes-connectivity/cloudflared/files/cloudflared.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=cloudflared
+After=network-online.target
+Wants=network-online.target
+[Service]
+Type=notify
+DynamicUser=yes
+EnvironmentFile=/etc/default/cloudflared
+ExecStart=/usr/bin/cloudflared --no-autoupdate tunnel run --token ${TUNNEL_TOKEN}
+Restart=on-failure
+RestartSec=5s
+[Install]
+WantedBy=multi-user.target
diff --git a/meta-networking/recipes-connectivity/cloudflared/files/default b/meta-networking/recipes-connectivity/cloudflared/files/default
new file mode 100644
index 0000000000..1e00173af6
--- /dev/null
+++ b/meta-networking/recipes-connectivity/cloudflared/files/default
@@ -0,0 +1,2 @@
+# Cloudflare Tunnel token from the dashboard
+TUNNEL_TOKEN=
diff --git a/meta-networking/recipes-connectivity/daq/libdaq_3.0.25.bb b/meta-networking/recipes-connectivity/daq/libdaq_3.0.27.bb
index b999f385a6..fb45ad74b3 100644
--- a/meta-networking/recipes-connectivity/daq/libdaq_3.0.25.bb
+++ b/meta-networking/recipes-connectivity/daq/libdaq_3.0.27.bb
@@ -12,7 +12,7 @@ inherit autotools pkgconfig
 SRC_URI = "git://github.com/snort3/libdaq.git;protocol=https;branch=master;tag=v${PV} \
           file://0001-example-Use-lm-for-the-fst-module.patch"
-SRCREV = "7baba902b3fee7a81be663bfb71418402411c24a"
+SRCREV = "959b13d76aa3409acadfe22d1c30864698a297a7"
 FILES:${PN} += "${libdir}/daq/*.so"
diff --git a/meta-networking/recipes-connectivity/dhcp/dhcp-relay_4.4.3p1.bb b/meta-networking/recipes-connectivity/dhcp/dhcp-relay_4.4.3p1.bb
index 707eeb0e26..04fe9b9acd 100644
--- a/meta-networking/recipes-connectivity/dhcp/dhcp-relay_4.4.3p1.bb
+++ b/meta-networking/recipes-connectivity/dhcp/dhcp-relay_4.4.3p1.bb
@@ -39,7 +39,7 @@ BIND_EXTRA_CONFIG = "\
        --host=${HOST_SYS} \
        --target=${TARGET_SYS} \
 "
+CACHED_CONFIGUREVARS += "ac_cv_prog_cc_c23=no"
 EXTRA_OECONF = "--with-bind-extra-config="${BIND_EXTRA_CONFIG}" \
                --enable-paranoia \
                --disable-static \
diff --git a/meta-networking/recipes-connectivity/ez-ipupdate/ez-ipupdate_3.0.11b7.bb b/meta-networking/recipes-connectivity/ez-ipupdate/ez-ipupdate_3.0.11b8.bb
index 7a392b2c23..eabf4027d6 100644
--- a/meta-networking/recipes-connectivity/ez-ipupdate/ez-ipupdate_3.0.11b7.bb
+++ b/meta-networking/recipes-connectivity/ez-ipupdate/ez-ipupdate_3.0.11b8.bb
@@ -4,21 +4,19 @@ HOMEPAGE = "http://sourceforge.net/projects/ez-ipupdate/"
 LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=7783169b4be06b54e86730eb01bc3a31"
-SRC_URI = "http://sourceforge.net/projects/ez-ipupdate/files/${BPN}/${PV}/${BPN}-${PV}.tar.gz \
+SRC_URI = "${DEBIAN_MIRROR}/main/e/${BPN}/${BPN}_${PV}.orig.tar.gz \
           file://Makefile.am.patch \
-           file://cache_file.c.patch \
-           file://conf_file.c.patch \
           file://wformat.patch \
           file://0001-ez-ipupdate-Include-time.h-for-time-API-prototype.patch \
           file://CVE-2003-0887.patch \
+                   file://0001-configure-Check-for-string.h-system-header.patch \
           "
-SRC_URI[md5sum] = "525be4550b4461fdf105aed8e753b020"
+SRC_URI[sha256sum] = "bf5b8d11ffe055c5891d0ab64bbfa86e99cbda645d40f346146b939fec8d962d"
-SRC_URI[sha256sum] = "a15ec0dc0b78ec7578360987c68e43a67bc8d3591cbf528a323588830ae22c20"
 inherit autotools pkgconfig
-do_install:append(){
+#do_install:append(){
-    install -m 0744 -d ${D}${localstatedir}/lib/ez-ipupdate
+#    install -m 0744 -d ${D}${localstatedir}/lib/ez-ipupdate
-}
+#}
-FILES:${PN} += "${localstatedir}/lib/ez-ipupdate"
+#FILES:${PN} += "${localstatedir}/lib/ez-ipupdate"
diff --git a/meta-networking/recipes-connectivity/ez-ipupdate/files/0001-configure-Check-for-string.h-system-header.patch b/meta-networking/recipes-connectivity/ez-ipupdate/files/0001-configure-Check-for-string.h-system-header.patch
new file mode 100644
index 0000000000..e9995a3500
--- /dev/null
+++ b/meta-networking/recipes-connectivity/ez-ipupdate/files/0001-configure-Check-for-string.h-system-header.patch
@@ -0,0 +1,53 @@
+From 811f253c03464489d445ab6627bb4187d27e98ef Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Sat, 4 Apr 2026 19:12:37 +0000
+Subject: [PATCH] configure: Check for string.h system header
+This is needed for functions like memcpy in md5.c but
+it only includes string.h when its detected by autotools
+however the needed check for detecting it during configure
+are missing. This patch adds them
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ config.h.in  | 3 +++
+ configure.in | 3 ++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+diff --git a/config.h.in b/config.h.in
+index 2ce447f..52a8d7d 100644
+--- a/config.h.in
+++ b/config.h.in
+@@ -129,6 +129,9 @@
+ /* Define if you have the <signal.h> header file.  */
+ #undef HAVE_SIGNAL_H
+ 
+/* Define if you have the <string.h> header file.  */
+#undef HAVE_STRING_H
+
+ /* Define if you have the <stdarg.h> header file.  */
+ #undef HAVE_STDARG_H
+ 
+diff --git a/configure.in b/configure.in
+index c97b9fc..f5d0808 100644
+--- a/configure.in
+++ b/configure.in
+@@ -62,6 +62,7 @@ AC_CHECK_HEADERS( arpa/inet.h \
+                  sys/stat.h \
+                  fcntl.h \
+                  signal.h \
+                 string.h \
+                  syslog.h \
+                  pwd.h \
+                  stdarg.h \
+@@ -104,7 +105,7 @@ AC_ARG_ENABLE(default-service,
+                           dyndns, dyndns-static, ods, tzo, gnudip, easydns, easydns-partner, dyns, hn, zoneedit, heipv6tb],
+              [ use_SERVICE=$enableval;
+                AC_MSG_RESULT(yes) ],
+-             [ AC_MSG_RESULT(no) 
+             [ AC_MSG_RESULT(no)
+                 use_SERVICE=null
+                 AC_MSG_WARN(not setting default service) ]   )
+ case "$use_SERVICE" in
diff --git a/meta-networking/recipes-connectivity/ez-ipupdate/files/CVE-2003-0887.patch b/meta-networking/recipes-connectivity/ez-ipupdate/files/CVE-2003-0887.patch
index 53aa355008..14abe27c00 100644
--- a/meta-networking/recipes-connectivity/ez-ipupdate/files/CVE-2003-0887.patch
+++ b/meta-networking/recipes-connectivity/ez-ipupdate/files/CVE-2003-0887.patch
@@ -26,8 +26,6 @@ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 example-tzo.conf       | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)
-diff --git a/example-dhs.conf b/example-dhs.conf
-index 3fe9a04..f976ae5 100755
 --- a/example-dhs.conf
 +++ b/example-dhs.conf
 @@ -11,7 +11,7 @@ host=mydomain.whatever.com
@@ -39,8 +37,6 @@ index 3fe9a04..f976ae5 100755
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
-diff --git a/example-dyndns.conf b/example-dyndns.conf
-index f539dec..84b4807 100755
 --- a/example-dyndns.conf
 +++ b/example-dyndns.conf
 @@ -19,7 +19,7 @@ max-interval=2073600
@@ -52,8 +48,6 @@ index f539dec..84b4807 100755
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
-diff --git a/example-dyns.conf b/example-dyns.conf
-index 868768d..856a4d7 100644
 --- a/example-dyns.conf
 +++ b/example-dyns.conf
 @@ -11,7 +11,7 @@ host=myhost
@@ -65,8 +59,6 @@ index 868768d..856a4d7 100644
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
-diff --git a/example-easydns.conf b/example-easydns.conf
-index 0ff20da..15d9b78 100755
 --- a/example-easydns.conf
 +++ b/example-easydns.conf
 @@ -11,7 +11,7 @@ host=mydomain.whatever.com
@@ -78,8 +70,6 @@ index 0ff20da..15d9b78 100755
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
-diff --git a/example-gnudip.conf b/example-gnudip.conf
-index 3b2fb63..d09df1f 100755
 --- a/example-gnudip.conf
 +++ b/example-gnudip.conf
 @@ -15,7 +15,7 @@ max-interval=2073600
@@ -91,8 +81,6 @@ index 3b2fb63..d09df1f 100755
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
-diff --git a/example-heipv6tb.conf b/example-heipv6tb.conf
-index e31aa9c..3ebc822 100644
 --- a/example-heipv6tb.conf
 +++ b/example-heipv6tb.conf
 @@ -18,7 +18,7 @@ max-interval=2073600
@@ -104,8 +92,6 @@ index e31aa9c..3ebc822 100644
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
-diff --git a/example-justlinux.conf b/example-justlinux.conf
-index 0afeb2c..28b3327 100755
 --- a/example-justlinux.conf
 +++ b/example-justlinux.conf
 @@ -11,7 +11,7 @@ host=mydomain.penguinpowered.com
@@ -117,8 +103,6 @@ index 0afeb2c..28b3327 100755
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
-diff --git a/example-ods.conf b/example-ods.conf
-index d0ff889..7b16f2c 100755
 --- a/example-ods.conf
 +++ b/example-ods.conf
 @@ -11,7 +11,7 @@ host=mydomain.ods.org
@@ -130,8 +114,6 @@ index d0ff889..7b16f2c 100755
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
-diff --git a/example-pgpow.conf b/example-pgpow.conf
-index 29a92d6..81e351b 100755
 --- a/example-pgpow.conf
 +++ b/example-pgpow.conf
 @@ -11,7 +11,7 @@ host=mydomain.penguinpowered.com
@@ -143,8 +125,6 @@ index 29a92d6..81e351b 100755
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
-diff --git a/example-tzo.conf b/example-tzo.conf
-index 2a71db3..10b8dc4 100755
 --- a/example-tzo.conf
 +++ b/example-tzo.conf
 @@ -15,7 +15,7 @@ max-interval=2073600
diff --git a/meta-networking/recipes-connectivity/ez-ipupdate/files/cache_file.c.patch b/meta-networking/recipes-connectivity/ez-ipupdate/files/cache_file.c.patch
deleted file mode 100644
index 0199cb1278..0000000000
--- a/meta-networking/recipes-connectivity/ez-ipupdate/files/cache_file.c.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-Upstream-Status: Pending
-Dont assume errno type
--- ez-ipupdate-3.0.11b7/cache_file.c.orig      2014-07-02 14:01:07.126029412 -0600
-+++ ez-ipupdate-3.0.11b7/cache_file.c   2014-07-02 14:08:27.422026332 -0600
-@@ -43,11 +43,11 @@
- #include <cache_file.h>
- 
- #if HAVE_STRERROR
-extern int errno;
-+#  include <errno.h>
- #  define error_string strerror(errno)
- #elif HAVE_SYS_ERRLIST
- extern const char *const sys_errlist[];
-extern int errno;
-+#  include <errno.h>
- #  define error_string (sys_errlist[errno])
- #else
- #  define error_string "error message not found"
-@@ -63,11 +63,11 @@
- #  define dprintf(x)
- #endif
- #if HAVE_STRERROR
-extern int errno;
-+#  include <errno.h>
- #  define error_string strerror(errno)
- #elif HAVE_SYS_ERRLIST
- extern const char *const sys_errlist[];
-extern int errno;
-+#  include <errno.h>
- #  define error_string (sys_errlist[errno])
- #else
- #  define error_string "error message not found"
diff --git a/meta-networking/recipes-connectivity/ez-ipupdate/files/conf_file.c.patch b/meta-networking/recipes-connectivity/ez-ipupdate/files/conf_file.c.patch
deleted file mode 100644
index 6325c1873f..0000000000
--- a/meta-networking/recipes-connectivity/ez-ipupdate/files/conf_file.c.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Upstream-Status: Pending
-Dont assume errno type
--- ez-ipupdate-3.0.11b7/conf_file.c.orig       2014-07-02 14:01:19.174029328 -0600
-+++ ez-ipupdate-3.0.11b7/conf_file.c    2014-07-02 14:08:42.982026223 -0600
-@@ -38,11 +38,11 @@
- #include <conf_file.h>
- 
- #if HAVE_STRERROR
-extern int errno;
-+#  include <errno.h>
- #  define error_string strerror(errno)
- #elif HAVE_SYS_ERRLIST
- extern const char *const sys_errlist[];
-extern int errno;
-+#  include <errno.h>
- #  define error_string (sys_errlist[errno])
- #else
- #  define error_string "error message not found"
diff --git a/meta-networking/recipes-connectivity/ez-ipupdate/files/wformat.patch b/meta-networking/recipes-connectivity/ez-ipupdate/files/wformat.patch
index 3b791559d5..7463e3c535 100644
--- a/meta-networking/recipes-connectivity/ez-ipupdate/files/wformat.patch
+++ b/meta-networking/recipes-connectivity/ez-ipupdate/files/wformat.patch
@@ -1,4 +1,9 @@
-Upstream-Status: Pending
+This patch is used by Gentoo to mitigate CVE-2004-0980:
+https://bugs.gentoo.org/69658
+CVE: CVE-2004-0980
+Upstream-Status: Inactive-Upstream [last commit: 2002]
 Index: ez-ipupdate-3.0.11b7/ez-ipupdate.c
 ===================================================================
diff --git a/meta-networking/recipes-connectivity/freeradius/files/0010-fix-error-for-expansion-of-macro-in-thread.h.patch b/meta-networking/recipes-connectivity/freeradius/files/0010-fix-error-for-expansion-of-macro-in-thread.h.patch
deleted file mode 100644
index cae27ad3a4..0000000000
--- a/meta-networking/recipes-connectivity/freeradius/files/0010-fix-error-for-expansion-of-macro-in-thread.h.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 0475d948ceab91b22172f0fae3bc01e0a1502ae8 Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Wed, 18 Jan 2017 14:59:39 +0800
-Subject: [PATCH] fix error for expansion of macro in thread.h
-The parameter declaration is missing in expansion of macro
-which cause the build error:
-| In file included from src/freeradius-devel/libradius.h:80:0,
-|                  from src/lib/log.c:26:
-| src/lib/log.c: In function '__fr_thread_local_destroy_fr_strerror_buffer':
-| src/lib/log.c:37:31: error: 'fr_strerror_buffer' undeclared (first use in this function)
-|  fr_thread_local_setup(char *, fr_strerror_buffer) /* macro */
-|                                ^
-Add the missing declaration in macro.
-Upstream-Status: Pending
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
- src/include/threads.h | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-diff --git a/src/include/threads.h b/src/include/threads.h
-index f2aea776d6..1c4e526797 100644
--- a/src/include/threads.h
-+++ b/src/include/threads.h
-@@ -92,7 +92,7 @@ static _t __fr_thread_local_init_##_n(pthread_destructor_t func)\
- #  define fr_thread_local_get(_n) _n
- #elif defined(HAVE_PTHREAD_H)
- #  include <pthread.h>
-#  define fr_thread_local_setup(_t, _n) \
-+#  define fr_thread_local_setup(_t, _n) static __thread _t _n;\
- static pthread_key_t __fr_thread_local_key_##_n;\
- static pthread_once_t __fr_thread_local_once_##_n = PTHREAD_ONCE_INIT;\
- static pthread_destructor_t __fr_thread_local_destructor_##_n = NULL;\
-@@ -103,17 +103,17 @@ static void __fr_thread_local_destroy_##_n(UNUSED void *unused)\
- static void __fr_thread_local_key_init_##_n(void)\
- {\
-        (void) pthread_key_create(&__fr_thread_local_key_##_n, __fr_thread_local_destroy_##_n);\
-       (void) pthread_setspecific(__fr_thread_local_key_##_n, &(_n));\
- }\
- static _t __fr_thread_local_init_##_n(pthread_destructor_t func)\
- {\
-        __fr_thread_local_destructor_##_n = func;\
-        if (_n) return _n; \
-        (void) pthread_once(&__fr_thread_local_once_##_n, __fr_thread_local_key_init_##_n);\
-+       (void) pthread_setspecific(__fr_thread_local_key_##_n, &(_n));\
-        return _n;\
- }
-#  define fr_thread_local_init(_n, _f)                 __fr_thread_local_init_##_n(_f)
-#  define fr_thread_local_set(_n, _v)                  __fr_thread_local_set_##_n(_v)
-#  define fr_thread_local_get(_n)                      __fr_thread_local_get_##_n()
-+#  define fr_thread_local_init(_n, _f) __fr_thread_local_init_##_n(_f)
-+#  define fr_thread_local_set(_n, _v) ((int)!((_n = _v) || 1))
-+#  define fr_thread_local_get(_n) _n
- #endif
- #endif
-- 
-2.25.1
diff --git a/meta-networking/recipes-connectivity/freeradius/files/0016-version.c-don-t-print-build-flags.patch b/meta-networking/recipes-connectivity/freeradius/files/0016-version.c-don-t-print-build-flags.patch
index 8917457ec2..6fb9d9fa3b 100644
--- a/meta-networking/recipes-connectivity/freeradius/files/0016-version.c-don-t-print-build-flags.patch
+++ b/meta-networking/recipes-connectivity/freeradius/files/0016-version.c-don-t-print-build-flags.patch
@@ -1,4 +1,4 @@
-From 99ea83d998d3b8957830afa15cec42ba265b67ca Mon Sep 17 00:00:00 2001
+From ac503b5395d566c677013c051165290ab024cdef Mon Sep 17 00:00:00 2001
 From: Mingli Yu <mingli.yu@windriver.com>
 Date: Wed, 3 Aug 2022 16:44:29 +0800
 Subject: [PATCH] version.c: don't print build flags
@@ -13,10 +13,10 @@ Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
 1 file changed, 13 deletions(-)
 diff --git a/src/main/version.c b/src/main/version.c
-index 44a6edc699..a0e6f26911 100644
+index 1bdb562..0368fba 100644
 --- a/src/main/version.c
 +++ b/src/main/version.c
-@@ -614,19 +614,6 @@ void version_print(void)
+@@ -622,19 +622,6 @@ void version_print(void)
                DEBUG2("  unknown");
 #endif
 
@@ -35,7 +35,4 @@ index 44a6edc699..a0e6f26911 100644
 -#endif
                DEBUG2("  ");
        }
-        INFO("FreeRADIUS Version " RADIUSD_VERSION_STRING);
+ 
-- 
-2.25.1
diff --git a/meta-networking/recipes-connectivity/freeradius/files/0018-update-license-1.patch b/meta-networking/recipes-connectivity/freeradius/files/0018-update-license-1.patch
deleted file mode 100644
index 8647c389ab..0000000000
--- a/meta-networking/recipes-connectivity/freeradius/files/0018-update-license-1.patch
+++ /dev/null
@@ -1,175 +0,0 @@
-From 82d874c638c80fbbf1eca7c51aca095fbbf40024 Mon Sep 17 00:00:00 2001
-From: "Alan T. DeKok" <aland@freeradius.org>
-Date: Mon, 27 Oct 2025 06:31:22 -0400
-Subject: [PATCH] update license
-Upstream-Status: Backport
-[https://github.com/FreeRADIUS/freeradius-server/commit/82d874c638c80fbbf1eca7c51aca095fbbf40024]
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
- src/modules/rlm_dpsk/rlm_dpsk.c               | 25 +++++++---------
- .../rlm_eap/types/rlm_eap_teap/eap_teap.c     | 29 +++++++------------
- .../rlm_eap/types/rlm_eap_teap/eap_teap.h     | 29 +++++++------------
- .../rlm_eap/types/rlm_eap_teap/rlm_eap_teap.c | 29 +++++++------------
- 4 files changed, 44 insertions(+), 68 deletions(-)
-diff --git a/src/modules/rlm_dpsk/rlm_dpsk.c b/src/modules/rlm_dpsk/rlm_dpsk.c
-index 4b818d08a5..aa07415540 100644
--- a/src/modules/rlm_dpsk/rlm_dpsk.c
-+++ b/src/modules/rlm_dpsk/rlm_dpsk.c
-@@ -1,20 +1,17 @@
- /*
- * Copyright (C) 2023 Network RADIUS SARL (legal@networkradius.com)
-+ *   This program is is free software; you can redistribute it and/or modify
-+ *   it under the terms of the GNU General Public License as published by
-+ *   the Free Software Foundation; either version 2 of the License, or (at
-+ *   your option) any later version.
-  *
- * This software may not be redistributed in any form without the prior
- * written consent of Network RADIUS.
-+ *   This program is distributed in the hope that it will be useful,
-+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ *   GNU General Public License for more details.
-  *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
-+ *   You should have received a copy of the GNU General Public License
-+ *   along with this program; if not, write to the Free Software
-+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
- 
- /**
-diff --git a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c
-index 20646c5ba1..33512788c2 100644
--- a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c
-+++ b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c
-@@ -1,24 +1,17 @@
- /*
- * eap_teap.c  contains the interfaces that are called from the main handler
-+ *   This program is is free software; you can redistribute it and/or modify
-+ *   it under the terms of the GNU General Public License as published by
-+ *   the Free Software Foundation; either version 2 of the License, or (at
-+ *   your option) any later version.
-  *
- * Version:     $Id$
-+ *   This program is distributed in the hope that it will be useful,
-+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ *   GNU General Public License for more details.
-  *
- * Copyright (C) 2022 Network RADIUS SARL <legal@networkradius.com>
- *
- * This software may not be redistributed in any form without the prior
- * written consent of Network RADIUS.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
-+ *   You should have received a copy of the GNU General Public License
-+ *   along with this program; if not, write to the Free Software
-+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
- 
- RCSID("$Id$")
-diff --git a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.h b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.h
-index 59f7835a26..69f4b1ebba 100644
--- a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.h
-+++ b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.h
-@@ -1,24 +1,17 @@
- /*
- * eap_teap.h
-+ *   This program is is free software; you can redistribute it and/or modify
-+ *   it under the terms of the GNU General Public License as published by
-+ *   the Free Software Foundation; either version 2 of the License, or (at
-+ *   your option) any later version.
-  *
- * Version:     $Id$
-+ *   This program is distributed in the hope that it will be useful,
-+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ *   GNU General Public License for more details.
-  *
- * Copyright (C) 2022 Network RADIUS SARL <legal@networkradius.com>
- *
- * This software may not be redistributed in any form without the prior
- * written consent of Network RADIUS.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
-+ *   You should have received a copy of the GNU General Public License
-+ *   along with this program; if not, write to the Free Software
-+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
- #ifndef _EAP_TEAP_H
- #define _EAP_TEAP_H
-diff --git a/src/modules/rlm_eap/types/rlm_eap_teap/rlm_eap_teap.c b/src/modules/rlm_eap/types/rlm_eap_teap/rlm_eap_teap.c
-index fcf9717257..13c709b287 100644
--- a/src/modules/rlm_eap/types/rlm_eap_teap/rlm_eap_teap.c
-+++ b/src/modules/rlm_eap/types/rlm_eap_teap/rlm_eap_teap.c
-@@ -1,24 +1,17 @@
- /*
- * rlm_eap_teap.c  contains the interfaces that are called from eap
-+ *   This program is is free software; you can redistribute it and/or modify
-+ *   it under the terms of the GNU General Public License as published by
-+ *   the Free Software Foundation; either version 2 of the License, or (at
-+ *   your option) any later version.
-  *
- * Version:     $Id$
-+ *   This program is distributed in the hope that it will be useful,
-+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ *   GNU General Public License for more details.
-  *
- * Copyright (C) 2022 Network RADIUS SARL <legal@networkradius.com>
- *
- * This software may not be redistributed in any form without the prior
- * written consent of Network RADIUS.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
-+ *   You should have received a copy of the GNU General Public License
-+ *   along with this program; if not, write to the Free Software
-+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
- 
- RCSID("$Id$")
-- 
-2.43.0
diff --git a/meta-networking/recipes-connectivity/freeradius/files/0019-update-license-2.patch b/meta-networking/recipes-connectivity/freeradius/files/0019-update-license-2.patch
deleted file mode 100644
index 4fa3ecd265..0000000000
--- a/meta-networking/recipes-connectivity/freeradius/files/0019-update-license-2.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From a46e81a7764b57983ce6724524f745a06222dc0a Mon Sep 17 00:00:00 2001
-From: "Alan T. DeKok" <aland@freeradius.org>
-Date: Tue, 28 Oct 2025 11:33:44 -0400
-Subject: [PATCH] update license
-Upstream-Status: Backport
-[https://github.com/FreeRADIUS/freeradius-server/commit/a46e81a7764b57983ce6724524f745a06222dc0a]
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
- .../rlm_proxy_rate_limit.c                    | 25 ++++++++-----------
- 1 file changed, 11 insertions(+), 14 deletions(-)
-diff --git a/src/modules/rlm_proxy_rate_limit/rlm_proxy_rate_limit.c b/src/modules/rlm_proxy_rate_limit/rlm_proxy_rate_limit.c
-index 744b14a448..a855273784 100644
--- a/src/modules/rlm_proxy_rate_limit/rlm_proxy_rate_limit.c
-+++ b/src/modules/rlm_proxy_rate_limit/rlm_proxy_rate_limit.c
-@@ -1,20 +1,17 @@
- /*
- * Copyright (C) 2024 Network RADIUS SAS (legal@networkradius.com)
-+ *   This program is is free software; you can redistribute it and/or modify
-+ *   it under the terms of the GNU General Public License as published by
-+ *   the Free Software Foundation; either version 2 of the License, or (at
-+ *   your option) any later version.
-  *
- * This software may not be redistributed in any form without the prior
- * written consent of Network RADIUS.
-+ *   This program is distributed in the hope that it will be useful,
-+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ *   GNU General Public License for more details.
-  *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
-+ *   You should have received a copy of the GNU General Public License
-+ *   along with this program; if not, write to the Free Software
-+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
- 
- /**
-- 
-2.43.0
diff --git a/meta-networking/recipes-connectivity/freeradius/files/0020-update-license-3.patch b/meta-networking/recipes-connectivity/freeradius/files/0020-update-license-3.patch
deleted file mode 100644
index f77c585bda..0000000000
--- a/meta-networking/recipes-connectivity/freeradius/files/0020-update-license-3.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From d00440f3290871aef667f80e15f256c64f9b7cd6 Mon Sep 17 00:00:00 2001
-From: "Alan T. DeKok" <aland@freeradius.org>
-Date: Wed, 29 Oct 2025 09:45:17 -0400
-Subject: [PATCH] update license
-Upstream-Status: Backport
-[https://github.com/FreeRADIUS/freeradius-server/commit/d00440f3290871aef667f80e15f256c64f9b7cd6]
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
- .../types/rlm_eap_teap/eap_teap_crypto.c      | 30 +++++++------------
- .../types/rlm_eap_teap/eap_teap_crypto.h      | 30 +++++++------------
- 2 files changed, 22 insertions(+), 38 deletions(-)
-diff --git a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap_crypto.c b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap_crypto.c
-index 17f49f9dfc..aaa74837a9 100644
--- a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap_crypto.c
-+++ b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap_crypto.c
-@@ -1,26 +1,18 @@
- /*
- * teap-crypto.c  Cryptographic functions for EAP-TEAP.
-+ *   This program is is free software; you can redistribute it and/or modify
-+ *   it under the terms of the GNU General Public License as published by
-+ *   the Free Software Foundation; either version 2 of the License, or (at
-+ *   your option) any later version.
-  *
- * Version:     $Id$
-+ *   This program is distributed in the hope that it will be useful,
-+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ *   GNU General Public License for more details.
-  *
- * Copyright (C) 2022 Network RADIUS SARL <legal@networkradius.com>
- *
- * This software may not be redistributed in any form without the prior
- * written consent of Network RADIUS.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
-+ *   You should have received a copy of the GNU General Public License
-+ *   along with this program; if not, write to the Free Software
-+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
- RCSID("$Id$")
- USES_APPLE_DEPRECATED_API      /* OpenSSL API has been deprecated by Apple */
- 
-diff --git a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap_crypto.h b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap_crypto.h
-index b02f2b9083..f9403dcf93 100644
--- a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap_crypto.h
-+++ b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap_crypto.h
-@@ -1,26 +1,18 @@
- /*
- * eap_teap_crypto.h
-+ *   This program is is free software; you can redistribute it and/or modify
-+ *   it under the terms of the GNU General Public License as published by
-+ *   the Free Software Foundation; either version 2 of the License, or (at
-+ *   your option) any later version.
-  *
- * Version:     $Id$
-+ *   This program is distributed in the hope that it will be useful,
-+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ *   GNU General Public License for more details.
-  *
- * Copyright (C) 2022 Network RADIUS SARL <legal@networkradius.com>
- *
- * This software may not be redistributed in any form without the prior
- * written consent of Network RADIUS.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
-+ *   You should have received a copy of the GNU General Public License
-+ *   along with this program; if not, write to the Free Software
-+ *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
-  */
-
- #ifndef _EAP_TEAP_CRYPTO_H
- #define _EAP_TEAP_CRYPTO_H
- 
-- 
-2.43.0
diff --git a/meta-networking/recipes-connectivity/freeradius/freeradius_3.2.8.bb b/meta-networking/recipes-connectivity/freeradius/freeradius_3.2.10.bb
index 9b05968638..eef0e8f519 100644
--- a/meta-networking/recipes-connectivity/freeradius/freeradius_3.2.8.bb
+++ b/meta-networking/recipes-connectivity/freeradius/freeradius_3.2.10.bb
@@ -15,7 +15,9 @@ DEPENDS = "openssl-native openssl libidn libtool libpcap libtalloc"
 PATCHTOOL = "git"
-SRC_URI = "git://github.com/FreeRADIUS/freeradius-server.git;branch=v3.2.x;lfs=0;;protocol=https \
+FREERADIUS_TAG = "release_${@d.getVar('PV').replace('.', '_')}"
+SRC_URI = "git://github.com/FreeRADIUS/freeradius-server.git;branch=v3.2.x;tag=${FREERADIUS_TAG};lfs=0;protocol=https \
    file://freeradius \
    file://volatiles.58_radiusd \
    file://radiusd.service \
@@ -29,7 +31,6 @@ SRC_URI = "git://github.com/FreeRADIUS/freeradius-server.git;branch=v3.2.x;lfs=0
    file://0007-rlm_python-add-PY_INC_DIR-in-search-dir.patch \
    file://0008-libtool-do-not-use-jlibtool.patch \
    file://0009-Fix-quoting-for-BUILD_WITH.patch \
-    file://0010-fix-error-for-expansion-of-macro-in-thread.h.patch \
    file://0011-rlm_mschap-Use-includedir-instead-of-hardcoding-usr-.patch \
    file://0012-raddb-certs-Makefile-fix-the-existed-certificate-err.patch \
    file://0013-raddb-certs-Makefile-fix-the-occasional-verification.patch \
@@ -37,14 +38,11 @@ SRC_URI = "git://github.com/FreeRADIUS/freeradius-server.git;branch=v3.2.x;lfs=0
    file://0015-bootstrap-check-commands-of-openssl-exist.patch \
    file://0016-version.c-don-t-print-build-flags.patch \
    file://0017-Add-acinclude.m4-to-include-required-macros.patch \
-    file://0018-update-license-1.patch \
-    file://0019-update-license-2.patch \
-    file://0020-update-license-3.patch \
 "
 raddbdir = "${sysconfdir}/${MLPREFIX}raddb"
-SRCREV = "032be31bb52646171099617928ec1703335bcf73"
+SRCREV = "9071ea041b9172e52eabbba91619afaf3a238795"
 UPSTREAM_CHECK_GITTAGREGEX = "release_(?P<pver>\d+(\_\d+)+)"
@@ -53,6 +51,8 @@ CVE_STATUS[CVE-2011-4966] = "fixed-version: The CPE in the NVD database doesn't
 PARALLEL_MAKE = ""
+# autoconf 2.73+Clang does not detect it correctly so help out
+CFLAGS += "-DTLS_STORAGE_CLASS=__thread"
 LDFLAGS:append:powerpc = " -latomic"
 LDFLAGS:append:mipsarch = " -latomic"
@@ -114,6 +114,7 @@ PACKAGECONFIG[openssl] = "--with-openssl, --without-openssl"
 PACKAGECONFIG[rlm-eap-fast] = "--with-rlm_eap_fast, --without-rlm_eap_fast"
 PACKAGECONFIG[rlm-eap-pwd] = "--with-rlm_eap_pwd, --without-rlm_eap_pwd"
 PACKAGECONFIG[kafka] = "--with-rlm_kafka, --without-rlm_kafka, librdkafka"
+PACKAGECONFIG[legacy-openssl] = ",--enable-fips-workaround,,openssl-ossl-module-legacy"
 inherit useradd autotools-brokensep update-rc.d systemd multilib_script multilib_header
diff --git a/meta-networking/recipes-connectivity/mbedtls/mbedtls_2.28.10.bb b/meta-networking/recipes-connectivity/mbedtls/mbedtls_2.28.10.bb
deleted file mode 100644
index b126aee7db..0000000000
--- a/meta-networking/recipes-connectivity/mbedtls/mbedtls_2.28.10.bb
+++ /dev/null
@@ -1,79 +0,0 @@
-SUMMARY = "Lightweight crypto and SSL/TLS library"
-DESCRIPTION = "mbedtls is a lean open source crypto library          \
-for providing SSL and TLS support in your programs. It offers        \
-an intuitive API and documented header files, so you can actually    \
-understand what the code does. It features:                          \
-                                                                     \
- - Symmetric algorithms, like AES, Blowfish, Triple-DES, DES, ARC4,  \
-   Camellia and XTEA                                                 \
- - Hash algorithms, like SHA-1, SHA-2, RIPEMD-160 and MD5            \
- - Entropy pool and random generators, like CTR-DRBG and HMAC-DRBG   \
- - Public key algorithms, like RSA, Elliptic Curves, Diffie-Hellman, \
-   ECDSA and ECDH                                                    \
- - SSL v3 and TLS 1.0, 1.1 and 1.2                                   \
- - Abstraction layers for ciphers, hashes, public key operations,    \
-   platform abstraction and threading                                \
-"
-HOMEPAGE = "https://tls.mbed.org/"
-LICENSE = "Apache-2.0 | GPL-2.0-or-later"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=379d5819937a6c2f1ef1630d341e026d"
-SECTION = "libs"
-SRCREV = "2fc8413bfcb51354c8e679141b17b3f1a5942561"
-SRC_URI = "git://github.com/Mbed-TLS/mbedtls.git;protocol=https;branch=archive/mbedtls-2.28;tag=${BPN} \
-           file://run-ptest \
-          "
-inherit cmake update-alternatives ptest
-PACKAGECONFIG ??= "shared-libs programs ${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)}"
-PACKAGECONFIG[shared-libs] = "-DUSE_SHARED_MBEDTLS_LIBRARY=ON,-DUSE_SHARED_MBEDTLS_LIBRARY=OFF"
-PACKAGECONFIG[programs] = "-DENABLE_PROGRAMS=ON,-DENABLE_PROGRAMS=OFF"
-PACKAGECONFIG[werror] = "-DMBEDTLS_FATAL_WARNINGS=ON,-DMBEDTLS_FATAL_WARNINGS=OFF"
-# Make X.509 and TLS calls use PSA
-# https://github.com/Mbed-TLS/mbedtls/blob/development/docs/use-psa-crypto.md
-PACKAGECONFIG[psa] = ""
-PACKAGECONFIG[tests] = "-DENABLE_TESTING=ON,-DENABLE_TESTING=OFF"
-EXTRA_OECMAKE = "-DLIB_INSTALL_DIR:STRING=${libdir}"
-# For now the only way to enable PSA is to explicitly pass a -D via CFLAGS
-CFLAGS:append = "${@bb.utils.contains('PACKAGECONFIG', 'psa', ' -DMBEDTLS_USE_PSA_CRYPTO', '', d)}"
-PROVIDES += "polarssl"
-RPROVIDES:${PN} = "polarssl"
-PACKAGES =+ "${PN}-programs"
-FILES:${PN}-programs = "${bindir}/"
-ALTERNATIVE:${PN}-programs = "${@bb.utils.contains('PACKAGECONFIG', 'programs', 'hello', '', d)}"
-ALTERNATIVE_LINK_NAME[hello] = "${bindir}/hello"
-BBCLASSEXTEND = "native nativesdk"
-CVE_PRODUCT = "mbed_tls"
-CVE_STATUS[CVE-2021-43666] = "backported-patch: Fix merged upstream https://github.com/Mbed-TLS/mbedtls/pull/5310"
-CVE_STATUS[CVE-2021-45451] = "backported-patch: Fix merged upstream https://github.com/Mbed-TLS/mbedtls/commit/9a4a9c66a48edfe9ece03c7e4a53310adf73a86c"
-# Strip host paths from autogenerated test files
-do_compile:append() {
-        sed -i 's+${S}/++g' ${B}/tests/*.c 2>/dev/null || :
-        sed -i 's+${B}/++g' ${B}/tests/*.c 2>/dev/null || :
-}
-# Export source files/headers needed by Arm Trusted Firmware
-sysroot_stage_all:append() {
-        sysroot_stage_dir "${S}/library" "${SYSROOT_DESTDIR}/usr/share/mbedtls-source/library"
-        sysroot_stage_dir "${S}/include" "${SYSROOT_DESTDIR}/usr/share/mbedtls-source/include"
-}
-do_install_ptest () {
-        install -d ${D}${PTEST_PATH}/tests
-        cp -f ${B}/tests/test_suite_* ${D}${PTEST_PATH}/tests/
-        find ${D}${PTEST_PATH}/tests/ -type f -name "*.c" -delete
-        cp -fR ${S}/tests/data_files ${D}${PTEST_PATH}/tests/
-}
diff --git a/meta-networking/recipes-connectivity/mbedtls/mbedtls_3.6.5.bb b/meta-networking/recipes-connectivity/mbedtls/mbedtls_3.6.6.bb
index e6dfe43092..23d5c0878f 100644
--- a/meta-networking/recipes-connectivity/mbedtls/mbedtls_3.6.5.bb
+++ b/meta-networking/recipes-connectivity/mbedtls/mbedtls_3.6.6.bb
@@ -15,7 +15,8 @@ understand what the code does. It features:                          \
   platform abstraction and threading                                \
 "
-HOMEPAGE = "https://tls.mbed.org/"
+HOMEPAGE = "https://www.trustedfirmware.org/projects/mbed-tls/"
+BUGTRACKER = "https://github.com/Mbed-TLS/mbedtls/issues"
 LICENSE = "Apache-2.0 | GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=379d5819937a6c2f1ef1630d341e026d"
@@ -26,7 +27,7 @@ SRC_URI = "gitsm://github.com/Mbed-TLS/mbedtls.git;protocol=https;branch=mbedtls
           file://run-ptest \
           "
-SRCREV = "e185d7fd85499c8ce5ca2a54f5cf8fe7dbe3f8df"
+SRCREV = "0bebf8b8c7f07abe3571ded48a11aa907a1ffb20"
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>\d+(\.\d+)+)"
diff --git a/meta-networking/recipes-connectivity/miniupnpd/files/0001-Add-OpenEmbedded-cross-compile-case.patch b/meta-networking/recipes-connectivity/miniupnpd/files/0001-Add-OpenEmbedded-cross-compile-case.patch
deleted file mode 100644
index e33d8eac1d..0000000000
--- a/meta-networking/recipes-connectivity/miniupnpd/files/0001-Add-OpenEmbedded-cross-compile-case.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 54698856e5602bbd9d61e855814c854a013b4840 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Sat, 22 Dec 2018 18:47:45 -0800
-Subject: [PATCH] Add OpenEmbedded cross compile case
-Upstream-Status: Submitted [https://github.com/miniupnp/miniupnp/pull/410]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
- genconfig.sh | 11 +++++++++++
- 1 file changed, 11 insertions(+)
--- a/genconfig.sh
-+++ b/genconfig.sh
-@@ -103,6 +103,12 @@ if [ -f ../shared/tomato_version ]; then
-        OS_VERSION="Tomato $TOMATO_VER"
- fi
- 
-+# OpenEmbedded special case
-+if [ -f ./os.openembedded ]; then
-+       OS_NAME=OpenEmbedded
-+       OS_VERSION=$(cat ./os.openembedded)
-+fi
-+
- ${RM} ${CONFIGFILE}
- 
- echo "/* MiniUPnP Project" >> ${CONFIGFILE}
-@@ -346,6 +352,11 @@ case $OS_NAME in
-                echo "#define USE_IFACEWATCHER 1" >> ${CONFIGFILE}
-                FW=iptables
-                ;;
-+       OpenEmbedded)
-+               OS_URL=http://www.openembedded.org/
-+               echo "#define USE_IFACEWATCHER 1" >> ${CONFIGFILE}
-+               FW=iptables
-+               ;;
-        AstLinux)
-                OS_URL=http://www.astlinux.org/
-                echo "#define USE_IFACEWATCHER 1" >> ${CONFIGFILE}
diff --git a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.1.20191006.bb b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.10.bb
index b7ba37f290..91f86659f7 100644
--- a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.1.20191006.bb
+++ b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.10.bb
@@ -5,7 +5,7 @@ the network."
 SECTION = "networking"
 LICENSE = "BSD-3-Clause"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=a1ed15843ce66639bcf9f109cf247870"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=9526418307cb153aee96a4f9b33bd1c7"
 inherit gettext pkgconfig systemd
@@ -13,9 +13,8 @@ DEPENDS += "iptables net-tools util-linux libmnl libnetfilter-conntrack openssl"
 SRC_URI = "http://miniupnp.tuxfamily.org/files/download.php?file=${BP}.tar.gz;downloadfilename=${BP}.tar.gz \
           file://miniupnpd.service \
-           file://0001-Add-OpenEmbedded-cross-compile-case.patch \
           "
-SRC_URI[sha256sum] = "218fad7af31f3c22fb4c9db28a55a2a8b5067d41f5b38f52008a057a00d2206d"
+SRC_URI[sha256sum] = "f9c34ed3632fb60cd248dd5897bd98479a103a75688b056ca2f069e68ab32987"
 UPSTREAM_CHECK_URI = "https://miniupnp.tuxfamily.org/files/"
 UPSTREAM_CHECK_REGEX = "${BPN}-(?P<pver>\d+(\.\d+)+)\.tar"
@@ -27,6 +26,7 @@ EXTRA_OEMAKE = "-f Makefile.linux"
 do_configure() {
    echo "${@d.getVar('DISTRO_VERSION')}" > ${S}/os.openembedded
+    ./configure
    CONFIG_OPTIONS="--leasefile --vendorcfg ${PACKAGECONFIG_CONFARGS}" oe_runmake --always-make config.h
 }
diff --git a/meta-networking/recipes-connectivity/mosquitto/mosquitto_2.1.2.bb b/meta-networking/recipes-connectivity/mosquitto/mosquitto_2.1.2.bb
index 6a6e554453..8bb6c9009d 100644
--- a/meta-networking/recipes-connectivity/mosquitto/mosquitto_2.1.2.bb
+++ b/meta-networking/recipes-connectivity/mosquitto/mosquitto_2.1.2.bb
@@ -57,6 +57,8 @@ do_install:append() {
        -e 's,@LOCALSTATEDIR@,${localstatedir},g' \
        -e 's,@SYSCONFDIR@,${sysconfdir},g' \
        ${D}${sysconfdir}/init.d/mosquitto
+    install -m 0644 ${S}/mosquitto.conf ${D}${sysconfdir}/mosquitto/mosquitto.conf
 }
 PACKAGE_BEFORE_PN = "libmosquitto1 libmosquittopp1 ${PN}-clients ${PN}-examples"
diff --git a/meta-networking/recipes-connectivity/networkmanager/networkmanager_1.56.0.bb b/meta-networking/recipes-connectivity/networkmanager/networkmanager_1.56.0.bb
index de163fe00e..138d7118eb 100644
--- a/meta-networking/recipes-connectivity/networkmanager/networkmanager_1.56.0.bb
+++ b/meta-networking/recipes-connectivity/networkmanager/networkmanager_1.56.0.bb
@@ -48,7 +48,6 @@ SRC_URI:append:libc-musl = "${@bb.utils.contains('DISTRO_FEATURES', 'ld-is-lld',
 SRCREV = "56b51b98fbb8627c4c09a483702e18fd8aee7ce1"
 # ['auto', 'symlink', 'file', 'netconfig', 'resolvconf']
 NETWORKMANAGER_DNS_RC_MANAGER_DEFAULT ??= "auto"
@@ -72,25 +71,12 @@ EXTRA_OEMESON = "\
    -Dman=false \
 "
-# stolen from https://github.com/void-linux/void-packages/blob/master/srcpkgs/NetworkManager/template
-# avoids:
-# | ../NetworkManager-1.16.0/libnm-core/nm-json.c:106:50: error: 'RTLD_DEEPBIND' undeclared (first use in this function); did you mean 'RTLD_DEFAULT'?
-CFLAGS:append:libc-musl = " \
-    -DRTLD_DEEPBIND=0 \
-"
-# networkmanager-1.52.0/src/nmcli/agent.c:88:29: error: incompatible function pointer types assigning to 'rl_hook_func_t *' (aka 'int (*)(void)') from 'int (const char *, int)' [-Wincompatible-function-pointer-types]
-#   88 |             rl_startup_hook = set_deftext;
-#      |                             ^ ~~~~~~~~~~~
-CFLAGS:append:toolchain-clang = " -Wno-error=incompatible-function-pointer-types"
 PACKAGECONFIG ??= "readline nss ifupdown dnsmasq nmcli \
    ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', bb.utils.contains('DISTRO_FEATURES', 'x11', 'consolekit', '', d), d)} \
    ${@bb.utils.contains('DISTRO_FEATURES', 'bluetooth', 'bluez5', '', d)} \
    ${@bb.utils.filter('DISTRO_FEATURES', 'wifi polkit ppp', d)} \
    ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux audit', '', d)} \
-    ${@bb.utils.contains('DISTRO_FEATURES_BACKFILL_CONSIDERED', 'gobject-introspection-data', '', 'vala', d)} \
+    ${@bb.utils.contains('DISTRO_FEATURES', 'gobject-introspection-data', 'vala', '', d)} \
 "
 inherit ${@bb.utils.contains('PACKAGECONFIG', 'vala', 'vala', '', d)}
@@ -325,4 +311,9 @@ do_install:append() {
    if ${@bb.utils.contains('PACKAGECONFIG','dhcpcd','true','false',d)}; then
        install -Dm 0644 ${UNPACKDIR}/enable-dhcpcd.conf ${D}${nonarch_libdir}/NetworkManager/conf.d/enable-dhcpcd.conf
    fi
+    # Don't ship initrd specific services into rootfs to avoid the conflict with the main services
+    rm -f ${D}${systemd_system_unitdir}/NetworkManager-config-initrd.service
+    rm -f ${D}${systemd_system_unitdir}/NetworkManager-initrd.service
+    rm -f ${D}${systemd_system_unitdir}/NetworkManager-wait-online-initrd.service
 }
diff --git a/meta-networking/recipes-connectivity/samba/samba/0001-Don-t-check-xsltproc-manpages.patch b/meta-networking/recipes-connectivity/samba/samba/0001-Don-t-check-xsltproc-manpages.patch
index a498348c20..afa1154827 100644
--- a/meta-networking/recipes-connectivity/samba/samba/0001-Don-t-check-xsltproc-manpages.patch
+++ b/meta-networking/recipes-connectivity/samba/samba/0001-Don-t-check-xsltproc-manpages.patch
@@ -9,25 +9,14 @@ Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
 Rebase to 4.14.4
 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+Rebase to 4.23.5
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 ---
- lib/ldb/wscript    | 2 +-
 lib/talloc/wscript | 2 +-
 lib/tdb/wscript    | 2 +-
- 3 files changed, 3 insertions(+), 3 deletions(-)
+ 2 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/lib/ldb/wscript b/lib/ldb/wscript
-index ed5d45f..de3c648 100644
--- a/lib/ldb/wscript
-+++ b/lib/ldb/wscript
-@@ -144,7 +144,7 @@ def configure(conf):
-         conf.DEFINE('EXPECTED_SYSTEM_LDB_VERSION_RELEASE', int(v[2]))
- 
-     if conf.env.standalone_ldb:
-        conf.CHECK_XSLTPROC_MANPAGES()
-+        #conf.CHECK_XSLTPROC_MANPAGES()
- 
-         # we need this for the ldap backend
-         if conf.CHECK_FUNCS_IN('ber_flush ldap_open ldap_initialize', 'lber ldap', headers='lber.h ldap.h'):
 diff --git a/lib/talloc/wscript b/lib/talloc/wscript
 index 075f1ec..9bd9f73 100644
 --- a/lib/talloc/wscript
diff --git a/meta-networking/recipes-connectivity/samba/samba/0003-Add-config-option-without-valgrind.patch b/meta-networking/recipes-connectivity/samba/samba/0003-Add-config-option-without-valgrind.patch
index 2c9d29c9fe..70e7f28cc7 100644
--- a/meta-networking/recipes-connectivity/samba/samba/0003-Add-config-option-without-valgrind.patch
+++ b/meta-networking/recipes-connectivity/samba/samba/0003-Add-config-option-without-valgrind.patch
@@ -37,10 +37,10 @@ diff --git a/wscript b/wscript
 index 95ddd9e..6d9577a 100644
 --- a/wscript
 +++ b/wscript
-@@ -123,6 +123,13 @@ def options(opt):
+@@ -131,6 +131,13 @@
                   help=('Disable kernely keyring support for credential storage'),
                   action='store_false', dest='enable_keyring')
- 
 +    opt.add_option('--with-valgrind',
 +                   help=("Enable use of valgrind"),
 +                   action="store_true", dest='enable_valgrind')
@@ -48,9 +48,6 @@ index 95ddd9e..6d9577a 100644
 +                   help=("Disable use of valgrind"),
 +                   action="store_false", dest='enable_valgrind', default=False)
 +
-     gr = opt.option_group('developer options')
+     opt.samba_add_onoff_option('ldap')
- 
-     opt.load('python') # options for disabling pyc or pyo compilation
-- 
-2.25.1
+     opt.option_group('developer options')
diff --git a/meta-networking/recipes-connectivity/samba/samba/0003-Replace-memset_s-with-memset_explicit.patch b/meta-networking/recipes-connectivity/samba/samba/0003-Replace-memset_s-with-memset_explicit.patch
index a96cd062cd..74ea1a7ab4 100644
--- a/meta-networking/recipes-connectivity/samba/samba/0003-Replace-memset_s-with-memset_explicit.patch
+++ b/meta-networking/recipes-connectivity/samba/samba/0003-Replace-memset_s-with-memset_explicit.patch
@@ -15,7 +15,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
 --- a/lib/replace/replace.h
 +++ b/lib/replace/replace.h
-@@ -815,50 +815,50 @@ typedef unsigned long long ptrdiff_t ;
+@@ -811,50 +811,50 @@ typedef unsigned long long ptrdiff_t ;
 /**
  * Zero a structure.
  */
@@ -74,7 +74,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
 
