diff --git a/.java-21-openjdk.checksum b/.java-21-openjdk.checksum
index 54495baf385b08cfc246a8116667929d5c223345..867cbab2ab940927c30f63cfd736629ac6c671cd 100644
--- a/.java-21-openjdk.checksum
+++ b/.java-21-openjdk.checksum
@@ -1 +1 @@
-Direct Git Import
+7fbc4d1523de02eecbe06e434ba398a0639f8fb1a76c64cb3ac6c26a66577c56
diff --git a/.java-21-openjdk.metadata b/.java-21-openjdk.metadata
index ea2c06fcd718951d66e5adeb3d0a6d121102b506..2365781493ec8fea9d2cbda32dc57b0d6accb11d 100644
--- a/.java-21-openjdk.metadata
+++ b/.java-21-openjdk.metadata
@@ -1,2 +1,2 @@
-f383329220e75e254b853ebe06df827421fbe8f467c701ccd2fc8dc6a639c87d  SOURCES/openjdk-21.0.5+9-ea.tar.xz
+4892cc53511a8c9fe97ac7fe3fb9fe40ad21d04fa3f2f8fabe614187984f1de1  SOURCES/openjdk-21.0.5+10.tar.xz
 d8a785cc9cc71745c17ecb9e5f0f919e7776b2f21584634f1eb71e4c7e813d6f  SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
diff --git a/SOURCES/NEWS b/SOURCES/NEWS
index 876a37cf3be29f595b2f85d5eb5c98cb185c43f9..a98df8b0bd3e4b9c9b45ebe6d34913fb24cdf113 100644
--- a/SOURCES/NEWS
+++ b/SOURCES/NEWS
@@ -8,6 +8,20 @@ New in release OpenJDK 21.0.5 (2024-10-15):
 Live versions of these release notes can be found at:
   * https://bit.ly/openjdk2105
 
+* CVEs
+  - CVE-2024-21208
+  - CVE-2024-21210
+  - CVE-2024-21217
+  - CVE-2024-21235
+* Security fixes
+  - JDK-8307383: Enhance DTLS connections
+  - JDK-8311208: Improve CDS Support
+  - JDK-8328286: Enhance HTTP client
+  - JDK-8328544: Improve handling of vectorization
+  - JDK-8328726: Better Kerberos support
+  - JDK-8331446: Improve deserialization support
+  - JDK-8332644: Improve graph optimizations
+  - JDK-8335713: Enhance vectorization analysis
 * Other changes
   - JDK-6355567: AdobeMarkerSegment causes failure to read valid JPEG
   - JDK-6967482: TAB-key does not work in JTables after selecting details-view in JFileChooser
@@ -361,6 +375,7 @@ Live versions of these release notes can be found at:
   - JDK-8339869: [21u] Test CreationTime.java fails with UnsatisfiedLinkError after 8334339
   - JDK-8341057: Add 2 SSL.com TLS roots
   - JDK-8341059: Change Entrust TLS distrust date to November 12, 2024
+  - JDK-8341674: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.5
 
 Notes on individual issues:
 ===========================
@@ -528,6 +543,24 @@ Name: SSL.com
 Alias Name: ssltlsrootrsa2022
 Distinguished Name: CN=SSL.com TLS RSA Root CA 2022, O=SSL Corporation, C=US
 
+core-libs/java.net:
+
+JDK-8328286: Enhance HTTP client
+================================
+This OpenJDK release limits the maximum header field size accepted by
+the HTTP client within the JDK for all supported versions of the HTTP
+protocol. The header field size is computed as the sum of the size of
+the uncompressed header name, the size of the uncompressed header
+value and a overhead of 32 bytes for each field section line. If a
+peer sends a field section that exceeds this limit, a
+`java.net.ProtocolException` will be raised.
+
+This release also introduces a new system property,
+`jdk.http.maxHeaderSize`. This property can be used to alter the
+maximum header field size (in bytes) or disable it by setting the
+value to zero or a negative value. The default value is 393,216 bytes
+or 384kB.
+
 core-svc/java.lang.management:
 
 JDK-8338139: {ClassLoading,Memory}MXBean::isVerbose methods are inconsistent with their setVerbose methods
diff --git a/SOURCES/java-21-openjdk-portable.specfile b/SOURCES/java-21-openjdk-portable.specfile
index 1d731d49c147d1b6d4a9448031525f3fc70a3446..ec8c58b84b8128ff002ac0ca5fd802bd8f7f8353 100644
--- a/SOURCES/java-21-openjdk-portable.specfile
+++ b/SOURCES/java-21-openjdk-portable.specfile
@@ -31,9 +31,7 @@
 
 # This is RHEL 7 specific as it doesn't seem to have the
 # __brp_strip_static_archive macro.
-%if 0%{?rhel} == 7
 %define __os_install_post %{nil}
-%endif
 
 # Workaround for stripping of debug symbols from static libraries
 %if %{with staticlibs}
@@ -58,10 +56,6 @@
 # See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879
 %global _find_debuginfo_opts -g
 
-# Disable LTO as this causes build failures at the moment.
-# See RHBZ#1861401
-%define _lto_cflags %{nil}
-
 # note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros
 # also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch
 # see the difference between global and define:
@@ -148,7 +142,7 @@
 %global zgc_arches x86_64
 # Set of architectures for which alt-java has SSB mitigation
 %global ssbd_arches x86_64
-# Set of architectures for which java has short vector math library (libjsvml.so)
+# Set of architectures for which java has short vector math library (libsvml.so)
 %global svml_arches x86_64
 # Set of architectures where we verify backtraces with gdb
 # s390x fails on RHEL 7 so we exclude it there
@@ -159,11 +153,6 @@
 %endif
 # Architecture on which we run Java only tests
 %global jdk_test_arch x86_64
-# Set of architectures for which we have a devkit
-# Only used on RHEL
-%if 0%{?centos} == 0
-%global devkit_arches %{aarch64} %{ppc64le} s390x x86_64
-%endif
 
 # By default, we build a slowdebug build during main build on JIT architectures
 %if %{with slowdebug}
@@ -244,9 +233,11 @@
 %global hotspot_target hotspot
 
 # DTS toolset to use to provide gcc & binutils
-%if 0%{?rhel} == 7
 %global dtsversion 10
-%endif
+
+# Disable LTO as this causes build failures at the moment.
+# See RHBZ#1861401
+%define _lto_cflags %{nil}
 
 # Filter out flags from the optflags macro that cause problems with the OpenJDK build
 # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2
@@ -342,7 +333,7 @@
   %global lts_designator_zip ""
 %endif
 # JDK to use for bootstrapping
-%global bootjdk /usr/lib/jvm/java-%{featurever}-openjdk
+%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
 # Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
 # This will only work where the bootstrap JDK is the same major version
 # as the JDK being built
@@ -390,7 +381,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        9
+%global buildver        10
 %global rpmrelease      1
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
@@ -410,7 +401,7 @@
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
 # - N%%{?extraver}{?dist} for GA releases
-%global is_ga           0
+%global is_ga           1
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
@@ -495,7 +486,6 @@
 %define jrebindir()     %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin}
 
 %global alt_java_name     alt-java
-%global devkit_name %{origin}-devkit
 
 %global rpm_state_dir %{_localstatedir}/lib/rpm-state/
 
@@ -530,19 +520,10 @@
 
 # Prevent brp-java-repack-jars from being run
 %global __jar_repack 0
-
-# Define an optional suffix for the OS this package is built on
-%if 0%{?rhel} == 7
-%global pkgos rhel7
-%endif
-
 # Define the architectures on which we build
-# On RHEL, this should be the architectures with a devkit
-%if 0%{?centos} == 0
-ExclusiveArch: %{devkit_arches}
-%else
 ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64
-%endif
+# Define the OS this package is built on
+%global pkgos rhel7
 
 Name:    java-%{javaver}-%{origin}-portable%{?pkgos:-%{pkgos}}
 Version: %{newjavaver}.%{buildver}
@@ -558,6 +539,11 @@ Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
 # provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0".
 
