gnu: node-lts: Update to 24.14.1.

* gnu/packages/node.scm (node-lts): Update to 24.14.1.

Change-Id: I60457e8e8e05e0102feb450655113ba410bd7667

.guix-authorizations

@@ -16,6 +16,8 @@
   ( ;; primary: "D0C2 EAC1 3310 822D 98DE  B57C E9C5 A2D9 0898 A02F"
    "01FD 85F4 1A7B 7F82 0583  06A5 935E BE07 36DC 857E"
    (name "avp"))
+  ("5D54 CF25 57B2 38E8 8DC1  80A2 2D22 3241 0AB7 4043"
+   (name "baleine"))
   ( ;; primary: "34FF 38BC D151 25A6 E340  A0B5 3453 2F9F AFCA 8B8E"
    "A3A4 B419 0074 087C A7DE  5698 BC45 CA67 E2F8 D007"
    (name "bavier"))

CODEOWNERS

@@ -264,6 +264,7 @@ gnu/installer(\.scm$|/)                            @guix/installer
 gnu/packages/clojure\.scm                          @guix/java
 gnu/packages/java(-.+|)\.scm$                      @guix/java
 gnu/packages/maven(-.+|)\.scm$                     @guix/java
+gnu/packages/netbeans\.scm                         @guix/java
 guix/build/ant-build-system\.scm                   @guix/java
 guix/build/clojure-build-system\.scm               @guix/java
 guix/build/clojure-utils\.scm                      @guix/java
@@ -274,6 +275,7 @@ guix/build-system/ant\.scm                         @guix/java
 guix/build-system/clojure\.scm                     @guix/java
 guix/build-system/maven\.scm                       @guix/java
 
+gnu/packages/javascript\.scm                       @guix/javascript
 gnu/packages/node-xyz\.scm                         @guix/javascript
 gnu/packages/node\.scm                             @guix/javascript
 guix/build-system/node\.scm                        @guix/javascript

Makefile.am

@@ -457,6 +457,8 @@ AUX_FILES =						\
   gnu/packages/aux-files/findclass.php			\
   gnu/packages/aux-files/guix.vim			\
   gnu/packages/aux-files/guix-nvim.vim			\
+  gnu/packages/aux-files/linux-libre/7.0-arm64.conf	\
+  gnu/packages/aux-files/linux-libre/7.0-x86_64.conf	\
   gnu/packages/aux-files/linux-libre/6.19-arm64.conf	\
   gnu/packages/aux-files/linux-libre/6.19-i686.conf	\
   gnu/packages/aux-files/linux-libre/6.19-x86_64.conf	\

doc/guix-cookbook.texi

@@ -3256,8 +3256,8 @@ your Linode Summary section.) Now you can run the "install guix from
 
 @example
 sudo apt-get install gpg
-wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
+wget https://codeberg.org/efraim.gpg -qO - | gpg --import -
-wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
+wget https://guix.gnu.org/guix-install.sh
 chmod +x guix-install.sh
 ./guix-install.sh
 guix pull
@@ -3436,7 +3436,7 @@ Now you can run the "install guix from @pxref{Binary Installation,,,
 guix, GNU Guix}" steps:
 
 @example
-wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
+wget https://guix.gnu.org/guix-install.sh
 chmod +x guix-install.sh
 ./guix-install.sh
 guix pull
@@ -4491,7 +4491,7 @@ network.  Assuming your interface is named @samp{enp2s0}, the following
 command can be used to do so:
 
 @example sh
-# nmcli con add type bridge-slave ifname enp2s0 master br0
+# nmcli con add type bridge-slave autoconnect yes ifname enp2s0 master br0
 @end example
 
 @quotation Important
@@ -4527,8 +4527,8 @@ bridge interface, as the default is to deny all.  Add the following to
 your list of services to do so:
 
 @example lisp
-(extra-special-file "/etc/qemu/host.conf"
+(extra-special-file "/etc/qemu/bridge.conf"
-                    (plain-file "host.conf" "allow br0\n"))
+                    (plain-file "bridge.conf" "allow br0\n"))
 @end example
 
 @subsection Invoking QEMU with the right command line options
@@ -4546,7 +4546,7 @@ machine making use of the bridge would cause networking issues.
 @example sh
 $ qemu-system-x86_64 [...] \
     -device virtio-net-pci,netdev=user0,mac=XX:XX:XX:XX:XX:XX \
-    -netdev bridge,id=user0,br=br0 \
+    -netdev bridge,helper=/run/privileged/bin/qemu-bridge-helper,id=user0,br=br0 \
     [...]
 @end example
 

doc/guix.texi

@@ -10,8 +10,8 @@
 @include version.texi
 
 @c Identifier of the OpenPGP key used to sign tarballs and such.
-@set OPENPGP-SIGNING-KEY-ID 3CE464558A84FDC69DB40CFB090B11993D9AEBB5
+@set OPENPGP-SIGNING-KEY-ID A28BF40C3E551372662D14F741AAE7DCCA3D8351
-@set OPENPGP-SIGNING-KEY-URL https://sv.gnu.org/people/viewgpg.php?user_id=15145
+@set OPENPGP-SIGNING-KEY-URL https://codeberg.org/efraim.gpg
 
 @c Base URL for downloads.
 @set BASE-URL https://ftpmirror.gnu.org/gnu/guix
@@ -2658,12 +2658,13 @@ bootloaders.
 
 Once you are done partitioning the target hard disk drive, you have to
 create a file system on the relevant partition(s)@footnote{Currently
-Guix System supports only ext4, btrfs, bcachefs, JFS, F2FS, and XFS
+Guix System can mount only ext4, btrfs, JFS, F2FS, and XFS file systems
-file systems.  In particular, code that reads file system UUIDs and
+at boot time.  In particular, code that reads file system UUIDs and
-labels works only for these file system types.  For bcachefs, also add
+labels works only for these file system types.  The code for bcachefs is
-the @code{bcachefs-linux-module} to your @code{operating-system}'s
+in place, but support for loading out-of-tree kernel modules in the
-@code{initrd-modules}.}.  For the ESP, if you have one and assuming it is
+initrd is not.}.
-@file{/dev/sda1}, run:
+
+For the ESP, if you have one and assuming it is @file{/dev/sda1}, run:
 
 @example
 mkfs.fat -F32 /dev/sda1
@@ -6590,6 +6591,21 @@ directory within the container.  If this is undesirable,
 be automatically shared and will change to the user's home directory
 within the container instead.  See also @option{--user}.
 
+@item --cwd=@var{directory}
+For containers, change to @var{directory} inside the container instead
+of the default location.  The default location is the current working
+directory when @option{--no-cwd} is not used, or the user's home
+directory when @option{--no-cwd} is used.  When @var{directory} is a
+relative file name, it is interpreted relative to the current working
+directory on the host.  Note that @option{--cwd} does not automatically
+share @var{directory}---you must ensure it is accessible via the default
+current directory sharing or explicit @option{--share}/@option{--expose}
+options.  For example:
+
+@example
+guix shell --container --cwd=/tmp --share=/tmp coreutils
+@end example
+
 @item --writable-root
 When using @option{--container}, this option makes the root file system
 writable (it is read-only by default).
@@ -7091,6 +7107,17 @@ directory within the container.  If this is undesirable,
 be automatically shared and will change to the user's home directory
 within the container instead.  See also @option{--user}.
 
+@item --cwd=@var{directory}
+For containers, change to @var{directory} inside the container instead
+of the default location.  The default location is the current working
+directory when @option{--no-cwd} is not used, or the user's home
+directory when @option{--no-cwd} is used.  When @var{directory} is a
+relative file name, it is interpreted relative to the current working
+directory on the host.  Note that @option{--cwd} does not automatically
+share @var{directory}---you must ensure it is accessible via the default
+current directory sharing or explicit @option{--share}/@option{--expose}
+options.
+
 @item --expose=@var{source}[=@var{target}]
 @itemx --share=@var{source}[=@var{target}]
 For containers, @option{--expose} (resp. @option{--share}) exposes the
@@ -19215,7 +19242,7 @@ Partitioning}, for an example.
 
 When using GRUB as the bootloader, the LUKS password is only requested
 once: GRUB passes the master key to the initial RAM disk automatically.
-@xref{Bootloader Configuration, Automatic LUKS Master Key Passing}, for
+@xref{grub-luks-root-device-key, Automatic LUKS Master Key Passing}, for
 details.
 
 @end defvar
@@ -45250,6 +45277,12 @@ Extra command line options for @code{guix-data-service}.
 @item @code{extra-process-jobs-options} (default: @var{'()})
 Extra command line options for @code{guix-data-service-process-jobs}.
 
+@item @code{extra-environment-variables} (default: @var{'()})
+Extra environment variables for @code{guix-data-service}.
+
+@item @code{extra-process-jobs-environment-variables} (default: @var{'()})
+Extra environment variables for @code{guix-data-service-process-jobs}.
+
 @item @code{git-repositories} (default: @var{#f})
 List of git-repository information to insert into the database.
 
@@ -48959,8 +48992,28 @@ This option in enabled by default.  In some cases involving the
 in RAM, it can be handy to disable the option by setting it to
 @code{#f}.
 
-@subsubheading Automatic LUKS Master Key Passing
+@item @code{extra-initrd} (default: @code{#f})
+File name of an additional initrd to load during the boot.  It may or
+may not point to a file in the store, but the main use case is for
+out-of-store files containing secrets.
 
+For any use case not involving secrets, you should use regular initrd
+(@pxref{operating-system Reference, @code{initrd}}) instead.
+
+Be careful when using this option, since pointing to a file that is not
+readable by the grub while booting will cause the boot to fail and
+require a manual edit of the initrd line in the grub menu.
+
+Currently only supported by GRUB.
+@end table
+
+@end deftp
+
+@anchor{grub-luks-root-device-key}
+@unnumberedsubsec Automatic LUKS Master Key Passing
+
+@cindex LUKS, root file system encryption
+@cindex passphrase, for LUKS-encrypted root
 When booting from a LUKS-encrypted device using GRUB, the password is
 normally requested twice: once by GRUB to access @file{/boot}, and a
 second time by the initial RAM disk to mount the root file system.
@@ -49001,22 +49054,7 @@ No configuration is required: GRUB's @code{procfs} and @code{luks}
 modules are loaded automatically when encrypted devices are declared
 via @code{luks-device-mapping} (@pxref{Mapped Devices}).
 
-@item @code{extra-initrd} (default: @code{#f})
+@unnumberedsubsec Additional Boot Entries
-File name of an additional initrd to load during the boot.  It may or
-may not point to a file in the store, but the main use case is for
-out-of-store files containing secrets.
-
-For any use case not involving secrets, you should use regular initrd
-(@pxref{operating-system Reference, @code{initrd}}) instead.
-
-Be careful when using this option, since pointing to a file that is not
-readable by the grub while booting will cause the boot to fail and
-require a manual edit of the initrd line in the grub menu.
-
-Currently only supported by GRUB.
-@end table
-
-@end deftp
 
 @cindex dual boot
 @cindex boot menu
@@ -49145,9 +49183,13 @@ example of chainloading a different GNU/Linux system.
 @end table
 @end deftp
 
+@unnumberedsubsec Themes
+
 @cindex HDPI
 @cindex HiDPI
 @cindex resolution
+@cindex themes, for GRUB
+@cindex bootloader themes
 @c FIXME: Write documentation once it's stable.
 For now only GRUB has theme support.  GRUB themes are created using
 the @code{grub-theme} form, which is not fully documented yet.
@@ -49167,7 +49209,7 @@ Return the default GRUB theme used by the operating system if no
 @code{theme} field is specified in @code{bootloader-configuration}
 record.
 
-It comes with a fancy background image displaying the GNU and Guix
+It comes with a fancy background image displaying the Guix
 logos.
 @end deffn
 
@@ -49542,7 +49584,7 @@ how to generate an image that uses the @code{grub-efi-bootloader}
 bootloader and boot it with QEMU:
 
 @example
-image=$(guix system image --image-type=qcow2 \
+image=$(guix system image --image-type=qcow2-gpt \
         gnu/system/examples/lightweight-desktop.tmpl)
 cp $image /tmp/my-image.qcow2
 chmod +w /tmp/my-image.qcow2

etc/teams.scm

@@ -828,6 +828,7 @@ and the maven-build-system."
               (make-regexp* "^gnu/packages/java(-.+|)\\.scm$")
               ;; Match maven.scm and maven-*.scm
               (make-regexp* "^gnu/packages/maven(-.+|)\\.scm$")
+              "gnu/packages/netbeans.scm"
               "guix/build/ant-build-system.scm"
               "guix/build/clojure-build-system.scm"
               "guix/build/clojure-utils.scm"
@@ -844,7 +845,8 @@ and the maven-build-system."
         #:name "JavaScript team"
         #:description
         "JavaScript/Node.js packages, the node build system."
-        #:scope (list "gnu/packages/node-xyz.scm"
+        #:scope (list "gnu/packages/javascript.scm"
+                      "gnu/packages/node-xyz.scm"
                       "gnu/packages/node.scm"
                       "guix/build-system/node.scm"
                       "guix/build/node-build-system.scm"
@@ -1637,7 +1639,7 @@ the \"texlive\" importer."
 (define-member (person "Thanos Apollo"
                        "public@thanosapollo.org"
                        "thanosapollo")
-  vcs)
+  vcs emacs)
 
 (define-member (person "Ashish SHUKLA"
                        "ashish.is@lostca.se"
@@ -1659,6 +1661,11 @@ the \"texlive\" importer."
                        "tok")
   electronics)
 
+(define-member (person "gemmaro"
+                       "gemmaro.dev@gmail.com"
+                       "gemmaro")
+  ruby)
+
 
 (define (find-team name)
   (or (hash-ref %teams (string->symbol name))

gnu/build/file-systems.scm

@@ -1226,10 +1226,12 @@ file name or an nfs-root containing ':/')."
 
   (match spec
     ((? string?)
-     (if (string-prefix? "/dev/" spec)
+     (if (string-match "^/dev/[a-zA-Z0-9]+$" spec)
          ;; Nothing to do, but wait until SPEC shows up.
          (resolve device-exists? spec identity)
-         spec)) ; do not resolve NFS / CIFS / tmpfs devices
+         ;; Do not resolve NFS / CIFS / tmpfs devices
+         ;; or bcachefs multi-device specifications.
+         spec))
     ((? file-system-label?)
      ;; Resolve the label.
      (resolve find-partition-by-label

gnu/build/linux-container.scm

@@ -445,10 +445,14 @@ load path must be adjusted as needed."
           ;; Behave like an init process: create a sub-process that calls
           ;; THUNK, and wait for child processes.  Furthermore, forward
           ;; RELAYED-SIGNALS to the child process.
-          (match (primitive-fork)
+          ;; We presently use `safe-clone` here due to a bug in the interaction
-            (0
+          ;; between Guix and `primitive-fork` in Guile 3.0.11:
+          ;; https://codeberg.org/guix/guix/issues/7690#issuecomment-12744123
+          (safe-clone
+            SIGCHLD
+            (lambda ()
              (call-with-clean-exit thunk))
-            (pid
+            (lambda (pid)
              (install-signal-handlers pid)
              (let loop ()
                (match (wait-child-process)

gnu/local.mk

@@ -57,7 +57,7 @@
 # Copyright © 2022 ( <paren@disroot.org>
 # Copyright © 2022, 2026 jgart <jgart@dismail.de>
 # Copyright © 2022-2023, 2025-2026 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
-# Copyright © 2023-2025 Zheng Junjie <z572@z572.online>
+# Copyright © 2023-2026 Zheng Junjie <z572@z572.online>
 # Copyright © 2023 Ivana Drazovic <iv.dra@hotmail.com>
 # Copyright © 2023 Andy Tai <atai@atai.org>
 # Copyright © 2023 B. Wilson <elaexuotee@wilsonb.com>
@@ -502,6 +502,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/myrddin.scm			\
   %D%/packages/ncdu.scm				\
   %D%/packages/ncurses.scm			\
+  %D%/packages/netbeans.scm			\
   %D%/packages/netpbm.scm			\
   %D%/packages/nettle.scm			\
   %D%/packages/networking.scm			\
@@ -1093,6 +1094,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/catdoc-CVE-2017-11110.patch		\
   %D%/packages/patches/chez-irregex-import-cond-expand.patch	\
   %D%/packages/patches/chez-scheme-bin-sh.patch			\
+  %D%/packages/patches/cianna-remove-error-for-missing-cuda.patch		\
   %D%/packages/patches/circos-remove-findbin.patch		\
   %D%/packages/patches/cdparanoia-fpic.patch			\
   %D%/packages/patches/cdrkit-libre-cross-compile.patch	\
@@ -1178,6 +1180,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/curlftpfs-fix-no_verify_hostname.patch	\
   %D%/packages/patches/cursynth-wave-rand.patch			\
   %D%/packages/patches/cvc5-reproducible-build.patch		\
+  %D%/packages/patches/cvc5-symfpu-compatibility.patch		\
   %D%/packages/patches/cvs-CVE-2017-12836.patch		\
   %D%/packages/patches/cyrus-sasl-fix-time-h.patch              \
   %D%/packages/patches/d-feet-drop-unused-meson-argument.patch	\
@@ -1240,7 +1243,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/python-treelib-remove-python2-compat.patch	\
   %D%/packages/patches/elm-offline-package-registry.patch	\
   %D%/packages/patches/elm-reactor-static-files.patch		\
-  %D%/packages/patches/emacs-buttercup-1.38-native-comp-spy-on-trampoline-scope.patch	\
+  %D%/packages/patches/emacs-agent-shell-fix-tests.patch        \
   %D%/packages/patches/emacs-deferred-fix-number-of-arguments.patch	\
   %D%/packages/patches/emacs-disable-jit-compilation.patch			\
   %D%/packages/patches/emacs-doc-toc-shell-commands.patch	\
@@ -1675,6 +1678,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/java-commons-collections-fix-java8.patch \
   %D%/packages/patches/java-guava-remove-annotation-deps.patch \
   %D%/packages/patches/java-jeromq-fix-tests.patch		\
+  %D%/packages/patches/java-jtidy-remove-xerces-dependency.patch	\
   %D%/packages/patches/java-openjfx-build-jdk_version.patch     \
   %D%/packages/patches/java-powermock-fix-java-files.patch		\
   %D%/packages/patches/java-simple-xml-fix-tests.patch		\
@@ -1683,6 +1687,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/java-xerces-build_dont_unzip.patch	\
   %D%/packages/patches/java-xerces-xjavac_taskdef.patch	\
   %D%/packages/patches/jbr-17-xcursor-no-dynamic.patch	\
+  %D%/packages/patches/jbr-25-wayland-drag-icon.patch	\
+  %D%/packages/patches/jbr-25-wayland-intra-jvm-dnd.patch	\
   %D%/packages/patches/jdk-currency-time-bomb.patch		\
   %D%/packages/patches/jdk-currency-time-bomb2.patch		\
   %D%/packages/patches/jfsutils-add-sysmacros.patch		\
@@ -1713,7 +1719,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/libretro-dolphin-emu-libusb-assert.patch \
   %D%/packages/patches/libretro-dolphin-emu-vulkan-headers.patch        \
   %D%/packages/patches/libretranslate-use-flasgger.patch	\
-  %D%/packages/patches/librewolf-150.0-encoding_rs-rust-fix.patch       \
   %D%/packages/patches/librewolf-add-store-to-rdd-allowlist.patch       \
   %D%/packages/patches/librewolf-compare-paths.patch		\
   %D%/packages/patches/librewolf-neuter-locale-download.patch	\
@@ -1975,6 +1980,11 @@ dist_patch_DATA =						\
   %D%/packages/patches/netcdf-date-time.patch			\
   %D%/packages/patches/netdde-build-fix.patch			\
   %D%/packages/patches/netdde-csum.patch			\
+  %D%/packages/patches/java-apache-xml-commons-resolver-1.2-netbeans.patch \
+  %D%/packages/patches/java-simplevalidation-1.14.1.patch	\
+  %D%/packages/patches/netbeans-25-nativeexecution-paths.patch \
+  %D%/packages/patches/netbeans-25-terminal-no-login-shell.patch \
+  %D%/packages/patches/netbeans-25-source-only-build.patch	\
   %D%/packages/patches/netpbm-CVE-2017-2586.patch		\
   %D%/packages/patches/netpbm-CVE-2017-2587.patch		\
   %D%/packages/patches/netsurf-message-timestamp.patch		\
@@ -2069,6 +2079,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/open-zwave-hidapi.patch			\
   %D%/packages/patches/opusfile-CVE-2022-47021.patch		\
   %D%/packages/patches/orbit2-fix-array-allocation-32bit.patch \
+  %D%/packages/patches/orca-fix-gst-init-check-call.patch \
   %D%/packages/patches/orpheus-cast-errors-and-includes.patch	\
   %D%/packages/patches/ots-no-include-missing-file.patch	\
   %D%/packages/patches/owncloud-disable-updatecheck.patch	\
@@ -2171,6 +2182,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/perl-www-curl-remove-symbol.patch	\
   %D%/packages/patches/perl-xml-libxml-fix-function-prototypes.patch	\
   %D%/packages/patches/phoronix-test-suite-fsdg.patch		\
+  %D%/packages/patches/php-01-fix-expired-certificate.patch	\
+  %D%/packages/patches/php-02-fix-sni-tests.patch		\
   %D%/packages/patches/picprog-non-intel-support.patch		\
   %D%/packages/patches/pidgin-add-search-path.patch		\
   %D%/packages/patches/pinball-system-ltdl.patch		\
@@ -2349,8 +2362,16 @@ dist_patch_DATA =						\
   %D%/packages/patches/renpy-fix-integer-slots.patch			\
   %D%/packages/patches/reposurgeon-add-missing-docbook-files.patch	\
   %D%/packages/patches/rdkit-unbundle-external-dependencies.patch	\
+  %D%/packages/patches/r-biostrings-r4.6.0-compat.patch		\
+  %D%/packages/patches/r-h5mread-0001-h5mread-1.3.2-Get-rid-of-non-API-calls-to-R.patch \
   %D%/packages/patches/r-httpuv-1.6.6-unvendor-libuv.patch	\
+  %D%/packages/patches/r-mscoreutils-0001-fix-non-API-call-to-R-SETLENGTH-by-using-lengthgets.patch \
+  %D%/packages/patches/r-rsamtools-r-4.6.0-compat.patch		\
+  %D%/packages/patches/r-snpstats-0001-fixed-non-API-except-for-IS_S4_OBJECT.patch \
+  %D%/packages/patches/r-snpstats-0002-fixed-IS_S4_OBJECT.patch \
   %D%/packages/patches/r-sapa-lapack.patch			\
+  %D%/packages/patches/r-shortread-0001-ShortRead-1.69.3-Get-rid-of-non-API-calls-to-R.patch \
+  %D%/packages/patches/r-sparsearray-r-4.6.0-compat.patch	\
   %D%/packages/patches/ripperx-missing-file.patch		\
   %D%/packages/patches/rpcbind-CVE-2017-8779.patch		\
   %D%/packages/patches/rtosc-0.3.1-fix-invalid-comparison-operator.patch	\
@@ -2400,6 +2421,9 @@ dist_patch_DATA =						\
   %D%/packages/patches/rust-codex-0.120.0-connectors-cache-test-race.patch	\
   %D%/packages/patches/rust-codex-0.120.0-remove-libwebrtc.patch	\
   %D%/packages/patches/rust-codex-0.120.0-test-timeout.patch	\
+  %D%/packages/patches/rust-codex-0.124.0-code-mode-stub-toolname.patch	\
+  %D%/packages/patches/rust-codex-0.124.0-remove-patch-sections.patch	\
+  %D%/packages/patches/rust-librocksdb-sys-unbundled-sources.patch	\
   %D%/packages/patches/rust-ring-0.17-ring-core.patch		\
   %D%/packages/patches/rw-igraph-0.10.patch			\
   %D%/packages/patches/rxvt-unicode-fix-cursor-position.patch	\

gnu/packages/accessibility.scm

@@ -185,7 +185,7 @@ terminals.")
     (native-inputs
      (append
        (list clisp
-             python-cython
+             python-cython-0 ;; See https://bugzilla.redhat.com/show_bug.cgi?id=2231865
              doxygen
              gettext-minimal)
        ;; icedtea doesn't build reliably on all architectures.

gnu/packages/admin.scm

@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012-2025 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012-2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Cyril Roelandt <tipecaml@gmail.com>
 ;;; Copyright © 2014, 2015, 2016, 2018, 2019, 2020 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014, 2015-2018, 2020-2023 Eric Bavier <bavier@posteo.net>
@@ -1158,7 +1158,7 @@ on memory usage on GNU/Linux systems.")
 (define-public htop
   (package
     (name "htop")
-    (version "3.5.0")
+    (version "3.5.1")
     (source
      (origin
        (method git-fetch)
@@ -1166,7 +1166,7 @@ on memory usage on GNU/Linux systems.")
              (url "https://github.com/htop-dev/htop")
              (commit version)))
        (sha256
-        (base32 "1r07ri0dl9xz0jn1hc2g8q3l0q4clvnxs05yagpzsz0zigp4flj5"))
+        (base32 "187gyj081n6qsidll5wdri3jkr4m2i4m461z3xv03y342f5yj3lv"))
        (file-name (git-file-name name version))))
     (build-system gnu-build-system)
     (arguments
@@ -3751,59 +3751,68 @@ summarizes network bandwidth by process and remote host.")
 (define-public munge
   (package
     (name "munge")
-    (version "0.5.14")
+    (version "0.5.18")
     (source (origin
-              (method url-fetch)
+              (method git-fetch)
-              (uri (string-append "https://github.com/dun/munge/releases/"
+              (uri (git-reference
-                                  "download/munge-" version "/munge-"
+                     (url "https://github.com/dun/munge")
-                                  version ".tar.xz"))
+                     (commit (string-append "munge-" version))))
+              (file-name (git-file-name name version))
               (sha256
                (base32
-                "0h06sghb4rqvv1ywyd6mzsmbcgh712v6ygrff0gzm440y4ca41k6"))
+                "1b7gm680dlvmgvj9vxy7n0cqmnv1rl9n4563vasxdxx54f78j30s"))
               (modules '((guix build utils)))
               (snippet
-               '(begin
                ;; Don't insist on write access to /var.
-                  (substitute* "src/etc/Makefile.in"
+               #~(substitute* "src/etc/Makefile.am"
-                    (("\\$\\(INSTALL\\)(.*)localstatedir" _ middle)
+                   (("\\$\\(MKDIR_P\\) .*(local|run)statedir.*" all)
-                     (string-append "-$(INSTALL)" middle "localstatedir"))
+                    (string-append ": " all))))))
-                    (("\\$\\(MKDIR_P\\) .*(local|run)statedir.*")
-                     ""))
-                  #t))))
     (inputs
      (list openssl libgcrypt))
+    (native-inputs
+     (list autoconf
+           automake
+           libtool
+           procps))                               ;for tests
     (build-system gnu-build-system)
     (arguments
-     `(#:configure-flags
+     (list #:configure-flags
-       (list "--localstatedir=/var"
+           #~(list "--localstatedir=/var"
-             (string-append "--with-pkgconfigdir="
+                   "--disable-static"
-                            (assoc-ref %outputs "out") "/lib/pkgconfig")
+                   #$@(if (%current-target-system)
-             (string-append "--with-libgcrypt-prefix="
-                            (assoc-ref %build-inputs "libgcrypt"))
-             ,@(if (%current-target-system)
                           ;; Assume yes on pipes when cross compiling.
                           `("ac_cv_file__dev_spx=yes"
                             "x_ac_cv_check_fifo_recvfd=yes")
-                 '()))
+                          '())
+
+                   ;; The '.pc' file is not installed when omitting this flag.
+                   (string-append "--with-pkgconfigdir="
+                                  #$output "/lib/pkgconfig"))
            #:phases
-       (modify-phases %standard-phases
+           #~(modify-phases %standard-phases
-         ;; XXX Many test series fail.  Some might be fixable, others do no-no
+               (add-before 'bootstrap 'pre-bootstrap
-         ;; things like invoking ‘sudo’.
+                 (lambda _
+                   (for-each patch-shebang (find-files "build-aux"))))
                (add-after 'unpack 'skip-failing-tests
                  (lambda _
+                   ;; Pass '--force' to 'munged'; without it, it fails with "Socket
+                   ;; is inaccessible" due to the build directory not being
+                   ;; world-readable.
+                   (substitute* "tests/sharness.d/03-munged.sh"
+                     (("--group-update-time=-1" all)
+                      (string-append all " --force")))
+
+                   ;; The tests below invoke 'sudo' or have special expectations
+                   ;; about network interfaces.
                    (for-each (lambda (test)
-                         (substitute* "t/Makefile.in"
+                               (substitute* "tests/Makefile.am"
-                           (((string-append test "\\.t ")) "")))
+                                 (((string-append test "\\.t "))
+                                  "")))
                              (list "0100-munged-lock"
-                             "0010-basic"
-                             "0011-munged-cmdline"
-                             "0012-munge-cmdline"
-                             "0013-unmunge-cmdline"
                                    "0101-munged-security-socket"
                                    "0102-munged-security-keyfile"
                                    "0103-munged-security-logfile"
-                             "0110-munged-origin-addr"))
+                                   "0110-munged-origin-addr")))))))
-             #t)))))
     (home-page "https://dun.github.io/munge/")
     (synopsis "Cluster computing authentication service")
     (description
@@ -7043,7 +7052,7 @@ network, which causes enabled computers to power on.")
 (define-public witr
   (package
     (name "witr")
-    (version "0.1.7")
+    (version "0.3.1")
     (source
      (origin
        (method git-fetch)
@@ -7052,7 +7061,7 @@ network, which causes enabled computers to power on.")
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "18xx01lxd5j019gy9jmpms3awv4snlr028w01bfkyfid6hlwxbq2"))))
+        (base32 "03v9n4mdvqm0knqjl4s64321i5clqpmlrlkkdb87glzb9p28sg00"))))
     (build-system go-build-system)
     (arguments
      (list

gnu/packages/algebra.scm

@@ -458,7 +458,7 @@ precision.")
     (inputs
      ;; TODO: Unbundle "libmicropython.a".
      (list ao
-           fltk-1.3
+           fltk
            glpk
            gmp
            gsl

gnu/packages/animation.scm

@@ -238,12 +238,12 @@ contains the graphical user interface for synfig.")
              (when tests?
                (invoke "./tests")))))))
     (native-inputs
-     (list gettext-minimal
+     (cons* gettext-minimal
             `(,glib "bin")
-           nasm
             perl
             pkg-config
-           python-wrapper))
+            python-wrapper
+            (maybe-nasm)))
     (inputs
      (list cairo
            curl

gnu/packages/assembly.scm

@@ -2,7 +2,7 @@
 ;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2013, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
-;;; Copyright © 2016, 2020, 2021, 2025 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2020, 2021, 2025, 2026 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017–2022 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Guy Fleury Iteriteka <hoonandon@gmail.com>
 ;;; Copyright © 2019, 2022, 2024 Andy Tai <atai@atai.org>
@@ -43,6 +43,7 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix gexp)
+  #:use-module (guix utils)
   #:use-module (gnu packages)
   #:use-module (gnu packages admin)
   #:use-module (gnu packages autotools)
@@ -248,6 +249,16 @@ complex.  It supports all currently known x86 architectural extensions, and
 has strong support for macros.")
     (license license:bsd-2)))
 
+(define* (maybe-nasm #:optional
+                     (system (or (%current-target-system)
+                                 (%current-system))))
+  ;; For some packages nasm is only needed when compiling to/for x86/x86_64.
+  (if (target-x86? system)
+      (list nasm)
+      '()))
+
+(export maybe-nasm)
+
 (define-public yasm
   (package
     (name "yasm")

gnu/packages/audio.scm

@@ -1210,7 +1210,7 @@ PulseAudio clients, featuring:
 (define-public ardour
   (package
     (name "ardour")
-    (version "9.1")
+    (version "9.2")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -1227,7 +1227,7 @@ PulseAudio clients, featuring:
 namespace ARDOUR { const char* revision = \"" version "\" ; const char* date = \"\"; }")))))
               (sha256
                (base32
-                "00bramm8dq0ihr376n7l9rg0mjzxmzw6lxvsbsdlrdsimfwsy16p"))
+                "14s6cq3x7l7b682ah9k8cdr6plfirlgm882dc2nm51lxwl91zcfd"))
               (file-name (git-file-name name version))))
     (build-system waf-build-system)
     (arguments

gnu/packages/benchmark.scm

@@ -14,6 +14,7 @@
 ;;; Copyright © 2022 Tomasz Jeneralczyk <tj@schwi.pl>
 ;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2025 Artyom V. Poptsov <poptsov.artyom@gmail.com>
+;;; Copyright © 2026 Sughosha <sughosha@disroot.org>
 ;;; Copyright © 2023 Advanced Micro Devices, Inc.
 ;;;
 ;;; This file is part of GNU Guix.
@@ -41,6 +42,7 @@
   #:use-module (guix amd-gpu)
   #:use-module (guix search-paths)
   #:use-module (guix build-system cmake)
+  #:use-module (guix build-system qt)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system python)
   #:use-module (guix build-system pyproject)
@@ -730,7 +732,7 @@ and options.  With careful benchmarking, different hardware can be compared.")
 (define-public kdiskmark
   (package
     (name "kdiskmark")
-    (version "3.1.4")
+    (version "3.2.0")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -739,14 +741,13 @@ and options.  With careful benchmarking, different hardware can be compared.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "1x8vd6swmf0i7f6m6wl2154n6plx8jkmcqfq6zxbdy255f1da74c"))))
+                "161yyy4fcy5bnzhbcd7p90nlcslcsfp7n3m3bz9bygch7bdjw46g"))))
-    (build-system cmake-build-system)
+    (build-system qt-build-system)
     (arguments
      (list
+      #:qtbase qtbase
       #:configure-flags
-      ;; Drop runtime dependency on KDE's KFAuth.
+      #~(list (string-append "-DPOLKITQT-1_INSTALL_DIR=" #$output))
-      #~(list "-DPERFORM_PAGECACHE_CLEARING_USING_KF5AUTH=no"
-              (string-append "-DPOLKITQT-1_INSTALL_DIR=" #$output))
       #:tests? #f                       ;no test suite
       #:phases
       #~(modify-phases %standard-phases
@@ -759,10 +760,10 @@ and options.  With careful benchmarking, different hardware can be compared.")
             (lambda _
               (rmdir "src/singleapplication")
               (symlink #$(package-source
-                          (this-package-input "single-application-qt5"))
+                          (this-package-input "single-application"))
                        "src/singleapplication"))))))
-    (native-inputs (list extra-cmake-modules qttools-5))
+    (native-inputs (list extra-cmake-modules qttools))
-    (inputs (list fio polkit-qt qtbase-5 single-application-qt5))
+    (inputs (list fio polkit-qt6 single-application qtwayland))
     (home-page "https://github.com/JonMagon/KDiskMark")
     (synopsis "Simple disk benchmark tool")
     (description "KDiskMark is an HDD and SSD benchmark tool.  KDiskMark

gnu/packages/bioinformatics.scm

@@ -913,7 +913,7 @@ suite native in R.")
 (define-public r-bpcells
   (package
     (name "r-bpcells")
-    (version "0.3.0")
+    (version "0.3.1")
     (source
      (origin
        (method git-fetch)
@@ -922,7 +922,7 @@ suite native in R.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "12h1di45fg06nhsliii7v0h1z567pkpis1xm4ar1qr8ns1n8iljw"))
+        (base32 "0yqgcajq83g25mznwcngaw7pi6vcqxqdnynpgb95yci57k3wrp6j"))
        (modules '((guix build utils)))
        (snippet
         '(delete-file-recursively "r/src/vendor/highway"))))
@@ -931,13 +931,15 @@ suite native in R.")
     (arguments
      (list
       #:phases
-      '(modify-phases %standard-phases
+      `(modify-phases %standard-phases
          (add-after 'unpack 'chdir
-           (lambda _
+           (lambda _ (chdir "r")))
-             (substitute* "r/configure"
+         ,@(if (target-x86-32?)
-               (("tools/hwy-test.cpp" m)
+               '((add-after 'chdir 'require-sse2
-                (string-append m " $HWY_LIBS $HWY_CFLAGS")))
+                   ;; This avoids falling back to the scalar backend in
-             (chdir "r"))))))
+                   ;; highway, which fails to build.
+                   (lambda _ (setenv "CFLAGS" "-msse2"))))
+               '()))))
     (propagated-inputs
      (list r-dplyr
            r-ggplot2

gnu/packages/browser-extensions.scm

@@ -328,15 +328,15 @@ with the @uref{https://keepassxc.org, KeePassXC} password manager.")
 (define noscript
   (package
     (name "noscript")
-    (version "13.2.2")
+    (version "13.6.18.1984")
     (source (origin
               (method url-fetch/zipbomb)
               (uri (string-append
-                    "https://noscript.net/download/releases/noscript-" version
+                    "https://archive.torproject.org/tor-package-archive/torbrowser/noscript/noscript-"
-                    ".xpi"))
+                    version ".xpi"))
               (sha256
                (base32
-                "0w2w0a76dk01bkh83mqwgs9ky02rjqk15z5sxg4a6mw0hpr81bpm"))))
+                "0assv8v89hhg302q81vvv7ln3q8k9m6rzjkbprv2j05ghb23kkvm"))))
     (build-system copy-build-system)
     (properties '((addon-id . "{73a6fe31-595d-460b-a920-fcc0f8843232}")))
     (arguments

gnu/packages/chromium.scm

@@ -400,7 +400,7 @@
   ;; run the Blink performance tests, just remove everything to save ~70MiB.
   '("third_party/blink/perf_tests"))
 
-(define %chromium-version "147.0.7727.55")
+(define %chromium-version "147.0.7727.137")
 (define %ungoogled-revision (string-append %chromium-version "-1"))
 (define %debian-revision (string-append "debian/" %ungoogled-revision))
 
@@ -412,7 +412,7 @@
     (file-name (git-file-name "ungoogled-chromium" %ungoogled-revision))
     (sha256
      (base32
-      "0l6v4wf16067igawjlh90f3d287mkw0cq4j5lvrxxy17y1skynzc"))))
+      "1ha84j3zckdv2l8dpicqhmr6a8mq3bqwalw0bmgamvlmns9i7nrj"))))
 
 (define %debian-origin
   (origin
@@ -425,7 +425,7 @@
                                 ((_ version) version))))
     (sha256
      (base32
-      "0gqarll08i7rcs1amapciv263xvzglc8p44ikavq3xd12yyvcd98"))))
+      "04lqbclkvn9nsksgjpjilh78a8y17mwwq4pmhr6h8gvpp2y3bhhc"))))
 
 (define (origin-file origin file)
   (computed-file
@@ -570,7 +570,7 @@
                                   %chromium-version "-lite.tar.xz"))
               (sha256
                (base32
-                "1salvlw5sykx3zmsbp7cgmf7y8yy6jlgb4b4zswzsbjrprk4jnap"))
+                "1m22whg5n9lw9gqhalm95jwfm45lqp4a7cs3mn3f4n8w0rvr0r5j"))
               (modules '((guix build utils)))
               (snippet (force ungoogled-chromium-snippet))))
     (build-system gnu-build-system)
@@ -596,6 +596,7 @@
               "use_custom_libcxx=false" ; support for this is deprecated and to be removed.
               "optimize_webui=false"
               "webnn_use_tflite=false"
+              "build_tflite_with_xnnpack=false"
               "safe_browsing_use_unrar=false"
               "chrome_pgo_phase=0"
               "use_sysroot=false"
@@ -688,7 +689,7 @@
               "use_gnome_keyring=false" ;deprecated by libsecret
               "use_pulseaudio=true"
               "link_pulseaudio=true"
-              "icu_use_data_file=false"
+              "icu_use_data_file=true"
 
               ;; VA-API acceleration is currently only supported on x86_64-linux.
               #$@(if (string-prefix? "x86_64" (or (%current-target-system)
@@ -696,6 +697,13 @@
                      '("use_vaapi=true")
                      '())
 
+              #$@(if (string-prefix? "aarch64" (or (%current-target-system)
+                                                   (%current-system)))
+                     '("use_v4l2_codec=true"
+                       "use_vaapi=false"
+                       "use_av1_hw_decoder=true")
+                     '())
+
               ;; Do not artificially restrict formats supported by system ffmpeg.
               "proprietary_codecs=true"
               "ffmpeg_branding=\"Chrome\""
@@ -769,12 +777,7 @@
                    (string-append libclang "clang_base_path"))
                   (("(_rustfmt_path = \")\\$\\{rust_bindgen_root\\}" _ rustfmt)
                    (string-append rustfmt "${rust_sysroot_absolute}"))))))
-          (add-after 'patch-stuff 'include-pthreadpool
+          (add-after 'patch-stuff 'add-absolute-references
-            ;; FIXME: Somehow the build system cannot locate this header.
-            (lambda _
-              (copy-file "third_party/pthreadpool/src/include/pthreadpool.h"
-                         "pthreadpool.h")))
-          (add-after 'include-pthreadpool 'add-absolute-references
             (lambda* (#:key inputs #:allow-other-keys)
               (let ((cups-config (search-input-file inputs "/bin/cups-config"))
                     (libnssckbi.so (search-input-file inputs
@@ -892,6 +895,7 @@
                                        "resources.pak"
                                        "v8_context_snapshot.bin"
                                        "chrome_crashpad_handler"
+                                       "icudtl.dat"
 
                                        ;; Swiftshader ICD.
                                        "libvk_swiftshader.so"
@@ -914,9 +918,11 @@
 
                 (substitute* '("chrome/app/resources/manpage.1.in"
                                "chrome/installer/linux/common/desktop.template")
-                  (("@@MENUNAME@@") "Chromium")
+                  (("@@MENUNAME") "Chromium")
-                  (("@@PACKAGE@@") "chromium")
+                  (("@@PACKAGE") "chromium")
-                  (("/usr/bin/@@USR_BIN_SYMLINK_NAME@@") exe))
+                  (("/usr/bin/@@usr_bin_symlink_name") exe)
+                  (("@@uri_scheme") "x-scheme-handler/chromium")
+                  (("@@extra_desktop_entries") ""))
 
                 (mkdir-p man)
                 (copy-file "chrome/app/resources/manpage.1.in"

gnu/packages/codex.scm

@@ -18,10 +18,10 @@
 
 ;;; This module is separate from (gnu packages rust-apps) to avoid a
 ;;; circular module dependency: (gnu packages rust-sources), which
-;;; defines rust-codex-0.120.0, transitively loads (gnu packages
+;;; defines rust-codex-0.124.0, transitively loads (gnu packages
 ;;; rust-apps) through its #:use-module chain.  If the codex package
 ;;; lived in rust-apps.scm, loading rust-sources would trigger loading
-;;; rust-apps before rust-codex-0.120.0 is defined, causing an unbound
+;;; rust-apps before rust-codex-0.124.0 is defined, causing an unbound
 ;;; variable error.
 
 (define-module (gnu packages codex)
@@ -54,14 +54,14 @@
 (define-public codex
   (package
     (name "codex")
-    (version (package-version rust-codex-0.120.0))
+    (version (package-version rust-codex-0.124.0))
     (source
      (origin
-       (inherit (package-source rust-codex-0.120.0))
+       (inherit (package-source rust-codex-0.124.0))
        (patches (search-patches
                  "codex-acp-0.11.1-disable-code-mode.patch"
-                 "rust-codex-0.117.0-remove-patch-sections.patch"
+                 "rust-codex-0.124.0-code-mode-stub-toolname.patch"
-                 "rust-codex-0.120.0-connectors-cache-test-race.patch"
+                 "rust-codex-0.124.0-remove-patch-sections.patch"
                  "rust-codex-0.120.0-remove-libwebrtc.patch"
                  "rust-codex-0.98.0-test-shebangs.patch"
                  "rust-codex-0.120.0-test-timeout.patch"))))
@@ -69,7 +69,12 @@
     (arguments
      (list
       #:install-source? #f
-      #:cargo-install-paths '(list "cli" "exec" "exec-server"
+      ;; exec-server is library-only in 0.124 (no [[bin]] in
+      ;; exec-server/Cargo.toml); cargo install --path exec-server fails
+      ;; with "no packages found with binaries or examples".  Drop it
+      ;; from the install paths -- the library is consumed via the
+      ;; workspace by other binaries here, not installed standalone.
+      #:cargo-install-paths '(list "cli" "exec"
                                    "linux-sandbox" "mcp-server"
                                    "app-server" "tui")
       ;; schema_fixtures_match_generated (upstream fixture is stale:
@@ -317,7 +322,164 @@
                                 ;; (chatgpt.com, api.github.com) wait
                                 ;; for TCP timeout instead of failing
                                 ;; instantly at TLS, eating the budget.
-                                "--skip" "mcp_server_status_list_tools_and_auth_only_skips_slow_inventory_calls")
+                                "--skip" "mcp_server_status_list_tools_and_auth_only_skips_slow_inventory_calls"
+                                ;;; BEGIN Stack overflow in 'current_thread'
+                                ;;; tokio runtime.  The sibling tests in
+                                ;;; tracing_tests.rs use the local helper
+                                ;;; run_current_thread_test_with_stack
+                                ;;; (4 MiB) but this one uses bare
+                                ;;; #[tokio::test] on the 2 MiB default
+                                ;;; test-thread stack, and TurnStart's
+                                ;;; future graph exceeds it.  With
+                                ;;; RUST_MIN_STACK raised the overflow is
+                                ;;; gone but the test then deterministically
+                                ;;; times out waiting for a span tagged
+                                ;;; codex.op = "user_input" on the remote
+                                ;;; trace that upstream never emits on that
+                                ;;; trace in our environment.
+                                "--skip" "turn_start_jsonrpc_span_parents_core_turn_spans"
+                                ;;; END tracing test stack/timeout
+                                ;;; BEGIN The upstream loader resolves the
+                                ;;; MCP OAuth credentials store mode by
+                                ;;; calling
+                                ;;; resolve_mcp_oauth_credentials_store_mode
+                                ;;; with env!("CARGO_PKG_VERSION") -- which
+                                ;;; in the released 0.124.0 tarball is
+                                ;;; "0.124.0".  These fixture tests
+                                ;;; construct the expected Config by
+                                ;;; passing the LOCAL_DEV_BUILD_VERSION
+                                ;;; constant ("0.0.0") to the same
+                                ;;; resolver, and the resolver only returns
+                                ;;; File for "0.0.0" -- Auto otherwise.
+                                ;;; Upstream CI builds from a checkout
+                                ;;; still carrying version = "0.0.0" so the
+                                ;;; tests pass there; they cannot pass
+                                ;;; against a released tag.
+                                "--skip" "test_precedence_fixture_with_gpt3_profile"
+                                "--skip" "test_precedence_fixture_with_gpt5_profile"
+                                "--skip" "test_precedence_fixture_with_o3_profile"
+                                "--skip" "test_precedence_fixture_with_zdr_profile"
+                                ;;; END LOCAL_DEV_BUILD_VERSION fixture mismatch
+                                ;;; BEGIN Verifies that Codex's user-shell
+                                ;;; spawn produces a child where
+                                ;;; CODEX_SANDBOX_NETWORK_DISABLED is unset
+                                ;;; (asserts stdout == "not-set").  We
+                                ;;; deliberately set that env var at the
+                                ;;; check phase to trigger upstream's
+                                ;;; skip_if_no_network! guards; the var then
+                                ;;; leaks into the spawned shell and the
+                                ;;; assertion fails.  The guix skip is a
+                                ;;; direct cost of the network-gate fix --
+                                ;;; trading one broken test for two that
+                                ;;; now skip cleanly.
+                                "--skip" "user_shell_command_does_not_set_network_sandbox_env_var"
+                                ;;; END CODEX_SANDBOX_NETWORK_DISABLED leak
+                                ;;; BEGIN The exec-server/tests/file_system
+                                ;;; integration tests invoke the real
+                                ;;; system bwrap, which tries to execvp the
+                                ;;; test binary at the cargo target path
+                                ;;; under the build dir.  Same root cause
+                                ;;; as the existing
+                                ;;; sandbox_reenables_writable_subpaths_under_unreadable_parents
+                                ;;; skip: guix builds live under /tmp but
+                                ;;; bwrap's mount namespace excludes /tmp,
+                                ;;; making the binary invisible inside the
+                                ;;; namespace.
+                                "--skip" "file_system_copy_preserves_symlink_source"
+                                "--skip" "file_system_copy_rejects_symlink_escape_destination"
+                                "--skip" "file_system_copy_rejects_symlink_escape_source"
+                                "--skip" "file_system_create_directory_rejects_symlink_escape"
+                                "--skip" "file_system_read_directory_rejects_symlink_escape"
+                                "--skip" "file_system_remove_rejects_symlink_escape"
+                                "--skip" "file_system_remove_removes_symlink_not_target"
+                                "--skip" "file_system_sandboxed_read_allows_readable_root"
+                                "--skip" "file_system_sandboxed_read_rejects_symlink_escape"
+                                "--skip" "file_system_sandboxed_read_rejects_symlink_parent_dotdot_escape"
+                                "--skip" "file_system_sandboxed_write_allows_additional_write_root"
+                                "--skip" "file_system_sandboxed_write_rejects_symlink_escape"
+                                "--skip" "file_system_sandboxed_write_rejects_unwritable_path"
+                                ;;; END bwrap-cant-see-/tmp file_system tests
+                                ;;; BEGIN Landlock is unavailable on Guix,
+                                ;;; so the sandbox cannot deny network
+                                ;;; syscalls.  These tests expect
+                                ;;; SandboxErr::Denied for the nc, ping,
+                                ;;; ssh, getent, and dev_tcp_redirection
+                                ;;; commands but those commands instead
+                                ;;; block on connect() until the test's 2s
+                                ;;; timeout fires (Timeout, exit 124).
+                                ;;; Same root cause as the Landlock skips
+                                ;;; at the top of this list; new test names
+                                ;;; in 0.124.
+                                "--skip" "sandbox_blocks_nc"
+                                "--skip" "sandbox_blocks_ping"
+                                "--skip" "sandbox_blocks_dev_tcp_redirection"
+                                "--skip" "sandbox_blocks_getent"
+                                "--skip" "sandbox_blocks_ssh"
+                                ;;; END Landlock network block
+                                ;;; BEGIN Requires github.com network access.
+                                ;;; With no "extraKnownMarketplaces" entry
+                                ;;; in settings.json,
+                                ;;; collect_marketplace_import_sources
+                                ;;; inserts a fallback entry for the
+                                ;;; "claude-plugins-official" marketplace
+                                ;;; pointing at the github shorthand
+                                ;;; "anthropics/claude-plugins-official".
+                                ;;; add_marketplace -> parse_marketplace_source
+                                ;;; expands that to a github.com/.git URL
+                                ;;; and clone_git_source runs 'git clone'.
+                                ;;; The Guix build sandbox has no network,
+                                ;;; so the clone fails and the marketplace
+                                ;;; lands in failed_marketplaces.  No mock
+                                ;;; cloner is injected via
+                                ;;; ExternalAgentConfigService::new_for_test,
+                                ;;; so there is no in-tree way to satisfy
+                                ;;; the test offline.
+                                "--skip" "import_plugins_infers_claude_official_marketplace_when_missing_from_settings"
+                                ;;; END github.com network access
+                                ;;; BEGIN Async race between the rollout
+                                ;;; writer task and a direct SQLite read.
+                                ;;; The test calls
+                                ;;; update_memory_settings_with_app_server,
+                                ;;; which routes through the in-memory
+                                ;;; thread path on the app-server's
+                                ;;; ThreadMemoryModeSet handler ->
+                                ;;; Session::set_thread_memory_mode ->
+                                ;;; persist_thread_memory_mode_update,
+                                ;;; which writes a RolloutItem::SessionMeta
+                                ;;; with the new mode to the rollout file
+                                ;;; via recorder.record_items + flush.  The
+                                ;;; rollout writer task then asynchronously
+                                ;;; calls sync_thread_state_after_write,
+                                ;;; which calls state_db::apply_rollout_items
+                                ;;; to mirror the SessionMeta into SQLite.
+                                ;;; flush() only awaits the rollout-file
+                                ;;; write, not the subsequent SQLite sync.
+                                ;;; The test opens a fresh StateRuntime and
+                                ;;; reads get_thread_memory_mode
+                                ;;; immediately, so it observes the creation
+                                ;;; default of "enabled" written by
+                                ;;; upsert_thread_with_creation_memory_mode
+                                ;;; instead of the new "disabled".  Upstream
+                                ;;; CI wins this race; we lose.
+                                "--skip" "update_memory_settings_updates_current_thread_memory_mode"
+                                ;;; END memory-mode rollout/sqlite race
+                                ;;; BEGIN The Stopwatch::new constructor in
+                                ;;; codex_shell_escalation anchors
+                                ;;; T0 = Instant::now() at construction;
+                                ;;; the spawned cancellation task fires at
+                                ;;; T0 + limit.  The test captures
+                                ;;; start = Instant::now() at T1 > T0 (after
+                                ;;; cancellation_token() returns) and
+                                ;;; asserts start.elapsed() >= limit,
+                                ;;; i.e. (T0 + limit) - T1 >= limit, which
+                                ;;; is always false by the offset T1 - T0.
+                                ;;; The test only passes when scheduler
+                                ;;; jitter on the sleep wakeup happens to
+                                ;;; exceed that offset.  Upstream wins the
+                                ;;; race; we don't always.
+                                "--skip" "cancellation_receiver_fires_after_limit"
+                                ;;; END Stopwatch construction/start offset race
+                                )
       #:cargo-package-crates
       ''(;;; Tier 0: No internal deps.
          "codex-ansi-escape"
@@ -358,22 +520,31 @@
          "codex-debug-client"
          "codex-analytics"
          "codex-rollout"
+         "codex-rollout-trace"
          "codex-terminal-detection"
          "codex-utils-approval-presets"
          "codex-utils-cli"
+         "codex-uds"
+         "codex-install-context"
+         "codex-device-key"
          ;;; Tier 2.
          "codex-app-server-protocol"
          "codex-rmcp-client"
          "codex-otel"
+         "codex-thread-store"
          "codex-state"
          "codex-features"
+         "codex-model-provider"
          "codex-config"
+         "codex-agent-identity"
+         "codex-aws-auth"
          "codex-hooks"
-         "codex-instructions"
          "codex-code-mode"
          "codex-feedback"
          "codex-skills"
+         "codex-test-binary-support"
          "codex-core"
+         "codex-core-plugins"
          "codex-utils-sandbox-summary"
          "codex-linux-sandbox"
          "codex-sandboxing"
@@ -425,7 +596,7 @@
               ;; Update them to match the actual package version.
               (let ((snap-files (find-files "." "\\.snap$")))
                 (substitute* snap-files
-                  (("\\(v0\\.0\\.0\\)   ") "(v0.120.0) ")))))
+                  (("\\(v0\\.0\\.0\\)   ") "(v0.124.0) ")))))
           (add-after 'chdir-to-workspace 'patch-git-deps-to-vendor
             (lambda _
               ;; Replace git dependencies with version references so cargo
@@ -436,32 +607,55 @@
                 (("runfiles = \\{ git = [^}]+\\}")
                  "runfiles = \"0.1.0\""))
               ;; Remove workspace members that have unbuildable deps
-              ;; (libwebrtc requires git fetch, v8-poc requires V8).
+              ;; (v8-poc requires V8).  code-mode stays a workspace member
+              ;; so its codex-protocol resolves to the same local copy as
+              ;; the rest of the build; disabling its default features
+              ;; (below) avoids pulling in V8.
               (substitute* "Cargo.toml"
-                (("\"v8-poc\",") "")
+                (("\"v8-poc\",") ""))
-                (("\"code-mode\",") ""))
+              ;; Disable V8 runtime in codex-code-mode by turning off
-              ;; Disable V8 runtime in codex-code-mode: remove path
+              ;; default features.  Keep path= so code-mode is resolved
-              ;; so cargo resolves it from the vendor (where it has
+              ;; from the local source tree and shares codex-protocol
-              ;; optional = true on v8) and disable default features.
+              ;; (and other workspace crates) with the rest of the build;
+              ;; resolving it from the vendor instead introduces a
+              ;; duplicate codex-protocol and causes E0308 type
+              ;; mismatches in codex-tools.
               (substitute* "Cargo.toml"
                 (("codex-code-mode = \\{ path = \"code-mode\" \\}")
-                 "codex-code-mode = { version = \"0.120.0\", default-features = false }"))))
+                 "codex-code-mode = { path = \"code-mode\", default-features = false }"))
+              ;; cargo build at workspace root ignores per-dep
+              ;; default-features=false and builds code-mode with its
+              ;; own default features, which include v8-runtime and
+              ;; would pull in V8.  Make the default feature empty.
+              (substitute* "code-mode/Cargo.toml"
+                (("^default = \\[\"v8-runtime\"\\]") "default = []"))))
           (add-after 'patch-git-deps-to-vendor 'add-version-to-workspace-deps
             (lambda _
               ;; cargo package requires all dependencies to have versions.
-              ;; cargo package requires all dependencies to have versions.
+              ;; Add version = "0.124.0" to internal path dependencies.
-              ;; Add version = "0.120.0" to internal path dependencies.
               (let ((cargo-files (find-files "." "^Cargo\\.toml$")))
                 (substitute* cargo-files
                   ;; Handle inline deps: name = { path = "..." }
                   (("(codex-[a-z0-9-]+) = \\{ path = " all name)
-                   (string-append name " = { version = \"0.120.0\", path = "))
+                   (string-append name " = { version = \"0.124.0\", path = "))
                   ;; Handle inline deps with package: name = { package = "...", path = "..." }
                   (("(codex-[a-z0-9-]+) = \\{ package = " all name)
-                   (string-append name " = { version = \"0.120.0\", package = "))
+                   (string-append name " = { version = \"0.124.0\", package = "))
                   ;; Handle section deps: [dependencies.X] with path = "..."
                   (("^(path = \"\\.\\./[^\"]*\")" all path-line)
-                   (string-append path-line "\nversion = \"0.120.0\""))))))
+                   (string-append path-line "\nversion = \"0.124.0\""))))))
+          (add-after 'chdir-to-workspace 'use-gnu-store-in-sandbox
+            (lambda _
+              ;; LINUX_PLATFORM_DEFAULT_READ_ROOTS in linux-sandbox/src/
+              ;; bwrap.rs is the read-only baseline that codex's bwrap
+              ;; sandbox bind-mounts so commands can read /usr/bin/ls,
+              ;; libc, etc.  Upstream lists "/nix/store" for NixOS;
+              ;; Guix's equivalent is "/gnu/store".  Without this swap,
+              ;; the codex sandbox cannot locate any binaries on a Guix
+              ;; system because every "system" path resolves into
+              ;; /gnu/store/<hash>-pkg/bin/...
+              (substitute* "linux-sandbox/src/bwrap.rs"
+                (("\"/nix/store\"") "\"/gnu/store\""))))
           (add-after 'chdir-to-workspace 'patch-hardcoded-paths
             (lambda* (#:key inputs #:allow-other-keys)
               (let ((bash-bin (string-append
@@ -561,10 +755,12 @@
                 ;; double quotes.
                 (substitute*
                   (list "core/src/plugins/startup_sync_tests.rs"
+                        "core/src/tools/runtimes/shell/unix_escalation_tests.rs"
                         "core/tests/suite/client.rs"
                         "core/tests/suite/js_repl.rs"
                         "core/tests/suite/skill_approval.rs"
                         "core/tests/suite/user_notification.rs"
+                        "exec-server/tests/file_system.rs"
                         "login/src/auth/auth_tests.rs"
                         "models-manager/src/manager_tests.rs"
                         "sandboxing/src/bwrap_tests.rs")
@@ -613,7 +809,17 @@
               ;; ~/... and 30 snapshot tests fail.
               (setenv "HOME" "/tmp/guix-home")
               (mkdir-p "/tmp/guix-home")
-              (setenv "USER" "nixbld"))))))
+              (setenv "USER" "nixbld")
+              ;; Default libtest thread stack is 2 MiB, which is not
+              ;; enough for tokio current_thread tests that drive
+              ;; codex-core's full turn pipeline.  Upstream gates such
+              ;; tests through run_current_thread_test_with_stack (4 MiB)
+              ;; in app-server/src/message_processor/tracing_tests.rs;
+              ;; raise the global default so future additions that
+              ;; forget the wrapper still pass.
+              (setenv "RUST_MIN_STACK" "8388608")
+              ;; Disable network access.
+              (setenv "CODEX_SANDBOX_NETWORK_DISABLED" "1"))))))
     (native-inputs `(("bubblewrap" ,bubblewrap) ;tests need bwrap on PATH
                      ("clang" ,clang)
                      ("cmake-minimal" ,cmake-minimal)
@@ -628,6 +834,8 @@
     (inputs (cons* bash-minimal coreutils git-minimal sed
                    libcap oniguruma openssl sqlite zlib `(,zstd "lib")
                    (cargo-inputs 'codex)))
+    (properties '((timeout . 108000) ; 30  hours
+                  (max-silent-time . 54000))) ; 15 hours
     (home-page "https://github.com/openai/codex")
     (synopsis "AI-assisted coding CLI and TUI")
     (description

