gnu: node-lts: Update to 24.14.1.

* gnu/packages/node.scm (node-lts): Update to 24.14.1. Change-Id: I60457e8e8e05e0102feb450655113ba410bd7667
gnu: node-nan: Update to 2.26.2.
2026-05-03 20:58:59 +02:00 · 2026-05-03 20:58:58 +02:00 · 2026-05-03 20:58:58 +02:00 · 2026-05-03 20:58:58 +02:00 · 2026-05-03 20:58:58 +02:00 · 2026-05-03 20:58:58 +02:00
288 changed files with 92073 additions and 28779 deletions
@@ -16,6 +16,8 @@
  ( ;; primary: "D0C2 EAC1 3310 822D 98DE  B57C E9C5 A2D9 0898 A02F"
   "01FD 85F4 1A7B 7F82 0583  06A5 935E BE07 36DC 857E"
   (name "avp"))
+  ("5D54 CF25 57B2 38E8 8DC1  80A2 2D22 3241 0AB7 4043"
+   (name "baleine"))
  ( ;; primary: "34FF 38BC D151 25A6 E340  A0B5 3453 2F9F AFCA 8B8E"
   "A3A4 B419 0074 087C A7DE  5698 BC45 CA67 E2F8 D007"
   (name "bavier"))
@@ -68,6 +68,7 @@ guix/discovery\.scm                                @guix/core
 guix/docker\.scm                                   @guix/core
 guix/download\.scm                                 @guix/core
 guix/elf\.scm                                      @guix/core
+guix/fossil-download\.scm                          @guix/core
 guix/ftp-client\.scm                               @guix/core
 guix/gexp\.scm                                     @guix/core
 guix/git-authenticate\.scm                         @guix/core
@@ -178,6 +179,7 @@ guix/scripts/import/elpa\.scm                      @guix/emacs
 tests/import/elpa\.scm                             @guix/emacs

 gnu/packages/bootloaders\.scm                      @guix/embedded
+gnu/packages/coreboot\.scm                         @guix/embedded
 gnu/packages/firmware\.scm                         @guix/embedded

 gnu/packages/emulators\.scm                        @guix/games
@@ -262,6 +264,7 @@ gnu/installer(\.scm$|/)                            @guix/installer
 gnu/packages/clojure\.scm                          @guix/java
 gnu/packages/java(-.+|)\.scm$                      @guix/java
 gnu/packages/maven(-.+|)\.scm$                     @guix/java
+gnu/packages/netbeans\.scm                         @guix/java
 guix/build/ant-build-system\.scm                   @guix/java
 guix/build/clojure-build-system\.scm               @guix/java
 guix/build/clojure-utils\.scm                      @guix/java
@@ -272,6 +275,7 @@ guix/build-system/ant\.scm                         @guix/java
 guix/build-system/clojure\.scm                     @guix/java
 guix/build-system/maven\.scm                       @guix/java

+gnu/packages/javascript\.scm                       @guix/javascript
 gnu/packages/node-xyz\.scm                         @guix/javascript
 gnu/packages/node\.scm                             @guix/javascript
 guix/build-system/node\.scm                        @guix/javascript
@@ -317,6 +321,7 @@ gnu/packages/tor-browsers\.scm                     @guix/mozilla

 gnu/packages/ocaml\.scm                            @guix/ocaml
 gnu/packages/coq\.scm                              @guix/ocaml
+gnu/packages/rocq\.scm                             @guix/ocaml
 guix/build/ocaml-build-system\.scm                 @guix/ocaml
 guix/build/dune-build-system\.scm                  @guix/ocaml
 guix/build-system/ocaml\.scm                       @guix/ocaml
@@ -484,6 +489,7 @@ gnu/services/version-control\.scm                  @guix/vcs
 gnu/tests/version-control\.scm                     @guix/vcs
 guix/build/bzr\.scm                                @guix/vcs
 guix/build/cvs\.scm                                @guix/vcs
+guix/build/fossil\.scm                             @guix/vcs
 guix/build/git\.scm                                @guix/vcs
 guix/build/hg\.scm                                 @guix/vcs
 guix/build/svn\.scm                                @guix/vcs
@@ -104,6 +104,7 @@ MODULES =					\
  guix/discovery.scm				\
  guix/android-repo-download.scm		\
  guix/bzr-download.scm            		\
+  guix/fossil-download.scm			\
  guix/git-download.scm				\
  guix/hg-download.scm				\
  guix/hash.scm					\
@@ -236,6 +237,7 @@ MODULES =					\
  guix/build/asdf-build-system.scm		\
  guix/build/bzr.scm				\
  guix/build/copy-build-system.scm		\
+  guix/build/fossil.scm				\
  guix/build/git.scm				\
  guix/build/hg.scm				\
  guix/build/glib-or-gtk-build-system.scm	\
@@ -455,6 +457,8 @@ AUX_FILES =						\
  gnu/packages/aux-files/findclass.php			\
  gnu/packages/aux-files/guix.vim			\
  gnu/packages/aux-files/guix-nvim.vim			\
+  gnu/packages/aux-files/linux-libre/7.0-arm64.conf	\
+  gnu/packages/aux-files/linux-libre/7.0-x86_64.conf	\
  gnu/packages/aux-files/linux-libre/6.19-arm64.conf	\
  gnu/packages/aux-files/linux-libre/6.19-i686.conf	\
  gnu/packages/aux-files/linux-libre/6.19-x86_64.conf	\
@@ -20,6 +20,9 @@ Please send Guix bug reports to bug-guix@gnu.org.
 *** New service for Fossil SCM
 *** TeX Live updated to 2026.1

+** Programming interfaces
+*** New (guix fossil-download) module, for fetching Fossil repositories
+
 * Changes in 1.5.0 (since 1.4.0)
 ** Package management
 *** New ‘rpm’ format for the ‘guix pack’ command
@@ -1667,6 +1667,9 @@ can be turned into a version string via @code{git-version}, for example
@code{rust-pipewire-0.8.0.fd3d8f7} and @code{rust-pubgrub-0.3.0.b70cf70}.
@end table

+When contributing Rust packages, we should have all modifications to these
+two modules, in the same commit as the package we are contributing.
+
 To avoid merge conflicts with changes from multiple branches, these two modules
 are maintained by the Rust team (@pxref{Teams}).

@@ -1696,6 +1699,68 @@ tree.
@xref{Packaging Rust Crates,,, guix-cookbook, GNU Guix Cookbook}, for
 packaging workflow.

+@subsubsection Commit messages
+
+The commit message must have a general brief mention to entry changes
+in @code{(gnu packages rust-crates)}. For changes in @code{(gnu packages
+rust-sources)}, the commit message must explicitly mention all changes to the
+packages.
+
+Here are some examples for different situations:
+
+@itemize
+
+@item
+Adding a new Rust package:
+
+@example
+gnu: Add catppuccin-whiskers.
+
+* gnu/packages/rust-apps.scm (catppuccin-whiskers): New variable.
+* gnu/packages/rust-crates.scm (lookup-cargo-inputs)
+[catppuccin-whiskers]: New entry.
+@end example
+
+@item
+Updating a simple package:
+
+@example
+gnu: watchexec: Update to 2.3.2.
+
+* gnu/packages/rust-apps.scm (watchexec): Update to 2.3.2.
+* gnu/packages/rust-crates.scm (lookup-cargo-inputs)[watchexec]:
+Update entry.
+@end example
+
+@item
+Updating a package with sources:
+
+@example
+gnu: typst: Update to 0.14.0.
+
+* gnu/packages/rust-apps.scm (typst): Update to 0.14.0.
+[arguments]<#:rust>: Use rust-1.88.
+* gnu/packages/rust-crates.scm (lookup-cargo-inputs)[typst]: Update
+entry.
+[rust-syntect-5]: Rename to rust-syntect-5.2.
+[rust-syntect-5.3]: New entry.
+* gnu/packages/rust-sources.scm (rust-hypher-0.1): Update to 0.1.6.
+(rust-syntect-5): Rename to rust-syntect-5.2.
+[inputs]: Rename cargo-inputs rust-syntect-5 to rust-syntect-5.2.
+(rust-syntect-5.3): New variable.
+@end example
+
+@end itemize
+
+@subsubsection Resolving merge conflicts in Pull Requests
+
+For Rust crates, the recommended way to solve merge conflicts is to drop all
+changes to @code{gnu/packages/rust-crates.scm}, rebase onto the desired branch
+and run the lockfile importer again, manually adding back all relevant snippets
+(if any).
+
+@xref{Common Workflow for Resolving Merge Conflicts on Existing Pull Requests,,, guix-cookbook, GNU Guix Cookbook} for
+a suggested workflow on resolving merge conflicts.

@node Elm Packages
@subsection Elm Packages
@@ -2650,6 +2715,7 @@ applications settings page}, granting read/write access to the

@cindex decision making
@cindex consensus seeking
+Every contribution to the project involves a form of decision making.
 It is expected from all contributors, and even more so from committers,
 to help build consensus and make decisions based on consensus.  By using
 consensus, we are committed to finding solutions that everyone can live
@@ -2664,6 +2730,26 @@ resolve the deadlock.  To learn what consensus decision making means and
 understand its finer details, you are encouraged to read
@url{https://www.seedsforchange.org.uk/consensus}.

+Day-to-day decision making, for instance discussions about pull requests
+(@pxref{Reviewing the Work of Others}), happens informally among
+interested parties such as contributors and members of the relevant
+teams (@pxref{Teams}).
+
+@cindex GCD, Guix Consensus Documents
+@cindex Guix Consensus Documents (GCD)
+Decisions that are expected to have an impact on most contributors
+and/or on the broader user community---e.g., changes to project-wide
+policies, to core functionality, and so on---are made following the
+@acronym{GCD, Guix Consensus Document} process.  The process provides a
+framework to formalize proposals and draw attention to them, to leave
+time for interested parties to discuss them, and to collectively accept
+or withdraw them based on input from participating team members.  It is
+defined in
+@uref{https://consensus.guix.gnu.org/gcd/001-gcd-process.html,
+GCD@tie{}001}.  Past GCDs can be seen at
+@uref{https://consensus.guix.gnu.org}, and discussions take place at
+@uref{https://codeberg.org/guix/guix-consensus-documents}.
+
@node Commit Access
@section Commit Access

@@ -146,6 +146,8 @@ Packaging Rust Crates
 * Common Workflow for Rust Packaging::
 * Cargo Workspaces and Development Snapshots::
 * Using Rust Libraries in Other Build Systems::
+* Common Workflow for Updating Existing Rust Packages::
+* Common Workflow for Resolving Merge Conflicts on Existing Pull Requests::

 System Configuration

@@ -1647,6 +1649,8 @@ $ guix shell rust rust:cargo cargo-audit cargo-license
 * Common Workflow for Rust Packaging::
 * Cargo Workspaces and Development Snapshots::
 * Using Rust Libraries in Other Build Systems::
+* Common Workflow for Updating Existing Rust Packages::
+* Common Workflow for Resolving Merge Conflicts on Existing Pull Requests::
@end menu

@node Common Workflow for Rust Packaging
@@ -1705,6 +1709,15 @@ $ cargo audit
 $ cargo license
@end example

+@quotation Note
+Before running @command{cargo generate-lockfile}, make sure you have checked
+out the correct tag for the version you are packaging. This ensures that
+@code{Cargo.toml} matches the file used in the packages's @code{source} field.
+To make sure, you can obtain the exact source with @command{./pre-inst-env guix
+build --source <package>} and only then run @command{cargo generate-lockfile} on
+that source tree.
+@end quotation
+
@command{cargo generate-lockfile} updates dependencies to compatible versions.
 Applying it to all Rust applications helps reduce a great number of Rust
 libraries we need to check later.  Although sometimes libraries may fail to
@@ -1987,6 +2000,316 @@ method, one of the most popular choices for Traditional Chinese users.")
    (license license:lgpl2.1+)))
@end lisp

+@node Common Workflow for Updating Existing Rust Packages
+@subsubsection Common Workflow for Updating Existing Rust Packages
+
+For this example, we'll update @code{niri}. The package definition looks like
+this initially:
+
+@lisp
+(define-public niri
+  (package
+   (name "niri")
+   (version "25.08")
+   (source (origin
+             (method git-fetch)
+             (uri (git-reference
+                   (url "https://github.com/YaLTeR/niri")
+                   (commit (string-append "v" version))))
+             (file-name (git-file-name name version))
+             (sha256
+              (base32
+               "09nsxd211mly8r1ys2lq6ia4jxgb980h1axrbgw748r0knfbbj7n"))))
+   (build-system cargo-build-system)
+...
+@end lisp
+
+We start by running the usual @command{guix refresh -u niri}.
+
+The @command{-u} flag will update in place the version and hash for the
+@code{niri} package.
+
+The package definition will then look like this:
+
+@lisp
+(define-public niri
+  (package
+   (name "niri")
+   (version "25.11")
+   (source (origin
+             (method git-fetch)
+             (uri (git-reference
+                   (url "https://github.com/YaLTeR/niri")
+                   (commit (string-append "v" version))))
+             (file-name (git-file-name name version))
+             (sha256
+              (base32
+               "0752qm245wc2gak0jhp0fnr0rdj3z54m2h97k3cxbjym9pcn658n"))))
+   (build-system cargo-build-system)
+...
+@end lisp
+
+This means the source field was updated successfully, thus we can now proceed to
+get the updated source with @command{guix build --source niri} as follows:
+
+@example shell
+$ cp -r $(./pre-inst-env guix build --source niri) /tmp
+$ cd /tmp/<hash>-niri-25.11-checkout/
+@end example
+
+@quotation Note
+In this specific example, the source is a git checkout, thus a directory. If the
+package source is a compressed archive, you would at this point extract it to a
+directory to proceed.
+@end quotation
+
+Now, given that we have access to the @code{Cargo.toml} file, we can now run
+the following inside the checkout:
+
+@example shell
+$ guix shell rust rust:cargo -- cargo generate-lockfile
+$ guix shell rust rust:cargo -- cargo audit
+$ guix shell rust rust:cargo -- cargo license
+@end example
+
+@quotation Note
+Sometimes the package will require a more up-to-date version of rust, that is
+not yet the default rust on guix. For these cases you can use:
+@example shell
+$ guix shell -e "(@ (gnu packages rust) rust-1.90)" \
+     -e '`(,(@ (gnu packages rust) rust-1.90) "cargo")'
+@end example
+@end quotation
+
+The first command will ensure that all cargo dependencies are up to date
+and semver compatible, while also providing some other benefits, as further
+explained in @ref{Common Workflow for Rust Packaging}.
+
+The following command will warn if there are any known vulnerabilities in the
+crates being imported. The last one will output the license information of all
+the dependent crates.
+
+If everything looks good, we can now replace the contents of the @code{niri}
+indentifier, located inside the @code{lookup-cargo-inputs} variable on the
+bottom of the @file{gnu/packages/rust-crates.scm} module, with the newer updated
+crates by running the importer on the lockfile as follows:
+
+@example shell
+$ guix import -i /path/to/gnu/packages/rust-crates.scm \
+     crate -f Cargo.lock niri
+@end example
+
+@quotation Note
+For the purpose of contributing a package to Guix (@pxref{Contributing,,,
+guix, GNU Guix Reference Manual}), there is no need to cleanup the leftover
+crates as a result of the package update.  This is tasked to the rust-team
+(@pxref{Teams,,, guix, GNU Guix Reference Manual}) to periodically run a
+convenient script in @code{etc/teams/rust} to cleanup unused crates from
+@file{gnu/packages/rust-crates.scm}.
+@end quotation
+
+We then need to check whether the importer has placed some TODOs for us,
+inside @file{gnu/packages/rust-crates.scm} (you can use @command{git diff --
+gnu/packages/rust-crates.scm} for this purpose).
+
+There are a few types of TODO messages that you might encounter during this
+step, each type requiring you to perform a different action.
+
+The first one we encounter in our example is:
+
+@lisp
+(define rust-libdisplay-info-sys-0.3.0
+  ;; TODO REVIEW: Check bundled sources.
+  (crate-source "libdisplay-info-sys" "0.3.0"
+                "07xmkc2aqcdn6d58321y87rd3gzdr4nx3ncm1mmrr7w1p1ahsn96"))
+@end lisp
+
+This specific TODO message tells us that there is a high probability of
+encountering bundled sources within a crate definition generated by the
+importer.
+
+We then check if there are any bundled sources within the
+@code{rust-libdisplay-info-sys-0.3.0} crate. Since there are none (in our
+example), we can simply remove the TODO line, and continue to the next TODO.
+
+If there were any bundled sources inside the crate, we would have to patch
+it with a snippet, in order to unbundle it. You can see some examples on
+how to unbundle inside @file{gnu/packages/rust-crates.scm} (search for the
+@code{#:snippet} keyword).
+
+@quotation Note
+If the unbundle is considered too difficult to be executed (e.g. the effort
+needed to unbundle is unreasonable), the @code{TODO REVIEW} line should be
+converted to a regular TODO comment explicitly stating the unbundle was not done
+(e.g. @code{TODO: Unbundle rust-libdisplay-info-sys.}).
+@end quotation
+
+Continuing, another TODO message we encounter in this example is the following:
+
+@lisp
+(define rust-smithay-0.7.0.d743e1a
+  ;; TODO REVIEW: Define standalone package if this is a workspace.
+  (origin
+    (method git-fetch)
+    (uri (git-reference (url "https://github.com/Smithay/smithay.git")
+                        (commit "d743e1a317fa0f01d1c4cadd96d277a1ec7b59d9")))
+    (file-name (git-file-name "rust-smithay" "0.7.0.d743e1a"))
+    (sha256 (base32 "11327mhxxf844bs0v5bw1g9bzjssnzhidsissywy6kwng16x727v"))))
+@end lisp
+
+This specific TODO message tells us that there is a high probability of the
+@code{rust-smithay-0.7.0.d743e1a} crate being a workspace.
+
+After verifying that it is indeed a workspace, we now need to make it an
+actual package in @file{gnu/packages/rust-sources.scm}, referencing it in the
+crate-source definition (see @ref{Common Workflow for Rust Packaging} for more
+details).
+
+@quotation Note
+You can verify if a crate is a workspace by cloning the crate repository (in
+this case @code{https://github.com/Smithay/smithay.git}), checking out the
+specific revision (in this case @command{git checkout d743e1a}), and looking
+for @code{[workspace]} in its main @file{Cargo.toml} file. If it does not have a
+TOML @code{[workspace]} section, then it is not a workspace.
+@end quotation
+
+After defining the separate source package for the workspace in
+@file{gnu/packages/rust-sources.scm} (see @ref{Common Workflow for Rust
+Packaging} for more details on how to do this), the crate definition for
+@code{rust-smithay-0.7.0.d743e1a} would then become the following (notice we
+also remove the TODO line):
+
+@lisp
+(define rust-smithay-0.7.0.d743e1a package:rust-smithay-0.7.0.d743e1a)
+@end lisp
+
+If @code{rust-smithay-0.7.0.d743e1a} was not a workspace, we would simply remove
+the TODO line and move on.
+
+We then try to build the package with @command{guix build niri}, and make sure
+whether it builds successfully, which it does.
+
+As a good practice, we can further check the output of the
+@code{check-for-pregenerated-files} phase to ensure there are no extraneous
+pregenerated files inside the crates. If there are any, it is important to
+snippet them out, like these:
+
+@lisp
+(define rust-winapi-x86-64-pc-windows-gnu-0.4.0
+  (crate-source "winapi-x86_64-pc-windows-gnu" "0.4.0"
+                "0gqq64czqb64kskjryj8isp62m2sgvx25yyj3kpc2myh85w24bki"
+                #:snippet '(delete-file-recursively "lib")))
+
+(define rust-flate2-1.1.4
+  (crate-source "flate2" "1.1.4"
+                "1a8a3pk2r2dxays4ikc47ygydhpd1dcxlgqdi3r9kiiq9rb4wnnw"
+                #:snippet '(for-each delete-file-recursively '("examples" "tests"))))
+
+(define rust-flo-curves-0.3.1
+  (crate-source "flo_curves" "0.3.1"
+                "16x293dp8825jh465kgms4yyvl4960j26gh37h3skflq9zxpy8hw"
+                #:snippet '(for-each delete-file '("logo-small.png" "logo.png"))))
+
+(define rust-interception-sys-0.1.3
+  (crate-source "interception-sys" "0.1.3"
+                "1lgwbml7gzq5a5rriy708w68gx6yiw9cdg7xy2c5vsrrck7pbs5b"
+                #:snippet '(for-each delete-file (find-files "." "\\.(dll|lib)$"))))
+@end lisp
+
+@node Common Workflow for Resolving Merge Conflicts on Existing Pull Requests
+@subsubsection Common Workflow for Resolving Merge Conflicts on Existing Pull Requests
+
+Whenever a Rust package change is merged into our target branch from a different
+Pull Request, we often encounter many merge conflicts in @code{(gnu packages
+rust-crates)} when rebasing the Pull Request on top of the target branch. Since
+we should avoid modifying the rust-crates file manually (e.g. using the git
+interface to solve merge conflicts), it is recommended (and often much faster)
+to drop all changes to @code{(gnu packages rust-crates)} and run the lockfile
+importer once again, manually adding back all the manual changes.
+
+This workflow describes one of many ways to do the described procedure.
+
+In this example we'll update the @code{codeberg-cli} package, which has produced
+some merge conflicts in @file{gnu/packages/rust-crates.scm} when we tried a git
+pull rebase.
+
+Before starting, make sure we're not in a rebase environment, by aborting the
+rebase we tried previously (the one which created the merge conflicts by git
+pulling):
+
+@example
+$ git rebase --abort
+@end example
+
+@cindex git rebase --interactive
+@cindex interactive rebase
+To begin, we interactively rebase our PR branch by marking as
+@code{edit} the commit we want to edit, which is the one containing the
+@file{gnu/packages/rust-crates.scm} changes:
+
+@example
+# Change 1 to the number of relevant commits
+$ git rebase -i HEAD~1
+@end example
+
+In our example, we would mark the @code{codeberg-cli} commit like so:
+
+@example
+edit 6ef4f1ad043 # gnu: codeberg-cli: Update to 0.5.4.
+@end example
+
+After that, we'll be in rebase mode, where we can restore the changes made to
+@file{gnu/packages/rust-crates.scm}:
+
+@quotation Note
+Notice that we will lose all manual changes we have previously made to
+@file{gnu/packages/rust-crates.scm} (e.g. snippets, deleting TODO comments,
+if there were any). We'll need to manually add them back after we run the guix
+lockfile importer once again, so make sure you have them saved somewhere, for
+example in your PR link under the @code{Files changed} tab.
+@end quotation
+
+@example
+$ git restore --source=HEAD~ gnu/packages/rust-crates.scm
+@end example
+
+Having restored the file, we can stage the changes, commit, finish the rebase
+and pull rebase from the target branch:
+
+@example
+$ git add gnu/packages/rust-crates.scm
+$ git commit --amend --no-edit
+$ git rebase --continue
+$ git pull <remote> <target branch>
+@end example
+
+We then proceed to run the guix lockfile importer:
+
+@quotation Note
+Remember to checkout the correct tag you're packaging in the package repository
+checkout. Don't forget to run @code{cargo generate-lockfile} before running
+the lockfile importer, see @ref{Common Workflow for Rust Packaging} for more
+detailed steps on what to do before running the guix lockfile importer.
+@end quotation
+
+@example
+$ guix import --insert=gnu/packages/rust-crates.scm \
+      crate --lockfile=/path/to/Cargo.lock codeberg-cli
+@end example
+
+Now is the time we manually add back the snippets and remove the relevant TODOs
+we have already checked (if there are any).
+
+After running the lockfile importer and checking if there are any changes to
+manually add back, we can finally:
+
+@example
+$ git add gnu/packages/rust-crates.scm
+# Our target commit is the last one:
+$ git commit --amend --no-edit
+@end example
+
+We now have a non-conflicting tree, from which we can now update our PR with.

@c *********************************************************************
@node System Configuration
@@ -2933,8 +3256,8 @@ your Linode Summary section.) Now you can run the "install guix from

@example
 sudo apt-get install gpg
-wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
-wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
+wget https://codeberg.org/efraim.gpg -qO - | gpg --import -
+wget https://guix.gnu.org/guix-install.sh
 chmod +x guix-install.sh
 ./guix-install.sh
 guix pull
@@ -3113,7 +3436,7 @@ Now you can run the "install guix from @pxref{Binary Installation,,,
 guix, GNU Guix}" steps:

@example
-wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
+wget https://guix.gnu.org/guix-install.sh
 chmod +x guix-install.sh
 ./guix-install.sh
 guix pull
@@ -4168,7 +4491,7 @@ network.  Assuming your interface is named @samp{enp2s0}, the following
 command can be used to do so:

@example sh
-# nmcli con add type bridge-slave ifname enp2s0 master br0
+# nmcli con add type bridge-slave autoconnect yes ifname enp2s0 master br0
@end example

@quotation Important
@@ -4204,8 +4527,8 @@ bridge interface, as the default is to deny all.  Add the following to
 your list of services to do so:

@example lisp
-(extra-special-file "/etc/qemu/host.conf"
-                    (plain-file "host.conf" "allow br0\n"))
+(extra-special-file "/etc/qemu/bridge.conf"
+                    (plain-file "bridge.conf" "allow br0\n"))
@end example

@subsection Invoking QEMU with the right command line options
@@ -4223,7 +4546,7 @@ machine making use of the bridge would cause networking issues.
@example sh
 $ qemu-system-x86_64 [...] \
    -device virtio-net-pci,netdev=user0,mac=XX:XX:XX:XX:XX:XX \
-    -netdev bridge,id=user0,br=br0 \
+    -netdev bridge,helper=/run/privileged/bin/qemu-bridge-helper,id=user0,br=br0 \
    [...]
@end example

@@ -10,8 +10,8 @@
@include version.texi

@c Identifier of the OpenPGP key used to sign tarballs and such.
-@set OPENPGP-SIGNING-KEY-ID 3CE464558A84FDC69DB40CFB090B11993D9AEBB5
-@set OPENPGP-SIGNING-KEY-URL https://sv.gnu.org/people/viewgpg.php?user_id=15145
+@set OPENPGP-SIGNING-KEY-ID A28BF40C3E551372662D14F741AAE7DCCA3D8351
+@set OPENPGP-SIGNING-KEY-URL https://codeberg.org/efraim.gpg

@c Base URL for downloads.
@set BASE-URL https://ftpmirror.gnu.org/gnu/guix
@@ -2658,12 +2658,13 @@ bootloaders.

 Once you are done partitioning the target hard disk drive, you have to
 create a file system on the relevant partition(s)@footnote{Currently
-Guix System supports only ext4, btrfs, bcachefs, JFS, F2FS, and XFS
-file systems.  In particular, code that reads file system UUIDs and
-labels works only for these file system types.  For bcachefs, also add
-the @code{bcachefs-linux-module} to your @code{operating-system}'s
-@code{initrd-modules}.}.  For the ESP, if you have one and assuming it is
-@file{/dev/sda1}, run:
+Guix System can mount only ext4, btrfs, JFS, F2FS, and XFS file systems
+at boot time.  In particular, code that reads file system UUIDs and
+labels works only for these file system types.  The code for bcachefs is
+in place, but support for loading out-of-tree kernel modules in the
+initrd is not.}.
+
+For the ESP, if you have one and assuming it is @file{/dev/sda1}, run:

@example
 mkfs.fat -F32 /dev/sda1
@@ -6590,6 +6591,21 @@ directory within the container.  If this is undesirable,
 be automatically shared and will change to the user's home directory
 within the container instead.  See also @option{--user}.

+@item --cwd=@var{directory}
+For containers, change to @var{directory} inside the container instead
+of the default location.  The default location is the current working
+directory when @option{--no-cwd} is not used, or the user's home
+directory when @option{--no-cwd} is used.  When @var{directory} is a
+relative file name, it is interpreted relative to the current working
+directory on the host.  Note that @option{--cwd} does not automatically
+share @var{directory}---you must ensure it is accessible via the default
+current directory sharing or explicit @option{--share}/@option{--expose}
+options.  For example:
+
+@example
+guix shell --container --cwd=/tmp --share=/tmp coreutils
+@end example
+
@item --writable-root
 When using @option{--container}, this option makes the root file system
 writable (it is read-only by default).
@@ -7091,6 +7107,17 @@ directory within the container.  If this is undesirable,
 be automatically shared and will change to the user's home directory
 within the container instead.  See also @option{--user}.

+@item --cwd=@var{directory}
+For containers, change to @var{directory} inside the container instead
+of the default location.  The default location is the current working
+directory when @option{--no-cwd} is not used, or the user's home
+directory when @option{--no-cwd} is used.  When @var{directory} is a
+relative file name, it is interpreted relative to the current working
+directory on the host.  Note that @option{--cwd} does not automatically
+share @var{directory}---you must ensure it is accessible via the default
+current directory sharing or explicit @option{--share}/@option{--expose}
+options.
+
@item --expose=@var{source}[=@var{target}]
@itemx --share=@var{source}[=@var{target}]
 For containers, @option{--expose} (resp. @option{--share}) exposes the
@@ -8737,6 +8764,52 @@ The example below denotes a version of gnu-standards to fetch:

@end deftp

+For Fossil repositories, the module @code{(guix fossil-download)} defines
+the @code{fossil-fetch} origin method and @code{fossil-reference} data type
+for support of the Fossil @abbr{SCM, software configuration management} system.
+
+@deffn {Procedure} fossil-fetch ref hash-algo hash [name]
+Return a fixed-output derivation that fetches @var{ref}, a
+@code{<fossil-reference>} object.  The output is expected to have recursive
+hash @var{hash} of type @var{hash-algo} (a symbol).  Use @var{name} as
+the file name, or a generic name if @code{#f}.
+@end deffn
+
+@deftp {Data Type} fossil-reference
+This data type represents a Fossil reference
+for @code{fossil-fetch} to retrieve.
+
+@table @asis
+@item @code{uri} (type: string)
+The URI of a Fossil repository to clone, in one of the following forms,
+in which @code{[...]} denotes optional elements:
+
+@table @code
+@item http[s]://[userid[:password]@@]host[:port][/path]
+A HTTP/HTTPS URL.
+@item [file://]path/to/repo.fossil
+A file URI, where the path must have an extra leading @code{/}
+to use an absolute path (without the URI scheme, the repository
+is opened directly without cloning).
+@end table
+
+@item @code{check-in} (type: string)
+A @url{https://fossil-scm.org/home/doc/trunk/www/checkin_names.wiki,
+name of the check-in} to fetch, e.g.@: its canonical hexadecimal identifier,
+associated tag and/or timestamp.
+@end table
+
+The example below denotes the @code{version-3.51.1} tag
+of the SQLite repository:
+
+@lisp
+(fossil-reference
+ (uri "https://sqlite.org/src")
+ (check-in "version-3.51.1"))
+@end lisp
+
+@end deftp
+
@node Defining Package Variants
@section Defining Package Variants

@@ -8797,12 +8870,12 @@ dependencies than the original package.  For example, the default
 optional dependency, you can define a variant that removes that
 dependency like so:

+@findex package/inherit
@lisp
 (use-modules (gnu packages gdb))   ;for 'gdb'

 (define gdb-sans-guile
-  (package
-    (inherit gdb)
+  (package/inherit gdb
    (inputs (modify-inputs inputs
              (delete "guile")))))
@end lisp
@@ -8810,6 +8883,23 @@ dependency like so:
 In the body of the @code{inputs} field above, @code{inputs} is bound to
 the inherited value.  Thus, the @code{modify-inputs} form above removes
 the @code{"guile"} package from the @code{inputs} field of @code{gdb}.
+
+@quotation Note
+The example above uses @code{(package/inherit gdb @dots{})} instead of
+the usual @code{(package (inherit gdb) @dots{})}.  While the latter
+would work, @code{package/inherit} does extra work: if @code{gdb} has a
+@code{replacement} field (@pxref{Security Updates}),
+@code{package/inherit} propagates the @code{inputs} changes of this
+variant to the replacement.
+
+In other words, @code{package/inherit} ensures the variant gets a
+consistent @code{replacement} when the original package has one.  Thus,
+one should generally use @code{package/inherit} when creating a variant
+for the same version, but not when targeting a different version, as in
+the @code{hello} example we saw earlier, where the replacement may be
+incorrect.
+@end quotation
+
 The @code{modify-inputs} macro is a helper that can prove useful anytime
 you want to remove, add, or replace package inputs.

@@ -14794,7 +14884,7 @@ provided through NuGet's v3 API at @code{api.nuget.org} and includes
 most relevant information, including package dependencies.
 There are some caveats, however.  The metadata does not always include
 repository information, in which case the importer attempts to extract
-it from the symbol package (@file{.snupkg}) if available. 
+it from the symbol package (@file{.snupkg}) if available.
 Additionally, dependencies are grouped by target framework in NuGet,
 but the importer flattens all dependency groups into a single list.

@@ -15488,7 +15578,7 @@ gnu/packages/qt.scm:452:13: qtbase would be upgraded from 5.15.8 to 5.15.10
@end example

@cindex partial version specification, guix refresh
-A per-package equivalent to --target-version is made available by
+A per-package equivalent to @option{--target-version} is made available by
 prefixing the version specification with the @samp{~} (tilde) character.
 For example:

@@ -16049,7 +16139,7 @@ it unchanged.
@item git-source
 If the @code{home-page} is a Git repository (as per
@code{git-repository-url?}), and the actual Git repository is tagged
-with @code{version} or @code{(string-append ``v'' version)}, change the
+with a version string, possibly prefixed by ``v'', change the
 package origin to the @code{git-fetch} method
 (@pxref{origin Reference}).  Consider this example:

@@ -16078,14 +16168,16 @@ its @code{source} field like to:
    (inherit guile-json-3)
    (name "guile-json")
    (version "4.7.3")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference (url
-                                   "https://github.com/aconchillo/guile-json")
-                                  (commit version)))
-              (file-name (git-file-name name version))
-              (sha256 (base32
-                       "0akhm8xjv8fl55fyq0w6c9c6hi5j7mifjx01w07np7qg1cjl9f06"))))))
+    (source
+      (origin
+        (method git-fetch)
+        (uri (git-reference
+               (url "https://github.com/aconchillo/guile-json")
+               (commit version)))
+        (file-name (git-file-name name version))
+        (sha256
+          (base32
+            "0akhm8xjv8fl55fyq0w6c9c6hi5j7mifjx01w07np7qg1cjl9f06"))))))
@end lisp

@end table
@@ -19150,7 +19242,7 @@ Partitioning}, for an example.

 When using GRUB as the bootloader, the LUKS password is only requested
 once: GRUB passes the master key to the initial RAM disk automatically.
-@xref{Bootloader Configuration, Automatic LUKS Master Key Passing}, for
+@xref{grub-luks-root-device-key, Automatic LUKS Master Key Passing}, for
 details.

@end defvar
@@ -27202,6 +27294,28 @@ Package object for GVfs.
@end table
@end deftp

+@defvar kmonad-service-type
+This is the type of the service that runs
+@uref{https://github.com/kmonad/kmonad, KMonad}.  Its value is a
+@code{kmonad-configuration} object.  This service allows spawning
+@command{kmonad} configurations to manage keyboards.
+
+@deftp {Data Type} kmonad-configuration
+Configuration record for the KMonad service.
+
+@table @asis
+@item @code{kmonad} (default: @code{kmonad})
+The KMonad package to use.
+
+@item @code{keymaps}
+A list of files with KMonad configurations. One shepherd service will be
+created to control each configuration. Each configuration should target
+a distinct input device as KMonad operates on a per-input basis.
+
+@end table
+@end deftp
+@end defvar
+
@defvar colord-service-type
 This is the type of the service that runs @command{colord}, a system
 service with a D-Bus
@@ -45163,6 +45277,12 @@ Extra command line options for @code{guix-data-service}.
@item @code{extra-process-jobs-options} (default: @var{'()})
 Extra command line options for @code{guix-data-service-process-jobs}.

+@item @code{extra-environment-variables} (default: @var{'()})
+Extra environment variables for @code{guix-data-service}.
+
+@item @code{extra-process-jobs-environment-variables} (default: @var{'()})
+Extra environment variables for @code{guix-data-service-process-jobs}.
+
@item @code{git-repositories} (default: @var{#f})
 List of git-repository information to insert into the database.

@@ -48872,8 +48992,28 @@ This option in enabled by default.  In some cases involving the
 in RAM, it can be handy to disable the option by setting it to
@code{#f}.

-@subsubheading Automatic LUKS Master Key Passing
+@item @code{extra-initrd} (default: @code{#f})
+File name of an additional initrd to load during the boot.  It may or
+may not point to a file in the store, but the main use case is for
+out-of-store files containing secrets.

+For any use case not involving secrets, you should use regular initrd
+(@pxref{operating-system Reference, @code{initrd}}) instead.
+
+Be careful when using this option, since pointing to a file that is not
+readable by the grub while booting will cause the boot to fail and
+require a manual edit of the initrd line in the grub menu.
+
+Currently only supported by GRUB.
+@end table
+
+@end deftp
+
+@anchor{grub-luks-root-device-key}
+@unnumberedsubsec Automatic LUKS Master Key Passing
+
+@cindex LUKS, root file system encryption
+@cindex passphrase, for LUKS-encrypted root
 When booting from a LUKS-encrypted device using GRUB, the password is
 normally requested twice: once by GRUB to access @file{/boot}, and a
 second time by the initial RAM disk to mount the root file system.
@@ -48914,22 +49054,7 @@ No configuration is required: GRUB's @code{procfs} and @code{luks}
 modules are loaded automatically when encrypted devices are declared
 via @code{luks-device-mapping} (@pxref{Mapped Devices}).

-@item @code{extra-initrd} (default: @code{#f})
-File name of an additional initrd to load during the boot.  It may or
-may not point to a file in the store, but the main use case is for
-out-of-store files containing secrets.
-
-For any use case not involving secrets, you should use regular initrd
-(@pxref{operating-system Reference, @code{initrd}}) instead.
-
-Be careful when using this option, since pointing to a file that is not
-readable by the grub while booting will cause the boot to fail and
-require a manual edit of the initrd line in the grub menu.
-
-Currently only supported by GRUB.
-@end table
-
-@end deftp
+@unnumberedsubsec Additional Boot Entries

@cindex dual boot
@cindex boot menu
@@ -49058,9 +49183,13 @@ example of chainloading a different GNU/Linux system.
@end table
@end deftp

+@unnumberedsubsec Themes
+
@cindex HDPI
@cindex HiDPI
@cindex resolution
+@cindex themes, for GRUB
+@cindex bootloader themes
@c FIXME: Write documentation once it's stable.
 For now only GRUB has theme support.  GRUB themes are created using
 the @code{grub-theme} form, which is not fully documented yet.
@@ -49080,7 +49209,7 @@ Return the default GRUB theme used by the operating system if no
@code{theme} field is specified in @code{bootloader-configuration}
 record.

-It comes with a fancy background image displaying the GNU and Guix
+It comes with a fancy background image displaying the Guix
 logos.
@end deffn

@@ -49455,7 +49584,7 @@ how to generate an image that uses the @code{grub-efi-bootloader}
 bootloader and boot it with QEMU:

@example
-image=$(guix system image --image-type=qcow2 \
+image=$(guix system image --image-type=qcow2-gpt \
        gnu/system/examples/lightweight-desktop.tmpl)
 cp $image /tmp/my-image.qcow2
 chmod +w /tmp/my-image.qcow2
@@ -53462,6 +53591,9 @@ Maximum time a cache entry for SSH keys is valid, in seconds.
@item @code{extra-content} (default: @code{""}) (type: raw-configuration-string)
 Raw content to add to the end of @file{~/.gnupg/gpg-agent.conf}.

+@item @code{shepherd-requirement} (default: @code{'()}) (type: list-of-symbols)
+List of services that should be started before this service.
+
@end table

@end deftp
@@ -16,6 +16,7 @@ exec $pre_inst_env_maybe guix repl -- "$0" "$@"
 ;;; Copyright © 2025 Cayetano Santos <csantosb@inventati.org>
 ;;; Copyright © 2025-2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2025 jgart <jgart@dismail.de>
+;;; Copyright © 2026 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -565,6 +566,7 @@ challenges"))
              "guix/docker.scm"
              "guix/download.scm"
              "guix/elf.scm"
+              "guix/fossil-download.scm"
              "guix/ftp-client.scm"
              "guix/gexp.scm"
              "guix/git-authenticate.scm"
@@ -689,6 +691,7 @@ ecosystem."
  (team 'embedded
        #:name "Embedded"
        #:scope (list "gnu/packages/bootloaders.scm"
+                      "gnu/packages/coreboot.scm"
                      "gnu/packages/firmware.scm")))

 (define-team games
@@ -825,6 +828,7 @@ and the maven-build-system."
              (make-regexp* "^gnu/packages/java(-.+|)\\.scm$")
              ;; Match maven.scm and maven-*.scm
              (make-regexp* "^gnu/packages/maven(-.+|)\\.scm$")
+              "gnu/packages/netbeans.scm"
              "guix/build/ant-build-system.scm"
              "guix/build/clojure-build-system.scm"
              "guix/build/clojure-utils.scm"
@@ -841,7 +845,8 @@ and the maven-build-system."
        #:name "JavaScript team"
        #:description
        "JavaScript/Node.js packages, the node build system."
-        #:scope (list "gnu/packages/node-xyz.scm"
+        #:scope (list "gnu/packages/javascript.scm"
+                      "gnu/packages/node-xyz.scm"
                      "gnu/packages/node.scm"
                      "guix/build-system/node.scm"
                      "guix/build/node-build-system.scm"
@@ -942,6 +947,7 @@ importer, and the ocaml-build-system."
        #:scope
        (list "gnu/packages/ocaml.scm"
              "gnu/packages/coq.scm"
+              "gnu/packages/rocq.scm"
              "guix/build/ocaml-build-system.scm"
              "guix/build/dune-build-system.scm"
              "guix/build-system/ocaml.scm"
@@ -1214,6 +1220,7 @@ the \"texlive\" importer."
                      "gnu/tests/version-control.scm"
                      "guix/build/bzr.scm"
                      "guix/build/cvs.scm"
+                      "guix/build/fossil.scm"
                      "guix/build/git.scm"
                      "guix/build/hg.scm"
                      "guix/build/svn.scm")))
@@ -1244,6 +1251,11 @@ the \"texlive\" importer."
                       "jonsger")
  mozilla)

+(define-member (person "Denis Carikli"
+                       "GNUtoo@cyberdimension.org"
+                       "GNUtoo")
+  embedded)
+
 (define-member (person "Ludovic Courtès"
                       "ludo@gnu.org"
                       "civodul")
@@ -1627,7 +1639,7 @@ the \"texlive\" importer."
 (define-member (person "Thanos Apollo"
                       "public@thanosapollo.org"
                       "thanosapollo")
-  vcs)
+  vcs emacs)

 (define-member (person "Ashish SHUKLA"
                       "ashish.is@lostca.se"
@@ -1649,6 +1661,11 @@ the \"texlive\" importer."
                       "tok")
  electronics)

+(define-member (person "gemmaro"
+                       "gemmaro.dev@gmail.com"
+                       "gemmaro")
+  ruby)
+

 (define (find-team name)
  (or (hash-ref %teams (string->symbol name))
@@ -1,6 +1,6 @@
 #!/usr/bin/env -S gawk -f
 # GNU Guix --- Functional package management for GNU
-# Copyright © 2025 Efraim Flashner <efraim@flashner.co.il>
+# Copyright © 2025, 2026 Efraim Flashner <efraim@flashner.co.il>
 #
 # This file is part of GNU Guix.
 #
@@ -21,20 +21,22 @@
 # ./etc/teams/rust/audit-rust-crates ./path/to/file.scm
 # Prints the output of cargo-audit to the shell.

-# Make sure we have cargo-audit in our PATH
 BEGIN {
-    if (system("which cargo-audit 1> /dev/null"))
-        exit 1;
+    "which cargo-audit" | getline cargoAudit
+    close("which cargo-audit")
+    cargoAudit = cargoAudit " audit --file -"
+
    # Parse a record at a time.
    RS = "\n\n"
-    cargoAudit = "cargo-audit audit --file -"
 }

-# Check the crate-source origin-only inputs
+# Check the crate-source origin-only inputs, like in rust-crates.scm
 /crate-source/ {
    for(i=3; i <= NF-2; i++) {
        if($i == "(crate-source") {
-            cargoLock = cargoLock "[[package]]\nname = " $(i+1) "\nversion = " $(i+2) "\n"
+            crateName = $(i+1)
+            crateVersion = $(i+2)
+            cargoLock = cargoLock "[[package]]\nname = " crateName "\nversion = " crateVersion "\n"
            next
        }
    }
@@ -44,27 +46,64 @@ BEGIN {
 /crate-uri/ {
    for(i=3; i <= NF; i++) {
        if($i == "(version")
-           crateVersion = $(i+1)
+            crateVersion = $(i+1)
        if($i == "(crate-uri")
-           crateName = $(i+1)
+            crateName = $(i+1)
    }
    gsub(/)/, "", crateVersion)
    cargoLock = cargoLock "[[package]]\nname = " crateName "\nversion = " crateVersion "\n"
+    next
 }

-# The xxxx-cargo-input variables have a set style
-# TODO: Replace the last dash between the name and the version with a space!
-# This doesn't take into account swapping between "-" and "_" so we skip it.
-#( $2 ~ /-cargo-inputs/ ) {
-#    sub(/-cargo-inputs/, "", $2)
-#    gsub(/)/, "", $0)
-#    gsub(/rust-/, "", $0)
-#    #gensub(/([[:alpha:]])-([[:digit:]]+)/, "\\1 \\2", "g", $i)
-#    print "[[package]]\nname = \"" $2 "\"\nversion = \"1.0.0\"\ndependencies = ["
-#    for (i = 4; i <= NF; i++) {
-#        print "\"" $i "\","
-#    }
-#    print "]"
-#}
+# Parse the crates created from packages using 'cargo package'
+/package:rust/ {
+    pkg = $2
+    split(pkg, name_version, "-")
+    crateVersion = name_version[length(name_version)]
+    crateName = substr(pkg, 6, (length(pkg) - length(crateVersion) - 6))
+    split(crateVersion, versionDots, ".")
+    if(crateVersion && (crateVersion != "(git-version") && (length(versionDots) == 3) && crateName) {
+        cargoLock = cargoLock "[[package]]\nname = \"" crateName "\"\nversion = \"" crateVersion "\"\n"
+    } else {
+        untested++
+        #print("Unable to test " $0)
+    }
+    next
+}

-END { print cargoLock | cargoAudit }
+# We make an attempt to create the crate name from the package name otherwise
+/git-reference/ {
+    for(i=3; i <= NF; i++) {
+        if($i == "(version")
+            crateVersion = $(i+1)
+        if($i == "(name")
+            crateName = $(i+1)
+        if($i == "(git-file-name") {
+            crateName = $(i+1)
+            crateVersion = $(i+2)
+        }
+    }
+    gsub(/)/, "", crateVersion)
+    gsub(/)/, "", crateName)
+    sub(/rust-/, "", crateName)
+    # The crate version MUST be major.minor.patch
+    split(crateVersion, versionParts, ".")
+    if(crateVersion && (crateVersion != "(git-version") && (length(versionParts) == 3) && crateName) {
+        cargoLock = cargoLock "[[package]]\nname = " crateName "\nversion = " crateVersion "\n"
+    } else {
+        untested++
+        #print("Unable to test " $0)
+    }
+    next
+}
+
+# Note those which we were unable to parse
+/define rust/ {
+    if($3 == "#f)")
+        next
+    print("Unable to parse " $0)
+    }
+
+{ untested++ }
+
+END { print("Number of crates untested: " untested); print cargoLock | cargoAudit }
@@ -1226,10 +1226,12 @@ file name or an nfs-root containing ':/')."

