107 files changed, 2513 insertions, 1378 deletions
diff --git a/meta-oe/recipes-support/atop/atop_2.12.1.bb b/meta-oe/recipes-support/atop/atop_2.12.1.bb
index 4ca74edbaf..d40b95ce6c 100644
--- a/meta-oe/recipes-support/atop/atop_2.12.1.bb
+++ b/meta-oe/recipes-support/atop/atop_2.12.1.bb
@@ -7,7 +7,7 @@ etc. At regular intervals, it shows system-level activity related to the CPU, \
 memory, swap, disks (including LVM) and network layers, and for every process \
 (and thread) it shows e.g. the CPU utilization, memory growth, disk \
 utilization, priority, username, state, and exit code."
-HOMEPAGE = "http://www.atoptool.nl"
+HOMEPAGE = "https://www.atoptool.nl"
 SECTION = "console/utils"
 LICENSE = "GPL-2.0-only"
@@ -37,7 +37,7 @@ do_compile() {
 do_install() {
    if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
        make DESTDIR=${D} VERS=${PV} SYSDPATH=${systemd_system_unitdir} \
-            PMPATHD=${systemd_unitdir}/system-sleep install
+            PMPATHD=${systemd_unitdir}/system-sleep SBINPATH=${sbindir} install
        install -d ${D}${sysconfdir}/tmpfiles.d
        install -m 644 ${UNPACKDIR}/volatiles.atop.conf ${D}${sysconfdir}/tmpfiles.d/atop.conf
        rm -f ${D}${systemd_system_unitdir}/atopacct.service
@@ -51,16 +51,19 @@ do_install() {
    # /var/log/atop will be created in runtime
    rm -rf ${D}${localstatedir}/log
    rmdir --ignore-fail-on-non-empty ${D}${localstatedir}
-    # remove atopacct related files
-    rm -rf ${D}${sbindir} ${D}${mandir}/man8
 }
 inherit systemd
+PACKAGES =+ "${PN}-acctd ${PN}-gpud"
 SYSTEMD_SERVICE:${PN} = "atop.service atopgpu.service atop-rotate.service"
 SYSTEMD_AUTO_ENABLE = "disable"
 FILES:${PN} += "${systemd_unitdir}/system-sleep ${systemd_system_unitdir}/atop-rotate.timer"
+FILES:${PN}-acctd += "${sbindir}/atopacctd ${mandir}/man8/atopacctd.8"
+FILES:${PN}-gpud += "${sbindir}/atopgpud ${mandir}/man8/atopgpud.8"
 RDEPENDS:${PN} = "procps"
+RDEPENDS:${PN}-gpud = "python3-core"
+RRECOMMENDS:${PN} = "${PN}-acctd ${PN}-gpud"
diff --git a/meta-oe/recipes-support/bmap-writer/bmap-writer_1.0.2.bb b/meta-oe/recipes-support/bmap-writer/bmap-writer_1.0.4.bb
index f49aa480da..657ba60e1d 100644
--- a/meta-oe/recipes-support/bmap-writer/bmap-writer_1.0.2.bb
+++ b/meta-oe/recipes-support/bmap-writer/bmap-writer_1.0.4.bb
@@ -8,12 +8,15 @@ SECTION = "console/utils"
 LICENSE = "GPL-3.0-only"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=e49f4652534af377a713df3d9dec60cb"
-SRC_URI = "git://github.com/embetrix/${BPN};branch=master;protocol=https"
+SRC_URI = "git://github.com/embetrix/${BPN};branch=master;protocol=https;tag=${PV}"
-SRCREV = "7489280a7a1247f23543343aba4e95bf2f2e8fa6"
+SRCREV = "52919b145d04953a91cf846f3db3d8cee8d989ac"
 DEPENDS = "libtinyxml2 libarchive"
 inherit cmake pkgconfig
+PACKAGECONFIG ?= ""
+PACKAGECONFIG[libkcapi]  = "-DUSE_KERNEL_CRYPTO_API=ON, -DUSE_KERNEL_CRYPTO_API=OFF, libkcapi"
 FILES:${PN} = "${bindir}"
 BBCLASSEXTEND = "native nativesdk"
diff --git a/meta-oe/recipes-support/ceres-solver/ceres-solver_2.2.0.bb b/meta-oe/recipes-support/ceres-solver/ceres-solver_2.2.0.bb
index 0a8f237180..5368bdeeb4 100644
--- a/meta-oe/recipes-support/ceres-solver/ceres-solver_2.2.0.bb
+++ b/meta-oe/recipes-support/ceres-solver/ceres-solver_2.2.0.bb
@@ -3,12 +3,11 @@ HOMEPAGE = "http://ceres-solver.org/"
 LICENSE = "BSD-3-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=3585a26c9cd9ec0cb36a7d65542878ca"
-DEPENDS = "libeigen glog"
+DEPENDS = "libeigen"
 SRC_URI = "git://github.com/ceres-solver/ceres-solver.git;branch=master;protocol=https"
 SRCREV = "85331393dc0dff09f6fb9903ab0c4bfa3e134b01"
 inherit cmake
 do_configure:prepend() {
@@ -19,6 +18,14 @@ do_configure:prepend() {
    touch ${S}/.git/hooks/commit-msg 2>/dev/null || :
 }
+EXTRA_OECMAKE += " \
+    -DBUILD_BENCHMARKS=OFF \
+    -DBUILD_EXAMPLES=OFF \
+    -DBUILD_TESTING=OFF \
+    -DGFLAGS=OFF \
+    -DUSE_CUDA=OFF \
+"
 # We don't want path to eigen3 in ceres-solver RSS to be
 # used by components which use CeresConfig.cmake from their
 # own RSS
@@ -27,11 +34,12 @@ do_configure:prepend() {
 # ceres-solver/1.14-r0/packages-split/ceres-solver-dev/usr/lib/cmake/Ceres/CeresConfig.cmake:    set(glog_DIR ceres-solver/1.14-r0/recipe-sysroot/usr/lib/cmake/glog)
 SSTATE_SCAN_FILES += "*.cmake"
-PACKAGECONFIG ??= ""
+PACKAGECONFIG ??= "glog"
 # suitesparse* recipes will be in meta-ros layer
 PACKAGECONFIG[suitesparse] = "-DSUITESPARSE=ON,-DSUITESPARSE=OFF,suitesparse-config suitesparse-amd suitesparse-camd suitesparse-colamd suitesparse-ccolamd suitesparse-cholmod suitesparse-metis suitesparse-spqr"
 PACKAGECONFIG[cxsparse] = "-DCXSPARSE=ON,-DCXSPARSE=OFF,suitesparse-cxsparse"
+PACKAGECONFIG[glog] = "-DMINIGLOG=OFF,-DMINIGLOG=ON,glog"
 PACKAGECONFIG[lapack] = "-DLAPACK=ON,-DLAPACK=OFF,lapack"
 # Only a static library and headers are created
diff --git a/meta-oe/recipes-support/composefs/composefs/0001-mkcomposefs-use-const-char-for-memchr-return-values.patch b/meta-oe/recipes-support/composefs/composefs/0001-mkcomposefs-use-const-char-for-memchr-return-values.patch
new file mode 100644
index 0000000000..9c45d4fcc0
--- /dev/null
+++ b/meta-oe/recipes-support/composefs/composefs/0001-mkcomposefs-use-const-char-for-memchr-return-values.patch
@@ -0,0 +1,45 @@
+From 9d82303c7a3a780d481469cd8eafa016dcbff86f Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Thu, 16 Apr 2026 08:25:28 -0700
+Subject: [PATCH] mkcomposefs: use const char* for memchr return values
+memchr returns void*, which when assigned to char* discards the
+const qualifier of the input pointer. Cast to const char* to
+preserve const'ness.
+Fixes build with clang-22/glibc-2.43
+tools/mkcomposefs.c
+../sources/composefs-1.0.8/tools/mkcomposefs.c:413:8: error: initializing 'char *' with an expression of type 'const void *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
+  413 |         char *embedded_nul_offset = memchr(line, 0, line_len);
+      |               ^                     ~~~~~~~~~~~~~~~~~~~~~~~~~
+1 error generated.
+Upstream-Status: Submitted [https://github.com/composefs/composefs/pull/435]
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ tools/mkcomposefs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/tools/mkcomposefs.c b/tools/mkcomposefs.c
+index 13b505d..e14d8d0 100644
+--- a/tools/mkcomposefs.c
+++ b/tools/mkcomposefs.c
+@@ -63,7 +63,7 @@ static __attribute__((format(printf, 1, 2))) char *make_error(const char *fmt, .
+ static size_t split_at(const char **start, size_t *length, char split_char,
+                       bool *partial)
+ {
+-       char *end = memchr(*start, split_char, *length);
+       const char *end = (const char*)memchr(*start, split_char, *length);
+        if (end == NULL) {
+                size_t part_len = *length;
+                *start = *start + *length;
+@@ -410,7 +410,7 @@ static char *tree_from_dump_line(dump_info *info, const char *line,
+         * We didn't document support for embedded NULs, and it only introduces
+         * ambiguity in parsing, so let's just reject this early on.
+         */
+-       char *embedded_nul_offset = memchr(line, 0, line_len);
+       const char *embedded_nul_offset = (const char*)memchr(line, 0, line_len);
+        if (embedded_nul_offset != NULL) {
+                size_t off = embedded_nul_offset - line;
+                return make_error("Invalid embedded NUL character at position %lld",
diff --git a/meta-oe/recipes-support/composefs/composefs_1.0.8.bb b/meta-oe/recipes-support/composefs/composefs_1.0.8.bb
index f2bae91f44..3450f9a339 100644
--- a/meta-oe/recipes-support/composefs/composefs_1.0.8.bb
+++ b/meta-oe/recipes-support/composefs/composefs_1.0.8.bb
@@ -14,8 +14,9 @@ LIC_FILES_CHKSUM = "\
 "
 SRCREV = "858ce1b38e1534c2602eb431124b5dca706bc746"
-SRC_URI = "git://github.com/containers/composefs.git;protocol=https;branch=main"
+SRC_URI = "git://github.com/containers/composefs.git;protocol=https;branch=main;tag=v${PV} \
+           file://0001-mkcomposefs-use-const-char-for-memchr-return-values.patch \
+          "
 inherit meson
diff --git a/meta-oe/recipes-support/crow/crow_1.3.2.bb b/meta-oe/recipes-support/crow/crow_1.3.2.bb
new file mode 100644
index 0000000000..09970fcfc2
--- /dev/null
+++ b/meta-oe/recipes-support/crow/crow_1.3.2.bb
@@ -0,0 +1,20 @@
+SUMMARY = "A Fast and Easy to use microframework for the web"
+HOMEPAGE = "https://crowcpp.org/"
+DESCRIPTION = "Crow is a C++ framework for creating HTTP or Websocket web services. \
+It uses routing similar to Python's Flask which makes it easy to use. \
+It is also extremely fast, beating multiple existing C++ frameworks as well as non-C++ frameworks."
+SECTION = "libs"
+LICENSE = "BSD-3-Clause"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=e08502e395a6f7c037ddfe7d2915f58e"
+SRC_URI = "git://github.com/CrowCpp/Crow.git;protocol=https;branch=v1.3;tag=v${PV}"
+SRCREV = "f8c060c51feeca2c65828fb6f538603db4392d55"
+inherit cmake
+DEPENDS = "asio"
+EXTRA_OECMAKE = "\
+    -DCROW_BUILD_EXAMPLES=OFF \
+    -DCROW_BUILD_TESTS=OFF \
+"
diff --git a/meta-oe/recipes-support/enca/enca_1.19.bb b/meta-oe/recipes-support/enca/enca_1.19.bb
index 61da50ba52..395d7abe70 100644
--- a/meta-oe/recipes-support/enca/enca_1.19.bb
+++ b/meta-oe/recipes-support/enca/enca_1.19.bb
@@ -17,4 +17,6 @@ SRC_URI[sha256sum] = "4c305cc59f3e57f2cfc150a6ac511690f43633595760e1cb266bf23362
 inherit autotools
+CACHED_CONFIGUREVARS += "ac_cv_prog_cc_c23=no"
 EXTRA_OECONF += "MKTEMP_PROG=mktemp"
diff --git a/meta-oe/recipes-support/fastfetch/fastfetch_2.60.0.bb b/meta-oe/recipes-support/fastfetch/fastfetch_2.61.0.bb
index dbb999969b..8db0b608f1 100644
--- a/meta-oe/recipes-support/fastfetch/fastfetch_2.60.0.bb
+++ b/meta-oe/recipes-support/fastfetch/fastfetch_2.61.0.bb
@@ -10,14 +10,13 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=2090e7d93df7ad5a3d41f6fb4226ac76"
 DEPENDS = "yyjson"
-SRC_URI = "git://github.com/fastfetch-cli/fastfetch.git;protocol=https;branch=dev;tag=${PV}"
+SRC_URI = "git://github.com/fastfetch-cli/fastfetch.git;protocol=https;branch=master;tag=${PV}"
-SRCREV = "06ecc9c4805794ca8d632844e64950e82a6d5f7e"
+SRCREV = "e5d600600614f5496b02907a11a7bc80c369d266"
 inherit cmake pkgconfig
 EXTRA_OECMAKE += "\
    -DENABLE_SYSTEM_YYJSON=ON \
-    -DENABLE_DIRECTX_HEADERS=OFF \
 "
 PACKAGECONFIG ??= "\
diff --git a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.16.bb b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
index f5be870b1d..7970e0f563 100644
--- a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.16.bb
+++ b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
@@ -14,7 +14,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504 \
                    file://COPYING.sunbmc;md5=c03f21cd76ff5caba6b890d1213cbfbb"
 SRC_URI = "${GNU_MIRROR}/freeipmi/freeipmi-${PV}.tar.gz"
-SRC_URI[sha256sum] = "5bcef6bb9eb680e49b4a3623579930ace7899f53925b2045fe9f91ad6904111d"
+SRC_URI[sha256sum] = "16783d10faa28847a795cce0bf86deeaa72b8fbe71d1f0dc1101d13a6b501ec1"
 DEPENDS = "libgcrypt"
 DEPENDS:append:libc-musl = " argp-standalone"
@@ -23,3 +23,4 @@ inherit pkgconfig autotools
 EXTRA_OECONF = "--without-random-device"
+CVE_STATUS[CVE-2026-33554] = "fixed-version: fixed since 1.6.17"
diff --git a/meta-oe/recipes-support/freerdp/freerdp/0001-Fix-compilation-error.patch b/meta-oe/recipes-support/freerdp/freerdp/0001-Fix-compilation-error.patch
new file mode 100644
index 0000000000..c2c093bc47
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp/0001-Fix-compilation-error.patch
@@ -0,0 +1,101 @@
+From 0d48a9cb6e25afa10e76de75232ad32a82806aae Mon Sep 17 00:00:00 2001
+From: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Date: Wed, 25 Mar 2026 00:04:42 +1300
+Subject: [PATCH] Fix compilation error
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/b78cb455cbe847da934c777189b6e7f25267502e]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ winpr/include/winpr/collections.h        |  2 +-
+ winpr/libwinpr/utils/collections/Queue.c | 28 ++++++++++++++++++------
+ 2 files changed, 22 insertions(+), 8 deletions(-)
+diff --git a/winpr/include/winpr/collections.h b/winpr/include/winpr/collections.h
+index b8c8d9d66..64705751e 100644
+--- a/winpr/include/winpr/collections.h
+++ b/winpr/include/winpr/collections.h
+@@ -63,7 +63,7 @@ extern "C"
+                int head;
+                int tail;
+                int size;
+-               void** array;
+               uintptr_t* array;
+                CRITICAL_SECTION lock;
+                HANDLE event;
+ 
+diff --git a/winpr/libwinpr/utils/collections/Queue.c b/winpr/libwinpr/utils/collections/Queue.c
+index bb789b658..6b86f7ab7 100644
+--- a/winpr/libwinpr/utils/collections/Queue.c
+++ b/winpr/libwinpr/utils/collections/Queue.c
+@@ -34,6 +34,16 @@
+  * Properties
+  */
+ 
+static inline void* uptr2void(uintptr_t ptr)
+{
+       return (void*)ptr;
+}
+
+static inline uintptr_t void2uptr(const void* ptr)
+{
+       return (uintptr_t)ptr;
+}
+
+ /**
+  * Gets the number of elements contained in the Queue.
+  */
+@@ -98,9 +108,12 @@ void Queue_Clear(wQueue* queue)
+        for (index = queue->head; index != queue->tail; index = (index + 1) % queue->capacity)
+        {
+                if (queue->object.fnObjectFree)
+-                       queue->object.fnObjectFree(queue->array[index]);
+               {
+                       void* obj = uptr2void(queue->array[index]);
+                       queue->object.fnObjectFree(obj);
+               }
+ 
+-               queue->array[index] = NULL;
+               queue->array[index] = 0;
+        }
+ 
+        queue->size = 0;
+@@ -124,7 +137,8 @@ BOOL Queue_Contains(wQueue* queue, void* obj)
+ 
+        for (index = 0; index < queue->tail; index++)
+        {
+-               if (queue->object.fnObjectEquals(queue->array[index], obj))
+               void* ptr = uptr2void(queue->array[index]);
+               if (queue->object.fnObjectEquals(ptr, obj))
+                {
+                        found = TRUE;
+                        break;
+@@ -217,7 +231,7 @@ BOOL Queue_Enqueue(wQueue* queue, void* obj)
+        if (!Queue_EnsureCapacity(queue, 1))
+                goto out;
+ 
+-       queue->array[queue->tail] = obj;
+       queue->array[queue->tail] = void2uptr(obj);
+        queue->tail = (queue->tail + 1) % queue->capacity;
+        queue->size++;
+        SetEvent(queue->event);
+@@ -242,8 +256,8 @@ void* Queue_Dequeue(wQueue* queue)
+ 
+        if (queue->size > 0)
+        {
+-               obj = queue->array[queue->head];
+-               queue->array[queue->head] = NULL;
+               obj = uptr2void(queue->array[queue->head]);
+               queue->array[queue->head] = 0;
+                queue->head = (queue->head + 1) % queue->capacity;
+                queue->size--;
+        }
+@@ -269,7 +283,7 @@ void* Queue_Peek(wQueue* queue)
+                EnterCriticalSection(&queue->lock);
+ 
+        if (queue->size > 0)
+-               obj = queue->array[queue->head];
+               obj = uptr2void(queue->array[queue->head]);
+ 
+        if (queue->synchronized)
+                LeaveCriticalSection(&queue->lock);
diff --git a/meta-oe/recipes-support/freerdp/freerdp/0001-Fix-const-qualifier-error.patch b/meta-oe/recipes-support/freerdp/freerdp/0001-Fix-const-qualifier-error.patch
deleted file mode 100644
index 87a456d16d..0000000000
--- a/meta-oe/recipes-support/freerdp/freerdp/0001-Fix-const-qualifier-error.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 761b4df04a141cc8c9507c741e4046c6c6b00491 Mon Sep 17 00:00:00 2001
-From: Wang Mingyu <wangmy@fujitsu.com>
-Date: Mon, 11 Sep 2023 09:00:39 +0000
-Subject: [PATCH] Fix const qualifier error
-Fixes clang error
-error: incompatible function pointer types assigning to 'OBJECT_NEW_FN' (aka 'void *(*)(void *)') from 'void *(const void *)' [-Wincompatible-function-pointer-types]
-|         obj->fnObjectNew = uwac_event_clone;
-|                          ^ ~~~~~~~~~~~~~~~~
-https://github.com/FreeRDP/FreeRDP/commit/6e3c00725aae99d03a0baa65430eceddebd9dee8
-Upstream-Status: Backport
-Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
- libfreerdp/codec/rfx.c            | 4 ++--
- winpr/include/winpr/collections.h | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/libfreerdp/codec/rfx.c b/libfreerdp/codec/rfx.c
-index ccbc5af..eec7365 100644
--- a/libfreerdp/codec/rfx.c
-+++ b/libfreerdp/codec/rfx.c
-@@ -153,7 +153,7 @@ static void rfx_tile_init(void* obj)
-        }
- }
- 
-static void* rfx_decoder_tile_new(void* val)
-+static void* rfx_decoder_tile_new(const void* val)
- {
-        RFX_TILE* tile = NULL;
-        WINPR_UNUSED(val);
-@@ -184,7 +184,7 @@ static void rfx_decoder_tile_free(void* obj)
-        }
- }
- 
-static void* rfx_encoder_tile_new(void* val)
-+static void* rfx_encoder_tile_new(const void* val)
- {
-        WINPR_UNUSED(val);
-        return calloc(1, sizeof(RFX_TILE));
-diff --git a/winpr/include/winpr/collections.h b/winpr/include/winpr/collections.h
-index 807f011..b8c8d9d 100644
--- a/winpr/include/winpr/collections.h
-+++ b/winpr/include/winpr/collections.h
-@@ -36,7 +36,7 @@ extern "C"
- {
- #endif
- 
-       typedef void* (*OBJECT_NEW_FN)(void* val);
-+       typedef void* (*OBJECT_NEW_FN)(const void* val);
-        typedef void (*OBJECT_INIT_FN)(void* obj);
-        typedef void (*OBJECT_UNINIT_FN)(void* obj);
-        typedef void (*OBJECT_FREE_FN)(void* obj);
-- 
-2.34.1
diff --git a/meta-oe/recipes-support/freerdp/freerdp/0001-Fixed-compilation-warnings-in-ainput-channel.patch b/meta-oe/recipes-support/freerdp/freerdp/0001-Fixed-compilation-warnings-in-ainput-channel.patch
deleted file mode 100644
index 62600cddab..0000000000
--- a/meta-oe/recipes-support/freerdp/freerdp/0001-Fixed-compilation-warnings-in-ainput-channel.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 130094de3244d5039e463e1142e1ec487c1104ef Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Tue, 22 Feb 2022 12:05:08 +0100
-Subject: [PATCH] Fixed compilation warnings in ainput channel
-Upstream-Status: Backport [130094de3 Fixed compilation warnings in ainput channel]
-Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
---
- channels/ainput/server/ainput_main.c | 18 ++++++++++++------
- 1 file changed, 12 insertions(+), 6 deletions(-)
-diff --git a/channels/ainput/server/ainput_main.c b/channels/ainput/server/ainput_main.c
-index bc1737ee1..17d2ec681 100644
--- a/channels/ainput/server/ainput_main.c
-+++ b/channels/ainput/server/ainput_main.c
-@@ -192,7 +192,7 @@ static UINT ainput_server_recv_mouse_event(ainput_server* ainput, wStream* s)
- 
- static HANDLE ainput_server_get_channel_handle(ainput_server* ainput)
- {
-       BYTE* buffer = NULL;
-+       void* buffer = NULL;
-        DWORD BytesReturned = 0;
-        HANDLE ChannelEvent = NULL;
- 
-@@ -389,7 +389,7 @@ ainput_server_context* ainput_server_context_new(HANDLE vcm)
-                goto fail;
-        return &ainput->context;
- fail:
-       ainput_server_context_free(ainput);
-+       ainput_server_context_free(&ainput->context);
-        return NULL;
- }
- 
-@@ -496,17 +496,23 @@ UINT ainput_server_context_poll_int(ainput_server_context* context)
-                        break;
-                case AINPUT_OPENED:
-                {
-                       BYTE* buffer = NULL;
-+                       union
-+                       {
-+                               BYTE* pb;
-+                               void* pv;
-+                       } buffer;
-                        DWORD BytesReturned = 0;
- 
-                       if (WTSVirtualChannelQuery(ainput->ainput_channel, WTSVirtualChannelReady, &buffer,
-+                       buffer.pv = NULL;
-+
-+                       if (WTSVirtualChannelQuery(ainput->ainput_channel, WTSVirtualChannelReady, &buffer.pv,
-                                                   &BytesReturned) != TRUE)
-                        {
-                                WLog_ERR(TAG, "WTSVirtualChannelReady failed,");
-                        }
-                        else
-                        {
-                               if (*buffer != 0)
-+                               if (*buffer.pb != 0)
-                                {
-                                        error = ainput_server_send_version(ainput);
-                                        if (error)
-@@ -518,7 +524,7 @@ UINT ainput_server_context_poll_int(ainput_server_context* context)
-                                else
-                                        error = CHANNEL_RC_OK;
-                        }
-                       WTSFreeMemory(buffer);
-+                       WTSFreeMemory(buffer.pv);
-                }
-                break;
-                case AINPUT_VERSION_SENT:
-- 
-2.43.0
diff --git a/meta-oe/recipes-support/freerdp/freerdp/0001-Fixed-compilation-warnings.patch b/meta-oe/recipes-support/freerdp/freerdp/0001-Fixed-compilation-warnings.patch
deleted file mode 100644
index 7fae2703f8..0000000000
--- a/meta-oe/recipes-support/freerdp/freerdp/0001-Fixed-compilation-warnings.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 75fa1fa5bd5ef2350390564245fd0984209ac092 Mon Sep 17 00:00:00 2001
-From: akallabeth <akallabeth@posteo.net>
-Date: Mon, 4 Jul 2022 14:34:46 +0200
-Subject: [PATCH] Fixed compilation warnings
-Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/2da280b8a1748052b70b3f5a1ef0d8e932c33adc]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
- client/X11/xf_graphics.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/client/X11/xf_graphics.c b/client/X11/xf_graphics.c
-index 5aa1fd48b..fe81e0ed9 100644
--- a/client/X11/xf_graphics.c
-+++ b/client/X11/xf_graphics.c
-@@ -438,7 +438,7 @@ static BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer)
- 
- #endif
- fail:
-       WLog_DBG(TAG, "%s: %ld", __func__, rc ? pointer : -1);
-+       WLog_DBG(TAG, "%s: %p", __func__, rc ? pointer : NULL);
-        return rc;
- }
- 
-- 
-2.45.0
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.0.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 3c0fed5dc4..a4561495cf 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.0.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -8,8 +8,8 @@ RDEPENDS:${PN}-ptest += "cmake coreutils"
 inherit pkgconfig cmake ptest
-SRCREV = "b00402d3258402c868224b6ffed04182cbed78d9"
+SRCREV = "3028b706908f81767d9b9c744a90778c28f57d61"
-SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;branch=master;protocol=https;tag=${PV} \
+SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${PV} \
           file://run-ptest"
diff --git a/meta-oe/recipes-support/freerdp/freerdp_2.11.7.bb b/meta-oe/recipes-support/freerdp/freerdp_2.11.8.bb
index dff3f6dafe..2cc8dc6cf2 100644
--- a/meta-oe/recipes-support/freerdp/freerdp_2.11.7.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp_2.11.8.bb
@@ -15,14 +15,12 @@ RDEPENDS:${PN}-ptest += "coreutils pcsc-lite-lib"
 PE = "1"
 PKGV = "${GITPKGVTAG}"
-SRCREV = "efa899d3deb8595a29fabb2a2251722f9d7e0d7f"
+SRCREV = "9b678b6d5a40ce01607d8c3b1b1416437c8416c4"
 SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;branch=stable-2.0;protocol=https \
           file://run-ptest \
           file://winpr-makecert-Build-with-install-RPATH.patch \
-           file://0001-Fixed-compilation-warnings.patch \
-           file://0001-Fix-const-qualifier-error.patch \
           file://0002-Do-not-install-tools-a-CMake-targets.patch \
-           file://0001-Fixed-compilation-warnings-in-ainput-channel.patch \
+           file://0001-Fix-compilation-error.patch \
           file://CVE-2024-32661.patch \
           file://CVE-2026-22854.patch \
           file://CVE-2026-22855.patch \
diff --git a/meta-oe/recipes-support/fuse/fuse3_3.18.1.bb b/meta-oe/recipes-support/fuse/fuse3_3.18.2.bb
index a29e1820d7..5a0c894e86 100644
--- a/meta-oe/recipes-support/fuse/fuse3_3.18.1.bb
+++ b/meta-oe/recipes-support/fuse/fuse3_3.18.2.bb
@@ -14,7 +14,7 @@ LIC_FILES_CHKSUM = " \
 "
 SRC_URI = "https://github.com/libfuse/libfuse/releases/download/fuse-${PV}/fuse-${PV}.tar.gz"
-SRC_URI[sha256sum] = "dd395c88f29c7540bbdd0b830260ab8092ccb241bb6e66f603643f715fb9322c"
+SRC_URI[sha256sum] = "f01de85717e20adf5f98aff324acd85dd73d61a5ca3834d573dcf0bd6e54a298"
 S = "${UNPACKDIR}/fuse-${PV}"
diff --git a/meta-oe/recipes-support/gd/gd_2.3.3.bb b/meta-oe/recipes-support/gd/gd_2.3.3.bb
index 0d7a6d34f9..062c4b4a8f 100644
--- a/meta-oe/recipes-support/gd/gd_2.3.3.bb
+++ b/meta-oe/recipes-support/gd/gd_2.3.3.bb
@@ -23,14 +23,23 @@ SRCREV = "b5319a41286107b53daa0e08e402aa1819764bdc"
 inherit autotools binconfig gettext pkgconfig
-EXTRA_OECONF += " --disable-rpath \
+PACKAGECONFIG ?= "jpeg freetype"
-                  --with-jpeg=${STAGING_LIBDIR}/.. \
-                  --with-freetype=yes \
+PACKAGECONFIG[avif] = "--with-avif,--without-avif"
-                  --without-fontconfig \
+PACKAGECONFIG[fontconfig] = "--with-fontconfig,--without-fontconfig"
-                  --without-webp \
+PACKAGECONFIG[freetype] = "--with-freetype,--without-freetype"
-                  --without-xpm \
+PACKAGECONFIG[heif] = "--with-heif,--without-heif"
-                  --without-x \
+PACKAGECONFIG[jpeg] = "--with-jpeg,--without-jpeg"
-                "
+PACKAGECONFIG[liq] = "--with-liq,--without-liq"
+PACKAGECONFIG[png] = "--with-png,--without-png"
+PACKAGECONFIG[raqm] = "--with-raqm,--without-raqm,libraqm"
+PACKAGECONFIG[tiff] = "--with-tiff,--without-tiff"
+PACKAGECONFIG[webp] = "--with-webp,--without-webp"
+PACKAGECONFIG[x] = "--with-x,--without-x"
+PACKAGECONFIG[xpm] = "--with-xpm,--without-xpm"
+PACKAGECONFIG[zlib] = "--with-zlib,--without-zlib"
+EXTRA_OECONF += "--disable-rpath"
 EXTRA_OEMAKE = 'LDFLAGS="${LDFLAGS}"'
diff --git a/meta-oe/recipes-support/glaze/glaze_7.1.1.bb b/meta-oe/recipes-support/glaze/glaze_7.3.3.bb
index ef1f9032b1..e733d166b2 100644
--- a/meta-oe/recipes-support/glaze/glaze_7.1.1.bb
+++ b/meta-oe/recipes-support/glaze/glaze_7.3.3.bb
@@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=ea4d29875d83fbbf50485c846dbbbed8"
 SRC_URI = "git://github.com/stephenberry/glaze;protocol=https;branch=main;tag=v${PV}"
-SRCREV = "a6008aa05d26ab1653bda73235fe05629f7bdad0"
+SRCREV = "dbf6caec935b768546587a413e45d033480c4483"
 inherit cmake
diff --git a/meta-oe/recipes-support/gnulib/gnulib_202601.bb b/meta-oe/recipes-support/gnulib/gnulib_202601.bb
index d3ebdca8dd..763be6c11a 100644
--- a/meta-oe/recipes-support/gnulib/gnulib_202601.bb
+++ b/meta-oe/recipes-support/gnulib/gnulib_202601.bb
@@ -20,6 +20,7 @@ SRC_URI = "git://git.savannah.gnu.org/git/gnulib.git;branch=stable-${PV};protoco
 do_install () {
    install -d ${D}/${datadir}/gnulib
    cp --no-preserve=ownership --recursive ${S}/* ${D}/${datadir}/gnulib/
+    cp --no-preserve=ownership --recursive ${S}/.gnulib-tool.py ${D}/${datadir}/gnulib/
    cp --no-preserve=ownership --recursive ${S}/.git ${D}/${datadir}/gnulib/
 }
diff --git a/meta-oe/recipes-support/gtk-layer-shell/gtk-layer-shell_0.10.0.bb b/meta-oe/recipes-support/gtk-layer-shell/gtk-layer-shell_0.10.1.bb
index 2bfe9b0e77..46a0562d2c 100644
--- a/meta-oe/recipes-support/gtk-layer-shell/gtk-layer-shell_0.10.0.bb
+++ b/meta-oe/recipes-support/gtk-layer-shell/gtk-layer-shell_0.10.1.bb
@@ -18,7 +18,7 @@ DEPENDS += " \
 SRC_URI = " \
        git://github.com/wmww/gtk-layer-shell.git;protocol=https;branch=master;tag=v${PV} \
 "
-SRCREV = "3964966d72ea3359f4ff748081493e979c080b7e"
+SRCREV = "fd88ba666c18ff65ea786bf7b2e270d840030817"
 inherit meson pkgconfig features_check gobject-introspection vala
diff --git a/meta-oe/recipes-support/htop/files/0001-configure.ac-Remove-usr-include-libnl3.patch b/meta-oe/recipes-support/htop/files/0001-configure.ac-Remove-usr-include-libnl3.patch
index f00f3ac4db..c1f763ce17 100644
--- a/meta-oe/recipes-support/htop/files/0001-configure.ac-Remove-usr-include-libnl3.patch
+++ b/meta-oe/recipes-support/htop/files/0001-configure.ac-Remove-usr-include-libnl3.patch
@@ -1,6 +1,6 @@
-From 87d66b3b60176197e785670214b0bbc5bedd6552 Mon Sep 17 00:00:00 2001
+From 652b208b8c3038934fb55169f44068bbdf399b69 Mon Sep 17 00:00:00 2001
-From: Leon Anavi <leon.anavi@konsulko.com>
+From: Liu Yiding <liuyd.fnst@fujitsu.com>
-Date: Mon, 8 Dec 2025 11:06:01 +0000
+Date: Wed, 15 Apr 2026 01:34:56 +0000
 Subject: [PATCH] configure.ac: Remove /usr/include/libnl3
 Fixes:
@@ -11,40 +11,35 @@ netlink/attr.h, netlink/handlers.h, netlink/msg.h
 Upstream-Status: Inappropriate [OE-specific]
 Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
+Update for 3.5.0.
+Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com>
 ---
- configure.ac | 6 +++---
+ configure.ac | 4 ++--
- 1 file changed, 3 insertions(+), 3 deletions(-)
+ 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/configure.ac b/configure.ac
-index 9f2f46b3..f3906692 100644
+index 2d174d73..ee8b29ca 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -980,14 +980,14 @@ case "$enable_delayacct" in
+@@ -1638,7 +1638,7 @@ case "$enable_delayacct" in
-          enable_delayacct=no
+ 
-       else
+       htop_save_CFLAGS=$CFLAGS
-          old_CFLAGS="$CFLAGS"
+       # New include path searched after what user has specified
-         CFLAGS="$CFLAGS -I/usr/include/libnl3"
+-      CFLAGS="$CFLAGS $LIBNL3_CFLAGS"
-+         CFLAGS="$CFLAGS"
-          AC_CHECK_HEADERS([netlink/attr.h netlink/handlers.h netlink/msg.h], [enable_delayacct=yes], [enable_delayacct=no])
-          CFLAGS="$old_CFLAGS"
-       fi
-       ;;
-    yes)
-       old_CFLAGS="$CFLAGS"
-      CFLAGS="$CFLAGS -I/usr/include/libnl3"
 +      CFLAGS="$CFLAGS"
-       AC_CHECK_HEADERS([netlink/attr.h netlink/handlers.h netlink/msg.h], [], [AC_MSG_ERROR([can not find required header files netlink/attr.h, netlink/handlers.h, netlink/msg.h])])
+       AC_CHECK_HEADERS(
-       CFLAGS="$old_CFLAGS"
+          [netlink/attr.h netlink/handlers.h netlink/msg.h],
-       ;;
+          [],
-@@ -997,7 +997,7 @@ case "$enable_delayacct" in
+@@ -1681,7 +1681,7 @@ case "$enable_delayacct" in
 esac
 if test "$enable_delayacct" = yes; then
-   AC_DEFINE([HAVE_DELAYACCT], [1], [Define if delay accounting support should be enabled.])
+    AC_DEFINE([HAVE_DELAYACCT], [1], [Define if delay accounting support should be enabled.])
-  AM_CFLAGS="$AM_CFLAGS -I/usr/include/libnl3"
+-   AM_CFLAGS="$AM_CFLAGS $LIBNL3_CFLAGS"
-+  AM_CFLAGS="$AM_CFLAGS"
+   AM_CFLAGS="$AM_CFLAGS"
 fi
 AM_CONDITIONAL([HAVE_DELAYACCT], [test "$enable_delayacct" = yes])
 
 -- 
-2.47.3
+2.43.0
diff --git a/meta-oe/recipes-support/htop/htop_3.4.1.bb b/meta-oe/recipes-support/htop/htop_3.5.0.bb
index e3f8a7fdb4..961a87097b 100644
--- a/meta-oe/recipes-support/htop/htop_3.4.1.bb
+++ b/meta-oe/recipes-support/htop/htop_3.5.0.bb
@@ -6,10 +6,10 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
 DEPENDS = "ncurses libnl"
-SRC_URI = "git://github.com/htop-dev/htop.git;branch=main;protocol=https \
+SRC_URI = "git://github.com/htop-dev/htop.git;branch=main;protocol=https;tag=${PV} \
           file://0001-configure.ac-Remove-usr-include-libnl3.patch \
 "
-SRCREV = "348c0a6bf4f33571835a0b6a1a0f5deb15132128"
+SRCREV = "a21f043b253a6dfa89df1ff4130fe7d2e505000f"
 inherit autotools pkgconfig
@@ -23,7 +23,7 @@ PACKAGECONFIG ??= " \
 "
 PACKAGECONFIG[unicode] = "--enable-unicode,--disable-unicode"
 PACKAGECONFIG[affinity] = "--enable-affinity,--disable-affinity,,,,hwloc"
-PACKAGECONFIG[unwind] = "--enable-unwind,--disable-unwind,libunwind"
+PACKAGECONFIG[unwind] = "--with-libunwind,--without-libunwind,libunwind"
 PACKAGECONFIG[hwloc] = "--enable-hwloc,--disable-hwloc,hwloc,,,affinity"
 PACKAGECONFIG[openvz] = "--enable-openvz,--disable-openvz"
 PACKAGECONFIG[vserver] = "--enable-vserver,--disable-vserver"
diff --git a/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-17.bb b/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-17.bb
deleted file mode 100644
index 2a1152087a..0000000000
--- a/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-17.bb
+++ /dev/null
@@ -1,197 +0,0 @@
-SUMMARY = "ImageMagick is an image conversion toolkit"
-SECTION = "console/utils"
-HOMEPAGE = "https://www.imagemagick.org/"
-DESCRIPTION = "ImageMagick is a collection of tools for displaying, converting, and \
-editing raster and vector image files. It can read and write over 200 image file formats."
-LICENSE = "ImageMagick"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=1f56ade64cf079aff7232f7dbeaea992 \
-                    file://NOTICE;md5=3974428a57d34b981abb7acc416dde8f"
-# FIXME: There are many more checked libraries. All should be added or explicitly disabled to get consistent results.
-DEPENDS = "lcms bzip2 jpeg libpng tiff zlib fftw freetype libtool"
-BASE_PV = "${@d.getVar('PV').split('-')[0]}"
-UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>([0-9][\.|_|-]?)+)"
-SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=https;tag=${PV} \
-           file://run-ptest \
-           file://imagemagick-ptest.sh \
-"
-SRCREV = "3f2f629405c62106d3569547c03634bc46fcd07d"
-inherit autotools pkgconfig update-alternatives ptest
-export ac_cv_sys_file_offset_bits = "64"
-EXTRA_OECONF = "--program-prefix= --program-suffix=.im7 --without-perl --enable-largefile"
-PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'x11', d)} cxx webp xml"
-PACKAGECONFIG[cxx] = "--with-magick-plus-plus,--without-magick-plus-plus"
-PACKAGECONFIG[graphviz] = "--with-gvc,--without-gvc,graphviz"
-PACKAGECONFIG[heic] = "--with-heic,--without-heic,libheif"
-PACKAGECONFIG[jxl] = "--with-jxl,--without-jxl,libjxl"
-PACKAGECONFIG[lzma] = "--with-lzma,--without-lzma,xz"
-PACKAGECONFIG[openjpeg] = "--with-openjp2,--without-openjp2,openjpeg"
-PACKAGECONFIG[pango] = "--with-pango,--without-pango,pango cairo"
-PACKAGECONFIG[raw] = "--with-raw,--without-raw,libraw"
-PACKAGECONFIG[rsvg] = "--with-rsvg,--without-rsvg,librsvg"
-PACKAGECONFIG[tcmalloc] = "--with-tcmalloc=yes,--with-tcmalloc=no,gperftools"
-PACKAGECONFIG[webp] = "--with-webp,--without-webp,libwebp"
-PACKAGECONFIG[wmf] = "--with-wmf,--without-wmf,libwmf"
-PACKAGECONFIG[x11] = "--with-x,--without-x,virtual/libx11 libxext libxt"
-PACKAGECONFIG[xml] = "--with-xml,--without-xml,libxml2"
-do_install:append:class-target() {
-    for file in MagickCore-config.im7 MagickWand-config.im7; do
-        sed -i 's,${STAGING_DIR_TARGET},,g' "${D}${bindir}/$file"
-    done
-    if ${@bb.utils.contains('PACKAGECONFIG', 'cxx', 'true', 'false', d)}; then
-        sed -i 's,${STAGING_DIR_TARGET},,g' "${D}${bindir}/Magick++-config.im7"
-    fi
-    if ${@bb.utils.contains('PACKAGECONFIG', 'xml', 'true', 'false', d)}; then
-        xml_config="${D}${libdir}/ImageMagick-${BASE_PV}/config-Q16HDRI/configure.xml"
-        sed -i 's,${S},,g' "$xml_config"
-        sed -i 's,${B},,g' "$xml_config"
-        sed -i 's,${RECIPE_SYSROOT},,g' "$xml_config"
-    fi
-    if ${@bb.utils.contains_any('PACKAGECONFIG', 'webp openjpeg', 'true', 'false', d)}; then
-        sed -i 's,${HOSTTOOLS_DIR},${bindir},g' "${D}${sysconfdir}/ImageMagick-7/delegates.xml"
-    fi
-}
-do_install_ptest() {
-    install -d ${D}${PTEST_PATH}
-    install -m 0755 ${UNPACKDIR}/run-ptest ${D}${PTEST_PATH}/
-    install -m 0755 ${UNPACKDIR}/imagemagick-ptest.sh ${D}${PTEST_PATH}/
-}
-FILES:${PN} += "${libdir}/ImageMagick-${BASE_PV}/config-Q16* \
-                ${datadir}/ImageMagick-7"
-FILES:${PN}-dev += "${libdir}/ImageMagick-${BASE_PV}/modules-Q16/*/*.a"
-FILES:${PN}-dbg += "${libdir}/ImageMagick-${BASE_PV}/modules-Q16/*/.debug/*"
-BBCLASSEXTEND = "native nativesdk"
-ALTERNATIVE_PRIORITY = "100"
-ALTERNATIVE:${PN} = "animate compare composite conjure convert display \
-    identify import magick-script mogrify montage stream magick"
-ALTERNATIVE_TARGET[animate] = "${bindir}/animate.im7"
-ALTERNATIVE_TARGET[compare] = "${bindir}/compare.im7"
-ALTERNATIVE_TARGET[composite] = "${bindir}/composite.im7"
-ALTERNATIVE_TARGET[conjure] = "${bindir}/conjure.im7"
-ALTERNATIVE_TARGET[convert] = "${bindir}/convert.im7"
-ALTERNATIVE_TARGET[display] = "${bindir}/display.im7"
-ALTERNATIVE_TARGET[identify] = "${bindir}/identify.im7"
-ALTERNATIVE_TARGET[import] = "${bindir}/import.im7"
-ALTERNATIVE_TARGET[magick-script] = "${bindir}/magick-script.im7"
-ALTERNATIVE_TARGET[mogrify] = "${bindir}/mogrify.im7"
-ALTERNATIVE_TARGET[montage] = "${bindir}/montage.im7"
-ALTERNATIVE_TARGET[stream] = "${bindir}/stream.im7"
-ALTERNATIVE_TARGET[magick] = "${bindir}/magick.im7"
-ALTERNATIVE:${PN}-doc = "animate.1 compare.1 composite.1 conjure.1 \
-    convert.1 display.1 identify.1 import.1 magick-script.1 mogrify.1 montage.1 stream.1"
-ALTERNATIVE_LINK_NAME[animate.1] = "${mandir}/man1/animate.1"
-ALTERNATIVE_TARGET[animate.1] = "${mandir}/man1/animate.im7.1"
-ALTERNATIVE_LINK_NAME[compare.1] = "${mandir}/man1/compare.1"
-ALTERNATIVE_TARGET[compare.1] = "${mandir}/man1/compare.im7.1"
-ALTERNATIVE_LINK_NAME[composite.1] = "${mandir}/man1/composite.1"
-ALTERNATIVE_TARGET[composite.1] = "${mandir}/man1/composite.im7.1"
-ALTERNATIVE_LINK_NAME[conjure.1] = "${mandir}/man1/conjure.1"
-ALTERNATIVE_TARGET[conjure.1] = "${mandir}/man1/conjure.im7.1"
-ALTERNATIVE_LINK_NAME[convert.1] = "${mandir}/man1/convert.1"
-ALTERNATIVE_TARGET[convert.1] = "${mandir}/man1/convert.im7.1"
-ALTERNATIVE_LINK_NAME[display.1] = "${mandir}/man1/display.1"
-ALTERNATIVE_TARGET[display.1] = "${mandir}/man1/display.im7.1"
-ALTERNATIVE_LINK_NAME[identify.1] = "${mandir}/man1/identify.1"
-ALTERNATIVE_TARGET[identify.1] = "${mandir}/man1/identify.im7.1"
-ALTERNATIVE_LINK_NAME[import.1] = "${mandir}/man1/import.1"
-ALTERNATIVE_TARGET[import.1] = "${mandir}/man1/import.im7.1"
-ALTERNATIVE_LINK_NAME[magick-script.1] = "${mandir}/man1/magick-script.1"
-ALTERNATIVE_TARGET[magick-script.1] = "${mandir}/man1/magick-script.im7.1"
-ALTERNATIVE_LINK_NAME[mogrify.1] = "${mandir}/man1/mogrify.1"
-ALTERNATIVE_TARGET[mogrify.1] = "${mandir}/man1/mogrify.im7.1"
-ALTERNATIVE_LINK_NAME[montage.1] = "${mandir}/man1/montage.1"
-ALTERNATIVE_TARGET[montage.1] = "${mandir}/man1/montage.im7.1"
-ALTERNATIVE_LINK_NAME[stream.1] = "${mandir}/man1/stream.1"
-ALTERNATIVE_TARGET[stream.1] = "${mandir}/man1/stream.im7.1"
-ALTERNATIVE_LINK_NAME[magick] = "${bindir}/magick"
-CVE_STATUS[CVE-2007-1667] = "cpe-incorrect: CVE should not include a CPE for imagemagick"
-CVE_STATUS[CVE-2014-9804] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9805] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9806] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9807] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9808] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9809] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9810] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9811] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9812] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9813] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9814] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9815] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9816] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9817] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9818] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9819] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9820] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9821] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9822] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9823] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9824] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9825] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9826] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9827] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9828] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9829] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9830] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9831] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9848] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9852] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9853] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9854] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2014-9907] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-10062] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 7.0.1-10"
-CVE_STATUS[CVE-2016-10144] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.7-1"
-CVE_STATUS[CVE-2016-10145] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.7-1"
-CVE_STATUS[CVE-2016-10146] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.6-8"
-CVE_STATUS[CVE-2016-5118] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 7.0.1-7"
-CVE_STATUS[CVE-2016-7513] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7514] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 7.0.1-0"
-CVE_STATUS[CVE-2016-7515] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7516] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7517] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7518] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7519] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7520] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7521] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7522] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7523] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7524] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7525] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7526] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7527] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7528] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7529] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7530] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7531] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 7.0.1-0"
-CVE_STATUS[CVE-2016-7532] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7533] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7534] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7535] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7536] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7537] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2016-7538] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
-CVE_STATUS[CVE-2017-5506] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 7.0.4-4"
-CVE_STATUS[CVE-2017-5509] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 7.0.4-4"
-CVE_STATUS[CVE-2017-5510] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 7.0.4-4"
-CVE_STATUS[CVE-2017-5511] = "cpe-incorrect: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 7.0.4-3"
-CVE_STATUS[CVE-2023-5341] = "fixed-version: this is fixed in 7.1.1-19"
diff --git a/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-19.bb b/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-19.bb
new file mode 100644
index 0000000000..18c23cb0d4
--- /dev/null
+++ b/meta-oe/recipes-support/imagemagick/imagemagick_7.1.2-19.bb
@@ -0,0 +1,130 @@
+SUMMARY = "ImageMagick is an image conversion toolkit"
+SECTION = "console/utils"
+HOMEPAGE = "https://www.imagemagick.org/"
+DESCRIPTION = "ImageMagick is a collection of tools for displaying, converting, and \
+editing raster and vector image files. It can read and write over 200 image file formats."
+LICENSE = "ImageMagick"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=1f56ade64cf079aff7232f7dbeaea992 \
+                    file://NOTICE;md5=3974428a57d34b981abb7acc416dde8f"
+# FIXME: There are many more checked libraries. All should be added or explicitly disabled to get consistent results.
+DEPENDS = "lcms bzip2 jpeg libpng tiff zlib fftw freetype libtool"
+BASE_PV = "${@d.getVar('PV').split('-')[0]}"
+UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>([0-9][\.|_|-]?)+)"
+SRC_URI = "git://github.com/ImageMagick/ImageMagick.git;branch=main;protocol=https;tag=${PV} \
+           file://run-ptest \
+           file://imagemagick-ptest.sh \
+"
+SRCREV = "9fbd2b79450e930edb95e8158d412e57a7b27e83"
+inherit autotools pkgconfig update-alternatives ptest
+export ac_cv_sys_file_offset_bits = "64"
+EXTRA_OECONF = "--program-prefix= --program-suffix=.im7 --without-perl --enable-largefile"
+PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'x11', d)} cxx webp xml"
+PACKAGECONFIG[cxx] = "--with-magick-plus-plus,--without-magick-plus-plus"
+PACKAGECONFIG[graphviz] = "--with-gvc,--without-gvc,graphviz"
+PACKAGECONFIG[heic] = "--with-heic,--without-heic,libheif"
+PACKAGECONFIG[jxl] = "--with-jxl,--without-jxl,libjxl"
+PACKAGECONFIG[lzma] = "--with-lzma,--without-lzma,xz"
+PACKAGECONFIG[openjpeg] = "--with-openjp2,--without-openjp2,openjpeg"
+PACKAGECONFIG[pango] = "--with-pango,--without-pango,pango cairo"
+PACKAGECONFIG[raw] = "--with-raw,--without-raw,libraw"
+PACKAGECONFIG[rsvg] = "--with-rsvg,--without-rsvg,librsvg"
+PACKAGECONFIG[tcmalloc] = "--with-tcmalloc=yes,--with-tcmalloc=no,gperftools"
+PACKAGECONFIG[webp] = "--with-webp,--without-webp,libwebp"
+PACKAGECONFIG[wmf] = "--with-wmf,--without-wmf,libwmf"
+PACKAGECONFIG[x11] = "--with-x,--without-x,virtual/libx11 libxext libxt"
+PACKAGECONFIG[xml] = "--with-xml,--without-xml,libxml2"
+do_install:append:class-target() {
+    for file in MagickCore-config.im7 MagickWand-config.im7; do
+        sed -i 's,${STAGING_DIR_TARGET},,g' "${D}${bindir}/$file"
+    done
+    if ${@bb.utils.contains('PACKAGECONFIG', 'cxx', 'true', 'false', d)}; then
+        sed -i 's,${STAGING_DIR_TARGET},,g' "${D}${bindir}/Magick++-config.im7"
+    fi
+    if ${@bb.utils.contains('PACKAGECONFIG', 'xml', 'true', 'false', d)}; then
+        xml_config="${D}${libdir}/ImageMagick-${BASE_PV}/config-Q16HDRI/configure.xml"
+        sed -i 's,${S},,g' "$xml_config"
+        sed -i 's,${B},,g' "$xml_config"
+        sed -i 's,${RECIPE_SYSROOT},,g' "$xml_config"
+    fi
+    if ${@bb.utils.contains_any('PACKAGECONFIG', 'webp openjpeg', 'true', 'false', d)}; then
+        sed -i 's,${HOSTTOOLS_DIR},${bindir},g' "${D}${sysconfdir}/ImageMagick-7/delegates.xml"
+    fi
+}
+do_install_ptest() {
+    install -d ${D}${PTEST_PATH}
+    install -m 0755 ${UNPACKDIR}/run-ptest ${D}${PTEST_PATH}/
+    install -m 0755 ${UNPACKDIR}/imagemagick-ptest.sh ${D}${PTEST_PATH}/
+}
+FILES:${PN} += "${libdir}/ImageMagick-${BASE_PV}/config-Q16* \
+                ${datadir}/ImageMagick-7"
+FILES:${PN}-dev += "${libdir}/ImageMagick-${BASE_PV}/modules-Q16/*/*.a"
+FILES:${PN}-dbg += "${libdir}/ImageMagick-${BASE_PV}/modules-Q16/*/.debug/*"
+BBCLASSEXTEND = "native nativesdk"
+ALTERNATIVE_PRIORITY = "100"
+ALTERNATIVE:${PN} = "animate compare composite conjure convert display \
+    identify import magick-script mogrify montage stream magick"
+ALTERNATIVE_TARGET[animate] = "${bindir}/animate.im7"
+ALTERNATIVE_TARGET[compare] = "${bindir}/compare.im7"
+ALTERNATIVE_TARGET[composite] = "${bindir}/composite.im7"
+ALTERNATIVE_TARGET[conjure] = "${bindir}/conjure.im7"
+ALTERNATIVE_TARGET[convert] = "${bindir}/convert.im7"
+ALTERNATIVE_TARGET[display] = "${bindir}/display.im7"
+ALTERNATIVE_TARGET[identify] = "${bindir}/identify.im7"
+ALTERNATIVE_TARGET[import] = "${bindir}/import.im7"
+ALTERNATIVE_TARGET[magick-script] = "${bindir}/magick-script.im7"
+ALTERNATIVE_TARGET[mogrify] = "${bindir}/mogrify.im7"
+ALTERNATIVE_TARGET[montage] = "${bindir}/montage.im7"
+ALTERNATIVE_TARGET[stream] = "${bindir}/stream.im7"
+ALTERNATIVE_TARGET[magick] = "${bindir}/magick.im7"
+ALTERNATIVE:${PN}-doc = "animate.1 compare.1 composite.1 conjure.1 \
+    convert.1 display.1 identify.1 import.1 magick-script.1 mogrify.1 montage.1 stream.1"
+ALTERNATIVE_LINK_NAME[animate.1] = "${mandir}/man1/animate.1"
+ALTERNATIVE_TARGET[animate.1] = "${mandir}/man1/animate.im7.1"
+ALTERNATIVE_LINK_NAME[compare.1] = "${mandir}/man1/compare.1"
+ALTERNATIVE_TARGET[compare.1] = "${mandir}/man1/compare.im7.1"
+ALTERNATIVE_LINK_NAME[composite.1] = "${mandir}/man1/composite.1"
+ALTERNATIVE_TARGET[composite.1] = "${mandir}/man1/composite.im7.1"
+ALTERNATIVE_LINK_NAME[conjure.1] = "${mandir}/man1/conjure.1"
+ALTERNATIVE_TARGET[conjure.1] = "${mandir}/man1/conjure.im7.1"
+ALTERNATIVE_LINK_NAME[convert.1] = "${mandir}/man1/convert.1"
+ALTERNATIVE_TARGET[convert.1] = "${mandir}/man1/convert.im7.1"
+ALTERNATIVE_LINK_NAME[display.1] = "${mandir}/man1/display.1"
+ALTERNATIVE_TARGET[display.1] = "${mandir}/man1/display.im7.1"
+ALTERNATIVE_LINK_NAME[identify.1] = "${mandir}/man1/identify.1"
+ALTERNATIVE_TARGET[identify.1] = "${mandir}/man1/identify.im7.1"
+ALTERNATIVE_LINK_NAME[import.1] = "${mandir}/man1/import.1"
+ALTERNATIVE_TARGET[import.1] = "${mandir}/man1/import.im7.1"
+ALTERNATIVE_LINK_NAME[magick-script.1] = "${mandir}/man1/magick-script.1"
+ALTERNATIVE_TARGET[magick-script.1] = "${mandir}/man1/magick-script.im7.1"
+ALTERNATIVE_LINK_NAME[mogrify.1] = "${mandir}/man1/mogrify.1"
+ALTERNATIVE_TARGET[mogrify.1] = "${mandir}/man1/mogrify.im7.1"
+ALTERNATIVE_LINK_NAME[montage.1] = "${mandir}/man1/montage.1"
+ALTERNATIVE_TARGET[montage.1] = "${mandir}/man1/montage.im7.1"
+ALTERNATIVE_LINK_NAME[stream.1] = "${mandir}/man1/stream.1"
+ALTERNATIVE_TARGET[stream.1] = "${mandir}/man1/stream.im7.1"
+ALTERNATIVE_LINK_NAME[magick] = "${bindir}/magick"
+CVE_STATUS[CVE-2014-9826] = "fixed-version: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
+CVE_STATUS[CVE-2016-7538] = "fixed-version: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 6.9.4-0"
+CVE_STATUS[CVE-2017-5506] = "fixed-version: The current version (7.1.1) is not affected by the CVE which affects versions at least earlier than 7.0.4-4"
diff --git a/meta-oe/recipes-support/jsoncons/jsoncons_1.5.0.bb b/meta-oe/recipes-support/jsoncons/jsoncons_1.6.0.bb
index 1321f824ee..64860c06dd 100644
--- a/meta-oe/recipes-support/jsoncons/jsoncons_1.5.0.bb
+++ b/meta-oe/recipes-support/jsoncons/jsoncons_1.6.0.bb
@@ -5,7 +5,7 @@ LICENSE = "BSL-1.0"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=6ee7f7ed2001e4cde4679fdb8926f820"
 SRC_URI = "git://github.com/danielaparker/jsoncons.git;protocol=https;branch=master;tag=v${PV}"
-SRCREV = "95a220dff2d927f15e1fe0c7dac2821b7134e4c9"
+SRCREV = "128553c8d1b222c30819656d123590accb60689d"
 inherit cmake
diff --git a/meta-oe/recipes-support/lcms/lcms/CVE-2026-41254_1.patch b/meta-oe/recipes-support/lcms/lcms/CVE-2026-41254_1.patch
new file mode 100644
index 0000000000..2ed8e9f587
--- /dev/null
+++ b/meta-oe/recipes-support/lcms/lcms/CVE-2026-41254_1.patch
@@ -0,0 +1,28 @@
+From c83cfcd249d06950a307cee8d1e22b7f6a78a8a7 Mon Sep 17 00:00:00 2001
+From: Marti Maria <marti.maria@littlecms.com>
+Date: Thu, 19 Feb 2026 09:07:20 +0100
+Subject: [PATCH] Fix integer overflow in CubeSize()
+Thanks to @zerojackyi for reporting
+CVE: CVE-2026-41254
+Upstream-Status: Backport [https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/cmslut.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/src/cmslut.c b/src/cmslut.c
+index 1089148..b245209 100644
+--- a/src/cmslut.c
+++ b/src/cmslut.c
+@@ -460,7 +460,8 @@ void EvaluateCLUTfloatIn16(const cmsFloat32Number In[], cmsFloat32Number Out[],
+ static
+ cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b)
+ {
+-    cmsUInt32Number rv, dim;
+    cmsUInt32Number dim;
+    cmsUInt64Number rv;
+ 
+     _cmsAssert(Dims != NULL);
+ 
diff --git a/meta-oe/recipes-support/lcms/lcms/CVE-2026-41254_2.patch b/meta-oe/recipes-support/lcms/lcms/CVE-2026-41254_2.patch
new file mode 100644
index 0000000000..be8c759a6f
--- /dev/null
+++ b/meta-oe/recipes-support/lcms/lcms/CVE-2026-41254_2.patch
@@ -0,0 +1,34 @@
+From f5994aea02d5620f3182cafdcf116ffe9d6c9fd2 Mon Sep 17 00:00:00 2001
+From: Marti Maria <marti.maria@littlecms.com>
+Date: Thu, 12 Mar 2026 22:57:35 +0100
+Subject: [PATCH] check for overflow
+Thanks to Guanni Qu for detecting & reporting the issue
+CVE: CVE-2026-41254
+Upstream-Status: Backport [https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/cmslut.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/src/cmslut.c b/src/cmslut.c
+index b245209..c1dbb32 100644
+--- a/src/cmslut.c
+++ b/src/cmslut.c
+@@ -468,12 +468,12 @@ cmsUInt32Number CubeSize(const cmsUInt32Number Dims[], cmsUInt32Number b)
+     for (rv = 1; b > 0; b--) {
+ 
+         dim = Dims[b-1];
+-        if (dim <= 1) return 0;  // Error
+-
+-        rv *= dim;
+        if (dim <= 1) return 0;  
+ 
+         // Check for overflow
+         if (rv > UINT_MAX / dim) return 0;
+
+        rv *= dim;
+     }
+ 
+     // Again, prevent overflow
diff --git a/meta-oe/recipes-support/lcms/lcms_2.18.bb b/meta-oe/recipes-support/lcms/lcms_2.18.bb
index 79e4a6f694..1ff3b3908f 100644
--- a/meta-oe/recipes-support/lcms/lcms_2.18.bb
+++ b/meta-oe/recipes-support/lcms/lcms_2.18.bb
@@ -3,7 +3,10 @@ SECTION = "libs"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=e9ce323c4b71c943a785db90142b228a"
-SRC_URI = "${SOURCEFORGE_MIRROR}/lcms/lcms2-${PV}.tar.gz"
+SRC_URI = "${SOURCEFORGE_MIRROR}/lcms/lcms2-${PV}.tar.gz \
+           file://CVE-2026-41254_1.patch \
+           file://CVE-2026-41254_2.patch \
+           "
 SRC_URI[sha256sum] = "ee67be3566f459362c1ee094fde2c159d33fa0390aa4ed5f5af676f9e5004347"
 DEPENDS = "tiff"
diff --git a/meta-oe/recipes-support/libcanberra/libcanberra_0.30-19.bb b/meta-oe/recipes-support/libcanberra/libcanberra_0.30-20.bb
index 2c063fd995..2f10a10931 100644
--- a/meta-oe/recipes-support/libcanberra/libcanberra_0.30-19.bb
+++ b/meta-oe/recipes-support/libcanberra/libcanberra_0.30-20.bb
@@ -12,13 +12,14 @@ SRC_URI = " \
    git://salsa.debian.org/gnome-team/libcanberra;protocol=https;branch=debian/latest;tag=debian/${PV} \
    file://0001-Determine-audio-buffer-size-for-a-time-of-500ms.patch \
 "
-SRCREV = "d1ed1ac0c9950ed3908c04abb7c4a6de5c51ed94"
+SRCREV = "47d67f43c58af36143060888fc8e69a9cb0eddea"
 EXTRA_OECONF = "\
    --enable-null \
    --disable-oss \
    --disable-tdb \
    --disable-lynx \
+    --disable-gtk-doc \
 "
 PACKAGECONFIG ??= " \
diff --git a/meta-oe/recipes-support/libgpiod/libgpiod-2.x/0001-tools-tests-remove-SIGINT-test-cases.patch b/meta-oe/recipes-support/libgpiod/libgpiod-2.x/0001-tools-tests-remove-SIGINT-test-cases.patch
deleted file mode 100644
index 7fe06b9882..0000000000
--- a/meta-oe/recipes-support/libgpiod/libgpiod-2.x/0001-tools-tests-remove-SIGINT-test-cases.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 3c38c5f9ab49384039f35408656a88f87619dd03 Mon Sep 17 00:00:00 2001
-From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
-Date: Wed, 18 Mar 2026 14:07:06 +0100
-Subject: [libgpiod][PATCH] tools: tests: remove SIGINT test cases
-In coreutils v9.10 (specifically with commit 8c2461933411 ("timeout:
-honor ignored signal dispositions")) the behavior of timeout changed and
-it will no longer propagate SIGINT or SIGQUIT in shell background jobs.
-This breaks the test cases checking the behavior of tools after SIGINT.
-We have to assume that if exit after SIGTERM works, then so does it
-after SIGINT and remove the failing tests.
