22 changed files with 14 additions and 2675 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,5 +1,3 @@
-SOURCES/gvim16.png
+SOURCES/Changelog.rpm
 SOURCES/gvim32.png
 SOURCES/gvim48.png
 SOURCES/gvim64.png
 SOURCES/vim-8.0-1763.tar.bz2
--- a/.vim.metadata
+++ b/.vim.metadata
@ -1,5 +1,3 @@
-a7c81ffd40611b19c125c505699d8a6401f6e022 SOURCES/gvim16.png
+5ea81545fc28b57c490d25bda67a63a2838dd25b SOURCES/Changelog.rpm
 2356345378a9f1ba3c9e9e6508b695611e8f2cfa SOURCES/gvim32.png
 37ad682f67539da7f4d4b7316383115dfe43222d SOURCES/gvim48.png
 c32bd520a1498b71ee9bbcddc7ad05df1565d085 SOURCES/gvim64.png
 6716ebb416c9da91d16a2b17dc6bc2cecf65b4eb SOURCES/vim-8.0-1763.tar.bz2
--- a/SOURCES/0001-patch-8.1.1366-using-expressions-in-modeline-is-unsafe.patch
+++ b/SOURCES/0001-patch-8.1.1366-using-expressions-in-modeline-is-unsafe.patch
@ -1,500 +0,0 @@
 diff --git a/runtime/doc/options.txt b/runtime/doc/options.txt
 index b7f9869..2558f17 100644
 --- a/runtime/doc/options.txt
 +++ b/runtime/doc/options.txt
@@ -589,13 +589,17 @@ backslash in front of the ':' will be removed.  Example:
 This sets the 'dir' option to "c:\tmp".  Only a single backslash before the
 ':' is removed.  Thus to include "\:" you have to specify "\\:".
 +							*E992*
 No other commands than "set" are supported, for security reasons (somebody
 might create a Trojan horse text file with modelines).  And not all options
 -can be set.  For some options a flag is set, so that when it's used the
 -|sandbox| is effective.  Still, there is always a small risk that a modeline
 -causes trouble.  E.g., when some joker sets 'textwidth' to 5 all your lines
 -are wrapped unexpectedly.  So disable modelines before editing untrusted text.
 -The mail ftplugin does this, for example.
 +can be set.  For some options a flag is set, so that when the value is used
 +the |sandbox| is effective.  Some options can only be set from the modeline
 +when 'modelineexpr' is set (the default is off).
 +
 +Still, there is always a small risk that a modeline causes trouble.  E.g.,
 +when some joker sets 'textwidth' to 5 all your lines are wrapped unexpectedly.
 +So disable modelines before editing untrusted text.  The mail ftplugin does
 +this, for example.
 Hint: If you would like to do something else than setting an option, you could
 define an autocommand that checks the file for a specific string.  For
@@ -1177,6 +1181,7 @@ A jump table for the options with a short description can be found at |Q_op|.
 	The expression will be evaluated in the |sandbox| when set from a
 	modeline, see |sandbox-option|.
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 	It is not allowed to change text or jump to another window while
 	evaluating 'balloonexpr' |textlock|.
@@ -3290,7 +3295,7 @@ A jump table for the options with a short description can be found at |Q_op|.
 	The expression will be evaluated in the |sandbox| if set from a
 	modeline, see |sandbox-option|.
 	This option can't be set from a |modeline| when the 'diff' option is
 -	on.
 +	on or the 'modelineexpr' option is off.
 	It is not allowed to change text or jump to another window while
 	evaluating 'foldexpr' |textlock|.
@@ -3432,6 +3437,7 @@ A jump table for the options with a short description can be found at |Q_op|.
 	The expression will be evaluated in the |sandbox| if set from a
 	modeline, see |sandbox-option|.
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 	It is not allowed to change text or jump to another window while
 	evaluating 'foldtext' |textlock|.
@@ -3470,6 +3476,7 @@ A jump table for the options with a short description can be found at |Q_op|.
 	The expression will be evaluated in the |sandbox| when set from a
 	modeline, see |sandbox-option|.  That stops the option from working,
 	since changing the buffer text is not allowed.
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 	NOTE: This option is set to "" when 'compatible' is set.
 					*'formatoptions'* *'fo'*
@@ -3530,6 +3537,8 @@ A jump table for the options with a short description can be found at |Q_op|.
 	Also see 'swapsync' for controlling fsync() on swap files.
 	'fsync' also applies to |writefile()|, unless a flag is used to
 	overrule it.
 +	This option cannot be set from a |modeline| or in the |sandbox|, for
 +	security reasons.
 				   *'gdefault'* *'gd'* *'nogdefault'* *'nogd'*
 'gdefault' 'gd'		boolean	(default off)
@@ -3985,6 +3994,7 @@ A jump table for the options with a short description can be found at |Q_op|.
 	'guitabtooltip' is used for the tooltip, see below.
 	The expression will be evaluated in the |sandbox| when set from a
 	modeline, see |sandbox-option|.
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 	Only used when the GUI tab pages line is displayed.  'e' must be
 	present in 'guioptions'.  For the non-GUI tab pages line 'tabline' is
@@ -4246,6 +4256,7 @@ A jump table for the options with a short description can be found at |Q_op|.
 	When this option contains printf-style '%' items, they will be
 	expanded according to the rules used for 'statusline'.  See
 	'titlestring' for example settings.
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 	{not available when compiled without the |+statusline| feature}
 			*'ignorecase'* *'ic'* *'noignorecase'* *'noic'*
@@ -4265,6 +4276,8 @@ A jump table for the options with a short description can be found at |Q_op|.
 	This option specifies a function that will be called to
 	activate or deactivate the Input Method.
 	It is not used in the GUI.
 +	The expression will be evaluated in the |sandbox| when set from a
 +	modeline, see |sandbox-option|.
 	Example: >
 		function ImActivateFunc(active)
@@ -5296,6 +5309,19 @@ A jump table for the options with a short description can be found at |Q_op|.
 				 Vi default: off)
 			local to buffer
 						*'modelines'* *'mls'*
 +	If 'modeline' is on 'modelines' gives the number of lines that is
 +	checked for set commands.  If 'modeline' is off or 'modelines' is zero
 +	no lines are checked.  See |modeline|.
 +
 +			   *'modelineexpr'* *'mle'* *'nomodelineexpr'* *'nomle'*
 +'modelineexpr' 'mle'	boolean (default: off)
 +			global
 +	When on allow some options that are an expression to be set in the
 +	modeline.  Check the option for whether it is affected by
 +	'modelineexpr'.  Also see |modeline|.
 +	This option cannot be set from a |modeline| or in the |sandbox|, for
 +	security reasons.
 +
 'modelines' 'mls'	number	(default 5)
 			global
 			{not in Vi}
@@ -5306,9 +5332,9 @@ A jump table for the options with a short description can be found at |Q_op|.
 	set and to the Vim default value when 'compatible' is reset.
 				*'modifiable'* *'ma'* *'nomodifiable'* *'noma'*
 +				*E21*
 'modifiable' 'ma'	boolean	(default on)
 			local to buffer
 -			{not in Vi}		*E21*
 	When off the buffer contents cannot be changed.  The 'fileformat' and
 	'fileencoding' options also can't be changed.
 	Can be reset on startup with the |-M| command line argument.
@@ -6357,6 +6383,8 @@ A jump table for the options with a short description can be found at |Q_op|.
 	When this option is not empty, it determines the content of the ruler
 	string, as displayed for the 'ruler' option.
 	The format of this option is like that of 'statusline'.
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 +
 	The default ruler width is 17 characters.  To make the ruler 15
 	characters wide, put "%15(" at the start and "%)" at the end.
 	Example: >
@@ -6911,7 +6939,8 @@ A jump table for the options with a short description can be found at |Q_op|.
 		"Pattern not found", "Back at original", etc.
 	  q	use "recording" instead of "recording @a"
 	  F	don't give the file info when editing a file, like `:silent`
 -		was used for the command
 +		was used for the command; note that this also affects messages
 +		from autocommands
 	This gives you the opportunity to avoid that a change between buffers
 	requires you to hit <Enter>, but still gives as useful a message as
@@ -7488,6 +7517,7 @@ A jump table for the options with a short description can be found at |Q_op|.
 	The 'statusline' option will be evaluated in the |sandbox| if set from
 	a modeline, see |sandbox-option|.
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 	It is not allowed to change text or jump to another window while
 	evaluating 'statusline' |textlock|.
@@ -7672,6 +7702,8 @@ A jump table for the options with a short description can be found at |Q_op|.
 	the text to be displayed.  Use "%1T" for the first label, "%2T" for
 	the second one, etc.  Use "%X" items for closing labels.
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 +
 	Keep in mind that only one of the tab pages is the current one, others
 	are invisible and you can't jump to their windows.
@@ -8188,8 +8220,11 @@ A jump table for the options with a short description can be found at |Q_op|.
 	non-empty 't_ts' option).
 	When Vim was compiled with HAVE_X11 defined, the original title will
 	be restored if possible, see |X11|.
 +
 	When this option contains printf-style '%' items, they will be
 	expanded according to the rules used for 'statusline'.
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 +
 	Example: >
     :auto BufEnter * let &titlestring = hostname() . "/" . expand("%:p")
     :set title titlestring=%<%F%=%l/%L-%P titlelen=70
@@ -8378,6 +8413,8 @@ A jump table for the options with a short description can be found at |Q_op|.
 	undo file that exists is used.  When it cannot be read an error is
 	given, no further entry is used.
 	See |undo-persistence|.
 +	This option cannot be set from a |modeline| or in the |sandbox|, for
 +	security reasons.
 				*'undofile'* *'noundofile'* *'udf'* *'noudf'*
 'undofile' 'udf'	boolean	(default off)
@@ -8663,6 +8700,8 @@ A jump table for the options with a short description can be found at |Q_op|.
 	When equal to "NONE" no viminfo file will be read or written.
 	This option can be set with the |-i| command line flag.  The |--clean|
 	command line flag sets it to "NONE".
 +	This option cannot be set from a |modeline| or in the |sandbox|, for
 +	security reasons.
 					    *'virtualedit'* *'ve'*
 'virtualedit' 've'	string	(default "")
 diff --git a/src/Makefile b/src/Makefile
 index 85de383..1e9ab0d 100644
 --- a/src/Makefile
 +++ b/src/Makefile
@@ -2236,6 +2236,7 @@ test_arglist \
 	test_messages \
 	test_mksession \
 	test_mksession_utf8 \
 +	test_modeline \
 	test_nested_function \
 	test_netbeans \
 	test_normal \
 diff --git a/src/option.c b/src/option.c
 index 31aec7e..74ad244 100644
 --- a/src/option.c
 +++ b/src/option.c
@@ -458,6 +458,7 @@ struct vimoption
 				  * there is a redraw flag */
 #define P_NDNAME      0x8000000L /* only normal dir name chars allowed */
 #define P_RWINONLY   0x10000000L /* only redraw current window */
 +#define P_MLE	     0x20000000L /* under control of 'modelineexpr' */
 #define ISK_LATIN1  (char_u *)"@,48-57,_,192-255"
@@ -647,7 +648,7 @@ static struct vimoption options[] =
 			    {(char_u *)0L, (char_u *)0L}
 #endif
 			    SCRIPTID_INIT},
 -    {"balloonexpr", "bexpr", P_STRING|P_ALLOCED|P_VI_DEF|P_VIM,
 +    {"balloonexpr", "bexpr", P_STRING|P_ALLOCED|P_VI_DEF|P_VIM|P_MLE,
 #if defined(FEAT_BEVAL) && defined(FEAT_EVAL)
 			    (char_u *)&p_bexpr, PV_BEXPR,
 			    {(char_u *)"", (char_u *)0L}
@@ -733,7 +734,7 @@ static struct vimoption options[] =
 			    {(char_u *)0L, (char_u *)0L}
 #endif
 			    SCRIPTID_INIT},
 -    {"cdpath",	    "cd",   P_STRING|P_EXPAND|P_VI_DEF|P_COMMA|P_NODUP,
 +    {"cdpath",	    "cd",   P_STRING|P_EXPAND|P_VI_DEF|P_SECURE|P_COMMA|P_NODUP,
 #ifdef FEAT_SEARCHPATH
 			    (char_u *)&p_cdpath, PV_NONE,
 			    {(char_u *)",,", (char_u *)0L}
@@ -1209,7 +1210,7 @@ static struct vimoption options[] =
 			    {(char_u *)NULL, (char_u *)0L}
 #endif
 			    SCRIPTID_INIT},
 -    {"foldexpr",    "fde",  P_STRING|P_ALLOCED|P_VIM|P_VI_DEF|P_RWIN,
 +    {"foldexpr",    "fde",  P_STRING|P_ALLOCED|P_VIM|P_VI_DEF|P_RWIN|P_MLE,
 #if defined(FEAT_FOLDING) && defined(FEAT_EVAL)
 			    (char_u *)VAR_WIN, PV_FDE,
 			    {(char_u *)"0", (char_u *)NULL}
@@ -1292,7 +1293,7 @@ static struct vimoption options[] =
 			    {(char_u *)NULL, (char_u *)0L}
 #endif
 			    SCRIPTID_INIT},
 -    {"foldtext",    "fdt",  P_STRING|P_ALLOCED|P_VIM|P_VI_DEF|P_RWIN,
 +    {"foldtext",    "fdt",  P_STRING|P_ALLOCED|P_VIM|P_VI_DEF|P_RWIN|P_MLE,
 #if defined(FEAT_FOLDING) && defined(FEAT_EVAL)
 			    (char_u *)VAR_WIN, PV_FDT,
 			    {(char_u *)"foldtext()", (char_u *)NULL}
@@ -1301,7 +1302,7 @@ static struct vimoption options[] =
 			    {(char_u *)NULL, (char_u *)0L}
 #endif
 			    SCRIPTID_INIT},
 -    {"formatexpr", "fex",   P_STRING|P_ALLOCED|P_VI_DEF|P_VIM,
 +    {"formatexpr", "fex",   P_STRING|P_ALLOCED|P_VI_DEF|P_VIM|P_MLE,
 #ifdef FEAT_EVAL
 			    (char_u *)&p_fex, PV_FEX,
 			    {(char_u *)"", (char_u *)0L}
@@ -1440,7 +1441,7 @@ static struct vimoption options[] =
 			    (char_u *)NULL, PV_NONE,
 #endif
 			    {(char_u *)TRUE, (char_u *)0L} SCRIPTID_INIT},
 -    {"guitablabel",  "gtl", P_STRING|P_VI_DEF|P_RWIN,
 +    {"guitablabel",  "gtl", P_STRING|P_VI_DEF|P_RWIN|P_MLE,
 #if defined(FEAT_GUI_TABLINE)
 			    (char_u *)&p_gtl, PV_NONE,
 			    {(char_u *)"", (char_u *)0L}
@@ -1511,7 +1512,7 @@ static struct vimoption options[] =
 			    (char_u *)NULL, PV_NONE,
 #endif
 			    {(char_u *)FALSE, (char_u *)0L} SCRIPTID_INIT},
 -    {"iconstring",  NULL,   P_STRING|P_VI_DEF,
 +    {"iconstring",  NULL,   P_STRING|P_VI_DEF|P_MLE,
 #ifdef FEAT_TITLE
 			    (char_u *)&p_iconstring, PV_NONE,
 #else
@@ -1591,7 +1592,7 @@ static struct vimoption options[] =
 			    {(char_u *)0L, (char_u *)0L}
 #endif
 			    SCRIPTID_INIT},
 -    {"includeexpr", "inex", P_STRING|P_ALLOCED|P_VI_DEF,
 +    {"includeexpr", "inex", P_STRING|P_ALLOCED|P_VI_DEF|P_MLE,
 #if defined(FEAT_FIND_ID) && defined(FEAT_EVAL)
 			    (char_u *)&p_inex, PV_INEX,
 			    {(char_u *)"", (char_u *)0L}
@@ -1603,7 +1604,7 @@ static struct vimoption options[] =
     {"incsearch",   "is",   P_BOOL|P_VI_DEF|P_VIM,
 			    (char_u *)&p_is, PV_NONE,
 			    {(char_u *)FALSE, (char_u *)0L} SCRIPTID_INIT},
 -    {"indentexpr", "inde",  P_STRING|P_ALLOCED|P_VI_DEF|P_VIM,
 +    {"indentexpr", "inde",  P_STRING|P_ALLOCED|P_VI_DEF|P_VIM|P_MLE,
 #if defined(FEAT_CINDENT) && defined(FEAT_EVAL)
 			    (char_u *)&p_inde, PV_INDE,
 			    {(char_u *)"", (char_u *)0L}
@@ -1939,6 +1940,9 @@ static struct vimoption options[] =
     {"modeline",    "ml",   P_BOOL|P_VIM,
 			    (char_u *)&p_ml, PV_ML,
 			    {(char_u *)FALSE, (char_u *)TRUE} SCRIPTID_INIT},
 +    {"modelineexpr", "mle",  P_BOOL|P_VI_DEF|P_SECURE,
 +			    (char_u *)&p_mle, PV_NONE,
 +			    {(char_u *)FALSE, (char_u *)0L} SCRIPTID_INIT},
     {"modelines",   "mls",  P_NUM|P_VI_DEF,
 			    (char_u *)&p_mls, PV_NONE,
 			    {(char_u *)5L, (char_u *)0L} SCRIPTID_INIT},
@@ -2362,7 +2366,7 @@ static struct vimoption options[] =
 			    (char_u *)NULL, PV_NONE,
 #endif
 			    {(char_u *)FALSE, (char_u *)0L} SCRIPTID_INIT},
 -    {"rulerformat", "ruf",  P_STRING|P_VI_DEF|P_ALLOCED|P_RSTAT,
 +    {"rulerformat", "ruf",  P_STRING|P_VI_DEF|P_ALLOCED|P_RSTAT|P_MLE,
 #ifdef FEAT_STL_OPT
 			    (char_u *)&p_ruf, PV_NONE,
 #else
@@ -2628,7 +2632,7 @@ static struct vimoption options[] =
     {"startofline", "sol",  P_BOOL|P_VI_DEF|P_VIM,
 			    (char_u *)&p_sol, PV_NONE,
 			    {(char_u *)TRUE, (char_u *)0L} SCRIPTID_INIT},
 -    {"statusline"  ,"stl",  P_STRING|P_VI_DEF|P_ALLOCED|P_RSTAT,
 +    {"statusline"  ,"stl",  P_STRING|P_VI_DEF|P_ALLOCED|P_RSTAT|P_MLE,
 #ifdef FEAT_STL_OPT
 			    (char_u *)&p_stl, PV_STL,
 #else
@@ -2675,7 +2679,7 @@ static struct vimoption options[] =
 			    {(char_u *)0L, (char_u *)0L}
 #endif
 			    SCRIPTID_INIT},
 -    {"tabline",	    "tal",  P_STRING|P_VI_DEF|P_RALL,
 +    {"tabline",	    "tal",  P_STRING|P_VI_DEF|P_RALL|P_MLE,
 #ifdef FEAT_STL_OPT
 			    (char_u *)&p_tal, PV_NONE,
 #else
@@ -2870,7 +2874,7 @@ static struct vimoption options[] =
 			    {(char_u *)0L, (char_u *)0L}
 #endif
 			    SCRIPTID_INIT},
 -    {"titlestring", NULL,   P_STRING|P_VI_DEF,
 +    {"titlestring", NULL,   P_STRING|P_VI_DEF|P_MLE,
 #ifdef FEAT_TITLE
 			    (char_u *)&p_titlestring, PV_NONE,
 #else
@@ -4608,6 +4612,11 @@ do_set(
 		    errmsg = (char_u *)_("E520: Not allowed in a modeline");
 		    goto skip;
 		}
 +		if ((flags & P_MLE) && !p_mle)
 +		{
 +		    errmsg = (char_u *)_("E992: Not allowed in a modeline when 'modelineexpr' is off");
 +		    goto skip;
 +		}
 #ifdef FEAT_DIFF
 		/* In diff mode some options are overruled.  This avoids that
 		 * 'foldmethod' becomes "marker" instead of "diff" and that
 diff --git a/src/option.h b/src/option.h
 index 8f492c3..dfec21e 100644
 --- a/src/option.h
 +++ b/src/option.h
@@ -659,6 +659,7 @@ EXTERN long	p_mis;		/* 'menuitems' */
 #ifdef FEAT_SPELL
 EXTERN char_u	*p_msm;		/* 'mkspellmem' */
 #endif
 +EXTERN long	p_mle;		/* 'modelineexpr' */
 EXTERN long	p_mls;		/* 'modelines' */
 EXTERN char_u	*p_mouse;	/* 'mouse' */
 #ifdef FEAT_GUI
 diff --git a/src/testdir/test49.in b/src/testdir/test49.in
 index 79f13f6..a0c9e0d 100644
 --- a/src/testdir/test49.in
 +++ b/src/testdir/test49.in
@@ -5,7 +5,7 @@ test49.failed, try to add one or more "G"s at the line ending in "test.out"
 STARTTEST
 :so small.vim
 -:se nocp nomore viminfo+=nviminfo
 +:se nocp nomore viminfo+=nviminfo modelineexpr
 :lang mess C
 :so test49.vim
 :" Go back to this file and append the results from register r.
