Update to libX11 1.8.10. tested by and ok rsadowski@

25 files changed, 988 insertions, 95 deletions

diff --git a/lib/libX11/ChangeLog b/lib/libX11/ChangeLog
index c314f0a9a..49b87dec4 100644
--- a/lib/libX11/ChangeLog
+++ b/lib/libX11/ChangeLog
@@ -1,3 +1,562 @@
+commit ed9fb5535efe1e5278654b6b3994a34337b4bf1a
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sun Jul 28 10:37:55 2024 -0700
+
+    libX11 1.8.10
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+commit 92014b39634e0b0aa52d4bff955a7aac3ed0a915
+Author: Kelly Roadkill <roadkell@pm.me>
+Date:   Tue Jul 23 08:12:01 2024 +0500
+
+    Revert "nls: add compose seq's for symbols absent from Cyrillic layouts to ru_RU"
+    
+    Testing by multilingual typists revealed that the
+    proposed sequences are too complex for everyday
+    use. It seems that the inherent problems with
+    JCUKEN can only be fixed with better kbd layouts.
+    
+    This reverts commit 174df0b8b6ada7e1c741373c7d686e00f42d8bd5.
+    
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/261>
+
+commit be137dffa6f0b7640ce80b4266539009544bb045
+Author: Kelly Roadkill <roadkell@pm.me>
+Date:   Fri Jul 19 16:47:40 2024 +0500
+
+    nls: add compose sequences for hryvnia currency
+    
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/259>
+
+commit 39d57cbeda627115f7e8bd305b6cbd9df1daa007
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Jul 13 10:14:02 2024 -0700
+
+    xlibi18n/lcFile.c: avoid use of possibly-NULL pointer with strcpy
+    
+    Fixes gcc warnings:
+    lcFile.c: In function ‘_XlcLocaleLibDirName’:
+    lcFile.c:708:5: warning: use of possibly-NULL ‘last_dir_name’ where
+     non-null expected [CWE-690] [-Wanalyzer-possible-null-argument]
+      708 |     strcpy (last_dir_name, dir_name);
+          |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/258>
+
+commit 8abcaba1a7ee363a35ad8d869715095096995c76
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat Jul 6 09:37:50 2024 -0700
+
+    Revert "unifdef __vax__"
+    
+    This reverts commit 4ce3962b701c502acc96b6eaf104a5ffc317c5d7.
+    Requested by NetBSD which still has a supported VAX port.
+    
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/257>
+
+commit 751fbc59c30604980fdd19cb4b333d3cf2eccb24
+Author: Olivier Fourdan <ofourdan@redhat.com>
+Date:   Fri Jun 21 14:37:24 2024 +0200
+
+    Fix deadlock in XRebindKeysym()
+    
+    Xlib is now built with threading support enabled from the constructor
+    by default.
+    
+    XRebindKeysym() acquires the display lock, then calls:
+    
+    | XRebindKeysym()
+    |  LockDisplay()
+    |  ComputeMaskFromKeytrans()
+    |    -> XkbKeysymToModifiers()
+    |        -> _XkbLoadDpy()
+    |            -> XkbGetMap()
+    |                -> XkbGetUpdatedMap()
+    |                   LockDisplay()
+    
+    And the dead lock:
+    
+    | Xlib ERROR: XKBGetMap.c line 575 thread 1fc6e580: locking display already
+    | locked at KeyBind.c line 937
+    
+    To avoid the issue, call ComputeMaskFromKeytrans() from outside the display
+    lock.
+    
+    Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+    Closes: https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/216
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/256>
+
+commit bc8c908ae8007d0bfe9b58c7752dd00fd282d999
+Author: Kelly Roadkill <roadkell@pm.me>
+Date:   Tue Jun 18 14:49:50 2024 +0500
+
+    nls: delete compose sequence with anomalous post-fixed cedilla
+    
+    The only sequence with post-fixed cedilla in the
+    whole en_US.UTF-8 was introduced in cf040016 with
+    the merge of GTK+ compose sequences 12 years ago.
+    It goes against the established patterns.
+    
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/255>
+
+commit 1472048b7a02d1b7fc25cfeda761db23fba21eac
+Author: Olivier Fourdan <ofourdan@redhat.com>
+Date:   Fri Jun 7 09:05:55 2024 +0200
+
+    Make colormap private interfaces thread safe.
+    
+    Protect access to the dpy structure by a display lock, so that these can
+    be called outside of a global display lock.
+    
+    That allows the XCMS colormap functions to be thread safe without having
+    the whole functions within a display lock, to avoid deadlocks.
+    
+    Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+    See-also: https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/215
+    See-also: https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/94
+    Reviewed-by: Adam Jackson <ajax@redhat.com>
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/254>
+
+commit 739fce4c12c7aa39112353d80c8a3bf25bdd5274
+Author: Olivier Fourdan <ofourdan@redhat.com>
+Date:   Fri Jun 7 09:07:39 2024 +0200
+
+    Revert "Protect colormap add/removal with display lock"
+    
+    That commit 99a2cf1aa was moving the calls to the _Xcms*CmapRec*()
+    family of functions within a display lock to make the XCMS colormap
+    functions thread safe.
+    
+    Unfortunately, that causes a deadlock in XCopyColormapAndFree(), because
+    _XcmsCopyCmapRecAndFree() calls CmapRecForColormap() which calls
+    XGetVisualInfo() which also tries to acquire the display lock.
+    
+    So, instead of moving the entire functions within the display lock,
+    let's try to make the functions themselves thread safe in the following
+    commit, and revert this change which causes a deadlock.
+    
+    This reverts commit 99a2cf1aa0b58391078d5d3edf0a7dab18c7745d.
+    
+    Fixes: https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/215
+    See-also: https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/94
+    Reviewed-by: Adam Jackson <ajax@redhat.com>
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/254>
+
+commit 5dfedaf4aa1a032ea6cb4e871abd2e065f798129
+Author: Olivier Fourdan <ofourdan@redhat.com>
+Date:   Thu Jun 6 16:25:26 2024 +0200
+
+    Revert "Fix XTS regression in XCopyColormapAndFree"
+    
+    This change was to fix the next change that we are to revert as well.
+    
+    This reverts commit 68c72a7341b114277ab232f2499ee3bd035af8a0.
+    
+    Reviewed-by: Adam Jackson <ajax@redhat.com>
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/254>
+
+commit c099d0105f7a4f969cf922f333cb54c177aceacb
+Author: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date:   Sat May 18 11:41:36 2024 -0700
+
+    Avoid buffer overflow in _XimLookupMBText & _XimLookupUTF8Text
+    
+    Reported-by: u32i <u32i@proton.me>
+    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/251>
+
+commit 0af3328dc330cbd8e097e2971b336b44466b1ab0
+Author: jmcwilliams403 <jmcwilliams403@gmail.com>
+Date:   Sun Jul 16 11:31:22 2023 -0400
+
+    NLS: Add 6 Multi_key sequences for Ezh
+    
+    Ezh is a Latin-Script letter belonging to several Uralic, Caucasian,
+    and West-African languages. It is present on some Finnish keyboards,
+    but users of many other layouts cannot presently type it. This commit
+    adds Multi_key sequences for both Capital and lowercase Ezh, as well
+    as Multi_key + dead_caron sequences for Ezh with a caron, which is
+    used in Laz and Skolt Sámi.
+    
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/221>
+
+commit 174df0b8b6ada7e1c741373c7d686e00f42d8bd5
+Author: Kelly Roadkill <roadkell@pm.me>
+Date:   Sun Dec 3 00:53:55 2023 +0500
+
+    nls: add compose seq's for symbols absent from Cyrillic layouts to ru_RU
+    
+    JCUKEN (ЙЦУКЕН) - the default and de-facto standard layout for most Cyrillic scripts - lacks a number of ASCII symbols from QWERTY counterpart, forcing users to switch back-and-forth between layouts to type them.
+    This adds sequences for them to the ru_RU compose map in an intuitive and consistent manner.
+    
+    Fixes #200 for ru_RU (but other Cyrillic layouts might benefit too)
+    
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/238>
+
+commit 763f3f938c24993e9ceb1d6960d939b022fa8dfe
+Author: Mohamed Akram <mohd.akram@outlook.com>
+Date:   Fri May 24 18:18:43 2024 +0400
+
+    nls: add Arabic hamza compose sequences
+    
+    These sequences are intended for use in the ara(mac-phonetic) and
+    my(phonetic) layouts. They are based on the following layouts listed in
+    the CLDR:
+    
+    - https://github.com/unicode-org/cldr/blob/release-43/keyboards/osx/ar-t-k0-osx-qwerty.xml
+    - https://github.com/unicode-org/cldr/blob/release-43/keyboards/osx/ms-t-k0-osx.xml
+    
+    The sequences are listed in the `<transforms>` section, and are
+    reproduced below:
+    
+    ```
+    <transforms type="simple">
+            <transform from="ء\u{64E}" to="آ"/> <!--  ءَ → آ -->
+            <transform from="ء\u{650}" to="إ"/> <!--  ءِ → إ -->
+            <transform from="ء " to="ء"/>
+            <transform from="ء\u{A0}" to="ء"/>
+            <transform from="ء!" to="إ"/>
+            <transform from="ء١" to="إ"/>
+            <transform from="ءا" to="أ"/>
+            <transform from="ءس" to="ئ"/>
+            <transform from="ءو" to="ؤ"/>
+            <transform from="ءي" to="ئ"/>
+            <transform from="ءى" to="ئ"/>
+    </transforms>
+    ```
+    
+    We limit ourselves to the sequences that strictly combine a character
+    and a hamza, and generate that character with a hamza on it, following
+    the behavior in sequences of other dead keys. Additional sequences,
+    potentially for other layouts as well, could be added later on as
+    necessary.
+    
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/218>
+
+commit 97fb5bda3d0777380cd4b964f48771a82ef3f2a7
+Author: José Expósito <jexposit@redhat.com>
+Date:   Tue Apr 30 18:21:08 2024 +0200
+
+    Fix buffer overrun in parse_omit_name
+    
+    When `num_fields == 12`, if the last character of the pattern is '-',
+    the `buf` array is overrun.
+    
+    This error has been found by a static analysis tool. This is the report:
+    
+        Error: OVERRUN (CWE-119):
+        libX11-1.8.7/modules/om/generic/omGeneric.c:691: cond_at_most:
+          Checking "length > 255" implies that "length" may be up to 255 on
+          the false branch.
+        libX11-1.8.7/modules/om/generic/omGeneric.c:695: alias:
+          Assigning: "last" = "buf + length - 1". "last" may now point to as
+          high as byte 254 of "buf" (which consists of 256 bytes).
+        libX11-1.8.7/modules/om/generic/omGeneric.c:718: ptr_incr:
+          Incrementing "last". "last" may now point to as high as byte 255
+          of "buf" (which consists of 256 bytes).
+        libX11-1.8.7/modules/om/generic/omGeneric.c:720: ptr_incr:
+          Incrementing "last". "last" may now point to as high as byte 256
+          of "buf" (which consists of 256 bytes).
+        libX11-1.8.7/modules/om/generic/omGeneric.c:720: overrun-local:
+          Overrunning array of 256 bytes at byte offset 256 by
+          dereferencing pointer "++last".
+        #  718|               *++last = '*';
+        #  719|
+        #  720|->         *++last = '-';
+        #  721|           break;
+        #  722|       case 13:
+    
+    Signed-off-by: José Expósito <jexposit@redhat.com>
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/250>
+
+commit f67a87dad40141f50f4da35b28a92a974bfdf7e1
+Author: José Expósito <jexposit@redhat.com>
+Date:   Tue Apr 30 18:04:35 2024 +0200
+
+    Fix memory leak in _XimProtoSetIMValues
+    
+    This error has been found by a static analysis tool. This is the report:
+    
+        Error: RESOURCE_LEAK (CWE-772):
+        libX11-1.8.7/modules/im/ximcp/imDefIm.c:1316: alloc_fn:
+          Storage is returned from allocation function "calloc".
+        libX11-1.8.7/modules/im/ximcp/imDefIm.c:1316: var_assign:
+          Assigning: "tmp" = storage returned from
+          "calloc((size_t)((buf_size + data_len == 0) ? 1 : (buf_size + data_len)), 1UL)".
+        libX11-1.8.7/modules/im/ximcp/imDefIm.c:1319: noescape:
+          Resource "tmp" is not freed or pointed-to in "memcpy".
+        libX11-1.8.7/modules/im/ximcp/imDefIm.c:1320: var_assign:
+          Assigning: "buf" = "tmp".
+        libX11-1.8.7/modules/im/ximcp/imDefIm.c:1302: var_assign:
+          Assigning: "data" = "buf".
