diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/patch/Manifest
index 8da8b1d590..ebef4b3a0b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/patch/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/Manifest
@@ -1,4 +1,4 @@
 DIST patch-2.7.6.tar.xz 783756 BLAKE2B e3dd2d155a94c39cb60eafc26677e84de14c3a6d5814dff69de091ded52f21862490970254297795f2c42a0c3203f7e88a8f65bb66968f8dfd6e066bf53f2dfb SHA512 fcca87bdb67a88685a8a25597f9e015f5e60197b9a269fa350ae35a7991ed8da553939b4bbc7f7d3cfd863c67142af403b04165633acbce4339056a905e87fbd
 DIST patch-2.7.6.tar.xz.sig 801 BLAKE2B 8f2decb10402ecf0208d05ea7cce3bae565d31ee2bb2a118367c117d25b158d8bd525cae654ec0c0e2c036cc8f47a331edc1bb10b100683ade64dfa3b651988b SHA512 1302a1110dcda4f3d83b5263415d72be55c46dae0efb1c123e9c346154e09def5657004bbe7249e2d014555349410e7a5217140dd8852331235f75bcc757351b
-DIST patch-2.7.6_p20241103.tar.xz 903028 BLAKE2B 874f390bd9a3ed2c5da59c41c708bf41d9bf3bcfe799a0647c7382013793a29ec331df82510424ff2fd9b280e0594822d08eae1074af774d57f625214edc3578 SHA512 29db065dd17e25aa562acb1d7ba6be780eed59c2cc9b74e76b5d5b2dac1768e25e8a28acde0907825f6d863a7e14ede33537c89361624e3dcfbb6c0fa6fb0cf2
-DIST patch-2.7.6_p20241103.tar.xz.sig 833 BLAKE2B 3a065dd0c8f83a0287f091536fa89a9914272ae49bdd2b67f91173365789275427e52f20bfcff50c65194a97e96cd07201781d1d13eb84f0adc2d52d741d8598 SHA512 4ee1151deced3dab999794913a2bfc54096cf42a9c0757b192b7fad71ecd6ec28f4f1451818262f154240e909654253d20b41a555230d260c9c4d29f36dd54ba
+DIST patch-2.7.6_p20250206.tar.xz 906596 BLAKE2B f110bcf19b655c900327088ba023743fd845161dd00cab228675d3c0992fa397916adf153c35775fc5ff8e733b559ce8a05eac71eec7156403f4c9ab17ff2a3e SHA512 2dd05af5f9f0864b0cccc5c5194d0ba4ca427fc366b91210e2f539a50bd2006d7142606f8f223b45c5d426eafef7e6b17c6b67c2ef9b7ec75589bb3d9fce68d3
+DIST patch-2.7.6_p20250206.tar.xz.sig 833 BLAKE2B 8363136c58bbde5c349a4c96cd277588f3b679a98ea1c21da39bcf375c2b85c0d36165f1dceab453a09bcc2745d5ab6959d5ba28020e138591e7530dbf72f180 SHA512 a114f836502bb02910c8f88d7e667ce92ef6b0b9a26eb466ee9bd1ad8956036867801b19ea3ee27418fe0fb6e673e3d5d2aad2b9c05f7e99fd8bb1a9d604ea6f
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6-configure-mkdir-spruced-up.patch b/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6-configure-mkdir-spruced-up.patch
new file mode 100644
index 0000000000..8ef7a954a4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6-configure-mkdir-spruced-up.patch
@@ -0,0 +1,38 @@
+https://bugs.gentoo.org/898598
+https://github.com/coreutils/gnulib/commit/3c136a2cc38d71083f123231a8b9ad4b01930789
+--- a/configure
++++ b/configure
+@@ -17084,6 +17084,8 @@ else
+ #include <unistd.h>
+ #include <stdlib.h>
+ #include <errno.h>
++/* Android 4.3 declares fchownat() in <sys/stat.h> instead.  */
++#include <sys/stat.h>
+ #include <sys/types.h>
+ int
+ main ()
+@@ -17130,6 +17132,8 @@ else
+ /* end confdefs.h.  */
+ #include <unistd.h>
+             #include <fcntl.h>
++            /* Android 4.3 declares fchownat() in <sys/stat.h> instead.  */
++            #include <sys/stat.h>
+ 
+ int
+ main ()
+--- a/lib/unistd.in.h
++++ b/lib/unistd.in.h
+@@ -113,6 +113,13 @@
+ # include <netdb.h>
+ #endif
+ 
++/* Android 4.3 declares fchownat in <sys/stat.h>, not in <unistd.h>.  */
++/* But avoid namespace pollution on glibc systems.  */
++#if (@GNULIB_FCHOWNAT@ || defined GNULIB_POSIXCHECK) && defined __ANDROID__ \
++    && !defined __GLIBC__
++# include <sys/stat.h>
++#endif
++
+ /* MSVC defines off_t in <sys/types.h>.
