diff --git a/.github/renovate.json b/.github/renovate.json
index ff9aa63..1219f48 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -51,6 +51,12 @@
             ],
             "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.?(?<patch>\\d+)?$"
         },
+        {
+            "matchPackageNames": [
+                "Perl/perl5"
+            ],
+            "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d[02468]+)\\.(?<patch>\\d+)$"
+        },
         {
             "matchPackagePatterns": [
                 "*"
diff --git a/Makefile b/Makefile
index 2e050aa..faa7369 100644
--- a/Makefile
+++ b/Makefile
@@ -11,7 +11,7 @@ SOURCE_DATE_EPOCH ?= "1559830076"
 
 # Sync bldr image with Pkgfile
 BLDR ?= docker run --rm --volume $(PWD):/tools --entrypoint=/bldr \
-	ghcr.io/siderolabs/bldr:v0.2.0-alpha.8-frontend graph --root=/tools
+	ghcr.io/siderolabs/bldr:v0.2.0-alpha.10 graph --root=/tools
 
 BUILD := docker buildx build
 PLATFORM ?= linux/amd64,linux/arm64
diff --git a/Pkgfile b/Pkgfile
index ee519cd..335f913 100644
--- a/Pkgfile
+++ b/Pkgfile
@@ -1,11 +1,11 @@
-# syntax = ghcr.io/siderolabs/bldr:v0.2.0-alpha.8-frontend
+# syntax = ghcr.io/siderolabs/bldr:v0.2.0-alpha.10
 
 # Sync bldr image with Makefile
 
 format: v1alpha2
 
 vars:
-  TOOLCHAIN_IMAGE: ghcr.io/siderolabs/toolchain:v0.6.0-2-gee7deca
+  TOOLCHAIN_IMAGE: ghcr.io/siderolabs/toolchain:v0.6.0-9-g1b97abc
 
   # renovate: datasource=github-tags depName=argp-standalone/argp-standalone
   argp_standalone_version: 1.5.0
@@ -13,24 +13,24 @@ vars:
   argp_standalone_sha512: fa2eb61ea00f7a13385e5c1e579dd88471d6ba3a13b6353e924fe71914b90b40688b42a9f1789bc246e03417fee1788b1990753cda8c8d4a544e85f26b63f9e2
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.savannah.gnu.org/autoconf.git
-  autoconf_version: 2.69
-  autoconf_sha256: 64ebcec9f8ac5b2487125a86a7760d2591ac9e1d3dbd59489633f9de62a57684
-  autoconf_sha512: 995d3e5a8eb1eb37e2b7fae53c6ec7a9b4df997286b7d643344818f94636756b1bf5ff5ea9155e755cb9461149a853dfbf2886fc6bd7132e5afa9c168e306e9b
+  autoconf_version: 2.71
+  autoconf_sha256: f14c83cfebcc9427f2c3cea7258bd90df972d92eb26752da4ddad81c87a0faa4
+  autoconf_sha512: 73d32b4adcbe24e3bafa9f43f59ed3b6efbd3de0f194e5ec90375f35da1199c583f5d3e89139b7edbad35171403709270e339ffa56a2ecb9b3123e9285021ff0
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.savannah.gnu.org/automake.git
-  automake_version: 1.16.1
-  automake_sha256: 5d05bb38a23fd3312b10aea93840feec685bdf4a41146e78882848165d3ae921
-  automake_sha512: 4013bd31f4903b10875caa7d6ac16a14623a4eb91aa758924dee5b990e234fb50848d131e2dbdbbbc32f89c41a14f9c52a0064c37aa6760c524d607b354b13c3
+  automake_version: 1.16.5
+  automake_sha256: f01d58cd6d9d77fbdca9eb4bbd5ead1988228fdb73d6f7a201f5f8d6b118b469
+  automake_sha512: 3084ae543aa3fb5a05104ffb2e66cfa9a53080f2343c44809707fd648516869511500dba50dae67ff10f92a1bf3b5a92b2a0fa01cda30adb69b9da03994d9d88
 
   # renovate: datasource=git-tags extractVersion=^bash-(?<version>.*)$ depName=git://git.savannah.gnu.org/bash.git
-  bash_version: 4.4.18
-  bash_sha256: 604d9eec5e4ed5fd2180ee44dd756ddca92e0b6aa4217bbab2b6227380317f23
-  bash_sha512: bd3048338aded9dee31651011aaa46bc8fba83a27fa063e3d47bcbe85ebbd86816d9080d1a658cfbd1736a2c80e98fdb659019c192d332472b00aa305e0285b0
+  bash_version: 5.1
+  bash_sha256: cc012bc860406dcf42f64431bcd3d2fa7560c02915a601aba9cd597a39329baa
+  bash_sha512: c44a0ce381469219548a3a27589af3fea4f22eda1ca4e9434b59fc16da81b471c29ce18e31590e0860a6a251a664b68c2b45e3a17d22cfc02799ffd9a208390c
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.savannah.gnu.org/bison.git
-  bison_version: 3.0.5
-  bison_sha256: 075cef2e814642e30e10e8155e93022e4a91ca38a65aa1d5467d4e969f97f338
-  bison_sha512: 00b448db8abe91b07e32ff5273c6617bc1350d806f92073a9472f4c2f0de5d22c152795674171b74f2eb9eff8d36f8173b82dacb215601bb071ae39404d4a8a2
+  bison_version: 3.8.2
+  bison_sha256: 9bba0214ccf7f1079c5d59210045227bcf619519840ebfa80cd3849cff5a5bf2
+  bison_sha512: d4d23af6671406e97257892f90651b67f2ab95219831372be032190b7156c10a3435d457857e677445df8b2327aacccc15344acbbc3808a6f332a93cce23b444
 
   # renovate: datasource=git-tags extractVersion=^bzip2-(?<version>.*)$ depName=git://sourceware.org/git/bzip2.git
   bzip2_version: 1.0.8
@@ -38,9 +38,9 @@ vars:
   bzip2_sha512: 083f5e675d73f3233c7930ebe20425a533feedeaaa9d8cc86831312a6581cefbe6ed0d08d2fa89be81082f2a5abdabca8b3c080bf97218a1bd59dc118a30b9f3
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=https://gitlab.kitware.com/cmake/cmake.git
-  cmake_version: 3.18.1
-  cmake_sha256: c0e3338bd37e67155b9d1e9526fec326b5c541f74857771b7ffed0c46ad62508
-  cmake_sha512: e0591d5fb234f3e7b74d6d2aad44fbf3e19e69547bd428681ba6ad0461d4f3d2a154605808b4733531d2c66f0e91eb39a179ae0d89a37e92a3f20e9cae691468
+  cmake_version: 3.24.1
+  cmake_sha256: 4931e277a4db1a805f13baa7013a7757a0cbfe5b7932882925c7061d9d1fa82b
+  cmake_sha512: 67bfafcf9ceba617d7ebbb0ac88b689a2d90ab51fea4a83bd073ee082fb55de8962ce7fb283f3db5f455d286f2199843ffa595a1de207d4fa3e4472d951eb289
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.savannah.gnu.org/coreutils.git
   coreutils_version: 9.1
@@ -58,19 +58,19 @@ vars:
   curl_sha512: 86231866a35593a1637fbc0c6af3b6761bdfd99fb35580cc52970c36f19604f93dce59fea67a1d5bb4b455f719307599c7916c77d14f2b661f6bf7fb1ca716ce
 