+        libX11-1.8.7/modules/im/ximcp/imDefIm.c:1303: noescape:
+          Resource "data" is not freed or pointed-to in
+          "_XimEncodeIMATTRIBUTE".
+        libX11-1.8.7/modules/im/ximcp/imDefIm.c:1333: leaked_storage:
+          Variable "data" going out of scope leaks the storage it points to.
+        libX11-1.8.7/modules/im/ximcp/imDefIm.c:1333: leaked_storage:
+          Variable "buf" going out of scope leaks the storage it points to.
+        libX11-1.8.7/modules/im/ximcp/imDefIm.c:1333: leaked_storage:
+          Variable "tmp" going out of scope leaks the storage it points to.
+        # 1331|
+        # 1332|       if (!total)
+        # 1333|->         return (char *)NULL;
+        # 1334|
+        # 1335|       buf_s = (CARD16 *)&buf[XIM_HEADER_SIZE];
+    
+    Signed-off-by: José Expósito <jexposit@redhat.com>
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/250>
+
+commit af1312d2873d2ce49b18708a5029895aed477392
+Author: José Expósito <jexposit@redhat.com>
+Date:   Tue Apr 30 17:37:39 2024 +0200
+
+    XKBMAlloc: Check that needed is >= 0 in XkbResizeKeyActions
+    
+    Passing a negative value in `needed` to the `XkbResizeKeyActions()`
+    function can create a `newActs` array of an unespected size.
+    Check the value and return if it is invalid.
+    
+    This error has been found by a static analysis tool. This is the report:
+    
+        Error: OVERRUN (CWE-119):
+        libX11-1.8.7/src/xkb/XKBMAlloc.c:811: cond_const:
+          Checking "xkb->server->size_acts == 0" implies that
+          "xkb->server->size_acts" is 0 on the true branch.
+        libX11-1.8.7/src/xkb/XKBMAlloc.c:811: buffer_alloc:
+          "calloc" allocates 8 bytes dictated by parameters
+          "(size_t)((xkb->server->size_acts == 0) ? 1 : xkb->server->size_acts)"
+          and "8UL".
+        libX11-1.8.7/src/xkb/XKBMAlloc.c:811: var_assign:
+          Assigning: "newActs" = "calloc((size_t)((xkb->server->size_acts == 0) ? 1 : xkb->server->size_acts), 8UL)".
+        libX11-1.8.7/src/xkb/XKBMAlloc.c:815: assignment:
+          Assigning: "nActs" = "1".
+        libX11-1.8.7/src/xkb/XKBMAlloc.c:829: cond_at_least:
+          Checking "nCopy > 0" implies that "nCopy" is at least 1 on the
+          true branch.
+        libX11-1.8.7/src/xkb/XKBMAlloc.c:830: overrun-buffer-arg:
+          Overrunning buffer pointed to by "&newActs[nActs]" of 8 bytes by
+          passing it to a function which accesses it at byte offset 15
+          using argument "nCopy * 8UL" (which evaluates to 8).
+        #  828|
+        #  829|           if (nCopy > 0)
+        #  830|->             memcpy(&newActs[nActs], XkbKeyActionsPtr(xkb, i),
+        #  831|                      nCopy * sizeof(XkbAction));
+        #  832|           if (nCopy < nKeyActs)
+    
+    Signed-off-by: José Expósito <jexposit@redhat.com>
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/250>
+
+commit 836a8f2cf5e930c8a56b512273fdf9890282ba04
+Author: José Expósito <jexposit@redhat.com>
+Date:   Tue Apr 30 16:49:26 2024 +0200
+
+    Fix use of uninitialized variable in _XimEncodeICATTRIBUTE
+    
+    In the `res->resource_size == XimType_NEST` code path, if
+    `res->xrm_name != pre_quark` and `res->xrm_name != sts_quark`, `len` can
+    be used uninitialized.
+    
+    This error has been found by a static analysis tool. This is the report:
+    
+        Error: UNINIT (CWE-457):
+        libX11-1.8.7/modules/im/ximcp/imRmAttr.c:1106: var_decl:
+          Declaring variable "len" without initializer.
+        libX11-1.8.7/modules/im/ximcp/imRmAttr.c:1179: uninit_use:
+          Using uninitialized value "len".
+        # 1177|           }
+        # 1178|
+        # 1179|->         if (len == 0) {
+        # 1180|               continue;
+        # 1181|           } else if (len < 0) {
+    
+    Signed-off-by: José Expósito <jexposit@redhat.com>
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/250>
+
+commit eaad761e24722b1743d3edee3383294bfb4947d6
+Author: José Expósito <jexposit@redhat.com>
+Date:   Tue Apr 30 16:41:40 2024 +0200
+
+    Fix use of uninitialized variable in _XimExtension
+    
+    `_XimRead()` is being called with `reply` as target buffer instead of
+    using `preply`, accessing uninitialized memory a few lines later.
+    
+    This error has been found by a static analysis tool. This is the report:
+    
+        Error: UNINIT (CWE-457):
+        libX11-1.8.7/modules/im/ximcp/imExten.c:468: alloc_fn:
+          Calling "malloc" which returns uninitialized memory.
+        libX11-1.8.7/modules/im/ximcp/imExten.c:468: assign:
+          Assigning: "preply" = "malloc((size_t)((buf_size == 0) ? 1 : buf_size))",
+          which points to uninitialized data.
+        libX11-1.8.7/modules/im/ximcp/imExten.c:479: uninit_use:
+          Using uninitialized value "*((CARD8 *)preply)".
+        #  477|           return False;
+        #  478|       buf_s = (CARD16 *)((char *)preply + XIM_HEADER_SIZE);
+        #  479|->     if (*((CARD8 *)preply) == XIM_ERROR) {
+        #  480|           _XimProcError(im, 0, (XPointer)&buf_s[3]);
+        #  481|               if(reply != preply)
+    
+    Signed-off-by: José Expósito <jexposit@redhat.com>
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/250>
+
+commit 4f5541193dd5a004ed5ea44c12fc25e227113c9b
+Author: José Expósito <jexposit@redhat.com>
+Date:   Tue Apr 30 16:37:21 2024 +0200
+
+    Fix use of uninitialized variable in _XimTriggerNotify
+    
+    `_XimRead()` is being called with `reply` as target buffer instead of
+    using `preply`, accessing uninitialized memory a few lines later.
+    
+    This error has been found by a static analysis tool. This is the report:
+    
+        Error: UNINIT (CWE-457):
+        libX11-1.8.7/modules/im/ximcp/imDefLkup.c:561: alloc_fn:
+          Calling "malloc" which returns uninitialized memory.
+        libX11-1.8.7/modules/im/ximcp/imDefLkup.c:561: assign:
+          Assigning: "preply" = "malloc((size_t)((len == 0) ? 1 : len))",
+          which points to uninitialized data.
+        libX11-1.8.7/modules/im/ximcp/imDefLkup.c:573: uninit_use:
+          Using uninitialized value "*((CARD8 *)preply)".
+        #  571|       }
+        #  572|       buf_s = (CARD16 *)((char *)preply + XIM_HEADER_SIZE);
+        #  573|->     if (*((CARD8 *)preply) == XIM_ERROR) {
+        #  574|           _XimProcError(im, 0, (XPointer)&buf_s[3]);
+        #  575|           if(reply != preply)
+    
+    Signed-off-by: José Expósito <jexposit@redhat.com>
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/250>
+
+commit 90b8fc65da1e773b0091a50be46b23609591e8b7
+Author: Takao Fujiwara <tfujiwar@redhat.com>
+Date:   Fri Apr 26 01:29:39 2024 +0900
+
+    imDefIm: Add LIBX11_ENABLE_FABRICATED_ORDER env
+    
+    If an XIM application does not return the XKeyEvent from XNextEvent()
+    to XFilterEvent(), a timeout is reached and the behavior is fallen
+    back to the previous one with a warning messsage and we can ask
+    the application to send the XKeyEvent to XFilterEvent() but also
+    libX11 provides LIBX11_ENABLE_FABRICATED_ORDER environment variable.
+    If the application runs with LIBX11_ENABLE_FABRICATED_ORDER=0, the
+    previous behavior is available until the application is fixed.
+    
+    Closes: !246
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
+
+commit 898746f9b1fb384d6d24ed827c836ec8a0b3da3b
+Author: Takao Fujiwara <tfujiwar@redhat.com>
+Date:   Fri Apr 26 01:29:34 2024 +0900
+
+    ximcp: Unmark fabricated with serial 0 and Xic commit_info
+    
+    GTK2 XIM resets the XKeyEvent serial to 0 even if _XimCommitRecv()
+    sets the serial so now checks if the events are sent with
+    Xic->private.proto.commit_info.
+    
+    Closes: !246
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
+
+commit 5a1e62d77b65ba148b1c6d1d22a81dc2b07e7d9e
+Author: Takao Fujiwara <tfujiwar@redhat.com>
+Date:   Fri Apr 26 01:29:26 2024 +0900
+
+    Accept anon windows in XFilterEvent to update XIM state
+    
+    When input focuses are switched quickly with shortcut keys in a Java
+    window, the focus is sometimes lost and the Window=0 is assigned in
+    XFilterEvent() but the XKeyEvent was forwarded by a XIM serer(IBus)
+    with XIM_FORWARD_EVENT -> XNextEvent() -> XFilterEvent() and the event
+    needs to be forwarded to the XIM XKeyEvent press and release filters
+    to update the XIM state with Window=0 likes _XimPendingFilter() and
+    _XimUnfabricateSerial().
+    
+    Closes: #205, #206
+    Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
+
+commit 5a14178c7cc408f425fe298aeade3dee749b1ca1
+Author: Takao Fujiwara <tfujiwar@redhat.com>
+Date:   Fri Apr 26 00:49:14 2024 +0900
+
+    ximcp: Add fabricated_time in XimProtoPrivate for timeout
+    
+    When users type keys quickly, some applications using Steam or Java
+    do not call XNextEvent() for a key event but _XimFilterKeypress()
+    and _XimFilterKeyrelease() expect to receive the key events
+    forwarded by input methods.
+    
+    Now fabricated_time Time value is added to XimProtoPrivate to check
+    the timeout value.
+    
+    Closes: #205
+    Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
+
+commit 1181abd6ffede3ac5663a3a3d4ee66aef1fa553b
+Author: Takao Fujiwara <tfujiwar@redhat.com>
+Date:   Fri Apr 12 10:50:33 2024 +0900
+
+    imDefLkup: Mark and unmark fabricated with serial 0
+    
+    GTK2 applications with GTK_IM_MODULE=xim sets the serial number 0
+    to the XKeyEvent and the previous _XimFabricateSerial() logic did
+    not work for the applications.
+    Now the API marks to fabricate with the serial 0.
+    
+    Closes: #205
+    Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
+
+commit c7790072657f9fdbe8cda031776617088c5f11db
+Author: Takao Fujiwara <tfujiwar@redhat.com>
+Date:   Fri Apr 12 10:21:43 2024 +0900
+
+    imDefLkup: Commit first info in XimCommitInfo
+    
+    Xic.private.proto.commit_info can receive multiple XimCommitInfo
+    when typing keys very quickly like an bar code scanner (or evemu-play)
+    and the first info in XimCommitInfo should be committed to keep
+    the typing key order.
+    
+    This and 041b5291 are same patches but the regression issues will be
+    fixed by the later patches.
+    
+    Closes: #198
+    Fixes: 041b5291 ("imDefLkup: Commit first info in XimCommitInfo")
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
+
+commit 13e9ac4d458069c81d795f6b4842814d30431b4b
+Author: Takao Fujiwara <tfujiwar@redhat.com>
+Date:   Fri Apr 12 10:21:41 2024 +0900
+
+    ximcp: Unmark to fabricate key events with XKeyEvent serial
+    
+    _XimProtoKeypressFilter() and _XimProtoKeyreleaseFilter() can
+    receive XKeyEvent from both the typing on the keyboard and the
+    callback of XIM_FORWARD_EVENT.
+    
+    If the filter functions unmark to fabricate XKeyEvent from the typing
+    on the keyboard during receiving XKeyEvent from the callback of
+    XIM_FORWARD_EVENT with typing keys very quickly likes an bar code
+    scanner (or evemu-play), XIM server cannot receive some key events and
+    it causes the key typing order to get scrambled.
+    
+    Now XIM client saves the serial in XKeyEvent and the filter functions
+    unmark to fabricate XKeyEvent from the callback of XIM_FORWARD_EVENT
+    only.
+    
+    This and 024d229f are same patches but the regression issues will be
+    fixed by the later patches.
+    
+    Closes: #198
+    Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
+    Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
+
 commit a465588218c1643eedc35b3c24409cb775454eee
 Author: Alan Coopersmith <alan.coopersmith@oracle.com>
 Date:   Fri Apr 5 15:50:06 2024 -0700
diff --git a/lib/libX11/Makefile.bsd-wrapper b/lib/libX11/Makefile.bsd-wrapper
index 98eca786d..c43c37179 100644
--- a/lib/libX11/Makefile.bsd-wrapper
+++ b/lib/libX11/Makefile.bsd-wrapper
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile.bsd-wrapper,v 1.30 2024/07/11 07:28:46 matthieu Exp $
+# $OpenBSD: Makefile.bsd-wrapper,v 1.31 2024/08/04 17:15:57 matthieu Exp $
 .include <bsd.xconf.mk>
 
