diff --git a/deps-packaging/apr-util/cfbuild-apr-util.spec b/deps-packaging/apr-util/cfbuild-apr-util.spec
index 2caa1c954..6fa161f22 100644
--- a/deps-packaging/apr-util/cfbuild-apr-util.spec
+++ b/deps-packaging/apr-util/cfbuild-apr-util.spec
@@ -1,4 +1,4 @@
-%define apr_version 1.6.3
+%define apr_version 1.6.4
 
 Summary: CFEngine Build Automation -- apr-util
 Name: cfbuild-apr-util
diff --git a/deps-packaging/apr-util/distfiles b/deps-packaging/apr-util/distfiles
index 8ab0de2e6..1779c18a7 100644
--- a/deps-packaging/apr-util/distfiles
+++ b/deps-packaging/apr-util/distfiles
@@ -1 +1 @@
-2b74d8932703826862ca305b094eef2983c27b39d5c9414442e9976a9acf1983  apr-util-1.6.3.tar.gz
+9160444764bd1d804d7e6ee50783ec9442a88b5a8984e62470832b06983eeaa4  apr-util-1.6.4.tar.gz
diff --git a/deps-packaging/leech2/cfbuild-leech2.spec b/deps-packaging/leech2/cfbuild-leech2.spec
index 4d2992dd1..e4285d8bf 100644
--- a/deps-packaging/leech2/cfbuild-leech2.spec
+++ b/deps-packaging/leech2/cfbuild-leech2.spec
@@ -1,4 +1,4 @@
-%define leech2_version 5.4.3
+%define leech2_version 5.4.4
 
 Summary: CFEngine Build Automation -- leech2
 Name: cfbuild-leech2
diff --git a/deps-packaging/leech2/distfiles b/deps-packaging/leech2/distfiles
index 6ab291b9d..09853f7c0 100644
--- a/deps-packaging/leech2/distfiles
+++ b/deps-packaging/leech2/distfiles
@@ -1 +1 @@
-9455efb989937dae41f5ce4b9cd99cb879273978923a58289c500e144beb62ac  leech2-5.4.3.tar.gz
+3af85af5620cbe400b42c550bd4da72c1b57b39ede33e171bac27001dc7e5c6f  leech2-5.4.4.tar.gz
diff --git a/deps-packaging/leech2/source b/deps-packaging/leech2/source
index 182317991..b597d1920 100644
--- a/deps-packaging/leech2/source
+++ b/deps-packaging/leech2/source
@@ -1 +1 @@
-https://github.com/larsewi/leech2/releases/download/v5.4.3/
+https://github.com/larsewi/leech2/releases/download/v5.4.4/
diff --git a/deps-packaging/lmdb/0011-Fix-Windows-mingw-LARGE_INTEGER-usage-in-mdb.c.patch b/deps-packaging/lmdb/0011-Fix-Windows-mingw-LARGE_INTEGER-usage-in-mdb.c.patch
deleted file mode 100644
index 2283cc2d0..000000000
--- a/deps-packaging/lmdb/0011-Fix-Windows-mingw-LARGE_INTEGER-usage-in-mdb.c.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Ihor Aleksandrychiev <igor.aleksandrychev@northern.tech>
-Date: Tue, 14 Jul 2026 15:19:32 +0300
-Subject: [PATCH] Fix Windows/mingw LARGE_INTEGER usage in mdb.c
-
-lmdb 1.0.0 introduced incremental dump/load and MDB_RPAGE_CACHE
-remapping code that treats the Windows LARGE_INTEGER union as a
-scalar integer. This does not compile with mingw (x86_64-w64-mingw32),
-failing with 'invalid initializer', 'incompatible types when assigning
-to type LARGE_INTEGER' and 'used union type value where scalar is
-required' in mdb_env_copyfd0() and mdb_env_incr_loadfd().
-
-Access the .QuadPart member on Windows so the offset arithmetic and
-SetFilePointerEx() calls use the correct type.
-
-Upstream tracking: fixed upstream by ITS#10539 ("lmdb: windows cleanup",
-mdb.RE/1.0 commit 8827c7d, 2026-07-14), which landed after the LMDB_1.0.0
-tag we build from. Drop this patch once we update to an lmdb snapshot that
-includes that commit.
-Ref: https://bugs.openldap.org/show_bug.cgi?id=10539
----
- libraries/liblmdb/mdb.c | 22 +++++++++++++++++-----
- 1 file changed, 17 insertions(+), 5 deletions(-)
-
-diff --git a/libraries/liblmdb/mdb.c b/libraries/liblmdb/mdb.c
-index 43fe7b9..6c7078c 100644
---- a/libraries/liblmdb/mdb.c
-+++ b/libraries/liblmdb/mdb.c
-@@ -11623,7 +11623,7 @@ mdb_env_copyfd0(MDB_env *env, HANDLE fd)
- #endif
- #if MDB_RPAGE_CACHE
- #ifdef _WIN32
--	LARGE_INTEGER	off = 0;
-+	LARGE_INTEGER	off = {0};
- #else
- 	off_t	off = 0;
- #endif
-@@ -11687,7 +11687,11 @@ mdb_env_copyfd0(MDB_env *env, HANDLE fd)
- 	}
- #if MDB_RPAGE_CACHE
- 	if (MDB_REMAPPING(env->me_flags)) {
-+#ifdef _WIN32
-+		off.QuadPart = wsize;
-+#else
- 		off = wsize;
-+#endif
- 	}
- #endif
- 	wsize = w3 - wsize;
-@@ -11713,7 +11717,11 @@ mdb_env_copyfd0(MDB_env *env, HANDLE fd)
- 			wsize -= len;
- #if MDB_RPAGE_CACHE
- 			if (MDB_REMAPPING(env->me_flags)) {
-+#ifdef _WIN32
-+				off.QuadPart += len;
-+#else
- 				off += len;
-+#endif
- 			}
- #endif
- 			continue;
-@@ -11955,7 +11963,8 @@ mdb_env_incr_loadfd(MDB_env *env, HANDLE fd)
- 		return ENOMEM;
- 
- #ifdef _WIN32
--		SetFilePointerEx(env->me_fd, 0, NULL, FILE_BEGIN);
-+		off.QuadPart = 0;
-+		SetFilePointerEx(env->me_fd, off, NULL, FILE_BEGIN);
- #else
- 		lseek(env->me_fd, 0, SEEK_SET);
- #endif
-@@ -12020,15 +12029,18 @@ mdb_env_incr_loadfd(MDB_env *env, HANDLE fd)
- 			ptr += rlen;
- 			rsize -= rlen;
- 		}
--		off = (pg-prevpg-numprev) * env->me_psize;
- 		rsize = numpgs * env->me_psize;
--		if (off) {
- #ifdef _WIN32
-+		off.QuadPart = (pg-prevpg-numprev) * env->me_psize;
-+		if (off.QuadPart) {
- 			SetFilePointerEx(env->me_fd, off, NULL, FILE_CURRENT);
-+		}
- #else
-+		off = (pg-prevpg-numprev) * env->me_psize;
-+		if (off) {
- 			lseek(env->me_fd, off, SEEK_CUR);
--#endif
- 		}
-+#endif
- 		ptr = pbuf;
- 		while (rsize > 0) {
- 			w2 = (rsize > MAX_WRITE) ? MAX_WRITE: rsize;
diff --git a/deps-packaging/lmdb/cfbuild-lmdb.spec b/deps-packaging/lmdb/cfbuild-lmdb.spec
index 233e3095a..1546c143f 100644
--- a/deps-packaging/lmdb/cfbuild-lmdb.spec
+++ b/deps-packaging/lmdb/cfbuild-lmdb.spec
@@ -1,4 +1,4 @@
-%define lmdb_version 1.0.0
+%define lmdb_version 1.0.1
 
