internal/rosa: update packages

The elfutils fix has entered a release, the backport patch has been
removed. The libconfig patch has been updated to remove newly added
broken glibc-dependent tests.

Kernel headers remain unchanged. Kernel configuration was updated via
the new cross-compilation infrastructure.

The toolchain was updated, causing a large amount of rebuilds. QEMU
riscv64 cross compilation still crashes clang.

PipeWire is updated, however WirePlumber remains vulnerable. The
PipeWire maintainers are not treating this vulnerability as a
vulnerability, and an upstream release is not coming. This change
backports the fix for now. The included patch is slopped by its author,
but there is nothing I can do to change that fact.

Signed-off-by: Ophestra <cat@gensokyo.uk>

23 files changed, 110 insertions, 132 deletions

diff --git a/internal/rosa/package/elfutils/package.az b/internal/rosa/package/elfutils.az
index 5f35670e..002209c8 100644
--- a/internal/rosa/package/elfutils/package.az
+++ b/internal/rosa/package/elfutils.az
@@ -3,14 +3,13 @@ package elfutils {
 	website = "https://sourceware.org/elfutils";
 	anitya = 5679;
 
-	version# = "0.196";
+	version# = "0.197";
 	source = remoteTar {
 		url = "https://sourceware.org/elfutils/ftp/"+
 			version+"/elfutils-"+version+".tar.bz2";
-		checksum = "TzY1z0jDRofYNxhEsElwgzSKWUy2Hb6RSzm_8ni-peGKmZWLJUqefZItJtw-ZvHj";
+		checksum = "6NS1Y_HJPx8UB6RRUV0ckXk4MhiRyMI4zQJ8fKBvlny1ixuUWgawWfR_i-r7hDg7";
 		compress = bzip2;
 	};
-	patches = [ "64e89606ff4967a647525524aec00dd33765ba2a.patch" ];
 
 	env = [
 		"CC=cc" +
diff --git a/internal/rosa/package/elfutils/64e89606ff4967a647525524aec00dd33765ba2a.patch b/internal/rosa/package/elfutils/64e89606ff4967a647525524aec00dd33765ba2a.patch
deleted file mode 100644
index e7b534f1..00000000
--- a/internal/rosa/package/elfutils/64e89606ff4967a647525524aec00dd33765ba2a.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 64e89606ff4967a647525524aec00dd33765ba2a Mon Sep 17 00:00:00 2001
-From: Daeho Ro <email@daeho.ro>
-Date: Sun, 16 Aug 2026 16:27:56 +0900
-Subject: [PATCH] backends: use <sys/uio.h> instead of <linux/uio.h> for struct
- iovec
-
-Since commit 0e8b57a3 ("elfcompress: Handle existing output files
-(symlinks)") lib/system.h includes <fcntl.h>.  When _GNU_SOURCE is
-defined, glibc's <fcntl.h> pulls in <bits/types/struct_iovec.h> (via
-bits/fcntl-linux.h), which defines struct iovec.  The kernel UAPI header
-<linux/uio.h> defines struct iovec unconditionally, so including it
-after "system.h" now breaks the aarch64 backend build:
-
-  In file included from aarch64_initreg.c:36:
-  /usr/include/linux/uio.h:17:8: error: redefinition of 'struct iovec'
-     17 | struct iovec
-        |        ^~~~~
-  In file included from /usr/include/aarch64-linux-gnu/bits/fcntl-linux.h:38,
-                   from /usr/include/aarch64-linux-gnu/bits/fcntl.h:61,
-                   from /usr/include/fcntl.h:35,
-                   from ../lib/system.h:42,
-                   from aarch64_initreg.c:33:
-  /usr/include/aarch64-linux-gnu/bits/types/struct_iovec.h:26:8: note: originally defined here
-
-Seen building 0.196 on aarch64 with glibc 2.39 and gcc 13.3.0.
-
-Both files only need struct iovec to call ptrace (PTRACE_GETREGSET),
-which glibc provides in <sys/uio.h>; that header guards the definition
-with __iovec_defined, so it composes with the rest of system.h.
-arm_initreg.c does not currently include "system.h" and so still builds,
-but it has the same latent conflict.
-
-* backends/aarch64_initreg.c: Include <sys/uio.h> instead of
-  <linux/uio.h>.
-* backends/arm_initreg.c: Likewise.
-
-Signed-off-by: Daeho Ro <email@daeho.ro>
----
- backends/aarch64_initreg.c | 2 +-
- backends/arm_initreg.c     | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/backends/aarch64_initreg.c b/backends/aarch64_initreg.c
-index a6badbb4..539a6366 100644
---- a/backends/aarch64_initreg.c
-+++ b/backends/aarch64_initreg.c
-@@ -33,7 +33,7 @@
- #include "system.h"
- #include <assert.h>
- #if defined(__aarch64__) && defined(__linux__)
--# include <linux/uio.h>
-+# include <sys/uio.h>
- # include <sys/user.h>
- # include <sys/ptrace.h>
- # include <asm/ptrace.h>
-diff --git a/backends/arm_initreg.c b/backends/arm_initreg.c
-index efcabaf6..062bb9e0 100644
---- a/backends/arm_initreg.c
-+++ b/backends/arm_initreg.c
-@@ -38,7 +38,7 @@
- #endif
- 
- #ifdef __aarch64__
--# include <linux/uio.h>
-+# include <sys/uio.h>
- # include <sys/user.h>
- # include <sys/ptrace.h>
- /* Deal with old glibc defining user_pt_regs instead of user_regs_struct.  */
--- 
-2.55.0
-
diff --git a/internal/rosa/package/firmware.az b/internal/rosa/package/firmware.az
index e87a34c1..f003e370 100644
--- a/internal/rosa/package/firmware.az
+++ b/internal/rosa/package/firmware.az
@@ -3,12 +3,12 @@ package firmware {
 	website = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
 	anitya = 141464;
 