gnu/packages/compression.scm

@@ -2375,7 +2375,9 @@ non-Windows systems without running the actual installer using wine.")
      (sha256
       (base32 "17k679glx05v23n8kxbg9vmbf89i2252g5xj6w3dkz19asmh1zd6"))))
    (build-system gnu-build-system)
-   (native-inputs (list autoconf automake libtool nasm))
+   (native-inputs
+    (cons* autoconf automake libtool
+           (maybe-nasm)))
    (home-page "https://github.com/intel/isa-l")
    (synopsis "Intelligent storage acceleration library")
    (description "ISA-L is a collection of optimized low-level functions

gnu/packages/cpp.scm

@@ -52,6 +52,7 @@
 ;;; Copyright © 2025 Philippe Swartvagher <phil.swart@gmx.fr>
 ;;; Copyright © 2025 Murilo <murilo@disroot.org>
 ;;; Copyright © 2026 Justin Veilleux <terramorpha@cock.li>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -3192,8 +3193,7 @@ pointers, containers, compiler building blocks, etc.")
     (native-inputs
      (list build))
     (inputs
-     `(("libcutl" ,libcutl)
+     (list libcutl xerces-c))
-       ("libxerces-c" ,xerces-c)))
     (synopsis "XSD Front-end")
     (description "@code{libxsd-frontend} is a compiler frontend for the W3C
 XML Schema definition language.  It includes a parser, semantic graph types

gnu/packages/databases.scm

@@ -71,6 +71,7 @@
 ;;; Copyright © 2026 Spencer King <spencer.king@wustl.edu>
 ;;; Copyright © 2026 Peter Polidoro <peter@polidoro.io>
 ;;; Copyright © 2026 Josep Bigorra <jjbigorra@gmail.com>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -4159,8 +4160,8 @@ programmatically or as a standalone CLI application.")
        (file-name (git-file-name name version))))
     (build-system gnu-build-system)
     (inputs
-     `(("libcrypto" ,openssl)
+     (list openssl
-       ("libtcl8.6" ,tcl))) ; required for running the tests
+           tcl))                        ;for tests
     (native-inputs
      (list tcl))
     (arguments

gnu/packages/distributed.scm

@@ -51,7 +51,7 @@
 (define-public boinc-client
   (package
     (name "boinc-client")
-    (version "8.2.9")
+    (version "8.2.12")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -62,7 +62,7 @@
               (file-name (git-file-name "boinc" version))
               (sha256
                (base32
-                "0ik9423ii6kal29jdn907pxy8w86zpi8n158qx1gcsh8lsaif1v5"))))
+                "0531n0yij1gh06xy6plwivbpmhqfq15jizg3rdgri40nz41rzbgr"))))
     (build-system gnu-build-system)
     (arguments
      (list

gnu/packages/django.scm

@@ -201,13 +201,13 @@ your project into different processes.")
 (define-public python-django
   (package
     (name "python-django")
-    (version "5.2.11")
+    (version "5.2.13")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "django" version))
        (sha256
-        (base32 "1lq2dynfw6jmvzrzgfrlij2qnxcksaxgnrfr0pj3bvmrv0m2jbbz"))))
+        (base32 "1i1vlffzhwbzp6r6y8ycvwklc45diy4c6i897z379l48a7dqj5d3"))))
     (build-system pyproject-build-system)
     (arguments
      '(#:test-flags
@@ -298,22 +298,6 @@ to the @dfn{don't repeat yourself} (DRY) principle.")
                       ;; This CVE is fixed in 4.1.9.
                       "CVE-2023-31047"))))))
 
-(define-public python-django-4
-  (package
-    (inherit python-django)
-    (name "python-django-4")
-    (version "4.2.28")
-    (source
-      (origin
-        (method url-fetch)
-        (uri (pypi-uri "django" version))
-        (sha256
-         (base32 "1znc2q1m9p2kxz1rkfkh2hg2sx6i3aqv72zsraad7bci364cvfd4"))))
-    (arguments
-     (substitute-keyword-arguments arguments
-       ((#:phases phases)
-        #~(modify-phases #$phases (delete 'delete-sitecustomize)))))))
-
 (define-public python-django-cache-url
   (package
     (name "python-django-cache-url")

gnu/packages/dlang.scm

@@ -10,6 +10,7 @@
 ;;; Copyright © 2022 ( <paren@disroot.org>
 ;;; Copyright © 2022 Esther Flashner <esther@flashner.co.il>
 ;;; Copyright © 2025-2026 Jonas Meeuws <jonas.meeuws@gmail.com>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -320,11 +321,11 @@ integration tests...\n")
                                  "|core.thread.osthread-debug-shared")))
                            (#t `("")))))))))))))
     (native-inputs
-     (append (delete "llvm"
+     (modify-inputs native-inputs
-                     (alist-replace "ldc" (list ldc-bootstrap)
+       (delete "llvm")
-                                    (package-native-inputs ldc-bootstrap)))
+       (replace "ldc" ldc-bootstrap)
-         `(("clang" ,clang-17)          ;propagates llvm and clang-runtime
+       (append clang-17                 ;propagates llvm and clang-runtime
-           ("python-lit" ,python-lit))))
+               python-lit)))
     (properties
      (alist-delete 'hidden? (package-properties ldc-bootstrap)))))
 

gnu/packages/dns.scm

@@ -115,6 +115,7 @@
        (uri (git-reference
               (url "git://git.chiark.greenend.org.uk/~ianmdlvl/adns.git")
               (commit (string-append "adns-" version))))
+       (file-name (git-file-name name version))
        (sha256
         (base32
          "0ln3l5j7wb1xazrzl76p9xar52p6l2k1cwy7jazxw1acl71k9h5n"))))

gnu/packages/duckdb.scm

@@ -148,13 +148,13 @@ system.")
 (define-public r-duckdb
   (package
     (name "r-duckdb")
-    (version "1.5.1")
+    (version "1.5.2")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "duckdb" version))
        (sha256
-        (base32 "177621m08whqqk4yhj3zrr08l3d9hhlqh3gm9jzhi5cplg47cksq"))
+        (base32 "1dldlfwvc33czvlxfmwaj4p9y6sjjj5iqy98yda47a8kclrqmyam"))
        ;; This package bundles the duckdb sources and builds a custom variant
        ;; of duckdb.  I'd be happy to link it with our duckdb library instead,
        ;; but it does not seem possible to do that.

gnu/packages/electronics.scm

@@ -2331,7 +2331,7 @@ Automation}, portable and vendor neutral FPGA place and route tool.")
 (define-public nvc
   (package
     (name "nvc")
-    (version "1.19.3")
+    (version "1.20.1")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -2340,7 +2340,7 @@ Automation}, portable and vendor neutral FPGA place and route tool.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "1zizz2dafm53lzpjayy6vig5pz5ri9cszdivg0jzzh8s3ggkpy1i"))))
+                "1b38x2ch468s4p6mrq6c8s0d95vb84p6w4v8in79l4w7sfy8jnr0"))))
     (build-system gnu-build-system)
     (arguments
      (list #:out-of-source? #t
@@ -3461,7 +3461,7 @@ form of AXI, AXI lite, and AXI stream modules.")
 (define-public python-edalize
   (package
     (name "python-edalize")
-    (version "0.6.6")
+    (version "0.6.8")
     (source
      (origin
        (method git-fetch)
@@ -3470,7 +3470,7 @@ form of AXI, AXI lite, and AXI stream modules.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "115nc15n2cx4x9irjim07zkg0287418djqd6ja7rm8jrnyldvln9"))))
+        (base32 "04m2lhkclw9fj92k43c06j003qnq9i1yhy2131fvcnkkr0d9438m"))))
     (build-system pyproject-build-system)
     (arguments
      (list
@@ -4516,7 +4516,7 @@ unique design feature of Trilinos is its focus on packages.")
 (define-public verilator
   (package
     (name "verilator")
-    (version "5.046")
+    (version "5.048")
     (source
      (origin
        (method git-fetch)
@@ -4525,7 +4525,7 @@ unique design feature of Trilinos is its focus on packages.")
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1gr1qhxvl4856hnmnx46dqd2qp0jhdh959zm2qfmxzzh19np7xkm"))))
+        (base32 "16c1x66kqmc5ldqjij81kypj471fibfihcqn6kz4wbxvnn0smyn6"))))
     (native-inputs
      (list autoconf
            automake

gnu/packages/emacs-build.scm

@@ -62,7 +62,7 @@ as bold, underscore or italic.")
 (define-public emacs-buttercup
   (package
     (name "emacs-buttercup")
-    (version "1.38")
+    (version "1.40")
     (source
      (origin
        (method git-fetch)
@@ -72,9 +72,7 @@ as bold, underscore or italic.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "09n8skr5wi8bs7x81d5bi6z89dd8s1zi9a5f4r2qadaz69slncxq"))
+         "1b55cfh4wr40max2c42crvaa6wid7a83g28yximsin98i32q5f5r"))))
-       (patches
-        (search-patches "emacs-buttercup-1.38-native-comp-spy-on-trampoline-scope.patch"))))
     (build-system emacs-build-system)
     (arguments
      (list

gnu/packages/emacs.scm

@@ -28,6 +28,7 @@
 ;;; Copyright © 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2025 Jake Forster <jakecameron.forster@gmail.com>
 ;;; Copyright © 2025 John Kehayias <john@guixotic.coop>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -869,7 +870,7 @@ Started in 2014 as a GSOC project, Guile-Emacs was resurrected in 2024.")
          "0vfw7z9i2s9np6nmx1d4dlsywm044rkaqarn7akffmb6bf1j6zv5"))))
     (build-system gnu-build-system)
     (native-inputs
-     `(("gettext" ,gettext-minimal)))
+     (list gettext-minimal))
     (arguments
      `(#:configure-flags
        (list (string-append "--with-charmaps="

gnu/packages/emulators.scm

@@ -1264,7 +1264,8 @@ Enjoy all of your favorite Atari 2600 games on your PC thanks to Stella!")
         (base32 "1xf15b6c3i0vv92b420a92pfvfaxhji56ivin8pn5r7fajkqyfb7"))))
     (build-system gnu-build-system)
     (native-inputs
-     (list pkg-config nasm which))
+     (cons* pkg-config which
+            (maybe-nasm)))
     (inputs
      (list freetype
            glu
@@ -1289,8 +1290,6 @@ Enjoy all of your favorite Atari 2600 games on your PC thanks to Stella!")
                       (list "all" (string-append "PREFIX=" out)))
        ;; There are no tests.
        #:tests? #f))
-    ;; As per the Makefile (in projects/unix/Makefile):
-    (supported-systems '("i686-linux" "x86_64-linux"))
     (home-page "https://www.mupen64plus.org/")
     (synopsis "Nintendo 64 emulator core library")
     (description
@@ -2164,7 +2163,9 @@ as RetroArch.")
               (lambda _
                 (install-file "mupen64plus_next_libretro.so"
                               (string-append #$output "/lib/libretro/")))))))
-      (native-inputs (list nasm pkg-config))
+      (native-inputs
+       (cons* pkg-config
+              (maybe-nasm)))
       (inputs (list mesa libpng minizip unzip xxhash zlib))
       (home-page "https://github.com/libretro/mupen64plus-libretro-nx")
       (synopsis "Improved Mupen64Plus libretro core")

gnu/packages/file-systems.scm

@@ -1128,8 +1128,8 @@ transaction log.
      (inherit jfsutils)
      (name "jfsutils-static")
      (inputs
-      `(("util-linux:static" ,util-linux "static")
+      (modify-inputs inputs
-        ,@(package-inputs jfsutils))))))
+        (prepend (list util-linux "static")))))))
 
 (define-public jfs_fsck/static
   (package

gnu/packages/firmware.scm

@@ -1159,10 +1159,10 @@ Executables included are:
       (native-inputs
        (append
          (list acpica
-               nasm
                perl
                python-3
                (list util-linux "lib"))
+         (maybe-nasm (string-append arch "-" arch))
          (if (not (string-prefix? arch (%current-system)))
              (if (string=? arch "armhf")
                  (list (cross-gcc "arm-linux-gnueabihf")

gnu/packages/freedesktop.scm

@@ -43,6 +43,7 @@
 ;;; Copyright © 2024 Janneke Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2025 wvlab <me@wvlab.xyz>
 ;;; Copyright © 2025 jgart <jgart@dismail.de>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -3053,10 +3054,10 @@ useful with system integration.")
          "0zs4z7l9b57jldwz0ban77f3c2zq43ambd0dssf5qg9i216f9lmj"))))
     (build-system gnu-build-system)
     (native-inputs
-     `(("dbus-test-runner" ,dbus-test-runner)
+     (list dbus-test-runner
-       ("glib:bin" ,glib "bin")
+           (list glib "bin")
-       ("pkg-config" ,pkg-config)
+           pkg-config
-       ("xvfb" ,xorg-server-for-tests)))
+           xorg-server-for-tests))
     (inputs
      (list gtk+ glib))
     (arguments
@@ -3417,50 +3418,50 @@ interfaces.")
 (define-public xdg-desktop-portal-wlr
   (package
     (name "xdg-desktop-portal-wlr")
-    (version "0.7.1")
+    (version "0.8.2")
-    (source (origin
+    (source
+     (origin
        (method git-fetch)
        (uri (git-reference
              (url "https://github.com/emersion/xdg-desktop-portal-wlr")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-               (base32
+        (base32 "1jj0a9s3h3i04qsxkhcpxjzbb17hs9ngdy7wkypja09233zdz10w"))
-                "1mbq3czka9swwmfaasnaj89y2m254p3qa522ayclh688jdwh70hq"))
        (patches (search-patches "xdg-desktop-portal-wlr-harcoded-length.patch"))))
     (build-system meson-build-system)
     (arguments
-     `(#:configure-flags
+     (list
-       '("-Dsystemd=disabled"
+      #:configure-flags
+      #~(list "-Dsystemd=disabled"
               "-Dsd-bus-provider=libelogind")
       #:phases
-       (modify-phases %standard-phases
+      #~(modify-phases %standard-phases
           (add-after 'unpack 'hardcode-binaries
             (lambda* (#:key inputs #:allow-other-keys)
               (let ((sh (search-input-file inputs "/bin/sh"))
                     (grim (search-input-file inputs "/bin/grim"))
                     (slurp (search-input-file inputs "/bin/slurp")))
-               (substitute* "src/screenshot/screenshot.c"
+                (substitute* '("src/screencast/chooser.c"
+                               "src/screenshot/screenshot.c")
                   (("grim") grim)
                   (("slurp") slurp)
-                 (("execl\\(\"/bin/sh\", \"/bin/sh\"")
+                  (("/bin/sh") sh))
-                  (string-append "execl(\"" sh "\", \"" sh "\"")))
                 (substitute* "src/screencast/screencast.c"
                   (("execvp\\(\"sh")
-                  (string-append "execvp(\"" sh))))))
+                   (format #f "execvp(\"~a" sh))))))
           (add-after 'install 'install-documentation
-           (lambda* (#:key outputs #:allow-other-keys)
+            (lambda _
               (install-file "../source/README.md"
-                           (string-append (assoc-ref outputs "out")
+                            (string-append #$output "/share/doc/"
-                                          "/share/doc/" ,name)))))))
+                                           #$name)))))))
-    (native-inputs
+    (native-inputs (list cmake-minimal pkg-config scdoc))
-     (list cmake-minimal pkg-config scdoc))
+    (inputs (list bash-minimal
-    (inputs (list elogind
+                  elogind
-                  bash-minimal
                   grim
                   iniparser
-                  mesa
                   libinih
+                  mesa
                   pipewire
                   slurp
                   wayland

gnu/packages/games.scm

@@ -552,14 +552,14 @@ use with @code{udev-service-type}.")
 (define-public armagetronad
   (package
     (name "armagetronad")
-    (version "0.2.9.2.3")
+    (version "0.2.9.3.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://sourceforge/armagetronad/stable/"
                                   version "/armagetronad-" version ".tbz"))
               (sha256
                (base32
-                "0a6rlp2lj5bp7pg1yf8brjyb3mw7nqp3amj19wvz3xni21bbc31k"))))
+                "1q1zlbhbcimr6bw0ms1pr8hz4q850ivi3hvxn3467jfgiq22f3cy"))))
     (build-system gnu-build-system)
     (arguments
      (list #:configure-flags
@@ -576,6 +576,7 @@ use with @code{udev-service-type}.")
                      (("^install_link .*BINDIR.*") "")))))))
     (native-inputs (list pkg-config))
     (inputs (list libxml2
+                  curl
                   (sdl-union (list sdl sdl-image sdl-mixer))
                   freeglut
                   libpng
@@ -3407,7 +3408,8 @@ and defeat them with your bubbles!")
                                  "SamTSE/Sources/Engine/Engine.cpp")
                 (("@OUTPUT_DIR@") #$output)))))))
     (inputs (list sdl2 libvorbis))
-    (native-inputs (list flex bison nasm imagemagick))
+    (native-inputs (cons* flex bison imagemagick
+                          (maybe-nasm)))
     (home-page "https://github.com/tx00100xt/SeriousSamClassic")
     (synopsis "SeriousSam engine and Serious Sam: TFE and TSE")
     (description
@@ -4128,7 +4130,7 @@ a C library, so they can easily be integrated into other programs.")
 (define-public taisei
   (package
     (name "taisei")
-    (version "1.4.2")
+    (version "1.4.4")
     (source
      (origin
        (method url-fetch)
@@ -4136,7 +4138,7 @@ a C library, so they can easily be integrated into other programs.")
                            "taisei/releases/download/v" version
                            "/taisei-" version ".tar.xz"))
        (sha256
-        (base32 "19sgm175clkvpcv0b9p4jkjpfxqw0kyl2i5p8w63kwzqcjp9m1jx"))))
+        (base32 "13b2ha8nsdzbydirvc7hw1q46jzhn6cx9b9spgk777swjlgx2vph"))))
     (build-system meson-build-system)
     (arguments
      (list
@@ -4145,7 +4147,8 @@ a C library, so they can easily be integrated into other programs.")
                                 "-Dr_gles30=enabled"
                                 "-Dshader_transpiler=enabled")))
     (native-inputs
-     (list pkg-config
+     (list cmake-minimal
+           pkg-config
            python
            python-docutils
            python-pygments
@@ -4153,24 +4156,29 @@ a C library, so they can easily be integrated into other programs.")
     (inputs
      (list cglm
            freetype
+           glslang
+           libdecor                     ; XXX: for sdl3
            libpng
            libwebp
            libzip
            mesa
            openssl
            opusfile
-           sdl2
+           sdl3
-           sdl2-mixer
            shaderc
            spirv-cross
+           spirv-tools                  ; for glslang
+           vulkan-loader                ; XXX: for sdl3?
            zlib
            (list zstd "lib")))
     (home-page "https://taisei-project.org/")
     (synopsis "Shoot'em up fangame and libre clone of Touhou Project")
     (description
-     "The player controls a character (one of three: Good, Bad, and Dead),
+     "Taisei is a vertical shoot'em up game, in which the player controls
-dodges the missiles (lots of it cover the screen, but the character's hitbox
+one of three characters.  While moving through stages, a large number of
-is very small), and shoot at the adversaries that keep appear on the screen.")
+enemies and even larger amounts of bullets appear that require careful
+maneuvers to dodge.  By shooting the enemies, players receive powerups
+for their characters, allowing them to shoot even more.")
     (license (list
               ;; game
               license:expat
@@ -4723,6 +4731,10 @@ for common mesh file formats, and collision detection.")
                       (url "https://github.com/thelaui/M.A.R.S.")
                       (commit commit)))
                 (file-name (git-file-name name version))
+                (modules '((guix build utils)))
+                (snippet
+                 #~(begin
+                     (delete-file-recursively "ext_libs_for_windows")))
                 (sha256
                  (base32
                   "0bdi4ja39rark742qvqixm8khai5k8qd84z5kzim9jcjdvvwyqj9"))))
@@ -4749,7 +4761,8 @@ for common mesh file formats, and collision detection.")
 attractive physics.  Players can battle each other or computer controlled
 enemies in different game modes such as space ball, death match, team death
 match, cannon keep, and grave-itation pit.")
-      (license license:gpl3+))))
+      (license (list license:gpl3+
+                     license:cc-by-sa3.0))))) ;/data/audio/music
 
 (define-public alienblaster
   (package
@@ -5344,7 +5357,9 @@ also available.")
                    (with-directory-excursion "src"
                      (substitute* "CMakeLists.txt"
                        (("glm::glm")
-                        "glm")))))))
+                        "glm")))
+                   ;; Rename the icon to match with the executable file.
+                   (rename-file "srb2.png" "ringracers.png")))))
     (build-system cmake-build-system)
     (arguments
      (list
@@ -5354,15 +5369,30 @@ also available.")
               "-DCMAKE_CXX_FLAGS_RELWITHDEBINFO='-O3 -g -DNDEBUG'")
       #:phases
       #~(modify-phases %standard-phases
-          (add-after 'install 'move-and-wrap-binary
+          (replace 'install
+            (lambda _
+              (install-file "bin/ringracers" (string-append #$output "/bin"))
+              (install-file "../source/ringracers.png"
+                            (string-append #$output "/share/pixmaps"))))
+          (add-after 'install 'wrap-program
             ;; Install executable to $out/bin.
             (lambda* (#:key inputs #:allow-other-keys)
-              (with-directory-excursion #$output
-                (mkdir "bin")
-                (rename-file "ringracers" "bin/ringracers")
               (wrap-program "bin/ringracers"
                 `("RINGRACERSWADDIR" =
-                    (,(assoc-ref inputs "ring-racers-data"))))))))))
+                  (,(assoc-ref inputs "ring-racers-data"))))))
+          (add-after 'wrap-program 'create-desktop-entry
+            (lambda _
+              (let* ((datadir (string-append #$output "/share"))
+                     (appdir (string-append datadir "/applications")))
+                (mkdir-p appdir)
+                (make-desktop-entry-file (string-append appdir
+                                                        "/ringracers.desktop")
+                  #:name "Dr. Robotnik's Ring Racers"
+                  #:comment "Technical kart racing game"
+                  #:icon "ringracers"
+                  #:exec (string-append #$output "/bin/ringracers")
+                  #:startup-notify #f
+                  #:categories '("Application" "Game"))))))))
     (native-inputs (list pkg-config))
     (inputs (list glm
                   libogg
@@ -5954,7 +5984,7 @@ Transport Tycoon Deluxe.")
   (package
     (inherit openttd)
     (name "openttd-jgrpp")
-    (version "0.71.1")
+    (version "0.71.2")
     (source
      (origin
        (method git-fetch)
@@ -5963,7 +5993,7 @@ Transport Tycoon Deluxe.")
              (commit (string-append "jgrpp-" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1cy1ghc1mc61hdz8lykx2ggs5nld30jdgj8y4vdli2v1ffhy7xy9"))))
+        (base32 "1gb5gickmf1d1wkzqny5ryapvw32a2g94f77iq0102xhyyw8g8s0"))))
     (inputs (modify-inputs inputs
               (append zstd harfbuzz)))
     (arguments

gnu/packages/geo.scm

@@ -425,8 +425,23 @@ hierarchical hexagonal geospatial indexing system")
                (base32
                 "00qdk9a4048pzfj2rhzkfw3lvm642znf6kr4x29i3d94494pxsnn"))))
     (build-system cmake-build-system)
-    (arguments `(#:phases
+    (arguments
+     `(#:phases
        (modify-phases %standard-phases
+         ,@(if (or (target-x86-32?) (target-arm32?))
+               '((add-after 'unpack 'disable-broken-tests
+                   (lambda _
+                     ;; This test fails due to limited accuracy.
+                     (delete-file "tests/xmltester/tests/general/TestCentroid.xml")
+                     (with-directory-excursion "tests/unit"
+                       ;; These also fail due to limited accuracy.
+                       (delete-file "algorithm/MinimumAreaRectangleTest.cpp")
+                       (delete-file "capi/GEOSMinimumRotatedRectangleTest.cpp")
+                       ;; It is unclear why these fail, but I'm guessing:
+                       ;; limited accuracy.
+                       (delete-file "linearref/LengthIndexedLineTest.cpp")
+                       (delete-file "math/DDTest.cpp")))))
+               '())
          (add-after
              'unpack 'patch-test-shebangs
            (lambda _
@@ -955,6 +970,29 @@ hydrology and waste deposition.")
         (base32
          "03r6mspfv22fs4x4jcgv25v9gsj5k6zy8incvyf94qf50g47s2bc"))))
     (build-system cmake-build-system)
+    (arguments
+     (if (target-32bit?)
+         (list
+          #:phases
+          '(modify-phases %standard-phases
+             (add-after 'unpack 'patch-tests
+               (lambda _
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/unit/test_factory.cpp"
+                   (("^TEST\\(factory, AuthorityFactory_createUnitOfMeasure_linear_us_survey_foot\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_grids.cpp"
+                   (("^TEST_F\\(GridTest, VerticalShiftGridSet_gtx\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_defmodel.cpp"
+                   (("^TEST\\(defmodel, evaluator_horizontal_unit_metre\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/CMakeLists.txt"
+                   (("proj_add_gie_test\\(\"4D-API-cs2cs-style\".+") "")
+                   (("proj_add_gie_test\\(\"Builtins\".+") "")
+                   (("proj_add_gie_test\\(\"peirce_q\".+") ""))))))
+         '()))
     (native-inputs (list googletest pkg-config))
     (propagated-inputs (list curl libtiff sqlite)) ;required by proj.pc
     (home-page "https://proj.org/")
@@ -984,7 +1022,34 @@ lets developers use the functionality of Proj in their own software.")
                            version ".tar.gz"))
        (sha256
         (base32
-         "1g0hkpiablvhsmw0kn5frwgdir3q7avc45p6lc1zhhhzkv5ikydh"))))))
+         "1g0hkpiablvhsmw0kn5frwgdir3q7avc45p6lc1zhhhzkv5ikydh"))))
+    (arguments
+     (if (target-32bit?)
+         (list
+          #:phases
+          '(modify-phases %standard-phases
+             (add-after 'unpack 'patch-tests
+               (lambda _
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/unit/test_factory.cpp"
+                   (("^TEST\\(factory, AuthorityFactory_createUnitOfMeasure_linear_us_survey_foot\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_grids.cpp"
+                   (("^TEST_F\\(GridTest, VerticalShiftGridSet_gtx\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_defmodel.cpp"
+                   (("^TEST\\(defmodel, evaluator_horizontal_unit_metre\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/CMakeLists.txt"
+                   (("proj_add_gie_test\\(\"4D-API-cs2cs-style\".+") "")
+                   (("proj_add_gie_test\\(\"Builtins\".+") "")
+                   (("proj_add_gie_test\\(\"peirce_q\".+") "")
+                   (("proj_add_gie_test\\(\"adams_ws2\".+") ""))
+                 (substitute* "test/cli/CMakeLists.txt"
+                   (("proj_add_test_script_sh\\(\"testvarious\" CS2CS_BIN\\)") ""))))))
+         '()))))
+
 
 (define-public python-obspy
   (package
@@ -1219,20 +1284,23 @@ readily with other Python GIS packages such as pyproj, Rtree, and Shapely.")
 (define-public python-geopack
   (package
     (name "python-geopack")
-    (version "1.0.10")
+    (version "1.0.12")
     (source
      (origin
-       (method url-fetch)
+       (method git-fetch)
-       (uri (pypi-uri "geopack" version))
+       (uri (git-reference
+              (url "https://github.com/tsssss/geopack")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
        (sha256
-        (base32 "0mryjp7m4h99qlpvnn40s81sygr73qcv8rkmjp9pcli1gz829kjf"))))
+        (base32 "0ap5j4359xxjkbz06y097yq5d37sxcwlnlsfwrv6dvza7ydmgcgg"))))
     (build-system pyproject-build-system)
     (arguments
      (list
       ;; XXX Reported upstream <https://github.com/tsssss/geopack/issues/21>.
       #:tests? #f))
     (native-inputs
-     (list python-pytest python-setuptools python-wheel))
+     (list python-setuptools))
     (propagated-inputs
      (list python-numpy python-scipy))
     (home-page "https://github.com/tsssss/geopack")

gnu/packages/gnome.scm

@@ -10674,6 +10674,7 @@ playing media, scanning, and much more.")
                             system-config-printer
                             xdg-desktop-portal
                             xdg-user-dirs
+                            xdg-user-dirs-gtk
                             yelp
                             zenity))
    (description "This package provides a list of packages required for
@@ -11575,7 +11576,8 @@ accessibility infrastructure.")
                     name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0sfs06f66dsibvnp87jshhs7n3f8shkn9x7j3ygpk8409za2n2xy"))))
+                "0sfs06f66dsibvnp87jshhs7n3f8shkn9x7j3ygpk8409za2n2xy"))
+              (patches (search-patches "orca-fix-gst-init-check-call.patch"))))
     (build-system meson-build-system)
     (arguments
      '(#:glib-or-gtk? #t
@@ -11593,10 +11595,7 @@ accessibility infrastructure.")
                    (pgrep (string-append
                            (assoc-ref inputs "procps") "/bin/pgrep")))
                (substitute* "src/orca/orca_modifier_manager.py"
-                 (("'xkbcomp'") (format #f "'~a'" xkbcomp)))
+                 (("\"xkbcomp\"") (format #f "'~a'" xkbcomp)))
-               (substitute* "src/orca/debug.py"
-                 (("'pgrep %s'")
-                  (format #f "'~a %s'" pgrep)))
                (substitute* "src/orca/orca_bin.py.in"
                  (("'pgrep -u %s -x orca'")
                   (format #f "'~a -u %s -x orca'" pgrep))))))
@@ -11627,6 +11626,7 @@ accessibility infrastructure.")
            `(,liblouis "python")
            procps                       ; for pgrep
            python
+           python-dbus
            python-pygobject-3.50
            python-pyatspi
            speech-dispatcher

gnu/packages/gnupg.scm

@@ -26,6 +26,7 @@
 ;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
 ;;; Copyright © 2025 Antoine Côté <antoine.cote@posteo.net>
 ;;; Copyright © 2026 Luis Guilherme Coelho <lgcoelho@disroot.org>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -971,10 +972,8 @@ passphrase when @code{gpg} is run and needs it.")))
            (lambda _
              (invoke "sh" "autogen.sh"))))))
     (native-inputs
-     `(("autoconf" ,autoconf)
+     (modify-inputs native-inputs
-       ("automake" ,automake)
+       (prepend autoconf automake gettext-minimal)))
-       ("gettext" ,gettext-minimal)
-       ,@(package-native-inputs pinentry-tty)))
     (inputs
      (modify-inputs inputs
        (prepend efl)))

gnu/packages/gnuzilla.scm

@@ -605,9 +605,9 @@ in the case of Firefox, it is browser/locales/all-locales."
     "zh-TW"))
 
 ;;; Please keep these versions in sync with icedove.
-(define %icecat-base-version "140.10.0")
+(define %icecat-base-version "140.10.1")
 (define %icecat-version (string-append %icecat-base-version "-gnu1"))
-(define %icecat-build-id "20260421000000") ;must be of the form YYYYMMDDhhmmss
+(define %icecat-build-id "20260428000000") ;must be of the form YYYYMMDDhhmmss
 
 ;; 'icecat-source' is a "computed" origin that generates an IceCat tarball
 ;; from the corresponding upstream Firefox ESR tarball, using the 'makeicecat'
@@ -627,9 +627,9 @@ in the case of Firefox, it is browser/locales/all-locales."
                   "firefox-" upstream-firefox-version ".source.tar.xz"))
             (sha256
              (base32
-              "06996548nfmn4r4mfw3wvgb1mp35majc5hjyhs1krgp33ck2m1f0"))))
+              "1fx52y52c3dmgr5gm64x40r2n6zq5ckqiqsd6vlhsly5wb1w0xaf"))))
 
-         (gnuzilla-commit "02125f31250c0240ee2ab1aa629ce66d4ffb9f30")
+         (gnuzilla-commit "5162cbc74c483c361ad5709c767c5cb2395ff4f9")
          (gnuzilla-source
           (origin
             (method git-fetch)
@@ -640,7 +640,7 @@ in the case of Firefox, it is browser/locales/all-locales."
                                       (string-take gnuzilla-commit 8)))
             (sha256
              (base32
-              "1hgx286gp0j46pklzzh5kvsnari1j3s0bff384m505m942k6l4hf"))))
+              "06qyirgjjgy7fwn7mbrz23wsdv9a88w70pz8qm1yszln74xxdsp0"))))
 
          ;; 'search-patch' returns either a valid file name or #f, so wrap it
          ;; in 'assume-valid-file-name' to avoid 'local-file' warnings.

gnu/packages/golang-check.scm

@@ -245,6 +245,55 @@ go-fuzz-headers.")
 @end itemize")
     (license license:expat)))
 
+(define-public go-github-com-alexkohler-prealloc
+  (package
+    (name "go-github-com-alexkohler-prealloc")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/alexkohler/prealloc")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "011i8yqzyjgwj17k44xvvg4bxfv8z20s0416r2d3yf4s3wqqygpq"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/alexkohler/prealloc"))
+    (home-page "https://github.com/alexkohler/prealloc")
+    (synopsis "Find slice declarations that could be preallocated")
+    (description
+     "This package is a Go static analysis tool to find slice declarations
+that could potentially be preallocated.")
+    (license license:expat)))
+
+(define-public go-github-com-alingse-asasalint
+  (package
+    (name "go-github-com-alingse-asasalint")
+    (version "0.0.11")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/alingse/asasalint")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1avz33cx3gcpps26rxijv7ic0njfmsdkbcp2mqg5yxhdcpq57s0q"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/alingse/asasalint"))
+    (propagated-inputs
+     (list go-golang-org-x-tools))
+    (home-page "https://github.com/alingse/asasalint")
+    (synopsis "Lint pass any slice as any in variadic function")
+    (description
+     "Golang linter, lint that pass any slice as any in variadic function.")
+    (license license:expat)))
+
 (define-public go-github-com-andreyvit-diff
   (package
     (name "go-github-com-andreyvit-diff")
@@ -603,6 +652,42 @@ time functions.")
 strings which may be used in mock tests.")
     (license license:unlicense)))
 
+(define-public go-github-com-daixiang0-gci
+  (package
+    (name "go-github-com-daixiang0-gci")
+    (version "0.13.7")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/daixiang0/gci")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1vhnqisf6d706qvswccb0d7bkbl53lyi84f5sl3zyaf6yk8ml9dx"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:import-path "github.com/daixiang0/gci"))
+    (native-inputs
+     (list go-github-com-stretchr-testify
+           go-github-com-spf13-cobra))
+    (propagated-inputs
+     (list go-gopkg-in-yaml-v3
+           go-golang-org-x-tools
+           go-golang-org-x-sync
+           go-golang-org-x-mod
+           go-go-uber-org-zap
+           go-github-com-pmezard-go-difflib
+           go-github-com-hexops-gotextdiff))
+    (home-page "https://github.com/daixiang0/gci")
+    (synopsis "Tool to make Go import order deterministic")
+    (description
+     "This package provides a tool that controls Go package import order and
+makes it always deterministic.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-data-dog-go-sqlmock
   (package
     (name "go-github-com-data-dog-go-sqlmock")
@@ -676,6 +761,34 @@ style).
 @end itemize")
     (license license:isc)))
 
+(define-public go-github-com-denis-tingaikin-go-header
+  (package
+    (name "go-github-com-denis-tingaikin-go-header")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/denis-tingaikin/go-header")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0qzy2ps59dzsdn4ny8x48k9d1kscpddjilkxra1w16npsvix6mcm"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/denis-tingaikin/go-header"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (propagated-inputs
+     (list go-golang-org-x-tools
+           go-gopkg-in-yaml-v3))
+    (home-page "https://github.com/denis-tingaikin/go-header")
+    (synopsis "Go linter for copyright headers")
+    (description
+     "Simple Go source code linter providing checks for copyright headers.")
+    (license license:gpl3)))
+
 (define-public go-github-com-dgryski-go-ddmin
   (package
     (name "go-github-com-dgryski-go-ddmin")
@@ -885,6 +998,31 @@ can use the mock clock.  This is a maintained fork of benbjohnson's
 @url{https://github.com/benbjohnson/clock, clock} package.")
     (license license:expat)))
 
+(define-public go-github-com-firefart-nonamedreturns
+  (package
+    (name "go-github-com-firefart-nonamedreturns")
+    (version "1.0.6")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/firefart/nonamedreturns")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1y9dz8rkd55p1rkib4y3b0czs44c2bb1pmlr4k53ms1k8d9bjgwk"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/firefart/nonamedreturns"))
+    (propagated-inputs
+     (list go-golang-org-x-tools))
+    (home-page "https://github.com/firefart/nonamedreturns")
+    (synopsis "Go linter to catch named returns")
+    (description
+     "This package provides a linter to find named returns in Go code.")
+    (license license:gpl3)))
+
 ;; XXX: The project looks like abandoned, see
 ;; <https://github.com/frankban/quicktest/issues/172>, remove when nothing
 ;; depends on it.
@@ -923,6 +1061,30 @@ can use the mock clock.  This is a maintained fork of benbjohnson's
 tests.")
     (license license:expat)))
 
+(define-public go-github-com-fzipp-gocyclo
+  (package
+    (name "go-github-com-fzipp-gocyclo")
+    (version "0.6.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/fzipp/gocyclo")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1w2h8qlifrskn8g8zcwb6banr9si0vck9y8irg1r51mc98cjv36l"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/fzipp/gocyclo"))
+    (home-page "https://github.com/fzipp/gocyclo")
+    (synopsis "Calculate cyclomatic complexity in Go")
+    (description
+     "This package calculates the cyclomatic complexities of functions and
+methods in Go source code.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-gdey-tbltest
   (package
     (name "go-github-com-gdey-tbltest")
@@ -947,6 +1109,45 @@ tests.")
 tests.")
     (license license:expat)))
 
+(define-public go-github-com-ghostiam-protogetter
+  (package
+    (name "go-github-com-ghostiam-protogetter")
+    (version "0.3.20")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/ghostiam/protogetter")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1hap2ykmlnan5vz8sczdpiv93iidbgl13mlcdx468nhfprg2hbbm"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:tests? #f ;"module lookup disabled by GOPROXY=off"
+      #:import-path "github.com/ghostiam/protogetter"))
+    (propagated-inputs
+     (list go-golang-org-x-tools
+           go-github-com-gobwas-glob))
+    (home-page "https://github.com/ghostiam/protogetter")
+    (synopsis "Protobuf Golang linter")
+    (description
+     "This package is a linter developed specifically for Go programmers
+working with nested @code{protobuf} types.  It's designed to aid developers in
+preventing invalid memory address or nil pointer dereference errors arising
+from direct access of nested protobuf fields.
+
+When working with protobuf, it's quite common to have complex structures where
+a message field is contained within another message, which itself can be part
+of another message, and so on. If these fields are accessed directly and some
+field in the call chain will not be initialized, it can result in application
+panic.
+
+Protogetter addresses this issue by suggesting use of getter methods for field
+access.")
+    (license license:expat)))
+
 (define-public go-github-com-gkampitakis-ciinfo
   (package
     (name "go-github-com-gkampitakis-ciinfo")
@@ -1202,6 +1403,29 @@ kept in fixtures files.  Before the execution of every test, the test database
 is cleaned and the fixture data is loaded into the database.")
     (license license:expat)))
 
+(define-public go-github-com-go-xmlfmt-xmlfmt
+  (package
+    (name "go-github-com-go-xmlfmt-xmlfmt")
+    (version "1.1.3")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/go-xmlfmt/xmlfmt")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1cglrwmpg0lb7cnyvdz8js52h07rcvka7y9abksk9p5ajxj5rp1s"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/go-xmlfmt/xmlfmt"))
+    (home-page "https://github.com/go-xmlfmt/xmlfmt")
+    (synopsis "Go XML Formatter")
+    (description
+     "The Go XML Formatter, xmlfmt, will format the XML string in a readable way.")
+    (license license:expat)))
+
 ;; XXX: This repository has been archived by the owner
 ;; on May 9, 2021. It is now read-only. It's only used
 ;; by go-github-com-golang-gddo. Consider to remove when nothing
@@ -3967,6 +4191,20 @@ thoroughly
                     "  This package provides an command line interface (CLI)
 tool."))))
 
+(define-public go-gci
+  (package/inherit go-github-com-daixiang0-gci
+    (name "go-gci")
+    (arguments
+     (substitute-keyword-arguments arguments
+       ((#:tests? _ #t) #f)
+       ((#:install-source? _ #t) #f)
+       ((#:skip-build? _ #t) #f)))
+    (native-inputs
+     (append (package-native-inputs go-github-com-daixiang0-gci)
+             (package-propagated-inputs go-github-com-daixiang0-gci)))
+    (propagated-inputs '())
+    (inputs '())))
+
 (define-public go-pgmockproxy
   (package/inherit go-github-com-jackc-pgmock
     (name "go-pgmockproxy")
@@ -4090,6 +4328,21 @@ prints an ASCII fraphic representing the memory layout.")))
                     "  This package provides an command line interface (CLI)
 tool."))))
 
+(define-public protogetter
+  (package/inherit go-github-com-ghostiam-protogetter
+    (name "protogetter")
+    (arguments
+     (substitute-keyword-arguments arguments
+       ((#:tests? _ #f) #f)
+       ((#:skip-build? _ #t) #f)
+       ((#:install-source? _ #t) #f)
+       ((#:import-path _) "github.com/ghostiam/protogetter/cmd/protogetter")
+       ((#:unpack-path _ "") "github.com/ghostiam/protogetter")))
+    (native-inputs
+     (package-propagated-inputs go-github-com-ghostiam-protogetter))
+    (propagated-inputs '())
+    (inputs '())))
+
 (define-public unparam
   (package
     (inherit go-mvdan-cc-unparam)

gnu/packages/golang-crypto.scm

@@ -1600,7 +1600,7 @@ RSA, RSA-PSS, and ECDSA, though hooks are present for adding your own.")
 (define-public go-github-com-google-go-tpm
   (package
     (name "go-github-com-google-go-tpm")
-    (version "0.9.1")
+    (version "0.9.4")
     (source
      (origin
        (method git-fetch)
@@ -1609,7 +1609,7 @@ RSA, RSA-PSS, and ECDSA, though hooks are present for adding your own.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1c5j5cvwl45ka93nknmv454ivd7kp9n8yql19gr6z01z0s1ph7sg"))))
+        (base32 "1sp1mbr6vz36zy9w36iksirbsj5p2jslsl8zs1cdj8s4ig4lkd9d"))))
     (build-system go-build-system)
     (arguments
      (list
@@ -3286,6 +3286,37 @@ to support the streaming mode required by Go's standard Hash interface.")
 @url{https://www.rfc-editor.org/errata/rfc7512, errata} specifications.")
     (license license:asl2.0)))
 
+(define-public go-github-com-tailscale-golang-x-crypto
+  (package
+    (name "go-github-com-tailscale-golang-x-crypto")
+    (version "0.91.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/tailscale/golang-x-crypto")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0m9qkk48mihrkmfh1fzfhc39l8957qkpfx8qbw4xdjws7dy4vzbz"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:tests? #f ;Tests have broken package imports (expected as per readme)
+      #:import-path "github.com/tailscale/golang-x-crypto"))
+    (propagated-inputs
+     (list go-golang-org-x-crypto
+           go-golang-org-x-term
+           go-golang-org-x-sys
+           go-golang-org-x-net))
+    (home-page "https://github.com/tailscale/golang-x-crypto")
+    (synopsis "Supplementary Go crypto libraries")
+    (description
+     "This package holds supplementary Go cryptography libraries, it's a fork
+of @code{golang.org/x/crypto} maintained by Tailscale.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-tink-crypto-tink-go-v2
   (package
     (name "go-github-com-tink-crypto-tink-go-v2")

gnu/packages/golang-maths.scm

@@ -456,6 +456,29 @@ penalization.")
 FFT (Schonhage-Strassen method for multiplying integers).")
     (license license:bsd-3)))
 
+(define-public go-github-com-robinus2-golang-moving-average
+  (package
+    (name "go-github-com-robinus2-golang-moving-average")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/RobinUS2/golang-moving-average")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "02z3ad29653fz7whxkjjpq820ig9j8m68xj4kay14jyazkr5in1f"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/RobinUS2/golang-moving-average"))
+    (home-page "https://github.com/RobinUS2/golang-moving-average")
+    (synopsis "Moving average implementation for Go")
+    (description
+     "This package provides a moving average implementation for Go.")
+    (license license:asl2.0)))
+
 (define-public go-github-com-shopspring-decimal
   (package
     (name "go-github-com-shopspring-decimal")

gnu/packages/golang-xyz.scm

@@ -76,6 +76,7 @@
 ;;; Copyright © 2026 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;; Copyright © 2026 Evgeny Pisemsky <mail@pisemsky.site>
 ;;; Copyright © 2026 Vinicius Monego <monego@posteo.net>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -120,7 +121,13 @@
   #:use-module (gnu packages serialization)
   #:use-module (gnu packages specifications)
   #:use-module (gnu packages xdisorg)
-  #:use-module (gnu packages xorg))
+  #:use-module (gnu packages xorg)
+
+  ;; TODO: Remove when go-github-com-containerd-containerd is moved to (gnu
+  ;; packages containers)
+  #:use-module (gnu packages docker)
+  #:use-module (gnu packages prometheus)
+  #:use-module (gnu packages kubernetes))
 
 ;;; Commentary:
 ;;;
@@ -525,6 +532,35 @@ file along with an index.html file.")
      "Package tcell provides a gruid Driver for making terminal apps.")
     (license license:isc)))
 
+(define-public go-codeberg-org-chavacava-garif
+  (package
+    (name "go-codeberg-org-chavacava-garif")
+    (version "0.2.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://codeberg.org/chavacava/garif.git")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0cz037yb9gnk9fd61pni6m0n9cbrwmlxxija5vm91mplyxlih05h"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "codeberg.org/chavacava/garif"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (home-page "https://codeberg.org/chavacava/garif")
+    (synopsis "Create and manipulate SARIF logs")
+    (description
+     "This package defines all the Go structures required to model a log file.
+
+SARIF, from Static Analysis Results Interchange Format, is a standard
+JSON-based format for the output of static analysis tools defined and promoted
+by @url{https://www.oasis-open.org/, OASIS}.")
+    (license license:expat)))
+
 (define-public go-codeberg-org-emersion-go-scfg
   (package
     (name "go-codeberg-org-emersion-go-scfg")
@@ -613,6 +649,33 @@ recursively any exported one.  It also won't merge structs inside
 maps (because they are not addressable using Go reflection).")
     (license license:bsd-3)))
 
+(define-public go-fyne-io-systray
+  (package
+    (name "go-fyne-io-systray")
+    (version "1.11.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/fyne-io/systray")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0yrd4f3n8wrqcqradmqq9w0b31hd5hali876xkynfhm3nhaz4j1i"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "fyne.io/systray"))
+    (propagated-inputs
+     (list go-github-com-godbus-dbus-v5
+           go-golang-org-x-sys))
+    (home-page "https://fyne.io/systray/")
+    (synopsis "Place an icon and menu in the notification area")
+    (description
+     "This package is a cross-platform Go library to place an icon and menu in
+the notification area.")
+    (license license:asl2.0)))
+
 (define-public go-git-sr-ht-rjarry-go-opt
   (package
     (name "go-git-sr-ht-rjarry-go-opt")
@@ -2981,6 +3044,38 @@ input from the terminal while not echoing the input back (similar to
 and is therefore compatible with cross-compiling.")
     (license license:expat)))
 
+(define-public go-github-com-bitfield-script
+  (package
+    (name "go-github-com-bitfield-script")
+    (version "0.24.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/bitfield/script")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1pzmz7n39sh9sprclzd0m0l0flf626286fh51m065yjhkqzrjw89"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/bitfield/script"
+      #:test-flags #~(list "-vet=off")))
+    (native-inputs
+     (list go-github-com-google-go-cmp))
+    (propagated-inputs
+     (list go-github-com-itchyny-gojq
+           go-github-com-rogpeppe-go-internal
+           go-mvdan-cc-sh-v3))
+    (home-page "https://github.com/bitfield/script")
+    (synopsis "Making it easy to write shell-like scripts in Go")
+    (description
+     "Package script aims to make it easy to write shell-type scripts in Go,
+for general system administration purposes: reading files, counting lines,
+matching strings, and so on.")
+    (license license:expat)))
+
 (define-public go-github-com-bitly-go-hostpool
   (package
     (name "go-github-com-bitly-go-hostpool")
@@ -4433,6 +4528,34 @@ over strings.")
 @code{https://en.wikipedia.org/wiki/WebP, WebP} images.")
     (license license:bsd-3)))
 
+(define-public go-github-com-chainguard-dev-clog
+  (package
+    (name "go-github-com-chainguard-dev-clog")
+    (version "1.8.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/chainguard-dev/clog")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0b95vw8czs2r9lscyi85vppbyqj672zm6z2n9siy1s9yv6fkys62"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/chainguard-dev/clog"))
+    (home-page "https://github.com/chainguard-dev/clog")
+    (synopsis "Context aware slog")
+    (description
+     "This package provides a context-aware Go std lib
+@url{https://pkg.go.dev/log/slog, @code{slog}}.  The context Logger can be
+used to use Loggers from the context.  This is sometimes preferred over the
+@url{https://github.com/chainguard-dev/clog#context-handler, Context Handler},
+since this can make it easier to use different loggers in different
+contexts (e.g. testing).")
+    (license license:asl2.0)))
+
 (define-public go-github-com-charlievieth-fastwalk
   (package
     (name "go-github-com-charlievieth-fastwalk")
@@ -6039,6 +6162,7 @@ dependencies and a simple API.")
     (license license:asl2.0)))
 