-Upstream-Status: Submitted [https://lore.kernel.org/all/20260318131413.56575-1-bartosz.golaszewski@oss.qualcomm.com/]
-Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
---
- tools/gpio-tools-test.bash | 37 -------------------------------------
- 1 file changed, 37 deletions(-)
-diff --git a/tools/gpio-tools-test.bash b/tools/gpio-tools-test.bash
-index 71d6e3d..62f6836 100755
--- a/tools/gpio-tools-test.bash
-+++ b/tools/gpio-tools-test.bash
-@@ -1415,17 +1415,6 @@ test_gpioset_with_lines_strictly_by_name() {
-        gpiosim_check_value sim0 6 0
- }
- 
-test_gpioset_interactive_after_SIGINT() {
-       gpiosim_chip sim0 num_lines=8 line_name=1:foo
-
-       dut_run gpioset -i foo=1
-
-       dut_kill -SIGINT
-       dut_wait
-
-       status_is 130
-}
-
- test_gpioset_interactive_after_SIGTERM() {
-        gpiosim_chip sim0 num_lines=8 line_name=1:foo
- 
-@@ -1907,20 +1896,6 @@ test_gpiomon_multiple_lines_across_multiple_chips() {
-        assert_fail dut_readable
- }
- 
-test_gpiomon_exit_after_SIGINT() {
-       gpiosim_chip sim0 num_lines=8
-
-       local sim0=${GPIOSIM_CHIP_NAME[sim0]}
-
-       dut_run gpiomon --banner --chip "$sim0" 4
-       dut_regex_match "Monitoring line .*"
-
-       dut_kill -SIGINT
-       dut_wait
-
-       status_is 130
-}
-
- test_gpiomon_exit_after_SIGTERM() {
-        gpiosim_chip sim0 num_lines=8
- 
-@@ -2503,18 +2478,6 @@ test_gpionotify_multiple_lines_across_multiple_chips() {
-        assert_fail dut_readable
- }
- 
-test_gpionotify_exit_after_SIGINT() {
-       gpiosim_chip sim0 num_lines=8
-
-       dut_run gpionotify --banner --chip "${GPIOSIM_CHIP_NAME[sim0]}" 4
-       dut_regex_match "Watching line .*"
-
-       dut_kill -SIGINT
-       dut_wait
-
-       status_is 130
-}
-
- test_gpionotify_exit_after_SIGTERM() {
-        gpiosim_chip sim0 num_lines=8
- 
-- 
-2.47.3
diff --git a/meta-oe/recipes-support/libgpiod/libgpiod_1.6.5.bb b/meta-oe/recipes-support/libgpiod/libgpiod_1.6.5.bb
index 009cf9897a..583648a6a3 100644
--- a/meta-oe/recipes-support/libgpiod/libgpiod_1.6.5.bb
+++ b/meta-oe/recipes-support/libgpiod/libgpiod_1.6.5.bb
@@ -10,6 +10,7 @@ SRC_URI[sha256sum] = "ae280f697bf035a1fb780c9972e5c81d0d2712b7ab6124fb3fba24619d
 FILESEXTRAPATHS:prepend := "${THISDIR}/${BPN}-1.x:"
 inherit python3native
+inherit_defer ${@bb.utils.contains('PACKAGECONFIG', 'python3', 'python3targetconfig', '', d)}
 PACKAGECONFIG[tests] = "--enable-tests,--disable-tests,kmod udev glib-2.0 catch2"
 PACKAGECONFIG[python3] = "--enable-bindings-python,--disable-bindings-python,python3"
diff --git a/meta-oe/recipes-support/libgpiod/libgpiod_2.2.3.bb b/meta-oe/recipes-support/libgpiod/libgpiod_2.2.4.bb
index 38829a620f..2c8d9f1873 100644
--- a/meta-oe/recipes-support/libgpiod/libgpiod_2.2.3.bb
+++ b/meta-oe/recipes-support/libgpiod/libgpiod_2.2.4.bb
@@ -13,10 +13,9 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/${BPN}-2.x:"
 SRC_URI += " \
    file://gpio-manager.init \
-    file://0001-tools-tests-remove-SIGINT-test-cases.patch \
 "
-SRC_URI[sha256sum] = "70012b0262e4b90f140431efa841ca89643b02ea6c09f507e23cec664a51b71a"
+SRC_URI[sha256sum] = "13207176b0eb9b3e0f02552d5f49f5a6a449343ce47416158bb484d9d3019592"
 # Enable all project features for ptest
 PACKAGECONFIG[tests] = " \
diff --git a/meta-oe/recipes-support/libgusb/libgusb_0.4.9.bb b/meta-oe/recipes-support/libgusb/libgusb_0.4.9.bb
index 9007574fc6..25750247f8 100644
--- a/meta-oe/recipes-support/libgusb/libgusb_0.4.9.bb
+++ b/meta-oe/recipes-support/libgusb/libgusb_0.4.9.bb
@@ -10,7 +10,7 @@ inherit meson gobject-introspection gi-docgen gettext vala pkgconfig
 PACKAGECONFIG:class-target ??= "${@bb.utils.contains('GI_DATA_ENABLED', 'True', 'vapi', '', d)}"
 PACKAGECONFIG[vapi] = "-Dvapi=true,-Dvapi=false"
-EXTRA_OEMESON:class-native += "-Dtests=false  -Dintrospection=false"
+EXTRA_OEMESON:class-native = "-Dtests=false  -Dintrospection=false"
 GIDOCGEN_MESON_OPTION = 'docs'
diff --git a/meta-oe/recipes-support/libharu/libharu_2.4.5.bb b/meta-oe/recipes-support/libharu/libharu_2.4.6.bb
index 0ad4bd92c0..714cccbc3c 100644
--- a/meta-oe/recipes-support/libharu/libharu_2.4.5.bb
+++ b/meta-oe/recipes-support/libharu/libharu_2.4.6.bb
@@ -8,8 +8,8 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=924546dab2bef90e370d7c0c090ddcf0"
 DEPENDS += "libpng zlib"
-SRC_URI = "git://github.com/libharu/libharu.git;branch=master;protocol=https"
+SRC_URI = "git://github.com/libharu/libharu.git;branch=master;protocol=https;tag=v${PV}"
-SRCREV = "8fe5a738541a04642885fb7a75b2b5b9c5b416fa"
+SRCREV = "3467749fd1c0ab6ca6ed424d053b1ea53c1bf67c"
 inherit cmake
diff --git a/meta-oe/recipes-support/liboauth2/liboauth2/0001-build-guard-coverage-linker-flag-behind-CODE_COVERAG.patch b/meta-oe/recipes-support/liboauth2/liboauth2/0001-build-guard-coverage-linker-flag-behind-CODE_COVERAG.patch
new file mode 100644
index 0000000000..f234cbd50b
--- /dev/null
+++ b/meta-oe/recipes-support/liboauth2/liboauth2/0001-build-guard-coverage-linker-flag-behind-CODE_COVERAG.patch
@@ -0,0 +1,33 @@
+From 7c70315f7f6b4305d761804fb03f8f90ad7572eb Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Fri, 17 Apr 2026 14:01:46 -0700
+Subject: [PATCH] build: guard --coverage linker flag behind
+ CODE_COVERAGE_ENABLED
+AM_LDFLAGS passes --coverage to the linker unconditionally,
+it causes coverage instrumentation to be enabled even when
+configured with --disable-code-coverage. Wrap it in the
+automake conditional provided by AX_CODE_COVERAGE.
+Upstream-Status: Submitted [https://github.com/OpenIDC/liboauth2/pull/74]
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ Makefile.am | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+diff --git a/Makefile.am b/Makefile.am
+index a079dcc..a3f991d 100644
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -8,7 +8,10 @@ EXTRA_DIST = autogen.sh ChangeLog README.md LICENSE
+ AM_CPPFLAGS = -Wall -Werror -Wno-error=deprecated-declarations -I${srcdir}/include -I${srcdir}/src @JANSSON_CFLAGS@ @OPENSSL_CFLAGS@
+ AM_CPPFLAGS += $(CODE_COVERAGE_CPPFLAGS) $(CODE_COVERAGE_CFLAGS)
+-AM_LDFLAGS = --coverage
+AM_LDFLAGS =
+if CODE_COVERAGE_ENABLED
+AM_LDFLAGS += --coverage
+endif
+ LDADD = @JANSSON_LIBS@ @OPENSSL_LIBS@
+ LDADD += $(CODE_COVERAGE_LIBS)
diff --git a/meta-oe/recipes-support/liboauth2/liboauth2_2.2.0.bb b/meta-oe/recipes-support/liboauth2/liboauth2_2.2.0.bb
index 5b1ecd23dd..83825c69a5 100644
--- a/meta-oe/recipes-support/liboauth2/liboauth2_2.2.0.bb
+++ b/meta-oe/recipes-support/liboauth2/liboauth2_2.2.0.bb
@@ -7,6 +7,7 @@ SRC_URI = " \
    git://github.com/OpenIDC/liboauth2;protocol=https;branch=master;tag=v${PV} \
    file://0001-fix-clang-curl_easy_setopt-takes-a-long-not-an-int.patch \
    file://0002-Fix-use-of-strchr-with-new-GCC.patch \
+    file://0001-build-guard-coverage-linker-flag-behind-CODE_COVERAG.patch \
    "
 SRCREV = "12571b6d6568c2db7d5f080f60ecb55795c0db19"
@@ -20,4 +21,4 @@ PACKAGECONFIG[memcache] = "--with-memcache,--without-memcache,libmemcached"
 PACKAGECONFIG[redis] = "--with-redis,--without-redis,hiredis"
 PACKAGECONFIG[jq] = "--with-jq,--without-jq,jq"
 PACKAGECONFIG[apache] = "--with-apache,--without-apache,apache2"
+PACKAGECONFIG[ccov] = "--enable-code-coverage,--disable-code-coverage,"
diff --git a/meta-oe/recipes-support/libraw/libraw_0.21.4.bb b/meta-oe/recipes-support/libraw/libraw_0.21.4.bb
deleted file mode 100644
index ef0a0255d9..0000000000
--- a/meta-oe/recipes-support/libraw/libraw_0.21.4.bb
+++ /dev/null
@@ -1,10 +0,0 @@
-SUMMARY = "raw image decoder"
-LICENSE = "LGPL-2.1-only | CDDL-1.0"
-LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=1501ae0aa3c8544e63f08d6f7bf88a6f"
-SRC_URI = "git://github.com/LibRaw/LibRaw.git;branch=0.21-stable;protocol=https;tag=${PV}"
-SRCREV = "9646d776c7c61976080a8f2be67928df0750493e"
-inherit autotools pkgconfig
-DEPENDS = "jpeg jasper lcms"
diff --git a/meta-oe/recipes-support/libraw/libraw_0.22.1.bb b/meta-oe/recipes-support/libraw/libraw_0.22.1.bb
new file mode 100644
index 0000000000..e99f0e46b6
--- /dev/null
+++ b/meta-oe/recipes-support/libraw/libraw_0.22.1.bb
@@ -0,0 +1,17 @@
+SUMMARY = "raw image decoder"
+LICENSE = "LGPL-2.1-only | CDDL-1.0"
+LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=1d66195044cfbe4327c055d1c9c1a229"
+SRC_URI = "git://github.com/LibRaw/LibRaw.git;branch=0.22-stable;protocol=https;tag=${PV}"
+SRCREV = "b860248a89d9082b8e0a1e202e516f46af9adb29"
+inherit autotools pkgconfig
+DEPENDS = "jpeg jasper lcms"
+CVE_STATUS[CVE-2026-5318] = "fixed-version: fixed since 0.22.1"
+CVE_STATUS[CVE-2026-5342] = "fixed-version: fixed since 0.22.1"
+CVE_STATUS[CVE-2026-20884] = "fixed-version: fixed since 0.22.1"
+CVE_STATUS[CVE-2026-24450] = "fixed-version: fixed since 0.22.1"
+CVE_STATUS[CVE-2026-20911] = "fixed-version: fixed since 0.22.1"
+CVE_STATUS[CVE-2026-21413] = "fixed-version: fixed since 0.22.1"
diff --git a/meta-oe/recipes-support/libsmi/libsmi_0.5.0.bb b/meta-oe/recipes-support/libsmi/libsmi_0.5.0.bb
index 85eac33369..99d0939b34 100644
--- a/meta-oe/recipes-support/libsmi/libsmi_0.5.0.bb
+++ b/meta-oe/recipes-support/libsmi/libsmi_0.5.0.bb
@@ -20,6 +20,9 @@ UPSTREAM_CHECK_REGEX = "${BPN}-(?P<pver>\d+(\.\d+)+)"
 DEPENDS += "bison-native flex-native wget-native gawk-native"
 inherit autotools-brokensep update-alternatives
+CACHED_CONFIGUREVARS += "ac_cv_prog_cc_c23=no"
 ALTERNATIVE_PRIORITY = "50"
 ALTERNATIVE:${PN}-yang = " ietf-interfaces ietf-netconf-acm ietf-netconf-with-defaults ietf-netconf"
 ALTERNATIVE_LINK_NAME[ietf-interfaces] = "${datadir}/yang/ietf-interfaces.yang"
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-14523.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-14523.patch
new file mode 100644
index 0000000000..7815dba55a
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-14523.patch
@@ -0,0 +1,52 @@
+From d6028a6e6a8417b7fb6c89f6c10fb94781435ee6 Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Wed, 4 Feb 2026 15:08:50 +0800
+Subject: [PATCH] Reject duplicate Host headers (for libsoup 2)
+This is a simplified version of my patch for libsoup 3:
+!491
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/d3db5a6f8f03e1f0133754872877c92c0284c472]
+CVE: CVE-2025-14523
+This patch is a MR for branch 2-74, but not merged yet, maybe it will
+not be merged.
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-headers.c         | 3 +++
+ libsoup/soup-message-headers.c | 3 +++
+ 2 files changed, 6 insertions(+)
+diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
+index ea2f986..6cd3dad 100644
+--- a/libsoup/soup-headers.c
+++ b/libsoup/soup-headers.c
+@@ -138,6 +138,9 @@ soup_headers_parse (const char *str, int len, SoupMessageHeaders *dest)
+                for (p = strchr (value, '\r'); p; p = strchr (p, '\r'))
+                        *p = ' ';
+ 
+               if (g_ascii_strcasecmp (name, "Host") == 0 && soup_message_headers_get_one (dest, "Host"))
+                       goto done;
+
+                soup_message_headers_append (dest, name, value);
+         }
+        success = TRUE;
+diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
+index f612bff..bb20bbb 100644
+--- a/libsoup/soup-message-headers.c
+++ b/libsoup/soup-message-headers.c
+@@ -220,6 +220,9 @@ soup_message_headers_append (SoupMessageHeaders *hdrs,
+        }
+ #endif
+ 
+       if (g_ascii_strcasecmp (name, "Host") == 0 && soup_message_headers_get_one (hdrs, "Host"))
+               return;
+
+        header.name = intern_header_name (name, &setter);
+        header.value = g_strdup (value);
+        g_array_append_val (hdrs->array, header);
+-- 
+2.34.1
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-1.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-1.patch
new file mode 100644
index 0000000000..64e87cb1ec
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-1.patch
@@ -0,0 +1,229 @@
+From c574e659c41c18fad3973bbaa3b3ec75664b3137 Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Thu, 5 Feb 2026 16:20:02 +0800
+Subject: [PATCH 1/2] websocket: add a way to restrict the total message size
+Otherwise a client could send small packages smaller than
+total-incoming-payload-size but still to break the server
+with a big allocation
+Fixes: #390
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/db87805ab565d67533dfed2cb409dbfd63c7fdce]
+CVE: CVE-2025-32049
+libsoup2 is not maintained, the patch is backported from libsoup3, and
+change accordingly
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-websocket-connection.c | 104 ++++++++++++++++++++++++++--
+ libsoup/soup-websocket-connection.h |   7 ++
+ 2 files changed, 107 insertions(+), 4 deletions(-)
+diff --git a/libsoup/soup-websocket-connection.c b/libsoup/soup-websocket-connection.c
+index 9d5f4f8..3dad477 100644
+--- a/libsoup/soup-websocket-connection.c
+++ b/libsoup/soup-websocket-connection.c
+@@ -85,7 +85,8 @@ enum {
+        PROP_STATE,
+        PROP_MAX_INCOMING_PAYLOAD_SIZE,
+        PROP_KEEPALIVE_INTERVAL,
+-       PROP_EXTENSIONS
+       PROP_EXTENSIONS,
+       PROP_MAX_TOTAL_MESSAGE_SIZE,
+ };
+ 
+ enum {
+@@ -120,6 +121,7 @@ struct _SoupWebsocketConnectionPrivate {
+        char *origin;
+        char *protocol;
+        guint64 max_incoming_payload_size;
+       guint64 max_total_message_size;
+        guint keepalive_interval;
+ 
+        gushort peer_close_code;
+@@ -152,6 +154,7 @@ struct _SoupWebsocketConnectionPrivate {
+ };
+ 
+ #define MAX_INCOMING_PAYLOAD_SIZE_DEFAULT   128 * 1024
+#define MAX_TOTAL_MESSAGE_SIZE_DEFAULT   128 * 1024
+ #define READ_BUFFER_SIZE 1024
+ #define MASK_LENGTH 4
+ 
+@@ -664,7 +667,7 @@ bad_data_error_and_close (SoupWebsocketConnection *self)
+ }
+ 
+ static void
+-too_big_error_and_close (SoupWebsocketConnection *self,
+too_big_incoming_payload_error_and_close (SoupWebsocketConnection *self,
+                          guint64 payload_len)
+ {
+        GError *error;
+@@ -680,6 +683,23 @@ too_big_error_and_close (SoupWebsocketConnection *self,
+        emit_error_and_close (self, error, TRUE);
+ }
+ 
+static void
+too_big_message_error_and_close (SoupWebsocketConnection *self,
+                                 guint64 len)
+{
+       GError *error;
+
+       error = g_error_new_literal (SOUP_WEBSOCKET_ERROR,
+                                    SOUP_WEBSOCKET_CLOSE_TOO_BIG,
+                                    self->pv->connection_type == SOUP_WEBSOCKET_CONNECTION_SERVER ?
+                                    "Received WebSocket payload from the client larger than configured max-total-message-size" :
+                                    "Received WebSocket payload from the server larger than configured max-total-message-size");
+       g_debug ("%s received message of size %" G_GUINT64_FORMAT " or greater, but max supported size is %" G_GUINT64_FORMAT,
+                self->pv->connection_type == SOUP_WEBSOCKET_CONNECTION_SERVER ? "server" : "client",
+                len, self->pv->max_total_message_size);
+       emit_error_and_close (self, error, TRUE);
+}
+
+ static void
+ close_connection (SoupWebsocketConnection *self,
+                   gushort                  code,
+@@ -913,6 +933,12 @@ process_contents (SoupWebsocketConnection *self,
+                switch (pv->message_opcode) {
+                case 0x01:
+                case 0x02:
+                       /* Safety valve */
+                       if (pv->max_total_message_size > 0 &&
+                           (pv->message_data->len + payload_len) > pv->max_total_message_size) {
+                               too_big_message_error_and_close (self, (pv->message_data->len + payload_len));
+                               return;
+                       }
+                        g_byte_array_append (pv->message_data, payload, payload_len);
+                        break;
+                default:
+@@ -1050,7 +1076,7 @@ process_frame (SoupWebsocketConnection *self)
+        /* Safety valve */
+        if (self->pv->max_incoming_payload_size > 0 &&
+            payload_len >= self->pv->max_incoming_payload_size) {
+-               too_big_error_and_close (self, payload_len);
+               too_big_incoming_payload_error_and_close (self, payload_len);
+                return FALSE;
+        }
+ 
+@@ -1357,6 +1383,10 @@ soup_websocket_connection_get_property (GObject *object,
+                g_value_set_pointer (value, pv->extensions);
+                break;
+ 
+       case PROP_MAX_TOTAL_MESSAGE_SIZE:
+               g_value_set_uint64 (value, pv->max_total_message_size);
+               break;
+
+        default:
+                G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+                break;
+@@ -1410,6 +1440,10 @@ soup_websocket_connection_set_property (GObject *object,
+                pv->extensions = g_value_get_pointer (value);
+                break;
+ 
+       case PROP_MAX_TOTAL_MESSAGE_SIZE:
+               pv->max_total_message_size = g_value_get_uint64 (value);
+               break;
+
+        default:
+                G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+                break;
+@@ -1631,7 +1665,24 @@ soup_websocket_connection_class_init (SoupWebsocketConnectionClass *klass)
+                                                                G_PARAM_READWRITE |
+                                                                G_PARAM_CONSTRUCT_ONLY |
+                                                                G_PARAM_STATIC_STRINGS));
+-
+       /**
+        * SoupWebsocketConnection:max-total-message-size:
+        *
+        * The total message size for incoming packets.
+        *
+        * The protocol expects or 0 to not limit it.
+        *
+        */
+       g_object_class_install_property (gobject_class, PROP_MAX_TOTAL_MESSAGE_SIZE,
+                                       g_param_spec_uint64 ("max-total-message-size",
+                                                            "Max total message size",
+                                                            "Max total message size ",
+                                                            0,
+                                                            G_MAXUINT64,
+                                                            MAX_TOTAL_MESSAGE_SIZE_DEFAULT,
+                                                            G_PARAM_READWRITE |
+                                                            G_PARAM_CONSTRUCT |
+                                                            G_PARAM_STATIC_STRINGS));
+        /**
+         * SoupWebsocketConnection::message:
+         * @self: the WebSocket
+@@ -2145,6 +2196,51 @@ soup_websocket_connection_set_max_incoming_payload_size (SoupWebsocketConnection
+        }
+ }
+ 
+/**
+ * soup_websocket_connection_get_max_total_message_size:
+ * @self: the WebSocket
+ *
+ * Gets the maximum total message size allowed for packets.
+ *
+ * Returns: the maximum total message size.
+ *
+ */
+guint64
+soup_websocket_connection_get_max_total_message_size (SoupWebsocketConnection *self)
+{
+   SoupWebsocketConnectionPrivate *pv;
+
+   g_return_val_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self), MAX_TOTAL_MESSAGE_SIZE_DEFAULT);
+   pv = self->pv;
+
+   return pv->max_total_message_size;
+}
+
+/**
+ * soup_websocket_connection_set_max_total_message_size:
+ * @self: the WebSocket
+ * @max_total_message_size: the maximum total message size
+ *
+ * Sets the maximum total message size allowed for packets.
+ *
+ * It does not limit the outgoing packet size.
+ *
+ */
+void
+soup_websocket_connection_set_max_total_message_size (SoupWebsocketConnection *self,
+                                                      guint64                  max_total_message_size)
+{
+   SoupWebsocketConnectionPrivate *pv;
+
+   g_return_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self));
+   pv = self->pv;
+
+   if (pv->max_total_message_size != max_total_message_size) {
+       pv->max_total_message_size = max_total_message_size;
+       g_object_notify (G_OBJECT (self), "max-total-message-size");
+   }
+}
+
+ /**
+  * soup_websocket_connection_get_keepalive_interval:
+  * @self: the WebSocket
+diff --git a/libsoup/soup-websocket-connection.h b/libsoup/soup-websocket-connection.h
+index f82d723..d2a60e9 100644
+--- a/libsoup/soup-websocket-connection.h
+++ b/libsoup/soup-websocket-connection.h
+@@ -136,6 +136,13 @@ SOUP_AVAILABLE_IN_2_58
+ void                soup_websocket_connection_set_keepalive_interval (SoupWebsocketConnection *self,
+                                                                       guint                    interval);
+ 
+SOUP_AVAILABLE_IN_2_72
+guint64             soup_websocket_connection_get_max_total_message_size    (SoupWebsocketConnection *self);
+
+SOUP_AVAILABLE_IN_2_72
+void                soup_websocket_connection_set_max_total_message_size    (SoupWebsocketConnection *self,
+                                                                             guint64                  max_total_message_size);
+
+ G_END_DECLS
+ 
+ #endif /* __SOUP_WEBSOCKET_CONNECTION_H__ */
+-- 
+2.34.1
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-2.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-2.patch
new file mode 100644
index 0000000000..f9c894aaec
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2025-32049-2.patch
@@ -0,0 +1,131 @@
+From 0bfc66f1082f5d47df99b6fc03f742ef7fa1051e Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Thu, 5 Feb 2026 17:19:51 +0800
+Subject: [PATCH] Set message size limit in SoupServer rather than 
+ SoupWebsocketConnection
+We're not sure about the compatibility implications of having a default
+size limit for clients.
+Also not sure whether the server limit is actually set appropriately,
+but there is probably very little server usage of
+SoupWebsocketConnection in the wild, so it's not so likely to break
+things.
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/2df34d9544cabdbfdedd3b36f098cf69233b1df7]
+CVE: CVE-2025-32049
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-server.c               | 24 +++++++++++++++++++-----
+ libsoup/soup-websocket-connection.c | 23 ++++++++++++++++-------
+ 2 files changed, 35 insertions(+), 12 deletions(-)
+diff --git a/libsoup/soup-server.c b/libsoup/soup-server.c
+index 63875f3..a3f8597 100644
+--- a/libsoup/soup-server.c
+++ b/libsoup/soup-server.c
+@@ -216,6 +216,16 @@ enum {
+ 
+ G_DEFINE_TYPE_WITH_PRIVATE (SoupServer, soup_server, G_TYPE_OBJECT)
+ 
+/* SoupWebsocketConnection by default limits only maximum packet size. But a
+ * message may consist of multiple packets, so SoupServer additionally restricts
+ * total message size to mitigate denial of service attacks on the server.
+ * SoupWebsocketConnection does not do this by default because I don't know
+ * whether that would or would not cause compatibility problems for websites.
+ *
+ * This size is in bytes and it is arbitrary.
+ */
+#define MAX_TOTAL_MESSAGE_SIZE_DEFAULT   128 * 1024
+
+ static SoupClientContext *soup_client_context_ref (SoupClientContext *client);
+ static void soup_client_context_unref (SoupClientContext *client);
+ 
+@@ -1445,11 +1455,15 @@ complete_websocket_upgrade (SoupMessage *msg, gpointer user_data)
+ 
+        soup_client_context_ref (client);
+        stream = soup_client_context_steal_connection (client);
+-       conn = soup_websocket_connection_new_with_extensions (stream, uri,
+-                                                             SOUP_WEBSOCKET_CONNECTION_SERVER,
+-                                                             soup_message_headers_get_one (msg->request_headers, "Origin"),
+-                                                             soup_message_headers_get_one (msg->response_headers, "Sec-WebSocket-Protocol"),
+-                                                             handler->websocket_extensions);
+       conn = SOUP_WEBSOCKET_CONNECTION (g_object_new (SOUP_TYPE_WEBSOCKET_CONNECTION,
+                                                         "io-stream", stream,
+                                                         "uri", uri,
+                                                         "connection-type", SOUP_WEBSOCKET_CONNECTION_SERVER,
+                                                         "origin", soup_message_headers_get_one (msg->request_headers, "Origin"),
+                                                         "protocol", soup_message_headers_get_one (msg->response_headers, "Sec-WebSocket-Protocol"),
+                                                         "extensions", handler->websocket_extensions,
+                                                         "max-total-message-size", (guint64)MAX_TOTAL_MESSAGE_SIZE_DEFAULT,
+                                 NULL));
+        handler->websocket_extensions = NULL;
+        g_object_unref (stream);
+        soup_client_context_unref (client);
+diff --git a/libsoup/soup-websocket-connection.c b/libsoup/soup-websocket-connection.c
+index 3dad477..e7fa9b7 100644
+--- a/libsoup/soup-websocket-connection.c
+++ b/libsoup/soup-websocket-connection.c
+@@ -154,7 +154,6 @@ struct _SoupWebsocketConnectionPrivate {
+ };
+ 
+ #define MAX_INCOMING_PAYLOAD_SIZE_DEFAULT   128 * 1024
+-#define MAX_TOTAL_MESSAGE_SIZE_DEFAULT   128 * 1024
+ #define READ_BUFFER_SIZE 1024
+ #define MASK_LENGTH 4
+ 
+@@ -1615,8 +1614,9 @@ soup_websocket_connection_class_init (SoupWebsocketConnectionClass *klass)
+        /**
+         * SoupWebsocketConnection:max-incoming-payload-size:
+         *
+-        * The maximum payload size for incoming packets the protocol expects
+-        * or 0 to not limit it.
+        * The maximum payload size for incoming packets, or 0 to not limit it.
+        * Each message may consist of multiple packets, so also refer to
+        * [property@WebSocketConnection:max-total-message-size].
+         *
+         * Since: 2.56
+         */
+@@ -1668,9 +1668,18 @@ soup_websocket_connection_class_init (SoupWebsocketConnectionClass *klass)
+        /**
+         * SoupWebsocketConnection:max-total-message-size:
+         *
+-        * The total message size for incoming packets.
+        * The maximum size for incoming messages.
+        * Set to a value to limit the total message size, or 0 to not
+        * limit it.
+         *
+-        * The protocol expects or 0 to not limit it.
+        * [method@Server.add_websocket_handler] will set this to a nonzero
+        * default value to mitigate denial of service attacks. Clients must
+        * choose their own default if they need to mitigate denial of service
+        * attacks. You also need to set your own default if creating your own
+        * server SoupWebsocketConnection without using SoupServer.
+        *
+        * Each message may consist of multiple packets, so also refer to
+        *[property@WebSocketConnection:max-incoming-payload-size].
+         *
+         */
+        g_object_class_install_property (gobject_class, PROP_MAX_TOTAL_MESSAGE_SIZE,
+@@ -1679,7 +1688,7 @@ soup_websocket_connection_class_init (SoupWebsocketConnectionClass *klass)
+                                                             "Max total message size ",
+                                                             0,
+                                                             G_MAXUINT64,
+-                                                            MAX_TOTAL_MESSAGE_SIZE_DEFAULT,
+                                                            0,
+                                                             G_PARAM_READWRITE |
+                                                             G_PARAM_CONSTRUCT |
+                                                             G_PARAM_STATIC_STRINGS));
+@@ -2210,7 +2219,7 @@ soup_websocket_connection_get_max_total_message_size (SoupWebsocketConnection *s
+ {
+    SoupWebsocketConnectionPrivate *pv;
+ 
+-   g_return_val_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self), MAX_TOTAL_MESSAGE_SIZE_DEFAULT);
+   g_return_val_if_fail (SOUP_IS_WEBSOCKET_CONNECTION (self), 0);
+    pv = self->pv;
+ 
+    return pv->max_total_message_size;
+-- 
+2.34.1
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
new file mode 100644
index 0000000000..a1a130ee3a
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
@@ -0,0 +1,151 @@
+From b4f1dcb89a552fc03bfd0e65830b4f76fdc4a232 Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Tue, 21 Apr 2026 17:10:37 +0800
+Subject: [PATCH] Fix CVE-2026-1467
+CVE: CVE-2026-1467
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/6dfe506618d2d5856618e5c0f85bd93386dc8012]
+The original backport patch targets libsoup3. This patch has been
+adapted accordingly for libsoup2, refer the openSUSE patch, see [1]
+[1] https://www.suse.com/security/cve/CVE-2026-1467.html
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-auth.c    |  2 +-
+ libsoup/soup-message.c |  5 +++-
+ libsoup/soup-uri.c     | 60 ++++++++++++++++++++++++++++++++++++++++++
+ libsoup/soup-uri.h     |  2 ++
+ 4 files changed, 67 insertions(+), 2 deletions(-)
+diff --git a/libsoup/soup-auth.c b/libsoup/soup-auth.c
+index 1896aab..e205fe3 100644
+--- a/libsoup/soup-auth.c
+++ b/libsoup/soup-auth.c
+@@ -535,7 +535,7 @@ GSList *
+ soup_auth_get_protection_space (SoupAuth *auth, SoupURI *source_uri)
+ {
+        g_return_val_if_fail (SOUP_IS_AUTH (auth), NULL);
+-       g_return_val_if_fail (source_uri != NULL, NULL);
+       g_return_val_if_fail (soup_uri_is_valid (source_uri), NULL);
+ 
+        return SOUP_AUTH_GET_CLASS (auth)->get_protection_space (auth, source_uri);
+ }
+diff --git a/libsoup/soup-message.c b/libsoup/soup-message.c
+index da32b42..cc4f22b 100644
+--- a/libsoup/soup-message.c
+++ b/libsoup/soup-message.c
+@@ -1044,7 +1044,7 @@ soup_message_new (const char *method, const char *uri_string)
+        uri = soup_uri_new (uri_string);
+        if (!uri)
+                return NULL;
+-       if (!uri->host) {
+       if (!soup_uri_is_valid (uri)) {
+                soup_uri_free (uri);
+                return NULL;
+        }
+@@ -1066,6 +1066,8 @@ soup_message_new (const char *method, const char *uri_string)
+ SoupMessage *
+ soup_message_new_from_uri (const char *method, SoupURI *uri)
+ {
+       g_return_val_if_fail (soup_uri_is_valid (uri), NULL);
+
+        return g_object_new (SOUP_TYPE_MESSAGE,
+                             SOUP_MESSAGE_METHOD, method,
+                             SOUP_MESSAGE_URI, uri,
+@@ -1676,6 +1678,7 @@ soup_message_set_uri (SoupMessage *msg, SoupURI *uri)
+        SoupMessagePrivate *priv;
+ 
+        g_return_if_fail (SOUP_IS_MESSAGE (msg));
+       g_return_if_fail (soup_uri_is_valid (uri));
+        priv = soup_message_get_instance_private (msg);
+ 
+        if (priv->uri)
+diff --git a/libsoup/soup-uri.c b/libsoup/soup-uri.c
+index bdb7a17..d781ff1 100644
+--- a/libsoup/soup-uri.c
+++ b/libsoup/soup-uri.c
+@@ -1342,6 +1342,66 @@ soup_uri_host_equal (gconstpointer v1, gconstpointer v2)
+        return g_ascii_strcasecmp (one->host, two->host) == 0;
+ }
+ 
+static gboolean
+is_valid_character_for_host (char c)
+{
+        static const char forbidden_chars[] = { '\t', '\n', '\r', ' ', '#', '/', ':', '<', '>', '?', '@', '[', '\\', ']', '^', '|' };
+        int i;
+
+        for (i = 0; i < G_N_ELEMENTS (forbidden_chars); ++i) {
+                if (c == forbidden_chars[i])
+                        return FALSE;
+        }
+
+        return TRUE;
+}
+
+static gboolean
+is_host_valid (const char* host)
+{
+        int i;
+        gboolean is_valid;
+        char *ascii_host = NULL;
+
+        if (!host || !host[0])
+                return FALSE;
+
+        if (g_hostname_is_non_ascii (host)) {
+                ascii_host = g_hostname_to_ascii (host);
+                if (!ascii_host)
+                  return FALSE;
+
+                host = ascii_host;
+        }
+
+        if ((g_ascii_isdigit (host[0]) || strchr (host, ':')) && g_hostname_is_ip_address (host)) {
+                g_free (ascii_host);
+                return TRUE;
+        }
+        is_valid = TRUE;
+        for (i = 0; host[i] && is_valid; i++)
+                is_valid = is_valid_character_for_host (host[i]);
+
+        g_free (ascii_host);
+
+        return is_valid;
+}
+
+gboolean
+soup_uri_is_valid (SoupURI *uri)
+{
+        if (!uri)
+                return FALSE;
+
+        if (!is_host_valid (soup_uri_get_host (uri)))
+                return FALSE;
+
+        /* FIXME: validate other URI components? */
+
+        return TRUE;
+}
+
+
+ gboolean
+ soup_uri_is_http (SoupURI *uri, char **aliases)
+ {
+diff --git a/libsoup/soup-uri.h b/libsoup/soup-uri.h
+index 8015e4f..64099c3 100644
+--- a/libsoup/soup-uri.h
+++ b/libsoup/soup-uri.h
+@@ -133,6 +133,8 @@ guint       soup_uri_host_hash             (gconstpointer key);
+ SOUP_AVAILABLE_IN_2_28
+ gboolean    soup_uri_host_equal            (gconstpointer v1,
+                                            gconstpointer v2);
+SOUP_AVAILABLE_IN_2_68
+gboolean     soup_uri_is_valid             (SoupURI       *uri);
+ 
+ #define   SOUP_URI_IS_VALID(uri)       ((uri) && (uri)->scheme && (uri)->path)
+ #define   SOUP_URI_VALID_FOR_HTTP(uri) ((uri) && ((uri)->scheme == SOUP_URI_SCHEME_HTTP || (uri)->scheme == SOUP_URI_SCHEME_HTTPS) && (uri)->host && (uri)->path)
+-- 
+2.34.1
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1539.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1539.patch
new file mode 100644
index 0000000000..c6b813a98f
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1539.patch
@@ -0,0 +1,31 @@
+From 285faea567e1e2a95226201175dbf745a64a2439 Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Fri, 20 Mar 2026 15:04:22 +0800
+Subject: [PATCH 4/4] Also remove Proxy-Authorization header on cross origin
+ redirect
+Closes #489
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/98c1285d9d78662c38bf14b4a128af01ccfdb446]
+CVE: CVE-2026-1539
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-session.c | 1 +
+ 1 file changed, 1 insertion(+)
+diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c
+index cc0d04c..0361856 100644
+--- a/libsoup/soup-session.c
+++ b/libsoup/soup-session.c
+@@ -1190,6 +1190,7 @@ soup_session_redirect_message (SoupSession *session, SoupMessage *msg)
+        /* Strip all credentials on cross-origin redirect. */
+        if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) {
+                soup_message_headers_remove (msg->request_headers, "Authorization");
+               soup_message_headers_remove (msg->request_headers, "Proxy-Authorization");
+                soup_message_set_auth (msg, NULL);
+        }
+ 
+-- 
+2.34.1
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1760.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1760.patch
new file mode 100644
index 0000000000..a5547132a2
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1760.patch
@@ -0,0 +1,153 @@
+From 0fca37e0fce479284e62091ffb9b7d6caff1c7e4 Mon Sep 17 00:00:00 2001
+From: Carlos Garcia Campos <cgarcia@igalia.com>
+Date: Thu, 29 Jan 2026 16:43:28 +0100
+Subject: [PATCH] server: close the connection after responsing a request
+ containing Content-Length and Transfer-Encoding
+Closes #475
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/6224df5a471e9040a99dd3dc2e91817a701b1bf6]
+CVE: CVE-2026-1760
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-message-headers.c   | 86 +++++++++++++++-----------------
+ libsoup/soup-message-server-io.c |  8 +++
+ 2 files changed, 49 insertions(+), 45 deletions(-)
+diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
+index 535cf14..06d9600 100644
+--- a/libsoup/soup-message-headers.c
+++ b/libsoup/soup-message-headers.c
+@@ -666,38 +666,13 @@ clear_special_headers (SoupMessageHeaders *hdrs)
+ static void
+ transfer_encoding_setter (SoupMessageHeaders *hdrs, const char *value)
+ {
+-       if (value) {
+-               /* "identity" is a wrong value according to RFC errata 408,
+-                * and RFC 7230 does not list it as valid transfer-coding.