-	version# = "20260916";
+	version# = "20261019";
 	source = remoteGitLab {
 		domain = "gitlab.com";
 		suffix = "kernel-firmware/linux-firmware";
 		ref = version;
-		checksum = "Yv3yaffN6-ARSFSnDm-0gHM3T7m3ZwMqBLIP8UA3Jpe23Jk8MyNLUE44wJMy_DH6";
+		checksum = "Ya6gh6pUw-3Tf5Cs9f4zPSA9fRXU9hJdMs2OjuoVd2eRko4MOqeehmHNJ0vYqQc6";
 	};
 
 	// dedup creates temporary file
diff --git a/internal/rosa/package/go.az b/internal/rosa/package/go.az
index 08ad847e..a6b1ff05 100644
--- a/internal/rosa/package/go.az
+++ b/internal/rosa/package/go.az
@@ -3,10 +3,10 @@ package go {
 	website = "https://go.dev";
 	anitya = 1227;
 
-	version# = "1.27.2";
+	version# = "1.27.3";
 	source = remoteTar {
 		url = "https://go.dev/dl/go"+version+".src.tar.gz";
-		checksum = "Vxj6mhsDZEPq3AX21AA20zWMaVPX3Ezhdbkm1SK8O__BH8jczdeeLFMasQ-PUIww";
+		checksum = "lyIgV0TTDx3yF3__cI507YUvU1ubQ2-6JwCLbycUdKKZlbJWWIf_8sfPbIHCev_n";
 		compress = gzip;
 	};
 
diff --git a/internal/rosa/package/harfbuzz.az b/internal/rosa/package/harfbuzz.az
index 2d62d023..c219d78c 100644
--- a/internal/rosa/package/harfbuzz.az
+++ b/internal/rosa/package/harfbuzz.az
@@ -3,11 +3,11 @@ package harfbuzz {
 	website = "https://harfbuzz.github.io";
 	anitya = 1299;
 
