gnu: r-s4vectors: Patch for R 4.6.0.

* gnu/packages/bioconductor.scm (r-s4vectors)[arguments]: Add phase
'R-4.6.0-compatibility.

Change-Id: I731250e9dcfc62cfb2cafbf88e2f1e2d6b932828

CODEOWNERS

@@ -179,6 +179,7 @@ guix/scripts/import/elpa\.scm                      @guix/emacs
 tests/import/elpa\.scm                             @guix/emacs
 
 gnu/packages/bootloaders\.scm                      @guix/embedded
+gnu/packages/coreboot\.scm                         @guix/embedded
 gnu/packages/firmware\.scm                         @guix/embedded
 
 gnu/packages/emulators\.scm                        @guix/games
@@ -318,6 +319,7 @@ gnu/packages/tor-browsers\.scm                     @guix/mozilla
 
 gnu/packages/ocaml\.scm                            @guix/ocaml
 gnu/packages/coq\.scm                              @guix/ocaml
+gnu/packages/rocq\.scm                             @guix/ocaml
 guix/build/ocaml-build-system\.scm                 @guix/ocaml
 guix/build/dune-build-system\.scm                  @guix/ocaml
 guix/build-system/ocaml\.scm                       @guix/ocaml

doc/contributing.texi

@@ -1667,6 +1667,9 @@ can be turned into a version string via @code{git-version}, for example
 @code{rust-pipewire-0.8.0.fd3d8f7} and @code{rust-pubgrub-0.3.0.b70cf70}.
 @end table
 
+When contributing Rust packages, we should have all modifications to these
+two modules, in the same commit as the package we are contributing.
+
 To avoid merge conflicts with changes from multiple branches, these two modules
 are maintained by the Rust team (@pxref{Teams}).
 
@@ -1696,6 +1699,68 @@ tree.
 @xref{Packaging Rust Crates,,, guix-cookbook, GNU Guix Cookbook}, for
 packaging workflow.
 
+@subsubsection Commit messages
+
+The commit message must have a general brief mention to entry changes
+in @code{(gnu packages rust-crates)}. For changes in @code{(gnu packages
+rust-sources)}, the commit message must explicitly mention all changes to the
+packages.
+
+Here are some examples for different situations:
+
+@itemize
+
+@item
+Adding a new Rust package:
+
+@example
+gnu: Add catppuccin-whiskers.
+
+* gnu/packages/rust-apps.scm (catppuccin-whiskers): New variable.
+* gnu/packages/rust-crates.scm (lookup-cargo-inputs)
+[catppuccin-whiskers]: New entry.
+@end example
+
+@item
+Updating a simple package:
+
+@example
+gnu: watchexec: Update to 2.3.2.
+
+* gnu/packages/rust-apps.scm (watchexec): Update to 2.3.2.
+* gnu/packages/rust-crates.scm (lookup-cargo-inputs)[watchexec]:
+Update entry.
+@end example
+
+@item
+Updating a package with sources:
+
+@example
+gnu: typst: Update to 0.14.0.
+
+* gnu/packages/rust-apps.scm (typst): Update to 0.14.0.
+[arguments]<#:rust>: Use rust-1.88.
+* gnu/packages/rust-crates.scm (lookup-cargo-inputs)[typst]: Update
+entry.
+[rust-syntect-5]: Rename to rust-syntect-5.2.
+[rust-syntect-5.3]: New entry.
+* gnu/packages/rust-sources.scm (rust-hypher-0.1): Update to 0.1.6.
+(rust-syntect-5): Rename to rust-syntect-5.2.
+[inputs]: Rename cargo-inputs rust-syntect-5 to rust-syntect-5.2.
+(rust-syntect-5.3): New variable.
+@end example
+
+@end itemize
+
+@subsubsection Resolving merge conflicts in Pull Requests
+
+For Rust crates, the recommended way to solve merge conflicts is to drop all
+changes to @code{gnu/packages/rust-crates.scm}, rebase onto the desired branch
+and run the lockfile importer again, manually adding back all relevant snippets
+(if any).
+
+@xref{Common Workflow for Resolving Merge Conflicts on Existing Pull Requests,,, guix-cookbook, GNU Guix Cookbook} for
+a suggested workflow on resolving merge conflicts.
 
 @node Elm Packages
 @subsection Elm Packages
@@ -2650,6 +2715,7 @@ applications settings page}, granting read/write access to the
 
 @cindex decision making
 @cindex consensus seeking
+Every contribution to the project involves a form of decision making.
 It is expected from all contributors, and even more so from committers,
 to help build consensus and make decisions based on consensus.  By using
 consensus, we are committed to finding solutions that everyone can live
@@ -2664,6 +2730,26 @@ resolve the deadlock.  To learn what consensus decision making means and
 understand its finer details, you are encouraged to read
 @url{https://www.seedsforchange.org.uk/consensus}.
 
+Day-to-day decision making, for instance discussions about pull requests
+(@pxref{Reviewing the Work of Others}), happens informally among
+interested parties such as contributors and members of the relevant
+teams (@pxref{Teams}).
+
+@cindex GCD, Guix Consensus Documents
+@cindex Guix Consensus Documents (GCD)
+Decisions that are expected to have an impact on most contributors
+and/or on the broader user community---e.g., changes to project-wide
+policies, to core functionality, and so on---are made following the
+@acronym{GCD, Guix Consensus Document} process.  The process provides a
+framework to formalize proposals and draw attention to them, to leave
+time for interested parties to discuss them, and to collectively accept
+or withdraw them based on input from participating team members.  It is
+defined in
+@uref{https://consensus.guix.gnu.org/gcd/001-gcd-process.html,
+GCD@tie{}001}.  Past GCDs can be seen at
+@uref{https://consensus.guix.gnu.org}, and discussions take place at
+@uref{https://codeberg.org/guix/guix-consensus-documents}.
+
 @node Commit Access
 @section Commit Access
 

doc/guix-cookbook.texi

@@ -146,6 +146,8 @@ Packaging Rust Crates
 * Common Workflow for Rust Packaging::
 * Cargo Workspaces and Development Snapshots::
 * Using Rust Libraries in Other Build Systems::
+* Common Workflow for Updating Existing Rust Packages::
+* Common Workflow for Resolving Merge Conflicts on Existing Pull Requests::
 
 System Configuration
 
@@ -1647,6 +1649,8 @@ $ guix shell rust rust:cargo cargo-audit cargo-license
 * Common Workflow for Rust Packaging::
 * Cargo Workspaces and Development Snapshots::
 * Using Rust Libraries in Other Build Systems::
+* Common Workflow for Updating Existing Rust Packages::
+* Common Workflow for Resolving Merge Conflicts on Existing Pull Requests::
 @end menu
 
 @node Common Workflow for Rust Packaging
@@ -1705,6 +1709,15 @@ $ cargo audit
 $ cargo license
 @end example
 
+@quotation Note
+Before running @command{cargo generate-lockfile}, make sure you have checked
+out the correct tag for the version you are packaging. This ensures that
+@code{Cargo.toml} matches the file used in the packages's @code{source} field.
+To make sure, you can obtain the exact source with @command{./pre-inst-env guix
+build --source <package>} and only then run @command{cargo generate-lockfile} on
+that source tree.
+@end quotation
+
 @command{cargo generate-lockfile} updates dependencies to compatible versions.
 Applying it to all Rust applications helps reduce a great number of Rust
 libraries we need to check later.  Although sometimes libraries may fail to
@@ -1987,6 +2000,316 @@ method, one of the most popular choices for Traditional Chinese users.")
     (license license:lgpl2.1+)))
 @end lisp
 
+@node Common Workflow for Updating Existing Rust Packages
+@subsubsection Common Workflow for Updating Existing Rust Packages
+
+For this example, we'll update @code{niri}. The package definition looks like
+this initially:
+
+@lisp
+(define-public niri
+  (package
+   (name "niri")
+   (version "25.08")
+   (source (origin
+             (method git-fetch)
+             (uri (git-reference
+                   (url "https://github.com/YaLTeR/niri")
+                   (commit (string-append "v" version))))
+             (file-name (git-file-name name version))
+             (sha256
+              (base32
+               "09nsxd211mly8r1ys2lq6ia4jxgb980h1axrbgw748r0knfbbj7n"))))
+   (build-system cargo-build-system)
+...
+@end lisp
+
+We start by running the usual @command{guix refresh -u niri}.
+
+The @command{-u} flag will update in place the version and hash for the
+@code{niri} package.
+
+The package definition will then look like this:
+
+@lisp
+(define-public niri
+  (package
+   (name "niri")
+   (version "25.11")
+   (source (origin
+             (method git-fetch)
+             (uri (git-reference
+                   (url "https://github.com/YaLTeR/niri")
+                   (commit (string-append "v" version))))
+             (file-name (git-file-name name version))
+             (sha256
+              (base32
+               "0752qm245wc2gak0jhp0fnr0rdj3z54m2h97k3cxbjym9pcn658n"))))
+   (build-system cargo-build-system)
+...
+@end lisp
+
+This means the source field was updated successfully, thus we can now proceed to
+get the updated source with @command{guix build --source niri} as follows:
+
+@example shell
+$ cp -r $(./pre-inst-env guix build --source niri) /tmp
+$ cd /tmp/<hash>-niri-25.11-checkout/
+@end example
+
+@quotation Note
+In this specific example, the source is a git checkout, thus a directory. If the
+package source is a compressed archive, you would at this point extract it to a
+directory to proceed.
+@end quotation
+
+Now, given that we have access to the @code{Cargo.toml} file, we can now run
+the following inside the checkout:
+
+@example shell
+$ guix shell rust rust:cargo -- cargo generate-lockfile
+$ guix shell rust rust:cargo -- cargo audit
+$ guix shell rust rust:cargo -- cargo license
+@end example
+
+@quotation Note
+Sometimes the package will require a more up-to-date version of rust, that is
+not yet the default rust on guix. For these cases you can use:
+@example shell
+$ guix shell -e "(@ (gnu packages rust) rust-1.90)" \
+     -e '`(,(@ (gnu packages rust) rust-1.90) "cargo")'
+@end example
+@end quotation
+
+The first command will ensure that all cargo dependencies are up to date
+and semver compatible, while also providing some other benefits, as further
+explained in @ref{Common Workflow for Rust Packaging}.
+
+The following command will warn if there are any known vulnerabilities in the
+crates being imported. The last one will output the license information of all
+the dependent crates.
+
+If everything looks good, we can now replace the contents of the @code{niri}
+indentifier, located inside the @code{lookup-cargo-inputs} variable on the
+bottom of the @file{gnu/packages/rust-crates.scm} module, with the newer updated
+crates by running the importer on the lockfile as follows:
+
+@example shell
+$ guix import -i /path/to/gnu/packages/rust-crates.scm \
+     crate -f Cargo.lock niri
+@end example
+
+@quotation Note
+For the purpose of contributing a package to Guix (@pxref{Contributing,,,
+guix, GNU Guix Reference Manual}), there is no need to cleanup the leftover
+crates as a result of the package update.  This is tasked to the rust-team
+(@pxref{Teams,,, guix, GNU Guix Reference Manual}) to periodically run a
+convenient script in @code{etc/teams/rust} to cleanup unused crates from
+@file{gnu/packages/rust-crates.scm}.
+@end quotation
+
+We then need to check whether the importer has placed some TODOs for us,
+inside @file{gnu/packages/rust-crates.scm} (you can use @command{git diff --
+gnu/packages/rust-crates.scm} for this purpose).
+
+There are a few types of TODO messages that you might encounter during this
+step, each type requiring you to perform a different action.
+
+The first one we encounter in our example is:
+
+@lisp
+(define rust-libdisplay-info-sys-0.3.0
+  ;; TODO REVIEW: Check bundled sources.
+  (crate-source "libdisplay-info-sys" "0.3.0"
+                "07xmkc2aqcdn6d58321y87rd3gzdr4nx3ncm1mmrr7w1p1ahsn96"))
+@end lisp
+
+This specific TODO message tells us that there is a high probability of
+encountering bundled sources within a crate definition generated by the
+importer.
+
+We then check if there are any bundled sources within the
+@code{rust-libdisplay-info-sys-0.3.0} crate. Since there are none (in our
+example), we can simply remove the TODO line, and continue to the next TODO.
+
+If there were any bundled sources inside the crate, we would have to patch
+it with a snippet, in order to unbundle it. You can see some examples on
+how to unbundle inside @file{gnu/packages/rust-crates.scm} (search for the
+@code{#:snippet} keyword).
+
+@quotation Note
+If the unbundle is considered too difficult to be executed (e.g. the effort
+needed to unbundle is unreasonable), the @code{TODO REVIEW} line should be
+converted to a regular TODO comment explicitly stating the unbundle was not done
+(e.g. @code{TODO: Unbundle rust-libdisplay-info-sys.}).
+@end quotation
+
+Continuing, another TODO message we encounter in this example is the following:
+
+@lisp
+(define rust-smithay-0.7.0.d743e1a
+  ;; TODO REVIEW: Define standalone package if this is a workspace.
+  (origin
+    (method git-fetch)
+    (uri (git-reference (url "https://github.com/Smithay/smithay.git")
+                        (commit "d743e1a317fa0f01d1c4cadd96d277a1ec7b59d9")))
+    (file-name (git-file-name "rust-smithay" "0.7.0.d743e1a"))
+    (sha256 (base32 "11327mhxxf844bs0v5bw1g9bzjssnzhidsissywy6kwng16x727v"))))
+@end lisp
+
+This specific TODO message tells us that there is a high probability of the
+@code{rust-smithay-0.7.0.d743e1a} crate being a workspace.
+
+After verifying that it is indeed a workspace, we now need to make it an
+actual package in @file{gnu/packages/rust-sources.scm}, referencing it in the
+crate-source definition (see @ref{Common Workflow for Rust Packaging} for more
+details).
+
+@quotation Note
+You can verify if a crate is a workspace by cloning the crate repository (in
+this case @code{https://github.com/Smithay/smithay.git}), checking out the
+specific revision (in this case @command{git checkout d743e1a}), and looking
+for @code{[workspace]} in its main @file{Cargo.toml} file. If it does not have a
+TOML @code{[workspace]} section, then it is not a workspace.
+@end quotation
+
+After defining the separate source package for the workspace in
+@file{gnu/packages/rust-sources.scm} (see @ref{Common Workflow for Rust
+Packaging} for more details on how to do this), the crate definition for
+@code{rust-smithay-0.7.0.d743e1a} would then become the following (notice we
+also remove the TODO line):
+
+@lisp
+(define rust-smithay-0.7.0.d743e1a package:rust-smithay-0.7.0.d743e1a)
+@end lisp
+
+If @code{rust-smithay-0.7.0.d743e1a} was not a workspace, we would simply remove
+the TODO line and move on.
+
+We then try to build the package with @command{guix build niri}, and make sure
+whether it builds successfully, which it does.
+
+As a good practice, we can further check the output of the
+@code{check-for-pregenerated-files} phase to ensure there are no extraneous
+pregenerated files inside the crates. If there are any, it is important to
+snippet them out, like these:
+
+@lisp
+(define rust-winapi-x86-64-pc-windows-gnu-0.4.0
+  (crate-source "winapi-x86_64-pc-windows-gnu" "0.4.0"
+                "0gqq64czqb64kskjryj8isp62m2sgvx25yyj3kpc2myh85w24bki"
+                #:snippet '(delete-file-recursively "lib")))
+
+(define rust-flate2-1.1.4
+  (crate-source "flate2" "1.1.4"
+                "1a8a3pk2r2dxays4ikc47ygydhpd1dcxlgqdi3r9kiiq9rb4wnnw"
+                #:snippet '(for-each delete-file-recursively '("examples" "tests"))))
+
+(define rust-flo-curves-0.3.1
+  (crate-source "flo_curves" "0.3.1"
+                "16x293dp8825jh465kgms4yyvl4960j26gh37h3skflq9zxpy8hw"
+                #:snippet '(for-each delete-file '("logo-small.png" "logo.png"))))
+
+(define rust-interception-sys-0.1.3
+  (crate-source "interception-sys" "0.1.3"
+                "1lgwbml7gzq5a5rriy708w68gx6yiw9cdg7xy2c5vsrrck7pbs5b"
+                #:snippet '(for-each delete-file (find-files "." "\\.(dll|lib)$"))))
+@end lisp
+
+@node Common Workflow for Resolving Merge Conflicts on Existing Pull Requests
+@subsubsection Common Workflow for Resolving Merge Conflicts on Existing Pull Requests
+
+Whenever a Rust package change is merged into our target branch from a different
+Pull Request, we often encounter many merge conflicts in @code{(gnu packages
+rust-crates)} when rebasing the Pull Request on top of the target branch. Since
+we should avoid modifying the rust-crates file manually (e.g. using the git
+interface to solve merge conflicts), it is recommended (and often much faster)
+to drop all changes to @code{(gnu packages rust-crates)} and run the lockfile
+importer once again, manually adding back all the manual changes.
+
+This workflow describes one of many ways to do the described procedure.
+
+In this example we'll update the @code{codeberg-cli} package, which has produced
+some merge conflicts in @file{gnu/packages/rust-crates.scm} when we tried a git
+pull rebase.
+
+Before starting, make sure we're not in a rebase environment, by aborting the
+rebase we tried previously (the one which created the merge conflicts by git
+pulling):
+
+@example
+$ git rebase --abort
+@end example
+
+@cindex git rebase --interactive
+@cindex interactive rebase
+To begin, we interactively rebase our PR branch by marking as
+@code{edit} the commit we want to edit, which is the one containing the
+@file{gnu/packages/rust-crates.scm} changes:
+
+@example
+# Change 1 to the number of relevant commits
+$ git rebase -i HEAD~1
+@end example
+
+In our example, we would mark the @code{codeberg-cli} commit like so:
+
+@example
+edit 6ef4f1ad043 # gnu: codeberg-cli: Update to 0.5.4.
+@end example
+
+After that, we'll be in rebase mode, where we can restore the changes made to
+@file{gnu/packages/rust-crates.scm}:
+
+@quotation Note
+Notice that we will lose all manual changes we have previously made to
+@file{gnu/packages/rust-crates.scm} (e.g. snippets, deleting TODO comments,
+if there were any). We'll need to manually add them back after we run the guix
+lockfile importer once again, so make sure you have them saved somewhere, for
+example in your PR link under the @code{Files changed} tab.
+@end quotation
+
+@example
+$ git restore --source=HEAD~ gnu/packages/rust-crates.scm
+@end example
+
+Having restored the file, we can stage the changes, commit, finish the rebase
+and pull rebase from the target branch:
+
+@example
+$ git add gnu/packages/rust-crates.scm
+$ git commit --amend --no-edit
+$ git rebase --continue
+$ git pull <remote> <target branch>
+@end example
+
+We then proceed to run the guix lockfile importer:
+
+@quotation Note
+Remember to checkout the correct tag you're packaging in the package repository
+checkout. Don't forget to run @code{cargo generate-lockfile} before running
+the lockfile importer, see @ref{Common Workflow for Rust Packaging} for more
+detailed steps on what to do before running the guix lockfile importer.
+@end quotation
+
+@example
+$ guix import --insert=gnu/packages/rust-crates.scm \
+      crate --lockfile=/path/to/Cargo.lock codeberg-cli
+@end example
+
+Now is the time we manually add back the snippets and remove the relevant TODOs
+we have already checked (if there are any).
+
+After running the lockfile importer and checking if there are any changes to
+manually add back, we can finally:
+
+@example
+$ git add gnu/packages/rust-crates.scm
+# Our target commit is the last one:
+$ git commit --amend --no-edit
+@end example
+
+We now have a non-conflicting tree, from which we can now update our PR with.
 
 @c *********************************************************************
 @node System Configuration

doc/guix.texi

@@ -8843,12 +8843,12 @@ dependencies than the original package.  For example, the default
 optional dependency, you can define a variant that removes that
 dependency like so:
 
+@findex package/inherit
 @lisp
 (use-modules (gnu packages gdb))   ;for 'gdb'
 
 (define gdb-sans-guile
-  (package
-    (inherit gdb)
+  (package/inherit gdb
     (inputs (modify-inputs inputs
               (delete "guile")))))
 @end lisp
@@ -8856,6 +8856,23 @@ dependency like so:
 In the body of the @code{inputs} field above, @code{inputs} is bound to
 the inherited value.  Thus, the @code{modify-inputs} form above removes
 the @code{"guile"} package from the @code{inputs} field of @code{gdb}.
+
+@quotation Note
+The example above uses @code{(package/inherit gdb @dots{})} instead of
+the usual @code{(package (inherit gdb) @dots{})}.  While the latter
+would work, @code{package/inherit} does extra work: if @code{gdb} has a
+@code{replacement} field (@pxref{Security Updates}),
+@code{package/inherit} propagates the @code{inputs} changes of this
+variant to the replacement.
+
+In other words, @code{package/inherit} ensures the variant gets a
+consistent @code{replacement} when the original package has one.  Thus,
+one should generally use @code{package/inherit} when creating a variant
+for the same version, but not when targeting a different version, as in
+the @code{hello} example we saw earlier, where the replacement may be
+incorrect.
+@end quotation
+
 The @code{modify-inputs} macro is a helper that can prove useful anytime
 you want to remove, add, or replace package inputs.
 
@@ -15534,7 +15551,7 @@ gnu/packages/qt.scm:452:13: qtbase would be upgraded from 5.15.8 to 5.15.10
 @end example
 
 @cindex partial version specification, guix refresh
-A per-package equivalent to --target-version is made available by
+A per-package equivalent to @option{--target-version} is made available by
 prefixing the version specification with the @samp{~} (tilde) character.
 For example:
 
@@ -16095,7 +16112,7 @@ it unchanged.
 @item git-source
 If the @code{home-page} is a Git repository (as per
 @code{git-repository-url?}), and the actual Git repository is tagged
-with @code{version} or @code{(string-append ``v'' version)}, change the
+with a version string, possibly prefixed by ``v'', change the
 package origin to the @code{git-fetch} method
 (@pxref{origin Reference}).  Consider this example:
 
@@ -16124,14 +16141,16 @@ its @code{source} field like to:
     (inherit guile-json-3)
     (name "guile-json")
     (version "4.7.3")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference (url
-                                   "https://github.com/aconchillo/guile-json")
-                                  (commit version)))
-              (file-name (git-file-name name version))
-              (sha256 (base32
-                       "0akhm8xjv8fl55fyq0w6c9c6hi5j7mifjx01w07np7qg1cjl9f06"))))))
+    (source
+      (origin
+        (method git-fetch)
+        (uri (git-reference
+               (url "https://github.com/aconchillo/guile-json")
+               (commit version)))
+        (file-name (git-file-name name version))
+        (sha256
+          (base32
+            "0akhm8xjv8fl55fyq0w6c9c6hi5j7mifjx01w07np7qg1cjl9f06"))))))
 @end lisp
 
 @end table
@@ -27248,6 +27267,28 @@ Package object for GVfs.
 @end table
 @end deftp
 
+@defvar kmonad-service-type
+This is the type of the service that runs
+@uref{https://github.com/kmonad/kmonad, KMonad}.  Its value is a
+@code{kmonad-configuration} object.  This service allows spawning
+@command{kmonad} configurations to manage keyboards.
+
+@deftp {Data Type} kmonad-configuration
+Configuration record for the KMonad service.
+
+@table @asis
+@item @code{kmonad} (default: @code{kmonad})
+The KMonad package to use.
+
+@item @code{keymaps}
+A list of files with KMonad configurations. One shepherd service will be
+created to control each configuration. Each configuration should target
+a distinct input device as KMonad operates on a per-input basis.
+
+@end table
+@end deftp
+@end defvar
+
 @defvar colord-service-type
 This is the type of the service that runs @command{colord}, a system
 service with a D-Bus

etc/teams.scm

@@ -16,6 +16,7 @@ exec $pre_inst_env_maybe guix repl -- "$0" "$@"
 ;;; Copyright © 2025 Cayetano Santos <csantosb@inventati.org>
 ;;; Copyright © 2025-2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2025 jgart <jgart@dismail.de>
+;;; Copyright © 2026 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -690,6 +691,7 @@ ecosystem."
   (team 'embedded
         #:name "Embedded"
         #:scope (list "gnu/packages/bootloaders.scm"
+                      "gnu/packages/coreboot.scm"
                       "gnu/packages/firmware.scm")))
 
 (define-team games
@@ -943,6 +945,7 @@ importer, and the ocaml-build-system."
         #:scope
         (list "gnu/packages/ocaml.scm"
               "gnu/packages/coq.scm"
+              "gnu/packages/rocq.scm"
               "guix/build/ocaml-build-system.scm"
               "guix/build/dune-build-system.scm"
               "guix/build-system/ocaml.scm"
@@ -1246,6 +1249,11 @@ the \"texlive\" importer."
                        "jonsger")
   mozilla)
 
+(define-member (person "Denis Carikli"
+                       "GNUtoo@cyberdimension.org"
+                       "GNUtoo")
+  embedded)
+
 (define-member (person "Ludovic Courtès"
                        "ludo@gnu.org"
                        "civodul")

etc/teams/rust/audit-rust-crates

@@ -1,6 +1,6 @@
 #!/usr/bin/env -S gawk -f
 # GNU Guix --- Functional package management for GNU
-# Copyright © 2025 Efraim Flashner <efraim@flashner.co.il>
+# Copyright © 2025, 2026 Efraim Flashner <efraim@flashner.co.il>
 #
 # This file is part of GNU Guix.
 #
@@ -21,20 +21,22 @@
 # ./etc/teams/rust/audit-rust-crates ./path/to/file.scm
 # Prints the output of cargo-audit to the shell.
 
-# Make sure we have cargo-audit in our PATH
 BEGIN {
-    if (system("which cargo-audit 1> /dev/null"))
-        exit 1;
+    "which cargo-audit" | getline cargoAudit
+    close("which cargo-audit")
+    cargoAudit = cargoAudit " audit --file -"
+
     # Parse a record at a time.
     RS = "\n\n"
-    cargoAudit = "cargo-audit audit --file -"
 }
 
-# Check the crate-source origin-only inputs
+# Check the crate-source origin-only inputs, like in rust-crates.scm
 /crate-source/ {
     for(i=3; i <= NF-2; i++) {
         if($i == "(crate-source") {
-            cargoLock = cargoLock "[[package]]\nname = " $(i+1) "\nversion = " $(i+2) "\n"
+            crateName = $(i+1)
+            crateVersion = $(i+2)
+            cargoLock = cargoLock "[[package]]\nname = " crateName "\nversion = " crateVersion "\n"
             next
         }
     }
@@ -44,27 +46,64 @@ BEGIN {
 /crate-uri/ {
     for(i=3; i <= NF; i++) {
         if($i == "(version")
-           crateVersion = $(i+1)
+            crateVersion = $(i+1)
         if($i == "(crate-uri")
-           crateName = $(i+1)
+            crateName = $(i+1)
     }
     gsub(/)/, "", crateVersion)
     cargoLock = cargoLock "[[package]]\nname = " crateName "\nversion = " crateVersion "\n"
+    next
 }
 
-# The xxxx-cargo-input variables have a set style
-# TODO: Replace the last dash between the name and the version with a space!
-# This doesn't take into account swapping between "-" and "_" so we skip it.
-#( $2 ~ /-cargo-inputs/ ) {
-#    sub(/-cargo-inputs/, "", $2)
-#    gsub(/)/, "", $0)
-#    gsub(/rust-/, "", $0)
-#    #gensub(/([[:alpha:]])-([[:digit:]]+)/, "\\1 \\2", "g", $i)
-#    print "[[package]]\nname = \"" $2 "\"\nversion = \"1.0.0\"\ndependencies = ["
-#    for (i = 4; i <= NF; i++) {
-#        print "\"" $i "\","
-#    }
-#    print "]"
-#}
+# Parse the crates created from packages using 'cargo package'
+/package:rust/ {
+    pkg = $2
+    split(pkg, name_version, "-")
+    crateVersion = name_version[length(name_version)]
+    crateName = substr(pkg, 6, (length(pkg) - length(crateVersion) - 6))
+    split(crateVersion, versionDots, ".")
+    if(crateVersion && (crateVersion != "(git-version") && (length(versionDots) == 3) && crateName) {
+        cargoLock = cargoLock "[[package]]\nname = \"" crateName "\"\nversion = \"" crateVersion "\"\n"
+    } else {
+        untested++
+        #print("Unable to test " $0)
+    }
+    next
+}
 
-END { print cargoLock | cargoAudit }
+# We make an attempt to create the crate name from the package name otherwise
+/git-reference/ {
+    for(i=3; i <= NF; i++) {
+        if($i == "(version")
+            crateVersion = $(i+1)
+        if($i == "(name")
+            crateName = $(i+1)
+        if($i == "(git-file-name") {
+            crateName = $(i+1)
+            crateVersion = $(i+2)
+        }
+    }
+    gsub(/)/, "", crateVersion)
+    gsub(/)/, "", crateName)
+    sub(/rust-/, "", crateName)
+    # The crate version MUST be major.minor.patch
+    split(crateVersion, versionParts, ".")
+    if(crateVersion && (crateVersion != "(git-version") && (length(versionParts) == 3) && crateName) {
+        cargoLock = cargoLock "[[package]]\nname = " crateName "\nversion = " crateVersion "\n"
+    } else {
+        untested++
+        #print("Unable to test " $0)
+    }
+    next
+}
+
+# Note those which we were unable to parse
+/define rust/ {
+    if($3 == "#f)")
+        next
+    print("Unable to parse " $0)
+    }
+
+{ untested++ }
+
+END { print("Number of crates untested: " untested); print cargoLock | cargoAudit }

gnu/local.mk

@@ -610,6 +610,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/rocm-apps.scm			\
   %D%/packages/rocm-libs.scm			\
   %D%/packages/rocm-tools.scm			\
+  %D%/packages/rocq.scm				\
   %D%/packages/rpc.scm				\
   %D%/packages/rpm.scm				\
   %D%/packages/rrdtool.scm			\
@@ -1130,9 +1131,10 @@ dist_patch_DATA =						\
   %D%/packages/patches/clucene-gcc-14.patch			\
   %D%/packages/patches/clucene-pkgconfig.patch			\
   %D%/packages/patches/coda-use-system-libs.patch		\
-  %D%/packages/patches/codex-acp-0.9.2-remove-patch-sections.patch \
-  %D%/packages/patches/codex-acp-0.9.2-replace-result-flatten.patch    \
+  %D%/packages/patches/codex-acp-0.11.1-disable-code-mode.patch \
+  %D%/packages/patches/codex-acp-0.11.1-remove-patch-sections.patch \
   %D%/packages/patches/codex-0.98.0-remove-patch-sections.patch    \
+  %D%/packages/patches/rust-codex-0.117.0-remove-patch-sections.patch    \
   %D%/packages/patches/cogl-fix-double-free.patch		\
   %D%/packages/patches/collada-dom-boost.patch			\
   %D%/packages/patches/collectd-5.11.0-noinstallvar.patch	\
@@ -1466,7 +1468,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/ghostscript-no-header-creationdate.patch \
   %D%/packages/patches/gimp-fix-metadata-editor.patch		\
   %D%/packages/patches/gimp-fix-tiff-load.patch			\
-  %D%/packages/patches/git-clar-path-max.patch			\
   %D%/packages/patches/git-filter-repo-generate-doc.patch	\
   %D%/packages/patches/gklib-suitesparse.patch			\
   %D%/packages/patches/glib-appinfo-watch.patch			\
@@ -1616,7 +1617,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/hurd-refcounts-assert.patch		\
   %D%/packages/patches/hurd-rumpdisk-no-hd.patch		\
   %D%/packages/patches/hurd-startup.patch			\
-  %D%/packages/patches/hwloc-1-test-btrfs.patch			\
   %D%/packages/patches/hwloc-add-with-opencl.patch		\
   %D%/packages/patches/i3lock-blur-fix-build-on-gcc-10.patch	\
   %D%/packages/patches/i7z-gcc-10.patch				\
@@ -1652,6 +1652,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/id3lib-CVE-2007-4460.patch			\
   %D%/packages/patches/id3lib-UTF16-writing-bug.patch			\
   %D%/packages/patches/ilmbase-fix-tests.patch			\
+  %D%/packages/patches/inetutils-drop-test.patch                \
   %D%/packages/patches/inferno-fix-crash.patch		\
   %D%/packages/patches/iniparser-remove-fetchcontent-usage.patch		\
   %D%/packages/patches/inkscape-libxml2.patch		\
@@ -2394,6 +2395,11 @@ dist_patch_DATA =						\
   %D%/packages/patches/rust-codex-0.98.0-test-shebangs.patch	\
   %D%/packages/patches/rust-codex-0.98.0-test-timeout.patch	\
   %D%/packages/patches/rust-codex-0.98.0-windows-sandbox-protocol-version.patch	\
+  %D%/packages/patches/rust-codex-0.117.0-core-remove-self-dep.patch	\
+  %D%/packages/patches/rust-codex-0.120.0-core-remove-self-dep.patch	\
+  %D%/packages/patches/rust-codex-0.120.0-connectors-cache-test-race.patch	\
+  %D%/packages/patches/rust-codex-0.120.0-remove-libwebrtc.patch	\
+  %D%/packages/patches/rust-codex-0.120.0-test-timeout.patch	\
   %D%/packages/patches/rust-ring-0.17-ring-core.patch		\
   %D%/packages/patches/rw-igraph-0.10.patch			\
   %D%/packages/patches/rxvt-unicode-fix-cursor-position.patch	\

gnu/packages/admin.scm

@@ -1158,7 +1158,7 @@ on memory usage on GNU/Linux systems.")
 (define-public htop
   (package
     (name "htop")
-    (version "3.4.1")
+    (version "3.5.0")
     (source
      (origin
        (method git-fetch)
@@ -1166,7 +1166,7 @@ on memory usage on GNU/Linux systems.")
              (url "https://github.com/htop-dev/htop")
              (commit version)))
        (sha256
-        (base32 "058y4a4mvx9m179dyr4wi8mlm6i4ybywshadaj4cvfn9fv0r0nkx"))
+        (base32 "1r07ri0dl9xz0jn1hc2g8q3l0q4clvnxs05yagpzsz0zigp4flj5"))
        (file-name (git-file-name name version))))
     (build-system gnu-build-system)
     (arguments
@@ -1309,7 +1309,8 @@ re-executing them as necessary.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "11n01vsd51r7qraaaylhhx04hq4s6vcq0896zkz0yp1wvqfbwmm1"))))
+                "11n01vsd51r7qraaaylhhx04hq4s6vcq0896zkz0yp1wvqfbwmm1"))
+              (patches (search-patches "inetutils-drop-test.patch"))))
     (build-system gnu-build-system)
     (arguments
      (list
@@ -3441,7 +3442,7 @@ modules and plugins that extend Ansible.")
      (list ansible
            bash-minimal
            encfs
-           fuse-2
+           fuse
            util-linux ;; for umount
            findutils
            git
@@ -7169,6 +7170,35 @@ stored in an SQL database.")
 (connects via USB OTG).")
     (license license:expat)))
 
+(define-public yoctofetch
+  (package
+    (name "yoctofetch")
+    (version "2.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://codeberg.org/Phosphenius/yoctofetch.git")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0smkaydv74p2231gafibvqbwsy469w56hya8gz8wq0gw7m2l7zh3"))))
+    ; Support for other platforms not available per upstream:
+    ; https://codeberg.org/Phosphenius/yoctofetch#supported-platforms
+    (supported-systems '("x86_64-linux" "aarch64-linux"))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:tests? #f)) ; No tests available.
+    (home-page "https://codeberg.org/Phosphenius/yoctofetch")
+    (synopsis "Fast and low footprint system fetch tool for the Linux UAPI")
+    (description
+     "This package provides a system fetch tool, similar to
+@command{neofetch}, @command{fastfetch}, etc.  It is lightweight and
+has a focus on performance.  It can be used as a greeter by starting
+it from @file{~/.bashrc} for example.")
+    (license license:agpl3+)))
+
 (define-public zzz
   (package
     (name "zzz")

gnu/packages/audio.scm

@@ -6529,22 +6529,23 @@ on the ALSA software PCM plugin.")
 (define-public snd
   (package
     (name "snd")
-    (version "25.2")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "ftp://ccrma-ftp.stanford.edu/pub/Lisp/"
-                                  "snd-" version ".tar.gz"))
-              (sha256
-               (base32
-                "0fgxqk0byxdj6059mb9d5qic2dqjabz49j0szsrn2y3c9nz6iyq4"))))
+    (version "26.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://ccrma.stanford.edu/software/snd/snd-"
+                           version ".tar.gz"))
+       (sha256
+        (base32
+         "1d573mjlrn9rhl9g0a3d1rkar34q60ln8mwlbibfalpn8lsz59a0"))))
     (build-system gnu-build-system)
     (arguments
      (list
-      #:tests? #f                       ; no tests
-      #:out-of-source? #f               ; for the 'install-doc' phase
+      #:tests? #f                       ; No tests.
+      #:out-of-source? #f               ; Required by 'install-doc'.
       #:configure-flags
-      #~(let ((docdir (string-append #$output "/share/doc/"
-                                     #$name "-" #$version)))
+      #~(let
+            ((docdir (string-append #$output "/share/doc/snd-" #$version)))
           (list "--with-alsa"
                 "--with-jack"
                 "--with-gmp"
@@ -6552,18 +6553,20 @@ on the ALSA software PCM plugin.")
                 (string-append "--with-doc-dir=" docdir)))
       #:phases
       #~(modify-phases %standard-phases
-          (add-after 'install 'install-s7
+          (add-after 'install 'install-s7-h
             (lambda _
-              (install-file "s7.h" (string-append #$output "/include"))))
+              (install-file "s7.h" (string-append #$output
+                                                  "/include"))))
           (add-after 'install 'install-doc
             (lambda _
-              (let ((doc (string-append #$output "/share/doc/"
-                                        #$name "-" #$version)))
+              (let
+                  ((docdir (string-append #$output "/share/doc/snd-"
+                                          #$version)))
                 (for-each
                  (lambda (f)
-                   (install-file f doc))
+                   (install-file f docdir))
                  (find-files "." "\\.html$"))
-                (copy-recursively "pix" (string-append doc "/pix"))))))))
+                (copy-recursively "pix" (string-append docdir "/pix"))))))))
     (native-inputs
      (list pkg-config))
     (inputs
@@ -6582,13 +6585,16 @@ on the ALSA software PCM plugin.")
            timidity++
            vorbis-tools
            wavpack))
+    (home-page "https://ccrma.stanford.edu/software/snd/snd/snd.html")
     (synopsis "Sound editor")
-    (home-page "https://ccrma.stanford.edu/software/snd/")
     (description
      "Snd is a sound editor modelled loosely after Emacs.  It can be
 customized and extended using either the s7 Scheme implementation (included in
 the Snd sources), Ruby, or Forth.")
-    (license (license:non-copyleft "file://COPYING"))))
+    (license
+     ;; INFO: pkgsrc classifies this as `esdl-license', a license not included
+     ;; in OSI or FSF lists, despite being similar to ISC.
+     (license:non-copyleft "file://COPYING"))))
 