 Epoch:   1
+
+# portables have grown out of its component, moving back to java-x-vendor
+# this expression, when declared as global, filled component with java-x-vendor portable
+%define component %(echo %{name} | sed "s;-portable%{?pkgos:-%{pkgos}};;g")
+
 Summary: %{origin_nice} %{featurever} Runtime Environment portable edition
 # Groups are only used up to RHEL 8 and on Fedora versions prior to F30
 %if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30)
@@ -622,6 +608,7 @@ Source18: TestTranslations.java
 # RPM/distribution specific patches
 #
 ############################################
+
 # Crypto policy and FIPS support patches
 # Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u
 # as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch
@@ -665,6 +652,8 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch
 # OpenJDK patches in need of upstreaming
 #
 #############################################
+# Revert backport of JDK-8327501 & JDK-8328366
+Patch2001: jdk8327501-8328366-revert.patch
 
 # Currently empty
 
@@ -674,8 +663,6 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch
 #
 #############################################
 
-# Currently empty
-
 #############################################
 #
 # Portable build specific patches
@@ -694,19 +681,9 @@ BuildRequires: desktop-file-utils
 BuildRequires: elfutils-devel
 BuildRequires: file
 BuildRequires: fontconfig-devel
-# RHEL 7 builds obtain a newer compiler from DTS
-%if 0%{?rhel} == 7
 BuildRequires: devtoolset-%{dtsversion}-gcc
 BuildRequires: devtoolset-%{dtsversion}-gcc-c++
-%else
-%ifarch %{devkit_arches}
-BuildRequires: %{devkit_name} >= 1.0-6
-%else
-# Earlier versions have a bug in tree vectorization on PPC
-BuildRequires: gcc >= 4.8.3-8
 BuildRequires: gcc-c++
-%endif
-%endif
 BuildRequires: gdb
 BuildRequires: libxslt
 BuildRequires: libX11-devel
@@ -719,7 +696,7 @@ BuildRequires: libXtst-devel
 # Requirement for setting up nss.fips.cfg
 BuildRequires: nss-devel
 # Requirement for system security property test
-# N/A for portable as we don't enable support for them
+# N/A for portable. RHEL7 doesn't provide them
 #BuildRequires: crypto-policies
 BuildRequires: pkgconfig
 BuildRequires: xorg-x11-proto-devel
@@ -727,20 +704,22 @@ BuildRequires: zip
 # to pack portable tarballs
 BuildRequires: tar
 BuildRequires: unzip
-BuildRequires: javapackages-filesystem
-BuildRequires: java-%{featurever}-%{origin}%{?pkgos:-%{pkgos}}-devel
+BuildRequires: javapackages-tools
+BuildRequires: java-%{buildjdkver}-%{origin}%{?pkgos:-%{pkgos}}-devel
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
 # Full documentation build requirements
-# pandoc is only available on RHEL/CentOS 8
-%if 0%{?rhel} == 8
+# pandoc is not available on RHEL 7
+%if 0%{?rhel} >= 8
 BuildRequires: graphviz
 BuildRequires: pandoc
 %endif
 # cacerts build requirement in portable mode
 BuildRequires: ca-certificates
+# Earlier versions have a bug in tree vectorization on PPC
+BuildRequires: gcc >= 4.8.3-8
 
 %if %{with_systemtap}
 BuildRequires: systemtap-sdt-devel
@@ -771,10 +750,8 @@ Provides: bundled(libpng) = 1.6.43
 # Version in src/java.base/share/native/libzip/zlib/zlib.h
 Provides: bundled(zlib) = 1.3.1
 # We link statically against libstdc++ to increase portability
-%ifnarch %{devkit_arches}
 BuildRequires: libstdc++-static
 %endif
-%endif
 
 # this is always built, also during debug-only build
 # when it is built in debug-only this package is just placeholder
@@ -917,13 +894,12 @@ The %{origin_nice} %{featurever} miscellany.
 %prep
 
 echo "Preparing %{oj_vendor_version}"
-echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}"
 
 # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
-%if 0%{?stapinstall:1}
-  echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{stapinstall}"
+%if 0%{?_build_cpu:1}
+  echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{_build_cpu}"
 %else
-  %{error:Unrecognised architecture %{_target_cpu}}
+  %{error:Unrecognised architecture %{_build_cpu}}
 %endif
 
 if [ %{include_normal_build} -eq 0 -o  %{include_normal_build} -eq 1 ] ; then
@@ -987,6 +963,8 @@ sh %{SOURCE12} %{top_level_dir_name}
 pushd %{top_level_dir_name}
 # Add crypto policy and FIPS support
 %patch -P1001 -p1
+# Backport reversion
+%patch -P2001 -p1
 popd # openjdk
 
 
@@ -1032,24 +1010,8 @@ done
 # Prepare desktop files
 # Portables do not have desktop integration
 
-# Extract devkit
-%ifarch %{devkit_arches}
-  devkittarball=%{_datadir}/%{devkit_name}/sdk-%{_target_cpu}-%{_target_os}-gnu*.tar.gz
-  echo "Extracting devkit ${devkittarball}";
-  mkdir devkit;
-  tar -C devkit --strip-components=1 -xzf ${devkittarball}
-  DEVKIT_ROOT=$(pwd)/devkit
-  source ${DEVKIT_ROOT}/devkit.info
-  echo "Installed ${DEVKIT_NAME} devkit"
-%else
-%if 0%{?centos} > 0
-  echo "No devkit for CentOS %{?centos}"
-%else
-  echo "No devkit for %{_target_cpu} on RHEL %{?rhel}";
-%endif
-%endif
-
 %build
+
 # How many CPU's do we have?
 export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :)
 export NUM_PROC=${NUM_PROC:-1}
@@ -1081,12 +1043,6 @@ EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing"
 EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
 EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
 %endif
-%ifarch %{devkit_arches}
-# Remove annobin plugin reference which isn't available in the devkit
-EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')"
-EXTRA_CPP_FLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')"
-%endif
-
 export EXTRA_CFLAGS EXTRA_CPP_FLAGS
 
 # Set modification times (mtimes) of files within JAR files generated
@@ -1134,6 +1090,16 @@ export EXTRA_CFLAGS EXTRA_CPP_FLAGS
 VERSION_FILE="$(pwd)"/"%{top_level_dir_name}"/make/conf/version-numbers.conf
 OPENJDK_UPSTREAM_TAG_EPOCH="$(stat --format=%Y "${VERSION_FILE}")"
 
+echo "Building %{SOURCE11}"
+mkdir -p %{altjavaoutputdir}
+gcc ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11}
+echo "Generating %{alt_java_name} man page"
+altjavamanpage=%{altjavaoutputdir}/%{alt_java_name}.1
+echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > ${altjavamanpage}
+cat %{top_level_dir_name}/src/java.base/share/man/java.1 >> ${altjavamanpage}
+
+echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
+
 function buildjdk() {
     local outputdir=${1}
     local buildjdk=${2}
@@ -1141,16 +1107,10 @@ function buildjdk() {
     local debuglevel=${4}
     local link_opt=${5}
     local debug_symbols=${6}
-    local devkit=${7}
 
     local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name}
     local top_dir_abs_build_path=$(pwd)/${outputdir}
 
