fix: preserve substituter trace ordering

Drain pending substituter stderr before waking a substitution goal after the fd 4 status reply. This avoids daemon-side substituter-succeeded traces overtaking the child's final download progress trace on the client status stream. Recheck descriptor readiness before reads because draining one descriptor can consume readiness observed by the worker's earlier select call.
fix: ignore invalid Guix progress updates
2026-07-15 19:24:08 +02:00 · 2026-05-18 22:56:17 +02:00 · 2026-05-17 09:59:53 +02:00 · 2026-05-17 09:59:47 +02:00 · 2026-05-17 01:42:12 +02:00 · 2026-05-16 00:43:24 +02:00
149 changed files with 63301 additions and 12901 deletions
@@ -16,6 +16,8 @@
  ( ;; primary: "D0C2 EAC1 3310 822D 98DE  B57C E9C5 A2D9 0898 A02F"
   "01FD 85F4 1A7B 7F82 0583  06A5 935E BE07 36DC 857E"
   (name "avp"))
+  ("5D54 CF25 57B2 38E8 8DC1  80A2 2D22 3241 0AB7 4043"
+   (name "baleine"))
  ( ;; primary: "34FF 38BC D151 25A6 E340  A0B5 3453 2F9F AFCA 8B8E"
   "A3A4 B419 0074 087C A7DE  5698 BC45 CA67 E2F8 D007"
   (name "bavier"))
@@ -118,6 +120,8 @@
   (name "sharlatan"))
  ("F494 72F4 7A59 00D5 C235  F212 89F9 6D48 08F3 59C7"
   (name "snape"))
+  ("6688 9153 C51C 4613 A493  A525 2F0D FD14 EF99 DAC3"
+   (name "steffen"))
  ("6580 7361 3BFC C5C7 E2E4  5D45 DC51 8FC8 7F97 16AA"
   (name "vagrantc"))
  (;; primary: "C955 CC5D C048 7FB1 7966  40A9 199A F6A3 67E9 4ABB"
@@ -274,6 +274,7 @@ guix/build-system/ant\.scm                         @guix/java
 guix/build-system/clojure\.scm                     @guix/java
 guix/build-system/maven\.scm                       @guix/java

+gnu/packages/javascript\.scm                       @guix/javascript
 gnu/packages/node-xyz\.scm                         @guix/javascript
 gnu/packages/node\.scm                             @guix/javascript
 guix/build-system/node\.scm                        @guix/javascript
@@ -457,6 +457,8 @@ AUX_FILES =						\
  gnu/packages/aux-files/findclass.php			\
  gnu/packages/aux-files/guix.vim			\
  gnu/packages/aux-files/guix-nvim.vim			\
+  gnu/packages/aux-files/linux-libre/7.0-arm64.conf	\
+  gnu/packages/aux-files/linux-libre/7.0-x86_64.conf	\
  gnu/packages/aux-files/linux-libre/6.19-arm64.conf	\
  gnu/packages/aux-files/linux-libre/6.19-i686.conf	\
  gnu/packages/aux-files/linux-libre/6.19-x86_64.conf	\
@@ -3256,8 +3256,8 @@ your Linode Summary section.) Now you can run the "install guix from

@example
 sudo apt-get install gpg
-wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
-wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
+wget https://codeberg.org/efraim.gpg -qO - | gpg --import -
+wget https://guix.gnu.org/guix-install.sh
 chmod +x guix-install.sh
 ./guix-install.sh
 guix pull
@@ -3436,7 +3436,7 @@ Now you can run the "install guix from @pxref{Binary Installation,,,
 guix, GNU Guix}" steps:

@example
-wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
+wget https://guix.gnu.org/guix-install.sh
 chmod +x guix-install.sh
 ./guix-install.sh
 guix pull
@@ -4491,7 +4491,7 @@ network.  Assuming your interface is named @samp{enp2s0}, the following
 command can be used to do so:

@example sh
-# nmcli con add type bridge-slave ifname enp2s0 master br0
+# nmcli con add type bridge-slave autoconnect yes ifname enp2s0 master br0
@end example

@quotation Important
@@ -4527,8 +4527,8 @@ bridge interface, as the default is to deny all.  Add the following to
 your list of services to do so:

@example lisp
-(extra-special-file "/etc/qemu/host.conf"
-                    (plain-file "host.conf" "allow br0\n"))
+(extra-special-file "/etc/qemu/bridge.conf"
+                    (plain-file "bridge.conf" "allow br0\n"))
@end example

@subsection Invoking QEMU with the right command line options
@@ -4546,7 +4546,7 @@ machine making use of the bridge would cause networking issues.
@example sh
 $ qemu-system-x86_64 [...] \
    -device virtio-net-pci,netdev=user0,mac=XX:XX:XX:XX:XX:XX \
-    -netdev bridge,id=user0,br=br0 \
+    -netdev bridge,helper=/run/privileged/bin/qemu-bridge-helper,id=user0,br=br0 \
    [...]
@end example

@@ -10,8 +10,8 @@
@include version.texi

@c Identifier of the OpenPGP key used to sign tarballs and such.
-@set OPENPGP-SIGNING-KEY-ID 3CE464558A84FDC69DB40CFB090B11993D9AEBB5
-@set OPENPGP-SIGNING-KEY-URL https://sv.gnu.org/people/viewgpg.php?user_id=15145
+@set OPENPGP-SIGNING-KEY-ID A28BF40C3E551372662D14F741AAE7DCCA3D8351
+@set OPENPGP-SIGNING-KEY-URL https://codeberg.org/efraim.gpg

@c Base URL for downloads.
@set BASE-URL https://ftpmirror.gnu.org/gnu/guix
@@ -2658,12 +2658,13 @@ bootloaders.

 Once you are done partitioning the target hard disk drive, you have to
 create a file system on the relevant partition(s)@footnote{Currently
-Guix System supports only ext4, btrfs, bcachefs, JFS, F2FS, and XFS
-file systems.  In particular, code that reads file system UUIDs and
-labels works only for these file system types.  For bcachefs, also add
-the @code{bcachefs-linux-module} to your @code{operating-system}'s
-@code{initrd-modules}.}.  For the ESP, if you have one and assuming it is
-@file{/dev/sda1}, run:
+Guix System can mount only ext4, btrfs, JFS, F2FS, and XFS file systems
+at boot time.  In particular, code that reads file system UUIDs and
+labels works only for these file system types.  The code for bcachefs is
+in place, but support for loading out-of-tree kernel modules in the
+initrd is not.}.
+
+For the ESP, if you have one and assuming it is @file{/dev/sda1}, run:

@example
 mkfs.fat -F32 /dev/sda1
@@ -6590,6 +6591,21 @@ directory within the container.  If this is undesirable,
 be automatically shared and will change to the user's home directory
 within the container instead.  See also @option{--user}.

+@item --cwd=@var{directory}
+For containers, change to @var{directory} inside the container instead
+of the default location.  The default location is the current working
+directory when @option{--no-cwd} is not used, or the user's home
+directory when @option{--no-cwd} is used.  When @var{directory} is a
+relative file name, it is interpreted relative to the current working
+directory on the host.  Note that @option{--cwd} does not automatically
+share @var{directory}---you must ensure it is accessible via the default
+current directory sharing or explicit @option{--share}/@option{--expose}
+options.  For example:
+
+@example
+guix shell --container --cwd=/tmp --share=/tmp coreutils
+@end example
+
@item --writable-root
 When using @option{--container}, this option makes the root file system
 writable (it is read-only by default).
@@ -7091,6 +7107,17 @@ directory within the container.  If this is undesirable,
 be automatically shared and will change to the user's home directory
 within the container instead.  See also @option{--user}.

+@item --cwd=@var{directory}
+For containers, change to @var{directory} inside the container instead
+of the default location.  The default location is the current working
+directory when @option{--no-cwd} is not used, or the user's home
+directory when @option{--no-cwd} is used.  When @var{directory} is a
+relative file name, it is interpreted relative to the current working
+directory on the host.  Note that @option{--cwd} does not automatically
+share @var{directory}---you must ensure it is accessible via the default
+current directory sharing or explicit @option{--share}/@option{--expose}
+options.
+
@item --expose=@var{source}[=@var{target}]
@itemx --share=@var{source}[=@var{target}]
 For containers, @option{--expose} (resp. @option{--share}) exposes the
@@ -14857,7 +14884,7 @@ provided through NuGet's v3 API at @code{api.nuget.org} and includes
 most relevant information, including package dependencies.
 There are some caveats, however.  The metadata does not always include
 repository information, in which case the importer attempts to extract
-it from the symbol package (@file{.snupkg}) if available. 
+it from the symbol package (@file{.snupkg}) if available.
 Additionally, dependencies are grouped by target framework in NuGet,
 but the importer flattens all dependency groups into a single list.

@@ -19215,7 +19242,7 @@ Partitioning}, for an example.

 When using GRUB as the bootloader, the LUKS password is only requested
 once: GRUB passes the master key to the initial RAM disk automatically.
-@xref{Bootloader Configuration, Automatic LUKS Master Key Passing}, for
+@xref{grub-luks-root-device-key, Automatic LUKS Master Key Passing}, for
 details.

@end defvar
@@ -45250,6 +45277,12 @@ Extra command line options for @code{guix-data-service}.
@item @code{extra-process-jobs-options} (default: @var{'()})
 Extra command line options for @code{guix-data-service-process-jobs}.

+@item @code{extra-environment-variables} (default: @var{'()})
+Extra environment variables for @code{guix-data-service}.
+
+@item @code{extra-process-jobs-environment-variables} (default: @var{'()})
+Extra environment variables for @code{guix-data-service-process-jobs}.
+
@item @code{git-repositories} (default: @var{#f})
 List of git-repository information to insert into the database.

@@ -48959,8 +48992,28 @@ This option in enabled by default.  In some cases involving the
 in RAM, it can be handy to disable the option by setting it to
@code{#f}.

-@subsubheading Automatic LUKS Master Key Passing
+@item @code{extra-initrd} (default: @code{#f})
+File name of an additional initrd to load during the boot.  It may or
+may not point to a file in the store, but the main use case is for
+out-of-store files containing secrets.

+For any use case not involving secrets, you should use regular initrd
+(@pxref{operating-system Reference, @code{initrd}}) instead.
+
+Be careful when using this option, since pointing to a file that is not
+readable by the grub while booting will cause the boot to fail and
+require a manual edit of the initrd line in the grub menu.
+
+Currently only supported by GRUB.
+@end table
+
+@end deftp
+
+@anchor{grub-luks-root-device-key}
+@unnumberedsubsec Automatic LUKS Master Key Passing
+
+@cindex LUKS, root file system encryption
+@cindex passphrase, for LUKS-encrypted root
 When booting from a LUKS-encrypted device using GRUB, the password is
 normally requested twice: once by GRUB to access @file{/boot}, and a
 second time by the initial RAM disk to mount the root file system.
@@ -49001,22 +49054,7 @@ No configuration is required: GRUB's @code{procfs} and @code{luks}
 modules are loaded automatically when encrypted devices are declared
 via @code{luks-device-mapping} (@pxref{Mapped Devices}).

-@item @code{extra-initrd} (default: @code{#f})
-File name of an additional initrd to load during the boot.  It may or
-may not point to a file in the store, but the main use case is for
-out-of-store files containing secrets.
-
-For any use case not involving secrets, you should use regular initrd
-(@pxref{operating-system Reference, @code{initrd}}) instead.
-
-Be careful when using this option, since pointing to a file that is not
-readable by the grub while booting will cause the boot to fail and
-require a manual edit of the initrd line in the grub menu.
-
-Currently only supported by GRUB.
-@end table
-
-@end deftp
+@unnumberedsubsec Additional Boot Entries

@cindex dual boot
@cindex boot menu
@@ -49145,9 +49183,13 @@ example of chainloading a different GNU/Linux system.
@end table
@end deftp

+@unnumberedsubsec Themes
+
@cindex HDPI
@cindex HiDPI
@cindex resolution
+@cindex themes, for GRUB
+@cindex bootloader themes
@c FIXME: Write documentation once it's stable.
 For now only GRUB has theme support.  GRUB themes are created using
 the @code{grub-theme} form, which is not fully documented yet.
@@ -49167,7 +49209,7 @@ Return the default GRUB theme used by the operating system if no
@code{theme} field is specified in @code{bootloader-configuration}
 record.

-It comes with a fancy background image displaying the GNU and Guix
+It comes with a fancy background image displaying the Guix
 logos.
@end deffn

@@ -49542,7 +49584,7 @@ how to generate an image that uses the @code{grub-efi-bootloader}
 bootloader and boot it with QEMU:

@example
-image=$(guix system image --image-type=qcow2 \
+image=$(guix system image --image-type=qcow2-gpt \
        gnu/system/examples/lightweight-desktop.tmpl)
 cp $image /tmp/my-image.qcow2
 chmod +w /tmp/my-image.qcow2
@@ -844,7 +844,8 @@ and the maven-build-system."
        #:name "JavaScript team"
        #:description
        "JavaScript/Node.js packages, the node build system."
-        #:scope (list "gnu/packages/node-xyz.scm"
+        #:scope (list "gnu/packages/javascript.scm"
+                      "gnu/packages/node-xyz.scm"
                      "gnu/packages/node.scm"
                      "guix/build-system/node.scm"
                      "guix/build/node-build-system.scm"
@@ -1637,7 +1638,7 @@ the \"texlive\" importer."
 (define-member (person "Thanos Apollo"
                       "public@thanosapollo.org"
                       "thanosapollo")
-  vcs)
+  vcs emacs)

 (define-member (person "Ashish SHUKLA"
                       "ashish.is@lostca.se"
@@ -1226,10 +1226,12 @@ file name or an nfs-root containing ':/')."

  (match spec
    ((? string?)
-     (if (string-prefix? "/dev/" spec)
+     (if (string-match "^/dev/[a-zA-Z0-9]+$" spec)
         ;; Nothing to do, but wait until SPEC shows up.
         (resolve device-exists? spec identity)
-         spec)) ; do not resolve NFS / CIFS / tmpfs devices
+         ;; Do not resolve NFS / CIFS / tmpfs devices
+         ;; or bcachefs multi-device specifications.
+         spec))
    ((? file-system-label?)
     ;; Resolve the label.
     (resolve find-partition-by-label
@@ -445,10 +445,14 @@ load path must be adjusted as needed."
          ;; Behave like an init process: create a sub-process that calls
          ;; THUNK, and wait for child processes.  Furthermore, forward
          ;; RELAYED-SIGNALS to the child process.
-          (match (primitive-fork)
-            (0
+          ;; We presently use `safe-clone` here due to a bug in the interaction
+          ;; between Guix and `primitive-fork` in Guile 3.0.11:
+          ;; https://codeberg.org/guix/guix/issues/7690#issuecomment-12744123
+          (safe-clone
+            SIGCHLD
+            (lambda ()
             (call-with-clean-exit thunk))
-            (pid
+            (lambda (pid)
             (install-signal-handlers pid)
             (let loop ()
               (match (wait-child-process)
@@ -57,7 +57,7 @@
 # Copyright © 2022 ( <paren@disroot.org>
 # Copyright © 2022, 2026 jgart <jgart@dismail.de>
 # Copyright © 2022-2023, 2025-2026 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
-# Copyright © 2023-2025 Zheng Junjie <z572@z572.online>
+# Copyright © 2023-2026 Zheng Junjie <z572@z572.online>
 # Copyright © 2023 Ivana Drazovic <iv.dra@hotmail.com>
 # Copyright © 2023 Andy Tai <atai@atai.org>
 # Copyright © 2023 B. Wilson <elaexuotee@wilsonb.com>
@@ -1093,6 +1093,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/catdoc-CVE-2017-11110.patch		\
  %D%/packages/patches/chez-irregex-import-cond-expand.patch	\
  %D%/packages/patches/chez-scheme-bin-sh.patch			\
+  %D%/packages/patches/cianna-remove-error-for-missing-cuda.patch		\
  %D%/packages/patches/circos-remove-findbin.patch		\
  %D%/packages/patches/cdparanoia-fpic.patch			\
  %D%/packages/patches/cdrkit-libre-cross-compile.patch	\
@@ -1178,6 +1179,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/curlftpfs-fix-no_verify_hostname.patch	\
  %D%/packages/patches/cursynth-wave-rand.patch			\
  %D%/packages/patches/cvc5-reproducible-build.patch		\
+  %D%/packages/patches/cvc5-symfpu-compatibility.patch		\
  %D%/packages/patches/cvs-CVE-2017-12836.patch		\
  %D%/packages/patches/cyrus-sasl-fix-time-h.patch              \
  %D%/packages/patches/d-feet-drop-unused-meson-argument.patch	\
@@ -1240,7 +1242,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/python-treelib-remove-python2-compat.patch	\
  %D%/packages/patches/elm-offline-package-registry.patch	\
  %D%/packages/patches/elm-reactor-static-files.patch		\
-  %D%/packages/patches/emacs-buttercup-1.38-native-comp-spy-on-trampoline-scope.patch	\
  %D%/packages/patches/emacs-deferred-fix-number-of-arguments.patch	\
  %D%/packages/patches/emacs-disable-jit-compilation.patch			\
  %D%/packages/patches/emacs-doc-toc-shell-commands.patch	\
@@ -2069,6 +2070,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/open-zwave-hidapi.patch			\
  %D%/packages/patches/opusfile-CVE-2022-47021.patch		\
  %D%/packages/patches/orbit2-fix-array-allocation-32bit.patch \
+  %D%/packages/patches/orca-fix-gst-init-check-call.patch \
  %D%/packages/patches/orpheus-cast-errors-and-includes.patch	\
  %D%/packages/patches/ots-no-include-missing-file.patch	\
  %D%/packages/patches/owncloud-disable-updatecheck.patch	\
@@ -2349,8 +2351,16 @@ dist_patch_DATA =						\
  %D%/packages/patches/renpy-fix-integer-slots.patch			\
  %D%/packages/patches/reposurgeon-add-missing-docbook-files.patch	\
  %D%/packages/patches/rdkit-unbundle-external-dependencies.patch	\
+  %D%/packages/patches/r-biostrings-r4.6.0-compat.patch		\
+  %D%/packages/patches/r-h5mread-0001-h5mread-1.3.2-Get-rid-of-non-API-calls-to-R.patch \
  %D%/packages/patches/r-httpuv-1.6.6-unvendor-libuv.patch	\
+  %D%/packages/patches/r-mscoreutils-0001-fix-non-API-call-to-R-SETLENGTH-by-using-lengthgets.patch \
+  %D%/packages/patches/r-rsamtools-r-4.6.0-compat.patch		\
+  %D%/packages/patches/r-snpstats-0001-fixed-non-API-except-for-IS_S4_OBJECT.patch \
+  %D%/packages/patches/r-snpstats-0002-fixed-IS_S4_OBJECT.patch \
  %D%/packages/patches/r-sapa-lapack.patch			\
+  %D%/packages/patches/r-shortread-0001-ShortRead-1.69.3-Get-rid-of-non-API-calls-to-R.patch \
+  %D%/packages/patches/r-sparsearray-r-4.6.0-compat.patch	\
  %D%/packages/patches/ripperx-missing-file.patch		\
  %D%/packages/patches/rpcbind-CVE-2017-8779.patch		\
  %D%/packages/patches/rtosc-0.3.1-fix-invalid-comparison-operator.patch	\
@@ -2400,6 +2410,9 @@ dist_patch_DATA =						\
  %D%/packages/patches/rust-codex-0.120.0-connectors-cache-test-race.patch	\
  %D%/packages/patches/rust-codex-0.120.0-remove-libwebrtc.patch	\
  %D%/packages/patches/rust-codex-0.120.0-test-timeout.patch	\
+  %D%/packages/patches/rust-codex-0.124.0-code-mode-stub-toolname.patch	\
+  %D%/packages/patches/rust-codex-0.124.0-remove-patch-sections.patch	\
+  %D%/packages/patches/rust-librocksdb-sys-unbundled-sources.patch	\
  %D%/packages/patches/rust-ring-0.17-ring-core.patch		\
  %D%/packages/patches/rw-igraph-0.10.patch			\
  %D%/packages/patches/rxvt-unicode-fix-cursor-position.patch	\
@@ -185,7 +185,7 @@ terminals.")
    (native-inputs
     (append
       (list clisp
-             python-cython
+             python-cython-0 ;; See https://bugzilla.redhat.com/show_bug.cgi?id=2231865
             doxygen
             gettext-minimal)
       ;; icedtea doesn't build reliably on all architectures.
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012-2025 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012-2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Cyril Roelandt <tipecaml@gmail.com>
 ;;; Copyright © 2014, 2015, 2016, 2018, 2019, 2020 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014, 2015-2018, 2020-2023 Eric Bavier <bavier@posteo.net>
@@ -3751,59 +3751,68 @@ summarizes network bandwidth by process and remote host.")
 (define-public munge
  (package
    (name "munge")
-    (version "0.5.14")
+    (version "0.5.18")
    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://github.com/dun/munge/releases/"
-                                  "download/munge-" version "/munge-"
-                                  version ".tar.xz"))
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/dun/munge")
+                     (commit (string-append "munge-" version))))
+              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0h06sghb4rqvv1ywyd6mzsmbcgh712v6ygrff0gzm440y4ca41k6"))
+                "1b7gm680dlvmgvj9vxy7n0cqmnv1rl9n4563vasxdxx54f78j30s"))
              (modules '((guix build utils)))
              (snippet
-               '(begin
-                  ;; Don't insist on write access to /var.
-                  (substitute* "src/etc/Makefile.in"
-                    (("\\$\\(INSTALL\\)(.*)localstatedir" _ middle)
-                     (string-append "-$(INSTALL)" middle "localstatedir"))
-                    (("\\$\\(MKDIR_P\\) .*(local|run)statedir.*")
-                     ""))
-                  #t))))
+               ;; Don't insist on write access to /var.
+               #~(substitute* "src/etc/Makefile.am"
+                   (("\\$\\(MKDIR_P\\) .*(local|run)statedir.*" all)
+                    (string-append ": " all))))))
    (inputs
     (list openssl libgcrypt))
+    (native-inputs
+     (list autoconf
+           automake
+           libtool
+           procps))                               ;for tests
    (build-system gnu-build-system)
    (arguments
-     `(#:configure-flags
-       (list "--localstatedir=/var"
-             (string-append "--with-pkgconfigdir="
-                            (assoc-ref %outputs "out") "/lib/pkgconfig")
-             (string-append "--with-libgcrypt-prefix="
-                            (assoc-ref %build-inputs "libgcrypt"))
-             ,@(if (%current-target-system)
-                 ;; Assume yes on pipes when cross compiling.
-                 `("ac_cv_file__dev_spx=yes"
-                   "x_ac_cv_check_fifo_recvfd=yes")
-                 '()))
-       #:phases
-       (modify-phases %standard-phases
-         ;; XXX Many test series fail.  Some might be fixable, others do no-no
-         ;; things like invoking ‘sudo’.
-         (add-after 'unpack 'skip-failing-tests
-           (lambda _
-             (for-each (lambda (test)
-                         (substitute* "t/Makefile.in"
-                           (((string-append test "\\.t ")) "")))
-                       (list "0100-munged-lock"
-                             "0010-basic"
-                             "0011-munged-cmdline"
-                             "0012-munge-cmdline"
-                             "0013-unmunge-cmdline"
-                             "0101-munged-security-socket"
-                             "0102-munged-security-keyfile"
-                             "0103-munged-security-logfile"
-                             "0110-munged-origin-addr"))
-             #t)))))
+     (list #:configure-flags
+           #~(list "--localstatedir=/var"
+                   "--disable-static"
+                   #$@(if (%current-target-system)
+                          ;; Assume yes on pipes when cross compiling.
+                          `("ac_cv_file__dev_spx=yes"
+                            "x_ac_cv_check_fifo_recvfd=yes")
+                          '())
+
+                   ;; The '.pc' file is not installed when omitting this flag.
+                   (string-append "--with-pkgconfigdir="
+                                  #$output "/lib/pkgconfig"))
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-before 'bootstrap 'pre-bootstrap
+                 (lambda _
+                   (for-each patch-shebang (find-files "build-aux"))))
+               (add-after 'unpack 'skip-failing-tests
+                 (lambda _
+                   ;; Pass '--force' to 'munged'; without it, it fails with "Socket
+                   ;; is inaccessible" due to the build directory not being
+                   ;; world-readable.
+                   (substitute* "tests/sharness.d/03-munged.sh"
+                     (("--group-update-time=-1" all)
+                      (string-append all " --force")))
+
+                   ;; The tests below invoke 'sudo' or have special expectations
+                   ;; about network interfaces.
+                   (for-each (lambda (test)
+                               (substitute* "tests/Makefile.am"
+                                 (((string-append test "\\.t "))
+                                  "")))
+                             (list "0100-munged-lock"
+                                   "0101-munged-security-socket"
+                                   "0102-munged-security-keyfile"
+                                   "0103-munged-security-logfile"
+                                   "0110-munged-origin-addr")))))))
    (home-page "https://dun.github.io/munge/")
    (synopsis "Cluster computing authentication service")
    (description
@@ -458,7 +458,7 @@ precision.")
    (inputs
     ;; TODO: Unbundle "libmicropython.a".
     (list ao
-           fltk-1.3
+           fltk
           glpk
           gmp
           gsl
@@ -1210,7 +1210,7 @@ PulseAudio clients, featuring:
 (define-public ardour
  (package
    (name "ardour")
-    (version "9.1")
+    (version "9.2")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1227,7 +1227,7 @@ PulseAudio clients, featuring:
 namespace ARDOUR { const char* revision = \"" version "\" ; const char* date = \"\"; }")))))
              (sha256
               (base32
-                "00bramm8dq0ihr376n7l9rg0mjzxmzw6lxvsbsdlrdsimfwsy16p"))
+                "14s6cq3x7l7b682ah9k8cdr6plfirlgm882dc2nm51lxwl91zcfd"))
              (file-name (git-file-name name version))))
    (build-system waf-build-system)
    (arguments
@@ -37,8 +37,6 @@
  #:use-module (gnu packages elf)
  #:use-module (gnu packages ncurses)
  #:use-module (gnu packages readline)
-  #:use-module (gnu packages ruby-check)
-  #:use-module (gnu packages ruby-xyz)
  #:use-module (gnu packages bison)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages libffi)
@@ -55,7 +53,6 @@
  #:use-module (guix store)
  #:use-module (guix build-system copy)
  #:use-module (guix build-system gnu)
-  #:use-module (guix build-system ruby)
  #:use-module (guix build-system trivial)
  #:autoload   (guix gnupg) (gnupg-verify*)
  #:autoload   (guix base32) (bytevector->nix-base32-string)
@@ -516,46 +513,6 @@ function interface (FFI) directly in your shell.  In other words, it allows
 you to call routines in shared libraries from within Bash.")
    (license license:expat)))

-(define-public bashly
-  (package
-    (name "bashly")
-    (version "1.3.5")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (rubygems-uri "bashly" version))
-       (sha256
-        (base32 "17msjzca5ifx8biimdjps655w51yc82d5ys9hwn749bi2f3n8mcz"))))
-    (build-system ruby-build-system)
-    (arguments
-     (list
-      #:phases
-      #~(modify-phases %standard-phases
-          (replace 'check
-            (lambda* (#:key tests? #:allow-other-keys)
-              (when tests?
-                (invoke "rspec" "-c" "spec")))))))
-    (native-inputs (list ruby-rspec))
-    (propagated-inputs (list ruby-colsole
-                             ruby-completely
-                             ruby-filewatcher
-                             ruby-gtx
-                             ruby-logger
-                             ruby-lp
-                             ruby-mister-bin
-                             ruby-ostruct
-                             ruby-requires
-                             ruby-tty-markdown))
-    (synopsis
-     "Create feature-rich Bash scrips using simple YAML configuration")
-    (description
-     "Bashly is a CLI for generating feature-rich Bash command line
-tools.  Bashly lets you focus on your specific code, without worrying about
-command line argument parsing, usage texts, error messages and other functions
-that are usually handled by a framework in other programming languages.")
-    (home-page "https://bashly.dev/")
-    (license license:expat)))
-
 (define-public blesh
  (package
    (name "blesh")
@@ -14,6 +14,7 @@
 ;;; Copyright © 2022 Tomasz Jeneralczyk <tj@schwi.pl>
 ;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2025 Artyom V. Poptsov <poptsov.artyom@gmail.com>
+;;; Copyright © 2026 Sughosha <sughosha@disroot.org>
 ;;; Copyright © 2023 Advanced Micro Devices, Inc.
 ;;;
 ;;; This file is part of GNU Guix.
@@ -41,6 +42,7 @@
  #:use-module (guix amd-gpu)
  #:use-module (guix search-paths)
  #:use-module (guix build-system cmake)
+  #:use-module (guix build-system qt)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system python)
  #:use-module (guix build-system pyproject)
@@ -730,7 +732,7 @@ and options.  With careful benchmarking, different hardware can be compared.")
 (define-public kdiskmark
  (package
    (name "kdiskmark")
-    (version "3.1.4")
+    (version "3.2.0")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -739,14 +741,13 @@ and options.  With careful benchmarking, different hardware can be compared.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1x8vd6swmf0i7f6m6wl2154n6plx8jkmcqfq6zxbdy255f1da74c"))))
-    (build-system cmake-build-system)
+                "161yyy4fcy5bnzhbcd7p90nlcslcsfp7n3m3bz9bygch7bdjw46g"))))
+    (build-system qt-build-system)
    (arguments
     (list
+      #:qtbase qtbase
      #:configure-flags
-      ;; Drop runtime dependency on KDE's KFAuth.
-      #~(list "-DPERFORM_PAGECACHE_CLEARING_USING_KF5AUTH=no"
-              (string-append "-DPOLKITQT-1_INSTALL_DIR=" #$output))
+      #~(list (string-append "-DPOLKITQT-1_INSTALL_DIR=" #$output))
      #:tests? #f                       ;no test suite
      #:phases
      #~(modify-phases %standard-phases
@@ -759,10 +760,10 @@ and options.  With careful benchmarking, different hardware can be compared.")
            (lambda _
              (rmdir "src/singleapplication")
              (symlink #$(package-source
-                          (this-package-input "single-application-qt5"))
+                          (this-package-input "single-application"))
                       "src/singleapplication"))))))
-    (native-inputs (list extra-cmake-modules qttools-5))
-    (inputs (list fio polkit-qt qtbase-5 single-application-qt5))
+    (native-inputs (list extra-cmake-modules qttools))
+    (inputs (list fio polkit-qt6 single-application qtwayland))
    (home-page "https://github.com/JonMagon/KDiskMark")
    (synopsis "Simple disk benchmark tool")
    (description "KDiskMark is an HDD and SSD benchmark tool.  KDiskMark
@@ -913,7 +913,7 @@ suite native in R.")
 (define-public r-bpcells
  (package
    (name "r-bpcells")
-    (version "0.3.0")
+    (version "0.3.1")
    (source
     (origin
       (method git-fetch)
@@ -922,7 +922,7 @@ suite native in R.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "12h1di45fg06nhsliii7v0h1z567pkpis1xm4ar1qr8ns1n8iljw"))
+        (base32 "0yqgcajq83g25mznwcngaw7pi6vcqxqdnynpgb95yci57k3wrp6j"))
       (modules '((guix build utils)))
       (snippet
        '(delete-file-recursively "r/src/vendor/highway"))))
@@ -931,13 +931,15 @@ suite native in R.")
    (arguments
     (list
      #:phases
-      '(modify-phases %standard-phases
+      `(modify-phases %standard-phases
         (add-after 'unpack 'chdir
-           (lambda _
-             (substitute* "r/configure"
-               (("tools/hwy-test.cpp" m)
-                (string-append m " $HWY_LIBS $HWY_CFLAGS")))
-             (chdir "r"))))))
+           (lambda _ (chdir "r")))
+         ,@(if (target-x86-32?)
+               '((add-after 'chdir 'require-sse2
+                   ;; This avoids falling back to the scalar backend in
+                   ;; highway, which fails to build.
+                   (lambda _ (setenv "CFLAGS" "-msse2"))))
+               '()))))
    (propagated-inputs
     (list r-dplyr
           r-ggplot2
@@ -328,15 +328,15 @@ with the @uref{https://keepassxc.org, KeePassXC} password manager.")
 (define noscript
  (package
    (name "noscript")
-    (version "13.2.2")
+    (version "13.6.18.1984")
    (source (origin
              (method url-fetch/zipbomb)
              (uri (string-append
-                    "https://noscript.net/download/releases/noscript-" version
-                    ".xpi"))
+                    "https://archive.torproject.org/tor-package-archive/torbrowser/noscript/noscript-"
+                    version ".xpi"))
              (sha256
               (base32
-                "0w2w0a76dk01bkh83mqwgs9ky02rjqk15z5sxg4a6mw0hpr81bpm"))))
+                "0assv8v89hhg302q81vvv7ln3q8k9m6rzjkbprv2j05ghb23kkvm"))))
    (build-system copy-build-system)
    (properties '((addon-id . "{73a6fe31-595d-460b-a920-fcc0f8843232}")))
    (arguments
@@ -400,7 +400,7 @@
  ;; run the Blink performance tests, just remove everything to save ~70MiB.
  '("third_party/blink/perf_tests"))

-(define %chromium-version "147.0.7727.55")
+(define %chromium-version "147.0.7727.137")
 (define %ungoogled-revision (string-append %chromium-version "-1"))
 (define %debian-revision (string-append "debian/" %ungoogled-revision))

@@ -412,7 +412,7 @@
    (file-name (git-file-name "ungoogled-chromium" %ungoogled-revision))
    (sha256
     (base32
-      "0l6v4wf16067igawjlh90f3d287mkw0cq4j5lvrxxy17y1skynzc"))))
+      "1ha84j3zckdv2l8dpicqhmr6a8mq3bqwalw0bmgamvlmns9i7nrj"))))

 (define %debian-origin
  (origin
@@ -425,7 +425,7 @@
                                ((_ version) version))))
    (sha256
     (base32
-      "0gqarll08i7rcs1amapciv263xvzglc8p44ikavq3xd12yyvcd98"))))
+      "04lqbclkvn9nsksgjpjilh78a8y17mwwq4pmhr6h8gvpp2y3bhhc"))))

 (define (origin-file origin file)
  (computed-file
@@ -570,7 +570,7 @@
                                  %chromium-version "-lite.tar.xz"))
              (sha256
               (base32
-                "1salvlw5sykx3zmsbp7cgmf7y8yy6jlgb4b4zswzsbjrprk4jnap"))
+                "1m22whg5n9lw9gqhalm95jwfm45lqp4a7cs3mn3f4n8w0rvr0r5j"))
              (modules '((guix build utils)))
              (snippet (force ungoogled-chromium-snippet))))
    (build-system gnu-build-system)
@@ -596,6 +596,7 @@
              "use_custom_libcxx=false" ; support for this is deprecated and to be removed.
              "optimize_webui=false"
              "webnn_use_tflite=false"
+              "build_tflite_with_xnnpack=false"
              "safe_browsing_use_unrar=false"
              "chrome_pgo_phase=0"
              "use_sysroot=false"
@@ -688,7 +689,7 @@
              "use_gnome_keyring=false" ;deprecated by libsecret
              "use_pulseaudio=true"
              "link_pulseaudio=true"
-              "icu_use_data_file=false"
+              "icu_use_data_file=true"

              ;; VA-API acceleration is currently only supported on x86_64-linux.
              #$@(if (string-prefix? "x86_64" (or (%current-target-system)
@@ -696,6 +697,13 @@
                     '("use_vaapi=true")
                     '())

+              #$@(if (string-prefix? "aarch64" (or (%current-target-system)
+                                                   (%current-system)))
+                     '("use_v4l2_codec=true"
+                       "use_vaapi=false"
+                       "use_av1_hw_decoder=true")
+                     '())
+
              ;; Do not artificially restrict formats supported by system ffmpeg.
              "proprietary_codecs=true"
              "ffmpeg_branding=\"Chrome\""
@@ -769,12 +777,7 @@
                   (string-append libclang "clang_base_path"))
                  (("(_rustfmt_path = \")\\$\\{rust_bindgen_root\\}" _ rustfmt)
                   (string-append rustfmt "${rust_sysroot_absolute}"))))))
-          (add-after 'patch-stuff 'include-pthreadpool
-            ;; FIXME: Somehow the build system cannot locate this header.
-            (lambda _
-              (copy-file "third_party/pthreadpool/src/include/pthreadpool.h"
-                         "pthreadpool.h")))
-          (add-after 'include-pthreadpool 'add-absolute-references
+          (add-after 'patch-stuff 'add-absolute-references
            (lambda* (#:key inputs #:allow-other-keys)
              (let ((cups-config (search-input-file inputs "/bin/cups-config"))
                    (libnssckbi.so (search-input-file inputs
@@ -892,6 +895,7 @@
                                       "resources.pak"
                                       "v8_context_snapshot.bin"
                                       "chrome_crashpad_handler"
+                                       "icudtl.dat"

                                       ;; Swiftshader ICD.
                                       "libvk_swiftshader.so"
@@ -914,9 +918,11 @@

                (substitute* '("chrome/app/resources/manpage.1.in"
                               "chrome/installer/linux/common/desktop.template")
-                  (("@@MENUNAME@@") "Chromium")
-                  (("@@PACKAGE@@") "chromium")
-                  (("/usr/bin/@@USR_BIN_SYMLINK_NAME@@") exe))
+                  (("@@MENUNAME") "Chromium")
+                  (("@@PACKAGE") "chromium")
+                  (("/usr/bin/@@usr_bin_symlink_name") exe)
+                  (("@@uri_scheme") "x-scheme-handler/chromium")
+                  (("@@extra_desktop_entries") ""))

                (mkdir-p man)
                (copy-file "chrome/app/resources/manpage.1.in"
@@ -18,10 +18,10 @@

 ;;; This module is separate from (gnu packages rust-apps) to avoid a
 ;;; circular module dependency: (gnu packages rust-sources), which
-;;; defines rust-codex-0.120.0, transitively loads (gnu packages
+;;; defines rust-codex-0.124.0, transitively loads (gnu packages
 ;;; rust-apps) through its #:use-module chain.  If the codex package
 ;;; lived in rust-apps.scm, loading rust-sources would trigger loading
-;;; rust-apps before rust-codex-0.120.0 is defined, causing an unbound
+;;; rust-apps before rust-codex-0.124.0 is defined, causing an unbound
 ;;; variable error.

