diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000000000000000000000000000000000000..f087b429e2f81a9f37b28a8308e2210f84df6c9b
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.tar.gz filter=lfs diff=lfs merge=lfs -text
diff --git a/.lfsconfig b/.lfsconfig
new file mode 100644
index 0000000000000000000000000000000000000000..0acde9cecfe1a9de610c74fa30d47ba6f66da24c
--- /dev/null
+++ b/.lfsconfig
@@ -0,0 +1,2 @@
+[lfs]
+	url = https://artlfs.openeuler.openatom.cn/src-openEuler/lasso
diff --git a/backport-misc-adjust-to-libxml-2.12.patch b/backport-misc-adjust-to-libxml-2.12.patch
deleted file mode 100644
index 3b5ac5c40a1d1e4b4477ce48c43ffadae08ef2dc..0000000000000000000000000000000000000000
--- a/backport-misc-adjust-to-libxml-2.12.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From cbe2c45455d93ed793dc4be59e3d2d26f1bd1111 Mon Sep 17 00:00:00 2001
-From: Benjamin Dauvergne <bdauvergne@entrouvert.com>
-Date: Wed, 24 Jan 2024 15:15:39 +0100
-Subject: [PATCH] misc: adjust to structured error callback argument change in
- libxml2 2.12 (#86080)
-
----
- lasso/lasso.c     | 8 +++++++-
- lasso/xml/tools.c | 9 ++++++++-
- 2 files changed, 15 insertions(+), 2 deletions(-)
-
-diff --git a/lasso/lasso.c b/lasso/lasso.c
-index 42b7d6bb..bc75f5e6 100644
---- a/lasso/lasso.c
-+++ b/lasso/lasso.c
-@@ -138,7 +138,13 @@ DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
- #include "types.c"
- 
- static void
--lasso_xml_structured_error_func(G_GNUC_UNUSED void *user_data, xmlErrorPtr error)
-+lasso_xml_structured_error_func(G_GNUC_UNUSED void *user_data,
-+#if LIBXML_VERSION >= 21200
-+                                        const xmlError *error
-+#else
-+                                        xmlErrorPtr error
-+#endif
-+				)
- {
- 	g_log("libxml2", G_LOG_LEVEL_DEBUG, "libxml2: %s", error->message);
- }
-diff --git a/lasso/xml/tools.c b/lasso/xml/tools.c
-index bbc87d9f..4d5fa78a 100644
---- a/lasso/xml/tools.c
-+++ b/lasso/xml/tools.c
-@@ -1450,7 +1450,14 @@ lasso_concat_url_query(const char *url, const char *query)
- 	}
- }
- 
--static void structuredErrorFunc (void *userData, xmlErrorPtr error) {
-+static void structuredErrorFunc (void *userData,
-+#if LIBXML_VERSION >= 21200
-+                                        const xmlError *error
-+#else
-+                                        xmlErrorPtr error
-+#endif
-+				 )
-+{
- 		*(int*)userData = error->code;
- }
- 
diff --git a/lasso-2.8.2.tar.gz b/lasso-2.8.2.tar.gz
deleted file mode 100644
index f7d0e610f5b8ce212a1398d9651b1ac867defa65..0000000000000000000000000000000000000000
Binary files a/lasso-2.8.2.tar.gz and /dev/null differ
diff --git a/lasso-2.9.0.tar.gz b/lasso-2.9.0.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..6b1c11f54105f48120e3a7aa0a637487dc073135
--- /dev/null
+++ b/lasso-2.9.0.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:63816c8219df48cdefeccb1acb35e04014ca6395b5263c70aacd5470ea95c351
+size 4053813
diff --git a/lasso.spec b/lasso.spec
index 72de21399aa555809e22d741fc675e7deed25ad5..18f920ebe0ad6c019b291dabb277af5f8043c0a6 100644
--- a/lasso.spec
+++ b/lasso.spec
@@ -1,12 +1,11 @@
 Name:                lasso
-Version:             2.8.2
-Release:             4
+Version:             2.9.0
+Release:             1
 Summary:             Liberty Alliance Single Sign On
 License:             GPL-2.0-or-later
 URL:                 http://lasso.entrouvert.org/
 Source:              http://dev.entrouvert.org/lasso/lasso-%{version}.tar.gz
 Patch0001:           lasso-perl-bindings-build-options.patch
-Patch6001:           backport-misc-adjust-to-libxml-2.12.patch
 Requires:            xmlsec1 >= 1.2.25-4
 
 BuildRequires:       autoconf automake check-devel glib2-devel gtk-doc libtool
@@ -93,6 +92,9 @@ rm -fr %{buildroot}%{_datadir}/doc/
 %doc AUTHORS NEWS README
 
 %changelog
+* Fri Nov 07 2025 yaoxin <1024769339@qq.com> - 2.9.0-1
+- Update to 2.9.0 for fix CVE-2025-46404, CVE-2025-46705 and CVE-2025-47151
+
 * Thu Jan 16 2025 Funda Wang <fundawang@yeah.net> - 2.8.2-4
 - drop useless perl(:MODULE_COMPAT) requirement