diff --git a/packages/aws-iam-authenticator/Cargo.toml b/packages/aws-iam-authenticator/Cargo.toml
index adc5c571ddf..a12bcbcdea1 100644
--- a/packages/aws-iam-authenticator/Cargo.toml
+++ b/packages/aws-iam-authenticator/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://github.com/kubernetes-sigs/aws-iam-authenticator/archive/v0.5.1/aws-iam-authenticator-0.5.1.tar.gz"
-sha512 = "d2d3fb9eb800811f864b3fa3fa0f018bf382cc95339f57348df86917552a2d29203bec888cee0af34eee62562e754e1e01afd4d36a990ebeb98bbddda7b6ff07"
+url = "https://github.com/kubernetes-sigs/aws-iam-authenticator/archive/v0.5.2/aws-iam-authenticator-0.5.2.tar.gz"
+sha512 = "a16a630096ed3223d156e1586f02ffcfcf256f12530ba565f5f1f649c83418cd71ea66c554c9e1edd1b44dd745d9393f4ed4c63c62677ae973e9bd9a1a24fe5b"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/aws-iam-authenticator/aws-iam-authenticator.spec b/packages/aws-iam-authenticator/aws-iam-authenticator.spec
index 21474b8e885..30d098775bf 100644
--- a/packages/aws-iam-authenticator/aws-iam-authenticator.spec
+++ b/packages/aws-iam-authenticator/aws-iam-authenticator.spec
@@ -2,7 +2,7 @@
 %global gorepo aws-iam-authenticator
 %global goimport %{goproject}/%{gorepo}
 
-%global gover 0.5.1
+%global gover 0.5.2
 %global rpmver %{gover}
 
 %global _dwz_low_mem_die_limit 0
diff --git a/packages/ca-certificates/Cargo.toml b/packages/ca-certificates/Cargo.toml
index 30d123c9a0f..a81a599c1e0 100644
--- a/packages/ca-certificates/Cargo.toml
+++ b/packages/ca-certificates/Cargo.toml
@@ -9,5 +9,5 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://curl.haxx.se/ca/cacert-2020-07-22.pem"
-sha512 = "0d49bd1435a25b113a34ac38b337a9c904b6ac720824fd55d410ff6d8f6d0f637b54fd92cdff31d1c632b6a77f35fe55de9c756f35365387cea94f0fd93631b1"
+url = "https://curl.haxx.se/ca/cacert-2020-10-14.pem"
+sha512 = "f72d08913f2e1271a2f4bb1b77144bbea21fff28113074474f83d0a3bafc54cad69449bd98d6c228d78b409b6055a7efb341b75878724bd9d6a468dab20cf541"
diff --git a/packages/ca-certificates/ca-certificates.spec b/packages/ca-certificates/ca-certificates.spec
index bf7ebdc509c..442a5b52ea3 100644
--- a/packages/ca-certificates/ca-certificates.spec
+++ b/packages/ca-certificates/ca-certificates.spec
@@ -1,12 +1,12 @@
 Name: %{_cross_os}ca-certificates
-Version: 2020.07.22
+Version: 2020.10.14
 Release: 1%{?dist}
 Summary: CA certificates extracted from Mozilla
 License: MPL-2.0
 # Note: You can see changes here:
 # https://hg.mozilla.org/projects/nss/log/tip/lib/ckfw/builtins/certdata.txt
 URL: https://curl.haxx.se/docs/caextract.html
-Source0: https://curl.haxx.se/ca/cacert-2020-07-22.pem
+Source0: https://curl.haxx.se/ca/cacert-2020-10-14.pem
 Source1: ca-certificates.conf
 
