diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..772eb97a5e1f636b7520f25f062b0b5708c05298
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/pycares-4.9.0.tar.gz
diff --git a/python-pycares.spec b/python-pycares.spec
index 6e0d2c74a2b3c6e705956605e9ae1a80056bcc94..b0c24f551ee1aa4b72362a8b94c534114c013ea8 100644
--- a/python-pycares.spec
+++ b/python-pycares.spec
@@ -3,15 +3,14 @@
 
 Summary:        Python interface for c-ares
 Name:           python-%{srcname}
-Version:        4.3.0
-Release:        7%{?dist}
+Version:        4.9.0
+Release:        1%{?dist}
 License:        MIT
 URL:            https://github.com/saghul/pycares
-Source0:        https://github.com/saghul/%{srcname}/archive/%{srcname}-%{version}.tar.gz #/%{srcname}-%{srcname}-%{version}.tar.gz
+Source0:        https://files.pythonhosted.org/packages/source/p/%{srcname}/%{srcname}-%{version}.tar.gz
 
 BuildRequires:  gcc make
 BuildRequires:  python3-devel python3-setuptools python3-cffi
-BuildRequires:  c-ares-devel
 %if %{with docs}
 BuildRequires:  python3-sphinx python3-sphinx_rtd_theme
 %endif
@@ -42,11 +41,10 @@ This package contains documentation in reST and HTML formats for python-pycares.
 
 
 %prep
-%autosetup -n %{srcname}-%{srcname}-%{version}
+%autosetup -p1 -n %{srcname}-%{version}
 
 
 %build
-export PYCARES_USE_SYSTEM_LIB=1
 %py3_build
 
 %if %{with docs}
@@ -67,7 +65,7 @@ mv -f %{buildroot}%{_pkgdocdir}/html/_sources/ %{buildroot}%{_pkgdocdir}/rst/
 rm -rf %{buildroot}%{_pkgdocdir}/html/.buildinfo
 %endif
 
-chmod 755 %{buildroot}%{python3_sitearch}/%{srcname}/_cares.cpython-*.so
+chmod 755 %{buildroot}%{python3_sitearch}/%{srcname}/_cares*.so
 
 
 %check
@@ -88,6 +86,14 @@ chmod 755 %{buildroot}%{python3_sitearch}/%{srcname}/_cares.cpython-*.so
 
 
 %changelog
+* Wed Dec 17 2025 maxonxie <maxonxie@tencent.com> - 4.9.0-1
+- Update to version 4.9.0
+- Fix CVE-2024-48945 (security vulnerability in c-ares)
+- Use bundled c-ares instead of system library for compatibility
+- Remove c-ares-devel build dependency
+- Fix SO file permission handling (_cares.abi3.so)
+- Update source URL to PyPI packages location
+
 * Thu Sep 26 2024 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 4.3.0-7
 - Rebuilt for clarifying the packages requirement in BaseOS and AppStream
 
diff --git a/sources b/sources
index 59e962326e78dfa1dc509919fd8225e96435ad11..07f0fb3cacd3e0204b486ff86e2c2703334c98f0 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (pycares-pycares-4.3.0.tar.gz) = 1dad1a6722bdd2bc59cc4ca774cc9da243e61a442ef383c238714b1274e90359352c72d16a2c1af2fcce3ea92708a7e5cee89a9b3eb7c015f9a194051c685f52
+SHA512 (pycares-4.9.0.tar.gz) = 3be5aa36fbfbc47e54f7b41e14ef951bdb1528a60f51a11ef7d010da2ef9ca2830f89d277063788c44468f27fb4d875ce472729106cf1c0bb32000727d2841b7