  (match spec
    ((? string?)
-     (if (string-prefix? "/dev/" spec)
+     (if (string-match "^/dev/[a-zA-Z0-9]+$" spec)
         ;; Nothing to do, but wait until SPEC shows up.
         (resolve device-exists? spec identity)
-         spec)) ; do not resolve NFS / CIFS / tmpfs devices
+         ;; Do not resolve NFS / CIFS / tmpfs devices
+         ;; or bcachefs multi-device specifications.
+         spec))
    ((? file-system-label?)
     ;; Resolve the label.
     (resolve find-partition-by-label
@@ -445,10 +445,14 @@ load path must be adjusted as needed."
          ;; Behave like an init process: create a sub-process that calls
          ;; THUNK, and wait for child processes.  Furthermore, forward
          ;; RELAYED-SIGNALS to the child process.
-          (match (primitive-fork)
-            (0
+          ;; We presently use `safe-clone` here due to a bug in the interaction
+          ;; between Guix and `primitive-fork` in Guile 3.0.11:
+          ;; https://codeberg.org/guix/guix/issues/7690#issuecomment-12744123
+          (safe-clone
+            SIGCHLD
+            (lambda ()
             (call-with-clean-exit thunk))
-            (pid
+            (lambda (pid)
             (install-signal-handlers pid)
             (let loop ()
               (match (wait-child-process)
@@ -81,7 +81,10 @@ entry will be expired even if it has been accessed recently.")
   "Maximum time a cache entry for SSH keys is valid, in seconds.")
  (extra-content
   (raw-configuration-string "")
-   "Raw content to add to the end of @file{~/.gnupg/gpg-agent.conf}."))
+   "Raw content to add to the end of @file{~/.gnupg/gpg-agent.conf}.")
+  (shepherd-requirement
+   (list-of-symbols '())
+   "List of services that should be started before this service."))

 (define (home-gpg-agent-configuration-file config)
  "Return the @file{gpg-agent.conf} file for @var{config}."
@@ -104,7 +107,7 @@ entry will be expired even if it has been accessed recently.")
 (define (home-gpg-agent-shepherd-services config)
  "Return the possibly-empty list of Shepherd services for @var{config}."
  (match-record config <home-gpg-agent-configuration>
-    (gnupg ssh-support?)
+    (gnupg ssh-support? shepherd-requirement)
    ;; 'gpg-agent' is started on demand by GnuPG's programs, but it has to be
    ;; started explicitly when OpenSSH support is enabled (info "(gnupg) Agent
    ;; Options").
@@ -119,15 +122,21 @@ entry will be expired even if it has been accessed recently.")
                             #:socket-directory-permissions #o700))))
          (list (shepherd-service
                 (provision '(gpg-agent ssh-agent))
+                 (requirement shepherd-requirement)
                 (modules '((shepherd support)))  ;for '%user-runtime-dir'
-                 (start #~(make-systemd-constructor
-                           (list #$(file-append gnupg "/bin/gpg-agent")
-                                 "--supervised" "--enable-ssh-support")
-                           (list #$(endpoint "ssh" "S.gpg-agent.ssh")
-                                 #$(endpoint "browser" "S.gpg-agent.browser")
-                                 #$(endpoint "extra" "S.gpg-agent.extra")
-                                 ;; #$(endpoint "scdaemon" "S.scdaemon")
-                                 #$(endpoint "std" "S.gpg-agent"))))
+                 (start
+                  #~(lambda args
+                      ((make-systemd-constructor
+                        (list #$(file-append gnupg "/bin/gpg-agent")
+                              "--supervised" "--enable-ssh-support")
+                        (list #$(endpoint "ssh" "S.gpg-agent.ssh")
+                              #$(endpoint "browser" "S.gpg-agent.browser")
+                              #$(endpoint "extra" "S.gpg-agent.extra")
+                              ;; #$(endpoint "scdaemon" "S.scdaemon")
+                              #$(endpoint "std" "S.gpg-agent"))
+                        ;; Inherit graphical session environment.
+                        #:environment-variables (environ))
+                       args)))
                 (stop #~(make-systemd-destructor))
                 (documentation "Start 'gpg-agent', the GnuPG passphrase
 agent, with support for handling OpenSSH material."))))
@@ -57,7 +57,7 @@
 # Copyright © 2022 ( <paren@disroot.org>
 # Copyright © 2022, 2026 jgart <jgart@dismail.de>
 # Copyright © 2022-2023, 2025-2026 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
-# Copyright © 2023-2025 Zheng Junjie <z572@z572.online>
+# Copyright © 2023-2026 Zheng Junjie <z572@z572.online>
 # Copyright © 2023 Ivana Drazovic <iv.dra@hotmail.com>
 # Copyright © 2023 Andy Tai <atai@atai.org>
 # Copyright © 2023 B. Wilson <elaexuotee@wilsonb.com>
@@ -502,6 +502,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/myrddin.scm			\
  %D%/packages/ncdu.scm				\
  %D%/packages/ncurses.scm			\
+  %D%/packages/netbeans.scm			\
  %D%/packages/netpbm.scm			\
  %D%/packages/nettle.scm			\
  %D%/packages/networking.scm			\
@@ -610,6 +611,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/rocm-apps.scm			\
  %D%/packages/rocm-libs.scm			\
  %D%/packages/rocm-tools.scm			\
+  %D%/packages/rocq.scm				\
  %D%/packages/rpc.scm				\
  %D%/packages/rpm.scm				\
  %D%/packages/rrdtool.scm			\
@@ -1092,6 +1094,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/catdoc-CVE-2017-11110.patch		\
  %D%/packages/patches/chez-irregex-import-cond-expand.patch	\
  %D%/packages/patches/chez-scheme-bin-sh.patch			\
+  %D%/packages/patches/cianna-remove-error-for-missing-cuda.patch		\
  %D%/packages/patches/circos-remove-findbin.patch		\
  %D%/packages/patches/cdparanoia-fpic.patch			\
  %D%/packages/patches/cdrkit-libre-cross-compile.patch	\
@@ -1130,9 +1133,10 @@ dist_patch_DATA =						\
  %D%/packages/patches/clucene-gcc-14.patch			\
  %D%/packages/patches/clucene-pkgconfig.patch			\
  %D%/packages/patches/coda-use-system-libs.patch		\
-  %D%/packages/patches/codex-acp-0.9.2-remove-patch-sections.patch \
-  %D%/packages/patches/codex-acp-0.9.2-replace-result-flatten.patch    \
+  %D%/packages/patches/codex-acp-0.11.1-disable-code-mode.patch \
+  %D%/packages/patches/codex-acp-0.11.1-remove-patch-sections.patch \
  %D%/packages/patches/codex-0.98.0-remove-patch-sections.patch    \
+  %D%/packages/patches/rust-codex-0.117.0-remove-patch-sections.patch    \
  %D%/packages/patches/cogl-fix-double-free.patch		\
  %D%/packages/patches/collada-dom-boost.patch			\
  %D%/packages/patches/collectd-5.11.0-noinstallvar.patch	\
@@ -1176,6 +1180,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/curlftpfs-fix-no_verify_hostname.patch	\
  %D%/packages/patches/cursynth-wave-rand.patch			\
  %D%/packages/patches/cvc5-reproducible-build.patch		\
+  %D%/packages/patches/cvc5-symfpu-compatibility.patch		\
  %D%/packages/patches/cvs-CVE-2017-12836.patch		\
  %D%/packages/patches/cyrus-sasl-fix-time-h.patch              \
  %D%/packages/patches/d-feet-drop-unused-meson-argument.patch	\
@@ -1238,7 +1243,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/python-treelib-remove-python2-compat.patch	\
  %D%/packages/patches/elm-offline-package-registry.patch	\
  %D%/packages/patches/elm-reactor-static-files.patch		\
-  %D%/packages/patches/emacs-buttercup-1.38-native-comp-spy-on-trampoline-scope.patch	\
+  %D%/packages/patches/emacs-agent-shell-fix-tests.patch        \
  %D%/packages/patches/emacs-deferred-fix-number-of-arguments.patch	\
  %D%/packages/patches/emacs-disable-jit-compilation.patch			\
  %D%/packages/patches/emacs-doc-toc-shell-commands.patch	\
@@ -1453,7 +1458,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/ghc-aeson-encodeDouble.patch		\
  %D%/packages/patches/ghc-basement-fix-32bit.patch		\
  %D%/packages/patches/ghc-bytestring-handle-ghc9.patch	\
-  %D%/packages/patches/ghc-chell-quickcheck-enable-qc-2.15.patch	\
  %D%/packages/patches/ghc-clock-realfrag.patch	\
  %D%/packages/patches/ghc-language-haskell-extract-ghc-8.10.patch	\
  %D%/packages/patches/ghc-memory-fix-32bit.patch		\
@@ -1467,7 +1471,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/ghostscript-no-header-creationdate.patch \
  %D%/packages/patches/gimp-fix-metadata-editor.patch		\
  %D%/packages/patches/gimp-fix-tiff-load.patch			\
-  %D%/packages/patches/git-clar-path-max.patch			\
  %D%/packages/patches/git-filter-repo-generate-doc.patch	\
  %D%/packages/patches/gklib-suitesparse.patch			\
  %D%/packages/patches/glib-appinfo-watch.patch			\
@@ -1617,7 +1620,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/hurd-refcounts-assert.patch		\
  %D%/packages/patches/hurd-rumpdisk-no-hd.patch		\
  %D%/packages/patches/hurd-startup.patch			\
-  %D%/packages/patches/hwloc-1-test-btrfs.patch			\
  %D%/packages/patches/hwloc-add-with-opencl.patch		\
  %D%/packages/patches/i3lock-blur-fix-build-on-gcc-10.patch	\
  %D%/packages/patches/i7z-gcc-10.patch				\
@@ -1653,6 +1655,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/id3lib-CVE-2007-4460.patch			\
  %D%/packages/patches/id3lib-UTF16-writing-bug.patch			\
  %D%/packages/patches/ilmbase-fix-tests.patch			\
+  %D%/packages/patches/inetutils-drop-test.patch                \
  %D%/packages/patches/inferno-fix-crash.patch		\
  %D%/packages/patches/iniparser-remove-fetchcontent-usage.patch		\
  %D%/packages/patches/inkscape-libxml2.patch		\
@@ -1675,6 +1678,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/java-commons-collections-fix-java8.patch \
  %D%/packages/patches/java-guava-remove-annotation-deps.patch \
  %D%/packages/patches/java-jeromq-fix-tests.patch		\
+  %D%/packages/patches/java-jtidy-remove-xerces-dependency.patch	\
  %D%/packages/patches/java-openjfx-build-jdk_version.patch     \
  %D%/packages/patches/java-powermock-fix-java-files.patch		\
  %D%/packages/patches/java-simple-xml-fix-tests.patch		\
@@ -1683,6 +1687,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/java-xerces-build_dont_unzip.patch	\
  %D%/packages/patches/java-xerces-xjavac_taskdef.patch	\
  %D%/packages/patches/jbr-17-xcursor-no-dynamic.patch	\
+  %D%/packages/patches/jbr-25-wayland-drag-icon.patch	\
+  %D%/packages/patches/jbr-25-wayland-intra-jvm-dnd.patch	\
  %D%/packages/patches/jdk-currency-time-bomb.patch		\
  %D%/packages/patches/jdk-currency-time-bomb2.patch		\
  %D%/packages/patches/jfsutils-add-sysmacros.patch		\
@@ -1745,7 +1751,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/kissfft-tflite-micro.patch               \
  %D%/packages/patches/kitty-fix-wayland-protocols.patch	\
  %D%/packages/patches/kmod-module-directory.patch		\
-  %D%/packages/patches/kmscon-runtime-keymap-switch.patch	\
+  %D%/packages/patches/kmscon-8-runtime-keymap-switch.patch	\
  %D%/packages/patches/knot-remove-runtime-deps.patch		\
  %D%/packages/patches/kobodeluxe-paths.patch			\
  %D%/packages/patches/kobodeluxe-enemies-pipe-decl.patch	\
@@ -1974,6 +1980,11 @@ dist_patch_DATA =						\
  %D%/packages/patches/netcdf-date-time.patch			\
  %D%/packages/patches/netdde-build-fix.patch			\
  %D%/packages/patches/netdde-csum.patch			\
+  %D%/packages/patches/java-apache-xml-commons-resolver-1.2-netbeans.patch \
+  %D%/packages/patches/java-simplevalidation-1.14.1.patch	\
+  %D%/packages/patches/netbeans-25-nativeexecution-paths.patch \
+  %D%/packages/patches/netbeans-25-terminal-no-login-shell.patch \
+  %D%/packages/patches/netbeans-25-source-only-build.patch	\
  %D%/packages/patches/netpbm-CVE-2017-2586.patch		\
  %D%/packages/patches/netpbm-CVE-2017-2587.patch		\
  %D%/packages/patches/netsurf-message-timestamp.patch		\
@@ -2068,6 +2079,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/open-zwave-hidapi.patch			\
  %D%/packages/patches/opusfile-CVE-2022-47021.patch		\
  %D%/packages/patches/orbit2-fix-array-allocation-32bit.patch \
+  %D%/packages/patches/orca-fix-gst-init-check-call.patch \
  %D%/packages/patches/orpheus-cast-errors-and-includes.patch	\
  %D%/packages/patches/ots-no-include-missing-file.patch	\
  %D%/packages/patches/owncloud-disable-updatecheck.patch	\
@@ -2170,6 +2182,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/perl-www-curl-remove-symbol.patch	\
  %D%/packages/patches/perl-xml-libxml-fix-function-prototypes.patch	\
  %D%/packages/patches/phoronix-test-suite-fsdg.patch		\
+  %D%/packages/patches/php-01-fix-expired-certificate.patch	\
+  %D%/packages/patches/php-02-fix-sni-tests.patch		\
  %D%/packages/patches/picprog-non-intel-support.patch		\
  %D%/packages/patches/pidgin-add-search-path.patch		\
  %D%/packages/patches/pinball-system-ltdl.patch		\
@@ -2258,6 +2272,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/python-werkzeug-tests.patch		\
  %D%/packages/patches/qdigidoc-bundle-config-files.patch       \
  %D%/packages/patches/qdigidoc-bundle-tsl-files.patch          \
+  %D%/packages/patches/qdigidoc-fix-icon.patch                  \
  %D%/packages/patches/qemu-build-info-manual.patch		\
  %D%/packages/patches/qemu-fix-agent-paths.patch 		\
  %D%/packages/patches/qemu-fix-test-virtio-version.patch       \
@@ -2347,8 +2362,16 @@ dist_patch_DATA =						\
  %D%/packages/patches/renpy-fix-integer-slots.patch			\
  %D%/packages/patches/reposurgeon-add-missing-docbook-files.patch	\
  %D%/packages/patches/rdkit-unbundle-external-dependencies.patch	\
+  %D%/packages/patches/r-biostrings-r4.6.0-compat.patch		\
+  %D%/packages/patches/r-h5mread-0001-h5mread-1.3.2-Get-rid-of-non-API-calls-to-R.patch \
  %D%/packages/patches/r-httpuv-1.6.6-unvendor-libuv.patch	\
+  %D%/packages/patches/r-mscoreutils-0001-fix-non-API-call-to-R-SETLENGTH-by-using-lengthgets.patch \
+  %D%/packages/patches/r-rsamtools-r-4.6.0-compat.patch		\
+  %D%/packages/patches/r-snpstats-0001-fixed-non-API-except-for-IS_S4_OBJECT.patch \
+  %D%/packages/patches/r-snpstats-0002-fixed-IS_S4_OBJECT.patch \
  %D%/packages/patches/r-sapa-lapack.patch			\
+  %D%/packages/patches/r-shortread-0001-ShortRead-1.69.3-Get-rid-of-non-API-calls-to-R.patch \
+  %D%/packages/patches/r-sparsearray-r-4.6.0-compat.patch	\
  %D%/packages/patches/ripperx-missing-file.patch		\
  %D%/packages/patches/rpcbind-CVE-2017-8779.patch		\
  %D%/packages/patches/rtosc-0.3.1-fix-invalid-comparison-operator.patch	\
@@ -2393,6 +2416,14 @@ dist_patch_DATA =						\
  %D%/packages/patches/rust-codex-0.98.0-test-shebangs.patch	\
  %D%/packages/patches/rust-codex-0.98.0-test-timeout.patch	\
  %D%/packages/patches/rust-codex-0.98.0-windows-sandbox-protocol-version.patch	\
+  %D%/packages/patches/rust-codex-0.117.0-core-remove-self-dep.patch	\
+  %D%/packages/patches/rust-codex-0.120.0-core-remove-self-dep.patch	\
+  %D%/packages/patches/rust-codex-0.120.0-connectors-cache-test-race.patch	\
+  %D%/packages/patches/rust-codex-0.120.0-remove-libwebrtc.patch	\
+  %D%/packages/patches/rust-codex-0.120.0-test-timeout.patch	\
+  %D%/packages/patches/rust-codex-0.124.0-code-mode-stub-toolname.patch	\
+  %D%/packages/patches/rust-codex-0.124.0-remove-patch-sections.patch	\
+  %D%/packages/patches/rust-librocksdb-sys-unbundled-sources.patch	\
  %D%/packages/patches/rust-ring-0.17-ring-core.patch		\
  %D%/packages/patches/rw-igraph-0.10.patch			\
  %D%/packages/patches/rxvt-unicode-fix-cursor-position.patch	\
@@ -185,7 +185,7 @@ terminals.")
    (native-inputs
     (append
       (list clisp
-             python-cython
+             python-cython-0 ;; See https://bugzilla.redhat.com/show_bug.cgi?id=2231865
             doxygen
             gettext-minimal)
       ;; icedtea doesn't build reliably on all architectures.
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012-2025 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012-2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Cyril Roelandt <tipecaml@gmail.com>
 ;;; Copyright © 2014, 2015, 2016, 2018, 2019, 2020 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014, 2015-2018, 2020-2023 Eric Bavier <bavier@posteo.net>
@@ -1158,7 +1158,7 @@ on memory usage on GNU/Linux systems.")
 (define-public htop
  (package
    (name "htop")
-    (version "3.4.1")
+    (version "3.5.1")
    (source
     (origin
       (method git-fetch)
@@ -1166,7 +1166,7 @@ on memory usage on GNU/Linux systems.")
             (url "https://github.com/htop-dev/htop")
             (commit version)))
       (sha256
-        (base32 "058y4a4mvx9m179dyr4wi8mlm6i4ybywshadaj4cvfn9fv0r0nkx"))
+        (base32 "187gyj081n6qsidll5wdri3jkr4m2i4m461z3xv03y342f5yj3lv"))
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
@@ -1309,7 +1309,8 @@ re-executing them as necessary.")
                                  version ".tar.gz"))
              (sha256
               (base32
-                "11n01vsd51r7qraaaylhhx04hq4s6vcq0896zkz0yp1wvqfbwmm1"))))
+                "11n01vsd51r7qraaaylhhx04hq4s6vcq0896zkz0yp1wvqfbwmm1"))
+              (patches (search-patches "inetutils-drop-test.patch"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -3441,7 +3442,7 @@ modules and plugins that extend Ansible.")
     (list ansible
           bash-minimal
           encfs
-           fuse-2
+           fuse
           util-linux ;; for umount
           findutils
           git
@@ -3750,59 +3751,68 @@ summarizes network bandwidth by process and remote host.")
 (define-public munge
  (package
    (name "munge")
-    (version "0.5.14")
+    (version "0.5.18")
    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://github.com/dun/munge/releases/"
-                                  "download/munge-" version "/munge-"
-                                  version ".tar.xz"))
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/dun/munge")
+                     (commit (string-append "munge-" version))))
+              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0h06sghb4rqvv1ywyd6mzsmbcgh712v6ygrff0gzm440y4ca41k6"))
+                "1b7gm680dlvmgvj9vxy7n0cqmnv1rl9n4563vasxdxx54f78j30s"))
              (modules '((guix build utils)))
              (snippet
-               '(begin
-                  ;; Don't insist on write access to /var.
-                  (substitute* "src/etc/Makefile.in"
-                    (("\\$\\(INSTALL\\)(.*)localstatedir" _ middle)
-                     (string-append "-$(INSTALL)" middle "localstatedir"))
-                    (("\\$\\(MKDIR_P\\) .*(local|run)statedir.*")
-                     ""))
-                  #t))))
+               ;; Don't insist on write access to /var.
+               #~(substitute* "src/etc/Makefile.am"
+                   (("\\$\\(MKDIR_P\\) .*(local|run)statedir.*" all)
+                    (string-append ": " all))))))
    (inputs
     (list openssl libgcrypt))
+    (native-inputs
+     (list autoconf
+           automake
+           libtool
+           procps))                               ;for tests
    (build-system gnu-build-system)
    (arguments
-     `(#:configure-flags
-       (list "--localstatedir=/var"
-             (string-append "--with-pkgconfigdir="
-                            (assoc-ref %outputs "out") "/lib/pkgconfig")
-             (string-append "--with-libgcrypt-prefix="
-                            (assoc-ref %build-inputs "libgcrypt"))
-             ,@(if (%current-target-system)
-                 ;; Assume yes on pipes when cross compiling.
-                 `("ac_cv_file__dev_spx=yes"
-                   "x_ac_cv_check_fifo_recvfd=yes")
-                 '()))
-       #:phases
-       (modify-phases %standard-phases
-         ;; XXX Many test series fail.  Some might be fixable, others do no-no
-         ;; things like invoking ‘sudo’.
-         (add-after 'unpack 'skip-failing-tests
-           (lambda _
-             (for-each (lambda (test)
-                         (substitute* "t/Makefile.in"
-                           (((string-append test "\\.t ")) "")))
-                       (list "0100-munged-lock"
-                             "0010-basic"
-                             "0011-munged-cmdline"
-                             "0012-munge-cmdline"
-                             "0013-unmunge-cmdline"
-                             "0101-munged-security-socket"
-                             "0102-munged-security-keyfile"
-                             "0103-munged-security-logfile"
-                             "0110-munged-origin-addr"))
-             #t)))))
+     (list #:configure-flags
+           #~(list "--localstatedir=/var"
+                   "--disable-static"
+                   #$@(if (%current-target-system)
+                          ;; Assume yes on pipes when cross compiling.
+                          `("ac_cv_file__dev_spx=yes"
+                            "x_ac_cv_check_fifo_recvfd=yes")
+                          '())
+
+                   ;; The '.pc' file is not installed when omitting this flag.
+                   (string-append "--with-pkgconfigdir="
+                                  #$output "/lib/pkgconfig"))
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-before 'bootstrap 'pre-bootstrap
+                 (lambda _
+                   (for-each patch-shebang (find-files "build-aux"))))
+               (add-after 'unpack 'skip-failing-tests
+                 (lambda _
+                   ;; Pass '--force' to 'munged'; without it, it fails with "Socket
+                   ;; is inaccessible" due to the build directory not being
+                   ;; world-readable.
+                   (substitute* "tests/sharness.d/03-munged.sh"
+                     (("--group-update-time=-1" all)
+                      (string-append all " --force")))
+
+                   ;; The tests below invoke 'sudo' or have special expectations
+                   ;; about network interfaces.
+                   (for-each (lambda (test)
+                               (substitute* "tests/Makefile.am"
+                                 (((string-append test "\\.t "))
+                                  "")))
+                             (list "0100-munged-lock"
+                                   "0101-munged-security-socket"
+                                   "0102-munged-security-keyfile"
+                                   "0103-munged-security-logfile"
+                                   "0110-munged-origin-addr")))))))
    (home-page "https://dun.github.io/munge/")
    (synopsis "Cluster computing authentication service")
    (description
@@ -7042,7 +7052,7 @@ network, which causes enabled computers to power on.")
 (define-public witr
  (package
    (name "witr")
-    (version "0.1.7")
+    (version "0.3.1")
    (source
     (origin
       (method git-fetch)
@@ -7051,7 +7061,7 @@ network, which causes enabled computers to power on.")
              (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "18xx01lxd5j019gy9jmpms3awv4snlr028w01bfkyfid6hlwxbq2"))))
+        (base32 "03v9n4mdvqm0knqjl4s64321i5clqpmlrlkkdb87glzb9p28sg00"))))
    (build-system go-build-system)
    (arguments
     (list
@@ -7169,6 +7179,35 @@ stored in an SQL database.")
 (connects via USB OTG).")
    (license license:expat)))

+(define-public yoctofetch
+  (package
+    (name "yoctofetch")
+    (version "2.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://codeberg.org/Phosphenius/yoctofetch.git")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0smkaydv74p2231gafibvqbwsy469w56hya8gz8wq0gw7m2l7zh3"))))
+    ; Support for other platforms not available per upstream:
+    ; https://codeberg.org/Phosphenius/yoctofetch#supported-platforms
+    (supported-systems '("x86_64-linux" "aarch64-linux"))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:tests? #f)) ; No tests available.
+    (home-page "https://codeberg.org/Phosphenius/yoctofetch")
+    (synopsis "Fast and low footprint system fetch tool for the Linux UAPI")
+    (description
+     "This package provides a system fetch tool, similar to
+@command{neofetch}, @command{fastfetch}, etc.  It is lightweight and
+has a focus on performance.  It can be used as a greeter by starting
+it from @file{~/.bashrc} for example.")
+    (license license:agpl3+)))
+
 (define-public zzz
  (package
    (name "zzz")
@@ -458,7 +458,7 @@ precision.")
    (inputs
     ;; TODO: Unbundle "libmicropython.a".
     (list ao
-           fltk-1.3
+           fltk
           glpk
           gmp
           gsl
@@ -765,7 +765,7 @@ file system.")
       (sha256
        (base32 "0r3xwk8xsfxvmxyw3d57sy2i9by24g0l1jl40735jiac9mypcg7n"))))
    (build-system pyproject-build-system)
-    (inputs (list python-requests python-argcomplete python-urllib3
+    (propagated-inputs (list python-requests python-argcomplete python-urllib3
                  python-looseversion gnupg))
    (native-inputs (list python-setuptools python-wheel python-requests-cache
                         python-defusedxml))
@@ -773,8 +773,7 @@ file system.")
     (list $SSL_CERT_FILE))
    (arguments
     (list
-      #:test-flags
-      #~(list "-k" "test_*")
+      #:test-backend #~'unittest
      #:phases
      #~(modify-phases %standard-phases
          (add-after 'unpack 'patch-tests
@@ -793,11 +792,7 @@ file system.")
            (lambda _
              (substitute* "sdkmanager.py"
                (("gpgv")
-                 (string-append #$(this-package-input "gnupg") "/bin/gpgv")))))
-          (replace 'check
-            (lambda* (#:key tests? test-flags #:allow-other-keys)
-              (when tests?
-                (apply invoke "python" "-m" "unittest" test-flags)))))))
+                 (string-append #$(this-package-input "gnupg") "/bin/gpgv"))))))))
    (home-page "https://gitlab.com/fdroid/sdkmanager")
    (synopsis "Replacement for Android sdkmanager written in Python")
    (description
@@ -1182,14 +1177,16 @@ for communicating with Xiaomi smart appliances over miIO and MIoT protocols.")
 (define-public fdroidserver
  (package
    (name "fdroidserver")
-    (version "2.4.2")
+    (version "2.4.3")
    (source
     (origin
-       (method url-fetch)
-       (uri (pypi-uri "fdroidserver" version))
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://gitlab.com/fdroid/fdroidserver")
+              (commit version)))
+       (file-name (git-file-name name version))
       (sha256
-        (base32
-         "06xybginrwi5c7bw000wz5s5hzi0aqrxskzwh8qc6wv463w2djax"))))
+        (base32 "1745fqxr2qfrls4wr6x9w1262b9pxmw9yvzd9b71ya2qmj74q17n"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@@ -1200,22 +1197,17 @@ for communicating with Xiaomi smart appliances over miIO and MIoT protocols.")
            (lambda _
              (setenv "HOME" "/tmp"))))))
    (propagated-inputs
-     (list python-androguard
+     (list python-platformdirs
+           python-androguard
           python-apache-libcloud
-           python-argcomplete
           python-asn1crypto
           python-clint
           python-defusedxml
-           python-docker
           python-gitpython
-           python-mwclient
           python-oscrypto
           python-paramiko
           python-pillow
-           python-platformdirs
           python-puremagic
-           python-pyasn1
-           python-pyasn1-modules
           python-pyyaml
           python-qrcode
           python-requests
@@ -238,12 +238,12 @@ contains the graphical user interface for synfig.")
             (when tests?
               (invoke "./tests")))))))
    (native-inputs
-     (list gettext-minimal
-           `(,glib "bin")
-           nasm
-           perl
-           pkg-config
-           python-wrapper))
+     (cons* gettext-minimal
+            `(,glib "bin")
+            perl
+            pkg-config
+            python-wrapper
+            (maybe-nasm)))
    (inputs
     (list cairo
           curl
@@ -2,7 +2,7 @@
 ;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2013, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
-;;; Copyright © 2016, 2020, 2021, 2025 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2020, 2021, 2025, 2026 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017–2022 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Guy Fleury Iteriteka <hoonandon@gmail.com>
 ;;; Copyright © 2019, 2022, 2024 Andy Tai <atai@atai.org>
@@ -43,6 +43,7 @@
  #:use-module ((guix licenses) #:prefix license:)
  #:use-module (guix packages)
  #:use-module (guix gexp)
+  #:use-module (guix utils)
  #:use-module (gnu packages)
  #:use-module (gnu packages admin)
  #:use-module (gnu packages autotools)
@@ -248,6 +249,16 @@ complex.  It supports all currently known x86 architectural extensions, and
 has strong support for macros.")
    (license license:bsd-2)))

+(define* (maybe-nasm #:optional
+                     (system (or (%current-target-system)
+                                 (%current-system))))
+  ;; For some packages nasm is only needed when compiling to/for x86/x86_64.
+  (if (target-x86? system)
+      (list nasm)
+      '()))
+
+(export maybe-nasm)
+
 (define-public yasm
  (package
    (name "yasm")
@@ -1210,7 +1210,7 @@ PulseAudio clients, featuring:
 (define-public ardour
  (package
    (name "ardour")
-    (version "9.1")
+    (version "9.2")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1227,7 +1227,7 @@ PulseAudio clients, featuring:
 namespace ARDOUR { const char* revision = \"" version "\" ; const char* date = \"\"; }")))))
              (sha256
               (base32
-                "00bramm8dq0ihr376n7l9rg0mjzxmzw6lxvsbsdlrdsimfwsy16p"))
+                "14s6cq3x7l7b682ah9k8cdr6plfirlgm882dc2nm51lxwl91zcfd"))
              (file-name (git-file-name name version))))
    (build-system waf-build-system)
    (arguments
@@ -6529,22 +6529,23 @@ on the ALSA software PCM plugin.")
 (define-public snd
  (package
    (name "snd")
-    (version "25.2")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "ftp://ccrma-ftp.stanford.edu/pub/Lisp/"
-                                  "snd-" version ".tar.gz"))
-              (sha256
-               (base32
-                "0fgxqk0byxdj6059mb9d5qic2dqjabz49j0szsrn2y3c9nz6iyq4"))))
+    (version "26.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://ccrma.stanford.edu/software/snd/snd-"
+                           version ".tar.gz"))
+       (sha256
+        (base32
+         "1d573mjlrn9rhl9g0a3d1rkar34q60ln8mwlbibfalpn8lsz59a0"))))
    (build-system gnu-build-system)
    (arguments
     (list
-      #:tests? #f                       ; no tests
-      #:out-of-source? #f               ; for the 'install-doc' phase
+      #:tests? #f                       ; No tests.
+      #:out-of-source? #f               ; Required by 'install-doc'.
      #:configure-flags
-      #~(let ((docdir (string-append #$output "/share/doc/"
-                                     #$name "-" #$version)))
+      #~(let
+            ((docdir (string-append #$output "/share/doc/snd-" #$version)))
          (list "--with-alsa"
                "--with-jack"
                "--with-gmp"
@@ -6552,18 +6553,20 @@ on the ALSA software PCM plugin.")
                (string-append "--with-doc-dir=" docdir)))
      #:phases
      #~(modify-phases %standard-phases
-          (add-after 'install 'install-s7
+          (add-after 'install 'install-s7-h
            (lambda _
-              (install-file "s7.h" (string-append #$output "/include"))))
+              (install-file "s7.h" (string-append #$output
+                                                  "/include"))))
          (add-after 'install 'install-doc
            (lambda _
-              (let ((doc (string-append #$output "/share/doc/"
-                                        #$name "-" #$version)))
+              (let
+                  ((docdir (string-append #$output "/share/doc/snd-"
+                                          #$version)))
                (for-each
                 (lambda (f)
-                   (install-file f doc))
+                   (install-file f docdir))
                 (find-files "." "\\.html$"))
-                (copy-recursively "pix" (string-append doc "/pix"))))))))
+                (copy-recursively "pix" (string-append docdir "/pix"))))))))
    (native-inputs
     (list pkg-config))
    (inputs
@@ -6582,13 +6585,16 @@ on the ALSA software PCM plugin.")
           timidity++
           vorbis-tools
           wavpack))
+    (home-page "https://ccrma.stanford.edu/software/snd/snd/snd.html")
    (synopsis "Sound editor")
-    (home-page "https://ccrma.stanford.edu/software/snd/")
    (description
     "Snd is a sound editor modelled loosely after Emacs.  It can be
 customized and extended using either the s7 Scheme implementation (included in
 the Snd sources), Ruby, or Forth.")
-    (license (license:non-copyleft "file://COPYING"))))
+    (license
+     ;; INFO: pkgsrc classifies this as `esdl-license', a license not included
+     ;; in OSI or FSF lists, despite being similar to ISC.
+     (license:non-copyleft "file://COPYING"))))

 (define-public libspecbleach
  (package
@@ -14,6 +14,7 @@
 ;;; Copyright © 2022 Tomasz Jeneralczyk <tj@schwi.pl>
 ;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2025 Artyom V. Poptsov <poptsov.artyom@gmail.com>
+;;; Copyright © 2026 Sughosha <sughosha@disroot.org>
 ;;; Copyright © 2023 Advanced Micro Devices, Inc.
 ;;;
 ;;; This file is part of GNU Guix.
@@ -41,6 +42,7 @@
  #:use-module (guix amd-gpu)
  #:use-module (guix search-paths)
  #:use-module (guix build-system cmake)
+  #:use-module (guix build-system qt)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system python)
  #:use-module (guix build-system pyproject)
@@ -730,7 +732,7 @@ and options.  With careful benchmarking, different hardware can be compared.")
 (define-public kdiskmark
  (package
    (name "kdiskmark")
-    (version "3.1.4")
+    (version "3.2.0")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -739,14 +741,13 @@ and options.  With careful benchmarking, different hardware can be compared.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1x8vd6swmf0i7f6m6wl2154n6plx8jkmcqfq6zxbdy255f1da74c"))))
-    (build-system cmake-build-system)
+                "161yyy4fcy5bnzhbcd7p90nlcslcsfp7n3m3bz9bygch7bdjw46g"))))
+    (build-system qt-build-system)
    (arguments
     (list
+      #:qtbase qtbase
      #:configure-flags
-      ;; Drop runtime dependency on KDE's KFAuth.
-      #~(list "-DPERFORM_PAGECACHE_CLEARING_USING_KF5AUTH=no"
-              (string-append "-DPOLKITQT-1_INSTALL_DIR=" #$output))
+      #~(list (string-append "-DPOLKITQT-1_INSTALL_DIR=" #$output))
      #:tests? #f                       ;no test suite
      #:phases
      #~(modify-phases %standard-phases
@@ -759,10 +760,10 @@ and options.  With careful benchmarking, different hardware can be compared.")
            (lambda _
              (rmdir "src/singleapplication")
              (symlink #$(package-source
-                          (this-package-input "single-application-qt5"))
+                          (this-package-input "single-application"))
                       "src/singleapplication"))))))
-    (native-inputs (list extra-cmake-modules qttools-5))
-    (inputs (list fio polkit-qt qtbase-5 single-application-qt5))
+    (native-inputs (list extra-cmake-modules qttools))
+    (inputs (list fio polkit-qt6 single-application qtwayland))
    (home-page "https://github.com/JonMagon/KDiskMark")
    (synopsis "Simple disk benchmark tool")
    (description "KDiskMark is an HDD and SSD benchmark tool.  KDiskMark
@@ -913,7 +913,7 @@ suite native in R.")
 (define-public r-bpcells
  (package
    (name "r-bpcells")
-    (version "0.3.0")
+    (version "0.3.1")
    (source
     (origin
       (method git-fetch)
@@ -922,7 +922,7 @@ suite native in R.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "12h1di45fg06nhsliii7v0h1z567pkpis1xm4ar1qr8ns1n8iljw"))
+        (base32 "0yqgcajq83g25mznwcngaw7pi6vcqxqdnynpgb95yci57k3wrp6j"))
       (modules '((guix build utils)))
       (snippet
        '(delete-file-recursively "r/src/vendor/highway"))))
@@ -931,13 +931,15 @@ suite native in R.")
    (arguments
     (list
      #:phases
-      '(modify-phases %standard-phases
+      `(modify-phases %standard-phases
         (add-after 'unpack 'chdir
-           (lambda _
-             (substitute* "r/configure"
-               (("tools/hwy-test.cpp" m)
-                (string-append m " $HWY_LIBS $HWY_CFLAGS")))
-             (chdir "r"))))))
+           (lambda _ (chdir "r")))
+         ,@(if (target-x86-32?)
+               '((add-after 'chdir 'require-sse2
+                   ;; This avoids falling back to the scalar backend in
+                   ;; highway, which fails to build.
+                   (lambda _ (setenv "CFLAGS" "-msse2"))))
+               '()))))
    (propagated-inputs
     (list r-dplyr
           r-ggplot2
@@ -22349,37 +22351,6 @@ combinatorial configurations.\", G. Ehrlich - Journal of the ACM (JACM),
 1973. (Algorithm 7.)")
    (license license:expat)))

-(define-public fsom
-  (let ((commit "a6ef318fbd347c53189384aef7f670c0e6ce89a3"))
-    (package
-      (name "fsom")
-      (version (git-version "0.0.0" "1" commit))
-      (source (origin
-        (method git-fetch)
-        (uri (git-reference
-              (url "https://github.com/ekg/fsom/")
-              (commit commit)))
-        (file-name (git-file-name name version))
-        (sha256
-         (base32 "0gw1lpvr812pywg9y546x0h1hhj261xwls41r6kqhddjlrcjc0pi"))))
-      (build-system gnu-build-system)
-      (arguments
-       `(#:tests? #f ; There are no tests to run.
-         #:phases
-         (modify-phases %standard-phases
-           (delete 'configure) ; There is no configure phase.
-           (replace 'install
-             (lambda* (#:key outputs #:allow-other-keys)
-               (let ((bin (string-append (assoc-ref outputs "out") "/bin")))
-                 (install-file "fsom" bin)))))))
-      (native-inputs
-       (list gcc-6))
-      (home-page "https://github.com/ekg/fsom")
-      (synopsis "Manage SOM (Self-Organizing Maps) neural networks")
-      (description "A tiny C library for managing SOM (Self-Organizing Maps)
-neural networks.")
-      (license license:gpl3))))
-
 (define-public fastahack
  (package
    (name "fastahack")
@@ -328,15 +328,15 @@ with the @uref{https://keepassxc.org, KeePassXC} password manager.")
 (define noscript
  (package
    (name "noscript")
-    (version "13.2.2")
+    (version "13.6.18.1984")
    (source (origin
              (method url-fetch/zipbomb)
              (uri (string-append
-                    "https://noscript.net/download/releases/noscript-" version
-                    ".xpi"))
+                    "https://archive.torproject.org/tor-package-archive/torbrowser/noscript/noscript-"
+                    version ".xpi"))
              (sha256
               (base32
-                "0w2w0a76dk01bkh83mqwgs9ky02rjqk15z5sxg4a6mw0hpr81bpm"))))
+                "0assv8v89hhg302q81vvv7ln3q8k9m6rzjkbprv2j05ghb23kkvm"))))
    (build-system copy-build-system)
    (properties '((addon-id . "{73a6fe31-595d-460b-a920-fcc0f8843232}")))
    (arguments
@@ -275,14 +275,14 @@ generate such a compilation database.")
 (define-public bmake
  (package
    (name "bmake")
-    (version "20260313")
+    (version "20260406")
    (source
     (origin
       (method url-fetch)
       (uri (string-append
             "http://www.crufty.net/ftp/pub/sjg/bmake-" version ".tar.gz"))
       (sha256
-        (base32 "0xgryknmv625idw37rq89mpl5rymwdb15j5w8zxwy1gf8b6z7j3n"))
+        (base32 "09nzd9v12n2pwxmf67056kzjnvxcpk5q2x1fs5qkrsk1ssh5yvpd"))
       (patches (search-patches "bmake-run-check-separately.patch"))))
    (build-system gnu-build-system)
    (inputs
@@ -23,7 +23,7 @@
 ;;; Copyright © 2023, 2024 David Elsing <david.elsing@posteo.net>
 ;;; Copyright @ 2022, Kitzman <kitzman@disroot.org>
 ;;; Copyright @ 2025 Dariqq <dariqq@posteo.net>
-;;; Copyright © 2025 Ashish SHUKLA <ashish.is@lostca.se>
+;;; Copyright © 2025, 2026 Ashish SHUKLA <ashish.is@lostca.se>
 ;;; Copyright © 2026 Cayetano Santos <csantosb@inventati.org>
 ;;; Copyright © 2026 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;;
@@ -1762,7 +1762,7 @@ string.h, but with a utf8* prefix instead of the str* prefix.")
 (define-public simdutf
  (package
    (name "simdutf")
-    (version "7.7.1")
+    (version "9.0.0")
    (source
     (origin
       (method git-fetch)
@@ -1771,7 +1771,7 @@ string.h, but with a utf8* prefix instead of the str* prefix.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0kw4j4qqcfjaii667xa745pklj50m70nqq8cj5agj714acczbk7y"))))
+        (base32 "0f5ccvqj7pfa69m9y1kxp2v1lybx6x8i9pykdqfkr7dydqbhrhx6"))))
    (build-system cmake-build-system)
    (arguments (list #:configure-flags #~(list "-DBUILD_SHARED_LIBS=ON")))
    (synopsis "SIMD Unicode validation and transcoding")
@@ -3131,7 +3131,7 @@ time by mocking the datetime module.")
 (define-public python-flaky
  (package
    (name "python-flaky")
-    (version "3.8.1")
+    (version "3.8.1")  ; On bump, remove some skipped tests in python-cherrypy.
    (source (origin
              (method url-fetch)
              (uri (pypi-uri "flaky" version))
@@ -3719,30 +3719,6 @@ system.  The code under test requires no modification to work with pyfakefs.")
 directories and files.")
    (license license:expat)))

-(define-public python-pytest-tornado5
-  (package
-    (name "python-pytest-tornado5")
-    (version "2.0.0")
-    (source (origin
-              (method url-fetch)
-              (uri (pypi-uri "pytest-tornado5" version))
-              (sha256
-               (base32
-                "0qb62jw2w0xr6y942yp0qxiy755bismjfpnxaxjjm05gy2pymr8d"))))
-    (build-system pyproject-build-system)
-    (arguments
-     ;; Tests require pytest < 6
-     (list #:tests? #f))
-    (propagated-inputs (list python-pytest python-tornado))
-    (native-inputs (list python-setuptools python-wheel))
-    (home-page "https://github.com/vidartf/pytest-tornado")
-    (synopsis
-     "Fixtures and markers to simplify testing of Tornado applications")
-    (description
-     "This package provides a @code{py.test} plugin supplying fixtures and
-markers to simplify testing of asynchronous tornado applications.")
-    (license license:asl2.0)))
-
 (define-public guile-proba
  (package
    (name "guile-proba")
@@ -580,7 +580,7 @@ stored with user-specified precision.")
           python-sphinx))
    (inputs
     (list fftwf
-           `(,hwloc-2 "lib")
+           `(,hwloc "lib")
           libtirpc
           lmfit
           muparser
@@ -400,7 +400,7 @@
  ;; run the Blink performance tests, just remove everything to save ~70MiB.
  '("third_party/blink/perf_tests"))

-(define %chromium-version "147.0.7727.55")
+(define %chromium-version "147.0.7727.137")
 (define %ungoogled-revision (string-append %chromium-version "-1"))
 (define %debian-revision (string-append "debian/" %ungoogled-revision))

@@ -412,7 +412,7 @@
    (file-name (git-file-name "ungoogled-chromium" %ungoogled-revision))
    (sha256
     (base32
-      "0l6v4wf16067igawjlh90f3d287mkw0cq4j5lvrxxy17y1skynzc"))))
+      "1ha84j3zckdv2l8dpicqhmr6a8mq3bqwalw0bmgamvlmns9i7nrj"))))

 (define %debian-origin
  (origin
@@ -425,7 +425,7 @@
                                ((_ version) version))))
    (sha256
     (base32
-      "0gqarll08i7rcs1amapciv263xvzglc8p44ikavq3xd12yyvcd98"))))
+      "04lqbclkvn9nsksgjpjilh78a8y17mwwq4pmhr6h8gvpp2y3bhhc"))))

 (define (origin-file origin file)
  (computed-file
@@ -570,7 +570,7 @@
                                  %chromium-version "-lite.tar.xz"))
              (sha256
               (base32
-                "1salvlw5sykx3zmsbp7cgmf7y8yy6jlgb4b4zswzsbjrprk4jnap"))
+                "1m22whg5n9lw9gqhalm95jwfm45lqp4a7cs3mn3f4n8w0rvr0r5j"))
              (modules '((guix build utils)))
              (snippet (force ungoogled-chromium-snippet))))
    (build-system gnu-build-system)
@@ -596,6 +596,7 @@
              "use_custom_libcxx=false" ; support for this is deprecated and to be removed.
              "optimize_webui=false"
              "webnn_use_tflite=false"
+              "build_tflite_with_xnnpack=false"
              "safe_browsing_use_unrar=false"
              "chrome_pgo_phase=0"
              "use_sysroot=false"
@@ -688,7 +689,7 @@
              "use_gnome_keyring=false" ;deprecated by libsecret
              "use_pulseaudio=true"
              "link_pulseaudio=true"
-              "icu_use_data_file=false"
+              "icu_use_data_file=true"

              ;; VA-API acceleration is currently only supported on x86_64-linux.
              #$@(if (string-prefix? "x86_64" (or (%current-target-system)
@@ -696,6 +697,13 @@
                     '("use_vaapi=true")
                     '())

+              #$@(if (string-prefix? "aarch64" (or (%current-target-system)
+                                                   (%current-system)))
+                     '("use_v4l2_codec=true"
+                       "use_vaapi=false"
+                       "use_av1_hw_decoder=true")
+                     '())
+
              ;; Do not artificially restrict formats supported by system ffmpeg.
              "proprietary_codecs=true"
              "ffmpeg_branding=\"Chrome\""
@@ -769,12 +777,7 @@
                   (string-append libclang "clang_base_path"))
                  (("(_rustfmt_path = \")\\$\\{rust_bindgen_root\\}" _ rustfmt)
                   (string-append rustfmt "${rust_sysroot_absolute}"))))))
-          (add-after 'patch-stuff 'include-pthreadpool
-            ;; FIXME: Somehow the build system cannot locate this header.
-            (lambda _
-              (copy-file "third_party/pthreadpool/src/include/pthreadpool.h"
-                         "pthreadpool.h")))
-          (add-after 'include-pthreadpool 'add-absolute-references
+          (add-after 'patch-stuff 'add-absolute-references
            (lambda* (#:key inputs #:allow-other-keys)
              (let ((cups-config (search-input-file inputs "/bin/cups-config"))
                    (libnssckbi.so (search-input-file inputs
@@ -892,6 +895,7 @@
                                       "resources.pak"
                                       "v8_context_snapshot.bin"
                                       "chrome_crashpad_handler"
+                                       "icudtl.dat"

                                       ;; Swiftshader ICD.
                                       "libvk_swiftshader.so"
@@ -914,9 +918,11 @@

                (substitute* '("chrome/app/resources/manpage.1.in"
                               "chrome/installer/linux/common/desktop.template")
-                  (("@@MENUNAME@@") "Chromium")
-                  (("@@PACKAGE@@") "chromium")
-                  (("/usr/bin/@@USR_BIN_SYMLINK_NAME@@") exe))
+                  (("@@MENUNAME") "Chromium")
+                  (("@@PACKAGE") "chromium")
+                  (("/usr/bin/@@usr_bin_symlink_name") exe)
+                  (("@@uri_scheme") "x-scheme-handler/chromium")
+                  (("@@extra_desktop_entries") ""))

                (mkdir-p man)
                (copy-file "chrome/app/resources/manpage.1.in"
@@ -18,10 +18,10 @@

 ;;; This module is separate from (gnu packages rust-apps) to avoid a
 ;;; circular module dependency: (gnu packages rust-sources), which
-;;; defines rust-codex-0.98.0, transitively loads (gnu packages
+;;; defines rust-codex-0.124.0, transitively loads (gnu packages
 ;;; rust-apps) through its #:use-module chain.  If the codex package
 ;;; lived in rust-apps.scm, loading rust-sources would trigger loading
-;;; rust-apps before rust-codex-0.98.0 is defined, causing an unbound
+;;; rust-apps before rust-codex-0.124.0 is defined, causing an unbound
 ;;; variable error.