 diff --git a/src/testdir/test_alot.vim b/src/testdir/test_alot.vim
 index b8a5650..018a507 100644
 --- a/src/testdir/test_alot.vim
 +++ b/src/testdir/test_alot.vim
@@ -36,6 +36,7 @@ source test_mapping.vim
 source test_match.vim
 source test_menu.vim
 source test_messages.vim
 +source test_modeline.vim
 source test_partial.vim
 source test_popup.vim
 source test_put.vim
 diff --git a/src/testdir/test_modeline.vim b/src/testdir/test_modeline.vim
 new file mode 100644
 index 0000000..d2c3233
 --- /dev/null
 +++ b/src/testdir/test_modeline.vim
@@ -0,0 +1,103 @@
 +" Tests for parsing the modeline.
 +
 +func s:modeline_fails(what, text, error)
 +  if !exists('+' . a:what)
 +    return
 +  endif
 +  let fname = "Xmodeline_fails_" . a:what
 +  call writefile(['vim: set ' . a:text . ' :', 'nothing'], fname)
 +  let modeline = &modeline
 +  set modeline
 +  filetype plugin on
 +  syntax enable
 +  call assert_fails('split ' . fname, a:error)
 +  call assert_equal("", &filetype)
 +  call assert_equal("", &syntax)
 +
 +  " Some options set a mark, don't let them cause a failure.
 +  wviminfo! Xviminfo
 +  bwipe!
 +  call delete(fname)
 +  call delete('Xviminfo')
 +  let &modeline = modeline
 +  filetype plugin off
 +  syntax off
 +endfunc
 +
 +func Test_modeline_fails_always()
 +  call s:modeline_fails('backupdir', 'backupdir=Something()', 'E520:')
 +  call s:modeline_fails('cdpath', 'cdpath=Something()', 'E520:')
 +  call s:modeline_fails('charconvert', 'charconvert=Something()', 'E520:')
 +  call s:modeline_fails('completefunc', 'completefunc=Something()', 'E520:')
 +  call s:modeline_fails('cscopeprg', 'cscopeprg=Something()', 'E520:')
 +  call s:modeline_fails('diffexpr', 'diffexpr=Something()', 'E520:')
 +  call s:modeline_fails('directory', 'directory=Something()', 'E520:')
 +  call s:modeline_fails('equalprg', 'equalprg=Something()', 'E520:')
 +  call s:modeline_fails('errorfile', 'errorfile=Something()', 'E520:')
 +  call s:modeline_fails('exrc', 'exrc=Something()', 'E520:')
 +  call s:modeline_fails('formatprg', 'formatprg=Something()', 'E520:')
 +  call s:modeline_fails('fsync', 'fsync=Something()', 'E520:')
 +  call s:modeline_fails('grepprg', 'grepprg=Something()', 'E520:')
 +  call s:modeline_fails('helpfile', 'helpfile=Something()', 'E520:')
 +  call s:modeline_fails('imactivatefunc', 'imactivatefunc=Something()', 'E520:')
 +  call s:modeline_fails('imstatusfunc', 'imstatusfunc=Something()', 'E520:')
 +  call s:modeline_fails('imstyle', 'imstyle=Something()', 'E520:')
 +  call s:modeline_fails('keywordprg', 'keywordprg=Something()', 'E520:')
 +  call s:modeline_fails('langmap', 'langmap=Something()', 'E520:')
 +  call s:modeline_fails('luadll', 'luadll=Something()', 'E520:')
 +  call s:modeline_fails('makeef', 'makeef=Something()', 'E520:')
 +  call s:modeline_fails('makeprg', 'makeprg=Something()', 'E520:')
 +  call s:modeline_fails('makespellmem', 'makespellmem=Something()', 'E520:')
 +  call s:modeline_fails('modelineexpr', 'modelineexpr', 'E520:')
 +  call s:modeline_fails('mzschemedll', 'mzschemedll=Something()', 'E520:')
 +  call s:modeline_fails('mzschemegcdll', 'mzschemegcdll=Something()', 'E520:')
 +  call s:modeline_fails('omnifunc', 'omnifunc=Something()', 'E520:')
 +  call s:modeline_fails('operatorfunc', 'operatorfunc=Something()', 'E520:')
 +  call s:modeline_fails('perldll', 'perldll=Something()', 'E520:')
 +  call s:modeline_fails('printdevice', 'printdevice=Something()', 'E520:')
 +  call s:modeline_fails('patchexpr', 'patchexpr=Something()', 'E520:')
 +  call s:modeline_fails('printexpr', 'printexpr=Something()', 'E520:')
 +  call s:modeline_fails('pythondll', 'pythondll=Something()', 'E520:')
 +  call s:modeline_fails('pythonhome', 'pythonhome=Something()', 'E520:')
 +  call s:modeline_fails('pythonthreedll', 'pythonthreedll=Something()', 'E520:')
 +  call s:modeline_fails('pythonthreehome', 'pythonthreehome=Something()', 'E520:')
 +  call s:modeline_fails('pyxversion', 'pyxversion=Something()', 'E520:')
 +  call s:modeline_fails('rubydll', 'rubydll=Something()', 'E520:')
 +  call s:modeline_fails('runtimepath', 'runtimepath=Something()', 'E520:')
 +  call s:modeline_fails('secure', 'secure=Something()', 'E520:')
 +  call s:modeline_fails('shell', 'shell=Something()', 'E520:')
 +  call s:modeline_fails('shellcmdflag', 'shellcmdflag=Something()', 'E520:')
 +  call s:modeline_fails('shellpipe', 'shellpipe=Something()', 'E520:')
 +  call s:modeline_fails('shellquote', 'shellquote=Something()', 'E520:')
 +  call s:modeline_fails('shellredir', 'shellredir=Something()', 'E520:')
 +  call s:modeline_fails('shellxquote', 'shellxquote=Something()', 'E520:')
 +  call s:modeline_fails('spellfile', 'spellfile=Something()', 'E520:')
 +  call s:modeline_fails('spellsuggest', 'spellsuggest=Something()', 'E520:')
 +  call s:modeline_fails('tcldll', 'tcldll=Something()', 'E520:')
 +  call s:modeline_fails('titleold', 'titleold=Something()', 'E520:')
 +  call s:modeline_fails('viewdir', 'viewdir=Something()', 'E520:')
 +  call s:modeline_fails('viminfo', 'viminfo=Something()', 'E520:')
 +  call s:modeline_fails('viminfofile', 'viminfofile=Something()', 'E520:')
 +  call s:modeline_fails('winptydll', 'winptydll=Something()', 'E520:')
 +  call s:modeline_fails('undodir', 'undodir=Something()', 'E520:')
 +  " only check a few terminal options
 +  call s:modeline_fails('t_AB', 't_AB=Something()', 'E520:')
 +  call s:modeline_fails('t_ce', 't_ce=Something()', 'E520:')
 +  call s:modeline_fails('t_sr', 't_sr=Something()', 'E520:')
 +  call s:modeline_fails('t_8b', 't_8b=Something()', 'E520:')
 +endfunc
 +
 +func Test_modeline_fails_modelineexpr()
 +  call s:modeline_fails('balloonexpr', 'balloonexpr=Something()', 'E992:')
 +  call s:modeline_fails('foldexpr', 'foldexpr=Something()', 'E992:')
 +  call s:modeline_fails('foldtext', 'foldtext=Something()', 'E992:')
 +  call s:modeline_fails('formatexpr', 'formatexpr=Something()', 'E992:')
 +  call s:modeline_fails('guitablabel', 'guitablabel=Something()', 'E992:')
 +  call s:modeline_fails('iconstring', 'iconstring=Something()', 'E992:')
 +  call s:modeline_fails('includeexpr', 'includeexpr=Something()', 'E992:')
 +  call s:modeline_fails('indentexpr', 'indentexpr=Something()', 'E992:')
 +  call s:modeline_fails('rulerformat', 'rulerformat=Something()', 'E992:')
 +  call s:modeline_fails('statusline', 'statusline=Something()', 'E992:')
 +  call s:modeline_fails('tabline', 'tabline=Something()', 'E992:')
 +  call s:modeline_fails('titlestring', 'titlestring=Something()', 'E992:')
 +endfunc
--- a/SOURCES/0001-patch-8.1.1401-misspelled-mkspellmem.patch
+++ b/SOURCES/0001-patch-8.1.1401-misspelled-mkspellmem.patch
@ -1,26 +0,0 @@
 diff --git a/runtime/doc/options.txt b/runtime/doc/options.txt
 index f3ba03c..cb8f482 100644
 --- a/runtime/doc/options.txt
 +++ b/runtime/doc/options.txt
@@ -5304,6 +5304,8 @@ A jump table for the options with a short description can be found at |Q_op|.
 <	If you have less than 512 Mbyte |:mkspell| may fail for some
 	languages, no matter what you set 'mkspellmem' to.
 +        This option cannot be set from a |modeline| or in the |sandbox|.
 +
 				   *'modeline'* *'ml'* *'nomodeline'* *'noml'*
 'modeline' 'ml'		boolean	(Vim default: on (off for root),
 				 Vi default: off)
 diff --git a/src/testdir/test_modeline.vim b/src/testdir/test_modeline.vim
 index 3140b07..ec986f4 100644
 --- a/src/testdir/test_modeline.vim
 +++ b/src/testdir/test_modeline.vim
@@ -45,7 +45,7 @@ func Test_modeline_fails_always()
   call s:modeline_fails('luadll', 'luadll=Something()', 'E520:')
   call s:modeline_fails('makeef', 'makeef=Something()', 'E520:')
   call s:modeline_fails('makeprg', 'makeprg=Something()', 'E520:')
 -  call s:modeline_fails('makespellmem', 'makespellmem=Something()', 'E520:')
 +  call s:modeline_fails('mkspellmem', 'mkspellmem=Something()', 'E520:')
   call s:modeline_fails('modelineexpr', 'modelineexpr', 'E520:')
   call s:modeline_fails('mzschemedll', 'mzschemedll=Something()', 'E520:')
   call s:modeline_fails('mzschemegcdll', 'mzschemegcdll=Something()', 'E520:')
--- a/SOURCES/0001-patch-9.0.1477-crash-when-recovering-from-corrupted-.patch
+++ b/SOURCES/0001-patch-9.0.1477-crash-when-recovering-from-corrupted-.patch
@ -1,109 +0,0 @@
 diff -up vim80/src/globals.h.check-page-count vim80/src/globals.h
 --- vim80/src/globals.h.check-page-count	2026-03-19 17:53:51.063638067 +0100
 +++ vim80/src/globals.h	2026-03-19 17:56:16.144187736 +0100
@@ -1584,6 +1584,7 @@
 #endif
 EXTERN char_u e_dirnotf[]	INIT(= N_("E919: Directory not found in '%s': \"%s\""));
 EXTERN char_u e_au_recursive[]	INIT(= N_("E952: Autocommand caused recursive behavior"));
 +EXTERN char_u e_warning_pointer_block_corrupted[] INIT(= N_("E1364: Warning: Pointer block corrupted"));
 #ifdef FEAT_GUI_MAC
 EXTERN short disallow_gui	INIT(= FALSE);
 diff -up vim80/src/memfile.c.check-page-count vim80/src/memfile.c
 --- vim80/src/memfile.c.check-page-count	2021-03-22 10:02:42.000000000 +0100
 +++ vim80/src/memfile.c	2026-03-19 18:13:11.196323045 +0100
@@ -432,7 +432,9 @@ mf_get(memfile_T *mfp, blocknr_T nr, int
 	 * If not, allocate a new block.
 	 */
 	hp = mf_release(mfp, page_count);
 -	if (hp == NULL && (hp = mf_alloc_bhdr(mfp, page_count)) == NULL)
 +	if (hp == NULL && page_count > 0)
 +	    hp = mf_alloc_bhdr(mfp, page_count);
 +	if (hp == NULL)
 	    return NULL;
 	hp->bh_bnum = nr;
@@ -813,8 +815,10 @@ mf_release(memfile_T *mfp, int page_coun
      */
     if (hp->bh_page_count != page_count)
     {
 -	vim_free(hp->bh_data);
 -	if ((hp->bh_data = alloc(mfp->mf_page_size * page_count)) == NULL)
 +	VIM_CLEAR(hp->bh_data);
 +	if (page_count > 0)
 +	    hp->bh_data = alloc((size_t)mfp->mf_page_size * page_count);
 +	if (hp->bh_data == NULL)
 	{
 	    vim_free(hp);
 	    return NULL;
@@ -872,7 +876,7 @@ mf_release_all(void)
 }
 /*
 - * Allocate a block header and a block of memory for it
 + * Allocate a block header and a block of memory for it.
  */
     static bhdr_T *
 mf_alloc_bhdr(memfile_T *mfp, int page_count)
@@ -892,7 +896,7 @@ mf_alloc_bhdr(memfile_T *mfp, int page_c
 }
 /*
 - * Free a block header and the block of memory for it
 + * Free a block header and the block of memory for it.
  */
     static void
 mf_free_bhdr(bhdr_T *hp)
@@ -902,7 +906,7 @@ mf_free_bhdr(bhdr_T *hp)
 }
 /*
 - * insert entry *hp in the free list
 + * Insert entry *hp in the free list.
  */
     static void
 mf_ins_free(memfile_T *mfp, bhdr_T *hp)
 diff -up vim80/src/memline.c.check-page-count vim80/src/memline.c
 --- vim80/src/memline.c.check-page-count	2021-03-22 10:02:42.000000000 +0100
 +++ vim80/src/memline.c	2026-03-19 18:13:59.116720443 +0100
@@ -96,6 +96,9 @@ struct pointer_block
 				 * followed by empty space until end of page */
 };
 +// Value for pb_count_max.
 +#define PB_COUNT_MAX(mfp) (short_u)(((mfp)->mf_page_size - offsetof(PTR_BL, pb_pointer)) / sizeof(PTR_EN))
 +
 /*
  * A data block is a leaf in the tree.
  *
@@ -1505,6 +1508,20 @@ ml_recover(int checkext)
 	    pp = (PTR_BL *)(hp->bh_data);
 	    if (pp->pb_id == PTR_ID)		/* it is a pointer block */
 	    {
 +		int ptr_block_error = FALSE;
 +		if (pp->pb_count_max != PB_COUNT_MAX(mfp))
 +		{
 +		    ptr_block_error = TRUE;
 +		    pp->pb_count_max = PB_COUNT_MAX(mfp);
 +		}
 +		if (pp->pb_count > pp->pb_count_max)
 +		{
 +		    ptr_block_error = TRUE;
 +		    pp->pb_count = pp->pb_count_max;
 +		}
 +		if (ptr_block_error)
 +		    EMSG(_(e_warning_pointer_block_corrupted));
 +
 		/* check line count when using pointer block first time */
 		if (idx == 0 && line_count != 0)
 		{
@@ -4040,8 +4057,7 @@ ml_new_ptr(memfile_T *mfp)
     pp = (PTR_BL *)(hp->bh_data);
     pp->pb_id = PTR_ID;
     pp->pb_count = 0;
 -    pp->pb_count_max = (short_u)((mfp->mf_page_size - sizeof(PTR_BL))
 -							/ sizeof(PTR_EN) + 1);
 +    pp->pb_count_max = PB_COUNT_MAX(mfp);
     return hp;
 }
--- a/SOURCES/0001-patch-9.1.1551-security-path-traversal-issue-in-zip..patch
+++ b/SOURCES/0001-patch-9.1.1551-security-path-traversal-issue-in-zip..patch
@ -1,70 +0,0 @@
 diff -up vim82/runtime/autoload/zip.vim.CVE-2025-53906 vim82/runtime/autoload/zip.vim
 --- vim82/runtime/autoload/zip.vim.CVE-2025-53906	2021-03-22 10:02:41.000000000 +0100
 +++ vim82/runtime/autoload/zip.vim	2025-09-10 19:33:11.491115978 +0200
@@ -251,6 +251,7 @@ fun! zip#Write(fname)
 "  call Dfunc("zip#Write(fname<".a:fname.">) zipfile_".winnr()."<".s:zipfile_{winnr()}.">")
   let repkeep= &report
   set report=10
 +  let need_rename = 0
   " sanity checks
   if !executable(substitute(g:zip_zipcmd,'\s\+.*$','',''))
@@ -261,14 +262,6 @@ fun! zip#Write(fname)
 "   call Dret("zip#Write")
    return
   endif
 -  if !exists("*mkdir")
 -   redraw!
