diff --git a/.gitignore b/.gitignore
index 8d9599f..79c4020 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,3 @@
-SOURCES/grafana-7.5.9.tar.gz
-SOURCES/grafana-vendor-7.5.9-2.tar.xz
-SOURCES/grafana-webpack-7.5.9-2.tar.gz
+SOURCES/grafana-7.5.11.tar.gz
+SOURCES/grafana-vendor-7.5.11-1.tar.xz
+SOURCES/grafana-webpack-7.5.11-1.tar.gz
diff --git a/.grafana.metadata b/.grafana.metadata
index af2fa86..d33b818 100644
--- a/.grafana.metadata
+++ b/.grafana.metadata
@@ -1,3 +1,3 @@
-e658bc3706a71a2a77f34755ac362fd506d7b1a0 SOURCES/grafana-7.5.9.tar.gz
-8fc46c12ac1bae0f2e0434e8fdf71e61e922c74a SOURCES/grafana-vendor-7.5.9-2.tar.xz
-28052475c9cb45ac6523479ab9fd3da4ba678400 SOURCES/grafana-webpack-7.5.9-2.tar.gz
+cd7bfb63dd91361c1bc9c46d1f889b1f54f7758a SOURCES/grafana-7.5.11.tar.gz
+d55ac0b3a8fb3a0ce772442923e2ca3cba1af78f SOURCES/grafana-vendor-7.5.11-1.tar.xz
+db79c330e9a56dac2cdcae9b7c07c86112a66237 SOURCES/grafana-webpack-7.5.11-1.tar.gz
diff --git a/SOURCES/002-manpages.patch b/SOURCES/002-manpages.patch
index ccc1385..36ca294 100644
--- a/SOURCES/002-manpages.patch
+++ b/SOURCES/002-manpages.patch
@@ -4,7 +4,7 @@ index 0000000000..7ac2af882c
 --- /dev/null
 +++ b/docs/man/man1/grafana-cli.1
 @@ -0,0 +1,60 @@
-+.TH GRAFANA "1" "June 2021" "Grafana cli version 7.5.9" "User Commands"
++.TH GRAFANA "1" "October 2021" "Grafana cli version 7.5.11" "User Commands"
 +.SH NAME
 +grafana-cli \- command line administration for the Grafana metrics dashboard and graph editor
 +.SH DESCRIPTION
@@ -70,7 +70,7 @@ index 0000000000..c616268b31
 --- /dev/null
 +++ b/docs/man/man1/grafana-server.1
 @@ -0,0 +1,72 @@
-+.TH VERSION "1" "June 2021" "Version 7.5.9" "User Commands"
++.TH VERSION "1" "October 2021" "Version 7.5.11" "User Commands"
 +.SH NAME
 +grafana-server \- back-end server for the Grafana metrics dashboard and graph editor
 +.SH DESCRIPTION
diff --git a/SOURCES/Makefile b/SOURCES/Makefile
index acd932c..dab531d 100644
--- a/SOURCES/Makefile
+++ b/SOURCES/Makefile
@@ -1,19 +1,24 @@
-ifndef VER
-  $(error VER is undefined)
-endif
-ifndef REL
-  $(error REL is undefined)
-endif
+VERSION := $(shell rpm --specfile *.spec --qf '%{VERSION}\n' | head -1)
+RELEASE := $(shell rpm --specfile *.spec --qf '%{RELEASE}\n' | head -1 | cut -d. -f1)
 
 NAME       := grafana
 RPM_NAME   := $(NAME)
-SOURCE_DIR := $(NAME)-$(VER)
-SOURCE_TAR := $(NAME)-$(VER).tar.gz
-VENDOR_TAR := $(RPM_NAME)-vendor-$(VER)-$(REL).tar.xz
-WEBPACK_TAR := $(RPM_NAME)-webpack-$(VER)-$(REL).tar.gz
+SOURCE_DIR := $(NAME)-$(VERSION)
+SOURCE_TAR := $(NAME)-$(VERSION).tar.gz
+VENDOR_TAR := $(RPM_NAME)-vendor-$(VERSION)-$(RELEASE).tar.xz
+WEBPACK_TAR := $(RPM_NAME)-webpack-$(VERSION)-$(RELEASE).tar.gz
+
+# patches which must be applied before creating the vendor tarball, for example:
+# - changes in dependency versions
+# - changes in Go module imports (which affect the vendored Go modules)
+PATCHES_PRE_VENDOR := \
+	005-remove-unused-dependencies.patch \
+	008-remove-unused-frontend-crypto.patch
+
+# patches which must be applied before creating the webpack, for example:
+# - changes in Node.js sources or vendored dependencies
+PATCHES_PRE_WEBPACK :=
 