 (define-public libspecbleach
   (package

gnu/packages/axoloti.scm

@@ -341,7 +341,7 @@ runtime.")
        ("java-jgit" ,java-jgit-4.2)
        ("axoloti-runtime" ,axoloti-runtime)))
     (native-inputs
-     (list ant/java7 zip ; for repacking the jar
+     (list ant zip ; for repacking the jar
            unzip))
     (description
      "The Axoloti patcher offers a “patcher” environment similar to Pure Data
@@ -647,7 +647,7 @@ This package provides the runtime.")
        ("java-slf4j-api" ,java-slf4j-api)
        ("ksoloti-runtime" ,ksoloti-runtime)))
     (native-inputs
-     (list ant/java7 zip                      ;for repacking the jar
+     (list ant zip                      ;for repacking the jar
            unzip))
     (description
      "Ksoloti is an environment for generating and processing digital audio.

gnu/packages/bioinformatics.scm

@@ -913,7 +913,7 @@ suite native in R.")
 (define-public r-bpcells
   (package
     (name "r-bpcells")
-    (version "0.3.0")
+    (version "0.3.1")
     (source
      (origin
        (method git-fetch)
@@ -922,7 +922,7 @@ suite native in R.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "12h1di45fg06nhsliii7v0h1z567pkpis1xm4ar1qr8ns1n8iljw"))
+        (base32 "0yqgcajq83g25mznwcngaw7pi6vcqxqdnynpgb95yci57k3wrp6j"))
        (modules '((guix build utils)))
        (snippet
         '(delete-file-recursively "r/src/vendor/highway"))))
@@ -931,13 +931,15 @@ suite native in R.")
     (arguments
      (list
       #:phases
-      '(modify-phases %standard-phases
+      `(modify-phases %standard-phases
          (add-after 'unpack 'chdir
-           (lambda _
-             (substitute* "r/configure"
-               (("tools/hwy-test.cpp" m)
-                (string-append m " $HWY_LIBS $HWY_CFLAGS")))
-             (chdir "r"))))))
+           (lambda _ (chdir "r")))
+         ,@(if (target-x86-32?)
+               '((add-after 'chdir 'require-sse2
+                   ;; This avoids falling back to the scalar backend in
+                   ;; highway, which fails to build.
+                   (lambda _ (setenv "CFLAGS" "-msse2"))))
+               '()))))
     (propagated-inputs
      (list r-dplyr
            r-ggplot2
@@ -9283,7 +9285,7 @@ VCF.")
        ;; [testng] Exception in thread "main" java.lang.NoClassDefFoundError: com/beust/jcommander/ParameterException
        #:tests? #f
        #:jdk ,icedtea-8
-       #:ant ,ant
+       #:ant ,ant/java8
        ;; This is only used for tests.
        #:make-flags
        (list "-Dsamjdk.intel_deflater_so_path=lib/jni/libIntelDeflater.so")
@@ -9353,10 +9355,11 @@ VCF.")
      (list java-snappy-1
            java-commons-jexl-2
            java-cofoja
-           ant                          ;for bzip2 support at runtime
+           ant/java8                    ;for bzip2 support at runtime
            zlib))
     (native-inputs
      `(("ant-apache-bcel" ,ant-apache-bcel)
+       ("ant-junit" ,ant-junit)
        ("java-testng" ,java-testng)
        ("java-commons-bcel" ,java-commons-bcel)
        ("java-jcommander" ,java-jcommander)
@@ -22348,37 +22351,6 @@ combinatorial configurations.\", G. Ehrlich - Journal of the ACM (JACM),
 1973. (Algorithm 7.)")
     (license license:expat)))
 
-(define-public fsom
-  (let ((commit "a6ef318fbd347c53189384aef7f670c0e6ce89a3"))
-    (package
-      (name "fsom")
-      (version (git-version "0.0.0" "1" commit))
-      (source (origin
-        (method git-fetch)
-        (uri (git-reference
-              (url "https://github.com/ekg/fsom/")
-              (commit commit)))
-        (file-name (git-file-name name version))
-        (sha256
-         (base32 "0gw1lpvr812pywg9y546x0h1hhj261xwls41r6kqhddjlrcjc0pi"))))
-      (build-system gnu-build-system)
-      (arguments
-       `(#:tests? #f ; There are no tests to run.
-         #:phases
-         (modify-phases %standard-phases
-           (delete 'configure) ; There is no configure phase.
-           (replace 'install
-             (lambda* (#:key outputs #:allow-other-keys)
-               (let ((bin (string-append (assoc-ref outputs "out") "/bin")))
-                 (install-file "fsom" bin)))))))
-      (native-inputs
-       (list gcc-6))
-      (home-page "https://github.com/ekg/fsom")
-      (synopsis "Manage SOM (Self-Organizing Maps) neural networks")
-      (description "A tiny C library for managing SOM (Self-Organizing Maps)
-neural networks.")
-      (license license:gpl3))))
-
 (define-public fastahack
   (package
     (name "fastahack")

gnu/packages/build-tools.scm

@@ -275,14 +275,14 @@ generate such a compilation database.")
 (define-public bmake
   (package
     (name "bmake")
-    (version "20260313")
+    (version "20260406")
     (source
      (origin
        (method url-fetch)
        (uri (string-append
              "http://www.crufty.net/ftp/pub/sjg/bmake-" version ".tar.gz"))
        (sha256
-        (base32 "0xgryknmv625idw37rq89mpl5rymwdb15j5w8zxwy1gf8b6z7j3n"))
+        (base32 "09nzd9v12n2pwxmf67056kzjnvxcpk5q2x1fs5qkrsk1ssh5yvpd"))
        (patches (search-patches "bmake-run-check-separately.patch"))))
     (build-system gnu-build-system)
     (inputs

gnu/packages/c.scm

@@ -23,7 +23,7 @@
 ;;; Copyright © 2023, 2024 David Elsing <david.elsing@posteo.net>
 ;;; Copyright @ 2022, Kitzman <kitzman@disroot.org>
 ;;; Copyright @ 2025 Dariqq <dariqq@posteo.net>
-;;; Copyright © 2025 Ashish SHUKLA <ashish.is@lostca.se>
+;;; Copyright © 2025, 2026 Ashish SHUKLA <ashish.is@lostca.se>
 ;;; Copyright © 2026 Cayetano Santos <csantosb@inventati.org>
 ;;; Copyright © 2026 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;;
@@ -1762,7 +1762,7 @@ string.h, but with a utf8* prefix instead of the str* prefix.")
 (define-public simdutf
   (package
     (name "simdutf")
-    (version "7.7.1")
+    (version "9.0.0")
     (source
      (origin
        (method git-fetch)
@@ -1771,7 +1771,7 @@ string.h, but with a utf8* prefix instead of the str* prefix.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0kw4j4qqcfjaii667xa745pklj50m70nqq8cj5agj714acczbk7y"))))
+        (base32 "0f5ccvqj7pfa69m9y1kxp2v1lybx6x8i9pykdqfkr7dydqbhrhx6"))))
     (build-system cmake-build-system)
     (arguments (list #:configure-flags #~(list "-DBUILD_SHARED_LIBS=ON")))
     (synopsis "SIMD Unicode validation and transcoding")

gnu/packages/check.scm

@@ -3131,7 +3131,7 @@ time by mocking the datetime module.")
 (define-public python-flaky
   (package
     (name "python-flaky")
-    (version "3.8.1")
+    (version "3.8.1")  ; On bump, remove some skipped tests in python-cherrypy.
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "flaky" version))
@@ -3719,30 +3719,6 @@ system.  The code under test requires no modification to work with pyfakefs.")
 directories and files.")
     (license license:expat)))
 
-(define-public python-pytest-tornado5
-  (package
-    (name "python-pytest-tornado5")
-    (version "2.0.0")
-    (source (origin
-              (method url-fetch)
-              (uri (pypi-uri "pytest-tornado5" version))
-              (sha256
-               (base32
-                "0qb62jw2w0xr6y942yp0qxiy755bismjfpnxaxjjm05gy2pymr8d"))))
-    (build-system pyproject-build-system)
-    (arguments
-     ;; Tests require pytest < 6
-     (list #:tests? #f))
-    (propagated-inputs (list python-pytest python-tornado))
-    (native-inputs (list python-setuptools python-wheel))
-    (home-page "https://github.com/vidartf/pytest-tornado")
-    (synopsis
-     "Fixtures and markers to simplify testing of Tornado applications")
-    (description
-     "This package provides a @code{py.test} plugin supplying fixtures and
-markers to simplify testing of asynchronous tornado applications.")
-    (license license:asl2.0)))
-
 (define-public guile-proba
   (package
     (name "guile-proba")

gnu/packages/chemistry.scm

@@ -580,7 +580,7 @@ stored with user-specified precision.")
            python-sphinx))
     (inputs
      (list fftwf
-           `(,hwloc-2 "lib")
+           `(,hwloc "lib")
            libtirpc
            lmfit
            muparser

gnu/packages/codex.scm

@@ -18,10 +18,10 @@
 
 ;;; This module is separate from (gnu packages rust-apps) to avoid a
 ;;; circular module dependency: (gnu packages rust-sources), which
-;;; defines rust-codex-0.98.0, transitively loads (gnu packages
+;;; defines rust-codex-0.120.0, transitively loads (gnu packages
 ;;; rust-apps) through its #:use-module chain.  If the codex package
 ;;; lived in rust-apps.scm, loading rust-sources would trigger loading
-;;; rust-apps before rust-codex-0.98.0 is defined, causing an unbound
+;;; rust-apps before rust-codex-0.120.0 is defined, causing an unbound
 ;;; variable error.
 
 (define-module (gnu packages codex)
@@ -36,33 +36,41 @@
   #:use-module (gnu packages base)
   #:use-module (gnu packages cmake)
   #:use-module (gnu packages compression)
+  #:use-module (gnu packages linux)
   #:use-module (gnu packages libunwind)
   #:use-module (gnu packages llvm)
+  #:use-module (gnu packages lsof)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
   #:use-module (gnu packages rust-sources)
   #:use-module (gnu packages sqlite)
+  #:use-module (gnu packages textutils)
+  #:use-module (gnu packages nss)
   #:use-module (gnu packages tls)
-  #:use-module (gnu packages version-control))
+  #:use-module (gnu packages version-control)
+  #:use-module (gnu packages virtualization))
 
 (define-public codex
   (package
     (name "codex")
-    (version (package-version rust-codex-0.98.0))
+    (version (package-version rust-codex-0.120.0))
     (source
      (origin
-       (inherit (package-source rust-codex-0.98.0))
+       (inherit (package-source rust-codex-0.120.0))
        (patches (search-patches
-                 "codex-0.98.0-remove-patch-sections.patch"
+                 "codex-acp-0.11.1-disable-code-mode.patch"
+                 "rust-codex-0.117.0-remove-patch-sections.patch"
+                 "rust-codex-0.120.0-connectors-cache-test-race.patch"
+                 "rust-codex-0.120.0-remove-libwebrtc.patch"
                  "rust-codex-0.98.0-test-shebangs.patch"
-                 "rust-codex-0.98.0-test-timeout.patch"))))
+                 "rust-codex-0.120.0-test-timeout.patch"))))
     (build-system cargo-build-system)
     (arguments
      (list
       #:install-source? #f
       #:cargo-install-paths '(list "cli" "exec" "exec-server"
-                                   "linux-sandbox" "mcp-server" "network-proxy"
+                                   "linux-sandbox" "mcp-server"
                                    "app-server" "tui")
       ;; schema_fixtures_match_generated (upstream fixture is stale:
       ;; FileChange::Update in codex-protocol gained old_content,
@@ -71,72 +79,55 @@
       #:cargo-test-flags '(list "--workspace"
                                 "--exclude" "codex-app-server-protocol"
                                 "--"
-                                ;; These tests exercise sandbox denial and
-                                ;; escalation, which requires Landlock to
-                                ;; cleanly deny filesystem access.  Inside the
-                                ;; build container Landlock returns NotEnforced
-                                ;; and the sandbox binary panics instead.
-                                ;; Disabling Landlock would not help either,
-                                ;; since these tests need a working sandbox to
-                                ;; have anything to deny and escalate.
+                                ;;; BEGIN Landlock returns NotEnforced
+                                ;;; in the build container; the sandbox
+                                ;;; binary panics instead of cleanly
+                                ;;; denying filesystem access.
+                                ;; Sandbox denial and escalation tests.
                                 "--skip" "sandbox_denied_shell_returns_original_output"
+                                ;; Sandbox denial and escalation tests.
                                 "--skip" "shell_escalated_permissions_rejected_then_ok"
+                                ;; Sandbox denial and escalation tests.
                                 "--skip" "unified_exec_runs_under_sandbox"
-                                ;; These tests (in codex-exec) directly call
-                                ;; spawn_command_under_linux_sandbox to verify
-                                ;; that python and bash work correctly inside
-                                ;; the Landlock sandbox.  The sandbox binary
-                                ;; (codex-exec) panics with LandlockRestrict
-                                ;; (exit code 101) before the inner command
-                                ;; even starts.
+                                ;; codex-exec: spawn_command_under_linux_sandbox
+                                ;; panics with LandlockRestrict (exit 101).
                                 "--skip" "python_getpwuid_works_under_sandbox"
+                                ;; Same as above.
                                 "--skip" "python_multiprocessing_lock_works_under_sandbox"
+                                ;; Same as above.
                                 "--skip" "sandbox_distinguishes_command_and_policy_cwds"
-                                ;; These linux-sandbox tests directly invoke
-                                ;; the Landlock sandbox via
-                                ;; process_exec_tool_call; same root cause.
+                                ;; linux-sandbox: process_exec_tool_call
+                                ;; invokes Landlock; same panic.
                                 "--skip" "test_writable_root"
+                                ;; Same as above.
                                 "--skip" "test_timeout"
+                                ;; Same as above.
                                 "--skip" "test_root_read"
+                                ;; Same as above.
                                 "--skip" "test_dev_null_write"
+                                ;; Same as above.
                                 "--skip" "test_no_new_privs_is_enabled"
-                                ;; This test iterates many approval scenarios;
-                                ;; one of them
-                                ;; (danger_full_access_on_request_allows_network)
-                                ;; runs a command through the Landlock sandbox
-                                ;; binary, which panics with LandlockRestrict
-                                ;; inside the build container.  Cargo --skip
-                                ;; cannot target individual scenarios, so we
-                                ;; skip the entire matrix.
+                                ;; One scenario runs through Landlock
+                                ;; which panics; cargo --skip cannot
+                                ;; target individual scenarios.
                                 "--skip" "approval_matrix_covers_all_modes"
-                                ;; This test verifies session-level patch
-                                ;; approval caching: approve once, skip
-                                ;; future prompts for the same file.  When
-                                ;; Landlock is unavailable (as in the Guix
-                                ;; build container) the sandbox binary panics,
-                                ;; triggering the escalation-retry path, which
-                                ;; interferes with the approval cache and
-                                ;; causes a spurious re-prompt on the second
-                                ;; patch.
+                                ;; Landlock panic triggers escalation-retry
+                                ;; which interferes with the approval cache.
                                 "--skip" "approving_apply_patch_for_session_skips_future_prompts_for_same_file"
                                 ;; These tests expect to interrupt a
                                 ;; long-running 'sleep 60' and receive
-                                ;; TurnAborted.  Default test config is
-                                ;; OnRequest + ReadOnly.  What happens:
+                                ;; TurnAborted.  What happens:
                                 ;;
                                 ;; 1. ReadOnly wraps the command with
                                 ;;    codex-linux-sandbox (Landlock-based).
-                                ;; 2. Landlock is unavailable in the Guix
-                                ;;    build container, so the sandbox
-                                ;;    binary exits instantly (~1 ms).
+                                ;; 2. Landlock is unavailable, so the
+                                ;;    sandbox binary exits instantly.
                                 ;; 3. Orchestrator gets SandboxErr::Denied.
                                 ;;    wants_no_sandbox_approval(OnRequest)
-                                ;;    returns false (sandboxing.rs:222),
-                                ;;    so no escalation -- denial returned
-                                ;;    directly.
+                                ;;    returns false, so no escalation --
+                                ;;    denial returned directly.
                                 ;; 4. ToolEmitter::finish sends the error
-                                ;;    to the mock model as
-                                ;;    function_call_output.
+                                ;;    to the mock model.
                                 ;; 5. Second mock SSE response fires,
                                 ;;    turn finishes with TurnComplete.
                                 ;; 6. Op::Interrupt arrives 100 ms later,
@@ -150,74 +141,213 @@
                                 ;; has only one mock response (so the turn
                                 ;; cannot complete first).
                                 "--skip" "interrupt_persists_turn_aborted_marker_in_next_request"
+                                ;; Same causal chain as above.
                                 "--skip" "interrupt_tool_records_history_entries"
-                                ;; Upstream bug: test hardcodes "0.0.0" in the
-                                ;; expected user-agent string but the workspace
-                                ;; version is "0.98.0".
-                                "--skip" "get_user_agent_returns_current_codex_user_agent"
-                                ;; Same upstream bug: mcp-server tests
-                                ;; check the initialize response which
-                                ;; includes "version": "0.0.0" but the
-                                ;; server returns "0.98.0".
+                                ;; WorkspaceWrite sandbox policy wraps
+                                ;; commands with codex-linux-sandbox;
+                                ;; Landlock panics, command never runs,
+                                ;; exit_code is None instead of Some(0).
+                                "--skip" "request_permissions_grants_apply_to_later_exec_command_calls"
+                                ;; Same root cause.
+                                "--skip" "request_permissions_grants_apply_to_later_shell_command_calls"
+                                ;; Same root cause.
+                                "--skip" "partial_request_permissions_grants_do_not_preapprove_new_permissions"
+                                ;;; END Landlock
+                                ;;; BEGIN mcp_process.rs initialize
+                                ;;; assertion expects "version":"0.0.0"
+                                ;;; but the server returns "0.120.0".
                                 "--skip" "test_codex_tool_passes_base_instructions"
                                 "--skip" "test_shell_command_approval_triggers_elicitation"
                                 "--skip" "test_patch_approval_triggers_elicitation"
-                                ;; These codex-exec-server tests need
-                                ;; "dotslash", a Meta tool that lazily
-                                ;; downloads pre-built binaries from a
-                                ;; JSON manifest.  The test helper
-                                ;; create_transport runs
-                                ;; `dotslash -- fetch <path>` to obtain a
-                                ;; custom bash binary described in
-                                ;; exec-server/tests/suite/bash.
-                                ;; dotslash is not available in the build
-                                ;; container.
-                                "--skip" "list_tools"
-                                "--skip" "accept_elicitation_for_prompt_rule"
-                                ;;; Test isolation bug: each test in
-                                ;;; state/src/runtime.rs calls
-                                ;;; unique_temp_dir() to get its own
-                                ;;; temporary directory (and thus its
-                                ;;; own SQLite database).  That function
-                                ;;; names directories using the current
-                                ;;; nanosecond timestamp, so when tests
-                                ;;; run in parallel several can receive
-                                ;;; the same name and open the same
-                                ;;; database.  The initial SQLite
-                                ;;; migration runs CREATE TABLE threads
-                                ;;; (without IF NOT EXISTS), so any init
-                                ;;; after the first panics with "table
-                                ;;; threads already exists".  Any of
-                                ;;; these tests
-                                ;;; can be the victim.
+                                ;;; END version mismatch
+                                ;;; BEGIN Test isolation bug:
+                                ;;; unique_temp_dir() in
+                                ;;; state/src/runtime.rs names dirs
+                                ;;; using nanosecond timestamps, so
+                                ;;; parallel tests can collide.  The
+                                ;;; SQLite migration runs CREATE TABLE
+                                ;;; threads (without IF NOT EXISTS),
+                                ;;; so the second init panics with
+                                ;;; "table threads already exists".
                                 "--skip" "init_removes_legacy_state_db_files"
                                 "--skip" "upsert_and_get_thread_memory"
                                 "--skip" "get_last_n_thread_memories_for_cwd_matches_exactly"
                                 "--skip" "upsert_thread_memory_errors_for_unknown_thread"
                                 "--skip" "get_last_n_thread_memories_for_cwd_zero_returns_empty"
                                 "--skip" "get_last_n_thread_memories_for_cwd_does_not_prefix_match"
-                                "--skip" "deleting_thread_cascades_thread_memory")
+                                "--skip" "deleting_thread_cascades_thread_memory"
+                                ;;; END SQLite test isolation
+                                ;; The test spawns 'sh' after
+                                ;; env_clear() with an empty env map;
+                                ;; glibc execvp uses confstr(_CS_PATH)
+                                ;; ("/bin:/usr/bin") when PATH is
+                                ;; unset, but /bin/sh does not exist
+                                ;; in the build container.
+                                "--skip" "cancellation_expiration_keeps_process_alive_until_terminated"
+                                ;; Proxy baseline_policy returns 403
+                                ;; "not_allowed_local" for example.com;
+                                ;; test expects 200.
+                                "--skip" "managed_network_proxy_decider_survives_full_access_start"
+                                ;;; BEGIN bash_snapshot_script() uses
+                                ;;; "compgen -e" to list exports but
+                                ;;; bash-minimal lacks programmable
+                                ;;; completion; export section is empty.
+                                ;; stdout.contains("VALID_NAME") fails.
+                                "--skip" "bash_snapshot_filters_invalid_exports"
+                                ;; stdout.contains("MULTILINE_CERT") fails.
+                                "--skip" "bash_snapshot_preserves_multiline_exports"
+                                ;; snapshot.contains("PATH") fails.
+                                "--skip" "linux_bash_snapshot_includes_sections"
+                                ;;; END compgen
+                                ;; substitute* patches PAGER to store
+                                ;; path of cat; test expects bare "cat".
+                                "--skip" "unified_exec_env_injects_defaults"
+                                ;;; BEGIN V8 disabled (codex-code-mode
+                                ;;; default-features = false).
+                                "--skip" "suite::code_mode::"
+                                "--skip" "suite::js_repl::"
+                                "--skip" "suite::view_image::js_repl_"
+                                ;;; END V8 disabled
+                                ;;; BEGIN same compgen root cause:
+                                ;;; assert_posix_snapshot_sections
+                                ;;; asserts snapshot.contains("PATH").
+                                "--skip" "linux_shell_command_uses_shell_snapshot"
+                                "--skip" "linux_unified_exec_uses_shell_snapshot"
+                                "--skip" "shell_command_snapshot_still_intercepts_apply_patch"
+                                ;;; END compgen / shell snapshot
+                                ;;; BEGIN These sandbox tests set
+                                ;;; exclude_slash_tmp: true which makes
+                                ;;; bwrap exclude /tmp from its mount
+                                ;;; namespace.  Since Guix builds under
+                                ;;; /tmp, the codex-linux-sandbox binary
+                                ;;; becomes invisible to bwrap even though
+                                ;;; the test adds the helper dir as a
+                                ;;; filesystem carve-out -- the parent /tmp
+                                ;;; bind-mount is absent so the carve-out
+                                ;;; has nothing to carve out of.
+                                "--skip" "sandbox_reenables_writable_subpaths_under_unreadable_parents"
+                                "--skip" "managed_proxy_mode_routes_through_bridge_and_blocks_direct_egress"
+                                ;;; END exclude_slash_tmp
+                                ;; Expects 3 TerminalInteraction events
+                                ;; across timed poll windows; under CPU
+                                ;; contention events merge into 2.
+                                "--skip" "unified_exec_terminal_interaction_captures_delayed_output"
+                                ;;; BEGIN assert_parallel_duration
+                                ;;; requires < 1600 ms for parallel ops.
+                                ;; Two 300 ms test_sync_tool calls.
+                                "--skip" "read_file_tools_run_in_parallel"
+                                ;; Two "sleep 0.25" shell commands.
+                                "--skip" "shell_tools_run_in_parallel"
+                                ;; One test_sync_tool + one shell sleep.
+                                "--skip" "mixed_parallel_tools_run_in_parallel"
+                                ;;; END assert_parallel_duration
+                                ;; Asserts elapsed >= 4500 ms and
+                                ;; < 5800 ms for a 5 s timeout; under
+                                ;; contention elapsed drifts past 5800.
+                                "--skip" "remote_models_request_times_out_after_5s"
+                                ;; Queued inter-agent mail must be
+                                ;; injected between the reasoning/
+                                ;; commentary item and the gate release;
+                                ;; under contention the gate fires before
+                                ;; the mail is processed, so the snapshot
+                                ;; shows the stale function_call instead
+                                ;; of the expected mail message.
+                                "--skip" "queued_inter_agent_mail_triggers_follow_up_after_commentary_message_item"
+                                ;; Same root cause: snapshot mismatch at
+                                ;; pending_input.rs assert_two_responses_
+                                ;; input_snapshot; expects mail at position
+                                ;; 04 but gets function_call/shell instead.
+                                "--skip" "queued_inter_agent_mail_triggers_follow_up_after_reasoning_item"
+                                ;;; BEGIN DNS for hostnames like
+                                ;;; example.com fails in the build
+                                ;;; sandbox.  host_resolves_to_non_
+                                ;;; public_ip() in runtime.rs treats
+                                ;;; failed DNS as non-public and
+                                ;;; returns NotAllowedLocal, so tests
+                                ;;; expecting Allowed or Decider get
+                                ;;; Deny/BaselinePolicy instead.
+                                "--skip" "host_blocked_requires_allowlist_match"
+                                "--skip" "add_allowed_domain_removes_matching_deny_entry"
+                                "--skip" "host_blocked_subdomain_wildcards_exclude_apex"
+                                "--skip" "host_blocked_global_wildcard_allowlist_allows_public_hosts_except_denylist"
+                                "--skip" "evaluate_host_policy_emits_domain_event_for_decider_ask"
+                                "--skip" "evaluate_host_policy_emits_domain_event_for_decider_allow_override"
+                                "--skip" "http_connect_accept_blocks_in_limited_mode"
+                                "--skip" "http_connect_accept_allows_allowlisted_host_in_full_mode"
+                                "--skip" "mitm_policy_blocks_disallowed_method_and_records_telemetry"
+                                ;;; END DNS failure / NotAllowedLocal
+                                ;;; BEGIN Flaky: wiremock mock expects
+                                ;;; 1 POST to /codex/safety/arc but
+                                ;;; receives 0.  Passes in some builds,
+                                ;;; fails in others with identical code
+                                ;;; and env.  The identical custom_
+                                ;;; variant always passes; only the
+                                ;;; CODEX_APPS_MCP_SERVER_NAME variant
+                                ;;; flakes, suggesting a timing race
+                                ;;; in the async POST under contention.
+                                "--skip" "approve_mode_blocks_when_arc_returns_interrupt_for_model"
+                                "--skip" "approve_mode_blocks_when_arc_returns_interrupt_without_annotations"
+                                ;;; END ARC monitor flake
+                                ;;; BEGIN nss-certs sets SSL_CERT_FILE
+                                ;;; which makes build_reqwest_client load
+                                ;;; 171 CA certs via add_root_certificate.
+                                ;;; This changes the reqwest TLS backend
+                                ;;; configuration; the ARC safety POST to
+                                ;;; the localhost mock server never arrives
+                                ;;; (wiremock expects 1 request, gets 0).
+                                "--skip" "approve_mode_blocks_when_arc_returns_interrupt_for_model"
+                                "--skip" "approve_mode_blocks_when_arc_returns_interrupt_without_annotations"
+                                ;;; END nss-certs / ARC monitor
+                                ;; Upstream bug: JsonRpcConnection has
+                                ;; no websocket keepalive or read timeout.
+                                ;; When the exec-server is killed, the
+                                ;; client's reader task blocks on
+                                ;; websocket_reader.next() forever because
+                                ;; TCP doesn't detect the dead peer without
+                                ;; a write or keepalive probe.  Previously
+                                ;; masked because empty env made "sleep 10"
+                                ;; fail instantly; with PATH the process
+                                ;; lives long enough to hit the deadlock.
+                                "--skip" "remote_exec_process_reports_transport_disconnect"
+                                ;; 500 ms timeout on MCP list response
+                                ;; (mcp_server_status.rs timeout at
+                                ;; Duration::from_millis(500)).  With
+                                ;; nss-certs TLS now works, so the
+                                ;; startup plugin sync HTTP requests
+                                ;; (chatgpt.com, api.github.com) wait
+                                ;; for TCP timeout instead of failing
+                                ;; instantly at TLS, eating the budget.
+                                "--skip" "mcp_server_status_list_tools_and_auth_only_skips_slow_inventory_calls")
       #:cargo-package-crates
       ''(;;; Tier 0: No internal deps.
+         "codex-ansi-escape"
          "codex-async-utils"
+         "codex-backend-openapi-models"
          "codex-client"
          "codex-execpolicy"
          "codex-file-search"
-         "codex-git"
+         "codex-git-utils"
          "codex-keyring-store"
+         "codex-process-hardening"
          "codex-utils-absolute-path"
          "codex-utils-cache"
          "codex-utils-cargo-bin"
+         "codex-utils-elapsed"
+         "codex-utils-fuzzy-match"
          "codex-utils-home-dir"
          "codex-utils-json-to-toml"
+         "codex-utils-path"
+         "codex-utils-plugins"
          "codex-utils-pty"
          "codex-utils-readiness"
+         "codex-utils-rustls-provider"
+         "codex-utils-sleep-inhibitor"
+         "codex-utils-stream-parser"
          "codex-utils-string"
-         "codex-backend-openapi-models"
-         "codex-process-hardening"
-         "codex-ansi-escape"
-         ;;; Tier 1: Depends on tier 0.
+         "codex-utils-template"
+         ;;; Tier 1.
          "codex-utils-image"
+         "codex-utils-output-truncation"
          "codex-apply-patch"
          "codex-protocol"
          "codex-windows-sandbox"
@@ -226,35 +356,60 @@
          "codex-secrets"
          "codex-execpolicy-legacy"
          "codex-debug-client"
+         "codex-analytics"
+         "codex-rollout"
+         "codex-terminal-detection"
+         "codex-utils-approval-presets"
+         "codex-utils-cli"
          ;;; Tier 2.
          "codex-app-server-protocol"
          "codex-rmcp-client"
          "codex-otel"
          "codex-state"
-         "codex-core"
-         "codex-linux-sandbox"
+         "codex-features"
+         "codex-config"
+         "codex-hooks"
+         "codex-instructions"
+         "codex-code-mode"
          "codex-feedback"
+         "codex-skills"
+         "codex-core"
+         "codex-utils-sandbox-summary"
+         "codex-linux-sandbox"
+         "codex-sandboxing"
+         "codex-connectors"
+         "codex-core-skills"
          ;;; Tier 3.
          "codex-arg0"
          "codex-lmstudio"
          "codex-login"
          "codex-ollama"
-         "codex-common"
+         "codex-utils-oss"
          "codex-mcp-server"
          "codex-backend-client"
          "codex-responses-api-proxy"
+         "codex-shell-command"
+         "codex-shell-escalation"
+         "codex-plugin"
+         "codex-model-provider-info"
+         "codex-models-manager"
          ;;; Tier 4.
          "codex-cloud-requirements"
          "codex-exec"
          "codex-exec-server"
-         "codex-stdio-to-uds"
          "codex-network-proxy"
+         "codex-stdio-to-uds"
          "codex-chatgpt"
          "codex-cloud-tasks-client"
+         "codex-cloud-tasks-mock-client"
+         "codex-tools"
+         "codex-mcp"
+         "codex-collaboration-mode-templates"
          ;;; Tier 5.
          "codex-app-server"
          "codex-app-server-test-client"
          "codex-tui"
+         "codex-response-debug-context"
          ;;; Tier 6.
          "codex-cloud-tasks"
          ;; The main executable.
@@ -270,7 +425,7 @@
               ;; Update them to match the actual package version.
               (let ((snap-files (find-files "." "\\.snap$")))
                 (substitute* snap-files
-                  (("\\(v0\\.0\\.0\\) ") "(v0.98.0)")))))
+                  (("\\(v0\\.0\\.0\\)   ") "(v0.120.0) ")))))
           (add-after 'chdir-to-workspace 'patch-git-deps-to-vendor
             (lambda _
               ;; Replace git dependencies with version references so cargo
@@ -279,23 +434,34 @@
                 (("nucleo = \\{ git = [^}]+\\}")
                  "nucleo = \"0.5.0\"")
                 (("runfiles = \\{ git = [^}]+\\}")
-                 "runfiles = \"0.1.0\""))))
-          (add-after 'chdir-to-workspace 'add-version-to-workspace-deps
+                 "runfiles = \"0.1.0\""))
+              ;; Remove workspace members that have unbuildable deps
+              ;; (libwebrtc requires git fetch, v8-poc requires V8).
+              (substitute* "Cargo.toml"
+                (("\"v8-poc\",") "")
+                (("\"code-mode\",") ""))
+              ;; Disable V8 runtime in codex-code-mode: remove path
+              ;; so cargo resolves it from the vendor (where it has
+              ;; optional = true on v8) and disable default features.
+              (substitute* "Cargo.toml"
+                (("codex-code-mode = \\{ path = \"code-mode\" \\}")
+                 "codex-code-mode = { version = \"0.120.0\", default-features = false }"))))
+          (add-after 'patch-git-deps-to-vendor 'add-version-to-workspace-deps
             (lambda _
               ;; cargo package requires all dependencies to have versions.
               ;; cargo package requires all dependencies to have versions.
-              ;; Add version = "0.98.0" to internal path dependencies.
+              ;; Add version = "0.120.0" to internal path dependencies.
               (let ((cargo-files (find-files "." "^Cargo\\.toml$")))
                 (substitute* cargo-files
                   ;; Handle inline deps: name = { path = "..." }
                   (("(codex-[a-z0-9-]+) = \\{ path = " all name)
-                   (string-append name " = { version = \"0.98.0\", path = "))
+                   (string-append name " = { version = \"0.120.0\", path = "))
                   ;; Handle inline deps with package: name = { package = "...", path = "..." }
                   (("(codex-[a-z0-9-]+) = \\{ package = " all name)
-                   (string-append name " = { version = \"0.98.0\", package = "))
+                   (string-append name " = { version = \"0.120.0\", package = "))
                   ;; Handle section deps: [dependencies.X] with path = "..."
                   (("^(path = \"\\.\\./[^\"]*\")" all path-line)
-                   (string-append path-line "\nversion = \"0.98.0\""))))))
+                   (string-append path-line "\nversion = \"0.120.0\""))))))
           (add-after 'chdir-to-workspace 'patch-hardcoded-paths
             (lambda* (#:key inputs #:allow-other-keys)
               (let ((bash-bin (string-append
@@ -325,6 +491,14 @@
                    (string-append "\"" bash-bin "/bash "))
                   (("\"/bin/sh ")
                    (string-append "\"" bash-bin "/sh "))
+                  ;; Single-quoted paths in test assertion strings,
+                  ;; e.g. "exec '/bin/bash' -c ...".  Must match the
+                  ;; double-quoted substitutions above so both sides
+                  ;; of assert_eq!/contains use the store path.
+                  (("'/bin/bash'")
+                   (string-append "'" bash-bin "/bash'"))
+                  (("'/bin/sh'")
+                   (string-append "'" bash-bin "/sh'"))
                   ;; coreutils.
                   (("\"/bin/(cat|cp|date|echo|head|ls|rm|sleep|true|touch)\"" all cmd)
                    (string-append "\"" coreutils-bin "/" cmd "\""))
@@ -339,28 +513,120 @@
                    (string-append "\"" git-bin "/git\""))
                   (("\"/usr/bin/sed\"")
                    (string-append "\"" sed-bin "/sed\"")))
+                ;; Bare Command::new("git") and Command::new("ls")
+                ;; in codex source files that exec internally.
+                (substitute* (find-files "git-utils" "\\.rs$")
+                  (("Command::new\\(\"git\"\\)")
+                   (string-append "Command::new(\"" git-bin "/git\")")))
+                (substitute* "tui/src/get_git_diff.rs"
+                  (("Command::new\\(\"git\"\\)")
+                   (string-append "Command::new(\"" git-bin "/git\")")))
+                (substitute* "core/src/turn_diff_tracker.rs"
+                  (("Command::new\\(\"git\"\\)")
+                   (string-append "Command::new(\"" git-bin "/git\")")))
+                (substitute* "cloud-tasks/src/env_detect.rs"
+                  (("Command::new\\(\"git\"\\)")
+                   (string-append "Command::new(\"" git-bin "/git\")")))
+                (substitute* "core/src/plugins/startup_sync.rs"
+                  (("\"git\",")
+                   (string-append "\"" git-bin "/git\",")))
+                (substitute* "file-search/src/lib.rs"
+                  (("Command::new\\(\"ls\"\\)")
+                   (string-append "Command::new(\"" coreutils-bin "/ls\")")))
+                ;; Neutralize pager with absolute path to cat.
+                (substitute* "core/src/unified_exec/process_manager.rs"
+                  (("\"PAGER\", \"cat\"")
+                   (string-append "\"PAGER\", \"" coreutils-bin "/cat\""))
+                  (("\"GIT_PAGER\", \"cat\"")
+                   (string-append "\"GIT_PAGER\", \"" coreutils-bin "/cat\""))
+                  (("\"GH_PAGER\", \"cat\"")
+                   (string-append "\"GH_PAGER\", \"" coreutils-bin "/cat\"")))
+                ;; Bare /bin/sleep inside a format! string
+                ;; (no surrounding double quotes, so the main
+                ;; pattern does not match).
+                (substitute*
+                  "shell-escalation/src/unix/escalate_server.rs"
+                  (("/bin/sleep")
+                   (string-append coreutils-bin "/sleep")))
                 ;; @SHELL@ placeholder from test-shebangs patch
                 (substitute*
                   (list "rmcp-client/src/program_resolver.rs"
                         "tui/src/external_editor.rs")
                   (("@SHELL@")
                    (string-append bash-bin "/sh")))
-                ;; shebang in test-only file
+                ;; Shebangs inside raw string literals (r#"..."#)
+                ;; that are written to scripts at runtime.  The
+                ;; main "/bin/sh" patterns only match double-quoted
+                ;; occurrences; these shebangs have no surrounding
+                ;; double quotes.
                 (substitute*
-                  "core/tests/suite/user_notification.rs"
+                  (list "core/src/plugins/startup_sync_tests.rs"
+                        "core/tests/suite/client.rs"
+                        "core/tests/suite/js_repl.rs"
+                        "core/tests/suite/skill_approval.rs"
+                        "core/tests/suite/user_notification.rs"
+                        "login/src/auth/auth_tests.rs"
+                        "models-manager/src/manager_tests.rs"
+                        "sandboxing/src/bwrap_tests.rs")
                   (("#!/bin/bash")
-                   (string-append "#!" bash-bin "/bash"))))))
+                   (string-append "#!" bash-bin "/bash"))
+                  (("#!/bin/sh")
+                   (string-append "#!" bash-bin "/sh")))
+                ;; Test helpers pass env: Default::default() to the
+                ;; spawn code which calls env_clear(), leaving
+                ;; processes with no PATH.  Inject the build-time
+                ;; PATH so tests find coreutils, bash, etc.
+                (substitute* (find-files "." "\\.rs$")
+                  (("env: Default::default\\(\\)")
+                   (string-append
+                    "env: std::env::var(\"PATH\")"
+                    ".into_iter()"
+                    ".map(|p| (\"PATH\".to_string(), p))"
+                    ".collect()")))
+                ;; Test-only absolute path; bare name works via PATH.
+                (substitute* "exec-server/tests/exec_process.rs"
+                  (("\"/usr/bin/python3\"")
+                   "\"python3\""))
+                ;; Same empty-env issue but in JSON literals
+                ;; (serde_json::json! macro).
+                (substitute* "exec-server/tests/process.rs"
+                  (("\"env\": \\{\\}")
+                   (string-append
+                    "\"env\": {\"PATH\": \""
+                    (getenv "PATH")
+                    "\"}"))))))
+          (add-before 'build 'set-bubblewrap-source
+            (lambda* (#:key inputs #:allow-other-keys)
+              (setenv "CODEX_BWRAP_SOURCE_DIR"
+                      (string-append
+                       (assoc-ref inputs "bubblewrap-source")
+                       "/"))))
+          (add-before 'build 'create-node-version-file
+            (lambda _
+              (call-with-output-file "guix-vendor/node-version.txt"
+                (lambda (port)
+                  (display "22.22.0" port)))))
           (add-before 'check 'set-home
             (lambda _
-              (setenv "HOME" "/tmp")
+              ;; HOME must not be a prefix of /tmp, otherwise
+              ;; the TUI's path shortener replaces /tmp/... with
+              ;; ~/... and 30 snapshot tests fail.
+              (setenv "HOME" "/tmp/guix-home")
+              (mkdir-p "/tmp/guix-home")
               (setenv "USER" "nixbld"))))))
-    (native-inputs (list clang              ;bindgen uses libclang to parse BoringSSL's C headers
-                         cmake-minimal    ;BoringSSL is compiled from C source
-                         libunwind        ;BoringSSL tests verify stack unwinding in assembly
-                         perl python-minimal ;for tests
-                         pkg-config))
+    (native-inputs `(("bubblewrap" ,bubblewrap) ;tests need bwrap on PATH
+                     ("clang" ,clang)
+                     ("cmake-minimal" ,cmake-minimal)
+                     ("libunwind" ,libunwind)
+                     ("lsof" ,lsof)            ;app-server tests
+                     ("nss-certs-for-test" ,nss-certs-for-test) ;OTLP gRPC TLS
+                     ("perl" ,perl)
+                     ("procps" ,procps)         ;tests use ps
+                     ("python-minimal" ,python-minimal)
+                     ("pkg-config" ,pkg-config)
+                     ("bubblewrap-source" ,(package-source bubblewrap))))
     (inputs (cons* bash-minimal coreutils git-minimal sed
-                   openssl sqlite `(,zstd "lib")
+                   libcap oniguruma openssl sqlite zlib `(,zstd "lib")
                    (cargo-inputs 'codex)))
     (home-page "https://github.com/openai/codex")
     (synopsis "AI-assisted coding CLI and TUI")
@@ -368,13 +634,15 @@
      "Codex is an AI-powered coding assistant that runs in the terminal.
 It provides an interactive TUI for conversations with AI models, with
 support for shell command execution, file editing, and code generation.
-Configure providers via @file{~/.codex/config.toml}.")
+Configure providers via @file{~/.codex/config.toml}.
+
+codex-code-mode's V8 Javascript executor is disabled.")
     (license license:asl2.0)))
 