 /**
  * Explicitly zero data in string. This is guaranteed to be not optimized
-@@ -867,7 +867,7 @@ typedef unsigned long long ptrdiff_t ;
+@@ -863,7 +863,7 @@ typedef unsigned long long ptrdiff_t ;
 #define BURN_STR(x)    do { \
                                if ((x) != NULL) { \
                                        size_t s = strlen(x); \
@@ -193,116 +193,3 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
 
        talloc_free(mem_ctx);
 }
--- a/lib/cmdline/cmdline.c
-+++ b/lib/cmdline/cmdline.c
-@@ -358,7 +358,7 @@ bool samba_cmdline_burn(int argc, char *
-                                p += ulen;
-                        }
- 
-                       memset_s(p, strlen(p), '\0', strlen(p));
-+                       memset_explicit(p, '\0', strlen(p));
-                        burnt = true;
-                }
-        }
--- a/lib/util/data_blob.c
-+++ b/lib/util/data_blob.c
-@@ -1,19 +1,19 @@
-/* 
-+/*
-    Unix SMB/CIFS implementation.
-    Easy management of byte-length data
-    Copyright (C) Andrew Tridgell 2001
-    Copyright (C) Andrew Bartlett 2001
-   
-+
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 3 of the License, or
-    (at your option) any later version.
-   
-+
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-   
-+
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-@@ -67,7 +67,7 @@ _PUBLIC_ DATA_BLOB data_blob_talloc_name
- }
- 
- /**
- construct a zero data blob, using supplied TALLOC_CTX. 
-+ construct a zero data blob, using supplied TALLOC_CTX.
-  use this sparingly as it initialises data - better to initialise
-  yourself if you want specific data in the blob
- **/
-@@ -95,7 +95,7 @@ clear a DATA_BLOB's contents
- _PUBLIC_ void data_blob_clear(DATA_BLOB *d)
- {
-        if (d->data) {
-               memset_s(d->data, d->length, 0, d->length);
-+               memset_explicit(d->data, 0, d->length);
-        }
- }
- 
-@@ -219,7 +219,7 @@ _PUBLIC_ DATA_BLOB data_blob_string_cons
- }
- 
- /**
- * Create a new data blob from const data 
-+ * Create a new data blob from const data
-  */
- 
- _PUBLIC_ DATA_BLOB data_blob_const(const void *p, size_t length)
-@@ -266,7 +266,7 @@ _PUBLIC_ bool data_blob_append(TALLOC_CT
-        if ((const uint8_t *)p + length < (const uint8_t *)p) {
-                return false;
-        }
-       
-+
-        if (!data_blob_realloc(mem_ctx, blob, new_len)) {
-                return false;
-        }
--- a/lib/util/talloc_keep_secret.c
-+++ b/lib/util/talloc_keep_secret.c
-@@ -22,27 +22,13 @@
- 
- static int talloc_keep_secret_destructor(void *ptr)
- {
-       int ret;
-        size_t size = talloc_get_size(ptr);
- 
-        if (unlikely(size == 0)) {
-                return 0;
-        }
- 
-       ret = memset_s(ptr, size, 0, size);
-       if (unlikely(ret != 0)) {
-               char *msg = NULL;
-               int ret2;
-               ret2 = asprintf(&msg,
-                               "talloc_keep_secret_destructor: memset_s() failed: %s",
-                               strerror(ret));
-               if (ret2 != -1) {
-                       smb_panic(msg);
-               } else {
-                       smb_panic("talloc_keep_secret_destructor: memset_s() failed");
-               }
-       }
-
-+       memset_explicit(ptr, 0, size);
-        return 0;
- }
- 
--- a/librpc/ndr/util.c
-+++ b/librpc/ndr/util.c
-@@ -32,5 +32,5 @@ _PUBLIC_ void ndr_print_sockaddr_storage
- 
- _PUBLIC_ void ndr_zero_memory(void *ptr, size_t len)
- {
-       memset_s(ptr, len, 0, len);
-+       memset_explicit(ptr, 0, len);
- }
diff --git a/meta-networking/recipes-connectivity/samba/samba/0004-Add-options-to-configure-the-use-of-libbsd.patch b/meta-networking/recipes-connectivity/samba/samba/0004-Add-options-to-configure-the-use-of-libbsd.patch
index c72bd133ee..88acfeef07 100644
--- a/meta-networking/recipes-connectivity/samba/samba/0004-Add-options-to-configure-the-use-of-libbsd.patch
+++ b/meta-networking/recipes-connectivity/samba/samba/0004-Add-options-to-configure-the-use-of-libbsd.patch
@@ -19,7 +19,7 @@ diff --git a/buildtools/wafsamba/wscript b/buildtools/wafsamba/wscript
 index 30cb366..d167551 100644
 --- a/buildtools/wafsamba/wscript
 +++ b/buildtools/wafsamba/wscript
-@@ -145,6 +145,13 @@ Currently the only tested value is 'smbtorture,smbd/smbd' for Samba'''),
+@@ -155,6 +155,13 @@ Currently the only tested value is 'smbtorture,smbd/smbd' for Samba'''),
                    help=("Disable use of gettext"),
                    action="store_true", dest='disable_gettext', default=False)
 