 -   echohl Error | echo "***error*** (zip#Write) sorry, mkdir() doesn't work on your system" | echohl None
 -"   call inputsave()|call input("Press <cr> to continue")|call inputrestore()
 -   let &report= repkeep
 -"   call Dret("zip#Write")
 -   return
 -  endif
   let curdir= getcwd()
   let tmpdir= tempname()
@@ -302,6 +295,11 @@ fun! zip#Write(fname)
    let zipfile = substitute(a:fname,'^.\{-}zipfile:\(.\{-}\)::[^\\].*$','\1','')
    let fname   = substitute(a:fname,'^.\{-}zipfile:.\{-}::\([^\\].*\)$','\1','')
   endif
 +  if fname =~ '^[.]\{1,2}/'
 +    call system(g:zip_zipcmd." -d ".s:Escape(fnamemodify(zipfile,":p"),0)." ".s:Escape(fname,0))
 +    let fname = substitute(fname, '^\([.]\{1,2}/\)\+', '', 'g')
 +    let need_rename = 1
 +  endif
 "  call Decho("zipfile<".zipfile.">")
 "  call Decho("fname  <".fname.">")
@@ -318,7 +316,7 @@ fun! zip#Write(fname)
   endif
 "  call Decho("zipfile<".zipfile."> fname<".fname.">")
 -  exe "w! ".fnameescape(fname)
 +  exe "w ".fnameescape(fname)
   if has("win32unix") && executable("cygpath")
    let zipfile = substitute(system("cygpath ".s:Escape(zipfile,0)),'\n','','e')
   endif
@@ -348,6 +346,10 @@ fun! zip#Write(fname)
    let &binary = binkeep
    q!
    unlet s:zipfile_{winnr()}
 +  elseif need_rename
 +    sil exe 'keepalt file '.fnameescape("zipfile://".zipfile.'::'.fname)
 +    redraw!
 +    echohl Error | echo "***error*** (zip#Browse) Path Traversal Attack detected, dropping relative path" | echohl None
   endif
   " cleanup and restore current directory
@@ -383,6 +385,11 @@ fun! zip#Extract()
    let &report= repkeep
 "   call Dret("zip#Extract")
    return
 +  elseif fname =~ '^[.]\?[.]/'
 +    redraw!
 +    echohl Error | echo "***error*** (zip#Browse) Path Traversal Attack detected, not extracting!" | echohl None
 +    let &report= repkeep
 +    return
   endif
   " extract the file mentioned under the cursor
--- a/SOURCES/0001-patch-9.1.1552-security-path-traversal-issue-in-tar..patch
+++ b/SOURCES/0001-patch-9.1.1552-security-path-traversal-issue-in-tar..patch
@ -1,288 +0,0 @@
 diff --git a/runtime/autoload/tar.vim b/runtime/autoload/tar.vim
 index 9c518cb..e320b9a 100644
 --- a/runtime/autoload/tar.vim
 +++ b/runtime/autoload/tar.vim
@@ -37,10 +37,10 @@ set cpo&vim
 " ---------------------------------------------------------------------
 "  Default Settings: {{{1
 if !exists("g:tar_browseoptions")
 - let g:tar_browseoptions= "Ptf"
 + let g:tar_browseoptions= "tf"
 endif
 if !exists("g:tar_readoptions")
 - let g:tar_readoptions= "OPxf"
 + let g:tar_readoptions= "Oxf"
 endif
 if !exists("g:tar_cmd")
  let g:tar_cmd= "tar"
@@ -95,6 +95,9 @@ if !exists("g:tar_shq")
 " call Decho("g:tar_shq<".g:tar_shq.">")
 endif
 +let g:tar_secure=' -- '
 +let g:tar_leading_pat='^\%([.]\{,2\}/\)\+'
 +
 " ----------------
 "  Functions: {{{1
 " ----------------
@@ -195,6 +198,15 @@ fun! tar#Browse(tarfile)
    return
   endif
 +  " remove tar: Removing leading '/' from member names
 +  " Note: the message could be localized
 +  if search('^tar: ') > 0 || search(g:tar_leading_pat) > 0
 +    call append(3,'" Note: Path Traversal Attack detected!')
 +    let b:leading_slash = 1
 +    " remove the message output
 +    sil g/^tar: /d
 +  endif
 +
   setlocal noma nomod ro
   noremap <silent> <buffer> <cr> :call <SID>TarBrowseSelect()<cr>
@@ -211,12 +223,7 @@ fun! s:TarBrowseSelect()
   let fname= getline(".")
 "  call Decho("fname<".fname.">")
 -  if !exists("g:tar_secure") && fname =~ '^\s*-\|\s\+-'
 -   redraw!
 -   echohl WarningMsg | echo '***warning*** (tar#BrowseSelect) rejecting tarfile member<'.fname.'> because of embedded "-"'
 -"   call Dret('tar#BrowseSelect : rejecting tarfile member<'.fname.'> because of embedded "-"')
 -   return
 -  endif
 +  let ls= get(b:, 'leading_slash', 0)
   " sanity check
   if fname =~ '^"'
@@ -238,7 +245,8 @@ fun! s:TarBrowseSelect()
    wincmd _
   endif
   let s:tblfile_{winnr()}= curfile
 -  call tar#Read("tarfile:".tarfile.'::'.fname,1)
 +  let b:leading_slash= ls
 +  call tar#Read("tarfile:".tarfile.'::'.fname)
   filetype detect
   set nomod
   exe 'com! -buffer -nargs=? -complete=file TarDiff	:call tar#Diff(<q-args>,"'.fnameescape(fname).'")'
@@ -249,8 +257,8 @@ endfun
 " ---------------------------------------------------------------------
 " tar#Read: {{{2
 -fun! tar#Read(fname,mode)
 -"  call Dfunc("tar#Read(fname<".a:fname.">,mode=".a:mode.")")
 +fun! tar#Read(fname)
 +"  call Dfunc("tar#Read(fname<".a:fname.">)")
   let repkeep= &report
   set report=10
   let tarfile = substitute(a:fname,'tarfile:\(.\{-}\)::.*$','\1','')
@@ -262,6 +270,8 @@ fun! tar#Read(fname,mode)
 "  call Decho("tarfile<".tarfile.">")
 "  call Decho("fname<".fname.">")
 +  let curdir= getcwd()
 +  let b:curdir= curdir
   if  fname =~ '\.bz2$' && executable("bzcat")
    let decmp= "|bzcat"
    let doro = 1
@@ -282,33 +292,31 @@ fun! tar#Read(fname,mode)
    endif
   endif
 -  if exists("g:tar_secure")
 -   let tar_secure= " -- "
 -  else
 -   let tar_secure= " "
 -  endif
   if tarfile =~# '\.bz2$'
 -"   call Decho("7: exe silent r! bzip2 -d -c ".shellescape(tarfile,1)."| ".g:tar_cmd." -".g:tar_readoptions." - ".tar_secure.shellescape(fname,1).decmp)
 -   exe "sil! r! bzip2 -d -c -- ".shellescape(tarfile,1)."| ".g:tar_cmd." -".g:tar_readoptions." - ".tar_secure.shellescape(fname,1).decmp
 +"   call Decho("7: exe silent r! bzip2 -d -c ".shellescape(tarfile,1)."| ".g:tar_cmd." -".g:tar_readoptions." - ".g:tar_secure.shellescape(fname,1).decmp)
 +   exe "sil! r! bzip2 -d -c -- ".shellescape(tarfile,1)."| ".g:tar_cmd." -".g:tar_readoptions." - ".g:tar_secure.shellescape(fname,1).decmp
   elseif tarfile =~# '\.\(gz\|tgz\)$'
 -"   call Decho("5: exe silent r! gzip -d -c -- ".shellescape(tarfile,1)."| ".g:tar_cmd.' -'.g:tar_readoptions.' - '.tar_secure.shellescape(fname,1))
 -   exe "sil! r! gzip -d -c -- ".shellescape(tarfile,1)."| ".g:tar_cmd." -".g:tar_readoptions." - ".tar_secure.shellescape(fname,1).decmp
 +"   call Decho("5: exe silent r! gzip -d -c -- ".shellescape(tarfile,1)."| ".g:tar_cmd.' -'.g:tar_readoptions.' - '.g:tar_secure.shellescape(fname,1))
 +   exe "sil! r! gzip -d -c -- ".shellescape(tarfile,1)."| ".g:tar_cmd." -".g:tar_readoptions." - ".g:tar_secure.shellescape(fname,1).decmp
   elseif tarfile =~# '\.lrp$'
 -"   call Decho("6: exe silent r! cat ".shellescape(tarfile,1)." | gzip -d -c - | ".g:tar_cmd." -".g:tar_readoptions." - ".tar_secure.shellescape(fname,1).decmp)
 -   exe "sil! r! cat -- ".shellescape(tarfile,1)." | gzip -d -c - | ".g:tar_cmd." -".g:tar_readoptions." - ".tar_secure.shellescape(fname,1).decmp
 +"   call Decho("6: exe silent r! cat ".shellescape(tarfile,1)." | gzip -d -c - | ".g:tar_cmd." -".g:tar_readoptions." - ".g:tar_secure.shellescape(fname,1).decmp)
 +   exe "sil! r! cat -- ".shellescape(tarfile,1)." | gzip -d -c - | ".g:tar_cmd." -".g:tar_readoptions." - ".g:tar_secure.shellescape(fname,1).decmp
   elseif tarfile =~# '\.lzma$'
 -"   call Decho("7: exe silent r! lzma -d -c ".shellescape(tarfile,1)."| ".g:tar_cmd." -".g:tar_readoptions." - ".tar_secure.shellescape(fname,1).decmp)
 -   exe "sil! r! lzma -d -c -- ".shellescape(tarfile,1)."| ".g:tar_cmd." -".g:tar_readoptions." - ".tar_secure.shellescape(fname,1).decmp
 +"   call Decho("7: exe silent r! lzma -d -c ".shellescape(tarfile,1)."| ".g:tar_cmd." -".g:tar_readoptions." - ".g:tar_secure.shellescape(fname,1).decmp)
 +   exe "sil! r! lzma -d -c -- ".shellescape(tarfile,1)."| ".g:tar_cmd." -".g:tar_readoptions." - ".g:tar_secure.shellescape(fname,1).decmp
   elseif tarfile =~# '\.\(xz\|txz\)$'
 -"   call Decho("3: exe silent r! xz --decompress --stdout -- ".shellescape(tarfile,1)." | ".g:tar_cmd." -".g:tar_readoptions." - ".tar_secure.shellescape(fname,1).decmp)
 -   exe "sil! r! xz --decompress --stdout -- ".shellescape(tarfile,1)." | ".g:tar_cmd." -".g:tar_readoptions." - ".tar_secure.shellescape(fname,1).decmp
 +"   call Decho("3: exe silent r! xz --decompress --stdout -- ".shellescape(tarfile,1)." | ".g:tar_cmd." -".g:tar_readoptions." - ".g:tar_secure.shellescape(fname,1).decmp)
 +   exe "sil! r! xz --decompress --stdout -- ".shellescape(tarfile,1)." | ".g:tar_cmd." -".g:tar_readoptions." - ".g:tar_secure.shellescape(fname,1).decmp
   else
    if tarfile =~ '^\s*-'
     " A file name starting with a dash is taken as an option.  Prepend ./ to avoid that.
     let tarfile = substitute(tarfile, '-', './-', '')
    endif
 -"   call Decho("8: exe silent r! ".g:tar_cmd." -".g:tar_readoptions.tar_secure.shellescape(tarfile,1)." ".shellescape(fname,1).decmp)
 -   exe "silent r! ".g:tar_cmd." -".g:tar_readoptions.shellescape(tarfile,1)." ".tar_secure.shellescape(fname,1).decmp
 +"   call Decho("8: exe silent r! ".g:tar_cmd." -".g:tar_readoptions.g:tar_secure.shellescape(tarfile,1)." ".shellescape(fname,1).decmp)
 +   exe "silent r! ".g:tar_cmd." -".g:tar_readoptions.shellescape(tarfile,1)." ".g:tar_secure.shellescape(fname,1).decmp
 +  endif
 +  if get(b:, 'leading_slash', 0)
 +    sil g/^tar: /d
   endif
   if doro
@@ -317,13 +325,14 @@ fun! tar#Read(fname,mode)
   endif
   let b:tarfile= a:fname
 -  exe "file tarfile::".fnameescape(fname)
   " cleanup
   keepj sil! 0d
   set nomod
   let &report= repkeep
 +  exe "lcd ".fnameescape(curdir)
 +  silent exe "file tarfile::".fnameescape(fname)
 "  call Dret("tar#Read : b:tarfile<".b:tarfile.">")
 endfun
@@ -334,13 +343,6 @@ fun! tar#Write(fname)
   let repkeep= &report
   set report=10
 -  if !exists("g:tar_secure") && a:fname =~ '^\s*-\|\s\+-'
 -   redraw!
 -   echohl WarningMsg | echo '***warning*** (tar#Write) rejecting tarfile member<'.a:fname.'> because of embedded "-"'
 -"   call Dret('tar#Write : rejecting tarfile member<'.fname.'> because of embedded "-"')
 -   return
 -  endif
 -
   " sanity checks
   if !executable(g:tar_cmd)
    redraw!
@@ -389,6 +391,13 @@ fun! tar#Write(fname)
   let tarfile = substitute(b:tarfile,'tarfile:\(.\{-}\)::.*$','\1','')
   let fname   = substitute(b:tarfile,'tarfile:.\{-}::\(.*\)$','\1','')
 +  if get(b:, 'leading_slash', 0)
 +   redraw!
 +   echohl Error | echo "***error*** (tar#Write) sorry, not attempting to update ".tarfile." with ".fname | echohl None
 +   let &report= repkeep
 +   return
 +  endif
 +
   " handle compressed archives
   if tarfile =~# '\.bz2'
    call system("bzip2 -d -- ".shellescape(tarfile,0))
@@ -442,27 +451,23 @@ fun! tar#Write(fname)
    endif
 "   call Decho("tarfile<".tarfile."> fname<".fname.">")
 -   if exists("g:tar_secure")
 -    let tar_secure= " -- "
 -   else
 -    let tar_secure= " "
 -   endif
 -   exe "w! ".fnameescape(fname)
 +   " don't overwrite a file forcefully
 +   exe "w ".fnameescape(fname)
    if has("win32unix") && executable("cygpath")
     let tarfile = substitute(system("cygpath ".shellescape(tarfile,0)),'\n','','e')
    endif
    " delete old file from tarfile
 "   call Decho("system(".g:tar_cmd." --delete -f ".shellescape(tarfile,0)." -- ".shellescape(fname,0).")")
 -   call system(g:tar_cmd." --delete -f ".shellescape(tarfile,0).tar_secure.shellescape(fname,0))
 +   call system(g:tar_cmd." --delete -f ".shellescape(tarfile,0).g:tar_secure.shellescape(fname,0))
    if v:shell_error != 0
     redraw!
     echohl Error | echo "***error*** (tar#Write) sorry, unable to update ".fnameescape(tarfile)." with ".fnameescape(fname) | echohl None
    else
     " update tarfile with new file 
 -"    call Decho(g:tar_cmd." -".g:tar_writeoptions." ".shellescape(tarfile,0).tar_secure.shellescape(fname,0))
 -    call system(g:tar_cmd." -".g:tar_writeoptions." ".shellescape(tarfile,0).tar_secure.shellescape(fname,0))
 +"    call Decho(g:tar_cmd." -".g:tar_writeoptions." ".shellescape(tarfile,0).g:tar_secure.shellescape(fname,0))
 +    call system(g:tar_cmd." -".g:tar_writeoptions." ".shellescape(tarfile,0).g:tar_secure.shellescape(fname,0))
     if v:shell_error != 0
      redraw!
      echohl Error | echo "***error*** (tar#Write) sorry, unable to update ".fnameescape(tarfile)." with ".fnameescape(fname) | echohl None
@@ -511,6 +516,7 @@ fun! tar#Diff(userfname,fname)
   if a:userfname != ""
    let fname= a:userfname
   endif
 +  exe "lcd ".fnameescape(b:tmpdir). '/_ZIPVIM_'
   if filereadable(fname)
    " sets current file (from tarball) for diff'ing
    " splits window vertically
 diff --git a/runtime/doc/pi_tar.txt b/runtime/doc/pi_tar.txt
 index 1b03d31..a6c72cd 100644
 --- a/runtime/doc/pi_tar.txt
 +++ b/runtime/doc/pi_tar.txt
@@ -61,7 +61,7 @@ Copyright 2005-2012:					*tar-copyright*
 	the file mentioned in the tarball.  If the current directory is not
 	correct for that path, :TarDiff will fail to find the associated file.
 -	If the [filename] is given, that that filename (and path) will be used
 +	If the [filename] is given, that filename (and path) will be used
 	to specify the associated file.
@@ -86,18 +86,6 @@ Copyright 2005-2012:					*tar-copyright*
    *g:tar_readoptions*    "OPxf"  used to extract a file from a tarball
    *g:tar_cmd*            "tar"   the name of the tar program
    *g:tar_nomax*            0     if true, file window will not be maximized
 -   *g:tar_secure*         undef   if exists:
 -					"--"s will be used to prevent unwanted
 -					option expansion in tar commands.
 -					Please be sure that your tar command
 -					accepts "--"; Posix compliant tar
 -					utilities do accept them.
 -				  if not exists:
 -				  	The tar plugin will reject any tar
 -					files or member files that begin with
 -					"-"
 -				  Not all tar's support the "--" which is why
 -				  it isn't default.