+-                * Nevertheless, the obsolete RFC 2616 stated "identity"
+-                * as valid, so we can't handle it as unrecognized here
+-                * for compatibility reasons.
+-                */
+-               if (g_ascii_strcasecmp (value, "chunked") == 0)
+-                       hdrs->encoding = SOUP_ENCODING_CHUNKED;
+-               else if (g_ascii_strcasecmp (value, "identity") != 0)
+-                       hdrs->encoding = SOUP_ENCODING_UNRECOGNIZED;
+-       } else
+-               hdrs->encoding = -1;
+       hdrs->encoding = -1;
+ }
+ 
+ static void
+ content_length_setter (SoupMessageHeaders *hdrs, const char *value)
+ {
+-       /* Transfer-Encoding trumps Content-Length */
+-       if (hdrs->encoding == SOUP_ENCODING_CHUNKED)
+-               return;
+-
+-       if (value) {
+-               char *end;
+-
+-               hdrs->content_length = g_ascii_strtoull (value, &end, 10);
+-               if (*end)
+-                       hdrs->encoding = SOUP_ENCODING_UNRECOGNIZED;
+-               else
+-                       hdrs->encoding = SOUP_ENCODING_CONTENT_LENGTH;
+-       } else
+-               hdrs->encoding = -1;
+       hdrs->encoding = -1;
+ }
+ 
+ /**
+@@ -730,29 +705,50 @@ SoupEncoding
+ soup_message_headers_get_encoding (SoupMessageHeaders *hdrs)
+ {
+        const char *header;
+       const char *content_length;
+       const char *transfer_encoding;
+ 
+        if (hdrs->encoding != -1)
+                return hdrs->encoding;
+ 
+-       /* If Transfer-Encoding was set, hdrs->encoding would already
+-        * be set. So we don't need to check that possibility.
+-        */
+-       header = soup_message_headers_get_one (hdrs, "Content-Length");
+-       if (header) {
+-               content_length_setter (hdrs, header);
+-               if (hdrs->encoding != -1)
+-                       return hdrs->encoding;
+-       }
+                       /* Transfer-Encoding is checked first because it overrides the Content-Length */
+                       transfer_encoding = soup_message_headers_get_one (hdrs, "Transfer-Encoding");
+                       if (transfer_encoding) {
+                                       /* "identity" is a wrong value according to RFC errata 408,
+                                        * and RFC 7230 does not list it as valid transfer-coding.
+                                        * Nevertheless, the obsolete RFC 2616 stated "identity"
+                                        * as valid, so we can't handle it as unrecognized here
+                                        * for compatibility reasons.
+                                        */
+                                       if (g_ascii_strcasecmp (transfer_encoding, "chunked") == 0)
+                                                       hdrs->encoding = SOUP_ENCODING_CHUNKED;
+                                       else if (g_ascii_strcasecmp (transfer_encoding, "identity") != 0)
+                                                       hdrs->encoding = SOUP_ENCODING_UNRECOGNIZED;
+                       } else {
+                                       content_length = soup_message_headers_get_one (hdrs, "Content-Length");
+                                       if (content_length) {
+                                                       char *end;
+
+                                                       hdrs->content_length = g_ascii_strtoull (content_length, &end, 10);
+                                                       if (*end)
+                                                                       hdrs->encoding = SOUP_ENCODING_UNRECOGNIZED;
+                                                       else
+                                                                       hdrs->encoding = SOUP_ENCODING_CONTENT_LENGTH;
+                                       }
+                       }
+
+                       if (hdrs->encoding == -1) {
+                                       /* Per RFC 2616 4.4, a response body that doesn't indicate its
+                                        * encoding otherwise is terminated by connection close, and a
+                                        * request that doesn't indicate otherwise has no body. Note
+                                        * that SoupMessage calls soup_message_headers_set_encoding()
+                                        * to override the response body default for our own
+                                        * server-side messages.
+                                        */
+                                       hdrs->encoding = (hdrs->type == SOUP_MESSAGE_HEADERS_RESPONSE) ?
+                                                       SOUP_ENCODING_EOF : SOUP_ENCODING_NONE;
+                       }
+ 
+-       /* Per RFC 2616 4.4, a response body that doesn't indicate its
+-        * encoding otherwise is terminated by connection close, and a
+-        * request that doesn't indicate otherwise has no body. Note
+-        * that SoupMessage calls soup_message_headers_set_encoding()
+-        * to override the response body default for our own
+-        * server-side messages.
+-        */
+-       hdrs->encoding = (hdrs->type == SOUP_MESSAGE_HEADERS_RESPONSE) ?
+-               SOUP_ENCODING_EOF : SOUP_ENCODING_NONE;
+        return hdrs->encoding;
+ }
+ 
+diff --git a/libsoup/soup-message-server-io.c b/libsoup/soup-message-server-io.c
+index 71e943b..df5eafc 100644
+--- a/libsoup/soup-message-server-io.c
+++ b/libsoup/soup-message-server-io.c
+@@ -80,6 +80,14 @@ parse_request_headers (SoupMessage *msg, char *headers, guint headers_len,
+                        return SOUP_STATUS_BAD_REQUEST;
+        }
+ 
+       /* A server MAY reject a request that contains both Content-Length and
+        * Transfer-Encoding or process such a request in accordance with the
+        * Transfer-Encoding alone. Regardless, the server MUST close the connection
+        * after responding to such a request to avoid the potential attacks
+        */
+       if (*encoding == SOUP_ENCODING_CHUNKED && soup_message_headers_get_one (msg->request_headers, "Content-Length"))
+                       soup_message_headers_replace (msg->request_headers, "Connection", "close");
+
+        /* Generate correct context for request */
+        req_host = soup_message_headers_get_one (msg->request_headers, "Host");
+        if (req_host && strchr (req_host, '/')) {
+-- 
+2.34.1
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1761.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1761.patch
new file mode 100644
index 0000000000..573e3e1dd0
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1761.patch
@@ -0,0 +1,36 @@
+From 07757b7feacfc660c6c463ff2b773c13bc42d2c9 Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Thu, 19 Mar 2026 17:21:32 +0800
+Subject: [PATCH 3/4] multipart: check length of bytes read
+ soup_filter_input_stream_read_until()
+We do make sure the read length is smaller than the buffer length when
+the boundary is not found, but we should do the same when the boundary
+is found.
+Spotted in #YWH-PGM9867-149
+Closes #493
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/cfa9d90d1a5c274233554a264c56551c13d6a6f0]
+CVE: CVE-2026-1761
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-filter-input-stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/libsoup/soup-filter-input-stream.c b/libsoup/soup-filter-input-stream.c
+index 2c30bf9..c34510b 100644
+--- a/libsoup/soup-filter-input-stream.c
+++ b/libsoup/soup-filter-input-stream.c
+@@ -272,6 +272,6 @@ soup_filter_input_stream_read_until (SoupFilterInputStream  *fstream,
+        if (eof && !*got_boundary)
+                read_length = MIN (fstream->priv->buf->len, length);
+        else
+-               read_length = p - buf;
+               read_length = MIN ((gsize)(p - buf), length);
+        return read_from_buf (fstream, buffer, read_length);
+ }
+-- 
+2.34.1
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch
new file mode 100644
index 0000000000..5f445f7354
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-1801.patch
@@ -0,0 +1,126 @@
+From f9c933e258e9ef2f221cca6395f8092a1c4b93dd Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Thu, 19 Mar 2026 17:10:36 +0800
+Subject: [PATCH 2/4] Fix CVE-2026-1801
+This patch merges 3 upstream patches
+Chery-pick the first two patches to make the context is the same as the
+third patch that fix CVE-2026-1801
+Upstream-Status: Backport
+[https://gitlab.gnome.org/GNOME/libsoup/-/commit/1e32b5e123aa1689505472bdbfcbd897eac41977,
+https://gitlab.gnome.org/GNOME/libsoup/-/commit/8a2e15c88512ae4517d2c2c887d39299725b22da,
+https://gitlab.gnome.org/GNOME/libsoup/-/commit/b9a1c0663ff8ab6e79715db4b35b54f560416ddd]
+CVE: CVE-2026-1801
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-body-input-stream.c | 66 ++++++++++++++++++++------------
+ 1 file changed, 41 insertions(+), 25 deletions(-)
+diff --git a/libsoup/soup-body-input-stream.c b/libsoup/soup-body-input-stream.c
+index 6b95884..25d9312 100644
+--- a/libsoup/soup-body-input-stream.c
+++ b/libsoup/soup-body-input-stream.c
+@@ -159,15 +159,18 @@ soup_body_input_stream_read_chunked (SoupBodyInputStream  *bistream,
+ again:
+        switch (bistream->priv->chunked_state) {
+        case SOUP_BODY_INPUT_STREAM_STATE_CHUNK_SIZE:
+-               nread = soup_filter_input_stream_read_line (
+-                       fstream, metabuf, sizeof (metabuf), blocking,
+-                       &got_line, cancellable, error);
+-               if (nread <= 0)
+               nread = soup_filter_input_stream_read_until (
+                               fstream, metabuf, sizeof (metabuf),
+                               "\r\n", 2, blocking, TRUE,
+                               &got_line, cancellable, error);
+               if (nread < 0)
+                        return nread;
+-               if (!got_line) {
+-                       g_set_error_literal (error, G_IO_ERROR,
+-                                            G_IO_ERROR_PARTIAL_INPUT,
+-                                            _("Connection terminated unexpectedly"));
+               if (nread == 0 || !got_line) {
+                       if (error && *error == NULL) {
+                               g_set_error_literal (error, G_IO_ERROR,
+                                                                       G_IO_ERROR_PARTIAL_INPUT,
+                                                                       ("Connection terminated unexpectedly"));
+                       }
+                        return -1;
+                }
+ 
+@@ -180,9 +183,9 @@ again:
+ 
+        case SOUP_BODY_INPUT_STREAM_STATE_CHUNK:
+                nread = soup_body_input_stream_read_raw (
+-                       bistream, buffer,
+-                       MIN (count, bistream->priv->read_length),
+-                       blocking, cancellable, error);
+                               bistream, buffer,
+                               MIN (count, bistream->priv->read_length),
+                               blocking, cancellable, error);
+                if (nread > 0) {
+                        bistream->priv->read_length -= nread;
+                        if (bistream->priv->read_length == 0)
+@@ -191,16 +194,19 @@ again:
+                return nread;
+ 
+        case SOUP_BODY_INPUT_STREAM_STATE_CHUNK_END:
+-               nread = soup_filter_input_stream_read_line (
+-                       SOUP_FILTER_INPUT_STREAM (bistream->priv->base_stream),
+-                       metabuf, sizeof (metabuf), blocking,
+-                       &got_line, cancellable, error);
+-               if (nread <= 0)
+               nread = soup_filter_input_stream_read_until (
+                               SOUP_FILTER_INPUT_STREAM (bistream->priv->base_stream),
+                               metabuf, sizeof (metabuf),
+                               "\r\n", 2, blocking, TRUE,
+                               &got_line, cancellable, error);
+               if (nread < 0)
+                        return nread;
+-               if (!got_line) {
+-                       g_set_error_literal (error, G_IO_ERROR,
+-                                            G_IO_ERROR_PARTIAL_INPUT,
+-                                            _("Connection terminated unexpectedly"));
+               if (nread == 0 || !got_line) {
+                       if (error && *error == NULL) {
+                               g_set_error_literal (error, G_IO_ERROR,
+                               G_IO_ERROR_PARTIAL_INPUT,
+                               _("Connection terminated unexpectedly"));
+                       }
+                        return -1;
+                }
+ 
+@@ -208,13 +214,23 @@ again:
+                break;
+ 
+        case SOUP_BODY_INPUT_STREAM_STATE_TRAILERS:
+-               nread = soup_filter_input_stream_read_line (
+-                       fstream, buffer, count, blocking,
+-                       &got_line, cancellable, error);
+-               if (nread <= 0)
+               nread = soup_filter_input_stream_read_until (
+                               fstream, metabuf, sizeof (metabuf),
+                               "\r\n", 2, blocking, TRUE,
+                               &got_line, cancellable, error);
+               if (nread < 0)
+                        return nread;
+ 
+-               if (strncmp (buffer, "\r\n", nread) || strncmp (buffer, "\n", nread)) {
+               if (nread == 0) {
+                       if (error && *error == NULL) {
+                               g_set_error_literal (error, G_IO_ERROR,
+                               G_IO_ERROR_PARTIAL_INPUT,
+                               _("Connection terminated unexpectedly"));
+                       }
+                       return -1;
+               }
+
+               if (nread == 2 && strncmp (metabuf, "\r\n", nread) == 0) {
+                        bistream->priv->chunked_state = SOUP_BODY_INPUT_STREAM_STATE_DONE;
+                        bistream->priv->eof = TRUE;
+                }
+-- 
+2.34.1
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-2369.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-2369.patch
new file mode 100644
index 0000000000..814672caca
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-2369.patch
@@ -0,0 +1,33 @@
+From 5c4e65fd99ff4e3ae76c7985c5e160bb07ea0f92 Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Wed, 25 Mar 2026 11:24:36 +0800
+Subject: [PATCH] sniffer: Handle potential underflow
+Closes #498
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/b91bbd7d7888c85b17a8b33173caa806dff51681]
+CVE: CVE-2026-2369
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-content-sniffer.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+diff --git a/libsoup/soup-content-sniffer.c b/libsoup/soup-content-sniffer.c
+index 3edc568..b091bca 100644
+--- a/libsoup/soup-content-sniffer.c
+++ b/libsoup/soup-content-sniffer.c
+@@ -504,6 +504,10 @@ sniff_unknown (SoupContentSniffer *sniffer, SoupBuffer *buffer,
+                if (!sniff_scriptable && type_row->scriptable)
+                        continue;
+ 
+               /* Ensure we have data to sniff - prevents underflow in resource_length - 1 */
+               if (resource_length == 0)
+                       continue;
+
+                if (type_row->has_ws) {
+                        guint index_stream = 0;
+                        guint index_pattern = 0;
+-- 
+2.34.1
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-2443.patch b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-2443.patch
new file mode 100644
index 0000000000..99d42acb1e
--- /dev/null
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4/CVE-2026-2443.patch
@@ -0,0 +1,135 @@
+From 7bb3115a296154e3f465900ea5c984a493385a7f Mon Sep 17 00:00:00 2001
+From: Philip Withnall <pwithnall@gnome.org>
+Date: Fri, 19 Dec 2025 23:49:05 +0000
+Subject: [PATCH] Fix CVE-2026-2443
+Upstream-Status: Backport [
+c1796442 soup-message-headers: Rework Range response statuses to match Apache
+191ef313 soup-message-headers: Fix rejection of Range headers with trailing garbage
+be677bea soup-message-headers: Fix parsing of invalid Range suffix lengths
+2bbfdfe8 soup-message-headers: Reject ranges where end is before start
+739bf7cb soup-message-headers: Reject invalid Range ends longer than the content
+]
+CVE: CVE-2026-2443
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+---
+ libsoup/soup-message-headers.c | 62 ++++++++++++++++++++++++----------
+ 1 file changed, 44 insertions(+), 18 deletions(-)
+diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
+index bb20bbb..535cf14 100644
+--- a/libsoup/soup-message-headers.c
+++ b/libsoup/soup-message-headers.c
+@@ -943,10 +943,16 @@ sort_ranges (gconstpointer a, gconstpointer b)
+ }
+ 
+ /* like soup_message_headers_get_ranges(), except it returns:
+- *   SOUP_STATUS_OK if there is no Range or it should be ignored.
+- *   SOUP_STATUS_PARTIAL_CONTENT if there is at least one satisfiable range.
+- *   SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE if @check_satisfiable
+- *     is %TRUE and the request is not satisfiable given @total_length.
+ *  - SOUP_STATUS_OK if there is no Range or it should be ignored due to being
+ *    entirely invalid.
+ *  - SOUP_STATUS_PARTIAL_CONTENT if there is at least one satisfiable range.
+ *  - SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE if @check_satisfiable
+ *     is %TRUE, the Range is valid, but no part of the request is satisfiable
+ *     given @total_length.
+ *
+ * @ranges and @length are only set if SOUP_STATUS_PARTIAL_CONTENT is returned.
+ *
+ * See https://httpwg.org/specs/rfc9110.html#field.range
+  */
+ guint
+ soup_message_headers_get_ranges_internal (SoupMessageHeaders  *hdrs,
+@@ -960,22 +966,28 @@ soup_message_headers_get_ranges_internal (SoupMessageHeaders  *hdrs,
+        GArray *array;
+        char *spec, *end;
+        guint status = SOUP_STATUS_OK;
+       gboolean is_all_valid = TRUE;
+ 
+        if (!range || strncmp (range, "bytes", 5) != 0)
+-               return status;
+               return SOUP_STATUS_OK;  /* invalid header or unknown range unit */
+ 
+        range += 5;
+        while (g_ascii_isspace (*range))
+                range++;
+        if (*range++ != '=')
+-               return status;
+               return SOUP_STATUS_OK;  /* invalid header */
+        while (g_ascii_isspace (*range))
+                range++;
+ 
+        range_list = soup_header_parse_list (range);
+        if (!range_list)
+-               return status;
+               return SOUP_STATUS_OK;  /* invalid list */
+ 
+       /* Loop through the ranges and modify the status accordingly. Default to
+        * status 200 (OK, ignoring the ranges). Switch to status 206 (Partial
+        * Content) if there is at least one partially valid range. Switch to
+        * status 416 (Range Not Satisfiable) if there are no partially valid
+        * ranges at all. */
+        array = g_array_new (FALSE, FALSE, sizeof (SoupRange));
+        for (r = range_list; r; r = r->next) {
+                SoupRange cur;
+@@ -988,30 +1000,44 @@ soup_message_headers_get_ranges_internal (SoupMessageHeaders  *hdrs,
+                        cur.start = g_ascii_strtoull (spec, &end, 10);
+                        if (*end == '-')
+                                end++;
+-                       if (*end) {
+                       if (*end)
+                                cur.end = g_ascii_strtoull (end, &end, 10);
+-                               if (cur.end < cur.start) {
+-                                       status = SOUP_STATUS_OK;
+-                                       break;
+-                               }
+-                       } else
+                       else
+                                cur.end = total_length - 1;
+                }
+
+                if (*end) {
+-                       status = SOUP_STATUS_OK;
+-                       break;
+-               } else if (check_satisfiable && cur.start >= total_length) {
+-                       if (status == SOUP_STATUS_OK)
+-                               status = SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE;
+                       /* Junk after the range */
+                       is_all_valid = FALSE;
+                       continue;
+               }
+
+               if (cur.end < cur.start) {
+                       is_all_valid = FALSE;
+                       continue;
+               }
+
+               g_assert (cur.start >= 0);
+               if (cur.end >= total_length)
+                       cur.end = total_length - 1;
+
+               if (cur.start >= total_length) {
+                       /* Range is valid, but unsatisfiable */
+                        continue;
+                }
+ 
+               /* We have at least one (at least partially) satisfiable range */
+                g_array_append_val (array, cur);
+                status = SOUP_STATUS_PARTIAL_CONTENT;
+        }
+        soup_header_free_list (range_list);
+ 
+        if (status != SOUP_STATUS_PARTIAL_CONTENT) {
+               g_assert (status == SOUP_STATUS_OK);
+
+               if (is_all_valid && check_satisfiable)
+                       status = SOUP_STATUS_REQUESTED_RANGE_NOT_SATISFIABLE;
+
+                g_array_free (array, TRUE);
+                return status;
+        }
+-- 
+2.34.1
diff --git a/meta-oe/recipes-support/libsoup/libsoup-2.4_2.74.3.bb b/meta-oe/recipes-support/libsoup/libsoup-2.4_2.74.3.bb
index 68ec576d9b..e588e60cd5 100644
--- a/meta-oe/recipes-support/libsoup/libsoup-2.4_2.74.3.bb
+++ b/meta-oe/recipes-support/libsoup/libsoup-2.4_2.74.3.bb
@@ -40,6 +40,16 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
           file://CVE-2025-4948.patch \
           file://CVE-2025-4969.patch \
           file://CVE-2025-4945.patch \
+           file://CVE-2025-14523.patch \
+           file://CVE-2025-32049-1.patch \
+           file://CVE-2025-32049-2.patch \
+           file://CVE-2026-2443.patch \
+           file://CVE-2026-1801.patch \
+           file://CVE-2026-1761.patch \
+           file://CVE-2026-1539.patch \
+           file://CVE-2026-2369.patch \
+           file://CVE-2026-1760.patch \
+           file://CVE-2026-1467.patch \
 "
 SRC_URI[sha256sum] = "e4b77c41cfc4c8c5a035fcdc320c7bc6cfb75ef7c5a034153df1413fa1d92f13"
diff --git a/meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb b/meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb
index 75c51b92d9..7d227d4148 100644
--- a/meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb
+++ b/meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb
@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.md;md5=8f9b59a81a88da8e812af43728b72dd7"
 DEPENDS = "openssl"
 SRC_URI = "git://github.com/DMTF/libspdm.git;branch=release-3.8;protocol=https;tag=${PV}"
-SRCREV = "5cf0acb87b2f36f8d70a89e5da8476d85db59f46"
+SRCREV = "f55cf6d48ec69b4ac60a63903e9c6a2cb0fd155d"
 inherit cmake
@@ -37,6 +37,7 @@ def get_spdm_multiarch(bb, d):
        "riscv32": "riscv32",
        "riscv64": "riscv64",
        "ppc64le": "ppc64le",
+        "powerpc64le": "ppc64le",
    }
    if target_arch in multiarch_options :
diff --git a/meta-oe/recipes-support/libtar/files/0001-compat-convert-K-R-function-definitions-to-ANSI-C-pr.patch b/meta-oe/recipes-support/libtar/files/0001-compat-convert-K-R-function-definitions-to-ANSI-C-pr.patch
new file mode 100644
index 0000000000..4585c586b4
--- /dev/null
+++ b/meta-oe/recipes-support/libtar/files/0001-compat-convert-K-R-function-definitions-to-ANSI-C-pr.patch
@@ -0,0 +1,62 @@
+From 5ea04d70221a18cbd711a9d570c81ef0b9be6765 Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Fri, 10 Apr 2026 18:41:04 -0700
+Subject: [PATCH] compat: convert K&R function definitions to ANSI C prototypes
+Replace old-style K&R parameter declarations with modern ANSI C
+function prototypes in basename.c, dirname.c, and strmode.c.
+Required for compatibility with clang 22 under -std=gnu23, which
+no longer supports K&R-style function definitions.
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ compat/basename.c | 3 +--
+ compat/dirname.c  | 3 +--
+ compat/strmode.c  | 4 +---
+ 3 files changed, 3 insertions(+), 7 deletions(-)
+diff --git a/compat/basename.c b/compat/basename.c
+index 2ac1e13..7b0384a 100644
+--- a/compat/basename.c
+++ b/compat/basename.c
+@@ -36,8 +36,7 @@ static char rcsid[] = "$OpenBSD: basename.c,v 1.4 1999/05/30 17:10:30 espie Exp
+ #include <sys/param.h>
+ 
+ char *
+-openbsd_basename(path)
+-       const char *path;
+openbsd_basename(const char *path)
+ {
+        static char bname[MAXPATHLEN];
+        register const char *endp, *startp;
+diff --git a/compat/dirname.c b/compat/dirname.c
+index 986db4a..6c1231d 100644
+--- a/compat/dirname.c
+++ b/compat/dirname.c
+@@ -36,8 +36,7 @@ static char rcsid[] = "$OpenBSD: dirname.c,v 1.4 1999/05/30 17:10:30 espie Exp $
+ #include <sys/param.h>
+ 
+ char *
+-openbsd_dirname(path)
+-       const char *path;
+openbsd_dirname (const char *path)
+ {
+        static char bname[MAXPATHLEN];
+        register const char *endp;
+diff --git a/compat/strmode.c b/compat/strmode.c
+index 5e7f15e..2ffab61 100644
+--- a/compat/strmode.c
+++ b/compat/strmode.c
+@@ -40,9 +40,7 @@ static char *rcsid = "$OpenBSD: strmode.c,v 1.3 1997/06/13 13:57:20 deraadt Exp
+ #include <string.h>
+ 
+ void
+-strmode(mode, p)
+-       register mode_t mode;
+-       register char *p;
+strmode (register mode_t mode, register char *p)
+ {
+         /* print type */
+        switch (mode & S_IFMT) {
diff --git a/meta-oe/recipes-support/libtar/libtar_1.2.20.bb b/meta-oe/recipes-support/libtar/libtar_1.2.20.bb
index a17509d2e5..39d410064e 100644
--- a/meta-oe/recipes-support/libtar/libtar_1.2.20.bb
+++ b/meta-oe/recipes-support/libtar/libtar_1.2.20.bb
@@ -20,6 +20,7 @@ SRC_URI = "${DEBIAN_MIRROR}/main/libt/${BPN}/${BPN}_${PV}.orig.tar.gz \
           file://CVE-2021-33643-CVE-2021-33644.patch \
           file://CVE-2021-33640-CVE-2021-33645-CVE-2021-33646.patch \
           file://CVE-2013-4420.patch \
+           file://0001-compat-convert-K-R-function-definitions-to-ANSI-C-pr.patch \
           "
 S = "${UNPACKDIR}/${BPN}"
diff --git a/meta-oe/recipes-support/libvarlink/libvarlink/0001-transport-tool-use-const-for-strchr-return-pointers.patch b/meta-oe/recipes-support/libvarlink/libvarlink/0001-transport-tool-use-const-for-strchr-return-pointers.patch
new file mode 100644
index 0000000000..348dc88838
--- /dev/null
+++ b/meta-oe/recipes-support/libvarlink/libvarlink/0001-transport-tool-use-const-for-strchr-return-pointers.patch
@@ -0,0 +1,96 @@
+From 27e4f4504b3c60356b9507e926aae2b82ba47275 Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Wed, 15 Apr 2026 11:10:01 -0700
+Subject: [PATCH] transport,tool: use const for strchr return pointers
+Fixes errors seen after c23 implemented in glibc
+lib/transport-device.c:13:14: error: assigning to 'char *' from 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types-discards-qualifiers]
+   13 |         parm = strchr(address, ';');
+      |              ^ ~~~~~~~~~~~~~~~~~~~~
+1 error generated.
+Upstream-Status: Submitted [https://github.com/varlink/libvarlink/pull/85]
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ lib/transport-device.c | 2 +-
+ lib/transport-tcp.c    | 4 ++--
+ lib/transport-unix.c   | 2 +-
+ tool/command-format.c  | 2 +-
+ tool/command-info.c    | 2 +-
+ 5 files changed, 6 insertions(+), 6 deletions(-)
+diff --git a/lib/transport-device.c b/lib/transport-device.c
+index 0b8cec5..205eac4 100644
+--- a/lib/transport-device.c
+++ b/lib/transport-device.c
+@@ -7,7 +7,7 @@
+ #include <fcntl.h>
+ static int strip_parameters(const char *address, char **devicep) {
+-        char *parm;
+        const char *parm;
+         _cleanup_(freep) char *device = NULL;
+         parm = strchr(address, ';');
+diff --git a/lib/transport-tcp.c b/lib/transport-tcp.c
+index 92a0e7b..fff2379 100644
+--- a/lib/transport-tcp.c
+++ b/lib/transport-tcp.c
+@@ -10,7 +10,7 @@
+ #include <sys/socket.h>
+ static int strip_parameters(const char *address, char **hostp) {
+-        char *parm;
+        const char *parm;
+         _cleanup_(freep) char *host = NULL;
+         parm = strchr(address, ';');
+@@ -34,7 +34,7 @@ static void freeaddrinfop(struct addrinfo **ai) {
+ static int resolve_addrinfo(const char *address, struct addrinfo **resultp) {
+         _cleanup_(freep) char *host = NULL;
+         char *endptr;
+-        char *port;
+        const char *port;
+         struct addrinfo hints = {
+                 .ai_family = AF_UNSPEC,
+                 .ai_socktype = SOCK_STREAM,
+diff --git a/lib/transport-unix.c b/lib/transport-unix.c
+index 5dc3853..2414b29 100644
+--- a/lib/transport-unix.c
+++ b/lib/transport-unix.c
+@@ -10,7 +10,7 @@
+ #include <unistd.h>
+ static int strip_parameters(const char *address, char **pathp) {
+-        char *parm;
+        const char *parm;
+         _cleanup_(freep) char *path = NULL;
+         parm = strchr(address, ';');
+diff --git a/tool/command-format.c b/tool/command-format.c
+index 6932bc4..0f5ef8c 100644
+--- a/tool/command-format.c
+++ b/tool/command-format.c
+@@ -155,7 +155,7 @@ static long format_run(Cli *UNUSED(cli), int argc, char **argv) {
+ static long format_complete(Cli *cli, int argc, char **UNUSED(argv), const char *current) {
+         _cleanup_(freep) char *prefix = NULL;
+         DIR *dir;
+-        char *p;
+        const char *p;
+         if (argc != 1)
+                 return 0;
+diff --git a/tool/command-info.c b/tool/command-info.c
+index 571b6fd..9d252f7 100644
+--- a/tool/command-info.c
+++ b/tool/command-info.c
+@@ -137,7 +137,7 @@ static long info_run(Cli *cli, int argc, char **argv) {
+ static long info_complete(Cli *UNUSED(cli), int argc, char **UNUSED(argv), const char *current) {
+         _cleanup_(freep) char *prefix = NULL;
+         DIR *dir;
+-        char *p;
+        const char *p;
+         if (argc != 1)
+                 return 0;
diff --git a/meta-oe/recipes-support/libvarlink/libvarlink_24.0.1.bb b/meta-oe/recipes-support/libvarlink/libvarlink_24.0.1.bb
new file mode 100644
index 0000000000..1d1419a878
--- /dev/null
+++ b/meta-oe/recipes-support/libvarlink/libvarlink_24.0.1.bb
@@ -0,0 +1,19 @@
+SUMMARY = "Varlink C library and command line tool"
+HOMEPAGE = "https://varlink.org/"
+DESCRIPTION = "Varlink is an interface description format and protocol that aims \
+to make services accessible to both humans and machines in the simplest feasible way."
+SECION = "devel"
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=e3fc50a88d0a364313df4b21ef20c29e"
+SRC_URI = "git://github.com/varlink/libvarlink.git;protocol=https;branch=master;tag=v${PV} \
+           file://0001-transport-tool-use-const-for-strchr-return-pointers.patch \
+          "
+SRCREV = "2ad4ec7ca62e148dbf0ad98646ec68c2e7e8a88e"
+inherit meson bash-completion lib_package
+do_install:append() {
+    # vim integration is not needed
+    rm -rf ${D}${datadir}/vim
+}
diff --git a/meta-oe/recipes-support/log4c/log4c/0001-sd-malloc-convert-K-R-function-declarations-to-ANSI-.patch b/meta-oe/recipes-support/log4c/log4c/0001-sd-malloc-convert-K-R-function-declarations-to-ANSI-.patch
new file mode 100644
index 0000000000..fae1a2d0c2
--- /dev/null
+++ b/meta-oe/recipes-support/log4c/log4c/0001-sd-malloc-convert-K-R-function-declarations-to-ANSI-.patch
@@ -0,0 +1,92 @@
+From b0ecadec662a8e35b017e16e92c5b1a04ed72598 Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Sat, 11 Apr 2026 00:24:17 -0700
+Subject: [PATCH] sd/malloc: convert K&R function declarations to ANSI C
+ prototypes
+Replace old-style K&R parameter declarations with modern ANSI C
+(C89/C90) function prototypes across all functions in malloc.c.
+Also remove trailing whitespace in fixup_null_alloc().
