gnu: node-lts: Update to 24.14.1.

* gnu/packages/node.scm (node-lts): Update to 24.14.1.

Change-Id: I60457e8e8e05e0102feb450655113ba410bd7667

CODEOWNERS

@@ -264,6 +264,7 @@ gnu/installer(\.scm$|/)                            @guix/installer
 gnu/packages/clojure\.scm                          @guix/java
 gnu/packages/java(-.+|)\.scm$                      @guix/java
 gnu/packages/maven(-.+|)\.scm$                     @guix/java
+gnu/packages/netbeans\.scm                         @guix/java
 guix/build/ant-build-system\.scm                   @guix/java
 guix/build/clojure-build-system\.scm               @guix/java
 guix/build/clojure-utils\.scm                      @guix/java

etc/teams.scm

@@ -828,6 +828,7 @@ and the maven-build-system."
               (make-regexp* "^gnu/packages/java(-.+|)\\.scm$")
               ;; Match maven.scm and maven-*.scm
               (make-regexp* "^gnu/packages/maven(-.+|)\\.scm$")
+              "gnu/packages/netbeans.scm"
               "guix/build/ant-build-system.scm"
               "guix/build/clojure-build-system.scm"
               "guix/build/clojure-utils.scm"
@@ -1660,6 +1661,11 @@ the \"texlive\" importer."
                        "tok")
   electronics)
 
+(define-member (person "gemmaro"
+                       "gemmaro.dev@gmail.com"
+                       "gemmaro")
+  ruby)
+
 
 (define (find-team name)
   (or (hash-ref %teams (string->symbol name))

gnu/local.mk

@@ -502,6 +502,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/myrddin.scm			\
   %D%/packages/ncdu.scm				\
   %D%/packages/ncurses.scm			\
+  %D%/packages/netbeans.scm			\
   %D%/packages/netpbm.scm			\
   %D%/packages/nettle.scm			\
   %D%/packages/networking.scm			\
@@ -1242,6 +1243,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/python-treelib-remove-python2-compat.patch	\
   %D%/packages/patches/elm-offline-package-registry.patch	\
   %D%/packages/patches/elm-reactor-static-files.patch		\
+  %D%/packages/patches/emacs-agent-shell-fix-tests.patch        \
   %D%/packages/patches/emacs-deferred-fix-number-of-arguments.patch	\
   %D%/packages/patches/emacs-disable-jit-compilation.patch			\
   %D%/packages/patches/emacs-doc-toc-shell-commands.patch	\
@@ -1676,6 +1678,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/java-commons-collections-fix-java8.patch \
   %D%/packages/patches/java-guava-remove-annotation-deps.patch \
   %D%/packages/patches/java-jeromq-fix-tests.patch		\
+  %D%/packages/patches/java-jtidy-remove-xerces-dependency.patch	\
   %D%/packages/patches/java-openjfx-build-jdk_version.patch     \
   %D%/packages/patches/java-powermock-fix-java-files.patch		\
   %D%/packages/patches/java-simple-xml-fix-tests.patch		\
@@ -1684,6 +1687,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/java-xerces-build_dont_unzip.patch	\
   %D%/packages/patches/java-xerces-xjavac_taskdef.patch	\
   %D%/packages/patches/jbr-17-xcursor-no-dynamic.patch	\
+  %D%/packages/patches/jbr-25-wayland-drag-icon.patch	\
+  %D%/packages/patches/jbr-25-wayland-intra-jvm-dnd.patch	\
   %D%/packages/patches/jdk-currency-time-bomb.patch		\
   %D%/packages/patches/jdk-currency-time-bomb2.patch		\
   %D%/packages/patches/jfsutils-add-sysmacros.patch		\
@@ -1714,7 +1719,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/libretro-dolphin-emu-libusb-assert.patch \
   %D%/packages/patches/libretro-dolphin-emu-vulkan-headers.patch        \
   %D%/packages/patches/libretranslate-use-flasgger.patch	\
-  %D%/packages/patches/librewolf-150.0-encoding_rs-rust-fix.patch       \
   %D%/packages/patches/librewolf-add-store-to-rdd-allowlist.patch       \
   %D%/packages/patches/librewolf-compare-paths.patch		\
   %D%/packages/patches/librewolf-neuter-locale-download.patch	\
@@ -1976,6 +1980,11 @@ dist_patch_DATA =						\
   %D%/packages/patches/netcdf-date-time.patch			\
   %D%/packages/patches/netdde-build-fix.patch			\
   %D%/packages/patches/netdde-csum.patch			\
+  %D%/packages/patches/java-apache-xml-commons-resolver-1.2-netbeans.patch \
+  %D%/packages/patches/java-simplevalidation-1.14.1.patch	\
+  %D%/packages/patches/netbeans-25-nativeexecution-paths.patch \
+  %D%/packages/patches/netbeans-25-terminal-no-login-shell.patch \
+  %D%/packages/patches/netbeans-25-source-only-build.patch	\
   %D%/packages/patches/netpbm-CVE-2017-2586.patch		\
   %D%/packages/patches/netpbm-CVE-2017-2587.patch		\
   %D%/packages/patches/netsurf-message-timestamp.patch		\
@@ -2173,6 +2182,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/perl-www-curl-remove-symbol.patch	\
   %D%/packages/patches/perl-xml-libxml-fix-function-prototypes.patch	\
   %D%/packages/patches/phoronix-test-suite-fsdg.patch		\
+  %D%/packages/patches/php-01-fix-expired-certificate.patch	\
+  %D%/packages/patches/php-02-fix-sni-tests.patch		\
   %D%/packages/patches/picprog-non-intel-support.patch		\
   %D%/packages/patches/pidgin-add-search-path.patch		\
   %D%/packages/patches/pinball-system-ltdl.patch		\

gnu/packages/admin.scm

@@ -1158,7 +1158,7 @@ on memory usage on GNU/Linux systems.")
 (define-public htop
   (package
     (name "htop")
-    (version "3.5.0")
+    (version "3.5.1")
     (source
      (origin
        (method git-fetch)
@@ -1166,7 +1166,7 @@ on memory usage on GNU/Linux systems.")
              (url "https://github.com/htop-dev/htop")
              (commit version)))
        (sha256
-        (base32 "1r07ri0dl9xz0jn1hc2g8q3l0q4clvnxs05yagpzsz0zigp4flj5"))
+        (base32 "187gyj081n6qsidll5wdri3jkr4m2i4m461z3xv03y342f5yj3lv"))
        (file-name (git-file-name name version))))
     (build-system gnu-build-system)
     (arguments
@@ -7052,7 +7052,7 @@ network, which causes enabled computers to power on.")
 (define-public witr
   (package
     (name "witr")
-    (version "0.1.7")
+    (version "0.3.1")
     (source
      (origin
        (method git-fetch)
@@ -7061,7 +7061,7 @@ network, which causes enabled computers to power on.")
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "18xx01lxd5j019gy9jmpms3awv4snlr028w01bfkyfid6hlwxbq2"))))
+        (base32 "03v9n4mdvqm0knqjl4s64321i5clqpmlrlkkdb87glzb9p28sg00"))))
     (build-system go-build-system)
     (arguments
      (list

gnu/packages/animation.scm

@@ -238,12 +238,12 @@ contains the graphical user interface for synfig.")
              (when tests?
                (invoke "./tests")))))))
     (native-inputs
-     (list gettext-minimal
-           `(,glib "bin")
-           nasm
-           perl
-           pkg-config
-           python-wrapper))
+     (cons* gettext-minimal
+            `(,glib "bin")
+            perl
+            pkg-config
+            python-wrapper
+            (maybe-nasm)))
     (inputs
      (list cairo
            curl

gnu/packages/assembly.scm

@@ -2,7 +2,7 @@
 ;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2013, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
-;;; Copyright © 2016, 2020, 2021, 2025 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2020, 2021, 2025, 2026 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017–2022 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Guy Fleury Iteriteka <hoonandon@gmail.com>
 ;;; Copyright © 2019, 2022, 2024 Andy Tai <atai@atai.org>
@@ -43,6 +43,7 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix gexp)
+  #:use-module (guix utils)
   #:use-module (gnu packages)
   #:use-module (gnu packages admin)
   #:use-module (gnu packages autotools)
@@ -248,6 +249,16 @@ complex.  It supports all currently known x86 architectural extensions, and
 has strong support for macros.")
     (license license:bsd-2)))
 
+(define* (maybe-nasm #:optional
+                     (system (or (%current-target-system)
+                                 (%current-system))))
+  ;; For some packages nasm is only needed when compiling to/for x86/x86_64.
+  (if (target-x86? system)
+      (list nasm)
+      '()))
+
+(export maybe-nasm)
+
 (define-public yasm
   (package
     (name "yasm")

gnu/packages/codex.scm

@@ -834,7 +834,8 @@
     (inputs (cons* bash-minimal coreutils git-minimal sed
                    libcap oniguruma openssl sqlite zlib `(,zstd "lib")
                    (cargo-inputs 'codex)))
-    (properties '((timeout . 108000)))  ;30 hours
+    (properties '((timeout . 108000) ; 30  hours
+                  (max-silent-time . 54000))) ; 15 hours
     (home-page "https://github.com/openai/codex")
     (synopsis "AI-assisted coding CLI and TUI")
     (description

gnu/packages/compression.scm

@@ -2375,7 +2375,9 @@ non-Windows systems without running the actual installer using wine.")
      (sha256
       (base32 "17k679glx05v23n8kxbg9vmbf89i2252g5xj6w3dkz19asmh1zd6"))))
    (build-system gnu-build-system)
-   (native-inputs (list autoconf automake libtool nasm))
+   (native-inputs
+    (cons* autoconf automake libtool
+           (maybe-nasm)))
    (home-page "https://github.com/intel/isa-l")
    (synopsis "Intelligent storage acceleration library")
    (description "ISA-L is a collection of optimized low-level functions

gnu/packages/cran.scm

@@ -9232,7 +9232,7 @@ similar rank-based tests for equal probability distributions due to Neuhauser
                (("^PKG_LIBS=.*")
                 (string-append "PKG_LIBS="
                                (assoc-ref inputs "libnode")
-                               "/lib/libnode.so.127\n")))
+                               "/lib/libnode.so.137\n")))
              (setenv "INCLUDE_DIR"
                      (string-append
                       (assoc-ref inputs "libnode")

gnu/packages/dns.scm

@@ -115,6 +115,7 @@
        (uri (git-reference
               (url "git://git.chiark.greenend.org.uk/~ianmdlvl/adns.git")
               (commit (string-append "adns-" version))))
+       (file-name (git-file-name name version))
        (sha256
         (base32
          "0ln3l5j7wb1xazrzl76p9xar52p6l2k1cwy7jazxw1acl71k9h5n"))))

gnu/packages/emacs-xyz.scm

@@ -1223,6 +1223,9 @@ for multiple backends.")
        (sha256
         (base32 "0hr1176sy8xrx6wkqadmvwdjm1sv7aq8ddrw8h3ha6sn74glx8ws"))))
     (build-system emacs-build-system)
+    (arguments (list #:test-command
+                     #~(list "ert-runner" "tests")))
+    (native-inputs (list emacs-ert-runner))
     (home-page "https://github.com/xenodium/acp.el")
     (synopsis "@acronym{ACP, Agent Client Protocol} for Emacs")
     (description
@@ -1243,8 +1246,19 @@ communicating with LLM agents.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0njajpz51pbz4hqaq7lcvwaypilq1c9sdxsk6sdxgk1xpivqlxfb"))))
+        (base32 "0njajpz51pbz4hqaq7lcvwaypilq1c9sdxsk6sdxgk1xpivqlxfb"))
+       (patches
+        (search-patches "emacs-agent-shell-fix-tests.patch"))))
     (build-system emacs-build-system)
+    (arguments (list #:test-command
+                     #~(list "ert-runner" "tests"
+                             "-l" "tests/agent-shell-anthropic-tests.el"
+                             "-l" "tests/agent-shell-command-prefix-tests.el"
+                             "-l" "tests/agent-shell-devcontainer-tests.el"
+                             "-l" "tests/agent-shell-diff-tests.el"
+                             "-l" "tests/agent-shell-openai-tests.el"
+                             "-l" "tests/agent-shell-tests.el")))
+    (native-inputs (list emacs-ert-runner))
     (propagated-inputs (list emacs-shell-maker emacs-acp))
     (home-page "https://github.com/xenodium/agent-shell")
     (synopsis "Native agentic integrations for Claude Code, Gemini CLI, etc")
@@ -8119,6 +8133,7 @@ with more precise location control.")
                 ("doc-toc--djvused-program" (search-input-file inputs "/bin/djvused"))
                 ("doc-toc--djvutxt-program" (search-input-file inputs "/bin/djvutxt"))
                 ("doc-toc--mutool-program" (search-input-file inputs "/bin/mutool"))
+                ("doc-toc--pdfoutline-program" (search-input-file inputs "/bin/pdfoutline"))
                 ("doc-toc--pdftocgen-program" (search-input-file inputs "/bin/pdftocgen"))
                 ("doc-toc--pdftocio-program" (search-input-file inputs "/bin/pdftocio"))
                 ("doc-toc--pdftotext-program" (search-input-file inputs "/bin/pdftotext"))
@@ -11377,7 +11392,11 @@ the speedbar window.")
                 "06ibxnb765sjcxjv2w923cnjr9664qp2pf7w3wxdp8vrbxg1s670"))))
     (build-system emacs-build-system)
     (arguments
-     (list #:tests? #f ; There are no tests.
+     (list #:test-command
+           #~(list "ert-runner" "tests"
+                   "-l" "tests/markdown-overlays-blocks-tests.el"
+                   "-l" "tests/markdown-overlays-images-tests.el"
+                   "-l" "tests/shell-maker-history-tests.el")
            #:phases
            #~(modify-phases %standard-phases
                (add-after 'unpack 'patch-curl
@@ -11385,6 +11404,7 @@ the speedbar window.")
                    (emacs-substitute-variables "shell-maker.el"
                      ("shell-maker-curl-executable"
                       (search-input-file inputs "/bin/curl"))))))))
+    (native-inputs (list emacs-ert-runner))
     (inputs (list curl))
     (home-page "https://github.com/xenodium/shell-maker")
     (synopsis "Create Emacs shells")
@@ -21471,6 +21491,31 @@ in English as you type.  It primarily detects \"weasel words\" and abuse of
 passive voice.")
     (license license:gpl3+)))
 
+(define-public emacs-neocities
+  (package
+    (name "emacs-neocities")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://codeberg.org/coopi/emacs-neocities")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1zvmbb780yh9jpapi9z6pvban48lnhc49xrz7s8d367nprvrjyy0"))))
+    (build-system emacs-build-system)
+    (home-page "https://codeberg.org/coopi/emacs-neocities")
+    (synopsis "Client library for the Neocities API")
+    (description
+     "This package provides an Emacs Lisp client for the
+@url{https://neocities.org/api, Neocities API}.  It supports uploading and
+deleting files, listing site contents, and querying site information.
+Requests are synchronous by default but can be made asynchronous via a
+callback.  Authentication uses @acronym{API, Application Programming
+Interface} keys, obtainable with @code{neocities-fetch-api-key}.")
+    (license license:agpl3+)))
+
 (define-public emacs-writefreely
   (let ((commit "cfbba9c3a34f580f39c0796966ea76b0cf98a23e")
         (revision "0"))
@@ -32688,7 +32733,7 @@ current upstream.")
 (define-public emacs-ultra-scroll
   (package
     (name "emacs-ultra-scroll")
-    (version "0.6")
+    (version "0.6.1")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -32697,7 +32742,7 @@ current upstream.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "0a3m1aapcrbf2b78712xh0lx4bblq3jx3n0bnhm9m9qs8889w7ir"))))
+                "0h5r8ma5aslcwbxiyh27z8ni3v09mzdml3gfccib197dg4k1xr8s"))))
     (build-system emacs-build-system)
     (arguments (list #:tests? #f))      ;no tests
     (home-page "https://github.com/jdtsmith/ultra-scroll")
@@ -42584,6 +42629,32 @@ will scroll the corresponding edit buffer.  Additionally, you can overlay
 information from the tags gathered by CEDET's semantic analyzer.)")
     (license license:gpl3+)))
 
+(define-public emacs-eshell-pure-prompt
+  (package
+    (name "emacs-eshell-pure-prompt")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://codeberg.org/coopi/emacs-eshell-pure-prompt")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "11mcyyra19lhk09k50fpqwqs50rl0mxmwzv11bjrpl2bd7m2bmf2"))))
+    (build-system emacs-build-system)
+    (home-page "https://codeberg.org/coopi/emacs-eshell-pure-prompt")
+    (synopsis "Port of the Pure Zsh prompt for Eshell")
+    (description
+     "This package provides an Eshell prompt modeled after
+@uref{https://github.com/sindresorhus/pure, Sindre Sorhus' Pure Zsh prompt}.
+It displays the current working directory, Git branch and status (dirty,
+ahead/behind, stash), the active Python or Conda virtual environment, and the
+elapsed time of long-running commands.  The prompt symbol changes color on
+command failure and a @code{user@@host} prefix appears on remote TRAMP
+connections.")
+    (license license:agpl3+)))
+
 (define-public emacs-eshell-prompt-extras
   (package
     (name "emacs-eshell-prompt-extras")

gnu/packages/emulators.scm

@@ -1264,7 +1264,8 @@ Enjoy all of your favorite Atari 2600 games on your PC thanks to Stella!")
         (base32 "1xf15b6c3i0vv92b420a92pfvfaxhji56ivin8pn5r7fajkqyfb7"))))
     (build-system gnu-build-system)
     (native-inputs
-     (list pkg-config nasm which))
+     (cons* pkg-config which
+            (maybe-nasm)))
     (inputs
      (list freetype
            glu
@@ -1289,8 +1290,6 @@ Enjoy all of your favorite Atari 2600 games on your PC thanks to Stella!")
                       (list "all" (string-append "PREFIX=" out)))
        ;; There are no tests.
        #:tests? #f))
-    ;; As per the Makefile (in projects/unix/Makefile):
-    (supported-systems '("i686-linux" "x86_64-linux"))
     (home-page "https://www.mupen64plus.org/")
     (synopsis "Nintendo 64 emulator core library")
     (description
@@ -2164,7 +2163,9 @@ as RetroArch.")
               (lambda _
                 (install-file "mupen64plus_next_libretro.so"
                               (string-append #$output "/lib/libretro/")))))))
-      (native-inputs (list nasm pkg-config))
+      (native-inputs
+       (cons* pkg-config
+              (maybe-nasm)))
       (inputs (list mesa libpng minizip unzip xxhash zlib))
       (home-page "https://github.com/libretro/mupen64plus-libretro-nx")
       (synopsis "Improved Mupen64Plus libretro core")

gnu/packages/firmware.scm

@@ -1159,10 +1159,10 @@ Executables included are:
       (native-inputs
        (append
          (list acpica
-               nasm
                perl
                python-3
                (list util-linux "lib"))
+         (maybe-nasm (string-append arch "-" arch))
          (if (not (string-prefix? arch (%current-system)))
              (if (string=? arch "armhf")
                  (list (cross-gcc "arm-linux-gnueabihf")

gnu/packages/games.scm

@@ -3408,7 +3408,8 @@ and defeat them with your bubbles!")
                                  "SamTSE/Sources/Engine/Engine.cpp")
                 (("@OUTPUT_DIR@") #$output)))))))
     (inputs (list sdl2 libvorbis))
-    (native-inputs (list flex bison nasm imagemagick))
+    (native-inputs (cons* flex bison imagemagick
+                          (maybe-nasm)))
     (home-page "https://github.com/tx00100xt/SeriousSamClassic")
     (synopsis "SeriousSam engine and Serious Sam: TFE and TSE")
     (description

gnu/packages/java-graphics.scm

@@ -165,17 +165,18 @@ ascii art drawings that contain characters that resemble lines like @samp{|}
                 "017n1w6hds4wrz597jk7v8r6pz0kz5j9xwd240nq7s8hc58d4c2q"))
               (modules '((guix build utils)))
               (snippet
-               '(for-each
-                 delete-file
-                 (find-files "flatlaf-core/src/main/resources/com/formdev/flatlaf/natives/"
-                             ".*")))))
+               ;; Remove pre-built native libraries.
+               '(for-each delete-file
+                          (find-files "." "\\.(dll|dylib|so)$")))))
     (build-system ant-build-system)
     (arguments
      (list
+      #:jdk openjdk17
       #:tests? #false                   ;XXX requires junit5
-      #:jar-name "flatlaf.jar"
-      #:source-dir '(list "flatlaf-core/src/main/java")
-      #:test-dir '(list "flatlaf-core/src/test")
+      #:modules '((guix build ant-build-system)
+                  (guix build java-utils)
+                  (guix build utils)
+                  (sxml simple))
       #:phases
       #~(modify-phases %standard-phases
           (add-before 'configure 'build-native-code
@@ -224,8 +225,58 @@ ascii art drawings that contain characters that resemble lines like @samp{|}
           (add-before 'build 'copy-resources
             (lambda _
               (copy-recursively "flatlaf-core/src/main/resources"
-                                "build/classes"))))))
-    (inputs (list libx11 libxt))
+                                "build/classes")))
+          (add-before 'build 'generate-pom
+            (lambda _
+              (call-with-output-file "pom.xml"
+                (lambda (port)
+                  (sxml->xml
+                   `(*TOP*
+                     (*PI* xml "version=\"1.0\" encoding=\"UTF-8\"")
+                     (project
+                      (modelVersion "4.0.0")
+                      (groupId "com.formdev")
+                      (artifactId "flatlaf")
+                      (version ,#$version)))
+                   port)))))
+          (replace 'build
+            (lambda* (#:key inputs #:allow-other-keys)
+              (let* ((jdk (assoc-ref inputs "jdk"))
+                     (src-dir "flatlaf-core/src/main/java")
+                     (java9-dir "flatlaf-core/src/main/java9")
+                     (classes-dir "build/classes")
+                     (classes9-dir "build/classes9")
+                     (jar-file
+                      (string-append "build/flatlaf-" #$version ".jar")))
+                ;; Compile main sources (Java 8 target).
+                (apply invoke "javac"
+                       "--release" "8"
+                       "-d" classes-dir
+                       (find-files src-dir "\\.java$"))
+                ;; Compile Java 9 multi-release sources.
+                (mkdir-p classes9-dir)
+                (apply invoke "javac"
+                       "--release" "9"
+                       "-cp" classes-dir
+                       "-d" classes9-dir
+                       (find-files java9-dir "\\.java$"))
+                ;; Create multi-release JAR.
+                (let ((meta-versions
+                       (string-append classes-dir
+                                      "/META-INF/versions/9")))
+                  (mkdir-p meta-versions)
+                  (copy-recursively classes9-dir meta-versions))
+                (call-with-output-file "build/manifest.mf"
+                  (lambda (port)
+                    (display "Multi-Release: true\n" port)))
+                (invoke "jar" "--create"
+                        "--file" jar-file
+                        "--manifest" "build/manifest.mf"
+                        "-C" classes-dir "."))))
+          (replace 'install
+            (install-from-pom "pom.xml")))))
+    (inputs
+     (list libx11 libxt))
     (home-page "https://www.formdev.com/flatlaf/")
     (synopsis "Flat Look and Feel for Java Swing applications")
     (description "FlatLaf is a cross-platform Look and Feel for Java Swing

gnu/packages/libevent.scm

@@ -164,14 +164,14 @@ resolution, asynchronous file system operations, and threading primitives.")
   (package
     (inherit libuv)
     (name "libuv")
-    (version "1.49.2")
+    (version "1.51.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dist.libuv.org/dist/v" version
                                   "/libuv-v" version ".tar.gz"))
               (sha256
                (base32
-                "1a75p8wp4l43y2ffj1szs1ssm6nzjad7k51bqi2r04ngs9mp044c"))))
+                "1szqivvs7izbhw1a3nd1ipbk012yvqqkjg0sjmqxw1hi1fwmf1az"))))
     (properties '((hidden? . #t)))))
 
 (define-public libuv-for-r-httpuv

gnu/packages/librewolf.scm

@@ -205,8 +205,7 @@
        (search-patches
         "librewolf-compare-paths.patch"
         "librewolf-use-system-wide-dir.patch"
-        "librewolf-add-store-to-rdd-allowlist.patch"
-        "librewolf-150.0-encoding_rs-rust-fix.patch"))
+        "librewolf-add-store-to-rdd-allowlist.patch"))
       ;; Slim down the tarball by removing unbundled libraries and 75 Mo (800+
       ;; Mo uncompressed) of unused tests.
       ;; TODO: Unbundle security/nss and media/libpng.
@@ -239,23 +238,23 @@
 ;;; but since in Guix only the latest packaged Rust is officially supported,
 ;;; it is a tradeoff worth making.
 ;;; 0: https://firefox-source-docs.mozilla.org/writing-rust-code/update-policy.html
-(define rust-librewolf rust-1.93)
+(define rust-librewolf rust-1.94)
 
 ;; Update this id with every update to its release date.
 ;; It's used for cache validation and therefore can lead to strange bugs.
 ;; ex: date '+%Y%m%d%H%M%S'
 ;; or: (format-time-string "%Y%m%d%H%M%S")
-(define %librewolf-build-id "20260421153818")
+(define %librewolf-build-id "20260428201413")
 
 (define-public librewolf
   (package
     (name "librewolf")
-    (version "150.0-1")
+    (version "150.0.1-1")
     (source
      (make-librewolf-source
       #:version version
-      #:firefox-hash "151rxzl80dm8jsxl6fwzgbirwq4zpms5adwwnbjcwdd1r3s3vr7v"
-      #:librewolf-hash "0iw9v3zc1fxc93yyhldqarxaypgmbndh2ylsy330kcbpb6p1gnmr"
+      #:firefox-hash "1v3fbwvd0khm3xwsgwcp6wpwmkz0v6fyk37hxj0mqkwjimqgmkra"
+      #:librewolf-hash "0294lsiyvfh93id04xki4bhs8d84vmysqviivxiif0xfzqv65qzp"
       #:l10n firefox-l10n))
     (build-system gnu-build-system)
     (arguments

gnu/packages/mail.scm

@@ -3919,7 +3919,7 @@ on the fly.  Both programs are written in C and are very fast.")
 (define-public stalwart
   (package
     (name "stalwart")
-    (version "0.16.1")
+    (version "0.16.3")
     (source
      (let ((upstream-source
              (origin
@@ -3930,7 +3930,7 @@ on the fly.  Both programs are written in C and are very fast.")
                (file-name (git-file-name name version))
                (sha256
                 (base32
-                 "1vfgn6jd6gi7b0ilivl4wy6m8bd9hbg919csfndb3h553w153hzy")))))
+                 "1wcs9inwv8iv4qrayp9730wzmmpp4bna6jnpdz29ygb5c0lf2b29")))))
        (origin
          (method computed-origin-method)
          (file-name (git-file-name name version))

gnu/packages/maven-parent-pom.scm

@@ -686,6 +686,35 @@ components.")
                (base32
                 "0cqa072fz55j5xyvixqv8vbd7jsbhb1cd14bzjvm0hbv2wpd9npf"))))))
 
