diff --git a/001-remove-unused-frontend-crypto-and-patch-md4.patch b/001-remove-unused-frontend-crypto-and-patch-md4.patch
new file mode 100644
index 0000000..5d99e56
--- /dev/null
+++ b/001-remove-unused-frontend-crypto-and-patch-md4.patch
@@ -0,0 +1,62 @@
+diff --git a/package.json b/package.json
+index 9469638..d81424f 100644
+--- a/package.json
++++ b/package.json
+@@ -61,5 +61,9 @@
+     "d3-scale": "^3.2.1",
+     "d3-selection": "^1.4.1",
+     "d3-transition": "^1.3.2"
++  },
++  "resolutions": {
++    "crypto-browserify": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.1.tgz",
++    "http-signature": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.1.tgz"
+   }
+ }
+diff --git a/webpack.config.js b/webpack.config.js
+index 00e171a..8997a9f 100644
+--- a/webpack.config.js
++++ b/webpack.config.js
+@@ -8,6 +8,13 @@ const ScriptExtHtmlWebpackPlugin = require('script-ext-html-webpack-plugin')
+ const TerserPlugin = require('terser-webpack-plugin')
+ const packageFile = require('./package.json')
+ 
++// monkey patch crypto module to not use deprecated md4 hash algorithm,
++// which is removed in OpenSSL 3.0
++// https://github.com/webpack/webpack/issues/13572#issuecomment-923736472
++const crypto = require("crypto");
++const crypto_orig_createHash = crypto.createHash;
++crypto.createHash = algorithm => crypto_orig_createHash(algorithm == "md4" ? "sha256" : algorithm);
++
+ module.exports = [{
+     context: path.join(__dirname, 'src'),
+     entry: {
+@@ -21,6 +28,9 @@ module.exports = [{
+         libraryExport: 'default',
+         libraryTarget: 'umd'
+     },
++    node: {
++        crypto: false
++    },
+     plugins: [
+         new CopyWebpackPlugin([{
+             from: 'flamegraph.css',
+@@ -58,6 +68,9 @@ module.exports = [{
+         library: ['flamegraph', '[name]'],
+         libraryTarget: 'umd'
+     },
++    node: {
++        crypto: false
++    },
+     module: {
+         rules: [{
+             test: /\.js$/,
+@@ -79,6 +92,9 @@ module.exports = [{
+         path: path.resolve(__dirname, 'dist', 'templates'),
+         filename: 'bundle.js'
+     },
++    node: {
++        crypto: false
++    },
+     plugins: [
+         new CleanWebpackPlugin({
+             protectWebpackAssets: false,
diff --git a/001-remove-unused-frontend-crypto-and-update-hash-fn.patch b/001-remove-unused-frontend-crypto-and-update-hash-fn.patch
deleted file mode 100644
index ff0e49a..0000000
--- a/001-remove-unused-frontend-crypto-and-update-hash-fn.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-diff --git a/package.json b/package.json
-index 2284a2f..26bb09b 100644
---- a/package.json
-+++ b/package.json
-@@ -58,5 +58,8 @@
-     "d3-selection": "^1.4.1",
-     "d3-transition": "^1.3.2",
-     "d3-dispatch": "^1.0.6"
-+  },
-+  "resolutions": {
-+    "crypto-browserify": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.1.tgz"
-   }
- }
-diff --git a/webpack.config.js b/webpack.config.js
-index 7153477..e663cf1 100644
---- a/webpack.config.js
-+++ b/webpack.config.js
-@@ -19,7 +19,11 @@ module.exports = [{
-         filename: '[name].js',
-         library: 'flamegraph',
-         libraryExport: 'default',
--        libraryTarget: 'umd'
-+        libraryTarget: 'umd',
-+        hashFunction: 'sha256',
-+    },
-+    node: {
-+        crypto: false
-     },
-     plugins: [
-         new CopyWebpackPlugin([{
-@@ -54,7 +58,11 @@ module.exports = [{
-         path: path.resolve(__dirname, 'dist'),
-         filename: '[name].js',
-         library: ['flamegraph', 'colorMapper'],
--        libraryTarget: 'umd'
-+        libraryTarget: 'umd',
-+        hashFunction: 'sha256',
-+    },
-+    node: {
-+        crypto: false
-     },
-     module: {
-         rules: [{
-@@ -80,7 +88,11 @@ module.exports = [{
-         path: path.resolve(__dirname, 'dist'),
-         filename: '[name].js',
-         library: ['flamegraph', 'tooltip'],
--        libraryTarget: 'umd'
-+        libraryTarget: 'umd',
-+        hashFunction: 'sha256',
-+    },
-+    node: {
-+        crypto: false
-     },
-     module: {
-         rules: [{
-@@ -101,7 +113,11 @@ module.exports = [{
-     entry: './template.js',
-     output: {
-         path: path.resolve(__dirname, 'dist', 'templates'),
--        filename: 'bundle.js'
-+        filename: 'bundle.js',
-+        hashFunction: 'sha256',
-+    },
-+    node: {
-+        crypto: false
-     },
-     plugins: [
-         new CleanWebpackPlugin({
-@@ -131,5 +147,10 @@ module.exports = [{
-                 use: ['style-loader', 'css-loader']
-             }
-         ]
-+    },
-+    optimization: {
-+        minimizer: [
-+            new TerserPlugin()
-+        ]
-     }
- }]
diff --git a/002-webpack-update-hash-fn.vendor.patch b/002-webpack-update-hash-fn.vendor.patch
deleted file mode 100644
index b842d88..0000000
--- a/002-webpack-update-hash-fn.vendor.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/node_modules/webpack/lib/optimize/ConcatenatedModule.js b/node_modules/webpack/lib/optimize/ConcatenatedModule.js
-index 03711c4..df4d216 100644
---- a/node_modules/webpack/lib/optimize/ConcatenatedModule.js
-+++ b/node_modules/webpack/lib/optimize/ConcatenatedModule.js
-@@ -560,7 +560,7 @@ class ConcatenatedModule extends Module {
- 				orderedConcatenationListIdentifiers += " ";
- 			}
- 		}
--		const hash = createHash("md4");
-+		const hash = createHash("sha256");
- 		hash.update(orderedConcatenationListIdentifiers);
- 		return this.rootModule.identifier() + " " + hash.digest("hex");
- 	}
diff --git a/Makefile b/Makefile
index cef2f9b..a3a453a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,19 +1,16 @@
-ifndef VER
-  $(error VER is undefined)
-endif
-ifndef REL
-  $(error REL is undefined)
-endif
+VERSION := $(shell rpm --specfile *.spec --qf '%{VERSION}\n' | head -1)
+RELEASE := $(shell rpm --specfile *.spec --qf '%{RELEASE}\n' | head -1 | cut -d. -f1)
 