@@ -37,40 +37,60 @@ diff --git a/lib/replace/wscript b/lib/replace/wscript
 index 9dd9b48..a22ae59 100644
 --- a/lib/replace/wscript
 +++ b/lib/replace/wscript
-@@ -444,20 +444,21 @@ def configure(conf):
+@@ -444,31 +444,32 @@
- 
     strlcpy_in_bsd = False
- 
 -    # libbsd on some platforms provides strlcpy and strlcat
 -    if not conf.CHECK_FUNCS('strlcpy strlcat'):
 -        if conf.CHECK_FUNCS_IN('strlcpy strlcat', 'bsd', headers='bsd/string.h',
 -                               checklibc=True):
 -            strlcpy_in_bsd = True
-    if not conf.CHECK_FUNCS('getpeereid'):
+-    elif conf.env.enable_fuzzing:
-        conf.CHECK_FUNCS_IN('getpeereid', 'bsd', headers='sys/types.h bsd/unistd.h')
+-        # Just to complicate it more, some versions of Honggfuzz have
-    if not conf.CHECK_FUNCS_IN('setproctitle', 'setproctitle', headers='setproctitle.h'):
+-        # got strlcpy and strlcat in libc, but not in <string.h>
-        conf.CHECK_FUNCS_IN('setproctitle', 'bsd', headers='sys/types.h bsd/unistd.h')
+-        # (unless it is there coincidentally, on a BSD). Therefore we
-    if not conf.CHECK_FUNCS('setproctitle_init'):
+-        # can't use CHECK_FUNCS alone to decide whether to add the
-        conf.CHECK_FUNCS_IN('setproctitle_init', 'bsd', headers='sys/types.h bsd/unistd.h')
+-        # headers to replace.h.
-
+-        #
-    if not conf.CHECK_FUNCS('closefrom'):
+-        # As this is only known to happen on a fuzzing compiler, we'll
-        conf.CHECK_FUNCS_IN('closefrom', 'bsd', headers='bsd/unistd.h')
+-        # skip the check when not in fuzzing mode.
+-        conf.CHECK_HEADERS('bsd/string.h')
 +    if Options.options.enable_libbsd:
 +        # libbsd on some platforms provides strlcpy and strlcat
 +        if not conf.CHECK_FUNCS('strlcpy strlcat'):
 +            if conf.CHECK_FUNCS_IN('strlcpy strlcat', 'bsd', headers='bsd/string.h',
 +                                   checklibc=True):
 +                strlcpy_in_bsd = True
+        elif conf.env.enable_fuzzing:
+            # Just to complicate it more, some versions of Honggfuzz have
+            # got strlcpy and strlcat in libc, but not in <string.h>
+            # (unless it is there coincidentally, on a BSD). Therefore we
+            # can't use CHECK_FUNCS alone to decide whether to add the
+            # headers to replace.h.
+            #
+            # As this is only known to happen on a fuzzing compiler, we'll
+            # skip the check when not in fuzzing mode.
+            conf.CHECK_HEADERS('bsd/string.h')
+-    if not conf.CHECK_FUNCS('getpeereid'):
+-        conf.CHECK_FUNCS_IN('getpeereid', 'bsd', headers='sys/types.h bsd/unistd.h')
+-    if not conf.CHECK_FUNCS_IN('setproctitle', 'setproctitle', headers='setproctitle.h'):
+-        conf.CHECK_FUNCS_IN('setproctitle', 'bsd', headers='sys/types.h bsd/unistd.h')
+-    if not conf.CHECK_FUNCS('setproctitle_init'):
+-        conf.CHECK_FUNCS_IN('setproctitle_init', 'bsd', headers='sys/types.h bsd/unistd.h')
 +        if not conf.CHECK_FUNCS('getpeereid'):
 +            conf.CHECK_FUNCS_IN('getpeereid', 'bsd', headers='sys/types.h bsd/unistd.h')
 +        if not conf.CHECK_FUNCS_IN('setproctitle', 'setproctitle', headers='setproctitle.h'):
 +            conf.CHECK_FUNCS_IN('setproctitle', 'bsd', headers='sys/types.h bsd/unistd.h')
 +        if not conf.CHECK_FUNCS('setproctitle_init'):
 +            conf.CHECK_FUNCS_IN('setproctitle_init', 'bsd', headers='sys/types.h bsd/unistd.h')
-+
+-    if not conf.CHECK_FUNCS('closefrom'):
+-        conf.CHECK_FUNCS_IN('closefrom', 'bsd', headers='bsd/unistd.h')
 +        if not conf.CHECK_FUNCS('closefrom'):
 +            conf.CHECK_FUNCS_IN('closefrom', 'bsd', headers='bsd/unistd.h')
- 
     conf.CHECK_CODE('''
                 struct ucred cred;
 diff --git a/lib/texpect/wscript b/lib/texpect/wscript
diff --git a/meta-networking/recipes-connectivity/samba/samba/0004-lib-replace-Remove-memset_s.patch b/meta-networking/recipes-connectivity/samba/samba/0004-lib-replace-Remove-memset_s.patch
index 409c36da7c..6e01ae35e7 100644
--- a/meta-networking/recipes-connectivity/samba/samba/0004-lib-replace-Remove-memset_s.patch
+++ b/meta-networking/recipes-connectivity/samba/samba/0004-lib-replace-Remove-memset_s.patch
@@ -24,7 +24,7 @@ diff --git a/lib/replace/README b/lib/replace/README
 index bb9d008..d8431e7 100644
 --- a/lib/replace/README
 +++ b/lib/replace/README
-@@ -74,7 +74,6 @@ realpath
+@@ -73,7 +73,6 @@ realpath
 poll
 setproctitle
 memset_explicit
@@ -36,219 +36,10 @@ diff --git a/lib/replace/replace.c b/lib/replace/replace.c
 index 8615899..a419837 100644
 --- a/lib/replace/replace.c
 +++ b/lib/replace/replace.c
-@@ -1,4 +1,4 @@
+@@ -965,37 +965,6 @@
-/* 
-+/*
-    Unix SMB/CIFS implementation.
-    replacement routines for broken systems
-    Copyright (C) Andrew Tridgell 1992-1998
-@@ -8,7 +8,7 @@
-      ** NOTE! The following LGPL license applies to the replace
-      ** library. This does NOT imply that all of Samba is released
-      ** under the LGPL
-   
-+
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Lesser General Public
-    License as published by the Free Software Foundation; either
-@@ -91,7 +91,7 @@ size_t rep_strlcpy(char *d, const char *s, size_t bufsize)
- #endif
- 
- #ifndef HAVE_STRLCAT
-/* like strncat but does not 0 fill the buffer and always null 
-+/* like strncat but does not 0 fill the buffer and always null
-    terminates. bufsize is the length of the buffer, which should
-    be one more than the maximum resulting string length */
- size_t rep_strlcat(char *d, const char *s, size_t bufsize)
-@@ -116,7 +116,7 @@ size_t rep_strlcat(char *d, const char *s, size_t bufsize)
- 
- #ifndef HAVE_MKTIME
- /*******************************************************************
-a mktime() replacement for those who don't have it - contributed by 
-+a mktime() replacement for those who don't have it - contributed by
- C.A. Lademann <cal@zls.com>
- Corrections by richard.kettlewell@kewill.com
- ********************************************************************/
-@@ -137,7 +137,7 @@ time_t rep_mktime(struct tm *t)
-     return((time_t)-1);
- 
-   n = t->tm_year + 1900 - 1;
-  epoch = (t->tm_year - 70) * YEAR + 
-+  epoch = (t->tm_year - 70) * YEAR +
-     ((n / 4 - n / 100 + n / 400) - (1969 / 4 - 1969 / 100 + 1969 / 400)) * DAY;
- 
-   y = t->tm_year + 1900;
-@@ -147,7 +147,7 @@ time_t rep_mktime(struct tm *t)
-     epoch += mon [m] * DAY;
-     if(m == 1 && y % 4 == 0 && (y % 100 != 0 || y % 400 == 0))
-       epoch += DAY;
-    
-+
-     if(++m > 11) {
-       m = 0;
-       y++;
-@@ -156,7 +156,7 @@ time_t rep_mktime(struct tm *t)
- 
-   epoch += (t->tm_mday - 1) * DAY;
-   epoch += t->tm_hour * HOUR + t->tm_min * MINUTE + t->tm_sec;
-  
-+
-   if((u = localtime(&epoch)) != NULL) {
-     t->tm_sec = u->tm_sec;
-     t->tm_min = u->tm_min;
-@@ -176,7 +176,7 @@ time_t rep_mktime(struct tm *t)
- 
- #ifndef HAVE_INITGROUPS
- /****************************************************************************
- some systems don't have an initgroups call 
-+ some systems don't have an initgroups call
- ****************************************************************************/
- int rep_initgroups(char *name, gid_t id)
- {
-@@ -194,7 +194,7 @@ int rep_initgroups(char *name, gid_t id)
-        int    i,j;
-        struct group *g;
-        char   *gr;
-       
-+
-        if((grouplst = malloc(sizeof(gid_t) * max_gr)) == NULL) {
-                errno = ENOMEM;
-                return -1;
-@@ -250,9 +250,9 @@ void *rep_memmove(void *dest,const void *src,int size)
- 
-        if (d < s) {
-                /* we can forward copy */
-               if (s-d >= sizeof(int) && 
-                   !(s%sizeof(int)) && 
-                   !(d%sizeof(int)) && 
-+               if (s-d >= sizeof(int) &&
-+                   !(s%sizeof(int)) &&
-+                   !(d%sizeof(int)) &&
-                    !(size%sizeof(int))) {
-                        /* do it all as words */
-                        int *idest = (int *)dest;
-@@ -267,9 +267,9 @@ void *rep_memmove(void *dest,const void *src,int size)
-                }
-        } else {
-                /* must backward copy */
-               if (d-s >= sizeof(int) && 
-                   !(s%sizeof(int)) && 
-                   !(d%sizeof(int)) && 
-+               if (d-s >= sizeof(int) &&
-+                   !(s%sizeof(int)) &&
-+                   !(d%sizeof(int)) &&
-                    !(size%sizeof(int))) {
-                        /* do it all as words */
-                        int *idest = (int *)dest;
-@@ -281,7 +281,7 @@ void *rep_memmove(void *dest,const void *src,int size)
-                        char *cdest = (char *)dest;
-                        char *csrc = (char *)src;
-                        for (i=size-1;i>=0;i--) cdest[i] = csrc[i];
-               }      
-+               }
-        }
-        return(dest);
- }
-@@ -334,16 +334,16 @@ void rep_vsyslog (int facility_priority, const char *format, va_list arglist)
-  size_t rep_strnlen(const char *s, size_t max)
- {
-         size_t len;
-  
-+
-         for (len = 0; len < max; len++) {
-                 if (s[len] == '\0') {
-                         break;
-                 }
-         }
-        return len;  
-+        return len;
 }
 #endif
-  
-+
- #ifndef HAVE_STRNDUP
- /**
-  Some platforms don't have strndup.
-@@ -351,7 +351,7 @@ void rep_vsyslog (int facility_priority, const char *format, va_list arglist)
- char *rep_strndup(const char *s, size_t n)
- {
-        char *ret;
-       
-+
-        n = strnlen(s, n);
-        ret = malloc(n+1);
-        if (!ret)
-@@ -407,7 +407,7 @@ int rep_chroot(const char *dname)
- 
- /*****************************************************************
-  Possibly replace mkstemp if it is broken.
-*****************************************************************/  
-+*****************************************************************/
- 
- #ifndef HAVE_SECURE_MKSTEMP
- int rep_mkstemp(char *template)
-@@ -425,7 +425,7 @@ int rep_mkstemp(char *template)
- char *rep_mkdtemp(char *template)
- {
-        char *dname;
-       
-+
-        if ((dname = mktemp(template))) {
-                if (mkdir(dname, 0700) >= 0) {
-                        return dname;
-@@ -532,7 +532,7 @@ long long int rep_strtoll(const char *str, char **endptr, int base)
- {
- #ifdef HAVE_STRTOQ
-        return strtoq(str, endptr, base);
-#elif defined(HAVE___STRTOLL) 
-+#elif defined(HAVE___STRTOLL)
-        return __strtoll(str, endptr, base);
- #elif SIZEOF_LONG == SIZEOF_LONG_LONG
-        return (long long int) strtol(str, endptr, base);
-@@ -568,7 +568,7 @@ unsigned long long int rep_strtoull(const char *str, char **endptr, int base)
- {
- #ifdef HAVE_STRTOUQ
-        return strtouq(str, endptr, base);
-#elif defined(HAVE___STRTOULL) 
-+#elif defined(HAVE___STRTOULL)
-        return __strtoull(str, endptr, base);
- #elif SIZEOF_LONG == SIZEOF_LONG_LONG
-        return (unsigned long long int) strtoul(str, endptr, base);
-@@ -599,7 +599,7 @@ unsigned long long int rep_strtoull(const char *str, char **endptr, int base)
- #endif /* HAVE_STRTOULL */
- 
- #ifndef HAVE_SETENV
-int rep_setenv(const char *name, const char *value, int overwrite) 
-+int rep_setenv(const char *name, const char *value, int overwrite)
- {
-        char *p;
-        size_t l1, l2;
-@@ -644,10 +644,10 @@ int rep_unsetenv(const char *name)
-        for (i=0;environ[i];i++) /* noop */ ;
- 
-        count=i;
-       
-+
-        for (i=0;i<count;) {
-                if (strncmp(environ[i], name, len) == 0 && environ[i][len] == '=') {
-                       /* note: we do _not_ free the old variable here. It is unsafe to 
-+                       /* note: we do _not_ free the old variable here. It is unsafe to
-                           do so, as the pointer may not have come from malloc */
-                        memmove(&environ[i], &environ[i+1], (count-i)*sizeof(char *));
-                        count--;
-@@ -688,7 +688,7 @@ int rep_utimes(const char *filename, const struct timeval tv[2])
- #endif
- 
- #ifndef HAVE_DUP2
-int rep_dup2(int oldfd, int newfd) 
-+int rep_dup2(int oldfd, int newfd)
- {
-        errno = ENOSYS;
-        return -1;
-@@ -965,37 +965,6 @@ void *rep_memset_explicit(void *block, int c, size_t size)
- }
- #endif
- 
 -#ifndef HAVE_MEMSET_S
 -# ifndef RSIZE_MAX
 -#  define RSIZE_MAX (SIZE_MAX >> 1)
@@ -267,7 +58,7 @@ index 8615899..a419837 100644
 -       }
 -
 -#if defined(HAVE_MEMSET_EXPLICIT)
-       memset_explicit(dest, destsz, ch, count);
+-       memset_explicit(dest, ch, count);
 -#else /* HAVE_MEMSET_EXPLICIT */
 -       memset(dest, ch, count);
 -# if defined(HAVE_GCC_VOLATILE_MEMORY_PROTECTION)
diff --git a/meta-networking/recipes-connectivity/samba/samba/9aa5c43315d83c19514251a11c4fba5a137f2821.patch b/meta-networking/recipes-connectivity/samba/samba/9aa5c43315d83c19514251a11c4fba5a137f2821.patch
deleted file mode 100644
index e07e86e887..0000000000
--- a/meta-networking/recipes-connectivity/samba/samba/9aa5c43315d83c19514251a11c4fba5a137f2821.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 9aa5c43315d83c19514251a11c4fba5a137f2821 Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@samba.org>
-Date: Tue, 21 Jan 2025 17:59:27 +0100
-Subject: [PATCH] lib:replace: Don't use deprecated readline CPPFunction cast
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-HAVE_RL_COMPLETION_FUNC_T was unused and not checking for the right
-function.
-libcli/smbreadline/smbreadline.c: In function ‘smb_readline’:
-libcli/smbreadline/smbreadline.c:139:17: warning: ‘CPPFunction’ is deprecated [-Wdeprecated-declarations]
-  139 |                 rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn;
-      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-libcli/smbreadline/smbreadline.c:139:50: error: assignment to ‘char ** (*)(const char *, int,  int)’ from incompatible pointer type ‘char ** (*)(void)’ [-Wincompatible-pointer-types]
-  139 |                 rl_attempted_completion_function = RL_COMPLETION_CAST completion_fn;
-      |                                                  ^
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=15788
-Signed-off-by: Andreas Schneider <asn@samba.org>
-Reviewed-by: Alexander Bokovoy <ab@samba.org>
-Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
-Autobuild-Date(master): Tue Jan 21 19:38:37 UTC 2025 on atb-devel-224
-Upstream-Status: Backport [https://github.com/samba-team/samba/commit/9aa5c43315d83c19514251a11c4fba5a137f2821]
-Signed-off-by: Markus Volk <f_l_k@t-online.de>
---
- lib/replace/system/readline.h        | 4 +++-
- libcli/smbreadline/wscript_configure | 8 +++++---
- 2 files changed, 8 insertions(+), 4 deletions(-)
-diff --git a/lib/replace/system/readline.h b/lib/replace/system/readline.h
-index 9a9af266ca6d..ac3604fc12e0 100644
--- a/lib/replace/system/readline.h
-+++ b/lib/replace/system/readline.h
-@@ -46,7 +46,9 @@
- #endif
- 
- #ifdef HAVE_NEW_LIBREADLINE
-#ifdef HAVE_CPPFUNCTION
-+#if defined(HAVE_RL_COMPLETION_FUNC_T)
-+#  define RL_COMPLETION_CAST (rl_completion_func_t *)
-+#elif defined(HAVE_CPPFUNCTION)
- #  define RL_COMPLETION_CAST (CPPFunction *)
- #elif defined(HAVE_RL_COMPLETION_T)
- #  define RL_COMPLETION_CAST (rl_completion_t *)
-diff --git a/libcli/smbreadline/wscript_configure b/libcli/smbreadline/wscript_configure
-index 912ff53a150d..f5a401ebae00 100644
--- a/libcli/smbreadline/wscript_configure
-+++ b/libcli/smbreadline/wscript_configure
-@@ -51,10 +51,12 @@ conf.CHECK_CODE('''
- #    endif
- #  endif
- #endif
-int main(void) {rl_completion_t f; return 0;}
-+int main(void) {rl_completion_func_t f; return 0;}
- ''',
-'HAVE_RL_COMPLETION_FUNC_T', execute=False, addmain=False,
-msg='Checking for rl_completion_t')
-+                'HAVE_RL_COMPLETION_FUNC_T',
-+                execute=False,
-+                addmain=False,
-+                msg='Checking for rl_completion_func_t')
- 
- conf.CHECK_CODE('''
- #ifdef HAVE_READLINE_READLINE_H
diff --git a/meta-networking/recipes-connectivity/samba/samba_4.19.9.bb b/meta-networking/recipes-connectivity/samba/samba_4.23.5.bb
index 3ed1d46754..ec3149562a 100644
--- a/meta-networking/recipes-connectivity/samba/samba_4.19.9.bb
+++ b/meta-networking/recipes-connectivity/samba/samba_4.23.5.bb
@@ -14,6 +14,10 @@ ${SAMBA_MIRROR}    http://www.mirrorservice.org/sites/ftp.samba.org \n \
 export PYTHONHASHSEED = "1"
+# If XML_CATALOG_FILES env var is not defined, waf defaults
+# to build host folders looking for catalogs.
+export XML_CATALOG_FILES = ""
 SRC_URI = "${SAMBA_MIRROR}/stable/samba-${PV}.tar.gz \
           file://smb.conf \
           file://volatiles.03_samba \
@@ -24,7 +28,6 @@ SRC_URI = "${SAMBA_MIRROR}/stable/samba-${PV}.tar.gz \
           file://0005-Fix-pyext_PATTERN-for-cross-compilation.patch \
           file://0006-smbtorture-skip-test-case-tfork_cmd_send.patch \
           file://0007-Deleted-settiong-of-python-to-fix-the-install-confli.patch \
-           file://9aa5c43315d83c19514251a11c4fba5a137f2821.patch \
           file://0001-lib-replace-Implement-memset_explicit.patch \
           file://0002-lib-replace-Add-test-for-memset_explicit.patch \
           file://0003-Replace-memset_s-with-memset_explicit.patch \
@@ -36,7 +39,7 @@ SRC_URI:append:libc-musl = " \
           file://samba-4.3.9-remove-getpwent_r.patch \
           "
-SRC_URI[sha256sum] = "71ed406444714c90bb9d36c576d807b67af15449f297e91106d42b3ca2fa5549"
+SRC_URI[sha256sum] = "593a43ddd0d57902237dfa76888f7b02cb7fc7747111369cb31e126db4836b9f"
 UPSTREAM_CHECK_REGEX = "samba\-(?P<pver>4\.19(\.\d+)+).tar.gz"
@@ -47,7 +50,7 @@ CVE_STATUS[CVE-2011-2411] = "not-applicable-platform: vulnerable only on HP NonS
 # remove default added RDEPENDS on perl
 RDEPENDS:${PN}:remove = "perl"
-DEPENDS += "readline virtual/libiconv zlib popt libtalloc libtdb libtevent libldb libaio libpam libtasn1 libtasn1-native jansson libparse-yapp-perl-native gnutls cmocka"
+DEPENDS += "readline virtual/libiconv zlib popt libtalloc libtdb libtevent libaio libpam libtasn1 libtasn1-native jansson libparse-yapp-perl-native gnutls cmocka ngtcp2 bison-native"
 inherit features_check
 REQUIRED_DISTRO_FEATURES = "pam"
@@ -62,7 +65,7 @@ INITSCRIPT_NAME = "samba"
 INITSCRIPT_PARAMS = "start 20 3 5 . stop 20 0 1 6 ."
 SYSTEMD_PACKAGES = "${PN}-base ${PN}-ad-dc winbind ctdb"
-SYSTEMD_SERVICE:${PN}-base = "nmb.service smb.service"
+SYSTEMD_SERVICE:${PN}-base = "nmb.service smb.service samba-bgqd.service"
 SYSTEMD_SERVICE:${PN}-ad-dc = "${@bb.utils.contains('PACKAGECONFIG', 'ad-dc', 'samba.service', '', d)}"
 SYSTEMD_SERVICE:winbind = "winbind.service"
 SYSTEMD_SERVICE:ctdb = "ctdb.service"
@@ -109,7 +112,7 @@ SAMBA4_MODULES = "${SAMBA4_IDMAP_MODULES},${SAMBA4_PDB_MODULES},${SAMBA4_AUTH_MO
 # .so files so there will not be a conflict.  This is not done consistantly, so be very careful
 # when adding to this list.
 #
-SAMBA4_LIBS = "heimdal,NONE"
+SAMBA4_LIBS = "heimdal,libquic,NONE"
 EXTRA_OECONF += "--enable-fhs \
                 --with-piddir=/run \
@@ -132,6 +135,19 @@ EXTRA_OECONF += "--enable-fhs \
 LDFLAGS += "-Wl,-z,relro,-z,now"
+do_configure:prepend() {
+    # The xsltproc tool is actually a wrapper script in OE, which exports its own XML_CATALOG_FILES env var
+    # However samba does that too. So here I'm trying to concatenate the variables.
+    # The original looks like this in the wrapper:
+    # export XML_CATALOG_FILES=oe-core-specific-thing
+    # and this sed prepends the value with $XML_CATALOG_FILES, and encloses it in quotes. So the end value is
+    # export XML_CATALOG_FILES="$XML_CATALOG FILES oe-core-specific-thing"
+    # The first grep just checks if it was already done, so it is not prepended multiple times.
+    grep \$XML_CATALOG_FILES ${STAGING_BINDIR_NATIVE}/xsltproc || \
+        sed -i 's,\(XML_CATALOG_FILES\)=\(.*\),\1="\$XML_CATALOG_FILES \2",' ${STAGING_BINDIR_NATIVE}/xsltproc
+}
 do_configure:append() {
    cd ${S}/pidl/
    perl Makefile.PL PREFIX=${prefix}
@@ -213,6 +229,9 @@ do_install:append() {
    find ${D}${libdir}/perl5/ -type f -name "perllocal.pod" -delete
    find ${D}${libdir}/perl5/ -type f -name ".packlist" -delete
    sed -i -e '1s,#!.*perl,#!${bindir}/env perl,' ${D}${bindir}/pidl
+    sed -i 's,${UNPACKDIR},,g' ${S}/bin/default/libcli/wsp/wsp_aqs_lexer.c
+    sed -i 's,${UNPACKDIR},,g' ${S}/bin/default/libcli/wsp/wsp_aqs_lexer.h
 }
 PACKAGES =+ "${PN}-python3 ${PN}-pidl \
@@ -245,7 +264,7 @@ PACKAGESPLITFUNCS:prepend = "samba_populate_packages "
 PACKAGES_DYNAMIC = "samba-auth-.* samba-pdb-.*"
 RDEPENDS:${PN} += "${PN}-base ${PN}-python3 ${PN}-dsdb-modules python3"
-RDEPENDS:${PN}-python3 += "pytalloc python3-tdb pyldb"
+RDEPENDS:${PN}-python3 += "pytalloc python3-tdb"
 FILES:${PN}-base = "${sbindir}/nmbd \
                    ${sbindir}/smbd \
diff --git a/meta-networking/recipes-connectivity/tailscale/tailscale-go-mods.inc b/meta-networking/recipes-connectivity/tailscale/tailscale-go-mods.inc
index 3cfea84a55..7e2e91bb56 100644
--- a/meta-networking/recipes-connectivity/tailscale/tailscale-go-mods.inc
+++ b/meta-networking/recipes-connectivity/tailscale/tailscale-go-mods.inc
@@ -1,43 +1,54 @@
-SRC_URI += " \
-    gomod://filippo.io/edwards25519;version=v1.1.0;sha256sum=9ac43a686d06fdebd719f7af3866c87eb069302272dfb131007adf471c308b65 \
+# This file has been generated by go-mod-update-modules.bbclass
+#
+# Do not modify it by hand, as the contents will be replaced when
+# running the update-modules task.
+SRC_URI += "\
+    gomod://filippo.io/edwards25519;version=v1.2.0;sha256sum=98f2d3ca9b88daa031b0fb2fb521b7ea386af1fed61b6f445a20bef7fa381c17 \
+    gomod://fyne.io/systray;version=v1.11.1-0.20250812065214-4856ac3adc3c;sha256sum=7782bef2e30904a5e34477f713a4c598b1ddf3b3a70deead056549ad22248311 \
+    gomod://github.com/Kodeworks/golang-image-ico;version=v0.0.0-20141118225523-73f0f4cfade9;sha256sum=1d677069e35c4a3e4f290e68c6e2391f6237aee9ce3f39448ed09a2ddab274b0 \
    gomod://github.com/anmitsu/go-shlex;version=v0.0.0-20200514113438-38f4b401e2be;sha256sum=2a5cf7c9a2709f649fd508cbacb2be96e4fba4d534a28a122ee4d7574af40b5e \
-    gomod://github.com/aws/aws-sdk-go-v2;version=v1.36.0;sha256sum=ec276e274bbe39c35d3c2c8c1ec5cba494d6449cd8166d741676cdf0a9d1697b \
+    gomod://github.com/atotto/clipboard;version=v0.1.4;sha256sum=d67b2c36c662751309fd2ec351df3651584bea840bd27be9a90702c3a238b43f \
+    gomod://github.com/aws/aws-sdk-go-v2;version=v1.41.0;sha256sum=869834493118f72f9349f5493959bcd8fc951fa236eecd0095c16322f5b2f53c \
    gomod://github.com/aws/aws-sdk-go-v2/config;version=v1.29.5;sha256sum=ce165d37c7b1dfee2047137f1176c197dc397a5553ef6fc0dba799b21908475b \
    gomod://github.com/aws/aws-sdk-go-v2/credentials;version=v1.17.58;sha256sum=238cc4a98dde7bc3e94dc0f0005c4d988a244daaa9fe4fda706a781ec62bf7e2 \
    gomod://github.com/aws/aws-sdk-go-v2/feature/ec2/imds;version=v1.16.27;sha256sum=408958244a10036461c3a3b27fcdaf20efa3af19168bd527b6617319a754309c \
-    gomod://github.com/aws/aws-sdk-go-v2/internal/configsources;version=v1.3.31;sha256sum=7929b44beec37b00c9ee5269b0f109d7ccc2bb26a8528ab14e0f172076a41205 \
+    gomod://github.com/aws/aws-sdk-go-v2/internal/configsources;version=v1.4.16;sha256sum=5bd82543507e01fab6a9344a995a431682f4061770b25005f9116f43ae539ac4 \
-    gomod://github.com/aws/aws-sdk-go-v2/internal/endpoints/v2;version=v2.6.31;sha256sum=6ae31e302c828ecf80310e85059c49ce44668b8c62aa52fa964b0d745a6f62b1 \
+    gomod://github.com/aws/aws-sdk-go-v2/internal/endpoints/v2;version=v2.7.16;sha256sum=0a4cc94f6843c9c50a1839783123b4664a07d5a67d8a49157304f8550c0c2e39 \
    gomod://github.com/aws/aws-sdk-go-v2/internal/ini;version=v1.8.2;sha256sum=53d1a9a401283711118c91e6e9fdb8193ce6430ca4bbe6b5454bcaaa51e81de0 \
-    gomod://github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding;version=v1.12.2;sha256sum=6ab252b3b962a6b34f0107583f6ff8e4a68e02dcd8df9573e895e5ca60ff139c \
+    gomod://github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding;version=v1.13.4;sha256sum=e9b9e131812d339f4ac2b20bb504caf1cde680e048e15688bd8126ecd300e5e2 \
-    gomod://github.com/aws/aws-sdk-go-v2/service/internal/presigned-url;version=v1.12.12;sha256sum=a92f4383630fa976eeb484b051a6224a8d1d277c4b3ca93a40cce57d06cbbec2 \
+    gomod://github.com/aws/aws-sdk-go-v2/service/internal/presigned-url;version=v1.13.16;sha256sum=1ba321f470ad6ce8673c303386f15136b8fa2f86b23e6a181dbf5c74cb84ef7b \
    gomod://github.com/aws/aws-sdk-go-v2/service/ssm;version=v1.44.7;sha256sum=e09b97aa37ffd7c003a8a2e7574668e92eabd267d2a78d22fb440bcd93a61e46 \
    gomod://github.com/aws/aws-sdk-go-v2/service/sso;version=v1.24.14;sha256sum=9196a430068584c9d1e621aff0a45b32adaf190b4363dddda8b341901e188f51 \
    gomod://github.com/aws/aws-sdk-go-v2/service/ssooidc;version=v1.28.13;sha256sum=acaeca3476410d64512a4d9feefd6c8d16effa76718f72db4ba7b786c7fcc398 \
-    gomod://github.com/aws/aws-sdk-go-v2/service/sts;version=v1.33.13;sha256sum=1800e76ad35287ca7067374b7489ebd7f1d25426c93ae9e40fd73e2a78f29e75 \
+    gomod://github.com/aws/aws-sdk-go-v2/service/sts;version=v1.41.5;sha256sum=de6f3748c40c13e10b790a7c02023aa559b153c251856e3b3940ee47cc0bc007 \
-    gomod://github.com/aws/smithy-go;version=v1.22.2;sha256sum=e5701b5798a3ff01b7139ec07e5bc2010f76cab82523e8989602003d61d82324 \
+    gomod://github.com/aws/smithy-go;version=v1.24.0;sha256sum=655a1e00489bcf29a94cf26878c2f0b3b74c8bfb5d3c566baa3b94e088fbf417 \
    gomod://github.com/coder/websocket;version=v1.8.12;sha256sum=ad8d323970c04679f4566ee7db98946508c37cdd21a46a875d5257d631a9e990 \
    gomod://github.com/coreos/go-iptables;version=v0.7.1-0.20240112124308-65c67c9f46e6;sha256sum=6d0ae6344f1d355f72e6aaba583ce73822861511337ca92cc1c4727fc8ba66dd \
-    gomod://github.com/creack/pty;version=v1.1.23;sha256sum=2151b7121020954864de83eacf854634866cca0a3bfe33a2ebffa2edebc25df3 \
+    gomod://github.com/creachadair/msync;version=v0.7.1;sha256sum=ee8dd1d2cc8a1e555fcfaecc7407425216ee87cd4414093d9a3d8d50fc622e5d \
+    gomod://github.com/creack/pty;version=v1.1.24;sha256sum=754e25253e76a5583b80d57d3add3afe68fc4d9f2a490968a9d1eda8c8fd8815 \
    gomod://github.com/digitalocean/go-smbios;version=v0.0.0-20180907143718-390a4f403a8e;sha256sum=2bc498a09aa55b3417bebacce448b2d2ab757981e59b6b016d08cf97e4a7bdde \
    gomod://github.com/djherbis/times;version=v1.6.0;sha256sum=21d69060967bc03ea3c39ff8c0b1a95511e96eccd3749a2daef1a02af1bc0a85 \
-    gomod://github.com/fxamacker/cbor/v2;version=v2.7.0;sha256sum=b48771460405bab6896c85e21ebc5ff287d4018c6db5c8d822c55769c80dde03 \
+    gomod://github.com/fogleman/gg;version=v1.3.0;sha256sum=792f7a3ea9eea31b7947dabaf9d5a307389245069078e4bf435d76cb0505439c \
-    gomod://github.com/gaissmai/bart;version=v0.18.0;sha256sum=566f2401988b2536055d87f6851ea596518377ee4592176375b84a5ca791fc77 \
+    gomod://github.com/fxamacker/cbor/v2;version=v2.9.0;sha256sum=5b0ec6424bd522aeeeab30cbdcad6f40bf976a9a2ddf125ab27b97826140d97a \
-    gomod://github.com/go-json-experiment/json;version=v0.0.0-20250223041408-d3c622f1b874;sha256sum=96edf3942a5665ff2b27f0da4586e2602fe4816dc31e184d3bcd6fbf4cdb13e4 \
+    gomod://github.com/gaissmai/bart;version=v0.26.1;sha256sum=7cead7fb3f4be36f3864efaf1344d72ca7ba03ab5a557338c80ca6d4bda59cca \
+    gomod://github.com/go-json-experiment/json;version=v0.0.0-20250813024750-ebf49471dced;sha256sum=e20ad9cf462e43db906cd2dc237061d6a5b575d10bd4ece52f1857b15a107006 \
    gomod://github.com/godbus/dbus/v5;version=v5.1.1-0.20230522191255-76236955d466;sha256sum=262f43ec87570238a0e770e7fa656dda70fe6050a7edf5addc30287cb64b21a6 \
-    gomod://github.com/golang/groupcache;version=v0.0.0-20210331224755-41bb18bfe9da;sha256sum=b27034e8fc013627543e1ad098cfc65329f2896df3da5cf3266cc9166f93f3a5 \
+    gomod://github.com/golang/freetype;version=v0.0.0-20170609003504-e2365dfdc4a0;sha256sum=cdcb9e6a14933dcbf167b44dcd5083fc6a2e52c4fae8fb79747c691efeb7d84e \
-    gomod://github.com/google/btree;version=v1.1.2;sha256sum=faee8550c5fffb4ae1dadde5ccaccb13298726f9fad226bb4eed0c03c90a481d \
+    gomod://github.com/golang/groupcache;version=v0.0.0-20241129210726-2c02b8208cf8;sha256sum=163367355442a630b12b0b452892cd98e99fcfdf7e40b68d358be73479cc1c23 \
+    gomod://github.com/google/btree;version=v1.1.3;sha256sum=11b736bc8252b52fecdf346d3707ccf3a2b6d458ba21b4f843616fc12eeb30b2 \
    gomod://github.com/google/go-tpm;version=v0.9.4;sha256sum=a8a5e504fbd78284a50e6ab625f6248cfbb89421fafdfee71d66abc6e1dfc192 \
    gomod://github.com/google/nftables;version=v0.2.1-0.20240414091927-5e242ec57806;sha256sum=ceb96b39a6f9004d8c217a6ae61b91a69c250bc30fbf3a04cd87cbbfddea73c8 \
-    gomod://github.com/gorilla/csrf;version=v1.7.3;sha256sum=39923b0dde0b8be30d3572589a8cc2ea515ca36a3e542269645db36aff7d6842 \
-    gomod://github.com/gorilla/securecookie;version=v1.1.2;sha256sum=fd7c0de7000c2e6a123d73e1249e1dce892ba29d2d03b00dc81d5fcee41d5895 \
    gomod://github.com/hdevalence/ed25519consensus;version=v0.2.0;sha256sum=111cafade3ba9c7c3adf66b6a424386e30829c46c60b80dabe288e1837d30e33 \
+    gomod://github.com/huin/goupnp;version=v1.3.0;sha256sum=df663b90b9b3bf16e1cfa810a6c3dd904993e8c1155dbf65566ce0361f163dce \
    gomod://github.com/illarion/gonotify/v3;version=v3.0.2;sha256sum=fef3e17f676c8ce98b60f0e2180fc4e3331e6e1604eaf96ab8791e073f96a7af \
    gomod://github.com/insomniacslk/dhcp;version=v0.0.0-20231206064809-8c70d406f6d2;sha256sum=be28971fb642a9c4cf9f16e07332310af05c291584b6440b32849ca058dd345d \
    gomod://github.com/jellydator/ttlcache/v3;version=v3.1.0;sha256sum=278dfc9b4882eaeb9b56e925b574028f3e9cc4436645b93f56ccb69de134a898 \
    gomod://github.com/jmespath/go-jmespath;version=v0.4.0;sha256sum=d1f77b6790d7c4321a74260f3675683d3ac06b0a614b5f83e870beae0a8b2867 \
    gomod://github.com/jsimonetti/rtnetlink;version=v1.4.0;sha256sum=81625291f4d0a08718dfd2170873d1adfd8fc2248657584f520c4de6de9e2e4d \
    gomod://github.com/kballard/go-shellquote;version=v0.0.0-20180428030007-95032a82bc51;sha256sum=ae4cb7b097dc4eb0c248dff00ed3bbf0f36984c4162ad1d615266084e58bd6cc \
-    gomod://github.com/klauspost/compress;version=v1.17.11;sha256sum=88dea800cc6a11ccb9dd2f0dd487f30e8701870abdfc11245e41dcfc9f3d428e \
+    gomod://github.com/klauspost/compress;version=v1.18.5;sha256sum=e1fdde95d97978146243f1e793ce18a09b107d6cd6032347fcb5b9115181497d \
    gomod://github.com/kortschak/wol;version=v0.0.0-20200729010619-da482cc4850a;sha256sum=09c15500a0ef54af0796f37282dd5377d2b866e4c36c87dcb6b2894cf3114dc5 \
    gomod://github.com/kr/fs;version=v0.1.0;sha256sum=d376bd98e81aea34585fc3b04bab76363e9e87cde69383964e57e9779f2af81e \
    gomod://github.com/mattn/go-colorable;version=v0.1.13;sha256sum=08be322dcc584a9fcfde5caf0cf878b4e11cd98f252e32bc704e92c5a4ba9d15 \
@@ -46,38 +57,40 @@ SRC_URI += " \
    gomod://github.com/mdlayher/netlink;version=v1.7.3-0.20250113171957-fbb4dce95f42;sha256sum=b427c8c746e87c2f8033678fb87cdcf5cefb21ce16f35930eff91683661395f0 \
    gomod://github.com/mdlayher/sdnotify;version=v1.0.0;sha256sum=26f4efbcba73eaec323973c8ae335bad430e5d6947097976cfbe7c9547f68c90 \
    gomod://github.com/mdlayher/socket;version=v0.5.0;sha256sum=931626341956178fe6015b128fdda22283480d05dc964675307eb61ed39c29fe \
-    gomod://github.com/miekg/dns;version=v1.1.58;sha256sum=179bd419d011fd90802355756f59fff70ddf9a5886a4db6336a6d05783552b16 \
    gomod://github.com/mitchellh/go-ps;version=v1.0.0;sha256sum=f2f0400b1d5e136419daed275c27a930b0f5447ac12bb8acd3ddbe39547b2834 \
    gomod://github.com/peterbourgon/ff/v3;version=v3.4.0;sha256sum=b49537268ce67eb755d773fdd2a3e1c9c6dec0731993a4f742080416eb9b12a6 \
-    gomod://github.com/pierrec/lz4/v4;version=v4.1.21;sha256sum=bd2e8ef13800ca42205b0d4085a927a6d012b82cfa831769be4830036e953bec \
+    gomod://github.com/pierrec/lz4/v4;version=v4.1.25;sha256sum=f8a08e363b7ac3835d6785281e7b26bee4928dade20b2750286397180e5c7a75 \
+    gomod://github.com/pires/go-proxyproto;version=v0.8.1;sha256sum=a979a2f26160bfcb6f3829dd546d5f53c8b1879e7ad84466e359cf3f6237aa4c \
    gomod://github.com/pkg/sftp;version=v1.13.6;sha256sum=0cdf6bd0edef9db8137ce398c9bbe514713e42cf2d4d415b5025f4a3c33f249d \
    gomod://github.com/safchain/ethtool;version=v0.3.0;sha256sum=bfa1a3fe314a3f2ac4c4385a6c4694708e4881bfd86c34668eca92656e398590 \
    gomod://github.com/skip2/go-qrcode;version=v0.0.0-20200617195104-da1b6568686e;sha256sum=3fc1c4d11c79001d1cc2df0de87493b324b9af141cc59ae8c212612dd2c90e90 \
-    gomod://github.com/tailscale/goupnp;version=v1.0.1-0.20210804011211-c64d0f06ea05;sha256sum=1c7ed6ecc16b6f402c225bae88a067a8bc1574cded894638b820c5da751823cc \
+    gomod://github.com/tailscale/gliderssh;version=v0.3.4-0.20260330083525-c1389c70ff89;sha256sum=b80328e5c37bd7f6f8a3c304d8938ade18e12b035b753cd50db265147814befd \
-    gomod://github.com/tailscale/hujson;version=v0.0.0-20221223112325-20486734a56a;sha256sum=8e65bacebfc0a1edc067fd97f839fcfeb93c1e7b8cc0186d1773cff4e125d9d5 \
+    gomod://github.com/tailscale/hujson;version=v0.0.0-20260302212456-ecc657c15afd;sha256sum=9f9c320dd90c86880b26107b931d6c056e99642d4c4e50fafcdf7de8ea0989e6 \
    gomod://github.com/tailscale/netlink;version=v1.1.1-0.20240822203006-4d49adab4de7;sha256sum=a5195ef600f8d9a0fb8501eea85e4fe0321a74bd57dec88f07b8569d0ee4f55e \
    gomod://github.com/tailscale/peercred;version=v0.0.0-20250107143737-35a0c7bd7edc;sha256sum=87d0f4f3b1d59ea45c9a87b775b615bebd721a5870dafedc63cc860ec4aac281 \
    gomod://github.com/tailscale/web-client-prebuilt;version=v0.0.0-20250124233751-d4cd19a26976;sha256sum=1d02f0804bb41e0743b7d889b8e2dbd8466a89793f03997f4c1fd10f9e8974c3 \
-    gomod://github.com/tailscale/wireguard-go;version=v0.0.0-20250304000100-91a0587fb251;sha256sum=7b82eb990f2f3686d335cdff5e988f8d4e27e031d563fb0e37bce1a3b0c5a83f \
+    gomod://github.com/tailscale/wireguard-go;version=v0.0.0-20260427181203-e3ac4a0afb4e;sha256sum=2b648406d9e57b06178836db6b2e3e9a7c5e25fefe256978a11d91d34a4a5581 \
    gomod://github.com/tailscale/xnet;version=v0.0.0-20240729143630-8497ac4dab2e;sha256sum=438abf28ce5fb03adf529c2cb57a451f9b243c4a2a181d9d06cdb61bb10960e7 \
    gomod://github.com/toqueteos/webbrowser;version=v1.2.0;sha256sum=1227d3ebeab16d8232a304a10b087984a96ad30f7439b6687bab2f5747d308cf \
    gomod://github.com/u-root/u-root;version=v0.14.0;sha256sum=a65c0a06236b10a0cea50e603fef0ced0c7e343a66ef957a45ebcd51f304d286 \
    gomod://github.com/u-root/uio;version=v0.0.0-20240224005618-d2acac8f3701;sha256sum=f6e8f912e968744999d508c3df54f0308aaf337052a8d0bd3edd72583adfd9cd \
-    gomod://github.com/vishvananda/netns;version=v0.0.4;sha256sum=cdaebcd80614800a74537e59855730d42393ffc109ebd47e5b8437dcc4d7f429 \
+    gomod://github.com/vishvananda/netns;version=v0.0.5;sha256sum=07804b88c922c2a6780efe392ffef9d126eac584384eb3eb17bcadd34cfa9422 \
    gomod://github.com/x448/float16;version=v0.8.4;sha256sum=73b24a41037ea999ab66851e3798a0973dbb1f214925915b01f0820f7b2f1500 \
+    gomod://go.yaml.in/yaml/v2;version=v2.4.2;sha256sum=ed63e181cbb5a991c104639b0e6d48d45fd951f22b47d4c5d1a36156d8ed06ee \
    gomod://go4.org/mem;version=v0.0.0-20240501181205-ae6ca9944745;sha256sum=9b5037a57122457fdc5c2c0a31e3996b44cf9dfcdee5c53ed72adfd88d077795 \
    gomod://go4.org/netipx;version=v0.0.0-20231129151722-fdeea329fbba;sha256sum=e15f57de368c92b826010181906f26112ba3a0d7fde7d94c8a8c60c525dc4044 \
-    gomod://golang.org/x/crypto;version=v0.37.0;sha256sum=7ce6b2be21be1ce9e04dc784830e08931f09b5903596b8017839322c9e828667 \
+    gomod://golang.org/x/crypto;version=v0.50.0;sha256sum=aaf9503dd088d2727e08f213d23424ebc75a52ee609f084ec4c726f3590c0ea5 \
-    gomod://golang.org/x/exp;version=v0.0.0-20250210185358-939b2ce775ac;sha256sum=de413a97994a7b97541cb1f867439fa20b60361d79dc35e8e2faf847a2a188df \
+    gomod://golang.org/x/exp;version=v0.0.0-20250620022241-b7579e27df2b;sha256sum=fdaae8f1b98727b49d10228492b2dee1b8c68d12f640a4f17f0fb175581bf547 \
-    gomod://golang.org/x/net;version=v0.36.0;sha256sum=e823a351657b349cd8a705079778769534d90a5c3a6c7caed174a79608257d12 \
+    gomod://golang.org/x/image;version=v0.27.0;sha256sum=db4846c8edb8cdcb556d205840361f62382df9bd5946b756e700c5fb43d90332 \
-    gomod://golang.org/x/oauth2;version=v0.26.0;sha256sum=d4c1bfc661b8ff3ccb3d5d30babf5f67798b59e2bfa932b6f1f739e67e45dcda \
+    gomod://golang.org/x/net;version=v0.53.0;sha256sum=3808b07d64ba58f58ca91737f0a165439f72b03a512ea901bad2aa1e168092d5 \
-    gomod://golang.org/x/sync;version=v0.13.0;sha256sum=4bdaaffe69cc7c997cff97cd81dc9c6777777bd311175f100f76b049bbbe7ed9 \
+    gomod://golang.org/x/oauth2;version=v0.36.0;sha256sum=15bf65ff103e5dafc809d78cd037a1d1e88ccb8451824e851156002a13304504 \
-    gomod://golang.org/x/sys;version=v0.32.0;sha256sum=85d47075d21fd7ef35d9a47fc73f2356fb3cd2e7fab7f45c874b814bf312127d \
+    gomod://golang.org/x/sync;version=v0.20.0;sha256sum=7179d4d68800f6fdcadb9d4bbf11cbb5df9b40360c89305c203fe20723cbd375 \
-    gomod://golang.org/x/term;version=v0.31.0;sha256sum=bdeda753791b44f6815ccf3367ff57ffaca9bb100bfe8ebe112c8da133e78aec \
+    gomod://golang.org/x/sys;version=v0.43.0;sha256sum=cb8b073934cf7e579c9f80c4d12619d5f96fcf97af6f07fdc649e7acec0aaddf \
-    gomod://golang.org/x/text;version=v0.24.0;sha256sum=f585335a57a6fa5fa0c0bf319b45f0909e5ff1aba91e8567187ba8e423084c00 \
+    gomod://golang.org/x/term;version=v0.42.0;sha256sum=c69cf2bf68d1d73e15a31c1c9a687316edef5c4ef9b6bb35aaedc08c6204f3c2 \
-    gomod://golang.org/x/time;version=v0.10.0;sha256sum=7420a12017bb47bd85ccab81f9d1f7a3ff6daf8da768256292bc1dbb3bf9ba63 \
+    gomod://golang.org/x/text;version=v0.36.0;sha256sum=15c60227cf084605a0256b8eacd9cfaf411109fe80c9e68b14a9367a5e42b23c \
-    gomod://gvisor.dev/gvisor;version=v0.0.0-20250205023644-9414b50a5633;sha256sum=b373e677e77f28c095b43ed976f5d9ca885d3b1b5407a71a5691e4a47e813bd0 \
+    gomod://golang.org/x/time;version=v0.12.0;sha256sum=cdcb04c43b112919c5e0d0fa1d90769124ad56918a44e6cb0747876ed7e5015c \
-    gomod://k8s.io/client-go;version=v0.32.0;sha256sum=74ee50d42da263c0743212c17a12f16d8a3283f31f7c9209c6327b6656ac1550 \
+    gomod://gvisor.dev/gvisor;version=v0.0.0-20260224225140-573d5e7127a8;sha256sum=2335e73d1effb8e5601be32b322e5d39bf1efc1eef2d296a8e054bd37a72b47f \
-    gomod://sigs.k8s.io/yaml;version=v1.4.0;sha256sum=ef031ff78ff9b7036e174eef49dfbd77468dc4f0afb73a639b61f8ab3a1cc425 \
+    gomod://k8s.io/client-go;version=v0.34.0;sha256sum=3ede34d9df9dcb02779a631ca9c653f92db3714ee887c6fdd86a66bc4889d2c0 \
+    gomod://sigs.k8s.io/yaml;version=v1.6.0;sha256sum=cf88648a471581817b00a42ee8d24fd73eb0e3503998cf46d8e63787e11e5052 \
    gomod://software.sslmate.com/src/go-pkcs12;version=v0.4.0;sha256sum=55019a391e5302a51ba62e98909e006224b81207866da90beaf582ec0dee036f \
 "
diff --git a/meta-networking/recipes-connectivity/tailscale/tailscale-licenses.inc b/meta-networking/recipes-connectivity/tailscale/tailscale-licenses.inc
index 53d46dd45c..54690f464e 100644
--- a/meta-networking/recipes-connectivity/tailscale/tailscale-licenses.inc
+++ b/meta-networking/recipes-connectivity/tailscale/tailscale-licenses.inc
@@ -1,43 +1,60 @@
-LIC_FILES_CHKSUM += " \
-    file://pkg/mod/filippo.io/edwards25519@v1.1.0/LICENSE;md5=5d4950ecb7b26d2c5e4e7b4e0dd74707;spdx=BSD-3-Clause \
+# This file has been generated by go-mod-update-modules.bbclass
+#
+# Unknown licenses have been checked manually and completed.
+#
+LICENSE += "& Apache-2.0 & BSD-2-Clause & BSD-3-Clause & ISC & MIT"
+LIC_FILES_CHKSUM += "\
+    file://pkg/mod/filippo.io/edwards25519@v1.2.0/LICENSE;md5=5d4950ecb7b26d2c5e4e7b4e0dd74707;spdx=BSD-3-Clause \
+    file://pkg/mod/fyne.io/systray@v1.11.1-0.20250812065214-4856ac3adc3c/LICENSE;md5=a2be13cb34e811436f5388f0a19cc0b0;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/!kodeworks/golang-image-ico@v0.0.0-20141118225523-73f0f4cfade9/LICENSE;md5=591778525c869cdde0ab5a1bf283cd81;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/anmitsu/go-shlex@v0.0.0-20200514113438-38f4b401e2be/LICENSE;md5=45a47c50f5b33ff9ab3347c7db1bfb6a;spdx=MIT \
-    file://pkg/mod/github.com/aws/aws-sdk-go-v2@v1.36.0/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/atotto/clipboard@v0.1.4/LICENSE;md5=489200b65f13bcbcb890a96b99a58a6f;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/aws/aws-sdk-go-v2/config@v1.29.5/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
    file://pkg/mod/github.com/aws/aws-sdk-go-v2/credentials@v1.17.58/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
    file://pkg/mod/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.16.27/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
-    file://pkg/mod/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.3.31/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.16/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
-    file://pkg/mod/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.6.31/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.16/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
    file://pkg/mod/github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.2/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
-    file://pkg/mod/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.12.2/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.4/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
-    file://pkg/mod/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.12.12/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.16/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
    file://pkg/mod/github.com/aws/aws-sdk-go-v2/service/ssm@v1.44.7/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
    file://pkg/mod/github.com/aws/aws-sdk-go-v2/service/sso@v1.24.14/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
    file://pkg/mod/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.28.13/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
-    file://pkg/mod/github.com/aws/aws-sdk-go-v2/service/sts@v1.33.13/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/aws/aws-sdk-go-v2/service/sts@v1.41.5/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
-    file://pkg/mod/github.com/aws/smithy-go@v1.22.2/LICENSE;md5=34400b68072d710fecd0a2940a0d1658;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/aws/aws-sdk-go-v2@v1.41.0/LICENSE.txt;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/aws/aws-sdk-go-v2@v1.41.0/internal/sync/singleflight/LICENSE;md5=bdc234595bc2fe370918f5de5077c8e9;spdx=BSD-3-Clause \
+    file://pkg/mod/github.com/aws/smithy-go@v1.24.0/LICENSE;md5=34400b68072d710fecd0a2940a0d1658;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/aws/smithy-go@v1.24.0/internal/sync/singleflight/LICENSE;md5=bdc234595bc2fe370918f5de5077c8e9;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/coder/websocket@v1.8.12/LICENSE.txt;md5=bc0b6f68116166556efe7184edfda3e9;spdx=ISC \
    file://pkg/mod/github.com/coreos/go-iptables@v0.7.1-0.20240112124308-65c67c9f46e6/LICENSE;md5=19cbd64715b51267a47bf3750cc6a8a5;spdx=Apache-2.0 \
-    file://pkg/mod/github.com/creack/pty@v1.1.23/LICENSE;md5=93958070863d769117fa33b129020050;spdx=MIT \
+    file://pkg/mod/github.com/creachadair/msync@v0.7.1/LICENSE;md5=b8be277519c5ee121454d43de171668a;spdx=BSD-3-Clause \
+    file://pkg/mod/github.com/creack/pty@v1.1.24/LICENSE;md5=93958070863d769117fa33b129020050;spdx=MIT \
    file://pkg/mod/github.com/digitalocean/go-smbios@v0.0.0-20180907143718-390a4f403a8e/LICENSE.md;md5=c1653934903ab2785c09c2bdd7344526;spdx=Apache-2.0 \
    file://pkg/mod/github.com/djherbis/times@v1.6.0/LICENSE;md5=3cafd141825e7a44b1c6a047b2320012;spdx=MIT \
-    file://pkg/mod/github.com/fxamacker/cbor/v2@v2.7.0/LICENSE;md5=827f5a2fa861382d35a3943adf9ebb86;spdx=MIT \
+    file://pkg/mod/github.com/fogleman/gg@v1.3.0/LICENSE.md;md5=1630f0e1bac38694fdc4dcb6a9218f4a;spdx=MIT \
-    file://pkg/mod/github.com/gaissmai/bart@v0.18.0/LICENSE;md5=05779e437ec35570aca43cc66a95e056;spdx=MIT \
+    file://pkg/mod/github.com/fxamacker/cbor/v2@v2.9.0/LICENSE;md5=827f5a2fa861382d35a3943adf9ebb86;spdx=MIT \
-    file://pkg/mod/github.com/go-json-experiment/json@v0.0.0-20250223041408-d3c622f1b874/LICENSE;md5=9d210c7471ce08e3db5261f33bf8fce6;spdx=BSD-3-Clause \
+    file://pkg/mod/github.com/gaissmai/bart@v0.26.1/LICENSE;md5=05779e437ec35570aca43cc66a95e056;spdx=MIT \
+    file://pkg/mod/github.com/go-json-experiment/json@v0.0.0-20250813024750-ebf49471dced/LICENSE;md5=9d210c7471ce08e3db5261f33bf8fce6;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/godbus/dbus/v5@v5.1.1-0.20230522191255-76236955d466/LICENSE;md5=09042bd5c6c96a2b9e45ddf1bc517eed;spdx=BSD-2-Clause \
-    file://pkg/mod/github.com/golang/groupcache@v0.0.0-20210331224755-41bb18bfe9da/LICENSE;md5=19cbd64715b51267a47bf3750cc6a8a5;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/golang/freetype@v0.0.0-20170609003504-e2365dfdc4a0/LICENSE;md5=8e050e4860234723098ceeefa49edd05;spdx=BSD-3-Clause \
-    file://pkg/mod/github.com/google/btree@v1.1.2/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/golang/groupcache@v0.0.0-20241129210726-2c02b8208cf8/LICENSE;md5=19cbd64715b51267a47bf3750cc6a8a5;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/google/btree@v1.1.3/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
    file://pkg/mod/github.com/google/go-tpm@v0.9.4/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
    file://pkg/mod/github.com/google/nftables@v0.2.1-0.20240414091927-5e242ec57806/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
-    file://pkg/mod/github.com/gorilla/csrf@v1.7.3/LICENSE;md5=c30eee78985cf2584cded5f89ba3d787;spdx=BSD-3-Clause \
-    file://pkg/mod/github.com/gorilla/securecookie@v1.1.2/LICENSE;md5=c30eee78985cf2584cded5f89ba3d787;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/hdevalence/ed25519consensus@v0.2.0/LICENSE;md5=4041895a1f717acb5be52e24edb19917;spdx=BSD-3-Clause \
+    file://pkg/mod/github.com/huin/goupnp@v1.3.0/LICENSE;md5=3d7eee8afacfccb446c1ac30289c965d;spdx=BSD-2-Clause \
    file://pkg/mod/github.com/illarion/gonotify/v3@v3.0.2/LICENSE;md5=6b631a3123c7c679195702a8a35c9f21;spdx=MIT \
    file://pkg/mod/github.com/insomniacslk/dhcp@v0.0.0-20231206064809-8c70d406f6d2/LICENSE;md5=ceaf33b8b657b2d342dbd3bb59578d8a;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/jellydator/ttlcache/v3@v3.1.0/LICENSE;md5=4cea77626c625d583c98a85a8658f9d2;spdx=MIT \
    file://pkg/mod/github.com/jmespath/go-jmespath@v0.4.0/LICENSE;md5=9abfa8353fce3f2cb28364e1e9016852;spdx=Apache-2.0 \
    file://pkg/mod/github.com/jsimonetti/rtnetlink@v1.4.0/LICENSE.md;md5=75a8090d4c02945ad9d61c7cce77ed48;spdx=MIT \
    file://pkg/mod/github.com/kballard/go-shellquote@v0.0.0-20180428030007-95032a82bc51/LICENSE;md5=9d95d1ad917c814c23909addb8692eeb;spdx=MIT \
-    file://pkg/mod/github.com/klauspost/compress@v1.17.11/LICENSE;md5=d0fd9ebda39468b51ff4539c9fbb13a8;spdx=BSD-3-Clause \
+    file://pkg/mod/github.com/klauspost/compress@v1.18.5/LICENSE;md5=d0fd9ebda39468b51ff4539c9fbb13a8;spdx=BSD-3-Clause \
+    file://pkg/mod/github.com/klauspost/compress@v1.18.5/internal/snapref/LICENSE;md5=b8b79c7d4cda128290b98c6a21f9aac6;spdx=BSD-3-Clause \
+    file://pkg/mod/github.com/klauspost/compress@v1.18.5/zstd/internal/xxhash/LICENSE.txt;md5=802da049c92a99b4387d3f3d91b00fa9;spdx=MIT \
    file://pkg/mod/github.com/kortschak/wol@v0.0.0-20200729010619-da482cc4850a/LICENSE;md5=5a0acdb344844a21e2df8bc2e1fe5f2d;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/kr/fs@v0.1.0/LICENSE;md5=591778525c869cdde0ab5a1bf283cd81;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/mattn/go-colorable@v0.1.13/LICENSE;md5=24ce168f90aec2456a73de1839037245;spdx=MIT \
@@ -46,40 +63,40 @@ LIC_FILES_CHKSUM += " \
    file://pkg/mod/github.com/mdlayher/netlink@v1.7.3-0.20250113171957-fbb4dce95f42/LICENSE.md;md5=e08504321a9b3e86ee07433c231b33f1;spdx=MIT \
    file://pkg/mod/github.com/mdlayher/sdnotify@v1.0.0/LICENSE.md;md5=a57b2e272a0c75c413c784bb877cda50;spdx=MIT \
    file://pkg/mod/github.com/mdlayher/socket@v0.5.0/LICENSE.md;md5=bdcb2fcb7aea8a34d189ef572a59ff88;spdx=MIT \
-    file://pkg/mod/github.com/miekg/dns@v1.1.58/LICENSE;md5=b5215dfec2c591290f399a181669bef7;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/mitchellh/go-ps@v1.0.0/LICENSE.md;md5=56da355a12d4821cda57b8f23ec34bc4;spdx=MIT \
    file://pkg/mod/github.com/peterbourgon/ff/v3@v3.4.0/LICENSE;md5=e3fc50a88d0a364313df4b21ef20c29e;spdx=Apache-2.0 \
-    file://pkg/mod/github.com/pierrec/lz4/v4@v4.1.21/LICENSE;md5=09ece85f3c312a63b522bfc6ebd44943;spdx=BSD-3-Clause \
+    file://pkg/mod/github.com/pierrec/lz4/v4@v4.1.25/LICENSE;md5=09ece85f3c312a63b522bfc6ebd44943;spdx=BSD-3-Clause \
+    file://pkg/mod/github.com/pires/go-proxyproto@v0.8.1/LICENSE;md5=ebfe2201eab4c067477cc534908ac12f;spdx=Apache-2.0 \
    file://pkg/mod/github.com/pkg/sftp@v1.13.6/LICENSE;md5=452fc5cc5a9127a0e828d73423d45035;spdx=BSD-2-Clause \
    file://pkg/mod/github.com/safchain/ethtool@v0.3.0/LICENSE;md5=fa818a259cbed7ce8bc2a22d35a464fc;spdx=Apache-2.0 \
    file://pkg/mod/github.com/skip2/go-qrcode@v0.0.0-20200617195104-da1b6568686e/LICENSE;md5=515c25e1450ede2834397875c18439d4;spdx=MIT \
-    file://pkg/mod/github.com/tailscale/goupnp@v1.0.1-0.20210804011211-c64d0f06ea05/LICENSE;md5=3d7eee8afacfccb446c1ac30289c965d;spdx=BSD-2-Clause \
+    file://pkg/mod/github.com/tailscale/gliderssh@v0.3.4-0.20260330083525-c1389c70ff89/LICENSE;md5=ac631f842784b8ec269293a49121236b;spdx=BSD-3-Clause \
-    file://pkg/mod/github.com/tailscale/hujson@v0.0.0-20221223112325-20486734a56a/LICENSE;md5=073f7ac93b9172ac4e1d258584fc0271;spdx=BSD-3-Clause \
+    file://pkg/mod/github.com/tailscale/hujson@v0.0.0-20260302212456-ecc657c15afd/LICENSE;md5=073f7ac93b9172ac4e1d258584fc0271;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/tailscale/netlink@v1.1.1-0.20240822203006-4d49adab4de7/LICENSE;md5=2ade771c7d7211af507864e8dd520529;spdx=Apache-2.0 \
    file://pkg/mod/github.com/tailscale/peercred@v0.0.0-20250107143737-35a0c7bd7edc/LICENSE;md5=94eaeed21686fd9816f57f86b9914071;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/tailscale/web-client-prebuilt@v0.0.0-20250124233751-d4cd19a26976/LICENSE;md5=a672713a9eb730050e491c92edf7984d;spdx=BSD-3-Clause \
-    file://pkg/mod/github.com/tailscale/wireguard-go@v0.0.0-20250304000100-91a0587fb251/LICENSE;md5=995598bc9de2b4c987c2cb87fc24f341;spdx=MIT \
+    file://pkg/mod/github.com/tailscale/wireguard-go@v0.0.0-20260427181203-e3ac4a0afb4e/LICENSE;md5=995598bc9de2b4c987c2cb87fc24f341;spdx=MIT \
    file://pkg/mod/github.com/tailscale/xnet@v0.0.0-20240729143630-8497ac4dab2e/LICENSE;md5=5d4950ecb7b26d2c5e4e7b4e0dd74707;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/toqueteos/webbrowser@v1.2.0/LICENSE.md;md5=6072d29ffa4b14338ff8fd68f17f6851;spdx=MIT \
    file://pkg/mod/github.com/u-root/u-root@v0.14.0/LICENSE;md5=bf431bf303eaf01f17bef6624d9f2208;spdx=BSD-3-Clause \
    file://pkg/mod/github.com/u-root/uio@v0.0.0-20240224005618-d2acac8f3701/LICENSE;md5=52bf39fc1e426b6459f5c9a142e5bfbd;spdx=BSD-3-Clause \
-    file://pkg/mod/github.com/vishvananda/netns@v0.0.4/LICENSE;md5=2ade771c7d7211af507864e8dd520529;spdx=Apache-2.0 \
+    file://pkg/mod/github.com/vishvananda/netns@v0.0.5/LICENSE;md5=2ade771c7d7211af507864e8dd520529;spdx=Apache-2.0 \
    file://pkg/mod/github.com/x448/float16@v0.8.4/LICENSE;md5=de8f8e025d57fe7ee0b67f30d571323b;spdx=MIT \
+    file://pkg/mod/go.yaml.in/yaml/v2@v2.4.2/LICENSE;md5=e3fc50a88d0a364313df4b21ef20c29e;spdx=Apache-2.0 \
    file://pkg/mod/go4.org/mem@v0.0.0-20240501181205-ae6ca9944745/LICENSE;md5=fa818a259cbed7ce8bc2a22d35a464fc;spdx=Apache-2.0 \
    file://pkg/mod/go4.org/netipx@v0.0.0-20231129151722-fdeea329fbba/LICENSE;md5=628df198dc9e033b86b8eedff039ff86;spdx=BSD-3-Clause \
-    file://pkg/mod/golang.org/x/crypto@v0.37.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
+    file://pkg/mod/golang.org/x/crypto@v0.50.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
-    file://pkg/mod/golang.org/x/exp@v0.0.0-20250210185358-939b2ce775ac/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
+    file://pkg/mod/golang.org/x/exp@v0.0.0-20250620022241-b7579e27df2b/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
-    file://pkg/mod/golang.org/x/net@v0.36.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
+    file://pkg/mod/golang.org/x/image@v0.27.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
-    file://pkg/mod/golang.org/x/oauth2@v0.26.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
+    file://pkg/mod/golang.org/x/net@v0.53.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
-    file://pkg/mod/golang.org/x/sync@v0.13.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
+    file://pkg/mod/golang.org/x/oauth2@v0.36.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
-    file://pkg/mod/golang.org/x/sys@v0.32.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
+    file://pkg/mod/golang.org/x/sync@v0.20.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
-    file://pkg/mod/golang.org/x/term@v0.31.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
+    file://pkg/mod/golang.org/x/sys@v0.43.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
-    file://pkg/mod/golang.org/x/text@v0.24.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
+    file://pkg/mod/golang.org/x/term@v0.42.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
-    file://pkg/mod/golang.org/x/time@v0.10.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
+    file://pkg/mod/golang.org/x/text@v0.36.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
-    file://pkg/mod/gvisor.dev/gvisor@v0.0.0-20250205023644-9414b50a5633/LICENSE;md5=fbbaf7613c100c84b8f20701859dee2d;spdx=MIT+%26+Apache-2.0 \
+    file://pkg/mod/golang.org/x/time@v0.12.0/LICENSE;md5=7998cb338f82d15c0eff93b7004d272a;spdx=BSD-3-Clause \
-    file://pkg/mod/k8s.io/client-go@v0.32.0/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
+    file://pkg/mod/gvisor.dev/gvisor@v0.0.0-20260224225140-573d5e7127a8/LICENSE;md5=e566fe37b81dd469e93876dc021ca01c;spdx=Apache-2.0 \
-    file://pkg/mod/sigs.k8s.io/yaml@v1.4.0/LICENSE;md5=b5d30dd5bc47d1b56b678ac06dead1c7;spdx=MIT+%26+Apache-2.0+%26+BSD-3-Clause \
+    file://pkg/mod/k8s.io/client-go@v0.34.0/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57;spdx=Apache-2.0 \
+    file://pkg/mod/sigs.k8s.io/yaml@v1.6.0/LICENSE;md5=b5d30dd5bc47d1b56b678ac06dead1c7;spdx=BSD-3-Clause \
    file://pkg/mod/software.sslmate.com/src/go-pkcs12@v0.4.0/LICENSE;md5=259f3802525423b1a33efb1b85f64e18;spdx=BSD-3-Clause \
 "
-LICENSE += " & Apache-2.0 & BSD-2-Clause & BSD-3-Clause & ISC & MIT"
diff --git a/meta-networking/recipes-connectivity/tailscale/tailscale_1.84.3.bb b/meta-networking/recipes-connectivity/tailscale/tailscale_1.98.3.bb
index 33ae1925d5..a352c5cf58 100644
--- a/meta-networking/recipes-connectivity/tailscale/tailscale_1.84.3.bb
+++ b/meta-networking/recipes-connectivity/tailscale/tailscale_1.98.3.bb
@@ -4,7 +4,7 @@ HOMEPAGE = "https://github.com/tailscale/tailscale"
 SECTION = "networking"
 LICENSE = "BSD-3-Clause"
-LIC_FILES_CHKSUM = "file://src/${GO_IMPORT}/LICENSE;md5=a672713a9eb730050e491c92edf7984d"
+LIC_FILES_CHKSUM = "file://src/${GO_IMPORT}/LICENSE;md5=cadeae10a8856ddfdb129866b75b33e3"
 require ${BPN}-licenses.inc
 MAJOR_MINOR = "${@oe.utils.trim_version('${PV}', 2)}"
@@ -12,7 +12,7 @@ SRC_URI = "git://github.com/tailscale/tailscale.git;protocol=https;branch=releas
           file://default \
           file://tailscaled.init \
           "
-SRCREV = "7648989bc54738b1e40dde74fa822984a63cbc05"
+SRCREV = "8f2c8d6a14419e95fb9d02d6bf6113893daef5c3"
 SRCREV_SHORT = "${@d.getVar('SRCREV')[:8]}"
 require ${BPN}-go-mods.inc
@@ -22,7 +22,10 @@ GO_LINKSHARED = ""
 GOBUILDFLAGS:prepend = "-tags=${@','.join(d.getVar('PACKAGECONFIG_CONFARGS').split())} "
 GO_EXTRA_LDFLAGS = "-X tailscale.com/version.longStamp=${PV}-${SRCREV_SHORT} -X tailscale.com/version.shortStamp=${PV}"
-inherit go-mod \
+# Pass build tags so go list in update-modules discovers all conditional deps
+export GOFLAGS = "-tags=${@','.join(d.getVar('PACKAGECONFIG_CONFARGS').split())}"
+inherit go-mod go-mod-update-modules \
    ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'update-rc.d', '', d)} \
    ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', '', d)}
diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.8.4.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
index f16c8c1e68..2978ff1cc1 100644
--- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.8.4.bb
+++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
@@ -17,7 +17,7 @@ SRC_URI = " \
    file://run-ptest \
 "
-SRCREV = "59f4fa568615396fbf381b073b220d1e8d61e4c2"
+SRCREV = "1d363f3adceba9d1478230ede476a37b0dcdef24"
 inherit autotools ptest
@@ -47,5 +47,25 @@ do_install_ptest() {
    cp -rf ${S}/tests  ${D}${PTEST_PATH}
 }
-CVE_STATUS[CVE-2025-11931] = "fixed-version: The currently used version (5.8.4) contains the fix already."
+CVE_STATUS[CVE-2026-0819] = "fixed-version: fixed in 5.9.0"
-CVE_STATUS[CVE-2025-12889] = "fixed-version: The currently used version (5.8.4) contains the fix already."
+CVE_STATUS[CVE-2026-2646] = "fixed-version: fixed in 5.9.0"
+CVE_STATUS[CVE-2026-3503] = "fixed-version: fixed in 5.9.0"
+CVE_STATUS[CVE-2026-3548] = "fixed-version: fixed in 5.9.0"
+CVE_STATUS[CVE-2026-5188] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5194] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5263] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5264] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5392] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5393] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5446] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5447] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5448] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5460] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5466] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5479] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5500] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5503] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5504] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5507] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5772] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5778] = "fixed-version: fixed in 5.9.1"
diff --git a/meta-networking/recipes-core/packagegroups/packagegroup-meta-networking.bb b/meta-networking/recipes-core/packagegroups/packagegroup-meta-networking.bb
index cc0445aaed..21c9dce4e1 100644
--- a/meta-networking/recipes-core/packagegroups/packagegroup-meta-networking.bb
+++ b/meta-networking/recipes-core/packagegroups/packagegroup-meta-networking.bb
@@ -216,7 +216,6 @@ RDEPENDS:packagegroup-meta-networking-support = "\
    ndisc6 \
    tcpdump \
    tcpslice \
-    netcf \
    tnftp \
    traceroute \
    tunctl \
diff --git a/meta-networking/recipes-daemons/atftp/atftp_0.8.0.bb b/meta-networking/recipes-daemons/atftp/atftp_0.8.1.bb
index 9db0aebccb..ecd55684f5 100644
--- a/meta-networking/recipes-daemons/atftp/atftp_0.8.0.bb
+++ b/meta-networking/recipes-daemons/atftp/atftp_0.8.1.bb
@@ -2,9 +2,9 @@ SUMMARY = "Advanced TFTP server and client"
 SECTION = "net"
 HOMEPAGE = "http://packages.debian.org/atftp"
 LICENSE = "GPL-2.0-only"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=f65159f73e603f89d6867d43191900e5"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=570a9b3749dd0463a1778803b12a6dce"
-SRCREV = "d5c27eb7a9695d83569767e27ef69674173db39a"
+SRCREV = "7238b7b6753157d0c4ad739df3d87a958f78d70b"
 SRC_URI = "git://git.code.sf.net/p/atftp/code;branch=master;protocol=https \
           file://atftpd.init \
diff --git a/meta-networking/recipes-daemons/igmpproxy/igmpproxy_0.3.bb b/meta-networking/recipes-daemons/igmpproxy/igmpproxy_0.4.bb
index e8567ccebf..df1e8f27e1 100644
--- a/meta-networking/recipes-daemons/igmpproxy/igmpproxy_0.3.bb
+++ b/meta-networking/recipes-daemons/igmpproxy/igmpproxy_0.4.bb
@@ -5,8 +5,7 @@ LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://COPYING;md5=432040ff3a55670c1dec0c32b209ad69"
 SRC_URI = "https://github.com/pali/igmpproxy/releases/download/${PV}/${BP}.tar.gz"
-SRC_URI[md5sum] = "5565874d9631103109a72452cecb5ce7"
+SRC_URI[sha256sum] = "afa4b75a823b82f71ce99f33eae4e8136b906ae8a5ede5caaad93bac38cdae24"
-SRC_URI[sha256sum] = "d1fc244cb2fbbf99f720bda3e841fe59ece9b6919073790b4b892739b1b844eb"
 UPSTREAM_CHECK_URI = "https://github.com/pali/${BPN}/releases"
diff --git a/meta-networking/recipes-daemons/lldpd/lldpd_1.0.20.bb b/meta-networking/recipes-daemons/lldpd/lldpd_1.0.22.bb
index 044f1e0745..635d54931d 100644
--- a/meta-networking/recipes-daemons/lldpd/lldpd_1.0.20.bb
+++ b/meta-networking/recipes-daemons/lldpd/lldpd_1.0.22.bb
@@ -12,7 +12,7 @@ SRC_URI = "\
    file://run-ptest \
    "
-SRC_URI[sha256sum] = "61b8cb22d4879e68f7825a2fb8e1e92abb4aba4773977cf0258bc32ed9f55450"
+SRC_URI[sha256sum] = "9587940ed2314a86774c5499f3dfb13a8eb86232a62d243a83a1f09886848e03"
 inherit autotools update-rc.d useradd systemd pkgconfig bash-completion github-releases ptest
@@ -29,7 +29,7 @@ EXTRA_OECONF += "--without-embedded-libevent \
 "
 PACKAGECONFIG ??= "cdp fdp edp sonmp lldpmed dot1 dot3"
-PACKAGECONFIG[xml] = "--with-xml,--without-xml,libxm2"
+PACKAGECONFIG[xml] = "--with-xml,--without-xml,libxml2"
 PACKAGECONFIG[snmp] = "--with-snmp,--without-snmp,net-snmp"
 PACKAGECONFIG[readline] = "--with-readline,--without-readline,readline"
 PACKAGECONFIG[seccomp] = "--with-seccomp,--without-seccomp,libseccomp"
diff --git a/meta-networking/recipes-daemons/postfix/files/0001-Fix-build-with-musl.patch b/meta-networking/recipes-daemons/postfix/files/0001-Fix-build-with-musl.patch
new file mode 100644
index 0000000000..6574db9d61
--- /dev/null
+++ b/meta-networking/recipes-daemons/postfix/files/0001-Fix-build-with-musl.patch
@@ -0,0 +1,45 @@
+From c7ea1cce7f4f83e9ff27873a96113bdb382bb296 Mon Sep 17 00:00:00 2001
+From: Yi Zhao <yi.zhao@windriver.com>
+Date: Fri, 8 May 2026 22:39:54 +0800
+Subject: [PATCH] Fix build with musl
+Guard glibc-specific version check with __GLIBC__ macro. When building
+with musl, __GLIBC__ is not defined, so the preprocessor previously fell
+through to the #else branch and defined NO_SNPRINTF, causing a build
+error:
+vbuf_print.c: In function 'vbuf_print':
+vbuf_print.c:208:46: error: macro 'VBUF_SNPRINTF' passed 5 arguments, but takes just 4
+  208 |                     VSTRING_ADDNUM(fmt, width);
+      |                                              ^
+vbuf_print.c:126:9: note: macro 'VBUF_SNPRINTF' defined here
+  126 | #define VBUF_SNPRINTF(bp, sz, fmt, arg) do { \
+      |         ^~~~~~~~~~~~~
+Wrap the entire block in #ifdef __GLIBC__ so that neither branch
+is entered on musl.
+Upstream-Status: Pending
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ src/util/sys_defs.h | 2 ++
+ 1 file changed, 2 insertions(+)
+diff --git a/src/util/sys_defs.h b/src/util/sys_defs.h
+index 09a05bd..15ea8c6 100644
+--- a/src/util/sys_defs.h
+++ b/src/util/sys_defs.h
+@@ -794,10 +794,12 @@ extern int initgroups(const char *, int);
+ #define NATIVE_NEWALIAS_PATH "/usr/bin/newaliases"
+ #define NATIVE_COMMAND_DIR "/usr/sbin"
+ #define NATIVE_DAEMON_DIR "/usr/libexec/postfix"
+#ifdef __GLIBC__
+ #if HAVE_GLIBC_API_VERSION_SUPPORT(2, 1)
+ #define SOCKADDR_SIZE  socklen_t
+ #define SOCKOPT_SIZE   socklen_t
+ #endif
+#endif
+ #ifndef NO_IPV6
+ #define HAS_IPV6
+ #if HAVE_GLIBC_API_VERSION_SUPPORT(2, 4)
diff --git a/meta-networking/recipes-daemons/postfix/files/0001-Fix-makedefs.patch b/meta-networking/recipes-daemons/postfix/files/0001-Fix-makedefs.patch
index 785fe87452..4e187849dc 100644
--- a/meta-networking/recipes-daemons/postfix/files/0001-Fix-makedefs.patch
+++ b/meta-networking/recipes-daemons/postfix/files/0001-Fix-makedefs.patch
@@ -1,4 +1,4 @@
-From e4197bc1f431fd7e555a31e6f7f1e020b4ec8f4c Mon Sep 17 00:00:00 2001
+From 51e29c0a1d98948118e5135bb817a96811105d39 Mon Sep 17 00:00:00 2001
 From: Li xin <lixin.fnst@cn.fujitsu.com>
 Date: Fri, 19 Jun 2015 16:45:54 +0900
 Subject: [PATCH] Fix makedefs
@@ -19,10 +19,10 @@ Signed-off-by: Yao Zhao <yao.zhao@windriver.com>
 1 file changed, 11 insertions(+), 16 deletions(-)
 diff --git a/makedefs b/makedefs
-index a740e41..28fb128 100644
+index d5103ce..9713327 100644
 --- a/makedefs
 +++ b/makedefs
-@@ -230,9 +230,6 @@ echo "# pie=$pie"
+@@ -232,9 +232,6 @@ echo "# pie=$pie"
 