-%ifarch s390x
-    # devkit libstdc++.a fails with "error: relocation refers
-    # to local symbol "" [9], which is defined in a discarded section
-    libc_link_opt="dynamic";
-%else
     # This must be set using the global, so that the
     # static libraries still use a dynamic stdc++lib
     if [ "x%{link_type}" = "xbundled" ] ; then
@@ -1158,7 +1118,6 @@ function buildjdk() {
     else
         libc_link_opt="dynamic";
     fi
-%endif
 
     echo "Using output directory: ${outputdir}";
     echo "Checking build JDK ${buildjdk} is operational..."
@@ -1169,11 +1128,6 @@ function buildjdk() {
     echo "Using debug_symbols: ${debug_symbols}"
     echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
 
-%ifarch %{devkit_arches}
-    LIBPATH="${devkit}/lib:${devkit}/lib64"
-    echo "Setting library path to ${LIBPATH}"
-%endif
-
     mkdir -p ${outputdir}
     pushd ${outputdir}
 
@@ -1181,23 +1135,19 @@ function buildjdk() {
     # rather than ${link_opt} as the system versions
     # are always used in a system_libs build, even
     # for the static library build
-    LD_LIBRARY_PATH=${LIBPATH} \
-    bash ${top_dir_abs_src_path}/configure \
+    scl enable devtoolset-%{dtsversion} "bash ${top_dir_abs_src_path}/configure \
 %ifarch %{zero_arches}
     --with-jvm-variants=zero \
 %endif
-%ifarch %{devkit_arches}
-    --with-devkit=${devkit} \
-%endif
-    --with-cacerts-file=$(readlink -f %{_sysconfdir}/pki/java/cacerts)  \
+    --with-cacerts-file=`readlink -f %{_sysconfdir}/pki/java/cacerts`  \
     --with-version-build=%{buildver} \
-    --with-version-pre="%{ea_designator}" \
-    --with-version-opt="%{lts_designator}" \
-    --with-vendor-version-string="%{oj_vendor_version}" \
-    --with-vendor-name="%{oj_vendor}" \
-    --with-vendor-url="%{oj_vendor_url}" \
-    --with-vendor-bug-url="%{oj_vendor_bug_url}" \
-    --with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \
+    --with-version-pre=\"%{ea_designator}\" \
+    --with-version-opt=\"%{lts_designator}\" \
+    --with-vendor-version-string=\"%{oj_vendor_version}\" \
+    --with-vendor-name=\"%{oj_vendor}\" \
+    --with-vendor-url=\"%{oj_vendor_url}\" \
+    --with-vendor-bug-url=\"%{oj_vendor_bug_url}\" \
+    --with-vendor-vm-bug-url=\"%{oj_vendor_bug_url}\" \
     --with-boot-jdk=${buildjdk} \
     --with-debug-level=${debuglevel} \
     --with-native-debug-symbols="${debug_symbols}" \
@@ -1211,28 +1161,25 @@ function buildjdk() {
     --with-lcms=${link_opt} \
     --with-harfbuzz=${link_opt} \
     --with-stdc++lib=${libc_link_opt} \
-    --with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
-    --with-extra-cflags="$EXTRA_CFLAGS" \
-    --with-extra-ldflags="%{ourldflags}" \
-    --with-num-cores="$NUM_PROC" \
-    --with-source-date="version" \
+    --with-extra-cxxflags=\"$EXTRA_CPP_FLAGS\" \
+    --with-extra-cflags=\"$EXTRA_CFLAGS\" \
+    --with-extra-ldflags=\"%{ourldflags}\" \
+    --with-num-cores=\"$NUM_PROC\" \
+    --with-source-date=\"version\" \
     --disable-javac-server \
 %ifarch %{zgc_arches}
     --with-jvm-features=zgc \
 %endif
-    --disable-warnings-as-errors
+    --disable-warnings-as-errors"
 
     cat spec.gmk
-    LD_LIBRARY_PATH=${LIBPATH} \
-    make LOG=trace $maketargets || \
-        ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )
-
+    scl enable devtoolset-%{dtsversion} "make LOG=trace $maketargets || \
+        ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )"
     popd
 }
 
 function stripjdk() {
     local outputdir=${1}
-    local toolpath=${2}
     local jdkimagepath=images/%{jdkimage}
     local jreimagepath=images/%{jreimage}
     local jmodimagepath=images/jmods
@@ -1242,14 +1189,6 @@ function stripjdk() {
     local jdkoutdir=${outputdir}/${jdkimagepath}
     local jreoutdir=${outputdir}/${jreimagepath}
 
-%ifarch %{devkit_arches}
-    OBJCOPY=${toolpath}/objcopy
-    STRIP=${toolpath}/strip
-%else
-    OBJCOPY=$(which objcopy)
-    STRIP=$(which strip)
-%endif
-
     if [ "x$suffix" = "x" ] ; then
         # Keep the unstripped version for consumption by RHEL RPMs
         cp -a ${jdkoutdir}{,.unstripped}
@@ -1258,9 +1197,9 @@ function stripjdk() {
         for file in $(find ${jdkoutdir} ${jreoutdir} ${supportdir} ${modulebuildpath} -type f) ; do
             if file ${file} | cut -d ':' -f 2 | grep -q 'ELF'; then
                 noextfile=${file/.so/};
-                ${OBJCOPY} --only-keep-debug ${file} ${noextfile}.debuginfo;
-                ${OBJCOPY} --add-gnu-debuglink=${noextfile}.debuginfo ${file};
-                ${STRIP} -g ${file};
+                scl enable devtoolset-%{dtsversion} "objcopy --only-keep-debug ${file} ${noextfile}.debuginfo";
+                scl enable devtoolset-%{dtsversion} "objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file}";
+                scl enable devtoolset-%{dtsversion} "strip -g ${file}";
             fi
         done
 
@@ -1531,31 +1470,11 @@ function packagejdk() {
 
 }
 
-%ifarch %{devkit_arches}
-  DEVKIT_ROOT=$(pwd)/devkit
-  source ${DEVKIT_ROOT}/devkit.info
-  GCC="${DEVKIT_TOOLCHAIN_PATH}/gcc --sysroot=${DEVKIT_SYSROOT}"
-  LIBPATH="${DEVKIT_ROOT}/lib:${DEVKIT_ROOT}/lib64"
-%else
-  GCC=$(which gcc)
-%endif
-
-echo "Building %{SOURCE11}"
-mkdir -p %{altjavaoutputdir}
-LD_LIBRARY_PATH="${LIBPATH}" ${GCC} ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11}
-echo "Generating %{alt_java_name} man page"
-altjavamanpage=%{altjavaoutputdir}/%{alt_java_name}.1
-echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > ${altjavamanpage}
-cat %{top_level_dir_name}/src/java.base/share/man/java.1 >> ${altjavamanpage}
-
-echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
-
 %if %{build_hotspot_first}
   # Build a fresh libjvm.so first and use it to bootstrap
-  echo "Building HotSpot only for the latest libjvm.so"
   cp -LR --preserve=mode,timestamps %{bootjdk} newboot
   systemjdk=$(pwd)/newboot
-  buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal" ${DEVKIT_ROOT}
+  buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal"
   mv build/newboot/jdk/lib/%{vm_variant}/libjvm.so newboot/lib/%{vm_variant}
 %else
   systemjdk=%{bootjdk}
@@ -1598,15 +1517,15 @@ for suffix in %{build_loop} ; do
       run_bootstrap=%{bootstrap_build}
   fi
   if ${run_bootstrap} ; then
-      buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT}
+      buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols}
       installjdk ${bootbuilddir} ${bootinstalldir}
-      buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT}
-      stripjdk ${builddir} ${DEVKIT_TOOLCHAIN_PATH}
+      buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
+      stripjdk ${builddir}
       installjdk ${builddir} ${installdir}
       %{!?with_artifacts:rm -rf ${bootinstalldir}}
   else
-      buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT}
-      stripjdk ${builddir} ${DEVKIT_TOOLCHAIN_PATH}
+      buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
+      stripjdk ${builddir}
       installjdk ${builddir} ${installdir}
   fi
   packagejdk ${installdir} ${packagesdir} %{altjavaoutputdir}
@@ -1640,22 +1559,6 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
 #sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
 #${JAVA_HOME}/conf/security/java.security
 