 # when buming X11 major also bump:
@@ -10,7 +10,7 @@
 # when bumping X11_xcb also bump:
 # libEGL libGL libIntelXvMC libGLU
 
-SHARED_LIBS=	X11 18.1 X11_xcb 2.0
+SHARED_LIBS=	X11 18.2 X11_xcb 2.0
 
 CONFIGURE_ARGS= --enable-tcp-transport --enable-unix-transport --enable-ipv6 \
 	--disable-composecache \
diff --git a/lib/libX11/README.md b/lib/libX11/README.md
index be1bddbb4..abacb3934 100644
--- a/lib/libX11/README.md
+++ b/lib/libX11/README.md
@@ -31,6 +31,17 @@ For patch submission instructions, see:
 
   https://www.x.org/wiki/Development/Documentation/SubmittingPatches
 
+## Release 1.8.10
+
+ * Re-fix XIM input sometimes jumbled (#205, #206, #207, #208, !246)
+ * Fix various static analysis errors (!250)
+ * Add compose sequences for Arabic hamza (!218), Ezh (!221), and
+   hryvnia currency (!259)
+ * Make colormap private interfaces thread safe (#215, !254)
+ * Fix deadlock in XRebindKeysym() (!256)
+ * Assorted memory handling cleanups (!251, !258)
+ * Restore VAX support still in use by NetBSD (!257)
+
 ## Release 1.8.9
 
  * Fix regressions introduced in 1.8.8 (!245, !248) - this includes reverting
diff --git a/lib/libX11/aclocal.m4 b/lib/libX11/aclocal.m4
index d7b71b7ef..5091f734a 100644
--- a/lib/libX11/aclocal.m4
+++ b/lib/libX11/aclocal.m4
@@ -19,7 +19,7 @@ You have another version of autoconf.  It may work, but is not guaranteed to.
 If you have problems, you may need to regenerate the build system entirely.
 To do so, use the procedure documented by the package, typically 'autoreconf'.])])
 
-# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+# pkg.m4 - Macros to locate and use pkg-config.   -*- Autoconf -*-
 # serial 12 (pkg-config-0.29.2)
 
 dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
@@ -107,7 +107,7 @@ dnl Check to see whether a particular set of modules exists. Similar to
 dnl PKG_CHECK_MODULES(), but does not set variables or print errors.
 dnl
 dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG])
-dnl only at the first occurence in configure.ac, so if the first place
+dnl only at the first occurrence in configure.ac, so if the first place
 dnl it's called might be skipped (such as if it is within an "if", you
 dnl have to call PKG_CHECK_EXISTS manually
 AC_DEFUN([PKG_CHECK_EXISTS],
@@ -176,14 +176,14 @@ if test $pkg_failed = yes; then
         AC_MSG_RESULT([no])
         _PKG_SHORT_ERRORS_SUPPORTED
         if test $_pkg_short_errors_supported = yes; then
-	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
+                $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
         else
-	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
+                $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
         fi
-	# Put the nasty error message in config.log where it belongs
-	echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD
+        # Put the nasty error message in config.log where it belongs
+        echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD
 
-	m4_default([$4], [AC_MSG_ERROR(
+        m4_default([$4], [AC_MSG_ERROR(
 [Package requirements ($2) were not met:
 
 $$1_PKG_ERRORS
@@ -195,7 +195,7 @@ _PKG_TEXT])[]dnl
         ])
 elif test $pkg_failed = untried; then
         AC_MSG_RESULT([no])
-	m4_default([$4], [AC_MSG_FAILURE(
+        m4_default([$4], [AC_MSG_FAILURE(
 [The pkg-config script could not be found or is too old.  Make sure it
 is in your PATH or set the PKG_CONFIG environment variable to the full
 path to pkg-config.
@@ -205,10 +205,10 @@ _PKG_TEXT
 To get pkg-config, see <http://pkg-config.freedesktop.org/>.])[]dnl
         ])
 else
-	$1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
-	$1[]_LIBS=$pkg_cv_[]$1[]_LIBS
+        $1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
+        $1[]_LIBS=$pkg_cv_[]$1[]_LIBS
         AC_MSG_RESULT([yes])
-	$3
+        $3
 fi[]dnl
 ])dnl PKG_CHECK_MODULES
 
@@ -295,6 +295,74 @@ AS_VAR_COPY([$1], [pkg_cv_][$1])
 AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR
 