 # Defaults for most sane systems
 
@@ -32,7 +32,7 @@ index a740e41..28fb128 100644
 ARFL=rv
 
 # Ugly function to make our error message more visible among the
-@@ -563,12 +560,12 @@ case "$SYSTEM.$RELEASE" in
+@@ -608,12 +605,12 @@ case "$SYSTEM.$RELEASE" in
                case "$CCARGS" in
                 *-DNO_DB*) ;;
                 *-DHAS_DB*) ;;
@@ -48,8 +48,8 @@ index a740e41..28fb128 100644
                    else
                        # No, we're not going to try db1 db2 db3 etc.
                        # On a properly installed system, Postfix builds
-@@ -577,12 +574,12 @@ case "$SYSTEM.$RELEASE" in
+@@ -623,12 +620,12 @@ case "$SYSTEM.$RELEASE" in
-                        echo "Install the appropriate db*-devel package first." 1>&2
+                        echo "Alternatively, build with CCARGS=\"-NO_DB ...\"" 1>&2
                        exit 1
                    fi
 -                   SYSLIBS="-ldb"
@@ -63,7 +63,7 @@ index a740e41..28fb128 100644
                    do
                        test -e $lib/lib$name.a -o -e $lib/lib$name.so && {
                            SYSLIBS="$SYSLIBS -l$name"
-@@ -602,7 +599,7 @@ case "$SYSTEM.$RELEASE" in
+@@ -648,7 +645,7 @@ case "$SYSTEM.$RELEASE" in
                       if [ `expr "X$CCARGS" : "X.*-DNO_EPOLL"` -gt 0 ]
                       then
                           :
@@ -72,7 +72,7 @@ index a740e41..28fb128 100644
                       then
                           echo CCARGS="$CCARGS -DNO_EPOLL"
                       else
-@@ -626,8 +623,6 @@ int     main(int argc, char **argv)
+@@ -672,8 +669,6 @@ int     main(int argc, char **argv)
 }
 EOF
                           ${CC-gcc} -o makedefs.test makedefs.test.c || exit 1
@@ -81,7 +81,7 @@ index a740e41..28fb128 100644
                           rm -f makedefs.test makedefs.test.[co]
                       fi;;
                esac
-@@ -644,12 +639,12 @@ EOF
+@@ -690,12 +685,12 @@ EOF
                case "$CCARGS" in
                 *-DNO_DB*) ;;
                 *-DHAS_DB*) ;;
@@ -97,8 +97,8 @@ index a740e41..28fb128 100644
                    else
                        # On a properly installed system, Postfix builds
                        # by including <db.h> and by linking with -ldb
-@@ -657,12 +652,12 @@ EOF
+@@ -705,12 +700,12 @@ EOF
-                        echo "Install the appropriate db*-devel package first." 1>&2
+                        echo "See: https://www.postfix.org/NON_BERKELEYDB_README.html#build-conf" 1>&2
                        exit 1
                    fi
 -                   SYSLIBS="-ldb"
@@ -112,6 +112,3 @@ index a740e41..28fb128 100644
                    do
                        test -e $lib/lib$name.a -o -e $lib/lib$name.so && {
                            SYSLIBS="$SYSLIBS -l$name"
-- 
-2.25.1
diff --git a/meta-networking/recipes-daemons/postfix/files/0001-makedefs-Account-for-linux-7.x-version.patch b/meta-networking/recipes-daemons/postfix/files/0001-makedefs-Account-for-linux-7.x-version.patch
new file mode 100644
index 0000000000..4bc59ace7d
--- /dev/null
+++ b/meta-networking/recipes-daemons/postfix/files/0001-makedefs-Account-for-linux-7.x-version.patch
@@ -0,0 +1,47 @@
+From 5466d510dfbc2b7a81dcf766f83d2c89066c0446 Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Mon, 11 May 2026 18:16:07 +0000
+Subject: [PATCH] makedefs: Account for linux 7.x version
+Major version has bumped to 7, update the scripts
+Upstream-Status: Backport [The latest stable version 3.11 already fixed]
+Refer:
+https://www.ftp.saix.net/MTA/postfix/index.html
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ makedefs            | 2 +-
+ src/util/sys_defs.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/makedefs b/makedefs
+index 74b103d..fe8c618 100644
+--- a/makedefs
+++ b/makedefs
+@@ -625,7 +625,7 @@ EOF
+                : ${SHLIB_ENV="LD_LIBRARY_PATH=`pwd`/lib"}
+                : ${PLUGIN_LD="${CC-gcc} -shared"}
+                ;;
+-    Linux.[3456].*)
+    Linux.[34567].*)
+                SYSTYPE=LINUX$RELEASE_MAJOR
+                case "$CCARGS" in
+                 *-DNO_DB*) ;;
+diff --git a/src/util/sys_defs.h b/src/util/sys_defs.h
+index 70aab23..c5472eb 100644
+--- a/src/util/sys_defs.h
+++ b/src/util/sys_defs.h
+@@ -763,7 +763,7 @@ extern int initgroups(const char *, int);
+   * LINUX.
+   */
+ #if defined(LINUX2) || defined(LINUX3) || defined(LINUX4) || defined(LINUX5) \
+-       || defined(LINUX6)
+       || defined(LINUX6) || defined(LINUX7)
+ #define SUPPORTED
+ #define UINT32_TYPE    unsigned int
+ #define UINT16_TYPE    unsigned short
+-- 
+2.53.0
diff --git a/meta-networking/recipes-daemons/postfix/files/0002-Change-fixed-postconf-to-a-variable-for-cross-compil.patch b/meta-networking/recipes-daemons/postfix/files/0002-Change-fixed-postconf-to-a-variable-for-cross-compil.patch
index d46efb95cb..a74c46fa92 100644
--- a/meta-networking/recipes-daemons/postfix/files/0002-Change-fixed-postconf-to-a-variable-for-cross-compil.patch
+++ b/meta-networking/recipes-daemons/postfix/files/0002-Change-fixed-postconf-to-a-variable-for-cross-compil.patch
@@ -1,4 +1,4 @@
-From 953719878466c55572294f42e85127bda5d34999 Mon Sep 17 00:00:00 2001
+From ce8deeaac8ca5d7329e1923790a1f35798953799 Mon Sep 17 00:00:00 2001
 From: Li xin <lixin.fnst@cn.fujitsu.com>
 Date: Fri, 19 Jun 2015 17:14:58 +0900
 Subject: [PATCH] Change fixed postconf to a variable for cross-compiling
@@ -12,10 +12,10 @@ Signed-off-by: Yao Zhao <yao.zhao@windriver.com>
 2 files changed, 11 insertions(+), 9 deletions(-)
 diff --git a/Makefile.in b/Makefile.in
-index a37f89f..17cb64b 100644
+index 8d7501a..d2a85e8 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -22,7 +22,7 @@ META  = meta/main.cf.proto meta/master.cf.proto meta/postfix-files \
+@@ -23,7 +23,7 @@ META  = meta/main.cf.proto meta/master.cf.proto meta/postfix-files \
 EXPAND = sed -e "s;\$${LIB_PREFIX};$(LIB_PREFIX);" \
            -e "s;\$${LIB_SUFFIX};$(LIB_SUFFIX);"
 SHLIB_DIR_OVERRIDE = \
@@ -102,6 +102,3 @@ index 563ee27..00d4651 100644
     "daemon_directory = $daemon_directory" \
     "data_directory = $data_directory" \
     "command_directory = $command_directory" \
-- 
-2.25.1
diff --git a/meta-networking/recipes-daemons/postfix/files/0003-makedefs-Use-native-compiler-to-build-makedefs.test.patch b/meta-networking/recipes-daemons/postfix/files/0003-makedefs-Use-native-compiler-to-build-makedefs.test.patch
index 6f8e3e84da..201b4741de 100644
--- a/meta-networking/recipes-daemons/postfix/files/0003-makedefs-Use-native-compiler-to-build-makedefs.test.patch
+++ b/meta-networking/recipes-daemons/postfix/files/0003-makedefs-Use-native-compiler-to-build-makedefs.test.patch
@@ -1,4 +1,4 @@
-From a8ec63a71361ccd3f6d2959c4c87b7824282b291 Mon Sep 17 00:00:00 2001
+From fc51d9145210350577fdb29a9b0680df779ae347 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sat, 26 Aug 2017 10:29:37 -0700
 Subject: [PATCH] makedefs: Use native compiler to build makedefs.test
@@ -13,10 +13,10 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
 1 file changed, 5 insertions(+), 5 deletions(-)
 diff --git a/makedefs b/makedefs
-index 28fb128..313b401 100644
+index 9713327..e879832 100644
 --- a/makedefs
 +++ b/makedefs
-@@ -622,7 +622,7 @@ int     main(int argc, char **argv)
+@@ -668,7 +668,7 @@ int     main(int argc, char **argv)
     exit(0);
 }
 EOF
@@ -25,7 +25,7 @@ index 28fb128..313b401 100644
                           rm -f makedefs.test makedefs.test.[co]
                       fi;;
                esac
-@@ -865,7 +865,7 @@ int     main(int argc, char **argv)
+@@ -914,7 +914,7 @@ int     main(int argc, char **argv)
     exit(0);
 }
 EOF
@@ -34,7 +34,7 @@ index 28fb128..313b401 100644
                   ./makedefs.test 2>/dev/null ||
                        CCARGS="$CCARGS -DNO_SIGSETJMP"
                   rm -f makedefs.test makedefs.test.[co]
-@@ -903,7 +903,7 @@ int main(int argc, char **argv)
+@@ -952,7 +952,7 @@ int main(int argc, char **argv)
                                  &error) != 14);
 }
 EOF
@@ -43,7 +43,7 @@ index 28fb128..313b401 100644
                        $icu_ldflags >/dev/null 2>&1
                    if ./makedefs.test 2>/dev/null ; then
                        CCARGS="$CCARGS $icu_cppflags"
-@@ -1024,7 +1024,7 @@ int     main(void)
+@@ -1088,7 +1088,7 @@ int     main(void)
     exit(ferror(stdout) ? 1 : 0);
 }
 EOF
@@ -52,7 +52,7 @@ index 28fb128..313b401 100644
     ./makedefs.test || exit 1
     rm -f makedefs.test makedefs.test.[co]
 }
-@@ -1180,7 +1180,7 @@ int     main(void)
+@@ -1245,7 +1245,7 @@ int     main(void)
     exit(ferror(stdout) ? 1 : 0);
 }
 EOF
@@ -61,6 +61,3 @@ index 28fb128..313b401 100644
        parm_val=`./makedefs.test` || exit 1
        rm -f makedefs.test makedefs.test.[co]
        eval ${parm_name}=\""\$parm_val"\"
-- 
-2.25.1
diff --git a/meta-networking/recipes-daemons/postfix/files/0004-Fix-icu-config.patch b/meta-networking/recipes-daemons/postfix/files/0004-Fix-icu-config.patch
index 0660ee098e..daf5c7089e 100644
--- a/meta-networking/recipes-daemons/postfix/files/0004-Fix-icu-config.patch
+++ b/meta-networking/recipes-daemons/postfix/files/0004-Fix-icu-config.patch
@@ -1,4 +1,4 @@
-From 404150f53bb49af987d7338a808f47fdbd50ba7f Mon Sep 17 00:00:00 2001
+From b63facf538af99e7c79ebee8d41abd52e7d5ee5e Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sun, 16 Jan 2022 11:21:54 +0800
 Subject: [PATCH] Fix icu config
@@ -18,10 +18,10 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
 1 file changed, 1 deletion(-)
 diff --git a/makedefs b/makedefs
-index 313b401..e5db212 100644
+index e879832..f9c132e 100644
 --- a/makedefs
 +++ b/makedefs
-@@ -906,7 +906,6 @@ EOF
+@@ -955,7 +955,6 @@ EOF
                    ${BUILD_CC-gcc} -o makedefs.test makedefs.test.c $icu_cppflags \
                        $icu_ldflags >/dev/null 2>&1
                    if ./makedefs.test 2>/dev/null ; then
@@ -29,6 +29,3 @@ index 313b401..e5db212 100644
                        SYSLIBS="$SYSLIBS $icu_ldflags"
                    else
                        CCARGS="$CCARGS -DNO_EAI"
-- 
-2.25.1
diff --git a/meta-networking/recipes-daemons/postfix/files/0005-makedefs-add-lnsl-and-lresolv-to-SYSLIBS-by-default.patch b/meta-networking/recipes-daemons/postfix/files/0005-makedefs-add-lnsl-and-lresolv-to-SYSLIBS-by-default.patch
index 1571aa844d..c2e640d6ff 100644
--- a/meta-networking/recipes-daemons/postfix/files/0005-makedefs-add-lnsl-and-lresolv-to-SYSLIBS-by-default.patch
+++ b/meta-networking/recipes-daemons/postfix/files/0005-makedefs-add-lnsl-and-lresolv-to-SYSLIBS-by-default.patch
@@ -1,4 +1,4 @@
-From 25e7d1a9bc64f39666eb0e2b9b175773615e28d2 Mon Sep 17 00:00:00 2001
+From fb5b16db0282b5d80edb0ccc6f0f197a7f663610 Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Fri, 12 Oct 2018 12:38:02 +0800
 Subject: [PATCH] makedefs: add -lnsl and -lresolv to SYSLIBS by default
@@ -14,10 +14,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 1 file changed, 2 insertions(+), 20 deletions(-)
 diff --git a/makedefs b/makedefs
-index e5db212..b00049b 100644
+index f9c132e..5ebef5b 100644
 --- a/makedefs
 +++ b/makedefs
-@@ -577,16 +577,7 @@ case "$SYSTEM.$RELEASE" in
+@@ -623,16 +623,7 @@ case "$SYSTEM.$RELEASE" in
                    SYSLIBS="$SYSLIBS -ldb"
                    ;;
                esac
@@ -35,7 +35,7 @@ index e5db212..b00049b 100644
                # Kernel 2.4 added IPv6
                case "$RELEASE" in
                2.[0-3].*) CCARGS="$CCARGS -DNO_IPV6";;
-@@ -655,16 +646,7 @@ EOF
+@@ -703,16 +694,7 @@ EOF
                    SYSLIBS="$SYSLIBS -ldb"
                    ;;
                esac
@@ -53,6 +53,3 @@ index e5db212..b00049b 100644
                SYSLIBS="$SYSLIBS -ldl"
                : ${SHLIB_SUFFIX=.so}
                : ${SHLIB_CFLAGS=-fPIC}
-- 
-2.25.1
diff --git a/meta-networking/recipes-daemons/postfix/postfix_3.10.8.bb b/meta-networking/recipes-daemons/postfix/postfix_3.11.3.bb
index 2423e17169..0c38c743e7 100644
--- a/meta-networking/recipes-daemons/postfix/postfix_3.10.8.bb
+++ b/meta-networking/recipes-daemons/postfix/postfix_3.11.3.bb
@@ -26,9 +26,10 @@ SRC_URI = "http://ftp.porcupine.org/mirrors/postfix-release/official/postfix-${P
           file://0003-makedefs-Use-native-compiler-to-build-makedefs.test.patch \
           file://0004-Fix-icu-config.patch \
           file://0005-makedefs-add-lnsl-and-lresolv-to-SYSLIBS-by-default.patch \
+           file://0001-Fix-build-with-musl.patch \
           "
-SRC_URI[sha256sum] = "31d4b3eb8093d823b5a151f571719ff7c0462571bc95e6440d87ca525bfb096c"
+SRC_URI[sha256sum] = "bd11dcc463d7045e40f2c11cc00216489c73b58cc40b3d06c54265b088a173e1"
 UPSTREAM_CHECK_URI = "https://www.postfix.org/announcements.html"
 UPSTREAM_CHECK_REGEX = "postfix-(?P<pver>\d+(\.\d+)+)"
@@ -240,8 +241,8 @@ pkg_postinst_ontarget:${PN}-cfg () {
 }
 PACKAGES =+ "${PN}-cfg"
-RDEPENDS:${PN}-cfg:class-target += "${PN}-bin"
+RDEPENDS:${PN}-cfg:append:class-target = " ${PN}-bin"
-RDEPENDS:${PN}:class-target += "${PN}-cfg"
+RDEPENDS:${PN}:append:class-target = " ${PN}-cfg"
 # Exclude .debug directories from the main package
 FILES:${PN}-bin += "${localstatedir} ${bindir}/* ${sbindir}/* \
               ${libexecdir}/* ${systemd_unitdir}/*"
diff --git a/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9.bb b/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9b.bb
index d64e0a0495..3da67c9e1c 100644
--- a/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9.bb
+++ b/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9b.bb
@@ -4,8 +4,8 @@ HOMEPAGE = "http://www.proftpd.org"
 LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://COPYING;md5=fb0d1484d11915fa88a6a7702f1dc184"
-SRCREV = "ae25959adb05ae1d6ebfa1f36bf778c9c34e9410"
+SRCREV = "390b21555268bbc64b66d2dfa7ae40476419b80f"
-BRANCH = "${PV}"
+BRANCH = "1.3.9"
 SRC_URI = "git://github.com/proftpd/proftpd.git;branch=${BRANCH};protocol=https;tag=v${PV} \
           file://basic.conf.patch \
diff --git a/meta-networking/recipes-daemons/pure-ftpd/pure-ftpd_1.0.53.bb b/meta-networking/recipes-daemons/pure-ftpd/pure-ftpd_1.0.54.bb
index 02a10f8e84..222a0bb731 100644
--- a/meta-networking/recipes-daemons/pure-ftpd/pure-ftpd_1.0.53.bb
+++ b/meta-networking/recipes-daemons/pure-ftpd/pure-ftpd_1.0.54.bb
@@ -11,7 +11,7 @@ SRC_URI = "http://download.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-${PV}.t
           file://0001-Remove-hardcoded-usr-local-includes-from-configure.a.patch \
           file://nostrip.patch \
 "
-SRC_URI[sha256sum] = "b3f2b0194223b1e88bf8b0df9e91ffb5d1b9812356e9dd465f2f97b72b21265f"
+SRC_URI[sha256sum] = "dc9140420ec44f7829579591ff378aa6396b4604b9c6aeae847368e0f35bd7b2"
 inherit autotools
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/0001-__progname-is-provided-by-libc.patch b/meta-networking/recipes-daemons/tftp-hpa/files/0001-__progname-is-provided-by-libc.patch
deleted file mode 100644
index 66c15b5f8b..0000000000
--- a/meta-networking/recipes-daemons/tftp-hpa/files/0001-__progname-is-provided-by-libc.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 941038fc05be21202cab7a7a9434097fb55ecbe0 Mon Sep 17 00:00:00 2001
-From: Thorsten Glaser <tg@mirbsd.de>
-Date: Thu, 31 Jul 2014 16:29:41 +0930
-Subject: [PATCH] __progname[] is provided by libc
-Rename local variable to tftpd_progname to avoid a clash with glibc
-global symbols and work around Debian bug #519006 (Closes: #564052).
-[ hpa: specifically, double-underscore symbols in C are reserved for
-  the implementation, i.e. compiler/libc. ]
-Signed-off-by: Ron Lee <ron@debian.org>
-Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
---
-Upstream-Status: Pending
- tftpd/tftpd.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-diff --git a/tftpd/tftpd.c b/tftpd/tftpd.c
-index e247b97..5fec7bf 100644
--- a/tftpd/tftpd.c
-+++ b/tftpd/tftpd.c
-@@ -76,7 +76,7 @@ static int ai_fam = AF_INET;
- #define TRIES   6               /* Number of attempts to send each packet */
- #define TIMEOUT_LIMIT ((1 << TRIES)-1)
- 
-const char *__progname;
-+const char *tftpd_progname;
- static int peer;
- static unsigned long timeout  = TIMEOUT;        /* Current timeout value */
- static unsigned long rexmtval = TIMEOUT;       /* Basic timeout value */
-@@ -395,9 +395,9 @@ int main(int argc, char **argv)
-     /* basename() is way too much of a pain from a portability standpoint */
- 
-     p = strrchr(argv[0], '/');
-    __progname = (p && p[1]) ? p + 1 : argv[0];
-+    tftpd_progname = (p && p[1]) ? p + 1 : argv[0];
- 
-    openlog(__progname, LOG_PID | LOG_NDELAY, LOG_DAEMON);
-+    openlog(tftpd_progname, LOG_PID | LOG_NDELAY, LOG_DAEMON);
- 
-     srand(time(NULL) ^ getpid());
- 
-@@ -946,14 +946,14 @@ int main(int argc, char **argv)
-        syslog daemon gets restarted by the time we get here. */
-     if (secure && standalone) {
-         closelog();
-        openlog(__progname, LOG_PID | LOG_NDELAY, LOG_DAEMON);
-+        openlog(tftpd_progname, LOG_PID | LOG_NDELAY, LOG_DAEMON);
-     }
- 
- #ifdef HAVE_TCPWRAPPERS
-     /* Verify if this was a legal request for us.  This has to be
-        done before the chroot, while /etc is still accessible. */
-     request_init(&wrap_request,
-                 RQ_DAEMON, __progname,
-+                 RQ_DAEMON, tftpd_progname,
-                  RQ_FILE, fd,
-                  RQ_CLIENT_SIN, &from, RQ_SERVER_SIN, &myaddr, 0);
-     sock_methods(&wrap_request);
-- 
-2.14.1
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/0001-tftp-Mark-toplevel-definition-as-external.patch b/meta-networking/recipes-daemons/tftp-hpa/files/0001-tftp-Mark-toplevel-definition-as-external.patch
deleted file mode 100644
index 646757c783..0000000000
--- a/meta-networking/recipes-daemons/tftp-hpa/files/0001-tftp-Mark-toplevel-definition-as-external.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 2a12174a5059e84d4ff6fad8f983a4d0f2127e73 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Wed, 12 Aug 2020 12:17:31 -0700
-Subject: [PATCH] tftp: Mark toplevel definition as external
-Fixes
-multiple definition of `toplevel'; tftp.o:/usr/src/debug/tftp-hpa/5.2-r0/tftp-hpa-5.2/tftp/tftp.c:51: first defined here
-Upstream-Status: Pending
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
- tftp/tftp.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tftp/tftp.c b/tftp/tftp.c
-index 9d15022..109848c 100644
--- a/tftp/tftp.c
-+++ b/tftp/tftp.c
-@@ -48,7 +48,7 @@ extern int maxtimeout;
- #define PKTSIZE    SEGSIZE+4
- char ackbuf[PKTSIZE];
- int timeout;
-sigjmp_buf toplevel;
-+extern sigjmp_buf toplevel;
- sigjmp_buf timeoutbuf;
- 
- static void nak(int, const char *);
-- 
-2.28.0
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/0001-tftp-Remove-double-inclusion-of-signal.h.patch b/meta-networking/recipes-daemons/tftp-hpa/files/0001-tftp-Remove-double-inclusion-of-signal.h.patch
deleted file mode 100644
index 84658d667b..0000000000
--- a/meta-networking/recipes-daemons/tftp-hpa/files/0001-tftp-Remove-double-inclusion-of-signal.h.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From e9ed48d91642d384ce07cbb9bec788f07fc6354c Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Tue, 6 Sep 2022 14:51:42 -0700
-Subject: [PATCH] tftp: Remove double inclusion of signal.h
-Undefine __USE_XOPEN2K8 so we can get bsd_signal definition from system
-headers
-Upstream-Status: Pending
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
- config.h | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/config.h b/config.h
-index 3ff2915..ae1a14b 100644
--- a/config.h
-+++ b/config.h
-@@ -93,7 +93,6 @@
- #endif
- 
- #include <errno.h>
-#include <signal.h>
- 
- #ifdef HAVE_SYS_SOCKET_H
- #include <sys/socket.h>
-@@ -296,6 +295,9 @@ char *xstrdup(const char *);
- 
- #ifndef HAVE_BSD_SIGNAL
- void (*bsd_signal(int, void (*)(int))) (int);
-+#else
-+#undef __USE_XOPEN2K8
-+#include <signal.h>
- #endif
- #ifndef HAVE_DUP2
- int dup2(int, int);
-- 
-2.37.3
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/add-error-check-for-disk-filled-up.patch b/meta-networking/recipes-daemons/tftp-hpa/files/add-error-check-for-disk-filled-up.patch
index e4acd099ab..0f324a3265 100644
--- a/meta-networking/recipes-daemons/tftp-hpa/files/add-error-check-for-disk-filled-up.patch
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/add-error-check-for-disk-filled-up.patch
@@ -1,19 +1,19 @@
-From bd5773947af5ca80ca546ad5625818fc912bdd60 Mon Sep 17 00:00:00 2001
+From 0b89c5bd9723ebd5207590016a14e5f2c6a0bdc9 Mon Sep 17 00:00:00 2001
 From: "Roy.Li" <rongqing.li@windriver.com>
 Date: Thu, 22 Aug 2013 08:56:09 +0800
 Subject: [PATCH] tftp-hpa: add error check for disk filled up
-Upstream-Status: Pending [Sent to http://www.syslinux.org/archives/2013-August/020765.html]
 Add error check when the write-buffer is finally flushed to the file,
 the caller can detect if the disk filled up (or had an i/o error) and
 return a NOSAPCE nak to the other side.
+Upstream-Status: Pending [Sent to http://www.syslinux.org/archives/2013-August/020765.html]
 Signed-off-by: Ming Liu <ming.liu@windriver.com>
 Signed-off-by: Roy.Li <rongqing.li@windriver.com>
 ---
- common/tftpsubs.c |    8 +++++---
+ common/tftpsubs.c |  8 +++++---
- tftpd/tftpd.c     |   12 ++++++++++--
+ tftpd/tftpd.c     | 12 ++++++++++--
 2 files changed, 15 insertions(+), 5 deletions(-)
 diff --git a/common/tftpsubs.c b/common/tftpsubs.c
@@ -47,10 +47,10 @@ index 8c999f6..b4d4ffe 100644
 
 /* When an error has occurred, it is possible that the two sides
 diff --git a/tftpd/tftpd.c b/tftpd/tftpd.c
-index 1873e70..c2adbda 100644
+index 3158c6d..001237b 100644
 --- a/tftpd/tftpd.c
 +++ b/tftpd/tftpd.c
-@@ -1681,7 +1681,11 @@ static void tftp_recvfile(const struct formats *pf, struct tftphdr *oap, int oac
+@@ -1690,7 +1690,11 @@ static void tftp_recvfile(const struct formats *pf, struct tftphdr *oap, int oac
             syslog(LOG_WARNING, "tftpd: write(ack): %m");
             goto abort;
         }
@@ -63,7 +63,7 @@ index 1873e70..c2adbda 100644
         for (;;) {
             n = recv_time(peer, dp, PKTSIZE, 0, &r_timeout);
             if (n < 0) {        /* really? */
-@@ -1712,7 +1716,11 @@ static void tftp_recvfile(const struct formats *pf, struct tftphdr *oap, int oac
+@@ -1721,7 +1725,11 @@ static void tftp_recvfile(const struct formats *pf, struct tftphdr *oap, int oac
             goto abort;
         }
     } while (size == segsize);
@@ -77,5 +77,5 @@ index 1873e70..c2adbda 100644
 
     ap->th_opcode = htons((u_short) ACK);       /* send the "final" ack */
 -- 
-1.7.10.4
+2.34.1
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/fix-writing-emtpy-file.patch b/meta-networking/recipes-daemons/tftp-hpa/files/fix-writing-emtpy-file.patch
index 4f3dcd7767..0b235361c5 100644
--- a/meta-networking/recipes-daemons/tftp-hpa/files/fix-writing-emtpy-file.patch
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/fix-writing-emtpy-file.patch
@@ -1,6 +1,7 @@
-[PATCH] fix the empty file writting
+From 1ce974f1cf6afbc528c941a8cdf0817a3fd7c5a7 Mon Sep 17 00:00:00 2001
+From: "Roy.Li" <rongqing.li@windriver.com>
-Upstream-Status: Pending
+Date: Mon, 30 Mar 2026 22:37:22 +0800
+Subject: [PATCH] fix the empty file writting
 With the feature that checking the disk filled up, the return
 value of function write_behind was checked and used to detect
@@ -11,13 +12,15 @@ error was miss-raised.
 make write_behind to return 0 if written file is empty, to fix
 the this bug.
+Upstream-Status: Pending
 Signed-off-by: Roy.Li <rongqing.li@windriver.com>
 ---
 common/tftpsubs.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
 diff --git a/common/tftpsubs.c b/common/tftpsubs.c
-index b4ea3f2..9f6cafc 100644
+index b4ea3f2..30e749a 100644
 --- a/common/tftpsubs.c
 +++ b/common/tftpsubs.c
 @@ -198,9 +198,12 @@ int write_behind(FILE * file, int convert)
@@ -35,5 +38,5 @@ index b4ea3f2..9f6cafc 100644
         return write(fileno(file), buf, count);
 
 -- 
-1.9.1
+2.34.1
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.40-remap.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.40-remap.patch
index 3f690609a6..837d2f7d08 100644
--- a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.40-remap.patch
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.40-remap.patch
@@ -1,6 +1,6 @@
 Patch originally from Fedora
-http://pkgs.fedoraproject.org/cgit/tftp.git/
+https://src.fedoraproject.org/rpms/tftp.git
 Upstream-Status: Pending
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.42-tftpboot.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.42-tftpboot.patch
index 98a86b78b0..8a30194f4b 100644
--- a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.42-tftpboot.patch
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.42-tftpboot.patch
@@ -1,6 +1,6 @@
 Patch originally from Fedora
-http://pkgs.fedoraproject.org/cgit/tftp.git/
+https://src.fedoraproject.org/rpms/tftp.git
 Upstream-Status: Pending
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.49-chk_retcodes.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.49-chk_retcodes.patch
index 7ae1a87220..fae887427f 100644
--- a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.49-chk_retcodes.patch
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.49-chk_retcodes.patch
@@ -1,6 +1,6 @@
 Patch originally from Fedora
-http://pkgs.fedoraproject.org/cgit/tftp.git/
+https://src.fedoraproject.org/rpms/tftp.git
 Upstream-Status: Pending
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.39-tzfix.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.39-tzfix.patch
index 85110eb285..3a3a292e2e 100644
--- a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.39-tzfix.patch
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.39-tzfix.patch
@@ -1,6 +1,6 @@
 Patch originally from Fedora
-http://pkgs.fedoraproject.org/cgit/tftp.git/
+https://src.fedoraproject.org/rpms/tftp.git
 Upstream-Status: Pending
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch
index 08d2b5b7d6..42fddfd0ca 100644
--- a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch
@@ -1,6 +1,6 @@
 Patch originally from Fedora
-http://pkgs.fedoraproject.org/cgit/tftp.git/
+https://src.fedoraproject.org/rpms/tftp.git
 Upstream-Status: Pending
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-stats.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-stats.patch
index 720cd69dec..f646ec5afe 100644
--- a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-stats.patch
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-stats.patch
@@ -1,6 +1,6 @@
 Patch originally from Fedora
-http://pkgs.fedoraproject.org/cgit/tftp.git/
+https://src.fedoraproject.org/rpms/tftp.git
 Upstream-Status: Pending
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-5.2-pktinfo.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-5.2-pktinfo.patch
deleted file mode 100644
index 216349d26f..0000000000
--- a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-5.2-pktinfo.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-Patch originally from Fedora
-http://pkgs.fedoraproject.org/cgit/tftp.git/
-Upstream-Status: Pending
-diff -up tftp-hpa-5.2/tftpd/recvfrom.c.test tftp-hpa-5.2/tftpd/recvfrom.c
--- tftp-hpa-5.2/tftpd/recvfrom.c.test  2011-12-11 23:13:52.000000000 +0100
-+++ tftp-hpa-5.2/tftpd/recvfrom.c       2012-01-04 10:05:17.852042256 +0100
-@@ -149,16 +149,16 @@ myrecvfrom(int s, void *buf, int len, un
- 
-     /* Try to enable getting the return address */
- #ifdef IP_RECVDSTADDR
-    if (from->sa_family == AF_INET)
-+    if (from->sa_family == AF_INET || !from->sa_family)
-         setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR, &on, sizeof(on));
- #endif
- #ifdef IP_PKTINFO
-    if (from->sa_family == AF_INET)
-+    if (from->sa_family == AF_INET || !from->sa_family)
-         setsockopt(s, IPPROTO_IP, IP_PKTINFO, &on, sizeof(on));
- #endif
- #ifdef HAVE_IPV6
- #ifdef IPV6_RECVPKTINFO
-    if (from->sa_family == AF_INET6)
-+    if (from->sa_family == AF_INET6 || !from->sa_family)
-         setsockopt(s, IPPROTO_IPV6, IPV6_RECVPKTINFO, &on, sizeof(on));
- #endif
- #endif
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.49-cmd_arg.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-5.3-cmd_arg.patch
index 6b8ceaaeba..3571137ce1 100644
--- a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-0.49-cmd_arg.patch
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-5.3-cmd_arg.patch
@@ -1,34 +1,23 @@
 Patch originally from Fedora
-http://pkgs.fedoraproject.org/cgit/tftp.git/
+https://src.fedoraproject.org/rpms/tftp.git
 Upstream-Status: Pending
-diff -up tftp-hpa-0.49/config.h.cmd_arg tftp-hpa-0.49/config.h
+diff -up tftp-hpa-5.3/config.h.cmd_arg tftp-hpa-5.3/config.h
--- tftp-hpa-0.49/config.h.cmd_arg      2010-04-19 15:29:10.567331454 +0200
+--- tftp-hpa-5.3/config.h.cmd_arg       2024-05-30 00:40:13.000000000 +0200
-+++ tftp-hpa-0.49/config.h      2010-04-20 07:33:03.133232772 +0200
+++ tftp-hpa-5.3/config.h       2025-12-26 22:27:30.933202754 +0100
-@@ -291,6 +291,7 @@ typedef int socklen_t;
+@@ -277,6 +277,7 @@ typedef int socklen_t;
 /* Prototypes for libxtra functions */
 
 void *xmalloc(size_t);
 +void *xrealloc(void *, size_t);
 char *xstrdup(const char *);
 
