compilerplugins/LICENSE.TXT                                                 |  
  2 
 configure.ac                                                                |  
  4 
 cui/inc/strings.hrc                                                         |  
  2 
 download.lst                                                                |  
 40 +--
 external/cairo/ExternalPackage_pixman.mk                                    |  
  2 
 external/cairo/ExternalProject_pixman.mk                                    |  
  6 
 external/cairo/pixman/pixman-0.24.4.patch                                   |  
  2 
 external/cairo/pixman/pixman-ubsan.patch                                    |  
 41 +--
 external/curl/UnpackedTarball_curl.mk                                       |  
  6 
 external/curl/asan-poison-nsspem.patch.0                                    |  
 11 
 external/curl/curl-msvc-disable-protocols.patch.1                           |  
  2 
 external/curl/curl-nss.patch.1                                              |  
  2 
 external/curl/zlib.patch.0                                                  |  
 12 
 external/expat/expat-winapi.patch                                           |  
 13 -
 external/freetype/ExternalProject_freetype.mk                               |  
 10 
 external/freetype/UnpackedTarball_freetype.mk                               |  
  3 
 external/freetype/freetype-2.6.5.patch.1                                    |  
 45 +--
 external/freetype/ubsan.patch                                               |  
 11 
 external/gpgmepp/0001-cpp-Fix-building-with-C-11.patch.1                    |  
 72 +++++
 external/gpgmepp/ExternalPackage_gpgmepp.mk                                 |  
  4 
 external/gpgmepp/ExternalProject_gpgmepp.mk                                 |  
 17 -
 external/gpgmepp/Library_gpgmepp.mk                                         |  
  3 
 external/gpgmepp/UnpackedTarball_gpgmepp.mk                                 |  
  5 
 external/gpgmepp/Wincompatible-function-pointer-types.patch                 |  
 31 ++
 external/gpgmepp/asan.patch                                                 |  
  2 
 external/gpgmepp/configure.patch                                            |  
  4 
 external/gpgmepp/find-libgpg-error-libassuan.patch                          |  
  6 
 external/gpgmepp/fix-autoconf-macros.patch                                  |  
  8 
 external/gpgmepp/gcc9.patch                                                 |  
  2 
 external/gpgmepp/gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1 |  
 32 --
 external/gpgmepp/macos-include.patch                                        |  
 10 
 external/gpgmepp/rpath.patch                                                |  
  2 
 external/gpgmepp/ubsan.patch                                                |  
  8 
 external/gpgmepp/w32-build-fixes.patch.1                                    |  
 16 -
 external/gpgmepp/w32-disable-docs.patch.1                                   |  
  2 
 external/gpgmepp/w32-fix-libtool.patch.1                                    |  
  2 
 external/gpgmepp/w32-fix-win32-macro.patch.1                                |  
 20 -
 external/gpgmepp/w32-include.patch                                          |  
 42 +++
 external/nss/UnpackedTarball_nss.mk                                         |  
  2 
 external/nss/asan.patch.1                                                   |  
  2 
 external/nss/clang-cl.patch.0                                               |  
 12 
 external/nss/macos-dlopen.patch.0                                           |  
  2 
 external/nss/nss-android.patch.1                                            |  
  6 
 external/nss/nss-ios.patch                                                  |  
 36 +-
 external/nss/nss-restore-manual-pre-dependencies.patch.1                    |  
  2 
 external/nss/nss-win32-make.patch.1                                         |  
  4 
 external/nss/nss.aix.patch                                                  |  
 10 
 external/nss/nss.bzmozilla1238154.patch                                     |  
  2 
 external/nss/nss.cygwin64.in32bit.patch                                     |  
  2 
 external/nss/nss.nowerror.patch                                             |  
  2 
 external/nss/nss.utf8bom.patch.1                                            |  
  4 
 external/nss/nss.vs2015.patch                                               |  
  2 
 external/nss/nss.vs2015.pdb.patch                                           |  
  2 
 external/nss/nss.windows.patch                                              |  
  6 
 external/nss/nss_macosx.patch                                               |  
 12 
 external/nss/ubsan.patch.0                                                  |  
  2 
 external/poppler/disable-freetype.patch.1                                   |  
  4 
 external/poppler/sanitizer.patch                                            |  
  4 
 odk/docs/install.html                                                       |  
  2 
 odk/docs/tools.html                                                         |  
  2 
 odk/examples/DevelopersGuide/examples.html                                  |  
  2 
 odk/examples/examples.html                                                  |  
  2 
 odk/index.html                                                              |  
  2 
 odk/index_online.html                                                       |  
  2 
 readlicense_oo/license/license.xml                                          |  
  2 
 setup_native/source/packinfo/packinfo_brand.txt                             |  
 16 -
 setup_native/source/packinfo/packinfo_extensions.txt                        |  
  8 
 setup_native/source/packinfo/packinfo_librelogo_disabled.txt                |  
  2 
 setup_native/source/packinfo/packinfo_office.txt                            |  
124 +++++-----
 setup_native/source/packinfo/packinfo_office_help.txt                       |  
  2 
 setup_native/source/packinfo/packinfo_office_lang.txt                       |  
 20 -
 setup_native/source/packinfo/packinfo_sdkoo.txt                             |  
  2 
 setup_native/source/packinfo/packinfo_ure.txt                               |  
  4 
 sfx2/uiconfig/ui/licensedialog.ui                                           |  
  2 
 74 files changed, 490 insertions(+), 324 deletions(-)

New commits:
commit 5d5aacf95c7336be2975bd2e55be83841aee572c
Author:     Andras Timar <[email protected]>
AuthorDate: Sun Jan 29 15:56:52 2023 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:56:52 2023 +0100

    Bump version to 7.3.7.2.M2
    
    Change-Id: I8650c701ce103cbbf179a3245d257bbaa7905dc7

diff --git a/configure.ac b/configure.ac
index c2a71b250013..93758ed6b508 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9,7 +9,7 @@ dnl in order to create a configure script.
 # several non-alphanumeric characters, those are split off and used only for 
the
 # ABOUTBOXPRODUCTVERSIONSUFFIX in openoffice.lst. Why that is necessary, no 
idea.
 
-AC_INIT([LibreOffice],[7.3.7.2.M1],[],[],[http://documentfoundation.org/])
+AC_INIT([LibreOffice],[7.3.7.2.M2],[],[],[http://documentfoundation.org/])
 
 dnl libnumbertext needs autoconf 2.68, but that can pick up autoconf268 just 
fine if it is installed
 dnl whereas aclocal (as run by autogen.sh) insists on using autoconf and fails 
hard
commit 1ed1d7dd00af5c7210df395820baa590416ed25b
Author:     Taichi Haradaguchi <[email protected]>
AuthorDate: Fri Dec 30 21:29:58 2022 +0900
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:56:33 2023 +0100

    curl: upgrade to release 7.87.0
    
    Fixes CVE-2022-43551 and CVE-2022-43552.
    
    https://curl.se/docs/CVE-2022-43551.html
    https://curl.se/docs/CVE-2022-43552.html
    
    Change-Id: I979ed11c212aef226ad9f26420462e5f9dbe15e5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/145116
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/download.lst b/download.lst
index 959113797754..06c67ec28196 100644
--- a/download.lst
+++ b/download.lst
@@ -37,8 +37,8 @@ export CPPUNIT_SHA256SUM := 
89c5c6665337f56fd2db36bc3805a5619709d51fb136e5193707
 export CPPUNIT_TARBALL := cppunit-1.15.1.tar.gz
 export CT2N_SHA256SUM := 
71b238efd2734be9800af07566daea8d6685aeed28db5eb5fa0e6453f4d85de3
 export CT2N_TARBALL := 
1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt
-export CURL_SHA256SUM := 
2d61116e5f485581f6d59865377df4463f2e788677ac43222b496d4e49fb627b
-export CURL_TARBALL := curl-7.86.0.tar.xz
+export CURL_SHA256SUM := 
ee5f1a1955b0ed413435ef79db28b834ea5f0fb7c8cfb1ce47175cc3bee08fff
+export CURL_TARBALL := curl-7.87.0.tar.xz
 export EBOOK_SHA256SUM := 
7e8d8ff34f27831aca3bc6f9cc532c2f90d2057c778963b884ff3d1e34dfe1f9
 export EBOOK_TARBALL := libe-book-0.1.3.tar.xz
 export EPOXY_SHA256SUM := 
a7ced37f4102b745ac86d6a70a9da399cc139ff168ba6b8002b4d8d43c900c15
diff --git a/external/curl/UnpackedTarball_curl.mk 
b/external/curl/UnpackedTarball_curl.mk
index 004ae5c69850..e78adabb8d07 100644
--- a/external/curl/UnpackedTarball_curl.mk
+++ b/external/curl/UnpackedTarball_curl.mk
@@ -39,4 +39,10 @@ $(eval $(call gb_UnpackedTarball_add_patches,curl, \
 ))
 endif
 
+ifneq ($(filter -fsanitize=%,$(CC)),)
+$(eval $(call gb_UnpackedTarball_add_patches,curl, \
+    external/curl/asan-poison-nsspem.patch.0 \
+))
+endif
+
 # vim: set noet sw=4 ts=4:
diff --git a/external/curl/asan-poison-nsspem.patch.0 
b/external/curl/asan-poison-nsspem.patch.0
new file mode 100644
index 000000000000..1f490bd6bf86
--- /dev/null
+++ b/external/curl/asan-poison-nsspem.patch.0
@@ -0,0 +1,11 @@
+--- lib/vtls/nss.c
++++ lib/vtls/nss.c
+@@ -1945,7 +1945,7 @@
+ 
+   PK11_SetPasswordFunc(nss_get_password);
+ 
+-  result = nss_load_module(&pem_module, pem_library, "PEM");
++  result = CURLE_FAILED_INIT;
+   PR_Unlock(nss_initlock);
+   if(result == CURLE_FAILED_INIT)
+     infof(data, "WARNING: failed to load NSS PEM library %s. Using "
diff --git a/external/curl/curl-msvc-disable-protocols.patch.1 
b/external/curl/curl-msvc-disable-protocols.patch.1
index 89c4ff576f85..71ff0c01a028 100644
--- a/external/curl/curl-msvc-disable-protocols.patch.1
+++ b/external/curl/curl-msvc-disable-protocols.patch.1
@@ -2,7 +2,7 @@ disable protocols nobody needs in MSVC build
 
 --- curl/lib/config-win32.h.orig       2017-08-09 16:43:29.464000000 +0200
 +++ curl/lib/config-win32.h    2017-08-09 16:47:38.549200000 +0200
-@@ -616,4 +616,20 @@
+@@ -654,4 +654,20 @@
  #  define ENABLE_IPV6 1
  #endif
  
diff --git a/external/curl/curl-nss.patch.1 b/external/curl/curl-nss.patch.1
index 5ef25748d7eb..2128849369e7 100644
--- a/external/curl/curl-nss.patch.1
+++ b/external/curl/curl-nss.patch.1
@@ -1,7 +1,7 @@
 diff -ur curl.org/configure curl/configure
 --- curl.org/configure 2016-03-13 15:14:07.177000076 +0100
 +++ curl/configure     2016-03-13 15:16:44.132000076 +0100
-@@ -27985,7 +27985,12 @@
+@@ -28230,7 +28230,12 @@
        { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: Using hard-wired 
libraries and compilation flags for NSS." >&5
  printf "%s\n" "$as_me: WARNING: Using hard-wired libraries and compilation 
flags for NSS." >&2;}
        addld="-L$OPT_NSS/lib"
diff --git a/external/curl/zlib.patch.0 b/external/curl/zlib.patch.0
index b8e242a3aaea..b4442ba262d1 100644
--- a/external/curl/zlib.patch.0
+++ b/external/curl/zlib.patch.0
@@ -1,6 +1,6 @@
 --- configure
 +++ configure
-@@ -22808,7 +22808,6 @@
+@@ -23035,7 +23035,6 @@
  clean_CPPFLAGS=$CPPFLAGS
  clean_LDFLAGS=$LDFLAGS
  clean_LIBS=$LIBS
@@ -8,7 +8,7 @@
  
  # Check whether --with-zlib was given.
  if test ${with_zlib+y}
-@@ -22818,6 +22818,7 @@
+@@ -23045,6 +23044,7 @@
  
  
  if test "$OPT_ZLIB" = "no" ; then
@@ -16,7 +16,7 @@
      { printf "%s\n" "$as_me:${as_lineno-$LINENO}: WARNING: zlib disabled" >&5
  printf "%s\n" "$as_me: WARNING: zlib disabled" >&2;}
  else
-@@ -22825,6 +825,21 @@
+@@ -23052,6 +23052,21 @@
      OPT_ZLIB=""
    fi
  
@@ -38,7 +38,7 @@
    if test -z "$OPT_ZLIB" ; then
  
      if test -n "$PKG_CONFIG"; then
-@@ -23120,6 +23120,7 @@
+@@ -23344,6 +23359,7 @@
  printf "%s\n" "$as_me: found both libz and libz.h header" >&6;}
      curl_zlib_msg="enabled"
    fi
@@ -48,7 +48,7 @@
   if test x"$AMFIXLIB" = x1; then
 --- configure.ac
 +++ configure.ac
-@@ -1222,19 +1222,30 @@
+@@ -1243,19 +1243,30 @@
  clean_CPPFLAGS=$CPPFLAGS
  clean_LDFLAGS=$LDFLAGS
  clean_LIBS=$LIBS
@@ -80,7 +80,7 @@
    if test -z "$OPT_ZLIB" ; then
      CURL_CHECK_PKGCONFIG(zlib)
  
-@@ -1316,6 +1316,7 @@
+@@ -1336,6 +1347,7 @@
      AC_MSG_NOTICE([found both libz and libz.h header])
      curl_zlib_msg="enabled"
    fi
commit 9dc962e8464e9ccc7650ebb5b6fd1107db09105d
Author:     Taichi Haradaguchi <[email protected]>
AuthorDate: Mon Nov 21 23:39:38 2022 +0900
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:48:05 2023 +0100

    gpgme: upgrade to release 1.18.0
    
    Remove gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1 as it has 
applied in 1.18.0.
    
    * 0001-cpp-Fix-building-with-C-11.patch.1: fixed error "no matching 
function for call to object of type "(lambda at importresult.cpp:154:71)"".
    * w32-include.patch: add missing #include <string> (for std::string).
    * macos-include.patch: add missing #include <algorithm> (for std::any_of).
    
    Change-Id: I45f2ef415d80e6ee848699803e971f154812c9c6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143039
    Tested-by: Jenkins
    Tested-by: Caolán McNamara <[email protected]>
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit 1c5c31b006f8515bfea440bbcf286f8b4b840aac)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144270