 Summary: CFEngine Build Automation -- lmdb
 Name: cfbuild-lmdb
diff --git a/deps-packaging/lmdb/distfiles b/deps-packaging/lmdb/distfiles
index f3c975d59..3dee6be80 100644
--- a/deps-packaging/lmdb/distfiles
+++ b/deps-packaging/lmdb/distfiles
@@ -1 +1 @@
-a61ded12bd9c670038b77483dda13b50684a93a111e53421dfb979624ae9f72e  openldap-LMDB_1.0.0.tar.gz
+63a3cdcca69f4fd403b61fd5c5a51a119f1549d7b375b33f624e64df2933d336  openldap-LMDB_1.0.1.tar.gz
diff --git a/deps-packaging/lmdb/source b/deps-packaging/lmdb/source
index 251867b28..4b21e867b 100644
--- a/deps-packaging/lmdb/source
+++ b/deps-packaging/lmdb/source
@@ -1 +1 @@
-https://git.openldap.org/openldap/openldap/-/archive/LMDB_1.0.0/
+https://git.openldap.org/openldap/openldap/-/archive/LMDB_1.0.1/
diff --git a/deps-packaging/openldap/75b624f47574dffb1f5041625cf9d6218dbcb07d.patch b/deps-packaging/openldap/75b624f47574dffb1f5041625cf9d6218dbcb07d.patch
deleted file mode 100644
index 533716822..000000000
--- a/deps-packaging/openldap/75b624f47574dffb1f5041625cf9d6218dbcb07d.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-From 75b624f47574dffb1f5041625cf9d6218dbcb07d Mon Sep 17 00:00:00 2001
-From: Simon Pichugin <simon.pichugin@gmail.com>
-Date: Thu, 30 Apr 2026 16:57:27 -0700
-Subject: [PATCH] ITS#10498 libldap: more const-correctness for OpenSSL 4
-
----
- libraries/libldap/tls_o.c       | 20 ++++++++++----------
- servers/slapd/overlays/autoca.c |  7 ++++++-
- 2 files changed, 16 insertions(+), 11 deletions(-)
-
-diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
-index 428bc32c85..93a7070f81 100644
---- a/libraries/libldap/tls_o.c
-+++ b/libraries/libldap/tls_o.c
-@@ -198,8 +198,8 @@ tlso_ca_list( char * bundle, char * dir, X509 *cert, STACK_OF(X509_NAME) *ca_lis
- 		ldap_charray_free( dirs );
- 	}
- 	if ( cert ) {
--		X509_NAME *xn = X509_get_subject_name( cert );
--		xn = X509_NAME_dup( xn );
-+		const X509_NAME *cxn = X509_get_subject_name( cert );
-+		X509_NAME *xn = X509_NAME_dup( cxn );
- 		if ( xn && ca_list ) {
- 			sk_X509_NAME_push( ca_list, xn );
- 		}
-@@ -924,7 +924,7 @@ tlso_session_my_dn( tls_session *sess, struct berval *der_dn )
- {
- 	tlso_session *s = (tlso_session *)sess;
- 	X509 *x;
--	X509_NAME *xn;
-+	const X509_NAME *xn;
- 
- 	x = SSL_get_certificate( s );
- 
-@@ -961,7 +961,7 @@ tlso_session_peer_dn( tls_session *sess, struct berval *der_dn )
- {
- 	tlso_session *s = (tlso_session *)sess;
- 	X509 *x = tlso_get_cert( s );
--	X509_NAME *xn;
-+	const X509_NAME *xn;
- 
- 	if ( !x )
- 		return LDAP_INVALID_CREDENTIALS;
-@@ -1037,7 +1037,7 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in )
- 	if (chkSAN) {
- 	i = X509_get_ext_by_NID(x, NID_subject_alt_name, -1);
- 	if (i >= 0) {
--		X509_EXTENSION *ex;
-+		const X509_EXTENSION *ex;
- 		STACK_OF(GENERAL_NAME) *alt;
- 
- 		ex = X509_get_ext(x, i);
-@@ -1143,10 +1143,10 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in )
- 	}
- 
- 	if (ret != LDAP_SUCCESS) {
--		X509_NAME *xn;
--		X509_NAME_ENTRY *ne;
-+		const X509_NAME *xn;
-+		const X509_NAME_ENTRY *ne;
- 		ASN1_OBJECT *obj;
--		ASN1_STRING *cn = NULL;
-+		const ASN1_STRING *cn = NULL;
- 		char *cnstr;
- 		int cnlen;
- 		int navas;
-@@ -1742,8 +1742,8 @@ tlso_verify_cb( int ok, X509_STORE_CTX *ctx )
- 	X509 *cert;
- 	int errnum;
- 	int errdepth;
--	X509_NAME *subject;
--	X509_NAME *issuer;
-+	const X509_NAME *subject;
-+	const X509_NAME *issuer;
- 	char *sname;
- 	char *iname;
- 	char *certerr = NULL;
-diff --git a/servers/slapd/overlays/autoca.c b/servers/slapd/overlays/autoca.c
-index 43761655d2..da978c3233 100644
---- a/servers/slapd/overlays/autoca.c
-+++ b/servers/slapd/overlays/autoca.c
-@@ -44,9 +44,13 @@
- 
- #if OPENSSL_VERSION_NUMBER >= 0x10100000
- #include <openssl/rsa.h>
-+#ifndef X509_get_notBefore
- #define X509_get_notBefore(x)	X509_getm_notBefore(x)
-+#endif
-+#ifndef X509_get_notAfter
- #define X509_get_notAfter(x)	X509_getm_notAfter(x)
- #endif
-+#endif
- 
- #if OPENSSL_VERSION_MAJOR >= 3
- #define BN_pseudo_rand(bn, bits, top, bottom)	BN_rand(bn, bits, top, bottom)
-@@ -272,7 +276,8 @@ typedef struct genargs {
- 
- static int autoca_gencert( Operation *op, genargs *args )
- {
--	X509_NAME *subj_name, *issuer_name;
-+	X509_NAME *subj_name;
-+	const X509_NAME *issuer_name;
- 	X509 *subj_cert;
- 	struct berval derdn;
- 	unsigned char *pp;
--- 
-GitLab
-
diff --git a/deps-packaging/openldap/a599597cb3cb6d36f888bffcbd0b010a644b92c5.patch b/deps-packaging/openldap/a599597cb3cb6d36f888bffcbd0b010a644b92c5.patch