 %description
diff --git a/packages/chrony/0001-sys_linux-add-support-for-TCP-sockets.patch b/packages/chrony/0001-sys_linux-add-support-for-TCP-sockets.patch
deleted file mode 100644
index 26ca8e9dfdd..00000000000
--- a/packages/chrony/0001-sys_linux-add-support-for-TCP-sockets.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 1e3925f7a62765d271cfad4eb371c6e555911746 Mon Sep 17 00:00:00 2001
-From: Jamie Anderson <jamieand@amazon.com>
-Date: Wed, 26 Feb 2020 20:29:00 +0000
-Subject: [PATCH] sys_linux: add support for TCP sockets
-
-This patch was reworked from an upstream patch to only apply changes to
-the seccomp filter, to allow later patches to the seccomp filter to
-apply cleanly.  The upstream patch message is preserved below:
-
-From 02ada36838e48942dd1ecd0513c3449fcf9135df Mon Sep 17 00:00:00 2001
-From: Miroslav Lichvar <mlichvar@redhat.com>
-Date: Tue, 6 Aug 2019 18:33:06 +0200
-Subject: socket: add support for TCP sockets
-
-TCP sockets will be needed for NTS key establishment.
----
- sys_linux.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/sys_linux.c b/sys_linux.c
-index 898dc7a..1f36696 100644
---- a/sys_linux.c
-+++ b/sys_linux.c
-@@ -496,9 +496,10 @@ SYS_Linux_EnableSystemCallFilter(int level)
-     SCMP_SYS(stat), SCMP_SYS(stat64), SCMP_SYS(statfs), SCMP_SYS(statfs64),
-     SCMP_SYS(unlink), SCMP_SYS(unlinkat),
-     /* Socket */
--    SCMP_SYS(bind), SCMP_SYS(connect), SCMP_SYS(getsockname), SCMP_SYS(getsockopt),
--    SCMP_SYS(recv), SCMP_SYS(recvfrom), SCMP_SYS(recvmmsg), SCMP_SYS(recvmsg),
--    SCMP_SYS(send), SCMP_SYS(sendmmsg), SCMP_SYS(sendmsg), SCMP_SYS(sendto),
-+    SCMP_SYS(accept), SCMP_SYS(bind), SCMP_SYS(connect), SCMP_SYS(getsockname),
-+    SCMP_SYS(getsockopt), SCMP_SYS(recv), SCMP_SYS(recvfrom),
-+    SCMP_SYS(recvmmsg), SCMP_SYS(recvmsg), SCMP_SYS(send), SCMP_SYS(sendmmsg),
-+    SCMP_SYS(sendmsg), SCMP_SYS(sendto), SCMP_SYS(shutdown),
-     /* TODO: check socketcall arguments */
-     SCMP_SYS(socketcall),
-     /* General I/O */
--- 
-2.25.0.191.gde93cc14ab
-
diff --git a/packages/chrony/0002-sys_linux-allow-F_GETFL-in-seccomp-filter.patch b/packages/chrony/0002-sys_linux-allow-F_GETFL-in-seccomp-filter.patch
deleted file mode 100644
index 3c8c425ec67..00000000000
--- a/packages/chrony/0002-sys_linux-allow-F_GETFL-in-seccomp-filter.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From 429c4468b0058d9c2e2fffbf6660b0f1581af6af Mon Sep 17 00:00:00 2001
-From: Miroslav Lichvar <mlichvar@redhat.com>
-Date: Thu, 24 Oct 2019 12:42:02 +0200
-Subject: sys_linux: allow F_GETFL in seccomp filter
-
-This is needed for fdopen().
-
-diff --git a/sys_linux.c b/sys_linux.c
-index 1f36696..63eb8f1 100644
---- a/sys_linux.c
-+++ b/sys_linux.c
-@@ -529,7 +529,7 @@ SYS_Linux_EnableSystemCallFilter(int level)
- #endif
-   };
- 
--  const static int fcntls[] = { F_GETFD, F_SETFD, F_SETFL };
-+  const static int fcntls[] = { F_GETFD, F_SETFD, F_GETFL, F_SETFL };
- 
-   const static unsigned long ioctls[] = {
-     FIONREAD, TCGETS,
--- 
-cgit v0.10.2
-
diff --git a/packages/chrony/0003-sys_linux-allow-clock_adjtime-in-seccomp-filter.patch b/packages/chrony/0003-sys_linux-allow-clock_adjtime-in-seccomp-filter.patch
deleted file mode 100644
index 2fa3baca722..00000000000
--- a/packages/chrony/0003-sys_linux-allow-clock_adjtime-in-seccomp-filter.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 0cf506c92967c84f9ed83ba9e1be946a7fda6425 Mon Sep 17 00:00:00 2001
-From: Miroslav Lichvar <mlichvar@redhat.com>
-Date: Mon, 2 Dec 2019 12:47:13 +0100
-Subject: sys_linux: allow clock_adjtime in seccomp filter
-
-The adjtimex() function in glibc was switched to the clock_adjtime
-system call.
-
-diff --git a/sys_linux.c b/sys_linux.c
-index 63eb8f1..fcf89c2 100644
---- a/sys_linux.c
-+++ b/sys_linux.c
-@@ -478,8 +478,8 @@ SYS_Linux_EnableSystemCallFilter(int level)
- {
-   const int syscalls[] = {
-     /* Clock */
--    SCMP_SYS(adjtimex), SCMP_SYS(clock_gettime), SCMP_SYS(gettimeofday),
--    SCMP_SYS(settimeofday), SCMP_SYS(time),
-+    SCMP_SYS(adjtimex), SCMP_SYS(clock_adjtime), SCMP_SYS(clock_gettime),
-+    SCMP_SYS(gettimeofday), SCMP_SYS(settimeofday), SCMP_SYS(time),
-     /* Process */
-     SCMP_SYS(clone), SCMP_SYS(exit), SCMP_SYS(exit_group), SCMP_SYS(getpid),
-     SCMP_SYS(getrlimit), SCMP_SYS(rt_sigaction), SCMP_SYS(rt_sigreturn),
--- 
-cgit v0.10.2
-
diff --git a/packages/chrony/0004-sys_linux-allow-renameat2-in-seccomp-filter.patch b/packages/chrony/0004-sys_linux-allow-renameat2-in-seccomp-filter.patch
deleted file mode 100644
index 1ab93ec3d52..00000000000
--- a/packages/chrony/0004-sys_linux-allow-renameat2-in-seccomp-filter.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 994409a03697b8df68115342dc8d1e7ceeeb40bd Mon Sep 17 00:00:00 2001
-From: Vincent Blut <vincent.debian@free.fr>
-Date: Thu, 16 Jan 2020 17:04:35 +0100
-Subject: sys_linux: allow renameat2 in seccomp filter
-
-This is needed for architectures that support neither rename() nor
-renameat() (e.g. riscv64)
-
-diff --git a/sys_linux.c b/sys_linux.c
-index fcf89c2..d2dc908 100644
---- a/sys_linux.c
-+++ b/sys_linux.c
-@@ -493,8 +493,8 @@ SYS_Linux_EnableSystemCallFilter(int level)
-     SCMP_SYS(chown32), SCMP_SYS(faccessat), SCMP_SYS(fchmodat), SCMP_SYS(fchownat),
-     SCMP_SYS(fstat), SCMP_SYS(fstat64), SCMP_SYS(getdents), SCMP_SYS(getdents64),
-     SCMP_SYS(lseek), SCMP_SYS(newfstatat), SCMP_SYS(rename), SCMP_SYS(renameat),
--    SCMP_SYS(stat), SCMP_SYS(stat64), SCMP_SYS(statfs), SCMP_SYS(statfs64),
--    SCMP_SYS(unlink), SCMP_SYS(unlinkat),
-+    SCMP_SYS(renameat2), SCMP_SYS(stat), SCMP_SYS(stat64), SCMP_SYS(statfs),
-+    SCMP_SYS(statfs64), SCMP_SYS(unlink), SCMP_SYS(unlinkat),
-     /* Socket */
-     SCMP_SYS(accept), SCMP_SYS(bind), SCMP_SYS(connect), SCMP_SYS(getsockname),
-     SCMP_SYS(getsockopt), SCMP_SYS(recv), SCMP_SYS(recvfrom),
--- 
-cgit v0.10.2
-
diff --git a/packages/chrony/Cargo.toml b/packages/chrony/Cargo.toml
index f8f4e897e3e..34ba8daf1f1 100644
--- a/packages/chrony/Cargo.toml
+++ b/packages/chrony/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://download.tuxfamily.org/chrony/chrony-3.5.1.tar.gz"
-sha512 = "489cf614bfb2c1e024343af1316c339b287ed5c7b6cec15b44ef3d90512036fb1da3fd627d291a193c59d9c5c095afa66c529eeb6fd0c1bbc8256ed8873b7984"
+url = "https://download.tuxfamily.org/chrony/chrony-4.0.tar.gz"
+sha512 = "a1c11a386c43f495910f7f2e9b5fbb1652c3631471d182b9b8203dfef98611d11535ad547a879856551263aed0ae2e30e4135b8ed89553684706166bc1c725c9"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/chrony/chrony.spec b/packages/chrony/chrony.spec
index 6e7df9e9cee..708209ffee4 100644
--- a/packages/chrony/chrony.spec
+++ b/packages/chrony/chrony.spec
@@ -1,5 +1,5 @@
 Name: %{_cross_os}chrony
-Version: 3.5.1
+Version: 4.0
 Release: 1%{?dist}
 Summary: A versatile implementation of the Network Time Protocol
 License: GPL-2.0-only
@@ -17,19 +17,6 @@ BuildRequires: %{_cross_os}readline-devel
 Requires: %{_cross_os}libcap
 Requires: %{_cross_os}libseccomp
 