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ src/sd/malloc.c | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+diff --git a/src/sd/malloc.c b/src/sd/malloc.c
+index 7d241ad..43dd460 100644
+--- a/src/sd/malloc.c
+++ b/src/sd/malloc.c
+@@ -41,8 +41,7 @@ typedef void (*sd_malloc_handler_t)();
+ static sd_malloc_handler_t handler  = NULL;
+ 
+ static void *
+-fixup_null_alloc (n)
+-    size_t n;
+fixup_null_alloc (size_t n)
+ {
+     void* p = 0;
+ 
+@@ -62,8 +61,8 @@ fixup_null_alloc (n)
+            allocated = (char *) sbrk (0) - (char *) &environ;
+        sd_error("\nCannot allocate %lu bytes after allocating %lu bytes\n",
+                 (unsigned long) n, (unsigned long) allocated);
+-       
+-       if (handler) 
+
+       if (handler)
+            handler();
+        else {
+            sd_error("\n\tMemory exhausted !! Aborting.\n");
+@@ -75,8 +74,7 @@ fixup_null_alloc (n)
+ }
+ 
+ sd_malloc_handler_t
+-sd_malloc_set_handler(a_handler)
+-    sd_malloc_handler_t a_handler;
+sd_malloc_set_handler(sd_malloc_handler_t a_handler)
+ {
+     sd_malloc_handler_t previous = handler;
+ 
+@@ -87,8 +85,7 @@ sd_malloc_set_handler(a_handler)
+ /* Allocate N bytes of memory dynamically, with error checking.  */
+ 
+ void *
+-sd_malloc (n)
+-    size_t n;
+sd_malloc (size_t n)
+ {
+     void *p;
+ 
+@@ -101,8 +98,7 @@ sd_malloc (n)
+ /* Allocate memory for N elements of S bytes, with error checking.  */
+ 
+ void *
+-sd_calloc (n, s)
+-    size_t n, s;
+sd_calloc (size_t n, size_t s)
+ {
+     void *p;
+ 
+@@ -117,9 +113,7 @@ sd_calloc (n, s)
+    If P is NULL, run sd_malloc.  */
+ 
+ void *
+-sd_realloc (p, n)
+-    void *p;
+-    size_t n;
+sd_realloc (void *p, size_t n)
+ {
+     if (p == 0)
+        return sd_malloc (n);
+@@ -132,8 +126,7 @@ sd_realloc (p, n)
+ /* Return a newly allocated copy of STRING.  */
+ 
+ char *
+-sd_strdup (string)
+-     const char *string;
+sd_strdup (const char *string)
+ {
+   return strcpy (sd_malloc (strlen (string) + 1), string);
+ }
diff --git a/meta-oe/recipes-support/log4c/log4c_1.2.4.bb b/meta-oe/recipes-support/log4c/log4c_1.2.4.bb
index a0bd40b03a..eca800dc5e 100644
--- a/meta-oe/recipes-support/log4c/log4c_1.2.4.bb
+++ b/meta-oe/recipes-support/log4c/log4c_1.2.4.bb
@@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
 SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BP}.tar.gz \
           file://fix_configure_with-expat.patch \
           file://0001-Use-the-API-properly-in-the-example-format-security-.patch \
+           file://0001-sd-malloc-convert-K-R-function-declarations-to-ANSI-.patch \
          "
 SRC_URI[sha256sum] = "5991020192f52cc40fa852fbf6bbf5bd5db5d5d00aa9905c67f6f0eadeed48ea"
diff --git a/meta-oe/recipes-support/lvm2/files/0001-implement-libc-specific-reopen_stream.patch b/meta-oe/recipes-support/lvm2/files/0001-implement-libc-specific-reopen_stream.patch
index 1f6b89f2b6..e157c5518e 100644
--- a/meta-oe/recipes-support/lvm2/files/0001-implement-libc-specific-reopen_stream.patch
+++ b/meta-oe/recipes-support/lvm2/files/0001-implement-libc-specific-reopen_stream.patch
@@ -48,7 +48,7 @@ diff --git a/tools/lvmcmdline.c b/tools/lvmcmdline.c
 index 22ae1e3bb..b0928bc04 100644
 --- a/tools/lvmcmdline.c
 +++ b/tools/lvmcmdline.c
-@@ -3407,7 +3407,7 @@ static int _check_standard_fds(void)
+@@ -3427,7 +3427,7 @@ static int _check_standard_fds(void)
        int err = is_valid_fd(STDERR_FILENO);
 
        if (!is_valid_fd(STDIN_FILENO) &&
@@ -57,7 +57,7 @@ index 22ae1e3bb..b0928bc04 100644
                if (err)
                        perror("stdin stream open");
                else
-@@ -3417,7 +3417,7 @@ static int _check_standard_fds(void)
+@@ -3437,7 +3437,7 @@ static int _check_standard_fds(void)
        }
 
        if (!is_valid_fd(STDOUT_FILENO) &&
@@ -66,7 +66,7 @@ index 22ae1e3bb..b0928bc04 100644
                if (err)
                        perror("stdout stream open");
                /* else no stdout */
-@@ -3425,7 +3425,7 @@ static int _check_standard_fds(void)
+@@ -3445,7 +3445,7 @@ static int _check_standard_fds(void)
        }
 
        if (!is_valid_fd(STDERR_FILENO) &&
diff --git a/meta-oe/recipes-support/lvm2/files/0001-include-libgen.h-for-basename.patch b/meta-oe/recipes-support/lvm2/files/0001-include-libgen.h-for-basename.patch
index 2fcbc12b22..c2c83dbb7e 100644
--- a/meta-oe/recipes-support/lvm2/files/0001-include-libgen.h-for-basename.patch
+++ b/meta-oe/recipes-support/lvm2/files/0001-include-libgen.h-for-basename.patch
@@ -21,7 +21,7 @@ index a3f341bfc..0c05eb151 100644
 +++ b/lib/device/device_id.c
 @@ -27,6 +27,7 @@
 #include "lib/display/display.h"
- #include "device_mapper/misc/dm-ioctl.h"
+ #include "libdm/misc/dm-ioctl.h"
 
 +#include <libgen.h>
 #include <sys/stat.h>
diff --git a/meta-oe/recipes-support/lvm2/files/0004-tweak-MODPROBE_CMD-for-cross-compile.patch b/meta-oe/recipes-support/lvm2/files/0004-tweak-MODPROBE_CMD-for-cross-compile.patch
index ac5c440e4e..49f8d27c00 100644
--- a/meta-oe/recipes-support/lvm2/files/0004-tweak-MODPROBE_CMD-for-cross-compile.patch
+++ b/meta-oe/recipes-support/lvm2/files/0004-tweak-MODPROBE_CMD-for-cross-compile.patch
@@ -24,7 +24,7 @@ diff --git a/configure.ac b/configure.ac
 index e5e5e71ce..3af73c781 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1742,8 +1742,6 @@ AS_IF([test "$BUILD_DMFILEMAPD" = "yes"], [
+@@ -1746,8 +1746,6 @@ AS_IF([test "$BUILD_DMFILEMAPD" = "yes"], [
 ])
 
 ################################################################################
diff --git a/meta-oe/recipes-support/lvm2/files/0005-do-not-build-manual.patch b/meta-oe/recipes-support/lvm2/files/0005-do-not-build-manual.patch
index f7a85b4b3f..c2d4da5c41 100644
--- a/meta-oe/recipes-support/lvm2/files/0005-do-not-build-manual.patch
+++ b/meta-oe/recipes-support/lvm2/files/0005-do-not-build-manual.patch
@@ -47,7 +47,7 @@ index 06c4b1823..90df7b09c 100644
     libdaemon lib tools daemons libdm \
     udev po
 tools.distclean: test.distclean
-@@ -59,7 +59,7 @@ unit-test  run-unit-test: test libdm
+@@ -57,7 +57,7 @@ unit-test  run-unit-test: test libdm
 
 daemons.device-mapper: libdm.device-mapper
 tools.device-mapper: libdm.device-mapper
@@ -60,7 +60,7 @@ diff --git a/configure.ac b/configure.ac
 index 3af73c781..f32d1f376 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -2076,7 +2076,6 @@ libdaemon/server/Makefile
+@@ -2083,7 +2083,6 @@ libdaemon/server/Makefile
 libdm/Makefile
 libdm/dm-tools/Makefile
 libdm/libdevmapper.pc
diff --git a/meta-oe/recipes-support/lvm2/files/reproducible-build.patch b/meta-oe/recipes-support/lvm2/files/reproducible-build.patch
index ca632d213f..f6c561aeb1 100644
--- a/meta-oe/recipes-support/lvm2/files/reproducible-build.patch
+++ b/meta-oe/recipes-support/lvm2/files/reproducible-build.patch
@@ -16,7 +16,7 @@ diff --git a/configure.ac b/configure.ac
 index 5364dd68e..c2dbf3c9f 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -15,7 +15,15 @@ AC_PREREQ(2.69)
+@@ -14,7 +14,15 @@ AC_PREREQ(2.69)
 ################################################################################
 dnl -- Process this file with autoconf to produce a configure script.
 AC_INIT
diff --git a/meta-oe/recipes-support/lvm2/lvm2.inc b/meta-oe/recipes-support/lvm2/lvm2.inc
index 9e6bd807a2..c2a88a2917 100644
--- a/meta-oe/recipes-support/lvm2/lvm2.inc
+++ b/meta-oe/recipes-support/lvm2/lvm2.inc
@@ -7,7 +7,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=12713b4d9386533feeb07d6e4831765a \
 DEPENDS += "libaio"
-SRC_URI = "git://sourceware.org/git/lvm2.git;branch=main \
+SRC_URI = "git://sourceware.org/git/lvm2.git;branch=main;tag=${PV_TAG} \
           file://lvm.conf \
           file://0001-implement-libc-specific-reopen_stream.patch \
           file://0004-tweak-MODPROBE_CMD-for-cross-compile.patch \
@@ -18,8 +18,9 @@ SRC_URI = "git://sourceware.org/git/lvm2.git;branch=main \
           file://0001-include-libgen.h-for-basename.patch \
           "
-SRCREV = "657e10bd75fcb3dffbd40bb1ffc6f1bfd768a10e"
+SRCREV = "6c5b6cee9f21908bdaff830c210222cc7e08f1ab"
-PV = "2.03.38"
+PV = "2.03.39"
+PV_TAG = "v${@d.getVar('PV').replace('.', '_')}"
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>\d+(\_\d+)+)"
diff --git a/meta-oe/recipes-support/lvm2/lvm2/tweak-for-lvmdbusd.patch b/meta-oe/recipes-support/lvm2/lvm2/tweak-for-lvmdbusd.patch
index 200f2f044a..fd8faaf1fe 100644
--- a/meta-oe/recipes-support/lvm2/lvm2/tweak-for-lvmdbusd.patch
+++ b/meta-oe/recipes-support/lvm2/lvm2/tweak-for-lvmdbusd.patch
@@ -21,7 +21,7 @@ diff --git a/configure.ac b/configure.ac
 index 9dfdcfe01..fcf5c8b78 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1282,8 +1282,8 @@ AS_IF([test "$BUILD_LVMDBUSD" = "yes"], [
+@@ -1338,8 +1338,8 @@ AS_IF([test "$BUILD_LVMDBUSD" = "yes"], [
        AS_IF([test "$PYTHON3_BINDINGS" = "yes"], [PYTHON_BINDINGS="yes"])
 
        # To get this macro, install autoconf-archive package then run autoreconf
diff --git a/meta-oe/recipes-support/multipath-tools/multipath-tools_0.12.2.bb b/meta-oe/recipes-support/multipath-tools/multipath-tools_0.12.2.bb
index bfb75718f2..0c572d1bd3 100644
--- a/meta-oe/recipes-support/multipath-tools/multipath-tools_0.12.2.bb
+++ b/meta-oe/recipes-support/multipath-tools/multipath-tools_0.12.2.bb
@@ -110,6 +110,7 @@ PACKAGES =+ "${PN}-libs"
 FILES:${PN}-libs = "${base_libdir}/lib*.so.* \
                    ${base_libdir}/multipath/lib*.so*"
 RDEPENDS:${PN} += "${PN}-libs bash libgcc"
+RRECOMMENDS:${PN} = "kernel-module-dm-multipath"
 PROVIDES += "device-mapper-multipath"
 RPROVIDES:${PN} += "device-mapper-multipath"
diff --git a/meta-oe/recipes-support/nano/nano_8.7.1.bb b/meta-oe/recipes-support/nano/nano_9.0.bb
index e62529ff9b..06bb7a63ce 100644
--- a/meta-oe/recipes-support/nano/nano_8.7.1.bb
+++ b/meta-oe/recipes-support/nano/nano_9.0.bb
@@ -13,7 +13,7 @@ RDEPENDS:${PN} = "ncurses-terminfo-base"
 PV_MAJOR = "${@d.getVar('PV').split('.')[0]}"
 SRC_URI = "https://nano-editor.org/dist/v${PV_MAJOR}/nano-${PV}.tar.xz"
-SRC_URI[sha256sum] = "76f0dcb248f2e2f1251d4ecd20fd30fb400a360a3a37c6c340e0a52c2d1cdedf"
+SRC_URI[sha256sum] = "9f384374b496110a25b73ad5a5febb384783c6e3188b37063f677ac908013fde"
 UPSTREAM_CHECK_URI = "${GNU_MIRROR}/nano"
diff --git a/meta-oe/recipes-support/nss/nss_3.121.bb b/meta-oe/recipes-support/nss/nss_3.122.bb
index 99f54c948a..70aee3d9db 100644
--- a/meta-oe/recipes-support/nss/nss_3.121.bb
+++ b/meta-oe/recipes-support/nss/nss_3.122.bb
@@ -33,7 +33,7 @@ SRC_URI = "https://ftp.mozilla.org/pub/security/nss/releases/${VERSION_DIR}/src/
           file://0006-Fix-nss-multilib-build-on-openSUSE-11.x-32bit.patch \
           file://0007-freebl-add-a-configure-option-to-disable-ARM-HW-cryp.patch \
           "
-SRC_URI[sha256sum] = "cb3a8f8781bea78b7b8edd3afb7a2cb58e4881bb0160d189a39b98216ba7632e"
+SRC_URI[sha256sum] = "2699478b843b9f09c61f85341578df514463a0069447c816bef0d59bd800d777"
 UPSTREAM_CHECK_URI = "https://ftp.mozilla.org/pub/security/nss/releases/"
 UPSTREAM_CHECK_REGEX = "NSS_(?P<pver>\d+(\_\d+)+)"
diff --git a/meta-oe/recipes-support/openct/openct/0001-Fix-incompatible-pointer-type-error-with-gcc-option.patch b/meta-oe/recipes-support/openct/openct/0001-Fix-incompatible-pointer-type-error-with-gcc-option.patch
deleted file mode 100644
index 73c9d06667..0000000000
--- a/meta-oe/recipes-support/openct/openct/0001-Fix-incompatible-pointer-type-error-with-gcc-option.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From c4351058da555e1e6a2b4b15d913baee80f55865 Mon Sep 17 00:00:00 2001
-From: Wang Mingyu <wangmy@fujitsu.com>
-Date: Thu, 27 Jun 2024 06:27:18 +0000
-Subject: Fix incompatible pointer type error with gcc option 
- -Wincompatible-pointer-types
-| ../../../openct-0.6.20/src/ifd/ifdhandler.c: In function 'ifdhandler_run':
-| ../../../openct-0.6.20/src/ifd/ifdhandler.c:239:52: error: passing argument 2 of 'ifd_get_eventfd' from incompatible pointer type [-Wincompatible-pointer-types]
-|   239 |                 sock->fd = ifd_get_eventfd(reader, &sock->events);
-|       |                                                    ^~~~~~~~~~~~~
-|       |                                                    |
-|       |                                                    int *
-| In file included from ../../../openct-0.6.20/src/ifd/internal.h:17,
-|                  from ../../../openct-0.6.20/src/ifd/ifdhandler.c:7:
-| ../../../openct-0.6.20/src/include/openct/ifd.h:182:65: note: expected 'short int *' but argument is of type 'int *'
-|   182 | extern int                      ifd_get_eventfd(ifd_reader_t *, short *);
-|       |                                                                 ^~~~~~~
-| ../../../openct-0.6.20/src/ifd/process.c: In function 'do_memory_write':
-| ../../../openct-0.6.20/src/ifd/process.c:461:61: error: passing argument 4 of 'ct_tlv_get_opaque' from incompatible pointer type [-Wincompatible-pointer-types]
-|   461 |             || !ct_tlv_get_opaque(args, CT_TAG_DATA, &data, &data_len))
-|       |                                                             ^~~~~~~~~
-|       |                                                             |
-|       |                                                             unsigned int *
-| In file included from ../../../openct-0.6.20/src/ifd/process.c:20:
-| ../../../openct-0.6.20/src/include/openct/tlv.h:40:62: note: expected 'size_t *' {aka 'long unsigned int *'} but argument is of type 'unsigned int *'
-|    40 |                                 ifd_tag_t, unsigned char **, size_t *);
-Upstream-Status: Submitted
-Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
---
- src/ifd/ifdhandler.c | 2 +-
- src/ifd/process.c    | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/src/ifd/ifdhandler.c b/src/ifd/ifdhandler.c
-index 12686c9..ebd1b53 100644
--- a/src/ifd/ifdhandler.c
-+++ b/src/ifd/ifdhandler.c
-@@ -236,7 +236,7 @@ static void ifdhandler_run(ifd_reader_t * reader)
-                sock->fd = -1;
-        }
-        else {
-               sock->fd = ifd_get_eventfd(reader, &sock->events);
-+               sock->fd = ifd_get_eventfd(reader, (short int *)&sock->events);
-        }
-        if (sock->fd == -1) {
-                ifd_debug(1, "events inactive for reader %s", reader->name);
-diff --git a/src/ifd/process.c b/src/ifd/process.c
-index 4563bdf..7088a76 100644
--- a/src/ifd/process.c
-+++ b/src/ifd/process.c
-@@ -458,7 +458,7 @@ static int do_memory_write(ifd_reader_t * reader, int unit,
-                return IFD_ERROR_INVALID_SLOT;
- 
-        if (ct_tlv_get_int(args, CT_TAG_ADDRESS, &address) == 0
-           || !ct_tlv_get_opaque(args, CT_TAG_DATA, &data, &data_len))
-+           || !ct_tlv_get_opaque(args, CT_TAG_DATA, &data, (size_t *)&data_len))
-                return IFD_ERROR_MISSING_ARG;
- 
-        rc = ifd_card_write_memory(reader, unit, address, data, data_len);
-- 
-2.34.1
diff --git a/meta-oe/recipes-support/openct/openct/0001-m4-Just-emit-the-first-line-of-compiler-version.patch b/meta-oe/recipes-support/openct/openct/0001-m4-Just-emit-the-first-line-of-compiler-version.patch
deleted file mode 100644
index 9bd3d18d6e..0000000000
--- a/meta-oe/recipes-support/openct/openct/0001-m4-Just-emit-the-first-line-of-compiler-version.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 146b5116140d719e4e9ae19748c0b6dee7d82f96 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Mon, 22 May 2023 22:01:28 -0700
-Subject: [PATCH] m4: Just emit the first line of compiler version
-Avoids emitting buildpaths into comments
-Fixes
-WARNING: openct-0.6.20-r0 do_package_qa: QA Issue: File /usr/include/openct/types.h in package openct-dev contains reference to TMPDIR [buildpaths]
-Upstream-Status: Pending
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
- m4/ac_create_stdint_h.m4 | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/m4/ac_create_stdint_h.m4 b/m4/ac_create_stdint_h.m4
-index 66de704..4b7223a 100644
--- a/m4/ac_create_stdint_h.m4
-+++ b/m4/ac_create_stdint_h.m4
-@@ -110,7 +110,7 @@ echo "#define" $_ac_stdint_h "1" >>$ac_stdint_h
- echo "#ifndef" _GENERATED_STDINT_H >>$ac_stdint_h
- echo "#define" _GENERATED_STDINT_H '"'$PACKAGE $VERSION'"' >>$ac_stdint_h
- if test "$GCC" = "yes" ; then
-  echo "/* generated using a gnu compiler version" `$CC --version` "*/" \
-+  echo "/* generated using a gnu compiler version" `$CC --version|head -1` "*/" \
-   >>$ac_stdint_h
- else
-   echo "/* generated using $CC */" >>$ac_stdint_h
-- 
-2.40.1
diff --git a/meta-oe/recipes-support/openct/openct/etc-openct.udev.in-disablePROGRAM.patch b/meta-oe/recipes-support/openct/openct/etc-openct.udev.in-disablePROGRAM.patch
deleted file mode 100644
index e2401bb31b..0000000000
--- a/meta-oe/recipes-support/openct/openct/etc-openct.udev.in-disablePROGRAM.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From e0d3e0bb1e38ff851696a7d8826e651d364ad8ce Mon Sep 17 00:00:00 2001
-From: Li xin <lixin.fnst@cn.fujitsu.com>
-Date: Fri, 5 Dec 2014 02:00:57 +0900
-Subject: [PATCH 1/2] etc/openct.udev.in: disablePROGRAM
-Bug fix: https://bugzilla.redhat.com/show_bug.cgi?id=287871
-Upstream-Status: Pending
-Signed-off-by: Li Xin <lixin.fnst@cn.fujitsu.com>
---
- etc/openct.udev.in | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/etc/openct.udev.in b/etc/openct.udev.in
-index d11d0e1..48083c9 100644
--- a/etc/openct.udev.in
-+++ b/etc/openct.udev.in
-@@ -22,7 +22,8 @@ ACTION!="add", GOTO="openct_usb_rules_end"
- # 2010-01-06 removed, as latest udev doesn't know WAIT_FOR_ATTR any more.
- 
- # sleep for 100ms - the wait_for_sysfs might not be enough
-PROGRAM="/bin/sleep 0.1"
-+# Disabled in this package - see https://bugzilla.redhat.com/287871
-+# PROGRAM="/bin/sleep 0.1"
- 
- # ccid
- ATTR{bInterfaceClass}=="0b", ATTR{bInterfaceSubClass}=="00", ATTR{bInterfaceProtocol}=="00", ATTRS{idVendor}=="?*"  RUN+="@udevdir@/openct_usb /dev/$parent"
-- 
-1.8.4.2
diff --git a/meta-oe/recipes-support/openct/openct/etc-openct_usb.in-modify-UDEVINFO.patch b/meta-oe/recipes-support/openct/openct/etc-openct_usb.in-modify-UDEVINFO.patch
deleted file mode 100644
index 22eda729fb..0000000000
--- a/meta-oe/recipes-support/openct/openct/etc-openct_usb.in-modify-UDEVINFO.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From d93985a137b553b2723235d03bda341dab14064f Mon Sep 17 00:00:00 2001
-From: Li xin <lixin.fnst@cn.fujitsu.com>
-Date: Fri, 5 Dec 2014 02:04:03 +0900
-Subject: [PATCH 2/2] etc/openct_usb.in: modify UDEVINFO
-this patch is from Fedora
-Upstream-Status: Pending
-Signed-off-by: Li Xin <lixin.fnst@cn.fujitsu.com>
---
- etc/openct_usb.in | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/etc/openct_usb.in b/etc/openct_usb.in
-index 32f91aa..917467d 100644
--- a/etc/openct_usb.in
-+++ b/etc/openct_usb.in
-@@ -15,10 +15,10 @@ if [ -z "$DEVNAME" ]; then
-        # Guess udev info interface.
-        # Newer udev uses udevadm
-        #
-       if which udevinfo > /dev/null 2>&1; then
-               UDEVINFO="udevinfo"
-       else
-+       if which udevadm > /dev/null 2>&1; then
-                UDEVINFO="udevadm info"
-+       else
-+               UDEVINFO="udevinfo"
-        fi
-        DEVNAME=/dev/$($UDEVINFO --query=name --path=$(dirname $DEVPATH))
- fi
-- 
-1.8.4.2
diff --git a/meta-oe/recipes-support/openct/openct/openct.init b/meta-oe/recipes-support/openct/openct/openct.init
deleted file mode 100644
index c6896095e3..0000000000
--- a/meta-oe/recipes-support/openct/openct/openct.init
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/bin/sh
-#
-# openct       This shell script takes care of starting and stopping OpenCT.
-#
-# chkconfig:   2345 24 89
-# description: OpenCT is a middleware framework for smart card terminals.
-#
-# processname: ifdhandler
-# config:      /etc/openct.conf
-### BEGIN INIT INFO
-# Provides: openct
-# Default-Start: 2 3 4 5
-# Default-Stop: 0 1 6
-# Should-Start: $syslog $network
-# Should-Stop: $syslog $network
-# Short-Description: Middleware framework for smart card terminals
-# Description: This starts/stops the OpenCT middleware framework support
-#              for smart card terminals.
-### END INIT INFO
-. /etc/init.d/functions
-exec="/usr/sbin/openct-control"
-prog=openct
-proc=ifdhandler
-OPENCT_OPTIONS=
-[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
-lockfile=/var/lock/subsys/$prog
-start() {
-    retval=0
-    if ! status $proc >/dev/null 2>&1 ; then
-        action $"Initializing OpenCT smart card terminals: " \
-            $exec $OPENCT_OPTIONS init
-        retval=$?
-        [ $retval -eq 0 ] && touch $lockfile
-    fi
-    return $retval
-}
-stop() {
-    if status $proc >/dev/null 2>&1 ; then
-        action $"Stopping OpenCT smart card terminals: " \
-            $exec $OPENCT_OPTIONS shutdown
-    fi
-    retval=$?
-    if [ $retval -eq 0 ] ; then
-        rm -f /var/run/openct/status
-        rm -f $lockfile
-    fi
-    return $retval
-}
-restart() {
-    stop
-    start
-}
-oct_status() {
-    status $proc
-    retval=$?
-    if [ -e /var/run/openct/status ] ; then
-        $exec $OPENCT_OPTIONS status
-        [ -e /var/run/openct/status ] && \
-            echo $"Waiting for reader attach/detach events..."
-    fi
-    return $retval
-}
-case "$1" in
-    start|stop|restart)
-        $1
-        ;;
-    reload|force-reload)
-        restart
-        ;;
-    status)
-        oct_status
-        ;;
-    try-restart|condrestart)
-        [ ! -f $lockfile ] || restart
-        ;;
-    *)
-        echo $"Usage: $0 {start|stop|status|restart|try-restart|reload|force-reload}"
-        exit 2
-esac
diff --git a/meta-oe/recipes-support/openct/openct/openct.service b/meta-oe/recipes-support/openct/openct/openct.service
deleted file mode 100644
index c9ec497fa5..0000000000
--- a/meta-oe/recipes-support/openct/openct/openct.service
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Openct Middleware framework for smart card terminals
-After=syslog.target network.target
-[Service]
-EnvironmentFile=-/etc/sysconfig/openct
-ExecStart=/usr/sbin/openct-control $OPENCT_OPTIONS init 
-ExecStop=/usr/sbin/openct-control $OPENCT_OPTIONS shutdown
-RemainAfterExit=yes
-KillMode=none
-[Install]
-WantedBy=multi-user.target
diff --git a/meta-oe/recipes-support/openct/openct/openct.sysconfig b/meta-oe/recipes-support/openct/openct/openct.sysconfig
deleted file mode 100644
index ffc270790f..0000000000
--- a/meta-oe/recipes-support/openct/openct/openct.sysconfig
+++ /dev/null
@@ -1,5 +0,0 @@
-#                                                                    -*- sh -*-
-# Extra options to pass to openct-control.
-# Consult "/usr/sbin/openct-control -h" for available options.
-#
-OPENCT_OPTIONS=""
diff --git a/meta-oe/recipes-support/openct/openct_0.6.20.bb b/meta-oe/recipes-support/openct/openct_0.6.20.bb
deleted file mode 100644
index c7b0d0d56d..0000000000
--- a/meta-oe/recipes-support/openct/openct_0.6.20.bb
+++ /dev/null
@@ -1,91 +0,0 @@
-SUMMARY = "Middleware framework for smart card terminals"
-HOMEPAGE = "https://github.com/OpenSC/openct/wiki"
-DESCRIPTION = " \
-OpenCT implements drivers for several smart card readers. \
-It comes as driver in ifdhandler format for PC/SC-Lite, \
-as CT-API driver, or as a small and lean middleware, \
-so applications can use it with minimal overhead. \
-OpenCT also has a primitive mechanism to export smart card \
-readers to remote machines via TCP/IP."
-DEPENDS += "libtool pcsc-lite libusb-compat"
-SRC_URI = " \
-    https://downloads.sourceforge.net/project/opensc/${BPN}/${BPN}-${PV}.tar.gz \
-    file://etc-openct.udev.in-disablePROGRAM.patch \
-    file://etc-openct_usb.in-modify-UDEVINFO.patch \
-    file://0001-m4-Just-emit-the-first-line-of-compiler-version.patch \
-    file://openct.init \
-    file://openct.sysconfig \
-    file://openct.service \
-    file://0001-Fix-incompatible-pointer-type-error-with-gcc-option.patch \
-"
-SRC_URI[sha256sum] = "6cd3e2933d29eb1f875c838ee58b8071fd61f0ec8ed5922a86c01c805d181a68"
-UPSTREAM_CHECK_URI = "https://sourceforge.net/projects/opensc/files/openct/"
-LICENSE = "LGPL-2.0-or-later"
-LIC_FILES_CHKSUM = "file://LGPL-2.1;md5=2d5025d4aa3495befef8f17206a5b0a1"
-inherit systemd
-SYSTEMD_SERVICE:${PN} += "openct.service "
-SYSTEMD_AUTO_ENABLE = "enable"
-EXTRA_OECONF = " \
-    --disable-static \
-    --enable-usb \
-    --enable-pcsc \
-    --enable-doc \
-    --enable-api-doc \
-    --with-udev=${nonarch_libdir}/udev \
-    --with-bundle=${libdir}/pcsc/drivers \
-"
-inherit autotools pkgconfig
-FILES:${PN} += " \
-    ${libdir}/ctapi \
-    ${nonarch_libdir}/udev \
-    ${libdir}/openct-ifd.so \
-    ${libdir}/pcsc \
-"
-FILES:${PN}-dbg += " \
-    ${libdir}/ctapi/.debug \
-    ${libdir}/pcsc/drivers/openct-ifd.bundle/Contents/Linux/.debug \
-"
-INSANE_SKIP:${PN} += "dev-deps"
-do_install[cleandirs] += "${D}"
-do_install () {
-    install -d ${D}${sysconfdir}
-    # fix up hardcoded paths
-    sed -i -e 's,/etc/,${sysconfdir}/,' -e 's,/usr/sbin/,${sbindir}/,' \
-        ${UNPACKDIR}/openct.service ${UNPACKDIR}/openct.init
-    oe_runmake install DESTDIR=${D}
-    install -dm 755 ${D}${libdir}/ctapi/
-    mv ${D}${libdir}/libopenctapi.so ${D}${libdir}/ctapi/
-    install -Dpm 644 etc/openct.udev ${D}${nonarch_libdir}/udev/rules.d/60-openct.rules
-    install -pm 644 etc/openct.conf ${D}${sysconfdir}/openct.conf
-    install -Dpm 755 ${UNPACKDIR}/openct.init ${D}${sysconfdir}/init.d/openct
-    install -Dpm 644 ${UNPACKDIR}/openct.sysconfig ${D}${sysconfdir}/sysconfig/openct
-    install -d ${D}${systemd_unitdir}/system
-    install -m 644 ${UNPACKDIR}/openct.service ${D}${systemd_unitdir}/system
-    so=$(find ${D} -name \*.so | sed "s|^${D}||")
-    sed -i -e 's|\\(LIBPATH\\s*\\).*|\\1$so|' etc/reader.conf
-    install -Dpm 644 etc/reader.conf ${D}${sysconfdir}/reader.conf.d/openct.conf
-}
-BBCLASSEXTEND = "native"
-# http://errors.yoctoproject.org/Errors/Details/766890/
-# openct-0.6.20/src/ifd/ifdhandler.c:239:52: error: passing argument 2 of 'ifd_get_eventfd' from incompatible pointer type [-Wincompatible-pointer-types]
-# openct-0.6.20/src/ifd/process.c:461:61: error: passing argument 4 of 'ct_tlv_get_opaque' from incompatible pointer type [-Wincompatible-pointer-types]
-CFLAGS += "-Wno-error=incompatible-pointer-types"
diff --git a/meta-oe/recipes-support/openldap/openldap_2.6.12.bb b/meta-oe/recipes-support/openldap/openldap_2.6.13.bb
index beee1b2738..59f20d0f08 100644
--- a/meta-oe/recipes-support/openldap/openldap_2.6.12.bb
+++ b/meta-oe/recipes-support/openldap/openldap_2.6.13.bb
@@ -21,7 +21,7 @@ SRC_URI = "http://www.openldap.org/software/download/OpenLDAP/openldap-release/$
    file://0001-build-top.mk-unset-STRIP_OPTS.patch \
 "
-SRC_URI[sha256sum] = "1716ad779e85d743694c3e3b05277fb71b6a5eadca43c7a958aa62683b22208e"
+SRC_URI[sha256sum] = "d693b49517a42efb85a1a364a310aed16a53d428d1b46c0d31ef3fba78fcb656"
 DEPENDS = "util-linux groff-native"
diff --git a/meta-oe/recipes-support/opensc/opensc_0.26.1.bb b/meta-oe/recipes-support/opensc/opensc_0.27.1.bb
index 78258c965a..d659fd1bee 100644
--- a/meta-oe/recipes-support/opensc/opensc_0.26.1.bb
+++ b/meta-oe/recipes-support/opensc/opensc_0.27.1.bb
@@ -11,8 +11,8 @@ LICENSE = "LGPL-2.1-or-later"
 LIC_FILES_CHKSUM = "file://COPYING;md5=cb8aedd3bced19bd8026d96a8b6876d7"
 DEPENDS = "openssl"
-SRCREV = "043343d2df7b09d1938bc3dc313d86a96be457cc"
+SRCREV = "19868984dc4dc697af6a86d65ab32a1f19a43ea4"
-SRC_URI = "git://github.com/OpenSC/OpenSC;branch=0.26.1;protocol=https"
+SRC_URI = "git://github.com/OpenSC/OpenSC;branch=master;protocol=https"
 CVE_STATUS[CVE-2024-8443] = "fixed-version: this is fixed since 0.26.0"
@@ -36,6 +36,7 @@ PACKAGECONFIG[readline] = "--enable-readline,--disable-readline,readline"
 FILES:${PN} += "\
    ${libdir}/opensc-pkcs11.so \
    ${libdir}/pkcs11-spy.so \
+    ${datadir}/p11-kit/modules/opensc.module \
 "
 FILES:${PN}-dev += "\
    ${libdir}/onepin-opensc-pkcs11.so \
diff --git a/meta-oe/recipes-support/pcp/pcp-native_6.3.8.bb b/meta-oe/recipes-support/pcp/pcp-native_6.3.8.bb
index e90efea9cb..c4064d8330 100644
--- a/meta-oe/recipes-support/pcp/pcp-native_6.3.8.bb
+++ b/meta-oe/recipes-support/pcp/pcp-native_6.3.8.bb
@@ -10,8 +10,8 @@ export PCP_BIN_DIR = "${D}/usr/bin"
 B = "${S}"
 do_configure:prepend() {
-    export SED=${TMPDIR}/hosttools/sed
+    export SED=${HOSTTOOLS_DIR}/sed
-    export AR=${TMPDIR}/hosttools/ar
+    export AR=${HOSTTOOLS_DIR}/ar
 #    export PYTHON=python3
    
    rm -rf ${S}/include/pcp/configsz.h
@@ -25,7 +25,7 @@ do_compile:prepend() {
           -e "s,#undef PM_SIZEOF_TIME_T,,g" \
           ${S}/src/include/pcp/config.h.in
-    export AR=${TMPDIR}/hosttools/ar
+    export AR=${HOSTTOOLS_DIR}/ar
 #    export PYTHON=python3
 }
diff --git a/meta-oe/recipes-support/pcp/pcp_6.3.8.bb b/meta-oe/recipes-support/pcp/pcp_6.3.8.bb
index 65efac06be..bf1d728b7c 100644
--- a/meta-oe/recipes-support/pcp/pcp_6.3.8.bb
+++ b/meta-oe/recipes-support/pcp/pcp_6.3.8.bb
@@ -61,7 +61,7 @@ do_configure:prepend () {
    cp ${UNPACKDIR}/config.linux ${B}
    rm -rf ${S}/include/pcp/configsz.h
    rm -rf ${S}/include/pcp/platformsz.h
-    export SED=${TMPDIR}/hosttools/sed
+    export SED=${HOSTTOOLS_DIR}/sed
    export PYTHON=python3
 }
diff --git a/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.0.3.bb b/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.0.3.bb
index 169630d319..9e3c98bb97 100644
--- a/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.0.3.bb
+++ b/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.0.3.bb
@@ -34,7 +34,7 @@ PACKAGES = "${PN} ${PN}-dbg ${PN}-dev ${PN}-lib ${PN}-doc ${PN}-spy ${PN}-spy-de
 RRECOMMENDS:${PN} = "ccid"
 RRECOMMENDS:${PN}:class-native = ""
-RPROVIDES:${PN}:class-native += "pcsc-lite-lib-native"
+RPROVIDES:${PN}:append:class-native = " pcsc-lite-lib-native"
 FILES:${PN} = "${sbindir}/pcscd \
               ${datadir}/polkit-1"
diff --git a/meta-oe/recipes-support/pidgin/pidgin_2.14.14.bb b/meta-oe/recipes-support/pidgin/pidgin_2.14.14.bb
index 13a22f6e59..af44864fa9 100644
--- a/meta-oe/recipes-support/pidgin/pidgin_2.14.14.bb
+++ b/meta-oe/recipes-support/pidgin/pidgin_2.14.14.bb
@@ -14,7 +14,6 @@ SRC_URI = "\
 SRC_URI[sha256sum] = "0ffc9994def10260f98a55cd132deefa8dc4a9835451cc0e982747bd458e2356"
-CVE_STATUS[CVE-2010-1624] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
 CVE_STATUS[CVE-2011-3594] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions."