 (define-module (gnu packages codex)
@@ -36,33 +36,46 @@
  #:use-module (gnu packages base)
  #:use-module (gnu packages cmake)
  #:use-module (gnu packages compression)
+  #:use-module (gnu packages linux)
  #:use-module (gnu packages libunwind)
  #:use-module (gnu packages llvm)
+  #:use-module (gnu packages lsof)
  #:use-module (gnu packages perl)
  #:use-module (gnu packages pkg-config)
  #:use-module (gnu packages python)
  #:use-module (gnu packages rust-sources)
  #:use-module (gnu packages sqlite)
+  #:use-module (gnu packages textutils)
+  #:use-module (gnu packages nss)
  #:use-module (gnu packages tls)
-  #:use-module (gnu packages version-control))
+  #:use-module (gnu packages version-control)
+  #:use-module (gnu packages virtualization))

 (define-public codex
  (package
    (name "codex")
-    (version (package-version rust-codex-0.98.0))
+    (version (package-version rust-codex-0.124.0))
    (source
     (origin
-       (inherit (package-source rust-codex-0.98.0))
+       (inherit (package-source rust-codex-0.124.0))
       (patches (search-patches
-                 "codex-0.98.0-remove-patch-sections.patch"
+                 "codex-acp-0.11.1-disable-code-mode.patch"
+                 "rust-codex-0.124.0-code-mode-stub-toolname.patch"
+                 "rust-codex-0.124.0-remove-patch-sections.patch"
+                 "rust-codex-0.120.0-remove-libwebrtc.patch"
                 "rust-codex-0.98.0-test-shebangs.patch"
-                 "rust-codex-0.98.0-test-timeout.patch"))))
+                 "rust-codex-0.120.0-test-timeout.patch"))))
    (build-system cargo-build-system)
    (arguments
     (list
      #:install-source? #f
-      #:cargo-install-paths '(list "cli" "exec" "exec-server"
-                                   "linux-sandbox" "mcp-server" "network-proxy"
+      ;; exec-server is library-only in 0.124 (no [[bin]] in
+      ;; exec-server/Cargo.toml); cargo install --path exec-server fails
+      ;; with "no packages found with binaries or examples".  Drop it
+      ;; from the install paths -- the library is consumed via the
+      ;; workspace by other binaries here, not installed standalone.
+      #:cargo-install-paths '(list "cli" "exec"
+                                   "linux-sandbox" "mcp-server"
                                   "app-server" "tui")
      ;; schema_fixtures_match_generated (upstream fixture is stale:
      ;; FileChange::Update in codex-protocol gained old_content,
@@ -71,72 +84,55 @@
      #:cargo-test-flags '(list "--workspace"
                                "--exclude" "codex-app-server-protocol"
                                "--"
-                                ;; These tests exercise sandbox denial and
-                                ;; escalation, which requires Landlock to
-                                ;; cleanly deny filesystem access.  Inside the
-                                ;; build container Landlock returns NotEnforced
-                                ;; and the sandbox binary panics instead.
-                                ;; Disabling Landlock would not help either,
-                                ;; since these tests need a working sandbox to
-                                ;; have anything to deny and escalate.
+                                ;;; BEGIN Landlock returns NotEnforced
+                                ;;; in the build container; the sandbox
+                                ;;; binary panics instead of cleanly
+                                ;;; denying filesystem access.
+                                ;; Sandbox denial and escalation tests.
                                "--skip" "sandbox_denied_shell_returns_original_output"
+                                ;; Sandbox denial and escalation tests.
                                "--skip" "shell_escalated_permissions_rejected_then_ok"
+                                ;; Sandbox denial and escalation tests.
                                "--skip" "unified_exec_runs_under_sandbox"
-                                ;; These tests (in codex-exec) directly call
-                                ;; spawn_command_under_linux_sandbox to verify
-                                ;; that python and bash work correctly inside
-                                ;; the Landlock sandbox.  The sandbox binary
-                                ;; (codex-exec) panics with LandlockRestrict
-                                ;; (exit code 101) before the inner command
-                                ;; even starts.
+                                ;; codex-exec: spawn_command_under_linux_sandbox
+                                ;; panics with LandlockRestrict (exit 101).
                                "--skip" "python_getpwuid_works_under_sandbox"
+                                ;; Same as above.
                                "--skip" "python_multiprocessing_lock_works_under_sandbox"
+                                ;; Same as above.
                                "--skip" "sandbox_distinguishes_command_and_policy_cwds"
-                                ;; These linux-sandbox tests directly invoke
-                                ;; the Landlock sandbox via
-                                ;; process_exec_tool_call; same root cause.
+                                ;; linux-sandbox: process_exec_tool_call
+                                ;; invokes Landlock; same panic.
                                "--skip" "test_writable_root"
+                                ;; Same as above.
                                "--skip" "test_timeout"
+                                ;; Same as above.
                                "--skip" "test_root_read"
+                                ;; Same as above.
                                "--skip" "test_dev_null_write"
+                                ;; Same as above.
                                "--skip" "test_no_new_privs_is_enabled"
-                                ;; This test iterates many approval scenarios;
-                                ;; one of them
-                                ;; (danger_full_access_on_request_allows_network)
-                                ;; runs a command through the Landlock sandbox
-                                ;; binary, which panics with LandlockRestrict
-                                ;; inside the build container.  Cargo --skip
-                                ;; cannot target individual scenarios, so we
-                                ;; skip the entire matrix.
+                                ;; One scenario runs through Landlock
+                                ;; which panics; cargo --skip cannot
+                                ;; target individual scenarios.
                                "--skip" "approval_matrix_covers_all_modes"
-                                ;; This test verifies session-level patch
-                                ;; approval caching: approve once, skip
-                                ;; future prompts for the same file.  When
-                                ;; Landlock is unavailable (as in the Guix
-                                ;; build container) the sandbox binary panics,
-                                ;; triggering the escalation-retry path, which
-                                ;; interferes with the approval cache and
-                                ;; causes a spurious re-prompt on the second
-                                ;; patch.
+                                ;; Landlock panic triggers escalation-retry
+                                ;; which interferes with the approval cache.
                                "--skip" "approving_apply_patch_for_session_skips_future_prompts_for_same_file"
                                ;; These tests expect to interrupt a
                                ;; long-running 'sleep 60' and receive
-                                ;; TurnAborted.  Default test config is
-                                ;; OnRequest + ReadOnly.  What happens:
+                                ;; TurnAborted.  What happens:
                                ;;
                                ;; 1. ReadOnly wraps the command with
                                ;;    codex-linux-sandbox (Landlock-based).
-                                ;; 2. Landlock is unavailable in the Guix
-                                ;;    build container, so the sandbox
-                                ;;    binary exits instantly (~1 ms).
+                                ;; 2. Landlock is unavailable, so the
+                                ;;    sandbox binary exits instantly.
                                ;; 3. Orchestrator gets SandboxErr::Denied.
                                ;;    wants_no_sandbox_approval(OnRequest)
-                                ;;    returns false (sandboxing.rs:222),
-                                ;;    so no escalation -- denial returned
-                                ;;    directly.
+                                ;;    returns false, so no escalation --
+                                ;;    denial returned directly.
                                ;; 4. ToolEmitter::finish sends the error
-                                ;;    to the mock model as
-                                ;;    function_call_output.
+                                ;;    to the mock model.
                                ;; 5. Second mock SSE response fires,
                                ;;    turn finishes with TurnComplete.
                                ;; 6. Op::Interrupt arrives 100 ms later,
@@ -150,74 +146,370 @@
                                ;; has only one mock response (so the turn
                                ;; cannot complete first).
                                "--skip" "interrupt_persists_turn_aborted_marker_in_next_request"
+                                ;; Same causal chain as above.
                                "--skip" "interrupt_tool_records_history_entries"
-                                ;; Upstream bug: test hardcodes "0.0.0" in the
-                                ;; expected user-agent string but the workspace
-                                ;; version is "0.98.0".
-                                "--skip" "get_user_agent_returns_current_codex_user_agent"
-                                ;; Same upstream bug: mcp-server tests
-                                ;; check the initialize response which
-                                ;; includes "version": "0.0.0" but the
-                                ;; server returns "0.98.0".
+                                ;; WorkspaceWrite sandbox policy wraps
+                                ;; commands with codex-linux-sandbox;
+                                ;; Landlock panics, command never runs,
+                                ;; exit_code is None instead of Some(0).
+                                "--skip" "request_permissions_grants_apply_to_later_exec_command_calls"
+                                ;; Same root cause.
+                                "--skip" "request_permissions_grants_apply_to_later_shell_command_calls"
+                                ;; Same root cause.
+                                "--skip" "partial_request_permissions_grants_do_not_preapprove_new_permissions"
+                                ;;; END Landlock
+                                ;;; BEGIN mcp_process.rs initialize
+                                ;;; assertion expects "version":"0.0.0"
+                                ;;; but the server returns "0.120.0".
                                "--skip" "test_codex_tool_passes_base_instructions"
                                "--skip" "test_shell_command_approval_triggers_elicitation"
                                "--skip" "test_patch_approval_triggers_elicitation"
-                                ;; These codex-exec-server tests need
-                                ;; "dotslash", a Meta tool that lazily
-                                ;; downloads pre-built binaries from a
-                                ;; JSON manifest.  The test helper
-                                ;; create_transport runs
-                                ;; `dotslash -- fetch <path>` to obtain a
-                                ;; custom bash binary described in
-                                ;; exec-server/tests/suite/bash.
-                                ;; dotslash is not available in the build
-                                ;; container.
-                                "--skip" "list_tools"
-                                "--skip" "accept_elicitation_for_prompt_rule"
-                                ;;; Test isolation bug: each test in
-                                ;;; state/src/runtime.rs calls
-                                ;;; unique_temp_dir() to get its own
-                                ;;; temporary directory (and thus its
-                                ;;; own SQLite database).  That function
-                                ;;; names directories using the current
-                                ;;; nanosecond timestamp, so when tests
-                                ;;; run in parallel several can receive
-                                ;;; the same name and open the same
-                                ;;; database.  The initial SQLite
-                                ;;; migration runs CREATE TABLE threads
-                                ;;; (without IF NOT EXISTS), so any init
-                                ;;; after the first panics with "table
-                                ;;; threads already exists".  Any of
-                                ;;; these tests
-                                ;;; can be the victim.
+                                ;;; END version mismatch
+                                ;;; BEGIN Test isolation bug:
+                                ;;; unique_temp_dir() in
+                                ;;; state/src/runtime.rs names dirs
+                                ;;; using nanosecond timestamps, so
+                                ;;; parallel tests can collide.  The
+                                ;;; SQLite migration runs CREATE TABLE
+                                ;;; threads (without IF NOT EXISTS),
+                                ;;; so the second init panics with
+                                ;;; "table threads already exists".
                                "--skip" "init_removes_legacy_state_db_files"
                                "--skip" "upsert_and_get_thread_memory"
                                "--skip" "get_last_n_thread_memories_for_cwd_matches_exactly"
                                "--skip" "upsert_thread_memory_errors_for_unknown_thread"
                                "--skip" "get_last_n_thread_memories_for_cwd_zero_returns_empty"
                                "--skip" "get_last_n_thread_memories_for_cwd_does_not_prefix_match"
-                                "--skip" "deleting_thread_cascades_thread_memory")
+                                "--skip" "deleting_thread_cascades_thread_memory"
+                                ;;; END SQLite test isolation
+                                ;; The test spawns 'sh' after
+                                ;; env_clear() with an empty env map;
+                                ;; glibc execvp uses confstr(_CS_PATH)
+                                ;; ("/bin:/usr/bin") when PATH is
+                                ;; unset, but /bin/sh does not exist
+                                ;; in the build container.
+                                "--skip" "cancellation_expiration_keeps_process_alive_until_terminated"
+                                ;; Proxy baseline_policy returns 403
+                                ;; "not_allowed_local" for example.com;
+                                ;; test expects 200.
+                                "--skip" "managed_network_proxy_decider_survives_full_access_start"
+                                ;;; BEGIN bash_snapshot_script() uses
+                                ;;; "compgen -e" to list exports but
+                                ;;; bash-minimal lacks programmable
+                                ;;; completion; export section is empty.
+                                ;; stdout.contains("VALID_NAME") fails.
+                                "--skip" "bash_snapshot_filters_invalid_exports"
+                                ;; stdout.contains("MULTILINE_CERT") fails.
+                                "--skip" "bash_snapshot_preserves_multiline_exports"
+                                ;; snapshot.contains("PATH") fails.
+                                "--skip" "linux_bash_snapshot_includes_sections"
+                                ;;; END compgen
+                                ;; substitute* patches PAGER to store
+                                ;; path of cat; test expects bare "cat".
+                                "--skip" "unified_exec_env_injects_defaults"
+                                ;;; BEGIN V8 disabled (codex-code-mode
+                                ;;; default-features = false).
+                                "--skip" "suite::code_mode::"
+                                "--skip" "suite::js_repl::"
+                                "--skip" "suite::view_image::js_repl_"
+                                ;;; END V8 disabled
+                                ;;; BEGIN same compgen root cause:
+                                ;;; assert_posix_snapshot_sections
+                                ;;; asserts snapshot.contains("PATH").
+                                "--skip" "linux_shell_command_uses_shell_snapshot"
+                                "--skip" "linux_unified_exec_uses_shell_snapshot"
+                                "--skip" "shell_command_snapshot_still_intercepts_apply_patch"
+                                ;;; END compgen / shell snapshot
+                                ;;; BEGIN These sandbox tests set
+                                ;;; exclude_slash_tmp: true which makes
+                                ;;; bwrap exclude /tmp from its mount
+                                ;;; namespace.  Since Guix builds under
+                                ;;; /tmp, the codex-linux-sandbox binary
+                                ;;; becomes invisible to bwrap even though
+                                ;;; the test adds the helper dir as a
+                                ;;; filesystem carve-out -- the parent /tmp
+                                ;;; bind-mount is absent so the carve-out
+                                ;;; has nothing to carve out of.
+                                "--skip" "sandbox_reenables_writable_subpaths_under_unreadable_parents"
+                                "--skip" "managed_proxy_mode_routes_through_bridge_and_blocks_direct_egress"
+                                ;;; END exclude_slash_tmp
+                                ;; Expects 3 TerminalInteraction events
+                                ;; across timed poll windows; under CPU
+                                ;; contention events merge into 2.
+                                "--skip" "unified_exec_terminal_interaction_captures_delayed_output"
+                                ;;; BEGIN assert_parallel_duration
+                                ;;; requires < 1600 ms for parallel ops.
+                                ;; Two 300 ms test_sync_tool calls.
+                                "--skip" "read_file_tools_run_in_parallel"
+                                ;; Two "sleep 0.25" shell commands.
+                                "--skip" "shell_tools_run_in_parallel"
+                                ;; One test_sync_tool + one shell sleep.
+                                "--skip" "mixed_parallel_tools_run_in_parallel"
+                                ;;; END assert_parallel_duration
+                                ;; Asserts elapsed >= 4500 ms and
+                                ;; < 5800 ms for a 5 s timeout; under
+                                ;; contention elapsed drifts past 5800.
+                                "--skip" "remote_models_request_times_out_after_5s"
+                                ;; Queued inter-agent mail must be
+                                ;; injected between the reasoning/
+                                ;; commentary item and the gate release;
+                                ;; under contention the gate fires before
+                                ;; the mail is processed, so the snapshot
+                                ;; shows the stale function_call instead
+                                ;; of the expected mail message.
+                                "--skip" "queued_inter_agent_mail_triggers_follow_up_after_commentary_message_item"
+                                ;; Same root cause: snapshot mismatch at
+                                ;; pending_input.rs assert_two_responses_
+                                ;; input_snapshot; expects mail at position
+                                ;; 04 but gets function_call/shell instead.
+                                "--skip" "queued_inter_agent_mail_triggers_follow_up_after_reasoning_item"
+                                ;;; BEGIN DNS for hostnames like
+                                ;;; example.com fails in the build
+                                ;;; sandbox.  host_resolves_to_non_
+                                ;;; public_ip() in runtime.rs treats
+                                ;;; failed DNS as non-public and
+                                ;;; returns NotAllowedLocal, so tests
+                                ;;; expecting Allowed or Decider get
+                                ;;; Deny/BaselinePolicy instead.
+                                "--skip" "host_blocked_requires_allowlist_match"
+                                "--skip" "add_allowed_domain_removes_matching_deny_entry"
+                                "--skip" "host_blocked_subdomain_wildcards_exclude_apex"
+                                "--skip" "host_blocked_global_wildcard_allowlist_allows_public_hosts_except_denylist"
+                                "--skip" "evaluate_host_policy_emits_domain_event_for_decider_ask"
+                                "--skip" "evaluate_host_policy_emits_domain_event_for_decider_allow_override"
+                                "--skip" "http_connect_accept_blocks_in_limited_mode"
+                                "--skip" "http_connect_accept_allows_allowlisted_host_in_full_mode"
+                                "--skip" "mitm_policy_blocks_disallowed_method_and_records_telemetry"
+                                ;;; END DNS failure / NotAllowedLocal
+                                ;;; BEGIN Flaky: wiremock mock expects
+                                ;;; 1 POST to /codex/safety/arc but
+                                ;;; receives 0.  Passes in some builds,
+                                ;;; fails in others with identical code
+                                ;;; and env.  The identical custom_
+                                ;;; variant always passes; only the
+                                ;;; CODEX_APPS_MCP_SERVER_NAME variant
+                                ;;; flakes, suggesting a timing race
+                                ;;; in the async POST under contention.
+                                "--skip" "approve_mode_blocks_when_arc_returns_interrupt_for_model"
+                                "--skip" "approve_mode_blocks_when_arc_returns_interrupt_without_annotations"
+                                ;;; END ARC monitor flake
+                                ;;; BEGIN nss-certs sets SSL_CERT_FILE
+                                ;;; which makes build_reqwest_client load
+                                ;;; 171 CA certs via add_root_certificate.
+                                ;;; This changes the reqwest TLS backend
+                                ;;; configuration; the ARC safety POST to
+                                ;;; the localhost mock server never arrives
+                                ;;; (wiremock expects 1 request, gets 0).
+                                "--skip" "approve_mode_blocks_when_arc_returns_interrupt_for_model"
+                                "--skip" "approve_mode_blocks_when_arc_returns_interrupt_without_annotations"
+                                ;;; END nss-certs / ARC monitor
+                                ;; Upstream bug: JsonRpcConnection has
+                                ;; no websocket keepalive or read timeout.
+                                ;; When the exec-server is killed, the
+                                ;; client's reader task blocks on
+                                ;; websocket_reader.next() forever because
+                                ;; TCP doesn't detect the dead peer without
+                                ;; a write or keepalive probe.  Previously
+                                ;; masked because empty env made "sleep 10"
+                                ;; fail instantly; with PATH the process
+                                ;; lives long enough to hit the deadlock.
+                                "--skip" "remote_exec_process_reports_transport_disconnect"
+                                ;; 500 ms timeout on MCP list response
+                                ;; (mcp_server_status.rs timeout at
+                                ;; Duration::from_millis(500)).  With
+                                ;; nss-certs TLS now works, so the
+                                ;; startup plugin sync HTTP requests
+                                ;; (chatgpt.com, api.github.com) wait
+                                ;; for TCP timeout instead of failing
+                                ;; instantly at TLS, eating the budget.
+                                "--skip" "mcp_server_status_list_tools_and_auth_only_skips_slow_inventory_calls"
+                                ;;; BEGIN Stack overflow in 'current_thread'
+                                ;;; tokio runtime.  The sibling tests in
+                                ;;; tracing_tests.rs use the local helper
+                                ;;; run_current_thread_test_with_stack
+                                ;;; (4 MiB) but this one uses bare
+                                ;;; #[tokio::test] on the 2 MiB default
+                                ;;; test-thread stack, and TurnStart's
+                                ;;; future graph exceeds it.  With
+                                ;;; RUST_MIN_STACK raised the overflow is
+                                ;;; gone but the test then deterministically
+                                ;;; times out waiting for a span tagged
+                                ;;; codex.op = "user_input" on the remote
+                                ;;; trace that upstream never emits on that
+                                ;;; trace in our environment.
+                                "--skip" "turn_start_jsonrpc_span_parents_core_turn_spans"
+                                ;;; END tracing test stack/timeout
+                                ;;; BEGIN The upstream loader resolves the
+                                ;;; MCP OAuth credentials store mode by
+                                ;;; calling
+                                ;;; resolve_mcp_oauth_credentials_store_mode
+                                ;;; with env!("CARGO_PKG_VERSION") -- which
+                                ;;; in the released 0.124.0 tarball is
+                                ;;; "0.124.0".  These fixture tests
+                                ;;; construct the expected Config by
+                                ;;; passing the LOCAL_DEV_BUILD_VERSION
+                                ;;; constant ("0.0.0") to the same
+                                ;;; resolver, and the resolver only returns
+                                ;;; File for "0.0.0" -- Auto otherwise.
+                                ;;; Upstream CI builds from a checkout
+                                ;;; still carrying version = "0.0.0" so the
+                                ;;; tests pass there; they cannot pass
+                                ;;; against a released tag.
+                                "--skip" "test_precedence_fixture_with_gpt3_profile"
+                                "--skip" "test_precedence_fixture_with_gpt5_profile"
+                                "--skip" "test_precedence_fixture_with_o3_profile"
+                                "--skip" "test_precedence_fixture_with_zdr_profile"
+                                ;;; END LOCAL_DEV_BUILD_VERSION fixture mismatch
+                                ;;; BEGIN Verifies that Codex's user-shell
+                                ;;; spawn produces a child where
+                                ;;; CODEX_SANDBOX_NETWORK_DISABLED is unset
+                                ;;; (asserts stdout == "not-set").  We
+                                ;;; deliberately set that env var at the
+                                ;;; check phase to trigger upstream's
+                                ;;; skip_if_no_network! guards; the var then
+                                ;;; leaks into the spawned shell and the
+                                ;;; assertion fails.  The guix skip is a
+                                ;;; direct cost of the network-gate fix --
+                                ;;; trading one broken test for two that
+                                ;;; now skip cleanly.
+                                "--skip" "user_shell_command_does_not_set_network_sandbox_env_var"
+                                ;;; END CODEX_SANDBOX_NETWORK_DISABLED leak
+                                ;;; BEGIN The exec-server/tests/file_system
+                                ;;; integration tests invoke the real
+                                ;;; system bwrap, which tries to execvp the
+                                ;;; test binary at the cargo target path
+                                ;;; under the build dir.  Same root cause
+                                ;;; as the existing
+                                ;;; sandbox_reenables_writable_subpaths_under_unreadable_parents
+                                ;;; skip: guix builds live under /tmp but
+                                ;;; bwrap's mount namespace excludes /tmp,
+                                ;;; making the binary invisible inside the
+                                ;;; namespace.
+                                "--skip" "file_system_copy_preserves_symlink_source"
+                                "--skip" "file_system_copy_rejects_symlink_escape_destination"
+                                "--skip" "file_system_copy_rejects_symlink_escape_source"
+                                "--skip" "file_system_create_directory_rejects_symlink_escape"
+                                "--skip" "file_system_read_directory_rejects_symlink_escape"
+                                "--skip" "file_system_remove_rejects_symlink_escape"
+                                "--skip" "file_system_remove_removes_symlink_not_target"
+                                "--skip" "file_system_sandboxed_read_allows_readable_root"
+                                "--skip" "file_system_sandboxed_read_rejects_symlink_escape"
+                                "--skip" "file_system_sandboxed_read_rejects_symlink_parent_dotdot_escape"
+                                "--skip" "file_system_sandboxed_write_allows_additional_write_root"
+                                "--skip" "file_system_sandboxed_write_rejects_symlink_escape"
+                                "--skip" "file_system_sandboxed_write_rejects_unwritable_path"
+                                ;;; END bwrap-cant-see-/tmp file_system tests
+                                ;;; BEGIN Landlock is unavailable on Guix,
+                                ;;; so the sandbox cannot deny network
+                                ;;; syscalls.  These tests expect
+                                ;;; SandboxErr::Denied for the nc, ping,
+                                ;;; ssh, getent, and dev_tcp_redirection
+                                ;;; commands but those commands instead
+                                ;;; block on connect() until the test's 2s
+                                ;;; timeout fires (Timeout, exit 124).
+                                ;;; Same root cause as the Landlock skips
+                                ;;; at the top of this list; new test names
+                                ;;; in 0.124.
+                                "--skip" "sandbox_blocks_nc"
+                                "--skip" "sandbox_blocks_ping"
+                                "--skip" "sandbox_blocks_dev_tcp_redirection"
+                                "--skip" "sandbox_blocks_getent"
+                                "--skip" "sandbox_blocks_ssh"
+                                ;;; END Landlock network block
+                                ;;; BEGIN Requires github.com network access.
+                                ;;; With no "extraKnownMarketplaces" entry
+                                ;;; in settings.json,
+                                ;;; collect_marketplace_import_sources
+                                ;;; inserts a fallback entry for the
+                                ;;; "claude-plugins-official" marketplace
+                                ;;; pointing at the github shorthand
+                                ;;; "anthropics/claude-plugins-official".
+                                ;;; add_marketplace -> parse_marketplace_source
+                                ;;; expands that to a github.com/.git URL
+                                ;;; and clone_git_source runs 'git clone'.
+                                ;;; The Guix build sandbox has no network,
+                                ;;; so the clone fails and the marketplace
+                                ;;; lands in failed_marketplaces.  No mock
+                                ;;; cloner is injected via
+                                ;;; ExternalAgentConfigService::new_for_test,
+                                ;;; so there is no in-tree way to satisfy
+                                ;;; the test offline.
+                                "--skip" "import_plugins_infers_claude_official_marketplace_when_missing_from_settings"
+                                ;;; END github.com network access
+                                ;;; BEGIN Async race between the rollout
+                                ;;; writer task and a direct SQLite read.
+                                ;;; The test calls
+                                ;;; update_memory_settings_with_app_server,
+                                ;;; which routes through the in-memory
+                                ;;; thread path on the app-server's
+                                ;;; ThreadMemoryModeSet handler ->
+                                ;;; Session::set_thread_memory_mode ->
+                                ;;; persist_thread_memory_mode_update,
+                                ;;; which writes a RolloutItem::SessionMeta
+                                ;;; with the new mode to the rollout file
+                                ;;; via recorder.record_items + flush.  The
+                                ;;; rollout writer task then asynchronously
+                                ;;; calls sync_thread_state_after_write,
+                                ;;; which calls state_db::apply_rollout_items
+                                ;;; to mirror the SessionMeta into SQLite.
+                                ;;; flush() only awaits the rollout-file
+                                ;;; write, not the subsequent SQLite sync.
+                                ;;; The test opens a fresh StateRuntime and
+                                ;;; reads get_thread_memory_mode
+                                ;;; immediately, so it observes the creation
+                                ;;; default of "enabled" written by
+                                ;;; upsert_thread_with_creation_memory_mode
+                                ;;; instead of the new "disabled".  Upstream
+                                ;;; CI wins this race; we lose.
+                                "--skip" "update_memory_settings_updates_current_thread_memory_mode"
+                                ;;; END memory-mode rollout/sqlite race
+                                ;;; BEGIN The Stopwatch::new constructor in
+                                ;;; codex_shell_escalation anchors
+                                ;;; T0 = Instant::now() at construction;
+                                ;;; the spawned cancellation task fires at
+                                ;;; T0 + limit.  The test captures
+                                ;;; start = Instant::now() at T1 > T0 (after
+                                ;;; cancellation_token() returns) and
+                                ;;; asserts start.elapsed() >= limit,
+                                ;;; i.e. (T0 + limit) - T1 >= limit, which
+                                ;;; is always false by the offset T1 - T0.
+                                ;;; The test only passes when scheduler
+                                ;;; jitter on the sleep wakeup happens to
+                                ;;; exceed that offset.  Upstream wins the
+                                ;;; race; we don't always.
+                                "--skip" "cancellation_receiver_fires_after_limit"
+                                ;;; END Stopwatch construction/start offset race
+                                )
      #:cargo-package-crates
      ''(;;; Tier 0: No internal deps.
+         "codex-ansi-escape"
         "codex-async-utils"
+         "codex-backend-openapi-models"
         "codex-client"
         "codex-execpolicy"
         "codex-file-search"
-         "codex-git"
+         "codex-git-utils"
         "codex-keyring-store"
+         "codex-process-hardening"
         "codex-utils-absolute-path"
         "codex-utils-cache"
         "codex-utils-cargo-bin"
+         "codex-utils-elapsed"
+         "codex-utils-fuzzy-match"
         "codex-utils-home-dir"
         "codex-utils-json-to-toml"
+         "codex-utils-path"
+         "codex-utils-plugins"
         "codex-utils-pty"
         "codex-utils-readiness"
+         "codex-utils-rustls-provider"
+         "codex-utils-sleep-inhibitor"
+         "codex-utils-stream-parser"
         "codex-utils-string"
-         "codex-backend-openapi-models"
-         "codex-process-hardening"
-         "codex-ansi-escape"
-         ;;; Tier 1: Depends on tier 0.
+         "codex-utils-template"
+         ;;; Tier 1.
         "codex-utils-image"
+         "codex-utils-output-truncation"
         "codex-apply-patch"
         "codex-protocol"
         "codex-windows-sandbox"
@@ -226,35 +518,69 @@
         "codex-secrets"
         "codex-execpolicy-legacy"
         "codex-debug-client"
+         "codex-analytics"
+         "codex-rollout"
+         "codex-rollout-trace"
+         "codex-terminal-detection"
+         "codex-utils-approval-presets"
+         "codex-utils-cli"
+         "codex-uds"
+         "codex-install-context"
+         "codex-device-key"
         ;;; Tier 2.
         "codex-app-server-protocol"
         "codex-rmcp-client"
         "codex-otel"
+         "codex-thread-store"
         "codex-state"
-         "codex-core"
-         "codex-linux-sandbox"
+         "codex-features"
+         "codex-model-provider"
+         "codex-config"
+         "codex-agent-identity"
+         "codex-aws-auth"
+         "codex-hooks"
+         "codex-code-mode"
         "codex-feedback"
+         "codex-skills"
+         "codex-test-binary-support"
+         "codex-core"
+         "codex-core-plugins"
+         "codex-utils-sandbox-summary"
+         "codex-linux-sandbox"
+         "codex-sandboxing"
+         "codex-connectors"
+         "codex-core-skills"
         ;;; Tier 3.
         "codex-arg0"
         "codex-lmstudio"
         "codex-login"
         "codex-ollama"
-         "codex-common"
+         "codex-utils-oss"
         "codex-mcp-server"
         "codex-backend-client"
         "codex-responses-api-proxy"
+         "codex-shell-command"
+         "codex-shell-escalation"
+         "codex-plugin"
+         "codex-model-provider-info"
+         "codex-models-manager"
         ;;; Tier 4.
         "codex-cloud-requirements"
         "codex-exec"
         "codex-exec-server"
-         "codex-stdio-to-uds"
         "codex-network-proxy"
+         "codex-stdio-to-uds"
         "codex-chatgpt"
         "codex-cloud-tasks-client"
+         "codex-cloud-tasks-mock-client"
+         "codex-tools"
+         "codex-mcp"
+         "codex-collaboration-mode-templates"
         ;;; Tier 5.
         "codex-app-server"
         "codex-app-server-test-client"
         "codex-tui"
+         "codex-response-debug-context"
         ;;; Tier 6.
         "codex-cloud-tasks"
         ;; The main executable.
@@ -270,7 +596,7 @@
              ;; Update them to match the actual package version.
              (let ((snap-files (find-files "." "\\.snap$")))
                (substitute* snap-files
-                  (("\\(v0\\.0\\.0\\) ") "(v0.98.0)")))))
+                  (("\\(v0\\.0\\.0\\)   ") "(v0.124.0) ")))))
          (add-after 'chdir-to-workspace 'patch-git-deps-to-vendor
            (lambda _
              ;; Replace git dependencies with version references so cargo
@@ -279,23 +605,57 @@
                (("nucleo = \\{ git = [^}]+\\}")
                 "nucleo = \"0.5.0\"")
                (("runfiles = \\{ git = [^}]+\\}")
-                 "runfiles = \"0.1.0\""))))
-          (add-after 'chdir-to-workspace 'add-version-to-workspace-deps
+                 "runfiles = \"0.1.0\""))
+              ;; Remove workspace members that have unbuildable deps
+              ;; (v8-poc requires V8).  code-mode stays a workspace member
+              ;; so its codex-protocol resolves to the same local copy as
+              ;; the rest of the build; disabling its default features
+              ;; (below) avoids pulling in V8.
+              (substitute* "Cargo.toml"
+                (("\"v8-poc\",") ""))
+              ;; Disable V8 runtime in codex-code-mode by turning off
+              ;; default features.  Keep path= so code-mode is resolved
+              ;; from the local source tree and shares codex-protocol
+              ;; (and other workspace crates) with the rest of the build;
+              ;; resolving it from the vendor instead introduces a
+              ;; duplicate codex-protocol and causes E0308 type
+              ;; mismatches in codex-tools.
+              (substitute* "Cargo.toml"
+                (("codex-code-mode = \\{ path = \"code-mode\" \\}")
+                 "codex-code-mode = { path = \"code-mode\", default-features = false }"))
+              ;; cargo build at workspace root ignores per-dep
+              ;; default-features=false and builds code-mode with its
+              ;; own default features, which include v8-runtime and
+              ;; would pull in V8.  Make the default feature empty.
+              (substitute* "code-mode/Cargo.toml"
+                (("^default = \\[\"v8-runtime\"\\]") "default = []"))))
+          (add-after 'patch-git-deps-to-vendor 'add-version-to-workspace-deps
            (lambda _
              ;; cargo package requires all dependencies to have versions.
-              ;; cargo package requires all dependencies to have versions.
-              ;; Add version = "0.98.0" to internal path dependencies.
+              ;; Add version = "0.124.0" to internal path dependencies.
              (let ((cargo-files (find-files "." "^Cargo\\.toml$")))
                (substitute* cargo-files
                  ;; Handle inline deps: name = { path = "..." }
                  (("(codex-[a-z0-9-]+) = \\{ path = " all name)
-                   (string-append name " = { version = \"0.98.0\", path = "))
+                   (string-append name " = { version = \"0.124.0\", path = "))
                  ;; Handle inline deps with package: name = { package = "...", path = "..." }
                  (("(codex-[a-z0-9-]+) = \\{ package = " all name)
-                   (string-append name " = { version = \"0.98.0\", package = "))
+                   (string-append name " = { version = \"0.124.0\", package = "))
                  ;; Handle section deps: [dependencies.X] with path = "..."
                  (("^(path = \"\\.\\./[^\"]*\")" all path-line)
-                   (string-append path-line "\nversion = \"0.98.0\""))))))
+                   (string-append path-line "\nversion = \"0.124.0\""))))))
+          (add-after 'chdir-to-workspace 'use-gnu-store-in-sandbox
+            (lambda _
+              ;; LINUX_PLATFORM_DEFAULT_READ_ROOTS in linux-sandbox/src/
+              ;; bwrap.rs is the read-only baseline that codex's bwrap
+              ;; sandbox bind-mounts so commands can read /usr/bin/ls,
+              ;; libc, etc.  Upstream lists "/nix/store" for NixOS;
+              ;; Guix's equivalent is "/gnu/store".  Without this swap,
+              ;; the codex sandbox cannot locate any binaries on a Guix
+              ;; system because every "system" path resolves into
+              ;; /gnu/store/<hash>-pkg/bin/...
+              (substitute* "linux-sandbox/src/bwrap.rs"
+                (("\"/nix/store\"") "\"/gnu/store\""))))
          (add-after 'chdir-to-workspace 'patch-hardcoded-paths
            (lambda* (#:key inputs #:allow-other-keys)
              (let ((bash-bin (string-append
@@ -325,6 +685,14 @@
                   (string-append "\"" bash-bin "/bash "))
                  (("\"/bin/sh ")
                   (string-append "\"" bash-bin "/sh "))
+                  ;; Single-quoted paths in test assertion strings,
+                  ;; e.g. "exec '/bin/bash' -c ...".  Must match the
+                  ;; double-quoted substitutions above so both sides
+                  ;; of assert_eq!/contains use the store path.
+                  (("'/bin/bash'")
+                   (string-append "'" bash-bin "/bash'"))
+                  (("'/bin/sh'")
+                   (string-append "'" bash-bin "/sh'"))
                  ;; coreutils.
                  (("\"/bin/(cat|cp|date|echo|head|ls|rm|sleep|true|touch)\"" all cmd)
                   (string-append "\"" coreutils-bin "/" cmd "\""))
@@ -339,42 +707,150 @@
                   (string-append "\"" git-bin "/git\""))
                  (("\"/usr/bin/sed\"")
                   (string-append "\"" sed-bin "/sed\"")))
+                ;; Bare Command::new("git") and Command::new("ls")
+                ;; in codex source files that exec internally.
+                (substitute* (find-files "git-utils" "\\.rs$")
+                  (("Command::new\\(\"git\"\\)")
+                   (string-append "Command::new(\"" git-bin "/git\")")))
+                (substitute* "tui/src/get_git_diff.rs"
+                  (("Command::new\\(\"git\"\\)")
+                   (string-append "Command::new(\"" git-bin "/git\")")))
+                (substitute* "core/src/turn_diff_tracker.rs"
+                  (("Command::new\\(\"git\"\\)")
+                   (string-append "Command::new(\"" git-bin "/git\")")))
+                (substitute* "cloud-tasks/src/env_detect.rs"
+                  (("Command::new\\(\"git\"\\)")
+                   (string-append "Command::new(\"" git-bin "/git\")")))
+                (substitute* "core/src/plugins/startup_sync.rs"
+                  (("\"git\",")
+                   (string-append "\"" git-bin "/git\",")))
+                (substitute* "file-search/src/lib.rs"
+                  (("Command::new\\(\"ls\"\\)")
+                   (string-append "Command::new(\"" coreutils-bin "/ls\")")))
+                ;; Neutralize pager with absolute path to cat.
+                (substitute* "core/src/unified_exec/process_manager.rs"
+                  (("\"PAGER\", \"cat\"")
+                   (string-append "\"PAGER\", \"" coreutils-bin "/cat\""))
+                  (("\"GIT_PAGER\", \"cat\"")
+                   (string-append "\"GIT_PAGER\", \"" coreutils-bin "/cat\""))
+                  (("\"GH_PAGER\", \"cat\"")
+                   (string-append "\"GH_PAGER\", \"" coreutils-bin "/cat\"")))
+                ;; Bare /bin/sleep inside a format! string
+                ;; (no surrounding double quotes, so the main
+                ;; pattern does not match).
+                (substitute*
+                  "shell-escalation/src/unix/escalate_server.rs"
+                  (("/bin/sleep")
+                   (string-append coreutils-bin "/sleep")))
                ;; @SHELL@ placeholder from test-shebangs patch
                (substitute*
                  (list "rmcp-client/src/program_resolver.rs"
                        "tui/src/external_editor.rs")
                  (("@SHELL@")
                   (string-append bash-bin "/sh")))
-                ;; shebang in test-only file
+                ;; Shebangs inside raw string literals (r#"..."#)
+                ;; that are written to scripts at runtime.  The
+                ;; main "/bin/sh" patterns only match double-quoted
+                ;; occurrences; these shebangs have no surrounding
+                ;; double quotes.
                (substitute*
-                  "core/tests/suite/user_notification.rs"
+                  (list "core/src/plugins/startup_sync_tests.rs"
+                        "core/src/tools/runtimes/shell/unix_escalation_tests.rs"
+                        "core/tests/suite/client.rs"
+                        "core/tests/suite/js_repl.rs"
+                        "core/tests/suite/skill_approval.rs"
+                        "core/tests/suite/user_notification.rs"
+                        "exec-server/tests/file_system.rs"
+                        "login/src/auth/auth_tests.rs"
+                        "models-manager/src/manager_tests.rs"
+                        "sandboxing/src/bwrap_tests.rs")
                  (("#!/bin/bash")
-                   (string-append "#!" bash-bin "/bash"))))))
+                   (string-append "#!" bash-bin "/bash"))
+                  (("#!/bin/sh")
+                   (string-append "#!" bash-bin "/sh")))
+                ;; Test helpers pass env: Default::default() to the
+                ;; spawn code which calls env_clear(), leaving
+                ;; processes with no PATH.  Inject the build-time
+                ;; PATH so tests find coreutils, bash, etc.
+                (substitute* (find-files "." "\\.rs$")
+                  (("env: Default::default\\(\\)")
+                   (string-append
+                    "env: std::env::var(\"PATH\")"
+                    ".into_iter()"
+                    ".map(|p| (\"PATH\".to_string(), p))"
+                    ".collect()")))
+                ;; Test-only absolute path; bare name works via PATH.
+                (substitute* "exec-server/tests/exec_process.rs"
+                  (("\"/usr/bin/python3\"")
+                   "\"python3\""))
+                ;; Same empty-env issue but in JSON literals
+                ;; (serde_json::json! macro).
+                (substitute* "exec-server/tests/process.rs"
+                  (("\"env\": \\{\\}")
+                   (string-append
+                    "\"env\": {\"PATH\": \""
+                    (getenv "PATH")
+                    "\"}"))))))
+          (add-before 'build 'set-bubblewrap-source
+            (lambda* (#:key inputs #:allow-other-keys)
+              (setenv "CODEX_BWRAP_SOURCE_DIR"
+                      (string-append
+                       (assoc-ref inputs "bubblewrap-source")
+                       "/"))))
+          (add-before 'build 'create-node-version-file
+            (lambda _
+              (call-with-output-file "guix-vendor/node-version.txt"
+                (lambda (port)
+                  (display "22.22.0" port)))))
          (add-before 'check 'set-home
            (lambda _
-              (setenv "HOME" "/tmp")
-              (setenv "USER" "nixbld"))))))
-    (native-inputs (list clang              ;bindgen uses libclang to parse BoringSSL's C headers
-                         cmake-minimal    ;BoringSSL is compiled from C source
-                         libunwind        ;BoringSSL tests verify stack unwinding in assembly
-                         perl python-minimal ;for tests
-                         pkg-config))
+              ;; HOME must not be a prefix of /tmp, otherwise
+              ;; the TUI's path shortener replaces /tmp/... with
+              ;; ~/... and 30 snapshot tests fail.
+              (setenv "HOME" "/tmp/guix-home")
+              (mkdir-p "/tmp/guix-home")
+              (setenv "USER" "nixbld")
+              ;; Default libtest thread stack is 2 MiB, which is not
+              ;; enough for tokio current_thread tests that drive
+              ;; codex-core's full turn pipeline.  Upstream gates such
+              ;; tests through run_current_thread_test_with_stack (4 MiB)
+              ;; in app-server/src/message_processor/tracing_tests.rs;
+              ;; raise the global default so future additions that
+              ;; forget the wrapper still pass.
+              (setenv "RUST_MIN_STACK" "8388608")
+              ;; Disable network access.
+              (setenv "CODEX_SANDBOX_NETWORK_DISABLED" "1"))))))
+    (native-inputs `(("bubblewrap" ,bubblewrap) ;tests need bwrap on PATH
+                     ("clang" ,clang)
+                     ("cmake-minimal" ,cmake-minimal)
+                     ("libunwind" ,libunwind)
+                     ("lsof" ,lsof)            ;app-server tests
+                     ("nss-certs-for-test" ,nss-certs-for-test) ;OTLP gRPC TLS
+                     ("perl" ,perl)
+                     ("procps" ,procps)         ;tests use ps
+                     ("python-minimal" ,python-minimal)
+                     ("pkg-config" ,pkg-config)
+                     ("bubblewrap-source" ,(package-source bubblewrap))))
    (inputs (cons* bash-minimal coreutils git-minimal sed
-                   openssl sqlite `(,zstd "lib")
+                   libcap oniguruma openssl sqlite zlib `(,zstd "lib")
                   (cargo-inputs 'codex)))
+    (properties '((timeout . 108000) ; 30  hours
+                  (max-silent-time . 54000))) ; 15 hours
    (home-page "https://github.com/openai/codex")
    (synopsis "AI-assisted coding CLI and TUI")
    (description
     "Codex is an AI-powered coding assistant that runs in the terminal.
 It provides an interactive TUI for conversations with AI models, with
 support for shell command execution, file editing, and code generation.
-Configure providers via @file{~/.codex/config.toml}.")
+Configure providers via @file{~/.codex/config.toml}.
+
+codex-code-mode's V8 Javascript executor is disabled.")
    (license license:asl2.0)))

