configure.ac                                                                |  
  2 
 download.lst                                                                |  
 32 ++--
 external/cairo/ExternalPackage_pixman.mk                                    |  
  2 
 external/cairo/ExternalProject_pixman.mk                                    |  
  6 
 external/cairo/pixman/pixman-0.24.4.patch                                   |  
  2 
 external/cairo/pixman/pixman-ubsan.patch                                    |  
 41 +++--
 external/curl/UnpackedTarball_curl.mk                                       |  
  6 
 external/curl/asan-poison-nsspem.patch.0                                    |  
 11 +
 external/curl/curl-msvc-disable-protocols.patch.1                           |  
  2 
 external/curl/curl-nss.patch.1                                              |  
  2 
 external/curl/zlib.patch.0                                                  |  
 12 -
 external/expat/expat-winapi.patch                                           |  
 13 -
 external/gpgmepp/0001-cpp-Fix-building-with-C-11.patch.1                    |  
 72 ++++++++++
 external/gpgmepp/ExternalPackage_gpgmepp.mk                                 |  
  4 
 external/gpgmepp/ExternalProject_gpgmepp.mk                                 |  
 17 --
 external/gpgmepp/Library_gpgmepp.mk                                         |  
  3 
 external/gpgmepp/UnpackedTarball_gpgmepp.mk                                 |  
  5 
 external/gpgmepp/Wincompatible-function-pointer-types.patch                 |  
 31 ++++
 external/gpgmepp/asan.patch                                                 |  
  2 
 external/gpgmepp/configure.patch                                            |  
  4 
 external/gpgmepp/find-libgpg-error-libassuan.patch                          |  
  6 
 external/gpgmepp/fix-autoconf-macros.patch                                  |  
  8 -
 external/gpgmepp/gcc9.patch                                                 |  
  2 
 external/gpgmepp/gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1 |  
 32 ----
 external/gpgmepp/macos-include.patch                                        |  
 10 +
 external/gpgmepp/rpath.patch                                                |  
  2 
 external/gpgmepp/ubsan.patch                                                |  
  8 -
 external/gpgmepp/w32-build-fixes.patch.1                                    |  
 16 +-
 external/gpgmepp/w32-disable-docs.patch.1                                   |  
  2 
 external/gpgmepp/w32-fix-libtool.patch.1                                    |  
  2 
 external/gpgmepp/w32-fix-win32-macro.patch.1                                |  
 20 +-
 external/gpgmepp/w32-include.patch                                          |  
 42 +++++
 external/nss/UnpackedTarball_nss.mk                                         |  
  2 
 external/nss/asan.patch.1                                                   |  
  2 
 external/nss/clang-cl.patch.0                                               |  
 12 -
 external/nss/macos-dlopen.patch.0                                           |  
  2 
 external/nss/nss-android.patch.1                                            |  
  6 
 external/nss/nss-ios.patch                                                  |  
 36 ++---
 external/nss/nss-restore-manual-pre-dependencies.patch.1                    |  
  2 
 external/nss/nss-win32-make.patch.1                                         |  
  4 
 external/nss/nss.aix.patch                                                  |  
 10 -
 external/nss/nss.bzmozilla1238154.patch                                     |  
  2 
 external/nss/nss.cygwin64.in32bit.patch                                     |  
  2 
 external/nss/nss.nowerror.patch                                             |  
  2 
 external/nss/nss.utf8bom.patch.1                                            |  
  4 
 external/nss/nss.vs2015.patch                                               |  
  2 
 external/nss/nss.vs2015.pdb.patch                                           |  
  2 
 external/nss/nss.windows.patch                                              |  
  6 
 external/nss/nss_macosx.patch                                               |  
 12 -
 external/nss/ubsan.patch.0                                                  |  
  2 
 external/poppler/disable-freetype.patch.1                                   |  
  4 
 external/poppler/sanitizer.patch                                            |  
  4 
 52 files changed, 342 insertions(+), 195 deletions(-)

New commits:
commit 2f06853da17ff0f3a4625005f4830d9550f7723a
Author:     Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Fri Dec 30 21:29:58 2022 +0900
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Feb 1 12:00:00 2023 +0100

    curl: upgrade to release 7.87.0
    
    Fixes CVE-2022-43551 and CVE-2022-43552.
    
    https://curl.se/docs/CVE-2022-43551.html
    https://curl.se/docs/CVE-2022-43552.html
    
    Change-Id: I979ed11c212aef226ad9f26420462e5f9dbe15e5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145116
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/download.lst b/download.lst
index f92182c9f998..2e4ca0cdb73c 100644
--- a/download.lst
+++ b/download.lst
@@ -37,8 +37,8 @@ export CPPUNIT_SHA256SUM := 
89c5c6665337f56fd2db36bc3805a5619709d51fb136e5193707
 export CPPUNIT_TARBALL := cppunit-1.15.1.tar.gz
 export CT2N_SHA256SUM := 
71b238efd2734be9800af07566daea8d6685aeed28db5eb5fa0e6453f4d85de3
 export CT2N_TARBALL := 
1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt
-export CURL_SHA256SUM := 
2d61116e5f485581f6d59865377df4463f2e788677ac43222b496d4e49fb627b
-export CURL_TARBALL := curl-7.86.0.tar.xz
+export CURL_SHA256SUM := 
ee5f1a1955b0ed413435ef79db28b834ea5f0fb7c8cfb1ce47175cc3bee08fff
+export CURL_TARBALL := curl-7.87.0.tar.xz
 export EBOOK_SHA256SUM := 
7e8d8ff34f27831aca3bc6f9cc532c2f90d2057c778963b884ff3d1e34dfe1f9
 export EBOOK_TARBALL := libe-book-0.1.3.tar.xz
 export EPOXY_SHA256SUM := 
a7ced37f4102b745ac86d6a70a9da399cc139ff168ba6b8002b4d8d43c900c15
diff --git a/external/curl/UnpackedTarball_curl.mk 
b/external/curl/UnpackedTarball_curl.mk
index 004ae5c69850..e78adabb8d07 100644
--- a/external/curl/UnpackedTarball_curl.mk
+++ b/external/curl/UnpackedTarball_curl.mk
@@ -39,4 +39,10 @@ $(eval $(call gb_UnpackedTarball_add_patches,curl, \
 ))
 endif
 
+ifneq ($(filter -fsanitize=%,$(CC)),)
+$(eval $(call gb_UnpackedTarball_add_patches,curl, \
+    external/curl/asan-poison-nsspem.patch.0 \
+))
+endif
+
 # vim: set noet sw=4 ts=4:
diff --git a/external/curl/asan-poison-nsspem.patch.0 
b/external/curl/asan-poison-nsspem.patch.0
new file mode 100644
index 000000000000..1f490bd6bf86
--- /dev/null
+++ b/external/curl/asan-poison-nsspem.patch.0
@@ -0,0 +1,11 @@
+--- lib/vtls/nss.c
++++ lib/vtls/nss.c
+@@ -1945,7 +1945,7 @@
+ 
+   PK11_SetPasswordFunc(nss_get_password);
+ 
+-  result = nss_load_module(&pem_module, pem_library, "PEM");
++  result = CURLE_FAILED_INIT;
+   PR_Unlock(nss_initlock);
+   if(result == CURLE_FAILED_INIT)
+     infof(data, "WARNING: failed to load NSS PEM library %s. Using "
diff --git a/external/curl/curl-msvc-disable-protocols.patch.1 
b/external/curl/curl-msvc-disable-protocols.patch.1
index 89c4ff576f85..71ff0c01a028 100644
--- a/external/curl/curl-msvc-disable-protocols.patch.1
+++ b/external/curl/curl-msvc-disable-protocols.patch.1
@@ -2,7 +2,7 @@ disable protocols nobody needs in MSVC build
 
 --- curl/lib/config-win32.h.orig       2017-08-09 16:43:29.464000000 +0200
 +++ curl/lib/config-win32.h    2017-08-09 16:47:38.549200000 +0200
-@@ -616,4 +616,20 @@
+@@ -654,4 +654,20 @@
  #  define ENABLE_IPV6 1
  #endif
  
diff --git a/external/curl/curl-nss.patch.1 b/external/curl/curl-nss.patch.1
index 5ef25748d7eb..2128849369e7 100644
--- a/external/curl/curl-nss.patch.1
+++ b/external/curl/curl-nss.patch.1
@@ -1,7 +1,7 @@
 diff -ur curl.org/configure curl/configure
 --- curl.org/configure 2016-03-13 15:14:07.177000076 +0100
 +++ curl/configure     2016-03-13 15:16:44.132000076 +0100
-@@ -27985,7 +27985,12 @@
+@@ -28230,7 +28230,12 @@
        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Using hard-wired 
libraries and compilation flags for NSS." >&5
  printf "%s\n" "$as_me: WARNING: Using hard-wired libraries and compilation 
flags for NSS." >&2;}
        addld="-L$OPT_NSS/lib"
diff --git a/external/curl/zlib.patch.0 b/external/curl/zlib.patch.0
index b8e242a3aaea..b4442ba262d1 100644
--- a/external/curl/zlib.patch.0
+++ b/external/curl/zlib.patch.0
@@ -1,6 +1,6 @@
 --- configure
 +++ configure
-@@ -22808,7 +22808,6 @@
+@@ -23035,7 +23035,6 @@
  clean_CPPFLAGS=$CPPFLAGS
  clean_LDFLAGS=$LDFLAGS
  clean_LIBS=$LIBS
@@ -8,7 +8,7 @@
  
  # Check whether --with-zlib was given.
  if test ${with_zlib+y}
-@@ -22818,6 +22818,7 @@
+@@ -23045,6 +23044,7 @@
  
  
  if test "$OPT_ZLIB" = "no" ; then
@@ -16,7 +16,7 @@
      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: zlib disabled" >&5
  printf "%s\n" "$as_me: WARNING: zlib disabled" >&2;}
  else
-@@ -22825,6 +825,21 @@
+@@ -23052,6 +23052,21 @@
      OPT_ZLIB=""
    fi
  
@@ -38,7 +38,7 @@
    if test -z "$OPT_ZLIB" ; then
  
      if test -n "$PKG_CONFIG"; then
-@@ -23120,6 +23120,7 @@
+@@ -23344,6 +23359,7 @@
  printf "%s\n" "$as_me: found both libz and libz.h header" >&6;}
      curl_zlib_msg="enabled"
    fi
@@ -48,7 +48,7 @@
   if test x"$AMFIXLIB" = x1; then
 --- configure.ac
 +++ configure.ac
-@@ -1222,19 +1222,30 @@
+@@ -1243,19 +1243,30 @@
  clean_CPPFLAGS=$CPPFLAGS
  clean_LDFLAGS=$LDFLAGS
  clean_LIBS=$LIBS
@@ -80,7 +80,7 @@
    if test -z "$OPT_ZLIB" ; then
      CURL_CHECK_PKGCONFIG(zlib)
  
-@@ -1316,6 +1316,7 @@
+@@ -1336,6 +1347,7 @@
      AC_MSG_NOTICE([found both libz and libz.h header])
      curl_zlib_msg="enabled"
    fi
commit 8ef5e70c7edaa271d68c819982b9e054ad9ffffa
Author:     Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Mon Nov 21 23:39:38 2022 +0900
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Feb 1 11:59:59 2023 +0100

    gpgme: upgrade to release 1.18.0
    
    Remove gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1 as it has 
applied in 1.18.0.
    
    * 0001-cpp-Fix-building-with-C-11.patch.1: fixed error "no matching 
function for call to object of type "(lambda at importresult.cpp:154:71)"".
    * w32-include.patch: add missing #include <string> (for std::string).
    * macos-include.patch: add missing #include <algorithm> (for std::any_of).
    