deleted file mode 100644
index 47d4b6927..000000000
--- a/deps-packaging/openldap/a599597cb3cb6d36f888bffcbd0b010a644b92c5.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From a599597cb3cb6d36f888bffcbd0b010a644b92c5 Mon Sep 17 00:00:00 2001
-From: Howard Chu <hyc@openldap.org>
-Date: Tue, 28 Apr 2026 16:49:32 +0100
-Subject: [PATCH] ITS#10498 libldap: fix for OpenSSL 4 compatibility
-
----
- libraries/libldap/tls_o.c | 33 +++++++++++++++++++--------------
- 1 file changed, 19 insertions(+), 14 deletions(-)
-
-diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
-index 02dc4cd92f..428bc32c85 100644
---- a/libraries/libldap/tls_o.c
-+++ b/libraries/libldap/tls_o.c
-@@ -1147,6 +1147,8 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in )
- 		X509_NAME_ENTRY *ne;
- 		ASN1_OBJECT *obj;
- 		ASN1_STRING *cn = NULL;
-+		char *cnstr;
-+		int cnlen;
- 		int navas;
- 
- 		/* find the last CN */
-@@ -1174,22 +1176,25 @@ no_cn:
- 			}
- 			ld->ld_error = LDAP_STRDUP(
- 				_("TLS: unable to get CN from peer certificate"));
-+		} else {
-+			cnlen = ASN1_STRING_length( cn );
-+			cnstr = (char *)ASN1_STRING_get0_data( cn );
-+			if ( cnlen == nlen &&
-+				strncasecmp( name, (char *) cnstr, nlen ) == 0 ) {
-+				ret = LDAP_SUCCESS;
- 
--		} else if ( cn->length == nlen &&
--			strncasecmp( name, (char *) cn->data, nlen ) == 0 ) {
--			ret = LDAP_SUCCESS;
--
--		} else if (( cn->data[0] == '*' ) && ( cn->data[1] == '.' )) {
--			char *domain = strchr(name, '.');
--			if( domain ) {
--				int dlen;
-+			} else if (( cnstr[0] == '*' ) && ( cnstr[1] == '.' )) {
-+				char *domain = strchr(name, '.');
-+				if( domain ) {
-+					int dlen;
- 
--				dlen = nlen - (domain-name);
-+					dlen = nlen - (domain-name);
- 
--				/* Is this a wildcard match? */
--				if ((dlen == cn->length-1) &&
--					!strncasecmp(domain, (char *) &cn->data[1], dlen)) {
--					ret = LDAP_SUCCESS;
-+					/* Is this a wildcard match? */
-+					if ((dlen == cnlen-1) &&
-+						!strncasecmp(domain, cnstr+1, dlen)) {
-+						ret = LDAP_SUCCESS;
-+					}
- 				}
- 			}
- 		}
-@@ -1197,7 +1202,7 @@ no_cn:
- 		if( ret == LDAP_LOCAL_ERROR ) {
- 			Debug3( LDAP_DEBUG_ANY, "TLS: hostname (%s) does not match "
- 				"common name in certificate (%.*s).\n", 
--				name, cn->length, cn->data );
-+				name, cnlen, cnstr );
- 			ret = LDAP_CONNECT_ERROR;
- 			if ( ld->ld_error ) {
- 				LDAP_FREE( ld->ld_error );
--- 
-GitLab
-
diff --git a/deps-packaging/openldap/a704373426e37fd7f4e4beb3be451b5555799517.patch b/deps-packaging/openldap/a704373426e37fd7f4e4beb3be451b5555799517.patch
deleted file mode 100644
index 4c7c4f6fb..000000000
--- a/deps-packaging/openldap/a704373426e37fd7f4e4beb3be451b5555799517.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From a704373426e37fd7f4e4beb3be451b5555799517 Mon Sep 17 00:00:00 2001
-From: Howard Chu <hyc@openldap.org>
-Date: Mon, 4 May 2026 15:35:20 +0100
-Subject: [PATCH] ITS#10498 libldap: silence a couple more warnings
-
-OpenSSL 3 and 4 differ on constness here, and 4 is self-inconsistent
-between getter and d2i. Discard the useless const qualifiers.
----
- libraries/libldap/tls_o.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
-index 93a7070f81..4dd4ff5205 100644
---- a/libraries/libldap/tls_o.c
-+++ b/libraries/libldap/tls_o.c
-@@ -557,7 +557,7 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server, char *
- 						if ( is_server ) {
- 							STACK_OF(X509_NAME) *ca_list = SSL_CTX_get_client_CA_list( ctx );
- 							if ( ca_list ) {
--								X509_NAME *xn = X509_get_subject_name( cert );
-+								X509_NAME *xn = (X509_NAME *)X509_get_subject_name( cert );
- 								if ( xn )
- 									xn = X509_NAME_dup( xn );
- 								if ( xn )
-@@ -1037,10 +1037,10 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in )
- 	if (chkSAN) {
- 	i = X509_get_ext_by_NID(x, NID_subject_alt_name, -1);
- 	if (i >= 0) {
--		const X509_EXTENSION *ex;
-+		X509_EXTENSION *ex;
- 		STACK_OF(GENERAL_NAME) *alt;
- 
--		ex = X509_get_ext(x, i);
-+		ex = (X509_EXTENSION *)X509_get_ext(x, i);
- 		alt = X509V3_EXT_d2i(ex);
- 		if (alt) {
- 			int n, len2 = 0;
--- 
-GitLab
-
diff --git a/deps-packaging/openldap/cfbuild-openldap-aix.spec b/deps-packaging/openldap/cfbuild-openldap-aix.spec
index 19ce4bc5a..4e09cfdf7 100644
--- a/deps-packaging/openldap/cfbuild-openldap-aix.spec
+++ b/deps-packaging/openldap/cfbuild-openldap-aix.spec
@@ -1,4 +1,4 @@
-%define openldap_version 2.6.13
+%define openldap_version 2.7.0
 