 (define-public codex-acp
  (package
    (name "codex-acp")
-    (version "0.9.2")
+    (version "0.11.1")
    (source
     (origin
       (method git-fetch)
@@ -383,9 +859,8 @@ Configure providers via @file{~/.codex/config.toml}.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "190sq6s6jfz8dkj1y8305r7x6ln86qqr2j1bnfjci7f1x2wyzmsj"))
-       (patches (search-patches "codex-acp-0.9.2-remove-patch-sections.patch"
-                                "codex-acp-0.9.2-replace-result-flatten.patch"))))
+        (base32 "1rlgkbvrbdl5jhf49sjn2mifn2rq6z0vwf0gard23y1bz6sr3wmr"))
+       (patches (search-patches "codex-acp-0.11.1-remove-patch-sections.patch"))))
    (build-system cargo-build-system)
    (arguments
     (list
@@ -393,13 +868,43 @@ Configure providers via @file{~/.codex/config.toml}.")
      #:phases
      #~(modify-phases %standard-phases
          (add-after 'unpack 'patch-codex-deps
-            (lambda _
+            (lambda* (#:key inputs #:allow-other-keys)
              ;; Rewrite git dependencies to use vendored sources from rust-codex
              (substitute* "Cargo.toml"
-                (("git = \"https://github.com/zed-industries/codex\", branch = \"acp\"")
-                 "version = \"0.0.0\"")))))))
-    (native-inputs (list pkg-config))
-    (inputs (cons* openssl sqlite `(,zstd "lib") (cargo-inputs 'codex-acp)))
+                (("git = \"https://github.com/openai/codex\", tag = \"rust-v0.117.0\"")
+                 "version = \"0.117.0\""))
+              ;; Disable V8 runtime in codex-code-mode (transitive dep).
+              (let ((port (open-file "Cargo.toml" "a")))
+                (display "
+[dependencies.codex-code-mode]
+version = \"0.117.0\"
+default-features = false
+" port)
+                (close-port port))
+              ;; Point codex-linux-sandbox at system bubblewrap source.
+              (setenv "CODEX_BWRAP_SOURCE_DIR"
+                      (string-append
+                       (assoc-ref inputs "bubblewrap-source")
+                       "/"))))
+          (add-before 'check 'set-home
+            (lambda _
+              (setenv "HOME" "/tmp")
+              (setenv "USER" "nixbld")))
+          (add-before 'build 'create-node-version-file
+            (lambda _
+              ;; codex-core's js_repl uses include_str! to read
+              ;; node-version.txt four directories up from its source;
+              ;; create it where the vendored crate expects it.
+              (call-with-output-file "guix-vendor/node-version.txt"
+                (lambda (port)
+                  (display "22.22.0" port))))))))
+    (native-inputs
+     `(("cmake-minimal" ,cmake-minimal)
+       ("clang" ,clang)
+       ("pkg-config" ,pkg-config)
+       ("bubblewrap-source" ,(package-source bubblewrap))))
+    (inputs (cons* libcap openssl sqlite zlib `(,zstd "lib")
+                   (cargo-inputs 'codex-acp)))
    (home-page "https://github.com/zed-industries/codex-acp")
    (synopsis "ACP-compatible agent bridging Zed Codex with ACP clients")
    (description
@@ -2375,7 +2375,9 @@ non-Windows systems without running the actual installer using wine.")
     (sha256
      (base32 "17k679glx05v23n8kxbg9vmbf89i2252g5xj6w3dkz19asmh1zd6"))))
   (build-system gnu-build-system)
-   (native-inputs (list autoconf automake libtool nasm))
+   (native-inputs
+    (cons* autoconf automake libtool
+           (maybe-nasm)))
   (home-page "https://github.com/intel/isa-l")
   (synopsis "Intelligent storage acceleration library")
   (description "ISA-L is a collection of optimized low-level functions
@@ -150,7 +150,7 @@ as created by Podman, CRI-O and containerd.")))
 (define-public crun
  (package
    (name "crun")
-    (version "1.25.1")
+    (version "1.26")
    (source
     (origin
       (method url-fetch)
@@ -160,7 +160,7 @@ as created by Podman, CRI-O and containerd.")))
             "/crun-" version ".tar.gz"))
       (sha256
        (base32
-         "02kksvnja234k8mpq5j7yms8npbpvh8iz3k03h21lwcqzqsb88rx"))))
+         "1hdwk5dpsz9danxiyfli07b7sqid6hr34qmhs5qjl2dcc00is89j"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -44,7 +44,7 @@
 ;;; Copyright © 2024 Jakob Kirsch <jakob.kirsch@web.de>
 ;;; Copyright © 2025 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;; Copyright © 2025 Sergio Pastor Pérez <sergio.pastorperez@gmail.com>
-;;; Copyright © 2025 Ashish SHUKLA <ashish.is@lostca.se>
+;;; Copyright © 2025, 2026 Ashish SHUKLA <ashish.is@lostca.se>
 ;;; Copyright © 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2025 Romain Garbage <romain.garbage@inria.fr>
 ;;; Copyright © 2024, 2025 Janneke Nieuwenhuizen <janneke@gnu.org>
@@ -52,6 +52,7 @@
 ;;; Copyright © 2025 Philippe Swartvagher <phil.swart@gmx.fr>
 ;;; Copyright © 2025 Murilo <murilo@disroot.org>
 ;;; Copyright © 2026 Justin Veilleux <terramorpha@cock.li>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -3192,8 +3193,7 @@ pointers, containers, compiler building blocks, etc.")
    (native-inputs
     (list build))
    (inputs
-     `(("libcutl" ,libcutl)
-       ("libxerces-c" ,xerces-c)))
+     (list libcutl xerces-c))
    (synopsis "XSD Front-end")
    (description "@code{libxsd-frontend} is a compiler frontend for the W3C
 XML Schema definition language.  It includes a parser, semantic graph types
@@ -3360,7 +3360,7 @@ which can evaluate Jsonnet files and expressions.")))
 (define-public simdjson
  (package
    (name "simdjson")
-    (version "3.13.0")
+    (version "4.6.3")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -3369,7 +3369,7 @@ which can evaluate Jsonnet files and expressions.")))
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "005yli56nrkvlyx9g9cq8dczk42r9a18l162i2s5k81lj3y7mcrp"))))
+                "0729mxnc2wjb94gr4znwlzfmgw5w2v9kd8glvn3vnjhkdnd87zry"))))
    (build-system cmake-build-system)
    (arguments
     '(#:tests? #f                      ; tests require downloading dependencies
@@ -3608,7 +3608,7 @@ std::wstring, etc).")
 (define-public fast-float
  (package
    (name "fast-float")
-    (version "8.0.2")
+    (version "8.2.5")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -3617,7 +3617,7 @@ std::wstring, etc).")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "19x1yklf641yrpad6lk4cq3jmird10d5ig8hicm3p9lxh92k78cl"))))
+                "1l13nsl4sgq71m7aifrmmmfyl14vp48vqdh7pb50hxqq6f8bq2b5"))))
    (build-system cmake-build-system)
    (arguments
     (list
@@ -3628,12 +3628,10 @@ std::wstring, etc).")
          (add-after 'unpack 'patch-cmake-tests
            (lambda* (#:key inputs native-inputs #:allow-other-keys)
              (substitute* "tests/CMakeLists.txt"
-                (("FetchContent_GetProperties\\(supplemental_test_files.*")
-                 "")
-                (("if\\(NOT supplemental_test_files_POPULATED.*")
+                (("FetchContent_MakeAvailable\\(supplemental_test_files.*")
                 (string-append
                  "set(supplemental_test_files_BINARY_DIR "
-                  #$fast-float-test-files ")\nif(0)\n"))))))))
+                  #$fast-float-test-files ")\n"))))))))
    (native-inputs (list doctest fast-float-test-files))
    (home-page "https://github.com/fastfloat/fast_float")
    (synopsis "Floating point number parser for C++")
@@ -276,18 +276,17 @@ Ed448-Goldilocks and Curve448, using the Decaf encoding.")
 (define-public libsodium
  (package
    (name "libsodium")
-    (version "1.0.18")
-    (source (origin
-            (method url-fetch)
-            (uri (list (string-append
-                        "https://download.libsodium.org/libsodium/"
-                        "releases/libsodium-" version ".tar.gz")
-                       (string-append
-                        "https://download.libsodium.org/libsodium/"
-                        "releases/old/libsodium-" version ".tar.gz")))
-            (sha256
-             (base32
-              "1h9ncvj23qbbni958knzsli8dvybcswcjbx0qjjgi922nf848l3g"))))
+    (version "1.0.22")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/jedisct1/libsodium")
+              (commit (string-append version "-RELEASE"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32
+         "05lqdn6nzldsia5mv5a9xfvc5k0kybh9snwv7qsb135gva4bpjwk"))))
    (build-system gnu-build-system)
    (synopsis "Portable NaCl-based crypto library")
    (description
@@ -69,6 +69,9 @@
 ;;; Copyright © 2025 Simen Endsjø <contact@simendsjo.me>
 ;;; Copyright © 2025 bdunahu <bdunahu@operationnull.com>
 ;;; Copyright © 2026 Spencer King <spencer.king@wustl.edu>
+;;; Copyright © 2026 Peter Polidoro <peter@polidoro.io>
+;;; Copyright © 2026 Josep Bigorra <jjbigorra@gmail.com>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -125,6 +128,7 @@
  #:use-module (gnu packages gperf)
  #:use-module (gnu packages gtk)
  #:use-module (gnu packages guile)
+  #:use-module (gnu packages guile-xyz)
  #:use-module (gnu packages icu4c)
  #:use-module (gnu packages jemalloc)
  #:use-module (gnu packages language)
@@ -197,6 +201,7 @@
  #:use-module (guix build-system emacs)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system go)
+  #:use-module (guix build-system guile)
  #:use-module (guix build-system meson)
  #:use-module (guix build-system perl)
  #:use-module (guix build-system pyproject)
@@ -3096,6 +3101,64 @@ Driver.")
   ;; COPYING contains copy of lgpl2.1 - but copyright notices just say "LGPL"
   (home-page "https://www.unixodbc.org")))

+(define-public sqliteodbc
+  (package
+    (name "sqliteodbc")
+    (version "0.99991")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "http://www.ch-werner.de/sqliteodbc/"
+                                  name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0p4avhqxnd2l49g3vpzwrmdi8wxyqzy0vswalaagmqfdsfwav52d"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:tests? #f                      ; no check target
+      #:configure-flags
+      #~(list "--disable-static"
+              (string-append "--with-sqlite3=" #$(this-package-input "sqlite"))
+              (string-append "--with-odbc=" #$(this-package-input "unixodbc")))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'install 'create-lib-directory
+            (lambda _
+              (mkdir-p (string-append #$output "/lib"))))
+          (add-after 'install 'remove-extra-sqlite-extensions
+            (lambda _
+              ;; Keep this package focused on the ODBC driver itself.
+              (for-each delete-file
+                        (find-files (string-append #$output "/lib")
+                                    "^libsqlite3_mod_.*\\.(la|so)$"))))
+          (add-after 'install 'install-odbcinst.ini
+            (lambda _
+              (let ((dir (string-append #$output "/share/sqliteodbc")))
+                (mkdir-p dir)
+                (call-with-output-file (string-append dir "/odbcinst.ini")
+                  (lambda (port)
+                    (display
+                     (string-append
+                      "[SQLite3]\n"
+                      "Description = SQLite3 ODBC Driver\n"
+                      "Driver      = " #$output "/lib/libsqlite3odbc.so\n"
+                      "Setup       = " #$output "/lib/libsqlite3odbc.so\n"
+                      "Threading   = 2\n")
+                     port)))))))))
+    (native-search-paths
+     (list (search-path-specification
+            (variable "ODBCSYSINI")
+            (files '("share/sqliteodbc"))
+            (separator #f))))
+    (inputs (list sqlite unixodbc))
+    (home-page "http://www.ch-werner.de/sqliteodbc/")
+    (synopsis "ODBC driver for SQLite")
+    (description
+     "SQLiteODBC provides an ODBC driver for SQLite 3 databases.  It installs
+the shared library and a driver registration file so applications using
+unixODBC can resolve the @code{SQLite3} driver name from a Guix profile.")
+    (license license:tcl/tk)))
+
 (define-public nanodbc
  (package
    (name "nanodbc")
@@ -4097,8 +4160,8 @@ programmatically or as a standalone CLI application.")
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (inputs
-     `(("libcrypto" ,openssl)
-       ("libtcl8.6" ,tcl))) ; required for running the tests
+     (list openssl
+           tcl))                        ;for tests
    (native-inputs
     (list tcl))
    (arguments
@@ -4987,6 +5050,54 @@ postgresql = postgresql://nixbld@/yoyo_test~%")))
 files or Python scripts that define a list of migration steps.")
    (license license:asl2.0)))

+(define-public mutastructura
+  (package
+    (name "mutastructura")
+    (version "0.6.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://codeberg.org/jjba23/mutastructura")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "08vzlc5imavqf3bdzgbh70c7z44xjhf05gr7i2g5ksl49lv39gzh"))))
+    (build-system guile-build-system)
+    (arguments
+     (list
+      #:source-directory "src"
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'build 'install-program-files
+            (lambda _
+              (let* ((bin (string-append #$output "/bin"))
+                     (share (string-append #$output "/share")))
+                (copy-recursively "resources"
+                                  (string-append share "/resources"))
+                (install-file "scripts/mutastructura" bin)
+                (install-file "scripts/log.bash"
+                              (string-append share "/scripts/"))
+                (chmod (string-append bin "/mutastructura") #o755)))))))
+    (native-inputs (list guile-3.0))
+    (propagated-inputs (list guile-dbi
+                             guile-dbd-mysql
+                             guile-dbd-sqlite3
+                             guile-dbd-postgresql
+                             guile-gcrypt))
+    (inputs (list guile-3.0 bash-minimal))
+    (home-page "https://codeberg.org/jjba23/mutastructura")
+    (synopsis "Relational database schema migrations powered by Guile Scheme")
+    (description
+     "Mutastructura provides a familiar, declarative and transactional
+approach to managing database states. It exposes a user-friendly 
+@acronym{CLI, command-line interface} and has support for PostgreSQL, MySQL, and SQLite.
+It also exposes library functions and can be imported and used directly from other Guile code.
+
+Features include executing migrations transactionally and computing SHA256
+checksums to track schema evolution in a @code{migrations_history} table.")
+    (license license:agpl3+)))
+
 (define-public python-mysqlclient
  (package
    (name "python-mysqlclient")
@@ -31,13 +31,13 @@
 (define-public dhall
  (package
    (name "dhall")
-    (version "1.42.2")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "dhall" version))
-       (sha256
-        (base32 "0fvvqvh6diqi55dmncfs06rvcw8k0a1hs2gq228yxvsfbzcpv44s"))))
+    (version "1.41.2")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "dhall" version))
+              (sha256
+               (base32
+                "14m5rrvkid76qnvg0l14xw1mnqclhip3gjrz20g1lp4fd5p056ka"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "dhall")))
    (inputs (list ghc-aeson
@@ -73,8 +73,8 @@
                  ghc-text-manipulate
                  ghc-text-short
                  ghc-th-lift-instances
-                  ghc-unix-compat
                  ghc-unordered-containers
+                  ghc-uri-encode
                  ghc-vector
                  ghc-cryptohash-sha256
                  ghc-http-types
@@ -86,6 +86,7 @@
                         ghc-quickcheck-instances
                         ghc-special-values
                         ghc-spoon
+                         ghc-system-filepath
                         ghc-tasty
                         ghc-tasty-expected-failure
                         ghc-tasty-hunit
@@ -96,8 +97,9 @@
                         ghc-mockery
                         ghc-doctest))
    (arguments
-     `(#:cabal-revision ("2"
-                         "1h9kxpn3kzwmxj07mqc0cxjj2ak3dyxnifb78z5vn34xn747j5bk")))
+     `(#:tests? #f ; Tries to access httpbin.org
+       #:cabal-revision ("4"
+                         "0innb3cn98ynb8bd83jdyrm64ij7wcvajg5qcwzdwbyzpr62anfx")))
    (home-page "http://hackage.haskell.org/package/dhall")
    (synopsis "Configuration language guaranteed to terminate")
    (description
@@ -31,7 +31,7 @@
 ;;; Copyright © 2023 Zheng Junjie <873216071@qq.com>
 ;;; Copyright © 2024-2025 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;; Copyright © 2025 Ashish SHUKLA <ashish.is@lostca.se>
-;;; Copyright © 2025 Vinicius Monego <monego@posteo.net>
+;;; Copyright © 2025, 2026 Vinicius Monego <monego@posteo.net>
 ;;; Copyright © 2025 Grigory Shepelev <shegeley@gmail.com>
 ;;; Copyright © 2026 Luis Guilherme Coelho <lgcoelho@disroot.org>

@@ -94,6 +94,8 @@
  #:use-module (gnu packages gnome)
  #:use-module (gnu packages gnupg)
  #:use-module (gnu packages golang-build)
+  #:use-module (gnu packages golang-check)
+  #:use-module (gnu packages golang-compression)
  #:use-module (gnu packages golang-xyz)
  #:use-module (gnu packages graphics)
  #:use-module (gnu packages gtk)
@@ -420,6 +422,49 @@ tables, and it understands a variety of different formats.")
 similarity.")
    (license license:gpl3+)))

+(define-public gdu
+  (package
+    (name "gdu")
+    (version "5.35.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/dundee/gdu")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "051xf3wncdiavjwyl9djmni5vd2dqjgn6drkw2nm21c9l0rjfv6d"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:install-source? #f
+      #:import-path "github.com/dundee/gdu/v5/cmd/gdu"
+      #:unpack-path "github.com/dundee/gdu/v5"))
+    (native-inputs
+     (list go-github-com-dgraph-io-badger-v4
+           go-github-com-fatih-color
+           go-github-com-gdamore-tcell-v2
+           go-github-com-h2non-filetype
+           go-github-com-maruel-natural
+           go-github-com-mattn-go-isatty
+           go-github-com-pkg-errors
+           go-github-com-rivo-tview
+           go-github-com-sirupsen-logrus
+           go-github-com-spf13-cobra
+           go-github-com-stretchr-testify
+           go-github-com-ulikunitz-xz
+           go-golang-org-x-sys
+           go-golang-org-x-text
+           go-gopkg-in-yaml-v3
+           go-modernc-org-sqlite))
+    (home-page "https://github.com/dundee/gdu")
+    (synopsis "Disk usage analyzer")
+    (description "Gdu is a disk usage analyzer written in Go.  It is intended
+primarily for SSD disks where it can fully utilize parallel processing, but it
+also works on HDDs.")
+    (license license:expat)))
+
 (define-public gpart
  ;; The latest (0.3) release is from 2015 and is missing a crash fix.
  (let ((commit "ec03350a01ad69708b5a3e2d47b8e002b0eba6c9")
@@ -51,7 +51,7 @@
 (define-public boinc-client
  (package
    (name "boinc-client")
-    (version "8.2.9")
+    (version "8.2.12")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -62,7 +62,7 @@
              (file-name (git-file-name "boinc" version))
              (sha256
               (base32
-                "0ik9423ii6kal29jdn907pxy8w86zpi8n158qx1gcsh8lsaif1v5"))))
+                "0531n0yij1gh06xy6plwivbpmhqfq15jizg3rdgri40nz41rzbgr"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -201,13 +201,13 @@ your project into different processes.")
 (define-public python-django
  (package
    (name "python-django")
-    (version "5.2.11")
+    (version "5.2.13")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "django" version))
       (sha256
-        (base32 "1lq2dynfw6jmvzrzgfrlij2qnxcksaxgnrfr0pj3bvmrv0m2jbbz"))))
+        (base32 "1i1vlffzhwbzp6r6y8ycvwklc45diy4c6i897z379l48a7dqj5d3"))))
    (build-system pyproject-build-system)
    (arguments
     '(#:test-flags
@@ -298,22 +298,6 @@ to the @dfn{don't repeat yourself} (DRY) principle.")
                      ;; This CVE is fixed in 4.1.9.
                      "CVE-2023-31047"))))))

-(define-public python-django-4
-  (package
-    (inherit python-django)
-    (name "python-django-4")
-    (version "4.2.28")
-    (source
-      (origin
-        (method url-fetch)
-        (uri (pypi-uri "django" version))
-        (sha256
-         (base32 "1znc2q1m9p2kxz1rkfkh2hg2sx6i3aqv72zsraad7bci364cvfd4"))))
-    (arguments
-     (substitute-keyword-arguments arguments
-       ((#:phases phases)
-        #~(modify-phases #$phases (delete 'delete-sitecustomize)))))))
-
 (define-public python-django-cache-url
  (package
    (name "python-django-cache-url")
@@ -10,6 +10,7 @@
 ;;; Copyright © 2022 ( <paren@disroot.org>
 ;;; Copyright © 2022 Esther Flashner <esther@flashner.co.il>
 ;;; Copyright © 2025-2026 Jonas Meeuws <jonas.meeuws@gmail.com>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -320,11 +321,11 @@ integration tests...\n")
                                 "|core.thread.osthread-debug-shared")))
                           (#t `("")))))))))))))
    (native-inputs
-     (append (delete "llvm"
-                     (alist-replace "ldc" (list ldc-bootstrap)
-                                    (package-native-inputs ldc-bootstrap)))
-         `(("clang" ,clang-17)          ;propagates llvm and clang-runtime
-           ("python-lit" ,python-lit))))
+     (modify-inputs native-inputs
+       (delete "llvm")
+       (replace "ldc" ldc-bootstrap)
+       (append clang-17                 ;propagates llvm and clang-runtime
+               python-lit)))
    (properties
     (alist-delete 'hidden? (package-properties ldc-bootstrap)))))

@@ -77,6 +77,8 @@
  #:use-module (gnu packages pkg-config)
  #:use-module (gnu packages protobuf)
  #:use-module (gnu packages python)
+  #:use-module (gnu packages python-build)
+  #:use-module (gnu packages python-web)
  #:use-module (gnu packages python-xyz)
  #:use-module (gnu packages ragel)
  #:use-module (gnu packages serialization)
@@ -93,6 +95,8 @@
  #:use-module (guix build-system glib-or-gtk)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system meson)
+  #:use-module (guix build-system pyproject)
+  #:use-module (guix build-system python)
  #:use-module (guix download)
  #:use-module (guix gexp)
  #:use-module (guix git-download)
@@ -111,6 +115,7 @@
       (uri (git-reference
              (url "git://git.chiark.greenend.org.uk/~ianmdlvl/adns.git")
              (commit (string-append "adns-" version))))
+       (file-name (git-file-name name version))
       (sha256
        (base32
         "0ln3l5j7wb1xazrzl76p9xar52p6l2k1cwy7jazxw1acl71k9h5n"))))
@@ -303,6 +308,58 @@ protocol.")
      (home-page "https://github.com/earlchew/cloudflare-cli")
      (license license:expat))))

+(define-public ddclient
+  (package
+    (name "ddclient")
+    (version "4.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/ddclient/ddclient")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0sz4f7qx4yjg6q6ybhzilb7f0kshz46c54y3i4hq2nww2bhkc8a4"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'bootstrap 'patch-ddclient.in-shebang
+            (lambda _
+              ;; This is run in the bootstrap phase, so patch before
+              (patch-shebang "ddclient.in")))
+          (add-after 'install 'wrap-program
+            (lambda* (#:key inputs #:allow-other-keys)
+              (wrap-program (string-append #$output "/bin/ddclient")
+                `("PERL5LIB" ":" prefix
+                  ,(map (lambda (input-name)
+                          (string-append (assoc-ref inputs input-name)
+                                         "/lib/perl5/site_perl"))
+                        '("perl-json")))))))))
+    (native-inputs
+     (list autoconf
+           automake
+           perl-http-daemon
+           perl-plack
+           perl-test-mockmodule
+           perl-test-tcp
+           perl-test-warnings))
+    (inputs
+     (list curl
+           perl
+           perl-json
+           bash-minimal))
+    (home-page "https://github.com/ddclient/ddclient")
+    (synopsis "Dynamic DNS update client")
+    (description
+     "ddclient is used to update dynamic DNS entries for accounts on many
+dynamic DNS services.  It supports a wide range of routers and protocols,
+including Cloudflare, Namecheap, DynDNS, FreeDNS, Google Domains, and many
+more.")
+    (license license:gpl2+)))
+
 (define-public ldns
  (package
    (name "ldns")
@@ -498,6 +555,39 @@ and BOOTP/TFTP for network booting of diskless machines.")
    ;; Source files only say GPL2 and GPL3 are allowed.
    (license (list license:gpl2 license:gpl3))))

+(define-public dnsupdate
+  (package
+    (name "dnsupdate")
+    (version "0.4.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/lopsided98/dnsupdate")
+              (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0bp6mm0yhg4hs698xdmvcfad4jqf5rgb1cab88pfzyx9w52x0ag6"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list #:test-backend #~'unittest
+           #:test-flags #~'("discover" "-p" "*_test.py")))
+    (native-inputs
+     (list python-setuptools))
+    (propagated-inputs
+     (list python-beautifulsoup4
+           python-netifaces
+           python-pyyaml
+           python-requests))
+    (home-page "https://github.com/lopsided98/dnsupdate")
+    (synopsis "Modern and flexible dynamic DNS client")
+    (description
+     "Dnsupdate is a dynamic DNS client that provides support for multiple DNS
+services, including Afraid.org FreeDNS, Cloudflare, IETF standard DNS
+updates (nsupdate), and custom HTTP-based services.  It uses YAML
+configuration files and supports multiple address detection methods.")
+    (license license:gpl3+)))
+
 ;; 'bind' is the name of a built-in Guile procedure, which is why we choose a
 ;; different name here.
 (define-public isc-bind
@@ -148,13 +148,13 @@ system.")
 (define-public r-duckdb
  (package
    (name "r-duckdb")
-    (version "1.5.1")
+    (version "1.5.2")
    (source
     (origin
       (method url-fetch)
       (uri (cran-uri "duckdb" version))
       (sha256
-        (base32 "177621m08whqqk4yhj3zrr08l3d9hhlqh3gm9jzhi5cplg47cksq"))
+        (base32 "1dldlfwvc33czvlxfmwaj4p9y6sjjj5iqy98yda47a8kclrqmyam"))
       ;; This package bundles the duckdb sources and builds a custom variant
       ;; of duckdb.  I'd be happy to link it with our duckdb library instead,
       ;; but it does not seem possible to do that.
@@ -1069,7 +1069,7 @@ characterization result in a liberty library file.")
 (define-public kicad
  (package
    (name "kicad")
-    (version "10.0.0")
+    (version "10.0.1")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1077,7 +1077,7 @@ characterization result in a liberty library file.")
                    (commit version)))
              (sha256
               (base32
-                "1470x1276yvd8li3w25zjg73fkpl2qp4dsx7adanafq5c4l47rmc"))
+                "1mnlv8fyz03pfg8pkqwdl5gjz6vsk98c6414lf3wkvrkb85ljaav"))
              (file-name (git-file-name name version))))
    (build-system cmake-build-system)
    (arguments
@@ -1185,7 +1185,9 @@ characterization result in a liberty library file.")
     "Kicad is a program for the formation of printed circuit
 boards and electrical circuits.  The software has a number of programs that
 perform specific functions, for example, pcbnew (Editing PCB), eeschema (editing
-electrical diagrams), gerbview (viewing Gerber files) and others.")
+electrical diagrams), gerbview (viewing Gerber files) and others.  To use
+SQLite-backed database libraries, install the optional @code{sqliteodbc}
+package.")
    (license license:gpl3+)))

 (define-public kicad-doc
@@ -1200,7 +1202,7 @@ electrical diagrams), gerbview (viewing Gerber files) and others.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1k0ayxsy0nnv9qxkii9yrxs7jx9y3wfjpsv5yl9wql3vdg3qay69"))))
+                "1c0vn13rp0z12rlqhl321pk2gj9577dyky6xj3i6hb040i3v7zrr"))))
    (build-system cmake-build-system)
    (arguments
     `(#:configure-flags (list "-DBUILD_FORMATS=html"
@@ -1232,7 +1234,7 @@ electrical diagrams), gerbview (viewing Gerber files) and others.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0khfnln0f2zsz5hy31nw2rr0nflb2z3s9n9f7g41g03m9l3s43v2"))))
+                "0iz4lb33wdsw4f82a0ln8ycgaf39gjws03mvl2j1q9npwj6xl1cm"))))
    (build-system cmake-build-system)
    (native-inputs (list python-wrapper))
    (arguments
@@ -1262,7 +1264,7 @@ libraries.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0ymmd1rzrczpvcqzw1mld9x8xhbka0vvjy3kdqwysg4ri97f5wrm"))))
+                "0jqgyi1yb2zc6w56ba7xama0wnhrqwbbnf2fqvr47xihvdcvs87v"))))
    (synopsis "Official KiCad footprint libraries")
    (description "This package contains the official KiCad footprint libraries.")))

@@ -1279,7 +1281,7 @@ libraries.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0k91iw661fpzb7saryjxdcdvk1kis7dhbcpzp7xzjk84i4jvxrp5"))))
+                "0jr70ry6inzc2fy3s300z0zlmihbq95ba1zckyd1wwbpplaj1gbl"))))
    (synopsis "Official KiCad 3D model libraries")
    (description "This package contains the official KiCad 3D model libraries.")))

@@ -2329,7 +2331,7 @@ Automation}, portable and vendor neutral FPGA place and route tool.")
 (define-public nvc
  (package
    (name "nvc")
-    (version "1.19.3")
+    (version "1.20.1")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -2338,7 +2340,7 @@ Automation}, portable and vendor neutral FPGA place and route tool.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1zizz2dafm53lzpjayy6vig5pz5ri9cszdivg0jzzh8s3ggkpy1i"))))
+                "1b38x2ch468s4p6mrq6c8s0d95vb84p6w4v8in79l4w7sfy8jnr0"))))
    (build-system gnu-build-system)
    (arguments
     (list #:out-of-source? #t
@@ -3459,7 +3461,7 @@ form of AXI, AXI lite, and AXI stream modules.")
 (define-public python-edalize
  (package
    (name "python-edalize")
-    (version "0.6.6")
+    (version "0.6.8")
    (source
     (origin
       (method git-fetch)
@@ -3468,7 +3470,7 @@ form of AXI, AXI lite, and AXI stream modules.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "115nc15n2cx4x9irjim07zkg0287418djqd6ja7rm8jrnyldvln9"))))
+        (base32 "04m2lhkclw9fj92k43c06j003qnq9i1yhy2131fvcnkkr0d9438m"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@@ -4514,7 +4516,7 @@ unique design feature of Trilinos is its focus on packages.")
 (define-public verilator
  (package
    (name "verilator")
-    (version "5.046")
+    (version "5.048")
    (source
     (origin
       (method git-fetch)
@@ -4523,7 +4525,7 @@ unique design feature of Trilinos is its focus on packages.")
              (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1gr1qhxvl4856hnmnx46dqd2qp0jhdh959zm2qfmxzzh19np7xkm"))))
+        (base32 "16c1x66kqmc5ldqjij81kypj471fibfihcqn6kz4wbxvnn0smyn6"))))
    (native-inputs
     (list autoconf
           automake
@@ -290,7 +290,7 @@ based upon the Common Locale Data Repository (CLDR).")
  (package
    (inherit elixir-ex-cldr-minimal)
    (name "elixir-ex-cldr")
-    (version "2.43.2")
+    (version "2.47.2")
    (source
     (origin
       ;; The hex.pm package ships only the en locale.
@@ -300,7 +300,7 @@ based upon the Common Locale Data Repository (CLDR).")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1wgwp74ya0gkvd5pk4qv9s38p85r5yw370y4wv7jywy3hrbrj9f5"))))
+        (base32 "1rivy61aq0c9zfklm4bpvvkj7lzjgy316rwxl8qz92xqp6xa292y"))))
    (arguments
     (list
      #:phases
@@ -303,7 +303,17 @@ purposes.  Its goal is to be as close as possible to
     (list
      #:test-flags
      ;; These tests require network access to badssl.com.
-      #~(list "--exclude" "network")))
+      #~(list "--exclude" "network")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'make-reproducible
+            (lambda _
+              ;; Buffer size has been increased in OTP 28+. For more info see:
+              ;; https://github.com/erlang/otp/issues/9722#issuecomment-2808683303
+              (substitute* "test/httpoison_test.exs"
+                (("stream/20") "stream/100")
+                (("<= expected_length") "<= expected_length * 1.1")
+                ((">= max_length") ">= max_length * 0.9")))))))
    (native-inputs
     (list erlang-cowboy
           elixir-earmark
@@ -164,7 +164,8 @@ Mix.CLI.main()"
                       '("ERL_LIBS" prefix ("${GUIX_ELIXIR_LIBS}"))))
                   programs))))))))
    (outputs '("out" "src"))
-    (inputs (list bash-minimal erlang rebar3 git))
+    (inputs (list bash-minimal erlang rebar3))
+    (native-inputs (list git-minimal))
    (native-search-paths
     (list (search-path-specification
            (variable "GUIX_ELIXIR_LIBS")
@@ -62,7 +62,7 @@ as bold, underscore or italic.")
 (define-public emacs-buttercup
  (package
    (name "emacs-buttercup")
-    (version "1.38")
+    (version "1.40")
    (source
     (origin
       (method git-fetch)
@@ -72,9 +72,7 @@ as bold, underscore or italic.")
       (file-name (git-file-name name version))
       (sha256
        (base32
-         "09n8skr5wi8bs7x81d5bi6z89dd8s1zi9a5f4r2qadaz69slncxq"))
-       (patches
-        (search-patches "emacs-buttercup-1.38-native-comp-spy-on-trampoline-scope.patch"))))
+         "1b55cfh4wr40max2c42crvaa6wid7a83g28yximsin98i32q5f5r"))))
    (build-system emacs-build-system)
    (arguments
     (list
@@ -28,6 +28,7 @@
 ;;; Copyright © 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2025 Jake Forster <jakecameron.forster@gmail.com>
 ;;; Copyright © 2025 John Kehayias <john@guixotic.coop>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -869,7 +870,7 @@ Started in 2014 as a GSOC project, Guile-Emacs was resurrected in 2024.")
         "0vfw7z9i2s9np6nmx1d4dlsywm044rkaqarn7akffmb6bf1j6zv5"))))
    (build-system gnu-build-system)
    (native-inputs
-     `(("gettext" ,gettext-minimal)))
+     (list gettext-minimal))
    (arguments
     `(#:configure-flags
       (list (string-append "--with-charmaps="
@@ -1264,7 +1264,8 @@ Enjoy all of your favorite Atari 2600 games on your PC thanks to Stella!")
        (base32 "1xf15b6c3i0vv92b420a92pfvfaxhji56ivin8pn5r7fajkqyfb7"))))
    (build-system gnu-build-system)
    (native-inputs
-     (list pkg-config nasm which))
+     (cons* pkg-config which
+            (maybe-nasm)))
    (inputs
     (list freetype
           glu
@@ -1289,8 +1290,6 @@ Enjoy all of your favorite Atari 2600 games on your PC thanks to Stella!")
                      (list "all" (string-append "PREFIX=" out)))
       ;; There are no tests.
       #:tests? #f))
-    ;; As per the Makefile (in projects/unix/Makefile):
-    (supported-systems '("i686-linux" "x86_64-linux"))
    (home-page "https://www.mupen64plus.org/")
    (synopsis "Nintendo 64 emulator core library")
    (description
@@ -2164,7 +2163,9 @@ as RetroArch.")
              (lambda _
                (install-file "mupen64plus_next_libretro.so"
                              (string-append #$output "/lib/libretro/")))))))
-      (native-inputs (list nasm pkg-config))
+      (native-inputs
+       (cons* pkg-config
+              (maybe-nasm)))
      (inputs (list mesa libpng minizip unzip xxhash zlib))
      (home-page "https://github.com/libretro/mupen64plus-libretro-nx")
      (synopsis "Improved Mupen64Plus libretro core")
@@ -3452,7 +3453,7 @@ This is a part of the TiLP project.")
 (define-public mame
  (package
    (name "mame")
-    (version "0.252")
+    (version "0.287")
    (source
     (origin
       (method git-fetch)
@@ -3461,16 +3462,16 @@ This is a part of the TiLP project.")
             (commit (apply string-append "mame" (string-split version #\.)))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "07qhcm1v47sy2wj30nx3cbhvcbgki0cl83gabr0miiw60fhgyn6j"))
+        (base32 "1p9v71gvaqiyj6sa1b0wkdksa9wnr6yr2a43ckycljjfas5s36kq"))
       (modules '((guix build utils)))
       (snippet
        ;; Remove bundled libraries.
        '(begin
           (with-directory-excursion "3rdparty"
             (for-each delete-file-recursively
-                       '("asio" "expat" "glm" "libflac" "libjpeg" "lua"
-                         "portaudio" "portmidi" "pugixml" "rapidjson" "SDL2"
-                         "SDL2-override" "sqlite3" "utf8proc" "zlib")))))))
+                       '("asio" "expat" "glm" "flac" "libjpeg" "lua"
+                         "portaudio" "portmidi" "pugixml" "rapidjson"
+                         "sqlite3" "utf8proc" "zlib")))))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -3604,7 +3605,9 @@ This is a part of the TiLP project.")
           libjpeg-turbo
           libxi
           libxinerama
-           lua
+           ;; MAME requires Lua compiled as C++ to work correctly.
+           ;; See https://www.mamedev.org/?p=523
+           lua-5.4-for-c++
           portaudio
           portmidi
           pugixml
@@ -2730,7 +2730,7 @@ dynamics is used by FreeCAD 1.0.0 for its new Assembly workbench.")
 (define-public freecad
  (package
    (name "freecad")
-    (version "1.1.0")
+    (version "1.1.1")
    (source
     (origin
       (method git-fetch)
@@ -2740,7 +2740,7 @@ dynamics is used by FreeCAD 1.0.0 for its new Assembly workbench.")
             (recursive? #t)))          ;needed for the AddonManager
       (file-name (git-file-name name version))
       (sha256
-        (base32 "029ndw1dypx0xhs4fyiinf7gpk8am0vm9b24idvdsx9x7ghrqz4j"))
+        (base32 "05dx7ifx33705mxb0vc82j0mzzkazakgadfgq5bws30qrxp49xgg"))
       (snippet
        #~(begin
            (use-modules (guix build utils))
@@ -50,7 +50,7 @@
 (define-public erlang
  (package
    (name "erlang")
-    (version "27.3.4.6")
+    (version "28.4.3")
    (source (origin
              (method git-fetch)
              ;; The tarball from http://erlang.org/download contains many
@@ -62,7 +62,7 @@
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0dhz2c7w28ss0ypj7jh88pfs3kc8hbwiiq91in1j2miy5sn4cp3x"))
+                "1dsdmp2rccc0rhzy2w8r4amxmc6nr9hbi053j2s0bg9db30b48rc"))
              (patches (search-patches "erlang-man-path.patch"))))
    (build-system gnu-build-system)
    (native-inputs
@@ -75,7 +75,7 @@
                               "/OTP-" version "/otp_doc_man_" version ".tar.gz"))
           (sha256
            (base32
-             "1j1fcli7ma9vi4qyv67lq7yiznhpnfvcmh57bn8qxvha6ky2pngm"))))))
+             "1g17wzv8j12g9272yvv55nj4wqs09hxkv3i0vnp7d6gcs24bmphi"))))))
    (inputs
     (list ncurses openssl wxwidgets))
    (propagated-inputs
@@ -220,6 +220,7 @@ testing InfiniBand networks.")
                           "--disable-assertions"
                           "--disable-params-check"

+                           "--enable-mt"
                           (string-append "--with-verbs="
                                          #$(this-package-input "rdma-core"))

@@ -148,6 +148,11 @@ client.")
     (list (search-path-specification
            (variable "FCITX_ADDON_DIRS")
            (files '("lib/fcitx5")))
+           (search-path-specification
+            (variable "GUIX_GTK2_IM_MODULE_FILE")
+            (file-type 'regular)
+            (separator #f)
+            (files '("lib/gtk-2.0/2.10.0/immodules-gtk2.cache")))
           (search-path-specification
            (variable "GUIX_GTK3_IM_MODULE_FILE")
            (file-type 'regular)
@@ -1128,8 +1128,8 @@ transaction log.
     (inherit jfsutils)
     (name "jfsutils-static")
     (inputs
-      `(("util-linux:static" ,util-linux "static")
-        ,@(package-inputs jfsutils))))))
+      (modify-inputs inputs
+        (prepend (list util-linux "static")))))))

 (define-public jfs_fsck/static
  (package
@@ -165,7 +165,7 @@
  ;; <https://bitcoincore.org/en/lifecycle/#schedule>.
  (package
    (name "bitcoin-core")
-    (version "30.2")
+    (version "31.0")
    (source (origin
              (method url-fetch)
              (uri
@@ -173,7 +173,7 @@
                              version "/bitcoin-" version ".tar.gz"))
              (sha256
               (base32
-                "1jw4djh22v0nih0n7irdbknfbqavlc4l3b8176b5qgc88a60pl3g"))))
+                "1qxkcyq8nwq6sw4qi660z8n8356mqdsf4jvpq5ndkvrsx9gfz80b"))))
    (build-system qt-build-system)
    (arguments
     (list #:qtbase qtbase
@@ -197,9 +197,7 @@
                    "python3" "./test/functional/test_runner.py" "--timeout-factor=2"
                    (string-append "--jobs=" (number->string (parallel-job-count)))))))))
    (native-inputs
-     (list bash ; provides the sh command for system_tests
-           coreutils ; provides the cat, echo and false commands for system_tests
-           pkg-config
+     (list pkg-config
           python ; for the tests
           python-pyzmq ; for the tests
           qttools))
@@ -323,41 +321,37 @@ based on Qt.")
 (define-public ghc-hledger
  (package
    (name "ghc-hledger")
-    (version "1.43.2")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "hledger" version))
-       (sha256
-        (base32 "043gw3amc29fbjxlzyc4m97bw5i5462352lmk61adlxcd12l47i1"))))
+    (version "1.27.1")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "hledger" version))
+              (sha256
+               (base32
+                "0qdg87m7ys2ykqqq32p7h7aw827w4f5bcqx4dspxxq6zqlvzddqb"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hledger")))
    (inputs (list ghc-decimal
                  ghc-diff
                  ghc-aeson
                  ghc-ansi-terminal
+                  ghc-breakpoint
                  ghc-cmdargs
                  ghc-data-default
                  ghc-extra
                  ghc-githash
                  ghc-hashable
                  ghc-hledger-lib
-                  ghc-http-client
-                  ghc-http-types
                  ghc-lucid
                  ghc-math-functions
                  ghc-megaparsec
                  ghc-microlens
-                  ghc-modern-uri
                  ghc-regex-tdfa
-                  ghc-req
                  ghc-safe
                  ghc-shakespeare
                  ghc-split
                  ghc-tabular
                  ghc-tasty
                  ghc-temporary
-                  ghc-text-ansi
                  ghc-timeit
                  ghc-unordered-containers
                  ghc-utf8-string
@@ -388,8 +382,8 @@ Accounting.")
      #~(modify-phases %standard-phases
          (add-after 'install 'install-doc
            (lambda _
-              (install-file "embeddedfiles/hledger.info" (string-append #$output "/share/info"))
-              (install-file "embeddedfiles/hledger.1" (string-append #$output "/man/man1"))))
+              (install-file "hledger.info" (string-append #$output "/share/info"))
+              (install-file "hledger.1" (string-append #$output "/man/man1"))))
           (add-after 'register 'remove-libraries
             (lambda* (#:key outputs #:allow-other-keys)
               (delete-file-recursively (string-append (assoc-ref outputs "out") "/lib")))))))))
@@ -2312,13 +2306,13 @@ textual ledgers to Beancount files.")
 (define-public hledger-web
  (package
    (name "hledger-web")
-    (version "1.43.2")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "hledger-web" version))
-       (sha256
-        (base32 "0d4sv9k3m7s0764lbq2l8w9p2p47cby177l0avl5w3fa9y8d0gyd"))))
+    (version "1.27.1")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "hledger-web" version))
+              (sha256
+               (base32
+                "151dxci7dld8626dzw823sr3d9iaac92wfzbfcbdz4jh9f7n07wa"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hledger-web")))
    (inputs (list ghc-decimal
@@ -2326,6 +2320,7 @@ textual ledgers to Beancount files.")
                  ghc-base64
                  ghc-blaze-html
                  ghc-blaze-markup
+                  ghc-breakpoint
                  ghc-case-insensitive
                  ghc-clientsession
                  ghc-cmdargs
@@ -2333,8 +2328,6 @@ textual ledgers to Beancount files.")
                  ghc-conduit-extra
                  ghc-data-default
                  ghc-extra
-                  ghc-file-embed
-                  ghc-githash
                  ghc-hjsmin
                  ghc-hledger
                  ghc-hledger-lib
@@ -2344,7 +2337,6 @@ textual ledgers to Beancount files.")
                  ghc-http-types
                  ghc-megaparsec
                  ghc-network
-                  ghc-safe
                  ghc-shakespeare
                  ghc-unix-compat
                  ghc-unordered-containers
@@ -1159,10 +1159,10 @@ Executables included are:
      (native-inputs
       (append
         (list acpica
-               nasm
               perl
               python-3
               (list util-linux "lib"))
+         (maybe-nasm (string-append arch "-" arch))
         (if (not (string-prefix? arch (%current-system)))
             (if (string=? arch "armhf")
                 (list (cross-gcc "arm-linux-gnueabihf")
@@ -4658,46 +4658,6 @@ is a stylish type with a polished yet relaxed feel.  Its versatility makes it
 suitable for a wide range of uses.")
      (license license:silofl1.1))))

-(define-public font-cozette
-  (package
-    (name "font-cozette")
-    (version "1.13.0")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/slavfox/Cozette")
-                     (commit (string-append "v." version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "178i812n4sfsvid7jhnm683jlxqmrv4ck6qbb4nwyllhwg3gyq60"))))
-    (build-system font-build-system)
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'dont-depend-on-git
-           (lambda _
-             (substitute* "build.py"
-               ;; Merely importing this module requires a git repository.
-               ;; We don't use get_changelog, so just disable the import.
-               (("from cozette_builder\\.changeloggen import get_changelog")
-                ""))))
-         (add-before 'install 'build
-           (lambda _
-             (invoke "python3" "build.py" "fonts"))))))
-    (native-inputs
-     (list fontforge
-           python
-           python-crayons
-           python-fonttools
-           python-numpy
-           python-pillow))
-    (home-page "https://github.com/slavfox/Cozette")
-    (synopsis "Bitmap programming font")
-    (description "Cozette is a 6x13px (bounding box) bitmap font based on Dina
-and heavily inspired by Creep.")
-    (license license:expat)))
-
 (define-public font-montserrat
  (package
    (name "font-montserrat")
@@ -5559,6 +5519,39 @@ technical and idiosyncratic feel—perfect for headers and pull-quotes.  Made to
 work well together with Mona Sans.")
    (license license:silofl1.1)))

+(define-public font-open-sans
+  (package
+    (name "font-open-sans")
+    (version "3.003")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/googlefonts/opensans")
+             (commit "bd7e37632246368c60fdcbd374dbf9bad11969b6")))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1mlnybaci1cr8z5xzxm7l2xpwfq27x9hqv649hc2ni1cjsyhpjp8"))))
+    (build-system font-build-system)
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (replace 'install
+            (lambda* (#:key outputs #:allow-other-keys)
+              ;; Install the variable fonts only.
+              (let ((%install (assoc-ref %standard-phases 'install)))
+                (with-directory-excursion "fonts/variable"
+                  (%install #:outputs outputs))))))))
+    (home-page "https://github.com/googlefonts/opensans")
+    (synopsis "Humanist sans-serif typeface by Steve Matteson")
+    (description
+     "Open Sans is an open source humanist sans-serif typeface
+that was designed by Steve Matteson under commission from Google.  It was
+released in 2011 and is based on his earlier design called Droid Sans, which
+was specifically created for Android mobile devices but with slight
+modifications to its width.")
+    (license license:silofl1.1)))

 (define-public font-peppercarrot
  (package
@@ -43,6 +43,7 @@
 ;;; Copyright © 2024 Janneke Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2025 wvlab <me@wvlab.xyz>
 ;;; Copyright © 2025 jgart <jgart@dismail.de>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -3053,10 +3054,10 @@ useful with system integration.")
         "0zs4z7l9b57jldwz0ban77f3c2zq43ambd0dssf5qg9i216f9lmj"))))
    (build-system gnu-build-system)
    (native-inputs
-     `(("dbus-test-runner" ,dbus-test-runner)
-       ("glib:bin" ,glib "bin")
-       ("pkg-config" ,pkg-config)
-       ("xvfb" ,xorg-server-for-tests)))
+     (list dbus-test-runner
+           (list glib "bin")
+           pkg-config
+           xorg-server-for-tests))
    (inputs
     (list gtk+ glib))
    (arguments
@@ -3417,50 +3418,50 @@ interfaces.")
 (define-public xdg-desktop-portal-wlr
  (package
    (name "xdg-desktop-portal-wlr")
-    (version "0.7.1")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/emersion/xdg-desktop-portal-wlr")
-                     (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "1mbq3czka9swwmfaasnaj89y2m254p3qa522ayclh688jdwh70hq"))
-              (patches (search-patches "xdg-desktop-portal-wlr-harcoded-length.patch"))))
+    (version "0.8.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/emersion/xdg-desktop-portal-wlr")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1jj0a9s3h3i04qsxkhcpxjzbb17hs9ngdy7wkypja09233zdz10w"))
+       (patches (search-patches "xdg-desktop-portal-wlr-harcoded-length.patch"))))
    (build-system meson-build-system)
    (arguments
-     `(#:configure-flags
-       '("-Dsystemd=disabled"
-         "-Dsd-bus-provider=libelogind")
-       #:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'hardcode-binaries
-           (lambda* (#:key inputs #:allow-other-keys)
-             (let ((sh (search-input-file inputs "/bin/sh"))
-                   (grim (search-input-file inputs "/bin/grim"))
-                   (slurp (search-input-file inputs "/bin/slurp")))
-               (substitute* "src/screenshot/screenshot.c"
-                 (("grim") grim)
-                 (("slurp") slurp)
-                 (("execl\\(\"/bin/sh\", \"/bin/sh\"")
-                  (string-append "execl(\"" sh "\", \"" sh "\"")))
-               (substitute* "src/screencast/screencast.c"
-                 (("execvp\\(\"sh")
-                  (string-append "execvp(\"" sh))))))
-         (add-after 'install 'install-documentation
-           (lambda* (#:key outputs #:allow-other-keys)
-             (install-file "../source/README.md"
-                           (string-append (assoc-ref outputs "out")
-                                          "/share/doc/" ,name)))))))
-    (native-inputs
-     (list cmake-minimal pkg-config))
-    (inputs (list elogind
-                  bash-minimal
+     (list
+      #:configure-flags
+      #~(list "-Dsystemd=disabled"
+              "-Dsd-bus-provider=libelogind")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'hardcode-binaries
+            (lambda* (#:key inputs #:allow-other-keys)
+              (let ((sh (search-input-file inputs "/bin/sh"))
+                    (grim (search-input-file inputs "/bin/grim"))
+                    (slurp (search-input-file inputs "/bin/slurp")))
+                (substitute* '("src/screencast/chooser.c"
+                               "src/screenshot/screenshot.c")
+                  (("grim") grim)
+                  (("slurp") slurp)
+                  (("/bin/sh") sh))
+                (substitute* "src/screencast/screencast.c"
+                  (("execvp\\(\"sh")
+                   (format #f "execvp(\"~a" sh))))))
+          (add-after 'install 'install-documentation
+            (lambda _
+              (install-file "../source/README.md"
+                            (string-append #$output "/share/doc/"
+                                           #$name)))))))
+    (native-inputs (list cmake-minimal pkg-config scdoc))
+    (inputs (list bash-minimal
+                  elogind
                  grim
                  iniparser
-                  mesa
                  libinih
+                  mesa
                  pipewire
                  slurp
                  wayland
@@ -552,14 +552,14 @@ use with @code{udev-service-type}.")
 (define-public armagetronad
  (package
    (name "armagetronad")
-    (version "0.2.9.2.3")
+    (version "0.2.9.3.0")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://sourceforge/armagetronad/stable/"
                                  version "/armagetronad-" version ".tbz"))
              (sha256
               (base32
-                "0a6rlp2lj5bp7pg1yf8brjyb3mw7nqp3amj19wvz3xni21bbc31k"))))
+                "1q1zlbhbcimr6bw0ms1pr8hz4q850ivi3hvxn3467jfgiq22f3cy"))))
    (build-system gnu-build-system)
    (arguments
     (list #:configure-flags
@@ -576,6 +576,7 @@ use with @code{udev-service-type}.")
                     (("^install_link .*BINDIR.*") "")))))))
    (native-inputs (list pkg-config))
    (inputs (list libxml2
+                  curl
                  (sdl-union (list sdl sdl-image sdl-mixer))
                  freeglut
                  libpng
@@ -3407,7 +3408,8 @@ and defeat them with your bubbles!")
                                 "SamTSE/Sources/Engine/Engine.cpp")
                (("@OUTPUT_DIR@") #$output)))))))
    (inputs (list sdl2 libvorbis))
-    (native-inputs (list flex bison nasm imagemagick))
+    (native-inputs (cons* flex bison imagemagick
+                          (maybe-nasm)))
    (home-page "https://github.com/tx00100xt/SeriousSamClassic")
    (synopsis "SeriousSam engine and Serious Sam: TFE and TSE")
    (description
@@ -4128,7 +4130,7 @@ a C library, so they can easily be integrated into other programs.")
 (define-public taisei
  (package
    (name "taisei")
-    (version "1.4.2")
+    (version "1.4.4")
    (source
     (origin
       (method url-fetch)
@@ -4136,7 +4138,7 @@ a C library, so they can easily be integrated into other programs.")
                           "taisei/releases/download/v" version
                           "/taisei-" version ".tar.xz"))
       (sha256
-        (base32 "19sgm175clkvpcv0b9p4jkjpfxqw0kyl2i5p8w63kwzqcjp9m1jx"))))
+        (base32 "13b2ha8nsdzbydirvc7hw1q46jzhn6cx9b9spgk777swjlgx2vph"))))
    (build-system meson-build-system)
    (arguments
     (list
@@ -4145,7 +4147,8 @@ a C library, so they can easily be integrated into other programs.")
                                "-Dr_gles30=enabled"
                                "-Dshader_transpiler=enabled")))
    (native-inputs
-     (list pkg-config
+     (list cmake-minimal
+           pkg-config
           python
           python-docutils
           python-pygments
@@ -4153,24 +4156,29 @@ a C library, so they can easily be integrated into other programs.")
    (inputs
     (list cglm
           freetype
+           glslang
+           libdecor                     ; XXX: for sdl3
           libpng
           libwebp
           libzip
           mesa
           openssl
           opusfile
-           sdl2
-           sdl2-mixer
+           sdl3
           shaderc
           spirv-cross
+           spirv-tools                  ; for glslang
+           vulkan-loader                ; XXX: for sdl3?
           zlib
           (list zstd "lib")))
    (home-page "https://taisei-project.org/")
    (synopsis "Shoot'em up fangame and libre clone of Touhou Project")
    (description
-     "The player controls a character (one of three: Good, Bad, and Dead),
-dodges the missiles (lots of it cover the screen, but the character's hitbox
-is very small), and shoot at the adversaries that keep appear on the screen.")
+     "Taisei is a vertical shoot'em up game, in which the player controls
+one of three characters.  While moving through stages, a large number of
+enemies and even larger amounts of bullets appear that require careful
+maneuvers to dodge.  By shooting the enemies, players receive powerups
+for their characters, allowing them to shoot even more.")
    (license (list
              ;; game
              license:expat
@@ -4723,6 +4731,10 @@ for common mesh file formats, and collision detection.")
                      (url "https://github.com/thelaui/M.A.R.S.")
                      (commit commit)))
                (file-name (git-file-name name version))
+                (modules '((guix build utils)))
+                (snippet
+                 #~(begin
+                     (delete-file-recursively "ext_libs_for_windows")))
                (sha256
                 (base32
                  "0bdi4ja39rark742qvqixm8khai5k8qd84z5kzim9jcjdvvwyqj9"))))
@@ -4749,7 +4761,8 @@ for common mesh file formats, and collision detection.")
 attractive physics.  Players can battle each other or computer controlled
 enemies in different game modes such as space ball, death match, team death
 match, cannon keep, and grave-itation pit.")
-      (license license:gpl3+))))
+      (license (list license:gpl3+
+                     license:cc-by-sa3.0))))) ;/data/audio/music