-# Set up tools
-%ifarch %{devkit_arches}
-  DEVKIT_ROOT=$(pwd)/devkit
-  source ${DEVKIT_ROOT}/devkit.info
-  NM="${DEVKIT_TOOLCHAIN_PATH}/nm"
-%else
-  NM=$(which nm)
-%endif
-# elfutils readelf supports more binaries than binutils version on RHEL 8
-# and debug symbols tests below were designed around this version
-READELF=$(which eu-readelf)
-# Only native gdb seems to work
-# The devkit gdb needs the devkit stdc++ library but then the JVM
-# segfaults when this is on the LD_LIBRARY_PATH
-GDB=$(which gdb)
-
 # Check Shenandoah is enabled
 %if %{use_shenandoah_hotspot}
 $JAVA_HOME/bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version
@@ -1717,14 +1620,14 @@ $JAVA_HOME/bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -versi
 %endif
 
 # Check java launcher has no SSB mitigation
-if ! ${NM} $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
+if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
 
 # Check alt-java launcher has SSB mitigation on supported architectures
 # set_speculation function exists in both cases, so check for prctl call
 %ifarch %{ssbd_arches}
-${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl
+nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl
 %else
-if ! ${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi
+if ! nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi
 %endif
 
 %if %{include_staticlibs}
@@ -1732,8 +1635,8 @@ if ! ${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else
 export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
 ls -l $STATIC_LIBS_HOME
 ls -l $STATIC_LIBS_HOME/lib
-${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c
-${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c
+readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c
+readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c
 %endif
 
 # Release builds strip the debug symbols into external .debuginfo files
@@ -1752,15 +1655,15 @@ do
 
     # Test for .debug_* sections in the shared object. This is the main test
     # Stripped objects will not contain these
-    ${READELF} -S "$lib" | grep "] .debug_"
-    test $(${READELF} -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2
+    eu-readelf -S "$lib" | grep "] .debug_"
+    test $(eu-readelf -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2
 
     # Test FILE symbols. These will most likely be removed by anything that
     # manipulates symbol tables because it's generally useless. So a nice test
     # that nothing has messed with symbols
     old_IFS="$IFS"
     IFS=$'\n'
-    for line in $(${READELF} -s "$lib" | grep "00000000      0 FILE    LOCAL  DEFAULT")
+    for line in $(eu-readelf -s "$lib" | grep "00000000      0 FILE    LOCAL  DEFAULT")
     do
      # We expect to see .cpp and .S files, except for architectures like aarch64 and
      # s390 where we expect .o and .oS files
@@ -1770,17 +1673,17 @@ do
 
     # If this is the JVM, look for javaCalls.(cpp|o) in FILEs, for extra sanity checking
     if [ "`basename $lib`" = "libjvm.so" ]; then
-      ${READELF} -s "$lib" | \
+      eu-readelf -s "$lib" | \
         grep -E "00000000      0 FILE    LOCAL  DEFAULT      ABS javaCalls.(cpp|o)$"
     fi
 
     # Test that there are no .gnu_debuglink sections pointing to another
     # debuginfo file. There shouldn't be any debuginfo files, so the link makes
     # no sense either
-    ${READELF} -S "$lib" | grep 'gnu'
-    if ${READELF} -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then
+    eu-readelf -S "$lib" | grep 'gnu'
+    if eu-readelf -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then
       echo "bad .gnu_debuglink section."
-      ${READELF} -x .gnu_debuglink "$lib"
+      eu-readelf -x .gnu_debuglink "$lib"
       false
     fi
   fi
@@ -1792,7 +1695,7 @@ done
 # Using line number 1 might cause build problems. See:
 # https://bugzilla.redhat.com/show_bug.cgi?id=1539664
 # https://bugzilla.redhat.com/show_bug.cgi?id=1538767
-${GDB} -q "$JAVA_HOME/bin/java" <<EOF | tee gdb.out
+gdb -q "$JAVA_HOME/bin/java" <<EOF | tee gdb.out
 handle SIGSEGV pass nostop noprint
 handle SIGILL pass nostop noprint
 set breakpoint pending on
@@ -1939,6 +1842,15 @@ done
 %endif
 
 %changelog
+* Sat Oct 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-1
+- Update to jdk-21.0.5+10 (GA)
+- Update release notes to 21.0.5+10
+- Switch to GA mode.
+- Revert JDK-8327501 & JDK-8328366 backport until more mature.
+- ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
+- Resolves: OPENJDK-3327
+- Resolves: OPENJDK-3084
+
 * Thu Oct 10 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.9-0.1.ea
 - Update to jdk-21.0.5+9 (EA)
 - Update release notes to 21.0.5+9
@@ -1961,14 +1873,6 @@ done
 - Update to jdk-21.0.4+7 (GA)
 - Update release notes to 21.0.4+7
 - Switch to GA mode.
-- Sync with RHEL 7 portable build:
-  - Conditionally define __os_install_post, dtsversion & pkgos only on RHEL 7
-  - Use ExclusiveArch over ExcludeArch
-  - Depend on devtoolset only on RHEL 7
-  - Use javapackages-filesystem rather than manually defining _jvmdir
-  - Restrict pandoc dependency to RHEL/CentOS 8
-  - Drop unused component macro
-- Sync ExclusiveArch with devkit_arches on RHEL only
 - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
 - Resolves: OPENJDK-2756
 - Resolves: OPENJDK-3163
@@ -1978,11 +1882,11 @@ done
 - Update release notes to 21.0.4+5
 - Move unstripped, misc and doc tarball handling into normal build / no suffix blocks
 - Limit Java only tests to one architecture using jdk_test_arch
-- Drop unneeded tzdata-java build dependency following f854bb3955fb57bba4e83d09813e9cfd0e81079e
-- Resolves: OPENJDK-3133
-- Resolves: OPENJDK-3237
-- Resolves: OPENJDK-3182
-- Resolves: OPENJDK-3190
+- Drop unneeded tzdata-java build dependency following 3e3cf8fa2df7bac2f6a60a0ddd596ec39228a3e1
+- Resolves: OPENJDK-3132
+- Resolves: OPENJDK-3194
+- Resolves: OPENJDK-3181
+- Resolves: OPENJDK-3189
 