-	version# = "14.6.0";
+	version# = "15.0.0";
 	source = remoteGitHub {
 		suffix = "harfbuzz/harfbuzz";
 		tag = version;
-		checksum = "raMMlGfzwy1bEIIO8a93-eEj50ksDDWDdLyeQlO8IM04_woqkIPhJ90QvU3lZJ2L";
+		checksum = "H2oVhz5XOfavg5l-0XAON6vPrMEjzm0cBGnVdkj-dJTGkrktbIOrrN6m8brsjzma";
 	};
 
 	exec = meson {
diff --git a/internal/rosa/package/iproute2.az b/internal/rosa/package/iproute2.az
index 0730e9b3..46265ed3 100644
--- a/internal/rosa/package/iproute2.az
+++ b/internal/rosa/package/iproute2.az
@@ -3,11 +3,11 @@ package iproute2 {
 	website = "https://wiki.linuxfoundation.org/networking/iproute2";
 	anitya = 1392;
 
-	version# = "7.2.0";
+	version# = "7.3.0";
 	source = remoteTar {
 		url = "https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/"+
 			"snapshot/iproute2-"+version+".tar.gz";
-		checksum = "VECMJeSm-lHWpyJqnI-1CeHFejAgi_mb8LJjMGIx5rqww6AlZii3g_tUGPLu4npo";
+		checksum = "LsjPWjojHkM9VuLDjukY2L7540bTuL9B0aWeBgauzqLIOU38rJq1-lofovs2kW6a";
 		compress = gzip;
 	};
 
diff --git a/internal/rosa/package/kernel/amd64.config b/internal/rosa/package/kernel/amd64.config
index 1166145f..30cad9ec 100644
--- a/internal/rosa/package/kernel/amd64.config
+++ b/internal/rosa/package/kernel/amd64.config
@@ -1,16 +1,16 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 6.18.57 Kernel Configuration
+# Linux/x86 6.18.58 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="Rosa OS clang version 23.1.3"
+CONFIG_CC_VERSION_TEXT="Rosa OS clang version 23.1.4"
 CONFIG_GCC_VERSION=0
 CONFIG_CC_IS_CLANG=y
-CONFIG_CLANG_VERSION=230103
+CONFIG_CLANG_VERSION=230104
 CONFIG_AS_IS_LLVM=y
-CONFIG_AS_VERSION=230103
+CONFIG_AS_VERSION=230104
 CONFIG_LD_VERSION=0
 CONFIG_LD_IS_LLD=y
-CONFIG_LLD_VERSION=230103
+CONFIG_LLD_VERSION=230104
 CONFIG_RUSTC_VERSION=0
 CONFIG_RUSTC_LLVM_VERSION=0
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
diff --git a/internal/rosa/package/kernel/arm64.config b/internal/rosa/package/kernel/arm64.config
index 7d61da6e..c9146f25 100644
--- a/internal/rosa/package/kernel/arm64.config
+++ b/internal/rosa/package/kernel/arm64.config
@@ -1,16 +1,16 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm64 6.18.57 Kernel Configuration
+# Linux/arm64 6.18.58 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="Rosa OS clang version 23.1.3"
+CONFIG_CC_VERSION_TEXT="Rosa OS clang version 23.1.4"
 CONFIG_GCC_VERSION=0
 CONFIG_CC_IS_CLANG=y
-CONFIG_CLANG_VERSION=230103
+CONFIG_CLANG_VERSION=230104
 CONFIG_AS_IS_LLVM=y
-CONFIG_AS_VERSION=230103
+CONFIG_AS_VERSION=230104
 CONFIG_LD_VERSION=0
 CONFIG_LD_IS_LLD=y
-CONFIG_LLD_VERSION=230103
+CONFIG_LLD_VERSION=230104
 CONFIG_RUSTC_VERSION=0
 CONFIG_RUSTC_LLVM_VERSION=0
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
diff --git a/internal/rosa/package/kernel/package.az b/internal/rosa/package/kernel/package.az
index f0e94a70..065ac994 100644
--- a/internal/rosa/package/kernel/package.az
+++ b/internal/rosa/package/kernel/package.az
@@ -3,10 +3,10 @@ package kernel-source {
 	website = "https://kernel.org";
 	exclude = true;
 