 NAME       := d3-flame-graph
 RPM_NAME   := js-$(NAME)
-SOURCE_DIR := $(NAME)-$(VER)
-SOURCE_TAR := $(NAME)-$(VER).tar.gz
-VENDOR_TAR := $(RPM_NAME)-vendor-$(VER)-$(REL).tar.xz
+SOURCE_DIR := $(NAME)-$(VERSION)
+SOURCE_TAR := $(NAME)-$(VERSION).tar.gz
+VENDOR_TAR := $(RPM_NAME)-vendor-$(VERSION)-$(RELEASE).tar.xz
 
-ALL_PATCHES := $(sort $(wildcard *.patch))
-VENDOR_PATCHES := $(sort $(wildcard *.vendor.patch))
-SOURCE_PATCHES := $(filter-out $(VENDOR_PATCHES),$(ALL_PATCHES))
+ALL_PATCHES     := $(sort $(wildcard *.patch))
+VENDOR_PATCHES  := $(sort $(wildcard *.vendor.patch))
+COND_PATCHES    := $(sort $(wildcard *.cond.patch))
+REGULAR_PATCHES := $(filter-out $(VENDOR_PATCHES) $(COND_PATCHES),$(ALL_PATCHES))
 
 all: $(SOURCE_TAR) $(VENDOR_TAR)
 
@@ -25,17 +22,17 @@ $(VENDOR_TAR): $(SOURCE_TAR)
 	tar xf $(SOURCE_TAR)
 
 	# Patches to apply before vendoring
-	for patch in $(SOURCE_PATCHES); do echo $$patch; patch -d $(SOURCE_DIR) -p1 --fuzz=0 < $$patch; done
+	for patch in $(REGULAR_PATCHES); do echo applying $$patch ...; patch -d $(SOURCE_DIR) -p1 --fuzz=0 < $$patch; done
 