+dnl PKG_WITH_MODULES(VARIABLE-PREFIX, MODULES,
+dnl   [ACTION-IF-FOUND],[ACTION-IF-NOT-FOUND],
+dnl   [DESCRIPTION], [DEFAULT])
+dnl ------------------------------------------
+dnl
+dnl Prepare a "--with-" configure option using the lowercase
+dnl [VARIABLE-PREFIX] name, merging the behaviour of AC_ARG_WITH and
+dnl PKG_CHECK_MODULES in a single macro.
+AC_DEFUN([PKG_WITH_MODULES],
+[
+m4_pushdef([with_arg], m4_tolower([$1]))
+
+m4_pushdef([description],
+           [m4_default([$5], [build with ]with_arg[ support])])
+
+m4_pushdef([def_arg], [m4_default([$6], [auto])])
+m4_pushdef([def_action_if_found], [AS_TR_SH([with_]with_arg)=yes])
+m4_pushdef([def_action_if_not_found], [AS_TR_SH([with_]with_arg)=no])
+
+m4_case(def_arg,
+            [yes],[m4_pushdef([with_without], [--without-]with_arg)],
+            [m4_pushdef([with_without],[--with-]with_arg)])
+
+AC_ARG_WITH(with_arg,
+     AS_HELP_STRING(with_without, description[ @<:@default=]def_arg[@:>@]),,
+    [AS_TR_SH([with_]with_arg)=def_arg])
+
+AS_CASE([$AS_TR_SH([with_]with_arg)],
+            [yes],[PKG_CHECK_MODULES([$1],[$2],$3,$4)],
+            [auto],[PKG_CHECK_MODULES([$1],[$2],
+                                        [m4_n([def_action_if_found]) $3],
+                                        [m4_n([def_action_if_not_found]) $4])])
+
+m4_popdef([with_arg])
+m4_popdef([description])
+m4_popdef([def_arg])
+
+])dnl PKG_WITH_MODULES
+
+dnl PKG_HAVE_WITH_MODULES(VARIABLE-PREFIX, MODULES,
+dnl   [DESCRIPTION], [DEFAULT])
+dnl -----------------------------------------------
+dnl
+dnl Convenience macro to trigger AM_CONDITIONAL after PKG_WITH_MODULES
+dnl check._[VARIABLE-PREFIX] is exported as make variable.
+AC_DEFUN([PKG_HAVE_WITH_MODULES],
+[
+PKG_WITH_MODULES([$1],[$2],,,[$3],[$4])
+
+AM_CONDITIONAL([HAVE_][$1],
+               [test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"])
+])dnl PKG_HAVE_WITH_MODULES
+
+dnl PKG_HAVE_DEFINE_WITH_MODULES(VARIABLE-PREFIX, MODULES,
+dnl   [DESCRIPTION], [DEFAULT])
+dnl ------------------------------------------------------
+dnl
+dnl Convenience macro to run AM_CONDITIONAL and AC_DEFINE after
+dnl PKG_WITH_MODULES check. HAVE_[VARIABLE-PREFIX] is exported as make
+dnl and preprocessor variable.
+AC_DEFUN([PKG_HAVE_DEFINE_WITH_MODULES],
+[
+PKG_HAVE_WITH_MODULES([$1],[$2],[$3],[$4])
+
+AS_IF([test "$AS_TR_SH([with_]m4_tolower([$1]))" = "yes"],
+        [AC_DEFINE([HAVE_][$1], 1, [Enable ]m4_tolower([$1])[ support])])
+])dnl PKG_HAVE_DEFINE_WITH_MODULES
+
 # Copyright (C) 2002-2012 Free Software Foundation, Inc.
 #
 # This file is free software; the Free Software Foundation
diff --git a/lib/libX11/compile b/lib/libX11/compile
index df363c8fb..49b3d05fd 100644
--- a/lib/libX11/compile
+++ b/lib/libX11/compile
@@ -1,9 +1,9 @@
 #! /bin/sh
 # Wrapper for compilers which do not understand '-c -o'.
 
-scriptversion=2018-03-07.03; # UTC
+scriptversion=2024-06-19.01; # UTC
 
-# Copyright (C) 1999-2021 Free Software Foundation, Inc.
+# Copyright (C) 1999-2024 Free Software Foundation, Inc.
 # Written by Tom Tromey <tromey@cygnus.com>.
 #
 # This program is free software; you can redistribute it and/or modify
@@ -143,7 +143,7 @@ func_cl_wrapper ()
 	  # configure might choose to run compile as 'compile cc -o foo foo.c'.
 	  eat=1
 	  case $2 in
-	    *.o | *.[oO][bB][jJ])
+	    *.o | *.lo | *.[oO][bB][jJ])
 	      func_file_conv "$2"
 	      set x "$@" -Fo"$file"
 	      shift
@@ -248,14 +248,17 @@ If you are trying to build a whole package this is not the
 right script to run: please start by reading the file 'INSTALL'.
 
 Report bugs to <bug-automake@gnu.org>.
+GNU Automake home page: <https://www.gnu.org/software/automake/>.
+General help using GNU software: <https://www.gnu.org/gethelp/>.
 EOF
     exit $?
     ;;
   -v | --v*)
-    echo "compile $scriptversion"
+    echo "compile (GNU Automake) $scriptversion"
     exit $?
     ;;
   cl | *[/\\]cl | cl.exe | *[/\\]cl.exe | \
+  clang-cl | *[/\\]clang-cl | clang-cl.exe | *[/\\]clang-cl.exe | \
   icl | *[/\\]icl | icl.exe | *[/\\]icl.exe )
     func_cl_wrapper "$@"      # Doesn't return...
     ;;
diff --git a/lib/libX11/configure b/lib/libX11/configure
index a13112fd3..379d04374 100644
--- a/lib/libX11/configure
+++ b/lib/libX11/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for libX11 1.8.9.
+# Generated by GNU Autoconf 2.71 for libX11 1.8.10.
 #
 # Report bugs to <https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues>.
 #
@@ -682,8 +682,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='libX11'
 PACKAGE_TARNAME='libX11'
-PACKAGE_VERSION='1.8.9'
-PACKAGE_STRING='libX11 1.8.9'
+PACKAGE_VERSION='1.8.10'
+PACKAGE_STRING='libX11 1.8.10'
 PACKAGE_BUGREPORT='https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues'
 PACKAGE_URL=''
 
@@ -1548,7 +1548,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures libX11 1.8.9 to adapt to many kinds of systems.
+\`configure' configures libX11 1.8.10 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1619,7 +1619,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of libX11 1.8.9:";;
+     short | recursive ) echo "Configuration of libX11 1.8.10:";;
    esac
   cat <<\_ACEOF
 
@@ -1789,7 +1789,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-libX11 configure 1.8.9
+libX11 configure 1.8.10
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2257,7 +2257,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by libX11 $as_me 1.8.9, which was
+It was created by libX11 $as_me 1.8.10, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -4807,7 +4807,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='libX11'
- VERSION='1.8.9'
+ VERSION='1.8.10'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -21407,21 +21407,21 @@ else
         _pkg_short_errors_supported=no
 fi
         if test $_pkg_short_errors_supported = yes; then
-	        BIGFONT_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "xf86bigfontproto >= 1.2.0" 2>&1`
+                BIGFONT_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "xf86bigfontproto >= 1.2.0" 2>&1`
         else
-	        BIGFONT_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "xf86bigfontproto >= 1.2.0" 2>&1`
+                BIGFONT_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "xf86bigfontproto >= 1.2.0" 2>&1`
         fi
-	# Put the nasty error message in config.log where it belongs
-	echo "$BIGFONT_PKG_ERRORS" >&5
+        # Put the nasty error message in config.log where it belongs
+        echo "$BIGFONT_PKG_ERRORS" >&5
 
-	XF86BIGFONT="no"
+        XF86BIGFONT="no"
 elif test $pkg_failed = untried; then
         { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
 printf "%s\n" "no" >&6; }
-	XF86BIGFONT="no"
+        XF86BIGFONT="no"
 else
-	BIGFONT_CFLAGS=$pkg_cv_BIGFONT_CFLAGS
-	BIGFONT_LIBS=$pkg_cv_BIGFONT_LIBS
+        BIGFONT_CFLAGS=$pkg_cv_BIGFONT_CFLAGS
+        BIGFONT_LIBS=$pkg_cv_BIGFONT_LIBS
         { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 printf "%s\n" "yes" >&6; }
 
@@ -21897,14 +21897,14 @@ else
         _pkg_short_errors_supported=no
 fi
         if test $_pkg_short_errors_supported = yes; then
-	        X11_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$X11_REQUIRES" 2>&1`
+                X11_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$X11_REQUIRES" 2>&1`
         else
-	        X11_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$X11_REQUIRES" 2>&1`
+                X11_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$X11_REQUIRES" 2>&1`
         fi
-	# Put the nasty error message in config.log where it belongs
-	echo "$X11_PKG_ERRORS" >&5
+        # Put the nasty error message in config.log where it belongs
+        echo "$X11_PKG_ERRORS" >&5
 
-	as_fn_error $? "Package requirements ($X11_REQUIRES) were not met:
+        as_fn_error $? "Package requirements ($X11_REQUIRES) were not met:
 
 $X11_PKG_ERRORS
 
@@ -21917,7 +21917,7 @@ See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
         { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
 printf "%s\n" "no" >&6; }
-	{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+        { { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
 as_fn_error $? "The pkg-config script could not be found or is too old.  Make sure it
 is in your PATH or set the PKG_CONFIG environment variable to the full
@@ -21930,8 +21930,8 @@ See the pkg-config man page for more details.
 To get pkg-config, see <http://pkg-config.freedesktop.org/>.
 See \`config.log' for more details" "$LINENO" 5; }
 else
-	X11_CFLAGS=$pkg_cv_X11_CFLAGS
-	X11_LIBS=$pkg_cv_X11_LIBS
+        X11_CFLAGS=$pkg_cv_X11_CFLAGS
+        X11_LIBS=$pkg_cv_X11_LIBS
         { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 printf "%s\n" "yes" >&6; }
 