 * Sat Jun 22 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
 - Update to jdk-21.0.4+1 (EA)
@@ -1990,15 +1894,26 @@ done
 - Switch to EA mode
 - Bump LCMS 2 version to 2.16.0 following JDK-8321489
 - Add zlib build requirement or bundled version (1.3.1), depending on system_libs setting
-- Resolves: OPENJDK-3061
-- Resolves: OPENJDK-3064
+- Resolves: OPENJDK-3060
+- Resolves: OPENJDK-3063
+
+* Tue Jun 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-3
+- Re-run jlink to regenerate the jmods directory and lib/modules with stripped libraries
+- Rebuild CDS archives against the updated lib/modules
+- Resolves: OPENJDK-2829
+
+* Wed May 01 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.9-2
+- createtar: Add exclude option
+- packagejdk: Exclude debuginfo when creating jdkarchive and jrearchive tarballs
+- Resolves: OPENJDK-2995
 
 * Sat Apr 13 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
 - Update to jdk-21.0.3+9 (GA)
 - Update release notes to 21.0.3+9
 - Switch to GA mode.
-- Update buildjdkver to match the featurever
+- Change --with-source-date value to 'version' to match Temurin builds
 - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
+- Resolves: OPENJDK-2585
 
 * Thu Apr 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
 - Update to jdk-21.0.3+7 (EA)
@@ -2008,7 +1923,32 @@ done
 - Drop JDK-8009550 which is now available upstream
 - Re-generate FIPS patch against 21.0.3+7 following backport of JDK-8325254
 
-* Wed Mar 20 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.1.ea
+* Thu Mar 21 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.2.ea
+- generate_source_tarball.sh: Update examples in header for clarity
+- generate_source_tarball.sh: Cleanup message issued when checkout already exists
+- generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
+- generate_source_tarball.sh: Only add --depth=1 on non-local repositories
+- icedtea_sync.sh: Reinstate from rhel-8.9.0 branch
+- Move maintenance scripts to a scripts subdirectory
+- discover_trees.sh: Set compile-command and indentation instructions for Emacs
+- discover_trees.sh: shellcheck: Do not use -o (SC2166)
+- discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
+- generate_source_tarball.sh: Add authorship
+- icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
+- icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
+- icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: Set compile-command and indentation instructions for Emacs
+- openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
+- openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
+- generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
+- generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
+- Vary reproducible tar creation by version of tar detected
+- Set OPENJDK_UPSTREAM_TAG_EPOCH & VERSION_FILE at start of build section as in 17u
+- generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
+
+* Wed Mar 20 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.2.ea
 - generate_source_tarball.sh: Add WITH_TEMP environment variable
 - generate_source_tarball.sh: Multithread xz on all available cores
 - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
@@ -2037,83 +1977,54 @@ done
 - generate_source_tarball.sh: Add license
 - generate_source_tarball.sh: Add indentation instructions for Emacs
 - Remove -T0 argument from systemtap tar invocation
+
+* Mon Mar 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.2.ea
+- Introduce tar_opts to avoid repetition of lengthy tar creation options
+- Add module build path to stripped directories to catch jpackageapplauncher files
+- Move alt-java man page to the misc tarball so it is not in the JDK image
+- Resolves: OPENJDK-2820
+- Resolves: OPENJDK-2821
+
+* Thu Feb 08 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.2.ea
+- Invoke xz in multi-threaded mode
+- Remove ppc64le with-jobs=1 workaround
+- Make portable tarball modification times reproducible
 - Use RHEL-7 tar-1.26-compatible invocations for reproducible tarballs
-- createtar: Add exclude option
-- packagejdk: Exclude debuginfo when creating jdkarchive and jrearchive tarballs
-- Resolves: OPENJDK-2995
 
-* Mon Mar 18 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
+* Fri Feb 02 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
 - Update to jdk-21.0.3+1 (EA)
 - Update release notes to 21.0.3+1
 - Switch to EA mode
 - Require tzdata 2023d due to upstream inclusion of JDK-8322725
 - Bump FreeType version to 2.13.2 following JDK-8316028
-- Add module build path to stripped directories to catch jpackageapplauncher files
-- Move alt-java man page to the misc tarball so it is not in the JDK image
-- generate_source_tarball.sh: Update examples in header for clarity
-- generate_source_tarball.sh: Cleanup message issued when checkout already exists
-- generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
-- generate_source_tarball.sh: Only add --depth=1 on non-local repositories
-- icedtea_sync.sh: Reinstate from rhel-8.9.0 branch
-- Move maintenance scripts to a scripts subdirectory
-- discover_trees.sh: Set compile-command and indentation instructions for Emacs
-- discover_trees.sh: shellcheck: Do not use -o (SC2166)
-- discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
-- discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
-- generate_source_tarball.sh: Add authorship
-- icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
-- icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
-- icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
-- openjdk_news.sh: Set compile-command and indentation instructions for Emacs
-- openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
-- openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
-- openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
-- generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
-- generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
-- generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
-- Vary reproducible tar creation by version of tar detected
-- Set OPENJDK_UPSTREAM_TAG_EPOCH & VERSION_FILE at start of build section as in 17u
-- Change --with-source-date value to 'version' to match Temurin builds
-- Re-run jlink to regenerate the jmods directory and lib/modules with stripped libraries
-- Rebuild CDS archives against the updated lib/modules
-- Require openjdk-devkit 1.0-4 to bring in fixes for .comment section and deterministic archives
-- Bump devkit requirement to 1.0-5 to bring in the bootstrapped version
-- Set LD_LIBRARY_PATH when calling gcc to build alt-java
-- Set LD_LIBRARY_PATH when calling configure
-- Set LD_LIBRARY_PATH when calling make
-- Bump devkit requirement to 1.0-6 to bring in the AS=<path>/as fix
-- Resolves: OPENJDK-2820
-- Resolves: OPENJDK-2821
-- Resolves: OPENJDK-2585
-- Resolves: OPENJDK-3138
 
-* Fri Mar 15 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
+* Sat Jan 27 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-2
+- Sync with upstream release notes
+
+* Tue Jan 09 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
 - Update to jdk-21.0.2+13 (GA)
 - Update release notes to 21.0.2+13
+- Drop no longer needed local patch to fix versioning
+- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
+
+* Mon Jan 08 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.12-1
+- Update to jdk-21.0.2+12 (GA)
+- Update release notes to 21.0.2+12
+- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
+
+* Sat Jan 06 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.11-1
+- Update to jdk-21.0.2+11 (GA)
+- Update release notes to 21.0.2+11
 - Bump libpng version to 1.6.40 following JDK-8316030
 - Bump HarfBuzz version to 8.2.2 following JDK-8313643
-- pandoc is only available on RHEL/CentOS 8
-- Check for CentOS being defined to determine use of devkit
-- Set buildjdkver to 20 until OpenJDK 21 is available in the buildroot
-- Use featurever for JDK build dependencies
-
-* Mon Mar 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-2
-- Use a devkit to build on architectures where we have one (s390x, aarch64, ppc64le, x86_64)
-- Use a dynamic libstdc++ on s390x to workaround failure with static libstdc++
-- Use the devkit tools during the check stage so they can understand the generated binaries
-- Use eu-readelf on devkit and non-devkit builds as debug symbol tests rely on its behaviour
-- Use system gdb for both builds as devkit version fails (needs devkit libraries, then JDK segfaults with them)
-- Filter out annobin plugin when using the devkit
-- Drop static libstdc++ build dependency on devkit builds as it should come from the devkit
-- Disable devkit build on CentOS where it is unavailable
-- Introduce tar_opts to avoid repetition of lengthy tar creation options
+- Drop local JDK-8311630 patch which is now upstream
+- Locally patch versioning to be 21.0.2 released on 2014-01-16
+- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
 
