diff --git a/.gitignore b/.gitignore
index ecdb3a0..21ab68c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,3 +17,4 @@ bugzilla-3.6.1.tar.gz
 /bugzilla-4.2.5.tar.gz
 /bugzilla-4.2.6.tar.gz
 /bugzilla-4.2.7.tar.gz
+/bugzilla-4.2.9.tar.gz
diff --git a/bugzilla-invalid-version.patch b/bugzilla-invalid-version.patch
deleted file mode 100644
index 21360a8..0000000
--- a/bugzilla-invalid-version.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-=== modified file 'Bugzilla/Install/Requirements.pm'
---- ./Bugzilla/Install/Requirements.pm	2013-03-26 11:07:25 +0000
-+++ ./Bugzilla/Install/Requirements.pm	2013-12-02 16:00:20 +0000
-@@ -659,8 +659,15 @@
-     Bugzilla::Install::Util::set_output_encoding();
- 
-     # VERSION is provided by UNIVERSAL::, and can be called even if
--    # the module isn't loaded.
--    my $vnum = $module->VERSION || -1;
-+    # the module isn't loaded. We eval'uate ->VERSION because it can die
-+    # when the version is not valid (yes, this happens from time to time).
-+    # In that case, we use an uglier method to get the version.
-+    my $vnum = eval { $module->VERSION };
-+    if ($@) {
-+        no strict 'refs';
-+        $vnum = ${"${module}::VERSION"};
-+    }
-+    $vnum ||= -1;
- 
-     # CGI's versioning scheme went 2.75, 2.751, 2.752, 2.753, 2.76
-     # That breaks the standard version tests, so we need to manually correct
-
diff --git a/bugzilla-project-mod_perl.patch b/bugzilla-project-mod_perl.patch
deleted file mode 100644
index a29632a..0000000
--- a/bugzilla-project-mod_perl.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-diff -up ./Bugzilla/Constants.pm.orig ./Bugzilla/Constants.pm
---- ./Bugzilla/Constants.pm.orig	2013-11-14 23:21:44.947050044 +0100
-+++ ./Bugzilla/Constants.pm	2013-11-14 23:23:55.873245730 +0100
-@@ -591,6 +591,13 @@ use constant AUDIT_CREATE => '__create__
- use constant AUDIT_REMOVE => '__remove__';
- 
- sub bz_locations {
-+    # Force memoize() to re-compute data per project, to avoid
-+    # sharing the same data across different installations.
-+    return _bz_locations($ENV{'PROJECT'});
-+}
-+
-+sub _bz_locations {
-+    my $project = shift;
-     # We know that Bugzilla/Constants.pm must be in %INC at this point.
-     # So the only question is, what's the name of the directory
-     # above it? This is the most reliable way to get our current working
-@@ -607,12 +614,13 @@ sub bz_locations {
-     $libpath =~ /(.*)/;
-     $libpath = $1;
- 
--    my ($project, $localconfig, $datadir);
--    if ($ENV{'PROJECT'} && $ENV{'PROJECT'} =~ /^(\w+)$/) {
-+    my ($localconfig, $datadir);
-+    if ($project && $project =~ /^(\w+)$/) {
-         $project = $1;
-         $localconfig = "localconfig.$project";
-         $datadir = "data/$project";
-     } else {
-+	$project = undef;
-         $localconfig = "localconfig";
-         $datadir = "data";
-     }
-@@ -647,6 +655,6 @@ sub bz_locations {
- 
- # This makes us not re-compute all the bz_locations data every time it's
- # called.
--BEGIN { memoize('bz_locations') };
-+BEGIN { memoize('_bz_locations') };
- 
- 1;
diff --git a/bugzilla-vers-cmp.patch b/bugzilla-vers-cmp.patch
deleted file mode 100644
index 33f4d5e..0000000
--- a/bugzilla-vers-cmp.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-=== modified file 'Bugzilla/Install/Requirements.pm'
---- ./Bugzilla/Install/Requirements.pm	2013-12-02 16:00:20 +0000
-+++ ./Bugzilla/Install/Requirements.pm	2013-12-02 16:07:30 +0000
-@@ -24,6 +24,7 @@
- # MUST NOT "use."
- 
- use strict;
-+use version;
- 
- use Bugzilla::Constants;
- use Bugzilla::Install::Util qw(vers_cmp install_string bin_loc 
-@@ -206,7 +207,9 @@
-         package => 'Chart',
-         module  => 'Chart::Lines',
-         # Versions below 2.1 cannot be detected accurately.