 (define-public alienblaster
  (package
@@ -5344,7 +5357,9 @@ also available.")
                   (with-directory-excursion "src"
                     (substitute* "CMakeLists.txt"
                       (("glm::glm")
-                        "glm")))))))
+                        "glm")))
+                   ;; Rename the icon to match with the executable file.
+                   (rename-file "srb2.png" "ringracers.png")))))
    (build-system cmake-build-system)
    (arguments
     (list
@@ -5354,15 +5369,30 @@ also available.")
              "-DCMAKE_CXX_FLAGS_RELWITHDEBINFO='-O3 -g -DNDEBUG'")
      #:phases
      #~(modify-phases %standard-phases
-          (add-after 'install 'move-and-wrap-binary
+          (replace 'install
+            (lambda _
+              (install-file "bin/ringracers" (string-append #$output "/bin"))
+              (install-file "../source/ringracers.png"
+                            (string-append #$output "/share/pixmaps"))))
+          (add-after 'install 'wrap-program
            ;; Install executable to $out/bin.
            (lambda* (#:key inputs #:allow-other-keys)
-              (with-directory-excursion #$output
-                (mkdir "bin")
-                (rename-file "ringracers" "bin/ringracers")
-                (wrap-program "bin/ringracers"
-                  `("RINGRACERSWADDIR" =
-                    (,(assoc-ref inputs "ring-racers-data"))))))))))
+              (wrap-program "bin/ringracers"
+                `("RINGRACERSWADDIR" =
+                  (,(assoc-ref inputs "ring-racers-data"))))))
+          (add-after 'wrap-program 'create-desktop-entry
+            (lambda _
+              (let* ((datadir (string-append #$output "/share"))
+                     (appdir (string-append datadir "/applications")))
+                (mkdir-p appdir)
+                (make-desktop-entry-file (string-append appdir
+                                                        "/ringracers.desktop")
+                  #:name "Dr. Robotnik's Ring Racers"
+                  #:comment "Technical kart racing game"
+                  #:icon "ringracers"
+                  #:exec (string-append #$output "/bin/ringracers")
+                  #:startup-notify #f
+                  #:categories '("Application" "Game"))))))))
    (native-inputs (list pkg-config))
    (inputs (list glm
                  libogg
@@ -5534,23 +5564,13 @@ falling, themeable graphics and sounds, and replays.")
    (build-system cmake-build-system)
    (arguments
     (list #:tests? #f                  ;no test target
-           #:configure-flags #~'("-DENABLE_SYSTEM_LUA=ON")
-           #:phases
-           #~(modify-phases %standard-phases
-               (add-before 'configure 'pre-configure
-                 (lambda _
-                   ;; XXX: Our Lua doesn't have a C++ library, force C linkage.
-                   (substitute* '("src/lua/wrapper_lua.h"
-                                  "src/lua/wrapper_lualib.h"
-                                  "src/lua/wrapper_lauxlib.h")
-                     (("#include \"(lua|lualib|lauxlib)\\.h\"")
-                      "#include \"lua.hpp\"")))))))
+           #:configure-flags #~'("-DENABLE_SYSTEM_LUA=ON")))
    (inputs
     (list boost-1.83
           curl
           dbus
           libvorbis
-           lua-5.4
+           lua-5.4-for-c++
           openssl
           pango
           sdl2
@@ -5937,7 +5957,7 @@ Transport Tycoon Deluxe.")
          (add-after 'unpack 'patch-sources
            (lambda* (#:key inputs #:allow-other-keys)
              (substitute* "src/music/fluidsynth.cpp"
-                (("default_sf\\[\\] = \\{" all)
+                (("_default_soundfonts\\[\\] = \\{" all)
                 (string-append all "
 \t/* Guix hardcoded :P */
 \t\"" (search-input-file inputs "/share/soundfonts/FreePatsGM.sf2") "\",
@@ -5964,7 +5984,7 @@ Transport Tycoon Deluxe.")
  (package
    (inherit openttd)
    (name "openttd-jgrpp")
-    (version "0.70.2")
+    (version "0.71.2")
    (source
     (origin
       (method git-fetch)
@@ -5973,7 +5993,7 @@ Transport Tycoon Deluxe.")
             (commit (string-append "jgrpp-" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1jzzvribf2cqvjl9cympyx9qpplljvmhqrrlw7aq4ckzl92d87z3"))))
+        (base32 "1gb5gickmf1d1wkzqny5ryapvw32a2g94f77iq0102xhyyw8g8s0"))))
    (inputs (modify-inputs inputs
              (append zstd harfbuzz)))
    (arguments
@@ -13508,8 +13528,8 @@ rules to solve permissions issues.")

 (define-public steam-devices-udev-rules
  ;; Last release from 2019-04-10
-  (let ((commit "13443480a64fe8f10676606bd57da6de89f8ccb1")
-        (revision "1"))
+  (let ((commit "7dde9ecb3c386363ecd9bd0a3b77e4756d200704")
+        (revision "2"))
    (package
      (name "steam-devices-udev-rules")
      (version (git-version "1.0.0.61" revision commit))
@@ -13521,7 +13541,7 @@ rules to solve permissions issues.")
                (file-name (git-file-name name version))
                (sha256
                 (base32
-                  "0i086gmnk93q76sw1laa9br6b7zj2r6nrrw7d64y4q9wcrlxw2bi"))))
+                  "0w0xkgi9fpvdbpl57f8fy2nwy2icm6iag39b8ifpkijlxgclx1p3"))))
      (build-system copy-build-system)
      (arguments
       '(#:install-plan '(("./" "lib/udev/rules.d"
@@ -425,14 +425,29 @@ hierarchical hexagonal geospatial indexing system")
               (base32
                "00qdk9a4048pzfj2rhzkfw3lvm642znf6kr4x29i3d94494pxsnn"))))
    (build-system cmake-build-system)
-    (arguments `(#:phases
-                 (modify-phases %standard-phases
-                   (add-after
-                    'unpack 'patch-test-shebangs
-                    (lambda _
-                      (substitute* '("tests/xmltester/testrunner.sh"
-                                     "tests/xmltester/safe_to_xml.sh")
-                        (("/bin/sh") (which "sh"))))))))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         ,@(if (or (target-x86-32?) (target-arm32?))
+               '((add-after 'unpack 'disable-broken-tests
+                   (lambda _
+                     ;; This test fails due to limited accuracy.
+                     (delete-file "tests/xmltester/tests/general/TestCentroid.xml")
+                     (with-directory-excursion "tests/unit"
+                       ;; These also fail due to limited accuracy.
+                       (delete-file "algorithm/MinimumAreaRectangleTest.cpp")
+                       (delete-file "capi/GEOSMinimumRotatedRectangleTest.cpp")
+                       ;; It is unclear why these fail, but I'm guessing:
+                       ;; limited accuracy.
+                       (delete-file "linearref/LengthIndexedLineTest.cpp")
+                       (delete-file "math/DDTest.cpp")))))
+               '())
+         (add-after
+             'unpack 'patch-test-shebangs
+           (lambda _
+             (substitute* '("tests/xmltester/testrunner.sh"
+                            "tests/xmltester/safe_to_xml.sh")
+               (("/bin/sh") (which "sh"))))))))
    (inputs
     (list glib))
    (home-page "https://libgeos.org/")
@@ -955,6 +970,29 @@ hydrology and waste deposition.")
        (base32
         "03r6mspfv22fs4x4jcgv25v9gsj5k6zy8incvyf94qf50g47s2bc"))))
    (build-system cmake-build-system)
+    (arguments
+     (if (target-32bit?)
+         (list
+          #:phases
+          '(modify-phases %standard-phases
+             (add-after 'unpack 'patch-tests
+               (lambda _
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/unit/test_factory.cpp"
+                   (("^TEST\\(factory, AuthorityFactory_createUnitOfMeasure_linear_us_survey_foot\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_grids.cpp"
+                   (("^TEST_F\\(GridTest, VerticalShiftGridSet_gtx\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_defmodel.cpp"
+                   (("^TEST\\(defmodel, evaluator_horizontal_unit_metre\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/CMakeLists.txt"
+                   (("proj_add_gie_test\\(\"4D-API-cs2cs-style\".+") "")
+                   (("proj_add_gie_test\\(\"Builtins\".+") "")
+                   (("proj_add_gie_test\\(\"peirce_q\".+") ""))))))
+         '()))
    (native-inputs (list googletest pkg-config))
    (propagated-inputs (list curl libtiff sqlite)) ;required by proj.pc
    (home-page "https://proj.org/")
@@ -984,7 +1022,34 @@ lets developers use the functionality of Proj in their own software.")
                           version ".tar.gz"))
       (sha256
        (base32
-         "1g0hkpiablvhsmw0kn5frwgdir3q7avc45p6lc1zhhhzkv5ikydh"))))))
+         "1g0hkpiablvhsmw0kn5frwgdir3q7avc45p6lc1zhhhzkv5ikydh"))))
+    (arguments
+     (if (target-32bit?)
+         (list
+          #:phases
+          '(modify-phases %standard-phases
+             (add-after 'unpack 'patch-tests
+               (lambda _
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/unit/test_factory.cpp"
+                   (("^TEST\\(factory, AuthorityFactory_createUnitOfMeasure_linear_us_survey_foot\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_grids.cpp"
+                   (("^TEST_F\\(GridTest, VerticalShiftGridSet_gtx\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_defmodel.cpp"
+                   (("^TEST\\(defmodel, evaluator_horizontal_unit_metre\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/CMakeLists.txt"
+                   (("proj_add_gie_test\\(\"4D-API-cs2cs-style\".+") "")
+                   (("proj_add_gie_test\\(\"Builtins\".+") "")
+                   (("proj_add_gie_test\\(\"peirce_q\".+") "")
+                   (("proj_add_gie_test\\(\"adams_ws2\".+") ""))
+                 (substitute* "test/cli/CMakeLists.txt"
+                   (("proj_add_test_script_sh\\(\"testvarious\" CS2CS_BIN\\)") ""))))))
+         '()))))
+

 (define-public python-obspy
  (package
@@ -1219,20 +1284,23 @@ readily with other Python GIS packages such as pyproj, Rtree, and Shapely.")
 (define-public python-geopack
  (package
    (name "python-geopack")
-    (version "1.0.10")
+    (version "1.0.12")
    (source
     (origin
-       (method url-fetch)
-       (uri (pypi-uri "geopack" version))
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/tsssss/geopack")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
       (sha256
-        (base32 "0mryjp7m4h99qlpvnn40s81sygr73qcv8rkmjp9pcli1gz829kjf"))))
+        (base32 "0ap5j4359xxjkbz06y097yq5d37sxcwlnlsfwrv6dvza7ydmgcgg"))))
    (build-system pyproject-build-system)
    (arguments
     (list
      ;; XXX Reported upstream <https://github.com/tsssss/geopack/issues/21>.
      #:tests? #f))
    (native-inputs
-     (list python-pytest python-setuptools python-wheel))
+     (list python-setuptools))
    (propagated-inputs
     (list python-numpy python-scipy))
    (home-page "https://github.com/tsssss/geopack")
@@ -1,7 +1,4 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
-;;; Copyright © 2018, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -19,44 +16,8 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu packages gkrellm)
-  #:use-module (guix build-system gnu)
-  #:use-module (guix download)
-  #:use-module (guix gexp)
-  #:use-module ((guix licenses) #:prefix license:)
-  #:use-module (guix packages)
-  #:use-module (guix utils)
-  #:use-module (gnu packages gettext)
-  #:use-module (gnu packages gtk)
-  #:use-module (gnu packages pkg-config)
-  #:use-module (gnu packages xorg))
+  #:use-module (gnu packages monitoring)
+  #:use-module (guix deprecation))

-(define-public gkrellm
-  (package
-    (name "gkrellm")
-    (version "2.5.1")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (string-append "https://gkrellm.srcbox.net/releases/gkrellm-"
-                           version ".tar.bz2"))
-       (sha256
-        (base32 "0qvy2xmwmfy5f0g09yn9lr262shnx82ba04r5il2wj4qscg3r7h8"))))
-    (build-system gnu-build-system)
-    (inputs (list gtk+-2 libsm))
-    (native-inputs (list gettext-minimal pkg-config))
-    (arguments
-     (list
-      #:tests? #f ;there is no check target
-      #:phases
-      #~(modify-phases %standard-phases
-          (delete 'configure)) ;no configure script
-      #:make-flags
-      #~(list (string-append "INSTALLROOT=" #$output)
-              (string-append "CC=" #$(cc-for-target)))))
-    (home-page "https://gkrellm.srcbox.net/")
-    (synopsis "System monitors")
-    (description
-     "GKrellM is a single process stack of system monitors which supports
-applying themes to match its appearance to your window manager, Gtk, or any
-other theme.")
-    (license license:gpl3+)))
+(define-deprecated/public-alias gkrellm
+  (@ (guix packages monitoring) gkrellm))
@@ -1335,6 +1335,74 @@ animation of closing windowed applications.")
 GNOME Shell, including the top panel, dash and overview.")
    (license license:gpl3)))

+(define-public gnome-shell-extension-caffeine
+  (package
+    (name "gnome-shell-extension-caffeine")
+    (version "59")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url
+              "https://github.com/eonpatapon/gnome-shell-extension-caffeine")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0sv0iqfb6kjhgcg4pb59n91dyf667vax96kfhz5ik5hhx9n0z43w"))))
+    (build-system copy-build-system)
+    (arguments
+     (list
+      #:install-plan
+      #~'(("caffeine@patapon.info"
+           "share/gnome-shell/extensions/caffeine@patapon.info"
+           #:include-regexp ("icons" "locale" "preferences" "schemas"
+                             "\\.js(on)?$")))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'install 'compile-schemas
+            (lambda _
+              (with-directory-excursion "caffeine@patapon.info/schemas"
+                (invoke "glib-compile-schemas" ".")))))))
+    (native-inputs (list `(,glib "bin")))
+    (synopsis "Disable screensaver and auto suspend in Gnome")
+    (description "This extension provides a quick setting toggle to enable or
+disable the Gnome auto-suspend and screensaver.")
+    (home-page "https://github.com/eonpatapon/gnome-shell-extension-caffeine")
+    (license license:gpl2+)))
+
+(define-public gnome-shell-extension-hot-edge
+  (package
+    (name "gnome-shell-extension-hot-edge")
+    (version "27")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/jdoda/hotedge")
+             (commit "90e9cdd6f2a171a676a96a4e6ad0126316317e4d")))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "08jqz6n04yvqa77930sghgip5qfj8i4dm8wsm5cqjc4sqm4pn9yy"))))
+    (build-system copy-build-system)
+    (arguments
+     (list
+      #:install-plan
+      #~'(("." "share/gnome-shell/extensions/hotedge@jonathan.jdoda.ca"
+           #:include-regexp ("\\.css$" "\\.js(on)?$" "schemas")))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'install 'compile-schemas
+            (lambda _
+              (with-directory-excursion "schemas"
+                (invoke "glib-compile-schemas" ".")))))))
+    (native-inputs (list `(,glib "bin")))
+    (synopsis "Add a hot edge to the bottom of the screen in Gnome")
+    (description
+     "Add a hot edge that activates the overview to the bottom of the screen.
+This provides a better mouse-based workflow and can be an alternative to a dock.")
+    (home-page "https://github.com/jdoda/hotedge")
+    (license license:gpl2+)))
+
 (define-public gnome-shell-extension-radio
  (let ((commit "860e55b9e704eb3dde43e6bbeccec5748242498e")
        (revision "0"))
@@ -2598,6 +2598,92 @@ of Evince is to replace the multiple document viewers that exist
 on the GNOME Desktop with a single simple application.")
    (license license:gpl2+)))

+(define-public papers
+  (package
+    (name "papers")
+    (version "50.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnome/sources/papers/"
+                                  (version-major version) "/"
+                                  "papers-" version ".tar.xz"))
+              (sha256
+               (base32 "01dws72fb19i9jwp3r0khr7ym2ns51fifdzafb5dcr5w8vmj06rh"))))
+    (build-system meson-build-system)
+    (arguments
+     (list
+      #:glib-or-gtk? #t
+      #:configure-flags
+      #~(list (string-append "-Dc_link_args=-Wl,-rpath=" #$output "/lib"))
+      #:imported-modules `(,@%meson-build-system-modules
+                           ,@%cargo-build-system-modules)
+      #:modules `(((guix build cargo-build-system) #:prefix cargo:)
+                  (guix build meson-build-system)
+                  (guix build utils))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'prepare-for-build
+            (lambda _
+              (substitute* "meson.build"
+                (("gtk_update_icon_cache: true")
+                 "gtk_update_icon_cache: false")
+                (("update_desktop_database: true")
+                 "update_desktop_database: false"))
+              (substitute* "meson.build"
+                (("'Cargo.lock',")
+                  ""))
+              (delete-file "Cargo.lock")))
+          (add-after 'configure 'prepare-cargo-build-system
+            (lambda args
+              (for-each
+               (lambda (phase)
+                 (format #t "Running cargo phase: ~a~%" phase)
+                 (apply (assoc-ref cargo:%standard-phases phase)
+                        #:vendor-dir "vendor"
+                        #:cargo-target #$(cargo-triplet)
+                        args))
+               '(unpack-rust-crates
+                 configure
+                 check-for-pregenerated-files
+                 patch-cargo-checksums))
+
+              (setenv "RUSTFLAGS"
+                      (string-append (or (getenv "RUSTFLAGS") "")
+                                     " -C link-arg=-Wl,-rpath,"
+                                     #$output "/lib")))))))
+    (native-inputs
+     (cons* blueprint-compiler
+            gettext-minimal
+            `(,glib "bin")
+            gobject-introspection
+            gi-docgen
+            itstool
+            pkg-config
+            rust
+            `(,rust "cargo")
+            (or (and=> (%current-target-system)
+                       (compose list make-rust-sysroot))
+                '())))
+    (inputs
+     (cons* appstream
+            djvulibre
+            exempi
+            gtk
+            libadwaita
+            libarchive
+            libspelling
+            libtiff
+            nautilus                    ; for nautilus extension
+            poppler-next
+            zlib
+            (cargo-inputs 'papers)))
+    (home-page "https://apps.gnome.org/Papers")
+    ;; TODO: drop “new” when updating to GNOME 49 or newer.
+    (synopsis "GNOME's new document viewer")
+    (description "Papers is a document viewer capable of displaying multiple
+and single page document formats like PDF and DejaVu.")
+    (license license:gpl2+)))
+
 (define-public gsettings-desktop-schemas
  (package
    (name "gsettings-desktop-schemas")
@@ -10542,7 +10628,6 @@ playing media, scanning, and much more.")
           cheese
           decibels
           epiphany
-           evince
           file-roller
           gnome-calculator
           gnome-calendar
@@ -10562,6 +10647,7 @@ playing media, scanning, and much more.")
           localsearch
           loupe
           nautilus
+           papers
           simple-scan
           showtime
           xdg-desktop-portal-gnome
@@ -10588,6 +10674,7 @@ playing media, scanning, and much more.")
                            system-config-printer
                            xdg-desktop-portal
                            xdg-user-dirs
+                            xdg-user-dirs-gtk
                            yelp
                            zenity))
   (description "This package provides a list of packages required for
@@ -11489,7 +11576,8 @@ accessibility infrastructure.")
                    name "-" version ".tar.xz"))
              (sha256
               (base32
-                "0sfs06f66dsibvnp87jshhs7n3f8shkn9x7j3ygpk8409za2n2xy"))))
+                "0sfs06f66dsibvnp87jshhs7n3f8shkn9x7j3ygpk8409za2n2xy"))
+              (patches (search-patches "orca-fix-gst-init-check-call.patch"))))
    (build-system meson-build-system)
    (arguments
     '(#:glib-or-gtk? #t
@@ -11507,10 +11595,7 @@ accessibility infrastructure.")
                   (pgrep (string-append
                           (assoc-ref inputs "procps") "/bin/pgrep")))
               (substitute* "src/orca/orca_modifier_manager.py"
-                 (("'xkbcomp'") (format #f "'~a'" xkbcomp)))
-               (substitute* "src/orca/debug.py"
-                 (("'pgrep %s'")
-                  (format #f "'~a %s'" pgrep)))
+                 (("\"xkbcomp\"") (format #f "'~a'" xkbcomp)))
               (substitute* "src/orca/orca_bin.py.in"
                 (("'pgrep -u %s -x orca'")
                  (format #f "'~a -u %s -x orca'" pgrep))))))
@@ -11541,6 +11626,7 @@ accessibility infrastructure.")
           `(,liblouis "python")
           procps                       ; for pgrep
           python
+           python-dbus
           python-pygobject-3.50
           python-pyatspi
           speech-dispatcher
@@ -26,6 +26,7 @@
 ;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
 ;;; Copyright © 2025 Antoine Côté <antoine.cote@posteo.net>
 ;;; Copyright © 2026 Luis Guilherme Coelho <lgcoelho@disroot.org>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -971,10 +972,8 @@ passphrase when @code{gpg} is run and needs it.")))
           (lambda _
             (invoke "sh" "autogen.sh"))))))
    (native-inputs
-     `(("autoconf" ,autoconf)
-       ("automake" ,automake)
-       ("gettext" ,gettext-minimal)
-       ,@(package-native-inputs pinentry-tty)))
+     (modify-inputs native-inputs
+       (prepend autoconf automake gettext-minimal)))
    (inputs
     (modify-inputs inputs
       (prepend efl)))
@@ -48,6 +48,34 @@
  #:use-module (gnu packages xml)
  #:use-module (ice-9 match))

+(define-public fsviewer
+  (package
+    (name "fsviewer")
+    (version "0.2.7")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/roblillack/fsviewer")
+              (commit (string-append "v" version))))
+       (sha256
+        (base32
+         "067fvbq7b4lbnn1flmwf8lm0vq4n6qz5yz6hhab30l4gksfk51cg"))
+       (file-name (git-file-name name version))))
+    (build-system cmake-build-system)
+    (arguments (list #:tests? #f))      ;no tests
+    (inputs
+     (list windowmaker libxmu libxpm))
+    (native-inputs
+     (list pkg-config))
+    (home-page "https://github.com/roblillack/fsviewer")
+    (synopsis "File viewer for Window Maker")
+    (description "FSViewer is a NeXT FileViewer lookalike for Window
+Maker supporting browser mode and list mode.  This version is a fork of
+FSViewer.app originally written by George Clernon (1998-99) and later
+maintained by Guido Scholz (2002-07).")
+    (license license:gpl2)))
+
 (define-public gnustep-make
  (package
    (name "gnustep-make")
@@ -605,9 +605,9 @@ in the case of Firefox, it is browser/locales/all-locales."
    "zh-TW"))

 ;;; Please keep these versions in sync with icedove.
-(define %icecat-base-version "140.9.1")
+(define %icecat-base-version "140.10.1")
 (define %icecat-version (string-append %icecat-base-version "-gnu1"))
-(define %icecat-build-id "20260414000000") ;must be of the form YYYYMMDDhhmmss
+(define %icecat-build-id "20260428000000") ;must be of the form YYYYMMDDhhmmss

 ;; 'icecat-source' is a "computed" origin that generates an IceCat tarball
 ;; from the corresponding upstream Firefox ESR tarball, using the 'makeicecat'
@@ -627,9 +627,9 @@ in the case of Firefox, it is browser/locales/all-locales."
                  "firefox-" upstream-firefox-version ".source.tar.xz"))
            (sha256
             (base32
-              "1hld2kbzvrmr7pqq0r5hw639xl8kw29lm2hsbn0m4kxang1fdlj5"))))
+              "1fx52y52c3dmgr5gm64x40r2n6zq5ckqiqsd6vlhsly5wb1w0xaf"))))

-         (gnuzilla-commit "f3595923458a5255f61a3853bd83bb5f004dc3bc")
+         (gnuzilla-commit "5162cbc74c483c361ad5709c767c5cb2395ff4f9")
         (gnuzilla-source
          (origin
            (method git-fetch)
@@ -640,7 +640,7 @@ in the case of Firefox, it is browser/locales/all-locales."
                                      (string-take gnuzilla-commit 8)))
            (sha256
             (base32
-              "03kc08cvmdv3sxihf5hfhw2k91mg1y6f46b3x47p7q98phgk03cv"))))
+              "06qyirgjjgy7fwn7mbrz23wsdv9a88w70pz8qm1yszln74xxdsp0"))))

         ;; 'search-patch' returns either a valid file name or #f, so wrap it
         ;; in 'assume-valid-file-name' to avoid 'local-file' warnings.
@@ -1249,6 +1249,166 @@ testing.")
       (cpe-name . "firefox_esr")
       (cpe-version . ,(first (string-split version #\-)))))))

+;;; TEMPORARY old version of icecat-source for use by icedove until it is updated.
+(define %icecat-140.9.1-base-version "140.9.1")
+(define %icecat-140.9.1-version (string-append %icecat-140.9.1-base-version "-gnu1"))
+(define icecat-140.9.1-source
+  (let* ((major-version (first  (string-split %icecat-140.9.1-base-version #\.)))
+         (minor-version (second (string-split %icecat-140.9.1-base-version #\.)))
+         (sub-version   (third  (string-split %icecat-140.9.1-base-version #\.)))
+
+         (upstream-firefox-version (string-append %icecat-140.9.1-base-version "esr"))
+         (upstream-firefox-source
+          (origin
+            (method url-fetch)
+            (uri (string-append
+                  "https://ftp.mozilla.org/pub/firefox/releases/"
+                  upstream-firefox-version "/source/"
+                  "firefox-" upstream-firefox-version ".source.tar.xz"))
+            (sha256
+             (base32
+              "1hld2kbzvrmr7pqq0r5hw639xl8kw29lm2hsbn0m4kxang1fdlj5"))))
+
+         (gnuzilla-commit "f3595923458a5255f61a3853bd83bb5f004dc3bc")
+         (gnuzilla-source
+          (origin
+            (method git-fetch)
+            (uri (git-reference
+                  (url "git://git.savannah.gnu.org/gnuzilla.git")
+                  (commit gnuzilla-commit)))
+            (file-name (git-file-name "gnuzilla"
+                                      (string-take gnuzilla-commit 8)))
+            (sha256
+             (base32
+              "03kc08cvmdv3sxihf5hfhw2k91mg1y6f46b3x47p7q98phgk03cv"))))
+
+         ;; 'search-patch' returns either a valid file name or #f, so wrap it
+         ;; in 'assume-valid-file-name' to avoid 'local-file' warnings.
+         (makeicecat-patch
+          (local-file (assume-valid-file-name
+                       (search-patch "icecat-makeicecat.patch")))))
+
+    (origin
+      (method computed-origin-method)
+      (file-name (string-append "icecat-" %icecat-140.9.1-version ".tar.zst"))
+      (sha256 #f)
+      (uri
+       (delay
+        (with-imported-modules '((guix build utils))
+          #~(begin
+              (use-modules (guix build utils))
+              (let ((firefox-dir
+                     (string-append "firefox-" #$%icecat-140.9.1-base-version))
+                    (icecat-dir
+                     (string-append "icecat-" #$%icecat-140.9.1-version)))
+
+                (set-path-environment-variable
+                 "PATH" '("bin")
+                 (list #+python
+                       #+(canonical-package bash)
+                       #+(canonical-package coreutils)
+                       #+(canonical-package findutils)
+                       #+(canonical-package patch)
+                       #+(canonical-package xz)
+                       #+(canonical-package zstd)
+                       #+(canonical-package sed)
+                       #+(canonical-package grep)
+                       #+(canonical-package bzip2)
+                       #+(canonical-package gzip)
+                       #+(canonical-package tar)))
+
+                (set-path-environment-variable
+                 "PYTHONPATH"
+                 (list #+(format #f "lib/python~a/site-packages"
+                                 (version-major+minor
+                                  (package-version python))))
+                 '#+(cons python-jsonschema
+                          (map second
+                               (package-transitive-propagated-inputs
+                                python-jsonschema))))
+
+                ;; We copy the gnuzilla source directory because it is
+                ;; read-only in 'gnuzilla-source', and the makeicecat script
+                ;; uses "cp -a" to copy parts of it and assumes that the
+                ;; copies will be writable.
+                (copy-recursively #+gnuzilla-source "/tmp/gnuzilla"
+                                  #:log (%make-void-port "w"))
+
+                (with-directory-excursion "/tmp/gnuzilla"
+                  (make-file-writable "makeicecat")
+                  (invoke "patch" "--force" "--no-backup-if-mismatch"
+                          "-p1" "--input" #+makeicecat-patch)
+                  (patch-shebang "makeicecat")
+                  (substitute* "makeicecat"
+                    (("^readonly FFMAJOR=(.*)" all ffmajor)
+                     (unless (string=? #$major-version
+                                       (string-trim-both ffmajor))
+                       ;; The makeicecat script cannot be expected to work
+                       ;; properly on a different version of Firefox, even if
+                       ;; no errors occur during execution.
+                       (error "makeicecat major version mismatch"))
+                     (string-append "readonly FFMAJOR=" #$major-version "\n"))
+                    (("^readonly FFMINOR=.*")
+                     (string-append "readonly FFMINOR=" #$minor-version "\n"))
+                    (("^readonly FFSUB=.*")
+                     (string-append "readonly FFSUB=" #$sub-version "\n"))
+                    (("^readonly DATADIR=.*")
+                     "readonly DATADIR=/tmp/gnuzilla/data\n")
+                    (("^readonly SOURCEDIR=.*")
+                     (string-append "readonly SOURCEDIR=" icecat-dir "\n"))
+                    (("/bin/sed")
+                     #+(file-append (canonical-package sed) "/bin/sed"))))
+
+                (format #t "Unpacking upstream firefox tarball...~%")
+                (force-output)
+                (invoke "tar" "xf" #+upstream-firefox-source)
+                (rename-file firefox-dir icecat-dir)
+
+                (with-directory-excursion icecat-dir
+                  (format #t "Populating l10n directory...~%")
+                  (force-output)
+                  (mkdir "l10n")
+                  (with-directory-excursion "l10n"
+                    (for-each
+                     (lambda (locale)
+                       (let ((locale-dir (string-append #+mozilla-l10n "/"
+                                                        locale)))
+                         (format #t "  ~a~%" locale)
+                         (force-output)
+                         (copy-recursively locale-dir locale
+                                           #:log (%make-void-port "w"))
+                         (for-each make-file-writable (find-files locale))
+                         (with-directory-excursion locale
+                           (mkdir-p "browser/chrome/browser/preferences")
+                           (call-with-output-file "browser/chrome/browser/\
+preferences/advanced-scripts.dtd"
+                             (lambda (port) #f)))))
+                     '#+%icecat-locales)
+                    (copy-recursively #+mozilla-compare-locales
+                                      "compare-locales"
+                                      #:log (%make-void-port "w"))
+                    (delete-file "compare-locales/.gitignore")))
+
+                (format #t "Running makeicecat script...~%")
+                (force-output)
+                (invoke "bash" "/tmp/gnuzilla/makeicecat")
+
+                (format #t "Packing IceCat source tarball...~%")
+                (force-output)
+                (setenv "ZSTD_NBTHREADS" (number->string (parallel-job-count)))
+                (invoke "tar" "cfa" #$output
+                        ;; Avoid non-determinism in the archive.  We set the
+                        ;; mtime of files in the archive to early 1980 because
+                        ;; the build process fails if the mtime of source
+                        ;; files is pre-1980, due to the creation of zip
+                        ;; archives.
+                        "--mtime=@315619200" ; 1980-01-02 UTC
+                        "--owner=root:0"
+                        "--group=root:0"
+                        "--sort=name"
+                        icecat-dir)))))))))
+
+
 (define %icedove-build-id "20260403000000") ;must be of the form YYYYMMDDhhmmss
 ;;; See <https://product-details.mozilla.org/1.0/thunderbird_versions.json>
 ;;; for the source of truth regarding Thunderbird releases.
@@ -1383,7 +1543,7 @@ testing.")
               ;; Extract the base Icecat tarball, renaming its top-level
               ;; directory.
               (invoke "tar" "--transform" (string-append "s,[^/]*," #$name ",")
-                       "-xf" #$icecat-source)
+                       "-xf" #$icecat-140.9.1-source)
               (chdir #$name)

               ;; Merge the Thunderdbird localization data.
@@ -245,6 +245,55 @@ go-fuzz-headers.")
@end itemize")
    (license license:expat)))

+(define-public go-github-com-alexkohler-prealloc
+  (package
+    (name "go-github-com-alexkohler-prealloc")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/alexkohler/prealloc")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "011i8yqzyjgwj17k44xvvg4bxfv8z20s0416r2d3yf4s3wqqygpq"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/alexkohler/prealloc"))
+    (home-page "https://github.com/alexkohler/prealloc")
+    (synopsis "Find slice declarations that could be preallocated")
+    (description
+     "This package is a Go static analysis tool to find slice declarations
+that could potentially be preallocated.")
+    (license license:expat)))
+
+(define-public go-github-com-alingse-asasalint
+  (package
+    (name "go-github-com-alingse-asasalint")
+    (version "0.0.11")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/alingse/asasalint")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1avz33cx3gcpps26rxijv7ic0njfmsdkbcp2mqg5yxhdcpq57s0q"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/alingse/asasalint"))
+    (propagated-inputs
+     (list go-golang-org-x-tools))
+    (home-page "https://github.com/alingse/asasalint")
+    (synopsis "Lint pass any slice as any in variadic function")
+    (description
+     "Golang linter, lint that pass any slice as any in variadic function.")
+    (license license:expat)))
+
 (define-public go-github-com-andreyvit-diff
  (package
    (name "go-github-com-andreyvit-diff")
@@ -603,6 +652,42 @@ time functions.")
 strings which may be used in mock tests.")
    (license license:unlicense)))

+(define-public go-github-com-daixiang0-gci
+  (package
+    (name "go-github-com-daixiang0-gci")
+    (version "0.13.7")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/daixiang0/gci")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1vhnqisf6d706qvswccb0d7bkbl53lyi84f5sl3zyaf6yk8ml9dx"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:import-path "github.com/daixiang0/gci"))
+    (native-inputs
+     (list go-github-com-stretchr-testify
+           go-github-com-spf13-cobra))
+    (propagated-inputs
+     (list go-gopkg-in-yaml-v3
+           go-golang-org-x-tools
+           go-golang-org-x-sync
+           go-golang-org-x-mod
+           go-go-uber-org-zap
+           go-github-com-pmezard-go-difflib
+           go-github-com-hexops-gotextdiff))
+    (home-page "https://github.com/daixiang0/gci")
+    (synopsis "Tool to make Go import order deterministic")
+    (description
+     "This package provides a tool that controls Go package import order and
+makes it always deterministic.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-data-dog-go-sqlmock
  (package
    (name "go-github-com-data-dog-go-sqlmock")
@@ -676,6 +761,34 @@ style).
@end itemize")
    (license license:isc)))

+(define-public go-github-com-denis-tingaikin-go-header
+  (package
+    (name "go-github-com-denis-tingaikin-go-header")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/denis-tingaikin/go-header")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0qzy2ps59dzsdn4ny8x48k9d1kscpddjilkxra1w16npsvix6mcm"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/denis-tingaikin/go-header"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (propagated-inputs
+     (list go-golang-org-x-tools
+           go-gopkg-in-yaml-v3))
+    (home-page "https://github.com/denis-tingaikin/go-header")
+    (synopsis "Go linter for copyright headers")
+    (description
+     "Simple Go source code linter providing checks for copyright headers.")
+    (license license:gpl3)))
+
 (define-public go-github-com-dgryski-go-ddmin
  (package
    (name "go-github-com-dgryski-go-ddmin")
@@ -885,6 +998,31 @@ can use the mock clock.  This is a maintained fork of benbjohnson's
@url{https://github.com/benbjohnson/clock, clock} package.")
    (license license:expat)))

+(define-public go-github-com-firefart-nonamedreturns
+  (package
+    (name "go-github-com-firefart-nonamedreturns")
+    (version "1.0.6")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/firefart/nonamedreturns")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1y9dz8rkd55p1rkib4y3b0czs44c2bb1pmlr4k53ms1k8d9bjgwk"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/firefart/nonamedreturns"))
+    (propagated-inputs
+     (list go-golang-org-x-tools))
+    (home-page "https://github.com/firefart/nonamedreturns")
+    (synopsis "Go linter to catch named returns")
+    (description
+     "This package provides a linter to find named returns in Go code.")
+    (license license:gpl3)))
+
 ;; XXX: The project looks like abandoned, see
 ;; <https://github.com/frankban/quicktest/issues/172>, remove when nothing
 ;; depends on it.
@@ -923,6 +1061,30 @@ can use the mock clock.  This is a maintained fork of benbjohnson's
 tests.")
    (license license:expat)))

+(define-public go-github-com-fzipp-gocyclo
+  (package
+    (name "go-github-com-fzipp-gocyclo")
+    (version "0.6.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/fzipp/gocyclo")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1w2h8qlifrskn8g8zcwb6banr9si0vck9y8irg1r51mc98cjv36l"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/fzipp/gocyclo"))
+    (home-page "https://github.com/fzipp/gocyclo")
+    (synopsis "Calculate cyclomatic complexity in Go")
+    (description
+     "This package calculates the cyclomatic complexities of functions and
+methods in Go source code.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-gdey-tbltest
  (package
    (name "go-github-com-gdey-tbltest")
@@ -947,6 +1109,45 @@ tests.")
 tests.")
    (license license:expat)))

+(define-public go-github-com-ghostiam-protogetter
+  (package
+    (name "go-github-com-ghostiam-protogetter")
+    (version "0.3.20")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/ghostiam/protogetter")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1hap2ykmlnan5vz8sczdpiv93iidbgl13mlcdx468nhfprg2hbbm"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:tests? #f ;"module lookup disabled by GOPROXY=off"
+      #:import-path "github.com/ghostiam/protogetter"))
+    (propagated-inputs
+     (list go-golang-org-x-tools
+           go-github-com-gobwas-glob))
+    (home-page "https://github.com/ghostiam/protogetter")
+    (synopsis "Protobuf Golang linter")
+    (description
+     "This package is a linter developed specifically for Go programmers
+working with nested @code{protobuf} types.  It's designed to aid developers in
+preventing invalid memory address or nil pointer dereference errors arising
+from direct access of nested protobuf fields.
+
+When working with protobuf, it's quite common to have complex structures where
+a message field is contained within another message, which itself can be part
+of another message, and so on. If these fields are accessed directly and some
+field in the call chain will not be initialized, it can result in application
+panic.
+
+Protogetter addresses this issue by suggesting use of getter methods for field
+access.")
+    (license license:expat)))
+
 (define-public go-github-com-gkampitakis-ciinfo
  (package
    (name "go-github-com-gkampitakis-ciinfo")
@@ -1202,6 +1403,29 @@ kept in fixtures files.  Before the execution of every test, the test database
 is cleaned and the fixture data is loaded into the database.")
    (license license:expat)))

+(define-public go-github-com-go-xmlfmt-xmlfmt
+  (package
+    (name "go-github-com-go-xmlfmt-xmlfmt")
+    (version "1.1.3")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/go-xmlfmt/xmlfmt")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1cglrwmpg0lb7cnyvdz8js52h07rcvka7y9abksk9p5ajxj5rp1s"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/go-xmlfmt/xmlfmt"))
+    (home-page "https://github.com/go-xmlfmt/xmlfmt")
+    (synopsis "Go XML Formatter")
+    (description
+     "The Go XML Formatter, xmlfmt, will format the XML string in a readable way.")
+    (license license:expat)))
+
 ;; XXX: This repository has been archived by the owner
 ;; on May 9, 2021. It is now read-only. It's only used
 ;; by go-github-com-golang-gddo. Consider to remove when nothing
@@ -3967,6 +4191,20 @@ thoroughly
                    "  This package provides an command line interface (CLI)
 tool."))))

+(define-public go-gci
+  (package/inherit go-github-com-daixiang0-gci
+    (name "go-gci")
+    (arguments
+     (substitute-keyword-arguments arguments
+       ((#:tests? _ #t) #f)
+       ((#:install-source? _ #t) #f)
+       ((#:skip-build? _ #t) #f)))
+    (native-inputs
+     (append (package-native-inputs go-github-com-daixiang0-gci)
+             (package-propagated-inputs go-github-com-daixiang0-gci)))
+    (propagated-inputs '())
+    (inputs '())))
+
 (define-public go-pgmockproxy
  (package/inherit go-github-com-jackc-pgmock
    (name "go-pgmockproxy")
@@ -4090,6 +4328,21 @@ prints an ASCII fraphic representing the memory layout.")))
                    "  This package provides an command line interface (CLI)
 tool."))))