-ALL_PATCHES := $(wildcard *.patch)
-PATCHES_TO_APPLY := $(filter-out 009-patch-unused-backend-crypto.patch 010-fips.patch,$(ALL_PATCHES))
 
 all: $(SOURCE_TAR) $(VENDOR_TAR) $(WEBPACK_TAR)
 
@@ -21,43 +26,52 @@ $(SOURCE_TAR):
 	spectool -g $(RPM_NAME).spec
 
 $(VENDOR_TAR): $(SOURCE_TAR)
-	rm -rf grafana-$(VER)
-	tar xfz grafana-$(VER).tar.gz
+	# start with a clean state
+	rm -rf $(SOURCE_DIR)
+	tar xf $(SOURCE_TAR)
 
-	# patches can affect Go or Node.js dependencies, or the webpack
-	for patch in $(PATCHES_TO_APPLY); do patch -d grafana-$(VER) -p1 --fuzz=0 < $$patch; done
+	# Patches to apply before vendoring
+	for patch in $(PATCHES_PRE_VENDOR); do echo applying $$patch ...; patch -d $(SOURCE_DIR) -p1 --fuzz=0 < $$patch; done
 
 	# Go
-	cd grafana-$(VER) && go mod vendor -v
+	cd $(SOURCE_DIR) && go mod vendor -v
 	# Remove unused crypto
-	rm grafana-$(VER)/vendor/golang.org/x/crypto/cast5/cast5.go
-	rm grafana-$(VER)/vendor/golang.org/x/crypto/ed25519/ed25519.go
-	rm grafana-$(VER)/vendor/golang.org/x/crypto/ed25519/internal/edwards25519/const.go
-	rm grafana-$(VER)/vendor/golang.org/x/crypto/ed25519/internal/edwards25519/edwards25519.go
-	rm grafana-$(VER)/vendor/golang.org/x/crypto/openpgp/elgamal/elgamal.go
-	rm grafana-$(VER)/vendor/golang.org/x/crypto/openpgp/packet/ocfb.go
-	awk '$$2~/^v/ && $$4 != "indirect" {print "Provides: bundled(golang(" $$1 ")) = " substr($$2, 2)}' grafana-$(VER)/go.mod | \
+	rm $(SOURCE_DIR)/vendor/golang.org/x/crypto/cast5/cast5.go
+	rm $(SOURCE_DIR)/vendor/golang.org/x/crypto/ed25519/ed25519.go
+	rm $(SOURCE_DIR)/vendor/golang.org/x/crypto/ed25519/internal/edwards25519/const.go
+	rm $(SOURCE_DIR)/vendor/golang.org/x/crypto/ed25519/internal/edwards25519/edwards25519.go
+	rm $(SOURCE_DIR)/vendor/golang.org/x/crypto/openpgp/elgamal/elgamal.go
+	rm $(SOURCE_DIR)/vendor/golang.org/x/crypto/openpgp/packet/ocfb.go
+	awk '$$2~/^v/ && $$4 != "indirect" {print "Provides: bundled(golang(" $$1 ")) = " substr($$2, 2)}' $(SOURCE_DIR)/go.mod | \
 		sed -E 's/=(.*)-(.*)-(.*)/=\1-\2.\3/g' > $@.manifest
 
 	# Node.js
-	cd grafana-$(VER) && yarn install --pure-lockfile
+	cd $(SOURCE_DIR) && yarn install --pure-lockfile
 	# Remove files with licensing issues
-	find grafana-$(VER) -type d -name 'node-notifier' -prune -exec rm -r {} \;
-	find grafana-$(VER) -type d -name 'property-information' -prune -exec rm -r {} \;
-	find grafana-$(VER) -type f -name '*.exe' -delete
-	rm -r grafana-$(VER)/node_modules/visjs-network/examples
-	./list_bundled_nodejs_packages.py grafana-$(VER)/ >> $@.manifest
+	find $(SOURCE_DIR) -type d -name 'node-notifier' -prune -exec rm -r {} \;
+	find $(SOURCE_DIR) -type d -name 'property-information' -prune -exec rm -r {} \;
+	find $(SOURCE_DIR) -type f -name '*.exe' -delete
+	rm -r $(SOURCE_DIR)/node_modules/visjs-network/examples
+	./list_bundled_nodejs_packages.py $(SOURCE_DIR) >> $@.manifest
 