+    May also define off_t to a 64-bit type on native Windows.  */
+ #if !@HAVE_UNISTD_H@ || @WINDOWS_64_BIT_OFF_T@
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6-ndebug-assert-hash-table.patch b/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6-ndebug-assert-hash-table.patch
new file mode 100644
index 0000000000..d3aa7aa4c3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/files/patch-2.7.6-ndebug-assert-hash-table.patch
@@ -0,0 +1,37 @@
+From 01ae7ce6a7f270937face6aec75db28d30d83059 Mon Sep 17 00:00:00 2001
+Message-ID: <01ae7ce6a7f270937face6aec75db28d30d83059.1738773172.git.sam@gentoo.org>
+From: Sam James <sam@gentoo.org>
+Date: Wed, 5 Feb 2025 16:16:06 +0000
+Subject: [PATCH] Fix dodgy assert with side-effects in insert_cached_dirfd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Michał Górny <mgorny@gentoo.org> reported that patch was running out of
+FDs and that the `deep-directories` test was failing. This turns out
+to be because `hash_insert` isn't called at all with `-DNDEBUG` because
+`insert_cached_dirfd` only calls it in one case inside of an `assert`.
+
+See https://github.com/conda-forge/patch-feedstock/issues/11.
+
+This regressed in 025a54b789bd88ed15430f8633514e296826983e.
+
+* src/safe.c (insert_cached_dirfd): Don't use 'assert' for 'hash_insert'
+  call with side-effects.
+--- a/src/safe.c
++++ b/src/safe.c
+@@ -183,7 +183,8 @@ static void insert_cached_dirfd (struct cached_dirfd *entry, int keepfd)
+ 
+   /* Only insert if the parent still exists. */
+   if (! list_empty (&entry->children_link))
+-    assert (hash_insert (cached_dirfds, entry) == entry);
++    if (hash_insert (cached_dirfds, entry) != entry)
++      xalloc_die ();
+ }
+ 
+ static void invalidate_cached_dirfd (int dirfd, const char *name)
+
+base-commit: 1da6bf84db2ed0be88ccb47139256e48243a75f0
+-- 
+2.48.1
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6-r7.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6-r7.ebuild
new file mode 100644
index 0000000000..61ce4a002a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6-r7.ebuild
@@ -0,0 +1,86 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/patch.asc
+inherit flag-o-matic verify-sig
+
+DESCRIPTION="Utility to apply diffs to files"
+HOMEPAGE="https://www.gnu.org/software/patch/patch.html"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/patch.git"
+	inherit git-r3
+else
+	SRC_URI="mirror://gnu/patch/${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/patch/${P}.tar.xz.sig )"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="static test xattr"
+RESTRICT="!test? ( test )"
+
+RDEPEND="xattr? ( sys-apps/attr )"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	test? ( sys-apps/ed )
+	verify-sig? ( sec-keys/openpgp-keys-patch )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-fix-test-suite.patch
+	"${FILESDIR}"/${PN}-2.7.6-fix-error-handling-with-git-style-patches.patch
+	"${FILESDIR}"/${PN}-2.7.6-CVE-2018-6951.patch
+	"${FILESDIR}"/${PN}-2.7.6-allow-input-files-to-be-missing-for-ed-style-patches.patch
+	"${FILESDIR}"/${PN}-2.7.6-CVE-2018-1000156.patch
+	"${FILESDIR}"/${PN}-2.7.6-CVE-2018-6952.patch
+	"${FILESDIR}"/${PN}-2.7.6-Do-not-crash-when-RLIMIT_NOFILE-is-set-to-RLIM_INFINITY.patch
+	"${FILESDIR}"/${PN}-2.7.6-CVE-2018-1000156-fix1.patch
+	"${FILESDIR}"/${PN}-2.7.6-CVE-2018-1000156-fix2.patch
+	"${FILESDIR}"/${PN}-2.7.6-CVE-2019-13636.patch
+	"${FILESDIR}"/${PN}-2.7.6-CVE-2019-13638.patch
+	"${FILESDIR}"/${PN}-2.7.6-Avoid-invalid-memory-access-in-context-format-diffs.patch
+	"${FILESDIR}"/${PN}-2.7.6-configure-mkdir-spruced-up.patch
+	"${FILESDIR}"/${PN}-2.7.6-ndebug-assert-hash-table.patch
+)
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+
+		cd "${S}" || die
+		./bootstrap || die
+	elif use verify-sig ; then
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.sig}
+	fi
+
+	default
+}
+
+src_configure() {
+	use static && append-ldflags -static
+
+	local myeconfargs=(
+		$(use_enable xattr)
+		# rename to gpatch for better BSD compatibility
+		--program-prefix=g
+	)
+	# Do not let $ED mess up the search for `ed` 470210.