 Summary: CFEngine Build Automation -- openldap
 Name: cfbuild-openldap
@@ -6,11 +6,6 @@ Version: %{version}
 Release: 1
 Source0: openldap-%{openldap_version}.tgz
 Patch0:  no_Sockaddr_redefine.patch
-# patches for openssl 4.0.0 unavailable in a release as of 2.6.13
-Patch1: f3b49ffa10d93e841d00f05d9f56b88078acf235.patch
-Patch2: a599597cb3cb6d36f888bffcbd0b010a644b92c5.patch
-Patch3: 75b624f47574dffb1f5041625cf9d6218dbcb07d.patch
-Patch4: a704373426e37fd7f4e4beb3be451b5555799517.patch
 License: MIT
 Group: Other
 Url: https://cfengine.com
@@ -25,10 +20,6 @@ mkdir -p %{_builddir}
 %setup -q -n openldap-%{openldap_version}
 
 %patch0 -p0
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
 
 # Either "$LDFLAGS -L%{prefix}lib"
 # Or     "-bsvr4 $LDFLAGS -Wl,-R,%{prefix}/lib"
diff --git a/deps-packaging/openldap/cfbuild-openldap.spec b/deps-packaging/openldap/cfbuild-openldap.spec
index 37a5fb139..a32661cda 100644
--- a/deps-packaging/openldap/cfbuild-openldap.spec
+++ b/deps-packaging/openldap/cfbuild-openldap.spec
@@ -1,4 +1,4 @@
-%define openldap_version 2.6.13
+%define openldap_version 2.7.0
 
 Summary: CFEngine Build Automation -- openldap
 Name: cfbuild-openldap
@@ -6,12 +6,7 @@ Version: %{version}
 Release: 1
 Source0: openldap-%{openldap_version}.tgz
 Patch0:  no_Sockaddr_redefine.patch
-# patches for openssl 4.0.0 unavailable in a release as of 2.6.13
-Patch1: f3b49ffa10d93e841d00f05d9f56b88078acf235.patch
-Patch2: a599597cb3cb6d36f888bffcbd0b010a644b92c5.patch
-Patch3: 75b624f47574dffb1f5041625cf9d6218dbcb07d.patch
-Patch4: a704373426e37fd7f4e4beb3be451b5555799517.patch
-Patch5: gcc-8.5.patch
+Patch1: gcc-8.5.patch
 License: MIT
 Group: Other
 Url: https://cfengine.com
@@ -27,10 +22,6 @@ mkdir -p %{_builddir}
 
 %patch -P0 -p0
 %patch -P1 -p1
-%patch -P2 -p1
-%patch -P3 -p1
-%patch -P4 -p1
-%patch -P5 -p1
 
 CPPFLAGS=-I%{buildprefix}/include
 
diff --git a/deps-packaging/openldap/debian/rules b/deps-packaging/openldap/debian/rules
index 618d209e0..f33c3cd44 100755
--- a/deps-packaging/openldap/debian/rules
+++ b/deps-packaging/openldap/debian/rules
@@ -26,11 +26,6 @@ build: build-stamp
 build-stamp:
 	dh_testdir
 
-	patch -p1 < f3b49ffa10d93e841d00f05d9f56b88078acf235.patch
-	patch -p1 < a599597cb3cb6d36f888bffcbd0b010a644b92c5.patch
-	patch -p1 < 75b624f47574dffb1f5041625cf9d6218dbcb07d.patch
-	patch -p1 < a704373426e37fd7f4e4beb3be451b5555799517.patch
-
 	# for older compilers we need to patch some code
 	patch -p1 < gcc-8.5.patch
 