   # renovate: datasource=git-tags extractVersion=^dejagnu-(?<version>.*)-release$ versioning=loose depName=git://git.savannah.gnu.org/dejagnu.git
-  dejagnu_version: 1.6.1
-  dejagnu_sha256: bf5b28bb797e0ace4cfc0766a996339c795d8223bef54158be7887046bc01692
-  dejagnu_sha512: 887aa7c8b8698fe193f393b75479aad2c0724d6baa52e6f7172c48172f6546956c5f932afb574ba38b7c79e630981eeaf1d6d3c9edb3862ab5f39c5c09dce682
+  dejagnu_version: 1.6.3
+  dejagnu_sha256: 87daefacd7958b4a69f88c6856dbd1634261963c414079d0c371f589cd66a2e3
+  dejagnu_sha512: 1a737132bd912cb527e7f2fcbe70ffff8ccc8604a0ffdecff87ba2a16aeeefd800f5792aeffdbe79be6daa35cedb1c60e41002ca4aabb5370a460028191b76c4
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.savannah.gnu.org/diffutils.git
-  diffutils_version: 3.6
-  diffutils_sha256: d621e8bdd4b573918c8145f7ae61817d1be9deb4c8d2328a65cea8e11d783bd6
-  diffutils_sha512: 3c159ff1cb7c901b0a57518483566b5740ca3c45aeb8d3004089f052975481db52994cc18592c502c68b0d2a1e22f1f7830f0d8dd9a9ed86de96e28cce9f70c1
+  diffutils_version: 3.8
+  diffutils_sha256: a6bdd7d1b31266d11c4f4de6c1b748d4607ab0231af5188fc2533d0ae2438fec
+  diffutils_sha512: 279441270987e70d5ecfaf84b6285a4866929c43ec877e50f154a788858d548a8a316f2fc26ad62f7348c8d289cb29a09d06dfadce1806e3d8b4ea88c8b1aa7c
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/utils/dtc/dtc.git
-  dtc_version: 1.6.0
-  dtc_sha256: 10503b0217e1b07933e29e8d347a00015b2431bea5f59afe0bed3af30340c82d
-  dtc_sha512: 15433b24f1d6b7ed1f8066d050bd1bcbf988731aa38147564e3dd04b5f69af8d69e03befdc621a768526c620425a9bdd24aad4f9ff135930d6a1eeb0625f7de3
+  dtc_version: 1.6.1
+  dtc_sha256: 65cec529893659a49a89740bb362f507a3b94fc8cd791e76a8d6a2b6f3203473
+  dtc_sha512: 26cd351ddca411ab96b93ac3e763f817f9f8a80ca66a8707e1077f771ed8e7e04c01f321ab8ab27b2f9826d9d438483fe3156401493bfd29cef3cc71a1414568
 
   # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=davea42/libdwarf-code
   dwarfutils_version: 0.4.1
@@ -88,14 +88,14 @@ vars:
   expat_sha512: 46cc9d725f359b77681a2875bfefa15ceee50eb9513f6577607c0c5833dfa4241565c74f26b84b38d802c3cd8c32f00204fd74272bcecbd21229425764eef86c
 
   # renovate: datasource=github-tags extractVersion=^FILE(?<version>.*)$ depName=file/file
-  file_version: 5_34
-  file_sha256: cf6014a703b71767cc1b00a101e8147c9db267dba3c4fee972b2a359355389cb
-  file_sha512: 499df0346c9c5a7ac9e0e91da8ad67532bbc514dc6f5513ec90825cdbdc88dceb85108d099b0177f0ff3f2591183b19052515ebcd8aa5891b461452da18310e5
+  file_version: 5_42
+  file_sha256: d7374d06451154a628831df58e835fa3263825d0ad593df0fb8a911418d27863
+  file_sha512: 7df20a1818a59feaa92012c6e19c263db1ac006d19bdec9fd69f47da702dae040f53371f112c31c38e42a35279a668a9e98469bc19cc88bed781ba46db235942
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.savannah.gnu.org/findutils.git
-  findutils_version: 4.7.0
-  findutils_sha256: c5fefbdf9858f7e4feb86f036e1247a54c79fc2d8e4b7064d5aaa1f47dfa789a
-  findutils_sha512: 650a24507f8f4ebff83ad28dd27daa4785b4038dcaadc4fe00823b976e848527074cce3f9ec34065b7f037436d2aa6e9ec099bc05d7472c29864ac2c69de7f2e
+  findutils_version: 4.9.0
+  findutils_sha256: a2bfb8c09d436770edc59f50fa483e785b161a3b7b9d547573cb08065fd462fe
+  findutils_sha512: ba4844f4403de0148ad14b46a3dbefd5a721f6257c864bf41a6789b11705408524751c627420b15a52af95564d8e5b52f0978474f640a62ab86a41d20cf14be9
 
   # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=westes/flex
   flex_version: 2.6.4
@@ -103,30 +103,30 @@ vars:
   flex_sha512: e9785f3d620a204b7d20222888917dc065c2036cae28667065bf7862dfa1b25235095a12fd04efdbd09bfd17d3452e6b9ef953a8c1137862ff671c97132a082e
 
   # renovate: datasource=git-tags extractVersion=^gawk-(?<version>.*)$ depName=git://git.savannah.gnu.org/gawk.git
-  gawk_version: 4.2.1
-  gawk_sha256: d1119785e746d46a8209d28b2de404a57f983aa48670f4e225531d3bdc175551
-  gawk_sha512: 0e3006a795dc3ac91359a7d2590c0cccbfd39b18a1d491617d68505c55a2800355b1439050681b4fcacf65fb0d533151a046babe0fd774503037bab363ef2ae4
+  gawk_version: 5.2.0
+  gawk_sha256: e4ddbad1c2ef10e8e815ca80208d0162d4c983e6cca16f925e8418632d639018
+  gawk_sha512: e81e1efb1be06f82602e704d10e8de4b78797d058d9718d353e0837660dc8adf952965240c0a3b1a71c3e295f2e9641eacf64496d1d896edd81b101e09a656ac
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.savannah.gnu.org/gettext.git
-  gettext_version: 0.19.8.1
-  gettext_sha256: 105556dbc5c3fbbc2aa0edb46d22d055748b6f5c7cd7a8d99f8e7eb84e938be4
-  gettext_sha512: 3553227b62f2a7d9b67c881ef889c030a6a21d5ecd210c4bf3d649df0b37193a99a68cf8fd5f2c69b6a87e847035dd9576f9bcb9363422866e26b04f4f6dd431
+  gettext_version: 0.21
+  gettext_sha256: d20fcbb537e02dcf1383197ba05bd0734ef7bf5db06bdb241eb69b7d16b73192
+  gettext_sha512: f7e2968651879f8444d43a176a149db9f9411f4a03132a7f3b37c2ed97e3978ae6888169c995c1953cb78943b6e3573811abcbb8661b6631edbbe067b2699ddf
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.kernel.org/pub/scm/git/git.git
-  git_version: 2.37.1
-  git_sha256: c8162c6b8b8f1c5db706ab01b4ee29e31061182135dc27c4860224aaec1b3500
-  git_sha512: 3c9cad6b4757f425ee53996d8d80db2226b246513cbcec9011022e02e4235d7ec38c7c1aada73bb3c9279a91d1aaf8664633356ce1dce847e0d371f702a5b766
+  git_version: 2.37.3
+  git_sha256: 814641d7f61659cfbc17825d0462499ca1403e39ff53d76a8512050e6483e87a
+  git_sha512: 9120050b01d8ac8d9f9e85f19cb84dc90c28f3beadc3ea94da94845f2eb5e35aa83eee8447a7ecef5190b8eb5d01be621be2e82bb3020e51e05037cd1fa9b58f
 
