From 88f482246b14a0806930725ff831e796f98fa555 Mon Sep 17 00:00:00 2001
From: Manuel de Brito Fontes <aledbf@gmail.com>
Date: Wed, 21 Oct 2026 17:05:40 -0300
Subject: [PATCH] build: Go 1.27.3, and Wolfi's roots without emSign's

Eight of eMudhra's intermediate CA keys were weak enough to recover (CVE-2026-111943). Go 1.27.3
refuses a chain through any of them, by key: go.mod's and the builder host's, which a test holds
together. Wolfi's lines at its index: ca-certificates-bundle 20260909-r3 is the sync with NSS
3.131.1, which drops emSign's roots; the rest moved with it, as the lock workflow would have on
Monday.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 build/host.env              |   4 +-
 go.mod                      |   2 +-
 image/apko.lock.yaml        | 180 ++++++++++++++++++------------------
 image/initrd/apko.lock.yaml |  48 +++++-----
 4 files changed, 117 insertions(+), 117 deletions(-)

diff --git a/build/host.env b/build/host.env
index a27ef3a..25bfdf5 100644
--- a/build/host.env
+++ b/build/host.env
@@ -3,8 +3,8 @@
 # cache: a host tool's bump rebuilds no kernel.
 
 # Go: go.mod's go line is the same version (a test holds them together); the tarball is go.dev's.
-GO_VERSION=1.27.2
-GO_SHA256=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5
+GO_VERSION=1.27.3
+GO_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
 
 # task (taskfile.dev), from its GitHub release.
 TASK_VERSION=3.54.0
diff --git a/go.mod b/go.mod
index d3d6f91..cf0a815 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/Construct-Linux/os
 
-go 1.27.2
+go 1.27.3
 
 require (
 	github.com/ProtonMail/go-crypto v1.5.2
diff --git a/image/apko.lock.yaml b/image/apko.lock.yaml
index ddeba54..bebc9c7 100644
--- a/image/apko.lock.yaml
+++ b/image/apko.lock.yaml
@@ -323,18 +323,18 @@ contents:
     - xwayland=24.1.13-r1
     - yubikey-manager=5.9.2-r0
     # Wolfi's: bumped by the lock workflow, or task lock -- -all.
-    - agetty=2.42.4-r0
+    - agetty=2.42.4-r1
     - alsa-lib=1.2.16.1-r3
     - aom-libs=3.15.2-r0
-    - avahi=0.9_rc5-r2
+    - avahi=0.9_rc5-r3
     - bash=5.3-r14
     - bash-binsh=5.3-r14
     - bash-doc=5.3-r14
     - binutils=2.47-r1
     - binutils-doc=2.47-r1
-    - brotli=1.2.0-r6
-    - brotli-dev=1.2.0-r6
-    - brotli-doc=1.2.0-r6
+    - brotli=1.2.0-r7
+    - brotli-dev=1.2.0-r7
+    - brotli-doc=1.2.0-r7
     - btrfs-progs=7.1-r3
     - bubblewrap=0.13.1-r0
     - build-base=1-r10
@@ -342,9 +342,9 @@ contents:
     - bzip2=1.0.8-r25
     - bzip2-dev=1.0.8-r25
     - bzip2-doc=1.0.8-r25
-    - ca-certificates=20260909-r2
-    - ca-certificates-bundle=20260909-r2
-    - ca-certificates-doc=20260909-r2
+    - ca-certificates=20260909-r3
+    - ca-certificates-bundle=20260909-r3
+    - ca-certificates-doc=20260909-r3
     - cairo=1.18.6-r0
     - cairo-dev=1.18.6-r0