- #ifndef HAVE_BSD_SIGNAL
+ #ifndef HAVE_SIGHANDLER_T
-diff -up tftp-hpa-0.49/configure.in.cmd_arg tftp-hpa-0.49/configure.in
+diff -up tftp-hpa-5.3/lib/xrealloc.c.cmd_arg tftp-hpa-5.3/lib/xrealloc.c
--- tftp-hpa-0.49/configure.in.cmd_arg  2008-10-21 00:08:31.000000000 +0200
+--- tftp-hpa-5.3/lib/xrealloc.c.cmd_arg 2025-12-26 22:19:59.751870026 +0100
-+++ tftp-hpa-0.49/configure.in  2010-04-19 11:05:12.387340698 +0200
+++ tftp-hpa-5.3/lib/xrealloc.c 2025-12-26 22:19:59.751870026 +0100
-@@ -152,6 +152,7 @@ OBJROOT=`pwd`
- 
- XTRA=false
- PA_SEARCH_LIBS_AND_ADD(xmalloc, iberty)
-+PA_SEARCH_LIBS_AND_ADD(xrealloc, iberty)
- PA_SEARCH_LIBS_AND_ADD(xstrdup, iberty)
- PA_SEARCH_LIBS_AND_ADD(bsd_signal, bsd, bsdsignal)
- PA_SEARCH_LIBS_AND_ADD(getopt_long, getopt, getopt_long)
-diff -up tftp-hpa-0.49/lib/xrealloc.c.cmd_arg tftp-hpa-0.49/lib/xrealloc.c
--- tftp-hpa-0.49/lib/xrealloc.c.cmd_arg        2010-04-19 11:05:12.387340698 +0200
-+++ tftp-hpa-0.49/lib/xrealloc.c        2010-04-19 11:05:12.387340698 +0200
 @@ -0,0 +1,20 @@
 +/*
 + * xrealloc.c
@@ -50,9 +39,9 @@ diff -up tftp-hpa-0.49/lib/xrealloc.c.cmd_arg tftp-hpa-0.49/lib/xrealloc.c
 +
 +    return p;
 +}
-diff -up tftp-hpa-0.49/tftp/main.c.cmd_arg tftp-hpa-0.49/tftp/main.c
+diff -up tftp-hpa-5.3/tftp/main.c.cmd_arg tftp-hpa-5.3/tftp/main.c
--- tftp-hpa-0.49/tftp/main.c.cmd_arg   2008-10-21 00:08:31.000000000 +0200
+--- tftp-hpa-5.3/tftp/main.c.cmd_arg    2024-05-30 00:40:13.000000000 +0200
-+++ tftp-hpa-0.49/tftp/main.c   2010-04-19 11:05:12.389329337 +0200
+++ tftp-hpa-5.3/tftp/main.c    2025-12-26 22:19:59.752870023 +0100
 @@ -89,11 +89,14 @@ int connected;
 const struct modes *mode;
 #ifdef WITH_READLINE
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-5.3-pktinfo.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-5.3-pktinfo.patch
new file mode 100644
index 0000000000..02e88aed36
--- /dev/null
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-5.3-pktinfo.patch
@@ -0,0 +1,29 @@
+Patch originally from Fedora
+https://src.fedoraproject.org/rpms/tftp.git
+Upstream-Status: Pending
+diff -up tftp-hpa-5.3/tftpd/recvfrom.c.pktinfo tftp-hpa-5.3/tftpd/recvfrom.c
+--- tftp-hpa-5.3/tftpd/recvfrom.c.pktinfo       2024-05-30 00:40:13.000000000 +0200
+++ tftp-hpa-5.3/tftpd/recvfrom.c       2025-12-26 22:30:37.142522362 +0100
+@@ -170,16 +170,16 @@ myrecvfrom(int s, void *buf, int len, un
+ 
+     /* Try to enable getting the return address */
+ #ifdef IP_RECVDSTADDR
+-    if (from->sa.sa_family == AF_INET)
+    if (from->sa.sa_family == AF_INET || !from->sa.sa_family)
+         setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR, &on, sizeof(on));
+ #endif
+ #ifdef IP_PKTINFO
+-    if (from->sa.sa_family == AF_INET)
+    if (from->sa.sa_family == AF_INET || !from->sa.sa_family)
+         setsockopt(s, IPPROTO_IP, IP_PKTINFO, &on, sizeof(on));
+ #endif
+ #ifdef HAVE_IPV6
+ #ifdef IPV6_RECVPKTINFO
+-    if (from->sa.sa_family == AF_INET6)
+    if (from->sa.sa_family == AF_INET6 || !from->sa.sa_family)
+         setsockopt(s, IPPROTO_IPV6, IPV6_RECVPKTINFO, &on, sizeof(on));
+ #endif
+ #endif
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-bug-fix-on-separated-CR-and-LF.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-bug-fix-on-separated-CR-and-LF.patch
index e994f28402..f68e6369c4 100644
--- a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-bug-fix-on-separated-CR-and-LF.patch
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-bug-fix-on-separated-CR-and-LF.patch
@@ -1,4 +1,4 @@
-From 6ed1eb8829dee351b54e183bc42c007cb306aaa5 Mon Sep 17 00:00:00 2001
+From 2be04543d790d9ec29fa8522f07f221468ccd033 Mon Sep 17 00:00:00 2001
 From: Zhang Xiao <xiao.zhang@windriver.com>
 Date: Wed, 11 Jun 2014 14:01:16 +0800
 Subject: [PATCH] tftp-hpa: bug fix on separated CR and LF
@@ -34,5 +34,5 @@ index b4d4ffe..b4ea3f2 100644
         c = *p++;               /* pick up a character */
         if (prevchar == '\r') { /* if prev char was cr */
 -- 
-1.8.5.2.233.g932f7e4
+2.34.1
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-xinetd b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-xinetd
deleted file mode 100644
index fe70163966..0000000000
--- a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-xinetd
+++ /dev/null
@@ -1,18 +0,0 @@
-# default: off
-# description: The tftp server serves files using the trivial file transfer \
-#       protocol.  The tftp protocol is often used to boot diskless \
-#       workstations, download configuration files to network-aware printers, \
-#       and to start the installation process for some operating systems.
-service tftp
-{
-        socket_type             = dgram
-        protocol                = udp
-        wait                    = yes
-        user                    = root
-        server                  = /usr/sbin/in.tftpd-hpa
-        server_args             = -s /var/lib/tftpboot
-        disable                 = yes
-        per_source              = 11
-        cps                             = 100 2
-        flags                   = IPv6
-}
diff --git a/meta-networking/recipes-daemons/tftp-hpa/tftp-hpa_5.2.bb b/meta-networking/recipes-daemons/tftp-hpa/tftp-hpa_5.3.bb
index 96c9bdb653..fc7e54a160 100644
--- a/meta-networking/recipes-daemons/tftp-hpa/tftp-hpa_5.2.bb
+++ b/meta-networking/recipes-daemons/tftp-hpa/tftp-hpa_5.3.bb
@@ -5,51 +5,47 @@ booting diskless workstations.  The tftp package provides the user   \
 interface for TFTP, which allows users to transfer files to and from a \
 remote machine.  This program and TFTP provide very little security, \
 and should not be enabled unless it is expressly needed."
-DEPENDS = "readline"
+HOMEPAGE = "https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/"
 SECTION = "net"
-HOMEPAGE = "http://freecode.com/projects/tftp-hpa"
 LICENSE = "BSD-4-Clause"
 LIC_FILES_CHKSUM = "file://MCONFIG.in;beginline=1;endline=9;md5=c28ba5adb43041fae4629db05c83cbdd \
                    file://tftp/tftp.c;beginline=1;endline=32;md5=988c1cba99d70858a26cd877209857f4"
-SRC_URI = "http://kernel.org/pub/software/network/tftp/tftp-hpa/tftp-hpa-${PV}.tar.bz2 \
+SRC_URI = "git://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git;protocol=https;branch=master;tag=tftp-hpa-${PV} \
           file://tftp-0.40-remap.patch \
           file://tftp-0.42-tftpboot.patch \
           file://tftp-0.49-chk_retcodes.patch \
-           file://tftp-0.49-cmd_arg.patch \
+           file://tftp-hpa-5.3-cmd_arg.patch \
           file://tftp-hpa-0.39-tzfix.patch \
           file://tftp-hpa-0.49-fortify-strcpy-crash.patch \
           file://tftp-hpa-0.49-stats.patch \
-           file://tftp-hpa-5.2-pktinfo.patch \
+           file://tftp-hpa-5.3-pktinfo.patch \
-           file://default \
-           file://init \
           file://add-error-check-for-disk-filled-up.patch \
           file://tftp-hpa-bug-fix-on-separated-CR-and-LF.patch \
           file://fix-writing-emtpy-file.patch \
-           file://0001-__progname-is-provided-by-libc.patch \
+           file://default \
-           file://0001-tftp-Mark-toplevel-definition-as-external.patch \
+           file://init \
-           file://0001-tftp-Remove-double-inclusion-of-signal.h.patch \
           file://tftpd-hpa.socket \
           file://tftpd-hpa.service \
-"
+          "
-SRC_URI[md5sum] = "46c9bd20bbffa62f79c958c7b99aac21"
+SRCREV = "15c4f369ee741e9205dc28ce631aaf6799193b04"
-SRC_URI[sha256sum] = "0a9f88d4c1c02687b4853b02ab5dd8779d4de4ffdb9b2e5c9332841304d1a269"
 inherit autotools-brokensep update-rc.d update-alternatives systemd
-export AR = "${HOST_PREFIX}ar cq"
+DEPENDS = "readline"
-EXTRA_OECONF += "--disable-option-checking"
+EXTRA_OECONF = "--enable-largefile \
+                --enable-year2038 \
+                --with-readline \
+                --without-tcpwrappers \
+               "
 PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"
-PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6,"
+PACKAGECONFIG[ipv6] = "--with-ipv6,--without-ipv6,"
-# configure.in has errors
+CACHED_CONFIGUREVARS:libc-musl = "ac_cv_type_socklen_t=yes"
-do_configure() {
-    oe_runconf
-}
 do_install() {
    oe_runmake install INSTALLROOT=${D}
@@ -57,20 +53,25 @@ do_install() {
    mv ${D}${sbindir}/in.tftpd ${D}${sbindir}/in.tftpd-hpa
    install -m 755 -d ${D}${localstatedir}/lib/tftpboot/
-    install -d ${D}${sysconfdir}/init.d
-    install -m 0755 ${UNPACKDIR}/init ${D}${sysconfdir}/init.d/tftpd-hpa
+    if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then
-    sed -i 's!/usr/sbin/!${sbindir}/!g' ${D}${sysconfdir}/init.d/tftpd-hpa
+        install -d ${D}${sysconfdir}/default
-    sed -i 's!/etc/!${sysconfdir}/!g' ${D}${sysconfdir}/init.d/tftpd-hpa
+        install -m 0644 ${UNPACKDIR}/default ${D}${sysconfdir}/default/tftpd-hpa
-    sed -i 's!/var/!${localstatedir}/!g' ${D}${sysconfdir}/init.d/tftpd-hpa
-    sed -i 's!^PATH=.*!PATH=${base_sbindir}:${base_bindir}:${sbindir}:${bindir}!' ${D}${sysconfdir}/init.d/tftpd-hpa
+        install -d ${D}${sysconfdir}/init.d
+        install -m 0755 ${UNPACKDIR}/init ${D}${sysconfdir}/init.d/tftpd-hpa
-    install -d ${D}${sysconfdir}/default
+        sed -i 's!/usr/sbin/!${sbindir}/!g' ${D}${sysconfdir}/init.d/tftpd-hpa
-    install -m 0644 ${UNPACKDIR}/default ${D}${sysconfdir}/default/tftpd-hpa
+        sed -i 's!/etc/!${sysconfdir}/!g' ${D}${sysconfdir}/init.d/tftpd-hpa
+        sed -i 's!/var/!${localstatedir}/!g' ${D}${sysconfdir}/init.d/tftpd-hpa
-    install -d ${D}${systemd_unitdir}/system
+        sed -i 's!^PATH=.*!PATH=${base_sbindir}:${base_bindir}:${sbindir}:${bindir}!' ${D}${sysconfdir}/init.d/tftpd-hpa
-    install -m 0644 ${UNPACKDIR}/tftpd-hpa.socket ${D}${systemd_unitdir}/system
+    fi
-    install -m 0644 ${UNPACKDIR}/tftpd-hpa.service ${D}${systemd_unitdir}/system
-    sed -i -e 's,@SBINDIR@,${sbindir},g' ${D}${systemd_unitdir}/system/tftpd-hpa.service
+    if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
+        install -d ${D}${systemd_unitdir}/system
+        install -m 0644 ${UNPACKDIR}/tftpd-hpa.socket ${D}${systemd_unitdir}/system
+        install -m 0644 ${UNPACKDIR}/tftpd-hpa.service ${D}${systemd_unitdir}/system
+        sed -i -e 's,@SBINDIR@,${sbindir},g' ${D}${systemd_unitdir}/system/tftpd-hpa.service
+    fi
 }
 FILES:${PN} = "${bindir}"
@@ -92,7 +93,6 @@ ALTERNATIVE:${PN} = "tftp"
 ALTERNATIVE_TARGET[tftp] = "${bindir}/tftp-hpa"
 ALTERNATIVE_PRIORITY = "100"
 SYSTEMD_PACKAGES = "tftp-hpa-server"
 SYSTEMD_SERVICE:tftp-hpa-server = "tftpd-hpa.socket tftpd-hpa.service"
 SYSTEMD_AUTO_ENABLE:tftp-hpa-server = "enable"
diff --git a/meta-networking/recipes-daemons/vsftpd/vsftpd_3.0.5.bb b/meta-networking/recipes-daemons/vsftpd/vsftpd_3.0.5.bb
index f2c27606e1..69d97d326d 100644
--- a/meta-networking/recipes-daemons/vsftpd/vsftpd_3.0.5.bb
+++ b/meta-networking/recipes-daemons/vsftpd/vsftpd_3.0.5.bb
@@ -35,8 +35,9 @@ RDEPENDS:${PN} += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-li
 PAMLIB = "${@bb.utils.contains('DISTRO_FEATURES', 'pam', '-L${STAGING_BASELIBDIR} -lpam', '', d)}"
 NOPAM_SRC = "file://nopam.patch"
-inherit update-rc.d useradd systemd
+inherit update-rc.d useradd systemd multilib_script
+MULTILIB_SCRIPTS = "${PN}:${sysconfdir}/pam.d/vsftpd"
 CONFFILES:${PN} = "${sysconfdir}/vsftpd.conf"
 LDFLAGS:append = " -lcrypt -lcap"
 CFLAGS:append:libc-musl = " -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -include fcntl.h"
diff --git a/meta-networking/recipes-devtools/libcoap/libcoap_4.3.5a.bb b/meta-networking/recipes-devtools/libcoap/libcoap_4.3.5b.bb
index 611795e17d..7ea3eba1b0 100644
--- a/meta-networking/recipes-devtools/libcoap/libcoap_4.3.5a.bb
+++ b/meta-networking/recipes-devtools/libcoap/libcoap_4.3.5b.bb
@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=05d17535846895e23ea4c79b16a9e904"
 SRC_URI = "git://github.com/obgm/libcoap.git;branch=release-4.3.5-patches;protocol=https;tag=v${PV} \
           file://run-ptest \
           "
-SRCREV = "e3fdcdcfbd1588754fe9dd4b754ac9397260f0f9"
+SRCREV = "851533c3cf63d16984d370ce39d586ecb3694971"
 # patch releases often use alphabetical suffixes
 CVE_VERSION_SUFFIX = "alphabetical"
@@ -64,3 +64,4 @@ FILES:${PN}-bin = "${bindir}"
 FILES:${PN}-dev += "${datadir}/${BPN}/examples"
 CVE_STATUS[CVE-2025-50518] = "disputed: happens only when library is used incorrectly"
+CVE_STATUS[CVE-2026-29013] = "fixed-version: fixed in 4.3.5b"
diff --git a/meta-networking/recipes-devtools/python/python3-scapy_2.6.1.bb b/meta-networking/recipes-devtools/python/python3-scapy_2.6.1.bb
index 678aec0135..0c547a53ce 100644
--- a/meta-networking/recipes-devtools/python/python3-scapy_2.6.1.bb
+++ b/meta-networking/recipes-devtools/python/python3-scapy_2.6.1.bb
@@ -42,7 +42,7 @@ do_install_ptest() {
    # note1: if ipv6 isn't enabled, skip the related test (add '-K ipv6' argument)
    # note2: to make this test work, your ISP also must support ipv6 - the test is trying
    #        to ping google.com through ipv6.
-    if [ "${@oe.utils.all_distro_features(d, 'ipv6', 'true', 'false')}" = "false" ]; then
+    if [ -z "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}" ]; then
        sed -i 's/UTscapy.py/UTscapy.py -K ipv6/g' ${D}${PTEST_PATH}/run-ptest
    fi
 }
diff --git a/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35091.patch b/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35091.patch
new file mode 100644
index 0000000000..8afa5d6841
--- /dev/null
+++ b/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35091.patch
@@ -0,0 +1,47 @@
+From b9cb461121c8721c94a94309eb345a3c2f9ee9b4 Mon Sep 17 00:00:00 2001
+From: Jan Friesse <jfriesse@redhat.com>
+Date: Thu, 2 Apr 2026 09:00:39 +0200
+Subject: [PATCH] totemsrp: Return error if sanity check fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Previously, the check_memb_commit_token_sanity function correctly
+checked the minimum message length. However, if the message was too
+short, it incorrectly returned a success code (0) instead of the
+expected failure code (-1).
+This commit ensures the appropriate error code is returned when the
+message length sanity check fails.
+Fixes: CVE-2026-35091
+Reported-by: Sebastián Alba Vives (@Sebasteuo / 0xS4bb1) <sebasjosue84@gmail.com>
+Signed-off-by: Jan Friesse <jfriesse@redhat.com>
+Also-proposed-by: nicholasyang <nicholas.yang@suse.com>
+Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>
+CVE: CVE-2026-35091
+Upstream-Status: Backport [https://github.com/corosync/corosync/commit/a16614accfdb3481264d7281843fadf439d9ab1b]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ exec/totemsrp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/exec/totemsrp.c b/exec/totemsrp.c
+index 35bf971..94d6c21 100644
+--- a/exec/totemsrp.c
+++ b/exec/totemsrp.c
+@@ -3811,10 +3811,10 @@ static int check_memb_commit_token_sanity(
+                log_printf (instance->totemsrp_log_level_security,
+                    "Received memb_commit_token message is too short...  ignoring.");
+ 
+-               return (0);
+               return (-1);
+        }
+ 
+-       addr_entries= mct_msg->addr_entries;
+       addr_entries = mct_msg->addr_entries;
+        if (endian_conversion_needed) {
+                addr_entries = swab32(addr_entries);
+        }
diff --git a/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35092.patch b/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35092.patch
new file mode 100644
index 0000000000..8182647840
--- /dev/null
+++ b/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35092.patch
@@ -0,0 +1,57 @@
+From 8f8a4747a0223b8897deda9a40a8a099c61fa80f Mon Sep 17 00:00:00 2001
+From: Jan Friesse <jfriesse@redhat.com>
+Date: Thu, 2 Apr 2026 09:44:06 +0200
+Subject: [PATCH] totemsrp: Fix integer overflow in memb_join_sanity
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+This commit addresses an integer overflow (wraparound) vulnerability
+in the check_memb_join_sanity function.
+Previously, the 32-bit unsigned network values proc_list_entries and
+failed_list_entries were added together before being promoted to
+size_t. This allowed the addition to wrap around in 32-bit arithmetic
+(e.g., 0x80000000 + 0x80000000 = 0), resulting in a required_len
+calculation that was incorrectly small.
+The solution is to cast the list entries to size_t and verify that
+neither exceeds the maximum allowed value before the addition occurs.
+Fixes: CVE-2026-35092
+Reported-by: Sebastián Alba Vives (@Sebasteuo / 0xS4bb1) <sebasjosue84@gmail.com>
+Signed-off-by: Jan Friesse <jfriesse@redhat.com>
+Also-proposed-by: nicholasyang <nicholas.yang@suse.com>
+Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>
+CVE: CVE-2026-35092
+Upstream-Status: Backport [https://github.com/corosync/corosync/commit/4082294f5094a7591e4e00658c5a605f05d644f1]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ exec/totemsrp.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+diff --git a/exec/totemsrp.c b/exec/totemsrp.c
+index 94d6c21..6845cec 100644
+--- a/exec/totemsrp.c
+++ b/exec/totemsrp.c
+@@ -3786,7 +3786,17 @@ static int check_memb_join_sanity(
+                failed_list_entries = swab32(failed_list_entries);
+        }
+ 
+-       required_len = sizeof(struct memb_join) + ((proc_list_entries + failed_list_entries) * sizeof(struct srp_addr));
+       if (proc_list_entries > PROCESSOR_COUNT_MAX ||
+           failed_list_entries > PROCESSOR_COUNT_MAX) {
+               log_printf (instance->totemsrp_log_level_security,
+                   "Received memb_join message list_entries exceeds the maximum "
+                   "allowed value...  ignoring.");
+
+               return (-1);
+       }
+
+       required_len = sizeof(struct memb_join) +
+         (((size_t)proc_list_entries + (size_t)failed_list_entries) * sizeof(struct srp_addr));
+        if (msg_len < required_len) {
+                log_printf (instance->totemsrp_log_level_security,
+                    "Received memb_join message is too short...  ignoring.");
diff --git a/meta-networking/recipes-extended/corosync/corosync_3.1.10.bb b/meta-networking/recipes-extended/corosync/corosync_3.1.10.bb
index 07d9333ec8..77dea16e98 100644
--- a/meta-networking/recipes-extended/corosync/corosync_3.1.10.bb
+++ b/meta-networking/recipes-extended/corosync/corosync_3.1.10.bb
@@ -9,6 +9,8 @@ inherit autotools pkgconfig systemd github-releases
 SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz \
           file://corosync.conf \
+           file://CVE-2026-35091.patch \
+           file://CVE-2026-35092.patch \
           "
 SRC_URI[sha256sum] = "be361c827f99b215b3bd3fa2fb071c03dac6831c2a351963d938caef62604bc8"
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>\d+(\.\d+)+)"
diff --git a/meta-networking/recipes-filter/ebtables/ebtables_2.0.11.bb b/meta-networking/recipes-filter/ebtables/ebtables_2.0.11.bb
index be8c49854e..5e9f9ce070 100644
--- a/meta-networking/recipes-filter/ebtables/ebtables_2.0.11.bb
+++ b/meta-networking/recipes-filter/ebtables/ebtables_2.0.11.bb
@@ -21,7 +21,7 @@ SRC_URI:append:libc-musl = " file://0010-Adjust-header-include-sequence.patch"
 SRC_URI[md5sum] = "071c8b0a59241667a0044fb040d4fc72"
 SRC_URI[sha256sum] = "b71f654784a726329f88b412ef7b96b4e5d786ed2bd28193ed7b4c0d677dfd2a"
-inherit systemd autotools
+inherit systemd autotools update-alternatives
 do_install:append () {
        # Replace upstream ebtables-save perl script with Fedora bash based rewrite
@@ -49,3 +49,8 @@ FILES:${PN}-dbg += "${base_libdir}/ebtables/.debug"
 FILES:${PN} += "${base_libdir}/ebtables/*.so"
 SYSTEMD_SERVICE:${PN} = "ebtables.service"
+ALTERNATIVE:${PN} = "ebtables"
+ALTERNATIVE_LINK_NAME[ebtables] = "${sbindir}/ebtables"
+ALTERNATIVE_TARGET[ebtables] = "${sbindir}/ebtables-legacy"
+ALTERNATIVE_PRIORITY[ebtables] = "90"
diff --git a/meta-networking/recipes-filter/nftables/nftables/0001-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch b/meta-networking/recipes-filter/nftables/nftables/0001-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch
new file mode 100644
index 0000000000..f52ff28b21
--- /dev/null
+++ b/meta-networking/recipes-filter/nftables/nftables/0001-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch
@@ -0,0 +1,41 @@
+From fde27e62b241fb7d96de36a2fd6d7879c24f5de6 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Wed, 28 Jan 2026 18:31:07 +0000
+Subject: [PATCH] build: support `SOURCE_DATE_EPOCH` for build time-stamp
+In order to support reproducible builds, set the build time-stamp to the value
+of the environment variable, `SOURCE_DATE_EPOCH`, if set, and fall back to
+calling `date`, otherwise.
+Link: https://reproducible-builds.org/docs/source-date-epoch/
+Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
+Reported-by: Arnout Engelen <arnout@bzzt.net>
+Closes: https://github.com/NixOS/nixpkgs/issues/478048
+Suggested-by: Philipp Bartsch <phil@grmr.de>
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Upstream-Status: Backport [https://git.netfilter.org/nftables/commit/?id=ca86f206c92704170a295b8dc7a41f6448835dde]
+[Adjust patch for 1.1.6]
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/configure.ac b/configure.ac
+index 6825474..527049f 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -165,7 +165,7 @@ AC_CONFIG_COMMANDS([nftversion.h], [
+ ])
+ # Current date should be fetched exactly once per build,
+ # so have 'make' call date and pass the value to every 'gcc' call
+-AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
+AC_SUBST([MAKE_STAMP], ["${SOURCE_DATE_EPOCH:-$(date +%s)}"])
+ 
+ AC_ARG_ENABLE([distcheck],
+              AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
+-- 
+2.34.1
diff --git a/meta-networking/recipes-filter/nftables/nftables_1.1.6.bb b/meta-networking/recipes-filter/nftables/nftables_1.1.6.bb
index d27e60a18d..ea42b74615 100644
--- a/meta-networking/recipes-filter/nftables/nftables_1.1.6.bb
+++ b/meta-networking/recipes-filter/nftables/nftables_1.1.6.bb
@@ -12,13 +12,14 @@ DEPENDS = "libmnl libnftnl bison-native \
           ${@bb.utils.contains('PACKAGECONFIG', 'mini-gmp', '', 'gmp', d)}"
 SRC_URI = "http://www.netfilter.org/projects/nftables/files/${BP}.tar.xz \
+           file://0001-build-support-SOURCE_DATE_EPOCH-for-build-time-stamp.patch \
           file://run-ptest \
          "
 SRC_URI[sha256sum] = "372931bda8556b310636a2f9020adc710f9bab66f47efe0ce90bff800ac2530c"
-inherit autotools manpages pkgconfig ptest python3native
+inherit autotools manpages pkgconfig ptest python3native systemd
-PACKAGECONFIG ?= "python readline json"
+PACKAGECONFIG ?= "python readline json ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}"
 PACKAGECONFIG[editline] = "--with-cli=editline, , libedit, , , linenoise readline"
 PACKAGECONFIG[json] = "--with-json, --without-json, jansson"
 PACKAGECONFIG[linenoise] = "--with-cli=linenoise, , linenoise, , , editline readline"
@@ -27,10 +28,14 @@ PACKAGECONFIG[mini-gmp] = "--with-mini-gmp, --without-mini-gmp"
 PACKAGECONFIG[python] = ""
 PACKAGECONFIG[readline] = "--with-cli=readline, , readline, , , editline linenoise"
 PACKAGECONFIG[xtables] = "--with-xtables, --without-xtables, iptables"
+PACKAGECONFIG[systemd] = "--with-unitdir=${systemd_system_unitdir}, --without-unitdir"
 EXTRA_OECONF = " \
    ${@bb.utils.contains_any('PACKAGECONFIG', 'editline linenoise readline', '', '--without-cli', d)}"
+SYSTEMD_SERVICE:${PN} = "${@bb.utils.contains('PACKAGECONFIG', 'systemd', 'nftables.service', '', d)}"
+SYSTEMD_AUTO_ENABLE:${PN} = "${@bb.utils.contains('PACKAGECONFIG', 'systemd', 'disable', '', d)}"
 PEP517_SOURCE_PATH = "${S}/py"
 # xtables will need it on musl see iptables
@@ -67,7 +72,10 @@ do_install() {
    fi
 }
-RDEPENDS:${PN}-ptest += " ${PN}-python bash coreutils make iproute2 iputils-ping procps python3-core python3-ctypes python3-json python3-misc sed util-linux"
+RDEPENDS:${PN}-ptest += " \
+        bash coreutils make iproute2 iputils-ping procps python3-core python3-ctypes python3-json python3-misc sed util-linux \
+        ${@bb.utils.contains('PACKAGECONFIG', 'python', '${PN}-python', '', d)} \
+"
 # For ptests compile the kernel with CONFIG_NFT_TPROXY
diff --git a/meta-networking/recipes-irc/znc/znc_1.10.1.bb b/meta-networking/recipes-irc/znc/znc_1.10.2.bb
index 4477068bba..7793813234 100644
--- a/meta-networking/recipes-irc/znc/znc_1.10.1.bb
+++ b/meta-networking/recipes-irc/znc/znc_1.10.2.bb
@@ -6,7 +6,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 DEPENDS = "zlib"
 SRC_URI = "gitsm://github.com/znc/znc.git;branch=master;protocol=https;tag=${BP}"
-SRCREV = "29694fd26f5e9ec46731ee13bf66224181984966"
+SRCREV = "59af2206c62724eec0d8c43d3c1c0b70610ca1d9"
 inherit cmake pkgconfig
diff --git a/meta-networking/recipes-protocols/dante/dante_1.4.4.bb b/meta-networking/recipes-protocols/dante/dante_1.4.4.bb
index 52cfba4c5f..6a1eed3edb 100644
--- a/meta-networking/recipes-protocols/dante/dante_1.4.4.bb
+++ b/meta-networking/recipes-protocols/dante/dante_1.4.4.bb
@@ -25,6 +25,8 @@ EXTRA_OECONF += "--without-gssapi --sbindir=${bindir}"
 DEPENDS += "flex-native bison-native libpam libtirpc"
 inherit autotools-brokensep features_check
+CACHED_CONFIGUREVARS += "ac_cv_prog_cc_c23=no"
 CPPFLAGS += "-P"
 CFLAGS += "-I${STAGING_INCDIR}/tirpc"
 LIBS += "-ltirpc"
diff --git a/meta-networking/recipes-protocols/frr/frr/0001-lib-fix-mgmt_msg-recv-to-deal-with-mis-alignment.patch b/meta-networking/recipes-protocols/frr/frr/0001-lib-fix-mgmt_msg-recv-to-deal-with-mis-alignment.patch
new file mode 100644
index 0000000000..22cc10cf31
--- /dev/null
+++ b/meta-networking/recipes-protocols/frr/frr/0001-lib-fix-mgmt_msg-recv-to-deal-with-mis-alignment.patch
@@ -0,0 +1,352 @@
+From 5959a3d0cbc73b0c41134bf0d9944a6bd40ba510 Mon Sep 17 00:00:00 2001
+From: Christian Hopps <chopps@labn.net>
+Date: Sat, 18 Apr 2026 03:01:46 +0000
+Subject: [PATCH] lib: fix mgmt_msg recv to deal with mis-alignment
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+We need our messages to start on 64 bit boundaries as the message buffer
+is accessed directly as structured data. In particular on ARM32 arch
+using the data this way lead to unaligned access and SIGBUS.
+The minor optimization of reading multiple messages into a single stream
+buffer complicated this. Instead we KISS and switch to one message per
+stream buffer.
+Fixes #20087.
+Signed-off-by: Christian Hopps <chopps@labn.net>
+Co-developed-by: Samir MOUHOUNE <samir.mouhoune@nav-timing.safrangroup.com>
+Co-developed-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+See also PR #20985
+This issue was identified and another solution was provided by Samir
+MOUHOUNE with the following commit message comments:
+On ARM32 systems, mgmtd crashes at startup on an alignment fault:
+```
+  frrinit.sh[158]: Starting watchfrr with command: '  /usr/sbin/watchfrr  -d   mgmtd zebra staticd'
+  watchfrr[168]: [T83RR-8SM5G] watchfrr 10.5.2 starting: vty@0
+  watchfrr[168]: [ZCJ3S-SPH5S] mgmtd state -> down : initial connection attempt failed
+  watchfrr[168]: [ZCJ3S-SPH5S] zebra state -> down : initial connection attempt failed
+  watchfrr[168]: [ZCJ3S-SPH5S] staticd state -> down : initial connection attempt failed
+  watchfrr[168]: [YFT0P-5Q5YX] Forked background command [pid 169]: /usr/sbin/watchfrr.sh restart all
+  frrinit.sh[180]: 2026/02/27 09:14:13 ZEBRA: [KGY44-D47GD][EC 4043309111] Disabling MPLS support (no kernel support)
+  watchfrr[168]: [QDG3Y-BY5TN] zebra state -> up : connect succeeded
+  kernel: Alignment trap: not handling instruction edc30b02 at [<004c3c1c>]
+  kernel: 8<--- cut here ---
+  kernel: Unhandled fault: alignment exception (0x801) at 0x008879f6
+  kernel: [008879f6] *pgd=9baf6831
+  watchfrr[168]: [YFT0P-5Q5YX] Forked background command [pid 189]: /usr/sbin/watchfrr.sh restart mgmtd
+  frrinit.sh[189]: Cannot stop mgmtd: pid 179 not running
+  watchfrr.sh[196]: Cannot stop mgmtd: pid 179 not running
+  frrinit.sh[202]: [202|zebra] sending configuration
+  frrinit.sh[202]: [202|zebra] done
+  frrinit.sh[216]: [216|watchfrr] sending configuration
+  frrinit.sh[218]: [218|staticd] sending configuration
+  watchfrr[168]: [VTVCM-Y2NW3] Configuration Read in Took: 00:00:00
+  frrinit.sh[199]: Waiting for children to finish applying config...
+  frrinit.sh[216]: [216|watchfrr] done
+```
+When checking crashlogs in /var/tmp/frr, mgmt gives the following:
+```
+  MGMTD: Received signal 7 at 1772183653 (si_addr 0x8879f6); aborting...
+  MGMTD: /lib/libfrr.so.0(zlog_backtrace_sigsafe+0x5c) [0xb6e89c90]
+  MGMTD: /lib/libfrr.so.0(zlog_signal+0xe0) [0xb6e89e80]
+  MGMTD: /lib/libfrr.so.0(+0xd4374) [0xb6ed3374]
+  MGMTD: /lib/libc.so.6(__default_rt_sa_restorer+0) [0xb6ab4d90]
+  MGMTD: /usr/sbin/mgmtd(mgmt_fe_adapter_send_notify+0x6b8) [0x4c3c20]
+  MGMTD: /lib/libfrr.so.0(mgmt_msg_procbufs+0x124) [0xb6e976b8]
+  MGMTD: /lib/libfrr.so.0(+0x98798) [0xb6e97798]
+  MGMTD: /lib/libfrr.so.0(event_call+0xa8) [0xb6ee739c]
+  MGMTD: /lib/libfrr.so.0(frr_run+0xd4) [0xb6e80fc8]
+  MGMTD: /usr/sbin/mgmtd(main+0x188) [0x4bd7ec]
+  MGMTD: /lib/libc.so.6(+0x236b0) [0xb6a9f6b0]
+  MGMTD: /lib/libc.so.6(__libc_start_main+0x98) [0xb6a9f790]
+  MGMTD: in thread msg_conn_proc_msgs scheduled from lib/mgmt_msg.c:543 msg_conn_sched_proc_msgs()
+```
+The issue is that messages are queued for sending/receive back-to-back
+with no padding. This means that when mgmt creates a pointer back to the
+data waiting in queue and tries to access fields inside the dereferenced
+message, those accesses are not performed with the alignment constraints
+required by some architectures. For example, ARM ABI AAPCS32 ([1])
+states that structures alignment should be the same as the "most
+aligned" member; so a struct mgmt_msg_header, which contains some
+uint64_t fields (which are 8-bytes alignes), should be 8-bytes aligned
+as well.
+On x86, this goes unnoticed because the CPU handles unaligned access
+transparently. On ARM 32-bit with NEON/VFP, the compiler generates
+64-bit store instructions that trap on unaligned addresses. The kernel
+cannot emulate these instructions and kills the process with SIGBUS.
+[1] https://github.com/ARM-software/abi-aa/blob/main/aapcs32/aapcs32.rst#data-types-and-alignment
+Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/5959a3d0cbc73b0c41134bf0d9944a6bd40ba510]
+Signed-off-by: Christian Hopps <chopps@labn.net>
+(cherry picked from commit ae7d79f8ff25d5750e5796567ff6317030900d40)
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ lib/mgmt_be_client.h |   3 +-
+ lib/mgmt_fe_client.h |   3 +-
+ lib/mgmt_msg.c       | 157 ++++++++++++++++++-------------------------
+ 3 files changed, 68 insertions(+), 95 deletions(-)
+diff --git a/lib/mgmt_be_client.h b/lib/mgmt_be_client.h
+index f5627e3c4e..2f412a6fbd 100644
+--- a/lib/mgmt_be_client.h
+++ b/lib/mgmt_be_client.h
+@@ -21,7 +21,8 @@ extern "C" {
+ 
+ #define MGMTD_BE_MAX_NUM_MSG_PROC  500
+ #define MGMTD_BE_MAX_NUM_MSG_WRITE 1000
+-#define MGMTD_BE_MAX_MSG_LEN      (64 * 1024)
+/* Messages can be any size, this is just the preallocated buffer size */
+#define MGMTD_BE_MAX_MSG_LEN (4 * 1024)
+ 
+ #define MGMTD_BE_CONTAINER_NODE_VAL "<<container>>"
+ 
+diff --git a/lib/mgmt_fe_client.h b/lib/mgmt_fe_client.h
+index 8ff08b566a..3005c5dd01 100644
+--- a/lib/mgmt_fe_client.h
+++ b/lib/mgmt_fe_client.h
+@@ -29,7 +29,8 @@ extern "C" {
+ 
+ #define MGMTD_FE_MAX_NUM_MSG_PROC  500
+ #define MGMTD_FE_MAX_NUM_MSG_WRITE 100
+-#define MGMTD_FE_MAX_MSG_LEN      (64 * 1024)
+/* Messages can be any size, this is just the preallocated buffer size */
+#define MGMTD_FE_MAX_MSG_LEN (4 * 1024)
+ 
+ /***************************************************************
+  * Data-structures
+diff --git a/lib/mgmt_msg.c b/lib/mgmt_msg.c
+index f299b52873..fb56f58ab5 100644
+--- a/lib/mgmt_msg.c
+++ b/lib/mgmt_msg.c
+@@ -13,6 +13,7 @@
+ #include "network.h"
+ #include "sockopt.h"
+ #include "stream.h"
+#include "zlog.h"
+ #include "frrevent.h"
+ #include "mgmt_msg.h"
+ #include "mgmt_msg_native.h"
+@@ -39,8 +40,8 @@ static bool trace;
+ DEFINE_MTYPE(LIB, MSG_CONN, "msg connection state");
+ 
+ /**
+- * Read data from a socket into streams containing 1 or more full msgs headed by
+- * mgmt_msg_hdr which contain API messages (currently protobuf).
+ * Read data from a socket into a stream containing 1 full msg headed by
+ * mgmt_msg_hdr.
+  *
+  * Args:
+  *     ms: mgmt_msg_state for this process.
+@@ -57,96 +58,80 @@ enum mgmt_msg_rsched mgmt_msg_read(struct mgmt_msg_state *ms, int fd,
+                                   bool debug)
+ {
+        const char *dbgtag = debug ? ms->idtag : NULL;
+-       size_t avail = STREAM_WRITEABLE(ms->ins);
+        struct mgmt_msg_hdr *mhdr = NULL;
+-       size_t total = 0;
+-       size_t mcount = 0;
+-       ssize_t n, left;
+       struct stream *news;
+       size_t nread;
+       ssize_t n;
+ 
+        assert(ms && fd != -1);
+-       MGMT_MSG_TRACE(dbgtag, "enter with %zu bytes available to read on fd %d", avail, fd);
+       MGMT_MSG_TRACE(dbgtag, "enter to read from fd %d", fd);
+
+       assert(stream_get_getp(ms->ins) == 0);
+       nread = stream_get_endp(ms->ins);
+ 
+        /*
+-        * Read as much as we can into the stream.
+        * Get header, validate, and resize the stream, if needed, to fit incoming message.
+         */
+-       while (avail > sizeof(struct mgmt_msg_hdr)) {
+-               n = stream_read_try(ms->ins, fd, avail);
+-
+-               /* -2 is normal nothing read, and to retry */
+-               if (n == -2) {
+-                       MGMT_MSG_TRACE(dbgtag, "nothing more to read on fd %d", fd);
+-                       break;
+-               }
+-               if (n <= 0) {
+-                       if (n == 0)
+-                               MGMT_MSG_ERR(ms, "got EOF/disconnect on fd %d", fd);
+-                       else
+-                               MGMT_MSG_ERR(ms, "got error while reading on fd %d: '%s'", fd,
+-                                            safe_strerror(errno));
+-                       return MSR_DISCONNECT;
+       if (nread < sizeof(struct mgmt_msg_hdr)) {
+               while (nread < sizeof(struct mgmt_msg_hdr)) {
+                       n = stream_read_try(ms->ins, fd, sizeof(struct mgmt_msg_hdr) - nread);
+                       if (n <= 0)
+                               goto not_done;
+                       nread += n;
+                       ms->nrxb += n;
+                }
+-               MGMT_MSG_TRACE(dbgtag, "read %zd bytes on fd %d", n, fd);
+-               ms->nrxb += n;
+-               avail -= n;
+-       }
+ 
+-       /*
+-        * Check if we have read a complete messages or not.
+-        */
+-       assert(stream_get_getp(ms->ins) == 0);
+-       left = stream_get_endp(ms->ins);
+-       while (left > (ssize_t)sizeof(struct mgmt_msg_hdr)) {
+-               mhdr = (struct mgmt_msg_hdr *)(STREAM_DATA(ms->ins) + total);
+               /* Validate the header is sane */
+               mhdr = (struct mgmt_msg_hdr *)STREAM_DATA(ms->ins);
+                if (!MGMT_MSG_IS_MARKER(mhdr->marker)) {
+                        MGMT_MSG_DBG(dbgtag, "recv corrupt buffer on fd %d, disconnect", fd);
+                        return MSR_DISCONNECT;
+               } else if (mhdr->len <= sizeof(struct mgmt_msg_hdr)) {
+                       MGMT_MSG_DBG(dbgtag, "recv invalid message length %u on fd %d, disconnect",
+                                    mhdr->len, fd);
+                       return MSR_DISCONNECT;
+                }
+-               if ((ssize_t)mhdr->len > left)
+-                       break;
+-
+-               MGMT_MSG_TRACE(dbgtag, "read full message on fd %d len %u", fd, mhdr->len);
+-               total += mhdr->len;
+-               left -= mhdr->len;
+-               mcount++;
+-       }
+ 
+-       if (!mcount) {
+-               /* Didn't manage to read a full message */
+-               if (mhdr && avail == 0) {
+-                       struct stream *news;
+-                       /*
+-                        * Message was longer than what was left and we have no
+-                        * available space to read more in. B/c mcount == 0 the
+-                        * message starts at the beginning of the stream so
+-                        * therefor the stream is too small to fit the message..
+-                        * Resize the stream to fit.
+-                        */
+               /* See if message will fit in the stream, realloc if not */
+               if (mhdr->len > ms->ins->size) {
+                       MGMT_MSG_DBG(dbgtag,
+                                    "message length %u is greater than available %zu on fd %d",
+                                    mhdr->len, ms->ins->size, fd);
+                        news = stream_new(mhdr->len);
+-                       stream_put(news, mhdr, left);
+-                       stream_set_endp(news, left);
+                       stream_put(news, mhdr, sizeof(struct mgmt_msg_hdr));
+                        stream_free(ms->ins);
+                        ms->ins = news;
+                }
+-               return MSR_SCHED_STREAM;
+        }
+ 
+-       /*
+-        * We have read at least one message into the stream, queue it up.
+-        */
+-       mhdr = (struct mgmt_msg_hdr *)(STREAM_DATA(ms->ins) + total);
+-       stream_set_endp(ms->ins, total);
+-       stream_fifo_push(&ms->inq, ms->ins);
+-       if (left < (ssize_t)sizeof(struct mgmt_msg_hdr))
+-               ms->ins = stream_new(ms->max_msg_sz);
+-       else
+-               /* handle case where message is greater than max */
+-               ms->ins = stream_new(MAX(ms->max_msg_sz, mhdr->len));
+-       if (left) {
+-               stream_put(ms->ins, mhdr, left);
+-               stream_set_endp(ms->ins, left);
+       /* Read the rest of the message. */
+       mhdr = (struct mgmt_msg_hdr *)STREAM_DATA(ms->ins);
+       while (nread < mhdr->len) {
+               n = stream_read_try(ms->ins, fd, mhdr->len - nread);
+               if (n <= 0)
+                       goto not_done;
+               nread += n;
+               ms->nrxb += n;
+               MGMT_MSG_TRACE(dbgtag, "read %zd from fd %d (%zu of %u)", n, fd, nread, mhdr->len);
+        }
+ 
+       /* We've got a full message, push it onto the FIFO and setup for the next message. */
+       MGMT_MSG_TRACE(dbgtag, "read full msg %zu/%u from fd %d", nread, mhdr->len, fd);
+       stream_fifo_push(&ms->inq, ms->ins);
+       ms->ins = stream_new(ms->max_msg_sz);
+        return MSR_SCHED_BOTH;
+
+not_done:
+       if (n == -2) {
+               MGMT_MSG_TRACE(dbgtag, "nothing more to read on fd %d", fd);
+               return MSR_SCHED_STREAM;
+       }
+       if (n == 0)
+               MGMT_MSG_ERR(ms, "got EOF/disconnect on fd %d", fd);
+       else
+               MGMT_MSG_ERR(ms, "got error while reading on fd %d: '%s'", fd,
+                            safe_strerror(errno));
+       return MSR_DISCONNECT;
+ }
+ 
+ /**
+@@ -171,7 +156,6 @@ bool mgmt_msg_procbufs(struct mgmt_msg_state *ms,
+        const char *dbgtag = debug ? ms->idtag : NULL;
+        struct mgmt_msg_hdr *mhdr;
+        struct stream *work;
+-       uint8_t *data;
+        size_t left, nproc;
+ 
+        MGMT_MSG_TRACE(dbgtag, "Have %zu streams to process", ms->inq.count);
+@@ -182,30 +166,17 @@ bool mgmt_msg_procbufs(struct mgmt_msg_state *ms,
+                if (!work)
+                        break;
+ 
+-               data = STREAM_DATA(work);
+                left = stream_get_endp(work);
+                MGMT_MSG_TRACE(dbgtag, "Processing stream of len %zu", left);
+-
+-               for (; left > sizeof(struct mgmt_msg_hdr);
+-                    left -= mhdr->len, data += mhdr->len) {
+-                       mhdr = (struct mgmt_msg_hdr *)data;
+-
+-                       assert(MGMT_MSG_IS_MARKER(mhdr->marker));
+-                       assert(left >= mhdr->len);
+-
+-                       /*
+-                        * Q: if the handler disconnects should stop/flush?
+-                        */
+-                       handle_msg(MGMT_MSG_MARKER_VERSION(mhdr->marker), (uint8_t *)(mhdr + 1),
+-                                  mhdr->len - sizeof(struct mgmt_msg_hdr), user);
+-                       ms->nrxm++;
+-                       nproc++;
+-               }
+-
+-               if (work != ms->ins)
+-                       stream_free(work); /* Free it up */
+-               else
+-                       stream_reset(work); /* Reset stream for next read */
+               /*
+                * Q: if the handler disconnects should we stop/flush?
+                */
+               mhdr = (struct mgmt_msg_hdr *)STREAM_DATA(work);
+               handle_msg(MGMT_MSG_MARKER_VERSION(mhdr->marker), (uint8_t *)(mhdr + 1),
+                          mhdr->len - sizeof(struct mgmt_msg_hdr), user);
+               ms->nrxm++;
+               nproc++;
+               stream_free(work); /* Free it up */
+        }
+ 
+        /* return true if should reschedule b/c more to process. */
+-- 
+2.43.0
diff --git a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-1.patch b/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-1.patch
deleted file mode 100644
index a1e1246cce..0000000000
--- a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-1.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From e21276d430663fd8312940bb3b0ce081957e3d85 Mon Sep 17 00:00:00 2001
-From: Gyorgy Sarvari <skandigraun@gmail.com>
-Date: Sun, 24 Aug 2025 21:17:55 +0800
-Subject: [PATCH] ospfd: Add null check for vty_out in check_tlv_size
-From: s1awwhy <seawwhy@163.com>
-Add security check for vty_out. Specifically,  Check NULL for vty. If vty is not available, dump info via zlog.
-Signed-off-by: s1awwhy <seawwhy@163.com>
-CVE: CVE-2025-61099 CVE-2025-61100 CVE-2025-61101 CVE-2025-61102 CVE-2025-61103 CVE-2025-61104 CVE-2025-61105 CVE-2025-61106 CVE-2025-61107
-Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/b7d9b7aa47627b31e4b50795284408ab6de98660]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
- ospfd/ospf_ext.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-diff --git a/ospfd/ospf_ext.c b/ospfd/ospf_ext.c
-index df0b3b9081..8ca0df3200 100644
--- a/ospfd/ospf_ext.c
-+++ b/ospfd/ospf_ext.c
-@@ -1705,11 +1705,15 @@ static void ospf_ext_lsa_schedule(struct ext_itf *exti, enum lsa_opcode op)
-  * ------------------------------------
-  */
- 
-+/* Check NULL for vty. If vty is not available, dump info via zlog */
- #define check_tlv_size(size, msg)                                              \
-        do {                                                                   \
-                if (ntohs(tlvh->length) != size) {                             \
-                       vty_out(vty, "  Wrong %s TLV size: %d(%d). Abort!\n",  \
-                               msg, ntohs(tlvh->length), size);               \
-+                       if (vty != NULL)                         \
-+                               vty_out(vty, "  Wrong %s TLV size: %d(%d). Abort!\n",  \
-+                                       msg, ntohs(tlvh->length), size);               \
-+                       else                                              \
-+                               zlog_debug("    Wrong %s TLV size: %d(%d). Abort!", msg, ntohs(tlvh->length), size);    \
-                        return size + TLV_HDR_SIZE;                            \
-                }                                                              \
-        } while (0)
diff --git a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-2.patch b/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-2.patch
deleted file mode 100644
index eacada0ec4..0000000000
--- a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-2.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From d9ed123b814dad7cf4b069de5601c9f279596191 Mon Sep 17 00:00:00 2001
-From: Gyorgy Sarvari <skandigraun@gmail.com>
-Date: Tue, 6 Jan 2026 15:32:32 +0100
-Subject: [PATCH] ospfd: skip subsequent tlvs after invalid length
-From: Louis Scalbert <louis.scalbert@6wind.com>
-Do not attempt to read subsequent TLVs after an TLV invalid length is
-detected.
-Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
-CVE: CVE-2025-61099 CVE-2025-61100 CVE-2025-61101 CVE-2025-61102 CVE-2025-61103 CVE-2025-61104 CVE-2025-61105 CVE-2025-61106 CVE-2025-61107
-Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/33dfc7e7be1ac8b66abbf47c30a709215fbc1926]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
- ospfd/ospf_ext.c | 6 +++---
- ospfd/ospf_ri.c  | 6 +++---
- ospfd/ospf_te.c  | 6 +++---
- 3 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/ospfd/ospf_ext.c b/ospfd/ospf_ext.c
-index 8ca0df3200..62b0020148 100644
--- a/ospfd/ospf_ext.c
-+++ b/ospfd/ospf_ext.c
-@@ -1710,11 +1710,11 @@ static void ospf_ext_lsa_schedule(struct ext_itf *exti, enum lsa_opcode op)
-        do {                                                                   \
-                if (ntohs(tlvh->length) != size) {                             \
-                        if (vty != NULL)                         \
-                               vty_out(vty, "  Wrong %s TLV size: %d(%d). Abort!\n",  \
-+                               vty_out(vty, "  Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!\n",  \
-                                        msg, ntohs(tlvh->length), size);               \
-                        else                                              \
-                               zlog_debug("    Wrong %s TLV size: %d(%d). Abort!", msg, ntohs(tlvh->length), size);    \
-                       return size + TLV_HDR_SIZE;                            \
-+                               zlog_debug("    Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!", msg, ntohs(tlvh->length), size);    \
-+                       return OSPF_MAX_LSA_SIZE + 1;                            \
-                }                                                              \
-        } while (0)
- 
-diff --git a/ospfd/ospf_ri.c b/ospfd/ospf_ri.c
-index 76e6efeb83..7934b25451 100644
--- a/ospfd/ospf_ri.c
-+++ b/ospfd/ospf_ri.c
-@@ -1208,12 +1208,12 @@ static int ospf_router_info_lsa_update(struct ospf_lsa *lsa)
-        do {                                                                   \
-                if (ntohs(tlvh->length) > size) {                              \
-                        if (vty != NULL)                                       \
-                               vty_out(vty, "  Wrong %s TLV size: %d(%d)\n",  \
-+                               vty_out(vty, "  Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!\n",  \
-                                        msg, ntohs(tlvh->length), size);       \
-                        else                                                   \
-                               zlog_debug("    Wrong %s TLV size: %d(%d)",    \
-+                               zlog_debug("    Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!",    \
-                                           msg, ntohs(tlvh->length), size);    \
-                       return size + TLV_HDR_SIZE;                            \
-+                       return OSPF_MAX_LSA_SIZE + 1;                            \
-                }                                                              \
-        } while (0)
- 
-diff --git a/ospfd/ospf_te.c b/ospfd/ospf_te.c
-index d187485b9f..850a7039f1 100644
--- a/ospfd/ospf_te.c
-+++ b/ospfd/ospf_te.c
-@@ -3161,12 +3161,12 @@ static void ospf_te_init_ted(struct ls_ted *ted, struct ospf *ospf)
-        do {                                                                   \
-                if (ntohs(tlvh->length) > size) {                              \
-                        if (vty != NULL)                                       \
-                               vty_out(vty, "  Wrong %s TLV size: %d(%d)\n",  \
-+                               vty_out(vty, "  Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!\n",  \
-                                        msg, ntohs(tlvh->length), size);       \
-                        else                                                   \
-                               zlog_debug("    Wrong %s TLV size: %d(%d)",    \
-+                               zlog_debug("    Wrong %s TLV size: %d(expected %d). Skip subsequent TLVs!",    \
-                                           msg, ntohs(tlvh->length), size);    \
-                       return size + TLV_HDR_SIZE;                            \
-+                       return OSPF_MAX_LSA_SIZE + 1;                            \
-                }                                                              \
-        } while (0)
- 
diff --git a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-3.patch b/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-3.patch
deleted file mode 100644
index 7b983198f5..0000000000
--- a/meta-networking/recipes-protocols/frr/frr/CVE-2025-61099-61107-3.patch
+++ /dev/null
@@ -1,293 +0,0 @@
-From 2d02bca97251ee53fb10b4c34c8cda0e20ae8b8e Mon Sep 17 00:00:00 2001
-From: Gyorgy Sarvari <skandigraun@gmail.com>
-Date: Sun, 24 Aug 2025 21:21:23 +0800
-Subject: [PATCH] ospfd: Fix NULL Pointer Deference when dumping link info
-From: s1awwhy <seawwhy@163.com>
-When the command debug ospf packet all send/recv detail is enabled in the OSPF
-configuration,  ospfd will dump detailed information of any received or sent
-OSPF packets, either via VTY or through the zlog. However, the original Opaque
-LSA handling code failed to check whether the VTY context and show_opaque_info
-were available, resulting in NULL pointer dereference and crashes in ospfd.
-The patch fixes the Null Pointer Deference Vulnerability in
-show_vty_ext_link_rmt_itf_addr, show_vty_ext_link_adj_sid,
-show_vty_ext_link_lan_adj_sid, show_vty_unknown_tlv,
-show_vty_link_info, show_vty_ext_pref_pref_sid, show_vtY_pref_info.
-Specifically, add NULL check for vty. If vty is not available, dump details
-via zlog.
-Signed-off-by: s1awwhy <seawwhy@163.com>
-Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
-CVE: CVE-2025-61099 CVE-2025-61100 CVE-2025-61101 CVE-2025-61102 CVE-2025-61103 CVE-2025-61104 CVE-2025-61105 CVE-2025-61106 CVE-2025-61107
-Upstream-Status: Backport [https://github.com/FRRouting/frr/commit/034e6fe67078810b952630055614ee5710d1196e]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
- ospfd/ospf_ext.c | 200 ++++++++++++++++++++++++++++++++---------------
- 1 file changed, 138 insertions(+), 62 deletions(-)
-diff --git a/ospfd/ospf_ext.c b/ospfd/ospf_ext.c
-index 62b0020148..c1fcd632e0 100644
--- a/ospfd/ospf_ext.c
-+++ b/ospfd/ospf_ext.c
-@@ -1729,9 +1729,15 @@ static uint16_t show_vty_ext_link_rmt_itf_addr(struct vty *vty,
-        check_tlv_size(EXT_SUBTLV_RMT_ITF_ADDR_SIZE, "Remote Itf. Address");
- 
-        if (!json)
-               vty_out(vty,
-                       "  Remote Interface Address Sub-TLV: Length %u\n        Address: %pI4\n",
-                       ntohs(top->header.length), &top->value);
-+               if (vty != NULL) {
-+                       vty_out(vty,
-+                               "  Remote Interface Address Sub-TLV: Length %u\n        Address: %pI4\n",
-+                               ntohs(top->header.length), &top->value);
-+               } else {
-+                       zlog_debug("  Remote Interface Address Sub-TLV: Length %u",
-+                                  ntohs(top->header.length));
-+                       zlog_debug("  Address: %pI4", &top->value);
-+               }
-        else
-                json_object_string_addf(json, "remoteInterfaceAddress", "%pI4",
-                                        &top->value);
-@@ -1752,18 +1758,30 @@ static uint16_t show_vty_ext_link_adj_sid(struct vty *vty,
-                              : SID_INDEX_SIZE(EXT_SUBTLV_ADJ_SID_SIZE);
-        check_tlv_size(tlv_size, "Adjacency SID");
- 
-       if (!json)
-               vty_out(vty,
-                       "  Adj-SID Sub-TLV: Length %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\tWeight: 0x%x\n\t%s: %u\n",
-                       ntohs(top->header.length), top->flags, top->mtid,
-                       top->weight,
-                       CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-                               ? "Label"
-                               : "Index",
-                       CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-                               ? GET_LABEL(ntohl(top->value))
-                               : ntohl(top->value));
-       else {
-+       if (!json) {
-+               /* Add security check for vty_out. If vty is not available, dump info via zlog.*/
-+               if (vty != NULL)
-+                       vty_out(vty,
-+                               "  Adj-SID Sub-TLV: Length %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\tWeight: 0x%x\n\t%s: %u\n",
-+                               ntohs(top->header.length), top->flags, top->mtid, top->weight,
-+                               CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG) ? "Label"
-+                                                                                    : "Index",
-+                               CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-+                                       ? GET_LABEL(ntohl(top->value))
-+                                       : ntohl(top->value));
-+               else {
-+                       zlog_debug("  Adj-SID Sub-TLV: Length %u", ntohs(top->header.length));
-+                       zlog_debug("    Flags: 0x%x", top->flags);
-+                       zlog_debug("    MT-ID:0x%x", top->mtid);
-+                       zlog_debug("    Weight: 0x%x", top->weight);
-+                       zlog_debug("    %s: %u",
-+                                  CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG) ? "Label"
-+                                                                                       : "Index",
-+                                  CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-+                                          ? GET_LABEL(ntohl(top->value))
-+                                          : ntohl(top->value));
-+               }
-+       } else {
-                json_object_string_addf(json, "flags", "0x%x", top->flags);
-                json_object_string_addf(json, "mtID", "0x%x", top->mtid);
-                json_object_string_addf(json, "weight", "0x%x", top->weight);
-@@ -1791,18 +1809,32 @@ static uint16_t show_vty_ext_link_lan_adj_sid(struct vty *vty,
-                              : SID_INDEX_SIZE(EXT_SUBTLV_LAN_ADJ_SID_SIZE);
-        check_tlv_size(tlv_size, "LAN-Adjacency SID");
- 
-       if (!json)
-               vty_out(vty,
-                       "  LAN-Adj-SID Sub-TLV: Length %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\tWeight: 0x%x\n\tNeighbor ID: %pI4\n\t%s: %u\n",
-                       ntohs(top->header.length), top->flags, top->mtid,
-                       top->weight, &top->neighbor_id,
-                       CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-                               ? "Label"
-                               : "Index",
-                       CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-                               ? GET_LABEL(ntohl(top->value))
-                               : ntohl(top->value));
-       else {
-+       if (!json) {
-+               /* Add security check for vty_out. If vty is not available, dump info via zlog. */
-+               if (vty != NULL) {
-+                       vty_out(vty,
-+                               "  LAN-Adj-SID Sub-TLV: Length %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\tWeight: 0x%x\n\tNeighbor ID: %pI4\n\t%s: %u\n",
-+                               ntohs(top->header.length), top->flags, top->mtid, top->weight,
-+                               &top->neighbor_id,
-+                               CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG) ? "Label"
-+                                                                                    : "Index",
-+                               CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-+                                       ? GET_LABEL(ntohl(top->value))
-+                                       : ntohl(top->value));
-+               } else {
-+                       zlog_debug("  LAN-Adj-SID Sub-TLV: Length %u", ntohs(top->header.length));
-+                       zlog_debug("    Flags: 0x%x", top->flags);
-+                       zlog_debug("    MT-ID:0x%x", top->mtid);
-+                       zlog_debug("    Weight: 0x%x", top->weight);
-+                       zlog_debug("    Neighbor ID: %pI4", &top->neighbor_id);
-+                       zlog_debug("    %s: %u",
-+                                  CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG) ? "Label"
-+                                                                                       : "Index",
-+                                  CHECK_FLAG(top->flags, EXT_SUBTLV_LINK_ADJ_SID_VFLG)
-+                                          ? GET_LABEL(ntohl(top->value))
-+                                          : ntohl(top->value));
-+               }
-+       } else {
-                json_object_string_addf(json, "flags", "0x%x", top->flags);
-                json_object_string_addf(json, "mtID", "0x%x", top->mtid);
-                json_object_string_addf(json, "weight", "0x%x", top->weight);
-@@ -1823,14 +1855,23 @@ static uint16_t show_vty_unknown_tlv(struct vty *vty, struct tlv_header *tlvh,
- {
-        json_object *obj;
- 
-+       /* Add security check for vty_out. If vty is not available, dump info via zlog. */
-        if (TLV_SIZE(tlvh) > buf_size) {
-               vty_out(vty, "    TLV size %d exceeds buffer size. Abort!",
-                       TLV_SIZE(tlvh));
-+               if (vty != NULL)
-+                       vty_out(vty, "    TLV size %d exceeds buffer size. Abort!", TLV_SIZE(tlvh));
-+               else
-+                       zlog_debug("    TLV size %d exceeds buffer size. Abort!", TLV_SIZE(tlvh));
-+
-                return buf_size;
-        }
-        if (!json)
-               vty_out(vty, "    Unknown TLV: [type(0x%x), length(0x%x)]\n",
-                       ntohs(tlvh->type), ntohs(tlvh->length));
-+               if (vty != NULL) {
-+                       vty_out(vty, "    Unknown TLV: [type(0x%x), length(0x%x)]\n",
-+                               ntohs(tlvh->type), ntohs(tlvh->length));
-+               } else {
-+                       zlog_debug("    Unknown TLV: [type(0x%x), length(0x%x)]",
-+                                  ntohs(tlvh->type), ntohs(tlvh->length));
-+               }
-        else {
-                obj = json_object_new_object();
-                json_object_string_addf(obj, "type", "0x%x",
-@@ -1855,19 +1896,31 @@ static uint16_t show_vty_link_info(struct vty *vty, struct tlv_header *ext,
- 
-        /* Verify that TLV length is valid against remaining buffer size */
-        if (length > buf_size) {
-               vty_out(vty,
-                       "  Extended Link TLV size %d exceeds buffer size. Abort!\n",
-                       length);
-+               /* Add security check for vty_out. If vty is not available, dump info via zlog. */
-+               if (vty != NULL) {
-+                       vty_out(vty, "  Extended Link TLV size %d exceeds buffer size. Abort!\n",
-+                               length);
-+               } else {
-+                       zlog_debug("  Extended Link TLV size %d exceeds buffer size. Abort!",