 	# Node.js
 	cd $(SOURCE_DIR) && yarn import && yarn install --pure-lockfile
-	./list_bundled_nodejs_packages.py $(SOURCE_DIR)/ >> $@.manifest
+	./list_bundled_nodejs_packages.py $(SOURCE_DIR) >> $@.manifest
 
 	# Patches to apply after vendoring
-	for patch in $(VENDOR_PATCHES); do echo $$patch; patch -d $(SOURCE_DIR) -p1 --fuzz=0 < $$patch; done
+	for patch in $(VENDOR_PATCHES); do echo applying $$patch ...; patch -d $(SOURCE_DIR) -p1 --fuzz=0 < $$patch; done
 
 	# Create tarball
-	XZ_OPT=-9 tar cJf $@ \
+	XZ_OPT=-9 time -p tar cJf $@ \
 		$(SOURCE_DIR)/node_modules
 
 clean:
diff --git a/README.md b/README.md
index b72f694..97df79c 100644
--- a/README.md
+++ b/README.md
@@ -1,17 +1,15 @@
 # js-d3-flame-graph
-
 The js-d3-flame-graph package
 
 ## Upgrade instructions
-(replace X.Y.Z and R with the new version/release)
-
-* update `Version`, `Release` and `%changelog` in the specfile
-* create bundles and manifest: `VER=X.Y.Z REL=R make clean all`
+* update `Version`, `Release`, `%changelog` and tarball NVRs in the specfile
+* create bundles and manifest: `make clean all`
 * update specfile with contents of the `.manifest` file
 * run local build: `rpkg local`
 * run rpm linter: `rpkg lint -r js-d3-flame-graph.rpmlintrc`
 * run a scratch build: `fedpkg scratch-build --srpm`
 * upload new source tarballs: `fedpkg new-sources *.tar.gz *.tar.xz`
+* commit new `sources` file
 
 ## Backporting
 * create the patch
@@ -21,3 +19,8 @@ The js-d3-flame-graph package
   * update the specfile with new tarball path and contents of the `.manifest` file
 
 Note: the Makefile automatically applies patches before creating the tarballs
+
+## Patches
+* `*.patch`: regular patches applied to the source, applied in the Makefile before vendoring and in the specfile (e.g. updating dependencies)
+* `*.vendor.patch`: patches applied to the vendor tarball (e.g. patching vendored sources before generating a webpack)
+* `*.cond.patch`: conditionally applied patches in the specfile
diff --git a/js-d3-flame-graph.spec b/js-d3-flame-graph.spec
index 228f1d6..f913acb 100644
--- a/js-d3-flame-graph.spec
+++ b/js-d3-flame-graph.spec
@@ -2,8 +2,8 @@
 %global         github https://github.com/spiermar/d3-flame-graph
 
 Name:           js-d3-flame-graph
-Version:        3.0.2
-Release:        7%{?dist}
+Version:        4.0.7
+Release:        1%{?dist}
 Summary:        A D3.js plugin that produces flame graphs
 
 BuildArch:      noarch
@@ -12,42 +12,48 @@ License:        ASL 2.0
 URL:            %{github}
 
 Source0:        %{github}/archive/%{version}/%{pkgname}-%{version}.tar.gz
-Source1:        js-d3-flame-graph-vendor-%{version}-6.tar.xz
+# Note: In case there were no changes to this tarball, the NVR of this tarball
+# lags behind the NVR of this package.
+Source1:        js-d3-flame-graph-vendor-%{version}-1.tar.xz
 Source2:        Makefile
 Source3:        list_bundled_nodejs_packages.py
 
-Patch1:         001-remove-unused-frontend-crypto-and-update-hash-fn.patch
-Patch2:         002-webpack-update-hash-fn.vendor.patch
+Patch1:         001-remove-unused-frontend-crypto-and-patch-md4.patch
 
 BuildRequires:  web-assets-devel
 BuildRequires:  nodejs
+
+%if 0%{?fedora}
 Requires:       web-assets-filesystem
+%endif
 