    Change-Id: I45f2ef415d80e6ee848699803e971f154812c9c6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143039
    Tested-by: Jenkins
    Tested-by: Caolán McNamara <caol...@redhat.com>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 1c5c31b006f8515bfea440bbcf286f8b4b840aac)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144270

diff --git a/download.lst b/download.lst
index ba51aa391ea2..f92182c9f998 100644
--- a/download.lst
+++ b/download.lst
@@ -122,8 +122,8 @@ export FREETYPE_SHA256SUM := 
ef5c336aacc1a079ff9262d6308d6c2a066dd4d2a905301c4ad
 export FREETYPE_TARBALL := freetype-2.12.0.tar.xz
 export GLM_SHA256SUM := 
6bba5f032bed47c73ad9397f2313b9acbfb56253d0d0576b5873d3dcb25e99ad
 export GLM_TARBALL := glm-0.9.9.8.zip
-export GPGME_SHA256SUM := 
6c8cc4aedb10d5d4c905894ba1d850544619ee765606ac43df7405865de29ed0
-export GPGME_TARBALL := gpgme-1.16.0.tar.bz2
+export GPGME_SHA256SUM := 
361d4eae47ce925dba0ea569af40e7b52c645c4ae2e65e5621bf1b6cdd8b0e9e
+export GPGME_TARBALL := gpgme-1.18.0.tar.bz2
 export GRAPHITE_SHA256SUM := 
b8e892d8627c41888ff121e921455b9e2d26836978f2359173d19825da62b8fc
 export GRAPHITE_TARBALL := graphite2-minimal-1.3.14.tgz
 export HARFBUZZ_SHA256SUM := 
d58461395ce28b9dc03903254374dd70c38c8c28c5046db123c08f7ab9417be7
diff --git a/external/gpgmepp/0001-cpp-Fix-building-with-C-11.patch.1 
b/external/gpgmepp/0001-cpp-Fix-building-with-C-11.patch.1
new file mode 100755
index 000000000000..c7b288d7240a
--- /dev/null
+++ b/external/gpgmepp/0001-cpp-Fix-building-with-C-11.patch.1
@@ -0,0 +1,72 @@
+From f02c20cc9c5756690b07abfd02a43533547ba2ef Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <d...@ingo-kloecker.de>
+Date: Fri, 19 Aug 2022 11:05:37 +0200
+Subject: [PATCH] cpp: Fix building with C++11
+
+* lang/cpp/src/importresult.cpp (ImportResult::mergeWith): Replace
+'auto' in lambdas with the actual type.
+--
+
+Generic lambdas require C++14.
+
+GnuPG-bug-id: 6141
+---
+ lang/cpp/src/importresult.cpp | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/lang/cpp/src/importresult.cpp b/lang/cpp/src/importresult.cpp
+index 06258729..0a7ad03d 100644
+--- a/lang/cpp/src/importresult.cpp
++++ b/lang/cpp/src/importresult.cpp
+@@ -152,17 +152,17 @@ void GpgME::ImportResult::mergeWith(const ImportResult 
&other)
+         }
+         // was this key also considered during the first import
+         const auto consideredInFirstImports =
+-            std::any_of(std::begin(d->imports), std::end(d->imports), 
[fpr](const auto i) {
++            std::any_of(std::begin(d->imports), std::end(d->imports), 
[fpr](const gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr);
+             });
+         // did we see this key already in the list of keys of the other import
+         const auto consideredInPreviousOtherImports =
+-            std::any_of(std::begin(other.d->imports), it, [fpr](const auto i) 
{
++            std::any_of(std::begin(other.d->imports), it, [fpr](const 
gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr);
+             });
+         // was anything added to this key during the other import
+         const auto changedInOtherImports =
+-            std::any_of(std::begin(other.d->imports), 
std::end(other.d->imports), [fpr](const auto i) {
++            std::any_of(std::begin(other.d->imports), 
std::end(other.d->imports), [fpr](const gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr) && (i->status != 0);
+             });
+         if (consideredInFirstImports && !consideredInPreviousOtherImports) {
+@@ -177,15 +177,15 @@ void GpgME::ImportResult::mergeWith(const ImportResult 
&other)
+ 
+         // now do the same for the secret key counts
+         const auto secretKeyConsideredInFirstImports =
+-            std::any_of(std::begin(d->imports), std::end(d->imports), 
[fpr](const auto i) {
++            std::any_of(std::begin(d->imports), std::end(d->imports), 
[fpr](const gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr) && (i->status & 
GPGME_IMPORT_SECRET);
+             });
+         const auto secretKeyConsideredInPreviousOtherImports =
+-            std::any_of(std::begin(other.d->imports), it, [fpr](const auto i) 
{
++            std::any_of(std::begin(other.d->imports), it, [fpr](const 
gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr) && (i->status & 
GPGME_IMPORT_SECRET);
+             });
+         const auto secretKeyChangedInOtherImports =
+-            std::any_of(std::begin(other.d->imports), 
std::end(other.d->imports), [fpr](const auto i) {
++            std::any_of(std::begin(other.d->imports), 
std::end(other.d->imports), [fpr](const gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr) && (i->status & 
GPGME_IMPORT_SECRET) && (i->status != GPGME_IMPORT_SECRET);
+             });
+         if (secretKeyConsideredInFirstImports && 
!secretKeyConsideredInPreviousOtherImports) {
+@@ -204,7 +204,7 @@ void GpgME::ImportResult::mergeWith(const ImportResult 
&other)
+     d->imports.reserve(d->imports.size() + other.d->imports.size());
+     std::transform(std::begin(other.d->imports), std::end(other.d->imports),
+                    std::back_inserter(d->imports),
+-                   [](const auto import) {
++                   [](const gpgme_import_status_t import) {
+                        gpgme_import_status_t copy = new 
_gpgme_import_status{*import};
+                        if (import->fpr) {
+                            copy->fpr = strdup(import->fpr);
+-- 
+2.34.1
+
diff --git a/external/gpgmepp/ExternalPackage_gpgmepp.mk 
b/external/gpgmepp/ExternalPackage_gpgmepp.mk
index a2b207597cdd..2b853087216b 100644
--- a/external/gpgmepp/ExternalPackage_gpgmepp.mk
+++ b/external/gpgmepp/ExternalPackage_gpgmepp.mk
@@ -15,8 +15,8 @@ ifneq ($(DISABLE_DYNLOADING),TRUE)
 
 ifeq ($(OS),LINUX)
 
-$(eval $(call 
gb_ExternalPackage_add_file,gpgmepp,$(LIBO_LIB_FOLDER)/libgpgmepp.so.6,lang/cpp/src/.libs/libgpgmepp.so.6.13.0))
-$(eval $(call 
gb_ExternalPackage_add_file,gpgmepp,$(LIBO_LIB_FOLDER)/libgpgme.so.11,src/.libs/libgpgme.so.11.25.0))
+$(eval $(call 
gb_ExternalPackage_add_file,gpgmepp,$(LIBO_LIB_FOLDER)/libgpgmepp.so.6,lang/cpp/src/.libs/libgpgmepp.so.6.15.0))
+$(eval $(call 
gb_ExternalPackage_add_file,gpgmepp,$(LIBO_LIB_FOLDER)/libgpgme.so.11,src/.libs/libgpgme.so.11.27.0))
 
 else ifeq ($(OS),MACOSX)
 
diff --git a/external/gpgmepp/ExternalProject_gpgmepp.mk 
b/external/gpgmepp/ExternalProject_gpgmepp.mk
index a3166e94175e..a58717fe3adb 100644
--- a/external/gpgmepp/ExternalProject_gpgmepp.mk
+++ b/external/gpgmepp/ExternalProject_gpgmepp.mk
@@ -27,6 +27,7 @@ $(call gb_ExternalProject_get_state_target,gpgmepp,build): 
$(call gb_Executable_
                $(gb_WIN_GPG_cross_setup_exports) \
                && autoreconf \
                && $(gb_RUN_CONFIGURE) ./configure \
+                  $(gb_CONFIGURE_PLATFORMS) \
                   --disable-shared \
                   --disable-languages \
                   --disable-gpgconf-test \
@@ -35,9 +36,7 @@ $(call gb_ExternalProject_get_state_target,gpgmepp,build): 
$(call gb_Executable_
                   --disable-g13-test \
            $(if $(verbose),--disable-silent-rules,--enable-silent-rules) \
                   CFLAGS='$(CFLAGS) \
-                               $(if $(ENABLE_OPTIMIZED), \
-                                       
$(gb_COMPILEROPTFLAGS),$(gb_COMPILERNOOPTFLAGS)) \
-                               $(if $(call 
gb_Module__symbols_enabled,gpgmepp),$(gb_DEBUGINFO_FLAGS))' \
+                               $(call 
gb_ExternalProject_get_build_flags,gpgmepp)' \
                   $(gb_WIN_GPG_platform_switches) \
                   MAKE=$(MAKE) \
            && $(MAKE) \
@@ -59,18 +58,14 @@ $(call gb_ExternalProject_get_state_target,gpgmepp,build):
                   LIBASSUAN_CFLAGS="$(LIBASSUAN_CFLAGS)" \
                   LIBASSUAN_LIBS="$(LIBASSUAN_LIBS)" \
                   CFLAGS='$(CFLAGS) \
-                               $(if $(ENABLE_OPTIMIZED), \
-                                       
$(gb_COMPILEROPTFLAGS),$(gb_COMPILERNOOPTFLAGS)) \
-                               $(if $(call 
gb_Module__symbols_enabled,gpgmepp),$(gb_DEBUGINFO_FLAGS))' \
+                               $(call 
gb_ExternalProject_get_build_flags,gpgmepp)' \
                   CXXFLAGS='$(CXXFLAGS) \
-                               $(if $(ENABLE_OPTIMIZED), \
-                                       
$(gb_COMPILEROPTFLAGS),$(gb_COMPILERNOOPTFLAGS)) \
-                               $(gb_COMPILERDEFS_STDLIB_DEBUG) \
-                               $(if $(call 
gb_Module__symbols_enabled,gpgmepp),$(gb_DEBUGINFO_FLAGS))' \
+                               $(call 
gb_ExternalProject_get_build_flags,gpgmepp) \
+                               $(gb_COMPILERDEFS_STDLIB_DEBUG)' \
                   $(if $(filter LINUX,$(OS)), \
                                'LDFLAGS=-Wl$(COMMA)-z$(COMMA)origin \
                                        -Wl$(COMMA)-rpath$(COMMA)\$$$$ORIGIN') \
-                  $(if $(CROSS_COMPILING),--build=$(BUILD_PLATFORM) 
--host=$(HOST_PLATFORM)) \
+                  $(gb_CONFIGURE_PLATFORMS) \
                   $(if $(filter 
MACOSX,$(OS)),--prefix=/@.__________________________________________________OOO)
 \
                   $(if $(filter 
TRUE,$(DISABLE_DYNLOADING)),--disable-shared,--disable-static) \
          && $(MAKE) \
diff --git a/external/gpgmepp/Library_gpgmepp.mk 
b/external/gpgmepp/Library_gpgmepp.mk
index f60301a4eb0d..ac71cf8b90ec 100644
--- a/external/gpgmepp/Library_gpgmepp.mk
+++ b/external/gpgmepp/Library_gpgmepp.mk
@@ -58,9 +58,11 @@ $(eval $(call 
gb_Library_add_generated_exception_objects,gpgmepp,\
        UnpackedTarball/gpgmepp/lang/cpp/src/engineinfo \
        UnpackedTarball/gpgmepp/lang/cpp/src/eventloopinteractor \
        UnpackedTarball/gpgmepp/lang/cpp/src/exception \
+       UnpackedTarball/gpgmepp/lang/cpp/src/gpgaddexistingsubkeyeditinteractor 
\
        UnpackedTarball/gpgmepp/lang/cpp/src/gpgadduserideditinteractor \
        UnpackedTarball/gpgmepp/lang/cpp/src/gpgagentgetinfoassuantransaction \
        UnpackedTarball/gpgmepp/lang/cpp/src/gpggencardkeyinteractor \
+       UnpackedTarball/gpgmepp/lang/cpp/src/gpgrevokekeyeditinteractor \
        UnpackedTarball/gpgmepp/lang/cpp/src/gpgsetexpirytimeeditinteractor \
        UnpackedTarball/gpgmepp/lang/cpp/src/gpgsetownertrusteditinteractor \
        UnpackedTarball/gpgmepp/lang/cpp/src/gpgsignkeyeditinteractor \
@@ -73,6 +75,7 @@ $(eval $(call 
gb_Library_add_generated_exception_objects,gpgmepp,\
        UnpackedTarball/gpgmepp/lang/cpp/src/swdbresult \
        UnpackedTarball/gpgmepp/lang/cpp/src/tofuinfo \
        UnpackedTarball/gpgmepp/lang/cpp/src/trustitem \
+       UnpackedTarball/gpgmepp/lang/cpp/src/util \
        UnpackedTarball/gpgmepp/lang/cpp/src/verificationresult \
        UnpackedTarball/gpgmepp/lang/cpp/src/vfsmountresult \
 ))
diff --git a/external/gpgmepp/UnpackedTarball_gpgmepp.mk 
b/external/gpgmepp/UnpackedTarball_gpgmepp.mk
index 05bfc9f07bf1..be2b616d1268 100644
--- a/external/gpgmepp/UnpackedTarball_gpgmepp.mk
+++ b/external/gpgmepp/UnpackedTarball_gpgmepp.mk
@@ -32,6 +32,9 @@ $(eval $(call gb_UnpackedTarball_add_patches,gpgmepp, \
     external/gpgmepp/c++20.patch \
     external/gpgmepp/clang-cl.patch \
     external/gpgmepp/configure.patch \
-    
external/gpgmepp/gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1 \
+    external/gpgmepp/w32-include.patch \
+    external/gpgmepp/Wincompatible-function-pointer-types.patch \
+    external/gpgmepp/0001-cpp-Fix-building-with-C-11.patch.1 \
+    external/gpgmepp/macos-include.patch \
 ))
 # vim: set noet sw=4 ts=4:
diff --git a/external/gpgmepp/Wincompatible-function-pointer-types.patch 
b/external/gpgmepp/Wincompatible-function-pointer-types.patch
new file mode 100755
index 000000000000..050d2e55cfc7
--- /dev/null
+++ b/external/gpgmepp/Wincompatible-function-pointer-types.patch
@@ -0,0 +1,31 @@
+--- src/assuan-support.c
++++ src/assuan-support.c
+@@ -126,7 +126,7 @@
+ }
+ 
+ 
+-static gpgme_ssize_t
++static ssize_t
+ my_read (assuan_context_t ctx, assuan_fd_t fd, void *buffer, size_t size)
+ {
+   (void)ctx;
+@@ -134,7 +134,7 @@
+ }
+ 
+ 
+-static gpgme_ssize_t
++static ssize_t
+ my_write (assuan_context_t ctx, assuan_fd_t fd, const void *buffer, size_t 
size)
+ {
+   (void)ctx;
+--- src/gpgme-w32spawn.c
++++ src/gpgme-w32spawn.c
+@@ -243,7 +243,7 @@
+           handle = LoadLibrary ("user32.dll");
+           if (handle)
+             {
+-              func = GetProcAddress (handle, "AllowSetForegroundWindow");
++              func = (BOOL (WINAPI *)(DWORD)) GetProcAddress (handle, 
"AllowSetForegroundWindow");
+               if (!func)
+                 FreeLibrary (handle);
+             }
diff --git a/external/gpgmepp/asan.patch b/external/gpgmepp/asan.patch
index 16d97f6ff307..e0b1c85fe51b 100644
--- a/external/gpgmepp/asan.patch
+++ b/external/gpgmepp/asan.patch
@@ -1,6 +1,6 @@
 --- src/posix-io.c
 +++ src/posix-io.c
-@@ -468,6 +468,9 @@
+@@ -563,6 +563,9 @@
  
          if (atfork)
            atfork (atforkvalue, 0);
diff --git a/external/gpgmepp/configure.patch b/external/gpgmepp/configure.patch
index 4b51db6bebad..ad3f97e632fb 100644
--- a/external/gpgmepp/configure.patch
+++ b/external/gpgmepp/configure.patch
@@ -1,6 +1,6 @@
 --- configure.ac
 +++ configure.ac
-@@ -619,6 +619,15 @@
+@@ -617,6 +617,15 @@
  AC_SUBST(API__SSIZE_T)
  AM_SUBST_NOTMAKE(API__SSIZE_T)
  