-	version# = "6.18.57";
+	version# = "6.18.58";
 	output = remoteTar {
 		url = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-"+version+".tar.gz";
-		checksum = "CnOD4u2pRjkjmyD6wg4dyQVnXXy8rNlwZ-OmTZvSFZPJNSEC996heziLGbKQNCTL";
+		checksum = "Sv7N_LByk-wUXphGWhSmfLVnjNAbybcNzqTkT7iZWPZ-k6bLZ3xP4nMF_Z0Y4vCv";
 		compress = gzip;
 	};
 }
diff --git a/internal/rosa/package/kernel/riscv64.config b/internal/rosa/package/kernel/riscv64.config
index 4cd0171b..cbd0372d 100644
--- a/internal/rosa/package/kernel/riscv64.config
+++ b/internal/rosa/package/kernel/riscv64.config
@@ -1,16 +1,16 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/riscv 6.18.57 Kernel Configuration
+# Linux/riscv 6.18.58 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="Rosa OS clang version 23.1.3"
+CONFIG_CC_VERSION_TEXT="Rosa OS clang version 23.1.4"
 CONFIG_GCC_VERSION=0
 CONFIG_CC_IS_CLANG=y
-CONFIG_CLANG_VERSION=230103
+CONFIG_CLANG_VERSION=230104
 CONFIG_AS_IS_LLVM=y
-CONFIG_AS_VERSION=230103
+CONFIG_AS_VERSION=230104
 CONFIG_LD_VERSION=0
 CONFIG_LD_IS_LLD=y
-CONFIG_LLD_VERSION=230103
+CONFIG_LLD_VERSION=230104
 CONFIG_RUSTC_VERSION=0
 CONFIG_RUSTC_LLVM_VERSION=0
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
diff --git a/internal/rosa/package/libconfig/disable-broken-tests.patch b/internal/rosa/package/libconfig/disable-broken-tests.patch
index 9378221b..93f4a697 100644
--- a/internal/rosa/package/libconfig/disable-broken-tests.patch
+++ b/internal/rosa/package/libconfig/disable-broken-tests.patch
@@ -1,8 +1,8 @@
 diff --git a/tests/tests.c b/tests/tests.c
-index eba7eae..f916d2e 100644
+index d9ccd25..75c89cc 100644
 --- a/tests/tests.c
 +++ b/tests/tests.c
-@@ -753,7 +753,6 @@ int main(int argc, char **argv)
+@@ -1090,7 +1090,6 @@ int main(int argc, char **argv)
    int failures;
  
    TT_SUITE_START(LibConfigTests);
@@ -10,11 +10,20 @@ index eba7eae..f916d2e 100644
    TT_SUITE_TEST(LibConfigTests, ParseInvalidFiles);
    TT_SUITE_TEST(LibConfigTests, ParseInvalidStrings);
    TT_SUITE_TEST(LibConfigTests, BigInt1);
-@@ -768,7 +767,6 @@ int main(int argc, char **argv)
+@@ -1101,16 +1100,12 @@ int main(int argc, char **argv)
+   TT_SUITE_TEST(LibConfigTests, BigInt6);
+   TT_SUITE_TEST(LibConfigTests, BigInt7);
+   TT_SUITE_TEST(LibConfigTests, RemoveSetting);
+-  TT_SUITE_TEST(LibConfigTests, ListGrowAndRemove);
+-  TT_SUITE_TEST(LibConfigTests, LongStrings);
+   TT_SUITE_TEST(LibConfigTests, IncludeFiles);
+   TT_SUITE_TEST(LibConfigTests, EscapedStrings);
    TT_SUITE_TEST(LibConfigTests, OverrideSetting);
    TT_SUITE_TEST(LibConfigTests, SettingLookups);
+   TT_SUITE_TEST(LibConfigTests, IncludeReadError);
    TT_SUITE_TEST(LibConfigTests, ReadStream);
+-  TT_SUITE_TEST(LibConfigTests, NonDecimalInt64Suffix);
 -  TT_SUITE_TEST(LibConfigTests, BinaryAndHex);
+   TT_SUITE_TEST(LibConfigTests, BinaryIntegerRoundTrip);
+   TT_SUITE_TEST(LibConfigTests, AutoConvertIntegerToFloat);
    TT_SUITE_RUN(LibConfigTests);
-   failures = TT_SUITE_NUM_FAILURES(LibConfigTests);
-   TT_SUITE_END(LibConfigTests);
diff --git a/internal/rosa/package/libconfig/package.az b/internal/rosa/package/libconfig/package.az
index 4b501994..0fc10b92 100644
--- a/internal/rosa/package/libconfig/package.az
+++ b/internal/rosa/package/libconfig/package.az
@@ -3,11 +3,11 @@ package libconfig {
 	website = "https://hyperrealm.github.io/libconfig";
 	anitya = 1580;
 