 (define-module (gnu packages codex)
@@ -54,14 +54,14 @@
 (define-public codex
  (package
    (name "codex")
-    (version (package-version rust-codex-0.120.0))
+    (version (package-version rust-codex-0.124.0))
    (source
     (origin
-       (inherit (package-source rust-codex-0.120.0))
+       (inherit (package-source rust-codex-0.124.0))
       (patches (search-patches
                 "codex-acp-0.11.1-disable-code-mode.patch"
-                 "rust-codex-0.117.0-remove-patch-sections.patch"
-                 "rust-codex-0.120.0-connectors-cache-test-race.patch"
+                 "rust-codex-0.124.0-code-mode-stub-toolname.patch"
+                 "rust-codex-0.124.0-remove-patch-sections.patch"
                 "rust-codex-0.120.0-remove-libwebrtc.patch"
                 "rust-codex-0.98.0-test-shebangs.patch"
                 "rust-codex-0.120.0-test-timeout.patch"))))
@@ -69,7 +69,12 @@
    (arguments
     (list
      #:install-source? #f
-      #:cargo-install-paths '(list "cli" "exec" "exec-server"
+      ;; exec-server is library-only in 0.124 (no [[bin]] in
+      ;; exec-server/Cargo.toml); cargo install --path exec-server fails
+      ;; with "no packages found with binaries or examples".  Drop it
+      ;; from the install paths -- the library is consumed via the
+      ;; workspace by other binaries here, not installed standalone.
+      #:cargo-install-paths '(list "cli" "exec"
                                   "linux-sandbox" "mcp-server"
                                   "app-server" "tui")
      ;; schema_fixtures_match_generated (upstream fixture is stale:
@@ -317,7 +322,164 @@
                                ;; (chatgpt.com, api.github.com) wait
                                ;; for TCP timeout instead of failing
                                ;; instantly at TLS, eating the budget.
-                                "--skip" "mcp_server_status_list_tools_and_auth_only_skips_slow_inventory_calls")
+                                "--skip" "mcp_server_status_list_tools_and_auth_only_skips_slow_inventory_calls"
+                                ;;; BEGIN Stack overflow in 'current_thread'
+                                ;;; tokio runtime.  The sibling tests in
+                                ;;; tracing_tests.rs use the local helper
+                                ;;; run_current_thread_test_with_stack
+                                ;;; (4 MiB) but this one uses bare
+                                ;;; #[tokio::test] on the 2 MiB default
+                                ;;; test-thread stack, and TurnStart's
+                                ;;; future graph exceeds it.  With
+                                ;;; RUST_MIN_STACK raised the overflow is
+                                ;;; gone but the test then deterministically
+                                ;;; times out waiting for a span tagged
+                                ;;; codex.op = "user_input" on the remote
+                                ;;; trace that upstream never emits on that
+                                ;;; trace in our environment.
+                                "--skip" "turn_start_jsonrpc_span_parents_core_turn_spans"
+                                ;;; END tracing test stack/timeout
+                                ;;; BEGIN The upstream loader resolves the
+                                ;;; MCP OAuth credentials store mode by
+                                ;;; calling
+                                ;;; resolve_mcp_oauth_credentials_store_mode
+                                ;;; with env!("CARGO_PKG_VERSION") -- which
+                                ;;; in the released 0.124.0 tarball is
+                                ;;; "0.124.0".  These fixture tests
+                                ;;; construct the expected Config by
+                                ;;; passing the LOCAL_DEV_BUILD_VERSION
+                                ;;; constant ("0.0.0") to the same
+                                ;;; resolver, and the resolver only returns
+                                ;;; File for "0.0.0" -- Auto otherwise.
+                                ;;; Upstream CI builds from a checkout
+                                ;;; still carrying version = "0.0.0" so the
+                                ;;; tests pass there; they cannot pass
+                                ;;; against a released tag.
+                                "--skip" "test_precedence_fixture_with_gpt3_profile"
+                                "--skip" "test_precedence_fixture_with_gpt5_profile"
+                                "--skip" "test_precedence_fixture_with_o3_profile"
+                                "--skip" "test_precedence_fixture_with_zdr_profile"
+                                ;;; END LOCAL_DEV_BUILD_VERSION fixture mismatch
+                                ;;; BEGIN Verifies that Codex's user-shell
+                                ;;; spawn produces a child where
+                                ;;; CODEX_SANDBOX_NETWORK_DISABLED is unset
+                                ;;; (asserts stdout == "not-set").  We
+                                ;;; deliberately set that env var at the
+                                ;;; check phase to trigger upstream's
+                                ;;; skip_if_no_network! guards; the var then
+                                ;;; leaks into the spawned shell and the
+                                ;;; assertion fails.  The guix skip is a
+                                ;;; direct cost of the network-gate fix --
+                                ;;; trading one broken test for two that
+                                ;;; now skip cleanly.
+                                "--skip" "user_shell_command_does_not_set_network_sandbox_env_var"
+                                ;;; END CODEX_SANDBOX_NETWORK_DISABLED leak
+                                ;;; BEGIN The exec-server/tests/file_system
+                                ;;; integration tests invoke the real
+                                ;;; system bwrap, which tries to execvp the
+                                ;;; test binary at the cargo target path
+                                ;;; under the build dir.  Same root cause
+                                ;;; as the existing
+                                ;;; sandbox_reenables_writable_subpaths_under_unreadable_parents
+                                ;;; skip: guix builds live under /tmp but
+                                ;;; bwrap's mount namespace excludes /tmp,
+                                ;;; making the binary invisible inside the
+                                ;;; namespace.
+                                "--skip" "file_system_copy_preserves_symlink_source"
+                                "--skip" "file_system_copy_rejects_symlink_escape_destination"
+                                "--skip" "file_system_copy_rejects_symlink_escape_source"
+                                "--skip" "file_system_create_directory_rejects_symlink_escape"
+                                "--skip" "file_system_read_directory_rejects_symlink_escape"
+                                "--skip" "file_system_remove_rejects_symlink_escape"
+                                "--skip" "file_system_remove_removes_symlink_not_target"
+                                "--skip" "file_system_sandboxed_read_allows_readable_root"
+                                "--skip" "file_system_sandboxed_read_rejects_symlink_escape"
+                                "--skip" "file_system_sandboxed_read_rejects_symlink_parent_dotdot_escape"
+                                "--skip" "file_system_sandboxed_write_allows_additional_write_root"
+                                "--skip" "file_system_sandboxed_write_rejects_symlink_escape"
+                                "--skip" "file_system_sandboxed_write_rejects_unwritable_path"
+                                ;;; END bwrap-cant-see-/tmp file_system tests
+                                ;;; BEGIN Landlock is unavailable on Guix,
+                                ;;; so the sandbox cannot deny network
+                                ;;; syscalls.  These tests expect
+                                ;;; SandboxErr::Denied for the nc, ping,
+                                ;;; ssh, getent, and dev_tcp_redirection
+                                ;;; commands but those commands instead
+                                ;;; block on connect() until the test's 2s
+                                ;;; timeout fires (Timeout, exit 124).
+                                ;;; Same root cause as the Landlock skips
+                                ;;; at the top of this list; new test names
+                                ;;; in 0.124.
+                                "--skip" "sandbox_blocks_nc"
+                                "--skip" "sandbox_blocks_ping"
+                                "--skip" "sandbox_blocks_dev_tcp_redirection"
+                                "--skip" "sandbox_blocks_getent"
+                                "--skip" "sandbox_blocks_ssh"
+                                ;;; END Landlock network block
+                                ;;; BEGIN Requires github.com network access.
+                                ;;; With no "extraKnownMarketplaces" entry
+                                ;;; in settings.json,
+                                ;;; collect_marketplace_import_sources
+                                ;;; inserts a fallback entry for the
+                                ;;; "claude-plugins-official" marketplace
+                                ;;; pointing at the github shorthand
+                                ;;; "anthropics/claude-plugins-official".
+                                ;;; add_marketplace -> parse_marketplace_source
+                                ;;; expands that to a github.com/.git URL
+                                ;;; and clone_git_source runs 'git clone'.
+                                ;;; The Guix build sandbox has no network,
+                                ;;; so the clone fails and the marketplace
+                                ;;; lands in failed_marketplaces.  No mock
+                                ;;; cloner is injected via
+                                ;;; ExternalAgentConfigService::new_for_test,
+                                ;;; so there is no in-tree way to satisfy
+                                ;;; the test offline.
+                                "--skip" "import_plugins_infers_claude_official_marketplace_when_missing_from_settings"
+                                ;;; END github.com network access
+                                ;;; BEGIN Async race between the rollout
+                                ;;; writer task and a direct SQLite read.
+                                ;;; The test calls
+                                ;;; update_memory_settings_with_app_server,
+                                ;;; which routes through the in-memory
+                                ;;; thread path on the app-server's
+                                ;;; ThreadMemoryModeSet handler ->
+                                ;;; Session::set_thread_memory_mode ->
+                                ;;; persist_thread_memory_mode_update,
+                                ;;; which writes a RolloutItem::SessionMeta
+                                ;;; with the new mode to the rollout file
+                                ;;; via recorder.record_items + flush.  The
+                                ;;; rollout writer task then asynchronously
+                                ;;; calls sync_thread_state_after_write,
+                                ;;; which calls state_db::apply_rollout_items
+                                ;;; to mirror the SessionMeta into SQLite.
+                                ;;; flush() only awaits the rollout-file
+                                ;;; write, not the subsequent SQLite sync.
+                                ;;; The test opens a fresh StateRuntime and
+                                ;;; reads get_thread_memory_mode
+                                ;;; immediately, so it observes the creation
+                                ;;; default of "enabled" written by
+                                ;;; upsert_thread_with_creation_memory_mode
+                                ;;; instead of the new "disabled".  Upstream
+                                ;;; CI wins this race; we lose.
+                                "--skip" "update_memory_settings_updates_current_thread_memory_mode"
+                                ;;; END memory-mode rollout/sqlite race
+                                ;;; BEGIN The Stopwatch::new constructor in
+                                ;;; codex_shell_escalation anchors
+                                ;;; T0 = Instant::now() at construction;
+                                ;;; the spawned cancellation task fires at
+                                ;;; T0 + limit.  The test captures
+                                ;;; start = Instant::now() at T1 > T0 (after
+                                ;;; cancellation_token() returns) and
+                                ;;; asserts start.elapsed() >= limit,
+                                ;;; i.e. (T0 + limit) - T1 >= limit, which
+                                ;;; is always false by the offset T1 - T0.
+                                ;;; The test only passes when scheduler
+                                ;;; jitter on the sleep wakeup happens to
+                                ;;; exceed that offset.  Upstream wins the
+                                ;;; race; we don't always.
+                                "--skip" "cancellation_receiver_fires_after_limit"
+                                ;;; END Stopwatch construction/start offset race
+                                )
      #:cargo-package-crates
      ''(;;; Tier 0: No internal deps.
         "codex-ansi-escape"
@@ -358,22 +520,31 @@
         "codex-debug-client"
         "codex-analytics"
         "codex-rollout"
+         "codex-rollout-trace"
         "codex-terminal-detection"
         "codex-utils-approval-presets"
         "codex-utils-cli"
+         "codex-uds"
+         "codex-install-context"
+         "codex-device-key"
         ;;; Tier 2.
         "codex-app-server-protocol"
         "codex-rmcp-client"
         "codex-otel"
+         "codex-thread-store"
         "codex-state"
         "codex-features"
+         "codex-model-provider"
         "codex-config"
+         "codex-agent-identity"
+         "codex-aws-auth"
         "codex-hooks"
-         "codex-instructions"
         "codex-code-mode"
         "codex-feedback"
         "codex-skills"
+         "codex-test-binary-support"
         "codex-core"
+         "codex-core-plugins"
         "codex-utils-sandbox-summary"
         "codex-linux-sandbox"
         "codex-sandboxing"
@@ -425,7 +596,7 @@
              ;; Update them to match the actual package version.
              (let ((snap-files (find-files "." "\\.snap$")))
                (substitute* snap-files
-                  (("\\(v0\\.0\\.0\\)   ") "(v0.120.0) ")))))
+                  (("\\(v0\\.0\\.0\\)   ") "(v0.124.0) ")))))
          (add-after 'chdir-to-workspace 'patch-git-deps-to-vendor
            (lambda _
              ;; Replace git dependencies with version references so cargo
@@ -436,32 +607,55 @@
                (("runfiles = \\{ git = [^}]+\\}")
                 "runfiles = \"0.1.0\""))
              ;; Remove workspace members that have unbuildable deps
-              ;; (libwebrtc requires git fetch, v8-poc requires V8).
+              ;; (v8-poc requires V8).  code-mode stays a workspace member
+              ;; so its codex-protocol resolves to the same local copy as
+              ;; the rest of the build; disabling its default features
+              ;; (below) avoids pulling in V8.
              (substitute* "Cargo.toml"
-                (("\"v8-poc\",") "")
-                (("\"code-mode\",") ""))
-              ;; Disable V8 runtime in codex-code-mode: remove path
-              ;; so cargo resolves it from the vendor (where it has
-              ;; optional = true on v8) and disable default features.
+                (("\"v8-poc\",") ""))
+              ;; Disable V8 runtime in codex-code-mode by turning off
+              ;; default features.  Keep path= so code-mode is resolved
+              ;; from the local source tree and shares codex-protocol
+              ;; (and other workspace crates) with the rest of the build;
+              ;; resolving it from the vendor instead introduces a
+              ;; duplicate codex-protocol and causes E0308 type
+              ;; mismatches in codex-tools.
              (substitute* "Cargo.toml"
                (("codex-code-mode = \\{ path = \"code-mode\" \\}")
-                 "codex-code-mode = { version = \"0.120.0\", default-features = false }"))))
+                 "codex-code-mode = { path = \"code-mode\", default-features = false }"))
+              ;; cargo build at workspace root ignores per-dep
+              ;; default-features=false and builds code-mode with its
+              ;; own default features, which include v8-runtime and
+              ;; would pull in V8.  Make the default feature empty.
+              (substitute* "code-mode/Cargo.toml"
+                (("^default = \\[\"v8-runtime\"\\]") "default = []"))))
          (add-after 'patch-git-deps-to-vendor 'add-version-to-workspace-deps
            (lambda _
              ;; cargo package requires all dependencies to have versions.
-              ;; cargo package requires all dependencies to have versions.
-              ;; Add version = "0.120.0" to internal path dependencies.
+              ;; Add version = "0.124.0" to internal path dependencies.
              (let ((cargo-files (find-files "." "^Cargo\\.toml$")))
                (substitute* cargo-files
                  ;; Handle inline deps: name = { path = "..." }
                  (("(codex-[a-z0-9-]+) = \\{ path = " all name)
-                   (string-append name " = { version = \"0.120.0\", path = "))
+                   (string-append name " = { version = \"0.124.0\", path = "))
                  ;; Handle inline deps with package: name = { package = "...", path = "..." }
                  (("(codex-[a-z0-9-]+) = \\{ package = " all name)
-                   (string-append name " = { version = \"0.120.0\", package = "))
+                   (string-append name " = { version = \"0.124.0\", package = "))
                  ;; Handle section deps: [dependencies.X] with path = "..."
                  (("^(path = \"\\.\\./[^\"]*\")" all path-line)
-                   (string-append path-line "\nversion = \"0.120.0\""))))))
+                   (string-append path-line "\nversion = \"0.124.0\""))))))
+          (add-after 'chdir-to-workspace 'use-gnu-store-in-sandbox
+            (lambda _
+              ;; LINUX_PLATFORM_DEFAULT_READ_ROOTS in linux-sandbox/src/
+              ;; bwrap.rs is the read-only baseline that codex's bwrap
+              ;; sandbox bind-mounts so commands can read /usr/bin/ls,
+              ;; libc, etc.  Upstream lists "/nix/store" for NixOS;
+              ;; Guix's equivalent is "/gnu/store".  Without this swap,
+              ;; the codex sandbox cannot locate any binaries on a Guix
+              ;; system because every "system" path resolves into
+              ;; /gnu/store/<hash>-pkg/bin/...
+              (substitute* "linux-sandbox/src/bwrap.rs"
+                (("\"/nix/store\"") "\"/gnu/store\""))))
          (add-after 'chdir-to-workspace 'patch-hardcoded-paths
            (lambda* (#:key inputs #:allow-other-keys)
              (let ((bash-bin (string-append
@@ -561,10 +755,12 @@
                ;; double quotes.
                (substitute*
                  (list "core/src/plugins/startup_sync_tests.rs"
+                        "core/src/tools/runtimes/shell/unix_escalation_tests.rs"
                        "core/tests/suite/client.rs"
                        "core/tests/suite/js_repl.rs"
                        "core/tests/suite/skill_approval.rs"
                        "core/tests/suite/user_notification.rs"
+                        "exec-server/tests/file_system.rs"
                        "login/src/auth/auth_tests.rs"
                        "models-manager/src/manager_tests.rs"
                        "sandboxing/src/bwrap_tests.rs")
@@ -613,7 +809,17 @@
              ;; ~/... and 30 snapshot tests fail.
              (setenv "HOME" "/tmp/guix-home")
              (mkdir-p "/tmp/guix-home")
-              (setenv "USER" "nixbld"))))))
+              (setenv "USER" "nixbld")
+              ;; Default libtest thread stack is 2 MiB, which is not
+              ;; enough for tokio current_thread tests that drive
+              ;; codex-core's full turn pipeline.  Upstream gates such
+              ;; tests through run_current_thread_test_with_stack (4 MiB)
+              ;; in app-server/src/message_processor/tracing_tests.rs;
+              ;; raise the global default so future additions that
+              ;; forget the wrapper still pass.
+              (setenv "RUST_MIN_STACK" "8388608")
+              ;; Disable network access.
+              (setenv "CODEX_SANDBOX_NETWORK_DISABLED" "1"))))))
    (native-inputs `(("bubblewrap" ,bubblewrap) ;tests need bwrap on PATH
                     ("clang" ,clang)
                     ("cmake-minimal" ,cmake-minimal)
@@ -628,6 +834,7 @@
    (inputs (cons* bash-minimal coreutils git-minimal sed
                   libcap oniguruma openssl sqlite zlib `(,zstd "lib")
                   (cargo-inputs 'codex)))
+    (properties '((timeout . 108000)))  ;30 hours
    (home-page "https://github.com/openai/codex")
    (synopsis "AI-assisted coding CLI and TUI")
    (description
@@ -52,6 +52,7 @@
 ;;; Copyright © 2025 Philippe Swartvagher <phil.swart@gmx.fr>
 ;;; Copyright © 2025 Murilo <murilo@disroot.org>
 ;;; Copyright © 2026 Justin Veilleux <terramorpha@cock.li>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -3192,8 +3193,7 @@ pointers, containers, compiler building blocks, etc.")
    (native-inputs
     (list build))
    (inputs
-     `(("libcutl" ,libcutl)
-       ("libxerces-c" ,xerces-c)))
+     (list libcutl xerces-c))
    (synopsis "XSD Front-end")
    (description "@code{libxsd-frontend} is a compiler frontend for the W3C
 XML Schema definition language.  It includes a parser, semantic graph types
@@ -71,6 +71,7 @@
 ;;; Copyright © 2026 Spencer King <spencer.king@wustl.edu>
 ;;; Copyright © 2026 Peter Polidoro <peter@polidoro.io>
 ;;; Copyright © 2026 Josep Bigorra <jjbigorra@gmail.com>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -4159,8 +4160,8 @@ programmatically or as a standalone CLI application.")
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (inputs
-     `(("libcrypto" ,openssl)
-       ("libtcl8.6" ,tcl))) ; required for running the tests
+     (list openssl
+           tcl))                        ;for tests
    (native-inputs
     (list tcl))
    (arguments
@@ -51,7 +51,7 @@
 (define-public boinc-client
  (package
    (name "boinc-client")
-    (version "8.2.9")
+    (version "8.2.12")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -62,7 +62,7 @@
              (file-name (git-file-name "boinc" version))
              (sha256
               (base32
-                "0ik9423ii6kal29jdn907pxy8w86zpi8n158qx1gcsh8lsaif1v5"))))
+                "0531n0yij1gh06xy6plwivbpmhqfq15jizg3rdgri40nz41rzbgr"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -201,13 +201,13 @@ your project into different processes.")
 (define-public python-django
  (package
    (name "python-django")
-    (version "5.2.11")
+    (version "5.2.13")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "django" version))
       (sha256
-        (base32 "1lq2dynfw6jmvzrzgfrlij2qnxcksaxgnrfr0pj3bvmrv0m2jbbz"))))
+        (base32 "1i1vlffzhwbzp6r6y8ycvwklc45diy4c6i897z379l48a7dqj5d3"))))
    (build-system pyproject-build-system)
    (arguments
     '(#:test-flags
@@ -298,22 +298,6 @@ to the @dfn{don't repeat yourself} (DRY) principle.")
                      ;; This CVE is fixed in 4.1.9.
                      "CVE-2023-31047"))))))

-(define-public python-django-4
-  (package
-    (inherit python-django)
-    (name "python-django-4")
-    (version "4.2.28")
-    (source
-      (origin
-        (method url-fetch)
-        (uri (pypi-uri "django" version))
-        (sha256
-         (base32 "1znc2q1m9p2kxz1rkfkh2hg2sx6i3aqv72zsraad7bci364cvfd4"))))
-    (arguments
-     (substitute-keyword-arguments arguments
-       ((#:phases phases)
-        #~(modify-phases #$phases (delete 'delete-sitecustomize)))))))
-
 (define-public python-django-cache-url
  (package
    (name "python-django-cache-url")
@@ -10,6 +10,7 @@
 ;;; Copyright © 2022 ( <paren@disroot.org>
 ;;; Copyright © 2022 Esther Flashner <esther@flashner.co.il>
 ;;; Copyright © 2025-2026 Jonas Meeuws <jonas.meeuws@gmail.com>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -320,11 +321,11 @@ integration tests...\n")
                                 "|core.thread.osthread-debug-shared")))
                           (#t `("")))))))))))))
    (native-inputs
-     (append (delete "llvm"
-                     (alist-replace "ldc" (list ldc-bootstrap)
-                                    (package-native-inputs ldc-bootstrap)))
-         `(("clang" ,clang-17)          ;propagates llvm and clang-runtime
-           ("python-lit" ,python-lit))))
+     (modify-inputs native-inputs
+       (delete "llvm")
+       (replace "ldc" ldc-bootstrap)
+       (append clang-17                 ;propagates llvm and clang-runtime
+               python-lit)))
    (properties
     (alist-delete 'hidden? (package-properties ldc-bootstrap)))))

@@ -148,13 +148,13 @@ system.")
 (define-public r-duckdb
  (package
    (name "r-duckdb")
-    (version "1.5.1")
+    (version "1.5.2")
    (source
     (origin
       (method url-fetch)
       (uri (cran-uri "duckdb" version))
       (sha256
-        (base32 "177621m08whqqk4yhj3zrr08l3d9hhlqh3gm9jzhi5cplg47cksq"))
+        (base32 "1dldlfwvc33czvlxfmwaj4p9y6sjjj5iqy98yda47a8kclrqmyam"))
       ;; This package bundles the duckdb sources and builds a custom variant
       ;; of duckdb.  I'd be happy to link it with our duckdb library instead,
       ;; but it does not seem possible to do that.
@@ -2331,7 +2331,7 @@ Automation}, portable and vendor neutral FPGA place and route tool.")
 (define-public nvc
  (package
    (name "nvc")
-    (version "1.19.3")
+    (version "1.20.1")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -2340,7 +2340,7 @@ Automation}, portable and vendor neutral FPGA place and route tool.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1zizz2dafm53lzpjayy6vig5pz5ri9cszdivg0jzzh8s3ggkpy1i"))))
+                "1b38x2ch468s4p6mrq6c8s0d95vb84p6w4v8in79l4w7sfy8jnr0"))))
    (build-system gnu-build-system)
    (arguments
     (list #:out-of-source? #t
@@ -3461,7 +3461,7 @@ form of AXI, AXI lite, and AXI stream modules.")
 (define-public python-edalize
  (package
    (name "python-edalize")
-    (version "0.6.6")
+    (version "0.6.8")
    (source
     (origin
       (method git-fetch)
@@ -3470,7 +3470,7 @@ form of AXI, AXI lite, and AXI stream modules.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "115nc15n2cx4x9irjim07zkg0287418djqd6ja7rm8jrnyldvln9"))))
+        (base32 "04m2lhkclw9fj92k43c06j003qnq9i1yhy2131fvcnkkr0d9438m"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@@ -4516,7 +4516,7 @@ unique design feature of Trilinos is its focus on packages.")
 (define-public verilator
  (package
    (name "verilator")
-    (version "5.046")
+    (version "5.048")
    (source
     (origin
       (method git-fetch)
@@ -4525,7 +4525,7 @@ unique design feature of Trilinos is its focus on packages.")
              (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1gr1qhxvl4856hnmnx46dqd2qp0jhdh959zm2qfmxzzh19np7xkm"))))
+        (base32 "16c1x66kqmc5ldqjij81kypj471fibfihcqn6kz4wbxvnn0smyn6"))))
    (native-inputs
     (list autoconf
           automake
@@ -62,7 +62,7 @@ as bold, underscore or italic.")
 (define-public emacs-buttercup
  (package
    (name "emacs-buttercup")
-    (version "1.38")
+    (version "1.40")
    (source
     (origin
       (method git-fetch)
@@ -72,9 +72,7 @@ as bold, underscore or italic.")
       (file-name (git-file-name name version))
       (sha256
        (base32
-         "09n8skr5wi8bs7x81d5bi6z89dd8s1zi9a5f4r2qadaz69slncxq"))
-       (patches
-        (search-patches "emacs-buttercup-1.38-native-comp-spy-on-trampoline-scope.patch"))))
+         "1b55cfh4wr40max2c42crvaa6wid7a83g28yximsin98i32q5f5r"))))
    (build-system emacs-build-system)
    (arguments
     (list
@@ -28,6 +28,7 @@
 ;;; Copyright © 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2025 Jake Forster <jakecameron.forster@gmail.com>
 ;;; Copyright © 2025 John Kehayias <john@guixotic.coop>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -869,7 +870,7 @@ Started in 2014 as a GSOC project, Guile-Emacs was resurrected in 2024.")
         "0vfw7z9i2s9np6nmx1d4dlsywm044rkaqarn7akffmb6bf1j6zv5"))))
    (build-system gnu-build-system)
    (native-inputs
-     `(("gettext" ,gettext-minimal)))
+     (list gettext-minimal))
    (arguments
     `(#:configure-flags
       (list (string-append "--with-charmaps="
@@ -1128,8 +1128,8 @@ transaction log.
     (inherit jfsutils)
     (name "jfsutils-static")
     (inputs
-      `(("util-linux:static" ,util-linux "static")
-        ,@(package-inputs jfsutils))))))
+      (modify-inputs inputs
+        (prepend (list util-linux "static")))))))

 (define-public jfs_fsck/static
  (package
@@ -43,6 +43,7 @@
 ;;; Copyright © 2024 Janneke Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2025 wvlab <me@wvlab.xyz>
 ;;; Copyright © 2025 jgart <jgart@dismail.de>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -3053,10 +3054,10 @@ useful with system integration.")
         "0zs4z7l9b57jldwz0ban77f3c2zq43ambd0dssf5qg9i216f9lmj"))))
    (build-system gnu-build-system)
    (native-inputs
-     `(("dbus-test-runner" ,dbus-test-runner)
-       ("glib:bin" ,glib "bin")
-       ("pkg-config" ,pkg-config)
-       ("xvfb" ,xorg-server-for-tests)))
+     (list dbus-test-runner
+           (list glib "bin")
+           pkg-config
+           xorg-server-for-tests))
    (inputs
     (list gtk+ glib))
    (arguments
@@ -3417,50 +3418,50 @@ interfaces.")
 (define-public xdg-desktop-portal-wlr
  (package
    (name "xdg-desktop-portal-wlr")
-    (version "0.7.1")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/emersion/xdg-desktop-portal-wlr")
-                     (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "1mbq3czka9swwmfaasnaj89y2m254p3qa522ayclh688jdwh70hq"))
-              (patches (search-patches "xdg-desktop-portal-wlr-harcoded-length.patch"))))
+    (version "0.8.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/emersion/xdg-desktop-portal-wlr")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1jj0a9s3h3i04qsxkhcpxjzbb17hs9ngdy7wkypja09233zdz10w"))
+       (patches (search-patches "xdg-desktop-portal-wlr-harcoded-length.patch"))))
    (build-system meson-build-system)
    (arguments
-     `(#:configure-flags
-       '("-Dsystemd=disabled"
-         "-Dsd-bus-provider=libelogind")
-       #:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'hardcode-binaries
-           (lambda* (#:key inputs #:allow-other-keys)
-             (let ((sh (search-input-file inputs "/bin/sh"))
-                   (grim (search-input-file inputs "/bin/grim"))
-                   (slurp (search-input-file inputs "/bin/slurp")))
-               (substitute* "src/screenshot/screenshot.c"
-                 (("grim") grim)
-                 (("slurp") slurp)
-                 (("execl\\(\"/bin/sh\", \"/bin/sh\"")
-                  (string-append "execl(\"" sh "\", \"" sh "\"")))
-               (substitute* "src/screencast/screencast.c"
-                 (("execvp\\(\"sh")
-                  (string-append "execvp(\"" sh))))))
-         (add-after 'install 'install-documentation
-           (lambda* (#:key outputs #:allow-other-keys)
-             (install-file "../source/README.md"
-                           (string-append (assoc-ref outputs "out")
-                                          "/share/doc/" ,name)))))))
-    (native-inputs
-     (list cmake-minimal pkg-config scdoc))
-    (inputs (list elogind
-                  bash-minimal
+     (list
+      #:configure-flags
+      #~(list "-Dsystemd=disabled"
+              "-Dsd-bus-provider=libelogind")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'hardcode-binaries
+            (lambda* (#:key inputs #:allow-other-keys)
+              (let ((sh (search-input-file inputs "/bin/sh"))
+                    (grim (search-input-file inputs "/bin/grim"))
+                    (slurp (search-input-file inputs "/bin/slurp")))
+                (substitute* '("src/screencast/chooser.c"
+                               "src/screenshot/screenshot.c")
+                  (("grim") grim)
+                  (("slurp") slurp)
+                  (("/bin/sh") sh))
+                (substitute* "src/screencast/screencast.c"
+                  (("execvp\\(\"sh")
+                   (format #f "execvp(\"~a" sh))))))
+          (add-after 'install 'install-documentation
+            (lambda _
+              (install-file "../source/README.md"
+                            (string-append #$output "/share/doc/"
+                                           #$name)))))))
+    (native-inputs (list cmake-minimal pkg-config scdoc))
+    (inputs (list bash-minimal
+                  elogind
                  grim
                  iniparser
-                  mesa
                  libinih
+                  mesa
                  pipewire
                  slurp
                  wayland
@@ -552,14 +552,14 @@ use with @code{udev-service-type}.")
 (define-public armagetronad
  (package
    (name "armagetronad")
-    (version "0.2.9.2.3")
+    (version "0.2.9.3.0")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://sourceforge/armagetronad/stable/"
                                  version "/armagetronad-" version ".tbz"))
              (sha256
               (base32
-                "0a6rlp2lj5bp7pg1yf8brjyb3mw7nqp3amj19wvz3xni21bbc31k"))))
+                "1q1zlbhbcimr6bw0ms1pr8hz4q850ivi3hvxn3467jfgiq22f3cy"))))
    (build-system gnu-build-system)
    (arguments
     (list #:configure-flags
@@ -576,6 +576,7 @@ use with @code{udev-service-type}.")
                     (("^install_link .*BINDIR.*") "")))))))
    (native-inputs (list pkg-config))
    (inputs (list libxml2
+                  curl
                  (sdl-union (list sdl sdl-image sdl-mixer))
                  freeglut
                  libpng
@@ -4128,7 +4129,7 @@ a C library, so they can easily be integrated into other programs.")
 (define-public taisei
  (package
    (name "taisei")
-    (version "1.4.2")
+    (version "1.4.4")
    (source
     (origin
       (method url-fetch)
@@ -4136,7 +4137,7 @@ a C library, so they can easily be integrated into other programs.")
                           "taisei/releases/download/v" version
                           "/taisei-" version ".tar.xz"))
       (sha256
-        (base32 "19sgm175clkvpcv0b9p4jkjpfxqw0kyl2i5p8w63kwzqcjp9m1jx"))))
+        (base32 "13b2ha8nsdzbydirvc7hw1q46jzhn6cx9b9spgk777swjlgx2vph"))))
    (build-system meson-build-system)
    (arguments
     (list
@@ -4145,7 +4146,8 @@ a C library, so they can easily be integrated into other programs.")
                                "-Dr_gles30=enabled"
                                "-Dshader_transpiler=enabled")))
    (native-inputs
-     (list pkg-config
+     (list cmake-minimal
+           pkg-config
           python
           python-docutils
           python-pygments
@@ -4153,24 +4155,29 @@ a C library, so they can easily be integrated into other programs.")
    (inputs
     (list cglm
           freetype
+           glslang
+           libdecor                     ; XXX: for sdl3
           libpng
           libwebp
           libzip
           mesa
           openssl
           opusfile
-           sdl2
-           sdl2-mixer
+           sdl3
           shaderc
           spirv-cross
+           spirv-tools                  ; for glslang
+           vulkan-loader                ; XXX: for sdl3?
           zlib
           (list zstd "lib")))
    (home-page "https://taisei-project.org/")
    (synopsis "Shoot'em up fangame and libre clone of Touhou Project")
    (description
-     "The player controls a character (one of three: Good, Bad, and Dead),
-dodges the missiles (lots of it cover the screen, but the character's hitbox
-is very small), and shoot at the adversaries that keep appear on the screen.")
+     "Taisei is a vertical shoot'em up game, in which the player controls
+one of three characters.  While moving through stages, a large number of
+enemies and even larger amounts of bullets appear that require careful
+maneuvers to dodge.  By shooting the enemies, players receive powerups
+for their characters, allowing them to shoot even more.")
    (license (list
              ;; game
              license:expat
@@ -4723,6 +4730,10 @@ for common mesh file formats, and collision detection.")
                      (url "https://github.com/thelaui/M.A.R.S.")
                      (commit commit)))
                (file-name (git-file-name name version))
+                (modules '((guix build utils)))
+                (snippet
+                 #~(begin
+                     (delete-file-recursively "ext_libs_for_windows")))
                (sha256
                 (base32
                  "0bdi4ja39rark742qvqixm8khai5k8qd84z5kzim9jcjdvvwyqj9"))))
@@ -4749,7 +4760,8 @@ for common mesh file formats, and collision detection.")
 attractive physics.  Players can battle each other or computer controlled
 enemies in different game modes such as space ball, death match, team death
 match, cannon keep, and grave-itation pit.")
-      (license license:gpl3+))))
+      (license (list license:gpl3+
+                     license:cc-by-sa3.0))))) ;/data/audio/music

 (define-public alienblaster
  (package
@@ -5344,7 +5356,9 @@ also available.")
                   (with-directory-excursion "src"
                     (substitute* "CMakeLists.txt"
                       (("glm::glm")
-                        "glm")))))))
+                        "glm")))
+                   ;; Rename the icon to match with the executable file.
+                   (rename-file "srb2.png" "ringracers.png")))))
    (build-system cmake-build-system)
    (arguments
     (list
@@ -5354,15 +5368,30 @@ also available.")
              "-DCMAKE_CXX_FLAGS_RELWITHDEBINFO='-O3 -g -DNDEBUG'")
      #:phases
      #~(modify-phases %standard-phases
-          (add-after 'install 'move-and-wrap-binary
+          (replace 'install
+            (lambda _
+              (install-file "bin/ringracers" (string-append #$output "/bin"))
+              (install-file "../source/ringracers.png"
+                            (string-append #$output "/share/pixmaps"))))
+          (add-after 'install 'wrap-program
            ;; Install executable to $out/bin.
            (lambda* (#:key inputs #:allow-other-keys)
-              (with-directory-excursion #$output
-                (mkdir "bin")
-                (rename-file "ringracers" "bin/ringracers")
-                (wrap-program "bin/ringracers"
-                  `("RINGRACERSWADDIR" =
-                    (,(assoc-ref inputs "ring-racers-data"))))))))))
+              (wrap-program "bin/ringracers"
+                `("RINGRACERSWADDIR" =
+                  (,(assoc-ref inputs "ring-racers-data"))))))
+          (add-after 'wrap-program 'create-desktop-entry
+            (lambda _
+              (let* ((datadir (string-append #$output "/share"))
+                     (appdir (string-append datadir "/applications")))
+                (mkdir-p appdir)
+                (make-desktop-entry-file (string-append appdir
+                                                        "/ringracers.desktop")
+                  #:name "Dr. Robotnik's Ring Racers"
+                  #:comment "Technical kart racing game"
+                  #:icon "ringracers"
+                  #:exec (string-append #$output "/bin/ringracers")
+                  #:startup-notify #f
+                  #:categories '("Application" "Game"))))))))
    (native-inputs (list pkg-config))
    (inputs (list glm
                  libogg
@@ -5954,7 +5983,7 @@ Transport Tycoon Deluxe.")
  (package
    (inherit openttd)
    (name "openttd-jgrpp")
-    (version "0.71.1")
+    (version "0.71.2")
    (source
     (origin
       (method git-fetch)
@@ -5963,7 +5992,7 @@ Transport Tycoon Deluxe.")
             (commit (string-append "jgrpp-" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1cy1ghc1mc61hdz8lykx2ggs5nld30jdgj8y4vdli2v1ffhy7xy9"))))
+        (base32 "1gb5gickmf1d1wkzqny5ryapvw32a2g94f77iq0102xhyyw8g8s0"))))
    (inputs (modify-inputs inputs
              (append zstd harfbuzz)))
    (arguments
@@ -425,14 +425,29 @@ hierarchical hexagonal geospatial indexing system")
               (base32
                "00qdk9a4048pzfj2rhzkfw3lvm642znf6kr4x29i3d94494pxsnn"))))
    (build-system cmake-build-system)
-    (arguments `(#:phases
-                 (modify-phases %standard-phases
-                   (add-after
-                    'unpack 'patch-test-shebangs
-                    (lambda _
-                      (substitute* '("tests/xmltester/testrunner.sh"
-                                     "tests/xmltester/safe_to_xml.sh")
-                        (("/bin/sh") (which "sh"))))))))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         ,@(if (or (target-x86-32?) (target-arm32?))
+               '((add-after 'unpack 'disable-broken-tests
+                   (lambda _
+                     ;; This test fails due to limited accuracy.
+                     (delete-file "tests/xmltester/tests/general/TestCentroid.xml")
+                     (with-directory-excursion "tests/unit"
+                       ;; These also fail due to limited accuracy.
+                       (delete-file "algorithm/MinimumAreaRectangleTest.cpp")
+                       (delete-file "capi/GEOSMinimumRotatedRectangleTest.cpp")
+                       ;; It is unclear why these fail, but I'm guessing:
+                       ;; limited accuracy.
+                       (delete-file "linearref/LengthIndexedLineTest.cpp")
+                       (delete-file "math/DDTest.cpp")))))
+               '())
+         (add-after
+             'unpack 'patch-test-shebangs
+           (lambda _
+             (substitute* '("tests/xmltester/testrunner.sh"
+                            "tests/xmltester/safe_to_xml.sh")
+               (("/bin/sh") (which "sh"))))))))
    (inputs
     (list glib))
    (home-page "https://libgeos.org/")
@@ -955,6 +970,29 @@ hydrology and waste deposition.")
        (base32
         "03r6mspfv22fs4x4jcgv25v9gsj5k6zy8incvyf94qf50g47s2bc"))))
    (build-system cmake-build-system)
+    (arguments
+     (if (target-32bit?)
+         (list
+          #:phases
+          '(modify-phases %standard-phases
+             (add-after 'unpack 'patch-tests
+               (lambda _
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/unit/test_factory.cpp"
+                   (("^TEST\\(factory, AuthorityFactory_createUnitOfMeasure_linear_us_survey_foot\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_grids.cpp"
+                   (("^TEST_F\\(GridTest, VerticalShiftGridSet_gtx\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_defmodel.cpp"
+                   (("^TEST\\(defmodel, evaluator_horizontal_unit_metre\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/CMakeLists.txt"
+                   (("proj_add_gie_test\\(\"4D-API-cs2cs-style\".+") "")
+                   (("proj_add_gie_test\\(\"Builtins\".+") "")
+                   (("proj_add_gie_test\\(\"peirce_q\".+") ""))))))
+         '()))
    (native-inputs (list googletest pkg-config))
    (propagated-inputs (list curl libtiff sqlite)) ;required by proj.pc
    (home-page "https://proj.org/")
@@ -984,7 +1022,34 @@ lets developers use the functionality of Proj in their own software.")
                           version ".tar.gz"))
       (sha256
        (base32
-         "1g0hkpiablvhsmw0kn5frwgdir3q7avc45p6lc1zhhhzkv5ikydh"))))))
+         "1g0hkpiablvhsmw0kn5frwgdir3q7avc45p6lc1zhhhzkv5ikydh"))))
+    (arguments
+     (if (target-32bit?)
+         (list
+          #:phases
+          '(modify-phases %standard-phases
+             (add-after 'unpack 'patch-tests
+               (lambda _
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/unit/test_factory.cpp"
+                   (("^TEST\\(factory, AuthorityFactory_createUnitOfMeasure_linear_us_survey_foot\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_grids.cpp"
+                   (("^TEST_F\\(GridTest, VerticalShiftGridSet_gtx\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_defmodel.cpp"
+                   (("^TEST\\(defmodel, evaluator_horizontal_unit_metre\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/CMakeLists.txt"
+                   (("proj_add_gie_test\\(\"4D-API-cs2cs-style\".+") "")
+                   (("proj_add_gie_test\\(\"Builtins\".+") "")
+                   (("proj_add_gie_test\\(\"peirce_q\".+") "")
+                   (("proj_add_gie_test\\(\"adams_ws2\".+") ""))
+                 (substitute* "test/cli/CMakeLists.txt"
+                   (("proj_add_test_script_sh\\(\"testvarious\" CS2CS_BIN\\)") ""))))))
+         '()))))
+

 (define-public python-obspy
  (package
@@ -1219,20 +1284,23 @@ readily with other Python GIS packages such as pyproj, Rtree, and Shapely.")
 (define-public python-geopack
  (package
    (name "python-geopack")
-    (version "1.0.10")
+    (version "1.0.12")
    (source
     (origin
-       (method url-fetch)
-       (uri (pypi-uri "geopack" version))
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/tsssss/geopack")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
       (sha256
-        (base32 "0mryjp7m4h99qlpvnn40s81sygr73qcv8rkmjp9pcli1gz829kjf"))))
+        (base32 "0ap5j4359xxjkbz06y097yq5d37sxcwlnlsfwrv6dvza7ydmgcgg"))))
    (build-system pyproject-build-system)
    (arguments
     (list
      ;; XXX Reported upstream <https://github.com/tsssss/geopack/issues/21>.
      #:tests? #f))
    (native-inputs
-     (list python-pytest python-setuptools python-wheel))
+     (list python-setuptools))
    (propagated-inputs
     (list python-numpy python-scipy))
    (home-page "https://github.com/tsssss/geopack")
@@ -10674,6 +10674,7 @@ playing media, scanning, and much more.")
                            system-config-printer
                            xdg-desktop-portal
                            xdg-user-dirs
+                            xdg-user-dirs-gtk
                            yelp
                            zenity))
   (description "This package provides a list of packages required for
@@ -11575,7 +11576,8 @@ accessibility infrastructure.")
                    name "-" version ".tar.xz"))
              (sha256
               (base32
-                "0sfs06f66dsibvnp87jshhs7n3f8shkn9x7j3ygpk8409za2n2xy"))))
+                "0sfs06f66dsibvnp87jshhs7n3f8shkn9x7j3ygpk8409za2n2xy"))
+              (patches (search-patches "orca-fix-gst-init-check-call.patch"))))
    (build-system meson-build-system)
    (arguments
     '(#:glib-or-gtk? #t
@@ -11593,10 +11595,7 @@ accessibility infrastructure.")
                   (pgrep (string-append
                           (assoc-ref inputs "procps") "/bin/pgrep")))
               (substitute* "src/orca/orca_modifier_manager.py"
-                 (("'xkbcomp'") (format #f "'~a'" xkbcomp)))
-               (substitute* "src/orca/debug.py"
-                 (("'pgrep %s'")
-                  (format #f "'~a %s'" pgrep)))
+                 (("\"xkbcomp\"") (format #f "'~a'" xkbcomp)))
               (substitute* "src/orca/orca_bin.py.in"
                 (("'pgrep -u %s -x orca'")
                  (format #f "'~a -u %s -x orca'" pgrep))))))
@@ -11627,6 +11626,7 @@ accessibility infrastructure.")
           `(,liblouis "python")
           procps                       ; for pgrep
           python
+           python-dbus
           python-pygobject-3.50
           python-pyatspi
           speech-dispatcher
@@ -26,6 +26,7 @@
 ;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
 ;;; Copyright © 2025 Antoine Côté <antoine.cote@posteo.net>
 ;;; Copyright © 2026 Luis Guilherme Coelho <lgcoelho@disroot.org>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -971,10 +972,8 @@ passphrase when @code{gpg} is run and needs it.")))
           (lambda _
             (invoke "sh" "autogen.sh"))))))
    (native-inputs
-     `(("autoconf" ,autoconf)
-       ("automake" ,automake)
-       ("gettext" ,gettext-minimal)
-       ,@(package-native-inputs pinentry-tty)))
+     (modify-inputs native-inputs
+       (prepend autoconf automake gettext-minimal)))
    (inputs
     (modify-inputs inputs
       (prepend efl)))
@@ -605,9 +605,9 @@ in the case of Firefox, it is browser/locales/all-locales."
    "zh-TW"))

 ;;; Please keep these versions in sync with icedove.
-(define %icecat-base-version "140.10.0")
+(define %icecat-base-version "140.10.1")
 (define %icecat-version (string-append %icecat-base-version "-gnu1"))
-(define %icecat-build-id "20260421000000") ;must be of the form YYYYMMDDhhmmss
+(define %icecat-build-id "20260428000000") ;must be of the form YYYYMMDDhhmmss

 ;; 'icecat-source' is a "computed" origin that generates an IceCat tarball
 ;; from the corresponding upstream Firefox ESR tarball, using the 'makeicecat'
@@ -627,9 +627,9 @@ in the case of Firefox, it is browser/locales/all-locales."
                  "firefox-" upstream-firefox-version ".source.tar.xz"))
            (sha256
             (base32
-              "06996548nfmn4r4mfw3wvgb1mp35majc5hjyhs1krgp33ck2m1f0"))))
+              "1fx52y52c3dmgr5gm64x40r2n6zq5ckqiqsd6vlhsly5wb1w0xaf"))))

-         (gnuzilla-commit "02125f31250c0240ee2ab1aa629ce66d4ffb9f30")
+         (gnuzilla-commit "5162cbc74c483c361ad5709c767c5cb2395ff4f9")
         (gnuzilla-source
          (origin
            (method git-fetch)
@@ -640,7 +640,7 @@ in the case of Firefox, it is browser/locales/all-locales."
                                      (string-take gnuzilla-commit 8)))
            (sha256
             (base32
-              "1hgx286gp0j46pklzzh5kvsnari1j3s0bff384m505m942k6l4hf"))))
+              "06qyirgjjgy7fwn7mbrz23wsdv9a88w70pz8qm1yszln74xxdsp0"))))

         ;; 'search-patch' returns either a valid file name or #f, so wrap it
         ;; in 'assume-valid-file-name' to avoid 'local-file' warnings.
@@ -245,6 +245,55 @@ go-fuzz-headers.")
@end itemize")
    (license license:expat)))

+(define-public go-github-com-alexkohler-prealloc
+  (package
+    (name "go-github-com-alexkohler-prealloc")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/alexkohler/prealloc")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "011i8yqzyjgwj17k44xvvg4bxfv8z20s0416r2d3yf4s3wqqygpq"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/alexkohler/prealloc"))
+    (home-page "https://github.com/alexkohler/prealloc")
+    (synopsis "Find slice declarations that could be preallocated")
+    (description
+     "This package is a Go static analysis tool to find slice declarations
+that could potentially be preallocated.")
+    (license license:expat)))
+
+(define-public go-github-com-alingse-asasalint
+  (package
+    (name "go-github-com-alingse-asasalint")
+    (version "0.0.11")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/alingse/asasalint")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1avz33cx3gcpps26rxijv7ic0njfmsdkbcp2mqg5yxhdcpq57s0q"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/alingse/asasalint"))
+    (propagated-inputs
+     (list go-golang-org-x-tools))
+    (home-page "https://github.com/alingse/asasalint")
+    (synopsis "Lint pass any slice as any in variadic function")
+    (description
+     "Golang linter, lint that pass any slice as any in variadic function.")
+    (license license:expat)))
+
 (define-public go-github-com-andreyvit-diff
  (package
    (name "go-github-com-andreyvit-diff")
@@ -603,6 +652,42 @@ time functions.")
 strings which may be used in mock tests.")
    (license license:unlicense)))

+(define-public go-github-com-daixiang0-gci
+  (package
+    (name "go-github-com-daixiang0-gci")
+    (version "0.13.7")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/daixiang0/gci")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1vhnqisf6d706qvswccb0d7bkbl53lyi84f5sl3zyaf6yk8ml9dx"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:import-path "github.com/daixiang0/gci"))
+    (native-inputs
+     (list go-github-com-stretchr-testify
+           go-github-com-spf13-cobra))
+    (propagated-inputs
+     (list go-gopkg-in-yaml-v3
+           go-golang-org-x-tools
+           go-golang-org-x-sync
+           go-golang-org-x-mod
+           go-go-uber-org-zap
+           go-github-com-pmezard-go-difflib
+           go-github-com-hexops-gotextdiff))
+    (home-page "https://github.com/daixiang0/gci")
+    (synopsis "Tool to make Go import order deterministic")
+    (description
+     "This package provides a tool that controls Go package import order and
+makes it always deterministic.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-data-dog-go-sqlmock
  (package
    (name "go-github-com-data-dog-go-sqlmock")
@@ -676,6 +761,34 @@ style).
@end itemize")
    (license license:isc)))

+(define-public go-github-com-denis-tingaikin-go-header
+  (package
+    (name "go-github-com-denis-tingaikin-go-header")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/denis-tingaikin/go-header")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0qzy2ps59dzsdn4ny8x48k9d1kscpddjilkxra1w16npsvix6mcm"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/denis-tingaikin/go-header"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (propagated-inputs
+     (list go-golang-org-x-tools
+           go-gopkg-in-yaml-v3))
+    (home-page "https://github.com/denis-tingaikin/go-header")
+    (synopsis "Go linter for copyright headers")
+    (description
+     "Simple Go source code linter providing checks for copyright headers.")
+    (license license:gpl3)))
+
 (define-public go-github-com-dgryski-go-ddmin
  (package
    (name "go-github-com-dgryski-go-ddmin")
@@ -885,6 +998,31 @@ can use the mock clock.  This is a maintained fork of benbjohnson's
@url{https://github.com/benbjohnson/clock, clock} package.")
    (license license:expat)))

+(define-public go-github-com-firefart-nonamedreturns
+  (package
+    (name "go-github-com-firefart-nonamedreturns")
+    (version "1.0.6")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/firefart/nonamedreturns")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1y9dz8rkd55p1rkib4y3b0czs44c2bb1pmlr4k53ms1k8d9bjgwk"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/firefart/nonamedreturns"))
+    (propagated-inputs
+     (list go-golang-org-x-tools))
+    (home-page "https://github.com/firefart/nonamedreturns")
+    (synopsis "Go linter to catch named returns")
+    (description
+     "This package provides a linter to find named returns in Go code.")
+    (license license:gpl3)))
+
 ;; XXX: The project looks like abandoned, see
 ;; <https://github.com/frankban/quicktest/issues/172>, remove when nothing
 ;; depends on it.
@@ -923,6 +1061,30 @@ can use the mock clock.  This is a maintained fork of benbjohnson's
 tests.")
    (license license:expat)))

+(define-public go-github-com-fzipp-gocyclo
+  (package
+    (name "go-github-com-fzipp-gocyclo")
+    (version "0.6.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/fzipp/gocyclo")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1w2h8qlifrskn8g8zcwb6banr9si0vck9y8irg1r51mc98cjv36l"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/fzipp/gocyclo"))
+    (home-page "https://github.com/fzipp/gocyclo")
+    (synopsis "Calculate cyclomatic complexity in Go")
+    (description
+     "This package calculates the cyclomatic complexities of functions and
+methods in Go source code.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-gdey-tbltest
  (package
    (name "go-github-com-gdey-tbltest")
@@ -947,6 +1109,45 @@ tests.")
 tests.")
    (license license:expat)))

+(define-public go-github-com-ghostiam-protogetter
+  (package
+    (name "go-github-com-ghostiam-protogetter")
+    (version "0.3.20")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/ghostiam/protogetter")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1hap2ykmlnan5vz8sczdpiv93iidbgl13mlcdx468nhfprg2hbbm"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:tests? #f ;"module lookup disabled by GOPROXY=off"
+      #:import-path "github.com/ghostiam/protogetter"))
+    (propagated-inputs
+     (list go-golang-org-x-tools
+           go-github-com-gobwas-glob))
+    (home-page "https://github.com/ghostiam/protogetter")
+    (synopsis "Protobuf Golang linter")
+    (description
+     "This package is a linter developed specifically for Go programmers
+working with nested @code{protobuf} types.  It's designed to aid developers in
+preventing invalid memory address or nil pointer dereference errors arising
+from direct access of nested protobuf fields.
+
+When working with protobuf, it's quite common to have complex structures where
+a message field is contained within another message, which itself can be part
+of another message, and so on. If these fields are accessed directly and some
+field in the call chain will not be initialized, it can result in application
+panic.
+
+Protogetter addresses this issue by suggesting use of getter methods for field
+access.")
+    (license license:expat)))
+
 (define-public go-github-com-gkampitakis-ciinfo
  (package
    (name "go-github-com-gkampitakis-ciinfo")
@@ -1202,6 +1403,29 @@ kept in fixtures files.  Before the execution of every test, the test database
 is cleaned and the fixture data is loaded into the database.")
    (license license:expat)))

+(define-public go-github-com-go-xmlfmt-xmlfmt
+  (package
+    (name "go-github-com-go-xmlfmt-xmlfmt")
+    (version "1.1.3")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/go-xmlfmt/xmlfmt")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1cglrwmpg0lb7cnyvdz8js52h07rcvka7y9abksk9p5ajxj5rp1s"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/go-xmlfmt/xmlfmt"))
+    (home-page "https://github.com/go-xmlfmt/xmlfmt")
+    (synopsis "Go XML Formatter")
+    (description
+     "The Go XML Formatter, xmlfmt, will format the XML string in a readable way.")
+    (license license:expat)))
+
 ;; XXX: This repository has been archived by the owner
 ;; on May 9, 2021. It is now read-only. It's only used
 ;; by go-github-com-golang-gddo. Consider to remove when nothing
@@ -3967,6 +4191,20 @@ thoroughly
                    "  This package provides an command line interface (CLI)
 tool."))))