@@ -16,7 +16,7 @@
  # Checks for compiler features.
  if test "$GCC" = yes; then
      CFLAGS="$CFLAGS -Wall -Wcast-align -Wshadow -Wstrict-prototypes"
-@@ -679,15 +679,6 @@
+@@ -677,15 +686,6 @@
  
  AC_FUNC_FSEEKO
  
diff --git a/external/gpgmepp/find-libgpg-error-libassuan.patch 
b/external/gpgmepp/find-libgpg-error-libassuan.patch
index a65e453fc8b6..a98a7d845a34 100644
--- a/external/gpgmepp/find-libgpg-error-libassuan.patch
+++ b/external/gpgmepp/find-libgpg-error-libassuan.patch
@@ -2,7 +2,7 @@ diff --git a/configure.ac b/configure.ac
 index f28480b..92a3e85 100644
 --- configure.ac
 +++ configure.ac
-@@ -674,15 +674,34 @@ AC_CHECK_FUNCS(setlocale)
+@@ -719,8 +719,18 @@
  
  # Checking for libgpg-error.
  have_gpg_error=no
@@ -23,6 +23,8 @@ index f28480b..92a3e85 100644
  AC_DEFINE(GPG_ERR_SOURCE_DEFAULT, GPG_ERR_SOURCE_GPGME,
            [The default error source for GPGME.])
  
+@@ -729,8 +739,17 @@
+ 
  # And for libassuan.
  have_libassuan=no
 -AM_PATH_LIBASSUAN("$NEED_LIBASSUAN_API:$NEED_LIBASSUAN_VERSION",
@@ -53,7 +55,7 @@ index f28480b..92a3e85 100644
  AM_CPPFLAGS = -I$(top_srcdir)/lang/cpp/src -I$(top_builddir)/src \
 --- lang/cpp/tests/Makefile.in 2020-06-20 00:44:49.542344510 +0200
 +++ lang/cpp/tests/Makefile.in~        2020-06-13 00:55:19.021212970 +0200
-@@ -415,7 +415,7 @@
+@@ -427,7 +427,7 @@
  top_srcdir = @top_srcdir@
  AM_LDFLAGS = -no-install
  LDADD = ../../cpp/src/libgpgmepp.la \
diff --git a/external/gpgmepp/fix-autoconf-macros.patch 
b/external/gpgmepp/fix-autoconf-macros.patch
index e333168b2b33..265703b00671 100644
--- a/external/gpgmepp/fix-autoconf-macros.patch
+++ b/external/gpgmepp/fix-autoconf-macros.patch
@@ -1,7 +1,7 @@
 diff -ur gpgme.org/configure.ac gpgme/configure.ac
 --- configure.ac       2017-02-16 15:18:45.051417378 +0100
 +++ configure.ac~      2017-02-16 15:20:03.635059285 +0100
-@@ -35,6 +35,11 @@
+@@ -38,6 +38,11 @@
  # the decimalized short revision number, a beta version string and a
  # flag indicating a development version (mym4_isbeta).  Note that the
  # m4 processing is done by autoconf and not during the configure run.
@@ -13,10 +13,10 @@ diff -ur gpgme.org/configure.ac gpgme/configure.ac
  m4_define([mym4_verslist], m4_split(m4_esyscmd([./autogen.sh --find-version] \
                             mym4_package mym4_major mym4_minor 
mym4_micro),[:]))
  m4_define([mym4_isbeta],       m4_argn(2, mym4_verslist))
-@@ -90,7 +90,22 @@
+@@ -98,7 +103,22 @@
  AC_CONFIG_MACRO_DIR([m4])
- AC_CONFIG_SRCDIR(src/gpgme.h.in)
- AC_CONFIG_HEADER(conf/config.h)
+ AC_CONFIG_SRCDIR([src/gpgme.h.in])
+ AC_CONFIG_HEADERS([conf/config.h])
 -AM_INIT_AUTOMAKE([serial-tests dist-bzip2 no-dist-gzip])
 +
 +dnl Initialize automake.  automake < 1.12 didn't have serial-tests and
diff --git a/external/gpgmepp/gcc9.patch b/external/gpgmepp/gcc9.patch
index c2a9fd444df7..709154ec102b 100644
--- a/external/gpgmepp/gcc9.patch
+++ b/external/gpgmepp/gcc9.patch
@@ -1,6 +1,6 @@
 --- lang/cpp/src/key.h
 +++ lang/cpp/src/key.h
-@@ -62,6 +62,7 @@
+@@ -68,6 +68,7 @@
      /* implicit */ Key(const Null &);
      Key(const shared_gpgme_key_t &key);
      Key(gpgme_key_t key, bool acquireRef);
diff --git 
a/external/gpgmepp/gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1 
b/external/gpgmepp/gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1
deleted file mode 100644
index 8b12c1785ccf..000000000000
--- 
a/external/gpgmepp/gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1
+++ /dev/null
@@ -1,32 +0,0 @@
-From 4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e Mon Sep 17 00:00:00 2001
-From: Jiri Kucera <sanc...@gmail.com>
-Date: Sun, 25 Jul 2021 11:35:54 +0200
-Subject: [PATCH] core: Support closefrom also for glibc.
-
-* src/posix-io.c (_gpgme_io_spawn): Use glibc's closefrom.
---
-
-Since 2.34, glibc introduces closefrom (the implementation
-follows *BSD standard).
-
-Signed-off-by: Werner Koch <w...@gnupg.org>
----
- src/posix-io.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/posix-io.c b/src/posix-io.c
-index e712ef28..2a3a81fc 100644
---- a/src/posix-io.c
-+++ b/src/posix-io.c
-@@ -570,7 +570,7 @@ _gpgme_io_spawn (const char *path, char *const argv[], 
unsigned int flags,
-               if (fd_list[i].fd > fd)
-                 fd = fd_list[i].fd;
-             fd++;
--#if defined(__sun) || defined(__FreeBSD__)
-+#if defined(__sun) || defined(__FreeBSD__) || defined(__GLIBC__)
-             closefrom (fd);
-             max_fds = fd;
- #else /*!__sun */
--- 
-2.11.0
-
diff --git a/external/gpgmepp/macos-include.patch 
b/external/gpgmepp/macos-include.patch
new file mode 100644
index 000000000000..93dd297c7368
--- /dev/null
+++ b/external/gpgmepp/macos-include.patch
@@ -0,0 +1,10 @@
+--- lang/cpp/src/importresult.cpp      2022-08-10 18:17:33.000000000 +0900
++++ lang/cpp/src/importresult.cpp      2022-11-29 01:37:44.786604882 +0900
+@@ -31,6 +31,7 @@
+ #include "result_p.h"
+ 
+ #include <gpgme.h>
++#include <algorithm>
+ #include <cstdlib>
+ #include <cstring>
+ 
diff --git a/external/gpgmepp/rpath.patch b/external/gpgmepp/rpath.patch
index e83dcf2762ef..6e6c46105b94 100644
--- a/external/gpgmepp/rpath.patch
+++ b/external/gpgmepp/rpath.patch
@@ -1,6 +1,6 @@
 --- configure.ac
 +++ configure.ac
-@@ -176,6 +176,9 @@
+@@ -187,6 +187,9 @@
  LT_INIT([win32-dll disable-static])
  LT_LANG([Windows Resource])
  
diff --git a/external/gpgmepp/ubsan.patch b/external/gpgmepp/ubsan.patch
index 5a6e6dcdc9b2..2262291cd8b5 100644
--- a/external/gpgmepp/ubsan.patch
+++ b/external/gpgmepp/ubsan.patch
@@ -1,8 +1,8 @@
 --- src/engine-gpg.c
 +++ src/engine-gpg.c
-@@ -60,6 +60,15 @@
+@@ -61,6 +61,15 @@
                      building command line to this location.  */
-   char arg[1];     /* Used if data above is not used.  */
+   char arg[FLEXIBLE_ARRAY_MEMBER];     /* Used if data above is not used.  */
  };
 +struct arg_without_data_s
 +{
@@ -16,8 +16,8 @@
  
  
  struct fd_data_map_s
-@@ -299,23 +308,24 @@
-   a = malloc (sizeof *a - 1);
+@@ -310,23 +319,24 @@
+   a = malloc (offsetof (struct arg_and_data_s, arg));
    if (!a)
      return gpg_error_from_syserror ();
 -  a->next = NULL;
diff --git a/external/gpgmepp/w32-build-fixes.patch.1 
b/external/gpgmepp/w32-build-fixes.patch.1
index 01ea99d91e43..d6d8af601015 100644
--- a/external/gpgmepp/w32-build-fixes.patch.1
+++ b/external/gpgmepp/w32-build-fixes.patch.1
@@ -13,7 +13,7 @@ diff -ru gpgme.orig/m4/ax_cxx_compile_stdcxx.m4 
gpgme/m4/ax_cxx_compile_stdcxx.m
 diff -ru gpgme.orig/src/dirinfo.c gpgme/src/dirinfo.c
 --- gpgme.orig/src/dirinfo.c   2017-03-21 11:09:41.000000000 +0100
 +++ gpgme/src/dirinfo.c        2017-09-30 08:36:13.239279300 +0200
-@@ -33,6 +33,10 @@
+@@ -34,6 +34,10 @@
  
  DEFINE_STATIC_LOCK (dirinfo_lock);
  
@@ -27,7 +27,7 @@ diff -ru gpgme.orig/src/dirinfo.c gpgme/src/dirinfo.c
 diff -ru gpgme.orig/src/mbox-util.c gpgme/src/mbox-util.c
 --- gpgme.orig/src/mbox-util.c 2016-11-16 13:22:41.000000000 +0100
 +++ gpgme/src/mbox-util.c      2017-09-30 08:18:29.270567500 +0200
-@@ -28,7 +28,9 @@
+@@ -29,7 +29,9 @@
  #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
@@ -40,7 +40,7 @@ diff -ru gpgme.orig/src/mbox-util.c gpgme/src/mbox-util.c
 diff -ru gpgme.orig/src/priv-io.h gpgme/src/priv-io.h
 --- gpgme.orig/src/priv-io.h   2016-11-16 13:23:14.000000000 +0100
 +++ gpgme/src/priv-io.h        2017-09-30 08:20:38.770562400 +0200
-@@ -36,6 +36,9 @@
+@@ -33,6 +33,9 @@
  #ifdef HAVE_SYS_TYPES_H
  # include <sys/types.h>
  #endif
@@ -53,7 +53,7 @@ diff -ru gpgme.orig/src/priv-io.h gpgme/src/priv-io.h
 diff -ru gpgme.orig/src/util.h gpgme/src/util.h
 --- gpgme.orig/src/util.h      2017-03-28 11:41:30.000000000 +0200
 +++ gpgme/src/util.h   2017-09-30 08:10:54.194049100 +0200
-@@ -39,6 +39,9 @@
+@@ -35,6 +35,9 @@
  #ifdef HAVE_UNISTD_H
  # include <unistd.h>
  #endif
@@ -66,7 +66,7 @@ diff -ru gpgme.orig/src/util.h gpgme/src/util.h
 diff -ru gpgme.orig/src/w32-util.c gpgme/src/w32-util.c
 --- gpgme.orig/src/w32-util.c  2017-03-09 09:01:10.000000000 +0100
 +++ gpgme/src/w32-util.c       2017-09-30 08:32:02.114330500 +0200
-@@ -721,7 +721,8 @@
+@@ -772,7 +772,8 @@
        v /= 62;
        XXXXXX[5] = letters[v % 62];
  
@@ -79,7 +79,7 @@ diff -ru gpgme.orig/src/w32-util.c gpgme/src/w32-util.c
 diff -ru gpgme.orig/src/Makefile.am gpgme/src/Makefile.am
 --- gpgme.orig/src/Makefile.am 2017-09-30 11:50:07.456960000 +0200
 +++ gpgme/src/Makefile.am      2017-09-30 11:51:29.609649400 +0200
-@@ -26,7 +26,7 @@
+@@ -35,7 +35,7 @@
  m4data_DATA = gpgme.m4
  nodist_include_HEADERS = gpgme.h
  