-	version# = "1.8.2";
+	version# = "1.8.3";
 	source = remoteGitHub {
 		suffix = "hyperrealm/libconfig";
 		tag = "v"+version;
-		checksum = "fD32hjeAZuTz98g6WYHRwsxphrgrEFqxi5Z1jlJemPckPBfxpS3i5HgshAuA6vmT";
+		checksum = "5wdYjX3mn0c09MwN8n9LQIx4fYfOEOmgm0isqmwb1Cu5cPd7fTsK5vAbPcuyXYkR";
 	};
 	patches = [ "disable-broken-tests.patch" ];
 
diff --git a/internal/rosa/package/llvm/package.az b/internal/rosa/package/llvm/package.az
index f55f4a7d..8502b558 100644
--- a/internal/rosa/package/llvm/package.az
+++ b/internal/rosa/package/llvm/package.az
@@ -2,11 +2,11 @@ package llvm-project {
 	description = "LLVM monorepo with Rosa OS patches";
 	anitya = 1830;
 
-	version# = "23.1.3";
+	version# = "23.1.4";
 	output = remoteGitHub {
 		suffix = "llvm/llvm-project";
 		tag = "llvmorg-"+version;
-		checksum = "bEWWfej4llsLsQ_wKIv57zcfNNgQD1yihufRDeSDYDlTzyrMTUS8J-ve6Bk2kPrJ";
+		checksum = "WcBjxRCDEAJDQVDxnEzr8iivxiShCKU7hM84TMSNfwdymAX-Eyw8oTda7pDSL73O";
 	};
 	patches = [
 		"increase-stack-size-unconditional.patch",
diff --git a/internal/rosa/package/nss.az b/internal/rosa/package/nss.az
index a7e1b6f1..4f4d4d9a 100644
--- a/internal/rosa/package/nss.az
+++ b/internal/rosa/package/nss.az
@@ -3,7 +3,7 @@ package nss-cacert {
 	website = "https://firefox-source-docs.mozilla.org/security/nss/index.html";
 	anitya = 2503;
 
-	version# = "3.131";
+	version# = "3.132";
 	source = remoteGitHub {
 		suffix = "nss-dev/nss";
 		tag = "NSS_"+join {
@@ -14,7 +14,7 @@ package nss-cacert {
 			};
 			sep = "_";
 		}+"_RTM";
-		checksum = "fQZ1hbSQyeqc2uK1bx4CeYPb3nb1t4M40D3_JXOJ0WO6a0QvMtddn2jQjKmnmCKD";
+		checksum = "GBkrmgdeEjvmLuWq6_EX5nkfebL4ojBE0yHsBgeijX7cnoLA5aOY2Z-GIolJwFy_";
 	};
 
 	enterSource = true;
diff --git a/internal/rosa/package/openssl.az b/internal/rosa/package/openssl.az
index eb2f28fa..da99b82c 100644
--- a/internal/rosa/package/openssl.az
+++ b/internal/rosa/package/openssl.az
@@ -5,12 +5,12 @@ package openssl {
 	// strange malformed tags treated as pre-releases in Anitya
 	latest = anityaFallback;
 