 (define-public codex-acp
   (package
     (name "codex-acp")
-    (version "0.9.2")
+    (version "0.11.1")
     (source
      (origin
        (method git-fetch)
@@ -383,9 +651,8 @@ Configure providers via @file{~/.codex/config.toml}.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "190sq6s6jfz8dkj1y8305r7x6ln86qqr2j1bnfjci7f1x2wyzmsj"))
-       (patches (search-patches "codex-acp-0.9.2-remove-patch-sections.patch"
-                                "codex-acp-0.9.2-replace-result-flatten.patch"))))
+        (base32 "1rlgkbvrbdl5jhf49sjn2mifn2rq6z0vwf0gard23y1bz6sr3wmr"))
+       (patches (search-patches "codex-acp-0.11.1-remove-patch-sections.patch"))))
     (build-system cargo-build-system)
     (arguments
      (list
@@ -393,13 +660,43 @@ Configure providers via @file{~/.codex/config.toml}.")
       #:phases
       #~(modify-phases %standard-phases
           (add-after 'unpack 'patch-codex-deps
-            (lambda _
+            (lambda* (#:key inputs #:allow-other-keys)
               ;; Rewrite git dependencies to use vendored sources from rust-codex
               (substitute* "Cargo.toml"
-                (("git = \"https://github.com/zed-industries/codex\", branch = \"acp\"")
-                 "version = \"0.0.0\"")))))))
-    (native-inputs (list pkg-config))
-    (inputs (cons* openssl sqlite `(,zstd "lib") (cargo-inputs 'codex-acp)))
+                (("git = \"https://github.com/openai/codex\", tag = \"rust-v0.117.0\"")
+                 "version = \"0.117.0\""))
+              ;; Disable V8 runtime in codex-code-mode (transitive dep).
+              (let ((port (open-file "Cargo.toml" "a")))
+                (display "
+[dependencies.codex-code-mode]
+version = \"0.117.0\"
+default-features = false
+" port)
+                (close-port port))
+              ;; Point codex-linux-sandbox at system bubblewrap source.
+              (setenv "CODEX_BWRAP_SOURCE_DIR"
+                      (string-append
+                       (assoc-ref inputs "bubblewrap-source")
+                       "/"))))
+          (add-before 'check 'set-home
+            (lambda _
+              (setenv "HOME" "/tmp")
+              (setenv "USER" "nixbld")))
+          (add-before 'build 'create-node-version-file
+            (lambda _
+              ;; codex-core's js_repl uses include_str! to read
+              ;; node-version.txt four directories up from its source;
+              ;; create it where the vendored crate expects it.
+              (call-with-output-file "guix-vendor/node-version.txt"
+                (lambda (port)
+                  (display "22.22.0" port))))))))
+    (native-inputs
+     `(("cmake-minimal" ,cmake-minimal)
+       ("clang" ,clang)
+       ("pkg-config" ,pkg-config)
+       ("bubblewrap-source" ,(package-source bubblewrap))))
+    (inputs (cons* libcap openssl sqlite zlib `(,zstd "lib")
+                   (cargo-inputs 'codex-acp)))
     (home-page "https://github.com/zed-industries/codex-acp")
     (synopsis "ACP-compatible agent bridging Zed Codex with ACP clients")
     (description

gnu/packages/containers.scm

@@ -150,7 +150,7 @@ as created by Podman, CRI-O and containerd.")))
 (define-public crun
   (package
     (name "crun")
-    (version "1.25.1")
+    (version "1.26")
     (source
      (origin
        (method url-fetch)
@@ -160,7 +160,7 @@ as created by Podman, CRI-O and containerd.")))
              "/crun-" version ".tar.gz"))
        (sha256
         (base32
-         "02kksvnja234k8mpq5j7yms8npbpvh8iz3k03h21lwcqzqsb88rx"))))
+         "1hdwk5dpsz9danxiyfli07b7sqid6hr34qmhs5qjl2dcc00is89j"))))
     (build-system gnu-build-system)
     (arguments
      (list

gnu/packages/cpp.scm

@@ -44,7 +44,7 @@
 ;;; Copyright © 2024 Jakob Kirsch <jakob.kirsch@web.de>
 ;;; Copyright © 2025 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;; Copyright © 2025 Sergio Pastor Pérez <sergio.pastorperez@gmail.com>
-;;; Copyright © 2025 Ashish SHUKLA <ashish.is@lostca.se>
+;;; Copyright © 2025, 2026 Ashish SHUKLA <ashish.is@lostca.se>
 ;;; Copyright © 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2025 Romain Garbage <romain.garbage@inria.fr>
 ;;; Copyright © 2024, 2025 Janneke Nieuwenhuizen <janneke@gnu.org>
@@ -3360,7 +3360,7 @@ which can evaluate Jsonnet files and expressions.")))
 (define-public simdjson
   (package
     (name "simdjson")
-    (version "3.13.0")
+    (version "4.6.3")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -3369,7 +3369,7 @@ which can evaluate Jsonnet files and expressions.")))
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "005yli56nrkvlyx9g9cq8dczk42r9a18l162i2s5k81lj3y7mcrp"))))
+                "0729mxnc2wjb94gr4znwlzfmgw5w2v9kd8glvn3vnjhkdnd87zry"))))
     (build-system cmake-build-system)
     (arguments
      '(#:tests? #f                      ; tests require downloading dependencies
@@ -3608,7 +3608,7 @@ std::wstring, etc).")
 (define-public fast-float
   (package
     (name "fast-float")
-    (version "8.0.2")
+    (version "8.2.5")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -3617,7 +3617,7 @@ std::wstring, etc).")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "19x1yklf641yrpad6lk4cq3jmird10d5ig8hicm3p9lxh92k78cl"))))
+                "1l13nsl4sgq71m7aifrmmmfyl14vp48vqdh7pb50hxqq6f8bq2b5"))))
     (build-system cmake-build-system)
     (arguments
      (list
@@ -3628,12 +3628,10 @@ std::wstring, etc).")
           (add-after 'unpack 'patch-cmake-tests
             (lambda* (#:key inputs native-inputs #:allow-other-keys)
               (substitute* "tests/CMakeLists.txt"
-                (("FetchContent_GetProperties\\(supplemental_test_files.*")
-                 "")
-                (("if\\(NOT supplemental_test_files_POPULATED.*")
+                (("FetchContent_MakeAvailable\\(supplemental_test_files.*")
                  (string-append
                   "set(supplemental_test_files_BINARY_DIR "
-                  #$fast-float-test-files ")\nif(0)\n"))))))))
+                  #$fast-float-test-files ")\n"))))))))
     (native-inputs (list doctest fast-float-test-files))
     (home-page "https://github.com/fastfloat/fast_float")
     (synopsis "Floating point number parser for C++")

gnu/packages/crypto.scm

@@ -276,18 +276,17 @@ Ed448-Goldilocks and Curve448, using the Decaf encoding.")
 (define-public libsodium
   (package
     (name "libsodium")
-    (version "1.0.18")
-    (source (origin
-            (method url-fetch)
-            (uri (list (string-append
-                        "https://download.libsodium.org/libsodium/"
-                        "releases/libsodium-" version ".tar.gz")
-                       (string-append
-                        "https://download.libsodium.org/libsodium/"
-                        "releases/old/libsodium-" version ".tar.gz")))
-            (sha256
-             (base32
-              "1h9ncvj23qbbni958knzsli8dvybcswcjbx0qjjgi922nf848l3g"))))
+    (version "1.0.22")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/jedisct1/libsodium")
+              (commit (string-append version "-RELEASE"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32
+         "05lqdn6nzldsia5mv5a9xfvc5k0kybh9snwv7qsb135gva4bpjwk"))))
     (build-system gnu-build-system)
     (synopsis "Portable NaCl-based crypto library")
     (description

gnu/packages/databases.scm

@@ -70,6 +70,7 @@
 ;;; Copyright © 2025 bdunahu <bdunahu@operationnull.com>
 ;;; Copyright © 2026 Spencer King <spencer.king@wustl.edu>
 ;;; Copyright © 2026 Peter Polidoro <peter@polidoro.io>
+;;; Copyright © 2026 Josep Bigorra <jjbigorra@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -126,6 +127,7 @@
   #:use-module (gnu packages gperf)
   #:use-module (gnu packages gtk)
   #:use-module (gnu packages guile)
+  #:use-module (gnu packages guile-xyz)
   #:use-module (gnu packages icu4c)
   #:use-module (gnu packages jemalloc)
   #:use-module (gnu packages language)
@@ -198,6 +200,7 @@
   #:use-module (guix build-system emacs)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system go)
+  #:use-module (guix build-system guile)
   #:use-module (guix build-system meson)
   #:use-module (guix build-system perl)
   #:use-module (guix build-system pyproject)
@@ -5046,6 +5049,54 @@ postgresql = postgresql://nixbld@/yoyo_test~%")))
 files or Python scripts that define a list of migration steps.")
     (license license:asl2.0)))
 
+(define-public mutastructura
+  (package
+    (name "mutastructura")
+    (version "0.6.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://codeberg.org/jjba23/mutastructura")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "08vzlc5imavqf3bdzgbh70c7z44xjhf05gr7i2g5ksl49lv39gzh"))))
+    (build-system guile-build-system)
+    (arguments
+     (list
+      #:source-directory "src"
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'build 'install-program-files
+            (lambda _
+              (let* ((bin (string-append #$output "/bin"))
+                     (share (string-append #$output "/share")))
+                (copy-recursively "resources"
+                                  (string-append share "/resources"))
+                (install-file "scripts/mutastructura" bin)
+                (install-file "scripts/log.bash"
+                              (string-append share "/scripts/"))
+                (chmod (string-append bin "/mutastructura") #o755)))))))
+    (native-inputs (list guile-3.0))
+    (propagated-inputs (list guile-dbi
+                             guile-dbd-mysql
+                             guile-dbd-sqlite3
+                             guile-dbd-postgresql
+                             guile-gcrypt))
+    (inputs (list guile-3.0 bash-minimal))
+    (home-page "https://codeberg.org/jjba23/mutastructura")
+    (synopsis "Relational database schema migrations powered by Guile Scheme")
+    (description
+     "Mutastructura provides a familiar, declarative and transactional
+approach to managing database states. It exposes a user-friendly 
+@acronym{CLI, command-line interface} and has support for PostgreSQL, MySQL, and SQLite.
+It also exposes library functions and can be imported and used directly from other Guile code.
+
+Features include executing migrations transactionally and computing SHA256
+checksums to track schema evolution in a @code{migrations_history} table.")
+    (license license:agpl3+)))
+
 (define-public python-mysqlclient
   (package
     (name "python-mysqlclient")

gnu/packages/disk.scm

@@ -31,7 +31,7 @@
 ;;; Copyright © 2023 Zheng Junjie <873216071@qq.com>
 ;;; Copyright © 2024-2025 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;; Copyright © 2025 Ashish SHUKLA <ashish.is@lostca.se>
-;;; Copyright © 2025 Vinicius Monego <monego@posteo.net>
+;;; Copyright © 2025, 2026 Vinicius Monego <monego@posteo.net>
 ;;; Copyright © 2025 Grigory Shepelev <shegeley@gmail.com>
 ;;; Copyright © 2026 Luis Guilherme Coelho <lgcoelho@disroot.org>
 
@@ -94,6 +94,8 @@
   #:use-module (gnu packages gnome)
   #:use-module (gnu packages gnupg)
   #:use-module (gnu packages golang-build)
+  #:use-module (gnu packages golang-check)
+  #:use-module (gnu packages golang-compression)
   #:use-module (gnu packages golang-xyz)
   #:use-module (gnu packages graphics)
   #:use-module (gnu packages gtk)
@@ -420,6 +422,49 @@ tables, and it understands a variety of different formats.")
 similarity.")
     (license license:gpl3+)))
 
+(define-public gdu
+  (package
+    (name "gdu")
+    (version "5.35.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/dundee/gdu")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "051xf3wncdiavjwyl9djmni5vd2dqjgn6drkw2nm21c9l0rjfv6d"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:install-source? #f
+      #:import-path "github.com/dundee/gdu/v5/cmd/gdu"
+      #:unpack-path "github.com/dundee/gdu/v5"))
+    (native-inputs
+     (list go-github-com-dgraph-io-badger-v4
+           go-github-com-fatih-color
+           go-github-com-gdamore-tcell-v2
+           go-github-com-h2non-filetype
+           go-github-com-maruel-natural
+           go-github-com-mattn-go-isatty
+           go-github-com-pkg-errors
+           go-github-com-rivo-tview
+           go-github-com-sirupsen-logrus
+           go-github-com-spf13-cobra
+           go-github-com-stretchr-testify
+           go-github-com-ulikunitz-xz
+           go-golang-org-x-sys
+           go-golang-org-x-text
+           go-gopkg-in-yaml-v3
+           go-modernc-org-sqlite))
+    (home-page "https://github.com/dundee/gdu")
+    (synopsis "Disk usage analyzer")
+    (description "Gdu is a disk usage analyzer written in Go.  It is intended
+primarily for SSD disks where it can fully utilize parallel processing, but it
+also works on HDDs.")
+    (license license:expat)))
+
 (define-public gpart
   ;; The latest (0.3) release is from 2015 and is missing a crash fix.
   (let ((commit "ec03350a01ad69708b5a3e2d47b8e002b0eba6c9")

gnu/packages/duckdb.scm

@@ -148,13 +148,13 @@ system.")
 (define-public r-duckdb
   (package
     (name "r-duckdb")
-    (version "1.5.1")
+    (version "1.5.2")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "duckdb" version))
        (sha256
-        (base32 "177621m08whqqk4yhj3zrr08l3d9hhlqh3gm9jzhi5cplg47cksq"))
+        (base32 "1dldlfwvc33czvlxfmwaj4p9y6sjjj5iqy98yda47a8kclrqmyam"))
        ;; This package bundles the duckdb sources and builds a custom variant
        ;; of duckdb.  I'd be happy to link it with our duckdb library instead,
        ;; but it does not seem possible to do that.

gnu/packages/elixir-i18n.scm

@@ -290,7 +290,7 @@ based upon the Common Locale Data Repository (CLDR).")
   (package
     (inherit elixir-ex-cldr-minimal)
     (name "elixir-ex-cldr")
-    (version "2.43.2")
+    (version "2.47.2")
     (source
      (origin
        ;; The hex.pm package ships only the en locale.
@@ -300,7 +300,7 @@ based upon the Common Locale Data Repository (CLDR).")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1wgwp74ya0gkvd5pk4qv9s38p85r5yw370y4wv7jywy3hrbrj9f5"))))
+        (base32 "1rivy61aq0c9zfklm4bpvvkj7lzjgy316rwxl8qz92xqp6xa292y"))))
     (arguments
      (list
       #:phases

gnu/packages/elixir-web.scm

@@ -303,7 +303,17 @@ purposes.  Its goal is to be as close as possible to
      (list
       #:test-flags
       ;; These tests require network access to badssl.com.
-      #~(list "--exclude" "network")))
+      #~(list "--exclude" "network")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'make-reproducible
+            (lambda _
+              ;; Buffer size has been increased in OTP 28+. For more info see:
+              ;; https://github.com/erlang/otp/issues/9722#issuecomment-2808683303
+              (substitute* "test/httpoison_test.exs"
+                (("stream/20") "stream/100")
+                (("<= expected_length") "<= expected_length * 1.1")
+                ((">= max_length") ">= max_length * 0.9")))))))
     (native-inputs
      (list erlang-cowboy
            elixir-earmark

gnu/packages/emacs-xyz.scm

@@ -56,7 +56,7 @@
 ;;; Copyright © 2019 Jelle Licht <jlicht@fsfe.org>
 ;;; Copyright © 2019 Björn Höfling <bjoern.hoefling@bjoernhoefling.de>
 ;;; Copyright © 2019 Stephen Webber <montokapro@gmail.com>
-;;; Copyright © 2019, 2021 Liliana Marie Prikler <liliana.prikler@gmail.com>
+;;; Copyright © 2019, 2021—2026 Liliana Marie Prikler <liliana.prikler@gmail.com>
 ;;; Copyright © 2019 David Wilson <david@daviwil.com>
 ;;; Copyright © 2020 Paul Garlick <pgarlick@tourbillion-technology.com>
 ;;; Copyright © 2020 Robert Smith <robertsmith@posteo.net>
@@ -147,7 +147,7 @@
 ;;; Copyright © 2024 Artyom V. Poptsov <poptsov.artyom@gmail.com>
 ;;; Copyright © 2024, 2025 Spencer King <spencer.king@wustl.edu>
 ;;; Copyright © 2024 emma thompson <bigbookofbug@proton.me>
-;;; Copyright © 2024-2025 Liam Hupfer <liam@hpfr.net>
+;;; Copyright © 2024-2026 Liam Hupfer <liam@hpfr.net>
 ;;; Copyright © 2024-2025 Alvin Hsu <aurtzy@gmail.com>
 ;;; Copyright © 2024 Olivier Rojon <o.rojon@posteo.net>
 ;;; Copyright © 2024 Divya Ranjan Pattanaik <divya@subvertising.org>
@@ -656,6 +656,30 @@ supported algorithm is chosen to ensure interoperability with
 Emacs Lisp.")
     (license license:gpl3)))
 
+(define-public emacs-org-arbeitszeit
+  (package
+    (name "emacs-org-arbeitszeit")
+    (version "0.0.5")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/bkaestner/org-arbeitszeit")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0krxainwpn7bnnvbrrhivmh302i9dyfixs6l5wb7xw7qpjgwqzc8"))))
+    (build-system emacs-build-system)
+    (arguments (list #:tests? #f))      ; no tests
+    (home-page "https://github.com/bkaestner/org-arbeitszeit")
+    (synopsis "Calculate your worktime")
+    (description
+     "This package provides a new dynamic block for Org called \"arbeitszeit\"
+(German for \"working hours\").  The dynamic block collects all clocked hours and
+provides a weekly table to quickly see your accumulated overtime.  To insert a
+new block, use @samp{M-x org-dynamic-block-insert-dblock}.")
+    (license license:gpl3+)))
+
 (define-public emacs-perl-doc
   (package
     (name "emacs-perl-doc")
@@ -834,7 +858,7 @@ input via a small child-frame spawned at the position of the cursor.")
 (define-public emacs-arei
   (package
     (name "emacs-arei")
-    (version "0.9.6")
+    (version "0.9.7")
     (source
      (origin
        (method git-fetch)
@@ -844,10 +868,13 @@ input via a small child-frame spawned at the position of the cursor.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "1m8ic5pcshz2y2maxvbgg70n4k2kgxvj98zisqal15j7djz0hzji"))))
+         "1fp4l8rzfd7cds80p8c9jgwwlb7rsw35djh0hs50g89h937w5s02"))))
     (build-system emacs-build-system)
-    (arguments (list #:tests? #f))      ; no tests
-    (propagated-inputs (list emacs-eros emacs-sesman emacs-queue))
+    (arguments
+     (list #:lisp-directory "lisp"
+           #:tests? #f))                ; no tests
+    (propagated-inputs
+     (list emacs-consult emacs-eros emacs-sesman emacs-queue))
     (home-page "https://git.sr.ht/~abcdw/emacs-arei")
     (synopsis "Asynchronous Reliable Extensible IDE")
     (description "Sleek Guile IDE for Emacs.")
@@ -13518,8 +13545,8 @@ for compilation, debugging, documentation lookup, and so on.")
     (license (list license:gpl2+ license:public-domain))))
 
 (define-public emacs-sliver
-  (let ((commit "d08d41947bb943f25ee2de9573459a6c720e027f")
-        (revision "0"))
+  (let ((commit "b4cb9cd2a810ba59c946e2592c4a4d56060a8d22")
+        (revision "1"))
     (package
       (name "emacs-sliver")
       ;; No tagged releases. Version comes from source code.
@@ -13532,7 +13559,7 @@ for compilation, debugging, documentation lookup, and so on.")
                 (commit commit)))
          (file-name (git-file-name name version))
          (sha256
-          (base32 "08qycim0mxyiqbik9hjlmzpdggl506bcsv1q1icxzd05bm73sh6n"))))
+          (base32 "1wddivmp5f4m6fdib96vfylqp4kgcw3ipdsi4b9w50dqzvrqrfjh"))))
       (build-system emacs-build-system)
       (arguments
        (list
@@ -15797,8 +15824,16 @@ versions utilizing Consult's internal API.")
     (arguments
      (list
       #:tests? #f                       ;no tests
-      #:include #~(cons "^extensions\\/consult-eglot-embark"
-                        %default-include)))
+      #:phases
+      #~(modify-phases %standard-phases
+          ;; Move the extensions source files to the top level, which is
+          ;; included in the EMACSLOADPATH.
+          (add-after 'unpack 'move-source-files
+            (lambda _
+              (let ((el-files (find-files "./extensions" ".*\\.el$")))
+                (for-each (lambda (f)
+                            (rename-file f (basename f)))
+                          el-files)))))))
     (propagated-inputs (list emacs-consult emacs-eglot emacs-embark))
     (home-page "https://github.com/mohkale/consult-eglot")
     (synopsis "Consulting-read interface for eglot")
@@ -25071,7 +25106,7 @@ lines, and @code{gc} to comment out the target of a motion.")
 (define-public emacs-eglot
   (package
     (name "emacs-eglot")
-    (version "1.21")
+    (version "1.23")
     (source
      (origin
        (method url-fetch)
@@ -25079,7 +25114,7 @@ lines, and @code{gc} to comment out the target of a motion.")
                            ".tar"))
        (sha256
         (base32
-         "03fx22rv8ijxq0jnn7xlfqhkpk2b109ygpjbcchp41sa4q7d6nbl"))))
+         "1l83c90rdamlk576bd859jkg6406hgxi7w4c6ixlw509c66qr3s6"))))
     (build-system emacs-build-system)
     (propagated-inputs
      (list emacs-eldoc
@@ -28516,7 +28551,7 @@ unstructured, meant for quick @code{JavaScript} experiments.")
 (define-public emacs-firefox-release-notes
   (package
     (name "emacs-firefox-release-notes")
-    (version "1.7")
+    (version "1.8")
     (source
      (origin
        (method git-fetch)
@@ -28527,7 +28562,7 @@ unstructured, meant for quick @code{JavaScript} experiments.")
           (commit version)))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1i9ncnn0qys0v0bqw87jwx0sa2g31n1i1gfr9zqdml3hakyz8b5f"))))
+        (base32 "13ymnx4vgiq5f3cjk3zddrq4xnv6116j5zzza67v98q7rsvzl049"))))
     (build-system emacs-build-system)
     (arguments
      (list
@@ -32038,6 +32073,31 @@ leverages the Parinfer Rust Emacs library to do most of the heavy lifting.")
 bookmarks and history.")
     (license license:gpl3+)))
 
+(define-public emacs-shr-syntax-highlight
+  (package
+    (name "emacs-shr-syntax-highlight")
+    (version "0.1.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://codeberg.org/coopi/emacs-shr-syntax-highlight")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "04ax8svpw2s0085pp93dsz5xhhbqr58ghkr1ab2g38pczlsbz18s"))))
+    (build-system emacs-build-system)
+    (home-page "https://codeberg.org/coopi/emacs-shr-syntax-highlight")
+    (synopsis "Syntax highlighting for code blocks rendered by shr")
+    (description
+     "This package adds syntax highlighting to @code{<pre>} code blocks
+rendered by @acronym{@code{shr}, Simple @acronym{HTML, HyperText Markup
+Language} Renderer}, used by @acronym{EWW, Emacs Web Wowser} and similar
+interfaces.  It reads @acronym{CSS, Cascading Style Sheets} class annotations
+such as @code{language-python} and fontifies block contents using the
+corresponding Emacs major mode.")
+    (license license:agpl3+)))
+
 (define-public emacs-stumpwm-mode
     (let ((commit "920f8fc1488f7953f205e1dda4c2ecbbbda56d6")
         (revision "3"))

gnu/packages/emulators.scm

@@ -3452,7 +3452,7 @@ This is a part of the TiLP project.")
 (define-public mame
   (package
     (name "mame")
-    (version "0.252")
+    (version "0.287")
     (source
      (origin
        (method git-fetch)
@@ -3461,16 +3461,16 @@ This is a part of the TiLP project.")
              (commit (apply string-append "mame" (string-split version #\.)))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "07qhcm1v47sy2wj30nx3cbhvcbgki0cl83gabr0miiw60fhgyn6j"))
+        (base32 "1p9v71gvaqiyj6sa1b0wkdksa9wnr6yr2a43ckycljjfas5s36kq"))
        (modules '((guix build utils)))
        (snippet
         ;; Remove bundled libraries.
         '(begin
            (with-directory-excursion "3rdparty"
              (for-each delete-file-recursively
-                       '("asio" "expat" "glm" "libflac" "libjpeg" "lua"
-                         "portaudio" "portmidi" "pugixml" "rapidjson" "SDL2"
-                         "SDL2-override" "sqlite3" "utf8proc" "zlib")))))))
+                       '("asio" "expat" "glm" "flac" "libjpeg" "lua"
+                         "portaudio" "portmidi" "pugixml" "rapidjson"
+                         "sqlite3" "utf8proc" "zlib")))))))
     (build-system gnu-build-system)
     (arguments
      (list
@@ -3604,7 +3604,9 @@ This is a part of the TiLP project.")
            libjpeg-turbo
            libxi
            libxinerama
-           lua
+           ;; MAME requires Lua compiled as C++ to work correctly.
+           ;; See https://www.mamedev.org/?p=523
+           lua-5.4-for-c++
            portaudio
            portmidi
            pugixml

gnu/packages/erlang.scm

@@ -50,7 +50,7 @@
 (define-public erlang
   (package
     (name "erlang")
-    (version "27.3.4.6")
+    (version "28.4.3")
     (source (origin
               (method git-fetch)
               ;; The tarball from http://erlang.org/download contains many
@@ -62,7 +62,7 @@
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "0dhz2c7w28ss0ypj7jh88pfs3kc8hbwiiq91in1j2miy5sn4cp3x"))
+                "1dsdmp2rccc0rhzy2w8r4amxmc6nr9hbi053j2s0bg9db30b48rc"))
               (patches (search-patches "erlang-man-path.patch"))))
     (build-system gnu-build-system)
     (native-inputs
@@ -75,7 +75,7 @@
                                "/OTP-" version "/otp_doc_man_" version ".tar.gz"))
            (sha256
             (base32
-             "1j1fcli7ma9vi4qyv67lq7yiznhpnfvcmh57bn8qxvha6ky2pngm"))))))
+             "1g17wzv8j12g9272yvv55nj4wqs09hxkv3i0vnp7d6gcs24bmphi"))))))
     (inputs
      (list ncurses openssl wxwidgets))
     (propagated-inputs

gnu/packages/fabric-management.scm

@@ -220,6 +220,7 @@ testing InfiniBand networks.")
                            "--disable-assertions"
                            "--disable-params-check"
 
+                           "--enable-mt"
                            (string-append "--with-verbs="
                                           #$(this-package-input "rdma-core"))
 

gnu/packages/finance.scm

@@ -165,7 +165,7 @@
   ;; <https://bitcoincore.org/en/lifecycle/#schedule>.
   (package
     (name "bitcoin-core")
-    (version "30.2")
+    (version "31.0")
     (source (origin
               (method url-fetch)
               (uri
@@ -173,7 +173,7 @@
                               version "/bitcoin-" version ".tar.gz"))
               (sha256
                (base32
-                "1jw4djh22v0nih0n7irdbknfbqavlc4l3b8176b5qgc88a60pl3g"))))
+                "1qxkcyq8nwq6sw4qi660z8n8356mqdsf4jvpq5ndkvrsx9gfz80b"))))
     (build-system qt-build-system)
     (arguments
      (list #:qtbase qtbase
@@ -197,9 +197,7 @@
                     "python3" "./test/functional/test_runner.py" "--timeout-factor=2"
                     (string-append "--jobs=" (number->string (parallel-job-count)))))))))
     (native-inputs
-     (list bash ; provides the sh command for system_tests
-           coreutils ; provides the cat, echo and false commands for system_tests
-           pkg-config
+     (list pkg-config
            python ; for the tests
            python-pyzmq ; for the tests
            qttools))

gnu/packages/fonts.scm

@@ -4658,46 +4658,6 @@ is a stylish type with a polished yet relaxed feel.  Its versatility makes it
 suitable for a wide range of uses.")
       (license license:silofl1.1))))
 
-(define-public font-cozette
-  (package
-    (name "font-cozette")
-    (version "1.13.0")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/slavfox/Cozette")
-                     (commit (string-append "v." version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "178i812n4sfsvid7jhnm683jlxqmrv4ck6qbb4nwyllhwg3gyq60"))))
-    (build-system font-build-system)
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'dont-depend-on-git
-           (lambda _
-             (substitute* "build.py"
-               ;; Merely importing this module requires a git repository.
-               ;; We don't use get_changelog, so just disable the import.
-               (("from cozette_builder\\.changeloggen import get_changelog")
-                ""))))
-         (add-before 'install 'build
-           (lambda _
-             (invoke "python3" "build.py" "fonts"))))))
-    (native-inputs
-     (list fontforge
-           python
-           python-crayons
-           python-fonttools
-           python-numpy
-           python-pillow))
-    (home-page "https://github.com/slavfox/Cozette")
-    (synopsis "Bitmap programming font")
-    (description "Cozette is a 6x13px (bounding box) bitmap font based on Dina
-and heavily inspired by Creep.")
-    (license license:expat)))
-
 (define-public font-montserrat
   (package
     (name "font-montserrat")

gnu/packages/freedesktop.scm

@@ -3454,7 +3454,7 @@ interfaces.")
                            (string-append (assoc-ref outputs "out")
                                           "/share/doc/" ,name)))))))
     (native-inputs
-     (list cmake-minimal pkg-config))
+     (list cmake-minimal pkg-config scdoc))
     (inputs (list elogind
                   bash-minimal
                   grim

gnu/packages/games.scm

@@ -5534,23 +5534,13 @@ falling, themeable graphics and sounds, and replays.")
     (build-system cmake-build-system)
     (arguments
      (list #:tests? #f                  ;no test target
-           #:configure-flags #~'("-DENABLE_SYSTEM_LUA=ON")
-           #:phases
-           #~(modify-phases %standard-phases
-               (add-before 'configure 'pre-configure
-                 (lambda _
-                   ;; XXX: Our Lua doesn't have a C++ library, force C linkage.
-                   (substitute* '("src/lua/wrapper_lua.h"
-                                  "src/lua/wrapper_lualib.h"
-                                  "src/lua/wrapper_lauxlib.h")
-                     (("#include \"(lua|lualib|lauxlib)\\.h\"")
-                      "#include \"lua.hpp\"")))))))
+           #:configure-flags #~'("-DENABLE_SYSTEM_LUA=ON")))
     (inputs
      (list boost-1.83
            curl
            dbus
            libvorbis
-           lua-5.4
+           lua-5.4-for-c++
            openssl
            pango
            sdl2
@@ -5937,7 +5927,7 @@ Transport Tycoon Deluxe.")
           (add-after 'unpack 'patch-sources
             (lambda* (#:key inputs #:allow-other-keys)
               (substitute* "src/music/fluidsynth.cpp"
-                (("default_sf\\[\\] = \\{" all)
+                (("_default_soundfonts\\[\\] = \\{" all)
                  (string-append all "
 \t/* Guix hardcoded :P */
 \t\"" (search-input-file inputs "/share/soundfonts/FreePatsGM.sf2") "\",
@@ -5964,7 +5954,7 @@ Transport Tycoon Deluxe.")
   (package
     (inherit openttd)
     (name "openttd-jgrpp")
-    (version "0.70.2")
+    (version "0.71.1")
     (source
      (origin
        (method git-fetch)
@@ -5973,7 +5963,7 @@ Transport Tycoon Deluxe.")
              (commit (string-append "jgrpp-" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1jzzvribf2cqvjl9cympyx9qpplljvmhqrrlw7aq4ckzl92d87z3"))))
+        (base32 "1cy1ghc1mc61hdz8lykx2ggs5nld30jdgj8y4vdli2v1ffhy7xy9"))))
     (inputs (modify-inputs inputs
               (append zstd harfbuzz)))
     (arguments

gnu/packages/geo.scm

@@ -425,14 +425,29 @@ hierarchical hexagonal geospatial indexing system")
                (base32
                 "00qdk9a4048pzfj2rhzkfw3lvm642znf6kr4x29i3d94494pxsnn"))))
     (build-system cmake-build-system)
-    (arguments `(#:phases
-                 (modify-phases %standard-phases
-                   (add-after
-                    'unpack 'patch-test-shebangs
-                    (lambda _
-                      (substitute* '("tests/xmltester/testrunner.sh"
-                                     "tests/xmltester/safe_to_xml.sh")
-                        (("/bin/sh") (which "sh"))))))))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         ,@(if (or (target-x86-32?) (target-arm32?))
+               '((add-after 'unpack 'disable-broken-tests
+                   (lambda _
+                     ;; This test fails due to limited accuracy.
+                     (delete-file "tests/xmltester/tests/general/TestCentroid.xml")
+                     (with-directory-excursion "tests/unit"
+                       ;; These also fail due to limited accuracy.
+                       (delete-file "algorithm/MinimumAreaRectangleTest.cpp")
+                       (delete-file "capi/GEOSMinimumRotatedRectangleTest.cpp")
+                       ;; It is unclear why these fail, but I'm guessing:
+                       ;; limited accuracy.
+                       (delete-file "linearref/LengthIndexedLineTest.cpp")
+                       (delete-file "math/DDTest.cpp")))))
+               '())
+         (add-after
+             'unpack 'patch-test-shebangs
+           (lambda _
+             (substitute* '("tests/xmltester/testrunner.sh"
+                            "tests/xmltester/safe_to_xml.sh")
+               (("/bin/sh") (which "sh"))))))))
     (inputs
      (list glib))
     (home-page "https://libgeos.org/")
@@ -955,6 +970,29 @@ hydrology and waste deposition.")
         (base32
          "03r6mspfv22fs4x4jcgv25v9gsj5k6zy8incvyf94qf50g47s2bc"))))
     (build-system cmake-build-system)
+    (arguments
+     (if (target-32bit?)
+         (list
+          #:phases
+          '(modify-phases %standard-phases
+             (add-after 'unpack 'patch-tests
+               (lambda _
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/unit/test_factory.cpp"
+                   (("^TEST\\(factory, AuthorityFactory_createUnitOfMeasure_linear_us_survey_foot\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_grids.cpp"
+                   (("^TEST_F\\(GridTest, VerticalShiftGridSet_gtx\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_defmodel.cpp"
+                   (("^TEST\\(defmodel, evaluator_horizontal_unit_metre\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/CMakeLists.txt"
+                   (("proj_add_gie_test\\(\"4D-API-cs2cs-style\".+") "")
+                   (("proj_add_gie_test\\(\"Builtins\".+") "")
+                   (("proj_add_gie_test\\(\"peirce_q\".+") ""))))))
+         '()))
     (native-inputs (list googletest pkg-config))
     (propagated-inputs (list curl libtiff sqlite)) ;required by proj.pc
     (home-page "https://proj.org/")
@@ -984,7 +1022,34 @@ lets developers use the functionality of Proj in their own software.")
                            version ".tar.gz"))
        (sha256
         (base32
-         "1g0hkpiablvhsmw0kn5frwgdir3q7avc45p6lc1zhhhzkv5ikydh"))))))
+         "1g0hkpiablvhsmw0kn5frwgdir3q7avc45p6lc1zhhhzkv5ikydh"))))
+    (arguments
+     (if (target-32bit?)
+         (list
+          #:phases
+          '(modify-phases %standard-phases
+             (add-after 'unpack 'patch-tests
+               (lambda _
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/unit/test_factory.cpp"
+                   (("^TEST\\(factory, AuthorityFactory_createUnitOfMeasure_linear_us_survey_foot\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_grids.cpp"
+                   (("^TEST_F\\(GridTest, VerticalShiftGridSet_gtx\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_defmodel.cpp"
+                   (("^TEST\\(defmodel, evaluator_horizontal_unit_metre\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/CMakeLists.txt"
+                   (("proj_add_gie_test\\(\"4D-API-cs2cs-style\".+") "")
+                   (("proj_add_gie_test\\(\"Builtins\".+") "")
+                   (("proj_add_gie_test\\(\"peirce_q\".+") "")
+                   (("proj_add_gie_test\\(\"adams_ws2\".+") ""))
+                 (substitute* "test/cli/CMakeLists.txt"
+                   (("proj_add_test_script_sh\\(\"testvarious\" CS2CS_BIN\\)") ""))))))
+         '()))))
+
 
