add CVE patches from Arch, sync locale with PLD