 (define-public go-github-com-containerd-containerd
+  ;; TODO: Move to (gnu packages containers).
   (package
     (name "go-github-com-containerd-containerd")
     (version "1.7.22")
@@ -6054,102 +6178,148 @@ dependencies and a simple API.")
        (snippet
         #~(begin
             (use-modules (guix build utils))
-            (delete-file-recursively "vendor")))))
+            (delete-file-recursively "vendor")
+            ;; Submodules with their own go.mod files and packaged separately:
+            ;;
+            ;; - github.com/containerd/containerd/api
+            (delete-file-recursively "api")))))
     (build-system go-build-system)
-
-    ;; For the forgejo-runner build, we only need the pkg/userns module which
-    ;; doesn't require the massive dependency tree for all of containerd, so
-    ;; we cheat and skip the build and avoid having to package a large number
-    ;; of additional dependencies.
     (arguments
      (list
       #:import-path "github.com/containerd/containerd"
       #:skip-build? #t
-      #:tests? #f))
+      #:test-subdirs
-    ;; (propagated-inputs
+      ;; XXX: Remove when all inputs are packaged.
-    ;;  (list go-tags-cncf-io-container-device-interface
+      #~(list "archive/compression"
-    ;;        go-k8s-io-utils
+              "cio"
-    ;;        go-k8s-io-klog-v2
+              "content"
-    ;;        go-k8s-io-cri-api
+              "content/local"
-    ;;        go-k8s-io-component-base
+              "contrib/apparmor"
-    ;;        go-k8s-io-client-go
+              "contrib/seccomp/kernelversion"
-    ;;        go-k8s-io-apiserver
+              "diff/apply"
-    ;;        go-k8s-io-apimachinery
+              "events/exchange"
-    ;;        go-k8s-io-api
+              "gc"
-    ;;        go-google-golang-org-protobuf
+              "gc/scheduler"
-    ;;        go-google-golang-org-grpc
+              "identifiers"
-    ;;        go-google-golang-org-genproto-googleapis-rpc
+              "images"
-    ;;        go-google-golang-org-genproto
+              "labels"
-    ;;        go-golang-org-x-sys
+              "leases"
-    ;;        go-golang-org-x-sync
+              "mount"
-    ;;        go-golang-org-x-net
+              "namespaces"
-    ;;        go-go-opentelemetry-io-otel-trace
+              "pkg/atomic"
-    ;;        go-go-opentelemetry-io-otel-sdk
+              "pkg/atomicfile"
-    ;;        go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracehttp
+              "pkg/cap"
-    ;;        go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracegrpc
+              "pkg/cleanup"
-    ;;        go-go-opentelemetry-io-otel-exporters-otlp-otlptrace
+              "pkg/cri/io"
-    ;;        go-go-opentelemetry-io-otel
+              "pkg/cri/store/label"
-    ;;        go-go-opentelemetry-io-contrib-instrumentation-net-http-otelhttp
+              "pkg/cri/store/snapshot"
-    ;;        go-go-opentelemetry-io-contrib-instrumentation-google-golang-org-grpc-otelgrpc
+              "pkg/cri/streaming/internal/wsstream"
-    ;;        go-go-etcd-io-bbolt
+              "pkg/cri/util"
-    ;;        go-github-com-vishvananda-netlink
+              "pkg/epoch"
-    ;;        go-github-com-urfave-cli
+              "pkg/failpoint"
-    ;;        go-github-com-tchap-go-patricia-v2
+              "pkg/ioutil"
-    ;;        go-github-com-stretchr-testify
+              "pkg/kmutex"
-    ;;        go-github-com-sirupsen-logrus
+              "pkg/registrar"
-    ;;        go-github-com-prometheus-client-golang
+              "pkg/snapshotters"
-    ;;        go-github-com-pelletier-go-toml
+              "pkg/transfer/image"
-    ;;        go-github-com-opencontainers-selinux
+              "pkg/transfer/streaming"
-    ;;        go-github-com-opencontainers-runtime-tools
+              "plugin"
-    ;;        go-github-com-opencontainers-runtime-spec
+              "protobuf"
-    ;;        go-github-com-opencontainers-image-spec
+              "reference"
-    ;;        go-github-com-opencontainers-go-digest
+              "remotes"
-    ;;        go-github-com-moby-sys-userns
+              "remotes/docker/auth"
-    ;;        go-github-com-moby-sys-user
+              "remotes/docker/config"
-    ;;        go-github-com-moby-sys-symlink
+              "runtime/v2/shim"
-    ;;        go-github-com-moby-sys-signal
+              "services/server/config"
-    ;;        go-github-com-moby-sys-sequential
+              "snapshots/benchsuite"
-    ;;        go-github-com-moby-sys-mountinfo
+              "snapshots/devmapper/dmsetup"
-    ;;        go-github-com-moby-locker
+              "snapshots/overlay/overlayutils"
-    ;;        go-github-com-minio-sha256-simd
+              "snapshots/storage")))
-    ;;        go-github-com-klauspost-compress
+    (native-inputs
-    ;;        go-github-com-intel-goresctrl
+     (list go-github-com-davecgh-go-spew
-    ;;        go-github-com-grpc-ecosystem-go-grpc-prometheus
+           go-github-com-google-go-cmp
-    ;;        go-github-com-grpc-ecosystem-go-grpc-middleware
+           go-github-com-stretchr-testify))
-    ;;        go-github-com-google-uuid
+    (propagated-inputs
-    ;;        go-github-com-google-go-cmp
+     (list go-dario-cat-mergo
-    ;;        go-github-com-fsnotify-fsnotify
+           go-github-com-adalogics-go-fuzz-headers
-    ;;        go-github-com-emicklei-go-restful-v3
+           go-github-com-adamkorcz-go-118-fuzz-build
-    ;;        go-github-com-docker-go-units
+           go-github-com-containerd-btrfs-v2
-    ;;        go-github-com-docker-go-metrics
+           go-github-com-containerd-cgroups-v3
-    ;;        go-github-com-docker-go-events
+           go-github-com-containerd-console
-    ;;        go-github-com-distribution-reference
+           go-github-com-containerd-containerd-api
-    ;;        go-github-com-davecgh-go-spew
+           go-github-com-containerd-continuity
-    ;;        go-github-com-coreos-go-systemd-v22
+           go-github-com-containerd-errdefs
-    ;;        go-github-com-containernetworking-plugins
+           go-github-com-containerd-fifo
-    ;;        go-github-com-containernetworking-cni
+           go-github-com-containerd-go-cni
-    ;;        go-github-com-containerd-zfs
+           go-github-com-containerd-go-runc
-    ;;        go-github-com-containerd-typeurl-v2
+           go-github-com-containerd-log
-    ;;        go-github-com-containerd-ttrpc
+           go-github-com-containerd-nri
-    ;;        go-github-com-containerd-platforms
+           go-github-com-containerd-platforms
-    ;;        go-github-com-containerd-nri
+           go-github-com-containerd-ttrpc
-    ;;        go-github-com-containerd-log
+           go-github-com-containerd-typeurl-v2
-    ;;        go-github-com-containerd-imgcrypt
+           go-github-com-containernetworking-cni
-    ;;        go-github-com-containerd-go-runc
+           go-github-com-containernetworking-plugins
-    ;;        go-github-com-containerd-go-cni
+           go-github-com-coreos-go-systemd-v22
-    ;;        go-github-com-containerd-fifo
+           go-github-com-distribution-reference
-    ;;        go-github-com-containerd-errdefs
+           go-github-com-docker-go-events
-    ;;        go-github-com-containerd-continuity
+           go-github-com-docker-go-metrics
-    ;;        go-github-com-containerd-containerd-api
+           go-github-com-docker-go-units
-    ;;        go-github-com-containerd-console
+           go-github-com-emicklei-go-restful-v3
-    ;;        go-github-com-containerd-cgroups-v3
+           go-github-com-fsnotify-fsnotify
-    ;;        go-github-com-containerd-btrfs-v2
+           go-github-com-google-uuid
+           go-github-com-grpc-ecosystem-go-grpc-middleware
+           go-github-com-grpc-ecosystem-go-grpc-prometheus
+           go-github-com-intel-goresctrl
+           go-github-com-klauspost-compress
+           go-github-com-minio-sha256-simd
+           go-github-com-moby-locker
+           go-github-com-moby-sys-mountinfo
+           go-github-com-moby-sys-sequential
+           go-github-com-moby-sys-signal
+           go-github-com-moby-sys-symlink
+           go-github-com-moby-sys-user
+           go-github-com-moby-sys-userns
+           go-github-com-opencontainers-go-digest
+           go-github-com-opencontainers-image-spec
+           go-github-com-opencontainers-runtime-spec
+           go-github-com-opencontainers-runtime-tools
+           go-github-com-opencontainers-selinux
+           go-github-com-pelletier-go-toml
+           go-github-com-prometheus-client-golang
+           go-github-com-sirupsen-logrus
+           go-github-com-tchap-go-patricia-v2
+           go-github-com-urfave-cli
+           go-github-com-vishvananda-netlink
+           go-go-etcd-io-bbolt
+           go-go-opentelemetry-io-contrib-instrumentation-google-golang-org-grpc-otelgrpc
+           go-go-opentelemetry-io-contrib-instrumentation-net-http-otelhttp
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracegrpc
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracehttp
+           go-go-opentelemetry-io-otel-sdk
+           go-go-opentelemetry-io-otel-trace
+           go-golang-org-x-net
+           go-golang-org-x-sync
+           go-golang-org-x-sys
+           go-google-golang-org-genproto
+           go-google-golang-org-genproto-googleapis-rpc
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf
+           go-k8s-io-api
+           go-k8s-io-apimachinery
+           go-k8s-io-apiserver
+           go-k8s-io-client-go
+           go-k8s-io-component-base
+           go-k8s-io-cri-api
+           go-k8s-io-klog-v2
+           go-k8s-io-utils
+           go-tags-cncf-io-container-device-interface
+
+           ;; TODO: Complete packaging.
            ;; go-github-com-containerd-aufs
-    ;;        go-github-com-microsoft-hcsshim
+           ;; go-github-com-containerd-imgcrypt
-    ;;        go-github-com-microsoft-go-winio
+           #;go-github-com-containerd-zfs))
-    ;;        go-github-com-adamkorcz-go-118-fuzz-build
-    ;;        go-github-com-adalogics-go-fuzz-headers
-    ;;        go-dario-cat-mergo))
     (home-page "https://github.com/containerd/containerd")
     (synopsis "Container runtime support daemon")
     (description
@@ -6158,9 +6328,7 @@ robustness, and portability.  It is available as a daemon, which can manage
 the complete container lifecycle of its host system: image transfer and
 storage, container execution and supervision, low-level storage and network
 attachments, etc.")
-    (license license:asl2.0)
+    (license license:asl2.0)))
-    ;; Don't expose since it's a partial package.
-    (properties '((hidden? . #t)))))
 
 (define-public go-github-com-containerd-continuity
   (package
@@ -7103,6 +7271,155 @@ against various paths.  This is particularly useful when trying to filter
 files based on a .gitignore document.")
     (license license:expat)))
 
+(define-public go-github-com-creachadair-command
+  (package
+    (name "go-github-com-creachadair-command")
+    (version "0.2.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/creachadair/command")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0c2y7i8c7kwsqyi6rmql9jpc2xan8jp2cpxgx615safk6xvc41kp"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/creachadair/command"))
+    (native-inputs
+     (list go-github-com-google-go-cmp))
+    (propagated-inputs
+     (list go-github-com-creachadair-mds))
+    (home-page "https://github.com/creachadair/command")
+    (synopsis "Lightweight subcommand-handling library")
+    (description
+     "This package defines plumbing for command dispatch.  It is based on and
+similar in design to the @code{go} command-line tool.")
+    (license license:bsd-3)))
+
+(define-public go-github-com-creachadair-flax
+  (package
+    (name "go-github-com-creachadair-flax")
+    (version "0.0.5")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/creachadair/flax")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1r8s0jqayxglnmkffdpkxl72l594ja82wpa9ypxh1v437kv2gqc2"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/creachadair/flax"))
+    (home-page "https://github.com/creachadair/flax")
+    (synopsis "Bind flags to struct fields")
+    (description
+     "This package implements a helper for attaching flags to the fields of
+struct values.")
+    (license license:bsd-3)))
+
+(define-public go-github-com-creachadair-mds
+  (package
+    (name "go-github-com-creachadair-mds")
+    (version "0.25.15")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/creachadair/mds")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1zdidlcbjlx9aw5j3i73c3mxp7366yh66bn7s5a8p1zaw72k035n"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:go go-1.25
+      #:skip-build? #t
+      #:test-flags
+      #~(list "-skip" (string-join
+                       (list "TestNetwork" ;Needs network
+                             "TestNewHTTPServer"
+                             ;; Broken by read-only FS
+                             "TestDeepPathsWithGlobAndUmask")
+                       "|"))
+      #:import-path "github.com/creachadair/mds"))
+    (native-inputs
+     (list go-github-com-google-go-cmp))
+    (home-page "https://github.com/creachadair/mds")
+    (synopsis "Generic data structures and utility types in Go")
+    (description
+     "This repository defines generic data structures and utility types in Go.
+
+Data structures:
+@itemize
+@item heapq: a heap-structured priority queue
+@item mapset: a basic map-based set implementation
+@item mlink: basic linked sequences (list, queue)
+@item omap: ordered key-value map
+@item queue: an array-based FIFO queue
+@item ring: a circular doubly-linked sequence
+@item stack: an array-based LIFO stack
+@item stree: self-balancing binary-search tree
+@end itemize
+
+Utilities:
+@itemize
+@item cache: an in-memory key/value cache
+@item compare: provides helpers for comparison of values
+@item distinct: a probabilistic distinct-elements counter (CVM)
+@item mbits: helpful functions for manipulating bits and bytes
+@item mdiff: supports creating textual diffs
+@item mnet: provides an in-memory network implementation compatible with the net package
+@item mstr: helpful functions for manipulating strings
+@item mtest: a support library for writing tests
+@item shell: POSIX shell quoting and splitting
+@item slice: helpful functions for manipulating slices
+@item value: helpful functions for basic values and pointers
+@end itemize")
+    (license license:bsd-3)))
+
+(define-public go-github-com-creachadair-msync
+  (package
+    (name "go-github-com-creachadair-msync")
+    (version "0.8.3")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/creachadair/msync")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1z797dc0s99l7xf8zsbynwh1rjqw2w9119n81kjx39zkwrbmnc2w"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:go go-1.25
+      #:import-path "github.com/creachadair/msync"
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'pre-check
+            (lambda* (#:key tests? import-path #:allow-other-keys)
+              ;; See: <https://go.dev/blog/synctest>.
+              (setenv "GOEXPERIMENT" "synctest")
+              (setenv "GODEBUG" "asynctimerchan=0"))))))
+    (propagated-inputs
+     (list go-github-com-creachadair-mds))
+    (home-page "https://github.com/creachadair/msync")
+    (synopsis "Synchronization management types in Go")
+    (description
+     "This package defines two types for managing concurrency: @code{throttle},
+which allows calls to a function to be coalesced among multiple concurrent
+goroutines and @code{trigger}, that implements channel-based condition
+variable.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-creack-pty
   (package
     (name "go-github-com-creack-pty")
@@ -8648,6 +8965,7 @@ interact with distribution components.")
     (license license:asl2.0)))
 
 (define-public go-github-com-docker-docker
+  ;; TODO: Move to (gnu packages docker).
   (package
     (name "go-github-com-docker-docker")
     (version "25.0.7")
@@ -8668,7 +8986,47 @@ interact with distribution components.")
      (list
       #:import-path "github.com/docker/docker"
       #:skip-build? #t
-      #:tests? #f))
+      #:test-subdirs
+      ;; XXX: Remove when all inputs are packaged.
+      #~(list "api/types/strslice"
+              "api/types/time"
+              "api/types/versions"
+              "builder/remotecontext/urlutil"
+              "cli/debug"
+              "daemon/links"
+              "daemon/network"
+              "errdefs"
+              "integration/plugin"
+              "integration/plugin/logging/cmd/discard"
+              "internal/mod"
+              "libnetwork/bitmap"
+              "libnetwork/etchosts"
+              "libnetwork/internal/caller"
+              "libnetwork/ipbits"
+              "libnetwork/options"
+              "libnetwork/portallocator"
+              "pkg/broadcaster"
+              "pkg/capabilities"
+              "pkg/directory"
+              "pkg/dmesg"
+              "pkg/fileutils"
+              "pkg/homedir"
+              "pkg/ioutils"
+              "pkg/longpath"
+              "pkg/meminfo"
+              "pkg/namesgenerator"
+              "pkg/parsers"
+              "pkg/parsers/kernel"
+              "pkg/pidfile"
+              "pkg/plugins/pluginrpc-gen"
+              "pkg/process"
+              "pkg/progress"
+              "pkg/stdcopy"
+              "pkg/stringid"
+              "pkg/useragent"
+              "plugin/v2"
+              "restartmanager"
+              "volume/drivers")))
     (propagated-inputs
      (list go-github-com-containerd-containerd
            go-github-com-containerd-log
@@ -8967,6 +9325,41 @@ sub-interfaces are also provided for cases where the full Channel interface
 cannot be met (for example, @code{InChannel} for write-only channels).")
     (license license:expat)))
 
+(define-public go-github-com-eapache-go-resiliency
+  (package
+    (name "go-github-com-eapache-go-resiliency")
+    (version "1.7.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/eapache/go-resiliency")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "07a1r3c2spd37k3riy4fxz8v8ibxiprf8a3vw788whz4mlp6gm40"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:import-path "github.com/eapache/go-resiliency"))
+    (home-page "https://github.com/eapache/go-resiliency")
+    (synopsis "Resiliency patterns for golang")
+    (description
+     "Resiliency patterns for golang.  Based in part on
+@url{https://github.com/Netflix/Hystrix, Hystrix},
+@@url{https://github.com/Shopify/semian, Semian}, and others.
+
+Currently implemented patterns include:
+@itemize
+@item circuit-breaker
+@item semaphore
+@item deadline/timeout
+@item batching
+@item retriable
+@end itemize")
+    (license license:expat)))
+
 (define-public go-github-com-eapache-queue
   (package
     (name "go-github-com-eapache-queue")
@@ -12570,8 +12963,7 @@ single @code{Tree} implementation, optimized for sparse nodes.")
      (list
       #:import-path "github.com/hashicorp/go-immutable-radix/v2"))
     (propagated-inputs
-     (modify-inputs (package-propagated-inputs
+     (modify-inputs propagated-inputs
-                     go-github-com-hashicorp-go-immutable-radix)
        (prepend go-golang-org-x-exp)
        (replace "go-github-com-hashicorp-golang-lru"
                 go-github-com-hashicorp-golang-lru-v2)))))
@@ -13298,6 +13690,32 @@ subsystem in Linux.")
 used in other languages but absent in Go package strings.")
     (license license:expat)))
 
+(define-public go-github-com-huin-goutil
+  (package
+    (name "go-github-com-huin-goutil")
+    (version "0.0.0-20170803182201-1ca381bf3150")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/huin/goutil")
+              (commit (go-version->git-ref version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0alhyacsfqic2wxyqn4gvk9wzjl4pkmy8rhvqjk84xsghgx5xf12"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:import-path "github.com/huin/goutil"))
+    (home-page "https://github.com/huin/goutil")
+    (synopsis "Collection of Go utility code")
+    (description
+     "This package is a collection of miscellaneous Go utility code that is
+potentially useful across multiple projects, and has therefore been factored
+out.")
+    (license license:bsd-2)))
+
 (define-public go-github-com-iancoleman-orderedmap
   (package
     (name "go-github-com-iancoleman-orderedmap")
@@ -16374,6 +16792,29 @@ structure.  It can also produce a much more verbose, one-item-per-line
 representation suitable for computing diffs.")
     (license license:asl2.0)))
 
+(define-public go-github-com-kodeworks-golang-image-ico
+  (package
+    (name "go-github-com-kodeworks-golang-image-ico")
+    (version "0.0.0-20141118225523-73f0f4cfade9")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/Kodeworks/golang-image-ico")
+              (commit (go-version->git-ref version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0zfcvpf6pdqismq9j8nvismln1dbz2i22d7c00a2ygjxldbmnd3k"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/Kodeworks/golang-image-ico"))
+    (home-page "https://github.com/Kodeworks/golang-image-ico")
+    (synopsis "Golang support for Windows .ico file format")
+    (description
+     "This package provides Golang support for Windows' @code{.ico} file format.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-labstack-gommon
   (package
     (name "go-github-com-labstack-gommon")
@@ -22390,6 +22831,88 @@ without configuration, but if desired, everything can be customized down to the
 smallest detail.")
     (license license:expat)))
 
+(define-public go-github-com-puzpuzpuz-xsync
+  (package
+    (name "go-github-com-puzpuzpuz-xsync")
+    (version "1.5.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/puzpuzpuz/xsync")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1qfmiyk5wypssr30nj5qp4izdav5gbaxf1324i70vjhn5g8g74mb"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/puzpuzpuz/xsync"))
+    (home-page "https://github.com/puzpuzpuz/xsync")
+    (synopsis "Concurrent data structures for Go")
+    (description
+     "This package is an extension for the standard @code{sync} package and
+provides the following concurrent data structures for Go: a concurrent
+counter, concurrent hash table, multiple concurrent queues and @code{mutex}.")
+    (license license:expat)))
+
+(define-public go-github-com-puzpuzpuz-xsync-v2
+  (package
+    (inherit go-github-com-puzpuzpuz-xsync)
+    (name "go-github-com-puzpuzpuz-xsync-v2")
+    (version "2.5.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/puzpuzpuz/xsync")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1almmzvkhyvhdwyhv9jphbhcm5yv45cmv9v39r3rcbkvl212igmz"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/puzpuzpuz/xsync/v2"))))
+
+(define-public go-github-com-puzpuzpuz-xsync-v3
+  (package
+    (inherit go-github-com-puzpuzpuz-xsync-v2)
+    (name "go-github-com-puzpuzpuz-xsync-v3")
+    (version "3.5.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/puzpuzpuz/xsync")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0k2ir8ixr5h0rwfd4i0nxlgmcrklld06jcbp5ghxk6hpxrhzs1y8"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/puzpuzpuz/xsync/v3"))))
+
+(define-public go-github-com-puzpuzpuz-xsync-v4
+  (package
+    (inherit go-github-com-puzpuzpuz-xsync-v3)
+    (name "go-github-com-puzpuzpuz-xsync-v4")
+    (version "4.5.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/puzpuzpuz/xsync")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "04caylbphjgq1qbpd09cg0b8h84y4zznsdfhi20w4f1628fq7077"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/puzpuzpuz/xsync/v4"))))
+
 (define-public go-github-com-quasilyte-go-ruleguard-dsl
   (package
     (name "go-github-com-quasilyte-go-ruleguard-dsl")
@@ -28603,6 +29126,30 @@ designed to work with the MySQL protocol version 4.1 or greater.  It definitely
 works well with MySQL server version 5.0 and 5.1.")
     (license license:bsd-3)))
 
+(define-public go-github-com-ziutek-telnet
+  (package
+    (name "go-github-com-ziutek-telnet")
+    (version "0.1.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/ziutek/telnet")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0w0zn8yhpmhrph41dlf9pn5h1zzhgajxwbx85fk4d0m55xp0r680"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/ziutek/telnet"))
+    (home-page "https://github.com/ziutek/telnet")
+    (synopsis "Telnet interface in Go")
+    (description
+     "This package provides a simple interface for interacting with Telnet
+connections.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-zk-org-pretty
   (package
     (name "go-github-com-zk-org-pretty")
@@ -29757,49 +30304,25 @@ organization}.")
        (list
         #:skip-build? #t
         #:import-path "go4.org"
-        #:test-subdirs
+        #:test-flags #~(list "-vet=off")
-        #~(list "bytereplacer/..."
-                ;; "cloud/..." ; missing packages
-                "ctxutil/..."
-                "errorutil/..."
-                "fault/..."
-                "jsonconfig/..."
-                "legal/..."
-                "lock/..."
-                "media/..."
-                "must/..."
-                "net/..."
-                "net/throttle/..."
-                "oauthutil/..."
-                "osutil/..."
-                "readerutil/..."
-                "reflectutil/..."
-                "rollsum/..."
-                "sort/..."
-                "strutil/..."
-                "syncutil/..."
-                "testing/..."
-                "testing/functest/..."
-                "types/..."
-                ;; "wkfs/..." ; missing packages
-                "writerutil/..."
-                "xdgdir/...")
         #:phases
         #~(modify-phases %standard-phases
             (add-after 'unpack 'remove-examples
               (lambda* (#:key import-path #:allow-other-keys)
                 (with-directory-excursion (string-append "src/" import-path)
                   (for-each delete-file
-                            (find-files "." "example.*_test\\.go$"))))))
+                            (find-files "." "example.*_test\\.go$"))))))))
-        #:test-flags #~(list "-vet=off")))
+      (native-inputs
+       ;; XXX: Remove when cycle is fixed.
+       (list go-github-com-envoyproxy-go-control-plane))
       (propagated-inputs
-       (list ;; go-cloud-google-com-go
+       (list go-cloud-google-com-go
-             ;; go-cloud-google-com-go-storage
+             go-cloud-google-com-go-storage
              go-github-com-rwcarlsen-goexif
              go-golang-org-x-net
              go-golang-org-x-oauth2
              go-golang-org-x-sys
-             #; go-google-golang-org-api))
+             go-google-golang-org-api))
       (home-page "https://github.com/go4org/go4")
       (synopsis "Collection of packages for Go programmers")
       (description
@@ -29846,6 +30369,30 @@ for locating directories
 @end itemize")
       (license (list license:asl2.0 license:bsd-3)))))
 
+(define-public go-go4-org-mem
+  (package
+    (name "go-go4-org-mem")
+    (version "0.0.0-20240501181205-ae6ca9944745")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/go4org/mem")
+              (commit (go-version->git-ref version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1h2bam1h6xi0lx9s0k44fvd28vkb6rh9vndz3srhwi6axvm8ir0s"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "go4.org/mem"))
+    (home-page "https://go4.org/mem")
+    (synopsis "Cheap read-only memory types in Go")
+    (description
+     "Package mem provides the @code{mem.RO} type that allows you to cheaply
+pass & access either a read-only @code{[]byte} or a @code{string}.")
+    (license license:asl2.0)))
+
 (define-public go-golang-org-rainycape-unidecode
   (let ((commit "cb7f23ec59bec0d61b19c56cd88cee3d0cc1870c")
         (revision "1"))
@@ -30438,8 +30985,8 @@ The yaml package supports most of YAML 1.2, but preserves some behavior from
 ;; to build NNCP and remove vendor) dependency for Golang.  Full build depends
 ;; on Bazel <https://bazel.build/>.
 (define-public go-gvisor-dev-gvisor
-  (let ((commit "634ce95eed8d5b8e6b3e2ea30542c34cb30af148")
+  (let ((commit "9414b50a5633100fd7299a5a7998742575dcb669")
-        (revision "0"))
+        (revision "1"))
     (package
       (name "go-gvisor-dev-gvisor")
       (version (git-version "0.0.0" revision commit))
@@ -30451,7 +30998,7 @@ The yaml package supports most of YAML 1.2, but preserves some behavior from
                (commit commit)))
          (file-name (git-file-name name version))
          (sha256
-          (base32 "1l3si6qlchwgsvaq6lxyvj8iq8n8pqxlayb1hbdf3pynxi52hfkw"))))
+          (base32 "0vqaclb2ignkcs7n463bj349m0xybdsv71i6afhzh8r05hdywzax"))))
       (build-system go-build-system)
       (arguments
        (list

gnu/packages/gtk.scm

@@ -2763,6 +2763,43 @@ entire output.  It supports all Layer Shell features including popups and
 popovers.")
     (license license:expat)))
 
+(define-public xdg-user-dirs-gtk
+  (package
+    (name "xdg-user-dirs-gtk")
+    (version "0.16")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://gitlab.gnome.org/GNOME/xdg-user-dirs-gtk.git")
+                     (commit version)))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "11h1164mkajpfrp6mkky2gvx3xd7dw0c9f2785jf4lys4jmmj4c3"))))
+    (build-system meson-build-system)
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'fix-exec-path
+            (lambda* (#:key inputs #:allow-other-keys)
+              (substitute* "update.c"
+                (("xdg-user-dirs-update")
+                 (search-input-file inputs "/bin/xdg-user-dirs-update"))))))))
+    (native-inputs
+     (list gettext-minimal
+           pkg-config))
+    (inputs
+     (list gtk+
+           xdg-user-dirs))
+    (home-page "https://gitlab.gnome.org/GNOME/xdg-user-dirs-gtk")
+    (synopsis "Integration of xdg-user-dirs with GTK")
+    (description "This package is a companion to @code{xdg-user-dirs} to
+integrate it with the GNOME desktop and GTK applications.  It gets run during
+login to create default GTK bookmarks files containing the user directories, and
+to rename these directories if the locale changes.")
+    (license license:gpl2+)))
+
 (define-public goocanvas
   (package
     (name "goocanvas")

gnu/packages/guile-xyz.scm

@@ -7764,8 +7764,8 @@ is an attempt to combine both into something useful.")
       (license license:asl2.0))))
 
 (define-public guile-knots
-  (let ((commit "f767eca066495e6582e89ba1b91907c0c5657878")
+  (let ((commit "49996c432a4616e03ecaf01cb42afc5fd78eafd5")
-        (revision "34"))
+        (revision "35"))
     (package
     (name "guile-knots")
     (version (git-version "0.1" revision commit))
@@ -7776,7 +7776,7 @@ is an attempt to combine both into something useful.")
                     (commit commit)))
               (sha256
                (base32
-                "18fqmpyrrxy8phxxm5b7d1qhhvc3rsrs243xiinkj2hn2ca1cqi8"))
+                "0i6vk432shy7qmsq1hli71a9kmgf8yy9hx3bck0r9qzsldv1m3m9"))
               (file-name (git-file-name name version))))
     (build-system gnu-build-system)
     (arguments

gnu/packages/hardware.scm

@@ -23,6 +23,7 @@
 ;;; Copyright © 2025 Eric Bavier <bavier@posteo.net>
 ;;; Copyright © 2025 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2025 James Smith <jsubuntuxp@disroot.org>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1000,22 +1001,21 @@ information can be viewed in real time and/or logged to a file.")
     (source
      (origin
        (method git-fetch)
-       (uri
+       (uri (git-reference
-        (git-reference
+              (url "https://github.com/dell/libsmbios")
-         (url (string-append "https://github.com/dell/" name))
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
         (base32 "0krwwydyvb9224r884y1mlmzyxhlfrcqw73vi1j8787rl0gl5a2i"))))
     (build-system gnu-build-system)
     (native-inputs
-     `(("autoconf" ,autoconf)
+     (list autoconf
-       ("automake" ,automake)
+           automake
-       ("gettext" ,gettext-minimal)
+           gettext-minimal
-       ("libtool" ,libtool)
+           libtool
-       ("pkg-config" ,pkg-config)
+           pkg-config
-       ("perl" ,perl)
+           perl
-       ("python" ,python)))
+           python))
     (inputs
      (list libxml2))
     (arguments

gnu/packages/image-viewers.scm

@@ -38,6 +38,7 @@
 ;;; Copyright © 2025 Zhu Zihao <all_but_last@163.com>
 ;;; Copyright © 2025 Vinicius Monego <monego@posteo.net>
 ;;; Copyright © 2025 Igorj Gorjaĉev <igor@goryachev.org>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -305,7 +306,7 @@ actions.")
 (define-public geeqie
   (package
     (name "geeqie")
-    (version "2.6.1")
+    (version "2.7")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -313,11 +314,12 @@ actions.")
                     (commit (string-append "v" version))))
               (sha256
                (base32
-                "08yr8jqli33rn1zvj9mjvinyzjp2myakxgf8wqqq8yidmm0vvn1p"))
+                "139ffzqqq79d3k5q99r8i1jr9v9vfwv89dkh6vvw1mdnv6b3s9n8"))
               (file-name (git-file-name name version))))
     (build-system meson-build-system)
     (arguments
      (list
+      #:glib-or-gtk? #t
       #:phases
       #~(modify-phases %standard-phases
           ;; Disable test which requires binaries not present
@@ -346,6 +348,7 @@ actions.")
            libwebp))
     (native-inputs
      (list `(,glib "bin") ; glib-gettextize
+           gsettings-desktop-schemas
            intltool
            pkg-config
            python         ; for tests
@@ -924,15 +927,15 @@ with tiling window managers.  Features include:
            ;; That is required for testing.
            xorg-server-for-tests))
     (inputs
-     `(("imlib2" ,imlib2)
+     (list imlib2
-       ("glib" ,glib)
+           glib
-       ("gtk+" ,gtk+-2)
+           gtk+-2
-       ("lcms" ,lcms)
+           lcms
-       ("libjpeg" ,libjpeg-turbo)
+           libjpeg-turbo
-       ("libtiff" ,libtiff)
+           libtiff
-       ("libexif" ,libexif)
+           libexif
-       ("libx11" ,libx11)
+           libx11
-       ("libxext" ,libxext)))
+           libxext))
     (arguments
      `(#:phases
        (modify-phases %standard-phases

gnu/packages/irc.scm

@@ -18,6 +18,7 @@
 ;;; Copyright © 2024 Christian Miller <christian.miller@dadoes.de>
 ;;; Copyright © 2024 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2025 Zheng Junjie <z572@z572.online>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -433,11 +434,11 @@ using a mouse.  It is customizable and extensible with plugins and scripts.")
       #:tests? #f ;there are no tests
       #:glib-or-gtk? #t))
     (native-inputs
-     `(("gettext" ,gettext-minimal)
+     (list gettext-minimal
-       ("glib:bin" ,glib "bin")
+           `(,glib "bin")
-       ("pkg-config" ,pkg-config)
+           pkg-config
-       ("python" ,python-wrapper)
+           python-wrapper
-       ("python-sphinx" ,python-sphinx)))
+           python-sphinx))
     (inputs
      (list glib-networking
            gsettings-desktop-schemas

gnu/packages/java-bootstrap.scm

@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019, 2021 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2014-2019, 2021, 2026 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2021, 2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017, 2022 Marius Bakke <marius@gnu.org>
@@ -226,6 +226,18 @@ JNI.")
              (setenv "JAVACMD" (search-input-file inputs "/bin/jamvm"))
              (setenv "JAVAC" (search-input-file inputs "/bin/jikes"))
              (setenv "CLASSPATH" (search-input-file inputs "/lib/rt.jar"))))
+         ,@(if (target-x86-32?)
+               ;; XXX: On i686 isFile() always seems to return true.  Patching
+               ;; this here is very ugly, but the effects are limited.  None
+               ;; of these changes remain by the time we've built Icedtea and
+               ;; the other JDKs.
+               '((add-after 'unpack 'disable-isFile-checks
+                   (lambda _
+                     (substitute* "src/main/org/apache/tools/ant/util/ResourceUtils.java"
+                       (("destFile = \\(\\(FileProvider\\).*") ""))
+                     (substitute* "src/main/org/apache/tools/ant/taskdefs/Mkdir.java"
+                       (("dir.isFile\\(\\)") "false")))))
+               '())
          (replace 'build
            (lambda* (#:key inputs outputs #:allow-other-keys)
              ;; Ant complains if this file doesn't exist.

gnu/packages/java-graphics.scm

@@ -165,17 +165,18 @@ ascii art drawings that contain characters that resemble lines like @samp{|}
                 "017n1w6hds4wrz597jk7v8r6pz0kz5j9xwd240nq7s8hc58d4c2q"))
               (modules '((guix build utils)))
               (snippet
-               '(for-each
+               ;; Remove pre-built native libraries.
-                 delete-file
+               '(for-each delete-file
-                 (find-files "flatlaf-core/src/main/resources/com/formdev/flatlaf/natives/"
+                          (find-files "." "\\.(dll|dylib|so)$")))))
-                             ".*")))))
     (build-system ant-build-system)
     (arguments
      (list
+      #:jdk openjdk17
       #:tests? #false                   ;XXX requires junit5
-      #:jar-name "flatlaf.jar"
+      #:modules '((guix build ant-build-system)
-      #:source-dir '(list "flatlaf-core/src/main/java")
+                  (guix build java-utils)
-      #:test-dir '(list "flatlaf-core/src/test")
+                  (guix build utils)
+                  (sxml simple))
       #:phases
       #~(modify-phases %standard-phases
           (add-before 'configure 'build-native-code
@@ -224,8 +225,58 @@ ascii art drawings that contain characters that resemble lines like @samp{|}
           (add-before 'build 'copy-resources
             (lambda _
               (copy-recursively "flatlaf-core/src/main/resources"
-                                "build/classes"))))))
+                                "build/classes")))
-    (inputs (list libx11 libxt))
+          (add-before 'build 'generate-pom
+            (lambda _
+              (call-with-output-file "pom.xml"
+                (lambda (port)
+                  (sxml->xml
+                   `(*TOP*
+                     (*PI* xml "version=\"1.0\" encoding=\"UTF-8\"")
+                     (project
+                      (modelVersion "4.0.0")
+                      (groupId "com.formdev")
+                      (artifactId "flatlaf")
+                      (version ,#$version)))
+                   port)))))
+          (replace 'build
+            (lambda* (#:key inputs #:allow-other-keys)
+              (let* ((jdk (assoc-ref inputs "jdk"))
+                     (src-dir "flatlaf-core/src/main/java")
+                     (java9-dir "flatlaf-core/src/main/java9")
+                     (classes-dir "build/classes")
+                     (classes9-dir "build/classes9")
+                     (jar-file
+                      (string-append "build/flatlaf-" #$version ".jar")))
+                ;; Compile main sources (Java 8 target).
+                (apply invoke "javac"
+                       "--release" "8"
+                       "-d" classes-dir
+                       (find-files src-dir "\\.java$"))
+                ;; Compile Java 9 multi-release sources.
+                (mkdir-p classes9-dir)
+                (apply invoke "javac"
+                       "--release" "9"
+                       "-cp" classes-dir
+                       "-d" classes9-dir
+                       (find-files java9-dir "\\.java$"))
+                ;; Create multi-release JAR.
+                (let ((meta-versions
+                       (string-append classes-dir
+                                      "/META-INF/versions/9")))
+                  (mkdir-p meta-versions)
+                  (copy-recursively classes9-dir meta-versions))
+                (call-with-output-file "build/manifest.mf"
+                  (lambda (port)
+                    (display "Multi-Release: true\n" port)))
+                (invoke "jar" "--create"
+                        "--file" jar-file
+                        "--manifest" "build/manifest.mf"
+                        "-C" classes-dir "."))))
+          (replace 'install
+            (install-from-pom "pom.xml")))))
+    (inputs
+     (list libx11 libxt))
     (home-page "https://www.formdev.com/flatlaf/")
     (synopsis "Flat Look and Feel for Java Swing applications")
     (description "FlatLaf is a cross-platform Look and Feel for Java Swing

gnu/packages/kde-utils.scm

@@ -485,11 +485,23 @@ to camera devices supported by @code{libgphoto2} using
        (uri (string-append "mirror://kde/stable/release-service/" version
                            "/src/kate-" version ".tar.xz"))
        (sha256
-        (base32 "0ah6cy92yir68z25460ccl48i5nrfqswpzil9a7l69h3qxspsk88"))))
+        (base32 "0ah6cy92yir68z25460ccl48i5nrfqswpzil9a7l69h3qxspsk88"))
+       (modules '((guix build utils)))
+       ;; Unbundle SingleApplication.
+       (snippet
+        '(begin
+           (delete-file-recursively "3rdparty/SingleApplication")
+           (with-directory-excursion "apps/kate"
+             (substitute* "CMakeLists.txt"
+               ((".*3rdparty.*") "")
+               ((" -DQAPPLICATION_CLASS=FreeStandingSingleApplication") ""))
+             (substitute* "main.cpp"
+               (("(#include )\"SingleApplication\\/SingleApplication\"" _ keep)
+                (string-append keep "<SingleApplication>"))))))))
     (build-system qt-build-system)
     (native-inputs
      (list extra-cmake-modules kdoctools xorg-server-for-tests))
-    ;; TODO: Unbundle rapidjson and SingleApplication.
+    ;; TODO: Unbundle rapidjson.
     (inputs
      (list breeze-icons ;; default icon set
            karchive
@@ -515,11 +527,20 @@ to camera devices supported by @code{libgphoto2} using
            libxkbcommon
            plasma-activities
            qtsvg
-           qtwayland))
+           qtwayland
+           single-application))
     (arguments
      (list #:qtbase qtbase
            #:phases
            #~(modify-phases %standard-phases
+               (add-after 'unpack 'link-single-application
+                 (lambda _
+                   (substitute* "apps/kate/CMakeLists.txt"
+                     (("target_link_libraries\\(kate-bin PRIVATE kateprivate"
+                       all)
+                      (string-append all " "
+                                     #$(this-package-input "single-application")
+                                     "/lib/libSingleApplication.a")))))
                (add-after 'unpack 'patch-tests
                  (lambda* (#:key inputs #:allow-other-keys)
                    ;; This test requires a 'bin' diretory under '/usr'.

gnu/packages/kubernetes.scm

@@ -24,6 +24,7 @@
   #:use-module (guix packages)
   #:use-module (gnu packages golang-build)
   #:use-module (gnu packages golang-check)
+  #:use-module (gnu packages golang-crypto)
   #:use-module (gnu packages golang-web)
   #:use-module (gnu packages golang-xyz)
   #:use-module (gnu packages prometheus))
@@ -33,6 +34,313 @@
 ;;; Libraries:
 ;;;
 
+(define-public go-go-etcd-io-etcd-client-v3
+  (package
+    (name "go-go-etcd-io-etcd-client-v3")
+    (version "3.6.7")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/etcd-io/etcd")
+             (commit (go-version->git-ref version #:subdir "client"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0d9rjyl5h0xm9isgr8b2fz8528wk3pds71rjl8g08fgsmsa5kicb"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet #~(begin
+                    (define (delete-all-but directory . preserve)
+                      (with-directory-excursion directory
+                        (let* ((pred (negate (cut member <>
+                                                  (cons* "." ".." preserve))))
+                               (items (scandir "." pred)))
+                          (for-each (cut delete-file-recursively <>) items))))
+                    ;; Replace symlinks to tests with file contents
+                    (for-each
+                     (lambda (f)
+                       (delete-file (string-append "client/v3/" f))
+                       (copy-file (string-append
+                                   "tests/integration/clientv3/examples/" f)
+                                  (string-append "client/v3/" f)))
+                     (list "example_auth_test.go"
+                           "example_cluster_test.go"
+                           "example_kv_test.go"
+                           "example_lease_test.go"
+                           "example_maintenance_test.go"
+                           "example_metrics_test.go"
+                           "example_test.go"
+                           "example_watch_test.go"))
+                    (for-each
+                     (lambda (f)
+                       (delete-file
+                        (string-append "client/v3/concurrency/" f))
+                       (copy-file
+                        (string-append "tests/integration/clientv3/concurrency/" f)
+                        (string-append "client/v3/concurrency/" f)))
+                     (list "example_election_test.go"
+                           "example_mutex_test.go"
+                           "example_stm_test.go"))
+                    ;; Copy sertificates for tests.
+                    (mkdir-p "client/v3/tests/fixtures")
+                    (substitute* "client/v3/yaml/config_test.go"
+                      (("\\.\\./\\.\\./\\.\\./") "../"))
+                    (for-each
+                     (lambda (f)
+                       (copy-file
+                        (string-append "tests/fixtures/" f)
+                        (string-append "client/v3/tests/fixtures/" f)))
+                     (list "server.crt"
+                           "server.key.insecure"
+                           "ca.crt"))
+                    ;; Keep source related to expected import-path.
+                    (delete-all-but "." "client")
+                    (delete-file-recursively "client/pkg")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      ;; TODO: Tests a shaky and fail a lot, check how run unittests.
+      #:tests? #f 
+      #:import-path "go.etcd.io/etcd/client/v3"
+      #:unpack-path "go.etcd.io/etcd"))
+    (native-inputs
+     (list go-github-com-grpc-ecosystem-go-grpc-middleware-providers-prometheus
+           go-github-com-prometheus-client-golang
+           go-github-com-stretchr-testify
+           go-go-etcd-io-etcd-client-pkg-v3
+           go-go-uber-org-zap
+           go-google-golang-org-grpc))
+    (propagated-inputs
+     (list go-github-com-coreos-go-semver
+           go-github-com-dustin-go-humanize
+           go-github-com-grpc-ecosystem-go-grpc-middleware-v2
+           go-go-etcd-io-etcd-api-v3
+           go-sigs-k8s-io-yaml))
+    (home-page "https://github.com/etcd-io/etcd")
+    (synopsis "Golang client for ETCD")
+    (description
+     "This package implements the official Go client for etcd.")
+    (license license:asl2.0)))
+
+(define-public go-go-etcd-io-etcd-server-v3
+  (package
+    (name "go-go-etcd-io-etcd-server-v3")
+    (version "3.6.7")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/etcd-io/etcd")
+             (commit (go-version->git-ref version
+                                          #:subdir "server"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0d9rjyl5h0xm9isgr8b2fz8528wk3pds71rjl8g08fgsmsa5kicb"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet #~(begin
+                    (define (delete-all-but directory . preserve)
+                      (with-directory-excursion directory
+                        (let* ((pred (negate (cut member <>
+                                                  (cons* "." ".." preserve))))
+                               (items (scandir "." pred)))
+                          (for-each (cut delete-file-recursively <>) items))))
+                    (delete-all-but "." "server")
+                    (rename-file "server" "server.tmp")
+                    (mkdir-p "server/v3")
+                    (rename-file "server.tmp" "server/v3")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:tests? #f ;Setup fails
+      #:import-path "go.etcd.io/etcd/server/v3"
+      #:unpack-path "go.etcd.io/etcd"))
+    (propagated-inputs
+     (list go-github-com-coreos-go-semver
+           go-github-com-coreos-go-systemd-v22
+           go-github-com-dustin-go-humanize
+           go-github-com-gogo-protobuf
+           go-github-com-golang-groupcache
+           go-github-com-golang-jwt-jwt-v5
+           go-github-com-golang-protobuf
+           go-github-com-google-btree
+           go-github-com-google-go-cmp
+           go-github-com-grpc-ecosystem-go-grpc-middleware
+           go-github-com-grpc-ecosystem-go-grpc-middleware-providers-prometheus
+           go-github-com-grpc-ecosystem-grpc-gateway-v2
+           go-github-com-jonboulle-clockwork
+           go-github-com-prometheus-client-golang
+           go-github-com-prometheus-client-model
+           go-github-com-soheilhy-cmux
+           go-github-com-spf13-cobra
+           go-github-com-stretchr-testify
+           go-github-com-tmc-grpc-websocket-proxy
+           go-github-com-xiang90-probing
+           go-go-etcd-io-bbolt
+           go-go-etcd-io-etcd-client-v3
+           go-go-etcd-io-etcd-pkg-v3
+           go-go-etcd-io-raft-v3
+           go-go-opentelemetry-io-contrib-instrumentation-google-golang-org-grpc-otelgrpc
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracegrpc
+           go-go-opentelemetry-io-otel-sdk
+           go-go-uber-org-zap
+           go-golang-org-x-crypto
+           go-golang-org-x-net
+           go-golang-org-x-time
+           go-google-golang-org-genproto-googleapis-api
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf
+           go-gopkg-in-natefinch-lumberjack-v2
+           go-sigs-k8s-io-json
+           go-sigs-k8s-io-yaml))
+    (home-page "https://go.etcd.io/etcd")
+    (synopsis "Server package for ETCD")
+    (description
+     "This package provides a server for the ETCD distributed key-value storage
+system.")
+    (license license:asl2.0)))
+
+
+(define-public go-go-etcd-io-etcd-pkg-v3
+  (package
+    (name "go-go-etcd-io-etcd-pkg-v3")
+    (version "3.6.7")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/etcd-io/etcd")
+              (commit (go-version->git-ref version
+                                           #:subdir "pkg"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0d9rjyl5h0xm9isgr8b2fz8528wk3pds71rjl8g08fgsmsa5kicb"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet #~(begin
+                    (define (delete-all-but directory . preserve)
+                      (with-directory-excursion directory
+                        (let* ((pred (negate (cut member <>
+                                                  (cons* "." ".." preserve))))
+                               (items (scandir "." pred)))
+                          (for-each (cut delete-file-recursively <>) items))))
+                    (delete-all-but "." "pkg")
+                    (rename-file "pkg" "pkg.tmp")
+                    (mkdir-p "pkg/v3")
+                    (rename-file "pkg.tmp" "pkg/v3")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:tests? #f       ;TODO: Tests hang, select some subset
+      #:import-path "go.etcd.io/etcd/pkg/v3"
+      #:unpack-path "go.etcd.io/etcd"))
+    (native-inputs
+     (list go-github-com-spf13-cobra
+           go-github-com-spf13-pflag
+           go-github-com-stretchr-testify))
+    (propagated-inputs
+     (list go-github-com-creack-pty
+           go-github-com-dustin-go-humanize
+           go-go-etcd-io-etcd-client-pkg-v3
+           go-go-uber-org-zap
+           go-google-golang-org-grpc))
+    (home-page "https://github.com/etcd-io/etcd")
+    (synopsis "Utility packages for etcd")
+    (description
+     "This package is a collection of utility packages used by etcd without
+being specific to etcd itself.")
+    (license license:asl2.0)))
+
+(define-public go-k8s-io-apiserver
+  (package
+    (name "go-k8s-io-apiserver")
+    (version "0.34.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/kubernetes/apiserver")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "06bcbdnlhg1mwky6i1519n1nhlh8rxc9qv7jwqjhc03m2ql3bb8q"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:tests? #f ;TODO: Tests require unpackaged dependencies
+      #:embed-files
+      #~(list "authoring\\.tmpl" "api__v1_openapi\\.json")
+      #:import-path "k8s.io/apiserver"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (propagated-inputs
+     (list go-github-com-blang-semver-v4
+           go-github-com-coreos-go-oidc
+           go-github-com-coreos-go-systemd-v22
+           go-github-com-emicklei-go-restful-v3
+           go-github-com-fsnotify-fsnotify
+           go-github-com-go-logr-logr
+           go-github-com-gogo-protobuf
+           go-github-com-google-btree
+           go-github-com-google-cel-go
+           go-github-com-google-gnostic-models
+           go-github-com-google-go-cmp
+           go-github-com-google-uuid
+           go-github-com-gorilla-websocket
+           go-github-com-grpc-ecosystem-go-grpc-prometheus
+           go-github-com-munnerz-goautoneg
+           go-github-com-mxk-go-flowrate
+           go-github-com-spf13-pflag
+           go-go-etcd-io-etcd-api-v3
+           go-go-etcd-io-etcd-client-pkg-v3
+           go-go-etcd-io-etcd-client-v3
+           go-go-etcd-io-etcd-server-v3
+           go-go-opentelemetry-io-contrib-instrumentation-google-golang-org-grpc-otelgrpc
+           go-go-opentelemetry-io-contrib-instrumentation-net-http-otelhttp
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracegrpc
+           go-go-opentelemetry-io-otel-metric
+           go-go-opentelemetry-io-otel-sdk
+           go-go-opentelemetry-io-otel-trace
+           go-go-uber-org-zap
+           go-golang-org-x-crypto
+           go-golang-org-x-net
+           go-golang-org-x-sync
+           go-golang-org-x-sys
+           go-golang-org-x-time
+           go-google-golang-org-genproto-googleapis-api
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf
+           go-gopkg-in-evanphx-json-patch-v4
+           go-gopkg-in-go-jose-go-jose-v2
+           go-gopkg-in-natefinch-lumberjack-v2
+           go-k8s-io-api
+           go-k8s-io-apimachinery
+           go-k8s-io-client-go
+           go-k8s-io-component-base
+           go-k8s-io-klog-v2
+           go-k8s-io-kms
+           go-k8s-io-kube-openapi
+           go-k8s-io-utils
+           go-sigs-k8s-io-apiserver-network-proxy-konnectivity-client
+           go-sigs-k8s-io-json
+           go-sigs-k8s-io-randfill
+           go-sigs-k8s-io-structured-merge-diff-v6
+           go-sigs-k8s-io-yaml))
+    (home-page "https://github.com/kubernetes/apiserver")
+    (synopsis "Library for building a Kubernetes aggregated API server")
+    (description
+     "This package provides a generic library for building a Kubernetes
+aggregated API server.")
+    (license license:asl2.0)))
+
 (define-public go-k8s-io-component-base
   (package
     (name "go-k8s-io-component-base")
@@ -87,6 +395,39 @@
      "This package contains shared code for Kubernetes core components.")
     (license license:asl2.0)))
 
+(define-public go-sigs-k8s-io-apiserver-network-proxy-konnectivity-client
+  (package
+    (name "go-sigs-k8s-io-apiserver-network-proxy-konnectivity-client")
+    (version "0.34.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/kubernetes-sigs/apiserver-network-proxy")
+              (commit (go-version->git-ref version
+                                           #:subdir "konnectivity-client"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1kh92blfpmrmklxqg5j0p07yz534gjzhm44xj8bh5pad3y5zw5m0"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:import-path "sigs.k8s.io/apiserver-network-proxy/konnectivity-client"
+      #:unpack-path "sigs.k8s.io/apiserver-network-proxy"))
+    (native-inputs
+     (list go-go-uber-org-goleak))
+    (propagated-inputs
+     (list go-github-com-prometheus-client-golang
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf
+           go-k8s-io-klog-v2))
+    (home-page "https://sigs.k8s.io/apiserver-network-proxy")
+    (synopsis "Network proxy for Kubernetes API server")
+    (description
+     "This package provides a network proxy for the Kubernetes API server.")
+    (license license:asl2.0)))
+
 
 ;;;
 ;;; Executables:

gnu/packages/libevent.scm

@@ -164,14 +164,14 @@ resolution, asynchronous file system operations, and threading primitives.")
   (package
     (inherit libuv)
     (name "libuv")
-    (version "1.49.2")
+    (version "1.51.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dist.libuv.org/dist/v" version
                                   "/libuv-v" version ".tar.gz"))
               (sha256
                (base32
-                "1a75p8wp4l43y2ffj1szs1ssm6nzjad7k51bqi2r04ngs9mp044c"))))
+                "1szqivvs7izbhw1a3nd1ipbk012yvqqkjg0sjmqxw1hi1fwmf1az"))))
     (properties '((hidden? . #t)))))
 
 (define-public libuv-for-r-httpuv

gnu/packages/librewolf.scm

@@ -205,8 +205,7 @@
        (search-patches
         "librewolf-compare-paths.patch"
         "librewolf-use-system-wide-dir.patch"
-        "librewolf-add-store-to-rdd-allowlist.patch"
+        "librewolf-add-store-to-rdd-allowlist.patch"))
-        "librewolf-150.0-encoding_rs-rust-fix.patch"))
       ;; Slim down the tarball by removing unbundled libraries and 75 Mo (800+
       ;; Mo uncompressed) of unused tests.
       ;; TODO: Unbundle security/nss and media/libpng.
@@ -239,23 +238,23 @@
 ;;; but since in Guix only the latest packaged Rust is officially supported,
 ;;; it is a tradeoff worth making.
 ;;; 0: https://firefox-source-docs.mozilla.org/writing-rust-code/update-policy.html
-(define rust-librewolf rust-1.93)
+(define rust-librewolf rust-1.94)
 
 ;; Update this id with every update to its release date.
 ;; It's used for cache validation and therefore can lead to strange bugs.
 ;; ex: date '+%Y%m%d%H%M%S'
 ;; or: (format-time-string "%Y%m%d%H%M%S")
-(define %librewolf-build-id "20260421153818")
+(define %librewolf-build-id "20260428201413")
 
 (define-public librewolf
   (package
     (name "librewolf")
-    (version "150.0-1")
+    (version "150.0.1-1")
     (source
      (make-librewolf-source
       #:version version
-      #:firefox-hash "151rxzl80dm8jsxl6fwzgbirwq4zpms5adwwnbjcwdd1r3s3vr7v"
+      #:firefox-hash "1v3fbwvd0khm3xwsgwcp6wpwmkz0v6fyk37hxj0mqkwjimqgmkra"
-      #:librewolf-hash "0iw9v3zc1fxc93yyhldqarxaypgmbndh2ylsy330kcbpb6p1gnmr"
+      #:librewolf-hash "0294lsiyvfh93id04xki4bhs8d84vmysqviivxiif0xfzqv65qzp"
       #:l10n firefox-l10n))
     (build-system gnu-build-system)
     (arguments

gnu/packages/linux.scm

@@ -87,6 +87,7 @@
 ;;; Copyright © 2025 John Kehayias <john.kehayias@protonmail.com>
 ;;; Copyright © 2025 Arjan Adriaanse <arjan@adriaan.se>
 ;;; Copyright © 2026 Justin Veilleux <terramorpha@cock.li>
+;;; Copyright © 2026 Simen Endsjø <contact@simendsjo.me>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -528,10 +529,27 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
                         "linux-" version ".tar.xz"))
     (sha256 hash)))
 
+;; The current "mainline" kernel.
+
+(define-public linux-libre-7.0-version "7.0.3")
+(define-public linux-libre-7.0-gnu-revision "gnu")
+(define deblob-scripts-7.0
+  (linux-libre-deblob-scripts
+   linux-libre-7.0-version
+   linux-libre-7.0-gnu-revision
+   (base32 "0pqhhkpq61rvdiyas28x7kclsz1iribzwsyf81gbic56ci4z2ldv")
+   (base32 "0a7572zw5y3k4gs4p3h5w0s9bhd63pdjxz6vxbr96sq6r8b6k02n")))
+(define-public linux-libre-7.0-pristine-source
+  (let ((version linux-libre-7.0-version)
+        (hash (base32 "074zjl0v901a9hafgpcxyyd395qs7y4kr4fcpgg3ssc8ayzsvv8b")))
+   (make-linux-libre-source version
+                            (%upstream-linux-source version hash)
+                            deblob-scripts-7.0)))
+
 ;; The current "stable" kernels. That is, the most recently released major
 ;; versions that are still supported upstream.
 