 (define-public python-obspy
   (package

gnu/packages/gnuzilla.scm

@@ -605,9 +605,9 @@ in the case of Firefox, it is browser/locales/all-locales."
     "zh-TW"))
 
 ;;; Please keep these versions in sync with icedove.
-(define %icecat-base-version "140.9.1")
+(define %icecat-base-version "140.10.0")
 (define %icecat-version (string-append %icecat-base-version "-gnu1"))
-(define %icecat-build-id "20260414000000") ;must be of the form YYYYMMDDhhmmss
+(define %icecat-build-id "20260421000000") ;must be of the form YYYYMMDDhhmmss
 
 ;; 'icecat-source' is a "computed" origin that generates an IceCat tarball
 ;; from the corresponding upstream Firefox ESR tarball, using the 'makeicecat'
@@ -627,9 +627,9 @@ in the case of Firefox, it is browser/locales/all-locales."
                   "firefox-" upstream-firefox-version ".source.tar.xz"))
             (sha256
              (base32
-              "1hld2kbzvrmr7pqq0r5hw639xl8kw29lm2hsbn0m4kxang1fdlj5"))))
+              "06996548nfmn4r4mfw3wvgb1mp35majc5hjyhs1krgp33ck2m1f0"))))
 
-         (gnuzilla-commit "f3595923458a5255f61a3853bd83bb5f004dc3bc")
+         (gnuzilla-commit "02125f31250c0240ee2ab1aa629ce66d4ffb9f30")
          (gnuzilla-source
           (origin
             (method git-fetch)
@@ -640,7 +640,7 @@ in the case of Firefox, it is browser/locales/all-locales."
                                       (string-take gnuzilla-commit 8)))
             (sha256
              (base32
-              "03kc08cvmdv3sxihf5hfhw2k91mg1y6f46b3x47p7q98phgk03cv"))))
+              "1hgx286gp0j46pklzzh5kvsnari1j3s0bff384m505m942k6l4hf"))))
 
          ;; 'search-patch' returns either a valid file name or #f, so wrap it
          ;; in 'assume-valid-file-name' to avoid 'local-file' warnings.
@@ -1249,6 +1249,166 @@ testing.")
        (cpe-name . "firefox_esr")
        (cpe-version . ,(first (string-split version #\-)))))))
 
+;;; TEMPORARY old version of icecat-source for use by icedove until it is updated.
+(define %icecat-140.9.1-base-version "140.9.1")
+(define %icecat-140.9.1-version (string-append %icecat-140.9.1-base-version "-gnu1"))
+(define icecat-140.9.1-source
+  (let* ((major-version (first  (string-split %icecat-140.9.1-base-version #\.)))
+         (minor-version (second (string-split %icecat-140.9.1-base-version #\.)))
+         (sub-version   (third  (string-split %icecat-140.9.1-base-version #\.)))
+
+         (upstream-firefox-version (string-append %icecat-140.9.1-base-version "esr"))
+         (upstream-firefox-source
+          (origin
+            (method url-fetch)
+            (uri (string-append
+                  "https://ftp.mozilla.org/pub/firefox/releases/"
+                  upstream-firefox-version "/source/"
+                  "firefox-" upstream-firefox-version ".source.tar.xz"))
+            (sha256
+             (base32
+              "1hld2kbzvrmr7pqq0r5hw639xl8kw29lm2hsbn0m4kxang1fdlj5"))))
+
+         (gnuzilla-commit "f3595923458a5255f61a3853bd83bb5f004dc3bc")
+         (gnuzilla-source
+          (origin
+            (method git-fetch)
+            (uri (git-reference
+                  (url "git://git.savannah.gnu.org/gnuzilla.git")
+                  (commit gnuzilla-commit)))
+            (file-name (git-file-name "gnuzilla"
+                                      (string-take gnuzilla-commit 8)))
+            (sha256
+             (base32
+              "03kc08cvmdv3sxihf5hfhw2k91mg1y6f46b3x47p7q98phgk03cv"))))
+
+         ;; 'search-patch' returns either a valid file name or #f, so wrap it
+         ;; in 'assume-valid-file-name' to avoid 'local-file' warnings.
+         (makeicecat-patch
+          (local-file (assume-valid-file-name
+                       (search-patch "icecat-makeicecat.patch")))))
+
+    (origin
+      (method computed-origin-method)
+      (file-name (string-append "icecat-" %icecat-140.9.1-version ".tar.zst"))
+      (sha256 #f)
+      (uri
+       (delay
+        (with-imported-modules '((guix build utils))
+          #~(begin
+              (use-modules (guix build utils))
+              (let ((firefox-dir
+                     (string-append "firefox-" #$%icecat-140.9.1-base-version))
+                    (icecat-dir
+                     (string-append "icecat-" #$%icecat-140.9.1-version)))
+
+                (set-path-environment-variable
+                 "PATH" '("bin")
+                 (list #+python
+                       #+(canonical-package bash)
+                       #+(canonical-package coreutils)
+                       #+(canonical-package findutils)
+                       #+(canonical-package patch)
+                       #+(canonical-package xz)
+                       #+(canonical-package zstd)
+                       #+(canonical-package sed)
+                       #+(canonical-package grep)
+                       #+(canonical-package bzip2)
+                       #+(canonical-package gzip)
+                       #+(canonical-package tar)))
+
+                (set-path-environment-variable
+                 "PYTHONPATH"
+                 (list #+(format #f "lib/python~a/site-packages"
+                                 (version-major+minor
+                                  (package-version python))))
+                 '#+(cons python-jsonschema
+                          (map second
+                               (package-transitive-propagated-inputs
+                                python-jsonschema))))
+
+                ;; We copy the gnuzilla source directory because it is
+                ;; read-only in 'gnuzilla-source', and the makeicecat script
+                ;; uses "cp -a" to copy parts of it and assumes that the
+                ;; copies will be writable.
+                (copy-recursively #+gnuzilla-source "/tmp/gnuzilla"
+                                  #:log (%make-void-port "w"))
+
+                (with-directory-excursion "/tmp/gnuzilla"
+                  (make-file-writable "makeicecat")
+                  (invoke "patch" "--force" "--no-backup-if-mismatch"
+                          "-p1" "--input" #+makeicecat-patch)
+                  (patch-shebang "makeicecat")
+                  (substitute* "makeicecat"
+                    (("^readonly FFMAJOR=(.*)" all ffmajor)
+                     (unless (string=? #$major-version
+                                       (string-trim-both ffmajor))
+                       ;; The makeicecat script cannot be expected to work
+                       ;; properly on a different version of Firefox, even if
+                       ;; no errors occur during execution.
+                       (error "makeicecat major version mismatch"))
+                     (string-append "readonly FFMAJOR=" #$major-version "\n"))
+                    (("^readonly FFMINOR=.*")
+                     (string-append "readonly FFMINOR=" #$minor-version "\n"))
+                    (("^readonly FFSUB=.*")
+                     (string-append "readonly FFSUB=" #$sub-version "\n"))
+                    (("^readonly DATADIR=.*")
+                     "readonly DATADIR=/tmp/gnuzilla/data\n")
+                    (("^readonly SOURCEDIR=.*")
+                     (string-append "readonly SOURCEDIR=" icecat-dir "\n"))
+                    (("/bin/sed")
+                     #+(file-append (canonical-package sed) "/bin/sed"))))
+
+                (format #t "Unpacking upstream firefox tarball...~%")
+                (force-output)
+                (invoke "tar" "xf" #+upstream-firefox-source)
+                (rename-file firefox-dir icecat-dir)
+
+                (with-directory-excursion icecat-dir
+                  (format #t "Populating l10n directory...~%")
+                  (force-output)
+                  (mkdir "l10n")
+                  (with-directory-excursion "l10n"
+                    (for-each
+                     (lambda (locale)
+                       (let ((locale-dir (string-append #+mozilla-l10n "/"
+                                                        locale)))
+                         (format #t "  ~a~%" locale)
+                         (force-output)
+                         (copy-recursively locale-dir locale
+                                           #:log (%make-void-port "w"))
+                         (for-each make-file-writable (find-files locale))
+                         (with-directory-excursion locale
+                           (mkdir-p "browser/chrome/browser/preferences")
+                           (call-with-output-file "browser/chrome/browser/\
+preferences/advanced-scripts.dtd"
+                             (lambda (port) #f)))))
+                     '#+%icecat-locales)
+                    (copy-recursively #+mozilla-compare-locales
+                                      "compare-locales"
+                                      #:log (%make-void-port "w"))
+                    (delete-file "compare-locales/.gitignore")))
+
+                (format #t "Running makeicecat script...~%")
+                (force-output)
+                (invoke "bash" "/tmp/gnuzilla/makeicecat")
+
+                (format #t "Packing IceCat source tarball...~%")
+                (force-output)
+                (setenv "ZSTD_NBTHREADS" (number->string (parallel-job-count)))
+                (invoke "tar" "cfa" #$output
+                        ;; Avoid non-determinism in the archive.  We set the
+                        ;; mtime of files in the archive to early 1980 because
+                        ;; the build process fails if the mtime of source
+                        ;; files is pre-1980, due to the creation of zip
+                        ;; archives.
+                        "--mtime=@315619200" ; 1980-01-02 UTC
+                        "--owner=root:0"
+                        "--group=root:0"
+                        "--sort=name"
+                        icecat-dir)))))))))
+
+
 (define %icedove-build-id "20260403000000") ;must be of the form YYYYMMDDhhmmss
 ;;; See <https://product-details.mozilla.org/1.0/thunderbird_versions.json>
 ;;; for the source of truth regarding Thunderbird releases.
@@ -1383,7 +1543,7 @@ testing.")
                ;; Extract the base Icecat tarball, renaming its top-level
                ;; directory.
                (invoke "tar" "--transform" (string-append "s,[^/]*," #$name ",")
-                       "-xf" #$icecat-source)
+                       "-xf" #$icecat-140.9.1-source)
                (chdir #$name)
 
                ;; Merge the Thunderdbird localization data.

gnu/packages/golang-crypto.scm

@@ -31,6 +31,7 @@
 ;;; Copyright © 2025 Arthur Rodrigues <arthurhdrodrigues@proton.me>
 ;;; Copyright © 2025 Patrick Norton <patrick.147.norton@gmail.com>
 ;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2026 Evgeny Pisemsky <mail@pisemsky.site>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -2873,7 +2874,7 @@ package.")
 (define-public go-github-com-refraction-networking-utls
   (package
     (name "go-github-com-refraction-networking-utls")
-    (version "1.6.0")
+    (version "1.8.2")
     (source
      (origin
        (method git-fetch)
@@ -2882,7 +2883,7 @@ package.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1iywar5vqsml4b177k2nkcxmjm8mw92g3p112yjsrpmikiwpwpyw"))))
+        (base32 "03kgwxdm2lg28fn2w5q7ql2szsiwj2xjdf477h1g3a4a9y9j6zk0"))))
     (build-system go-build-system)
     (arguments
      `(#:import-path "github.com/refraction-networking/utls"
@@ -3640,6 +3641,39 @@ algorithm described in @url{https://rfc-editor.org/rfc/rfc2898.html,RFC 2898}
 and @url{https://rfc-editor.org/rfc/rfc8018.html,RFC 8018}.")
     (license license:asl2.0)))
 
+(define-public go-github-com-xtls-reality
+  (package
+    (name "go-github-com-xtls-reality")
+    (version "0.0.0-20260322125925-9234c772ba8f")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/xtls/reality")
+              (commit (go-version->git-ref version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1wncy5aph6nmq4814xjhj6b5p1wm2fyrqn83dw0xlyxvq2z6iqfs"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/xtls/reality"))
+    (propagated-inputs
+     (list go-github-com-cloudflare-circl
+           go-github-com-juju-ratelimit
+           go-github-com-pires-go-proxyproto
+           go-github-com-refraction-networking-utls
+           go-golang-org-x-crypto
+           go-golang-org-x-sys))
+    (home-page "https://github.com/xtls/reality")
+    (synopsis "Implementation of REALITY protocol")
+    (description
+     "This package provides an implementation of REALITY protocol, which is
+intented to eliminate the detectable TLS fingerprint on the server side, while
+still maintain the secrecy.  It achieves full real TLS that is
+undistingwishable with the specified SNI to the middleman.")
+    (license (list license:bsd-3 license:mpl2.0))))
+
 (define-public go-github-com-youmark-pkcs8
   (package
     (name "go-github-com-youmark-pkcs8")

gnu/packages/golang-web.scm

@@ -50,6 +50,7 @@
 ;;; Copyright © 2026 Carlos Durán Domínguez <wurt@wurt.eu>
 ;;; Copyright © 2026 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2026 Evgeny Pisemsky <mail@pisemsky.site>
+;;; Copyright © 2026 Vinicius Monego <monego@posteo.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -20005,6 +20006,36 @@ at
 Tracer implementation from the @code{OpenTracing} project.")
     (license license:asl2.0)))
 
+(define-public go-go-opentelemetry-io-contrib-zpages
+  (package
+    (name "go-go-opentelemetry-io-contrib-zpages")
+    (version "0.68.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/open-telemetry/opentelemetry-go-contrib")
+             (commit (go-version->git-ref version
+                                          #:subdir "zpages"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0nh7g1zxr3drqcbhsnnkqaz2hn1rnawg8jalixng23c9hwfgqaly"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:go go-1.25
+      #:import-path "go.opentelemetry.io/contrib/zpages"
+      #:unpack-path "go.opentelemetry.io/contrib"))
+    (native-inputs (list go-github-com-stretchr-testify))
+    (propagated-inputs (list go-go-opentelemetry-io-otel
+                             go-go-opentelemetry-io-otel-sdk
+                             go-go-opentelemetry-io-otel-trace))
+    (home-page "https://opentelemetry.io/")
+    (synopsis "Display telemetry stats")
+    (description "Package zPages implements a collection of HTML pages that
+display telemetry stats.")
+    (license license:asl2.0)))
+
 (define-public go-go-opentelemetry-io-otel
   (package
     (name "go-go-opentelemetry-io-otel")

gnu/packages/golang-xyz.scm

@@ -75,6 +75,7 @@
 ;;; Copyright © 2026 Carlos Durán Domínguez <wurt@wurt.eu>
 ;;; Copyright © 2026 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;; Copyright © 2026 Evgeny Pisemsky <mail@pisemsky.site>
+;;; Copyright © 2026 Vinicius Monego <monego@posteo.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -8036,7 +8037,7 @@ supports concurrent serializable transactions.")
   (package
     (inherit go-github-com-dgraph-io-badger)
     (name "go-github-com-dgraph-io-badger-v4")
-    (version "4.5.2")
+    (version "4.9.1")
     (source
      (origin
        (method git-fetch)
@@ -8045,7 +8046,7 @@ supports concurrent serializable transactions.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0v4c69whypm3k40hrx8bw9rjrcb0swz43v056s0fadqr04j0ncwj"))))
+        (base32 "0a9lk7fw06yb89wy9rp4q50ircw5imm1cqzhyhs92d0cia5qbhh6"))))
     (arguments
      (list
       #:tests? #f ; TODO: tests hang, find out why.
@@ -8058,7 +8059,8 @@ supports concurrent serializable transactions.")
            go-github-com-klauspost-compress
            go-github-com-pkg-errors
            go-github-com-spf13-cobra
-           go-go-opencensus-io
+           go-go-opentelemetry-io-contrib-zpages
+           go-go-opentelemetry-io-otel
            go-golang-org-x-net
            go-golang-org-x-sys
            go-google-golang-org-protobuf))))
@@ -17604,7 +17606,7 @@ implementing features like:
 (define-public go-github-com-maruel-natural
   (package
     (name "go-github-com-maruel-natural")
-    (version "1.1.1")
+    (version "1.3.0")
     (source
      (origin
        (method git-fetch)
@@ -17613,7 +17615,7 @@ implementing features like:
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "040aikizdd7c4zm8xindb2ps16s60i0fkf8gkll2rir7lwv6q7ks"))))
+        (base32 "1nr1ai3b7yvz4wz4k0jqvjq3978hpk9yxarn7g7i3d2sxbdc0g4q"))))
     (build-system go-build-system)
     (arguments
      (list
@@ -22786,16 +22788,16 @@ it is capable of logging at some or all levels.")
 (define-public go-github-com-rivo-tview
   (package
     (name "go-github-com-rivo-tview")
-    (version "0.0.0-20241227133733-17b7edb88c57")
+    (version "0.42.0")
     (source
      (origin
        (method git-fetch)
        (uri (git-reference
              (url "https://github.com/rivo/tview")
-             (commit (go-version->git-ref version))))
+             (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1w59vyvs8k5mzl7k39zpwcwwdgam2pbz0rnrfnnjgvkld1rh81dc"))))
+        (base32 "0jw47h92l0vp1lg6s5kng4hjv81hi8qxx9h5yilc7rzrr8l9ksd2"))))
     (build-system go-build-system)
     (arguments
      (list #:import-path "github.com/rivo/tview"))

gnu/packages/groovy.scm

@@ -412,7 +412,7 @@ similar to javadoc."))))
       (inherit base)
       (arguments
        `(;#:tests? #f;Requires spock-framework which is a circular dependency
-         #:ant ,ant; ant is actually a dependency of this package, and we need 1.10
+         #:ant ,ant/java8; ant is actually a dependency of this package, and we need 1.10
          ,@(substitute-keyword-arguments arguments
              ((#:phases phases)
               `(modify-phases ,phases
@@ -431,7 +431,8 @@ similar to javadoc."))))
          ("java-asm-analysis" ,java-asm-analysis-8)
          ,@(package-inputs base)))
       (native-inputs
-       `(("groovy-bootstrap" ,groovy-bootstrap)
+       `(("ant-junit" ,ant-junit)
+         ("groovy-bootstrap" ,groovy-bootstrap)
          ("groovy-xml" ,groovy-xml)
          ("groovy-test" ,groovy-test)
          ("groovy-tests-bootstrap" ,groovy-tests-bootstrap)

gnu/packages/guile-xyz.scm

@@ -60,6 +60,7 @@
 ;;; Copyright © 2025 Andy Tai <atai@atai.org>
 ;;; Copyright © 2025 Ekaitz Zarraga <ekaitz@elenq.tech>
 ;;; Copyright © 2026 Matt Wette <matt.wette@gmail.com>
+;;; Copyright © 2026 Dzianis Jackievič <mail@miesta.by>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1167,7 +1168,7 @@ is not available for Guile 2.0.")
   (package
     (inherit guile-fibers-1.3)
     (name "guile-fibers")
-    (version "1.4.2")
+    (version "1.4.3")
     (source
      (origin (inherit (package-source guile-fibers-1.3))
              (file-name (git-file-name name version))
@@ -1176,7 +1177,7 @@ is not available for Guile 2.0.")
                     (commit (string-append "v" version))))
              (sha256
               (base32
-               "0qh0czz5qvk5mmrc8x2gmvl5psdfd22q2rhzj4jrpan6k3d55bl8"))
+               "1q0a9y0cc8rld1z7mcj61fkldhd0kn9n4yq25izxslbgg4g5h9j6"))
              (patches '())))
     (arguments
      (if (target-aarch64?)
@@ -1256,30 +1257,8 @@ is not available for Guile 2.0.")
      (modify-inputs native-inputs
        (replace "guile" guile-2.2)))))
 
-(define-public guile-fibers-next
-  (let ((commit "297359f0ad655378bcc3ff0d4e96101965ef39b4")
-        (revision "0"))
-    (package
-      (inherit guile-fibers)
-      (name "guile-fibers-next")
-      (version (git-version "1.4.2"
-                            revision
-                            commit))
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://codeberg.org/guile/fibers.git")
-                      (commit commit)))
-                (file-name (git-file-name name version))
-                (sha256
-                 (base32
-                  "0qh0czz5qvk5mmrc8x2gmvl5psdfd22q2rhzj4jrpan6k3d55bl8"))))
-      (inputs
-       (modify-inputs inputs
-         (replace "guile" guile-next)))
-      (native-inputs
-       (modify-inputs native-inputs
-         (replace "guile" guile-next))))))
+;; Deprecated on 2026-04-23
+(define-deprecated-package guile-fibers-next guile-fibers)
 
 (define-public guile-kracht
   (package
@@ -1537,7 +1516,7 @@ order to provide IDE functionality for Guile Scheme.")
 (define-public guile-ares-rs
   (package
     (name "guile-ares-rs")
-    (version "0.9.6")
+    (version "0.9.7")
     (source
      (origin
        (method git-fetch)
@@ -1547,35 +1526,42 @@ order to provide IDE functionality for Guile Scheme.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "1vkww3vc0lsh5f8yh6fnh402rx3rsm0ss69rdkmplhzp4c7c4z1d"))))
+         "1xbznh5zjswfydgqg53g50ya7zm0hidin74g2glk849l9j45szw3"))))
     (build-system guile-build-system)
     (arguments
      (list
       #:source-directory "src/guile"
       #:phases
       #~(modify-phases %standard-phases
-          (add-after 'build 'install-script
+          (add-after 'build 'install-scripts
             (lambda _
-              (let* ((bin (string-append #$output "/bin"))
-                     (oldpath (string-append
-                               #$output
-                               ;; This file will be named ares-nrepl.scm for
-                               ;; the next version.
-                               "/share/guile/site/3.0/ares/scripts/ares.scm"))
-                     (newpath (string-append bin "/ares-nrepl")))
-                (mkdir bin)
-                (symlink oldpath newpath)
-                (wrap-program newpath
-                  `("GUILE_LOAD_PATH" ":" =
-                    ,(list (string-append #$output "/share/guile/site/3.0")
-                           (getenv "GUILE_LOAD_PATH")))
-                  `("GUILE_LOAD_COMPILED_PATH" ":" =
-                    ,(list (string-append #$output "/lib/guile/3.0/site-ccache")
-                           (getenv "GUILE_LOAD_COMPILED_PATH"))))
-                ;; Not needed since the wrapper followed the symlink.
-                (delete-file (string-append bin "/.ares-nrepl-real"))))))))
-    (inputs (list bash-minimal guile-3.0))
-    (propagated-inputs (list guile-fibers guile-custom-ports))
+              (define bin (string-append #$output "/bin"))
+              (define site (string-append #$output "/share/guile/site/3.0"))
+              (define ccache
+                (string-append #$output "/lib/guile/3.0/site-ccache"))
+
+              (define (install-script name)
+                (let ((oldpath
+                       (string-append site "/ares/scripts/" name ".scm"))
+                      (newpath
+                       (string-append bin "/" name)))
+                  (symlink oldpath newpath)
+                  (wrap-program newpath
+                    `("GUILE_LOAD_PATH" ":" =
+                      ,(list "$GUILE_LOAD_PATH"
+                             site
+                             (getenv "GUILE_LOAD_PATH")))
+                    `("GUILE_LOAD_COMPILED_PATH" ":" =
+                      ,(list "$GUILE_LOAD_COMPILED_PATH"
+                             ccache
+                             (getenv "GUILE_LOAD_COMPILED_PATH"))))
+                  ;; Not needed since the wrapper followed the symlink.
+                  (delete-file (string-append bin "/." name "-real"))))
+
+              (mkdir bin)
+              (for-each install-script '("ares-nrepl" "ares-suitbl")))))))
+    (inputs (list bash-minimal guile-3.0-latest))
+    (propagated-inputs (list guile-fibers))
     (home-page "https://git.sr.ht/~abcdw/guile-ares-rs")
     (synopsis "Asynchronous Reliable Extensible Sleek RPC Server for Guile")
     (description "Asynchronous Reliable Extensible Sleek RPC Server for
@@ -5707,27 +5693,32 @@ perform geometrical transforms on JPEG images.")
       (license license:gpl3+))))
 
 (define-public guile-jtd
-  (package
-    (name "guile-jtd")
-    (version "220323a")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                    (url "https://github.com/mwette/guile-jtd")
-                    (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "1l8fyqhvksarvpbr903i3ss3432jzvyvhgcqa15j922ngqh4ds6f"))))
-    (build-system guile-build-system)
-    (native-inputs (list guile-3.0))
-    (home-page "https://github.com/mwette/guile-jtd")
-    (synopsis "Python's @code{pdb.set_trace()} but for Guile")
-    (description
-     "The @code{(jtd)} module for Guile provides a procedure
+  ;; There are a few unreleased commits that include niceties such as warning
+  ;; that the debug VM must be used; use the latest commit until the next
+  ;; release comes.
+  (let ((commit "425f86ae954d6445aaedacfd4ecd50aa0022e59d")
+        (revision "0"))
+    (package
+      (name "guile-jtd")
+      (version (git-version "220323a" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                       (url "https://github.com/mwette/guile-jtd")
+                       (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "1l8fyqhvksarvpbr903i3ss3432jzvyvhgcqa15j922ngqh4ds6f"))))
+      (build-system guile-build-system)
+      (native-inputs (list guile-3.0))
+      (home-page "https://github.com/mwette/guile-jtd")
+      (synopsis "Python's @code{pdb.set_trace()} but for Guile")
+      (description
+       "The @code{(jtd)} module for Guile provides a procedure
 @code{jump-to-debugger} for escaping to the Guile REPL for the purpose of
 debugging code.")
-    (license license:lgpl2.1+)))
+      (license license:lgpl2.1+))))
 
 (define-public guile-png
   (package
@@ -6399,6 +6390,88 @@ as signed sessions, multipart message support, etc.")
     (propagated-inputs
      (list guile2.2-irregex guile2.2-gcrypt))))
 
+(define-public guile-compose
+  (package
+    (name "guile-compose")
+    (version "0.1.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://codeberg.org/jadzi/guile-compose.git")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1g68gczs96nrb0vf1hv4n07zsp2516gpiwq1wwlhcq4rzynhf12h"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:make-flags
+      #~'("GUILE_AUTO_COMPILE=0")))
+    (inputs (list guile-3.0))
+    (native-inputs (list autoconf-2.72 automake pkg-config guile-3.0 texinfo))
+    (synopsis "Procedure composition utilities for Guile Scheme")
+    (description
+     "This tiny package provides some procedures and macros to extend
+Guile Scheme procedure composition facilities.  For example, there is
+a @code{compose-top}, a reverse-order analog to native @code{compose}
+procedure.  The @code{compose-cont} is a macro, utilizing some power of
+continuations to build really flexible flows.
+
+This library is intended to stay basic and small, so it has no any
+external dependencies and can be a good base for other packages, like e.g.
+@code{guile-web-middleware}.")
+    (license (list license:lgpl3+))
+    (home-page "https://jadzi.codeberg.page/guile-compose")))
+
+(define-public guile-web-middleware
+  (package
+    (name "guile-web-middleware")
+    (version "0.11.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://codeberg.org/jadzi/guile-web-middleware.git")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "01wb8v0lszphdv08ly4aqv59qm5h8yw2fgm025vkn61djspsq4j9"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:make-flags
+      #~'("GUILE_AUTO_COMPILE=0")))
+    (inputs (list guile-3.0))
+    (propagated-inputs (list guile-compose))
+    (native-inputs (list autoconf-2.72 automake pkg-config guile-3.0 texinfo))
+    (synopsis "Web application middleware composition for Guile Scheme")
+    (description
+     "This package provides means to compose a web application by
+chaining procedures, a.k.a. middlewares.  By those means, composed
+procedures form a standard request handler for any Guile's web server
+implementation.
+
+Each middleware has its own limited responsibility in request
+processing.  Also, middlewares are simple Scheme procedures, so they
+can be easily tested and shared among web applications.
+
+Out of the box, this package provides several procedures for commonly
+required tasks.  Among them:
+
+@itemize
+@item Error handling with customizable page contents.
+@item Request filtering.
+@item Request logging.
+@item Serving static files, file URL generation.
+@item Request routing, handling parameters, route URL generation.
+@item Middleware nesting, composing whole apps.
+@end itemize
+
+This package relies on @code{guile-compose} package as its only dependency.")
+    (license (list license:lgpl3+))
+    (home-page "https://jadzi.codeberg.page/guile-web-middleware")))
+
 (define-public guile-web-driver-ng
   (package
     (name "guile-web-driver-ng")
@@ -7716,13 +7789,13 @@ is an attempt to combine both into something useful.")
      (list pkg-config
            autoconf
            automake
-           guile-next
+           guile-3.0-latest
            guile-lib
-           guile-fibers-next))
+           guile-fibers))
     (inputs
-     (list guile-next))
+     (list guile-3.0-latest))
     (propagated-inputs
-     (list guile-fibers-next))
+     (list guile-fibers))
     (home-page "https://cbaines.codeberg.page/guile-knots/")
     (synopsis "Patterns and functionality to use with Guile Fibers")
     (description
@@ -8018,14 +8091,14 @@ application to open a given file or URL based on given configurations.")
 (define-public guile-goblins
   (package
     (name "guile-goblins")
-    (version "0.17.0")
+    (version "0.18.0")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://files.spritely.institute/releases"
                            "/guile-goblins/guile-goblins-" version ".tar.gz"))
        (sha256
-        (base32 "16jkmfspsnza2fdk5jr05a5pfh7x856gpg031i21s1yvy43l8mi0"))))
+        (base32 "0gj5018wmq97ln1z7x03a13z3p35xc8762id9bl9fgkxwm01df1a"))))
     (build-system gnu-build-system)
     (arguments
      (list

gnu/packages/guile.scm

@@ -653,7 +653,10 @@ GNU@tie{}Guile.  Use the @code{(ice-9 readline)} module and call its
 (define (guile-variant-package-name prefix)
   (lambda (name)
     "Return NAME with PREFIX instead of \"guile-\", when applicable."
-    (if (string-prefix? "guile-" name)
+    (if (and (string-prefix? "guile-" name)
+
+             ;; Don't rename guile-bootstrap@2.0.
+             (not (string=? "guile-bootstrap" name)))
         (string-append prefix "-"
                        (string-drop name
                                     (string-length "guile-")))
@@ -900,8 +903,8 @@ type system, elevating types to first-class status.")
 (define-public guile-git
   (package
     (name "guile-git")
-    (version "0.11.0")
-    (home-page "https://gitlab.com/guile-git/guile-git.git")
+    (version "0.11.1")
+    (home-page "https://codeberg.org/guile-git/guile-git.git")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -910,11 +913,11 @@ type system, elevating types to first-class status.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "1yjyil6z4k80pjdps8v6h6lxikwxmjxvrslf2jrmq2rrfnajschz"))))
+                "0xpzchnglddphi3chv53xqaz2x6rpq3l4s023w7r4mmndb6lgz0b"))))
     (build-system gnu-build-system)
     (arguments
      `(#:make-flags '("GUILE_AUTO_COMPILE=0")       ; to prevent guild warnings
-       ;; https://gitlab.com/guile-git/guile-git/-/issues/20
+       ;; https://codeberg.org/guile-git/guile-git/issues/20
        ,@(if (target-ppc32?)
            `(#:phases
              (modify-phases %standard-phases
@@ -922,20 +925,7 @@ type system, elevating types to first-class status.")
                  (lambda _
                    (substitute* "Makefile.am"
                      ((".*tests/blob\\.scm.*") ""))))))
-           '())
-       ,@(if (system-hurd?)
-             (list
-              #:phases
-              #~(modify-phases %standard-phases
-                  (add-after 'unpack 'skip-tests/hurd
-                    (lambda _
-                      (substitute* "tests/proxy.scm"
-                        (("\\(test-begin.*" all)
-                         (string-append
-                          all
-                          "(when (string-ci= \"GNU\" (vector-ref (uname) 0))\n"
-                          "  (test-skip 1))\n")))))))
-             '())))
+           '())))
     (native-inputs
      (list pkg-config autoconf automake texinfo guile-3.0 guile-bytestructures))
     (inputs
@@ -1004,7 +994,7 @@ Guile's foreign function interface.")
        (file-name (string-append "guile-lzlib-" version ".tar.gz"))
        (sha256
         (base32
-         "1whgmwkr1v8m63p4aaqn8blwl9vcrswwhbfv4bm0aghl5a6rryd7"))
+         "1v1pfqp6hwl0rivs7swhqnfgznxlfnws9ldmn6avnhd10filfa3a"))
        (patches (search-patches "guile-lzlib-gcc-14.patch"
                                 "guile-lzlib-hurd64.patch"))))
     (build-system gnu-build-system)

gnu/packages/haskell-crypto.scm

@@ -914,7 +914,7 @@ regular) Diffie Hellman key exchanges, and many extensions.")
      (list #:extra-directories (list "openssl")
            #:configure-flags
            #~(list "--ghc-options=-optc=-Wno-incompatible-pointer-types")))
-    (inputs (list ghc-network openssl))
+    (inputs (list ghc-network openssl-3.0))
     (home-page "https://github.com/haskell-cryptography/HsOpenSSL")
     (synopsis "Partial OpenSSL binding for Haskell")
     (description

gnu/packages/high-availability.scm

@@ -489,11 +489,22 @@ lost.
                 "0b9d2i22ghyjarwi1c596q5mf7gj1k04k784hnmrd2d4x9hgv9ax"))))
     (build-system gnu-build-system)
     (arguments
-     (list #:configure-flags #~(list "--with-corosync" "--disable-static"
+     (list #:configure-flags #~(list "--with-corosync"
+                                     "--disable-static"
+                                     "--localstatedir=/var"
                                      (string-append "--with-initdir="
                                                     #$output "/etc/init.d")
                                      (string-append "--with-ocfdir="
-                                                    #$output "/lib"))))
+                                                    #$output "/lib"))
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-before 'configure 'pre-configure
+                 (lambda _
+                   ;; Do not attempt to install /var.
+                   (substitute* '("Makefile.am"
+                                  "daemons/schedulerd/Makefile.am")
+                     (("install-exec-local:")
+                      "install-exec-local-disabled:")))))))
     (native-inputs (list autoconf
                          automake
                          cmocka

gnu/packages/instrumentation.scm

@@ -339,30 +339,6 @@ coverage.")
     ;; that list in further version.
     (supported-systems (list "x86_64-linux"))))
 
-(define-public lttng-modules
-  (package
-    (name "lttng-modules")
-    (version "2.13.14")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://lttng.org/files/lttng-modules/"
-                                  "lttng-modules-" version ".tar.bz2"))
-              (sha256
-               (base32
-                "19jx1yz1hsbr4vwfp2nr6z52a5g50iimaak962k49diay5zryi66"))))
-    (build-system linux-module-build-system)
-    (arguments
-     `(#:tests? #f ; no tests
-       #:make-flags (list "CONFIG_LTTNG=m"
-                          "CONFIG_LTTNG_CLOCK_PLUGIN_TEST=m")))
-    (home-page "https://lttng.org/")
-    (synopsis "LTTng kernel modules for the LTTng tracer toolset")
-    (description
-     "LTTng kernel modules are Linux kernel modules which make
-LTTng kernel tracing possible.  They include essential control modules and
-many probes which instrument numerous interesting parts of Linux.")
-    (license (list license:lgpl2.1 license:gpl2 license:expat))))
-
 (define-public lttng-ust
   (package
     (name "lttng-ust")

gnu/packages/java-bootstrap.scm

@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019, 2021 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2014-2019, 2021, 2026 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2021, 2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017, 2022 Marius Bakke <marius@gnu.org>
@@ -226,6 +226,18 @@ JNI.")
              (setenv "JAVACMD" (search-input-file inputs "/bin/jamvm"))
              (setenv "JAVAC" (search-input-file inputs "/bin/jikes"))
              (setenv "CLASSPATH" (search-input-file inputs "/lib/rt.jar"))))
+         ,@(if (target-x86-32?)
+               ;; XXX: On i686 isFile() always seems to return true.  Patching
+               ;; this here is very ugly, but the effects are limited.  None
+               ;; of these changes remain by the time we've built Icedtea and
+               ;; the other JDKs.
+               '((add-after 'unpack 'disable-isFile-checks
+                   (lambda _
+                     (substitute* "src/main/org/apache/tools/ant/util/ResourceUtils.java"
+                       (("destFile = \\(\\(FileProvider\\).*") ""))
+                     (substitute* "src/main/org/apache/tools/ant/taskdefs/Mkdir.java"
+                       (("dir.isFile\\(\\)") "false")))))
+               '())
          (replace 'build
            (lambda* (#:key inputs outputs #:allow-other-keys)
              ;; Ant complains if this file doesn't exist.

gnu/packages/java-compression.scm

@@ -55,13 +55,12 @@
        (modify-phases %standard-phases
          (add-after 'unpack 'make-git-checkout-writable
            (lambda _
-             (for-each make-file-writable (find-files "."))
-             #t))
+             (for-each make-file-writable (find-files "."))))
          (add-before 'build 'remove-binaries
            (lambda _
              (delete-file "lib/org/xerial/snappy/OSInfo.class")
-             (delete-file-recursively "src/main/resources/org/xerial/snappy/native")
-             #t))
+             (delete-file-recursively
+              "src/main/resources/org/xerial/snappy/native")))
          (add-before 'build 'build-jni
            (lambda _
              ;; Rebuild one of the binaries we removed earlier
@@ -98,36 +97,33 @@
          (add-after 'build-jni 'copy-jni
            (lambda _
              (copy-recursively "src/main/resources/org/xerial/snappy/native"
-                               "build/classes/org/xerial/snappy/native")
-             #t))
+                               "build/classes/org/xerial/snappy/native")))
          (add-before 'build 'set-test-memory-size
            (lambda _
              (substitute* "build.xml"
-               (("<junit printsummary=") "<junit maxmemory=\"2G\" printsummary="))
-             #t))
+               (("<junit printsummary=")
+                "<junit maxmemory=\"2G\" printsummary="))))
          (add-before 'check 'fix-failing
            (lambda _
              (with-directory-excursion "src/test/java/org/xerial/snappy"
-               ;; This package assumes maven build, which puts results in "target".
-               ;; We put them in "build" instead, so fix that.
+               ;; This package assumes maven build, which puts results in
+               ;; "target". We put them in "build" instead, so fix that.
                (substitute* "SnappyLoaderTest.java"
                  (("target/classes") "build/classes"))
                ;; This requires Hadoop, which is not in Guix yet.
-               (delete-file "SnappyHadoopCompatibleOutputStreamTest.java"))
-             #t)))))
+               (delete-file "SnappyHadoopCompatibleOutputStreamTest.java")))))))
     (inputs
-     `(("osgi-framework" ,java-osgi-framework)))
+     (list java-osgi-framework))
     (propagated-inputs
-     `(("bitshuffle" ,bitshuffle-for-snappy)
-       ("snappy" ,snappy)))
+     (list bitshuffle-for-snappy snappy))
     (native-inputs
-     `(("junit" ,java-junit)
-       ("hamcrest" ,java-hamcrest-core)
-       ("xerial-core" ,java-xerial-core)
-       ("classworlds" ,java-plexus-classworlds)
-       ("commons-lang" ,java-commons-lang)
-       ("commons-io" ,java-commons-io)
-       ("perl" ,perl)))
+     (list java-junit
+           java-hamcrest-core
+           java-xerial-core
+           java-plexus-classworlds
+           java-commons-lang
+           java-commons-io
+           perl))
     (home-page "https://github.com/xerial/snappy-java")
     (synopsis "Compression/decompression algorithm in Java")
     (description "Snappy-java is a Java port of snappy, a fast C++
@@ -156,13 +152,13 @@ compressor/decompressor.")
          (add-before 'build 'remove-binaries
            (lambda _
              (delete-file "lib/org/xerial/snappy/OSInfo.class")
-             (delete-file-recursively "src/main/resources/org/xerial/snappy/native")
-             #t))
+             (delete-file-recursively
+              "src/main/resources/org/xerial/snappy/native")))
          (add-before 'build 'build-jni
            (lambda _
              ;; Rebuild one of the binaries we removed earlier
              (invoke "javac" "src/main/java/org/xerial/snappy/OSInfo.java"
-                      "-d" "lib")
+                     "-d" "lib")
              ;; Link to the dynamic snappy, not the static ones
              (substitute* "Makefile.common"
                (("-shared") "-shared -lsnappy"))
@@ -184,16 +180,14 @@ compressor/decompressor.")
          (add-after 'build-jni 'copy-jni
            (lambda _
              (copy-recursively "src/main/resources/org/xerial/snappy/native"
-                               "build/classes/org/xerial/snappy/native")
-             #t))
+                               "build/classes/org/xerial/snappy/native")))
          (add-before 'check 'fix-tests
            (lambda _
              (mkdir-p "src/test/resources/org/xerial/snappy/")
              (copy-recursively "src/test/java/org/xerial/snappy/testdata"
                                "src/test/resources/org/xerial/snappy/testdata")
              (install-file "src/test/java/org/xerial/snappy/alice29.txt"
-                           "src/test/resources/org/xerial/snappy/")
-             #t)))))))
+                           "src/test/resources/org/xerial/snappy/"))))))))
 