   # official source code uses mercurial https://gmplib.org/devel/repo-usage, so falling back to a GitHub mirror,
   # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=alisw/GMP
-  gmp_version: 6.2.0
-  gmp_sha256: 258e6cd51b3fbdfc185c716d55f82c08aff57df0c6fbd143cf6ed561267a1526
-  gmp_sha512: a066f0456f0314a1359f553c49fc2587e484ff8ac390ff88537266a146ea373f97a1c0ba24608bf6756f4eab11c9056f103c8deb99e5b57741b4f7f0ec44b90c
+  gmp_version: 6.2.1
+  gmp_sha256: fd4829912cddd12f84181c3451cc752be224643e87fac497b69edddadc49b4f2
+  gmp_sha512: c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84
 
   # renovate: datasource=github-tags extractVersion=^go(?<version>.*)$ versioning=loose depName=golang/go
-  golang_version: 1.19
-  golang_sha256: 9419cc70dc5a2523f29a77053cafff658ed21ef3561d9b6b020280ebceab28b9
-  golang_sha512: c4460d54957a0bcf3407ea72cd1c6b3c645ef4ef6cc0fa142a80cb43c06ca4af31d52b0ccd723c81d17a62004bc96559cad23da874a4b668b4d8b168f1da2186
+  golang_version: 1.19.1
+  golang_sha256: 27871baa490f3401414ad793fba49086f6c855b1c584385ed7771e1204c7e179
+  golang_sha512: 7e8cf557f05d5a537f9305bb9c19cf8ab9ce640376e5ea97ff0d490b016364936e8dfc129462760c4e817af01fdf09e3f815b88412f9985bb254dfa3167752c0
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.savannah.gnu.org/gperf.git
   gperf_version: 3.1
@@ -134,9 +134,9 @@ vars:
   gperf_sha512: 855ebce5ff36753238a44f14c95be7afdc3990b085960345ca2caf1a2db884f7db74d406ce9eec2f4a52abb8a063d4ed000a36b317c9a353ef4e25e2cca9a3f4
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.savannah.gnu.org/grep.git
-  grep_version: 3.1
-  grep_sha256: db625c7ab3bb3ee757b3926a5cfa8d9e1c3991ad24707a83dde8a5ef2bf7a07e
-  grep_sha512: 05494381c7dd8aad7e2ee4c17450de8d7b969a99dcfe17747db60df3475bf02d5323d091e896e8343e4f3251c29dc7f0b7a9f93c575c9d58ee2a57014c2c9d26
+  grep_version: 3.8
+  grep_sha256: 498d7cc1b4fb081904d87343febb73475cf771e424fb7e6141aff66013abc382
+  grep_sha512: 2014519a80c6dcd799837e1bd7d9d5ebe8729ec54b0dc76981dac4755a9a8a9f200470cdcc911e2825bed8162e61da39e3dd60289f7393b48bf67314077d0c79
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.savannah.gnu.org/gzip.git
   gzip_version: 1.12
@@ -144,9 +144,9 @@ vars:
   gzip_sha512: 116326fe991828227de150336a0c016f4fe932dfbb728a16b4a84965256d9929574a4f5cfaf3cf6bb4154972ef0d110f26ab472c93e62ec9a5fd7a5d65abea24
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git
-  kmod_version: 25
-  kmod_sha256: 7165e6496656159dcb909a91ed708a0fe273a4b128b4b1dc997ccb5189eef1cd
-  kmod_sha512: d579cd0cea24a06362a74927b7a3c777e9e01c990306e1032e4781cd441ffe435c70f2c2c4f6ae39eb1d857e622746411d5824d0c0d8bb79f91dc9fa51956252
+  kmod_version: 30
+  kmod_sha256: f897dd72698dc6ac1ef03255cd0a5734ad932318e4adbaebc7338ef2f5202f9f
+  kmod_sha512: e2cd34e600a72e44710760dfda9364b790b8352a99eafbd43e683e4a06f37e6b5c0b5d14e7c28070e30fc5fc6ceddedf7b97f3b6c2c5c2d91204fefd630b9a3e
 
   # renovate: datasource=github-tags depName=libbpf/libbpf
   libbpf_version: v1.0.0
@@ -159,24 +159,24 @@ vars:
   libffi_sha512: 31bad35251bf5c0adb998c88ff065085ca6105cf22071b9bd4b5d5d69db4fadf16cadeec9baca944c4bb97b619b035bb8279de8794b922531fddeb0779eb7fb1
 
   # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=seccomp/libseccomp
-  libseccomp_version: 2.5.3
-  libseccomp_sha256: 59065c8733364725e9721ba48c3a99bbc52af921daf48df4b1e012fbc7b10a76
-  libseccomp_sha512: 00170fe2360f0c0b33293dccfcc33e98fabb99619f34ecefbcc92bfdaa249ba91e7433226545b842b71542a3b224b6e980ea2ae656c4addf07e84a0def1870a0
+  libseccomp_version: 2.5.4
+  libseccomp_sha256: d82902400405cf0068574ef3dc1fe5f5926207543ba1ae6f8e7a1576351dcbdb
+  libseccomp_sha512: 92650bd7d1d48b383f402a536b97a017fd0f6ad1234daf4b938d01c92e8d134a01d2f2dd45fd9e2d025d7556bd1386ec360402145a87f20580c85949d62cea0e
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.savannah.gnu.org/libtool.git
-  libtool_version: 2.4.6
-  libtool_sha256: e3bd4d5d3d025a36c21dd6af7ea818a2afcd4dfc1ea5a17b39d7854bcd0c06e3
-  libtool_sha512: 3233d81cb2739a54b840a0a82064eebbfaa4fb442fb993a35d6bd41d8395c51f038c90ae048b9252f172d0a5bbfb4b36e2b13d4477001f9ff7d4124237819a18
+  libtool_version: 2.4.7
+  libtool_sha256: 04e96c2404ea70c590c546eba4202a4e12722c640016c12b9b2f1ce3d481e9a8
+  libtool_sha512: 27acef46d9eb67203d708b57d80b853f76fa4b9c2720ff36ec161e6cdf702249e7982214ddf60bae75511aa79bc7d92aa27e3eab7ef9c0f5c040e8e42e76a385
 
   # renovate: datasource=github-tags depName=libuv/libuv
-  libuv_version: v1.37.0
-  libuv_sha256: 6f2794313c9603388ed4b7b818b3bed5f784f886ae3ce5b3424b331813f6a391
-  libuv_sha512: dc5f616871d8ea10d7d5f66f5b1044eb1deeab7714a5fb515a40ca9a45d01efea310c182b74a4152da26c9de9ca75b0ba13b103eb0e63361144216aac408223a
+  libuv_version: v1.44.2
+  libuv_sha256: ccfcdc968c55673c6526d8270a9c8655a806ea92468afcbcabc2b16040f03cb4
+  libuv_sha512: 91197ff9303112567bbb915bbb88058050e2ad1c048815a3b57c054635d5dc7df458b956089d785475290132236cb0edcfae830f5d749de29a9a3213eeaf0b20
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ depName=git://git.savannah.gnu.org/m4.git
-  m4_version: 1.4.18
-  m4_sha256: f2c1e86ca0a404ff281631bdc8377638992744b175afb806e25871a24a934e07
-  m4_sha512: 06f583efc3855cd8477d8347544f4ae5153a3e50aea74d21968afa7214784ea3ddfc02d0a2b11324120d76a19f2e804d20de11a456b5da929eb6ae469519b174
+  m4_version: 1.4.19
+  m4_sha256: 63aede5c6d33b6d9b13511cd0be2cac046f2e70fd0a07aa9573a04a82783af96
+  m4_sha512: 47f595845c89709727bda0b3fc78e3188ef78ec818965b395532e7041cabe9e49677ee4aca3d042930095a7f8df81de3da1026b23b6897be471f6cf13ddd512b
 