-	version# = "4.0.3";
+	version# = "4.1.0";
 	source = remoteGitHubRelease {
 		suffix = "openssl/openssl";
 		tag = "openssl-"+version;
 		name = "openssl-"+version+".tar.gz";
-		checksum = "qRm2EpUnLqKBgUFimF2uqjHZJaUgK-AWTuX9DVHhnowvCdm09p0wIn3mPRjXjGxj";
+		checksum = "E5aKge_8t3EhUMgqdyJSs0Kv0XYlnmYky7Zm0tqx2gZRffQsgUp9VxAFG8lyoBku";
 		compress = gzip;
 	};
 
diff --git a/internal/rosa/package/pipewire/fcc8d79b6b5e1bc21ff7ea6353f3cd230e9243ee.patch b/internal/rosa/package/pipewire/fcc8d79b6b5e1bc21ff7ea6353f3cd230e9243ee.patch
new file mode 100644
index 00000000..c5318f4f
--- /dev/null
+++ b/internal/rosa/package/pipewire/fcc8d79b6b5e1bc21ff7ea6353f3cd230e9243ee.patch
@@ -0,0 +1,40 @@
+From fcc8d79b6b5e1bc21ff7ea6353f3cd230e9243ee Mon Sep 17 00:00:00 2001
+From: Julian Bouzas <julian.bouzas@collabora.com>
+Date: Fri, 16 Oct 2026 14:44:36 -0400
+Subject: [PATCH] m-lua-scripting: fix the values of the Perm constants
+
+Lua does not support octal literals, so the permission values were
+parsed as decimal numbers and did not match the PipeWire ones. This
+gave restricted and flatpak clients write and link permissions. Use
+hexadecimal values instead.
+
+Fixes: #1044
+Assisted-by: Claude:claude-opus-5-5
+---
+ modules/module-lua-scripting/api/api.lua | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/modules/module-lua-scripting/api/api.lua b/modules/module-lua-scripting/api/api.lua
+index aafa49d98..0ca8c4155 100644
+--- a/modules/module-lua-scripting/api/api.lua
++++ b/modules/module-lua-scripting/api/api.lua
+@@ -184,11 +184,11 @@ local Feature = {
+   },
+ }
+ 
+-PERM_R_VAL = 0400
+-PERM_W_VAL = 0200
+-PERM_X_VAL = 0100
+-PERM_M_VAL = 0010
+-PERM_L_VAL = 0020
++PERM_R_VAL = 0x100
++PERM_W_VAL = 0x080
++PERM_X_VAL = 0x040
++PERM_M_VAL = 0x008
++PERM_L_VAL = 0x010
+ 
+ local Perm = {
+   NONE = 0,
+-- 
+GitLab
+
diff --git a/internal/rosa/package/pipewire.az b/internal/rosa/package/pipewire/package.az
index 230755fd..30967468 100644
--- a/internal/rosa/package/pipewire.az
+++ b/internal/rosa/package/pipewire/package.az
@@ -10,6 +10,7 @@ package wireplumber {
 		ref = version;
 		checksum = "YsKFuMxDJQtwnR0N7h7KA7fNR866k7XhCiSdn3L30Wn1kU7mTV66V8eHHL9dZ5sZ";
 	};
+	patches = [ "fcc8d79b6b5e1bc21ff7ea6353f3cd230e9243ee.patch" ];
 
 	// OSError: [Errno 30] Read-only file system: '../../usr/src/wireplumber/po/conf.pot'
 	writable = true;
@@ -37,12 +38,12 @@ package pipewire {
 	website = "https://pipewire.org";
 	anitya = 57357;
 