 (define-public java-iq80-snappy
   (package

gnu/packages/java-maths.scm

@@ -75,7 +75,7 @@
     (inputs
      (list openblas))
     (native-inputs
-     `(("ant" ,ant/java7)
+     `(("ant" ,ant)
        ("ruby" ,ruby)                   ; for configure script
        ("gfortran" ,gfortran)
        ("jdk" ,icedtea "jdk")))

gnu/packages/java.scm

@@ -1285,7 +1285,13 @@ new Date();"))))
                 ;; It looks like the "--disable-warnings-as-errors" option of
                 ;; the 'configure' phase is not working.
                 (substitute* "make/autoconf/generated-configure.sh"
-                  (("-Werror") ""))))))
+                  (("-Werror") ""))))
+            #$@(if (target-x86-32?)
+                   ;; On i686 the C2 compiler sometimes crashes when importing
+                   ;; certificates.
+                   #~((add-before 'install-keystore 'disable-C2-compiler
+                        (lambda _ (setenv "_JAVA_OPTIONS" "-XX:TieredStopAtLevel=1"))))
+                   #~())))
        ((#:disallowed-references refs '())
         (cons* (this-package-native-input "openjdk")
                (gexp-input (this-package-native-input "openjdk") "jdk")
@@ -1844,12 +1850,50 @@ blacklisted.certs.pem"
 (define-public openjdk24
   (make-openjdk
    openjdk23 "24.0.1"
-   "0h6sbzbjyqg85iml41pswdh2z3d7h2hhb0sd5yll37r1mj5lsxmx"))
+   "0h6sbzbjyqg85iml41pswdh2z3d7h2hhb0sd5yll37r1mj5lsxmx"
+   (arguments
+    (substitute-keyword-arguments (package-arguments base)
+      ((#:configure-flags flags #~(list))
+       (if (target-x86-32?)
+           #~(cons* "--enable-deprecated-ports=yes" #$flags)
+          flags))))))
 
 (define-public openjdk25
   (make-openjdk
    openjdk24 "25.0.2"
-   "03aa34lscr3qbdl6qz3gqyp0nzkqfj02362mzmpkiq3y2g5xdnrj"))
+   "03aa34lscr3qbdl6qz3gqyp0nzkqfj02362mzmpkiq3y2g5xdnrj"
+   (arguments
+    (substitute-keyword-arguments (package-arguments base)
+      ((#:configure-flags flags #~(list))
+       (if (target-x86-32?)
+           ;; Full builds on 32-bit x86 architectures are not supported as of
+           ;; this version.  Best we can do is to build with the "zero" variant.
+           #~(cons* "--with-jvm-variants=zero"
+                    "--disable-precompiled-headers"
+                    #$flags)
+           flags))
+      ((#:phases phases #~%standard-phases)
+       (if (target-x86-32?)
+           #~(modify-phases #$phases
+               (replace 'install
+                 (lambda _
+                   (let ((images (car (find-files "build" "-zero-release"
+                                                  #:directories? #t))))
+                     (copy-recursively (string-append images "/images/jdk")
+                                       #$output:jdk)
+                     (copy-recursively (string-append images "/images/jre")
+                                       #$output)
+                     (copy-recursively (string-append images "/images/docs")
+                                       #$output:doc))))
+               (replace 'install-libjvm
+                 (lambda _
+                   (let ((lib-out (string-append #$output "/lib"))
+                         (lib-jdk (string-append #$output:jdk "/lib")))
+                     (symlink (string-append lib-jdk "/zero/libjvm.so")
+                              (string-append lib-jdk "/libjvm.so"))
+                     (symlink (string-append lib-out "/zero/libjvm.so")
+                              (string-append lib-out "/libjvm.so"))))))
+           phases))))))
 
 ;;; Convenience alias to point to the latest version of OpenJDK.
 (define-public openjdk openjdk25)
@@ -1964,7 +2008,8 @@ OpenJDK.")
     (home-page "https://www.jetbrains.com/")
     (license license:gpl2+)))
 
-(define-public ant
+
+(define-public ant/java8
   (package
     (name "ant")
     (version "1.10.15")
@@ -1979,12 +2024,15 @@ OpenJDK.")
               (snippet
                '(begin
                   (for-each delete-file
-                            (find-files "lib/optional" "\\.jar$"))))))
-    (build-system ant-build-system)
+                            (find-files "lib/optional" "\\.jar$"))
+                  #t))))
+    (build-system gnu-build-system)
     (arguments
      (list
-      #:ant ant/java7
-      #:test-target "test"
+      #:modules '((srfi srfi-1)
+                  (guix build gnu-build-system)
+                  (guix build utils))
+      #:tests? #f                       ;no "check" target
       #:phases
       #~(modify-phases %standard-phases
           (add-after 'unpack 'remove-scripts
@@ -1994,100 +2042,11 @@ OpenJDK.")
               (for-each delete-file
                         (find-files "src/script"
                                     "(.*\\.(bat|cmd)|runant.*|antRun.*)"))))
-          (add-after 'unpack 'link-test-dependencies
-            (lambda* (#:key inputs #:allow-other-keys)
-              (for-each (lambda (file)
-                          (symlink file
-                                   (string-append "lib/optional/"
-                                                  (basename file))))
-                        (append
-                          (find-files (assoc-ref inputs "java-hamcrest-core")
-                                      "\\.jar$")
-                          (find-files (assoc-ref inputs "java-hamcrest-library")
-                                      "\\.jar$")
-                          (find-files (assoc-ref inputs "java-junit")
-                                      "\\.jar$")))))
-          (add-before 'build 'fix-test-failures
-            (lambda _
-              ;; Failure because the directory does not exist
-              (substitute* "src/etc/testcases/taskdefs/exec/exec-with-redirector.xml"
-                (("/usr/bin") (getcwd)))
-              ;; Failure because it cannot read root's name in the build
-              ;; container
-              (delete-file "src/tests/junit/org/apache/tools/ant/types/selectors/OwnedBySelectorTest.java")
-              ;; Cause timestamp issue when trying to rollback time by a few
-              ;; seconds.
-              (for-each (lambda (file) (utime file 5000))
-                        (find-files "src/etc/testcases/taskdefs" "" #:directories? #t))))
           (delete 'bootstrap)
           (delete 'configure)
           (replace 'build
             (lambda* (#:key inputs #:allow-other-keys)
               (setenv "JAVA_HOME" (assoc-ref inputs "jdk"))
-              (invoke "bash" "bootstrap.sh"
-                      (string-append "-Ddist.dir=" #$output))))
-          (add-after 'build 'fix-executables-paths
-            (lambda* (#:key inputs #:allow-other-keys)
-              (wrap-script (string-append #$output "/bin/ant")
-                `("PATH" suffix
-                  (,(dirname (search-input-file inputs "/bin/sed"))
-                   ,(dirname (search-input-file inputs "/bin/uname"))
-                   ,(dirname (search-input-file inputs "/bin/which")))))
-              (patch-shebang
-               (string-append #$output "/bin/complete-ant-cmd.pl")
-               (list (dirname (search-input-file inputs "/bin/perl"))))))
-          (delete 'install))))
-    (inputs
-     (list coreutils-minimal
-           guile-3.0/pinned
-           java-hamcrest-core
-           java-hamcrest-library
-           java-junit
-           perl
-           sed
-           which))
-    (home-page "https://ant.apache.org")
-    (synopsis "Build tool for Java")
-    (description
-     "Ant is a platform-independent build tool for Java.  It is similar to
-make but is implemented using the Java language, requires the Java platform,
-and is best suited to building Java projects.  Ant uses XML to describe the
-build process and its dependencies, whereas Make uses Makefile format.")
-    (license license:asl2.0)))
-
-;; The 1.9.x series is the last that can be built with GCJ.  The 1.10.x series
-;; requires Java 8.
-(define-public ant/java7
-  (package
-    (name "ant")
-    (version "1.9.15")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://apache/ant/source/apache-ant-"
-                                  version "-src.tar.gz"))
-              (sha256
-               (base32
-                "1xy30f1w5gaqk6g3f0vw7ygix4rb6032qkcw42y4z8wd9jihgygd"))))
-    (build-system gnu-build-system)
-    (arguments
-      `(#:modules ((srfi srfi-1)
-                   (guix build gnu-build-system)
-                   (guix build utils))
-        #:tests? #f                  ; no "check" target
-        #:phases
-        (modify-phases %standard-phases
-          (delete 'bootstrap)
-          (delete 'configure)
-          (add-after 'unpack 'remove-scripts
-            ;; Remove bat / cmd scripts for DOS as well as the antRun and runant
-            ;; wrappers.
-            (lambda _
-              (for-each delete-file
-                        (find-files "src/script"
-                                    "(.*\\.(bat|cmd)|runant.*|antRun.*)"))))
-          (replace 'build
-            (lambda* (#:key inputs outputs #:allow-other-keys)
-              (setenv "JAVA_HOME" (assoc-ref inputs "jdk"))
 
               ;; Disable tests to avoid dependency on hamcrest-core, which needs
               ;; Ant to build.  This is necessary in addition to disabling the
@@ -2096,10 +2055,9 @@ build process and its dependencies, whereas Make uses Makefile format.")
               (substitute* "build.xml"
                 (("depends=\"jars,test-jar") "depends=\"jars"))
               (invoke "bash" "bootstrap.sh"
-                      (string-append "-Ddist.dir="
-                                     (assoc-ref outputs "out")))))
+                      (string-append "-Ddist.dir=" #$output))))
           (add-after 'build 'strip-jar-timestamps ;based on ant-build-system
-            (lambda* (#:key outputs #:allow-other-keys)
+            (lambda _
               (define (repack-archive jar)
                 (let* ((dir (mkdtemp "jar-contents.XXXXXX"))
                        (manifest (string-append dir "/META-INF/MANIFESTS.MF")))
@@ -2125,11 +2083,11 @@ build process and its dependencies, whereas Make uses Makefile format.")
                       (apply invoke command)))))
               (for-each repack-archive
                         (find-files
-                         (string-append (assoc-ref %outputs "out") "/lib")
+                         (string-append #$output "/lib")
                          "\\.jar$"))))
           (delete 'install))))
     (native-inputs
-     `(("jdk" ,icedtea-7 "jdk")
+     `(("jdk" ,icedtea-8 "jdk")
        ("zip" ,zip)
        ("unzip" ,unzip)))
     (home-page "https://ant.apache.org")
@@ -2141,12 +2099,131 @@ and is best suited to building Java projects.  Ant uses XML to describe the
 build process and its dependencies, whereas Make uses Makefile format.")
     (license license:asl2.0)))
 
+;; The 1.9.x series is the last that can be built with GCJ.  The 1.10.x series
+;; requires Java 8.
+(define-public ant
+  (package (inherit ant/java8)
+    (version "1.9.15")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://apache/ant/source/apache-ant-"
+                                  version "-src.tar.gz"))
+              (sha256
+               (base32
+                "1xy30f1w5gaqk6g3f0vw7ygix4rb6032qkcw42y4z8wd9jihgygd"))))
+    ;; XXX: we do this to avoid a rebuild.  This mess will be cleaned up
+    ;; later.
+    (arguments
+     (substitute-keyword-arguments
+         `(#:modules ((srfi srfi-1)
+                      (guix build gnu-build-system)
+                      (guix build utils))
+           #:tests? #f                  ; no "check" target
+           #:phases
+           (modify-phases %standard-phases
+             (delete 'bootstrap)
+             (delete 'configure)
+             (add-before 'build 'define-java-environment-variables
+               (lambda* (#:key inputs #:allow-other-keys)
+                 ;; First, set environment variables (eases debugging on -K).
+                 (setenv "JAVA_HOME" (assoc-ref inputs "jamvm"))
+                 (setenv "JAVACMD" (search-input-file inputs "/bin/jamvm"))
+                 (setenv "JAVAC" (search-input-file inputs "/bin/jikes"))
+                 (setenv "CLASSPATH" (search-input-file inputs "/lib/rt.jar"))))
+             (replace 'build
+               (lambda* (#:key inputs outputs #:allow-other-keys)
+                 ;; Ant complains if this file doesn't exist.
+                 (setenv "HOME" "/tmp")
+                 (with-output-to-file "/tmp/.ant.properties"
+                   (lambda _ (display "")))
+
+                 ;; Use jikes instead of javac for <javac ...> tags in build.xml
+                 (setenv "ANT_OPTS" "-Dbuild.compiler=jikes")
+
+                 ;; jikes produces lots of warnings, but they are not very
+                 ;; interesting, so we silence them.
+                 (setenv "$BOOTJAVAC_OPTS" "-nowarn")
+
+                 ;; Without these JamVM options the build may freeze.
+                 (substitute* "bootstrap.sh"
+                   (("^\"\\$\\{JAVACMD\\}\" " m)
+                    ,@(if (string-prefix? "armhf" (or (%current-system)
+                                                      (%current-target-system)))
+                          `((string-append m "-Xnocompact "))
+                          `((string-append m "-Xnocompact -Xnoinlining ")))))
+
+                 ;; Disable tests because we are bootstrapping and thus don't have
+                 ;; any of the dependencies required to build and run the tests.
+                 (substitute* "build.xml"
+                   (("depends=\"jars,test-jar\"") "depends=\"jars\""))
+                 (invoke "bash" "bootstrap.sh"
+                         (string-append "-Ddist.dir="
+                                        (assoc-ref outputs "out")))))
+             (add-after 'build 'strip-jar-timestamps ;based on ant-build-system
+               (lambda* (#:key outputs #:allow-other-keys)
+                 (define (repack-archive jar)
+                   (let* ((dir (mkdtemp "jar-contents.XXXXXX"))
+                          (manifest (string-append dir "/META-INF/MANIFESTS.MF")))
+                     (with-directory-excursion dir
+                       (invoke "unzip" jar))
+                     (delete-file jar)
+                     ;; XXX: copied from (gnu build install)
+                     (for-each (lambda (file)
+                                 (let ((s (lstat file)))
+                                   (unless (eq? (stat:type s) 'symlink)
+                                     (utime file  0 0 0 0))))
+                               (find-files dir #:directories? #t))
+                     ;; It is important that the manifest appears first.
+                     (with-directory-excursion dir
+                       (let* ((files (find-files "." ".*" #:directories? #t))
+                              ;; To ensure that the reference scanner can
+                              ;; detect all store references in the jars
+                              ;; we disable compression with the "-0" option.
+                              (command (if (file-exists? manifest)
+                                           `("zip" "-0" "-X" ,jar ,manifest
+                                             ,@files)
+                                           `("zip" "-0" "-X" ,jar ,@files))))
+                         (apply invoke command)))))
+                 (for-each repack-archive
+                           (find-files
+                            (string-append (assoc-ref %outputs "out") "/lib")
+                            "\\.jar$"))))
+             (delete 'install)))
+       ((#:phases phases)
+        `(modify-phases ,phases
+           (delete 'define-java-environment-variables)
+           (add-after 'unpack 'remove-scripts
+             ;; Remove bat / cmd scripts for DOS as well as the antRun and runant
+             ;; wrappers.
+             (lambda _
+               (for-each delete-file
+                         (find-files "src/script"
+                                     "(.*\\.(bat|cmd)|runant.*|antRun.*)"))
+               #t))
+           (replace 'build
+             (lambda* (#:key inputs outputs #:allow-other-keys)
+               (setenv "JAVA_HOME" (assoc-ref inputs "jdk"))
+
+               ;; Disable tests to avoid dependency on hamcrest-core, which needs
+               ;; Ant to build.  This is necessary in addition to disabling the
+               ;; "check" phase, because the dependency on "test-jar" would always
+               ;; result in the tests to be run.
+               (substitute* "build.xml"
+                 (("depends=\"jars,test-jar") "depends=\"jars"))
+               (invoke "bash" "bootstrap.sh"
+                       (string-append "-Ddist.dir="
+                                      (assoc-ref outputs "out")))))))))
+    (native-inputs
+     `(("jdk" ,icedtea-7 "jdk")
+       ("zip" ,zip)
+       ("unzip" ,unzip)))))
+
 (define-public ant-apache-bcel
   (package
-    (inherit ant)
+    (inherit ant/java8)
     (name "ant-apache-bcel")
     (arguments
-     (substitute-keyword-arguments (package-arguments ant)
+     (substitute-keyword-arguments (package-arguments ant/java8)
        ((#:phases phases)
         #~(modify-phases #$phases
             (add-after 'unpack 'link-bcel
@@ -2167,11 +2244,37 @@ build process and its dependencies, whereas Make uses Makefile format.")
                   (delete-file-recursively bin)
                   (delete-file-recursively lib))))))))
     (inputs
-     (modify-inputs (package-inputs ant)
+     (modify-inputs (package-inputs ant/java8)
        (prepend java-commons-bcel)))))
 
-(define-deprecated-package ant-junit
-  ant)
+(define-public ant-junit
+  (package
+    (inherit ant/java8)
+    (name "ant-junit")
+    (arguments
+     (substitute-keyword-arguments (package-arguments ant/java8)
+       ((#:phases phases)
+        #~(modify-phases #$phases
+            (add-after 'unpack 'link-junit
+              (lambda* (#:key inputs #:allow-other-keys)
+                (for-each (lambda (file)
+                            (symlink file
+                                     (string-append "lib/optional/"
+                                                    (basename file))))
+                          (find-files (assoc-ref inputs "java-junit")
+                                      "\\.jar$"))))
+            (add-after 'build 'install
+              (lambda _
+                (let ((share (string-append #$output "/share/java"))
+                      (bin   (string-append #$output "/bin"))
+                      (lib   (string-append #$output "/lib")))
+                  (mkdir-p share)
+                  (install-file (string-append lib "/ant-junit.jar") share)
+                  (delete-file-recursively bin)
+                  (delete-file-recursively lib))))))))
+    (inputs
+     (modify-inputs (package-inputs ant/java8)
+       (prepend java-junit)))))
 
 (define-public libantlr3c
   (package
@@ -3278,9 +3381,6 @@ is implemented.")
      `(;; Tests require junit
        #:tests? #f
        #:jar-name "qdox.jar"
-       ;; Explicitely use an ant version that includes the junit tasks, since
-       ;; it is a dependency of junit.
-       #:ant ,ant/java7
        #:phases
        (modify-phases %standard-phases
          (replace 'unpack
@@ -3389,9 +3489,6 @@ documentation tools.")
      `(;; Tests require junit, which ultimately depends on this package.
        #:tests? #f
        #:build-target "jar"
-       ;; Explicitely use an ant version that includes the junit tasks, since
-       ;; it is a dependency of junit.
-       #:ant ,ant/java7
        #:phases
        (modify-phases %standard-phases
          (add-before 'build 'do-not-use-bundled-asm
@@ -3490,9 +3587,6 @@ testing frameworks, mocking libraries and UI validation rules.")
     (build-system ant-build-system)
     (arguments
      `(#:tests? #f ; Tests require junit
-       ;; Explicitely use an ant version that includes the junit tasks, since
-       ;; it is a dependency of junit.
-       #:ant ,ant/java7
        #:modules ((guix build ant-build-system)
                   (guix build java-utils)
                   (guix build utils)
@@ -3578,9 +3672,6 @@ testing frameworks, mocking libraries and UI validation rules.")
     (native-inputs '())
     (arguments
      `(#:tests? #f
-       ;; Explicitely use an ant version that includes the junit tasks, since
-       ;; it is a dependency of junit.
-       #:ant ,ant/java7
        #:phases
        (modify-phases %standard-phases
          (delete 'configure)
@@ -3622,7 +3713,7 @@ testing frameworks, mocking libraries and UI validation rules.")
 (define-public java-junit
   (package
     (name "java-junit")
-    (version "4.13.2")
+    (version "4.12")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -3631,7 +3722,7 @@ testing frameworks, mocking libraries and UI validation rules.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "1r7k4zzscc8019np3is3bzfigw8fxd6s3259cbhzzh02q6d5p9h3"))
+                "1j8avi91px1z8rjc89cfikwrvfifdmmsarwiyrcnr59ynvpz0v8h"))
               (modules '((guix build utils)))
               (snippet
                '(begin
@@ -3643,9 +3734,6 @@ testing frameworks, mocking libraries and UI validation rules.")
      `(#:jar-name "junit.jar"
        #:source-dir "src/main/java"
        #:test-dir "src/test"
-       ;; Explicitely use an ant version that includes the junit tasks, so
-       ;; we can run the tests.
-       #:ant ,ant/java7
        #:test-exclude (list "**/SimpleTest.java" "**/StackTracesTest.java"
                             "**/RuleChainTest.java" "**/TestWatchmanTest.java")
        #:phases
@@ -3686,13 +3774,7 @@ sharing common test data, and test runners for running tests.")
      `(#:jar-name "junitparams.jar"
        #:source-dir "src/main/java"
        #:test-dir "src/test"
-       #:test-exclude (list
-                        ;; Abstract class: no tests
-                        "**/SuperclassTest.java"
-                        ;; Incompatible tests with junit 4.13.2
-                        "**/BeforeAfterClassTest.java"
-                        "**/FilterableTest.java"
-                        "**/RulesTest.java")))
+       #:test-exclude (list "**/SuperclassTest.java")))
     (inputs
      (list java-junit))
     (native-inputs
@@ -5161,9 +5243,6 @@ complex transformations and code analysis tools.")
     (build-system ant-build-system)
     (arguments
      `(#:tests? #f
-       ;; Explicitely use an ant version that includes the junit tasks, since
-       ;; it is a dependency of junit.
-       #:ant ,ant/java7
        #:phases
        (modify-phases %standard-phases
          (delete 'unpack)
@@ -5185,9 +5264,6 @@ including java-asm.")
     (properties '((hidden? . #t)))
     (arguments
      (substitute-keyword-arguments (package-arguments java-asm)
-       ;; Explicitely use an ant version that includes the junit tasks, since
-       ;; it is a dependency of junit.
-       ((#:ant _ ant/java7) ant/java7)
        ((#:tests? _) #f)))
     (native-inputs `())))
 

gnu/packages/jupyter.scm

@@ -22,6 +22,7 @@
 ;;; Copyright © 2024, 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2024-2025 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;; Copyright © 2025 Ghislain Vaillant <ghislain.vaillant@inria.fr>
+;;; Copyright © 2026 Vinicius Monego <monego@posteo.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -52,7 +53,9 @@
   #:use-module (gnu packages bash)
   #:use-module (gnu packages check)
   #:use-module (gnu packages cpp)
+  #:use-module (gnu packages databases)
   #:use-module (gnu packages docker)
+  #:use-module (gnu packages freedesktop)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages monitoring)
   #:use-module (gnu packages networking)
@@ -1710,13 +1713,13 @@ analyzing Jupyter Notebooks.")
 (define-public python-qtconsole
   (package
     (name "python-qtconsole")
-    (version "5.7.0")
+    (version "5.7.2")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "qtconsole" version))
        (sha256
-        (base32 "0w9i0s70dm39cxgn3vh4wcaxdywzp9j0ac7f49q4qmggx4f3fcqd"))))
+        (base32 "088m56fav6xlcw55srxz96yf7rj2ndmycy4f3m69498r2swqbd17"))))
     (build-system pyproject-build-system)
     (arguments
      (list
@@ -1764,6 +1767,67 @@ analyzing Jupyter Notebooks.")
 rich media output.")
     (license license:bsd-3)))
 
+(define-public python-spyder-kernels
+  (package
+    (name "python-spyder-kernels")
+    (version "3.1.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/spyder-ide/spyder-kernels")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0yhrifh148g93qkwx9ggsh2kr9789apzlw91ais4dyas5yf1xj8w"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:test-flags
+      #~(list "-k" (string-append
+                    ;; Avoid pulling Django for a single test.
+                    "not test_django_settings"
+                    ;; AssertionError.
+                    " and not test_umr_reload_modules"))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'redirect-HOME
+            (lambda _
+              (setenv "HOME" "/tmp"))))))
+    (propagated-inputs (list python-cloudpickle
+                             python-ipykernel
+                             python-ipython
+                             python-jupyter-client
+                             python-packaging
+                             python-pyxdg
+                             python-pyzmq
+                             python-traitlets
+                             python-wurlitzer))
+    (native-inputs (list python-anyio
+                         python-cython
+                         python-dask
+                         python-h5py
+                         python-matplotlib
+                         python-numpy
+                         python-pandas
+                         python-pillow
+                         python-polars
+                         python-pyarrow
+                         python-pydicom
+                         python-pytest
+                         python-scipy
+                         python-setuptools
+                         python-xarray))
+    (home-page "https://github.com/spyder-ide/spyder-kernels")
+    (synopsis "Jupyter kernels for Spyder's console")
+    (description "This package provides Jupyter kernels for use with the
+consoles of Spyder, the Scientific Python Development Environment.
+
+These kernels can be launched either through Spyder itself or in an
+independent Python session, and allow for interactive or file-based execution
+of Python code inside Spyder.")
+    (license license:expat)))
+
 (define-public python-voila
   (package
     (name "python-voila")

gnu/packages/kde-multimedia.scm

@@ -1191,37 +1191,42 @@ CDs.")
 (define-public plasmatube
   (package
     (name "plasmatube")
-    (version "25.12.2")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://kde/stable/release-service/" version
-                                  "/src/plasmatube-" version ".tar.xz"))
-              (sha256
-               (base32
-                "1jc6iqcxz0zyai26vx80nyfr818r4cj8lpw0b1pbvb1vya12v8zy"))))
+    (version "26.04.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://kde/stable/release-service/" version
+                           "/src/plasmatube-" version ".tar.xz"))
+       (sha256
+        (base32 "0dby9wypbrhg6g03kvl8fc40zpnri03hf3kk3vi1z16pwc7sn093"))))
     (build-system qt-build-system)
     (native-inputs (list extra-cmake-modules pkg-config python-minimal))
     (inputs
      (list kconfig
            kcoreaddons
            kdbusaddons
+           kdeclarative ; for org.kde.kquickcontrolsaddons
+           ki18n
            kirigami
            kirigami-addons
-           ki18n
+           kitemmodels
            kwindowsystem
            mpvqt
            purpose
+           qqc2-desktop-style ; for org.kde.desktop
            qtdeclarative
+           qtkeychain-qt6
            qtmultimedia
            qtsvg
-           qtkeychain-qt6
            qtwayland
+           sonnet
            yt-dlp))
     (arguments (list #:qtbase qtbase))
     (home-page "https://apps.kde.org/plasmatube/")
-    (synopsis "Kirigami YouTube video player")
-    (description "This package provides YouTube video player based
-on QtMultimedia and @command{yt-dlp}.")
+    (synopsis "YouTube and PeerTube video player")
+    (description
+     "Plasmatube is a YouTube video player that uses Invidious and Piped
+APIs.  It can also play videos from PeerTube sources.")
     (license license:gpl3+)))
 
 (define-public rattlesnake

gnu/packages/linux.scm

@@ -2767,32 +2767,6 @@ This package provides the @command{corefreqd} data collection daemon, the
     (supported-systems (list "x86_64-linux"))
     (license license:gpl2)))
 
-(define-public librem-ec-acpi-linux-module
-  (package
-    (name "librem-ec-acpi-linux-module")
-    (version "0.9.2")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://source.puri.sm/nicole.faerber/librem-ec-acpi-dkms")
-             (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "0m8hamf0550083jnk5q4hv20l8lfiardnkxbib4hhvqghpzzbxl0"))))
-    (build-system linux-module-build-system)
-    (arguments
-     (list #:tests? #f))                ; no test suite
-    (home-page "https://source.puri.sm/nicole.faerber/librem-ec-acpi-dkms")
-    (synopsis "Linux kernel module to control the Librem Embedded Controller")
-    (description
-     "This is the Linux kernel @acronym{ACPI, Advanced Configuration and Power
-Interface} platform driver for the @acronym{EC, Embedded Controller} firmware
-on Purism Librem laptop computers.  It allows user-space control over the
-battery charging thresholds, keyboard backlight, fans and thermal monitors,
-and the notification, WiFi, and Bluetooth LED.")
-    (license license:gpl2)))
-
 (define-public tuxedo-keyboard
   (package
     (name "tuxedo-keyboard")
@@ -2823,70 +2797,6 @@ kernel modules to control the keyboard on most Tuxedo computers. The @code{tuxed
 module is also needed for the @code{tuxedo-control-center} (short tcc) package.")
     (license license:gpl2+)))
 
-(define-public evdi
-  (package
-    (name "evdi")
-    (version "1.14.8")                  ;inherited by libevdi
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/DisplayLink/evdi")
-             (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "18n8kk4gbbj252a2dqb7mbpscfb437x42flh1fsl4g5c8brczc77"))))
-    (build-system linux-module-build-system)
-    (arguments
-     (list #:tests? #f                  ;no test suite
-           #:phases #~(modify-phases %standard-phases
-                        (add-after 'unpack 'chdir
-                          (lambda _
-                            (chdir "module"))))))
-    (home-page "https://github.com/DisplayLink/evdi")
-    (synopsis
-     "@acronym{EVDI, Extensible Virtual Display Interface} Linux kernel module")
-    (description
-     "The @acronym{EVDI, Extensible Virtual Display Interface} is a Linux kernel
-module that enables management of multiple screens, allowing user-space programs
-to take control over what happens with the image.  It is essentially a virtual
-display for which applications using the @code{libevdi} library can add, remove,
-and receive screen updates.
-
-The EVDI driver uses the standard Linux @acronym{DRM, Direct Rendering Manager}.
-Its displays can be controlled by standard tools such as @command{xrandr} and
-display settings applets in graphical environments")
-    (license license:gpl2)))
-
-(define-public libevdi
-  (package
-    (inherit evdi)
-    (name "libevdi")
-    (build-system gnu-build-system)
-    (arguments
-     (list #:tests? #f                  ;no test suite
-           #:make-flags
-           #~(list (string-append "CC=" #$(cc-for-target)))
-           #:phases #~(modify-phases %standard-phases
-                        (delete 'configure)
-                        (add-after 'unpack 'chdir
-                          (lambda _
-                            (chdir "library")))
-                        (replace 'install
-                          (lambda* _
-                            (let* ((lib (string-append #$output "/lib")))
-                              (mkdir-p lib)
-                              (install-file "libevdi.so" lib)))))))
-    (inputs (list libdrm))
-    (native-inputs (list pkg-config))
-    (synopsis
-     "@acronym{EVDI, Extensible Virtual Display Interface} user-space library")
-    (description
-     "Libevdi is a library that gives applications easy access to
-@acronym{EVDI, Extensible Virtual Display Interface} devices provided by the
-@code{evdi} driver package.")
-    (license license:lgpl2.1)))
-
 (define-public ec
   (package
     (name "ec")
@@ -2912,62 +2822,6 @@ registers of the @acronym{EC, Embedded Controller} supported by the
 @code{ec_sys} Linux driver.")
     (license license:gpl2)))
 
-(define-public lkrg
-  (package
-    (name "lkrg")
-    (version "0.9.7")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                    (url "https://github.com/lkrg-org/lkrg")
-                    (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "0k0z9caj48nqjwk3bapgfcdzi1lkizxcjj4r1dvkvwsk38mbk1c4"))))
-    (build-system linux-module-build-system)
-    (arguments
-     (list #:linux linux-libre
-           #:tests? #f
-           #:make-flags #~(list (string-append "CC="
-                                               #$(cc-for-target))
-                                (string-append "SYSSRC="
-                                               (assoc-ref %build-inputs
-                                                "linux-module-builder")
-                                               "/lib/modules/build"))))
-    (inputs (list bash-minimal))
-    (home-page "https://lkrg.org/")
-    (synopsis "Linux Kernel Runtime Guard")
-    (description
-     "This package performs runtime integrity checking of the Linux kernel and
-detection of security vulnerability exploits against the kernel.")
-    (license license:gpl2)))
-
-(define-public vhba-module
-  (package
-    (name "vhba-module")
-    (version "20211218")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (string-append
-             "http://downloads.sourceforge.net/cdemu/vhba-module/vhba-module-"
-             version ".tar.xz"))
-       (sha256
-        (base32 "1dkprnnya0i8121p7ip4g8cww99drk7fzbwcxx65x02jqk0siibj"))))
-    (build-system linux-module-build-system)
-    (arguments
-     (list #:tests? #f))                ; no test suite
-    (home-page "https://cdemu.sourceforge.io/")
-    (synopsis "Linux kernel module that emulates SCSI devices")
-    (description
-     "The @acronym{VHBA, Virtual SCSI Host Bus Adapter} module is the link
-between the CDemu user-space daemon and the kernel Linux.  It acts as a
-low-level SCSI driver that emulates a virtual SCSI adapter which can have
-multiple virtual devices attached to it.  Its typical use with CDEmu is to
-emulate optical devices such as DVD and CD-ROM drives.")
-    (license license:gpl2+)))
-
 (define-public bbswitch-module
   ;; Use "develop" branch since stable release does not build on Linux >= 5.6.
   ;; See https://github.com/Bumblebee-Project/bbswitch/issues/205.
@@ -3164,36 +3018,6 @@ Linux kernel module, it also contains a modprobe configuration and udev rules,
 which need to be installed separately.")
     (license license:gpl3+)))
 
-(define-public vendor-reset-linux-module
-  (let ((commit "4b466e92a2d9f76ce1082cde982c7be0be91e248")
-        (revision "0"))
-    (package
-      (name "vendor-reset-linux-module")
-      (version (git-version "0.1.0" revision commit))
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://github.com/gnif/vendor-reset")
-                      (commit commit)))
-                (file-name (git-file-name name version))
-                (sha256
-                 (base32
-                  "1gaf4j20grng689c9fylcqri3j9ycnhr2bsva2z6qcdqvzl6yxbi"))))
-      (build-system linux-module-build-system)
-      (arguments
-       (list #:tests? #f)) ;no test suite
-      (home-page "https://github.com/gnif/vendor-reset")
-      (synopsis
-       "Kernel module that resets GPUs that are affected by the reset bug")
-      (description
-       "This package provides a kernel module that is capable of
-resetting hardware devices into a state where they can be
-re-initialized or passed through into a virtual machine (VFIO).
-While it would be great to have these in the kernel as PCI quirks,
-some of the reset procedures are very complex and would never be
-accepted as a quirk (ie AMD Vega 10).")
-      (license license:gpl2))))
-
 
 ;;;
 ;;; Pluggable authentication modules (PAM).
@@ -12094,7 +11918,7 @@ provides user-space tools for creating EROFS file systems.")
 (define-public rasdaemon
   (package
     (name "rasdaemon")
-    (version "0.8.3")
+    (version "0.8.4")
     (source
      (origin
        (method git-fetch)
@@ -12103,9 +11927,17 @@ provides user-space tools for creating EROFS file systems.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0vfw4vf75fnpbxnfsmpdwdzhplnccz24j23bg6nsb3b4wa8hv4sa"))))
+        (base32 "1930g35igfdw5bzcd6diy59rm1q4yirpjgqznfqfsichnmk04kmf"))))
     (native-inputs (list autoconf automake libtool pkg-config))
-    (inputs (list bash-minimal libtraceevent perl perl-dbd-sqlite sqlite dmidecode kmod))
+    (inputs
+     (list bash-minimal
+           dmidecode
+           kmod
+           libtraceevent
+           pciutils
+           perl
+           perl-dbd-sqlite
+           sqlite))
     (arguments
      (list
       #:configure-flags

gnu/packages/lua.scm

@@ -89,6 +89,7 @@
   #:use-module (gnu packages wget)
   #:use-module (gnu packages xml)
   #:use-module (gnu packages xorg)
+  #:use-module (ice-9 match)
   #:use-module ((srfi srfi-1) #:hide (zip)))
 
 (define (lua-search-paths version)
@@ -170,6 +171,22 @@ for configuration, scripting, and rapid prototyping.")
                                               "lua-5.4-search-paths.patch"))))
            (native-search-paths (lua-search-paths "5.4"))))
 
+
+(define-public lua-5.4-for-c++
+  (let ((lua-pkg lua-5.4))
+    (hidden-package
+     (package/inherit lua-pkg
+       (name (string-append (package-name lua-pkg) "-for-c++"))
+       (arguments
+        (substitute-keyword-arguments (package-arguments lua-pkg)
+          ((#:make-flags old-flags)
+           (map
+            (match-lambda
+              ((string-append "CC=" _)
+               `(string-append "CC=" ,(cxx-for-target)))
+              (else else))
+            old-flags))))))))
+
 (define-public lua-5.2
   (package (inherit lua)
            (version "5.2.4")

gnu/packages/maths.scm

@@ -2475,6 +2475,9 @@ similar to MATLAB, GNU Octave or SciPy.")
                    ;; "--enable-doxygen"
                    "--enable-dot"
                    "--enable-netcdf-4"
+                   #$@(if (or (target-x86-32?) (target-arm32?))
+                          '("CFLAGS=-Wno-error=incompatible-pointer-types")
+                          '())
                    (string-append "--with-plugin-dir=" #$output "/lib/hdf5-plugins"))
            #:phases
            #~(modify-phases %standard-phases
@@ -2486,7 +2489,15 @@ similar to MATLAB, GNU Octave or SciPy.")
                      (("testurl.sh") ""))
                    (substitute* "nczarr_test/Makefile.in"
                      (("/bin/bash")
-                      (search-input-file inputs "bin/bash")))))
+                      (search-input-file inputs "bin/bash")))
+                   ;; This test fails on 32 bit platforms.
+                   #$@(if (or (target-x86-32?) (target-arm32?))
+                          '((substitute* '("ncdump/tst_netcdf4_4.sh"
+                                           "ncdump/tst_nccopy4.sh")
+                              (("#!/bin/sh" m) (string-append m "\nexit 0\n")))
+                            (substitute* "ncdump/Makefile.in"
+                              (("tst_netcdf4_4.log") "")))
+                          '())))
                (add-before 'configure 'fix-source-date
                  (lambda _
                    ;; As we ${SOURCE_DATE_EPOCH} evaluates to "1" in the build
@@ -9647,7 +9658,7 @@ researchers and developers alike to get started on SAT.")
 (define-public kissat
   (package
     (name "kissat")
-    (version "4.0.1")
+    (version "4.0.4")
     (source
      (origin
        (method git-fetch)
@@ -9657,7 +9668,7 @@ researchers and developers alike to get started on SAT.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "0acg61cfcjg13if2i375cyl4xvwmabhfhi9z8pnw971046am6bzv"))))
+         "1snimig4cp97p570nin2i38my72zvwypldyhr125i1z6cd9pa046"))))
     (build-system gnu-build-system)
     (inputs (list xz gzip lzip bzip2 p7zip))
     (arguments
@@ -9668,6 +9679,10 @@ researchers and developers alike to get started on SAT.")
       #~(modify-phases %standard-phases
           (add-after 'unpack 'patch-source
             (lambda* (#:key inputs #:allow-other-keys)
+              (substitute* "test/testfile.c"
+                ;; Don't check if /etc/passwd isn't writable.
+                ;; When building in a container/chroot, this fails spuriously.
+                ((".*/etc/passwd.*") ""))
               (substitute* "scripts/generate-build-header.sh"
                 ;; by default BUILD includes the build date which
                 ;; makes the build not reproducible.