-+                                  length);
-+               }
-                return buf_size;
-        }
- 
-        if (!json) {
-               vty_out(vty,
-                       "  Extended Link TLV: Length %u\n       Link Type: 0x%x\n"
-                       "       Link ID: %pI4\n",
-                       ntohs(top->header.length), top->link_type,
-                       &top->link_id);
-               vty_out(vty, "  Link data: %pI4\n", &top->link_data);
-+               /* Add security check for vty_out. If vty is not available, dump info via zlog. */
-+               if (vty != NULL) {
-+                       vty_out(vty,
-+                               "  Extended Link TLV: Length %u\n       Link Type: 0x%x\n"
-+                               "       Link ID: %pI4\n",
-+                               ntohs(top->header.length), top->link_type, &top->link_id);
-+                       vty_out(vty, "  Link data: %pI4\n", &top->link_data);
-+               } else {
-+                       zlog_debug("  Extended Link TLV: Length %u", ntohs(top->header.length));
-+                       zlog_debug("    Link Type: 0x%x", top->link_type);
-+                       zlog_debug("    Link ID: %pI4", &top->link_id);
-+                       zlog_debug("    Link data: %pI4", &top->link_data);
-+               }
-        } else {
-                json_object_string_addf(json, "linkType", "0x%x",
-                                        top->link_type);
-@@ -1959,18 +2012,29 @@ static uint16_t show_vty_ext_pref_pref_sid(struct vty *vty,
-                              : SID_INDEX_SIZE(EXT_SUBTLV_PREFIX_SID_SIZE);
-        check_tlv_size(tlv_size, "Prefix SID");
- 
-       if (!json)
-               vty_out(vty,
-                       "  Prefix SID Sub-TLV: Length %u\n\tAlgorithm: %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\t%s: %u\n",
-                       ntohs(top->header.length), top->algorithm, top->flags,
-                       top->mtid,
-                       CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG)
-                               ? "Label"
-                               : "Index",
-                       CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG)
-                               ? GET_LABEL(ntohl(top->value))
-                               : ntohl(top->value));
-       else {
-+       if (!json) {
-+               if (vty != NULL) {
-+                       vty_out(vty,
-+                               "  Prefix SID Sub-TLV: Length %u\n\tAlgorithm: %u\n\tFlags: 0x%x\n\tMT-ID:0x%x\n\t%s: %u\n",
-+                               ntohs(top->header.length), top->algorithm, top->flags, top->mtid,
-+                               CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG) ? "Label"
-+                                                                                  : "Index",
-+                               CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG)
-+                                       ? GET_LABEL(ntohl(top->value))
-+                                       : ntohl(top->value));
-+               } else {
-+                       zlog_debug("  Prefix SID Sub-TLV: Length %u", ntohs(top->header.length));
-+                       zlog_debug("    Algorithm: %u", top->algorithm);
-+                       zlog_debug("    Flags: 0x%x", top->flags);
-+                       zlog_debug("    MT-ID:0x%x", top->mtid);
-+                       zlog_debug("    %s: %u",
-+                                  CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG) ? "Label"
-+                                                                                     : "Index",
-+                                  CHECK_FLAG(top->flags, EXT_SUBTLV_PREFIX_SID_VFLG)
-+                                          ? GET_LABEL(ntohl(top->value))
-+                                          : ntohl(top->value));
-+               }
-+       } else {
-                json_object_int_add(json, "algorithm", top->algorithm);
-                json_object_string_addf(json, "flags", "0x%x", top->flags);
-                json_object_string_addf(json, "mtID", "0x%x", top->mtid);
-@@ -1995,19 +2059,31 @@ static uint16_t show_vty_pref_info(struct vty *vty, struct tlv_header *ext,
- 
-        /* Verify that TLV length is valid against remaining buffer size */
-        if (length > buf_size) {
-               vty_out(vty,
-                       "  Extended Link TLV size %d exceeds buffer size. Abort!\n",
-                       length);
-+               if (vty != NULL) {
-+                       vty_out(vty, "  Extended Link TLV size %d exceeds buffer size. Abort!\n",
-+                               length);
-+               } else {
-+                       zlog_debug("  Extended Link TLV size %d exceeds buffer size. Abort!",
-+                                  length);
-+               }
-                return buf_size;
-        }
- 
-       if (!json)
-               vty_out(vty,
-                       "  Extended Prefix TLV: Length %u\n\tRoute Type: %u\n"
-                       "\tAddress Family: 0x%x\n\tFlags: 0x%x\n\tAddress: %pI4/%u\n",
-                       ntohs(top->header.length), top->route_type, top->af,
-                       top->flags, &top->address, top->pref_length);
-       else {
-+       if (!json) {
-+               if (vty != NULL) {
-+                       vty_out(vty,
-+                               "  Extended Prefix TLV: Length %u\n\tRoute Type: %u\n"
-+                               "\tAddress Family: 0x%x\n\tFlags: 0x%x\n\tAddress: %pI4/%u\n",
-+                               ntohs(top->header.length), top->route_type, top->af, top->flags,
-+                               &top->address, top->pref_length);
-+               } else {
-+                       zlog_debug("  Extended Prefix TLV: Length %u", ntohs(top->header.length));
-+                       zlog_debug("    Route Type: %u", top->route_type);
-+                       zlog_debug("    Address Family: 0x%x", top->af);
-+                       zlog_debug("    Flags: 0x%x", top->flags);
-+                       zlog_debug("    Address: %pI4/%u", &top->address, top->pref_length);
-+               }
-+       } else {
-                json_object_int_add(json, "routeType", top->route_type);
-                json_object_string_addf(json, "addressFamily", "0x%x", top->af);
-                json_object_string_addf(json, "flags", "0x%x", top->flags);
diff --git a/meta-networking/recipes-protocols/frr/frr_10.5.2.bb b/meta-networking/recipes-protocols/frr/frr_10.6.1.bb
index 710bdf4a5d..1cd102f0da 100644
--- a/meta-networking/recipes-protocols/frr/frr_10.5.2.bb
+++ b/meta-networking/recipes-protocols/frr/frr_10.6.1.bb
@@ -10,13 +10,11 @@ LIC_FILES_CHKSUM = "file://doc/licenses/GPL-2.0;md5=b234ee4d69f5fce4486a80fdaf4a
                    file://doc/licenses/LGPL-2.1;md5=4fbd65380cdd255951079008b364516c"
-SRC_URI = "git://github.com/FRRouting/frr.git;protocol=https;branch=stable/10.5;tag=frr-${PV} \
+SRC_URI = "git://github.com/FRRouting/frr.git;protocol=https;branch=stable/10.6;tag=frr-${PV} \
           file://frr.pam \
-           file://CVE-2025-61099-61107-1.patch \
+           file://0001-lib-fix-mgmt_msg-recv-to-deal-with-mis-alignment.patch \
-           file://CVE-2025-61099-61107-2.patch \
-           file://CVE-2025-61099-61107-3.patch \
           "
-SRCREV = "fa68c0ca04f95125cb993b5cacb64fc1495348eb"
+SRCREV = "71da51baee6fb2a02b24262defc46591c86e8a81"
 UPSTREAM_CHECK_GITTAGREGEX = "frr-(?P<pver>\d+(\.\d+)+)$"
diff --git a/meta-networking/recipes-protocols/mdns/mdns/0001-Fix-build-with-gcc-15.patch b/meta-networking/recipes-protocols/mdns/mdns/0001-Fix-build-with-gcc-15.patch
index af33d5444c..c232685a15 100644
--- a/meta-networking/recipes-protocols/mdns/mdns/0001-Fix-build-with-gcc-15.patch
+++ b/meta-networking/recipes-protocols/mdns/mdns/0001-Fix-build-with-gcc-15.patch
@@ -1,4 +1,4 @@
-From c84f185f29d0839b97177aecb0a78b9717947973 Mon Sep 17 00:00:00 2001
+From 0ec55ecaa7386f924ee3d64fdfbe1c2d0df1341a Mon Sep 17 00:00:00 2001
 From: Nguyen Dat Tho <tho3.nguyen@lge.com>
 Date: Wed, 9 Apr 2025 13:05:24 +0900
 Subject: [PATCH] Fix build with gcc-15
diff --git a/meta-networking/recipes-protocols/mdns/mdns/0001-dns-sd-Include-missing-headers.patch b/meta-networking/recipes-protocols/mdns/mdns/0001-dns-sd-Include-missing-headers.patch
index 5464e3febe..c9929db4ca 100644
--- a/meta-networking/recipes-protocols/mdns/mdns/0001-dns-sd-Include-missing-headers.patch
+++ b/meta-networking/recipes-protocols/mdns/mdns/0001-dns-sd-Include-missing-headers.patch
@@ -1,4 +1,4 @@
-From cdbc28c668dd627906f833f9a8e32ac53b0b0139 Mon Sep 17 00:00:00 2001
+From 18b1239b7abd289fe5275fddc2545727a956a4ad Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Thu, 4 Nov 2021 07:31:32 -0700
 Subject: [PATCH] dns-sd: Include missing headers
diff --git a/meta-networking/recipes-protocols/mdns/mdns/0001-mDNSPosix-Rework-mbedtls-for-compatibility-with-mbed.patch b/meta-networking/recipes-protocols/mdns/mdns/0001-mDNSPosix-Rework-mbedtls-for-compatibility-with-mbed.patch
new file mode 100644
index 0000000000..a561fd232f
--- /dev/null
+++ b/meta-networking/recipes-protocols/mdns/mdns/0001-mDNSPosix-Rework-mbedtls-for-compatibility-with-mbed.patch
@@ -0,0 +1,57 @@
+From f4f5039eb90918b5248bd6266afdad0b33b2d010 Mon Sep 17 00:00:00 2001
+From: Alex Kiernan <alex.kiernan@gmail.com>
+Date: Thu, 30 Apr 2026 08:21:19 +0100
+Subject: [PATCH] mDNSPosix: Rework mbedtls for compatibility with mbedtls4
+Upstream-Status: Inactive-Upstream [Upstream does not take patches]
+Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
+---
+ mDNSPosix/mbedtls.c | 21 +++++----------------
+ 1 file changed, 5 insertions(+), 16 deletions(-)
+diff --git a/mDNSPosix/mbedtls.c b/mDNSPosix/mbedtls.c
+index 6726ef9b9145..c4b7fd4edfff 100644
+--- a/mDNSPosix/mbedtls.c
+++ b/mDNSPosix/mbedtls.c
+@@ -29,14 +29,10 @@
+ #include <errno.h>
+ #include <unistd.h>
+ 
+#include <psa/crypto.h>
+
+ #include <mbedtls/error.h>
+-#include <mbedtls/pk.h>
+-#include <mbedtls/ecp.h>
+-#include <mbedtls/ecdsa.h>
+-#include <mbedtls/entropy.h>
+-#include <mbedtls/ctr_drbg.h>
+-#include <mbedtls/sha256.h>
+-#include <mbedtls/base64.h>
+#include <mbedtls/psa_util.h>
+ 
+ #include <mbedtls/x509.h>
+ #include <mbedtls/ssl.h>
+@@ -53,21 +49,14 @@ struct TLSServerContext_struct {
+     mbedtls_ssl_config config;
+ };
+ 
+-// Context that is shared amongs all TLS connections, regardless of which server cert/key is in use.
+-static mbedtls_entropy_context entropy;
+-static mbedtls_ctr_drbg_context ctr_drbg;
+-
+ mDNSBool
+ mDNSPosixTLSInit(void)
+ {
+     int status;
+ 
+-    mbedtls_entropy_init(&entropy);
+-    mbedtls_ctr_drbg_init(&ctr_drbg);
+-
+-    status = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0);
+    status = psa_crypto_init();
+     if (status != 0) {
+-        LogRedact(MDNS_LOG_CATEGORY_DEFAULT, MDNS_LOG_ERROR, "Unable to seed RNG: %x", -status);
+        LogRedact(MDNS_LOG_CATEGORY_DEFAULT, MDNS_LOG_ERROR, "PSA crypto init failed: %x", -status);
+         return mDNSfalse;
+     }
+     return mDNStrue;
diff --git a/meta-networking/recipes-protocols/mdns/mdns/0002-make-Set-libdns_sd.so-soname-correctly.patch b/meta-networking/recipes-protocols/mdns/mdns/0002-make-Set-libdns_sd.so-soname-correctly.patch
index f547c64d93..5f91e91b1d 100644
--- a/meta-networking/recipes-protocols/mdns/mdns/0002-make-Set-libdns_sd.so-soname-correctly.patch
+++ b/meta-networking/recipes-protocols/mdns/mdns/0002-make-Set-libdns_sd.so-soname-correctly.patch
@@ -1,4 +1,4 @@
-From dcc1f39a0918cdebf53ac7c105b3d33df960ed14 Mon Sep 17 00:00:00 2001
+From 7319d6c328d7b18a048e9855902e180fe23641a2 Mon Sep 17 00:00:00 2001
 From: Alex Kiernan <alex.kiernan@gmail.com>
 Date: Mon, 5 Dec 2022 15:14:12 +0000
 Subject: [PATCH] make: Set libdns_sd.so soname correctly
@@ -10,7 +10,7 @@ Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/mDNSPosix/Makefile b/mDNSPosix/Makefile
-index e05ba10b4340..7c510317f1b6 100755
+index 22789f0368c7..2bb57eae5659 100755
 --- a/mDNSPosix/Makefile
 +++ b/mDNSPosix/Makefile
 @@ -276,7 +276,7 @@ libdns_sd: setup $(BUILDDIR)/libdns_sd.$(LDSUFFIX)
diff --git a/meta-networking/recipes-protocols/mdns/mdns/0004-make-Separate-TLS-targets-from-libraries.patch b/meta-networking/recipes-protocols/mdns/mdns/0004-make-Separate-TLS-targets-from-libraries.patch
index 2969b5e244..b6697f0ba6 100644
--- a/meta-networking/recipes-protocols/mdns/mdns/0004-make-Separate-TLS-targets-from-libraries.patch
+++ b/meta-networking/recipes-protocols/mdns/mdns/0004-make-Separate-TLS-targets-from-libraries.patch
@@ -1,4 +1,4 @@
-From f7ee12c1f8e85b9d2fe4023b6539c8051dc710c3 Mon Sep 17 00:00:00 2001
+From e27ac4bb6243b33d23ccb7a137983887676fda7f Mon Sep 17 00:00:00 2001
 From: Alex Kiernan <alex.kiernan@gmail.com>
 Date: Mon, 5 Dec 2022 15:14:26 +0000
 Subject: [PATCH] make: Separate TLS targets from libraries
@@ -13,7 +13,7 @@ Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
 1 file changed, 8 insertions(+), 6 deletions(-)
 diff --git a/mDNSPosix/Makefile b/mDNSPosix/Makefile
-index 7c510317f1b6..8dd5984020ee 100755
+index 2bb57eae5659..490165561410 100755
 --- a/mDNSPosix/Makefile
 +++ b/mDNSPosix/Makefile
 @@ -112,9 +112,11 @@ ifeq ($(findstring linux,$(os)),linux)
diff --git a/meta-networking/recipes-protocols/mdns/mdns/0005-mDNSCore-Fix-broken-debug-parameter.patch b/meta-networking/recipes-protocols/mdns/mdns/0005-mDNSCore-Fix-broken-debug-parameter.patch
index 0c1a9f373f..b8929ea439 100644
--- a/meta-networking/recipes-protocols/mdns/mdns/0005-mDNSCore-Fix-broken-debug-parameter.patch
+++ b/meta-networking/recipes-protocols/mdns/mdns/0005-mDNSCore-Fix-broken-debug-parameter.patch
@@ -1,4 +1,4 @@
-From e79f75487e32f87677519ec40c021b1623395bde Mon Sep 17 00:00:00 2001
+From ab62d343d7e13ae79b0445a0b3d0954ba3534a0c Mon Sep 17 00:00:00 2001
 From: Alex Kiernan <alex.kiernan@gmail.com>
 Date: Mon, 5 Dec 2022 22:49:49 +0000
 Subject: [PATCH] mDNSCore: Fix broken debug parameter
@@ -9,11 +9,11 @@ Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
 mDNSCore/mDNS.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
-Index: mDNSResponder/mDNSCore/mDNS.c
+diff --git a/mDNSCore/mDNS.c b/mDNSCore/mDNS.c
-===================================================================
+index 08bfafb11d8d..079c9742e419 100644
--- mDNSResponder.orig/mDNSCore/mDNS.c
+--- a/mDNSCore/mDNS.c
-+++ mDNSResponder/mDNSCore/mDNS.c
+++ b/mDNSCore/mDNS.c
-@@ -9481,7 +9481,7 @@ mDNSlocal void mDNSCoreReceiveNoUnicastA
+@@ -9481,7 +9481,7 @@ mDNSlocal void mDNSCoreReceiveNoUnicastAnswers(mDNS *const m, const DNSMessage *
                         {
                             CacheRecord *negcr;
                             const DNSServRef dnsserv = qptr->qDNSServer;
diff --git a/meta-networking/recipes-protocols/mdns/mdns/0006-make-Add-top-level-Makefile.patch b/meta-networking/recipes-protocols/mdns/mdns/0006-make-Add-top-level-Makefile.patch
index 5f8f428302..87b163f1e2 100644
--- a/meta-networking/recipes-protocols/mdns/mdns/0006-make-Add-top-level-Makefile.patch
+++ b/meta-networking/recipes-protocols/mdns/mdns/0006-make-Add-top-level-Makefile.patch
@@ -1,4 +1,4 @@
-From a1c982808ebfb71ba7e0f16040013b7127a6e2ab Mon Sep 17 00:00:00 2001
+From a90eacb0f42e4ac63fe8c0ab624e8af7d9d47bd1 Mon Sep 17 00:00:00 2001
 From: Alex Kiernan <alex.kiernan@gmail.com>
 Date: Tue, 6 Dec 2022 13:28:31 +0000
 Subject: [PATCH] make: Add top-level Makefile
diff --git a/meta-networking/recipes-protocols/mdns/mdns/0007-mDNSShared-Make-Apple-Wireless-Direct-Link-depend-on.patch b/meta-networking/recipes-protocols/mdns/mdns/0007-mDNSShared-Make-Apple-Wireless-Direct-Link-depend-on.patch
new file mode 100644
index 0000000000..7a47ddd789
--- /dev/null
+++ b/meta-networking/recipes-protocols/mdns/mdns/0007-mDNSShared-Make-Apple-Wireless-Direct-Link-depend-on.patch
@@ -0,0 +1,27 @@
+From eac5e89c884b4dd28a80f77d2c447a398e8db94f Mon Sep 17 00:00:00 2001
+From: Alex Kiernan <alex.kiernan@gmail.com>
+Date: Sat, 21 Mar 2026 20:12:39 +0000
+Subject: [PATCH] mDNSShared: Make Apple Wireless Direct Link depend on macOS
+Upstream-Status: Inactive-Upstream [Upstream does not take patches]
+Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
+---
+ mDNSShared/uds_daemon.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+diff --git a/mDNSShared/uds_daemon.c b/mDNSShared/uds_daemon.c
+index 6486f1ed51dd..3113313191d7 100644
+--- a/mDNSShared/uds_daemon.c
+++ b/mDNSShared/uds_daemon.c
+@@ -3626,7 +3626,11 @@ mDNSlocal void resolve_result_callback(mDNS *const m, DNSQuestion *question, con
+     request_state *const req = question->QuestionContext;
+     const mDNSu32 name_hash = mDNS_DomainNameFNV1aHash(&question->qname);
+     const mDNSBool isMDNSQuestion = mDNSOpaque16IsZero(question->TargetQID);
+#if MDNS_OS(macOS)
+     const mDNSBool is_split_awdl_query = (req->resolve_awdl && question->InterfaceID == AWDLInterfaceID);
+#else
+    const mDNSBool is_split_awdl_query = mDNSfalse;
+#endif
+     UDS_LOG_ANSWER_EVENT(isMDNSQuestion ? MDNS_LOG_CATEGORY_MDNS : MDNS_LOG_CATEGORY_DEFAULT, MDNS_LOG_DEFAULT,
+         req, question, answer, mDNSfalse, "DNSServiceResolve result", AddRecord);
+ 
diff --git a/meta-networking/recipes-protocols/mdns/mdns_2881.0.25.bb b/meta-networking/recipes-protocols/mdns/mdns_2881.100.56.0.1.bb
index d44eb72f67..4bbf012b83 100644
--- a/meta-networking/recipes-protocols/mdns/mdns_2881.0.25.bb
+++ b/meta-networking/recipes-protocols/mdns/mdns_2881.100.56.0.1.bb
@@ -14,9 +14,11 @@ SRC_URI = "git://github.com/apple-oss-distributions/mDNSResponder;protocol=https
           file://0006-make-Add-top-level-Makefile.patch \
           file://0001-Fix-build-with-gcc-15.patch \
           file://mdns.service \
+           file://0007-mDNSShared-Make-Apple-Wireless-Direct-Link-depend-on.patch \
+           file://0001-mDNSPosix-Rework-mbedtls-for-compatibility-with-mbed.patch \
           "
-BRANCH = "main"
+BRANCH = "rel/mDNSResponder-2881"
-SRCREV = "d4658af3f5f291311c6aee4210aa6d39bda82bbe"
+SRCREV = "ea3902cfeff86a04b4c684753c80e425edbd1a21"
 inherit github-releases manpages systemd update-rc.d
@@ -25,7 +27,10 @@ PACKAGECONFIG ?= "tls \
 PACKAGECONFIG[debug] = "DEBUG=1,DEBUG=0"
 PACKAGECONFIG[ipv6] = "HAVE_IPV6=1,HAVE_IPV6=0"
 PACKAGECONFIG[manpages] = ""
+PACKAGECONFIG[idlesleepcontrol] = ""
+PACKAGECONFIG[spc] = ""
 PACKAGECONFIG[tls] = ",tls=no,mbedtls"
+PACKAGECONFIG[unicast] = ""
 CVE_PRODUCT = "apple:mdnsresponder"
@@ -46,49 +51,55 @@ EXTRA_OEMAKE = "os=linux 'CC=${CCLD}' 'LD=${CCLD}' 'LINKOPTS=${LDFLAGS}' STRIP=:
 # MDNS_VERSIONSTR_NODTS disables __DATE__ and __TIME__ in the version string,
 # which are fixed anyway for build reproducibility.
-TARGET_CPPFLAGS += "-DMDNS_VERSIONSTR_NODTS"
+#
+# IDLESLEEPCONTROL_DISABLED - disables sleep control for Bonjour Sleep Proxy clients
+# UNICAST_DISABLED - disables unicast DNS functionality, including Wide Area Bonjour
+# SPC_DISABLED - disables Bonjour Sleep Proxy client
+TARGET_CPPFLAGS += "-DmDNSResponderVersion=${PV} \
+                    -DMDNS_VERSIONSTR_NODTS \
+                    ${@bb.utils.contains('PACKAGECONFIG','idlesleepcontrol','','-DIDLESLEEPCONTROL_DISABLED', d)} \
+                    ${@bb.utils.contains('PACKAGECONFIG','unicast','','-DUNICAST_DISABLED', d)} \
+                    ${@bb.utils.contains('PACKAGECONFIG','spc','','-DSPC_DISABLED', d)}"
 TARGET_CC_ARCH += "${LDFLAGS}"
 MDNS_BUILDDIR = "build/${@bb.utils.contains('PACKAGECONFIG','debug','debug','prod', d)}"
 do_install () {
-        cd mDNSPosix
+        install -d ${D}${bindir}
+        install -d ${D}${includedir}
+        install -d ${D}${libdir}
+        install -d ${D}${mandir}/man5
+        install -d ${D}${mandir}/man8
        install -d ${D}${sbindir}
-        install ${MDNS_BUILDDIR}/mdnsd ${D}${sbindir}
+        install -d ${D}${sysconfdir}
+        install -d ${D}${systemd_system_unitdir}
+        install -d ${D}${INIT_D_DIR}
-        install -d ${D}${libdir}
+        install ${B}/mDNSPosix/${MDNS_BUILDDIR}/mdnsd ${D}${sbindir}
-        install -m 0644 ${MDNS_BUILDDIR}/libdns_sd.so ${D}${libdir}/libdns_sd.so.1
+        install ${B}/mDNSPosix/${MDNS_BUILDDIR}/mDNSClientPosix ${D}${bindir}
-        ln -s libdns_sd.so.1 ${D}${libdir}/libdns_sd.so
+        install ${B}/mDNSPosix/${MDNS_BUILDDIR}/mDNSNetMonitor ${D}${bindir}
+        install ${B}/mDNSPosix/${MDNS_BUILDDIR}/mDNSProxyResponderPosix ${D}${bindir}
+        install ${B}/mDNSPosix/${MDNS_BUILDDIR}/mDNSResponderPosix ${D}${bindir}
-        install -d ${D}${includedir}
+        install -m 0644 ${B}/mDNSPosix/${MDNS_BUILDDIR}/libdns_sd.so ${D}${libdir}/libdns_sd.so.1
-        install -m 0644 ../mDNSShared/dns_sd.h ${D}${includedir}
+        ln -s libdns_sd.so.1 ${D}${libdir}/libdns_sd.so
-        install -d ${D}${mandir}/man8
+        install -m 0644 ${B}/mDNSShared/dns_sd.h ${D}${includedir}
-        install -m 0644 ../mDNSShared/mDNSResponder.8 ${D}${mandir}/man8/mdnsd.8
+        install -m 0644 ${B}/mDNSShared/mDNSResponder.8 ${D}${mandir}/man8/mdnsd.8
-        install -d ${D}${bindir}
+        install -m 0755 ${B}/Clients/build/dns-sd ${D}${bindir}
-        install -m 0755 ../Clients/build/dns-sd ${D}${bindir}
-        install -d ${D}${libdir}
+        oe_libinstall -C ${B}/mDNSPosix/${MDNS_BUILDDIR} -so libnss_mdns-0.2 ${D}${libdir}
-        oe_libinstall -C ${MDNS_BUILDDIR} -so libnss_mdns-0.2 ${D}${libdir}
        ln -s libnss_mdns-0.2.so ${D}${libdir}/libnss_mdns.so.2
-        install -d ${D}${sysconfdir}
+        install -m 0644 ${B}/mDNSPosix/nss_mdns.conf ${D}${sysconfdir}
-        install -m 0644 nss_mdns.conf ${D}${sysconfdir}
+        install -m 0644 ${B}/mDNSPosix/nss_mdns.conf.5 ${D}${mandir}/man5
+        install -m 0644 ${B}/mDNSPosix/libnss_mdns.8 ${D}${mandir}/man8
-        install -d ${D}${mandir}/man5
-        install -m 0644 nss_mdns.conf.5 ${D}${mandir}/man5
-        install -d ${D}${mandir}/man8
-        install -m 0644 libnss_mdns.8 ${D}${mandir}/man8
-        install -d ${D}${systemd_system_unitdir}
        install -m 0644 ${UNPACKDIR}/mdns.service ${D}${systemd_system_unitdir}
-        install -d ${D}${INIT_D_DIR}
+        install ${B}/mDNSPosix/mdnsd.sh ${D}${INIT_D_DIR}/mdns
-        install mdnsd.sh ${D}${INIT_D_DIR}/mdns
 }
 pkg_postinst:${PN}-libnss-mdns () {
@@ -110,7 +121,7 @@ pkg_prerm:${PN}-libnss-mdns () {
 SYSTEMD_SERVICE:${PN} = "mdns.service"
 INITSCRIPT_NAME = "mdns"
-PACKAGE_BEFORE_PN = "${PN}-libnss-mdns"
+PACKAGE_BEFORE_PN = "${PN}-libnss-mdns ${PN}-clients"
 RRECOMMENDS:${PN}:append:libc-glibc = " ${PN}-libnss-mdns"
@@ -118,4 +129,9 @@ FILES_SOLIBSDEV = "${libdir}/libdns_sd.so"
 FILES:${PN}-libnss-mdns = "${sysconfdir}/nss_mdns.conf ${libdir}/libnss_mdns*.so*"
 RPROVIDES:${PN}-libnss-mdns = "libnss-mdns"
+FILES:${PN}-clients = "${bindir}/mDNSClientPosix \
+                       ${bindir}/mDNSNetMonitor \
+                       ${bindir}/mDNSProxyResponderPosix \
+                       ${bindir}/mDNSResponderPosix"
 RPROVIDES:${PN} += "libdns-sd"
diff --git a/meta-networking/recipes-protocols/mjansson-mdns/files/0001-Bump-cmake_minimum_required-version-to-3.5-94.patch b/meta-networking/recipes-protocols/mjansson-mdns/files/0001-Bump-cmake_minimum_required-version-to-3.5-94.patch
new file mode 100644
index 0000000000..2afccbe463
--- /dev/null
+++ b/meta-networking/recipes-protocols/mjansson-mdns/files/0001-Bump-cmake_minimum_required-version-to-3.5-94.patch
@@ -0,0 +1,21 @@
+From ab8f4118469d7a0bb83b9fcb88fe53482c35f0cb Mon Sep 17 00:00:00 2001
+From: skrede <code@skrede.me>
+Date: Sun, 26 Oct 2025 14:35:05 +0100
+Subject: [PATCH] Bump cmake_minimum_required version to 3.5 (#94)
+Upstream-Status: Backport [https://github.com/mjansson/mdns/commit/ab8f4118469d7a0bb83b9fcb88fe53482c35f0cb]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 1bce26d..50f1f05 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 3.0)
+cmake_minimum_required(VERSION 3.5)
+ project(mdns VERSION 1.4.2 LANGUAGES C)
+ 
+ option(MDNS_BUILD_EXAMPLE "build example" ON)
diff --git a/meta-networking/recipes-protocols/mjansson-mdns/mjansson-mdns_1.4.3.bb b/meta-networking/recipes-protocols/mjansson-mdns/mjansson-mdns_1.4.3.bb
new file mode 100644
index 0000000000..5c404cbb9d
--- /dev/null
+++ b/meta-networking/recipes-protocols/mjansson-mdns/mjansson-mdns_1.4.3.bb
@@ -0,0 +1,14 @@
+SUMMARY = "Public domain mDNS/DNS-SD library in C"
+DESCRIPTION = "This library provides a header only cross-platform mDNS and DNS-DS library in C"
+SECTION = "net"
+LICENSE = "Unlicense"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=911690f51af322440237a253d695d19f"
+SRC_URI = "git://github.com/mjansson/mdns.git;protocol=https;branch=main;tag=${PV} \
+    file://0001-Bump-cmake_minimum_required-version-to-3.5-94.patch \
+"
+SRCREV = "1727be0602941a714cb6048a737f0584b1cebf3c"
+inherit cmake
+CVE_PRODUCT = "mjansson:mdns"
diff --git a/meta-networking/recipes-protocols/ngtcp2/ngtcp2_1.21.0.bb b/meta-networking/recipes-protocols/ngtcp2/ngtcp2_1.22.1.bb
index f71de5aa07..acff7b548b 100644
--- a/meta-networking/recipes-protocols/ngtcp2/ngtcp2_1.21.0.bb
+++ b/meta-networking/recipes-protocols/ngtcp2/ngtcp2_1.22.1.bb
@@ -4,8 +4,8 @@ BUGTRACKER = "https://github.com/ngtcp2/ngtcp2/issues"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://COPYING;md5=de0966c8ff4f62661a3da92967a75434"
-SRC_URI = "gitsm://github.com/ngtcp2/ngtcp2;protocol=https;branch=main;tag=v${PV};name=ngtcp2"
+SRC_URI = "gitsm://github.com/ngtcp2/ngtcp2;protocol=https;branch=release-1.22;tag=v${PV}"
-SRCREV = "9e32add590fc74707b62f61aa5e0aa5c6f8a2c60"
+SRCREV = "716e64b05f4a3709dfc0b0522cf9fd4456d055e5"
 DEPENDS = "brotli libev nghttp3"
@@ -18,3 +18,5 @@ PACKAGECONFIG[shared] = "-DENABLE_SHARED_LIB=ON, -DENABLE_SHARED_LIB=OFF"
 PACKAGECONFIG[build-lib-only] = "-DENABLE_LIB_ONLY=ON, -DENABLE_LIB_ONLY=OFF"
 PACKAGECONFIG[openssl] = "-DENABLE_OPENSSL=ON, -DENABLE_OPENSSL=OFF, openssl"
 PACKAGECONFIG[gnutls] = "-DENABLE_GNUTLS=ON, -DENABLE_GNUTLS=OFF, gnutls"
+CVE_STATUS[CVE-2026-40170] = "fixed-version: fixed in 1.22.1"
diff --git a/meta-networking/recipes-protocols/opcua/open62541_1.4.16.bb b/meta-networking/recipes-protocols/opcua/open62541_1.5.4.bb
index 32f7148f4b..9a39bb0e4f 100644
--- a/meta-networking/recipes-protocols/opcua/open62541_1.4.16.bb
+++ b/meta-networking/recipes-protocols/opcua/open62541_1.5.4.bb
@@ -8,13 +8,13 @@ LIC_FILES_CHKSUM = "\
 "
 SRCREV_FORMAT = "opcua_mdnsd_ua-nodeset_mqtt-c"
-SRCREV_opcua = "f63e2a819aff6e468242dc2e54ccbd5b75d63654"
+SRCREV_opcua = "dfd44a234645ed29cc6d190048bc8ae80c5454cd"
 SRCREV_mdnsd = "488d24fb9d427aec77df180268f0291eeee7fb8b"
-SRCREV_ua-nodeset = "d1bb6a22125bd7cd986272b1ee98a18a91d76fff"
+SRCREV_ua-nodeset = "257db9ad98ee7ba4b67d3500b54bfc9d744a36af"
 SRCREV_mqtt-c = "0f4c34c8cc00b16cfee094745d68b8cdbaecd8e0"
 SRC_URI = " \
-    git://github.com/open62541/open62541.git;name=opcua;branch=1.4;protocol=https \
+    git://github.com/open62541/open62541.git;name=opcua;branch=1.5;protocol=https \
    git://github.com/Pro/mdnsd.git;name=mdnsd;protocol=https;branch=master;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/mdnsd \
    git://github.com/OPCFoundation/UA-Nodeset;name=ua-nodeset;protocol=https;branch=latest;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/ua-nodeset \
    git://github.com/LiamBindle/MQTT-C.git;name=mqtt-c;protocol=https;branch=master;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/mqtt-c \
@@ -59,4 +59,5 @@ do_configure:prepend:toolchain-clang:riscv32() {
 do_install:append(){
    sed -i 's|${RECIPE_SYSROOT}|\$\{CMAKE_SYSROOT\}|g' ${D}${libdir}/cmake/open62541/open62541Targets.cmake
+    sed -i -e 's|-l[^ ]*/lib\([^ /]*\)\.so|-l\1|g' ${D}${libdir}/pkgconfig/open62541.pc
 }
diff --git a/meta-networking/recipes-protocols/openflow/openflow_git.bb b/meta-networking/recipes-protocols/openflow/openflow_git.bb
index 1588245f8a..d506dd4d01 100644
--- a/meta-networking/recipes-protocols/openflow/openflow_git.bb
+++ b/meta-networking/recipes-protocols/openflow/openflow_git.bb
@@ -40,6 +40,8 @@ DEPENDS:append:libc-musl = " libexecinfo"
 inherit autotools-brokensep pkgconfig
+CACHED_CONFIGUREVARS += "ac_cv_prog_cc_c23=no"
 do_configure:prepend() {
    ./boot.sh
 }
diff --git a/meta-networking/recipes-support/dnsmasq/dnsmasq_2.92.bb b/meta-networking/recipes-support/dnsmasq/dnsmasq_2.93.bb
index 59509ecba2..765287018b 100644
--- a/meta-networking/recipes-support/dnsmasq/dnsmasq_2.92.bb
+++ b/meta-networking/recipes-support/dnsmasq/dnsmasq_2.93.bb
@@ -16,7 +16,7 @@ SRC_URI = "http://www.thekelleys.org.uk/dnsmasq/${@['archive/', ''][float(d.getV
           file://dnsmasq-noresolvconf.service \
           file://dnsmasq-resolved.conf \
 "
-SRC_URI[sha256sum] = "fd908e79ff37f73234afcb6d3363f78353e768703d92abd8e3220ade6819b1e1"
+SRC_URI[sha256sum] = "cc967771abdafeb43d10db18932d6b59fd4bed2c69c22acf8cb96aff6920d55f"
 inherit pkgconfig update-rc.d systemd
diff --git a/meta-networking/recipes-support/dovecot/dovecot/0001-adapt-lua_newstate-to-new-api.patch b/meta-networking/recipes-support/dovecot/dovecot/0001-adapt-lua_newstate-to-new-api.patch
new file mode 100644
index 0000000000..363361fcd5
--- /dev/null
+++ b/meta-networking/recipes-support/dovecot/dovecot/0001-adapt-lua_newstate-to-new-api.patch
@@ -0,0 +1,29 @@
+From 5efcbab91b510f5a2495369b729248e8bf8a5d63 Mon Sep 17 00:00:00 2001
+From: Gyorgy Sarvari <skandigraun@gmail.com>
+Date: Tue, 31 Mar 2026 11:05:52 +0000
+Subject: [PATCH] adapt lua_newstate to new api
+lua_newstate() in lua 5.5 has gained a new, third argument, which made
+it not backwards compatible. This change adapts this call to the lua version
+used in OE.
+Upstream-Status: Pending
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/lib-lua/dlua-script.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/src/lib-lua/dlua-script.c b/src/lib-lua/dlua-script.c
+index 20f91ad..789d603 100644
+--- a/src/lib-lua/dlua-script.c
+++ b/src/lib-lua/dlua-script.c
+@@ -253,7 +253,7 @@ static struct dlua_script *dlua_create_script(const char *name,
+        /* lua API says that lua_newstate will return NULL only if it's out of
+           memory. this cannot really happen with our allocator as it will
+           call i_fatal_status anyways if it runs out of memory */
+-       script->L = lua_newstate(dlua_alloc, script);
+       script->L = lua_newstate(dlua_alloc, script, luaL_makeseed(NULL));
+        i_assert(script->L != NULL);
+        script->ref = 1;
+        lua_atpanic(script->L, dlua_atpanic);
diff --git a/meta-networking/recipes-support/dovecot/dovecot/0001-lib-regex-remove-LIBPCRE_LIBS-from.patch b/meta-networking/recipes-support/dovecot/dovecot/0001-lib-regex-remove-LIBPCRE_LIBS-from.patch
deleted file mode 100644
index b872587a88..0000000000
--- a/meta-networking/recipes-support/dovecot/dovecot/0001-lib-regex-remove-LIBPCRE_LIBS-from.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From fd3d65c65c778cf0a2fba6487c8d0eb30b6780b7 Mon Sep 17 00:00:00 2001
-From: Aki Tuomi <aki.tuomi@open-xchange.com>
-Date: Fri, 31 Oct 2025 12:53:33 +0200
-Subject: [PATCH] lib-regex: Remove LIBPCRE_LIBS from test dependencies
-Was accidentically added in 49ae6e798310e5c4b96709db435a3714ea6468a8
-Upstream-Status: Backport [https://github.com/dovecot/core/commit/fd3d65c65c778cf0a2fba6487c8d0eb30b6780b7]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
- src/lib-regex/Makefile.am | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/src/lib-regex/Makefile.am b/src/lib-regex/Makefile.am
-index 60f43d9779..9d26d27fa1 100644
--- a/src/lib-regex/Makefile.am
-+++ b/src/lib-regex/Makefile.am
-@@ -34,7 +34,7 @@ test_regex_LDADD = libdregex.la \
-                   ../lib-test/libtest.la \
-                   ../lib/liblib.la \
-                   $(LIBPCRE_LIBS)
-test_regex_DEPENDENCIES = libdregex.la $(LIBPCRE_LIBS)
-+test_regex_DEPENDENCIES = libdregex.la
- 
- check-local:
-        for bin in $(test_programs); do \
diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.4.2.bb b/meta-networking/recipes-support/dovecot/dovecot_2.4.4.bb
index e94306dd32..6cac8de964 100644
--- a/meta-networking/recipes-support/dovecot/dovecot_2.4.2.bb
+++ b/meta-networking/recipes-support/dovecot/dovecot_2.4.4.bb
@@ -6,17 +6,17 @@ in mind. Dovecot is an excellent choice for both small and large \
 installations. It's fast, simple to set up, requires no special \
 administration and it uses very little memory."
 SECTION = "mail"
-LICENSE = "LGPL-2.1-only & MIT"
+LICENSE = "LGPL-2.1-only & MIT & Unicode-3.0 & BSD-3-Clause & PD"
-LIC_FILES_CHKSUM = "file://COPYING;md5=2956560272e5b31d9d64f03111732048"
+LIC_FILES_CHKSUM = "file://COPYING;md5=cb805cc6bdb95ba8fc2398a55fd50877"
-SRC_URI = "http://dovecot.org/releases/2.4/dovecot-${PV}.tar.gz \
+SRC_URI = "https://dovecot.org/releases/2.4/dovecot-${PV}.tar.gz \
           file://0001-configure.ac-convert-AC_TRY_RUN-to-AC_TRY_LINK-state.patch \
           file://dovecot.service \
           file://dovecot.socket \
           file://0001-m4-Check-for-libunwind-instead-of-libunwind-generic.patch \
-           file://0001-lib-regex-remove-LIBPCRE_LIBS-from.patch \
+           file://0001-adapt-lua_newstate-to-new-api.patch \
           "
-SRC_URI[sha256sum] = "2cd62e4d22b9fc1c80bd38649739950f0dbda34fbc3e62624fb6842264e93c6e"
+SRC_URI[sha256sum] = "670f98d55a29b02ae6a97281e51374e553b94496480ab0a07439571ab30ca8c3"
 DEPENDS = "openssl xz zlib bzip2 libcap icu libtirpc bison-native"
 CFLAGS += "-I${STAGING_INCDIR}/tirpc"
@@ -29,6 +29,7 @@ PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'ldap pam systemd', d)}
 PACKAGECONFIG[pam] = "--with-pam,--without-pam,libpam,"
 PACKAGECONFIG[systemd] = "--with-systemd,--without-systemd,systemd,"
 PACKAGECONFIG[ldap] = "--with-ldap=plugin,--without-ldap,openldap,"
+PACKAGECONFIG[lua] = "--with-lua=yes, --without-lua, lua"
 PACKAGECONFIG[lz4] = "--with-lz4,--without-lz4,lz4,"
 # From native build in armv7a-hf/eglibc
@@ -80,3 +81,8 @@ FILES:${PN}-dev += "${libdir}/dovecot/libdovecot*.so"
 FILES:${PN}-dbg += "${libdir}/dovecot/*/.debug"
 CVE_STATUS[CVE-2016-4983] = "not-applicable-platform: Affects only postinstall script on specific distribution."
+CVE_STATUS[CVE-2025-59031] = "fixed-version: fixed since v2.4.2"
+CVE_STATUS[CVE-2026-0394] = "fixed-version: fixed since v2.4.1"
+CVE_STATUS[CVE-2026-24031] = "fixed-version: fixed since v2.4.3"
+CVE_STATUS[CVE-2026-27855] = "fixed-version: fixed since v2.4.3"
+CVE_STATUS[CVE-2026-27860] = "fixed-version: fixed since v2.4.3"
diff --git a/meta-networking/recipes-support/drbd/drbd-utils/0001-Fix-build-with-gcc-15.patch b/meta-networking/recipes-support/drbd/drbd-utils/0001-Fix-build-with-gcc-15.patch
deleted file mode 100644
index 00105fb844..0000000000
--- a/meta-networking/recipes-support/drbd/drbd-utils/0001-Fix-build-with-gcc-15.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From b42265af87d9efcc9aac91b3a3da3df5c5c66e29 Mon Sep 17 00:00:00 2001
-From: Nguyen Dat Tho <tho3.nguyen@lge.com>
-Date: Wed, 9 Apr 2025 17:33:25 +0900
-Subject: [PATCH] Fix build with gcc-15
-To fix the following error:
-In file included from string_matching.cpp:1:
-./string_matching.h:10:18: error: 'uint16_t' does not name a type
-   10 |     extern const uint16_t   PATTERN_LIMIT;
-      |                  ^~~~~~~~
-./string_matching.h:7:1: note: 'uint16_t' is defined in header '<cstdint>'; this is probably fixable by adding '#include <cstdint>'
-Upstream-Status: Submitted [https://github.com/LINBIT/drbd-utils/pull/50]
-Signed-off-by: Nguyen Dat Tho <tho3.nguyen@lge.com>
---
- user/drbdmon/string_matching.h | 1 +
- 1 file changed, 1 insertion(+)
-diff --git a/user/drbdmon/string_matching.h b/user/drbdmon/string_matching.h
-index 9b3918fe..b783ba48 100644
--- a/user/drbdmon/string_matching.h
-+++ b/user/drbdmon/string_matching.h
-@@ -4,6 +4,7 @@
- #include <string>
- #include <memory>
- #include <stdexcept>
-+#include <cstdint>
- 
- namespace string_matching
- {
-- 
-2.34.1
diff --git a/meta-networking/recipes-support/drbd/drbd-utils/0001-fix-the-hardcoded-legacy-helper-path.patch b/meta-networking/recipes-support/drbd/drbd-utils/0001-fix-the-hardcoded-legacy-helper-path.patch
new file mode 100644
index 0000000000..3d7c95b4a8
--- /dev/null
+++ b/meta-networking/recipes-support/drbd/drbd-utils/0001-fix-the-hardcoded-legacy-helper-path.patch
@@ -0,0 +1,53 @@
+From 301e64db17466316ac34a28e30867cc7853777b5 Mon Sep 17 00:00:00 2001
+From: Haiqing Bai <Haiqing.Bai@windriver.com>
+Date: Thu, 16 Apr 2026 10:00:19 +0000
+Subject: [PATCH] Fix the hardcoded legacy helper path
+Fix the below issue:
+"~# drbdadm --version
+execvp() failed to exec drbdadm-84: No such file or directory"
+The legacy helper path was hardcoded to "/lib/drbd", which does not exist
+on systems where LIBDIR is configured to a different location (e.g.
+/usr/lib). This caused drbdadm to fail when attempting to exec drbdadm-84.
+Use the build-configured DRBD_LEGACY_LIB_DIR (derived from LIBDIR) instead
+of the hardcoded path, so the legacy helper lookup respects the actual
+install prefix.
+Upstream-Status: Pending
+Signed-off-by: Haiqing Bai <haiqing.bai@windriver.com>
+---
+ user/v9/Makefile.in       | 1 +
+ user/v9/drbdtool_common.c | 3 +--
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/user/v9/Makefile.in b/user/v9/Makefile.in
+index fa12f79..980c67c 100644
+--- a/user/v9/Makefile.in
+++ b/user/v9/Makefile.in
+@@ -70,6 +70,7 @@ CFLAGS += -DKEYUTILS
+ endif
+ ifeq ($(WITH_84_SUPPORT),yes)
+ CFLAGS += -DWITH_84_SUPPORT
+CFLAGS += -DDRBD_LEGACY_LIB_DIR=\"$(LIBDIR)\"
+ endif
+ CFLAGS += $(EXTRA_CFLAGS)
+ 
+diff --git a/user/v9/drbdtool_common.c b/user/v9/drbdtool_common.c
+index d07d054..ea95a16 100644
+--- a/user/v9/drbdtool_common.c
+++ b/user/v9/drbdtool_common.c
+@@ -332,8 +332,7 @@ void add_component_to_path(const char *path)
+ 
+ void add_lib_drbd_to_path(void)
+ {
+-               /* TODO: if exec-prefix != "/" ? */
+-       add_component_to_path("/lib/drbd");
+       add_component_to_path(DRBD_LEGACY_LIB_DIR);
+ }
+ 
+ /* from linux/crypto/crc32.c */
+-- 
+2.53.0
diff --git a/meta-networking/recipes-support/drbd/drbd-utils_9.30.0.bb b/meta-networking/recipes-support/drbd/drbd-utils_9.34.0.bb
index 4c520e8c78..abc406b5e0 100644
--- a/meta-networking/recipes-support/drbd/drbd-utils_9.30.0.bb
+++ b/meta-networking/recipes-support/drbd/drbd-utils_9.34.0.bb
@@ -11,10 +11,10 @@ SRC_URI = "git://github.com/LINBIT/drbd-utils;name=drbd-utils;branch=master;prot
           git://github.com/LINBIT/drbd-headers;name=drbd-headers;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/drbd-headers;branch=master;protocol=https \
           file://0001-drbdmon-add-LDFLAGS-when-linking.patch \
           ${@bb.utils.contains('DISTRO_FEATURES','usrmerge','file://0001-drbd-utils-support-usrmerge.patch','',d)} \
-           file://0001-Fix-build-with-gcc-15.patch \
+           file://0001-fix-the-hardcoded-legacy-helper-path.patch \
           "
-SRCREV_drbd-utils = "36ea199f38b543b2da92219109c2832e122e5bf9"
+SRCREV_drbd-utils = "7fe34d56a7264cfc92fc5270471827bb3f7773e6"
-SRCREV_drbd-headers = "94f4472513f351efba5788f783feba6ac6efe9fc"
+SRCREV_drbd-headers = "8ab631bfa8eb606e53c86f50b9f2d6f51d0f9ca5"
 SRCREV_FORMAT = "drbd-utils_drbd-headers"
@@ -56,7 +56,9 @@ do_install:append() {
    sed -i -e 's#@nonarch_libdir@#${nonarch_libdir}#g' ${D}${systemd_unitdir}/system/drbd-wait-promotable@.service
    sed -i -e 's#@nonarch_libdir@#${nonarch_libdir}#g' ${D}${systemd_unitdir}/system/drbd.service
    sed -i -e 's#@nonarch_libdir@#${nonarch_libdir}#g' ${D}${systemd_unitdir}/system/drbd@.service
-    sed -i -e 's#@nonarch_libdir@#${nonarch_libdir}#g' ${D}${systemd_unitdir}/system/ocf.ra@.service
+    install -D -m 0644 ${D}/50-drbd.preset ${D}${systemd_unitdir}/system-preset/50-drbd.preset
+    rm -f ${D}/50-drbd.preset
 }
 RDEPENDS:${PN} += "bash perl-module-getopt-long perl-module-exporter perl-module-constant perl-module-overloading perl-module-exporter-heavy"
@@ -69,6 +71,7 @@ FILES:${PN} += "${nonarch_base_libdir}/drbd \
                ${nonarch_libdir}/tmpfiles.d \
                ${nonarch_libdir}/drbdscripts/* \
                ${systemd_unitdir}/system/* \
+                ${systemd_unitdir}/system-preset/50-drbd.preset \
 "
 FILES:${PN}-dbg += "${nonarch_base_libdir}/drbd/.debug"
diff --git a/meta-networking/recipes-support/ettercap/ettercap/CVE-2026-3606.patch b/meta-networking/recipes-support/ettercap/ettercap/CVE-2026-3606.patch
deleted file mode 100644
index e1b19ea05b..0000000000
--- a/meta-networking/recipes-support/ettercap/ettercap/CVE-2026-3606.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From a7347f49b928f47fc37805c9f3a70a9487d45a65 Mon Sep 17 00:00:00 2001
-From: Alexander Koeppe <alexander@koeppe.rocks>
-Date: Sun, 8 Mar 2026 17:57:39 +0100
-Subject: [PATCH] Fix heap-out-of-bounds read issue in etterfilter
- (CVE-2026-3606)
-CVE: CVE-2026-3603
-Upstream-Status: Backport [https://github.com/Ettercap/ettercap/commit/41c312d4be6f6067968a275bf66b2abd2a0ba385]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
- include/ec.h                  | 6 ++++++
- utils/etterfilter/ef_output.c | 4 ++--
- 2 files changed, 8 insertions(+), 2 deletions(-)
-diff --git a/include/ec.h b/include/ec.h
-index d69de613..80c7eaba 100644
--- a/include/ec.h
-+++ b/include/ec.h
-@@ -94,6 +94,12 @@
-    ON_ERROR(x, NULL, "virtual memory exhausted"); \
- } while(0)
- 
-+#define SAFE_RECALLOC(x, s) do { \
-+   x = realloc(x, s); \
-+   ON_ERROR(x, NULL, "virtual memory exhausted"); \
-+   memset(x, 0, s); \
-+} while(0)
-+
- #define SAFE_STRDUP(x, s) do{ \
-    x = strdup(s); \
-    ON_ERROR(x, NULL, "virtual memory exhausted"); \
-diff --git a/utils/etterfilter/ef_output.c b/utils/etterfilter/ef_output.c
-index 2530e599..2f49177e 100644
--- a/utils/etterfilter/ef_output.c
-+++ b/utils/etterfilter/ef_output.c
-@@ -150,10 +150,10 @@ static size_t create_data_segment(u_char** data, struct filter_header *fh, struc
- static size_t add_data_segment(u_char **data, size_t base, u_char **string, size_t slen)
- {
-    /* make room for the new string */
-   SAFE_REALLOC(*data, base + slen + 1);
-+   SAFE_RECALLOC(*data, base + slen + 1);
- 
-    /* copy the string, NULL separated */
-   memcpy(*data + base, *string, slen + 1);
-+   memcpy(*data + base, *string, slen);
- 
-    /* 
-     * change the pointer to the new string location 
diff --git a/meta-networking/recipes-support/ettercap/ettercap_0.8.4.bb b/meta-networking/recipes-support/ettercap/ettercap_0.8.4.1.bb
index 6fac3a0b84..a28de7b2bd 100644
--- a/meta-networking/recipes-support/ettercap/ettercap_0.8.4.bb
+++ b/meta-networking/recipes-support/ettercap/ettercap_0.8.4.1.bb
@@ -22,10 +22,9 @@ DEPENDS += "ethtool \
 RDEPENDS:${PN} += "bash ethtool libgcc"
 SRC_URI = "gitsm://github.com/Ettercap/ettercap;branch=master;protocol=https;tag=v${PV} \
-           file://CVE-2026-3606.patch \
           "
-SRCREV = "41da65f4026a9e4cea928e61941b976d9279f508"
+SRCREV = "0dc8409779f3a09cbfff4434b9a4d7b33480d88d"
 EXTRA_OECMAKE = " \
    -DCMAKE_SKIP_RPATH=TRUE \
diff --git a/meta-networking/recipes-support/linux-atm/linux-atm_2.5.2.bb b/meta-networking/recipes-support/linux-atm/linux-atm_2.5.2.bb
index b43900a94d..f87aa92932 100644
--- a/meta-networking/recipes-support/linux-atm/linux-atm_2.5.2.bb
+++ b/meta-networking/recipes-support/linux-atm/linux-atm_2.5.2.bb
@@ -4,6 +4,7 @@ SECTION = "libs"
 LICENSE = "GPL-2.0-only & LGPL-2.0-only"
 DEPENDS = "flex flex-native"
+RRECOMMENDS:${PN} = "kernel-module-atm-tcp"
 SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}/${PV}/${BP}.tar.gz \
           file://link-with-ldflags.patch \
@@ -31,6 +32,8 @@ file://COPYING.LGPL;md5=6e29c688d912da12b66b73e32b03d812"
 inherit autotools pkgconfig
+CACHED_CONFIGUREVARS += "ac_cv_prog_cc_c23=no"
 EXTRA_OEMAKE += "ROOTPREFIX=${root_prefix}"
 FILES:${PN} += "${nonarch_base_libdir}/firmware"
diff --git a/meta-networking/recipes-support/mdio-tools/mdio-netlink_1.3.1.bb b/meta-networking/recipes-support/mdio-tools/mdio-netlink_1.3.2.bb
index 52e7e53c32..52e7e53c32 100644
--- a/meta-networking/recipes-support/mdio-tools/mdio-netlink_1.3.1.bb
+++ b/meta-networking/recipes-support/mdio-tools/mdio-netlink_1.3.2.bb
diff --git a/meta-networking/recipes-support/mdio-tools/mdio-tools.inc b/meta-networking/recipes-support/mdio-tools/mdio-tools.inc
index fc8161eb1f..b90f476e89 100644
--- a/meta-networking/recipes-support/mdio-tools/mdio-tools.inc
+++ b/meta-networking/recipes-support/mdio-tools/mdio-tools.inc
@@ -4,5 +4,5 @@ HOMEPAGE = "https://github.com/wkz/mdio-tools"
 LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
-SRC_URI = "git://github.com/wkz/mdio-tools.git;protocol=https;branch=master"
+SRC_URI = "git://github.com/wkz/mdio-tools.git;protocol=https;branch=master;tag=${PV}"
-SRCREV = "f74eaf38dbda441df4fcaeb21ca4465957953a2f"
+SRCREV = "a1fca6b8fb3b5a95ebb28324a95673488dddc005"
diff --git a/meta-networking/recipes-support/mdio-tools/mdio-tools_1.3.1.bb b/meta-networking/recipes-support/mdio-tools/mdio-tools_1.3.2.bb
index 2c8f9b8c37..3b4a525da0 100644
--- a/meta-networking/recipes-support/mdio-tools/mdio-tools_1.3.1.bb
+++ b/meta-networking/recipes-support/mdio-tools/mdio-tools_1.3.2.bb
@@ -6,3 +6,4 @@ DEPENDS += "virtual/kernel libmnl"
 inherit pkgconfig autotools
 RRECOMMENDS:${PN} = "kernel-module-mdio-netlink"
diff --git a/meta-networking/recipes-support/memcached/memcached/memcached-add-hugetlbfs-check.patch b/meta-networking/recipes-support/memcached/memcached/memcached-add-hugetlbfs-check.patch
deleted file mode 100644
index 26281e73ef..0000000000
--- a/meta-networking/recipes-support/memcached/memcached/memcached-add-hugetlbfs-check.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From dfa90817a08f206f7e2dbba44d913968ae7f7d94 Mon Sep 17 00:00:00 2001
-From: Chong Lu <Chong.Lu@windriver.com>
-Date: Tue, 19 Aug 2014 17:38:32 +0800
-Subject: [PATCH] memcached: add knob to detect whether hugetlbfs are checked
-Add knob to detect whether hugetlbfs are checked or not.
-Upstream-Status: Pending
-Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
---
- configure.ac | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/configure.ac b/configure.ac
-index 6f2ef97..bd7dd96 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -559,8 +559,12 @@ if test "x$enable_static" = "xyes"; then
- fi
- 
- dnl ----------------------------------------------------------------------------
-+AC_ARG_ENABLE(hugetlbfs,
-+  [AS_HELP_STRING([--enable-hugetlbfs],[Enable hugetlbfs])])
- 
-AC_SEARCH_LIBS(gethugepagesizes, hugetlbfs)
-+if test "x$enable_hugetlbfs" = "xyes"; then
-+  AC_SEARCH_LIBS(gethugepagesizes, hugetlbfs)
-+fi
- 
- AC_HEADER_STDBOOL
- AH_BOTTOM([#if HAVE_STDBOOL_H
diff --git a/meta-networking/recipes-support/memcached/memcached_1.6.41.bb b/meta-networking/recipes-support/memcached/memcached_1.6.42.bb
index 9d759069ba..28d8ba3cf9 100644
--- a/meta-networking/recipes-support/memcached/memcached_1.6.41.bb
+++ b/meta-networking/recipes-support/memcached/memcached_1.6.42.bb
@@ -19,17 +19,14 @@ RDEPENDS:${PN} += "perl perl-module-posix perl-module-autoloader \
    perl-module-tie-hash bash \
    "
-SRC_URI = "http://www.memcached.org/files/${BP}.tar.gz \
+SRC_URI = "http://www.memcached.org/files/${BP}.tar.gz"
-           file://memcached-add-hugetlbfs-check.patch \
+SRC_URI[sha256sum] = "50f08b879d4f9d36dea9d905e9eaade15c708e38db7e9a73fc21dc8b45395de7"
-           "
-SRC_URI[sha256sum] = "e097073c156eeff9e12655b054f446d57374cfba5c132dcdbe7fac64e728286a"
 CVE_STATUS[CVE-2022-26635] = "disputed: this is a problem of applications using php-memcached inproperly"
 UPSTREAM_CHECK_URI = "${HOMEPAGE}"
-# set the same COMPATIBLE_HOST as libhugetlbfs
+COMPATIBLE_HOST = "(i.86|x86_64|powerpc|powerpc64|riscv64|aarch64|arm).*-linux*"
-COMPATIBLE_HOST = "(i.86|x86_64|powerpc|powerpc64|aarch64|arm).*-linux*"
 # assoc.c:83:9: error: variable 'depth' set but not used [-Werror,-Wunused-but-set-variable]
 CFLAGS:append:toolchain-clang = " -Wno-error=unused-but-set-variable"
@@ -42,9 +39,6 @@ python __anonymous () {
        d.appendVar('EXTRA_OECONF', " ac_cv_c_endian=big")
 }
-PACKAGECONFIG ??= ""
-PACKAGECONFIG[hugetlbfs] = "--enable-hugetlbfs, --disable-hugetlbfs, libhugetlbfs"
 inherit update-rc.d
 INITSCRIPT_NAME = "memcached"
diff --git a/meta-networking/recipes-support/nbdkit/nbdkit_1.47.5.bb b/meta-networking/recipes-support/nbdkit/nbdkit_1.47.9.bb
index 5ec440fc18..5c6c0a2e64 100644
--- a/meta-networking/recipes-support/nbdkit/nbdkit_1.47.5.bb
+++ b/meta-networking/recipes-support/nbdkit/nbdkit_1.47.9.bb
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=26250adec854bc317493f6fb98efe049"
 SRC_URI = "git://gitlab.com/nbdkit/nbdkit.git;protocol=https;branch=master;tag=v${PV} \
           file://0002-plugins-Avoid-absolute-buildpaths-in-binaries.patch \
           "
-SRCREV = "131372494a384a2ee21b97ec9375b7a55636a417"
+SRCREV = "714956cc9901c752598a214ae72fc69a897cd3b9"
 DEPENDS = "curl xz e2fsprogs zlib"
diff --git a/meta-networking/recipes-support/netcf/netcf/0001-Adopt-to-new-gnulib-read_file-fread_file-signature.patch b/meta-networking/recipes-support/netcf/netcf/0001-Adopt-to-new-gnulib-read_file-fread_file-signature.patch
deleted file mode 100644
index b188248fff..0000000000
--- a/meta-networking/recipes-support/netcf/netcf/0001-Adopt-to-new-gnulib-read_file-fread_file-signature.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From af256680926e166ac21bc0f11172ea6c077a9b55 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Sat, 9 Mar 2024 10:40:48 -0800
-Subject: [PATCH] Adopt to new gnulib read_file/fread_file signature
-It now expects a flag parameter in latest gnulib
-see [1]
-[1] https://public-inbox.org/bug-gnulib/87tv01c1z2.fsf-ueno@gnu.org/
-Upstream-Status: Pending
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
- src/dutil_linux.c  | 4 ++--
- src/dutil_posix.c  | 2 +-
- src/ncftool.c      | 2 +-
- src/ncftransform.c | 2 +-
- 4 files changed, 5 insertions(+), 5 deletions(-)
-diff --git a/src/dutil_linux.c b/src/dutil_linux.c
-index 742153a..eb72eb2 100644
--- a/src/dutil_linux.c
-+++ b/src/dutil_linux.c
-@@ -1113,7 +1113,7 @@ static void add_link_info(struct netcf *ncf,
- 
-     xasprintf(&path, "/sys/class/net/%s/operstate", ifname);
-     ERR_NOMEM(!path, ncf);
-    state = read_file(path, &length);
-+    state = read_file(path, 0, &length);
-     if (!state) {
-         /* missing operstate is *not* an error. It could be due to an
-          * alias interface, which has no entry in /sys/class/net at
-@@ -1132,7 +1132,7 @@ static void add_link_info(struct netcf *ncf,
-         FREE(path);
-         xasprintf(&path, "/sys/class/net/%s/speed", ifname);
-         ERR_NOMEM(path == NULL, ncf);
-        speed = read_file(path, &length);
-+        speed = read_file(path, 0, &length);
-         if (!speed && errno == EINVAL) {
-             /* attempts to read $ifname/speed result in EINVAL if the
-              * interface is ifconfiged down (which isn't exactly the
-diff --git a/src/dutil_posix.c b/src/dutil_posix.c
-index 1313514..b9884f0 100644
--- a/src/dutil_posix.c
-+++ b/src/dutil_posix.c
-@@ -211,7 +211,7 @@ int run_program(struct netcf *ncf, const char *const *argv, char **output)
-                        "Failed to create file stream for output while executing '%s': %s",
-                        argv_str, errbuf);
- 
-    *output = fread_file(outfile, &outlen);
-+    *output = fread_file(outfile, 0, &outlen);
-     ERR_THROW_STRERROR(*output == NULL, ncf, EEXEC,
-                        "Error while reading output from execution of '%s': %s",
-                        argv_str, errbuf);
-diff --git a/src/ncftool.c b/src/ncftool.c
-index f1b5642..c878cb0 100644
--- a/src/ncftool.c
-+++ b/src/ncftool.c
-@@ -351,7 +351,7 @@ static int cmd_define(const struct command *cmd) {
-     struct netcf_if *nif = NULL;
-     int result = CMD_RES_ERR;
- 
-    xml = read_file(fname, &length);
-+    xml = read_file(fname, 0, &length);
-     if (xml == NULL) {
-         fprintf(stderr, "Failed to read %s\n", fname);
-         goto done;
-diff --git a/src/ncftransform.c b/src/ncftransform.c
-index fbabfc3..4c9a56d 100644
--- a/src/ncftransform.c
-+++ b/src/ncftransform.c
-@@ -54,7 +54,7 @@ int main(int argc, char **argv) {
-     if (argc != 3 || (STRNEQ(argv[1], "get") && STRNEQ(argv[1], "put")))
-         die("Usage: ncftransform (put|get) FILE\n");
- 
-    in_xml = read_file(argv[2], &length);
-+    in_xml = read_file(argv[2], 0, &length);
-     if (in_xml == NULL)
-         die("Failed to read %s\n", argv[2]);
- 
-- 
-2.44.0
diff --git a/meta-networking/recipes-support/netcf/netcf_0.2.8.bb b/meta-networking/recipes-support/netcf/netcf_0.2.8.bb
deleted file mode 100644
index 4170e9fab0..0000000000
--- a/meta-networking/recipes-support/netcf/netcf_0.2.8.bb
+++ /dev/null
@@ -1,72 +0,0 @@
-SUMMARY = "netcf"
-DESCRIPTION = "netcf is a cross-platform network configuration library."
-HOMEPAGE = "https://pagure.io/netcf"
-SECTION = "libs"
-LICENSE = "LGPL-2.1-only"
-LIC_FILES_CHKSUM = "file://COPYING;md5=fb919cc88dbe06ec0b0bd50e001ccf1f"
-SRCREV = "2c5d4255857531bc09d91dcd02e86545f29004d4"
-PV .= "+git"
-SRC_URI = "git://pagure.io/netcf.git;protocol=https;branch=master \
-           file://0001-Adopt-to-new-gnulib-read_file-fread_file-signature.patch"
-UPSTREAM_CHECK_GITTAGREGEX = "release-(?P<pver>(\d+(\.\d+)+))"
-DEPENDS += "augeas libnl libxslt libxml2"
-do_configure[depends] += "${MLPREFIX}gnulib:do_populate_sysroot"
-inherit gettext autotools perlnative pkgconfig systemd
-EXTRA_OECONF:append:class-target = " --with-driver=redhat"
-PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}"
-PACKAGECONFIG[systemd] = "--with-sysinit=systemd,--with-sysinit=initscripts,"
-do_configure:prepend() {
-    currdir=`pwd`
-    cd ${S}
-    # avoid bootstrap cloning gnulib on every configure
-    # the dir starts out empty from the pkg, but unconditionally blow it
-    # away so if we reconfigure due to gnulib sysroot sig changes, we will
-    # get the newer gnulib content into the build here.
-    rm -rf ${S}/.gnulib
-    cp -rf ${STAGING_DATADIR}/gnulib ${S}/.gnulib
-    # --force to avoid errors on reconfigure e.g if recipes changed we depend on
-    # | bootstrap: running: libtoolize --quiet
-    # | libtoolize:   error: 'libltdl/COPYING.LIB' exists: use '--force' to overwrite
-    # | ...
-    ./bootstrap --force --no-git --gnulib-srcdir=.gnulib
-    cd $currdir
-}
-do_install:append() {
-    if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
-       install -d ${D}${systemd_unitdir}/system
-       if [ -d "${D}${libdir}/systemd/system" ]; then
-           if [ "${systemd_unitdir}" != "${libdir}/systemd" ] ; then 
-               mv ${D}${libdir}/systemd/system/* ${D}${systemd_unitdir}/system/
-               rm -rf ${D}${libdir}/systemd/
-           fi
-       elif [ "${systemd_unitdir}" != "${nonarch_libdir}/systemd" ] ; then 
-           mv ${D}${nonarch_libdir}/systemd/system/* ${D}${systemd_unitdir}/system/
-           rm -rf ${D}${nonarch_libdir}/systemd/
-       fi
-    else
-       mv ${D}${sysconfdir}/rc.d/init.d/ ${D}${sysconfdir}
-       rm -rf ${D}${sysconfdir}/rc.d/
-    fi
-}
-FILES:${PN} += " \
-        ${libdir} \
-        ${nonarch_libdir} \
-        "
-SYSTEMD_SERVICE:${PN} = "netcf-transaction.service"
diff --git a/meta-networking/recipes-support/netperf/files/0001-cleanup-modernize-sendfile_tcp_stream-signature-from.patch b/meta-networking/recipes-support/netperf/files/0001-cleanup-modernize-sendfile_tcp_stream-signature-from.patch
new file mode 100644
index 0000000000..4e8731fb25
--- /dev/null
+++ b/meta-networking/recipes-support/netperf/files/0001-cleanup-modernize-sendfile_tcp_stream-signature-from.patch
@@ -0,0 +1,25 @@
+From ea9ce6ae6154660f2a1dc7a73aedf906cc935a72 Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Sun, 12 Apr 2026 16:38:28 -0700
+Subject: [PATCH] cleanup: modernize sendfile_tcp_stream signature from K&R to ANSI C style
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ src/nettest_bsd.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+diff --git a/src/nettest_bsd.c b/src/nettest_bsd.c
+index 36f5810..e7feb83 100644
+--- a/src/nettest_bsd.c
+++ b/src/nettest_bsd.c
+@@ -4270,8 +4270,7 @@ Size (bytes)\n\
+    all it knows, nothig is different. */
+ void
+-sendfile_tcp_stream(remote_host)
+-     char      remote_host[];
+sendfile_tcp_stream (char      remote_host[])
+ {
+   char *tput_title = "\
diff --git a/meta-networking/recipes-support/netperf/netperf_git.bb b/meta-networking/recipes-support/netperf/netperf_git.bb
index d5a717b0f6..8f49a7596b 100644
--- a/meta-networking/recipes-support/netperf/netperf_git.bb
+++ b/meta-networking/recipes-support/netperf/netperf_git.bb
@@ -18,6 +18,7 @@ SRC_URI = "git://github.com/HewlettPackard/netperf.git;branch=master;protocol=ht
           file://0001-Makefile.am-add-ACLOCAL_AMFLAGS.patch \
           file://0001-Fix-too-many-arguments-error-occurring-in-gcc-15.patch \
           file://0001-Fix-multiple-definitions-with-enable-intervals.patch \
+           file://0001-cleanup-modernize-sendfile_tcp_stream-signature-from.patch \
           "
 SRCREV = "3bc455b23f901dae377ca0a558e1e32aa56b31c4"
diff --git a/meta-networking/recipes-support/ntopng/files/0001-Follow-rrd-post-1.8-change.patch b/meta-networking/recipes-support/ntopng/files/0001-Follow-rrd-post-1.8-change.patch
deleted file mode 100644
index eefd4e1ab2..0000000000
--- a/meta-networking/recipes-support/ntopng/files/0001-Follow-rrd-post-1.8-change.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From a3bd9efe78f9c381f19b99c8ceb7f52b4c2a52b8 Mon Sep 17 00:00:00 2001
-From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Date: Wed, 5 Jun 2024 09:40:17 +0300
-Subject: [PATCH] Follow rrd post-1.8 change
-Git version of rrdtool has changed rrd_tune argument from char pointer
-to const char pointer. GCC 14 is more strict regarding the pointer
-constantness checks and errors out in such a case. Update rrd_tune
-invokation.
-Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
-Upstream-Status: Pending [CLA is not signed on our side]
---
- src/LuaEngineNtop.cpp | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/src/LuaEngineNtop.cpp b/src/LuaEngineNtop.cpp
-index bd2de79e3021..dd00f1608f78 100644
--- a/src/LuaEngineNtop.cpp
-+++ b/src/LuaEngineNtop.cpp
-@@ -5427,7 +5427,7 @@ static int ntop_rrd_tune(lua_State* vm) {
-   filename = argv[1];
- 
-   reset_rrd_state();
-  status = rrd_tune(argc, (char**)argv);
-+  status = rrd_tune(argc, (const char**)argv);
- 
-   if(status != 0) {
-     char *err = rrd_get_error();
-- 
-2.39.2
diff --git a/meta-networking/recipes-support/ntopng/files/0001-Makefile.in-don-t-use-the-internal-lua.patch b/meta-networking/recipes-support/ntopng/files/0001-Makefile.in-don-t-use-the-internal-lua.patch
index bb5bcfbd63..402d679a90 100644
--- a/meta-networking/recipes-support/ntopng/files/0001-Makefile.in-don-t-use-the-internal-lua.patch
+++ b/meta-networking/recipes-support/ntopng/files/0001-Makefile.in-don-t-use-the-internal-lua.patch
@@ -14,26 +14,32 @@ Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
 Makefile.in | 2 --
 1 file changed, 2 deletions(-)
-diff --git a/Makefile.in b/Makefile.in
-index d737e74..a611b16 100755
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -36,7 +36,6 @@ MONGOOSE_INC=-I$(MONGOOSE_HOME)
+@@ -31,8 +31,6 @@ MONGOOSE_INC=-I$(MONGOOSE_HOME)
+ 
 LUA_PLATFORM=generic
- LUA_HOME=${PWD}/third-party/lua-5.4.3
+ LUA_HOME=${PWD}/third-party/lua-5.4.6
- LUA_INC=-I$(LUA_HOME)/src
+-LUA_INC=-I$(LUA_HOME)/src
 -LUA_LIB=$(LUA_HOME)/src/liblua.a
 