     - cairo-gobject=1.18.6-r0
@@ -359,27 +359,27 @@ contents:
     - cryptsetup=2.8.8-r3
     - cryptsetup-doc=2.8.8-r3
     - ctr-2=2.4.2-r0
-    - cups=2.4.19-r4
-    - cups-doc=2.4.19-r4
-    - cups-libs=2.4.19-r4
-    - curl=8.23.0-r0
-    - curl-doc=8.23.0-r0
+    - cups=2.4.20-r0
+    - cups-doc=2.4.20-r0
+    - cups-libs=2.4.20-r0
+    - curl=8.23.0-r1
+    - curl-doc=8.23.0-r1
     - cyrus-sasl-heimdal-libs=2.1.28-r58
-    - db=5.3.37-r0
+    - db=2026.10.7-r0
     - dbus=1.16.2-r7
     - dbus-doc=1.16.2-r7
     - dbus-libs=1.16.2-r7
     - dmidecode=3.7-r4
     - dmidecode-doc=3.7-r4
     - docbook-xml=4.5-r8
-    - docker-29=29.9.1-r0
-    - docker-cli=29.9.1-r0
-    - docker-cli-buildx=0.38.0-r2
-    - docker-cli-doc=29.9.1-r0
-    - docker-compose=5.6.0-r2
-    - docker-init-29=29.9.1-r0
-    - dockerd-29=29.9.1-r0
-    - dockerd-service-29=29.9.1-r0
+    - docker-29=29.9.2-r0
+    - docker-cli=29.9.2-r0
+    - docker-cli-buildx=0.38.1-r0
+    - docker-cli-doc=29.9.2-r0
+    - docker-compose=5.6.1-r0
+    - docker-init-29=29.9.2-r0
+    - dockerd-29=29.9.2-r0
+    - dockerd-service-29=29.9.2-r0
     - dosfstools=4.2-r46
     - dosfstools-doc=4.2-r46
     - e2fsprogs=1.47.4-r3
@@ -391,7 +391,7 @@ contents:
     - enchant2-doc=2.8.21-r1
     - expat-dev=2.9.0-r0
     - fio=3.43-r0
-    - firefox=158.0-r1
+    - firefox=158.0.1-r0
     - font-noto=2026.10.01-r1
     - font-noto-common=2026.10.01-r1
     - font-noto-emoji=2.057-r0
@@ -609,7 +609,7 @@ contents:
     - freetype=2.14.3-r7
     - freetype-dev=2.14.3-r7
     - fribidi=1.0.17-r0
-    - fstrim=2.42.4-r0
+    - fstrim=2.42.4-r1
     - fuse-overlayfs=1.18-r1
     - fuse-overlayfs-doc=1.18-r1
     - fuse3=3.18.3-r1
@@ -619,9 +619,9 @@ contents:
     - gcc-doc=16.2.0-r1
     - gdbm=1.26-r7
     - gdbm-doc=1.26-r7
-    - gdk-pixbuf=2.44.8-r2
-    - gdk-pixbuf-doc=2.44.8-r2
-    - gdk-pixbuf-lang=2.44.8-r2
+    - gdk-pixbuf=2.44.8-r3
+    - gdk-pixbuf-doc=2.44.8-r3
+    - gdk-pixbuf-lang=2.44.8-r3
     - gettext=1.0-r8
     - gettext-dev=1.0-r8
     - gettext-doc=1.0-r8
@@ -629,8 +629,8 @@ contents:
     - ghostscript=10.08.0-r0
     - ghostscript-doc=10.08.0-r0
     - giflib=6.1.3-r2
-    - git=2.56.0-r2
-    - git-doc=2.56.0-r2
+    - git=2.56.0-r3
+    - git-doc=2.56.0-r3
     - glib=2.90.1-r0
     - glib-dev=2.90.1-r0
     - glib-doc=2.90.1-r0
@@ -664,7 +664,7 @@ contents:
     - groff=1.24.2-r0
     - groff-base=1.24.2-r0
     - groff-doc=1.24.2-r0
-    - gst-libav=1.29.2-r0
+    - gst-libav=1.29.2-r1
     - gst-plugins-base=1.29.2-r3
     - gst-plugins-base-doc=1.29.2-r3
     - gst-plugins-base-lang=1.29.2-r3
@@ -686,8 +686,8 @@ contents:
     - innoextract=1.9-r6
     - innoextract-doc=1.9-r6
     - ip6tables=1.8.13-r5
-    - iproute2=7.2.0-r1
-    - iproute2-doc=7.2.0-r1
+    - iproute2=7.3.0-r0