+(define-public protogetter
+  (package/inherit go-github-com-ghostiam-protogetter
+    (name "protogetter")
+    (arguments
+     (substitute-keyword-arguments arguments
+       ((#:tests? _ #f) #f)
+       ((#:skip-build? _ #t) #f)
+       ((#:install-source? _ #t) #f)
+       ((#:import-path _) "github.com/ghostiam/protogetter/cmd/protogetter")
+       ((#:unpack-path _ "") "github.com/ghostiam/protogetter")))
+    (native-inputs
+     (package-propagated-inputs go-github-com-ghostiam-protogetter))
+    (propagated-inputs '())
+    (inputs '())))
+
 (define-public unparam
  (package
    (inherit go-mvdan-cc-unparam)
@@ -31,6 +31,7 @@
 ;;; Copyright © 2025 Arthur Rodrigues <arthurhdrodrigues@proton.me>
 ;;; Copyright © 2025 Patrick Norton <patrick.147.norton@gmail.com>
 ;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2026 Evgeny Pisemsky <mail@pisemsky.site>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1599,7 +1600,7 @@ RSA, RSA-PSS, and ECDSA, though hooks are present for adding your own.")
 (define-public go-github-com-google-go-tpm
  (package
    (name "go-github-com-google-go-tpm")
-    (version "0.9.1")
+    (version "0.9.4")
    (source
     (origin
       (method git-fetch)
@@ -1608,7 +1609,7 @@ RSA, RSA-PSS, and ECDSA, though hooks are present for adding your own.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1c5j5cvwl45ka93nknmv454ivd7kp9n8yql19gr6z01z0s1ph7sg"))))
+        (base32 "1sp1mbr6vz36zy9w36iksirbsj5p2jslsl8zs1cdj8s4ig4lkd9d"))))
    (build-system go-build-system)
    (arguments
     (list
@@ -2873,7 +2874,7 @@ package.")
 (define-public go-github-com-refraction-networking-utls
  (package
    (name "go-github-com-refraction-networking-utls")
-    (version "1.6.0")
+    (version "1.8.2")
    (source
     (origin
       (method git-fetch)
@@ -2882,7 +2883,7 @@ package.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1iywar5vqsml4b177k2nkcxmjm8mw92g3p112yjsrpmikiwpwpyw"))))
+        (base32 "03kgwxdm2lg28fn2w5q7ql2szsiwj2xjdf477h1g3a4a9y9j6zk0"))))
    (build-system go-build-system)
    (arguments
     `(#:import-path "github.com/refraction-networking/utls"
@@ -3285,6 +3286,37 @@ to support the streaming mode required by Go's standard Hash interface.")
@url{https://www.rfc-editor.org/errata/rfc7512, errata} specifications.")
    (license license:asl2.0)))

+(define-public go-github-com-tailscale-golang-x-crypto
+  (package
+    (name "go-github-com-tailscale-golang-x-crypto")
+    (version "0.91.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/tailscale/golang-x-crypto")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0m9qkk48mihrkmfh1fzfhc39l8957qkpfx8qbw4xdjws7dy4vzbz"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:tests? #f ;Tests have broken package imports (expected as per readme)
+      #:import-path "github.com/tailscale/golang-x-crypto"))
+    (propagated-inputs
+     (list go-golang-org-x-crypto
+           go-golang-org-x-term
+           go-golang-org-x-sys
+           go-golang-org-x-net))
+    (home-page "https://github.com/tailscale/golang-x-crypto")
+    (synopsis "Supplementary Go crypto libraries")
+    (description
+     "This package holds supplementary Go cryptography libraries, it's a fork
+of @code{golang.org/x/crypto} maintained by Tailscale.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-tink-crypto-tink-go-v2
  (package
    (name "go-github-com-tink-crypto-tink-go-v2")
@@ -3640,6 +3672,39 @@ algorithm described in @url{https://rfc-editor.org/rfc/rfc2898.html,RFC 2898}
 and @url{https://rfc-editor.org/rfc/rfc8018.html,RFC 8018}.")
    (license license:asl2.0)))

+(define-public go-github-com-xtls-reality
+  (package
+    (name "go-github-com-xtls-reality")
+    (version "0.0.0-20260322125925-9234c772ba8f")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/xtls/reality")
+              (commit (go-version->git-ref version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1wncy5aph6nmq4814xjhj6b5p1wm2fyrqn83dw0xlyxvq2z6iqfs"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/xtls/reality"))
+    (propagated-inputs
+     (list go-github-com-cloudflare-circl
+           go-github-com-juju-ratelimit
+           go-github-com-pires-go-proxyproto
+           go-github-com-refraction-networking-utls
+           go-golang-org-x-crypto
+           go-golang-org-x-sys))
+    (home-page "https://github.com/xtls/reality")
+    (synopsis "Implementation of REALITY protocol")
+    (description
+     "This package provides an implementation of REALITY protocol, which is
+intented to eliminate the detectable TLS fingerprint on the server side, while
+still maintain the secrecy.  It achieves full real TLS that is
+undistingwishable with the specified SNI to the middleman.")
+    (license (list license:bsd-3 license:mpl2.0))))
+
 (define-public go-github-com-youmark-pkcs8
  (package
    (name "go-github-com-youmark-pkcs8")
@@ -456,6 +456,29 @@ penalization.")
 FFT (Schonhage-Strassen method for multiplying integers).")
    (license license:bsd-3)))

+(define-public go-github-com-robinus2-golang-moving-average
+  (package
+    (name "go-github-com-robinus2-golang-moving-average")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/RobinUS2/golang-moving-average")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "02z3ad29653fz7whxkjjpq820ig9j8m68xj4kay14jyazkr5in1f"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/RobinUS2/golang-moving-average"))
+    (home-page "https://github.com/RobinUS2/golang-moving-average")
+    (synopsis "Moving average implementation for Go")
+    (description
+     "This package provides a moving average implementation for Go.")
+    (license license:asl2.0)))
+
 (define-public go-github-com-shopspring-decimal
  (package
    (name "go-github-com-shopspring-decimal")
@@ -517,22 +517,19 @@ functions which were removed.")
                "0pik2d3995z0rjcjhb4hsj5fsph3m8khg6j10k6mx4j2j727aq6l"))))
    (build-system waf-build-system)
    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-before 'configure 'set-flags
-           (lambda* (#:key outputs #:allow-other-keys)
-             ;; Allow 'bin/ganv_bench' to find libganv-1.so.
-             (setenv "LDFLAGS"
-                     (string-append "-Wl,-rpath="
-                                    (assoc-ref outputs "out") "/lib"))
-             #t)))
-       #:tests? #f)) ; no check target
-    (inputs
-     `(("gtk" ,gtk+-2)
-       ("gtkmm" ,gtkmm-2)))
+     (list
+      #:tests? #f ; no check target
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'configure 'set-flags
+            (lambda _
+              ;; Allow 'bin/ganv_bench' to find libganv-1.so.
+              (setenv "LDFLAGS"
+                      (string-append "-Wl,-rpath=" #$output "/lib")))))))
    (native-inputs
     (list `(,glib "bin") ; for glib-genmarshal, etc.
           pkg-config))
+    (inputs (list gtk+-2 gtkmm-2))
    (home-page "https://drobilla.net/software/ganv/")
    (synopsis "GTK+ widget for interactive graph-like environments")
    (description
@@ -1460,10 +1457,9 @@ exceptions, macros, and a dynamic programming environment.")
    (inherit guile-cairo)
    (name "guile2.2-cairo")
    (inputs
-     `(("guile" ,guile-2.2)
-       ("guile-lib" ,guile2.2-lib)
-       ,@(fold alist-delete (package-inputs guile-cairo)
-               '("guile" "guile-lib"))))))
+     (modify-inputs inputs
+       (delete "guile" "guile-lib")
+       (append guile-2.2 guile2.2-lib)))))

 (define-public guile-cairo-next
  ;; A commit with cairo-pointer->context, missing from guile-cairo@1.11.2
@@ -1579,11 +1575,10 @@ images onto Cairo surfaces.")
    (inherit guile-rsvg)
    (name "guile2.2-rsvg")
    (inputs
-     `(("guile" ,guile-2.2)
-       ("guile-lib" ,guile2.2-lib)
-       ,@(fold alist-delete (package-inputs guile-rsvg)
-               '("guile" "guile-lib"))))
-    (propagated-inputs `(("guile-cairo" ,guile2.2-cairo)))))
+     (modify-inputs inputs
+       (delete "guile" "guile-lib")
+       (append guile-2.2 guile2.2-lib)))
+    (propagated-inputs (list guile2.2-cairo))))

 (define-public guile-present
  (package
@@ -1649,9 +1644,7 @@ documents.")
    (name "guile2.2-present")
    (inputs (list guile-2.2))
    (propagated-inputs
-     `(("guile-lib" ,guile2.2-lib)
-       ("guile-cairo" ,guile2.2-cairo)
-       ("guile-rsvg" ,guile2.2-rsvg)))))
+     (list guile2.2-lib guile2.2-cairo guile2.2-rsvg))))

 ;;;
 ;;; C++ bindings.
@@ -2770,6 +2763,43 @@ entire output.  It supports all Layer Shell features including popups and
 popovers.")
    (license license:expat)))

+(define-public xdg-user-dirs-gtk
+  (package
+    (name "xdg-user-dirs-gtk")
+    (version "0.16")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://gitlab.gnome.org/GNOME/xdg-user-dirs-gtk.git")
+                     (commit version)))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "11h1164mkajpfrp6mkky2gvx3xd7dw0c9f2785jf4lys4jmmj4c3"))))
+    (build-system meson-build-system)
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'fix-exec-path
+            (lambda* (#:key inputs #:allow-other-keys)
+              (substitute* "update.c"
+                (("xdg-user-dirs-update")
+                 (search-input-file inputs "/bin/xdg-user-dirs-update"))))))))
+    (native-inputs
+     (list gettext-minimal
+           pkg-config))
+    (inputs
+     (list gtk+
+           xdg-user-dirs))
+    (home-page "https://gitlab.gnome.org/GNOME/xdg-user-dirs-gtk")
+    (synopsis "Integration of xdg-user-dirs with GTK")
+    (description "This package is a companion to @code{xdg-user-dirs} to
+integrate it with the GNOME desktop and GTK applications.  It gets run during
+login to create default GTK bookmarks files containing the user directories, and
+to rename these directories if the locale changes.")
+    (license license:gpl2+)))
+
 (define-public goocanvas
  (package
    (name "goocanvas")
@@ -60,6 +60,7 @@
 ;;; Copyright © 2025 Andy Tai <atai@atai.org>
 ;;; Copyright © 2025 Ekaitz Zarraga <ekaitz@elenq.tech>
 ;;; Copyright © 2026 Matt Wette <matt.wette@gmail.com>
+;;; Copyright © 2026 Dzianis Jackievič <mail@miesta.by>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1167,7 +1168,7 @@ is not available for Guile 2.0.")
  (package
    (inherit guile-fibers-1.3)
    (name "guile-fibers")
-    (version "1.4.2")
+    (version "1.4.3")
    (source
     (origin (inherit (package-source guile-fibers-1.3))
             (file-name (git-file-name name version))
@@ -1176,7 +1177,7 @@ is not available for Guile 2.0.")
                    (commit (string-append "v" version))))
             (sha256
              (base32
-               "0qh0czz5qvk5mmrc8x2gmvl5psdfd22q2rhzj4jrpan6k3d55bl8"))
+               "1q0a9y0cc8rld1z7mcj61fkldhd0kn9n4yq25izxslbgg4g5h9j6"))
             (patches '())))
    (arguments
     (if (target-aarch64?)
@@ -1256,30 +1257,8 @@ is not available for Guile 2.0.")
     (modify-inputs native-inputs
       (replace "guile" guile-2.2)))))

-(define-public guile-fibers-next
-  (let ((commit "297359f0ad655378bcc3ff0d4e96101965ef39b4")
-        (revision "0"))
-    (package
-      (inherit guile-fibers)
-      (name "guile-fibers-next")
-      (version (git-version "1.4.2"
-                            revision
-                            commit))
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://codeberg.org/guile/fibers.git")
-                      (commit commit)))
-                (file-name (git-file-name name version))
-                (sha256
-                 (base32
-                  "0qh0czz5qvk5mmrc8x2gmvl5psdfd22q2rhzj4jrpan6k3d55bl8"))))
-      (inputs
-       (modify-inputs inputs
-         (replace "guile" guile-next)))
-      (native-inputs
-       (modify-inputs native-inputs
-         (replace "guile" guile-next))))))
+;; Deprecated on 2026-04-23
+(define-deprecated-package guile-fibers-next guile-fibers)

 (define-public guile-kracht
  (package
@@ -1537,7 +1516,7 @@ order to provide IDE functionality for Guile Scheme.")
 (define-public guile-ares-rs
  (package
    (name "guile-ares-rs")
-    (version "0.9.6")
+    (version "0.9.7")
    (source
     (origin
       (method git-fetch)
@@ -1547,35 +1526,42 @@ order to provide IDE functionality for Guile Scheme.")
       (file-name (git-file-name name version))
       (sha256
        (base32
-         "1vkww3vc0lsh5f8yh6fnh402rx3rsm0ss69rdkmplhzp4c7c4z1d"))))
+         "1xbznh5zjswfydgqg53g50ya7zm0hidin74g2glk849l9j45szw3"))))
    (build-system guile-build-system)
    (arguments
     (list
      #:source-directory "src/guile"
      #:phases
      #~(modify-phases %standard-phases
-          (add-after 'build 'install-script
+          (add-after 'build 'install-scripts
            (lambda _
-              (let* ((bin (string-append #$output "/bin"))
-                     (oldpath (string-append
-                               #$output
-                               ;; This file will be named ares-nrepl.scm for
-                               ;; the next version.
-                               "/share/guile/site/3.0/ares/scripts/ares.scm"))
-                     (newpath (string-append bin "/ares-nrepl")))
-                (mkdir bin)
-                (symlink oldpath newpath)
-                (wrap-program newpath
-                  `("GUILE_LOAD_PATH" ":" =
-                    ,(list (string-append #$output "/share/guile/site/3.0")
-                           (getenv "GUILE_LOAD_PATH")))
-                  `("GUILE_LOAD_COMPILED_PATH" ":" =
-                    ,(list (string-append #$output "/lib/guile/3.0/site-ccache")
-                           (getenv "GUILE_LOAD_COMPILED_PATH"))))
-                ;; Not needed since the wrapper followed the symlink.
-                (delete-file (string-append bin "/.ares-nrepl-real"))))))))
-    (inputs (list bash-minimal guile-3.0))
-    (propagated-inputs (list guile-fibers guile-custom-ports))
+              (define bin (string-append #$output "/bin"))
+              (define site (string-append #$output "/share/guile/site/3.0"))
+              (define ccache
+                (string-append #$output "/lib/guile/3.0/site-ccache"))
+
+              (define (install-script name)
+                (let ((oldpath
+                       (string-append site "/ares/scripts/" name ".scm"))
+                      (newpath
+                       (string-append bin "/" name)))
+                  (symlink oldpath newpath)
+                  (wrap-program newpath
+                    `("GUILE_LOAD_PATH" ":" =
+                      ,(list "$GUILE_LOAD_PATH"
+                             site
+                             (getenv "GUILE_LOAD_PATH")))
+                    `("GUILE_LOAD_COMPILED_PATH" ":" =
+                      ,(list "$GUILE_LOAD_COMPILED_PATH"
+                             ccache
+                             (getenv "GUILE_LOAD_COMPILED_PATH"))))
+                  ;; Not needed since the wrapper followed the symlink.
+                  (delete-file (string-append bin "/." name "-real"))))
+
+              (mkdir bin)
+              (for-each install-script '("ares-nrepl" "ares-suitbl")))))))
+    (inputs (list bash-minimal guile-3.0-latest))
+    (propagated-inputs (list guile-fibers))
    (home-page "https://git.sr.ht/~abcdw/guile-ares-rs")
    (synopsis "Asynchronous Reliable Extensible Sleek RPC Server for Guile")
    (description "Asynchronous Reliable Extensible Sleek RPC Server for
@@ -5707,27 +5693,32 @@ perform geometrical transforms on JPEG images.")
      (license license:gpl3+))))

 (define-public guile-jtd
-  (package
-    (name "guile-jtd")
-    (version "220323a")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                    (url "https://github.com/mwette/guile-jtd")
-                    (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "1l8fyqhvksarvpbr903i3ss3432jzvyvhgcqa15j922ngqh4ds6f"))))
-    (build-system guile-build-system)
-    (native-inputs (list guile-3.0))
-    (home-page "https://github.com/mwette/guile-jtd")
-    (synopsis "Python's @code{pdb.set_trace()} but for Guile")
-    (description
-     "The @code{(jtd)} module for Guile provides a procedure
+  ;; There are a few unreleased commits that include niceties such as warning
+  ;; that the debug VM must be used; use the latest commit until the next
+  ;; release comes.
+  (let ((commit "425f86ae954d6445aaedacfd4ecd50aa0022e59d")
+        (revision "0"))
+    (package
+      (name "guile-jtd")
+      (version (git-version "220323a" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                       (url "https://github.com/mwette/guile-jtd")
+                       (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "1l8fyqhvksarvpbr903i3ss3432jzvyvhgcqa15j922ngqh4ds6f"))))
+      (build-system guile-build-system)
+      (native-inputs (list guile-3.0))
+      (home-page "https://github.com/mwette/guile-jtd")
+      (synopsis "Python's @code{pdb.set_trace()} but for Guile")
+      (description
+       "The @code{(jtd)} module for Guile provides a procedure
@code{jump-to-debugger} for escaping to the Guile REPL for the purpose of
 debugging code.")
-    (license license:lgpl2.1+)))
+      (license license:lgpl2.1+))))

 (define-public guile-png
  (package
@@ -5790,7 +5781,7 @@ processing filters.")
 (define-public guile-pnm
  (package
    (name "guile-pnm")
-    (version "0.1.0")
+    (version "0.2.0")
    (source
     (origin
       (method git-fetch)
@@ -5799,7 +5790,7 @@ processing filters.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1yvsni4hll20g99zq4wl734f9i8gpjr1sqsnk3a93k2dd7b6ymac"))))
+        (base32 "06kgp1gh8hdj1j6w7i981prx93wfjpayrnjlydlzs7l5j04l4m3a"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -6399,6 +6390,88 @@ as signed sessions, multipart message support, etc.")
    (propagated-inputs
     (list guile2.2-irregex guile2.2-gcrypt))))

+(define-public guile-compose
+  (package
+    (name "guile-compose")
+    (version "0.1.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://codeberg.org/jadzi/guile-compose.git")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1g68gczs96nrb0vf1hv4n07zsp2516gpiwq1wwlhcq4rzynhf12h"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:make-flags
+      #~'("GUILE_AUTO_COMPILE=0")))
+    (inputs (list guile-3.0))
+    (native-inputs (list autoconf-2.72 automake pkg-config guile-3.0 texinfo))
+    (synopsis "Procedure composition utilities for Guile Scheme")
+    (description
+     "This tiny package provides some procedures and macros to extend
+Guile Scheme procedure composition facilities.  For example, there is
+a @code{compose-top}, a reverse-order analog to native @code{compose}
+procedure.  The @code{compose-cont} is a macro, utilizing some power of
+continuations to build really flexible flows.
+
+This library is intended to stay basic and small, so it has no any
+external dependencies and can be a good base for other packages, like e.g.
+@code{guile-web-middleware}.")
+    (license (list license:lgpl3+))
+    (home-page "https://jadzi.codeberg.page/guile-compose")))
+
+(define-public guile-web-middleware
+  (package
+    (name "guile-web-middleware")
+    (version "0.11.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://codeberg.org/jadzi/guile-web-middleware.git")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "01wb8v0lszphdv08ly4aqv59qm5h8yw2fgm025vkn61djspsq4j9"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:make-flags
+      #~'("GUILE_AUTO_COMPILE=0")))
+    (inputs (list guile-3.0))
+    (propagated-inputs (list guile-compose))
+    (native-inputs (list autoconf-2.72 automake pkg-config guile-3.0 texinfo))
+    (synopsis "Web application middleware composition for Guile Scheme")
+    (description
+     "This package provides means to compose a web application by
+chaining procedures, a.k.a. middlewares.  By those means, composed
+procedures form a standard request handler for any Guile's web server
+implementation.
+
+Each middleware has its own limited responsibility in request
+processing.  Also, middlewares are simple Scheme procedures, so they
+can be easily tested and shared among web applications.
+
+Out of the box, this package provides several procedures for commonly
+required tasks.  Among them:
+
+@itemize
+@item Error handling with customizable page contents.
+@item Request filtering.
+@item Request logging.
+@item Serving static files, file URL generation.
+@item Request routing, handling parameters, route URL generation.
+@item Middleware nesting, composing whole apps.
+@end itemize
+
+This package relies on @code{guile-compose} package as its only dependency.")
+    (license (list license:lgpl3+))
+    (home-page "https://jadzi.codeberg.page/guile-web-middleware")))
+
 (define-public guile-web-driver-ng
  (package
    (name "guile-web-driver-ng")
@@ -7691,11 +7764,11 @@ is an attempt to combine both into something useful.")
      (license license:asl2.0))))

 (define-public guile-knots
-  (let ((commit "d79284b4715efc347b22d510c3e3134a0c584b17")
-        (revision "32"))
+  (let ((commit "49996c432a4616e03ecaf01cb42afc5fd78eafd5")
+        (revision "35"))
    (package
    (name "guile-knots")
-    (version (git-version "0" revision commit))
+    (version (git-version "0.1" revision commit))
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -7703,7 +7776,7 @@ is an attempt to combine both into something useful.")
                    (commit commit)))
              (sha256
               (base32
-                "0i87jc3dznw6pdib0yy49d8066c1jvwp2m01xi92amx45dkl8ixc"))
+                "0i6vk432shy7qmsq1hli71a9kmgf8yy9hx3bck0r9qzsldv1m3m9"))
              (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
@@ -7716,13 +7789,13 @@ is an attempt to combine both into something useful.")
     (list pkg-config
           autoconf
           automake
-           guile-next
+           guile-3.0-latest
           guile-lib
-           guile-fibers-next))
+           guile-fibers))
    (inputs
-     (list guile-next))
+     (list guile-3.0-latest))
    (propagated-inputs
-     (list guile-fibers-next))
+     (list guile-fibers))
    (home-page "https://cbaines.codeberg.page/guile-knots/")
    (synopsis "Patterns and functionality to use with Guile Fibers")
    (description
@@ -7938,14 +8011,16 @@ This module implements this interface by use of Guile's dynamic FFI.")
 (define-public guile-bstructs
  (package
    (name "guile-bstructs")
-    (version "0.1.0")
+    (version "0.2.0")
    (source
-     (origin
-       (method url-fetch)
-       (uri (string-append "https://files.dthompson.us/releases"
-                           "/guile-bstructs/guile-bstructs-" version ".tar.gz"))
-       (sha256
-        (base32 "0f847aiyzhrlvd2jmckyqrkrvi7i9mg8rmyhbh7fs1vzykcf67wb"))))
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://git.dthompson.us/guile-bstructs.git")
+               (commit (string-append "v" version))))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "18dwhcsbcjix61hy32ckjyvgmg1r9smq2krp2m1yc6sinlszh0f2"))))
    (build-system gnu-build-system)
    (native-inputs (list autoconf automake guile-3.0 pkg-config texinfo))
    (inputs (list guile-3.0))
@@ -8016,14 +8091,14 @@ application to open a given file or URL based on given configurations.")
 (define-public guile-goblins
  (package
    (name "guile-goblins")
-    (version "0.17.0")
+    (version "0.18.0")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "https://files.spritely.institute/releases"
                           "/guile-goblins/guile-goblins-" version ".tar.gz"))
       (sha256
-        (base32 "16jkmfspsnza2fdk5jr05a5pfh7x856gpg031i21s1yvy43l8mi0"))))
+        (base32 "0gj5018wmq97ln1z7x03a13z3p35xc8762id9bl9fgkxwm01df1a"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -653,7 +653,10 @@ GNU@tie{}Guile.  Use the @code{(ice-9 readline)} module and call its
 (define (guile-variant-package-name prefix)
  (lambda (name)
    "Return NAME with PREFIX instead of \"guile-\", when applicable."
-    (if (string-prefix? "guile-" name)
+    (if (and (string-prefix? "guile-" name)
+
+             ;; Don't rename guile-bootstrap@2.0.
+             (not (string=? "guile-bootstrap" name)))
        (string-append prefix "-"
                       (string-drop name
                                    (string-length "guile-")))
@@ -900,8 +903,8 @@ type system, elevating types to first-class status.")
 (define-public guile-git
  (package
    (name "guile-git")
-    (version "0.11.0")
-    (home-page "https://gitlab.com/guile-git/guile-git.git")
+    (version "0.11.1")
+    (home-page "https://codeberg.org/guile-git/guile-git.git")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -910,11 +913,11 @@ type system, elevating types to first-class status.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1yjyil6z4k80pjdps8v6h6lxikwxmjxvrslf2jrmq2rrfnajschz"))))
+                "0xpzchnglddphi3chv53xqaz2x6rpq3l4s023w7r4mmndb6lgz0b"))))
    (build-system gnu-build-system)
    (arguments
     `(#:make-flags '("GUILE_AUTO_COMPILE=0")       ; to prevent guild warnings
-       ;; https://gitlab.com/guile-git/guile-git/-/issues/20
+       ;; https://codeberg.org/guile-git/guile-git/issues/20
       ,@(if (target-ppc32?)
           `(#:phases
             (modify-phases %standard-phases
@@ -922,20 +925,7 @@ type system, elevating types to first-class status.")
                 (lambda _
                   (substitute* "Makefile.am"
                     ((".*tests/blob\\.scm.*") ""))))))
-           '())
-       ,@(if (system-hurd?)
-             (list
-              #:phases
-              #~(modify-phases %standard-phases
-                  (add-after 'unpack 'skip-tests/hurd
-                    (lambda _
-                      (substitute* "tests/proxy.scm"
-                        (("\\(test-begin.*" all)
-                         (string-append
-                          all
-                          "(when (string-ci= \"GNU\" (vector-ref (uname) 0))\n"
-                          "  (test-skip 1))\n")))))))
-             '())))
+           '())))
    (native-inputs
     (list pkg-config autoconf automake texinfo guile-3.0 guile-bytestructures))
    (inputs
@@ -1004,7 +994,7 @@ Guile's foreign function interface.")
       (file-name (string-append "guile-lzlib-" version ".tar.gz"))
       (sha256
        (base32
-         "1whgmwkr1v8m63p4aaqn8blwl9vcrswwhbfv4bm0aghl5a6rryd7"))
+         "1v1pfqp6hwl0rivs7swhqnfgznxlfnws9ldmn6avnhd10filfa3a"))
       (patches (search-patches "guile-lzlib-gcc-14.patch"
                                "guile-lzlib-hurd64.patch"))))
    (build-system gnu-build-system)
@@ -23,6 +23,7 @@
 ;;; Copyright © 2025 Eric Bavier <bavier@posteo.net>
 ;;; Copyright © 2025 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2025 James Smith <jsubuntuxp@disroot.org>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1000,22 +1001,21 @@ information can be viewed in real time and/or logged to a file.")
    (source
     (origin
       (method git-fetch)
-       (uri
-        (git-reference
-         (url (string-append "https://github.com/dell/" name))
-         (commit (string-append "v" version))))
+       (uri (git-reference
+              (url "https://github.com/dell/libsmbios")
+              (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
        (base32 "0krwwydyvb9224r884y1mlmzyxhlfrcqw73vi1j8787rl0gl5a2i"))))
    (build-system gnu-build-system)
    (native-inputs
-     `(("autoconf" ,autoconf)
-       ("automake" ,automake)
-       ("gettext" ,gettext-minimal)
-       ("libtool" ,libtool)
-       ("pkg-config" ,pkg-config)
-       ("perl" ,perl)
-       ("python" ,python)))
+     (list autoconf
+           automake
+           gettext-minimal
+           libtool
+           pkg-config
+           perl
+           python))
    (inputs
     (list libxml2))
    (arguments
@@ -96,13 +96,13 @@ library.  It is primarily used with HLint's @code{--refactor} flag.")
 (define-public cabal-install
 (package
   (name "cabal-install")
-   (version "3.12.1.0")
-   (source
-    (origin
-      (method url-fetch)
-      (uri (hackage-uri "cabal-install" version))
-      (sha256
-       (base32 "1cmifq189i4x0r0yha3dl8nrzzfh92bnd2saak7dqvvjkkysqj38"))))
+   (version "3.6.2.0")
+   (source (origin
+             (method url-fetch)
+             (uri (hackage-uri "cabal-install" version))
+             (sha256
+              (base32
+               "0dihpm4h3xh13vnpvwflnb7v614qdvljycc6ffg5cvhwbwfrxyfw"))))
   (build-system haskell-build-system)
   (properties '((upstream-name . "cabal-install")))
   (inputs (list ghc-async
@@ -117,35 +117,13 @@ library.  It is primarily used with HLint's @code{--refactor} flag.")
                 ghc-tar
                 ghc-zlib
                 ghc-hackage-security
-                 ghc-open-browser
                 ghc-regex-base
                 ghc-regex-posix
-                 ghc-safe-exceptions
-                 ghc-semaphore-compat
                 ghc-resolv
                 ghc-lukko))
-   (native-inputs (list ghc-tasty
-                        ghc-tasty-golden
-                        ghc-tasty-quickcheck
-                        ghc-tasty-expected-failure
-                        ghc-tasty-hunit
-                        ghc-tree-diff
-                        ghc-quickcheck
-                        ghc-tasty
-                        ghc-tasty-hunit
-                        ghc-tasty
-                        ghc-tasty-hunit
-                        ghc-tagged
-                        ghc-tagged
-                        ghc-tasty
-                        ghc-tasty-expected-failure
-                        ghc-tasty-hunit
-                        ghc-tasty-quickcheck
-                        ghc-quickcheck
-                        ghc-pretty-show))
   (arguments
    `(#:cabal-revision ("2"
-                        "0fdzqdkg2vbyg0lnbk9bdskr2d23hwjpmnc7jnvpzkcmxmcvl99n")))
+                        "1kpgyfl5njxp4c8ax5ziag1bhqvph3h0pn660v3vpxalz8d1j6xv")))
   (home-page "https://www.haskell.org/cabal/")
   (synopsis "Command-line interface for Cabal and Hackage")
   (description
@@ -167,10 +145,11 @@ installation of Haskell libraries and programs.")
         "17wi7fma2qaqdm1hwgaam3fd140v9bpa8ky0wg708h1pqc5v2nbz"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "cpphs")))
-    (inputs (list ghc-polyparse))
+    (inputs
+     (list ghc-polyparse ghc-old-locale ghc-old-time))
    (arguments
-     `(#:cabal-revision ("2"
-                         "0vxav36p0kplp4dpd17i4cfzrsl3r437d840xwv83lf1bqp7mrxc")))
+     `(#:cabal-revision ("1"
+                         "1f8jzs8zdh4wwbcq8fy6qqxkv75ypnvsm4yzw49wpr3b9vpnzlha")))
    (home-page "https://projects.haskell.org/cpphs/")
    (synopsis "Liberalised re-implementation of cpp, the C pre-processor")
    (description "Cpphs is a re-implementation of the C pre-processor that is
@@ -290,18 +269,20 @@ unique algebra of patches called @url{http://darcs.net/Theory,Patchtheory}.
 (define-public ghcid
  (package
    (name "ghcid")
-    (version "0.8.9")
+    (version "0.8.7")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "ghcid" version))
       (sha256
-        (base32 "1dq8lc0dwzib8y21279q4j54cmm7lvx64b3hw2yiym1kzi9rrhj4"))))
+        (base32 "0yqc1pkfajnr56gnh43sbj50r7c3r41b2jfz07ivgl6phi4frjbq"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "ghcid")))
-    (inputs (list ghc-extra ghc-ansi-terminal ghc-cmdargs ghc-fsnotify
-                  ghc-terminal-size))
-    (native-inputs (list ghc-tasty ghc-tasty-hunit))
+    (inputs
+     (list ghc-extra ghc-ansi-terminal ghc-cmdargs ghc-fsnotify
+           ghc-terminal-size))
+    (native-inputs
+     (list ghc-tasty ghc-tasty-hunit))
    (home-page "https://github.com/ndmitchell/ghcid#readme")
    (synopsis "GHCi based bare bones IDE")
    (description
@@ -423,97 +404,95 @@ to @code{cabal repl}).")
                        (string-append bin "/git-remote-annex"))
               (symlink (string-append bin "/git-annex")
                        (string-append bin "/git-remote-tor-annex"))))))))
-    (inputs (list ghc-network-uri
-                  ghc-optparse-applicative
-                  ghc-uuid
-                  ghc-data-default
-                  ghc-case-insensitive
-                  ghc-random
-                  ghc-dlist
-                  ghc-unix-compat
-                  ghc-safesemaphore
-                  ghc-async
-                  ghc-disk-free-space
-                  ghc-ifelse
-                  ghc-monad-logger
-                  ghc-free
-                  ghc-utf8-string
-                  ghc-sandi
-                  ghc-monad-control
-                  ghc-bloomfilter
-                  ghc-edit-distance
-                  ghc-resourcet
-                  ghc-http-client
-                  ghc-http-client-tls
-                  ghc-http-types
-                  ghc-http-conduit
-                  ghc-http-client-restricted
-                  ghc-conduit
-                  ghc-old-locale
-                  ghc-persistent-sqlite
-                  ghc-persistent
-                  ghc-persistent-template
-                  ghc-unliftio-core
-                  ghc-microlens
-                  ghc-aeson
-                  ghc-vector
-                  ghc-tagsoup
-                  ghc-unordered-containers
-                  ghc-feed
-                  ghc-regex-tdfa
-                  ghc-socks
-                  ghc-byteable
-                  ghc-stm-chans
-                  ghc-securemem
-                  ghc-crypto-api
-                  ghc-memory
-                  ghc-split
-                  ghc-attoparsec
-                  ghc-concurrent-output
-                  ghc-unbounded-delays
-                  ghc-quickcheck
-                  ghc-tasty
-                  ghc-tasty-hunit
-                  ghc-tasty-quickcheck
-                  ghc-tasty-rerun
-                  ghc-ansi-terminal
-                  ghc-aws
-                  ghc-dav
-                  ghc-network
-                  ghc-network-bsd
-                  ghc-git-lfs
-                  ghc-clock
-                  ghc-crypton
-                  ghc-servant
-                  ghc-servant-server
-                  ghc-servant-client
-                  ghc-servant-client-core
-                  ghc-warp
-                  ghc-warp-tls
-                  ghc-os-string
-                  ghc-file-io
-                  ghc-mountpoints
-                  ghc-yesod
-                  ghc-yesod-static
-                  ghc-yesod-form
-                  ghc-yesod-core
-                  ghc-path-pieces
-                  ghc-wai
-                  ghc-wai-extra
-                  ghc-blaze-builder
-                  ghc-clientsession
-                  ghc-shakespeare
-                  ghc-hinotify
-                  ghc-dbus
-                  ghc-fdo-notify
-                  ghc-network-multicast
-                  ghc-network-info
-                  ghc-torrent
-                  ghc-magic
-                  ghc-criterion))
+    (inputs
+     (list curl
+           ghc-aeson
+           ghc-ansi-terminal
+           ghc-async
+           ghc-attoparsec
+           ghc-aws
+           ghc-bloomfilter
+           ghc-byteable
+           ghc-case-insensitive
+           ghc-clientsession
+           ghc-concurrent-output
+           ghc-conduit
+           ghc-connection
+           ghc-crypto-api
+           ghc-cryptonite
+           ghc-data-default
+           ghc-dav
+           ghc-dbus
+           ghc-disk-free-space
+           ghc-dlist
+           ghc-edit-distance
+           ghc-exceptions
+           ghc-fdo-notify
+           ghc-feed
+           ghc-filepath-bytestring
+           ghc-free
+           ghc-git-lfs
+           ghc-hinotify
+           ghc-http-client
+           ghc-http-client-tls
+           ghc-http-client-restricted
+           ghc-http-conduit
+           ghc-http-types
+           ghc-ifelse
+           ghc-magic
+           ghc-memory
+           ghc-microlens
+           ghc-monad-control
+           ghc-monad-logger
+           ghc-mountpoints
+           ghc-network
+           ghc-network-bsd
+           ghc-network-info
+           ghc-network-multicast
+           ghc-network-uri
+           ghc-old-locale
+           ghc-optparse-applicative
+           ghc-persistent
+           ghc-persistent-sqlite
+           ghc-persistent-template
+           ghc-quickcheck
+           ghc-random
+           ghc-regex-tdfa
+           ghc-resourcet
+           ghc-safesemaphore
+           ghc-sandi
+           ghc-securemem
+           ghc-servant-client
+           ghc-servant-server
+           ghc-socks
+           ghc-split
+           ghc-stm-chans
+           ghc-tagsoup
+           ghc-torrent
+           ghc-transformers
+           ghc-unbounded-delays
+           ghc-unix-compat
+           ghc-unliftio-core
+           ghc-unordered-containers
+           ghc-utf8-string
+           ghc-uuid
+           ghc-vector
+           ghc-wai
+           ghc-wai-extra
+           ghc-warp
+           ghc-warp-tls
+           ghc-yesod
+           ghc-yesod-core
+           ghc-yesod-form
+           ghc-yesod-static
+           lsof
+           rsync
+           xdg-utils))
    (propagated-inputs
     (list git))
-    (native-inputs (list ghc-filepath-bytestring))
+    (native-inputs
+     (list ghc-tasty ghc-tasty-hunit ghc-tasty-quickcheck ghc-tasty-rerun
+           perl))
    (home-page "https://git-annex.branchable.com/")
    (synopsis "Manage files with Git, without checking in their contents")
    (description "This package allows managing files with Git, without
@@ -534,13 +513,13 @@ used to keep a folder in sync between computers.")
 (define-public hlint
  (package
    (name "hlint")
-    (version "3.10")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "hlint" version))
-       (sha256
-        (base32 "0dzy7spc45v88yplczhd3la464bhcbaihi619a45bd06ghrp55nr"))))
+    (version "3.4.1")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "hlint" version))
+              (sha256
+               (base32
+                "0bkk03c9hacvfd73dk89g4r81b50g7pjgw5pavldali4qwss34cz"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hlint")))
    (inputs (list ghc-unordered-containers
@@ -557,10 +536,12 @@ used to keep a folder in sync between computers.")
                  ghc-aeson
                  ghc-deriving-aeson
                  ghc-filepattern
-                  ghc-lib-parser
                  ghc-lib-parser-ex
                  hscolour
                  ghc-yaml))
+    (arguments
+     `(#:cabal-revision ("1"
+                         "1rdaffg5n179yfcn5zjwjb0bki09qy13gz2ijky455y9pbaz8yz9")))
    (home-page "https://github.com/ndmitchell/hlint#readme")
    (synopsis "Suggest improvements for Haskell source code")
    (description
@@ -572,13 +553,13 @@ unwanted suggestions, and to add your own custom suggestions.")
 (define-public hoogle
  (package
    (name "hoogle")
-    (version "5.0.18.4")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "hoogle" version))
-       (sha256
-        (base32 "08z32d87vqzhapb2vw21h25jb2g74csxlpvd8f54xl91k3ijs3wx"))))
+    (version "5.0.18.3")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "hoogle" version))
+              (sha256
+               (base32
+                "0v6k75w0an9pqgb7a6cicnpf9rz77xd2lmxfbafc5l4f99jg83bn"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hoogle")))
    (inputs (list ghc-quickcheck
@@ -588,7 +569,7 @@ unwanted suggestions, and to add your own custom suggestions.")
                  ghc-cmdargs
                  ghc-conduit
                  ghc-conduit-extra
-                  ghc-crypton-connection
+                  ghc-connection
                  ghc-extra
                  ghc-foundation
                  ghc-old-locale
@@ -601,7 +582,6 @@ unwanted suggestions, and to add your own custom suggestions.")
                  ghc-mmap
                  ghc-process-extras
                  ghc-resourcet
-                  ghc-safe
                  ghc-storable-tuple
                  ghc-tar
                  ghc-uniplate
@@ -613,9 +593,6 @@ unwanted suggestions, and to add your own custom suggestions.")
                  ghc-warp-tls
                  ghc-zlib
                  ghc-semigroups))
-    (arguments
-     `(#:cabal-revision ("1"
-                         "1129flhhb1992rijw46dclvmpqlylmbrzl4swsnk2knylx6jgw5a")))
    (home-page "https://hoogle.haskell.org/")
    (synopsis "Haskell API Search")
    (description
@@ -627,13 +604,14 @@ or by approximate type signature.")
 (define-public hscolour
  (package
    (name "hscolour")
-    (version "1.25")
+    (version "1.24.4")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "hscolour" version))
       (sha256
-        (base32 "0z679khnmb6as1zcdb44n9qjk7in32jpm4ldscpqg7jrapd31kjl"))))
+        (base32
+         "079jwph4bwllfp03yfr26s5zc6m6kw3nhb1cggrifh99haq34cr4"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hscolour")))
    (home-page "https://hackage.haskell.org/package/hscolour")
@@ -782,7 +760,7 @@ Wayland, and Linux console environments alike.")
                  ghc-text-zipper
                  ghc-timezone-olson
                  ghc-timezone-series
-                  ghc-unix-compat
+                  ghc-unix-compat-7
                  ghc-unordered-containers
                  ghc-utf8-string
                  ghc-uuid
@@ -976,7 +954,6 @@ too slow and you'll get wound up in the scroll and crushed.")
    (build-system haskell-build-system)
    (arguments
     (list #:haddock? #f ; TODO: Fails to build.
-           #:cabal-revision '("1" "1935jrzy1r3g9cc74b330fmxnz2i1j8hsdk9jnl557qgk6xjqzs7")
           #:phases
           #~(modify-phases %standard-phases
               (add-after 'build 'build-man-page
@@ -1016,13 +993,13 @@ advanced user's otherwise working script to fail under future circumstances.
 (define-public shelltestrunner
  (package
    (name "shelltestrunner")
-    (version "1.10")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "shelltestrunner" version))
-       (sha256
-        (base32 "1c6bjyxqa4mgnh3w4pqp6sbr5cf160n7jf9i1b4b9sdxzdjk7g87"))))
+    (version "1.9")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "shelltestrunner" version))
+              (sha256
+               (base32
+                "1a5kzqbwg6990249ypw0cx6cqj6663as1kbj8nzblcky8j6kbi6b"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "shelltestrunner")))
    (arguments
@@ -1045,19 +1022,17 @@ advanced user's otherwise working script to fail under future circumstances.
                           "tests/examples")
                   (format #t "test suite not run~%"))
               #t))))))
-    (inputs (list ghc-diff
-                  ghc-filemanip
-                  ghc-hunit
-                  ghc-cmdargs
-                  ghc-pretty-show
-                  ghc-regex-tdfa
-                  ghc-safe
-                  ghc-test-framework
-                  ghc-test-framework-hunit
-                  ghc-utf8-string
-                  ghc-hspec
-                  ghc-hspec-core
-                  ghc-hspec-contrib))
+    (inputs
+     (list ghc-diff
+           ghc-cmdargs
+           ghc-filemanip
+           ghc-hunit
+           ghc-pretty-show
+           ghc-regex-tdfa
+           ghc-safe
+           ghc-utf8-string
+           ghc-test-framework
+           ghc-test-framework-hunit))
    (home-page "https://github.com/simonmichael/shelltestrunner")
    (synopsis "Test CLI programs")
    (description
@@ -1070,13 +1045,13 @@ output, stderr, and exit status.")
 (define-public stylish-haskell
  (package
    (name "stylish-haskell")
-    (version "0.15.1.0")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "stylish-haskell" version))
-       (sha256
-        (base32 "06y6f7bv5j5k7q81194v9jqcbmmqcv7h8ii3lq1783bpfnyd6h19"))))
+    (version "0.14.3.0")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "stylish-haskell" version))
+              (sha256
+               (base32
+                "17w92v0qnwj7m6yqdq5cxbr04xiz0yfnnyx5q54218wdl7n5lf6d"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "stylish-haskell")))
    (inputs (list ghc-aeson
@@ -1086,7 +1061,6 @@ output, stderr, and exit status.")
                  ghc-hsyaml-aeson
                  ghc-hsyaml
                  ghc-semigroups
-                  ghc-lib-parser
                  ghc-lib-parser-ex
                  ghc-strict
                  ghc-optparse-applicative))
@@ -45,18 +45,22 @@
 (define-public ghc-tasty-ant-xml
  (package
    (name "ghc-tasty-ant-xml")
-    (version "1.1.9")
+    (version "1.1.8")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "tasty-ant-xml" version))
       (sha256
-        (base32 "00zgsd6jjfwasr69d0y781vhjr7d8p1jbaaz4pn75ljf33akd92l"))))
+        (base32
+         "0h9mllhw9cd0rn34xhj8grwmbny7z7hpd8qmp9lfcdj0s4qx9vx8"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty-ant-xml")))
-    (inputs (list ghc-generic-deriving ghc-tagged ghc-tasty ghc-xml))
-    (home-page "http://github.com/ocharles/tasty-ant-xml")
-    (synopsis "Render tasty output to XML for Jenkins")
+    (inputs
+     (list ghc-generic-deriving ghc-xml ghc-tagged ghc-tasty))
+    (home-page
+     "https://github.com/ocharles/tasty-ant-xml")
+    (synopsis
+     "Render tasty output to XML for Jenkins")
    (description
     "A tasty ingredient to output test results in XML, using the Ant
 schema.  This XML can be consumed by the Jenkins continuous integration
@@ -72,37 +76,33 @@ framework.")
       (method url-fetch)
       (uri (hackage-uri "tasty-smallcheck" version))
       (sha256
-        (base32 "0csgwn3vch0jnpqyyfnrfjq4z0dpl67imh5a7byll3hhlyidgjym"))))
+        (base32
+         "0csgwn3vch0jnpqyyfnrfjq4z0dpl67imh5a7byll3hhlyidgjym"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty-smallcheck")))
-    (inputs (list ghc-tasty ghc-smallcheck ghc-tagged ghc-optparse-applicative))
-    (arguments
-     `(#:cabal-revision ("1"
-                         "0033ha2w9rzc1rxpzh1dkfdrn256i5lvb41pqbdh2i6kli0v5vmh")))
-    (home-page "https://github.com/feuerbach/tasty")
+    (inputs
+     (list ghc-tasty ghc-smallcheck ghc-async ghc-tagged))
+    (home-page "https://documentup.com/feuerbach/tasty")
    (synopsis "SmallCheck support for the Tasty test framework")
    (description "This package provides SmallCheck support for the Tasty
 Haskell test framework.")
-    (license license:expat)))
+    (license license:bsd-3)))

 (define-public ghc-tasty-quickcheck
  (package
    (name "ghc-tasty-quickcheck")
-    (version "0.11.1")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "tasty-quickcheck" version))
-       (sha256
-        (base32 "0si4ccgqlv8h33d6310rrqba7f4pz3g8cinqfj42yd7damsdxm73"))))
+    (version "0.10.2")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "tasty-quickcheck" version))
+              (sha256
+               (base32
+                "1qnc6rdvjvlw08q6sln2n98rvj0s0pp689h6w4z58smjbn0lr25l"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty-quickcheck")))
    (inputs (list ghc-tagged ghc-tasty ghc-random ghc-quickcheck
                  ghc-optparse-applicative))
-    (native-inputs (list ghc-regex-tdfa ghc-tasty-hunit))
-    (arguments
-     `(#:cabal-revision ("3"
-                         "1wzvha4xam8npx5mk33c056grmrqnjd6m38nnm6d7y99w2mn1a7w")))
+    (native-inputs (list ghc-tasty-hunit ghc-pcre-light))
    (home-page "https://github.com/UnkindPartition/tasty")
    (synopsis "QuickCheck support for the Tasty test framework")
    (description "This package provides QuickCheck support for the Tasty
@@ -140,23 +140,22 @@ contains the correct result for the test.")
 (define-public ghc-tasty
  (package
    (name "ghc-tasty")
-    (version "1.5.3")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "tasty" version))
-       (sha256
-        (base32 "10076vlklbcyiz7plakrihava5sy3dvwhskjldqzhfl18jvcg82l"))))
+    (version "1.4.3")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "tasty" version))
+              (sha256
+               (base32
+                "006bf4gyc30i2gvb17hj1mzrh1kwnwf7l050x3f72wi6c2axl87l"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty")))
    (inputs
-      (list ghc-tagged
-            ghc-optparse-applicative
-            ghc-ansi-terminal
-            ghc-unbounded-delays)) ; needed on 32-bit architectures
-    (arguments
-     `(#:cabal-revision ("2"
-                         "04llcf1i3gawdik0bjhxdgls2wkiqlx0gi76nfh784nv2qzxlpbb")))
+      (append
+        (list ghc-tagged ghc-optparse-applicative ghc-ansi-terminal)
+        ;; TODO: Add ghc-unbounded-delays unconditionally on next rebuild cycle.
+        (if (member (%current-system) '("i686-linux"))
+            (list ghc-unbounded-delays)
+            '())))
    (home-page "https://github.com/UnkindPartition/tasty")
    (synopsis "Modern and extensible testing framework")
    (description
@@ -168,20 +167,17 @@ and any other types of tests into a single test suite.")
 (define-public ghc-tasty-hedgehog
  (package
    (name "ghc-tasty-hedgehog")
-    (version "1.4.0.2")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "tasty-hedgehog" version))
-       (sha256
-        (base32 "0lki03z0p38x0dkqx5cqga30zy5m31gxn1saqylja9bi6bbq8d25"))))
+    (version "1.3.1.0")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "tasty-hedgehog" version))
+              (sha256
+               (base32
+                "1iq452mvd9wc9pfmjsmm848jwp3cvsk1faf2mlr21vcs0yaxvq3m"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty-hedgehog")))
    (inputs (list ghc-tagged ghc-tasty ghc-hedgehog))
    (native-inputs (list ghc-tasty-expected-failure))
-    (arguments
-     `(#:cabal-revision ("6"
-                         "1rb8ncp6xyy7jr6v0hyls9m529ba0djndsxgxmkgr52rk3qq8lrc")))
    (home-page "https://github.com/qfpl/tasty-hedgehog")
    (synopsis "Integration for tasty and hedgehog")
    (description
@@ -194,25 +190,22 @@ framework}.")
 (define-public ghc-tasty-hspec
  (package
    (name "ghc-tasty-hspec")
-    (version "1.2.0.4")
+    (version "1.2.0.2")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "tasty-hspec" version))
       (sha256
-        (base32 "1hk1nkjvhp89xxgzj6dhbgw0fknnghpng6afq4i39hjkwv5p78ni"))))
+        (base32 "0cfcpi25jmnmzfzsx364qsj68q6gyph5z112kl8ja222hnhhr2n2"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty-hspec")))
    (inputs (list ghc-hspec
-                  ghc-hspec-api
                  ghc-hspec-core
                  ghc-quickcheck
                  ghc-tasty
                  ghc-tasty-smallcheck
-                  ghc-tasty-quickcheck))
-    (arguments
-     `(#:cabal-revision ("7"
-                         "0s1y34i8g7fva0z10ws3ipcy2jmlvqk0v4hdbx8rqnby5n0l5kay")))
+                  ghc-tasty-quickcheck
+                  ghc-tagged))
    (home-page "https://github.com/mitchellwrosen/tasty-hspec")
    (synopsis "Hspec support for the Tasty test framework")
    (description
@@ -222,17 +215,19 @@ framework}.")
 (define-public ghc-tasty-hunit
  (package
    (name "ghc-tasty-hunit")
-    (version "0.10.2")
+    (version "0.10.0.3")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "tasty-hunit" version))
       (sha256
-        (base32 "1xh33ss7dncm7zanzkzh7ywb3a46k7vkcbh6v8jb767gq6kizw2s"))))
+        (base32
+         "0gz6zz3w7s44pymw33xcxnawryl27zk33766sab96nz2xh91kvxp"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty-hunit")))
-    (inputs (list ghc-tasty ghc-call-stack-boot))
-    (home-page "https://github.com/UnkindPartition/tasty")
+    (inputs
+     (list ghc-call-stack-boot ghc-tasty))
+    (home-page "http://documentup.com/feuerbach/tasty")
    (synopsis "HUnit support for the Tasty test framework")
    (description "This package provides HUnit support for the Tasty Haskell
 test framework.")
@@ -262,13 +257,13 @@ tasty.")
 (define-public ghc-tasty-lua
  (package
    (name "ghc-tasty-lua")
-    (version "1.1.1.1")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "tasty-lua" version))
-       (sha256
-        (base32 "03b2n3gw2w70cnl57w3sh3cv5ka270sf07jlxpb4zs0z5gh83p1r"))))
+    (version "1.0.2")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "tasty-lua" version))
+              (sha256
+               (base32
+                "1vnyvgcjsvqhwwyqkbgqksr9ppj5whiihpwcqkg33sl7jj3ysdwv"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty-lua")))
    (inputs (list ghc-hslua-core
@@ -293,15 +288,16 @@ from Lua.")
       (method url-fetch)
       (uri (hackage-uri "tasty-th" version))
       (sha256
-        (base32 "0b2ivrw2257m4cy4rjnkwqlarh83j1y3zywnmaqqqbvy667sqnj3"))))
+        (base32
+         "0b2ivrw2257m4cy4rjnkwqlarh83j1y3zywnmaqqqbvy667sqnj3"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty-th")))
-    (inputs (list ghc-haskell-src-exts ghc-tasty))
-    (native-inputs (list ghc-tasty-hunit))
+    (inputs
+     (list ghc-haskell-src-exts ghc-tasty ghc-tasty-hunit))
    (home-page "https://github.com/bennofs/tasty-th")
    (synopsis "Automatically generate tasty TestTrees")
    (description
-     "Tasty-th automatically generates tasty TestTrees from functions of the
+      "Tasty-th automatically generates tasty TestTrees from functions of the
 current module, using TemplateHaskell.  This is a fork the original
 test-framework-th package, modified to work with tasty instead of
 test-framework.")
@@ -310,27 +306,28 @@ test-framework.")
 (define-public ghc-tasty-rerun
  (package
    (name "ghc-tasty-rerun")
-    (version "1.1.20")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "tasty-rerun" version))
-       (sha256
-        (base32 "0px58jm1yqbg32qf2s0yk09d2qdjxkkz9df89f31q3nzw85jv2ky"))))
+    (version "1.1.18")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "tasty-rerun" version))
+              (sha256
+               (base32
+                "0sccp5zx9v2rx741nbmgd8mzjhy5m4v74hk26d23xz93ph8aqx7s"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty-rerun")))
-    (inputs (list ghc-optparse-applicative ghc-split ghc-tagged ghc-tasty))
+    (inputs
+     (list ghc-optparse-applicative ghc-reducers ghc-split ghc-tagged
+           ghc-tasty))
    (arguments
-     `(#:cabal-revision ("1"
-                         "13xmx91hp7i0qzrhada9ckliqkynwlwa8x6pjbvxjcy1y0qsd7hk")))
+     `(#:cabal-revision ("3"
+                         "0091arn90cx5rzn5n2bpb9alzybwraf9yj7hb0bwdfyamzpf3pkb")))
    (home-page "https://github.com/ocharles/tasty-rerun")
    (synopsis "Run tests by filtering the test tree")
-    (description
-     "This package adds the ability to run tests by filtering the
+    (description "This package adds the ability to run tests by filtering the
 test tree based on the result of a previous test run.  You can use this to run
 only those tests that failed in the last run, or to only run the tests that have
 been added since previous test run.")
-    (license license:bsd-3)))
+  (license license:bsd-3)))