 PACKAGECONFIG ??= "gnutls consoleui avahi dbus idn nss \
@@ -51,6 +50,7 @@ EXTRA_OECONF = " \
    --disable-farstream \
    --disable-vv \
 "
+CACHED_CONFIGUREVARS += "ac_cv_prog_cc_c23=no"
 # CONFIG_ARGS is used to display build info. Replace full paths by reproducible
 # variables ($S, $WORKDIR)
diff --git a/meta-oe/recipes-support/pkcs11-provider/pkcs11-provider_1.1.bb b/meta-oe/recipes-support/pkcs11-provider/pkcs11-provider_1.2.bb
index 015c2287ef..1bdb4445e5 100644
--- a/meta-oe/recipes-support/pkcs11-provider/pkcs11-provider_1.1.bb
+++ b/meta-oe/recipes-support/pkcs11-provider/pkcs11-provider_1.2.bb
@@ -15,7 +15,7 @@ DEPENDS = "\
    p11-kit \
 "
-SRCREV = "acb7086e44849d019956233348046c4f07c0670b"
+SRCREV = "c7a5c8b62a0ff012b16574f01651254ef7e664ee"
 SRC_URI = "git://github.com/latchset/${BPN}.git;branch=main;protocol=https"
diff --git a/meta-oe/recipes-support/poco/poco/0001-cppignore.lnx-Ignore-PKCS12-and-testLaunch-test.patch b/meta-oe/recipes-support/poco/poco/0001-cppignore.lnx-Ignore-PKCS12-and-testLaunch-test.patch
index 8575797e89..f8eadb3ee6 100644
--- a/meta-oe/recipes-support/poco/poco/0001-cppignore.lnx-Ignore-PKCS12-and-testLaunch-test.patch
+++ b/meta-oe/recipes-support/poco/poco/0001-cppignore.lnx-Ignore-PKCS12-and-testLaunch-test.patch
@@ -17,14 +17,14 @@ Updated comment and content after fixing some tests.
 Left only MongoDBTest.testArray on ignore list, untested.
 ---
- cppignore.lnx | 9 +++++++++
+ cppignore.lnx | 1 +
- 1 file changed, 9 insertions(+)
+ 1 file changed, 1 insertion(+)
 diff --git a/cppignore.lnx b/cppignore.lnx
 index b3288d474..9aad48ca5 100644
 --- a/cppignore.lnx
 +++ b/cppignore.lnx
-@@ -30,3 +30,4 @@ CppUnit::TestCaller<HTTPSClientSessionTest>.testProxy
+@@ -35,3 +35,4 @@ CppUnit::TestCaller<HTTPSClientSessionTest>.testProxy
 CppUnit::TestCaller<HTTPSStreamFactoryTest>.testProxy
 CppUnit::TestCaller<DNSTest>.testHostByAddress
 CppUnit::TestCaller<DNSTest>.testHostByName
diff --git a/meta-oe/recipes-support/poco/poco/0002-DataTest-disable-testSQLChannel-test.patch b/meta-oe/recipes-support/poco/poco/0002-DataTest-disable-testSQLChannel-test.patch
index 7628a8625a..38028c1cf8 100644
--- a/meta-oe/recipes-support/poco/poco/0002-DataTest-disable-testSQLChannel-test.patch
+++ b/meta-oe/recipes-support/poco/poco/0002-DataTest-disable-testSQLChannel-test.patch
@@ -15,7 +15,7 @@ diff --git a/Data/testsuite/src/DataTest.cpp b/Data/testsuite/src/DataTest.cpp
 index e18b87edc..60fd266c3 100644
 --- a/Data/testsuite/src/DataTest.cpp
 +++ b/Data/testsuite/src/DataTest.cpp
-@@ -1648,7 +1648,7 @@ CppUnit::Test* DataTest::suite()
+@@ -1659,7 +1659,7 @@ CppUnit::Test* DataTest::suite()
        CppUnit_addTest(pSuite, DataTest, testExternalBindingAndExtraction);
        CppUnit_addTest(pSuite, DataTest, testTranscode);
        CppUnit_addTest(pSuite, DataTest, testSQLParse);
diff --git a/meta-oe/recipes-support/poco/poco/0003-quill-rdtsc-fallback-for-32-bit-powerpc.patch b/meta-oe/recipes-support/poco/poco/0003-quill-rdtsc-fallback-for-32-bit-powerpc.patch
new file mode 100644
index 0000000000..293321bfa8
--- /dev/null
+++ b/meta-oe/recipes-support/poco/poco/0003-quill-rdtsc-fallback-for-32-bit-powerpc.patch
@@ -0,0 +1,35 @@
+From dce2cc2886a9097971856e69737cc5c05c9239ea Mon Sep 17 00:00:00 2001
+From: Peter Marko <peter.marko@siemens.com>
+Date: Wed, 8 Apr 2026 10:54:25 +0200
+Subject: [PATCH] quill: use soft rdtsc fallback on 32-bit PowerPC
+Quill's rdtsc helper already avoids __rdtsc() on ARM and PPC64, but
+32-bit PowerPC was not included in that guard. On powerpc targets this
+falls through to the x86-specific intrinsic and fails with:
+  error: '__rdtsc' was not declared in this scope
+Treat common 32-bit PowerPC compiler define the same way as PPC64 and
+use the existing steady_clock-based fallback.
+Upstream-Status: Submitted [https://github.com/odygrd/quill/pull/911]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ dependencies/quill/include/quill/core/Rdtsc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/dependencies/quill/include/quill/core/Rdtsc.h b/dependencies/quill/include/quill/core/Rdtsc.h
+index 3d0ae9f26..67f26cb89 100644
+--- a/dependencies/quill/include/quill/core/Rdtsc.h
+++ b/dependencies/quill/include/quill/core/Rdtsc.h
+@@ -95,7 +95,7 @@ QUILL_NODISCARD QUILL_ATTRIBUTE_HOT inline uint64_t rdtsc() noexcept
+   __asm__ volatile("stck %0" : "=Q"(tsc) : : "cc");
+   return tsc;
+ }
+-#elif (defined(_M_ARM) || defined(_M_ARM64) || defined(__PPC64__))
+#elif (defined(_M_ARM) || defined(_M_ARM64) || defined(__PPC64__) || defined(__PPC__))
+ QUILL_NODISCARD QUILL_ATTRIBUTE_HOT inline uint64_t rdtsc() noexcept
+ {
+   // soft failover
+-- 
+2.47.2
diff --git a/meta-oe/recipes-support/poco/poco_1.15.0.bb b/meta-oe/recipes-support/poco/poco_1.15.2.bb
index a22694031a..5a873a1d85 100644
--- a/meta-oe/recipes-support/poco/poco_1.15.0.bb
+++ b/meta-oe/recipes-support/poco/poco_1.15.2.bb
@@ -11,9 +11,10 @@ DEPENDS = "libpcre2 utf8proc zlib"
 SRC_URI = "git://github.com/pocoproject/poco.git;branch=poco-${PV};protocol=https;tag=poco-${PV}-release \
           file://0001-cppignore.lnx-Ignore-PKCS12-and-testLaunch-test.patch \
           file://0002-DataTest-disable-testSQLChannel-test.patch \
+           file://0003-quill-rdtsc-fallback-for-32-bit-powerpc.patch \
           file://run-ptest \
           "
-SRCREV = "52c558fbcda0578467e4f59c96961eb629ed3c77"
+SRCREV = "afbb1ab68f29eec7079e2fdfa04b3efdbec6529d"
 UPSTREAM_CHECK_GITTAGREGEX = "poco-(?P<pver>\d+(\.\d+)+)"
@@ -23,7 +24,7 @@ inherit cmake ptest
 # By default the most commonly used poco components are built
 # Foundation is built anyway and doesn't need to be listed explicitly
 # these don't have dependencies outside oe-core
-PACKAGECONFIG ??= "XML JSON PDF Util Net NetSSL Crypto JWT Data DataPostgreSQL DataSQLite DNSSDAvahi Zip Encodings Prometheus"
+PACKAGECONFIG ??= "XML JSON PDF Util Net NetSSL Crypto JWT Data DataPostgreSQL DataSQLite DNSSDAvahi Zip Encodings Prometheus FastLogger"
 # MongoDB does not build for all architectures yet keep in sync with COMPATIBLE_HOST list in mongodb recipe
 # and mongodb needs meta-python enabled as well
 PACKAGECONFIG:remove:riscv32 = "MongoDB"
@@ -48,6 +49,7 @@ PACKAGECONFIG[DNSSDAvahi] = "-DENABLE_DNSSD=ON -DENABLE_DNSSD_AVAHI=ON,-DENABLE_
 PACKAGECONFIG[Zip] = "-DENABLE_ZIP=ON,-DENABLE_ZIP=OFF"
 PACKAGECONFIG[Encodings] = "-DENABLE_ENCODINGS=ON,-DENABLE_ENCODINGS=OFF"
 PACKAGECONFIG[Prometheus] = "-DENABLE_PROMETHEUS=ON,-DENABLE_PROMETHEUS=OFF"
+PACKAGECONFIG[FastLogger] = "-DENABLE_FASTLOGGER=ON,-DENABLE_FASTLOGGER=OFF"
 # Additional components not build by default,
 # they might have dependencies not included in oe-core
@@ -74,11 +76,6 @@ EXTRA_OECMAKE:append:class-native = " -DPOCO_UNBUNDLED=OFF"
 # do not use rpath
 EXTRA_OECMAKE:append = " -DCMAKE_SKIP_RPATH=ON"
-LDFLAGS:append:riscv32 = "${@bb.utils.contains('PACKAGECONFIG', 'Prometheus', ' -Wl,--no-as-needed -latomic -Wl,--as-needed', '', d)}"
-LDFLAGS:append:mips = "${@bb.utils.contains('PACKAGECONFIG', 'Prometheus', ' -Wl,--no-as-needed -latomic -Wl,--as-needed', '', d)}"
-LDFLAGS:append:powerpc = "${@bb.utils.contains('PACKAGECONFIG', 'Prometheus', ' -Wl,--no-as-needed -latomic -Wl,--as-needed', '', d)}"
-LDFLAGS:append:x86 = "${@bb.utils.contains('PACKAGECONFIG', 'Prometheus', ' -Wl,--no-as-needed -latomic -Wl,--as-needed', '', d)}"
 python populate_packages:prepend () {
    poco_libdir = d.expand('${libdir}')
    pn = d.getVar("PN")
@@ -126,12 +123,8 @@ PACKAGES_DYNAMIC = "poco-.*"
 ALLOW_EMPTY:${PN} = "1"
 # cppunit and datatest is only built if tests are enabled
-# Upstream only ships libCppUnit.so.1 + symlink libCppUnit.so (no patch version),
+PACKAGES =+ "${PN}-cppunit ${PN}-datatest"
-# so split: runtime in poco-cppunit, dev symlink in poco-cppunit-dev
+FILES:${PN}-cppunit += "${libdir}/libCppUnit.so*"
-PACKAGES =+ "${PN}-cppunit-dev ${PN}-cppunit ${PN}-datatest"
-FILES:${PN}-cppunit-dev += "${libdir}/libCppUnit.so"
-RDEPENDS:${PN}-cppunit-dev += "${PN}-cppunit"
-FILES:${PN}-cppunit += "${libdir}/libCppUnit.so.1"
 ALLOW_EMPTY:${PN}-cppunit = "1"
 FILES:${PN}-datatest += "${libdir}/libPocoDataTest.so*"
 ALLOW_EMPTY:${PN}-datatest = "1"
diff --git a/meta-oe/recipes-support/systemd-netlogd/systemd-netlogd/0001-Fix-const-correctness-for-pointer-variables-to-refer.patch b/meta-oe/recipes-support/systemd-netlogd/systemd-netlogd/0001-Fix-const-correctness-for-pointer-variables-to-refer.patch
new file mode 100644
index 0000000000..190baff606
--- /dev/null
+++ b/meta-oe/recipes-support/systemd-netlogd/systemd-netlogd/0001-Fix-const-correctness-for-pointer-variables-to-refer.patch
@@ -0,0 +1,60 @@
+From 515e23b37ad1400bfb73797771c4f0fd78655328 Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Wed, 15 Apr 2026 10:52:05 -0700
+Subject: [PATCH] Fix const-correctness for pointer variables to referred
+ strings
+Mark pointer variables 'e' as 'const char *' in
+config_parse_netlog_remote_address,file_in_same_dir, and
+socket_address_parse, since they point to memory they do not
+own or modify.
+Upstream-Status: Submitted [https://github.com/systemd/systemd-netlogd/pull/148]
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ src/netlog/netlog-conf.c | 2 +-
+ src/share/path-util.c    | 3 ++-
+ src/share/socket-util.c  | 3 ++-
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+diff --git a/src/netlog/netlog-conf.c b/src/netlog/netlog-conf.c
+index a4cf0da..59bdd23 100644
+--- a/src/netlog/netlog-conf.c
+++ b/src/netlog/netlog-conf.c
+@@ -22,7 +22,7 @@ int config_parse_netlog_remote_address(const char *unit,
+                                        void *data,
+                                        void *userdata) {
+         Manager *m = userdata;
+-        char *e;
+        const char *e;
+         int r;
+         assert(filename);
+diff --git a/src/share/path-util.c b/src/share/path-util.c
+index dda7ec6..ad6f24a 100644
+--- a/src/share/path-util.c
+++ b/src/share/path-util.c
+@@ -327,7 +327,8 @@ bool path_is_safe(const char *p) {
+ }
+ char *file_in_same_dir(const char *path, const char *filename) {
+-        char *e, *ret;
+        const char *e;
+        char *ret;
+         size_t k;
+         assert(path);
+diff --git a/src/share/socket-util.c b/src/share/socket-util.c
+index ae33338..5a6284b 100644
+--- a/src/share/socket-util.c
+++ b/src/share/socket-util.c
+@@ -33,7 +33,8 @@
+ #include "util.h"
+ int socket_address_parse(SocketAddress *a, const char *s) {
+-        char *e, *n;
+        const char *e;
+        char *n;
+         unsigned u;
+         int r;
diff --git a/meta-oe/recipes-support/systemd-netlogd/systemd-netlogd_1.4.4.bb b/meta-oe/recipes-support/systemd-netlogd/systemd-netlogd_1.4.5.bb
index 019098fdf7..c52940ec70 100644
--- a/meta-oe/recipes-support/systemd-netlogd/systemd-netlogd_1.4.4.bb
+++ b/meta-oe/recipes-support/systemd-netlogd/systemd-netlogd_1.4.5.bb
@@ -3,8 +3,10 @@ SUMMARY = "Forwards messages from the journal to other hosts over the network us
 LICENSE = "LGPL-2.1-or-later"
 LIC_FILES_CHKSUM = "file://LICENSE.LGPL2.1;md5=4fbd65380cdd255951079008b364516c"
-SRC_URI = "git://github.com/systemd/systemd-netlogd.git;protocol=https;branch=main"
+SRC_URI = "git://github.com/systemd/systemd-netlogd.git;protocol=https;branch=main;tag=v${PV} \
-SRCREV = "b03cc3b1a75048c7cf19467d8918a4b7320767e6"
+           file://0001-Fix-const-correctness-for-pointer-variables-to-refer.patch \
+                  "
+SRCREV = "20534091417686d1185acb3f29e93944d8663c4b"
 inherit meson systemd pkgconfig useradd features_check
diff --git a/meta-oe/recipes-support/tbb/tbb_2022.3.0.bb b/meta-oe/recipes-support/tbb/tbb_2022.3.0.bb
index 01115e7e4d..440b6e0f46 100644
--- a/meta-oe/recipes-support/tbb/tbb_2022.3.0.bb
+++ b/meta-oe/recipes-support/tbb/tbb_2022.3.0.bb
@@ -17,6 +17,7 @@ SRCREV = "f1862f38f83568d96e814e469ab61f88336cc595"
 SRC_URI = "git://github.com/oneapi-src/oneTBB.git;protocol=https;branch=${BRANCH} \
          "
+LDFLAGS += "${@bb.utils.contains('DISTRO_FEATURES', 'ld-is-lld', ' -Wl,--undefined-version', '', d)}"
 inherit cmake pkgconfig
diff --git a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools-crates.inc b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools-crates.inc
index e06fc31905..3876cb88cc 100644
--- a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools-crates.inc
+++ b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools-crates.inc
@@ -2,281 +2,381 @@
 # from Cargo.lock
 SRC_URI += " \
-    crate://crates.io/adler/1.0.2 \
+    crate://crates.io/adler2/2.0.1 \
-    crate://crates.io/aho-corasick/1.1.3 \
+    crate://crates.io/aho-corasick/1.1.4 \
-    crate://crates.io/anstream/0.6.15 \
+    crate://crates.io/allocator-api2/0.2.21 \
-    crate://crates.io/anstyle/1.0.8 \
+    crate://crates.io/anstream/0.6.21 \
-    crate://crates.io/anstyle-parse/0.2.5 \
+    crate://crates.io/anstyle/1.0.13 \
-    crate://crates.io/anstyle-query/1.1.1 \
+    crate://crates.io/anstyle-parse/0.2.7 \
-    crate://crates.io/anstyle-wincon/3.0.4 \
+    crate://crates.io/anstyle-query/1.1.5 \
-    crate://crates.io/anyhow/1.0.86 \
+    crate://crates.io/anstyle-wincon/3.0.11 \
-    crate://crates.io/atty/0.2.14 \
+    crate://crates.io/anyhow/1.0.100 \
-    crate://crates.io/autocfg/1.3.0 \
+    crate://crates.io/autocfg/1.5.0 \
    crate://crates.io/base64/0.22.1 \
-    crate://crates.io/bindgen/0.69.4 \
+    crate://crates.io/bindgen/0.72.1 \
-    crate://crates.io/bitflags/1.3.2 \
+    crate://crates.io/bitflags/2.10.0 \
-    crate://crates.io/bitflags/2.6.0 \
+    crate://crates.io/bumpalo/3.19.0 \
-    crate://crates.io/bytemuck/1.16.3 \
+    crate://crates.io/bytemuck/1.24.0 \
    crate://crates.io/byteorder/1.5.0 \
    crate://crates.io/cassowary/0.3.0 \
+    crate://crates.io/castaway/0.2.4 \
    crate://crates.io/cexpr/0.6.0 \
-    crate://crates.io/cfg-if/1.0.0 \
+    crate://crates.io/cfg-if/1.0.4 \
    crate://crates.io/cfg_aliases/0.2.1 \
    crate://crates.io/clang-sys/1.8.1 \
-    crate://crates.io/clap/4.5.13 \
+    crate://crates.io/clap/4.5.52 \
-    crate://crates.io/clap_builder/4.5.13 \
+    crate://crates.io/clap_builder/4.5.52 \
-    crate://crates.io/clap_lex/0.7.2 \
+    crate://crates.io/clap_lex/0.7.6 \
-    crate://crates.io/colorchoice/1.0.2 \
+    crate://crates.io/colorchoice/1.0.4 \
-    crate://crates.io/console/0.15.8 \
+    crate://crates.io/compact_str/0.8.1 \
+    crate://crates.io/console/0.16.1 \
    crate://crates.io/crc32c/0.6.8 \
-    crate://crates.io/crc32fast/1.4.2 \
+    crate://crates.io/crc32fast/1.5.0 \
-    crate://crates.io/data-encoding/2.6.0 \
+    crate://crates.io/darling/0.20.11 \
-    crate://crates.io/devicemapper/0.34.3 \
+    crate://crates.io/darling_core/0.20.11 \
-    crate://crates.io/devicemapper-sys/0.3.0 \
+    crate://crates.io/darling_macro/0.20.11 \
+    crate://crates.io/data-encoding/2.9.0 \
+    crate://crates.io/devicemapper/0.34.5 \
+    crate://crates.io/devicemapper-sys/0.3.3 \
    crate://crates.io/downcast/0.11.0 \
-    crate://crates.io/duct/0.13.7 \
+    crate://crates.io/duct/1.1.1 \
-    crate://crates.io/either/1.13.0 \
+    crate://crates.io/either/1.15.0 \
-    crate://crates.io/encode_unicode/0.3.6 \
+    crate://crates.io/encode_unicode/1.0.0 \
-    crate://crates.io/env_filter/0.1.2 \
+    crate://crates.io/env_filter/0.1.4 \
    crate://crates.io/env_logger/0.8.4 \
-    crate://crates.io/env_logger/0.11.5 \
+    crate://crates.io/env_logger/0.11.8 \
-    crate://crates.io/errno/0.3.9 \
+    crate://crates.io/equivalent/1.0.2 \
+    crate://crates.io/errno/0.3.14 \
    crate://crates.io/exitcode/1.1.2 \
-    crate://crates.io/fastrand/2.1.0 \
+    crate://crates.io/fastrand/2.3.0 \
-    crate://crates.io/fixedbitset/0.4.2 \
+    crate://crates.io/fixedbitset/0.5.7 \
-    crate://crates.io/flate2/1.0.31 \
+    crate://crates.io/flate2/1.1.5 \
-    crate://crates.io/fragile/2.0.0 \
+    crate://crates.io/fnv/1.0.7 \
-    crate://crates.io/getrandom/0.2.15 \
+    crate://crates.io/foldhash/0.1.5 \
-    crate://crates.io/glob/0.3.1 \
+    crate://crates.io/fragile/2.0.1 \
-    crate://crates.io/hermit-abi/0.1.19 \
+    crate://crates.io/getrandom/0.2.16 \
+    crate://crates.io/getrandom/0.3.4 \
+    crate://crates.io/glob/0.3.3 \
+    crate://crates.io/hashbrown/0.15.5 \
+    crate://crates.io/heck/0.5.0 \
    crate://crates.io/hermit-abi/0.3.9 \
-    crate://crates.io/humantime/2.1.0 \
+    crate://crates.io/hermit-abi/0.5.2 \
-    crate://crates.io/indicatif/0.17.8 \
+    crate://crates.io/ident_case/1.0.1 \
-    crate://crates.io/instant/0.1.13 \
+    crate://crates.io/indicatif/0.18.3 \
+    crate://crates.io/indoc/2.0.7 \
+    crate://crates.io/instability/0.3.9 \
+    crate://crates.io/io-lifetimes/1.0.11 \
+    crate://crates.io/io-uring/0.7.11 \
    crate://crates.io/iovec/0.1.4 \
-    crate://crates.io/is_terminal_polyfill/1.70.1 \
+    crate://crates.io/is_terminal_polyfill/1.70.2 \
-    crate://crates.io/itertools/0.12.1 \
+    crate://crates.io/itertools/0.13.0 \
-    crate://crates.io/lazy_static/1.5.0 \
+    crate://crates.io/itoa/1.0.15 \
-    crate://crates.io/lazycell/1.3.0 \
+    crate://crates.io/jiff/0.2.16 \
-    crate://crates.io/libc/0.2.155 \
+    crate://crates.io/jiff-static/0.2.16 \
-    crate://crates.io/libloading/0.8.5 \
+    crate://crates.io/js-sys/0.3.82 \
+    crate://crates.io/libc/0.2.177 \
+    crate://crates.io/libloading/0.8.9 \
+    crate://crates.io/libredox/0.1.10 \
    crate://crates.io/libudev-sys/0.1.4 \
-    crate://crates.io/linux-raw-sys/0.4.14 \
+    crate://crates.io/linux-raw-sys/0.11.0 \
-    crate://crates.io/log/0.4.22 \
+    crate://crates.io/log/0.4.28 \
-    crate://crates.io/memchr/2.7.4 \
+    crate://crates.io/lru/0.12.5 \
+    crate://crates.io/memchr/2.7.6 \
    crate://crates.io/minimal-lexical/0.2.1 \
-    crate://crates.io/miniz_oxide/0.7.4 \
+    crate://crates.io/miniz_oxide/0.8.9 \
-    crate://crates.io/mockall/0.13.0 \
+    crate://crates.io/mockall/0.13.1 \
-    crate://crates.io/mockall_derive/0.13.0 \
+    crate://crates.io/mockall_derive/0.13.1 \
-    crate://crates.io/nix/0.29.0 \
+    crate://crates.io/nix/0.30.1 \
    crate://crates.io/nom/7.1.3 \
+    crate://crates.io/nom/8.0.0 \
    crate://crates.io/num-derive/0.4.2 \
    crate://crates.io/num-traits/0.2.19 \
-    crate://crates.io/num_cpus/1.16.0 \
+    crate://crates.io/num_cpus/1.17.0 \
-    crate://crates.io/number_prefix/0.4.0 \
+    crate://crates.io/numtoa/0.2.4 \
-    crate://crates.io/numtoa/0.1.0 \
+    crate://crates.io/once_cell/1.21.3 \
-    crate://crates.io/once_cell/1.19.0 \
+    crate://crates.io/once_cell_polyfill/1.70.2 \
-    crate://crates.io/os_pipe/1.2.1 \
+    crate://crates.io/os_pipe/1.2.3 \
-    crate://crates.io/pkg-config/0.3.30 \
+    crate://crates.io/paste/1.0.15 \
-    crate://crates.io/portable-atomic/1.11.0 \
+    crate://crates.io/pkg-config/0.3.32 \
-    crate://crates.io/ppv-lite86/0.2.20 \
+    crate://crates.io/portable-atomic/1.11.1 \
-    crate://crates.io/predicates/3.1.2 \
+    crate://crates.io/portable-atomic-util/0.2.4 \
-    crate://crates.io/predicates-core/1.0.8 \
+    crate://crates.io/ppv-lite86/0.2.21 \
-    crate://crates.io/predicates-tree/1.0.11 \
+    crate://crates.io/predicates/3.1.3 \
-    crate://crates.io/proc-macro2/1.0.86 \
+    crate://crates.io/predicates-core/1.0.9 \
-    crate://crates.io/quick-xml/0.36.1 \
+    crate://crates.io/predicates-tree/1.0.12 \
+    crate://crates.io/prettyplease/0.2.37 \
+    crate://crates.io/proc-macro2/1.0.103 \
+    crate://crates.io/quick-xml/0.38.4 \
    crate://crates.io/quickcheck/1.0.3 \
-    crate://crates.io/quickcheck_macros/1.0.0 \
+    crate://crates.io/quickcheck_macros/1.1.0 \
-    crate://crates.io/quote/1.0.36 \
+    crate://crates.io/quote/1.0.42 \
+    crate://crates.io/r-efi/5.3.0 \
    crate://crates.io/rand/0.8.5 \
-    crate://crates.io/rand_chacha/0.3.1 \
+    crate://crates.io/rand/0.9.2 \
+    crate://crates.io/rand_chacha/0.9.0 \
    crate://crates.io/rand_core/0.6.4 \
-    crate://crates.io/rangemap/1.5.1 \
+    crate://crates.io/rand_core/0.9.3 \
-    crate://crates.io/redox_syscall/0.2.16 \
+    crate://crates.io/rangemap/1.7.0 \
+    crate://crates.io/ratatui/0.29.0 \
+    crate://crates.io/redox_syscall/0.5.18 \
    crate://crates.io/redox_termios/0.1.3 \
-    crate://crates.io/regex/1.10.6 \
+    crate://crates.io/regex/1.12.2 \
-    crate://crates.io/regex-automata/0.4.7 \
+    crate://crates.io/regex-automata/0.4.13 \
-    crate://crates.io/regex-syntax/0.8.4 \
+    crate://crates.io/regex-syntax/0.8.8 \
-    crate://crates.io/retry/2.0.0 \
+    crate://crates.io/retry/2.1.0 \
-    crate://crates.io/roaring/0.10.6 \
+    crate://crates.io/roaring/0.11.2 \
-    crate://crates.io/rustc-hash/1.1.0 \
+    crate://crates.io/rustc-hash/2.1.1 \
-    crate://crates.io/rustc_version/0.4.0 \
+    crate://crates.io/rustc_version/0.4.1 \
-    crate://crates.io/rustix/0.38.34 \
+    crate://crates.io/rustix/1.1.2 \
-    crate://crates.io/safemem/0.3.3 \
+    crate://crates.io/rustversion/1.0.22 \
-    crate://crates.io/semver/1.0.23 \
+    crate://crates.io/ryu/1.0.20 \
-    crate://crates.io/serde/1.0.204 \
+    crate://crates.io/semver/1.0.27 \
-    crate://crates.io/serde_derive/1.0.204 \
+    crate://crates.io/serde/1.0.228 \
-    crate://crates.io/shared_child/1.0.1 \
+    crate://crates.io/serde_core/1.0.228 \
+    crate://crates.io/serde_derive/1.0.228 \
+    crate://crates.io/shared_child/1.1.1 \
+    crate://crates.io/shared_thread/0.2.0 \
    crate://crates.io/shlex/1.3.0 \
+    crate://crates.io/sigchld/0.2.4 \
+    crate://crates.io/signal-hook/0.3.18 \
+    crate://crates.io/signal-hook-registry/1.4.6 \
+    crate://crates.io/simd-adler32/0.3.7 \
+    crate://crates.io/static_assertions/1.1.0 \
    crate://crates.io/strsim/0.11.1 \
-    crate://crates.io/syn/1.0.109 \
+    crate://crates.io/strum/0.26.3 \
-    crate://crates.io/syn/2.0.72 \
+    crate://crates.io/strum_macros/0.26.4 \
-    crate://crates.io/tempfile/3.11.0 \
+    crate://crates.io/syn/2.0.110 \
-    crate://crates.io/termion/1.5.6 \
+    crate://crates.io/tempfile/3.23.0 \
-    crate://crates.io/termtree/0.4.1 \
+    crate://crates.io/termion/4.0.5 \
-    crate://crates.io/thiserror/1.0.63 \
+    crate://crates.io/termtree/0.5.1 \
-    crate://crates.io/thiserror-impl/1.0.63 \
+    crate://crates.io/thiserror/2.0.17 \
-    crate://crates.io/threadpool/1.8.1 \
+    crate://crates.io/thiserror-impl/2.0.17 \
-    crate://crates.io/tui/0.19.0 \
+    crate://crates.io/udev/0.9.3 \
-    crate://crates.io/udev/0.7.0 \
+    crate://crates.io/unicode-ident/1.0.22 \
-    crate://crates.io/unicode-ident/1.0.12 \
+    crate://crates.io/unicode-segmentation/1.12.0 \
-    crate://crates.io/unicode-segmentation/1.11.0 \
+    crate://crates.io/unicode-truncate/1.1.0 \
-    crate://crates.io/unicode-width/0.1.13 \
+    crate://crates.io/unicode-width/0.1.14 \
+    crate://crates.io/unicode-width/0.2.0 \
+    crate://crates.io/unit-prefix/0.5.2 \
    crate://crates.io/utf8parse/0.2.2 \
-    crate://crates.io/wasi/0.11.0+wasi-snapshot-preview1 \
+    crate://crates.io/wasi/0.11.1+wasi-snapshot-preview1 \
-    crate://crates.io/winapi/0.3.9 \
+    crate://crates.io/wasip2/1.0.1+wasi-0.2.4 \
-    crate://crates.io/winapi-i686-pc-windows-gnu/0.4.0 \
+    crate://crates.io/wasm-bindgen/0.2.105 \
-    crate://crates.io/winapi-x86_64-pc-windows-gnu/0.4.0 \
+    crate://crates.io/wasm-bindgen-macro/0.2.105 \
-    crate://crates.io/windows-sys/0.52.0 \
+    crate://crates.io/wasm-bindgen-macro-support/0.2.105 \
-    crate://crates.io/windows-sys/0.59.0 \
+    crate://crates.io/wasm-bindgen-shared/0.2.105 \
-    crate://crates.io/windows-targets/0.52.6 \
+    crate://crates.io/web-time/1.1.0 \
-    crate://crates.io/windows_aarch64_gnullvm/0.52.6 \
+    crate://crates.io/windows-link/0.2.1 \
-    crate://crates.io/windows_aarch64_msvc/0.52.6 \
+    crate://crates.io/windows-sys/0.48.0 \
-    crate://crates.io/windows_i686_gnu/0.52.6 \
+    crate://crates.io/windows-sys/0.60.2 \
-    crate://crates.io/windows_i686_gnullvm/0.52.6 \
+    crate://crates.io/windows-sys/0.61.2 \
-    crate://crates.io/windows_i686_msvc/0.52.6 \
+    crate://crates.io/windows-targets/0.48.5 \
-    crate://crates.io/windows_x86_64_gnu/0.52.6 \
+    crate://crates.io/windows-targets/0.53.5 \
-    crate://crates.io/windows_x86_64_gnullvm/0.52.6 \
+    crate://crates.io/windows_aarch64_gnullvm/0.48.5 \
-    crate://crates.io/windows_x86_64_msvc/0.52.6 \
+    crate://crates.io/windows_aarch64_gnullvm/0.53.1 \
-    crate://crates.io/zerocopy/0.7.35 \
+    crate://crates.io/windows_aarch64_msvc/0.48.5 \
-    crate://crates.io/zerocopy-derive/0.7.35 \
+    crate://crates.io/windows_aarch64_msvc/0.53.1 \
+    crate://crates.io/windows_i686_gnu/0.48.5 \
+    crate://crates.io/windows_i686_gnu/0.53.1 \
+    crate://crates.io/windows_i686_gnullvm/0.53.1 \
+    crate://crates.io/windows_i686_msvc/0.48.5 \
+    crate://crates.io/windows_i686_msvc/0.53.1 \
+    crate://crates.io/windows_x86_64_gnu/0.48.5 \
+    crate://crates.io/windows_x86_64_gnu/0.53.1 \
+    crate://crates.io/windows_x86_64_gnullvm/0.48.5 \
+    crate://crates.io/windows_x86_64_gnullvm/0.53.1 \
+    crate://crates.io/windows_x86_64_msvc/0.48.5 \
+    crate://crates.io/windows_x86_64_msvc/0.53.1 \
+    crate://crates.io/wit-bindgen/0.46.0 \
+    crate://crates.io/zerocopy/0.8.27 \
+    crate://crates.io/zerocopy-derive/0.8.27 \
 "
-SRC_URI[adler-1.0.2.sha256sum] = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+SRC_URI[adler2-2.0.1.sha256sum] = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
-SRC_URI[aho-corasick-1.1.3.sha256sum] = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+SRC_URI[aho-corasick-1.1.4.sha256sum] = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
-SRC_URI[anstream-0.6.15.sha256sum] = "64e15c1ab1f89faffbf04a634d5e1962e9074f2741eef6d97f3c4e322426d526"
+SRC_URI[allocator-api2-0.2.21.sha256sum] = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
-SRC_URI[anstyle-1.0.8.sha256sum] = "1bec1de6f59aedf83baf9ff929c98f2ad654b97c9510f4e70cf6f661d49fd5b1"
+SRC_URI[anstream-0.6.21.sha256sum] = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
-SRC_URI[anstyle-parse-0.2.5.sha256sum] = "eb47de1e80c2b463c735db5b217a0ddc39d612e7ac9e2e96a5aed1f57616c1cb"
+SRC_URI[anstyle-1.0.13.sha256sum] = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
-SRC_URI[anstyle-query-1.1.1.sha256sum] = "6d36fc52c7f6c869915e99412912f22093507da8d9e942ceaf66fe4b7c14422a"
+SRC_URI[anstyle-parse-0.2.7.sha256sum] = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
-SRC_URI[anstyle-wincon-3.0.4.sha256sum] = "5bf74e1b6e971609db8ca7a9ce79fd5768ab6ae46441c572e46cf596f59e57f8"
+SRC_URI[anstyle-query-1.1.5.sha256sum] = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
-SRC_URI[anyhow-1.0.86.sha256sum] = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
+SRC_URI[anstyle-wincon-3.0.11.sha256sum] = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
-SRC_URI[atty-0.2.14.sha256sum] = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+SRC_URI[anyhow-1.0.100.sha256sum] = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
-SRC_URI[autocfg-1.3.0.sha256sum] = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+SRC_URI[autocfg-1.5.0.sha256sum] = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 SRC_URI[base64-0.22.1.sha256sum] = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-SRC_URI[bindgen-0.69.4.sha256sum] = "a00dc851838a2120612785d195287475a3ac45514741da670b735818822129a0"
+SRC_URI[bindgen-0.72.1.sha256sum] = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
-SRC_URI[bitflags-1.3.2.sha256sum] = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+SRC_URI[bitflags-2.10.0.sha256sum] = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
-SRC_URI[bitflags-2.6.0.sha256sum] = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+SRC_URI[bumpalo-3.19.0.sha256sum] = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
-SRC_URI[bytemuck-1.16.3.sha256sum] = "102087e286b4677862ea56cf8fc58bb2cdfa8725c40ffb80fe3a008eb7f2fc83"