diff --git a/download.lst b/download.lst
index 2a61ea52ce0d..959113797754 100644
--- a/download.lst
+++ b/download.lst
@@ -100,8 +100,8 @@ export FREETYPE_SHA256SUM := 
ef5c336aacc1a079ff9262d6308d6c2a066dd4d2a905301c4ad
 export FREETYPE_TARBALL := freetype-2.12.0.tar.xz
 export GLM_SHA256SUM := 
6bba5f032bed47c73ad9397f2313b9acbfb56253d0d0576b5873d3dcb25e99ad
 export GLM_TARBALL := glm-0.9.9.8.zip
-export GPGME_SHA256SUM := 
6c8cc4aedb10d5d4c905894ba1d850544619ee765606ac43df7405865de29ed0
-export GPGME_TARBALL := gpgme-1.16.0.tar.bz2
+export GPGME_SHA256SUM := 
361d4eae47ce925dba0ea569af40e7b52c645c4ae2e65e5621bf1b6cdd8b0e9e
+export GPGME_TARBALL := gpgme-1.18.0.tar.bz2
 export GRAPHITE_SHA256SUM := 
b8e892d8627c41888ff121e921455b9e2d26836978f2359173d19825da62b8fc
 export GRAPHITE_TARBALL := graphite2-minimal-1.3.14.tgz
 export HARFBUZZ_SHA256SUM := 
d58461395ce28b9dc03903254374dd70c38c8c28c5046db123c08f7ab9417be7
diff --git a/external/gpgmepp/0001-cpp-Fix-building-with-C-11.patch.1 
b/external/gpgmepp/0001-cpp-Fix-building-with-C-11.patch.1
new file mode 100755
index 000000000000..c7b288d7240a
--- /dev/null
+++ b/external/gpgmepp/0001-cpp-Fix-building-with-C-11.patch.1
@@ -0,0 +1,72 @@
+From f02c20cc9c5756690b07abfd02a43533547ba2ef Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingo=20Kl=C3=B6cker?= <[email protected]>
+Date: Fri, 19 Aug 2022 11:05:37 +0200
+Subject: [PATCH] cpp: Fix building with C++11
+
+* lang/cpp/src/importresult.cpp (ImportResult::mergeWith): Replace
+'auto' in lambdas with the actual type.
+--
+
+Generic lambdas require C++14.
+
+GnuPG-bug-id: 6141
+---
+ lang/cpp/src/importresult.cpp | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/lang/cpp/src/importresult.cpp b/lang/cpp/src/importresult.cpp
+index 06258729..0a7ad03d 100644
+--- a/lang/cpp/src/importresult.cpp
++++ b/lang/cpp/src/importresult.cpp
+@@ -152,17 +152,17 @@ void GpgME::ImportResult::mergeWith(const ImportResult 
&other)
+         }
+         // was this key also considered during the first import
+         const auto consideredInFirstImports =
+-            std::any_of(std::begin(d->imports), std::end(d->imports), 
[fpr](const auto i) {
++            std::any_of(std::begin(d->imports), std::end(d->imports), 
[fpr](const gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr);
+             });
+         // did we see this key already in the list of keys of the other import
+         const auto consideredInPreviousOtherImports =
+-            std::any_of(std::begin(other.d->imports), it, [fpr](const auto i) 
{
++            std::any_of(std::begin(other.d->imports), it, [fpr](const 
gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr);
+             });
+         // was anything added to this key during the other import
+         const auto changedInOtherImports =
+-            std::any_of(std::begin(other.d->imports), 
std::end(other.d->imports), [fpr](const auto i) {
++            std::any_of(std::begin(other.d->imports), 
std::end(other.d->imports), [fpr](const gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr) && (i->status != 0);
+             });
+         if (consideredInFirstImports && !consideredInPreviousOtherImports) {
+@@ -177,15 +177,15 @@ void GpgME::ImportResult::mergeWith(const ImportResult 
&other)
+ 
+         // now do the same for the secret key counts
+         const auto secretKeyConsideredInFirstImports =
+-            std::any_of(std::begin(d->imports), std::end(d->imports), 
[fpr](const auto i) {
++            std::any_of(std::begin(d->imports), std::end(d->imports), 
[fpr](const gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr) && (i->status & 
GPGME_IMPORT_SECRET);
+             });
+         const auto secretKeyConsideredInPreviousOtherImports =
+-            std::any_of(std::begin(other.d->imports), it, [fpr](const auto i) 
{
++            std::any_of(std::begin(other.d->imports), it, [fpr](const 
gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr) && (i->status & 
GPGME_IMPORT_SECRET);
+             });
+         const auto secretKeyChangedInOtherImports =
+-            std::any_of(std::begin(other.d->imports), 
std::end(other.d->imports), [fpr](const auto i) {
++            std::any_of(std::begin(other.d->imports), 
std::end(other.d->imports), [fpr](const gpgme_import_status_t i) {
+                 return i->fpr && !strcmp(i->fpr, fpr) && (i->status & 
GPGME_IMPORT_SECRET) && (i->status != GPGME_IMPORT_SECRET);
+             });
+         if (secretKeyConsideredInFirstImports && 
!secretKeyConsideredInPreviousOtherImports) {
+@@ -204,7 +204,7 @@ void GpgME::ImportResult::mergeWith(const ImportResult 
&other)
+     d->imports.reserve(d->imports.size() + other.d->imports.size());
+     std::transform(std::begin(other.d->imports), std::end(other.d->imports),
+                    std::back_inserter(d->imports),
+-                   [](const auto import) {
++                   [](const gpgme_import_status_t import) {
+                        gpgme_import_status_t copy = new 
_gpgme_import_status{*import};
+                        if (import->fpr) {
+                            copy->fpr = strdup(import->fpr);
+-- 
+2.34.1
+
diff --git a/external/gpgmepp/ExternalPackage_gpgmepp.mk 
b/external/gpgmepp/ExternalPackage_gpgmepp.mk
index a2b207597cdd..2b853087216b 100644
--- a/external/gpgmepp/ExternalPackage_gpgmepp.mk
+++ b/external/gpgmepp/ExternalPackage_gpgmepp.mk
@@ -15,8 +15,8 @@ ifneq ($(DISABLE_DYNLOADING),TRUE)
 
 ifeq ($(OS),LINUX)
 
-$(eval $(call 
gb_ExternalPackage_add_file,gpgmepp,$(LIBO_LIB_FOLDER)/libgpgmepp.so.6,lang/cpp/src/.libs/libgpgmepp.so.6.13.0))
-$(eval $(call 
gb_ExternalPackage_add_file,gpgmepp,$(LIBO_LIB_FOLDER)/libgpgme.so.11,src/.libs/libgpgme.so.11.25.0))
+$(eval $(call 
gb_ExternalPackage_add_file,gpgmepp,$(LIBO_LIB_FOLDER)/libgpgmepp.so.6,lang/cpp/src/.libs/libgpgmepp.so.6.15.0))
+$(eval $(call 
gb_ExternalPackage_add_file,gpgmepp,$(LIBO_LIB_FOLDER)/libgpgme.so.11,src/.libs/libgpgme.so.11.27.0))
 
 else ifeq ($(OS),MACOSX)
 
diff --git a/external/gpgmepp/ExternalProject_gpgmepp.mk 
b/external/gpgmepp/ExternalProject_gpgmepp.mk
index a3166e94175e..a58717fe3adb 100644
--- a/external/gpgmepp/ExternalProject_gpgmepp.mk
+++ b/external/gpgmepp/ExternalProject_gpgmepp.mk
@@ -27,6 +27,7 @@ $(call gb_ExternalProject_get_state_target,gpgmepp,build): 
$(call gb_Executable_
                $(gb_WIN_GPG_cross_setup_exports) \
                && autoreconf \
                && $(gb_RUN_CONFIGURE) ./configure \
+                  $(gb_CONFIGURE_PLATFORMS) \
                   --disable-shared \
                   --disable-languages \
                   --disable-gpgconf-test \
@@ -35,9 +36,7 @@ $(call gb_ExternalProject_get_state_target,gpgmepp,build): 
$(call gb_Executable_
                   --disable-g13-test \
            $(if $(verbose),--disable-silent-rules,--enable-silent-rules) \
                   CFLAGS='$(CFLAGS) \
-                               $(if $(ENABLE_OPTIMIZED), \
-                                       
$(gb_COMPILEROPTFLAGS),$(gb_COMPILERNOOPTFLAGS)) \
-                               $(if $(call 
gb_Module__symbols_enabled,gpgmepp),$(gb_DEBUGINFO_FLAGS))' \
+                               $(call 
gb_ExternalProject_get_build_flags,gpgmepp)' \
                   $(gb_WIN_GPG_platform_switches) \
                   MAKE=$(MAKE) \
            && $(MAKE) \
@@ -59,18 +58,14 @@ $(call gb_ExternalProject_get_state_target,gpgmepp,build):
                   LIBASSUAN_CFLAGS="$(LIBASSUAN_CFLAGS)" \
                   LIBASSUAN_LIBS="$(LIBASSUAN_LIBS)" \
                   CFLAGS='$(CFLAGS) \
-                               $(if $(ENABLE_OPTIMIZED), \
-                                       
$(gb_COMPILEROPTFLAGS),$(gb_COMPILERNOOPTFLAGS)) \
-                               $(if $(call 
gb_Module__symbols_enabled,gpgmepp),$(gb_DEBUGINFO_FLAGS))' \
+                               $(call 
gb_ExternalProject_get_build_flags,gpgmepp)' \
                   CXXFLAGS='$(CXXFLAGS) \
-                               $(if $(ENABLE_OPTIMIZED), \
-                                       
$(gb_COMPILEROPTFLAGS),$(gb_COMPILERNOOPTFLAGS)) \
-                               $(gb_COMPILERDEFS_STDLIB_DEBUG) \
-                               $(if $(call 
gb_Module__symbols_enabled,gpgmepp),$(gb_DEBUGINFO_FLAGS))' \
+                               $(call 
gb_ExternalProject_get_build_flags,gpgmepp) \
+                               $(gb_COMPILERDEFS_STDLIB_DEBUG)' \
                   $(if $(filter LINUX,$(OS)), \
                                'LDFLAGS=-Wl$(COMMA)-z$(COMMA)origin \
                                        -Wl$(COMMA)-rpath$(COMMA)\$$$$ORIGIN') \
-                  $(if $(CROSS_COMPILING),--build=$(BUILD_PLATFORM) 
--host=$(HOST_PLATFORM)) \
+                  $(gb_CONFIGURE_PLATFORMS) \
                   $(if $(filter 
MACOSX,$(OS)),--prefix=/@.__________________________________________________OOO)
 \
                   $(if $(filter 
TRUE,$(DISABLE_DYNLOADING)),--disable-shared,--disable-static) \
          && $(MAKE) \
diff --git a/external/gpgmepp/Library_gpgmepp.mk 
b/external/gpgmepp/Library_gpgmepp.mk
index f60301a4eb0d..ac71cf8b90ec 100644
--- a/external/gpgmepp/Library_gpgmepp.mk
+++ b/external/gpgmepp/Library_gpgmepp.mk
@@ -58,9 +58,11 @@ $(eval $(call 
gb_Library_add_generated_exception_objects,gpgmepp,\
        UnpackedTarball/gpgmepp/lang/cpp/src/engineinfo \
        UnpackedTarball/gpgmepp/lang/cpp/src/eventloopinteractor \
        UnpackedTarball/gpgmepp/lang/cpp/src/exception \
+       UnpackedTarball/gpgmepp/lang/cpp/src/gpgaddexistingsubkeyeditinteractor 
\
        UnpackedTarball/gpgmepp/lang/cpp/src/gpgadduserideditinteractor \
        UnpackedTarball/gpgmepp/lang/cpp/src/gpgagentgetinfoassuantransaction \
        UnpackedTarball/gpgmepp/lang/cpp/src/gpggencardkeyinteractor \
+       UnpackedTarball/gpgmepp/lang/cpp/src/gpgrevokekeyeditinteractor \
        UnpackedTarball/gpgmepp/lang/cpp/src/gpgsetexpirytimeeditinteractor \
        UnpackedTarball/gpgmepp/lang/cpp/src/gpgsetownertrusteditinteractor \
        UnpackedTarball/gpgmepp/lang/cpp/src/gpgsignkeyeditinteractor \
@@ -73,6 +75,7 @@ $(eval $(call 
gb_Library_add_generated_exception_objects,gpgmepp,\
        UnpackedTarball/gpgmepp/lang/cpp/src/swdbresult \
        UnpackedTarball/gpgmepp/lang/cpp/src/tofuinfo \
        UnpackedTarball/gpgmepp/lang/cpp/src/trustitem \
+       UnpackedTarball/gpgmepp/lang/cpp/src/util \
        UnpackedTarball/gpgmepp/lang/cpp/src/verificationresult \
        UnpackedTarball/gpgmepp/lang/cpp/src/vfsmountresult \
 ))
diff --git a/external/gpgmepp/UnpackedTarball_gpgmepp.mk 
b/external/gpgmepp/UnpackedTarball_gpgmepp.mk
index 05bfc9f07bf1..be2b616d1268 100644
--- a/external/gpgmepp/UnpackedTarball_gpgmepp.mk
+++ b/external/gpgmepp/UnpackedTarball_gpgmepp.mk
@@ -32,6 +32,9 @@ $(eval $(call gb_UnpackedTarball_add_patches,gpgmepp, \
     external/gpgmepp/c++20.patch \
     external/gpgmepp/clang-cl.patch \
     external/gpgmepp/configure.patch \
-    
external/gpgmepp/gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1 \
+    external/gpgmepp/w32-include.patch \
+    external/gpgmepp/Wincompatible-function-pointer-types.patch \
+    external/gpgmepp/0001-cpp-Fix-building-with-C-11.patch.1 \
+    external/gpgmepp/macos-include.patch \
 ))
 # vim: set noet sw=4 ts=4:
diff --git a/external/gpgmepp/Wincompatible-function-pointer-types.patch 
b/external/gpgmepp/Wincompatible-function-pointer-types.patch
new file mode 100755
index 000000000000..050d2e55cfc7
--- /dev/null
+++ b/external/gpgmepp/Wincompatible-function-pointer-types.patch
@@ -0,0 +1,31 @@
+--- src/assuan-support.c
++++ src/assuan-support.c
+@@ -126,7 +126,7 @@
+ }
+ 
+ 
+-static gpgme_ssize_t
++static ssize_t
+ my_read (assuan_context_t ctx, assuan_fd_t fd, void *buffer, size_t size)
+ {
+   (void)ctx;
+@@ -134,7 +134,7 @@
+ }
+ 
+ 
+-static gpgme_ssize_t
++static ssize_t
+ my_write (assuan_context_t ctx, assuan_fd_t fd, const void *buffer, size_t 
size)
+ {
+   (void)ctx;
+--- src/gpgme-w32spawn.c
++++ src/gpgme-w32spawn.c
+@@ -243,7 +243,7 @@
+           handle = LoadLibrary ("user32.dll");
+           if (handle)
+             {
+-              func = GetProcAddress (handle, "AllowSetForegroundWindow");
++              func = (BOOL (WINAPI *)(DWORD)) GetProcAddress (handle, 
"AllowSetForegroundWindow");
+               if (!func)
+                 FreeLibrary (handle);
+             }
diff --git a/external/gpgmepp/asan.patch b/external/gpgmepp/asan.patch
index 16d97f6ff307..e0b1c85fe51b 100644
--- a/external/gpgmepp/asan.patch
+++ b/external/gpgmepp/asan.patch
@@ -1,6 +1,6 @@
 --- src/posix-io.c
 +++ src/posix-io.c
-@@ -468,6 +468,9 @@
+@@ -563,6 +563,9 @@
  
          if (atfork)
            atfork (atforkvalue, 0);
diff --git a/external/gpgmepp/configure.patch b/external/gpgmepp/configure.patch
index 4b51db6bebad..ad3f97e632fb 100644
--- a/external/gpgmepp/configure.patch
+++ b/external/gpgmepp/configure.patch
@@ -1,6 +1,6 @@
 --- configure.ac
 +++ configure.ac
-@@ -619,6 +619,15 @@
+@@ -617,6 +617,15 @@
  AC_SUBST(API__SSIZE_T)
  AM_SUBST_NOTMAKE(API__SSIZE_T)
  
@@ -16,7 +16,7 @@
  # Checks for compiler features.
  if test "$GCC" = yes; then
      CFLAGS="$CFLAGS -Wall -Wcast-align -Wshadow -Wstrict-prototypes"
-@@ -679,15 +679,6 @@
+@@ -677,15 +686,6 @@
  
  AC_FUNC_FSEEKO
  
diff --git a/external/gpgmepp/find-libgpg-error-libassuan.patch 
b/external/gpgmepp/find-libgpg-error-libassuan.patch
index a65e453fc8b6..a98a7d845a34 100644
--- a/external/gpgmepp/find-libgpg-error-libassuan.patch
+++ b/external/gpgmepp/find-libgpg-error-libassuan.patch
@@ -2,7 +2,7 @@ diff --git a/configure.ac b/configure.ac
 index f28480b..92a3e85 100644
 --- configure.ac
 +++ configure.ac
-@@ -674,15 +674,34 @@ AC_CHECK_FUNCS(setlocale)
+@@ -719,8 +719,18 @@
  
  # Checking for libgpg-error.
  have_gpg_error=no
@@ -23,6 +23,8 @@ index f28480b..92a3e85 100644
  AC_DEFINE(GPG_ERR_SOURCE_DEFAULT, GPG_ERR_SOURCE_GPGME,
            [The default error source for GPGME.])
  
