diff --git a/0016-fix-x-net-CVE.patch b/0016-fix-x-net-CVE.patch
new file mode 100644
index 0000000..1d3b649
--- /dev/null
+++ b/0016-fix-x-net-CVE.patch
@@ -0,0 +1,189 @@
+diff --git a/.bingo/wire.mod b/.bingo/wire.mod
+index fc39b30..cc59b83 100644
+--- a/.bingo/wire.mod
++++ b/.bingo/wire.mod
+@@ -1,5 +1,5 @@
+ module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+ 
+-go 1.16
++go 1.25
+ 
+-require github.com/google/wire v0.5.0 // cmd/wire
++require github.com/google/wire v0.7.0 // cmd/wire
+diff --git a/.bingo/wire.sum b/.bingo/wire.sum
+index 6d4b4b3..5771a44 100644
+--- a/.bingo/wire.sum
++++ b/.bingo/wire.sum
+@@ -3,6 +3,8 @@ github.com/google/subcommands v1.0.1 h1:/eqq+otEXm5vhfBrbREPCSVQbvofip6kIz+mX5TU
+ github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
+ github.com/google/wire v0.5.0 h1:I7ELFeVBr3yfPIcc8+MWvrjk+3VjbcSzoXm3JVa+jD8=
+ github.com/google/wire v0.5.0/go.mod h1:ngWDr9Qvq3yZA10YrxfyGELY/AFWGVpy9c1LTRi1EoU=
++github.com/google/wire v0.7.0 h1:JxUKI6+CVBgCO2WToKy/nQk0sS+amI9z9EjVmdaocj4=
++github.com/google/wire v0.7.0/go.mod h1:n6YbUQD9cPKTnHXEBN2DXlOp/mVADhVErcMFb0v3J18=
+ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+diff --git a/go.mod b/go.mod
+index fcbc09d..fde2d02 100644
+--- a/go.mod
++++ b/go.mod
+@@ -1,6 +1,6 @@
+ module github.com/grafana/grafana
+ 
+-go 1.21
++go 1.25.0
+ 
+ // Override docker/docker to avoid:
+ // go: github.com/drone-runners/drone-runner-docker@v1.8.2 requires
+@@ -109,13 +109,13 @@ require (
+ 	go.opentelemetry.io/otel/exporters/jaeger v1.10.0 // @grafana/backend-platform
+ 	go.opentelemetry.io/otel/sdk v1.21.0 // @grafana/backend-platform
+ 	go.opentelemetry.io/otel/trace v1.21.0 // @grafana/backend-platform
+-	golang.org/x/crypto v0.17.0 // @grafana/backend-platform
++	golang.org/x/crypto v0.51.0 // @grafana/backend-platform
+ 	golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // @grafana/alerting-squad-backend
+-	golang.org/x/net v0.19.0 // @grafana/oss-big-tent @grafana/partner-datasources
++	golang.org/x/net v0.55.0 // @grafana/oss-big-tent @grafana/partner-datasources
+ 	golang.org/x/oauth2 v0.15.0 // @grafana/grafana-authnz-team
+-	golang.org/x/sync v0.4.0 // @grafana/alerting-squad-backend
++	golang.org/x/sync v0.20.0 // @grafana/alerting-squad-backend
+ 	golang.org/x/time v0.3.0 // @grafana/backend-platform
+-	golang.org/x/tools v0.13.0 // @grafana/grafana-as-code
++	golang.org/x/tools v0.44.0 // @grafana/grafana-as-code
+ 	gonum.org/v1/gonum v0.12.0 // @grafana/observability-metrics
+ 	google.golang.org/api v0.148.0 // @grafana/backend-platform
+ 	google.golang.org/grpc v1.59.0 // @grafana/plugins-platform-backend
+@@ -218,8 +218,8 @@ require (
+ 	go.opencensus.io v0.24.0 // indirect
+ 	go.uber.org/atomic v1.11.0 // @grafana/alerting-squad-backend
+ 	go.uber.org/goleak v1.3.0 // indirect
+-	golang.org/x/sys v0.15.0 // indirect
+-	golang.org/x/text v0.14.0 // @grafana/backend-platform
++	golang.org/x/sys v0.45.0 // indirect
++	golang.org/x/text v0.37.0 // @grafana/backend-platform
+ 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
+ 	google.golang.org/appengine v1.6.7 // indirect
+ 	google.golang.org/genproto v0.0.0-20231012201019-e917dd12ba7a // indirect; @grafana/backend-platform
+@@ -272,7 +272,7 @@ require (
+ 	github.com/weaveworks/common v0.0.0-20230511094633-334485600903 // @grafana/alerting-squad-backend
+ 	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // @grafana/grafana-as-code
+ 	go.opentelemetry.io/contrib/samplers/jaegerremote v0.15.1 // @grafana/backend-platform
+-	golang.org/x/mod v0.12.0 // @grafana/backend-platform
++	golang.org/x/mod v0.35.0 // @grafana/backend-platform
+ 	gopkg.in/square/go-jose.v2 v2.6.0 // @grafana/grafana-authnz-team
+ 	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // @grafana/partner-datasources
+ )
+@@ -407,7 +407,7 @@ require (
+ 	go.starlark.net v0.0.0-20221020143700-22309ac47eac // indirect
+ 	go.uber.org/multierr v1.11.0 // indirect
+ 	go.uber.org/zap v1.24.0 // indirect
+-	golang.org/x/term v0.15.0 // indirect
++	golang.org/x/term v0.43.0 // indirect
+ 	google.golang.org/genproto/googleapis/api v0.0.0-20231002182017-d307bd883b97 // indirect
+ 	google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b // indirect
+ 	gopkg.in/fsnotify/fsnotify.v1 v1.4.7 // indirect
+@@ -478,6 +478,8 @@ require (
+ require (
+ 	github.com/google/gnostic-models v0.6.8 // indirect
+ 	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
++	golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa // indirect
++	golang.org/x/tools/godoc v0.1.0-deprecated // indirect
+ )
+ 
+ // Use fork of crewjam/saml with fixes for some issues until changes get merged into upstream
+diff --git a/go.sum b/go.sum
+index d05dfb5..ba1e58a 100644
+--- a/go.sum
++++ b/go.sum
+@@ -3133,8 +3133,8 @@ golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE
+ golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
+ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+ golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
+-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
++golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
++golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
+ golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+ golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+ golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+@@ -3199,8 +3199,9 @@ golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
+ golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+ golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
+ golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
++golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
++golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+ golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+ golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+ golang.org/x/net v0.0.0-20180816102801-aaf60122140d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+@@ -3312,8 +3313,8 @@ golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+ golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
++golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
++golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+ golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+ golang.org/x/oauth2 v0.0.0-20181003184128-c57b0facaced/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+ golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+@@ -3369,8 +3370,8 @@ golang.org/x/sync v0.0.0-20220819030929-7fc1605a5dde/go.mod h1:RxMgew5VJxzue5/jJ
+ golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+-golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
+-golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
++golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
++golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+ golang.org/x/sys v0.0.0-20180816055513-1c9583448a9c/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+ golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+ golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+@@ -3539,8 +3540,10 @@ golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+ golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+ golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
+-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
++golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
++golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
++golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa h1:efT73AJZfAAUV7SOip6pWGkwJDzIGiKBZGVzHYa+ve4=
++golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa/go.mod h1:kHjTxDEnAu6/Nl9lDkzjWpR+bmKfxeiRuSDlsMb70gE=
+ golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+ golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+ golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+@@ -3555,8 +3558,8 @@ golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
+ golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+ golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+-golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
+-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
++golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
++golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+ golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+ golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+@@ -3574,8 +3577,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+ golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
++golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
++golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+ golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+ golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+ golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+@@ -3713,8 +3716,11 @@ golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
+ golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
+ golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+ golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
+-golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
+ golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
++golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
++golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
++golang.org/x/tools/godoc v0.1.0-deprecated h1:o+aZ1BOj6Hsx/GBdJO/s815sqftjSnrZZwyYTHODvtk=
++golang.org/x/tools/godoc v0.1.0-deprecated/go.mod h1:qM63CriJ961IHWmnWa9CjZnBndniPt4a3CK0PVB9bIg=
+ golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+ golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/1005-vendor-fix-idna-unicode-version-gate.patch b/1005-vendor-fix-idna-unicode-version-gate.patch
new file mode 100644
index 0000000..e071e76
--- /dev/null
+++ b/1005-vendor-fix-idna-unicode-version-gate.patch
@@ -0,0 +1,12 @@
+diff --git a/vendor/golang.org/x/net/idna/idna.go b/vendor/golang.org/x/net/idna/idna.go
+--- a/vendor/golang.org/x/net/idna/idna.go
++++ b/vendor/golang.org/x/net/idna/idna.go
+@@ -400,7 +400,7 @@
+ 				// Spec says keep the old label.
+ 				continue
+ 			}
+-			if unicode16 && err == nil && len(u) > 0 && isASCII(u) {
++			if err == nil && len(u) > 0 && isASCII(u) {
+ 				err = punyError(enc)
+ 			}
+ 			isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight
diff --git a/create_bundles.sh b/create_bundles.sh
index f4105d0..2427ae2 100755
--- a/create_bundles.sh
+++ b/create_bundles.sh
@@ -22,6 +22,7 @@ pushd "${SOURCE_DIR}"
 # Vendor Go dependencies
 patch -p1 --fuzz=0 < ../0004-remove-unused-backend-dependencies.patch
 patch -p1 --fuzz=0 < ../0012-fix-jwt-CVE.patch
+patch -p1 --fuzz=0 < ../0016-fix-x-net-CVE.patch
 go mod vendor
 