gnu/packages/messaging.scm

@@ -1151,7 +1151,7 @@ simultaneously and therefore appear under the same nickname on IRC.")
 (define-public python-nbxmpp
   (package
     (name "python-nbxmpp")
-    (version "7.1.0")
+    (version "7.2.0")
     (source
      (origin
        (method git-fetch)
@@ -1160,7 +1160,7 @@ simultaneously and therefore appear under the same nickname on IRC.")
               (commit version)))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1n7b6yv2k89hsmhmx9pi7m8l3aq97xppaz3hm7mvqgvxnlw0c1kr"))))
+        (base32 "1dyf4jh76ffbl45x4cpk6rsn1r4wck54b3d8wfd2swxaqq4p7lis"))))
     (build-system pyproject-build-system)
     (arguments (list #:test-backend #~'unittest))
     (propagated-inputs
@@ -1184,7 +1184,7 @@ of xmpppy.")
 (define-public gajim
   (package
     (name "gajim")
-    (version "2.4.5")
+    (version "2.4.6")
     (source
      (origin
        (method url-fetch)
@@ -1192,7 +1192,7 @@ of xmpppy.")
                            (version-major+minor version)
                            "/gajim-" version ".tar.gz"))
        (sha256
-         (base32 "1rkxzf1pfd29rip5bw4730fl7b2xk12zpiwnfkyzxlkmbh4j3kp2"))
+         (base32 "0ilpgkzw45scjlnag94p8v6np629v7w0ihci5a2w5d742gpqvq6c"))
        (patches
          (search-patches "gajim-honour-GAJIM_PLUGIN_PATH.patch"))))
     (build-system pyproject-build-system)
@@ -1278,7 +1278,6 @@ of xmpppy.")
            glib
            glib-networking
            gsettings-desktop-schemas
-           gsound
            libspelling
            libadwaita
            gstreamer
@@ -1293,6 +1292,7 @@ of xmpppy.")
            libsoup
            libxscrnsaver
            network-manager
+           python-cryptography
            python-css-parser
            python-dbus-1.2
            python-emoji

gnu/packages/mpi.scm

@@ -76,95 +76,7 @@
   #:use-module (srfi srfi-1)
   #:use-module (ice-9 match))
 
-(define-public hwloc-1
-  (package
-    (name "hwloc")
-    (version "1.11.13")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://www.open-mpi.org/software/hwloc/v"
-                                  (version-major+minor version)
-                                  "/downloads/hwloc-" version ".tar.bz2"))
-              (sha256
-               (base32
-                "1j69p8a1pjpbpwn4w7l4dfxmaxxqikchjzqw1ncw05zmcmvlnjd4"))
-              (patches (search-patches "hwloc-1-test-btrfs.patch"))))
-
-    (properties
-     ;; Tell the 'generic-html' updater to monitor this URL for updates.
-     `((release-monitoring-url
-        . "https://www-lb.open-mpi.org/software/hwloc/current")))
-
-    (build-system gnu-build-system)
-    (outputs '("out"           ;'lstopo' & co., depends on Cairo, libx11, etc.
-               "lib"           ;small closure
-               "doc"           ;400+ section 3 man pages
-               "debug"))
-    (inputs
-     (append (if (%current-target-system)
-                 '()                  ;fewer dependencies when cross-compiling
-                 (list libx11 cairo ncurses expat))
-             (if (target-arm32?) '() (list numactl))))
-    (propagated-inputs
-     ;; hwloc.pc lists it in 'Requires.private'.
-     (list libpciaccess))
-    (native-inputs
-     (list pkg-config))
-    (arguments
-     (list #:configure-flags
-           #~(list "--localstatedir=/var")
-           #:phases
-           #~(modify-phases %standard-phases
-               (add-before 'check 'skip-linux-libnuma-test
-                 (lambda _
-                   ;; Arrange to skip 'tests/linux-libnuma', which fails on some
-                   ;; machines: <https://github.com/open-mpi/hwloc/issues/213>.
-                   (substitute* "tests/linux-libnuma.c"
-                     (("numa_available\\(\\)")
-                      "-1"))))
-               (add-after 'install 'refine-libnuma
-                 ;; Give -L arguments for libraries to avoid propagation
-                 (lambda* (#:key inputs outputs #:allow-other-keys)
-                   (let ((out  (assoc-ref outputs "lib"))
-                         (numa (assoc-ref inputs "numactl")))
-                     (substitute* (map (lambda (f) (string-append out "/" f))
-                                       '("lib/pkgconfig/hwloc.pc" "lib/libhwloc.la"))
-                       (("-lnuma" lib)
-                        (string-append "-L" numa "/lib " lib))))))
-               (add-after 'install 'avoid-circular-references
-                 (lambda* (#:key outputs #:allow-other-keys)
-                   (let ((lib (assoc-ref outputs "lib")))
-                     ;; Suppress the 'prefix=' and 'exec_prefix=' lines so that the
-                     ;; "lib" output doesn't refer to "out".
-                     (substitute* (string-append lib "/lib/pkgconfig/hwloc.pc")
-                       (("^.*prefix=.*$")
-                        "")))))
-               (add-after 'install 'move-man3-pages
-                 (lambda* (#:key outputs #:allow-other-keys)
-                   ;; Move section 3 man pages to the "doc" output.
-                   (let ((out (assoc-ref outputs "out"))
-                         (doc (assoc-ref outputs "doc")))
-                     (copy-recursively (string-append out "/share/man/man3")
-                                       (string-append doc "/share/man/man3"))
-                     (delete-file-recursively
-                      (string-append out "/share/man/man3"))))))))
-    (home-page "https://www.open-mpi.org/projects/hwloc/")
-    (synopsis "Abstraction of hardware architectures")
-    (description
-     "hwloc provides a portable abstraction (across OS,
-versions, architectures, ...) of the hierarchical topology of modern
-architectures, including NUMA memory nodes, sockets, shared caches, cores and
-simultaneous multithreading.  It also gathers various attributes such as cache
-and memory information.  It primarily aims at helping high-performance
-computing applications with gathering information about the hardware so as to
-exploit it accordingly and efficiently.
-
-hwloc may display the topology in multiple convenient formats.  It also offers
-a powerful programming interface to gather information about the hardware,
-bind processes, and much more.")
-    (license license:bsd-3)))
-
-(define-public hwloc-2
+(define-public hwloc
   (package
     (name "hwloc")
     (version "2.13.0")
@@ -274,10 +186,6 @@ a powerful programming interface to gather information about the hardware,
 bind processes, and much more.")
     (license license:bsd-3)))
 
-(define-public hwloc
-  ;; The latest stable series of hwloc.
-  hwloc-2)
-
 (define-public openmpi-4
   (package
     (name "openmpi")
@@ -306,7 +214,7 @@ bind processes, and much more.")
                                (package-supported-systems package)))
                   (list package)
                   '()))))
-       (append (list `(,hwloc-2 "lib")
+       (append (list `(,hwloc "lib")
                      gfortran
                      libfabric-1                  ;fails to build with 2.3
                      libevent
@@ -699,7 +607,7 @@ arrays) that expose a buffer interface.")
     (build-system gnu-build-system)
     (inputs
      `(,zlib
-       (,hwloc-2 "lib")
+       (,hwloc "lib")
        ,slurm
        ,@(if (and (not (%current-target-system))
                   (member (%current-system) (package-supported-systems ucx)))

gnu/packages/node.scm

@@ -966,7 +966,7 @@ fi"
            icu4c-76
            libuv-for-node-lts
            `(,nghttp2 "lib")
-           openssl
+           openssl-3.0
            zlib
            ; ngtcp2? nghttp3?
            ;; Regular build-time dependencies.
@@ -986,7 +986,7 @@ fi"
            ngtcp2
            nghttp3
            `(,nghttp2 "lib")
-           openssl
+           openssl-3.0
            zlib))
     (supported-systems
       (cons "riscv64-linux" (package-supported-systems node-bootstrap)))

gnu/packages/ntp.scm

@@ -173,7 +173,7 @@ time-stamping or reference clock, sub-microsecond accuracy is possible.")
     (native-inputs (list which pkg-config))
     (inputs (cons* guile-3.0    ; for wrap-script
                    libevent
-                   openssl
+                   openssl-3.0
                    perl
                    perl-http-tiny
                    perl-io-socket-ssl

gnu/packages/nutrition.scm

@@ -81,72 +81,3 @@
     (description "This tool extracts cooking recipe from HTML structured data
 in the @url{https://schema.org/Recipe} format.")
     (license asl2.0)))
-
-(define-public gourmet
-  ;; Use the latest commit to gain Python 3 support.
-  (let ((revision "0")
-        (commit "8af29c8ded24528030e5ae2ea3461f61c1e5a575"))
-    (package
-      (name "gourmet")
-      (version (git-version "0.17.4" revision commit))
-      (source
-       (origin
-         (method git-fetch)
-         (uri (git-reference
-                (url "https://github.com/thinkle/gourmet")
-                (commit commit)))
-         (file-name (git-file-name name version))
-         (sha256
-          (base32
-           "08fbw6zp32ws6w9czwy2sqc9c9izlkglsskshj2114d0l79z4gj8"))
-         (patches (search-patches "gourmet-sqlalchemy-compat.patch"))))
-      (build-system pyproject-build-system)
-      (arguments
-       (list
-        #:test-flags
-        ;; XXX: Some tests in deeper directories or otherwise discovered by
-        ;; Pytest are broken.
-        #~(list "--ignore-glob=gourmet/tests/**/*.py")
-        #:phases
-        #~(modify-phases %standard-phases
-            (add-before 'build 'set-environemnt
-              (lambda _
-                (setenv "HOME" "/tmp")
-                (system "Xvfb &")
-                (setenv "DISPLAY" ":0")))
-            (add-after 'install 'install-dekstop-file-and-icons
-              (lambda _
-                (define share (string-append #$output "/share"))
-                (install-file ".flatpak/io.github.thinkle.Gourmet.desktop"
-                              (string-append share "/applications"))
-                (install-file ".flatpak/io.github.thinkle.Gourmet.svg"
-                              (string-append share "/icons/Gourmet")))))))
-      (native-inputs
-       (list python-dogtail
-             python-pytest
-             python-selenium
-             python-setuptools
-             xorg-server-for-tests))
-      (inputs
-       (list gtk+
-             python-argcomplete
-             python-beautifulsoup4
-             python-gst
-             python-keyring
-             python-lxml
-             python-pillow
-             python-pycairo
-             python-pyenchant
-             python-pygobject
-             python-requests
-             python-scrape-schema-recipe
-             python-sqlalchemy
-             python-toml))
-      (home-page "https://thinkle.github.io/gourmet/")
-      (synopsis "Recipe organizer")
-      (description
-       "Gourmet Recipe Manager is a recipe organizer that allows you to collect,
-search, organize, and browse your recipes.  Gourmet can also generate shopping
-lists and calculate nutritional information.  It imports Mealmaster,
-MasterCook and KRecipe files and exports PDFs, webpages, and other formats.")
-      (license gpl2+))))

gnu/packages/ocaml.scm

@@ -91,6 +91,7 @@
   #:use-module (gnu packages tls)
   #:use-module (gnu packages unicode)
   #:use-module (gnu packages version-control)
+  #:use-module (gnu packages vim)
   #:use-module (gnu packages virtualization)
   #:use-module (gnu packages web)
   #:use-module (gnu packages web-browsers)
@@ -797,30 +798,29 @@ describing upgrade scenarios in package-based software distributions.")
 (define-public ocaml-mccs
   (package
     (name "ocaml-mccs")
-    (version "1.1+14")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/AltGr/ocaml-mccs")
-                     (commit version)))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "17bvm0jhhs8h3p5sbb65asj53a8sxl634cc0kvcivpams74837zq"))))
+    (version "1.1+19")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/AltGr/ocaml-mccs")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1x1y5rhj4f0xakbgfn9f90a9xy09v99p8mc42pbnam5kghyjmxy6"))))
     (build-system dune-build-system)
     (propagated-inputs (list ocaml-cudf))
     (home-page "https://www.i3s.unice.fr/~cpjm/misc/")
     (synopsis "Upgrade path problem solver")
-    (description "Mccs (Multi Criteria CUDF Solver) is a CUDF problem solver.
+    (description
+     "Mccs (Multi Criteria CUDF Solver) is a CUDF problem solver.
 Mccs take as input a CUDF problem and computes the best solution according to
 a set of criteria.  It relies on a Integer Programming solver or a
 Pseudo Boolean solver to achieve its task.  Mccs can use a wide set of
 underlying solvers like Cplex, Gurobi, Lpsolver, Glpk, CbC, SCIP or WBO.")
-    (license (list
-               license:bsd-3
-               license:gpl3+
-               ;; With static-linking exception
-               license:lgpl2.1+))))
+    (license (list license:bsd-3 license:gpl3+
+                   ;; With static-linking exception
+                   license:lgpl2.1+))))
 
 (define-public ocaml-dose3
   (package
@@ -945,47 +945,156 @@ the opam file format.")
     ;; With static-linking exception
     (license license:lgpl2.1+)))
 
+(define-public ocaml-swhid-core
+  (package
+    (name "ocaml-swhid-core")
+    (version "0.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/OCamlPro/swhid_core")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0h3zndyk94lf2lakc3cb8b7a00jqh0y1m8xk6mg61gj2kdpdbfdq"))))
+    (build-system dune-build-system)
+    (properties `((upstream-name . "swhid_core")))
+    (home-page "https://github.com/ocamlpro/swhid_core")
+    (synopsis "OCaml library to work with swhids")
+    (description
+     "swhid_core is an OCaml library to work with Software Heritage persistent
+identifiers (swhids).  This is the core library, for most use cases you should
+use the swhid library instead.")
+    (license license:isc)))
+
+(define-public ocaml-spdx-licenses
+  (package
+    (name "ocaml-spdx-licenses")
+    (version "1.3.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/kit-ty-kate/spdx_licenses")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "08vh9mfkq34f0l5ka94hhklc43kvz09wd04x1gkxkawn4786rf9z"))))
+    (build-system dune-build-system)
+    (native-inputs (list ocaml-alcotest))
+    (properties `((upstream-name . "spdx_licenses")))
+    (home-page "https://github.com/kit-ty-kate/spdx_licenses")
+    (synopsis "Strict SPDX License Expression parser")
+    (description
+     "This package provides an up-to-date and strict SPDX License Expression
+parser.  It implements the format described in:
+https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/
+See https://spdx.org/licenses/ for more details.")
+    (license license:expat)))
+
+(define-public ocaml-0install-solver
+  (package
+    (name "ocaml-0install-solver")
+    (version "2.18")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/0install/0install")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1hm72k355qwgh16hngmnd77bgawf20ipnqxfncdzl10rqrc0640b"))))
+    (build-system dune-build-system)
+    (arguments
+     `(#:package "0install-solver"))
+    (native-inputs (list ocaml-ounit2))
+    (home-page "https://docs.0install.net/developers/solver/")
+    (synopsis "Package dependency solver")
+    (description
+     "This package provides a package dependency resolver based on a SAT solver.
+This was originally written for the 0install package manager, but is now
+generic and is also used as a solver backend for opam.  The SAT solver is
+based on @code{MiniSat} (http://minisat.se/Papers.html) and the application to
+package management is based on OPIUM (Optimal Package Install/Uninstall
+Manager).  0install-solver uses a (novel?) strategy to find the optimal
+solution extremely quickly (even for a SAT-based solver).")
+    (license license:lgpl2.1+)))
+
+(define-public ocaml-opam-0install-cudf
+  (package
+    (name "ocaml-opam-0install-cudf")
+    (version "0.5.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/ocaml-opam/opam-0install-cudf")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "12v1bgnxcxdylgxbsjlcr90rzwcp39rjlv191cy8g2s33nyxyi2c"))))
+    (build-system dune-build-system)
+    (propagated-inputs (list ocaml-cudf ocaml-0install-solver))
+    (native-inputs (list ocaml-alcotest))
+    (home-page "https://opam.ocaml.org")
+    (synopsis "Opam solver using 0install backend using the CUDF interface")
+    (description
+     "Opam's default solver is designed to maintain a set of packages over time,
+minimising disruption when installing new programs and finding a compromise
+solution across all packages.  In many situations (e.g. CI, local roots or
+duniverse builds) this is not necessary, and we can get a solution much faster
+by using a different algorithm.  This package provides a generic solver library
+which uses 0install's solver library.  The library uses the CUDF library in
+order to interface with opam as it is the format common used to talk to all the
+supported solvers.")
+    (license license:isc)))
+
 (define ocaml-opam-core
   (package
     (name "ocaml-opam-core")
-    (version "2.1.5")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/ocaml/opam")
-                     (commit version)))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "0ckd87rcmcz11iyhhm5qnmy27jbdffx6n1fr06hvrqqrzi00jljh"))))
+    (version "2.5.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/ocaml/opam")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "10diw6wdl6v89kbvb8x22dbfacw1ikhl63hybyp2s7560450hygc"))))
     (build-system dune-build-system)
-    (arguments `(#:package "opam-core"
-                 ;; tests are run with the opam package
-                 #:tests? #f
-                 #:phases
-                 (modify-phases %standard-phases
-                   (add-before 'build 'pre-build
-                     (lambda* (#:key inputs make-flags #:allow-other-keys)
-                       (let ((bash (assoc-ref inputs "bash"))
-                             (bwrap (search-input-file inputs "/bin/bwrap")))
-                         (substitute* "src/core/opamSystem.ml"
-                           (("\"/bin/sh\"")
-                            (string-append "\"" bash "/bin/sh\""))
-                           (("getconf")
-                            (which "getconf")))))))))
-    (propagated-inputs
-     (list ocaml-graph
-           ocaml-re
-           ocaml-cppo))
+    (arguments
+     `(#:package "opam-core"
+       ;; tests are run with the opam package
+       #:tests? #f
+       #:phases (modify-phases %standard-phases
+                  (add-before 'build 'pre-build
+                    (lambda* (#:key inputs make-flags #:allow-other-keys)
+                      (let ((bash (assoc-ref inputs "bash"))
+                            (bwrap (search-input-file inputs "/bin/bwrap")))
+                        (substitute* "src/core/opamSystem.ml"
+                          (("\"/bin/sh\"")
+                           (string-append "\"" bash "/bin/sh\""))
+                          (("getconf")
+                           (which "getconf")))))))))
+    (propagated-inputs (list ocaml-graph
+                             ocaml-re
+                             ocaml-patch
+                             ocaml-uutf
+                             ocaml-swhid-core
+                             ocaml-jsonm
+                             ocaml-sha))
     (inputs (list bubblewrap))
-    (home-page "https://opam.ocamlpro.com/")
+    (home-page "https://opam.ocaml.org")
     (synopsis "Package manager for OCaml")
     (description
      "OPAM is a tool to manage OCaml packages.  It supports multiple
 simultaneous compiler installations, flexible package constraints, and a
 Git-friendly development workflow.")
-    ;; The 'LICENSE' file waives some requirements compared to LGPLv3.
-    (license license:lgpl3)))
+    ;; The 'LICENSE' file waives some requirements compared to LGPLv2.1.
+    (license license:lgpl2.1)))
 
 (define ocaml-opam-format
   (package
@@ -1002,24 +1111,56 @@ Git-friendly development workflow.")
 
 (define-public opam-installer
   (package
-    (inherit ocaml-opam-core)
     (name "opam-installer")
-    (native-inputs (list ocaml-opam-format
-                         ocaml-cmdliner))
-    (inputs '())
-    (propagated-inputs '())
-    (arguments `(#:package "opam-installer"
-                 ;; requires all of opam
-                 #:tests? #f))
+    (version "2.5.1")
+    ;; opam has some library dependencies that in turn depend on
+    ;; opam-installer (https://codeberg.org/guix/guix/issues/3588).  To break
+    ;; the cycle, we build opam-installer from a version of the release that
+    ;; vendors all dependencies. Then the remaining opam packages can be built
+    ;; in the usual way from git sources.
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/ocaml/opam/releases/download/"
+                           version "/opam-full-" version ".tar.gz"))
+       (sha256
+        (base32 "1v9k00az5lkdrlb64xb9h8xasnsz73kms0j0bz64hh2wbypvzia8"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      ;; Tests depend on the full opam package.
+      #:tests? #f
+      #:configure-flags
+      #~'("--with-vendored-deps")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'fix-shell-path
+            (lambda _
+              (let ((sh (which "sh")))
+                (substitute* "configure"
+                  (("/bin/sh") sh)))))
+          ;; The Makefile builds both opam and opam-installer, but we
+          ;; only want the latter.
+          (replace 'install
+            (lambda _
+              (define (install source dest-dir)
+                (install-file source
+                              (string-append #$output "/" dest-dir)))
+              (install "opam-installer" "bin")
+              (install "_build/default/doc/man/opam-installer.1"
+                       "share/man/man1"))))))
+    (native-inputs (list ocaml))
+    (home-page "https://opam.ocaml.org")
     (synopsis "Tool for installing OCaml packages")
-    (description "@var{opam-installer} is a tool for installing OCaml packages
+    (description
+     "@var{opam-installer} is a tool for installing OCaml packages
 based on @code{.install} files defined by the OPAM package manager.  It is
 useful for installing OCaml packages without requiring the entirety of
 OPAM.")
-    (properties
-     ;; opam-installer is used as a tool and not as a library, we can use the
-     ;; OCaml 4.14 compiled opam until opam is compatible with OCaml 5.0.
-     `((ocaml5.0-variant . ,(delay opam-installer))))))
+    (properties `((ocaml5.0-variant unquote
+                                    (delay opam-installer))))
+    ;; The 'LICENSE' file waives some requirements compared to LGPLv2.1.
+    (license license:lgpl2.1)))
 
 (define ocaml-opam-repository
   (package
@@ -1056,7 +1197,7 @@ OPAM.")
                             (string-append "add_sys_mounts "
                                            (%store-directory)
                                            " /run/current-system /usr")))))))))
-    (inputs (list bubblewrap))
+    (inputs (list bubblewrap ocaml-spdx-licenses))
     (propagated-inputs (list ocaml-opam-repository))))
 
 (define ocaml-opam-solver
@@ -1066,7 +1207,8 @@ OPAM.")
     (inputs '())
     (propagated-inputs (list ocaml-opam-format
                              ocaml-mccs
-                             ocaml-dose3))
+                             ocaml-dose3
+                             ocaml-opam-0install-cudf))
     (arguments `(#:package "opam-solver"
                  ;; tests are run with the opam package
                  #:tests? #f
@@ -1093,7 +1235,7 @@ OPAM.")
            ocaml-opam-repository
            ocaml-base64
            ocaml-re
-           ocaml-cmdliner))))
+           ocaml-spdx-licenses))))
 
 (define-public opam
   (package
@@ -1102,120 +1244,171 @@ OPAM.")
     (build-system dune-build-system)
     (arguments
      `(#:package "opam"
-       #:phases
-       (modify-phases %standard-phases
-         (add-before 'check 'prepare-checks
-           (lambda* (#:key inputs #:allow-other-keys)
-             ;; Opam tests need to run an isolated environment from a writable
-             ;; home directory.
-             (mkdir-p "test-home")
-             (setenv "HOME" (string-append (getcwd) "/test-home"))
-             (with-output-to-file (string-append (getcwd) "/test-home/.gitconfig")
-               (lambda _
-                 (display "[user]
+       #:phases (modify-phases %standard-phases
+                  (add-before 'check 'prepare-checks
+                    (lambda* (#:key inputs #:allow-other-keys)
+                      ;; Opam tests need to run an isolated environment from a writable
+                      ;; home directory.
+                      (mkdir-p "test-home")
+                      (setenv "HOME"
+                              (string-append (getcwd) "/test-home"))
+                      (with-output-to-file (string-append (getcwd)
+                                            "/test-home/.gitconfig")
+                        (lambda _
+                          (display "[user]
 email = guix@localhost.none
-name = Guix Builder")
-                 (newline)))
+name = Guix Builder
 
-             ;; Opam tests require data from opam-repository. Instead of
-             ;; downloading them with wget from the guix environment, copy the
-             ;; content to the expected directory.
-             (substitute* "tests/reftests/dune.inc"
-               (("tar -C.*opam-archive-([0-9a-f]*)[^)]*" _ commit)
-                (string-append "rmdir %{targets}) (run cp -r "
-                               (assoc-ref inputs (string-append "opam-repo-" commit))
-                               "/ %{targets}) (run chmod +w -R %{targets}"))
-               (("wget[^)]*") "touch %{targets}")
-               ;; Disable a failing test because it tries to clone a git
-               ;; repository from inside bwrap
-               (("diff upgrade-format.test upgrade-format.out") "run true")
-               ;; Disable a failing test because it tries to figure out which
-               ;; distro this is, and it doesn't know Guix
-               (("diff pin.unix.test pin.unix.out") "run true")
-               ;; Disable a failing test because of a failed expansion
-               (("diff opamroot-versions.test opamroot-versions.out") "run true")
-               ;; Disable a failing test, probably because the repository we
-               ;; replaced is not as expected
-               (("diff opamrt-big-upgrade.test opamrt-big-upgrade.out") "run true")
-               ;; Disable a failing test because of missing sandboxing
-               ;; functionality
-               (("diff init.test init.out") "run true"))
-             (substitute* "tests/reftests/dune"
-               ;; Because of our changes to the previous file, we cannot check
-               ;; it can be regenerated
-               (("diff dune.inc dune.inc.gen") "run true"))
-             ;; Ensure we can run the generated build.sh (no /bin/sh)
-             (substitute* '("tests/reftests/legacy-local.test"
-                            "tests/reftests/legacy-git.test")
-               (("#! ?/bin/sh")
-                (string-append "#!"
-                               (search-input-file inputs "/bin/sh"))))
-             (substitute* "tests/reftests/testing-env"
-               (("OPAMSTRICT=1")
-                (string-append "OPAMSTRICT=1\nLIBRARY_PATH="
-                               (assoc-ref inputs "libc") "/lib"))))))))
-    (native-inputs
-      (let ((opam-repo (lambda (commit hash)
-                         (origin
-                           (method git-fetch)
-                           (uri (git-reference
-                                  (url "https://github.com/ocaml/opam-repository")
-                                  (commit commit)))
-                           (file-name (git-file-name "opam-repo" commit))
-                           (sha256 (base32 hash))))))
-       `(("dune" ,dune)
-         ("ocaml-cppo" ,ocaml-cppo)
+[protocol \"file\"]
+allow = always")
+                          (newline)))
 
-         ;; For tests.
-         ("git" ,git-minimal/pinned)
-         ("openssl" ,openssl)
-         ("python" ,python-wrapper)
-         ("rsync" ,rsync)
-         ("unzip" ,unzip)
-         ("which" ,which)
+                      ;; Opam tests require data from opam-repository. Instead
+                      ;; of downloading them with wget from the guix
+                      ;; environment, copy the content to the expected
+                      ;; directory.
+                      (substitute* "tests/reftests/dune.inc"
+                        (("tar -C.*opam-archive-([0-9a-f]*)[^)]*" _ commit)
+                         (string-append "rmdir %{targets}) (run cp -r "
+                          (begin
+                            ;; When updating opam, uncomment the following
+                            ;; call.  It will list "opam-repo" commit-ish
+                            ;; required to run tests (see native-inputs
+                            ;; below).  Remove versions that are no longer
+                            ;; required, and add new ones if necessary.
+                            ;;
+                            ;; (pk commit)
+                            (assoc-ref inputs
+                                       (string-append "opam-repo-" commit)))
+                          "/ %{targets}) (run chmod +w -R %{targets}"))
+                        (("wget[^)]*")
+                         "touch %{targets}")
 
-         ;; Data for tests
-         ("opam-repo-0070613707"
-          ,(opam-repo "00706137074d536d2019d2d222fbe1bea929deda"
-                      "1gv1vvmfscj7wirfv6qncp8pf81wygnpzjwd0lyqcxm7g8r8lb4w"))
-         ("opam-repo-009e00fa"
-          ,(opam-repo "009e00fa86300d11c311309a2544e5c6c3eb8de2"
-                      "1wwy0rwrsjf4q10j1rh1dazk32fbzhzy6f7zl6qmndidx9b1bq7w"))
-         ("opam-repo-7090735c"
-          ,(opam-repo "7090735c9d1dd2dc481c4128c5ef4d3667238f15"
-                      "1bccsgjhlp64lmvfjfn6viywf3x73ji75myg9ssf1ij1fkmabn0z"))
-         ("opam-repo-a5d7cdc0"
-          ,(opam-repo "a5d7cdc0c91452b0aef4fa71c331ee5237f6dddd"
-                      "0z7kawqisy07088p5xjxwpvmvzlbj1d9cgdipsj90yx7nc5qh369"))
-         ("opam-repo-ad4dd344"
-          ,(opam-repo "ad4dd344fe5cd1cab49ced49d6758a9844549fb4"
-                      "1a1qj47kj8xjdnc4zc50ijrix1kym1n7k20n3viki80a7518baw8"))
-         ("opam-repo-c1842d168d"
-          ,(opam-repo "c1842d168de956caf06d7ac8588e65020d7594d8"
-                      "142y1ac7sprygyh91shcp0zcyfxjjkshi9g44qgg4rx60rbsbhai"))
-         ("opam-repo-c1d23f0e"
-          ,(opam-repo "c1d23f0e17ec83a036ebfbad1c78311b898a2ca0"
-                      "0j9abisx3ifzm66ci3p45mngmz4f0fx7yd9jjxrz3f8w5jffc9ii"))
-         ("opam-repo-f372039d"
-          ,(opam-repo "f372039db86a970ef3e662adbfe0d4f5cd980701"
-                      "0ld7fcry6ss6fmrpswvr6bikgx299w97h0gwrjjh7kd7rydsjdws"))
-         ("opam-repo-11ea1cb"
-          ,(opam-repo "11ea1cb6f2418b1f8a6679e4422771a04c9c3655"
-                      "1s4p0wfn3bx97yvm8xvj3yhzv2pz0jwml68g2ybv37hj9mpbrsq0"))
-         ("opam-repo-297366c"
-          ,(opam-repo "297366cd01c3aaf29b967bf0b34ccc7989d4d5b3"
-                      "1ysg69gys37nc2cxivs2ikh6xp0gj85if4rcrr874mqb9z12dm0j"))
-         ("opam-repo-3235916"
-          ,(opam-repo "3235916a162a59d7c82dac3fe24214975d48f1aa"
-                      "1yf73rv2n740a4s9g7a9k4j91b4k7al88nwnw9cdw0k2ncbmr486"))
-         ("opam-repo-de897adf36c4230dfea812f40c98223b31c4521a"
-          ,(opam-repo "de897adf36c4230dfea812f40c98223b31c4521a"
-                      "1m18x9gcwnbar8yv9sbfz8a3qpw412fp9cf4d6fb7syn0p0h96jw")))))
-    (inputs (list ocaml-opam-client))
-    (properties
-     ;; OPAM is used as a tool and not as a library, we can use the OCaml 4.14
-     ;; compiled opam until opam is compatible with OCaml 5.0.
-     `((ocaml5.0-variant . ,(delay opam))))))
+                        ;; Selectively disable a fraction of opam's "reftests"
+                        ;; (CRAM-style regression tests). Most of these tests
+                        ;; make assumptions about the build environment that
+                        ;; don't hold for Guix.
+
+                        ;; Test tries to clone a git repository from inside
+                        ;; bwrap
+                        (("diff upgrade-format.test upgrade-format.out")
+                         "run true")
+                        ;; Test tries to figure out which distro this is, and
+                        ;; it doesn't know Guix
+                        (("diff pin.unix.test pin.unix.out")
+                         "run true")
+                        ;; A variable expansion fails.
+                        (("diff opamroot-versions.test opamroot-versions.out")
+                         "run true")
+                        ;; The repository we replaced is probably not as
+                        ;; expected
+                        (("diff opamrt-big-upgrade.test opamrt-big-upgrade.out")
+                         "run true")
+                        ;; Disable a failing test because of missing sandboxing
+                        ;; functionality
+                        (("diff init.test init.out")
+                         "run true")
+                        ;; These tests try to normalize output to exclude
+                        ;; version strings, but this seems to break some
+                        ;; output assertions if $BASEDIR happens to include
+                        ;; the version.
+                        (("diff cli-versioning.test cli-versioning.out")
+                         "run true")
+                        (("diff hooks-variables.test hooks-variables.out")
+                         "run true")
+                        ;; Fails on noisy git output.
+                        (("diff action-disk.test action-disk.out")
+                         "run true")
+                        ;; Requires network access.
+                        (("diff download.test download.out")
+                         "run true")
+                        (("diff swhid.unix.test swhid.unix.out")
+                         "run true")
+                        ;; Depends on 3rd-party git repos.
+                        (("diff lock.test lock.out")
+                         "run true"))
+
+                      (substitute* "tests/reftests/dune"
+                        ;; Because of our changes to the previous file, we
+                        ;; cannot check it can be regenerated
+                        (("diff dune.inc dune.inc.gen")
+                         "run true"))
+                      ;; Ensure we can run the generated build.sh (no /bin/sh)
+                      (substitute* '("tests/reftests/legacy-local.test"
+                                     "tests/reftests/legacy-git.test")
+                        (("#! ?/bin/sh")
+                         (string-append "#!"
+                                        (search-input-file inputs "/bin/sh"))))
+                      (substitute* "tests/reftests/testing-env"
+                        (("OPAMSTRICT=1")
+                         (string-append "OPAMSTRICT=1\nLIBRARY_PATH="
+                                        (assoc-ref inputs "libc") "/lib"))))))))
+
+    (native-inputs (let ((opam-repo (lambda (commit hash)
+                                      (origin
+                                        (method git-fetch)
+                                        (uri (git-reference
+                                              (url
+                                               "https://github.com/ocaml/opam-repository")
+                                              (commit commit)))
+                                        (file-name (git-file-name "opam-repo"
+                                                                  commit))
+                                        (sha256 (base32 hash))))))
+                     `(("dune" ,dune)
+
+                       ;; For tests.
+                       ("git" ,git-minimal/pinned)
+                       ("openssl" ,openssl)
+                       ("python" ,python-wrapper)
+                       ("rsync" ,rsync)
+                       ("unzip" ,unzip)
+                       ("which" ,which)
+                       ("xxd" ,xxd)
+
+                       ;; Data for tests
+                       ("opam-repo-0070613707" ,(opam-repo
+                                                 "00706137074d536d2019d2d222fbe1bea929deda"
+                                                 "1gv1vvmfscj7wirfv6qncp8pf81wygnpzjwd0lyqcxm7g8r8lb4w"))
+                       ("opam-repo-009e00fa" ,(opam-repo
+                                               "009e00fa86300d11c311309a2544e5c6c3eb8de2"
+                                               "1wwy0rwrsjf4q10j1rh1dazk32fbzhzy6f7zl6qmndidx9b1bq7w"))
+                       ("opam-repo-11ea1cb" ,(opam-repo
+                                              "11ea1cb6f2418b1f8a6679e4422771a04c9c3655"
+                                              "1s4p0wfn3bx97yvm8xvj3yhzv2pz0jwml68g2ybv37hj9mpbrsq0"))
+                       ("opam-repo-143dd2a2f59f5befbf3cb90bb2667f911737fbf8" ,
+                        (opam-repo "143dd2a2f59f5befbf3cb90bb2667f911737fbf8"
+                         "1kliiy9n2j8myxhbz1brq6yingfy0si1bmv15j1hbnbpyi3bavr9"))
+                       ("opam-repo-297366c" ,(opam-repo
+                                              "297366cd01c3aaf29b967bf0b34ccc7989d4d5b3"
+                                              "1ysg69gys37nc2cxivs2ikh6xp0gj85if4rcrr874mqb9z12dm0j"))
+                       ("opam-repo-3235916" ,(opam-repo
+                                              "3235916a162a59d7c82dac3fe24214975d48f1aa"
+                                              "1yf73rv2n740a4s9g7a9k4j91b4k7al88nwnw9cdw0k2ncbmr486"))
+                       ("opam-repo-7090735c" ,(opam-repo
+                                               "7090735c9d1dd2dc481c4128c5ef4d3667238f15"
+                                               "1bccsgjhlp64lmvfjfn6viywf3x73ji75myg9ssf1ij1fkmabn0z"))
+                       ("opam-repo-7371c1d9" ,(opam-repo
+                                               "7371c1d9c53000840fb9a6d8ec13d87ffaa98401"
+                                               "0lmy3rmp5liyp2dsx4s90rjdwc012947ig2fz6y97s3pmwsbf9g8"))
+                       ("opam-repo-a5d7cdc0" ,(opam-repo
+                                               "a5d7cdc0c91452b0aef4fa71c331ee5237f6dddd"
+                                               "0z7kawqisy07088p5xjxwpvmvzlbj1d9cgdipsj90yx7nc5qh369"))
+                       ("opam-repo-ad4dd344" ,(opam-repo
+                                               "ad4dd344fe5cd1cab49ced49d6758a9844549fb4"
+                                               "1a1qj47kj8xjdnc4zc50ijrix1kym1n7k20n3viki80a7518baw8"))
+                       ("opam-repo-c1842d168d" ,(opam-repo
+                                                 "c1842d168de956caf06d7ac8588e65020d7594d8"
+                                                 "142y1ac7sprygyh91shcp0zcyfxjjkshi9g44qgg4rx60rbsbhai"))
+                       ("opam-repo-c1ba97dafe95c865d37ad4d88f6e57c9ffbe7f0a" ,
+                        (opam-repo "c1ba97dafe95c865d37ad4d88f6e57c9ffbe7f0a"
+                         "0sllm110dvs3w1k7qhias5y8v6ikkk2knw97v1fk9lnw4lq45gv6"))
+                       ("opam-repo-de897adf36c4230dfea812f40c98223b31c4521a" ,
+                        (opam-repo "de897adf36c4230dfea812f40c98223b31c4521a"
+                         "1m18x9gcwnbar8yv9sbfz8a3qpw412fp9cf4d6fb7syn0p0h96jw"))
+                       ("opam-repo-f372039d" ,(opam-repo
+                                               "f372039db86a970ef3e662adbfe0d4f5cd980701"
+                                               "0ld7fcry6ss6fmrpswvr6bikgx299w97h0gwrjjh7kd7rydsjdws")))))
+    (inputs (list ocaml-opam-client))))
 
 (define-public ocaml-opam-monorepo
   (package
@@ -4124,6 +4317,32 @@ and command-line tool.")
 length of domain names are preserved throughout the module.")
     (license license:isc)))
 
+(define-public ocaml-patch
+  (package
+    (name "ocaml-patch")
+    (version "3.1.0")
+    (build-system dune-build-system)
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/hannesm/patch")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1zg35f427ixd3jhkiwk91sil45pmf6ns7yfcgyi6gf2r0y241xn3"))))
+    (native-inputs (list ocaml-alcotest))
+    (home-page "https://github.com/hannesm/patch")
+    (synopsis "Applies unified diffs in pure OCaml")
+    (description
+     "This package applies unified diffs in pure OCaml.
+
+The loosely specified diff file format is widely used for transmitting
+differences of line-based information.  The motivating example is opam, which
+is able to validate updates being cryptographically signed (e.g. conex) by
+providing a unified diff.")
+    (license license:isc)))
+
 (define-public ocaml-macaddr
   (package
     (name "ocaml-macaddr")

gnu/packages/package-management.scm

@@ -817,7 +817,33 @@ high-performance computing} clusters.")
      (list
       #:phases
       #~(modify-phases %standard-phases
-          (add-after 'unpack 'register-guix-extension
+          (add-after 'unpack 'set-load-paths-in-entry-point
+            (lambda _
+              (define load-path
+                (cons (string-append #$output
+                                     "/share/guile/site/"
+                                     (target-guile-effective-version))
+                      (parse-path (getenv "GUILE_LOAD_PATH"))))
+              (define load-compiled-path
+                (cons (string-append #$output
+                                     "/lib/guile/"
+                                     (target-guile-effective-version)
+                                     "/site-ccache")
+                      (parse-path (getenv "GUILE_LOAD_COMPILED_PATH"))))
+              (define search-paths-header
+                `(begin
+                   (set! %load-path
+                         (append (list ,@load-path) %load-path))
+                   (set! %load-compiled-path
+                         (append (list ,@load-compiled-path)
+                                 %load-compiled-path))))
+              (substitute* "guix/extensions/toys.scm"
+                (("^\\(define-module \\(guix extensions toys\\)")
+                 (string-append
+                  (with-output-to-string
+                    (lambda () (write search-paths-header)))
+                  "\n(define-module (guix extensions toys)")))))
+          (add-after 'set-load-paths-in-entry-point 'register-guix-extension
             (lambda* (#:key outputs #:allow-other-keys)
               (let ((ext-path (string-append #$output "/share/guix/extensions")))
                 (mkdir-p ext-path)
@@ -1199,13 +1225,13 @@ transactions from C or Python.")
              automake
 
              ;; Guile libraries are needed here for cross-compilation.
-             guile-next
+             guile-3.0-latest
              guile-gnutls
              guile-json-4
              guix
              guix-data-service
              guix-build-coordinator
-             guile-fibers-next
+             guile-fibers
              guile-knots
              guile-pfds
              guile-prometheus
@@ -1216,7 +1242,7 @@ transactions from C or Python.")
              guix
              guix-data-service
              guix-build-coordinator
-             guile-fibers-next
+             guile-fibers
              guile-knots
              guile-pfds
              guile-prometheus
@@ -2185,7 +2211,7 @@ environments.")
                                           "guile-gnutls"
                                           #$@(if (target-hurd?)
                                                  '()
-                                                 '("guile-fibers-next"
+                                                 '("guile-fibers"
                                                    "guile-knots")))))
                        (wrap-program file
                          `("PATH" ":" prefix
@@ -2229,12 +2255,12 @@ environments.")
              guile-gcrypt
              guix
              guile-prometheus
-             guile-fibers-next
+             guile-fibers
              guile-knots
              guile-lib
-             guile-next))
+             guile-3.0-latest))
       (inputs
-       (list guile-next
+       (list guile-3.0-latest
              sqlite-next
              bash-minimal
              (libc-utf8-locales-for-target)
@@ -2249,7 +2275,7 @@ environments.")
              guile-sqlite3
              guix
              guile-gnutls
-             guile-fibers-next
+             guile-fibers
              guile-knots))
       (home-page "https://git.cbaines.net/guix/build-coordinator/")
       (synopsis "Tool to help build derivations")
@@ -2285,9 +2311,9 @@ outputs of those builds.")
            guix
            guile-prometheus
            guile-lib
-           guile-next))
+           guile-3.0-latest))
     (inputs
-     (list guile-next
+     (list guile-3.0-latest
            guix
            guile-prometheus
            guile-gcrypt
@@ -2438,7 +2464,7 @@ in an isolated environment, in separate namespaces.")
                                           "guile-prometheus"
                                           "guile-sqlite3"
                                           "guile-gnutls"
-                                          "guile-fibers-next"
+                                          "guile-fibers"
                                           "guile-knots")))
                        (wrap-program file
                          `("GUILE_LOAD_PATH" ":" prefix
@@ -2468,11 +2494,12 @@ in an isolated environment, in separate namespaces.")
 