+@@ -729,8 +739,17 @@
+ 
  # And for libassuan.
  have_libassuan=no
 -AM_PATH_LIBASSUAN("$NEED_LIBASSUAN_API:$NEED_LIBASSUAN_VERSION",
@@ -53,7 +55,7 @@ index f28480b..92a3e85 100644
  AM_CPPFLAGS = -I$(top_srcdir)/lang/cpp/src -I$(top_builddir)/src \
 --- lang/cpp/tests/Makefile.in 2020-06-20 00:44:49.542344510 +0200
 +++ lang/cpp/tests/Makefile.in~        2020-06-13 00:55:19.021212970 +0200
-@@ -415,7 +415,7 @@
+@@ -427,7 +427,7 @@
  top_srcdir = @top_srcdir@
  AM_LDFLAGS = -no-install
  LDADD = ../../cpp/src/libgpgmepp.la \
diff --git a/external/gpgmepp/fix-autoconf-macros.patch 
b/external/gpgmepp/fix-autoconf-macros.patch
index e333168b2b33..265703b00671 100644
--- a/external/gpgmepp/fix-autoconf-macros.patch
+++ b/external/gpgmepp/fix-autoconf-macros.patch
@@ -1,7 +1,7 @@
 diff -ur gpgme.org/configure.ac gpgme/configure.ac
 --- configure.ac       2017-02-16 15:18:45.051417378 +0100
 +++ configure.ac~      2017-02-16 15:20:03.635059285 +0100
-@@ -35,6 +35,11 @@
+@@ -38,6 +38,11 @@
  # the decimalized short revision number, a beta version string and a
  # flag indicating a development version (mym4_isbeta).  Note that the
  # m4 processing is done by autoconf and not during the configure run.
@@ -13,10 +13,10 @@ diff -ur gpgme.org/configure.ac gpgme/configure.ac
  m4_define([mym4_verslist], m4_split(m4_esyscmd([./autogen.sh --find-version] \
                             mym4_package mym4_major mym4_minor 
mym4_micro),[:]))
  m4_define([mym4_isbeta],       m4_argn(2, mym4_verslist))
-@@ -90,7 +90,22 @@
+@@ -98,7 +103,22 @@
  AC_CONFIG_MACRO_DIR([m4])
- AC_CONFIG_SRCDIR(src/gpgme.h.in)
- AC_CONFIG_HEADER(conf/config.h)
+ AC_CONFIG_SRCDIR([src/gpgme.h.in])
+ AC_CONFIG_HEADERS([conf/config.h])
 -AM_INIT_AUTOMAKE([serial-tests dist-bzip2 no-dist-gzip])
 +
 +dnl Initialize automake.  automake < 1.12 didn't have serial-tests and
diff --git a/external/gpgmepp/gcc9.patch b/external/gpgmepp/gcc9.patch
index c2a9fd444df7..709154ec102b 100644
--- a/external/gpgmepp/gcc9.patch
+++ b/external/gpgmepp/gcc9.patch
@@ -1,6 +1,6 @@
 --- lang/cpp/src/key.h
 +++ lang/cpp/src/key.h
-@@ -62,6 +62,7 @@
+@@ -68,6 +68,7 @@
      /* implicit */ Key(const Null &);
      Key(const shared_gpgme_key_t &key);
      Key(gpgme_key_t key, bool acquireRef);
diff --git 
a/external/gpgmepp/gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1 
b/external/gpgmepp/gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1
deleted file mode 100644
index 8b12c1785ccf..000000000000
--- 
a/external/gpgmepp/gpgme.git-4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e.patch.1
+++ /dev/null
@@ -1,32 +0,0 @@
-From 4b64774b6d13ffa4f59dddf947a97d61bcfa2f2e Mon Sep 17 00:00:00 2001
-From: Jiri Kucera <[email protected]>
-Date: Sun, 25 Jul 2021 11:35:54 +0200
-Subject: [PATCH] core: Support closefrom also for glibc.
-
-* src/posix-io.c (_gpgme_io_spawn): Use glibc's closefrom.
---
-
-Since 2.34, glibc introduces closefrom (the implementation
-follows *BSD standard).
-
-Signed-off-by: Werner Koch <[email protected]>
----
- src/posix-io.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/posix-io.c b/src/posix-io.c
-index e712ef28..2a3a81fc 100644
---- a/src/posix-io.c
-+++ b/src/posix-io.c
-@@ -570,7 +570,7 @@ _gpgme_io_spawn (const char *path, char *const argv[], 
unsigned int flags,
-               if (fd_list[i].fd > fd)
-                 fd = fd_list[i].fd;
-             fd++;
--#if defined(__sun) || defined(__FreeBSD__)
-+#if defined(__sun) || defined(__FreeBSD__) || defined(__GLIBC__)
-             closefrom (fd);
-             max_fds = fd;
- #else /*!__sun */
--- 
-2.11.0
-
diff --git a/external/gpgmepp/macos-include.patch 
b/external/gpgmepp/macos-include.patch
new file mode 100644
index 000000000000..93dd297c7368
--- /dev/null
+++ b/external/gpgmepp/macos-include.patch
@@ -0,0 +1,10 @@
+--- lang/cpp/src/importresult.cpp      2022-08-10 18:17:33.000000000 +0900
++++ lang/cpp/src/importresult.cpp      2022-11-29 01:37:44.786604882 +0900
+@@ -31,6 +31,7 @@
+ #include "result_p.h"
+ 
+ #include <gpgme.h>
++#include <algorithm>
+ #include <cstdlib>
+ #include <cstring>
+ 
diff --git a/external/gpgmepp/rpath.patch b/external/gpgmepp/rpath.patch
index e83dcf2762ef..6e6c46105b94 100644
--- a/external/gpgmepp/rpath.patch
+++ b/external/gpgmepp/rpath.patch
@@ -1,6 +1,6 @@
 --- configure.ac
 +++ configure.ac
-@@ -176,6 +176,9 @@
+@@ -187,6 +187,9 @@
  LT_INIT([win32-dll disable-static])
  LT_LANG([Windows Resource])
  
diff --git a/external/gpgmepp/ubsan.patch b/external/gpgmepp/ubsan.patch
index 5a6e6dcdc9b2..2262291cd8b5 100644
--- a/external/gpgmepp/ubsan.patch
+++ b/external/gpgmepp/ubsan.patch
@@ -1,8 +1,8 @@
 --- src/engine-gpg.c
 +++ src/engine-gpg.c
-@@ -60,6 +60,15 @@
+@@ -61,6 +61,15 @@
                      building command line to this location.  */
-   char arg[1];     /* Used if data above is not used.  */
+   char arg[FLEXIBLE_ARRAY_MEMBER];     /* Used if data above is not used.  */
  };
 +struct arg_without_data_s
 +{
@@ -16,8 +16,8 @@
  
  
  struct fd_data_map_s
-@@ -299,23 +308,24 @@
-   a = malloc (sizeof *a - 1);
+@@ -310,23 +319,24 @@
+   a = malloc (offsetof (struct arg_and_data_s, arg));
    if (!a)
      return gpg_error_from_syserror ();
 -  a->next = NULL;
diff --git a/external/gpgmepp/w32-build-fixes.patch.1 
b/external/gpgmepp/w32-build-fixes.patch.1
index 01ea99d91e43..d6d8af601015 100644
--- a/external/gpgmepp/w32-build-fixes.patch.1
+++ b/external/gpgmepp/w32-build-fixes.patch.1
@@ -13,7 +13,7 @@ diff -ru gpgme.orig/m4/ax_cxx_compile_stdcxx.m4 
gpgme/m4/ax_cxx_compile_stdcxx.m
 diff -ru gpgme.orig/src/dirinfo.c gpgme/src/dirinfo.c
 --- gpgme.orig/src/dirinfo.c   2017-03-21 11:09:41.000000000 +0100
 +++ gpgme/src/dirinfo.c        2017-09-30 08:36:13.239279300 +0200
-@@ -33,6 +33,10 @@
+@@ -34,6 +34,10 @@
  
  DEFINE_STATIC_LOCK (dirinfo_lock);
  
@@ -27,7 +27,7 @@ diff -ru gpgme.orig/src/dirinfo.c gpgme/src/dirinfo.c
 diff -ru gpgme.orig/src/mbox-util.c gpgme/src/mbox-util.c
 --- gpgme.orig/src/mbox-util.c 2016-11-16 13:22:41.000000000 +0100
 +++ gpgme/src/mbox-util.c      2017-09-30 08:18:29.270567500 +0200
-@@ -28,7 +28,9 @@
+@@ -29,7 +29,9 @@
  #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
@@ -40,7 +40,7 @@ diff -ru gpgme.orig/src/mbox-util.c gpgme/src/mbox-util.c
 diff -ru gpgme.orig/src/priv-io.h gpgme/src/priv-io.h
 --- gpgme.orig/src/priv-io.h   2016-11-16 13:23:14.000000000 +0100
 +++ gpgme/src/priv-io.h        2017-09-30 08:20:38.770562400 +0200
-@@ -36,6 +36,9 @@
+@@ -33,6 +33,9 @@
  #ifdef HAVE_SYS_TYPES_H
  # include <sys/types.h>
  #endif
@@ -53,7 +53,7 @@ diff -ru gpgme.orig/src/priv-io.h gpgme/src/priv-io.h
 diff -ru gpgme.orig/src/util.h gpgme/src/util.h
 --- gpgme.orig/src/util.h      2017-03-28 11:41:30.000000000 +0200
 +++ gpgme/src/util.h   2017-09-30 08:10:54.194049100 +0200
-@@ -39,6 +39,9 @@
+@@ -35,6 +35,9 @@
  #ifdef HAVE_UNISTD_H
  # include <unistd.h>
  #endif
@@ -66,7 +66,7 @@ diff -ru gpgme.orig/src/util.h gpgme/src/util.h
 diff -ru gpgme.orig/src/w32-util.c gpgme/src/w32-util.c
 --- gpgme.orig/src/w32-util.c  2017-03-09 09:01:10.000000000 +0100
 +++ gpgme/src/w32-util.c       2017-09-30 08:32:02.114330500 +0200
-@@ -721,7 +721,8 @@
+@@ -772,7 +772,8 @@
        v /= 62;
        XXXXXX[5] = letters[v % 62];
  
@@ -79,7 +79,7 @@ diff -ru gpgme.orig/src/w32-util.c gpgme/src/w32-util.c
 diff -ru gpgme.orig/src/Makefile.am gpgme/src/Makefile.am
 --- gpgme.orig/src/Makefile.am 2017-09-30 11:50:07.456960000 +0200
 +++ gpgme/src/Makefile.am      2017-09-30 11:51:29.609649400 +0200
-@@ -26,7 +26,7 @@
+@@ -35,7 +35,7 @@
  m4data_DATA = gpgme.m4
  nodist_include_HEADERS = gpgme.h
  
@@ -88,7 +88,7 @@ diff -ru gpgme.orig/src/Makefile.am gpgme/src/Makefile.am
  
  if BUILD_W32_GLIB
  ltlib_gpgme_glib = libgpgme-glib.la
-@@ -99,11 +99,11 @@
+@@ -107,11 +107,11 @@
  # versions, because then every object file is only compiled once.
  AM_CFLAGS = @LIBASSUAN_CFLAGS@ @GPG_ERROR_CFLAGS@ @GLIB_CFLAGS@
  
@@ -104,7 +104,7 @@ diff -ru gpgme.orig/src/Makefile.am gpgme/src/Makefile.am
  
  
  if HAVE_W32_SYSTEM
-@@ -120,7 +120,7 @@
+@@ -126,7 +126,7 @@
  SUFFIXES = .rc .lo
  
  .rc.lo:
diff --git a/external/gpgmepp/w32-disable-docs.patch.1 
b/external/gpgmepp/w32-disable-docs.patch.1
index 2c307f502b63..1803ffa03cb5 100644
--- a/external/gpgmepp/w32-disable-docs.patch.1
+++ b/external/gpgmepp/w32-disable-docs.patch.1
@@ -4,7 +4,7 @@ like libgpg-error's --disable-doc
 diff -ur gpgmepp.org/Makefile.am gpgmepp/Makefile.am
 --- gpgmepp.org/Makefile.am    2016-11-16 13:20:18.000000000 +0100
 +++ gpgmepp/Makefile.am        2017-11-20 15:34:49.086731000 +0100
-@@ -33,7 +33,7 @@
+@@ -45,7 +45,7 @@
  tests =
  endif
  
diff --git a/external/gpgmepp/w32-fix-libtool.patch.1 
b/external/gpgmepp/w32-fix-libtool.patch.1
index 9a7adf713694..40893908b7f6 100644
--- a/external/gpgmepp/w32-fix-libtool.patch.1
+++ b/external/gpgmepp/w32-fix-libtool.patch.1
@@ -9,7 +9,7 @@ linking, by accepting cygwin path names, and correctly expanding
 diff -ur gpgmepp.org/m4/libtool.m4 gpgmepp/m4/libtool.m4
 --- gpgmepp.org/m4/libtool.m4  2016-11-16 13:20:16.000000000 +0100
 +++ gpgmepp/m4/libtool.m4      2017-11-21 22:00:05.006587800 +0100
-@@ -3209,24 +3209,11 @@
+@@ -3230,24 +3230,11 @@
    ;;
  
  cygwin*)
diff --git a/external/gpgmepp/w32-fix-win32-macro.patch.1 
b/external/gpgmepp/w32-fix-win32-macro.patch.1
index 66e9ac48099a..8ab7b0fab089 100644
--- a/external/gpgmepp/w32-fix-win32-macro.patch.1
+++ b/external/gpgmepp/w32-fix-win32-macro.patch.1
@@ -1,7 +1,7 @@
 diff -ur gpgmepp.org/lang/cpp/src/callbacks.cpp 
gpgmepp/lang/cpp/src/callbacks.cpp
 --- gpgmepp.org/lang/cpp/src/callbacks.cpp     2016-10-18 19:22:02.000000000 
+0200
 +++ gpgmepp/lang/cpp/src/callbacks.cpp 2017-11-20 18:03:04.290060900 +0100
-@@ -38,7 +38,9 @@
+@@ -40,7 +40,9 @@
  #include <cassert>
  #include <cerrno>
  #include <cstring>
@@ -29,7 +29,7 @@ diff -ur gpgmepp.org/lang/cpp/src/data.h 
gpgmepp/lang/cpp/src/data.h
 diff -ur gpgmepp.org/lang/cpp/src/editinteractor.cpp 
gpgmepp/lang/cpp/src/editinteractor.cpp
 --- gpgmepp.org/lang/cpp/src/editinteractor.cpp        2017-03-09 
09:01:10.000000000 +0100
 +++ gpgmepp/lang/cpp/src/editinteractor.cpp    2017-11-20 18:09:33.022674700 
+0100
-@@ -30,9 +30,11 @@
+@@ -33,9 +33,11 @@
  
  #include <gpgme.h>
  
@@ -46,7 +46,7 @@ diff -ur gpgmepp.org/lang/cpp/src/editinteractor.cpp 
gpgmepp/lang/cpp/src/editin
 diff -ur gpgmepp.org/lang/cpp/src/gpgmepp_export.h 
gpgmepp/lang/cpp/src/gpgmepp_export.h
 --- gpgmepp.org/lang/cpp/src/gpgmepp_export.h  2016-08-04 15:03:09.000000000 
+0200
 +++ gpgmepp/lang/cpp/src/gpgmepp_export.h      2017-11-20 16:57:47.805691100 
+0100
-@@ -29,14 +29,14 @@
+@@ -30,14 +30,14 @@
  #  ifndef GPGMEPP_EXPORT
  #    ifdef BUILDING_GPGMEPP
          /* We are building this library */
@@ -63,7 +63,7 @@ diff -ur gpgmepp.org/lang/cpp/src/gpgmepp_export.h 
gpgmepp/lang/cpp/src/gpgmepp_
  #       define GPGMEPP_EXPORT __declspec(dllimport)
  #      else
  #       define GPGMEPP_EXPORT __attribute__((visibility("default")))
-@@ -45,7 +45,7 @@
+@@ -46,7 +46,7 @@
  #  endif
  
  #  ifndef GPGMEPP_NO_EXPORT
@@ -72,7 +72,7 @@ diff -ur gpgmepp.org/lang/cpp/src/gpgmepp_export.h 
gpgmepp/lang/cpp/src/gpgmepp_
  #     define GPGMEPP_NO_EXPORT
  #    else
  #     define GPGMEPP_NO_EXPORT __attribute__((visibility("hidden")))
-@@ -54,7 +54,11 @@
+@@ -55,7 +55,11 @@
  #endif
  
  #ifndef GPGMEPP_DEPRECATED
@@ -88,7 +88,7 @@ diff -ur gpgmepp.org/lang/cpp/src/gpgmepp_export.h 
gpgmepp/lang/cpp/src/gpgmepp_
 diff -ur gpgmepp.org/lang/cpp/src/interfaces/dataprovider.h 
gpgmepp/lang/cpp/src/interfaces/dataprovider.h
 --- gpgmepp.org/lang/cpp/src/interfaces/dataprovider.h 2016-05-17 
14:32:37.000000000 +0200
 +++ gpgmepp/lang/cpp/src/interfaces/dataprovider.h     2017-11-20 
18:03:11.332715700 +0100
-@@ -29,6 +29,11 @@
+@@ -31,6 +31,11 @@
  
  #include <gpg-error.h>
  
@@ -103,7 +103,7 @@ diff -ur gpgmepp.org/lang/cpp/src/interfaces/dataprovider.h 
gpgmepp/lang/cpp/src
 diff -ur gpgmepp.org/lang/cpp/src/key.cpp gpgmepp/lang/cpp/src/key.cpp
 --- gpgmepp.org/lang/cpp/src/key.cpp   2017-03-20 20:10:15.000000000 +0100
 +++ gpgmepp/lang/cpp/src/key.cpp       2017-11-20 17:44:50.321858800 +0100
-@@ -33,11 +33,17 @@
+@@ -34,11 +34,17 @@
  #include <gpgme.h>
  
  #include <string.h>
@@ -135,7 +135,7 @@ diff -ur gpgmepp.org/lang/cpp/src/key.h 
gpgmepp/lang/cpp/src/key.h
 diff -ur gpgmepp.org/lang/qt/src/qgpgme_export.h 
gpgmepp/lang/qt/src/qgpgme_export.h
 --- gpgmepp.org/lang/qt/src/qgpgme_export.h    2016-11-03 17:32:30.000000000 
+0100
 +++ gpgmepp/lang/qt/src/qgpgme_export.h        2017-11-20 16:58:27.395388000 
+0100
-@@ -39,14 +39,14 @@
+@@ -40,14 +40,14 @@
  #  ifndef QGPGME_EXPORT
  #    ifdef BUILDING_QGPGME
          /* We are building this library */
@@ -152,7 +152,7 @@ diff -ur gpgmepp.org/lang/qt/src/qgpgme_export.h 
gpgmepp/lang/qt/src/qgpgme_expo
  #       define QGPGME_EXPORT __declspec(dllimport)
  #      else
  #       define QGPGME_EXPORT __attribute__((visibility("default")))
-@@ -55,7 +55,7 @@
+@@ -56,7 +56,7 @@
  #  endif
  