-* Thu Feb 08 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.1.0.12-2
-- Invoke xz in multi-threaded mode
-- Remove ppc64le with-jobs=1 workaround
-- Make portable tarball modification times reproducible
+* Mon Nov 06 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-2
+- Include JDK-8311630 patch to implement Foreign Function & Memory preview API on s390x
 
-* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
+* Sun Oct 29 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
 - Update to jdk-21.0.1.0+12 (GA)
 - Update release notes to 21.0.1.0+12
 - Update openjdk_news script to specify subdirectory last
@@ -2123,33 +2034,17 @@ done
 - Update bug URL for RHEL to point to the Red Hat customer portal
 - Fix upstream release URL for OpenJDK source
 - Update buildjdkver to match the featurever
-
-* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-4
-- Rebuild jmods using the stripped binaries in release builds
-- Make sure the unstripped JDK is customised by the installjdk function
-- Resolves: OPENJDK-3224
-
-* Thu Oct 26 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-3
 - Re-enable SystemTap support and perform only substitutions possible without final NVR available
-- Depend on graphviz & pandoc for full documentation support
 - Fix typo which stops the EA designator being included in the build
 - Include tapsets in the miscellaneous tarball
 - Drop unused globals for tapset installation
+- Rebuild jmods using the stripped binaries in release builds
+- Make sure the unstripped JDK is customised by the installjdk function
 
-* Thu Aug 24 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-2
-- Update documentation (README.md, add missing JEP to release notes)
-- Replace alt-java patch with a binary separate from the JDK
-- Adapt alt-java test to new binary where there is always a set_speculation function
-- Drop stale patches that are of little use any more:
-- * nss.cfg has been disabled since early PKCS11 work and long superseded by FIPS work
-- * No accessibility subpackage to warrant RH1648242 patch any more
-- * No use of system libjpeg turbo to warrant RH649512 patch any more
-- Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
-- Related: rhbz#2192749
-
-* Mon Aug 21 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
+* Sat Oct 28 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
 - Update to jdk-21.0.0+35
 - Update release notes to 21.0.0+35
+- Update documentation (README.md)
 - Update system crypto policy & FIPS patch from new fips-21u tree
 - Update generate_tarball.sh to sync with upstream vanilla script inc. no more ECC removal
 - Drop fakefeaturever now it is no longer needed
@@ -2157,39 +2052,42 @@ done
 - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
 - Use upstream release URL for OpenJDK source
 - Re-enable tzdata tests now we are on the latest JDK and things are back in sync
-- Related: rhbz#2192749
+- Fix trailing '.' in tarball name
+- Use rpmrelease in vendor version to avoid inclusion of dist tag
+- Replace alt-java patch with a binary separate from the JDK
+- Drop stale patches that are of little use any more:
+- * nss.cfg has been disabled since early PKCS11 work and long superseded by FIPS work
+- * No accessibility subpackage to warrant RH1648242 patch any more
+- * No use of system libjpeg turbo to warrant RH649512 patch any more
+- Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
 
-* Mon Aug 21 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
+* Sat Oct 28 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
 - Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
 - Related: rhbz#2192749
 
-* Wed Aug 16 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.2.0.9-1
+* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.2.0.9-1.1
 - Update to jdk-20.0.2+9
 - Update release notes to 20.0.2+9
 - Update system crypto policy & FIPS patch from new fips-20u tree
 - Update generate_tarball.sh ICEDTEA_VERSION
 - Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
+- Related: rhbz#2192749
 
-* Wed Aug 16 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.2.0.9-1
+* Fri Oct 27 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.0.0.36-1
 - Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
 - Adapted rh1750419-redhat_alt_java.patch
+- Related: rhbz#2192749
 
-* Tue Aug 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.2.0.7-2
-- Bump rpmrelease to rebuild for CentOS 9
-
-* Tue Aug 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.2.0.7-1
+* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.1.0.10-1
 - Update to jdk-19.0.2 release
 - Update release notes to 19.0.2
 - Rebase FIPS patches from fips-19u branch
 - Remove references to sample directory removed by JDK-8284999
 - Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag
 - Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases
-- Switch buildjdkver to java-21-openjdk
-
-* Thu Aug 10 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-2
-- Bump rpmrelease to rebuild for CentOS 9
+- Related: rhbz#2192749
 
-* Thu Aug 10 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
+* Tue Oct 24 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
 - Update to jdk-18.0.2 release
 - Update release notes to actually reflect OpenJDK 18
 - Support JVM variant zero following JDK-8273494 no longer installing Zero's libjvm.so in the server directory
@@ -2197,20 +2095,27 @@ done
 - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
 - Automatically turn off building a fresh HotSpot first, if the bootstrap JDK is not the same major version as that being built
 - Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
+- Switch bootjdkver to java-21-openjdk
 - Disable tzdata tests until we are on the latest JDK and things are back in sync
+- Drop bootstrap JDKs and use the java-21-openjdk-rhel7 build
+- Related: rhbz#2192749
 
-* Thu Aug 10 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.0.0.37-1
+* Tue Oct 24 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.0.0.37-1
 - Update to ea version of jdk18
 - Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
 
-* Mon May 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-3
-- Bump rpmrelease to rebuild for CentOS 9
+* Tue Aug 22 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
+- Define architectures we build on to avoid those without DTS 10 (e.g. s390)
+
+* Tue Aug 22 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
+- Switch to DTS 10
+- Related: rhbz#2192749
 
 * Mon May 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
 - Create java-21-openjdk-portable package based on java-17-openjdk-portable
 - Related: rhbz#2192749
 
-* Tue Apr 25 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
+* Thu Apr 13 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-1
 - Update to jdk-17.0.7.0+7
 - Update release notes to 17.0.7.0+7
 - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
@@ -2223,20 +2128,12 @@ done
 - * test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
 - * RH1940064: Enable XML Signature provider in FIPS mode
 - * RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
-- Fix trailing '.' in tarball name
-- Use rpmrelease in vendor version to avoid inclusion of dist tag
 - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
 - Resolves: rhbz#2185182
 - Resolves: rhbz#2134669
 - Resolves: rhbz#1940064
 - Resolves: rhbz#2173781
 