 (define-public ghc-tasty-expected-failure
  (package
@@ -365,17 +362,17 @@ development.")
 (define-public ghc-quickcheck-instances
  (package
    (name "ghc-quickcheck-instances")
-    (version "0.3.33")
+    (version "0.3.29.1")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "quickcheck-instances" version))
       (sha256
-        (base32 "0rl8y3rb4fm4nqz122bp5f2aya4f8bc9m9i9n2vwlyq2gdacs0v8"))))
+        (base32 "0jx2wfy7y5dr14s9i457g2aah4isjxry4mlbqhj7vlav6ib84gdj"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "quickcheck-instances")))
    (inputs (list ghc-quickcheck
-                  ghc-splitmix-bootstrap
+                  ghc-splitmix
                  ghc-case-insensitive
                  ghc-data-fix
                  ghc-hashable
@@ -386,15 +383,17 @@ development.")
                  ghc-scientific
                  ghc-strict
                  ghc-tagged
-                  ghc-text-short
                  ghc-these
                  ghc-time-compat
+                  ghc-transformers-compat
                  ghc-unordered-containers
                  ghc-uuid-types
-                  ghc-vector))
+                  ghc-vector
+                  ghc-data-array-byte
+                  ghc-text-short))
    (arguments
-     `(#:cabal-revision ("1"
-                         "1xkc7rsfgya4rwiizh0yfincws3knpdnh08m280v1dgik4kv37vh")))
+     `(#:cabal-revision ("2"
+                         "118xy4z4dy4bpkzsp98daiv3l4n5j7ph9my0saca7cqjybqwkcip")))
    (home-page "https://github.com/haskellari/qc-instances")
    (synopsis "Common quickcheck instances")
    (description "This package provides QuickCheck instances for types
@@ -410,38 +409,17 @@ provided by the Haskell Platform.")
       (method url-fetch)
       (uri (hackage-uri "quickcheck-unicode" version))
       (sha256
-        (base32 "0s43s1bzbg3gwsjgm7fpyksd1339f0m26dlw2famxwyzgvm0a80k"))))
+        (base32
+         "0s43s1bzbg3gwsjgm7fpyksd1339f0m26dlw2famxwyzgvm0a80k"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "quickcheck-unicode")))
    (inputs (list ghc-quickcheck))
-    (home-page "https://github.com/bos/quickcheck-unicode")
+    (home-page
+     "https://github.com/bos/quickcheck-unicode")
    (synopsis "Generator functions Unicode-related tests")
    (description "This package provides generator and shrink functions for
 testing Unicode-related software.")
-    (license license:bsd-2)))
-
-(define-public ghc-quickcheck-text
-  (package
-    (name "ghc-quickcheck-text")
-    (version "0.1.2.1")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "quickcheck-text" version))
-       (sha256
-        (base32 "02dbs0k6igmsa1hcw8yfvp09v7038vp4zlsp9706km3cmswgshj4"))))
-    (build-system haskell-build-system)
-    (properties '((upstream-name . "quickcheck-text")))
-    (inputs (list ghc-quickcheck))
-    (home-page "https://github.com/olorin/quickcheck-text")
-    (synopsis "Alternative arbitrary instance for Text")
-    (description
-     "The usual Arbitrary instance for Text (in
-<https://hackage.haskell.org/package/quickcheck-instances quickcheck-instances>)
-only has single-byte instances and so isn't an ideal representation of a valid
-UTF-8 character.  This package has generators for one-, two- and three-byte
-UTF-8 characters (all that are currently in use).")
-    (license license:expat)))
+    (license license:bsd-3)))

 (define-public ghc-quickcheck-io
  (package
@@ -468,19 +446,17 @@ use HUnit assertions as QuickCheck properties.")
 (define-public ghc-quickcheck
  (package
    (name "ghc-quickcheck")
-    (version "2.15.0.1")
+    (version "2.14.3")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "QuickCheck" version))
       (sha256
-        (base32 "0zvfydg44ibs1br522rzvdlxj9mpz0h62js1hay1sj5gvdnj3cm3"))))
+        (base32 "0085lwy14r7hk7ibmv8d7d54ja9zin0ijf0b27xai898dfrj43sw"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "QuickCheck")))
-    (inputs (list ghc-random-bootstrap ghc-splitmix-bootstrap))
-    (arguments
-     `(#:cabal-revision ("1"
-                         "0cgfp4s51cjphsn9cls6rndisvqmi94vn95xan9g1yz6p5xk7z8c")))
+    (inputs
+     (list ghc-random ghc-splitmix-bootstrap))
    (home-page "https://github.com/nick8325/quickcheck")
    (synopsis "Automatic testing of Haskell programs")
    (description
@@ -503,8 +479,10 @@ expressed in Haskell, using combinators defined in the QuickCheck library.")
        (base32 "1kyam4cy7qmnizjwjm8jamq43w7f0fs6ljfplwj0ib6wi2kjh0wv"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "quickcheck-assertions")))
-    (inputs (list ghc-quickcheck ghc-ieee754 ghc-pretty-show))
-    (native-inputs (list ghc-hspec))
+    (native-inputs
+     (list ghc-hspec))
+    (inputs
+     (list ghc-ieee754 ghc-pretty-show ghc-quickcheck))
    (home-page "https://github.com/s9gf4ult/quickcheck-assertions")
    (synopsis "HUnit-like assertions for QuickCheck")
    (description
@@ -516,27 +494,33 @@ HUnit.")
 (define-public ghc-test-framework
  (package
    (name "ghc-test-framework")
-    (version "0.8.2.2")
+    (version "0.8.2.0")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "test-framework" version))
       (sha256
-        (base32 "04ijf5x6xx8i5lqv9ir33zs1rfzc4qkwwz8c1fdycnzvydcv4dnp"))))
+        (base32
+         "1hhacrzam6b8f10hyldmjw8pb7frdxh04rfg3farxcxwbnhwgbpm"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "test-framework")))
-    (inputs (list ghc-ansi-terminal
-                  ghc-ansi-wl-pprint
-                  ghc-random
-                  ghc-regex-posix
-                  ghc-old-locale
-                  ghc-xml
-                  ghc-hostname))
-    (native-inputs (list ghc-hunit ghc-quickcheck ghc-semigroups-bootstrap))
    (arguments
-     `(#:cabal-revision ("1"
-                         "1yv1qsr6bxphxk9430id9bqhfmkffdqmfg0k017dp9pnn4pqj0zh")))
-    (home-page "https://github.com/haskell/test-framework#readme")
+     `(#:tests? #f  ; FIXME: Tests do not build.
+       #:cabal-revision
+       ("6" "0wbq9wiaag69nsqxwijzhs5y1hb9kbpkp1x65dvx158cxp8i9w9r")))
+    ;(native-inputs
+    ; (list ghc-hunit ghc-quickcheck))
+    (inputs
+     `(("ghc-ansi-terminal" ,ghc-ansi-terminal)
+       ("ghc-ansi-wl-pprint" ,ghc-ansi-wl-pprint)
+       ("ghc-hostname" ,ghc-hostname)
+       ("ghc-old-locale" ,ghc-old-locale)
+       ("ghc-random" ,ghc-random)
+       ("ghc-regex-posix" ,ghc-regex-posix)
+       ("ghc-xml" ,ghc-xml)
+       ("ghc-libxml" ,ghc-libxml)
+       ("ghc-semigroups" ,ghc-semigroups-bootstrap)))
+    (home-page "https://batterseapower.github.io/test-framework/")
    (synopsis "Framework for running and organising tests")
    (description
     "This package allows tests such as QuickCheck properties and HUnit test
@@ -573,21 +557,23 @@ reporting and test statistics output.")
 (define-public ghc-test-framework-quickcheck2
  (package
    (name "ghc-test-framework-quickcheck2")
-    (version "0.3.0.6")
+    (version "0.3.0.5")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "test-framework-quickcheck2" version))
       (sha256
-        (base32 "1d0w2q9sm8aayk0aj1zr2irpnqwpzixn6pdfq1i904vs1kkb2xin"))))
+        (base32
+         "0ngf9vvby4nrdf1i7dxf5m9jn0g2pkq32w48xdr92n9hxka7ixn9"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "test-framework-quickcheck2")))
-    (inputs (list ghc-test-framework ghc-quickcheck ghc-extensible-exceptions
-                  ghc-random))
    (arguments
-     `(#:cabal-revision ("1"
-                         "1af2gw9gvq143jdqmsnxj23cgss9ffdyr67951a5x151aps04y7z")))
-    (home-page "https://github.com/haskell/test-framework")
+     `(#:cabal-revision
+       ("3" "0mglqfimla4vvv80mg08aj76zf4993wmngqlirh05h8i9nmgv6lh")))
+    (inputs
+     (list ghc-extensible-exceptions ghc-quickcheck ghc-random
+           ghc-test-framework))
+    (home-page "https://batterseapower.github.io/test-framework/")
    (synopsis "QuickCheck2 support for test-framework")
    (description
     "This package provides QuickCheck2 support for the test-framework
@@ -606,8 +592,9 @@ package.")
        (base32 "1xpgpk1gp4w7w46b4rhj80fa0bcyz8asj2dcjb5x1c37b7rw90b0"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "test-framework-smallcheck")))
-    (inputs (list ghc-test-framework ghc-smallcheck))
-    (home-page "https://github.com/feuerbach/smallcheck")
+    (inputs
+     (list ghc-smallcheck ghc-test-framework))
+    (home-page "https://github.com/Bodigrim/smallcheck")
    (synopsis "SmallCheck support for test-framework")
    (description
     "This package lets programmers use SmallCheck properties in Haskell's
@@ -673,17 +660,17 @@ JUnit tool for Java.")
 (define-public hspec-discover
  (package
    (name "hspec-discover")
-    (version "2.11.12")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "hspec-discover" version))
-       (sha256
-        (base32 "044vgsy45ff00h9z2k3jgn2m37npcjiacc4cifahrjlmwa7a7ylp"))))
+    (version "2.9.7")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "hspec-discover" version))
+              (sha256
+               (base32
+                "0536kdxjw6p8b6gcwvmr22jbmb6cgzbddi0fkd01b2m847z37sb5"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hspec-discover")))
    (native-inputs (list ghc-quickcheck ghc-hspec-meta ghc-mockery-bootstrap))
-    (home-page "https://hspec.github.io/")
+    (home-page "http://hspec.github.io/")
    (synopsis "Automatically discover and run Hspec tests")
    (description "hspec-discover is a tool which automatically discovers and
 runs Hspec tests.")
@@ -692,30 +679,28 @@ runs Hspec tests.")
 (define-public ghc-hspec-core
  (package
    (name "ghc-hspec-core")
-    (version "2.11.12")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "hspec-core" version))
-       (sha256
-        (base32 "030400w95775jrivbi7n1nnx6j5z717rqd3986ggklb8h9hjalfc"))))
+    (version "2.9.7")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "hspec-core" version))
+              (sha256
+               (base32
+                "040rzqiqwkp373jjpij8lkmv08pp2ya92zzcf95bw8px215rp08n"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hspec-core")))
    (inputs (list ghc-hunit
                  ghc-quickcheck
                  ghc-ansi-terminal
                  ghc-call-stack
-                  ghc-haskell-lexer
+                  ghc-clock
                  ghc-hspec-expectations
                  ghc-quickcheck-io
                  ghc-random
+                  ghc-setenv
                  ghc-tf-random))
    (native-inputs (list ghc-base-orphans-bootstrap ghc-hspec-meta
-                         ghc-silently-bootstrap ghc-temporary-bootstrap))
-    (arguments
-     `(#:cabal-revision ("1"
-                         "0yq9nnawcgbgxiz4ymfa8k66jrvgrhmv8j7g880x8k6q8q4ncqlq")))
-    (home-page "https://hspec.github.io/")
+                         ghc-silently-bootstrap ghc-temporary))
+    (home-page "http://hspec.github.io/")
    (synopsis "Testing framework for Haskell")
    (description "This library exposes internal types and functions that can
 be used to extend Hspec's functionality.")
@@ -724,28 +709,23 @@ be used to extend Hspec's functionality.")
 (define-public ghc-hspec-meta
  (package
    (name "ghc-hspec-meta")
-    (version "2.11.12")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "hspec-meta" version))
-       (sha256
-        (base32 "1612pg5gihqjxrzqqvbbgckaqiwq3rmz3rg07lrjhzklg975nj69"))))
+    (version "2.9.3")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "hspec-meta" version))
+              (sha256
+               (base32
+                "1raxwpsmcijl3x2h5naw6aydhbiknxvhj3x7v384bi1rqi51ainm"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hspec-meta")))
-    (inputs (list ghc-hunit
-                  ghc-quickcheck
+    (inputs (list ghc-quickcheck
                  ghc-ansi-terminal
                  ghc-call-stack-boot
-                  ghc-haskell-lexer
-                  ghc-hspec-expectations
+                  ghc-clock
                  ghc-quickcheck-io
                  ghc-random
-                  ghc-tf-random))
-    (arguments
-     `(#:cabal-revision ("2"
-                         "1jrk14s51psb0zjici56220iyb98i3q06sd3rsyx594s3cddgn5d")))
-    (home-page "https://hspec.github.io/")
+                  ghc-setenv))
+    (home-page "http://hspec.github.io/")
    (synopsis "Version of Hspec to test Hspec itself")
    (description "This library provides a stable version of Hspec which is
 used to test the in-development version of Hspec.")
@@ -754,58 +734,38 @@ used to test the in-development version of Hspec.")
 (define-public ghc-hspec
  (package
    (name "ghc-hspec")
-    (version "2.11.12")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "hspec" version))
-       (sha256
-        (base32 "1zdgkn0gkcphcsfqcqwcfqiqvkz12ljks46v3czpaysndz8icfip"))))
+    (version "2.9.7")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "hspec" version))
+              (sha256
+               (base32
+                "092sfqjkargxxszp9jjqa8ldjz0xv34jwn6k21q59ys5ckvsrpc1"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hspec")))
    (inputs (list ghc-quickcheck ghc-hspec-core hspec-discover
                  ghc-hspec-expectations))
-    (home-page "https://hspec.github.io/")
+    (home-page "http://hspec.github.io/")
    (synopsis "Testing Framework for Haskell")
    (description "This library provides the Hspec testing framework for
 Haskell, inspired by the Ruby library RSpec.")
    (license license:expat)))

-(define-public ghc-hspec-api
-  (package
-    (name "ghc-hspec-api")
-    (version "2.11.12")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "hspec-api" version))
-       (sha256
-        (base32 "1xn2b2hafyq6qm3zaia9nw27ir4cg8v2qn499bz2zwnp2vkjra07"))))
-    (build-system haskell-build-system)
-    (properties '((upstream-name . "hspec-api")))
-    (inputs (list ghc-hspec-core))
-    (native-inputs (list ghc-hspec))
-    (home-page "https://hspec.github.io/")
-    (synopsis "A Testing Framework for Haskell")
-    (description
-     "This package provides a stable API that can be used to extend Hspec's
-functionality.")
-    (license license:expat)))
-
 (define-public ghc-hspec-contrib
  (package
    (name "ghc-hspec-contrib")
-    (version "0.5.2")
+    (version "0.5.1.1")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "hspec-contrib" version))
       (sha256
-        (base32 "0002xzvyh790iwf1y33d4nflrbp5sxvpsp010srcfryf1n3qx2b0"))))
+        (base32 "1nyb5n2jiq920yyf3flzyxrs5xpfyppl3jn18zhviyysjjk5drpx"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hspec-contrib")))
    (inputs (list ghc-hunit ghc-call-stack ghc-hspec-core))
    (native-inputs (list ghc-quickcheck ghc-hspec hspec-discover))
+    (arguments (list #:tests? #f)) ; Fail to build.
    (home-page "https://hspec.github.io/")
    (synopsis "Contributed functionality for Hspec")
    (description "This package provides contributed Hspec extensions.")
@@ -814,25 +774,22 @@ functionality.")
 (define-public ghc-hspec-expectations
  (package
    (name "ghc-hspec-expectations")
-    (version "0.8.4")
+    (version "0.8.2")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "hspec-expectations" version))
       (sha256
-        (base32 "1zr1pqchcwglfr5dvcrgc1l5x924n9w09n2zr68dmkqf4dzdx3bv"))))
+        (base32
+         "1vxl9zazbaapijr6zmcj72j9wf7ka1pirrjbwddwwddg3zm0g5l1"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hspec-expectations")))
-    (inputs (list ghc-hunit ghc-call-stack))
-    (arguments
    ;; Tests depend on ghc-nanospec.
-     `(#:tests? #f
-       #:cabal-revision ("2"
-                         "14zzsjqcz1zbnvi50i82lx84nc8b5da7ar5cazzh44lklyag0ds2")))
-    (home-page "https://github.com/hspec/hspec-expectations#readme")
+    (arguments '(#:tests? #f))
+    (inputs (list ghc-hunit))
+    (home-page "https://github.com/sol/hspec-expectations")
    (synopsis "Catchy combinators for HUnit")
-    (description
-     "This library provides catchy combinators for HUnit, see
+    (description "This library provides catchy combinators for HUnit, see
@uref{https://github.com/sol/hspec-expectations#readme, the README}.")
    (license license:expat)))

@@ -897,13 +854,13 @@ implementations of cryptographic ciphers.")
 (define-public ghc-hedgehog
  (package
    (name "ghc-hedgehog")
-    (version "1.5")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "hedgehog" version))
-       (sha256
-        (base32 "0sl6x9q9kyrpv73565w9na9dm10wzxdl0qgiraqarffynfgn0hg9"))))
+    (version "1.1.2")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "hedgehog" version))
+              (sha256
+               (base32
+                "0dbk75hk6hqpzkjdlpw3s63qhm42kqigij33p321by6xndb59jg1"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "hedgehog")))
    (inputs (list ghc-ansi-terminal
@@ -918,12 +875,8 @@ implementations of cryptographic ciphers.")
                  ghc-primitive
                  ghc-random
                  ghc-resourcet
-                  ghc-safe-exceptions
                  ghc-transformers-base
                  ghc-wl-pprint-annotated))
-    (arguments
-     `(#:cabal-revision ("2"
-                         "1m0b9m8dw5nw4b3w1jbp5fd0b0kqlyvvy3qsfxc7md77iafxq169")))
    (home-page "https://hedgehog.qa")
    (synopsis "Property-based testing in the spirt of QuickCheck")
    (description
@@ -939,16 +892,26 @@ To get started quickly, see the examples:
 (define-public cabal-doctest
  (package
    (name "cabal-doctest")
-    (version "1.0.11")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "cabal-doctest" version))
-       (sha256
-        (base32 "0gwjpwv2v7c7gs2dvf7ixsxx6likmgw5yi0fy4bqc0i7nkqg4bfw"))))
+    (version "1.0.9")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "cabal-doctest" version))
+              (sha256
+               (base32
+                "0wxs0xkspc80h0g8ks792lrzldxvcnhc9rja1j0k678ijs20hmjm"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "cabal-doctest")))
-    (home-page "https://github.com/ulidtko/cabal-doctest")
+    (arguments
+     `(#:cabal-revision ("2"
+                         "0868js0qgfhvmyw4hjzrvmlzyqsm8dfsbmqhybxb90x44xi3r0i1")
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'configure 'update-constraints
+           (lambda _
+             (substitute* "cabal-doctest.cabal"
+               (("\\b(Cabal|base)\\s+[^,]+" all dep)
+                dep)))))))
+    (home-page "https://github.com/haskellari/cabal-doctest")
    (synopsis "Setup.hs helper for running doctests")
    (description
     "To properly work, the @code{doctest} package needs plenty of
@@ -1008,13 +971,13 @@ random testing, and hybrids of the two.")
 (define-public ghc-inspection-testing
  (package
    (name "ghc-inspection-testing")
-    (version "0.6.2")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "inspection-testing" version))
-       (sha256
-        (base32 "0zi1q86sd9jy5dpqfs2j71acdl7kvik0ps78xirpdhyldhwwyqws"))))
+    (version "0.4.6.1")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "inspection-testing" version))
+              (sha256
+               (base32
+                "0mxff0v3ciccbk4b8kxnh4752fzbwn7213qd8xji0csv6gi2w83y"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "inspection-testing")))
    (home-page "https://github.com/nomeata/inspection-testing")
@@ -1047,33 +1010,33 @@ examples and more information.")
    (name "ghc-quickcheck-classes")
    (version "0.6.5.0")
    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "quickcheck-classes" version))
-       (sha256
-        (base32 "19iw15mvb7gws3ljdxqwsbb4pmfc0sfflf8szgmrhiqr3k82mqv2"))))
+      (origin
+        (method url-fetch)
+        (uri (hackage-uri "quickcheck-classes" version))
+        (sha256
+          (base32 "19iw15mvb7gws3ljdxqwsbb4pmfc0sfflf8szgmrhiqr3k82mqv2"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "quickcheck-classes")))
-    (inputs (list ghc-quickcheck
-                  ghc-primitive
-                  ghc-primitive-addr
-                  ghc-quickcheck-classes-base
-                  ghc-semigroups-bootstrap
-                  ghc-fail
-                  ghc-tagged
-                  ghc-aeson
-                  ghc-semigroupoids
-                  ghc-semirings
-                  ghc-vector))
-    (native-inputs (list ghc-base-orphans ghc-base-orphans ghc-tasty
-                         ghc-tasty-quickcheck))
-    (arguments
-     `(#:cabal-revision ("3"
-                         "1pawam5rsdcdv21fqc87khzqjm0ixwzklfxd6gk3b2qrr5q66bn5")))
+    (inputs
+      (list ghc-quickcheck
+            ghc-primitive
+            ghc-primitive-addr
+            ghc-quickcheck-classes-base
+            ghc-aeson
+            ghc-semigroupoids
+            ghc-semirings
+            ghc-vector))
+    (native-inputs
+      (list ghc-base-orphans
+            ghc-tagged
+            ghc-base-orphans
+            ghc-tagged
+            ghc-tasty
+            ghc-tasty-quickcheck))
    (home-page "https://github.com/andrewthad/quickcheck-classes#readme")
    (synopsis "QuickCheck common typeclasses")
    (description
-     "This library provides QuickCheck properties to ensure that typeclass
+      "This library provides QuickCheck properties to ensure that typeclass
 instances adhere to the set of laws that they are supposed to.  There are
 other libraries that do similar things, such as @code{genvalidity-hspec} and
@code{checkers}.  This library differs from other solutions by not introducing
@@ -1089,26 +1052,24 @@ constraints more cleanly.")
    (name "ghc-quickcheck-classes-base")
    (version "0.6.2.0")
    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "quickcheck-classes-base" version))
-       (sha256
-        (base32 "16c6gq4cqpkwnq1pzkhm6r7mrwk4an50ha5w77bmiia2qkhla6ch"))))
+      (origin
+        (method url-fetch)
+        (uri (hackage-uri "quickcheck-classes-base" version))
+        (sha256
+          (base32 "16c6gq4cqpkwnq1pzkhm6r7mrwk4an50ha5w77bmiia2qkhla6ch"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "quickcheck-classes-base")))
-    (inputs (list ghc-quickcheck
-                  ghc-contravariant
-                  ghc-bifunctors
-                  ghc-semigroups-bootstrap
-                  ghc-fail
-                  ghc-tagged))
-    (arguments
-     `(#:cabal-revision ("1"
-                         "1p3v38jhpx0r6rnvaspkkivl8xyq2mq4xnmycgmkj1gr77vplkdr")))
+    (inputs
+      (list ghc-quickcheck
+            ghc-contravariant
+            ghc-bifunctors
+            ghc-semigroups
+            ghc-fail
+            ghc-tagged))
    (home-page "https://github.com/andrewthad/quickcheck-classes#readme")
    (synopsis "QuickCheck common typeclasses from `base`")
    (description
-     "This library is a minimal variant of `quickcheck-classes` that only
+      "This library is a minimal variant of `quickcheck-classes` that only
 provides laws for typeclasses from `base`.  The main purpose of splitting this
 out is so that `primitive` can depend on `quickcheck-classes-base` in its test
 suite, avoiding the circular dependency that arises if `quickcheck-classes` is
@@ -1126,61 +1087,67 @@ this library uses the higher-kinded typeclasses
 (define-public ghc-doctest-lib
  (package
    (name "ghc-doctest-lib")
-    (version "0.1.1.1")
+    (version "0.1")
    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "doctest-lib" version))
-       (sha256
-        (base32 "1hb3zx1xzib3v41blnwcbhc2v0rzwdzq7gm4sajqndimwjkkxc67"))))
+      (origin
+        (method url-fetch)
+        (uri (hackage-uri "doctest-lib" version))
+        (sha256
+          (base32 "1vswam0dhw52dihgnzirh18gqs8rj8h6jd7pl6y1mg2f9f9zmih2"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "doctest-lib")))
    (home-page "https://hub.darcs.net/thielema/doctest-lib/")
    (synopsis "Parts of doctest exposed as library")
    (description
-     "Parts of doctest exposed as library.  For use with the doctest-extract utility.")
+      "Parts of doctest exposed as library.  For use with the doctest-extract utility.")
    (license license:expat)))

 (define-public ghc-doctest-exitcode-stdio
  (package
    (name "ghc-doctest-exitcode-stdio")
-    (version "0.0.0.1")
+    (version "0.0")
    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "doctest-exitcode-stdio" version))
-       (sha256
-        (base32 "0kg5xiw4giyvqpcj6cxqqnysvixhxlwm0pbg3qks8dzwb5w79dvk"))))
+      (origin
+        (method url-fetch)
+        (uri (hackage-uri "doctest-exitcode-stdio" version))
+        (sha256
+          (base32 "1g3c7yrqq2mwqbmvs8vkx1a3cf0p0x74b7fnn344dsk7bsfpgv0x"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "doctest-exitcode-stdio")))
-    (inputs (list ghc-doctest-lib ghc-quickcheck ghc-semigroups))
+    (inputs
+      (list ghc-doctest-lib ghc-quickcheck ghc-semigroups))
+    (arguments
+     `(#:cabal-revision ("1"
+                         "1065s8bch6zhl6mc8nhvfpwd1irmjd04z7xgycbpihc14x4ijim3")))
    (home-page "https://hub.darcs.net/thielema/doctest-exitcode-stdio/")
    (synopsis "Run Doctests in a @code{Cabal.Test.exitcode-stdio} environment")
    (description
-     "This package allows on to run Doctests in a Cabal.Test.exitcode-stdio
+      "This package allows on to run Doctests in a Cabal.Test.exitcode-stdio
 environment.")
    (license license:bsd-3)))

 (define-public ghc-tasty-silver
  (package
    (name "ghc-tasty-silver")
-    (version "3.3.2.1")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "tasty-silver" version))
-       (sha256
-        (base32 "01w3576kymglcddinh10m1wgy71dia49k2pnw5y1c97jjrhanf17"))))
+    (version "3.3.1.1")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "tasty-silver" version))
+              (sha256
+               (base32
+                "13j0zs0ciijv9q2nncna1gbgsgw2g7xc228hzmqic1750n3ybz9m"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty-silver")))
    (inputs (list ghc-ansi-terminal
+                  ghc-async
                  ghc-optparse-applicative
                  ghc-process-extras
                  ghc-regex-tdfa
                  ghc-silently
                  ghc-tagged
                  ghc-tasty
-                  ghc-temporary))
+                  ghc-temporary
+                  ghc-semigroups))
    (native-inputs (list ghc-tasty-hunit))
    (home-page "https://github.com/phile314/tasty-silver")
    (synopsis "Fancy test runner, including support for golden tests")
@@ -1196,19 +1163,16 @@ result of golden tests.")
 (define-public ghc-tasty-inspection-testing
  (package
    (name "ghc-tasty-inspection-testing")
-    (version "0.2.1")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "tasty-inspection-testing" version))
-       (sha256
-        (base32 "0wl2xlnbmqdkwhi4ic6a4q4lxf9qg433lidi8d0hlp3ykrjpbcay"))))
+    (version "0.1.0.1")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "tasty-inspection-testing" version))
+              (sha256
+               (base32
+                "0p46w44f19w7lvdzyg3vq6qzix0rjp8p23ilxz82dviq38lgmifp"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tasty-inspection-testing")))
    (inputs (list ghc-inspection-testing ghc-tasty))
-    (arguments
-     `(#:cabal-revision ("2"
-                         "0z9al0hyq381fw146agbpz7rf24rwms1w91m7s0k1w3xbfw16l9n")))
    (home-page "https://github.com/Bodigrim/tasty-inspection-testing")
    (synopsis "Inspection testing support for tasty")
    (description
@@ -62,19 +62,18 @@ format.")
  (package
    (name "ghc-asn1-encoding")
    (version "0.9.6")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "asn1-encoding" version))
-       (sha256
-        (base32 "02nsr30h5yic1mk7znf0q4z3n560ip017n60hg7ya25rsfmxxy6r"))))
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "asn1-encoding" version))
+              (sha256
+               (base32
+                "02nsr30h5yic1mk7znf0q4z3n560ip017n60hg7ya25rsfmxxy6r"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "asn1-encoding")))
-    (inputs (list ghc-hourglass ghc-asn1-types))
-    (native-inputs (list ghc-tasty ghc-tasty-quickcheck))
-    (arguments
-     `(#:cabal-revision ("2"
-                         "16503ryhq15f2rfdav2qnkq11dg2r3vk3f9v64q9dmxf8dh8zv97")))
+    (inputs
+     (list ghc-hourglass ghc-asn1-types))
+    (native-inputs
+     (list ghc-tasty ghc-tasty-quickcheck))
    (home-page "https://github.com/vincenthz/hs-asn1")
    (synopsis "ASN1 data reader and writer in RAW, BER and DER forms")
    (description
@@ -112,18 +111,15 @@ when ASN1 pattern matching is not convenient.")
       (method url-fetch)
       (uri (hackage-uri "crypto-api" version))
       (sha256
-        (base32 "19bsmkqkpnvh01b77pmyarx00fic15j4hvg4pzscrj4prskrx2i9"))))
+        (base32
+         "19bsmkqkpnvh01b77pmyarx00fic15j4hvg4pzscrj4prskrx2i9"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "crypto-api")))
    (inputs (list ghc-cereal ghc-tagged ghc-entropy))
-    (arguments
-     `(#:cabal-revision ("1"
-                         "1z6n1sa5pn3iqvqjrd8hv4bc2pxzsrhm5sh0l8z7g9lbqp6w0wp5")))
    (home-page "https://github.com/TomMD/crypto-api")
    (synopsis "Provides generic interface for cryptographic operations
 for Haskell")
-    (description
-     "This Haskell package provides a generic interface for
+    (description "This Haskell package provides a generic interface for
 cryptographic operations (hashes, ciphers, randomness).

 Maintainers of hash and cipher implementations are encouraged to add instances
@@ -201,15 +197,13 @@ that hides the C implementation.")
       (method url-fetch)
       (uri (hackage-uri "cryptohash-md5" version))
       (sha256
-        (base32 "018g13hkmq5782i24b4518hcd926fl6x6fh5hd7b9wlxwc5dn21v"))))
+        (base32
+         "018g13hkmq5782i24b4518hcd926fl6x6fh5hd7b9wlxwc5dn21v"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "cryptohash-md5")))
    (native-inputs (list ghc-base16-bytestring ghc-puremd5 ghc-tasty
-                         ghc-tasty-quickcheck ghc-tasty-hunit))
-    (arguments
-     `(#:cabal-revision ("6"
-                         "0m7f9mgw4w9vcch37ja9zgbn0knq8rjppqr9x2ylkcdxfdnmhhif")))
-    (home-page "https://github.com/haskell-hvr/cryptohash-md5")
+                         ghc-tasty-hunit ghc-tasty-quickcheck))
+    (home-page "https://github.com/hvr/cryptohash-md5")
    (synopsis "MD5 implementation for Haskell")
    (description "This Haskell package provides implementation of MD5.")
    (license license:bsd-3)))
@@ -218,20 +212,20 @@ that hides the C implementation.")
  (package
    (name "ghc-cryptohash-sha1")
    (version "0.11.101.0")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "cryptohash-sha1" version))
-       (sha256
-        (base32 "0h9jl9v38gj0vnscqx7xdklk634p05fa6z2pcvknisq2mnbjq154"))))
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "cryptohash-sha1" version))
+              (sha256
+               (base32
+                "0h9jl9v38gj0vnscqx7xdklk634p05fa6z2pcvknisq2mnbjq154"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "cryptohash-sha1")))
    (native-inputs (list ghc-base16-bytestring ghc-sha ghc-tasty
                         ghc-tasty-quickcheck ghc-tasty-hunit))
    (arguments
-     `(#:cabal-revision ("6"
-                         "1cxdw2y10z4v0mz91wki7f233jziipx85j4qy5msig4nv3djkprb")))
-    (home-page "https://github.com/haskell-hvr/cryptohash-sha1")
+     `(#:cabal-revision ("1"
+                         "0bz9rfl7b2iwn45m0lxcmsyi5rrv3xdgzx2lzr79bds91dw6i25b")))
+    (home-page "https://github.com/hvr/cryptohash-sha1")
    (synopsis "SHA-1 implementation for Haskell")
    (description
     "This Haskell package provides an incremental and one-pass,
@@ -252,18 +246,20 @@ the C implementation.")
       (method url-fetch)
       (uri (hackage-uri "cryptohash-sha256" version))
       (sha256
-        (base32 "1xkb7iqplbw4fy1122p79xf1zcb7k44rl0wmfj1q06l7cdqxr9vk"))))
+        (base32
+         "1xkb7iqplbw4fy1122p79xf1zcb7k44rl0wmfj1q06l7cdqxr9vk"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "cryptohash-sha256")))
-    (native-inputs (list ghc-base16-bytestring ghc-sha ghc-tasty
-                         ghc-tasty-quickcheck ghc-tasty-hunit))
    (arguments
-     `(#:cabal-revision ("6"
-                         "01s12sl5mxvraj5fj3cs0pkb03pm8xpjz13y09dpl7i6rv6f578f")))
-    (home-page "https://github.com/haskell-hvr/cryptohash-sha256")
+     `(#:cabal-revision
+       ("1" "1hyzqv30rpj920ddnr0zypyjjlh52vyp2d140pn2byayj820rkgs")
+       #:tests? #f)) ; TODO: tasty ==1.1.*
+    (native-inputs
+     (list ghc-base16-bytestring ghc-sha ghc-tasty ghc-tasty-hunit
+           ghc-tasty-quickcheck))
+    (home-page "https://github.com/hvr/cryptohash-sha1")
    (synopsis "SHA-256 implementation for Haskell")
-    (description
-     "This Haskell package provides an incremental and
+    (description "This Haskell package provides an incremental and
 one-pass, pure API to the @uref{https://en.wikipedia.org/wiki/SHA-2,
 SHA-256 cryptographic hash algorithm}, with performance close to the
 fastest implementations available in other languages.
@@ -276,12 +272,12 @@ the C implementation.")
  (package
    (name "ghc-cryptonite")
    (version "0.30")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "cryptonite" version))
-       (sha256
-        (base32 "07bb97iszhnrfddh5ql6p3dqd0c13xycjw5n2kljw7d0ia59q2an"))))
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "cryptonite" version))
+              (sha256
+               (base32
+                "07bb97iszhnrfddh5ql6p3dqd0c13xycjw5n2kljw7d0ia59q2an"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "cryptonite")))
    (inputs (list ghc-memory ghc-basement))
@@ -330,17 +326,19 @@ elsewhere.")
 (define-public ghc-digest
  (package
    (name "ghc-digest")
-    (version "0.0.2.1")
+    (version "0.0.1.7")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "digest" version))
       (sha256
-        (base32 "163418p50bqdxn8ajzj6x3455xbch9jq1w6psbkdz5qzw017py6b"))))
+        (base32 "02jzw0bsng87y1n2kgpy7vb30lvqsnpbfd8dpg4hmvbg9s06qgdj"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "digest")))
    (arguments
-     `(#:extra-directories ("zlib")))
+     `(#:extra-directories ("zlib")
+       #:cabal-revision ("1"
+                         "0wh34kyag2vhwvsdwv8qmvm13gy32nc94yfyqfdnl67nyc2sx8wl")))
    (inputs (list zlib))
    (native-inputs (list pkg-config))
    (home-page "http://hackage.haskell.org/package/digest")
@@ -354,13 +352,13 @@ are implemented as FFI bindings to efficient code from zlib.")
 (define-public ghc-entropy
  (package
    (name "ghc-entropy")
-    (version "0.4.1.11")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "entropy" version))
-       (sha256
-        (base32 "1slj5n783k2amsx2hqs5qwvcw4rgfhdhgmiyg7cii0wg4w0mmpgm"))))
+    (version "0.4.1.10")
+    (source (origin
+              (method url-fetch)
+              (uri (hackage-uri "entropy" version))
+              (sha256
+               (base32
+                "1rbx4ydabrjs8kkdg9laznkh9nisiq6b5z93vnp9bh6iy59ivb45"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "entropy")))
    (home-page "https://github.com/TomMD/entropy")
@@ -417,35 +415,6 @@ the MD5 digest (hash) algorithm.  This now supports the @code{crypto-api} class
 interface.")
    (license license:bsd-3)))

-(define-public ghc-rsa
-  (package
-    (name "ghc-rsa")
-    (version "2.4.1")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "RSA" version))
-       (sha256
-        (base32 "0hchsqrxpfw7mqrqwscfy8ig1w2di6w3nxpzi873w0gibv2diibj"))))
-    (build-system haskell-build-system)
-    (properties '((upstream-name . "RSA")))
-    (inputs (list ghc-crypto-api ghc-crypto-pubkey-types ghc-sha))
-    (native-inputs (list ghc-quickcheck ghc-tagged ghc-test-framework
-                         ghc-test-framework-quickcheck2))
-    (arguments
-     `(#:cabal-revision ("2"
-                         "090yzm99fmh7c6z4m9hbkasqhc3xlw104g2b6wnk77n1abd13ryj")))
-    (home-page "http://hackage.haskell.org/package/RSA")
-    (synopsis
-     "Implementation of RSA, using the padding schemes of PKCS#1 v2.1.")
-    (description
-     "This library implements the RSA encryption and signature algorithms for
-arbitrarily-sized @code{ByteStrings}.  While the implementations work, they are
-not necessarily the fastest ones on the planet.  Particularly key generation.
-The algorithms included are based of RFC 3447, or the Public-Key Cryptography
-Standard for RSA, version 2.1 (a.k.a, PKCS#1 v2.1).")
-    (license license:bsd-3)))
-
 (define-public ghc-sha
  (package
    (name "ghc-sha")
@@ -625,24 +594,6 @@ implementation.  If it matters for your case, you should make sure you have
 AES-NI available, or you'll need to use a different implementation.")
    (license license:bsd-3)))

-(define-public ghc-crypto-pubkey-types
-  (package
-    (name "ghc-crypto-pubkey-types")
-    (version "0.4.3")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "crypto-pubkey-types" version))
-       (sha256
-        (base32 "0q0wlzjmpx536h1zcdzrpxjkvqw8abj8z0ci38138kpch4igbnby"))))
-    (build-system haskell-build-system)
-    (properties '((upstream-name . "crypto-pubkey-types")))
-    (inputs (list ghc-asn1-types ghc-asn1-encoding))
-    (home-page "http://github.com/vincenthz/hs-crypto-pubkey-types")
-    (synopsis "Generic cryptography Public keys algorithm types")
-    (description "Generic cryptography public keys algorithm types.")
-    (license license:bsd-3)))
-
 (define-public ghc-crypto-random
  (package
    (name "ghc-crypto-random")
@@ -666,13 +617,13 @@ abstraction for CPRNGs.")
 (define-public ghc-crypton
  (package
    (name "ghc-crypton")
-    (version "1.0.4")
+    (version "0.34")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "crypton" version))
       (sha256
-        (base32 "06h1qjvqd8gmiyzvh31sc061vcgns101l0774c44a8k44015925l"))))
+        (base32 "1mhypjhzn95in853bp7ary0a2xc6lsji6j8hrrgn2mfa4ilq8i24"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "crypton")))
    (inputs (list ghc-memory ghc-basement))
@@ -702,13 +653,13 @@ abstraction for CPRNGs.")
 (define-public ghc-crypton-x509
  (package
    (name "ghc-crypton-x509")
-    (version "1.7.7")
+    (version "1.7.6")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "crypton-x509" version))
       (sha256
-        (base32 "10pkva9wvm6ih48bprxlnyhnn3nr6xq9dhkrk4hfxpsaij6f9v7g"))))
+        (base32 "1zyaz0krf08g36g30zr5wn8f2x51l4dj2zcjnhpiw9h05p54mdzb"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "crypton-x509")))
    (inputs (list ghc-memory
@@ -718,7 +669,13 @@ abstraction for CPRNGs.")
                  ghc-asn1-encoding
                  ghc-asn1-parse
                  ghc-crypton))
-    (native-inputs (list ghc-tasty ghc-tasty-quickcheck))
+    (native-inputs (list ghc-tasty ghc-tasty-quickcheck ghc-x509))
+    (arguments
+     `(#:cabal-revision ("1"
+                         "10a2x47znhbayyfr6fqgq27623akpycyjbfxz4hnavavf1x6ary5")
+       ;; build phase fails when tests are activated.
+       ;; See https://github.com/kazu-yamamoto/crypton-certificate/pull/7
+       #:tests? #f))
    (home-page "https://github.com/kazu-yamamoto/crypton-certificate")
    (synopsis "X509 reader and writer")
    (description "This package provides generic X509 support for Haskell.")
@@ -727,13 +684,13 @@ abstraction for CPRNGs.")
 (define-public ghc-crypton-x509-store
  (package
    (name "ghc-crypton-x509-store")
-    (version "1.6.11")
+    (version "1.6.9")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "crypton-x509-store" version))
       (sha256
-        (base32 "07vq7f883cm5krqz2kc0qkh9ks54jknrwdqvfqsk91s12b693a83"))))
+        (base32 "0vr5b9cyf9x016wn1g0bryslf5nz8jq2sy8r3llwqfg02apihqiy"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "crypton-x509-store")))
    (inputs (list ghc-pem ghc-asn1-types ghc-asn1-encoding ghc-crypton
@@ -770,25 +727,24 @@ storage methods, and accessors.")
 (define-public ghc-crypton-x509-validation
  (package
    (name "ghc-crypton-x509-validation")
-    (version "1.6.14")
+    (version "1.6.12")
    (source
     (origin
       (method url-fetch)
       (uri (hackage-uri "crypton-x509-validation" version))
       (sha256
-        (base32 "07b09kgrd3m5ahxpj458r5ycd30bz8ldwjwf19mdcnfv4x0kj3pd"))))
+        (base32 "1xjhwvmkcy47a6xiqxb3xy944ca7g660203jdrz5xzd46zibfq0f"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "crypton-x509-validation")))
    (inputs (list ghc-memory
                  ghc-hourglass
-                  ghc-data-default
+                  ghc-data-default-class
                  ghc-pem
                  ghc-asn1-types
                  ghc-asn1-encoding
                  ghc-crypton-x509
                  ghc-crypton-x509-store
-                  ghc-crypton
-                  ghc-iproute))
+                  ghc-crypton))
    (native-inputs (list ghc-tasty ghc-tasty-hunit))
    (home-page "https://github.com/kazu-yamamoto/crypton-certificate")
    (synopsis "X.509 Certificate and CRL validation")
@@ -796,44 +752,6 @@ storage methods, and accessors.")
 and @dfn{Certificates revocation list} (CRL) validation.")
    (license license:bsd-3)))