+SRC_URI[bytemuck-1.24.0.sha256sum] = "1fbdf580320f38b612e485521afda1ee26d10cc9884efaaa750d383e13e3c5f4"
 SRC_URI[byteorder-1.5.0.sha256sum] = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 SRC_URI[cassowary-0.3.0.sha256sum] = "df8670b8c7b9dae1793364eafadf7239c40d669904660c5960d74cfd80b46a53"
+SRC_URI[castaway-0.2.4.sha256sum] = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
 SRC_URI[cexpr-0.6.0.sha256sum] = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
-SRC_URI[cfg-if-1.0.0.sha256sum] = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+SRC_URI[cfg-if-1.0.4.sha256sum] = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 SRC_URI[cfg_aliases-0.2.1.sha256sum] = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 SRC_URI[clang-sys-1.8.1.sha256sum] = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
-SRC_URI[clap-4.5.13.sha256sum] = "0fbb260a053428790f3de475e304ff84cdbc4face759ea7a3e64c1edd938a7fc"
+SRC_URI[clap-4.5.52.sha256sum] = "aa8120877db0e5c011242f96806ce3c94e0737ab8108532a76a3300a01db2ab8"
-SRC_URI[clap_builder-4.5.13.sha256sum] = "64b17d7ea74e9f833c7dbf2cbe4fb12ff26783eda4782a8975b72f895c9b4d99"
+SRC_URI[clap_builder-4.5.52.sha256sum] = "02576b399397b659c26064fbc92a75fede9d18ffd5f80ca1cd74ddab167016e1"
-SRC_URI[clap_lex-0.7.2.sha256sum] = "1462739cb27611015575c0c11df5df7601141071f07518d56fcc1be504cbec97"
+SRC_URI[clap_lex-0.7.6.sha256sum] = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d"
-SRC_URI[colorchoice-1.0.2.sha256sum] = "d3fd119d74b830634cea2a0f58bbd0d54540518a14397557951e79340abc28c0"
+SRC_URI[colorchoice-1.0.4.sha256sum] = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
-SRC_URI[console-0.15.8.sha256sum] = "0e1f83fc076bd6dd27517eacdf25fef6c4dfe5f1d7448bafaaf3a26f13b5e4eb"
+SRC_URI[compact_str-0.8.1.sha256sum] = "3b79c4069c6cad78e2e0cdfcbd26275770669fb39fd308a752dc110e83b9af32"
+SRC_URI[console-0.16.1.sha256sum] = "b430743a6eb14e9764d4260d4c0d8123087d504eeb9c48f2b2a5e810dd369df4"
 SRC_URI[crc32c-0.6.8.sha256sum] = "3a47af21622d091a8f0fb295b88bc886ac74efcc613efc19f5d0b21de5c89e47"
-SRC_URI[crc32fast-1.4.2.sha256sum] = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+SRC_URI[crc32fast-1.5.0.sha256sum] = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
-SRC_URI[data-encoding-2.6.0.sha256sum] = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"
+SRC_URI[darling-0.20.11.sha256sum] = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
-SRC_URI[devicemapper-0.34.3.sha256sum] = "59209790c5d189070a52937581950947207e740fadc87f68af14f34d0eb333df"
+SRC_URI[darling_core-0.20.11.sha256sum] = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
-SRC_URI[devicemapper-sys-0.3.0.sha256sum] = "3d6681f5413e2094480381a97b8299f548c0579f07095ee20fe58e0a28cb34b5"
+SRC_URI[darling_macro-0.20.11.sha256sum] = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
+SRC_URI[data-encoding-2.9.0.sha256sum] = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
+SRC_URI[devicemapper-0.34.5.sha256sum] = "f8ca2baf05e507adafc3524fb687aa15f2f9953de808c6a4cbd57a7f2e5aa883"
+SRC_URI[devicemapper-sys-0.3.3.sha256sum] = "06421aaad10b53bd5d1fe004c26efddfaaeaa4438ff52b84a0f660b3c87d63e6"
 SRC_URI[downcast-0.11.0.sha256sum] = "1435fa1053d8b2fbbe9be7e97eca7f33d37b28409959813daefc1446a14247f1"
-SRC_URI[duct-0.13.7.sha256sum] = "e4ab5718d1224b63252cd0c6f74f6480f9ffeb117438a2e0f5cf6d9a4798929c"
+SRC_URI[duct-1.1.1.sha256sum] = "7e66e9c0c03d094e1a0ba1be130b849034aa80c3a2ab8ee94316bc809f3fa684"
-SRC_URI[either-1.13.0.sha256sum] = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+SRC_URI[either-1.15.0.sha256sum] = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
-SRC_URI[encode_unicode-0.3.6.sha256sum] = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
+SRC_URI[encode_unicode-1.0.0.sha256sum] = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
-SRC_URI[env_filter-0.1.2.sha256sum] = "4f2c92ceda6ceec50f43169f9ee8424fe2db276791afde7b2cd8bc084cb376ab"
+SRC_URI[env_filter-0.1.4.sha256sum] = "1bf3c259d255ca70051b30e2e95b5446cdb8949ac4cd22c0d7fd634d89f568e2"
 SRC_URI[env_logger-0.8.4.sha256sum] = "a19187fea3ac7e84da7dacf48de0c45d63c6a76f9490dae389aead16c243fce3"
-SRC_URI[env_logger-0.11.5.sha256sum] = "e13fa619b91fb2381732789fc5de83b45675e882f66623b7d8cb4f643017018d"
+SRC_URI[env_logger-0.11.8.sha256sum] = "13c863f0904021b108aa8b2f55046443e6b1ebde8fd4a15c399893aae4fa069f"
-SRC_URI[errno-0.3.9.sha256sum] = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
+SRC_URI[equivalent-1.0.2.sha256sum] = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+SRC_URI[errno-0.3.14.sha256sum] = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 SRC_URI[exitcode-1.1.2.sha256sum] = "de853764b47027c2e862a995c34978ffa63c1501f2e15f987ba11bd4f9bba193"
-SRC_URI[fastrand-2.1.0.sha256sum] = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
+SRC_URI[fastrand-2.3.0.sha256sum] = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
-SRC_URI[fixedbitset-0.4.2.sha256sum] = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
+SRC_URI[fixedbitset-0.5.7.sha256sum] = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
-SRC_URI[flate2-1.0.31.sha256sum] = "7f211bbe8e69bbd0cfdea405084f128ae8b4aaa6b0b522fc8f2b009084797920"
+SRC_URI[flate2-1.1.5.sha256sum] = "bfe33edd8e85a12a67454e37f8c75e730830d83e313556ab9ebf9ee7fbeb3bfb"
-SRC_URI[fragile-2.0.0.sha256sum] = "6c2141d6d6c8512188a7891b4b01590a45f6dac67afb4f255c4124dbb86d4eaa"
+SRC_URI[fnv-1.0.7.sha256sum] = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-SRC_URI[getrandom-0.2.15.sha256sum] = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+SRC_URI[foldhash-0.1.5.sha256sum] = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-SRC_URI[glob-0.3.1.sha256sum] = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+SRC_URI[fragile-2.0.1.sha256sum] = "28dd6caf6059519a65843af8fe2a3ae298b14b80179855aeb4adc2c1934ee619"
-SRC_URI[hermit-abi-0.1.19.sha256sum] = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+SRC_URI[getrandom-0.2.16.sha256sum] = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+SRC_URI[getrandom-0.3.4.sha256sum] = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+SRC_URI[glob-0.3.3.sha256sum] = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+SRC_URI[hashbrown-0.15.5.sha256sum] = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+SRC_URI[heck-0.5.0.sha256sum] = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 SRC_URI[hermit-abi-0.3.9.sha256sum] = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
-SRC_URI[humantime-2.1.0.sha256sum] = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+SRC_URI[hermit-abi-0.5.2.sha256sum] = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
-SRC_URI[indicatif-0.17.8.sha256sum] = "763a5a8f45087d6bcea4222e7b72c291a054edf80e4ef6efd2a4979878c7bea3"
+SRC_URI[ident_case-1.0.1.sha256sum] = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
-SRC_URI[instant-0.1.13.sha256sum] = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
+SRC_URI[indicatif-0.18.3.sha256sum] = "9375e112e4b463ec1b1c6c011953545c65a30164fbab5b581df32b3abf0dcb88"
+SRC_URI[indoc-2.0.7.sha256sum] = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
+SRC_URI[instability-0.3.9.sha256sum] = "435d80800b936787d62688c927b6490e887c7ef5ff9ce922c6c6050fca75eb9a"
+SRC_URI[io-lifetimes-1.0.11.sha256sum] = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
+SRC_URI[io-uring-0.7.11.sha256sum] = "fdd7bddefd0a8833b88a4b68f90dae22c7450d11b354198baee3874fd811b344"
 SRC_URI[iovec-0.1.4.sha256sum] = "b2b3ea6ff95e175473f8ffe6a7eb7c00d054240321b84c57051175fe3c1e075e"
-SRC_URI[is_terminal_polyfill-1.70.1.sha256sum] = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+SRC_URI[is_terminal_polyfill-1.70.2.sha256sum] = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
-SRC_URI[itertools-0.12.1.sha256sum] = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
+SRC_URI[itertools-0.13.0.sha256sum] = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
-SRC_URI[lazy_static-1.5.0.sha256sum] = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+SRC_URI[itoa-1.0.15.sha256sum] = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
-SRC_URI[lazycell-1.3.0.sha256sum] = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+SRC_URI[jiff-0.2.16.sha256sum] = "49cce2b81f2098e7e3efc35bc2e0a6b7abec9d34128283d7a26fa8f32a6dbb35"
-SRC_URI[libc-0.2.155.sha256sum] = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+SRC_URI[jiff-static-0.2.16.sha256sum] = "980af8b43c3ad5d8d349ace167ec8170839f753a42d233ba19e08afe1850fa69"
-SRC_URI[libloading-0.8.5.sha256sum] = "4979f22fdb869068da03c9f7528f8297c6fd2606bc3a4affe42e6a823fdb8da4"
+SRC_URI[js-sys-0.3.82.sha256sum] = "b011eec8cc36da2aab2d5cff675ec18454fad408585853910a202391cf9f8e65"
+SRC_URI[libc-0.2.177.sha256sum] = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+SRC_URI[libloading-0.8.9.sha256sum] = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+SRC_URI[libredox-0.1.10.sha256sum] = "416f7e718bdb06000964960ffa43b4335ad4012ae8b99060261aa4a8088d5ccb"
 SRC_URI[libudev-sys-0.1.4.sha256sum] = "3c8469b4a23b962c1396b9b451dda50ef5b283e8dd309d69033475fa9b334324"
-SRC_URI[linux-raw-sys-0.4.14.sha256sum] = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
+SRC_URI[linux-raw-sys-0.11.0.sha256sum] = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
-SRC_URI[log-0.4.22.sha256sum] = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+SRC_URI[log-0.4.28.sha256sum] = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
-SRC_URI[memchr-2.7.4.sha256sum] = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+SRC_URI[lru-0.12.5.sha256sum] = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
+SRC_URI[memchr-2.7.6.sha256sum] = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
 SRC_URI[minimal-lexical-0.2.1.sha256sum] = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-SRC_URI[miniz_oxide-0.7.4.sha256sum] = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
+SRC_URI[miniz_oxide-0.8.9.sha256sum] = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-SRC_URI[mockall-0.13.0.sha256sum] = "d4c28b3fb6d753d28c20e826cd46ee611fda1cf3cde03a443a974043247c065a"
+SRC_URI[mockall-0.13.1.sha256sum] = "39a6bfcc6c8c7eed5ee98b9c3e33adc726054389233e201c95dab2d41a3839d2"
-SRC_URI[mockall_derive-0.13.0.sha256sum] = "341014e7f530314e9a1fdbc7400b244efea7122662c96bfa248c31da5bfb2020"
+SRC_URI[mockall_derive-0.13.1.sha256sum] = "25ca3004c2efe9011bd4e461bd8256445052b9615405b4f7ea43fc8ca5c20898"
-SRC_URI[nix-0.29.0.sha256sum] = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+SRC_URI[nix-0.30.1.sha256sum] = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 SRC_URI[nom-7.1.3.sha256sum] = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+SRC_URI[nom-8.0.0.sha256sum] = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
 SRC_URI[num-derive-0.4.2.sha256sum] = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 SRC_URI[num-traits-0.2.19.sha256sum] = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-SRC_URI[num_cpus-1.16.0.sha256sum] = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
+SRC_URI[num_cpus-1.17.0.sha256sum] = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
-SRC_URI[number_prefix-0.4.0.sha256sum] = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
+SRC_URI[numtoa-0.2.4.sha256sum] = "6aa2c4e539b869820a2b82e1aef6ff40aa85e65decdd5185e83fb4b1249cd00f"
-SRC_URI[numtoa-0.1.0.sha256sum] = "b8f8bdf33df195859076e54ab11ee78a1b208382d3a26ec40d142ffc1ecc49ef"
+SRC_URI[once_cell-1.21.3.sha256sum] = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
-SRC_URI[once_cell-1.19.0.sha256sum] = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+SRC_URI[once_cell_polyfill-1.70.2.sha256sum] = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
-SRC_URI[os_pipe-1.2.1.sha256sum] = "5ffd2b0a5634335b135d5728d84c5e0fd726954b87111f7506a61c502280d982"
+SRC_URI[os_pipe-1.2.3.sha256sum] = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
-SRC_URI[pkg-config-0.3.30.sha256sum] = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
+SRC_URI[paste-1.0.15.sha256sum] = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
-SRC_URI[portable-atomic-1.11.0.sha256sum] = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
+SRC_URI[pkg-config-0.3.32.sha256sum] = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
-SRC_URI[ppv-lite86-0.2.20.sha256sum] = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+SRC_URI[portable-atomic-1.11.1.sha256sum] = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
-SRC_URI[predicates-3.1.2.sha256sum] = "7e9086cc7640c29a356d1a29fd134380bee9d8f79a17410aa76e7ad295f42c97"
+SRC_URI[portable-atomic-util-0.2.4.sha256sum] = "d8a2f0d8d040d7848a709caf78912debcc3f33ee4b3cac47d73d1e1069e83507"
-SRC_URI[predicates-core-1.0.8.sha256sum] = "ae8177bee8e75d6846599c6b9ff679ed51e882816914eec639944d7c9aa11931"
+SRC_URI[ppv-lite86-0.2.21.sha256sum] = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
-SRC_URI[predicates-tree-1.0.11.sha256sum] = "41b740d195ed3166cd147c8047ec98db0e22ec019eb8eeb76d343b795304fb13"
+SRC_URI[predicates-3.1.3.sha256sum] = "a5d19ee57562043d37e82899fade9a22ebab7be9cef5026b07fda9cdd4293573"
-SRC_URI[proc-macro2-1.0.86.sha256sum] = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+SRC_URI[predicates-core-1.0.9.sha256sum] = "727e462b119fe9c93fd0eb1429a5f7647394014cf3c04ab2c0350eeb09095ffa"
-SRC_URI[quick-xml-0.36.1.sha256sum] = "96a05e2e8efddfa51a84ca47cec303fac86c8541b686d37cac5efc0e094417bc"
+SRC_URI[predicates-tree-1.0.12.sha256sum] = "72dd2d6d381dfb73a193c7fca536518d7caee39fc8503f74e7dc0be0531b425c"
+SRC_URI[prettyplease-0.2.37.sha256sum] = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+SRC_URI[proc-macro2-1.0.103.sha256sum] = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
+SRC_URI[quick-xml-0.38.4.sha256sum] = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
 SRC_URI[quickcheck-1.0.3.sha256sum] = "588f6378e4dd99458b60ec275b4477add41ce4fa9f64dcba6f15adccb19b50d6"
-SRC_URI[quickcheck_macros-1.0.0.sha256sum] = "b22a693222d716a9587786f37ac3f6b4faedb5b80c23914e7303ff5a1d8016e9"
+SRC_URI[quickcheck_macros-1.1.0.sha256sum] = "f71ee38b42f8459a88d3362be6f9b841ad2d5421844f61eb1c59c11bff3ac14a"
-SRC_URI[quote-1.0.36.sha256sum] = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+SRC_URI[quote-1.0.42.sha256sum] = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f"
+SRC_URI[r-efi-5.3.0.sha256sum] = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 SRC_URI[rand-0.8.5.sha256sum] = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
-SRC_URI[rand_chacha-0.3.1.sha256sum] = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+SRC_URI[rand-0.9.2.sha256sum] = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+SRC_URI[rand_chacha-0.9.0.sha256sum] = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 SRC_URI[rand_core-0.6.4.sha256sum] = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-SRC_URI[rangemap-1.5.1.sha256sum] = "f60fcc7d6849342eff22c4350c8b9a989ee8ceabc4b481253e8946b9fe83d684"
+SRC_URI[rand_core-0.9.3.sha256sum] = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
-SRC_URI[redox_syscall-0.2.16.sha256sum] = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+SRC_URI[rangemap-1.7.0.sha256sum] = "acbbbbea733ec66275512d0b9694f34102e7d5406fdbe2ad8d21b28dce92887c"
+SRC_URI[ratatui-0.29.0.sha256sum] = "eabd94c2f37801c20583fc49dd5cd6b0ba68c716787c2dd6ed18571e1e63117b"
+SRC_URI[redox_syscall-0.5.18.sha256sum] = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 SRC_URI[redox_termios-0.1.3.sha256sum] = "20145670ba436b55d91fc92d25e71160fbfbdd57831631c8d7d36377a476f1cb"
-SRC_URI[regex-1.10.6.sha256sum] = "4219d74c6b67a3654a9fbebc4b419e22126d13d2f3c4a07ee0cb61ff79a79619"
+SRC_URI[regex-1.12.2.sha256sum] = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
-SRC_URI[regex-automata-0.4.7.sha256sum] = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
+SRC_URI[regex-automata-0.4.13.sha256sum] = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
-SRC_URI[regex-syntax-0.8.4.sha256sum] = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
+SRC_URI[regex-syntax-0.8.8.sha256sum] = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
-SRC_URI[retry-2.0.0.sha256sum] = "9166d72162de3575f950507683fac47e30f6f2c3836b71b7fbc61aa517c9c5f4"
+SRC_URI[retry-2.1.0.sha256sum] = "a1e211f878258887b3e65dd3c8ff9f530fe109f441a117ee0cdc27f341355032"
-SRC_URI[roaring-0.10.6.sha256sum] = "8f4b84ba6e838ceb47b41de5194a60244fac43d9fe03b71dbe8c5a201081d6d1"
+SRC_URI[roaring-0.11.2.sha256sum] = "f08d6a905edb32d74a5d5737a0c9d7e950c312f3c46cb0ca0a2ca09ea11878a0"
-SRC_URI[rustc-hash-1.1.0.sha256sum] = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+SRC_URI[rustc-hash-2.1.1.sha256sum] = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
-SRC_URI[rustc_version-0.4.0.sha256sum] = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+SRC_URI[rustc_version-0.4.1.sha256sum] = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
-SRC_URI[rustix-0.38.34.sha256sum] = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
+SRC_URI[rustix-1.1.2.sha256sum] = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
-SRC_URI[safemem-0.3.3.sha256sum] = "ef703b7cb59335eae2eb93ceb664c0eb7ea6bf567079d843e09420219668e072"
+SRC_URI[rustversion-1.0.22.sha256sum] = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
-SRC_URI[semver-1.0.23.sha256sum] = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+SRC_URI[ryu-1.0.20.sha256sum] = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
-SRC_URI[serde-1.0.204.sha256sum] = "bc76f558e0cbb2a839d37354c575f1dc3fdc6546b5be373ba43d95f231bf7c12"
+SRC_URI[semver-1.0.27.sha256sum] = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
-SRC_URI[serde_derive-1.0.204.sha256sum] = "e0cd7e117be63d3c3678776753929474f3b04a43a080c744d6b0ae2a8c28e222"
+SRC_URI[serde-1.0.228.sha256sum] = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
-SRC_URI[shared_child-1.0.1.sha256sum] = "09fa9338aed9a1df411814a5b2252f7cd206c55ae9bf2fa763f8de84603aa60c"
+SRC_URI[serde_core-1.0.228.sha256sum] = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+SRC_URI[serde_derive-1.0.228.sha256sum] = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+SRC_URI[shared_child-1.1.1.sha256sum] = "1e362d9935bc50f019969e2f9ecd66786612daae13e8f277be7bfb66e8bed3f7"
+SRC_URI[shared_thread-0.2.0.sha256sum] = "52b86057fcb5423f5018e331ac04623e32d6b5ce85e33300f92c79a1973928b0"
 SRC_URI[shlex-1.3.0.sha256sum] = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+SRC_URI[sigchld-0.2.4.sha256sum] = "47106eded3c154e70176fc83df9737335c94ce22f821c32d17ed1db1f83badb1"
+SRC_URI[signal-hook-0.3.18.sha256sum] = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
+SRC_URI[signal-hook-registry-1.4.6.sha256sum] = "b2a4719bff48cee6b39d12c020eeb490953ad2443b7055bd0b21fca26bd8c28b"
+SRC_URI[simd-adler32-0.3.7.sha256sum] = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+SRC_URI[static_assertions-1.1.0.sha256sum] = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 SRC_URI[strsim-0.11.1.sha256sum] = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-SRC_URI[syn-1.0.109.sha256sum] = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+SRC_URI[strum-0.26.3.sha256sum] = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"
-SRC_URI[syn-2.0.72.sha256sum] = "dc4b9b9bf2add8093d3f2c0204471e951b2285580335de42f9d2534f3ae7a8af"
+SRC_URI[strum_macros-0.26.4.sha256sum] = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
-SRC_URI[tempfile-3.11.0.sha256sum] = "b8fcd239983515c23a32fb82099f97d0b11b8c72f654ed659363a95c3dad7a53"
+SRC_URI[syn-2.0.110.sha256sum] = "a99801b5bd34ede4cf3fc688c5919368fea4e4814a4664359503e6015b280aea"
-SRC_URI[termion-1.5.6.sha256sum] = "077185e2eac69c3f8379a4298e1e07cd36beb962290d4a51199acf0fdc10607e"
+SRC_URI[tempfile-3.23.0.sha256sum] = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
-SRC_URI[termtree-0.4.1.sha256sum] = "3369f5ac52d5eb6ab48c6b4ffdc8efbcad6b89c765749064ba298f2c68a16a76"
+SRC_URI[termion-4.0.5.sha256sum] = "3669a69de26799d6321a5aa713f55f7e2cd37bd47be044b50f2acafc42c122bb"
-SRC_URI[thiserror-1.0.63.sha256sum] = "c0342370b38b6a11b6cc11d6a805569958d54cfa061a29969c3b5ce2ea405724"
+SRC_URI[termtree-0.5.1.sha256sum] = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
-SRC_URI[thiserror-impl-1.0.63.sha256sum] = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
+SRC_URI[thiserror-2.0.17.sha256sum] = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
-SRC_URI[threadpool-1.8.1.sha256sum] = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa"
+SRC_URI[thiserror-impl-2.0.17.sha256sum] = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
-SRC_URI[tui-0.19.0.sha256sum] = "ccdd26cbd674007e649a272da4475fb666d3aa0ad0531da7136db6fab0e5bad1"
+SRC_URI[udev-0.9.3.sha256sum] = "af4e37e9ea4401fc841ff54b9ddfc9be1079b1e89434c1a6a865dd68980f7e9f"
-SRC_URI[udev-0.7.0.sha256sum] = "4ebdbbd670373442a12fe9ef7aeb53aec4147a5a27a00bbc3ab639f08f48191a"
+SRC_URI[unicode-ident-1.0.22.sha256sum] = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
-SRC_URI[unicode-ident-1.0.12.sha256sum] = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+SRC_URI[unicode-segmentation-1.12.0.sha256sum] = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
-SRC_URI[unicode-segmentation-1.11.0.sha256sum] = "d4c87d22b6e3f4a18d4d40ef354e97c90fcb14dd91d7dc0aa9d8a1172ebf7202"
+SRC_URI[unicode-truncate-1.1.0.sha256sum] = "b3644627a5af5fa321c95b9b235a72fd24cd29c648c2c379431e6628655627bf"
-SRC_URI[unicode-width-0.1.13.sha256sum] = "0336d538f7abc86d282a4189614dfaa90810dfc2c6f6427eaf88e16311dd225d"
+SRC_URI[unicode-width-0.1.14.sha256sum] = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+SRC_URI[unicode-width-0.2.0.sha256sum] = "1fc81956842c57dac11422a97c3b8195a1ff727f06e85c84ed2e8aa277c9a0fd"
+SRC_URI[unit-prefix-0.5.2.sha256sum] = "81e544489bf3d8ef66c953931f56617f423cd4b5494be343d9b9d3dda037b9a3"
 SRC_URI[utf8parse-0.2.2.sha256sum] = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
-SRC_URI[wasi-0.11.0+wasi-snapshot-preview1.sha256sum] = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+SRC_URI[wasi-0.11.1+wasi-snapshot-preview1.sha256sum] = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-SRC_URI[winapi-0.3.9.sha256sum] = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+SRC_URI[wasip2-1.0.1+wasi-0.2.4.sha256sum] = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
-SRC_URI[winapi-i686-pc-windows-gnu-0.4.0.sha256sum] = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+SRC_URI[wasm-bindgen-0.2.105.sha256sum] = "da95793dfc411fbbd93f5be7715b0578ec61fe87cb1a42b12eb625caa5c5ea60"
-SRC_URI[winapi-x86_64-pc-windows-gnu-0.4.0.sha256sum] = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+SRC_URI[wasm-bindgen-macro-0.2.105.sha256sum] = "04264334509e04a7bf8690f2384ef5265f05143a4bff3889ab7a3269adab59c2"
-SRC_URI[windows-sys-0.52.0.sha256sum] = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+SRC_URI[wasm-bindgen-macro-support-0.2.105.sha256sum] = "420bc339d9f322e562942d52e115d57e950d12d88983a14c79b86859ee6c7ebc"
-SRC_URI[windows-sys-0.59.0.sha256sum] = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+SRC_URI[wasm-bindgen-shared-0.2.105.sha256sum] = "76f218a38c84bcb33c25ec7059b07847d465ce0e0a76b995e134a45adcb6af76"
-SRC_URI[windows-targets-0.52.6.sha256sum] = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+SRC_URI[web-time-1.1.0.sha256sum] = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-SRC_URI[windows_aarch64_gnullvm-0.52.6.sha256sum] = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+SRC_URI[windows-link-0.2.1.sha256sum] = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-SRC_URI[windows_aarch64_msvc-0.52.6.sha256sum] = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+SRC_URI[windows-sys-0.48.0.sha256sum] = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-SRC_URI[windows_i686_gnu-0.52.6.sha256sum] = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+SRC_URI[windows-sys-0.60.2.sha256sum] = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-SRC_URI[windows_i686_gnullvm-0.52.6.sha256sum] = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+SRC_URI[windows-sys-0.61.2.sha256sum] = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-SRC_URI[windows_i686_msvc-0.52.6.sha256sum] = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+SRC_URI[windows-targets-0.48.5.sha256sum] = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-SRC_URI[windows_x86_64_gnu-0.52.6.sha256sum] = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+SRC_URI[windows-targets-0.53.5.sha256sum] = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-SRC_URI[windows_x86_64_gnullvm-0.52.6.sha256sum] = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+SRC_URI[windows_aarch64_gnullvm-0.48.5.sha256sum] = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-SRC_URI[windows_x86_64_msvc-0.52.6.sha256sum] = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+SRC_URI[windows_aarch64_gnullvm-0.53.1.sha256sum] = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-SRC_URI[zerocopy-0.7.35.sha256sum] = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+SRC_URI[windows_aarch64_msvc-0.48.5.sha256sum] = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-SRC_URI[zerocopy-derive-0.7.35.sha256sum] = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+SRC_URI[windows_aarch64_msvc-0.53.1.sha256sum] = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+SRC_URI[windows_i686_gnu-0.48.5.sha256sum] = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+SRC_URI[windows_i686_gnu-0.53.1.sha256sum] = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+SRC_URI[windows_i686_gnullvm-0.53.1.sha256sum] = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+SRC_URI[windows_i686_msvc-0.48.5.sha256sum] = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+SRC_URI[windows_i686_msvc-0.53.1.sha256sum] = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+SRC_URI[windows_x86_64_gnu-0.48.5.sha256sum] = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+SRC_URI[windows_x86_64_gnu-0.53.1.sha256sum] = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+SRC_URI[windows_x86_64_gnullvm-0.48.5.sha256sum] = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+SRC_URI[windows_x86_64_gnullvm-0.53.1.sha256sum] = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+SRC_URI[windows_x86_64_msvc-0.48.5.sha256sum] = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+SRC_URI[windows_x86_64_msvc-0.53.1.sha256sum] = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+SRC_URI[wit-bindgen-0.46.0.sha256sum] = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
+SRC_URI[zerocopy-0.8.27.sha256sum] = "0894878a5fa3edfd6da3f88c4805f4c8558e2b996227a3d864f47fe11e38282c"
+SRC_URI[zerocopy-derive-0.8.27.sha256sum] = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
diff --git a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools-git-crates.inc b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools-git-crates.inc
deleted file mode 100644
index ceea67c364..0000000000
--- a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools-git-crates.inc
+++ /dev/null
@@ -1,6 +0,0 @@
-SRC_URI += "\
-    git://github.com/jthornber/rio;protocol=https;nobranch=1;name=rio;destsuffix=rio;type=git-dependency \
-"
-SRCREV_FORMAT .= "_rio"
-SRCREV_rio = "2979a720f671e836302c01546f9cc9f7988610c8"
diff --git a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/0001-Define-more-ioctl-codes-on-riscv32gc-unknown-linux-g.patch b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/0001-Define-more-ioctl-codes-on-riscv32gc-unknown-linux-g.patch
deleted file mode 100644
index ed5f40a881..0000000000
--- a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/0001-Define-more-ioctl-codes-on-riscv32gc-unknown-linux-g.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 11c494b418570a3fbdfbbbdfbbc4db0108743cc7 Mon Sep 17 00:00:00 2001
-From: Dan Gohman <dev@sunfishcode.online>
-Date: Sun, 6 Apr 2025 05:22:49 -0700
-Subject: [PATCH] Define more ioctl codes on riscv32gc-unknown-linux-gnu
-Define ioctl codes including `FICLONE` and `FS_IOC32_GETVERSION` on
-riscv32gc-unknown-linux-gnu.