diff --git a/deps-packaging/openldap/distfiles b/deps-packaging/openldap/distfiles
index f7da517dc..73edfb2e1 100644
--- a/deps-packaging/openldap/distfiles
+++ b/deps-packaging/openldap/distfiles
@@ -1 +1 @@
-d693b49517a42efb85a1a364a310aed16a53d428d1b46c0d31ef3fba78fcb656  openldap-2.6.13.tgz
+9e86f37da375aa948a1b478dd76fe87b02090e47c21facae19223588e3407922  openldap-2.7.0.tgz
diff --git a/deps-packaging/openldap/f3b49ffa10d93e841d00f05d9f56b88078acf235.patch b/deps-packaging/openldap/f3b49ffa10d93e841d00f05d9f56b88078acf235.patch
deleted file mode 100644
index 4328a2d3f..000000000
--- a/deps-packaging/openldap/f3b49ffa10d93e841d00f05d9f56b88078acf235.patch
+++ /dev/null
@@ -1,493 +0,0 @@
-From f3b49ffa10d93e841d00f05d9f56b88078acf235 Mon Sep 17 00:00:00 2001
-From: Graham Leggett <minfrin@sharp.fm>
-Date: Mon, 15 Dec 2025 22:52:13 +0000
-Subject: [PATCH] ITS#10149 - Allow certificates and keys to be read from URIs
-
----
- doc/man/man3/ldap_get_option.3 |  33 +++++
- include/ldap.h                 |   2 +
- libraries/libldap/ldap-int.h   |   6 +-
- libraries/libldap/tls2.c       |  39 +++++-
- libraries/libldap/tls_g.c      |  28 ++++
- libraries/libldap/tls_o.c      | 227 +++++++++++++++++++++++++++++----
- 6 files changed, 305 insertions(+), 30 deletions(-)
-
-diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3
-index 45e91a28e5..63601f28a7 100644
---- a/doc/man/man3/ldap_get_option.3
-+++ b/doc/man/man3/ldap_get_option.3
-@@ -678,6 +678,22 @@ must be
- and its contents need to be freed by the caller using
- .BR ldap_memfree (3).
- .TP
-+.B LDAP_OPT_X_TLS_CACERTURIS
-+Sets/gets an array containing the URIs of CA certificates. The
-+URIs accepted are based on the underlying crypto library. In the
-+case of OpenSSL, the URIs are handled by the provider interface, and a
-+URI without a scheme is treated as a file path.
-+.BR outvalue
-+must be a
-+.BR "char ***" ,
-+and the caller is responsible of freeing the returned string by calling
-+.BR ldap_memvfree (3),
-+while
-+.BR invalue
-+must be a NULL-terminated
-+.BR "char *const *" ;
-+the library duplicates the corresponding string.
-+.TP
- .B LDAP_OPT_X_TLS_CERTFILE
- Sets/gets the full-path of the certificate file.
- .BR invalue
-@@ -883,6 +899,23 @@ When using the OpenSSL library this is an SSL*. When using other
- crypto libraries this is a pointer to an OpenLDAP private structure.
- Applications generally should not use this option.
- .TP
-+.B LDAP_OPT_X_TLS_URIS
-+Sets/gets an array containing the URIs of certificates, intermediate
-+certificates and keys. The URIs accepted are based on the underlying
-+crypto library. In the case of OpenSSL, the URIs are handled by the
-+provider interface, and a URI without a scheme is treated as a file
-+path.
-+.BR outvalue
-+must be a
-+.BR "char ***" ,
-+and the caller is responsible of freeing the returned string by calling
-+.BR ldap_memvfree (3),
-+while
-+.BR invalue
-+must be a NULL-terminated
-+.BR "char *const *" ;
-+the library duplicates the corresponding string.
-+.TP
- .B LDAP_OPT_X_TLS_VERSION
- Gets the TLS version being used on an established TLS session.
- .BR outvalue
-diff --git a/include/ldap.h b/include/ldap.h
-index 521bc0caba..f916226f46 100644
---- a/include/ldap.h
-+++ b/include/ldap.h
-@@ -164,6 +164,8 @@ LDAP_BEGIN_DECL
- #define LDAP_OPT_X_TLS_PEERKEY_HASH	0x6019
- #define LDAP_OPT_X_TLS_REQUIRE_SAN	0x601a
- #define LDAP_OPT_X_TLS_PROTOCOL_MAX	0x601b
-+#define LDAP_OPT_X_TLS_URIS		0x601c
-+#define LDAP_OPT_X_TLS_CACERTURIS	0x601d
- 
- #define LDAP_OPT_X_TLS_NEVER	0
- #define LDAP_OPT_X_TLS_HARD		1
-diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h
-index 78e1f806a2..33b94a59bd 100644
---- a/libraries/libldap/ldap-int.h
-+++ b/libraries/libldap/ldap-int.h
-@@ -187,6 +187,8 @@ struct ldaptls {
- 	struct berval	lt_cacert;
- 	struct berval	lt_cert;
- 	struct berval	lt_key;
-+	char		**lt_cacerturis;
-+	char		**lt_uris;
- };
- #endif
- 
-@@ -310,7 +312,9 @@ struct ldapoptions {
- #define ldo_tls_cacert	ldo_tls_info.lt_cacert
- #define ldo_tls_cert	ldo_tls_info.lt_cert
- #define ldo_tls_key	ldo_tls_info.lt_key
--   	int			ldo_tls_mode;
-+#define ldo_tls_uris	ldo_tls_info.lt_uris
-+#define ldo_tls_cacerturis	ldo_tls_info.lt_cacerturis
-+	int			ldo_tls_mode;
-    	int			ldo_tls_require_cert;
- 	int			ldo_tls_impl;
-    	int			ldo_tls_crlcheck;
-diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
-index 1fb878aab8..158b552b1a 100644
---- a/libraries/libldap/tls2.c
-+++ b/libraries/libldap/tls2.c
-@@ -849,7 +849,20 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg )
- 		}
- 		break;
- 	}
--
-+	case LDAP_OPT_X_TLS_URIS:
-+		if( lo->ldo_tls_uris == NULL ) {
-+			* (char ***) arg = NULL;
-+		} else {
-+			* (char ***) arg = ldap_value_dup(lo->ldo_tls_uris);
-+		}
-+		break;
-+	case LDAP_OPT_X_TLS_CACERTURIS:
-+		if( lo->ldo_tls_cacerturis == NULL ) {
-+			* (char ***) arg = NULL;
-+		} else {
-+			* (char ***) arg = ldap_value_dup(lo->ldo_tls_cacerturis);
-+		}
-+		break;
- 	default:
- 		return -1;
- 	}
-@@ -1107,7 +1120,29 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )
- 		}
- 
- 		return rc;
--	}
-+		}
-+	case LDAP_OPT_X_TLS_URIS: {
-+		char *const *uris = (char *const *) arg;
-+
-+		if( lo->ldo_tls_uris ) {
-+			LDAP_VFREE(lo->ldo_tls_uris);
-+		}
-+		if ( uris ) {
-+			lo->ldo_tls_uris = ldap_value_dup(uris);