    *g:tar_writeoptions*   "uf"    used to update/replace a file
 diff --git a/runtime/doc/tags b/runtime/doc/tags
 index 5895c05..2e09b72 100644
 --- a/runtime/doc/tags
 +++ b/runtime/doc/tags
@@ -6517,7 +6517,6 @@ g:tar_copycmd	pi_tar.txt	/*g:tar_copycmd*
 g:tar_extractcmd	pi_tar.txt	/*g:tar_extractcmd*
 g:tar_nomax	pi_tar.txt	/*g:tar_nomax*
 g:tar_readoptions	pi_tar.txt	/*g:tar_readoptions*
 -g:tar_secure	pi_tar.txt	/*g:tar_secure*
 g:tar_writeoptions	pi_tar.txt	/*g:tar_writeoptions*
 g:terminal_ansi_colors	terminal.txt	/*g:terminal_ansi_colors*
 g:tex_comment_nospell	syntax.txt	/*g:tex_comment_nospell*
 diff --git a/runtime/plugin/tarPlugin.vim b/runtime/plugin/tarPlugin.vim
 index 6d9e6bd..471712f 100644
 --- a/runtime/plugin/tarPlugin.vim
 +++ b/runtime/plugin/tarPlugin.vim
@@ -22,14 +22,14 @@ set cpo&vim
 "  Public Interface: {{{1
 augroup tar
   au!
 -  au BufReadCmd   tarfile::*	call tar#Read(expand("<amatch>"), 1)
 -  au FileReadCmd  tarfile::*	call tar#Read(expand("<amatch>"), 0)
 +  au BufReadCmd   tarfile::*	call tar#Read(expand("<amatch>"))
 +  au FileReadCmd  tarfile::*	call tar#Read(expand("<amatch>"))
   au BufWriteCmd  tarfile::*	call tar#Write(expand("<amatch>"))
   au FileWriteCmd tarfile::*	call tar#Write(expand("<amatch>"))
   if has("unix")
 -   au BufReadCmd   tarfile::*/*	call tar#Read(expand("<amatch>"), 1)
 -   au FileReadCmd  tarfile::*/*	call tar#Read(expand("<amatch>"), 0)
 +   au BufReadCmd   tarfile::*/*	call tar#Read(expand("<amatch>"))
 +   au FileReadCmd  tarfile::*/*	call tar#Read(expand("<amatch>"))
    au BufWriteCmd  tarfile::*/*	call tar#Write(expand("<amatch>"))
    au FileWriteCmd tarfile::*/*	call tar#Write(expand("<amatch>"))
   endif
--- a/SOURCES/0001-patch-9.1.2132-security-buffer-overflow-in-helpfile-.patch
+++ b/SOURCES/0001-patch-9.1.2132-security-buffer-overflow-in-helpfile-.patch
@ -1,39 +0,0 @@
 diff -up vim80/src/structs.h.tag-overflow vim80/src/structs.h
 --- vim80/src/structs.h.tag-overflow	2018-04-24 17:10:42.000000000 +0200
 +++ vim80/src/structs.h	2026-02-25 15:20:08.027012072 +0100
@@ -3423,3 +3423,7 @@ typedef struct {
     int		save_opcount;
     tasave_T	tabuf;
 } save_state_T;
 +
 +// Return the length of a string literal
 +#define STRLEN_LITERAL(s) (sizeof(s) - 1)
 +
 diff -up vim80/src/tag.c.tag-overflow vim80/src/tag.c
 --- vim80/src/tag.c.tag-overflow	2018-03-05 15:55:42.000000000 +0100
 +++ vim80/src/tag.c	2026-02-25 15:21:18.623604260 +0100
@@ -2677,7 +2677,7 @@ get_tagfname(
 	    if (tnp->tn_hf_idx > tag_fnames.ga_len || *p_hf == NUL)
 		return FAIL;
 	    ++tnp->tn_hf_idx;
 -	    STRCPY(buf, p_hf);
 +	    vim_strncpy(buf, p_hf, MAXPATHL - 1);
 	    STRCPY(gettail(buf), "tags");
 	}
 	else
 diff -up vim80/src/testdir/test_help.vim.tag-overflow vim80/src/testdir/test_help.vim
 --- vim80/src/testdir/test_help.vim.tag-overflow	2017-12-11 10:20:46.000000000 +0100
 +++ vim80/src/testdir/test_help.vim	2026-02-25 15:21:53.687898395 +0100
@@ -49,3 +49,12 @@ func Test_help_local_additions()
   call delete('Xruntime', 'rf')
   let &rtp = rtp_save
 endfunc
 +
 +" This caused a buffer overflow
 +func Test_helpfile_overflow()
 +  let _helpfile = &helpfile
 +  let &helpfile = repeat('A', 5000)
 +  help
 +  helpclose
 +  let &helpfile = _helpfile
 +endfunc
--- a/SOURCES/0001-patch-9.1.2133-Another-case-of-buffer-overflow-with-.patch
+++ b/SOURCES/0001-patch-9.1.2133-Another-case-of-buffer-overflow-with-.patch
@ -1,26 +0,0 @@
 diff -up vim80/src/tag.c.tag-overflow2 vim80/src/tag.c
 --- vim80/src/tag.c.tag-overflow2	2026-02-25 15:22:41.624581958 +0100
 +++ vim80/src/tag.c	2026-02-25 15:23:23.993655916 +0100
@@ -2677,7 +2677,7 @@ get_tagfname(
 	    if (tnp->tn_hf_idx > tag_fnames.ga_len || *p_hf == NUL)
 		return FAIL;
 	    ++tnp->tn_hf_idx;
 -	    vim_strncpy(buf, p_hf, MAXPATHL - 1);
 +	    vim_strncpy(buf, p_hf, MAXPATHL - STRLEN_LITERAL("tags") - 1);
 	    STRCPY(gettail(buf), "tags");
 	}
 	else
 diff -up vim80/src/testdir/test_help.vim.tag-overflow2 vim80/src/testdir/test_help.vim
 --- vim80/src/testdir/test_help.vim.tag-overflow2	2026-02-25 15:22:41.624858588 +0100
 +++ vim80/src/testdir/test_help.vim	2026-02-25 15:24:01.774829851 +0100
@@ -56,5 +56,10 @@ func Test_helpfile_overflow()
   let &helpfile = repeat('A', 5000)
   help
   helpclose
 +  for i in range(4089, 4096)
 +    let &helpfile = repeat('A', i) . '/A'
 +    help
 +    helpclose
 +  endfor
   let &helpfile = _helpfile
 endfunc
--- a/SOURCES/0001-patch-9.2.0073-security-possible-command-injection-u.patch
+++ b/SOURCES/0001-patch-9.2.0073-security-possible-command-injection-u.patch
@ -1,56 +0,0 @@
 diff -up vim91/runtime/autoload/netrw.vim.CVE-2026-28417 vim91/runtime/autoload/netrw.vim
 --- vim91/runtime/autoload/netrw.vim.CVE-2026-28417	2026-03-17 19:22:17.101915588 +0100
 +++ vim91/runtime/autoload/netrw.vim	2026-03-17 19:32:29.134514079 +0100
@@ -3376,13 +3376,26 @@ endif
 " s:NetrwValidateHostname:  Validate that the hostname is valid {{{2
 " Input:
 -"   hostname
 +"   hostname, may include an optional username, e.g. user@hostname
 +"   allow a alphanumeric hostname or an IPv(4/6) address
 " Output:
 "  true if g:netrw_machine is valid according to RFC1123 #Section 2
 fun! s:NetrwValidateHostname(hostname)
 -    " RFC1123#section-2 mandates, a valid hostname starts with letters or digits
 -    " so reject everyhing else
 -    return a:hostname =~? '^[a-z0-9]'
 +  " Username:
 +  let user_pat = '\%([a-zA-Z0-9._-]\+@\)\?'
 +  " Hostname: 1-64 chars, alphanumeric/dots/hyphens.
 +  " No underscores. No leading/trailing dots/hyphens.
 +  let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]{,62}[a-zA-Z0-9]\)\?$'
 +
 +  " IPv4: 1-3 digits separated by dots
 +  let ipv4_pat = '\%(\d\{1,3}\.\)\{3\}\d\{1,3\}$'
 +
 +  " IPv6: Hex, colons, and optional brackets
 +  let ipv6_pat = '\[\?\%([a-fA-F0-9:]\{2,}\)\+\]\?$'
 +
 +  return a:hostname =~? '^'.user_pat.host_pat ||
 +       \ a:hostname =~? '^'.user_pat.ipv4_pat ||
 +       \ a:hostname =~? '^'.user_pat.ipv6_pat
 endfun
 " ---------------------------------------------------------------------
@@ -11880,15 +11893,15 @@ endfun
 "               a correct command for use with a system() call
 fun! s:MakeSshCmd(sshcmd)
 "  call Dfunc("s:MakeSshCmd(sshcmd<".a:sshcmd.">) user<".s:user."> machine<".s:machine.">")
 -  if s:user == ""
 -   let sshcmd = substitute(a:sshcmd,'\<HOSTNAME\>',s:machine,'')
 -  else
 -   let sshcmd = substitute(a:sshcmd,'\<HOSTNAME\>',s:user."@".s:machine,'')
 +  let machine = shellescape(s:machine, 1)
 +  if s:user != ''
 +      let machine    = shellescape(s:user, 1).'@'.machine
   endif
 +  let sshcmd = substitute(a:sshcmd,'\<HOSTNAME\>',machine,'')
   if exists("g:netrw_port") && g:netrw_port != ""
 -   let sshcmd= substitute(sshcmd,"USEPORT",g:netrw_sshport.' '.g:netrw_port,'')
 +   let sshcmd= substitute(sshcmd,"USEPORT",g:netrw_sshport.' '.shellescape(g:netrw_port,1),'')
   elseif exists("s:port") && s:port != ""
 -   let sshcmd= substitute(sshcmd,"USEPORT",g:netrw_sshport.' '.s:port,'')
 +   let sshcmd= substitute(sshcmd,"USEPORT",g:netrw_sshport.' '.shellescape(s:port,1),'')
   else
    let sshcmd= substitute(sshcmd,"USEPORT ",'','')
   endif
--- a/SOURCES/0001-patch-9.2.0077-security-Crash-when-recovering-a-corr.patch
+++ b/SOURCES/0001-patch-9.2.0077-security-Crash-when-recovering-a-corr.patch
@ -1,397 +0,0 @@
 diff -up vim80/src/memline.c.CVE-2026-28421 vim80/src/memline.c
 --- vim80/src/memline.c.CVE-2026-28421	2021-03-22 10:02:42.000000000 +0100
 +++ vim80/src/memline.c	2026-03-19 10:42:50.113672743 +0100
@@ -1536,8 +1536,12 @@ ml_recover(int checkext)
 			if (!cannot_open)
 			{
 			    line_count = pp->pb_pointer[idx].pe_line_count;
 -			    if (readfile(curbuf->b_ffname, NULL, lnum,
 -					pp->pb_pointer[idx].pe_old_lnum - 1,
 +			    linenr_T pe_old_lnum = pp->pb_pointer[idx].pe_old_lnum;
 +			    // Validate pe_line_count and pe_old_lnum from the
 +			    // untrusted swap file before passing to readfile().
 +			    if (line_count <= 0 || pe_old_lnum < 1 ||
 +				    readfile(curbuf->b_ffname, NULL, lnum,
 +					pe_old_lnum - 1,
 					line_count, NULL, 0) != OK)
 				cannot_open = TRUE;
 			    else
@@ -1568,6 +1572,27 @@ ml_recover(int checkext)
 		    bnum = pp->pb_pointer[idx].pe_bnum;
 		    line_count = pp->pb_pointer[idx].pe_line_count;
 		    page_count = pp->pb_pointer[idx].pe_page_count;
 +		    // Validate pe_bnum and pe_page_count from the untrusted
 +		    // swap file before passing to mf_get(), which uses
 +		    // page_count to calculate allocation size.  A bogus value
 +		    // (e.g. 0x40000000) would cause a multi-GB allocation.
 +		    // pe_page_count must be >= 1 and bnum + page_count must
 +		    // not exceed the number of pages in the swap file.
 +		    if (page_count < 1
 +			    || bnum + page_count > mfp->mf_blocknr_max + 1)
 +		    {
 +			++error;
 +			ml_append(lnum++,
 +				(char_u *)_("???ILLEGAL BLOCK NUMBER"),
 +				(colnr_T)0, TRUE);
 +			// Skip this entry and pop back up the stack to keep
 +			// recovering whatever else we can.
 +			idx = ip->ip_index + 1;
 +			bnum = ip->ip_bnum;
 +			page_count = 1;
 +			--buf->b_ml.ml_stack_top;
 +			continue;
 +		    }
 		    idx = 0;
 		    continue;
 		}
 --- vim80/src/po/af.po.CVE-2026-28421	2026-04-01 09:23:53.971493324 -0400
 +++ vim80/src/po/af.po	2026-04-01 09:23:53.971493324 -0400
@@ -5391,3 +5391,6 @@ msgstr "E463: Omgewing is onder bewaking
 #~ msgid "WARNING: tag command changed a buffer!!!"
 #~ msgstr "WAARSKUWING: etiketbevel het buffer verander!!!"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/ca.po.CVE-2026-28421	2026-04-01 09:23:53.976493324 -0400
 +++ vim80/src/po/ca.po	2026-04-01 09:23:53.976493324 -0400
@@ -6937,3 +6937,6 @@ msgid ""
 msgstr ""
 "Error en establir el path: sys.path no és una llista\n"
 "Hauríeu d'afegir vim.VIM_SPECIAL_PATH a sys.path"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/cs.cp1250.po.CVE-2026-28421	2026-04-01 09:23:53.981493324 -0400
 +++ vim80/src/po/cs.cp1250.po	2026-04-01 09:23:53.981493324 -0400
@@ -4658,3 +4658,6 @@ msgstr "Nulový poèet"
 msgid "E81: Using <SID> not in a script context"
 msgstr "E81: Použití <SID> mimo kontext skriptu"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/cs.po.CVE-2026-28421	2026-04-01 09:23:53.986493324 -0400
 +++ vim80/src/po/cs.po	2026-04-01 09:23:53.987493324 -0400
@@ -4658,3 +4658,6 @@ msgstr "Nulový poèet"
 msgid "E81: Using <SID> not in a script context"
 msgstr "E81: Pou¾ití <SID> mimo kontext skriptu"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/de.po.CVE-2026-28421	2026-04-01 09:23:53.992493324 -0400
 +++ vim80/src/po/de.po	2026-04-01 09:23:53.992493324 -0400
@@ -7101,3 +7101,6 @@ msgid ""
 msgstr ""
 "Fehler beim setzen des Pfades: sys.path ist keine Liste\n"
 "Fügen Sie vim.VIM_SPECIAL_PATH zu sys.path hinzu"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/en_GB.po.CVE-2026-28421	2026-04-01 09:23:53.998493324 -0400
 +++ vim80/src/po/en_GB.po	2026-04-01 09:23:53.999493324 -0400
@@ -765,3 +765,6 @@ msgid "can't delete OutputObject attribu
 msgstr "cannot delete OutputObject attributes"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/eo.po.CVE-2026-28421	2026-04-01 09:23:54.005493324 -0400
 +++ vim80/src/po/eo.po	2026-04-01 09:23:54.005493324 -0400
@@ -7024,3 +7024,6 @@ msgid ""
 msgstr ""
 "Agordo de serÄ‰vojo malsukcesis: sys.path ne estas listo\n"
 "Vi nun devas aldoni vim.VIM_SPECIAL_PATH al sys.path"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/es.po.CVE-2026-28421	2026-04-01 09:23:54.010493324 -0400
 +++ vim80/src/po/es.po	2026-04-01 09:23:54.011493324 -0400
@@ -8275,3 +8275,6 @@ msgstr "La bÃºsqueda ha llegado al FINAL
 #~ msgid "-V[N]\t\tVerbose level"
 #~ msgstr "-V[N]\t\tNivel de verbosidad (traza de ejecuciÃ³n)"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/fi.po.CVE-2026-28421	2026-04-01 09:23:54.016493324 -0400
 +++ vim80/src/po/fi.po	2026-04-01 09:23:54.016493324 -0400
@@ -6991,3 +6991,6 @@ msgid ""
 msgstr ""
 "Ei onnistuttu asettaman polkua: sys.path ei ole list\n"
 "LisÃ¤Ã¤ vim.VIM_SPECIAL_PATH muuttujaan sys.path"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/fr.po.CVE-2026-28421	2026-04-01 09:23:54.021493324 -0400
 +++ vim80/src/po/fr.po	2026-04-01 09:23:54.021493324 -0400
@@ -7306,3 +7306,6 @@ msgid ""
 msgstr ""
 "Impossible d'initialiser le chemin : sys.math n'est pas une liste\n"
 "Vous devez maintenant ajouter vim.VIM_SPECIAL_PATH à sys.path"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/ga.po.CVE-2026-28421	2026-04-01 09:23:54.026493324 -0400
 +++ vim80/src/po/ga.po	2026-04-01 09:23:54.026493324 -0400
@@ -7509,3 +7509,6 @@ msgstr ""
 #~ msgid "E363: pattern caused out-of-stack error"