+(define-public go-gci
+  (package/inherit go-github-com-daixiang0-gci
+    (name "go-gci")
+    (arguments
+     (substitute-keyword-arguments arguments
+       ((#:tests? _ #t) #f)
+       ((#:install-source? _ #t) #f)
+       ((#:skip-build? _ #t) #f)))
+    (native-inputs
+     (append (package-native-inputs go-github-com-daixiang0-gci)
+             (package-propagated-inputs go-github-com-daixiang0-gci)))
+    (propagated-inputs '())
+    (inputs '())))
+
 (define-public go-pgmockproxy
  (package/inherit go-github-com-jackc-pgmock
    (name "go-pgmockproxy")
@@ -4090,6 +4328,21 @@ prints an ASCII fraphic representing the memory layout.")))
                    "  This package provides an command line interface (CLI)
 tool."))))

+(define-public protogetter
+  (package/inherit go-github-com-ghostiam-protogetter
+    (name "protogetter")
+    (arguments
+     (substitute-keyword-arguments arguments
+       ((#:tests? _ #f) #f)
+       ((#:skip-build? _ #t) #f)
+       ((#:install-source? _ #t) #f)
+       ((#:import-path _) "github.com/ghostiam/protogetter/cmd/protogetter")
+       ((#:unpack-path _ "") "github.com/ghostiam/protogetter")))
+    (native-inputs
+     (package-propagated-inputs go-github-com-ghostiam-protogetter))
+    (propagated-inputs '())
+    (inputs '())))
+
 (define-public unparam
  (package
    (inherit go-mvdan-cc-unparam)
@@ -1600,7 +1600,7 @@ RSA, RSA-PSS, and ECDSA, though hooks are present for adding your own.")
 (define-public go-github-com-google-go-tpm
  (package
    (name "go-github-com-google-go-tpm")
-    (version "0.9.1")
+    (version "0.9.4")
    (source
     (origin
       (method git-fetch)
@@ -1609,7 +1609,7 @@ RSA, RSA-PSS, and ECDSA, though hooks are present for adding your own.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1c5j5cvwl45ka93nknmv454ivd7kp9n8yql19gr6z01z0s1ph7sg"))))
+        (base32 "1sp1mbr6vz36zy9w36iksirbsj5p2jslsl8zs1cdj8s4ig4lkd9d"))))
    (build-system go-build-system)
    (arguments
     (list
@@ -3286,6 +3286,37 @@ to support the streaming mode required by Go's standard Hash interface.")
@url{https://www.rfc-editor.org/errata/rfc7512, errata} specifications.")
    (license license:asl2.0)))

+(define-public go-github-com-tailscale-golang-x-crypto
+  (package
+    (name "go-github-com-tailscale-golang-x-crypto")
+    (version "0.91.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/tailscale/golang-x-crypto")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0m9qkk48mihrkmfh1fzfhc39l8957qkpfx8qbw4xdjws7dy4vzbz"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:tests? #f ;Tests have broken package imports (expected as per readme)
+      #:import-path "github.com/tailscale/golang-x-crypto"))
+    (propagated-inputs
+     (list go-golang-org-x-crypto
+           go-golang-org-x-term
+           go-golang-org-x-sys
+           go-golang-org-x-net))
+    (home-page "https://github.com/tailscale/golang-x-crypto")
+    (synopsis "Supplementary Go crypto libraries")
+    (description
+     "This package holds supplementary Go cryptography libraries, it's a fork
+of @code{golang.org/x/crypto} maintained by Tailscale.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-tink-crypto-tink-go-v2
  (package
    (name "go-github-com-tink-crypto-tink-go-v2")
@@ -456,6 +456,29 @@ penalization.")
 FFT (Schonhage-Strassen method for multiplying integers).")
    (license license:bsd-3)))

+(define-public go-github-com-robinus2-golang-moving-average
+  (package
+    (name "go-github-com-robinus2-golang-moving-average")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/RobinUS2/golang-moving-average")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "02z3ad29653fz7whxkjjpq820ig9j8m68xj4kay14jyazkr5in1f"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/RobinUS2/golang-moving-average"))
+    (home-page "https://github.com/RobinUS2/golang-moving-average")
+    (synopsis "Moving average implementation for Go")
+    (description
+     "This package provides a moving average implementation for Go.")
+    (license license:asl2.0)))
+
 (define-public go-github-com-shopspring-decimal
  (package
    (name "go-github-com-shopspring-decimal")
@@ -76,6 +76,7 @@
 ;;; Copyright © 2026 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;; Copyright © 2026 Evgeny Pisemsky <mail@pisemsky.site>
 ;;; Copyright © 2026 Vinicius Monego <monego@posteo.net>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -120,7 +121,13 @@
  #:use-module (gnu packages serialization)
  #:use-module (gnu packages specifications)
  #:use-module (gnu packages xdisorg)
-  #:use-module (gnu packages xorg))
+  #:use-module (gnu packages xorg)
+
+  ;; TODO: Remove when go-github-com-containerd-containerd is moved to (gnu
+  ;; packages containers)
+  #:use-module (gnu packages docker)
+  #:use-module (gnu packages prometheus)
+  #:use-module (gnu packages kubernetes))

 ;;; Commentary:
 ;;;
@@ -525,6 +532,35 @@ file along with an index.html file.")
     "Package tcell provides a gruid Driver for making terminal apps.")
    (license license:isc)))

+(define-public go-codeberg-org-chavacava-garif
+  (package
+    (name "go-codeberg-org-chavacava-garif")
+    (version "0.2.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://codeberg.org/chavacava/garif.git")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0cz037yb9gnk9fd61pni6m0n9cbrwmlxxija5vm91mplyxlih05h"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "codeberg.org/chavacava/garif"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (home-page "https://codeberg.org/chavacava/garif")
+    (synopsis "Create and manipulate SARIF logs")
+    (description
+     "This package defines all the Go structures required to model a log file.
+
+SARIF, from Static Analysis Results Interchange Format, is a standard
+JSON-based format for the output of static analysis tools defined and promoted
+by @url{https://www.oasis-open.org/, OASIS}.")
+    (license license:expat)))
+
 (define-public go-codeberg-org-emersion-go-scfg
  (package
    (name "go-codeberg-org-emersion-go-scfg")
@@ -613,6 +649,33 @@ recursively any exported one.  It also won't merge structs inside
 maps (because they are not addressable using Go reflection).")
    (license license:bsd-3)))

+(define-public go-fyne-io-systray
+  (package
+    (name "go-fyne-io-systray")
+    (version "1.11.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/fyne-io/systray")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0yrd4f3n8wrqcqradmqq9w0b31hd5hali876xkynfhm3nhaz4j1i"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "fyne.io/systray"))
+    (propagated-inputs
+     (list go-github-com-godbus-dbus-v5
+           go-golang-org-x-sys))
+    (home-page "https://fyne.io/systray/")
+    (synopsis "Place an icon and menu in the notification area")
+    (description
+     "This package is a cross-platform Go library to place an icon and menu in
+the notification area.")
+    (license license:asl2.0)))
+
 (define-public go-git-sr-ht-rjarry-go-opt
  (package
    (name "go-git-sr-ht-rjarry-go-opt")
@@ -2981,6 +3044,38 @@ input from the terminal while not echoing the input back (similar to
 and is therefore compatible with cross-compiling.")
    (license license:expat)))

+(define-public go-github-com-bitfield-script
+  (package
+    (name "go-github-com-bitfield-script")
+    (version "0.24.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/bitfield/script")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1pzmz7n39sh9sprclzd0m0l0flf626286fh51m065yjhkqzrjw89"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/bitfield/script"
+      #:test-flags #~(list "-vet=off")))
+    (native-inputs
+     (list go-github-com-google-go-cmp))
+    (propagated-inputs
+     (list go-github-com-itchyny-gojq
+           go-github-com-rogpeppe-go-internal
+           go-mvdan-cc-sh-v3))
+    (home-page "https://github.com/bitfield/script")
+    (synopsis "Making it easy to write shell-like scripts in Go")
+    (description
+     "Package script aims to make it easy to write shell-type scripts in Go,
+for general system administration purposes: reading files, counting lines,
+matching strings, and so on.")
+    (license license:expat)))
+
 (define-public go-github-com-bitly-go-hostpool
  (package
    (name "go-github-com-bitly-go-hostpool")
@@ -4433,6 +4528,34 @@ over strings.")
@code{https://en.wikipedia.org/wiki/WebP, WebP} images.")
    (license license:bsd-3)))

+(define-public go-github-com-chainguard-dev-clog
+  (package
+    (name "go-github-com-chainguard-dev-clog")
+    (version "1.8.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/chainguard-dev/clog")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0b95vw8czs2r9lscyi85vppbyqj672zm6z2n9siy1s9yv6fkys62"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/chainguard-dev/clog"))
+    (home-page "https://github.com/chainguard-dev/clog")
+    (synopsis "Context aware slog")
+    (description
+     "This package provides a context-aware Go std lib
+@url{https://pkg.go.dev/log/slog, @code{slog}}.  The context Logger can be
+used to use Loggers from the context.  This is sometimes preferred over the
+@url{https://github.com/chainguard-dev/clog#context-handler, Context Handler},
+since this can make it easier to use different loggers in different
+contexts (e.g. testing).")
+    (license license:asl2.0)))
+
 (define-public go-github-com-charlievieth-fastwalk
  (package
    (name "go-github-com-charlievieth-fastwalk")
@@ -6039,6 +6162,7 @@ dependencies and a simple API.")
    (license license:asl2.0)))

 (define-public go-github-com-containerd-containerd
+  ;; TODO: Move to (gnu packages containers).
  (package
    (name "go-github-com-containerd-containerd")
    (version "1.7.22")
@@ -6046,110 +6170,156 @@ dependencies and a simple API.")
     (origin
       (method git-fetch)
       (uri (git-reference
-             (url "https://github.com/containerd/containerd")
-             (commit (string-append "v" version))))
+              (url "https://github.com/containerd/containerd")
+              (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
        (base32 "1yfda4qnygy4lcqb6cqc7v7h2lf0gl64xhvkp39zngmqm0lw30gh"))
       (snippet
        #~(begin
            (use-modules (guix build utils))
-            (delete-file-recursively "vendor")))))
+            (delete-file-recursively "vendor")
+            ;; Submodules with their own go.mod files and packaged separately:
+            ;;
+            ;; - github.com/containerd/containerd/api
+            (delete-file-recursively "api")))))
    (build-system go-build-system)
-
-    ;; For the forgejo-runner build, we only need the pkg/userns module which
-    ;; doesn't require the massive dependency tree for all of containerd, so
-    ;; we cheat and skip the build and avoid having to package a large number
-    ;; of additional dependencies.
    (arguments
     (list
      #:import-path "github.com/containerd/containerd"
      #:skip-build? #t
-      #:tests? #f))
-    ;; (propagated-inputs
-    ;;  (list go-tags-cncf-io-container-device-interface
-    ;;        go-k8s-io-utils
-    ;;        go-k8s-io-klog-v2
-    ;;        go-k8s-io-cri-api
-    ;;        go-k8s-io-component-base
-    ;;        go-k8s-io-client-go
-    ;;        go-k8s-io-apiserver
-    ;;        go-k8s-io-apimachinery
-    ;;        go-k8s-io-api
-    ;;        go-google-golang-org-protobuf
-    ;;        go-google-golang-org-grpc
-    ;;        go-google-golang-org-genproto-googleapis-rpc
-    ;;        go-google-golang-org-genproto
-    ;;        go-golang-org-x-sys
-    ;;        go-golang-org-x-sync
-    ;;        go-golang-org-x-net
-    ;;        go-go-opentelemetry-io-otel-trace
-    ;;        go-go-opentelemetry-io-otel-sdk
-    ;;        go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracehttp
-    ;;        go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracegrpc
-    ;;        go-go-opentelemetry-io-otel-exporters-otlp-otlptrace
-    ;;        go-go-opentelemetry-io-otel
-    ;;        go-go-opentelemetry-io-contrib-instrumentation-net-http-otelhttp
-    ;;        go-go-opentelemetry-io-contrib-instrumentation-google-golang-org-grpc-otelgrpc
-    ;;        go-go-etcd-io-bbolt
-    ;;        go-github-com-vishvananda-netlink
-    ;;        go-github-com-urfave-cli
-    ;;        go-github-com-tchap-go-patricia-v2
-    ;;        go-github-com-stretchr-testify
-    ;;        go-github-com-sirupsen-logrus
-    ;;        go-github-com-prometheus-client-golang
-    ;;        go-github-com-pelletier-go-toml
-    ;;        go-github-com-opencontainers-selinux
-    ;;        go-github-com-opencontainers-runtime-tools
-    ;;        go-github-com-opencontainers-runtime-spec
-    ;;        go-github-com-opencontainers-image-spec
-    ;;        go-github-com-opencontainers-go-digest
-    ;;        go-github-com-moby-sys-userns
-    ;;        go-github-com-moby-sys-user
-    ;;        go-github-com-moby-sys-symlink
-    ;;        go-github-com-moby-sys-signal
-    ;;        go-github-com-moby-sys-sequential
-    ;;        go-github-com-moby-sys-mountinfo
-    ;;        go-github-com-moby-locker
-    ;;        go-github-com-minio-sha256-simd
-    ;;        go-github-com-klauspost-compress
-    ;;        go-github-com-intel-goresctrl
-    ;;        go-github-com-grpc-ecosystem-go-grpc-prometheus
-    ;;        go-github-com-grpc-ecosystem-go-grpc-middleware
-    ;;        go-github-com-google-uuid
-    ;;        go-github-com-google-go-cmp
-    ;;        go-github-com-fsnotify-fsnotify
-    ;;        go-github-com-emicklei-go-restful-v3
-    ;;        go-github-com-docker-go-units
-    ;;        go-github-com-docker-go-metrics
-    ;;        go-github-com-docker-go-events
-    ;;        go-github-com-distribution-reference
-    ;;        go-github-com-davecgh-go-spew
-    ;;        go-github-com-coreos-go-systemd-v22
-    ;;        go-github-com-containernetworking-plugins
-    ;;        go-github-com-containernetworking-cni
-    ;;        go-github-com-containerd-zfs
-    ;;        go-github-com-containerd-typeurl-v2
-    ;;        go-github-com-containerd-ttrpc
-    ;;        go-github-com-containerd-platforms
-    ;;        go-github-com-containerd-nri
-    ;;        go-github-com-containerd-log
-    ;;        go-github-com-containerd-imgcrypt
-    ;;        go-github-com-containerd-go-runc
-    ;;        go-github-com-containerd-go-cni
-    ;;        go-github-com-containerd-fifo
-    ;;        go-github-com-containerd-errdefs
-    ;;        go-github-com-containerd-continuity
-    ;;        go-github-com-containerd-containerd-api
-    ;;        go-github-com-containerd-console
-    ;;        go-github-com-containerd-cgroups-v3
-    ;;        go-github-com-containerd-btrfs-v2
-    ;;        go-github-com-containerd-aufs
-    ;;        go-github-com-microsoft-hcsshim
-    ;;        go-github-com-microsoft-go-winio
-    ;;        go-github-com-adamkorcz-go-118-fuzz-build
-    ;;        go-github-com-adalogics-go-fuzz-headers
-    ;;        go-dario-cat-mergo))
+      #:test-subdirs
+      ;; XXX: Remove when all inputs are packaged.
+      #~(list "archive/compression"
+              "cio"
+              "content"
+              "content/local"
+              "contrib/apparmor"
+              "contrib/seccomp/kernelversion"
+              "diff/apply"
+              "events/exchange"
+              "gc"
+              "gc/scheduler"
+              "identifiers"
+              "images"
+              "labels"
+              "leases"
+              "mount"
+              "namespaces"
+              "pkg/atomic"
+              "pkg/atomicfile"
+              "pkg/cap"
+              "pkg/cleanup"
+              "pkg/cri/io"
+              "pkg/cri/store/label"
+              "pkg/cri/store/snapshot"
+              "pkg/cri/streaming/internal/wsstream"
+              "pkg/cri/util"
+              "pkg/epoch"
+              "pkg/failpoint"
+              "pkg/ioutil"
+              "pkg/kmutex"
+              "pkg/registrar"
+              "pkg/snapshotters"
+              "pkg/transfer/image"
+              "pkg/transfer/streaming"
+              "plugin"
+              "protobuf"
+              "reference"
+              "remotes"
+              "remotes/docker/auth"
+              "remotes/docker/config"
+              "runtime/v2/shim"
+              "services/server/config"
+              "snapshots/benchsuite"
+              "snapshots/devmapper/dmsetup"
+              "snapshots/overlay/overlayutils"
+              "snapshots/storage")))
+    (native-inputs
+     (list go-github-com-davecgh-go-spew
+           go-github-com-google-go-cmp
+           go-github-com-stretchr-testify))
+    (propagated-inputs
+     (list go-dario-cat-mergo
+           go-github-com-adalogics-go-fuzz-headers
+           go-github-com-adamkorcz-go-118-fuzz-build
+           go-github-com-containerd-btrfs-v2
+           go-github-com-containerd-cgroups-v3
+           go-github-com-containerd-console
+           go-github-com-containerd-containerd-api
+           go-github-com-containerd-continuity
+           go-github-com-containerd-errdefs
+           go-github-com-containerd-fifo
+           go-github-com-containerd-go-cni
+           go-github-com-containerd-go-runc
+           go-github-com-containerd-log
+           go-github-com-containerd-nri
+           go-github-com-containerd-platforms
+           go-github-com-containerd-ttrpc
+           go-github-com-containerd-typeurl-v2
+           go-github-com-containernetworking-cni
+           go-github-com-containernetworking-plugins
+           go-github-com-coreos-go-systemd-v22
+           go-github-com-distribution-reference
+           go-github-com-docker-go-events
+           go-github-com-docker-go-metrics
+           go-github-com-docker-go-units
+           go-github-com-emicklei-go-restful-v3
+           go-github-com-fsnotify-fsnotify
+           go-github-com-google-uuid
+           go-github-com-grpc-ecosystem-go-grpc-middleware
+           go-github-com-grpc-ecosystem-go-grpc-prometheus
+           go-github-com-intel-goresctrl
+           go-github-com-klauspost-compress
+           go-github-com-minio-sha256-simd
+           go-github-com-moby-locker
+           go-github-com-moby-sys-mountinfo
+           go-github-com-moby-sys-sequential
+           go-github-com-moby-sys-signal
+           go-github-com-moby-sys-symlink
+           go-github-com-moby-sys-user
+           go-github-com-moby-sys-userns
+           go-github-com-opencontainers-go-digest
+           go-github-com-opencontainers-image-spec
+           go-github-com-opencontainers-runtime-spec
+           go-github-com-opencontainers-runtime-tools
+           go-github-com-opencontainers-selinux
+           go-github-com-pelletier-go-toml
+           go-github-com-prometheus-client-golang
+           go-github-com-sirupsen-logrus
+           go-github-com-tchap-go-patricia-v2
+           go-github-com-urfave-cli
+           go-github-com-vishvananda-netlink
+           go-go-etcd-io-bbolt
+           go-go-opentelemetry-io-contrib-instrumentation-google-golang-org-grpc-otelgrpc
+           go-go-opentelemetry-io-contrib-instrumentation-net-http-otelhttp
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracegrpc
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracehttp
+           go-go-opentelemetry-io-otel-sdk
+           go-go-opentelemetry-io-otel-trace
+           go-golang-org-x-net
+           go-golang-org-x-sync
+           go-golang-org-x-sys
+           go-google-golang-org-genproto
+           go-google-golang-org-genproto-googleapis-rpc
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf
+           go-k8s-io-api
+           go-k8s-io-apimachinery
+           go-k8s-io-apiserver
+           go-k8s-io-client-go
+           go-k8s-io-component-base
+           go-k8s-io-cri-api
+           go-k8s-io-klog-v2
+           go-k8s-io-utils
+           go-tags-cncf-io-container-device-interface
+
+           ;; TODO: Complete packaging.
+           ;; go-github-com-containerd-aufs
+           ;; go-github-com-containerd-imgcrypt
+           #;go-github-com-containerd-zfs))
    (home-page "https://github.com/containerd/containerd")
    (synopsis "Container runtime support daemon")
    (description
@@ -6158,9 +6328,7 @@ robustness, and portability.  It is available as a daemon, which can manage
 the complete container lifecycle of its host system: image transfer and
 storage, container execution and supervision, low-level storage and network
 attachments, etc.")
-    (license license:asl2.0)
-    ;; Don't expose since it's a partial package.
-    (properties '((hidden? . #t)))))
+    (license license:asl2.0)))

 (define-public go-github-com-containerd-continuity
  (package
@@ -7103,6 +7271,155 @@ against various paths.  This is particularly useful when trying to filter
 files based on a .gitignore document.")
    (license license:expat)))

+(define-public go-github-com-creachadair-command
+  (package
+    (name "go-github-com-creachadair-command")
+    (version "0.2.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/creachadair/command")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0c2y7i8c7kwsqyi6rmql9jpc2xan8jp2cpxgx615safk6xvc41kp"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/creachadair/command"))
+    (native-inputs
+     (list go-github-com-google-go-cmp))
+    (propagated-inputs
+     (list go-github-com-creachadair-mds))
+    (home-page "https://github.com/creachadair/command")
+    (synopsis "Lightweight subcommand-handling library")
+    (description
+     "This package defines plumbing for command dispatch.  It is based on and
+similar in design to the @code{go} command-line tool.")
+    (license license:bsd-3)))
+
+(define-public go-github-com-creachadair-flax
+  (package
+    (name "go-github-com-creachadair-flax")
+    (version "0.0.5")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/creachadair/flax")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1r8s0jqayxglnmkffdpkxl72l594ja82wpa9ypxh1v437kv2gqc2"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/creachadair/flax"))
+    (home-page "https://github.com/creachadair/flax")
+    (synopsis "Bind flags to struct fields")
+    (description
+     "This package implements a helper for attaching flags to the fields of
+struct values.")
+    (license license:bsd-3)))
+
+(define-public go-github-com-creachadair-mds
+  (package
+    (name "go-github-com-creachadair-mds")
+    (version "0.25.15")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/creachadair/mds")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1zdidlcbjlx9aw5j3i73c3mxp7366yh66bn7s5a8p1zaw72k035n"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:go go-1.25
+      #:skip-build? #t
+      #:test-flags
+      #~(list "-skip" (string-join
+                       (list "TestNetwork" ;Needs network
+                             "TestNewHTTPServer"
+                             ;; Broken by read-only FS
+                             "TestDeepPathsWithGlobAndUmask")
+                       "|"))
+      #:import-path "github.com/creachadair/mds"))
+    (native-inputs
+     (list go-github-com-google-go-cmp))
+    (home-page "https://github.com/creachadair/mds")
+    (synopsis "Generic data structures and utility types in Go")
+    (description
+     "This repository defines generic data structures and utility types in Go.
+
+Data structures:
+@itemize
+@item heapq: a heap-structured priority queue
+@item mapset: a basic map-based set implementation
+@item mlink: basic linked sequences (list, queue)
+@item omap: ordered key-value map
+@item queue: an array-based FIFO queue
+@item ring: a circular doubly-linked sequence
+@item stack: an array-based LIFO stack
+@item stree: self-balancing binary-search tree
+@end itemize
+
+Utilities:
+@itemize
+@item cache: an in-memory key/value cache
+@item compare: provides helpers for comparison of values
+@item distinct: a probabilistic distinct-elements counter (CVM)
+@item mbits: helpful functions for manipulating bits and bytes
+@item mdiff: supports creating textual diffs
+@item mnet: provides an in-memory network implementation compatible with the net package
+@item mstr: helpful functions for manipulating strings
+@item mtest: a support library for writing tests
+@item shell: POSIX shell quoting and splitting
+@item slice: helpful functions for manipulating slices
+@item value: helpful functions for basic values and pointers
+@end itemize")
+    (license license:bsd-3)))
+
+(define-public go-github-com-creachadair-msync
+  (package
+    (name "go-github-com-creachadair-msync")
+    (version "0.8.3")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/creachadair/msync")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1z797dc0s99l7xf8zsbynwh1rjqw2w9119n81kjx39zkwrbmnc2w"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:go go-1.25
+      #:import-path "github.com/creachadair/msync"
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'pre-check
+            (lambda* (#:key tests? import-path #:allow-other-keys)
+              ;; See: <https://go.dev/blog/synctest>.
+              (setenv "GOEXPERIMENT" "synctest")
+              (setenv "GODEBUG" "asynctimerchan=0"))))))
+    (propagated-inputs
+     (list go-github-com-creachadair-mds))
+    (home-page "https://github.com/creachadair/msync")
+    (synopsis "Synchronization management types in Go")
+    (description
+     "This package defines two types for managing concurrency: @code{throttle},
+which allows calls to a function to be coalesced among multiple concurrent
+goroutines and @code{trigger}, that implements channel-based condition
+variable.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-creack-pty
  (package
    (name "go-github-com-creack-pty")
@@ -8648,6 +8965,7 @@ interact with distribution components.")
    (license license:asl2.0)))

 (define-public go-github-com-docker-docker
+  ;; TODO: Move to (gnu packages docker).
  (package
    (name "go-github-com-docker-docker")
    (version "25.0.7")
@@ -8668,7 +8986,47 @@ interact with distribution components.")
     (list
      #:import-path "github.com/docker/docker"
      #:skip-build? #t
-      #:tests? #f))
+      #:test-subdirs
+      ;; XXX: Remove when all inputs are packaged.
+      #~(list "api/types/strslice"
+              "api/types/time"
+              "api/types/versions"
+              "builder/remotecontext/urlutil"
+              "cli/debug"
+              "daemon/links"
+              "daemon/network"
+              "errdefs"
+              "integration/plugin"
+              "integration/plugin/logging/cmd/discard"
+              "internal/mod"
+              "libnetwork/bitmap"
+              "libnetwork/etchosts"
+              "libnetwork/internal/caller"
+              "libnetwork/ipbits"
+              "libnetwork/options"
+              "libnetwork/portallocator"
+              "pkg/broadcaster"
+              "pkg/capabilities"
+              "pkg/directory"
+              "pkg/dmesg"
+              "pkg/fileutils"
+              "pkg/homedir"
+              "pkg/ioutils"
+              "pkg/longpath"
+              "pkg/meminfo"
+              "pkg/namesgenerator"
+              "pkg/parsers"
+              "pkg/parsers/kernel"
+              "pkg/pidfile"
+              "pkg/plugins/pluginrpc-gen"
+              "pkg/process"
+              "pkg/progress"
+              "pkg/stdcopy"
+              "pkg/stringid"
+              "pkg/useragent"
+              "plugin/v2"
+              "restartmanager"
+              "volume/drivers")))
    (propagated-inputs
     (list go-github-com-containerd-containerd
           go-github-com-containerd-log
@@ -8967,6 +9325,41 @@ sub-interfaces are also provided for cases where the full Channel interface
 cannot be met (for example, @code{InChannel} for write-only channels).")
    (license license:expat)))

+(define-public go-github-com-eapache-go-resiliency
+  (package
+    (name "go-github-com-eapache-go-resiliency")
+    (version "1.7.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/eapache/go-resiliency")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "07a1r3c2spd37k3riy4fxz8v8ibxiprf8a3vw788whz4mlp6gm40"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:import-path "github.com/eapache/go-resiliency"))
+    (home-page "https://github.com/eapache/go-resiliency")
+    (synopsis "Resiliency patterns for golang")
+    (description
+     "Resiliency patterns for golang.  Based in part on
+@url{https://github.com/Netflix/Hystrix, Hystrix},
+@@url{https://github.com/Shopify/semian, Semian}, and others.
+
+Currently implemented patterns include:
+@itemize
+@item circuit-breaker
+@item semaphore
+@item deadline/timeout
+@item batching
+@item retriable
+@end itemize")
+    (license license:expat)))
+
 (define-public go-github-com-eapache-queue
  (package
    (name "go-github-com-eapache-queue")
@@ -12570,11 +12963,10 @@ single @code{Tree} implementation, optimized for sparse nodes.")
     (list
      #:import-path "github.com/hashicorp/go-immutable-radix/v2"))
    (propagated-inputs
-     (modify-inputs (package-propagated-inputs
-                     go-github-com-hashicorp-go-immutable-radix)
+     (modify-inputs propagated-inputs
       (prepend go-golang-org-x-exp)
       (replace "go-github-com-hashicorp-golang-lru"
-         go-github-com-hashicorp-golang-lru-v2)))))
+                go-github-com-hashicorp-golang-lru-v2)))))

 (define-public go-github-com-hashicorp-go-memdb
  (package
@@ -13298,6 +13690,32 @@ subsystem in Linux.")
 used in other languages but absent in Go package strings.")
    (license license:expat)))

+(define-public go-github-com-huin-goutil
+  (package
+    (name "go-github-com-huin-goutil")
+    (version "0.0.0-20170803182201-1ca381bf3150")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/huin/goutil")
+              (commit (go-version->git-ref version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0alhyacsfqic2wxyqn4gvk9wzjl4pkmy8rhvqjk84xsghgx5xf12"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:import-path "github.com/huin/goutil"))
+    (home-page "https://github.com/huin/goutil")
+    (synopsis "Collection of Go utility code")
+    (description
+     "This package is a collection of miscellaneous Go utility code that is
+potentially useful across multiple projects, and has therefore been factored
+out.")
+    (license license:bsd-2)))
+
 (define-public go-github-com-iancoleman-orderedmap
  (package
    (name "go-github-com-iancoleman-orderedmap")
@@ -16374,6 +16792,29 @@ structure.  It can also produce a much more verbose, one-item-per-line
 representation suitable for computing diffs.")
    (license license:asl2.0)))

+(define-public go-github-com-kodeworks-golang-image-ico
+  (package
+    (name "go-github-com-kodeworks-golang-image-ico")
+    (version "0.0.0-20141118225523-73f0f4cfade9")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/Kodeworks/golang-image-ico")
+              (commit (go-version->git-ref version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0zfcvpf6pdqismq9j8nvismln1dbz2i22d7c00a2ygjxldbmnd3k"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/Kodeworks/golang-image-ico"))
+    (home-page "https://github.com/Kodeworks/golang-image-ico")
+    (synopsis "Golang support for Windows .ico file format")
+    (description
+     "This package provides Golang support for Windows' @code{.ico} file format.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-labstack-gommon
  (package
    (name "go-github-com-labstack-gommon")
@@ -22390,6 +22831,88 @@ without configuration, but if desired, everything can be customized down to the
 smallest detail.")
    (license license:expat)))

+(define-public go-github-com-puzpuzpuz-xsync
+  (package
+    (name "go-github-com-puzpuzpuz-xsync")
+    (version "1.5.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/puzpuzpuz/xsync")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1qfmiyk5wypssr30nj5qp4izdav5gbaxf1324i70vjhn5g8g74mb"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/puzpuzpuz/xsync"))
+    (home-page "https://github.com/puzpuzpuz/xsync")
+    (synopsis "Concurrent data structures for Go")
+    (description
+     "This package is an extension for the standard @code{sync} package and
+provides the following concurrent data structures for Go: a concurrent
+counter, concurrent hash table, multiple concurrent queues and @code{mutex}.")
+    (license license:expat)))
+
+(define-public go-github-com-puzpuzpuz-xsync-v2
+  (package
+    (inherit go-github-com-puzpuzpuz-xsync)
+    (name "go-github-com-puzpuzpuz-xsync-v2")
+    (version "2.5.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/puzpuzpuz/xsync")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1almmzvkhyvhdwyhv9jphbhcm5yv45cmv9v39r3rcbkvl212igmz"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/puzpuzpuz/xsync/v2"))))
+
+(define-public go-github-com-puzpuzpuz-xsync-v3
+  (package
+    (inherit go-github-com-puzpuzpuz-xsync-v2)
+    (name "go-github-com-puzpuzpuz-xsync-v3")
+    (version "3.5.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/puzpuzpuz/xsync")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0k2ir8ixr5h0rwfd4i0nxlgmcrklld06jcbp5ghxk6hpxrhzs1y8"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/puzpuzpuz/xsync/v3"))))
+
+(define-public go-github-com-puzpuzpuz-xsync-v4
+  (package
+    (inherit go-github-com-puzpuzpuz-xsync-v3)
+    (name "go-github-com-puzpuzpuz-xsync-v4")
+    (version "4.5.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/puzpuzpuz/xsync")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "04caylbphjgq1qbpd09cg0b8h84y4zznsdfhi20w4f1628fq7077"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/puzpuzpuz/xsync/v4"))))
+
 (define-public go-github-com-quasilyte-go-ruleguard-dsl
  (package
    (name "go-github-com-quasilyte-go-ruleguard-dsl")
@@ -28603,6 +29126,30 @@ designed to work with the MySQL protocol version 4.1 or greater.  It definitely
 works well with MySQL server version 5.0 and 5.1.")
    (license license:bsd-3)))

+(define-public go-github-com-ziutek-telnet
+  (package
+    (name "go-github-com-ziutek-telnet")
+    (version "0.1.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/ziutek/telnet")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0w0zn8yhpmhrph41dlf9pn5h1zzhgajxwbx85fk4d0m55xp0r680"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/ziutek/telnet"))
+    (home-page "https://github.com/ziutek/telnet")
+    (synopsis "Telnet interface in Go")
+    (description
+     "This package provides a simple interface for interacting with Telnet
+connections.")
+    (license license:bsd-3)))
+
 (define-public go-github-com-zk-org-pretty
  (package
    (name "go-github-com-zk-org-pretty")
@@ -29757,49 +30304,25 @@ organization}.")
       (list
        #:skip-build? #t
        #:import-path "go4.org"
-        #:test-subdirs
-        #~(list "bytereplacer/..."
-                ;; "cloud/..." ; missing packages
-                "ctxutil/..."
-                "errorutil/..."
-                "fault/..."
-                "jsonconfig/..."
-                "legal/..."
-                "lock/..."
-                "media/..."
-                "must/..."
-                "net/..."
-                "net/throttle/..."
-                "oauthutil/..."
-                "osutil/..."
-                "readerutil/..."
-                "reflectutil/..."
-                "rollsum/..."
-                "sort/..."
-                "strutil/..."
-                "syncutil/..."
-                "testing/..."
-                "testing/functest/..."
-                "types/..."
-                ;; "wkfs/..." ; missing packages
-                "writerutil/..."
-                "xdgdir/...")
+        #:test-flags #~(list "-vet=off")
        #:phases
        #~(modify-phases %standard-phases
            (add-after 'unpack 'remove-examples
              (lambda* (#:key import-path #:allow-other-keys)
                (with-directory-excursion (string-append "src/" import-path)
                  (for-each delete-file
-                            (find-files "." "example.*_test\\.go$"))))))
-        #:test-flags #~(list "-vet=off")))
+                            (find-files "." "example.*_test\\.go$"))))))))
+      (native-inputs
+       ;; XXX: Remove when cycle is fixed.
+       (list go-github-com-envoyproxy-go-control-plane))
      (propagated-inputs
-       (list ;; go-cloud-google-com-go
-             ;; go-cloud-google-com-go-storage
+       (list go-cloud-google-com-go
+             go-cloud-google-com-go-storage
             go-github-com-rwcarlsen-goexif
             go-golang-org-x-net
             go-golang-org-x-oauth2
             go-golang-org-x-sys
-             #; go-google-golang-org-api))
+             go-google-golang-org-api))
      (home-page "https://github.com/go4org/go4")
      (synopsis "Collection of packages for Go programmers")
      (description
@@ -29846,6 +30369,30 @@ for locating directories
@end itemize")
      (license (list license:asl2.0 license:bsd-3)))))

+(define-public go-go4-org-mem
+  (package
+    (name "go-go4-org-mem")
+    (version "0.0.0-20240501181205-ae6ca9944745")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/go4org/mem")
+              (commit (go-version->git-ref version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1h2bam1h6xi0lx9s0k44fvd28vkb6rh9vndz3srhwi6axvm8ir0s"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "go4.org/mem"))
+    (home-page "https://go4.org/mem")
+    (synopsis "Cheap read-only memory types in Go")
+    (description
+     "Package mem provides the @code{mem.RO} type that allows you to cheaply
+pass & access either a read-only @code{[]byte} or a @code{string}.")
+    (license license:asl2.0)))
+
 (define-public go-golang-org-rainycape-unidecode
  (let ((commit "cb7f23ec59bec0d61b19c56cd88cee3d0cc1870c")
        (revision "1"))
@@ -30438,8 +30985,8 @@ The yaml package supports most of YAML 1.2, but preserves some behavior from
 ;; to build NNCP and remove vendor) dependency for Golang.  Full build depends
 ;; on Bazel <https://bazel.build/>.
 (define-public go-gvisor-dev-gvisor
-  (let ((commit "634ce95eed8d5b8e6b3e2ea30542c34cb30af148")
-        (revision "0"))
+  (let ((commit "9414b50a5633100fd7299a5a7998742575dcb669")
+        (revision "1"))
    (package
      (name "go-gvisor-dev-gvisor")
      (version (git-version "0.0.0" revision commit))
@@ -30451,7 +30998,7 @@ The yaml package supports most of YAML 1.2, but preserves some behavior from
               (commit commit)))
         (file-name (git-file-name name version))
         (sha256
-          (base32 "1l3si6qlchwgsvaq6lxyvj8iq8n8pqxlayb1hbdf3pynxi52hfkw"))))
+          (base32 "0vqaclb2ignkcs7n463bj349m0xybdsv71i6afhzh8r05hdywzax"))))
      (build-system go-build-system)
      (arguments
       (list
@@ -2763,6 +2763,43 @@ entire output.  It supports all Layer Shell features including popups and
 popovers.")
    (license license:expat)))