-+		}
-+		return 0;
-+		}
-+	case LDAP_OPT_X_TLS_CACERTURIS: {
-+		char *const *uris = (char *const *) arg;
-+
-+		if( lo->ldo_tls_cacerturis ) {
-+			LDAP_VFREE(lo->ldo_tls_cacerturis);
-+		}
-+		if ( uris ) {
-+			lo->ldo_tls_cacerturis = ldap_value_dup(uris);
-+		}
-+		return 0;
-+		}
- 	default:
- 		return -1;
- 	}
-diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c
-index d4e7ee0bf7..2652cf6713 100644
---- a/libraries/libldap/tls_g.c
-+++ b/libraries/libldap/tls_g.c
-@@ -395,6 +395,34 @@ tlsg_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server, char *
- 
- 	ctx->reqcert = lo->ldo_tls_require_cert;
- 
-+	if ( lo->ldo_tls_uris )
-+	{
-+		/*
-+		 * TODO: figure out URL enumeration.
-+		 *
-+		 * Hopeful functions:
-+		 * gnutls_privkey_import_url
-+		 * gnutls_url_is_supported
-+		 * gnutls_tpm_get_registered
-+		 * gnutls_tpm_key_list_get_url
-+		 * gnutls_pkcs11_obj_list_import_url4
-+		 * gnutls_pkcs11_obj_get_type
-+		 */
-+
-+		Debug0( LDAP_DEBUG_ANY,
-+			"TLS: uris are not supported.\n" );
-+		strncpy( errmsg, "TLS uris are not supported", ERRBUFSIZE );
-+		return -1;
-+	}
-+
-+	if ( lo->ldo_tls_cacerturis )
-+	{
-+		Debug0( LDAP_DEBUG_ANY,
-+			"TLS: cacerturis are not supported.\n" );
-+		strncpy( errmsg, "TLS cacerturis are not supported", ERRBUFSIZE );
-+		return -1;
-+	}
-+
- 	return 0;
- }
- 
-diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
-index 155f685c99..729b6e9308 100644
---- a/libraries/libldap/tls_o.c
-+++ b/libraries/libldap/tls_o.c
-@@ -46,6 +46,9 @@
- #include <openssl/bn.h>
- #include <openssl/rsa.h>
- #include <openssl/dh.h>
-+#if OPENSSL_VERSION_MAJOR >= 3
-+#include <openssl/store.h>
-+#endif
- #endif
- 
- #if OPENSSL_VERSION_NUMBER >= 0x10100000
-@@ -169,37 +172,42 @@ BIO_meth_free( BIO_METHOD *meth )
- #endif /* OpenSSL 1.1 */
- 
- static STACK_OF(X509_NAME) *
--tlso_ca_list( char * bundle, char * dir, X509 *cert )
-+tlso_ca_list( char * bundle, char * dir, X509 *cert, STACK_OF(X509_NAME) *ca_list )
- {
--	STACK_OF(X509_NAME) *ca_list = NULL;
--
- 	if ( bundle ) {
--		ca_list = SSL_load_client_CA_file( bundle );
-+		if ( !SSL_add_file_cert_subjects_to_stack( ca_list, bundle ) ) {
-+			Debug1( LDAP_DEBUG_ANY, "TLS: "
-+				"could not load client CA list (file:`%s').\n",
-+				bundle );
-+			return NULL;
-+		}
- 	}
- 	if ( dir ) {
- 		char **dirs = ldap_str2charray( dir, CERTPATHSEP );
--		int freeit = 0, i, success = 0;
-+		int i;
- 
--		if ( !ca_list ) {
--			ca_list = sk_X509_NAME_new_null();
--			freeit = 1;
--		}
- 		for ( i=0; dirs[i]; i++ ) {
--			success += SSL_add_dir_cert_subjects_to_stack( ca_list, dir );
--		}
--		if ( !success && freeit ) {
--			sk_X509_NAME_free( ca_list );
--			ca_list = NULL;
-+			if ( !SSL_add_dir_cert_subjects_to_stack( ca_list, dirs[i] )) {
-+				Debug1( LDAP_DEBUG_ANY, "TLS: "
-+					"could not load client CA list (dir:`%s').\n",
-+					dirs[i] );
-+				ldap_charray_free( dirs );
-+				return NULL;
-+			}
- 		}
- 		ldap_charray_free( dirs );
- 	}
- 	if ( cert ) {
- 		X509_NAME *xn = X509_get_subject_name( cert );
- 		xn = X509_NAME_dup( xn );
--		if ( !ca_list )
--			ca_list = sk_X509_NAME_new_null();
--		if ( xn && ca_list )
-+		if ( xn && ca_list ) {
- 			sk_X509_NAME_push( ca_list, xn );
-+		}
-+		else {
-+			Debug0( LDAP_DEBUG_ANY, "TLS: "
-+				"could not load client CA list: subject missing\n" );
-+			return NULL;
-+		}
- 	}
- 	return ca_list;
- }
-@@ -456,7 +464,7 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server, char *
- 	}
- 
- 	if ( lo->ldo_tls_cacertfile == NULL && lo->ldo_tls_cacertdir == NULL &&
--		lo->ldo_tls_cacert.bv_val == NULL ) {
-+		lo->ldo_tls_cacert.bv_val == NULL && lo->ldo_tls_cacerturis == NULL ) {
- 		if ( !SSL_CTX_set_default_verify_paths( ctx ) ) {
- 			Debug0( LDAP_DEBUG_ANY, "TLS: "
- 				"could not use default certificate paths" );
-@@ -465,6 +473,12 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server, char *
- 		}
- 	} else {
- 		X509 *cert = NULL;
-+
-+		if ( is_server ) {
-+			STACK_OF(X509_NAME) *ca_list = sk_X509_NAME_new_null();
-+			SSL_CTX_set_client_CA_list( ctx, ca_list );
-+		}
-+
- 		if ( lo->ldo_tls_cacert.bv_val ) {
- 			const unsigned char *pp = (const unsigned char *) (lo->ldo_tls_cacert.bv_val);
- 			cert = d2i_X509( NULL, &pp, lo->ldo_tls_cacert.bv_len );
-@@ -509,20 +523,81 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server, char *
- 			}
- 		}
- 
-+		if ( lo->ldo_tls_cacerturis )
-+		{
-+#if OPENSSL_VERSION_MAJOR >= 3
-+			int i;
-+
-+			for(i=0; lo->ldo_tls_cacerturis[i] != NULL; i++) {
-+				OSSL_STORE_CTX *sctx;
-+				OSSL_STORE_INFO *info;
-+
-+				sctx = OSSL_STORE_open( lo->ldo_tls_cacerturis[i], NULL, NULL, NULL, NULL );
-+				if (!sctx) {
-+					Debug1( LDAP_DEBUG_ANY,
-+						"TLS: could not open uri `%s'.\n",
-+						lo->ldo_tls_cacerturis[i] );
-+					tlso_report_error( errmsg );
-+					return -1;
-+				}
-+
-+				while ((info = OSSL_STORE_load( sctx ))) {
-+					switch (OSSL_STORE_INFO_get_type( info )) {
-+					case OSSL_STORE_INFO_CERT:
-+						X509 *cert = OSSL_STORE_INFO_get0_CERT( info );
-+						X509_STORE *store = SSL_CTX_get_cert_store( ctx );
-+						if ( !X509_STORE_add_cert( store, cert ) ) {
-+							Debug1( LDAP_DEBUG_ANY,
-+								"TLS: could not use certificate from uri `%s'.\n",
-+								lo->ldo_tls_cacerturis[i] );
