diff --git a/SOURCES/rpm-4.14.3-add-path-query-option.patch b/SOURCES/rpm-4.14.3-add-path-query-option.patch
index 51b37db..0504ec8 100644
--- a/SOURCES/rpm-4.14.3-add-path-query-option.patch
+++ b/SOURCES/rpm-4.14.3-add-path-query-option.patch
@@ -1,4 +1,4 @@
-From 5e26aa82fb1792c0441131db8dc87976d2d653bb Mon Sep 17 00:00:00 2001
+From 013cd4ba63c35fa75feeccde0022d56e68bc5845 Mon Sep 17 00:00:00 2001
 From: Michal Domonkos <mdomonko@redhat.com>
 Date: Mon, 16 Aug 2021 18:21:02 +0200
 Subject: [PATCH] Add support for RPMDBI_BASENAMES on file queries
@@ -14,8 +14,11 @@ Update the man page for --file to reflect it's current behavior and make
 
 Resolves: rhbz#1940895
 
-Combined with d1aebda01033bc8ba0d748b49f6fad9a5c0caa3f and backported
-for 4.14.3.
+Combined with:
+d1aebda01033bc8ba0d748b49f6fad9a5c0caa3f
+f62b6d27cd741406a52a7e9c5b1d6f581dbd3af8
+
+Backported for 4.14.3.
 ---
  doc/rpm.8         |  9 ++++++--
  lib/poptQV.c      |  6 +++++-
@@ -115,17 +118,17 @@ index 26cdecf10..e6ea1fa2d 100644
  	    mi = rpmtsInitIterator(ts, RPMDBI_PROVIDENAME, fn, 0);
  
 diff --git a/lib/rpmcli.h b/lib/rpmcli.h
-index 99af2585a..330fd956f 100644
+index 99af2585a..c0d07d137 100644
 --- a/lib/rpmcli.h
 +++ b/lib/rpmcli.h
-@@ -82,6 +82,7 @@ rpmcliFini(poptContext optCon);
- enum rpmQVSources_e {
-     RPMQV_PACKAGE = 0,	/*!< ... from package name db search. */
-     RPMQV_PATH,		/*!< ... from file path db search. */
+@@ -102,6 +102,7 @@ enum rpmQVSources_e {
+     RPMQV_SPECBUILTRPMS,	/*!< ... from pkgs which would be built from spec */
+     RPMQV_WHATOBSOLETES,	/*!< ... from obsoletes db search. */
+     RPMQV_WHATCONFLICTS,	/*!< ... from conflicts db search. */
 +    RPMQV_PATH_ALL,	/*!< ... from file path db search (all states). */
-     RPMQV_ALL,		/*!< ... from each installed package. */
-     RPMQV_RPM, 		/*!< ... from reading binary rpm package. */
-     RPMQV_GROUP,	/*!< ... from group db search. */
+ };
+ 
+ typedef rpmFlags rpmQVSources;
 diff --git a/tests/rpmquery.at b/tests/rpmquery.at
 index 36c62339a..ad580f664 100644
 --- a/tests/rpmquery.at
@@ -190,5 +193,5 @@ index 36c62339a..ad580f664 100644
  AT_SETUP([integer array query])
  AT_KEYWORDS([query])
 -- 
-2.33.1
+2.35.1
 