+(define-public java-jvnet-parent-pom-1
+  (hidden-package
+    (package
+      (name "java-jvnet-parent-pom-1")
+      (version "1")
+      (source (origin
+                (method url-fetch)
+                (uri (string-append "https://repo1.maven.org/maven2/net/java/"
+                                    "jvnet-parent/" version "/jvnet-parent-"
+                                    version ".pom"))
+                (sha256
+                 (base32
+                  "1gv37n9aid7fdhwd0h4py024w8by56cchg3b4sg5vrk82a0l0518"))))
+      (build-system ant-build-system)
+      (arguments
+       (list
+         #:tests? #f
+         #:phases
+         #~(modify-phases %standard-phases
+             (delete 'unpack)
+             (delete 'configure)
+             (delete 'build)
+             (replace 'install
+               (install-pom-file #$(package-source this-package))))))
+      (home-page "https://mvnrepository.com/artifact/net.java/jvnet-parent")
+      (synopsis "java.net parent pom")
+      (description "This package contains the java.net parent pom file.")
+      (license license:asl2.0))))
+
 (define-public java-jvnet-parent-pom-3
   (hidden-package
     (package

gnu/packages/networking.scm

@@ -2041,7 +2041,7 @@ of the same name.")
 (define-public wireshark
   (package
     (name "wireshark")
-    (version "4.6.4")
+    (version "4.6.5")
     (source
      (origin
        (method git-fetch)
@@ -2050,7 +2050,7 @@ of the same name.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "05jivnnlmbbhc6b3r7zdahiw22fvb9r6pg4pc83ascnja49xlyq6"))))
+        (base32 "0cws5gaxkbdwqjawkwfr3iz39vdd0m0m0q7h2z4fzdv6lrp8ys31"))))
     (build-system qt-build-system)
     (arguments
      (list
@@ -3348,7 +3348,7 @@ speedtest.net.")
 (define-public librespeed-cli
   (package
     (name "librespeed-cli")
-    (version "1.0.12")
+    (version "1.0.13")
     (source
      (origin
        (method git-fetch)
@@ -3357,7 +3357,7 @@ speedtest.net.")
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "08x09b3j2qvhnwy8lrbfxqh1lbs64wyqlr4jj6m31b5r2zy90dly"))))
+        (base32 "0zgwdz955vlyy1yricgcbdlbxxh1z08xpbhxa8zs64bsg68mv8j3"))))
     (build-system go-build-system)
     (arguments
      (list
@@ -3381,6 +3381,7 @@ speedtest.net.")
      (list go-github-com-briandowns-spinner
            go-github-com-go-ping-ping
            go-github-com-gocarina-gocsv
+           go-github-com-prometheus-community-pro-bing
            go-github-com-sirupsen-logrus
            go-github-com-urfave-cli-v2
            go-golang-org-x-sys))

gnu/packages/node-xyz.scm

@@ -2324,7 +2324,7 @@ a string consisting of a number and a time unit is converted to milliseconds.")
 (define-public node-nan
   (package
     (name "node-nan")
-    (version "2.22.0")
+    (version "2.26.2")
     (source
      (origin
        (method git-fetch)
@@ -2333,7 +2333,7 @@ a string consisting of a number and a time unit is converted to milliseconds.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "02gqm23x26glffvyxrnk610hy3hg0kwh2v58dhnb032l0jhjzqvp"))))
+        (base32 "18xv0m40jgy3sc4pldw95w6p72ms5a5h0x2sm2mimlwlmxmrjlmb"))))
     (build-system node-build-system)
     (arguments
      `(#:phases

gnu/packages/node.scm

@@ -274,7 +274,7 @@
                             (lambda (file stat)
                               (executable-file? file))
                             #:stat lstat)))))
-         (add-after 'install 'install-npmrc
+         (add-after 'install 'fix-node-gyp-reference
            ;; Note: programs like node-gyp only receive these values if
            ;; they are started via `npm` or `npx`.
            ;; See: https://github.com/nodejs/node-gyp#npm-configuration
@@ -482,7 +482,7 @@ Node.js and web browsers.")
      (origin
        (method git-fetch)
        (uri (git-reference
-             (url "https://github.com/indutny/llparse-builder.git")
+             (url "https://github.com/nodejs/llparse-builder.git")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
@@ -491,10 +491,6 @@ Node.js and web browsers.")
        (modules '((guix build utils)))
        (snippet
         '(begin
-           ;; FIXME: Unneeded runtime dependency.
-           ;; https://github.com/indutny/llparse-builder/pull/2
-           (substitute* "package.json"
-             (("\"@types/debug.*,") ""))
            ;; Fix imports for esbuild.
            ;; https://github.com/evanw/esbuild/issues/477
            (substitute* '("src/node/invoke.ts"
@@ -521,7 +517,8 @@ Node.js and web browsers.")
          (add-after 'patch-dependencies 'delete-dependencies
            (lambda _
              (modify-json (delete-dependencies
-                           `("@types/mocha"
+                           `("@types/debug"
+                             "@types/mocha"
                              "@types/node"
                              "mocha"
                              "ts-node"
@@ -539,7 +536,7 @@ Node.js and web browsers.")
      (list node-binary-search-bootstrap node-debug-bootstrap))
     (native-inputs
      (list esbuild))
-    (home-page "https://github.com/indutny/llparse-builder#readme")
+    (home-page "https://github.com/nodejs/llparse-builder#readme")
     (properties '((hidden? . #t)))
     (synopsis "Graph builder for consumption by llparse")
     (description "This package builds graphs for consumption by llparse.")
@@ -553,7 +550,7 @@ Node.js and web browsers.")
      (origin
        (method git-fetch)
        (uri (git-reference
-             (url "https://github.com/indutny/llparse-frontend.git")
+             (url "https://github.com/nodejs/llparse-frontend.git")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
@@ -602,7 +599,7 @@ Node.js and web browsers.")
      (list node-debug-bootstrap node-llparse-builder-bootstrap))
     (native-inputs
      (list esbuild))
-    (home-page "https://github.com/indutny/llparse-frontend#readme")
+    (home-page "https://github.com/nodejs/llparse-frontend#readme")
     (properties '((hidden? . #t)))
     (synopsis "Frontend for the llparse compiler")
     (description "This package is a frontend for the llparse compiler.")
@@ -611,17 +608,17 @@ Node.js and web browsers.")
 (define-public node-llparse-bootstrap
   (package
     (name "node-llparse")
-    (version "7.1.0")
+    (version "7.3.0")
     (source
      (origin
        (method git-fetch)
        (uri (git-reference
-             (url "https://github.com/indutny/llparse.git")
+             (url "https://github.com/nodejs/llparse.git")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "10da273iy2if88hp79cwms6c8qpsl1fkgzll6gmqyx5yxv5mkyp6"))
+         "09hqjcynkz5iv7aydzdwgs42r7y2zylplv0ff7w0vkdsgb08j22a"))
        (modules '((guix build utils)))
        (snippet
         '(begin
@@ -645,10 +642,14 @@ Node.js and web browsers.")
          (add-after 'patch-dependencies 'delete-dependencies
            (lambda args
              (modify-json (delete-dependencies
-                           `("@types/debug"
+                           `("@stylistic/eslint-plugin"
+                             "@typescript-eslint/eslint-plugin"
+                             "@typescript-eslint/parser"
+                             "@types/debug"
                              "@types/mocha"
                              "@types/node"
                              "esm"
+                             "eslint"
                              "llparse-test-fixture"
                              "mocha"
                              "ts-node"
@@ -676,7 +677,7 @@ parser definition into a C output.")
 (define-public llhttp-bootstrap
   (package
     (name "llhttp")
-    (version "9.2.1")
+    (version "9.3.0")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -685,7 +686,7 @@ parser definition into a C output.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "0mzg19aqb1am498gms0z75cwd5kmfg9p78b1hhxw67019nsjcbac"))
+                "0yz4ys94pjq2fs2pihpqjvmxj2mbpm8k5prlm445z4qlajzlr4kb"))
               (patches (search-patches "llhttp-ponyfill-object-fromentries.patch"))
               (modules '((guix build utils)))
               (snippet
@@ -747,14 +748,14 @@ source files.")
 (define-public node-lts
   (package
     (inherit node-bootstrap)
-    (version "22.14.0")
+    (version "24.14.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
                                   "/node-v" version ".tar.gz"))
               (sha256
                (base32
-                "12msprh604s6qdsgwymxw4kl8ivaldbaydf4v37lbp02aznk2kkc"))
+                "1cri5lp3a9jhh34dbd48hq2zyb7xjb9qs6zl36l3q2blawgwz642"))
               (modules '((guix build utils)))
               (snippet
                '(begin
@@ -770,13 +771,17 @@ source files.")
                               "deps/icu-small"
                               "deps/nghttp2"
                               "deps/ngtcp2"
+                              "deps/llhttp"
                               "deps/uv"
-                              "deps/zlib"))))))
+                              "deps/zlib"
+                              "deps/zstd"))))))
     (arguments
      (substitute-keyword-arguments arguments
        ((#:configure-flags configure-flags)
         ''("--shared-cares"
            "--shared-libuv"
+           "--shared-http-parser"
+           "--shared-http-parser-libname=llhttp"
            "--shared-nghttp2"
            "--shared-openssl"
            "--shared-zlib"
@@ -784,6 +789,7 @@ source files.")
            "--with-intl=system-icu"
            "--shared-ngtcp2"
            "--shared-nghttp3"
+           "--shared-zstd"
            ;;Needed for correct snapshot checksums
            "--v8-enable-snapshot-compression"))
        ((#:phases phases)
@@ -846,9 +852,11 @@ source files.")
                (for-each delete-file
                          '("test/parallel/test-https-agent-unref-socket.js"))
 
-               ;; This test is timing-sensitive, and fails sporadically on
+               ;; These tests are timing-sensitive, and fail sporadically on
                ;; slow, busy, or even very fast machines.
-               (delete-file "test/parallel/test-fs-utimes.js")
+               (for-each delete-file
+                         '("test/parallel/test-fs-utimes.js"
+                           "test/sequential/test-performance-eventloopdelay.js"))
 
                ;; FIXME: This test fails randomly:
                ;; https://github.com/nodejs/node/issues/31213
@@ -899,18 +907,6 @@ source files.")
                      "test/parallel/test-http2-invalid-last-stream-id.js")
                  (("client\\.connect\\(address\\)")
                   "client.connect(address.port)"))))
-           (add-after 'delete-problematic-tests 'replace-llhttp-sources
-             (lambda* (#:key inputs #:allow-other-keys)
-               ;; Replace pre-generated llhttp sources
-               (let ((llhttp (assoc-ref inputs "llhttp")))
-                 (copy-file (string-append llhttp "/src/llhttp.c")
-                            "deps/llhttp/src/llhttp.c")
-                 (copy-file (string-append llhttp "/src/api.c")
-                            "deps/llhttp/src/api.c")
-                 (copy-file (string-append llhttp "/src/http.c")
-                            "deps/llhttp/src/http.c")
-                 (copy-file (string-append llhttp "/include/llhttp.h")
-                            "deps/llhttp/include/llhttp.h"))))
            ;; npm installs dependencies by copying their files over a tar
            ;; stream.  A file with more than one hardlink is marked as a
            ;; "Link".  pacote/lib/fetcher.js calls node-tar's extractor with a
@@ -935,30 +931,22 @@ source files.")
            ;;   https://github.com/npm/pacote/issues/285
            (add-after 'install 'ignore-number-of-hardlinks
              (lambda* (#:key outputs #:allow-other-keys)
-               (let ((file (string-append (assoc-ref outputs "out")
-                                          "/lib/node_modules/npm/node_modules"
-                                          "/tar/lib/write-entry.js")))
-                 (substitute* file
+               (let ((dir (string-append (assoc-ref outputs "out")
+                                         "/lib/node_modules/npm/node_modules"
+                                         "/tar/dist")))
+                 (substitute*
+                     (list (string-append dir "/esm/write-entry.js")
+                           (string-append dir "/commonjs/write-entry.js"))
                    (("this.stat.nlink > 1") "false")))))
-           (add-after 'install 'install-node-gyp-wrapper
+           (replace 'fix-node-gyp-reference
              (lambda* (#:key inputs outputs #:allow-other-keys)
-               (let* ((out (assoc-ref outputs "out"))
-                      (dir (string-append out "/lib/node_modules/npm/bin/node-gyp-bin"))
-                      (file (string-append dir "/node-gyp")))
-                 (mkdir-p dir)
-                 ;; See https://github.com/npm/cli/issues/6842
-                 (call-with-output-file file
-                   (lambda (port)
-                     (format port "#!~a/bin/sh
-if [ \"x$npm_config_node_gyp\" = \"x\" ]; then
-  ~a/bin/node \"~a/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js\" \"$@\"
-else
-  \"$npm_config_node_gyp\" \"$@\"
-fi"
-                             (assoc-ref inputs "bash")
-                             out
-                             out)))
-                 (chmod file #o555))))))))
+               (let ((out (assoc-ref outputs "out")))
+                 (for-each
+                  (lambda (spec)
+                    (wrap-program (string-append out spec)
+                      `("npm_package_config_node_gyp_nodedir" = (,out))))
+                  '("/bin/npm"
+                    "/bin/npx")))))))))
     (native-inputs
      (list ;; Runtime dependencies for binaries used as a bootstrap.
            c-ares-for-node-lts
@@ -974,7 +962,8 @@ fi"
            pkg-config
            procps
            python
-           util-linux))
+           util-linux
+           gcc-14))
     (inputs
      (list bash-minimal
            coreutils
@@ -987,7 +976,8 @@ fi"
            nghttp3
            `(,nghttp2 "lib")
            openssl-3.0
-           zlib))
+           zlib
+           `(,zstd-1.5.7 "lib")))
     (supported-systems
       (cons "riscv64-linux" (package-supported-systems node-bootstrap)))
     (properties (alist-delete 'hidden? (package-properties node-bootstrap)))))
@@ -1003,6 +993,6 @@ fi"
         `(cons* "--shared" "--without-npm" ,flags))
        ((#:phases phases '%standard-phases)
         `(modify-phases ,phases
-           (delete 'install-npmrc)
+           (delete 'fix-node-gyp-reference)
            (delete 'patch-nested-shebangs)
            (delete 'ignore-number-of-hardlinks)))))))

gnu/packages/patches/emacs-agent-shell-fix-tests.patch

@@ -0,0 +1,32 @@
+From 158304fb31177304d41fe495f8c1cca1fb5cff70 Mon Sep 17 00:00:00 2001
+From: xenodium <8107219+xenodium@users.noreply.github.com>
+Date: Wed, 25 Mar 2026 12:37:17 +0000
+Subject: [PATCH] Fixing test
+
+---
+ tests/agent-shell-tests.el | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tests/agent-shell-tests.el b/tests/agent-shell-tests.el
+index f602912d..9263e051 100644
+--- a/tests/agent-shell-tests.el
++++ b/tests/agent-shell-tests.el
+@@ -1233,14 +1233,16 @@ code block content
+                        test-buffer))
+                     ((symbol-function 'shell-maker--process) (lambda () fake-process))
+                     ((symbol-function 'shell-maker-finish-output) #'ignore)
++                    ((symbol-function 'agent-shell--handle) #'ignore)
+                     (agent-shell-file-completion-enabled nil))
+             (let* ((shell-buffer (agent-shell--start :config config
+                                                      :no-focus t
+                                                      :new-session t))
+                    (subs (map-elt (buffer-local-value 'agent-shell--state shell-buffer)
+                                   :event-subscriptions)))
+-              (should (= 1 (length subs)))
+-              (should (eq 'turn-complete (map-elt (car subs) :event))))))
++              (should (seq-find (lambda (sub)
++                                  (eq 'turn-complete (map-elt sub :event)))
++                                subs)))))
+       (remove-hook 'agent-shell-mode-hook hook-fn)
+       (when (process-live-p fake-process)
+         (delete-process fake-process))

gnu/packages/patches/java-apache-xml-commons-resolver-1.2-netbeans.patch

@@ -0,0 +1,890 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+# This is the Apache NetBeans patch
+# ide/o.apache.xml.resolver/external/xml-resolver-1.2-netbeans.patch,
+# rewritten only as needed to apply to the xml-commons-resolver source tree
+# packaged by Guix.
+#
+# NetBeans-side provenance:
+#   - Antonio Vieiro: introduced the patch file in commit
+#     4f4debf776ff247b33fe49b876379fbd90d65fe3
+#   - Junichi Yamamoto: later edited the patch file text
+#
+# Apache NetBeans expects a patched xml-resolver 1.2.  Its source tree and
+# build metadata use the following additions from this patch:
+#   - Catalog.getPublicIDs()
+#   - a CatalogManager.readProperties() guard for propertyFile == null
+#   - org.apache.xml.resolver.NbCatalogManager
+#   - org.apache.xml.resolver.tools.NbCatalogResolver
+#
+# This Guix copy is functionally equivalent to the NetBeans patch.
+
+diff -urN orig/src/org/apache/xml/resolver/Catalog.java mod/src/org/apache/xml/resolver/Catalog.java
+--- orig/src/org/apache/xml/resolver/Catalog.java	1970-01-01 00:00:01.000000000 +0000
++++ mod/src/org/apache/xml/resolver/Catalog.java	2026-03-18 08:06:04.365313076 +0000
+@@ -393,6 +393,26 @@
+   }
+ 
+   /**
++   * Return all registered public IDs.
++   * This method added for solving the following issues in NetBeans codebase:
++   * http://www.netbeans.org/issues/show_bug.cgi?id=98212
++   * and 
++   * http://www.netbeans.org/issues/show_bug.cgi?id=112679
++   */
++  public java.util.Iterator getPublicIDs() {
++      Vector v = new Vector();
++      Enumeration enumeration = catalogEntries.elements();
++
++      while (enumeration.hasMoreElements()) {
++        CatalogEntry e = (CatalogEntry) enumeration.nextElement();
++        if (e.getEntryType() == PUBLIC) {
++            v.add(e.getEntryArg(0));
++        }
++      }
++      return v.iterator();
++  }
++
++  /**
+    * Setup readers.
+    */
+   public void setupReaders() {
+diff -urN orig/src/org/apache/xml/resolver/CatalogManager.java mod/src/org/apache/xml/resolver/CatalogManager.java
+--- orig/src/org/apache/xml/resolver/CatalogManager.java	1970-01-01 00:00:01.000000000 +0000
++++ mod/src/org/apache/xml/resolver/CatalogManager.java	2026-03-18 08:06:04.368781753 +0000
+@@ -239,6 +239,9 @@
+    * resources from it.
+    */
+   private synchronized void readProperties() {
++    if (propertyFile == null) {
++      return;
++    }
+     try {
+       propertyFileURI = CatalogManager.class.getResource("/"+propertyFile);
+       InputStream in =
+diff -urN orig/src/org/apache/xml/resolver/NbCatalogManager.java mod/src/org/apache/xml/resolver/NbCatalogManager.java
+--- orig/src/org/apache/xml/resolver/NbCatalogManager.java	1970-01-01 00:00:00.000000000 +0000
++++ mod/src/org/apache/xml/resolver/NbCatalogManager.java	2026-03-18 08:04:38.762268746 +0000
+@@ -0,0 +1,570 @@
++/*
++ * Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ * 
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ * 
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++package org.apache.xml.resolver;
++
++import java.io.IOException;
++import java.io.InputStream;
++import java.io.PrintStream;
++import java.net.MalformedURLException;
++import java.net.URL;
++import java.util.MissingResourceException;
++import java.util.PropertyResourceBundle;
++import java.util.ResourceBundle;
++import java.util.StringTokenizer;
++import java.util.Vector;
++import org.apache.xml.resolver.helpers.BootstrapResolver;
++import org.apache.xml.resolver.helpers.Debug;
++
++public class NbCatalogManager
++  extends CatalogManager
++{
++  private static String pFiles = "xml.catalog.files";
++  private static String pVerbosity = "xml.catalog.verbosity";
++  private static String pPrefer = "xml.catalog.prefer";
++  private static String pStatic = "xml.catalog.staticCatalog";
++  private static String pAllowPI = "xml.catalog.allowPI";
++  private static String pClassname = "xml.catalog.className";
++  private static String pIgnoreMissing = "xml.catalog.ignoreMissing";
++  private static NbCatalogManager staticManager = new NbCatalogManager();
++  private BootstrapResolver bResolver = new BootstrapResolver();
++  private boolean ignoreMissingProperties = (System.getProperty(pIgnoreMissing) != null) || (System.getProperty(pFiles) != null);
++  private ResourceBundle resources;
++  private String propertyFile = "CatalogManager.properties";
++  private URL propertyFileURI = null;
++  private String defaultCatalogFiles = "./xcatalog";
++  private String catalogFiles = null;
++  private boolean fromPropertiesFile = false;
++  private int defaultVerbosity = 1;
++  private Integer verbosity = null;
++  private boolean defaultPreferPublic = true;
++  private Boolean preferPublic = null;
++  private boolean defaultUseStaticCatalog = true;
++  private Boolean useStaticCatalog = null;
++  private static Catalog staticCatalog = null;
++  private boolean defaultOasisXMLCatalogPI = true;
++  private Boolean oasisXMLCatalogPI = null;
++  private boolean defaultRelativeCatalogs = true;
++  private Boolean relativeCatalogs = null;
++  private String catalogClassName = null;
++  public Debug debug = null;
++  
++  public NbCatalogManager()
++  {
++    this.debug = new Debug();
++  }
++  
++  public NbCatalogManager(String propertyFile)
++  {
++    this.propertyFile = propertyFile;
++    
++    this.debug = new Debug();
++  }
++  
++  public void setBootstrapResolver(BootstrapResolver resolver)
++  {
++    this.bResolver = resolver;
++  }
++  
++  public BootstrapResolver getBootstrapResolver()
++  {
++    return this.bResolver;
++  }
++  
++  private synchronized void readProperties()
++  {
++    if (this.propertyFile == null) {
++      return;
++    }
++    try
++    {
++      this.propertyFileURI = NbCatalogManager.class.getResource("/" + this.propertyFile);
++      InputStream in = NbCatalogManager.class.getResourceAsStream("/" + this.propertyFile);
++      if (in == null)
++      {
++        if (!this.ignoreMissingProperties)
++        {
++          this.debug.message(2, "Cannot find " + this.propertyFile);
++          
++          this.ignoreMissingProperties = true;
++        }
++        return;
++      }
++      this.resources = new PropertyResourceBundle(in);
++    }
++    catch (MissingResourceException mre)
++    {
++      if (!this.ignoreMissingProperties) {
++        System.err.println("Cannot read " + this.propertyFile);
++      }
++    }
++    catch (IOException e)
++    {
++      if (!this.ignoreMissingProperties) {
++        System.err.println("Failure trying to read " + this.propertyFile);
++      }
++    }
++    if (this.verbosity == null) {
++      try
++      {
++        String verbStr = this.resources.getString("verbosity");
++        int verb = Integer.parseInt(verbStr.trim());
++        this.debug.setDebug(verb);
++        this.verbosity = new Integer(verb);
++      }
++      catch (Exception e) {}
++    }
++  }
++  
++  public static CatalogManager getStaticManager()
++  {
++    return staticManager;
++  }
++  
++  public boolean getIgnoreMissingProperties()
++  {
++    return this.ignoreMissingProperties;
++  }
++  
++  public void setIgnoreMissingProperties(boolean ignore)
++  {
++    this.ignoreMissingProperties = ignore;
++  }
++  
++  /**
++   * @deprecated
++   */
++  public void ignoreMissingProperties(boolean ignore)
++  {
++    setIgnoreMissingProperties(ignore);
++  }
++  
++  private int queryVerbosity()
++  {
++    String defaultVerbStr = Integer.toString(this.defaultVerbosity);
++    
++    String verbStr = System.getProperty(pVerbosity);
++    if (verbStr == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources != null) {
++        try
++        {
++          verbStr = this.resources.getString("verbosity");
++        }
++        catch (MissingResourceException e)
++        {
++          verbStr = defaultVerbStr;
++        }
++      } else {
++        verbStr = defaultVerbStr;
++      }
++    }
++    int verb = this.defaultVerbosity;
++    try
++    {
++      verb = Integer.parseInt(verbStr.trim());
++    }
++    catch (Exception e)
++    {
++      System.err.println("Cannot parse verbosity: \"" + verbStr + "\"");
++    }
++    if (this.verbosity == null)
++    {
++      this.debug.setDebug(verb);
++      this.verbosity = new Integer(verb);
++    }
++    return verb;
++  }
++  
++  public int getVerbosity()
++  {
++    if (this.verbosity == null) {
++      this.verbosity = new Integer(queryVerbosity());
++    }
++    return this.verbosity.intValue();
++  }
++  
++  public void setVerbosity(int verbosity)
++  {
++    this.verbosity = new Integer(verbosity);
++    this.debug.setDebug(verbosity);
++  }
++  
++  /**
++   * @deprecated
++   */
++  public int verbosity()
++  {
++    return getVerbosity();
++  }
++  
++  private boolean queryRelativeCatalogs()
++  {
++    if (this.resources == null) {
++      readProperties();
++    }
++    if (this.resources == null) {
++      return this.defaultRelativeCatalogs;
++    }
++    try
++    {
++      String allow = this.resources.getString("relative-catalogs");
++      return (allow.equalsIgnoreCase("true")) || (allow.equalsIgnoreCase("yes")) || (allow.equalsIgnoreCase("1"));
++    }
++    catch (MissingResourceException e) {}
++    return this.defaultRelativeCatalogs;
++  }
++  
++  public boolean getRelativeCatalogs()
++  {
++    if (this.relativeCatalogs == null) {
++      this.relativeCatalogs = new Boolean(queryRelativeCatalogs());
++    }
++    return this.relativeCatalogs.booleanValue();
++  }
++  
++  public void setRelativeCatalogs(boolean relative)
++  {
++    this.relativeCatalogs = new Boolean(relative);
++  }
++  
++  /**
++   * @deprecated
++   */
++  public boolean relativeCatalogs()
++  {
++    return getRelativeCatalogs();
++  }
++  
++  private String queryCatalogFiles()
++  {
++    String catalogList = System.getProperty(pFiles);
++    this.fromPropertiesFile = false;
++    if (catalogList == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources != null) {
++        try
++        {
++          catalogList = this.resources.getString("catalogs");
++          this.fromPropertiesFile = true;
++        }
++        catch (MissingResourceException e)
++        {
++          System.err.println(this.propertyFile + ": catalogs not found.");
++          catalogList = null;
++        }
++      }
++    }
++    if (catalogList == null) {
++      catalogList = this.defaultCatalogFiles;
++    }
++    return catalogList;
++  }
++  
++  public Vector getCatalogFiles()
++  {
++    if (this.catalogFiles == null) {
++      this.catalogFiles = queryCatalogFiles();
++    }
++    StringTokenizer files = new StringTokenizer(this.catalogFiles, ";");
++    Vector catalogs = new Vector();
++    while (files.hasMoreTokens())
++    {
++      String catalogFile = files.nextToken();
++      URL absURI = null;
++      if ((this.fromPropertiesFile) && (!relativeCatalogs())) {
++        try
++        {
++          absURI = new URL(this.propertyFileURI, catalogFile);
++          catalogFile = absURI.toString();
++        }
++        catch (MalformedURLException mue)
++        {
++          absURI = null;
++        }
++      }
++      catalogs.add(catalogFile);
++    }
++    return catalogs;
++  }
++  
++  public void setCatalogFiles(String fileList)
++  {
++    this.catalogFiles = fileList;
++    this.fromPropertiesFile = false;
++  }
++  
++  /**
++   * @deprecated
++   */
++  public Vector catalogFiles()
++  {
++    return getCatalogFiles();
++  }
++  
++  private boolean queryPreferPublic()
++  {
++    String prefer = System.getProperty(pPrefer);
++    if (prefer == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources == null) {
++        return this.defaultPreferPublic;
++      }
++      try
++      {
++        prefer = this.resources.getString("prefer");
++      }
++      catch (MissingResourceException e)
++      {
++        return this.defaultPreferPublic;
++      }
++    }
++    if (prefer == null) {
++      return this.defaultPreferPublic;
++    }
++    return prefer.equalsIgnoreCase("public");
++  }
++  
++  public boolean getPreferPublic()
++  {
++    if (this.preferPublic == null) {
++      this.preferPublic = new Boolean(queryPreferPublic());
++    }
++    return this.preferPublic.booleanValue();
++  }
++  
++  public void setPreferPublic(boolean preferPublic)
++  {
++    this.preferPublic = new Boolean(preferPublic);
++  }
++  
++  /**
++   * @deprecated
++   */
++  public boolean preferPublic()
++  {
++    return getPreferPublic();
++  }
++  
++  private boolean queryUseStaticCatalog()
++  {
++    String staticCatalog = System.getProperty(pStatic);
++    if (staticCatalog == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources == null) {
++        return this.defaultUseStaticCatalog;
++      }
++      try
++      {
++        staticCatalog = this.resources.getString("static-catalog");
++      }
++      catch (MissingResourceException e)
++      {
++        return this.defaultUseStaticCatalog;
++      }
++    }
++    if (staticCatalog == null) {
++      return this.defaultUseStaticCatalog;
++    }
++    return (staticCatalog.equalsIgnoreCase("true")) || (staticCatalog.equalsIgnoreCase("yes")) || (staticCatalog.equalsIgnoreCase("1"));
++  }
++  
++  public boolean getUseStaticCatalog()
++  {
++    if (this.useStaticCatalog == null) {
++      this.useStaticCatalog = new Boolean(queryUseStaticCatalog());
++    }
++    return this.useStaticCatalog.booleanValue();
++  }
++  
++  public void setUseStaticCatalog(boolean useStatic)
++  {
++    this.useStaticCatalog = new Boolean(useStatic);
++  }
++  
++  /**
++   * @deprecated
++   */
++  public boolean staticCatalog()
++  {
++    return getUseStaticCatalog();
++  }
++  
++  public Catalog getPrivateCatalog()
++  {
++    Catalog catalog = staticCatalog;
++    if (this.useStaticCatalog == null) {
++      this.useStaticCatalog = new Boolean(getUseStaticCatalog());
++    }
++    if ((catalog == null) || (!this.useStaticCatalog.booleanValue()))
++    {
++      try
++      {
++        String catalogClassName = getCatalogClassName();
++        if (catalogClassName == null) {
++          catalog = new Catalog();
++        } else {
++          try
++          {
++            catalog = (Catalog)Class.forName(catalogClassName).newInstance();
++          }
++          catch (ClassNotFoundException cnfe)
++          {
++            this.debug.message(1, "Catalog class named '" + catalogClassName + "' could not be found. Using default.");
++            
++            catalog = new Catalog();
++          }
++          catch (ClassCastException cnfe)
++          {
++            this.debug.message(1, "Class named '" + catalogClassName + "' is not a Catalog. Using default.");
++            
++            catalog = new Catalog();
++          }
++        }
++        catalog.setCatalogManager(this);
++        catalog.setupReaders();
++        catalog.loadSystemCatalogs();
++      }
++      catch (Exception ex)
++      {
++        ex.printStackTrace();
++      }
++      if (this.useStaticCatalog.booleanValue()) {
++        staticCatalog = catalog;
++      }
++    }
++    return catalog;
++  }
++  
++  public Catalog getCatalog()
++  {
++    Catalog catalog = staticCatalog;
++    if (this.useStaticCatalog == null) {
++      this.useStaticCatalog = new Boolean(getUseStaticCatalog());
++    }
++    if ((catalog == null) || (!this.useStaticCatalog.booleanValue()))
++    {
++      catalog = getPrivateCatalog();
++      if (this.useStaticCatalog.booleanValue()) {
++        staticCatalog = catalog;
++      }
++    }
++    return catalog;
++  }
++  
++  public boolean queryAllowOasisXMLCatalogPI()
++  {
++    String allow = System.getProperty(pAllowPI);
++    if (allow == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources == null) {
++        return this.defaultOasisXMLCatalogPI;
++      }
++      try
++      {
++        allow = this.resources.getString("allow-oasis-xml-catalog-pi");
++      }
++      catch (MissingResourceException e)
++      {
++        return this.defaultOasisXMLCatalogPI;
++      }
++    }
++    if (allow == null) {
++      return this.defaultOasisXMLCatalogPI;
++    }
++    return (allow.equalsIgnoreCase("true")) || (allow.equalsIgnoreCase("yes")) || (allow.equalsIgnoreCase("1"));
++  }
++  
++  public boolean getAllowOasisXMLCatalogPI()
++  {
++    if (this.oasisXMLCatalogPI == null) {
++      this.oasisXMLCatalogPI = new Boolean(queryAllowOasisXMLCatalogPI());
++    }
++    return this.oasisXMLCatalogPI.booleanValue();
++  }
++  
++  public void setAllowOasisXMLCatalogPI(boolean allowPI)
++  {
++    this.oasisXMLCatalogPI = new Boolean(allowPI);
++  }
++  
++  /**
++   * @deprecated
++   */
++  public boolean allowOasisXMLCatalogPI()
++  {
++    return getAllowOasisXMLCatalogPI();
++  }
++  
++  public String queryCatalogClassName()
++  {
++    String className = System.getProperty(pClassname);
++    if (className == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources == null) {
++        return null;
++      }
++      try
++      {
++        return this.resources.getString("catalog-class-name");
++      }
++      catch (MissingResourceException e)
++      {
++        return null;
++      }
++    }
++    return className;
++  }
++  
++  public String getCatalogClassName()
++  {
++    if (this.catalogClassName == null) {
++      this.catalogClassName = queryCatalogClassName();
++    }
++    return this.catalogClassName;
++  }
++  
++  public void setCatalogClassName(String className)
++  {
++    this.catalogClassName = className;
++  }
++  
++  /**
++   * @deprecated
++   */
++  public String catalogClassName()
++  {
++    return getCatalogClassName();
++  }
++}
+diff -urN orig/src/org/apache/xml/resolver/tools/NbCatalogResolver.java mod/src/org/apache/xml/resolver/tools/NbCatalogResolver.java
+--- orig/src/org/apache/xml/resolver/tools/NbCatalogResolver.java	1970-01-01 00:00:00.000000000 +0000
++++ mod/src/org/apache/xml/resolver/tools/NbCatalogResolver.java	2026-03-18 08:04:38.765863057 +0000
+@@ -0,0 +1,233 @@
++/*
++ * Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ * 
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ * 
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++package org.apache.xml.resolver.tools;
++
++import java.io.IOException;
++import java.net.MalformedURLException;
++import java.net.URL;
++import javax.xml.parsers.ParserConfigurationException;
++import javax.xml.parsers.SAXParser;
++import javax.xml.parsers.SAXParserFactory;
++import javax.xml.transform.Source;
++import javax.xml.transform.TransformerException;
++import javax.xml.transform.URIResolver;
++import javax.xml.transform.sax.SAXSource;
++import org.apache.xml.resolver.Catalog;
++import org.apache.xml.resolver.CatalogManager;
++import org.apache.xml.resolver.NbCatalogManager;
++import org.apache.xml.resolver.helpers.Debug;
++import org.apache.xml.resolver.helpers.FileURL;
++import org.xml.sax.EntityResolver;
++import org.xml.sax.InputSource;
++import org.xml.sax.SAXException;
++import org.xml.sax.XMLReader;
++
++public class NbCatalogResolver
++  implements EntityResolver, URIResolver
++{
++  public boolean namespaceAware = true;
++  public boolean validating = false;
++  private Catalog catalog = null;
++  private CatalogManager catalogManager = NbCatalogManager.getStaticManager();
++  
++  public NbCatalogResolver()
++  {
++    initializeCatalogs(false);
++  }
++  
++  public NbCatalogResolver(boolean privateCatalog)
++  {
++    initializeCatalogs(privateCatalog);
++  }
++  
++  public NbCatalogResolver(NbCatalogManager manager)
++  {
++    this.catalogManager = manager;
++    initializeCatalogs(!this.catalogManager.getUseStaticCatalog());
++  }
++  
++  private void initializeCatalogs(boolean privateCatalog)
++  {
++    this.catalog = this.catalogManager.getCatalog();
++  }
++  
++  public Catalog getCatalog()
++  {
++    return this.catalog;
++  }
++  
++  public String getResolvedEntity(String publicId, String systemId)
++  {
++    String resolved = null;
++    if (this.catalog == null)
++    {
++      this.catalogManager.debug.message(1, "Catalog resolution attempted with null catalog; ignored");
++      return null;
++    }
++    if (systemId != null) {
++      try
++      {
++        resolved = this.catalog.resolveSystem(systemId);
++      }
++      catch (MalformedURLException me)
++      {
++        this.catalogManager.debug.message(1, "Malformed URL exception trying to resolve", publicId);
++        
++        resolved = null;
++      }
++      catch (IOException ie)
++      {
++        this.catalogManager.debug.message(1, "I/O exception trying to resolve", publicId);
++        resolved = null;
++      }
++    }
++    if (resolved == null)
++    {
++      if (publicId != null) {
++        try
++        {
++          resolved = this.catalog.resolvePublic(publicId, systemId);
++        }
++        catch (MalformedURLException me)
++        {
++          this.catalogManager.debug.message(1, "Malformed URL exception trying to resolve", publicId);
++        }
++        catch (IOException ie)
++        {
++          this.catalogManager.debug.message(1, "I/O exception trying to resolve", publicId);
++        }
++      }
++      if (resolved != null) {
++        this.catalogManager.debug.message(2, "Resolved public", publicId, resolved);
++      }
++    }
++    else
++    {
++      this.catalogManager.debug.message(2, "Resolved system", systemId, resolved);
++    }
++    return resolved;
++  }
++  
++  public InputSource resolveEntity(String publicId, String systemId)
++  {
++    String resolved = getResolvedEntity(publicId, systemId);
++    if (resolved != null)
++    {
++      InputSource iSource = new InputSource(resolved);
++      iSource.setPublicId(publicId);
++      return iSource;
++    }
++    return null;
++  }
++  
++  public Source resolve(String href, String base)
++    throws TransformerException
++  {
++    String uri = href;
++    String fragment = null;
++    int hashPos = href.indexOf("#");
++    if (hashPos >= 0)
++    {
++      uri = href.substring(0, hashPos);
++      fragment = href.substring(hashPos + 1);
++    }
++    String result = null;
++    try
++    {
++      result = this.catalog.resolveURI(href);
++    }
++    catch (Exception e) {}
++    if (result == null) {
++      try
++      {
++        URL url = null;
++        if (base == null)
++        {
++          url = new URL(uri);
++          result = url.toString();
++        }
++        else
++        {
++          URL baseURL = new URL(base);
++          url = href.length() == 0 ? baseURL : new URL(baseURL, uri);
++          result = url.toString();
++        }
++      }
++      catch (MalformedURLException mue)
++      {
++        String absBase = makeAbsolute(base);
++        if (!absBase.equals(base)) {
++          return resolve(href, absBase);
++        }
++        throw new TransformerException("Malformed URL " + href + "(base " + base + ")", mue);
++      }
++    }
++    this.catalogManager.debug.message(2, "Resolved URI", href, result);
++    
++    SAXSource source = new SAXSource();
++    source.setInputSource(new InputSource(result));
++    setEntityResolver(source);
++    return source;
++  }
++  
++  private void setEntityResolver(SAXSource source)
++    throws TransformerException
++  {
++    XMLReader reader = source.getXMLReader();
++    if (reader == null)
++    {
++      SAXParserFactory spFactory = SAXParserFactory.newInstance();
++      spFactory.setNamespaceAware(true);
++      try
++      {
++        reader = spFactory.newSAXParser().getXMLReader();
++      }
++      catch (ParserConfigurationException ex)
++      {
++        throw new TransformerException(ex);
++      }
++      catch (SAXException ex)
++      {
++        throw new TransformerException(ex);
++      }
++    }
++    reader.setEntityResolver(this);
++    source.setXMLReader(reader);
++  }
++  
++  private String makeAbsolute(String uri)
++  {
++    if (uri == null) {
++      uri = "";
++    }
++    try
++    {
++      URL url = new URL(uri);
++      return url.toString();
++    }
++    catch (MalformedURLException mue)
++    {
++      try
++      {
++        URL fileURL = FileURL.makeURL(uri);
++        return fileURL.toString();
++      }
++      catch (MalformedURLException mue2) {}
++    }
++    return uri;
++  }
++}