-+							tlso_report_error( errmsg );
-+							OSSL_STORE_close( sctx );
-+							return -1;
-+						}
-+						if ( is_server ) {
-+							STACK_OF(X509_NAME) *ca_list = SSL_CTX_get_client_CA_list( ctx );
-+							if ( ca_list ) {
-+								X509_NAME *xn = X509_get_subject_name( cert );
-+								if ( xn )
-+									xn = X509_NAME_dup( xn );
-+								if ( xn )
-+									sk_X509_NAME_push( ca_list, xn );
-+							}
-+						}
-+						break;
-+					default:
-+						/* ignore other types */
-+						break;
-+					}
-+					OSSL_STORE_INFO_free( info );
-+				}
-+				if (!OSSL_STORE_eof(sctx) && OSSL_STORE_error(sctx)) {
-+					Debug1( LDAP_DEBUG_ANY,
-+						"TLS: could not load from uri `%s'.\n",
-+						lo->ldo_tls_uris[i] );
-+					tlso_report_error( errmsg );
-+					OSSL_STORE_close( sctx );
-+					return -1;
-+				}
-+				OSSL_STORE_close( sctx );
-+			}
-+#else
-+			Debug0( LDAP_DEBUG_ANY,
-+				"TLS: cacerturis are not supported.\n" );
-+			strncpy( errmsg, "TLS: cacerturis are not supported", ERRBUFSIZE );
-+			return -1;
-+#endif
-+		}
-+
- 		if ( is_server ) {
--			STACK_OF(X509_NAME) *calist;
-+			STACK_OF(X509_NAME) *ca_list = SSL_CTX_get_client_CA_list( ctx );
-+
- 			/* List of CA names to send to a client */
--			calist = tlso_ca_list( lt->lt_cacertfile, lt->lt_cacertdir, cert );
--			if ( !calist ) {
--				Debug2( LDAP_DEBUG_ANY, "TLS: "
--					"could not load client CA list (file:`%s',dir:`%s').\n",
--					lo->ldo_tls_cacertfile ? lo->ldo_tls_cacertfile : "",
--					lo->ldo_tls_cacertdir ? lo->ldo_tls_cacertdir : "" );
-+			ca_list = tlso_ca_list( lt->lt_cacertfile, lt->lt_cacertdir, cert, ca_list );
-+			if ( !ca_list ) {
- 				tlso_report_error( errmsg );
- 				return -1;
- 			}
--
--			SSL_CTX_set_client_CA_list( ctx, calist );
- 		}
- 		if ( cert )
- 			X509_free( cert );
-@@ -636,6 +711,104 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server, char *
- #endif	/* OPENSSL_NO_EC */
- 	}
- 
-+	if ( lo->ldo_tls_uris )
-+	{
-+#if OPENSSL_VERSION_MAJOR >= 3
-+		int i;
-+
-+		for(i=0; lo->ldo_tls_uris[i] != NULL; i++) {
-+			OSSL_STORE_CTX *sctx;
-+			OSSL_STORE_INFO *info;
-+
-+			sctx = OSSL_STORE_open(lo->ldo_tls_uris[i], NULL, NULL, NULL, NULL);
-+			if (!sctx) {
-+				Debug1( LDAP_DEBUG_ANY,
-+					"TLS: could not open uri `%s'.\n",
-+					lo->ldo_tls_uris[i] );
-+				tlso_report_error( errmsg );
-+				return -1;
-+			}
-+
-+			while ((info = OSSL_STORE_load(sctx))) {
-+				switch (OSSL_STORE_INFO_get_type(info)) {
-+				case OSSL_STORE_INFO_PARAMS:
-+					if ( !SSL_CTX_set0_tmp_dh_pkey( ctx,
-+							OSSL_STORE_INFO_get0_PARAMS(info) )) {
-+						Debug1( LDAP_DEBUG_ANY,
-+							"TLS: could not use params from uri `%s'.\n",
-+							lo->ldo_tls_uris[i] );
-+						tlso_report_error( errmsg );
-+						OSSL_STORE_close(sctx);
-+						return -1;
-+					}
-+					break;
-+				case OSSL_STORE_INFO_PKEY:
-+					if ( !SSL_CTX_use_PrivateKey( ctx,
-+							OSSL_STORE_INFO_get0_PKEY(info) )) {
-+						Debug1( LDAP_DEBUG_ANY,
-+							"TLS: could not use private key from uri `%s'.\n",
-+							lo->ldo_tls_uris[i] );
-+						tlso_report_error( errmsg );
-+						OSSL_STORE_close(sctx);
-+						return -1;
-+					}
-+					break;
-+				case OSSL_STORE_INFO_CERT:
-+					X509 *cert = OSSL_STORE_INFO_get0_CERT(info);
-+					int is_ca = X509_check_ca( cert );
-+					if ( !is_ca && !SSL_CTX_use_certificate( ctx, cert )) {
-+						Debug1( LDAP_DEBUG_ANY,
-+							"TLS: could not use leaf certificate from uri `%s'.\n",
-+							lo->ldo_tls_uris[i] );
-+						tlso_report_error( errmsg );
-+						OSSL_STORE_close(sctx);
-+						return -1;
-+					}
-+					if ( is_ca && !SSL_CTX_add_extra_chain_cert( ctx, cert )) {
-+						Debug1( LDAP_DEBUG_ANY,
-+							"TLS: could not use intermediate certificate from uri `%s'.\n",
-+							lo->ldo_tls_uris[i] );
-+						tlso_report_error( errmsg );
-+						OSSL_STORE_close(sctx);
-+						return -1;
-+					}
-+					break;
-+				case OSSL_STORE_INFO_CRL:
-+					X509_STORE *x509_s = SSL_CTX_get_cert_store( ctx );
-+					if ( !X509_STORE_add_crl( x509_s,
-+							OSSL_STORE_INFO_get0_CRL(info) )) {
-+						Debug1( LDAP_DEBUG_ANY,
-+							"TLS: could not use crl from uri `%s'.\n",
-+							lo->ldo_tls_uris[i] );
-+						tlso_report_error( errmsg );
-+						OSSL_STORE_close(sctx);
-+						return -1;
-+					}
-+					break;
-+				default:
-+					/* ignore other types */
-+					break;
-+				}
-+				OSSL_STORE_INFO_free(info);
-+			}
-+			if (!OSSL_STORE_eof(sctx) && OSSL_STORE_error(sctx)) {
-+				Debug1( LDAP_DEBUG_ANY,
-+					"TLS: could not load from uri `%s'.\n",
-+					lo->ldo_tls_uris[i] );
-+				tlso_report_error( errmsg );
-+				OSSL_STORE_close(sctx);
-+				return -1;
-+			}
-+			OSSL_STORE_close(sctx);
-+		}
-+#else
-+		Debug0( LDAP_DEBUG_ANY,
-+			"TLS: uris are not supported.\n" );
-+		strncpy( errmsg, "TLS: uris are not supported", ERRBUFSIZE );
-+		return -1;
-+#endif
-+	}
-+
- 	if ( tlso_opt_trace ) {
- 		SSL_CTX_set_info_callback( ctx, tlso_info_cb );
- 	}
--- 
-GitLab
-
diff --git a/deps-packaging/openldap/mingw/debian/rules b/deps-packaging/openldap/mingw/debian/rules
index cb7fa5029..61ce10e5a 100755
--- a/deps-packaging/openldap/mingw/debian/rules
+++ b/deps-packaging/openldap/mingw/debian/rules
@@ -15,11 +15,6 @@ build-stamp:
 	patch -p0 < mingw_build_fixes.patch
 	ln -s $(PREFIX)/bin/libgnurx-0.dll .
 