-# Patches taken from upstream
-
-# Update seccomp filter to work with glibc 2.31
-# Reworked version of
-# https://git.tuxfamily.org/chrony/chrony.git/patch/sys_linux.c?id=02ada36838e48942dd1ecd0513c3449fcf9135df
-Patch0: 0001-sys_linux-add-support-for-TCP-sockets.patch
-# https://git.tuxfamily.org/chrony/chrony.git/patch/sys_linux.c?id=429c4468b0058d9c2e2fffbf6660b0f1581af6af
-Patch1: 0002-sys_linux-allow-F_GETFL-in-seccomp-filter.patch
-# https://git.tuxfamily.org/chrony/chrony.git/patch/sys_linux.c?id=0cf506c92967c84f9ed83ba9e1be946a7fda6425
-Patch2: 0003-sys_linux-allow-clock_adjtime-in-seccomp-filter.patch
-# https://git.tuxfamily.org/chrony/chrony.git/patch/sys_linux.c?id=994409a03697b8df68115342dc8d1e7ceeeb40bd
-Patch3: 0004-sys_linux-allow-renameat2-in-seccomp-filter.patch
-
 %description
 %{summary}.
 
diff --git a/packages/cni-plugins/Cargo.toml b/packages/cni-plugins/Cargo.toml
index 92c5eac54df..9e3ee6ce2c2 100644
--- a/packages/cni-plugins/Cargo.toml
+++ b/packages/cni-plugins/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://github.com/containernetworking/plugins/archive/v0.8.6/plugins-0.8.6.tar.gz"
-sha512 = "8815de8b375c737c3a1951b0a7ef5786209fdcf723aa1bc7c2dab7e1bbdee4933a7237f41bdee4208828b457bc79ec69ff68db060c52bab13863f42b042480c8"
+url = "https://github.com/containernetworking/plugins/archive/v0.8.7/plugins-0.8.7.tar.gz"
+sha512 = "1b11b080b1f54a8a792b1048573d7d882603b76929f0c9343eeb2e010f97700c0deea4489faeb493a1aeac12557b6847b26784c378d0430c47de6bdaca6aa70f"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/cni-plugins/cni-plugins.spec b/packages/cni-plugins/cni-plugins.spec
index c7ca72c83d8..6edf8a07482 100644
--- a/packages/cni-plugins/cni-plugins.spec
+++ b/packages/cni-plugins/cni-plugins.spec
@@ -2,7 +2,7 @@
 %global gorepo plugins
 %global goimport %{goproject}/%{gorepo}
 
-%global gover 0.8.6
+%global gover 0.8.7
 %global rpmver %{gover}
 
 %global _dwz_low_mem_die_limit 0
diff --git a/packages/docker-cli/Cargo.toml b/packages/docker-cli/Cargo.toml
index fdc75c39f6c..057e1c0e015 100644
--- a/packages/docker-cli/Cargo.toml
+++ b/packages/docker-cli/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://github.com/docker/cli/archive/v19.03.12/cli-19.03.12.tar.gz"
-sha512 = "3114ba5134d8606393c526d9d780cae4ca8584017c734a49250be43eb84ab9c716c30735d04b33a1ef47475b06b31f269f4a020ac1b6647b58504acb9fed8be6"
+url = "https://github.com/docker/cli/archive/v19.03.13/cli-19.03.13.tar.gz"
+sha512 = "738745548bcb416ccadefe1c340b3206b36efb3c222c310b853146f9fe0839bd879576d895bcc53f1f709850ef77888a9990742dd647b9f3cccaa05876a7c9d1"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/docker-cli/docker-cli.spec b/packages/docker-cli/docker-cli.spec
index 16e3473e281..5936d9e1f6d 100644
--- a/packages/docker-cli/docker-cli.spec
+++ b/packages/docker-cli/docker-cli.spec
@@ -2,7 +2,7 @@
 %global gorepo cli
 %global goimport %{goproject}/%{gorepo}
 
-%global gover 19.03.12
+%global gover 19.03.13
 %global rpmver %{gover}
 %global gitrev 0ed913b885c8919944a2e4c8d0b80a318a8dd48b
 
diff --git a/packages/docker-engine/Cargo.toml b/packages/docker-engine/Cargo.toml
index ba7e8ae7621..1317a7cd895 100644
--- a/packages/docker-engine/Cargo.toml
+++ b/packages/docker-engine/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://github.com/docker/engine/archive/v19.03.12/engine-19.03.12.tar.gz"
-sha512 = "51632ca8cff03440e3b76ad3e7f06b9c6275c776f4c4f9dc88cd7f5aa9b8aa8cb16ce2b3702426cb93f3714265a6cd28d4ba31612db37199e2915821b9ee8fd4"
+url = "https://github.com/moby/moby/archive/v19.03.13/moby-19.03.13.tar.gz"
+sha512 = "b034ba2d00f944bc57f44858f95f4db5960930e2fb3efe41183ed88a6f29fcb60ea007b0b28705a00b467ba38da557654c5611c6ef6731361802936568879698"
 
 [[package.metadata.build-package.external-files]]
 path = "awslogs_update_aws-sdk-go_to_support_imdsv2.patch.bz2"
diff --git a/packages/docker-engine/docker-engine.spec b/packages/docker-engine/docker-engine.spec
index 44ffed7126e..05d099f45ff 100644
--- a/packages/docker-engine/docker-engine.spec
+++ b/packages/docker-engine/docker-engine.spec
@@ -1,13 +1,9 @@
-%global goproject github.com/docker
-%global gorepo engine
-%global goimport %{goproject}/%{gorepo}
+%global project moby
+%global repo github.com/moby/%{project}
+%global goorg github.com/docker
+%global goimport %{goorg}/docker
 