gnu/packages/patches/java-jtidy-remove-xerces-dependency.patch

@@ -0,0 +1,24 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Remove lib that is built-in into JDK since Java 5.
+
+Remove xerces:dom3-xml-apis dependency from pom.xml.
+The DOM Level 3 API has been part of the JDK since Java 5.
+Without this patch, install-from-pom's fix-pom-dependencies throws
+no-such-input because the dependency is not test-scoped or optional
+and no matching package is in inputs.
+
+--- a/pom.xml
++++ b/pom.xml
+@@ -171,11 +171,6 @@
+     </plugins>
+   </build>
+   <dependencies>
+-    <dependency>
+-      <groupId>xerces</groupId>
+-      <artifactId>dom3-xml-apis</artifactId>
+-      <version>1.0</version>
+-    </dependency>
+     <dependency>
+       <groupId>ant</groupId>
+       <artifactId>ant</artifactId>

gnu/packages/patches/java-simplevalidation-1.14.1.patch

@@ -0,0 +1,107 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Update simplevalidation to 1.14.1.
+
+diff -urN orig/ValidationAPI/pom.xml mod/ValidationAPI/pom.xml
+--- orig/ValidationAPI/pom.xml	2022-07-23 01:17:30.000000000 +0000
++++ mod/ValidationAPI/pom.xml	2026-03-18 08:31:38.200321916 +0000
+@@ -4,7 +4,7 @@
+     <parent>
+         <artifactId>simplevalidation-parent</artifactId>
+         <groupId>com.mastfrog</groupId>
+-        <version>1.14</version>
++        <version>1.14.1</version>
+     </parent>
+     <modelVersion>4.0.0</modelVersion>
+     <artifactId>simplevalidation</artifactId>
+diff -urN orig/nbstubs/pom.xml mod/nbstubs/pom.xml
+--- orig/nbstubs/pom.xml	2022-07-23 01:17:30.000000000 +0000
++++ mod/nbstubs/pom.xml	2026-03-18 08:31:38.200321916 +0000
+@@ -4,7 +4,7 @@
+     <parent>
+         <artifactId>simplevalidation-parent</artifactId>
+         <groupId>com.mastfrog</groupId>
+-        <version>1.14</version>
++        <version>1.14.1</version>
+     </parent>
+     <modelVersion>4.0.0</modelVersion>
+     <artifactId>nbstubs</artifactId>
+diff -urN orig/nbstubs/src/org/openide/util/lookup/ServiceProvider.java mod/nbstubs/src/org/openide/util/lookup/ServiceProvider.java
+--- orig/nbstubs/src/org/openide/util/lookup/ServiceProvider.java	1970-01-01 00:00:00.000000000 +0000
++++ mod/nbstubs/src/org/openide/util/lookup/ServiceProvider.java	2026-03-18 08:31:38.200321916 +0000
+@@ -0,0 +1,31 @@
++/*
++ * Copyright 2025 Danny Milosavljevic
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *     http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++package org.openide.util.lookup;
++
++import java.lang.annotation.ElementType;
++import java.lang.annotation.Retention;
++import java.lang.annotation.RetentionPolicy;
++import java.lang.annotation.Target;
++
++@Retention(RetentionPolicy.SOURCE)
++@Target(ElementType.TYPE)
++public @interface ServiceProvider {
++    Class<?> service();
++
++    String path() default "";
++
++    int position() default Integer.MAX_VALUE;
++}
+diff -urN orig/pom.xml mod/pom.xml
+--- orig/pom.xml	2022-07-23 01:17:30.000000000 +0000
++++ mod/pom.xml	2026-03-18 08:31:38.200321916 +0000
+@@ -21,7 +21,7 @@
+     </organization>
+     <packaging>pom</packaging>
+     <name>Simple Validation (parent)</name>
+-    <version>1.14</version>
++    <version>1.14.1</version>
+     <description>
+         Simple Validation Parent Project:
+         This is a simple library for quickly adding validation code to Swing user-interfaces.
+diff -urN orig/simplevalidation-swing/pom.xml mod/simplevalidation-swing/pom.xml
+--- orig/simplevalidation-swing/pom.xml	2022-07-23 01:17:30.000000000 +0000
++++ mod/simplevalidation-swing/pom.xml	2026-03-18 08:41:00.326700212 +0000
+@@ -5,7 +5,7 @@
+     <parent>
+         <groupId>com.mastfrog</groupId>
+         <artifactId>simplevalidation-parent</artifactId>
+-        <version>1.14</version>
++        <version>1.14.1</version>
+     </parent>
+     <artifactId>simplevalidation-swing</artifactId>
+     <scm>
+@@ -49,17 +49,12 @@
+     </build>
+     <dependencies>
+         <dependency>
+-            <groupId>${project.groupId}</groupId>
++            <groupId>com.mastfrog</groupId>
+             <artifactId>simplevalidation</artifactId>
+         </dependency>
+         <dependency>
+-            <groupId>${project.groupId}</groupId>
++            <groupId>com.mastfrog</groupId>
+             <artifactId>nbstubs</artifactId>
+         </dependency>
+-        <dependency>
+-            <groupId>org.netbeans.api</groupId>
+-            <artifactId>org-openide-util-lookup</artifactId>
+-            <scope>provided</scope>
+-        </dependency>
+     </dependencies>
+ </project>

gnu/packages/patches/jbr-25-wayland-drag-icon.patch

@@ -0,0 +1,508 @@
+From 0602a477881f7d4047edd2ffe2b6f5157fda9bc9 Mon Sep 17 00:00:00 2001
+From: Danny Milosavljevic <dannym@nova.friendly-machines.com>
+Date: Tue, 31 Mar 2026 05:11:27 +0000
+Subject: [PATCH 1/2] Wayland: fix drag icon updates during drag-and-drop
+
+Expose the actual cursor image and size to the Wayland peer, provide DnD cursor desktop properties, and use the Wayland drag icon surface as the drag-and-drop status channel. Preserve application-supplied drag images, update cursor-derived fallback icons during action changes, pad drag icon buffers for compositor scale requirements, and reuse the drag icon surface so later status changes reach the compositor.
+---
+ .../share/classes/sun/awt/CustomCursor.java   |  21 ++-
+ .../classes/sun/awt/wl/WLCursorManager.java   |  30 +++++
+ .../unix/classes/sun/awt/wl/WLDataSource.java |  32 +++--
+ .../sun/awt/wl/WLDragSourceContextPeer.java   | 122 ++++++++++++++++--
+ .../unix/classes/sun/awt/wl/WLToolkit.java    |  11 +-
+ .../unix/native/libawt_wlawt/WLCursor.c       |  14 ++
+ .../unix/native/libawt_wlawt/WLDataDevice.c   |  37 +++++-
+ 7 files changed, 243 insertions(+), 24 deletions(-)
+
+diff --git a/src/java.desktop/share/classes/sun/awt/CustomCursor.java b/src/java.desktop/share/classes/sun/awt/CustomCursor.java
+index 2b65c5dbe..aa7e5559d 100644
+--- a/src/java.desktop/share/classes/sun/awt/CustomCursor.java
++++ b/src/java.desktop/share/classes/sun/awt/CustomCursor.java
+@@ -37,6 +37,8 @@
+ public abstract class CustomCursor extends Cursor {
+ 
+     protected Image image;
++    private Image cursorImage;
++    private Point hotSpot;
+ 
+     public CustomCursor(Image cursor, Point hotSpot, String name)
+             throws IndexOutOfBoundsException {
+@@ -80,6 +82,9 @@ public CustomCursor(Image cursor, Point hotSpot, String name)
+             throw new IndexOutOfBoundsException("invalid hotSpot");
+         }
+ 
++        cursorImage = cursor;
++        this.hotSpot = new Point(hotSpot);
++
+         /* Extract ARGB array from image.
+          *
+          * A transparency mask can be created in native code by checking
+@@ -96,10 +101,24 @@ public CustomCursor(Image cursor, Point hotSpot, String name)
+         } catch (InterruptedException e) {
+         }
+ 
+-        createNativeCursor(image, pixels, width, height, hotSpot.x, hotSpot.y);
++        createNativeCursor(cursorImage, pixels, width, height, hotSpot.x, hotSpot.y);
+     }
+ 
+     protected abstract void createNativeCursor(Image im,  int[] pixels,
+                                                int width, int height,
+                                                int xHotSpot, int yHotSpot);
++
++    /**
++     * Returns the image used to create the native cursor.
++     */
++    public Image getImage() {
++        return cursorImage;
++    }
++
++    /**
++     * Returns the hotspot used to create the native cursor.
++     */
++    public Point getHotSpot() {
++        return new Point(hotSpot);
++    }
+ }
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLCursorManager.java b/src/java.desktop/unix/classes/sun/awt/wl/WLCursorManager.java
+index 75927e762..0b1ef8d57 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLCursorManager.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLCursorManager.java
+@@ -29,6 +29,7 @@
+ import sun.awt.AWTAccessor;
+ import sun.util.logging.PlatformLogger;
+ 
++import java.awt.Dimension;
+ import java.awt.Cursor;
+ import java.awt.GraphicsConfiguration;
+ 
+@@ -139,7 +140,36 @@ private long createNativeCursor(int type, int scale) {
+         return 0;
+     }
+ 
++    /**
++     * Returns the width and height in pixels of the given cursor at the
++     * specified display scale. Returns null if the cursor is unavailable.
++     */
++    public static Dimension getCursorSize(Cursor cursor, int scale) {
++        if (cursor == null) {
++            return null;
++        }
++
++        synchronized (instance) {
++            long pData = AWTAccessor.getCursorAccessor().getPData(cursor, scale);
++            if (pData == 0 && cursor.getType() == Cursor.CUSTOM_CURSOR) {
++                pData = AWTAccessor.getCursorAccessor().getPData(cursor);
++            }
++            if (pData <= 0) {
++                return null;
++            }
++
++            int w = nativeGetCursorWidth(pData);
++            int h = nativeGetCursorHeight(pData);
++            if (w <= 0 || h <= 0) {
++                return null;
++            }
++            return new Dimension(w, h);
++        }
++    }
++
+     private static native void nativeSetCursor(long pData, int scale, long pointerEnterSerial);
+     private static native long nativeGetPredefinedCursor(String name, int scale);
+     private static native void nativeDestroyPredefinedCursor(long pData);
++    private static native int nativeGetCursorWidth(long pData);
++    private static native int nativeGetCursorHeight(long pData);
+ }
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLDataSource.java b/src/java.desktop/unix/classes/sun/awt/wl/WLDataSource.java
+index 260aab964..2ecc52619 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLDataSource.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLDataSource.java
+@@ -103,22 +103,38 @@ public void setDnDIcon(Image image, int scale, int offsetX, int offsetY) {
+ 
+         int width = image.getWidth(null);
+         int height = image.getHeight(null);
+-        int[] pixels = new int[width * height];
++        int paddedWidth = width;
++        int paddedHeight = height;
++        Image iconImage = image;
++
++        if (scale > 1) {
++            paddedWidth = ((width + scale - 1) / scale) * scale;
++            paddedHeight = ((height + scale - 1) / scale) * scale;
++            if (paddedWidth != width || paddedHeight != height) {
++                BufferedImage paddedImage = new BufferedImage(paddedWidth, paddedHeight, BufferedImage.TYPE_INT_ARGB);
++                Graphics2D g = paddedImage.createGraphics();
++                g.drawImage(image, 0, 0, null);
++                g.dispose();
++                iconImage = paddedImage;
++            }
++        }
++
++        int[] pixels = new int[paddedWidth * paddedHeight];
+ 
+-        if (image instanceof BufferedImage) {
++        if (iconImage instanceof BufferedImage) {
+             // NOTE: no need to ensure that the BufferedImage is TYPE_INT_ARGB,
+             // getRGB() does pixel format conversion automatically
+-            ((BufferedImage) image).getRGB(0, 0, width, height, pixels, 0, width);
++            ((BufferedImage) iconImage).getRGB(0, 0, paddedWidth, paddedHeight, pixels, 0, paddedWidth);
+         } else {
+-            BufferedImage bufferedImage = new BufferedImage(width, height, BufferedImage.TYPE_INT_ARGB);
++            BufferedImage bufferedImage = new BufferedImage(paddedWidth, paddedHeight, BufferedImage.TYPE_INT_ARGB);
+             Graphics2D g = bufferedImage.createGraphics();
+-            g.drawImage(image, 0, 0, null);
++            g.drawImage(iconImage, 0, 0, null);
+             g.dispose();
+ 
+-            bufferedImage.getRGB(0, 0, width, height, pixels, 0, width);
++            bufferedImage.getRGB(0, 0, paddedWidth, paddedHeight, pixels, 0, paddedWidth);
+         }
+ 
+-        setDnDIconImpl(nativePtr, scale, width, height, offsetX, offsetY, pixels);
++        setDnDIconImpl(nativePtr, scale, paddedWidth, paddedHeight, offsetX, offsetY, pixels);
+     }
+ 
+     public void offerExtraMime(String mime) {
+@@ -152,4 +168,4 @@ protected void handleDnDDropPerformed() {}
+     protected void handleDnDFinished() {}
+ 
+     protected void handleDnDAction(int action) {}
+-}
+\ No newline at end of file
++}
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java b/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
+index afd727d1a..46747ddca 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
+@@ -26,9 +26,13 @@
+ package sun.awt.wl;
+ 
+ import sun.awt.AWTAccessor;
++import sun.awt.CustomCursor;
+ import sun.awt.dnd.SunDragSourceContextPeer;
+ 
+ import java.awt.Cursor;
++import java.awt.Dimension;
++import java.awt.Image;
++import java.awt.Point;
+ import java.awt.datatransfer.DataFlavor;
+ import java.awt.datatransfer.Transferable;
+ import java.awt.dnd.DragGestureEvent;
+@@ -36,6 +40,8 @@
+ 
+ public class WLDragSourceContextPeer extends SunDragSourceContextPeer {
+     private final WLDataDevice dataDevice;
++    private WLDragSource activeDragSource;
++    private boolean activeDragSourceUsesCursorFallback;
+ 
+     private class WLDragSource extends WLDataSource {
+         private int action;
+@@ -47,7 +53,7 @@ private class WLDragSource extends WLDataSource {
+             super(dataDevice, WLDataDevice.DATA_TRANSFER_PROTOCOL_WAYLAND, data);
+         }
+ 
+-        private void sendFinishedEvent() {
++        private synchronized void sendFinishedEvent() {
+             if (didSendFinishedEvent) {
+                 return;
+             }
+@@ -67,7 +73,11 @@ protected synchronized void handleDnDAction(int action) {
+             // except for maybe action(dnd_ask), but since we do not announce support for dnd_ask,
+             // we don't need to worry about it.
+             if (!didSucceed) {
++                int previousAction = this.action;
+                 this.action = action;
++                if (previousAction != action) {
++                    WLDragSourceContextPeer.this.handleSourceActionChanged(previousAction, action);
++                }
+             }
+         }
+ 
+@@ -78,8 +88,8 @@ protected synchronized void handleDnDDropPerformed() {
+ 
+         @Override
+         protected synchronized void handleDnDFinished() {
++            WLDragSourceContextPeer.this.finishDragSource(this);
+             sendFinishedEvent();
+-            destroy();
+         }
+ 
+         @Override
+@@ -88,9 +98,9 @@ protected synchronized void handleTargetAcceptsMime(String mime) {
+         }
+ 
+         @Override
+-        protected void handleCancelled() {
++        protected synchronized void handleCancelled() {
++            WLDragSourceContextPeer.this.finishDragSource(this);
+             sendFinishedEvent();
+-            super.handleCancelled();
+         }
+     }
+ 
+@@ -119,6 +129,35 @@ private WLMainSurface getSurface() {
+         return null;
+     }
+ 
++    private synchronized void activateDragSource(WLDragSource dragSource) {
++        activeDragSource = dragSource;
++    }
++
++    private synchronized void finishDragSource(WLDragSource dragSource) {
++        if (activeDragSource == dragSource) {
++            activeDragSource = null;
++            activeDragSourceUsesCursorFallback = false;
++        }
++        dragSource.destroy();
++    }
++
++    private void handleSourceActionChanged(int previousWaylandAction, int waylandAction) {
++        var inputState = WLToolkit.getInputState();
++        int x = inputState.getPointerX();
++        int y = inputState.getPointerY();
++        int modifiers = inputState.getModifiers();
++        int javaAction = WLDataDevice.waylandActionsToJava(waylandAction);
++        int previousJavaAction = WLDataDevice.waylandActionsToJava(previousWaylandAction);
++
++        if (previousJavaAction == 0 && javaAction != 0) {
++            postDragSourceDragEvent(javaAction, modifiers, x, y, DISPATCH_ENTER);
++        } else if (previousJavaAction != 0 && javaAction == 0) {
++            dragExit(x, y);
++        } else if (previousJavaAction != 0) {
++            postDragSourceDragEvent(javaAction, modifiers, x, y, DISPATCH_CHANGED);
++        }
++    }
++
+     @Override
+     protected void startDrag(Transferable trans, long[] formats, Map<Long, DataFlavor> formatMap) {
+         var mainSurface = getSurface();
+@@ -134,21 +173,88 @@ protected void startDrag(Transferable trans, long[] formats, Map<Long, DataFlavo
+ 
+         source.setDnDActions(waylandActions);
+ 
++        int scale = mainSurface.getGraphicsDevice().getDisplayScale();
+         var dragImage = getDragImage();
++        Point dragImageOffset = null;
++        boolean usesCursorFallback = false;
++        if (dragImage == null) {
++            dragImage = cursorToImage(getDragSourceContext().getCursor());
++            if (dragImage != null) {
++                dragImageOffset = cursorToDragImageOffset(getDragSourceContext().getCursor(), scale);
++                usesCursorFallback = true;
++            }
++        } else {
++            dragImageOffset = getDragImageOffset();
++        }
+         if (dragImage != null) {
+-            var dragImageOffset = getDragImageOffset();
+             source.setDnDIcon(dragImage,
+-                    mainSurface.getGraphicsDevice().getDisplayScale(),
++                    scale,
+                     dragImageOffset.x, dragImageOffset.y);
+         }
+ 
+         long eventSerial = WLToolkit.getInputState().pointerButtonSerial();
+ 
+-        dataDevice.startDrag(source, mainSurface.getWlSurfacePtr(), eventSerial);
++        synchronized (this) {
++            activateDragSource(source);
++            activeDragSourceUsesCursorFallback = usesCursorFallback;
++        }
++        try {
++            dataDevice.startDrag(source, mainSurface.getWlSurfacePtr(), eventSerial);
++        } catch (RuntimeException | Error e) {
++            finishDragSource(source);
++            throw e;
++        }
+     }
+ 
+     @Override
+     protected void setNativeCursor(long nativeCtxt, Cursor c, int cType) {
+-        // TODO: setting cursor here doesn't seem to be required on Wayland?
++        // On Wayland, cursor changes during a drag are expressed by
++        // updating the drag icon surface content.
++        var mainSurface = getSurface();
++        int scale = mainSurface != null ? mainSurface.getGraphicsDevice().getDisplayScale() : 1;
++
++        synchronized (this) {
++            if (activeDragSource == null) {
++                return;
++            }
++            if (!activeDragSourceUsesCursorFallback) {
++                return;
++            }
++
++            Image image = cursorToImage(c);
++            if (image == null) {
++                return;
++            }
++
++            Point dragImageOffset = cursorToDragImageOffset(c, scale);
++            activeDragSource.setDnDIcon(image, scale, dragImageOffset.x, dragImageOffset.y);
++        }
++    }
++
++    private static Image cursorToImage(Cursor cursor) {
++        if (cursor instanceof CustomCursor cc) {
++            return cc.getImage();
++        }
++        return null;
++    }
++
++    private static Point cursorToDragImageOffset(Cursor cursor, int scale) {
++        Dimension cursorSize = WLCursorManager.getCursorSize(cursor, scale);
++        if (cursorSize == null) {
++            Image image = cursorToImage(cursor);
++            if (image != null) {
++                cursorSize = new Dimension(image.getWidth(null), image.getHeight(null));
++            }
++        }
++
++        if (cursorSize == null) {
++            return new Point(0, 0);
++        }
++
++        // This is only for the Wayland fallback path where no application drag
++        // image was supplied and we reuse DnD cursor artwork as the drag icon.
++        // Keep that fallback icon visible by placing it one cursor width/height
++        // away from the pointer hotspot, expressed in surface-local coordinates.
++        return new Point(cursorSize.width / scale, cursorSize.height / scale);
+     }
+ }
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLToolkit.java b/src/java.desktop/unix/classes/sun/awt/wl/WLToolkit.java
+index 058306539..e768cbfd8 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLToolkit.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLToolkit.java
+@@ -983,9 +983,18 @@ public int getNumberOfButtons(){
+         return MOUSE_BUTTONS_COUNT;
+     }
+ 
++    private static final String DND_CURSOR_PREFIX = "DnD.Cursor.";
++
+     @Override
+     protected Object lazilyLoadDesktopProperty(String name) {
+-        if (log.isLoggable(PlatformLogger.Level.FINE)) {
++        if (name.startsWith(DND_CURSOR_PREFIX)) {
++            String cursorName = name.substring(DND_CURSOR_PREFIX.length()) + ".32x32";
++            try {
++                return Cursor.getSystemCustomCursor(cursorName);
++            } catch (AWTException awte) {
++                throw new RuntimeException("cannot load system cursor: " + cursorName, awte);
++            }
++        } else if (log.isLoggable(PlatformLogger.Level.FINE)) {
+             log.fine("Not implemented: WLToolkit.lazilyLoadDesktopProperty()");
+         }
+         return null;
+diff --git a/src/java.desktop/unix/native/libawt_wlawt/WLCursor.c b/src/java.desktop/unix/native/libawt_wlawt/WLCursor.c
+index f56f39d16..6d1a95460 100644
+--- a/src/java.desktop/unix/native/libawt_wlawt/WLCursor.c
++++ b/src/java.desktop/unix/native/libawt_wlawt/WLCursor.c
+@@ -100,6 +100,20 @@ JNIEXPORT void JNICALL Java_sun_awt_wl_WLCursorManager_nativeDestroyPredefinedCu
+     free(cursor);
+ }
+ 
++JNIEXPORT jint JNICALL Java_sun_awt_wl_WLCursorManager_nativeGetCursorWidth
++        (JNIEnv *env, jclass cls, jlong cursorPtr)
++{
++    struct WLCursor *cursor = jlong_to_ptr(cursorPtr);
++    return cursor ? (jint) cursor->width : 0;
++}
++
++JNIEXPORT jint JNICALL Java_sun_awt_wl_WLCursorManager_nativeGetCursorHeight
++        (JNIEnv *env, jclass cls, jlong cursorPtr)
++{
++    struct WLCursor *cursor = jlong_to_ptr(cursorPtr);
++    return cursor ? (jint) cursor->height : 0;
++}
++
+ JNIEXPORT jlong JNICALL Java_sun_awt_wl_WLCustomCursor_nativeCreateCustomCursor
+   (JNIEnv *env, jclass cls, jintArray pixels, jint width, jint height, jint xHotSpot, jint yHotSpot)
+ {
+diff --git a/src/java.desktop/unix/native/libawt_wlawt/WLDataDevice.c b/src/java.desktop/unix/native/libawt_wlawt/WLDataDevice.c
+index 5d0095dae..7e6311529 100644
+--- a/src/java.desktop/unix/native/libawt_wlawt/WLDataDevice.c
++++ b/src/java.desktop/unix/native/libawt_wlawt/WLDataDevice.c
+@@ -86,6 +86,8 @@ struct DataSource
+ 
+     struct wl_surface* dragIcon;
+     struct wl_buffer* dragIconBuffer;
++    int dragIconOffsetX;
++    int dragIconOffsetY;
+ 
+     struct DataSource* nextDel;
+ };
+@@ -673,7 +675,10 @@ zwp_primary_selection_source_handle_cancelled(void *user,
+ static void
+ wl_data_offer_handle_offer(void *user, struct wl_data_offer *wl_data_offer, const char *mime)
+ {
+-    DataOffer_callOfferHandler((struct DataOffer *) user, mime);
++    struct DataOffer *offer = user;
++    assert(offer != NULL);
++
++    DataOffer_callOfferHandler(offer, mime);
+ }
+ 
+ static void
+@@ -1149,6 +1154,14 @@ JNIEXPORT void JNICALL Java_sun_awt_wl_WLDataSource_setDnDIconImpl
+    jint width, jint height, jint offsetX, jint offsetY, jintArray pixels)
+ {
+     struct DataSource *source = jlong_to_ptr(nativePtr);
++    bool updating_existing_icon = source->dragIcon != NULL;
++    struct wl_buffer *oldBuffer = source->dragIconBuffer;
++    // Drag-icon updates reuse the same wl_surface after start_drag().
++    // For that surface, wl_surface.offset (or pre-v5 nonzero attach offsets)
++    // is relative to the current buffer position, not an absolute placement.
++    // Keep the last requested absolute offset and send only the delta here.
++    int deltaOffsetX = offsetX - source->dragIconOffsetX;
++    int deltaOffsetY = offsetY - source->dragIconOffsetY;
+ 
+     size_t pixelCount = (size_t)((*env)->GetArrayLength(env, pixels));
+     size_t byteSize = pixelCount * 4U;
+@@ -1180,7 +1193,9 @@ JNIEXPORT void JNICALL Java_sun_awt_wl_WLDataSource_setDnDIconImpl
+         return;
+     }
+ 
+-    source->dragIcon = wl_compositor_create_surface(wl_compositor);
++    if (!source->dragIcon) {
++        source->dragIcon = wl_compositor_create_surface(wl_compositor);
++    }
+     if (!source->dragIcon) {
+         wl_buffer_destroy(source->dragIconBuffer);
+         source->dragIconBuffer = NULL;
+@@ -1191,12 +1206,12 @@ JNIEXPORT void JNICALL Java_sun_awt_wl_WLDataSource_setDnDIconImpl
+     int wl_compositor_version = wl_compositor_get_version(wl_compositor);
+     if (wl_compositor_version >= 5) {
+         wl_surface_attach(source->dragIcon, source->dragIconBuffer, 0, 0);
+-        wl_surface_offset(source->dragIcon, offsetX, offsetY);
++        wl_surface_offset(source->dragIcon, deltaOffsetX, deltaOffsetY);
+     } else {
+-        wl_surface_attach(source->dragIcon, source->dragIconBuffer, offsetX, offsetY);
++        wl_surface_attach(source->dragIcon, source->dragIconBuffer, deltaOffsetX, deltaOffsetY);
+     }
+ #else
+-    wl_surface_attach(source->dragIcon, source->dragIconBuffer, offsetX, offsetY);
++    wl_surface_attach(source->dragIcon, source->dragIconBuffer, deltaOffsetX, deltaOffsetY);
+ #endif
+ 
+     if (scale >= 1) {
+@@ -1205,7 +1220,17 @@ JNIEXPORT void JNICALL Java_sun_awt_wl_WLDataSource_setDnDIconImpl
+ 
+     wl_surface_damage_buffer(source->dragIcon, 0, 0, width, height);
+ 
+-    // NOTE: we still need to commit the surface, this is done immediately after start_drag
++    if (oldBuffer) {
++        wl_buffer_destroy(oldBuffer);
++    }
++
++    source->dragIconOffsetX = offsetX;
++    source->dragIconOffsetY = offsetY;
++
++    if (updating_existing_icon) {
++        wl_surface_commit(source->dragIcon);
++        wlFlushToServer(env);
++    }
+ }
+ 
+ JNIEXPORT void JNICALL
+-- 
+2.52.0
+