-* Thu Apr 20 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-7
-- Sync with existing RHEL 8 build, in order to start building portables on RHEL 8
-- Restore system bootstrap JDK (RHEL 8 has java-17-openjdk)
-- Remove use of devtoolset (RHEL 8 native compilers should be sufficient)
-- Explicitly exclude x86, as on RHEL RPMs
-
 * Tue Feb 21 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-6
 - Add docs, icons and samples to the portable output
 - Make sure generated checksums work and don't include full path
diff --git a/SOURCES/jdk8327501-8328366-revert.patch b/SOURCES/jdk8327501-8328366-revert.patch
new file mode 100644
index 0000000000000000000000000000000000000000..ea5eb16a9882134e03323b869e5f14b9ec160429
--- /dev/null
+++ b/SOURCES/jdk8327501-8328366-revert.patch
@@ -0,0 +1,49 @@
+commit f21b0a990905afe79b56919a5119e2c06e29d61a
+Author: Andrew John Hughes <gnu_andrew@member.fsf.org>
+Date:   Sat Oct 12 02:31:38 2024 +0100
+
+    Revert "8327501: Common ForkJoinPool prevents class unloading in some cases"
+    
+    This reverts commit eb103b0e1abeeee19779cafc763d3d159030fb48.
+
+diff --git a/src/java.base/share/classes/java/util/concurrent/ForkJoinPool.java b/src/java.base/share/classes/java/util/concurrent/ForkJoinPool.java
+index 8aafda5312e..5e698b1540f 100644
+--- a/src/java.base/share/classes/java/util/concurrent/ForkJoinPool.java
++++ b/src/java.base/share/classes/java/util/concurrent/ForkJoinPool.java
+@@ -981,7 +981,9 @@ public class ForkJoinPool extends AbstractExecutorService {
+             boolean isCommon = (pool.workerNamePrefix == null);
+             @SuppressWarnings("removal")
+             SecurityManager sm = System.getSecurityManager();
+-            if (sm != null && isCommon)
++            if (sm == null)
++                return new ForkJoinWorkerThread(null, pool, true, false);
++            else if (isCommon)
+                 return newCommonWithACC(pool);
+             else
+                 return newRegularWithACC(pool);
+diff --git a/test/jdk/java/util/concurrent/tck/ForkJoinPool9Test.java b/test/jdk/java/util/concurrent/tck/ForkJoinPool9Test.java
+index a87aa7b916b..266c2a036fe 100644
+--- a/test/jdk/java/util/concurrent/tck/ForkJoinPool9Test.java
++++ b/test/jdk/java/util/concurrent/tck/ForkJoinPool9Test.java
+@@ -79,9 +79,6 @@ public class ForkJoinPool9Test extends JSR166TestCase {
+             assertSame(ForkJoinPool.commonPool(), ForkJoinTask.getPool());
+             Thread currentThread = Thread.currentThread();
+ 
+-            ClassLoader preexistingContextClassLoader =
+-                    currentThread.getContextClassLoader();
+-
+             Stream.of(systemClassLoader, null).forEach(cl -> {
+                 if (randomBoolean())
+                     // should always be permitted, without effect
+@@ -98,11 +95,6 @@ public class ForkJoinPool9Test extends JSR166TestCase {
+                     () -> System.getProperty("foo"),
+                     () -> currentThread.setContextClassLoader(
+                         classLoaderDistinctFromSystemClassLoader));
+-            else {
+-                currentThread.setContextClassLoader(classLoaderDistinctFromSystemClassLoader);
+-                assertSame(currentThread.getContextClassLoader(), classLoaderDistinctFromSystemClassLoader);
+-                currentThread.setContextClassLoader(preexistingContextClassLoader);
+-            }
+             // TODO ?
+ //          if (haveSecurityManager
+ //              && Thread.currentThread().getClass().getSimpleName()
diff --git a/SPECS/java-21-openjdk.spec b/SPECS/java-21-openjdk.spec
index f0563b954e122b1571c9c6aae6c0c7e132361e0b..96368e0da254c120da129fc970299febc4b90e79 100644
--- a/SPECS/java-21-openjdk.spec
+++ b/SPECS/java-21-openjdk.spec
@@ -102,9 +102,9 @@
 # similarly for other %%{_jvmdir}/{jre,java} and %%{_javadocdir}/{java,java-zip}
 %define is_release_build() %( if [ "%{?1}" == "%{debug_suffix_unquoted}" -o "%{?1}" == "%{fastdebug_suffix_unquoted}" ]; then echo "0" ; else echo "1"; fi )
 
-# Indicates whether this is the default JDK on this version of RHEL
-# Only the default/system JDK provides unversioned Provides like 'java', 'jre' and 'java-devel'
-%global is_system_jdk 1
+# while JDK is a techpreview(is_system_jdk=0), some provides are turned off. Once jdk stops to be an techpreview, move it to 1
+# as sytem JDK, we mean any JDK which can run whole system java stack without issues (like bytecode issues, module issues, dependencies...)
+%global is_system_jdk 0
 
 %global aarch64         aarch64 arm64 armv8
 # we need to distinguish between big and little endian PPC64
@@ -365,8 +365,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        9
-%global rpmrelease      1
+%global buildver        10
+%global rpmrelease      3
 # Settings used by the portable build
 %global portablerelease 1
 # Portable suffix differs between RHEL and CentOS
@@ -394,7 +394,7 @@
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
 # - N%%{?extraver}{?dist} for GA releases
-%global is_ga           0
+%global is_ga           1
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
@@ -1420,6 +1420,8 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch
 # OpenJDK patches in need of upstreaming
 #
 #############################################
+# Revert backport of JDK-8327501 & JDK-8328366
+Patch2001: jdk8327501-8328366-revert.patch
 
 # Currently empty
 
@@ -1895,6 +1897,8 @@ sh %{SOURCE12} %{top_level_dir_name}
 pushd %{top_level_dir_name}
 # Add crypto policy and FIPS support
 %patch -P1001 -p1
+# Backport reversion
+%patch -P2001 -p1
 popd # openjdk
 
 
@@ -2532,7 +2536,20 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
-* Fri Oct 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.9-0.1.ea
+* Sun Oct 13 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-3
+- Sync the copy of the portable specfile with the latest update
+- ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
+- Related: RHEL-61344
+
+* Sat Oct 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-2
+- Update to jdk-21.0.5+10 (GA)
+- Update release notes to 21.0.5+10
+- Switch to GA mode.
+- Revert JDK-8327501 & JDK-8328366 backport until more mature.
+- ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
+- Resolves: RHEL-61344
+
+* Fri Oct 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.9-0.2.ea
 - Update to jdk-21.0.5+9 (EA)
 - Update release notes to 21.0.5+9
 - Switch to EA mode
@@ -2541,32 +2558,35 @@ cjc.mainProgram(args)
 - Sync with RHEL 7 portable build:
   - Use ExclusiveArch over ExcludeArch
   - pkgos definition needs to be early enough to be used in portablesuffix
-- Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
 - Make build scripts executable
 - Sync the copy of the portable specfile with the latest update
-- Resolves: RHEL-62239
-- Resolves: RHEL-62241
+- Resolves: RHEL-58797
+- Resolves: RHEL-17191
 
-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
+* Mon Oct 07 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-2
+- Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
+- Handle debugedit being a separate package installed in /usr on RHEL/CentOS 10
+- Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
+- Related: RHEL-58797
+
+* Fri Jul 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
 - Update to jdk-21.0.4+7 (GA)
 - Update release notes to 21.0.4+7
 - Switch to GA mode.
 - Sync the copy of the portable specfile with the latest update
 - Add missing section headers in NEWS
-- Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
 - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
-- Resolves: RHEL-47024
+- Resolves: RHEL-47023
 
-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.5-0.1.ea
+* Wed Jun 26 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.5-0.1.ea
 - Update to jdk-21.0.4+5 (EA)
 - Update release notes to 21.0.4+5
 - Limit Java only tests to one architecture using jdk_test_arch
 - Actually require tzdata 2024a now it is available in the buildroot
-- Resolves: RHEL-45357
-- Resolves: RHEL-52735
-- Related: RHEL-52723
+- Resolves: RHEL-45355
+- Resolves: RHEL-47395
 
-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
+* Sat Jun 22 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
 - Update to jdk-21.0.4+1 (EA)
 - Update release notes to 21.0.4+1
 - Switch to EA mode
@@ -2574,27 +2594,27 @@ cjc.mainProgram(args)
 - Add zlib build requirement or bundled version (1.3.1), depending on system_libs setting
 - Restore NEWS file so portable can be rebuilt
 - Sync the copy of the portable specfile with the latest update
-- Related: RHEL-45357
-- Resolves: RHEL-46026
+- Related: RHEL-45355
+- Resolves: RHEL-46029
 
-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
 - Update to jdk-21.0.3+9 (GA)
 - Update release notes to 21.0.3+9
 - Switch to GA mode.
 - Sync the copy of the portable specfile with the latest update
 - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
-- Resolves: RHEL-32427
+- Resolves: RHEL-32424
 