  #  ifndef QGPGME_NO_EXPORT
@@ -161,7 +161,7 @@ diff -ur gpgmepp.org/lang/qt/src/qgpgme_export.h 
gpgmepp/lang/qt/src/qgpgme_expo
  #     define QGPGME_NO_EXPORT
  #    else
  #     define QGPGME_NO_EXPORT __attribute__((visibility("hidden")))
-@@ -64,7 +64,11 @@
+@@ -65,7 +65,11 @@
  #endif
  
  #ifndef QGPGME_DEPRECATED
diff --git a/external/gpgmepp/w32-include.patch 
b/external/gpgmepp/w32-include.patch
new file mode 100644
index 000000000000..0fda72c2b072
--- /dev/null
+++ b/external/gpgmepp/w32-include.patch
@@ -0,0 +1,42 @@
+--- src/data-fd.c
++++ src/data-fd.c
+@@ -28,6 +28,9 @@
+ #ifdef HAVE_SYS_TYPES_H
+ # include <sys/types.h>
+ #endif
++#if defined HAVE_W32_SYSTEM
++#include <io.h>
++#endif
+ 
+ #include "debug.h"
+ #include "data.h"
+--- src/gpgme-w32spawn.c
++++ src/gpgme-w32spawn.c
+@@ -36,6 +36,7 @@
+ # include <sys/stat.h>
+ #endif
+ #include <stdint.h>
++#include <io.h>
+ #include <process.h>
+ 
+ #include "priv-io.h"
+--- lang/cpp/src/gpgaddexistingsubkeyeditinteractor.h
++++ lang/cpp/src/gpgaddexistingsubkeyeditinteractor.h
+@@ -27,6 +27,7 @@
+ #include "editinteractor.h"
+ 
+ #include <memory>
++#include <string>
+ 
+ namespace GpgME
+ {
+--- lang/cpp/src/gpgrevokekeyeditinteractor.h
++++ lang/cpp/src/gpgrevokekeyeditinteractor.h
+@@ -28,6 +28,7 @@
+ #include "global.h"
+ 
+ #include <memory>
++#include <string>
+ #include <vector>
+ 
+ namespace GpgME
commit 99a5a00581401c8ad97a45b11dbcee315c44bd79
Author:     Taichi Haradaguchi <[email protected]>
AuthorDate: Sun Dec 11 18:00:28 2022 +0900
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:44:34 2023 +0100

    poppler: upgrade to release 22.12.0
    
    Change-Id: Ic0544fa378705b97b437132fc8860a65692634da
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143977
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 1ec7f8b5b21bf74f684095b97a2b9900a71a0979)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144066
    Reviewed-by: Christian Lohmaier <[email protected]>

diff --git a/download.lst b/download.lst
index 65e4afeb6aff..2a61ea52ce0d 100644
--- a/download.lst
+++ b/download.lst
@@ -214,8 +214,8 @@ export PIXMAN_SHA256SUM := 
ea1480efada2fd948bc75366f7c349e1c96d3297d09a3fe62626e
 export PIXMAN_TARBALL := pixman-0.42.2.tar.gz
 export LIBPNG_SHA256SUM := 
1f4696ce70b4ee5f85f1e1623dc1229b210029fa4b7aee573df3e2ba7b036937
 export LIBPNG_TARBALL := libpng-1.6.39.tar.xz
-export POPPLER_SHA256SUM := 
d7a8f748211359cadb774ba3e18ecda6464b34027045c0648eb30d5852a41e2e
-export POPPLER_TARBALL := poppler-22.09.0.tar.xz
+export POPPLER_SHA256SUM := 
d9aa9cacdfbd0f8e98fc2b3bb008e645597ed480685757c3e7bc74b4278d15c0
+export POPPLER_TARBALL := poppler-22.12.0.tar.xz
 export POPPLER_DATA_SHA256SUM := 
2cec05cd1bb03af98a8b06a1e22f6e6e1a65b1e2f3816cb3069bb0874825f08c
 export POPPLER_DATA_TARBALL := poppler-data-0.4.11.tar.gz
 export POSTGRESQL_SHA256SUM := 
73876fdd3a517087340458dca4ce15b8d2a4dbceb334c0441424551ae6c4cded
diff --git a/external/poppler/disable-freetype.patch.1 
b/external/poppler/disable-freetype.patch.1
index d59006eba979..710742206925 100644
--- a/external/poppler/disable-freetype.patch.1
+++ b/external/poppler/disable-freetype.patch.1
@@ -22,7 +22,7 @@ disable freetype dependent code
  
  // return a newly allocated char* containing an UTF16BE string of size length
  char *pdfDocEncodingToUTF16(const std::string &orig, int *length)
-@@ -2730,6 +2730,8 @@
+@@ -2743,6 +2743,8 @@
  
  Form::AddFontResult Form::addFontToDefaultResources(const std::string 
&filepath, int faceIndex, const std::string &fontFamily, const std::string 
&fontStyle)
  {
@@ -31,7 +31,7 @@ disable freetype dependent code
      if (!GooString::endsWith(filepath, ".ttf") && 
!GooString::endsWith(filepath, ".ttc") && !GooString::endsWith(filepath, 
".otf")) {
          error(errIO, -1, "We only support embedding ttf/ttc/otf fonts for 
now. The font file for {0:s} {1:s} was {2:s}", fontFamily.c_str(), 
fontStyle.c_str(), filepath.c_str());
          return {};
-@@ -2939,6 +2941,7 @@
+@@ -2951,6 +2953,7 @@
      }
  
      return { dictFontName, fontDictRef };
diff --git a/external/poppler/sanitizer.patch b/external/poppler/sanitizer.patch
index 149361661b95..c08e1b4e8a4f 100644
--- a/external/poppler/sanitizer.patch
+++ b/external/poppler/sanitizer.patch
@@ -1,6 +1,6 @@
 --- poppler/PSOutputDev.cc
 +++ poppler/PSOutputDev.cc
-@@ -3111,6 +3111,8 @@
+@@ -3138,6 +3138,8 @@
  bool PSOutputDev::checkPageSlice(Page *page, double /*hDPI*/, double 
/*vDPI*/, int rotateA, bool useMediaBox, bool crop, int sliceX, int sliceY, int 
sliceW, int sliceH, bool printing, bool (*abortCheckCbk)(void *data),
                                   void *abortCheckCbkData, bool 
(*annotDisplayDecideCbk)(Annot *annot, void *user_data), void 
*annotDisplayDecideCbkData)
  {
@@ -9,7 +9,7 @@
      PreScanOutputDev *scan;
      bool rasterize;
      bool useFlate, useLZW;
-@@ -3593,5 +3595,6 @@
+@@ -3623,5 +3625,6 @@
  
      return false;
 +#endif
commit 3d3cb3d8aba1e77bba790c8ab25d9c960eccbd13
Author:     Taichi Haradaguchi <[email protected]>
AuthorDate: Mon Nov 21 23:33:32 2022 +0900
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:44:10 2023 +0100

    nss: upgrade to release 3.86.0
    
    Change-Id: Ia236c7124d920785f7a2856db5ee1ccbef7a2d68
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143038
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit a2969884af71e88d2541bd2bfdebea222876fef4)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144068
    Reviewed-by: Christian Lohmaier <[email protected]>

diff --git a/download.lst b/download.lst
index edc536d4c58c..65e4afeb6aff 100644
--- a/download.lst
+++ b/download.lst
@@ -191,8 +191,8 @@ export MYTHES_SHA256SUM := 
1e81f395d8c851c3e4e75b568e20fa2fa549354e75ab397f9de4b
 export MYTHES_TARBALL := a8c2c5b8f09e7ede322d5c602ff6a4b6-mythes-1.2.4.tar.gz
 export NEON_SHA256SUM := 
cf1ee3ac27a215814a9c80803fcee4f0ede8466ebead40267a9bd115e16a8678
 export NEON_TARBALL := neon-0.31.2.tar.gz
-export NSS_SHA256SUM := 
b1e1198fa7ee4e0fe4fa6937245c94820fd3c3c6897779493858af1bf6310b30
-export NSS_TARBALL := nss-3.83-with-nspr-4.34.1.tar.gz
+export NSS_SHA256SUM := 
8b5a2e9e3d632a78ad4d9c8d2ea502d2790d7a8e7b1986d173107232eca27432
+export NSS_TARBALL := nss-3.86-with-nspr-4.35.tar.gz
 export ODFGEN_SHA256SUM := 
55200027fd46623b9bdddd38d275e7452d1b0ff8aeddcad6f9ae6dc25f610625
 export ODFGEN_VERSION_MICRO := 8
 export ODFGEN_TARBALL := libodfgen-0.1.$(ODFGEN_VERSION_MICRO).tar.xz
diff --git a/external/nss/UnpackedTarball_nss.mk 
b/external/nss/UnpackedTarball_nss.mk
index 4f8499e8a835..c6e2b8510db0 100644
--- a/external/nss/UnpackedTarball_nss.mk
+++ b/external/nss/UnpackedTarball_nss.mk
@@ -24,7 +24,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
     external/nss/nss.vs2015.patch \
     external/nss/nss.vs2015.pdb.patch \
     external/nss/nss.bzmozilla1238154.patch \
-       external/nss/nss-bz1646594.patch.1 \
+    external/nss/nss-bz1646594.patch.1 \
     external/nss/macos-dlopen.patch.0 \
     external/nss/nss-restore-manual-pre-dependencies.patch.1 \
     $(if $(filter iOS,$(OS)), \
diff --git a/external/nss/asan.patch.1 b/external/nss/asan.patch.1
index ce584a34a3b5..ccabd446ebac 100644
--- a/external/nss/asan.patch.1
+++ b/external/nss/asan.patch.1
@@ -1,7 +1,7 @@
 diff -ur nss.org/nss/coreconf/Linux.mk nss/nss/coreconf/Linux.mk
 --- nss.org/nss/coreconf/Linux.mk      2014-05-06 04:36:01.817838877 +0200
 +++ nss/nss/coreconf/Linux.mk  2014-05-06 04:37:25.387835456 +0200
-@@ -146,7 +146,7 @@
+@@ -157,7 +157,7 @@
  # we don't use -z defs there.
  # Also, -z defs conflicts with Address Sanitizer, which emits relocations
  # against the libsanitizer runtime built into the main executable.
diff --git a/external/nss/clang-cl.patch.0 b/external/nss/clang-cl.patch.0
index b02fff60e36b..e20aab3b9ff1 100644
--- a/external/nss/clang-cl.patch.0
+++ b/external/nss/clang-cl.patch.0
@@ -14,7 +14,7 @@
  #pragma intrinsic(_InterlockedExchange)
 --- nspr/pr/include/prbit.h
 +++ nspr/pr/include/prbit.h
-@@ -14,7 +14,7 @@
+@@ -15,7 +15,7 @@
  */
  #if defined(_WIN32) && (_MSC_VER >= 1300) && \
      (defined(_M_IX86) || defined(_M_X64) || defined(_M_ARM) || \
@@ -23,7 +23,7 @@
  # include <intrin.h>
  # pragma  intrinsic(_BitScanForward,_BitScanReverse)
  __forceinline static int __prBitScanForward32(unsigned int val)
-@@ -32,7 +32,7 @@
+@@ -33,7 +33,7 @@
  # define pr_bitscan_ctz32(val)  __prBitScanForward32(val)
  # define pr_bitscan_clz32(val)  __prBitScanReverse32(val)
  # define  PR_HAVE_BUILTIN_BITSCAN32
@@ -32,7 +32,7 @@
         (defined(__i386__) || defined(__x86_64__) || defined(__arm__) || \
          defined(__aarch64__))
  # define pr_bitscan_ctz32(val)  __builtin_ctz(val)
-@@ -136,7 +136,7 @@
+@@ -138,7 +138,7 @@
  */
  
  #if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_AMD64) || \
@@ -74,7 +74,7 @@
  #define DSA_SUBPRIME_LEN ((__BLAPI_DEPRECATED)DSA1_SUBPRIME_LEN)
 --- nss/lib/util/pkcs11n.h
 +++ nss/lib/util/pkcs11n.h
-@@ -426,7 +426,7 @@
+@@ -563,7 +563,7 @@
  /* keep the old value for compatibility reasons*/
  #define CKT_NSS_MUST_VERIFY ((__CKT_NSS_MUST_VERIFY)(CKT_NSS + 4))
  #else
@@ -91,7 +91,7 @@
 # in the outer pkcs11t.h:
 --- nss/lib/util/pkcs11t.h
 +++ nss/lib/util/pkcs11t.h
-@@ -72,7 +72,14 @@
+@@ -78,7 +78,14 @@
  #define CK_INVALID_HANDLE 0
  
  /* pack */
@@ -106,7 +106,7 @@
  
  typedef struct CK_VERSION {
      CK_BYTE major; /* integer portion of version number */
-@@ -1795,6 +1802,13 @@
+@@ -2586,6 +2593,13 @@
  #include "pkcs11n.h"
  
  /* undo packing */
diff --git a/external/nss/macos-dlopen.patch.0 
b/external/nss/macos-dlopen.patch.0
index 1889b8df7cd3..e8abc8f59c69 100644
--- a/external/nss/macos-dlopen.patch.0
+++ b/external/nss/macos-dlopen.patch.0
@@ -1,6 +1,6 @@
 --- nspr/pr/src/linking/prlink.c
 +++ nspr/pr/src/linking/prlink.c
-@@ -799,7 +799,7 @@
+@@ -555,7 +555,7 @@
           * The reason is that DARWIN's dlopen ignores the provided path
           * and checks for the plain filename in DYLD_LIBRARY_PATH,
           * which could load an unexpected version of a library. */
diff --git a/external/nss/nss-android.patch.1 b/external/nss/nss-android.patch.1
index 7eb306a50c32..707fcf99afe0 100644
--- a/external/nss/nss-android.patch.1
+++ b/external/nss/nss-android.patch.1
@@ -1,7 +1,7 @@
 diff -ur nss.org/nspr/build/autoconf/config.sub 
nss/nspr/build/autoconf/config.sub
 --- nss.org/nspr/build/autoconf/config.sub     2017-09-07 15:29:45.031246453 
+0200
 +++ nss/nspr/build/autoconf/config.sub 2017-09-07 15:32:13.087235423 +0200
-@@ -111,6 +111,11 @@
+@@ -110,6 +110,11 @@
      exit 1;;
  esac
  
@@ -16,7 +16,7 @@ diff -ur nss.org/nspr/build/autoconf/config.sub 
nss/nspr/build/autoconf/config.s
 diff -ur nss.org/nspr/configure nss/nspr/configure
 --- nss.org/nspr/configure     2017-09-07 15:29:45.018246359 +0200
 +++ nss/nspr/configure 2017-09-07 15:31:47.604075663 +0200
-@@ -2737,18 +2739,15 @@
+@@ -2728,18 +2728,15 @@
      esac
  
          AS="$android_toolchain"/bin/"$android_tool_prefix"-as
@@ -41,7 +41,7 @@ diff -ur nss.org/nspr/configure nss/nspr/configure
 diff -ur nss.org/nss/Makefile nss/nss/Makefile
 --- nss.org/nss/Makefile       2017-09-07 15:29:44.933245745 +0200
 +++ nss/nss/Makefile   2017-09-07 15:32:04.347181076 +0200
-@@ -62,7 +62,7 @@
+@@ -65,7 +65,7 @@
  
  ifeq ($(OS_TARGET),Android)
  NSPR_CONFIGURE_OPTS += --with-android-ndk=$(ANDROID_NDK) \
diff --git a/external/nss/nss-ios.patch b/external/nss/nss-ios.patch
index 86f85a873810..58239f718978 100644
--- a/external/nss/nss-ios.patch
+++ b/external/nss/nss-ios.patch
@@ -1,6 +1,6 @@
 --- a/a/nss/Makefile
 +++ a/a/nss/Makefile
-@@ -96,13 +96,11 @@
+@@ -91,13 +91,11 @@
  ifdef NS_USE_GCC
  NSPR_CONFIGURE_ENV = CC=gcc CXX=g++
  endif
@@ -16,7 +16,7 @@
  endif
  
  #
-@@ -140,7 +140,6 @@
+@@ -140,7 +138,6 @@
  
  build_nspr: $(NSPR_CONFIG_STATUS)
        $(MAKE) -C $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME)
@@ -37,7 +37,7 @@
  
 --- a/a/nss/lib/nss/nssinit.c
 +++ a/a/nss/lib/nss/nssinit.c
-@@ -278,6 +278,7 @@
+@@ -275,6 +275,7 @@
                            const char *secmodprefix,
                            char **retoldpath, char **retnewpath)
  {
@@ -45,7 +45,7 @@
      char *path, *oldpath = NULL, *lastsep;
      int len, path_len, secmod_len, dll_len;
  
-@@ -309,6 +309,10 @@
+@@ -309,6 +310,10 @@
      }
      *retoldpath = oldpath;
      *retnewpath = path;
@@ -58,7 +58,7 @@
  