 # Bundled npm packages
+Provides: bundled(npm(babel-preset-env)) = 1.7.0
 Provides: bundled(npm(clean-webpack-plugin)) = 3.0.0
 Provides: bundled(npm(copy-webpack-plugin)) = 5.1.1
-Provides: bundled(npm(css-loader)) = 3.4.2
+Provides: bundled(npm(css-loader)) = 3.5.2
 Provides: bundled(npm(d3-array)) = 2.4.0
 Provides: bundled(npm(d3-dispatch)) = 1.0.6
 Provides: bundled(npm(d3-ease)) = 1.0.6
-Provides: bundled(npm(d3-format)) = 1.4.3
+Provides: bundled(npm(d3-format)) = 1.4.4
 Provides: bundled(npm(d3-hierarchy)) = 1.1.9
 Provides: bundled(npm(d3-scale)) = 3.2.1
 Provides: bundled(npm(d3-selection)) = 1.4.1
 Provides: bundled(npm(d3-transition)) = 1.3.2
 Provides: bundled(npm(eslint)) = 6.8.0
-Provides: bundled(npm(eslint-config-standard)) = 14.1.0
-Provides: bundled(npm(eslint-loader)) = 3.0.3
-Provides: bundled(npm(eslint-plugin-import)) = 2.20.1
-Provides: bundled(npm(eslint-plugin-node)) = 11.0.0
+Provides: bundled(npm(eslint-config-standard)) = 14.1.1
+Provides: bundled(npm(eslint-loader)) = 4.0.0
+Provides: bundled(npm(eslint-plugin-import)) = 2.20.2
+Provides: bundled(npm(eslint-plugin-node)) = 11.1.0
 Provides: bundled(npm(eslint-plugin-promise)) = 4.2.1
 Provides: bundled(npm(eslint-plugin-standard)) = 4.0.1
-Provides: bundled(npm(html-webpack-plugin)) = 3.2.0
+Provides: bundled(npm(html-webpack-plugin)) = 4.2.0
+Provides: bundled(npm(jest)) = 25.4.0
+Provides: bundled(npm(prettier)) = 2.0.4
 Provides: bundled(npm(script-ext-html-webpack-plugin)) = 2.1.4
-Provides: bundled(npm(style-loader)) = 1.1.3
-Provides: bundled(npm(tape)) = 4.13.2
+Provides: bundled(npm(style-loader)) = 1.1.4
 Provides: bundled(npm(terser-webpack-plugin)) = 1.4.3
-Provides: bundled(npm(webpack)) = 4.42.0
+Provides: bundled(npm(webpack)) = 4.42.1
 Provides: bundled(npm(webpack-cli)) = 3.3.11
 Provides: bundled(npm(webpack-dev-server)) = 3.10.3
 
@@ -82,6 +88,10 @@ install -d -m 755 %{buildroot}/%{_jsdir}/%{pkgname}
 cp -a dist/* %{buildroot}/%{_jsdir}/%{pkgname}
 
 
+%check
+./node_modules/.bin/jest
+
+
 %files
 %{_jsdir}/%{pkgname}
 %{_datadir}/%{pkgname}
@@ -95,6 +105,9 @@ cp -a dist/* %{buildroot}/%{_jsdir}/%{pkgname}
 
 
 %changelog
+* Fri Oct 01 2021 Andreas Gerstmayr <agerstmayr@redhat.com> - 4.0.7-1
+- update to 4.0.7 tagged upstream community sources, see CHANGELOG
+
 * Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 3.0.2-7
 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
   Related: rhbz#1991688
diff --git a/sources b/sources
index 1dc559a..495281d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (d3-flame-graph-3.0.2.tar.gz) = 992c21ed8e88428cfa2475c6b4cffbc14fbdb163137cdab79a7f93ec9df8acacb890037a763d2e0d81e6e3755c8eb2d502cfaeb9027a077e80c5691c40516e47
-SHA512 (js-d3-flame-graph-vendor-3.0.2-6.tar.xz) = 8afa777c80d0b8e8fcc8b10e440fbefae9b35f3ee184efa1e8782c88042bca8d1d5b719f97a580b9360b7506786a78e9f9ae0710810c8fa9b1ee5d851362b0d4
+SHA512 (d3-flame-graph-4.0.7.tar.gz) = 1905fbeac9cef2808330af86495ef2a4ec97a332ed24bb869ed7fe71e0cdf44da179c66464dff125ced2be0768a7fe6f73971dbc4d01f7e39725dd3527ebd05a
+SHA512 (js-d3-flame-graph-vendor-4.0.7-1.tar.xz) = 1648ff25b800932bb5cdfdfdd8505eb18d0e097c7ea7919ad2a98fdd72ec0ee65ff1bdd67c331b14a8eeb0f3ea533c4b0c0779205ba386c1ed4d8c054328fc53