+(define-public xdg-user-dirs-gtk
+  (package
+    (name "xdg-user-dirs-gtk")
+    (version "0.16")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://gitlab.gnome.org/GNOME/xdg-user-dirs-gtk.git")
+                     (commit version)))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "11h1164mkajpfrp6mkky2gvx3xd7dw0c9f2785jf4lys4jmmj4c3"))))
+    (build-system meson-build-system)
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'fix-exec-path
+            (lambda* (#:key inputs #:allow-other-keys)
+              (substitute* "update.c"
+                (("xdg-user-dirs-update")
+                 (search-input-file inputs "/bin/xdg-user-dirs-update"))))))))
+    (native-inputs
+     (list gettext-minimal
+           pkg-config))
+    (inputs
+     (list gtk+
+           xdg-user-dirs))
+    (home-page "https://gitlab.gnome.org/GNOME/xdg-user-dirs-gtk")
+    (synopsis "Integration of xdg-user-dirs with GTK")
+    (description "This package is a companion to @code{xdg-user-dirs} to
+integrate it with the GNOME desktop and GTK applications.  It gets run during
+login to create default GTK bookmarks files containing the user directories, and
+to rename these directories if the locale changes.")
+    (license license:gpl2+)))
+
 (define-public goocanvas
  (package
    (name "goocanvas")
@@ -7764,8 +7764,8 @@ is an attempt to combine both into something useful.")
      (license license:asl2.0))))

 (define-public guile-knots
-  (let ((commit "f767eca066495e6582e89ba1b91907c0c5657878")
-        (revision "34"))
+  (let ((commit "49996c432a4616e03ecaf01cb42afc5fd78eafd5")
+        (revision "35"))
    (package
    (name "guile-knots")
    (version (git-version "0.1" revision commit))
@@ -7776,7 +7776,7 @@ is an attempt to combine both into something useful.")
                    (commit commit)))
              (sha256
               (base32
-                "18fqmpyrrxy8phxxm5b7d1qhhvc3rsrs243xiinkj2hn2ca1cqi8"))
+                "0i6vk432shy7qmsq1hli71a9kmgf8yy9hx3bck0r9qzsldv1m3m9"))
              (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
@@ -23,6 +23,7 @@
 ;;; Copyright © 2025 Eric Bavier <bavier@posteo.net>
 ;;; Copyright © 2025 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2025 James Smith <jsubuntuxp@disroot.org>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1000,22 +1001,21 @@ information can be viewed in real time and/or logged to a file.")
    (source
     (origin
       (method git-fetch)
-       (uri
-        (git-reference
-         (url (string-append "https://github.com/dell/" name))
-         (commit (string-append "v" version))))
+       (uri (git-reference
+              (url "https://github.com/dell/libsmbios")
+              (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
        (base32 "0krwwydyvb9224r884y1mlmzyxhlfrcqw73vi1j8787rl0gl5a2i"))))
    (build-system gnu-build-system)
    (native-inputs
-     `(("autoconf" ,autoconf)
-       ("automake" ,automake)
-       ("gettext" ,gettext-minimal)
-       ("libtool" ,libtool)
-       ("pkg-config" ,pkg-config)
-       ("perl" ,perl)
-       ("python" ,python)))
+     (list autoconf
+           automake
+           gettext-minimal
+           libtool
+           pkg-config
+           perl
+           python))
    (inputs
     (list libxml2))
    (arguments
@@ -38,6 +38,7 @@
 ;;; Copyright © 2025 Zhu Zihao <all_but_last@163.com>
 ;;; Copyright © 2025 Vinicius Monego <monego@posteo.net>
 ;;; Copyright © 2025 Igorj Gorjaĉev <igor@goryachev.org>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -305,7 +306,7 @@ actions.")
 (define-public geeqie
  (package
    (name "geeqie")
-    (version "2.6.1")
+    (version "2.7")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -313,11 +314,12 @@ actions.")
                    (commit (string-append "v" version))))
              (sha256
               (base32
-                "08yr8jqli33rn1zvj9mjvinyzjp2myakxgf8wqqq8yidmm0vvn1p"))
+                "139ffzqqq79d3k5q99r8i1jr9v9vfwv89dkh6vvw1mdnv6b3s9n8"))
              (file-name (git-file-name name version))))
    (build-system meson-build-system)
    (arguments
     (list
+      #:glib-or-gtk? #t
      #:phases
      #~(modify-phases %standard-phases
          ;; Disable test which requires binaries not present
@@ -346,6 +348,7 @@ actions.")
           libwebp))
    (native-inputs
     (list `(,glib "bin") ; glib-gettextize
+           gsettings-desktop-schemas
           intltool
           pkg-config
           python         ; for tests
@@ -924,15 +927,15 @@ with tiling window managers.  Features include:
           ;; That is required for testing.
           xorg-server-for-tests))
    (inputs
-     `(("imlib2" ,imlib2)
-       ("glib" ,glib)
-       ("gtk+" ,gtk+-2)
-       ("lcms" ,lcms)
-       ("libjpeg" ,libjpeg-turbo)
-       ("libtiff" ,libtiff)
-       ("libexif" ,libexif)
-       ("libx11" ,libx11)
-       ("libxext" ,libxext)))
+     (list imlib2
+           glib
+           gtk+-2
+           lcms
+           libjpeg-turbo
+           libtiff
+           libexif
+           libx11
+           libxext))
    (arguments
     `(#:phases
       (modify-phases %standard-phases
@@ -18,6 +18,7 @@
 ;;; Copyright © 2024 Christian Miller <christian.miller@dadoes.de>
 ;;; Copyright © 2024 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2025 Zheng Junjie <z572@z572.online>
+;;; Copyright © 2026 Daniel Littlewood <dan@danielittlewood.xyz>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -421,8 +422,8 @@ using a mouse.  It is customizable and extensible with plugins and scripts.")
     (origin
       (method git-fetch)
       (uri (git-reference
-             (url "https://github.com/SrainApp/srain")
-             (commit version)))
+              (url "https://github.com/SrainApp/srain")
+              (commit version)))
       (file-name (git-file-name name version))
       (sha256
        (base32 "105z2kbj9ar6zk6i1qrbysrp9vbz692kbl2dwdxcwly0yh4cbd0p"))))
@@ -433,11 +434,11 @@ using a mouse.  It is customizable and extensible with plugins and scripts.")
      #:tests? #f ;there are no tests
      #:glib-or-gtk? #t))
    (native-inputs
-     `(("gettext" ,gettext-minimal)
-       ("glib:bin" ,glib "bin")
-       ("pkg-config" ,pkg-config)
-       ("python" ,python-wrapper)
-       ("python-sphinx" ,python-sphinx)))
+     (list gettext-minimal
+           `(,glib "bin")
+           pkg-config
+           python-wrapper
+           python-sphinx))
    (inputs
     (list glib-networking
           gsettings-desktop-schemas
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019, 2021 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2014-2019, 2021, 2026 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2021, 2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017, 2022 Marius Bakke <marius@gnu.org>
@@ -226,6 +226,18 @@ JNI.")
             (setenv "JAVACMD" (search-input-file inputs "/bin/jamvm"))
             (setenv "JAVAC" (search-input-file inputs "/bin/jikes"))
             (setenv "CLASSPATH" (search-input-file inputs "/lib/rt.jar"))))
+         ,@(if (target-x86-32?)
+               ;; XXX: On i686 isFile() always seems to return true.  Patching
+               ;; this here is very ugly, but the effects are limited.  None
+               ;; of these changes remain by the time we've built Icedtea and
+               ;; the other JDKs.
+               '((add-after 'unpack 'disable-isFile-checks
+                   (lambda _
+                     (substitute* "src/main/org/apache/tools/ant/util/ResourceUtils.java"
+                       (("destFile = \\(\\(FileProvider\\).*") ""))
+                     (substitute* "src/main/org/apache/tools/ant/taskdefs/Mkdir.java"
+                       (("dir.isFile\\(\\)") "false")))))
+               '())
         (replace 'build
           (lambda* (#:key inputs outputs #:allow-other-keys)
             ;; Ant complains if this file doesn't exist.
@@ -1285,7 +1285,13 @@ new Date();"))))
                ;; It looks like the "--disable-warnings-as-errors" option of
                ;; the 'configure' phase is not working.
                (substitute* "make/autoconf/generated-configure.sh"
-                  (("-Werror") ""))))))
+                  (("-Werror") ""))))
+            #$@(if (target-x86-32?)
+                   ;; On i686 the C2 compiler sometimes crashes when importing
+                   ;; certificates.
+                   #~((add-before 'install-keystore 'disable-C2-compiler
+                        (lambda _ (setenv "_JAVA_OPTIONS" "-XX:TieredStopAtLevel=1"))))
+                   #~())))
       ((#:disallowed-references refs '())
        (cons* (this-package-native-input "openjdk")
               (gexp-input (this-package-native-input "openjdk") "jdk")
@@ -1844,12 +1850,50 @@ blacklisted.certs.pem"
 (define-public openjdk24
  (make-openjdk
   openjdk23 "24.0.1"
-   "0h6sbzbjyqg85iml41pswdh2z3d7h2hhb0sd5yll37r1mj5lsxmx"))
+   "0h6sbzbjyqg85iml41pswdh2z3d7h2hhb0sd5yll37r1mj5lsxmx"
+   (arguments
+    (substitute-keyword-arguments (package-arguments base)
+      ((#:configure-flags flags #~(list))
+       (if (target-x86-32?)
+           #~(cons* "--enable-deprecated-ports=yes" #$flags)
+          flags))))))

 (define-public openjdk25
  (make-openjdk
   openjdk24 "25.0.2"
-   "03aa34lscr3qbdl6qz3gqyp0nzkqfj02362mzmpkiq3y2g5xdnrj"))
+   "03aa34lscr3qbdl6qz3gqyp0nzkqfj02362mzmpkiq3y2g5xdnrj"
+   (arguments
+    (substitute-keyword-arguments (package-arguments base)
+      ((#:configure-flags flags #~(list))
+       (if (target-x86-32?)
+           ;; Full builds on 32-bit x86 architectures are not supported as of
+           ;; this version.  Best we can do is to build with the "zero" variant.
+           #~(cons* "--with-jvm-variants=zero"
+                    "--disable-precompiled-headers"
+                    #$flags)
+           flags))
+      ((#:phases phases #~%standard-phases)
+       (if (target-x86-32?)
+           #~(modify-phases #$phases
+               (replace 'install
+                 (lambda _
+                   (let ((images (car (find-files "build" "-zero-release"
+                                                  #:directories? #t))))
+                     (copy-recursively (string-append images "/images/jdk")
+                                       #$output:jdk)
+                     (copy-recursively (string-append images "/images/jre")
+                                       #$output)
+                     (copy-recursively (string-append images "/images/docs")
+                                       #$output:doc))))
+               (replace 'install-libjvm
+                 (lambda _
+                   (let ((lib-out (string-append #$output "/lib"))
+                         (lib-jdk (string-append #$output:jdk "/lib")))
+                     (symlink (string-append lib-jdk "/zero/libjvm.so")
+                              (string-append lib-jdk "/libjvm.so"))
+                     (symlink (string-append lib-out "/zero/libjvm.so")
+                              (string-append lib-out "/libjvm.so"))))))
+           phases))))))

 ;;; Convenience alias to point to the latest version of OpenJDK.
 (define-public openjdk openjdk25)
@@ -1968,14 +2012,14 @@ OpenJDK.")
 (define-public ant/java8
  (package
    (name "ant")
-    (version "1.10.15")
+    (version "1.10.17")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://apache/ant/source/apache-ant-"
                                  version "-src.tar.gz"))
              (sha256
               (base32
-                "1ccr852dxg5affdqafg04gi3l89q5c6l9lqrz50jhj05kidljax2"))
+                "0p34pqknp2rbk5wk6zw8m6jfn7rkk7fyv3yvk9zhfxhhxrf0lfgh"))
              (modules '((guix build utils)))
              (snippet
               '(begin
@@ -485,11 +485,23 @@ to camera devices supported by @code{libgphoto2} using
       (uri (string-append "mirror://kde/stable/release-service/" version
                           "/src/kate-" version ".tar.xz"))
       (sha256
-        (base32 "0ah6cy92yir68z25460ccl48i5nrfqswpzil9a7l69h3qxspsk88"))))
+        (base32 "0ah6cy92yir68z25460ccl48i5nrfqswpzil9a7l69h3qxspsk88"))
+       (modules '((guix build utils)))
+       ;; Unbundle SingleApplication.
+       (snippet
+        '(begin
+           (delete-file-recursively "3rdparty/SingleApplication")
+           (with-directory-excursion "apps/kate"
+             (substitute* "CMakeLists.txt"
+               ((".*3rdparty.*") "")
+               ((" -DQAPPLICATION_CLASS=FreeStandingSingleApplication") ""))
+             (substitute* "main.cpp"
+               (("(#include )\"SingleApplication\\/SingleApplication\"" _ keep)
+                (string-append keep "<SingleApplication>"))))))))
    (build-system qt-build-system)
    (native-inputs
     (list extra-cmake-modules kdoctools xorg-server-for-tests))
-    ;; TODO: Unbundle rapidjson and SingleApplication.
+    ;; TODO: Unbundle rapidjson.
    (inputs
     (list breeze-icons ;; default icon set
           karchive
@@ -515,11 +527,20 @@ to camera devices supported by @code{libgphoto2} using
           libxkbcommon
           plasma-activities
           qtsvg
-           qtwayland))
+           qtwayland
+           single-application))
    (arguments
     (list #:qtbase qtbase
           #:phases
           #~(modify-phases %standard-phases
+               (add-after 'unpack 'link-single-application
+                 (lambda _
+                   (substitute* "apps/kate/CMakeLists.txt"
+                     (("target_link_libraries\\(kate-bin PRIVATE kateprivate"
+                       all)
+                      (string-append all " "
+                                     #$(this-package-input "single-application")
+                                     "/lib/libSingleApplication.a")))))
               (add-after 'unpack 'patch-tests
                 (lambda* (#:key inputs #:allow-other-keys)
                   ;; This test requires a 'bin' diretory under '/usr'.
@@ -24,6 +24,7 @@
  #:use-module (guix packages)
  #:use-module (gnu packages golang-build)
  #:use-module (gnu packages golang-check)
+  #:use-module (gnu packages golang-crypto)
  #:use-module (gnu packages golang-web)
  #:use-module (gnu packages golang-xyz)
  #:use-module (gnu packages prometheus))
@@ -33,6 +34,313 @@
 ;;; Libraries:
 ;;;

+(define-public go-go-etcd-io-etcd-client-v3
+  (package
+    (name "go-go-etcd-io-etcd-client-v3")
+    (version "3.6.7")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/etcd-io/etcd")
+             (commit (go-version->git-ref version #:subdir "client"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0d9rjyl5h0xm9isgr8b2fz8528wk3pds71rjl8g08fgsmsa5kicb"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet #~(begin
+                    (define (delete-all-but directory . preserve)
+                      (with-directory-excursion directory
+                        (let* ((pred (negate (cut member <>
+                                                  (cons* "." ".." preserve))))
+                               (items (scandir "." pred)))
+                          (for-each (cut delete-file-recursively <>) items))))
+                    ;; Replace symlinks to tests with file contents
+                    (for-each
+                     (lambda (f)
+                       (delete-file (string-append "client/v3/" f))
+                       (copy-file (string-append
+                                   "tests/integration/clientv3/examples/" f)
+                                  (string-append "client/v3/" f)))
+                     (list "example_auth_test.go"
+                           "example_cluster_test.go"
+                           "example_kv_test.go"
+                           "example_lease_test.go"
+                           "example_maintenance_test.go"
+                           "example_metrics_test.go"
+                           "example_test.go"
+                           "example_watch_test.go"))
+                    (for-each
+                     (lambda (f)
+                       (delete-file
+                        (string-append "client/v3/concurrency/" f))
+                       (copy-file
+                        (string-append "tests/integration/clientv3/concurrency/" f)
+                        (string-append "client/v3/concurrency/" f)))
+                     (list "example_election_test.go"
+                           "example_mutex_test.go"
+                           "example_stm_test.go"))
+                    ;; Copy sertificates for tests.
+                    (mkdir-p "client/v3/tests/fixtures")
+                    (substitute* "client/v3/yaml/config_test.go"
+                      (("\\.\\./\\.\\./\\.\\./") "../"))
+                    (for-each
+                     (lambda (f)
+                       (copy-file
+                        (string-append "tests/fixtures/" f)
+                        (string-append "client/v3/tests/fixtures/" f)))
+                     (list "server.crt"
+                           "server.key.insecure"
+                           "ca.crt"))
+                    ;; Keep source related to expected import-path.
+                    (delete-all-but "." "client")
+                    (delete-file-recursively "client/pkg")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      ;; TODO: Tests a shaky and fail a lot, check how run unittests.
+      #:tests? #f 
+      #:import-path "go.etcd.io/etcd/client/v3"
+      #:unpack-path "go.etcd.io/etcd"))
+    (native-inputs
+     (list go-github-com-grpc-ecosystem-go-grpc-middleware-providers-prometheus
+           go-github-com-prometheus-client-golang
+           go-github-com-stretchr-testify
+           go-go-etcd-io-etcd-client-pkg-v3
+           go-go-uber-org-zap
+           go-google-golang-org-grpc))
+    (propagated-inputs
+     (list go-github-com-coreos-go-semver
+           go-github-com-dustin-go-humanize
+           go-github-com-grpc-ecosystem-go-grpc-middleware-v2
+           go-go-etcd-io-etcd-api-v3
+           go-sigs-k8s-io-yaml))
+    (home-page "https://github.com/etcd-io/etcd")
+    (synopsis "Golang client for ETCD")
+    (description
+     "This package implements the official Go client for etcd.")
+    (license license:asl2.0)))
+
+(define-public go-go-etcd-io-etcd-server-v3
+  (package
+    (name "go-go-etcd-io-etcd-server-v3")
+    (version "3.6.7")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/etcd-io/etcd")
+             (commit (go-version->git-ref version
+                                          #:subdir "server"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0d9rjyl5h0xm9isgr8b2fz8528wk3pds71rjl8g08fgsmsa5kicb"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet #~(begin
+                    (define (delete-all-but directory . preserve)
+                      (with-directory-excursion directory
+                        (let* ((pred (negate (cut member <>
+                                                  (cons* "." ".." preserve))))
+                               (items (scandir "." pred)))
+                          (for-each (cut delete-file-recursively <>) items))))
+                    (delete-all-but "." "server")
+                    (rename-file "server" "server.tmp")
+                    (mkdir-p "server/v3")
+                    (rename-file "server.tmp" "server/v3")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:tests? #f ;Setup fails
+      #:import-path "go.etcd.io/etcd/server/v3"
+      #:unpack-path "go.etcd.io/etcd"))
+    (propagated-inputs
+     (list go-github-com-coreos-go-semver
+           go-github-com-coreos-go-systemd-v22
+           go-github-com-dustin-go-humanize
+           go-github-com-gogo-protobuf
+           go-github-com-golang-groupcache
+           go-github-com-golang-jwt-jwt-v5
+           go-github-com-golang-protobuf
+           go-github-com-google-btree
+           go-github-com-google-go-cmp
+           go-github-com-grpc-ecosystem-go-grpc-middleware
+           go-github-com-grpc-ecosystem-go-grpc-middleware-providers-prometheus
+           go-github-com-grpc-ecosystem-grpc-gateway-v2
+           go-github-com-jonboulle-clockwork
+           go-github-com-prometheus-client-golang
+           go-github-com-prometheus-client-model
+           go-github-com-soheilhy-cmux
+           go-github-com-spf13-cobra
+           go-github-com-stretchr-testify
+           go-github-com-tmc-grpc-websocket-proxy
+           go-github-com-xiang90-probing
+           go-go-etcd-io-bbolt
+           go-go-etcd-io-etcd-client-v3
+           go-go-etcd-io-etcd-pkg-v3
+           go-go-etcd-io-raft-v3
+           go-go-opentelemetry-io-contrib-instrumentation-google-golang-org-grpc-otelgrpc
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracegrpc
+           go-go-opentelemetry-io-otel-sdk
+           go-go-uber-org-zap
+           go-golang-org-x-crypto
+           go-golang-org-x-net
+           go-golang-org-x-time
+           go-google-golang-org-genproto-googleapis-api
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf
+           go-gopkg-in-natefinch-lumberjack-v2
+           go-sigs-k8s-io-json
+           go-sigs-k8s-io-yaml))
+    (home-page "https://go.etcd.io/etcd")
+    (synopsis "Server package for ETCD")
+    (description
+     "This package provides a server for the ETCD distributed key-value storage
+system.")
+    (license license:asl2.0)))
+
+
+(define-public go-go-etcd-io-etcd-pkg-v3
+  (package
+    (name "go-go-etcd-io-etcd-pkg-v3")
+    (version "3.6.7")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/etcd-io/etcd")
+              (commit (go-version->git-ref version
+                                           #:subdir "pkg"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0d9rjyl5h0xm9isgr8b2fz8528wk3pds71rjl8g08fgsmsa5kicb"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet #~(begin
+                    (define (delete-all-but directory . preserve)
+                      (with-directory-excursion directory
+                        (let* ((pred (negate (cut member <>
+                                                  (cons* "." ".." preserve))))
+                               (items (scandir "." pred)))
+                          (for-each (cut delete-file-recursively <>) items))))
+                    (delete-all-but "." "pkg")
+                    (rename-file "pkg" "pkg.tmp")
+                    (mkdir-p "pkg/v3")
+                    (rename-file "pkg.tmp" "pkg/v3")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:tests? #f       ;TODO: Tests hang, select some subset
+      #:import-path "go.etcd.io/etcd/pkg/v3"
+      #:unpack-path "go.etcd.io/etcd"))
+    (native-inputs
+     (list go-github-com-spf13-cobra
+           go-github-com-spf13-pflag
+           go-github-com-stretchr-testify))
+    (propagated-inputs
+     (list go-github-com-creack-pty
+           go-github-com-dustin-go-humanize
+           go-go-etcd-io-etcd-client-pkg-v3
+           go-go-uber-org-zap
+           go-google-golang-org-grpc))
+    (home-page "https://github.com/etcd-io/etcd")
+    (synopsis "Utility packages for etcd")
+    (description
+     "This package is a collection of utility packages used by etcd without
+being specific to etcd itself.")
+    (license license:asl2.0)))
+
+(define-public go-k8s-io-apiserver
+  (package
+    (name "go-k8s-io-apiserver")
+    (version "0.34.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/kubernetes/apiserver")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "06bcbdnlhg1mwky6i1519n1nhlh8rxc9qv7jwqjhc03m2ql3bb8q"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:tests? #f ;TODO: Tests require unpackaged dependencies
+      #:embed-files
+      #~(list "authoring\\.tmpl" "api__v1_openapi\\.json")
+      #:import-path "k8s.io/apiserver"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (propagated-inputs
+     (list go-github-com-blang-semver-v4
+           go-github-com-coreos-go-oidc
+           go-github-com-coreos-go-systemd-v22
+           go-github-com-emicklei-go-restful-v3
+           go-github-com-fsnotify-fsnotify
+           go-github-com-go-logr-logr
+           go-github-com-gogo-protobuf
+           go-github-com-google-btree
+           go-github-com-google-cel-go
+           go-github-com-google-gnostic-models
+           go-github-com-google-go-cmp
+           go-github-com-google-uuid
+           go-github-com-gorilla-websocket
+           go-github-com-grpc-ecosystem-go-grpc-prometheus
+           go-github-com-munnerz-goautoneg
+           go-github-com-mxk-go-flowrate
+           go-github-com-spf13-pflag
+           go-go-etcd-io-etcd-api-v3
+           go-go-etcd-io-etcd-client-pkg-v3
+           go-go-etcd-io-etcd-client-v3
+           go-go-etcd-io-etcd-server-v3
+           go-go-opentelemetry-io-contrib-instrumentation-google-golang-org-grpc-otelgrpc
+           go-go-opentelemetry-io-contrib-instrumentation-net-http-otelhttp
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracegrpc
+           go-go-opentelemetry-io-otel-metric
+           go-go-opentelemetry-io-otel-sdk
+           go-go-opentelemetry-io-otel-trace
+           go-go-uber-org-zap
+           go-golang-org-x-crypto
+           go-golang-org-x-net
+           go-golang-org-x-sync
+           go-golang-org-x-sys
+           go-golang-org-x-time
+           go-google-golang-org-genproto-googleapis-api
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf
+           go-gopkg-in-evanphx-json-patch-v4
+           go-gopkg-in-go-jose-go-jose-v2
+           go-gopkg-in-natefinch-lumberjack-v2
+           go-k8s-io-api
+           go-k8s-io-apimachinery
+           go-k8s-io-client-go
+           go-k8s-io-component-base
+           go-k8s-io-klog-v2
+           go-k8s-io-kms
+           go-k8s-io-kube-openapi
+           go-k8s-io-utils
+           go-sigs-k8s-io-apiserver-network-proxy-konnectivity-client
+           go-sigs-k8s-io-json
+           go-sigs-k8s-io-randfill
+           go-sigs-k8s-io-structured-merge-diff-v6
+           go-sigs-k8s-io-yaml))
+    (home-page "https://github.com/kubernetes/apiserver")
+    (synopsis "Library for building a Kubernetes aggregated API server")
+    (description
+     "This package provides a generic library for building a Kubernetes
+aggregated API server.")
+    (license license:asl2.0)))
+
 (define-public go-k8s-io-component-base
  (package
    (name "go-k8s-io-component-base")
@@ -87,6 +395,39 @@
     "This package contains shared code for Kubernetes core components.")
    (license license:asl2.0)))

+(define-public go-sigs-k8s-io-apiserver-network-proxy-konnectivity-client
+  (package
+    (name "go-sigs-k8s-io-apiserver-network-proxy-konnectivity-client")
+    (version "0.34.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/kubernetes-sigs/apiserver-network-proxy")
+              (commit (go-version->git-ref version
+                                           #:subdir "konnectivity-client"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1kh92blfpmrmklxqg5j0p07yz534gjzhm44xj8bh5pad3y5zw5m0"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:import-path "sigs.k8s.io/apiserver-network-proxy/konnectivity-client"
+      #:unpack-path "sigs.k8s.io/apiserver-network-proxy"))
+    (native-inputs
+     (list go-go-uber-org-goleak))
+    (propagated-inputs
+     (list go-github-com-prometheus-client-golang
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf
+           go-k8s-io-klog-v2))
+    (home-page "https://sigs.k8s.io/apiserver-network-proxy")
+    (synopsis "Network proxy for Kubernetes API server")
+    (description
+     "This package provides a network proxy for the Kubernetes API server.")
+    (license license:asl2.0)))
+

 ;;;
 ;;; Executables:
@@ -87,6 +87,7 @@
 ;;; Copyright © 2025 John Kehayias <john.kehayias@protonmail.com>
 ;;; Copyright © 2025 Arjan Adriaanse <arjan@adriaan.se>
 ;;; Copyright © 2026 Justin Veilleux <terramorpha@cock.li>
+;;; Copyright © 2026 Simen Endsjø <contact@simendsjo.me>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -528,10 +529,27 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
                        "linux-" version ".tar.xz"))
    (sha256 hash)))

+;; The current "mainline" kernel.
+
+(define-public linux-libre-7.0-version "7.0.3")
+(define-public linux-libre-7.0-gnu-revision "gnu")
+(define deblob-scripts-7.0
+  (linux-libre-deblob-scripts
+   linux-libre-7.0-version
+   linux-libre-7.0-gnu-revision
+   (base32 "0pqhhkpq61rvdiyas28x7kclsz1iribzwsyf81gbic56ci4z2ldv")
+   (base32 "0a7572zw5y3k4gs4p3h5w0s9bhd63pdjxz6vxbr96sq6r8b6k02n")))
+(define-public linux-libre-7.0-pristine-source
+  (let ((version linux-libre-7.0-version)
+        (hash (base32 "074zjl0v901a9hafgpcxyyd395qs7y4kr4fcpgg3ssc8ayzsvv8b")))
+   (make-linux-libre-source version
+                            (%upstream-linux-source version hash)
+                            deblob-scripts-7.0)))
+
 ;; The current "stable" kernels. That is, the most recently released major
 ;; versions that are still supported upstream.

-(define-public linux-libre-6.19-version "6.19.12")
+(define-public linux-libre-6.19-version "6.19.14")
 (define-public linux-libre-6.19-gnu-revision "gnu")
 (define deblob-scripts-6.19
  (linux-libre-deblob-scripts
@@ -541,12 +559,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
   (base32 "05jpciyypvmy6byaxjl49b1fvzxcnlhknf0xabrdj5152iznrzkh")))
 (define-public linux-libre-6.19-pristine-source
  (let ((version linux-libre-6.19-version)
-        (hash (base32 "1md8b270pdyk9d8cq0qyr8qmymcijmj3gc39nn394wpr0l94yp6f")))
+        (hash (base32 "11giqsz9qa7s9lm94nn4h1bcb2411crsbfyvzrvhfjmy75kvzs6d")))
   (make-linux-libre-source version
                            (%upstream-linux-source version hash)
                            deblob-scripts-6.19)))

-(define-public linux-libre-6.18-version "6.18.22")
+(define-public linux-libre-6.18-version "6.18.26")
 (define-public linux-libre-6.18-gnu-revision "gnu")
 (define deblob-scripts-6.18
  (linux-libre-deblob-scripts
@@ -556,7 +574,7 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
   (base32 "0qlih8w8wg4v5cwbmd34rbhb6mjgbx69i9rx3s2vxw7h42q9l0ai")))
 (define-public linux-libre-6.18-pristine-source
  (let ((version linux-libre-6.18-version)
-        (hash (base32 "0nazlm6j5blyd4qgl0z6xc3qk00vz3cfvx5mqv18awv5ygx94g52")))
+        (hash (base32 "1v5h0w3s8p5m22jxg992x1jfpwyi80ia70cdgiv47q3n6xfjyxsk")))
   (make-linux-libre-source version
                            (%upstream-linux-source version hash)
                            deblob-scripts-6.18)))
@@ -565,7 +583,7 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
 ;; Here are the support timelines:
 ;; <https://www.kernel.org/category/releases.html>

-(define-public linux-libre-6.12-version "6.12.81")
+(define-public linux-libre-6.12-version "6.12.85")
 (define-public linux-libre-6.12-gnu-revision "gnu")
 (define deblob-scripts-6.12
  (linux-libre-deblob-scripts
@@ -575,12 +593,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
   (base32 "1x48hpmvajz7v5wn1vdd7l5r14mq4ngzh5npz3pj81z4f1g61i0a")))
 (define-public linux-libre-6.12-pristine-source
  (let ((version linux-libre-6.12-version)
-        (hash (base32 "0iw84bqdbh9dlaqd1bqgldg50riw2b5is7ipqnbp0sll8cv9rc62")))
+        (hash (base32 "1v8a0z6znmr2m26l4744wndaimsh24zz6q4d7m4p8s0ayjcwjnp3")))
   (make-linux-libre-source version
                            (%upstream-linux-source version hash)
                            deblob-scripts-6.12)))

-(define-public linux-libre-6.6-version "6.6.134")
+(define-public linux-libre-6.6-version "6.6.137")
 (define-public linux-libre-6.6-gnu-revision "gnu")
 (define deblob-scripts-6.6
  (linux-libre-deblob-scripts
@@ -590,12 +608,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
   (base32 "0xp9b2vkrb0g0rn4i33b59rhp4sgh1dbwzk28vwz7kwac6l5rcpi")))
 (define-public linux-libre-6.6-pristine-source
  (let ((version linux-libre-6.6-version)
-        (hash (base32 "1grp1wqgzjsk6xyl0nvd2hxlxjj0wgz04x544zkz8srp6rxnjy33")))
+        (hash (base32 "1i2npnsnhk41a88vimr521rxg77kljbkqmlyk1zrv7z4ic6ykwcj")))
   (make-linux-libre-source version
                            (%upstream-linux-source version hash)
                            deblob-scripts-6.6)))

-(define-public linux-libre-6.1-version "6.1.168")
+(define-public linux-libre-6.1-version "6.1.170")
 (define-public linux-libre-6.1-gnu-revision "gnu")
 (define deblob-scripts-6.1
  (linux-libre-deblob-scripts
@@ -605,12 +623,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
   (base32 "1w5pfws6l39dpc3lzazs1n6r4m96f6rdf6vb2scy5fhmrd933ldc")))
 (define-public linux-libre-6.1-pristine-source
  (let ((version linux-libre-6.1-version)
-        (hash (base32 "0vkp75sfnjvfqxjh6gqcx24h2m6qj6xkwlw6b118cja43vjnz1g0")))
+        (hash (base32 "0i29gilsvl7vx7p6vqg0bc0d40ir1b968hyfjhdfms55g4pr2y5m")))
   (make-linux-libre-source version
                            (%upstream-linux-source version hash)
                            deblob-scripts-6.1)))

-(define-public linux-libre-5.15-version "5.15.202")
+(define-public linux-libre-5.15-version "5.15.204")
 (define-public linux-libre-5.15-gnu-revision "gnu")
 (define deblob-scripts-5.15
  (linux-libre-deblob-scripts
@@ -620,7 +638,7 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
   (base32 "1s6km2r2mad0wpf7nqn4rqsykw1lm386l1yskmil24239fbva1f1")))
 (define-public linux-libre-5.15-pristine-source
  (let ((version linux-libre-5.15-version)
-        (hash (base32 "1m6d53qx1ah4jwpa8hwjdmq0jn2hf7xmz1li6rwpdqjp97vvvh8b")))
+        (hash (base32 "1kfvfvzhdgjcj1pa2aqks3iah00ilfpp1i9bmbwjr3na0crlrzcv")))
   (make-linux-libre-source version
                            (%upstream-linux-source version hash)
                            deblob-scripts-5.15)))
@@ -668,6 +686,10 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (patches (append (origin-patches source)
                     patches))))

+(define-public linux-libre-7.0-source
+  (source-with-patches linux-libre-7.0-pristine-source
+                       (list %linux-libre-arm-export-__sync_icache_dcache-patch)))
+
 (define-public linux-libre-6.19-source
  (source-with-patches linux-libre-6.19-pristine-source
                       (list %boot-logo-patch
@@ -790,6 +812,11 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (description "Headers of the Linux-Libre kernel.")
    (license license:gpl2)))

+(define-public linux-libre-headers-7.0
+  (make-linux-libre-headers* linux-libre-7.0-version
+                             linux-libre-7.0-gnu-revision
+                             linux-libre-7.0-source))
+
 (define-public linux-libre-headers-6.19
  (make-linux-libre-headers* linux-libre-6.19-version
                             linux-libre-6.19-gnu-revision
@@ -1176,6 +1203,14 @@ Linux kernel.  It has been modified to remove all non-free binary blobs.")
 ;;; Generic kernel packages.
 ;;;

+(define-public linux-libre-7.0
+  (make-linux-libre* linux-libre-7.0-version
+                     linux-libre-7.0-gnu-revision
+                     linux-libre-7.0-source
+                     '("x86_64-linux" "i686-linux" "armhf-linux"
+                       "aarch64-linux" "powerpc64le-linux" "riscv64-linux")
+                     #:configuration-file kernel-config))
+
 (define-public linux-libre-6.19
  (make-linux-libre* linux-libre-6.19-version
                     linux-libre-6.19-gnu-revision
@@ -2797,6 +2832,76 @@ kernel modules to control the keyboard on most Tuxedo computers. The @code{tuxed
 module is also needed for the @code{tuxedo-control-center} (short tcc) package.")
    (license license:gpl2+)))

+(define-public evdi
+  (package
+    (name "evdi")
+    (version "1.14.15")                  ;inherited by libevdi
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/DisplayLink/evdi")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "065mfwmb4nw71s0f0ax9si8xpbr1sah1bhxvq1k81yicvi83wsxn"))))
+    (build-system linux-module-build-system)
+    (arguments
+     (list #:tests? #f                  ;no test suite
+           #:phases #~(modify-phases %standard-phases
+                        (add-after 'unpack 'chdir
+                          (lambda _
+                            (chdir "module")))
+                        ;; Looks like the value is only there to detect RHEL
+                        ;; derivatives, so we can safely delete the include.
+                        (add-after 'unpack 'embed-/etc/os-release
+                          (lambda _
+                            (substitute* "module/Makefile"
+                              (("include /etc/os-release") "")))))))
+    (home-page "https://github.com/DisplayLink/evdi")
+    (synopsis
+     "@acronym{EVDI, Extensible Virtual Display Interface} Linux kernel module")
+    (description
+     "The @acronym{EVDI, Extensible Virtual Display Interface} is a Linux kernel
+module that enables management of multiple screens, allowing user-space programs
+to take control over what happens with the image.  It is essentially a virtual
+display for which applications using the @code{libevdi} library can add, remove,
+and receive screen updates.
+
+The EVDI driver uses the standard Linux @acronym{DRM, Direct Rendering Manager}.
+Its displays can be controlled by standard tools such as @command{xrandr} and
+display settings applets in graphical environments.")
+    (license license:gpl2)))
+
+(define-public libevdi
+  (package
+    (inherit evdi)
+    (name "libevdi")
+    (build-system gnu-build-system)
+    (arguments
+     (list #:tests? #f                  ;no test suite
+           #:make-flags
+           #~(list (string-append "CC=" #$(cc-for-target)))
+           #:phases #~(modify-phases %standard-phases
+                        (delete 'configure)
+                        (add-after 'unpack 'chdir
+                          (lambda _
+                            (chdir "library")))
+                        (replace 'install
+                          (lambda* _
+                            (let* ((lib (string-append #$output "/lib")))
+                              (mkdir-p lib)
+                              (install-file "libevdi.so" lib)))))))
+    (inputs (list libdrm))
+    (native-inputs (list pkg-config))
+    (synopsis
+     "@acronym{EVDI, Extensible Virtual Display Interface} user-space library")
+    (description
+     "Libevdi is a library that gives applications easy access to
+@acronym{EVDI, Extensible Virtual Display Interface} devices provided by the
+@code{evdi} driver package.")
+    (license license:lgpl2.1)))
+
 (define-public ec
  (package
    (name "ec")
@@ -4295,6 +4400,42 @@ external rate conversion.")
                   ;; `rate/rate_samplerate.c': LGPL v2.1 or later.
                   license:lgpl2.1+))))

+(define-public snd-rane-sl3
+  (let ((commit "01099892261b55ec5ee814292d840eeb664c1904")
+        (revision "0"))
+    (package
+      (name "snd-rane-sl3")
+      (version (git-version "0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/nvgeele/snd-rane-sl3")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "1j2aan5xmbi8hgkzzwjb7rarqh4g65rg3s1qd1c8x5m6fpqdnvli"))))
+      (build-system linux-module-build-system)
+      (arguments
+       (list
+        #:tests? #f ;No tests.
+        #:phases
+        #~(modify-phases %standard-phases
+            (delete 'configure)
+            (add-before 'build 'change-directory
+              (lambda _
+                (chdir "snd-rane-sl3"))))))
+      (inputs (list linux-libre-headers))
+      (home-page "https://github.com/nvgeele/snd-rane-sl3")
+      (synopsis
+       "Linux ALSA kernel driver for the Rane SL3 USB Audio interface")
+      (description
+       "snd-rane-sl3 provides a native Linux kernel module that
+enables the Rane SL3 to work as a standard ALSA audio device, supporting 6
+channels (3 stereo pairs) of 24-bit PCM audio at 44.1kHz and 48kHz sample
+rates.")
+      (license license:gpl3))))
+
 (define-public iptables
  (package
    (name "iptables")
@@ -12982,8 +12982,8 @@ score.  When evaluated, the musical score is rendered to an image.")
  (sbcl-package->ecl-package sbcl-cmn))

 (define-public sbcl-coalton
-  (let ((commit "bf475c8c53e02a2e0cb29deab4d101d25743bfca")
-        (revision "5"))
+  (let ((commit "14ed6dc733f8c23c1a345ceb11d3f75ee47f7525")
+        (revision "6"))
    (package
      (name "sbcl-coalton")
      (version (git-version "0.0.1" revision commit))
@@ -12995,12 +12995,16 @@ score.  When evaluated, the musical score is rendered to an image.")
               (commit commit)))
         (file-name (git-file-name "cl-coalton" version))
         (sha256
-          (base32 "0zrp2s82n2mxx7knbnbsdj64zar21nnnf8iwzrqzs4g3v6xpyz9z"))))
+          (base32 "024n72lxi8nycy012lqy6zx19lv7jh2ngs1mf559rw8kgwh3k54c"))))
      (build-system asdf-build-system/sbcl)
      (native-inputs
-       (list sbcl-fiasco))
+       (list sbcl-fiasco
+             sbcl-html-entities
+             sbcl-spinneret
+             sbcl-yason))
      (inputs
       (list sbcl-alexandria
+             sbcl-computable-reals
             sbcl-concrete-syntax-tree
             sbcl-eclector
             sbcl-float-features
@@ -13556,10 +13560,10 @@ place outside with-notes.
  (sbcl-package->ecl-package sbcl-compiler-macro-notes))

 (define-public sbcl-computable-reals
-  (let ((commit "fdc73d75e79d0a4ce6d01c822c950ae2eb137d39"))
+  (let ((commit "607a5d5b95387c06f92a661aa5562a7be0f5cad8"))
    (package
      (name "sbcl-computable-reals")
-      (version (git-version "1.1.0" "1" commit))
+      (version (git-version "1.1.0" "2" commit))
      (source
       (origin
         (method git-fetch)
@@ -13568,7 +13572,7 @@ place outside with-notes.
               (commit commit)))
         (file-name (git-file-name name version))
         (sha256
-          (base32 "0f12axi53x14l12dgf4a1lfq3p1fx7fh7sjfc0db3lk88ph9qfwl"))))
+          (base32 "1x8kkdyjil0zzg8fq9b76z12kmfrqwhsxnr6qqnlrg0c8c5bzz9c"))))
      (build-system asdf-build-system/sbcl)
      (home-page "https://github.com/stylewarning/computable-reals")
      (synopsis "Arbitrary-precision, re-computing real-numbers in Common Lisp")
@@ -22847,16 +22851,6 @@ specification}, a toolkit for writing GUIs in Common Lisp.")
 (define-public cl-mcclim
  (sbcl-package->cl-source-package sbcl-mcclim))