 --- a/a/nss/lib/pk11wrap/pk11load.c
 +++ a/a/nss/lib/pk11wrap/pk11load.c
-@@ -389,6 +389,8 @@
+@@ -390,6 +390,8 @@
  /*
   * load a new module into our address space and initialize it.
   */
@@ -67,7 +67,7 @@
  SECStatus
  secmod_LoadPKCS11Module(SECMODModule *mod, SECMODModule **oldModule)
  {
-@@ -465,6 +465,7 @@
+@@ -468,6 +470,7 @@
  /* load the library. If this succeeds, then we have to remember to
           * unload the library if anything goes wrong from here on out...
           */
@@ -75,7 +75,7 @@
  #if defined(_WIN32)
          if (nssUTF8_Length(mod->dllName, NULL)) {
              wchar_t *dllNameWide = _NSSUTIL_UTF8ToWide(mod->dllName);
-@@ -487,6 +487,11 @@
+@@ -507,6 +510,11 @@
              mod->moduleDBFunc = (void *)
                  PR_FindSymbol(library, "NSS_ReturnModuleSpecData");
          }
@@ -87,7 +87,7 @@
          if (mod->moduleDBFunc == NULL)
              mod->isModuleDB = PR_FALSE;
          if ((ientry == NULL) && (fentry == NULL)) {
-@@ -624,10 +624,12 @@
+@@ -643,10 +651,12 @@
      }
  fail:
      mod->functionList = NULL;
@@ -124,7 +124,7 @@
      PRLibrary *handle;
      const char *name = getLibName();
  
-@@ -47,32 +47,42 @@
+@@ -47,32 +48,42 @@
      if (handle) {
          PRFuncPtr address = PR_FindFunctionSymbol(handle, "FREEBL_GetVector");
          if (address) {
@@ -168,7 +168,7 @@
  }
  
  static const PRCallOnceType pristineCallOnce;
-@@ -837,6 +837,7 @@
+@@ -860,6 +871,7 @@
  void
  BL_Unload(void)
  {
@@ -176,7 +176,7 @@
      /* This function is not thread-safe, but doesn't need to be, because it is
       * only called from functions that are also defined as not thread-safe,
       * namely C_Finalize in softoken, and the SSL bypass shutdown callback 
called
-@@ -852,6 +852,7 @@
+@@ -872,6 +884,7 @@
          PR_UnloadLibrary(blLib);
  #endif
      }
@@ -186,7 +186,7 @@
  }
 --- a/a/nspr/build/autoconf/config.sub 2017-09-07 15:29:45.031246453 +0200
 +++ a/a/nspr/build/autoconf/config.sub 2017-09-07 15:32:13.087235423 +0200
-@@ -111,6 +111,9 @@
+@@ -110,6 +110,9 @@
      exit 1;;
  esac
  
@@ -198,7 +198,7 @@
  IFS="-" read field1 field2 field3 field4 <<EOF
 --- a/a/nspr/config/autoconf.mk.in
 +++ a/a/nspr/config/autoconf.mk.in
-@@ -67,7 +67,7 @@
+@@ -69,7 +69,7 @@
  MSC_VER               = @MSC_VER@
  AR            = @AR@
  AR_FLAGS      = @AR_FLAGS@
@@ -209,7 +209,7 @@
  RC            = @RC@
 --- a/a/nspr/configure
 +++ a/a/nspr/configure
-@@ -755,7 +755,7 @@
+@@ -2507,7 +2507,7 @@
  OBJDIR='$(OBJDIR_NAME)'
  OBJDIR_NAME=.
  OBJDIR_SUFFIX=OBJ
@@ -218,7 +218,7 @@
  NOSUCHFILE=/no-such-file
  LIBNSPR='-L$(dist_libdir) -lnspr$(MOD_MAJOR_VERSION)'
  LIBPLC='-L$(dist_libdir) -lplc$(MOD_MAJOR_VERSION)'
-@@ -3060,7 +3060,7 @@
+@@ -5571,7 +5571,7 @@
  LIB_SUFFIX=a
  DLL_SUFFIX=so
  ASM_SUFFIX=s
@@ -227,7 +227,7 @@
  PR_MD_ASFILES=
  PR_MD_CSRCS=
  PR_MD_ARCH_DIR=unix
-@@ -3904,7 +3904,7 @@
+@@ -6485,7 +6485,7 @@
      DSO_CFLAGS=-fPIC
      DSO_LDOPTS='-dynamiclib -compatibility_version 1 -current_version 1 
-all_load -install_name 
@__________________________________________________OOO/$@ 
-headerpad_max_install_names'
      _OPTIMIZE_FLAGS=-O2
@@ -238,7 +238,7 @@
      USE_PTHREADS=1
 --- a/a/nss/coreconf/ruleset.mk
 +++ a/a/nss/coreconf/ruleset.mk
-@@ -68,7 +68,7 @@
+@@ -45,7 +45,7 @@
  endif
  
  ifeq ($(MKPROG),)
@@ -249,7 +249,7 @@
  #
 --- a/a/nss/coreconf/Darwin.mk
 +++ a/a/nss/coreconf/Darwin.mk
-@@ -124,7 +124,7 @@
+@@ -116,7 +116,7 @@
     DSO_LDOPTS += --coverage
  endif
  
diff --git a/external/nss/nss-restore-manual-pre-dependencies.patch.1 
b/external/nss/nss-restore-manual-pre-dependencies.patch.1
index 06691b1ec957..ea034f0dc80f 100644
--- a/external/nss/nss-restore-manual-pre-dependencies.patch.1
+++ b/external/nss/nss-restore-manual-pre-dependencies.patch.1
@@ -68,7 +68,7 @@ summary:     Bug 1637083 Replace pre-dependency with shell 
hack r=rrelyea
        ck.h              \
 --- b/nss/manifest.mn  Wed May 13 19:00:40 2020 +0000
 +++ a/nss/manifest.mn  Tue May 12 21:33:43 2020 +0000
-@@ -23,6 +23,12 @@
+@@ -24,6 +24,12 @@
        # no real way to encode these in any sensible way
        $(MAKE) -C coreconf/nsinstall program
        $(MAKE) export
diff --git a/external/nss/nss-win32-make.patch.1 
b/external/nss/nss-win32-make.patch.1
index 7ba3df451ee6..6a3201a082a1 100644
--- a/external/nss/nss-win32-make.patch.1
+++ b/external/nss/nss-win32-make.patch.1
@@ -1,6 +1,6 @@
 --- nss/nss/coreconf/rules.mk.orig2    2014-06-03 15:30:01.667200000 +0200
 +++ nss/nss/coreconf/rules.mk  2014-06-03 15:30:14.537200000 +0200
-@@ -259,7 +259,7 @@
+@@ -174,7 +174,7 @@
  $(LIBRARY): $(OBJS) | $$(@D)/d
        rm -f $@
  ifeq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET)))
@@ -9,7 +9,7 @@
  else
        $(AR) cr $@ $(OBJS)
  endif
-@@ -297,7 +297,7 @@
+@@ -214,7 +214,7 @@
  ifdef NS_USE_GCC
        $(LINK_DLL) $(OBJS) $(SUB_SHLOBJS) $(EXTRA_LIBS) $(EXTRA_SHARED_LIBS) 
$(OS_LIBS) $(LD_LIBS) $(RES)
  else
diff --git a/external/nss/nss.aix.patch b/external/nss/nss.aix.patch
index 4b0c6bfb3261..10572f94717a 100644
--- a/external/nss/nss.aix.patch
+++ b/external/nss/nss.aix.patch
@@ -1,7 +1,7 @@
 diff -ru a/nspr/configure b/nspr/configure
 --- a/a/nspr/configure 2014-09-29 16:47:42.984012225 +0100
 +++ b/b/nspr/configure 2014-09-29 16:50:33.907375937 +0100
-@@ -6369,7 +6369,6 @@
+@@ -6325,7 +6325,6 @@
          AIX_LINK_OPTS='-brtl -bnso -berok'
          ;;
      esac
@@ -12,7 +12,7 @@ diff -ru a/nspr/configure b/nspr/configure
 diff -ru a/nspr/configure.in b/nspr/configure.in
 --- a/a/nspr/configure.in      2014-09-29 16:46:35.257394860 +0100
 +++ b/b/nspr/configure.in      2014-09-29 16:50:33.908375942 +0100
-@@ -1229,7 +1229,8 @@
+@@ -1180,7 +1180,8 @@
      AC_DEFINE(XP_UNIX)
      AC_DEFINE(AIX)
      AC_DEFINE(SYSV)
@@ -22,7 +22,7 @@ diff -ru a/nspr/configure.in b/nspr/configure.in
      AC_CHECK_HEADER(sys/atomic_op.h, AC_DEFINE(AIX_HAVE_ATOMIC_OP_H))
      case "${target_os}" in
      aix3.2*)
-@@ -1269,10 +1270,9 @@
+@@ -1220,10 +1221,9 @@
          AC_DEFINE(HAVE_SOCKLEN_T)
          AC_DEFINE(HAVE_FCNTL_FILE_LOCKING)
          USE_IPV6=1
@@ -48,7 +48,7 @@ diff -ru a/nspr/pr/src/Makefile.in b/nspr/pr/src/Makefile.in
 diff -ru a/nss/cmd/platlibs.mk b/nss/cmd/platlibs.mk
 --- a/a/nss/cmd/platlibs.mk    2014-09-29 16:47:42.987012253 +0100
 +++ b/b/nss/cmd/platlibs.mk    2014-09-29 16:50:33.910375955 +0100
-@@ -134,7 +134,7 @@
+@@ -171,7 +171,7 @@
        $(NULL)
  
  ifeq ($(OS_ARCH), AIX) 
@@ -57,7 +57,7 @@ diff -ru a/nss/cmd/platlibs.mk b/nss/cmd/platlibs.mk
  endif
  
  # $(PROGRAM) has NO explicit dependencies on $(EXTRA_SHARED_LIBS)
-@@ -180,7 +180,7 @@
+@@ -217,7 +217,7 @@
        $(NULL)
  
  ifeq ($(OS_ARCH), AIX) 
diff --git a/external/nss/nss.bzmozilla1238154.patch 
b/external/nss/nss.bzmozilla1238154.patch
index 468ff810b9ca..425f38257892 100644
--- a/external/nss/nss.bzmozilla1238154.patch
+++ b/external/nss/nss.bzmozilla1238154.patch
@@ -1,7 +1,7 @@
 diff -ru a/nspr/configure b/nspr/configure
 --- a/a/nspr/configure 2019-01-26 12:23:06.589389910 +0100
 +++ b/b/nspr/configure 2019-01-26 12:26:56.566222293 +0100
-@@ -7127,7 +7127,7 @@
+@@ -6883,7 +6883,7 @@
  
          # Determine compiler version
  
diff --git a/external/nss/nss.cygwin64.in32bit.patch 
b/external/nss/nss.cygwin64.in32bit.patch
index b00761a0e85b..bce0f1d09403 100644
--- a/external/nss/nss.cygwin64.in32bit.patch
+++ b/external/nss/nss.cygwin64.in32bit.patch
@@ -3,7 +3,7 @@ on Cygwin 64bit and in 32bit mode
 diff -ru nss.orig/nss/Makefile nss/nss/Makefile
 --- a/nss.orig/nss/Makefile       2016-02-26 01:00:52.146713100 +0100
 +++ b/nss/nss/Makefile    2016-02-26 01:02:05.303560100 +0100
-@@ -59,6 +59,8 @@
+@@ -63,6 +63,8 @@
  # Translate coreconf build options to NSPR configure options.
  #
 
diff --git a/external/nss/nss.nowerror.patch b/external/nss/nss.nowerror.patch
index ff81a9b33539..bdf7a33a874c 100644
--- a/external/nss/nss.nowerror.patch
+++ b/external/nss/nss.nowerror.patch
@@ -1,7 +1,7 @@
 diff -ur nss.org/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
 --- a/nss.org/nss/coreconf/WIN32.mk    2016-04-13 11:33:09.322294523 +0200
 +++ b/nss/nss/coreconf/WIN32.mk        2016-04-13 11:33:27.744323969 +0200
-@@ -127,7 +127,7 @@
+@@ -121,7 +121,7 @@
                        -D_CRT_NONSTDC_NO_WARNINGS
      OS_DLLFLAGS += -nologo -DLL -SUBSYSTEM:WINDOWS
      ifndef NSS_ENABLE_WERROR
diff --git a/external/nss/nss.utf8bom.patch.1 b/external/nss/nss.utf8bom.patch.1
index e8c56abefcde..f474adf6f932 100644
--- a/external/nss/nss.utf8bom.patch.1
+++ b/external/nss/nss.utf8bom.patch.1
@@ -1,7 +1,7 @@
 diff -ur nss.org/nss/lib/ckfw/builtins/certdata.perl 
nss/nss/lib/ckfw/builtins/certdata.perl
 --- nss.org/nss/lib/ckfw/builtins/certdata.perl        2016-03-31 
18:26:07.890190900 +0800
 +++ nss/nss/lib/ckfw/builtins/certdata.perl    2016-03-31 19:16:16.727269600 
+0800
-@@ -110,6 +110,9 @@
+@@ -122,6 +122,9 @@
  sub doprint {
  my $i;
  
@@ -11,7 +11,7 @@ diff -ur nss.org/nss/lib/ckfw/builtins/certdata.perl 
nss/nss/lib/ckfw/builtins/c
  print <<EOD
  /* THIS IS A GENERATED FILE */
  /* This Source Code Form is subject to the terms of the Mozilla Public
-@@ -119,6 +122,7 @@
+@@ -131,6 +134,7 @@
  #ifndef BUILTINS_H
  #include "builtins.h"
  #endif /* BUILTINS_H */
diff --git a/external/nss/nss.vs2015.patch b/external/nss/nss.vs2015.patch
index de4f8762fd5b..73cff7c833fb 100644
--- a/external/nss/nss.vs2015.patch
+++ b/external/nss/nss.vs2015.patch
@@ -1,7 +1,7 @@
 diff -ru nss.org/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
 --- a/nss.org/nss/coreconf/WIN32.mk    2016-02-12 15:36:18.000000000 +0100
 +++ b/nss/nss/coreconf/WIN32.mk        2016-02-26 00:42:43.170809600 +0100
-@@ -199,7 +199,7 @@
+@@ -192,7 +192,7 @@
      # Disable C4244: conversion from 'type1' to 'type2', possible loss of data
      # Disable C4018: 'expression' : signed/unsigned mismatch
      # Disable C4312: 'type cast': conversion from 'type1' to 'type2' of 
greater size
diff --git a/external/nss/nss.vs2015.pdb.patch 
b/external/nss/nss.vs2015.pdb.patch
index c66940132cdd..3b498f976ac6 100644
--- a/external/nss/nss.vs2015.pdb.patch
+++ b/external/nss/nss.vs2015.pdb.patch
@@ -1,7 +1,7 @@
 diff -ru nss.orig/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
 --- a/nss.orig/nss/coreconf/WIN32.mk   2016-03-04 08:30:16.306639400 +0100
 +++ b/nss/nss/coreconf/WIN32.mk        2016-03-04 08:31:17.987233200 +0100
-@@ -169,15 +169,15 @@
+@@ -163,15 +163,15 @@
        DLLFLAGS   += -OUT:$@
        ifdef MOZ_DEBUG_SYMBOLS
                ifdef MOZ_DEBUG_FLAGS
diff --git a/external/nss/nss.windows.patch b/external/nss/nss.windows.patch
index 901846e7bc1f..27a44045802e 100644
--- a/external/nss/nss.windows.patch
+++ b/external/nss/nss.windows.patch
@@ -1,6 +1,6 @@
 --- a/a/nspr/config/rules.mk   2008-12-03 00:24:39.000000000 +0100
 +++ b/b/nspr/config/rules.mk   2009-11-27 13:36:22.662753328 +0100
-@@ -415,7 +415,7 @@
+@@ -423,7 +423,7 @@
  
  ifdef NEED_ABSOLUTE_PATH
  # The quotes allow absolute paths to contain spaces.
@@ -11,7 +11,7 @@
  $(OBJDIR)/%.$(OBJ_SUFFIX): %.cpp
 --- a/a/nss/coreconf/rules.mk  2008-12-03 00:24:39.000000000 +0100
 +++ b/b/nss/coreconf/rules.mk  2009-11-27 13:36:22.662753328 +0100
-@@ -386,7 +386,7 @@
+@@ -280,7 +280,7 @@
  endif
  