gnu/packages/patches/jbr-25-wayland-intra-jvm-dnd.patch

@@ -0,0 +1,144 @@
+From 6f12ff22c3a902db64ef2bc4f94cb2ad4b26f4ce Mon Sep 17 00:00:00 2001
+From: Danny Milosavljevic <dannym@nova.friendly-machines.com>
+Date: Tue, 31 Mar 2026 05:24:04 +0000
+Subject: [PATCH 2/2] Wayland: enable intra-JVM drag-and-drop transfers
+
+Advertise JAVA_DATAFLAVOR natives for local drags, register the current JVM-local Transferable before starting the drag, and let the drop target fall back to the source actions when Wayland MIME negotiation stays at zero for a local Java-object transfer.
+---
+ .../sun/awt/wl/WLDragSourceContextPeer.java   | 42 +++++++++++++++++--
+ .../sun/awt/wl/WLDropTargetContextPeer.java   | 11 ++++-
+ 2 files changed, 48 insertions(+), 5 deletions(-)
+
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java b/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
+index 46747ddca..3490b9f2b 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
+@@ -28,6 +28,7 @@
+ import sun.awt.AWTAccessor;
+ import sun.awt.CustomCursor;
+ import sun.awt.dnd.SunDragSourceContextPeer;
++import sun.awt.dnd.SunDropTargetContextPeer;
+ 
+ import java.awt.Cursor;
+ import java.awt.Dimension;
+@@ -35,7 +36,9 @@
+ import java.awt.Point;
+ import java.awt.datatransfer.DataFlavor;
+ import java.awt.datatransfer.Transferable;
++import java.awt.dnd.DnDConstants;
+ import java.awt.dnd.DragGestureEvent;
++import java.util.HashSet;
+ import java.util.Map;
+ 
+ public class WLDragSourceContextPeer extends SunDragSourceContextPeer {
+@@ -59,7 +62,9 @@ private synchronized void sendFinishedEvent() {
+             }
+             didSendFinishedEvent = true;
+ 
+-            final int javaAction = didSucceed ? WLDataDevice.waylandActionsToJava(action) : 0;
++            final int javaAction = didSucceed
++                    ? WLDataDevice.waylandActionsToJava(action)
++                    : DnDConstants.ACTION_NONE;
+             final int x = WLToolkit.getInputState().getPointerX();
+             final int y = WLToolkit.getInputState().getPointerY();
+             WLDragSourceContextPeer.this.dragDropFinished(didSucceed, javaAction, x, y);
+@@ -149,15 +154,41 @@ private void handleSourceActionChanged(int previousWaylandAction, int waylandAct
+         int javaAction = WLDataDevice.waylandActionsToJava(waylandAction);
+         int previousJavaAction = WLDataDevice.waylandActionsToJava(previousWaylandAction);
+ 
+-        if (previousJavaAction == 0 && javaAction != 0) {
++        if (previousJavaAction == DnDConstants.ACTION_NONE
++                && javaAction != DnDConstants.ACTION_NONE) {
+             postDragSourceDragEvent(javaAction, modifiers, x, y, DISPATCH_ENTER);
+-        } else if (previousJavaAction != 0 && javaAction == 0) {
++        } else if (previousJavaAction != DnDConstants.ACTION_NONE
++                && javaAction == DnDConstants.ACTION_NONE) {
+             dragExit(x, y);
+-        } else if (previousJavaAction != 0) {
++        } else if (previousJavaAction != DnDConstants.ACTION_NONE) {
+             postDragSourceDragEvent(javaAction, modifiers, x, y, DISPATCH_CHANGED);
+         }
+     }
+ 
++    private void offerJavaFlavorMimes(WLDragSource source, Transferable trans) {
++        var transferer = (WLDataTransferer) WLDataTransferer.getInstance();
++        var flavorTable = transferer.getFlavorTable();
++        var extraMimes = new HashSet<String>();
++        var flavors = trans.getTransferDataFlavors();
++
++        if (flavors == null) {
++            return;
++        }
++
++        for (DataFlavor flavor : flavors) {
++            if (flavor == null) {
++                continue;
++            }
++            for (String nativeName : flavorTable.getNativesForFlavor(flavor)) {
++                if (nativeName != null
++                        && nativeName.startsWith("JAVA_DATAFLAVOR:")
++                        && extraMimes.add(nativeName)) {
++                    source.offerExtraMime(nativeName);
++                }
++            }
++        }
++    }
++
+     @Override
+     protected void startDrag(Transferable trans, long[] formats, Map<Long, DataFlavor> formatMap) {
+         var mainSurface = getSurface();
+@@ -167,6 +198,7 @@ protected void startDrag(Transferable trans, long[] formats, Map<Long, DataFlavo
+ 
+         // formats and formatMap are unused, because WLDataSource already references the same DataTransferer singleton
+         var source = new WLDragSource(trans);
++        offerJavaFlavorMimes(source, trans);
+ 
+         var actions = getDragSourceContext().getSourceActions();
+         int waylandActions = WLDataDevice.javaActionsToWayland(actions);
+@@ -199,9 +231,11 @@ protected void startDrag(Transferable trans, long[] formats, Map<Long, DataFlavo
+             activeDragSourceUsesCursorFallback = usesCursorFallback;
+         }
+         try {
++            SunDropTargetContextPeer.setCurrentJVMLocalSourceTransferable(trans);
+             dataDevice.startDrag(source, mainSurface.getWlSurfacePtr(), eventSerial);
+         } catch (RuntimeException | Error e) {
+             finishDragSource(source);
++            SunDropTargetContextPeer.setCurrentJVMLocalSourceTransferable(null);
+             throw e;
+         }
+     }
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLDropTargetContextPeer.java b/src/java.desktop/unix/classes/sun/awt/wl/WLDropTargetContextPeer.java
+index 76e47a133..757e20652 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLDropTargetContextPeer.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLDropTargetContextPeer.java
+@@ -31,6 +31,7 @@
+ import sun.awt.dnd.SunDropTargetEvent;
+ 
+ import java.awt.Component;
++import java.awt.dnd.DnDConstants;
+ import java.awt.event.MouseEvent;
+ import java.io.IOException;
+ 
+@@ -67,10 +68,18 @@ private synchronized void postEvent(int event) {
+         var x = peer.surfaceUnitsToJavaUnits((int) currentX);
+         var y = peer.surfaceUnitsToJavaUnits((int) currentY);
+         var actions = WLDataDevice.waylandActionsToJava(currentOffer.getSourceActions());
+-        int dropAction = 0;
++        int dropAction = DnDConstants.ACTION_NONE;
+ 
+         if (hasTarget() && event != MouseEvent.MOUSE_EXITED) {
++            // For intra-JVM transfers, the Wayland-level action negotiation
++            // may fail (no matching MIME types for Java object flavors).
++            // Fall back to the source actions directly.
+             dropAction = WLDataDevice.waylandActionsToJava(currentOffer.getSelectedAction());
++            if (dropAction == DnDConstants.ACTION_NONE
++                    && currentJVMLocalSourceTransferable != null) {
++                dropAction = SunDragSourceContextPeer.convertModifiersToDropAction(
++                        WLToolkit.getInputState().getModifiers(), actions);
++            }
+         }
+ 
+         postDropTargetEvent(
+-- 
+2.52.0
+

gnu/packages/patches/librewolf-150.0-encoding_rs-rust-fix.patch

@@ -1,260 +0,0 @@
-From d8702527f4f1f67f765330f5018bfcb182946c45 Mon Sep 17 00:00:00 2001
-From: Henri Sivonen <hsivonen@hsivonen.fi>
-Date: Tue, 21 Apr 2026 07:09:20 +0000
-Subject: [PATCH] Bug 2033279 - Make --enable-rust-simd work with Rust 1.95.
- r=firefox-build-system-reviewers,supply-chain-reviewers,ahochheiden
-
-Differential Revision: https://phabricator.services.mozilla.com/D295287
----
- .cargo/config.toml.in                         |  5 ++
- Cargo.lock                                    |  4 +-
- Cargo.toml                                    |  2 +
- supply-chain/audits.toml                      |  6 ++
- supply-chain/config.toml                      |  4 ++
- .../rust/encoding_rs/.cargo-checksum.json     |  2 +-
- .../rust/encoding_rs/.cargo_vcs_info.json     |  6 --
- third_party/rust/encoding_rs/Cargo.toml       | 60 ++++++++++---------
- third_party/rust/encoding_rs/Cargo.toml.orig  | 45 --------------
- .../rust/encoding_rs/src/x_user_defined.rs    |  2 +
- 10 files changed, 54 insertions(+), 82 deletions(-)
- delete mode 100644 third_party/rust/encoding_rs/.cargo_vcs_info.json
- delete mode 100644 third_party/rust/encoding_rs/Cargo.toml.orig
-
-diff --git a/.cargo/config.toml.in b/.cargo/config.toml.in
-index 8013ae5435dab..cabdee463415f 100644
---- a/.cargo/config.toml.in
-+++ b/.cargo/config.toml.in
-@@ -55,6 +55,11 @@ git = "https://github.com/hsivonen/any_all_workaround"
- rev = "7fb1b7034c9f172aade21ee1c8554e8d8a48af80"
- replace-with = "vendored-sources"
- 
-+[source."git+https://github.com/hsivonen/encoding_rs?rev=1236d1bc423e6ba35a06485f74a6304db2d703b5"]
-+git = "https://github.com/hsivonen/encoding_rs"
-+rev = "1236d1bc423e6ba35a06485f74a6304db2d703b5"
-+replace-with = "vendored-sources"
-+
- [source."git+https://github.com/hsivonen/rust-harfbuzz?rev=9d58a23a98772a197291d04af93f7041b7093d95"]
- git = "https://github.com/hsivonen/rust-harfbuzz"
- rev = "9d58a23a98772a197291d04af93f7041b7093d95"
-diff --git a/Cargo.lock b/Cargo.lock
-index fea2f95fbb438..63b1f818d7971 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -1914,11 +1914,11 @@ dependencies = [
- [[package]]
- name = "encoding_rs"
- version = "0.8.35"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
-+source = "git+https://github.com/hsivonen/encoding_rs?rev=1236d1bc423e6ba35a06485f74a6304db2d703b5#1236d1bc423e6ba35a06485f74a6304db2d703b5"
- dependencies = [
-  "any_all_workaround",
-  "cfg-if",
-+ "rustversion",
- ]
- 
- [[package]]
-diff --git a/Cargo.toml b/Cargo.toml
-index 49c695809f302..2648c32ae57e8 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -287,6 +287,8 @@ harfbuzz-sys = { git = "https://github.com/hsivonen/rust-harfbuzz", rev = "9d58a
- harfbuzz = { git = "https://github.com/hsivonen/rust-harfbuzz", rev = "9d58a23a98772a197291d04af93f7041b7093d95" }
- # Also vendor `harfbuzz-traits` to keep cargo-vendor happy.
- harfbuzz-traits = { git = "https://github.com/hsivonen/rust-harfbuzz", rev = "9d58a23a98772a197291d04af93f7041b7093d95" }
-+# Make --enable-rust-simd compatible with Rust 1.95
-+encoding_rs = { git = "https://github.com/hsivonen/encoding_rs", rev = "1236d1bc423e6ba35a06485f74a6304db2d703b5" }
- 
- # objc 0.2.7 + fa7ca43b862861dd1cd000d7ad01e6e0266cda13
- objc = { git = "https://github.com/glandium/rust-objc", rev = "4de89f5aa9851ceca4d40e7ac1e2759410c04324" }
-diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
-index 85b4037e03bdb..f4567ea6b6f94 100644
---- a/supply-chain/audits.toml
-+++ b/supply-chain/audits.toml
-@@ -2385,6 +2385,12 @@ who = "Mike Hommey <mh+mozilla@glandium.org>"
- criteria = "safe-to-deploy"
- delta = "0.8.31 -> 0.8.32"
- 
-+[[audits.encoding_rs]]
-+who = "Henri Sivonen <hsivonen@hsivonen.fi>"
-+criteria = "safe-to-deploy"
-+delta = "0.8.35 -> 0.8.35@git:1236d1bc423e6ba35a06485f74a6304db2d703b5"
-+importable = false
-+
- [[audits.enum-map]]
- who = "Kershaw Chang <kershaw@mozilla.com>"
- criteria = "safe-to-deploy"
-diff --git a/supply-chain/config.toml b/supply-chain/config.toml
-index 4cfd83dc2d608..15deefbec0574 100644
---- a/supply-chain/config.toml
-+++ b/supply-chain/config.toml
-@@ -39,6 +39,10 @@ notes = "This is the upstream code not yet released"
- audit-as-crates-io = true
- notes = "This is upstream plus a warning fix from bug 1823866."
- 
-+[policy.encoding_rs]
-+audit-as-crates-io = true
-+notes = "This is upstream plus a build fix for bug 2033279."
-+
- [policy.firefox-on-glean]
- audit-as-crates-io = false
- notes = "The crates.io version of this is just a placeholder to allow public crates to depend on firefox-on-glean."
-diff --git a/third_party/rust/encoding_rs/.cargo_vcs_info.json b/third_party/rust/encoding_rs/.cargo_vcs_info.json
-deleted file mode 100644
-index 6e5d699759e43..0000000000000
---- a/third_party/rust/encoding_rs/.cargo_vcs_info.json
-+++ /dev/null
-@@ -1,6 +0,0 @@
--{
--  "git": {
--    "sha1": "2fa58aecf537cc76ff52c0eb3d5e9f8fda466844"
--  },
--  "path_in_vcs": ""
--}
-\ No newline at end of file
-diff --git a/third_party/rust/encoding_rs/Cargo.toml b/third_party/rust/encoding_rs/Cargo.toml
-index 2adac351c2edf..0239315bab180 100644
---- a/third_party/rust/encoding_rs/Cargo.toml
-+++ b/third_party/rust/encoding_rs/Cargo.toml
-@@ -16,6 +16,7 @@ name = "encoding_rs"
- version = "0.8.35"
- authors = ["Henri Sivonen <hsivonen@hsivonen.fi>"]
- build = false
-+autolib = false
- autobins = false
- autoexamples = false
- autotests = false
-@@ -39,33 +40,6 @@ categories = [
- license = "(Apache-2.0 OR MIT) AND BSD-3-Clause"
- repository = "https://github.com/hsivonen/encoding_rs"
- 
--[profile.release]
--lto = true
--
--[lib]
--name = "encoding_rs"
--path = "src/lib.rs"
--
--[dependencies.any_all_workaround]
--version = "0.1.0"
--optional = true
--
--[dependencies.cfg-if]
--version = "1.0"
--
--[dependencies.serde]
--version = "1.0"
--optional = true
--
--[dev-dependencies.bincode]
--version = "1.0"
--
--[dev-dependencies.serde_derive]
--version = "1.0"
--
--[dev-dependencies.serde_json]
--version = "1.0"
--
- [features]
- alloc = []
- default = ["alloc"]
-@@ -84,4 +58,34 @@ fast-legacy-encode = [
- less-slow-big5-hanzi-encode = []
- less-slow-gb-hanzi-encode = []
- less-slow-kanji-encode = []
--simd-accel = ["any_all_workaround"]
-+simd-accel = [
-+    "any_all_workaround",
-+    "rustversion",
-+]
-+
-+[lib]
-+name = "encoding_rs"
-+path = "src/lib.rs"
-+
-+[dependencies]
-+cfg-if = "1.0"
-+
-+[dependencies.any_all_workaround]
-+version = "0.1.0"
-+optional = true
-+
-+[dependencies.rustversion]
-+version = "1.0.19"
-+optional = true
-+
-+[dependencies.serde]
-+version = "1.0"
-+optional = true
-+
-+[dev-dependencies]
-+bincode = "1.0"
-+serde_derive = "1.0"
-+serde_json = "1.0"
-+
-+[profile.release]
-+lto = true
-diff --git a/third_party/rust/encoding_rs/Cargo.toml.orig b/third_party/rust/encoding_rs/Cargo.toml.orig
-deleted file mode 100644
-index 0f7639d5f879b..0000000000000
---- a/third_party/rust/encoding_rs/Cargo.toml.orig
-+++ /dev/null
-@@ -1,45 +0,0 @@
--[package]
--name = "encoding_rs"
--description = "A Gecko-oriented implementation of the Encoding Standard"
--version = "0.8.35"
--edition = '2018'
--authors = ["Henri Sivonen <hsivonen@hsivonen.fi>"]
--license = "(Apache-2.0 OR MIT) AND BSD-3-Clause"
--readme = "README.md"
--documentation = "https://docs.rs/encoding_rs/"
--homepage = "https://docs.rs/encoding_rs/"
--repository = "https://github.com/hsivonen/encoding_rs"
--keywords = ["encoding", "web", "unicode", "charset"]
--categories = ["text-processing", "encoding", "web-programming", "internationalization"]
--rust-version = "1.36"
--
--[features]
--default = ["alloc"]
--alloc = []
--simd-accel = ["any_all_workaround"]
--less-slow-kanji-encode = []
--less-slow-big5-hanzi-encode = []
--less-slow-gb-hanzi-encode = []
--fast-hangul-encode = []
--fast-hanja-encode = []
--fast-kanji-encode = []
--fast-gb-hanzi-encode = []
--fast-big5-hanzi-encode = []
--fast-legacy-encode = ["fast-hangul-encode",
--                      "fast-hanja-encode",
--                      "fast-kanji-encode",
--                      "fast-gb-hanzi-encode",
--                      "fast-big5-hanzi-encode"]
--
--[dependencies]
--cfg-if = "1.0"
--serde = { version = "1.0", optional = true }
--any_all_workaround = { version = "0.1.0" , optional = true }
--
--[dev-dependencies]
--serde_derive = "1.0"
--bincode = "1.0"
--serde_json = "1.0"
--
--[profile.release]
--lto = true
-diff --git a/third_party/rust/encoding_rs/src/x_user_defined.rs b/third_party/rust/encoding_rs/src/x_user_defined.rs
-index 7af7d5e3d69da..16f1a18d7f6ce 100644
---- a/third_party/rust/encoding_rs/src/x_user_defined.rs
-+++ b/third_party/rust/encoding_rs/src/x_user_defined.rs
-@@ -16,7 +16,8 @@ cfg_if! {
-         use simd_funcs::*;
-         use core::simd::u16x8;
-         use core::simd::cmp::SimdPartialOrd;
-+        #[rustversion::since(1.95)]
-         use core::simd::Select;
- 
-         #[inline(always)]
-         fn shift_upper(unpacked: u16x8) -> u16x8 {