-# Docker's remote repository location does not match its canonical
-# import path, so we define macros for that as well.
-%global dorepo docker
-%global doimport %{goproject}/%{dorepo}
-
-%global gover 19.03.12
+%global gover 19.03.13
 %global rpmver %{gover}
 %global gitrev 9dc6525e6118a25fab2be322d1914740ea842495
 
@@ -15,13 +11,13 @@
 
 %global _dwz_low_mem_die_limit 0
 
-Name: %{_cross_os}docker-%{gorepo}
+Name: %{_cross_os}docker-engine
 Version: %{rpmver}
 Release: 1%{?dist}
 Summary: Docker engine
 License: Apache-2.0
-URL: https://%{goimport}
-Source0: https://%{goimport}/archive/v%{gover}/%{gorepo}-%{gover}.tar.gz
+URL: https://%{repo}
+Source0: https://%{repo}/archive/v%{gover}/%{project}-%{gover}.tar.gz
 Source1: docker.service
 Source2: docker.socket
 Source3: docker-sysusers.conf
@@ -49,11 +45,11 @@ Requires: %{_cross_os}systemd
 %{summary}.
 
 %prep
-%autosetup -Sgit -n %{gorepo}-%{gover} -p1
-%cross_go_setup %{gorepo}-%{gover} %{goproject} %{doimport}
+%autosetup -Sgit -n %{project}-%{gover} -p1
+%cross_go_setup %{project}-%{gover} %{goorg} %{goimport}
 
 %build
-%cross_go_configure %{doimport}
+%cross_go_configure %{goimport}
 BUILDTAGS="autogen journald selinux seccomp"
 BUILDTAGS+=" exclude_graphdriver_btrfs"
 BUILDTAGS+=" exclude_graphdriver_devicemapper"
@@ -66,7 +62,7 @@ export BUILDTIME=$(date -u -d "@%{source_date_epoch}" --rfc-3339 ns 2> /dev/null
 export PLATFORM="Docker Engine - Community"
 chmod +x ./hack/make/.go-autogen
 ./hack/make/.go-autogen
-go build -buildmode pie -tags="${BUILDTAGS}" -o dockerd %{doimport}/cmd/dockerd
+go build -buildmode pie -tags="${BUILDTAGS}" -o dockerd %{goimport}/cmd/dockerd
 
 %install
 install -d %{buildroot}%{_cross_bindir}
diff --git a/packages/docker-init/docker-init.spec b/packages/docker-init/docker-init.spec
index d7607a885eb..8ff747b3d30 100644
--- a/packages/docker-init/docker-init.spec
+++ b/packages/docker-init/docker-init.spec
@@ -3,7 +3,7 @@
 %global tiniver 0.19.0
 
 Name: %{_cross_os}docker-init
-Version: 18.09.9
+Version: 19.03.13
 Release: 1%{?dist}
 Summary: Init for containers
 License: MIT
diff --git a/packages/docker-proxy/0001-bridge-Fix-hwaddr-set-race-between-us-and-udev.patch b/packages/docker-proxy/0001-bridge-Fix-hwaddr-set-race-between-us-and-udev.patch
deleted file mode 100644
index 7883458e924..00000000000
--- a/packages/docker-proxy/0001-bridge-Fix-hwaddr-set-race-between-us-and-udev.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From 8710ffea0b06b2eeb66fd231b5a27fbf538377ac Mon Sep 17 00:00:00 2001
-From: Tomas Janousek <tomi@nomi.cz>
-Date: Sun, 19 May 2019 18:22:39 +0200
-Subject: [PATCH] bridge: Fix hwaddr set race between us and udev
-
-systemd and udev in their default configuration attempt to set a
-persistent MAC address for network interfaces that don't have one
-already [systemd-def-link]. We set the address only after creating the
-interface, so there is a race between us and udev. There are several
-outcomes (that actually occur, this race is very much not a theoretical
-one):
-
-* We set the address before udev gets to the networking rules, so udev
-  sees `/sys/devices/virtual/net/docker0/addr_assign_type = 3`
-  (NET_ADDR_SET). This means there's no need to assign a different
-  address and everything is fine.
-
-* udev reads `/sys/devices/virtual/net/docker0/addr_assign_type` before
-  we set the address, gets `1` (NET_ADDR_RANDOM), and proceeds to
-  generate and set a persistent address.
-
-  Old versions of udev (pre-v242, i.e. without [udev-patch]) would then
-  fail to generate an address, spit out "Could not generate persistent
-  MAC address for docker0: No such file or directory" (see [udev-issue],
-  and everything would be probably fine as well.
-
-  Current version of udev (with [udev-patch]) will generate an address
-  just fine and then race us setting it. As udev does more work than we,
-  the most probable outcome is that udev will overwrite the address we
-  set and possibly cause some trouble later on.
-
-On a clean Debian Buster (from Vagrant) VM with systemd/udev 242 from
-Debian Experimental, `docker network create net1` up to `net7` resulted
-in 3 bridges having a 02:42: address and 4 bridges having a seemingly
-random (actually generated from interface name) address. With systemd
-241, the result would be all bridges having a 02:42:, but some "Could
-not generate persistent MAC address for" messages in the log.
-
-The fix is to revert the MAC address setting fix from 79b3e7761d249a6f,
-as it is no longer necessary with current netlink [netlink-addr-add],
-and set the address atomically when creating the bridge interface, not
-after that.
-
-[systemd-def-link]: https://github.com/systemd/systemd/blob/a166cd3aacdbfd4df196bb4ca9f43cff19cf9fec/network/99-default.link
-[udev-patch]: https://github.com/systemd/systemd/commit/6d36464065601f79a352367cf099be8907d8f9aa
-[udev-issue]: https://github.com/systemd/systemd/issues/3374
-[netlink-addr-add]: https://github.com/vishvananda/netlink/commit/7d9b424492b5319e5993c5d6e8bef48e583aabd6
-
-...
-
-Do note that a similar race happens when creating veth devices as well.
-I wasn't able to reproduce getting a wrong (non-02:42:) address,
-possibly because the address is set by docker later, maybe only after
-the interface is moved to another network namespace (but I'm just
-guessing here). Still, different timings result in various error
-messages being logged ("link_config: could not get ethtool features for
-vethd9c938e" and the like) depending on when the interface disappears
-from the primary network namespace. I'm not sure how to fix this and I
-don't intend to dig deeper into this.
-
-Signed-off-by: Tomas Janousek <tomi@nomi.cz>
----
- drivers/bridge/setup_device.go | 13 ++++++-------
- 1 file changed, 6 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/bridge/setup_device.go b/drivers/bridge/setup_device.go
-index a9dfd067..548ad951 100644
---- a/drivers/bridge/setup_device.go
-+++ b/drivers/bridge/setup_device.go
-@@ -35,18 +35,17 @@ func setupDevice(config *networkConfiguration, i *bridgeInterface) error {
- 		setMac = kv.Kernel > 3 || (kv.Kernel == 3 && kv.Major >= 3)
- 	}
- 
-+	if setMac {
-+		hwAddr := netutils.GenerateRandomMAC()
-+		i.Link.Attrs().HardwareAddr = hwAddr
-+		logrus.Debugf("Setting bridge mac address to %s", hwAddr)
-+	}
-+
- 	if err = i.nlh.LinkAdd(i.Link); err != nil {
- 		logrus.Debugf("Failed to create bridge %s via netlink. Trying ioctl", config.BridgeName)
- 		return ioctlCreateBridge(config.BridgeName, setMac)
- 	}
- 
--	if setMac {
--		hwAddr := netutils.GenerateRandomMAC()
--		if err = i.nlh.LinkSetHardwareAddr(i.Link, hwAddr); err != nil {
--			return fmt.Errorf("failed to set bridge mac-address %s : %s", hwAddr, err.Error())
--		}
--		logrus.Debugf("Setting bridge mac address to %s", hwAddr)
--	}
- 	return err
- }
- 
--- 
-2.21.0
-
diff --git a/packages/docker-proxy/Cargo.toml b/packages/docker-proxy/Cargo.toml
index 60ff6d91f83..00bc8ce32d2 100644
--- a/packages/docker-proxy/Cargo.toml
+++ b/packages/docker-proxy/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://github.com/docker/libnetwork/archive/48722da498b202dfed2eb4299dfcfbdf8b75392d/libnetwork-48722da498b202dfed2eb4299dfcfbdf8b75392d.tar.gz"
-sha512 = "58801dadbd70fc4df8f41d605f5721d93c562414241ac632f40e35a04163c3761904f5e917d3e078bf2a46fb873d918b5c31321c319b6db23d437e5875b49c54"
+url = "https://github.com/docker/libnetwork/archive/026aabaa659832804b01754aaadd2c0f420c68b6/libnetwork-026aabaa659832804b01754aaadd2c0f420c68b6.tar.gz"
+sha512 = "fe8644611e975c051ee6e7ad4871624fb45862d9b4a2fd62ea4283e76ad9804d91d585e2165915b09356f11f9dfb31c40dd9ce6a66d63c5032c8c62354960538"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/docker-proxy/docker-proxy.spec b/packages/docker-proxy/docker-proxy.spec
index f73336c35e4..c4845b1eff8 100644
--- a/packages/docker-proxy/docker-proxy.spec
+++ b/packages/docker-proxy/docker-proxy.spec
@@ -1,12 +1,14 @@
 %global goproject github.com/docker
 %global gorepo libnetwork
 %global goimport %{goproject}/%{gorepo}
-%global commit 48722da498b202dfed2eb4299dfcfbdf8b75392d
+# Use the libnetwork commit listed in this file for the docker version we ship:
+# https://github.com/moby/moby/blob/DOCKER-VERSION-HERE/vendor.conf
+%global commit 026aabaa659832804b01754aaadd2c0f420c68b6
 
