diff --git a/README.md b/README.md
index 4cdf3b2..ed9e303 100644
--- a/README.md
+++ b/README.md
@@ -4,9 +4,9 @@ The grafana-pcp package
 
 ## Build instructions
 ```
-VER=1.0.4
+VER=1.0.6
 spectool -g grafana-pcp.spec
-./create_dependency_bundle.sh $(pwd)/grafana-pcp-$VER.tar.gz $(pwd)/grafana-pcp-deps-$VER.tar.xz
+./create_dependency_bundle.sh grafana-pcp-$VER.tar.gz grafana-pcp-deps-$VER.tar.xz
 ./check_npm_dependencies.py grafana-pcp.spec grafana-pcp-$VER.tar.gz grafana-pcp-deps-$VER.tar.xz
 fedpkg new-sources grafana-pcp-$VER.tar.gz grafana-pcp-deps-$VER.tar.xz
 
diff --git a/create_dependency_bundle.sh b/create_dependency_bundle.sh
index 3335867..041fbb6 100755
--- a/create_dependency_bundle.sh
+++ b/create_dependency_bundle.sh
@@ -1,19 +1,31 @@
-#!/bin/sh -eux
+#!/bin/sh -eu
 
-SRC="${1:?Usage: $0 source destination}"
-DEST="${2:?Usage: $0 source destination}"
+SRC=$(readlink -f "${1:?Usage: $0 source destination}")
+DEST=$(readlink -f "${2:?Usage: $0 source destination}")
 
 if [ -f "$DEST" ]; then
     echo "File $DEST exists already."
     exit 0
 fi
-
+if [ "$#" -gt 2 ]; then
+    PATCHES=$(readlink -f "${@:3}")
+else
+    PATCHES=""
+fi
 
 pushd $(mktemp -d)
 
-echo Installing dependencies...
+echo Extracting sources...
 tar xfz $SRC
 cd grafana-pcp-*
+
+echo Applying patches...
+for patch in $PATCHES
+do
+    patch -p1 < $patch
+done
+
+echo Installing dependencies...
 yarn install
 
 echo Removing files with licensing issues...
diff --git a/grafana-pcp.spec b/grafana-pcp.spec
index 2f96088..4a9564b 100644
--- a/grafana-pcp.spec
+++ b/grafana-pcp.spec
@@ -1,6 +1,6 @@
 Name:           grafana-pcp
-Version:        1.0.4
-Release:        2%{?dist}
+Version:        1.0.6
+Release:        1%{?dist}
 Summary:        Performance Co-Pilot Grafana Plugin
 
 %global         github https://github.com/performancecopilot/grafana-pcp
@@ -47,7 +47,7 @@ Provides: bundled(nodejs-babel-loader) = 8.0.6
 Provides: bundled(nodejs-babel-plugin-angularjs-annotate) = 0.10.0
 Provides: bundled(nodejs-benchmark) = 2.1.4
 Provides: bundled(nodejs-clean-webpack-plugin) = 0.1.19
-Provides: bundled(nodejs-copy-webpack-plugin) = 4.6.0
+Provides: bundled(nodejs-copy-webpack-plugin) = 5.1.1
 Provides: bundled(nodejs-core-js) = 3.1.4
 Provides: bundled(nodejs-css-loader) = 1.0.1
 Provides: bundled(nodejs-d3-flame-graph) = 2.1.8
@@ -69,7 +69,6 @@ Provides: bundled(nodejs-ts-loader) = 4.5.0
 Provides: bundled(nodejs-tslint) = 5.18.0
 Provides: bundled(nodejs-tslint-config-airbnb) = 5.11.1
 Provides: bundled(nodejs-typescript) = 3.5.3
-Provides: bundled(nodejs-uglifyjs-webpack-plugin) = 2.2.0
 Provides: bundled(nodejs-webpack) = 4.39.1
 Provides: bundled(nodejs-webpack-cli) = 3.3.6
 
@@ -104,6 +103,14 @@ cp -a dist/* %{buildroot}/%{install_dir}
 %doc README.md
 
 %changelog
+* Tue Jan 07 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 1.0.6-1
+- redis: support wildcards in metric names
+- redis: fix label support
+- redis: fix legends
+- redis: set default sample interval to 60s (fixes empty graph borders)
+- build: upgrade copy-webpack-plugin to mitigate XSS vulnerability in the serialize-javascript transitive dependency
+- build: remove deprecated uglify-webpack-plugin
+
 * Thu Dec 12 2019 Andreas Gerstmayr <agerstmayr@redhat.com> 1.0.4-2
 - remove node_modules/node-notifier directory from webpack (due to licensing issues)
 
diff --git a/sources b/sources
index 69d0991..34487f3 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (grafana-pcp-1.0.4.tar.gz) = 2ca9b71c1f1557d304fb54e0e4ffb11dcbba4e1cfa35ee8a448da4006b0d3d60b3032adfa8dba0ff884f84b86bd97a05d07828dea55f08a76e3f10f35cd4f9d9
-SHA512 (grafana-pcp-deps-1.0.4.tar.xz) = 1f845ece73333ec5e0ffc20777d15291d879d6a790d314497c18426cc73d10b43b2f195cd7a6677a922f7f61ce32fee04efdc540627897fdedc4453942a4b7fb
+SHA512 (grafana-pcp-1.0.6.tar.gz) = 37c47c2f9904a3091b3614761b66e4701a11b97cd9edb400d370aab39d08f7dfeaaab7693c58bfec51c5adbe0bc11a5196ea0638ff1fcdab949b4f200e18804f
+SHA512 (grafana-pcp-deps-1.0.6.tar.xz) = da5949bcc8e4b8645d68e593bfb93a3b38a0898d8a943e3f263889e9dc81dfdba26deafce1832003913a0486b232188f9996b0a1da791cc66f9c2cc2da502962