diff --git a/SOURCES/rpm-4.14.3-fix-spurious-transfiletriggerpostun-execution.patch b/SOURCES/rpm-4.14.3-fix-spurious-transfiletriggerpostun-execution.patch
new file mode 100644
index 0000000..6b26ec5
--- /dev/null
+++ b/SOURCES/rpm-4.14.3-fix-spurious-transfiletriggerpostun-execution.patch
@@ -0,0 +1,184 @@
+From f17aa638649fb8de730fecdbc906dc869b626ba5 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Tue, 16 Nov 2021 11:49:18 +0200
+Subject: [PATCH 1/2] Fix spurious %transfiletriggerpostun execution
+ (RhBug:2023311)
+
+If a package has multiple %transfiletriggerpostun triggers, any one
+of them matching would cause all of them to run, due to disconnect
+in the intel gathering stage: we'd gather all the headers with matching
+files into a lump, and then add any postun triggers found in them,
+but this loses the triggering file information and causes all postuns
+to run.
+
+The triggers need to be added while looping over the file matches,
+like runFileTriggers() does. Doing so actually simplifies the code.
+These should really be unified to use the same code, but leaving
+that exercise to another rainy day.
+---
+ lib/rpmtriggers.c | 64 +++++++++++++++++++++++------------------------
+ 1 file changed, 31 insertions(+), 33 deletions(-)
+
+diff --git a/lib/rpmtriggers.c b/lib/rpmtriggers.c
+index 0827af0c2..dc457f7cc 100644
+--- a/lib/rpmtriggers.c
++++ b/lib/rpmtriggers.c
+@@ -97,19 +97,37 @@ static void rpmtriggersSortAndUniq(rpmtriggers trigs)
+     }
+ }
+ 
++static void addTriggers(rpmts ts, Header trigH, rpmsenseFlags filter)
++{
++    int tix = 0;
++    rpmds ds;
++    rpmds triggers = rpmdsNew(trigH, RPMTAG_TRANSFILETRIGGERNAME, 0);
++
++    while ((ds = rpmdsFilterTi(triggers, tix))) {
++	if ((rpmdsNext(ds) >= 0) && (rpmdsFlags(ds) & filter)) {
++	    struct rpmtd_s priorities;
++
++	    if (headerGet(trigH, RPMTAG_TRANSFILETRIGGERPRIORITIES,
++			&priorities, HEADERGET_MINMEM)) {
++		rpmtdSetIndex(&priorities, tix);
++		rpmtriggersAdd(ts->trigs2run, headerGetInstance(trigH),
++				tix, *rpmtdGetUint32(&priorities));
++	    }
++	}
++	rpmdsFree(ds);
++	tix++;
++    }
++    rpmdsFree(triggers);
++}
++
+ void rpmtriggersPrepPostUnTransFileTrigs(rpmts ts, rpmte te)
+ {
+-    rpmdbMatchIterator mi;
+     rpmdbIndexIterator ii;
+-    Header trigH;
+     const void *key;
+     size_t keylen;
+     rpmfiles files;
+-    rpmds rpmdsTriggers;
+-    rpmds rpmdsTrigger;
+ 
+     ii = rpmdbIndexIteratorInit(rpmtsGetRdb(ts), RPMDBI_TRANSFILETRIGGERNAME);
+-    mi = rpmdbNewIterator(rpmtsGetRdb(ts), RPMDBI_PACKAGES);
+     files = rpmteFiles(te);
+ 
+     /* Iterate over file triggers in rpmdb */
+@@ -121,39 +139,19 @@ void rpmtriggersPrepPostUnTransFileTrigs(rpmts ts, rpmte te)
+ 	rpmfi fi = rpmfilesFindPrefix(files, pfx);
+ 	while (rpmfiNext(fi) >= 0) {
+ 	    if (RPMFILE_IS_INSTALLED(rpmfiFState(fi))) {
+-		/* If yes then store it */
+-		rpmdbAppendIterator(mi, rpmdbIndexIteratorPkgOffsets(ii),
+-				rpmdbIndexIteratorNumPkgs(ii));
+-		break;
++		unsigned int npkg = rpmdbIndexIteratorNumPkgs(ii);
++		const unsigned int *offs = rpmdbIndexIteratorPkgOffsets(ii);
++		/* Save any matching postun triggers */
++		for (int i = 0; i < npkg; i++) {
++		    Header h = rpmdbGetHeaderAt(rpmtsGetRdb(ts), offs[i]);
++		    addTriggers(ts, h, RPMSENSE_TRIGGERPOSTUN);
++		    headerFree(h);
++		}
+ 	    }
+ 	}
+ 	rpmfiFree(fi);
+     }
+     rpmdbIndexIteratorFree(ii);
+-
+-    if (rpmdbGetIteratorCount(mi)) {
+-	/* Filter triggers and save only trans postun triggers into ts */
+-	while ((trigH = rpmdbNextIterator(mi)) != NULL) {
+-	    int tix = 0;
+-	    rpmdsTriggers = rpmdsNew(trigH, RPMTAG_TRANSFILETRIGGERNAME, 0);
+-	    while ((rpmdsTrigger = rpmdsFilterTi(rpmdsTriggers, tix))) {
+-		if ((rpmdsNext(rpmdsTrigger) >= 0) &&
+-		    (rpmdsFlags(rpmdsTrigger) & RPMSENSE_TRIGGERPOSTUN)) {
+-		    struct rpmtd_s priorities;
+-
+-		    headerGet(trigH, RPMTAG_TRANSFILETRIGGERPRIORITIES,
+-				&priorities, HEADERGET_MINMEM);
+-		    rpmtdSetIndex(&priorities, tix);
+-		    rpmtriggersAdd(ts->trigs2run, rpmdbGetIteratorOffset(mi),
+-				    tix, *rpmtdGetUint32(&priorities));
+-		}
+-		rpmdsFree(rpmdsTrigger);
+-		tix++;
+-	    }
+-	    rpmdsFree(rpmdsTriggers);
+-	}
+-    }
+-    rpmdbFreeIterator(mi);
+     rpmfilesFree(files);
+ }
+ 
+-- 
+2.35.1
+
+From e617e7c550d3523998707c55f96b37ede2c48c78 Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Wed, 2 Feb 2022 13:46:23 +0200