   # renovate: datasource=git-tags versioning=loose depName=git://git.savannah.gnu.org/make.git
   make_version: 4.3
@@ -184,19 +184,19 @@ vars:
   make_sha512: 9a1185cc468368f4ec06478b1cfa343bf90b5cd7c92c0536567db0315b0ee909af53ecce3d44cfd93dd137dbca1ed13af5713e8663590c4fdd21ea635d78496b
 
   # renovate: datasource=github-releases depName=mesonbuild/meson
-  meson_version: 0.61.2
-  meson_sha256: 0233a7f8d959079318f6052b0939c27f68a5de86ba601f25c9ee6869fb5f5889
-  meson_sha512: 0cbc686b23a4d0b74e723a97869898c1e44977ee354ed9186ccac3e527c00b7407f62a15435cb9588e9d63f4e87de54da0a7fac5b251079d1a13851f17d61529
+  meson_version: 0.63.2
+  meson_sha256: 16222f17ef76be0542c91c07994f9676ae879f46fc21c0c786a21ef2cb518bbf
+  meson_sha512: 770d8d82502c5cd419123e09f6a445d2cbaea4463c5fa79f1497c868bf5defc5e5779a6e550ef5fcf75d57322d2b25b61574f4df0cbf001c4325c6abdbbc30b4
 
   # renovate: datasource=git-tags depName=https://gitlab.inria.fr/mpc/mpc.git
-  mpc_version: 1.1.0
-  mpc_sha256: 6985c538143c1208dcb1ac42cedad6ff52e267b47e5f970183a3e75125b43c2e
-  mpc_sha512: 72d657958b07c7812dc9c7cbae093118ce0e454c68a585bfb0e2fa559f1bf7c5f49b93906f580ab3f1073e5b595d23c6494d4d76b765d16dde857a18dd239628
+  mpc_version: 1.2.1
+  mpc_sha256: 17503d2c395dfcf106b622dc142683c1199431d095367c6aacba6eec30340459
+  mpc_sha512: 3279f813ab37f47fdcc800e4ac5f306417d07f539593ca715876e43e04896e1d5bceccfb288ef2908a3f24b760747d0dbd0392a24b9b341bc3e12082e5c836ee
 
   # renovate: datasource=git-tags depName=https://gitlab.inria.fr/mpfr/mpfr.git
-  mpfr_version: 4.0.2
-  mpfr_sha256: 1d3be708604eae0e42d578ba93b390c2a145f17743a744d8f3f8c2ad5855a38a
-  mpfr_sha512: d583555d08863bf36c89b289ae26bae353d9a31f08ee3894520992d2c26e5683c4c9c193d7ad139632f71c0a476d85ea76182702a98bf08dde7b6f65a54f8b88
+  mpfr_version: 4.1.0
+  mpfr_sha256: 0c98a3f1732ff6ca4ea690552079da9c597872d30e96ec28414ee23c95558a7f
+  mpfr_sha512: 1bd1c349741a6529dfa53af4f0da8d49254b164ece8a46928cdb13a99460285622d57fe6f68cef19c6727b3f9daa25ddb3d7d65c201c8f387e421c7f7bee6273
 
   # renovate: datasource=github-tags depName=void-linux/musl-fts
   musl_fts_version: v1.2.7
@@ -204,14 +204,14 @@ vars:
   musl_fts_sha512: 949f73b9406b06bd8712c721b4ec89afcb37d4eaef5666cccf3712242d3a57fc0acf3ca994934e0f57c1e92f40521a9370132a21eb6d1957415a83c76bf20feb
 
   # renovate: datasource=github-tags depName=void-linux/musl-obstack
-  musl_obstack_version: v1.2.2
-  musl_obstack_sha256: 6eac88961c58a53f31cccd719b97d1b33c65436c51664e760a9582e2659c1314
-  musl_obstack_sha512: 61ac90d8878ea620a5bab3ea8be1f8e42d26040475609f5a389a68b2dc0cfb4a10084deb994568392e5671b8ba405e9e78eb7e6313d03afbbcdde82d2e7995b0
+  musl_obstack_version: v1.2.3
+  musl_obstack_sha256: 9ffb3479b15df0170eba4480e51723c3961dbe0b461ec289744622db03a69395
+  musl_obstack_sha512: b2bbed19c4ab2714ca794bdcb1a84fad1af964e884d4f3bbe91c9937ca089d92b8472cb05ebe998a9f5c85cb922b9b458db91eff29077bd099942e1ce18e16cc
 
   # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=mirror/ncurses
-  ncurses_version: 6.2
-  ncurses_sha256: 30306e0c76e0f9f1f0de987cf1c82a5c21e1ce6568b9227f7da5b71cbea86c9d
-  ncurses_sha512: 4c1333dcc30e858e8a9525d4b9aefb60000cfc727bc4a1062bace06ffc4639ad9f6e54f6bdda0e3a0e5ea14de995f96b52b3327d9ec633608792c99a1e8d840d
+  ncurses_version: 6.3
+  ncurses_sha256: 97fc51ac2b085d4cde31ef4d2c3122c21abc217e9090a43a30fc5ec21684e059
+  ncurses_sha512: 5373f228cba6b7869210384a607a2d7faecfcbfef6dbfcd7c513f4e84fbd8bcad53ac7db2e7e84b95582248c1039dcfc7c4db205a618f7da22a166db482f0105
 
   # renovate: datasource=git-tags extractVersion=^OpenSSL_(?<version>.*)$ versioning=loose depName=git://git.openssl.org/openssl.git
   openssl_version: 1_1_1q
@@ -228,25 +228,26 @@ vars:
   patch_sha256: ac610bda97abe0d9f6b7c963255a11dcb196c25e337c61f94e4778d632f1d8fd
   patch_sha512: fcca87bdb67a88685a8a25597f9e015f5e60197b9a269fa350ae35a7991ed8da553939b4bbc7f7d3cfd863c67142af403b04165633acbce4339056a905e87fbd
 
-  # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=Perl/perl5
-  perl_version: 5.34.0
-  perl_sha256: 82c2e5e5c71b0e10487a80d79140469ab1f8056349ca8545140a224dbbed7ded
-  perl_sha512: 691b4b31eacec357191fba777612b4e3eae59e946a22998a50766697c0d61db1d42a9b3bc1e41abf0d1ca1893e4a7c06d7bf3290480cf03d7f79befd7a8a3267
+  # perl uses even numbered minor versions for stable releases - https://www.cpan.org/src/README.html
+  # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=Perl/perl5
+  perl_version: 5.36.0
+  perl_sha256: 0f386dccbee8e26286404b2cca144e1005be65477979beb9b1ba272d4819bcf0
+  perl_sha512: 6dd6ac2a77566c173c5ab9c238cf555f2c3e592e89abb5600bc23ce1cbd0c349e0233f6417cbbf1f6d0aefc6a734ba491285af0d3dc68a605b658b65c89f1dab
 
   # renovate: datasource=git-tags extractVersion=^pkg-config-(?<version>.*)$ versioning=loose depName=https://gitlab.freedesktop.org/pkg-config/pkg-config.git
   pkg_config_version: 0.29.2
   pkg_config_sha256: 6fc69c01688c9458a57eb9a1664c9aba372ccda420a02bf4429fe610e7e7d591
   pkg_config_sha512: 4861ec6428fead416f5cbbbb0bbad10b9152967e481d4b0ff2eb396a9f297f552984c9bb72f6864a37dcd8fca1d9ccceda3ef18d8f121938dbe4fdf2b870fe75
 