@@ -88,7 +88,7 @@ diff -ru gpgme.orig/src/Makefile.am gpgme/src/Makefile.am
  
  if BUILD_W32_GLIB
  ltlib_gpgme_glib = libgpgme-glib.la
-@@ -99,11 +99,11 @@
+@@ -107,11 +107,11 @@
  # versions, because then every object file is only compiled once.
  AM_CFLAGS = @LIBASSUAN_CFLAGS@ @GPG_ERROR_CFLAGS@ @GLIB_CFLAGS@
  
@@ -104,7 +104,7 @@ diff -ru gpgme.orig/src/Makefile.am gpgme/src/Makefile.am
  
  
  if HAVE_W32_SYSTEM
-@@ -120,7 +120,7 @@
+@@ -126,7 +126,7 @@
  SUFFIXES = .rc .lo
  
  .rc.lo:
diff --git a/external/gpgmepp/w32-disable-docs.patch.1 
b/external/gpgmepp/w32-disable-docs.patch.1
index 2c307f502b63..1803ffa03cb5 100644
--- a/external/gpgmepp/w32-disable-docs.patch.1
+++ b/external/gpgmepp/w32-disable-docs.patch.1
@@ -4,7 +4,7 @@ like libgpg-error's --disable-doc
 diff -ur gpgmepp.org/Makefile.am gpgmepp/Makefile.am
 --- gpgmepp.org/Makefile.am    2016-11-16 13:20:18.000000000 +0100
 +++ gpgmepp/Makefile.am        2017-11-20 15:34:49.086731000 +0100
-@@ -33,7 +33,7 @@
+@@ -45,7 +45,7 @@
  tests =
  endif
  
diff --git a/external/gpgmepp/w32-fix-libtool.patch.1 
b/external/gpgmepp/w32-fix-libtool.patch.1
index 9a7adf713694..40893908b7f6 100644
--- a/external/gpgmepp/w32-fix-libtool.patch.1
+++ b/external/gpgmepp/w32-fix-libtool.patch.1
@@ -9,7 +9,7 @@ linking, by accepting cygwin path names, and correctly expanding
 diff -ur gpgmepp.org/m4/libtool.m4 gpgmepp/m4/libtool.m4
 --- gpgmepp.org/m4/libtool.m4  2016-11-16 13:20:16.000000000 +0100
 +++ gpgmepp/m4/libtool.m4      2017-11-21 22:00:05.006587800 +0100
-@@ -3209,24 +3209,11 @@
+@@ -3230,24 +3230,11 @@
    ;;
  
  cygwin*)
diff --git a/external/gpgmepp/w32-fix-win32-macro.patch.1 
b/external/gpgmepp/w32-fix-win32-macro.patch.1
index 66e9ac48099a..8ab7b0fab089 100644
--- a/external/gpgmepp/w32-fix-win32-macro.patch.1
+++ b/external/gpgmepp/w32-fix-win32-macro.patch.1
@@ -1,7 +1,7 @@
 diff -ur gpgmepp.org/lang/cpp/src/callbacks.cpp 
gpgmepp/lang/cpp/src/callbacks.cpp
 --- gpgmepp.org/lang/cpp/src/callbacks.cpp     2016-10-18 19:22:02.000000000 
+0200
 +++ gpgmepp/lang/cpp/src/callbacks.cpp 2017-11-20 18:03:04.290060900 +0100
-@@ -38,7 +38,9 @@
+@@ -40,7 +40,9 @@
  #include <cassert>
  #include <cerrno>
  #include <cstring>
@@ -29,7 +29,7 @@ diff -ur gpgmepp.org/lang/cpp/src/data.h 
gpgmepp/lang/cpp/src/data.h
 diff -ur gpgmepp.org/lang/cpp/src/editinteractor.cpp 
gpgmepp/lang/cpp/src/editinteractor.cpp
 --- gpgmepp.org/lang/cpp/src/editinteractor.cpp        2017-03-09 
09:01:10.000000000 +0100
 +++ gpgmepp/lang/cpp/src/editinteractor.cpp    2017-11-20 18:09:33.022674700 
+0100
-@@ -30,9 +30,11 @@
+@@ -33,9 +33,11 @@
  
  #include <gpgme.h>
  
@@ -46,7 +46,7 @@ diff -ur gpgmepp.org/lang/cpp/src/editinteractor.cpp 
gpgmepp/lang/cpp/src/editin
 diff -ur gpgmepp.org/lang/cpp/src/gpgmepp_export.h 
gpgmepp/lang/cpp/src/gpgmepp_export.h
 --- gpgmepp.org/lang/cpp/src/gpgmepp_export.h  2016-08-04 15:03:09.000000000 
+0200
 +++ gpgmepp/lang/cpp/src/gpgmepp_export.h      2017-11-20 16:57:47.805691100 
+0100
-@@ -29,14 +29,14 @@
+@@ -30,14 +30,14 @@
  #  ifndef GPGMEPP_EXPORT
  #    ifdef BUILDING_GPGMEPP
          /* We are building this library */
@@ -63,7 +63,7 @@ diff -ur gpgmepp.org/lang/cpp/src/gpgmepp_export.h 
gpgmepp/lang/cpp/src/gpgmepp_
  #       define GPGMEPP_EXPORT __declspec(dllimport)
  #      else
  #       define GPGMEPP_EXPORT __attribute__((visibility("default")))
-@@ -45,7 +45,7 @@
+@@ -46,7 +46,7 @@
  #  endif
  
  #  ifndef GPGMEPP_NO_EXPORT
@@ -72,7 +72,7 @@ diff -ur gpgmepp.org/lang/cpp/src/gpgmepp_export.h 
gpgmepp/lang/cpp/src/gpgmepp_
  #     define GPGMEPP_NO_EXPORT
  #    else
  #     define GPGMEPP_NO_EXPORT __attribute__((visibility("hidden")))
-@@ -54,7 +54,11 @@
+@@ -55,7 +55,11 @@
  #endif
  
  #ifndef GPGMEPP_DEPRECATED
@@ -88,7 +88,7 @@ diff -ur gpgmepp.org/lang/cpp/src/gpgmepp_export.h 
gpgmepp/lang/cpp/src/gpgmepp_
 diff -ur gpgmepp.org/lang/cpp/src/interfaces/dataprovider.h 
gpgmepp/lang/cpp/src/interfaces/dataprovider.h
 --- gpgmepp.org/lang/cpp/src/interfaces/dataprovider.h 2016-05-17 
14:32:37.000000000 +0200
 +++ gpgmepp/lang/cpp/src/interfaces/dataprovider.h     2017-11-20 
18:03:11.332715700 +0100
-@@ -29,6 +29,11 @@
+@@ -31,6 +31,11 @@
  
  #include <gpg-error.h>
  
@@ -103,7 +103,7 @@ diff -ur gpgmepp.org/lang/cpp/src/interfaces/dataprovider.h 
gpgmepp/lang/cpp/src
 diff -ur gpgmepp.org/lang/cpp/src/key.cpp gpgmepp/lang/cpp/src/key.cpp
 --- gpgmepp.org/lang/cpp/src/key.cpp   2017-03-20 20:10:15.000000000 +0100
 +++ gpgmepp/lang/cpp/src/key.cpp       2017-11-20 17:44:50.321858800 +0100
-@@ -33,11 +33,17 @@
+@@ -34,11 +34,17 @@
  #include <gpgme.h>
  
  #include <string.h>
@@ -135,7 +135,7 @@ diff -ur gpgmepp.org/lang/cpp/src/key.h 
gpgmepp/lang/cpp/src/key.h
 diff -ur gpgmepp.org/lang/qt/src/qgpgme_export.h 
gpgmepp/lang/qt/src/qgpgme_export.h
 --- gpgmepp.org/lang/qt/src/qgpgme_export.h    2016-11-03 17:32:30.000000000 
+0100
 +++ gpgmepp/lang/qt/src/qgpgme_export.h        2017-11-20 16:58:27.395388000 
+0100
-@@ -39,14 +39,14 @@
+@@ -40,14 +40,14 @@
  #  ifndef QGPGME_EXPORT
  #    ifdef BUILDING_QGPGME
          /* We are building this library */
@@ -152,7 +152,7 @@ diff -ur gpgmepp.org/lang/qt/src/qgpgme_export.h 
gpgmepp/lang/qt/src/qgpgme_expo
  #       define QGPGME_EXPORT __declspec(dllimport)
  #      else
  #       define QGPGME_EXPORT __attribute__((visibility("default")))
-@@ -55,7 +55,7 @@
+@@ -56,7 +56,7 @@
  #  endif
  
  #  ifndef QGPGME_NO_EXPORT
@@ -161,7 +161,7 @@ diff -ur gpgmepp.org/lang/qt/src/qgpgme_export.h 
gpgmepp/lang/qt/src/qgpgme_expo
  #     define QGPGME_NO_EXPORT
  #    else
  #     define QGPGME_NO_EXPORT __attribute__((visibility("hidden")))
-@@ -64,7 +64,11 @@
+@@ -65,7 +65,11 @@
  #endif
  
  #ifndef QGPGME_DEPRECATED
diff --git a/external/gpgmepp/w32-include.patch 
b/external/gpgmepp/w32-include.patch
new file mode 100644
index 000000000000..0fda72c2b072
--- /dev/null
+++ b/external/gpgmepp/w32-include.patch
@@ -0,0 +1,42 @@
+--- src/data-fd.c
++++ src/data-fd.c
+@@ -28,6 +28,9 @@
+ #ifdef HAVE_SYS_TYPES_H
+ # include <sys/types.h>
+ #endif
++#if defined HAVE_W32_SYSTEM
++#include <io.h>
++#endif
+ 
+ #include "debug.h"
+ #include "data.h"
+--- src/gpgme-w32spawn.c
++++ src/gpgme-w32spawn.c
+@@ -36,6 +36,7 @@
+ # include <sys/stat.h>
+ #endif
+ #include <stdint.h>
++#include <io.h>
+ #include <process.h>
+ 
+ #include "priv-io.h"
+--- lang/cpp/src/gpgaddexistingsubkeyeditinteractor.h
++++ lang/cpp/src/gpgaddexistingsubkeyeditinteractor.h
+@@ -27,6 +27,7 @@
+ #include "editinteractor.h"
+ 
+ #include <memory>
++#include <string>
+ 
+ namespace GpgME
+ {
+--- lang/cpp/src/gpgrevokekeyeditinteractor.h
++++ lang/cpp/src/gpgrevokekeyeditinteractor.h
+@@ -28,6 +28,7 @@
+ #include "global.h"
+ 
+ #include <memory>
++#include <string>
+ #include <vector>
+ 
+ namespace GpgME
commit 2f0f3f943955fb51191ef0dd4eaace16dd34c12c
Author:     Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Sun Dec 11 18:00:28 2022 +0900
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Feb 1 11:59:56 2023 +0100

    poppler: upgrade to release 22.12.0
    
    Change-Id: Ic0544fa378705b97b437132fc8860a65692634da
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143977
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 1ec7f8b5b21bf74f684095b97a2b9900a71a0979)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144066
    Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>

diff --git a/download.lst b/download.lst
index f02c119d2608..ba51aa391ea2 100644
--- a/download.lst
+++ b/download.lst
@@ -240,8 +240,8 @@ export LIBPNG_SHA256SUM := 
1f4696ce70b4ee5f85f1e1623dc1229b210029fa4b7aee573df3e
 export LIBPNG_TARBALL := libpng-1.6.39.tar.xz
 export LIBTIFF_SHA256SUM := 
49307b510048ccc7bc40f2cba6e8439182fe6e654057c1a1683139bf2ecb1dc1
 export LIBTIFF_TARBALL := tiff-4.4.0.tar.xz
-export POPPLER_SHA256SUM := 
d7a8f748211359cadb774ba3e18ecda6464b34027045c0648eb30d5852a41e2e
-export POPPLER_TARBALL := poppler-22.09.0.tar.xz
+export POPPLER_SHA256SUM := 
d9aa9cacdfbd0f8e98fc2b3bb008e645597ed480685757c3e7bc74b4278d15c0
+export POPPLER_TARBALL := poppler-22.12.0.tar.xz
 export POPPLER_DATA_SHA256SUM := 
2cec05cd1bb03af98a8b06a1e22f6e6e1a65b1e2f3816cb3069bb0874825f08c
 export POPPLER_DATA_TARBALL := poppler-data-0.4.11.tar.gz
 export POSTGRESQL_SHA256SUM := 
73876fdd3a517087340458dca4ce15b8d2a4dbceb334c0441424551ae6c4cded
diff --git a/external/poppler/disable-freetype.patch.1 
b/external/poppler/disable-freetype.patch.1
index d59006eba979..710742206925 100644
--- a/external/poppler/disable-freetype.patch.1
+++ b/external/poppler/disable-freetype.patch.1
@@ -22,7 +22,7 @@ disable freetype dependent code
  
  // return a newly allocated char* containing an UTF16BE string of size length
  char *pdfDocEncodingToUTF16(const std::string &orig, int *length)
-@@ -2730,6 +2730,8 @@
+@@ -2743,6 +2743,8 @@
  