 %global _dwz_low_mem_die_limit 0
 
 Name: %{_cross_os}docker-proxy
-Version: 18.09.9
+Version: 19.03.13
 Release: 1%{?dist}
 Summary: Docker CLI
 # mostly Apache-2.0, client/mflag is BSD-3-Clause
@@ -14,7 +16,6 @@ License: Apache-2.0 AND BSD-3-Clause
 URL: https://%{goimport}
 Source0: https://%{goimport}/archive/%{commit}/%{gorepo}-%{commit}.tar.gz
 Source1000: clarify.toml
-Patch1: 0001-bridge-Fix-hwaddr-set-race-between-us-and-udev.patch
 
 BuildRequires: git
 BuildRequires: %{_cross_os}glibc-devel
diff --git a/packages/iproute/Cargo.toml b/packages/iproute/Cargo.toml
index e031a084261..c129dae9a4d 100644
--- a/packages/iproute/Cargo.toml
+++ b/packages/iproute/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "http://kernel.org/pub/linux/utils/net/iproute2/iproute2-5.7.0.tar.xz"
-sha512 = "d5ef68e0eb8e84fbff68c2e7dd4097b9ceb438c928d17ede4130876802dfeafe8bf08d82b4fd39005314e0679c0b261aaa3d6a0a2ff364074a43a043a855a634"
+url = "http://kernel.org/pub/linux/utils/net/iproute2/iproute2-5.9.0.tar.xz"
+sha512 = "bce59b0e8d876f10f94926be7f2a7cda0de15db04fabedfe938649d486ca6d6d222523d1661b8b36ea50e35369a4730938d6ebeb80577ac0522a3432037bcd50"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/iproute/iproute.spec b/packages/iproute/iproute.spec
index 0237bdfa250..93192373459 100644
--- a/packages/iproute/iproute.spec
+++ b/packages/iproute/iproute.spec
@@ -1,5 +1,5 @@
 Name: %{_cross_os}iproute
-Version: 5.7.0
+Version: 5.9.0
 Release: 1%{?dist}
 Summary: Tools for advanced IP routing and network device configuration
 License: GPL-2.0-or-later AND GPL-2.0-only
diff --git a/packages/iptables/Cargo.toml b/packages/iptables/Cargo.toml
index 3a74f5721f9..627169d253e 100644
--- a/packages/iptables/Cargo.toml
+++ b/packages/iptables/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "http://www.netfilter.org/projects/iptables/files/iptables-1.8.5.tar.bz2"
-sha512 = "6a6baa541bb7aa331b176e0a91894e0766859814b59e77c71351ac34d6ebd337487981db48c70e476a48c67bcf891cfc663221a7582feb1496ad1df56eb28da8"
+url = "http://www.netfilter.org/projects/iptables/files/iptables-1.8.6.tar.bz2"
+sha512 = "d06e4cddb69822c4618664a35877fc5811992936cade2040bb0e4eb25a4d879eadc7c84401c40fb39ffac7888568505adcb1cfe995cd166a15c702237daf6acf"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/iptables/iptables.spec b/packages/iptables/iptables.spec
index 71274be040f..f457c4aa7cf 100644
--- a/packages/iptables/iptables.spec
+++ b/packages/iptables/iptables.spec
@@ -1,5 +1,5 @@
 Name: %{_cross_os}iptables
-Version: 1.8.5
+Version: 1.8.6
 Release: 1%{?dist}
 Summary: Tools for managing Linux kernel packet filtering capabilities
 License: GPL-2.0-or-later AND GPL-2.0-only
@@ -71,6 +71,7 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
 %{_cross_libdir}/xtables/*.so
 %exclude %{_cross_mandir}/*
 %exclude %{_cross_datadir}/xtables/pf.os
+%exclude %{_cross_sbindir}/iptables-apply
 %exclude %{_cross_sbindir}/ip6tables-apply
 %exclude %{_cross_sbindir}/nfnl_osf
 