gnu/packages/patches/netbeans-25-nativeexecution-paths.patch

@@ -0,0 +1,73 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Make nativeexecution helper work with Guix
+
+diff -urN orig/ide/dlight.nativeexecution/release/bin/nativeexecution/dorun.sh mod/ide/dlight.nativeexecution/release/bin/nativeexecution/dorun.sh
+--- orig/ide/dlight.nativeexecution/release/bin/nativeexecution/dorun.sh	2026-03-19 00:00:00.000000000 +0000
++++ mod/ide/dlight.nativeexecution/release/bin/nativeexecution/dorun.sh	2026-03-19 00:00:00.000000000 +0000
+@@ -16,8 +16,8 @@
+ # specific language governing permissions and limitations
+ # under the License.
+ 
+-PATH=/bin:/usr/bin
+-PROG=`basename "$0"`
++PATH="${PATH:+$PATH:}/bin:/usr/bin"
++PROG="${0##*/}"
+ USAGE="usage: ${PROG} [-p prompt] -x execScript"
+ PROMPT=NO
+ STATUS=-1
+@@ -43,7 +43,7 @@
+   esac
+ done
+ 
+-shift `expr $OPTIND - 1`
++shift "$((OPTIND - 1))"
+ 
+ trap "doExit" 1 2 15 EXIT
+ 
+diff -urN orig/ide/dlight.nativeexecution/release/bin/nativeexecution/hostinfo.sh mod/ide/dlight.nativeexecution/release/bin/nativeexecution/hostinfo.sh
+--- orig/ide/dlight.nativeexecution/release/bin/nativeexecution/hostinfo.sh	2026-03-19 00:00:00.000000000 +0000
++++ mod/ide/dlight.nativeexecution/release/bin/nativeexecution/hostinfo.sh	2026-03-19 00:00:00.000000000 +0000
+@@ -16,13 +16,13 @@
+ # specific language governing permissions and limitations
+ # under the License.
+ 
+-PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
++PATH="${PATH:+$PATH:}/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin"
+ HOSTNAME=`uname -n`
+ OS=`uname -s`
+ CPUTYPE=`uname -p`
+ BITNESS=32
+ 
+-LS=/bin/ls
++LS=ls
+ OSFAMILY=
+ DATETIME=`date -u +'%Y-%m-%d %H:%M:%S'`
+ 
+@@ -139,7 +139,7 @@
+         echo "Warning: TMPDIRBASE is not writable: ${TMPDIRBASE}">&2
+         SUFFIX=`expr 1 + ${SUFFIX}`
+         TMPDIRBASE=${TMPBASE}/dlight_${USER_D}_${SUFFIX}
+-        /bin/mkdir -p ${TMPDIRBASE} 2>/dev/null
++        mkdir -p ${TMPDIRBASE} 2>/dev/null
+     else
+         break
+     fi
+@@ -157,7 +157,7 @@
+             echo "Warning: TMPDIRBASE is not writable: ${TMPDIRBASE}">&2
+             SUFFIX=`expr 1 + ${SUFFIX}`
+             TMPDIRBASE=${TMPBASE}/${NB_KEY}_${SUFFIX}
+-            /bin/mkdir -p ${TMPDIRBASE} 2>/dev/null
++            mkdir -p ${TMPDIRBASE} 2>/dev/null
+         else
+             break
+         fi
+@@ -174,7 +174,7 @@
+ 
+ ENVFILE="${TMPDIRBASE}/env"
+ 
+-ID=`LC_MESSAGES=C /usr/bin/id`
++ID=`LC_MESSAGES=C id`
+ 
+ echo BITNESS=${BITNESS}
+ echo CPUFAMILY=${CPUFAMILY}

gnu/packages/patches/netbeans-25-source-only-build.patch

@@ -0,0 +1,95 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Disable build-time (test-time) downloaders.
+
+diff -urN orig/harness/apisupport.harness/build.xml mod/harness/apisupport.harness/build.xml
+--- orig/harness/apisupport.harness/build.xml	2026-03-17 23:30:32.335913224 +0000
++++ mod/harness/apisupport.harness/build.xml	2026-03-17 23:30:51.503442261 +0000
+@@ -33,19 +33,6 @@
+             <zipfileset file="taskdefs.properties" fullpath="org/netbeans/nbbuild/taskdefs.properties"/>
+         </nb-ext-jar>
+         
+-        <!-- verify that the DownloadBinaries task is properly functional -->
+-        <taskdef name="TestDownload" classname="org.netbeans.nbbuild.extlibs.DownloadBinaries">
+-            <classpath>
+-                <pathelement location="${cluster}/tasks.jar"></pathelement>
+-            </classpath>
+-        </taskdef>
+-        <echo file="build/binaries-list">F0ED132A49244B042CD0E15702AB9F2CE3CC8436 org.ow2.asm:asm:9.7.1</echo>
+-        <TestDownload>
+-            <manifest dir="build">
+-                <include name="binaries-list"/>
+-            </manifest>
+-        </TestDownload>
+-        <delete file="build/asm-9.7.1.jar"/>
+     </target>
+ 
+     <target name="compile-jnlp-launcher" depends="init,compile">
+diff -urN orig/nbbuild/antsrc/org/netbeans/nbbuild/ModuleListParser.java mod/nbbuild/antsrc/org/netbeans/nbbuild/ModuleListParser.java
+--- orig/nbbuild/antsrc/org/netbeans/nbbuild/ModuleListParser.java	2026-03-18 07:25:25.497125691 +0000
++++ mod/nbbuild/antsrc/org/netbeans/nbbuild/ModuleListParser.java	2026-03-18 07:25:35.587014287 +0000
+@@ -467,6 +467,9 @@
+                 if (testtype == null) {
+                     throw new IOException("Must declare <name>unit</name> (e.g.) in <test-type> in " + projectxml);
+                 }
++                if (Boolean.parseBoolean((String) properties.get("disable." + testtype + ".tests"))) {
++                    continue;
++                }
+                 List<String> compileDepsList = new ArrayList<>();
+                 for (Element dep : XMLUtil.findSubElements(depssEl)) {
+                     if (dep.getTagName().equals("test-dependency")) {
+diff -urN orig/nbbuild/antsrc/org/netbeans/nbbuild/ParseProjectXml.java mod/nbbuild/antsrc/org/netbeans/nbbuild/ParseProjectXml.java
+--- orig/nbbuild/antsrc/org/netbeans/nbbuild/ParseProjectXml.java	2026-03-17 23:30:32.338404995 +0000
++++ mod/nbbuild/antsrc/org/netbeans/nbbuild/ParseProjectXml.java	2026-03-18 07:16:44.662227912 +0000
+@@ -1574,6 +1574,9 @@
+                 } else if (testType.equals(TestDeps.QA_FUNCTIONAL)) {
+                     existsQaFunctionalTests = true;
+                 }
++                if (Boolean.parseBoolean(getProject().getProperty("disable." + testType + ".tests"))) {
++                    continue;
++                }
+                 TestDeps testDeps = new TestDeps(testType,testCnb,modules);
+                 testDepsList.add(testDeps);
+                 for (Element el : XMLUtil.findSubElements(depssEl)) {
+@@ -1619,6 +1622,9 @@
+             if (testDeps.fullySpecified) {
+                 continue;
+             }
++            if (Boolean.parseBoolean(getProject().getProperty("disable." + testDeps.testtype + ".tests"))) {
++                continue;
++            }
+             if (new File(moduleProject, "test/" + testDeps.testtype + "/src").isDirectory()) {
+                 log("Warning: " + testCnb + " lacks a " + testDeps.testtype +
+                         " test dependency on org.netbeans.libs.junit4; using default dependencies for compatibility", Project.MSG_WARN);
+diff -urN orig/nbbuild/build.xml mod/nbbuild/build.xml
+--- orig/nbbuild/build.xml	2026-03-17 23:30:32.340737929 +0000
++++ mod/nbbuild/build.xml	2026-03-17 23:30:51.503442261 +0000
+@@ -101,6 +101,8 @@
+     </path>
+     <javac srcdir="antsrc" destdir="${build.ant.classes.dir}" deprecation="true" debug="${build.compiler.debug}" source="1.8" target="1.8">
+       <classpath refid="bootstrap-cp"/>
++      <exclude name="org/netbeans/nbbuild/CheckHelpSets.java"/>
++      <exclude name="org/netbeans/nbbuild/CheckHelpSetsBin.java"/>
+       <compilerarg line="-Xlint -Xlint:-serial"/>
+     </javac>
+     <jar jarfile="${nbantext.jar}">
+@@ -461,18 +463,7 @@
+     </fixcrlf>
+   </target>
+   
+-  <target name="-download-nb-windows-launchers" depends="init,-check-nb-cluster" if="has.nb.cluster">
+-    <downloadbinaries cache="${binaries.cache}" server="${binaries.server}" repos="${binaries.repos}">
+-        <manifest dir="${nb_all}" includes="nb/ide.launcher/external/binaries-list"/>
+-    </downloadbinaries>
+-
+-    <mkdir dir="${netbeans.dest.dir}/bin" />
+-    <unzip src="../nb/ide.launcher/external/launcher-external-binaries-2-6c17cc6.zip" dest="${netbeans.dest.dir}/bin">
+-        <patternset>
+-            <include name="netbeans*.exe"/>
+-        </patternset>
+-    </unzip>
+-  </target>
++  <target name="-download-nb-windows-launchers" depends="init,-check-nb-cluster" if="has.nb.cluster"/>
+ 
+   <target name="finish-build-nb" depends="init,-check-nb-cluster,-download-nb-windows-launchers,-load-module-flags" if="has.nb.cluster">
+     <loadproperties srcFile="${clusters.list.file}" />

gnu/packages/patches/netbeans-25-terminal-no-login-shell.patch

@@ -0,0 +1,17 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Remove forced login shell
+
+diff -urN orig/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java mod/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java
+--- orig/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java	2026-03-19 00:00:00.000000000 +0000
++++ mod/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java	2026-03-19 00:00:00.000000000 +0000
+@@ -320,9 +320,6 @@
+                         }
+ //                            npb.setWorkingDirectory("${HOME}");
+                         npb.setExecutable(shell);
+-                        if (shell.endsWith("bash") || shell.endsWith("bash.exe")) { // NOI18N
+-                            npb.setArguments("--login"); // NOI18N
+-                        }
+                         
+                         NativeExecutionDescriptor descr;
+                         descr = new NativeExecutionDescriptor().controllable(true).frontWindow(true).inputVisible(true).inputOutput(ioRef.get());

gnu/packages/patches/netbeans-25-wayland-font-rendering.patch

@@ -0,0 +1,94 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Add font hints (for Wayland).
+
+--- a/platform/o.n.swing.plaf/src/org/netbeans/swing/plaf/Startup.java	2026-03-20 03:13:28.788555561 +0000
++++ b/platform/o.n.swing.plaf/src/org/netbeans/swing/plaf/Startup.java	2026-03-20 03:15:03.827463921 +0000
+@@ -19,6 +19,7 @@
+ 
+ package org.netbeans.swing.plaf;
+ 
++import java.awt.RenderingHints;
+ import java.awt.Toolkit;
+ import java.util.logging.Logger;
+ import org.netbeans.swing.plaf.aqua.AquaLFCustoms;
+@@ -228,6 +229,20 @@
+         installPerLFDefaults();
+         installTheme(UIManager.getLookAndFeel());
+ 
++        // WLToolkit (JBR's native Wayland backend) does not provide font
++        // rendering hints via awt.font.desktophints, so Swing components
++        // render text without antialiasing.  Set LCD subpixel hints in
++        // UIManager so JComponent.setUI() picks them up.
++        if (System.getenv("WAYLAND_DISPLAY") != null
++                && Toolkit.getDefaultToolkit().getDesktopProperty(
++                       "awt.font.desktophints") == null) {
++            UIManager.getDefaults().put(
++                RenderingHints.KEY_TEXT_ANTIALIASING,
++                RenderingHints.VALUE_TEXT_ANTIALIAS_LCD_HBGR);
++            UIManager.getDefaults().put(
++                RenderingHints.KEY_TEXT_LCD_CONTRAST, 140);
++        }
++
+         runPostInstall();
+ 
+         attachListener();
+
+--- a/platform/openide.awt/src/org/openide/awt/GraphicsUtils.java	2026-03-20 03:13:28.792998877 +0000
++++ b/platform/openide.awt/src/org/openide/awt/GraphicsUtils.java	2026-03-20 03:16:15.622974599 +0000
+@@ -37,7 +37,8 @@
+         Boolean.getBoolean("nb.cellrenderer.antialiasing") // NOI18N
+          ||Boolean.getBoolean("swing.aatext") // NOI18N
+          ||(isGTK() && gtkShouldAntialias()) // NOI18N
+-         || isAqua();
++         || isAqua()
++         || isWayland();
+     private static Boolean gtkAA;
+     private static Map<Object,Object> hintsMap;
+ 
+@@ -49,6 +50,10 @@
+         return "GTK".equals(UIManager.getLookAndFeel().getID());
+     }
+ 
++    private static boolean isWayland() {
++        return System.getenv("WAYLAND_DISPLAY") != null;
++    }
++
+     private static final boolean gtkShouldAntialias() {
+         if (gtkAA == null) {
+             Object o = Toolkit.getDefaultToolkit().getDesktopProperty("gnome.Xft/Antialias"); //NOI18N
+@@ -84,7 +89,14 @@
+             if (ret == null) {
+                 ret = new HashMap<Object,Object>();
+                 if (antialias) {
+-                    ret.put(RenderingHints.KEY_TEXT_ANTIALIASING, RenderingHints.VALUE_TEXT_ANTIALIAS_ON);
++                    if (isWayland()) {
++                        ret.put(RenderingHints.KEY_TEXT_ANTIALIASING,
++                                RenderingHints.VALUE_TEXT_ANTIALIAS_LCD_HBGR);
++                        ret.put(RenderingHints.KEY_TEXT_LCD_CONTRAST, 140);
++                    } else {
++                        ret.put(RenderingHints.KEY_TEXT_ANTIALIASING,
++                                RenderingHints.VALUE_TEXT_ANTIALIAS_ON);
++                    }
+                 }
+             }
+             if (antialias ||
+
+--- a/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java	2026-03-20 03:01:46.421416137 +0000
++++ b/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java	2026-03-20 03:02:11.284626650 +0000
+@@ -266,6 +266,15 @@
+                         //
+                         term.setEmulation("xterm"); // NOI18N
+ 
++                        // WLToolkit (Wayland) doesn't provide desktop font hints,
++                        // so term.drawGlyphVector() renders without antialiasing.
++                        // Set LCD subpixel hints explicitly.
++                        java.util.Map<java.awt.RenderingHints.Key, Object> fontHints = new java.util.HashMap<>();
++                        fontHints.put(java.awt.RenderingHints.KEY_TEXT_ANTIALIASING,
++                                      java.awt.RenderingHints.VALUE_TEXT_ANTIALIAS_LCD_HBGR);
++                        fontHints.put(java.awt.RenderingHints.KEY_TEXT_LCD_CONTRAST, 140);
++                        term.setRenderingHints(fontHints);
++
+                         NativeProcessBuilder npb = NativeProcessBuilder.newProcessBuilder(env);
+                         // clear env modified by NB. Let it be initialized by started shell process
+                         npb.getEnvironment().put("LD_LIBRARY_PATH", "");// NOI18N