@@ -22718,7 +22718,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by libX11 $as_me 1.8.9, which was
+This file was extended by libX11 $as_me 1.8.10, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -22786,7 +22786,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-libX11 config.status 1.8.9
+libX11 config.status 1.8.10
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 
diff --git a/lib/libX11/configure.ac b/lib/libX11/configure.ac
index 15ccdd537..49f05e9f2 100644
--- a/lib/libX11/configure.ac
+++ b/lib/libX11/configure.ac
@@ -1,7 +1,7 @@
 
 # Initialize Autoconf
 AC_PREREQ([2.70])
-AC_INIT([libX11], [1.8.9],
+AC_INIT([libX11], [1.8.10],
         [https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues], [libX11])
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_HEADERS([src/config.h include/X11/XlibConf.h])
diff --git a/lib/libX11/modules/im/ximcp/imDefFlt.c b/lib/libX11/modules/im/ximcp/imDefFlt.c
index 44cc68847..9bd4f97f1 100644
--- a/lib/libX11/modules/im/ximcp/imDefFlt.c
+++ b/lib/libX11/modules/im/ximcp/imDefFlt.c
@@ -138,15 +138,19 @@ _XimPendingFilter(
 static Bool
 _XimProtoKeypressFilter(
     Xic		 ic,
-    XKeyEvent	*ev)
+    XKeyEvent	*ev,
+    Window	 w)
 {
     Xim		im = (Xim)ic->core.im;
 
-    if (IS_FABRICATED(im)) {
+    if (_XimIsFabricatedSerial(im, ev)) {
 	_XimPendingFilter(ic);
-	UNMARK_FABRICATED(im);
+	_XimUnfabricateSerial(im, ic, ev);
 	return NOTFILTERD;
     }
+    /* w=0 is used for _XimIsFabricatedSerial() only */
+    if (!w)
+	return NOTFILTERD;
 
     if (IS_NEGLECT_EVENT(ic, KeyPressMask))
 	return FILTERD;
@@ -193,21 +197,25 @@ _XimFilterKeypress(
     XEvent		*ev,
     XPointer		 client_data)
 {
-    return _XimProtoKeypressFilter((Xic)client_data, (XKeyEvent *)ev );
+    return _XimProtoKeypressFilter((Xic)client_data, (XKeyEvent *)ev, w);
 }
 
 static Bool
 _XimProtoKeyreleaseFilter(
     Xic		 ic,
-    XKeyEvent	*ev)
+    XKeyEvent	*ev,
+    Window	 w)
 {
     Xim		im = (Xim)ic->core.im;
 
-    if (IS_FABRICATED(im)) {
+    if (_XimIsFabricatedSerial(im, ev)) {
 	_XimPendingFilter(ic);
-	UNMARK_FABRICATED(im);
+	_XimUnfabricateSerial(im, ic, ev);
 	return NOTFILTERD;
     }
+    /* w=0 is used for _XimIsFabricatedSerial() only */
+    if (!w)
+	return NOTFILTERD;
 
     if (IS_NEGLECT_EVENT(ic, KeyReleaseMask))
 	return FILTERD;
@@ -254,7 +262,7 @@ _XimFilterKeyrelease(
     XEvent		*ev,
     XPointer		 client_data)
 {
-    return _XimProtoKeyreleaseFilter((Xic)client_data, (XKeyEvent *)ev);
+    return _XimProtoKeyreleaseFilter((Xic)client_data, (XKeyEvent *)ev, w);
 }
 
 static void
@@ -264,6 +272,11 @@ _XimRegisterKeyPressFilter(
     if (ic->core.focus_window) {
 	if (!(ic->private.proto.registed_filter_event & KEYPRESS_MASK)) {
 	    _XRegisterFilterByType (ic->core.im->core.display,
+				    0,
+				    KeyPress, KeyPress,
+				    _XimFilterKeypress,
+				    (XPointer)ic);
+	    _XRegisterFilterByType (ic->core.im->core.display,
 				    ic->core.focus_window,
 				    KeyPress, KeyPress,
 				    _XimFilterKeypress,
@@ -281,6 +294,11 @@ _XimRegisterKeyReleaseFilter(
     if (ic->core.focus_window) {
 	if (!(ic->private.proto.registed_filter_event & KEYRELEASE_MASK)) {
 	    _XRegisterFilterByType (ic->core.im->core.display,
+				    0,
+				    KeyRelease, KeyRelease,
+				    _XimFilterKeyrelease,
+				    (XPointer)ic);
+	    _XRegisterFilterByType (ic->core.im->core.display,
 				    ic->core.focus_window,
 				    KeyRelease, KeyRelease,
 				    _XimFilterKeyrelease,
@@ -301,6 +319,10 @@ _XimUnregisterKeyPressFilter(
 				ic->core.focus_window,
 				_XimFilterKeypress,
 				(XPointer)ic);
+	    _XUnregisterFilter (ic->core.im->core.display,
+				0,
+				_XimFilterKeypress,
+				(XPointer)ic);
 	    ic->private.proto.registed_filter_event &= ~KEYPRESS_MASK;
 	}
     }
@@ -317,6 +339,10 @@ _XimUnregisterKeyReleaseFilter(
 				ic->core.focus_window,
 				_XimFilterKeyrelease,
 				(XPointer)ic);
+	    _XUnregisterFilter (ic->core.im->core.display,
+				0,
+				_XimFilterKeyrelease,
+				(XPointer)ic);
 	    ic->private.proto.registed_filter_event &= ~KEYRELEASE_MASK;
 	}
     }
diff --git a/lib/libX11/modules/im/ximcp/imDefIm.c b/lib/libX11/modules/im/ximcp/imDefIm.c
index fe4d18ba3..e30753989 100644
--- a/lib/libX11/modules/im/ximcp/imDefIm.c
+++ b/lib/libX11/modules/im/ximcp/imDefIm.c
@@ -63,6 +63,8 @@ PERFORMANCE OF THIS SOFTWARE.
 #include "Ximint.h"
 
 #include <limits.h>
+#include <stdlib.h>
+#include <strings.h>
 
 int
 _XimCheckDataSize(
@@ -400,6 +402,7 @@ _XimPreConnect(
     Atom	   *atoms;
     Window	    im_window = 0;
     register int    i;
+    const char	   *env_enable_fabricated_order;
 
     if((imserver = XInternAtom(display, XIM_SERVERS, True)) == (Atom)None)
 	return False;
@@ -430,6 +433,16 @@ _XimPreConnect(
 	return False;
 
     im->private.proto.im_window = im_window;
+    im->private.proto.fabricated_serial = 0;
+    im->private.proto.fabricated_time = 0;
+    im->private.proto.enable_fabricated_order = True;
+    env_enable_fabricated_order = getenv("LIBX11_ENABLE_FABRICATED_ORDER");
+    if (env_enable_fabricated_order && *env_enable_fabricated_order) {
+	if (!strncasecmp(env_enable_fabricated_order, "0", 2) ||
+	    !strncasecmp(env_enable_fabricated_order, "false", 6)) {
+	    im->private.proto.enable_fabricated_order = False;
+	}
+    }
     return True;
 }
 
@@ -1314,8 +1327,11 @@ _XimProtoSetIMValues(
     }
     _XimSetCurrentIMValues(im, &im_values);
 
-    if (!total)
-	return (char *)NULL;
+    if (!total) {
+        if (buf != tmp_buf)
+	    Xfree(buf);
+        return (char *)NULL;
+    }
 
     buf_s = (CARD16 *)&buf[XIM_HEADER_SIZE];
     buf_s[0] = im->private.proto.imid;
diff --git a/lib/libX11/modules/im/ximcp/imDefLkup.c b/lib/libX11/modules/im/ximcp/imDefLkup.c
index dd1adf535..8ccaee262 100644
--- a/lib/libX11/modules/im/ximcp/imDefLkup.c
+++ b/lib/libX11/modules/im/ximcp/imDefLkup.c
@@ -341,6 +341,93 @@ _XimForwardEvent(
     return _XimForwardEventCore(ic, ev, sync);
 }
 
+Bool
+_XimFabricateSerial(
+    Xim			 im,
+    XKeyEvent		*event)
+{
+    /* GTK2 XIM module sets serial=0. */
+    if (!event->serial || !im->private.proto.enable_fabricated_order) {
+	MARK_FABRICATED(im);
+	return True;
+    }
+    if (event->serial == im->private.proto.fabricated_serial) {
+	fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__);
+	return False;
+    }
+    if (im->private.proto.fabricated_serial)
+	fprintf(stderr, "%s,%d: Tried to fabricate a wrong key event.\n", __FILE__, __LINE__);
+
+    MARK_FABRICATED(im);
+    im->private.proto.fabricated_serial = event->serial;
+    im->private.proto.fabricated_time = event->time;
+    return True;
+}
+
+Bool
+_XimUnfabricateSerial(
+    Xim			 im,
+    Xic			 ic,
+    XKeyEvent		*event)
+{
+    if (!im->private.proto.enable_fabricated_order) {
+	UNMARK_FABRICATED(im);
+	return True;
+    }
+    /* GTK2 XIM module sets serial=0. */
+    if (!event->serial) {
+	/* _XimCommitRecv() sets event->serial and call _XimFabricateSerial()
+	 * but GTK2 XIM always reset event->serial=0 with XFilterEvent().
+	 */
+	if (ic && ic->private.proto.commit_info)
+	    im->private.proto.fabricated_serial = 0;
+	UNMARK_FABRICATED(im);
+	return True;
+    }
+    if (!im->private.proto.fabricated_serial) {
+	fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__);
+	return False;
+    }
+    if (event->serial != im->private.proto.fabricated_serial)
+	fprintf(stderr, "%s,%d: Tried to unfabricate a wrong key event.\n", __FILE__, __LINE__);
+
+    im->private.proto.fabricated_serial = 0;
+    im->private.proto.fabricated_time = 0;
+    UNMARK_FABRICATED(im);
+    return True;
+}
+
+Bool
+_XimIsFabricatedSerial(
+    Xim			 im,
+    XKeyEvent		*event)
+{
+    /* GTK2 XIM module sets serial=0. */
+    if (!event->serial || !im->private.proto.enable_fabricated_order)
+	return IS_FABRICATED(im) ? True : False;
+    if (event->serial == im->private.proto.fabricated_serial)
+	return True;
+    if (!im->private.proto.fabricated_serial)
+	return False;
+    /* Rotate time */
+    if (event->time < im->private.proto.fabricated_time) {
+	if (event->time >= 1000)
+	    im->private.proto.fabricated_time = 0;
+    } else if (event->time - im->private.proto.fabricated_time > 1000) {
+	fprintf(stderr,
+	        "%s,%d: The application disposed a key event with %ld serial.\n",
+	        __FILE__, __LINE__,
+	        im->private.proto.fabricated_serial);
+	im->private.proto.enable_fabricated_order = False;
+	if (IS_FABRICATED(im)) {
+	    if (event->serial)
+		im->private.proto.fabricated_serial = event->serial;
+	    return True;
+	}
+    }
+    return False;
+}
+
 static void
 _XimProcEvent(
     Display		*d,
@@ -355,7 +442,7 @@ _XimProcEvent(
     ev->xany.serial |= serial << 16;
     ev->xany.send_event = False;
     ev->xany.display = d;
-    MARK_FABRICATED(ic->core.im);
+    _XimFabricateSerial((Xim)ic->core.im, &ev->xkey);
     return;
 }
 