diff --git a/packages/iputils/Cargo.toml b/packages/iputils/Cargo.toml
index 3e22adb4d2e..86a116ae1fc 100644
--- a/packages/iputils/Cargo.toml
+++ b/packages/iputils/Cargo.toml
@@ -9,9 +9,9 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-path = "iputils-s20190709.tar.gz"
-url = "https://github.com/iputils/iputils/archive/s20190709.tar.gz"
-sha512 = "5db18ac49fa46ed810da4d508e78f4baf2d5c07e7f923eb49d005ad8745743d8861e5788b34a7e37fb7261cee7ddfb768b737eee9d200502ea53537142cac6b5"
+path = "iputils-s20200821.tar.gz"
+url = "https://github.com/iputils/iputils/archive/s20200821.tar.gz"
+sha512 = "4a57c3637cdd9aab2600682774e27370716cbdf1c7ac8ae61bf86c21c08701a5b697792df4aa95309b196eaa74f3cb6b2836a40f04da0e602156e982ac99d8c9"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/iputils/iputils.spec b/packages/iputils/iputils.spec
index 12253e3b876..9528b3e8c0c 100644
--- a/packages/iputils/iputils.spec
+++ b/packages/iputils/iputils.spec
@@ -1,5 +1,5 @@
 Name: %{_cross_os}iputils
-Version: 20190709
+Version: 20200821
 Release: 1%{?dist}
 Summary: A set of network monitoring tools
 License: GPL-2.0-or-later AND BSD-3-Clause
diff --git a/packages/kernel/Cargo.toml b/packages/kernel/Cargo.toml
index b93b4ac9ef1..cab9d3ec80a 100644
--- a/packages/kernel/Cargo.toml
+++ b/packages/kernel/Cargo.toml
@@ -10,5 +10,5 @@ path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
 # Use latest-srpm-url.sh to get this.
-url = "https://cdn.amazonlinux.com/blobstore/36ea759a11e6e364ab8b2bf857c03cdbf53d33e348e785ed6767b87f8ac12c27/kernel-5.4.58-32.125.amzn2.src.rpm"
-sha512 = "c7c2fdcb752cc6ddc6410ac9195e5443b66e2e6354f4299786df6aa303aad64b3a4aa86bec4f1d8f0ac93280353ca2cc989e67417e974aa1a1f38013b01c9e6f"
+url = "https://cdn.amazonlinux.com/blobstore/195cb5ec07623ef7be724bd99bd49eda17ebe7ad82d752d0e39b096de5411500/kernel-5.4.68-34.125.amzn2.src.rpm"
+sha512 = "83833e09f14d8fbabae723051b4f24e9b658502d7286918146f12e26783985161194e8b94eeceea03812738495be87563c9e36738f22ae2a5f93c43b08ab3c52"
diff --git a/packages/kernel/kernel.spec b/packages/kernel/kernel.spec
index a1b2212fae5..8e8bc8183e5 100644
--- a/packages/kernel/kernel.spec
+++ b/packages/kernel/kernel.spec
@@ -1,13 +1,13 @@
 %global debug_package %{nil}
 
 Name: %{_cross_os}kernel
-Version: 5.4.58
+Version: 5.4.68
 Release: 1%{?dist}
 Summary: The Linux kernel
 License: GPL-2.0 WITH Linux-syscall-note
 URL: https://www.kernel.org/
 # Use latest-srpm-url.sh to get this.
-Source0: https://cdn.amazonlinux.com/blobstore/36ea759a11e6e364ab8b2bf857c03cdbf53d33e348e785ed6767b87f8ac12c27/kernel-5.4.58-32.125.amzn2.src.rpm
+Source0: https://cdn.amazonlinux.com/blobstore/195cb5ec07623ef7be724bd99bd49eda17ebe7ad82d752d0e39b096de5411500/kernel-5.4.68-34.125.amzn2.src.rpm
 Source100: config-bottlerocket
 Patch0001: 0001-lustrefsx-Disable-Werror-stringop-overflow.patch
 BuildRequires: bc
diff --git a/packages/kubernetes-1.16/Cargo.toml b/packages/kubernetes-1.16/Cargo.toml
index ed0c601205a..c52abcf2863 100644
--- a/packages/kubernetes-1.16/Cargo.toml
+++ b/packages/kubernetes-1.16/Cargo.toml
@@ -14,8 +14,8 @@ package-name = "kubernetes-1.16"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://github.com/kubernetes/kubernetes/archive/v1.16.13/kubernetes-1.16.13.tar.gz"
-sha512 = "c4f1d39fb9c16e2bcd2ebd0f8e8dbc889e02c4c28814132fc3856b3bf68aa4867828802e9ff48ce18f2c9c0fc246c6fbf2d9e55ca5956b4aef9cf7b4ad15b225"
+url = "https://github.com/kubernetes/kubernetes/archive/v1.16.15/kubernetes-1.16.15.tar.gz"
+sha512 = "ea075cce5996d4d830347df1dfe25b8cb385f7c51f4a898eebeab83eca899a5fd5473b210b149c8e09ad653f24b9c9f2c8bb1d7e763b83f88a4aa9d0d348431d"
 
 # This is a large patch, so we don't want to check it into the repo.  It's like
 # https://github.com/kubernetes/kubernetes/commit/a94346bef9806a135ebcfda03672966c336c1c17
diff --git a/packages/kubernetes-1.16/kubernetes-1.16.spec b/packages/kubernetes-1.16/kubernetes-1.16.spec
index a2641b3a7da..11c5209fcc1 100644
--- a/packages/kubernetes-1.16/kubernetes-1.16.spec
+++ b/packages/kubernetes-1.16/kubernetes-1.16.spec
@@ -2,7 +2,7 @@
 %global gorepo kubernetes
 %global goimport %{goproject}/%{gorepo}
 
