diff --git a/.gitignore b/.gitignore
index 016c26f..4932342 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
 /grafana-6.1.4.tar.gz
 /grafana_webpack-6.1.4.tar.gz
+/grafana-6.1.6.tar.gz
+/grafana_webpack-6.1.6.tar.gz
diff --git a/006-native-RPM-spec-and-webpack-build-script.patch b/006-native-RPM-spec-and-webpack-build-script.patch
index 683f12f..4f4b6da 100644
--- a/006-native-RPM-spec-and-webpack-build-script.patch
+++ b/006-native-RPM-spec-and-webpack-build-script.patch
@@ -13,10 +13,10 @@ index 000000000..f97c2a26b
 +
 diff --git a/packaging/rpm/spec/grafana.spec b/packaging/rpm/spec/grafana.spec
 new file mode 100644
-index 000000000..9d69b105e
+index 000000000..f17fa54b5
 --- /dev/null
 +++ b/packaging/rpm/spec/grafana.spec
-@@ -0,0 +1,511 @@
+@@ -0,0 +1,523 @@
 +%global grafana_arches %{lua: go_arches = {}
 +  for arch in rpm.expand("%{go_arches}"):gmatch("%S+") do
 +    go_arches[arch] = 1
@@ -28,7 +28,7 @@ index 000000000..9d69b105e
 +end}
 +
 +Name:             grafana
-+Version:          6.1.4
++Version:          6.1.6
 +Release:          1%{?dist}
 +Summary:          Metrics dashboard and graph editor
 +License:          ASL 2.0
@@ -87,6 +87,14 @@ index 000000000..9d69b105e
 +BuildRequires: golang(github.com/go-macaron/inject)
 +BuildRequires: golang(github.com/go-macaron/session)
 +BuildRequires: golang(google.golang.org/genproto/googleapis/rpc/status)
++BuildRequires: golang(github.com/gobwas/glob)
++BuildRequires: golang(github.com/gobwas/glob/compiler)
++BuildRequires: golang(github.com/gobwas/glob/match)
++BuildRequires: golang(github.com/gobwas/glob/syntax)
++BuildRequires: golang(github.com/gobwas/glob/syntax/ast)
++BuildRequires: golang(github.com/gobwas/glob/syntax/lexer)
++BuildRequires: golang(github.com/gobwas/glob/util/runes)
++BuildRequires: golang(github.com/gobwas/glob/util/strings)
 +BuildRequires: golang(github.com/gopherjs/gopherjs/js)
 +BuildRequires: golang(github.com/gorilla/websocket)
 +BuildRequires: golang(github.com/gosimple/slug)
@@ -437,6 +445,10 @@ index 000000000..9d69b105e
 +
 +
 +%changelog
++* Tue Apr 30 2019 Mark Goodwin <mgoodwin@redhat.com> 6.1.6-1
++- update to latest upstream stable release 6.1.6, see CHANGELOG
++- includes jQuery 3.4.0 security update
++
 +* Wed Apr 24 2019 Mark Goodwin <mgoodwin@redhat.com> 6.1.4-1
 +- update to latest upstream stable release 6.1.4, see CHANGELOG
 +- use gobuild and gochecks macros, eliminate arch symlinks
diff --git a/grafana.spec b/grafana.spec
index 9d69b10..f17fa54 100644
--- a/grafana.spec
+++ b/grafana.spec
@@ -9,7 +9,7 @@
 end}
 
 Name:             grafana
-Version:          6.1.4
+Version:          6.1.6
 Release:          1%{?dist}
 Summary:          Metrics dashboard and graph editor
 License:          ASL 2.0
@@ -68,6 +68,14 @@ BuildRequires: golang(github.com/go-macaron/gzip)
 BuildRequires: golang(github.com/go-macaron/inject)
 BuildRequires: golang(github.com/go-macaron/session)
 BuildRequires: golang(google.golang.org/genproto/googleapis/rpc/status)
+BuildRequires: golang(github.com/gobwas/glob)
+BuildRequires: golang(github.com/gobwas/glob/compiler)
+BuildRequires: golang(github.com/gobwas/glob/match)
+BuildRequires: golang(github.com/gobwas/glob/syntax)
+BuildRequires: golang(github.com/gobwas/glob/syntax/ast)
+BuildRequires: golang(github.com/gobwas/glob/syntax/lexer)
+BuildRequires: golang(github.com/gobwas/glob/util/runes)
+BuildRequires: golang(github.com/gobwas/glob/util/strings)
 BuildRequires: golang(github.com/gopherjs/gopherjs/js)
 BuildRequires: golang(github.com/gorilla/websocket)
 BuildRequires: golang(github.com/gosimple/slug)
@@ -418,6 +426,10 @@ go test ./pkg/...
 
 
 %changelog
+* Tue Apr 30 2019 Mark Goodwin <mgoodwin@redhat.com> 6.1.6-1
+- update to latest upstream stable release 6.1.6, see CHANGELOG
+- includes jQuery 3.4.0 security update
+
 * Wed Apr 24 2019 Mark Goodwin <mgoodwin@redhat.com> 6.1.4-1
 - update to latest upstream stable release 6.1.4, see CHANGELOG
 - use gobuild and gochecks macros, eliminate arch symlinks
diff --git a/sources b/sources
index 64f93e3..fd537fa 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (grafana-6.1.4.tar.gz) = 75ed40232182d33484ecaeb58539d465bfcbd0ba7d03901925e8256a40fb6c87292ec0b324e97dce89ddb3b87505090f730eb12f77d987de5fe6e3b31ffb1782
-SHA512 (grafana_webpack-6.1.4.tar.gz) = a8895d14213cbe43adb3585969a6b23c1016d39bdcee9b48bd544f31f84a51bb4eb9b942ef68450910bd73ad9c03f89870782a230bba098197e7ce32000b8058
+SHA512 (grafana-6.1.6.tar.gz) = 692eb13a7981e10cf3bea98a2054a1bb193b9bcdfae3630fcdb9f5f07bf1908e4e3898606f86a252edfd3bd36d41ae6dff1f467d602bd3f369ac9f98584911fb
+SHA512 (grafana_webpack-6.1.6.tar.gz) = 5fb043aa53bbc824541bb2924eb2889d30669b113871098bbd9ef168dec5fa01898a741f270b9f8c1ec9a23c69f7f97346de3354124c8cde8ddd464d213e53cd