 #~ msgstr "E363: ghin an patrún earráid as-an-chruach"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/it.po.CVE-2026-28421	2026-04-01 09:23:54.031493324 -0400
 +++ vim80/src/po/it.po	2026-04-01 09:23:54.031493324 -0400
@@ -7015,3 +7015,6 @@ msgstr ""
 "Dovresti aggiungere vim.VIM_SPECIAL_PATH a sys.path"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/ja.euc-jp.po.CVE-2026-28421	2026-04-01 09:23:54.036493324 -0400
 +++ vim80/src/po/ja.euc-jp.po	2026-04-01 09:23:54.036493324 -0400
@@ -7031,3 +7031,6 @@ msgid ""
 msgstr ""
 "¥Ñ¥¹¤ÎÀßÄê¤Ë¼ºÇÔ¤·¤Þ¤·¤¿: sys.path ¤¬¥ê¥¹¥È¤Ç¤Ï¤¢¤ê¤Þ¤»¤ó\n"
 "¤¹¤°¤Ë vim.VIM_SPECIAL_PATH ¤ò sys.path ¤ËÄÉ²Ã¤·¤Æ¤¯¤À¤µ¤¤"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/ja.po.CVE-2026-28421	2026-04-01 09:23:54.041493324 -0400
 +++ vim80/src/po/ja.po	2026-04-01 09:23:54.041493324 -0400
@@ -7031,3 +7031,6 @@ msgid ""
 msgstr ""
 "ãƒ‘ã‚¹ã<C2B9>®è¨å®šã<C5A1>«å¤±æ•—ã<E28094>—ã<E28094>¾ã<C2BE>—ã<E28094>Ÿ: sys.path ã<>Œãƒªã‚¹ãƒˆã<CB86>§ã<C2A7>¯ã<C2AF>‚ã‚Šã<C5A0>¾ã<C2BE>›ã‚“\n"
 "ã<>™ã<E284A2><C3A3>ã<EFBFBD>« vim.VIM_SPECIAL_PATH ã‚’ sys.path ã<>«è¿½åŠ ã<C2A0>—ã<E28094>¦ã<C2A6><C3A3>ã<EFBFBD> ã<C2A0>•ã<E280A2>„"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/ja.sjis.po.CVE-2026-28421	2026-04-01 09:23:54.046493324 -0400
 +++ vim80/src/po/ja.sjis.po	2026-04-01 09:23:54.046493324 -0400
@@ -7031,3 +7031,6 @@ msgid ""
 msgstr ""
 "ƒpƒX‚Ì<E2809A>Ý’è‚ÉŽ¸”s‚µ‚Ü‚µ‚½: sys.path ‚ªƒŠƒXƒg‚Å‚Í‚ ‚è‚Ü‚¹‚ñ\n"
 "‚·‚®‚É vim.VIM_SPECIAL_PATH ‚ð sys.path ‚É’Ç‰Á‚µ‚Ä‚‚¾‚³‚¢"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/ko.po.CVE-2026-28421	2026-04-01 09:23:54.051493324 -0400
 +++ vim80/src/po/ko.po	2026-04-01 09:23:54.051493324 -0400
@@ -6951,3 +6951,6 @@ msgstr "%sÀ»(¸¦) vim list·Î º¯°æÇÒ ¼ö ¾ø
 #~ "Failed to set path: sys.path is not a list\n"
 #~ "You should now append vim.VIM_SPECIAL_PATH to sys.path"
 #~ msgstr ""
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/ko.UTF-8.po.CVE-2026-28421	2026-04-01 09:23:54.056493324 -0400
 +++ vim80/src/po/ko.UTF-8.po	2026-04-01 09:23:54.056493324 -0400
@@ -6951,3 +6951,6 @@ msgstr "%sì<73>„(ë¥¼) vim listë¡œ ë³€ê²½í• 
 #~ "Failed to set path: sys.path is not a list\n"
 #~ "You should now append vim.VIM_SPECIAL_PATH to sys.path"
 #~ msgstr ""
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/lv.po.CVE-2026-28421	2026-04-01 09:23:54.061493324 -0400
 +++ vim80/src/po/lv.po	2026-04-01 09:23:54.061493324 -0400
@@ -280,3 +280,6 @@ msgstr "E442: Nevar sadalÄ«t kreiso augÅ
 #, c-format
 msgid "E447: Can't find file \"%s\" in path"
 msgstr "E447: Failu \"%s\" ceÄ¼Ä<C2BC> nevar atrast"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/nb.po.CVE-2026-28421	2026-04-01 09:23:54.066493324 -0400
 +++ vim80/src/po/nb.po	2026-04-01 09:23:54.066493324 -0400
@@ -6164,3 +6164,6 @@ msgstr "Søket traff TOPPEN, fortsetter f
 msgid "search hit BOTTOM, continuing at TOP"
 msgstr "Søket traff BUNNEN, fortsetter fra TOPPEN"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/nl.po.CVE-2026-28421	2026-04-01 09:23:54.071493324 -0400
 +++ vim80/src/po/nl.po	2026-04-01 09:23:54.071493324 -0400
@@ -5850,3 +5850,6 @@ msgstr "zoeken bereikte TOP, verder vana
 msgid "search hit BOTTOM, continuing at TOP"
 msgstr "zoeken bereikte BODEM, verder vanaf TOP"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/no.po.CVE-2026-28421	2026-04-01 09:23:54.076493324 -0400
 +++ vim80/src/po/no.po	2026-04-01 09:23:54.076493324 -0400
@@ -6164,3 +6164,6 @@ msgstr "Søket traff TOPPEN, fortsetter f
 msgid "search hit BOTTOM, continuing at TOP"
 msgstr "Søket traff BUNNEN, fortsetter fra TOPPEN"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/pl.cp1250.po.CVE-2026-28421	2026-04-01 09:23:54.081493324 -0400
 +++ vim80/src/po/pl.cp1250.po	2026-04-01 09:23:54.081493324 -0400
@@ -6903,3 +6903,6 @@ msgstr ""
 #~ msgid "E569: maximum number of cscope connections reached"
 #~ msgstr "E569: wyczerpano maksymaln¹ liczbê po³¹czeñ cscope"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/pl.po.CVE-2026-28421	2026-04-01 09:23:54.086493324 -0400
 +++ vim80/src/po/pl.po	2026-04-01 09:23:54.086493324 -0400
@@ -6903,3 +6903,6 @@ msgstr ""
 #~ msgid "E569: maximum number of cscope connections reached"
 #~ msgstr "E569: wyczerpano maksymaln± liczbê po³±czeñ cscope"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/pl.UTF-8.po.CVE-2026-28421	2026-04-01 09:23:54.091493324 -0400
 +++ vim80/src/po/pl.UTF-8.po	2026-04-01 09:23:54.091493324 -0400
@@ -6903,3 +6903,6 @@ msgstr ""
 #~ msgid "E569: maximum number of cscope connections reached"
 #~ msgstr "E569: wyczerpano maksymalnÄ… liczbÄ™ poÅ‚Ä…czeÅ„ cscope"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/pt_BR.po.CVE-2026-28421	2026-04-01 09:23:54.096493324 -0400
 +++ vim80/src/po/pt_BR.po	2026-04-01 09:23:54.096493324 -0400
@@ -7013,3 +7013,6 @@ msgid ""
 msgstr ""
 "Falha ao definir path: sys.path nÃ£o Ã© uma lista\n"
 "VocÃª deve adicionar vim.VIM_SPECIAL_PATH ao sys.path"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/ru.cp1251.po.CVE-2026-28421	2026-04-01 09:23:54.101493324 -0400
 +++ vim80/src/po/ru.cp1251.po	2026-04-01 09:23:54.101493324 -0400
@@ -6932,3 +6932,6 @@ msgstr ""
 "Îøèáêà ïðè óñòàíîâêå ïóòè: sys.path íå ÿâëÿåòñÿ ñïèñêîì\n"
 "Ñëåäóåò äîáàâèòü vim.VIM_SPECIAL_PATH â sys.path"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/ru.po.CVE-2026-28421	2026-04-01 09:23:54.106493324 -0400
 +++ vim80/src/po/ru.po	2026-04-01 09:23:54.106493324 -0400
@@ -6932,3 +6932,6 @@ msgstr ""
 "ÐžÑˆÐ¸Ð±ÐºÐ° Ð¿Ñ€Ð¸ ÑƒÑ<C692>Ñ‚Ð°Ð½Ð¾Ð²ÐºÐµ Ð¿ÑƒÑ‚Ð¸: sys.path Ð½Ðµ Ñ<>Ð²Ð»Ñ<C2BB>ÐµÑ‚Ñ<E2809A>Ñ<EFBFBD> Ñ<>Ð¿Ð¸Ñ<C2B8>ÐºÐ¾Ð¼\n"
 "Ð¡Ð»ÐµÐ´ÑƒÐµÑ‚ Ð´Ð¾Ð±Ð°Ð²Ð¸Ñ‚ÑŒ vim.VIM_SPECIAL_PATH Ð² sys.path"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/sk.cp1250.po.CVE-2026-28421	2026-04-01 09:23:54.111493324 -0400
 +++ vim80/src/po/sk.cp1250.po	2026-04-01 09:23:54.111493324 -0400
@@ -5820,3 +5820,6 @@ msgstr "h¾adanie dosiahlo zaèiatok, pokr
 msgid "search hit BOTTOM, continuing at TOP"
 msgstr "h¾adanie dosiahlo koniec, pokraèovanie od zaèiatku"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/sk.po.CVE-2026-28421	2026-04-01 09:23:54.116493324 -0400
 +++ vim80/src/po/sk.po	2026-04-01 09:23:54.116493324 -0400
@@ -5820,3 +5820,6 @@ msgstr "hµadanie dosiahlo zaèiatok, pokr
 msgid "search hit BOTTOM, continuing at TOP"
 msgstr "hµadanie dosiahlo koniec, pokraèovanie od zaèiatku"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/sr.po.CVE-2026-28421	2026-04-01 09:23:54.121493324 -0400
 +++ vim80/src/po/sr.po	2026-04-01 09:23:54.122493324 -0400
@@ -6916,3 +6916,6 @@ msgid ""
 msgstr ""
 "ÐŸÑƒÑ‚Ð°ÑšÐ° Ð½Ð¸Ñ˜Ðµ Ð¼Ð¾Ð³Ð»Ð° Ð´Ð° Ñ<>Ðµ Ð¿Ð¾Ñ<C2BE>Ñ‚Ð°Ð²Ð¸: sys.path Ð½Ð¸Ñ˜Ðµ Ñƒ Ð»Ð¸Ñ<C2B8>Ñ‚Ð¸\n"
 "Ð¡Ð°Ð´Ð° Ð±Ð¸ Ñ‚Ñ€ÐµÐ±Ð°Ð»Ð¾ Ð´Ð° Ð´Ð¾Ð´Ð°Ñ‚Ðµ vim.VIM_SPECIAL_PATH Ð½Ð° ÐºÑ€Ð°Ñ˜ sys.path"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/sv.po.CVE-2026-28421	2026-04-01 09:23:54.127493324 -0400
 +++ vim80/src/po/sv.po	2026-04-01 09:23:54.127493324 -0400
@@ -6146,3 +6146,6 @@ msgstr "sökning nådde TOPPEN, fortsätter
 msgid "search hit BOTTOM, continuing at TOP"
 msgstr "sökning nådde BOTTEN, forsätter vid TOPPEN"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/uk.cp1251.po.CVE-2026-28421	2026-04-01 09:23:54.132493324 -0400
 +++ vim80/src/po/uk.cp1251.po	2026-04-01 09:23:54.132493324 -0400
@@ -7272,3 +7272,6 @@ msgid ""
 msgstr ""
 "Íå âäàëîñÿ âñòàíîâèòè øëÿõ: sys.path íå ñïèñîê\n"
 "Âàñ ñë³ä äîäàòè vim.VIM_SPECIAL_PATH äî sys.path"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/uk.po.CVE-2026-28421	2026-04-01 09:23:54.137493324 -0400
 +++ vim80/src/po/uk.po	2026-04-01 09:23:54.137493324 -0400
@@ -7272,3 +7272,6 @@ msgid ""
 msgstr ""
 "Ð<>Ðµ Ð²Ð´Ð°Ð»Ð¾Ñ<C2BE>Ñ<EFBFBD> Ð²Ñ<C2B2>Ñ‚Ð°Ð½Ð¾Ð²Ð¸Ñ‚Ð¸ ÑˆÐ»Ñ<C2BB>Ñ…: sys.path Ð½Ðµ Ñ<>Ð¿Ð¸Ñ<C2B8>Ð¾Ðº\n"
 "Ð’Ð°Ñ<C2B0> Ñ<>Ð»Ñ–Ð´ Ð´Ð¾Ð´Ð°Ñ‚Ð¸ vim.VIM_SPECIAL_PATH Ð´Ð¾ sys.path"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/vi.po.CVE-2026-28421	2026-04-01 09:23:54.142493324 -0400
 +++ vim80/src/po/vi.po	2026-04-01 09:23:54.142493324 -0400
@@ -5194,3 +5194,6 @@ msgstr "E449: Nháºn Ä‘Æ°á»£c má»™t biá»
 msgid "E463: Region is guarded, cannot modify"
 msgstr "E463: KhÃ´ng thá»ƒ thay Ä‘á»•i vÃ¹ng Ä‘Ã£ Ä‘Æ°á»£c báº£o vá»‡"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/zh_CN.cp936.po.CVE-2026-28421	2026-04-01 09:23:54.147493324 -0400
 +++ vim80/src/po/zh_CN.cp936.po	2026-04-01 09:23:54.147493324 -0400
@@ -6138,3 +6138,6 @@ msgstr "ÒÑ²éÕÒµ½ÎÄ¼þ½áÎ²£¬ÔÙ´Ó¿ªÍ·¼ÌÐø²é
 #~ msgid "with BeOS GUI."
 #~ msgstr "Ê¹ÓÃ BeOS Í¼ÐÎ½çÃæ¡£"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/zh_CN.po.CVE-2026-28421	2026-04-01 09:23:54.152493324 -0400
 +++ vim80/src/po/zh_CN.po	2026-04-01 09:23:54.152493324 -0400
@@ -6138,3 +6138,6 @@ msgstr "ÒÑ²éÕÒµ½ÎÄ¼þ½áÎ²£¬ÔÙ´Ó¿ªÍ·¼ÌÐø²é
 #~ msgid "with BeOS GUI."
 #~ msgstr "Ê¹ÓÃ BeOS Í¼ÐÎ½çÃæ¡£"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/zh_CN.UTF-8.po.CVE-2026-28421	2026-04-01 09:23:54.157493324 -0400
 +++ vim80/src/po/zh_CN.UTF-8.po	2026-04-01 09:23:54.157493324 -0400
@@ -6138,3 +6138,6 @@ msgstr "å·²æŸ¥æ‰¾åˆ°æ–‡ä»¶ç»“å°¾ï¼Œå†<C3A5>ä»
 #~ msgid "with BeOS GUI."
 #~ msgstr "ä½¿ç”¨ BeOS å›¾å½¢ç•Œé<C592>¢ã€‚"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/zh_TW.po.CVE-2026-28421	2026-04-01 09:23:54.163493324 -0400
 +++ vim80/src/po/zh_TW.po	2026-04-01 09:23:54.164493324 -0400
@@ -5273,3 +5273,6 @@ msgstr "E463: °Ï°ì³Q«OÅ@¡AµLªk×§ï"
 #~ msgid "E277: Unrecognized sniff request [%s]"
 #~ msgstr "E277: µLªk¿ëÃÑ sniff ©R¥O [%s]"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
 --- vim80/src/po/zh_TW.UTF-8.po.CVE-2026-28421	2026-04-01 09:23:54.170493324 -0400
 +++ vim80/src/po/zh_TW.UTF-8.po	2026-04-01 09:23:54.171493324 -0400
@@ -5280,3 +5280,6 @@ msgstr "E463: å<>€åŸŸè¢«ä¿<C3A4>è·ï¼Œç„¡æ³•ä¿
 #~ msgid "E277: Unrecognized sniff request [%s]"
 #~ msgstr "E277: ç„¡æ³•è¾¨è˜ sniff å‘½ä»¤ [%s]"
 +
 +msgid "???ILLEGAL BLOCK NUMBER"
 +msgstr ""
--- a/SOURCES/0001-patch-9.2.0089-netrw-does-not-take-port-into-account.patch
+++ b/SOURCES/0001-patch-9.2.0089-netrw-does-not-take-port-into-account.patch
@ -1,39 +0,0 @@
 diff -up vim91/runtime/autoload/netrw.vim.validateportnum vim91/runtime/autoload/netrw.vim
 --- vim91/runtime/autoload/netrw.vim.validateportnum	2026-03-17 19:35:34.062575124 +0100
 +++ vim91/runtime/autoload/netrw.vim	2026-03-17 19:39:39.005999509 +0100
@@ -3376,7 +3376,8 @@ endif
 " s:NetrwValidateHostname:  Validate that the hostname is valid {{{2
 " Input:
 -"   hostname, may include an optional username, e.g. user@hostname
 +"   hostname, may include an optional username and port number, e.g.
 +"       user@hostname:port
 "   allow a alphanumeric hostname or an IPv(4/6) address
 " Output:
 "  true if g:netrw_machine is valid according to RFC1123 #Section 2
@@ -3385,17 +3386,19 @@ fun! s:NetrwValidateHostname(hostname)
   let user_pat = '\%([a-zA-Z0-9._-]\+@\)\?'
   " Hostname: 1-64 chars, alphanumeric/dots/hyphens.
   " No underscores. No leading/trailing dots/hyphens.
 -  let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]{,62}[a-zA-Z0-9]\)\?$'
 +  let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]\{0,62}[a-zA-Z0-9]\)\?'
 +  " Port: 16 bit unsigned integer
 +  let port_pat = '\%(:\d\{1,5\}\)\?$'
   " IPv4: 1-3 digits separated by dots
 -  let ipv4_pat = '\%(\d\{1,3}\.\)\{3\}\d\{1,3\}$'
 +  let ipv4_pat = '\%(\d\{1,3}\.\)\{3\}\d\{1,3\}'
   " IPv6: Hex, colons, and optional brackets
 -  let ipv6_pat = '\[\?\%([a-fA-F0-9:]\{2,}\)\+\]\?$'
 +  let ipv6_pat = '\[\?\%([a-fA-F0-9:]\{2,}\)\+\]\?'
 -  return a:hostname =~? '^'.user_pat.host_pat ||
 -       \ a:hostname =~? '^'.user_pat.ipv4_pat ||
 -       \ a:hostname =~? '^'.user_pat.ipv6_pat
 +  return a:hostname =~? '^'.user_pat.host_pat.port_pat ||
 +       \ a:hostname =~? '^'.user_pat.ipv4_pat.port_pat ||
 +       \ a:hostname =~? '^'.user_pat.ipv6_pat.port_pat
 endfun
 " ---------------------------------------------------------------------
--- a/SOURCES/0001-patch-9.2.0202-security-command-injection-via-newlin.patch
+++ b/SOURCES/0001-patch-9.2.0202-security-command-injection-via-newlin.patch
@ -1,40 +0,0 @@
 From 645ed6597d1ea896c712cd7ddbb6edee79577e9a Mon Sep 17 00:00:00 2001
 From: pyllyukko <pyllyukko@maimed.org>
 Date: Thu, 19 Mar 2026 19:58:05 +0000
 Subject: [PATCH] patch 9.2.0202: [security]: command injection via newline in
 glob()
 Problem:  The glob() function on Unix-like systems does not escape
          newline characters when expanding wildcards. A maliciously
          crafted string containing '\n' can be used as a command
          separator to execute arbitrary shell commands via
          mch_expand_wildcards(). This depends on the user's 'shell'
          setting.