-(define-public linux-libre-6.19-version "6.19.12")
+(define-public linux-libre-6.19-version "6.19.14")
 (define-public linux-libre-6.19-gnu-revision "gnu")
 (define deblob-scripts-6.19
   (linux-libre-deblob-scripts
@@ -541,12 +559,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "05jpciyypvmy6byaxjl49b1fvzxcnlhknf0xabrdj5152iznrzkh")))
 (define-public linux-libre-6.19-pristine-source
   (let ((version linux-libre-6.19-version)
-        (hash (base32 "1md8b270pdyk9d8cq0qyr8qmymcijmj3gc39nn394wpr0l94yp6f")))
+        (hash (base32 "11giqsz9qa7s9lm94nn4h1bcb2411crsbfyvzrvhfjmy75kvzs6d")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-6.19)))
 
-(define-public linux-libre-6.18-version "6.18.22")
+(define-public linux-libre-6.18-version "6.18.26")
 (define-public linux-libre-6.18-gnu-revision "gnu")
 (define deblob-scripts-6.18
   (linux-libre-deblob-scripts
@@ -556,7 +574,7 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "0qlih8w8wg4v5cwbmd34rbhb6mjgbx69i9rx3s2vxw7h42q9l0ai")))
 (define-public linux-libre-6.18-pristine-source
   (let ((version linux-libre-6.18-version)
-        (hash (base32 "0nazlm6j5blyd4qgl0z6xc3qk00vz3cfvx5mqv18awv5ygx94g52")))
+        (hash (base32 "1v5h0w3s8p5m22jxg992x1jfpwyi80ia70cdgiv47q3n6xfjyxsk")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-6.18)))
@@ -565,7 +583,7 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
 ;; Here are the support timelines:
 ;; <https://www.kernel.org/category/releases.html>
 
-(define-public linux-libre-6.12-version "6.12.81")
+(define-public linux-libre-6.12-version "6.12.85")
 (define-public linux-libre-6.12-gnu-revision "gnu")
 (define deblob-scripts-6.12
   (linux-libre-deblob-scripts
@@ -575,12 +593,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "1x48hpmvajz7v5wn1vdd7l5r14mq4ngzh5npz3pj81z4f1g61i0a")))
 (define-public linux-libre-6.12-pristine-source
   (let ((version linux-libre-6.12-version)
-        (hash (base32 "0iw84bqdbh9dlaqd1bqgldg50riw2b5is7ipqnbp0sll8cv9rc62")))
+        (hash (base32 "1v8a0z6znmr2m26l4744wndaimsh24zz6q4d7m4p8s0ayjcwjnp3")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-6.12)))
 
-(define-public linux-libre-6.6-version "6.6.134")
+(define-public linux-libre-6.6-version "6.6.137")
 (define-public linux-libre-6.6-gnu-revision "gnu")
 (define deblob-scripts-6.6
   (linux-libre-deblob-scripts
@@ -590,12 +608,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "0xp9b2vkrb0g0rn4i33b59rhp4sgh1dbwzk28vwz7kwac6l5rcpi")))
 (define-public linux-libre-6.6-pristine-source
   (let ((version linux-libre-6.6-version)
-        (hash (base32 "1grp1wqgzjsk6xyl0nvd2hxlxjj0wgz04x544zkz8srp6rxnjy33")))
+        (hash (base32 "1i2npnsnhk41a88vimr521rxg77kljbkqmlyk1zrv7z4ic6ykwcj")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-6.6)))
 
-(define-public linux-libre-6.1-version "6.1.168")
+(define-public linux-libre-6.1-version "6.1.170")
 (define-public linux-libre-6.1-gnu-revision "gnu")
 (define deblob-scripts-6.1
   (linux-libre-deblob-scripts
@@ -605,12 +623,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "1w5pfws6l39dpc3lzazs1n6r4m96f6rdf6vb2scy5fhmrd933ldc")))
 (define-public linux-libre-6.1-pristine-source
   (let ((version linux-libre-6.1-version)
-        (hash (base32 "0vkp75sfnjvfqxjh6gqcx24h2m6qj6xkwlw6b118cja43vjnz1g0")))
+        (hash (base32 "0i29gilsvl7vx7p6vqg0bc0d40ir1b968hyfjhdfms55g4pr2y5m")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-6.1)))
 
-(define-public linux-libre-5.15-version "5.15.202")
+(define-public linux-libre-5.15-version "5.15.204")
 (define-public linux-libre-5.15-gnu-revision "gnu")
 (define deblob-scripts-5.15
   (linux-libre-deblob-scripts
@@ -620,7 +638,7 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "1s6km2r2mad0wpf7nqn4rqsykw1lm386l1yskmil24239fbva1f1")))
 (define-public linux-libre-5.15-pristine-source
   (let ((version linux-libre-5.15-version)
-        (hash (base32 "1m6d53qx1ah4jwpa8hwjdmq0jn2hf7xmz1li6rwpdqjp97vvvh8b")))
+        (hash (base32 "1kfvfvzhdgjcj1pa2aqks3iah00ilfpp1i9bmbwjr3na0crlrzcv")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-5.15)))
@@ -668,6 +686,10 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
     (patches (append (origin-patches source)
                      patches))))
 
+(define-public linux-libre-7.0-source
+  (source-with-patches linux-libre-7.0-pristine-source
+                       (list %linux-libre-arm-export-__sync_icache_dcache-patch)))
+
 (define-public linux-libre-6.19-source
   (source-with-patches linux-libre-6.19-pristine-source
                        (list %boot-logo-patch
@@ -790,6 +812,11 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
     (description "Headers of the Linux-Libre kernel.")
     (license license:gpl2)))
 
+(define-public linux-libre-headers-7.0
+  (make-linux-libre-headers* linux-libre-7.0-version
+                             linux-libre-7.0-gnu-revision
+                             linux-libre-7.0-source))
+
 (define-public linux-libre-headers-6.19
   (make-linux-libre-headers* linux-libre-6.19-version
                              linux-libre-6.19-gnu-revision
@@ -1176,6 +1203,14 @@ Linux kernel.  It has been modified to remove all non-free binary blobs.")
 ;;; Generic kernel packages.
 ;;;
 
+(define-public linux-libre-7.0
+  (make-linux-libre* linux-libre-7.0-version
+                     linux-libre-7.0-gnu-revision
+                     linux-libre-7.0-source
+                     '("x86_64-linux" "i686-linux" "armhf-linux"
+                       "aarch64-linux" "powerpc64le-linux" "riscv64-linux")
+                     #:configuration-file kernel-config))
+
 (define-public linux-libre-6.19
   (make-linux-libre* linux-libre-6.19-version
                      linux-libre-6.19-gnu-revision
@@ -2797,6 +2832,76 @@ kernel modules to control the keyboard on most Tuxedo computers. The @code{tuxed
 module is also needed for the @code{tuxedo-control-center} (short tcc) package.")
     (license license:gpl2+)))
 
+(define-public evdi
+  (package
+    (name "evdi")
+    (version "1.14.15")                  ;inherited by libevdi
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/DisplayLink/evdi")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "065mfwmb4nw71s0f0ax9si8xpbr1sah1bhxvq1k81yicvi83wsxn"))))
+    (build-system linux-module-build-system)
+    (arguments
+     (list #:tests? #f                  ;no test suite
+           #:phases #~(modify-phases %standard-phases
+                        (add-after 'unpack 'chdir
+                          (lambda _
+                            (chdir "module")))
+                        ;; Looks like the value is only there to detect RHEL
+                        ;; derivatives, so we can safely delete the include.
+                        (add-after 'unpack 'embed-/etc/os-release
+                          (lambda _
+                            (substitute* "module/Makefile"
+                              (("include /etc/os-release") "")))))))
+    (home-page "https://github.com/DisplayLink/evdi")
+    (synopsis
+     "@acronym{EVDI, Extensible Virtual Display Interface} Linux kernel module")
+    (description
+     "The @acronym{EVDI, Extensible Virtual Display Interface} is a Linux kernel
+module that enables management of multiple screens, allowing user-space programs
+to take control over what happens with the image.  It is essentially a virtual
+display for which applications using the @code{libevdi} library can add, remove,
+and receive screen updates.
+
+The EVDI driver uses the standard Linux @acronym{DRM, Direct Rendering Manager}.
+Its displays can be controlled by standard tools such as @command{xrandr} and
+display settings applets in graphical environments.")
+    (license license:gpl2)))
+
+(define-public libevdi
+  (package
+    (inherit evdi)
+    (name "libevdi")
+    (build-system gnu-build-system)
+    (arguments
+     (list #:tests? #f                  ;no test suite
+           #:make-flags
+           #~(list (string-append "CC=" #$(cc-for-target)))
+           #:phases #~(modify-phases %standard-phases
+                        (delete 'configure)
+                        (add-after 'unpack 'chdir
+                          (lambda _
+                            (chdir "library")))
+                        (replace 'install
+                          (lambda* _
+                            (let* ((lib (string-append #$output "/lib")))
+                              (mkdir-p lib)
+                              (install-file "libevdi.so" lib)))))))
+    (inputs (list libdrm))
+    (native-inputs (list pkg-config))
+    (synopsis
+     "@acronym{EVDI, Extensible Virtual Display Interface} user-space library")
+    (description
+     "Libevdi is a library that gives applications easy access to
+@acronym{EVDI, Extensible Virtual Display Interface} devices provided by the
+@code{evdi} driver package.")
+    (license license:lgpl2.1)))
+
 (define-public ec
   (package
     (name "ec")
@@ -4295,6 +4400,42 @@ external rate conversion.")
                    ;; `rate/rate_samplerate.c': LGPL v2.1 or later.
                    license:lgpl2.1+))))
 
+(define-public snd-rane-sl3
+  (let ((commit "01099892261b55ec5ee814292d840eeb664c1904")
+        (revision "0"))
+    (package
+      (name "snd-rane-sl3")
+      (version (git-version "0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/nvgeele/snd-rane-sl3")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "1j2aan5xmbi8hgkzzwjb7rarqh4g65rg3s1qd1c8x5m6fpqdnvli"))))
+      (build-system linux-module-build-system)
+      (arguments
+       (list
+        #:tests? #f ;No tests.
+        #:phases
+        #~(modify-phases %standard-phases
+            (delete 'configure)
+            (add-before 'build 'change-directory
+              (lambda _
+                (chdir "snd-rane-sl3"))))))
+      (inputs (list linux-libre-headers))
+      (home-page "https://github.com/nvgeele/snd-rane-sl3")
+      (synopsis
+       "Linux ALSA kernel driver for the Rane SL3 USB Audio interface")
+      (description
+       "snd-rane-sl3 provides a native Linux kernel module that
+enables the Rane SL3 to work as a standard ALSA audio device, supporting 6
+channels (3 stereo pairs) of 24-bit PCM audio at 44.1kHz and 48kHz sample
+rates.")
+      (license license:gpl3))))
+
 (define-public iptables
   (package
     (name "iptables")

gnu/packages/lisp-xyz.scm

@@ -12982,8 +12982,8 @@ score.  When evaluated, the musical score is rendered to an image.")
   (sbcl-package->ecl-package sbcl-cmn))
 
 (define-public sbcl-coalton
-  (let ((commit "bf475c8c53e02a2e0cb29deab4d101d25743bfca")
+  (let ((commit "14ed6dc733f8c23c1a345ceb11d3f75ee47f7525")
-        (revision "5"))
+        (revision "6"))
     (package
       (name "sbcl-coalton")
       (version (git-version "0.0.1" revision commit))
@@ -12995,12 +12995,16 @@ score.  When evaluated, the musical score is rendered to an image.")
                (commit commit)))
          (file-name (git-file-name "cl-coalton" version))
          (sha256
-          (base32 "0zrp2s82n2mxx7knbnbsdj64zar21nnnf8iwzrqzs4g3v6xpyz9z"))))
+          (base32 "024n72lxi8nycy012lqy6zx19lv7jh2ngs1mf559rw8kgwh3k54c"))))
       (build-system asdf-build-system/sbcl)
       (native-inputs
-       (list sbcl-fiasco))
+       (list sbcl-fiasco
+             sbcl-html-entities
+             sbcl-spinneret
+             sbcl-yason))
       (inputs
        (list sbcl-alexandria
+             sbcl-computable-reals
              sbcl-concrete-syntax-tree
              sbcl-eclector
              sbcl-float-features
@@ -13556,10 +13560,10 @@ place outside with-notes.
   (sbcl-package->ecl-package sbcl-compiler-macro-notes))
 
 (define-public sbcl-computable-reals
-  (let ((commit "fdc73d75e79d0a4ce6d01c822c950ae2eb137d39"))
+  (let ((commit "607a5d5b95387c06f92a661aa5562a7be0f5cad8"))
     (package
       (name "sbcl-computable-reals")
-      (version (git-version "1.1.0" "1" commit))
+      (version (git-version "1.1.0" "2" commit))
       (source
        (origin
          (method git-fetch)
@@ -13568,7 +13572,7 @@ place outside with-notes.
                (commit commit)))
          (file-name (git-file-name name version))
          (sha256
-          (base32 "0f12axi53x14l12dgf4a1lfq3p1fx7fh7sjfc0db3lk88ph9qfwl"))))
+          (base32 "1x8kkdyjil0zzg8fq9b76z12kmfrqwhsxnr6qqnlrg0c8c5bzz9c"))))
       (build-system asdf-build-system/sbcl)
       (home-page "https://github.com/stylewarning/computable-reals")
       (synopsis "Arbitrary-precision, re-computing real-numbers in Common Lisp")
@@ -22847,16 +22851,6 @@ specification}, a toolkit for writing GUIs in Common Lisp.")
 (define-public cl-mcclim
   (sbcl-package->cl-source-package sbcl-mcclim))
 
-(define-public ecl-mcclim
-  (let ((pkg (sbcl-package->ecl-package sbcl-mcclim)))
-    (package
-      (inherit pkg)
-      (arguments
-       (substitute-keyword-arguments arguments
-         ;; Tests fail with "FUNCTION: Not a valid argument (R1
-         ;; (GENERATE-REGION))."  on ECL.
-         ((#:tests? _ #f) #f))))))
-
 (define-public sbcl-md5
   (package
     (name "sbcl-md5")
@@ -29767,7 +29761,7 @@ the Processing language and shares some of the API.")
   ;; Update together with emacs-slime.
   (package
     (name "sbcl-slime-swank")
-    (version "2.31")
+    (version "2.32")
     (source
      (origin
        (file-name (git-file-name "cl-slime-swank" version))
@@ -29776,7 +29770,7 @@ the Processing language and shares some of the API.")
              (url "https://github.com/slime/slime/")
              (commit (string-append "v" version))))
        (sha256
-        (base32 "0nv99wq2vz053p0rn9953rhmyz4g40zdl01mz7z9xbklxzbsx6x7"))
+        (base32 "0s7m7j7y1p8fb6ncpxcxdrrrxp5aw67xl7wrqy8zjjvwzljbs548"))
        (modules '((guix build utils)))
        (snippet
         ;; The doc folder drags `gawk' into the closure.  Doc is already

gnu/packages/mail.scm

@@ -57,7 +57,7 @@
 ;;; Copyright © 2023 Wilko Meyer <w@wmeyer.eu>
 ;;; Copyright © 2024 Benjamin Slade <slade@lambda-y.net>
 ;;; Copyright © 2024 Jean Simard <woshilapin@tuziwo.info>
-;;; Copyright © 2024, 2025 Zheng Junjie <873216071@qq.com>
+;;; Copyright © 2024-2026 Zheng Junjie <z572@z572.online>
 ;;; Copyright © 2024, 2025 Ashish SHUKLA <ashish.is@lostca.se>
 ;;; Copyright © 2025 Tanguy Le Carrour <tanguy@bioneland.org>
 ;;; Copyright © 2025-2026 Sharlatan Hellseher <sharlatanus@gmail.com>
@@ -138,6 +138,7 @@
   #:use-module (gnu packages guile-xyz)
   #:use-module (gnu packages haskell-xyz)
   #:use-module (gnu packages icu4c)
+  #:use-module (gnu packages jemalloc)
   #:use-module (gnu packages kerberos)
   #:use-module (gnu packages language)
   #:use-module (gnu packages libbsd)
@@ -148,6 +149,7 @@
   #:use-module (gnu packages libunistring)
   #:use-module (gnu packages libunwind)
   #:use-module (gnu packages linux)
+  #:use-module (gnu packages llvm)
   #:use-module (gnu packages lsof)
   #:use-module (gnu packages lua)
   #:use-module (gnu packages m4)
@@ -158,6 +160,7 @@
   #:use-module (gnu packages networking)
   #:use-module (gnu packages onc-rpc)
   #:use-module (gnu packages openldap)
+  #:use-module (gnu packages nss)
   #:use-module (gnu packages pcre)
   #:use-module (gnu packages pdf)
   #:use-module (gnu packages perl)
@@ -198,6 +201,7 @@
   #:use-module (gnu packages xml)
   #:use-module (gnu packages xorg)
   #:use-module (gnu packages)
+  #:use-module (guix build-system cargo)
   #:use-module (guix build-system cmake)
   #:use-module (guix build-system emacs)
   #:use-module (guix build-system glib-or-gtk)
@@ -1355,7 +1359,7 @@ security functionality including PGP, S/MIME, SSH, and SSL.")
 (define-public mu
   (package
     (name "mu")
-    (version "1.14.0")
+    (version "1.14.1")
     (source
      (origin
        (method git-fetch)
@@ -1364,7 +1368,7 @@ security functionality including PGP, S/MIME, SSH, and SSL.")
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1fhnnm58ndfd6hzdagrsgcdcm2qlcjlda13vyx5d9lclhxgdn0vf"))))
+        (base32 "0dv27pq2jmgqlzsy2gcmh7vddiwiwd55j299blb9k8g0xhkg8riz"))))
     (build-system meson-build-system)
     (native-inputs
      (list pkg-config
@@ -3910,6 +3914,112 @@ are supported).  @code{bit} is a CGI/SSI program that generates web pages
 on the fly.  Both programs are written in C and are very fast.")
     (license license:expat)))
 
+(define computed-origin-method (@@ (guix packages) computed-origin-method))
+
+(define-public stalwart
+  (package
+    (name "stalwart")
+    (version "0.16.3")
+    (source
+     (let ((upstream-source
+             (origin
+               (method git-fetch)
+               (uri (git-reference
+                      (url "https://github.com/stalwartlabs/stalwart")
+                      (commit (string-append "v" version))))
+               (file-name (git-file-name name version))
+               (sha256
+                (base32
+                 "1wcs9inwv8iv4qrayp9730wzmmpp4bna6jnpdz29ygb5c0lf2b29")))))
+       (origin
+         (method computed-origin-method)
+         (file-name (git-file-name name version))
+         (sha256 #f)
+         (uri
+          (delay
+            (with-imported-modules '((guix build utils))
+              #~(begin
+                  (use-modules (guix build utils))
+                  (set-path-environment-variable
+                   "PATH" '("bin")
+                   (list #+python-minimal))
+                  (copy-recursively #+upstream-source "upstream-source")
+                  (with-directory-excursion "upstream-source"
+                    (for-each make-file-writable (find-files "crates" "\\.rs"))
+                    (invoke "python3" "resources/scripts/ossify.py" "crates")
+                    (substitute* "crates/main/Cargo.toml"
+                      ((", \"enterprise\"")
+                       ""))
+                    (substitute* "crates/common/Cargo.toml"
+                      (("git =.*/opentelemetry-rust\"")
+                       "version = \"0.31.0\"")))
+                  (copy-recursively "upstream-source" #$output))))))))
+    (build-system cargo-build-system)
+    (arguments
+     (list
+      #:install-source? #f
+      ;; TODO: Currently, if the test is enabled, it will attempt to link
+      ;; the foundationdb library. However, we haven't packaged it yet,
+      ;; so for now, skip tests.
+      #:tests? #f
+      #:features ''("s3" "postgres" "rocks" "sqlite")
+      #:cargo-install-paths ''("crates/main")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'build 'setenv
+            (lambda* (#:key inputs #:allow-other-keys)
+              (setenv "LIBZ_SYS_STATIC" "0")
+              ;; jemalloc needs unbundling for tikv-jemallocator-sys
+              ;; This flag is needed when not using the bundled jemalloc.
+              ;; https://github.com/tikv/jemallocator/issues/19
+              (setenv
+               "CARGO_FEATURE_UNPREFIXED_MALLOC_ON_SUPPORTED_PLATFORMS" "1")
+              (setenv "JEMALLOC_OVERRIDE"
+                      (search-input-file inputs "/lib/libjemalloc.so")))))))
+    (native-inputs (list clang pkg-config))
+    (inputs (cons* bzip2
+                   jemalloc
+                   librdkafka
+                   lz4
+                   rocksdb
+                   snappy
+                   sqlite
+                   zlib
+                   openssl
+                   `(,zstd "lib")
+                   (cargo-inputs 'stalwart)))
+    (home-page "https://stalw.art")
+    (synopsis "All in one Mail and Collaboration server")
+    (description
+     "Stalwart is an mail and collaboration server with JMAP, IMAP4, POP3, SMTP,
+CalDAV, CardDAV and WebDAV support and a wide range of modern features.")
+    (license license:agpl3)))
+
+(define-public stalwart-cli
+  (package
+    (name "stalwart-cli")
+    (version "1.0.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/stalwartlabs/cli")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0rbhzd8m48fm5q8vlzkla5zxrypkbvsi8i1bplkm1ndp0bwiqdvz"))))
+    (build-system cargo-build-system)
+    (arguments
+     (list #:install-source? #f))
+    (native-inputs (list nss-certs-for-test))
+    (inputs (cargo-inputs 'stalwart-cli))
+    (home-page "https://stalw.art")
+    (synopsis "Stalwart Command Line Interface")
+    (description
+     "A schema-driven command line tool for administering Stalwart Mail and
+Collaboration Server over its JMAP API.")
+    (license license:agpl3)))
+
 (define-public swaks
   (package
     (name "swaks")

gnu/packages/maths.scm

@@ -22,7 +22,7 @@
 ;;; Copyright © 2017, 2019, 2022 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2017–2021 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Dave Love <me@fx@gnu.org>
-;;; Copyright © 2018, 2019, 2020, 2021, 2022, 2024, 2025 Janneke Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2018-2022, 2024-2026 Janneke Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2018 Joshua Sierles, Nextjournal <joshua@nextjournal.com>
 ;;; Copyright © 2018 Nadya Voronova <voronovank@gmail.com>
 ;;; Copyright © 2018 Adam Massmann <massmannak@gmail.com>
@@ -458,7 +458,8 @@ programming languages.")
              (url "https://github.com/cvc5/cvc5/")
              (commit (string-append "cvc5-" version))))
        (file-name (git-file-name name version))
-       (patches (search-patches "cvc5-reproducible-build.patch"))
+       (patches (search-patches "cvc5-reproducible-build.patch"
+                                "cvc5-symfpu-compatibility.patch"))
        (sha256
         (base32 "0ynz7di4dyyiiydgmf0z9dc2jl7nm44xi0amch29rcgznwr4wy5m"))))
     (build-system cmake-build-system)
@@ -745,6 +746,54 @@ complete with events and to-dos.")
       (home-page "https://codeberg.org/dgoodmaniii/dozenal")
       (license license:gpl3+))))
 
+(define-public drat-trim
+  (package
+    (name "drat-trim")
+    (version "05.22.2023")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/marijnheule/drat-trim")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "084miqj57xr7c74y649acm5xjkddpjn4ybfh469jcbakzp8w0pdi"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:tests? #f ;no tests
+      #:make-flags
+      #~(list (string-join
+                (list "FLAGS=-DLONGTYPE"
+                      ;; _POSIX_C_SOURCE required for getc_unlocked(3).
+                      "-D_POSIX_C_SOURCE=200809")
+                " "))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'always-pass-flags
+            (lambda _
+              (substitute* "Makefile"
+                ;; Ensure that drat-trim and gapless target also respect FLAGS.
+                (("-std=c99 -O2")
+                 "-std=c99 $(FLAGS) -O2"))))
+          (delete 'configure) ;no configure script
+          (replace 'install
+            (lambda* (#:key outputs #:allow-other-keys)
+              (let* ((bin (string-append #$output "/bin")))
+                (for-each (lambda (exec)
+                            (install-file exec bin))
+                          '("drat-trim"
+                            "lrat-check"))))))))
+    (synopsis "Proof checker for unsatisfiability of propositional formulas")
+    (description
+     "The proof checker DRAT-trim can be used to check whether a propositional
+formula in the DIMACS format is unsatisfiable.  Given a propositional formula and
+a clausal proof, DRAT-trim validates that the proof is a certificate of
+unsatisfiability of the formula.")
+    (home-page "https://www.cs.utexas.edu/~marijn/drat-trim/")
+    (license license:expat)))
+
 (define-public dsfmt
   (package
     (name "dsfmt")
@@ -2475,6 +2524,9 @@ similar to MATLAB, GNU Octave or SciPy.")
                    ;; "--enable-doxygen"
                    "--enable-dot"
                    "--enable-netcdf-4"
+                   #$@(if (or (target-x86-32?) (target-arm32?))
+                          '("CFLAGS=-Wno-error=incompatible-pointer-types")
+                          '())
                    (string-append "--with-plugin-dir=" #$output "/lib/hdf5-plugins"))
            #:phases
            #~(modify-phases %standard-phases
@@ -2486,7 +2538,15 @@ similar to MATLAB, GNU Octave or SciPy.")
                      (("testurl.sh") ""))
                    (substitute* "nczarr_test/Makefile.in"
                      (("/bin/bash")
-                      (search-input-file inputs "bin/bash")))))
+                      (search-input-file inputs "bin/bash")))
+                   ;; This test fails on 32 bit platforms.
+                   #$@(if (or (target-x86-32?) (target-arm32?))
+                          '((substitute* '("ncdump/tst_netcdf4_4.sh"
+                                           "ncdump/tst_nccopy4.sh")
+                              (("#!/bin/sh" m) (string-append m "\nexit 0\n")))
+                            (substitute* "ncdump/Makefile.in"
+                              (("tst_netcdf4_4.log") "")))
+                          '())))
                (add-before 'configure 'fix-source-date
                  (lambda _
                    ;; As we ${SOURCE_DATE_EPOCH} evaluates to "1" in the build
@@ -3995,6 +4055,64 @@ addition it can be used as a module in Python for plotting.  It supports
 vector and bitmap output, including PDF, Postscript, SVG and EMF.")
     (license license:gpl2+)))
 
+(define-public voro++
+  (package
+    (name "voro++")
+    (version "0.4.6")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/chr1shr/voro")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0rxyb662w9y3xadyxz2x7gvc7mafbhl13szdc55fsk5sygpdlkv5"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:make-flags #~(list (string-append "PREFIX=" #$output))
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure)        ;no configure
+          (replace 'check
+            ;; There is no test suite but the project provides a verity of
+            ;; examples to check performance, target "all" build each example
+            ;; (basic, walls, custom, extra, degenerate, and interface), see
+            ;; detailed description in "examples/README".
+            ;;
+            ;; Running timing example only:
+            ;; These codes and scripts can be used to test the code's
+            ;; performance. The program timing_test.cc creates a container
+            ;; with 100000 particles, and then times the computation of all
+            ;; the cells in the container, using the dummy function
+            ;; compute_all_cells().
+            (lambda* (#:key tests? #:allow-other-keys)
+              (when tests?
+                (with-directory-excursion "examples/timing"
+                  (invoke "perl" "timing_test.pl"))))))))
+    (native-inputs
+     (list perl))
+    (home-page "https://math.lbl.gov/voro++/")
+    (synopsis "C++ library for the computation of the Voronoi diagram")
+    (description
+     "Voro++ is a software library for carrying out three-dimensional
+computations of the Voronoi tessellation.  A distinguishing feature of the
+Voro++ library is that it carries out cell-based calculations, computing the
+Voronoi cell for each particle individually.  It is particularly well-suited
+for applications that rely on cell-based statistics, where features of Voronoi
+cells (eg. volume, centroid, number of faces) can be used to analyze a system
+of particles.
+
+Voro++ comprises of several C++ classes that can be built as a static library.
+A command-line utility is also provided that can use most features of the
+code.  The direct cell-by-cell construction makes the library particularly
+well-suited to handling special boundary conditions and walls.  It employs
+algorithms that are tolerant for numerical precision errors, it exhibits high
+performance, and it has been successfully employed on very large particle
+systems.")
+    (license license:bsd-3)))
+
 (define-public maxflow
   (package
     (name "maxflow")
@@ -8314,8 +8432,11 @@ s-expression-based format.")
    (license license:gpl3+)))
 
 (define-public symfpu
-  (let ((commit "22d993d880f66b2e470c3928e0e61bdf61419702")
+  ;; Currently, we use the "experimental" branch of the symfpu repository.  The
-        (revision "0"))
+  ;; default "master" branch hasn't been updated in ~7 years and both bitwuzla
+  ;; and cvc5 require fixes from the "experimental" branch.
+  (let ((commit "aeaa3fa62730148c855f5a9e0a9b7040d48e0b7e")
+        (revision "1"))
     (package
       (name "symfpu")
       (version (git-version "0" revision commit))
@@ -8327,7 +8448,7 @@ s-expression-based format.")
                (commit commit)))
          (file-name (git-file-name name version))
          (sha256
-          (base32 "1h20zzkyi225290kc6mzg8i4dwkj0p1vlwfgc9ycs61snlyd8gr8"))))
+          (base32 "0wj9pwr2jiliy4rw4nvy51427dwhwj86azi14qc5vzsdb44c6fdx"))))
       (build-system copy-build-system)
       (arguments
        (list
@@ -8369,7 +8490,7 @@ operations.")
 (define-public bitwuzla
   (package
     (name "bitwuzla")
-    (version "0.8.2")
+    (version "0.9.0")
     (source
      (origin
        (method git-fetch)
@@ -8378,21 +8499,16 @@ operations.")
              (commit version)))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0nakqz29cfkn91yvx1xzsk50rlqbiihslflbjanv4lflcl2zx6mz"))))
+        (base32 "012h3fj25f5zk9qy353vqn5jpp26db45xjbxi7ns02pkhlm46f6x"))))
     (build-system meson-build-system)
     (arguments
      `(#:configure-flags '("-Dtesting=enabled" "-Ddefault_library=shared"
-                           "-Dkissat=true")
+                           "-Dkissat=true")))
-       #:phases (modify-phases %standard-phases
-                  (add-after 'unpack 'make-git-optional
-                    (lambda _
-                      (substitute* "src/meson.build"
-                        (("run_command\\('git',")
-                         "run_command('sh', '-c', 'git',")))))))
     (native-inputs (list googletest pkg-config))
-    (inputs (list cadical
+    (inputs (list cadical-2.1
                   gmp
                   kissat
+                  mpfr
                   symfpu))
     (synopsis "SMT solver optimized for the theory of bit-vectors")
     (description
@@ -8679,7 +8795,7 @@ reduction.")
 (define-public mcrl2
   (package
     (name "mcrl2")
-    (version "202307.1")
+    (version "202507.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -8687,9 +8803,9 @@ reduction.")
                     version ".tar.gz"))
               (sha256
                (base32
-                "147002dl3gq2jsk5gcmvw7hj3mfxrpgxwcfda5mfrj26rcxw48fc"))))
+                "08w7v2dx1s164q3vc5lzf864nlxrf8s0kgsa26mmkgfqfqcwdgjj"))))
     (inputs
-     (list boost glu mesa qtbase-5))
+     (list boost glu mesa qtbase))
     (build-system cmake-build-system)
     (arguments (list #:tests? #f))
     (synopsis "Toolset for the mCRL2 formal specification language")
@@ -9660,6 +9776,7 @@ researchers and developers alike to get started on SAT.")
          "1snimig4cp97p570nin2i38my72zvwypldyhr125i1z6cd9pa046"))))
     (build-system gnu-build-system)
     (inputs (list xz gzip lzip bzip2 p7zip))
+    (native-inputs (list drat-trim))
     (arguments
      (list
       #:test-target "test"

gnu/packages/maven-parent-pom.scm

@@ -686,6 +686,35 @@ components.")
                (base32
                 "0cqa072fz55j5xyvixqv8vbd7jsbhb1cd14bzjvm0hbv2wpd9npf"))))))
 
+(define-public java-jvnet-parent-pom-1
+  (hidden-package
+    (package
+      (name "java-jvnet-parent-pom-1")
+      (version "1")
+      (source (origin
+                (method url-fetch)
+                (uri (string-append "https://repo1.maven.org/maven2/net/java/"
+                                    "jvnet-parent/" version "/jvnet-parent-"
+                                    version ".pom"))
+                (sha256
+                 (base32
+                  "1gv37n9aid7fdhwd0h4py024w8by56cchg3b4sg5vrk82a0l0518"))))
+      (build-system ant-build-system)
+      (arguments
+       (list
+         #:tests? #f
+         #:phases
+         #~(modify-phases %standard-phases
+             (delete 'unpack)
+             (delete 'configure)
+             (delete 'build)
+             (replace 'install
+               (install-pom-file #$(package-source this-package))))))
+      (home-page "https://mvnrepository.com/artifact/net.java/jvnet-parent")
+      (synopsis "java.net parent pom")
+      (description "This package contains the java.net parent pom file.")
+      (license license:asl2.0))))
+
 (define-public java-jvnet-parent-pom-3
   (hidden-package
     (package

gnu/packages/messaging.scm

@@ -2839,7 +2839,7 @@ implementation of an MQTT version client class.")
 (define-public psi-plus
   (package
     (name "psi-plus")
-    (version "1.5.1484")
+    (version "1.5.2115")
     (source
      (origin
        (method git-fetch)
@@ -2853,7 +2853,7 @@ implementation of an MQTT version client class.")
         `(begin
            (delete-file-recursively "3rdparty")))
        (sha256
-        (base32 "1jsm39nzzbqkp3zc0xqx7jid6p4q1ra28xad38wjr2l1jb8qjn24"))))
+        (base32 "14za9rh7nszv5px5a2w43ysi9977zws8a5mxsh7wc8ksr693faz2"))))
     (build-system qt-build-system)
     (arguments
      `(#:tests? #f                      ; No target
@@ -2910,19 +2910,13 @@ implementation of an MQTT version client class.")
                 "qite/qiteaudio.h")
                (("qiteaudiorecorder.h")
                 "qite/qiteaudiorecorder.h"))))
-         (add-after 'install 'wrap-env
+         (add-after 'install 'wrap-executable
            (lambda* (#:key outputs #:allow-other-keys)
              (let ((out (assoc-ref outputs "out")))
-               (for-each
+               (wrap-program (string-append out "/bin/psi-plus")
-                (lambda (name)
+                 `("GST_PLUGIN_SYSTEM_PATH" ":" prefix (,(getenv "GST_PLUGIN_SYSTEM_PATH")))
-                  (let ((file (string-append out "/bin/" name))
+                 `("GI_TYPELIB_PATH" ":" prefix (,(getenv "GI_TYPELIB_PATH")))))))
-                        (gst-plugin-path (getenv "GST_PLUGIN_SYSTEM_PATH"))
+         (add-after 'wrap-executable 'glib-or-gtk-compile-schemas
-                        (gi-typelib-path (getenv "GI_TYPELIB_PATH")))
-                    (wrap-program file
-                      `("GST_PLUGIN_SYSTEM_PATH" ":" prefix (,gst-plugin-path))
-                      `("GI_TYPELIB_PATH" ":" prefix (,gi-typelib-path)))))
-                '("psi-plus")))))
-         (add-after 'wrap-env 'glib-or-gtk-compile-schemas
            (assoc-ref glib-or-gtk:%standard-phases 'glib-or-gtk-compile-schemas))
          (add-after 'glib-or-gtk-compile-schemas 'glib-or-gtk-wrap
            (assoc-ref glib-or-gtk:%standard-phases 'glib-or-gtk-wrap)))))
@@ -2945,6 +2939,7 @@ implementation of an MQTT version client class.")
            libgcrypt
            libgpg-error
            libidn
+           libomemo-c
            libotr
            libsignal-protocol-c
            tidy-html
@@ -2964,11 +2959,11 @@ implementation of an MQTT version client class.")
            libxcb
            libxscrnsaver
            zlib))
-    (home-page "https://psi-plus.com/")
+    (home-page "https://psi-im.com/")
     (synopsis "Qt-based XMPP Client")
     (description
-     "Psi+ is a spin-off of Psi XMPP client.  It is a powerful XMPP client
+     "Psi+ is a powerful XMPP client designed for experienced users.
-designed for experienced users.")
+It's a spin-off of the Psi XMPP client.")
     (license license:gpl2+)))
 
 (define-deprecated-package psi

gnu/packages/music.scm

@@ -7465,31 +7465,6 @@ standalone JACK application.")
     ;; Expat or CC0
     (license (list license:expat license:cc0))))
 
-(define-public regrader
-  (package
-    (inherit vl1-emulator)
-    (name "regrader")
-    (version "1.0.0")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/linuxmao-org/regrader")
-             (commit (string-append "v" version))
-             ;; bundles a specific commit of the DISTRHO plugin framework
-             (recursive? #t)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32
-         "0gl4d5lf2afqknz22jz7hh7029sc9v1xrz6nbz9dlv42bwc0cvl0"))))
-    (home-page "https://github.com/linuxmao-org/regrader")
-    (synopsis "Delay effect plugin")
-    (description
-     "Regrader is a delay effect where the repeats degrade in resolution.
-This is an unofficial port of the Regrader plugin created by Igorski.  It
-is available as an LV2 plugin and a standalone JACK application.")
-    (license license:expat)))
-
 (define-public fogpad
   (package
     (inherit vl1-emulator)

gnu/packages/networking.scm

@@ -2041,7 +2041,7 @@ of the same name.")
 (define-public wireshark
   (package
     (name "wireshark")
-    (version "4.6.4")
+    (version "4.6.5")
     (source
      (origin
        (method git-fetch)
@@ -2050,7 +2050,7 @@ of the same name.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "05jivnnlmbbhc6b3r7zdahiw22fvb9r6pg4pc83ascnja49xlyq6"))))
+        (base32 "0cws5gaxkbdwqjawkwfr3iz39vdd0m0m0q7h2z4fzdv6lrp8ys31"))))
     (build-system qt-build-system)
     (arguments
      (list
@@ -2139,62 +2139,6 @@ replies, fping will send out a ping packet and move on to the next target in a
 round-robin fashion.")
     (license license:expat)))
 
-(define-public gandi-cli
-  (package
-    (name "gandi-cli")
-    (version "1.6")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (pypi-uri name version))
-       (sha256
-        (base32 "1h36jahbp7273wn3yd747kbiwjc0bm3sja67bcxdsd54ln0vyndg"))))
-    (build-system pyproject-build-system)
-    (arguments
-     (list
-      #:test-flags
-      #~(list "--pyargs" "gandi.cli")
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'embed-store-file-names
-            (lambda _
-              (substitute* (list "gandi/cli/modules/cert.py"
-                                 "gandi/cli/tests/commands/test_certificate.py")
-                (("openssl") (which "openssl")))))
-          (add-after 'install 'install-documentation
-            ;; The included man page may be outdated but we install it anyway,
-            ;; since it's mentioned in 'gandi --help' and better than nothing.
-            (lambda _
-              (let* ((man1 (string-append #$output "/share/man/man1")))
-                (mkdir-p man1)
-                (with-output-to-file (string-append man1 "/gandi.1")
-                  (lambda _
-                    (invoke "rst2man.py" "gandicli.man.rst")))))))))
-    (native-inputs
-     (list python-docutils-0.19
-           python-pytest
-           python-pytest-cov
-           python-setuptools
-           python-wheel))
-    (inputs
-     (list openssl
-           python-click-7
-           python-ipy
-           python-pyyaml
-           python-requests))
-    (propagated-inputs
-     (list openssh))
-    (home-page "https://cli.gandi.net")
-    (synopsis "Command-line interface to the Gandi.net Web API")
-    (description
-     "This package provides a command-line client (@command{gandi}) to buy,
-manage, and delete Internet resources from Gandi.net such as domain names,
-virtual machines, and certificates.")
-    (license license:gpl3+)))
-
-(define-deprecated-package gandi.cli
-  gandi-cli)
-
 (define-public go-sctp
   ;; docker-libnetwork-cmd-proxy requires this exact commit.
   ;; This commit is mentioned in docker-libnetwork-cmd-proxy's vendor.conf.
@@ -3404,7 +3348,7 @@ speedtest.net.")
 (define-public librespeed-cli
   (package
     (name "librespeed-cli")
-    (version "1.0.12")
+    (version "1.0.13")
     (source
      (origin
        (method git-fetch)
@@ -3413,7 +3357,7 @@ speedtest.net.")
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "08x09b3j2qvhnwy8lrbfxqh1lbs64wyqlr4jj6m31b5r2zy90dly"))))
+        (base32 "0zgwdz955vlyy1yricgcbdlbxxh1z08xpbhxa8zs64bsg68mv8j3"))))
     (build-system go-build-system)
     (arguments
      (list
@@ -3437,6 +3381,7 @@ speedtest.net.")
      (list go-github-com-briandowns-spinner
            go-github-com-go-ping-ping
            go-github-com-gocarina-gocsv
+           go-github-com-prometheus-community-pro-bing
            go-github-com-sirupsen-logrus
            go-github-com-urfave-cli-v2
            go-golang-org-x-sys))

gnu/packages/node-xyz.scm

@@ -2324,7 +2324,7 @@ a string consisting of a number and a time unit is converted to milliseconds.")
 (define-public node-nan
   (package
     (name "node-nan")
-    (version "2.22.0")
+    (version "2.26.2")
     (source
      (origin
        (method git-fetch)
@@ -2333,7 +2333,7 @@ a string consisting of a number and a time unit is converted to milliseconds.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "02gqm23x26glffvyxrnk610hy3hg0kwh2v58dhnb032l0jhjzqvp"))))
+        (base32 "18xv0m40jgy3sc4pldw95w6p72ms5a5h0x2sm2mimlwlmxmrjlmb"))))
     (build-system node-build-system)
     (arguments
      `(#:phases

gnu/packages/node.scm

@@ -274,7 +274,7 @@
                             (lambda (file stat)
                               (executable-file? file))
                             #:stat lstat)))))
-         (add-after 'install 'install-npmrc
+         (add-after 'install 'fix-node-gyp-reference
            ;; Note: programs like node-gyp only receive these values if
            ;; they are started via `npm` or `npx`.
            ;; See: https://github.com/nodejs/node-gyp#npm-configuration
@@ -482,7 +482,7 @@ Node.js and web browsers.")
      (origin
        (method git-fetch)
        (uri (git-reference
-             (url "https://github.com/indutny/llparse-builder.git")
+             (url "https://github.com/nodejs/llparse-builder.git")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
@@ -491,10 +491,6 @@ Node.js and web browsers.")
        (modules '((guix build utils)))
        (snippet
         '(begin
-           ;; FIXME: Unneeded runtime dependency.
-           ;; https://github.com/indutny/llparse-builder/pull/2
-           (substitute* "package.json"
-             (("\"@types/debug.*,") ""))
            ;; Fix imports for esbuild.
            ;; https://github.com/evanw/esbuild/issues/477
            (substitute* '("src/node/invoke.ts"
@@ -521,7 +517,8 @@ Node.js and web browsers.")
          (add-after 'patch-dependencies 'delete-dependencies
            (lambda _
              (modify-json (delete-dependencies
-                           `("@types/mocha"
+                           `("@types/debug"
+                             "@types/mocha"
                              "@types/node"
                              "mocha"
                              "ts-node"
@@ -539,7 +536,7 @@ Node.js and web browsers.")
      (list node-binary-search-bootstrap node-debug-bootstrap))
     (native-inputs
      (list esbuild))
-    (home-page "https://github.com/indutny/llparse-builder#readme")
+    (home-page "https://github.com/nodejs/llparse-builder#readme")
     (properties '((hidden? . #t)))
     (synopsis "Graph builder for consumption by llparse")
     (description "This package builds graphs for consumption by llparse.")
@@ -553,7 +550,7 @@ Node.js and web browsers.")
      (origin
        (method git-fetch)
        (uri (git-reference
-             (url "https://github.com/indutny/llparse-frontend.git")
+             (url "https://github.com/nodejs/llparse-frontend.git")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
@@ -602,7 +599,7 @@ Node.js and web browsers.")
      (list node-debug-bootstrap node-llparse-builder-bootstrap))
     (native-inputs
      (list esbuild))
-    (home-page "https://github.com/indutny/llparse-frontend#readme")
+    (home-page "https://github.com/nodejs/llparse-frontend#readme")
     (properties '((hidden? . #t)))
     (synopsis "Frontend for the llparse compiler")
     (description "This package is a frontend for the llparse compiler.")
@@ -611,17 +608,17 @@ Node.js and web browsers.")
 (define-public node-llparse-bootstrap
   (package
     (name "node-llparse")
-    (version "7.1.0")
+    (version "7.3.0")
     (source
      (origin
        (method git-fetch)
        (uri (git-reference
-             (url "https://github.com/indutny/llparse.git")
+             (url "https://github.com/nodejs/llparse.git")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "10da273iy2if88hp79cwms6c8qpsl1fkgzll6gmqyx5yxv5mkyp6"))
+         "09hqjcynkz5iv7aydzdwgs42r7y2zylplv0ff7w0vkdsgb08j22a"))
        (modules '((guix build utils)))
        (snippet
         '(begin
@@ -645,10 +642,14 @@ Node.js and web browsers.")
          (add-after 'patch-dependencies 'delete-dependencies
            (lambda args
              (modify-json (delete-dependencies
-                           `("@types/debug"
+                           `("@stylistic/eslint-plugin"
+                             "@typescript-eslint/eslint-plugin"
+                             "@typescript-eslint/parser"
+                             "@types/debug"
                              "@types/mocha"
                              "@types/node"
                              "esm"
+                             "eslint"
                              "llparse-test-fixture"
                              "mocha"
                              "ts-node"
@@ -676,7 +677,7 @@ parser definition into a C output.")
 (define-public llhttp-bootstrap
   (package
     (name "llhttp")
-    (version "9.2.1")
+    (version "9.3.0")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -685,7 +686,7 @@ parser definition into a C output.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "0mzg19aqb1am498gms0z75cwd5kmfg9p78b1hhxw67019nsjcbac"))
+                "0yz4ys94pjq2fs2pihpqjvmxj2mbpm8k5prlm445z4qlajzlr4kb"))
               (patches (search-patches "llhttp-ponyfill-object-fromentries.patch"))
               (modules '((guix build utils)))
               (snippet
@@ -747,14 +748,14 @@ source files.")
 (define-public node-lts
   (package
     (inherit node-bootstrap)
-    (version "22.14.0")
+    (version "24.14.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
                                   "/node-v" version ".tar.gz"))
               (sha256
                (base32
-                "12msprh604s6qdsgwymxw4kl8ivaldbaydf4v37lbp02aznk2kkc"))
+                "1cri5lp3a9jhh34dbd48hq2zyb7xjb9qs6zl36l3q2blawgwz642"))
               (modules '((guix build utils)))
               (snippet
                '(begin
@@ -770,13 +771,17 @@ source files.")
                               "deps/icu-small"
                               "deps/nghttp2"
                               "deps/ngtcp2"
+                              "deps/llhttp"
                               "deps/uv"
-                              "deps/zlib"))))))
+                              "deps/zlib"
+                              "deps/zstd"))))))
     (arguments
      (substitute-keyword-arguments arguments
        ((#:configure-flags configure-flags)
         ''("--shared-cares"
            "--shared-libuv"
+           "--shared-http-parser"
+           "--shared-http-parser-libname=llhttp"
            "--shared-nghttp2"
            "--shared-openssl"
            "--shared-zlib"
@@ -784,6 +789,7 @@ source files.")
            "--with-intl=system-icu"
            "--shared-ngtcp2"
            "--shared-nghttp3"
+           "--shared-zstd"
            ;;Needed for correct snapshot checksums
            "--v8-enable-snapshot-compression"))
        ((#:phases phases)
@@ -846,9 +852,11 @@ source files.")
                (for-each delete-file
                          '("test/parallel/test-https-agent-unref-socket.js"))
 
-               ;; This test is timing-sensitive, and fails sporadically on
+               ;; These tests are timing-sensitive, and fail sporadically on
                ;; slow, busy, or even very fast machines.
-               (delete-file "test/parallel/test-fs-utimes.js")
+               (for-each delete-file
+                         '("test/parallel/test-fs-utimes.js"
+                           "test/sequential/test-performance-eventloopdelay.js"))
 
                ;; FIXME: This test fails randomly:
                ;; https://github.com/nodejs/node/issues/31213
@@ -899,18 +907,6 @@ source files.")
                      "test/parallel/test-http2-invalid-last-stream-id.js")
                  (("client\\.connect\\(address\\)")
                   "client.connect(address.port)"))))
-           (add-after 'delete-problematic-tests 'replace-llhttp-sources
-             (lambda* (#:key inputs #:allow-other-keys)
-               ;; Replace pre-generated llhttp sources
-               (let ((llhttp (assoc-ref inputs "llhttp")))
-                 (copy-file (string-append llhttp "/src/llhttp.c")
-                            "deps/llhttp/src/llhttp.c")
-                 (copy-file (string-append llhttp "/src/api.c")
-                            "deps/llhttp/src/api.c")
-                 (copy-file (string-append llhttp "/src/http.c")
-                            "deps/llhttp/src/http.c")
-                 (copy-file (string-append llhttp "/include/llhttp.h")
-                            "deps/llhttp/include/llhttp.h"))))
            ;; npm installs dependencies by copying their files over a tar
            ;; stream.  A file with more than one hardlink is marked as a
            ;; "Link".  pacote/lib/fetcher.js calls node-tar's extractor with a
@@ -935,30 +931,22 @@ source files.")
            ;;   https://github.com/npm/pacote/issues/285
            (add-after 'install 'ignore-number-of-hardlinks
              (lambda* (#:key outputs #:allow-other-keys)
-               (let ((file (string-append (assoc-ref outputs "out")
+               (let ((dir (string-append (assoc-ref outputs "out")
                                          "/lib/node_modules/npm/node_modules"
-                                          "/tar/lib/write-entry.js")))
+                                         "/tar/dist")))
-                 (substitute* file
+                 (substitute*
+                     (list (string-append dir "/esm/write-entry.js")
+                           (string-append dir "/commonjs/write-entry.js"))
                    (("this.stat.nlink > 1") "false")))))
-           (add-after 'install 'install-node-gyp-wrapper
+           (replace 'fix-node-gyp-reference
              (lambda* (#:key inputs outputs #:allow-other-keys)
-               (let* ((out (assoc-ref outputs "out"))
+               (let ((out (assoc-ref outputs "out")))
-                      (dir (string-append out "/lib/node_modules/npm/bin/node-gyp-bin"))
+                 (for-each
-                      (file (string-append dir "/node-gyp")))
+                  (lambda (spec)
-                 (mkdir-p dir)
+                    (wrap-program (string-append out spec)
-                 ;; See https://github.com/npm/cli/issues/6842
+                      `("npm_package_config_node_gyp_nodedir" = (,out))))
-                 (call-with-output-file file
+                  '("/bin/npm"
-                   (lambda (port)
+                    "/bin/npx")))))))))
-                     (format port "#!~a/bin/sh
-if [ \"x$npm_config_node_gyp\" = \"x\" ]; then
-  ~a/bin/node \"~a/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js\" \"$@\"
-else
-  \"$npm_config_node_gyp\" \"$@\"
-fi"
-                             (assoc-ref inputs "bash")
-                             out
-                             out)))
-                 (chmod file #o555))))))))
     (native-inputs
      (list ;; Runtime dependencies for binaries used as a bootstrap.
            c-ares-for-node-lts
@@ -974,7 +962,8 @@ fi"
            pkg-config
            procps
            python
-           util-linux))
+           util-linux
+           gcc-14))
     (inputs
      (list bash-minimal
            coreutils
@@ -987,7 +976,8 @@ fi"
            nghttp3
            `(,nghttp2 "lib")
            openssl-3.0
-           zlib))
+           zlib
+           `(,zstd-1.5.7 "lib")))
     (supported-systems
       (cons "riscv64-linux" (package-supported-systems node-bootstrap)))
     (properties (alist-delete 'hidden? (package-properties node-bootstrap)))))
@@ -1003,6 +993,6 @@ fi"
         `(cons* "--shared" "--without-npm" ,flags))
        ((#:phases phases '%standard-phases)
         `(modify-phases ,phases
-           (delete 'install-npmrc)
+           (delete 'fix-node-gyp-reference)
            (delete 'patch-nested-shebangs)
            (delete 'ignore-number-of-hardlinks)))))))

gnu/packages/ocaml.scm

@@ -313,7 +313,7 @@ functional, imperative and object-oriented styles of programming.")
     (source (origin
               (method url-fetch)
               (uri (string-append
-                    "http://caml.inria.fr/pub/distrib/ocaml-"
+                    "https://caml.inria.fr/pub/distrib/ocaml-"
                     (version-major+minor version)
                     "/ocaml-" version ".tar.xz"))
               (sha256
@@ -373,7 +373,7 @@ functional, imperative and object-oriented styles of programming.")
     (source (origin
               (method url-fetch)
               (uri (string-append
-                    "http://caml.inria.fr/pub/distrib/ocaml-"
+                    "https://caml.inria.fr/pub/distrib/ocaml-"
                     (version-major+minor version)
                     "/ocaml-" version ".tar.xz"))
               (patches (search-patches
@@ -421,7 +421,7 @@ patch-/bin/sh-references: ~a: changing `\"/bin/sh\"' to `~a'~%"
     (source (origin
               (method url-fetch)
               (uri (string-append
-                    "http://caml.inria.fr/pub/distrib/ocaml-"
+                    "https://caml.inria.fr/pub/distrib/ocaml-"
                     (version-major+minor version)
                     "/ocaml-" version ".tar.xz"))
               (sha256

gnu/packages/package-management.scm

@@ -802,7 +802,7 @@ high-performance computing} clusters.")
 (define-public toys
   (package
     (name "toys")
-    (version "0.1.0")
+    (version "0.1.1")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -811,7 +811,7 @@ high-performance computing} clusters.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "169jxh5knp5f2y9wbnc454jjdvvyqb5r0ydv3qkpm332vr0cl6p9"))))
+                "05zkvjs3wkwdswl4irkqaxgdassiji5pq8qaqcrzscvp24vkjjja"))))
     (build-system guile-build-system)
     (arguments
      (list
@@ -838,11 +838,8 @@ high-performance computing} clusters.")
                          (append (list ,@load-compiled-path)
                                  %load-compiled-path))))
               (substitute* "guix/extensions/toys.scm"
-                (("^\\(define-module \\(guix extensions toys\\)")
+                ((";;@load-paths@")
-                 (string-append
+                 (with-output-to-string (lambda () (write search-paths-header)))))))
-                  (with-output-to-string
-                    (lambda () (write search-paths-header)))
-                  "\n(define-module (guix extensions toys)")))))
           (add-after 'set-load-paths-in-entry-point 'register-guix-extension
             (lambda* (#:key outputs #:allow-other-keys)
               (let ((ext-path (string-append #$output "/share/guix/extensions")))
@@ -1204,8 +1201,8 @@ transactions from C or Python.")
     (license license:gpl2+)))
 