-(define-public ecl-mcclim
-  (let ((pkg (sbcl-package->ecl-package sbcl-mcclim)))
-    (package
-      (inherit pkg)
-      (arguments
-       (substitute-keyword-arguments arguments
-         ;; Tests fail with "FUNCTION: Not a valid argument (R1
-         ;; (GENERATE-REGION))."  on ECL.
-         ((#:tests? _ #f) #f))))))
-
 (define-public sbcl-md5
  (package
    (name "sbcl-md5")
@@ -29767,7 +29761,7 @@ the Processing language and shares some of the API.")
  ;; Update together with emacs-slime.
  (package
    (name "sbcl-slime-swank")
-    (version "2.31")
+    (version "2.32")
    (source
     (origin
       (file-name (git-file-name "cl-slime-swank" version))
@@ -29776,7 +29770,7 @@ the Processing language and shares some of the API.")
             (url "https://github.com/slime/slime/")
             (commit (string-append "v" version))))
       (sha256
-        (base32 "0nv99wq2vz053p0rn9953rhmyz4g40zdl01mz7z9xbklxzbsx6x7"))
+        (base32 "0s7m7j7y1p8fb6ncpxcxdrrrxp5aw67xl7wrqy8zjjvwzljbs548"))
       (modules '((guix build utils)))
       (snippet
        ;; The doc folder drags `gawk' into the closure.  Doc is already
@@ -57,7 +57,7 @@
 ;;; Copyright © 2023 Wilko Meyer <w@wmeyer.eu>
 ;;; Copyright © 2024 Benjamin Slade <slade@lambda-y.net>
 ;;; Copyright © 2024 Jean Simard <woshilapin@tuziwo.info>
-;;; Copyright © 2024, 2025 Zheng Junjie <873216071@qq.com>
+;;; Copyright © 2024-2026 Zheng Junjie <z572@z572.online>
 ;;; Copyright © 2024, 2025 Ashish SHUKLA <ashish.is@lostca.se>
 ;;; Copyright © 2025 Tanguy Le Carrour <tanguy@bioneland.org>
 ;;; Copyright © 2025-2026 Sharlatan Hellseher <sharlatanus@gmail.com>
@@ -138,6 +138,7 @@
  #:use-module (gnu packages guile-xyz)
  #:use-module (gnu packages haskell-xyz)
  #:use-module (gnu packages icu4c)
+  #:use-module (gnu packages jemalloc)
  #:use-module (gnu packages kerberos)
  #:use-module (gnu packages language)
  #:use-module (gnu packages libbsd)
@@ -148,6 +149,7 @@
  #:use-module (gnu packages libunistring)
  #:use-module (gnu packages libunwind)
  #:use-module (gnu packages linux)
+  #:use-module (gnu packages llvm)
  #:use-module (gnu packages lsof)
  #:use-module (gnu packages lua)
  #:use-module (gnu packages m4)
@@ -158,6 +160,7 @@
  #:use-module (gnu packages networking)
  #:use-module (gnu packages onc-rpc)
  #:use-module (gnu packages openldap)
+  #:use-module (gnu packages nss)
  #:use-module (gnu packages pcre)
  #:use-module (gnu packages pdf)
  #:use-module (gnu packages perl)
@@ -198,6 +201,7 @@
  #:use-module (gnu packages xml)
  #:use-module (gnu packages xorg)
  #:use-module (gnu packages)
+  #:use-module (guix build-system cargo)
  #:use-module (guix build-system cmake)
  #:use-module (guix build-system emacs)
  #:use-module (guix build-system glib-or-gtk)
@@ -1355,7 +1359,7 @@ security functionality including PGP, S/MIME, SSH, and SSL.")
 (define-public mu
  (package
    (name "mu")
-    (version "1.14.0")
+    (version "1.14.1")
    (source
     (origin
       (method git-fetch)
@@ -1364,7 +1368,7 @@ security functionality including PGP, S/MIME, SSH, and SSL.")
              (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1fhnnm58ndfd6hzdagrsgcdcm2qlcjlda13vyx5d9lclhxgdn0vf"))))
+        (base32 "0dv27pq2jmgqlzsy2gcmh7vddiwiwd55j299blb9k8g0xhkg8riz"))))
    (build-system meson-build-system)
    (native-inputs
     (list pkg-config
@@ -3910,6 +3914,112 @@ are supported).  @code{bit} is a CGI/SSI program that generates web pages
 on the fly.  Both programs are written in C and are very fast.")
    (license license:expat)))

+(define computed-origin-method (@@ (guix packages) computed-origin-method))
+
+(define-public stalwart
+  (package
+    (name "stalwart")
+    (version "0.16.1")
+    (source
+     (let ((upstream-source
+             (origin
+               (method git-fetch)
+               (uri (git-reference
+                      (url "https://github.com/stalwartlabs/stalwart")
+                      (commit (string-append "v" version))))
+               (file-name (git-file-name name version))
+               (sha256
+                (base32
+                 "1vfgn6jd6gi7b0ilivl4wy6m8bd9hbg919csfndb3h553w153hzy")))))
+       (origin
+         (method computed-origin-method)
+         (file-name (git-file-name name version))
+         (sha256 #f)
+         (uri
+          (delay
+            (with-imported-modules '((guix build utils))
+              #~(begin
+                  (use-modules (guix build utils))
+                  (set-path-environment-variable
+                   "PATH" '("bin")
+                   (list #+python-minimal))
+                  (copy-recursively #+upstream-source "upstream-source")
+                  (with-directory-excursion "upstream-source"
+                    (for-each make-file-writable (find-files "crates" "\\.rs"))
+                    (invoke "python3" "resources/scripts/ossify.py" "crates")
+                    (substitute* "crates/main/Cargo.toml"
+                      ((", \"enterprise\"")
+                       ""))
+                    (substitute* "crates/common/Cargo.toml"
+                      (("git =.*/opentelemetry-rust\"")
+                       "version = \"0.31.0\"")))
+                  (copy-recursively "upstream-source" #$output))))))))
+    (build-system cargo-build-system)
+    (arguments
+     (list
+      #:install-source? #f
+      ;; TODO: Currently, if the test is enabled, it will attempt to link
+      ;; the foundationdb library. However, we haven't packaged it yet,
+      ;; so for now, skip tests.
+      #:tests? #f
+      #:features ''("s3" "postgres" "rocks" "sqlite")
+      #:cargo-install-paths ''("crates/main")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'build 'setenv
+            (lambda* (#:key inputs #:allow-other-keys)
+              (setenv "LIBZ_SYS_STATIC" "0")
+              ;; jemalloc needs unbundling for tikv-jemallocator-sys
+              ;; This flag is needed when not using the bundled jemalloc.
+              ;; https://github.com/tikv/jemallocator/issues/19
+              (setenv
+               "CARGO_FEATURE_UNPREFIXED_MALLOC_ON_SUPPORTED_PLATFORMS" "1")
+              (setenv "JEMALLOC_OVERRIDE"
+                      (search-input-file inputs "/lib/libjemalloc.so")))))))
+    (native-inputs (list clang pkg-config))
+    (inputs (cons* bzip2
+                   jemalloc
+                   librdkafka
+                   lz4
+                   rocksdb
+                   snappy
+                   sqlite
+                   zlib
+                   openssl
+                   `(,zstd "lib")
+                   (cargo-inputs 'stalwart)))
+    (home-page "https://stalw.art")
+    (synopsis "All in one Mail and Collaboration server")
+    (description
+     "Stalwart is an mail and collaboration server with JMAP, IMAP4, POP3, SMTP,
+CalDAV, CardDAV and WebDAV support and a wide range of modern features.")
+    (license license:agpl3)))
+
+(define-public stalwart-cli
+  (package
+    (name "stalwart-cli")
+    (version "1.0.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/stalwartlabs/cli")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0rbhzd8m48fm5q8vlzkla5zxrypkbvsi8i1bplkm1ndp0bwiqdvz"))))
+    (build-system cargo-build-system)
+    (arguments
+     (list #:install-source? #f))
+    (native-inputs (list nss-certs-for-test))
+    (inputs (cargo-inputs 'stalwart-cli))
+    (home-page "https://stalw.art")
+    (synopsis "Stalwart Command Line Interface")
+    (description
+     "A schema-driven command line tool for administering Stalwart Mail and
+Collaboration Server over its JMAP API.")
+    (license license:agpl3)))
+
 (define-public swaks
  (package
    (name "swaks")
@@ -22,7 +22,7 @@
 ;;; Copyright © 2017, 2019, 2022 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2017–2021 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Dave Love <me@fx@gnu.org>
-;;; Copyright © 2018, 2019, 2020, 2021, 2022, 2024, 2025 Janneke Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2018-2022, 2024-2026 Janneke Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2018 Joshua Sierles, Nextjournal <joshua@nextjournal.com>
 ;;; Copyright © 2018 Nadya Voronova <voronovank@gmail.com>
 ;;; Copyright © 2018 Adam Massmann <massmannak@gmail.com>
@@ -458,7 +458,8 @@ programming languages.")
             (url "https://github.com/cvc5/cvc5/")
             (commit (string-append "cvc5-" version))))
       (file-name (git-file-name name version))
-       (patches (search-patches "cvc5-reproducible-build.patch"))
+       (patches (search-patches "cvc5-reproducible-build.patch"
+                                "cvc5-symfpu-compatibility.patch"))
       (sha256
        (base32 "0ynz7di4dyyiiydgmf0z9dc2jl7nm44xi0amch29rcgznwr4wy5m"))))
    (build-system cmake-build-system)
@@ -745,6 +746,54 @@ complete with events and to-dos.")
      (home-page "https://codeberg.org/dgoodmaniii/dozenal")
      (license license:gpl3+))))

+(define-public drat-trim
+  (package
+    (name "drat-trim")
+    (version "05.22.2023")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/marijnheule/drat-trim")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "084miqj57xr7c74y649acm5xjkddpjn4ybfh469jcbakzp8w0pdi"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:tests? #f ;no tests
+      #:make-flags
+      #~(list (string-join
+                (list "FLAGS=-DLONGTYPE"
+                      ;; _POSIX_C_SOURCE required for getc_unlocked(3).
+                      "-D_POSIX_C_SOURCE=200809")
+                " "))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'always-pass-flags
+            (lambda _
+              (substitute* "Makefile"
+                ;; Ensure that drat-trim and gapless target also respect FLAGS.
+                (("-std=c99 -O2")
+                 "-std=c99 $(FLAGS) -O2"))))
+          (delete 'configure) ;no configure script
+          (replace 'install
+            (lambda* (#:key outputs #:allow-other-keys)
+              (let* ((bin (string-append #$output "/bin")))
+                (for-each (lambda (exec)
+                            (install-file exec bin))
+                          '("drat-trim"
+                            "lrat-check"))))))))
+    (synopsis "Proof checker for unsatisfiability of propositional formulas")
+    (description
+     "The proof checker DRAT-trim can be used to check whether a propositional
+formula in the DIMACS format is unsatisfiable.  Given a propositional formula and
+a clausal proof, DRAT-trim validates that the proof is a certificate of
+unsatisfiability of the formula.")
+    (home-page "https://www.cs.utexas.edu/~marijn/drat-trim/")
+    (license license:expat)))
+
 (define-public dsfmt
  (package
    (name "dsfmt")
@@ -2475,6 +2524,9 @@ similar to MATLAB, GNU Octave or SciPy.")
                   ;; "--enable-doxygen"
                   "--enable-dot"
                   "--enable-netcdf-4"
+                   #$@(if (or (target-x86-32?) (target-arm32?))
+                          '("CFLAGS=-Wno-error=incompatible-pointer-types")
+                          '())
                   (string-append "--with-plugin-dir=" #$output "/lib/hdf5-plugins"))
           #:phases
           #~(modify-phases %standard-phases
@@ -2486,7 +2538,15 @@ similar to MATLAB, GNU Octave or SciPy.")
                     (("testurl.sh") ""))
                   (substitute* "nczarr_test/Makefile.in"
                     (("/bin/bash")
-                      (search-input-file inputs "bin/bash")))))
+                      (search-input-file inputs "bin/bash")))
+                   ;; This test fails on 32 bit platforms.
+                   #$@(if (or (target-x86-32?) (target-arm32?))
+                          '((substitute* '("ncdump/tst_netcdf4_4.sh"
+                                           "ncdump/tst_nccopy4.sh")
+                              (("#!/bin/sh" m) (string-append m "\nexit 0\n")))
+                            (substitute* "ncdump/Makefile.in"
+                              (("tst_netcdf4_4.log") "")))
+                          '())))
               (add-before 'configure 'fix-source-date
                 (lambda _
                   ;; As we ${SOURCE_DATE_EPOCH} evaluates to "1" in the build
@@ -3995,6 +4055,64 @@ addition it can be used as a module in Python for plotting.  It supports
 vector and bitmap output, including PDF, Postscript, SVG and EMF.")
    (license license:gpl2+)))

+(define-public voro++
+  (package
+    (name "voro++")
+    (version "0.4.6")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/chr1shr/voro")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0rxyb662w9y3xadyxz2x7gvc7mafbhl13szdc55fsk5sygpdlkv5"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:make-flags #~(list (string-append "PREFIX=" #$output))
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure)        ;no configure
+          (replace 'check
+            ;; There is no test suite but the project provides a verity of
+            ;; examples to check performance, target "all" build each example
+            ;; (basic, walls, custom, extra, degenerate, and interface), see
+            ;; detailed description in "examples/README".
+            ;;
+            ;; Running timing example only:
+            ;; These codes and scripts can be used to test the code's
+            ;; performance. The program timing_test.cc creates a container
+            ;; with 100000 particles, and then times the computation of all
+            ;; the cells in the container, using the dummy function
+            ;; compute_all_cells().
+            (lambda* (#:key tests? #:allow-other-keys)
+              (when tests?
+                (with-directory-excursion "examples/timing"
+                  (invoke "perl" "timing_test.pl"))))))))
+    (native-inputs
+     (list perl))
+    (home-page "https://math.lbl.gov/voro++/")
+    (synopsis "C++ library for the computation of the Voronoi diagram")
+    (description
+     "Voro++ is a software library for carrying out three-dimensional
+computations of the Voronoi tessellation.  A distinguishing feature of the
+Voro++ library is that it carries out cell-based calculations, computing the
+Voronoi cell for each particle individually.  It is particularly well-suited
+for applications that rely on cell-based statistics, where features of Voronoi
+cells (eg. volume, centroid, number of faces) can be used to analyze a system
+of particles.
+
+Voro++ comprises of several C++ classes that can be built as a static library.
+A command-line utility is also provided that can use most features of the
+code.  The direct cell-by-cell construction makes the library particularly
+well-suited to handling special boundary conditions and walls.  It employs
+algorithms that are tolerant for numerical precision errors, it exhibits high
+performance, and it has been successfully employed on very large particle
+systems.")
+    (license license:bsd-3)))
+
 (define-public maxflow
  (package
    (name "maxflow")
@@ -8314,8 +8432,11 @@ s-expression-based format.")
   (license license:gpl3+)))

 (define-public symfpu
-  (let ((commit "22d993d880f66b2e470c3928e0e61bdf61419702")
-        (revision "0"))
+  ;; Currently, we use the "experimental" branch of the symfpu repository.  The
+  ;; default "master" branch hasn't been updated in ~7 years and both bitwuzla
+  ;; and cvc5 require fixes from the "experimental" branch.
+  (let ((commit "aeaa3fa62730148c855f5a9e0a9b7040d48e0b7e")
+        (revision "1"))
    (package
      (name "symfpu")
      (version (git-version "0" revision commit))
@@ -8327,7 +8448,7 @@ s-expression-based format.")
               (commit commit)))
         (file-name (git-file-name name version))
         (sha256
-          (base32 "1h20zzkyi225290kc6mzg8i4dwkj0p1vlwfgc9ycs61snlyd8gr8"))))
+          (base32 "0wj9pwr2jiliy4rw4nvy51427dwhwj86azi14qc5vzsdb44c6fdx"))))
      (build-system copy-build-system)
      (arguments
       (list
@@ -8369,7 +8490,7 @@ operations.")
 (define-public bitwuzla
  (package
    (name "bitwuzla")
-    (version "0.8.2")
+    (version "0.9.0")
    (source
     (origin
       (method git-fetch)
@@ -8378,21 +8499,16 @@ operations.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0nakqz29cfkn91yvx1xzsk50rlqbiihslflbjanv4lflcl2zx6mz"))))
+        (base32 "012h3fj25f5zk9qy353vqn5jpp26db45xjbxi7ns02pkhlm46f6x"))))
    (build-system meson-build-system)
    (arguments
     `(#:configure-flags '("-Dtesting=enabled" "-Ddefault_library=shared"
-                           "-Dkissat=true")
-       #:phases (modify-phases %standard-phases
-                  (add-after 'unpack 'make-git-optional
-                    (lambda _
-                      (substitute* "src/meson.build"
-                        (("run_command\\('git',")
-                         "run_command('sh', '-c', 'git',")))))))
+                           "-Dkissat=true")))
    (native-inputs (list googletest pkg-config))
-    (inputs (list cadical
+    (inputs (list cadical-2.1
                  gmp
                  kissat
+                  mpfr
                  symfpu))
    (synopsis "SMT solver optimized for the theory of bit-vectors")
    (description
@@ -8679,7 +8795,7 @@ reduction.")
 (define-public mcrl2
  (package
    (name "mcrl2")
-    (version "202307.1")
+    (version "202507.0")
    (source (origin
              (method url-fetch)
              (uri (string-append
@@ -8687,9 +8803,9 @@ reduction.")
                    version ".tar.gz"))
              (sha256
               (base32
-                "147002dl3gq2jsk5gcmvw7hj3mfxrpgxwcfda5mfrj26rcxw48fc"))))
+                "08w7v2dx1s164q3vc5lzf864nlxrf8s0kgsa26mmkgfqfqcwdgjj"))))
    (inputs
-     (list boost glu mesa qtbase-5))
+     (list boost glu mesa qtbase))
    (build-system cmake-build-system)
    (arguments (list #:tests? #f))
    (synopsis "Toolset for the mCRL2 formal specification language")
@@ -9660,6 +9776,7 @@ researchers and developers alike to get started on SAT.")
         "1snimig4cp97p570nin2i38my72zvwypldyhr125i1z6cd9pa046"))))
    (build-system gnu-build-system)
    (inputs (list xz gzip lzip bzip2 p7zip))
+    (native-inputs (list drat-trim))
    (arguments
     (list
      #:test-target "test"
@@ -2839,7 +2839,7 @@ implementation of an MQTT version client class.")
 (define-public psi-plus
  (package
    (name "psi-plus")
-    (version "1.5.1484")
+    (version "1.5.2115")
    (source
     (origin
       (method git-fetch)
@@ -2853,7 +2853,7 @@ implementation of an MQTT version client class.")
        `(begin
           (delete-file-recursively "3rdparty")))
       (sha256
-        (base32 "1jsm39nzzbqkp3zc0xqx7jid6p4q1ra28xad38wjr2l1jb8qjn24"))))
+        (base32 "14za9rh7nszv5px5a2w43ysi9977zws8a5mxsh7wc8ksr693faz2"))))
    (build-system qt-build-system)
    (arguments
     `(#:tests? #f                      ; No target
@@ -2910,19 +2910,13 @@ implementation of an MQTT version client class.")
                "qite/qiteaudio.h")
               (("qiteaudiorecorder.h")
                "qite/qiteaudiorecorder.h"))))
-         (add-after 'install 'wrap-env
+         (add-after 'install 'wrap-executable
           (lambda* (#:key outputs #:allow-other-keys)
             (let ((out (assoc-ref outputs "out")))
-               (for-each
-                (lambda (name)
-                  (let ((file (string-append out "/bin/" name))
-                        (gst-plugin-path (getenv "GST_PLUGIN_SYSTEM_PATH"))
-                        (gi-typelib-path (getenv "GI_TYPELIB_PATH")))
-                    (wrap-program file
-                      `("GST_PLUGIN_SYSTEM_PATH" ":" prefix (,gst-plugin-path))
-                      `("GI_TYPELIB_PATH" ":" prefix (,gi-typelib-path)))))
-                '("psi-plus")))))
-         (add-after 'wrap-env 'glib-or-gtk-compile-schemas
+               (wrap-program (string-append out "/bin/psi-plus")
+                 `("GST_PLUGIN_SYSTEM_PATH" ":" prefix (,(getenv "GST_PLUGIN_SYSTEM_PATH")))
+                 `("GI_TYPELIB_PATH" ":" prefix (,(getenv "GI_TYPELIB_PATH")))))))
+         (add-after 'wrap-executable 'glib-or-gtk-compile-schemas
           (assoc-ref glib-or-gtk:%standard-phases 'glib-or-gtk-compile-schemas))
         (add-after 'glib-or-gtk-compile-schemas 'glib-or-gtk-wrap
           (assoc-ref glib-or-gtk:%standard-phases 'glib-or-gtk-wrap)))))
@@ -2945,6 +2939,7 @@ implementation of an MQTT version client class.")
           libgcrypt
           libgpg-error
           libidn
+           libomemo-c
           libotr
           libsignal-protocol-c
           tidy-html
@@ -2964,11 +2959,11 @@ implementation of an MQTT version client class.")
           libxcb
           libxscrnsaver
           zlib))
-    (home-page "https://psi-plus.com/")
+    (home-page "https://psi-im.com/")
    (synopsis "Qt-based XMPP Client")
    (description
-     "Psi+ is a spin-off of Psi XMPP client.  It is a powerful XMPP client
-designed for experienced users.")
+     "Psi+ is a powerful XMPP client designed for experienced users.
+It's a spin-off of the Psi XMPP client.")
    (license license:gpl2+)))

 (define-deprecated-package psi
@@ -7465,31 +7465,6 @@ standalone JACK application.")
    ;; Expat or CC0
    (license (list license:expat license:cc0))))

-(define-public regrader
-  (package
-    (inherit vl1-emulator)
-    (name "regrader")
-    (version "1.0.0")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/linuxmao-org/regrader")
-             (commit (string-append "v" version))
-             ;; bundles a specific commit of the DISTRHO plugin framework
-             (recursive? #t)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32
-         "0gl4d5lf2afqknz22jz7hh7029sc9v1xrz6nbz9dlv42bwc0cvl0"))))
-    (home-page "https://github.com/linuxmao-org/regrader")
-    (synopsis "Delay effect plugin")
-    (description
-     "Regrader is a delay effect where the repeats degrade in resolution.
-This is an unofficial port of the Regrader plugin created by Igorski.  It
-is available as an LV2 plugin and a standalone JACK application.")
-    (license license:expat)))
-
 (define-public fogpad
  (package
    (inherit vl1-emulator)
@@ -2139,62 +2139,6 @@ replies, fping will send out a ping packet and move on to the next target in a
 round-robin fashion.")
    (license license:expat)))

-(define-public gandi-cli
-  (package
-    (name "gandi-cli")
-    (version "1.6")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (pypi-uri name version))
-       (sha256
-        (base32 "1h36jahbp7273wn3yd747kbiwjc0bm3sja67bcxdsd54ln0vyndg"))))
-    (build-system pyproject-build-system)
-    (arguments
-     (list
-      #:test-flags
-      #~(list "--pyargs" "gandi.cli")
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'embed-store-file-names
-            (lambda _
-              (substitute* (list "gandi/cli/modules/cert.py"
-                                 "gandi/cli/tests/commands/test_certificate.py")
-                (("openssl") (which "openssl")))))
-          (add-after 'install 'install-documentation
-            ;; The included man page may be outdated but we install it anyway,
-            ;; since it's mentioned in 'gandi --help' and better than nothing.
-            (lambda _
-              (let* ((man1 (string-append #$output "/share/man/man1")))
-                (mkdir-p man1)
-                (with-output-to-file (string-append man1 "/gandi.1")
-                  (lambda _
-                    (invoke "rst2man.py" "gandicli.man.rst")))))))))
-    (native-inputs
-     (list python-docutils-0.19
-           python-pytest
-           python-pytest-cov
-           python-setuptools
-           python-wheel))
-    (inputs
-     (list openssl
-           python-click-7
-           python-ipy
-           python-pyyaml
-           python-requests))
-    (propagated-inputs
-     (list openssh))
-    (home-page "https://cli.gandi.net")
-    (synopsis "Command-line interface to the Gandi.net Web API")
-    (description
-     "This package provides a command-line client (@command{gandi}) to buy,
-manage, and delete Internet resources from Gandi.net such as domain names,
-virtual machines, and certificates.")
-    (license license:gpl3+)))
-
-(define-deprecated-package gandi.cli
-  gandi-cli)
-
 (define-public go-sctp
  ;; docker-libnetwork-cmd-proxy requires this exact commit.
  ;; This commit is mentioned in docker-libnetwork-cmd-proxy's vendor.conf.
@@ -313,7 +313,7 @@ functional, imperative and object-oriented styles of programming.")
    (source (origin
              (method url-fetch)
              (uri (string-append
-                    "http://caml.inria.fr/pub/distrib/ocaml-"
+                    "https://caml.inria.fr/pub/distrib/ocaml-"
                    (version-major+minor version)
                    "/ocaml-" version ".tar.xz"))
              (sha256
@@ -373,7 +373,7 @@ functional, imperative and object-oriented styles of programming.")
    (source (origin
              (method url-fetch)
              (uri (string-append
-                    "http://caml.inria.fr/pub/distrib/ocaml-"
+                    "https://caml.inria.fr/pub/distrib/ocaml-"
                    (version-major+minor version)
                    "/ocaml-" version ".tar.xz"))
              (patches (search-patches
@@ -421,7 +421,7 @@ patch-/bin/sh-references: ~a: changing `\"/bin/sh\"' to `~a'~%"
    (source (origin
              (method url-fetch)
              (uri (string-append
-                    "http://caml.inria.fr/pub/distrib/ocaml-"
+                    "https://caml.inria.fr/pub/distrib/ocaml-"
                    (version-major+minor version)
                    "/ocaml-" version ".tar.xz"))
              (sha256
@@ -802,7 +802,7 @@ high-performance computing} clusters.")
 (define-public toys
  (package
    (name "toys")
-    (version "0.1.0")
+    (version "0.1.1")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -811,7 +811,7 @@ high-performance computing} clusters.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "169jxh5knp5f2y9wbnc454jjdvvyqb5r0ydv3qkpm332vr0cl6p9"))))
+                "05zkvjs3wkwdswl4irkqaxgdassiji5pq8qaqcrzscvp24vkjjja"))))
    (build-system guile-build-system)
    (arguments
     (list
@@ -838,11 +838,8 @@ high-performance computing} clusters.")
                         (append (list ,@load-compiled-path)
                                 %load-compiled-path))))
              (substitute* "guix/extensions/toys.scm"
-                (("^\\(define-module \\(guix extensions toys\\)")
-                 (string-append
-                  (with-output-to-string
-                    (lambda () (write search-paths-header)))
-                  "\n(define-module (guix extensions toys)")))))
+                ((";;@load-paths@")
+                 (with-output-to-string (lambda () (write search-paths-header)))))))
          (add-after 'set-load-paths-in-entry-point 'register-guix-extension
            (lambda* (#:key outputs #:allow-other-keys)
              (let ((ext-path (string-append #$output "/share/guix/extensions")))
@@ -1204,8 +1201,8 @@ transactions from C or Python.")
    (license license:gpl2+)))