-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
 - Update to jdk-21.0.3+7 (EA)
 - Update release notes to 21.0.3+7
 - Require tzdata 2024a due to upstream inclusion of JDK-8322725
 - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
 - Drop JDK-8009550 which is now available upstream
 - Re-generate FIPS patch against 21.0.3+7 following backport of JDK-8325254
-- Resolves: RHEL-52723
+- Resolves: RHEL-30946
 
-* Sat Aug 03 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.1.ea
+* Sun Apr 14 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.2.ea
 - Invoke xz in multi-threaded mode
 - generate_source_tarball.sh: Add WITH_TEMP environment variable
 - generate_source_tarball.sh: Multithread xz on all available cores
@@ -2623,14 +2643,9 @@ cjc.mainProgram(args)
 - generate_source_tarball.sh: Use long-style argument to grep
 - generate_source_tarball.sh: Add license
 - generate_source_tarball.sh: Add indentation instructions for Emacs
-- Related: RHEL-52723
+- Related: RHEL-30946
 
-* Sat Aug 03 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
-- Update to jdk-21.0.3+1 (EA)
-- Update release notes to 21.0.3+1
-- Switch to EA mode
-- Require tzdata 2023d due to local inclusion of JDK-8322725
-- Bump FreeType version to 2.13.2 following JDK-8316028
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.2.ea
 - Install alt-java man page from the misc tarball as it is no longer in the JDK image
 - generate_source_tarball.sh: Update examples in header for clarity
 - generate_source_tarball.sh: Cleanup message issued when checkout already exists
@@ -2652,18 +2667,19 @@ cjc.mainProgram(args)
 - generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
 - generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
 - generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
-- Related: RHEL-52723
+- Related: RHEL-30946
 
-* Tue Jul 30 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-3
-- Fix gating.yaml to reference RHEL 10
-- Set this to be the default/system JDK providing 'java', 'jre', 'java-devel' ,etc.
-- Resolves: RHEL-34597
-- Resolves: RHEL-51617
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
+- Update to jdk-21.0.3+1 (EA)
+- Update release notes to 21.0.3+1
+- Switch to EA mode
+- Require tzdata 2023d due to upstream inclusion of JDK-8322725
+- Bump FreeType version to 2.13.2 following JDK-8316028
+- Related: RHEL-30946
 
 * Fri Apr 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-2
 - Define portablesuffix according to whether pkgos is defined or not
-- Handle debugedit being a separate package installed in /usr on RHEL/CentOS 10
-- Related: RHEL-45217
+- Related: RHEL-30946
 
 * Tue Jan 09 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
 - Update to jdk-21.0.2+13 (GA)
@@ -2672,16 +2688,16 @@ cjc.mainProgram(args)
 - Bump HarfBuzz version to 8.2.2 following JDK-8313643
 - Drop local JDK-8311630 patch which is now upstream
 - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
-- Resolves: RHEL-45217
+- Resolves: RHEL-20999
 
 * Mon Nov 06 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-3
 - Include JDK-8311630 patch to implement Foreign Function & Memory preview API on s390x
 - Sync the copy of the portable specfile with the latest update
-- Related: RHEL-45217
+- Resolves: RHEL-16290
 
 * Mon Oct 30 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-2
 - Define pkgnameroot to simplify build requirements and allow '-rhel7' suffix on RHEL
-- Related: RHEL-45217
+- Related: RHEL-12998
 
 * Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
 - Update to jdk-21.0.1.0+12 (GA)
@@ -2703,15 +2719,21 @@ cjc.mainProgram(args)
 - Add missing jfr, jpackage and jwebserver alternative ghosts
 - Move jcmd to the headless package
 - Revert alt-java binary location to being within the JDK tree
-- Related: RHEL-45217
+- Resolves: RHEL-12998
+- Resolves: RHEL-14953
+- Resolves: RHEL-13925
+- Resolves: RHEL-14957
+- Related: RHEL-14945
+- Resolves: RHEL-11321
+- Resolves: RHEL-14947
 
 * Fri Oct 27 2023 Jiri Vanek <jvanek@redhat.com> - 1:21.0.1.0.12-1
 - Exclude classes_nocoops.jsa on i686 and arm32
-- Related: RHEL-45217
+- Related: RHEL-14945
 
 * Fri Oct 27 2023 Severin Gehwolf <sgehwolf@redhat.com> - 1:21.0.1.0.12-1
 - Fix packaging of CDS archives
-- Resolves: RHEL-45217
+- Resolves: RHEL-14945
 
 * Thu Aug 24 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-2
 - Update documentation (README.md)
@@ -2722,7 +2744,7 @@ cjc.mainProgram(args)
 - * No use of system libjpeg turbo to warrant RH649512 patch any more
 - Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
 - Adapt alt-java test to new binary where there is always a set_speculation function
-- Related: RHEL-45217
+- Related: RHEL-12998
 
 * Mon Aug 21 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
 - Update to jdk-21.0.0+35
@@ -2734,11 +2756,12 @@ cjc.mainProgram(args)
 - Re-enable tzdata tests now we are on the latest JDK and things are back in sync
 - Install jaxp.properties introduced by JDK-8303530
 - Install lible.so introduced by JDK-8306983
-- Related: RHEL-45217
+- Related: RHEL-12998
+- Resolves: RHEL-41087
 
 * Mon Aug 21 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
 - Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
-- Related: RHEL-45217
+- Related: RHEL-12998
 
 * Wed Aug 16 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.0.0.36-1
 - Update to jdk-20.0.2+9
@@ -2746,12 +2769,12 @@ cjc.mainProgram(args)
 - Update system crypto policy & FIPS patch from new fips-20u tree
 - Update generate_tarball.sh ICEDTEA_VERSION
 - Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
-- Related: RHEL-45217
+- Related: RHEL-12998
 
 * Wed Aug 16 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.0.0.36-1
 - Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
 - Adapted rh1750419-redhat_alt_java.patch
-- Related: RHEL-45217
+- Related: RHEL-12998
 
 * Tue Aug 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.1.0.10-1
 - Update to jdk-19.0.2 release
@@ -2760,7 +2783,7 @@ cjc.mainProgram(args)
 - Remove references to sample directory removed by JDK-8284999
 - Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag
 - Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases
-- Related: RHEL-45217
+- Related: RHEL-12998
 
 * Thu Aug 10 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
 - Update to jdk-18.0.2 release
@@ -2771,26 +2794,26 @@ cjc.mainProgram(args)
 - Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
 - Disable tzdata tests until we are on the latest JDK and things are back in sync
 - Use empty nss.fips.cfg until it is again available via the FIPS patch
-- Related: RHEL-45217
+- Related: RHEL-12998
 
 * Thu Aug 10 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.2.0.9-1
 - Update to ea version of jdk18
 - Add new slave jwebserver and corresponding manpage
 - Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
-- Related: RHEL-45217
+- Related: RHEL-12998
 
 * Thu Aug 10 2023 FeRD (Frank Dana) <ferdnyc@gmail.com> - 1:18.0.2.0.9-1
 - Add javaver- and origin-specific javadoc and javadoczip alternatives.
-- Related: RHEL-45217
+- Related: RHEL-12998
 
 * Tue Aug 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
 - Set portablerelease and portablerhel to use the CentOS 9 build
-- Related: RHEL-45217
+- Related: RHEL-12998
 
 * Tue Aug 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
 - Add files missed by centpkg import.
-- Related: RHEL-45217
+- Related: rhbz#2192748
 
 * Fri Aug 04 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-3
 - Create java-21-openjdk package based on java-17-openjdk
-- Related: RHEL-45217
+- Related: rhbz#2192748