 Solution: Add the newline character ('\n') to the SHELL_SPECIAL
          definition to ensure it is properly escaped before being
          passed to the shell (pyllyukko).
 closes: #19746
 Github Advisory:
 https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c
 Signed-off-by: pyllyukko <pyllyukko@maimed.org>
 Signed-off-by: Christian Brabandt <cb@256bit.org>
 ---
 src/os_unix.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/os_unix.c b/src/os_unix.c
 index 03f7649090c96..91bfd63d0dcb2 100644
 --- a/src/os_unix.c
 +++ b/src/os_unix.c
@@ -6772,7 +6772,7 @@ mch_expand_wildcards(
 # define SEEK_END 2
 #endif
 -#define SHELL_SPECIAL (char_u *)"\t \"&'$;<>()\\|"
 +#define SHELL_SPECIAL (char_u *)"\t \"&'$;<>()\\|\n"
     int
 mch_expand_wildcards(
--- a/SOURCES/0001-patch-9.2.0276-security-modeline-security-bypass.patch
+++ b/SOURCES/0001-patch-9.2.0276-security-modeline-security-bypass.patch
@ -1,52 +0,0 @@
 From 75661a66a1db1e1f3f1245c615f13a7de44c0587 Mon Sep 17 00:00:00 2001
 From: Christian Brabandt <cb@256bit.org>
 Date: Tue, 31 Mar 2026 18:29:00 +0000
 Subject: [PATCH] patch 9.2.0276: [security]: modeline security bypass
 Problem:  [security]: modeline security bypass
 Solution: set the P_MLE flag for the 'complete', 'guitabtooltip' and
          'printheader' options.
 Github Advisory:
 https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9
 Signed-off-by: Christian Brabandt <cb@256bit.org>
 Backported for vim 8.0.1763 - only option changes (mapset doesn't exist)
 ---
 src/option.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/src/option.c b/src/option.c
 index abc..def 100644
 --- a/src/option.c
 +++ b/src/option.c
@@ -852,7 +852,7 @@ static struct vimoption options[] =
     {"compatible",  "cp",   P_BOOL|P_RALL,
 			    (char_u *)&p_cp, PV_NONE,
 			    {(char_u *)TRUE, (char_u *)FALSE} SCRIPTID_INIT},
 -    {"complete",    "cpt",  P_STRING|P_ALLOCED|P_VI_DEF|P_ONECOMMA|P_NODUP,
 +    {"complete",    "cpt",  P_STRING|P_ALLOCED|P_VI_DEF|P_ONECOMMA|P_NODUP|P_MLE,
 #ifdef FEAT_INS_EXPAND
 			    (char_u *)&p_cpt, PV_CPT,
 			    {(char_u *)".,w,b,u,t,i", (char_u *)0L}
@@ -1449,7 +1449,7 @@ static struct vimoption options[] =
 			    {(char_u *)NULL, (char_u *)0L}
 #endif
 			    SCRIPTID_INIT},
 -    {"guitabtooltip",  "gtt", P_STRING|P_VI_DEF|P_RWIN,
 +    {"guitabtooltip",  "gtt", P_STRING|P_VI_DEF|P_RWIN|P_MLE,
 #if defined(FEAT_GUI_TABLINE)
 			    (char_u *)&p_gtt, PV_NONE,
 			    {(char_u *)"", (char_u *)0L}
@@ -2180,7 +2180,7 @@ static struct vimoption options[] =
 			    {(char_u *)NULL, (char_u *)0L}
 #endif
 			    SCRIPTID_INIT},
 -    {"printheader", "pheader",  P_STRING|P_VI_DEF|P_GETTEXT,
 +    {"printheader", "pheader",  P_STRING|P_VI_DEF|P_GETTEXT|P_MLE,
 #ifdef FEAT_PRINTER
 			    (char_u *)&p_header, PV_NONE,
 			    /* untranslated to avoid problems when 'encoding'
 --
 2.53.0
--- a/SOURCES/0001-patch-9.2.0277-tests-test_modeline.vim-fails.patch
+++ b/SOURCES/0001-patch-9.2.0277-tests-test_modeline.vim-fails.patch
@ -1,49 +0,0 @@
 diff -up vim80/runtime/doc/options.txt.modeline-tests vim80/runtime/doc/options.txt
 --- vim80/runtime/doc/options.txt.modeline-tests	2018-04-24 17:10:42.000000000 +0200
 +++ vim80/runtime/doc/options.txt	2026-04-13 17:23:09.505443053 +0200
@@ -1912,6 +1912,8 @@ A jump table for the options with a shor
 	based expansion (e.g., dictionary |i_CTRL-X_CTRL-K|, included patterns
 	|i_CTRL-X_CTRL-I|, tags |i_CTRL-X_CTRL-]| and normal expansions).
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 +
 						*'completefunc'* *'cfu'*
 'completefunc' 'cfu'	string	(default: empty)
 			local to buffer
@@ -4002,6 +4004,7 @@ A jump table for the options with a shor
 	You can include a line break.  Simplest method is to use |:let|: >
 		:let &guitabtooltip = "line one\nline two"
 <
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 						*'helpfile'* *'hf'*
 'helpfile' 'hf'		string	(default (MSDOS)  "$VIMRUNTIME\doc\help.txt"
@@ -5925,6 +5928,8 @@ A jump table for the options with a shor
 	The format of the header produced in |:hardcopy| output.
 	See |pheader-option|.
 +	This option cannot be set in a modeline when 'modelineexpr' is off.
 +
 						*'printmbcharset'* *'pmbcs'*
 'printmbcharset' 'pmbcs'  string (default "")
 			global
 diff -up vim80/src/testdir/test_modeline.vim.modeline-tests vim80/src/testdir/test_modeline.vim
 --- vim80/src/testdir/test_modeline.vim.modeline-tests	2026-04-13 17:24:08.663314798 +0200
 +++ vim80/src/testdir/test_modeline.vim	2026-04-13 17:25:03.653205200 +0200
@@ -87,13 +87,16 @@ endfunc
 func Test_modeline_fails_modelineexpr()
   call s:modeline_fails('balloonexpr', 'balloonexpr=Something()', 'E992:')
 +  call s:modeline_fails('complete', "complete=FSomething", 'E992:')
   call s:modeline_fails('foldexpr', 'foldexpr=Something()', 'E992:')
   call s:modeline_fails('foldtext', 'foldtext=Something()', 'E992:')
   call s:modeline_fails('formatexpr', 'formatexpr=Something()', 'E992:')
   call s:modeline_fails('guitablabel', 'guitablabel=Something()', 'E992:')
 +  call s:modeline_fails('guitabtooltip', 'guitabtooltip=Something()', 'E992:')
   call s:modeline_fails('iconstring', 'iconstring=Something()', 'E992:')
   call s:modeline_fails('includeexpr', 'includeexpr=Something()', 'E992:')
   call s:modeline_fails('indentexpr', 'indentexpr=Something()', 'E992:')
 +  call s:modeline_fails('printheader', 'printheader=Something()', 'E992:')
   call s:modeline_fails('rulerformat', 'rulerformat=Something()', 'E992:')
   call s:modeline_fails('statusline', 'statusline=Something()', 'E992:')
   call s:modeline_fails('tabline', 'tabline=Something()', 'E992:')
--- a/SOURCES/0001-runtime-netrw-upstream-snapshot-of-v179.patch
+++ b/SOURCES/0001-runtime-netrw-upstream-snapshot-of-v179.patch
@ -1,65 +0,0 @@
 diff -up vim91/runtime/autoload/netrw.vim.validatehostname vim91/runtime/autoload/netrw.vim
 --- vim91/runtime/autoload/netrw.vim.validatehostname	2024-02-09 06:33:54.000000000 +0100
 +++ vim91/runtime/autoload/netrw.vim	2026-03-17 19:16:22.210561235 +0100
@@ -1453,6 +1453,10 @@ fun! netrw#Obtain(islocal,fname,...)
     call s:SetupNetrwStatusLine('%f %h%m%r%=%9*Obtaining '.a:fname)
    endif
    call s:NetrwMethod(b:netrw_curdir)
 +   if !s:NetrwValidateHostname(g:netrw_machine)
 +       call netrw#ErrorMsg(s:ERROR,"Rejecting invalid hostname: <" .. g:netrw_machine .. ">",107)
 +       return
 +   endif
    if b:netrw_method == 4
     " obtain file using scp
@@ -1948,6 +19,10 @@ fun! netrw#NetRead(mode,...)
 "    call Dfunc("netrw#NetRead : unsupported method")
     return
    endif
 +   if !s:NetrwValidateHostname(g:netrw_machine)
 +       call netrw#ErrorMsg(s:ERROR,"Rejecting invalid hostname: <" .. g:netrw_machine .. ">",107)
 +       return
 +   endif
    let tmpfile= s:GetTempfile(b:netrw_fname) " apply correct suffix
    " Check whether or not NetrwBrowse() should be handling this request
@@ -2565,6 +2573,10 @@ fun! netrw#NetWrite(...) range
 "    call Dfunc("netrw#NetWrite : unsupported method")
     return
    endif
 +   if !s:NetrwValidateHostname(g:netrw_machine)
 +       call netrw#ErrorMsg(s:ERROR,"Rejecting invalid hostname: <" .. g:netrw_machine .. ">",107)
 +       return
 +   endif
    " =============
    " NetWrite: Perform Protocol-Based Write {{{3
@@ -3362,6 +3374,17 @@ if has("win95") && exists("g:netrw_win95
  endfun
 endif
 +" s:NetrwValidateHostname:  Validate that the hostname is valid {{{2
 +" Input:
 +"   hostname
 +" Output:
 +"  true if g:netrw_machine is valid according to RFC1123 #Section 2
 +fun! s:NetrwValidateHostname(hostname)
 +    " RFC1123#section-2 mandates, a valid hostname starts with letters or digits
 +    " so reject everyhing else
 +    return a:hostname =~? '^[a-z0-9]'
 +endfun
 +
 " ---------------------------------------------------------------------
 " NetUserPass: set username and password for subsequent ftp transfer {{{2
 "   Usage:  :call NetUserPass()		               -- will prompt for userid and password
@@ -8842,6 +8865,10 @@ fun! s:NetrwUpload(fname,tgt,...)
    elseif a:tgt =~ '^ftp:'
     call s:NetrwMethod(a:tgt)
 +    if !s:NetrwValidateHostname(g:netrw_machine)
 +        call netrw#ErrorMsg(s:ERROR,"Rejecting invalid hostname: <" .. g:netrw_machine .. ">",107)
 +        return
 +    endif
     if b:netrw_method == 2
      " handle uploading a list of files via ftp+.netrc
--- a/SOURCES/Changelog.rpm
+++ b/SOURCES/Changelog.rpm
@ -1,430 +0,0 @@
 * Tue Aug 28 2012 Karsten Hopp <karsten@redhat.com> 7.3.638-1
 - patchlevel 638
 * Mon Aug 06 2012 Karsten Hopp <karsten@redhat.com> 2:7.3.622-2
 - add epoch to spec.vim and automatic changelog entries
 * Mon Aug 06 2012 Karsten Hopp <karsten@redhat.com> 7.3.622-1
 - patchlevel 622
 * Mon Aug 06 2012 Karsten Hopp <karsten@redhat.com> 7.3.604-1
 - drop vim-6.1-rh3.patch, (bz #754801)
 * Wed Jul 18 2012 Karsten Hopp <karsten@redhat.com> 7.3.604-1
 - patchlevel 604
 * Wed Jul 11 2012 Petr Pisar <ppisar@redhat.com> - 2:7.3.594-2
 - Perl 5.16 rebuild
 * Tue Jul 10 2012 Karsten Hopp <karsten@redhat.com> 7.3.594-1
 - patchlevel 594
 * Tue Jul 10 2012 Karsten Hopp <karsten@redhat.com> 7.3.592-1
 - patchlevel 592
 * Mon Jul 09 2012 Petr Pisar <ppisar@redhat.com> - 2:7.3.584-2
 - Perl 5.16 rebuild
 * Mon Jul 02 2012 Karsten Hopp <karsten@redhat.com> 7.3.584-1
 - patchlevel 584
 * Thu Jun 28 2012 Petr Pisar <ppisar@redhat.com> - 2:7.3.556-2
 - Perl 5.16 rebuild
 * Mon Jun 18 2012 Karsten Hopp <karsten@redhat.com> 7.3.556-1
 - patchlevel 556
 * Mon Jun 11 2012 Petr Pisar <ppisar@redhat.com> - 2:7.3.515-2
 - Perl 5.16 rebuild
 * Mon May 21 2012 Karsten Hopp <karsten@redhat.com> 7.3.515-1
 - enable highlighting for older log files (#816848)
 * Tue May 08 2012 Karsten Hopp <karsten@redhat.com> 7.3.515-1
 - patchlevel 515
 * Fri Mar 16 2012 Karsten Hopp <karsten@redhat.com> 7.3.471-1
 - patchlevel 471
 * Mon Feb 13 2012 Karsten Hopp <karsten@redhat.com> 7.3.444-1
 - patchlevel 444
 * Tue Feb 07 2012 Karsten Hopp <karsten@redhat.com> 7.3.434-1
 - patchlevel 434
 * Tue Feb 07 2012 Karsten Hopp <karsten@redhat.com> 7.3.393-3
 - update spec file template, bugzilla 736774
 * Thu Jan 26 2012 Harald Hoyer <harald@redhat.com> 7.3.393-3
 - rebuild against the new ruby library
 * Thu Jan 26 2012 Harald Hoyer <harald@redhat.com> 7.3.393-2
 - install everything in /usr
  https://fedoraproject.org/wiki/Features/UsrMove
 * Thu Jan 05 2012 Karsten Hopp <karsten@redhat.com> 7.3.393-1
 - patchlevel 393
 - fix boolean key 'Terminal' in gvim.desktop
 * Fri Dec 23 2011 Karsten Hopp <karsten@redhat.com> 7.3.386-1
 - patchlevel 386
 * Mon Sep 26 2011 Karsten Hopp <karsten@redhat.com> 7.3.322-1
 - patchlevel 322
 * Wed Sep 21 2011 Karsten Hopp <karsten@redhat.com> 7.3.315-1
 - patchlevel 315
 * Mon Aug 29 2011 Karsten Hopp <karsten@redhat.com> 7.3.289-1
 - patchlevel 289
 * Mon Aug 29 2011 Karsten Hopp <karsten@redhat.com> 7.3.244-4
 - Remove old patched files. (Ricky Zhou <ricky@fedoraproject.org>)
  (bugzilla #709456)
 * Thu Jul 21 2011 Petr Sabata <contyk@redhat.com> - 2:7.3.244-3
 - Perl mass rebuild
 * Thu Jul 21 2011 Petr Sabata <contyk@redhat.com> - 2:7.3.244-2
 - Perl mass rebuild
 * Mon Jul 11 2011 Karsten Hopp <karsten@redhat.com> 7.3.244-1
 - patchlevel 244
 * Tue Jun 14 2011 Marcela Mašláňová <mmaslano@redhat.com> - 2:7.3.206-3
 - Perl mass rebuild
 * Tue May 31 2011 Ville Skyttä <ville.skytta@iki.fi> - 2:7.3.206-2
 - Own the /usr/share/vim/vim73 dir.