  Form::AddFontResult Form::addFontToDefaultResources(const std::string 
&filepath, int faceIndex, const std::string &fontFamily, const std::string 
&fontStyle)
  {
@@ -31,7 +31,7 @@ disable freetype dependent code
      if (!GooString::endsWith(filepath, ".ttf") && 
!GooString::endsWith(filepath, ".ttc") && !GooString::endsWith(filepath, 
".otf")) {
          error(errIO, -1, "We only support embedding ttf/ttc/otf fonts for 
now. The font file for {0:s} {1:s} was {2:s}", fontFamily.c_str(), 
fontStyle.c_str(), filepath.c_str());
          return {};
-@@ -2939,6 +2941,7 @@
+@@ -2951,6 +2953,7 @@
      }
  
      return { dictFontName, fontDictRef };
diff --git a/external/poppler/sanitizer.patch b/external/poppler/sanitizer.patch
index 149361661b95..c08e1b4e8a4f 100644
--- a/external/poppler/sanitizer.patch
+++ b/external/poppler/sanitizer.patch
@@ -1,6 +1,6 @@
 --- poppler/PSOutputDev.cc
 +++ poppler/PSOutputDev.cc
-@@ -3111,6 +3111,8 @@
+@@ -3138,6 +3138,8 @@
  bool PSOutputDev::checkPageSlice(Page *page, double /*hDPI*/, double 
/*vDPI*/, int rotateA, bool useMediaBox, bool crop, int sliceX, int sliceY, int 
sliceW, int sliceH, bool printing, bool (*abortCheckCbk)(void *data),
                                   void *abortCheckCbkData, bool 
(*annotDisplayDecideCbk)(Annot *annot, void *user_data), void 
*annotDisplayDecideCbkData)
  {
@@ -9,7 +9,7 @@
      PreScanOutputDev *scan;
      bool rasterize;
      bool useFlate, useLZW;
-@@ -3593,5 +3595,6 @@
+@@ -3623,5 +3625,6 @@
  
      return false;
 +#endif
commit 4c02c40d4b7e7aca4e1e7ae57264a31b209d4c79
Author:     Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Mon Nov 21 23:33:32 2022 +0900
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Feb 1 11:59:29 2023 +0100

    nss: upgrade to release 3.86.0
    
    Change-Id: Ia236c7124d920785f7a2856db5ee1ccbef7a2d68
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143038
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit a2969884af71e88d2541bd2bfdebea222876fef4)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144068
    Reviewed-by: Christian Lohmaier <lohmaier+libreoff...@googlemail.com>

diff --git a/download.lst b/download.lst
index 2daa337b767a..f02c119d2608 100644
--- a/download.lst
+++ b/download.lst
@@ -215,8 +215,8 @@ export MYTHES_SHA256SUM := 
1e81f395d8c851c3e4e75b568e20fa2fa549354e75ab397f9de4b
 export MYTHES_TARBALL := a8c2c5b8f09e7ede322d5c602ff6a4b6-mythes-1.2.4.tar.gz
 export NEON_SHA256SUM := 
cf1ee3ac27a215814a9c80803fcee4f0ede8466ebead40267a9bd115e16a8678
 export NEON_TARBALL := neon-0.31.2.tar.gz
-export NSS_SHA256SUM := 
b1e1198fa7ee4e0fe4fa6937245c94820fd3c3c6897779493858af1bf6310b30
-export NSS_TARBALL := nss-3.83-with-nspr-4.34.1.tar.gz
+export NSS_SHA256SUM := 
8b5a2e9e3d632a78ad4d9c8d2ea502d2790d7a8e7b1986d173107232eca27432
+export NSS_TARBALL := nss-3.86-with-nspr-4.35.tar.gz
 export ODFGEN_SHA256SUM := 
55200027fd46623b9bdddd38d275e7452d1b0ff8aeddcad6f9ae6dc25f610625
 export ODFGEN_VERSION_MICRO := 8
 export ODFGEN_TARBALL := libodfgen-0.1.$(ODFGEN_VERSION_MICRO).tar.xz
diff --git a/external/nss/UnpackedTarball_nss.mk 
b/external/nss/UnpackedTarball_nss.mk
index 4f8499e8a835..c6e2b8510db0 100644
--- a/external/nss/UnpackedTarball_nss.mk
+++ b/external/nss/UnpackedTarball_nss.mk
@@ -24,7 +24,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
     external/nss/nss.vs2015.patch \
     external/nss/nss.vs2015.pdb.patch \
     external/nss/nss.bzmozilla1238154.patch \
-       external/nss/nss-bz1646594.patch.1 \
+    external/nss/nss-bz1646594.patch.1 \
     external/nss/macos-dlopen.patch.0 \
     external/nss/nss-restore-manual-pre-dependencies.patch.1 \
     $(if $(filter iOS,$(OS)), \
diff --git a/external/nss/asan.patch.1 b/external/nss/asan.patch.1
index ce584a34a3b5..ccabd446ebac 100644
--- a/external/nss/asan.patch.1
+++ b/external/nss/asan.patch.1
@@ -1,7 +1,7 @@
 diff -ur nss.org/nss/coreconf/Linux.mk nss/nss/coreconf/Linux.mk
 --- nss.org/nss/coreconf/Linux.mk      2014-05-06 04:36:01.817838877 +0200
 +++ nss/nss/coreconf/Linux.mk  2014-05-06 04:37:25.387835456 +0200
-@@ -146,7 +146,7 @@
+@@ -157,7 +157,7 @@
  # we don't use -z defs there.
  # Also, -z defs conflicts with Address Sanitizer, which emits relocations
  # against the libsanitizer runtime built into the main executable.
diff --git a/external/nss/clang-cl.patch.0 b/external/nss/clang-cl.patch.0
index b02fff60e36b..e20aab3b9ff1 100644
--- a/external/nss/clang-cl.patch.0
+++ b/external/nss/clang-cl.patch.0
@@ -14,7 +14,7 @@
  #pragma intrinsic(_InterlockedExchange)
 --- nspr/pr/include/prbit.h
 +++ nspr/pr/include/prbit.h
-@@ -14,7 +14,7 @@
+@@ -15,7 +15,7 @@
  */
  #if defined(_WIN32) && (_MSC_VER >= 1300) && \
      (defined(_M_IX86) || defined(_M_X64) || defined(_M_ARM) || \
@@ -23,7 +23,7 @@
  # include <intrin.h>
  # pragma  intrinsic(_BitScanForward,_BitScanReverse)
  __forceinline static int __prBitScanForward32(unsigned int val)
-@@ -32,7 +32,7 @@
+@@ -33,7 +33,7 @@
  # define pr_bitscan_ctz32(val)  __prBitScanForward32(val)
  # define pr_bitscan_clz32(val)  __prBitScanReverse32(val)
  # define  PR_HAVE_BUILTIN_BITSCAN32
@@ -32,7 +32,7 @@
         (defined(__i386__) || defined(__x86_64__) || defined(__arm__) || \
          defined(__aarch64__))
  # define pr_bitscan_ctz32(val)  __builtin_ctz(val)
-@@ -136,7 +136,7 @@
+@@ -138,7 +138,7 @@
  */
  
  #if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_AMD64) || \
@@ -74,7 +74,7 @@
  #define DSA_SUBPRIME_LEN ((__BLAPI_DEPRECATED)DSA1_SUBPRIME_LEN)
 --- nss/lib/util/pkcs11n.h
 +++ nss/lib/util/pkcs11n.h
-@@ -426,7 +426,7 @@
+@@ -563,7 +563,7 @@
  /* keep the old value for compatibility reasons*/
  #define CKT_NSS_MUST_VERIFY ((__CKT_NSS_MUST_VERIFY)(CKT_NSS + 4))
  #else
@@ -91,7 +91,7 @@
 # in the outer pkcs11t.h:
 --- nss/lib/util/pkcs11t.h
 +++ nss/lib/util/pkcs11t.h
-@@ -72,7 +72,14 @@
+@@ -78,7 +78,14 @@
  #define CK_INVALID_HANDLE 0
  
  /* pack */
@@ -106,7 +106,7 @@
  
  typedef struct CK_VERSION {
      CK_BYTE major; /* integer portion of version number */
-@@ -1795,6 +1802,13 @@
+@@ -2586,6 +2593,13 @@
  #include "pkcs11n.h"
  
  /* undo packing */
diff --git a/external/nss/macos-dlopen.patch.0 
b/external/nss/macos-dlopen.patch.0
index 1889b8df7cd3..e8abc8f59c69 100644
--- a/external/nss/macos-dlopen.patch.0
+++ b/external/nss/macos-dlopen.patch.0
@@ -1,6 +1,6 @@
 --- nspr/pr/src/linking/prlink.c
 +++ nspr/pr/src/linking/prlink.c
-@@ -799,7 +799,7 @@
+@@ -555,7 +555,7 @@
           * The reason is that DARWIN's dlopen ignores the provided path
           * and checks for the plain filename in DYLD_LIBRARY_PATH,
           * which could load an unexpected version of a library. */
diff --git a/external/nss/nss-android.patch.1 b/external/nss/nss-android.patch.1
index 7eb306a50c32..707fcf99afe0 100644
--- a/external/nss/nss-android.patch.1
+++ b/external/nss/nss-android.patch.1
@@ -1,7 +1,7 @@
 diff -ur nss.org/nspr/build/autoconf/config.sub 
nss/nspr/build/autoconf/config.sub
 --- nss.org/nspr/build/autoconf/config.sub     2017-09-07 15:29:45.031246453 
+0200
 +++ nss/nspr/build/autoconf/config.sub 2017-09-07 15:32:13.087235423 +0200
-@@ -111,6 +111,11 @@
+@@ -110,6 +110,11 @@
      exit 1;;
  esac
  
@@ -16,7 +16,7 @@ diff -ur nss.org/nspr/build/autoconf/config.sub 
nss/nspr/build/autoconf/config.s
 diff -ur nss.org/nspr/configure nss/nspr/configure
 --- nss.org/nspr/configure     2017-09-07 15:29:45.018246359 +0200
 +++ nss/nspr/configure 2017-09-07 15:31:47.604075663 +0200
-@@ -2737,18 +2739,15 @@
+@@ -2728,18 +2728,15 @@
      esac
  
          AS="$android_toolchain"/bin/"$android_tool_prefix"-as
@@ -41,7 +41,7 @@ diff -ur nss.org/nspr/configure nss/nspr/configure
 diff -ur nss.org/nss/Makefile nss/nss/Makefile
 --- nss.org/nss/Makefile       2017-09-07 15:29:44.933245745 +0200
 +++ nss/nss/Makefile   2017-09-07 15:32:04.347181076 +0200
-@@ -62,7 +62,7 @@
+@@ -65,7 +65,7 @@
  
  ifeq ($(OS_TARGET),Android)
  NSPR_CONFIGURE_OPTS += --with-android-ndk=$(ANDROID_NDK) \
diff --git a/external/nss/nss-ios.patch b/external/nss/nss-ios.patch
index 86f85a873810..58239f718978 100644
--- a/external/nss/nss-ios.patch
+++ b/external/nss/nss-ios.patch
@@ -1,6 +1,6 @@
 --- a/a/nss/Makefile
 +++ a/a/nss/Makefile
-@@ -96,13 +96,11 @@
+@@ -91,13 +91,11 @@
  ifdef NS_USE_GCC
  NSPR_CONFIGURE_ENV = CC=gcc CXX=g++
  endif
@@ -16,7 +16,7 @@
  endif
  
  #
-@@ -140,7 +140,6 @@
+@@ -140,7 +138,6 @@
  
  build_nspr: $(NSPR_CONFIG_STATUS)
        $(MAKE) -C $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME)
@@ -37,7 +37,7 @@
  
 --- a/a/nss/lib/nss/nssinit.c
 +++ a/a/nss/lib/nss/nssinit.c
-@@ -278,6 +278,7 @@
+@@ -275,6 +275,7 @@
                            const char *secmodprefix,
                            char **retoldpath, char **retnewpath)
  {
@@ -45,7 +45,7 @@
      char *path, *oldpath = NULL, *lastsep;
      int len, path_len, secmod_len, dll_len;
  
-@@ -309,6 +309,10 @@
+@@ -309,6 +310,10 @@
      }
      *retoldpath = oldpath;
      *retnewpath = path;
@@ -58,7 +58,7 @@
  
 --- a/a/nss/lib/pk11wrap/pk11load.c
 +++ a/a/nss/lib/pk11wrap/pk11load.c
-@@ -389,6 +389,8 @@
+@@ -390,6 +390,8 @@
  /*
   * load a new module into our address space and initialize it.
   */
@@ -67,7 +67,7 @@
  SECStatus
  secmod_LoadPKCS11Module(SECMODModule *mod, SECMODModule **oldModule)
  {
-@@ -465,6 +465,7 @@
+@@ -468,6 +470,7 @@
  /* load the library. If this succeeds, then we have to remember to
           * unload the library if anything goes wrong from here on out...
           */
@@ -75,7 +75,7 @@
  #if defined(_WIN32)
          if (nssUTF8_Length(mod->dllName, NULL)) {
              wchar_t *dllNameWide = _NSSUTIL_UTF8ToWide(mod->dllName);
-@@ -487,6 +487,11 @@
+@@ -507,6 +510,11 @@
              mod->moduleDBFunc = (void *)
                  PR_FindSymbol(library, "NSS_ReturnModuleSpecData");
          }
@@ -87,7 +87,7 @@
          if (mod->moduleDBFunc == NULL)
              mod->isModuleDB = PR_FALSE;
          if ((ientry == NULL) && (fentry == NULL)) {
-@@ -624,10 +624,12 @@
+@@ -643,10 +651,12 @@
      }
  fail:
      mod->functionList = NULL;
@@ -124,7 +124,7 @@
      PRLibrary *handle;
      const char *name = getLibName();
  