--        version => '2.1',
-+        # There is no 2.1.0 release (it was 2.1), but .0 is required to fix
-+        # https://rt.cpan.org/Public/Bug/Display.html?id=28218.
-+        version => '2.1.0',
-         feature => [qw(new_charts old_charts)],
-     },
-     {
-@@ -640,8 +643,8 @@
-     return $return;
- }
- 
--# This was originally clipped from the libnet Makefile.PL, adapted here to
--# use the below vers_cmp routine for accurate version checking.
-+# This was originally clipped from the libnet Makefile.PL, adapted here for
-+# accurate version checking.
- sub have_vers {
-     my ($params, $output) = @_;
-     my $module  = $params->{module};
-@@ -666,21 +669,17 @@
-     if ($@) {
-         no strict 'refs';
-         $vnum = ${"${module}::VERSION"};
-+
-+        # If we come here, then the version is not a valid one.
-+        # We try to sanitize it.
-+        if ($vnum =~ /^((\d+)(\.\d+)*)/) {
-+            $vnum = $1;
-+        }
-     }
-     $vnum ||= -1;
- 
--    # CGI's versioning scheme went 2.75, 2.751, 2.752, 2.753, 2.76
--    # That breaks the standard version tests, so we need to manually correct
--    # the version
--    if ($module eq 'CGI' && $vnum =~ /(2\.7\d)(\d+)/) {
--        $vnum = $1 . "." . $2;
--    }
--    # CPAN did a similar thing, where it has versions like 1.9304.
--    if ($module eq 'CPAN' and $vnum =~ /^(\d\.\d{2})\d{2}$/) {
--        $vnum = $1;
--    }
--
--    my $vok = (vers_cmp($vnum,$wanted) > -1);
-+    # Must do a string comparison as $vnum may be of the form 5.10.1.
-+    my $vok = ($vnum ne '-1' && version->new($vnum) >= version->new($wanted)) ? 1 : 0;
-     my $blacklisted;
-     if ($vok && $params->{blacklist}) {
-         $blacklisted = grep($vnum =~ /$_/, @{$params->{blacklist}});
-
diff --git a/bugzilla.spec b/bugzilla.spec
index 358238b..bed23e7 100644
--- a/bugzilla.spec
+++ b/bugzilla.spec
@@ -4,9 +4,9 @@
 Summary: Bug tracking system
 URL: http://www.bugzilla.org/
 Name: bugzilla
-Version: 4.2.7
+Version: 4.2.9
 Group: Applications/Publishing
-Release: 3%{?dist}
+Release: 1%{?dist}
 License: MPLv1.1
 Source0: http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-%{version}.tar.gz
 Source1: bugzilla-httpd-conf
@@ -14,11 +14,6 @@ Source2: README.fedora.bugzilla
 Source3: bugzilla.cron-daily
 Patch0: bugzilla-rw-paths.patch
 Patch1: bugzilla-yum.patch
-Patch2: bugzilla-project-mod_perl.patch
-# Backport of https://bugzilla.mozilla.org/show_bug.cgi?id=938300
-Patch3: bugzilla-invalid-version.patch
-# Backport of https://bugzilla.mozilla.org/show_bug.cgi?id=781672
-Patch4: bugzilla-vers-cmp.patch
 
 BuildArch: noarch
 Requires: webserver, patchutils, perl(SOAP::Lite), which
@@ -109,9 +104,6 @@ Contributed scripts and functions for Bugzilla
 %setup -q -n %{name}-%{version}
 %patch0 -p1
 %patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
 rm -f Bugzilla/Constants.pm.orig
 rm -f Bugzilla/Install/Requirements.pm.orig
 # Remove bundled libs
@@ -223,6 +215,10 @@ popd > /dev/null)
 %{bzinstallprefix}/bugzilla/contrib/syncLDAP.pl
 
 %changelog
+* Sat Apr 19 2014 Emmanuel Seyman <emmanuel@seyman.fr> - 4.2.9-1
+- Update to 4.2.9 (regression fix for 4.2.8 which was a security update)
+- Drop backported patches
+
 * Tue Jan 14 2014 Emmanuel Seyman <emmanuel@seyman.fr> - 4.2.7-3
 - Fix the comparison of module versions (#1044854)
 - Really honor the PROJECT environment variable (#911943)
diff --git a/sources b/sources
index ff6e8d0..6a06105 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-ebf0a75d1037f09994660d3958fc66fb  bugzilla-4.2.7.tar.gz
+68ab079ce3c980ed0af632f24bb1a58b  bugzilla-4.2.9.tar.gz