-  # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=protocolbuffers/protobuf
-  protobuf_version: 3.19.1
-  protobuf_sha256: 645192532f28254152b51c01868efdf9b766b1dbe49c77cccd6efcdb2d7c7bc2
-  protobuf_sha512: e02185e26887da5de76d6bf446ec693df865ed454c6b4b2c80e936b7c8a837e79f2e34df874d72d818118b17169adbb386b0cbc95242d225e657b0945da4cc1d
+  # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=protocolbuffers/protobuf
+  protobuf_version: 3.21.5
+  protobuf_sha256: 58c8a18b4ec22655535c493155c5465a8903e8249094ceead87e00763bdbc44f
+  protobuf_sha512: d466e290105ce3df88fd10e11b2f463126b1f055e1ed7ebb133025e2108fa74645d287696041bc481c246e6b6ece873e40f73469b65b89e9a0caa8df5211038d
 
   # renovate: datasource=github-releases depName=protocolbuffers/protobuf-go
-  protoc_gen_go_version: v1.27.1
-  protoc_gen_go_sha256: 3ec41a8324431e72f85e0dc0c2c098cc14c3cb1ee8820996c8f46afca2d65609
-  protoc_gen_go_sha512: a0236bc88b963df0acc2a2c7c247334614b2d555f341e103fd06759665802069a320ced4ab51be658283cc816ec9f2d53ed98728895c5b8ce18954a17663264b
+  protoc_gen_go_version: v1.28.1
+  protoc_gen_go_sha256: df0b3dceeff0e1b6d029e60f076edd0d852cb8f3c2fe4fe3fe40164f16ec9b6b
+  protoc_gen_go_sha512: 53d78281bbae47baa2a2e029eafd37f9b1e26a5e17bb9f30ee3d7b875871ed07445845d9bb3168b148c057f2c16fd834606dd71cbe00f56dc8061b1907f75482
 
   # renovate: datasource=github-tags depName=grpc/grpc-go
   protoc_gen_go_grpc_version: v1.42.0
@@ -254,55 +255,55 @@ vars:
   protoc_gen_go_grpc_sha512: ff22842854ef4b3cfd842b344f3ac3641a815e1383b86fee90bfeeaeb7ee47aed9297379132a15d640c57bcb8b36da45c63f0437465c38122cbe941b52b7597c
 
   # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=python/cpython
-  python_version: 3.10.2
-  python_sha256: 17de3ac7da9f2519aa9d64378c603a73a0e9ad58dffa8812e45160c086de64c7
-  python_sha512: 215a7159face84788fe547c1e2689b8d0ae510275157cf01636bef2902d0ff465f844eb0328c9f39fd1cd03a1d1736d4cf258992f2788e492a801a372032c08b
+  python_version: 3.10.7
+  python_sha256: 6eed8415b7516fb2f260906db5d48dd4c06acc0cb24a7d6cc15296a604dcdc48
+  python_sha512: dc3432d72ee7382617318c9645204876d13bb61d4caf3fbbb65e6b14897261123c743049657c95e159e5566daf4dcde613d2e393f025de758f610b44eb958313
 
   # renovate: datasource=github-tags depName=rhash/RHash
-  rhash_version: v1.4.1
-  rhash_sha256: 430c812733e69b78f07ce30a05db69563450e41e217ae618507a4ce2e144a297
-  rhash_sha512: 30bbef7ce7815ee4ac062c537206a0b895845f61de4b1fdc0c0494f66284d9f3c1b06f812ea913fa35a3342d230d25d0986a1db644c7b4464bc1185997beb638
+  rhash_version: v1.4.3
+  rhash_sha256: 1e40fa66966306920f043866cbe8612f4b939b033ba5e2708c3f41be257c8a3e
+  rhash_sha512: d87ffcde28d8f25cf775c279fed457e52d24523ed9b695629dae694b3c22372247d18f6032f8ce13a0b70fa2953be408982e46659daaa7c4ab227ae89eaed9c7
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.savannah.gnu.org/sed.git
-  sed_version: 4.5
-  sed_sha256: 7aad73c8839c2bdadca9476f884d2953cdace9567ecd0d90f9959f229d146b40
-  sed_sha512: f95fb27e03b2301dae63878413b4c48e40341cc676945a612e1d0bd911da3192858ae142791292a99fbdaacbc7dab2d6fccb50787c06846f99b0b3740b40c196
+  sed_version: 4.8
+  sed_sha256: f79b0cfea71b37a8eeec8490db6c5f7ae7719c35587f21edb0617f370eeff633
+  sed_sha512: 7de25d9bc2981c63321c2223f3fbcab61d7b0df4fcf7d4394b72400b91993e1288d8bf53948ed5fffcf5a98c75265726a68ad4fb98e1d571bf768603a108c1c8
 
   # renovate: datasource=github-tags versioning=loose depName=plougher/squashfs-tools
-  squashfs_tools_version: 4.5
-  squashfs_tools_sha256: b9e16188e6dc1857fe312633920f7d71cc36b0162eb50f3ecb1f0040f02edddd
-  squashfs_tools_sha512: e00610487d24eed9e5dadcf84014a3d7faa9815d8ce00fd4660e6c8ce394dccf185ed9f387f4fa1313b9812fe770f802bdcbaef87887f2bcefacf234594a72e0
+  squashfs_tools_version: 4.5.1
+  squashfs_tools_sha256: 277b6e7f75a4a57f72191295ae62766a10d627a4f5e5f19eadfbc861378deea7
+  squashfs_tools_sha512: b3934ea1e26c7508110312711465644a6d9674b6b5332a7d011e191fa3c1d4b8be694214794a0f6005263d0f4e18bab96af2f7ed66a178f8e3bb3a781cd44896
 
   # TODO: switch to pcre2 once next version of swig is released
   # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=swig/swig
-  swig_version: 4.0.0
-  swig_sha256: e8a39cd6437e342cdcbd5af27a9bf11b62dc9efec9248065debcb8276fcbb925
-  swig_sha512: c897b87fb8b21caf8d1bee2c39cb9675a3b0ee047110e808c310a2787f8b89585738726e9f517c64e9d2f1b8311136365c569528f399b444b1081f69689b7165
+  swig_version: 4.0.2
+  swig_sha256: d53be9730d8d58a16bf0cbd1f8ac0c0c3e1090573168bfa151b01eb47fa906fc
+  swig_sha512: 05e7da70ce6d9a733b96c0bcfa3c1b82765bd859f48c74759bbf4bb1467acb1809caa310cba5e2b3280cd704fca249eaa0624821dffae1d2a75097c7f55d14ed
 
   # renovate: datasource=git-tags extractVersion=^release_(?<version>.*)$ depName=git://git.savannah.gnu.org/tar.git
-  tar_version: 1_30
-  tar_sha256: f1bf92dbb1e1ab27911a861ea8dde8208ee774866c46c0bb6ead41f4d1f4d2d3
-  tar_sha512: 9c8b2cacf8f6ca1b19f788d4ec0410127c4d71e54b9c9cac99ee5af6c002189ccc521302955510bb22a54a069ffd00fc2de12ac776985cbbeb3f1ecf38a4f8d9
+  tar_version: 1_34
+  tar_sha256: 63bebd26879c5e1eea4352f0d03c991f966aeb3ddeb3c7445c902568d5411d28
+  tar_sha512: 5e77c4a7b49983ad7d15238c2bce28be7a8aa437b4b1815fc00abd13096da308b6bba196cc6e3ed79d85e62823d520ae0d8fcda2d93873842cf84dc3369fc902
 