              ;; Guile libraries are needed here for cross-compilation.
              guile-next
+             guile-3.0-latest
              guile-aws
              guile-json-4
              guile-gcrypt
              guix
-             guile-fibers-next
+             guile-fibers
              guile-knots
              guile-prometheus
              guile-lib
@@ -2481,13 +2508,13 @@ in an isolated environment, in separate namespaces.")
              guile-sqlite3))
       (inputs
        (list bash-minimal
-             guile-next))
+             guile-3.0-latest))
       (propagated-inputs
        (list guile-aws
              guile-json-4
              guile-gcrypt
              guix
-             guile-fibers-next
+             guile-fibers
              guile-knots
              guile-prometheus
              guile-lib

gnu/packages/parallel.scm

@@ -254,7 +254,7 @@ when jobs finish.")
     (inputs
      (append
        (list freeipmi
-             `(,hwloc-2 "lib")
+             `(,hwloc "lib")
              json-c
              linux-pam)
        (if (supported-package? openpmix-4)

gnu/packages/pascal.scm

@@ -39,6 +39,7 @@
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages qt)
   #:use-module (gnu packages xml)
   #:use-module (gnu packages xorg)
   #:use-module (ice-9 match))
@@ -323,7 +324,7 @@ Pascal programs.")
 (define-public lazarus
   (package
     (name "lazarus")
-    (version "2.2.6")
+    (version "4.6")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -336,48 +337,95 @@ Pascal programs.")
               (file-name (string-append name "-" version "-checkout"))
               (sha256
                (base32
-                "0hpk6fxmy1h1q0df41jg1vnp8g8vynrg5v5ad43lv229nizfs3wj"))))
+                "1mkimvd5hiwlsxpjwqnhd7lwb0x2icnf9ks09wza7j5xaq7xjswy"))))
     (build-system gnu-build-system)
     (arguments
      (list #:tests? #f ;No tests exist
            #:make-flags #~(list (string-append "INSTALL_PREFIX="
-                                               #$output))
-           #:phases #~(modify-phases %standard-phases
-                        (delete 'configure)
-                        (replace 'build
-                          (lambda* (#:key inputs outputs #:allow-other-keys)
-                            (let* ((libdirs (map (lambda (x)
-                                                   (assoc-ref inputs x))
-                                                 '("glib" "gdk-pixbuf"
-                                                   "gtk+"
-                                                   "libx11"
-                                                   "libx11"
-                                                   "pango"
-                                                   "cairo"
-                                                   "at-spi2-core")))
-                                   (libs (append (map (lambda (name)
-                                                        (string-append "-Fl"
-                                                                       name
-                                                                       "/lib"))
-                                                      libdirs)
-                                                 (map (lambda (name)
-                                                        (string-append
-                                                         "-k-rpath=" name
-                                                         "/lib")) libdirs))))
-                              (setenv "LAZARUS_LIBPATHS"
-                                      (string-join libs " "))
-                              (setenv "MAKEFLAGS"
-                                      (string-append "LHELP_OPT="
-                                                     (string-join libs "\\ "))))
-                            (invoke "make" "bigide"))))))
-    (native-inputs (list fpc pkg-config))
-    (inputs (list glib
-                  gdk-pixbuf
-                  gtk+-2
-                  libx11
-                  pango
-                  cairo
-                  at-spi2-core))
+                                               #$output)
+                                "LCL_PLATFORM=qt6")
+           #:phases
+           #~(modify-phases %standard-phases
+               (delete 'configure)
+               ;; lcl/interfaces/qt6/cbindings/ ships the C++ source of
+               ;; libQt6Pas -- the Qt6 C-ABI bridge that LCL's qt6
+               ;; widgetset calls into.  Build it with qmake6 and stage
+               ;; the library so the IDE finds it at runtime.
+               (add-before 'build 'build-qt6pas
+                 (lambda _
+                   (with-directory-excursion "lcl/interfaces/qt6/cbindings"
+                     (invoke "qmake6" "Qt6Pas.pro"
+                             (string-append "PREFIX=" #$output))
+                     (invoke "make" "-j"
+                             (number->string (parallel-job-count))))))
+               (replace 'build
+                 (lambda* (#:key inputs make-flags #:allow-other-keys)
+                   (let* ((qt6pas-build
+                           (string-append (getcwd)
+                                          "/lcl/interfaces/qt6/cbindings"))
+                          (qt6pas-runtime
+                           (string-append #$output "/lib"))
+                          (input-libs
+                           (map (lambda (x)
+                                  (string-append (assoc-ref inputs x) "/lib"))
+                                '("qtbase" "libx11")))
+                          ;; Link against the build tree so the linker
+                          ;; resolves libQt6Pas now; bake the final
+                          ;; $out/lib into RUNPATH so the installed
+                          ;; binary finds it at runtime.
+                          (fpc-args
+                           (append (map (lambda (d)
+                                          (string-append "-Fl" d))
+                                        (cons qt6pas-build input-libs))
+                                   (map (lambda (d)
+                                          (string-append "-k-rpath=" d))
+                                        (cons qt6pas-runtime input-libs)))))
+                     (setenv "LAZARUS_LIBPATHS"
+                             (string-join fpc-args " "))
+                     (setenv "MAKEFLAGS"
+                             (string-append "LHELP_OPT="
+                                            (string-join fpc-args "\\ "))))
+                   (apply invoke "make" "bigide" make-flags)))
+               (add-after 'install 'wrap-qt
+                 (lambda* (#:key inputs #:allow-other-keys)
+                   ;; Qt6 apps load their platform plugins
+                   ;; (libqxcb.so, libqwayland.so, ...) from
+                   ;; QT_PLUGIN_PATH; each qt input has its plugins
+                   ;; under lib/qt6/plugins/.  Wrap lazarus-ide so the
+                   ;; wayland/xcb platform plugins are found at runtime.
+                   (let ((plugin-path
+                          (string-join
+                           (map (lambda (i)
+                                  (string-append (assoc-ref inputs i)
+                                                 "/lib/qt6/plugins"))
+                                '("qtbase" "qtsvg" "qtwayland"))
+                           ":")))
+                     (for-each
+                      (lambda (prog)
+                        (wrap-program (string-append #$output "/bin/" prog)
+                          `("QT_PLUGIN_PATH" ":" prefix (,plugin-path))))
+                      '("lazarus-ide" "startlazarus")))))
+               (add-after 'install 'install-qt6pas
+                 (lambda _
+                   ;; qmake's `make install' tries to copy libQt6Pas.so
+                   ;; into Qt's install prefix (read-only store path);
+                   ;; place it under $out/lib/ instead.
+                   (let ((src "lcl/interfaces/qt6/cbindings")
+                         (dst (string-append #$output "/lib")))
+                     (mkdir-p dst)
+                     (for-each
+                      (lambda (f)
+                        (let ((sf (string-append src "/" f))
+                              (df (string-append dst "/" f)))
+                          (if (eq? 'symlink (stat:type (lstat sf)))
+                              (symlink (readlink sf) df)
+                              (copy-file sf df))))
+                      '("libQt6Pas.so"
+                        "libQt6Pas.so.6"
+                        "libQt6Pas.so.6.2"
+                        "libQt6Pas.so.6.2.10"))))))))
+    (native-inputs (list fpc pkg-config qtbase qttools))
+    (inputs (list qtbase qtsvg qtwayland libx11))
     (synopsis "Integrated development environment for Pascal")
     (description "This package provides an integrated development environment
 for Pascal.")

gnu/packages/patches/codex-acp-0.11.1-disable-code-mode.patch

@@ -0,0 +1,128 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-04-13
+License: ASL2.0
+
+Make V8 an optional dependency in codex-code-mode.
+
+The V8 engine is only needed for actually executing JavaScript in the
+code-mode sandbox.  The description helpers, tool name constants, and
+data types do not require V8.  Gate the runtime and service modules
+behind a "v8-runtime" feature so that consumers like codex-acp that
+never use code-mode can avoid the V8 build dependency.
+
+--- a/codex-rs/code-mode/Cargo.toml	2026-04-13 16:14:49.459504037 +0000
++++ codex-rs/code-mode/Cargo.toml	2026-04-13 16:14:49.466438318 +0000
+@@ -12,6 +12,10 @@
+ [lints]
+ workspace = true
+
++[features]
++default = ["v8-runtime"]
++v8-runtime = ["dep:v8"]
++
+ [dependencies]
+ async-trait = { workspace = true }
+ serde = { workspace = true, features = ["derive"] }
+@@ -19,7 +23,7 @@
+ tokio = { workspace = true, features = ["macros", "rt", "sync", "time"] }
+ tokio-util = { workspace = true, features = ["rt"] }
+ tracing = { workspace = true }
+-v8 = { workspace = true }
++v8 = { workspace = true, optional = true }
+
+ [dev-dependencies]
+ pretty_assertions = { workspace = true }
+--- a/codex-rs/code-mode/src/lib.rs	2026-04-13 16:14:49.461337956 +0000
++++ codex-rs/code-mode/src/lib.rs	2026-04-13 16:14:49.470869556 +0000
+@@ -1,6 +1,8 @@
+ mod description;
+ mod response;
++#[cfg(feature = "v8-runtime")]
+ mod runtime;
++#[cfg(feature = "v8-runtime")]
+ mod service;
+
+ pub use description::CODE_MODE_PRAGMA_PREFIX;
+@@ -16,15 +18,82 @@
+ pub use description::render_json_schema_to_typescript;
+ pub use response::FunctionCallOutputContentItem;
+ pub use response::ImageDetail;
++
++#[cfg(feature = "v8-runtime")]
+ pub use runtime::DEFAULT_EXEC_YIELD_TIME_MS;
++#[cfg(feature = "v8-runtime")]
+ pub use runtime::DEFAULT_MAX_OUTPUT_TOKENS_PER_EXEC_CALL;
++#[cfg(feature = "v8-runtime")]
+ pub use runtime::DEFAULT_WAIT_YIELD_TIME_MS;
++#[cfg(feature = "v8-runtime")]
+ pub use runtime::ExecuteRequest;
++#[cfg(feature = "v8-runtime")]
+ pub use runtime::RuntimeResponse;
++#[cfg(feature = "v8-runtime")]
+ pub use runtime::WaitRequest;
++#[cfg(feature = "v8-runtime")]
+ pub use service::CodeModeService;
++#[cfg(feature = "v8-runtime")]
+ pub use service::CodeModeTurnHost;
++#[cfg(feature = "v8-runtime")]
+ pub use service::CodeModeTurnWorker;
+
++// Stub types when V8 is not available.
++#[cfg(not(feature = "v8-runtime"))]
++pub const DEFAULT_EXEC_YIELD_TIME_MS: u64 = 10_000;
++#[cfg(not(feature = "v8-runtime"))]
++pub const DEFAULT_MAX_OUTPUT_TOKENS_PER_EXEC_CALL: usize = 10_000;
++#[cfg(not(feature = "v8-runtime"))]
++pub const DEFAULT_WAIT_YIELD_TIME_MS: u64 = 10_000;
++
++#[cfg(not(feature = "v8-runtime"))]
++pub struct ExecuteRequest {
++    pub tool_call_id: String,
++    pub enabled_tools: Vec<ToolDefinition>,
++    pub source: String,
++    pub stored_values: std::collections::HashMap<String, serde_json::Value>,
++    pub yield_time_ms: Option<u64>,
++    pub max_output_tokens: Option<usize>,
++}
++
++#[cfg(not(feature = "v8-runtime"))]
++#[derive(Clone, Debug)]
++pub struct WaitRequest {
++    pub cell_id: String,
++    pub yield_time_ms: u64,
++    pub terminate: bool,
++}
++
++#[cfg(not(feature = "v8-runtime"))]
++#[derive(Debug, PartialEq)]
++pub enum RuntimeResponse {
++    Yielded { cell_id: String, content_items: Vec<FunctionCallOutputContentItem> },
++    Terminated { cell_id: String, content_items: Vec<FunctionCallOutputContentItem> },
++    Result { cell_id: String, content_items: Vec<FunctionCallOutputContentItem>, stored_values: std::collections::HashMap<String, serde_json::Value>, error_text: Option<String> },
++}
++
++#[cfg(not(feature = "v8-runtime"))]
++#[async_trait::async_trait]
++pub trait CodeModeTurnHost: Send + Sync {
++    async fn invoke_tool(&self, tool_name: String, input: Option<serde_json::Value>, cancellation_token: tokio_util::sync::CancellationToken) -> Result<serde_json::Value, String>;
++    async fn notify(&self, call_id: String, cell_id: String, text: String) -> Result<(), String>;
++}
++
++#[cfg(not(feature = "v8-runtime"))]
++pub struct CodeModeService;
++
++#[cfg(not(feature = "v8-runtime"))]
++impl CodeModeService {
++    pub fn new() -> Self { Self }
++    pub async fn stored_values(&self) -> std::collections::HashMap<String, serde_json::Value> { Default::default() }
++    pub async fn replace_stored_values(&self, _values: std::collections::HashMap<String, serde_json::Value>) {}
++    pub async fn execute(&self, _request: ExecuteRequest) -> Result<RuntimeResponse, String> { Err("code-mode requires v8-runtime feature".into()) }
++    pub async fn wait(&self, _request: WaitRequest) -> Result<RuntimeResponse, String> { Err("code-mode requires v8-runtime feature".into()) }
++    pub fn start_turn_worker(&self, _host: std::sync::Arc<dyn CodeModeTurnHost>) -> CodeModeTurnWorker { CodeModeTurnWorker }
++}
++
++#[cfg(not(feature = "v8-runtime"))]
++pub struct CodeModeTurnWorker;
++
+ pub const PUBLIC_TOOL_NAME: &str = "exec";
+ pub const WAIT_TOOL_NAME: &str = "wait";

gnu/packages/patches/codex-acp-0.11.1-remove-patch-sections.patch

@@ -0,0 +1,20 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-02-08
+License: ASL2.0
+
+Remove [patch.crates-io] section.
+
+This section points to git repositories which are unavailable in an
+offline build.  The vendored tokio-tungstenite and tungstenite forks
+are provided as cargo-inputs instead.
+
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -52,7 +52,3 @@
+ let-underscore = "warn"
+ rust-2018-idioms = "warn"
+ unused = "warn"
+-
+-[patch.crates-io]
+-tokio-tungstenite = { git = "https://github.com/openai-oss-forks/tokio-tungstenite", rev = "132f5b39c862e3a970f731d709608b3e6276d5f6" }
+-tungstenite = { git = "https://github.com/openai-oss-forks/tungstenite-rs", rev = "9200079d3b54a1ff51072e24d81fd354f085156f" }

gnu/packages/patches/codex-acp-0.9.2-remove-patch-sections.patch

@@ -1,21 +0,0 @@
-Author: Danny Milosavljevic <dannym@friendly-machines.com>
-Date: 2026-02-08
-License: ASL2.0
-
-Remove [patch.crates-io] and [patch.'ssh://...'] sections.
-
-These sections point to git repositories which are unavailable in an
-offline build.  The vendored tokio-tungstenite and tungstenite forks
-are provided as cargo-inputs instead.
-
-diff -u a/Cargo.toml b/Cargo.toml
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -47,8 +47,2 @@
- unused = "warn"
--
--[patch.crates-io]
--tokio-tungstenite = { git = "https://github.com/JakkuSakura/tokio-tungstenite", branch = "proxy-support" }
--
--[patch.'ssh://git@github.com/JakkuSakura/tungstenite-rs.git']
--tungstenite = { git = "https://github.com/JakkuSakura/tungstenite-rs", branch = "proxy-support" }

gnu/packages/patches/codex-acp-0.9.2-replace-result-flatten.patch

@@ -1,52 +0,0 @@
-Author: Danny Milosavljevic <dannym@friendly-machines.com>
-Date: 2026-02-08
-License: ASL2.0
-
-Replace Result::flatten() with and_then(|x| x).
-
-Result::flatten() was stabilized in Rust 1.89.0 but the build
-toolchain only provides Rust 1.88.0.  Use the equivalent
-.and_then(|x| x) form which works on all stable Rust versions.
-
-diff -u a/src/local_spawner.rs b/src/local_spawner.rs
---- a/src/local_spawner.rs
-+++ b/src/local_spawner.rs
-@@ -156,7 +156,7 @@
-         });
-         rx.recv()
-             .map_err(|e| std::io::Error::other(e.to_string()))
--            .flatten()
-+            .and_then(|x| x)
-     }
-
-     fn write(&self, path: &std::path::Path, contents: &[u8]) -> std::io::Result<()> {
-@@ -174,7 +174,7 @@
-         });
-         rx.recv()
-             .map_err(|e| std::io::Error::other(e.to_string()))
--            .flatten()
-+            .and_then(|x| x)
-     }
- }
-
-@@ -207,7 +207,7 @@
-             let file = rx
-                 .await
-                 .map_err(|e| std::io::Error::other(e.to_string()))
--                .flatten()?;
-+                .and_then(|x| x)?;
-
-             Ok(Box::new(tokio::io::BufReader::new(Cursor::new(file.into_bytes()))) as _)
-         })
-diff -u a/src/thread.rs b/src/thread.rs
---- a/src/thread.rs
-+++ b/src/thread.rs
-@@ -1817,7 +1817,7 @@
-                     let mut new_custom_prompts = load_custom_prompts
-                         .await
-                         .map_err(|_| Error::internal_error())
--                        .flatten()
-+                        .and_then(|x| x)
-                         .inspect_err(|e| error!("Failed to load custom prompts {e:?}"))
-                         .unwrap_or_default();
-

gnu/packages/patches/git-clar-path-max.patch

@@ -1,16 +0,0 @@
-On GNU/Hurd, 'PATH_MAX' is undefined.  Provide a reasonable default value.
-Adapted from <https://github.com/libgit2/libgit2/pull/7100>.
-
-diff --git a/tests/clar/clar.h b/tests/clar/clar.h
-index ca72292ae91..98e2b14e880 100644
---- a/t/unit-tests/clar/clar.h
-+++ b/t/unit-tests/clar/clar.h
-@@ -14,6 +14,8 @@
- # define CLAR_MAX_PATH 4096
- #elif defined(_WIN32)
- # define CLAR_MAX_PATH MAX_PATH
-+#elif !defined(PATH_MAX)			  /* GNU/Hurd */
-+# define CLAR_MAX_PATH 4096
- #else
- # define CLAR_MAX_PATH PATH_MAX
- #endif

gnu/packages/patches/hwloc-1-test-btrfs.patch

@@ -1,54 +0,0 @@
-From 093316a897a2eb4972a7a3a5888f40975d03f6bf Mon Sep 17 00:00:00 2001
-From: Brice Goglin <Brice.Goglin@inria.fr>
-Date: Tue, 5 Apr 2022 17:39:50 +0200
-Subject: [PATCH] linux: (partial) fix the discovery of hugepages on btrfs
- fsroot
-
-btrfs always returns 1 in directory stat.st_nlink.
-It breaks make check in tests/linux/ because the hugepages discovery
-uses st_nlink to allocate the memory page_types array.
-
-Always allocate at least 3 page_types slots
-(enough for all known cases, 1 for normal, 2 for huge pages)
-
-(partially cherry-picked from commit 7f351cec9bfe54a031f35ad16c9cfb99784d76dc)
-
-We don't reallocate later if needed as in 2.x commit 7f351cec9bfe54a031f35ad16c9cfb99784d76dc
-because v1.11 doesn't deserve a complete fix. Just commit the minimal change
-so that tests/linux/2i386-2t-hugepagesizecount with HWLOC_PAGESIZE_DEBUG=4096
-doesn't crash in btrfs anymore (test-topology.sh fails during make check if /tmp is in btrfs).
-
-Thanks to Philippe Swartvagher for the report.
-
-Signed-off-by: Brice Goglin <Brice.Goglin@inria.fr>
----
- src/topology-linux.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/src/topology-linux.c b/src/topology-linux.c
-index 58c275fea..269eca7f5 100644
---- a/src/topology-linux.c
-+++ b/src/topology-linux.c
-@@ -1,6 +1,6 @@
- /*
-  * Copyright © 2009 CNRS
-- * Copyright © 2009-2019 Inria.  All rights reserved.
-+ * Copyright © 2009-2022 Inria.  All rights reserved.
-  * Copyright © 2009-2013, 2015 Université Bordeaux
-  * Copyright © 2009-2014 Cisco Systems, Inc.  All rights reserved.
-  * Copyright © 2015 Intel, Inc.  All rights reserved.
-@@ -2329,7 +2329,14 @@ hwloc_get_procfs_meminfo_info(struct hwloc_topology *topology,
- 
-   err = hwloc_stat("/sys/kernel/mm/hugepages", &st, data->root_fd);
-   if (!err) {
--    types = 1 + st.st_nlink-2;
-+    types = 1 /* normal non-huge size */ + st.st_nlink - 2 /* ignore . and .. */;
-+    if (types < 3)
-+      /* some buggy filesystems (e.g. btrfs when reading from fsroot)
-+       * return wrong st_nlink for directories (always 1 for btrfs).
-+       * use 3 as a sane default (default page + 2 huge sizes).
-+       * hwloc_parse_hugepages_info() will extend it if needed.
-+       */
-+      types = 3;
-     has_sysfs_hugepages = 1;
-   }

gnu/packages/patches/inetutils-drop-test.patch

@@ -0,0 +1,26 @@
+To be remove when updating inetutils.
+See
+https://cgit.git.savannah.gnu.org/cgit/inetutils.git/commit/?id=556621adc3dcb62dbb28c54905cef15837947115
+https://codeberg.org/guix/guix/issues/7995
+
+diff --git a/tests/libls.sh b/tests/libls.sh
+index 827020f2..9fdef8be 100755
+--- a/tests/libls.sh
++++ b/tests/libls.sh
+@@ -91,7 +91,6 @@ REPLY_a1=`$LS -a1 $LSDIR`
+ REPLY_A1=`$LS -A1 $LSDIR`
+
+ REPLY_C=`$LS -C $LSDIR`
+-REPLY_Cf=`$LS -Cf $LSDIR`
+ REPLY_Cr=`$LS -Cr $LSDIR`
+ REPLY_Ct=`$LS -Ct $LSDIR`
+ REPLY_x=`$LS -x $LSDIR`
+@@ -130,9 +129,6 @@ test `echo "$diff" | $GREP -c -v '^[.]\{1,2\}$'` -eq 0 ||
+     fi
+   }
+
+-test x"$REPLY_C" != x"$REPLY_Cf" ||
+-  { errno=1; echo >&2 'Failed to disable sorting with "-f".'; }
+-
+ test x"$REPLY_C" != x"$REPLY_Cr" ||
+   { errno=1; echo >&2 'Failed to reverse sorting with "-r".'; }

gnu/packages/patches/rust-codex-0.117.0-core-remove-self-dep.patch

@@ -0,0 +1,20 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-02-08
+License: ASL2.0
+Subject: Remove codex-core circular dev-dependencies.
+
+codex-core has a dev-dependency on codex-arg0 which in turn depends on
+codex-core.  This causes cargo package to fail when resolving from the
+vendor directory because codex-arg0 is not yet available at the time
+codex-core is packaged.
+
+--- a/codex-rs/core/Cargo.toml
++++ b/codex-rs/core/Cargo.toml
+@@ -144,7 +144,6 @@
+ [dev-dependencies]
+ assert_cmd = { workspace = true }
+ assert_matches = { workspace = true }
+-codex-arg0 = { workspace = true }
+ codex-otel = { workspace = true, features = [
+     "disable-default-metrics-exporter",
+ ] }

gnu/packages/patches/rust-codex-0.117.0-remove-patch-sections.patch

@@ -0,0 +1,30 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-02-08
+License: ASL2.0
+Subject: Remove [patch.crates-io] and [patch.'ssh://...'] sections.
+
+The [patch] sections point to git repositories which are unavailable
+in an offline build.  The vendored crossterm, ratatui,
+tokio-tungstenite and tungstenite forks are provided as cargo-inputs
+instead.
+
+--- a/codex-rs/Cargo.toml
++++ b/codex-rs/Cargo.toml
+@@ -423,17 +423,3 @@
+ debug = 1         # Reduce debug symbol size
+ inherits = "test"
+ opt-level = 0
+-
+-[patch.crates-io]
+-# Uncomment to debug local changes.
+-# ratatui = { path = "../../ratatui" }
+-crossterm = { git = "https://github.com/nornagon/crossterm", branch = "nornagon/color-query" }
+-ratatui = { git = "https://github.com/nornagon/ratatui", branch = "nornagon-v0.29.0-patch" }
+-tokio-tungstenite = { git = "https://github.com/openai-oss-forks/tokio-tungstenite", rev = "132f5b39c862e3a970f731d709608b3e6276d5f6" }
+-tungstenite = { git = "https://github.com/openai-oss-forks/tungstenite-rs", rev = "9200079d3b54a1ff51072e24d81fd354f085156f" }
+-
+-# Uncomment to debug local changes.
+-# rmcp = { path = "../../rust-sdk/crates/rmcp" }
+-
+-[patch."ssh://git@github.com/openai-oss-forks/tungstenite-rs.git"]
+-tungstenite = { git = "https://github.com/openai-oss-forks/tungstenite-rs", rev = "9200079d3b54a1ff51072e24d81fd354f085156f" }

gnu/packages/patches/rust-codex-0.120.0-connectors-cache-test-race.patch

@@ -0,0 +1,26 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-04-14
+License: ASL2.0
+Subject: Fix race condition in codex-connectors cache test.
+
+ALL_CONNECTORS_CACHE is a single global Option, not a map.  When Rust's
+test runner executes tests in parallel, the
+list_all_connectors_merges_and_normalizes_directory_apps test can
+overwrite the cache entry between the two calls in
+list_all_connectors_uses_shared_cache, causing a key mismatch and a
+spurious "cache should have been used" failure.
+
+Fix by clearing the cache at the start of the cache test so it does not
+depend on execution order relative to other tests.
+
+--- a/codex-rs/connectors/src/lib.rs
++++ b/codex-rs/connectors/src/lib.rs
+@@ -441,6 +441,9 @@
+     #[tokio::test]
+     async fn list_all_connectors_uses_shared_cache() -> anyhow::Result<()> {
++        // Clear any stale cache entry left by a concurrently running test.
++        *ALL_CONNECTORS_CACHE.lock().unwrap() = None;
++
+         let calls = Arc::new(AtomicUsize::new(0));
+         let call_counter = Arc::clone(&calls);
+         let key = cache_key("shared");

gnu/packages/patches/rust-codex-0.120.0-core-remove-self-dep.patch

@@ -0,0 +1,20 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-02-08
+License: ASL2.0
+Subject: Remove codex-core circular dev-dependencies.
+
+codex-core has a dev-dependency on codex-arg0 which in turn depends on
+codex-core.  This causes cargo package to fail when resolving from the
+vendor directory because codex-arg0 is not yet available at the time
+codex-core is packaged.
+
+--- a/codex-rs/core/Cargo.toml
++++ b/codex-rs/core/Cargo.toml
+@@ -134,7 +134,6 @@
+ [dev-dependencies]
+ assert_cmd = { workspace = true }
+ assert_matches = { workspace = true }
+-codex-arg0 = { workspace = true }
+ codex-otel = { workspace = true }
+ codex-utils-cargo-bin = { workspace = true }
+ core_test_support = { workspace = true }

gnu/packages/patches/rust-codex-0.120.0-remove-libwebrtc.patch

@@ -0,0 +1,16 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-04-14
+License: ASL2.0
+Subject: Remove macOS-only libwebrtc git dependency.
+
+--- a/codex-rs/realtime-webrtc/Cargo.toml
++++ b/codex-rs/realtime-webrtc/Cargo.toml
+@@ -12,8 +12,5 @@
+ thiserror = { workspace = true }
+ tokio = { workspace = true, features = ["rt-multi-thread"] }
+
+-[target.'cfg(target_os = "macos")'.dependencies]
+-libwebrtc = { version = "0.3.26", git = "https://github.com/juberti-oai/rust-sdks.git", rev = "e2d1d1d230c6fc9df171ccb181423f957bb3c1f0" }
+-
+ [lints]
+ workspace = true

gnu/packages/patches/rust-codex-0.120.0-test-timeout.patch

@@ -0,0 +1,20 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-03-05
+License: ASL2.0
+Subject: Increase per-event test timeout from 10 to 30 seconds.
+
+In resource-constrained build environments, image processing (resize,
+base64-encode, JSON serialization) can exceed 10 seconds under CPU
+contention, causing intermittent test failures.
+
+--- a/codex-rs/core/tests/common/lib.rs
++++ b/codex-rs/core/tests/common/lib.rs
+@@ -283,7 +283,7 @@
+     use tokio::time::timeout;
+     loop {
+         // Allow a bit more time to accommodate async startup work (e.g. config IO, tool discovery)
+-        let ev = timeout(wait_time.max(Duration::from_secs(10)), codex.next_event())
++        let ev = timeout(wait_time.max(Duration::from_secs(30)), codex.next_event())
+             .await
+             .expect("timeout waiting for event")
+             .expect("stream ended unexpectedly");

gnu/packages/photo.scm

@@ -359,7 +359,7 @@ MTP, and much more.")
 (define-public perl-image-exiftool
   (package
     (name "perl-image-exiftool")
-    (version "12.70")
+    (version "13.55")
     (source
      (origin
        (method url-fetch)
@@ -371,7 +371,7 @@ MTP, and much more.")
                             "Image-ExifTool-" version ".tar.gz")))
        (sha256
         (base32
-         "1zmg5jsdqmr9mnmxg614brdgr9ddmspcc11rs4xkygnc8lj55cjc"))))
+         "0rv6hiqd44npnjzcn5ig5d0rnpgbzkdp5bbi526561nl9b9q2k2z"))))
     (build-system perl-build-system)
     (arguments
      (list #:phases

gnu/packages/plan9.scm

@@ -143,8 +143,8 @@ reconstruct a Plan 9 terminal-like experience from a non-Plan 9 system.")
 