-@@ -47,32 +47,42 @@
+@@ -47,32 +48,42 @@
      if (handle) {
          PRFuncPtr address = PR_FindFunctionSymbol(handle, "FREEBL_GetVector");
          if (address) {
@@ -168,7 +168,7 @@
  }
  
  static const PRCallOnceType pristineCallOnce;
-@@ -837,6 +837,7 @@
+@@ -860,6 +871,7 @@
  void
  BL_Unload(void)
  {
@@ -176,7 +176,7 @@
      /* This function is not thread-safe, but doesn't need to be, because it is
       * only called from functions that are also defined as not thread-safe,
       * namely C_Finalize in softoken, and the SSL bypass shutdown callback 
called
-@@ -852,6 +852,7 @@
+@@ -872,6 +884,7 @@
          PR_UnloadLibrary(blLib);
  #endif
      }
@@ -186,7 +186,7 @@
  }
 --- a/a/nspr/build/autoconf/config.sub 2017-09-07 15:29:45.031246453 +0200
 +++ a/a/nspr/build/autoconf/config.sub 2017-09-07 15:32:13.087235423 +0200
-@@ -111,6 +111,9 @@
+@@ -110,6 +110,9 @@
      exit 1;;
  esac
  
@@ -198,7 +198,7 @@
  IFS="-" read field1 field2 field3 field4 <<EOF
 --- a/a/nspr/config/autoconf.mk.in
 +++ a/a/nspr/config/autoconf.mk.in
-@@ -67,7 +67,7 @@
+@@ -69,7 +69,7 @@
  MSC_VER               = @MSC_VER@
  AR            = @AR@
  AR_FLAGS      = @AR_FLAGS@
@@ -209,7 +209,7 @@
  RC            = @RC@
 --- a/a/nspr/configure
 +++ a/a/nspr/configure
-@@ -755,7 +755,7 @@
+@@ -2507,7 +2507,7 @@
  OBJDIR='$(OBJDIR_NAME)'
  OBJDIR_NAME=.
  OBJDIR_SUFFIX=OBJ
@@ -218,7 +218,7 @@
  NOSUCHFILE=/no-such-file
  LIBNSPR='-L$(dist_libdir) -lnspr$(MOD_MAJOR_VERSION)'
  LIBPLC='-L$(dist_libdir) -lplc$(MOD_MAJOR_VERSION)'
-@@ -3060,7 +3060,7 @@
+@@ -5571,7 +5571,7 @@
  LIB_SUFFIX=a
  DLL_SUFFIX=so
  ASM_SUFFIX=s
@@ -227,7 +227,7 @@
  PR_MD_ASFILES=
  PR_MD_CSRCS=
  PR_MD_ARCH_DIR=unix
-@@ -3904,7 +3904,7 @@
+@@ -6485,7 +6485,7 @@
      DSO_CFLAGS=-fPIC
      DSO_LDOPTS='-dynamiclib -compatibility_version 1 -current_version 1 
-all_load -install_name 
@__________________________________________________OOO/$@ 
-headerpad_max_install_names'
      _OPTIMIZE_FLAGS=-O2
@@ -238,7 +238,7 @@
      USE_PTHREADS=1
 --- a/a/nss/coreconf/ruleset.mk
 +++ a/a/nss/coreconf/ruleset.mk
-@@ -68,7 +68,7 @@
+@@ -45,7 +45,7 @@
  endif
  
  ifeq ($(MKPROG),)
@@ -249,7 +249,7 @@
  #
 --- a/a/nss/coreconf/Darwin.mk
 +++ a/a/nss/coreconf/Darwin.mk
-@@ -124,7 +124,7 @@
+@@ -116,7 +116,7 @@
     DSO_LDOPTS += --coverage
  endif
  
diff --git a/external/nss/nss-restore-manual-pre-dependencies.patch.1 
b/external/nss/nss-restore-manual-pre-dependencies.patch.1
index 06691b1ec957..ea034f0dc80f 100644
--- a/external/nss/nss-restore-manual-pre-dependencies.patch.1
+++ b/external/nss/nss-restore-manual-pre-dependencies.patch.1
@@ -68,7 +68,7 @@ summary:     Bug 1637083 Replace pre-dependency with shell 
hack r=rrelyea
        ck.h              \
 --- b/nss/manifest.mn  Wed May 13 19:00:40 2020 +0000
 +++ a/nss/manifest.mn  Tue May 12 21:33:43 2020 +0000
-@@ -23,6 +23,12 @@
+@@ -24,6 +24,12 @@
        # no real way to encode these in any sensible way
        $(MAKE) -C coreconf/nsinstall program
        $(MAKE) export
diff --git a/external/nss/nss-win32-make.patch.1 
b/external/nss/nss-win32-make.patch.1
index 7ba3df451ee6..6a3201a082a1 100644
--- a/external/nss/nss-win32-make.patch.1
+++ b/external/nss/nss-win32-make.patch.1
@@ -1,6 +1,6 @@
 --- nss/nss/coreconf/rules.mk.orig2    2014-06-03 15:30:01.667200000 +0200
 +++ nss/nss/coreconf/rules.mk  2014-06-03 15:30:14.537200000 +0200
-@@ -259,7 +259,7 @@
+@@ -174,7 +174,7 @@
  $(LIBRARY): $(OBJS) | $$(@D)/d
        rm -f $@
  ifeq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET)))
@@ -9,7 +9,7 @@
  else
        $(AR) cr $@ $(OBJS)
  endif
-@@ -297,7 +297,7 @@
+@@ -214,7 +214,7 @@
  ifdef NS_USE_GCC
        $(LINK_DLL) $(OBJS) $(SUB_SHLOBJS) $(EXTRA_LIBS) $(EXTRA_SHARED_LIBS) 
$(OS_LIBS) $(LD_LIBS) $(RES)
  else
diff --git a/external/nss/nss.aix.patch b/external/nss/nss.aix.patch
index 4b0c6bfb3261..10572f94717a 100644
--- a/external/nss/nss.aix.patch
+++ b/external/nss/nss.aix.patch
@@ -1,7 +1,7 @@
 diff -ru a/nspr/configure b/nspr/configure
 --- a/a/nspr/configure 2014-09-29 16:47:42.984012225 +0100
 +++ b/b/nspr/configure 2014-09-29 16:50:33.907375937 +0100
-@@ -6369,7 +6369,6 @@
+@@ -6325,7 +6325,6 @@
          AIX_LINK_OPTS='-brtl -bnso -berok'
          ;;
      esac
@@ -12,7 +12,7 @@ diff -ru a/nspr/configure b/nspr/configure
 diff -ru a/nspr/configure.in b/nspr/configure.in
 --- a/a/nspr/configure.in      2014-09-29 16:46:35.257394860 +0100
 +++ b/b/nspr/configure.in      2014-09-29 16:50:33.908375942 +0100
-@@ -1229,7 +1229,8 @@
+@@ -1180,7 +1180,8 @@
      AC_DEFINE(XP_UNIX)
      AC_DEFINE(AIX)
      AC_DEFINE(SYSV)
@@ -22,7 +22,7 @@ diff -ru a/nspr/configure.in b/nspr/configure.in
      AC_CHECK_HEADER(sys/atomic_op.h, AC_DEFINE(AIX_HAVE_ATOMIC_OP_H))
      case "${target_os}" in
      aix3.2*)
-@@ -1269,10 +1270,9 @@
+@@ -1220,10 +1221,9 @@
          AC_DEFINE(HAVE_SOCKLEN_T)
          AC_DEFINE(HAVE_FCNTL_FILE_LOCKING)
          USE_IPV6=1
@@ -48,7 +48,7 @@ diff -ru a/nspr/pr/src/Makefile.in b/nspr/pr/src/Makefile.in
 diff -ru a/nss/cmd/platlibs.mk b/nss/cmd/platlibs.mk
 --- a/a/nss/cmd/platlibs.mk    2014-09-29 16:47:42.987012253 +0100
 +++ b/b/nss/cmd/platlibs.mk    2014-09-29 16:50:33.910375955 +0100
-@@ -134,7 +134,7 @@
+@@ -171,7 +171,7 @@
        $(NULL)
  
  ifeq ($(OS_ARCH), AIX) 
@@ -57,7 +57,7 @@ diff -ru a/nss/cmd/platlibs.mk b/nss/cmd/platlibs.mk
  endif
  
  # $(PROGRAM) has NO explicit dependencies on $(EXTRA_SHARED_LIBS)
-@@ -180,7 +180,7 @@
+@@ -217,7 +217,7 @@
        $(NULL)
  
  ifeq ($(OS_ARCH), AIX) 
diff --git a/external/nss/nss.bzmozilla1238154.patch 
b/external/nss/nss.bzmozilla1238154.patch
index 468ff810b9ca..425f38257892 100644
--- a/external/nss/nss.bzmozilla1238154.patch
+++ b/external/nss/nss.bzmozilla1238154.patch
@@ -1,7 +1,7 @@
 diff -ru a/nspr/configure b/nspr/configure
 --- a/a/nspr/configure 2019-01-26 12:23:06.589389910 +0100
 +++ b/b/nspr/configure 2019-01-26 12:26:56.566222293 +0100
-@@ -7127,7 +7127,7 @@
+@@ -6883,7 +6883,7 @@
  
          # Determine compiler version
  
diff --git a/external/nss/nss.cygwin64.in32bit.patch 
b/external/nss/nss.cygwin64.in32bit.patch
index b00761a0e85b..bce0f1d09403 100644
--- a/external/nss/nss.cygwin64.in32bit.patch
+++ b/external/nss/nss.cygwin64.in32bit.patch
@@ -3,7 +3,7 @@ on Cygwin 64bit and in 32bit mode
 diff -ru nss.orig/nss/Makefile nss/nss/Makefile
 --- a/nss.orig/nss/Makefile       2016-02-26 01:00:52.146713100 +0100
 +++ b/nss/nss/Makefile    2016-02-26 01:02:05.303560100 +0100
-@@ -59,6 +59,8 @@
+@@ -63,6 +63,8 @@
  # Translate coreconf build options to NSPR configure options.
  #
 
diff --git a/external/nss/nss.nowerror.patch b/external/nss/nss.nowerror.patch
index ff81a9b33539..bdf7a33a874c 100644
--- a/external/nss/nss.nowerror.patch
+++ b/external/nss/nss.nowerror.patch
@@ -1,7 +1,7 @@
 diff -ur nss.org/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
 --- a/nss.org/nss/coreconf/WIN32.mk    2016-04-13 11:33:09.322294523 +0200
 +++ b/nss/nss/coreconf/WIN32.mk        2016-04-13 11:33:27.744323969 +0200
-@@ -127,7 +127,7 @@
+@@ -121,7 +121,7 @@
                        -D_CRT_NONSTDC_NO_WARNINGS
      OS_DLLFLAGS += -nologo -DLL -SUBSYSTEM:WINDOWS
      ifndef NSS_ENABLE_WERROR
diff --git a/external/nss/nss.utf8bom.patch.1 b/external/nss/nss.utf8bom.patch.1
index e8c56abefcde..f474adf6f932 100644
--- a/external/nss/nss.utf8bom.patch.1
+++ b/external/nss/nss.utf8bom.patch.1
@@ -1,7 +1,7 @@
 diff -ur nss.org/nss/lib/ckfw/builtins/certdata.perl 
nss/nss/lib/ckfw/builtins/certdata.perl
 --- nss.org/nss/lib/ckfw/builtins/certdata.perl        2016-03-31 
18:26:07.890190900 +0800
 +++ nss/nss/lib/ckfw/builtins/certdata.perl    2016-03-31 19:16:16.727269600 
+0800
-@@ -110,6 +110,9 @@
+@@ -122,6 +122,9 @@
  sub doprint {
  my $i;
  