gnu/packages/patches/php-01-fix-expired-certificate.patch

@@ -0,0 +1,773 @@
+From 0f38bfdef2d9e5ccbb266658b29bd576e36ed8a8 Mon Sep 17 00:00:00 2001
+From: Jakub Zelenka <bukka@php.net>
+Date: Fri, 3 Apr 2026 21:49:54 +0200
+Subject: [PATCH] Fix GH-21617: sni_server self signed certifcate expired
+
+It changes the SNI tests to use certificate generator like other TLS
+tests.
+
+Closes GH-21628
+
+Upstream-Status: Merged in master.
+---
+ ext/openssl/tests/gh9310.phpt                 | 59 +++++++++++------
+ .../openssl_x509_checkpurpose_basic.phpt      |  2 +-
+ .../openssl_x509_export_to_file_leak.phpt     |  2 +-
+ .../{sni_server_uk.pem => sni_server.pem}     |  0
+ ext/openssl/tests/sni_server.phpt             | 29 +++++++--
+ ext/openssl/tests/sni_server_ca.pem           | 63 -------------------
+ ext/openssl/tests/sni_server_cs.pem           | 57 -----------------
+ ext/openssl/tests/sni_server_cs_cert.pem      | 30 ---------
+ ext/openssl/tests/sni_server_cs_key.pem       | 27 --------
+ ext/openssl/tests/sni_server_key_cert.phpt    | 45 ++++++++++---
+ ext/openssl/tests/sni_server_uk_cert.pem      | 30 ---------
+ ext/openssl/tests/sni_server_uk_key.pem       | 27 --------
+ ext/openssl/tests/sni_server_us.pem           | 57 -----------------
+ ext/openssl/tests/sni_server_us_cert.pem      | 30 ---------
+ ext/openssl/tests/sni_server_us_key.pem       | 27 --------
+ 15 files changed, 106 insertions(+), 379 deletions(-)
+ rename ext/openssl/tests/{sni_server_uk.pem => sni_server.pem} (100%)
+ delete mode 100644 ext/openssl/tests/sni_server_ca.pem
+ delete mode 100644 ext/openssl/tests/sni_server_cs.pem
+ delete mode 100644 ext/openssl/tests/sni_server_cs_cert.pem
+ delete mode 100644 ext/openssl/tests/sni_server_cs_key.pem
+ delete mode 100644 ext/openssl/tests/sni_server_uk_cert.pem
+ delete mode 100644 ext/openssl/tests/sni_server_uk_key.pem
+ delete mode 100644 ext/openssl/tests/sni_server_us.pem
+ delete mode 100644 ext/openssl/tests/sni_server_us_cert.pem
+ delete mode 100644 ext/openssl/tests/sni_server_us_key.pem
+
+diff --git a/ext/openssl/tests/gh9310.phpt b/ext/openssl/tests/gh9310.phpt
+index 07a7d442cec..874ed4c781d 100644
+--- a/ext/openssl/tests/gh9310.phpt
++++ b/ext/openssl/tests/gh9310.phpt
+@@ -23,7 +23,21 @@
+ 
+ copy($certFile, $baseDirCertFile);
+ copy($pkFile, $baseDirPkFile);
+-copy(__DIR__ . '/sni_server_uk_cert.pem', $baseDir . '/sni_server_uk_cert.pem');
++
++$sniCaFile = __DIR__ . '/gh9310_sni_ca.pem.tmp';
++$sniCsFile = __DIR__ . '/gh9310_sni_cs.pem.tmp';
++$sniUkCertFile = __DIR__ . '/gh9310_sni_uk_cert.pem.tmp';
++$sniUkKeyFile = __DIR__ . '/gh9310_sni_uk_key.pem.tmp';
++$sniUsCertFile = __DIR__ . '/gh9310_sni_us_cert.pem.tmp';
++$sniUsKeyFile = __DIR__ . '/gh9310_sni_us_key.pem.tmp';
++$baseDirSniUkCertFile = $baseDir . '/sni_uk_cert.pem';
++
++$certificateGenerator->saveCaCert($sniCaFile);
++$certificateGenerator->saveNewCertAsFileWithKey('cs.php.net', $sniCsFile);
++$certificateGenerator->saveNewCertAndKey('uk.php.net', $sniUkCertFile, $sniUkKeyFile);
++$certificateGenerator->saveNewCertAndKey('us.php.net', $sniUsCertFile, $sniUsKeyFile);
++
++copy($sniUkCertFile, $baseDirSniUkCertFile);
+ 
+ 
+ $serverCodeTemplate = <<<'CODE'
+@@ -60,7 +74,7 @@
+     $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+-            "cs.php.net" => __DIR__ . "/sni_server_cs.pem",
++            "cs.php.net" => '%s',
+         ]
+     ]]);
+ 
+@@ -69,6 +83,7 @@
+ 
+     stream_socket_accept($server);
+ CODE;
++$sniServerCodeV1 = sprintf($sniServerCodeV1, $sniCsFile);
+ 
+ $sniServerCodeV2 = <<<'CODE'
+     ini_set('log_errors', 'On');
+@@ -77,8 +92,8 @@
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+             "uk.php.net" => [
+-                'local_cert' => __DIR__ . '/gh9310/sni_server_uk_cert.pem',
+-                'local_pk' => __DIR__ . '/sni_server_uk_key.pem',
++                'local_cert' => '%s',
++                'local_pk' => '%s',
+             ]
+         ]
+     ]]);
+@@ -88,6 +103,7 @@
+ 
+     stream_socket_accept($server);
+ CODE;
++$sniServerCodeV2 = sprintf($sniServerCodeV2, $baseDirSniUkCertFile, $sniUkKeyFile);
+ 
+ $sniServerCodeV3 = <<<'CODE'
+     ini_set('log_errors', 'On');
+@@ -96,8 +112,8 @@
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+             "us.php.net" => [
+-                'local_cert' => __DIR__ . '/sni_server_us_cert.pem',
+-                'local_pk' => __DIR__ . '/sni_server_us_key.pem',
++                'local_cert' => '%s',
++                'local_pk' => '%s',
+             ]
+         ]
+     ]]);
+@@ -107,14 +123,15 @@
+ 
+     stream_socket_accept($server);
+ CODE;
++$sniServerCodeV3 = sprintf($sniServerCodeV3, $sniUsCertFile, $sniUsKeyFile);
+ 
+ $sniClientCodeTemplate = <<<'CODE'
+     $flags = STREAM_CLIENT_CONNECT;
+     $ctxArr = [
+-        'cafile' => __DIR__ . '/sni_server_ca.pem',
++        'cafile' => '%s',
++        'peer_name' => '%s',
+     ];
+ 
+-    $ctxArr['peer_name'] = '%s';
+     $ctx = stream_context_create(['ssl' => $ctxArr]);
+     @stream_socket_client("tls://{{ ADDR }}", $errno, $errstr, 1, $flags, $ctx);
+ CODE;
+@@ -131,13 +148,13 @@
+ $serverCode = sprintf($serverCodeTemplate, $baseDirCertFile, $pkFile);
+ ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+ 
+-$sniClientCode = sprintf($sniClientCodeTemplate, 'cs.php.net');
++$sniClientCode = sprintf($sniClientCodeTemplate, $sniCaFile, 'cs.php.net');
+ ServerClientTestCase::getInstance()->run($sniClientCode, $sniServerCodeV1);
+ 
+-$sniClientCode = sprintf($sniClientCodeTemplate, 'uk.php.net');
++$sniClientCode = sprintf($sniClientCodeTemplate, $sniCaFile, 'uk.php.net');
+ ServerClientTestCase::getInstance()->run($sniClientCode, $sniServerCodeV2);
+ 
+-$sniClientCode = sprintf($sniClientCodeTemplate, 'us.php.net');
++$sniClientCode = sprintf($sniClientCodeTemplate, $sniCaFile, 'us.php.net');
+ ServerClientTestCase::getInstance()->run($sniClientCode, $sniServerCodeV3);
+ 
+ ?>
+@@ -149,7 +166,13 @@
+ @unlink(__DIR__ . '/gh9310.key');
+ @unlink($baseDir . '/cert.crt');
+ @unlink($baseDir . '/private.key');
+-@unlink($baseDir . '/sni_server_uk_cert.pem');
++@unlink($baseDir . '/sni_uk_cert.pem');
++@unlink(__DIR__ . '/gh9310_sni_ca.pem.tmp');
++@unlink(__DIR__ . '/gh9310_sni_cs.pem.tmp');
++@unlink(__DIR__ . '/gh9310_sni_uk_cert.pem.tmp');
++@unlink(__DIR__ . '/gh9310_sni_uk_key.pem.tmp');
++@unlink(__DIR__ . '/gh9310_sni_us_cert.pem.tmp');
++@unlink(__DIR__ . '/gh9310_sni_us_key.pem.tmp');
+ @rmdir($baseDir);
+ ?>
+ --EXPECTF--
+@@ -169,15 +192,15 @@
+ PHP Warning:  stream_socket_accept(): Unable to get real path of private key file `%sgh9310.key' in %s
+ PHP Warning:  stream_socket_accept(): Failed to enable crypto in %s
+ PHP Warning:  stream_socket_accept(): Accept failed: %s
+-PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%ssni_server_cs.pem) is not within the allowed path(s): (%sgh9310) in %s
+-PHP Warning:  stream_socket_accept(): Failed setting local cert chain file `%ssni_server_cs.pem'; file not found in %s
++PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%sgh9310_sni_cs.pem.tmp) is not within the allowed path(s): (%sgh9310) in %s
++PHP Warning:  stream_socket_accept(): Failed setting local cert chain file `%sgh9310_sni_cs.pem.tmp'; file not found in %s
+ PHP Warning:  stream_socket_accept(): Failed to enable crypto in %s
+ PHP Warning:  stream_socket_accept(): Accept failed: %s
+-PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%ssni_server_uk_key.pem) is not within the allowed path(s): (%sgh9310) in %s
+-PHP Warning:  stream_socket_accept(): Failed setting local private key file `%ssni_server_uk_key.pem';  could not open file in %s
++PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%sgh9310_sni_uk_key.pem.tmp) is not within the allowed path(s): (%sgh9310) in %s
++PHP Warning:  stream_socket_accept(): Failed setting local private key file `%sgh9310_sni_uk_key.pem.tmp';  could not open file in %s
+ PHP Warning:  stream_socket_accept(): Failed to enable crypto in %s
+ PHP Warning:  stream_socket_accept(): Accept failed: %s
+-PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%ssni_server_us_cert.pem) is not within the allowed path(s): (%sgh9310) in %s
+-PHP Warning:  stream_socket_accept(): Failed setting local cert chain file `%ssni_server_us_cert.pem'; could not open file in %s
++PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%sgh9310_sni_us_cert.pem.tmp) is not within the allowed path(s): (%sgh9310) in %s
++PHP Warning:  stream_socket_accept(): Failed setting local cert chain file `%sgh9310_sni_us_cert.pem.tmp'; could not open file in %s
+ PHP Warning:  stream_socket_accept(): Failed to enable crypto in %s
+ PHP Warning:  stream_socket_accept(): Accept failed: %s
+diff --git a/ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt b/ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt
+index d09317b1d22..c1dba964bc6 100644
+--- a/ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt
++++ b/ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt
+@@ -17,7 +17,7 @@
+ $bert = "file://" . __DIR__ . "/bug41033.pem";
+ $sert = "file://" . __DIR__ . "/san-cert.pem";
+ $cpca = __DIR__ . "/san-cert.pem";
+-$utfl = __DIR__ . "/sni_server_uk.pem";
++$utfl = __DIR__ . "/sni_server.pem";
+ $rcrt = openssl_x509_read($cert);
+ 
+ /*  int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose);   */
+diff --git a/ext/openssl/tests/openssl_x509_export_to_file_leak.phpt b/ext/openssl/tests/openssl_x509_export_to_file_leak.phpt
+index 5775c2597c3..59a942d6a67 100644
+--- a/ext/openssl/tests/openssl_x509_export_to_file_leak.phpt
++++ b/ext/openssl/tests/openssl_x509_export_to_file_leak.phpt
+@@ -5,7 +5,7 @@
+ --FILE--
+ <?php
+ 
+-$path = "file://" . __DIR__ . "/sni_server_ca.pem";
++$path = "file://" . __DIR__ . "/cert.crt";
+ var_dump(openssl_x509_export_to_file($path, str_repeat("a", 10000)));
+ 
+ ?>
+diff --git a/ext/openssl/tests/sni_server_uk.pem b/ext/openssl/tests/sni_server.pem
+similarity index 100%
+rename from ext/openssl/tests/sni_server_uk.pem
+rename to ext/openssl/tests/sni_server.pem
+diff --git a/ext/openssl/tests/sni_server.phpt b/ext/openssl/tests/sni_server.phpt
+index 7f9a4e82872..db0b0190dab 100644
+--- a/ext/openssl/tests/sni_server.phpt
++++ b/ext/openssl/tests/sni_server.phpt
+@@ -8,13 +8,25 @@
+ ?>
+ --FILE--
+ <?php
++$caFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_ca.pem.tmp';
++$csFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs.pem.tmp';
++$ukFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk.pem.tmp';
++$usFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us.pem.tmp';
++
++include 'CertificateGenerator.inc';
++$certificateGenerator = new CertificateGenerator();
++$certificateGenerator->saveCaCert($caFile);
++$certificateGenerator->saveNewCertAsFileWithKey('cs.php.net', $csFile);
++$certificateGenerator->saveNewCertAsFileWithKey('uk.php.net', $ukFile);
++$certificateGenerator->saveNewCertAsFileWithKey('us.php.net', $usFile);
++
+ $serverCode = <<<'CODE'
+     $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+-            "cs.php.net" => __DIR__ . "/sni_server_cs.pem",
+-            "uk.php.net" => __DIR__ . "/sni_server_uk.pem",
+-            "us.php.net" => __DIR__ . "/sni_server_us.pem"
++            "cs.php.net" => '%s',
++            "uk.php.net" => '%s',
++            "us.php.net" => '%s',
+         ]
+     ]]);
+ 
+@@ -25,11 +37,12 @@
+         @stream_socket_accept($server, 3);
+     }
+ CODE;
++$serverCode = sprintf($serverCode, $csFile, $ukFile, $usFile);
+ 
+ $clientCode = <<<'CODE'
+     $flags = STREAM_CLIENT_CONNECT;
+     $ctxArr = [
+-        'cafile' => __DIR__ . '/sni_server_ca.pem',
++        'cafile' => '%s',
+         'capture_peer_cert' => true
+     ];
+ 
+@@ -51,10 +64,18 @@
+     $cert = stream_context_get_options($ctx)['ssl']['peer_certificate'];
+     var_dump(openssl_x509_parse($cert)['subject']['CN']);
+ CODE;
++$clientCode = sprintf($clientCode, $caFile);
+ 
+ include 'ServerClientTestCase.inc';
+ ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+ ?>
++--CLEAN--
++<?php
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_ca.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us.pem.tmp');
++?>
+ --EXPECTF--
+ string(%d) "cs.php.net"
+ string(%d) "uk.php.net"
+diff --git a/ext/openssl/tests/sni_server_ca.pem b/ext/openssl/tests/sni_server_ca.pem
+deleted file mode 100644
+index b2522884565..00000000000
+--- a/ext/openssl/tests/sni_server_ca.pem
++++ /dev/null
+@@ -1,63 +0,0 @@
+------BEGIN CERTIFICATE-----
+-MIIFejCCA2KgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwQzELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAMMB3Bo
+-cC5uZXQwHhcNMTcxMTIyMTQyODIzWhcNMjcxMTIwMTQyODIzWjBVMQswCQYDVQQG
+-EwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwHUEhQLm5ldDEQMA4GA1UE
+-CwwHb3BlbnNzbDEQMA4GA1UEAwwHcGhwLm5ldDCCAiIwDQYJKoZIhvcNAQEBBQAD
+-ggIPADCCAgoCggIBAMeENPus84HfIaypUVybbn5ZZyu1gXSYZAnDYYHhOlHu5kFh
+-26ohnHnoheapXVRbUtDZgUW5BztA+vDhKkM5G3U4p+YsqcSA/IkF2JQBkJH1jrxs
+-XMDtXIA4/MzYAVtyySqoMsrbkSCDzvI8imsbZI9O1x02VgaqoaQ9JZvglt1nhTIY
+-YpTbTKGCzMmrnFGHITeBsVose1ACFIAtqKqvUaA6TxcCtVcrENY3T3N/vEmoHHBg
+-O7j9+UvYN/WRPNcv0aIOlro83O9xQuJdRCygPmcv/jkqWRKm2Pu0lEkvbMCvOJr/
+-Fz/kQg/6EVmIMsR/dgOMIjWjmpeTx24UJaNHUdNCeUbxIyTIyl9ISLWLM0Ipoq3L
+-95ygH6FSESAOpc8rVE2A5YZCtKlwvogMx3C/tMH1gWwMlfxn0CopP4Jx6lngw3yn
+-IpP0hnuCauQikBkyhsGu4J0Lbx5BsyDWQLwjiq4s8EcEy0vTdAvhDMRUGvpnjWaa
+-zBDVVrzHaRFvp6ueh35xf+dYieGL5UTICyrrQX9wwSafHV90a87y6XU+RwA25Dmc
+-V/kTn8/xkFv/4CbZp+0yArKpwXjqBMsQFbkFjT+Ky9MN+nedoFUMl7slgjpBs6RI
+-T08Hoa7/kMZGtLCiGcRXlwiIhB00gDz2avUvFTxwik9ssjDqBJGzNbBvZGb/AgMB
+-AAGjZjBkMB0GA1UdDgQWBBTjyuOBGnHnb+x20diIHG3sPuJFGjAfBgNVHSMEGDAW
+-gBQ0s99BNsV4Dszph6PArogA8HP4TDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1Ud
+-DwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAFrQMmCoSe8uJbJLqPGMPW4ZE
+-0U81WWboc9FrSfezBYkTKuCjMTjQFv8oLp4pnuWZw22mHrOiz9izjNnXcR/rdVbG
+-Cip/JSHlTzHd3gnxSSd2diXvVrSb4zuLyN6WIficlsj3QdIP4Cdfv1pdHBTsRPbW
+-vuHpwYqqjxPBjqvoVZyZRyRM1pqpxLCvxOt4S3z4uZXyIH2UI7yWxI6MvdHBZg5m
+-TwiVi1gEQuRnYRy4sK9qJlBo5jERvzDr46W1e9Yz5sNMPfwWb64Hkkys3GqJt5am
+-OKxvgF3lvIK90vBjenGDfYEENP+0qdmdpHQkxGM2cl9iPqW8iyRGBVjdbzTIeRgB
+-u+CEbffSKWCpbm1Zcszv3FHMlsU4Px2pUTdLwEMgBQUPW/ngBMdRgVZE01GI7D1k
+-AM3hO347eehQTWoyuHgsnB2uaANEeR/XFBGDFmbs5ggAzxxRsH1FxoHXrv3iDIPW
+-9lKnSow+OZGcPKgaY5Nsregt4jO+pQqhzxlMa2QMfrMoGkEvrKNcDqeEI6KQa1SI
+-Zbq7sjf2w+VL0oQcse+gtg4q771dKy9V/XcfnPbiBAXfQqGj/v0LmZRn3ZRrkgzl
+-CaZocqVRJZbqu7/iu/p9pDRMR03vhBWPn7iM8VqzkhKjAlD0rolnQqvOAXyPpd/O
+-qYuYP+6Ymt/rUWXGVh0=
+------END CERTIFICATE-----
+------BEGIN CERTIFICATE-----
+-MIIFbDCCA1SgAwIBAgIJAJcrLHeFQrGEMA0GCSqGSIb3DQEBCwUAMEMxCzAJBgNV
+-BAYTAkdCMRAwDgYDVQQIDAdFbmdsYW5kMRAwDgYDVQQKDAdQSFAubmV0MRAwDgYD
+-VQQDDAdwaHAubmV0MB4XDTE3MTExNTE5MTEwMVoXDTM4MDUyOTE5MTEwMVowQzEL
+-MAkGA1UEBhMCR0IxEDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQx
+-EDAOBgNVBAMMB3BocC5uZXQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
+-AQC4bIXbh+e+OCbLum2FYB8i6ZnOShp1teWNEE/8A4ot20wkPxLeXFSU1Egn+3BG
+-fxHKrWxV/FOiL7bims/SfwptFkgNZkwE52HVk49zgQevG38smsnIGuBMXMKebLPT
+-wlsIWRqCmZqEmh1wNcC9+qwoHoYjvJvMYfFvofiSc7qkTFsjoBVe+ho90vjYMznr
+-Bs9DlD88iXO0kKN0Bsu2igz68JWkUsoNeD6UKSir16SmQZxdFPCM0O0gxmOyz4NZ
+-w8pJ5XGDJyS82fVp13tYCOBFhK0QBvvzaz/gN6De5arefm6cer9TX0HE+VvGhx4T
+-2lqydFLfAVKTTNoZHOQk2mFVUm7dlMzLvsgNKdEZH6wAa12eBImCea+CyJNkbGLC
+-nrN6a93iGqTft75sbDyvzRk/BdnxadkAPlOxgK1qGrOgeS0+7chPMh24MRoKj5bU
+-lYGdcp7Y9qIW1hZXFfgPJO0yMOug/7J14jybp+YhymBIBTZYi1zbGqGNXdLPyp77
+-9KTfyJE9KkbGegBvwqJmZTW8QoUDllopDjr1zaIqHWJqfAK7vGivu0iLVJHBRbRs
+-w9c48RCjfIh7AkvFKsdIDt9SMdZOdm9D8SXosYPM1zMFQsFFRPh/nKyl9QnhWbwd
+-Vs1tIFDrb10Z2sn0pF/V0F0gubR5rvYs+3h/dLciLVFobQIDAQABo2MwYTAdBgNV
+-HQ4EFgQUNLPfQTbFeA7M6YejwK6IAPBz+EwwHwYDVR0jBBgwFoAUNLPfQTbFeA7M
+-6YejwK6IAPBz+EwwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJ
+-KoZIhvcNAQELBQADggIBAIkctDRCNcNVs2qP/O3zZsVZ1cqlqYNjcHIVHqNZRvVb
+-bPtInZ/i/6BbwA5QM/giKpl2aMwetUnezjHVD+7/m24Mfs1FWyPD3joCMIANj7hR
+-MNbmX1LQBMt/bD3E5trq9S9rZ++/ny4gn/z2jH3x+lzDMBDiam/wXbvSmyIUPUX6
+-V8FFpkTBNERpurUvX1NEFLuiilWKrI7/u1qS11PGBcX3pNQNfhKNMtuFz74hAE7C
+-RE8756CGu2bZzydYCarUXSNTXqNm5ly2J0UN6Al4myFwj/6XnLnDhXDAI8CaqDMD
+-MwmxUzJvzuphNS085ZIntrSgPJESGozevEsf9bGD8GyoBQN/cSqOJCFfnJqxtKHb
+-wNa2F78SXYsiWkRb5EzoyCeon+0tygG6gLBouVY8ouCerExkH9qzRLLzFInxmCm2
+-ill7c8Xmml4H2BxJE33dz/Qh7PM3eF2A2VriioLDj4+HOiWq/1BjdW6/Xiwx5iP2
+-nC6Cex+lBt6HkP9WIiJbGxVeamF5jxNWWvLoUkrjFhpukjb5BPR9zFt7mAty9J/T
+-iQt26yylP4ucmL9KB6lv4ISW4Ri8mhMcYh6nF3tIYWZMCSQKqkyvymhKdLMZa20A
+-IME2oxnfZcmsfMpM6BYsN4XDfGBeYctqqt2AFRNLkI4wFkFFdPTMcTi1q0iRH2Xk
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_cs.pem b/ext/openssl/tests/sni_server_cs.pem
+deleted file mode 100644
+index 9f5a201b26d..00000000000
+--- a/ext/openssl/tests/sni_server_cs.pem
++++ /dev/null
+@@ -1,57 +0,0 @@
+------BEGIN RSA PRIVATE KEY-----
+-MIIEpQIBAAKCAQEAvy5NhzktzEdsHTbGB6vqYANms5rn1zXFmTJrGlWCwoIsNmTf
+-ahvZkrC1cCXTZ7fbPB8XQbpAtz2ZSU7OcwBW9B8okYUPo9zi/ptwcrgsQsN0hrcD
+-8MBRUccevwime5fLvg8E9RJ/68y9y3BnRcVWYO2sAK9juTfidNjETU3Bb05oXv8D
+-SD/6onXQu4uXDgsQ3cRXeld9UB0xazmQXyyiIqXc/cpTAnaEVYzn28aj7NlUbzNq
+-511UXMXY44x9EcXWpPVZ7heNcJNzY5DCNzmtXKrt9yiMpWQcPXEzsESVxAMqib9u
+-TFOlvVX17LIPxBG656PjTD9J1h6kBbMCUxzs7wIDAQABAoIBAQC85lBeY0X4ST3v
+-I7bJz7kWQ2YP4uhfAdeLhoDDFWjNLffniwYhfwEc6xNri0R2f/jUT9gX7qORKwEx
+-qPdeNCC2t67LElGg1FlJv2Z9Q7MgCKYzkdQH5s6y4e9kTHTLO/JpiceZKz1QTQ3f
+-XOH9032E6nIAf0wmr6xHTgOwajrN8VI5BuPEMVmEwIw3AtYeqVuPCNKyGR4HUVkC
+-2bAydnGngbRJRnNzmKcWJancxpHDGBSFqPyuXMFC7Jgo3ZmyCbGp99vuXVk/sW9x
+-5aj94M9nRE0guk05ivH2/JZao2uLYkIgjFWlhNxKdWgWRk8DEuN4djC8mKS9YH1q
+-crYRToMhAoGBAOspUTtKP54mpZmyhxuDqj02JaJRzNTskPHsiF1UhtXuw7uT+ryV
+-ekUFLNXoFmn9mbx1WVaUvGH4qjilvQOxz7u++lz0ApqJEfyM3jc/cC40Y5zcuGSu
+-Etbg+SyDoytlgMCIydJyrS7NNALSo5p5oG6XY2f8yd/DCAmo8LzypaHRAoGBANAf
+-R1SlBMc/bOsi6GrJxcBVSCFMiKYiO5woL5aUKa9yM+UQuQ/6xbQ7Q+sOlt0FH3xo
+-AJ2L60qTdjyXVtjOdtXs5ZC4l+C6AfnCx6yLr+fNc4SOYXEfqS4LZylgwKd9KyVB
+-asspIW9Idbgebmi6vPyt9LDkIp0h1VuFGjkvQJK/AoGBAI4pbS0dprXyARyYW6sb
+-fpgAmuG099IkrT9DUfCx/81myTclr2fAKal+BmvOIXaz0/OlMXvw8K19iVIzh7+r
+-B70lJ+93p/dKM/BsLI5TsHqOO0YB/QsIXOVAHgJ2FfdPJnW+e9vYba+kZ/Po6PSi
+-4ITaykJ8BIJcQgis89QWEGFxAoGBAJhQO+jzuDKF9ZWEf6ofrw0anOZZ16wWY5/e
+-PS2rk3JmVxpuibHrKqPDt+ogTELHDAsFJmYmz3VNxHuFmrajK49Wh4/JuMVr/CQo
+-6+8YcA1qa/94IFIlBLDBAafjujsZvOjQHnM+z8xcsGKmStF00Pjv6qNG4xoyd646
+-FD4DmfOLAoGAWXehpopZKXE9gRAni881ucK6WqxPPBoofbozi09D0MmfarIVaSkv
+-jNVVHBfLWd7IEXTjiipPBeUqq6Jc3pscN1Vp4rrl8jTmVTdazEv0LuzpdUFqmNo2
+-M+xw17uz9D9Q32/aW1Lar0PdIaL/wGEDEyzEBFwrGppcENLilPz8gzU=
+------END RSA PRIVATE KEY-----
+------BEGIN CERTIFICATE-----
+-MIIFIjCCAwqgAwIBAgICEAIwDQYJKoZIhvcNAQELBQAwVTELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAsMB29w
+-ZW5zc2wxEDAOBgNVBAMMB3BocC5uZXQwHhcNMTgwMTE0MTgzNjEyWhcNMjYwNDAy
+-MTgzNjEyWjBGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UE
+-CgwHUEhQLm5ldDETMBEGA1UEAwwKY3MucGhwLm5ldDCCASIwDQYJKoZIhvcNAQEB
+-BQADggEPADCCAQoCggEBAL8uTYc5LcxHbB02xger6mADZrOa59c1xZkyaxpVgsKC
+-LDZk32ob2ZKwtXAl02e32zwfF0G6QLc9mUlOznMAVvQfKJGFD6Pc4v6bcHK4LELD
+-dIa3A/DAUVHHHr8IpnuXy74PBPUSf+vMvctwZ0XFVmDtrACvY7k34nTYxE1NwW9O
+-aF7/A0g/+qJ10LuLlw4LEN3EV3pXfVAdMWs5kF8soiKl3P3KUwJ2hFWM59vGo+zZ
+-VG8zauddVFzF2OOMfRHF1qT1We4XjXCTc2OQwjc5rVyq7fcojKVkHD1xM7BElcQD
+-Kom/bkxTpb1V9eyyD8QRuuej40w/SdYepAWzAlMc7O8CAwEAAaOCAQkwggEFMAkG
+-A1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCGSAGG+EIBDQQmFiRPcGVu
+-U1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFHPfd8dK
+-Lz1R0Ck4WV1B9AWXd5DSMGwGA1UdIwRlMGOAFOPK44Eacedv7HbR2Igcbew+4kUa
+-oUekRTBDMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwH
+-UEhQLm5ldDEQMA4GA1UEAwwHcGhwLm5ldIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
+-A1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQB6WSIHEyDXLZxH
+-hZjqSNQOA7Wc9Z2FCAiD29xYkGTL8WuPVGGP1mu4B92ytj+PMWwqSReDa7eTGLE7
+-O7ozw9l+c+gNmHFNikSsGjlV2E8CToQOFMny+jAQYMSXf8UbTp9xDfgG02t/71hv
+-SLWqdeHMLcR0xi0nBQH0vDOkwUbuWYqFa3jejHieGhykHM6CkIk6lqnyOEO+ooIF
+-ZsLprrg1ss/mXCPI6niP0hze55ERKdxI7Rk8sZ4pVkf2SUWqZrUS0aJ+Ymmwi6Xd
+-2V7izq5N30PkJS8MtqII4FAjRBIkwPh0sy8PmW/DzkYU+lYQnDfYLKDFKcj8xJK/
+-o8oZUBsQltrSj0KlM9QuqxCTCBCy1nXZ9WHOhq+jdLiTc1Oi60uEHcUMrLK8aYc4
+-HqIvZS6C2iwMI0d1OP3VxmAbMQ9yqRi+FbLYavJ3H40jrU9SYqdxa0BrTaz8MJNE
+-6AEwgQDPChczSghvHME+Fs4mtGCY3TesbNZKVahQRjaFIhMZIZ4RP4CRc0bJOBG+
+-8Me4+KHNsD2ki5b03wAN6C1P2QrMzI+gH9fXLZYp761ciDAsX6YIzrhHHYLxYpJH
+-BkQKKs8dCQWE5IzgVrdlvC3Z1/l9om66wHqqx7nKnPfYs/Sfnwe9MpCD6xJrXiTm
+-WS7NM6fbQpO9APNr7o0ZOjbbWFzlNw==
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_cs_cert.pem b/ext/openssl/tests/sni_server_cs_cert.pem
+deleted file mode 100644
+index b77c7b83e2a..00000000000
+--- a/ext/openssl/tests/sni_server_cs_cert.pem
++++ /dev/null
+@@ -1,30 +0,0 @@
+------BEGIN CERTIFICATE-----
+-MIIFIjCCAwqgAwIBAgICEAIwDQYJKoZIhvcNAQELBQAwVTELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAsMB29w
+-ZW5zc2wxEDAOBgNVBAMMB3BocC5uZXQwHhcNMTgwMTE0MTgzNjEyWhcNMjYwNDAy
+-MTgzNjEyWjBGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UE
+-CgwHUEhQLm5ldDETMBEGA1UEAwwKY3MucGhwLm5ldDCCASIwDQYJKoZIhvcNAQEB
+-BQADggEPADCCAQoCggEBAL8uTYc5LcxHbB02xger6mADZrOa59c1xZkyaxpVgsKC
+-LDZk32ob2ZKwtXAl02e32zwfF0G6QLc9mUlOznMAVvQfKJGFD6Pc4v6bcHK4LELD
+-dIa3A/DAUVHHHr8IpnuXy74PBPUSf+vMvctwZ0XFVmDtrACvY7k34nTYxE1NwW9O
+-aF7/A0g/+qJ10LuLlw4LEN3EV3pXfVAdMWs5kF8soiKl3P3KUwJ2hFWM59vGo+zZ
+-VG8zauddVFzF2OOMfRHF1qT1We4XjXCTc2OQwjc5rVyq7fcojKVkHD1xM7BElcQD
+-Kom/bkxTpb1V9eyyD8QRuuej40w/SdYepAWzAlMc7O8CAwEAAaOCAQkwggEFMAkG
+-A1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCGSAGG+EIBDQQmFiRPcGVu
+-U1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFHPfd8dK
+-Lz1R0Ck4WV1B9AWXd5DSMGwGA1UdIwRlMGOAFOPK44Eacedv7HbR2Igcbew+4kUa
+-oUekRTBDMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwH
+-UEhQLm5ldDEQMA4GA1UEAwwHcGhwLm5ldIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
+-A1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQB6WSIHEyDXLZxH
+-hZjqSNQOA7Wc9Z2FCAiD29xYkGTL8WuPVGGP1mu4B92ytj+PMWwqSReDa7eTGLE7
+-O7ozw9l+c+gNmHFNikSsGjlV2E8CToQOFMny+jAQYMSXf8UbTp9xDfgG02t/71hv
+-SLWqdeHMLcR0xi0nBQH0vDOkwUbuWYqFa3jejHieGhykHM6CkIk6lqnyOEO+ooIF
+-ZsLprrg1ss/mXCPI6niP0hze55ERKdxI7Rk8sZ4pVkf2SUWqZrUS0aJ+Ymmwi6Xd
+-2V7izq5N30PkJS8MtqII4FAjRBIkwPh0sy8PmW/DzkYU+lYQnDfYLKDFKcj8xJK/
+-o8oZUBsQltrSj0KlM9QuqxCTCBCy1nXZ9WHOhq+jdLiTc1Oi60uEHcUMrLK8aYc4
+-HqIvZS6C2iwMI0d1OP3VxmAbMQ9yqRi+FbLYavJ3H40jrU9SYqdxa0BrTaz8MJNE
+-6AEwgQDPChczSghvHME+Fs4mtGCY3TesbNZKVahQRjaFIhMZIZ4RP4CRc0bJOBG+
+-8Me4+KHNsD2ki5b03wAN6C1P2QrMzI+gH9fXLZYp761ciDAsX6YIzrhHHYLxYpJH
+-BkQKKs8dCQWE5IzgVrdlvC3Z1/l9om66wHqqx7nKnPfYs/Sfnwe9MpCD6xJrXiTm
+-WS7NM6fbQpO9APNr7o0ZOjbbWFzlNw==
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_cs_key.pem b/ext/openssl/tests/sni_server_cs_key.pem
+deleted file mode 100644
+index bf1e9f25193..00000000000
+--- a/ext/openssl/tests/sni_server_cs_key.pem
++++ /dev/null
+@@ -1,27 +0,0 @@
+------BEGIN RSA PRIVATE KEY-----
+-MIIEpQIBAAKCAQEAvy5NhzktzEdsHTbGB6vqYANms5rn1zXFmTJrGlWCwoIsNmTf
+-ahvZkrC1cCXTZ7fbPB8XQbpAtz2ZSU7OcwBW9B8okYUPo9zi/ptwcrgsQsN0hrcD
+-8MBRUccevwime5fLvg8E9RJ/68y9y3BnRcVWYO2sAK9juTfidNjETU3Bb05oXv8D
+-SD/6onXQu4uXDgsQ3cRXeld9UB0xazmQXyyiIqXc/cpTAnaEVYzn28aj7NlUbzNq
+-511UXMXY44x9EcXWpPVZ7heNcJNzY5DCNzmtXKrt9yiMpWQcPXEzsESVxAMqib9u
+-TFOlvVX17LIPxBG656PjTD9J1h6kBbMCUxzs7wIDAQABAoIBAQC85lBeY0X4ST3v
+-I7bJz7kWQ2YP4uhfAdeLhoDDFWjNLffniwYhfwEc6xNri0R2f/jUT9gX7qORKwEx
+-qPdeNCC2t67LElGg1FlJv2Z9Q7MgCKYzkdQH5s6y4e9kTHTLO/JpiceZKz1QTQ3f
+-XOH9032E6nIAf0wmr6xHTgOwajrN8VI5BuPEMVmEwIw3AtYeqVuPCNKyGR4HUVkC
+-2bAydnGngbRJRnNzmKcWJancxpHDGBSFqPyuXMFC7Jgo3ZmyCbGp99vuXVk/sW9x
+-5aj94M9nRE0guk05ivH2/JZao2uLYkIgjFWlhNxKdWgWRk8DEuN4djC8mKS9YH1q
+-crYRToMhAoGBAOspUTtKP54mpZmyhxuDqj02JaJRzNTskPHsiF1UhtXuw7uT+ryV
+-ekUFLNXoFmn9mbx1WVaUvGH4qjilvQOxz7u++lz0ApqJEfyM3jc/cC40Y5zcuGSu
+-Etbg+SyDoytlgMCIydJyrS7NNALSo5p5oG6XY2f8yd/DCAmo8LzypaHRAoGBANAf
+-R1SlBMc/bOsi6GrJxcBVSCFMiKYiO5woL5aUKa9yM+UQuQ/6xbQ7Q+sOlt0FH3xo
+-AJ2L60qTdjyXVtjOdtXs5ZC4l+C6AfnCx6yLr+fNc4SOYXEfqS4LZylgwKd9KyVB
+-asspIW9Idbgebmi6vPyt9LDkIp0h1VuFGjkvQJK/AoGBAI4pbS0dprXyARyYW6sb
+-fpgAmuG099IkrT9DUfCx/81myTclr2fAKal+BmvOIXaz0/OlMXvw8K19iVIzh7+r
+-B70lJ+93p/dKM/BsLI5TsHqOO0YB/QsIXOVAHgJ2FfdPJnW+e9vYba+kZ/Po6PSi
+-4ITaykJ8BIJcQgis89QWEGFxAoGBAJhQO+jzuDKF9ZWEf6ofrw0anOZZ16wWY5/e
+-PS2rk3JmVxpuibHrKqPDt+ogTELHDAsFJmYmz3VNxHuFmrajK49Wh4/JuMVr/CQo
+-6+8YcA1qa/94IFIlBLDBAafjujsZvOjQHnM+z8xcsGKmStF00Pjv6qNG4xoyd646
+-FD4DmfOLAoGAWXehpopZKXE9gRAni881ucK6WqxPPBoofbozi09D0MmfarIVaSkv
+-jNVVHBfLWd7IEXTjiipPBeUqq6Jc3pscN1Vp4rrl8jTmVTdazEv0LuzpdUFqmNo2
+-M+xw17uz9D9Q32/aW1Lar0PdIaL/wGEDEyzEBFwrGppcENLilPz8gzU=
+------END RSA PRIVATE KEY-----
+diff --git a/ext/openssl/tests/sni_server_key_cert.phpt b/ext/openssl/tests/sni_server_key_cert.phpt
+index 49ed6aa5328..878f97c1e35 100644
+--- a/ext/openssl/tests/sni_server_key_cert.phpt
++++ b/ext/openssl/tests/sni_server_key_cert.phpt
+@@ -8,21 +8,36 @@
+ ?>
+ --FILE--
+ <?php
++$caFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_ca_kc.pem.tmp';
++$csCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs_cert.pem.tmp';
++$csKeyFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs_key.pem.tmp';
++$ukCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk_cert.pem.tmp';
++$ukKeyFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk_key.pem.tmp';
++$usCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us_cert.pem.tmp';
++$usKeyFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us_key.pem.tmp';
++
++include 'CertificateGenerator.inc';
++$certificateGenerator = new CertificateGenerator();
++$certificateGenerator->saveCaCert($caFile);
++$certificateGenerator->saveNewCertAndKey('cs.php.net', $csCertFile, $csKeyFile);
++$certificateGenerator->saveNewCertAndKey('uk.php.net', $ukCertFile, $ukKeyFile);
++$certificateGenerator->saveNewCertAndKey('us.php.net', $usCertFile, $usKeyFile);
++
+ $serverCode = <<<'CODE'
+     $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+             "cs.php.net" => [
+-                'local_cert' => __DIR__ . "/sni_server_cs_cert.pem",
+-                'local_pk' => __DIR__ . "/sni_server_cs_key.pem"
++                'local_cert' => '%s',
++                'local_pk' => '%s',
+             ],
+             "uk.php.net" => [
+-                'local_cert' => __DIR__ . "/sni_server_uk_cert.pem",
+-                'local_pk' => __DIR__ . "/sni_server_uk_key.pem"
++                'local_cert' => '%s',
++                'local_pk' => '%s',
+             ],
+             "us.php.net" => [
+-                'local_cert' => __DIR__ . "/sni_server_us_cert.pem",
+-                'local_pk' => __DIR__ . "/sni_server_us_key.pem"
++                'local_cert' => '%s',
++                'local_pk' => '%s',
+             ],
+         ]
+     ]]);
+@@ -34,11 +49,16 @@
+         @stream_socket_accept($server, 3);
+     }
+ CODE;
++$serverCode = sprintf($serverCode,
++        $csCertFile, $csKeyFile,
++        $ukCertFile, $ukKeyFile,
++        $usCertFile, $usKeyFile
++);
+ 
+ $clientCode = <<<'CODE'
+     $flags = STREAM_CLIENT_CONNECT;
+     $ctxArr = [
+-        'cafile' => __DIR__ . '/sni_server_ca.pem',
++        'cafile' => '%s',
+         'capture_peer_cert' => true
+     ];
+ 
+@@ -60,10 +80,21 @@
+     $cert = stream_context_get_options($ctx)['ssl']['peer_certificate'];
+     var_dump(openssl_x509_parse($cert)['subject']['CN']);
+ CODE;
++$clientCode = sprintf($clientCode, $caFile);
+ 
+ include 'ServerClientTestCase.inc';
+ ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+ ?>
++--CLEAN--
++<?php
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_ca_kc.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs_cert.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs_key.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk_cert.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk_key.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us_cert.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us_key.pem.tmp');
++?>
+ --EXPECTF--
+ string(%d) "cs.php.net"
+ string(%d) "uk.php.net"
+diff --git a/ext/openssl/tests/sni_server_uk_cert.pem b/ext/openssl/tests/sni_server_uk_cert.pem
+deleted file mode 100644
+index 57663855e59..00000000000
+--- a/ext/openssl/tests/sni_server_uk_cert.pem
++++ /dev/null
+@@ -1,30 +0,0 @@
+------BEGIN CERTIFICATE-----
+-MIIFIjCCAwqgAwIBAgICEAMwDQYJKoZIhvcNAQELBQAwVTELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAsMB29w
+-ZW5zc2wxEDAOBgNVBAMMB3BocC5uZXQwHhcNMTgwMTE0MTgzNjMyWhcNMjYwNDAy
+-MTgzNjMyWjBGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UE
+-CgwHUEhQLm5ldDETMBEGA1UEAwwKdWsucGhwLm5ldDCCASIwDQYJKoZIhvcNAQEB
+-BQADggEPADCCAQoCggEBAKzKRXj0jVBzRwolFn7Ej0MR2kE6Q36IBCEiDLhquSYR
+-Lh1spR0XudSVmRot/Wvz2PawApX4P6qj57scBQ6KL4ULKvSndCZ7F1tdQjEqogYp
+-n/L8oBhP1dgyDonsewG/PucxC+3Aqzcl3w5Pg7qE+zad42khP7t9TjFAMxc+PxC+
+-2as5ZCDJBwfxksCyCQfFWx7eB7p39vGy63k3Izv+UKTZEhbSdT721kb91oXkecpE
+-EFhihfVYMGMEtC7u2JLSxdkRhWYSMqVCvI2syYsLAUUNH2kgqQF00j2Iddhg3oMA
+-IiqhpC/n2slHVhp56WE1TsrGC/JgqIvQK9AT4LRxFb8CAwEAAaOCAQkwggEFMAkG
+-A1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCGSAGG+EIBDQQmFiRPcGVu
+-U1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFJK58uJe
+-Lv8WDOR8TTLUcSxO1zCyMGwGA1UdIwRlMGOAFOPK44Eacedv7HbR2Igcbew+4kUa
+-oUekRTBDMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwH
+-UEhQLm5ldDEQMA4GA1UEAwwHcGhwLm5ldIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
+-A1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQDHayU795hFnQNj
+-fuYV21sEmkSjgtp6X4rV9JfoCp8U2gieL4mizoCPx9Q8HYaAf98hPYTofGUaCSd+
+-Xlzd8lhLt9GCU+BsCxGtJocrjOQDhyhkioN8iirQRTtJpRVC6a4RCBGpenOD7Z7C
+-Z32uGXohzFuigP/J8/SXBdHrlpNSa03iEkkisPR46mbGj06lFVOFHJDNKA3CnQwM
+-3VfqvZt0ksZi/gAOol8dtrAd3k5JBfJ2BtqsPbycEGAhsGrTK/MeqiFcO8QZiXpN
+-qf0wZzOMFZJ4HqTiHs4TMMQaDK8c4qfR0l1OE224ijcB5NlqMjGAZabMfHgNZcl7
+-fYPX+POsOMaqubv98uoC0PCK8NCTyfB4V/el72EEoVfwKYOxm3eYXBEE2ZNyIci6
+-YKYhNa9e2k+cFueYMztV06HTGgkcHcSJATP+3ISTRx3tj1BPmc4O4WAMEMx1E0gg
+-PaVrBVAylGzt8kaMaOQMBImpsALSfutq6+KtQiu0OTGS3yVUGamV4AyRjuwF1/ZA
+-kZbjmNEGsf9d2rzS89ckds24QUx0zrfJ56p7lRvyVK/pML7iadv8dUH3fKDDDerD
+-oocLjOjNxFGN9Woz+kfidA8Siu0zsfQ6CLPlaQrVAVQH4iMuCZraqMc3TqAiUKRj
+-iHKp6FFrRZmY8W8HEKHv98uGofn+3g==
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_uk_key.pem b/ext/openssl/tests/sni_server_uk_key.pem
+deleted file mode 100644
+index 3baa6efd776..00000000000
+--- a/ext/openssl/tests/sni_server_uk_key.pem
++++ /dev/null
+@@ -1,27 +0,0 @@
+------BEGIN RSA PRIVATE KEY-----
+-MIIEowIBAAKCAQEArMpFePSNUHNHCiUWfsSPQxHaQTpDfogEISIMuGq5JhEuHWyl
+-HRe51JWZGi39a/PY9rAClfg/qqPnuxwFDoovhQsq9Kd0JnsXW11CMSqiBimf8vyg
+-GE/V2DIOiex7Ab8+5zEL7cCrNyXfDk+DuoT7Np3jaSE/u31OMUAzFz4/EL7Zqzlk
+-IMkHB/GSwLIJB8VbHt4Hunf28bLreTcjO/5QpNkSFtJ1PvbWRv3WheR5ykQQWGKF
+-9VgwYwS0Lu7YktLF2RGFZhIypUK8jazJiwsBRQ0faSCpAXTSPYh12GDegwAiKqGk
+-L+fayUdWGnnpYTVOysYL8mCoi9Ar0BPgtHEVvwIDAQABAoIBAGpg7XyWMxpAno/k
+-XYEWSo0kRJa75CnWW5R6fhJbwjlpglajONQ8czAqGeRARDFeI0lc+3qRJ8FKv7Q2
+-f/Z/pNnoEj4liiDWz350X/gdIztgDRVv6rCNFj7QMps/eEuPDo8PZySs5bxCGJ2a
+-3qLKlE7/za4/xhkMAEPaHppEvFb15dpomqP2Fjqei9afp8tD+xJv9BGtkFIy9acw
+-94AWQi974kgW7ZzfEf8RqHM0ExKiESCc26knbcBu0tQ892YHggMccUMk/UrVgR5d
+-vuGOBurlYGLBstSDSKCCe6la4N/FX3FiC3WhVNescnuTZPXcX3zebh7roGjgrTdd
+-6UJYBIECgYEA09XYihdwW66G9Y09OatzlzBh1Rvzjv2Vl5NmWHHb6vh38H4PcOof
+-S1pT0JvRzpt8uEs4i+Eda5PyQyp4iGtD+DQ07Dxh2jiixsE3PRFRG2wg2QCgDHnS
+-6vgV1VOqA/A4on4nhxLZXxhX4YvHaJYlm1bZ+amG+j5XiI/NtHJm9k8CgYEA0NB9
+-bAoaZnc06+T8rMaO45boX5SvYsCZbtY3VRl75SrbMal0IKfnXHELVHuei12LmlMs
+-LuFgG8jGO3+ncxUqMytoGvrmk/cM9tCNbDKVHtFbqz0qt9lkDAwLsBougKnVsNDW
+-Aae/tz/wYXJct86unfLh0xtvkx5Iz1we4cS1fZECgYA8YR+vfK7R8xUUuIVTAsOX
+-vHqmO6lYgH87DRCG9S0x9FB7g/LyxEjXOY/aTg+nTDpobUhY1nmESE8tRdXFTI27
+-GWZcT3m0sZ/z9u6/wUfVAST7tWnpJHAx+TR/8bDsHnSGHF836O98Y3vpFeZosSNW
+-+5J1zxRiD5LzocmIPXOLkQKBgEgHApxXx898YwbTj8zRGMysay89DFpV8RboUWHL
+-To83/y/cMbBp+kZKwAu+MGwGMndjJSRunUY4NRik6c+qh0nrORfFX+++Efy4529g
+-60scEDC7Apc0J2x4Yze1cED1VD6PaqJbiKffKD2UwyKr6lOVSgwVtKDcm2Tbc9OQ
+-lMHhAoGBAIPwYVxzWM6I6pr8x2TucpBZZReLytz7uzybMNvbKCrwlETbNNXubnfp
+-nPuPKzpeRI0y26pIIAbijzFW0MXq+kIu3H7we8TaImsJ1AaQCTYeoLWBVcr6RISk
+-3d4i7iT35aWCuhPVve0FNIv/u3jrqX2H2C2MXMiLOsw1GFxPvpi4
+------END RSA PRIVATE KEY-----
+diff --git a/ext/openssl/tests/sni_server_us.pem b/ext/openssl/tests/sni_server_us.pem
+deleted file mode 100644
+index 170a8a96e75..00000000000
+--- a/ext/openssl/tests/sni_server_us.pem
++++ /dev/null
+@@ -1,57 +0,0 @@
+------BEGIN RSA PRIVATE KEY-----
+-MIIEpQIBAAKCAQEA1QkC3tiNYDY+ZxMmPbagYUbMpzuXo9mVBvYh86bYZaeB7bts
+-QCBK+6VD4D2LjR3RszpzmOzhJXjm8j0t+GeRS3OMIM75/BKAnixXicRSIb8zdIPz
+-JP992vvMq8p46/XftAfBhAMOaCqcD85zpyX4PhfC9733nOyN4yqx58O4UhVTKih6
+-W9/ldp3uwSYAW+HyoINnHls/bFO8vv60K5VIhkxK30LHnC5PvByGfuHOgrscEThs
+-jW0ESqO0+9l88KhGdmLgzvbBlGxNziCMfn0LcFH6p2ITc3foD4LSzGEFtJ92OZi3
+-buCOfbFsN7vWHTsEi89fRcCnWGtMwLUx0TCluQIDAQABAoIBAQCnsUQ1Lrl6trhA
+-Yu6DPbLZX+XQ7jPbonaQ2Ea5iOhmfIjmHdaEU+cyV1EqvseO+Z4MO0KraiuAV79T
+-h50cIEpa3kW7vbFCHz5nQ/hUVdlg/yT93rASu5rSOctOnz64Xv8Ms948kDtS+9eF
+-Cbo4JMdX+VRbt4mmWP8HhqAsFACPexEoWxJcIxwFcI24GTGzySjemNjQzbmcVhzM
+-a4k6n8DolCL1cRS54C5Aaf5g4+IFDgyydcgZXp1lnX3MnqivSNkejnPnY55NcmrH
+-X3ZWPlAi9GHOJE33uy8bGWnip7Tn4iTt6tJvjz/yP82TGACDg1B8XsKrqsuQLsoU
+-cNBVGcQBAoGBAPteCgNmuNOpo4SRA1UVRw1WgnE8YtnNA6vYyVcTLSpqabq33UaD
+-03L9CQsbHtj88U+E8OH24Iqj3U9x7QJfH8DVmWuBrlwez80JsKGnLdViHydjKcAz
+-H2Cbv+SiWeaWXkFCkN4Jf7k3q0Ew4SG2LOq5PVUy/NB4bilbJD2ExKpZAoGBANj2
+-Hpwo35IQ4XfSSsGaCdn+8ajMcNUMMGZ6YkZqmVO4kogqobyrPL/2KE9ol/hlacw6
+-U/6Digox5/wqruYfqyM8lqGOq2/0Xf7c4XfiOTS9Na4JN3OGzlyqPvcn2zdqhYFY
+-iHPu2RqpA+LhCHW9Zs8C1Bp/KAEPdRP6OabqVaphAoGACLrHVj7nBFLL3vq6RuYq
+-RYhPl2cld7LrAbjRpTiBRQvVCCsCgERrv36SJdSXSanfJ4fSZcaRHb97HBs0w/RR
+-wfypC1bBm2lmhhRkEfkgWlzCADgtZwNff5dpHqOUw7FNLK8HIO7rhJ8uT2FHMEiH
+-Xs94FdFjfknwaXdE1u4ZdmECgYEAgxfbkQHFbO2UPqErGGXp0/WOsS6ucpyF1jXW
+-kbOxZ3vb1jjkNyrEbzzeSHTrdmRYk9UekWeLjfNvt9dWjKfP8V+XqJCbF+9wqCFw
+-fs6LQEmfWMQq5DwtDqKznwVPGOHdPzVuZZaJSemb9oeAZBwINccAv+3bDyD23hZQ
+-pYFsN6ECgYEA33QYDNG/spki4D8rlxyxZ+1MdB/efnrGBhO8FsJpG5+AtmYhWgD9
+-sl29+3aiRkmDznoy36z+hoeZePILEAKMcbHyXOymixOHPuaZJ95hbvq6sqd6WMAe
+-w5tHnxlfEuu11zatolk6WiAmTmG3sZpN5Tqloq0Ye4dvlhVKNV3Bn3E=
+------END RSA PRIVATE KEY-----
+------BEGIN CERTIFICATE-----
+-MIIFIjCCAwqgAwIBAgICEAQwDQYJKoZIhvcNAQELBQAwVTELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAsMB29w
+-ZW5zc2wxEDAOBgNVBAMMB3BocC5uZXQwHhcNMTgwMTE0MTgzNjQ0WhcNMjYwNDAy
+-MTgzNjQ0WjBGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UE
+-CgwHUEhQLm5ldDETMBEGA1UEAwwKdXMucGhwLm5ldDCCASIwDQYJKoZIhvcNAQEB
+-BQADggEPADCCAQoCggEBANUJAt7YjWA2PmcTJj22oGFGzKc7l6PZlQb2IfOm2GWn
+-ge27bEAgSvulQ+A9i40d0bM6c5js4SV45vI9LfhnkUtzjCDO+fwSgJ4sV4nEUiG/
+-M3SD8yT/fdr7zKvKeOv137QHwYQDDmgqnA/Oc6cl+D4Xwve995zsjeMqsefDuFIV
+-Uyooelvf5Xad7sEmAFvh8qCDZx5bP2xTvL7+tCuVSIZMSt9Cx5wuT7wchn7hzoK7
+-HBE4bI1tBEqjtPvZfPCoRnZi4M72wZRsTc4gjH59C3BR+qdiE3N36A+C0sxhBbSf
+-djmYt27gjn2xbDe71h07BIvPX0XAp1hrTMC1MdEwpbkCAwEAAaOCAQkwggEFMAkG
+-A1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCGSAGG+EIBDQQmFiRPcGVu
+-U1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFOXnUeNs
+-grKQb+EvG36DXjjDDmsFMGwGA1UdIwRlMGOAFOPK44Eacedv7HbR2Igcbew+4kUa
+-oUekRTBDMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwH
+-UEhQLm5ldDEQMA4GA1UEAwwHcGhwLm5ldIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
+-A1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQBDLwuLbx75ACSU
+-5cF2L/D17JEnhlna62MgKNdpNLJSpaofK2Lk2BqsmnQf5JdkrXWMUN/DsmXZc9pq
+-25XmprfABUP9Cx18KPVqLQ43Z9o+R9xI1Ospt5mrpxGp6l2BHSs/4G69nuPFpcIJ
+-iabnLYdUk2Z+64lPe4EMBrZH+pj4xn3JA59BACJYNYn0nLaw45DIAyzyLJ0vVSwc
+-0JtjsztXQov4UqdWXxLRFfe2nEGoK8ZkTJ8ELcCYu6sNSBjw9Ech78uXN1BQOBTK
+-lhAgN3FKqOp3hqf0umqf35gDvmWwLB/eptUYZ96gBYT0tbPA0P+YsW+iZmamxXma
+-Odgg8iRcPxKl9bVPt57NLaDy/RQhOxTGXQs1Q2jp7UhzqoZDClwVSDxd6DEppAFA
+-OZAY+Rsrm7VoCwVQ/1KbcJHmJ/79tArvaWJk3KHLGMpdZq4KwrC3hM8/QxYtyX/6
+-cfnXvShBYCdfTGgNlj3t/mNAgp1ZB3s9ClGqRBR/P0Db+ryv5DuxYM6nzEB3Od0y
+-kT5tHbXDQY+1HCExjOMi7Al0cmC2r3+oxDA4UjGv+npgcfeoxQhXmm/SQRiPdKlb
+-vT0D594sLoB23jqA9bMehpxEyI7eGjfFUmXwMeu0tJhipvpJI3ogJoM+SCFTyLkc
+-12cPiz/sR/ALhvhUJXTeUH8wxPjzbA==
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_us_cert.pem b/ext/openssl/tests/sni_server_us_cert.pem
+deleted file mode 100644
+index 4452e3c6cfb..00000000000
+--- a/ext/openssl/tests/sni_server_us_cert.pem
++++ /dev/null
+@@ -1,30 +0,0 @@
+------BEGIN CERTIFICATE-----
+-MIIFIjCCAwqgAwIBAgICEAQwDQYJKoZIhvcNAQELBQAwVTELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAsMB29w
+-ZW5zc2wxEDAOBgNVBAMMB3BocC5uZXQwHhcNMTgwMTE0MTgzNjQ0WhcNMjYwNDAy
+-MTgzNjQ0WjBGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UE
+-CgwHUEhQLm5ldDETMBEGA1UEAwwKdXMucGhwLm5ldDCCASIwDQYJKoZIhvcNAQEB
+-BQADggEPADCCAQoCggEBANUJAt7YjWA2PmcTJj22oGFGzKc7l6PZlQb2IfOm2GWn
+-ge27bEAgSvulQ+A9i40d0bM6c5js4SV45vI9LfhnkUtzjCDO+fwSgJ4sV4nEUiG/
+-M3SD8yT/fdr7zKvKeOv137QHwYQDDmgqnA/Oc6cl+D4Xwve995zsjeMqsefDuFIV
+-Uyooelvf5Xad7sEmAFvh8qCDZx5bP2xTvL7+tCuVSIZMSt9Cx5wuT7wchn7hzoK7
+-HBE4bI1tBEqjtPvZfPCoRnZi4M72wZRsTc4gjH59C3BR+qdiE3N36A+C0sxhBbSf
+-djmYt27gjn2xbDe71h07BIvPX0XAp1hrTMC1MdEwpbkCAwEAAaOCAQkwggEFMAkG
+-A1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCGSAGG+EIBDQQmFiRPcGVu
+-U1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFOXnUeNs
+-grKQb+EvG36DXjjDDmsFMGwGA1UdIwRlMGOAFOPK44Eacedv7HbR2Igcbew+4kUa
+-oUekRTBDMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwH
+-UEhQLm5ldDEQMA4GA1UEAwwHcGhwLm5ldIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
+-A1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQBDLwuLbx75ACSU
+-5cF2L/D17JEnhlna62MgKNdpNLJSpaofK2Lk2BqsmnQf5JdkrXWMUN/DsmXZc9pq
+-25XmprfABUP9Cx18KPVqLQ43Z9o+R9xI1Ospt5mrpxGp6l2BHSs/4G69nuPFpcIJ
+-iabnLYdUk2Z+64lPe4EMBrZH+pj4xn3JA59BACJYNYn0nLaw45DIAyzyLJ0vVSwc
+-0JtjsztXQov4UqdWXxLRFfe2nEGoK8ZkTJ8ELcCYu6sNSBjw9Ech78uXN1BQOBTK
+-lhAgN3FKqOp3hqf0umqf35gDvmWwLB/eptUYZ96gBYT0tbPA0P+YsW+iZmamxXma
+-Odgg8iRcPxKl9bVPt57NLaDy/RQhOxTGXQs1Q2jp7UhzqoZDClwVSDxd6DEppAFA
+-OZAY+Rsrm7VoCwVQ/1KbcJHmJ/79tArvaWJk3KHLGMpdZq4KwrC3hM8/QxYtyX/6
+-cfnXvShBYCdfTGgNlj3t/mNAgp1ZB3s9ClGqRBR/P0Db+ryv5DuxYM6nzEB3Od0y
+-kT5tHbXDQY+1HCExjOMi7Al0cmC2r3+oxDA4UjGv+npgcfeoxQhXmm/SQRiPdKlb
+-vT0D594sLoB23jqA9bMehpxEyI7eGjfFUmXwMeu0tJhipvpJI3ogJoM+SCFTyLkc
+-12cPiz/sR/ALhvhUJXTeUH8wxPjzbA==
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_us_key.pem b/ext/openssl/tests/sni_server_us_key.pem
+deleted file mode 100644
+index 8b0d73d7d63..00000000000
+--- a/ext/openssl/tests/sni_server_us_key.pem
++++ /dev/null
+@@ -1,27 +0,0 @@
+------BEGIN RSA PRIVATE KEY-----
+-MIIEpQIBAAKCAQEA1QkC3tiNYDY+ZxMmPbagYUbMpzuXo9mVBvYh86bYZaeB7bts
+-QCBK+6VD4D2LjR3RszpzmOzhJXjm8j0t+GeRS3OMIM75/BKAnixXicRSIb8zdIPz
+-JP992vvMq8p46/XftAfBhAMOaCqcD85zpyX4PhfC9733nOyN4yqx58O4UhVTKih6
+-W9/ldp3uwSYAW+HyoINnHls/bFO8vv60K5VIhkxK30LHnC5PvByGfuHOgrscEThs
+-jW0ESqO0+9l88KhGdmLgzvbBlGxNziCMfn0LcFH6p2ITc3foD4LSzGEFtJ92OZi3
+-buCOfbFsN7vWHTsEi89fRcCnWGtMwLUx0TCluQIDAQABAoIBAQCnsUQ1Lrl6trhA
+-Yu6DPbLZX+XQ7jPbonaQ2Ea5iOhmfIjmHdaEU+cyV1EqvseO+Z4MO0KraiuAV79T
+-h50cIEpa3kW7vbFCHz5nQ/hUVdlg/yT93rASu5rSOctOnz64Xv8Ms948kDtS+9eF
+-Cbo4JMdX+VRbt4mmWP8HhqAsFACPexEoWxJcIxwFcI24GTGzySjemNjQzbmcVhzM
+-a4k6n8DolCL1cRS54C5Aaf5g4+IFDgyydcgZXp1lnX3MnqivSNkejnPnY55NcmrH
+-X3ZWPlAi9GHOJE33uy8bGWnip7Tn4iTt6tJvjz/yP82TGACDg1B8XsKrqsuQLsoU
+-cNBVGcQBAoGBAPteCgNmuNOpo4SRA1UVRw1WgnE8YtnNA6vYyVcTLSpqabq33UaD
+-03L9CQsbHtj88U+E8OH24Iqj3U9x7QJfH8DVmWuBrlwez80JsKGnLdViHydjKcAz
+-H2Cbv+SiWeaWXkFCkN4Jf7k3q0Ew4SG2LOq5PVUy/NB4bilbJD2ExKpZAoGBANj2
+-Hpwo35IQ4XfSSsGaCdn+8ajMcNUMMGZ6YkZqmVO4kogqobyrPL/2KE9ol/hlacw6
+-U/6Digox5/wqruYfqyM8lqGOq2/0Xf7c4XfiOTS9Na4JN3OGzlyqPvcn2zdqhYFY
+-iHPu2RqpA+LhCHW9Zs8C1Bp/KAEPdRP6OabqVaphAoGACLrHVj7nBFLL3vq6RuYq
+-RYhPl2cld7LrAbjRpTiBRQvVCCsCgERrv36SJdSXSanfJ4fSZcaRHb97HBs0w/RR
+-wfypC1bBm2lmhhRkEfkgWlzCADgtZwNff5dpHqOUw7FNLK8HIO7rhJ8uT2FHMEiH
+-Xs94FdFjfknwaXdE1u4ZdmECgYEAgxfbkQHFbO2UPqErGGXp0/WOsS6ucpyF1jXW
+-kbOxZ3vb1jjkNyrEbzzeSHTrdmRYk9UekWeLjfNvt9dWjKfP8V+XqJCbF+9wqCFw
+-fs6LQEmfWMQq5DwtDqKznwVPGOHdPzVuZZaJSemb9oeAZBwINccAv+3bDyD23hZQ
+-pYFsN6ECgYEA33QYDNG/spki4D8rlxyxZ+1MdB/efnrGBhO8FsJpG5+AtmYhWgD9
+-sl29+3aiRkmDznoy36z+hoeZePILEAKMcbHyXOymixOHPuaZJ95hbvq6sqd6WMAe
+-w5tHnxlfEuu11zatolk6WiAmTmG3sZpN5Tqloq0Ye4dvlhVKNV3Bn3E=
+------END RSA PRIVATE KEY-----
+-- 
+2.52.0
+