-(define-public ghc-crypton-socks
-  (package
-    (name "ghc-crypton-socks")
-    (version "0.6.2")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "crypton-socks" version))
-       (sha256
-        (base32 "0fwzlvndyxjwhxambxdjzzm63yvb6jzsg53dkv3i6x17biz0hdm8"))))
-    (build-system haskell-build-system)
-    (properties '((upstream-name . "crypton-socks")))
-    (inputs (list ghc-cereal ghc-network ghc-network-bsd))
-    (home-page "http://github.com/mpilgrem/crypton-socks")
-    (synopsis "SOCKS Protocol Version 5")
-    (description
-     "This package provides a library implementing SOCKS Protocol Version 5.")
-    (license license:bsd-3)))
-
-(define-public ghc-crypto-token
-  (package
-    (name "ghc-crypto-token")
-    (version "0.1.2")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (hackage-uri "crypto-token" version))
-       (sha256
-        (base32 "18xphlvn6wzyi6lqrvm5vic97pkcbiph1938p5l1mb22rj5215zm"))))
-    (build-system haskell-build-system)
-    (properties '((upstream-name . "crypto-token")))
-    (inputs (list ghc-crypton ghc-memory ghc-network-byte-order))
-    (native-inputs (list ghc-hspec hspec-discover))
-    (home-page "http://hackage.haskell.org/package/crypto-token")
-    (synopsis "crypto tokens")
-    (description "Encrypted tokens/tickets to keep state in the client side.")
-    (license license:bsd-3)))
-
 (define-public ghc-cprng-aes
  (package
    (name "ghc-cprng-aes")
@@ -886,17 +804,20 @@ percent.
       (method url-fetch)
       (uri (hackage-uri "ed25519" version))
       (sha256
-        (base32 "0v8msqvgzimhs7p5ri25hrb1ni2wvisl5rmdxy89fc59py79b9fq"))))
+        (base32
+         "0v8msqvgzimhs7p5ri25hrb1ni2wvisl5rmdxy89fc59py79b9fq"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "ed25519")))
-    (native-inputs (list ghc-quickcheck ghc-doctest))
    (arguments
-     `(#:cabal-revision ("9"
-                         "0y5vfdcys18waa5k5zxiq9n8jq0l05j76riml23i0gxmwgdhsmgi")))
-    (home-page "https://github.com/thoughtpolice/hs-ed25519/")
+     `(#:cabal-revision
+       ("6" "0qyx6cl52fnll8lp6v9133wfvv3zhvq7v2crn441mng520j9wp48")
+       ;; We omit these test suites because they require old versions of
+       ;; packages and packages we do not have.
+       #:configure-flags
+       '("--flags=-test-hlint -test-doctests -test-properties")))
+    (home-page "http://thoughtpolice.github.com/hs-ed25519")
    (synopsis "Ed25519 cryptographic signatures")
-    (description
-     "This package provides a simple, fast, self-contained
+    (description "This package provides a simple, fast, self-contained
 copy of the Ed25519 public-key signature system with a clean interface.
 It also includes support for detached signatures, and thorough
 documentation on the design and implementation, including usage
@@ -906,41 +827,29 @@ guidelines.")
 (define-public ghc-tls
  (package
    (name "ghc-tls")
-    (version "2.1.8")
+    (version "1.5.8")
    (source (origin
              (method url-fetch)
              (uri (hackage-uri "tls" version))
              (sha256
               (base32
-                "1csdy3426lva1a5f7gh9qm96vzfraqj91jbxlm79wbf1jsdzfhsq"))))
+                "0rxdv8ab98kd4nqql7djmmi51k4vayq21s38s43sx3rzn0iyla3b"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "tls")))
-    (inputs (list ghc-asn1-types
-                  ghc-asn1-encoding
-                  ghc-base16-bytestring
-                  ghc-cereal
-                  ghc-crypton
-                  ghc-crypton-x509
-                  ghc-crypton-x509-store
-                  ghc-crypton-x509-validation
-                  ghc-data-default
+    (inputs (list ghc-cereal
+                  ghc-data-default-class
                  ghc-memory
-                  ghc-network
-                  ghc-serialise
-                  ghc-transformers
-                  ghc-unix-time
-                  ghc-zlib))
-    (native-inputs (list ghc-quickcheck
-                         ghc-asn1-types
-                         ghc-async
-                         ghc-crypton
-                         ghc-crypton-x509
-                         ghc-crypton-x509-validation
-                         ghc-hourglass
-                         ghc-hspec
-                         ghc-serialise
-                         hspec-discover))
-    (home-page "http://github.com/haskell-tls/hs-tls")
+                  ghc-cryptonite
+                  ghc-asn1-types
+                  ghc-asn1-encoding
+                  ghc-x509
+                  ghc-x509-store
+                  ghc-x509-validation
+                  ghc-async
+                  ghc-hourglass
+                  ghc-network))
+    (native-inputs (list ghc-tasty ghc-tasty-quickcheck ghc-quickcheck))
+    (home-page "http://github.com/vincenthz/hs-tls")
    (synopsis "TLS/SSL protocol native implementation (Server and Client)")
    (description
     "Native Haskell TLS and SSL protocol implementation for server and client.
@@ -952,6 +861,43 @@ Ephemeral (Elliptic curve and regular) Diffie Hellman key exchanges, and many
 extensions.")
    (license license:bsd-3)))

+(define-public ghc-tls-1.9
+  (package
+    (name "ghc-tls")
+    (version "1.9.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (hackage-uri "tls" version))
+       (sha256
+        (base32 "0gj3af9sqd0bw7dpcqfyvbslpxsk2ij00a77kl710fwhw35vj1an"))))
+    (build-system haskell-build-system)
+    (properties '((upstream-name . "tls")))
+    (inputs (list ghc-cereal
+                  ghc-data-default-class
+                  ghc-memory
+                  ghc-crypton
+                  ghc-asn1-types
+                  ghc-asn1-encoding
+                  ghc-crypton-x509
+                  ghc-crypton-x509-store
+                  ghc-crypton-x509-validation
+                  ghc-async
+                  ghc-unix-time
+                  ghc-network))
+    (native-inputs (list ghc-tasty ghc-tasty-quickcheck ghc-quickcheck))
+    (home-page "https://github.com/haskell-tls/hs-tls")
+    (synopsis "TLS/SSL protocol native implementation (server and client)")
+    (description
+     "This package provides a native Haskell TLS and SSL protocol
+implementation for server and client.  It provides a high-level implementation
+of a sensitive security protocol, eliminating a common set of security issues
+through the use of the advanced type system, high level constructions and
+common Haskell features.  It currently implements the SSL3.0, TLS1.0, TLS1.1
+and TLS1.2 protocol, and supports RSA and Ephemeral (Elliptic curve and
+regular) Diffie Hellman key exchanges, and many extensions.")
+    (license license:bsd-3)))
+
 (define-public ghc-hsopenssl
  (package
    (name "ghc-hsopenssl")
@@ -968,7 +914,7 @@ extensions.")
     (list #:extra-directories (list "openssl")
           #:configure-flags
           #~(list "--ghc-options=-optc=-Wno-incompatible-pointer-types")))
-    (inputs (list ghc-network openssl))
+    (inputs (list ghc-network openssl-3.0))
    (home-page "https://github.com/haskell-cryptography/HsOpenSSL")
    (synopsis "Partial OpenSSL binding for Haskell")
    (description
@@ -1014,14 +960,17 @@ the tls package, and borrows some ideas from x509-system.")
       (method url-fetch)
       (uri (hackage-uri "openssl-streams" version))
       (sha256
-        (base32 "10pnnpzgb5xr811kc9qdk7h2cgn6hk2yiyhnzz8f8p0fjzc0pwjm"))))
+        (base32
+         "10pnnpzgb5xr811kc9qdk7h2cgn6hk2yiyhnzz8f8p0fjzc0pwjm"))))
    (build-system haskell-build-system)
    (properties '((upstream-name . "openssl-streams")))
-    (inputs (list ghc-hsopenssl ghc-io-streams ghc-network))
-    (native-inputs (list ghc-hunit ghc-test-framework ghc-test-framework-hunit))
+    (inputs
+     (list ghc-hsopenssl ghc-io-streams ghc-network))
+    (native-inputs
+     (list ghc-hunit ghc-test-framework ghc-test-framework-hunit))
    (arguments
-     `(#:cabal-revision ("3"
-                         "1vizl9yajkbd59rrnfb38xwq7hfj36avbv6vwqnkhbvz3qaj3dwg")))
+     `(#:cabal-revision ("1"
+                         "0vfawnfcjrw29qg1n7k6z6bk4bmnk869gjlr9mxw4mzxgl80b2vp")))
    (home-page "https://hackage.haskell.org/package/openssl-streams")
    (synopsis "OpenSSL network support for io-streams")
    (description "This library contains io-streams routines for secure
@@ -1626,6 +1626,12 @@ SRC_HC_OPTS += -optc-mno-outline-atomics
              (file-pattern ".*\\.conf\\.d$")
              (file-type 'directory)))))))

+;; Versions newer than ghc defined below (i.e. the compiler
+;; haskell-build-system uses) should use ghc-next as their name to
+;; ensure ghc (without version specification) and ghc-* packages are
+;; always compatible. See https://issues.guix.gnu.org/issue/47335.
+(define-public ghc ghc-9.2)
+
 ;; 9.4 is the last version to support the make-based build system,
 ;; but it boot with 9.2, only 9.0 is supported.
 (define ghc-bootstrap-for-9.4 ghc-9.0)
@@ -1689,24 +1695,22 @@ SRC_HC_OPTS += -optc-mno-outline-atomics
  (let ((base ghc-9.2))
    (package
      (inherit base)
-      (name "ghc")
-      (version "9.4.3")
+      (name "ghc-next")
+      (version "9.4.4")
      (source (origin
                (method url-fetch)
                (uri (string-append "https://www.haskell.org/ghc/dist/" version
                                    "/ghc-" version "-src.tar.xz"))
                (sha256
                 (base32
-                  "0nlhx2cbq1jh2yr6zk475lavjkh9sncj57qp77p51pkfad4kkxpa"))
+                  "1qk7rlqf02s3b6m6sqqngmjq1mxnrz88h159lz6k25gddmdg5kp8"))
                (patches (search-patches "ghc-9-StgCRunAsm-only-when-needed.patch"))))
      (arguments
       (substitute-keyword-arguments arguments
         ((#:phases phases '%standard-phases)
          #~(modify-phases #$phases
             ;; Files don’t exist any more.
-             (delete 'skip-tests)))
-         ((#:tests? _ #f)
-          #f)))
+             (delete 'skip-tests)))))
      (native-inputs
       `(;; GHC 9.4 must be built with GHC >= 9.0.
         ("ghc-bootstrap" ,ghc-bootstrap-for-9.4)
@@ -1718,7 +1722,8 @@ SRC_HC_OPTS += -optc-mno-outline-atomics
                    version "/ghc-" version "-testsuite.tar.xz"))
             (sha256
              (base32
-               "1xbps33pq6mg2bwp5gvmc4qhgdq52yng5993if99b9s3fylqk86l"))))
+               "04p2lawxxg3nyv6frzhyjyh3arhqqyh5ka3alxa2pxhcd2hdcja3"))
+             (patches (search-patches "ghc-testsuite-recomp015-execstack.patch"))))
         ("ghc-alex" ,ghc-alex-bootstrap-for-9.4)
         ("ghc-happy" ,ghc-happy-bootstrap-for-9.4)
         ,@(filter (match-lambda
@@ -1733,326 +1738,4 @@ SRC_HC_OPTS += -optc-mno-outline-atomics
              (file-pattern ".*\\.conf\\.d$")
              (file-type 'directory)))))))

-;;; GHC >= 9.6 must be built using it's new haskell-written Hadrian build
-;;; system. Use this opportunity to cut the inheritance chain to simplify
-;;; understanding what building ghc requires with the new build system.
-
-(define-public ghc-9.8
-  (let ((ghc-bootstrap ghc-9.4))
-    (package
-      (name "ghc")
-      (version "9.8.1")
-      (source (origin
-                (method url-fetch)
-                (uri (string-append "https://downloads.haskell.org/~ghc/" version
-                                    "/ghc-" version "-src.tar.xz"))
-                (sha256
-                 (base32
-                  "0l87yb8hmd350klrp6lw2h9hjlla11pgzx1n4jlrfdvkgxmyvy5j"))))
-      (outputs (list "out" "doc"))
-      (arguments
-       (list
-        #:make-flags #~(list "-V" "--docs=no-sphinx")
-       #:configure-flags
-       #~(list
-           (string-append "--with-gmp-libraries="
-                          (assoc-ref %build-inputs "gmp") "/lib")
-           (string-append "--with-gmp-includes="
-                          (assoc-ref %build-inputs "gmp") "/include")
-           "--with-system-libffi"
-           (string-append "--with-ffi-libraries="
-                          (assoc-ref %build-inputs "libffi") "/lib")
-           (string-append "--with-ffi-includes="
-                          (assoc-ref %build-inputs "libffi") "/include")
-           (string-append "--with-curses-libraries="
-                          (assoc-ref %build-inputs "ncurses") "/lib")
-           (string-append "--with-curses-includes="
-                          (assoc-ref %build-inputs "ncurses") "/include"))
-        #:phases
-        #~(modify-phases %standard-phases
-            (add-before 'build 'fix-iserv-rpath
-              (lambda _
-                (mkdir-p "_build")
-                (call-with-output-file
-                 "_build/hadrian.settings"
-                 (lambda (port)
-                   (display
-                    (string-append
-                     "*.iserv.ghc.link.opts += -optl-Wl,-rpath,"
-                     #$output "/lib/ghc-" #$(package-version this-package)
-                     "/lib/" #$(or (%current-target-system)
-                                   (%current-system))
-                     "-ghc-" #$(package-version this-package) "/")
-                    port)))))
-            ;; This phase patches the 'ghc-pkg' command so that it sorts the list
-            ;; of packages in the binary cache it generates.
-            (add-before 'build 'fix-ghc-pkg-nondeterminism
-              (lambda _
-                (substitute* "utils/ghc-pkg/Main.hs"
-                  (("confs = map \\(path </>\\) \\$ filter \\(\".conf\" `isSuffixOf`\\) fs")
-                   "confs = map (path </>) $ filter (\".conf\" `isSuffixOf`) (sort fs)"))))
-            (add-after 'unpack 'unpack-testsuite
-              (lambda* (#:key inputs #:allow-other-keys)
-                (with-directory-excursion ".."
-                  (invoke "tar" "xvf" (assoc-ref inputs "ghc-testsuite")))))
-            (add-after 'unpack-testsuite 'fix-/bin/sh-references
-              (lambda* (#:key inputs #:allow-other-keys)
-                (substitute*
-                 (list "hadrian/src/Rules/BinaryDist.hs"
-                       "hadrian/src/Rules/Test.hs"
-                       "libraries/process/System/Process/Posix.hs"
-                       "libraries/process/jsbits/process.js"
-                       "libraries/unix/cbits/execvpe.c"
-                       "testsuite/tests/driver/T8602/T8602.script"
-                       "testsuite/timeout/timeout.py")
-                 (("/bin/sh") (search-input-file inputs "/bin/sh")))))
-            (add-after 'unpack-testsuite 'fix-cc-reference
-              (lambda* (#:key inputs #:allow-other-keys)
-                (substitute*
-                 (list "utils/hsc2hs/src/Common.hs")
-                 (("\"cc\"") "\"gcc\""))))
-            ;; XXX: something causes ld-wrapper to see test\ \ \ spaces/... and
-            ;; look for the files "test\", "\", "\" and "spaces/...", which obviously
-            ;; don't exist
-            (add-after 'unpack-testsuite 'fix-testsuite
-              (lambda _
-                (substitute*
-                  (list "testsuite/driver/runtests.py")
-                  (("'test   spaces'") "'dont-test-spaces'"))))
-            (add-before 'configure 'set-target-programs
-              (lambda* (#:key inputs #:allow-other-keys)
-                (let ((binutils (assoc-ref inputs "binutils"))
-                      (gcc (assoc-ref inputs "gcc"))
-                      (ld-wrapper (assoc-ref inputs "ld-wrapper")))
-                  (setenv "CC" (string-append gcc "/bin/gcc"))
-                  (setenv "CXX" (string-append gcc "/bin/g++"))
-                  (setenv "LD" (string-append ld-wrapper "/bin/ld"))
-                  (setenv "NM" (string-append binutils "/bin/nm"))
-                  (setenv "RANLIB" (string-append binutils "/bin/ranlib"))
-                  (setenv "STRIP" (string-append binutils "/bin/strip"))
-                  ;; The 'ar' command does not follow the same pattern.
-                  (setenv "fp_prog_ar" (string-append binutils "/bin/ar")))))
-            (add-before 'build 'build-hadrian
-              (lambda* (#:key (inputs '()) #:allow-other-keys)
-                (invoke "./hadrian/bootstrap/bootstrap.py"
-                        "-s" (assoc-ref inputs "hadrian-bootstrap")
-                        "-w" (which "ghc"))))
-            (add-before 'build-hadrian 'fix-environment
-              (lambda _
-                (unsetenv "GHC_PACKAGE_PATH")
-                (setenv "CONFIG_SHELL" (which "bash"))))
-            (replace 'build
-              (lambda* (#:key (parallel-build? #f) (make-flags '())
-                       #:allow-other-keys)
-                (apply invoke "_build/bin/hadrian"
-                       `("binary-dist-dir"
-                         ,@(if parallel-build?
-                             (list (string-append
-                                    "-j" (number->string
-                                          (parallel-job-count)))))
-                         ,@make-flags))))
-            (replace 'check
-              (lambda* (#:key (tests? #t) (parallel-tests? #f) (make-flags '())
-                        #:allow-other-keys)
-                (if tests?
-                  (apply invoke "_build/bin/hadrian"
-                         `(,@(if parallel-tests?
-                               (list (string-append
-                                      "-j"
-                                      (number->string (parallel-job-count))))
-                               '())
-                           ,@make-flags
-                           "test"
-                           ,(string-append
-                             "--broken-test="
-                             (string-join
-                              (list  "T15904" ; ld-wrapper, apparently
-                                     "T16521" ; no idea
-                                     ;; These fail due to gcc
-                                     ;; -Wincompatible-pointer-types, which
-                                     ;; apparently is not used in GHC's CI
-                                     ;; https://gitlab.haskell.org/ghc/ghc/-/issues/22263
-                                     "hs_try_putmvar001"
-                                     "list_threads_and_misc_roots"
-                                     "testwsdeque")))
-                           "--skip-perf"))
-                  (format #t "test suite not run~%"))))
-            (replace 'install
-              (lambda* (#:key (make-flags '()) #:allow-other-keys)
-                (apply invoke "_build/bin/hadrian"
-                       `("install"
-                         ,@make-flags
-                         ,(string-append "--prefix=" #$output)))))
-           (add-after 'install 'remove-unnecessary-references
-             (lambda* (#:key outputs #:allow-other-keys)
-               (substitute* (find-files (string-append (assoc-ref outputs "out") "/lib/")
-                                        "settings")
-                 (("/gnu/store/.*/bin/(.*)" m program) program))
-
-               ;; Remove references to "doc" output from "out" by rewriting
-               ;; the "haddock-interfaces" fields and removing the optional
-               ;; "haddock-html" field in the generated .conf files.
-               (let ((doc (assoc-ref outputs "doc"))
-                     (out (assoc-ref outputs "out")))
-                 (with-fluids ((%default-port-encoding #f))
-                   (for-each (lambda (config-file)
-                               (substitute* config-file
-                                 (("^haddock-html: .*") "\n")
-                                 (((format #f "^haddock-interfaces: ~a" doc))
-                                  (string-append "haddock-interfaces: " out))))
-                             (find-files (string-append out "/lib") ".conf")))
-                 ;; Move the referenced files to the "out" output.
-                 (for-each (lambda (haddock-file)
-                             (let* ((subdir (string-drop haddock-file (string-length doc)))
-                                    (new    (string-append out subdir)))
-                               (mkdir-p (dirname new))
-                               (rename-file haddock-file new)))
-                           (find-files doc "\\.haddock$")))))
-            (add-after 'install 'replace-$pkgroot
-              (lambda* (#:key outputs #:allow-other-keys)
-                ((@ (srfi srfi-11) let*-values)
-                  (((out) (assoc-ref outputs "out"))
-                   ((_ version) (package-name->name+version
-                                    (strip-store-file-name out))))
-                 ;; We split out the version because we want this to also work
-                 ;; with packages named "ghc-next" instead of "ghc"
-                 (substitute*
-                   (find-files
-                    (string-append (assoc-ref outputs "out") "/lib/ghc-"
-                                   version "/lib/package.conf.d/")
-                    "^.*\\.conf$")
-                   (("\\$\\{pkgroot\\}/")
-                    (string-append (assoc-ref outputs "out") "/lib/ghc-"
-                                   version "/lib/")))))))))
-      (build-system gnu-build-system)
-      (inputs (list bash-minimal gmp ncurses libffi))
-      (native-inputs
-       `(("perl" ,perl)
-         ("python" ,python)
-         ("git" ,git-minimal/pinned)
-         ("which" ,which)
-         ("ghostscript" ,ghostscript)
-         ("autoconf" ,autoconf)
-         ("automake" ,automake)
-
-         ("ghc-bootstrap" ,ghc-bootstrap)
-         ("ghc-alex" ,ghc-alex-bootstrap-for-9.4)
-         ("ghc-happy" ,ghc-happy-bootstrap-for-9.4)
-         ("ghc-testsuite"
-          ,(origin
-             (method url-fetch)
-             (uri (string-append
-                   "https://www.haskell.org/ghc/dist/"
-                   version "/ghc-" version "-testsuite.tar.xz"))
-             (sha256
-              (base32
-               "1hxylm3nhxzl7yidarlavvcg1240w4bk0hy5jnvwna24jyxz69i6"))
-             (patches (search-patches "ghc-testsuite-recomp015-execstack.patch"))))
-         ("hadrian-bootstrap"
-          ,(origin
-             (method url-fetch)
-             (uri (string-append "https://downloads.haskell.org/~ghc/"
-                                 version "/hadrian-bootstrap-sources/"
-                                 "hadrian-bootstrap-sources-"
-                                 (package-version ghc-bootstrap) ".tar.gz"))
-             (sha256
-               (base32
-                 "14dkxif9x4hy85phcj3j0glf95k04g4ab6hfchpw9vxgvk97syi1"))))))
-      (native-search-paths
-       (list (search-path-specification
-              (variable "GHC_PACKAGE_PATH")
-              (files (list (string-append "lib/ghc-" version)))
-              (file-pattern ".*\\.conf\\.d$")
-              (file-type 'directory))))
-      (home-page "https://www.haskell.org/ghc")
-      (synopsis "The Glasgow Haskell Compiler")
-      (description
-        "The Glasgow Haskell Compiler (GHC) is a state-of-the-art compiler and
-interactive environment for the functional language Haskell.")
-      (license license:bsd-3))))
-
-(define-public ghc-9.10
-  (let ((base ghc-9.8))
-    (package
-      (inherit base)
-      (name "ghc")
-      (version "9.10.2")
-      (source
-        (origin
-          (method url-fetch)
-          (uri (string-append "https://downloads.haskell.org/~ghc/" version
-                              "/ghc-" version "-src.tar.xz"))
-          (sha256
-            (base32
-             "1pm84cgr3yg99r3srdjllgz6zig8h7dbwa597srwcnjp0nh41zam"))))
-      (arguments
-        (substitute-keyword-arguments (package-arguments base)
-          ((#:phases phases #~%standard-phases)
-           #~(modify-phases #$phases
-               (replace 'check
-                 (lambda* (#:key (tests? #t) (parallel-tests? #f) (make-flags '())
-                           #:allow-other-keys)
-                   (if tests?
-                     (apply invoke "_build/bin/hadrian"
-                            `(,@(if parallel-tests?
-                                  (list (string-append
-                                         "-j"
-                                         (number->string (parallel-job-count))))
-                                  '())
-                              ,@make-flags
-                              "test"
-                              ,(string-append
-                                "--broken-test="
-                                (string-join
-                                 (list  "T15904" ; ld-wrapper, apparently
-                                        "T16521" ; no idea
-                                        ;; These fail due to gcc
-                                        ;; -Wincompatible-pointer-types, which
-                                        ;; apparently is not used in GHC's CI
-                                        ;; https://gitlab.haskell.org/ghc/ghc/-/issues/22263
-                                        "list_threads_and_misc_roots"
-                                        "stack_misc_closures")))
-                              "--skip-perf"))
-                     (format #t "test suite not run~%"))))))))
-      (native-inputs
-       `(("ghc-bootstrap" ,base)
-         ("ghc-testsuite"
-          ,(origin
-             (method url-fetch)
-             (uri (string-append
-                    "https://downloads.haskell.org/~ghc/"
-                    version "/ghc-" version "-testsuite.tar.xz"))
-             (sha256
-              (base32
-               "143ifc4g3jc6s9hcry5qha913rzwg4hpsvk6pqvxk5r0qigfxjwx"))
-             (patches (search-patches "ghc-testsuite-recomp015-execstack.patch"))))
-         ("hadrian-bootstrap"
-          ,(origin
-             (method url-fetch)
-             (uri (string-append "https://downloads.haskell.org/~ghc/" version
-                                 "/hadrian-bootstrap-sources/"
-                                 "hadrian-bootstrap-sources-"
-                                 (package-version base) ".tar.gz"))
-             (sha256
-               (base32
-                 "162lbafvdamfhx1jldax3shgk8jbbqn4an97ny363lxbdjgdn708"))))
-         ,@(filter (match-lambda
-                     (("ghc-bootstrap" . _) #f)
-                     (("ghc-testsuite" . _) #f)
-                     (("hadrian-bootstrap" . _) #f)
-                     (_ #t))
-                   (package-native-inputs base))))
-      (native-search-paths
-       (list (search-path-specification
-              (variable "GHC_PACKAGE_PATH")
-              (files (list (string-append "lib/ghc-" version)))
-              (file-pattern ".*\\.conf\\.d$")
-              (file-type 'directory)))))))
-
-;; Versions newer than ghc defined below (i.e. the compiler
-;; haskell-build-system uses) should use ghc-next as their name to
-;; ensure ghc (without version specification) and ghc-* packages are
-;; always compatible. See https://issues.guix.gnu.org/issue/47335.
-(define-public ghc ghc-9.10)
-
 ;;; haskell.scm ends here
@@ -489,11 +489,22 @@ lost.
                "0b9d2i22ghyjarwi1c596q5mf7gj1k04k784hnmrd2d4x9hgv9ax"))))
    (build-system gnu-build-system)
    (arguments
-     (list #:configure-flags #~(list "--with-corosync" "--disable-static"
+     (list #:configure-flags #~(list "--with-corosync"
+                                     "--disable-static"
+                                     "--localstatedir=/var"
                                     (string-append "--with-initdir="
                                                    #$output "/etc/init.d")
                                     (string-append "--with-ocfdir="
-                                                    #$output "/lib"))))
+                                                    #$output "/lib"))
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-before 'configure 'pre-configure
+                 (lambda _
+                   ;; Do not attempt to install /var.
+                   (substitute* '("Makefile.am"
+                                  "daemons/schedulerd/Makefile.am")
+                     (("install-exec-local:")
+                      "install-exec-local-disabled:")))))))
    (native-inputs (list autoconf
                         automake
                         cmocka
@@ -38,6 +38,7 @@
 ;;; Copyright © 2025 Zhu Zihao <all_but_last@163.com>
 ;;; Copyright © 2025 Vinicius Monego <monego@posteo.net>
 ;;; Copyright © 2025 Igorj Gorjaĉev <igor@goryachev.org>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -305,7 +306,7 @@ actions.")
 (define-public geeqie
  (package
    (name "geeqie")
-    (version "2.6.1")
+    (version "2.7")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -313,11 +314,12 @@ actions.")
                    (commit (string-append "v" version))))
              (sha256
               (base32
-                "08yr8jqli33rn1zvj9mjvinyzjp2myakxgf8wqqq8yidmm0vvn1p"))
+                "139ffzqqq79d3k5q99r8i1jr9v9vfwv89dkh6vvw1mdnv6b3s9n8"))
              (file-name (git-file-name name version))))
    (build-system meson-build-system)
    (arguments
     (list
+      #:glib-or-gtk? #t
      #:phases
      #~(modify-phases %standard-phases
          ;; Disable test which requires binaries not present
@@ -346,6 +348,7 @@ actions.")
           libwebp))
    (native-inputs
     (list `(,glib "bin") ; glib-gettextize
+           gsettings-desktop-schemas
           intltool
           pkg-config
           python         ; for tests
@@ -924,15 +927,15 @@ with tiling window managers.  Features include:
           ;; That is required for testing.
           xorg-server-for-tests))
    (inputs
-     `(("imlib2" ,imlib2)
-       ("glib" ,glib)
-       ("gtk+" ,gtk+-2)
-       ("lcms" ,lcms)
-       ("libjpeg" ,libjpeg-turbo)
-       ("libtiff" ,libtiff)
-       ("libexif" ,libexif)
-       ("libx11" ,libx11)
-       ("libxext" ,libxext)))
+     (list imlib2
+           glib
+           gtk+-2
+           lcms
+           libjpeg-turbo
+           libtiff
+           libexif
+           libx11
+           libxext))
    (arguments
     `(#:phases
       (modify-phases %standard-phases
@@ -339,30 +339,6 @@ coverage.")
    ;; that list in further version.
    (supported-systems (list "x86_64-linux"))))

-(define-public lttng-modules
-  (package
-    (name "lttng-modules")
-    (version "2.13.14")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://lttng.org/files/lttng-modules/"
-                                  "lttng-modules-" version ".tar.bz2"))
-              (sha256
-               (base32
-                "19jx1yz1hsbr4vwfp2nr6z52a5g50iimaak962k49diay5zryi66"))))
-    (build-system linux-module-build-system)
-    (arguments
-     `(#:tests? #f ; no tests
-       #:make-flags (list "CONFIG_LTTNG=m"
-                          "CONFIG_LTTNG_CLOCK_PLUGIN_TEST=m")))
-    (home-page "https://lttng.org/")
-    (synopsis "LTTng kernel modules for the LTTng tracer toolset")
-    (description
-     "LTTng kernel modules are Linux kernel modules which make
-LTTng kernel tracing possible.  They include essential control modules and
-many probes which instrument numerous interesting parts of Linux.")
-    (license (list license:lgpl2.1 license:gpl2 license:expat))))
-
 (define-public lttng-ust
  (package
    (name "lttng-ust")
@@ -18,6 +18,7 @@
 ;;; Copyright © 2024 Christian Miller <christian.miller@dadoes.de>
 ;;; Copyright © 2024 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2025 Zheng Junjie <z572@z572.online>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -421,8 +422,8 @@ using a mouse.  It is customizable and extensible with plugins and scripts.")
     (origin
       (method git-fetch)
       (uri (git-reference
-             (url "https://github.com/SrainApp/srain")
-             (commit version)))
+              (url "https://github.com/SrainApp/srain")
+              (commit version)))
       (file-name (git-file-name name version))
       (sha256
        (base32 "105z2kbj9ar6zk6i1qrbysrp9vbz692kbl2dwdxcwly0yh4cbd0p"))))
@@ -433,11 +434,11 @@ using a mouse.  It is customizable and extensible with plugins and scripts.")
      #:tests? #f ;there are no tests
      #:glib-or-gtk? #t))
    (native-inputs
-     `(("gettext" ,gettext-minimal)
-       ("glib:bin" ,glib "bin")
-       ("pkg-config" ,pkg-config)
-       ("python" ,python-wrapper)
-       ("python-sphinx" ,python-sphinx)))
+     (list gettext-minimal
+           `(,glib "bin")
+           pkg-config
+           python-wrapper
+           python-sphinx))
    (inputs
     (list glib-networking
           gsettings-desktop-schemas
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019, 2021 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2014-2019, 2021, 2026 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2021, 2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017, 2022 Marius Bakke <marius@gnu.org>
@@ -226,6 +226,18 @@ JNI.")
             (setenv "JAVACMD" (search-input-file inputs "/bin/jamvm"))
             (setenv "JAVAC" (search-input-file inputs "/bin/jikes"))
             (setenv "CLASSPATH" (search-input-file inputs "/lib/rt.jar"))))
+         ,@(if (target-x86-32?)
+               ;; XXX: On i686 isFile() always seems to return true.  Patching
+               ;; this here is very ugly, but the effects are limited.  None
+               ;; of these changes remain by the time we've built Icedtea and
+               ;; the other JDKs.
+               '((add-after 'unpack 'disable-isFile-checks
+                   (lambda _
+                     (substitute* "src/main/org/apache/tools/ant/util/ResourceUtils.java"
+                       (("destFile = \\(\\(FileProvider\\).*") ""))
+                     (substitute* "src/main/org/apache/tools/ant/taskdefs/Mkdir.java"
+                       (("dir.isFile\\(\\)") "false")))))
+               '())
         (replace 'build
           (lambda* (#:key inputs outputs #:allow-other-keys)
             ;; Ant complains if this file doesn't exist.
@@ -55,13 +55,12 @@
       (modify-phases %standard-phases
         (add-after 'unpack 'make-git-checkout-writable
           (lambda _
-             (for-each make-file-writable (find-files "."))
-             #t))
+             (for-each make-file-writable (find-files "."))))
         (add-before 'build 'remove-binaries
           (lambda _
             (delete-file "lib/org/xerial/snappy/OSInfo.class")
-             (delete-file-recursively "src/main/resources/org/xerial/snappy/native")
-             #t))
+             (delete-file-recursively
+              "src/main/resources/org/xerial/snappy/native")))
         (add-before 'build 'build-jni
           (lambda _
             ;; Rebuild one of the binaries we removed earlier
@@ -98,36 +97,33 @@
         (add-after 'build-jni 'copy-jni
           (lambda _
             (copy-recursively "src/main/resources/org/xerial/snappy/native"
-                               "build/classes/org/xerial/snappy/native")
-             #t))
+                               "build/classes/org/xerial/snappy/native")))
         (add-before 'build 'set-test-memory-size
           (lambda _
             (substitute* "build.xml"
-               (("<junit printsummary=") "<junit maxmemory=\"2G\" printsummary="))
-             #t))
+               (("<junit printsummary=")
+                "<junit maxmemory=\"2G\" printsummary="))))
         (add-before 'check 'fix-failing
           (lambda _
             (with-directory-excursion "src/test/java/org/xerial/snappy"
-               ;; This package assumes maven build, which puts results in "target".
-               ;; We put them in "build" instead, so fix that.
+               ;; This package assumes maven build, which puts results in
+               ;; "target". We put them in "build" instead, so fix that.
               (substitute* "SnappyLoaderTest.java"
                 (("target/classes") "build/classes"))
               ;; This requires Hadoop, which is not in Guix yet.
-               (delete-file "SnappyHadoopCompatibleOutputStreamTest.java"))
-             #t)))))
+               (delete-file "SnappyHadoopCompatibleOutputStreamTest.java")))))))
    (inputs
-     `(("osgi-framework" ,java-osgi-framework)))
+     (list java-osgi-framework))
    (propagated-inputs
-     `(("bitshuffle" ,bitshuffle-for-snappy)
-       ("snappy" ,snappy)))
+     (list bitshuffle-for-snappy snappy))
    (native-inputs
-     `(("junit" ,java-junit)
-       ("hamcrest" ,java-hamcrest-core)
-       ("xerial-core" ,java-xerial-core)
-       ("classworlds" ,java-plexus-classworlds)
-       ("commons-lang" ,java-commons-lang)
-       ("commons-io" ,java-commons-io)
-       ("perl" ,perl)))
+     (list java-junit
+           java-hamcrest-core
+           java-xerial-core
+           java-plexus-classworlds
+           java-commons-lang
+           java-commons-io
+           perl))
    (home-page "https://github.com/xerial/snappy-java")
    (synopsis "Compression/decompression algorithm in Java")
    (description "Snappy-java is a Java port of snappy, a fast C++
@@ -156,13 +152,13 @@ compressor/decompressor.")
         (add-before 'build 'remove-binaries
           (lambda _
             (delete-file "lib/org/xerial/snappy/OSInfo.class")
-             (delete-file-recursively "src/main/resources/org/xerial/snappy/native")
-             #t))
+             (delete-file-recursively
+              "src/main/resources/org/xerial/snappy/native")))
         (add-before 'build 'build-jni
           (lambda _
             ;; Rebuild one of the binaries we removed earlier
             (invoke "javac" "src/main/java/org/xerial/snappy/OSInfo.java"
-                      "-d" "lib")
+                     "-d" "lib")
             ;; Link to the dynamic snappy, not the static ones
             (substitute* "Makefile.common"
               (("-shared") "-shared -lsnappy"))
@@ -184,16 +180,14 @@ compressor/decompressor.")
         (add-after 'build-jni 'copy-jni
           (lambda _
             (copy-recursively "src/main/resources/org/xerial/snappy/native"
-                               "build/classes/org/xerial/snappy/native")
-             #t))
+                               "build/classes/org/xerial/snappy/native")))
         (add-before 'check 'fix-tests
           (lambda _
             (mkdir-p "src/test/resources/org/xerial/snappy/")
             (copy-recursively "src/test/java/org/xerial/snappy/testdata"
                               "src/test/resources/org/xerial/snappy/testdata")
             (install-file "src/test/java/org/xerial/snappy/alice29.txt"
-                           "src/test/resources/org/xerial/snappy/")
-             #t)))))))
+                           "src/test/resources/org/xerial/snappy/"))))))))

 (define-public java-iq80-snappy
  (package
@@ -165,17 +165,18 @@ ascii art drawings that contain characters that resemble lines like @samp{|}
                "017n1w6hds4wrz597jk7v8r6pz0kz5j9xwd240nq7s8hc58d4c2q"))
              (modules '((guix build utils)))
              (snippet
-               '(for-each
-                 delete-file
-                 (find-files "flatlaf-core/src/main/resources/com/formdev/flatlaf/natives/"
-                             ".*")))))
+               ;; Remove pre-built native libraries.
+               '(for-each delete-file
+                          (find-files "." "\\.(dll|dylib|so)$")))))
    (build-system ant-build-system)
    (arguments
     (list
+      #:jdk openjdk17
      #:tests? #false                   ;XXX requires junit5
-      #:jar-name "flatlaf.jar"
-      #:source-dir '(list "flatlaf-core/src/main/java")
-      #:test-dir '(list "flatlaf-core/src/test")
+      #:modules '((guix build ant-build-system)
+                  (guix build java-utils)
+                  (guix build utils)
+                  (sxml simple))
      #:phases
      #~(modify-phases %standard-phases
          (add-before 'configure 'build-native-code
@@ -224,8 +225,58 @@ ascii art drawings that contain characters that resemble lines like @samp{|}
          (add-before 'build 'copy-resources
            (lambda _
              (copy-recursively "flatlaf-core/src/main/resources"
-                                "build/classes"))))))
-    (inputs (list libx11 libxt))
+                                "build/classes")))
+          (add-before 'build 'generate-pom
+            (lambda _
+              (call-with-output-file "pom.xml"
+                (lambda (port)
+                  (sxml->xml
+                   `(*TOP*
+                     (*PI* xml "version=\"1.0\" encoding=\"UTF-8\"")
+                     (project
+                      (modelVersion "4.0.0")
+                      (groupId "com.formdev")
+                      (artifactId "flatlaf")
+                      (version ,#$version)))
+                   port)))))
+          (replace 'build
+            (lambda* (#:key inputs #:allow-other-keys)
+              (let* ((jdk (assoc-ref inputs "jdk"))
+                     (src-dir "flatlaf-core/src/main/java")
+                     (java9-dir "flatlaf-core/src/main/java9")
+                     (classes-dir "build/classes")
+                     (classes9-dir "build/classes9")
+                     (jar-file
+                      (string-append "build/flatlaf-" #$version ".jar")))
+                ;; Compile main sources (Java 8 target).
+                (apply invoke "javac"
+                       "--release" "8"
+                       "-d" classes-dir
+                       (find-files src-dir "\\.java$"))
+                ;; Compile Java 9 multi-release sources.
+                (mkdir-p classes9-dir)
+                (apply invoke "javac"
+                       "--release" "9"
+                       "-cp" classes-dir
+                       "-d" classes9-dir
+                       (find-files java9-dir "\\.java$"))
+                ;; Create multi-release JAR.
+                (let ((meta-versions
+                       (string-append classes-dir
+                                      "/META-INF/versions/9")))
+                  (mkdir-p meta-versions)
+                  (copy-recursively classes9-dir meta-versions))
+                (call-with-output-file "build/manifest.mf"
+                  (lambda (port)
+                    (display "Multi-Release: true\n" port)))
+                (invoke "jar" "--create"
+                        "--file" jar-file
+                        "--manifest" "build/manifest.mf"
+                        "-C" classes-dir "."))))
+          (replace 'install
+            (install-from-pom "pom.xml")))))
+    (inputs
+     (list libx11 libxt))
    (home-page "https://www.formdev.com/flatlaf/")
    (synopsis "Flat Look and Feel for Java Swing applications")
    (description "FlatLaf is a cross-platform Look and Feel for Java Swing
@@ -22,6 +22,7 @@
 ;;; Copyright © 2024, 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2024-2025 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;; Copyright © 2025 Ghislain Vaillant <ghislain.vaillant@inria.fr>
+;;; Copyright © 2026 Vinicius Monego <monego@posteo.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -52,7 +53,9 @@
  #:use-module (gnu packages bash)
  #:use-module (gnu packages check)
  #:use-module (gnu packages cpp)
+  #:use-module (gnu packages databases)
  #:use-module (gnu packages docker)
+  #:use-module (gnu packages freedesktop)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages monitoring)
  #:use-module (gnu packages networking)
@@ -1710,13 +1713,13 @@ analyzing Jupyter Notebooks.")
 (define-public python-qtconsole
  (package
    (name "python-qtconsole")
-    (version "5.7.0")
+    (version "5.7.2")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "qtconsole" version))
       (sha256
-        (base32 "0w9i0s70dm39cxgn3vh4wcaxdywzp9j0ac7f49q4qmggx4f3fcqd"))))
+        (base32 "088m56fav6xlcw55srxz96yf7rj2ndmycy4f3m69498r2swqbd17"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@@ -1764,6 +1767,67 @@ analyzing Jupyter Notebooks.")
 rich media output.")
    (license license:bsd-3)))

+(define-public python-spyder-kernels
+  (package
+    (name "python-spyder-kernels")
+    (version "3.1.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/spyder-ide/spyder-kernels")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0yhrifh148g93qkwx9ggsh2kr9789apzlw91ais4dyas5yf1xj8w"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:test-flags
+      #~(list "-k" (string-append
+                    ;; Avoid pulling Django for a single test.
+                    "not test_django_settings"
+                    ;; AssertionError.
+                    " and not test_umr_reload_modules"))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'redirect-HOME
+            (lambda _
+              (setenv "HOME" "/tmp"))))))
+    (propagated-inputs (list python-cloudpickle
+                             python-ipykernel
+                             python-ipython
+                             python-jupyter-client
+                             python-packaging
+                             python-pyxdg
+                             python-pyzmq
+                             python-traitlets
+                             python-wurlitzer))
+    (native-inputs (list python-anyio
+                         python-cython
+                         python-dask
+                         python-h5py
+                         python-matplotlib
+                         python-numpy
+                         python-pandas
+                         python-pillow
+                         python-polars
+                         python-pyarrow
+                         python-pydicom
+                         python-pytest
+                         python-scipy
+                         python-setuptools
+                         python-xarray))
+    (home-page "https://github.com/spyder-ide/spyder-kernels")
+    (synopsis "Jupyter kernels for Spyder's console")
+    (description "This package provides Jupyter kernels for use with the
+consoles of Spyder, the Scientific Python Development Environment.
+
+These kernels can be launched either through Spyder itself or in an
+independent Python session, and allow for interactive or file-based execution
+of Python code inside Spyder.")
+    (license license:expat)))
+
 (define-public python-voila
  (package
    (name "python-voila")
@@ -37,6 +37,7 @@
  #:use-module (guix packages)
  #:use-module (guix utils)
  #:use-module (gnu packages)
+  #:use-module (gnu packages bash)
  #:use-module (gnu packages boost)
  #:use-module (gnu packages compression)
  #:use-module (gnu packages crypto)
@@ -189,16 +190,17 @@ framework.  It builds XMPP clients complying with the XMPP Compliance Suites
  (package
    (name "kaidan")
    (version "0.15.0")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://kde/unstable/kaidan/" version
-                                  "/kaidan-" version ".tar.xz"))
-              (modules '((guix build utils)))
-              (snippet
-               #~(begin
-                   (delete-file-recursively "3rdparty")))
-              (sha256
-               (base32 "11g4lifji6gh9zmpgyx4dnmxyzzwkhhj84j2w9r4bvgqm2pxdhnd"))))
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://kde/unstable/kaidan/" version
+                           "/kaidan-" version ".tar.xz"))
+       (modules '((guix build utils)))
+       (snippet
+        #~(begin
+            (delete-file-recursively "3rdparty")))
+       (sha256
+        (base32 "11g4lifji6gh9zmpgyx4dnmxyzzwkhhj84j2w9r4bvgqm2pxdhnd"))))
    (build-system qt-build-system)
    (arguments
     (list
@@ -209,10 +211,18 @@ framework.  It builds XMPP clients complying with the XMPP Compliance Suites
           (add-before 'check 'set-home
             (lambda _
               ;; Tests need write permission in $HOME.
-               (setenv "HOME" "/tmp"))))))
+               (setenv "HOME" "/tmp")))
+           (add-after 'install 'wrap-program
+             (lambda _
+               (let ((gst-plugin-path (getenv "GST_PLUGIN_SYSTEM_PATH")))
+                 (wrap-program (string-append #$output "/bin/kaidan")
+                   `("GST_PLUGIN_SYSTEM_PATH" ":" prefix
+                     (,gst-plugin-path)))))))))
    (native-inputs (list extra-cmake-modules
                         pkg-config))
-    (inputs (list gstreamer
+    (inputs (list bash-minimal
+                  gst-plugins-good-qt
+                  gstreamer
                  icu4c
                  kcrash
                  kdsingleapplication
@@ -1191,37 +1191,42 @@ CDs.")
 (define-public plasmatube
  (package
    (name "plasmatube")
-    (version "25.12.2")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://kde/stable/release-service/" version
-                                  "/src/plasmatube-" version ".tar.xz"))
-              (sha256
-               (base32
-                "1jc6iqcxz0zyai26vx80nyfr818r4cj8lpw0b1pbvb1vya12v8zy"))))
+    (version "26.04.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://kde/stable/release-service/" version
+                           "/src/plasmatube-" version ".tar.xz"))
+       (sha256
+        (base32 "0dby9wypbrhg6g03kvl8fc40zpnri03hf3kk3vi1z16pwc7sn093"))))
    (build-system qt-build-system)
    (native-inputs (list extra-cmake-modules pkg-config python-minimal))
    (inputs
     (list kconfig
           kcoreaddons
           kdbusaddons
+           kdeclarative ; for org.kde.kquickcontrolsaddons
+           ki18n
           kirigami
           kirigami-addons
-           ki18n
+           kitemmodels
           kwindowsystem
           mpvqt
           purpose
+           qqc2-desktop-style ; for org.kde.desktop
           qtdeclarative
+           qtkeychain-qt6
           qtmultimedia
           qtsvg
-           qtkeychain-qt6
           qtwayland
+           sonnet
           yt-dlp))
    (arguments (list #:qtbase qtbase))
    (home-page "https://apps.kde.org/plasmatube/")
-    (synopsis "Kirigami YouTube video player")
-    (description "This package provides YouTube video player based
-on QtMultimedia and @command{yt-dlp}.")
+    (synopsis "YouTube and PeerTube video player")
+    (description
+     "Plasmatube is a YouTube video player that uses Invidious and Piped
+APIs.  It can also play videos from PeerTube sources.")
    (license license:gpl3+)))

 (define-public rattlesnake
@@ -1853,6 +1853,9 @@ for xdg-desktop-portal that is using Qt/KF5.")
                             breeze-icons ;default mouse icon
                             colord
                             discover
+                             ffmpegthumbs
+                             flatpak ;for discover
+                             flatpak-kcm ;to manage flatpak app permissions
                             kactivitymanagerd
                             kdeclarative ;required by sddm breeze theme
                             kde-cli-tools
@@ -485,11 +485,23 @@ to camera devices supported by @code{libgphoto2} using
       (uri (string-append "mirror://kde/stable/release-service/" version
                           "/src/kate-" version ".tar.xz"))
       (sha256
-        (base32 "0ah6cy92yir68z25460ccl48i5nrfqswpzil9a7l69h3qxspsk88"))))
+        (base32 "0ah6cy92yir68z25460ccl48i5nrfqswpzil9a7l69h3qxspsk88"))
+       (modules '((guix build utils)))
+       ;; Unbundle SingleApplication.
+       (snippet
+        '(begin
+           (delete-file-recursively "3rdparty/SingleApplication")
+           (with-directory-excursion "apps/kate"
+             (substitute* "CMakeLists.txt"
+               ((".*3rdparty.*") "")
+               ((" -DQAPPLICATION_CLASS=FreeStandingSingleApplication") ""))
+             (substitute* "main.cpp"
+               (("(#include )\"SingleApplication\\/SingleApplication\"" _ keep)
+                (string-append keep "<SingleApplication>"))))))))
    (build-system qt-build-system)
    (native-inputs
     (list extra-cmake-modules kdoctools xorg-server-for-tests))
-    ;; TODO: Unbundle rapidjson and SingleApplication.
+    ;; TODO: Unbundle rapidjson.
    (inputs
     (list breeze-icons ;; default icon set
           karchive
@@ -515,11 +527,20 @@ to camera devices supported by @code{libgphoto2} using
           libxkbcommon
           plasma-activities
           qtsvg
-           qtwayland))
+           qtwayland
+           single-application))
    (arguments
     (list #:qtbase qtbase
           #:phases
           #~(modify-phases %standard-phases
+               (add-after 'unpack 'link-single-application
+                 (lambda _
+                   (substitute* "apps/kate/CMakeLists.txt"
+                     (("target_link_libraries\\(kate-bin PRIVATE kateprivate"
+                       all)
+                      (string-append all " "
+                                     #$(this-package-input "single-application")
+                                     "/lib/libSingleApplication.a")))))
               (add-after 'unpack 'patch-tests
                 (lambda* (#:key inputs #:allow-other-keys)
                   ;; This test requires a 'bin' diretory under '/usr'.
--- a/Show More
+++ b/Show More