-Upstream-Status: Submitted [https://github.com/rust-lang/libc/pull/4382]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
- src/unix/linux_like/linux/arch/generic/mod.rs | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/src/unix/linux_like/linux/arch/generic/mod.rs b/src/unix/linux_like/linux/arch/generic/mod.rs
-index 2f437e1..db1f1e7 100644
--- a/src/unix/linux_like/linux/arch/generic/mod.rs
-+++ b/src/unix/linux_like/linux/arch/generic/mod.rs
-@@ -114,6 +114,7 @@ cfg_if! {
-                  target_arch = "x86_64",
-                  target_arch = "arm",
-                  target_arch = "aarch64",
-+                 target_arch = "riscv32",
-                  target_arch = "riscv64",
-                  target_arch = "s390x",
-                  target_arch = "csky",
-@@ -218,7 +219,10 @@ cfg_if! {
-     // where S stands for size (int, long, struct...)
-     // where T stands for type ('f','v','X'...)
-     // where N stands for NR (NumbeR)
-    if #[cfg(any(target_arch = "x86", target_arch = "arm", target_arch = "csky"))] {
-+    if #[cfg(any(target_arch = "x86",
-+                 target_arch = "arm",
-+                 target_arch = "riscv32",
-+                 target_arch = "csky"))] {
-         pub const FS_IOC_GETFLAGS: ::Ioctl = 0x80046601;
-         pub const FS_IOC_SETFLAGS: ::Ioctl = 0x40046602;
-         pub const FS_IOC_GETVERSION: ::Ioctl = 0x80047601;
diff --git a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/0001-Use-portable-atomics-crate.patch b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/0001-Use-portable-atomics-crate.patch
index 54d4fb4ae3..05d6d9b1a4 100644
--- a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/0001-Use-portable-atomics-crate.patch
+++ b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/0001-Use-portable-atomics-crate.patch
@@ -22,27 +22,15 @@ error[E0432]: unresolved import `std::sync::atomic::AtomicU64`
 Upstream-Status: Submitted [https://github.com/jthornber/thin-provisioning-tools/pull/321]
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
 ---
- Cargo.lock             | 5 +++--
+ Cargo.lock             | 1 +
 Cargo.toml             | 1 +
 src/cache/writeback.rs | 2 +-
 src/thin/stat.rs       | 2 +-
- 4 files changed, 6 insertions(+), 4 deletions(-)
+ 4 files changed, 4 insertions(+), 2 deletions(-)
 --- a/Cargo.lock
 +++ b/Cargo.lock
-@@ -649,9 +649,9 @@ checksum = "d231b230927b5e4ad203db57bbcb
+@@ -1329,6 +1329,7 @@ dependencies = [
- 
- [[package]]
- name = "portable-atomic"
-version = "1.7.0"
-+version = "1.11.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da544ee218f0d287a911e9c99a39a8c9bc8fcad3cb8db5959940044ecfc67265"
-+checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
- 
- [[package]]
- name = "ppv-lite86"
-@@ -1000,6 +1000,7 @@ dependencies = [
  "num-derive",
  "num-traits",
  "num_cpus",
@@ -52,14 +40,14 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  "quickcheck_macros",
 --- a/Cargo.toml
 +++ b/Cargo.toml
-@@ -30,6 +30,7 @@ nom = "7.1"
+@@ -30,6 +30,7 @@ nom = "8.0"
- num_cpus = "1.16"
+ num_cpus = "1.17"
 num-derive = "0.4"
 num-traits = "0.2"
 +portable-atomic = "1.11"
- quick-xml = "0.36"
+ quick-xml = "0.38"
- rand = "0.8"
+ rand = "0.9"
- rangemap = "1.5"
+ rangemap = "1.6"
 --- a/src/cache/writeback.rs
 +++ b/src/cache/writeback.rs
 @@ -1,9 +1,9 @@
@@ -81,6 +69,6 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
 use std::collections::BTreeMap;
 use std::path::Path;
 -use std::sync::atomic::{AtomicU64, Ordering};
- use std::sync::{Arc, Mutex};
+ use std::sync::Mutex;
 use std::vec::Vec;
 
diff --git a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/disable-cargo-metadata.patch b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/disable-cargo-metadata.patch
new file mode 100644
index 0000000000..2c98bf748f
--- /dev/null
+++ b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/disable-cargo-metadata.patch
@@ -0,0 +1,38 @@
+Enable the feature *disable_cargo_metadata* on dependency devicemapper.
+Otherwise the build (in kas-container 5.2) fails with:
+|    Compiling devicemapper v0.34.5
+|     Building [=======================> ] 140/145: devicemapper(build.rs)
+|      Running `rustc --crate-name build_script_build --edition=2021 /build/tmp/work/x86-64-v3-poky-linux/thin-provisioning-tools/1.3.1/sources/cargo_home/bit>
+build/target/release/deps --extern devicemapper_sys=/build/tmp/work/x86-64-v3-poky-linux/thin-provisioning-tools/1.3.1/build/target/release/deps/libdevicemapp>
+| error: linking with `/build/tmp/work/x86-64-v3-poky-linux/thin-provisioning-tools/1.3.1/wrapper/build-rust-ccld` failed: exit status: 1
+|   |
+|   = note:  "/build/tmp/work/x86-64-v3-poky-linux/thin-provisioning-tools/1.3.1/wrapper/build-rust-ccld" "-m64" "/build/tmp/work/x86-64-v3-poky-linux/thin-pr>
+|   = note: some arguments are omitted. use `--verbose` to show all linker arguments
+|   = note: /build/tmp/hosttools/ld: cannot find /usr/lib/libm.so.6: No such file or directory
+|           /build/tmp/hosttools/ld: cannot find /usr/lib/libmvec.so.1: No such file or directory
+|           collect2: error: ld returned 1 exit status
+|
+|
+| error: could not compile `devicemapper` (build script) due to 1 previous error
+|
+| Caused by:
+|   process didn't exit successfully: `rustc --crate-name build_script_build --edition=2021 /build/tmp/work/x86-64-v3-poky-linux/thin-provisioning-tools/1.3.1>
+This problem was reported upstream: https://github.com/stratis-storage/devicemapper-rs/issues/965
+Upstream-Status: Inappropriate [package configuration]
+diff --git c/Cargo.toml i/Cargo.toml
+index 39853af1..160bb3d9 100644
+--- c/Cargo.toml
+++ i/Cargo.toml
+@@ -18,7 +18,7 @@ clap = { version = "4.5", default-features = false, features = [
+ ] }
+ crc32c = "0.6"
+ data-encoding = "2.9"
+-devicemapper = "0.34"
+devicemapper = { version = "0.34", features = [ "disable_cargo_metadata" ] }
+ exitcode = "1.1.2"
+ fixedbitset = "0.5"
+ flate2 = "1.1"
diff --git a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/dms-no-layout-check.patch b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/dms-no-layout-check.patch
new file mode 100644
index 0000000000..172647a2af
--- /dev/null
+++ b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools/dms-no-layout-check.patch
@@ -0,0 +1,66 @@
+Between version 0.69.4 and 0.72.1, rust-bindgen changed the kind of layout
+checks from runtime to compile-time. The old checks look like this:
+    assert_eq!(
+        ::std::mem::size_of::<ipc_perm>(),
+        36usize,
+        concat!("Size of: ", stringify!(ipc_perm))
+    );
+The new checks look like this:
+    const _: () = {
+        ["Size of ipc_perm"][::std::mem::size_of::<ipc_perm>() - 36usize];
+    }
+These new checks fail, if the pointer size of the host and the target
+architecture differ:
+| error[E0080]: index out of bounds: the length is 1 but the index is 12
+|  --> /build/tmp/work/riscv32imafdc-poky-linux/thin-provisioning-tools/1.3.1/build/target/release/build/devicemapper-sys-8d0196f02bac90ea/out/sem-bindings.rs:3:1175
+|   |
+| 3 | ... _ : () = { ["Size of ipc_perm"] [:: std :: mem :: size_of :: < ipc_perm > () - 36usize] ; ["Alignment of ipc_perm"] [:: std :: me...
+|   |                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ evaluation of `_` failed here
+|
+| error[E0080]: index out of bounds: the length is 1 but the index is 16
+|  --> /build/tmp/work/riscv32imafdc-poky-linux/thin-provisioning-tools/1.3.1/build/target/release/build/devicemapper-sys-8d0196f02bac90ea/out/sem-bindings.rs:3:2735
+|   |
+| 3 | ... _ : () = { ["Size of semid_ds"] [:: std :: mem :: size_of :: < semid_ds > () - 72usize] ; ["Alignment of semid_ds"] [:: std :: me...
+|   |                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ evaluation of `_` failed here
+|
+| error[E0080]: index out of bounds: the length is 1 but the index is 4
+|  --> /build/tmp/work/riscv32imafdc-poky-linux/thin-provisioning-tools/1.3.1/build/target/release/build/devicemapper-sys-8d0196f02bac90ea/out/sem-bindings.rs:3:5620
+|   |
+| 3 | ...nst _ : () = { ["Size of semun"] [:: std :: mem :: size_of :: < semun > () - 4usize] ; ["Alignment of semun"] [:: std :: mem :: al...
+|   |                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ evaluation of `_` failed here
+But according to
+https://users.rust-lang.org/t/what-to-do-when-bindgen-tests-fail/23822/2
+it's okay to skip these check:
+> The usual cause of mismatch is generating bindings on 64-bit platform and
+> using them on 32-bit platform.
+>
+> In that case you can often just ignore the tests (delete them), because
+> rustc will adjust the structs because they are repr(c).
+Upstream-Status: Inappropriate [cross-platform issue]
+--- a/build.rs
+++ b/build.rs
+@@ -42,6 +42,7 @@ fn main() {
+         .allowlist_type("dm_target_versions")
+         .derive_debug(true)
+         .derive_default(true)
+        .layout_tests(false)
+         .generate()
+         .expect("Could not generate dm.h bindings");
+ 
+@@ -69,6 +70,7 @@ fn main() {
+     let bindings = bindings
+         .derive_debug(true)
+         .derive_default(true)
+        .layout_tests(false)
+         .generate()
+         .expect("Could not generate sem.h bindings");
+ 
diff --git a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools_1.1.0.bb b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools_1.3.1.bb
index 317794defb..4d8d2a04df 100644
--- a/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools_1.1.0.bb
+++ b/meta-oe/recipes-support/thin-provisioning-tools/thin-provisioning-tools_1.3.1.bb
@@ -1,19 +1,21 @@
 SUMMARY = "Tools of dm-thin device-mapper"
 DESCRIPTION = "A suite of tools for manipulating the metadata of the dm-thin device-mapper target."
-HOMEPAGE = "https://github.com/jthornber/thin-provisioning-tools"
+HOMEPAGE = "https://github.com/device-mapper-utils/thin-provisioning-tools"
 LICENSE = "GPL-3.0-only"
 SECTION = "devel"
 LIC_FILES_CHKSUM = "file://COPYING;md5=1ebbd3e34237af26da5dc08a4e440464"
 SRC_URI = " \
-    git://github.com/jthornber/thin-provisioning-tools;branch=main;protocol=https \
+    git://github.com/device-mapper-utils/thin-provisioning-tools;branch=main;protocol=https;tag=v${PV} \
-    file://0001-Define-more-ioctl-codes-on-riscv32gc-unknown-linux-g.patch;patchdir=${CARGO_VENDORING_DIRECTORY}/libc-0.2.155 \
    file://0001-Use-portable-atomics-crate.patch \
+    file://disable-cargo-metadata.patch \
+    ${@bb.utils.contains('TUNE_FEATURES', '32', \
+        'file://dms-no-layout-check.patch;patchdir=${CARGO_VENDORING_DIRECTORY}/devicemapper-sys-0.3.3', \
+        '', d)} \
    "
-# v1.1.0
+SRCREV = "8b663fb4c6fb8e52ca06cea57b986c5ba45f668d"
-SRCREV = "b745ab35057bdd0a4f1406938916621dcf2b7ef6"
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>\d+(\.\d+)+)"
 inherit cargo cargo-update-recipe-crates
@@ -28,7 +30,6 @@ BINDGEN_EXTRA_CLANG_ARGS:remove = "-mcpu=octeontx2+crypto"
 export BINDGEN_EXTRA_CLANG_ARGS
 require ${BPN}-crates.inc
-require ${BPN}-git-crates.inc
 do_install:append() {
        install -d ${D}${sbindir}
diff --git a/meta-oe/recipes-support/tree/tree_2.3.1.bb b/meta-oe/recipes-support/tree/tree_2.3.2.bb
index b4fa0659b9..6e0d9f943f 100644
--- a/meta-oe/recipes-support/tree/tree_2.3.1.bb
+++ b/meta-oe/recipes-support/tree/tree_2.3.2.bb
@@ -5,7 +5,7 @@ LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=393a5ca445f6965873eca0259a17f833"
 SRC_URI = "https://oldmanprogrammer.net/tar/tree/${BP}.tgz"
-SRC_URI[sha256sum] = "47ca786ed4ea4aa277cabd42b1a54635aca41b29e425e9229bd1317831f25665"
+SRC_URI[sha256sum] = "6b941dd6cbecfb4d3250700e4d08d8e0c251488981dd4868b90d744234300e21"
 # tree's default CFLAGS for Linux
 CFLAGS += "-Wall -DLINUX -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64"
diff --git a/meta-oe/recipes-support/upower/upower_1.91.1.bb b/meta-oe/recipes-support/upower/upower_1.91.2.bb
index d4107a959a..d6505974e9 100644
--- a/meta-oe/recipes-support/upower/upower_1.91.1.bb
+++ b/meta-oe/recipes-support/upower/upower_1.91.2.bb
@@ -13,7 +13,7 @@ DEPENDS = " \
 "
 SRC_URI = "https://gitlab.freedesktop.org/${BPN}/${BPN}/-/archive/v${PV}/${BPN}-v${PV}.tar.bz2"
-SRC_URI[sha256sum] = "d568638d670a63a1886335b7b136f4888cb38a3b28f3f4bcdeaffcca0b0f6df8"
+SRC_URI[sha256sum] = "f07f19b78a43a5053973d95a2fe96a12ede270b8db232b2e2c4ac4186fb42539"
 S = "${UNPACKDIR}/${BPN}-v${PV}"
 UPSTREAM_CHECK_URI = "https://gitlab.freedesktop.org/${BPN}/${BPN}/-/tags"
diff --git a/meta-oe/recipes-support/webkitgtk/webkitgtk3/0001-Fix-32bit-arm.patch b/meta-oe/recipes-support/webkitgtk/webkitgtk3/0001-Fix-32bit-arm.patch
deleted file mode 100644
index fadef2a01b..0000000000
--- a/meta-oe/recipes-support/webkitgtk/webkitgtk3/0001-Fix-32bit-arm.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-From 014b9dad4ec5c432410254c0d0cab7d20b1f31d7 Mon Sep 17 00:00:00 2001
-From: Jason Schonberg <schonm@gmail.com>
-Date: Mon, 29 Sep 2025 14:34:48 -0400
-Subject: [PATCH] From: amaxcz <amaxcz@gmail.com> Date: Fri, 19 Sep 2025
- 11:55:30 +0000 Subject: [PATCH] JSC: fix op_instanceof handler for 32-bit
- C-loop build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8
- Content-Transfer-Encoding: 8bit
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-JSC: fix op_instanceof handler for 32-bit C-loop build
-Fixes missing 'op_instanceof' handler in LowLevelInterpreter32_64.asm
-which breaks 32‑bit builds.
-* No ChangeLog (raw external patch).
-Upstream-Status: Backport [https://bugs.webkit.org/show_bug.cgi?id=299166]
-Signed-off-by: Jason Schonberg <schonm@gmail.com>
---
- .../llint/LowLevelInterpreter32_64.asm        | 95 ++++++++++++++++++-
- 1 file changed, 94 insertions(+), 1 deletion(-)
-diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
-index 0d7c92bb..0b81cc1a 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
-+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
-@@ -3437,4 +3437,97 @@ slowPathOp(enumerator_has_own_property)
- slowPathOp(mod)
- 
- llintSlowPathOp(has_structure_with_flags)
-llintSlowPathOp(instanceof)
-+
-+llintOpWithMetadata(op_instanceof, OpInstanceof, macro (size, get, dispatch, metadata, return)
-+
-+    macro getAndLoadConstantOrVariable(fieldName, tagReg, payloadReg)
-+        get(fieldName, t5)
-+        loadConstantOrVariable(size, t5, tagReg, payloadReg)
-+    end
-+
-+    macro isObject(field, falseLabel)
-+        getAndLoadConstantOrVariable(field, t0, t1)
-+        bineq t0, CellTag, falseLabel
-+        bbneq JSCell::m_type[t1], ObjectType, falseLabel
-+    end
-+
-+    macro overridesHasInstance(hasInstanceField, constructorField, trueLabel)
-+        getAndLoadConstantOrVariable(hasInstanceField, t0, t1)
-+        bineq t0, CellTag, trueLabel
-+        loadp CodeBlock[cfr], t2
-+        loadp CodeBlock::m_globalObject[t2], t2
-+        loadp JSGlobalObject::m_functionProtoHasInstanceSymbolFunction[t2], t2
-+        bpneq t1, t2, trueLabel
-+
-+        get(constructorField, t5)
-+        loadConstantOrVariablePayload(size, t5, CellTag, t1, trueLabel)
-+        btbz JSCell::m_flags[t1], ImplementsDefaultHasInstance, trueLabel
-+    end
-+
-+    macro storeValue(tagReg, payloadReg, fieldName)
-+        move tagReg, t0
-+        move payloadReg, t1
-+        get(fieldName, t5)
-+        storei t0, TagOffset[cfr, t5, 8]
-+        storei t1, PayloadOffset[cfr, t5, 8]
-+    end
-+
-+.getHasInstance:
-+    isObject(m_constructor, .throwStaticError)
-+    get(m_constructor, t5)
-+    metadata(t2, t6)
-+    loadConstantOrVariablePayload(size, t5, CellTag, t3, .getHasInstanceSlow)
-+    performGetByIDHelper(OpInstanceof, m_hasInstanceModeMetadata, m_hasInstanceValueProfile, .getHasInstanceSlow, size,
-+        macro (resultTag, resultPayload)
-+            storeValue(resultTag, resultPayload, m_hasInstanceOrPrototype)
-+            jmp .getPrototype
-+        end)
-+    jmp .getPrototype
-+
-+.getHasInstanceSlow:
-+    callSlowPath(_llint_slow_path_get_hasInstance_from_instanceof)
-+    branchIfException(_llint_throw_from_slow_path_trampoline)
-+    jmp .getPrototype
-+
-+.getHasInstanceInlinedGetterOSRReturnPoint:
-+    # This path is taken when exiting to the LLInt from an inlined getter for Symbol.hasInstance.
-+    getterSetterOSRExitReturnPoint(op_instanceof, size)
-+    valueProfile(size, OpInstanceof, m_hasInstanceValueProfile, r1, r0, t2)
-+    storeValue(r1, r0, m_hasInstanceOrPrototype)
-+
-+.getPrototype:
-+    overridesHasInstance(m_hasInstanceOrPrototype, m_constructor, .instanceofCustom)
-+    isObject(m_value, .false)
-+    get(m_constructor, t5)
-+    metadata(t2, t6)
-+    loadConstantOrVariablePayload(size, t5, CellTag, t3, .getPrototypeSlow)
-+    performGetByIDHelper(OpInstanceof, m_prototypeModeMetadata, m_prototypeValueProfile, .getPrototypeSlow, size,
-+        macro (resultTag, resultPayload)
-+            storeValue(resultTag, resultPayload, m_hasInstanceOrPrototype)
-+            jmp .instanceof
-+        end)
-+    jmp .instanceof
-+
-+.getPrototypeSlow:
-+    callSlowPath(_llint_slow_path_get_prototype_from_instanceof)
-+    branchIfException(_llint_throw_from_slow_path_trampoline)
-+    jmp .instanceof
-+
-+.instanceof:
-+    callSlowPath(_llint_slow_path_instanceof_from_instanceof)
-+    dispatch()
-+
-+.throwStaticError:
-+    callSlowPath(_slow_path_throw_static_error_from_instanceof)
-+    dispatch()
-+
-+.instanceofCustom:
-+    callSlowPath(_slow_path_instanceof_custom_from_instanceof)
-+    dispatch()
-+
-+.false:
-+    get(m_dst, t5)
-+    storei BooleanTag, TagOffset[cfr, t5, 8]
-+    storei 0, PayloadOffset[cfr, t5, 8]
-+    dispatch()
-+end)
diff --git a/meta-oe/recipes-support/webkitgtk/webkitgtk3_2.50.5.bb b/meta-oe/recipes-support/webkitgtk/webkitgtk3_2.50.6.bb
index 9be30506d6..c3f736568f 100644
--- a/meta-oe/recipes-support/webkitgtk/webkitgtk3_2.50.5.bb
+++ b/meta-oe/recipes-support/webkitgtk/webkitgtk3_2.50.6.bb
@@ -21,9 +21,8 @@ SRC_URI = "https://www.webkitgtk.org/releases/webkitgtk-${PV}.tar.xz \
           file://0001-Fix-build-errors-on-RISCV-https-bugs.webkit.org-show.patch \
           file://fix-ftbfs-riscv64.patch \
           file://0001-CMake-Add-a-variable-to-control-macro-__PAS_ALWAYS_I.patch \
-           file://0001-Fix-32bit-arm.patch \
           "
-SRC_URI[sha256sum] = "8737631bac3e9c7ad3e5208f9370e076c09d9c45b39980021ce54edadcc6f94f"
+SRC_URI[sha256sum] = "2b281abf8894ffc6172152e5660b75eeeedbe1cc43d6783d09dc79f7c865bb42"
 inherit cmake pkgconfig gobject-introspection perlnative features_check upstream-version-is-even gi-docgen
@@ -32,7 +31,7 @@ S = "${UNPACKDIR}/webkitgtk-${PV}"
 ANY_OF_DISTRO_FEATURES = "${GTK3DISTROFEATURES}"
 REQUIRED_DISTRO_FEATURES = "opengl"
-CVE_PRODUCT = "webkitgtk webkitgtk\+"
+CVE_PRODUCT = "webkitgtk webkitgtk+"
 DEPENDS += " \
          ruby-native \
diff --git a/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy/run-ptest b/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy/run-ptest
new file mode 100755
index 0000000000..ff4b0b49ad
--- /dev/null
+++ b/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy/run-ptest
@@ -0,0 +1,2 @@
+#!/bin/sh
+gnome-desktop-testing-runner xdg-dbus-proxy
diff --git a/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.6.bb b/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.6.bb
deleted file mode 100644
index 43536f5d7b..0000000000
--- a/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.6.bb
+++ /dev/null
@@ -1,18 +0,0 @@
-SUMMARY = "xdg-dbus-proxy is a filtering proxy for D-Bus connections"
-HOMEPAGE = "https://github.com/flatpak/xdg-dbus-proxy"
-LICENSE = "LGPL-2.1-only"
-LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
-DEPENDS = " \
-    glib-2.0 \
-    libxslt-native \
-    docbook-xsl-stylesheets-native \
-"
-inherit meson pkgconfig
-SRC_URI = "git://github.com/flatpak/xdg-dbus-proxy.git;protocol=https;branch=main"
-SRCREV = "1c1989e56f94b9eb3b7567f8a6e8a0aa16cba496"
-BBCLASSEXTEND = "native"
diff --git a/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.7.bb b/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.7.bb
new file mode 100644
index 0000000000..a8e0a651ad
--- /dev/null
+++ b/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.7.bb
@@ -0,0 +1,28 @@
+SUMMARY = "xdg-dbus-proxy is a filtering proxy for D-Bus connections"
+HOMEPAGE = "https://github.com/flatpak/xdg-dbus-proxy"
+LICENSE = "LGPL-2.1-only"
+LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
+DEPENDS = " \
+    glib-2.0 \
+    libxslt-native \
+    docbook-xsl-stylesheets-native \
+"
+inherit meson pkgconfig ptest-gnome
+SRC_URI = " \
+    git://github.com/flatpak/xdg-dbus-proxy.git;protocol=https;branch=main;tag=${PV} \
+    file://run-ptest \
+    "
+SRCREV = "6a170fa77e3cbecb48f9dd2478fe5c0a119eb467"
+CVE_STATUS[CVE-2026-34080] = "fixed-version: fixed in 0.1.7"
+PACKAGECONFIG = "${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)}"
+PACKAGECONFIG[tests] = "-Dtests=true -Dinstalled_tests=true,-Dtests=false -Dinstalled_tests=false"
+RDEPENDS:${PN}-ptest += "dbus"
+BBCLASSEXTEND = "native"
diff --git a/meta-oe/recipes-support/xdg-desktop-portal/xdg-desktop-portal_1.20.3.bb b/meta-oe/recipes-support/xdg-desktop-portal/xdg-desktop-portal_1.20.4.bb
index e0aca558fd..bb48b59dd8 100644
--- a/meta-oe/recipes-support/xdg-desktop-portal/xdg-desktop-portal_1.20.3.bb
+++ b/meta-oe/recipes-support/xdg-desktop-portal/xdg-desktop-portal_1.20.4.bb
@@ -27,11 +27,17 @@ RDEPENDS:${PN} = "bubblewrap rtkit ${PORTAL_BACKENDS} fuse3-utils"
 inherit meson pkgconfig python3native features_check
 SRC_URI = " \
-        git://github.com/flatpak/xdg-desktop-portal.git;protocol=https;branch=xdg-desktop-portal-1.20 \
+        git://github.com/flatpak/xdg-desktop-portal.git;protocol=https;branch=xdg-desktop-portal-1.20;name=main;tag=${PV} \
+        git://gitlab.gnome.org/GNOME/libglnx.git;protocol=https;branch=master;name=libglnx;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/subprojects/libglnx \
        file://0001-meson.build-add-a-hack-for-crosscompile.patch \
 "
-SRCREV = "23a76c392170dbbd26230f85ef56c3a57e52b857"
+SRCREV_main = "f5aec228c9eb0c9a70eadd6424d92c0ca8a78247"
+# this revision comes from subprojects/libglnx.wrap file of the main source repo
+SRCREV_libglnx = "ccea836b799256420788c463a638ded0636b1632"
+SRCREV_FORMAT = "main"
 FILES:${PN} += "${libdir}/systemd ${datadir}/dbus-1"
@@ -47,3 +53,5 @@ do_write_config:append() {
 bwrap = '${bindir}/bwrap'
 EOF
 }
+CVE_STATUS[CVE-2026-40354] = "fixed-version: fixed in 1.20.4"
diff --git a/meta-oe/recipes-support/xdg-user-dirs/xdg-user-dirs_0.19.bb b/meta-oe/recipes-support/xdg-user-dirs/xdg-user-dirs_0.20.bb
index 2550d4cd59..3d122981ca 100644
--- a/meta-oe/recipes-support/xdg-user-dirs/xdg-user-dirs_0.19.bb
+++ b/meta-oe/recipes-support/xdg-user-dirs/xdg-user-dirs_0.20.bb
@@ -3,11 +3,11 @@ LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=94d55d512a9ba36caa9b7df079bae19f"
 SRC_URI = "http://user-dirs.freedesktop.org/releases/${BPN}-${PV}.tar.xz"
-SRC_URI[sha256sum] = "e92deb929c10d4b29329397af8a2585101247f7e6177ac6f1d28e82130ed8c19"
+SRC_URI[sha256sum] = "b8e34286278f4fef3e1bfe9685c395ccc0eb50c14d3a2fb4953dd00fbfd3af39"
-inherit autotools gettext pkgconfig
+inherit meson gettext pkgconfig
-EXTRA_OECONF = "--disable-documentation"
+EXTRA_OEMESON = "-Ddocs=false"
 CONFFILES:${PN} += " \
    ${sysconfdir}/xdg/user-dirs.conf \
diff --git a/meta-oe/recipes-support/xmlsec1/xmlsec1_1.3.9.bb b/meta-oe/recipes-support/xmlsec1/xmlsec1_1.3.9.bb
index e0888f1ff4..e178fc2125 100644
--- a/meta-oe/recipes-support/xmlsec1/xmlsec1_1.3.9.bb
+++ b/meta-oe/recipes-support/xmlsec1/xmlsec1_1.3.9.bb
@@ -51,6 +51,9 @@ FILES:${PN}-dbg += "${PTEST_PATH}/.debug/*"
 RDEPENDS:${PN}-ptest += "${PN}-dev"
 INSANE_SKIP:${PN}-ptest += "dev-deps"
+# The ptests are not buildable now that pkgconf is being used, disable until fixed.
+PTEST_ENABLED = "0"
 PTEST_EXTRA_ARGS = "top_srcdir=${S} top_builddir=${B}"
 do_compile_ptest () {
diff --git a/meta-oe/recipes-support/xrdp/xrdp_0.10.5.bb b/meta-oe/recipes-support/xrdp/xrdp_0.10.6.bb
index 8d7c5807f2..152b37cb37 100644
--- a/meta-oe/recipes-support/xrdp/xrdp_0.10.5.bb
+++ b/meta-oe/recipes-support/xrdp/xrdp_0.10.6.bb
@@ -17,7 +17,7 @@ SRC_URI = "https://github.com/neutrinolabs/${BPN}/releases/download/v${PV}/${BPN
           file://0001-arch-Define-NO_NEED_ALIGN-on-ppc64.patch \
           file://0001-mark-count-with-unused-attribute.patch \
           "
-SRC_URI[sha256sum] = "9abc96d164de4b1c40e2f3f537d0593d052a640cf3388978c133715ea69fb123"
+SRC_URI[sha256sum] = "dfc21d5d603b642cf583987b36706b685bf05fd3aaaaacefb8f57c5f4a448677"
 UPSTREAM_CHECK_URI = "https://github.com/neutrinolabs/xrdp/releases"
 UPSTREAM_CHECK_REGEX = "releases/tag/v(?P<pver>\d+(\.\d+)+)"
@@ -127,3 +127,12 @@ pkg_postinst:${PN}() {
                fi
        fi
 }
+CVE_STATUS[CVE-2026-32105] = "fixed-version: fixed in 0.10.6"
+CVE_STATUS[CVE-2026-32107] = "fixed-version: fixed in 0.10.6"
+CVE_STATUS[CVE-2026-32623] = "fixed-version: fixed in 0.10.6"
+CVE_STATUS[CVE-2026-32624] = "fixed-version: fixed in 0.10.6"
+CVE_STATUS[CVE-2026-33145] = "fixed-version: fixed in 0.10.6"
+CVE_STATUS[CVE-2026-33516] = "fixed-version: fixed in 0.10.6"
+CVE_STATUS[CVE-2026-33689] = "fixed-version: fixed in 0.10.6"
+CVE_STATUS[CVE-2026-35512] = "fixed-version: fixed in 0.10.6"