  # The quotes allow absolute paths to contain spaces.
@@ -22,7 +22,7 @@
  ifdef USE_NT_C_SYNTAX
 --- a/a/nspr/pr/include/md/_win95.h
 +++ b/b/nspr/pr/include/md/_win95.h
-@@ -312,7 +312,7 @@
+@@ -317,7 +317,7 @@
  #define _MD_ATOMIC_ADD(ptr,val)    (InterlockedExchangeAdd((PLONG)ptr, 
(LONG)val) + val)
  #define _MD_ATOMIC_DECREMENT(x)       InterlockedDecrement((PLONG)x)
  #endif /* x86 */
diff --git a/external/nss/nss_macosx.patch b/external/nss/nss_macosx.patch
index 1e7599be6133..456bd62d509b 100644
--- a/external/nss/nss_macosx.patch
+++ b/external/nss/nss_macosx.patch
@@ -1,7 +1,7 @@
 diff -ru a/nspr/configure b/nspr/configure
 --- a/a/nspr/configure 2014-09-29 16:50:33.907375937 +0100
 +++ b/b/nspr/configure 2014-09-29 16:51:59.213931947 +0100
-@@ -6453,6 +6453,9 @@
+@@ -6448,6 +6448,9 @@
      AS='$(CC) -x assembler-with-cpp'
      CFLAGS="$CFLAGS -Wall -fno-common"
      case "${target_cpu}" in
@@ -11,7 +11,7 @@ diff -ru a/nspr/configure b/nspr/configure
          arm*)
              CPU_ARCH=arm
              ;;
-@@ -6578,7 +6579,7 @@
+@@ -6483,7 +6486,7 @@
  
  
      DSO_CFLAGS=-fPIC
@@ -23,7 +23,7 @@ diff -ru a/nspr/configure b/nspr/configure
 diff -ru a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
 --- a/a/nss/coreconf/Darwin.mk 2014-09-29 16:50:22.992304799 +0100
 +++ b/b/nss/coreconf/Darwin.mk 2014-09-29 16:51:59.214931953 +0100
-@@ -20,13 +24,17 @@
+@@ -20,13 +20,17 @@
  
  ifeq (,$(filter-out i%86,$(CPU_ARCH)))
  ifdef USE_64
@@ -41,7 +41,7 @@ diff -ru a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
  override CPU_ARCH     = x86
  endif
  else
-@@ -40,19 +48,20 @@
+@@ -33,19 +37,20 @@
  ifeq (arm,$(CPU_ARCH))
  # Nothing set for arm currently.
  else
@@ -66,7 +66,7 @@ diff -ru a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
          # GCC <= 3
          DARWIN_SDK_FRAMEWORKS = -F$(MACOS_SDK_DIR)/System/Library/Frameworks
          ifneq (,$(shell find $(MACOS_SDK_DIR)/Library/Frameworks -maxdepth 0))
-@@ -108,7 +120,7 @@
+@@ -108,7 +113,7 @@
  # May override this with different compatibility and current version numbers.
  DARWIN_DYLIB_VERSIONS = -compatibility_version 1 -current_version 1
  # May override this with -bundle to create a loadable module.
@@ -78,7 +78,7 @@ diff -ru a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
 diff -ru a/nss/Makefile b/nss/Makefile
 --- a/a/nss/Makefile   2014-09-29 16:50:22.990304789 +0100
 +++ b/b/nss/Makefile   2014-09-29 16:51:59.207931908 +0100
-@@ -72,6 +72,9 @@
+@@ -82,6 +82,9 @@
  ifeq ($(OS_TARGET),WIN95)
  NSPR_CONFIGURE_OPTS += --enable-win32-target=WIN95
  endif
diff --git a/external/nss/ubsan.patch.0 b/external/nss/ubsan.patch.0
index 2c32d90b00ce..5f97d3e9d24e 100644
--- a/external/nss/ubsan.patch.0
+++ b/external/nss/ubsan.patch.0
@@ -27,7 +27,7 @@
                count * sizeof(lgdbSlotData);
  
      data->data = (unsigned char *)PORT_ZAlloc(dataLen);
-@@ -327,7 +327,7 @@
+@@ -329,7 +329,7 @@
      }
      if ((encoded->major == LGDB_DB_EXT1_VERSION_MAJOR) &&
          (encoded->minor >= LGDB_DB_EXT1_VERSION_MINOR)) {
commit c957fed753f548086a3358791224b44ac00440da
Author:     Taichi Haradaguchi <[email protected]>
AuthorDate: Sun Dec 11 15:13:32 2022 +0900
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:43:36 2023 +0100

    libpng: upgrade to release 1.6.39
    
    Fixes CVE-2019-6129.
    
    Change-Id: I46ad0c9426a115ba19620814397a834923e03ca6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143976
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 9fb776f508a676d4c7255b5cfc6dfdc00d620a8c)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144067
    Reviewed-by: Xisco Fauli <[email protected]>
    Tested-by: Xisco Fauli <[email protected]>

diff --git a/download.lst b/download.lst
index 9358c9367acd..edc536d4c58c 100644
--- a/download.lst
+++ b/download.lst
@@ -212,8 +212,8 @@ export PDFIUM_SHA256SUM := 
ee80fe0a3b20ef5c5babc494cd655d1b1a0bdec710acb04524789
 export PDFIUM_TARBALL := pdfium-4699.tar.bz2
 export PIXMAN_SHA256SUM := 
ea1480efada2fd948bc75366f7c349e1c96d3297d09a3fe62626e38e234a625e
 export PIXMAN_TARBALL := pixman-0.42.2.tar.gz
-export LIBPNG_SHA256SUM := 
b3683e8b8111ebf6f1ac004ebb6b0c975cd310ec469d98364388e9cedbfa68be
-export LIBPNG_TARBALL := libpng-1.6.38.tar.xz
+export LIBPNG_SHA256SUM := 
1f4696ce70b4ee5f85f1e1623dc1229b210029fa4b7aee573df3e2ba7b036937
+export LIBPNG_TARBALL := libpng-1.6.39.tar.xz
 export POPPLER_SHA256SUM := 
d7a8f748211359cadb774ba3e18ecda6464b34027045c0648eb30d5852a41e2e
 export POPPLER_TARBALL := poppler-22.09.0.tar.xz
 export POPPLER_DATA_SHA256SUM := 
2cec05cd1bb03af98a8b06a1e22f6e6e1a65b1e2f3816cb3069bb0874825f08c
commit 9050bfa38598ad158fc1510095153d2f4c41d912
Author:     Michael Stahl <[email protected]>
AuthorDate: Fri Dec 9 11:51:22 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:42:30 2023 +0100

    python3: upgrade to release 3.8.16
    
    Fixes CVE-2022-37454 and a few other ones that look less relevant
    including CVE-2022-45061 and CVE-2015-20107.
    
    Change-Id: I10fd254f7f0801d47119234bb3436874e98d8c91
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143849
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 05f55b3898407828bb24347be56247f58803f7bb)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143859
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/configure.ac b/configure.ac
index 08836bb9b94d..c2a71b250013 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9849,7 +9849,7 @@ internal)
     SYSTEM_PYTHON=
     PYTHON_VERSION_MAJOR=3
     PYTHON_VERSION_MINOR=8
-    PYTHON_VERSION=${PYTHON_VERSION_MAJOR}.${PYTHON_VERSION_MINOR}.15
+    PYTHON_VERSION=${PYTHON_VERSION_MAJOR}.${PYTHON_VERSION_MINOR}.16
     if ! grep -q -i python.*${PYTHON_VERSION} ${SRC_ROOT}/download.lst; then
         AC_MSG_ERROR([PYTHON_VERSION ${PYTHON_VERSION} but no matching file in 
download.lst])
     fi
diff --git a/download.lst b/download.lst
index f151a4f3884b..9358c9367acd 100644
--- a/download.lst
+++ b/download.lst
@@ -220,8 +220,8 @@ export POPPLER_DATA_SHA256SUM := 
2cec05cd1bb03af98a8b06a1e22f6e6e1a65b1e2f3816cb
 export POPPLER_DATA_TARBALL := poppler-data-0.4.11.tar.gz
 export POSTGRESQL_SHA256SUM := 
73876fdd3a517087340458dca4ce15b8d2a4dbceb334c0441424551ae6c4cded
 export POSTGRESQL_TARBALL := postgresql-13.8.tar.bz2
-export PYTHON_SHA256SUM := 
5114fc7918a2a5e20eb5aac696b30c36f412c6ef24b13f5c9eb9e056982d9550
-export PYTHON_TARBALL := Python-3.8.15.tar.xz
+export PYTHON_SHA256SUM := 
d85dbb3774132473d8081dcb158f34a10ccad7a90b96c7e50ea4bb61f5ce4562
+export PYTHON_TARBALL := Python-3.8.16.tar.xz
 export QXP_SHA256SUM := 
e137b6b110120a52c98edd02ebdc4095ee08d0d5295a94316a981750095a945c
 export QXP_TARBALL := libqxp-0.0.2.tar.xz
 export RAPTOR_SHA256SUM := 
ada7f0ba54787b33485d090d3d2680533520cd4426d2f7fb4782dd4a6a1480ed
commit 0d5a3dbbf05b2a00aac23f2229ca0c320591a025
Author:     Taichi Haradaguchi <[email protected]>
AuthorDate: Mon Nov 28 21:04:45 2022 +0900
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:41:02 2023 +0100

    pixman: upgrade to release 0.42.2
    
    Fixes CVE-2022-44638
    
    Remove Wincompatible-function-pointer-types.patch.0, fixed upstream.
    
    Change-Id: If6589a701a252f71da145264ee3a6f0e333492ae
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143423
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 93a69d37c1dbcc7365dc0cf2493d1ca27babef2b)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143439

diff --git a/download.lst b/download.lst
index 96053558cc50..f151a4f3884b 100644
--- a/download.lst
+++ b/download.lst
@@ -210,8 +210,8 @@ export PAGEMAKER_SHA256SUM := 
66adacd705a7d19895e08eac46d1e851332adf2e736c566bef
 export PAGEMAKER_TARBALL := libpagemaker-0.0.4.tar.xz
 export PDFIUM_SHA256SUM := 
ee80fe0a3b20ef5c5babc494cd655d1b1a0bdec710acb04524789df500c563bf
 export PDFIUM_TARBALL := pdfium-4699.tar.bz2
-export PIXMAN_SHA256SUM := 
6d200dec3740d9ec4ec8d1180e25779c00bc749f94278c8b9021f5534db223fc
-export PIXMAN_TARBALL := pixman-0.40.0.tar.gz
+export PIXMAN_SHA256SUM := 
ea1480efada2fd948bc75366f7c349e1c96d3297d09a3fe62626e38e234a625e
+export PIXMAN_TARBALL := pixman-0.42.2.tar.gz
 export LIBPNG_SHA256SUM := 
b3683e8b8111ebf6f1ac004ebb6b0c975cd310ec469d98364388e9cedbfa68be
 export LIBPNG_TARBALL := libpng-1.6.38.tar.xz
 export POPPLER_SHA256SUM := 
d7a8f748211359cadb774ba3e18ecda6464b34027045c0648eb30d5852a41e2e
diff --git a/external/cairo/ExternalPackage_pixman.mk 
b/external/cairo/ExternalPackage_pixman.mk
index 458c2733503e..85ff062f22e2 100644
--- a/external/cairo/ExternalPackage_pixman.mk
+++ b/external/cairo/ExternalPackage_pixman.mk
@@ -12,7 +12,7 @@ $(eval $(call 
gb_ExternalPackage_ExternalPackage,pixman,pixman))
 $(eval $(call gb_ExternalPackage_use_external_project,pixman,pixman))
 
 ifneq ($(DISABLE_DYNLOADING),TRUE)
-$(eval $(call 
gb_ExternalPackage_add_file,pixman,$(LIBO_LIB_FOLDER)/libpixman-1.so.0,pixman/.libs/libpixman-1.so.0.40.0))
+$(eval $(call 
gb_ExternalPackage_add_file,pixman,$(LIBO_LIB_FOLDER)/libpixman-1.so.0,pixman/.libs/libpixman-1.so.0.42.2))
 endif
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/cairo/ExternalProject_pixman.mk 
b/external/cairo/ExternalProject_pixman.mk
index 2c089ba0e5fc..9293b9234013 100644
--- a/external/cairo/ExternalProject_pixman.mk
+++ b/external/cairo/ExternalProject_pixman.mk
@@ -25,9 +25,9 @@ $(call gb_ExternalProject_get_state_target,pixman,build) :
        $(call gb_ExternalProject_run,build,\
                $(gb_RUN_CONFIGURE) ./configure \
                $(if $(filter 
TRUE,$(DISABLE_DYNLOADING)),--disable-shared,--disable-static) \
-               $(if $(filter ANDROID,$(OS)),--disable-arm-simd 
--disable-arm-neon --disable-arm-iwmmxt) \
-               $(if $(CROSS_COMPILING),--build=$(BUILD_PLATFORM) 
--host=$(HOST_PLATFORM) \
-               $(if $(filter INTEL ARM,$(CPUNAME)),ac_cv_c_bigendian=no)) \
+               $(if $(filter ANDROID,$(OS)),--disable-arm-simd 
--disable-arm-neon --disable-arm-a64-neon --disable-arm-iwmmxt) \
+               $(gb_CONFIGURE_PLATFORMS) \
+               $(if $(CROSS_COMPILING),$(if $(filter INTEL 
ARM,$(CPUNAME)),ac_cv_c_bigendian=no)) \
                $(if $(filter EMSCRIPTEN,$(OS)),CFLAGS="-pthread") \
                && $(MAKE) \
        )
diff --git a/external/cairo/pixman/pixman-0.24.4.patch 
b/external/cairo/pixman/pixman-0.24.4.patch
index 6d871e37bfd1..a5d32f88f82f 100644
--- a/external/cairo/pixman/pixman-0.24.4.patch
+++ b/external/cairo/pixman/pixman-0.24.4.patch
@@ -1,6 +1,6 @@
 --- misc/pixman-0.24.4/Makefile.in     2011-11-06 22:11:25.000000000 +0100
 +++ misc/build/pixman-0.24.4/Makefile.in       2011-12-16 09:06:45.317211035 
+0100
-@@ -272,7 +272,7 @@
+@@ -385,7 +385,7 @@
  top_build_prefix = @top_build_prefix@
  top_builddir = @top_builddir@
  top_srcdir = @top_srcdir@
diff --git a/external/cairo/pixman/pixman-ubsan.patch 
b/external/cairo/pixman/pixman-ubsan.patch
index 3a556d19a9dd..64e5778ee4d4 100644
--- a/external/cairo/pixman/pixman-ubsan.patch
+++ b/external/cairo/pixman/pixman-ubsan.patch
@@ -1,6 +1,6 @@
-diff -ru pixman-0.40.0.orig/pixman/pixman-bits-image.c 
pixman-0.40.0/pixman/pixman-bits-image.c
---- misc/pixman-0.40.0.orig/pixman/pixman-bits-image.c 2021-08-29 
20:02:33.714515016 +0100
-+++ misc/build/pixman-0.40.0/pixman/pixman-bits-image.c        2021-08-29 
20:05:43.304930185 +0100
+diff -ru pixman-0.42.2.orig/pixman/pixman-bits-image.c 
pixman-0.42.2/pixman/pixman-bits-image.c
+--- misc/pixman-0.42.2.orig/pixman/pixman-bits-image.c 2022-11-03 
02:25:48.000000000 +0900
++++ misc/build/pixman-0.42.2/pixman/pixman-bits-image.c        2022-11-28 
21:35:25.896969126 +0900
 @@ -351,8 +351,8 @@
       * positioned relative to a particular phase (and not relative to whatever
       * exact fraction we happen to get here).
@@ -12,9 +12,9 @@ diff -ru pixman-0.40.0.orig/pixman/pixman-bits-image.c 
pixman-0.40.0/pixman/pixm
  
      px = (x & 0xffff) >> x_phase_shift;
      py = (y & 0xffff) >> y_phase_shift;
-diff -ru pixman-0.40.0.orig/pixman/pixman-combine32.c 
pixman-0.40.0/pixman/pixman-combine32.c
---- misc/pixman-0.40.0.orig/pixman/pixman-combine32.c  2021-08-29 
20:02:33.715514970 +0100
-+++ misc/build/pixman-0.40.0/pixman/pixman-combine32.c 2021-08-29 
20:05:43.304930185 +0100
+diff -ru pixman-0.42.2.orig/pixman/pixman-combine32.c 
pixman-0.42.2/pixman/pixman-combine32.c
+--- misc/pixman-0.42.2.orig/pixman/pixman-combine32.c  2022-02-02 
05:51:25.000000000 +0900
++++ misc/build/pixman-0.42.2/pixman/pixman-combine32.c 2022-11-28 
21:38:48.226968594 +0900
 @@ -589,7 +589,7 @@
            rg = DIV_ONE_UN8 (rg);                                      \
            rb = DIV_ONE_UN8 (rb);                                      \
@@ -24,9 +24,9 @@ diff -ru pixman-0.40.0.orig/pixman/pixman-combine32.c 
pixman-0.40.0/pixman/pixma
        }                                                               \
      }                                                                 \
                                                                        \
-diff -ru pixman-0.40.0.orig/pixman/pixman-fast-path.c 
pixman-0.40.0/pixman/pixman-fast-path.c
---- misc/pixman-0.40.0.orig/pixman/pixman-fast-path.c  2021-08-29 
20:02:33.716514925 +0100
-+++ misc/build/pixman-0.40.0/pixman/pixman-fast-path.c 2021-08-29 
20:05:43.303930231 +0100
+diff -ru pixman-0.42.2.orig/pixman/pixman-fast-path.c 
pixman-0.42.2/pixman/pixman-fast-path.c
+--- misc/pixman-0.42.2.orig/pixman/pixman-fast-path.c  2022-10-18 
02:47:42.000000000 +0900
++++ misc/build/pixman-0.42.2/pixman/pixman-fast-path.c 2022-11-28 
21:53:12.596963317 +0900
 @@ -2758,8 +2758,8 @@
         * positioned relative to a particular phase (and not relative to 
whatever
         * exact fraction we happen to get here).
@@ -38,19 +38,22 @@ diff -ru pixman-0.40.0.orig/pixman/pixman-fast-path.c 
pixman-0.40.0/pixman/pixma
  
        px = (x & 0xffff) >> x_phase_shift;
        py = (y & 0xffff) >> y_phase_shift;
-@@ -2836,7 +2836,7 @@
-       sgtot = CLIP (sgtot, 0, 0xff);
+@@ -2837,9 +2837,9 @@
        sbtot = CLIP (sbtot, 0, 0xff);
  