 (define-public bffe
-  (let ((commit "723fd5ea6af1b14c215baf80524c8ff4b21fcc82")
+  (let ((commit "d6c90f217595674c7910a858edcb735f88d3a14f")
-        (revision "17"))
+        (revision "18"))
     (package
       (name "bffe")
       (version (git-version "0" revision commit))
@@ -1216,7 +1213,7 @@ transactions from C or Python.")
                       (commit commit)))
                 (sha256
                  (base32
-                  "1sd62arq80kkfjnynivrp7jh8j359965ank8sglq1wgfdah9k8ii"))
+                  "0f7i68k6l5ylg8nch54xw4bxn0hayx2ng9j5dvwvai1vi887vmbj"))
                 (file-name (string-append name "-" version "-checkout"))))
       (build-system gnu-build-system)
       (native-inputs

gnu/packages/parallel.scm

@@ -82,7 +82,7 @@
 (define-public parallel
   (package
     (name "parallel")
-    (version "20260322")
+    (version "20260422")
     (outputs '("out" "doc"))
     (source
      (origin
@@ -90,7 +90,7 @@
       (uri (string-append "mirror://gnu/parallel/parallel-"
                           version ".tar.bz2"))
       (sha256
-       (base32 "1q7g5f13nlwichgh0dk8w5fqjnfnxvwxk6rjy0fd5l7l6blq0ikn"))
+       (base32 "1fq7v60x9jm8mg19qn8n0sfhrygccmw6mncwyjr1g8kfsrjz2k36"))
       (snippet
        '(begin
           (use-modules (guix build utils))
@@ -734,7 +734,7 @@ single-instruction multiple-data (SIMD) intrinsics.")
               (substitute* "src/include/pmix_config.h"
                 (("#define PMIX_CONFIGURE_CLI .*")
                  "#define PMIX_CONFIGURE_CLI \"[scrubbed]\"\n")))))))
-    (inputs (list libevent `(,hwloc "lib") zlib))
+    (inputs (list libevent `(,hwloc "lib") munge zlib))
     (native-inputs
      (list autoconf
            automake

gnu/packages/patches/cianna-remove-error-for-missing-cuda.patch

@@ -0,0 +1,32 @@
+From 5eed2d2ca7c13c08ca7eb92fc4a78c30ca4b6b3d Mon Sep 17 00:00:00 2001
+From: Hellseher <sharlatanus@gmail.com>
+Date: Sat, 18 Apr 2026 08:26:29 +0000
+Subject: [PATCH] Remove CUDA error handling from network.c
+
+Removed error handling for CUDA compilation check.
+
+Fixes: https://github.com/Deyht/CIANNA/issues/4
+---
+ src/network.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/src/network.c b/src/network.c
+index d454f64..5a9497c 100644
+--- a/src/network.c
++++ b/src/network.c
+@@ -155,15 +155,6 @@ CIANNA V-1.0.1.2 stable build (04/2026), by D.Cornu\n\
+ 		init_cuda(networks[network_number]);
+ 	#endif
+ 	
+-	#ifndef CUDA
+-	if(comp_int == C_CUDA)
+-	{
+-		printf("\n ERROR: compute method set to CUDA while CIANNA was not compiled for it.\n");
+-		printf(" Install Nvidia CUDA and recompile CIANNA with the appropriate option.\n\n");
+-		exit(EXIT_FAILURE);
+-	}
+-	#endif
+-	
+ 	#ifndef BLAS
+ 	if(comp_int == C_BLAS)
+ 	{

gnu/packages/patches/cvc5-symfpu-compatibility.patch

@@ -0,0 +1,165 @@
+Ensures that cvc5 is compatible with our version of SymFPU.
+
+Taken from: https://github.com/cvc5/cvc5/commit/2ed457049cf52bd0f21a6332c1be487d82bf5678
+
+diff --git a/cmake/FindSymFPU.cmake b/cmake/FindSymFPU.cmake
+index 765ee8d36..05a86e9ee 100644
+--- a/cmake/FindSymFPU.cmake
++++ b/cmake/FindSymFPU.cmake
+@@ -29,8 +29,8 @@ if(NOT SymFPU_FOUND_SYSTEM)
+   include(ExternalProject)
+   include(deps-helper)
+ 
+-  set(SymFPU_COMMIT "e6ac3af9c2c574498ea171c957425b407625448b")
+-  set(SymFPU_CHECKSUM "823aa663fcc2f6844ae5e9ea83ceda4ed393cdb3dadefce9b3c7c41cd0f4f702")
++  set(SymFPU_COMMIT "227a7246b8ce513b393cc2645d6d65d3490ea1de")
++  set(SymFPU_CHECKSUM "ff22e37dbc133120ada5760878974811737bec65b12a8883f92b1ed9e3f96e99")
+ 
+   ExternalProject_Add(
+     SymFPU-EP
+diff --git a/src/theory/fp/fp_word_blaster.cpp b/src/theory/fp/fp_word_blaster.cpp
+index 7f2086c35..3efb0eeed 100644
+--- a/src/theory/fp/fp_word_blaster.cpp
++++ b/src/theory/fp/fp_word_blaster.cpp
+@@ -119,6 +119,23 @@ CVC5_SYM_ITE_DFN(traits::ubv);
+ 
+ #undef CVC5_SYM_ITE_DFN
+ 
++#define CVC5_SYM_ITE_BOOL_DFN(T)                                   \
++  template <>                                                      \
++  struct ite<bool, T>                                              \
++  {                                                                \
++    static const T iteOp(const bool& cond, const T& l, const T& r) \
++    {                                                              \
++      return cond ? l : r;                                         \
++    }                                                              \
++  }
++
++CVC5_SYM_ITE_BOOL_DFN(traits::rm);
++CVC5_SYM_ITE_BOOL_DFN(traits::prop);
++CVC5_SYM_ITE_BOOL_DFN(traits::sbv);
++CVC5_SYM_ITE_BOOL_DFN(traits::ubv);
++
++#undef CVC5_SYM_ITE_BOOL_DFN
++
+ template <>
+ traits::ubv orderEncode<traits, traits::ubv>(const traits::ubv& b)
+ {
+@@ -564,6 +581,13 @@ symbolicBitVector<isSigned> symbolicBitVector<isSigned>::modularAdd(
+   return *this + op;
+ }
+ 
++template <bool isSigned>
++symbolicBitVector<isSigned> symbolicBitVector<isSigned>::modularSubtract(
++    const symbolicBitVector<isSigned>& op) const
++{
++  return *this - op;
++}
++
+ template <bool isSigned>
+ symbolicBitVector<isSigned> symbolicBitVector<isSigned>::modularNegate() const
+ {
+diff --git a/src/theory/fp/fp_word_blaster.h b/src/theory/fp/fp_word_blaster.h
+index 6ce365382..8179ceb32 100644
+--- a/src/theory/fp/fp_word_blaster.h
++++ b/src/theory/fp/fp_word_blaster.h
+@@ -242,6 +242,8 @@ class symbolicBitVector : public nodeWrapper
+   symbolicBitVector<isSigned> modularDecrement() const;
+   symbolicBitVector<isSigned> modularAdd(
+       const symbolicBitVector<isSigned>& op) const;
++  symbolicBitVector<isSigned> modularSubtract(
++      const symbolicBitVector<isSigned>& op) const;
+   symbolicBitVector<isSigned> modularNegate() const;
+ 
+   /*** Comparisons ***/
+diff --git a/src/util/floatingpoint_literal_symfpu_traits.cpp b/src/util/floatingpoint_literal_symfpu_traits.cpp
+index af56c2b87..181069427 100644
+--- a/src/util/floatingpoint_literal_symfpu_traits.cpp
++++ b/src/util/floatingpoint_literal_symfpu_traits.cpp
+@@ -223,6 +223,13 @@ wrappedBitVector<isSigned> wrappedBitVector<isSigned>::modularAdd(
+   return *this + op;
+ }
+ 
++template <bool isSigned>
++wrappedBitVector<isSigned> wrappedBitVector<isSigned>::modularSubtract(
++    const wrappedBitVector<isSigned>& op) const
++{
++  return *this - op;
++}
++
+ template <bool isSigned>
+ wrappedBitVector<isSigned> wrappedBitVector<isSigned>::modularNegate() const
+ {
+diff --git a/src/util/floatingpoint_literal_symfpu_traits.h b/src/util/floatingpoint_literal_symfpu_traits.h
+index 78fc69a18..b49ef3a2a 100644
+--- a/src/util/floatingpoint_literal_symfpu_traits.h
++++ b/src/util/floatingpoint_literal_symfpu_traits.h
+@@ -199,6 +199,8 @@ class wrappedBitVector : public BitVector
+   wrappedBitVector<isSigned> modularDecrement() const;
+   wrappedBitVector<isSigned> modularAdd(
+       const wrappedBitVector<isSigned>& op) const;
++  wrappedBitVector<isSigned> modularSubtract(
++      const wrappedBitVector<isSigned>& op) const;
+   wrappedBitVector<isSigned> modularNegate() const;
+ 
+   /** Bit-vector equality. */
+diff --git a/test/regress/cli/CMakeLists.txt b/test/regress/cli/CMakeLists.txt
+index 915a19e09..35ff58bc7 100644
+--- a/test/regress/cli/CMakeLists.txt
++++ b/test/regress/cli/CMakeLists.txt
+@@ -949,12 +949,15 @@ set(regress_0_tests
+   regress0/fp/issue6164.smt2
+   regress0/fp/issue7002.smt2
+   regress0/fp/issue7569.smt2
++  regress0/fp/issue9505.smt2
+   regress0/fp/issue9854.smt2
+   regress0/fp/issue9858.smt2
+   regress0/fp/issue9864.smt2
+   regress0/fp/issue9966.smt2
+   regress0/fp/issue9972.smt2
+   regress0/fp/issue9972-2.smt2
++  regress0/fp/issue11139.smt2
++  regress0/fp/issue12335.smt2
+   regress0/fp/issuepr650.smt2
+   regress0/fp/proj-issue329-prereg-context.smt2
+   regress0/fp/proj-issue477-fp-set-comprehension.smt2
+diff --git a/test/regress/cli/regress0/fp/issue11139.smt2 b/test/regress/cli/regress0/fp/issue11139.smt2
+new file mode 100644
+index 000000000..f4c00360e
+--- /dev/null
++++ b/test/regress/cli/regress0/fp/issue11139.smt2
+@@ -0,0 +1,9 @@
++; COMMAND-LINE: --check-models
++; EXPECT: sat
++(set-logic QF_FP)
++(declare-const FP_VAR_a (_ FloatingPoint 11 53))
++(declare-const FP_VAR_b (_ FloatingPoint 11 53))
++(assert ( = (fp #b0 #b00000000000 #b0000000000000000000000000000000000000000000000000000)
++(fp.div RTN (fp.fma RTP FP_VAR_a FP_VAR_a 
++(fp #b0 #b00000000000 #b0000000000000000000000000000000000000000000000000000)) FP_VAR_b)))
++(check-sat)
+diff --git a/test/regress/cli/regress0/fp/issue12335.smt2 b/test/regress/cli/regress0/fp/issue12335.smt2
+new file mode 100644
+index 000000000..bc2580a89
+--- /dev/null
++++ b/test/regress/cli/regress0/fp/issue12335.smt2
+@@ -0,0 +1,7 @@
++; EXPECT: sat
++(set-logic FP)
++(declare-const x Float32)
++(declare-const a Float32)
++(assert (forall ((V Float32) (A Float32)) (or (not (fp.lt V x)) (not (fp.eq a a)) (not (fp.gt A (fp (_ bv0 1) (_ bv0 8) (_ bv0 23)))) (not (fp.eq (fp.div RNE A V) (fp (_ bv0 1) (_ bv0 8) (_ bv0 23)))))))
++(assert (fp.geq a (fp (_ bv0 1) (_ bv0 8) (_ bv0 23))))
++(check-sat)
+diff --git a/test/regress/cli/regress0/fp/issue9505.smt2 b/test/regress/cli/regress0/fp/issue9505.smt2
+new file mode 100644
+index 000000000..05674b8ff
+--- /dev/null
++++ b/test/regress/cli/regress0/fp/issue9505.smt2
+@@ -0,0 +1,6 @@
++; COMMAND-LINE: --fp-exp
++; EXPECT: sat
++(set-logic QF_FP)
++(declare-fun m () (_ FloatingPoint 4 12))
++(assert (fp.eq (fp (_ bv0 1) (_ bv0 8) (_ bv0 23)) ((_ to_fp 8 24) roundNearestTiesToEven (fp.rem m (fp (_ bv0 1) (_     bv9 4) (_ bv1536 11))))))
++(check-sat)

gnu/packages/patches/emacs-agent-shell-fix-tests.patch

@@ -0,0 +1,32 @@
+From 158304fb31177304d41fe495f8c1cca1fb5cff70 Mon Sep 17 00:00:00 2001
+From: xenodium <8107219+xenodium@users.noreply.github.com>
+Date: Wed, 25 Mar 2026 12:37:17 +0000
+Subject: [PATCH] Fixing test
+
+---
+ tests/agent-shell-tests.el | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tests/agent-shell-tests.el b/tests/agent-shell-tests.el
+index f602912d..9263e051 100644
+--- a/tests/agent-shell-tests.el
++++ b/tests/agent-shell-tests.el
+@@ -1233,14 +1233,16 @@ code block content
+                        test-buffer))
+                     ((symbol-function 'shell-maker--process) (lambda () fake-process))
+                     ((symbol-function 'shell-maker-finish-output) #'ignore)
++                    ((symbol-function 'agent-shell--handle) #'ignore)
+                     (agent-shell-file-completion-enabled nil))
+             (let* ((shell-buffer (agent-shell--start :config config
+                                                      :no-focus t
+                                                      :new-session t))
+                    (subs (map-elt (buffer-local-value 'agent-shell--state shell-buffer)
+                                   :event-subscriptions)))
+-              (should (= 1 (length subs)))
+-              (should (eq 'turn-complete (map-elt (car subs) :event))))))
++              (should (seq-find (lambda (sub)
++                                  (eq 'turn-complete (map-elt sub :event)))
++                                subs)))))
+       (remove-hook 'agent-shell-mode-hook hook-fn)
+       (when (process-live-p fake-process)
+         (delete-process fake-process))

gnu/packages/patches/emacs-buttercup-1.38-native-comp-spy-on-trampoline-scope.patch

@@ -1,92 +0,0 @@
-From 8d651d7247c4e8cf07ba805712cdb09e8095dd89 Mon Sep 17 00:00:00 2001
-Message-ID: <8d651d7247c4e8cf07ba805712cdb09e8095dd89.1773006315.git.dannym@friendly-machines.com>
-From: Danny Milosavljevic <dannym@friendly-machines.com>
-Date: Sun, 8 Mar 2026 21:44:05 +0000
-Subject: [PATCH] Scope native-comp trampoline disabling to spy-on only
-See: <https://github.com/jorgenschaefer/emacs-buttercup/pull/257>
-
-buttercup-with-cleanup disabled native-comp-enable-subr-trampolines
-for the entire spec execution.  This was a workaround for Emacs
-bug#61880, where trampoline compilation fails when spy-on redefines
-primitives that the trampoline compiler itself depends on (e.g.
-file-exists-p).
-
-However, disabling trampolines globally has the side effect that fset
-overrides of C primitives become invisible to natively compiled code.
-This breaks shut-up's message override when called indirectly through
-native-compiled functions like display-message-or-buffer (from
-simple.eln), because without a trampoline, the native code calls the C
-primitive directly, bypassing the fset'd function.
-
-Move the trampoline disabling from buttercup-with-cleanup into
-buttercup--spy-on-and-call-replacement, scoping it to just the fset
-call that installs the spy.  This avoids the trampoline compilation
-issue while allowing other fset overrides (e.g. from shut-up or
-cl-letf) to work correctly with native-compiled callers.
----
- buttercup.el | 34 +++++++++++++++++-----------------
- 1 file changed, 17 insertions(+), 17 deletions(-)
-
-diff --git a/buttercup.el b/buttercup.el
-index 07e003f..417786d 100644
---- a/buttercup.el
-+++ b/buttercup.el
-@@ -1293,12 +1293,23 @@ responsibility to ensure ARG is a command."
-       (error "Spies can only be created in `before-each' or `it'"))))
- 
- 
-+(defvar native-comp-enable-subr-trampolines)
-+(defvar comp-enable-subr-trampolines)
-+
- (defun buttercup--spy-on-and-call-replacement (spy fun)
-   "Replace the function in symbol SPY with a spy calling FUN."
-   (let ((orig-function (and (fboundp spy) (symbol-function spy))))
-     (when (buttercup--add-cleanup (lambda ()
-                                   (fset spy orig-function)))
--      (fset spy (buttercup--make-spy fun)))))
-+      ;; Disable subr trampoline generation around the fset call.
-+      ;; Redefining certain primitives causes trampoline compilation
-+      ;; to fail because the trampoline compiler itself depends on
-+      ;; primitives that may have just been redefined.
-+      ;; See <https://github.com/jorgenschaefer/emacs-buttercup/issues/230>
-+      ;; and <https://debbugs.gnu.org/61880>.
-+      (let ((native-comp-enable-subr-trampolines nil)
-+            (comp-enable-subr-trampolines nil))
-+        (fset spy (buttercup--make-spy fun))))))
- 
- (defun buttercup--make-spy (fun)
-   "Create a new spy function wrapping FUN and tracking every call to itself."
-@@ -1343,24 +1354,13 @@ responsibility to ensure ARG is a command."
- Should always be set to a value that is not `listp', except while
- in a `buttercup-with-cleanup' environment.")
- 
--(defvar native-comp-enable-subr-trampolines)
--(defvar comp-enable-subr-trampolines)
--
- (defmacro buttercup-with-cleanup (&rest body)
-   "Execute BODY, cleaning spys and the rest afterwards."
--  `(,@(if (fboundp 'with-suppressed-warnings)
--          '(with-suppressed-warnings ((obsolete comp-enable-subr-trampolines)))
--        '(progn))
--     (let ((buttercup--cleanup-functions nil)
--           ;; Redefining certain primitive's trampolines will cause problems,
--           ;; see https://github.com/jorgenschaefer/emacs-buttercup/issues/230 and
--           ;; https://debbugs.gnu.org/cgi/bugreport.cgi?bug=61880
--           (comp-enable-subr-trampolines nil)
--           (native-comp-enable-subr-trampolines nil))
--       (unwind-protect (progn ,@body)
--         (dolist (fun buttercup--cleanup-functions)
--           (ignore-errors
--             (funcall fun)))))))
-+  `(let ((buttercup--cleanup-functions nil))
-+     (unwind-protect (progn ,@body)
-+       (dolist (fun buttercup--cleanup-functions)
-+         (ignore-errors
-+           (funcall fun))))))
- 
- (defun buttercup--add-cleanup (function)
-   "Register FUNCTION for cleanup in `buttercup-with-cleanup'."
-
-base-commit: cc5a2ab7c7f18aaaf525fac61fe59bae5ad018dd
--- 
-2.52.0

gnu/packages/patches/java-apache-xml-commons-resolver-1.2-netbeans.patch

@@ -0,0 +1,890 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+# This is the Apache NetBeans patch
+# ide/o.apache.xml.resolver/external/xml-resolver-1.2-netbeans.patch,
+# rewritten only as needed to apply to the xml-commons-resolver source tree
+# packaged by Guix.
+#
+# NetBeans-side provenance:
+#   - Antonio Vieiro: introduced the patch file in commit
+#     4f4debf776ff247b33fe49b876379fbd90d65fe3
+#   - Junichi Yamamoto: later edited the patch file text
+#
+# Apache NetBeans expects a patched xml-resolver 1.2.  Its source tree and
+# build metadata use the following additions from this patch:
+#   - Catalog.getPublicIDs()
+#   - a CatalogManager.readProperties() guard for propertyFile == null
+#   - org.apache.xml.resolver.NbCatalogManager
+#   - org.apache.xml.resolver.tools.NbCatalogResolver
+#
+# This Guix copy is functionally equivalent to the NetBeans patch.
+
+diff -urN orig/src/org/apache/xml/resolver/Catalog.java mod/src/org/apache/xml/resolver/Catalog.java
+--- orig/src/org/apache/xml/resolver/Catalog.java	1970-01-01 00:00:01.000000000 +0000
++++ mod/src/org/apache/xml/resolver/Catalog.java	2026-03-18 08:06:04.365313076 +0000
+@@ -393,6 +393,26 @@
+   }
+ 
+   /**
++   * Return all registered public IDs.
++   * This method added for solving the following issues in NetBeans codebase:
++   * http://www.netbeans.org/issues/show_bug.cgi?id=98212
++   * and 
++   * http://www.netbeans.org/issues/show_bug.cgi?id=112679
++   */
++  public java.util.Iterator getPublicIDs() {
++      Vector v = new Vector();
++      Enumeration enumeration = catalogEntries.elements();
++
++      while (enumeration.hasMoreElements()) {
++        CatalogEntry e = (CatalogEntry) enumeration.nextElement();
++        if (e.getEntryType() == PUBLIC) {
++            v.add(e.getEntryArg(0));
++        }
++      }
++      return v.iterator();
++  }
++
++  /**
+    * Setup readers.
+    */
+   public void setupReaders() {
+diff -urN orig/src/org/apache/xml/resolver/CatalogManager.java mod/src/org/apache/xml/resolver/CatalogManager.java
+--- orig/src/org/apache/xml/resolver/CatalogManager.java	1970-01-01 00:00:01.000000000 +0000
++++ mod/src/org/apache/xml/resolver/CatalogManager.java	2026-03-18 08:06:04.368781753 +0000
+@@ -239,6 +239,9 @@
+    * resources from it.
+    */
+   private synchronized void readProperties() {
++    if (propertyFile == null) {
++      return;
++    }
+     try {
+       propertyFileURI = CatalogManager.class.getResource("/"+propertyFile);
+       InputStream in =
+diff -urN orig/src/org/apache/xml/resolver/NbCatalogManager.java mod/src/org/apache/xml/resolver/NbCatalogManager.java
+--- orig/src/org/apache/xml/resolver/NbCatalogManager.java	1970-01-01 00:00:00.000000000 +0000
++++ mod/src/org/apache/xml/resolver/NbCatalogManager.java	2026-03-18 08:04:38.762268746 +0000
+@@ -0,0 +1,570 @@
++/*
++ * Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ * 
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ * 
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++package org.apache.xml.resolver;
++
++import java.io.IOException;
++import java.io.InputStream;
++import java.io.PrintStream;
++import java.net.MalformedURLException;
++import java.net.URL;
++import java.util.MissingResourceException;
++import java.util.PropertyResourceBundle;
++import java.util.ResourceBundle;
++import java.util.StringTokenizer;
++import java.util.Vector;
++import org.apache.xml.resolver.helpers.BootstrapResolver;
++import org.apache.xml.resolver.helpers.Debug;
++
++public class NbCatalogManager
++  extends CatalogManager
++{
++  private static String pFiles = "xml.catalog.files";
++  private static String pVerbosity = "xml.catalog.verbosity";
++  private static String pPrefer = "xml.catalog.prefer";
++  private static String pStatic = "xml.catalog.staticCatalog";
++  private static String pAllowPI = "xml.catalog.allowPI";
++  private static String pClassname = "xml.catalog.className";
++  private static String pIgnoreMissing = "xml.catalog.ignoreMissing";
++  private static NbCatalogManager staticManager = new NbCatalogManager();
++  private BootstrapResolver bResolver = new BootstrapResolver();
++  private boolean ignoreMissingProperties = (System.getProperty(pIgnoreMissing) != null) || (System.getProperty(pFiles) != null);
++  private ResourceBundle resources;
++  private String propertyFile = "CatalogManager.properties";
++  private URL propertyFileURI = null;
++  private String defaultCatalogFiles = "./xcatalog";
++  private String catalogFiles = null;
++  private boolean fromPropertiesFile = false;
++  private int defaultVerbosity = 1;
++  private Integer verbosity = null;
++  private boolean defaultPreferPublic = true;
++  private Boolean preferPublic = null;
++  private boolean defaultUseStaticCatalog = true;
++  private Boolean useStaticCatalog = null;
++  private static Catalog staticCatalog = null;
++  private boolean defaultOasisXMLCatalogPI = true;
++  private Boolean oasisXMLCatalogPI = null;
++  private boolean defaultRelativeCatalogs = true;
++  private Boolean relativeCatalogs = null;
++  private String catalogClassName = null;
++  public Debug debug = null;
++  
++  public NbCatalogManager()
++  {
++    this.debug = new Debug();
++  }
++  
++  public NbCatalogManager(String propertyFile)
++  {
++    this.propertyFile = propertyFile;
++    
++    this.debug = new Debug();
++  }
++  
++  public void setBootstrapResolver(BootstrapResolver resolver)
++  {
++    this.bResolver = resolver;
++  }
++  
++  public BootstrapResolver getBootstrapResolver()
++  {
++    return this.bResolver;
++  }
++  
++  private synchronized void readProperties()
++  {
++    if (this.propertyFile == null) {
++      return;
++    }
++    try
++    {
++      this.propertyFileURI = NbCatalogManager.class.getResource("/" + this.propertyFile);
++      InputStream in = NbCatalogManager.class.getResourceAsStream("/" + this.propertyFile);
++      if (in == null)
++      {
++        if (!this.ignoreMissingProperties)
++        {
++          this.debug.message(2, "Cannot find " + this.propertyFile);
++          
++          this.ignoreMissingProperties = true;
++        }
++        return;
++      }
++      this.resources = new PropertyResourceBundle(in);
++    }
++    catch (MissingResourceException mre)
++    {
++      if (!this.ignoreMissingProperties) {
++        System.err.println("Cannot read " + this.propertyFile);
++      }
++    }
++    catch (IOException e)
++    {
++      if (!this.ignoreMissingProperties) {
++        System.err.println("Failure trying to read " + this.propertyFile);
++      }
++    }
++    if (this.verbosity == null) {
++      try
++      {
++        String verbStr = this.resources.getString("verbosity");
++        int verb = Integer.parseInt(verbStr.trim());
++        this.debug.setDebug(verb);
++        this.verbosity = new Integer(verb);
++      }
++      catch (Exception e) {}
++    }
++  }
++  
++  public static CatalogManager getStaticManager()
++  {
++    return staticManager;
++  }
++  
++  public boolean getIgnoreMissingProperties()
++  {
++    return this.ignoreMissingProperties;
++  }
++  
++  public void setIgnoreMissingProperties(boolean ignore)
++  {
++    this.ignoreMissingProperties = ignore;
++  }
++  
++  /**
++   * @deprecated
++   */
++  public void ignoreMissingProperties(boolean ignore)
++  {
++    setIgnoreMissingProperties(ignore);
++  }
++  
++  private int queryVerbosity()
++  {
++    String defaultVerbStr = Integer.toString(this.defaultVerbosity);
++    
++    String verbStr = System.getProperty(pVerbosity);
++    if (verbStr == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources != null) {
++        try
++        {
++          verbStr = this.resources.getString("verbosity");
++        }
++        catch (MissingResourceException e)
++        {
++          verbStr = defaultVerbStr;
++        }
++      } else {
++        verbStr = defaultVerbStr;
++      }
++    }
++    int verb = this.defaultVerbosity;
++    try
++    {
++      verb = Integer.parseInt(verbStr.trim());
++    }
++    catch (Exception e)
++    {
++      System.err.println("Cannot parse verbosity: \"" + verbStr + "\"");
++    }
++    if (this.verbosity == null)
++    {
++      this.debug.setDebug(verb);
++      this.verbosity = new Integer(verb);
++    }
++    return verb;
++  }
++  
++  public int getVerbosity()
++  {
++    if (this.verbosity == null) {
++      this.verbosity = new Integer(queryVerbosity());
++    }
++    return this.verbosity.intValue();
++  }
++  
++  public void setVerbosity(int verbosity)
++  {
++    this.verbosity = new Integer(verbosity);
++    this.debug.setDebug(verbosity);
++  }
++  
++  /**
++   * @deprecated
++   */
++  public int verbosity()
++  {
++    return getVerbosity();
++  }
++  
++  private boolean queryRelativeCatalogs()
++  {
++    if (this.resources == null) {
++      readProperties();
++    }
++    if (this.resources == null) {
++      return this.defaultRelativeCatalogs;
++    }
++    try
++    {
++      String allow = this.resources.getString("relative-catalogs");
++      return (allow.equalsIgnoreCase("true")) || (allow.equalsIgnoreCase("yes")) || (allow.equalsIgnoreCase("1"));
++    }
++    catch (MissingResourceException e) {}
++    return this.defaultRelativeCatalogs;
++  }
++  
++  public boolean getRelativeCatalogs()
++  {
++    if (this.relativeCatalogs == null) {
++      this.relativeCatalogs = new Boolean(queryRelativeCatalogs());
++    }
++    return this.relativeCatalogs.booleanValue();
++  }
++  
++  public void setRelativeCatalogs(boolean relative)
++  {
++    this.relativeCatalogs = new Boolean(relative);
++  }
++  
++  /**
++   * @deprecated
++   */
++  public boolean relativeCatalogs()
++  {
++    return getRelativeCatalogs();
++  }
++  
++  private String queryCatalogFiles()
++  {
++    String catalogList = System.getProperty(pFiles);
++    this.fromPropertiesFile = false;
++    if (catalogList == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources != null) {
++        try
++        {
++          catalogList = this.resources.getString("catalogs");
++          this.fromPropertiesFile = true;
++        }
++        catch (MissingResourceException e)
++        {
++          System.err.println(this.propertyFile + ": catalogs not found.");
++          catalogList = null;
++        }
++      }
++    }
++    if (catalogList == null) {
++      catalogList = this.defaultCatalogFiles;
++    }
++    return catalogList;
++  }
++  
++  public Vector getCatalogFiles()
++  {
++    if (this.catalogFiles == null) {
++      this.catalogFiles = queryCatalogFiles();
++    }
++    StringTokenizer files = new StringTokenizer(this.catalogFiles, ";");
++    Vector catalogs = new Vector();
++    while (files.hasMoreTokens())
++    {
++      String catalogFile = files.nextToken();
++      URL absURI = null;
++      if ((this.fromPropertiesFile) && (!relativeCatalogs())) {
++        try
++        {
++          absURI = new URL(this.propertyFileURI, catalogFile);
++          catalogFile = absURI.toString();
++        }
++        catch (MalformedURLException mue)
++        {
++          absURI = null;
++        }
++      }
++      catalogs.add(catalogFile);
++    }
++    return catalogs;
++  }
++  
++  public void setCatalogFiles(String fileList)
++  {
++    this.catalogFiles = fileList;
++    this.fromPropertiesFile = false;
++  }
++  
++  /**
++   * @deprecated
++   */
++  public Vector catalogFiles()
++  {
++    return getCatalogFiles();
++  }
++  
++  private boolean queryPreferPublic()
++  {
++    String prefer = System.getProperty(pPrefer);
++    if (prefer == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources == null) {
++        return this.defaultPreferPublic;
++      }
++      try
++      {
++        prefer = this.resources.getString("prefer");
++      }
++      catch (MissingResourceException e)
++      {
++        return this.defaultPreferPublic;
++      }
++    }
++    if (prefer == null) {
++      return this.defaultPreferPublic;
++    }
++    return prefer.equalsIgnoreCase("public");
++  }
++  
++  public boolean getPreferPublic()
++  {
++    if (this.preferPublic == null) {
++      this.preferPublic = new Boolean(queryPreferPublic());
++    }
++    return this.preferPublic.booleanValue();
++  }
++  
++  public void setPreferPublic(boolean preferPublic)
++  {
++    this.preferPublic = new Boolean(preferPublic);
++  }
++  
++  /**
++   * @deprecated
++   */
++  public boolean preferPublic()
++  {
++    return getPreferPublic();
++  }
++  
++  private boolean queryUseStaticCatalog()
++  {
++    String staticCatalog = System.getProperty(pStatic);
++    if (staticCatalog == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources == null) {
++        return this.defaultUseStaticCatalog;
++      }
++      try
++      {
++        staticCatalog = this.resources.getString("static-catalog");
++      }
++      catch (MissingResourceException e)
++      {
++        return this.defaultUseStaticCatalog;
++      }
++    }
++    if (staticCatalog == null) {
++      return this.defaultUseStaticCatalog;
++    }
++    return (staticCatalog.equalsIgnoreCase("true")) || (staticCatalog.equalsIgnoreCase("yes")) || (staticCatalog.equalsIgnoreCase("1"));
++  }
++  
++  public boolean getUseStaticCatalog()
++  {
++    if (this.useStaticCatalog == null) {
++      this.useStaticCatalog = new Boolean(queryUseStaticCatalog());
++    }
++    return this.useStaticCatalog.booleanValue();
++  }
++  
++  public void setUseStaticCatalog(boolean useStatic)
++  {
++    this.useStaticCatalog = new Boolean(useStatic);
++  }
++  
++  /**
++   * @deprecated
++   */
++  public boolean staticCatalog()
++  {
++    return getUseStaticCatalog();
++  }
++  
++  public Catalog getPrivateCatalog()
++  {
++    Catalog catalog = staticCatalog;
++    if (this.useStaticCatalog == null) {
++      this.useStaticCatalog = new Boolean(getUseStaticCatalog());
++    }
++    if ((catalog == null) || (!this.useStaticCatalog.booleanValue()))
++    {
++      try
++      {
++        String catalogClassName = getCatalogClassName();
++        if (catalogClassName == null) {
++          catalog = new Catalog();
++        } else {
++          try
++          {
++            catalog = (Catalog)Class.forName(catalogClassName).newInstance();
++          }
++          catch (ClassNotFoundException cnfe)
++          {
++            this.debug.message(1, "Catalog class named '" + catalogClassName + "' could not be found. Using default.");
++            
++            catalog = new Catalog();
++          }
++          catch (ClassCastException cnfe)
++          {
++            this.debug.message(1, "Class named '" + catalogClassName + "' is not a Catalog. Using default.");
++            
++            catalog = new Catalog();
++          }
++        }
++        catalog.setCatalogManager(this);
++        catalog.setupReaders();
++        catalog.loadSystemCatalogs();
++      }
++      catch (Exception ex)
++      {
++        ex.printStackTrace();
++      }
++      if (this.useStaticCatalog.booleanValue()) {
++        staticCatalog = catalog;
++      }
++    }
++    return catalog;
++  }
++  
++  public Catalog getCatalog()
++  {
++    Catalog catalog = staticCatalog;
++    if (this.useStaticCatalog == null) {
++      this.useStaticCatalog = new Boolean(getUseStaticCatalog());
++    }
++    if ((catalog == null) || (!this.useStaticCatalog.booleanValue()))
++    {
++      catalog = getPrivateCatalog();
++      if (this.useStaticCatalog.booleanValue()) {
++        staticCatalog = catalog;
++      }
++    }
++    return catalog;
++  }
++  
++  public boolean queryAllowOasisXMLCatalogPI()
++  {
++    String allow = System.getProperty(pAllowPI);
++    if (allow == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources == null) {
++        return this.defaultOasisXMLCatalogPI;
++      }
++      try
++      {
++        allow = this.resources.getString("allow-oasis-xml-catalog-pi");
++      }
++      catch (MissingResourceException e)
++      {
++        return this.defaultOasisXMLCatalogPI;
++      }
++    }
++    if (allow == null) {
++      return this.defaultOasisXMLCatalogPI;
++    }
++    return (allow.equalsIgnoreCase("true")) || (allow.equalsIgnoreCase("yes")) || (allow.equalsIgnoreCase("1"));
++  }
++  
++  public boolean getAllowOasisXMLCatalogPI()
++  {
++    if (this.oasisXMLCatalogPI == null) {
++      this.oasisXMLCatalogPI = new Boolean(queryAllowOasisXMLCatalogPI());
++    }
++    return this.oasisXMLCatalogPI.booleanValue();
++  }
++  
++  public void setAllowOasisXMLCatalogPI(boolean allowPI)
++  {
++    this.oasisXMLCatalogPI = new Boolean(allowPI);
++  }
++  
++  /**
++   * @deprecated
++   */
++  public boolean allowOasisXMLCatalogPI()
++  {
++    return getAllowOasisXMLCatalogPI();
++  }
++  
++  public String queryCatalogClassName()
++  {
++    String className = System.getProperty(pClassname);
++    if (className == null)
++    {
++      if (this.resources == null) {
++        readProperties();
++      }
++      if (this.resources == null) {
++        return null;
++      }
++      try
++      {
++        return this.resources.getString("catalog-class-name");
++      }
++      catch (MissingResourceException e)
++      {
++        return null;
++      }
++    }
++    return className;
++  }
++  
++  public String getCatalogClassName()
++  {
++    if (this.catalogClassName == null) {
++      this.catalogClassName = queryCatalogClassName();
++    }
++    return this.catalogClassName;
++  }
++  
++  public void setCatalogClassName(String className)
++  {
++    this.catalogClassName = className;
++  }
++  
++  /**
++   * @deprecated
++   */
++  public String catalogClassName()
++  {
++    return getCatalogClassName();
++  }
++}
+diff -urN orig/src/org/apache/xml/resolver/tools/NbCatalogResolver.java mod/src/org/apache/xml/resolver/tools/NbCatalogResolver.java
+--- orig/src/org/apache/xml/resolver/tools/NbCatalogResolver.java	1970-01-01 00:00:00.000000000 +0000
++++ mod/src/org/apache/xml/resolver/tools/NbCatalogResolver.java	2026-03-18 08:04:38.765863057 +0000
+@@ -0,0 +1,233 @@
++/*
++ * Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ * 
++ *      http://www.apache.org/licenses/LICENSE-2.0
++ * 
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++package org.apache.xml.resolver.tools;
++
++import java.io.IOException;
++import java.net.MalformedURLException;
++import java.net.URL;
++import javax.xml.parsers.ParserConfigurationException;
++import javax.xml.parsers.SAXParser;
++import javax.xml.parsers.SAXParserFactory;
++import javax.xml.transform.Source;
++import javax.xml.transform.TransformerException;
++import javax.xml.transform.URIResolver;
++import javax.xml.transform.sax.SAXSource;
++import org.apache.xml.resolver.Catalog;
++import org.apache.xml.resolver.CatalogManager;
++import org.apache.xml.resolver.NbCatalogManager;
++import org.apache.xml.resolver.helpers.Debug;
++import org.apache.xml.resolver.helpers.FileURL;
++import org.xml.sax.EntityResolver;
++import org.xml.sax.InputSource;
++import org.xml.sax.SAXException;
++import org.xml.sax.XMLReader;
++
++public class NbCatalogResolver
++  implements EntityResolver, URIResolver
++{
++  public boolean namespaceAware = true;
++  public boolean validating = false;
++  private Catalog catalog = null;
++  private CatalogManager catalogManager = NbCatalogManager.getStaticManager();
++  
++  public NbCatalogResolver()
++  {
++    initializeCatalogs(false);
++  }
++  
++  public NbCatalogResolver(boolean privateCatalog)
++  {
++    initializeCatalogs(privateCatalog);
++  }
++  
++  public NbCatalogResolver(NbCatalogManager manager)
++  {
++    this.catalogManager = manager;
++    initializeCatalogs(!this.catalogManager.getUseStaticCatalog());
++  }
++  
++  private void initializeCatalogs(boolean privateCatalog)
++  {
++    this.catalog = this.catalogManager.getCatalog();
++  }
++  
++  public Catalog getCatalog()
++  {
++    return this.catalog;
++  }
++  
++  public String getResolvedEntity(String publicId, String systemId)
++  {
++    String resolved = null;
++    if (this.catalog == null)
++    {
++      this.catalogManager.debug.message(1, "Catalog resolution attempted with null catalog; ignored");
++      return null;
++    }
++    if (systemId != null) {
++      try
++      {
++        resolved = this.catalog.resolveSystem(systemId);
++      }
++      catch (MalformedURLException me)
++      {
++        this.catalogManager.debug.message(1, "Malformed URL exception trying to resolve", publicId);
++        
++        resolved = null;
++      }
++      catch (IOException ie)
++      {
++        this.catalogManager.debug.message(1, "I/O exception trying to resolve", publicId);
++        resolved = null;
++      }
++    }
++    if (resolved == null)
++    {
++      if (publicId != null) {
++        try
++        {
++          resolved = this.catalog.resolvePublic(publicId, systemId);
++        }
++        catch (MalformedURLException me)
++        {
++          this.catalogManager.debug.message(1, "Malformed URL exception trying to resolve", publicId);
++        }
++        catch (IOException ie)
++        {
++          this.catalogManager.debug.message(1, "I/O exception trying to resolve", publicId);
++        }
++      }
++      if (resolved != null) {
++        this.catalogManager.debug.message(2, "Resolved public", publicId, resolved);
++      }
++    }
++    else
++    {
++      this.catalogManager.debug.message(2, "Resolved system", systemId, resolved);
++    }
++    return resolved;
++  }
++  
++  public InputSource resolveEntity(String publicId, String systemId)
++  {
++    String resolved = getResolvedEntity(publicId, systemId);
++    if (resolved != null)
++    {
++      InputSource iSource = new InputSource(resolved);
++      iSource.setPublicId(publicId);
++      return iSource;
++    }
++    return null;
++  }
++  
++  public Source resolve(String href, String base)
++    throws TransformerException
++  {
++    String uri = href;
++    String fragment = null;
++    int hashPos = href.indexOf("#");
++    if (hashPos >= 0)
++    {
++      uri = href.substring(0, hashPos);
++      fragment = href.substring(hashPos + 1);
++    }
++    String result = null;
++    try
++    {
++      result = this.catalog.resolveURI(href);
++    }
++    catch (Exception e) {}
++    if (result == null) {
++      try
++      {
++        URL url = null;
++        if (base == null)
++        {
++          url = new URL(uri);
++          result = url.toString();
++        }
++        else
++        {
++          URL baseURL = new URL(base);
++          url = href.length() == 0 ? baseURL : new URL(baseURL, uri);
++          result = url.toString();
++        }
++      }
++      catch (MalformedURLException mue)
++      {
++        String absBase = makeAbsolute(base);
++        if (!absBase.equals(base)) {
++          return resolve(href, absBase);
++        }
++        throw new TransformerException("Malformed URL " + href + "(base " + base + ")", mue);
++      }
++    }
++    this.catalogManager.debug.message(2, "Resolved URI", href, result);
++    
++    SAXSource source = new SAXSource();
++    source.setInputSource(new InputSource(result));
++    setEntityResolver(source);
++    return source;
++  }
++  
++  private void setEntityResolver(SAXSource source)
++    throws TransformerException
++  {
++    XMLReader reader = source.getXMLReader();
++    if (reader == null)
++    {
++      SAXParserFactory spFactory = SAXParserFactory.newInstance();
++      spFactory.setNamespaceAware(true);
++      try
++      {
++        reader = spFactory.newSAXParser().getXMLReader();
++      }
++      catch (ParserConfigurationException ex)
++      {
++        throw new TransformerException(ex);
++      }
++      catch (SAXException ex)
++      {
++        throw new TransformerException(ex);
++      }
++    }
++    reader.setEntityResolver(this);
++    source.setXMLReader(reader);
++  }
++  
++  private String makeAbsolute(String uri)
++  {
++    if (uri == null) {
++      uri = "";
++    }
++    try
++    {
++      URL url = new URL(uri);
++      return url.toString();
++    }
++    catch (MalformedURLException mue)
++    {
++      try
++      {
++        URL fileURL = FileURL.makeURL(uri);
++        return fileURL.toString();
++      }
++      catch (MalformedURLException mue2) {}
++    }
++    return uri;
++  }
++}

gnu/packages/patches/java-jtidy-remove-xerces-dependency.patch

@@ -0,0 +1,24 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Remove lib that is built-in into JDK since Java 5.
+
+Remove xerces:dom3-xml-apis dependency from pom.xml.
+The DOM Level 3 API has been part of the JDK since Java 5.
+Without this patch, install-from-pom's fix-pom-dependencies throws
+no-such-input because the dependency is not test-scoped or optional
+and no matching package is in inputs.
+
+--- a/pom.xml
++++ b/pom.xml
+@@ -171,11 +171,6 @@
+     </plugins>
+   </build>
+   <dependencies>
+-    <dependency>
+-      <groupId>xerces</groupId>
+-      <artifactId>dom3-xml-apis</artifactId>
+-      <version>1.0</version>
+-    </dependency>
+     <dependency>
+       <groupId>ant</groupId>
+       <artifactId>ant</artifactId>

gnu/packages/patches/java-simplevalidation-1.14.1.patch

@@ -0,0 +1,107 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Update simplevalidation to 1.14.1.
+
+diff -urN orig/ValidationAPI/pom.xml mod/ValidationAPI/pom.xml
+--- orig/ValidationAPI/pom.xml	2022-07-23 01:17:30.000000000 +0000
++++ mod/ValidationAPI/pom.xml	2026-03-18 08:31:38.200321916 +0000
+@@ -4,7 +4,7 @@
+     <parent>
+         <artifactId>simplevalidation-parent</artifactId>
+         <groupId>com.mastfrog</groupId>
+-        <version>1.14</version>
++        <version>1.14.1</version>
+     </parent>
+     <modelVersion>4.0.0</modelVersion>
+     <artifactId>simplevalidation</artifactId>
+diff -urN orig/nbstubs/pom.xml mod/nbstubs/pom.xml
+--- orig/nbstubs/pom.xml	2022-07-23 01:17:30.000000000 +0000
++++ mod/nbstubs/pom.xml	2026-03-18 08:31:38.200321916 +0000
+@@ -4,7 +4,7 @@
+     <parent>
+         <artifactId>simplevalidation-parent</artifactId>
+         <groupId>com.mastfrog</groupId>
+-        <version>1.14</version>
++        <version>1.14.1</version>
+     </parent>
+     <modelVersion>4.0.0</modelVersion>
+     <artifactId>nbstubs</artifactId>
+diff -urN orig/nbstubs/src/org/openide/util/lookup/ServiceProvider.java mod/nbstubs/src/org/openide/util/lookup/ServiceProvider.java
+--- orig/nbstubs/src/org/openide/util/lookup/ServiceProvider.java	1970-01-01 00:00:00.000000000 +0000
++++ mod/nbstubs/src/org/openide/util/lookup/ServiceProvider.java	2026-03-18 08:31:38.200321916 +0000
+@@ -0,0 +1,31 @@
++/*
++ * Copyright 2025 Danny Milosavljevic
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ *     http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++package org.openide.util.lookup;
++
++import java.lang.annotation.ElementType;
++import java.lang.annotation.Retention;
++import java.lang.annotation.RetentionPolicy;
++import java.lang.annotation.Target;
++
++@Retention(RetentionPolicy.SOURCE)
++@Target(ElementType.TYPE)
++public @interface ServiceProvider {
++    Class<?> service();
++
++    String path() default "";
++
++    int position() default Integer.MAX_VALUE;
++}
+diff -urN orig/pom.xml mod/pom.xml
+--- orig/pom.xml	2022-07-23 01:17:30.000000000 +0000
++++ mod/pom.xml	2026-03-18 08:31:38.200321916 +0000
+@@ -21,7 +21,7 @@
+     </organization>
+     <packaging>pom</packaging>
+     <name>Simple Validation (parent)</name>
+-    <version>1.14</version>
++    <version>1.14.1</version>
+     <description>
+         Simple Validation Parent Project:
+         This is a simple library for quickly adding validation code to Swing user-interfaces.
+diff -urN orig/simplevalidation-swing/pom.xml mod/simplevalidation-swing/pom.xml
+--- orig/simplevalidation-swing/pom.xml	2022-07-23 01:17:30.000000000 +0000
++++ mod/simplevalidation-swing/pom.xml	2026-03-18 08:41:00.326700212 +0000
+@@ -5,7 +5,7 @@
+     <parent>
+         <groupId>com.mastfrog</groupId>
+         <artifactId>simplevalidation-parent</artifactId>
+-        <version>1.14</version>
++        <version>1.14.1</version>
+     </parent>
+     <artifactId>simplevalidation-swing</artifactId>
+     <scm>
+@@ -49,17 +49,12 @@
+     </build>
+     <dependencies>
+         <dependency>
+-            <groupId>${project.groupId}</groupId>
++            <groupId>com.mastfrog</groupId>
+             <artifactId>simplevalidation</artifactId>
+         </dependency>
+         <dependency>
+-            <groupId>${project.groupId}</groupId>
++            <groupId>com.mastfrog</groupId>
+             <artifactId>nbstubs</artifactId>
+         </dependency>
+-        <dependency>
+-            <groupId>org.netbeans.api</groupId>
+-            <artifactId>org-openide-util-lookup</artifactId>
+-            <scope>provided</scope>
+-        </dependency>
+     </dependencies>
+ </project>