+    - iproute2-doc=7.3.0-r0
     - iptables=1.8.13-r5
     - iptables-doc=1.8.13-r5
     - iptables-nft=1.8.13-r5
@@ -709,8 +709,8 @@ contents:
     - lame-libs=4.0-r2
     - lcms2=2.19.1-r3
     - ld-linux-2.44=2.44-r8
-    - less=711-r0
-    - less-doc=711-r0
+    - less=712-r0
+    - less-doc=712-r0
     - libLLVM-22=22.1.8-r6
     - libacl1=2.4.0-r4
     - libaio=0.3.113-r10
@@ -720,35 +720,35 @@ contents:
     - libatomic=16.2.0-r1
     - libattr1=2.6.0-r4
     - libaudit=4.2.1-r2
-    - libblkid=2.42.4-r0
-    - libboost-filesystem=1.88.0-r7
-    - libboost-iostreams=1.88.0-r7
+    - libblkid=2.42.4-r1
+    - libboost-filesystem=1.89.0-r0
+    - libboost-iostreams=1.89.0-r0
     - libboost-program_options=1.88.0-r7
     - libbpf=1.8.0-r0
-    - libbrotlicommon1=1.2.0-r6
-    - libbrotlidec1=1.2.0-r6
-    - libbrotlienc1=1.2.0-r6
+    - libbrotlicommon1=1.2.0-r7
+    - libbrotlidec1=1.2.0-r7
+    - libbrotlienc1=1.2.0-r7
     - libbsd=0.12.2-r9
     - libbz2-1=1.0.8-r25
     - libcap=2.78-r4
     - libcap-ng=0.9.6-r1
     - libcom_err=1.47.4-r3
     - libcrypt1-2.44=2.44-r8
-    - libcrypto3=3.6.5-r2
-    - libcurl-openssl4=8.23.0-r0
+    - libcrypto3=3.6.5-r5
+    - libcurl-openssl4=8.23.0-r1
     - libdaemon=0.14-r7
     - libdav1d=1.5.4-r2
     - libde265=1.1.3-r0
     - libdrm-libs=2.4.134-r3
     - libedit=3.1-r20
     - libedit-dev=3.1-r20
-    - libelf=0.196-r1
+    - libelf=0.197-r0
     - libepoxy=1.5.10-r10
     - libevdev=1.14.0-r0
     - libevent=2.1.13-r3
     - libexif-libs=0.6.26-r3
     - libexpat1=2.9.0-r0
-    - libfdisk=2.42.4-r0
+    - libfdisk=2.42.4-r1
     - libffi=3.8.0-r2
     - libffi-dev=3.8.0-r2
     - libflac=1.5.0-r2
@@ -768,7 +768,7 @@ contents:
     - libheif=1.23.6-r0
     - libheif-doc=1.23.6-r0
     - libhunspell=1.7.5-r0
-    - libical=4.0.6-r0
+    - libical=4.0.7-r0
     - libice=1.1.2-r8
     - libice-dev=1.1.2-r8
     - libicu78=78.3-r4
@@ -784,13 +784,13 @@ contents:
     - liblz4-1=1.10.0-r11
     - libmd=1.3.0-r0
     - libmnl=1.0.5-r10
-    - libmount=2.42.4-r0
+    - libmount=2.42.4-r1
     - libnftnl=1.3.2-r1
     - libnghttp2-14=1.70.0-r5
     - libnl3=3.12.0-r7
     - libnotify=0.8.9-r0
     - libnspr=4.40-r2
-    - libnss=3.131-r0
+    - libnss=3.131.1-r0
     - libnvme=1.16.2-r5
     - libogg-libs=1.3.6-r10
     - libopenjph0.32=0.32.0-r0
@@ -826,14 +826,14 @@ contents:
     - libsigcplusplus=3.8.1-r3
     - libsm=1.2.6-r6
     - libsm-dev=1.2.6-r6
-    - libsmartcols=2.42.4-r0
+    - libsmartcols=2.42.4-r1
     - libsmbclient=4.25.0-r0
     - libsndfile=1.2.2-r6
     - libsndfile-doc=1.2.2-r6
     - libsodium=1.0.22-r2
     - libsrt=1.5.7-r4
     - libssh=0.12.2-r3
-    - libssl3=3.6.5-r2
+    - libssl3=3.6.5-r5
     - libstdc++=16.2.0-r1
     - libstdc++-dev=16.2.0-r1
     - libsvtav1enc4=4.2.0-r2
@@ -847,7 +847,7 @@ contents:
     - libunistring=1.5-r0
     - liburcu=0.15.7-r1
     - libusb=1.0.30-r3
-    - libuuid=2.42.4-r0
+    - libuuid=2.42.4-r1
     - libva=2.24.1-r3
     - libverto=0.3.2-r9
     - libvorbis=1.3.7-r12
@@ -896,12 +896,12 @@ contents:
     - libzip=1.12.1-r0
     - libzip-doc=1.12.1-r0
     - libzstd1=1.5.7-r10
-    - linux-headers=7.2.11-r0
+    - linux-headers=7.3-r0
     - linux-pam=1.7.3-r0
     - lm-sensors=3.6.2-r4
     - lm-sensors-detect=3.6.2-r4
     - lm-sensors-doc=3.6.2-r4
-    - lsblk=2.42.4-r0
+    - lsblk=2.42.4-r1
     - lsof=4.99.7-r3
     - lsof-doc=4.99.7-r3
     - lua5.4-libs=5.4.9-r2
@@ -912,34 +912,34 @@ contents:
     - make-doc=4.4.1-r15
     - man-db=2.13.1-r55
     - man-db-doc=2.13.1-r55
-    - mount=2.42.4-r0
+    - mount=2.42.4-r1
     - mpc=1.4.1-r1
     - mpdecimal=4.0.1-r4
     - mpfr=4.2.2-r3
     - mtdev=1.1.7-r6
-    - ncurses=6.6.20261010-r0
-    - ncurses-dev=6.6.20261010-r0
-    - ncurses-doc=6.6.20261010-r0
-    - ncurses-terminfo-base=6.6.20261010-r0
+    - ncurses=6.6.20261017-r0
+    - ncurses-dev=6.6.20261017-r0
+    - ncurses-doc=6.6.20261017-r0
+    - ncurses-terminfo-base=6.6.20261017-r0
     - net-tools=2.10-r37
     - net-tools-doc=2.10-r37
-    - nettle=3.10.2-r2
+    - nettle=4.0-r4
     - nftables=1.1.7-r0
     - nftables-doc=1.1.7-r0
     - nghttp3=1.18.0-r1
     - ngtcp2=1.25.0-r5
     - npth-libs=1.8-r14
-    - nsenter=2.42.4-r0
+    - nsenter=2.42.4-r1
     - oniguruma=6.9.10-r5
     - opencore-amr=0.1.6-r6
     - openh264=2.6.0-r3
     - openjpeg=2.5.4-r3
     - openssf-compiler-options=20250904-r11
-    - openssl-4.0=4.0.3-r7
-    - openssl-4.0-dev=4.0.3-r7
-    - openssl-4.0-doc=4.0.3-r7
-    - openssl-4.0-libcrypto=4.0.3-r7
-    - openssl-4.0-libssl=4.0.3-r7
+    - openssl-4.0=4.0.3-r8
+    - openssl-4.0-dev=4.0.3-r8
+    - openssl-4.0-doc=4.0.3-r8
+    - openssl-4.0-libcrypto=4.0.3-r8
+    - openssl-4.0-libssl=4.0.3-r8
     - openssl-provider-legacy-allowed=4.0.3-r1
     - openvpn=2.7.8-r0
     - openvpn-doc=2.7.8-r0
@@ -954,13 +954,13 @@ contents:
     - pciutils-doc=3.10.0-r44
     - pciutils-libs=3.10.0-r44
     - pcre2-dev=10.49-r1
-    - perl=5.44.0-r1
-    - perl-doc=5.44.0-r1
+    - perl=5.44.0-r2
+    - perl-doc=5.44.0-r2
     - pigz=2.8-r8
     - pixman=0.46.4-r6
     - pixman-dev=0.46.4-r6
-    - pkgconf=3.0.9-r0
-    - pkgconf-doc=3.0.9-r0
+    - pkgconf=3.0.10-r0
+    - pkgconf-doc=3.0.10-r0
     - polkit=128-r0
     - polkit-doc=128-r0
     - polkit-lang=128-r0
@@ -977,7 +977,7 @@ contents:
     - procps=4.0.7-r1
     - procps-doc=4.0.7-r1
     - protobuf-c=1.5.2-r11
-    - py3-pip-wheel=26.2.1-r4
+    - py3-pip-wheel=26.2.2-r0
     - py3.13-backports.tarfile=1.2.0-r6
     - py3.13-cairo=1.29.2-r0
     - py3.13-cffi=2.1.1-r1
@@ -996,27 +996,27 @@ contents:
     - py3.13-pycparser=3.11-r0