+ #ifdef WORDS_BIGENDIAN
+-      buffer[k] = (satot << 0) | (srtot << 8) | (sgtot << 16) | (sbtot << 24);
++      buffer[k] = (satot << 0) | (srtot << 8) | (sgtot << 16) | 
((uint32_t)sbtot << 24);
+ #else
 -      buffer[k] = (satot << 24) | (srtot << 16) | (sgtot << 8) | (sbtot << 0);
 +      buffer[k] = ((uint32_t)satot << 24) | (srtot << 16) | (sgtot << 8) | 
(sbtot << 0);
+ #endif
  
      next:
-       vx += ux;
-diff -ru pixman-0.40.0.orig/pixman/pixman-sse2.c 
pixman-0.40.0/pixman/pixman-sse2.c
---- misc/pixman-0.40.0.orig/pixman/pixman-sse2.c       2021-08-29 
20:02:33.716514925 +0100
-+++ misc/build/pixman-0.40.0/pixman/pixman-sse2.c      2021-08-29 
20:05:43.306930095 +0100
-@@ -3344,7 +3344,7 @@
+diff -ru pixman-0.42.2.orig/pixman/pixman-sse2.c 
pixman-0.42.2/pixman/pixman-sse2.c
+--- misc/pixman-0.42.2/pixman/pixman-sse2.c    2022-02-02 05:51:25.000000000 
+0900
++++ misc/build/pixman-0.42.2/pixman/pixman-sse2.c   2022-11-28 
22:11:19.276969466 +0900
+@@ -3345,7 +3345,7 @@
  
        b = filler & 0xff;
        w = (b << 8) | b;
@@ -59,9 +62,9 @@ diff -ru pixman-0.40.0.orig/pixman/pixman-sse2.c 
pixman-0.40.0/pixman/pixman-sse
      }
      else if (bpp == 16)
      {
-diff -ru pixman-0.40.0.orig/pixman/pixman-utils.c 
pixman-0.40.0/pixman/pixman-utils.c
---- misc/pixman-0.40.0.orig/pixman/pixman-utils.c      2021-08-29 
20:02:33.715514970 +0100
-+++ misc/build/pixman-0.40.0/pixman/pixman-utils.c     2021-08-29 
20:05:43.306930095 +0100
+diff -ru pixman-0.42.2.orig/pixman/pixman-utils.c 
pixman-0.42.2/pixman/pixman-utils.c
+--- misc/pixman-0.42.2.orig/pixman/pixman-utils.c      2022-02-02 
05:51:25.000000000 +0900
++++ misc/build/pixman-0.42.2/pixman/pixman-utils.c     2022-11-28 
21:55:44.196964912 +0900
 @@ -213,7 +213,7 @@
        g = float_to_unorm (src[i].g, 8);
        b = float_to_unorm (src[i].b, 8);
commit 21060da35436cd567f26e309562c38fc8ad20cbe
Author:     Miklos Vajna <[email protected]>
AuthorDate: Wed Nov 16 13:37:33 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:38:22 2023 +0100

    Update freetype to 2.12.0
    
    - fixes CVE-2022-27404
    - dropped the no longer applying parts of ubsan.patch
    
    Change-Id: Ia8a496d53b62f68a27dbd9be08c89273b6bd01cd
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/142768
    Tested-by: Jenkins
    Reviewed-by: Miklos Vajna <[email protected]>
    (cherry picked from commit 7229a380d3d607dc896e1d48b1a13f7b301aef80)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/142927
    Reviewed-by: Michael Stahl <[email protected]>

diff --git a/download.lst b/download.lst
index 82507e415d06..96053558cc50 100644
--- a/download.lst
+++ b/download.lst
@@ -96,8 +96,8 @@ export FONT_SCHEHERAZADE_SHA256SUM := 
251c8817ceb87d9b661ce1d5b49e732a0116add10a
 export FONT_SCHEHERAZADE_TARBALL := Scheherazade-2.100.zip
 export FREEHAND_SHA256SUM := 
0e422d1564a6dbf22a9af598535425271e583514c0f7ba7d9091676420de34ac
 export FREEHAND_TARBALL := libfreehand-0.1.2.tar.xz
-export FREETYPE_SHA256SUM := 
8bee39bd3968c4804b70614a0a3ad597299ad0e824bc8aad5ce8aaf48067bde7
-export FREETYPE_TARBALL := freetype-2.11.0.tar.xz
+export FREETYPE_SHA256SUM := 
ef5c336aacc1a079ff9262d6308d6c2a066dd4d2a905301c4adda9b354399033
+export FREETYPE_TARBALL := freetype-2.12.0.tar.xz
 export GLM_SHA256SUM := 
6bba5f032bed47c73ad9397f2313b9acbfb56253d0d0576b5873d3dcb25e99ad
 export GLM_TARBALL := glm-0.9.9.8.zip
 export GPGME_SHA256SUM := 
6c8cc4aedb10d5d4c905894ba1d850544619ee765606ac43df7405865de29ed0
diff --git a/external/freetype/ExternalProject_freetype.mk 
b/external/freetype/ExternalProject_freetype.mk
index 032e0362917a..2a61ac7d7be4 100644
--- a/external/freetype/ExternalProject_freetype.mk
+++ b/external/freetype/ExternalProject_freetype.mk
@@ -18,13 +18,19 @@ $(call gb_ExternalProject_get_state_target,freetype,build) :
        $(call gb_ExternalProject_run,build,\
                $(gb_RUN_CONFIGURE) ./configure \
                        --disable-shared \
+                       --with-pic \
                        --without-zlib \
                        --without-brotli \
                        --without-bzip2 \
                        --without-harfbuzz \
+                       --without-png \
                        --prefix=$(call 
gb_UnpackedTarball_get_dir,freetype/instdir) \
-                       --build=$(BUILD_PLATFORM) --host=$(HOST_PLATFORM) \
-                       CFLAGS="$(CFLAGS) $(if $(debug),-g) 
$(gb_VISIBILITY_FLAGS)" \
+                       $(gb_CONFIGURE_PLATFORMS) \
+                       CFLAGS="$(CFLAGS) \
+                               $(call 
gb_ExternalProject_get_build_flags,freetype) \
+                               $(gb_VISIBILITY_FLAGS) \
+                               $(gb_EMSCRIPTEN_CPPFLAGS)" \
+                       LDFLAGS="$(call 
gb_ExternalProject_get_link_flags,freetype)" \
                && $(MAKE) install \
                && touch $@     )
        $(call gb_Trace_EndRange,freetype,EXTERNAL)
diff --git a/external/freetype/UnpackedTarball_freetype.mk 
b/external/freetype/UnpackedTarball_freetype.mk
index 6f724d1776fc..076edb9e3d97 100644
--- a/external/freetype/UnpackedTarball_freetype.mk
+++ b/external/freetype/UnpackedTarball_freetype.mk
@@ -13,6 +13,9 @@ $(eval $(call 
gb_UnpackedTarball_set_tarball,freetype,$(FREETYPE_TARBALL),,freet
 
 $(eval $(call gb_UnpackedTarball_add_patches,freetype,\
        external/freetype/freetype-2.6.5.patch.1 \
+       external/freetype/ubsan.patch \
 ))
 
+$(eval $(call gb_UnpackedTarball_set_patchlevel,freetype,0))
+
 # vim: set noet sw=4 ts=4:
diff --git a/external/freetype/freetype-2.6.5.patch.1 
b/external/freetype/freetype-2.6.5.patch.1
index faae4bafddd4..c10c0bb38ea8 100644
--- a/external/freetype/freetype-2.6.5.patch.1
+++ b/external/freetype/freetype-2.6.5.patch.1
@@ -1,7 +1,7 @@
 diff -up freetype/builds/unix/configure.dt freetype/builds/unix/configure
 --- freetype/builds/unix/configure.dt  2017-02-01 22:14:45.206257952 +0100
 +++ freetype/builds/unix/configure     2017-02-01 22:16:31.076183707 +0100
-@@ -8887,7 +8887,7 @@
+@@ -9386,7 +9386,7 @@
        case $host_cpu in
        powerpc)
              # see comment about AmigaOS4 .so support
@@ -10,7 +10,7 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
              archive_expsym_cmds=''
          ;;
        m68k)
-@@ -8903,7 +8903,7 @@
+@@ -9402,7 +9402,7 @@
        allow_undefined_flag=unsupported
        # Joseph Beckenbach <[email protected]> says some releases of gcc
        # support --undefined.  This deserves some investigation.  FIXME
@@ -19,7 +19,7 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
        else
        ld_shlibs=no
        fi
-@@ -8937,7 +8937,7 @@
+@@ -9436,7 +9436,7 @@
        ;;
  
      haiku*)
@@ -28,7 +28,7 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
        link_all_deplibs=yes
        ;;
  
-@@ -9032,13 +9032,13 @@
+@@ -9531,13 +9531,13 @@
        *Sun\ F*)                       # Sun Fortran 8.3
          tmp_sharedflag='-G' ;;
        esac
@@ -44,7 +44,7 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
          fi
  
        case $cc_basename in
-@@ -9068,8 +9068,8 @@
+@@ -9567,8 +9567,8 @@
        archive_cmds='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
        wlarc=
        else
@@ -55,7 +55,7 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
        fi
        ;;
  
-@@ -9087,8 +9087,8 @@
+@@ -9586,8 +9586,8 @@
  
  _LT_EOF
        elif $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; 
then
@@ -66,7 +66,7 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
        else
        ld_shlibs=no
        fi
-@@ -9116,8 +9116,8 @@
+@@ -9615,8 +9615,8 @@
          # requires that you compile everything twice, which is a pain.
          if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; 
then
            hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
@@ -77,7 +77,7 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
          else
            ld_shlibs=no
          fi
-@@ -9134,8 +9134,8 @@
+@@ -9633,8 +9633,8 @@
  
      *)
        if $LD --help 2>&1 | $GREP ': supported targets:.* elf' > /dev/null; 
then
@@ -88,7 +88,7 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
        else
        ld_shlibs=no
        fi
-@@ -9434,7 +9434,7 @@
+@@ -9937,7 +9937,7 @@
        case $host_cpu in
        powerpc)
              # see comment about AmigaOS4 .so support
@@ -97,7 +97,7 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
              archive_expsym_cmds=''
          ;;
        m68k)
-@@ -9703,7 +9703,7 @@
+@@ -10207,7 +10207,7 @@
  
      irix5* | irix6* | nonstopux*)
        if test yes = "$GCC"; then
@@ -106,16 +106,16 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
        # Try to use the -exported_symbol ld option, if it does not
        # work, assume that -exports_file does not work either and
        # implicitly export all symbols.
-@@ -9731,7 +9731,7 @@
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: $lt_cv_irix_exported_symbol" 
>&5
- $as_echo "$lt_cv_irix_exported_symbol" >&6; }
+@@ -10237,7 +10237,7 @@
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: 
$lt_cv_irix_exported_symbol" >&5
+ printf "%s\n" "$lt_cv_irix_exported_symbol" >&6; }
        if test yes = "$lt_cv_irix_exported_symbol"; then
 -          archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs 
$compiler_flags $wl-soname $wl$soname `test -n "$verstring" && func_echo_all 
"$wl-set_version $wl$verstring"` $wl-update_registry 
$wl$output_objdir/so_locations $wl-exports_file $wl$export_symbols -o $lib'
 +          archive_expsym_cmds='$CC -shared $pic_flag $libobjs $deplibs 
$compiler_flags `test -n "$verstring" && func_echo_all "$wl-set_version 
$wl$verstring"` $wl-update_registry $wl$output_objdir/so_locations 
$wl-exports_file $wl$export_symbols -o $lib'
        fi
        else
        archive_cmds='$CC -shared $libobjs $deplibs $compiler_flags -soname 
$soname `test -n "$verstring" && func_echo_all "-set_version $verstring"` 
-update_registry $output_objdir/so_locations -o $lib'
-@@ -9826,7 +9826,7 @@
+@@ -10332,7 +10332,7 @@
      osf3*)
        if test yes = "$GCC"; then
        allow_undefined_flag=' $wl-expect_unresolved $wl\*'
@@ -124,7 +124,7 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
        else
        allow_undefined_flag=' -expect_unresolved \*'
        archive_cmds='$CC -shared$allow_undefined_flag $libobjs $deplibs 
$compiler_flags -soname $soname `test -n "$verstring" && func_echo_all 
"-set_version $verstring"` -update_registry $output_objdir/so_locations -o $lib'
-@@ -9839,7 +9839,7 @@
+@@ -10345,7 +10345,7 @@
      osf4* | osf5*)    # as osf3* with the addition of -msym flag
        if test yes = "$GCC"; then
        allow_undefined_flag=' $wl-expect_unresolved $wl\*'
@@ -133,7 +133,7 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
        hardcode_libdir_flag_spec='$wl-rpath $wl$libdir'
        else
        allow_undefined_flag=' -expect_unresolved \*'
-@@ -13254,10 +13254,10 @@
+@@ -13620,10 +13620,10 @@
    XX_CFLAGS="-Wall"
    case "$host" in
    *-*-mingw*)
@@ -146,13 +146,12 @@ diff -up freetype/builds/unix/configure.dt 
freetype/builds/unix/configure
      ;;
    *)
      XX_ANSIFLAGS=""
-@@ -13294,7 +13294,7 @@
- if ac_fn_c_try_compile "$LINENO"; then :
-   { $as_echo "$as_me:${as_lineno-$LINENO}: result: ok, adding to 
XX_ANSIFLAGS" >&5
- $as_echo "ok, adding to XX_ANSIFLAGS" >&6; }
+@@ -13661,7 +13661,7 @@
+ then :
+   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ok, adding to 
XX_ANSIFLAGS" >&5
+ printf "%s\n" "ok, adding to XX_ANSIFLAGS" >&6; }
 -         XX_ANSIFLAGS="${XX_ANSIFLAGS} ${a}"
 +         XX_ANSIFLAGS="${XX_ANSIFLAGS}"
  
- else
-   { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-diff -up freetype/configure.dt freetype/configure
+ else $as_nop
+   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
diff --git a/external/freetype/ubsan.patch b/external/freetype/ubsan.patch
new file mode 100644
index 000000000000..c8173eeff531
--- /dev/null
+++ b/external/freetype/ubsan.patch
@@ -0,0 +1,11 @@
+--- src/truetype/ttgxvar.c
++++ src/truetype/ttgxvar.c
+@@ -964,7 +964,7 @@
+     /* in the OpenType specification.                  */
+ 
+     varData  = &itemStore->varData[outerIndex];
+-    deltaSet = &varData->deltaSet[varData->regionIdxCount * innerIndex];
++    deltaSet = varData->regionIdxCount * innerIndex == 0 ? varData->deltaSet 
: &varData->deltaSet[varData->regionIdxCount * innerIndex];
+ 
+     /* outer loop steps through master designs to be blended */
+     for ( master = 0; master < varData->regionIdxCount; master++ )
commit 65bed853b1f4522178153a97e871cc426eecaaa0
Author:     Taichi Haradaguchi <[email protected]>
AuthorDate: Mon Oct 31 00:20:55 2022 +0900
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:33:46 2023 +0100

    upgrade Expat to 2.5.0
    
    Fixes CVE-2022-43680
    
    Change-Id: I5bf8d1ab0ac352833c76a7edfc1d8eb78dd03e10
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/142205
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/download.lst b/download.lst
index 92078e1d7b65..82507e415d06 100644
--- a/download.lst
+++ b/download.lst
@@ -50,8 +50,8 @@ export EPUBGEN_TARBALL := libepubgen-0.1.1.tar.xz
 export ETONYEK_SHA256SUM := 
b430435a6e8487888b761dc848b7981626eb814884963ffe25eb26a139301e9a
 export ETONYEK_VERSION_MICRO := 10
 export ETONYEK_TARBALL := libetonyek-0.1.$(ETONYEK_VERSION_MICRO).tar.xz
-export EXPAT_SHA256SUM := 
6e8c0728fe5c7cd3f93a6acce43046c5e4736c7b4b68e032e9350daa0efc0354
-export EXPAT_TARBALL := expat-2.4.9.tar.xz
+export EXPAT_SHA256SUM := 
ef2420f0232c087801abf705e89ae65f6257df6b7931d37846a193ef2e8cdcbe
+export EXPAT_TARBALL := expat-2.5.0.tar.xz
 export FIREBIRD_SHA256SUM := 
acb85cedafa10ce106b1823fb236b1b3e5d942a5741e8f8435cc8ccfec0afe76
 export FIREBIRD_TARBALL := Firebird-3.0.7.33374-0.tar.bz2
 export FONTCONFIG_SHA256SUM := 
a5f052cb73fd479ffb7b697980510903b563bbb55b8f7a2b001fcfb94026003c
diff --git a/external/expat/expat-winapi.patch 
b/external/expat/expat-winapi.patch
index 7eae7d5d6139..fed65644a732 100644
--- a/external/expat/expat-winapi.patch
+++ b/external/expat/expat-winapi.patch
@@ -1,6 +1,6 @@
---- misc/expat-2.1.0/lib/expat_external.h      2009-11-16 08:53:17.375000000 
+0000
-+++ misc/build/expat-2.1.0/lib/expat_external.h        2009-11-16 
08:53:34.703125000 +0000
-@@ -81,10 +81,6 @@
+--- misc/expat-2.5.0/lib/expat_external.h      2022-10-25 01:32:54.000000000 
+0900
++++ misc/build/expat-2.5.0/lib/expat_external.h        2022-10-30 
23:09:47.339459134 +0900
+@@ -88,10 +88,6 @@
  #  ifndef XML_BUILDING_EXPAT
  /* using Expat from an application */
  
