diff --git a/NEWS b/NEWS
index 66eba57..6f683a4 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,15 @@ Live versions of these release notes can be found at:
   * https://bit.ly/openjdk2504
 
 * CVEs
+  - CVE-2026-46968
+  - CVE-2026-46917
+  - CVE-2026-47010
+  - CVE-2026-47021
+  - CVE-2026-47027
+  - CVE-2026-60147
+  - CVE-2026-47059
+  - CVE-2026-47063
+  - CVE-2026-41254
 * Changes
   - JDK-7184899: Test sun/java2d/X11SurfaceData/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
   - JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails
@@ -273,7 +282,6 @@ security-libs/javax.crypto:
 
 JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA Private Key Encodings
 ===============================================================================
-
 This release of OpenJDK adds support for encoding ML-KEM and ML-DSA
 keys to PKCS#8 format using the DER-encoded ASN.1 CHOICE formats
 defined in Section 6, "Private Key Format" of RFC 9935 [0] and RFC
diff --git a/java-25-openjdk.spec b/java-25-openjdk.spec
index 29ba2a3..51f7fcd 100644
--- a/java-25-openjdk.spec
+++ b/java-25-openjdk.spec
@@ -9,7 +9,7 @@
 %global updatever 4
 %global patchver 0
 %global buildver 7
-%global portablerelease 1
+%global portablerelease 2
 %global rpmrelease 1
 
 # Define IcedTea version used for SystemTap tapsets and desktop file
@@ -2595,7 +2595,12 @@ exit 0
 %endif
 
 %changelog
-* Thu Jul 16 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.0.7-1.0
+* Thu Jul 23 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.0.7-2.1
+- Add CVEs to NEWS file
+- Update to tarball with final changeset ID
+- Related: RHEL-188883
+
+* Thu Jul 16 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.0.7-1.1
 - Update to jdk-25.0.4+7 (GA)
 - Update release notes to 25.0.4+7
 - Bump freetype version to 2.14.3 following JDK-8385390
diff --git a/sources b/sources
index 70aa5a9..33c44a9 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
 SHA512 (nssadapter-0.1.1.tar.xz) = 2b4675cfbfa2ccb6c9a4870a4b58ae555267f5b8c9bdb0cf37b075483e6e9ea929561c05070453cf0d67b0b029de5408274555bf2ff50e9533219e898b2717f9
-SHA512 (openjdk-25.0.4+7.tar.xz) = bd2c336ba2f0196e361bc8fd81a39cd9907682c0fac3a2b24a703a2abcede0fc75247fc54767329fc45d2f562f2728e3691db864363e9ab326c8218280831494
+SHA512 (openjdk-25.0.4+7.tar.xz) = 736949ba57d6e36df1b4f85418b2a27d3e0aec7e4b492ef5d9c006355ede63db3f5f9e0e0ea2d63bea119d9baaa9cf5a92e14dad19e69e9351072ef0955ea2cf