 * Mon May 30 2011 Karsten Hopp <karsten@redhat.com> 7.3.206-1
 - drop xxd-locale patch
 - update to patchlevel 206
 * Wed May 11 2011 Karsten Hopp <karsten@redhat.com> 7.3.189-1
 - patchlevel 189
 * Wed Mar 16 2011 Karsten Hopp <karsten@redhat.com> 7.3.138-1
 - patchlevel 138
 * Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2:7.3.107-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
 * Mon Jan 24 2011 Karsten Hopp <karsten@redhat.com> 7.3.107-1
 - patchlevel 107
 * Mon Jan 10 2011 Karsten Hopp <karsten@redhat.com> 7.3.099-1
 - patchlevel 099
 * Mon Jan 03 2011 Karsten Hopp <karsten@redhat.com> 7.3.094-1
 - patchlevel 094
 * Thu Dec 09 2010 Karsten Hopp <karsten@redhat.com> 7.3.081-1
 - patchlevel 081
 * Wed Dec 08 2010 Karsten Hopp <karsten@redhat.com> 7.3.080-1
 - patchlevel 080
 * Fri Dec 03 2010 Karsten Hopp <karsten@redhat.com> 7.3.075-1
 - patchlevel 075
 * Thu Dec 02 2010 Karsten Hopp <karsten@redhat.com> 7.3.073-1
 - patchlevel 073
 * Thu Nov 25 2010 Karsten Hopp <karsten@redhat.com> 7.3.069-1
 - patchlevel 069
 * Wed Nov 24 2010 Karsten Hopp <karsten@redhat.com> 7.3.068-1
 - patchlevel 068
 * Wed Nov 24 2010 Karsten Hopp <karsten@redhat.com> 7.3.063-1
 - patchlevel 063
 * Wed Nov 17 2010 Karsten Hopp <karsten@redhat.com> 7.3.062-1
 - patchlevel 062
 * Tue Nov 16 2010 Karsten Hopp <karsten@redhat.com> 7.3.061-1
 - patchlevel 061
 * Tue Nov 16 2010 Karsten Hopp <karsten@redhat.com> 7.3.056-1
 - patchlevel 056
 * Thu Nov 11 2010 Karsten Hopp <karsten@redhat.com> 7.3.055-1
 - patchlevel 055
 * Wed Nov 10 2010 Karsten Hopp <karsten@redhat.com> 7.3.051-1
 - patchlevel 051
 * Thu Nov 04 2010 Karsten Hopp <karsten@redhat.com> 7.3.050-1
 - patchlevel 050
 * Thu Nov 04 2010 Karsten Hopp <karsten@redhat.com> 7.3.048-1
 - patchlevel 048
 * Thu Oct 28 2010 Karsten Hopp <karsten@redhat.com> 7.3.047-1
 - patchlevel 047
 * Wed Oct 27 2010 Karsten Hopp <karsten@redhat.com> 7.3.046-1
 - patchlevel 046
 * Wed Oct 27 2010 Karsten Hopp <karsten@redhat.com> 7.3.039-1
 - patchlevel 039
 * Sun Oct 24 2010 Karsten Hopp <karsten@redhat.com> 7.3.035-1
 - patchlevel 035
 * Sat Oct 23 2010 Karsten Hopp <karsten@redhat.com> 7.3.034-1
 - patchlevel 034
 * Sat Oct 23 2010 Karsten Hopp <karsten@redhat.com> 7.3.033-1
 - patchlevel 033
 * Thu Oct 21 2010 Karsten Hopp <karsten@redhat.com> 7.3.032-1
 - patchlevel 032
 * Wed Oct 20 2010 Karsten Hopp <karsten@redhat.com> 7.3.031-1
 - patchlevel 031
 * Sat Oct 16 2010 Karsten Hopp <karsten@redhat.com> 7.3.029-1
 - patchlevel 029
 * Fri Oct 15 2010 Karsten Hopp <karsten@redhat.com> 7.3.028-1
 - patchlevel 028
 * Thu Oct 14 2010 Karsten Hopp <karsten@redhat.com> 7.3.027-1
 - patchlevel 027
 * Wed Oct 13 2010 Karsten Hopp <karsten@redhat.com> 7.3.026-1
 - patchlevel 026
 * Sun Oct 10 2010 Karsten Hopp <karsten@redhat.com> 7.3.021-1
 - patchlevel 021
 * Sat Oct 09 2010 Karsten Hopp <karsten@redhat.com> 7.3.020-1
 - patchlevel 020
 * Fri Oct 01 2010 Karsten Hopp <karsten@redhat.com> 7.3.019-1
 - patchlevel 019
 * Thu Sep 30 2010 Karsten Hopp <karsten@redhat.com> 7.3.018-1
 - patchlevel 018
 * Thu Sep 30 2010 Karsten Hopp <karsten@redhat.com> 7.3.011-3
 - add filesystem subpackage (#628293)
 * Wed Sep 29 2010 jkeating - 2:7.3.011-2
 - Rebuilt for gcc bug 634757
 * Wed Sep 22 2010 Karsten Hopp <karsten@redhat.com> 7.3.011-1
 - update to VIM 7.3 patchlevel 011
 # vim:nrformats-=octal
 * Tue Jul 27 2010 Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> 7.2.446-2
 - Rebuild against python 2.7
 * Tue Jul 13 2010 Karsten Hopp <karsten@redhat.com> 7.2.446-1
 - patchlevel 446
 * Thu Jul 08 2010 Karsten Hopp <karsten@redhat.com> 7.2.445-1
 - patchlevel 445
 * Wed Jun 23 2010 Karsten Hopp <karsten@redhat.com> 7.2.444-2
 - rebuild with perl-5.12
 * Sun Jun 13 2010 Karsten Hopp <karsten@redhat.com> 7.2.444-1
 - patchlevel 444
 * Sun Jun 13 2010 Karsten Hopp <karsten@redhat.com> 7.2.443-1
 - patchlevel 443
 * Sat Jun 05 2010 Karsten Hopp <karsten@redhat.com> 7.2.442-1
 - patchlevel 442
 * Wed Jun 02 2010 Marcela Maslanova <mmaslano@redhat.com> - 2:7.2.441-2
 - Mass rebuild with perl-5.12.0
 * Sun May 30 2010 Karsten Hopp <karsten@redhat.com> 7.2.441-1
 - patchlevel 441
 * Sat May 29 2010 Karsten Hopp <karsten@redhat.com> 7.2.440-1
 - patchlevel 440
 * Wed May 26 2010 Karsten Hopp <karsten@redhat.com> 7.2.438-1
 - patchlevel 438
 * Sat May 22 2010 Karsten Hopp <karsten@redhat.com> 7.2.437-1
 - patchlevel 437
 * Sun May 16 2010 Karsten Hopp <karsten@redhat.com> 7.2.436-1
 - patchlevel 436
 * Sat May 15 2010 Karsten Hopp <karsten@redhat.com> 7.2.433-1
 - patchlevel 433
 * Fri May 14 2010 Karsten Hopp <karsten@redhat.com> 7.2.427-1
 - patchlevel 427
 * Thu May 13 2010 Karsten Hopp <karsten@redhat.com> 7.2.422-1
 - patchlevel 422
 * Fri May 07 2010 Karsten Hopp <karsten@redhat.com> 7.2.416-1
 - patchlevel 416
 * Tue Apr 20 2010 Karsten Hopp <karsten@redhat.com> 7.2.411-2
 - fix rvim manpage (#583180)
 * Wed Mar 24 2010 Karsten Hopp <karsten@redhat.com> 7.2.411-1
 - patchlevel 411
 * Tue Mar 23 2010 Karsten Hopp <karsten@redhat.com> 7.2.410-1
 - patchlevel 410
 * Sat Mar 20 2010 Karsten Hopp <karsten@redhat.com> 7.2.403-1
 - patchlevel 403
 * Thu Mar 18 2010 Karsten Hopp <karsten@redhat.com> 7.2.402-1
 - patchlevel 402
 * Wed Mar 17 2010 Karsten Hopp <karsten@redhat.com> 7.2.399-1
 - patchlevel 399
 * Wed Mar 10 2010 Karsten Hopp <karsten@redhat.com> 7.2.394-1
 - patchlevel 394
 * Wed Mar 03 2010 Karsten Hopp <karsten@redhat.com> 7.2.385-1
 - patchlevel 385
 * Tue Mar 02 2010 Karsten Hopp <karsten@redhat.com> 7.2.384-1
 - patchlevel 384
 * Tue Mar 02 2010 Karsten Hopp <karsten@redhat.com> 7.2.381-1
 - patchlevel 381
 * Sat Feb 27 2010 Karsten Hopp <karsten@redhat.com> 7.2.377-1
 - patchlevel 377
 * Wed Feb 24 2010 Karsten Hopp <karsten@redhat.com> 7.2.376-1
 - patchlevel 376
 * Thu Feb 18 2010 Karsten Hopp <karsten@redhat.com> 7.2.368-1
 - patchlevel 368
 * Thu Feb 18 2010 Karsten Hopp <karsten@redhat.com> 7.2.367-1
 - patchlevel 367
 * Wed Feb 17 2010 Karsten Hopp <karsten@redhat.com> 7.2.365-1
 - patchlevel 365
 * Fri Feb 12 2010 Karsten Hopp <karsten@redhat.com> 7.2.359-1
 - patchlevel 359
 * Thu Feb 11 2010 Karsten Hopp <karsten@redhat.com> 7.2.357-1
 - patchlevel 357
 * Thu Feb 04 2010 Karsten Hopp <karsten@redhat.com> 7.2.356-1
 - patchlevel 356
 * Wed Feb 03 2010 Karsten Hopp <karsten@redhat.com> 7.2.354-1
 - patchlevel 354
 * Fri Jan 29 2010 Karsten Hopp <karsten@redhat.com> 7.2.351-1
 - patchlevel 351
 * Thu Jan 28 2010 Karsten Hopp <karsten@redhat.com> 7.2.350-1
 - patchlevel 350
 * Mon Dec  7 2009 Stepan Kasal <skasal@redhat.com> - 2:7.2.315-2
 - rebuild against perl 5.10.1
 * Wed Dec 03 2009 Karsten Hopp <karsten@redhat.com> 7.2.315-1
 - patchlevel 315
 - fix vimrc location in man page (#456992)
 - correct syntax highlighting of httpd config files in /etc/httpd (#499123)
 - Buildrequire ruby, ruby-devel (#503872)
 - Remove check for static gravity (#510307)
 - sort tags file (#517725)
 - use one gvim to open multiple file selections from nautilus (#519265)
 - use elinks -source instead of elinks -dump (#518791)
 - add ext4 keyword to /etc/fstab syntax highlighting (#498290)
 * Mon Nov 09 2009 Karsten Hopp <karsten@redhat.com> 7.2.284-1
 - patchlevel 284
 * Thu Aug 20 2009 Karsten Hopp <karsten@redhat.com> 7.2.245-3
 - change range of system ids in /etc/profile.d/vim/* (#518555)
 * Mon Aug 03 2009 Karsten Hopp <karsten@redhat.com> 7.2.245-2
 - add fix for glibc fortify segfault (#514717, Adam Tkac)
 * Sat Aug 01 2009 Karsten Hopp <karsten@redhat.com> 7.2.245-1
 - add 97 upstream patches to get to patchlevel 245
 * Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2:7.2.148-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
 * Fri Mar 27 2009 Karsten Hopp <karsten@redhat.com> 7.2.148-1
 - patchlevel 148, fixes #461417
 * Tue Mar 10 2009 Karsten Hopp <karsten@redhat.com> 7.2.132-1
 - patchlevel 132, fixes accesses to freed memory
 * Wed Mar 04 2009 Karsten Hopp <karsten@redhat.com> 7.2.131-1
 - patchlevel 131
 * Tue Feb 24 2009 Karsten Hopp <karsten@redhat.com> 7.2.127-1
 - patchlevel 127
 * Mon Feb 23 2009 Karsten Hopp <karsten@redhat.com> 7.2.124-1
 - patchlevel 124
 * Mon Jan 26 2009 Karsten Hopp <karsten@redhat.com> 7.2.088-1
 - patchlevel 88
 * Thu Jan 08 2009 Karsten Hopp <karsten@redhat.com> 7.2.079-2
 - patchlevel 79
 * Thu Dec 04 2008 Jesse Keating <jkeating@redhat.com> - 7.2.060-2
 - Rebuild for new python.
 * Mon Dec 01 2008 Karsten Hopp <karsten@redhat.com> 7.2.060-1
 - patchlevel 60
 * Mon Nov 10 2008 Karsten Hopp <karsten@redhat.com> 7.2.032-1
 - patchlevel 32
 * Mon Nov 03 2008 Karsten Hopp <karsten@redhat.com> 7.2.026-2
 - add more /usr/share/vim/vimfiles directories (#444387)
 * Mon Nov 03 2008 Karsten Hopp <karsten@redhat.com> 7.2.026-1
 - patchlevel 26
 - own some directories in /usr/share/vim/vimfiles (#469491)
 * Tue Oct 21 2008 Karsten Hopp <karsten@redhat.com> 7.2.025-2
 - re-enable clean
 * Mon Oct 20 2008 Karsten Hopp <karsten@redhat.com> 7.2.025-1
 - patchlevel 25
 - add Categories tag to desktop file (#226526)
 - add requirement on hicolor-icon-theme to vim-X11 (#226526)
 - drop Amiga info files (#226526)
 - remove non-utf8 man pages (#226526)
 - drop Application from categories (#226526)
 * Tue Sep 30 2008 Karsten Hopp <karsten@redhat.com> 7.2.022-1
 - patchlevel 22
 * Mon Sep 08 2008 Karsten Hopp <karsten@redhat.com> 7.2.013-1
 - patchlevel 13
 * Mon Aug 25 2008 Karsten Hopp <karsten@redhat.com> 7.2.006-1
 - patchlevel 6
 * Mon Aug 18 2008 Karsten Hopp <karsten@redhat.com> 7.2.002-1
 - patchlevel 2
 - fix specfile template (#446070)
 - old specfile changelog moved to Changelog.rpm
 * Fri Aug 14 2008 Karsten Hopp <karsten@redhat.com> 7.2.000-1
 - vim 7.2
 - drop 330 patches
--- a/SOURCES/gvim16.png
+++ b/SOURCES/gvim16.png
--- a/SOURCES/gvim32.png
+++ b/SOURCES/gvim32.png
--- a/SOURCES/gvim48.png
+++ b/SOURCES/gvim48.png
--- a/SOURCES/vim-7.0-hunspell.patch
+++ b/SOURCES/vim-7.0-hunspell.patch
@ -1,399 +0,0 @@
 diff -ru vim70.orig/src/Makefile vim70.hunspell/src/Makefile
 --- vim70.orig/src/Makefile	2006-12-15 12:29:41.000000000 +0000
 +++ vim70.hunspell/src/Makefile	2006-12-14 11:11:20.000000000 +0000
@@ -1287,7 +1287,7 @@
 PFLAGS = $(PROTO_FLAGS) -DPROTO $(LINT_CFLAGS)
 ALL_LIB_DIRS = $(GUI_LIBS_DIR) $(X_LIBS_DIR)
 -ALL_LIBS = $(GUI_LIBS1) $(GUI_X_LIBS) $(GUI_LIBS2) $(X_PRE_LIBS) $(X_LIBS) $(X_EXTRA_LIBS) $(LIBS) $(EXTRA_LIBS) $(MZSCHEME_LIBS) $(PERL_LIBS) $(PYTHON_LIBS) $(TCL_LIBS) $(RUBY_LIBS) $(PROFILE_LIBS)
 +ALL_LIBS = $(GUI_LIBS1) $(GUI_X_LIBS) $(GUI_LIBS2) $(X_PRE_LIBS) $(X_LIBS) $(X_EXTRA_LIBS) $(LIBS) $(EXTRA_LIBS) $(MZSCHEME_LIBS) $(PERL_LIBS) $(PYTHON_LIBS) $(TCL_LIBS) $(RUBY_LIBS) $(PROFILE_LIBS) -lhunspell-1.1
 # abbreviations
 DEST_BIN = $(DESTDIR)$(BINDIR)
 diff -ru vim70.orig/src/spell.c vim70.hunspell/src/spell.c
 --- vim70.orig/src/spell.c	2006-12-15 12:29:44.000000000 +0000
 +++ vim70.hunspell/src/spell.c	2006-12-15 12:27:49.000000000 +0000
@@ -319,6 +319,8 @@
 # include <time.h>	/* for time_t */
 #endif
 +#include "hunspell/hunspell.h"
 +
 #define MAXWLEN 250		/* Assume max. word len is this many bytes.
 				   Some places assume a word length fits in a
 				   byte, thus it can't be above 255. */
@@ -428,6 +430,8 @@
 #define	SP_FORMERROR	-2	/* format error in spell file */
 #define SP_OTHERERROR	-3	/* other error while reading spell file */
 +#define MAXREGIONS 20
 +
 /*
  * Structure used to store words and other info for one language, loaded from
  * a .spl file.
@@ -450,6 +454,10 @@
     char_u	*sl_name;	/* language name "en", "en.rare", "nl", etc. */
     char_u	*sl_fname;	/* name of .spl file */
     int		sl_add;		/* TRUE if it's a .add file. */
 +    int		sl_ishunspell;	/* TRUE if it's an unconverted hunspell aff/dic combination. */
 +    Hunhandle	*sl_hunspell;
 +    vimconv_T   sl_tohunconv;
 +    vimconv_T   sl_fromhunconv;
     char_u	*sl_fbyts;	/* case-folded word bytes */
     idx_T	*sl_fidxs;	/* case-folded word indexes */
@@ -460,7 +468,7 @@
     char_u	*sl_info;	/* infotext string or NULL */
 -    char_u	sl_regions[17];	/* table with up to 8 region names plus NUL */
 +    char_u	sl_regions[MAXREGIONS * 2 + 1];	/* table with up to 8 region names plus NUL */
     char_u	*sl_midword;	/* MIDWORD string or NULL */
@@ -997,6 +1005,36 @@
 static char_u	*repl_from = NULL;
 static char_u	*repl_to = NULL;
 +static void
 +ensurehunspellinit(lp)
 +    slang_T *lp;
 +{
 +    if (!lp->sl_hunspell)
 +    {
 +        char_u *dic = lp->sl_fname;
 +        char_u *aff = vim_strnsave(dic, strlen(dic));
 +    
 +	vim_strncpy(aff + strlen(aff) - 3, "aff", 3);
 +    
 +	lp->sl_hunspell = Hunspell_create(aff, dic);
 +
 +	vim_free(aff);
 +
 +	if (convert_setup(&lp->sl_tohunconv, spell_enc(), 
 +	    Hunspell_get_dic_encoding(lp->sl_hunspell)) == FAIL)
 +	{
 +	    lp->sl_tohunconv.vc_fail = TRUE;
 +	}
 +
 +	if (convert_setup(&lp->sl_fromhunconv, 
 +	    Hunspell_get_dic_encoding(lp->sl_hunspell), spell_enc()) == FAIL)
 +	{
 +	    lp->sl_fromhunconv.vc_fail = TRUE;
 +	}
 +    }
 +}
 +
 +
 /*
  * Main spell-checking function.
  * "ptr" points to a character that could be the start of a word.