@@ -11,7 +11,7 @@ diff -ur nss.org/nss/lib/ckfw/builtins/certdata.perl 
nss/nss/lib/ckfw/builtins/c
  print <<EOD
  /* THIS IS A GENERATED FILE */
  /* This Source Code Form is subject to the terms of the Mozilla Public
-@@ -119,6 +122,7 @@
+@@ -131,6 +134,7 @@
  #ifndef BUILTINS_H
  #include "builtins.h"
  #endif /* BUILTINS_H */
diff --git a/external/nss/nss.vs2015.patch b/external/nss/nss.vs2015.patch
index de4f8762fd5b..73cff7c833fb 100644
--- a/external/nss/nss.vs2015.patch
+++ b/external/nss/nss.vs2015.patch
@@ -1,7 +1,7 @@
 diff -ru nss.org/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
 --- a/nss.org/nss/coreconf/WIN32.mk    2016-02-12 15:36:18.000000000 +0100
 +++ b/nss/nss/coreconf/WIN32.mk        2016-02-26 00:42:43.170809600 +0100
-@@ -199,7 +199,7 @@
+@@ -192,7 +192,7 @@
      # Disable C4244: conversion from 'type1' to 'type2', possible loss of data
      # Disable C4018: 'expression' : signed/unsigned mismatch
      # Disable C4312: 'type cast': conversion from 'type1' to 'type2' of 
greater size
diff --git a/external/nss/nss.vs2015.pdb.patch 
b/external/nss/nss.vs2015.pdb.patch
index c66940132cdd..3b498f976ac6 100644
--- a/external/nss/nss.vs2015.pdb.patch
+++ b/external/nss/nss.vs2015.pdb.patch
@@ -1,7 +1,7 @@
 diff -ru nss.orig/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
 --- a/nss.orig/nss/coreconf/WIN32.mk   2016-03-04 08:30:16.306639400 +0100
 +++ b/nss/nss/coreconf/WIN32.mk        2016-03-04 08:31:17.987233200 +0100
-@@ -169,15 +169,15 @@
+@@ -163,15 +163,15 @@
        DLLFLAGS   += -OUT:$@
        ifdef MOZ_DEBUG_SYMBOLS
                ifdef MOZ_DEBUG_FLAGS
diff --git a/external/nss/nss.windows.patch b/external/nss/nss.windows.patch
index 901846e7bc1f..27a44045802e 100644
--- a/external/nss/nss.windows.patch
+++ b/external/nss/nss.windows.patch
@@ -1,6 +1,6 @@
 --- a/a/nspr/config/rules.mk   2008-12-03 00:24:39.000000000 +0100
 +++ b/b/nspr/config/rules.mk   2009-11-27 13:36:22.662753328 +0100
-@@ -415,7 +415,7 @@
+@@ -423,7 +423,7 @@
  
  ifdef NEED_ABSOLUTE_PATH
  # The quotes allow absolute paths to contain spaces.
@@ -11,7 +11,7 @@
  $(OBJDIR)/%.$(OBJ_SUFFIX): %.cpp
 --- a/a/nss/coreconf/rules.mk  2008-12-03 00:24:39.000000000 +0100
 +++ b/b/nss/coreconf/rules.mk  2009-11-27 13:36:22.662753328 +0100
-@@ -386,7 +386,7 @@
+@@ -280,7 +280,7 @@
  endif
  
  # The quotes allow absolute paths to contain spaces.
@@ -22,7 +22,7 @@
  ifdef USE_NT_C_SYNTAX
 --- a/a/nspr/pr/include/md/_win95.h
 +++ b/b/nspr/pr/include/md/_win95.h
-@@ -312,7 +312,7 @@
+@@ -317,7 +317,7 @@
  #define _MD_ATOMIC_ADD(ptr,val)    (InterlockedExchangeAdd((PLONG)ptr, 
(LONG)val) + val)
  #define _MD_ATOMIC_DECREMENT(x)       InterlockedDecrement((PLONG)x)
  #endif /* x86 */
diff --git a/external/nss/nss_macosx.patch b/external/nss/nss_macosx.patch
index 1e7599be6133..456bd62d509b 100644
--- a/external/nss/nss_macosx.patch
+++ b/external/nss/nss_macosx.patch
@@ -1,7 +1,7 @@
 diff -ru a/nspr/configure b/nspr/configure
 --- a/a/nspr/configure 2014-09-29 16:50:33.907375937 +0100
 +++ b/b/nspr/configure 2014-09-29 16:51:59.213931947 +0100
-@@ -6453,6 +6453,9 @@
+@@ -6448,6 +6448,9 @@
      AS='$(CC) -x assembler-with-cpp'
      CFLAGS="$CFLAGS -Wall -fno-common"
      case "${target_cpu}" in
@@ -11,7 +11,7 @@ diff -ru a/nspr/configure b/nspr/configure
          arm*)
              CPU_ARCH=arm
              ;;
-@@ -6578,7 +6579,7 @@
+@@ -6483,7 +6486,7 @@
  
  
      DSO_CFLAGS=-fPIC
@@ -23,7 +23,7 @@ diff -ru a/nspr/configure b/nspr/configure
 diff -ru a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
 --- a/a/nss/coreconf/Darwin.mk 2014-09-29 16:50:22.992304799 +0100
 +++ b/b/nss/coreconf/Darwin.mk 2014-09-29 16:51:59.214931953 +0100
-@@ -20,13 +24,17 @@
+@@ -20,13 +20,17 @@
  
  ifeq (,$(filter-out i%86,$(CPU_ARCH)))
  ifdef USE_64
@@ -41,7 +41,7 @@ diff -ru a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
  override CPU_ARCH     = x86
  endif
  else
-@@ -40,19 +48,20 @@
+@@ -33,19 +37,20 @@
  ifeq (arm,$(CPU_ARCH))
  # Nothing set for arm currently.
  else
@@ -66,7 +66,7 @@ diff -ru a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
          # GCC <= 3
          DARWIN_SDK_FRAMEWORKS = -F$(MACOS_SDK_DIR)/System/Library/Frameworks
          ifneq (,$(shell find $(MACOS_SDK_DIR)/Library/Frameworks -maxdepth 0))
-@@ -108,7 +120,7 @@
+@@ -108,7 +113,7 @@
  # May override this with different compatibility and current version numbers.
  DARWIN_DYLIB_VERSIONS = -compatibility_version 1 -current_version 1
  # May override this with -bundle to create a loadable module.
@@ -78,7 +78,7 @@ diff -ru a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
 diff -ru a/nss/Makefile b/nss/Makefile
 --- a/a/nss/Makefile   2014-09-29 16:50:22.990304789 +0100
 +++ b/b/nss/Makefile   2014-09-29 16:51:59.207931908 +0100
-@@ -72,6 +72,9 @@
+@@ -82,6 +82,9 @@
  ifeq ($(OS_TARGET),WIN95)
  NSPR_CONFIGURE_OPTS += --enable-win32-target=WIN95
  endif
diff --git a/external/nss/ubsan.patch.0 b/external/nss/ubsan.patch.0
index 2c32d90b00ce..5f97d3e9d24e 100644
--- a/external/nss/ubsan.patch.0
+++ b/external/nss/ubsan.patch.0
@@ -27,7 +27,7 @@
                count * sizeof(lgdbSlotData);
  
      data->data = (unsigned char *)PORT_ZAlloc(dataLen);
-@@ -327,7 +327,7 @@
+@@ -329,7 +329,7 @@
      }
      if ((encoded->major == LGDB_DB_EXT1_VERSION_MAJOR) &&
          (encoded->minor >= LGDB_DB_EXT1_VERSION_MINOR)) {
commit e50c64b298e7e78b6c3c1e2081b407dcf9036d65
Author:     Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Sun Dec 11 15:13:32 2022 +0900
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Feb 1 11:59:27 2023 +0100

    libpng: upgrade to release 1.6.39
    
    Fixes CVE-2019-6129.
    
    Change-Id: I46ad0c9426a115ba19620814397a834923e03ca6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143976
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 9fb776f508a676d4c7255b5cfc6dfdc00d620a8c)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144067
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Tested-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/download.lst b/download.lst
index 6184994f7cc8..2daa337b767a 100644
--- a/download.lst
+++ b/download.lst
@@ -236,8 +236,8 @@ export PDFIUM_SHA256SUM := 
ecb9c2a0d777196949994946e3f24ed251ae5d3db8a9fa1e2827e
 export PDFIUM_TARBALL := pdfium-5298.tar.bz2
 export PIXMAN_SHA256SUM := 
ea1480efada2fd948bc75366f7c349e1c96d3297d09a3fe62626e38e234a625e
 export PIXMAN_TARBALL := pixman-0.42.2.tar.gz
-export LIBPNG_SHA256SUM := 
b3683e8b8111ebf6f1ac004ebb6b0c975cd310ec469d98364388e9cedbfa68be
-export LIBPNG_TARBALL := libpng-1.6.38.tar.xz
+export LIBPNG_SHA256SUM := 
1f4696ce70b4ee5f85f1e1623dc1229b210029fa4b7aee573df3e2ba7b036937
+export LIBPNG_TARBALL := libpng-1.6.39.tar.xz
 export LIBTIFF_SHA256SUM := 
49307b510048ccc7bc40f2cba6e8439182fe6e654057c1a1683139bf2ecb1dc1
 export LIBTIFF_TARBALL := tiff-4.4.0.tar.xz
 export POPPLER_SHA256SUM := 
d7a8f748211359cadb774ba3e18ecda6464b34027045c0648eb30d5852a41e2e
commit 5fa5ef8959af7d0454025ff0fa70000c31c6d182
Author:     Michael Stahl <michael.st...@allotropia.de>
AuthorDate: Fri Dec 9 11:51:22 2022 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Feb 1 11:59:00 2023 +0100

    python3: upgrade to release 3.8.16
    
    Fixes CVE-2022-37454 and a few other ones that look less relevant
    including CVE-2022-45061 and CVE-2015-20107.
    
    Change-Id: I10fd254f7f0801d47119234bb3436874e98d8c91
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143849
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 05f55b3898407828bb24347be56247f58803f7bb)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143859
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/configure.ac b/configure.ac
index 41095d2aed24..0d3ef9eb027e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9775,7 +9775,7 @@ internal)
     SYSTEM_PYTHON=
     PYTHON_VERSION_MAJOR=3
     PYTHON_VERSION_MINOR=8
-    PYTHON_VERSION=${PYTHON_VERSION_MAJOR}.${PYTHON_VERSION_MINOR}.15
+    PYTHON_VERSION=${PYTHON_VERSION_MAJOR}.${PYTHON_VERSION_MINOR}.16
     if ! grep -q -i python.*${PYTHON_VERSION} ${SRC_ROOT}/download.lst; then
         AC_MSG_ERROR([PYTHON_VERSION ${PYTHON_VERSION} but no matching file in 
download.lst])
     fi
diff --git a/download.lst b/download.lst
index 05a5415ca538..6184994f7cc8 100644
--- a/download.lst
+++ b/download.lst
@@ -246,8 +246,8 @@ export POPPLER_DATA_SHA256SUM := 
2cec05cd1bb03af98a8b06a1e22f6e6e1a65b1e2f3816cb
 export POPPLER_DATA_TARBALL := poppler-data-0.4.11.tar.gz
 export POSTGRESQL_SHA256SUM := 
73876fdd3a517087340458dca4ce15b8d2a4dbceb334c0441424551ae6c4cded
 export POSTGRESQL_TARBALL := postgresql-13.8.tar.bz2
-export PYTHON_SHA256SUM := 
5114fc7918a2a5e20eb5aac696b30c36f412c6ef24b13f5c9eb9e056982d9550
-export PYTHON_TARBALL := Python-3.8.15.tar.xz
+export PYTHON_SHA256SUM := 
d85dbb3774132473d8081dcb158f34a10ccad7a90b96c7e50ea4bb61f5ce4562
+export PYTHON_TARBALL := Python-3.8.16.tar.xz
 export QXP_SHA256SUM := 
e137b6b110120a52c98edd02ebdc4095ee08d0d5295a94316a981750095a945c
 export QXP_TARBALL := libqxp-0.0.2.tar.xz
 export RAPTOR_SHA256SUM := 
ada7f0ba54787b33485d090d3d2680533520cd4426d2f7fb4782dd4a6a1480ed
commit e48dd97c32575f83b20ac2d7820a1d498a7618f2
Author:     Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Mon Nov 28 21:04:45 2022 +0900
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Feb 1 11:58:57 2023 +0100

    pixman: upgrade to release 0.42.2
    
    Fixes CVE-2022-44638
    
    Remove Wincompatible-function-pointer-types.patch.0, fixed upstream.
    
    Change-Id: If6589a701a252f71da145264ee3a6f0e333492ae
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143423
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit 93a69d37c1dbcc7365dc0cf2493d1ca27babef2b)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143439

diff --git a/download.lst b/download.lst
index f978a591b05a..05a5415ca538 100644
--- a/download.lst
+++ b/download.lst
@@ -234,8 +234,8 @@ export PAGEMAKER_SHA256SUM := 
66adacd705a7d19895e08eac46d1e851332adf2e736c566bef
 export PAGEMAKER_TARBALL := libpagemaker-0.0.4.tar.xz
 export PDFIUM_SHA256SUM := 
ecb9c2a0d777196949994946e3f24ed251ae5d3db8a9fa1e2827ef857151db13
 export PDFIUM_TARBALL := pdfium-5298.tar.bz2
-export PIXMAN_SHA256SUM := 
6d200dec3740d9ec4ec8d1180e25779c00bc749f94278c8b9021f5534db223fc
-export PIXMAN_TARBALL := pixman-0.40.0.tar.gz
+export PIXMAN_SHA256SUM := 
ea1480efada2fd948bc75366f7c349e1c96d3297d09a3fe62626e38e234a625e
+export PIXMAN_TARBALL := pixman-0.42.2.tar.gz
 export LIBPNG_SHA256SUM := 
b3683e8b8111ebf6f1ac004ebb6b0c975cd310ec469d98364388e9cedbfa68be
 export LIBPNG_TARBALL := libpng-1.6.38.tar.xz
 export LIBTIFF_SHA256SUM := 
49307b510048ccc7bc40f2cba6e8439182fe6e654057c1a1683139bf2ecb1dc1
diff --git a/external/cairo/ExternalPackage_pixman.mk 
b/external/cairo/ExternalPackage_pixman.mk
index 458c2733503e..85ff062f22e2 100644
--- a/external/cairo/ExternalPackage_pixman.mk
+++ b/external/cairo/ExternalPackage_pixman.mk
@@ -12,7 +12,7 @@ $(eval $(call 
gb_ExternalPackage_ExternalPackage,pixman,pixman))
 $(eval $(call gb_ExternalPackage_use_external_project,pixman,pixman))
 