@@ -548,7 +635,7 @@ _XimTriggerNotify(
 	} else {
 	    buf_size = len;
 	    preply = Xmalloc(len);
-	    ret_code = _XimRead(im, &len, (XPointer)reply, buf_size,
+	    ret_code = _XimRead(im, &len, preply, buf_size,
 				_XimTriggerNotifyCheck, (XPointer)ic);
 	    if(ret_code != XIM_TRUE) {
 		Xfree(preply);
@@ -592,22 +679,47 @@ _XimRegCommitInfo(
 }
 
 static void
-_XimUnregCommitInfo(
-    Xic			ic)
+_XimUnregRealCommitInfo(
+    Xic			ic,
+    Bool		reverse)
 {
     XimCommitInfo	info;
+    XimCommitInfo	prev_info = NULL;
 
-    if (!(info = ic->private.proto.commit_info))
+    info = ic->private.proto.commit_info;
+    while (reverse && info) {
+	if (!info->next)
+	    break;
+	prev_info = info;
+	info = info->next;
+    }
+    if (!info)
 	return;
 
-
     Xfree(info->string);
     Xfree(info->keysym);
-    ic->private.proto.commit_info = info->next;
+    if (prev_info)
+	prev_info->next = info->next;
+    else
+	ic->private.proto.commit_info = info->next;
     Xfree(info);
     return;
 }
 
+static void
+_XimUnregCommitInfo(
+    Xic			ic)
+{
+    _XimUnregRealCommitInfo(ic, False);
+}
+
+static void
+_XimUnregFirstCommitInfo(
+    Xic			ic)
+{
+    _XimUnregRealCommitInfo(ic, True);
+}
+
 void
 _XimFreeCommitInfo(
     Xic			ic)
@@ -617,6 +729,19 @@ _XimFreeCommitInfo(
     return;
 }
 
+static XimCommitInfo
+_XimFirstCommitInfo(
+    Xic			ic)
+{
+    XimCommitInfo info = ic->private.proto.commit_info;
+    while (info) {
+	if (!info->next)
+	    break;
+	info = info->next;
+    }
+    return info;
+}
+
 static Bool
 _XimProcKeySym(
     Xic			  ic,
@@ -704,10 +829,6 @@ _XimCommitRecv(
 
     (void)_XimRespSyncReply(ic, flag);
 
-    if (ic->private.proto.registed_filter_event
-	& (KEYPRESS_MASK | KEYRELEASE_MASK))
-	    MARK_FABRICATED(im);
-
     bzero(&ev, sizeof(ev));	/* uninitialized : found when running kterm under valgrind */
 
     ev.type = KeyPress;
@@ -719,6 +840,10 @@ _XimCommitRecv(
 
     ev.time = 0L;
     ev.serial = LastKnownRequestProcessed(im->core.display);
+
+    if (ic->private.proto.registed_filter_event
+	& (KEYPRESS_MASK | KEYRELEASE_MASK))
+	    _XimFabricateSerial(im, &ev);
     /* FIXME :
        I wish there were COMMENTs (!) about the data passed around.
     */
@@ -1011,7 +1136,7 @@ _XimProtoMbLookupString(
 	state = &tmp_state;
 
     if ((ev->type == KeyPress) && (ev->keycode == 0)) { /* Filter function */
-	if (!(info = ic->private.proto.commit_info)) {
+	if (!(info = _XimFirstCommitInfo(ic))) {
 	    *state = XLookupNone;
 	    return 0;
 	}
@@ -1027,7 +1152,7 @@ _XimProtoMbLookupString(
 	    else
 		*state = XLookupKeySym;
 	}
-	_XimUnregCommitInfo(ic);
+	_XimUnregFirstCommitInfo(ic);
 
     } else  if (ev->type == KeyPress) {
 	ret = _XimLookupMBText(ic, ev, buffer, bytes, keysym, NULL);
@@ -1074,7 +1199,7 @@ _XimProtoWcLookupString(
 	state = &tmp_state;
 
     if (ev->type == KeyPress && ev->keycode == 0) { /* Filter function */
-	if (!(info = ic->private.proto.commit_info)) {
+	if (!(info = _XimFirstCommitInfo(ic))) {
            *state = XLookupNone;
 	    return 0;
 	}
@@ -1090,7 +1215,7 @@ _XimProtoWcLookupString(
 	    else
 		*state = XLookupKeySym;
 	}
-	_XimUnregCommitInfo(ic);
+	_XimUnregFirstCommitInfo(ic);
 
     } else if (ev->type == KeyPress) {
 	ret = _XimLookupWCText(ic, ev, buffer, bytes, keysym, NULL);
@@ -1137,7 +1262,7 @@ _XimProtoUtf8LookupString(
 	state = &tmp_state;
 
     if (ev->type == KeyPress && ev->keycode == 0) { /* Filter function */
-	if (!(info = ic->private.proto.commit_info)) {
+	if (!(info = _XimFirstCommitInfo(ic))) {
            *state = XLookupNone;
 	    return 0;
 	}
@@ -1153,7 +1278,7 @@ _XimProtoUtf8LookupString(
 	    else
 		*state = XLookupKeySym;
 	}
-	_XimUnregCommitInfo(ic);
+	_XimUnregFirstCommitInfo(ic);
 
     } else if (ev->type == KeyPress) {
 	ret = _XimLookupUTF8Text(ic, ev, buffer, bytes, keysym, NULL);
diff --git a/lib/libX11/modules/im/ximcp/imExten.c b/lib/libX11/modules/im/ximcp/imExten.c
index c2e48a891..a25f00d07 100644
--- a/lib/libX11/modules/im/ximcp/imExten.c
+++ b/lib/libX11/modules/im/ximcp/imExten.c
@@ -466,7 +466,7 @@ _XimExtension(
     	} else {
     	    buf_size = len;
 	    preply = Xmalloc(buf_size);
-    	    ret_code = _XimRead(im, &len, reply, buf_size,
+    	    ret_code = _XimRead(im, &len, preply, buf_size,
     					_XimQueryExtensionCheck, 0);
     	    if(ret_code != XIM_TRUE) {
 		Xfree(preply);
diff --git a/lib/libX11/modules/im/ximcp/imRmAttr.c b/lib/libX11/modules/im/ximcp/imRmAttr.c
index 709e64ab5..c56bd62ed 100644
--- a/lib/libX11/modules/im/ximcp/imRmAttr.c
+++ b/lib/libX11/modules/im/ximcp/imRmAttr.c
@@ -1115,6 +1115,7 @@ _XimEncodeICATTRIBUTE(
 
     *ret_len = 0;
     for (p = arg; p && p->name; p++) {
+	len = 0;
 	buf_s = (CARD16 *)buf;
 	if (!(res = _XimGetResourceListRec(res_list, res_num, p->name))) {
 	    if (_XimSetInnerICAttributes(ic, top, p, mode))
diff --git a/lib/libX11/modules/om/generic/omGeneric.c b/lib/libX11/modules/om/generic/omGeneric.c
index 406cec93d..370072f38 100644
--- a/lib/libX11/modules/om/generic/omGeneric.c
+++ b/lib/libX11/modules/om/generic/omGeneric.c
@@ -688,7 +688,7 @@ parse_omit_name(
 
     length = strlen (pattern);
 
-    if (length > XLFD_MAX_LEN)
+    if (length > XLFD_MAX_LEN - 1)
 	return -1;
 