   # renovate: datasource=github-tags extractVersion=^core-(?<version>.*)$ depName=tcltk/tcl
-  tcl_version: 8-6-9
-  tcl_sha256: 58014662862485f62e95f3804dd4840bc63af3c559f0d7d7fc178792794a20d8
-  tcl_sha512: e1dc7b8f1eb6dad1b61cb3136eed8cf538e8f14038795395bd21052bea491a3770af8523148a5fc2507afcb370f6b91612bb94810e3c7cdce47a710bc432f67a
+  tcl_version: 8-6-12
+  tcl_sha256: eb5dfae6b872c7c860f05a213b55a81a7d235450ac53c52aa79dd5cfadcccd95
+  tcl_sha512: 4a23bbfc687efa5aecaef5a29892ea75c12fbb952aa948e702380117fab34f51413b03872ab844de0638ac70df32124af2ca87d8fb17d010dcf91e934ac6199b
 
   # renovate: datasource=git-tags extractVersion=^texinfo-(?<version>.*)$ versioning=loose depName=git://git.savannah.gnu.org/texinfo.git
-  texinfo_version: 6.5
-  texinfo_sha256: 77774b3f4a06c20705cc2ef1c804864422e3cf95235e965b1f00a46df7da5f62
-  texinfo_sha512: 06831b4c74a1ba7a9cff937069e40ab26db1204aa8761d63254651ffacf6b0cb95d7078ba1cc59d95427239ab7e4f4aedf582967854281bfea3850b1ed5b1fdc
+  texinfo_version: 6.8
+  texinfo_sha256: 8eb753ed28bca21f8f56c1a180362aed789229bd62fff58bf8368e9beb59fec4
+  texinfo_sha512: 0ff9290b14e4d83e32b889cfa24e6d065f98b2a764daf6b92c6c895fddbb35258398da6257c113220d5a4d886f7b54b09c4b117ca5eacfee6797f9bffde0f909
 
   # renovate: datasource=git-tags extractVersion=^v(?<version>.*)$ versioning=loose depName=git://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
-  util_linux_version: 2.38
-  util_linux_sha256: 6d111cbe4d55b336db2f1fbeffbc65b89908704c01136371d32aa9bec373eb64
-  util_linux_sha512: d0f7888f457592067938e216695871ce6475a45d83a092cc3fd72b8cf8fca145ca5f3a99122f1744ef60b4f773055cf4e178dc6c59cd30837172aee0b5597e8c
+  util_linux_version: 2.38.1
+  util_linux_sha256: 60492a19b44e6cf9a3ddff68325b333b8b52b6c59ce3ebd6a0ecaa4c5117e84f
+  util_linux_sha512: 07f11147f67dfc6c8bc766dfc83266054e6ede776feada0566b447d13276b6882ee85c6fe53e8d94a17c03332106fc0549deca3cf5f2e92dda554e9bc0551957
 
   # renovate: datasource=git-tags depName=https://git.tukaani.org/xz.git
-  xz_version: v5.2.5
-  xz_sha256: 0d2b89629f13dd1a0602810529327195eff5f62a0142ccd65b903bc16a4ac78a
-  xz_sha512: 686f01cfe33e2194766a856c48668c661b25eee194a443524f87ce3f866e0eb54914075b4e00185921516c5211db8cd5d2658f4b91f4a3580508656f776f468e
+  xz_version: v5.2.6
+  xz_sha256: b818b95a68ff712258fc84bda987fe1bd84d13e8f091f3e8ec1db2d1969899ab
+  xz_sha512: c9079a61a55dbd94eac3c0351bfcf42237abad6dd77bb8843cfb08bd26a48d2036c0c6a09a692bfb8a336378128692d0c90d0ba35519c20215db6d9873b1cd7c
 
   # renovate: datasource=github-tags extractVersion=^v(?<version>.*)$ depName=madler/zlib
   zlib_version: 1.2.12
diff --git a/bash/pkg.yaml b/bash/pkg.yaml
index 9b2a45a..7ade429 100644
--- a/bash/pkg.yaml
+++ b/bash/pkg.yaml
@@ -1,15 +1,87 @@
 name: bash
 dependencies:
   - stage: base
+  - stage: patch
+    runtime: true
 steps:
   - sources:
       - url: https://ftp.gnu.org/gnu/bash/bash-{{ .bash_version }}.tar.gz
         destination: bash.tar.gz
         sha256: "{{ .bash_sha256 }}"
         sha512: "{{ .bash_sha512 }}"
+      # ref https://git.alpinelinux.org/aports/tree/main/bash/APKBUILD?h=3.16-stable
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-001
+        destination: bash51-001.patch
+        sha256: ebb07b3dbadd98598f078125d0ae0d699295978a5cdaef6282fe19adef45b5fa
+        sha512: 1cd86805a2639614372aec29a710bc456e330abcbbaa0867820c94f714a1fa5fb5c1b18aa2c10263ae0bce9dad7579c7af2f732282315c1c34bfd6a90777bfd2
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-002
+        destination: bash51-002.patch
+        sha256: 15ea6121a801e48e658ceee712ea9b88d4ded022046a6147550790caf04f5dbe
+        sha512: 923e7822a9629645347d3aea0058fb5e2d52223507159a62369309f264612df44a84931c19e0ccb3852e98ce672dfbd454477090b4041b5a0de477c94eb61088
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-003
+        destination: bash51-003.patch
+        sha256: 22f2cc262f056b22966281babf4b0a2f84cb7dd2223422e5dcd013c3dcbab6b1
+        sha512: 01e952dcfdae58624723d64912ea3444eed2fdcd266ba1a929b95ec3abd70f914bf400607c3f7bb7a94ac2925f794f91f37c1929d5bb987de2ba7f60a19cb8bd
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-004
+        destination: bash51-004.patch
+        sha256: 9aaeb65664ef0d28c0067e47ba5652b518298b3b92d33327d84b98b28d873c86
+        sha512: 10ff24cd91a2cd88818bfa7218050843af6b409e43fcca89f5ec70d8266020c6c2a55132426271f165cd0f154f49eb0f8ec2761b80fc066c921b83120bb543ce
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-005
+        destination: bash51-005.patch
+        sha256: cccbb5e9e6763915d232d29c713007a62b06e65126e3dd2d1128a0dc5ef46da5
+        sha512: fa83d894fe874a05b9a7d47b8bca8e5b7f4067221d82e8b1af616d17725592c3737c621f2a8ad3c917b29846012c37c85acd34dcbb43eb6b05065ccce89b260c
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-006
+        destination: bash51-006.patch
+        sha256: 75e17d937de862615c6375def40a7574462210dce88cf741f660e2cc29473d14
+        sha512: b9b6e3d71f7b7718e2e8598ec8e337dcc675571fb233c29e5230ebf14eab2249204531f2fe8c4d1459c5fed10acb679048588d1e457e98dbc00ffc4d2cd227e3
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-007
+        destination: bash51-007.patch
+        sha256: acfcb8c7e9f73457c0fb12324afb613785e0c9cef3315c9bbab4be702f40393a
+        sha512: e4ebdc47e780ddc2588ecdfcfe00cb618039c7044e250ab2b836b0735c461ebacd15beaf2145e277c70b7f51cded55bd8dde7757df810f33f8dae306ee5ba571
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-008
+        destination: bash51-008.patch
+        sha256: f22cf3c51a28f084a25aef28950e8777489072628f972b12643b4534a17ed2d1
+        sha512: 97f9558a08a66cc9da62c285bf9118b39328e25ed3b9277728e0539b1ac0adef176a090e39cd96dc03d6fd900d8155bd58040cb3390a09f637bab1de8af3faf6
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-009
+        destination: bash51-009.patch
+        sha256: e45cda953ab4b4b4bde6dc34d0d8ca40d1cc502046eb28070c9ebcd47e33c3ee
+        sha512: 2d3c65162ec4e5c3dfeb439891950ef2c43973a84122fcdf6b56c388466c7e671dbc9b236d2253f01411b668c365855263995dbacb8e6f9e9dbcb7e6c2cc518c
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-010
+        destination: bash51-010.patch
+        sha256: a2c8d7b2704eeceff7b1503b7ad9500ea1cb6e9393faebdb3acd2afdd7aeae2a
+        sha512: aac4a0b72b559566334f1029c52754f4c98185af99e09436e401d83ab81bab7882d0d8050674b30f171733f3628157777a264566e927e93db2ea5a18d26630f1
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-011
+        destination: bash51-011.patch
+        sha256: 58191f164934200746f48459a05bca34d1aec1180b08ca2deeee3bb29622027b
+        sha512: bb9e47a570bb9758c365831f9650b9379b60862b8cef572edc3cd833df96ebb8b9612de474bdc2a03ff4efc2275f871d55962295385e38f3658874488e974b81
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-012
+        destination: bash51-012.patch
+        sha256: 10f189c8367c4a15c7392e7bf70d0ff6953f78c9b312ed7622303a779273ab98
+        sha512: 59819914b6821d9f4af0aade7b9b7ea92368c2b8eb8407cea11dfeee7208905dd06bdef7a049d7b1c4fac41c44d9a130b95a061957a9649050b37471b3044cf1
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-013
+        destination: bash51-013.patch
+        sha256: c7acb66df435d284304c16ca83a5265f9edd9368612095b01a733d45c77ed5ad
+        sha512: 67535155f49a7f54f151e62aba9274f82d01f33a1a1a7e5efd1aa0d63ba2d078765f0b5e22cb24db7132eff2d8c5852a3688298baa5217b8b6e159aae065d748
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-014
+        destination: bash51-014.patch
+        sha256: 6a4ee0c81b437b96279a792c1efcec4ba56f009195a318083db6b53b096f83d0
+        sha512: f658ab7ef01ba1d26f735e24b23bf35687e15b0d5d20f90da233d000745a55bdba142c11e9fba52e3b84470ec625fab60cc74cd6be533d990496a3795c658e88
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-015
+        destination: bash51-015.patch
+        sha256: 1b37692ef1f6cc3dcec246773443276066e6b1379868f8c14e01f4dfd4df80f0
+        sha512: fd4bc85f942a3a16c545f7e951a24f620ff2d884640dea6e05f305aaf88ed41862bfb05eea2258881608de696f9dc7a0fe3bebb51a011f50b720ea7a66699184
+      - url: https://ftp.gnu.org/gnu/bash/bash-5.1-patches/bash51-016
+        destination: bash51-016.patch
+        sha256: 8899144f76a5db1fb41a89ed881c9f19add95728dd71db324f772ef225c5384f
+        sha512: 020b3f3db77ca603a27a3423323538db5c9844be17ee428cf7cda80bebdcc715d30eab6c95773541cb8d14f3ad9e6142bf0adcda0e745ee638242508cc0ab05f
     prepare:
       - |
         tar -xzf bash.tar.gz --strip-components=1
+
+        for patch in bash51-*.patch; do
+          patch -p0 < $patch
+        done
+
         mkdir build
         cd build
 