 (define-public bffe
-  (let ((commit "723fd5ea6af1b14c215baf80524c8ff4b21fcc82")
-        (revision "17"))
+  (let ((commit "d6c90f217595674c7910a858edcb735f88d3a14f")
+        (revision "18"))
    (package
      (name "bffe")
      (version (git-version "0" revision commit))
@@ -1216,7 +1213,7 @@ transactions from C or Python.")
                      (commit commit)))
                (sha256
                 (base32
-                  "1sd62arq80kkfjnynivrp7jh8j359965ank8sglq1wgfdah9k8ii"))
+                  "0f7i68k6l5ylg8nch54xw4bxn0hayx2ng9j5dvwvai1vi887vmbj"))
                (file-name (string-append name "-" version "-checkout"))))
      (build-system gnu-build-system)
      (native-inputs
@@ -82,7 +82,7 @@
 (define-public parallel
  (package
    (name "parallel")
-    (version "20260322")
+    (version "20260422")
    (outputs '("out" "doc"))
    (source
     (origin
@@ -90,7 +90,7 @@
      (uri (string-append "mirror://gnu/parallel/parallel-"
                          version ".tar.bz2"))
      (sha256
-       (base32 "1q7g5f13nlwichgh0dk8w5fqjnfnxvwxk6rjy0fd5l7l6blq0ikn"))
+       (base32 "1fq7v60x9jm8mg19qn8n0sfhrygccmw6mncwyjr1g8kfsrjz2k36"))
      (snippet
       '(begin
          (use-modules (guix build utils))
@@ -734,7 +734,7 @@ single-instruction multiple-data (SIMD) intrinsics.")
              (substitute* "src/include/pmix_config.h"
                (("#define PMIX_CONFIGURE_CLI .*")
                 "#define PMIX_CONFIGURE_CLI \"[scrubbed]\"\n")))))))
-    (inputs (list libevent `(,hwloc "lib") zlib))
+    (inputs (list libevent `(,hwloc "lib") munge zlib))
    (native-inputs
     (list autoconf
           automake
@@ -0,0 +1,32 @@
+From 5eed2d2ca7c13c08ca7eb92fc4a78c30ca4b6b3d Mon Sep 17 00:00:00 2001
+From: Hellseher <sharlatanus@gmail.com>
+Date: Sat, 18 Apr 2026 08:26:29 +0000
+Subject: [PATCH] Remove CUDA error handling from network.c
+
+Removed error handling for CUDA compilation check.
+
+Fixes: https://github.com/Deyht/CIANNA/issues/4
+---
+ src/network.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/src/network.c b/src/network.c
+index d454f64..5a9497c 100644
+--- a/src/network.c
+++ b/src/network.c
+@@ -155,15 +155,6 @@ CIANNA V-1.0.1.2 stable build (04/2026), by D.Cornu\n\
+ 		init_cuda(networks[network_number]);
+ 	#endif
+ 	
+-	#ifndef CUDA
+-	if(comp_int == C_CUDA)
+-	{
+-		printf("\n ERROR: compute method set to CUDA while CIANNA was not compiled for it.\n");
+-		printf(" Install Nvidia CUDA and recompile CIANNA with the appropriate option.\n\n");
+-		exit(EXIT_FAILURE);
+-	}
+-	#endif
+-	
+ 	#ifndef BLAS
+ 	if(comp_int == C_BLAS)
+ 	{
@@ -0,0 +1,165 @@
+Ensures that cvc5 is compatible with our version of SymFPU.
+
+Taken from: https://github.com/cvc5/cvc5/commit/2ed457049cf52bd0f21a6332c1be487d82bf5678
+
+diff --git a/cmake/FindSymFPU.cmake b/cmake/FindSymFPU.cmake
+index 765ee8d36..05a86e9ee 100644
+--- a/cmake/FindSymFPU.cmake
+++ b/cmake/FindSymFPU.cmake
+@@ -29,8 +29,8 @@ if(NOT SymFPU_FOUND_SYSTEM)
+   include(ExternalProject)
+   include(deps-helper)
+ 
+-  set(SymFPU_COMMIT "e6ac3af9c2c574498ea171c957425b407625448b")
+-  set(SymFPU_CHECKSUM "823aa663fcc2f6844ae5e9ea83ceda4ed393cdb3dadefce9b3c7c41cd0f4f702")
+  set(SymFPU_COMMIT "227a7246b8ce513b393cc2645d6d65d3490ea1de")
+  set(SymFPU_CHECKSUM "ff22e37dbc133120ada5760878974811737bec65b12a8883f92b1ed9e3f96e99")
+ 
+   ExternalProject_Add(
+     SymFPU-EP
+diff --git a/src/theory/fp/fp_word_blaster.cpp b/src/theory/fp/fp_word_blaster.cpp
+index 7f2086c35..3efb0eeed 100644
+--- a/src/theory/fp/fp_word_blaster.cpp
+++ b/src/theory/fp/fp_word_blaster.cpp
+@@ -119,6 +119,23 @@ CVC5_SYM_ITE_DFN(traits::ubv);
+ 
+ #undef CVC5_SYM_ITE_DFN
+ 
+#define CVC5_SYM_ITE_BOOL_DFN(T)                                   \
+  template <>                                                      \
+  struct ite<bool, T>                                              \
+  {                                                                \
+    static const T iteOp(const bool& cond, const T& l, const T& r) \
+    {                                                              \
+      return cond ? l : r;                                         \
+    }                                                              \
+  }
+
+CVC5_SYM_ITE_BOOL_DFN(traits::rm);
+CVC5_SYM_ITE_BOOL_DFN(traits::prop);
+CVC5_SYM_ITE_BOOL_DFN(traits::sbv);
+CVC5_SYM_ITE_BOOL_DFN(traits::ubv);
+
+#undef CVC5_SYM_ITE_BOOL_DFN
+
+ template <>
+ traits::ubv orderEncode<traits, traits::ubv>(const traits::ubv& b)
+ {
+@@ -564,6 +581,13 @@ symbolicBitVector<isSigned> symbolicBitVector<isSigned>::modularAdd(
+   return *this + op;
+ }
+ 
+template <bool isSigned>
+symbolicBitVector<isSigned> symbolicBitVector<isSigned>::modularSubtract(
+    const symbolicBitVector<isSigned>& op) const
+{
+  return *this - op;
+}
+
+ template <bool isSigned>
+ symbolicBitVector<isSigned> symbolicBitVector<isSigned>::modularNegate() const
+ {
+diff --git a/src/theory/fp/fp_word_blaster.h b/src/theory/fp/fp_word_blaster.h
+index 6ce365382..8179ceb32 100644
+--- a/src/theory/fp/fp_word_blaster.h
+++ b/src/theory/fp/fp_word_blaster.h
+@@ -242,6 +242,8 @@ class symbolicBitVector : public nodeWrapper
+   symbolicBitVector<isSigned> modularDecrement() const;
+   symbolicBitVector<isSigned> modularAdd(
+       const symbolicBitVector<isSigned>& op) const;
+  symbolicBitVector<isSigned> modularSubtract(
+      const symbolicBitVector<isSigned>& op) const;
+   symbolicBitVector<isSigned> modularNegate() const;
+ 
+   /*** Comparisons ***/
+diff --git a/src/util/floatingpoint_literal_symfpu_traits.cpp b/src/util/floatingpoint_literal_symfpu_traits.cpp
+index af56c2b87..181069427 100644
+--- a/src/util/floatingpoint_literal_symfpu_traits.cpp
+++ b/src/util/floatingpoint_literal_symfpu_traits.cpp
+@@ -223,6 +223,13 @@ wrappedBitVector<isSigned> wrappedBitVector<isSigned>::modularAdd(
+   return *this + op;
+ }
+ 
+template <bool isSigned>
+wrappedBitVector<isSigned> wrappedBitVector<isSigned>::modularSubtract(
+    const wrappedBitVector<isSigned>& op) const
+{
+  return *this - op;
+}
+
+ template <bool isSigned>
+ wrappedBitVector<isSigned> wrappedBitVector<isSigned>::modularNegate() const
+ {
+diff --git a/src/util/floatingpoint_literal_symfpu_traits.h b/src/util/floatingpoint_literal_symfpu_traits.h
+index 78fc69a18..b49ef3a2a 100644
+--- a/src/util/floatingpoint_literal_symfpu_traits.h
+++ b/src/util/floatingpoint_literal_symfpu_traits.h
+@@ -199,6 +199,8 @@ class wrappedBitVector : public BitVector
+   wrappedBitVector<isSigned> modularDecrement() const;
+   wrappedBitVector<isSigned> modularAdd(
+       const wrappedBitVector<isSigned>& op) const;
+  wrappedBitVector<isSigned> modularSubtract(
+      const wrappedBitVector<isSigned>& op) const;
+   wrappedBitVector<isSigned> modularNegate() const;
+ 
+   /** Bit-vector equality. */
+diff --git a/test/regress/cli/CMakeLists.txt b/test/regress/cli/CMakeLists.txt
+index 915a19e09..35ff58bc7 100644
+--- a/test/regress/cli/CMakeLists.txt
+++ b/test/regress/cli/CMakeLists.txt
+@@ -949,12 +949,15 @@ set(regress_0_tests
+   regress0/fp/issue6164.smt2
+   regress0/fp/issue7002.smt2
+   regress0/fp/issue7569.smt2
+  regress0/fp/issue9505.smt2
+   regress0/fp/issue9854.smt2
+   regress0/fp/issue9858.smt2
+   regress0/fp/issue9864.smt2
+   regress0/fp/issue9966.smt2
+   regress0/fp/issue9972.smt2
+   regress0/fp/issue9972-2.smt2
+  regress0/fp/issue11139.smt2
+  regress0/fp/issue12335.smt2
+   regress0/fp/issuepr650.smt2
+   regress0/fp/proj-issue329-prereg-context.smt2
+   regress0/fp/proj-issue477-fp-set-comprehension.smt2
+diff --git a/test/regress/cli/regress0/fp/issue11139.smt2 b/test/regress/cli/regress0/fp/issue11139.smt2
+new file mode 100644
+index 000000000..f4c00360e
+--- /dev/null
+++ b/test/regress/cli/regress0/fp/issue11139.smt2
+@@ -0,0 +1,9 @@
+; COMMAND-LINE: --check-models
+; EXPECT: sat
+(set-logic QF_FP)
+(declare-const FP_VAR_a (_ FloatingPoint 11 53))
+(declare-const FP_VAR_b (_ FloatingPoint 11 53))
+(assert ( = (fp #b0 #b00000000000 #b0000000000000000000000000000000000000000000000000000)
+(fp.div RTN (fp.fma RTP FP_VAR_a FP_VAR_a 
+(fp #b0 #b00000000000 #b0000000000000000000000000000000000000000000000000000)) FP_VAR_b)))
+(check-sat)
+diff --git a/test/regress/cli/regress0/fp/issue12335.smt2 b/test/regress/cli/regress0/fp/issue12335.smt2
+new file mode 100644
+index 000000000..bc2580a89
+--- /dev/null
+++ b/test/regress/cli/regress0/fp/issue12335.smt2
+@@ -0,0 +1,7 @@
+; EXPECT: sat
+(set-logic FP)
+(declare-const x Float32)
+(declare-const a Float32)
+(assert (forall ((V Float32) (A Float32)) (or (not (fp.lt V x)) (not (fp.eq a a)) (not (fp.gt A (fp (_ bv0 1) (_ bv0 8) (_ bv0 23)))) (not (fp.eq (fp.div RNE A V) (fp (_ bv0 1) (_ bv0 8) (_ bv0 23)))))))
+(assert (fp.geq a (fp (_ bv0 1) (_ bv0 8) (_ bv0 23))))
+(check-sat)
+diff --git a/test/regress/cli/regress0/fp/issue9505.smt2 b/test/regress/cli/regress0/fp/issue9505.smt2
+new file mode 100644
+index 000000000..05674b8ff
+--- /dev/null
+++ b/test/regress/cli/regress0/fp/issue9505.smt2
+@@ -0,0 +1,6 @@
+; COMMAND-LINE: --fp-exp
+; EXPECT: sat
+(set-logic QF_FP)
+(declare-fun m () (_ FloatingPoint 4 12))
+(assert (fp.eq (fp (_ bv0 1) (_ bv0 8) (_ bv0 23)) ((_ to_fp 8 24) roundNearestTiesToEven (fp.rem m (fp (_ bv0 1) (_     bv9 4) (_ bv1536 11))))))
+(check-sat)
@@ -1,92 +0,0 @@
-From 8d651d7247c4e8cf07ba805712cdb09e8095dd89 Mon Sep 17 00:00:00 2001
-Message-ID: <8d651d7247c4e8cf07ba805712cdb09e8095dd89.1773006315.git.dannym@friendly-machines.com>
-From: Danny Milosavljevic <dannym@friendly-machines.com>
-Date: Sun, 8 Mar 2026 21:44:05 +0000
-Subject: [PATCH] Scope native-comp trampoline disabling to spy-on only
-See: <https://github.com/jorgenschaefer/emacs-buttercup/pull/257>
-
-buttercup-with-cleanup disabled native-comp-enable-subr-trampolines
-for the entire spec execution.  This was a workaround for Emacs
-bug#61880, where trampoline compilation fails when spy-on redefines
-primitives that the trampoline compiler itself depends on (e.g.
-file-exists-p).
-
-However, disabling trampolines globally has the side effect that fset
-overrides of C primitives become invisible to natively compiled code.
-This breaks shut-up's message override when called indirectly through
-native-compiled functions like display-message-or-buffer (from
-simple.eln), because without a trampoline, the native code calls the C
-primitive directly, bypassing the fset'd function.
-
-Move the trampoline disabling from buttercup-with-cleanup into
-buttercup--spy-on-and-call-replacement, scoping it to just the fset
-call that installs the spy.  This avoids the trampoline compilation
-issue while allowing other fset overrides (e.g. from shut-up or
-cl-letf) to work correctly with native-compiled callers.
---
- buttercup.el | 34 +++++++++++++++++-----------------
- 1 file changed, 17 insertions(+), 17 deletions(-)
-
-diff --git a/buttercup.el b/buttercup.el
-index 07e003f..417786d 100644
--- a/buttercup.el
-+++ b/buttercup.el
-@@ -1293,12 +1293,23 @@ responsibility to ensure ARG is a command."
-       (error "Spies can only be created in `before-each' or `it'"))))
- 
- 
-+(defvar native-comp-enable-subr-trampolines)
-+(defvar comp-enable-subr-trampolines)
-+
- (defun buttercup--spy-on-and-call-replacement (spy fun)
-   "Replace the function in symbol SPY with a spy calling FUN."
-   (let ((orig-function (and (fboundp spy) (symbol-function spy))))
-     (when (buttercup--add-cleanup (lambda ()
-                                   (fset spy orig-function)))
-      (fset spy (buttercup--make-spy fun)))))
-+      ;; Disable subr trampoline generation around the fset call.
-+      ;; Redefining certain primitives causes trampoline compilation
-+      ;; to fail because the trampoline compiler itself depends on
-+      ;; primitives that may have just been redefined.
-+      ;; See <https://github.com/jorgenschaefer/emacs-buttercup/issues/230>
-+      ;; and <https://debbugs.gnu.org/61880>.
-+      (let ((native-comp-enable-subr-trampolines nil)
-+            (comp-enable-subr-trampolines nil))
-+        (fset spy (buttercup--make-spy fun))))))
- 
- (defun buttercup--make-spy (fun)
-   "Create a new spy function wrapping FUN and tracking every call to itself."
-@@ -1343,24 +1354,13 @@ responsibility to ensure ARG is a command."
- Should always be set to a value that is not `listp', except while
- in a `buttercup-with-cleanup' environment.")
- 
-(defvar native-comp-enable-subr-trampolines)
-(defvar comp-enable-subr-trampolines)
-
- (defmacro buttercup-with-cleanup (&rest body)
-   "Execute BODY, cleaning spys and the rest afterwards."
-  `(,@(if (fboundp 'with-suppressed-warnings)
-          '(with-suppressed-warnings ((obsolete comp-enable-subr-trampolines)))
-        '(progn))
-     (let ((buttercup--cleanup-functions nil)
-           ;; Redefining certain primitive's trampolines will cause problems,
-           ;; see https://github.com/jorgenschaefer/emacs-buttercup/issues/230 and
-           ;; https://debbugs.gnu.org/cgi/bugreport.cgi?bug=61880
-           (comp-enable-subr-trampolines nil)
-           (native-comp-enable-subr-trampolines nil))
-       (unwind-protect (progn ,@body)
-         (dolist (fun buttercup--cleanup-functions)
-           (ignore-errors
-             (funcall fun)))))))
-+  `(let ((buttercup--cleanup-functions nil))
-+     (unwind-protect (progn ,@body)
-+       (dolist (fun buttercup--cleanup-functions)
-+         (ignore-errors
-+           (funcall fun))))))
- 
- (defun buttercup--add-cleanup (function)
-   "Register FUNCTION for cleanup in `buttercup-with-cleanup'."
-
-base-commit: cc5a2ab7c7f18aaaf525fac61fe59bae5ad018dd
-- 
-2.52.0
@@ -0,0 +1,28 @@
+From 98300ecbb26fcacb0f7a722629fc50b4ec6bd1ab Mon Sep 17 00:00:00 2001
+Message-ID: <98300ecbb26fcacb0f7a722629fc50b4ec6bd1ab.1777294348.git.vivien@planete-kraus.eu>
+From: Vivien Kraus <vivien@planete-kraus.eu>
+Date: Mon, 27 Apr 2026 14:51:07 +0200
+Subject: [PATCH] Fix invalid Gst.init_check call
+
+init_check accepts a list of program arguments. An empty list works.
+
+---
+ src/orca/sound.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/orca/sound.py b/src/orca/sound.py
+index d507a371d..b1129609f 100644
+--- a/src/orca/sound.py
+++ b/src/orca/sound.py
+@@ -34,7 +34,7 @@ try:
+ except Exception:
+     _gstreamerAvailable = False
+ else:
+-    _gstreamerAvailable, args = Gst.init_check(None)
+    _gstreamerAvailable, args = Gst.init_check([])
+ 
+ from . import debug
+ from .sound_generator import Icon, Tone
+-- 
+2.52.0
+
@@ -0,0 +1,513 @@
+This patch shas been backported from the development version or Biostrings.
+
+From 100602242840322b5f6c267faaf8198c1a5aa2af Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Thu, 5 Mar 2026 22:36:30 -0800
+Subject: [PATCH] Biostrings 2.79.5: Get rid of never-used SparseMIndex and
+ SparseList classes
+
+This also eliminates the non-API calls to R.
+---
+ DESCRIPTION                 |   3 +-
+ NAMESPACE                   |   2 -
+ R/MIndex-class.R            |  79 -------------------------
+ R/SparseList-class.R        |  80 -------------------------
+ man/Biostrings-internals.Rd |   9 ---
+ src/Biostrings.h            |  41 -------------
+ src/MIndex_class.c          |  67 ---------------------
+ src/R_init_Biostrings.c     |   1 -
+ src/SparseList_utils.c      | 113 ------------------------------------
+ 9 files changed, 1 insertion(+), 394 deletions(-)
+ delete mode 100644 R/SparseList-class.R
+ delete mode 100644 src/SparseList_utils.c
+
+diff --git a/DESCRIPTION b/DESCRIPTION
+index a5d027cc..dbc323ea 100644
+--- a/DESCRIPTION
+++ b/DESCRIPTION
+@@ -76,3 +76,3 @@ Collate: utils.R IUPAC_CODE_MAP.R AMINO_ACID_CODE.R GENETIC_CODE.R
+         injectHardMask.R padAndClip.R strsplit-methods.R misc.R
+-        SparseList-class.R MIndex-class.R lowlevel-matching.R
+        MIndex-class.R lowlevel-matching.R
+         match-utils.R matchPattern.R maskMotif.R matchLRPatterns.R
+diff --git a/NAMESPACE b/NAMESPACE
+index ba1e3bfa..cf14db67 100644
+--- a/NAMESPACE
+++ b/NAMESPACE
+@@ -206,7 +206,6 @@ exportMethods(
+ ### ==========================================================================
+ ### STRING MATCHING
+ ### --------------------------------------------------------------------------
+-###   SparseList-class.R
+ ###   MIndex-class.R
+ ###   lowlevel-matching.R
+ ###   match-utils.R
+@@ -220,7 +219,6 @@ exportMethods(
+ ###   matchPDict.R
+ 
+ exportClasses(
+-    #SparseList,
+     MIndex, ByPos_MIndex,
+     PreprocessedTB, Twobit, ACtree2,
+     PDict3Parts,
+diff --git a/R/MIndex-class.R b/R/MIndex-class.R
+index 022f6746..f50f215e 100644
+--- a/R/MIndex-class.R
+++ b/R/MIndex-class.R
+@@ -218,82 +218,3 @@ ByPos_MIndex.combine <- function(mi_list)
+     new("ByPos_MIndex", width0=ans_width0, NAMES=ans_names, ends=ans_ends)
+ }
+ 
+-
+-### - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+-### The "SparseMIndex" class (DISABLED FOR NOW).
+-### 
+-### Slot description:
+-###
+-###   ends_envir: a key-value list (environment) where the values are integer
+-###       vectors containing the ending positions of the pattern whose
+-###       position in the original dictionary is given by the key (the keys are
+-###       strings representing positive integers).
+-### 
+-
+-if (FALSE) {
+-
+-  setClass("SparseMIndex",
+-    contains="MIndex",
+-    representation(
+-        ends_envir="environment"
+-    )
+-  )
+-
+-  setMethod("show", "SparseMIndex",
+-    function(object)
+-    {
+-        cat("Sparse MIndex object of length ", length(object), "\n", sep="")
+-    }
+-  )
+-
+-  setMethod("[[", "SparseMIndex",
+-    function(x, i, j, ...)
+-    {
+-        i <- normalizeDoubleBracketSubscript(i, x)
+-        ans_end <- x@ends_envir[[formatC(i, width=10, format="d", flag="0")]]
+-        if (is.null(ans_end))
+-            ans_end <- integer(0)
+-        ans_width <- rep.int(x@width0[i], length(ans_end))
+-        ans_start <- ans_end - x@width0[i] + 1L
+-        new2("IRanges", start=ans_start, width=ans_width, check=FALSE)
+-    }
+-  )
+-
+-  ### An example of a SparseMIndex object of length 5 where only the
+-  ### 2nd pattern has matches:
+-  ###   > width0 <- c(9L, 10L, 8L, 4L, 10L)
+-  ###   > ends_envir <- new.env(hash=TRUE, parent=emptyenv())
+-  ###   > ends_envir[['0000000002']] <- c(199L, 402L)
+-  ###   > mindex <- new("SparseMIndex", width0=width0, NAMES=letters[1:5], ends_envir=ends_envir)
+-  ###   > mindex[[1]]
+-  ###   > mindex[[2]]
+-  ###   > mindex[[6]] # Error in mindex[[6]] : subscript out of bounds
+-  ###   > names(mindex)
+-  ###   > mindex[["a"]]
+-  ###   > mindex[["b"]]
+-  ###   > mindex[["aa"]] # Error in mindex[["aa"]] : pattern name ‘aa’ not found
+-  ###   > startIndex(mindex)
+-  ###   > endIndex(mindex)
+-  ###   > elementNROWS(mindex)
+-  ###
+-  setMethod("startIndex", "SparseMIndex",
+-    function(x)
+-    {
+-        all.names <- TRUE
+-        .Call2("SparseMIndex_endIndex",
+-              x@ends_envir, x@width0, x@NAMES, all.names,
+-              PACKAGE="Biostrings")
+-    }
+-  )
+-  setMethod("endIndex", "SparseMIndex",
+-    function(x)
+-    {
+-        all.names <- TRUE
+-        .Call2("SparseMIndex_endIndex",
+-              x@ends_envir, NULL, x@NAMES, all.names,
+-              PACKAGE="Biostrings")
+-    }
+-  )
+-
+-}
+-
+diff --git a/R/SparseList-class.R b/R/SparseList-class.R
+deleted file mode 100644
+index 8295fd0f..00000000
+--- a/R/SparseList-class.R
+++ /dev/null
+@@ -1,80 +0,0 @@
+-### =========================================================================
+-### SparseList objects
+-### -------------------------------------------------------------------------
+-###
+-
+-setClass("SparseList",
+-    representation(
+-        length="integer",
+-        env="environment"
+-    )
+-)
+-
+-### Typical use:
+-###   env <- new.env(hash=TRUE, parent=emptyenv())
+-###   key <- formatC(98L, width=10, format="d", flag="0")
+-###   value <- 3:-2
+-###   assign(key, value, envir=env)
+-###   x <- new("SparseList", length=100L, env=env)
+-###   length(x)
+-###   ls(x)
+-###   ls(x, all.names=TRUE)
+-###   as.list(x)
+-###   as.list(x, all.names=TRUE)
+-###   x[[1]]
+-###   x[[98]
+-###   x[[101]]]
+-###
+-
+-setMethod("length", "SparseList", function(x) x@length)
+-
+-### 'pos', 'envir' and 'pattern' args are ignored
+-setMethod("ls", signature(name="SparseList"),
+-    function(name, pos, envir, all.names=FALSE, pattern)
+-    {
+-        if (!all.names)
+-            return(ls(name@env, all.names=TRUE))
+-        seq_len(length(name))
+-    }
+-)
+-
+-setMethod("as.list", "SparseList",
+-    function(x, all.names=FALSE, ...)
+-    {
+-        if (!all.names)
+-            return(as.list(x@env, all.names=TRUE))
+-        ans <- vector(mode="list", length=length(x))
+-        symbols <- ls(x)
+-        for (symb in symbols)
+-            ans[[as.integer(symb)]] <- get(symb, envir=x@env)
+-        ans
+-    }
+-)
+-
+-### Supported 'i' types: character or numeric vector of length 1.
+-setMethod("[[", "SparseList",
+-    function(x, i, j, ...)
+-    {
+-        if (!missing(j) || length(list(...)) > 0)
+-            stop("invalid subsetting")
+-        if (missing(i))
+-            stop("subscript is missing")
+-        if (!is.character(i) && !is.numeric(i))
+-            stop("invalid subscript type")
+-        if (length(i) < 1L)
+-            stop("attempt to select less than one element")
+-        if (length(i) > 1L)
+-            stop("attempt to select more than one element")
+-        if (is.na(i))
+-            stop("subscript cannot be NA")
+-        if (is.character(i))
+-            return(get(i, envir=x@env))
+-        if (!is.integer(i))
+-            i <- as.integer(i)
+-        if (i < 1L || i > length(x))
+-            stop("subscript out of bounds")
+-        i <- formatC(i, width=10, format="d", flag="0")
+-        get(i, envir=x@env)
+-    }
+-)
+-
+diff --git a/man/Biostrings-internals.Rd b/man/Biostrings-internals.Rd
+index 791b0870..609b7694 100644
+--- a/man/Biostrings-internals.Rd
+++ b/man/Biostrings-internals.Rd
+@@ -26,15 +26,6 @@
+ \alias{make_XStringSet_from_strings}
+ \alias{make_XStringSet_from_strings,XStringSet-method}
+ 
+-% SparseList class and methods:
+-\alias{class:SparseList}
+-\alias{SparseList-class}
+-\alias{SparseList}
+-
+-\alias{length,SparseList-method}
+-%\alias{ls,SparseList-method}
+-\alias{as.list,SparseList-method}
+-\alias{[[,SparseList-method}
+ 
+ \title{Biostrings internals}
+ 
+diff --git a/src/Biostrings.h b/src/Biostrings.h
+index 6e725bd5..e86d0ff2 100644
+--- a/src/Biostrings.h
+++ b/src/Biostrings.h
+@@ -446,40 +446,6 @@ SEXP XStringSetList_unstrsplit(
+ );
+ 
+ 
+-/* SparseList_utils.c */
+-
+-SEXP _SparseList_int2symb(int symb_as_int);
+-
+-int _SparseList_symb2int(SEXP symbol);
+-
+-SEXP _get_val_from_env(
+-	SEXP symbol,
+-	SEXP env,
+-	int error_on_unbound_value
+-);
+-
+-SEXP _get_val_from_SparseList(
+-	int symb_as_int,
+-	SEXP env,
+-	int error_on_unbound_value
+-);
+-
+-int _get_int_from_SparseList(
+-	int symb_as_int,
+-	SEXP env
+-);
+-
+-void _set_env_from_IntAE(
+-	SEXP env,
+-	const IntAE *int_ae
+-);
+-
+-void _set_env_from_IntAEAE(
+-	SEXP env,
+-	const IntAEAE *int_aeae
+-);
+-
+-
+ /* match_reporting.c */
+ 
+ int _get_match_storing_code(const char *ms_mode);
+@@ -558,13 +524,6 @@ SEXP ByPos_MIndex_endIndex(
+ 	SEXP x_width0
+ );
+ 
+-SEXP SparseMIndex_endIndex(
+-	SEXP x_ends_envir,
+-	SEXP x_width0,
+-	SEXP x_names,
+-	SEXP all_names
+-);
+-
+ SEXP ByPos_MIndex_combine(SEXP ends_listlist);
+ 
+ 
+diff --git a/src/MIndex_class.c b/src/MIndex_class.c
+index 00212fe9..dd6ad546 100644
+--- a/src/MIndex_class.c
+++ b/src/MIndex_class.c
+@@ -157,73 +157,6 @@ SEXP ByPos_MIndex_endIndex(SEXP x_high2low, SEXP x_ends, SEXP x_width0)
+ 	return ans;
+ }
+ 
+-/*
+- * --- .Call ENTRY POINT ---
+- * All the keys in 'x_ends_envir' must be representing integers left-padded with 0s
+- * so they have the same length. This works properly:
+-     library(Biostrings)
+-     ends_envir <- new.env(parent=emptyenv())
+-     ends_envir[['0000000010']] <- -2:1
+-     ends_envir[['0000000004']] <- 9:6
+-     .Call("SparseMIndex_endIndex",
+-           ends_envir, NULL, letters[1:10], TRUE,
+-           PACKAGE="Biostrings")
+-     .Call("SparseMIndex_endIndex",
+-           ends_envir, NULL, letters[1:10], FALSE,
+-           PACKAGE="Biostrings")
+- * but this doesn't:
+-     ends_envir[['3']] <- 33L
+-     .Call("SparseMIndex_endIndex",
+-           ends_envir, NULL, letters[1:10], FALSE,
+-           PACKAGE="Biostrings")
+- */
+-SEXP SparseMIndex_endIndex(SEXP x_ends_envir, SEXP x_width0, SEXP x_names, SEXP all_names)
+-{
+-	SEXP ans, ans_elt, ans_names, symbols, end;
+-	int nelt, i, j;
+-	IntAE *poffsets, *poffsets_order;
+-
+-	PROTECT(symbols = R_lsInternal(x_ends_envir, 1));
+-	poffsets = new_IntAE_from_CHARACTER(symbols, -1);
+-	nelt = IntAE_get_nelt(poffsets);
+-	if (LOGICAL(all_names)[0]) {
+-		PROTECT(ans = NEW_LIST(LENGTH(x_names)));
+-		for (i = 0; i < nelt; i++) {
+-			j = poffsets->elts[i];
+-			end = _get_val_from_env(STRING_ELT(symbols, i), x_ends_envir, 1);
+-			PROTECT(ans_elt = duplicate(end));
+-			if (x_width0 != R_NilValue)
+-				add_val_to_INTEGER(ans_elt, 1 - INTEGER(x_width0)[j]);
+-			SET_ELEMENT(ans, j, ans_elt);
+-			UNPROTECT(1);
+-		}
+-		SET_NAMES(ans, duplicate(x_names));
+-		UNPROTECT(1);
+-	} else {
+-		//poffsets_order = new_IntAE(nelt, 0, 0);
+-		//get_order_of_int_array(poffsets->elts, nelt, 0, 0,
+-		//		       poffsets_order->elts, 0);
+-		//IntAE_set_nelt(poffsets_order) = nelt; /* = poffsets_order->_buflength */
+-		PROTECT(ans = NEW_LIST(nelt));
+-		PROTECT(ans_names = NEW_CHARACTER(nelt));
+-		for (i = 0; i < nelt; i++) {
+-			//j = poffsets_order->elts[i];
+-			j = i;
+-			end = _get_val_from_env(STRING_ELT(symbols, j), x_ends_envir, 1);
+-			PROTECT(ans_elt = duplicate(end));
+-			if (x_width0 != R_NilValue)
+-				add_val_to_INTEGER(ans_elt, 1 - INTEGER(x_width0)[i]);
+-			SET_ELEMENT(ans, i, ans_elt);
+-			UNPROTECT(1);
+-			SET_STRING_ELT(ans_names, i, duplicate(STRING_ELT(x_names, poffsets->elts[j])));
+-		}
+-		SET_NAMES(ans, ans_names);
+-		UNPROTECT(2);
+-	}
+-	UNPROTECT(1);
+-	return ans;
+-}
+-
+ /*
+  * --- .Call ENTRY POINT ---
+  */
+diff --git a/src/R_init_Biostrings.c b/src/R_init_Biostrings.c
+index 4d2943f8..c1410dbd 100644
+--- a/src/R_init_Biostrings.c
+++ b/src/R_init_Biostrings.c
+@@ -88,7 +88,6 @@ static const R_CallMethodDef callMethods[] = {
+ 
+ /* MIndex_class.c */
+ 	CALLMETHOD_DEF(ByPos_MIndex_endIndex, 3),
+-	CALLMETHOD_DEF(SparseMIndex_endIndex, 4),
+ 	CALLMETHOD_DEF(ByPos_MIndex_combine, 1),
+ 
+ /* lowlevel_matching.c */
+diff --git a/src/SparseList_utils.c b/src/SparseList_utils.c
+deleted file mode 100644
+index 18597b55..00000000
+--- a/src/SparseList_utils.c
+++ /dev/null
+@@ -1,113 +0,0 @@
+-/****************************************************************************
+- *                        Fast SparseList utilities                         *
+- *                            Author: H. Pag\`es                            *
+- ****************************************************************************/
+-#include "Biostrings.h"
+-#include "S4Vectors_interface.h"
+-
+-
+-SEXP _SparseList_int2symb(int symb_as_int)
+-{
+-	char symbbuf[11];
+-
+-	snprintf(symbbuf, sizeof(symbbuf), "%010d", symb_as_int);
+-	return mkChar(symbbuf); /* UNPROTECTED! */
+-}
+-
+-int _SparseList_symb2int(SEXP symbol)
+-{
+-	int symb_as_int;
+-
+-	sscanf(CHAR(symbol), "%d", &symb_as_int);
+-	return symb_as_int;
+-}
+-
+-/* 'symbol' must be a CHARSXP */
+-SEXP _get_val_from_env(SEXP symbol, SEXP env, int error_on_unbound_value)
+-{
+-	SEXP ans;
+-
+-	/* The following code was inspired by R's do_get() code.
+-	 * Note that do_get() doesn't use PROTECT at all and so do we...
+-	 */
+-	ans = findVar(install(translateChar(symbol)), env);
+-	if (ans == R_UnboundValue) {
+-		if (error_on_unbound_value)
+-			error("Biostrings internal error in _get_val_from_env(): "
+-			      "unbound value");
+-		return R_UnboundValue;
+-	}
+-	if (TYPEOF(ans) == PROMSXP)
+-		ans = eval(ans, env);
+-	if (ans != R_NilValue && NAMED(ans) == 0)
+-		SET_NAMED(ans, 1);
+-	return ans;
+-}
+-
+-SEXP _get_val_from_SparseList(int symb_as_int, SEXP env, int error_on_unbound_value)
+-{
+-	SEXP symbol, ans;
+-
+-	PROTECT(symbol = _SparseList_int2symb(symb_as_int));
+-	ans = _get_val_from_env(symbol, env, error_on_unbound_value);
+-	UNPROTECT(1);
+-	return ans;
+-}
+-
+-int _get_int_from_SparseList(int symb_as_int, SEXP env)
+-{
+-	SEXP value;
+-	int val;
+-
+-	value = _get_val_from_SparseList(symb_as_int, env, 0);
+-	if (value == R_UnboundValue)
+-		return NA_INTEGER;
+-	if (LENGTH(value) != 1)
+-		error("Biostrings internal error in _get_int_from_SparseList(): "
+-		      "value is not a single integer");
+-	val = INTEGER(value)[0];
+-	if (val == NA_INTEGER)
+-		error("Biostrings internal error in _get_int_from_SparseList(): "
+-		      "value is NA");
+-	return val;
+-}
+-
+-void _set_env_from_IntAE(SEXP env, const IntAE *int_ae)
+-{
+-	int nelt, symb_as_int, elt;
+-	SEXP symbol, value;
+-
+-	nelt = IntAE_get_nelt(int_ae);
+-	for (symb_as_int = 1; symb_as_int <= nelt; symb_as_int++)
+-	{
+-		elt = int_ae->elts[symb_as_int - 1];
+-		if (elt == NA_INTEGER)
+-			continue;
+-		PROTECT(symbol = _SparseList_int2symb(symb_as_int));
+-		PROTECT(value = ScalarInteger(elt));
+-		defineVar(install(translateChar(symbol)), value, env);
+-		UNPROTECT(2);
+-	}
+-	return;
+-}
+-
+-void _set_env_from_IntAEAE(SEXP env, const IntAEAE *int_aeae)
+-{
+-	int nelt, symb_as_int;
+-	IntAE *ae;
+-	SEXP symbol, value;
+-
+-	nelt = IntAEAE_get_nelt(int_aeae);
+-	for (symb_as_int = 1; symb_as_int <= nelt; symb_as_int++)
+-	{
+-		ae = int_aeae->elts[symb_as_int - 1];
+-		if (IntAE_get_nelt(ae) == 0)
+-			continue;
+-		PROTECT(symbol = _SparseList_int2symb(symb_as_int));
+-		PROTECT(value = new_INTEGER_from_IntAE(ae));
+-		defineVar(install(translateChar(symbol)), value, env);
+-		UNPROTECT(2);
+-	}
+-	return;
+-}
+-
@@ -0,0 +1,142 @@
+From 7fe34542bff0183c3a6a35a62df9035a71698eb2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 15:54:23 -0800
+Subject: [PATCH] h5mread 1.3.2: Get rid of non-API calls to R
+
+---
+ DESCRIPTION                |  2 +-
+ R/H5File-class.R           | 27 ++++++++++++++++-----------
+ src/h5mread_index.c        |  5 +++--
+ src/h5mread_startscounts.c |  3 ++-
+ 4 files changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/R/H5File-class.R b/R/H5File-class.R
+index 2735166..6aeb80f 100644
+--- a/R/H5File-class.R
+++ b/R/H5File-class.R
+@@ -73,19 +73,23 @@
+     }
+ }
+ 
+-.h5openfile <- function(filepath, s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
+.h5openfile <- function(filepath, readonly=TRUE,
+                        s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
+ {
+     if (!isSingleString(filepath))
+         stop(wmsg("'filepath' must be a single string specifying ",
+                   "the path or URL to an HDF5 file"))
+    if (!isTRUEorFALSE(readonly))
+        stop(wmsg("'readonly' must be TRUE or FALSE"))
+     if (!isTRUEorFALSE(s3))
+         stop(wmsg("'s3' must be TRUE or FALSE"))
+-
+    if (s3 && !readonly)
+        stop(wmsg("'readonly' must be set to TRUE when 's3' is TRUE"))
+     if (s3) {
+         ID <- .h5openS3file(filepath, s3credentials=s3credentials,
+                                       use.rhdf5=use.rhdf5)
+     } else {
+-        ID <- .h5openlocalfile(filepath, readonly=TRUE, use.rhdf5=use.rhdf5)
+        ID <- .h5openlocalfile(filepath, readonly=readonly, use.rhdf5=use.rhdf5)
+     }
+     ID
+ }
+@@ -136,16 +140,16 @@
+ 
+ .ID_is_closed <- function(ID) { is.null(ID) || is.na(ID) }
+ 
+-.open_H5FileID_xp <- function(xp, filepath, s3=FALSE, s3credentials=NULL,
+-                                            use.rhdf5=FALSE)
+.open_H5FileID_xp <- function(xp, filepath, readonly=TRUE,
+                              s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
+ {
+     ID <- .get_H5FileID_xp_ID(xp)
+     if (!.ID_is_closed(ID)) {
+         ## H5FileID object is already open.
+         return(FALSE)
+     }
+-    ID <- .h5openfile(filepath, s3=s3, s3credentials=s3credentials,
+-                                use.rhdf5=use.rhdf5)
+    ID <- .h5openfile(filepath, readonly=readonly,
+                      s3=s3, s3credentials=s3credentials, use.rhdf5=use.rhdf5)
+     .set_H5FileID_xp_ID(xp, ID)
+     TRUE
+ }
+@@ -183,10 +187,11 @@ close.H5FileID <- function(con, ...)
+     .close_H5FileID_xp(con@xp, ..., use.rhdf5=con@from_rhdf5)
+ }
+ 
+-H5FileID <- function(filepath, s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
+H5FileID <- function(filepath, readonly=TRUE,
+                     s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
+ {
+-    ID <- .h5openfile(filepath, s3=s3, s3credentials=s3credentials,
+-                                use.rhdf5=use.rhdf5)
+    ID <- .h5openfile(filepath, readonly=readonly,
+                      s3=s3, s3credentials=s3credentials, use.rhdf5=use.rhdf5)
+     xp <- .new_H5FileID_xp(ID)
+     reg.finalizer(xp,
+                   function(e) .close_H5FileID_xp(e, use.rhdf5=use.rhdf5),
+@@ -272,7 +277,7 @@ H5File <- function(filepath, s3=FALSE, s3credentials=NULL, .no_rhdf5_h5id=FALSE)
+         rhdf5_h5id <- new("H5FileID")
+     } else {
+         rhdf5_h5id <- H5FileID(filepath, s3=s3, s3credentials=s3credentials,
+-                                         use.rhdf5=TRUE)
+                               use.rhdf5=TRUE)
+     }
+     if (!s3)
+         filepath <- file_path_as_absolute(filepath)
+diff --git a/src/h5mread_index.c b/src/h5mread_index.c
+index 7284815..ec93c25 100644
+--- a/src/h5mread_index.c
+++ b/src/h5mread_index.c
+@@ -9,6 +9,7 @@
+ #include "h5mread_helpers.h"
+ #include "TouchedChunks.h"
+ 
+#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <stdlib.h>  /* for malloc, free */
+ #include <string.h>  /* for memcmp */
+ //#include <time.h>
+@@ -444,7 +445,7 @@ static int read_chunk_data_4_5(const H5DSetDescriptor *h5dset,
+ 		const size_t *Rarray_dim, SEXP Rarray,
+ 		int method, int use_H5Dread_chunk)
+ {
+-	void *out = DATAPTR(Rarray);
+	void *out = DATAPTR_RW(Rarray);
+ 	if (out == NULL)
+ 		return -1;
+ 
+@@ -874,7 +875,7 @@ static int read_data_6(const AllTChunks *all_tchunks,
+ 	size_t *inner_nchip_buf = R_alloc0_size_t_array(ndim);
+ 	LLongAEAE *inner_breakpoint_bufs = new_LLongAEAE(ndim, ndim);
+ 
+-	void *out = DATAPTR(Rarray);
+	void *out = DATAPTR_RW(Rarray);
+ 	if (out == NULL) {
+ 		_destroy_TChunkIterator(&tchunk_iter);
+ 		return -1;
+diff --git a/src/h5mread_startscounts.c b/src/h5mread_startscounts.c
+index de57fd5..959014f 100644
+--- a/src/h5mread_startscounts.c
+++ b/src/h5mread_startscounts.c
+@@ -8,6 +8,7 @@
+ #include "uaselection.h"
+ #include "h5mread_helpers.h"
+ 
+#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <stdlib.h>  /* for malloc, free */
+ //#include <time.h>
+ 
+@@ -402,7 +403,7 @@ SEXP _h5mread_startscounts(const H5DSetDescriptor *h5dset,
+ 	SEXP ans = PROTECT(allocVector(h5dset->h5type->Rtype, ans_len));
+ 
+ 	if (ans_len != 0) {
+-		void *mem = DATAPTR(ans);
+		void *mem = DATAPTR_RW(ans);
+ 		if (mem == NULL)
+ 			goto on_error;
+ 
+-- 
+2.52.0
+
@@ -0,0 +1,67 @@
+From a827c9fdeb77edefe6cca81bdb9e0344bc8d3742 Mon Sep 17 00:00:00 2001
+From: Sebastian Gibb <mail@sebastiangibb.de>
+Date: Sat, 13 Dec 2025 23:06:12 +0100
+Subject: [PATCH] fix: non-API call to R: SETLENGTH by using lengthgets
+
+---
+ DESCRIPTION  |  2 +-
+ NEWS.md      |  6 ++++++
+ src/join.c   | 12 ++++--------
+ src/reduce.c |  6 ++----
+ 4 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/src/join.c b/src/join.c
+index f13a703..3849fdf 100644
+--- a/src/join.c
+++ b/src/join.c
+@@ -111,12 +111,10 @@ SEXP C_join_inner(SEXP x, SEXP y, SEXP tolerance, SEXP nomatch) {
+             ++j;
+         }
+     }
+-    SETLENGTH(rx, j);
+-    SETLENGTH(ry, j);
+     SEXP out = PROTECT(allocVector(VECSXP, 2));
+     SEXP nms = PROTECT(allocVector(STRSXP, 2));
+-    SET_VECTOR_ELT(out, 0, rx);
+-    SET_VECTOR_ELT(out, 1, ry);
+    SET_VECTOR_ELT(out, 0, lengthgets(rx, j));
+    SET_VECTOR_ELT(out, 1, lengthgets(ry, j));
+     SET_STRING_ELT(nms, 0, mkChar("x"));
+     SET_STRING_ELT(nms, 1, mkChar("y"));
+     setAttrib(out, R_NamesSymbol, nms);
+@@ -201,12 +199,10 @@ SEXP C_join_outer(SEXP x, SEXP y, SEXP tolerance, SEXP nomatch) {
+         ++i;
+     }
+ 
+-    SETLENGTH(rx, i);
+-    SETLENGTH(ry, i);
+     SEXP out = PROTECT(allocVector(VECSXP, 2));
+     SEXP nms = PROTECT(allocVector(STRSXP, 2));
+-    SET_VECTOR_ELT(out, 0, rx);
+-    SET_VECTOR_ELT(out, 1, ry);
+    SET_VECTOR_ELT(out, 0, lengthgets(rx, i));
+    SET_VECTOR_ELT(out, 1, lengthgets(ry, i));
+     SET_STRING_ELT(nms, 0, mkChar("x"));
+     SET_STRING_ELT(nms, 1, mkChar("y"));
+     setAttrib(out, R_NamesSymbol, nms);
+diff --git a/src/reduce.c b/src/reduce.c
+index 5f87966..8e48058 100644
+--- a/src/reduce.c
+++ b/src/reduce.c
+@@ -66,11 +66,9 @@ SEXP C_reduce(SEXP start, SEXP end, SEXP check) {
+         }
+     }
+ 
+-    SETLENGTH(rs, pos + 1);
+-    SETLENGTH(re, pos + 1);
+     SEXP out = PROTECT(allocVector(VECSXP, 2));
+-    SET_VECTOR_ELT(out, 0, rs);
+-    SET_VECTOR_ELT(out, 1, re);
+    SET_VECTOR_ELT(out, 0, lengthgets(rs, pos + 1));
+    SET_VECTOR_ELT(out, 1, lengthgets(re, pos + 1));
+ 
+     UNPROTECT(4);
+ 
+-- 
+2.52.0
+
@@ -0,0 +1,114 @@
+From 57dc6579d8b53af9e633016705fa9a1cbe58c8c8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 16:48:20 -0800
+Subject: [PATCH] Rsamtools 2.27.1: Get rid of non-API calls to R
+
+---
+ DESCRIPTION     | 2 +-
+ src/utilities.h | 3 +--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/utilities.h b/src/utilities.h
+index bffb98f7..f9d5e09f 100644
+--- a/src/utilities.h
+++ b/src/utilities.h
+@@ -51,8 +51,7 @@ SEXP find_mate_within_groups(SEXP group_sizes,
+ /* call-building macros */
+ 
+ #define NEW_CALL(S, T, NAME, ENV, N)            \
+-    PROTECT(S = T = allocList(N));              \
+-    SET_TYPEOF(T, LANGSXP);                     \
+    PROTECT(S = T = LCONS(R_NilValue, allocList(N-1))); \
+     SETCAR(T, findFun(install(NAME), ENV));     \
+     T = CDR(T)
+ #define CSET_CDR(T, NAME, VALUE)                \
+
+From 8cdec143023e8348a4f8bdc310acd609d14fe493 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 16:59:42 -0800
+Subject: [PATCH] oops, forgot to also get rid of non-API call to FORMALS()
+
+---
+ src/pileupbam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pileupbam.c b/src/pileupbam.c
+index f3256ba..7725628 100644
+--- a/src/pileupbam.c
+++ b/src/pileupbam.c
+@@ -655,7 +655,7 @@ SEXP apply_pileups(SEXP files, SEXP names, SEXP regions, SEXP param,
+     if (R_NilValue == regions)
+         Rf_error("'NULL' regions not (yet) supported");
+     _checkparams(regions, R_NilValue, R_NilValue);
+-    if (!Rf_isFunction(callback) || 1L != Rf_length(FORMALS(callback)))
+    if (!Rf_isFunction(callback) || 1L != Rf_length(R_ClosureFormals(callback)))
+         Rf_error("'callback' must be a function of 1 argument");
+     call = PROTECT(Rf_lang2(callback, R_NilValue));
+ 
+
+From ee01a1f13f3b012b0717247d1f21580225b6f3a0 Mon Sep 17 00:00:00 2001
+From: vjcitn <stvjc@channing.harvard.edu>
+Date: Wed, 8 Apr 2026 14:04:26 -0400
+Subject: [PATCH] API solutions
+
+---
+ DESCRIPTION     |  2 +-
+ src/tabixfile.c |  4 ++++
+ src/utilities.c | 13 ++++++++++---
+ 3 files changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/src/tabixfile.c b/src/tabixfile.c
+index 230a381..6f96568 100644
+--- a/src/tabixfile.c
+++ b/src/tabixfile.c
+@@ -187,8 +187,12 @@ SEXP index_tabix(SEXP filename, SEXP format, SEXP seq, SEXP begin, SEXP end,
+         LOGICAL(zeroBased)[0] == TRUE)
+         conf.preset |= TBX_UCSC;
+ 
+/* following is deprecated in HTSLIB with no precise replacement proposed */
+/* seems unimportant */
+/*
+     if (bgzf_is_bgzf(fn) != 1)
+         Rf_error("file does not appear to be bgzip'd");
+*/
+     if (tbx_index_build(fn, 0, &conf) == -1)
+         Rf_error("index build failed");
+ 
+diff --git a/src/utilities.c b/src/utilities.c
+index e224f91..d15c1d1 100644
+--- a/src/utilities.c
+++ b/src/utilities.c
+@@ -5,6 +5,13 @@
+ #include "XVector_interface.h"
+ #include <htslib/khash.h>
+ 
+#include <Rversion.h>
+
+#if R_VERSION < R_Version(4, 6, 0)
+# define R_getVar(x,y,z) findVar(x,y)
+#endif
+
+
+ void *_Rs_Realloc_impl(void *p, size_t n, size_t t)
+ {
+     /* R_Realloc(p, 0, *) fails inappropriately */
+@@ -30,7 +37,7 @@ SEXP _get_namespace(const char *pkg)
+ void _as_strand(SEXP vec)
+ {
+     SEXP nmspc = PROTECT(_get_namespace("Rsamtools"));
+-    SEXP lvls = PROTECT(eval(findVar(install(".STRAND_LEVELS"), nmspc), nmspc));
+    SEXP lvls = PROTECT(eval(R_getVar(install(".STRAND_LEVELS"), nmspc, TRUE), nmspc));
+     _as_factor_SEXP(vec, lvls);
+     UNPROTECT(2);
+ }
+@@ -38,8 +45,8 @@ void _as_strand(SEXP vec)
+ void _as_nucleotide(SEXP vec)
+ {
+     SEXP nmspc = PROTECT(_get_namespace("Rsamtools"));
+-    SEXP lvls = PROTECT(eval(findVar(install(".PILEUP_NUCLEOTIDE_LEVELS"),
+-                                     nmspc), nmspc));
+    SEXP lvls = PROTECT(eval(R_getVar(install(".PILEUP_NUCLEOTIDE_LEVELS"),
+                                     nmspc, TRUE), nmspc));
+     _as_factor_SEXP(vec, lvls);
+     UNPROTECT(2);
+ }
@@ -0,0 +1,103 @@
+From e39852a54312bbc6ba435848890cc2a7f612357c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 17:04:19 -0800
+Subject: [PATCH] ShortRead 1.69.3: Get rid of non-API calls to R
+
+---
+ DESCRIPTION |  2 +-
+ src/call.h  |  3 +--
+ src/io.c    | 10 +++++-----
+ 3 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/src/call.h b/src/call.h
+index e15bb5e..e72bbd6 100644
+--- a/src/call.h
+++ b/src/call.h
+@@ -6,8 +6,7 @@ extern "C" {
+ #endif
+ 
+ #define NEW_CALL(S, T, NAME, ENV, N)				\
+-    PROTECT((S) = (T) = allocList((N)));			\
+-    SET_TYPEOF((T), LANGSXP);                                   \
+    PROTECT((S) = (T) = LCONS(R_NilValue, allocList((N)-1)));	\
+     SETCAR((T), findFun(install((NAME)), (ENV)));               \
+     (T) = CDR((T))
+ #define CSET_CDR(T, NAME, VALUE)				\
+diff --git a/src/io.c b/src/io.c
+index 25a0111..9cf4bf8 100644
+--- a/src/io.c
+++ b/src/io.c
+@@ -46,9 +46,9 @@ SEXP write_fastq(SEXP id, SEXP sread, SEXP quality,
+                  SEXP fname, SEXP fmode, SEXP full, SEXP compress,
+                  SEXP max_width)
+ {
+-    if (!(IS_S4_OBJECT(id) && strcmp(get_classname(id), "BStringSet") == 0))
+    if (!(Rf_isS4(id) && strcmp(get_classname(id), "BStringSet") == 0))
+         Rf_error("'%s' must be '%s'", "id", "BStringSet");
+-    if (!(IS_S4_OBJECT(sread) &&
+    if (!(Rf_isS4(sread) &&
+           strcmp(get_classname(sread), "DNAStringSet") == 0))
+         Rf_error("'%s' must be '%s'", "sread", "DNAStringSet");
+     /* check in R -- C-level R_check_super... is not adequate */
+@@ -693,14 +693,14 @@ int _solexa_export_make_id(SEXP result)
+         *x = INTEGER(VECTOR_ELT(result, SLX_X)),
+         *y = INTEGER(VECTOR_ELT(result, SLX_Y)), *pairedReadNumber = NULL;
+     const SEXP
+-        * run = STRING_PTR(VECTOR_ELT(result, SLX_RUN)),
+        * run = STRING_PTR_RO(VECTOR_ELT(result, SLX_RUN)),
+         *multiplexIndex = NULL,
+-        *machine = STRING_PTR(VECTOR_ELT(result, SLX_MACHINE));
+        *machine = STRING_PTR_RO(VECTOR_ELT(result, SLX_MACHINE));
+     const Rboolean
+         withMultiplexIndex = R_NilValue != VECTOR_ELT(result, SLX_MULTIPLEX),
+         withPairedReadNumber = R_NilValue != VECTOR_ELT(result, SLX_PAIRID);
+     if (withMultiplexIndex)
+-        multiplexIndex = STRING_PTR(VECTOR_ELT(result, SLX_MULTIPLEX));
+        multiplexIndex = STRING_PTR_RO(VECTOR_ELT(result, SLX_MULTIPLEX));
+     if (withPairedReadNumber)
+         pairedReadNumber = INTEGER(VECTOR_ELT(result, SLX_PAIRID));
+ 
+-- 
+2.52.0
+
+
+From 2e3368a35e3955a0a92b7f3e2c8dface6709d135 Mon Sep 17 00:00:00 2001
+From: vjcitn <stvjc@channing.harvard.edu>
+Date: Thu, 16 Apr 2026 16:54:15 +0000
+Subject: [PATCH] fixapi
+
+---
+ src/util.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/util.c b/src/util.c
+index 4a10a90..59c089b 100644
+--- a/src/util.c
+++ b/src/util.c
+@@ -6,6 +6,14 @@ unsigned char _bDecode(char);
+ unsigned char _dnaDecode(char);
+ unsigned char _rnaDecode(char);
+ 
+
+#include <Rversion.h>
+
+#if R_VERSION < R_Version(4, 6, 0)
+# define R_getVar(x,y,z) findVar(x,y)
+#endif
+
+
+ /*
+  * Encode / decode XString wrappers
+  */
+@@ -80,7 +88,7 @@ SEXP _get_namespace(const char *pkg)
+ SEXP _get_strand_levels()
+ {
+     SEXP nmspc = PROTECT(_get_namespace("ShortRead"));
+-    SEXP ans = eval(findVar(install(".STRAND_LEVELS"), nmspc), nmspc);
+    SEXP ans = eval(R_getVar(install(".STRAND_LEVELS"), nmspc, TRUE), nmspc);
+     UNPROTECT(1);
+     return ans;
+ }
+-- 
+2.52.0
+
@@ -0,0 +1,412 @@
+From 803cda41994a22890e0a6e379e6588084d4bc91b Mon Sep 17 00:00:00 2001
+From: vjcitn <stvjc@channing.harvard.edu>
+Date: Fri, 13 Mar 2026 04:04:59 -0400
+Subject: [PATCH 1/2] fixed non-API except for IS_S4_OBJECT
+
+---
+ src/bind.c             |  8 ++++----
+ src/glm_test_R.c       | 20 ++++++++++----------
+ src/imputation.c       |  8 ++++----
+ src/input.c            |  2 +-
+ src/plink.c            |  2 +-
+ src/read_uncertain.c   |  4 ++--
+ src/readped.c          |  2 +-
+ src/single_snp_tests.c |  8 ++++----
+ src/snp_summary.c      |  8 ++++----
+ src/snpmpy.c           |  8 ++++----
+ src/structure.c        |  4 ++--
+ src/subset.c           |  2 +-
+ src/switch.c           |  2 +-
+ src/tdt.c              |  8 ++++----
+ src/testBig.c          |  2 +-
+ 15 files changed, 44 insertions(+), 44 deletions(-)
+
+diff --git a/src/bind.c b/src/bind.c
+index 44b1536..fa87e7c 100644
+--- a/src/bind.c
+++ b/src/bind.c
+@@ -19,7 +19,7 @@ SEXP snp_rbind(SEXP args) {
+     const SEXP This = CAR(args);
+     Class = getAttrib(This, R_ClassSymbol);
+     if (TYPEOF(Class) != STRSXP) {
+-      Class = R_data_class(This, FALSE);
+      Class = R_class(This);
+     }
+     const char *cli = CHAR(STRING_ELT(Class, 0));
+     if(!IS_S4_OBJECT(This)) {
+@@ -66,7 +66,7 @@ SEXP snp_rbind(SEXP args) {
+   SEXP Result, Rnames, Dnames, Diploid = R_NilValue;
+   PROTECT(Result = allocMatrix(RAWSXP, nr, nc));
+   classgets(Result, duplicate(Class));
+-  SET_S4_OBJECT(Result);
+  Rf_asS4(Result, TRUE, 0);
+   PROTECT(Rnames = allocVector(STRSXP, nr));
+   PROTECT(Dnames = allocVector(VECSXP, 2));
+   SET_VECTOR_ELT(Dnames, 0, Rnames);
+@@ -148,7 +148,7 @@ SEXP snp_cbind(SEXP args) {
+     SEXP This = CAR(args);
+     Class = getAttrib(This, R_ClassSymbol);
+     if (TYPEOF(Class) != STRSXP) {
+-      Class = R_data_class(This, FALSE);
+      Class = R_class(This);
+     }
+     const char *cli = CHAR(STRING_ELT(Class, 0));
+     if(!IS_S4_OBJECT(This)) {
+@@ -205,7 +205,7 @@ SEXP snp_cbind(SEXP args) {
+   SEXP Result, Cnames, Dnames;
+   PROTECT(Result = allocMatrix(RAWSXP, nr, nc));
+   classgets(Result, duplicate(Class));
+-  SET_S4_OBJECT(Result);
+  Rf_asS4(Result, TRUE, 0);
+   PROTECT(Dnames = allocVector(VECSXP, 2));
+   setAttrib(Result, R_DimNamesSymbol, Dnames);
+   PROTECT(Cnames = allocVector(STRSXP, nc));
+diff --git a/src/glm_test_R.c b/src/glm_test_R.c
+index d865182..dc8ebef 100644
+--- a/src/glm_test_R.c
+++ b/src/glm_test_R.c
+@@ -19,8 +19,8 @@ SEXP snp_lhs_score(const SEXP Y, const SEXP X, const SEXP Stratum,
+ 
+   /* Y should be a SnpMatrix or an XSnpMatrix */
+   const char *classY = NULL;
+-  if (TYPEOF(R_data_class(Y, FALSE)) == STRSXP) {
+-    classY = CHAR(STRING_ELT(R_data_class(Y, FALSE), 0));
+  if (TYPEOF(R_class(Y)) == STRSXP) {
+    classY = CHAR(STRING_ELT(R_class(Y), 0));
+   } else {
+     classY = CHAR(STRING_ELT(getAttrib(Y, R_ClassSymbol), 0));
+   }
+@@ -431,8 +431,8 @@ SEXP snp_rhs_score(SEXP Y, SEXP family, SEXP link,
+   /* Z should be a SnpMatrix or an XSnpMatrix */
+ 
+   const char *classZ = NULL;
+-  if (TYPEOF(R_data_class(Z, FALSE)) == STRSXP) {
+-    classZ = CHAR(STRING_ELT(R_data_class(Z, FALSE), 0));
+  if (TYPEOF(R_class(Z)) == STRSXP) {
+    classZ = CHAR(STRING_ELT(R_class(Z), 0));
+   } else {
+     classZ = CHAR(STRING_ELT(getAttrib(Z, R_ClassSymbol), 0));
+   }
+@@ -1003,8 +1003,8 @@ SEXP snp_lhs_estimate(const SEXP Y, const SEXP X, const SEXP Stratum,
+ 
+   /* Y should be a SnpMatrix or an XSnpMatrix */
+   const char *classY = NULL;
+-  if (TYPEOF(R_data_class(Y, FALSE)) == STRSXP) {
+-    classY = CHAR(STRING_ELT(R_data_class(Y, FALSE), 0));
+  if (TYPEOF(R_class(Y)) == STRSXP) {
+    classY = CHAR(STRING_ELT(R_class(Y), 0));
+   } else {
+     classY = CHAR(STRING_ELT(getAttrib(Y, R_ClassSymbol), 0));
+   }
+@@ -1286,7 +1286,7 @@ SEXP snp_lhs_estimate(const SEXP Y, const SEXP X, const SEXP Stratum,
+   LOGICAL(Lhs)[0] = 1;
+   setAttrib(Estimates, install("snpLHS"), Lhs);
+   UNPROTECT(6);
+-  SET_S4_OBJECT(Estimates);
+  Rf_asS4(Estimates, TRUE, 0);
+   return(Estimates);
+ }
+ 
+@@ -1360,8 +1360,8 @@ SEXP snp_rhs_estimate(SEXP Y, SEXP family, SEXP link,
+ /* Z should be a SnpMatrix or an XSnpMatrix */
+ 
+   const char *classZ = NULL;
+-  if (TYPEOF(R_data_class(Z, FALSE)) == STRSXP) {
+-    classZ = CHAR(STRING_ELT(R_data_class(Z, FALSE), 0));
+  if (TYPEOF(R_class(Z)) == STRSXP) {
+    classZ = CHAR(STRING_ELT(R_class(Z), 0));
+   } else {
+     classZ = CHAR(STRING_ELT(getAttrib(Z, R_ClassSymbol), 0));
+   }
+@@ -1724,7 +1724,7 @@ SEXP snp_rhs_estimate(SEXP Y, SEXP family, SEXP link,
+ 
+   UNPROTECT(gen_names? 7: 6);
+ 
+-  SET_S4_OBJECT(Estimates);
+  Rf_asS4(Estimates, TRUE, 0);
+   return(Estimates);
+   
+ }
+diff --git a/src/imputation.c b/src/imputation.c
+index ff9403b..d796c1b 100644
+--- a/src/imputation.c
+++ b/src/imputation.c
+@@ -77,7 +77,7 @@ SEXP snp_impute(const SEXP X, const SEXP Y, const SEXP Xord, const SEXP Yord,
+   int *diploid = NULL;
+   SEXP cl = GET_CLASS(X);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(X, FALSE); /* S4 way of getting class attribute */
+    cl = R_class(X); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP Diploid = R_do_slot(X, mkString("diploid"));
+@@ -395,7 +395,7 @@ SEXP snp_impute(const SEXP X, const SEXP Y, const SEXP Xord, const SEXP Yord,
+   PROTECT(Maxpred = allocVector(INTSXP, 1));
+   INTEGER(Maxpred)[0] = maxpred;
+   setAttrib(Result, install("Max.predictors"), Maxpred);
+-  SET_S4_OBJECT(Result);
+  Rf_asS4(Result, TRUE, 0);
+ 
+   /* Tidy up */
+ 
+@@ -701,7 +701,7 @@ SEXP impute_snps(const SEXP Rules, const SEXP Snps, const SEXP Subset,
+   int *diploid_in=NULL, *diploid=NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
+    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP Diploid = R_do_slot(Snps, mkString("diploid"));
+@@ -753,7 +753,7 @@ SEXP impute_snps(const SEXP Rules, const SEXP Snps, const SEXP Subset,
+     SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+     setAttrib(Class, install("package"), Package);
+     classgets(Result, Class);
+-    SET_S4_OBJECT(Result);
+    Rf_asS4(Result, TRUE, 0);
+   }
+   PROTECT(Dimnames = allocVector(VECSXP, 2));
+   SET_VECTOR_ELT(Dimnames, 0, VECTOR_ELT(names, 0));
+diff --git a/src/input.c b/src/input.c
+index 1d2a95b..60cdad8 100644
+--- a/src/input.c
+++ b/src/input.c
+@@ -330,7 +330,7 @@ SEXP insnp_new(const SEXP Filenames, const SEXP Sample_id, const SEXP Snp_id,
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Class, install("package"), Package);
+   classgets(Result, Class);
+-  SET_S4_OBJECT(Result);
+  Rf_asS4(Result, TRUE, 0);
+   unsigned char *result = RAW(Result);
+   memset(result, 0x00, Nsample*Nsnp);
+ 
+diff --git a/src/plink.c b/src/plink.c
+index a413440..9095c2d 100644
+--- a/src/plink.c
+++ b/src/plink.c
+@@ -59,7 +59,7 @@ SEXP readbed(SEXP Bed, SEXP Id, SEXP Snps, SEXP Rsel, SEXP Csel) {
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Class, install("package"), Package);
+   classgets(Result, Class);
+-  SET_S4_OBJECT(Result);
+  Rf_asS4(Result, TRUE, 0);
+   
+   unsigned char *result = RAW(Result); 
+   R_xlen_t ncell = (R_xlen_t)nrow*(R_xlen_t)ncol;
+diff --git a/src/read_uncertain.c b/src/read_uncertain.c
+index 2e3b901..fd82617 100644
+--- a/src/read_uncertain.c
+++ b/src/read_uncertain.c
+@@ -137,7 +137,7 @@ SEXP read_mach(const SEXP Filename, const SEXP Colnames, const SEXP Nsubject) {
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Class, install("package"), Package);
+   classgets(Result, Class);
+-  SET_S4_OBJECT(Result);
+  Rf_asS4(Result, TRUE, 0);
+   UNPROTECT(2);
+  
+   /* Read in data */
+@@ -278,7 +278,7 @@ SEXP read_impute(const SEXP Filename, const SEXP Rownames, const SEXP Nsnp,
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Class, install("package"), Package);
+   classgets(Result, Class);
+-  SET_S4_OBJECT(Result);
+  Rf_asS4(Result, TRUE, 0);
+   UNPROTECT(2);
+ 
+   char buffer[BUFFERSIZE];
+diff --git a/src/readped.c b/src/readped.c
+index 4e8563e..020d05f 100644
+--- a/src/readped.c
+++ b/src/readped.c
+@@ -327,7 +327,7 @@ SEXP readped(SEXP filename, SEXP snp_names, SEXP missing, SEXP X, SEXP sep) {
+   else
+     SET_STRING_ELT(SMClass, 0, mkChar("SnpMatrix"));
+   classgets(Smat, SMClass);
+-  SET_S4_OBJECT(Smat);
+  Rf_asS4(Smat, TRUE, 0);
+   PROTECT(DimNames = allocVector(VECSXP, 2));
+   SET_VECTOR_ELT(DimNames, 0, duplicate(Rnames));
+   protected += 2;
+diff --git a/src/single_snp_tests.c b/src/single_snp_tests.c
+index a242e17..08bd098 100644
+--- a/src/single_snp_tests.c
+++ b/src/single_snp_tests.c
+@@ -53,8 +53,8 @@ SEXP score_single(const SEXP Phenotype, const SEXP Stratum, const SEXP Snps,
+   /* SNPs ---- should be a SnpMatrix or an XSnpMatrix */
+ 
+   const char *classS = NULL;
+-  if (TYPEOF(R_data_class(Snps, FALSE)) == STRSXP) {
+-    classS = CHAR(STRING_ELT(R_data_class(Snps, FALSE), 0));
+  if (TYPEOF(R_class(Snps)) == STRSXP) {
+    classS = CHAR(STRING_ELT(R_class(Snps), 0));
+   } else {
+     classS = CHAR(STRING_ELT(getAttrib(Snps, R_ClassSymbol), 0));
+   }
+@@ -108,8 +108,8 @@ SEXP score_single(const SEXP Phenotype, const SEXP Stratum, const SEXP Snps,
+   index_db name_index;
+   if (!isNull(Rules)) {
+     const char *classR = NULL;
+-    if (TYPEOF(R_data_class(Rules, FALSE)) == STRSXP) {
+-      classR = CHAR(STRING_ELT(R_data_class(Rules, FALSE), 0));
+    if (TYPEOF(R_class(Rules)) == STRSXP) {
+      classR = CHAR(STRING_ELT(R_class(Rules), 0));
+     } else {
+       classR = CHAR(STRING_ELT(getAttrib(Rules, R_ClassSymbol), 0));
+     }
+diff --git a/src/snp_summary.c b/src/snp_summary.c
+index 9b53693..6f181c9 100644
+--- a/src/snp_summary.c
+++ b/src/snp_summary.c
+@@ -47,8 +47,8 @@ SEXP X_snp_summary(const SEXP Snps, const SEXP Rules, const SEXP Uncertain) {
+   SEXP ruleNames = R_NilValue;
+   if (!isNull(Rules)) {
+     const char *classR = NULL;
+-    if (TYPEOF(R_data_class(Rules, FALSE)) == STRSXP) {
+-      classR = CHAR(STRING_ELT(R_data_class(Rules, FALSE), 0));
+    if (TYPEOF(R_class(Rules)) == STRSXP) {
+      classR = CHAR(STRING_ELT(R_class(Rules), 0));
+     } else {
+       classR = CHAR(STRING_ELT(getAttrib(Rules, R_ClassSymbol), 0));
+     }
+@@ -321,8 +321,8 @@ SEXP snp_summary(const SEXP Snps, const SEXP Rules, const SEXP Uncertain) {
+   SEXP ruleNames = R_NilValue;
+   if (!isNull(Rules)) {
+     const char *classR = NULL;
+-    if (TYPEOF(R_data_class(Rules, FALSE)) == STRSXP) {
+-      classR = CHAR(STRING_ELT(R_data_class(Rules, FALSE), 0));
+    if (TYPEOF(R_class(Rules)) == STRSXP) {
+      classR = CHAR(STRING_ELT(R_class(Rules), 0));
+     } else {
+       classR = CHAR(STRING_ELT(getAttrib(Rules, R_ClassSymbol), 0));
+     }
+diff --git a/src/snpmpy.c b/src/snpmpy.c
+index 2447048..56b84d9 100644
+--- a/src/snpmpy.c
+++ b/src/snpmpy.c
+@@ -34,7 +34,7 @@ SEXP snp_pre(const SEXP Snps, const SEXP Mat, const SEXP Frequency,
+   int *ifdiploid = NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
+    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP diploid = R_do_slot(Snps, mkString("diploid"));
+@@ -55,7 +55,7 @@ SEXP snp_pre(const SEXP Snps, const SEXP Mat, const SEXP Frequency,
+ 
+   cl = GET_CLASS(Mat);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Mat, FALSE); /* S4 way of getting class attribute */
+    cl = R_class(Mat); /* S4 way of getting class attribute */
+   }
+   if (strcmp(CHAR(STRING_ELT(cl, 0)), "matrix"))
+     error("Argument error - Mat wrong type");
+@@ -161,7 +161,7 @@ SEXP snp_post(const SEXP Snps, const SEXP Mat, const SEXP Frequency,
+   int *ifdiploid = NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
+    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP diploid = R_do_slot(Snps, mkString("diploid"));
+@@ -182,7 +182,7 @@ SEXP snp_post(const SEXP Snps, const SEXP Mat, const SEXP Frequency,
+ 
+   cl = GET_CLASS(Mat);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Mat, FALSE); /* S4 way of getting class attribute */
+    cl = R_class(Mat); /* S4 way of getting class attribute */
+   }
+   if (strcmp(CHAR(STRING_ELT(cl, 0)), "matrix"))
+     error("Argument error - Mat wrong type");
+diff --git a/src/structure.c b/src/structure.c
+index 2a05635..1f9b62e 100644
+--- a/src/structure.c
+++ b/src/structure.c
+@@ -66,7 +66,7 @@ SEXP xxt(const SEXP Snps, const SEXP Strata, const SEXP Correct_for_missing,
+   int *ifDiploid = NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
+    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP Diploid = R_do_slot(Snps, mkString("diploid"));
+@@ -409,7 +409,7 @@ SEXP ibs_count(const SEXP Snps, const SEXP Uncertain) {
+   int *ifDiploid = NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
+    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP Diploid = R_do_slot(Snps, mkString("diploid"));
+diff --git a/src/subset.c b/src/subset.c
+index cc7992d..4c2e2c4 100644
+--- a/src/subset.c
+++ b/src/subset.c
+@@ -55,7 +55,7 @@ SEXP subset(SEXP X, SEXP Rows, SEXP Cols) {
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Rclass, install("package"), Package);
+   setAttrib(Result, R_ClassSymbol, Rclass);
+-  SET_S4_OBJECT(Result);
+  Rf_asS4(Result, TRUE, 0);
+   PROTECT(Rdim = allocVector(INTSXP, 2));
+   int *rdim = INTEGER(Rdim);
+   rdim[0] = nrows;
+diff --git a/src/switch.c b/src/switch.c
+index 60f7e6c..e2a3287 100644
+--- a/src/switch.c
+++ b/src/switch.c
+@@ -16,7 +16,7 @@ SEXP test_switch(const SEXP Snps, const SEXP Snps2, const SEXP Split,
+   int *female = NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
+    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   SEXP diploid = NULL;
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+diff --git a/src/tdt.c b/src/tdt.c
+index cece0d9..000d1c7 100644
+--- a/src/tdt.c
+++ b/src/tdt.c
+@@ -43,8 +43,8 @@ SEXP score_tdt(const SEXP Proband, const SEXP Father, const SEXP Mother,
+   /* SNPs ---- should be a SnpMatrix or an XSnpMatrix */
+ 
+   const char *classS = NULL;
+-  if (TYPEOF(R_data_class(Snps, FALSE)) == STRSXP) {
+-    classS = CHAR(STRING_ELT(R_data_class(Snps, FALSE), 0));
+  if (TYPEOF(R_class(Snps)) == STRSXP) {
+    classS = CHAR(STRING_ELT(R_class(Snps), 0));
+   } else {
+     classS = CHAR(STRING_ELT(getAttrib(Snps, R_ClassSymbol), 0));
+   }
+@@ -84,8 +84,8 @@ SEXP score_tdt(const SEXP Proband, const SEXP Father, const SEXP Mother,
+   GTYPE **gt2ht = NULL;
+   if (!isNull(Rules)) {
+     const char *classR = NULL;
+-    if (TYPEOF(R_data_class(Rules, FALSE)) == STRSXP) {
+-      classR = CHAR(STRING_ELT(R_data_class(Rules, FALSE), 0));
+    if (TYPEOF(R_class(Rules)) == STRSXP) {
+      classR = CHAR(STRING_ELT(R_class(Rules), 0));
+     } else {
+       classR = CHAR(STRING_ELT(getAttrib(Rules, R_ClassSymbol), 0));
+     }
+diff --git a/src/testBig.c b/src/testBig.c
+index a6eb76f..3dca1da 100644
+--- a/src/testBig.c
+++ b/src/testBig.c
+@@ -18,7 +18,7 @@ SEXP snp_big(SEXP nrow, SEXP ncol) {
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Class, install("package"), Package);
+   classgets(Result, Class);
+-  SET_S4_OBJECT(Result);
+  Rf_asS4(Result, TRUE, 0);
+ 
+   PROTECT(Dnames = allocVector(VECSXP, 2));
+   setAttrib(Result, R_DimNamesSymbol, Dnames);
+-- 
+2.52.0
+
@@ -0,0 +1,149 @@
+From a505297e347aa72510ecfc83e7009668693e1260 Mon Sep 17 00:00:00 2001
+From: vjcitn <stvjc@channing.harvard.edu>
+Date: Fri, 13 Mar 2026 04:06:37 -0400
+Subject: [PATCH 2/2] fixed IS_S4_OBJECT
+
+---
+ src/bind.c             | 4 ++--
+ src/fst.c              | 2 +-
+ src/glm_test_R.c       | 8 ++++----
+ src/single_snp_tests.c | 2 +-
+ src/snp_summary.c      | 6 +++---
+ src/tdt.c              | 2 +-
+ 6 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/src/bind.c b/src/bind.c
+index fa87e7c..b3ef928 100644
+--- a/src/bind.c
+++ b/src/bind.c
+@@ -22,7 +22,7 @@ SEXP snp_rbind(SEXP args) {
+       Class = R_class(This);
+     }
+     const char *cli = CHAR(STRING_ELT(Class, 0));
+-    if(!IS_S4_OBJECT(This)) {
+    if(!Rf_isS4(This)) {
+       warning("rbinding SnpMatrix object without S4 object bit");
+     }
+     int nci = ncols(This);
+@@ -151,7 +151,7 @@ SEXP snp_cbind(SEXP args) {
+       Class = R_class(This);
+     }
+     const char *cli = CHAR(STRING_ELT(Class, 0));
+-    if(!IS_S4_OBJECT(This)) {
+    if(!Rf_isS4(This)) {
+       warning("cbinding SnpMatrix object without S4 object bit");
+     }
+     SEXP Di = R_NilValue;
+diff --git a/src/fst.c b/src/fst.c
+index bbc39c0..5451a51 100644
+--- a/src/fst.c
+++ b/src/fst.c
+@@ -23,7 +23,7 @@ SEXP Fst(SEXP Snps, SEXP Group, SEXP HapMap) {
+     ifX = 0; /* to avoid warning message */
+     error("Argument error - class(Snps)");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
+  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+ 
+diff --git a/src/glm_test_R.c b/src/glm_test_R.c
+index dc8ebef..fe9d9c8 100644
+--- a/src/glm_test_R.c
+++ b/src/glm_test_R.c
+@@ -24,7 +24,7 @@ SEXP snp_lhs_score(const SEXP Y, const SEXP X, const SEXP Stratum,
+   } else {
+     classY = CHAR(STRING_ELT(getAttrib(Y, R_ClassSymbol), 0));
+   }
+-  if(!IS_S4_OBJECT(Y)) {
+  if(!Rf_isS4(Y)) {
+     error("Y in snp_lhs_score is missing S4 Object bit");
+   }
+   int ifX = 0;
+@@ -443,7 +443,7 @@ SEXP snp_rhs_score(SEXP Y, SEXP family, SEXP link,
+     ifX = 1;
+   else 
+     error("Argument error - class(Z)");
+-  if (!IS_S4_OBJECT(Z)) {
+  if (!Rf_isS4(Z)) {
+     error("Z in snp_rhs_score is missing S4 Object bit");
+   }
+  
+@@ -1008,7 +1008,7 @@ SEXP snp_lhs_estimate(const SEXP Y, const SEXP X, const SEXP Stratum,
+   } else {
+     classY = CHAR(STRING_ELT(getAttrib(Y, R_ClassSymbol), 0));
+   }
+-  if(!IS_S4_OBJECT(Y)) {
+  if(!Rf_isS4(Y)) {
+     error("Y in snp_lhs_score is missing S4 Object bit");
+   }
+   int ifX = 0;
+@@ -1365,7 +1365,7 @@ SEXP snp_rhs_estimate(SEXP Y, SEXP family, SEXP link,
+   } else {
+     classZ = CHAR(STRING_ELT(getAttrib(Z, R_ClassSymbol), 0));
+   }
+-  if(!IS_S4_OBJECT(Z)) {
+  if(!Rf_isS4(Z)) {
+     error("Z in snp_rhs_score is missing S4 Object bit");
+   }
+   int ifX = 0;
+diff --git a/src/single_snp_tests.c b/src/single_snp_tests.c
+index 08bd098..b577300 100644
+--- a/src/single_snp_tests.c
+++ b/src/single_snp_tests.c
+@@ -67,7 +67,7 @@ SEXP score_single(const SEXP Phenotype, const SEXP Stratum, const SEXP Snps,
+     ifX = 0; /* to avoid warning message */
+     error("Argument error - class(Snps)");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
+  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+ 
+diff --git a/src/snp_summary.c b/src/snp_summary.c
+index 6f181c9..c2f1c73 100644
+--- a/src/snp_summary.c
+++ b/src/snp_summary.c
+@@ -24,7 +24,7 @@ SEXP X_snp_summary(const SEXP Snps, const SEXP Rules, const SEXP Uncertain) {
+   if (Snps == R_NilValue) {
+     error("Argument error - Snps = NULL");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
+  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+   const unsigned char *snps = RAW(Snps);
+@@ -298,7 +298,7 @@ SEXP snp_summary(const SEXP Snps, const SEXP Rules, const SEXP Uncertain) {
+   if (Snps == R_NilValue) {
+     error("Argument error - Snps = NULL");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
+  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+   const unsigned char *snps = RAW(Snps);
+@@ -538,7 +538,7 @@ SEXP row_summary(const SEXP Snps) {
+   if (Snps == R_NilValue) {
+     error("Argument error - Snps = NULL");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
+  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+   const unsigned char *snps = RAW(Snps);
+diff --git a/src/tdt.c b/src/tdt.c
+index 000d1c7..634e1b3 100644
+--- a/src/tdt.c
+++ b/src/tdt.c
+@@ -57,7 +57,7 @@ SEXP score_tdt(const SEXP Proband, const SEXP Father, const SEXP Mother,
+     ifX = 0; /* to avoid warning message */
+     error("Argument error - class(Snps)");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
+  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+ 
+-- 
+2.52.0
+
@@ -0,0 +1,259 @@
+From 633aa6e3f671e9b58b3508b3944ff0dd45f34f8a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Thu, 5 Mar 2026 14:58:23 -0800
+Subject: [PATCH] SparseArray 1.11.11: Get rid of non-API calls to R
+
+From 65383c02f986832b1416c6ad39da800d8ced05df Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Tue, 31 Mar 2026 11:38:20 -0700
+Subject: [PATCH] SparseArray 1.11.13: Use R_getVar() instead of findVar() when
+ R >= 4.6.0
+
+---
+ DESCRIPTION                     |  2 +-
+ src/Makevars                    |  1 +
+ src/Rvector_utils.c             | 15 ++++++++-------
+ src/SparseArray_aperm.c         |  2 +-
+ src/SparseArray_matrixStats.c   |  5 +++--
+ src/SparseArray_subassignment.c |  6 +++---
+ src/SparseVec.h                 |  3 ++-
+ src/leaf_utils.c                |  5 +++--
+ src/test.c                      |  3 +++
+ 9 files changed, 25 insertions(+), 17 deletions(-)
+
+diff --git a/src/Makevars b/src/Makevars
+index 0ee3615..1c5b86e 100644
+--- a/src/Makevars
+++ b/src/Makevars
+@@ -1,2 +1,3 @@
+## See https://cran.r-project.org/doc/manuals/r-release/R-exts.html#OpenMP-support
+ PKG_CFLAGS = $(SHLIB_OPENMP_CFLAGS)
+ PKG_LIBS = $(SHLIB_OPENMP_CFLAGS)
+diff --git a/src/Rvector_utils.c b/src/Rvector_utils.c
+index ad80168..7e61ac1 100644
+--- a/src/Rvector_utils.c
+++ b/src/Rvector_utils.c
+@@ -4,6 +4,7 @@
+  ****************************************************************************/
+ #include "Rvector_utils.h"
+ 
+#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <string.h>  /* for memset() and memcpy() */
+ 
+ 
+@@ -242,7 +243,7 @@ void _fill_Rvector_block_with_val(SEXP Rvector,
+ 				     (const SEXP) val);
+ 		return;
+ 	}
+-	_set_elts_to_val(TYPEOF(Rvector), DATAPTR(Rvector),
+	_set_elts_to_val(TYPEOF(Rvector), DATAPTR_RW(Rvector),
+ 			 block_offset, block_len, val);
+ }
+ 
+@@ -260,7 +261,7 @@ void _fill_Rvector_block_with_zeros(SEXP Rvector,
+ 				     R_NilValue);
+ 		return;
+ 	}
+-	_set_elts_to_zero(Rtype, DATAPTR(Rvector), block_offset, block_len);
+	_set_elts_to_zero(Rtype, DATAPTR_RW(Rvector), block_offset, block_len);
+ 	return;
+ }
+ 
+@@ -268,7 +269,7 @@ void _fill_Rvector_block_with_zeros(SEXP Rvector,
+ void _fill_Rvector_block_with_ones(SEXP Rvector,
+ 		R_xlen_t block_offset, R_xlen_t block_len)
+ {
+-	_set_elts_to_one(TYPEOF(Rvector), DATAPTR(Rvector),
+	_set_elts_to_one(TYPEOF(Rvector), DATAPTR_RW(Rvector),
+ 			 block_offset, block_len);
+ 	return;
+ }
+@@ -277,7 +278,7 @@ void _fill_Rvector_block_with_ones(SEXP Rvector,
+ void _fill_Rvector_block_with_minus_one(SEXP Rvector,
+ 		R_xlen_t block_offset, R_xlen_t block_len)
+ {
+-	_set_elts_to_minus_one(TYPEOF(Rvector), DATAPTR(Rvector),
+	_set_elts_to_minus_one(TYPEOF(Rvector), DATAPTR_RW(Rvector),
+ 			 block_offset, block_len);
+ 	return;
+ }
+@@ -293,7 +294,7 @@ void _fill_Rvector_block_with_NA(SEXP Rvector,
+ 					  NA_STRING);
+ 		return;
+ 	}
+-	_set_elts_to_NA(Rtype, DATAPTR(Rvector), block_offset, block_len);
+	_set_elts_to_NA(Rtype, DATAPTR_RW(Rvector), block_offset, block_len);
+ 	return;
+ }
+ 
+@@ -460,7 +461,7 @@ void _fill_Rvector_subset_with_zeros(SEXP Rvector,
+ 				R_NilValue);
+ 		return;
+ 	}
+-	_set_selected_elts_to_zero(Rtype, DATAPTR(Rvector),
+	_set_selected_elts_to_zero(Rtype, DATAPTR_RW(Rvector),
+ 				selection, selection_len, selection_offset);
+ 	return;
+ }
+@@ -470,7 +471,7 @@ void _fill_Rvector_subset_with_ones(SEXP Rvector,
+ 		const int *selection, int selection_len,
+ 		R_xlen_t selection_offset)
+ {
+-	_set_selected_elts_to_one(TYPEOF(Rvector), DATAPTR(Rvector),
+	_set_selected_elts_to_one(TYPEOF(Rvector), DATAPTR_RW(Rvector),
+ 				  selection, selection_len, selection_offset);
+ 	return;
+ }
+diff --git a/src/SparseArray_aperm.c b/src/SparseArray_aperm.c
+index 0bd092e..bbeaf2c 100644
+--- a/src/SparseArray_aperm.c
+++ b/src/SparseArray_aperm.c
+@@ -721,7 +721,7 @@ static SEXP REC_grow_output_tree(const int *dim, int ndim,
+ 	const type *nzvals_p = NULL;  /* -Wmaybe-uninitialized */	\
+ 	type v;								\
+ 	if (nzvals != R_NilValue) {  /* standard leaf */		\
+-		nzvals_p = (const type *) DATAPTR(nzvals);		\
+		nzvals_p = DATAPTR_RO(nzvals);				\
+ 	} else {  /* lacunar leaf */					\
+ 		v = type ## 1;						\
+ 	}								\
+diff --git a/src/SparseArray_matrixStats.c b/src/SparseArray_matrixStats.c
+index b626553..debacf6 100644
+--- a/src/SparseArray_matrixStats.c
+++ b/src/SparseArray_matrixStats.c
+@@ -16,6 +16,7 @@
+ #include "leaf_utils.h"
+ #include "SparseArray_summarization.h"
+ 
+#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <string.h>  /* for memcpy() and memset() */
+ 
+ 
+@@ -272,7 +273,7 @@ SEXP C_colStats_SVT(SEXP x_dim, SEXP x_dimnames, SEXP x_type,
+ 	int warn = 0;
+ 	REC_colStats_SVT(x_SVT, x_bg_is_na, INTEGER(x_dim), LENGTH(x_dim),
+ 			 &summarize_op,
+-			 DATAPTR(ans), ans_Rtype,
+			 DATAPTR_RW(ans), ans_Rtype,
+ 			 out_incs, ans_ndim, pardim,
+ 			 &warn);
+ 	if (warn)
+@@ -1175,7 +1176,7 @@ SEXP C_rowStats_SVT(SEXP x_dim, SEXP x_dimnames, SEXP x_type,
+ 		SVT_rowMinsMaxs(x_SVT, x_Rtype, x_bg_is_na,
+ 			INTEGER(x_dim), LENGTH(x_dim),
+ 			opcode, narm,
+-			DATAPTR(ans), LENGTH(ans), ans_Rtype,
+			DATAPTR_RW(ans), LENGTH(ans), ans_Rtype,
+ 			out_incs, ans_ndim, nstrata);
+ 		break;
+ 	    case SUM_OPCODE:
+diff --git a/src/SparseArray_subassignment.c b/src/SparseArray_subassignment.c
+index 4cf1c3d..c3b2d5e 100644
+--- a/src/SparseArray_subassignment.c
+++ b/src/SparseArray_subassignment.c
+@@ -966,13 +966,13 @@ static inline int next_coords0(NindexIterator *Nindex_iter)
+ 		midx_p++;
+ 		coords0_p++;
+ 	}
+-	printf("coords0: ");
+	//printf("coords0: ");
+ 	coords0_p = Nindex_iter->coords0_buf;
+ 	for (along = Nindex_iter->margin; along < Nindex_iter->ndim; along++) {
+-		printf(" %3d", *coords0_p);
+		//printf(" %3d", *coords0_p);
+ 		coords0_p++;
+ 	}
+-	printf("\n");
+	//printf("\n");
+ 	return 1;
+ }
+ 
+diff --git a/src/SparseVec.h b/src/SparseVec.h
+index 894709b..73cd841 100644
+--- a/src/SparseVec.h
+++ b/src/SparseVec.h
+@@ -5,6 +5,7 @@
+ 
+ #include "Rvector_utils.h"
+ 
+#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <limits.h>  /* for INT_MAX */
+ 
+ 
+@@ -122,7 +123,7 @@ static inline SparseVec toSparseVec(SEXP nzvals, SEXP nzoffs,
+ 		if (IS_STRSXP_OR_VECSXP(Rtype)) {
+ 			sv.nzvals = nzvals;
+ 		} else {
+-			sv.nzvals = DATAPTR(nzvals);
+			sv.nzvals = DATAPTR_RW(nzvals);
+ 		}
+ 	}
+ 	sv.nzoffs = INTEGER(nzoffs);
+diff --git a/src/leaf_utils.c b/src/leaf_utils.c
+index e8066c3..c5ff3aa 100644
+--- a/src/leaf_utils.c
+++ b/src/leaf_utils.c
+@@ -10,6 +10,7 @@
+ #include "SparseVec_subsetting.h"
+ #include "SparseVec_subassignment.h"
+ 
+#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <string.h>  /* for memcpy() */
+ 
+ 
+@@ -129,7 +130,7 @@ SEXP _make_leaf_from_two_arrays(SEXPTYPE Rtype,
+ 			return ans;
+ 		}
+ 		ans_nzvals = PROTECT(allocVector(Rtype, nzcount));
+-		memcpy(DATAPTR(ans_nzvals), nzvals_p, Rtype_size * nzcount);
+		memcpy(DATAPTR_RW(ans_nzvals), nzvals_p, Rtype_size * nzcount);
+ 	}
+ 	SEXP ans = zip_leaf(ans_nzvals, ans_nzoffs, 0);
+ 	UNPROTECT(2);
+@@ -156,7 +157,7 @@ static SEXP make_leaf_from_Rvector_subset(SEXP Rvector,
+ 
+ 	if (avoid_copy_if_all_selected &&
+ 	    selection_offset == 0 && selection_len == XLENGTH(Rvector) &&
+-	    ATTRIB(Rvector) == R_NilValue)
+	    !ANY_ATTRIB(Rvector))
+ 	{
+ 		/* The full 'Rvector' is selected so can be reused as-is
+ 		   with no need to copy the selected elements to a new SEXP. */
+diff --git a/src/test.c b/src/test.c
+index 493538f..2205fa2 100644
+--- a/src/test.c
+++ b/src/test.c
+@@ -111,6 +111,9 @@ SEXP C_simple_omp_parallel_for_loop(SEXP nloop)
+ 	for (int i = 0; i < INTEGER(nloop)[0]; i++) {
+ #ifdef _OPENMP
+ 		int thread_num = omp_get_thread_num();
+		/* Can't use Rprintf() here because it's not thread-safe (it
+		   can trigger R's garbage collector which itself is not
+		   thread-safe). */
+ 		printf("thread_num = %d\n", thread_num);
+ #endif
+ 	}
+diff --git a/src/readSparseCSV.c b/src/readSparseCSV.c
+index a3d8da0..de1cb95 100644
+--- a/src/readSparseCSV.c
+++ b/src/readSparseCSV.c
+@@ -11,6 +11,7 @@
+ #include "ExtendableJaggedArray.h"
+ 
+ #include <R_ext/Connections.h>
+#include <Rversion.h>
+ 
+ #include <string.h>  /* for memcpy() */
+ 
+@@ -111,7 +112,11 @@ static SEXP dump_env_as_list_or_R_NilValue(SEXP env, int ans_len)
+ 	is_empty = 1;
+ 	for (i = 0; i < ans_len; i++) {
+ 		key = PROTECT(idx0_to_key(i));
+#if R_VERSION < R_Version(4, 6, 0)
+ 		ans_elt = findVar(install(translateChar(key)), env);
+#else
+		ans_elt = R_getVar(install(translateChar(key)), env, FALSE);
+#endif
+ 		UNPROTECT(1);
+ 		if (ans_elt == R_UnboundValue)
+ 			continue;
@@ -0,0 +1,25 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-04-26
+License: ASL2.0
+Subject: Stub CodeModeTurnHost::invoke_tool signature uses ToolName.
+
+In codex 0.117 the upstream trait took `tool_name: String`, so the
+disable-code-mode patch's `cfg(not(feature = "v8-runtime"))` stub used
+String to match.  In codex 0.124 the upstream trait takes
+`codex_protocol::ToolName`, and core/src/tools/code_mode/mod.rs's impl
+of CodeModeTurnHost passes `ToolName`, so the stub must match the new
+signature here too.  This patch is applied only to codex 0.124+ on top
+of the shared disable-code-mode patch; codex-acp (which still pins
+rust-v0.117.0 where code-mode has no codex-protocol dep) keeps the
+String-based stub.
+
+--- a/codex-rs/code-mode/src/lib.rs
+++ b/codex-rs/code-mode/src/lib.rs
+@@ -77,7 +77,7 @@
+ #[cfg(not(feature = "v8-runtime"))]
+ #[async_trait::async_trait]
+ pub trait CodeModeTurnHost: Send + Sync {
+-    async fn invoke_tool(&self, tool_name: String, input: Option<serde_json::Value>, cancellation_token: tokio_util::sync::CancellationToken) -> Result<serde_json::Value, String>;
+    async fn invoke_tool(&self, tool_name: codex_protocol::ToolName, input: Option<serde_json::Value>, cancellation_token: tokio_util::sync::CancellationToken) -> Result<serde_json::Value, String>;
+     async fn notify(&self, call_id: String, cell_id: String, text: String) -> Result<(), String>;
+ }
@@ -0,0 +1,29 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-04-23
+License: ASL2.0
+Subject: Remove [patch.crates-io] and [patch.'ssh://...'] sections.
+
+The [patch] sections point to git repositories which are unavailable
+in an offline build.  The vendored crossterm, ratatui,
+tokio-tungstenite and tungstenite forks are provided as cargo-inputs
+instead.
+
+--- a/codex-rs/Cargo.toml	2026-04-23 22:49:56.599115735 +0000
+++ b/codex-rs/Cargo.toml	2026-04-23 22:49:56.601899894 +0000
+@@ -470,16 +470,3 @@
+ inherits = "test"
+ opt-level = 0
+ 
+-[patch.crates-io]
+-# Uncomment to debug local changes.
+-# ratatui = { path = "../../ratatui" }
+-crossterm = { git = "https://github.com/nornagon/crossterm", rev = "87db8bfa6dc99427fd3b071681b07fc31c6ce995" }
+-ratatui = { git = "https://github.com/nornagon/ratatui", rev = "9b2ad1298408c45918ee9f8241a6f95498cdbed2" }
+-tokio-tungstenite = { git = "https://github.com/openai-oss-forks/tokio-tungstenite", rev = "132f5b39c862e3a970f731d709608b3e6276d5f6" }
+-tungstenite = { git = "https://github.com/openai-oss-forks/tungstenite-rs", rev = "9200079d3b54a1ff51072e24d81fd354f085156f" }
+-
+-# Uncomment to debug local changes.
+-# rmcp = { path = "../../rust-sdk/crates/rmcp" }
+-
+-[patch."ssh://git@github.com/openai-oss-forks/tungstenite-rs.git"]
+-tungstenite = { git = "https://github.com/openai-oss-forks/tungstenite-rs", rev = "9200079d3b54a1ff51072e24d81fd354f085156f" }
@@ -0,0 +1,61 @@
+adjust from https://sources.debian.org/data/main/r/rust-librocksdb-sys/0.17.1-2/debian/patches/pkgconf
+
+diff -u a/build.rs b/build.rs
+--- a/build.rs
+++ b/build.rs
+@@ -396,8 +396,13 @@
+ }
+ 
+ fn main() {
+    let Ok(rocksdb_lib) = pkg_config::Config::new().atleast_version("10.4.2").probe("rocksdb") else {
+        panic!("guix: rocksdb library not found");
+    };
+    env::set_var("ROCKSDB_INCLUDE_DIR", &rocksdb_lib.include_paths[0]);
+    env::set_var("ROCKSDB_LIB_DIR", &rocksdb_lib.link_paths[0]);
+     if !Path::new("rocksdb/AUTHORS").exists() {
+-        update_submodules();
+        // update_submodules();
+     }
+     bindgen_rocksdb();
+     let target = env::var("TARGET").unwrap();
+@@ -417,14 +422,14 @@
+         }
+ 
+         println!("cargo:rerun-if-changed=rocksdb/");
+-        fail_on_empty_directory("rocksdb");
+        // fail_on_empty_directory("rocksdb");
+         build_rocksdb();
+     }
+-    if cfg!(feature = "snappy") && !try_to_find_and_link_lib("SNAPPY") {
+-        println!("cargo:rerun-if-changed=snappy/");
+-        fail_on_empty_directory("snappy");
+-        build_snappy();
+-    }
+    // if cfg!(feature = "snappy") && !try_to_find_and_link_lib("SNAPPY") {
+    //     println!("cargo:rerun-if-changed=snappy/");
+    //     fail_on_empty_directory("snappy");
+    //     build_snappy();
+    // }
+ 
+     // Allow dependent crates to locate the sources and output directory of
+     // this crate. Notably, this allows a dependent crate to locate the RocksDB
+
+diff -u a/Cargo.toml b/Cargo.toml
+--- a/Cargo.toml
+++ b/Cargo.toml
+@@ -48,7 +48,7 @@
+     "static",
+     "bindgen/runtime",
+ ]
+-io-uring = ["pkg-config"]
+io-uring = []
+ jemalloc = ["tikv-jemalloc-sys"]
+ lto = []
+ lz4 = ["lz4-sys"]
+@@ -115,4 +115,4 @@
+ 
+ [build-dependencies.pkg-config]
+ version = "0.3"
+-optional = true
+
+
@@ -68,14 +68,14 @@
 (define-public php-8.5
  (package
    (name "php")
-    (version "8.5.3")
+    (version "8.5.5")
    (home-page "https://www.php.net/")
    (source
     (origin
       (method url-fetch)
       (uri (string-append home-page "distributions/" "php-" version ".tar.xz"))
       (sha256
-        (base32 "1fbfqc9bggxj73g8drzxmkr122q4hwad4ik0kav5cwzhi9dp4rff"))
+        (base32 "1wh27552f6vd20f1yy4l0jlvknfq0kn5hapmiq55f05xyj1c7glm"))
       (modules '((guix build utils)))
       (snippet
        '(with-directory-excursion "ext"
@@ -90,6 +90,9 @@
    (build-system gnu-build-system)
    (arguments
     (list
+      #:modules
+      `((ice-9 textual-ports)
+        ,@%default-gnu-imported-modules)
      #:configure-flags
      #~(let-syntax ((with (syntax-rules ()
                             ((_ option input)
@@ -330,7 +333,56 @@
              (setenv "TEST_PHP_ARGS"
                      (format #f "-j~a" (if parallel-tests?
                                            (parallel-job-count)
-                                            1))))))
+                                            1)))))
+          (add-after 'unpack 'regenerate-ssl-certs
+            (lambda _
+              ;; The X.509 certificates shipped with PHP have an expiration
+              ;; date, which causes tests to fail after that date.  Generate
+              ;; them to avoid the problem entirely.
+              (define (concat-files result . files)
+                (call-with-output-file result
+                  (lambda (out)
+                    (for-each
+                     (lambda (file)
+                       (put-string out
+                                   (call-with-input-file file
+                                     get-string-all))
+                       (newline out))
+                     files))))
+              (define* (gen-ssl-cert key cert #:optional ca-cert-key ca-cert)
+                (let ((csr (string-append cert ".csr")))
+                  (unless (file-exists? key)
+                    (invoke "openssl" "genrsa" "-out" key "2048"))
+                  (invoke "openssl" "x509" "-x509toreq" "-in" cert "-key" key "-out" csr)
+                  (if ca-cert-key
+                      (begin
+                        (invoke "openssl" "x509"
+                                "-CA" ca-cert
+                                "-CAkey" ca-cert-key
+                                "-req"
+                                "-in" csr
+                                "-days" "+1"
+                                "-CAserial" "serial"
+                                "-CAcreateserial"
+                                "-out" cert))
+                      (invoke "openssl" "x509"
+                              "-req"
+                              "-in" csr
+                              "-signkey" key
+                              "-out" cert
+                              "-days" "30"))))
+              (let ((ca-key "ext/openssl/tests/sni_server_ca.key")
+                    (ca-cert "ext/openssl/tests/sni_server_ca.pem"))
+                (gen-ssl-cert ca-key ca-cert)
+                (for-each
+                 (lambda (suffix)
+                   (let ((key-name (string-append "ext/openssl/tests/sni_server_" suffix "_key.pem"))
+                         (cert-name (string-append "ext/openssl/tests/sni_server_" suffix "_cert.pem"))
+                         (result (string-append "ext/openssl/tests/sni_server_" suffix ".pem")))
+                     (gen-ssl-cert key-name cert-name
+                                   ca-key ca-cert)
+                     (concat-files result key-name cert-name)))
+                 '("cs" "us" "uk"))))))
      #:test-target "test"))
    (inputs
     (list aspell
@@ -392,13 +444,13 @@ systems, web content management systems and web frameworks.")
  (package
    (inherit php-8.5)
    (home-page "https://www.php.net/")
-    (version "8.4.18")
+    (version "8.4.20")
    (source
     (origin
       (method url-fetch)
       (uri (string-append home-page "distributions/" "php-" version ".tar.xz"))
       (sha256
-        (base32 "0401yjrchg6dnq8qdd86qanzmzrv6dscm2671kp6bsd8nhcrnylm"))
+        (base32 "1xr1w82apzsscrsndnphlgqvbj78g0smrp06pcgg8hlsr3vwcm74"))
       (modules '((guix build utils)))
       (snippet
        '(with-directory-excursion "ext"
@@ -237,7 +237,7 @@ it.")
 (define-public trealla
  (package
    (name "trealla")
-    (version "2.94.2")
+    (version "2.94.12")
    (source
     (origin
       (method git-fetch)
@@ -246,7 +246,7 @@ it.")
          (url "https://github.com/trealla-prolog/trealla")
          (commit (string-append "v" version))))
       (sha256
-        (base32 "15pxb1j0gwkbsp3406h0smscv9plm92splnha7gl5gz58am4109p"))
+        (base32 "0mpzpc69agcnp2dnay08z7xjx0zq2b77ddd2kds1w6qlh2fc36s9"))
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (inputs
@@ -167,6 +167,46 @@
  #:use-module (guix utils)
  #:use-module (srfi srfi-1))