     strcpy(buf, pattern);
diff --git a/lib/libX11/nls/en_US.UTF-8/Compose.pre b/lib/libX11/nls/en_US.UTF-8/Compose.pre
index 680f4faba..d4ff81263 100644
--- a/lib/libX11/nls/en_US.UTF-8/Compose.pre
+++ b/lib/libX11/nls/en_US.UTF-8/Compose.pre
@@ -204,7 +204,14 @@ XCOMM "₪" U20aa NEW SHEQEL SIGN
 XCOMM "₱" U20b1 PESO SIGN
 <Multi_key> <G> <bar>			: "₲"	U20b2 # GUARANI SIGN
 <Multi_key> <bar> <G>			: "₲"	U20b2 # GUARANI SIGN
-XCOMM "₴" U20b4 HRYVNIA SIGN
+<Multi_key> <H> <equal>			: "₴"	U20b4 # HRYVNIA SIGN
+<Multi_key> <equal> <H>			: "₴"	U20b4 # HRYVNIA SIGN
+<Multi_key> <h> <equal>			: "₴"	U20b4 # HRYVNIA SIGN
+<Multi_key> <equal> <h>			: "₴"	U20b4 # HRYVNIA SIGN
+<Multi_key> <Cyrillic_GHE> <equal>	: "₴"	U20b4 # HRYVNIA SIGN
+<Multi_key> <equal> <Cyrillic_GHE>	: "₴"	U20b4 # HRYVNIA SIGN
+<Multi_key> <Cyrillic_ghe> <equal>	: "₴"	U20b4 # HRYVNIA SIGN
+<Multi_key> <equal> <Cyrillic_ghe>	: "₴"	U20b4 # HRYVNIA SIGN
 <Multi_key> <C> <bar>			: "₵"	U20b5 # CEDI SIGN
 <Multi_key> <bar> <C>			: "₵"	U20b5 # CEDI SIGN
 <Multi_key> <R> <equal>			: "₹"	U20b9 # INDIAN RUPEE SIGN
@@ -912,7 +919,6 @@ XCOMM Latin Extended-A
 <Multi_key> <comma> <s>			: "ş"	U015F # LATIN SMALL LETTER S WITH CEDILLA
 <Multi_key> <s> <comma>			: "ş"	U015F # LATIN SMALL LETTER S WITH CEDILLA
 <Multi_key> <cedilla> <s>		: "ş"	U015F # LATIN SMALL LETTER S WITH CEDILLA
-<Multi_key> <s> <cedilla>		: "ş"	U015F # LATIN SMALL LETTER S WITH CEDILLA
 <dead_caron> <S>			: "Š"	U0160 # LATIN CAPITAL LETTER S WITH CARON
 <Multi_key> <c> <S>			: "Š"	U0160 # LATIN CAPITAL LETTER S WITH CARON
 <Multi_key> <v> <S>			: "Š"	U0160 # LATIN CAPITAL LETTER S WITH CARON
@@ -1065,6 +1071,7 @@ XCOMM Latin Extended-B
 <dead_stroke> <z>				: "ƶ"	U01B6 # LATIN SMALL LETTER Z WITH STROKE
 <Multi_key> <slash> <z>				: "ƶ"	U01B6 # LATIN SMALL LETTER Z WITH STROKE
 <Multi_key> <KP_Divide> <z>			: "ƶ"	U01B6 # LATIN SMALL LETTER Z WITH STROKE
+<Multi_key> <Z> <H>				: "Ʒ"	U01B7 # LATIN CAPITAL LETTER EZH
 <dead_caron> <A>				: "Ǎ"	U01CD # LATIN CAPITAL LETTER A WITH CARON
 <Multi_key> <c> <A>				: "Ǎ"	U01CD # LATIN CAPITAL LETTER A WITH CARON
 <Multi_key> <v> <A>				: "Ǎ"	U01CD # LATIN CAPITAL LETTER A WITH CARON
@@ -1234,9 +1241,15 @@ XCOMM Latin Extended-B
 <dead_caron> <EZH>				: "Ǯ"	U01EE # LATIN CAPITAL LETTER EZH WITH CARON
 <Multi_key> <c> <EZH>				: "Ǯ"	U01EE # LATIN CAPITAL LETTER EZH WITH CARON
 <Multi_key> <v> <EZH>				: "Ǯ"	U01EE # LATIN CAPITAL LETTER EZH WITH CARON
+<dead_caron> <Multi_key> <Z> <H>		: "Ǯ"	U01EE # LATIN CAPITAL LETTER EZH WITH CARON
+<Multi_key> <c> <space> <Z> <H>			: "Ǯ"	U01EE # LATIN CAPITAL LETTER EZH WITH CARON
+<Multi_key> <v> <space> <Z> <H>			: "Ǯ"	U01EE # LATIN CAPITAL LETTER EZH WITH CARON
 <dead_caron> <ezh>				: "ǯ"	U01EF # LATIN SMALL LETTER EZH WITH CARON
 <Multi_key> <c> <ezh>				: "ǯ"	U01EF # LATIN SMALL LETTER EZH WITH CARON
 <Multi_key> <v> <ezh>				: "ǯ"	U01EF # LATIN SMALL LETTER EZH WITH CARON
+<dead_caron> <Multi_key> <z> <h>		: "ǯ"	U01EF # LATIN SMALL LETTER EZH WITH CARON
+<Multi_key> <c> <space> <z> <h>			: "ǯ"	U01EF # LATIN SMALL LETTER EZH WITH CARON
+<Multi_key> <v> <space> <z> <h>			: "ǯ"	U01EF # LATIN SMALL LETTER EZH WITH CARON
 <dead_caron> <j>				: "ǰ"	U01F0 # LATIN SMALL LETTER J WITH CARON
 <Multi_key> <c> <j>				: "ǰ"	U01F0 # LATIN SMALL LETTER J WITH CARON
 <Multi_key> <v> <j>				: "ǰ"	U01F0 # LATIN SMALL LETTER J WITH CARON
@@ -1416,6 +1429,7 @@ XCOMM IPA Extensions
 <dead_stroke> <i>				: "ɨ"	U0268 # LATIN SMALL LETTER I WITH STROKE
 <Multi_key> <slash> <i>				: "ɨ"	U0268 # LATIN SMALL LETTER I WITH STROKE
 <Multi_key> <KP_Divide> <i>			: "ɨ"	U0268 # LATIN SMALL LETTER I WITH STROKE
+<Multi_key> <z> <h>				: "ʒ"	U0292 # LATIN SMALL LETTER EZH
 
 XCOMM Spacing Modifier Letters
 <Multi_key> <slash> <U0294>				: "ʡ"	U02A1 # LATIN LETTER GLOTTAL STOP WITH STROKE
@@ -1678,7 +1692,12 @@ XCOMM Cyrillic
 <dead_diaeresis> <Cyrillic_yeru>	: "ӹ"	U04F9 # CYRILLIC SMALL LETTER YERU WITH DIAERESIS
 <Multi_key> <quotedbl> <Cyrillic_yeru>	: "ӹ"	U04F9 # CYRILLIC SMALL LETTER YERU WITH DIAERESIS
 
-XCOMM Several other scripts
+XCOMM Arabic
+<dead_hamza> <space>			: "ء"	Arabic_hamza # ARABIC LETTER HAMZA
+<dead_hamza> <dead_hamza>		: "ء"	Arabic_hamza # ARABIC LETTER HAMZA
+<dead_hamza> <Arabic_alef>		: "أ"	Arabic_hamzaonalef # ARABIC LETTER ALEF WITH HAMZA ABOVE
+<dead_hamza> <Arabic_waw>		: "ؤ"	Arabic_hamzaonwaw # ARABIC LETTER WAW WITH HAMZA ABOVE
+<dead_hamza> <Arabic_yeh>		: "ئ"	Arabic_hamzaonyeh # ARABIC LETTER YEH WITH HAMZA ABOVE
 <Multi_key> <U0653> <Arabic_alef>	: "آ"	U0622 # ARABIC LETTER ALEF WITH MADDA ABOVE
 <Multi_key> <U0654> <Arabic_alef>	: "أ"	U0623 # ARABIC LETTER ALEF WITH HAMZA ABOVE
 <Multi_key> <U0654> <Arabic_waw>	: "ؤ"	U0624 # ARABIC LETTER WAW WITH HAMZA ABOVE
@@ -1687,6 +1706,8 @@ XCOMM Several other scripts
 <Multi_key> <U0654> <U06D5>		: "ۀ"	U06C0 # ARABIC LETTER HEH WITH YEH ABOVE
 <Multi_key> <U0654> <U06C1>		: "ۂ"	U06C2 # ARABIC LETTER HEH GOAL WITH HAMZA ABOVE
 <Multi_key> <U0654> <U06D2>		: "ۓ"	U06D3 # ARABIC LETTER YEH BARREE WITH HAMZA ABOVE
+
+XCOMM Several other scripts
 <Multi_key> <U093C> <U0928>		: "ऩ"	U0929 # DEVANAGARI LETTER NNNA
 <Multi_key> <U093C> <U0930>		: "ऱ"	U0931 # DEVANAGARI LETTER RRA
 <Multi_key> <U093C> <U0933>		: "ऴ"	U0934 # DEVANAGARI LETTER LLLA
diff --git a/lib/libX11/src/CopyCmap.c b/lib/libX11/src/CopyCmap.c
index b37aba733..5444550cd 100644
--- a/lib/libX11/src/CopyCmap.c
+++ b/lib/libX11/src/CopyCmap.c
@@ -53,17 +53,12 @@ Colormap XCopyColormapAndFree(
     mid = req->mid = XAllocID(dpy);
     req->srcCmap = src_cmap;
 
-    /* re-lock the display to keep XID handling in sync */
     UnlockDisplay(dpy);
     SyncHandle();
-    LockDisplay(dpy);
 
 #if XCMS
     _XcmsCopyCmapRecAndFree(dpy, src_cmap, mid);
 #endif
 
-    UnlockDisplay(dpy);
-    SyncHandle();
-
     return(mid);
 }
diff --git a/lib/libX11/src/CrCmap.c b/lib/libX11/src/CrCmap.c
index 1b18a15bb..9904c7dda 100644
--- a/lib/libX11/src/CrCmap.c
+++ b/lib/libX11/src/CrCmap.c
@@ -48,12 +48,12 @@ Colormap XCreateColormap(
     if (visual == CopyFromParent) req->visual = CopyFromParent;
     else req->visual = visual->visualid;
 
+    UnlockDisplay(dpy);
+    SyncHandle();
+
 #ifdef XCMS
     _XcmsAddCmapRec(dpy, mid, w, visual);
 #endif
 
-    UnlockDisplay(dpy);
-    SyncHandle();
-
     return(mid);
 }
diff --git a/lib/libX11/src/FilterEv.c b/lib/libX11/src/FilterEv.c
index 0a48e5486..07845bcc0 100644
--- a/lib/libX11/src/FilterEv.c
+++ b/lib/libX11/src/FilterEv.c
@@ -100,6 +100,31 @@ XFilterEvent(
 	    }
 	}
     }
+    for (p = ev->xany.display->im_filters; p != NULL; p = p->next) {
+	/* Java sometimes calls XFilterEvent() with window=0 and ev come from
+	 * XNextEvent() when users type some keys quickly and switch multiple
+	 * input focuses in a Java window with the keys.
+	 * But XKeyEvent filters need to receive the event with window=0 for
+	 * _XimPendingFilter() and _XimUnfabricateSerial() to clear the
+	 * fowarded XKeyEvent with XIM_FORWARD_EVENT.
+	 *
+	 * The case of p->window == 0 is checkekd after all cases of p->window
+	 * != 0 are checked because all input contexts share
+	 * Display->im_filters but each input context has
+	 * Xic->private.proto.registed_filter_event for the filters
+	 * and same p->filter could be registerd to Display->im_filters twice
+	 * with different p->window.
+	 */
+	if (p->window == 0 && window == 0) {
+	    if ((mask & p->event_mask) ||
+		(ev->type >= p->start_type && ev->type <= p->end_type)) {
+		UnlockDisplay(ev->xany.display);
+		ret = (*(p->filter))(ev->xany.display, p->window, ev,
+				      p->client_data);
+		return(ret);
+	    }
+	}
+    }
     UnlockDisplay(ev->xany.display);
 #endif
     return(False);
diff --git a/lib/libX11/src/FreeCmap.c b/lib/libX11/src/FreeCmap.c
index 68496dd88..e2b76fa6f 100644
--- a/lib/libX11/src/FreeCmap.c
+++ b/lib/libX11/src/FreeCmap.c
@@ -41,12 +41,12 @@ XFreeColormap(
     LockDisplay(dpy);
     GetResReq(FreeColormap, cmap, req);
 