 # Generate Go files
diff --git a/create_bundles_in_container.sh b/create_bundles_in_container.sh
index 216efab..7ffd3b2 100755
--- a/create_bundles_in_container.sh
+++ b/create_bundles_in_container.sh
@@ -6,7 +6,7 @@
 #
 
 cat <<EOF | podman build -t grafana-build -f - .
-FROM fedora:39
+FROM fedora:44
 
 RUN dnf upgrade -y && \
     dnf install -y rpmdevtools python3-packaging python3-pyyaml make golang nodejs yarnpkg
diff --git a/grafana.spec b/grafana.spec
index a57c7dd..98b46e4 100644
--- a/grafana.spec
+++ b/grafana.spec
@@ -26,7 +26,7 @@ end}
 
 Name:             grafana
 Version:          10.2.6
-Release:          22%{?dist}
+Release:          23%{?dist}
 Summary:          Metrics dashboard and graph editor
 License:          AGPL-3.0-only
 URL:              https://grafana.org
@@ -37,13 +37,13 @@ Source0:          https://github.com/grafana/grafana/archive/v%{version}/%{name}
 # Source1 contains the bundled Go and Node.js dependencies
 # Note: In case there were no changes to this tarball, the NVR of this tarball
 # lags behind the NVR of this package.
-Source1:          grafana-vendor-%{version}-11.tar.xz
+Source1:          grafana-vendor-%{version}-23.tar.xz
 
 %if %{compile_frontend} == 0
 # Source2 contains the precompiled frontend
 # Note: In case there were no changes to this tarball, the NVR of this tarball
 # lags behind the NVR of this package.
-Source2:          grafana-webpack-%{version}-11.tar.gz
+Source2:          grafana-webpack-%{version}-23.tar.gz
 %endif
 
 # Source3 contains the systemd-sysusers configuration
@@ -83,12 +83,14 @@ Patch12:          0012-fix-jwt-CVE.patch
 Patch13:          0013-fix-CVE-2025-4123.patch
 Patch14:          0014-Fix-CVE-2026-21721.patch
 Patch15:          0015-Fix-CVE-2026-27877.patch
+Patch16:          0016-fix-x-net-CVE.patch
 
 # Patches affecting the vendor tarball
 Patch1001:        1001-vendor-patch-removed-backend-crypto.patch
 Patch1002:        1002-vendor-use-pbkdf2-from-OpenSSL.patch
 Patch1003:        1003-vendor-skip-goldenfiles-tests.patch
 Patch1004:        1004-vendor-Redacted-Url-in-logs.patch
+Patch1005:        1005-vendor-fix-idna-unicode-version-gate.patch
 