-%global gover 1.16.13
+%global gover 1.16.15
 %global rpmver %{gover}
 
 %global _dwz_low_mem_die_limit 0
diff --git a/packages/kubernetes-1.17/Cargo.toml b/packages/kubernetes-1.17/Cargo.toml
index 24eae9faa5c..d2d94dc89e9 100644
--- a/packages/kubernetes-1.17/Cargo.toml
+++ b/packages/kubernetes-1.17/Cargo.toml
@@ -14,8 +14,8 @@ package-name = "kubernetes-1.17"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://github.com/kubernetes/kubernetes/archive/v1.17.9/kubernetes-1.17.9.tar.gz"
-sha512 = "c6c1c27a534b5b6dbbc3be34d9f8f321b0289e9032ad11549e1f028cd4cf6ba288cdc54283f5263b5e9cef017d535db911b5f7e5cbaccd2bee7d955ce2039696"
+url = "https://github.com/kubernetes/kubernetes/archive/v1.17.13/kubernetes-1.17.13.tar.gz"
+sha512 = "eaebc7d649a2a53f2a7bae8fe70ccd469f8f983a2d14148f86e86a05d66a40ce8b71d4422e653966daf4c86ccd353693cc0e9bfe3a44b5259239d047a20ddb7a"
 
 # This is a large patch, so we don't want to check it into the repo.  It's like
 # https://github.com/kubernetes/kubernetes/commit/a94346bef9806a135ebcfda03672966c336c1c17
diff --git a/packages/kubernetes-1.17/kubernetes-1.17.spec b/packages/kubernetes-1.17/kubernetes-1.17.spec
index f02ed170d32..bcab81a3c2d 100644
--- a/packages/kubernetes-1.17/kubernetes-1.17.spec
+++ b/packages/kubernetes-1.17/kubernetes-1.17.spec
@@ -2,7 +2,7 @@
 %global gorepo kubernetes
 %global goimport %{goproject}/%{gorepo}
 
-%global gover 1.17.9
+%global gover 1.17.13
 %global rpmver %{gover}
 
 %global _dwz_low_mem_die_limit 0
diff --git a/packages/kubernetes-1.18/Cargo.toml b/packages/kubernetes-1.18/Cargo.toml
index f6018992b9d..34c9a9c59d8 100644
--- a/packages/kubernetes-1.18/Cargo.toml
+++ b/packages/kubernetes-1.18/Cargo.toml
@@ -14,8 +14,8 @@ package-name = "kubernetes-1.18"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://github.com/kubernetes/kubernetes/archive/v1.18.9/kubernetes-1.18.9.tar.gz"
-sha512 = "db950af5bc964ce98ad39f237dccb0f46c698b7e801a6d8b6f96b90c3ec9650ab8f4836a764baec4c8d1b4cbea1ed5e692623f3434cb4f6f9d2dba1df482baa6"
+url = "https://github.com/kubernetes/kubernetes/archive/v1.18.10/kubernetes-1.18.10.tar.gz"
+sha512 = "967caccf8758bcdf4549ec83b795ec580e072d8108b2c8ef10f1d05696dedbfd5d472e27590bb952639f198003b44dc83da5435853337938035488959360e3d3"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/kubernetes-1.18/kubernetes-1.18.spec b/packages/kubernetes-1.18/kubernetes-1.18.spec
index d31ecd6403d..82541d6d65a 100644
--- a/packages/kubernetes-1.18/kubernetes-1.18.spec
+++ b/packages/kubernetes-1.18/kubernetes-1.18.spec
@@ -2,7 +2,7 @@
 %global gorepo kubernetes
 %global goimport %{goproject}/%{gorepo}
 
-%global gover 1.18.9
+%global gover 1.18.10
 %global rpmver %{gover}
 
 %global _dwz_low_mem_die_limit 0
diff --git a/packages/libcap/Cargo.toml b/packages/libcap/Cargo.toml
index 37027de6526..59ec638206c 100644
--- a/packages/libcap/Cargo.toml
+++ b/packages/libcap/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://git.kernel.org/pub/scm/libs/libcap/libcap.git/snapshot/libcap-2.42.tar.gz"
-sha512 = "d09a650d375c87880c800076b2e49ece7db2cab589b7d2f0850cd857f9898220facff9f5ac268361d70cfa0db97485fd2febc107f333bc7881dad45e6a91b785"
+url = "https://git.kernel.org/pub/scm/libs/libcap/libcap.git/snapshot/libcap-2.44.tar.gz"
+sha512 = "d6a31dacd357a7c8fe553e4c004e8084c9025a72073073c92d0281e297172a0cab9174cb318f495eb51804cffcca376d8b7a650f6ba3d4fb31e207fcbc99116f"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/libcap/libcap.spec b/packages/libcap/libcap.spec
index 0b06770a955..c61d1deaa16 100644
--- a/packages/libcap/libcap.spec
+++ b/packages/libcap/libcap.spec
@@ -1,5 +1,5 @@
 Name: %{_cross_os}libcap
-Version: 2.42
+Version: 2.44
 Release: 1%{?dist}
 Summary: Library for getting and setting POSIX.1e capabilities
 License: GPL-2.0-only OR BSD-3-Clause
diff --git a/packages/libexpat/Cargo.toml b/packages/libexpat/Cargo.toml
index fbe6a18fe0e..c9bb6695d63 100644
--- a/packages/libexpat/Cargo.toml
+++ b/packages/libexpat/Cargo.toml
@@ -9,9 +9,9 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-path = "expat-2.2.9.tar.gz"
-url = "https://github.com/libexpat/libexpat/archive/R_2_2_9.tar.gz#/expat-2.2.9.tar.gz"
-sha512 = "e274fa7f30630450cb3ca681b266d765dbb7f5d00d1275ff9d9b2e2f6e1095893b8af4e3f4172ae6297c7a8a831a0a6becd484fe4bcdca09c37922f630780ef0"
+path = "expat-2.2.10.tar.gz"
+url = "https://github.com/libexpat/libexpat/archive/R_2_2_10.tar.gz#/expat-2.2.10.tar.gz"
+sha512 = "5f2d00ead20139aae89910cc08246cf15f7562af2a4fe1b37ebe4c1500a71d9f0a655ebc43f10164ac846be3186ff43f2b94287b18d2a3af882cbd0a1de41a36"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/libexpat/libexpat.spec b/packages/libexpat/libexpat.spec
index 5e9dafc4972..a0ec3aa7e77 100644
--- a/packages/libexpat/libexpat.spec
+++ b/packages/libexpat/libexpat.spec
@@ -1,4 +1,4 @@
-%global unversion 2_2_9
+%global unversion 2_2_10
 