-	patch -p1 < f3b49ffa10d93e841d00f05d9f56b88078acf235.patch
-	patch -p1 < a599597cb3cb6d36f888bffcbd0b010a644b92c5.patch
-	patch -p1 < 75b624f47574dffb1f5041625cf9d6218dbcb07d.patch
-	patch -p1 < a704373426e37fd7f4e4beb3be451b5555799517.patch
-
 	# Configure is unable to test memcmp for cross-compilation
 	# getaddrinfo/getnameinfo are broken in MinGW as well as socklen in2.4.36 work around it
 	ac_cv_type_socklen_t=yes \
diff --git a/deps-packaging/openldap/mingw_build_fixes.patch b/deps-packaging/openldap/mingw_build_fixes.patch
index a13ada0c3..bb29df316 100644
--- a/deps-packaging/openldap/mingw_build_fixes.patch
+++ b/deps-packaging/openldap/mingw_build_fixes.patch
@@ -9,13 +9,3 @@
  	struct timespec {
  		time_t	tv_sec;
  		int 	tv_nsec;
---- libraries/liblber/lber.map.orig	2021-11-09 15:43:46.876482616 +0100
-+++ libraries/liblber/lber.map	2021-11-09 15:45:03.819040549 +0100
-@@ -102,6 +102,7 @@
-     ber_pvt_sb_do_write;
-     ber_pvt_sb_grow_buffer;
-     ber_pvt_socket_set_nonblock;
-+    ber_pvt_wsa_err2string;
-     ber_read;
-     ber_realloc;
-     ber_remaining;
diff --git a/deps-packaging/openldap/solaris/build b/deps-packaging/openldap/solaris/build
index 0f82ce79f..8803da231 100755
--- a/deps-packaging/openldap/solaris/build
+++ b/deps-packaging/openldap/solaris/build
@@ -8,10 +8,6 @@ OL=${BUILD_ROOT}/cfbuild-openldap${PREFIX}
 OLD=${BUILD_ROOT}/cfbuild-openldap-devel${PREFIX}
 
 # Patch
-$PATCH -p1 < f3b49ffa10d93e841d00f05d9f56b88078acf235.patch
-$PATCH -p1 < a599597cb3cb6d36f888bffcbd0b010a644b92c5.patch
-$PATCH -p1 < 75b624f47574dffb1f5041625cf9d6218dbcb07d.patch
-$PATCH -p1 < a704373426e37fd7f4e4beb3be451b5555799517.patch
 
 # Configure