gnu/packages/patches/jbr-25-wayland-drag-icon.patch

@@ -0,0 +1,508 @@
+From 0602a477881f7d4047edd2ffe2b6f5157fda9bc9 Mon Sep 17 00:00:00 2001
+From: Danny Milosavljevic <dannym@nova.friendly-machines.com>
+Date: Tue, 31 Mar 2026 05:11:27 +0000
+Subject: [PATCH 1/2] Wayland: fix drag icon updates during drag-and-drop
+
+Expose the actual cursor image and size to the Wayland peer, provide DnD cursor desktop properties, and use the Wayland drag icon surface as the drag-and-drop status channel. Preserve application-supplied drag images, update cursor-derived fallback icons during action changes, pad drag icon buffers for compositor scale requirements, and reuse the drag icon surface so later status changes reach the compositor.
+---
+ .../share/classes/sun/awt/CustomCursor.java   |  21 ++-
+ .../classes/sun/awt/wl/WLCursorManager.java   |  30 +++++
+ .../unix/classes/sun/awt/wl/WLDataSource.java |  32 +++--
+ .../sun/awt/wl/WLDragSourceContextPeer.java   | 122 ++++++++++++++++--
+ .../unix/classes/sun/awt/wl/WLToolkit.java    |  11 +-
+ .../unix/native/libawt_wlawt/WLCursor.c       |  14 ++
+ .../unix/native/libawt_wlawt/WLDataDevice.c   |  37 +++++-
+ 7 files changed, 243 insertions(+), 24 deletions(-)
+
+diff --git a/src/java.desktop/share/classes/sun/awt/CustomCursor.java b/src/java.desktop/share/classes/sun/awt/CustomCursor.java
+index 2b65c5dbe..aa7e5559d 100644
+--- a/src/java.desktop/share/classes/sun/awt/CustomCursor.java
++++ b/src/java.desktop/share/classes/sun/awt/CustomCursor.java
+@@ -37,6 +37,8 @@
+ public abstract class CustomCursor extends Cursor {
+ 
+     protected Image image;
++    private Image cursorImage;
++    private Point hotSpot;
+ 
+     public CustomCursor(Image cursor, Point hotSpot, String name)
+             throws IndexOutOfBoundsException {
+@@ -80,6 +82,9 @@ public CustomCursor(Image cursor, Point hotSpot, String name)
+             throw new IndexOutOfBoundsException("invalid hotSpot");
+         }
+ 
++        cursorImage = cursor;
++        this.hotSpot = new Point(hotSpot);
++
+         /* Extract ARGB array from image.
+          *
+          * A transparency mask can be created in native code by checking
+@@ -96,10 +101,24 @@ public CustomCursor(Image cursor, Point hotSpot, String name)
+         } catch (InterruptedException e) {
+         }
+ 
+-        createNativeCursor(image, pixels, width, height, hotSpot.x, hotSpot.y);
++        createNativeCursor(cursorImage, pixels, width, height, hotSpot.x, hotSpot.y);
+     }
+ 
+     protected abstract void createNativeCursor(Image im,  int[] pixels,
+                                                int width, int height,
+                                                int xHotSpot, int yHotSpot);
++
++    /**
++     * Returns the image used to create the native cursor.
++     */
++    public Image getImage() {
++        return cursorImage;
++    }
++
++    /**
++     * Returns the hotspot used to create the native cursor.
++     */
++    public Point getHotSpot() {
++        return new Point(hotSpot);
++    }
+ }
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLCursorManager.java b/src/java.desktop/unix/classes/sun/awt/wl/WLCursorManager.java
+index 75927e762..0b1ef8d57 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLCursorManager.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLCursorManager.java
+@@ -29,6 +29,7 @@
+ import sun.awt.AWTAccessor;
+ import sun.util.logging.PlatformLogger;
+ 
++import java.awt.Dimension;
+ import java.awt.Cursor;
+ import java.awt.GraphicsConfiguration;
+ 
+@@ -139,7 +140,36 @@ private long createNativeCursor(int type, int scale) {
+         return 0;
+     }
+ 
++    /**
++     * Returns the width and height in pixels of the given cursor at the
++     * specified display scale. Returns null if the cursor is unavailable.
++     */
++    public static Dimension getCursorSize(Cursor cursor, int scale) {
++        if (cursor == null) {
++            return null;
++        }
++
++        synchronized (instance) {
++            long pData = AWTAccessor.getCursorAccessor().getPData(cursor, scale);
++            if (pData == 0 && cursor.getType() == Cursor.CUSTOM_CURSOR) {
++                pData = AWTAccessor.getCursorAccessor().getPData(cursor);
++            }
++            if (pData <= 0) {
++                return null;
++            }
++
++            int w = nativeGetCursorWidth(pData);
++            int h = nativeGetCursorHeight(pData);
++            if (w <= 0 || h <= 0) {
++                return null;
++            }
++            return new Dimension(w, h);
++        }
++    }
++
+     private static native void nativeSetCursor(long pData, int scale, long pointerEnterSerial);
+     private static native long nativeGetPredefinedCursor(String name, int scale);
+     private static native void nativeDestroyPredefinedCursor(long pData);
++    private static native int nativeGetCursorWidth(long pData);
++    private static native int nativeGetCursorHeight(long pData);
+ }
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLDataSource.java b/src/java.desktop/unix/classes/sun/awt/wl/WLDataSource.java
+index 260aab964..2ecc52619 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLDataSource.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLDataSource.java
+@@ -103,22 +103,38 @@ public void setDnDIcon(Image image, int scale, int offsetX, int offsetY) {
+ 
+         int width = image.getWidth(null);
+         int height = image.getHeight(null);
+-        int[] pixels = new int[width * height];
++        int paddedWidth = width;
++        int paddedHeight = height;
++        Image iconImage = image;
++
++        if (scale > 1) {
++            paddedWidth = ((width + scale - 1) / scale) * scale;
++            paddedHeight = ((height + scale - 1) / scale) * scale;
++            if (paddedWidth != width || paddedHeight != height) {
++                BufferedImage paddedImage = new BufferedImage(paddedWidth, paddedHeight, BufferedImage.TYPE_INT_ARGB);
++                Graphics2D g = paddedImage.createGraphics();
++                g.drawImage(image, 0, 0, null);
++                g.dispose();
++                iconImage = paddedImage;
++            }
++        }
++
++        int[] pixels = new int[paddedWidth * paddedHeight];
+ 
+-        if (image instanceof BufferedImage) {
++        if (iconImage instanceof BufferedImage) {
+             // NOTE: no need to ensure that the BufferedImage is TYPE_INT_ARGB,
+             // getRGB() does pixel format conversion automatically
+-            ((BufferedImage) image).getRGB(0, 0, width, height, pixels, 0, width);
++            ((BufferedImage) iconImage).getRGB(0, 0, paddedWidth, paddedHeight, pixels, 0, paddedWidth);
+         } else {
+-            BufferedImage bufferedImage = new BufferedImage(width, height, BufferedImage.TYPE_INT_ARGB);
++            BufferedImage bufferedImage = new BufferedImage(paddedWidth, paddedHeight, BufferedImage.TYPE_INT_ARGB);
+             Graphics2D g = bufferedImage.createGraphics();
+-            g.drawImage(image, 0, 0, null);
++            g.drawImage(iconImage, 0, 0, null);
+             g.dispose();
+ 
+-            bufferedImage.getRGB(0, 0, width, height, pixels, 0, width);
++            bufferedImage.getRGB(0, 0, paddedWidth, paddedHeight, pixels, 0, paddedWidth);
+         }
+ 
+-        setDnDIconImpl(nativePtr, scale, width, height, offsetX, offsetY, pixels);
++        setDnDIconImpl(nativePtr, scale, paddedWidth, paddedHeight, offsetX, offsetY, pixels);
+     }
+ 
+     public void offerExtraMime(String mime) {
+@@ -152,4 +168,4 @@ protected void handleDnDDropPerformed() {}
+     protected void handleDnDFinished() {}
+ 
+     protected void handleDnDAction(int action) {}
+-}
+\ No newline at end of file
++}
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java b/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
+index afd727d1a..46747ddca 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
+@@ -26,9 +26,13 @@
+ package sun.awt.wl;
+ 
+ import sun.awt.AWTAccessor;
++import sun.awt.CustomCursor;
+ import sun.awt.dnd.SunDragSourceContextPeer;
+ 
+ import java.awt.Cursor;
++import java.awt.Dimension;
++import java.awt.Image;
++import java.awt.Point;
+ import java.awt.datatransfer.DataFlavor;
+ import java.awt.datatransfer.Transferable;
+ import java.awt.dnd.DragGestureEvent;
+@@ -36,6 +40,8 @@
+ 
+ public class WLDragSourceContextPeer extends SunDragSourceContextPeer {
+     private final WLDataDevice dataDevice;
++    private WLDragSource activeDragSource;
++    private boolean activeDragSourceUsesCursorFallback;
+ 
+     private class WLDragSource extends WLDataSource {
+         private int action;
+@@ -47,7 +53,7 @@ private class WLDragSource extends WLDataSource {
+             super(dataDevice, WLDataDevice.DATA_TRANSFER_PROTOCOL_WAYLAND, data);
+         }
+ 
+-        private void sendFinishedEvent() {
++        private synchronized void sendFinishedEvent() {
+             if (didSendFinishedEvent) {
+                 return;
+             }
+@@ -67,7 +73,11 @@ protected synchronized void handleDnDAction(int action) {
+             // except for maybe action(dnd_ask), but since we do not announce support for dnd_ask,
+             // we don't need to worry about it.
+             if (!didSucceed) {
++                int previousAction = this.action;
+                 this.action = action;
++                if (previousAction != action) {
++                    WLDragSourceContextPeer.this.handleSourceActionChanged(previousAction, action);
++                }
+             }
+         }
+ 
+@@ -78,8 +88,8 @@ protected synchronized void handleDnDDropPerformed() {
+ 
+         @Override
+         protected synchronized void handleDnDFinished() {
++            WLDragSourceContextPeer.this.finishDragSource(this);
+             sendFinishedEvent();
+-            destroy();
+         }
+ 
+         @Override
+@@ -88,9 +98,9 @@ protected synchronized void handleTargetAcceptsMime(String mime) {
+         }
+ 
+         @Override
+-        protected void handleCancelled() {
++        protected synchronized void handleCancelled() {
++            WLDragSourceContextPeer.this.finishDragSource(this);
+             sendFinishedEvent();
+-            super.handleCancelled();
+         }
+     }
+ 
+@@ -119,6 +129,35 @@ private WLMainSurface getSurface() {
+         return null;
+     }
+ 
++    private synchronized void activateDragSource(WLDragSource dragSource) {
++        activeDragSource = dragSource;
++    }
++
++    private synchronized void finishDragSource(WLDragSource dragSource) {
++        if (activeDragSource == dragSource) {
++            activeDragSource = null;
++            activeDragSourceUsesCursorFallback = false;
++        }
++        dragSource.destroy();
++    }
++
++    private void handleSourceActionChanged(int previousWaylandAction, int waylandAction) {
++        var inputState = WLToolkit.getInputState();
++        int x = inputState.getPointerX();
++        int y = inputState.getPointerY();
++        int modifiers = inputState.getModifiers();
++        int javaAction = WLDataDevice.waylandActionsToJava(waylandAction);
++        int previousJavaAction = WLDataDevice.waylandActionsToJava(previousWaylandAction);
++
++        if (previousJavaAction == 0 && javaAction != 0) {
++            postDragSourceDragEvent(javaAction, modifiers, x, y, DISPATCH_ENTER);
++        } else if (previousJavaAction != 0 && javaAction == 0) {
++            dragExit(x, y);
++        } else if (previousJavaAction != 0) {
++            postDragSourceDragEvent(javaAction, modifiers, x, y, DISPATCH_CHANGED);
++        }
++    }
++
+     @Override
+     protected void startDrag(Transferable trans, long[] formats, Map<Long, DataFlavor> formatMap) {
+         var mainSurface = getSurface();
+@@ -134,21 +173,88 @@ protected void startDrag(Transferable trans, long[] formats, Map<Long, DataFlavo
+ 
+         source.setDnDActions(waylandActions);
+ 
++        int scale = mainSurface.getGraphicsDevice().getDisplayScale();
+         var dragImage = getDragImage();
++        Point dragImageOffset = null;
++        boolean usesCursorFallback = false;
++        if (dragImage == null) {
++            dragImage = cursorToImage(getDragSourceContext().getCursor());
++            if (dragImage != null) {
++                dragImageOffset = cursorToDragImageOffset(getDragSourceContext().getCursor(), scale);
++                usesCursorFallback = true;
++            }
++        } else {
++            dragImageOffset = getDragImageOffset();
++        }
+         if (dragImage != null) {
+-            var dragImageOffset = getDragImageOffset();
+             source.setDnDIcon(dragImage,
+-                    mainSurface.getGraphicsDevice().getDisplayScale(),
++                    scale,
+                     dragImageOffset.x, dragImageOffset.y);
+         }
+ 
+         long eventSerial = WLToolkit.getInputState().pointerButtonSerial();
+ 
+-        dataDevice.startDrag(source, mainSurface.getWlSurfacePtr(), eventSerial);
++        synchronized (this) {
++            activateDragSource(source);
++            activeDragSourceUsesCursorFallback = usesCursorFallback;
++        }
++        try {
++            dataDevice.startDrag(source, mainSurface.getWlSurfacePtr(), eventSerial);
++        } catch (RuntimeException | Error e) {
++            finishDragSource(source);
++            throw e;
++        }
+     }
+ 
+     @Override
+     protected void setNativeCursor(long nativeCtxt, Cursor c, int cType) {
+-        // TODO: setting cursor here doesn't seem to be required on Wayland?
++        // On Wayland, cursor changes during a drag are expressed by
++        // updating the drag icon surface content.
++        var mainSurface = getSurface();
++        int scale = mainSurface != null ? mainSurface.getGraphicsDevice().getDisplayScale() : 1;
++
++        synchronized (this) {
++            if (activeDragSource == null) {
++                return;
++            }
++            if (!activeDragSourceUsesCursorFallback) {
++                return;
++            }
++
++            Image image = cursorToImage(c);
++            if (image == null) {
++                return;
++            }
++
++            Point dragImageOffset = cursorToDragImageOffset(c, scale);
++            activeDragSource.setDnDIcon(image, scale, dragImageOffset.x, dragImageOffset.y);
++        }
++    }
++
++    private static Image cursorToImage(Cursor cursor) {
++        if (cursor instanceof CustomCursor cc) {
++            return cc.getImage();
++        }
++        return null;
++    }
++
++    private static Point cursorToDragImageOffset(Cursor cursor, int scale) {
++        Dimension cursorSize = WLCursorManager.getCursorSize(cursor, scale);
++        if (cursorSize == null) {
++            Image image = cursorToImage(cursor);
++            if (image != null) {
++                cursorSize = new Dimension(image.getWidth(null), image.getHeight(null));
++            }
++        }
++
++        if (cursorSize == null) {
++            return new Point(0, 0);
++        }
++
++        // This is only for the Wayland fallback path where no application drag
++        // image was supplied and we reuse DnD cursor artwork as the drag icon.
++        // Keep that fallback icon visible by placing it one cursor width/height
++        // away from the pointer hotspot, expressed in surface-local coordinates.
++        return new Point(cursorSize.width / scale, cursorSize.height / scale);
+     }
+ }
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLToolkit.java b/src/java.desktop/unix/classes/sun/awt/wl/WLToolkit.java
+index 058306539..e768cbfd8 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLToolkit.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLToolkit.java
+@@ -983,9 +983,18 @@ public int getNumberOfButtons(){
+         return MOUSE_BUTTONS_COUNT;
+     }
+ 
++    private static final String DND_CURSOR_PREFIX = "DnD.Cursor.";
++
+     @Override
+     protected Object lazilyLoadDesktopProperty(String name) {
+-        if (log.isLoggable(PlatformLogger.Level.FINE)) {
++        if (name.startsWith(DND_CURSOR_PREFIX)) {
++            String cursorName = name.substring(DND_CURSOR_PREFIX.length()) + ".32x32";
++            try {
++                return Cursor.getSystemCustomCursor(cursorName);
++            } catch (AWTException awte) {
++                throw new RuntimeException("cannot load system cursor: " + cursorName, awte);
++            }
++        } else if (log.isLoggable(PlatformLogger.Level.FINE)) {
+             log.fine("Not implemented: WLToolkit.lazilyLoadDesktopProperty()");
+         }
+         return null;
+diff --git a/src/java.desktop/unix/native/libawt_wlawt/WLCursor.c b/src/java.desktop/unix/native/libawt_wlawt/WLCursor.c
+index f56f39d16..6d1a95460 100644
+--- a/src/java.desktop/unix/native/libawt_wlawt/WLCursor.c
++++ b/src/java.desktop/unix/native/libawt_wlawt/WLCursor.c
+@@ -100,6 +100,20 @@ JNIEXPORT void JNICALL Java_sun_awt_wl_WLCursorManager_nativeDestroyPredefinedCu
+     free(cursor);
+ }
+ 
++JNIEXPORT jint JNICALL Java_sun_awt_wl_WLCursorManager_nativeGetCursorWidth
++        (JNIEnv *env, jclass cls, jlong cursorPtr)
++{
++    struct WLCursor *cursor = jlong_to_ptr(cursorPtr);
++    return cursor ? (jint) cursor->width : 0;
++}
++
++JNIEXPORT jint JNICALL Java_sun_awt_wl_WLCursorManager_nativeGetCursorHeight
++        (JNIEnv *env, jclass cls, jlong cursorPtr)
++{
++    struct WLCursor *cursor = jlong_to_ptr(cursorPtr);
++    return cursor ? (jint) cursor->height : 0;
++}
++
+ JNIEXPORT jlong JNICALL Java_sun_awt_wl_WLCustomCursor_nativeCreateCustomCursor
+   (JNIEnv *env, jclass cls, jintArray pixels, jint width, jint height, jint xHotSpot, jint yHotSpot)
+ {
+diff --git a/src/java.desktop/unix/native/libawt_wlawt/WLDataDevice.c b/src/java.desktop/unix/native/libawt_wlawt/WLDataDevice.c
+index 5d0095dae..7e6311529 100644
+--- a/src/java.desktop/unix/native/libawt_wlawt/WLDataDevice.c
++++ b/src/java.desktop/unix/native/libawt_wlawt/WLDataDevice.c
+@@ -86,6 +86,8 @@ struct DataSource
+ 
+     struct wl_surface* dragIcon;
+     struct wl_buffer* dragIconBuffer;
++    int dragIconOffsetX;
++    int dragIconOffsetY;
+ 
+     struct DataSource* nextDel;
+ };
+@@ -673,7 +675,10 @@ zwp_primary_selection_source_handle_cancelled(void *user,
+ static void
+ wl_data_offer_handle_offer(void *user, struct wl_data_offer *wl_data_offer, const char *mime)
+ {
+-    DataOffer_callOfferHandler((struct DataOffer *) user, mime);
++    struct DataOffer *offer = user;
++    assert(offer != NULL);
++
++    DataOffer_callOfferHandler(offer, mime);
+ }
+ 
+ static void
+@@ -1149,6 +1154,14 @@ JNIEXPORT void JNICALL Java_sun_awt_wl_WLDataSource_setDnDIconImpl
+    jint width, jint height, jint offsetX, jint offsetY, jintArray pixels)
+ {
+     struct DataSource *source = jlong_to_ptr(nativePtr);
++    bool updating_existing_icon = source->dragIcon != NULL;
++    struct wl_buffer *oldBuffer = source->dragIconBuffer;
++    // Drag-icon updates reuse the same wl_surface after start_drag().
++    // For that surface, wl_surface.offset (or pre-v5 nonzero attach offsets)
++    // is relative to the current buffer position, not an absolute placement.
++    // Keep the last requested absolute offset and send only the delta here.
++    int deltaOffsetX = offsetX - source->dragIconOffsetX;
++    int deltaOffsetY = offsetY - source->dragIconOffsetY;
+ 
+     size_t pixelCount = (size_t)((*env)->GetArrayLength(env, pixels));
+     size_t byteSize = pixelCount * 4U;
+@@ -1180,7 +1193,9 @@ JNIEXPORT void JNICALL Java_sun_awt_wl_WLDataSource_setDnDIconImpl
+         return;
+     }
+ 
+-    source->dragIcon = wl_compositor_create_surface(wl_compositor);
++    if (!source->dragIcon) {
++        source->dragIcon = wl_compositor_create_surface(wl_compositor);
++    }
+     if (!source->dragIcon) {
+         wl_buffer_destroy(source->dragIconBuffer);
+         source->dragIconBuffer = NULL;
+@@ -1191,12 +1206,12 @@ JNIEXPORT void JNICALL Java_sun_awt_wl_WLDataSource_setDnDIconImpl
+     int wl_compositor_version = wl_compositor_get_version(wl_compositor);
+     if (wl_compositor_version >= 5) {
+         wl_surface_attach(source->dragIcon, source->dragIconBuffer, 0, 0);
+-        wl_surface_offset(source->dragIcon, offsetX, offsetY);
++        wl_surface_offset(source->dragIcon, deltaOffsetX, deltaOffsetY);
+     } else {
+-        wl_surface_attach(source->dragIcon, source->dragIconBuffer, offsetX, offsetY);
++        wl_surface_attach(source->dragIcon, source->dragIconBuffer, deltaOffsetX, deltaOffsetY);
+     }
+ #else
+-    wl_surface_attach(source->dragIcon, source->dragIconBuffer, offsetX, offsetY);
++    wl_surface_attach(source->dragIcon, source->dragIconBuffer, deltaOffsetX, deltaOffsetY);
+ #endif
+ 
+     if (scale >= 1) {
+@@ -1205,7 +1220,17 @@ JNIEXPORT void JNICALL Java_sun_awt_wl_WLDataSource_setDnDIconImpl
+ 
+     wl_surface_damage_buffer(source->dragIcon, 0, 0, width, height);
+ 
+-    // NOTE: we still need to commit the surface, this is done immediately after start_drag
++    if (oldBuffer) {
++        wl_buffer_destroy(oldBuffer);
++    }
++
++    source->dragIconOffsetX = offsetX;
++    source->dragIconOffsetY = offsetY;
++
++    if (updating_existing_icon) {
++        wl_surface_commit(source->dragIcon);
++        wlFlushToServer(env);
++    }
+ }
+ 
+ JNIEXPORT void JNICALL
+-- 
+2.52.0
+

gnu/packages/patches/jbr-25-wayland-intra-jvm-dnd.patch

@@ -0,0 +1,144 @@
+From 6f12ff22c3a902db64ef2bc4f94cb2ad4b26f4ce Mon Sep 17 00:00:00 2001
+From: Danny Milosavljevic <dannym@nova.friendly-machines.com>
+Date: Tue, 31 Mar 2026 05:24:04 +0000
+Subject: [PATCH 2/2] Wayland: enable intra-JVM drag-and-drop transfers
+
+Advertise JAVA_DATAFLAVOR natives for local drags, register the current JVM-local Transferable before starting the drag, and let the drop target fall back to the source actions when Wayland MIME negotiation stays at zero for a local Java-object transfer.
+---
+ .../sun/awt/wl/WLDragSourceContextPeer.java   | 42 +++++++++++++++++--
+ .../sun/awt/wl/WLDropTargetContextPeer.java   | 11 ++++-
+ 2 files changed, 48 insertions(+), 5 deletions(-)
+
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java b/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
+index 46747ddca..3490b9f2b 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLDragSourceContextPeer.java
+@@ -28,6 +28,7 @@
+ import sun.awt.AWTAccessor;
+ import sun.awt.CustomCursor;
+ import sun.awt.dnd.SunDragSourceContextPeer;
++import sun.awt.dnd.SunDropTargetContextPeer;
+ 
+ import java.awt.Cursor;
+ import java.awt.Dimension;
+@@ -35,7 +36,9 @@
+ import java.awt.Point;
+ import java.awt.datatransfer.DataFlavor;
+ import java.awt.datatransfer.Transferable;
++import java.awt.dnd.DnDConstants;
+ import java.awt.dnd.DragGestureEvent;
++import java.util.HashSet;
+ import java.util.Map;
+ 
+ public class WLDragSourceContextPeer extends SunDragSourceContextPeer {
+@@ -59,7 +62,9 @@ private synchronized void sendFinishedEvent() {
+             }
+             didSendFinishedEvent = true;
+ 
+-            final int javaAction = didSucceed ? WLDataDevice.waylandActionsToJava(action) : 0;
++            final int javaAction = didSucceed
++                    ? WLDataDevice.waylandActionsToJava(action)
++                    : DnDConstants.ACTION_NONE;
+             final int x = WLToolkit.getInputState().getPointerX();
+             final int y = WLToolkit.getInputState().getPointerY();
+             WLDragSourceContextPeer.this.dragDropFinished(didSucceed, javaAction, x, y);
+@@ -149,15 +154,41 @@ private void handleSourceActionChanged(int previousWaylandAction, int waylandAct
+         int javaAction = WLDataDevice.waylandActionsToJava(waylandAction);
+         int previousJavaAction = WLDataDevice.waylandActionsToJava(previousWaylandAction);
+ 
+-        if (previousJavaAction == 0 && javaAction != 0) {
++        if (previousJavaAction == DnDConstants.ACTION_NONE
++                && javaAction != DnDConstants.ACTION_NONE) {
+             postDragSourceDragEvent(javaAction, modifiers, x, y, DISPATCH_ENTER);
+-        } else if (previousJavaAction != 0 && javaAction == 0) {
++        } else if (previousJavaAction != DnDConstants.ACTION_NONE
++                && javaAction == DnDConstants.ACTION_NONE) {
+             dragExit(x, y);
+-        } else if (previousJavaAction != 0) {
++        } else if (previousJavaAction != DnDConstants.ACTION_NONE) {
+             postDragSourceDragEvent(javaAction, modifiers, x, y, DISPATCH_CHANGED);
+         }
+     }
+ 
++    private void offerJavaFlavorMimes(WLDragSource source, Transferable trans) {
++        var transferer = (WLDataTransferer) WLDataTransferer.getInstance();
++        var flavorTable = transferer.getFlavorTable();
++        var extraMimes = new HashSet<String>();
++        var flavors = trans.getTransferDataFlavors();
++
++        if (flavors == null) {
++            return;
++        }
++
++        for (DataFlavor flavor : flavors) {
++            if (flavor == null) {
++                continue;
++            }
++            for (String nativeName : flavorTable.getNativesForFlavor(flavor)) {
++                if (nativeName != null
++                        && nativeName.startsWith("JAVA_DATAFLAVOR:")
++                        && extraMimes.add(nativeName)) {
++                    source.offerExtraMime(nativeName);
++                }
++            }
++        }
++    }
++
+     @Override
+     protected void startDrag(Transferable trans, long[] formats, Map<Long, DataFlavor> formatMap) {
+         var mainSurface = getSurface();
+@@ -167,6 +198,7 @@ protected void startDrag(Transferable trans, long[] formats, Map<Long, DataFlavo
+ 
+         // formats and formatMap are unused, because WLDataSource already references the same DataTransferer singleton
+         var source = new WLDragSource(trans);
++        offerJavaFlavorMimes(source, trans);
+ 
+         var actions = getDragSourceContext().getSourceActions();
+         int waylandActions = WLDataDevice.javaActionsToWayland(actions);
+@@ -199,9 +231,11 @@ protected void startDrag(Transferable trans, long[] formats, Map<Long, DataFlavo
+             activeDragSourceUsesCursorFallback = usesCursorFallback;
+         }
+         try {
++            SunDropTargetContextPeer.setCurrentJVMLocalSourceTransferable(trans);
+             dataDevice.startDrag(source, mainSurface.getWlSurfacePtr(), eventSerial);
+         } catch (RuntimeException | Error e) {
+             finishDragSource(source);
++            SunDropTargetContextPeer.setCurrentJVMLocalSourceTransferable(null);
+             throw e;
+         }
+     }
+diff --git a/src/java.desktop/unix/classes/sun/awt/wl/WLDropTargetContextPeer.java b/src/java.desktop/unix/classes/sun/awt/wl/WLDropTargetContextPeer.java
+index 76e47a133..757e20652 100644
+--- a/src/java.desktop/unix/classes/sun/awt/wl/WLDropTargetContextPeer.java
++++ b/src/java.desktop/unix/classes/sun/awt/wl/WLDropTargetContextPeer.java
+@@ -31,6 +31,7 @@
+ import sun.awt.dnd.SunDropTargetEvent;
+ 
+ import java.awt.Component;
++import java.awt.dnd.DnDConstants;
+ import java.awt.event.MouseEvent;
+ import java.io.IOException;
+ 
+@@ -67,10 +68,18 @@ private synchronized void postEvent(int event) {
+         var x = peer.surfaceUnitsToJavaUnits((int) currentX);
+         var y = peer.surfaceUnitsToJavaUnits((int) currentY);
+         var actions = WLDataDevice.waylandActionsToJava(currentOffer.getSourceActions());
+-        int dropAction = 0;
++        int dropAction = DnDConstants.ACTION_NONE;
+ 
+         if (hasTarget() && event != MouseEvent.MOUSE_EXITED) {
++            // For intra-JVM transfers, the Wayland-level action negotiation
++            // may fail (no matching MIME types for Java object flavors).
++            // Fall back to the source actions directly.
+             dropAction = WLDataDevice.waylandActionsToJava(currentOffer.getSelectedAction());
++            if (dropAction == DnDConstants.ACTION_NONE
++                    && currentJVMLocalSourceTransferable != null) {
++                dropAction = SunDragSourceContextPeer.convertModifiersToDropAction(
++                        WLToolkit.getInputState().getModifiers(), actions);
++            }
+         }
+ 
+         postDropTargetEvent(
+-- 
+2.52.0
+

gnu/packages/patches/librewolf-150.0-encoding_rs-rust-fix.patch

@@ -1,260 +0,0 @@
-From d8702527f4f1f67f765330f5018bfcb182946c45 Mon Sep 17 00:00:00 2001
-From: Henri Sivonen <hsivonen@hsivonen.fi>
-Date: Tue, 21 Apr 2026 07:09:20 +0000
-Subject: [PATCH] Bug 2033279 - Make --enable-rust-simd work with Rust 1.95.
- r=firefox-build-system-reviewers,supply-chain-reviewers,ahochheiden
-
-Differential Revision: https://phabricator.services.mozilla.com/D295287
----
- .cargo/config.toml.in                         |  5 ++
- Cargo.lock                                    |  4 +-
- Cargo.toml                                    |  2 +
- supply-chain/audits.toml                      |  6 ++
- supply-chain/config.toml                      |  4 ++
- .../rust/encoding_rs/.cargo-checksum.json     |  2 +-
- .../rust/encoding_rs/.cargo_vcs_info.json     |  6 --
- third_party/rust/encoding_rs/Cargo.toml       | 60 ++++++++++---------
- third_party/rust/encoding_rs/Cargo.toml.orig  | 45 --------------
- .../rust/encoding_rs/src/x_user_defined.rs    |  2 +
- 10 files changed, 54 insertions(+), 82 deletions(-)
- delete mode 100644 third_party/rust/encoding_rs/.cargo_vcs_info.json
- delete mode 100644 third_party/rust/encoding_rs/Cargo.toml.orig
-
-diff --git a/.cargo/config.toml.in b/.cargo/config.toml.in
-index 8013ae5435dab..cabdee463415f 100644
---- a/.cargo/config.toml.in
-+++ b/.cargo/config.toml.in
-@@ -55,6 +55,11 @@ git = "https://github.com/hsivonen/any_all_workaround"
- rev = "7fb1b7034c9f172aade21ee1c8554e8d8a48af80"
- replace-with = "vendored-sources"
- 
-+[source."git+https://github.com/hsivonen/encoding_rs?rev=1236d1bc423e6ba35a06485f74a6304db2d703b5"]
-+git = "https://github.com/hsivonen/encoding_rs"
-+rev = "1236d1bc423e6ba35a06485f74a6304db2d703b5"
-+replace-with = "vendored-sources"
-+
- [source."git+https://github.com/hsivonen/rust-harfbuzz?rev=9d58a23a98772a197291d04af93f7041b7093d95"]
- git = "https://github.com/hsivonen/rust-harfbuzz"
- rev = "9d58a23a98772a197291d04af93f7041b7093d95"
-diff --git a/Cargo.lock b/Cargo.lock
-index fea2f95fbb438..63b1f818d7971 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -1914,11 +1914,11 @@ dependencies = [
- [[package]]
- name = "encoding_rs"
- version = "0.8.35"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
-+source = "git+https://github.com/hsivonen/encoding_rs?rev=1236d1bc423e6ba35a06485f74a6304db2d703b5#1236d1bc423e6ba35a06485f74a6304db2d703b5"
- dependencies = [
-  "any_all_workaround",
-  "cfg-if",
-+ "rustversion",
- ]
- 
- [[package]]
-diff --git a/Cargo.toml b/Cargo.toml
-index 49c695809f302..2648c32ae57e8 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -287,6 +287,8 @@ harfbuzz-sys = { git = "https://github.com/hsivonen/rust-harfbuzz", rev = "9d58a
- harfbuzz = { git = "https://github.com/hsivonen/rust-harfbuzz", rev = "9d58a23a98772a197291d04af93f7041b7093d95" }
- # Also vendor `harfbuzz-traits` to keep cargo-vendor happy.
- harfbuzz-traits = { git = "https://github.com/hsivonen/rust-harfbuzz", rev = "9d58a23a98772a197291d04af93f7041b7093d95" }
-+# Make --enable-rust-simd compatible with Rust 1.95
-+encoding_rs = { git = "https://github.com/hsivonen/encoding_rs", rev = "1236d1bc423e6ba35a06485f74a6304db2d703b5" }
- 
- # objc 0.2.7 + fa7ca43b862861dd1cd000d7ad01e6e0266cda13
- objc = { git = "https://github.com/glandium/rust-objc", rev = "4de89f5aa9851ceca4d40e7ac1e2759410c04324" }
-diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
-index 85b4037e03bdb..f4567ea6b6f94 100644
---- a/supply-chain/audits.toml
-+++ b/supply-chain/audits.toml
-@@ -2385,6 +2385,12 @@ who = "Mike Hommey <mh+mozilla@glandium.org>"
- criteria = "safe-to-deploy"
- delta = "0.8.31 -> 0.8.32"
- 
-+[[audits.encoding_rs]]
-+who = "Henri Sivonen <hsivonen@hsivonen.fi>"
-+criteria = "safe-to-deploy"
-+delta = "0.8.35 -> 0.8.35@git:1236d1bc423e6ba35a06485f74a6304db2d703b5"
-+importable = false
-+
- [[audits.enum-map]]
- who = "Kershaw Chang <kershaw@mozilla.com>"
- criteria = "safe-to-deploy"
-diff --git a/supply-chain/config.toml b/supply-chain/config.toml
-index 4cfd83dc2d608..15deefbec0574 100644
---- a/supply-chain/config.toml
-+++ b/supply-chain/config.toml
-@@ -39,6 +39,10 @@ notes = "This is the upstream code not yet released"
- audit-as-crates-io = true
- notes = "This is upstream plus a warning fix from bug 1823866."
- 
-+[policy.encoding_rs]
-+audit-as-crates-io = true
-+notes = "This is upstream plus a build fix for bug 2033279."
-+
- [policy.firefox-on-glean]
- audit-as-crates-io = false
- notes = "The crates.io version of this is just a placeholder to allow public crates to depend on firefox-on-glean."
-diff --git a/third_party/rust/encoding_rs/.cargo_vcs_info.json b/third_party/rust/encoding_rs/.cargo_vcs_info.json
-deleted file mode 100644
-index 6e5d699759e43..0000000000000
---- a/third_party/rust/encoding_rs/.cargo_vcs_info.json
-+++ /dev/null
-@@ -1,6 +0,0 @@
--{
--  "git": {
--    "sha1": "2fa58aecf537cc76ff52c0eb3d5e9f8fda466844"
--  },
--  "path_in_vcs": ""
--}
-\ No newline at end of file
-diff --git a/third_party/rust/encoding_rs/Cargo.toml b/third_party/rust/encoding_rs/Cargo.toml
-index 2adac351c2edf..0239315bab180 100644
---- a/third_party/rust/encoding_rs/Cargo.toml
-+++ b/third_party/rust/encoding_rs/Cargo.toml
-@@ -16,6 +16,7 @@ name = "encoding_rs"
- version = "0.8.35"
- authors = ["Henri Sivonen <hsivonen@hsivonen.fi>"]
- build = false
-+autolib = false
- autobins = false
- autoexamples = false
- autotests = false
-@@ -39,33 +40,6 @@ categories = [
- license = "(Apache-2.0 OR MIT) AND BSD-3-Clause"
- repository = "https://github.com/hsivonen/encoding_rs"
- 
--[profile.release]
--lto = true
--
--[lib]
--name = "encoding_rs"
--path = "src/lib.rs"
--
--[dependencies.any_all_workaround]
--version = "0.1.0"
--optional = true
--
--[dependencies.cfg-if]
--version = "1.0"
--
--[dependencies.serde]
--version = "1.0"
--optional = true
--
--[dev-dependencies.bincode]
--version = "1.0"
--
--[dev-dependencies.serde_derive]
--version = "1.0"
--
--[dev-dependencies.serde_json]
--version = "1.0"
--
- [features]
- alloc = []
- default = ["alloc"]
-@@ -84,4 +58,34 @@ fast-legacy-encode = [
- less-slow-big5-hanzi-encode = []
- less-slow-gb-hanzi-encode = []
- less-slow-kanji-encode = []
--simd-accel = ["any_all_workaround"]
-+simd-accel = [
-+    "any_all_workaround",
-+    "rustversion",
-+]
-+
-+[lib]
-+name = "encoding_rs"
-+path = "src/lib.rs"
-+
-+[dependencies]
-+cfg-if = "1.0"
-+
-+[dependencies.any_all_workaround]
-+version = "0.1.0"
-+optional = true
-+
-+[dependencies.rustversion]
-+version = "1.0.19"
-+optional = true
-+
-+[dependencies.serde]
-+version = "1.0"
-+optional = true
-+
-+[dev-dependencies]
-+bincode = "1.0"
-+serde_derive = "1.0"
-+serde_json = "1.0"
-+
-+[profile.release]
-+lto = true
-diff --git a/third_party/rust/encoding_rs/Cargo.toml.orig b/third_party/rust/encoding_rs/Cargo.toml.orig
-deleted file mode 100644
-index 0f7639d5f879b..0000000000000
---- a/third_party/rust/encoding_rs/Cargo.toml.orig
-+++ /dev/null
-@@ -1,45 +0,0 @@
--[package]
--name = "encoding_rs"
--description = "A Gecko-oriented implementation of the Encoding Standard"
--version = "0.8.35"
--edition = '2018'
--authors = ["Henri Sivonen <hsivonen@hsivonen.fi>"]
--license = "(Apache-2.0 OR MIT) AND BSD-3-Clause"
--readme = "README.md"
--documentation = "https://docs.rs/encoding_rs/"
--homepage = "https://docs.rs/encoding_rs/"
--repository = "https://github.com/hsivonen/encoding_rs"
--keywords = ["encoding", "web", "unicode", "charset"]
--categories = ["text-processing", "encoding", "web-programming", "internationalization"]
--rust-version = "1.36"
--
--[features]
--default = ["alloc"]
--alloc = []
--simd-accel = ["any_all_workaround"]
--less-slow-kanji-encode = []
--less-slow-big5-hanzi-encode = []
--less-slow-gb-hanzi-encode = []
--fast-hangul-encode = []
--fast-hanja-encode = []
--fast-kanji-encode = []
--fast-gb-hanzi-encode = []
--fast-big5-hanzi-encode = []
--fast-legacy-encode = ["fast-hangul-encode",
--                      "fast-hanja-encode",
--                      "fast-kanji-encode",
--                      "fast-gb-hanzi-encode",
--                      "fast-big5-hanzi-encode"]
--
--[dependencies]
--cfg-if = "1.0"
--serde = { version = "1.0", optional = true }
--any_all_workaround = { version = "0.1.0" , optional = true }
--
--[dev-dependencies]
--serde_derive = "1.0"
--bincode = "1.0"
--serde_json = "1.0"
--
--[profile.release]
--lto = true
-diff --git a/third_party/rust/encoding_rs/src/x_user_defined.rs b/third_party/rust/encoding_rs/src/x_user_defined.rs
-index 7af7d5e3d69da..16f1a18d7f6ce 100644
---- a/third_party/rust/encoding_rs/src/x_user_defined.rs
-+++ b/third_party/rust/encoding_rs/src/x_user_defined.rs
-@@ -16,7 +16,8 @@ cfg_if! {
-         use simd_funcs::*;
-         use core::simd::u16x8;
-         use core::simd::cmp::SimdPartialOrd;
-+        #[rustversion::since(1.95)]
-         use core::simd::Select;
- 
-         #[inline(always)]
-         fn shift_upper(unpacked: u16x8) -> u16x8 {

gnu/packages/patches/netbeans-25-nativeexecution-paths.patch

@@ -0,0 +1,73 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Make nativeexecution helper work with Guix
+
+diff -urN orig/ide/dlight.nativeexecution/release/bin/nativeexecution/dorun.sh mod/ide/dlight.nativeexecution/release/bin/nativeexecution/dorun.sh
+--- orig/ide/dlight.nativeexecution/release/bin/nativeexecution/dorun.sh	2026-03-19 00:00:00.000000000 +0000
++++ mod/ide/dlight.nativeexecution/release/bin/nativeexecution/dorun.sh	2026-03-19 00:00:00.000000000 +0000
+@@ -16,8 +16,8 @@
+ # specific language governing permissions and limitations
+ # under the License.
+ 
+-PATH=/bin:/usr/bin
+-PROG=`basename "$0"`
++PATH="${PATH:+$PATH:}/bin:/usr/bin"
++PROG="${0##*/}"
+ USAGE="usage: ${PROG} [-p prompt] -x execScript"
+ PROMPT=NO
+ STATUS=-1
+@@ -43,7 +43,7 @@
+   esac
+ done
+ 
+-shift `expr $OPTIND - 1`
++shift "$((OPTIND - 1))"
+ 
+ trap "doExit" 1 2 15 EXIT
+ 
+diff -urN orig/ide/dlight.nativeexecution/release/bin/nativeexecution/hostinfo.sh mod/ide/dlight.nativeexecution/release/bin/nativeexecution/hostinfo.sh
+--- orig/ide/dlight.nativeexecution/release/bin/nativeexecution/hostinfo.sh	2026-03-19 00:00:00.000000000 +0000
++++ mod/ide/dlight.nativeexecution/release/bin/nativeexecution/hostinfo.sh	2026-03-19 00:00:00.000000000 +0000
+@@ -16,13 +16,13 @@
+ # specific language governing permissions and limitations
+ # under the License.
+ 
+-PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
++PATH="${PATH:+$PATH:}/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin"
+ HOSTNAME=`uname -n`
+ OS=`uname -s`
+ CPUTYPE=`uname -p`
+ BITNESS=32
+ 
+-LS=/bin/ls
++LS=ls
+ OSFAMILY=
+ DATETIME=`date -u +'%Y-%m-%d %H:%M:%S'`
+ 
+@@ -139,7 +139,7 @@
+         echo "Warning: TMPDIRBASE is not writable: ${TMPDIRBASE}">&2
+         SUFFIX=`expr 1 + ${SUFFIX}`
+         TMPDIRBASE=${TMPBASE}/dlight_${USER_D}_${SUFFIX}
+-        /bin/mkdir -p ${TMPDIRBASE} 2>/dev/null
++        mkdir -p ${TMPDIRBASE} 2>/dev/null
+     else
+         break
+     fi
+@@ -157,7 +157,7 @@
+             echo "Warning: TMPDIRBASE is not writable: ${TMPDIRBASE}">&2
+             SUFFIX=`expr 1 + ${SUFFIX}`
+             TMPDIRBASE=${TMPBASE}/${NB_KEY}_${SUFFIX}
+-            /bin/mkdir -p ${TMPDIRBASE} 2>/dev/null
++            mkdir -p ${TMPDIRBASE} 2>/dev/null
+         else
+             break
+         fi
+@@ -174,7 +174,7 @@
+ 
+ ENVFILE="${TMPDIRBASE}/env"
+ 
+-ID=`LC_MESSAGES=C /usr/bin/id`
++ID=`LC_MESSAGES=C id`
+ 
+ echo BITNESS=${BITNESS}
+ echo CPUFAMILY=${CPUFAMILY}

gnu/packages/patches/netbeans-25-source-only-build.patch

@@ -0,0 +1,95 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Disable build-time (test-time) downloaders.
+
+diff -urN orig/harness/apisupport.harness/build.xml mod/harness/apisupport.harness/build.xml
+--- orig/harness/apisupport.harness/build.xml	2026-03-17 23:30:32.335913224 +0000
++++ mod/harness/apisupport.harness/build.xml	2026-03-17 23:30:51.503442261 +0000
+@@ -33,19 +33,6 @@
+             <zipfileset file="taskdefs.properties" fullpath="org/netbeans/nbbuild/taskdefs.properties"/>
+         </nb-ext-jar>
+         
+-        <!-- verify that the DownloadBinaries task is properly functional -->
+-        <taskdef name="TestDownload" classname="org.netbeans.nbbuild.extlibs.DownloadBinaries">
+-            <classpath>
+-                <pathelement location="${cluster}/tasks.jar"></pathelement>
+-            </classpath>
+-        </taskdef>
+-        <echo file="build/binaries-list">F0ED132A49244B042CD0E15702AB9F2CE3CC8436 org.ow2.asm:asm:9.7.1</echo>
+-        <TestDownload>
+-            <manifest dir="build">
+-                <include name="binaries-list"/>
+-            </manifest>
+-        </TestDownload>
+-        <delete file="build/asm-9.7.1.jar"/>
+     </target>
+ 
+     <target name="compile-jnlp-launcher" depends="init,compile">
+diff -urN orig/nbbuild/antsrc/org/netbeans/nbbuild/ModuleListParser.java mod/nbbuild/antsrc/org/netbeans/nbbuild/ModuleListParser.java
+--- orig/nbbuild/antsrc/org/netbeans/nbbuild/ModuleListParser.java	2026-03-18 07:25:25.497125691 +0000
++++ mod/nbbuild/antsrc/org/netbeans/nbbuild/ModuleListParser.java	2026-03-18 07:25:35.587014287 +0000
+@@ -467,6 +467,9 @@
+                 if (testtype == null) {
+                     throw new IOException("Must declare <name>unit</name> (e.g.) in <test-type> in " + projectxml);
+                 }
++                if (Boolean.parseBoolean((String) properties.get("disable." + testtype + ".tests"))) {
++                    continue;
++                }
+                 List<String> compileDepsList = new ArrayList<>();
+                 for (Element dep : XMLUtil.findSubElements(depssEl)) {
+                     if (dep.getTagName().equals("test-dependency")) {
+diff -urN orig/nbbuild/antsrc/org/netbeans/nbbuild/ParseProjectXml.java mod/nbbuild/antsrc/org/netbeans/nbbuild/ParseProjectXml.java
+--- orig/nbbuild/antsrc/org/netbeans/nbbuild/ParseProjectXml.java	2026-03-17 23:30:32.338404995 +0000
++++ mod/nbbuild/antsrc/org/netbeans/nbbuild/ParseProjectXml.java	2026-03-18 07:16:44.662227912 +0000
+@@ -1574,6 +1574,9 @@
+                 } else if (testType.equals(TestDeps.QA_FUNCTIONAL)) {
+                     existsQaFunctionalTests = true;
+                 }
++                if (Boolean.parseBoolean(getProject().getProperty("disable." + testType + ".tests"))) {
++                    continue;
++                }
+                 TestDeps testDeps = new TestDeps(testType,testCnb,modules);
+                 testDepsList.add(testDeps);
+                 for (Element el : XMLUtil.findSubElements(depssEl)) {
+@@ -1619,6 +1622,9 @@
+             if (testDeps.fullySpecified) {
+                 continue;
+             }
++            if (Boolean.parseBoolean(getProject().getProperty("disable." + testDeps.testtype + ".tests"))) {
++                continue;
++            }
+             if (new File(moduleProject, "test/" + testDeps.testtype + "/src").isDirectory()) {
+                 log("Warning: " + testCnb + " lacks a " + testDeps.testtype +
+                         " test dependency on org.netbeans.libs.junit4; using default dependencies for compatibility", Project.MSG_WARN);
+diff -urN orig/nbbuild/build.xml mod/nbbuild/build.xml
+--- orig/nbbuild/build.xml	2026-03-17 23:30:32.340737929 +0000
++++ mod/nbbuild/build.xml	2026-03-17 23:30:51.503442261 +0000
+@@ -101,6 +101,8 @@
+     </path>
+     <javac srcdir="antsrc" destdir="${build.ant.classes.dir}" deprecation="true" debug="${build.compiler.debug}" source="1.8" target="1.8">
+       <classpath refid="bootstrap-cp"/>
++      <exclude name="org/netbeans/nbbuild/CheckHelpSets.java"/>
++      <exclude name="org/netbeans/nbbuild/CheckHelpSetsBin.java"/>
+       <compilerarg line="-Xlint -Xlint:-serial"/>
+     </javac>
+     <jar jarfile="${nbantext.jar}">
+@@ -461,18 +463,7 @@
+     </fixcrlf>
+   </target>
+   
+-  <target name="-download-nb-windows-launchers" depends="init,-check-nb-cluster" if="has.nb.cluster">
+-    <downloadbinaries cache="${binaries.cache}" server="${binaries.server}" repos="${binaries.repos}">
+-        <manifest dir="${nb_all}" includes="nb/ide.launcher/external/binaries-list"/>
+-    </downloadbinaries>
+-
+-    <mkdir dir="${netbeans.dest.dir}/bin" />
+-    <unzip src="../nb/ide.launcher/external/launcher-external-binaries-2-6c17cc6.zip" dest="${netbeans.dest.dir}/bin">
+-        <patternset>
+-            <include name="netbeans*.exe"/>
+-        </patternset>
+-    </unzip>
+-  </target>
++  <target name="-download-nb-windows-launchers" depends="init,-check-nb-cluster" if="has.nb.cluster"/>
+ 
+   <target name="finish-build-nb" depends="init,-check-nb-cluster,-download-nb-windows-launchers,-load-module-flags" if="has.nb.cluster">
+     <loadproperties srcFile="${clusters.list.file}" />

gnu/packages/patches/netbeans-25-terminal-no-login-shell.patch

@@ -0,0 +1,17 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Remove forced login shell
+
+diff -urN orig/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java mod/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java
+--- orig/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java	2026-03-19 00:00:00.000000000 +0000
++++ mod/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java	2026-03-19 00:00:00.000000000 +0000
+@@ -320,9 +320,6 @@
+                         }
+ //                            npb.setWorkingDirectory("${HOME}");
+                         npb.setExecutable(shell);
+-                        if (shell.endsWith("bash") || shell.endsWith("bash.exe")) { // NOI18N
+-                            npb.setArguments("--login"); // NOI18N
+-                        }
+                         
+                         NativeExecutionDescriptor descr;
+                         descr = new NativeExecutionDescriptor().controllable(true).frontWindow(true).inputVisible(true).inputOutput(ioRef.get());

gnu/packages/patches/netbeans-25-wayland-font-rendering.patch

@@ -0,0 +1,94 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-31
+Subject: Add font hints (for Wayland).
+
+--- a/platform/o.n.swing.plaf/src/org/netbeans/swing/plaf/Startup.java	2026-03-20 03:13:28.788555561 +0000
++++ b/platform/o.n.swing.plaf/src/org/netbeans/swing/plaf/Startup.java	2026-03-20 03:15:03.827463921 +0000
+@@ -19,6 +19,7 @@
+ 
+ package org.netbeans.swing.plaf;
+ 
++import java.awt.RenderingHints;
+ import java.awt.Toolkit;
+ import java.util.logging.Logger;
+ import org.netbeans.swing.plaf.aqua.AquaLFCustoms;
+@@ -228,6 +229,20 @@
+         installPerLFDefaults();
+         installTheme(UIManager.getLookAndFeel());
+ 
++        // WLToolkit (JBR's native Wayland backend) does not provide font
++        // rendering hints via awt.font.desktophints, so Swing components
++        // render text without antialiasing.  Set LCD subpixel hints in
++        // UIManager so JComponent.setUI() picks them up.
++        if (System.getenv("WAYLAND_DISPLAY") != null
++                && Toolkit.getDefaultToolkit().getDesktopProperty(
++                       "awt.font.desktophints") == null) {
++            UIManager.getDefaults().put(
++                RenderingHints.KEY_TEXT_ANTIALIASING,
++                RenderingHints.VALUE_TEXT_ANTIALIAS_LCD_HBGR);
++            UIManager.getDefaults().put(
++                RenderingHints.KEY_TEXT_LCD_CONTRAST, 140);
++        }
++
+         runPostInstall();
+ 
+         attachListener();
+
+--- a/platform/openide.awt/src/org/openide/awt/GraphicsUtils.java	2026-03-20 03:13:28.792998877 +0000
++++ b/platform/openide.awt/src/org/openide/awt/GraphicsUtils.java	2026-03-20 03:16:15.622974599 +0000
+@@ -37,7 +37,8 @@
+         Boolean.getBoolean("nb.cellrenderer.antialiasing") // NOI18N
+          ||Boolean.getBoolean("swing.aatext") // NOI18N
+          ||(isGTK() && gtkShouldAntialias()) // NOI18N
+-         || isAqua();
++         || isAqua()
++         || isWayland();
+     private static Boolean gtkAA;
+     private static Map<Object,Object> hintsMap;
+ 
+@@ -49,6 +50,10 @@
+         return "GTK".equals(UIManager.getLookAndFeel().getID());
+     }
+ 
++    private static boolean isWayland() {
++        return System.getenv("WAYLAND_DISPLAY") != null;
++    }
++
+     private static final boolean gtkShouldAntialias() {
+         if (gtkAA == null) {
+             Object o = Toolkit.getDefaultToolkit().getDesktopProperty("gnome.Xft/Antialias"); //NOI18N
+@@ -84,7 +89,14 @@
+             if (ret == null) {
+                 ret = new HashMap<Object,Object>();
+                 if (antialias) {
+-                    ret.put(RenderingHints.KEY_TEXT_ANTIALIASING, RenderingHints.VALUE_TEXT_ANTIALIAS_ON);
++                    if (isWayland()) {
++                        ret.put(RenderingHints.KEY_TEXT_ANTIALIASING,
++                                RenderingHints.VALUE_TEXT_ANTIALIAS_LCD_HBGR);
++                        ret.put(RenderingHints.KEY_TEXT_LCD_CONTRAST, 140);
++                    } else {
++                        ret.put(RenderingHints.KEY_TEXT_ANTIALIASING,
++                                RenderingHints.VALUE_TEXT_ANTIALIAS_ON);
++                    }
+                 }
+             }
+             if (antialias ||
+
+--- a/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java	2026-03-20 03:01:46.421416137 +0000
++++ b/ide/dlight.terminal/src/org/netbeans/modules/dlight/terminal/action/TerminalSupportImpl.java	2026-03-20 03:02:11.284626650 +0000
+@@ -266,6 +266,15 @@
+                         //
+                         term.setEmulation("xterm"); // NOI18N
+ 
++                        // WLToolkit (Wayland) doesn't provide desktop font hints,
++                        // so term.drawGlyphVector() renders without antialiasing.
++                        // Set LCD subpixel hints explicitly.
++                        java.util.Map<java.awt.RenderingHints.Key, Object> fontHints = new java.util.HashMap<>();
++                        fontHints.put(java.awt.RenderingHints.KEY_TEXT_ANTIALIASING,
++                                      java.awt.RenderingHints.VALUE_TEXT_ANTIALIAS_LCD_HBGR);
++                        fontHints.put(java.awt.RenderingHints.KEY_TEXT_LCD_CONTRAST, 140);
++                        term.setRenderingHints(fontHints);
++
+                         NativeProcessBuilder npb = NativeProcessBuilder.newProcessBuilder(env);
+                         // clear env modified by NB. Let it be initialized by started shell process
+                         npb.getEnvironment().put("LD_LIBRARY_PATH", "");// NOI18N

gnu/packages/patches/orca-fix-gst-init-check-call.patch

@@ -0,0 +1,28 @@
+From 98300ecbb26fcacb0f7a722629fc50b4ec6bd1ab Mon Sep 17 00:00:00 2001
+Message-ID: <98300ecbb26fcacb0f7a722629fc50b4ec6bd1ab.1777294348.git.vivien@planete-kraus.eu>
+From: Vivien Kraus <vivien@planete-kraus.eu>
+Date: Mon, 27 Apr 2026 14:51:07 +0200
+Subject: [PATCH] Fix invalid Gst.init_check call
+
+init_check accepts a list of program arguments. An empty list works.
+
+---
+ src/orca/sound.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/orca/sound.py b/src/orca/sound.py
+index d507a371d..b1129609f 100644
+--- a/src/orca/sound.py
++++ b/src/orca/sound.py
+@@ -34,7 +34,7 @@ try:
+ except Exception:
+     _gstreamerAvailable = False
+ else:
+-    _gstreamerAvailable, args = Gst.init_check(None)
++    _gstreamerAvailable, args = Gst.init_check([])
+ 
+ from . import debug
+ from .sound_generator import Icon, Tone
+-- 
+2.52.0
+