 Name: %{_cross_os}libexpat
 Version: %(echo %{unversion} | sed 's/_/./g')
diff --git a/packages/libnftnl/Cargo.toml b/packages/libnftnl/Cargo.toml
index f7392348b34..34190add2f0 100644
--- a/packages/libnftnl/Cargo.toml
+++ b/packages/libnftnl/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "http://netfilter.org/projects/libnftnl/files/libnftnl-1.1.7.tar.bz2"
-sha512 = "80fd09147b1e2c1533cc2c8347d35137ff94f14118d5ba7bf3c1fbd0a226f6443560d5eca03273129e091b3442f820cd24455e72e917a8b7fedc8f3c9b6dc407"
+url = "http://netfilter.org/projects/libnftnl/files/libnftnl-1.1.8.tar.bz2"
+sha512 = "173d8a7b95eb964a9fbe7ffcb46541a6bae976b4d4f2a28fbf9b03bf3e50a29b1ea12faa49926d2d33bc088580a833fc6e15ff59a30bcfe67c91c524f00c778e"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/libnftnl/libnftnl.spec b/packages/libnftnl/libnftnl.spec
index 22066d89399..23227ab013c 100644
--- a/packages/libnftnl/libnftnl.spec
+++ b/packages/libnftnl/libnftnl.spec
@@ -1,5 +1,5 @@
 Name: %{_cross_os}libnftnl
-Version: 1.1.7
+Version: 1.1.8
 Release: 1%{?dist}
 Summary: Library for nftables netlink
 License: GPL-2.0-or-later AND GPL-2.0-only
diff --git a/packages/libxcrypt/Cargo.toml b/packages/libxcrypt/Cargo.toml
index 2e72a698029..bef3c5d2d8e 100644
--- a/packages/libxcrypt/Cargo.toml
+++ b/packages/libxcrypt/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://github.com/besser82/libxcrypt/archive/v4.4.16/libxcrypt-4.4.16.tar.gz"
-sha512 = "e1d3b1262c6be7c6c8847b8c4eb8191d9e5e482798be6f1186876c72f3d8c737124378ec45a38aa464f556e10a557b96f855bd371f03c3611eada27904bf6781"
+url = "https://github.com/besser82/libxcrypt/archive/v4.4.17/libxcrypt-4.4.17.tar.gz"
+sha512 = "94aaba6ccf9b6d1a32f9a571ee32261cecd393d5b8d8c6f18d740dc7bb29ac0fbd381124e7f0d84882559bb634208c08151b3dc05c9138fa0a229c4ba20fb6f7"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/libxcrypt/libxcrypt.spec b/packages/libxcrypt/libxcrypt.spec
index 4e2f52a75c3..f3f6f4d9480 100644
--- a/packages/libxcrypt/libxcrypt.spec
+++ b/packages/libxcrypt/libxcrypt.spec
@@ -1,5 +1,5 @@
 Name: %{_cross_os}libxcrypt
-Version: 4.4.16
+Version: 4.4.17
 Release: 1%{?dist}
 Summary: Extended crypt library for descrypt, md5crypt, bcrypt, and others
 License: LGPL-2.1-or-later
diff --git a/packages/strace/Cargo.toml b/packages/strace/Cargo.toml
index 1227a3faff1..79c087fb666 100644
--- a/packages/strace/Cargo.toml
+++ b/packages/strace/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://strace.io/files/5.8/strace-5.8.tar.xz"
-sha512 = "633c3daa2dd3d273839cbb8ebd7f6512a38b39af0d0d89f4676c2067e199f346615406d85e3e13f9e4da8dbeb62095185895ffae986eb99b64775a4287e38f4c"
+url = "https://strace.io/files/5.9/strace-5.9.tar.xz"
+sha512 = "f28d5dcceccb44557b39ed6f295f3250662804dc3ad79959bfadffcecc9b736e532c7c90dc89ebf9d07eb3e02a5ace231605851148ca09d41c8c60dc1ff68206"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/strace/strace.spec b/packages/strace/strace.spec
index df2a05d850d..5b27158a8f2 100644
--- a/packages/strace/strace.spec
+++ b/packages/strace/strace.spec
@@ -1,5 +1,5 @@
 Name: %{_cross_os}strace
-Version: 5.8
+Version: 5.9
 Release: 1%{?dist}
 Summary: Linux syscall tracer
 License: LGPL-2.1-or-later
diff --git a/packages/wicked/Cargo.toml b/packages/wicked/Cargo.toml
index d0e67bcc88c..6653f361a81 100644
--- a/packages/wicked/Cargo.toml
+++ b/packages/wicked/Cargo.toml
@@ -9,8 +9,8 @@ build = "build.rs"
 path = "pkg.rs"
 
 [[package.metadata.build-package.external-files]]
-url = "https://github.com/openSUSE/wicked/archive/version-0.6.63.tar.gz"
-sha512 = "c23529246c545acd5c2342e035bc14d4b967bfbcedc8d7c49077a45bf3f98273ba73949522339569372120109078b53a3c8332d34ec29907841f36a72d413d39"
+url = "https://github.com/openSUSE/wicked/archive/version-0.6.64.tar.gz"
+sha512 = "5f0ef9831cba74b06f660a086c92e7c93c756fce9e402fc011bc14f2e29cb5be2ae1793844b7a1e89f3d423e10cdbe579f7fc73a02ad62cbe5ed49a0eef4b648"
 
 [build-dependencies]
 glibc = { path = "../glibc" }
diff --git a/packages/wicked/wicked.spec b/packages/wicked/wicked.spec
index 79fb368fd52..13321ef1b73 100644
--- a/packages/wicked/wicked.spec
+++ b/packages/wicked/wicked.spec
@@ -11,7 +11,7 @@
 %bcond_with bootstrap # without
 
 Name: %{_cross_os}wicked
-Version: 0.6.63
+Version: 0.6.64
 Release: 1%{?dist}
 Summary: Network configuration infrastructure
 License: GPL-2.0-or-later AND (GPL-2.0-only OR BSD-3-Clause)