-	version# = "1.6.9";
+	version# = "1.6.10";
 	source = remoteGitLab {
 		domain = "gitlab.freedesktop.org";
 		suffix = "pipewire/pipewire";
 		ref = version;
-		checksum = "EtqI-7Gwgp_6rHRqVlhuGAt39vOlX_SAoUWzaeeCaUqX4X6feCQvqmSwQvzR88Dr";
+		checksum = "2HBIEZmwVFWvj-RJfKypCIBfk0njwHEGHX5NZefeFdt-w5pSliPXe0CSjKE7p8Xv";
 	};
 
 	exec = meson {
diff --git a/internal/rosa/package/pkgconf.az b/internal/rosa/package/pkgconf.az
index 644c916d..35485b72 100644
--- a/internal/rosa/package/pkgconf.az
+++ b/internal/rosa/package/pkgconf.az
@@ -3,11 +3,11 @@ package pkgconf {
 	website = "https://github.com/pkgconf/pkgconf";
 	anitya = 12753;
 
-	version# = "3.0.9";
+	version# = "3.0.10";
 	source = remoteGitHub {
 		suffix = "pkgconf/pkgconf";
 		tag = "pkgconf-"+version;
-		checksum = "uGY_4freweuu58B5ftn9b9fmvND_BN1B6zCmmnFh2nO14aGZ98tCa3qAWakLF3q3";
+		checksum = "CF8gXPu-Zb1UULwtBNjrdplHWsys1hm6sbkt79adDD9PWyY-KJoFZXppsJaOhgf5";
 	};
 
 	exec = meson {
diff --git a/internal/rosa/package/python/package.az b/internal/rosa/package/python/package.az
index fa12b203..657ef546 100644
--- a/internal/rosa/package/python/package.az
+++ b/internal/rosa/package/python/package.az
@@ -6,11 +6,11 @@ package python {
 	// too many inputs; early variant available
 	bootstrap = false;
 
-	version# = "3.15.0";
+	version# = "3.15.1";
 	source = remoteTar {
 		url = "https://www.python.org/ftp/python/"+version+
 			"/Python-"+version+".tgz";
-		checksum = "SHy8bsXI1zLONLJHIK6gEJUiPjdUcRLzI9PjQnUfXOdL6Jcy0RQFEOyhMkp9vonP";
+		checksum = "SP9sQT5VtgMtYtLat4rw695B69TrmkIEqZ4oNtS8l7r2looA9M2-_IJDvZENwUQy";
 		compress = gzip;
 	};
 	patches = [ "zipfile-no-default-strict_timestamps.patch" ];
@@ -142,11 +142,11 @@ package python-setuptools {
 	website = "https://pypi.org/project/setuptools";
 	anitya = 4021;
 
-	version# = "84.0.0";
+	version# = "84.2.1";
 	source = remoteGitHub {
 		suffix = "pypa/setuptools";
 		tag = "v"+version;
-		checksum = "K9PGFv7ju_v4sykQCcROCc8Zdz3TfxYv95JlKFGXUnpf1yqRZW3oA0LuUQfE2x8n";
+		checksum = "Qql4Wkh8eDNwRczbb98MCvoukAxAPkDbSne2imaK3fXfkK5aLfg6dTVwZNMcOb6H";
 	};
 
 	exec = pip {
@@ -574,11 +574,11 @@ package python-pycparser {
 	website = "https://github.com/eliben/pycparser";
 	anitya = 8175;
 
-	version# = "3.11";
+	version# = "3.12";
 	source = remoteGitHub {
 		suffix = "eliben/pycparser";
 		tag = "release_v"+version;
-		checksum = "MjkTN3iAR3UglDqTHUjGozSowe7i0QJWBmaRYygYCH1TYlfFYyCaLx1LKG-Zf5_l";
+		checksum = "rMXFP1-9HDTHpMMwuO9hz7NRHtpu6BWNnCkfI_vIabaJfYGWNd8wzObtWY38HJ2_";
 	};
 
 	// test case hard codes gcc
diff --git a/internal/rosa/package/strace/package.az b/internal/rosa/package/strace/package.az
index 6173ae38..eca92e9e 100644
--- a/internal/rosa/package/strace/package.az
+++ b/internal/rosa/package/strace/package.az
@@ -3,11 +3,11 @@ package strace {
 	website = "https://strace.io";
 	anitya = 4897;
 