@@ -19,6 +91,8 @@ steps:
     build:
       - |
         cd build
+        # parallel build workarounds
+        make y.tab.c && make builtins/libbuiltins.a
         make -j $(nproc)
     install:
       - |
diff --git a/cmake/pkg.yaml b/cmake/pkg.yaml
index c014d94..621e332 100644
--- a/cmake/pkg.yaml
+++ b/cmake/pkg.yaml
@@ -11,7 +11,7 @@ dependencies:
   - stage: zlib
 steps:
   - sources:
-      - url: https://www.cmake.org/files/v{{ regexReplaceAll ".\\d+$" .cmake_version "${1}" |  }}/cmake-{{ .cmake_version }}.tar.gz
+      - url: https://www.cmake.org/files/v{{ regexReplaceAll ".\\d+$" .cmake_version "${1}" }}/cmake-{{ .cmake_version }}.tar.gz
         destination: cmake.tar.gz
         sha256: "{{ .cmake_sha256 }}"
         sha512: "{{ .cmake_sha512 }}"
diff --git a/dwarfutils/pkg.yaml b/dwarfutils/pkg.yaml
index 7439161..895978f 100644
--- a/dwarfutils/pkg.yaml
+++ b/dwarfutils/pkg.yaml
@@ -8,6 +8,8 @@ steps:
         destination: dwarfutils.tar.xz
         sha256: "{{ .dwarfutils_sha256 }}"
         sha512: "{{ .dwarfutils_sha512 }}"
+    env:
+      SOURCE_DATE_EPOCH: "1"
     prepare:
       - |
         tar -xvf dwarfutils.tar.xz --strip-components=1
diff --git a/gettext/pkg.yaml b/gettext/pkg.yaml
index 80a1e11..2543e97 100644
--- a/gettext/pkg.yaml
+++ b/gettext/pkg.yaml
@@ -12,7 +12,7 @@ steps:
         tar -xJf gettext.tar.xz --strip-components=1
         mkdir build
         cd build
-        EMACS="no" ../gettext-tools/configure \
+        ../configure \
             --prefix=${TOOLCHAIN} \
             --enable-relocatable \
             --disable-shared \
diff --git a/ncurses/patches/reproducibility.patch b/ncurses/patches/reproducibility.patch
index 0bc02f7..da88568 100644
--- a/ncurses/patches/reproducibility.patch
+++ b/ncurses/patches/reproducibility.patch
@@ -1,9 +1,9 @@
-http://cgit.openembedded.org/openembedded-core/plain/meta/recipes-core/ncurses/files/0002-configure-reproducible.patch?h=rocko
+https://cgit.openembedded.org/openembedded-core/plain/meta/recipes-core/ncurses/files/0002-configure-reproducible.patch
 
-From 939c994f3756c2d6d3cab2e6a04d05fa7c2b1d56 Mon Sep 17 00:00:00 2001
+From ec87e53066a9942e9aaba817d71268342f5e83b9 Mon Sep 17 00:00:00 2001
 From: Hongxu Jia <hongxu.jia@windriver.com>
 Date: Wed, 16 Aug 2017 14:45:27 +0800
-Subject: [PATCH 2/2] configure: reproducible
+Subject: [PATCH] configure: reproducible
 
 "configure" enforces -U for ar flags, breaking deterministic builds.
 The flag was added to fix some vaguely specified "recent POSIX binutil
@@ -12,25 +12,24 @@ build problems" in 2015.
 Upstream-Status: Pending
 Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
 