gnu/packages/patches/php-02-fix-sni-tests.patch

@@ -0,0 +1,211 @@
+From 178a30b9e700d32a8aac4f49864838829bedd389 Mon Sep 17 00:00:00 2001
+From: Jakub Zelenka <bukka@php.net>
+Date: Sat, 4 Apr 2026 00:28:29 +0200
+Subject: [PATCH] Fix SNI tests for bugs #80770 and #74796
+
+Upstream-Status: Merged in master.
+---
+ ext/openssl/tests/bug74796.phpt | 29 ++++++++++++++++++++------
+ ext/openssl/tests/bug80770.phpt | 31 ++++++++++++++++------------
+ php-8.3.30.manifest             | 36 +++++++++++++++++++++++++++++++++
+ 3 files changed, 77 insertions(+), 19 deletions(-)
+ create mode 100644 php-8.3.30.manifest
+
+diff --git a/ext/openssl/tests/bug74796.phpt b/ext/openssl/tests/bug74796.phpt
+index b3f594d5e60..8ec5590c064 100644
+--- a/ext/openssl/tests/bug74796.phpt
++++ b/ext/openssl/tests/bug74796.phpt
+@@ -12,13 +12,24 @@
+ --FILE--
+ <?php
+ 
++include 'CertificateGenerator.inc';
++$certificateGenerator = new CertificateGenerator();
++$caFile = __DIR__ . '/bug74796_ca.pem.tmp';
++$csFile = __DIR__ . '/bug74796_cs.pem.tmp';
++$ukFile = __DIR__ . '/bug74796_uk.pem.tmp';
++$usFile = __DIR__ . '/bug74796_us.pem.tmp';
++$certificateGenerator->saveCaCert($caFile);
++$certificateGenerator->saveNewCertAsFileWithKey('cs.php.net', $csFile);
++$certificateGenerator->saveNewCertAsFileWithKey('uk.php.net', $ukFile);
++$certificateGenerator->saveNewCertAsFileWithKey('us.php.net', $usFile);
++
+ $serverCode = <<<'CODE'
+     $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+-            "cs.php.net" => __DIR__ . "/sni_server_cs.pem",
+-            "uk.php.net" => __DIR__ . "/sni_server_uk.pem",
+-            "us.php.net" => __DIR__ . "/sni_server_us.pem"
++            "cs.php.net" => '%s',
++            "uk.php.net" => '%s',
++            "us.php.net" => '%s',
+         ]
+     ]]);
+ 
+@@ -33,6 +44,7 @@
+ 
+     phpt_wait();
+ CODE;
++$serverCode = sprintf($serverCode, $csFile, $ukFile, $usFile);
+ 
+ $proxyCode = <<<'CODE'
+     function parse_sni_from_client_hello($data) {
+@@ -134,7 +146,7 @@ function parse_sni_from_client_hello($data) {
+ $clientCode = <<<'CODE'
+     $clientCtx = stream_context_create([
+         'ssl' => [
+-            'cafile' => __DIR__ . '/sni_server_ca.pem',
++            'cafile' => '%s',
+             'verify_peer' => true,
+             'verify_peer_name' => true,
+         ],
+@@ -155,16 +167,21 @@ function parse_sni_from_client_hello($data) {
+ 
+     phpt_notify('server');
+ CODE;
++$clientCode = sprintf($clientCode, $caFile);
+ 
+ include 'ServerClientTestCase.inc';
+ ServerClientTestCase::getInstance()->run($clientCode, [
+-    'server' => $serverCode,
+-    'proxy' => $proxyCode,
++        'server' => $serverCode,
++        'proxy' => $proxyCode,
+ ]);
+ ?>
+ --CLEAN--
+ <?php
+ @unlink(__DIR__ . "/bug74796_proxy_sni.log");
++@unlink(__DIR__ . '/bug74796_ca.pem.tmp');
++@unlink(__DIR__ . '/bug74796_cs.pem.tmp');
++@unlink(__DIR__ . '/bug74796_uk.pem.tmp');
++@unlink(__DIR__ . '/bug74796_us.pem.tmp');
+ ?>
+ --EXPECT--
+ string(19) "Hello from server 0"
+diff --git a/ext/openssl/tests/bug80770.phpt b/ext/openssl/tests/bug80770.phpt
+index 9100aaa5aa1..21860dc78eb 100644
+--- a/ext/openssl/tests/bug80770.phpt
++++ b/ext/openssl/tests/bug80770.phpt
+@@ -11,14 +11,25 @@
+ <?php
+ $clientCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_client.pem.tmp';
+ $caCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_ca.pem.tmp';
++$csFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_cs.pem.tmp';
++$ukFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_uk.pem.tmp';
++$usFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_us.pem.tmp';
++
++include 'CertificateGenerator.inc';
++$certificateGenerator = new CertificateGenerator();
++$certificateGenerator->saveCaCert($caCertFile);
++$certificateGenerator->saveNewCertAsFileWithKey('cs.php.net', $csFile);
++$certificateGenerator->saveNewCertAsFileWithKey('uk.php.net', $ukFile);
++$certificateGenerator->saveNewCertAsFileWithKey('us.php.net', $usFile);
++$certificateGenerator->saveNewCertAsFileWithKey('Bug80770 Test Client', $clientCertFile);
+ 
+ $serverCode = <<<'CODE'
+     $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+-            "cs.php.net" => __DIR__ . "/sni_server_cs.pem",
+-            "uk.php.net" => __DIR__ . "/sni_server_uk.pem",
+-            "us.php.net" => __DIR__ . "/sni_server_us.pem"
++            "cs.php.net" => '%s',
++            "uk.php.net" => '%s',
++            "us.php.net" => '%s',
+         ],
+         'verify_peer' => true,
+         'cafile' => '%s',
+@@ -28,7 +39,6 @@
+     ]]);
+     $server = stream_socket_server('tcp://127.0.0.1:0', $errno, $errstr, $flags, $ctx);
+     phpt_notify_server_start($server);
+-
+     $client = stream_socket_accept($server, 30);
+     if ($client) {
+         $success = stream_socket_enable_crypto($client, true, STREAM_CRYPTO_METHOD_TLS_SERVER);
+@@ -43,7 +53,7 @@
+         phpt_notify(message: "ACCEPT_FAILED");
+     }
+ CODE;
+-$serverCode = sprintf($serverCode, $caCertFile);
++$serverCode = sprintf($serverCode, $csFile, $ukFile, $usFile, $caCertFile);
+ 
+ $clientCode = <<<'CODE'
+     $flags = STREAM_CLIENT_CONNECT;
+@@ -58,19 +68,11 @@
+     if ($client) {
+         stream_socket_enable_crypto($client, true, STREAM_CRYPTO_METHOD_TLS_CLIENT);
+     }
+-
+     $result = phpt_wait();
+     echo trim($result);
+ CODE;
+ $clientCode = sprintf($clientCode, $clientCertFile);
+ 
+-include 'CertificateGenerator.inc';
+-
+-// Generate CA and client certificate signed by that CA
+-$certificateGenerator = new CertificateGenerator();
+-$certificateGenerator->saveCaCert($caCertFile);
+-$certificateGenerator->saveNewCertAsFileWithKey('Bug80770 Test Client', $clientCertFile);
+-
+ include 'ServerClientTestCase.inc';
+ ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+ ?>
+@@ -78,6 +80,9 @@
+ <?php
+ @unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_client.pem.tmp');
+ @unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_ca.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_cs.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_uk.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_us.pem.tmp');
+ ?>
+ --EXPECTF--
+ CLIENT_CERT_CAPTURED
+diff --git a/php-8.3.30.manifest b/php-8.3.30.manifest
+new file mode 100644
+index 00000000000..ef6ffe8aa80
+--- /dev/null
++++ b/php-8.3.30.manifest
+@@ -0,0 +1,36 @@
++php-8.3.30.tar.bz2
++SHA256 hash: 800b7b6ed50b73c8ee7844ee5f2f7cc612faa7875a0aa7c4529e8ed5866a5030
++PGP signature:
++-----BEGIN PGP SIGNATURE-----
++
++iHUEABYKAB0WIQTCjZN1dWA+tKu3JYYcB3ncXAqd5AUCaWbJsAAKCRAcB3ncXAqd
++5FioAPwK1gjqwBbGr5g3y1TikqxgKVWMHCtir1n46yGN2hYvtwD/flOR9EqRejNU
++wW4RMkmRwXGsXY28V1DH+NKnDKTEWQ8=
++=jkCu
++-----END PGP SIGNATURE-----
++
++
++php-8.3.30.tar.gz
++SHA256 hash: e587dc95fb7f62730299fa7b36b6e4f91e6708aaefa2fff68a0098d320c16386
++PGP signature:
++-----BEGIN PGP SIGNATURE-----
++
++iHUEABYKAB0WIQTCjZN1dWA+tKu3JYYcB3ncXAqd5AUCaWbJsAAKCRAcB3ncXAqd
++5F4eAP44IkpP3p3FRq3S9pDm9Y6bJnrpzxafqfXlZ949ECmUIgEAxFb+m5Tz7gcb
++DSU+taIv2W6EQeijjaXPvAE2t1dGswo=
++=kn1U
++-----END PGP SIGNATURE-----
++
++
++php-8.3.30.tar.xz
++SHA256 hash: 67f084d36852daab6809561a7c8023d130ca07fc6af8fb040684dd1414934d48
++PGP signature:
++-----BEGIN PGP SIGNATURE-----
++
++iHUEABYKAB0WIQTCjZN1dWA+tKu3JYYcB3ncXAqd5AUCaWbJsQAKCRAcB3ncXAqd
++5NYpAP9Is0pCLlEuLiSRdAbgWPDee0jPA5JGoriGOFNkdMk67AD/WTzYCx7+dEVG
++8Gb54wK005bk9nRGYQqwvZb+r1gqaQU=
++=vSr4
++-----END PGP SIGNATURE-----
++
++
+-- 
+2.52.0
+