+	ac_cv_path_ED=$(type -P ed) \
+		econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	emake check gl_public_submodule_commit=
+}
+
+src_install() {
+	default
+
+	# symlink to the standard name
+	dosym gpatch /usr/bin/patch
+	dosym gpatch.1 /usr/share/man/man1/patch.1
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20241103.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20250206.ebuild
similarity index 83%
rename from sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20241103.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20250206.ebuild
index 05897044be..c410f22ffd 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20241103.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-2.7.6_p20250206.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -14,9 +14,9 @@ if [[ ${PV} == 9999 ]] ; then
 elif [[ ${PV} = *_p* ]] ; then
 	# Note: could put this in devspace, but if it's gone, we don't want
 	# it in tree anyway. It's just for testing.
-	MY_SNAPSHOT="$(ver_cut 1-3).200-be8b"
-	SRC_URI="https://meyering.net/patch/patch-${MY_SNAPSHOT}.tar.xz -> ${P}.tar.xz"
-	SRC_URI+=" verify-sig? ( https://meyering.net/patch/patch-${MY_SNAPSHOT}.tar.xz.sig -> ${P}.tar.xz.sig )"
+	MY_SNAPSHOT="$(ver_cut 1-3).211-86ac"
+	SRC_URI="https://alpha.gnu.org/gnu/patch/patch-${MY_SNAPSHOT}.tar.xz -> ${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://alpha.gnu.org/gnu/patch/patch-${MY_SNAPSHOT}.tar.xz.sig -> ${P}.tar.xz.sig )"
 	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
 else
 	SRC_URI="mirror://gnu/patch/${P}.tar.xz"
@@ -34,7 +34,7 @@ RDEPEND="xattr? ( sys-apps/attr )"
 DEPEND="${RDEPEND}"
 BDEPEND="
 	test? ( sys-apps/ed )
-	verify-sig? ( sec-keys/openpgp-keys-patch )
+	verify-sig? ( >=sec-keys/openpgp-keys-patch-20250206 )
 "
 
 src_unpack() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-9999.ebuild
index df6c6cec8d..c410f22ffd 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/patch/patch-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -11,6 +11,13 @@ HOMEPAGE="https://www.gnu.org/software/patch/patch.html"
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/patch.git"
 	inherit git-r3
+elif [[ ${PV} = *_p* ]] ; then
+	# Note: could put this in devspace, but if it's gone, we don't want
+	# it in tree anyway. It's just for testing.
+	MY_SNAPSHOT="$(ver_cut 1-3).211-86ac"
+	SRC_URI="https://alpha.gnu.org/gnu/patch/patch-${MY_SNAPSHOT}.tar.xz -> ${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://alpha.gnu.org/gnu/patch/patch-${MY_SNAPSHOT}.tar.xz.sig -> ${P}.tar.xz.sig )"
+	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
 else
 	SRC_URI="mirror://gnu/patch/${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( mirror://gnu/patch/${P}.tar.xz.sig )"
@@ -27,7 +34,7 @@ RDEPEND="xattr? ( sys-apps/attr )"
 DEPEND="${RDEPEND}"
 BDEPEND="
 	test? ( sys-apps/ed )
-	verify-sig? ( sec-keys/openpgp-keys-patch )
+	verify-sig? ( >=sec-keys/openpgp-keys-patch-20250206 )
 "
 
 src_unpack() {