gnu/packages/patches/php-01-fix-expired-certificate.patch

@@ -0,0 +1,773 @@
+From 0f38bfdef2d9e5ccbb266658b29bd576e36ed8a8 Mon Sep 17 00:00:00 2001
+From: Jakub Zelenka <bukka@php.net>
+Date: Fri, 3 Apr 2026 21:49:54 +0200
+Subject: [PATCH] Fix GH-21617: sni_server self signed certifcate expired
+
+It changes the SNI tests to use certificate generator like other TLS
+tests.
+
+Closes GH-21628
+
+Upstream-Status: Merged in master.
+---
+ ext/openssl/tests/gh9310.phpt                 | 59 +++++++++++------
+ .../openssl_x509_checkpurpose_basic.phpt      |  2 +-
+ .../openssl_x509_export_to_file_leak.phpt     |  2 +-
+ .../{sni_server_uk.pem => sni_server.pem}     |  0
+ ext/openssl/tests/sni_server.phpt             | 29 +++++++--
+ ext/openssl/tests/sni_server_ca.pem           | 63 -------------------
+ ext/openssl/tests/sni_server_cs.pem           | 57 -----------------
+ ext/openssl/tests/sni_server_cs_cert.pem      | 30 ---------
+ ext/openssl/tests/sni_server_cs_key.pem       | 27 --------
+ ext/openssl/tests/sni_server_key_cert.phpt    | 45 ++++++++++---
+ ext/openssl/tests/sni_server_uk_cert.pem      | 30 ---------
+ ext/openssl/tests/sni_server_uk_key.pem       | 27 --------
+ ext/openssl/tests/sni_server_us.pem           | 57 -----------------
+ ext/openssl/tests/sni_server_us_cert.pem      | 30 ---------
+ ext/openssl/tests/sni_server_us_key.pem       | 27 --------
+ 15 files changed, 106 insertions(+), 379 deletions(-)
+ rename ext/openssl/tests/{sni_server_uk.pem => sni_server.pem} (100%)
+ delete mode 100644 ext/openssl/tests/sni_server_ca.pem
+ delete mode 100644 ext/openssl/tests/sni_server_cs.pem
+ delete mode 100644 ext/openssl/tests/sni_server_cs_cert.pem
+ delete mode 100644 ext/openssl/tests/sni_server_cs_key.pem
+ delete mode 100644 ext/openssl/tests/sni_server_uk_cert.pem
+ delete mode 100644 ext/openssl/tests/sni_server_uk_key.pem
+ delete mode 100644 ext/openssl/tests/sni_server_us.pem
+ delete mode 100644 ext/openssl/tests/sni_server_us_cert.pem
+ delete mode 100644 ext/openssl/tests/sni_server_us_key.pem
+
+diff --git a/ext/openssl/tests/gh9310.phpt b/ext/openssl/tests/gh9310.phpt
+index 07a7d442cec..874ed4c781d 100644
+--- a/ext/openssl/tests/gh9310.phpt
++++ b/ext/openssl/tests/gh9310.phpt
+@@ -23,7 +23,21 @@
+ 
+ copy($certFile, $baseDirCertFile);
+ copy($pkFile, $baseDirPkFile);
+-copy(__DIR__ . '/sni_server_uk_cert.pem', $baseDir . '/sni_server_uk_cert.pem');
++
++$sniCaFile = __DIR__ . '/gh9310_sni_ca.pem.tmp';
++$sniCsFile = __DIR__ . '/gh9310_sni_cs.pem.tmp';
++$sniUkCertFile = __DIR__ . '/gh9310_sni_uk_cert.pem.tmp';
++$sniUkKeyFile = __DIR__ . '/gh9310_sni_uk_key.pem.tmp';
++$sniUsCertFile = __DIR__ . '/gh9310_sni_us_cert.pem.tmp';
++$sniUsKeyFile = __DIR__ . '/gh9310_sni_us_key.pem.tmp';
++$baseDirSniUkCertFile = $baseDir . '/sni_uk_cert.pem';
++
++$certificateGenerator->saveCaCert($sniCaFile);
++$certificateGenerator->saveNewCertAsFileWithKey('cs.php.net', $sniCsFile);
++$certificateGenerator->saveNewCertAndKey('uk.php.net', $sniUkCertFile, $sniUkKeyFile);
++$certificateGenerator->saveNewCertAndKey('us.php.net', $sniUsCertFile, $sniUsKeyFile);
++
++copy($sniUkCertFile, $baseDirSniUkCertFile);
+ 
+ 
+ $serverCodeTemplate = <<<'CODE'
+@@ -60,7 +74,7 @@
+     $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+-            "cs.php.net" => __DIR__ . "/sni_server_cs.pem",
++            "cs.php.net" => '%s',
+         ]
+     ]]);
+ 
+@@ -69,6 +83,7 @@
+ 
+     stream_socket_accept($server);
+ CODE;
++$sniServerCodeV1 = sprintf($sniServerCodeV1, $sniCsFile);
+ 
+ $sniServerCodeV2 = <<<'CODE'
+     ini_set('log_errors', 'On');
+@@ -77,8 +92,8 @@
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+             "uk.php.net" => [
+-                'local_cert' => __DIR__ . '/gh9310/sni_server_uk_cert.pem',
+-                'local_pk' => __DIR__ . '/sni_server_uk_key.pem',
++                'local_cert' => '%s',
++                'local_pk' => '%s',
+             ]
+         ]
+     ]]);
+@@ -88,6 +103,7 @@
+ 
+     stream_socket_accept($server);
+ CODE;
++$sniServerCodeV2 = sprintf($sniServerCodeV2, $baseDirSniUkCertFile, $sniUkKeyFile);
+ 
+ $sniServerCodeV3 = <<<'CODE'
+     ini_set('log_errors', 'On');
+@@ -96,8 +112,8 @@
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+             "us.php.net" => [
+-                'local_cert' => __DIR__ . '/sni_server_us_cert.pem',
+-                'local_pk' => __DIR__ . '/sni_server_us_key.pem',
++                'local_cert' => '%s',
++                'local_pk' => '%s',
+             ]
+         ]
+     ]]);
+@@ -107,14 +123,15 @@
+ 
+     stream_socket_accept($server);
+ CODE;
++$sniServerCodeV3 = sprintf($sniServerCodeV3, $sniUsCertFile, $sniUsKeyFile);
+ 
+ $sniClientCodeTemplate = <<<'CODE'
+     $flags = STREAM_CLIENT_CONNECT;
+     $ctxArr = [
+-        'cafile' => __DIR__ . '/sni_server_ca.pem',
++        'cafile' => '%s',
++        'peer_name' => '%s',
+     ];
+ 
+-    $ctxArr['peer_name'] = '%s';
+     $ctx = stream_context_create(['ssl' => $ctxArr]);
+     @stream_socket_client("tls://{{ ADDR }}", $errno, $errstr, 1, $flags, $ctx);
+ CODE;
+@@ -131,13 +148,13 @@
+ $serverCode = sprintf($serverCodeTemplate, $baseDirCertFile, $pkFile);
+ ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+ 
+-$sniClientCode = sprintf($sniClientCodeTemplate, 'cs.php.net');
++$sniClientCode = sprintf($sniClientCodeTemplate, $sniCaFile, 'cs.php.net');
+ ServerClientTestCase::getInstance()->run($sniClientCode, $sniServerCodeV1);
+ 
+-$sniClientCode = sprintf($sniClientCodeTemplate, 'uk.php.net');
++$sniClientCode = sprintf($sniClientCodeTemplate, $sniCaFile, 'uk.php.net');
+ ServerClientTestCase::getInstance()->run($sniClientCode, $sniServerCodeV2);
+ 
+-$sniClientCode = sprintf($sniClientCodeTemplate, 'us.php.net');
++$sniClientCode = sprintf($sniClientCodeTemplate, $sniCaFile, 'us.php.net');
+ ServerClientTestCase::getInstance()->run($sniClientCode, $sniServerCodeV3);
+ 
+ ?>
+@@ -149,7 +166,13 @@
+ @unlink(__DIR__ . '/gh9310.key');
+ @unlink($baseDir . '/cert.crt');
+ @unlink($baseDir . '/private.key');
+-@unlink($baseDir . '/sni_server_uk_cert.pem');
++@unlink($baseDir . '/sni_uk_cert.pem');
++@unlink(__DIR__ . '/gh9310_sni_ca.pem.tmp');
++@unlink(__DIR__ . '/gh9310_sni_cs.pem.tmp');
++@unlink(__DIR__ . '/gh9310_sni_uk_cert.pem.tmp');
++@unlink(__DIR__ . '/gh9310_sni_uk_key.pem.tmp');
++@unlink(__DIR__ . '/gh9310_sni_us_cert.pem.tmp');
++@unlink(__DIR__ . '/gh9310_sni_us_key.pem.tmp');
+ @rmdir($baseDir);
+ ?>
+ --EXPECTF--
+@@ -169,15 +192,15 @@
+ PHP Warning:  stream_socket_accept(): Unable to get real path of private key file `%sgh9310.key' in %s
+ PHP Warning:  stream_socket_accept(): Failed to enable crypto in %s
+ PHP Warning:  stream_socket_accept(): Accept failed: %s
+-PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%ssni_server_cs.pem) is not within the allowed path(s): (%sgh9310) in %s
+-PHP Warning:  stream_socket_accept(): Failed setting local cert chain file `%ssni_server_cs.pem'; file not found in %s
++PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%sgh9310_sni_cs.pem.tmp) is not within the allowed path(s): (%sgh9310) in %s
++PHP Warning:  stream_socket_accept(): Failed setting local cert chain file `%sgh9310_sni_cs.pem.tmp'; file not found in %s
+ PHP Warning:  stream_socket_accept(): Failed to enable crypto in %s
+ PHP Warning:  stream_socket_accept(): Accept failed: %s
+-PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%ssni_server_uk_key.pem) is not within the allowed path(s): (%sgh9310) in %s
+-PHP Warning:  stream_socket_accept(): Failed setting local private key file `%ssni_server_uk_key.pem';  could not open file in %s
++PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%sgh9310_sni_uk_key.pem.tmp) is not within the allowed path(s): (%sgh9310) in %s
++PHP Warning:  stream_socket_accept(): Failed setting local private key file `%sgh9310_sni_uk_key.pem.tmp';  could not open file in %s
+ PHP Warning:  stream_socket_accept(): Failed to enable crypto in %s
+ PHP Warning:  stream_socket_accept(): Accept failed: %s
+-PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%ssni_server_us_cert.pem) is not within the allowed path(s): (%sgh9310) in %s
+-PHP Warning:  stream_socket_accept(): Failed setting local cert chain file `%ssni_server_us_cert.pem'; could not open file in %s
++PHP Warning:  stream_socket_accept(): open_basedir restriction in effect. File(%sgh9310_sni_us_cert.pem.tmp) is not within the allowed path(s): (%sgh9310) in %s
++PHP Warning:  stream_socket_accept(): Failed setting local cert chain file `%sgh9310_sni_us_cert.pem.tmp'; could not open file in %s
+ PHP Warning:  stream_socket_accept(): Failed to enable crypto in %s
+ PHP Warning:  stream_socket_accept(): Accept failed: %s
+diff --git a/ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt b/ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt
+index d09317b1d22..c1dba964bc6 100644
+--- a/ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt
++++ b/ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt
+@@ -17,7 +17,7 @@
+ $bert = "file://" . __DIR__ . "/bug41033.pem";
+ $sert = "file://" . __DIR__ . "/san-cert.pem";
+ $cpca = __DIR__ . "/san-cert.pem";
+-$utfl = __DIR__ . "/sni_server_uk.pem";
++$utfl = __DIR__ . "/sni_server.pem";
+ $rcrt = openssl_x509_read($cert);
+ 
+ /*  int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose);   */
+diff --git a/ext/openssl/tests/openssl_x509_export_to_file_leak.phpt b/ext/openssl/tests/openssl_x509_export_to_file_leak.phpt
+index 5775c2597c3..59a942d6a67 100644
+--- a/ext/openssl/tests/openssl_x509_export_to_file_leak.phpt
++++ b/ext/openssl/tests/openssl_x509_export_to_file_leak.phpt
+@@ -5,7 +5,7 @@
+ --FILE--
+ <?php
+ 
+-$path = "file://" . __DIR__ . "/sni_server_ca.pem";
++$path = "file://" . __DIR__ . "/cert.crt";
+ var_dump(openssl_x509_export_to_file($path, str_repeat("a", 10000)));
+ 
+ ?>
+diff --git a/ext/openssl/tests/sni_server_uk.pem b/ext/openssl/tests/sni_server.pem
+similarity index 100%
+rename from ext/openssl/tests/sni_server_uk.pem
+rename to ext/openssl/tests/sni_server.pem
+diff --git a/ext/openssl/tests/sni_server.phpt b/ext/openssl/tests/sni_server.phpt
+index 7f9a4e82872..db0b0190dab 100644
+--- a/ext/openssl/tests/sni_server.phpt
++++ b/ext/openssl/tests/sni_server.phpt
+@@ -8,13 +8,25 @@
+ ?>
+ --FILE--
+ <?php
++$caFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_ca.pem.tmp';
++$csFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs.pem.tmp';
++$ukFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk.pem.tmp';
++$usFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us.pem.tmp';
++
++include 'CertificateGenerator.inc';
++$certificateGenerator = new CertificateGenerator();
++$certificateGenerator->saveCaCert($caFile);
++$certificateGenerator->saveNewCertAsFileWithKey('cs.php.net', $csFile);
++$certificateGenerator->saveNewCertAsFileWithKey('uk.php.net', $ukFile);
++$certificateGenerator->saveNewCertAsFileWithKey('us.php.net', $usFile);
++
+ $serverCode = <<<'CODE'
+     $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+-            "cs.php.net" => __DIR__ . "/sni_server_cs.pem",
+-            "uk.php.net" => __DIR__ . "/sni_server_uk.pem",
+-            "us.php.net" => __DIR__ . "/sni_server_us.pem"
++            "cs.php.net" => '%s',
++            "uk.php.net" => '%s',
++            "us.php.net" => '%s',
+         ]
+     ]]);
+ 
+@@ -25,11 +37,12 @@
+         @stream_socket_accept($server, 3);
+     }
+ CODE;
++$serverCode = sprintf($serverCode, $csFile, $ukFile, $usFile);
+ 
+ $clientCode = <<<'CODE'
+     $flags = STREAM_CLIENT_CONNECT;
+     $ctxArr = [
+-        'cafile' => __DIR__ . '/sni_server_ca.pem',
++        'cafile' => '%s',
+         'capture_peer_cert' => true
+     ];
+ 
+@@ -51,10 +64,18 @@
+     $cert = stream_context_get_options($ctx)['ssl']['peer_certificate'];
+     var_dump(openssl_x509_parse($cert)['subject']['CN']);
+ CODE;
++$clientCode = sprintf($clientCode, $caFile);
+ 
+ include 'ServerClientTestCase.inc';
+ ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+ ?>
++--CLEAN--
++<?php
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_ca.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us.pem.tmp');
++?>
+ --EXPECTF--
+ string(%d) "cs.php.net"
+ string(%d) "uk.php.net"
+diff --git a/ext/openssl/tests/sni_server_ca.pem b/ext/openssl/tests/sni_server_ca.pem
+deleted file mode 100644
+index b2522884565..00000000000
+--- a/ext/openssl/tests/sni_server_ca.pem
++++ /dev/null
+@@ -1,63 +0,0 @@
+------BEGIN CERTIFICATE-----
+-MIIFejCCA2KgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwQzELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAMMB3Bo
+-cC5uZXQwHhcNMTcxMTIyMTQyODIzWhcNMjcxMTIwMTQyODIzWjBVMQswCQYDVQQG
+-EwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwHUEhQLm5ldDEQMA4GA1UE
+-CwwHb3BlbnNzbDEQMA4GA1UEAwwHcGhwLm5ldDCCAiIwDQYJKoZIhvcNAQEBBQAD
+-ggIPADCCAgoCggIBAMeENPus84HfIaypUVybbn5ZZyu1gXSYZAnDYYHhOlHu5kFh
+-26ohnHnoheapXVRbUtDZgUW5BztA+vDhKkM5G3U4p+YsqcSA/IkF2JQBkJH1jrxs
+-XMDtXIA4/MzYAVtyySqoMsrbkSCDzvI8imsbZI9O1x02VgaqoaQ9JZvglt1nhTIY
+-YpTbTKGCzMmrnFGHITeBsVose1ACFIAtqKqvUaA6TxcCtVcrENY3T3N/vEmoHHBg
+-O7j9+UvYN/WRPNcv0aIOlro83O9xQuJdRCygPmcv/jkqWRKm2Pu0lEkvbMCvOJr/
+-Fz/kQg/6EVmIMsR/dgOMIjWjmpeTx24UJaNHUdNCeUbxIyTIyl9ISLWLM0Ipoq3L
+-95ygH6FSESAOpc8rVE2A5YZCtKlwvogMx3C/tMH1gWwMlfxn0CopP4Jx6lngw3yn
+-IpP0hnuCauQikBkyhsGu4J0Lbx5BsyDWQLwjiq4s8EcEy0vTdAvhDMRUGvpnjWaa
+-zBDVVrzHaRFvp6ueh35xf+dYieGL5UTICyrrQX9wwSafHV90a87y6XU+RwA25Dmc
+-V/kTn8/xkFv/4CbZp+0yArKpwXjqBMsQFbkFjT+Ky9MN+nedoFUMl7slgjpBs6RI
+-T08Hoa7/kMZGtLCiGcRXlwiIhB00gDz2avUvFTxwik9ssjDqBJGzNbBvZGb/AgMB
+-AAGjZjBkMB0GA1UdDgQWBBTjyuOBGnHnb+x20diIHG3sPuJFGjAfBgNVHSMEGDAW
+-gBQ0s99BNsV4Dszph6PArogA8HP4TDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1Ud
+-DwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAgEAFrQMmCoSe8uJbJLqPGMPW4ZE
+-0U81WWboc9FrSfezBYkTKuCjMTjQFv8oLp4pnuWZw22mHrOiz9izjNnXcR/rdVbG
+-Cip/JSHlTzHd3gnxSSd2diXvVrSb4zuLyN6WIficlsj3QdIP4Cdfv1pdHBTsRPbW
+-vuHpwYqqjxPBjqvoVZyZRyRM1pqpxLCvxOt4S3z4uZXyIH2UI7yWxI6MvdHBZg5m
+-TwiVi1gEQuRnYRy4sK9qJlBo5jERvzDr46W1e9Yz5sNMPfwWb64Hkkys3GqJt5am
+-OKxvgF3lvIK90vBjenGDfYEENP+0qdmdpHQkxGM2cl9iPqW8iyRGBVjdbzTIeRgB
+-u+CEbffSKWCpbm1Zcszv3FHMlsU4Px2pUTdLwEMgBQUPW/ngBMdRgVZE01GI7D1k
+-AM3hO347eehQTWoyuHgsnB2uaANEeR/XFBGDFmbs5ggAzxxRsH1FxoHXrv3iDIPW
+-9lKnSow+OZGcPKgaY5Nsregt4jO+pQqhzxlMa2QMfrMoGkEvrKNcDqeEI6KQa1SI
+-Zbq7sjf2w+VL0oQcse+gtg4q771dKy9V/XcfnPbiBAXfQqGj/v0LmZRn3ZRrkgzl
+-CaZocqVRJZbqu7/iu/p9pDRMR03vhBWPn7iM8VqzkhKjAlD0rolnQqvOAXyPpd/O
+-qYuYP+6Ymt/rUWXGVh0=
+------END CERTIFICATE-----
+------BEGIN CERTIFICATE-----
+-MIIFbDCCA1SgAwIBAgIJAJcrLHeFQrGEMA0GCSqGSIb3DQEBCwUAMEMxCzAJBgNV
+-BAYTAkdCMRAwDgYDVQQIDAdFbmdsYW5kMRAwDgYDVQQKDAdQSFAubmV0MRAwDgYD
+-VQQDDAdwaHAubmV0MB4XDTE3MTExNTE5MTEwMVoXDTM4MDUyOTE5MTEwMVowQzEL
+-MAkGA1UEBhMCR0IxEDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQx
+-EDAOBgNVBAMMB3BocC5uZXQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
+-AQC4bIXbh+e+OCbLum2FYB8i6ZnOShp1teWNEE/8A4ot20wkPxLeXFSU1Egn+3BG
+-fxHKrWxV/FOiL7bims/SfwptFkgNZkwE52HVk49zgQevG38smsnIGuBMXMKebLPT
+-wlsIWRqCmZqEmh1wNcC9+qwoHoYjvJvMYfFvofiSc7qkTFsjoBVe+ho90vjYMznr
+-Bs9DlD88iXO0kKN0Bsu2igz68JWkUsoNeD6UKSir16SmQZxdFPCM0O0gxmOyz4NZ
+-w8pJ5XGDJyS82fVp13tYCOBFhK0QBvvzaz/gN6De5arefm6cer9TX0HE+VvGhx4T
+-2lqydFLfAVKTTNoZHOQk2mFVUm7dlMzLvsgNKdEZH6wAa12eBImCea+CyJNkbGLC
+-nrN6a93iGqTft75sbDyvzRk/BdnxadkAPlOxgK1qGrOgeS0+7chPMh24MRoKj5bU
+-lYGdcp7Y9qIW1hZXFfgPJO0yMOug/7J14jybp+YhymBIBTZYi1zbGqGNXdLPyp77
+-9KTfyJE9KkbGegBvwqJmZTW8QoUDllopDjr1zaIqHWJqfAK7vGivu0iLVJHBRbRs
+-w9c48RCjfIh7AkvFKsdIDt9SMdZOdm9D8SXosYPM1zMFQsFFRPh/nKyl9QnhWbwd
+-Vs1tIFDrb10Z2sn0pF/V0F0gubR5rvYs+3h/dLciLVFobQIDAQABo2MwYTAdBgNV
+-HQ4EFgQUNLPfQTbFeA7M6YejwK6IAPBz+EwwHwYDVR0jBBgwFoAUNLPfQTbFeA7M
+-6YejwK6IAPBz+EwwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJ
+-KoZIhvcNAQELBQADggIBAIkctDRCNcNVs2qP/O3zZsVZ1cqlqYNjcHIVHqNZRvVb
+-bPtInZ/i/6BbwA5QM/giKpl2aMwetUnezjHVD+7/m24Mfs1FWyPD3joCMIANj7hR
+-MNbmX1LQBMt/bD3E5trq9S9rZ++/ny4gn/z2jH3x+lzDMBDiam/wXbvSmyIUPUX6
+-V8FFpkTBNERpurUvX1NEFLuiilWKrI7/u1qS11PGBcX3pNQNfhKNMtuFz74hAE7C
+-RE8756CGu2bZzydYCarUXSNTXqNm5ly2J0UN6Al4myFwj/6XnLnDhXDAI8CaqDMD
+-MwmxUzJvzuphNS085ZIntrSgPJESGozevEsf9bGD8GyoBQN/cSqOJCFfnJqxtKHb
+-wNa2F78SXYsiWkRb5EzoyCeon+0tygG6gLBouVY8ouCerExkH9qzRLLzFInxmCm2
+-ill7c8Xmml4H2BxJE33dz/Qh7PM3eF2A2VriioLDj4+HOiWq/1BjdW6/Xiwx5iP2
+-nC6Cex+lBt6HkP9WIiJbGxVeamF5jxNWWvLoUkrjFhpukjb5BPR9zFt7mAty9J/T
+-iQt26yylP4ucmL9KB6lv4ISW4Ri8mhMcYh6nF3tIYWZMCSQKqkyvymhKdLMZa20A
+-IME2oxnfZcmsfMpM6BYsN4XDfGBeYctqqt2AFRNLkI4wFkFFdPTMcTi1q0iRH2Xk
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_cs.pem b/ext/openssl/tests/sni_server_cs.pem
+deleted file mode 100644
+index 9f5a201b26d..00000000000
+--- a/ext/openssl/tests/sni_server_cs.pem
++++ /dev/null
+@@ -1,57 +0,0 @@
+------BEGIN RSA PRIVATE KEY-----
+-MIIEpQIBAAKCAQEAvy5NhzktzEdsHTbGB6vqYANms5rn1zXFmTJrGlWCwoIsNmTf
+-ahvZkrC1cCXTZ7fbPB8XQbpAtz2ZSU7OcwBW9B8okYUPo9zi/ptwcrgsQsN0hrcD
+-8MBRUccevwime5fLvg8E9RJ/68y9y3BnRcVWYO2sAK9juTfidNjETU3Bb05oXv8D
+-SD/6onXQu4uXDgsQ3cRXeld9UB0xazmQXyyiIqXc/cpTAnaEVYzn28aj7NlUbzNq
+-511UXMXY44x9EcXWpPVZ7heNcJNzY5DCNzmtXKrt9yiMpWQcPXEzsESVxAMqib9u
+-TFOlvVX17LIPxBG656PjTD9J1h6kBbMCUxzs7wIDAQABAoIBAQC85lBeY0X4ST3v
+-I7bJz7kWQ2YP4uhfAdeLhoDDFWjNLffniwYhfwEc6xNri0R2f/jUT9gX7qORKwEx
+-qPdeNCC2t67LElGg1FlJv2Z9Q7MgCKYzkdQH5s6y4e9kTHTLO/JpiceZKz1QTQ3f
+-XOH9032E6nIAf0wmr6xHTgOwajrN8VI5BuPEMVmEwIw3AtYeqVuPCNKyGR4HUVkC
+-2bAydnGngbRJRnNzmKcWJancxpHDGBSFqPyuXMFC7Jgo3ZmyCbGp99vuXVk/sW9x
+-5aj94M9nRE0guk05ivH2/JZao2uLYkIgjFWlhNxKdWgWRk8DEuN4djC8mKS9YH1q
+-crYRToMhAoGBAOspUTtKP54mpZmyhxuDqj02JaJRzNTskPHsiF1UhtXuw7uT+ryV
+-ekUFLNXoFmn9mbx1WVaUvGH4qjilvQOxz7u++lz0ApqJEfyM3jc/cC40Y5zcuGSu
+-Etbg+SyDoytlgMCIydJyrS7NNALSo5p5oG6XY2f8yd/DCAmo8LzypaHRAoGBANAf
+-R1SlBMc/bOsi6GrJxcBVSCFMiKYiO5woL5aUKa9yM+UQuQ/6xbQ7Q+sOlt0FH3xo
+-AJ2L60qTdjyXVtjOdtXs5ZC4l+C6AfnCx6yLr+fNc4SOYXEfqS4LZylgwKd9KyVB
+-asspIW9Idbgebmi6vPyt9LDkIp0h1VuFGjkvQJK/AoGBAI4pbS0dprXyARyYW6sb
+-fpgAmuG099IkrT9DUfCx/81myTclr2fAKal+BmvOIXaz0/OlMXvw8K19iVIzh7+r
+-B70lJ+93p/dKM/BsLI5TsHqOO0YB/QsIXOVAHgJ2FfdPJnW+e9vYba+kZ/Po6PSi
+-4ITaykJ8BIJcQgis89QWEGFxAoGBAJhQO+jzuDKF9ZWEf6ofrw0anOZZ16wWY5/e
+-PS2rk3JmVxpuibHrKqPDt+ogTELHDAsFJmYmz3VNxHuFmrajK49Wh4/JuMVr/CQo
+-6+8YcA1qa/94IFIlBLDBAafjujsZvOjQHnM+z8xcsGKmStF00Pjv6qNG4xoyd646
+-FD4DmfOLAoGAWXehpopZKXE9gRAni881ucK6WqxPPBoofbozi09D0MmfarIVaSkv
+-jNVVHBfLWd7IEXTjiipPBeUqq6Jc3pscN1Vp4rrl8jTmVTdazEv0LuzpdUFqmNo2
+-M+xw17uz9D9Q32/aW1Lar0PdIaL/wGEDEyzEBFwrGppcENLilPz8gzU=
+------END RSA PRIVATE KEY-----
+------BEGIN CERTIFICATE-----
+-MIIFIjCCAwqgAwIBAgICEAIwDQYJKoZIhvcNAQELBQAwVTELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAsMB29w
+-ZW5zc2wxEDAOBgNVBAMMB3BocC5uZXQwHhcNMTgwMTE0MTgzNjEyWhcNMjYwNDAy
+-MTgzNjEyWjBGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UE
+-CgwHUEhQLm5ldDETMBEGA1UEAwwKY3MucGhwLm5ldDCCASIwDQYJKoZIhvcNAQEB
+-BQADggEPADCCAQoCggEBAL8uTYc5LcxHbB02xger6mADZrOa59c1xZkyaxpVgsKC
+-LDZk32ob2ZKwtXAl02e32zwfF0G6QLc9mUlOznMAVvQfKJGFD6Pc4v6bcHK4LELD
+-dIa3A/DAUVHHHr8IpnuXy74PBPUSf+vMvctwZ0XFVmDtrACvY7k34nTYxE1NwW9O
+-aF7/A0g/+qJ10LuLlw4LEN3EV3pXfVAdMWs5kF8soiKl3P3KUwJ2hFWM59vGo+zZ
+-VG8zauddVFzF2OOMfRHF1qT1We4XjXCTc2OQwjc5rVyq7fcojKVkHD1xM7BElcQD
+-Kom/bkxTpb1V9eyyD8QRuuej40w/SdYepAWzAlMc7O8CAwEAAaOCAQkwggEFMAkG
+-A1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCGSAGG+EIBDQQmFiRPcGVu
+-U1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFHPfd8dK
+-Lz1R0Ck4WV1B9AWXd5DSMGwGA1UdIwRlMGOAFOPK44Eacedv7HbR2Igcbew+4kUa
+-oUekRTBDMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwH
+-UEhQLm5ldDEQMA4GA1UEAwwHcGhwLm5ldIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
+-A1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQB6WSIHEyDXLZxH
+-hZjqSNQOA7Wc9Z2FCAiD29xYkGTL8WuPVGGP1mu4B92ytj+PMWwqSReDa7eTGLE7
+-O7ozw9l+c+gNmHFNikSsGjlV2E8CToQOFMny+jAQYMSXf8UbTp9xDfgG02t/71hv
+-SLWqdeHMLcR0xi0nBQH0vDOkwUbuWYqFa3jejHieGhykHM6CkIk6lqnyOEO+ooIF
+-ZsLprrg1ss/mXCPI6niP0hze55ERKdxI7Rk8sZ4pVkf2SUWqZrUS0aJ+Ymmwi6Xd
+-2V7izq5N30PkJS8MtqII4FAjRBIkwPh0sy8PmW/DzkYU+lYQnDfYLKDFKcj8xJK/
+-o8oZUBsQltrSj0KlM9QuqxCTCBCy1nXZ9WHOhq+jdLiTc1Oi60uEHcUMrLK8aYc4
+-HqIvZS6C2iwMI0d1OP3VxmAbMQ9yqRi+FbLYavJ3H40jrU9SYqdxa0BrTaz8MJNE
+-6AEwgQDPChczSghvHME+Fs4mtGCY3TesbNZKVahQRjaFIhMZIZ4RP4CRc0bJOBG+
+-8Me4+KHNsD2ki5b03wAN6C1P2QrMzI+gH9fXLZYp761ciDAsX6YIzrhHHYLxYpJH
+-BkQKKs8dCQWE5IzgVrdlvC3Z1/l9om66wHqqx7nKnPfYs/Sfnwe9MpCD6xJrXiTm
+-WS7NM6fbQpO9APNr7o0ZOjbbWFzlNw==
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_cs_cert.pem b/ext/openssl/tests/sni_server_cs_cert.pem
+deleted file mode 100644
+index b77c7b83e2a..00000000000
+--- a/ext/openssl/tests/sni_server_cs_cert.pem
++++ /dev/null
+@@ -1,30 +0,0 @@
+------BEGIN CERTIFICATE-----
+-MIIFIjCCAwqgAwIBAgICEAIwDQYJKoZIhvcNAQELBQAwVTELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAsMB29w
+-ZW5zc2wxEDAOBgNVBAMMB3BocC5uZXQwHhcNMTgwMTE0MTgzNjEyWhcNMjYwNDAy
+-MTgzNjEyWjBGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UE
+-CgwHUEhQLm5ldDETMBEGA1UEAwwKY3MucGhwLm5ldDCCASIwDQYJKoZIhvcNAQEB
+-BQADggEPADCCAQoCggEBAL8uTYc5LcxHbB02xger6mADZrOa59c1xZkyaxpVgsKC
+-LDZk32ob2ZKwtXAl02e32zwfF0G6QLc9mUlOznMAVvQfKJGFD6Pc4v6bcHK4LELD
+-dIa3A/DAUVHHHr8IpnuXy74PBPUSf+vMvctwZ0XFVmDtrACvY7k34nTYxE1NwW9O
+-aF7/A0g/+qJ10LuLlw4LEN3EV3pXfVAdMWs5kF8soiKl3P3KUwJ2hFWM59vGo+zZ
+-VG8zauddVFzF2OOMfRHF1qT1We4XjXCTc2OQwjc5rVyq7fcojKVkHD1xM7BElcQD
+-Kom/bkxTpb1V9eyyD8QRuuej40w/SdYepAWzAlMc7O8CAwEAAaOCAQkwggEFMAkG
+-A1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCGSAGG+EIBDQQmFiRPcGVu
+-U1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFHPfd8dK
+-Lz1R0Ck4WV1B9AWXd5DSMGwGA1UdIwRlMGOAFOPK44Eacedv7HbR2Igcbew+4kUa
+-oUekRTBDMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwH
+-UEhQLm5ldDEQMA4GA1UEAwwHcGhwLm5ldIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
+-A1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQB6WSIHEyDXLZxH
+-hZjqSNQOA7Wc9Z2FCAiD29xYkGTL8WuPVGGP1mu4B92ytj+PMWwqSReDa7eTGLE7
+-O7ozw9l+c+gNmHFNikSsGjlV2E8CToQOFMny+jAQYMSXf8UbTp9xDfgG02t/71hv
+-SLWqdeHMLcR0xi0nBQH0vDOkwUbuWYqFa3jejHieGhykHM6CkIk6lqnyOEO+ooIF
+-ZsLprrg1ss/mXCPI6niP0hze55ERKdxI7Rk8sZ4pVkf2SUWqZrUS0aJ+Ymmwi6Xd
+-2V7izq5N30PkJS8MtqII4FAjRBIkwPh0sy8PmW/DzkYU+lYQnDfYLKDFKcj8xJK/
+-o8oZUBsQltrSj0KlM9QuqxCTCBCy1nXZ9WHOhq+jdLiTc1Oi60uEHcUMrLK8aYc4
+-HqIvZS6C2iwMI0d1OP3VxmAbMQ9yqRi+FbLYavJ3H40jrU9SYqdxa0BrTaz8MJNE
+-6AEwgQDPChczSghvHME+Fs4mtGCY3TesbNZKVahQRjaFIhMZIZ4RP4CRc0bJOBG+
+-8Me4+KHNsD2ki5b03wAN6C1P2QrMzI+gH9fXLZYp761ciDAsX6YIzrhHHYLxYpJH
+-BkQKKs8dCQWE5IzgVrdlvC3Z1/l9om66wHqqx7nKnPfYs/Sfnwe9MpCD6xJrXiTm
+-WS7NM6fbQpO9APNr7o0ZOjbbWFzlNw==
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_cs_key.pem b/ext/openssl/tests/sni_server_cs_key.pem
+deleted file mode 100644
+index bf1e9f25193..00000000000
+--- a/ext/openssl/tests/sni_server_cs_key.pem
++++ /dev/null
+@@ -1,27 +0,0 @@
+------BEGIN RSA PRIVATE KEY-----
+-MIIEpQIBAAKCAQEAvy5NhzktzEdsHTbGB6vqYANms5rn1zXFmTJrGlWCwoIsNmTf
+-ahvZkrC1cCXTZ7fbPB8XQbpAtz2ZSU7OcwBW9B8okYUPo9zi/ptwcrgsQsN0hrcD
+-8MBRUccevwime5fLvg8E9RJ/68y9y3BnRcVWYO2sAK9juTfidNjETU3Bb05oXv8D
+-SD/6onXQu4uXDgsQ3cRXeld9UB0xazmQXyyiIqXc/cpTAnaEVYzn28aj7NlUbzNq
+-511UXMXY44x9EcXWpPVZ7heNcJNzY5DCNzmtXKrt9yiMpWQcPXEzsESVxAMqib9u
+-TFOlvVX17LIPxBG656PjTD9J1h6kBbMCUxzs7wIDAQABAoIBAQC85lBeY0X4ST3v
+-I7bJz7kWQ2YP4uhfAdeLhoDDFWjNLffniwYhfwEc6xNri0R2f/jUT9gX7qORKwEx
+-qPdeNCC2t67LElGg1FlJv2Z9Q7MgCKYzkdQH5s6y4e9kTHTLO/JpiceZKz1QTQ3f
+-XOH9032E6nIAf0wmr6xHTgOwajrN8VI5BuPEMVmEwIw3AtYeqVuPCNKyGR4HUVkC
+-2bAydnGngbRJRnNzmKcWJancxpHDGBSFqPyuXMFC7Jgo3ZmyCbGp99vuXVk/sW9x
+-5aj94M9nRE0guk05ivH2/JZao2uLYkIgjFWlhNxKdWgWRk8DEuN4djC8mKS9YH1q
+-crYRToMhAoGBAOspUTtKP54mpZmyhxuDqj02JaJRzNTskPHsiF1UhtXuw7uT+ryV
+-ekUFLNXoFmn9mbx1WVaUvGH4qjilvQOxz7u++lz0ApqJEfyM3jc/cC40Y5zcuGSu
+-Etbg+SyDoytlgMCIydJyrS7NNALSo5p5oG6XY2f8yd/DCAmo8LzypaHRAoGBANAf
+-R1SlBMc/bOsi6GrJxcBVSCFMiKYiO5woL5aUKa9yM+UQuQ/6xbQ7Q+sOlt0FH3xo
+-AJ2L60qTdjyXVtjOdtXs5ZC4l+C6AfnCx6yLr+fNc4SOYXEfqS4LZylgwKd9KyVB
+-asspIW9Idbgebmi6vPyt9LDkIp0h1VuFGjkvQJK/AoGBAI4pbS0dprXyARyYW6sb
+-fpgAmuG099IkrT9DUfCx/81myTclr2fAKal+BmvOIXaz0/OlMXvw8K19iVIzh7+r
+-B70lJ+93p/dKM/BsLI5TsHqOO0YB/QsIXOVAHgJ2FfdPJnW+e9vYba+kZ/Po6PSi
+-4ITaykJ8BIJcQgis89QWEGFxAoGBAJhQO+jzuDKF9ZWEf6ofrw0anOZZ16wWY5/e
+-PS2rk3JmVxpuibHrKqPDt+ogTELHDAsFJmYmz3VNxHuFmrajK49Wh4/JuMVr/CQo
+-6+8YcA1qa/94IFIlBLDBAafjujsZvOjQHnM+z8xcsGKmStF00Pjv6qNG4xoyd646
+-FD4DmfOLAoGAWXehpopZKXE9gRAni881ucK6WqxPPBoofbozi09D0MmfarIVaSkv
+-jNVVHBfLWd7IEXTjiipPBeUqq6Jc3pscN1Vp4rrl8jTmVTdazEv0LuzpdUFqmNo2
+-M+xw17uz9D9Q32/aW1Lar0PdIaL/wGEDEyzEBFwrGppcENLilPz8gzU=
+------END RSA PRIVATE KEY-----
+diff --git a/ext/openssl/tests/sni_server_key_cert.phpt b/ext/openssl/tests/sni_server_key_cert.phpt
+index 49ed6aa5328..878f97c1e35 100644
+--- a/ext/openssl/tests/sni_server_key_cert.phpt
++++ b/ext/openssl/tests/sni_server_key_cert.phpt
+@@ -8,21 +8,36 @@
+ ?>
+ --FILE--
+ <?php
++$caFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_ca_kc.pem.tmp';
++$csCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs_cert.pem.tmp';
++$csKeyFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs_key.pem.tmp';
++$ukCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk_cert.pem.tmp';
++$ukKeyFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk_key.pem.tmp';
++$usCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us_cert.pem.tmp';
++$usKeyFile = __DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us_key.pem.tmp';
++
++include 'CertificateGenerator.inc';
++$certificateGenerator = new CertificateGenerator();
++$certificateGenerator->saveCaCert($caFile);
++$certificateGenerator->saveNewCertAndKey('cs.php.net', $csCertFile, $csKeyFile);
++$certificateGenerator->saveNewCertAndKey('uk.php.net', $ukCertFile, $ukKeyFile);
++$certificateGenerator->saveNewCertAndKey('us.php.net', $usCertFile, $usKeyFile);
++
+ $serverCode = <<<'CODE'
+     $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+             "cs.php.net" => [
+-                'local_cert' => __DIR__ . "/sni_server_cs_cert.pem",
+-                'local_pk' => __DIR__ . "/sni_server_cs_key.pem"
++                'local_cert' => '%s',
++                'local_pk' => '%s',
+             ],
+             "uk.php.net" => [
+-                'local_cert' => __DIR__ . "/sni_server_uk_cert.pem",
+-                'local_pk' => __DIR__ . "/sni_server_uk_key.pem"
++                'local_cert' => '%s',
++                'local_pk' => '%s',
+             ],
+             "us.php.net" => [
+-                'local_cert' => __DIR__ . "/sni_server_us_cert.pem",
+-                'local_pk' => __DIR__ . "/sni_server_us_key.pem"
++                'local_cert' => '%s',
++                'local_pk' => '%s',
+             ],
+         ]
+     ]]);
+@@ -34,11 +49,16 @@
+         @stream_socket_accept($server, 3);
+     }
+ CODE;
++$serverCode = sprintf($serverCode,
++        $csCertFile, $csKeyFile,
++        $ukCertFile, $ukKeyFile,
++        $usCertFile, $usKeyFile
++);
+ 
+ $clientCode = <<<'CODE'
+     $flags = STREAM_CLIENT_CONNECT;
+     $ctxArr = [
+-        'cafile' => __DIR__ . '/sni_server_ca.pem',
++        'cafile' => '%s',
+         'capture_peer_cert' => true
+     ];
+ 
+@@ -60,10 +80,21 @@
+     $cert = stream_context_get_options($ctx)['ssl']['peer_certificate'];
+     var_dump(openssl_x509_parse($cert)['subject']['CN']);
+ CODE;
++$clientCode = sprintf($clientCode, $caFile);
+ 
+ include 'ServerClientTestCase.inc';
+ ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+ ?>
++--CLEAN--
++<?php
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_ca_kc.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs_cert.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_cs_key.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk_cert.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_uk_key.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us_cert.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'sni_server_us_key.pem.tmp');
++?>
+ --EXPECTF--
+ string(%d) "cs.php.net"
+ string(%d) "uk.php.net"
+diff --git a/ext/openssl/tests/sni_server_uk_cert.pem b/ext/openssl/tests/sni_server_uk_cert.pem
+deleted file mode 100644
+index 57663855e59..00000000000
+--- a/ext/openssl/tests/sni_server_uk_cert.pem
++++ /dev/null
+@@ -1,30 +0,0 @@
+------BEGIN CERTIFICATE-----
+-MIIFIjCCAwqgAwIBAgICEAMwDQYJKoZIhvcNAQELBQAwVTELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAsMB29w
+-ZW5zc2wxEDAOBgNVBAMMB3BocC5uZXQwHhcNMTgwMTE0MTgzNjMyWhcNMjYwNDAy
+-MTgzNjMyWjBGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UE
+-CgwHUEhQLm5ldDETMBEGA1UEAwwKdWsucGhwLm5ldDCCASIwDQYJKoZIhvcNAQEB
+-BQADggEPADCCAQoCggEBAKzKRXj0jVBzRwolFn7Ej0MR2kE6Q36IBCEiDLhquSYR
+-Lh1spR0XudSVmRot/Wvz2PawApX4P6qj57scBQ6KL4ULKvSndCZ7F1tdQjEqogYp
+-n/L8oBhP1dgyDonsewG/PucxC+3Aqzcl3w5Pg7qE+zad42khP7t9TjFAMxc+PxC+
+-2as5ZCDJBwfxksCyCQfFWx7eB7p39vGy63k3Izv+UKTZEhbSdT721kb91oXkecpE
+-EFhihfVYMGMEtC7u2JLSxdkRhWYSMqVCvI2syYsLAUUNH2kgqQF00j2Iddhg3oMA
+-IiqhpC/n2slHVhp56WE1TsrGC/JgqIvQK9AT4LRxFb8CAwEAAaOCAQkwggEFMAkG
+-A1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCGSAGG+EIBDQQmFiRPcGVu
+-U1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFJK58uJe
+-Lv8WDOR8TTLUcSxO1zCyMGwGA1UdIwRlMGOAFOPK44Eacedv7HbR2Igcbew+4kUa
+-oUekRTBDMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwH
+-UEhQLm5ldDEQMA4GA1UEAwwHcGhwLm5ldIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
+-A1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQDHayU795hFnQNj
+-fuYV21sEmkSjgtp6X4rV9JfoCp8U2gieL4mizoCPx9Q8HYaAf98hPYTofGUaCSd+
+-Xlzd8lhLt9GCU+BsCxGtJocrjOQDhyhkioN8iirQRTtJpRVC6a4RCBGpenOD7Z7C
+-Z32uGXohzFuigP/J8/SXBdHrlpNSa03iEkkisPR46mbGj06lFVOFHJDNKA3CnQwM
+-3VfqvZt0ksZi/gAOol8dtrAd3k5JBfJ2BtqsPbycEGAhsGrTK/MeqiFcO8QZiXpN
+-qf0wZzOMFZJ4HqTiHs4TMMQaDK8c4qfR0l1OE224ijcB5NlqMjGAZabMfHgNZcl7
+-fYPX+POsOMaqubv98uoC0PCK8NCTyfB4V/el72EEoVfwKYOxm3eYXBEE2ZNyIci6
+-YKYhNa9e2k+cFueYMztV06HTGgkcHcSJATP+3ISTRx3tj1BPmc4O4WAMEMx1E0gg
+-PaVrBVAylGzt8kaMaOQMBImpsALSfutq6+KtQiu0OTGS3yVUGamV4AyRjuwF1/ZA
+-kZbjmNEGsf9d2rzS89ckds24QUx0zrfJ56p7lRvyVK/pML7iadv8dUH3fKDDDerD
+-oocLjOjNxFGN9Woz+kfidA8Siu0zsfQ6CLPlaQrVAVQH4iMuCZraqMc3TqAiUKRj
+-iHKp6FFrRZmY8W8HEKHv98uGofn+3g==
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_uk_key.pem b/ext/openssl/tests/sni_server_uk_key.pem
+deleted file mode 100644
+index 3baa6efd776..00000000000
+--- a/ext/openssl/tests/sni_server_uk_key.pem
++++ /dev/null
+@@ -1,27 +0,0 @@
+------BEGIN RSA PRIVATE KEY-----
+-MIIEowIBAAKCAQEArMpFePSNUHNHCiUWfsSPQxHaQTpDfogEISIMuGq5JhEuHWyl
+-HRe51JWZGi39a/PY9rAClfg/qqPnuxwFDoovhQsq9Kd0JnsXW11CMSqiBimf8vyg
+-GE/V2DIOiex7Ab8+5zEL7cCrNyXfDk+DuoT7Np3jaSE/u31OMUAzFz4/EL7Zqzlk
+-IMkHB/GSwLIJB8VbHt4Hunf28bLreTcjO/5QpNkSFtJ1PvbWRv3WheR5ykQQWGKF
+-9VgwYwS0Lu7YktLF2RGFZhIypUK8jazJiwsBRQ0faSCpAXTSPYh12GDegwAiKqGk
+-L+fayUdWGnnpYTVOysYL8mCoi9Ar0BPgtHEVvwIDAQABAoIBAGpg7XyWMxpAno/k
+-XYEWSo0kRJa75CnWW5R6fhJbwjlpglajONQ8czAqGeRARDFeI0lc+3qRJ8FKv7Q2
+-f/Z/pNnoEj4liiDWz350X/gdIztgDRVv6rCNFj7QMps/eEuPDo8PZySs5bxCGJ2a
+-3qLKlE7/za4/xhkMAEPaHppEvFb15dpomqP2Fjqei9afp8tD+xJv9BGtkFIy9acw
+-94AWQi974kgW7ZzfEf8RqHM0ExKiESCc26knbcBu0tQ892YHggMccUMk/UrVgR5d
+-vuGOBurlYGLBstSDSKCCe6la4N/FX3FiC3WhVNescnuTZPXcX3zebh7roGjgrTdd
+-6UJYBIECgYEA09XYihdwW66G9Y09OatzlzBh1Rvzjv2Vl5NmWHHb6vh38H4PcOof
+-S1pT0JvRzpt8uEs4i+Eda5PyQyp4iGtD+DQ07Dxh2jiixsE3PRFRG2wg2QCgDHnS
+-6vgV1VOqA/A4on4nhxLZXxhX4YvHaJYlm1bZ+amG+j5XiI/NtHJm9k8CgYEA0NB9
+-bAoaZnc06+T8rMaO45boX5SvYsCZbtY3VRl75SrbMal0IKfnXHELVHuei12LmlMs
+-LuFgG8jGO3+ncxUqMytoGvrmk/cM9tCNbDKVHtFbqz0qt9lkDAwLsBougKnVsNDW
+-Aae/tz/wYXJct86unfLh0xtvkx5Iz1we4cS1fZECgYA8YR+vfK7R8xUUuIVTAsOX
+-vHqmO6lYgH87DRCG9S0x9FB7g/LyxEjXOY/aTg+nTDpobUhY1nmESE8tRdXFTI27
+-GWZcT3m0sZ/z9u6/wUfVAST7tWnpJHAx+TR/8bDsHnSGHF836O98Y3vpFeZosSNW
+-+5J1zxRiD5LzocmIPXOLkQKBgEgHApxXx898YwbTj8zRGMysay89DFpV8RboUWHL
+-To83/y/cMbBp+kZKwAu+MGwGMndjJSRunUY4NRik6c+qh0nrORfFX+++Efy4529g
+-60scEDC7Apc0J2x4Yze1cED1VD6PaqJbiKffKD2UwyKr6lOVSgwVtKDcm2Tbc9OQ
+-lMHhAoGBAIPwYVxzWM6I6pr8x2TucpBZZReLytz7uzybMNvbKCrwlETbNNXubnfp
+-nPuPKzpeRI0y26pIIAbijzFW0MXq+kIu3H7we8TaImsJ1AaQCTYeoLWBVcr6RISk
+-3d4i7iT35aWCuhPVve0FNIv/u3jrqX2H2C2MXMiLOsw1GFxPvpi4
+------END RSA PRIVATE KEY-----
+diff --git a/ext/openssl/tests/sni_server_us.pem b/ext/openssl/tests/sni_server_us.pem
+deleted file mode 100644
+index 170a8a96e75..00000000000
+--- a/ext/openssl/tests/sni_server_us.pem
++++ /dev/null
+@@ -1,57 +0,0 @@
+------BEGIN RSA PRIVATE KEY-----
+-MIIEpQIBAAKCAQEA1QkC3tiNYDY+ZxMmPbagYUbMpzuXo9mVBvYh86bYZaeB7bts
+-QCBK+6VD4D2LjR3RszpzmOzhJXjm8j0t+GeRS3OMIM75/BKAnixXicRSIb8zdIPz
+-JP992vvMq8p46/XftAfBhAMOaCqcD85zpyX4PhfC9733nOyN4yqx58O4UhVTKih6
+-W9/ldp3uwSYAW+HyoINnHls/bFO8vv60K5VIhkxK30LHnC5PvByGfuHOgrscEThs
+-jW0ESqO0+9l88KhGdmLgzvbBlGxNziCMfn0LcFH6p2ITc3foD4LSzGEFtJ92OZi3
+-buCOfbFsN7vWHTsEi89fRcCnWGtMwLUx0TCluQIDAQABAoIBAQCnsUQ1Lrl6trhA
+-Yu6DPbLZX+XQ7jPbonaQ2Ea5iOhmfIjmHdaEU+cyV1EqvseO+Z4MO0KraiuAV79T
+-h50cIEpa3kW7vbFCHz5nQ/hUVdlg/yT93rASu5rSOctOnz64Xv8Ms948kDtS+9eF
+-Cbo4JMdX+VRbt4mmWP8HhqAsFACPexEoWxJcIxwFcI24GTGzySjemNjQzbmcVhzM
+-a4k6n8DolCL1cRS54C5Aaf5g4+IFDgyydcgZXp1lnX3MnqivSNkejnPnY55NcmrH
+-X3ZWPlAi9GHOJE33uy8bGWnip7Tn4iTt6tJvjz/yP82TGACDg1B8XsKrqsuQLsoU
+-cNBVGcQBAoGBAPteCgNmuNOpo4SRA1UVRw1WgnE8YtnNA6vYyVcTLSpqabq33UaD
+-03L9CQsbHtj88U+E8OH24Iqj3U9x7QJfH8DVmWuBrlwez80JsKGnLdViHydjKcAz
+-H2Cbv+SiWeaWXkFCkN4Jf7k3q0Ew4SG2LOq5PVUy/NB4bilbJD2ExKpZAoGBANj2
+-Hpwo35IQ4XfSSsGaCdn+8ajMcNUMMGZ6YkZqmVO4kogqobyrPL/2KE9ol/hlacw6
+-U/6Digox5/wqruYfqyM8lqGOq2/0Xf7c4XfiOTS9Na4JN3OGzlyqPvcn2zdqhYFY
+-iHPu2RqpA+LhCHW9Zs8C1Bp/KAEPdRP6OabqVaphAoGACLrHVj7nBFLL3vq6RuYq
+-RYhPl2cld7LrAbjRpTiBRQvVCCsCgERrv36SJdSXSanfJ4fSZcaRHb97HBs0w/RR
+-wfypC1bBm2lmhhRkEfkgWlzCADgtZwNff5dpHqOUw7FNLK8HIO7rhJ8uT2FHMEiH
+-Xs94FdFjfknwaXdE1u4ZdmECgYEAgxfbkQHFbO2UPqErGGXp0/WOsS6ucpyF1jXW
+-kbOxZ3vb1jjkNyrEbzzeSHTrdmRYk9UekWeLjfNvt9dWjKfP8V+XqJCbF+9wqCFw
+-fs6LQEmfWMQq5DwtDqKznwVPGOHdPzVuZZaJSemb9oeAZBwINccAv+3bDyD23hZQ
+-pYFsN6ECgYEA33QYDNG/spki4D8rlxyxZ+1MdB/efnrGBhO8FsJpG5+AtmYhWgD9
+-sl29+3aiRkmDznoy36z+hoeZePILEAKMcbHyXOymixOHPuaZJ95hbvq6sqd6WMAe
+-w5tHnxlfEuu11zatolk6WiAmTmG3sZpN5Tqloq0Ye4dvlhVKNV3Bn3E=
+------END RSA PRIVATE KEY-----
+------BEGIN CERTIFICATE-----
+-MIIFIjCCAwqgAwIBAgICEAQwDQYJKoZIhvcNAQELBQAwVTELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAsMB29w
+-ZW5zc2wxEDAOBgNVBAMMB3BocC5uZXQwHhcNMTgwMTE0MTgzNjQ0WhcNMjYwNDAy
+-MTgzNjQ0WjBGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UE
+-CgwHUEhQLm5ldDETMBEGA1UEAwwKdXMucGhwLm5ldDCCASIwDQYJKoZIhvcNAQEB
+-BQADggEPADCCAQoCggEBANUJAt7YjWA2PmcTJj22oGFGzKc7l6PZlQb2IfOm2GWn
+-ge27bEAgSvulQ+A9i40d0bM6c5js4SV45vI9LfhnkUtzjCDO+fwSgJ4sV4nEUiG/
+-M3SD8yT/fdr7zKvKeOv137QHwYQDDmgqnA/Oc6cl+D4Xwve995zsjeMqsefDuFIV
+-Uyooelvf5Xad7sEmAFvh8qCDZx5bP2xTvL7+tCuVSIZMSt9Cx5wuT7wchn7hzoK7
+-HBE4bI1tBEqjtPvZfPCoRnZi4M72wZRsTc4gjH59C3BR+qdiE3N36A+C0sxhBbSf
+-djmYt27gjn2xbDe71h07BIvPX0XAp1hrTMC1MdEwpbkCAwEAAaOCAQkwggEFMAkG
+-A1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCGSAGG+EIBDQQmFiRPcGVu
+-U1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFOXnUeNs
+-grKQb+EvG36DXjjDDmsFMGwGA1UdIwRlMGOAFOPK44Eacedv7HbR2Igcbew+4kUa
+-oUekRTBDMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwH
+-UEhQLm5ldDEQMA4GA1UEAwwHcGhwLm5ldIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
+-A1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQBDLwuLbx75ACSU
+-5cF2L/D17JEnhlna62MgKNdpNLJSpaofK2Lk2BqsmnQf5JdkrXWMUN/DsmXZc9pq
+-25XmprfABUP9Cx18KPVqLQ43Z9o+R9xI1Ospt5mrpxGp6l2BHSs/4G69nuPFpcIJ
+-iabnLYdUk2Z+64lPe4EMBrZH+pj4xn3JA59BACJYNYn0nLaw45DIAyzyLJ0vVSwc
+-0JtjsztXQov4UqdWXxLRFfe2nEGoK8ZkTJ8ELcCYu6sNSBjw9Ech78uXN1BQOBTK
+-lhAgN3FKqOp3hqf0umqf35gDvmWwLB/eptUYZ96gBYT0tbPA0P+YsW+iZmamxXma
+-Odgg8iRcPxKl9bVPt57NLaDy/RQhOxTGXQs1Q2jp7UhzqoZDClwVSDxd6DEppAFA
+-OZAY+Rsrm7VoCwVQ/1KbcJHmJ/79tArvaWJk3KHLGMpdZq4KwrC3hM8/QxYtyX/6
+-cfnXvShBYCdfTGgNlj3t/mNAgp1ZB3s9ClGqRBR/P0Db+ryv5DuxYM6nzEB3Od0y
+-kT5tHbXDQY+1HCExjOMi7Al0cmC2r3+oxDA4UjGv+npgcfeoxQhXmm/SQRiPdKlb
+-vT0D594sLoB23jqA9bMehpxEyI7eGjfFUmXwMeu0tJhipvpJI3ogJoM+SCFTyLkc
+-12cPiz/sR/ALhvhUJXTeUH8wxPjzbA==
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_us_cert.pem b/ext/openssl/tests/sni_server_us_cert.pem
+deleted file mode 100644
+index 4452e3c6cfb..00000000000
+--- a/ext/openssl/tests/sni_server_us_cert.pem
++++ /dev/null
+@@ -1,30 +0,0 @@
+------BEGIN CERTIFICATE-----
+-MIIFIjCCAwqgAwIBAgICEAQwDQYJKoZIhvcNAQELBQAwVTELMAkGA1UEBhMCR0Ix
+-EDAOBgNVBAgMB0VuZ2xhbmQxEDAOBgNVBAoMB1BIUC5uZXQxEDAOBgNVBAsMB29w
+-ZW5zc2wxEDAOBgNVBAMMB3BocC5uZXQwHhcNMTgwMTE0MTgzNjQ0WhcNMjYwNDAy
+-MTgzNjQ0WjBGMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UE
+-CgwHUEhQLm5ldDETMBEGA1UEAwwKdXMucGhwLm5ldDCCASIwDQYJKoZIhvcNAQEB
+-BQADggEPADCCAQoCggEBANUJAt7YjWA2PmcTJj22oGFGzKc7l6PZlQb2IfOm2GWn
+-ge27bEAgSvulQ+A9i40d0bM6c5js4SV45vI9LfhnkUtzjCDO+fwSgJ4sV4nEUiG/
+-M3SD8yT/fdr7zKvKeOv137QHwYQDDmgqnA/Oc6cl+D4Xwve995zsjeMqsefDuFIV
+-Uyooelvf5Xad7sEmAFvh8qCDZx5bP2xTvL7+tCuVSIZMSt9Cx5wuT7wchn7hzoK7
+-HBE4bI1tBEqjtPvZfPCoRnZi4M72wZRsTc4gjH59C3BR+qdiE3N36A+C0sxhBbSf
+-djmYt27gjn2xbDe71h07BIvPX0XAp1hrTMC1MdEwpbkCAwEAAaOCAQkwggEFMAkG
+-A1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMDMGCWCGSAGG+EIBDQQmFiRPcGVu
+-U1NMIEdlbmVyYXRlZCBTZXJ2ZXIgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFOXnUeNs
+-grKQb+EvG36DXjjDDmsFMGwGA1UdIwRlMGOAFOPK44Eacedv7HbR2Igcbew+4kUa
+-oUekRTBDMQswCQYDVQQGEwJHQjEQMA4GA1UECAwHRW5nbGFuZDEQMA4GA1UECgwH
+-UEhQLm5ldDEQMA4GA1UEAwwHcGhwLm5ldIICEAAwDgYDVR0PAQH/BAQDAgWgMBMG
+-A1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQBDLwuLbx75ACSU
+-5cF2L/D17JEnhlna62MgKNdpNLJSpaofK2Lk2BqsmnQf5JdkrXWMUN/DsmXZc9pq
+-25XmprfABUP9Cx18KPVqLQ43Z9o+R9xI1Ospt5mrpxGp6l2BHSs/4G69nuPFpcIJ
+-iabnLYdUk2Z+64lPe4EMBrZH+pj4xn3JA59BACJYNYn0nLaw45DIAyzyLJ0vVSwc
+-0JtjsztXQov4UqdWXxLRFfe2nEGoK8ZkTJ8ELcCYu6sNSBjw9Ech78uXN1BQOBTK
+-lhAgN3FKqOp3hqf0umqf35gDvmWwLB/eptUYZ96gBYT0tbPA0P+YsW+iZmamxXma
+-Odgg8iRcPxKl9bVPt57NLaDy/RQhOxTGXQs1Q2jp7UhzqoZDClwVSDxd6DEppAFA
+-OZAY+Rsrm7VoCwVQ/1KbcJHmJ/79tArvaWJk3KHLGMpdZq4KwrC3hM8/QxYtyX/6
+-cfnXvShBYCdfTGgNlj3t/mNAgp1ZB3s9ClGqRBR/P0Db+ryv5DuxYM6nzEB3Od0y
+-kT5tHbXDQY+1HCExjOMi7Al0cmC2r3+oxDA4UjGv+npgcfeoxQhXmm/SQRiPdKlb
+-vT0D594sLoB23jqA9bMehpxEyI7eGjfFUmXwMeu0tJhipvpJI3ogJoM+SCFTyLkc
+-12cPiz/sR/ALhvhUJXTeUH8wxPjzbA==
+------END CERTIFICATE-----
+diff --git a/ext/openssl/tests/sni_server_us_key.pem b/ext/openssl/tests/sni_server_us_key.pem
+deleted file mode 100644
+index 8b0d73d7d63..00000000000
+--- a/ext/openssl/tests/sni_server_us_key.pem
++++ /dev/null
+@@ -1,27 +0,0 @@
+------BEGIN RSA PRIVATE KEY-----
+-MIIEpQIBAAKCAQEA1QkC3tiNYDY+ZxMmPbagYUbMpzuXo9mVBvYh86bYZaeB7bts
+-QCBK+6VD4D2LjR3RszpzmOzhJXjm8j0t+GeRS3OMIM75/BKAnixXicRSIb8zdIPz
+-JP992vvMq8p46/XftAfBhAMOaCqcD85zpyX4PhfC9733nOyN4yqx58O4UhVTKih6
+-W9/ldp3uwSYAW+HyoINnHls/bFO8vv60K5VIhkxK30LHnC5PvByGfuHOgrscEThs
+-jW0ESqO0+9l88KhGdmLgzvbBlGxNziCMfn0LcFH6p2ITc3foD4LSzGEFtJ92OZi3
+-buCOfbFsN7vWHTsEi89fRcCnWGtMwLUx0TCluQIDAQABAoIBAQCnsUQ1Lrl6trhA
+-Yu6DPbLZX+XQ7jPbonaQ2Ea5iOhmfIjmHdaEU+cyV1EqvseO+Z4MO0KraiuAV79T
+-h50cIEpa3kW7vbFCHz5nQ/hUVdlg/yT93rASu5rSOctOnz64Xv8Ms948kDtS+9eF
+-Cbo4JMdX+VRbt4mmWP8HhqAsFACPexEoWxJcIxwFcI24GTGzySjemNjQzbmcVhzM
+-a4k6n8DolCL1cRS54C5Aaf5g4+IFDgyydcgZXp1lnX3MnqivSNkejnPnY55NcmrH
+-X3ZWPlAi9GHOJE33uy8bGWnip7Tn4iTt6tJvjz/yP82TGACDg1B8XsKrqsuQLsoU
+-cNBVGcQBAoGBAPteCgNmuNOpo4SRA1UVRw1WgnE8YtnNA6vYyVcTLSpqabq33UaD
+-03L9CQsbHtj88U+E8OH24Iqj3U9x7QJfH8DVmWuBrlwez80JsKGnLdViHydjKcAz
+-H2Cbv+SiWeaWXkFCkN4Jf7k3q0Ew4SG2LOq5PVUy/NB4bilbJD2ExKpZAoGBANj2
+-Hpwo35IQ4XfSSsGaCdn+8ajMcNUMMGZ6YkZqmVO4kogqobyrPL/2KE9ol/hlacw6
+-U/6Digox5/wqruYfqyM8lqGOq2/0Xf7c4XfiOTS9Na4JN3OGzlyqPvcn2zdqhYFY
+-iHPu2RqpA+LhCHW9Zs8C1Bp/KAEPdRP6OabqVaphAoGACLrHVj7nBFLL3vq6RuYq
+-RYhPl2cld7LrAbjRpTiBRQvVCCsCgERrv36SJdSXSanfJ4fSZcaRHb97HBs0w/RR
+-wfypC1bBm2lmhhRkEfkgWlzCADgtZwNff5dpHqOUw7FNLK8HIO7rhJ8uT2FHMEiH
+-Xs94FdFjfknwaXdE1u4ZdmECgYEAgxfbkQHFbO2UPqErGGXp0/WOsS6ucpyF1jXW
+-kbOxZ3vb1jjkNyrEbzzeSHTrdmRYk9UekWeLjfNvt9dWjKfP8V+XqJCbF+9wqCFw
+-fs6LQEmfWMQq5DwtDqKznwVPGOHdPzVuZZaJSemb9oeAZBwINccAv+3bDyD23hZQ
+-pYFsN6ECgYEA33QYDNG/spki4D8rlxyxZ+1MdB/efnrGBhO8FsJpG5+AtmYhWgD9
+-sl29+3aiRkmDznoy36z+hoeZePILEAKMcbHyXOymixOHPuaZJ95hbvq6sqd6WMAe
+-w5tHnxlfEuu11zatolk6WiAmTmG3sZpN5Tqloq0Ye4dvlhVKNV3Bn3E=
+------END RSA PRIVATE KEY-----
+-- 
+2.52.0
+