 ifneq ($(DISABLE_DYNLOADING),TRUE)
-$(eval $(call 
gb_ExternalPackage_add_file,pixman,$(LIBO_LIB_FOLDER)/libpixman-1.so.0,pixman/.libs/libpixman-1.so.0.40.0))
+$(eval $(call 
gb_ExternalPackage_add_file,pixman,$(LIBO_LIB_FOLDER)/libpixman-1.so.0,pixman/.libs/libpixman-1.so.0.42.2))
 endif
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/cairo/ExternalProject_pixman.mk 
b/external/cairo/ExternalProject_pixman.mk
index 2c089ba0e5fc..9293b9234013 100644
--- a/external/cairo/ExternalProject_pixman.mk
+++ b/external/cairo/ExternalProject_pixman.mk
@@ -25,9 +25,9 @@ $(call gb_ExternalProject_get_state_target,pixman,build) :
        $(call gb_ExternalProject_run,build,\
                $(gb_RUN_CONFIGURE) ./configure \
                $(if $(filter 
TRUE,$(DISABLE_DYNLOADING)),--disable-shared,--disable-static) \
-               $(if $(filter ANDROID,$(OS)),--disable-arm-simd 
--disable-arm-neon --disable-arm-iwmmxt) \
-               $(if $(CROSS_COMPILING),--build=$(BUILD_PLATFORM) 
--host=$(HOST_PLATFORM) \
-               $(if $(filter INTEL ARM,$(CPUNAME)),ac_cv_c_bigendian=no)) \
+               $(if $(filter ANDROID,$(OS)),--disable-arm-simd 
--disable-arm-neon --disable-arm-a64-neon --disable-arm-iwmmxt) \
+               $(gb_CONFIGURE_PLATFORMS) \
+               $(if $(CROSS_COMPILING),$(if $(filter INTEL 
ARM,$(CPUNAME)),ac_cv_c_bigendian=no)) \
                $(if $(filter EMSCRIPTEN,$(OS)),CFLAGS="-pthread") \
                && $(MAKE) \
        )
diff --git a/external/cairo/pixman/pixman-0.24.4.patch 
b/external/cairo/pixman/pixman-0.24.4.patch
index 6d871e37bfd1..a5d32f88f82f 100644
--- a/external/cairo/pixman/pixman-0.24.4.patch
+++ b/external/cairo/pixman/pixman-0.24.4.patch
@@ -1,6 +1,6 @@
 --- misc/pixman-0.24.4/Makefile.in     2011-11-06 22:11:25.000000000 +0100
 +++ misc/build/pixman-0.24.4/Makefile.in       2011-12-16 09:06:45.317211035 
+0100
-@@ -272,7 +272,7 @@
+@@ -385,7 +385,7 @@
  top_build_prefix = @top_build_prefix@
  top_builddir = @top_builddir@
  top_srcdir = @top_srcdir@
diff --git a/external/cairo/pixman/pixman-ubsan.patch 
b/external/cairo/pixman/pixman-ubsan.patch
index 3a556d19a9dd..64e5778ee4d4 100644
--- a/external/cairo/pixman/pixman-ubsan.patch
+++ b/external/cairo/pixman/pixman-ubsan.patch
@@ -1,6 +1,6 @@
-diff -ru pixman-0.40.0.orig/pixman/pixman-bits-image.c 
pixman-0.40.0/pixman/pixman-bits-image.c
---- misc/pixman-0.40.0.orig/pixman/pixman-bits-image.c 2021-08-29 
20:02:33.714515016 +0100
-+++ misc/build/pixman-0.40.0/pixman/pixman-bits-image.c        2021-08-29 
20:05:43.304930185 +0100
+diff -ru pixman-0.42.2.orig/pixman/pixman-bits-image.c 
pixman-0.42.2/pixman/pixman-bits-image.c
+--- misc/pixman-0.42.2.orig/pixman/pixman-bits-image.c 2022-11-03 
02:25:48.000000000 +0900
++++ misc/build/pixman-0.42.2/pixman/pixman-bits-image.c        2022-11-28 
21:35:25.896969126 +0900
 @@ -351,8 +351,8 @@
       * positioned relative to a particular phase (and not relative to whatever
       * exact fraction we happen to get here).
@@ -12,9 +12,9 @@ diff -ru pixman-0.40.0.orig/pixman/pixman-bits-image.c 
pixman-0.40.0/pixman/pixm
  
      px = (x & 0xffff) >> x_phase_shift;
      py = (y & 0xffff) >> y_phase_shift;
-diff -ru pixman-0.40.0.orig/pixman/pixman-combine32.c 
pixman-0.40.0/pixman/pixman-combine32.c
---- misc/pixman-0.40.0.orig/pixman/pixman-combine32.c  2021-08-29 
20:02:33.715514970 +0100
-+++ misc/build/pixman-0.40.0/pixman/pixman-combine32.c 2021-08-29 
20:05:43.304930185 +0100
+diff -ru pixman-0.42.2.orig/pixman/pixman-combine32.c 
pixman-0.42.2/pixman/pixman-combine32.c
+--- misc/pixman-0.42.2.orig/pixman/pixman-combine32.c  2022-02-02 
05:51:25.000000000 +0900
++++ misc/build/pixman-0.42.2/pixman/pixman-combine32.c 2022-11-28 
21:38:48.226968594 +0900
 @@ -589,7 +589,7 @@
            rg = DIV_ONE_UN8 (rg);                                      \
            rb = DIV_ONE_UN8 (rb);                                      \
@@ -24,9 +24,9 @@ diff -ru pixman-0.40.0.orig/pixman/pixman-combine32.c 
pixman-0.40.0/pixman/pixma
        }                                                               \
      }                                                                 \
                                                                        \
-diff -ru pixman-0.40.0.orig/pixman/pixman-fast-path.c 
pixman-0.40.0/pixman/pixman-fast-path.c
---- misc/pixman-0.40.0.orig/pixman/pixman-fast-path.c  2021-08-29 
20:02:33.716514925 +0100
-+++ misc/build/pixman-0.40.0/pixman/pixman-fast-path.c 2021-08-29 
20:05:43.303930231 +0100
+diff -ru pixman-0.42.2.orig/pixman/pixman-fast-path.c 
pixman-0.42.2/pixman/pixman-fast-path.c
+--- misc/pixman-0.42.2.orig/pixman/pixman-fast-path.c  2022-10-18 
02:47:42.000000000 +0900
++++ misc/build/pixman-0.42.2/pixman/pixman-fast-path.c 2022-11-28 
21:53:12.596963317 +0900
 @@ -2758,8 +2758,8 @@
         * positioned relative to a particular phase (and not relative to 
whatever
         * exact fraction we happen to get here).
@@ -38,19 +38,22 @@ diff -ru pixman-0.40.0.orig/pixman/pixman-fast-path.c 
pixman-0.40.0/pixman/pixma
  
        px = (x & 0xffff) >> x_phase_shift;
        py = (y & 0xffff) >> y_phase_shift;
-@@ -2836,7 +2836,7 @@
-       sgtot = CLIP (sgtot, 0, 0xff);
+@@ -2837,9 +2837,9 @@
        sbtot = CLIP (sbtot, 0, 0xff);
  
+ #ifdef WORDS_BIGENDIAN
+-      buffer[k] = (satot << 0) | (srtot << 8) | (sgtot << 16) | (sbtot << 24);
++      buffer[k] = (satot << 0) | (srtot << 8) | (sgtot << 16) | 
((uint32_t)sbtot << 24);
+ #else
 -      buffer[k] = (satot << 24) | (srtot << 16) | (sgtot << 8) | (sbtot << 0);
 +      buffer[k] = ((uint32_t)satot << 24) | (srtot << 16) | (sgtot << 8) | 
(sbtot << 0);
+ #endif
  
      next:
-       vx += ux;
-diff -ru pixman-0.40.0.orig/pixman/pixman-sse2.c 
pixman-0.40.0/pixman/pixman-sse2.c
---- misc/pixman-0.40.0.orig/pixman/pixman-sse2.c       2021-08-29 
20:02:33.716514925 +0100
-+++ misc/build/pixman-0.40.0/pixman/pixman-sse2.c      2021-08-29 
20:05:43.306930095 +0100
-@@ -3344,7 +3344,7 @@
+diff -ru pixman-0.42.2.orig/pixman/pixman-sse2.c 
pixman-0.42.2/pixman/pixman-sse2.c
+--- misc/pixman-0.42.2/pixman/pixman-sse2.c    2022-02-02 05:51:25.000000000 
+0900
++++ misc/build/pixman-0.42.2/pixman/pixman-sse2.c   2022-11-28 
22:11:19.276969466 +0900
+@@ -3345,7 +3345,7 @@
  
        b = filler & 0xff;
        w = (b << 8) | b;
@@ -59,9 +62,9 @@ diff -ru pixman-0.40.0.orig/pixman/pixman-sse2.c 
pixman-0.40.0/pixman/pixman-sse
      }
      else if (bpp == 16)
      {
-diff -ru pixman-0.40.0.orig/pixman/pixman-utils.c 
pixman-0.40.0/pixman/pixman-utils.c
---- misc/pixman-0.40.0.orig/pixman/pixman-utils.c      2021-08-29 
20:02:33.715514970 +0100
-+++ misc/build/pixman-0.40.0/pixman/pixman-utils.c     2021-08-29 
20:05:43.306930095 +0100
+diff -ru pixman-0.42.2.orig/pixman/pixman-utils.c 
pixman-0.42.2/pixman/pixman-utils.c
+--- misc/pixman-0.42.2.orig/pixman/pixman-utils.c      2022-02-02 
05:51:25.000000000 +0900
++++ misc/build/pixman-0.42.2/pixman/pixman-utils.c     2022-11-28 
21:55:44.196964912 +0900
 @@ -213,7 +213,7 @@
        g = float_to_unorm (src[i].g, 8);
        b = float_to_unorm (src[i].b, 8);
commit 46674baae6a721d8df89c0b3f2e12606e7512e9e
Author:     Taichi Haradaguchi <20001...@ymail.ne.jp>
AuthorDate: Mon Oct 31 00:20:55 2022 +0900
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Feb 1 11:57:41 2023 +0100

    upgrade Expat to 2.5.0
    
    Fixes CVE-2022-43680
    
    Change-Id: I5bf8d1ab0ac352833c76a7edfc1d8eb78dd03e10
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/142205
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/download.lst b/download.lst
index ef2f285572b5..f978a591b05a 100644
--- a/download.lst
+++ b/download.lst
@@ -50,8 +50,8 @@ export EPUBGEN_TARBALL := libepubgen-0.1.1.tar.xz
 export ETONYEK_SHA256SUM := 
b430435a6e8487888b761dc848b7981626eb814884963ffe25eb26a139301e9a
 export ETONYEK_VERSION_MICRO := 10
 export ETONYEK_TARBALL := libetonyek-0.1.$(ETONYEK_VERSION_MICRO).tar.xz
-export EXPAT_SHA256SUM := 
6e8c0728fe5c7cd3f93a6acce43046c5e4736c7b4b68e032e9350daa0efc0354
-export EXPAT_TARBALL := expat-2.4.9.tar.xz
+export EXPAT_SHA256SUM := 
ef2420f0232c087801abf705e89ae65f6257df6b7931d37846a193ef2e8cdcbe
+export EXPAT_TARBALL := expat-2.5.0.tar.xz
 export FIREBIRD_SHA256SUM := 
acb85cedafa10ce106b1823fb236b1b3e5d942a5741e8f8435cc8ccfec0afe76
 export FIREBIRD_TARBALL := Firebird-3.0.7.33374-0.tar.bz2
 export FONTCONFIG_SHA256SUM := 
a5f052cb73fd479ffb7b697980510903b563bbb55b8f7a2b001fcfb94026003c
diff --git a/external/expat/expat-winapi.patch 
b/external/expat/expat-winapi.patch
index 7eae7d5d6139..fed65644a732 100644
--- a/external/expat/expat-winapi.patch
+++ b/external/expat/expat-winapi.patch
@@ -1,6 +1,6 @@
---- misc/expat-2.1.0/lib/expat_external.h      2009-11-16 08:53:17.375000000 
+0000
-+++ misc/build/expat-2.1.0/lib/expat_external.h        2009-11-16 
08:53:34.703125000 +0000
-@@ -81,10 +81,6 @@
+--- misc/expat-2.5.0/lib/expat_external.h      2022-10-25 01:32:54.000000000 
+0900
++++ misc/build/expat-2.5.0/lib/expat_external.h        2022-10-30 
23:09:47.339459134 +0900
+@@ -88,10 +88,6 @@
  #  ifndef XML_BUILDING_EXPAT
  /* using Expat from an application */
  
@@ -11,12 +11,13 @@
  #  endif
  #endif /* not defined XML_STATIC */
  
---- misc/expat-2.1.0/lib/xmlparse.c    2021-05-23 16:56:25.000000000 +0100
-+++ misc/build/expat-2.1.0/lib/xmlparse.c      2021-05-25 12:42:11.997173600 
+0100
-@@ -64,6 +64,8 @@
+--- misc/expat-2.5.0/lib/xmlparse.c    2022-10-26 00:09:08.000000000 +0900
++++ misc/build/expat-2.5.0/lib/xmlparse.c      2022-10-30 23:09:01.843006341 
+0900
+@@ -67,6 +67,9 @@
  #endif
  
  #ifdef _WIN32
++#  undef HAVE_ARC4RANDOM_BUF
 +#  undef HAVE_GETRANDOM
 +#  undef HAVE_SYSCALL_GETRANDOM
  /* force stdlib to define rand_s() */

Reply via email to