+    UnlockDisplay(dpy);
+    SyncHandle();
+
 #ifdef XCMS
     _XcmsDeleteCmapRec(dpy, cmap);
 #endif
 
-    UnlockDisplay(dpy);
-    SyncHandle();
-
     return 1;
 }
diff --git a/lib/libX11/src/KeyBind.c b/lib/libX11/src/KeyBind.c
index a8181b91b..a5e221319 100644
--- a/lib/libX11/src/KeyBind.c
+++ b/lib/libX11/src/KeyBind.c
@@ -958,8 +958,9 @@ XRebindKeysym (
     memcpy ((char *) p->modifiers, (char *) mlist, (size_t) nb);
     p->key = keysym;
     p->mlen = nm;
-    ComputeMaskFromKeytrans(dpy, p);
     UnlockDisplay(dpy);
+    ComputeMaskFromKeytrans(dpy, p);
+
     return 0;
 }
 
diff --git a/lib/libX11/src/imConv.c b/lib/libX11/src/imConv.c
index 48bc79005..5a5b83dc8 100644
--- a/lib/libX11/src/imConv.c
+++ b/lib/libX11/src/imConv.c
@@ -177,6 +177,8 @@ _XimLookupMBText(
     if ((nbytes == 0) || (symbol == NoSymbol)) return count;
 
     if (count > 1) {
+	if ((unsigned)count >= sizeof(look))
+	    return 0;
 	memcpy(look, (char *)buffer,count);
 	look[count] = '\0';
 	if ((count = im->methods->ctstombs(ic->core.im,
@@ -320,6 +322,8 @@ _XimLookupUTF8Text(
     if ((nbytes == 0) || (symbol == NoSymbol)) return count;
 
     if (count > 1) {
+	if ((unsigned)count >= sizeof(look))
+	    return 0;
 	memcpy(look, (char *)buffer,count);
 	look[count] = '\0';
 	if ((count = im->methods->ctstoutf8(ic->core.im,
diff --git a/lib/libX11/src/xcms/cmsCmap.c b/lib/libX11/src/xcms/cmsCmap.c
index c7087ecb1..4b229477b 100644
--- a/lib/libX11/src/xcms/cmsCmap.c
+++ b/lib/libX11/src/xcms/cmsCmap.c
@@ -87,12 +87,17 @@ CmapRecForColormap(
     _XAsyncHandler async;
     _XAsyncErrorState async_state;
 
+    LockDisplay(dpy);
     for (pRec = (XcmsCmapRec *)dpy->cms.clientCmaps; pRec != NULL;
 	    pRec = pRec->pNext) {
 	if (pRec->cmapID == cmap) {
+            UnlockDisplay(dpy);
+            SyncHandle();
 	    return(pRec);
 	}
     }
+    UnlockDisplay(dpy);
+    SyncHandle();
 
     /*
      * Can't find an XcmsCmapRec associated with cmap in our records.
@@ -258,9 +263,12 @@ _XcmsAddCmapRec(
     pNew->dpy = dpy;
     pNew->windowID = windowID;
     pNew->visual = visual;
+    LockDisplay(dpy);
     pNew->pNext = (XcmsCmapRec *)dpy->cms.clientCmaps;
     dpy->cms.clientCmaps = (XPointer)pNew;
     dpy->free_funcs->clientCmaps = _XcmsFreeClientCmaps;
+    UnlockDisplay(dpy);
+    SyncHandle();
 
     /*
      * Note, we don't create the XcmsCCC for pNew->ccc here because
@@ -342,6 +350,7 @@ _XcmsDeleteCmapRec(
     }
 
     /* search for it in the list */
+    LockDisplay(dpy);
     pPrevPtr = (XcmsCmapRec **)&dpy->cms.clientCmaps;
     while ((pRec = *pPrevPtr) && (pRec->cmapID != cmap)) {
 	pPrevPtr = &pRec->pNext;
@@ -354,6 +363,8 @@ _XcmsDeleteCmapRec(
 	*pPrevPtr = pRec->pNext;
 	Xfree(pRec);
     }
+    UnlockDisplay(dpy);
+    SyncHandle();
 }
 
 
@@ -378,6 +389,7 @@ _XcmsFreeClientCmaps(
 {
     XcmsCmapRec *pRecNext, *pRecFree;
 
+    LockDisplay(dpy);
     pRecNext = (XcmsCmapRec *)dpy->cms.clientCmaps;
     while (pRecNext != NULL) {
 	pRecFree = pRecNext;
@@ -390,6 +402,8 @@ _XcmsFreeClientCmaps(
 	Xfree(pRecFree);
     }
     dpy->cms.clientCmaps = (XPointer)NULL;
+    UnlockDisplay(dpy);
+    SyncHandle();
 }
 
 
diff --git a/lib/libX11/src/xcms/cmsTrig.c b/lib/libX11/src/xcms/cmsTrig.c
index b23033aa8..ebb92be5b 100644
--- a/lib/libX11/src/xcms/cmsTrig.c
+++ b/lib/libX11/src/xcms/cmsTrig.c
@@ -71,7 +71,11 @@ _XcmsModuloF(
 #define XCMS_SIXTHPI		0.523598775598298820
 #define XCMS_RADIANS(d)		((d) * XCMS_PI / 180.0)
 #define XCMS_DEGREES(r)		((r) * 180.0 / XCMS_PI)
+#ifdef __vax__
+#define XCMS_X6_UNDERFLOWS	(3.784659e-07)	/* X**6 almost underflows*/
+#else
 #define XCMS_X6_UNDERFLOWS	(4.209340e-52)	/* X**6 almost underflows */
+#endif
 #define XCMS_X16_UNDERFLOWS	(5.421010e-20)	/* X**16 almost underflows*/
 #define XCMS_CHAR_BIT		8
 #define XCMS_LONG_MAX		0x7FFFFFFF
diff --git a/lib/libX11/src/xkb/XKBMAlloc.c b/lib/libX11/src/xkb/XKBMAlloc.c
index 8b3be3039..0563a688b 100644
--- a/lib/libX11/src/xkb/XKBMAlloc.c
+++ b/lib/libX11/src/xkb/XKBMAlloc.c
@@ -795,7 +795,7 @@ XkbResizeKeyActions(XkbDescPtr xkb, int key, int needed)
     register int i, nActs;
     XkbAction *newActs;
 
-    if (needed == 0) {
+    if (needed <= 0) {
         xkb->server->key_acts[key] = 0;
         return NULL;
     }
diff --git a/lib/libX11/src/xlibi18n/XimintP.h b/lib/libX11/src/xlibi18n/XimintP.h
index 674da0295..1afa3c75f 100644
--- a/lib/libX11/src/xlibi18n/XimintP.h
+++ b/lib/libX11/src/xlibi18n/XimintP.h
@@ -149,6 +149,10 @@ typedef struct _XimProtoPrivateRec {
     XimTransRegDispatcher	 register_dispatcher;
     XimTransCallDispatcher	 call_dispatcher;
     XPointer			 spec;
+
+    unsigned long		 fabricated_serial;
+    Time			 fabricated_time;
+    Bool			 enable_fabricated_order;
 } XimProtoPrivateRec;
 
 /*
@@ -307,4 +311,20 @@ typedef struct _XicProtoPrivateRec {
 #define XIM_MAXIMNAMELEN 64
 #define XIM_MAXLCNAMELEN 64
 
+Bool
+_XimFabricateSerial(
+    Xim                  im,
+    XKeyEvent           *event);
+
+Bool
+_XimUnfabricateSerial(
+    Xim                  im,
+    Xic                  ic,
+    XKeyEvent           *event);
+
+Bool
+_XimIsFabricatedSerial(
+    Xim                  im,
+    XKeyEvent           *event);
+
 #endif /* _XIMINTP_H */
diff --git a/lib/libX11/src/xlibi18n/lcFile.c b/lib/libX11/src/xlibi18n/lcFile.c
index b6cf93f26..060cd83f3 100644
--- a/lib/libX11/src/xlibi18n/lcFile.c
+++ b/lib/libX11/src/xlibi18n/lcFile.c
@@ -626,9 +626,9 @@ _XlcLocaleDirName(char *dir_name, size_t dir_len, const char *lc_name)
     Xfree (last_dir_name);
     Xfree (last_lc_name);
 
-    last_dir_len = strlen (dir_name) + 1;
-    last_dir_name = Xmalloc (last_dir_len);
-    strcpy (last_dir_name, dir_name);
+    last_dir_name = strdup (dir_name);
+    last_dir_len = (last_dir_name != NULL) ? strlen (last_dir_name) + 1 : 0;
+
     last_lc_name = strdup (lc_name);
 
     return dir_name;
@@ -703,9 +703,9 @@ _XlcLocaleLibDirName(char *dir_name, size_t dir_len, const char *lc_name)
     Xfree (last_dir_name);
     Xfree (last_lc_name);
 
-    last_dir_len = strlen (dir_name) + 1;
-    last_dir_name = Xmalloc (last_dir_len);
-    strcpy (last_dir_name, dir_name);
+    last_dir_name = strdup (dir_name);
+    last_dir_len = (last_dir_name != NULL) ? strlen (last_dir_name) + 1 : 0;
+
     last_lc_name = strdup (lc_name);
 
     return dir_name;