 # Intersection of go_arches and nodejs_arches
 ExclusiveArch:    %{grafana_arches}
@@ -233,13 +235,13 @@ Provides: bundled(golang(go.opentelemetry.io/contrib/instrumentation/net/http/ht
 Provides: bundled(golang(go.opentelemetry.io/otel/exporters/jaeger)) = 1.10.0
 Provides: bundled(golang(go.opentelemetry.io/otel/sdk)) = 1.21.0
 Provides: bundled(golang(go.opentelemetry.io/otel/trace)) = 1.21.0
-Provides: bundled(golang(golang.org/x/crypto)) = 0.17.0
+Provides: bundled(golang(golang.org/x/crypto)) = 0.51.0
 Provides: bundled(golang(golang.org/x/exp)) = 0.0.0-20230321023759.10a507213a29
-Provides: bundled(golang(golang.org/x/net)) = 0.19.0
+Provides: bundled(golang(golang.org/x/net)) = 0.55.0
 Provides: bundled(golang(golang.org/x/oauth2)) = 0.15.0
-Provides: bundled(golang(golang.org/x/sync)) = 0.4.0
+Provides: bundled(golang(golang.org/x/sync)) = 0.20.0
 Provides: bundled(golang(golang.org/x/time)) = 0.3.0
-Provides: bundled(golang(golang.org/x/tools)) = 0.13.0
+Provides: bundled(golang(golang.org/x/tools)) = 0.44.0
 Provides: bundled(golang(gonum.org/v1/gonum)) = 0.12.0
 Provides: bundled(golang(google.golang.org/api)) = 0.148.0
 Provides: bundled(golang(google.golang.org/grpc)) = 1.59.0
@@ -263,7 +265,7 @@ Provides: bundled(golang(github.com/hashicorp/go-multierror)) = 1.1.1
 Provides: bundled(golang(github.com/modern-go/reflect2)) = 1.0.2
 Provides: bundled(golang(github.com/olekukonko/tablewriter)) = 0.0.5
 Provides: bundled(golang(go.uber.org/atomic)) = 1.11.0
-Provides: bundled(golang(golang.org/x/text)) = 0.14.0
+Provides: bundled(golang(golang.org/x/text)) = 0.37.0
 Provides: bundled(golang(google.golang.org/genproto)) = 0.0.0-20231012201019.e917dd12ba7a
 Provides: bundled(golang(cloud.google.com/go/kms)) = 1.15.2
 Provides: bundled(golang(github.com/Azure/azure-sdk-for-go/sdk/azidentity)) = 1.3.0
@@ -308,7 +310,7 @@ Provides: bundled(golang(github.com/redis/go-redis/v9)) = 9.0.2
 Provides: bundled(golang(github.com/weaveworks/common)) = 0.0.0-20230511094633.334485600903
 Provides: bundled(golang(github.com/xeipuuv/gojsonpointer)) = 0.0.0-20180127040702.4e3ac2762d5f
 Provides: bundled(golang(go.opentelemetry.io/contrib/samplers/jaegerremote)) = 0.15.1
-Provides: bundled(golang(golang.org/x/mod)) = 0.12.0
+Provides: bundled(golang(golang.org/x/mod)) = 0.35.0
 Provides: bundled(golang(gopkg.in/square/go-jose.v2)) = 2.6.0
 Provides: bundled(golang(k8s.io/utils)) = 0.0.0-20230406110748.d93618cff8a2
 Provides: bundled(golang(github.com/spf13/cobra)) = 1.7.0
@@ -780,6 +782,7 @@ rm -r plugins-bundled
 %patch -P 13 -p1
 %patch -P 14 -p1
 %patch -P 15 -p1
+%patch -P 16 -p1
 
 %patch -P 1001 -p1
 %if %{enable_fips_mode}
@@ -789,6 +792,7 @@ rm -r plugins-bundled
 %patch -P 1003 -p1
 %endif
 %patch -P 1004 -p1
+%patch -P 1005 -p1
 
 
 %build
@@ -1025,6 +1029,10 @@ done
 %ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/*/active/modules/200/grafana
 
 %changelog
+* Thu Jul 09 2026 Sam Feifer <sfeifer@redhat.com> 10.2.6-23
+- Resolves RHEL-183848: CVE-2026-39821
+- Resolves RHEL-191577: CVE-2026-27136
+
 * Wed Apr 22 2026 Sam Feifer <sfeifer@redhat.com> 10.2.6-22
 - Resolves RHEL-161804: CVE-2026-27877
 - Resolves RHEL-166346: CVE-2026-33810
diff --git a/sources b/sources
index 725bcd1..0cb0db4 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
+SHA512 (grafana-webpack-10.2.6-23.tar.gz) = 37ac517bdbfeafbc2d9ce4f96b5879d204ea4a02ae1f2a8697d4ffb528ce367ad2db315f4282d4335cf77c8e10767f0a73a61692166751ed95fc28fea71b7e59
+SHA512 (grafana-vendor-10.2.6-23.tar.xz) = 8a7644744472da7fd5feac58de858e7c0da679e5bc9eaafb244ab96f4d34679d383d6a357e347c0af787056d47d9569132c03ebdb6c5f08b8621595182e830b3
 SHA512 (grafana-10.2.6.tar.gz) = 7244f4cb6572fe0403e6224f7247fbb273bbd1f359ee706a82001f0d409fb375d113f1cb24a657e845b93eb55ee98e1d7ae713e767c219f4d3b00eaf5c73d28e
-SHA512 (grafana-webpack-10.2.6-11.tar.gz) = 7e4a0f962bc0dbf0fffbc31599870c4099e421d4505644be0a412b26043dc7adb37e81f7b24621731f96d3c8a652009a9eef8cf68dd03e1351dc309fd87a1e6f
-SHA512 (grafana-vendor-10.2.6-11.tar.xz) = 1db5bedbbc84fecad9d07f9a44db0c17c9472387bdd0d58877415c756015dc579f109c1ae43a21ae97da5625806747ddd00b5f31be7965adabd316b1d6e943e1