     - py3.13-python-dateutil=2.9.0-r13
     - py3.13-secretstorage=3.5.0-r3
-    - py3.13-setuptools=84.0.0-r1
+    - py3.13-setuptools=84.2.1-r0
     - py3.13-six=1.17.0-r7
     - py3.13-typing-extensions=4.16.0-r0
     - py3.13-zipp=4.1.1-r0
-    - python-3.13=3.13.16_git20261016-r0
-    - python-3.13-base=3.13.16_git20261016-r0
-    - python-3.13-doc=3.13.16_git20261016-r0
+    - python-3.13=3.13.16_git20261016-r1
+    - python-3.13-base=3.13.16_git20261016-r1
+    - python-3.13-doc=3.13.16_git20261016-r1
     - qrencode=4.1.1-r1
     - qrencode-doc=4.1.1-r1
     - quota-tools=4.11-r3
     - quota-tools-doc=4.11-r3
     - rav1e=0.8.1-r11
     - readline=8.3-r3
-    - runc=1.5.2-r3
-    - runc-doc=1.5.2-r3
-    - runuser=2.42.4-r0
+    - runc=1.5.2-r4
+    - runc-doc=1.5.2-r4
+    - runuser=2.42.4-r1
     - samba-libs=4.25.0-r0
     - samba-util-libs=4.25.0-r0
     - sbc=2.2-r1
-    - script=2.42.4-r0
-    - setarch=2.42.4-r0
+    - script=2.42.4-r1
+    - setarch=2.42.4-r1
     - sgdisk=1.0.10-r7
     - shadow=4.20.3-r0
     - shadow-doc=4.20.3-r0
@@ -1036,7 +1036,7 @@ contents:
     - startup-notification=0.12-r8
     - stress-ng=0.22.01-r0
     - stress-ng-doc=0.22.01-r0
-    - tailscale=1.104.1-r2
+    - tailscale=1.104.2-r0
     - talloc=2.5.0-r2
     - tdb=1.4.15-r4
     - tevent=0.17.2-r1
@@ -1047,15 +1047,15 @@ contents:
     - tini-static=0.19.0-r26
     - tpm2-tss=4.2.0-r3
     - tzdata=2026e-r0
-    - umount=2.42.4-r0
-    - util-linux=2.42.4-r0
-    - util-linux-dev=2.42.4-r0
-    - util-linux-login=2.42.4-r0
-    - util-linux-misc=2.42.4-r0
-    - util-linux-su=2.42.4-r0
+    - umount=2.42.4-r1
+    - util-linux=2.42.4-r1
+    - util-linux-dev=2.42.4-r1
+    - util-linux-login=2.42.4-r1
+    - util-linux-misc=2.42.4-r1
+    - util-linux-su=2.42.4-r1
     - util-macros=1.20.2-r5
-    - vim=9.2.1202-r0
-    - vim-doc=9.2.1202-r0
+    - vim=9.2.1225-r0
+    - vim-doc=9.2.1225-r0
     - vulkan-loader=1.4.365-r0
     - vulkan-loader-libs=1.4.365-r0
     - wayland-libs-client=1.26.0-r1
@@ -1063,7 +1063,7 @@ contents:
     - wayland-libs-egl=1.26.0-r1
     - wayland-libs-server=1.26.0-r1
     - wayland-protocols=1.49-r0
-    - wipefs=2.42.4-r0
+    - wipefs=2.42.4-r1
     - wireguard-tools=1.0.20260223-r2
     - wireguard-tools-doc=1.0.20260223-r2
     - wolfi-baselayout=20230201-r30
@@ -1073,8 +1073,8 @@ contents:
     - xcb-util-dev=0.4.1-r8
     - xdg-utils=1.2.1-r8
     - xdg-utils-doc=1.2.1-r8
-    - xfsprogs=7.2.0-r0
-    - xfsprogs-core=7.2.0-r0
+    - xfsprogs=7.2.1-r0
+    - xfsprogs-core=7.2.1-r0
     - xkbcomp=1.5.0-r4
     - xkbcomp-doc=1.5.0-r4
     - xkeyboard-config=2.48-r2
diff --git a/image/initrd/apko.lock.yaml b/image/initrd/apko.lock.yaml
index 2e23fc1..7c100c0 100644
--- a/image/initrd/apko.lock.yaml
+++ b/image/initrd/apko.lock.yaml
@@ -30,12 +30,12 @@ contents:
     # Wolfi's: bumped by the lock workflow, or task lock -- -all.
     - bash=5.3-r14
     - bash-binsh=5.3-r14
-    - blkid=2.42.4-r0
-    - ca-certificates-bundle=20260909-r2
+    - blkid=2.42.4-r1
+    - ca-certificates-bundle=20260909-r3
     - cairo=1.18.6-r0
     - coreutils=9.12-r4
     - cryptsetup=2.8.8-r3
-    - curl=8.23.0-r0
+    - curl=8.23.0-r1
     - cyrus-sasl-heimdal-libs=2.1.28-r58
     - dbus=1.16.2-r7
     - dbus-libs=1.16.2-r7
@@ -44,7 +44,7 @@ contents:
     - fontconfig-config=2.18.3-r2
     - freetype=2.14.3-r7
     - fribidi=1.0.17-r0
-    - fstrim=2.42.4-r0
+    - fstrim=2.42.4-r1
     - gdbm=1.26-r7
     - glib=2.90.1-r0
     - glibc-2.44=2.44-r8
@@ -64,26 +64,26 @@ contents:
     - libarchive=3.8.10-r0
     - libattr1=2.6.0-r4
     - libaudit=4.2.1-r2
-    - libblkid=2.42.4-r0
-    - libbrotlicommon1=1.2.0-r6
-    - libbrotlidec1=1.2.0-r6
-    - libbrotlienc1=1.2.0-r6
+    - libblkid=2.42.4-r1
+    - libbrotlicommon1=1.2.0-r7
+    - libbrotlidec1=1.2.0-r7
+    - libbrotlienc1=1.2.0-r7
     - libbz2-1=1.0.8-r25
     - libcap-ng=0.9.6-r1
     - libcom_err=1.47.4-r3
     - libcrypt1-2.44=2.44-r8
-    - libcurl-openssl4=8.23.0-r0
+    - libcurl-openssl4=8.23.0-r1
     - libdrm-libs=2.4.134-r3
     - libevdev=1.14.0-r0
     - libexpat1=2.9.0-r0
-    - libfdisk=2.42.4-r0
+    - libfdisk=2.42.4-r1
     - libffi=3.8.0-r2
     - libfontconfig1=2.18.3-r2
     - libgcc=16.2.0-r1
     - libidn2=2.3.8-r10
     - libldap-2.7=2.7.1-r2
     - liblz4-1=1.10.0-r11
-    - libmount=2.42.4-r0
+    - libmount=2.42.4-r1
     - libnghttp2-14=1.70.0-r5
     - libpciaccess=0.19-r4
     - libpcre2-8-0=10.49-r1
@@ -92,10 +92,10 @@ contents:
     - libseccomp=2.6.1-r2
     - libselinux=3.11-r2
     - libsepol=3.11-r3
-    - libsmartcols=2.42.4-r0
+    - libsmartcols=2.42.4-r1
     - libssh=0.12.2-r3
     - libunistring=1.5-r0
-    - libuuid=2.42.4-r0
+    - libuuid=2.42.4-r1
     - libverto=0.3.2-r9
     - libx11=1.8.14-r0
     - libxau=1.0.12-r9
@@ -110,13 +110,13 @@ contents:
     - libzstd1=1.5.7-r10
     - linux-pam=1.7.3-r0
     - lz4=1.10.0-r11
-    - mount=2.42.4-r0
-    - ncurses=6.6.20261010-r0
-    - ncurses-terminfo-base=6.6.20261010-r0
+    - mount=2.42.4-r1
+    - ncurses=6.6.20261017-r0
+    - ncurses-terminfo-base=6.6.20261017-r0
     - nghttp3=1.18.0-r1
     - ngtcp2=1.25.0-r5
-    - openssl-4.0-libcrypto=4.0.3-r7
-    - openssl-4.0-libssl=4.0.3-r7
+    - openssl-4.0-libcrypto=4.0.3-r8
+    - openssl-4.0-libssl=4.0.3-r8
     - openssl-provider-legacy-allowed=4.0.3-r1
     - pango=1.58.2-r1
     - pixman=0.46.4-r6
@@ -124,14 +124,14 @@ contents:
     - popt=1.19-r11
     - quota-tools=4.11-r3
     - readline=8.3-r3
-    - runuser=2.42.4-r0
-    - sfdisk=2.42.4-r0
+    - runuser=2.42.4-r1
+    - sfdisk=2.42.4-r1
     - sqlite-libs=3.54.1-r0
     - tpm2-tss=4.2.0-r3
-    - umount=2.42.4-r0
-    - util-linux=2.42.4-r0
-    - util-linux-login=2.42.4-r0
-    - util-linux-su=2.42.4-r0
+    - umount=2.42.4-r1
+    - util-linux=2.42.4-r1
+    - util-linux-login=2.42.4-r1
+    - util-linux-su=2.42.4-r1
     - wayland-libs-client=1.26.0-r1
     - wolfi-baselayout=20230201-r30
     - xkeyboard-config=2.48-r2