gnu/packages/php.scm

@@ -76,6 +76,9 @@
        (uri (string-append home-page "distributions/" "php-" version ".tar.xz"))
        (sha256
         (base32 "1wh27552f6vd20f1yy4l0jlvknfq0kn5hapmiq55f05xyj1c7glm"))
+       (patches
+        (search-patches "php-01-fix-expired-certificate.patch"
+                        "php-02-fix-sni-tests.patch"))
        (modules '((guix build utils)))
        (snippet
         '(with-directory-excursion "ext"
@@ -333,56 +336,7 @@
               (setenv "TEST_PHP_ARGS"
                       (format #f "-j~a" (if parallel-tests?
                                             (parallel-job-count)
-                                            1)))))
-          (add-after 'unpack 'regenerate-ssl-certs
-            (lambda _
-              ;; The X.509 certificates shipped with PHP have an expiration
-              ;; date, which causes tests to fail after that date.  Generate
-              ;; them to avoid the problem entirely.
-              (define (concat-files result . files)
-                (call-with-output-file result
-                  (lambda (out)
-                    (for-each
-                     (lambda (file)
-                       (put-string out
-                                   (call-with-input-file file
-                                     get-string-all))
-                       (newline out))
-                     files))))
-              (define* (gen-ssl-cert key cert #:optional ca-cert-key ca-cert)
-                (let ((csr (string-append cert ".csr")))
-                  (unless (file-exists? key)
-                    (invoke "openssl" "genrsa" "-out" key "2048"))
-                  (invoke "openssl" "x509" "-x509toreq" "-in" cert "-key" key "-out" csr)
-                  (if ca-cert-key
-                      (begin
-                        (invoke "openssl" "x509"
-                                "-CA" ca-cert
-                                "-CAkey" ca-cert-key
-                                "-req"
-                                "-in" csr
-                                "-days" "+1"
-                                "-CAserial" "serial"
-                                "-CAcreateserial"
-                                "-out" cert))
-                      (invoke "openssl" "x509"
-                              "-req"
-                              "-in" csr
-                              "-signkey" key
-                              "-out" cert
-                              "-days" "30"))))
-              (let ((ca-key "ext/openssl/tests/sni_server_ca.key")
-                    (ca-cert "ext/openssl/tests/sni_server_ca.pem"))
-                (gen-ssl-cert ca-key ca-cert)
-                (for-each
-                 (lambda (suffix)
-                   (let ((key-name (string-append "ext/openssl/tests/sni_server_" suffix "_key.pem"))
-                         (cert-name (string-append "ext/openssl/tests/sni_server_" suffix "_cert.pem"))
-                         (result (string-append "ext/openssl/tests/sni_server_" suffix ".pem")))
-                     (gen-ssl-cert key-name cert-name
-                                   ca-key ca-cert)
-                     (concat-files result key-name cert-name)))
-                 '("cs" "us" "uk"))))))
+                                            1))))))
       #:test-target "test"))
     (inputs
      (list aspell
@@ -451,6 +405,9 @@ systems, web content management systems and web frameworks.")
        (uri (string-append home-page "distributions/" "php-" version ".tar.xz"))
        (sha256
         (base32 "1xr1w82apzsscrsndnphlgqvbj78g0smrp06pcgg8hlsr3vwcm74"))
+       (patches
+        (search-patches "php-01-fix-expired-certificate.patch"
+                        "php-02-fix-sni-tests.patch"))
        (modules '((guix build utils)))
        (snippet
         '(with-directory-excursion "ext"

gnu/packages/rdesktop.scm

@@ -227,9 +227,7 @@ of parts of the Windows API.")
              flex
              gettext-minimal
              intltool)
-       (if (target-x86?)
-           (list nasm)
-           '())
+       (maybe-nasm)
        (list pkg-config
              pixman)))
     (arguments
@@ -296,9 +294,7 @@ variety of RDP clients:
              automake
              intltool
              libtool)
-       (if (target-x86?)
-           (list nasm)
-           '())
+       (maybe-nasm)
        (list pkg-config
              pixman)))
     (arguments

gnu/packages/rust-crates.scm

@@ -8749,6 +8749,10 @@
   (crate-source "dns-update" "0.2.5"
                 "0pqv8d6klfr843rj9ds2cmwpq7fcd2d80md6xg3dqwm9xh6mcdzf"))
 
+(define rust-dns-update-0.2.6
+  (crate-source "dns-update" "0.2.6"
+                "1zpxk14dah94674mwmhih7y6gi9d00xdrq3gwh63x7qfmwivr847"))
+
 (define rust-doc-comment-0.3.3
   (crate-source "doc-comment" "0.3.3"
                 "043sprsf3wl926zmck1bm7gw0jq50mb76lkpk49vasfr6ax1p97y"))
@@ -20433,6 +20437,10 @@
   (crate-source "mail-parser" "0.11.2"
                 "15w8zl8xmczfqqy5wlhspj9yw3x4wmp0lgk89jx96xb949jksapq"))
 
+(define rust-mail-parser-0.11.3
+  (crate-source "mail-parser" "0.11.3"
+                "1mziczvxpbrv5svyjm1ic658qfdjgbzxv5yahc2jn771kh7458nq"))
+
 (define rust-mail-send-0.5.2
   (crate-source "mail-send" "0.5.2"
                 "07ik312zybp141g7bizd3cxq2342kcaa93ryg0c8kbygycklwjhi"))
@@ -94404,7 +94412,7 @@
                                 rust-dirs-sys-0.5.0
                                 rust-displaydoc-0.2.5
                                 rust-dlv-list-0.5.2
-                                rust-dns-update-0.2.5
+                                rust-dns-update-0.2.6
                                 rust-dsa-0.6.3
                                 rust-dunce-1.0.5
                                 rust-dyn-clone-1.0.20
@@ -94594,7 +94602,7 @@
                                 rust-lzma-rust2-0.16.2
                                 rust-mail-auth-0.8.0
                                 rust-mail-builder-0.4.4
-                                rust-mail-parser-0.11.2
+                                rust-mail-parser-0.11.3
                                 rust-maplit-1.0.2
                                 rust-matchers-0.2.0
                                 rust-maybe-async-0.2.10

gnu/packages/tex.scm

@@ -31009,26 +31009,27 @@ dissertation in LaTeX.")
     (license license:lppl1.2+)))
 
 (define-public texlive-neoschool
-  (package
-    (name "texlive-neoschool")
-    (version "2026.1")
-    (source
-     (origin
-       (method svn-multi-fetch)
-       (uri (svn-multi-reference
-             (url (texlive-packages-repository version))
-             (revision 78408)
-             (locations (list "doc/latex/neoschool/"
-                              "tex/latex/neoschool/"))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "06id93rcpzvw34psxfmm1gqyhg2kgzknlxvgfym1708747bgify0"))))
-    (outputs '("out" "doc"))
-    (build-system texlive-build-system)
-    (home-page "https://ctan.org/pkg/neoschool")
-    (synopsis "LaTeX class for teachers")
-    (description
-     "This package provides secondary school teachers with a comprehensive set
+  (let ((revision 78871))             ;release 1.3.6
+    (package
+      (name "texlive-neoschool")
+      (version (string-append "2026.1-" (number->string revision)))
+      (source
+       (origin
+         (method svn-multi-fetch)
+         (uri (svn-multi-reference
+                (url (string-append %texlive-repository "trunk/Master/texmf-dist"))
+                (revision revision)
+                (locations (list "doc/latex/neoschool/"
+                                 "tex/latex/neoschool/"))))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "0qg77lcail38ckyfbgbqj969dysgwq47sns5l4dd3k79513swllr"))))
+      (outputs '("out" "doc"))
+      (build-system texlive-build-system)
+      (home-page "https://ctan.org/pkg/neoschool")
+      (synopsis "LaTeX class for teachers")
+      (description
+       "This package provides secondary school teachers with a comprehensive set
 of tools for creating educational documents such as assessments, course
 materials, exercise sheets with solutions, and more.  It includes eight
 predefined color themes, various class options for layout and typography,
@@ -31037,7 +31038,7 @@ header styles tailored to different document types.  The package integrates
 numerous commonly used LaTeX packages, which significantly reduces the need
 for extensive preambles and minimizes compatibility issues.  Additionally, it
 is multilingual, supporting French, English, and German.")
-    (license license:lppl1.3c)))
+      (license license:lppl1.3c))))
 
 (define-public texlive-nevelok
   (package

gnu/packages/text-editors.scm

@@ -882,6 +882,7 @@ compiled, requires few libraries, and starts up quickly.")
        (uri (git-reference
               (url "https://codeberg.org/museoa/e3editor")
               (commit version)))
+       (file-name (git-file-name name version))
        (sha256
         (base32
          "1l57rxin3kv6iiw91rhjzl3bpk0gkfp3nrx7wmqikk1nycmkfbhm"))))

gnu/packages/web.scm

@@ -8736,6 +8736,41 @@ provides a very convenient API for extracting and manipulating data, using the
 best of DOM, CSS, and jQuery-like methods.")
     (license license:expat)))
 
+(define-public java-jsoup-1.15.3
+  (package
+    (inherit java-jsoup)
+    (name "java-jsoup")
+    (version "1.15.3")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/jhy/jsoup.git")
+             (commit (string-append "jsoup-" version))))
+       (file-name (git-file-name "java-jsoup" version))
+       (sha256
+        (base32 "1rp35w2138qkmpy7q7sn7yx50v3ks4dabd6ij50i9258yx38x3v9"))))
+    (arguments
+     `(#:jar-name "jsoup.jar"
+       #:source-dir "src/main/java"
+       #:tests? #f
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'build 'copy-resources
+           (lambda _
+             (let ((classes-dir (string-append (getcwd) "/build/classes")))
+               (with-directory-excursion "src/main/java"
+                 (for-each (lambda (file)
+                             (let ((dist (string-append classes-dir "/" file)))
+                               (mkdir-p (dirname dist))
+                               (copy-file file dist)))
+                           (find-files "." ".*\\.properties"))))
+             #t))
+         (replace 'install
+           (install-from-pom "pom.xml")))))
+    (inputs
+     (list java-jsr305))))
+
 (define-public java-signpost-core
   (package
     (name "java-signpost-core")

gnu/packages/wm.scm

@@ -2512,7 +2512,7 @@ limited size and a few external dependencies.  It is configurable via
 (define-public mangowm
   (package
     (name "mangowm")
-    (version "0.12.8")
+    (version "0.12.9")
     (source
      (origin
        (method git-fetch)
@@ -2521,7 +2521,7 @@ limited size and a few external dependencies.  It is configurable via
               (commit version)))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1jfm3kd2iscwfxhflmq8mdph64rd26jc6ps0sqmf0y9ysagqbnlk"))))
+        (base32 "0iczd26gcj0azcl7gj34r6n1w4jx29ziqx3q166znhz7lrbdxzj4"))))
     (build-system meson-build-system)
     (arguments
      (list

gnu/packages/zwave.scm

@@ -116,7 +116,7 @@ knowledge of the Z-Wave protocol.")
            (lambda _
              (substitute* "binding.gyp"
                (("std=c\\+\\+11")
-                "std=c++17"))))
+                "std=c++20"))))
          (replace 'build
            ;; For some reason, `npm install` doesn't build
            ;; the addon automatically, so we do it explicitly here.

guix/build-system/node.scm

@@ -30,10 +30,16 @@
   #:use-module (guix search-paths)
   #:use-module (guix build-system)
   #:use-module (guix build-system gnu)
-  #:export (%node-build-system-modules
+  #:export (%default-lockfiles
+            %node-build-system-modules
             node-build
             node-build-system))
 
+(define %default-lockfiles
+  (list "package-lock.json"
+        "yarn.lock"
+        "npm-shrinkwrap.json"))
+
 (define %node-build-system-modules
   ;; Build-side modules imported by default.
   `((guix build node-build-system)
@@ -47,6 +53,10 @@
   "Return the default Node package, resolved lazily."
   (@* (gnu packages node) node-lts))
 
+(define (default-guile-json)
+  "Return the default guile-json package, resolved lazily."
+  (@* (gnu packages guile) guile-json-4))
+
 (define* (lower name
                 #:key source inputs native-inputs outputs system target
                 (node (default-node))
@@ -78,17 +88,12 @@
          (build node-build)
          (arguments (strip-keyword-arguments private-keywords arguments)))))
 
-(define (default-guile-json)
-  "Return the default guile-json package."
-  ;; Lazily resolve the binding to avoid a circular dependency.
-  (let ((mod (resolve-interface '(gnu packages guile))))
-    (module-ref mod 'guile-json-4)))
-
 (define* (node-build name inputs
                      #:key
                      source
                      (npm-flags ''())
                      (test-target "test")
+                     (lockfiles %default-lockfiles)
                      (tests? #t)
                      (phases '%standard-phases)
                      (outputs '("out"))
@@ -110,6 +115,7 @@
                         #:system #$system
                         #:npm-flags #$npm-flags
                         #:test-target #$test-target
+                        #:lockfiles '#$lockfiles
                         #:tests? #$tests?
                         #:phases #$phases
                         #:outputs #$(outputs->gexp outputs)

guix/build-system/tree-sitter.scm

@@ -105,6 +105,7 @@
                             source
                             (phases '%standard-phases)
                             (grammar-directories '("."))
+                            (lockfiles %default-lockfiles)
                             (tests? #t)
                             (outputs '("out" "js"))
                             (search-paths '())
@@ -123,6 +124,7 @@
                                #:source #+source
                                #:system #$system
                                #:phases #$phases
+                               #:lockfiles '#$lockfiles
                                #:tests? #$tests?
                                #:grammar-directories '#$grammar-directories
                                #:outputs #$(outputs->gexp outputs)
@@ -145,6 +147,7 @@
                                   guile source
                                   (phases '%standard-phases)
                                   (grammar-directories '("."))
+                                  (lockfiles %default-lockfiles)
                                   (tests? #t)
                                   (outputs '("out" "js"))
                                   (search-paths '())
@@ -179,6 +182,7 @@
                                #:build #$build
                                #:target #$target
                                #:phases #$phases
+                               #:lockfiles '#$lockfiles
                                #:tests? #$tests?
                                #:grammar-directories '#$grammar-directories
                                #:outputs #$(outputs->gexp outputs)

guix/build/node-build-system.scm

@@ -5,6 +5,7 @@
 ;;; Copyright © 2021, 2022 Philip McGrath <philip@philipmcgrath.com>
 ;;; Copyright © 2022 Liliana Marie Prikler <liliana.prikler@gmail.com>
 ;;; Copyright © 2024 Daniel Khodabakhsh <d.khodabakhsh@gmail.com>
+;;; Copyright © 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -29,6 +30,7 @@
   #:use-module (ice-9 match)
   #:use-module (json)
   #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-26)
   #:use-module (srfi srfi-71)
   #:export (%standard-phases
             delete-dependencies
@@ -40,34 +42,6 @@
             replace-fields
             with-atomic-json-file-replacement))
 
-(define* (assoc-ref* alist key #:optional default)
-  "Like assoc-ref, but return DEFAULT instead of #f if no value exists."
-  (match (assoc key alist)
-    (#f default)
-    ((_ . value) value)))
-
-(define* (alist-pop alist key #:optional (= equal?))
-  "Return two values, the first pair in ALIST with key KEY, and the other
-elements.  Equality calls are made as (= KEY ALISTCAR)."
-  (define (found? pair)
-    (= key (car pair)))
-
-  (let ((before after (break found? alist)))
-    (if (pair? after)
-        (values (car after) (append before (cdr after)))
-        (values #f before))))
-
-(define* (alist-update alist key proc #:optional (= equal?))
-  "Return an association list like ALIST, but with KEY mapped to the result of
-PROC applied to the first value found under the comparison (= KEY ALISTCAR).
-If no such value exists, return the list unchanged.
-Unlike acons, this removes the previous association of KEY (assuming it is
-unique), but the result may still share storage with ALIST."
-  (let ((pair rest (alist-pop alist key =)))
-    (if (pair? pair)
-      (acons key (proc (cdr pair)) rest)
-      alist)))
-
 ;;;
 ;;; package.json modification procedures
 ;;;
@@ -106,23 +80,19 @@ listed in 'dependencies-to-remove', a list of strings naming npm packages.
 
 To prevent the deleted dependencies from being reintroduced, use this function
 only after the 'patch-dependencies' phase."
-  (lambda (pkg-meta)
-    (fold
-      (lambda (dependency-key pkg-meta)
-        (alist-update
-          pkg-meta
-          dependency-key
-          (lambda (dependencies)
-            (remove
-              (lambda (dependency)
-                (member (car dependency) dependencies-to-remove))
-              dependencies))))
-      pkg-meta
-      (list
-        "devDependencies"
-        "dependencies"
-        "peerDependencies"
-        "optionalDependencies"))))
+  (let ((predicate (lambda (dependency)
+                     (member (car dependency) dependencies-to-remove)))
+        (dependency? (cut member <> (list "devDependencies"
+                                          "dependencies"
+                                          "peerDependencies"
+                                          "optionalDependencies"))))
+    (lambda (pkg-meta)
+      (map (match-lambda
+             (((? dependency? key) . dependencies)
+              (cons key (remove predicate dependencies)))
+             (otherwise
+              otherwise))
+           pkg-meta))))
 
 (define* (modify-json-fields
     fields
@@ -236,8 +206,7 @@ only after the 'patch-dependencies' phase."
             (begin
               (mkdir dir)
               (setenv "HOME" (string-append (getcwd) "/" dir))
-              (format #t "set HOME to ~s~%" (getenv "HOME")))))))
-  #t)
+              (format #t "set HOME to ~s~%" (getenv "HOME"))))))))
 
 (define (module-name module)
   (let* ((package.json (string-append module "/package.json"))
@@ -257,67 +226,65 @@ only after the 'patch-dependencies' phase."
     (for-each (lambda (dir)
                 (let ((nm (string-append dir "/lib/node_modules")))
                   (for-each (lambda (module)
-                              (hash-set! index (module-name module) module))
+                              (hash-set! index (module-name module)
+                                         (string-append "file://" module)))
                             (list-modules nm))))
               input-paths)
     index))
 
 (define* (patch-dependencies #:key inputs #:allow-other-keys)
+  "Replace versions by paths when found among INPUTS in `package.json'."
 
-  (define index (index-modules (map cdr inputs)))
+  (define resolve-dependencies
+    (let ((index (index-modules (map cdr inputs))))
+      (cut map
+           (match-lambda
+             ((dependency . version)
+              (cons dependency (hash-ref index dependency version))))
+           <>)))
 
-  (define (resolve-dependencies dependencies)
-    (map
-      (match-lambda
-        ((dependency . version)
-          (cons dependency (hash-ref index dependency version))))
-      dependencies))
-
-  (with-atomic-json-file-replacement
+  (define (resolve key getter)
     (lambda (pkg-meta)
-      (fold
-        (lambda (proc pkg-meta) (proc pkg-meta))
-        pkg-meta
-        (list
-          (lambda (pkg-meta)
-            (alist-update pkg-meta "devDependencies" resolve-dependencies))
-          (lambda (pkg-meta)
-            (assoc-set!
-              pkg-meta
-              "dependencies"
-              (resolve-dependencies
-                ; Combined "peerDependencies" and "dependencies" dependencies
-                ; with "dependencies" taking precedent.
-                (fold
-                  (lambda (dependency dependencies)
-                    (assoc-set! dependencies (car dependency) (cdr dependency)))
-                  (assoc-ref* pkg-meta "peerDependencies" '())
-                  (assoc-ref* pkg-meta "dependencies" '())))))))))
-  #t)
+      (assoc-set! pkg-meta key
+                  (resolve-dependencies (getter pkg-meta)))))
 
-(define* (delete-lockfiles #:key inputs #:allow-other-keys)
-  "Delete 'package-lock.json', 'yarn.lock', and 'npm-shrinkwrap.json', if they
-exist."
+  (modify-json
+   (resolve "devDependencies"
+            (lambda (pkg-meta)
+              (or (assoc-ref pkg-meta "devDependencies") '())))
+   (resolve "dependencies"
+            ;; Combined "peerDependencies" and "dependencies" dependencies
+            ;; with "dependencies" taking precedent.
+            (lambda (pkg-meta)
+              (fold
+               (lambda (dependency dependencies)
+                 (assoc-set! dependencies
+                             (car dependency) (cdr dependency)))
+               (or (assoc-ref pkg-meta "peerDependencies") '())
+               (or (assoc-ref pkg-meta "dependencies") '()))))))
+
+(define* (delete-lockfiles #:key lockfiles #:allow-other-keys)
+  "Delete LOCKFILES if they exist."
   (for-each (lambda (pth)
               (when (file-exists? pth)
                 (delete-file pth)))
-            '("package-lock.json"
-              "yarn.lock"
-              "npm-shrinkwrap.json"))
-  #t)
+            lockfiles))
 
-(define* (configure #:key outputs inputs #:allow-other-keys)
+(define* (configure #:key inputs #:allow-other-keys)
   (let ((npm (string-append (assoc-ref inputs "node") "/bin/npm")))
-    (invoke npm "--offline" "--ignore-scripts" "--install-links" "install")
-    #t))
+    (invoke npm "--offline"
+            "--ignore-scripts"
+            "--install-links"
+            "--no-audit"
+            "install")))
 
 (define* (build #:key inputs #:allow-other-keys)
-  (let ((package-meta (call-with-input-file "package.json" json->scm)))
-    (if (assoc-ref* (assoc-ref* package-meta "scripts" '()) "build" #f)
+  (let* ((package-meta (call-with-input-file "package.json" json->scm))
+         (scripts (assoc-ref package-meta "scripts")))
+    (if (and scripts (assoc-ref scripts "build"))
         (let ((npm (string-append (assoc-ref inputs "node") "/bin/npm")))
           (invoke npm "run" "build"))
-        (format #t "there is no build script to run~%"))
-    #t))
+        (format #t "there is no build script to run~%"))))
 
 (define* (check #:key tests? inputs test-target #:allow-other-keys)
   "Run 'npm run TEST-TARGET' if TESTS?"
@@ -334,8 +301,7 @@ exist."
           "--owner=0"
           "--group=0"
           "--numeric-owner"
-          "-czf" "../package.tgz" ".")
-  #t)
+          "-czf" "../package.tgz" "."))
 
 (define* (install #:key outputs inputs #:allow-other-keys)
   "Install the node module to the output store item."
@@ -347,8 +313,7 @@ exist."
             "--loglevel" "info"
             "--production"
             "--install-links"
-            "install" "../package.tgz")
-    #t))
+            "install" "../package.tgz")))
 
 (define* (avoid-node-gyp-rebuild #:key outputs #:allow-other-keys)
   "Adjust the installed 'package.json' to remove an 'install' script that
@@ -376,28 +341,25 @@ would try to run 'node-gyp rebuild'."
   ;; For further details, see:
   ;; - https://docs.npmjs.com/cli/v8/configuring-npm/package-json#default-values
   ;; - https://docs.npmjs.com/cli/v8/using-npm/scripts#best-practices
-  (define installed-package.json
-    (search-input-file outputs (string-append "/lib/node_modules/"
-                                              (module-name ".")
-                                              "/package.json")))
-  ;; We don't want to use an atomic replacement here, because we often don't
-  ;; even need to overwrite this file.  Therefore, let's use some helpers
-  ;; that we'd otherwise not need.
-  (define pkg-meta
-    (call-with-input-file installed-package.json json->scm))
-  (define scripts
-    (assoc-ref* pkg-meta "scripts" '()))
-
-  (when (equal? "node-gyp rebuild" (assoc-ref* scripts "install" #f))
-    (call-with-output-file installed-package.json
-      (lambda (out)
-        (scm->json
-          (assoc-set! pkg-meta
-                      "scripts"
-                      (assoc-set! scripts
-                                  "install"
-                                  "echo Guix: avoiding node-gyp rebuild"))
-          out)))))
+  (let* ((installed-package.json
+          (search-input-file outputs (string-append "/lib/node_modules/"
+                                                    (module-name ".")
+                                                    "/package.json")))
+         ;; We don't want to use an atomic replacement here, because we often
+         ;; don't even need to overwrite this file.  Therefore, let's use some
+         ;; helpers that we'd otherwise not need.
+         (pkg-meta (call-with-input-file installed-package.json json->scm))
+         (scripts (or (assoc-ref pkg-meta "scripts") '())))
+    (when (equal? "node-gyp rebuild" (assoc-ref scripts "install"))
+      (call-with-output-file installed-package.json
+        (lambda (out)
+          (scm->json
+           (assoc-set! pkg-meta
+                       "scripts"
+                       (assoc-set! scripts
+                                   "install"
+                                   "echo Guix: avoiding node-gyp rebuild"))
+           out))))))
 
 (define %standard-phases
   (modify-phases gnu:%standard-phases