- ifeq ($(OS),Linux)
+ HAVE_CLICKHOUSE=@HAVE_CLICKHOUSE@
-        LUA_PLATFORM=linux
+ CLICKHOUSE_HOME=
-@@ -102,7 +101,6 @@ RPM_PKG = $(TARGET)-$(NTOPNG_VERSION)-@REVISION@.$(PLATFORM).rpm
+@@ -52,7 +50,7 @@ else ifeq ($(OS),Darwin)
- RPM_DATA_PKG = $(TARGET)-data-$(NTOPNG_VERSION)-@REVISION@.noarch.rpm
+        LUA_PLATFORM=macosx
+ else ifeq ($(OS), $(filter $(OS), FreeBSD))
+        LUA_PLATFORM=freebsd
+-       LUA_LIB=/usr/local/lib/liblua-5.3.a
+       LUA_LIB=liblua.a
+ endif
+ 
 ######
+@@ -138,7 +136,7 @@ HEADERS = $(wildcard include/*.h) $(wild
+ INC     = $(wildcard src/*.inc)
+ OBJECTS_NO_MAIN := $(filter-out src/main.o,$(OBJECTS))
 
-LIB_TARGETS = $(LUA_LIB)
+-TEST_FILES = $(wildcard tests/src/*.cpp) 
+TEST_FILES = $(wildcard tests/src/*.cpp)
+ TEST_HEADERS = $(wildcard tests/include/*.h)
 
- ifneq ($(HAS_ZEROMQ), 0)
+ %.o: %.c $(HEADERS) $(INC) Makefile
- LIB_TARGETS += $(ZEROMQ_LIB)
-- 
-2.25.1
diff --git a/meta-networking/recipes-support/ntopng/files/0001-autogen.sh-generate-configure.ac-only.patch b/meta-networking/recipes-support/ntopng/files/0001-autogen.sh-generate-configure.ac-only.patch
deleted file mode 100644
index 8d62147b9e..0000000000
--- a/meta-networking/recipes-support/ntopng/files/0001-autogen.sh-generate-configure.ac-only.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 22f0bec462763f1b0b92daa33133e274d3b45f4f Mon Sep 17 00:00:00 2001
-From: Mingli Yu <mingli.yu@windriver.com>
-Date: Thu, 5 Nov 2020 00:05:21 -0800
-Subject: [PATCH] autogen.sh: generate configure.ac only
-The autogen.sh should only generate configure.ac and the
-logic used to generate configure script should follow the
-autotools.bbclass in oe. Otherwise there may comes below
-do_configure error:
- | checking whether we are cross compiling... configure: error: in `/path/tmp/work/core2-64-poky-linux/ndpi/3.4-r0/git':
- | configure: error: cannot run C compiled programs.
- | If you meant to cross compile, use `--host'.
-Upstream-Status: Inappropriate [embedded specific]
-Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
---
- autogen.sh | 5 -----
- 1 file changed, 5 deletions(-)
-diff --git a/autogen.sh b/autogen.sh
-index 73f8d0ebe..15ff0aa84 100755
--- a/autogen.sh
-+++ b/autogen.sh
-@@ -73,8 +73,3 @@ cat configure.seed | sed \
-     > configure.ac
- 
- rm -f config.h config.h.in *~ #*
-
-echo "Wait please..."
-autoreconf -if
-echo ""
-echo "Now run ./configure"
-- 
-2.17.1
diff --git a/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-Allow-dynamic-linking-against-ndpi-3.patch b/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-Allow-dynamic-linking-against-ndpi-3.patch
index c645110f22..b0cdcd8401 100644
--- a/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-Allow-dynamic-linking-against-ndpi-3.patch
+++ b/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-Allow-dynamic-linking-against-ndpi-3.patch
@@ -17,23 +17,42 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
 configure.ac.in | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)
-diff --git a/configure.ac.in b/configure.ac.in
-index 7f4c0f893..c3299fda2 100644
 --- a/configure.ac.in
 +++ b/configure.ac.in
-@@ -193,10 +193,8 @@ if test -d /usr/local/include/ndpi ; then :
+@@ -235,8 +235,9 @@ AC_ARG_WITH(ndpi-includes,
+       NDPI_CUST_INC="-I$withval -I$withval/../lib/third_party/include"
+    ])
+ 
+-NDPI_INC=`echo $NDPI_CFLAGS | sed -e "s/[ ]*$//"`
+-NDPI_LIB=
+NDPI_INC="$NDPI_CFLAGS"
+NDPI_LIB="$NDPI_LIBS"
+
+ NDPI_LIB_DEP=
+ 
+ AS_VAR_IF(with_dynamic_ndpi, no, [
+@@ -267,11 +268,6 @@ AC_MSG_CHECKING(for nDPI source)
+       fi
+ ])
+ 
+-AS_VAR_IF(with_dynamic_ndpi, yes, [
+-      NDPI_LIB="-lndpi"
+-      NDPI_LIB_DEP=$NDPI_LIB
+-])
+-
+ if test ! -z "$NDPI_CUST_INC" ; then :
+   NDPI_INC=$NDPI_CUST_INC
+ fi
+@@ -280,12 +276,6 @@ if test ! -z "$NDPI_CUST_LIB" ; then :
+   NDPI_LIB=$NDPI_CUST_LIB
 fi
 
- PKG_CHECK_MODULES([NDPI], [libndpi >= 2.0], [
+-if test -z "$NDPI_LIB" ; then :
-   NDPI_INC=`echo $NDPI_CFLAGS | sed -e "s/[ ]*$//"`
+-  echo "Could not find nDPI"
-   # Use static libndpi library as building against the dynamic library fails
+-  echo "Please do cd ..; git clone https://github.com/ntop/nDPI.git; cd nDPI; ./autogen.sh; ${MAKE}; cd ../ntopng"
-   NDPI_LIB="-Wl,-Bstatic $NDPI_LIBS -Wl,-Bdynamic"
+-  echo "and try again"
-   #NDPI_LIB="$NDPI_LIBS"
+-  exit 1
-+   NDPI_INC="$NDPI_CFLAGS"
+-fi
-+   NDPI_LIB="$NDPI_LIBS"
+ dnl finish: nDPI handling
-    NDPI_LIB_DEP=
+ 
-    ], [
+ AC_ARG_WITH(json-c-static,
-       AC_MSG_CHECKING(for nDPI source)
-- 
-2.35.1
diff --git a/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-fix-configure-error.patch b/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-fix-configure-error.patch
deleted file mode 100644
index d4908e3227..0000000000
--- a/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-fix-configure-error.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 29797dd037009d38e4976249ed21b2076240751e Mon Sep 17 00:00:00 2001
-From: Mingli Yu <mingli.yu@windriver.com>
-Date: Wed, 4 Nov 2020 04:36:46 +0000
-Subject: [PATCH] configure.ac.in: fix configure error
-fix the below error:
-configure: error: cannot run test program while cross compiling
-Upstream-Status: Inappropriate [embedded specific]
-Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
---
- configure.ac.in | 13 +------------
- 1 file changed, 1 insertion(+), 12 deletions(-)
-diff --git a/configure.ac.in b/configure.ac.in
-index a321f9bbf..03f9a31b0 100644
--- a/configure.ac.in
-+++ b/configure.ac.in
-@@ -642,18 +642,7 @@ if test x$radcli = xtrue; then
-   fi
- fi
- 
-AC_CACHE_CHECK([if pthread rwlocks are supported], [my_cv_rw_locks_supported], [
-  AC_TRY_RUN([
-  #include <pthread.h>
-
-  int main() {
-    pthread_rwlock_t t;
-    return 0;
-  }
-]
-, [my_cv_rw_locks_supported=yes], [my_cv_rw_locks_supported=no])
-]
-)
-+AC_CACHE_CHECK([if pthread rwlocks are supported], [my_cv_rw_locks_supported])
- 
- if test "$my_cv_rw_locks_supported" = yes; then
-   AC_DEFINE_UNQUOTED(HAVE_RW_LOCK, 1, [pthread rwlocks supported])
-- 
-2.26.2
diff --git a/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-fix-host-contamination.patch b/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-fix-host-contamination.patch
index 5e1440b3d6..e3c0534da8 100644
--- a/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-fix-host-contamination.patch
+++ b/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-fix-host-contamination.patch
@@ -14,17 +14,95 @@ Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
 configure.ac.in | 43 +++----------------------------------------
 1 file changed, 3 insertions(+), 40 deletions(-)
-diff --git a/configure.ac.in b/configure.ac.in
-index 1d6380c..beffc6c 100644
 --- a/configure.ac.in
 +++ b/configure.ac.in
-@@ -167,31 +167,6 @@ fi
+@@ -83,30 +83,6 @@ if test "$with_dynamic_ndpi" = "yes"; th
- #
+   AC_DEFINE([HAVE_DYNAMIC_NDPI], [1], [Define if using dynamic linking with nDPI])
- REVISION=`git log --pretty=oneline | wc -l`
+ fi
+ 
+-dnl> CLANG_STDLIB="-stdlib=libc++"
+-
+-dnl> On Ubuntu do sudo apt-get install -y clang-14  clang-tools-14
+-if test "x$USE_CLANG" = xyes; then
+-    if test $SYSTEM = "Darwin"; then
+-        CC=clang
+-        CXX="clang++ -fno-color-diagnostics -fPIE -stdlib=libc++"
+-    else
+-       if test -x "/usr/bin/clang-10"; then
+-           CLANG_VERSION=10
+-       elif test -x "/usr/bin/clang-13"; then
+-           CLANG_VERSION=13
+-       elif test -x "/usr/bin/clang-14"; then
+-           CLANG_VERSION=14
+-       else
+-           echo "Could not find clang. Please install clang-14 clang-tools-14"
+-           exit 1
+-       fi
+-
+-       CC=clang-$CLANG_VERSION
+-       CXX="clang++-$CLANG_VERSION -fno-color-diagnostics -fPIE $CLANG_STDLIB"
+-    fi
+-fi
+-
+ CFLAGS="${CFLAGS} -I${HERE} -I${HERE}/include"
+ CXXFLAGS="${CXXFLAGS} -I${HERE} -I${HERE}/include"
+ 
+@@ -122,7 +98,7 @@ fi
+ 
+ if test -f /proc/device-tree/model; then
+   IS_RASPBERRY=`cat /proc/device-tree/model | grep -a -e "Orange Pi" -e Raspberry | wc -l`
+-  
+
+   if test "$IS_RASPBERRY" = "1"; then
+     CFLAGS="${CFLAGS} -DHAVE_EMBEDDED_SUPPORT"
+     CXXFLAGS="${CXXFLAGS} -DHAVE_EMBEDDED_SUPPORT"
+@@ -158,39 +134,6 @@ MAKE=make
+ BIN_PATH=/usr/bin
+ LIBPCAP=-lpcap
+ 
+-if test $SYSTEM = "FreeBSD" || test $SYSTEM = "Darwin"; then
+-   CFLAGS="${CFLAGS} -I/usr/local/include"
+-   LDFLAGS="${LDFLAGS} -L/usr/local/lib"
+-
+-   dnl> https://github.com/google/sanitizers/wiki/AddressSanitizerFlags
+-   CC=clang
+-   CXX="clang++ -fpie -fno-color-diagnostics $CLANG_STDLIB"
+-   if test $SYSTEM = "FreeBSD"; then
+-    MAKE=gmake
+-    BIN_PATH=/usr/local/bin
+-   else
+-     dnl> Adds /opt if MacPorts is installed
+-     if [ test -f /opt/local/bin/port ]; then
+-       CFLAGS="${CFLAGS} -I/opt/local/include"
+-       LDFLAGS="${LDFLAGS} -L/opt/local/lib"
+-     fi
+-   fi
+-   dnl> CXX=clang++ -fsanitize=address -fsanitize-address-use-after-scope
+-   OSXV=`sw_vers -productVersion`
+-   if test $SYSTEM = "Darwin"; then
+-     OS="macOS $OSXV"
+-   else
+-     OS=`uname -or | cut -d '-' -f 1`
+-   fi
+-   if test $MACHINE = "x86_64"; then
+-      LDFLAGS="${LDFLAGS} -L/usr/local/opt/ntopng"
+-      RES=`g++ -Wall -fno-color-diagnostics Prefs.cpp 2>&1 | grep "unrecognized command line option "|wc -l`
+-      if test $RES -eq 0; then
+-            CFLAGS="-fno-color-diagnostics $CFLAGS"
+-      fi
+-   fi
+-fi
+-
+ dnl> Remove spaces
+ OS="${OS#"${OS%%[![:space:]]*}"}"
+ 
+@@ -237,31 +180,6 @@ if test "${with_nedge+set}" = set; then
+   LIBS="${LIBS} -lnetfilter_queue -lnfnetlink -lnetfilter_conntrack"
+ fi
 
 -if test -d "/usr/local/include"; then
 -  CFLAGS="${CFLAGS} -I/usr/local/include"
-  CPPFLAGS="${CPPFLAGS} -I/usr/local/include"
+-  CXXFLAGS="${CXXFLAGS} -I/usr/local/include"
 -fi
 -
 -if test -d "/usr/local/lib"; then
@@ -33,7 +111,7 @@ index 1d6380c..beffc6c 100644
 -
 -if test -d /opt/local/include; then :
 -  CFLAGS="${CFLAGS} -I/opt/local/include"
-  CPPFLAGS="${CPPFLAGS} -I/opt/local/include"
+-  CXXFLAGS="${CXXFLAGS} -I/opt/local/include"
 -fi
 -
 -if test -d /opt/local/lib; then :
@@ -42,15 +120,26 @@ index 1d6380c..beffc6c 100644
 -
 -if [ test -f /usr/bin/lsb_release ]; then
 -  CODENAME=`/usr/bin/lsb_release -c|cut -f 2`
-  if [[ $CODENAME == "wheezy" ]]; then :
+-  if test $CODENAME = "wheezy" ; then
-    CPPFLAGS="${CPPFLAGS} -DOLD_NETFILTER_INTERFACE=1"
+-    CXXFLAGS="${CXXFLAGS} -DOLD_NETFILTER_INTERFACE=1"
 -  fi
 -fi
 -
- SHORT_MACHINE=`uname -m | cut -b1-3`
+ if test -d "pro"; then
+   NTOPCLOUD_LIB=
+   NTOPCLOUD_HOME="../ntopcloud"
+@@ -317,10 +235,6 @@ AC_ARG_WITH(ndpi-includes,
+       NDPI_CUST_INC="-I$withval -I$withval/../lib/third_party/include"
+    ])
 