-	version# = "7.2";
+	version# = "7.3";
 	source = remoteGit {
 		url = "https://github.com/strace/strace.git";
 		tag = "v"+version;
-		checksum = "_vIfkx9C8Q-F4Q1WE1jBMPFeDv3f2h-L1BTCokKqw3G993H2i5NYtBArIDo2Sx_O";
+		checksum = "uyFE6JkqVlkepedGBqdtpFIJc6sWiogyHw0sd_86a7UMyiZuebLzBugI8A-IyMQd";
 	};
 	patches = [
 		"tests-musl.patch",
diff --git a/internal/rosa/package/strace/skip-broken-tests.patch b/internal/rosa/package/strace/skip-broken-tests.patch
index ce74b0e2..43330ff9 100644
--- a/internal/rosa/package/strace/skip-broken-tests.patch
+++ b/internal/rosa/package/strace/skip-broken-tests.patch
@@ -1,5 +1,5 @@
 diff --git a/tests/attach-p-eperm-already-traced.test b/tests/attach-p-eperm-already-traced.test
-index 54428c539..a0fa049c4 100755
+index f97ce2e63..0bfa3a66d 100755
 --- a/tests/attach-p-eperm-already-traced.test
 +++ b/tests/attach-p-eperm-already-traced.test
 @@ -10,6 +10,8 @@
@@ -8,9 +8,9 @@ index 54428c539..a0fa049c4 100755
  
 +skip_ "broken test"
 +
- $STRACE -q --trace=none --signal=none -- \
- 	sh -c "echo \$\$; sleep $TIMEOUT_DURATION" > "$OUT" 2>/dev/null &
- tracer_pid=$!
+ check_prog mkfifo
+ mkfifo "$OUT.pid" "$OUT.done" ||
+ 	framework_skip_ 'mkfifo failed'
 diff --git a/tests/int_0x80.c b/tests/int_0x80.c
 index d46e51584..f0cb88b0f 100644
 --- a/tests/int_0x80.c
diff --git a/internal/rosa/package/tamago.az b/internal/rosa/package/tamago.az
index c4393b13..e0c25719 100644
--- a/internal/rosa/package/tamago.az
+++ b/internal/rosa/package/tamago.az
@@ -3,11 +3,11 @@ package tamago {
 	website = "https://github.com/usbarmory/tamago-go";
 	anitya = 388872;
 
-	version# = "1.27.2";
+	version# = "1.27.3";
 	source = remoteGitHub {
 		suffix = "usbarmory/tamago-go";
 		tag = "tamago-go"+version;
-		checksum = "z-4tuciBpbu4cR4hwkRemUcxWUgfLpfc8shIFDjUAdthxWMv9FYkwCfTta0Ho_4-";
+		checksum = "5gcklCtrcbclIjJpCFj5sZA5mjlvi5O7VmPmI7XB6oQQo0ubZFK1gAKaeVORkuQO";
 	};
 
 	env = [
diff --git a/internal/rosa/package/x.az b/internal/rosa/package/x.az
index c1a7cd82..b1fa9a73 100644
--- a/internal/rosa/package/x.az
+++ b/internal/rosa/package/x.az
@@ -638,12 +638,12 @@ package xkeyboard-config {
 	website = "https://www.freedesktop.org/wiki/Software/XKeyboardConfig";
 	anitya = 5191;
 
-	version# = "2.48";
+	version# = "2.49";
 	source = remoteGitLab {
 		domain = "gitlab.freedesktop.org";
 		suffix = "xkeyboard-config/xkeyboard-config";
 		ref = "xkeyboard-config-"+version;
-		checksum = "_CxeFtwCaki-ZzoVtBgLnJ1p6tDJTAsfGmWJy867ij7equ5-lTKMV2YheE_Lbpo4";
+		checksum = "g91FVLHmDMO2BXaijEdF2rn88te7rBLePoSoG4eBgLKDCsoz_P2AkS6b_Sq8Z07f";
 	};
 
 	exec = meson {};