+(define-public python-aioboto3
+  (package
+    (name "python-aioboto3")
+    (version "15.5.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/terricain/aioboto3")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "05644x17f9sl8mv9bp8l0rjcmw5x2ssyd5z1v3xmgcspk5qs6qn8"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:tests? #f ;XXX: all tests faild
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'relax-requirements
+            (lambda _
+              (substitute* "pyproject.toml"
+                (("aiobotocore\\[boto3\\]==2.25.1")
+                 "aiobotocore >= 2.25.1")))))))
+    (native-inputs
+     (list python-setuptools
+           python-setuptools-scm))
+    (propagated-inputs
+     (list python-aiobotocore
+           python-aiofiles
+           ;; [optional]
+           python-boto3
+           python-cryptography))
+    (home-page "https://github.com/terricain/aioboto3")
+    (synopsis "Async boto3 wrapper")
+    (description
+     "This package is mostly just a wrapper combining the great work of boto3
+and aiobotocore.")
+    (license license:asl2.0)))
+
 (define-public python-aiocoap
  (package
    (name "python-aiocoap")
@@ -148,7 +148,7 @@ of parts of the Windows API.")
  (package
    (inherit freerdp)
    (name "freerdp")
-    (version "3.20.0")
+    (version "3.25.0")
    (source
     (origin
       (method git-fetch)
@@ -157,11 +157,11 @@ of parts of the Windows API.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1fknj2ysm3nj7kz5k8wvxpny0a7bjbi290z9cs7fwrk3yqv454w4"))))
+        (base32 "1plynfsr0hbp8f1mmshx2ab1c90vhamgirk0cdqwibm8y4kgc63y"))))
    (inputs
     (modify-inputs inputs
       (replace "ffmpeg" ffmpeg)
-       (prepend fuse icu4c mit-krb5 sdl3 sdl3-gfx sdl3-ttf)))
+       (prepend fuse icu4c mit-krb5 sdl3 sdl3-gfx sdl3-ttf v4l-utils)))
    (arguments
     (list #:build-type "Release"
           #:test-exclude "TestFreeRDPCodecInterleaved|TestClientRdpFile"
@@ -175,6 +175,7 @@ of parts of the Windows API.")
              "-DWITH_PULSE=ON"
              "-DWITH_CAIRO=ON"
              "-DWITH_CUPS=ON"
+              "-DCHANNEL_RDPECAM_CLIENT=ON" ;webcam support
              "-DBUILD_TESTING=ON"
              "-DWITH_SERVER=ON" ;build servers
              "-DWITH_SHADOW=ON" ;build shadow server
@@ -346,7 +346,7 @@ a focus on simplicity and productivity.")
    (home-page "https://www.ruby-lang.org")
    (license license:ruby)))