+Subject: [PATCH 2/2] Really fix spurious %transfiletriggerpostun execution
+ (RhBug:2023311)
+
+Commit b3d672a5523dfec033160e5cc866432a0e808649 got the base reasoning
+in the ballpark but the code all wrong, introducing a severe performance
+regression without actually fixing what it claimed to.
+
+The missing incredient is actually comparing the current prefix with the
+triggers in matched package (trying to describe this makes my head
+spin): a package may have multiple triggers on multiple prefixes and
+we need to make sure we only execute triggers of this type, from this
+prefix.
+
+This stuff really needs more and better testcases.
+
+Fixes: b3d672a5523dfec033160e5cc866432a0e808649
+---
+ lib/rpmtriggers.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/lib/rpmtriggers.c b/lib/rpmtriggers.c
+index dc457f7cc..c652981be 100644
+--- a/lib/rpmtriggers.c
++++ b/lib/rpmtriggers.c
+@@ -97,14 +97,16 @@ static void rpmtriggersSortAndUniq(rpmtriggers trigs)
+     }
+ }
+ 
+-static void addTriggers(rpmts ts, Header trigH, rpmsenseFlags filter)
++static void addTriggers(rpmts ts, Header trigH, rpmsenseFlags filter,
++			const char *prefix)
+ {
+     int tix = 0;
+     rpmds ds;
+     rpmds triggers = rpmdsNew(trigH, RPMTAG_TRANSFILETRIGGERNAME, 0);
+ 
+     while ((ds = rpmdsFilterTi(triggers, tix))) {
+-	if ((rpmdsNext(ds) >= 0) && (rpmdsFlags(ds) & filter)) {
++	if ((rpmdsNext(ds) >= 0) && (rpmdsFlags(ds) & filter) &&
++		strcmp(prefix, rpmdsN(ds)) == 0) {
+ 	    struct rpmtd_s priorities;
+ 
+ 	    if (headerGet(trigH, RPMTAG_TRANSFILETRIGGERPRIORITIES,
+@@ -141,12 +143,13 @@ void rpmtriggersPrepPostUnTransFileTrigs(rpmts ts, rpmte te)
+ 	    if (RPMFILE_IS_INSTALLED(rpmfiFState(fi))) {
+ 		unsigned int npkg = rpmdbIndexIteratorNumPkgs(ii);
+ 		const unsigned int *offs = rpmdbIndexIteratorPkgOffsets(ii);
+-		/* Save any matching postun triggers */
++		/* Save any postun triggers matching this prefix */
+ 		for (int i = 0; i < npkg; i++) {
+ 		    Header h = rpmdbGetHeaderAt(rpmtsGetRdb(ts), offs[i]);
+-		    addTriggers(ts, h, RPMSENSE_TRIGGERPOSTUN);
++		    addTriggers(ts, h, RPMSENSE_TRIGGERPOSTUN, pfx);
+ 		    headerFree(h);
+ 		}
++		break;
+ 	    }
+ 	}
+ 	rpmfiFree(fi);
+-- 
+2.35.1
+
diff --git a/SOURCES/rpm-4.14.3-skip-recorded-symlinks-in-setperms.patch b/SOURCES/rpm-4.14.3-skip-recorded-symlinks-in-setperms.patch
new file mode 100644
index 0000000..ee12010
--- /dev/null
+++ b/SOURCES/rpm-4.14.3-skip-recorded-symlinks-in-setperms.patch
@@ -0,0 +1,40 @@
+From 2e61e5846f8301f85da9d30281538ea736d96fd0 Mon Sep 17 00:00:00 2001
+From: Michal Domonkos <mdomonko@redhat.com>
+Date: Tue, 7 Dec 2021 08:08:37 +0100
+Subject: [PATCH] Skip recorded symlinks in --setperms (RhBug:1900662)
+
+If a package contains a symlink in the buildroot which is declared as a
+ghost or config file but is a regular file or directory on the system
+where it's installed, a --setperms call will reset its permissions to
+those of a symlink (777 on Linux), which almost certainly is not the
+correct thing to do.
+
+To fix that, just skip files that were recorded as symlinks.
+
+This is a special case of a general issue in --setperms; since file
+permission semantics may change depending on the file type, to stay on
+the safe side, any (ghost or config) file whose type changes after
+installation should probably be skipped.  However, symlinks are the most
+prominent case here, so let's just focus on that now and avoid adding
+too much cleverness to a popt alias (this got us into trouble not too
+long ago, see commits 38c2f6e and 0d83637).  We may revisit this in the
+eventual C implementation.
+---
+ rpmpopt.in | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/rpmpopt.in b/rpmpopt.in
+index 67fcabfb1..e130a5d05 100644
+--- a/rpmpopt.in
++++ b/rpmpopt.in
+@@ -44,6 +44,7 @@ rpm	alias --scripts --qf '\
+ 	--POPTdesc=$"list install/erase scriptlets from package(s)"
+ 
+ rpm	alias --setperms -q --qf '[\[ -L %{FILENAMES:shescape} \] || \
++        \[ -n %{FILELINKTOS:shescape} \] || \
+         ( \[ $((%{FILEFLAGS} & 2#1001000)) != 0 \] && \[ ! -e %{FILENAMES:shescape} \] ) || \
+         chmod %7{FILEMODES:octal} %{FILENAMES:shescape}\n]' \
+ 		   --pipe "grep -v \(none\) | grep '^. -L ' | sed 's/chmod .../chmod /' | sh" \
+-- 
+2.35.1
+
diff --git a/SPECS/rpm.spec b/SPECS/rpm.spec
index a13c2fa..0191e89 100644
--- a/SPECS/rpm.spec
+++ b/SPECS/rpm.spec
@@ -42,7 +42,7 @@
 