-Rebase to Rebase to 6.0+20170715
+Rebase to 6.1
 
 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+
 ---
  configure | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/configure b/configure
-index 7d7d2c1..f444354 100755
+index 421cf859..a1b7840d 100755
 --- a/configure
 +++ b/configure
-@@ -4458,7 +4458,7 @@ if test "${cf_cv_ar_flags+set}" = set; then
- else
-
- 	cf_cv_ar_flags=unknown
--	for cf_ar_flags in -curvU -curv curv -crv crv -cqv cqv -rv rv
-+	for cf_ar_flags in -curv curv -crv crv -cqv cqv -rv rv
- 	do
-
- 		# check if $ARFLAGS already contains this choice
---
-1.8.3.1
+@@ -5072,7 +5072,7 @@ else
+ 		;;
+ 	(*)
+ 		cf_cv_ar_flags=unknown
+-		for cf_ar_flags in -curvU -curv curv -crv crv -cqv cqv -rv rv
++		for cf_ar_flags in -curv curv -crv crv -cqv cqv -rv rv
+ 		do
+
+ 			# check if $ARFLAGS already contains this choice
diff --git a/perl/pkg.yaml b/perl/pkg.yaml
index 54b7eff..9d6ac74 100644
--- a/perl/pkg.yaml
+++ b/perl/pkg.yaml
@@ -32,7 +32,9 @@ steps:
           -Duseshrplib \
           -Dd_semctl_semun \
           -Ud_csh \
-          -Dusenm
+          -Dusenm \
+          -Dcf_email=buildkit@buildkitsandbox \
+          -Dmydomain=buildkitsandbox
     build:
       - |
         make -j $(nproc)
diff --git a/protobuf/pkg.yaml b/protobuf/pkg.yaml
index ff574c2..3cd52f6 100644
--- a/protobuf/pkg.yaml
+++ b/protobuf/pkg.yaml
@@ -3,7 +3,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://github.com/protocolbuffers/protobuf/releases/download/v{{ .protobuf_version }}/protobuf-cpp-{{ .protobuf_version }}.tar.gz
+      - url: https://github.com/protocolbuffers/protobuf/releases/download/v{{ regexReplaceAll "^\\d+\\." .protobuf_version "${1}" }}/protobuf-cpp-{{ .protobuf_version }}.tar.gz
         destination: protobuf-cpp.tar.gz
         sha256: "{{ .protobuf_sha256 }}"
         sha512: "{{ .protobuf_sha512 }}"
diff --git a/swig/pkg.yaml b/swig/pkg.yaml
index 9e2ad79..7473686 100644
--- a/swig/pkg.yaml
+++ b/swig/pkg.yaml
@@ -5,7 +5,7 @@ dependencies:
   - stage: pcre
 steps:
   - sources:
-      - url: https://sourceforge.net/projects/swig/files/swig/swig-{{ .swig_version }}/swig-{{ .swig_version }}.tar.gz/download
+      - url: https://onboardcloud.dl.sourceforge.net/project/swig/swig/swig-{{ .swig_version }}/swig-{{ .swig_version }}.tar.gz
         destination: swig.tar.gz
         sha256: "{{ .swig_sha256 }}"
         sha512: "{{ .swig_sha512 }}"
diff --git a/util-linux/pkg.yaml b/util-linux/pkg.yaml
index f40deaa..489eafd 100644
--- a/util-linux/pkg.yaml
+++ b/util-linux/pkg.yaml
@@ -3,7 +3,7 @@ dependencies:
   - stage: base
 steps:
   - sources:
-      - url: https://www.kernel.org/pub/linux/utils/util-linux/v{{ .util_linux_version }}/util-linux-{{ .util_linux_version }}.tar.xz
+      - url: https://www.kernel.org/pub/linux/utils/util-linux/v{{ regexReplaceAll ".\\d+$" .util_linux_version "${1}" }}/util-linux-{{ .util_linux_version }}.tar.xz
         destination: util-linux.tar.xz
         sha256: "{{ .util_linux_sha256 }}"
         sha512: "{{ .util_linux_sha512 }}"
diff --git a/xz/patches/xzgrep-ZDI-CAN-16587.patch b/xz/patches/xzgrep-ZDI-CAN-16587.patch
deleted file mode 100644
index decc275..0000000
--- a/xz/patches/xzgrep-ZDI-CAN-16587.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 69d1b3fc29677af8ade8dc15dba83f0589cb63d6 Mon Sep 17 00:00:00 2001
-From: Lasse Collin <lasse.collin@tukaani.org>
-Date: Tue, 29 Mar 2022 19:19:12 +0300
-Subject: [PATCH] xzgrep: Fix escaping of malicious filenames (ZDI-CAN-16587).
-
-Malicious filenames can make xzgrep to write to arbitrary files
-or (with a GNU sed extension) lead to arbitrary code execution.
-
-xzgrep from XZ Utils versions up to and including 5.2.5 are
-affected. 5.3.1alpha and 5.3.2alpha are affected as well.
-This patch works for all of them.
-
-This bug was inherited from gzip's zgrep. gzip 1.12 includes
-a fix for zgrep.
-
-The issue with the old sed script is that with multiple newlines,
-the N-command will read the second line of input, then the
-s-commands will be skipped because it's not the end of the
-file yet, then a new sed cycle starts and the pattern space
-is printed and emptied. So only the last line or two get escaped.
-
-One way to fix this would be to read all lines into the pattern
-space first. However, the included fix is even simpler: All lines
-except the last line get a backslash appended at the end. To ensure
-that shell command substitution doesn't eat a possible trailing
-newline, a colon is appended to the filename before escaping.
-The colon is later used to separate the filename from the grep
-output so it is fine to add it here instead of a few lines later.
-
-The old code also wasn't POSIX compliant as it used \n in the
-replacement section of the s-command. Using \<newline> is the
-POSIX compatible method.
-
-LC_ALL=C was added to the two critical sed commands. POSIX sed
-manual recommends it when using sed to manipulate pathnames
-because in other locales invalid multibyte sequences might
-cause issues with some sed implementations. In case of GNU sed,
-these particular sed scripts wouldn't have such problems but some
-other scripts could have, see:
-
-    info '(sed)Locale Considerations'
-
-This vulnerability was discovered by:
-cleemy desu wayo working with Trend Micro Zero Day Initiative
-
-Thanks to Jim Meyering and Paul Eggert discussing the different
-ways to fix this and for coordinating the patch release schedule
-with gzip.
----
- src/scripts/xzgrep.in | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
-diff --git a/src/scripts/xzgrep.in b/src/scripts/xzgrep.in
-index b180936..e5186ba 100644
---- a/src/scripts/xzgrep.in
-+++ b/src/scripts/xzgrep.in
-@@ -180,22 +180,26 @@ for i; do
-          { test $# -eq 1 || test $no_filename -eq 1; }; then
-       eval "$grep"
-     else
-+      # Append a colon so that the last character will never be a newline
-+      # which would otherwise get lost in shell command substitution.
-+      i="$i:"
-+
-+      # Escape & \ | and newlines only if such characters are present
-+      # (speed optimization).
-       case $i in
-       (*'
- '* | *'&'* | *'\'* | *'|'*)
--        i=$(printf '%s\n' "$i" |
--            sed '
--              $!N
--              $s/[&\|]/\\&/g
--              $s/\n/\\n/g
--            ');;
-+        i=$(printf '%s\n' "$i" | LC_ALL=C sed 's/[&\|]/\\&/g; $!s/$/\\/');;
-       esac
--      sed_script="s|^|$i:|"
-+
-+      # $i already ends with a colon so don't add it here.
-+      sed_script="s|^|$i|"
- 
-       # Fail if grep or sed fails.
-       r=$(
-         exec 4>&1
--        (eval "$grep" 4>&-; echo $? >&4) 3>&- | sed "$sed_script" >&3 4>&-
-+        (eval "$grep" 4>&-; echo $? >&4) 3>&- |
-+            LC_ALL=C sed "$sed_script" >&3 4>&-
-       ) || r=2
-       exit $r
-     fi >&3 5>&-
--- 
-2.35.1
diff --git a/xz/pkg.yaml b/xz/pkg.yaml
index ac72fb0..8411a17 100644
--- a/xz/pkg.yaml
+++ b/xz/pkg.yaml
@@ -19,7 +19,6 @@ steps:
         tar -xf xz.tar.gz --strip-components=1 -C xz
 
         cd xz
-        patch -p1 < /pkg/patches/xzgrep-ZDI-CAN-16587.patch
         ./autogen.sh --no-po4a
 
         cd ../build