@@ -11,12 +11,13 @@
  #  endif
  #endif /* not defined XML_STATIC */
  
---- misc/expat-2.1.0/lib/xmlparse.c    2021-05-23 16:56:25.000000000 +0100
-+++ misc/build/expat-2.1.0/lib/xmlparse.c      2021-05-25 12:42:11.997173600 
+0100
-@@ -64,6 +64,8 @@
+--- misc/expat-2.5.0/lib/xmlparse.c    2022-10-26 00:09:08.000000000 +0900
++++ misc/build/expat-2.5.0/lib/xmlparse.c      2022-10-30 23:09:01.843006341 
+0900
+@@ -67,6 +67,9 @@
  #endif
  
  #ifdef _WIN32
++#  undef HAVE_ARC4RANDOM_BUF
 +#  undef HAVE_GETRANDOM
 +#  undef HAVE_SYSCALL_GETRANDOM
  /* force stdlib to define rand_s() */
commit 3da6129a10240505efa918c2b86e12fb1351d9b3
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed Nov 2 20:29:51 2022 +0100
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:33:38 2023 +0100

    upgrade to openssl-1.1.1s
    
    Change-Id: Ic0f1fca7ef73b3a443c24d2bcc7f234be331a05b
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/142184
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>

diff --git a/download.lst b/download.lst
index 253aaf07016d..92078e1d7b65 100644
--- a/download.lst
+++ b/download.lst
@@ -202,8 +202,8 @@ export OFFICEOTRON_SHA256SUM := 
f2443f27561af52324eee03a1892d9f569adc8db9e7bca55
 export OFFICEOTRON_JAR := 
8249374c274932a21846fa7629c2aa9b-officeotron-0.7.4-master.jar
 export OPENLDAP_SHA256SUM := 
99f37d6747d88206c470067eda624d5e48c1011e943ec0ab217bae8712e22f34
 export OPENLDAP_TARBALL := openldap-2.4.59.tgz
-export OPENSSL_SHA256SUM := 
d7939ce614029cdff0b6c20f0e2e5703158a489a72b2507b8bd51bf8c8fd10ca
-export OPENSSL_TARBALL := openssl-1.1.1q.tar.gz
+export OPENSSL_SHA256SUM := 
c5ac01e760ee6ff0dab61d6b2bbd30146724d063eb322180c6f18a6f74e4b6aa
+export OPENSSL_TARBALL := openssl-1.1.1s.tar.gz
 export ORCUS_SHA256SUM := 
2a86c405a5929f749b27637509596421d46805753364ab258b035fd01fbde143
 export ORCUS_TARBALL := liborcus-0.17.2.tar.bz2
 export PAGEMAKER_SHA256SUM := 
66adacd705a7d19895e08eac46d1e851332adf2e736c566bef1164e7a442519d
commit 46872c0173aef5dad943aaa1b39970ad201d2b7c
Author:     Adolfo Jayme Barrientos <[email protected]>
AuthorDate: Sun Jan 1 03:26:25 2023 -0600
Commit:     Andras Timar <[email protected]>
CommitDate: Sun Jan 29 15:31:34 2023 +0100

    Bump copyright year to 2023
    
    Change-Id: I699112a3e554013bab75b82d1eae00098216c886
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144893
    Tested-by: Jenkins
    Reviewed-by: Adolfo Jayme Barrientos <[email protected]>

diff --git a/compilerplugins/LICENSE.TXT b/compilerplugins/LICENSE.TXT
index 9c9d2864970e..1e8587c1cce9 100644
--- a/compilerplugins/LICENSE.TXT
+++ b/compilerplugins/LICENSE.TXT
@@ -1,7 +1,7 @@
 University of Illinois/NCSA
 Open Source License
 
-Copyright (c) 2012-2022 The Document Foundation
+Copyright (c) 2012-2023 The Document Foundation
 All rights reserved.
 
 Developed by:
diff --git a/cui/inc/strings.hrc b/cui/inc/strings.hrc
index adbb46043ce9..127598b74957 100644
--- a/cui/inc/strings.hrc
+++ b/cui/inc/strings.hrc
@@ -367,7 +367,7 @@
 
 #define RID_SVXSTR_CANNOTCONVERTURL_ERR             
NC_("RID_SVXSTR_CANNOTCONVERTURL_ERR", "The URL <%1> cannot be converted to a 
filesystem path.")
 
-#define RID_SVXSTR_ABOUT_COPYRIGHT                  
NC_("aboutdialog|copyright", "Copyright © 2000–2022 LibreOffice contributors.")
+#define RID_SVXSTR_ABOUT_COPYRIGHT                  
NC_("aboutdialog|copyright", "Copyright © 2000–2023 LibreOffice contributors.")
 #define RID_SVXSTR_ABOUT_CREDITS_URL                NC_("aboutdialog|link", 
"https://www.libreoffice.org/about-us/credits/";)
 #define RID_SVXSTR_ABOUT_VENDOR                     NC_("aboutdialog|vendor", 
"This release was supplied by %OOOVENDOR.")
 #define RID_SVXSTR_ABOUT_BASED_ON                   
NC_("aboutdialog|libreoffice", "LibreOffice was based on OpenOffice.org.")
diff --git a/odk/docs/install.html b/odk/docs/install.html
index 61bf4cc83f0c..08e20e7bc885 100644
--- a/odk/docs/install.html
+++ b/odk/docs/install.html
@@ -534,7 +534,7 @@
         </div>
         <div id="Footer">
           <div id="FooterText">
-            <p>Copyright © 2000–2022 LibreOffice contributors. All rights
+            <p>Copyright © 2000–2023 LibreOffice contributors. All rights
               reserved.<br/>
               LibreOffice was created by The Document Foundation, based on
               Apache OpenOffice, which is Copyright 2011 The Apache Software
diff --git a/odk/docs/tools.html b/odk/docs/tools.html
index 2785f9f3eb64..2c86953febb8 100644
--- a/odk/docs/tools.html
+++ b/odk/docs/tools.html
@@ -911,7 +911,7 @@ types the specified types depend on.</p>
                 <div id="Footer">
                     <div id="FooterText">
                         <p>
-                            Copyright © 2000–2022 LibreOffice contributors. 
All rights reserved.
+                            Copyright © 2000–2023 LibreOffice contributors. 
All rights reserved.
                             <br/>
                             LibreOffice was created by The Document Foundation,
                             based on Apache OpenOffice, which is Copyright 
2011,
diff --git a/odk/examples/DevelopersGuide/examples.html 
b/odk/examples/DevelopersGuide/examples.html
index f58800daf105..f5dd999fe7eb 100644
--- a/odk/examples/DevelopersGuide/examples.html
+++ b/odk/examples/DevelopersGuide/examples.html
@@ -2856,7 +2856,7 @@ for the Office application.</td>
                 <div id="Footer">
                     <div id="FooterText">
                         <p>
-                            Copyright © 2000–2022 LibreOffice contributors. 
All rights reserved.
+                            Copyright © 2000–2023 LibreOffice contributors. 
All rights reserved.
                             <br/>
                             LibreOffice was created by The Document Foundation,
                             based on Apache OpenOffice, which is Copyright 2011
diff --git a/odk/examples/examples.html b/odk/examples/examples.html
index 9383e3a23cb0..9af563bd635a 100644
--- a/odk/examples/examples.html
+++ b/odk/examples/examples.html
@@ -815,7 +815,7 @@
                 <div id="Footer">
                     <div id="FooterText">
                         <p>
-                            Copyright © 2000–2022 LibreOffice contributors. 
All rights reserved.
+                            Copyright © 2000–2023 LibreOffice contributors. 
All rights reserved.
                             <br/>
                             LibreOffice was created by The Document Foundation,
                             based on Apache OpenOffice, which is Copyright 2011
diff --git a/odk/index.html b/odk/index.html
index 7ed6ffd66226..cb39ca72f3bc 100644
--- a/odk/index.html
+++ b/odk/index.html
@@ -189,7 +189,7 @@
                 <div id="Footer">
                     <div id="FooterText">
                         <p>
-                            Copyright &copy; 2000–2022 LibreOffice 
contributors. All rights reserved.
+                            Copyright &copy; 2000–2023 LibreOffice 
contributors. All rights reserved.
                             <br/>
                             LibreOffice was created by The Document Foundation,
                             based on Apache OpenOffice, which is Copyright 2011
diff --git a/odk/index_online.html b/odk/index_online.html
index 30d181c9bf2a..417d21e55429 100644
--- a/odk/index_online.html
+++ b/odk/index_online.html
@@ -234,7 +234,7 @@
                 <div id="Footer">
                     <div id="FooterText">
                         <p>
-                            Copyright © 2000–2022 LibreOffice contributors. 
All rights reserved.
+                            Copyright © 2000–2023 LibreOffice contributors. 
All rights reserved.
                             <br>
                             LibreOffice was created by The Document 
Foundation, based on Apache OpenOffice, which is Copyright 2011 The Apache 
Software Foundation.
                             <br>
diff --git a/readlicense_oo/license/license.xml 
b/readlicense_oo/license/license.xml
index a5eab5d0dcf5..4b355489e7bf 100644
--- a/readlicense_oo/license/license.xml
+++ b/readlicense_oo/license/license.xml
@@ -13,7 +13,7 @@
     <p>Third Party Code Additional copyright notices and license terms 
applicable to portions of the Software can be
     found <a href="#thirdparty">below</a> in this document.</p>
     <p>All trademarks and registered trademarks mentioned herein are the 
property of their respective owners.</p>
-    <p>Copyright © 2000–2022 LibreOffice contributors. All rights reserved.</p>
+    <p>Copyright © 2000–2023 LibreOffice contributors. All rights reserved.</p>
     <p>This product is based on OpenOffice.org. Portions of this software are 
copyright © 2000-2011, Oracle and/or its
     affiliates.</p>
     <p>This product has been created by The Document Foundation, incorporating 
many modifications from different
diff --git a/setup_native/source/packinfo/packinfo_brand.txt 
b/setup_native/source/packinfo/packinfo_brand.txt
index 1118ffc11690..f8e4de457c66 100644
--- a/setup_native/source/packinfo/packinfo_brand.txt
+++ b/setup_native/source/packinfo/packinfo_brand.txt
@@ -22,7 +22,7 @@ solarispackagename = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION"
 packagename = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION"
 requires = "%UREPACKAGEPREFIX%BRANDPACKAGEVERSION-ure %PACKAGEVERSION 
%PACKAGEVERSION-%PACKAGEREVISION,%BASISPACKAGEPREFIX%PRODUCTVERSION-core 
%PACKAGEVERSION 
%PACKAGEVERSION-%PACKAGEREVISION,%BASISPACKAGEPREFIX%PRODUCTVERSION-images 
%PACKAGEVERSION %PACKAGEVERSION-%PACKAGEREVISION"
 solarisrequires = "%SOLSUREPACKAGEPREFIX%BRANDPACKAGEVERSION-ure (Name="UNO 
Runtime Environment"), %BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-core 
(Name="Core module for %PRODUCTNAME %PRODUCTVERSION"), 
%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-images (Name="Images module for 
%PRODUCTNAME %PRODUCTVERSION")"
-copyright = "2022 The Document Foundation"
+copyright = "2023 The Document Foundation"
 solariscopyright = "solariscopyrightfile"
 vendor = "The Document Foundation"
 description = "Brand module for %PRODUCTNAME %PRODUCTVERSION"
@@ -36,7 +36,7 @@ solarispackagename = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION-writer"
 packagename = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION-writer"
 requires = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION %PACKAGEVERSION 
%PACKAGEVERSION-%PACKAGEREVISION,%BASISPACKAGEPREFIX%PRODUCTVERSION-writer 
%PACKAGEVERSION %PACKAGEVERSION-%PACKAGEREVISION"
 solarisrequires = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION,%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-writer"
-copyright = "2022 The Document Foundation"
+copyright = "2023 The Document Foundation"
 solariscopyright = "solariscopyrightfile"
 vendor = "The Document Foundation"
 description = "Writer brand module for %PRODUCTNAME %PRODUCTVERSION"
@@ -50,7 +50,7 @@ solarispackagename = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION-calc"
 packagename = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION-calc"
 requires = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION %PACKAGEVERSION 
%PACKAGEVERSION-%PACKAGEREVISION,%BASISPACKAGEPREFIX%PRODUCTVERSION-calc 
%PACKAGEVERSION %PACKAGEVERSION-%PACKAGEREVISION"
 solarisrequires = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION,%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-calc"
-copyright = "2022 The Document Foundation"
+copyright = "2023 The Document Foundation"
 solariscopyright = "solariscopyrightfile"
 vendor = "The Document Foundation"
 description = "Calc brand module for %PRODUCTNAME %PRODUCTVERSION"
@@ -64,7 +64,7 @@ solarispackagename = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION-impress"
 packagename = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION-impress"
 requires = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION %PACKAGEVERSION 
%PACKAGEVERSION-%PACKAGEREVISION,%BASISPACKAGEPREFIX%PRODUCTVERSION-impress 
%PACKAGEVERSION %PACKAGEVERSION-%PACKAGEREVISION"
 solarisrequires = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION,%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-impress"
-copyright = "2022 The Document Foundation"
+copyright = "2023 The Document Foundation"
 solariscopyright = "solariscopyrightfile"
 vendor = "The Document Foundation"
 description = "Impress brand module for %PRODUCTNAME %PRODUCTVERSION"
@@ -78,7 +78,7 @@ solarispackagename = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION-draw"
 packagename = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION-draw"
 requires = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION %PACKAGEVERSION 
%PACKAGEVERSION-%PACKAGEREVISION,%BASISPACKAGEPREFIX%PRODUCTVERSION-draw 
%PACKAGEVERSION %PACKAGEVERSION-%PACKAGEREVISION"
 solarisrequires = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION,%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-draw"
-copyright = "2022 The Document Foundation"
+copyright = "2023 The Document Foundation"
 solariscopyright = "solariscopyrightfile"
 vendor = "The Document Foundation"
 description = "Draw brand module for %PRODUCTNAME %PRODUCTVERSION"
@@ -92,7 +92,7 @@ solarispackagename = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION-math"
 packagename = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION-math"
 requires = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION %PACKAGEVERSION 
%PACKAGEVERSION-%PACKAGEREVISION,%BASISPACKAGEPREFIX%PRODUCTVERSION-math 
%PACKAGEVERSION %PACKAGEVERSION-%PACKAGEREVISION"
 solarisrequires = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION,%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-math"
-copyright = "2022 The Document Foundation"
+copyright = "2023 The Document Foundation"
 solariscopyright = "solariscopyrightfile"
 vendor = "The Document Foundation"
 description = "Math brand module for %PRODUCTNAME %PRODUCTVERSION"
@@ -106,7 +106,7 @@ solarispackagename = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION-base"
 packagename = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION-base"
 requires = "%UNIXPACKAGENAME%BRANDPACKAGEVERSION %PACKAGEVERSION 
%PACKAGEVERSION-%PACKAGEREVISION,%BASISPACKAGEPREFIX%PRODUCTVERSION-base 
%PACKAGEVERSION %PACKAGEVERSION-%PACKAGEREVISION"
 solarisrequires = 
"%WITHOUTDOTUNIXPACKAGENAME%BRANDPACKAGEVERSION,%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-base"
-copyright = "2022 The Document Foundation"
+copyright = "2023 The Document Foundation"
 solariscopyright = "solariscopyrightfile"
 vendor = "The Document Foundation"
 description = "Base brand module for %PRODUCTNAME %PRODUCTVERSION"

... etc. - the rest is truncated

Reply via email to