@@ -1101,27 +1139,70 @@
     {
 	mi.mi_lp = LANGP_ENTRY(wp->w_buffer->b_langp, lpi);
 +	if (mi.mi_lp->lp_slang->sl_ishunspell)
 +	{
 +	    slang_T *lp = mi.mi_lp->lp_slang;
 +	    char_u *converted = 0;
 +	    char_u *thisword;
 +	    char_u *mi_end = mi.mi_end;
 +	    char_u *mi_final =  mi.mi_word + strlen(mi.mi_word);
 +
 +	    while (1)
 +	    {
 +		ensurehunspellinit(lp);
 +		if ((lp->sl_tohunconv.vc_fail == TRUE) || (lp->sl_fromhunconv.vc_fail == TRUE))
 +		    break;
 +
 +		if (mi_end != mi.mi_word)
 +		{
 +		    thisword = vim_strnsave(mi.mi_word, mi_end - mi.mi_word);
 +		    converted = string_convert(&lp->sl_tohunconv, thisword, NULL);
 +		    if (converted)
 +		    {
 +			if (Hunspell_spell(lp->sl_hunspell, converted) != 0)
 +			{
 +			    mi.mi_result = SP_OK;
 +			    mi.mi_end = mi.mi_cend = mi.mi_word + strlen(thisword);
 +			}
 +			vim_free(converted);
 +		    }
 +		    vim_free(thisword);
 +		}
 +
 +		if (mi_end == mi_final)
 +		    break;
 +
 +		do
 +		{
 +		    mb_ptr_adv(mi_end);
 +		} while (*mi_end != NUL && spell_iswordp(mi_end, wp->w_buffer));
 +	    }
 +	}
 +
 	/* If reloading fails the language is still in the list but everything
 	 * has been cleared. */
 -	if (mi.mi_lp->lp_slang->sl_fidxs == NULL)
 +	if (!mi.mi_lp->lp_slang->sl_ishunspell && mi.mi_lp->lp_slang->sl_fidxs == NULL)
 	    continue;
 -	/* Check for a matching word in case-folded words. */
 -	find_word(&mi, FIND_FOLDWORD);
 +	if (!mi.mi_lp->lp_slang->sl_ishunspell)
 +	{
 +	    /* Check for a matching word in case-folded words. */
 +	    find_word(&mi, FIND_FOLDWORD);
 -	/* Check for a matching word in keep-case words. */
 -	find_word(&mi, FIND_KEEPWORD);
 +	    /* Check for a matching word in keep-case words. */
 +	    find_word(&mi, FIND_KEEPWORD);
 -	/* Check for matching prefixes. */
 -	find_prefix(&mi, FIND_FOLDWORD);
 +	    /* Check for matching prefixes. */
 +	    find_prefix(&mi, FIND_FOLDWORD);
 -	/* For a NOBREAK language, may want to use a word without a following
 -	 * word as a backup. */
 -	if (mi.mi_lp->lp_slang->sl_nobreak && mi.mi_result == SP_BAD
 -						   && mi.mi_result2 != SP_BAD)
 -	{
 -	    mi.mi_result = mi.mi_result2;
 -	    mi.mi_end = mi.mi_end2;
 +	    /* For a NOBREAK language, may want to use a word without a following
 +	     * word as a backup. */
 +	    if (mi.mi_lp->lp_slang->sl_nobreak && mi.mi_result == SP_BAD
 +						       && mi.mi_result2 != SP_BAD)
 +	    {
 +		mi.mi_result = mi.mi_result2;
 +		mi.mi_end = mi.mi_end2;
 +	    }
 	}
 	/* Count the word in the first language where it's found to be OK. */
@@ -2359,6 +2440,80 @@
     if (r == FAIL)
     {
 +#	define HUNSPELLDICT "/usr/share/myspell/"
 +	DIR *dirp = opendir(HUNSPELLDICT);
 +	if (dirp != NULL)
 +	{
 +	    slang_T* thislang[MAXREGIONS] = {0};
 +	    slang_T *lp = 0;
 +	    struct dirent *dp;
 +	    int i = 0;
 +
 +	    while ((dp = readdir(dirp)) != NULL)
 +	    {
 +		char_u final_name[MAXPATHL];
 +		char_u spf_name[MAXPATHL];
 +		char_u thisregion[3] = {0};
 +		char *resolvedlink = final_name;
 +		int j, regionpos;
 +
 +		if (strncmp(dp->d_name, lang, strlen(lang)) != 0)
 +		    continue;
 +		
 +		if ((strlen(dp->d_name) <= 4) || (dp->d_name[strlen(lang)] != '_'))
 +		    continue;
 +
 +		if (strncmp(".dic", dp->d_name + strlen(dp->d_name) - 4, 4) != 0)
 +		    continue;
 +
 +		vim_strncpy(spf_name, HUNSPELLDICT, strlen(HUNSPELLDICT));
 +		vim_strncpy(spf_name + strlen(HUNSPELLDICT), dp->d_name, strlen(HUNSPELLDICT));
 +
 +		if (realpath(spf_name, resolvedlink) != resolvedlink)
 +		    continue;
 +
 +		thisregion[0] = tolower(dp->d_name[strlen(lang)+1]);
 +		thisregion[1] = tolower(dp->d_name[strlen(lang)+1+1]);
 +
 +		r = OK;
 +
 +		for (j = 0; j < MAXREGIONS; ++j)
 +		{
 +		    if (thislang[j] && (strcmp(thislang[j]->sl_fname, final_name) == 0))
 +			break;
 +		}
 +
 +		if (j < MAXREGIONS)
 +		    lp = thislang[j];
 +		else
 +		{
 +		    lp = slang_alloc(lang);
 +		    lp->sl_ishunspell = TRUE;
 +
 +		    lp->sl_fname = vim_strsave(resolvedlink);
 +
 +		    lp->sl_next = first_lang;
 +		    first_lang = lp;
 +		    thislang[i] = lp;
 +		}
 +
 +		regionpos = 0;
 +		while (lp->sl_regions[regionpos] != 0) ++regionpos;
 +
 +		//silently lose regions which won't fit in
 +		if (regionpos == MAXREGIONS * 2)
 +		    continue;
 +
 +		vim_strncpy(lp->sl_regions + regionpos, thisregion, 2);
 +
 +		++i;
 +	    }
 +	    closedir(dirp);
 +	}
 +    }
 +
 +    if (r == FAIL)
 +    {
 	smsg((char_u *)_("Warning: Cannot find word list \"%s.%s.spl\" or \"%s.ascii.spl\""),
 						     lang, spell_enc(), lang);
     }
@@ -2429,6 +2584,9 @@
 slang_free(lp)
     slang_T	*lp;
 {
 +    Hunspell_destroy(lp->sl_hunspell);
 +    convert_setup(&lp->sl_tohunconv, NULL, NULL);
 +    convert_setup(&lp->sl_fromhunconv, NULL, NULL);
     vim_free(lp->sl_name);
     vim_free(lp->sl_fname);
     slang_clear(lp);
@@ -2974,7 +3132,7 @@
 {
     int		i;
 -    if (len > 16)
 +    if (len > MAXREGIONS*2)
 	return SP_FORMERROR;
     for (i = 0; i < len; ++i)
 	lp->sl_regions[i] = getc(fd);			/* <regionname> */
@@ -4112,6 +4270,7 @@
     /* loop over comma separated language names. */
     for (splp = buf->b_p_spl; *splp != NUL; )
     {
 +	int hunspellregionunsupported;
 	/* Get one language name. */
 	copy_option_part(&splp, lang, MAXWLEN, ",");
@@ -4182,6 +4341,7 @@
 	/*
 	 * Loop over the languages, there can be several files for "lang".
 	 */
 +	hunspellregionunsupported = 0;
 	for (slang = first_lang; slang != NULL; slang = slang->sl_next)
 	    if (filename ? fullpathcmp(lang, slang->sl_fname, FALSE) == FPC_SAME
 			 : STRICMP(lang, slang->sl_name) == 0)
@@ -4199,6 +4359,11 @@
 				/* This addition file is for other regions. */
 				region_mask = 0;
 			}
 +			else if (slang->sl_ishunspell)
 +			{
 +			    region_mask = 0;
 +			    hunspellregionunsupported++;
 +			}
 			else
 			    /* This is probably an error.  Give a warning and
 			     * accept the words anyway. */
@@ -4207,7 +4372,10 @@
 								      region);
 		    }
 		    else
 +		    {
 +			hunspellregionunsupported--;
 			region_mask = 1 << c;
 +		    }
 		}
 		if (region_mask != 0)
@@ -4225,6 +4393,9 @@
 			nobreak = TRUE;
 		}
 	    }
 +
 +	if (region && hunspellregionunsupported >= 1)
 +	    smsg((char_u *) _("Warning: region %s not supported"), region);
     }
     /* round 0: load int_wordlist, if possible.
@@ -4832,7 +5003,7 @@
     char_u	*si_info;	/* info text chars or NULL  */
     int		si_region_count; /* number of regions supported (1 when there
 				    are no regions) */
 -    char_u	si_region_name[16]; /* region names; used only if
 +    char_u	si_region_name[MAXREGIONS*2]; /* region names; used only if
 				     * si_region_count > 1) */
     garray_T	si_rep;		/* list of fromto_T entries from REP lines */
@@ -7093,7 +7264,7 @@
 		else
 		{
 		    line += 8;
 -		    if (STRLEN(line) > 16)
 +		    if (STRLEN(line) > MAXREGIONS)
 			smsg((char_u *)_("Too many regions in %s line %d: %s"),
 						       fname, lnum, line);
 		    else
@@ -8973,7 +9144,7 @@
     char_u	wfname[MAXPATHL];
     char_u	**innames;
     int		incount;
 -    afffile_T	*(afile[8]);
 +    afffile_T	*(afile[MAXREGIONS]);
     int		i;
     int		len;
     struct stat	st;
@@ -9040,8 +9211,8 @@
 	EMSG(_(e_invarg));	/* need at least output and input names */
     else if (vim_strchr(gettail(wfname), '_') != NULL)
 	EMSG(_("E751: Output file name must not have region name"));
 -    else if (incount > 8)
 -	EMSG(_("E754: Only up to 8 regions supported"));
 +    else if (incount > MAXREGIONS)
 +	EMSG2(_("E754: Only up to %d regions supported"), MAXREGIONS);
     else
     {
 	/* Check for overwriting before doing things that may take a lot of
@@ -11097,6 +11268,36 @@
     {
 	lp = LANGP_ENTRY(curbuf->b_langp, lpi);
 +	if (lp->lp_slang->sl_ishunspell)
 +	{
 +	    slang_T *slp = lp->lp_slang;
 +	    char **slst;
 +	    char_u *converted = 0;
 +
 +	    ensurehunspellinit(slp);
 +
 +	    converted = string_convert(&slp->sl_tohunconv, su->su_fbadword, NULL);
 +	    if (converted)
 +	    {
 +		int suggests;
 +		suggests = Hunspell_suggest(slp->sl_hunspell, &slst, converted);
 +		if (suggests > 0)
 +		{
 +		    int i;
 +		    char_u *suggest;
 +		    for (i = 0; i < suggests; ++i)
 +		    {
 +			suggest = string_convert(&slp->sl_fromhunconv, slst[i], NULL);
 +			add_suggestion(su, &su->su_ga, suggest, su->su_badlen, i, 0, FALSE,
 +			    slp, FALSE);
 +			vim_free(suggest);
 +		    }
 +		    free(slst);
 +		}
 +		vim_free(converted);
 +	    }
 +	}
 +
 	/* If reloading a spell file fails it's still in the list but
 	 * everything has been cleared. */
 	if (lp->lp_slang->sl_fbyts == NULL)
--- a/SPECS/vim.spec
+++ b/SPECS/vim.spec
@ -24,7 +24,7 @@ Summary: The VIM editor
 URL:     http://www.vim.org/
 Name: vim
 Version: %{baseversion}.%{patchlevel}
-Release: 22%{?dist}.3
+Release: 19%{?dist}.4
 License: Vim and MIT
 Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
 Source1: vim.sh
@ -47,7 +47,10 @@ Source16: macros.vim
 Patch2002: vim-7.0-fixkeys.patch
 Patch2003: vim-7.4-specsyntax.patch
 %if %{withhunspell}
 Patch2011: vim-7.0-hunspell.patch
 BuildRequires: hunspell-devel
 %endif
 Patch3000: vim-7.4-syntax.patch
 Patch3002: vim-7.4-nowarnings.patch
@ -97,7 +100,7 @@ Patch3032: 0001-patch-8.2.4218-illegal-memory-access-with-bracketed-.patch
 Patch3033: 0001-patch-8.2.4253-using-freed-memory-when-substitute-wi.patch
 # CVE-2022-0361 vim: Heap-based Buffer Overflow in GitHub repository
 Patch3034: 0001-patch-8.2.4215-illegal-memory-access-when-copying-li.patch
-# 2073391 - CVE-2022-1154 vim: use after free in utf_ptr2char
+# CVE-2022-1154 vim: use after free in utf_ptr2char
 Patch3035: 0001-patch-8.2.4646-using-buffer-line-after-it-has-been-f.patch
 # CVE-2022-1621 vim: heap buffer overflow
 Patch3036: 0001-patch-8.2.4919-can-add-invalid-bytes-with-spellgood.patch
@ -109,45 +112,6 @@ Patch3038: 0001-patch-8.2.4977-memory-access-error-when-substitute-e.patch
 Patch3039: 0001-patch-8.2.5023-substitute-overwrites-allocated-buffe.patch
 # CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c
 Patch3040: 0001-patch-8.2.5037-cursor-position-may-be-invalid-after-.patch
 # RHEL-112003 CVE-2025-53905 vim: Vim path traversial
 Patch3041: 0001-patch-9.1.1552-security-path-traversal-issue-in-tar..patch
 # RHEL-112007 CVE-2025-53906 vim: Vim path traversal
 Patch3042: 0001-patch-9.1.1551-security-path-traversal-issue-in-zip..patch
 # RHEL-147935 CVE-2026-25749 vim: Heap Overflow in Vim
 # 0001-patch-9.1.2132-security-buffer-overflow-in-helpfile-.patch
 # 0001-patch-9.1.2133-Another-case-of-buffer-overflow-with-.patch
 Patch3043: 0001-patch-9.1.2132-security-buffer-overflow-in-helpfile-.patch
 Patch3044: 0001-patch-9.1.2133-Another-case-of-buffer-overflow-with-.patch
 # RHEL-159620 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function
 Patch3045: 0001-patch-9.2.0202-security-command-injection-via-newlin.patch
 # RHEL-155428 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
 # 3 patches:
 # 0001-runtime-netrw-upstream-snapshot-of-v179.patch - introduces NetrwValidateHostname
 # 0001-patch-9.2.0073-security-possible-command-injection-u.patch - CVE patch which sanitizes hostnames
 # and reports invalid characters in SSH commands
 # 0001-patch-9.2.0089-netrw-does-not-take-port-into-account.patch - include portnumber in hostname checking
 Patch3046: 0001-runtime-netrw-upstream-snapshot-of-v179.patch
 Patch3047: 0001-patch-9.2.0073-security-possible-command-injection-u.patch
 Patch3048: 0001-patch-9.2.0089-netrw-does-not-take-port-into-account.patch
 # RHEL-155412 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file
 # 0001-patch-9.0.1477-crash-when-recovering-from-corrupted-.patch - adds check for max page count, which fixes
 # crash which happens after applying 0001-patch-9.2.0077-security-Crash-when-recovering-a-corr.patch
 # 0001-patch-9.2.0077-security-Crash-when-recovering-a-corr.patch - validates line count and page count from
 # untrusted swap file before passing it to read and allocation functions
 Patch3049: 0001-patch-9.0.1477-crash-when-recovering-from-corrupted-.patch
 Patch3050: 0001-patch-9.2.0077-security-Crash-when-recovering-a-corr.patch
 # RHEL-164956 CVE-2026-34982 vim: arbitrary command execution via modeline sandbox bypass
 # https://redhat.atlassian.net/browse/RHEL-164956
 # first two patches include modelineexpr implementation, which is required for security fix,
 # and related tests
 # https://github.com/vim/vim/commit/110289e78195b6d01e1e6ad26ad450de476d41c1
 # https://github.com/vim/vim/commit/076073950c44ea0e35bc39d539dc7ab41bf9c7ec
 # https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615f13a7de44c0587
 # https://github.com/vim/vim/commit/8c8772c6b321d4955c8f09926e3eda2b4cd83680
 Patch3051: 0001-patch-8.1.1366-using-expressions-in-modeline-is-unsafe.patch
 Patch3052: 0001-patch-8.1.1401-misspelled-mkspellmem.patch
 Patch3053: 0001-patch-9.2.0276-security-modeline-security-bypass.patch
 Patch3054: 0001-patch-9.2.0277-tests-test_modeline.vim-fails.patch
 # gcc is no longer in buildroot by default
 BuildRequires: gcc
@ -172,11 +136,6 @@ BuildRequires: lua-devel
 Requires: desktop-file-utils
 BuildRequires: desktop-file-utils >= %{desktop_file_utils_version}
 %endif
 %if %{withhunspell}
 BuildRequires: hunspell-devel
 %endif
 Epoch: 2
 Conflicts: filesystem < 3
@ -194,7 +153,7 @@ Conflicts: man-pages-pl < 0.24-2
 Requires: %{name}-filesystem
 # it conflicts with older version of vim-minimal during update because of manpage
 # move
-Conflicts: %{name}-minimal < 2:8.0.1428-4
+Conflicts: %{name}-minimal < 8.0.1428-4
 %description common
 VIM (VIsual editor iMproved) is an updated and improved version of the
@ -217,11 +176,11 @@ many different languages.
 %package minimal
 Summary: A minimal version of the VIM editor
-Provides: vi = %{epoch}:%{version}-%{release}
+Provides: vi = %{version}-%{release}
 Provides: %{_bindir}/vi
 # it conflicts with older version of vim-common during update because of manpage
 # move
-Conflicts: %{name}-common < 2:8.0.1428-4
+Conflicts: %{name}-common < 8.0.1428-4
 %description minimal
 VIM (VIsual editor iMproved) is an updated and improved version of the
@ -236,7 +195,7 @@ package is installed.
 %package enhanced
 Summary: A version of the VIM editor which includes recent enhancements
 Requires: vim-common = %{epoch}:%{version}-%{release} which
-Provides: vim = %{epoch}:%{version}-%{release}
+Provides: vim = %{version}-%{release}
 Provides: %{_bindir}/mergetool
 Provides: %{_bindir}/vim
 # suggest python3, python2, lua, ruby and perl packages because of their 
@ -267,6 +226,7 @@ need to install the vim-common package.
 %package filesystem
 Summary: VIM filesystem layout
 BuildArch: noarch
 %Description filesystem
 This package provides some directories which are required by other
 packages that add vim files, p.e.  additional syntax files or filetypes.
@ -282,7 +242,7 @@ BuildRequires: libXpm-devel
 BuildRequires: libICE-devel
 Requires: vim-common = %{epoch}:%{version}-%{release} libattr >= 2.4 gtk3 
-Provides: gvim = %{epoch}:%{version}-%{release}
+Provides: gvim = %{version}-%{release}
 Provides: %{_bindir}/mergetool
 Provides: %{_bindir}/gvim
 Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
@ -369,20 +329,6 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
 %patch3038 -p1 -b .cve1785
 %patch3039 -p1 -b .cve1897
 %patch3040 -p1 -b .cve1927
 %patch -P 3041 -p1 -b .CVE-2025-53905
 %patch -P 3042 -p1 -b .CVE-2025-53906
 %patch -P 3043 -p1 -b .tag-overflow
 %patch -P 3044 -p1 -b .tag-overflow2
 %patch -P 3045 -p1 -b .CVE-2026-33412
 %patch -P 3046 -p1 -b .validatehostname
 %patch -P 3047 -p1 -b .CVE-2026-28417
 %patch -P 3048 -p1 -b .validateportnum
 %patch -P 3049 -p1 -b .check-page-count
 %patch -P 3050 -p1 -b .CVE-2026-28421
 %patch -P 3051 -p1 -b .modelineexpr
 %patch -P 3052 -p1 -b .mkspellmem-fix
 %patch -P 3053 -p1 -b .modeline-bypass
 %patch -P 3054 -p1 -b .modeline-tests
 %build
 %if 0%{?rhel} > 7
@ -901,24 +847,6 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
 %{_datadir}/icons/locolor/*/apps/*
 %changelog
 * Fri Apr 17 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-22.3
 - Relates: RHEL-164956 vim: arbitrary command execution via modeline sandbox bypass
 * Mon Apr 13 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-22.2
 - Resolves: RHEL-164956 vim: arbitrary command execution via modeline sandbox bypass
 * Tue Mar 31 2026 Petr Dancak   <pdancak@redhat.com> - 2:8.0.1763-22.1
 - RHEL-159620 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function
 - RHEL-155428 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
 - RHEL-155412 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file
 * Fri Feb 27 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-22
 - RHEL-147935 CVE-2026-25749 vim: Heap Overflow in Vim
 * Wed Sep 17 2025 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-21
 - RHEL-112003 CVE-2025-53905 vim: Vim path traversial
 - RHEL-112007 CVE-2025-53906 vim: Vim path traversal
 * Tue Jun 14 2022 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-19.4
 - fix issue reported by covscan
@ -927,7 +855,7 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
 - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c
 - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c
-* Sat May 14 2022 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-19.2
+* Wed May 25 2022 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-19.2
 - CVE-2022-1621 vim: heap buffer overflow
 - CVE-2022-1629 vim: buffer over-read