 %global rpmver 4.14.3
 #global snapver rc2
-%global rel 21.6
+%global rel 23.1
 
 %global srcver %{version}%{?snapver:-%{snapver}}
 %global srcdir %{?snapver:testing}%{!?snapver:%{name}-%(echo %{version} | cut -d'.' -f1-2).x}
@@ -122,6 +122,8 @@ Patch158: rpm-4.14.3-imp-covscan-fixes.patch
 Patch159: rpm-4.14.3-add-path-query-option.patch
 Patch160: rpm-4.14.3-macroize-find-debuginfo-script-location.patch
 Patch161: rpm-4.14.3-validate-and-require-subkey-binding-sigs.patch
+Patch162: rpm-4.14.3-fix-spurious-transfiletriggerpostun-execution.patch
+Patch163: rpm-4.14.3-skip-recorded-symlinks-in-setperms.patch
 
 # Python 3 string API sanity
 Patch500: 0001-In-Python-3-return-all-our-string-data-as-surrogate-.patch
@@ -830,6 +832,12 @@ make check || cat tests/rpmtests.log
 %doc doc/librpm/html/*
 
 %changelog
+* Mon May 16 2022 Manu Bretelle <chantra@fb.com> - 4.14.3-23.1
+-  Rebuild for Hyperscale
+
+* Tue Apr 05 2022 Michal Domonkos <mdomonko@redhat.com> - 4.14.3-23
+- Fix minor ABI regression in rpmcli.h (#1940895)
+
 * Fri Mar 25 2022 Manu Bretelle <chantra@fb.com> - 4.14.3-21.6
 - Make `rpm -i` work without `--nodigest`
 - Remove need of executable stack for reflink plugin
@@ -838,7 +846,11 @@ make check || cat tests/rpmtests.log
 * Fri Mar 04 2022 Manu Bretelle <chantra@fb.com> - 4.14.3-21.5
 - Backport GH#1040 to allow ndb DB query on read-only FS
 
-* Tue Feb 14 2022 Manu Bretelle <chantra@fb.com> - 4.14.3-21.4
+* Tue Feb 15 2022 Michal Domonkos <mdomonko@redhat.com> - 4.14.3-22
+- Fix spurious %transfiletriggerpostun execution (#2023693)
+- Skip recorded symlinks in --setperms (#1900662)
+
+* Mon Feb 14 2022 Manu Bretelle <chantra@fb.com> - 4.14.3-21.4
 - Use ndb by default
 - Fix support for hardlinks