- GIT_RELEASE="@GIT_RELEASE@"
+-if test -d /usr/local/include/ndpi ; then :
-@@ -300,23 +275,11 @@ fi
+-   echo "WARNING: /usr/local/include/ndpi is present and might lead to compile errors"
+-fi
+-
+ NDPI_INC=`echo $NDPI_CFLAGS | sed -e "s/[ ]*$//"`
+ NDPI_LIB=
+ NDPI_LIB_DEP=
+@@ -387,7 +301,7 @@ fi
 pkg-config --exists libssl
 if test "$?" -ne 1; then
   AC_DEFINE_UNQUOTED(NO_SSL_DL, 1, [has openssl])
@@ -58,25 +147,70 @@ index 1d6380c..beffc6c 100644
 +  SSL_INC="`pkg-config --cflags libssl`"
   SSL_LIB="`pkg-config --libs libssl` -lssl -lcrypto"
 else
-  dnl Workaround for MacOS Brew
+   dnl Workaround for MacOS Brew
-  if test -d "/usr/local/opt/openssl/lib"; then
+@@ -408,10 +322,6 @@ else
-    AC_DEFINE_UNQUOTED(NO_SSL_DL, 1, [has openssl])
+     SSL_INC="-I/usr/local/opt/openssl/include"
-    SSL_INC="-I/usr/local/opt/openssl/include"
+     SSL_LIB="-L/usr/local/opt/openssl/lib -lssl -lcrypto"
-    SSL_LIB="-L/usr/local/opt/openssl/lib -lssl -lcrypto"
+   dnl Workaround for FreeBSD
-  dnl Workaround for FreeBSD
 -  elif test -f "/usr/lib/libssl.so"; then
 -    AC_DEFINE_UNQUOTED(NO_SSL_DL, 1, [has openssl])
 -    SSL_INC="-I/usr/include"
 -    SSL_LIB="-L/usr/lib -lssl -lcrypto"
-  else
+   else
-    echo "Please install openssl-dev(el) package prerequisite"
+     echo "Please install openssl-dev(el) package prerequisite"
-    exit -1
+     exit -1
+@@ -433,13 +343,6 @@ fi
+ AC_MSG_CHECKING(for ntopng professional edition)
+ 
+ REDIS_SERVICE="redis.service"
+-if [ test -f /usr/bin/lsb_release ]; then
+-  UBUNTU_RELEASE=`lsb_release -r|cut -f 2`
+-  UBUNTU_SUB_RELEASE=`echo $UBUNTU_RELEASE|cut -f 1 -d '.'`
+-  if test "$UBUNTU_SUB_RELEASE" = "8" || test "$UBUNTU_SUB_RELEASE" = "10"; then
+-    REDIS_SERVICE="redis-server.service"
 -  fi
-+  echo "Please install openssl-dev(el) package prerequisite"
+-fi
-+  exit -1
+ 
+ SERVICE_ALIAS=
+ SERVICE_REQUIRES=
+@@ -497,7 +400,7 @@ fi
+ echo "Using clickhouse-cpp stored at ${CLICKHOUSE_HOME}"
+ 
+ dnl> fi dnl> test $SYSTEM = "Linux"
+- 
+
+ AC_DEFINE_UNQUOTED(NTOPNG_PRO_GIT_RELEASE, "r${PRO_GIT_RELEASE}", [ntopng professional release])
+ AC_DEFINE_UNQUOTED(NTOPNG_PRO_GIT_DATE, "${PRO_GIT_DATE}", [ntopng professional date])
+ DUMMY=`cd ./pro; ${MAKE} build`
+@@ -531,21 +434,7 @@ if test -f ".git/index"; then
 fi
 
- AC_CHECK_LIB([gcrypt], [gcry_cipher_checktag], [LIBS="${LIBS} -lgcrypt"])
+ if test $SYSTEM = "Linux"; then
-- 
+-  if [ test -f /usr/bin/lsb_release ]; then
-2.25.1
+-      OSNAME=`/usr/bin/lsb_release -d|cut -d ':' -f 2| sed -e 's/^[[[:space:]]]*//'`
+-      OS="$OSNAME"
+-  else
+-    if test -f /etc/debian_version; then
+-       DEBIAN_VERSION=`cat /etc/debian_version`
+-       OSNAME="Debian $DEBIAN_VERSION"
+-    else
+-        if test -f /etc/redhat-release; then
+-          OS=`cat /etc/redhat-release | cut -d '(' -f 1 | awk '{$1=$1};1'`
+-        else
+-          OS=`./config.guess`
+-        fi
+-   fi
+-  fi
+  OS=`./config.guess`
+ else
+ dnl> wget -O config.guess 'http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD'
+   if test $SYSTEM = "FreeBSD"; then
+@@ -575,7 +464,7 @@ AS_VAR_IF(with_hiredis, yes, [
+     else
+       pkg-config --exists hiredis
+       if test "$?" -ne 1; then
+-      HIREDIS_INC="`pkg-config --cflags hiredis` -I/usr/include/hiredis"
+      HIREDIS_INC="`pkg-config --cflags hiredis`"
+       if test $SYSTEM = "FreeBSD" && $FREEBSD_VERSION != "15"; then
+        dnl> Note: on freebsd 15 .a is not installed
+         HIREDIS_LIB="/usr/local/lib/libhiredis.a"
diff --git a/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-not-check-clang-on-host.patch b/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-not-check-clang-on-host.patch
deleted file mode 100644
index ffb106723c..0000000000
--- a/meta-networking/recipes-support/ntopng/files/0001-configure.ac.in-not-check-clang-on-host.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 5867be19e53a3cc09730b83282c83bdd26147cc3 Mon Sep 17 00:00:00 2001
-From: Mingli Yu <mingli.yu@windriver.com>
-Date: Mon, 9 Nov 2020 04:05:25 +0000
-Subject: [PATCH] configure.ac.in: not check clang on host
-Don't check clang on host to avoid host contamination.
-Upstream-Status: Inappropriate [OE specific]
-Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
---
- configure.ac.in | 16 ----------------
- 1 file changed, 16 deletions(-)
-diff --git a/configure.ac.in b/configure.ac.in
-index 55bd49678..94bc0bc48 100644
--- a/configure.ac.in
-+++ b/configure.ac.in
-@@ -90,22 +90,6 @@ if test $SYSTEM = "FreeBSD" || test $SYSTEM = "Darwin"; then
-             CFLAGS="-fno-color-diagnostics $CFLAGS"
-       fi
-    fi
-else
-  if test $SYSTEM = "Linux"; then
-    if [ test -f /usr/bin/clang++ ]; then
-      CC=clang
-      CXX=clang++
-      AC_MSG_RESULT(Using clang++ compiler)
-    fi
-
-    if [ test -f /etc/redhat-release ]; then
-      OS=`cat /etc/redhat-release`
-    else
-      if [ test -f /usr/bin/lsb_release ]; then
-        OS=`/usr/bin/lsb_release -d|cut -d ':' -f 2`
-      fi
-    fi
-  fi
- fi
- 
- dnl> Remove spaces
-- 
-2.17.1
diff --git a/meta-networking/recipes-support/ntopng/files/0001-luaengine-Use-lua-5.5-API-signature-for-lua_newstate.patch b/meta-networking/recipes-support/ntopng/files/0001-luaengine-Use-lua-5.5-API-signature-for-lua_newstate.patch
new file mode 100644
index 0000000000..8046d755c2
--- /dev/null
+++ b/meta-networking/recipes-support/ntopng/files/0001-luaengine-Use-lua-5.5-API-signature-for-lua_newstate.patch
@@ -0,0 +1,31 @@
+From 6c4806436c3214e32487d05ce099ac86b0b2519c Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Sun, 22 Mar 2026 10:08:01 -0700
+Subject: [PATCH] luaengine: Use lua 5.5 API signature for lua_newstate
+in Lua 5.5 lua_newstate gained a third argument,
+lua_State *lua_newstate(lua_Alloc f, void *ud, unsigned int seed);
+The 5.5 manual says that third argument, seed,
+is "a seed for the hashing of strings," and the 5.5 incompatibilities
+section explicitly calls out that lua_newstate now has
+a third parameter.
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ src/LuaEngine.cpp | 64 +++++++++++++++++++++++------------------------
+ 1 file changed, 32 insertions(+), 32 deletions(-)
+--- a/src/LuaEngine.cpp
+++ b/src/LuaEngine.cpp
+@@ -154,7 +154,7 @@ LuaEngine::LuaEngine() {
+   is_system_vm = false;
+   mem_used = 0;
+   
+-  L = lua_newstate(l_alloc, this);
+  L = lua_newstate(l_alloc, this, luaL_makeseed(NULL));
+ 
+   if (!L) {
+     ntop->getTrace()->traceEvent(TRACE_ERROR, "Unable to create a new Lua state.");
diff --git a/meta-networking/recipes-support/ntopng/ndpi_5.0.bb b/meta-networking/recipes-support/ntopng/ndpi_5.0.bb
index e2040eda18..6eadf8ba62 100644
--- a/meta-networking/recipes-support/ntopng/ndpi_5.0.bb
+++ b/meta-networking/recipes-support/ntopng/ndpi_5.0.bb
@@ -21,6 +21,10 @@ do_configure:prepend() {
    (cd ${S} && ${S}/autogen.sh)
 }
+do_install:append() {
+    install -Dm 0644 ${B}/src/include/ndpi_define.h ${D}${includedir}/ndpi/ndpi_define.h
+}
 EXTRA_OEMAKE = " \
    libdir=${libdir} \
 "
diff --git a/meta-networking/recipes-support/ntopng/ntopng_5.2.1.bb b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb
index 014706893a..3c039781d8 100644
--- a/meta-networking/recipes-support/ntopng/ntopng_5.2.1.bb
+++ b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb
@@ -11,27 +11,28 @@ RDEPENDS:${PN} = "bash redis"
 LICENSE = "GPL-3.0-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
-SRCREV = "d3ce78948e8d81dc1e2c5298ce556f9f2247aac1"
+SRCREV = "d3a1229954dd783af06c9fd2dcd9ce926826a228"
-SRC_URI = "git://github.com/ntop/ntopng.git;protocol=https;branch=5.2-stable \
+SRC_URI = "gitsm://github.com/ntop/ntopng;protocol=https;branch=6.6-stable \
-           file://0001-configure.ac.in-fix-configure-error.patch \
           file://0001-configure.ac.in-fix-host-contamination.patch \
           file://0001-Makefile.in-don-t-use-the-internal-lua.patch \
-           file://0001-autogen.sh-generate-configure.ac-only.patch \
-           file://0001-configure.ac.in-not-check-clang-on-host.patch \
           file://0001-configure.ac.in-Allow-dynamic-linking-against-ndpi-3.patch \
-           file://0001-Follow-rrd-post-1.8-change.patch \
+           file://0001-luaengine-Use-lua-5.5-API-signature-for-lua_newstate.patch \
           file://ntopng.service \
           "
 # don't use the lua under thirdparty as it supports cross compiling badly
-export LUA_LIB = "${STAGING_LIBDIR}/liblua.a"
+export LUA_LIB = "-llua"
+export LUA_INC = "-I${STAGING_INCDIR}"
+export NDPI_CUST_INC = "-I${STAGING_INCDIR}/ndpi"
+export NDPI_CUST_LIB = "-lndpi"
 LDFLAGS:append:mipsarch = " -latomic"
 LDFLAGS:append:powerpc = " -latomic"
 LDFLAGS:append:riscv32 = " -latomic"
 inherit autotools-brokensep gettext pkgconfig systemd
+EXTRA_OECONF += "--with-dynamic-ndpi"
 do_install:append() {
    install -d ${D}${systemd_unitdir}/system/
    install -m 0644 ${UNPACKDIR}/ntopng.service ${D}${systemd_unitdir}/system
diff --git a/meta-networking/recipes-support/ntp/ntp/0001-ITS-10011-build-fix-compatibility-with-stricter-C99-.patch b/meta-networking/recipes-support/ntp/ntp/0001-ITS-10011-build-fix-compatibility-with-stricter-C99-.patch
new file mode 100644
index 0000000000..6558fae4ae
--- /dev/null
+++ b/meta-networking/recipes-support/ntp/ntp/0001-ITS-10011-build-fix-compatibility-with-stricter-C99-.patch
@@ -0,0 +1,102 @@
+From 58c160ce28328f9a75d41c283ee9b94c10d6ec62 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Thu, 9 Feb 2023 23:17:53 +0000
+Subject: [PATCH] ITS#10011 build: fix compatibility with stricter C99
+ compilers
+Fix the following warnings:
+- -Wimplicit-int (fatal with Clang 16)
+- -Wimplicit-function-declaration (fatal with Clang 16)
+- -Wincompatible-function-pointer-types (fatal with Clang 16)
+- -Wint-conversion (fatal with Clang 15)
+- Old style prototypes (K&R, removed from C23)
+These warnings-now-error led to misconfigurations and failure to build
+OpenLDAP, as the tests used during configure caused the wrong results
+to be emitted.
+For more information, see LWN.net [0] or LLVM's Discourse [1], the Gentoo wiki [2],
+or the (new) c-std-porting mailing list [3].
+[0] https://lwn.net/Articles/913505/
+[1] https://discourse.llvm.org/t/configure-script-breakage-with-the-new-werror-implicit-function-declaration/65213
+[2] https://wiki.gentoo.org/wiki/Modern_C_porting
+[3] hosted at lists.linux.dev.
+Bug: https://bugs.gentoo.org/871288
+Upstream-Status: Pending
+Signed-off-by: Sam James <sam@gentoo.org>
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ sntp/m4/openldap.m4 | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+diff --git a/sntp/m4/openldap.m4 b/sntp/m4/openldap.m4
+index 49ffb87..2db6aa3 100644
+--- a/sntp/m4/openldap.m4
+++ b/sntp/m4/openldap.m4
+@@ -154,6 +154,7 @@ fi
+ if test $ol_cv_header_stdc = yes; then
+   # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
+ AC_RUN_IFELSE([AC_LANG_SOURCE([[#include <ctype.h>
+#include <stdlib.h>
+ #ifndef HAVE_EBCDIC
+ #      define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
+ #      define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
+@@ -610,8 +611,12 @@ AC_DEFUN([OL_PTHREAD_TEST_INCLUDES], [[
+ #define NULL (void*)0
+ #endif
+ 
+#ifdef __STDC__
+static void *task(void *p)
+#else
+ static void *task(p)
+        void *p;
+#endif
+ {
+        return (void *) (p == NULL);
+ }
+@@ -667,9 +672,13 @@ AC_DEFUN([OL_PTHREAD_TEST_FUNCTION],[[
+ AC_DEFUN([OL_PTHREAD_TEST_PROGRAM], [
+ AC_LANG_SOURCE([OL_PTHREAD_TEST_INCLUDES
+ 
+#ifdef __STDC__
+int main(int argc, char **argv)
+#else
+ int main(argc, argv)
+        int argc;
+        char **argv;
+#endif
+ {
+ OL_PTHREAD_TEST_FUNCTION
+ }
+@@ -791,7 +800,7 @@ AC_CACHE_CHECK([for compatible POSIX regex],ol_cv_c_posix_regex,[
+ #include <sys/types.h>
+ #include <regex.h>
+ static char *pattern, *string;
+-main()
+int main(void)
+ {
+        int rc;
+        regex_t re;
+@@ -818,7 +827,8 @@ AC_DEFUN([OL_C_UPPER_LOWER],
+ [AC_CACHE_CHECK([if toupper() requires islower()],ol_cv_c_upper_lower,[
+        AC_RUN_IFELSE([AC_LANG_SOURCE([[
+ #include <ctype.h>
+-main()
+#include <stdlib.h>
+int main(void)
+ {
+        if ('C' == toupper('C'))
+                exit(0);
+@@ -873,7 +883,7 @@ AC_DEFUN([OL_NONPOSIX_STRERROR_R],
+                        ]])],[ol_cv_nonposix_strerror_r=yes],[ol_cv_nonposix_strerror_r=no])
+        else
+                AC_RUN_IFELSE([AC_LANG_SOURCE([[
+-                       main() {
+                       int main(void) {
+                                char buf[100];
+                                buf[0] = 0;
+                                strerror_r( 1, buf, sizeof buf );
diff --git a/meta-networking/recipes-support/ntp/ntp/0001-colcomp-sntp-libpkgver-colcomp.c-Convert-K-R-functio.patch b/meta-networking/recipes-support/ntp/ntp/0001-colcomp-sntp-libpkgver-colcomp.c-Convert-K-R-functio.patch
new file mode 100644
index 0000000000..39f7e537c1
--- /dev/null
+++ b/meta-networking/recipes-support/ntp/ntp/0001-colcomp-sntp-libpkgver-colcomp.c-Convert-K-R-functio.patch
@@ -0,0 +1,32 @@
+From cd54486bdced460c174fcb98680ad5ffe64f906a Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Mon, 13 Apr 2026 19:09:24 -0700
+Subject: [PATCH] colcomp: sntp/libpkgver/colcomp.c: Convert K&R function
+ definition to ANSI C style
+Replace old-style K&R function declaration with modern ANSI C prototype
+syntax for colcomp(). Also remove trailing whitespace after return type.
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ sntp/libpkgver/colcomp.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+diff --git a/sntp/libpkgver/colcomp.c b/sntp/libpkgver/colcomp.c
+index 4b151e3..29ecb3e 100644
+--- a/sntp/libpkgver/colcomp.c
+++ b/sntp/libpkgver/colcomp.c
+@@ -33,10 +33,8 @@
+ #endif
+ 
+ 
+-int 
+-colcomp (s1, s2)
+-     register char *s1;
+-     register char *s2;
+int
+colcomp (register char *s1, register char *s2)
+ {
+   int hilo = 0;                        /* comparison value */
+ 
diff --git a/meta-networking/recipes-support/ntp/ntp_4.2.8p18.bb b/meta-networking/recipes-support/ntp/ntp_4.2.8p18.bb
index e59725e3e9..6f9bb01c02 100644
--- a/meta-networking/recipes-support/ntp/ntp_4.2.8p18.bb
+++ b/meta-networking/recipes-support/ntp/ntp_4.2.8p18.bb
@@ -17,6 +17,8 @@ SRC_URI = "http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-${PV}.tar.g
           file://0001-test-Fix-build-with-new-compiler-defaults-to-fno-com.patch \
           file://0001-sntp-Fix-types-in-check-for-pthread_detach.patch \
           file://0001-include-fix-build-failure-with-glibc-2.43-_Generic-m.patch \
+           file://0001-ITS-10011-build-fix-compatibility-with-stricter-C99-.patch \
+           file://0001-colcomp-sntp-libpkgver-colcomp.c-Convert-K-R-functio.patch \
           file://ntpd \
           file://ntp.conf \
           file://ntpd.service \
diff --git a/meta-networking/recipes-support/openvpn/openvpn/0001-tests-skip-test-execution-when-cross-compiling.patch b/meta-networking/recipes-support/openvpn/openvpn/0001-tests-skip-test-execution-when-cross-compiling.patch
new file mode 100644
index 0000000000..f8f2d2907f
--- /dev/null
+++ b/meta-networking/recipes-support/openvpn/openvpn/0001-tests-skip-test-execution-when-cross-compiling.patch
@@ -0,0 +1,34 @@
+From 93f7f6ca0c916427d28610d3e263fa556587532d Mon Sep 17 00:00:00 2001
+From: Haixiao Yan <haixiao.yan.cn@windriver.com>
+Date: Thu, 26 Mar 2026 13:43:50 +0800
+Subject: [PATCH] tests: skip test execution when cross-compiling
+The auth-pam unit test Makefile.am unconditionally assigns the TESTS variable,
+causing test execution to fail during cross-compilation because the target
+binaries are not executable on the build host.
+Upstream-Status: Pending
+Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
+---
+ tests/unit_tests/plugins/auth-pam/Makefile.am | 2 ++
+ 1 file changed, 2 insertions(+)
+diff --git a/tests/unit_tests/plugins/auth-pam/Makefile.am b/tests/unit_tests/plugins/auth-pam/Makefile.am
+index ba32013ac920..7da299ccde92 100644
+--- a/tests/unit_tests/plugins/auth-pam/Makefile.am
+++ b/tests/unit_tests/plugins/auth-pam/Makefile.am
+@@ -4,8 +4,10 @@ AM_TESTSUITE_SUMMARY_HEADER = ' for $(PACKAGE_STRING) auth_pam Plugin Unit-Tests
+ 
+ if ENABLE_PLUGIN_AUTH_PAM
+ check_PROGRAMS = auth_pam_testdriver
+if !CROSS_COMPILING
+ TESTS = $(check_PROGRAMS)
+ endif
+endif
+ 
+ auth_pam_testdriver_SOURCES = test_search_and_replace.c  $(top_srcdir)/src/plugins/auth-pam/utils.h $(top_srcdir)/src/plugins/auth-pam/utils.c
+ auth_pam_testdriver_CFLAGS  = @TEST_CFLAGS@ -I$(top_srcdir)/src/plugins/auth-pam
+-- 
+2.43.0
diff --git a/meta-networking/recipes-support/openvpn/openvpn/run-ptest b/meta-networking/recipes-support/openvpn/openvpn/run-ptest
index 19f66b5c56..b0f5699e57 100644
--- a/meta-networking/recipes-support/openvpn/openvpn/run-ptest
+++ b/meta-networking/recipes-support/openvpn/openvpn/run-ptest
@@ -1,8 +1,20 @@
 #!/bin/sh
-find ./ -name Makefile | while read -r x; do
+# Run unit tests directly
-    make -C "$(dirname "${x}")" -k runtest-TESTS | sed \
+find ./ -name "*testdriver" -type f -executable | while read -r t; do
+    dir=$(dirname "${t}")
+    srcdir="${dir}" "${t}" 2>&1 | sed \
        -e 's/^\(\[       OK \].*\)$/PASS: \1/' \
        -e 's/^\(\[  FAILED  \].*\)$/FAIL: \1/' \
        -e 's/^\(\[  SKIPPED \].*\)$/SKIP: \1/'
 done
+# Run crypto loopback integration test
+if [ -f ./t_lpback.sh ]; then
+    sh ./t_lpback.sh 2>&1
+    if [ $? -eq 0 ]; then
+        echo "PASS: t_lpback"
+    else
+        echo "FAIL: t_lpback"
+    fi
+fi
diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.6.17.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.0.bb
index c454a93276..6ddebde4d1 100644
--- a/meta-networking/recipes-support/openvpn/openvpn_2.6.17.bb
+++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.0.bb
@@ -2,20 +2,21 @@ SUMMARY = "A full-featured SSL VPN solution via tun device."
 HOMEPAGE = "https://openvpn.net/"
 SECTION = "net"
 LICENSE = "GPL-2.0-only"
-LIC_FILES_CHKSUM = "file://COPYING;md5=89196bacc47ed37a5b242a535661a049"
+LIC_FILES_CHKSUM = "file://COPYING;md5=924af2c382c415a0a68d0d9e7b483d23"
 DEPENDS = "lzo lz4 openssl libcap-ng ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)} ${@bb.utils.contains('PTEST_ENABLED', '1', 'cmocka', '', d)} "
 inherit autotools systemd update-rc.d pkgconfig ptest
 SRC_URI = "http://swupdate.openvpn.org/community/releases/${BP}.tar.gz \
           file://0001-configure.ac-eliminate-build-path-from-openvpn-versi.patch \
+           file://0001-tests-skip-test-execution-when-cross-compiling.patch \
           file://openvpn \
           file://run-ptest \
          "
 UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads"
-SRC_URI[sha256sum] = "4cc8e63f710d3001493b13d8a32cf22a214d5e4f71dd37d93831e2fd3208b370"
+SRC_URI[sha256sum] = "2f0e10eb272be61e8fb25fe1cfa20875ff30ac857ef1418000c02290bd6dfa45"
 CVE_STATUS[CVE-2020-27569] = "not-applicable-config: Applies only Aviatrix OpenVPN client, not openvpn"
@@ -46,7 +47,8 @@ PACKAGECONFIG[iproute2] = "--enable-iproute2,,iproute2,iproute2-ip"
 PACKAGECONFIG[systemd] = "--enable-systemd,--disable-systemd,systemd"
 PACKAGECONFIG[selinux] = "--enable-selinux,--disable-selinux,libselinux"
-RDEPENDS:${PN}-ptest:append = " make bash"
+RDEPENDS:${PN}-dns-updown:append = " bash"
+RDEPENDS:${PN}-ptest:append = " bash"
 do_install:append() {
    install -d ${D}/${sysconfdir}/init.d
@@ -70,21 +72,21 @@ do_install:append() {
 }
 do_compile_ptest () {
-    for x in `find ${B}/tests/unit_tests -name Makefile -exec grep -l buildtest-TESTS {} \;`; do
+    for x in `find ${B}/tests/unit_tests -name Makefile -exec grep -l check_PROGRAMS {} \;`; do
        dir=`dirname ${x}`
        case $dir in
            *example*)   
                echo "Skipping directory: $dir"
                ;;
            *)           
-                oe_runmake -C ${dir} buildtest-TESTS
+                oe_runmake -C ${dir} check-am
                ;;
        esac
    done
 }
 do_install_ptest() {
-    for x in $(find ${B}/tests/unit_tests -name Makefile -exec grep -l buildtest-TESTS {} \;); do
+    for x in $(find ${B}/tests/unit_tests -name Makefile -exec grep -l check_PROGRAMS {} \;); do
        dir=$(dirname ${x})
        if [[ "$dir" == *example* ]]; then
@@ -93,31 +95,35 @@ do_install_ptest() {
        target_dir="${D}/${PTEST_PATH}/unit_tests/$(basename ${dir})"
        mkdir -p ${target_dir}
-        cp -f ${dir}/Makefile ${target_dir}/        
-        sed -i "s/^Makefile:/MM:/g" ${target_dir}/Makefile
-        sed -i 's/^#TESTS = $(am__EXEEXT_4)/TESTS = $(am__EXEEXT_4)/' ${target_dir}/Makefile
-        for testfile in $(find ${dir} -name "*testdriver"); do
+        for testfile in $(find ${dir} -name "*testdriver" -type f -executable); do
            cp -rf ${testfile} ${target_dir}/
        done
    done
-    sed -i 's|find ./|find ${PTEST_PATH}|g' ${D}${PTEST_PATH}/run-ptest
+    # Install test input data files needed by user_pass and misc tests
+    cp -rf ${S}/tests/unit_tests/openvpn/input ${D}/${PTEST_PATH}/unit_tests/openvpn/
+    # Install COPYRIGHT.GPL needed by test_list
+    # test_list references srcdir/../../../COPYRIGHT.GPL
+    # srcdir=./unit_tests/openvpn -> resolves to ../COPYRIGHT.GPL from ptest cwd
+    # which is ${libdir}/openvpn/COPYRIGHT.GPL
+    cp -f ${S}/COPYRIGHT.GPL ${D}/${libdir}/openvpn/
    sed -i 's|${top_builddir}/src/openvpn|${sbindir}|g' ${S}/tests/t_lpback.sh
    cp -f ${S}/tests/t_lpback.sh ${D}/${PTEST_PATH}
-    cp -f ${B}/tests/Makefile ${D}/${PTEST_PATH}
-    sed -i "s/^Makefile:/MM:/g" ${D}/${PTEST_PATH}/Makefile
-    sed -i "s/^test_scripts = t_client.sh t_lpback.sh t_cltsrv.sh/test_scripts = t_lpback.sh/g" ${D}/${PTEST_PATH}/Makefile
-    
 }
-PACKAGES =+ " ${PN}-sample "
+PACKAGES =+ " ${PN}-dns-updown ${PN}-sample "
 RRECOMMENDS:${PN} = "kernel-module-tun"
 FILES:${PN}-dbg += "${libdir}/openvpn/plugins/.debug"
+FILES:${PN}-ptest += "${libdir}/openvpn/COPYRIGHT.GPL"
 FILES:${PN} += "${systemd_system_unitdir}/openvpn-server@.service \
                ${systemd_system_unitdir}/openvpn-client@.service \
                ${nonarch_libdir}/tmpfiles.d \
               "
+FILES:${PN}-dns-updown = "${libexecdir}/openvpn/dns-updown"
 FILES:${PN}-sample = "${sysconfdir}/openvpn/sample/ \
                     "
diff --git a/meta-networking/recipes-support/pgpool2/pgpool2_4.6.4.bb b/meta-networking/recipes-support/pgpool2/pgpool2_4.6.6.bb
index 0d7f1e0342..668e506831 100644
--- a/meta-networking/recipes-support/pgpool2/pgpool2_4.6.4.bb
+++ b/meta-networking/recipes-support/pgpool2/pgpool2_4.6.6.bb
@@ -10,13 +10,13 @@ HOMEPAGE = "https://pgpool.net"
 LICENSE = "BSD-2-Clause"
 LIC_FILES_CHKSUM = "file://COPYING;md5=e4b38de086d73e0521de0bbdbaa4a1a9"
-SRC_URI = "https://www.pgpool.net/mediawiki/images/pgpool-II-${PV}.tar.gz \
+SRC_URI = "https://www.pgpool.net/source/pgpool-II-${PV}.tar.gz \
           file://0001-Fix-build-error-when-build-this-file.patch \
           file://define_SIGNAL_ARGS.patch \
           file://pgpool.sysconfig \
           file://pgpool.service \
           "
-SRC_URI[sha256sum] = "ef0d2e91a9a11d737c6476247219e679f718bec53550646189594ef9aefd298d"
+SRC_URI[sha256sum] = "a4021c06b9fbdca975e62bf15a54d93e1b38854c53b5ad9d53cd082ec185dad0"
 S = "${UNPACKDIR}/pgpool-II-${PV}"
diff --git a/meta-networking/recipes-support/ruli/files/0001-Make-space-for-flags-from-environment.patch b/meta-networking/recipes-support/ruli/files/0001-Make-space-for-flags-from-environment.patch
index c3ca07a390..739d7f797e 100644
--- a/meta-networking/recipes-support/ruli/files/0001-Make-space-for-flags-from-environment.patch
+++ b/meta-networking/recipes-support/ruli/files/0001-Make-space-for-flags-from-environment.patch
@@ -12,8 +12,6 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
 src/Makefile    |  8 ++++----
 2 files changed, 14 insertions(+), 14 deletions(-)
-diff --git a/sample/Makefile b/sample/Makefile
-index 15cafd9..d83641f 100644
 --- a/sample/Makefile
 +++ b/sample/Makefile
 @@ -35,9 +35,9 @@ ifeq ($(PLATFORM),SunOS)
@@ -50,13 +48,23 @@ index 15cafd9..d83641f 100644
 
 %.o: %.c
        $(CC) $(ARCH) $(CPPFLAGS) $(CFLAGS) -c $<
-diff --git a/src/Makefile b/src/Makefile
-index 9b56b5e..39a5ea1 100644
 --- a/src/Makefile
 +++ b/src/Makefile
-@@ -45,7 +45,7 @@ endif
+@@ -2,7 +2,7 @@
+ # $Id: Makefile,v 1.57 2005/06/13 16:34:53 evertonm Exp $
+ #
 
- WARN = -pedantic -ansi -Wshadow -Wpointer-arith -Wcast-qual \
+-#DEBUG += -DRULI_SRV_DEBUG 
+#DEBUG += -DRULI_SRV_DEBUG
+ #DEBUG += -DRULI_HOST_DEBUG
+ #DEBUG += -DRULI_RES_DEBUG
+ #DEBUG += -DRULI_TXT_COMPARE_DEBUG
+@@ -43,9 +43,9 @@ ifeq ($(PLATFORM),SunOS)
+ DEFINE_SOLARIS = -D_RULI_SOLARIS_
+ endif
+ 
+-WARN = -pedantic -ansi -Wshadow -Wpointer-arith -Wcast-qual \
+WARN = -Wshadow -Wpointer-arith -Wcast-qual \
        -Wcast-align -Wwrite-strings -Wredundant-decls
 -CC = gcc
 +CC ?= gcc
@@ -72,7 +80,7 @@ index 9b56b5e..39a5ea1 100644
 LIBOBJ = ruli_isaac.o ruli_mem.o ruli_rand.o ruli_util.o ruli_list.o \
        ruli_addr.o ruli_sock.o ruli_txt.o ruli_msg.o ruli_fsm.o \
        ruli_res.o ruli_parse.o ruli_host.o ruli_srv.o ruli_conf.o \
-@@ -66,7 +66,7 @@ LIBOBJ = ruli_isaac.o ruli_mem.o ruli_rand.o ruli_util.o ruli_list.o \
+@@ -66,7 +66,7 @@ LIBOBJ = ruli_isaac.o ruli_mem.o ruli_ra
        ruli_getaddrinfo.o
 SHAREDOBJ = $(LIBOBJ:%.o=%.os)
 SONAME = libruli.so.4
@@ -90,6 +98,3 @@ index 9b56b5e..39a5ea1 100644
        @echo
        @echo "REMINDER:"
        @echo "Add $(INSTALL_LIB_DIR) to your dynamic loader path:"
-- 
-2.24.0
diff --git a/meta-networking/recipes-support/ruli/ruli_0.36.bb b/meta-networking/recipes-support/ruli/ruli_0.36.bb
index 0526f842a8..972184ae2c 100644
--- a/meta-networking/recipes-support/ruli/ruli_0.36.bb
+++ b/meta-networking/recipes-support/ruli/ruli_0.36.bb
@@ -20,7 +20,7 @@ SRC_URI[sha256sum] = "11d32def5b514748fbd9ea8c88049ae99e1bb358efc74eb91a4d268a39
 # -shared is passed via CFLAGS, clang complains since its used during linking
 # and not compiling
-CFLAGS:append:toolchain-clang = " -Wno-error=unused-command-line-argument"
+CFLAGS:append:toolchain-clang = " -std=gnu11 -Wno-error=unused-command-line-argument"
 EXTRA_OEMAKE = 'CC="${CC}" CPPFLAGS="${CFLAGS}" OOP_BASE_DIR="${STAGING_EXECPREFIXDIR}" \
                INSTALL_BASE_DIR="${D}${exec_prefix}" \
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.4.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb
index 2587722b6d..daa6552899 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.4.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb
@@ -10,7 +10,7 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', '  tpm2-tss',
 SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2"
-SRC_URI[sha256sum] = "79576bb61b9a406cea9eb73d0c565cc6254a6b6d2e7198f44758d2d7c61a7aec"
+SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c"
 UPSTREAM_CHECK_REGEX = "strongswan-(?P<pver>\d+(\.\d+)+)\.tar"
@@ -48,7 +48,7 @@ PACKAGECONFIG[pkcs12] = "--enable-pkcs12,--disable-pkcs12,,${PN}-plugin-pkcs12"
 PACKAGECONFIG[rc2] = "--enable-rc2,--disable-rc2,,${PN}-plugin-rc2"
 PACKAGECONFIG[sha1] = "--enable-sha1,--disable-sha1,,${PN}-plugin-sha1"
 PACKAGECONFIG[sha2] = "--enable-sha2,--disable-sha2,,${PN}-plugin-sha2"
-PACKAGECONFIG[soup] = "--enable-soup,--disable-soup,libsoup-2.4,${PN}-plugin-soup"
+PACKAGECONFIG[soup] = "--enable-soup,--disable-soup,libsoup,${PN}-plugin-soup"
 PACKAGECONFIG[sqlite3] = "--enable-sqlite,--disable-sqlite,sqlite3,${PN}-plugin-sqlite"
 PACKAGECONFIG[stroke] = "--enable-stroke,--disable-stroke,,${PN}-plugin-stroke"
 PACKAGECONFIG[swanctl] = "--enable-swanctl,--disable-swanctl,,libgcc"
@@ -189,3 +189,5 @@ SYSTEMD_SERVICE:${PN} = " \
    ${@bb.utils.contains('PACKAGECONFIG', 'swanctl', '${BPN}.service', '', d)} \
    ${@bb.utils.contains('PACKAGECONFIG', 'charon', '${BPN}-starter.service', '', d)} \
 "
+CVE_STATUS[CVE-2026-25075] = "fixed-version: fixed in 6.0.5"
diff --git a/meta-networking/recipes-support/stunnel/stunnel/fix-openssl-no-des.patch b/meta-networking/recipes-support/stunnel/stunnel/fix-openssl-no-des.patch
index 3520bf429e..0e94a969c0 100644
--- a/meta-networking/recipes-support/stunnel/stunnel/fix-openssl-no-des.patch
+++ b/meta-networking/recipes-support/stunnel/stunnel/fix-openssl-no-des.patch
@@ -1,4 +1,4 @@
-From e08b9760d319d0334f2aad02d32d791c8ebd8564 Mon Sep 17 00:00:00 2001
+From 08b1bf417be039b097fae25708861fe8184c739c Mon Sep 17 00:00:00 2001
 From: Kai Kang <kai.kang@windriver.com>
 Date: Wed, 1 Nov 2017 09:23:41 -0400
 Subject: [PATCH] stunnel: fix compile error when openssl disable des support
@@ -17,10 +17,10 @@ Signed-off-by: Kai Kang <kai.kang@windriver.com>
 2 files changed, 5 insertions(+), 3 deletions(-)
 diff --git a/src/common.h b/src/common.h
-index c2229d0..5eaee8c 100644
+index ada7ff7..8484144 100644
 --- a/src/common.h
 +++ b/src/common.h
-@@ -497,7 +497,9 @@ extern char *sys_errlist[];
+@@ -489,7 +489,9 @@ extern char *sys_errlist[];
 #ifndef OPENSSL_NO_MD4
 #include <openssl/md4.h>
 #endif /* !defined(OPENSSL_NO_MD4) */
@@ -29,9 +29,9 @@ index c2229d0..5eaee8c 100644
 +#endif
 #ifndef OPENSSL_NO_DH
 #include <openssl/dh.h>
- #if OPENSSL_VERSION_NUMBER<0x10100000L
+ #endif /* !defined(OPENSSL_NO_DH) */
 diff --git a/src/protocol.c b/src/protocol.c
-index c390a6f..7aca745 100644
+index cddc381..ae0f374 100644
 --- a/src/protocol.c
 +++ b/src/protocol.c
 @@ -82,7 +82,7 @@ NOEXPORT void ldap_client_middle(CLI *);
@@ -43,7 +43,7 @@ index c390a6f..7aca745 100644
 NOEXPORT void ntlm(CLI *);
 NOEXPORT char *ntlm1(void);
 NOEXPORT char *ntlm3(char *, char *, char *, char *);
-@@ -1391,7 +1391,7 @@ NOEXPORT void connect_client_middle(CLI *c) {
+@@ -1392,7 +1392,7 @@ NOEXPORT void connect_client_middle(CLI *c) {
     fd_printf(c, c->remote_fd.fd, "Host: %s", c->opt->protocol_host);
     if(c->opt->protocol_username && c->opt->protocol_password) {
         if(!strcasecmp(c->opt->protocol_authentication, "ntlm")) {
@@ -52,7 +52,7 @@ index c390a6f..7aca745 100644
             ntlm(c);
 #else
             s_log(LOG_ERR, "NTLM authentication is not available");
-@@ -1434,7 +1434,7 @@ NOEXPORT void connect_client_middle(CLI *c) {
+@@ -1435,7 +1435,7 @@ NOEXPORT void connect_client_middle(CLI *c) {
     str_free(line);
 }
 
diff --git a/meta-networking/recipes-support/stunnel/stunnel_5.77.bb b/meta-networking/recipes-support/stunnel/stunnel_5.78.bb
index 954fa896ba..1740ad41f2 100644
--- a/meta-networking/recipes-support/stunnel/stunnel_5.77.bb
+++ b/meta-networking/recipes-support/stunnel/stunnel_5.78.bb
@@ -3,7 +3,7 @@ DESCRIPTION = "SSL encryption wrapper between remote client and local (inetd-sta
 HOMEPAGE = "https://www.stunnel.org/"
 SECTION = "net"
 LICENSE = "GPL-2.0-or-later"
-LIC_FILES_CHKSUM = "file://COPYING.md;md5=1e4388407e163ad0cde171362f9a7b94"
+LIC_FILES_CHKSUM = "file://COPYING.md;md5=df2a0f88c5d5e3ebce922682a7b598ec"
 DEPENDS = "autoconf-archive libnsl2 openssl"
@@ -11,7 +11,7 @@ SRC_URI = "https://stunnel.org/archive/5.x/${BP}.tar.gz \
           file://fix-openssl-no-des.patch \
 "
-SRC_URI[sha256sum] = "ec026f4fae4e0d25b940cc7a9451d925e359e7fd59e9edad20baea66ce45f263"
+SRC_URI[sha256sum] = "8727e53bb8b7528f850327a2a149158422c02183bc120d1d733cc65b1e2c349d"
 inherit autotools bash-completion pkgconfig
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2025-63938.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2025-63938.patch
deleted file mode 100644
index e06e0d3eae..0000000000
--- a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2025-63938.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From cee659d2ac1e4e9d1ce388338f46df6c4bae8278 Mon Sep 17 00:00:00 2001
-From: Gyorgy Sarvari <skandigraun@gmail.com>
-Date: Fri, 17 Oct 2025 22:57:39 +0000
-Subject: [PATCH] reqs: fix integer overflow in port number processing
-From: rofl0r <rofl0r@users.noreply.github.com>
-closes #586
-CVE: CVE-2025-63938
-Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/3c0fde94981b025271ffa1788ae425257841bf5a]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
- src/reqs.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-diff --git a/src/reqs.c b/src/reqs.c
-index a65ed54..1e5895c 100644
--- a/src/reqs.c
-+++ b/src/reqs.c
-@@ -174,7 +174,7 @@ static int strip_return_port (char *host)
- {
-         char *ptr1;
-         char *ptr2;
-        int port;
-+        unsigned port;
- 
-         ptr1 = strrchr (host, ':');
-         if (ptr1 == NULL)
-@@ -186,8 +186,11 @@ static int strip_return_port (char *host)
-                 return 0;
- 
-         *ptr1++ = '\0';
-        if (sscanf (ptr1, "%d", &port) != 1)    /* one conversion required */
-                return 0;
-+
-+        port = atoi(ptr1);
-+        /* check that port string is in the valid range 1-0xffff) */
-+        if(strlen(ptr1) > 5 || (port & 0xffff0000)) return 0;
-+
-         return port;
- }
- 
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-3945-1.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-3945-1.patch
new file mode 100644
index 0000000000..99c4ea705d
--- /dev/null
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-3945-1.patch
@@ -0,0 +1,29 @@
+From 245946bb789c8fc0e4758c344f735a5d53827dce Mon Sep 17 00:00:00 2001
+From: rofl0r <rofl0r@users.noreply.github.com>
+Date: Thu, 12 Mar 2026 14:26:24 +0000
+Subject: [PATCH] reqs: check negative length values when reading chunked data
+this could lead to a DoS when a legitimate client reads from an
+attacker-controlled web server.
+closes #597
+CVE: CVE-2026-3945
+Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/969852ccdb1d19d7ed302f0e1d324661be641e0a]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/reqs.c | 1 +
+ 1 file changed, 1 insertion(+)
+diff --git a/src/reqs.c b/src/reqs.c
+index a562c68..94ce767 100644
+--- a/src/reqs.c
+++ b/src/reqs.c
+@@ -613,6 +613,7 @@ static int pull_client_data_chunked (struct conn_s *connptr) {
+                 }
+ 
+                 chunklen = strtol (buffer, (char**)0, 16);
+                if (chunklen < 0) goto ERROR_EXIT;
+ 
+                 if (pull_client_data (connptr, chunklen+2, 0) < 0)
+                         goto ERROR_EXIT;
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-3945-2.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-3945-2.patch
new file mode 100644
index 0000000000..3da30b54eb
--- /dev/null
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-3945-2.patch
@@ -0,0 +1,31 @@
+From 8f12872b8e50fe22be0a65ead260ebbedde905cd Mon Sep 17 00:00:00 2001
+From: rofl0r <rofl0r@users.noreply.github.com>
+Date: Sun, 29 Mar 2026 16:48:54 +0200
+Subject: [PATCH] reqs: prevent potential int overflow when parsing chunked
+ data (#603)
+follow-up to 969852ccdb1d19d7ed302f0e1d324661be641e0a
+closes #602
+CVE: CVE-2026-3945
+Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/bb7edc4778041b3bc8ad7fca448b67d98039cc7d]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/reqs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/src/reqs.c b/src/reqs.c
+index 94ce767..7aacfd3 100644
+--- a/src/reqs.c
+++ b/src/reqs.c
+@@ -613,7 +613,8 @@ static int pull_client_data_chunked (struct conn_s *connptr) {
+                 }
+ 
+                 chunklen = strtol (buffer, (char**)0, 16);
+-                if (chunklen < 0) goto ERROR_EXIT;
+                /* prevent negative or huge values causing overflow */
+                if (chunklen < 0 || chunklen > 0x0fffffff) goto ERROR_EXIT;
+ 
+                 if (pull_client_data (connptr, chunklen+2, 0) < 0)
+                         goto ERROR_EXIT;
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.2.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
index 8558291c18..56e3296066 100644
--- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.2.bb
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
@@ -7,10 +7,11 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz
           file://tinyproxy.service \
           file://tinyproxy.conf \
           file://run-ptest \
-           file://CVE-2025-63938.patch \
+           file://CVE-2026-3945-1.patch \
+           file://CVE-2026-3945-2.patch \
           "
-SRC_URI[sha256sum] = "2c8fe5496f2c642bfd189020504ab98d74b9edbafcdb94d9f108e157b5bdf96d"
+SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592"
 UPSTREAM_CHECK_URI = "https://github.com/tinyproxy/tinyproxy/releases"
diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.25.1.bb
index e41e2dc065..7331fc01d1 100644
--- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+++ b/meta-networking/recipes-support/unbound/unbound_1.25.1.bb
@@ -13,7 +13,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
           file://run-ptest \
           "
-SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"
+SRCREV = "75b6dba593d4fff000434cd64807c6ebd50bd244"
 inherit autotools pkgconfig systemd update-rc.d ptest
diff --git a/meta-networking/recipes-support/vnstat/vnstat_2.6.bb b/meta-networking/recipes-support/vnstat/vnstat_2.13.bb
index cf3f41c5a1..6f67777972 100644
--- a/meta-networking/recipes-support/vnstat/vnstat_2.6.bb
+++ b/meta-networking/recipes-support/vnstat/vnstat_2.13.bb
@@ -6,8 +6,7 @@ SECTION = "net"
 DEPENDS = "gd sqlite3"
 SRC_URI = "https://github.com/vergoh/vnstat/releases/download/v${PV}/${BPN}-${PV}.tar.gz"
-SRC_URI[md5sum] = "fe2928a81243cc8a532a357f97221736"
+SRC_URI[sha256sum] = "c9fe19312d1ec3ddfbc4672aa951cf9e61ca98dc14cad3d3565f7d9803a6b187"
-SRC_URI[sha256sum] = "89276e0a7281943edb554b874078278ad947dc312938a2451e03eb80679f7ff7"
 inherit autotools pkgconfig systemd
diff --git a/meta-networking/recipes-support/wireshark/wireshark_4.6.4.bb b/meta-networking/recipes-support/wireshark/wireshark_4.6.6.bb
index 7ecad4eda8..232cb2058b 100644
--- a/meta-networking/recipes-support/wireshark/wireshark_4.6.4.bb
+++ b/meta-networking/recipes-support/wireshark/wireshark_4.6.6.bb
@@ -31,7 +31,7 @@ SRC_URI:append:class-native = " file://0001-don-t-look-for-iconv.h-for-native-bu
 UPSTREAM_CHECK_URI = "https://1.as.dl.wireshark.org/src/all-versions"
-SRC_URI[sha256sum] = "fbeab3d85c6c8a5763c8d9b7fe20b5c69ca9f9e7f2b824bedc73135bdca332e2"
+SRC_URI[sha256sum] = "27e7ff780cd68a7466082be82ca26c06a002e74a71646ef3a6e4683e444c1a86"
 PE = "1"