 	# Create tarball
-	XZ_OPT=-9 tar cfJ $@ \
-		grafana-$(VER)/vendor \
-		$$(find grafana-$(VER) -type d -name "node_modules" -prune)
+	XZ_OPT=-9 time -p tar cJf $@ \
+		$(SOURCE_DIR)/vendor \
+		$$(find $(SOURCE_DIR) -type d -name "node_modules" -prune)
 
 $(WEBPACK_TAR): $(VENDOR_TAR)
-	cd grafana-$(VER) && \
+	# start with a clean state
+	rm -rf $(SOURCE_DIR)
+	tar xf $(SOURCE_TAR)
+	tar xf $(VENDOR_TAR)
+
+	# Patches to apply before creating the webpack
+	for patch in $(PATCHES_PRE_WEBPACK); do echo applying $$patch ...; patch -d $(SOURCE_DIR) -p1 --fuzz=0 < $$patch; done
+
+	cd $(SOURCE_DIR) && \
 		../build_frontend.sh
 
-	tar cfz $@ grafana-$(VER)/public/build grafana-$(VER)/public/views grafana-$(VER)/plugins-bundled
+	tar cfz $@ $(SOURCE_DIR)/public/build $(SOURCE_DIR)/public/views $(SOURCE_DIR)/plugins-bundled
 
 clean:
 	rm -rf *.tar.gz *.tar.xz *.manifest *.rpm $(NAME)-*/
diff --git a/SPECS/grafana.spec b/SPECS/grafana.spec
index b1fbc38..987ac54 100644
--- a/SPECS/grafana.spec
+++ b/SPECS/grafana.spec
@@ -29,8 +29,8 @@ end}
 %endif
 
 Name:             grafana
-Version:          7.5.9
-Release:          3%{?dist}
+Version:          7.5.11
+Release:          1%{?dist}
 Summary:          Metrics dashboard and graph editor
 License:          ASL 2.0
 URL:              https://grafana.org
@@ -39,11 +39,15 @@ URL:              https://grafana.org
 Source0:          https://github.com/grafana/grafana/archive/v%{version}/%{name}-%{version}.tar.gz
 
 # Source1 contains the bundled Go and Node.js dependencies
-Source1:          grafana-vendor-%{version}-2.tar.xz
+# Note: In case there were no changes to this tarball, the NVR of this tarball
+# lags behind the NVR of this package.
+Source1:          grafana-vendor-%{version}-1.tar.xz
 
 %if %{compile_frontend} == 0
 # Source2 contains the precompiled frontend
-Source2:          grafana-webpack-%{version}-2.tar.gz
+# Note: In case there were no changes to this tarball, the NVR of this tarball
+# lags behind the NVR of this package.
+Source2:          grafana-webpack-%{version}-1.tar.gz
 %endif
 
 # Source3 contains Grafana configuration defaults for distributions
@@ -615,6 +619,10 @@ export GOPATH=%{_builddir}
 # let's set the time zone to a time zone without daylight saving time
 export TZ=GMT
 
+# GO111MODULE=on automatically skips vendored macaron sources in pkg/macaron
+# GO111MODULE=off doesn't skip them, and fails with an error due to the canoncial import path
+rm -r pkg/macaron
+
 %gotest ./pkg/...
 
 %if %{enable_fips_mode}
@@ -712,6 +720,13 @@ GOLANG_FIPS=1 go test -v ./pkg/util -run TestEncryption
 
 
 %changelog
+* Mon Oct 11 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.11-1
+- update to 7.5.11 tagged upstream community sources, see CHANGELOG
+- resolve CVE-2021-39226
+
+* Thu Sep 30 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.10-1
+- update to 7.5.10 tagged upstream community sources, see CHANGELOG
+
 * Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 7.5.9-3
 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
   Related: rhbz#1991688