gnu/packages/patches/php-02-fix-sni-tests.patch

@@ -0,0 +1,211 @@
+From 178a30b9e700d32a8aac4f49864838829bedd389 Mon Sep 17 00:00:00 2001
+From: Jakub Zelenka <bukka@php.net>
+Date: Sat, 4 Apr 2026 00:28:29 +0200
+Subject: [PATCH] Fix SNI tests for bugs #80770 and #74796
+
+Upstream-Status: Merged in master.
+---
+ ext/openssl/tests/bug74796.phpt | 29 ++++++++++++++++++++------
+ ext/openssl/tests/bug80770.phpt | 31 ++++++++++++++++------------
+ php-8.3.30.manifest             | 36 +++++++++++++++++++++++++++++++++
+ 3 files changed, 77 insertions(+), 19 deletions(-)
+ create mode 100644 php-8.3.30.manifest
+
+diff --git a/ext/openssl/tests/bug74796.phpt b/ext/openssl/tests/bug74796.phpt
+index b3f594d5e60..8ec5590c064 100644
+--- a/ext/openssl/tests/bug74796.phpt
++++ b/ext/openssl/tests/bug74796.phpt
+@@ -12,13 +12,24 @@
+ --FILE--
+ <?php
+ 
++include 'CertificateGenerator.inc';
++$certificateGenerator = new CertificateGenerator();
++$caFile = __DIR__ . '/bug74796_ca.pem.tmp';
++$csFile = __DIR__ . '/bug74796_cs.pem.tmp';
++$ukFile = __DIR__ . '/bug74796_uk.pem.tmp';
++$usFile = __DIR__ . '/bug74796_us.pem.tmp';
++$certificateGenerator->saveCaCert($caFile);
++$certificateGenerator->saveNewCertAsFileWithKey('cs.php.net', $csFile);
++$certificateGenerator->saveNewCertAsFileWithKey('uk.php.net', $ukFile);
++$certificateGenerator->saveNewCertAsFileWithKey('us.php.net', $usFile);
++
+ $serverCode = <<<'CODE'
+     $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+-            "cs.php.net" => __DIR__ . "/sni_server_cs.pem",
+-            "uk.php.net" => __DIR__ . "/sni_server_uk.pem",
+-            "us.php.net" => __DIR__ . "/sni_server_us.pem"
++            "cs.php.net" => '%s',
++            "uk.php.net" => '%s',
++            "us.php.net" => '%s',
+         ]
+     ]]);
+ 
+@@ -33,6 +44,7 @@
+ 
+     phpt_wait();
+ CODE;
++$serverCode = sprintf($serverCode, $csFile, $ukFile, $usFile);
+ 
+ $proxyCode = <<<'CODE'
+     function parse_sni_from_client_hello($data) {
+@@ -134,7 +146,7 @@ function parse_sni_from_client_hello($data) {
+ $clientCode = <<<'CODE'
+     $clientCtx = stream_context_create([
+         'ssl' => [
+-            'cafile' => __DIR__ . '/sni_server_ca.pem',
++            'cafile' => '%s',
+             'verify_peer' => true,
+             'verify_peer_name' => true,
+         ],
+@@ -155,16 +167,21 @@ function parse_sni_from_client_hello($data) {
+ 
+     phpt_notify('server');
+ CODE;
++$clientCode = sprintf($clientCode, $caFile);
+ 
+ include 'ServerClientTestCase.inc';
+ ServerClientTestCase::getInstance()->run($clientCode, [
+-    'server' => $serverCode,
+-    'proxy' => $proxyCode,
++        'server' => $serverCode,
++        'proxy' => $proxyCode,
+ ]);
+ ?>
+ --CLEAN--
+ <?php
+ @unlink(__DIR__ . "/bug74796_proxy_sni.log");
++@unlink(__DIR__ . '/bug74796_ca.pem.tmp');
++@unlink(__DIR__ . '/bug74796_cs.pem.tmp');
++@unlink(__DIR__ . '/bug74796_uk.pem.tmp');
++@unlink(__DIR__ . '/bug74796_us.pem.tmp');
+ ?>
+ --EXPECT--
+ string(19) "Hello from server 0"
+diff --git a/ext/openssl/tests/bug80770.phpt b/ext/openssl/tests/bug80770.phpt
+index 9100aaa5aa1..21860dc78eb 100644
+--- a/ext/openssl/tests/bug80770.phpt
++++ b/ext/openssl/tests/bug80770.phpt
+@@ -11,14 +11,25 @@
+ <?php
+ $clientCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_client.pem.tmp';
+ $caCertFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_ca.pem.tmp';
++$csFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_cs.pem.tmp';
++$ukFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_uk.pem.tmp';
++$usFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug80770_us.pem.tmp';
++
++include 'CertificateGenerator.inc';
++$certificateGenerator = new CertificateGenerator();
++$certificateGenerator->saveCaCert($caCertFile);
++$certificateGenerator->saveNewCertAsFileWithKey('cs.php.net', $csFile);
++$certificateGenerator->saveNewCertAsFileWithKey('uk.php.net', $ukFile);
++$certificateGenerator->saveNewCertAsFileWithKey('us.php.net', $usFile);
++$certificateGenerator->saveNewCertAsFileWithKey('Bug80770 Test Client', $clientCertFile);
+ 
+ $serverCode = <<<'CODE'
+     $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
+     $ctx = stream_context_create(['ssl' => [
+         'SNI_server_certs' => [
+-            "cs.php.net" => __DIR__ . "/sni_server_cs.pem",
+-            "uk.php.net" => __DIR__ . "/sni_server_uk.pem",
+-            "us.php.net" => __DIR__ . "/sni_server_us.pem"
++            "cs.php.net" => '%s',
++            "uk.php.net" => '%s',
++            "us.php.net" => '%s',
+         ],
+         'verify_peer' => true,
+         'cafile' => '%s',
+@@ -28,7 +39,6 @@
+     ]]);
+     $server = stream_socket_server('tcp://127.0.0.1:0', $errno, $errstr, $flags, $ctx);
+     phpt_notify_server_start($server);
+-
+     $client = stream_socket_accept($server, 30);
+     if ($client) {
+         $success = stream_socket_enable_crypto($client, true, STREAM_CRYPTO_METHOD_TLS_SERVER);
+@@ -43,7 +53,7 @@
+         phpt_notify(message: "ACCEPT_FAILED");
+     }
+ CODE;
+-$serverCode = sprintf($serverCode, $caCertFile);
++$serverCode = sprintf($serverCode, $csFile, $ukFile, $usFile, $caCertFile);
+ 
+ $clientCode = <<<'CODE'
+     $flags = STREAM_CLIENT_CONNECT;
+@@ -58,19 +68,11 @@
+     if ($client) {
+         stream_socket_enable_crypto($client, true, STREAM_CRYPTO_METHOD_TLS_CLIENT);
+     }
+-
+     $result = phpt_wait();
+     echo trim($result);
+ CODE;
+ $clientCode = sprintf($clientCode, $clientCertFile);
+ 
+-include 'CertificateGenerator.inc';
+-
+-// Generate CA and client certificate signed by that CA
+-$certificateGenerator = new CertificateGenerator();
+-$certificateGenerator->saveCaCert($caCertFile);
+-$certificateGenerator->saveNewCertAsFileWithKey('Bug80770 Test Client', $clientCertFile);
+-
+ include 'ServerClientTestCase.inc';
+ ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
+ ?>
+@@ -78,6 +80,9 @@
+ <?php
+ @unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_client.pem.tmp');
+ @unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_ca.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_cs.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_uk.pem.tmp');
++@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug80770_us.pem.tmp');
+ ?>
+ --EXPECTF--
+ CLIENT_CERT_CAPTURED
+diff --git a/php-8.3.30.manifest b/php-8.3.30.manifest
+new file mode 100644
+index 00000000000..ef6ffe8aa80
+--- /dev/null
++++ b/php-8.3.30.manifest
+@@ -0,0 +1,36 @@
++php-8.3.30.tar.bz2
++SHA256 hash: 800b7b6ed50b73c8ee7844ee5f2f7cc612faa7875a0aa7c4529e8ed5866a5030
++PGP signature:
++-----BEGIN PGP SIGNATURE-----
++
++iHUEABYKAB0WIQTCjZN1dWA+tKu3JYYcB3ncXAqd5AUCaWbJsAAKCRAcB3ncXAqd
++5FioAPwK1gjqwBbGr5g3y1TikqxgKVWMHCtir1n46yGN2hYvtwD/flOR9EqRejNU
++wW4RMkmRwXGsXY28V1DH+NKnDKTEWQ8=
++=jkCu
++-----END PGP SIGNATURE-----
++
++
++php-8.3.30.tar.gz
++SHA256 hash: e587dc95fb7f62730299fa7b36b6e4f91e6708aaefa2fff68a0098d320c16386
++PGP signature:
++-----BEGIN PGP SIGNATURE-----
++
++iHUEABYKAB0WIQTCjZN1dWA+tKu3JYYcB3ncXAqd5AUCaWbJsAAKCRAcB3ncXAqd
++5F4eAP44IkpP3p3FRq3S9pDm9Y6bJnrpzxafqfXlZ949ECmUIgEAxFb+m5Tz7gcb
++DSU+taIv2W6EQeijjaXPvAE2t1dGswo=
++=kn1U
++-----END PGP SIGNATURE-----
++
++
++php-8.3.30.tar.xz
++SHA256 hash: 67f084d36852daab6809561a7c8023d130ca07fc6af8fb040684dd1414934d48
++PGP signature:
++-----BEGIN PGP SIGNATURE-----
++
++iHUEABYKAB0WIQTCjZN1dWA+tKu3JYYcB3ncXAqd5AUCaWbJsQAKCRAcB3ncXAqd
++5NYpAP9Is0pCLlEuLiSRdAbgWPDee0jPA5JGoriGOFNkdMk67AD/WTzYCx7+dEVG
++8Gb54wK005bk9nRGYQqwvZb+r1gqaQU=
++=vSr4
++-----END PGP SIGNATURE-----
++
++
+-- 
+2.52.0
+

gnu/packages/patches/r-biostrings-r4.6.0-compat.patch

@@ -0,0 +1,513 @@
+This patch shas been backported from the development version or Biostrings.
+
+From 100602242840322b5f6c267faaf8198c1a5aa2af Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Thu, 5 Mar 2026 22:36:30 -0800
+Subject: [PATCH] Biostrings 2.79.5: Get rid of never-used SparseMIndex and
+ SparseList classes
+
+This also eliminates the non-API calls to R.
+---
+ DESCRIPTION                 |   3 +-
+ NAMESPACE                   |   2 -
+ R/MIndex-class.R            |  79 -------------------------
+ R/SparseList-class.R        |  80 -------------------------
+ man/Biostrings-internals.Rd |   9 ---
+ src/Biostrings.h            |  41 -------------
+ src/MIndex_class.c          |  67 ---------------------
+ src/R_init_Biostrings.c     |   1 -
+ src/SparseList_utils.c      | 113 ------------------------------------
+ 9 files changed, 1 insertion(+), 394 deletions(-)
+ delete mode 100644 R/SparseList-class.R
+ delete mode 100644 src/SparseList_utils.c
+
+diff --git a/DESCRIPTION b/DESCRIPTION
+index a5d027cc..dbc323ea 100644
+--- a/DESCRIPTION
++++ b/DESCRIPTION
+@@ -76,3 +76,3 @@ Collate: utils.R IUPAC_CODE_MAP.R AMINO_ACID_CODE.R GENETIC_CODE.R
+         injectHardMask.R padAndClip.R strsplit-methods.R misc.R
+-        SparseList-class.R MIndex-class.R lowlevel-matching.R
++        MIndex-class.R lowlevel-matching.R
+         match-utils.R matchPattern.R maskMotif.R matchLRPatterns.R
+diff --git a/NAMESPACE b/NAMESPACE
+index ba1e3bfa..cf14db67 100644
+--- a/NAMESPACE
++++ b/NAMESPACE
+@@ -206,7 +206,6 @@ exportMethods(
+ ### ==========================================================================
+ ### STRING MATCHING
+ ### --------------------------------------------------------------------------
+-###   SparseList-class.R
+ ###   MIndex-class.R
+ ###   lowlevel-matching.R
+ ###   match-utils.R
+@@ -220,7 +219,6 @@ exportMethods(
+ ###   matchPDict.R
+ 
+ exportClasses(
+-    #SparseList,
+     MIndex, ByPos_MIndex,
+     PreprocessedTB, Twobit, ACtree2,
+     PDict3Parts,
+diff --git a/R/MIndex-class.R b/R/MIndex-class.R
+index 022f6746..f50f215e 100644
+--- a/R/MIndex-class.R
++++ b/R/MIndex-class.R
+@@ -218,82 +218,3 @@ ByPos_MIndex.combine <- function(mi_list)
+     new("ByPos_MIndex", width0=ans_width0, NAMES=ans_names, ends=ans_ends)
+ }
+ 
+-
+-### - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+-### The "SparseMIndex" class (DISABLED FOR NOW).
+-### 
+-### Slot description:
+-###
+-###   ends_envir: a key-value list (environment) where the values are integer
+-###       vectors containing the ending positions of the pattern whose
+-###       position in the original dictionary is given by the key (the keys are
+-###       strings representing positive integers).
+-### 
+-
+-if (FALSE) {
+-
+-  setClass("SparseMIndex",
+-    contains="MIndex",
+-    representation(
+-        ends_envir="environment"
+-    )
+-  )
+-
+-  setMethod("show", "SparseMIndex",
+-    function(object)
+-    {
+-        cat("Sparse MIndex object of length ", length(object), "\n", sep="")
+-    }
+-  )
+-
+-  setMethod("[[", "SparseMIndex",
+-    function(x, i, j, ...)
+-    {
+-        i <- normalizeDoubleBracketSubscript(i, x)
+-        ans_end <- x@ends_envir[[formatC(i, width=10, format="d", flag="0")]]
+-        if (is.null(ans_end))
+-            ans_end <- integer(0)
+-        ans_width <- rep.int(x@width0[i], length(ans_end))
+-        ans_start <- ans_end - x@width0[i] + 1L
+-        new2("IRanges", start=ans_start, width=ans_width, check=FALSE)
+-    }
+-  )
+-
+-  ### An example of a SparseMIndex object of length 5 where only the
+-  ### 2nd pattern has matches:
+-  ###   > width0 <- c(9L, 10L, 8L, 4L, 10L)
+-  ###   > ends_envir <- new.env(hash=TRUE, parent=emptyenv())
+-  ###   > ends_envir[['0000000002']] <- c(199L, 402L)
+-  ###   > mindex <- new("SparseMIndex", width0=width0, NAMES=letters[1:5], ends_envir=ends_envir)
+-  ###   > mindex[[1]]
+-  ###   > mindex[[2]]
+-  ###   > mindex[[6]] # Error in mindex[[6]] : subscript out of bounds
+-  ###   > names(mindex)
+-  ###   > mindex[["a"]]
+-  ###   > mindex[["b"]]
+-  ###   > mindex[["aa"]] # Error in mindex[["aa"]] : pattern name ‘aa’ not found
+-  ###   > startIndex(mindex)
+-  ###   > endIndex(mindex)
+-  ###   > elementNROWS(mindex)
+-  ###
+-  setMethod("startIndex", "SparseMIndex",
+-    function(x)
+-    {
+-        all.names <- TRUE
+-        .Call2("SparseMIndex_endIndex",
+-              x@ends_envir, x@width0, x@NAMES, all.names,
+-              PACKAGE="Biostrings")
+-    }
+-  )
+-  setMethod("endIndex", "SparseMIndex",
+-    function(x)
+-    {
+-        all.names <- TRUE
+-        .Call2("SparseMIndex_endIndex",
+-              x@ends_envir, NULL, x@NAMES, all.names,
+-              PACKAGE="Biostrings")
+-    }
+-  )
+-
+-}
+-
+diff --git a/R/SparseList-class.R b/R/SparseList-class.R
+deleted file mode 100644
+index 8295fd0f..00000000
+--- a/R/SparseList-class.R
++++ /dev/null
+@@ -1,80 +0,0 @@
+-### =========================================================================
+-### SparseList objects
+-### -------------------------------------------------------------------------
+-###
+-
+-setClass("SparseList",
+-    representation(
+-        length="integer",
+-        env="environment"
+-    )
+-)
+-
+-### Typical use:
+-###   env <- new.env(hash=TRUE, parent=emptyenv())
+-###   key <- formatC(98L, width=10, format="d", flag="0")
+-###   value <- 3:-2
+-###   assign(key, value, envir=env)
+-###   x <- new("SparseList", length=100L, env=env)
+-###   length(x)
+-###   ls(x)
+-###   ls(x, all.names=TRUE)
+-###   as.list(x)
+-###   as.list(x, all.names=TRUE)
+-###   x[[1]]
+-###   x[[98]
+-###   x[[101]]]
+-###
+-
+-setMethod("length", "SparseList", function(x) x@length)
+-
+-### 'pos', 'envir' and 'pattern' args are ignored
+-setMethod("ls", signature(name="SparseList"),
+-    function(name, pos, envir, all.names=FALSE, pattern)
+-    {
+-        if (!all.names)
+-            return(ls(name@env, all.names=TRUE))
+-        seq_len(length(name))
+-    }
+-)
+-
+-setMethod("as.list", "SparseList",
+-    function(x, all.names=FALSE, ...)
+-    {
+-        if (!all.names)
+-            return(as.list(x@env, all.names=TRUE))
+-        ans <- vector(mode="list", length=length(x))
+-        symbols <- ls(x)
+-        for (symb in symbols)
+-            ans[[as.integer(symb)]] <- get(symb, envir=x@env)
+-        ans
+-    }
+-)
+-
+-### Supported 'i' types: character or numeric vector of length 1.
+-setMethod("[[", "SparseList",
+-    function(x, i, j, ...)
+-    {
+-        if (!missing(j) || length(list(...)) > 0)
+-            stop("invalid subsetting")
+-        if (missing(i))
+-            stop("subscript is missing")
+-        if (!is.character(i) && !is.numeric(i))
+-            stop("invalid subscript type")
+-        if (length(i) < 1L)
+-            stop("attempt to select less than one element")
+-        if (length(i) > 1L)
+-            stop("attempt to select more than one element")
+-        if (is.na(i))
+-            stop("subscript cannot be NA")
+-        if (is.character(i))
+-            return(get(i, envir=x@env))
+-        if (!is.integer(i))
+-            i <- as.integer(i)
+-        if (i < 1L || i > length(x))
+-            stop("subscript out of bounds")
+-        i <- formatC(i, width=10, format="d", flag="0")
+-        get(i, envir=x@env)
+-    }
+-)
+-
+diff --git a/man/Biostrings-internals.Rd b/man/Biostrings-internals.Rd
+index 791b0870..609b7694 100644
+--- a/man/Biostrings-internals.Rd
++++ b/man/Biostrings-internals.Rd
+@@ -26,15 +26,6 @@
+ \alias{make_XStringSet_from_strings}
+ \alias{make_XStringSet_from_strings,XStringSet-method}
+ 
+-% SparseList class and methods:
+-\alias{class:SparseList}
+-\alias{SparseList-class}
+-\alias{SparseList}
+-
+-\alias{length,SparseList-method}
+-%\alias{ls,SparseList-method}
+-\alias{as.list,SparseList-method}
+-\alias{[[,SparseList-method}
+ 
+ \title{Biostrings internals}
+ 
+diff --git a/src/Biostrings.h b/src/Biostrings.h
+index 6e725bd5..e86d0ff2 100644
+--- a/src/Biostrings.h
++++ b/src/Biostrings.h
+@@ -446,40 +446,6 @@ SEXP XStringSetList_unstrsplit(
+ );
+ 
+ 
+-/* SparseList_utils.c */
+-
+-SEXP _SparseList_int2symb(int symb_as_int);
+-
+-int _SparseList_symb2int(SEXP symbol);
+-
+-SEXP _get_val_from_env(
+-	SEXP symbol,
+-	SEXP env,
+-	int error_on_unbound_value
+-);
+-
+-SEXP _get_val_from_SparseList(
+-	int symb_as_int,
+-	SEXP env,
+-	int error_on_unbound_value
+-);
+-
+-int _get_int_from_SparseList(
+-	int symb_as_int,
+-	SEXP env
+-);
+-
+-void _set_env_from_IntAE(
+-	SEXP env,
+-	const IntAE *int_ae
+-);
+-
+-void _set_env_from_IntAEAE(
+-	SEXP env,
+-	const IntAEAE *int_aeae
+-);
+-
+-
+ /* match_reporting.c */
+ 
+ int _get_match_storing_code(const char *ms_mode);
+@@ -558,13 +524,6 @@ SEXP ByPos_MIndex_endIndex(
+ 	SEXP x_width0
+ );
+ 
+-SEXP SparseMIndex_endIndex(
+-	SEXP x_ends_envir,
+-	SEXP x_width0,
+-	SEXP x_names,
+-	SEXP all_names
+-);
+-
+ SEXP ByPos_MIndex_combine(SEXP ends_listlist);
+ 
+ 
+diff --git a/src/MIndex_class.c b/src/MIndex_class.c
+index 00212fe9..dd6ad546 100644
+--- a/src/MIndex_class.c
++++ b/src/MIndex_class.c
+@@ -157,73 +157,6 @@ SEXP ByPos_MIndex_endIndex(SEXP x_high2low, SEXP x_ends, SEXP x_width0)
+ 	return ans;
+ }
+ 
+-/*
+- * --- .Call ENTRY POINT ---
+- * All the keys in 'x_ends_envir' must be representing integers left-padded with 0s
+- * so they have the same length. This works properly:
+-     library(Biostrings)
+-     ends_envir <- new.env(parent=emptyenv())
+-     ends_envir[['0000000010']] <- -2:1
+-     ends_envir[['0000000004']] <- 9:6
+-     .Call("SparseMIndex_endIndex",
+-           ends_envir, NULL, letters[1:10], TRUE,
+-           PACKAGE="Biostrings")
+-     .Call("SparseMIndex_endIndex",
+-           ends_envir, NULL, letters[1:10], FALSE,
+-           PACKAGE="Biostrings")
+- * but this doesn't:
+-     ends_envir[['3']] <- 33L
+-     .Call("SparseMIndex_endIndex",
+-           ends_envir, NULL, letters[1:10], FALSE,
+-           PACKAGE="Biostrings")
+- */
+-SEXP SparseMIndex_endIndex(SEXP x_ends_envir, SEXP x_width0, SEXP x_names, SEXP all_names)
+-{
+-	SEXP ans, ans_elt, ans_names, symbols, end;
+-	int nelt, i, j;
+-	IntAE *poffsets, *poffsets_order;
+-
+-	PROTECT(symbols = R_lsInternal(x_ends_envir, 1));
+-	poffsets = new_IntAE_from_CHARACTER(symbols, -1);
+-	nelt = IntAE_get_nelt(poffsets);
+-	if (LOGICAL(all_names)[0]) {
+-		PROTECT(ans = NEW_LIST(LENGTH(x_names)));
+-		for (i = 0; i < nelt; i++) {
+-			j = poffsets->elts[i];
+-			end = _get_val_from_env(STRING_ELT(symbols, i), x_ends_envir, 1);
+-			PROTECT(ans_elt = duplicate(end));
+-			if (x_width0 != R_NilValue)
+-				add_val_to_INTEGER(ans_elt, 1 - INTEGER(x_width0)[j]);
+-			SET_ELEMENT(ans, j, ans_elt);
+-			UNPROTECT(1);
+-		}
+-		SET_NAMES(ans, duplicate(x_names));
+-		UNPROTECT(1);
+-	} else {
+-		//poffsets_order = new_IntAE(nelt, 0, 0);
+-		//get_order_of_int_array(poffsets->elts, nelt, 0, 0,
+-		//		       poffsets_order->elts, 0);
+-		//IntAE_set_nelt(poffsets_order) = nelt; /* = poffsets_order->_buflength */
+-		PROTECT(ans = NEW_LIST(nelt));
+-		PROTECT(ans_names = NEW_CHARACTER(nelt));
+-		for (i = 0; i < nelt; i++) {
+-			//j = poffsets_order->elts[i];
+-			j = i;
+-			end = _get_val_from_env(STRING_ELT(symbols, j), x_ends_envir, 1);
+-			PROTECT(ans_elt = duplicate(end));
+-			if (x_width0 != R_NilValue)
+-				add_val_to_INTEGER(ans_elt, 1 - INTEGER(x_width0)[i]);
+-			SET_ELEMENT(ans, i, ans_elt);
+-			UNPROTECT(1);
+-			SET_STRING_ELT(ans_names, i, duplicate(STRING_ELT(x_names, poffsets->elts[j])));
+-		}
+-		SET_NAMES(ans, ans_names);
+-		UNPROTECT(2);
+-	}
+-	UNPROTECT(1);
+-	return ans;
+-}
+-
+ /*
+  * --- .Call ENTRY POINT ---
+  */
+diff --git a/src/R_init_Biostrings.c b/src/R_init_Biostrings.c
+index 4d2943f8..c1410dbd 100644
+--- a/src/R_init_Biostrings.c
++++ b/src/R_init_Biostrings.c
+@@ -88,7 +88,6 @@ static const R_CallMethodDef callMethods[] = {
+ 
+ /* MIndex_class.c */
+ 	CALLMETHOD_DEF(ByPos_MIndex_endIndex, 3),
+-	CALLMETHOD_DEF(SparseMIndex_endIndex, 4),
+ 	CALLMETHOD_DEF(ByPos_MIndex_combine, 1),
+ 
+ /* lowlevel_matching.c */
+diff --git a/src/SparseList_utils.c b/src/SparseList_utils.c
+deleted file mode 100644
+index 18597b55..00000000
+--- a/src/SparseList_utils.c
++++ /dev/null
+@@ -1,113 +0,0 @@
+-/****************************************************************************
+- *                        Fast SparseList utilities                         *
+- *                            Author: H. Pag\`es                            *
+- ****************************************************************************/
+-#include "Biostrings.h"
+-#include "S4Vectors_interface.h"
+-
+-
+-SEXP _SparseList_int2symb(int symb_as_int)
+-{
+-	char symbbuf[11];
+-
+-	snprintf(symbbuf, sizeof(symbbuf), "%010d", symb_as_int);
+-	return mkChar(symbbuf); /* UNPROTECTED! */
+-}
+-
+-int _SparseList_symb2int(SEXP symbol)
+-{
+-	int symb_as_int;
+-
+-	sscanf(CHAR(symbol), "%d", &symb_as_int);
+-	return symb_as_int;
+-}
+-
+-/* 'symbol' must be a CHARSXP */
+-SEXP _get_val_from_env(SEXP symbol, SEXP env, int error_on_unbound_value)
+-{
+-	SEXP ans;
+-
+-	/* The following code was inspired by R's do_get() code.
+-	 * Note that do_get() doesn't use PROTECT at all and so do we...
+-	 */
+-	ans = findVar(install(translateChar(symbol)), env);
+-	if (ans == R_UnboundValue) {
+-		if (error_on_unbound_value)
+-			error("Biostrings internal error in _get_val_from_env(): "
+-			      "unbound value");
+-		return R_UnboundValue;
+-	}
+-	if (TYPEOF(ans) == PROMSXP)
+-		ans = eval(ans, env);
+-	if (ans != R_NilValue && NAMED(ans) == 0)
+-		SET_NAMED(ans, 1);
+-	return ans;
+-}
+-
+-SEXP _get_val_from_SparseList(int symb_as_int, SEXP env, int error_on_unbound_value)
+-{
+-	SEXP symbol, ans;
+-
+-	PROTECT(symbol = _SparseList_int2symb(symb_as_int));
+-	ans = _get_val_from_env(symbol, env, error_on_unbound_value);
+-	UNPROTECT(1);
+-	return ans;
+-}
+-
+-int _get_int_from_SparseList(int symb_as_int, SEXP env)
+-{
+-	SEXP value;
+-	int val;
+-
+-	value = _get_val_from_SparseList(symb_as_int, env, 0);
+-	if (value == R_UnboundValue)
+-		return NA_INTEGER;
+-	if (LENGTH(value) != 1)
+-		error("Biostrings internal error in _get_int_from_SparseList(): "
+-		      "value is not a single integer");
+-	val = INTEGER(value)[0];
+-	if (val == NA_INTEGER)
+-		error("Biostrings internal error in _get_int_from_SparseList(): "
+-		      "value is NA");
+-	return val;
+-}
+-
+-void _set_env_from_IntAE(SEXP env, const IntAE *int_ae)
+-{
+-	int nelt, symb_as_int, elt;
+-	SEXP symbol, value;
+-
+-	nelt = IntAE_get_nelt(int_ae);
+-	for (symb_as_int = 1; symb_as_int <= nelt; symb_as_int++)
+-	{
+-		elt = int_ae->elts[symb_as_int - 1];
+-		if (elt == NA_INTEGER)
+-			continue;
+-		PROTECT(symbol = _SparseList_int2symb(symb_as_int));
+-		PROTECT(value = ScalarInteger(elt));
+-		defineVar(install(translateChar(symbol)), value, env);
+-		UNPROTECT(2);
+-	}
+-	return;
+-}
+-
+-void _set_env_from_IntAEAE(SEXP env, const IntAEAE *int_aeae)
+-{
+-	int nelt, symb_as_int;
+-	IntAE *ae;
+-	SEXP symbol, value;
+-
+-	nelt = IntAEAE_get_nelt(int_aeae);
+-	for (symb_as_int = 1; symb_as_int <= nelt; symb_as_int++)
+-	{
+-		ae = int_aeae->elts[symb_as_int - 1];
+-		if (IntAE_get_nelt(ae) == 0)
+-			continue;
+-		PROTECT(symbol = _SparseList_int2symb(symb_as_int));
+-		PROTECT(value = new_INTEGER_from_IntAE(ae));
+-		defineVar(install(translateChar(symbol)), value, env);
+-		UNPROTECT(2);
+-	}
+-	return;
+-}
+-

gnu/packages/patches/r-h5mread-0001-h5mread-1.3.2-Get-rid-of-non-API-calls-to-R.patch

@@ -0,0 +1,142 @@
+From 7fe34542bff0183c3a6a35a62df9035a71698eb2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 15:54:23 -0800
+Subject: [PATCH] h5mread 1.3.2: Get rid of non-API calls to R
+
+---
+ DESCRIPTION                |  2 +-
+ R/H5File-class.R           | 27 ++++++++++++++++-----------
+ src/h5mread_index.c        |  5 +++--
+ src/h5mread_startscounts.c |  3 ++-
+ 4 files changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/R/H5File-class.R b/R/H5File-class.R
+index 2735166..6aeb80f 100644
+--- a/R/H5File-class.R
++++ b/R/H5File-class.R
+@@ -73,19 +73,23 @@
+     }
+ }
+ 
+-.h5openfile <- function(filepath, s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
++.h5openfile <- function(filepath, readonly=TRUE,
++                        s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
+ {
+     if (!isSingleString(filepath))
+         stop(wmsg("'filepath' must be a single string specifying ",
+                   "the path or URL to an HDF5 file"))
++    if (!isTRUEorFALSE(readonly))
++        stop(wmsg("'readonly' must be TRUE or FALSE"))
+     if (!isTRUEorFALSE(s3))
+         stop(wmsg("'s3' must be TRUE or FALSE"))
+-
++    if (s3 && !readonly)
++        stop(wmsg("'readonly' must be set to TRUE when 's3' is TRUE"))
+     if (s3) {
+         ID <- .h5openS3file(filepath, s3credentials=s3credentials,
+                                       use.rhdf5=use.rhdf5)
+     } else {
+-        ID <- .h5openlocalfile(filepath, readonly=TRUE, use.rhdf5=use.rhdf5)
++        ID <- .h5openlocalfile(filepath, readonly=readonly, use.rhdf5=use.rhdf5)
+     }
+     ID
+ }
+@@ -136,16 +140,16 @@
+ 
+ .ID_is_closed <- function(ID) { is.null(ID) || is.na(ID) }
+ 
+-.open_H5FileID_xp <- function(xp, filepath, s3=FALSE, s3credentials=NULL,
+-                                            use.rhdf5=FALSE)
++.open_H5FileID_xp <- function(xp, filepath, readonly=TRUE,
++                              s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
+ {
+     ID <- .get_H5FileID_xp_ID(xp)
+     if (!.ID_is_closed(ID)) {
+         ## H5FileID object is already open.
+         return(FALSE)
+     }
+-    ID <- .h5openfile(filepath, s3=s3, s3credentials=s3credentials,
+-                                use.rhdf5=use.rhdf5)
++    ID <- .h5openfile(filepath, readonly=readonly,
++                      s3=s3, s3credentials=s3credentials, use.rhdf5=use.rhdf5)
+     .set_H5FileID_xp_ID(xp, ID)
+     TRUE
+ }
+@@ -183,10 +187,11 @@ close.H5FileID <- function(con, ...)
+     .close_H5FileID_xp(con@xp, ..., use.rhdf5=con@from_rhdf5)
+ }
+ 
+-H5FileID <- function(filepath, s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
++H5FileID <- function(filepath, readonly=TRUE,
++                     s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
+ {
+-    ID <- .h5openfile(filepath, s3=s3, s3credentials=s3credentials,
+-                                use.rhdf5=use.rhdf5)
++    ID <- .h5openfile(filepath, readonly=readonly,
++                      s3=s3, s3credentials=s3credentials, use.rhdf5=use.rhdf5)
+     xp <- .new_H5FileID_xp(ID)
+     reg.finalizer(xp,
+                   function(e) .close_H5FileID_xp(e, use.rhdf5=use.rhdf5),
+@@ -272,7 +277,7 @@ H5File <- function(filepath, s3=FALSE, s3credentials=NULL, .no_rhdf5_h5id=FALSE)
+         rhdf5_h5id <- new("H5FileID")
+     } else {
+         rhdf5_h5id <- H5FileID(filepath, s3=s3, s3credentials=s3credentials,
+-                                         use.rhdf5=TRUE)
++                               use.rhdf5=TRUE)
+     }
+     if (!s3)
+         filepath <- file_path_as_absolute(filepath)
+diff --git a/src/h5mread_index.c b/src/h5mread_index.c
+index 7284815..ec93c25 100644
+--- a/src/h5mread_index.c
++++ b/src/h5mread_index.c
+@@ -9,6 +9,7 @@
+ #include "h5mread_helpers.h"
+ #include "TouchedChunks.h"
+ 
++#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <stdlib.h>  /* for malloc, free */
+ #include <string.h>  /* for memcmp */
+ //#include <time.h>
+@@ -444,7 +445,7 @@ static int read_chunk_data_4_5(const H5DSetDescriptor *h5dset,
+ 		const size_t *Rarray_dim, SEXP Rarray,
+ 		int method, int use_H5Dread_chunk)
+ {
+-	void *out = DATAPTR(Rarray);
++	void *out = DATAPTR_RW(Rarray);
+ 	if (out == NULL)
+ 		return -1;
+ 
+@@ -874,7 +875,7 @@ static int read_data_6(const AllTChunks *all_tchunks,
+ 	size_t *inner_nchip_buf = R_alloc0_size_t_array(ndim);
+ 	LLongAEAE *inner_breakpoint_bufs = new_LLongAEAE(ndim, ndim);
+ 
+-	void *out = DATAPTR(Rarray);
++	void *out = DATAPTR_RW(Rarray);
+ 	if (out == NULL) {
+ 		_destroy_TChunkIterator(&tchunk_iter);
+ 		return -1;
+diff --git a/src/h5mread_startscounts.c b/src/h5mread_startscounts.c
+index de57fd5..959014f 100644
+--- a/src/h5mread_startscounts.c
++++ b/src/h5mread_startscounts.c
+@@ -8,6 +8,7 @@
+ #include "uaselection.h"
+ #include "h5mread_helpers.h"
+ 
++#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <stdlib.h>  /* for malloc, free */
+ //#include <time.h>
+ 
+@@ -402,7 +403,7 @@ SEXP _h5mread_startscounts(const H5DSetDescriptor *h5dset,
+ 	SEXP ans = PROTECT(allocVector(h5dset->h5type->Rtype, ans_len));
+ 
+ 	if (ans_len != 0) {
+-		void *mem = DATAPTR(ans);
++		void *mem = DATAPTR_RW(ans);
+ 		if (mem == NULL)
+ 			goto on_error;
+ 
+-- 
+2.52.0
+

gnu/packages/patches/r-mscoreutils-0001-fix-non-API-call-to-R-SETLENGTH-by-using-lengthgets.patch

@@ -0,0 +1,67 @@
+From a827c9fdeb77edefe6cca81bdb9e0344bc8d3742 Mon Sep 17 00:00:00 2001
+From: Sebastian Gibb <mail@sebastiangibb.de>
+Date: Sat, 13 Dec 2025 23:06:12 +0100
+Subject: [PATCH] fix: non-API call to R: SETLENGTH by using lengthgets
+
+---
+ DESCRIPTION  |  2 +-
+ NEWS.md      |  6 ++++++
+ src/join.c   | 12 ++++--------
+ src/reduce.c |  6 ++----
+ 4 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/src/join.c b/src/join.c
+index f13a703..3849fdf 100644
+--- a/src/join.c
++++ b/src/join.c
+@@ -111,12 +111,10 @@ SEXP C_join_inner(SEXP x, SEXP y, SEXP tolerance, SEXP nomatch) {
+             ++j;
+         }
+     }
+-    SETLENGTH(rx, j);
+-    SETLENGTH(ry, j);
+     SEXP out = PROTECT(allocVector(VECSXP, 2));
+     SEXP nms = PROTECT(allocVector(STRSXP, 2));
+-    SET_VECTOR_ELT(out, 0, rx);
+-    SET_VECTOR_ELT(out, 1, ry);
++    SET_VECTOR_ELT(out, 0, lengthgets(rx, j));
++    SET_VECTOR_ELT(out, 1, lengthgets(ry, j));
+     SET_STRING_ELT(nms, 0, mkChar("x"));
+     SET_STRING_ELT(nms, 1, mkChar("y"));
+     setAttrib(out, R_NamesSymbol, nms);
+@@ -201,12 +199,10 @@ SEXP C_join_outer(SEXP x, SEXP y, SEXP tolerance, SEXP nomatch) {
+         ++i;
+     }
+ 
+-    SETLENGTH(rx, i);
+-    SETLENGTH(ry, i);
+     SEXP out = PROTECT(allocVector(VECSXP, 2));
+     SEXP nms = PROTECT(allocVector(STRSXP, 2));
+-    SET_VECTOR_ELT(out, 0, rx);
+-    SET_VECTOR_ELT(out, 1, ry);
++    SET_VECTOR_ELT(out, 0, lengthgets(rx, i));
++    SET_VECTOR_ELT(out, 1, lengthgets(ry, i));
+     SET_STRING_ELT(nms, 0, mkChar("x"));
+     SET_STRING_ELT(nms, 1, mkChar("y"));
+     setAttrib(out, R_NamesSymbol, nms);
+diff --git a/src/reduce.c b/src/reduce.c
+index 5f87966..8e48058 100644
+--- a/src/reduce.c
++++ b/src/reduce.c
+@@ -66,11 +66,9 @@ SEXP C_reduce(SEXP start, SEXP end, SEXP check) {
+         }
+     }
+ 
+-    SETLENGTH(rs, pos + 1);
+-    SETLENGTH(re, pos + 1);
+     SEXP out = PROTECT(allocVector(VECSXP, 2));
+-    SET_VECTOR_ELT(out, 0, rs);
+-    SET_VECTOR_ELT(out, 1, re);
++    SET_VECTOR_ELT(out, 0, lengthgets(rs, pos + 1));
++    SET_VECTOR_ELT(out, 1, lengthgets(re, pos + 1));
+ 
+     UNPROTECT(4);
+ 
+-- 
+2.52.0
+

gnu/packages/patches/r-rsamtools-r-4.6.0-compat.patch

@@ -0,0 +1,114 @@
+From 57dc6579d8b53af9e633016705fa9a1cbe58c8c8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 16:48:20 -0800
+Subject: [PATCH] Rsamtools 2.27.1: Get rid of non-API calls to R
+
+---
+ DESCRIPTION     | 2 +-
+ src/utilities.h | 3 +--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/utilities.h b/src/utilities.h
+index bffb98f7..f9d5e09f 100644
+--- a/src/utilities.h
++++ b/src/utilities.h
+@@ -51,8 +51,7 @@ SEXP find_mate_within_groups(SEXP group_sizes,
+ /* call-building macros */
+ 
+ #define NEW_CALL(S, T, NAME, ENV, N)            \
+-    PROTECT(S = T = allocList(N));              \
+-    SET_TYPEOF(T, LANGSXP);                     \
++    PROTECT(S = T = LCONS(R_NilValue, allocList(N-1))); \
+     SETCAR(T, findFun(install(NAME), ENV));     \
+     T = CDR(T)
+ #define CSET_CDR(T, NAME, VALUE)                \
+
+From 8cdec143023e8348a4f8bdc310acd609d14fe493 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 16:59:42 -0800
+Subject: [PATCH] oops, forgot to also get rid of non-API call to FORMALS()
+
+---
+ src/pileupbam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pileupbam.c b/src/pileupbam.c
+index f3256ba..7725628 100644
+--- a/src/pileupbam.c
++++ b/src/pileupbam.c
+@@ -655,7 +655,7 @@ SEXP apply_pileups(SEXP files, SEXP names, SEXP regions, SEXP param,
+     if (R_NilValue == regions)
+         Rf_error("'NULL' regions not (yet) supported");
+     _checkparams(regions, R_NilValue, R_NilValue);
+-    if (!Rf_isFunction(callback) || 1L != Rf_length(FORMALS(callback)))
++    if (!Rf_isFunction(callback) || 1L != Rf_length(R_ClosureFormals(callback)))
+         Rf_error("'callback' must be a function of 1 argument");
+     call = PROTECT(Rf_lang2(callback, R_NilValue));
+ 
+
+From ee01a1f13f3b012b0717247d1f21580225b6f3a0 Mon Sep 17 00:00:00 2001
+From: vjcitn <stvjc@channing.harvard.edu>
+Date: Wed, 8 Apr 2026 14:04:26 -0400
+Subject: [PATCH] API solutions
+
+---
+ DESCRIPTION     |  2 +-
+ src/tabixfile.c |  4 ++++
+ src/utilities.c | 13 ++++++++++---
+ 3 files changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/src/tabixfile.c b/src/tabixfile.c
+index 230a381..6f96568 100644
+--- a/src/tabixfile.c
++++ b/src/tabixfile.c
+@@ -187,8 +187,12 @@ SEXP index_tabix(SEXP filename, SEXP format, SEXP seq, SEXP begin, SEXP end,
+         LOGICAL(zeroBased)[0] == TRUE)
+         conf.preset |= TBX_UCSC;
+ 
++/* following is deprecated in HTSLIB with no precise replacement proposed */
++/* seems unimportant */
++/*
+     if (bgzf_is_bgzf(fn) != 1)
+         Rf_error("file does not appear to be bgzip'd");
++*/
+     if (tbx_index_build(fn, 0, &conf) == -1)
+         Rf_error("index build failed");
+ 
+diff --git a/src/utilities.c b/src/utilities.c
+index e224f91..d15c1d1 100644
+--- a/src/utilities.c
++++ b/src/utilities.c
+@@ -5,6 +5,13 @@
+ #include "XVector_interface.h"
+ #include <htslib/khash.h>
+ 
++#include <Rversion.h>
++
++#if R_VERSION < R_Version(4, 6, 0)
++# define R_getVar(x,y,z) findVar(x,y)
++#endif
++
++
+ void *_Rs_Realloc_impl(void *p, size_t n, size_t t)
+ {
+     /* R_Realloc(p, 0, *) fails inappropriately */
+@@ -30,7 +37,7 @@ SEXP _get_namespace(const char *pkg)
+ void _as_strand(SEXP vec)
+ {
+     SEXP nmspc = PROTECT(_get_namespace("Rsamtools"));
+-    SEXP lvls = PROTECT(eval(findVar(install(".STRAND_LEVELS"), nmspc), nmspc));
++    SEXP lvls = PROTECT(eval(R_getVar(install(".STRAND_LEVELS"), nmspc, TRUE), nmspc));
+     _as_factor_SEXP(vec, lvls);
+     UNPROTECT(2);
+ }
+@@ -38,8 +45,8 @@ void _as_strand(SEXP vec)
+ void _as_nucleotide(SEXP vec)
+ {
+     SEXP nmspc = PROTECT(_get_namespace("Rsamtools"));
+-    SEXP lvls = PROTECT(eval(findVar(install(".PILEUP_NUCLEOTIDE_LEVELS"),
+-                                     nmspc), nmspc));
++    SEXP lvls = PROTECT(eval(R_getVar(install(".PILEUP_NUCLEOTIDE_LEVELS"),
++                                     nmspc, TRUE), nmspc));
+     _as_factor_SEXP(vec, lvls);
+     UNPROTECT(2);
+ }

gnu/packages/patches/r-shortread-0001-ShortRead-1.69.3-Get-rid-of-non-API-calls-to-R.patch

@@ -0,0 +1,103 @@
+From e39852a54312bbc6ba435848890cc2a7f612357c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 17:04:19 -0800
+Subject: [PATCH] ShortRead 1.69.3: Get rid of non-API calls to R
+
+---
+ DESCRIPTION |  2 +-
+ src/call.h  |  3 +--
+ src/io.c    | 10 +++++-----
+ 3 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/src/call.h b/src/call.h
+index e15bb5e..e72bbd6 100644
+--- a/src/call.h
++++ b/src/call.h
+@@ -6,8 +6,7 @@ extern "C" {
+ #endif
+ 
+ #define NEW_CALL(S, T, NAME, ENV, N)				\
+-    PROTECT((S) = (T) = allocList((N)));			\
+-    SET_TYPEOF((T), LANGSXP);                                   \
++    PROTECT((S) = (T) = LCONS(R_NilValue, allocList((N)-1)));	\
+     SETCAR((T), findFun(install((NAME)), (ENV)));               \
+     (T) = CDR((T))
+ #define CSET_CDR(T, NAME, VALUE)				\
+diff --git a/src/io.c b/src/io.c
+index 25a0111..9cf4bf8 100644
+--- a/src/io.c
++++ b/src/io.c
+@@ -46,9 +46,9 @@ SEXP write_fastq(SEXP id, SEXP sread, SEXP quality,
+                  SEXP fname, SEXP fmode, SEXP full, SEXP compress,
+                  SEXP max_width)
+ {
+-    if (!(IS_S4_OBJECT(id) && strcmp(get_classname(id), "BStringSet") == 0))
++    if (!(Rf_isS4(id) && strcmp(get_classname(id), "BStringSet") == 0))
+         Rf_error("'%s' must be '%s'", "id", "BStringSet");
+-    if (!(IS_S4_OBJECT(sread) &&
++    if (!(Rf_isS4(sread) &&
+           strcmp(get_classname(sread), "DNAStringSet") == 0))
+         Rf_error("'%s' must be '%s'", "sread", "DNAStringSet");
+     /* check in R -- C-level R_check_super... is not adequate */
+@@ -693,14 +693,14 @@ int _solexa_export_make_id(SEXP result)
+         *x = INTEGER(VECTOR_ELT(result, SLX_X)),
+         *y = INTEGER(VECTOR_ELT(result, SLX_Y)), *pairedReadNumber = NULL;
+     const SEXP
+-        * run = STRING_PTR(VECTOR_ELT(result, SLX_RUN)),
++        * run = STRING_PTR_RO(VECTOR_ELT(result, SLX_RUN)),
+         *multiplexIndex = NULL,
+-        *machine = STRING_PTR(VECTOR_ELT(result, SLX_MACHINE));
++        *machine = STRING_PTR_RO(VECTOR_ELT(result, SLX_MACHINE));
+     const Rboolean
+         withMultiplexIndex = R_NilValue != VECTOR_ELT(result, SLX_MULTIPLEX),
+         withPairedReadNumber = R_NilValue != VECTOR_ELT(result, SLX_PAIRID);
+     if (withMultiplexIndex)
+-        multiplexIndex = STRING_PTR(VECTOR_ELT(result, SLX_MULTIPLEX));
++        multiplexIndex = STRING_PTR_RO(VECTOR_ELT(result, SLX_MULTIPLEX));
+     if (withPairedReadNumber)
+         pairedReadNumber = INTEGER(VECTOR_ELT(result, SLX_PAIRID));
+ 
+-- 
+2.52.0
+
+
+From 2e3368a35e3955a0a92b7f3e2c8dface6709d135 Mon Sep 17 00:00:00 2001
+From: vjcitn <stvjc@channing.harvard.edu>
+Date: Thu, 16 Apr 2026 16:54:15 +0000
+Subject: [PATCH] fixapi
+
+---
+ src/util.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/util.c b/src/util.c
+index 4a10a90..59c089b 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -6,6 +6,14 @@ unsigned char _bDecode(char);
+ unsigned char _dnaDecode(char);
+ unsigned char _rnaDecode(char);
+ 
++
++#include <Rversion.h>
++
++#if R_VERSION < R_Version(4, 6, 0)
++# define R_getVar(x,y,z) findVar(x,y)
++#endif
++
++
+ /*
+  * Encode / decode XString wrappers
+  */
+@@ -80,7 +88,7 @@ SEXP _get_namespace(const char *pkg)
+ SEXP _get_strand_levels()
+ {
+     SEXP nmspc = PROTECT(_get_namespace("ShortRead"));
+-    SEXP ans = eval(findVar(install(".STRAND_LEVELS"), nmspc), nmspc);
++    SEXP ans = eval(R_getVar(install(".STRAND_LEVELS"), nmspc, TRUE), nmspc);
+     UNPROTECT(1);
+     return ans;
+ }
+-- 
+2.52.0
+