-(define-public ruby ruby-3.4)
+(define-public ruby ruby-3.3)

 (define-public mruby
  (package
@@ -51,6 +51,7 @@
 ;;; Copyright © 2026 Luis Guilherme Coelho <lgcoelho@disroot.org>
 ;;; Copyright © 2026 Sughosha <sughosha@disroot.org>
 ;;; Copyright © 2026 Ashish SHUKLA <ashish.is@lostca.se>
+;;; Copyright © 2026 Daniel Martins <email@danielfm.me>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -111,6 +112,7 @@
  #:use-module (gnu packages linux)
  #:use-module (gnu packages llvm)
  #:use-module (gnu packages libffi)
+  #:use-module (gnu packages lua)
  #:use-module (gnu packages ncurses)
  #:use-module (gnu packages networking)
  #:use-module (gnu packages ninja)
@@ -585,6 +587,55 @@ the palette can be injected into.")
 audit @file{Cargo.lock} for crates with security vulnerabilities.")
    (license (list license:asl2.0 license:expat))))

+(define-public cargo-auditable
+  (package
+    (name "cargo-auditable")
+    (version "0.7.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/rust-secure-code/cargo-auditable")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1z1bi1mx4db44mlsda4pfr25sk4r5jjq02wqmvn9vdlvmfllkgdd"))))
+    (build-system cargo-build-system)
+    (arguments
+     (list
+      #:install-source? #f
+      #:cargo-install-paths ''("cargo-auditable")
+      #:cargo-test-flags
+      '(list "--"
+             ;; error: output of --print=file-names missing
+             "--skip=test_wasm")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'remove-cargo.lock
+            (lambda _
+              (for-each delete-file
+                        (find-files "." "Cargo\\.lock"))))
+          (add-after 'install 'install-manpage
+            (lambda _
+              (install-file "cargo-auditable/cargo-auditable.1"
+                            (string-append #$output "/share/man/man1/")))))))
+    (inputs (cargo-inputs 'cargo-auditable))
+    (home-page "https://github.com/rust-secure-code/cargo-auditable")
+    (synopsis "Make production Rust binaries auditable")
+    (description
+     "Know the exact crate versions used to build your Rust executable.  Audit
+binaries for known bugs or security vulnerabilities in production, at scale,
+with zero bookkeeping.
+
+This works by embedding data about the dependency tree in JSON format into a
+dedicated linker section of the compiled executable.
+
+The end goal is to get Cargo itself to encode this information in binaries.
+There is an RFC for an implementation within Cargo, for which this project paves
+the way: @url{https://github.com/rust-lang/rfcs/pull/2801,
+rust-lang/rfcs#2801}.")
+    (license (list license:expat license:asl2.0))))
+
 (define-public cargo-bloat
  (package
    (name "cargo-bloat")
@@ -2413,6 +2464,77 @@ specified image or color, easing the process of theme creation.")
 GitHub-like look.")
    (license license:gpl3+)))

+(define-public mise
+  (package
+    (name "mise")
+    (version "2026.4.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/jdx/mise")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1298fxd1hx0y86xpmrmbi6ps9bvp81b4r4cgyvgqzfzicn616l2j"))
+       (snippet
+        #~(begin (use-modules (guix build utils))
+                 (for-each delete-file-recursively
+                           '("crates/vfox/test/data"
+                             "docs"))
+                 ;; Don't try to vendor lua.
+                 (substitute* "crates/vfox/Cargo.toml"
+                   (("\"vendored-lua\", ") "")
+                   (("^vendored-lua.*") "vendored-lua = []\n"))))))
+    (build-system cargo-build-system)
+    (arguments
+     (list #:install-source? #f
+           #:cargo-install-paths ''(".")
+           #:parallel-tests? #f
+           ;; test_last_modified fails in the build sandbox because file
+           ;; timestamps are normalized.
+           #:cargo-test-flags ''("--" "--skip" "test_last_modified")
+           #:modules '((guix build cargo-build-system)
+                       (guix build utils)
+                       (ice-9 match))
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-after 'install 'install-completions
+                 (lambda* (#:key native-inputs #:allow-other-keys)
+                   (let ((binary
+                          (if #$(%current-target-system)
+                              (search-input-file native-inputs "bin/mise")
+                              (in-vicinity #$output "bin/mise"))))
+                     (for-each
+                      (match-lambda
+                        ((args . path)
+                         (mkdir-p (in-vicinity #$output (dirname path)))
+                         (with-output-to-file (in-vicinity #$output path)
+                           (lambda _
+                             (apply invoke binary "completion" args)))))
+                      ;; Bash completions need --include-bash-completion-lib
+                      ;; to bundle the compatibility functions they rely on.
+                      '((("bash" "--include-bash-completion-lib")
+                         . "share/bash-completion/completions/mise")
+                        (("fish")
+                         . "share/fish/vendor_completions.d/mise.fish")
+                        (("zsh")
+                         . "share/zsh/site-functions/_mise")))))))))
+    (native-inputs
+     (append (if (%current-target-system)
+                 (list this-package)
+                 '())
+             (list pkg-config)))
+    (inputs (cons* lua-5.1 openssl `(,zstd "lib") (cargo-inputs 'mise)))
+    (home-page "https://mise.jdx.dev")
+    (synopsis "Polyglot version manager, task runner, and environment manager")
+    (description "Mise manages dev tool versions (e.g., Node.js, Python, Ruby,
+Go) allowing you to switch between versions per project.  It also serves as a
+task runner and manages environment variables through @file{.mise.toml}
+configuration files.  It is compatible with asdf plugins and supports
+@file{.tool-versions} files.")
+    (license license:expat)))
+
 (define-public mitm-cache
  (package
    (name "mitm-cache")
@@ -3799,14 +3921,14 @@ PNG and JPEG) into vector graphics (SVG).")
 (define-public watchexec
  (package
    (name "watchexec")
-    (version "2.3.2")
+    (version "2.5.1")
    (source
     (origin
       (method url-fetch)
       (uri (crate-uri "watchexec-cli" version))
       (file-name (string-append name "-" version ".tar.gz"))
       (sha256
-        (base32 "04qm50br5swck9sqvl9qhaa7cfh6z2y12ipj9729biczmzaw1avx"))))
+        (base32 "1p74v8m23ykvxyjgzz675vahpkwjjgbkqq9wfh0wap0aya22d5qz"))))
    (build-system cargo-build-system)
    (arguments
     `(#:install-source? #f
@@ -4664,15 +4786,15 @@ policies, and so on.
 (define-public radicle
  (package
    (name "radicle")
-    (version "1.7.1")
+    (version "1.8.0")
    (source
     (origin
       (method url-fetch/tarbomb)
       (uri (string-append
-             "https://files.radicle.xyz/releases/"
+             "https://files.radicle.dev/releases/"
             version "/heartwood-" version ".tar.gz"))
       (sha256
-        (base32 "1a2iv0whkfhsmkigam296mid9ikyjinlqs7di4jcqqh88yg22qrj"))
+        (base32 "15w0jijwfbvrfwpn89qbcf2mlxnjyhrcjhjymjgwdqcswpz89pn1"))
       (modules '((guix build utils)))
       (snippet
        '(begin
@@ -4722,7 +4844,7 @@ policies, and so on.
            ;; for test
            git-minimal/pinned)))
    (inputs (cons* libgit2-1.9 sqlite-next (cargo-inputs 'radicle)))
-    (home-page "https://radicle.xyz/")
+    (home-page "https://radicle.dev/")
    (synopsis "Peer-to-peer code collaboration stack")
    (description
     "Radicle is a peer-to-peer code collaboration stack built on Git.  Unlike
@@ -331,6 +331,39 @@ transliterating them.  It supports Emoji and Chinese.")
     (description "@code{hypher} is a Rust library for syllabification.")
     (license (list license:expat license:asl2.0)))))

+(define-public rust-opentelemetry-for-stalwart
+  (let ((commit "274b4d324794280ce6f4def095a3428197a9e6e3")
+        (revision "0"))
+    (hidden-package
+     (package
+       (name "rust-opentelemetry")
+       (version (git-version "0.31.0" revision commit))
+       (source
+        (origin
+          (method git-fetch)
+          (uri (git-reference
+                 (url "https://github.com/stalwartlabs/opentelemetry-rust")
+                 (commit commit)))
+          (file-name (git-file-name name version))
+          (sha256
+           (base32 "1k6mkvzbznnjzf38rl5xvzvdgp9kvd1xyk0zykwjzmh1hzcfgpws"))))
+       (build-system cargo-build-system)
+       (arguments (list #:skip-build? #t
+                        #:cargo-package-crates
+                        ''("opentelemetry"
+                           "opentelemetry-http"
+                           "opentelemetry_sdk"
+                           "opentelemetry-proto"
+                           "opentelemetry-otlp"
+                           "opentelemetry-jaeger-propagator"
+                           "opentelemetry-semantic-conventions")))
+
+       (inputs (cargo-inputs 'rust-opentelemetry-for-stalwart))
+       (home-page "https://github.com/stalwartlabs/opentelemetry-rust")
+       (synopsis "The Rust OpenTelemetry implementation")
+       (description "This package provides a Rust OpenTelemetry implementation.")
+       (license license:asl2.0)))))
+
 ;; Workspace dependency of zed.
 ;;
 ;; Cargo side: Cargo unifies dependency versions across zed's
@@ -1015,8 +1048,8 @@ It supports the @code{wayland}, @code{wayland-protocols}, and some external
 extensions, such as @code{wlr-protocols} and @code{plasma-wayland-protocols}.")
       (license license:expat)))))

-(define-public rust-smithay-0.7.0.20d2dac
-  (let ((commit "20d2dacd71394b5f96f6ace0a70a6f20dc62c0c6"))
+(define-public rust-smithay-0.7.0.ff5fa7d
+  (let ((commit "ff5fa7df392cecfba049ffed55cdaa4e98a8e7ef"))
    (hidden-package
     (package
       (inherit rust-smithay-0.6.0.ede2707)
@@ -1031,8 +1064,8 @@ extensions, such as @code{wlr-protocols} and @code{plasma-wayland-protocols}.")
          (file-name (git-file-name name version))
          (sha256
           (base32
-            "0h1q1jgyg76axr8h95nv8sg29l15iqnyfr5qfl5rk2wc7iw04avl"))))
-       (inputs (cargo-inputs 'rust-smithay-0.7.0.20d2dac))))))
+            "1dfksva7hizx675vh128ibrbf6ggjh2a01jm41qgb0dgyi6wcpsd"))))
+       (inputs (cargo-inputs 'rust-smithay-0.7.0.ff5fa7d))))))

 (define inspired-github-color-scheme-for-rust-syntect-5
  (let ((version "1.3.0"))
@@ -1537,6 +1570,168 @@ repository, used as dependencies by codex-acp.")
 and runtime for AI-assisted coding.")
     (license license:asl2.0))))

+(define-public rust-codex-0.124.0
+  (hidden-package
+   (package
+     (inherit rust-codex-0.120.0)
+     (version "0.124.0")
+     (source
+      (origin
+        (method git-fetch)
+        (uri (git-reference
+              (url "https://github.com/openai/codex")
+              (commit "e9fb49366c93a1478ec71cc41ecee415a197d036")))
+        (file-name (git-file-name "rust-codex" "0.124.0"))
+        (sha256
+         (base32 "06il60npjnc0h91afyp3wk725cgy3ywk3hx2sbvzdxx6037z6nb0"))
+        (modules '((guix build utils)))
+        (snippet '(begin
+                    ;;; These are JSON manifests with a dotslash
+                    ;;; shebang that download and run pre-built
+                    ;;; binaries (ripgrep, bash) at runtime.
+                    (delete-file "codex-cli/bin/rg")
+                    ;; Bundled bubblewrap source tree; includes a
+                    ;; compiled BPF blob (demos/flatpak.bpf).
+                    (delete-file-recursively "codex-rs/vendor/bubblewrap")))
+        (patches (search-patches
+                  "codex-acp-0.11.1-disable-code-mode.patch"
+                  "rust-codex-0.124.0-code-mode-stub-toolname.patch"
+                  "rust-codex-0.124.0-remove-patch-sections.patch"
+                  "rust-codex-0.120.0-remove-libwebrtc.patch"))))
+     (arguments
+      (substitute-keyword-arguments (package-arguments rust-codex-0.120.0)
+        ;; 0.124 differs from 0.120 by a single removal
+        ;; (codex-instructions) and ten additions placed at topo-correct
+        ;; positions; the order also shifts in a few spots to satisfy new
+        ;; deps (e.g. codex-utils-cargo-bin moves before codex-app-server-
+        ;; protocol).  Replace the whole list rather than computing a
+        ;; delta against the inherited one.
+        ((#:cargo-package-crates _)
+         ''(;; Topologically sorted by internal dependency order.
+            "codex-async-utils"
+            "codex-utils-absolute-path"
+            "codex-execpolicy"
+            "codex-utils-home-dir"
+            "codex-utils-rustls-provider"
+            "codex-network-proxy"
+            "codex-utils-cache"
+            "codex-utils-image"
+            "codex-utils-string"
+            "codex-utils-template"
+            "codex-protocol"
+            "codex-agent-identity"
+            "codex-experimental-api-macros"
+            "codex-shell-command"
+            "codex-utils-cargo-bin"
+            "codex-app-server-protocol"
+            "codex-client"
+            "codex-api"
+            "codex-otel"
+            "codex-features"
+            "codex-model-provider-info"
+            "codex-utils-path"
+            "codex-config"
+            "codex-sandboxing"
+            "codex-utils-pty"
+            "codex-exec-server"
+            "codex-git-utils"
+            "codex-keyring-store"
+            "codex-terminal-detection"
+            "codex-login"
+            "codex-utils-plugins"
+            "codex-plugin"
+            "codex-analytics"
+            "codex-ansi-escape"
+            "codex-apply-patch"
+            "codex-code-mode"
+            "codex-connectors"
+            "codex-skills"
+            "codex-utils-output-truncation"
+            "codex-core-skills"
+            "codex-core-plugins"
+            "codex-feedback"
+            "codex-hooks"
+            "codex-rmcp-client"
+            "codex-mcp"
+            "codex-aws-auth"
+            "codex-model-provider"
+            "codex-collaboration-mode-templates"
+            "codex-response-debug-context"
+            "codex-models-manager"
+            "codex-file-search"
+            "codex-state"
+            "codex-rollout"
+            "codex-rollout-trace"
+            "codex-secrets"
+            "codex-shell-escalation"
+            "codex-thread-store"
+            "codex-tools"
+            "codex-utils-readiness"
+            "codex-utils-stream-parser"
+            "codex-windows-sandbox"
+            "codex-core"
+            "codex-linux-sandbox"
+            "codex-arg0"
+            "codex-backend-openapi-models"
+            "codex-backend-client"
+            "codex-utils-cli"
+            "codex-chatgpt"
+            "codex-cloud-requirements"
+            "codex-device-key"
+            "codex-utils-json-to-toml"
+            "codex-app-server"
+            "codex-app-server-client"
+            "codex-app-server-test-client"
+            "codex-cloud-tasks-client"
+            "codex-cloud-tasks-mock-client"
+            "codex-install-context"
+            "codex-realtime-webrtc"
+            "codex-utils-approval-presets"
+            "codex-utils-elapsed"
+            "codex-utils-fuzzy-match"
+            "codex-lmstudio"
+            "codex-ollama"
+            "codex-utils-oss"
+            "codex-utils-sandbox-summary"
+            "codex-utils-sleep-inhibitor"
+            "codex-exec"
+            "codex-mcp-server"
+            "codex-process-hardening"
+            "codex-responses-api-proxy"
+            "codex-uds"
+            "codex-stdio-to-uds"
+            "codex-debug-client"
+            "codex-execpolicy-legacy"
+            "codex-test-binary-support"))
+        ((#:phases orig)
+         ;; Two changes from the inherited phases:
+         ;; (1) 'add-version-to-workspace-deps stamps the literal
+         ;;     0.120.0 version inside its substitute pattern, so we
+         ;;     swap the whole phase for one stamping 0.124.0 (and
+         ;;     using a regex that also matches the codex_windows_
+         ;;     sandbox underscore alias introduced in 0.124).
+         ;; (2) Add a new phase 'break-dev-dep-cycles to strip the
+         ;;     codex-test-binary-support dev-dep from exec-server and
+         ;;     core; it forms a cycle (test-binary-support -> arg0 ->
+         ;;     {exec-server,core} -> test-binary-support) that cargo
+         ;;     package --no-verify still rejects.
+         #~(modify-phases #$orig
+             (replace 'add-version-to-workspace-deps
+               (lambda _
+                 (let ((cargo-files (find-files "." "^Cargo\\.toml$")))
+                   (substitute* cargo-files
+                     (("(codex[_-][a-z0-9_-]+) = \\{ path = " all name)
+                      (string-append name " = { version = \"0.124.0\", path = "))
+                     (("(codex[_-][a-z0-9_-]+) = \\{ package = " all name)
+                      (string-append name " = { version = \"0.124.0\", package = "))
+                     (("^(path = \"\\.\\./[^\"]*\")" all path-line)
+                      (string-append path-line "\nversion = \"0.124.0\""))))))
+             (add-after 'add-version-to-workspace-deps 'break-dev-dep-cycles
+               (lambda _
+                 (substitute* '("exec-server/Cargo.toml" "core/Cargo.toml")
+                   (("^codex-test-binary-support = \\{[^}]*\\}\n") ""))))))))
+     (inputs (cargo-inputs 'rust-codex-0.124.0)))))
+
 ;; Also update (@ (gnu packages gnome) glycin-loaders) when updating this.
 (define-public rust-glycin-3
  (package
@@ -1830,8 +1830,8 @@ ge13ca993e8ccb9ba9847cc330696e02839f328f7/jemalloc"))
 (define-public rust-1.94
  (let ((base-rust
         (rust-bootstrapped-package
-          rust-1.93 "1.94.0"
-          "0k274dla70wnajjli2w80by9k4nqf2wah1lw9xhzy8gkscf94gxq")))
+          rust-1.93 "1.94.1"
+          "056mbblkhn5ig62v09r6938qmnb09ygy32n62vvwvqqjbxi2l52c")))
    (package
      (inherit base-rust)
      (source
@@ -1885,7 +1885,34 @@ ge13ca993e8ccb9ba9847cc330696e02839f328f7/jemalloc"))
                            "vendor/tempfile-3.23.0/Cargo.toml"
                            "vendor/tempfile-3.24.0/Cargo.toml")
               (("features = \\[\"fs\"" all)
-                (string-append all ", \"use-libc\""))))))))))
+                (string-append all ", \"use-libc\"")))))))
+      (arguments
+       (substitute-keyword-arguments (package-arguments base-rust)
+         ((#:phases phases)
+          `(modify-phases ,phases
+             (replace 'install
+               ;; Cannot use './x.py install' as it runs generate-copyright
+               ;; which fails due to patched cargo checksums.
+               ;; In this version we don't delete the .rmeta files; they are
+               ;; now needed in order to build the next rust version.
+               (lambda* (#:key outputs #:allow-other-keys)
+                 (let* ((out (assoc-ref outputs "out"))
+                        (cargo-out (assoc-ref outputs "cargo"))
+                        (build (string-append "build/"
+                                 ,(platform-rust-target
+                                    (lookup-platform-by-target-or-system
+                                     (or (%current-target-system)
+                                         (%current-system)))))))
+                   (with-directory-excursion build
+                     (install-file "stage2/bin/rustc"
+                                   (string-append out "/bin"))
+                     (install-file "stage2-tools-bin/cargo"
+                                   (string-append cargo-out "/bin"))
+                     (for-each delete-file
+                               (find-files "stage2/lib/rustlib"
+                                           "^librustc_driver.*\\.so$"))
+                     (copy-recursively "stage2/lib"
+                                       (string-append out "/lib")))))))))))))

 (define (make-ignore-test-list strs)
  "Function to make creating a list to ignore tests a bit easier."
@@ -14,7 +14,7 @@
 ;;; Copyright © 2022 Michael Rohleder <mike@rohleder.de>
 ;;; Copyright © 2023 Adam Faiz <adam.faiz@disroot.org>
 ;;; Copyright © 2023 David Pflug <david@pflug.io>
-;;; Copyright © 2024, 2025 Ashish SHUKLA <ashish.is@lostca.se>
+;;; Copyright © 2024-2026 Ashish SHUKLA <ashish.is@lostca.se>
 ;;; Copyright © 2025 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;; Copyright © 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;;
@@ -674,14 +674,14 @@ document and bibtex retrieval.")
 (define-public ugrep
  (package
    (name "ugrep")
-    (version "7.5.0")
+    (version "7.8.0")
    (source (origin
              (method git-fetch)
              (uri (git-reference
                    (url "https://github.com/Genivia/ugrep")
                    (commit (string-append "v" version))))
              (sha256
-               (base32 "0vfap67jfbcx6h72728il93sxy2dvvrsla8fzszgja3swddrrvyb"))
+               (base32 "0968cws0bvfgip7yh9vkhxfmr70dl1jr681yzgzhpn0xdv6iqg94"))
              (file-name (git-file-name name version))
              (modules '((guix build utils)))
              (snippet
@@ -511,14 +511,14 @@ POSIX Shell}, @url{https://www.gnu.org/software/bash/, Bash}, and
 (define-public starship
  (package
    (name "starship")
-    (version "1.25.0")
+    (version "1.25.1")
    (source
     (origin
       (method url-fetch)
       (uri (crate-uri "starship" version))
       (file-name (string-append name "-" version ".tar.gz"))
       (sha256
-        (base32 "0l0104a7f0ad636fzhybssjl76c5axkx241qq0f7f051kg34l5nj"))))
+        (base32 "022bnq9lq0kq0zxs34li0j653rhlh4y2garc3mvcr90pddjhp4wg"))))
    (build-system cargo-build-system)
    (arguments
     (list
@@ -384,15 +384,15 @@ comparison and diagnostics.")
 (define r-with-tests
  (package
    (name "r-with-tests")
-    (version "4.5.3")
+    (version "4.6.0")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://cran/src/base/R-"
                                  (version-major version) "/R-"
-                                  version ".tar.gz"))
+                                  version ".tar.xz"))
              (sha256
               (base32
-                "1wmqnm813lb58c0vwhjymnkfih3a6mq4cr9xa6n72wiw57a1wp5a"))))
+                "09sszy5fykpl2lyzxw5rgiabb3f5l62bqamnm7g2q9d57xlv7wli"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -370,7 +370,7 @@ clients.  The key features are:
 (define-public spdk
  (package
    (name "spdk")
-    (version "24.09")
+    (version "25.09")
    (source
     (origin
       (method git-fetch)
@@ -378,7 +378,7 @@ clients.  The key features are:
             (url "https://github.com/spdk/spdk")
             (commit (string-append "v" version))))
       (sha256
-        (base32 "1cx0yj3ibmbngqsjdlnh7qg7as9mzpbiw0zscraw07b4rs6g0s6q"))))
+        (base32 "1x2nrg4qjilym18shb792593gn1bwihzaq19bxms06mmw40x4s6n"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -404,6 +404,14 @@ clients.  The key features are:
            (lambda _
              (rmdir "isa-l")
              (symlink #$(package-source (this-package-input "isa-l")) "isa-l")))
+          (add-after 'substitute-git-submodules 'skip-python-make-subdir
+            ;; SPDK's Makefile calls 'pip install' for the python subdir, but
+            ;; pip 25+ crashes in the sandbox (SSL cert path not found at
+            ;; import time).  Remove python from DIRS-y and install the package
+            ;; ourselves in install-python-package below.
+            (lambda _
+              (substitute* "Makefile"
+                (("DIRS-y \\+= python") ""))))
          (replace 'configure
            (lambda* (#:key configure-flags #:allow-other-keys)
              (substitute* "configure"
@@ -443,7 +451,8 @@ clients.  The key features are:
                       (string-append #$(this-package-input "dpdk") "/lib")
                       (string-append #$(this-package-input "fuse") "/lib")
                       (string-append #$(this-package-input "gcc") "/lib")
-                       (string-append #$(this-package-input "glibc") "/lib")))
+                       (string-append #$(this-package-input "glibc") "/lib")
+                       (string-append #$(this-package-input "ncurses") "/lib")))
                     (rpath* (apply string-append (map (lambda (l) (string-append l ":")) libs))))
                (for-each
                 (lambda (b)
@@ -459,9 +468,30 @@ clients.  The key features are:
                 binaries))))
          (add-after 'patchelf 'python:wrap
            (assoc-ref py:%standard-phases 'wrap))
+          (add-before 'python:wrap 'install-python-package
+            ;; Install the SPDK Python package using hatchling + installer,
+            ;; bypassing pip (which crashes in the sandbox due to SSL).
+            ;; spdk/version.py is normally generated by python/Makefile, so
+            ;; we recreate it here from the top-level VERSION file.
+            (lambda* (#:key outputs #:allow-other-keys)
+              (invoke "python" "-c"
+                (string-append
+                  "v=open('VERSION').read().strip();"
+                  "p=v.split('.');"
+                  "ver=p[0]+'.'+p[1]+(('.'+p[2]) if len(p)>2 and p[2]!='0' else '');"
+                  "open('python/spdk/version.py','w')"
+                  ".write(\"__version__ = '\"+ver+\"'\\n\")"))
+              ;; ZIP format requires timestamps >= 1980; Guix normalizes
+              ;; source timestamps to epoch 0, so clamp SOURCE_DATE_EPOCH.
+              (setenv "SOURCE_DATE_EPOCH" "315532800")
+              (with-directory-excursion "python"
+                (invoke "python" "-m" "hatchling" "build" "-t" "wheel")
+                (let ((wheel (car (find-files "dist" "\\.whl$"))))
+                  (invoke "python" "-m" "installer"
+                          "--prefix" #$output wheel)))))
          (add-after 'python:wrap 'wrap-python-scripts
            (lambda* (#:key inputs #:allow-other-keys)
-              (let* ((scripts '("bin/spdk_cli" "bin/spdk_rpc" ))
+              (let* ((scripts '("bin/spdk-cli" "bin/spdk-rpc"))
                     (dependencies (map (lambda (input)
                                          (assoc-ref inputs input))
                                        '("python-configshell-fb")))
@@ -479,6 +509,7 @@ clients.  The key features are:
           automake
           patchelf
           pkg-config
+           python-installer
           python-wrapper))
    (inputs
     (list cunit
@@ -499,9 +530,7 @@ clients.  The key features are:
           openlibm
           openssl
           python-configshell-fb
-           python-pip             ; XXX: expected by install, check why
-           python-setuptools      ;
-           python-wheel           ;
+           python-hatchling       ;build backend for python/pyproject.toml
           (list util-linux "lib") ;; <uuid.h>
           zlib
           zstd))
@@ -510,7 +539,11 @@ clients.  The key features are:
    (description
     "@acronym{Storage Performance Development Kit, SPDK} provides a set of
 tools and libraries for writing high performance,scalable, user-mode storage
-applications.")
+applications.
+
+Note: the @command{spdk-mcp} binary requires the optional @code{mcp[cli]}
+Python dependency, and @command{spdk-sma} requires @code{grpcio} and
+@code{protobuf}.  These are not currently packaged in Guix.")
    (license license:bsd-3)))

 (define-public swapspace
@@ -50,7 +50,7 @@
 (define-public syncthing
  (package
    (name "syncthing")
-    (version "2.0.14")
+    (version "2.0.16")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://github.com/syncthing/syncthing"
@@ -58,7 +58,7 @@
                                  "/syncthing-source-v" version ".tar.gz"))
              (sha256
               (base32
-                "00isf0j9nf0752wrn79nh4aj5ij5gapv1kvhrg8ydmmw1gi6rhzy"))))
+                "0sgij3i2mhl6m9n2d98cz86f17215kfdc3z913k8yz4n8gwkcf7r"))))
    ;; TODO: Build from git, remove vendor.
    (build-system go-build-system)
    ;; The primary Syncthing executable goes to "out", while the auxiliary
@@ -73,6 +73,7 @@
       #:import-path "github.com/syncthing/syncthing"
       ;; Check 'go.mod' in the source distribution for the required version of Go.
       ;; We don't need to install the source code for end-user applications.
+       #:go go-1.25
       #:install-source? #f
       #:phases
       #~(modify-phases %standard-phases
@@ -1746,7 +1746,7 @@ running;
      (source
       (origin
         (method git-fetch)
-         (file-name "wezterm")
+         (file-name (git-file-name name version))
         (uri (git-reference
                (url "https://github.com/wezterm/wezterm")
                (commit commit)))
@@ -1784,7 +1784,10 @@ fn main() {
              '(("cairo"      ("cairo" "pixman-1"))
                ("fontconfig" ("fontconfig"))
                ("freetype"   ("freetype" "png" "z"))
-                ("harfbuzz"   ("harfbuzz"))))))))
+                ("harfbuzz"   ("harfbuzz"))))
+             ;; Don't try to vendor lua.
+             (substitute* "config/Cargo.toml"
+               (("\"vendored\", ") ""))))))
      (build-system cargo-build-system)
      (arguments
       (list
@@ -1908,6 +1911,7 @@ fn main() {
              libx11
              libxcb
              libxkbcommon
+              lua-5.4
              mesa
              openssl
              sqlite
@@ -1381,21 +1381,20 @@ interface with CI pipeline UIs.")
 (define-public texmacs
  (package
    (name "texmacs")
-    (version "2.1.4")
+    (version "2.1.5")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "https://www.texmacs.org/Download/ftp/tmftp/"
                           "source/TeXmacs-" version "-src.tar.gz"))
       (sha256
-        (base32 "11l1q5lmsj9g7yil1dn7n1cgsr8iikx59kg9riahpb6xw0p959l7"))
-       (patches
-        (search-patches "texmacs-wayland-hidpi.patch"))))
+        (base32 "0q3k0asf31mm2jl7fi7244sk6c9lprf434cj4c5h2ycfpayjg8dk"))))
    (build-system qt-build-system)
    (native-inputs
     (list pkg-config xdg-utils))       ;for xdg-icon-resource
    (inputs
     (list freetype
+           gnutls
           guile-1.8
           libjpeg-turbo
           libxcrypt
@@ -115,16 +115,16 @@ Firefox locales.")

 ;; We copy the official build id, which is defined at
 ;; tor-browser-build/rbm.conf (browser_release_date).
-(define %torbrowser-build-date "20260404073000")
+(define %torbrowser-build-date "20260427173000")

 ;; To find the last version, look at https://www.torproject.org/download/.
-(define %torbrowser-version "15.0.9")
+(define %torbrowser-version "15.0.11")

 ;; To find the last Firefox version, browse
 ;; https://archive.torproject.org/tor-package-archive/torbrowser/<%torbrowser-version>
 ;; There should be only one archive that starts with
 ;; "src-firefox-tor-browser-".
-(define %torbrowser-firefox-version "140.9.1esr-15.0-1-build1")
+(define %torbrowser-firefox-version "140.10.1esr-15.0-1-build1")

 ;; See tor-browser-build/rbm.conf for the list.
 (define %torbrowser-locales (list "ar" "be" "bg" "ca" "cs" "da" "de" "el" "es-ES" "fa"
@@ -139,11 +139,11 @@ Firefox locales.")
    (method git-fetch)
    (uri (git-reference
          (url "https://gitlab.torproject.org/tpo/translation.git")
-          (commit "ce651a6f8aa3a6c5ff9c3f9c77d3cb9585dcc903")))
+          (commit "1f76c1fa38583ae3f911e00a3bb170d73a329fac")))
    (file-name "translation-base-browser")
    (sha256
     (base32
-      "0cr82adjkqkbamb4qk7xpr84lch4js4n126pzsm1993np0ap7vjp"))))
+      "1plf0pcijid8lhrfzkbppf67q46783wxxqsjxi327d4xp0zxfq9g"))))

 ;; See tor-browser-build/projects/translation/config.
 (define torbrowser-translation-specific
@@ -151,11 +151,11 @@ Firefox locales.")
    (method git-fetch)
    (uri (git-reference
          (url "https://gitlab.torproject.org/tpo/translation.git")
-          (commit "685a144cb5cfdb50afc1e4effae48a63b3a81ee3")))
+          (commit "7ba943dc4c2b8675a38e09a4bdbf35692662f0c5")))
    (file-name "translation-tor-browser")
    (sha256
     (base32
-      "02z1cfzyg10g4z4iz5z1k3jjv7k0ydmsf6i923iir02yw2jgznp7"))))
+      "08xj969xlkca7icc5azcm4lni3i2nxa4w9kdbl09jzfj66iwj4qk"))))

 (define torbrowser-assets
  ;; This is a prebuilt Torbrowser from which we take the assets we need.
@@ -171,7 +171,7 @@ Firefox locales.")
         version "/tor-browser-linux-x86_64-" version ".tar.xz"))
       (sha256
        (base32
-         "039nys7h83avkva16rg7lvrxh08pczw08vklxrh90pm38fpipddk"))))
+         "0vhgrnwbq82wncl9a8l9rncc5792gc1cir2db3va7ak4qljnjmpv"))))
    (arguments
     (list
      #:install-plan
@@ -212,7 +212,7 @@ Browser.")
         ".tar.xz"))
       (sha256
        (base32
-         "0jvlznd2rc68c9bl7al405dpgk0806hznxn198ji0nryjr5hmzd5"))))
+         "0wxwa0w1v2fksy6qq8vpvxahbsad5w6lkjrz88yz2qjny7bs0j2v"))))
    (build-system mozilla-build-system)
    (inputs
     (list lyrebird
@@ -789,17 +789,17 @@ attacks on the privacy of Tor users.")

 ;; We copy the official build id, which can be found there:
 ;; https://cdn.mullvad.net/browser/update_responses/update_1/release.
-(define %mullvadbrowser-build-date "20260404073000")
+(define %mullvadbrowser-build-date "20260427173000")

 ;; To find the last version, look at
 ;; https://mullvad.net/en/download/browser/linux.
-(define %mullvadbrowser-version "15.0.9")
+(define %mullvadbrowser-version "15.0.11")

 ;; To find the last Firefox version, browse
 ;; https://archive.torproject.org/tor-package-archive/mullvadbrowser/<%mullvadbrowser-version>
 ;; There should be only one archive that starts with
 ;; "src-firefox-mullvad-browser-".
-(define %mullvadbrowser-firefox-version "140.9.1esr-15.0-1-build1")
+(define %mullvadbrowser-firefox-version "140.10.1esr-15.0-1-build1")

 ;; See tor-browser-build/projects/translation/config.
 (define mullvadbrowser-translation-base
@@ -807,11 +807,11 @@ attacks on the privacy of Tor users.")
    (method git-fetch)
    (uri (git-reference
          (url "https://gitlab.torproject.org/tpo/translation.git")
-          (commit "ce651a6f8aa3a6c5ff9c3f9c77d3cb9585dcc903")))
+          (commit "1f76c1fa38583ae3f911e00a3bb170d73a329fac")))
    (file-name "translation-base-browser")
    (sha256
     (base32
-      "0cr82adjkqkbamb4qk7xpr84lch4js4n126pzsm1993np0ap7vjp"))))
+      "1plf0pcijid8lhrfzkbppf67q46783wxxqsjxi327d4xp0zxfq9g"))))

 ;; See tor-browser-build/projects/translation/config.
 (define mullvadbrowser-translation-specific
@@ -839,7 +839,7 @@ attacks on the privacy of Tor users.")
         version "/mullvad-browser-linux-x86_64-" version ".tar.xz"))
       (sha256
        (base32
-         "154nraw83lhyrhrahvd35zvclnshcfvgjq16cr2z9jg5sz7c4hhs"))))
+         "11yq8cy0kqa0j1xba0j56gq3dv6543x2r1vnpxnvlqj1vs4hdjgs"))))
    (arguments
     (list
      #:install-plan
@@ -882,7 +882,7 @@ Mullvad Browser.")
         %mullvadbrowser-firefox-version ".tar.xz"))
       (sha256
        (base32
-         "0i860k6i2dc86jj9hg2hvm0g071iha7zxngnrn21kbilqr4hi61z"))))
+         "1cbc7s8fzwxl19nbf1l7gn6xjlkc81si147ww2v15yv0xpvlsymy"))))
    (arguments
     (substitute-keyword-arguments arguments
       ((#:phases phases)
@@ -232,39 +232,39 @@ with the editor vim.")))
    (inherit vim)
    (name "vim-full")
    (arguments
-     (cons*
-       #:configure-flags
-       #~(list (string-append "--with-lua-prefix="
-                              #$(this-package-input "lua"))
-               "--with-features=huge"
-               "--enable-python3interp=yes"
-               "--enable-perlinterp=yes"
-               "--enable-rubyinterp=yes"
-               "--enable-tclinterp=yes"
-               "--enable-luainterp=yes"
-               "--enable-cscope"
-               "--enable-sniff"
-               "--enable-multibyte"
-               "--enable-xim"
-               "--disable-selinux"
-               "--enable-gui")
-       (substitute-keyword-arguments arguments
-         ((#:phases phases)
-          #~(modify-phases #$phases
-              (add-before 'check 'skip-some-more-tests
-                (lambda _
-                  ;; Fontconfig can't figure out its cache directory.
-                  (substitute* "src/testdir/test_startup.vim"
-                    ((".*Test_progname.*" line)
-                     (string-append line "return\n")))))
-              ;; Some tests require an X server, but do not start one.
-              (add-before 'check 'start-xserver
-                (lambda _
-                  (setenv "DISPLAY" ":1")
-                  (zero? (system #$(file-append
-                                     (this-package-native-input
-                                       "xorg-server")
-                                     "/bin/Xvfb :1 &"))))))))))
+     (substitute-keyword-arguments arguments
+       ((#:configure-flags flags #~'())
+        #~(cons* (string-append "--with-lua-prefix="
+                                #$(this-package-input "lua"))
+                 "--with-features=huge"
+                 "--enable-python3interp=yes"
+                 "--enable-perlinterp=yes"
+                 "--enable-rubyinterp=yes"
+                 "--enable-tclinterp=yes"
+                 "--enable-luainterp=yes"
+                 "--enable-cscope"
+                 "--enable-sniff"
+                 "--enable-multibyte"
+                 "--enable-xim"
+                 "--disable-selinux"
+                 "--enable-gui"
+                 #$flags))
+       ((#:phases phases)
+        #~(modify-phases #$phases
+            (add-before 'check 'skip-some-more-tests
+              (lambda _
+                ;; Fontconfig can't figure out its cache directory.
+                (substitute* "src/testdir/test_startup.vim"
+                  ((".*Test_progname.*" line)
+                   (string-append line "return\n")))))
+            ;; Some tests require an X server, but do not start one.
+            (add-before 'check 'start-xserver
+              (lambda _
+                (setenv "DISPLAY" ":1")
+                (zero? (system #$(file-append
+                                   (this-package-native-input
+                                     "xorg-server")
+                                   "/bin/Xvfb :1 &")))))))))
    (native-inputs
     (modify-inputs native-inputs
       (prepend pkg-config xorg-server-for-tests)))
--- a/Show More
+++ b/Show More