 (define-public plan9port
   ;; no releases
-  (let ((commit "f8681acb374fa0d5ed1568dbedb00a4abe1ca6f1")
-        (revision "1"))
+  (let ((commit "b379c7cc9dd9a810a9873d444e9742fcad3f5997")
+        (revision "2"))
     (package
       (name "plan9port")
       (version (git-version "0.1.0" revision commit))
@@ -156,7 +156,7 @@ reconstruct a Plan 9 terminal-like experience from a non-Plan 9 system.")
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "01343jvn8kr63i78h8xlgscn6wihdsr44xzh1cylvhigjbqw8n2x"))
+                  "0mvchnbk9kywm9fsw0cb621g435kav4sd1facb71v0jy7xwzw1fz"))
                 (modules '((guix build utils)))
                 (snippet #~(for-each delete-file-recursively
                                      '("font/luc" ;nonfree
@@ -171,8 +171,8 @@ reconstruct a Plan 9 terminal-like experience from a non-Plan 9 system.")
                    (lambda _
                      (let ((dest (string-append #$output "/plan9")))
                        (substitute* "INSTALL"
-                         ;; Install fontsrv, which is enabled in LOCAL.config.
-                         (("rm -f bin/fontsrv") ""))
+                         ;; Pass the check for freetype to install fontsrv.
+                         (("\\[ -f a\\.out ]") "true"))
                        (delete-file "src/cmd/mk/mk.pdf")
                        ;; TODO: substitute font in src/cmd/venti/srv/graph.c
                        (substitute* "src/cmd/acme/acme.c"
@@ -201,8 +201,8 @@ reconstruct a Plan 9 terminal-like experience from a non-Plan 9 system.")
                          (("luc/unicode.6.font")
                            "fixed/unicode.6x9.font"))
                        (substitute* "bin/9c"
-                         (("which")
-                          (which "which")))
+                         (("[$][(]which uniq[)]")
+                          "uniq"))
                        (substitute* "src/cmd/fontsrv/freetyperules.sh"
                          (("'\\$i'/freetype2")
                           (string-append "-I"
@@ -210,8 +210,7 @@ reconstruct a Plan 9 terminal-like experience from a non-Plan 9 system.")
                                          "/include/freetype2")))
                        (with-output-to-file "LOCAL.config"
                          (lambda _
-                           (format #t "CC9=~a~%" #$(cc-for-target))
-                           (format #t "FONTSRV=fontsrv~%")))
+                           (format #t "CC9=~a~%" #$(cc-for-target))))
                        (setenv "X11" #$libx11)
                        (setenv "PLAN9" (getcwd))
                        (setenv "PLAN9_TARGET" dest))))
@@ -241,6 +240,7 @@ reconstruct a Plan 9 terminal-like experience from a non-Plan 9 system.")
                                    "troff"
                                    "postscript"))
                        (install-file "rcmain" dest)
+                       (install-file "config" dest)
                        (mkdir-p (string-append #$output "/bin"))
                        (symlink (string-append dest "/bin/9")
                                 (string-append #$output "/bin/9")))))

gnu/packages/prolog.scm

@@ -237,7 +237,7 @@ it.")
 (define-public trealla
   (package
     (name "trealla")
-    (version "2.92.41")
+    (version "2.93.2")
     (source
      (origin
        (method git-fetch)
@@ -246,7 +246,7 @@ it.")
           (url "https://github.com/trealla-prolog/trealla")
           (commit (string-append "v" version))))
        (sha256
-        (base32 "0ial37h0i9zjxgxvkai2vmaafn4djprliw0nzppnhwwy3jbcd14p"))
+        (base32 "0rsqka6i51ky74mzf2xlzdzss2xnldyk1wm0f5ilas6ic6pw3hir"))
        (file-name (git-file-name name version))))
     (build-system gnu-build-system)
     (inputs
@@ -302,13 +302,13 @@ interpreter with ISO Prolog aspirations.")
 (define-public logtalk
   (package
     (name "logtalk")
-    (version "3.80.0")
+    (version "3.99.0")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://logtalk.org/files/logtalk-"
                            version ".tar.bz2"))
-       (sha256 (base32 "0g4cc0qv921234548k3rkv1sdayicaa6zzh15vgn82ri9apwm3nh"))))
+       (sha256 (base32 "04namz3lj2j1j741bb41qy5c172b9zawp1li148i7pd2s0jiwjjr"))))
     (build-system gnu-build-system)
     (arguments
      (list #:tests? #f                  ;no tests

gnu/packages/python-check.scm

@@ -13,7 +13,7 @@
 ;;; Copyright © 2020, 2022 Julien Lepiller <julien@lepiller.eu>
 ;;; Copyright © 2020 Matthew James Kraai <kraai@ftbfs.org>
 ;;; Copyright © 2020 Edouard Klein <edk@beaver-labs.com>
-;;; Copyright © 2020, 2021, 2025 Vinicius Monego <monego@posteo.net>
+;;; Copyright © 2020, 2021, 2025, 2026 Vinicius Monego <monego@posteo.net>
 ;;; Copyright © 2020 Tanguy Le Carrour <tanguy@bioneland.org>
 ;;; Copyright © 2021 Hugo Lecomte <hugo.lecomte@inria.fr>
 ;;; Copyright © 2021 Lars-Dominik Braun <lars@6xq.net>
@@ -1663,6 +1663,49 @@ cProfile or profile modules, depending on what is available.  It's a
 successor of @url{https://github.com/rkern/line_profiler}.")
     (license license:bsd-3)))
 
+(define-public python-lsp-ruff
+  (package
+    (name "python-lsp-ruff")
+    (version "2.3.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/python-lsp/python-lsp-ruff")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1xjvqyn3qn54cq63ay9n1rr1wkzx04bf99cki68n46gm8nwjvn6m"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:test-flags #~(list (string-append
+                            ;; Tests below do a diff check on the ruff store
+                            ;; path against the python store path.
+                            "-k" "not test_ruff_settings"
+                            " and not test_ruff_config_param"))
+      #:phases #~(modify-phases %standard-phases
+                   (add-after 'unpack 'use-system-ruff
+                     ;; This package requests Ruff from PyPI.  Make it use
+                     ;; the guix package instead.
+                     (lambda _
+                       (substitute* "pyproject.toml"
+                         (("\"ruff.*\",") "")))))))
+    (propagated-inputs (list python-cattrs
+                             python-lsprotocol
+                             python-lsp-server
+                             python-tomli
+                             ;; Ruff is detected by shutil.which.
+                             ruff))
+    (native-inputs (list python-pytest python-setuptools))
+    (home-page "https://github.com/python-lsp/python-lsp-ruff")
+    (synopsis "Ruff linting plugin for @code{pylsp}")
+    (description
+     "@code{python-lsp-ruff} is a plugin for @code{python-lsp-server} that
+adds linting, code actions and formatting capabilities that are provided by
+Ruff.")
+    (license license:expat)))
+
 (define-public python-mamba
   (package
     (name "python-mamba")
@@ -2246,6 +2289,32 @@ wrapper above tools such as Pyflakes, pydocstyle, pycodestyle and McCabe,
 among others.")
     (license license:lgpl3+)))
 
+(define-public python-pylint-venv
+  (package
+    (name "python-pylint-venv")
+    (version "3.0.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/jgosmann/pylint-venv/")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "06va7vy3bg331aab589wcr3nmafxlya0ac1as39qqyvkbdz9b5bl"))))
+    (build-system pyproject-build-system)
+    (arguments
+     ;; Test is a simple shell script that activates a virtual environment
+     ;; and runs pylint inside of it.  There are no checks.
+     (list #:tests? #f))
+    (native-inputs (list python-poetry-core))
+    (home-page "https://github.com/jgosmann/pylint-venv/")
+    (synopsis
+     "Pylint init-hook to share a Pylint installation across virtualenvs")
+    (description "@code{pylint-venv} provides a Pylint init-hook to use the
+same Pylint installation with different virtual environments.")
+    (license license:expat)))
+
 (define-public python-pynose
   (package
     (name "python-pynose")

gnu/packages/python-crypto.scm

@@ -1142,20 +1142,23 @@ provides drop-in compatibility with PyCrypto.")))
 (define-public python-m2crypto
   (package
     (name "python-m2crypto")
-    (version "0.38.0")
+    (version "0.47.0")
     (source
      (origin
-       (method url-fetch)
-       (uri (pypi-uri "M2Crypto" version))
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://gitlab.com/m2crypto/m2crypto")
+             (commit version)))
+       (file-name (git-file-name name version))
        (sha256
-        (base32 "1jyynaybncgjp8rndrwjpj5gnbrislngimf6ind9874h6052dwlr"))))
+        (base32 "090dvgnjmqidh0c318kipysiy24cn1rwbmxl4vybnqd57n65xsn8"))))
     (build-system pyproject-build-system)
     (arguments
      `(;; FIXME: Tests start failing with time due to date checks in TLS
        ;; certificates.
        #:tests? #f))
     (inputs (list openssl))
-    (native-inputs (list swig-4.0 python-setuptools python-wheel))
+    (native-inputs (list swig python-setuptools))
     (home-page "https://gitlab.com/m2crypto/m2crypto")
     (synopsis "Python crypto and TLS toolkit")
     (description "@code{M2Crypto} is a complete Python wrapper for OpenSSL

gnu/packages/python-graphics.scm

@@ -809,7 +809,7 @@ wrappers for common SDL2 functionality.")
 (define-public python-qtawesome
   (package
     (name "python-qtawesome")
-    (version "1.4.0")
+    (version "1.4.2")
     (source
      (origin
        (method git-fetch)
@@ -818,7 +818,7 @@ wrappers for common SDL2 functionality.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "109anjlnin5cafx579clj1x21ggig3qkcm2g1wlx0lshxqzjadan"))))
+        (base32 "16vjnngg5hjmmbp0c2ikgc88g8q0l44n1w3wa04ga5zfhd1yhyn2"))))
     (build-system pyproject-build-system)
     (arguments
      (list

gnu/packages/python-science.scm

@@ -1171,16 +1171,26 @@ which uncovers hidden structures in categorical data")
 (define-public python-fast-histogram
   (package
     (name "python-fast-histogram")
-    (version "0.14")
+    (properties '((commit . "92ed2049a2e24b15993bb770e96a5d21f4736be3")
+                  (revision . "0")))
+    (version (git-version "0.14"
+                          (assoc-ref properties 'revision)
+                          (assoc-ref properties 'commit)))
     (source
      (origin
-       (method url-fetch)
-       (uri (pypi-uri "fast_histogram" version))
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/astrofrog/fast-histogram")
+              (commit (assoc-ref properties 'commit))))
+       (file-name (git-file-name name version))
        (sha256
-        (base32 "1sk9xa85cgm4sylzblwv3qr2dmm0ic06zkwxqa2xlazjiawp629r"))))
+        (base32 "0iqgrnzs2w0v36iyp9782lxc8nji2v7fvs1k90pnrrf6r3w98p0v"))))
     (build-system pyproject-build-system)
     (arguments
      (list
+      #:test-flags
+      ;; XXX: Too many bins for data range.
+      #~(list "-k" "not test_1d_compare_with_numpy")
       #:phases
       #~(modify-phases %standard-phases
           (add-before 'check 'build-extensions

gnu/packages/python-web.scm

@@ -3525,14 +3525,16 @@ other HTTP libraries.")
 (define-public python-cheroot
   (package
     (name "python-cheroot")
-    (version "10.0.1")
+    (version "11.1.2")
     (source
      (origin
-       (method url-fetch)
-       (uri (pypi-uri "cheroot" version))
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/cherrypy/cheroot")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
        (sha256
-        (base32
-         "0h0p3fnpa4dxi589s7ljlzb6p3mhqdivb3pc2f36pljqfrwjzf70"))))
+        (base32 "02rhci01m5fcn8mqpvq3c35rs4n28gxlfvfw2if2f85rgwrji8y8"))))
     (build-system pyproject-build-system)
     (arguments
      (list
@@ -3582,36 +3584,51 @@ other HTTP libraries.")
 (define-public python-cherrypy
   (package
     (name "python-cherrypy")
-    (version "18.10.0")
+    (properties '((commit . "1f75bc9eed8e0e385f64f368bd69f58d96fb8c2b")
+                  (revision . "0")))
+    (version (git-version "18.10.0"
+                          (assoc-ref properties 'revision)
+                          (assoc-ref properties 'commit)))
     (source
      (origin
        (method git-fetch)
        (uri (git-reference
               (url "https://github.com/cherrypy/cherrypy")
-              (commit (string-append "v" version))))
+              (commit (assoc-ref properties 'commit))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1mhs64z75mj3rk4rgxc3xm1yksaj253rj9czhk4632blz5yi0kbn"))))
+        (base32 "1l01a4sbfm42s5xp6ngphgqf0yb65ksqbsb27kznvybblyaxfa9p"))))
     (build-system pyproject-build-system)
     (arguments
      (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'patch-pyproject
+            (lambda _
+              (substitute* "pyproject.toml"
+                (("\"cherrypy.scaffold\",")
+                 (string-join
+                  (list "\"cherrypy.scaffold\""
+                        "\"cherrypy._private_api\""
+                        "\"cherrypy._private_api.compat\",")
+                  ",\n  "))))))
       #:test-flags
       #~(map
          (lambda (test)
            (string-append "--deselect=cherrypy/test/" test))
          (list
+          ;; Requires bumping python-flaky.
+          "test_bus.py::test_wait_publishes_periodically"
+          "test_bus.py::test_block"
+          "test_bus.py::test_start_with_callback"
+          "test_refleaks.py::ReferenceTests::test_threadlocal_garbage"
+          "test_session.py::SessionTest::test_0_Session"
+          "test_session.py::SessionTest::test_2_File_Concurrency"
+          ;; assert b'RamSession' == b'FileSession' or FileNotFoundError
+          "test_session.py::SessionTest::test_3_Redirect"
+          "test_session.py::SessionTest::test_4_File_deletion"
           ;; XXX: Unraisable exceptions.
-          "test_config_server.py::ServerConfigTests::testMaxRequestSize"
-          "test_core.py::CoreRequestHandlingTest::testRanges"
-          "test_core.py::CoreRequestHandlingTest::testRedirect"
-          "test_encoding.py::EncodingTests::\
-test_multipart_decoding_bigger_maxrambytes"
-          "test_encoding.py::EncodingTests::\
-test_test_http.py::HTTPTests::test_post_filename_with_special_characters"
-          "test_http.py::HTTPTests::test_post_multipart"
-          "test_http.py::HTTPTests::test_post_filename_with_special_characters"
-          "test_mime.py::SafeMultipartHandlingTest::test_Flash_Upload"
-          "test_tutorials.py::TutorialTest::test09Files"))))
+          "test_core.py::CoreRequestHandlingTest"))))
     (propagated-inputs
      (list python-cheroot
            python-jaraco-collections
@@ -3619,7 +3636,9 @@ test_test_http.py::HTTPTests::test_post_filename_with_special_characters"
            python-portend
            python-zc-lockfile))
     (native-inputs
-     (list python-objgraph
+     (list python-filelock
+           python-flaky
+           python-objgraph
            python-path
            python-pytest
            python-pytest-cov
@@ -3627,7 +3646,8 @@ test_test_http.py::HTTPTests::test_post_filename_with_special_characters"
            python-pytest-services
            python-pytest-sugar
            python-requests-toolbelt
-           python-setuptools))
+           python-setuptools
+           python-setuptools-scm))
     (home-page "https://www.cherrypy.dev")
     (synopsis "Object-Oriented HTTP framework")
     (description

gnu/packages/python-xyz.scm

@@ -2346,6 +2346,29 @@ for the Sweetscape 010 binary-format editor.")
 like pie glass').")
     (license license:asl2.0)))
 
+(define-public python-pyls-spyder
+  (package
+    (name "python-pyls-spyder")
+    (version "0.4.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/spyder-ide/pyls-spyder")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "11ajbsia60d4c9s6m6rbvaqp1d69fcdbq6a98lkzkkzv2b9pdhkk"))))
+    (build-system pyproject-build-system)
+    (propagated-inputs (list python-lsp-server))
+    (native-inputs (list python-pytest python-setuptools))
+    (home-page "https://github.com/spyder-ide/pyls-spyder")
+    (synopsis "Spyder extensions for @code{python-lsp-server}")
+    (description "This package provides Spyder-specific extras for the
+Language Server Protocol (LSP) on Python, such as document symbol searching
+and others.")
+    (license license:expat)))
+
 (define-public python-pypydispatcher
   (package
     (name "python-pypydispatcher")
@@ -2426,6 +2449,29 @@ pyte is a fork of vt102, which was an incomplete pure Python implementation
 of VT100 terminal.")
     (license license:lgpl3+)))
 
+(define-public python-pyuca
+  (package
+    (name "python-pyuca")
+    (version "1.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/jtauber/pyuca")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1zi301f1kpzcnkgd90ax8f1xhylcxy2c9fy3ym4pwc9mzbxs9198"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list #:tests? #f)) ; there are no tests
+    (native-inputs (list python-setuptools))
+    (home-page "https://github.com/jtauber/pyuca")
+    (synopsis "Python implementation of the Unicode Collation Algorithm")
+    (description "This package provides a Python implementation of the
+@url{http://unicode.org/reports/tr10/, Unicode Collation Algorithm}.")
+    (license license:expat)))
+
 (define-public python-pyxdameraulevenshtein
   (package
     (name "python-pyxdameraulevenshtein")
@@ -10787,50 +10833,59 @@ Server (PLS).")
 (define-public python-lsp-server
   (package
     (name "python-lsp-server")
-    (version "1.13.0")
+    (version "1.14.0")
     (source
      (origin
-       (method url-fetch)
-       (uri (pypi-uri "python_lsp_server" version))
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/python-lsp/python-lsp-server")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
        (sha256
-        (base32
-         "0s8dipxkdshg27a7a2nnkgg3kmksvbkfa7g39n310k6g7sv2d3rp"))))
+        (base32 "1dyp49x844c4mja0qg01nilsbi09w7526izsk3pi5zpylmhmvbk2"))))
     (build-system pyproject-build-system)
     (arguments
      (list
       #:test-flags
-      '(list "-c" "/dev/null"           ;avoid coverage
-             "--ignore-glob" "**/test_autopep8_format.py"  ;avoid autopep8 dep
-             "-k"
-             (string-append
-              "not test_concurrent_ws_requests "  ; flaky
-              "and not test_pyqt_completion "  ; avoid pyqt5
-              "and not test_pandas_completion"))  ; avoid pandas
+      #~(list "-c" "/dev/null"           ;avoid coverage
+              "--ignore-glob" "**/test_autopep8_format.py"  ;avoid autopep8 dep
+              "-k"
+              (string-append
+               "not " (string-join
+                       (list "test_concurrent_ws_requests" ; flaky
+                             "test_pyqt_completion" ; avoid pyqt5
+                             "test_pandas_completion" ; avoid pandas
+                             ;; test_missing_message requests write permission
+                             ;; in /dev/cache.
+                             "test_missing_message")
+                       " and not ")))
       #:phases
-      '(modify-phases %standard-phases
-         (add-before 'check 'set-HOME
-           (lambda _ (setenv "HOME" "/tmp"))))))
+      #~(modify-phases %standard-phases
+          (add-before 'check 'set-HOME
+            (lambda _ (setenv "HOME" "/tmp"))))))
     (propagated-inputs
      (list python-black
            python-docstring-to-markdown
+           python-flake8
            python-jedi
            python-lsp-jsonrpc
+           python-mccabe
            python-pluggy
+           python-pycodestyle
            python-pydocstyle
+           python-pyflakes
+           python-pylint
+           python-rope
            python-ujson
            python-whatthepatch
            python-yapf))
     (native-inputs
-     (list python-flake8
-           python-flaky
+     (list python-flaky
            python-matplotlib
-           python-pylint
            python-pytest
-           python-rope
            python-setuptools
            python-setuptools-scm
-           python-websockets
-           python-wheel))
+           python-websockets))
     (home-page "https://github.com/python-lsp/python-lsp-server")
     (synopsis "Python implementation of the Language Server Protocol")
     (description
@@ -16918,13 +16973,13 @@ the @code{sendfile(2)} system call.")
 (define-public python-pyftpdlib
   (package
     (name "python-pyftpdlib")
-    (version "1.5.7")
+    (version "1.5.10")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pyftpdlib" version))
        (sha256
-        (base32 "0vk5gcx4svjrpm014ykwxmijqihgb4ha17kb3yphk0nv6x0wx8vy"))))
+        (base32 "0a3i1253d3qp9rqb64wdq908a05bn7yizqys92vjzfmw2l9fpgcd"))))
     (build-system pyproject-build-system)
     ;; Using Pytest instead of the Makefile causes the command line tests to
     ;; fail on unknown Pytest arguments.
@@ -20952,6 +21007,35 @@ can also be used to get the exact location, font or color of the text.")
 zipfile like as possible.")
     (license license:isc)))
 
+(define-public python-rassumfrassum
+  (package
+    (name "python-rassumfrassum")
+    (version "0.3.3")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/joaotavora/rassumfrassum")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0iyqg7pnlca9i9a5n2v1pg8xy0chy297d1a934wqxvjzrv11wxyw"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (replace 'check
+            (lambda* (#:key tests? #:allow-other-keys)
+              (when tests?
+                (invoke "test/run-all.sh")))))))
+    (native-inputs (list python-setuptools))
+    (home-page "https://github.com/joaotavora/rassumfrassum")
+    (synopsis "Connect an LSP client to multiple LSP servers")
+    (description
+     "LSP/JSONRPC multiplexer for connecting one LSP client to multiple servers.")
+    (license license:gpl3+)))
+
 (define-public python-slugid
   (package
     (name "python-slugid")

gnu/packages/python.scm

@@ -819,6 +819,7 @@ def contents() -> str:
                                     " test_multiprocessing_main_handling"
                                     " test_pdb "
                                     " test_regrtest"
+                                    " test_ssl" ;; Fails with openssl 3.5
                                     " test_sqlite")
                                   '())
                             ,@(if (system-hurd64?)

gnu/packages/qt.scm

@@ -552,10 +552,12 @@ applications on Wayland.")
      ;; Optional: lcov and cccc, both are for code coverage
      (list doxygen))
     (inputs
-     (list qtbase-5 qtdeclarative-5 qtscript-5))
-    (build-system cmake-build-system)
+     (list qtdeclarative))
+    (build-system qt-build-system)
     (arguments
-     (list #:phases #~(modify-phases %standard-phases
+     (list #:qtbase qtbase
+           #:configure-flags #~(list "-DGRANTLEE_BUILD_WITH_QT6=ON")
+           #:phases #~(modify-phases %standard-phases
                         (add-before 'check 'check-setup
                           (lambda _
                             ;; make Qt render "offscreen", required for tests

gnu/packages/rdesktop.scm

@@ -68,36 +68,6 @@
   #:use-module (gnu packages xorg)
   #:use-module (gnu packages xml))
 
-(define-public rdesktop
-  (package
-    (name "rdesktop")
-    (version "1.9.0")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://github.com/rdesktop/rdesktop/"
-                                  "releases/download/v" version "/rdesktop-"
-                                  version ".tar.gz"))
-              (sha256
-               (base32
-                "1222f2srlq16bydhy44gph997iajg39sl774xxh9jdwi4cqjyg27"))))
-    (build-system gnu-build-system)
-    (arguments
-     `(#:configure-flags (list ;; XXX: optional dependencies missing
-                               "--disable-credssp"
-                               "--disable-smartcard")
-       #:tests? #f))                    ; No 'check' target
-    (native-inputs
-     (list pkg-config))
-    (inputs
-     (list gnutls libx11 libxcursor nettle))
-    (home-page "https://www.rdesktop.org/")
-    (synopsis "Client for Windows Terminal Services")
-    (description
-     "rdesktop is a client for Microsoft's Windows Remote Desktop Services,
-capable of natively speaking Remote Desktop Protocol (RDP).  It allows users
-to remotely control a user's Windows desktop.")
-    (license license:gpl3+)))
-
 (define-public freerdp
   (package
     (name "freerdp")

gnu/packages/rocq.scm

@@ -0,0 +1,166 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2018-2021 Julien Lepiller <julien@lepiller.eu>
+;;; Copyright © 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2019 Dan Frumin <dfrumin@cs.ru.nl>
+;;; Copyright © 2020 Brett Gilio <brettg@gnu.org>
+;;; Copyright © 2020 Björn Höfling <bjoern.hoefling@bjoernhoefling.de>
+;;; Copyright © 2020 raingloom <raingloom@riseup.net>
+;;; Copyright © 2020 Robin Green <greenrd@greenrd.org>
+;;; Copyright © 2021 Xinglu Chen <public@yoctocell.xyz>
+;;; Copyright © 2021 Simon Tournier <zimon.toutoune@gmail.com>
+;;; Copyright © 2022 Garek Dyszel <garekdyszel@disroot.org>
+;;; Copyright © 2024 Foundation Devices, Inc. <hello@foundation.xyz>
+;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
+;;; Copyright © 2026 Dan Rostovtsev <dan@rostovtsev.org>
+;;; Copyright © 2026 Jason Conroy <jconroy@tscripta.net>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages rocq)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages gawk)
+  #:use-module (gnu packages gtk)
+  #:use-module (gnu packages multiprecision)
+  #:use-module (gnu packages ocaml)
+  #:use-module (guix build-system dune)
+  #:use-module (guix gexp)
+  #:use-module (guix git-download)
+  #:use-module (guix licenses)
+  #:use-module (guix packages))
+
+(define (rocq-arguments opam-package-name)
+  ;; Dune parallel build is not reproducible (in rocq and camlp-streams,
+  ;; at least).
+  ;; First observed in Rocq in 2019 by bmwiedemann at OpenSUSE.
+  ;; - https://github.com/rocq-prover/rocq/issues/11229
+  ;; Was escalated to a specific package by Rocq team in 2023.
+  ;; - https://github.com/ocaml/camlp-streams/issues/9
+  ;; Was escalated to Dune by Xavier Leroy in 2023.
+  ;; - https://github.com/ocaml/dune/issues/9152
+  ;; AFAIK, no patches addressing this in any project circa 2026.
+  (list #:package opam-package-name
+        #:build-flags ''("-j1")
+        ;; The tests must be serial as well for reproducible builds.
+        #:test-flags ''("-j1")))
+
+(define-public rocq-runtime
+  (package
+    (name "rocq-runtime") ;see rocq-runtime.opam in rocq's git
+    (version "9.2.0")
+    (source
+     (origin
+       (method git-fetch)
+       ;; Use github uri as recommended by "Contributing" docs.
+       ;; Signed by Nicolas Tabareau (GPG: 5F6E82ADF36B53F6)
+       (uri (git-reference
+             (url "https://github.com/rocq-prover/rocq")
+             (commit (string-append "V" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1rxq2cfqlbp8vzygmk6cwszbsn5l2vka0syhrafrnpn2rpyivya9"))))
+    (build-system dune-build-system)
+    (arguments
+     (rocq-arguments "rocq-runtime"))
+    (propagated-inputs (list ocaml-zarith camlzip ocaml-yojson))
+    (inputs (list gmp))
+    (native-inputs (list ocaml-ounit2 which))
+    (native-search-paths
+     (list
+       (search-path-specification
+         (variable "ROCQLIB")
+         (files (list "lib/ocaml/site-lib/coq")))
+       (search-path-specification
+         (variable "ROCQRUNTIMELIB")
+         (files (list "lib/ocaml/site-lib/rocq-runtime")))))
+    (home-page "https://rocq-prover.org/")
+    (synopsis "Core Binaries and Tools for the Rocq Prover")
+    (description
+     "Rocq is an interactive theorem prover, or proof assistant.  It provides
+a formal language to write mathematical definitions, executable algorithms
+and theorems together with an environment for semi-interactive development
+of machine-checked proofs.
+
+This package includes the Rocq Prover core binaries, plugins, and tools, but
+not the language's standard library implementation.")
+    ;; The source code is distributed under lgpl2.1.
+    ;; Some of the documentation is distributed under opl1.0+.
+    (license (list lgpl2.1 opl1.0+))))
+
+(define-public rocq-core
+  (package
+    (inherit rocq-runtime)
+    (name "rocq-core") ;see rocq-core.opam in rocq's git
+    (arguments
+     (append (rocq-arguments "rocq-core")
+             (list #:phases
+                   ;; this is the only package in rocq that /needs/ a "dunestrap"
+                   #~(modify-phases %standard-phases
+                       (add-before 'build 'make-dunestrap
+                         (lambda _
+                           (invoke "make" "DUNEOPT=-j1" "COQ_SPLIT=1"
+                                   "dunestrap")))))))
+    (propagated-inputs (modify-inputs (package-propagated-inputs rocq-runtime)
+                         (append rocq-runtime)))
+    (synopsis "Standard library modules for Rocq Prover")
+    (description
+     "Rocq is an interactive theorem prover, or proof assistant.  It provides
+ a formal language to write mathematical definitions, executable algorithms
+and theorems together with an environment for semi-interactive development
+of machine-checked proofs.
+
+This package includes the Rocq standard library some other core language
+libraries.")))
+
+; The Rocq project refers to the pacakge as the "RocqIDE server," but has not
+; yet changed the name of the opam package.
+; https://rocq-prover.org/install
+(define-public rocqide-server
+  (package
+    (inherit rocq-runtime)
+    (name "rocqide-server") ;see coqide-server.opam in rocq's git
+    (propagated-inputs (modify-inputs (package-propagated-inputs rocq-runtime)
+                         (append rocq-runtime)))
+    (arguments
+     (rocq-arguments "coqide-server"))
+    (synopsis "Rocq's XML protocol server")
+    (description
+     "Rocq is an interactive theorem prover, or proof assistant.  It provides
+ a formal language to write mathematical definitions, executable algorithms
+and theorems together with an environment for semi-interactive development
+of machine-checked proofs.
+
+This package provides the @code{coqidetop} language server, an implementation of
+Rocq's XML protocol which allows clients, such as RocqIDE, to interact with
+the Rocq Prover in a structured way.")))
+
+(define-public rocqide
+  (package
+    (inherit rocq-runtime)
+    (name "rocqide") ;see rocqide.opam in rocq's git
+    (propagated-inputs (modify-inputs (package-propagated-inputs
+                                       rocqide-server)
+                         (append rocqide-server ocaml-lablgtk3-sourceview3)))
+    (arguments
+     (rocq-arguments "rocqide"))
+    (synopsis "Rocq's IDE")
+    (description
+     "Rocq is an interactive theorem prover, or proof assistant.  It provides
+ a formal language to write mathematical definitions, executable algorithms
+and theorems together with an environment for semi-interactive development
+of machine-checked proofs.
+
+This package provides the RocqIDE, a graphical user interface for the
+development of interactive proofs.")))

gnu/packages/ruby.scm

@@ -17,6 +17,7 @@
 ;;; Copyright © 2023 Zheng Junjie <873216071@qq.com>
 ;;; Copyright © 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2025 Remco van 't Veer <remco@remworks.net>
+;;; Copyright © 2026 gemmaro <gemmaro.dev@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -58,6 +59,7 @@
   #:use-module (gnu packages lsof)
   #:use-module (gnu packages man)
   #:use-module (gnu packages maths)
+  #:use-module (gnu packages multiprecision)
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages networking)
   #:use-module (gnu packages node)
@@ -68,6 +70,7 @@
   #:use-module (gnu packages python-xyz)
   #:use-module (gnu packages ragel)
   #:use-module (gnu packages rsync)
+  #:use-module (gnu packages rust)
   #:use-module (gnu packages sqlite)
   #:use-module (gnu packages tls)
   #:use-module (gnu packages valgrind)
@@ -86,6 +89,71 @@
   #:use-module (gnu packages web)
   #:use-module (guix build-system ruby))
 
+(define-public ruby-4.0
+  (package
+    (name "ruby")
+    (version "4.0.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "http://cache.ruby-lang.org/pub/ruby/"
+                           (version-major+minor version) "/ruby-" version
+                           ".tar.xz"))
+       (sha256
+        (base32 "0abghfkwa5r5c5fvp495w2zvzahs7bb294mybrmlkgjvs82n1kr2"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:test-target "test"
+      #:configure-flags (if (%current-target-system)
+                            #~(list (string-append "LDFLAGS=-Wl,-rpath="
+                                                   (assoc-ref %outputs "out")
+                                                   "/lib") "--enable-shared")
+                            #~'("--enable-shared")) ;dynamic linking
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'configure 'replace-bin-sh-and-remove-libffi
+            (lambda _
+              (substitute* '("configure.ac" "template/Makefile.in"
+                             "lib/rubygems/installer.rb"
+                             "ext/pty/pty.c"
+                             "io.c"
+                             "lib/mkmf.rb"
+                             "process.c"
+                             "test/rubygems/test_gem_ext_configure_builder.rb"
+                             "test/ruby/test_rubyoptions.rb"
+                             "test/ruby/test_process.rb"
+                             "test/ruby/test_system.rb"
+                             "tool/rbinstall.rb")
+                (("/bin/sh")
+                 (which "sh")))))
+          (add-after 'install 'delete-mkmf.log
+            (lambda _
+              ;; Rubygems installs build log files that embed volatile
+              ;; file names, especially for bigdecimal gem (see:
+              ;; https://github.com/rubygems/rubygems/issues/6259).
+              (for-each delete-file
+                        (find-files #$output "^mkmf\\.log$")))))))
+    (native-inputs (append (if (%current-target-system)
+                               (list this-package)
+                               '())
+                           (list autoconf libyaml)))
+    (inputs (list readline
+                  openssl-3.0
+                  libffi ;to build fiddle
+                  gmp ;to accelerate Bignum operations
+                  rust)) ;to build YJIT
+    (propagated-inputs (list zlib))
+    (native-search-paths
+     (list (search-path-specification
+            (variable "GEM_PATH")
+            (files (list (string-append "lib/ruby/vendor_ruby"))))))
+    (synopsis "Programming language interpreter")
+    (description "Ruby is a dynamic object-oriented programming language with
+a focus on simplicity and productivity.")
+    (home-page "https://www.ruby-lang.org")
+    (license license:ruby)))
+
 (define-public ruby-3.4
   (package
     (name "ruby")

gnu/packages/rust-apps.scm

@@ -508,14 +508,14 @@ choice.  Supported launchers are: dmenu, fuzzel, rofi, walker and custom.")
 (define-public c2rust
   (package
     (name "c2rust")
-    (version "0.20.0")
+    (version "0.22.1")
     (source
      (origin
        (method url-fetch)
        (uri (crate-uri "c2rust" version))
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
-        (base32 "05cm423m7v30b6gwgfzizhyqn3ncnfndin5zbkhyg9ah3pqccgps"))))
+        (base32 "0frzcnyah3a1srdwyx2rcpbh7hpwy6608cvhsqz5z9hdc08z8cg3"))))
     (build-system cargo-build-system)
     (native-inputs (list clang cmake-minimal %tinycbor-source))
     (inputs (cons llvm (cargo-inputs 'c2rust)))
@@ -1498,14 +1498,14 @@ defaults for 80% of the use cases.")
 (define-public gitoxide
   (package
     (name "gitoxide")
-    (version "0.51.0")
+    (version "0.52.0")
     (source
      (origin
        (method url-fetch)
        (uri (crate-uri "gitoxide" version))
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
-        (base32 "11w522h0hgj45089f7nj7vymzy7lz40g22a2351hkazym2y7mmja"))))
+        (base32 "0712ny094bnxcydk2v3a9wwjp315b3q2ljf36ycsrwzw3xi81dki"))))
     (build-system cargo-build-system)
     (arguments
      (list
@@ -1696,7 +1696,7 @@ characters, ASCII whitespace characters, other ASCII characters and non-ASCII.")
 (define-public hyperfine
   (package
     (name "hyperfine")
-    (version "1.19.0")
+    (version "1.20.0")
     (source
       (origin
         (method url-fetch)
@@ -1704,32 +1704,34 @@ characters, ASCII whitespace characters, other ASCII characters and non-ASCII.")
         (file-name (string-append name "-" version ".tar.gz"))
         (sha256
          (base32
-          "07pm8i71l9y50awz0d97zb231lcvp3c2hmdh98znq4m9a02xd7hv"))))
+          "0b0jhpqg7hamf8zkzw8cwim9550hj3w7cq43702d4yyxdxz6kzn5"))))
     (build-system cargo-build-system)
     (arguments
-     `(#:modules ((guix build cargo-build-system)
-                  (guix build utils)
-                  (srfi srfi-26))
-       #:install-source? #f
-       #:phases
-       (modify-phases %standard-phases
-        (add-after 'install 'install-more
-          (lambda* (#:key outputs #:allow-other-keys)
-            (let* ((out   (assoc-ref outputs "out"))
-                   (share (string-append out "/share/"))
-                   (man   (string-append share "man/man1"))
-                   (bash  (string-append out "/etc/bash_completion.d/"))
-                   (fish  (string-append share "fish/vendor_completions.d"))
-                   (zsh   (string-append share "zsh/site-functions")))
-              (install-file "doc/hyperfine.1" man)
-              (for-each (cut install-file <> bash)
-                        (find-files "target" "^hyperfine.bash$"))
-              (rename-file (string-append bash "/hyperfine.bash")
-                           (string-append bash "/hyperfine"))
-              (for-each (cut install-file <> fish)
-                        (find-files "target" "^hyperfine.fish$"))
-              (for-each (cut install-file <> zsh)
-                        (find-files "target" "^_hyperfine$"))))))))
+     (list
+      #:install-source? #f
+      #:imported-modules (append %copy-build-system-modules
+                                 %cargo-build-system-modules)
+      #:modules '((guix build cargo-build-system)
+                  ((guix build copy-build-system) #:prefix copy:)
+                  (guix build utils))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'build 'pre-build
+            (lambda _
+              (setenv "SHELL_COMPLETIONS_DIR" (string-append (getcwd) "/target"))))
+          (add-after 'install 'install-extras
+            (lambda args
+              (apply (assoc-ref copy:%standard-phases 'install)
+                     #:install-plan
+                     '(("target/hyperfine.bash"
+                        "share/bash-completion/completions/hyperfine")
+                       ("target/hyperfine.elv"
+                        "share/elvish/lib/hyperfine")
+                       ("target/hyperfine.fish"
+                        "share/fish/vendor_completions.d/")
+                       ("target/_hyperfine"
+                        "share/zsh/site-functions/"))
+                     args))))))
     (inputs (cargo-inputs 'hyperfine))
     (home-page "https://github.com/sharkdp/hyperfine")
     (synopsis "Command-line benchmarking tool")
@@ -2752,7 +2754,7 @@ search tools like The Silver Searcher, @command{ack} and @command{grep}.")
 (define-public ripgrep-all
   (package
     (name "ripgrep-all")
-    (version "0.10.9")
+    (version "0.10.10")
     (source
      (origin
        (method git-fetch)
@@ -2761,7 +2763,7 @@ search tools like The Silver Searcher, @command{ack} and @command{grep}.")
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1cks8b9z8fl1rs2xgklgsis79w9bylfmxxvns2adwsiilkpsxzxg"))))
+        (base32 "0vmdmv1np0r2khvg8j8i9z5zfy2h2ymhi93jzdhkn6wl3ns9wd3w"))))
     (build-system cargo-build-system)
     (arguments
      (list
@@ -3236,7 +3238,7 @@ command.")
 (define-public wasm-bindgen-cli
   (package
     (name "wasm-bindgen-cli")
-    (version "0.2.111")
+    (version "0.2.118")
     (source
      (origin
        (method git-fetch)
@@ -3245,13 +3247,10 @@ command.")
              (commit version)))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "19r30f0gz56180qm8spanwb1pkg0x1k8f6mgvsjil4q4qqhfary8"))
+        (base32 "02yy57pa4p53vrhpgc8xf737dnqiifnnnjinh49yq1345kd3287j"))
        (modules '((guix build utils)))
        (snippet
         '(begin
-           (substitute* "crates/webidl/Cargo.toml"
-             (("weedle = \\{ git = \"https://github.com/wasm-bindgen/weedle.git\", rev = \"e9e131229ba0477c34f09e136ed0a89a9fb1e448\" \\}")
-              "weedle = \"0.13.0\""))
            ;; Remove examples and benchmarks from workspace; they have
            ;; unneeded git dependencies (e.g. raytracer) or bundled blobs.
            (substitute* "Cargo.toml"
@@ -3261,16 +3260,10 @@ command.")
            (delete-file-recursively "benchmarks")))))
     (build-system cargo-build-system)
     (arguments
-     `(#:install-source? #f
-       #:cargo-build-flags '("--release" "-p" "wasm-bindgen-cli")
-       #:phases
-       (modify-phases %standard-phases
-         (replace 'install
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let ((bin (string-append (assoc-ref outputs "out") "/bin")))
-               (install-file "target/release/wasm-bindgen" bin)
-               (install-file "target/release/wasm-bindgen-test-runner" bin)
-               (install-file "target/release/wasm2es6js" bin)))))))
+     (list
+       #:install-source? #f
+       #:cargo-build-flags ''("--release" "-p" "wasm-bindgen-cli")
+       #:cargo-install-paths ''("crates/cli")))
     (inputs (cargo-inputs 'wasm-bindgen-cli))
     (home-page "https://github.com/wasm-bindgen/wasm-bindgen/")
     (synopsis "Generate JavaScript bindings for Rust WASM modules")
@@ -3411,35 +3404,54 @@ diagnostics, autocompletion, documentation, and formatting.")
 (define-public tectonic
   (package
     (name "tectonic")
-    (version "0.15.0")
+    (version "0.16.9")
     (source
      (origin
        ;; Grab all the sources instead of each packaged crate in the workspace.
        (method git-fetch)
        (uri (git-reference
              (url "https://github.com/tectonic-typesetting/tectonic")
-             (commit (string-append name "@" version))
-             (recursive? #t)))
+             (commit (string-append name "@" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "02wchm7kmfsw8y71x84hlk9qf5ldvj2ir7j8pcq2a09wlj4xi4f5"))
-       (snippet
-        #~(begin (use-modules (guix build utils))
-                 (delete-file-recursively "crates/bridge_harfbuzz/harfbuzz")))))
+        (base32 "1v9rs8wq608dwyr5wza9jlh9y8d3adm7jxny8dq02zpbda362ap7"))))
     (build-system cargo-build-system)
     (arguments
      (list
        #:install-source? #f
+       #:modules
+       '((guix build cargo-build-system)
+         (guix build utils)
+         (ice-9 match))
        #:cargo-install-paths ''(".")
        #:features '(list "external-harfbuzz")
-       #:cargo-test-flags '(list "--features" "external-harfbuzz")
+       #:cargo-test-flags '(list "--features" "external-harfbuzz"
+                                 "--"
+                                 "--skip=no_segfault_after_failed_compilation")
        #:phases
        #~(modify-phases %standard-phases
            (add-after 'install 'install-doc
              (lambda* (#:key outputs #:allow-other-keys)
                (let* ((out (assoc-ref outputs "out"))
                       (doc (string-append out "/share/doc/" #$name "-" #$version)))
-                 (copy-recursively "docs/src" doc)))))))
+                 (copy-recursively "docs/src" doc))))
+           (add-after 'install 'install-completions
+             (lambda* (#:key native-inputs #:allow-other-keys)
+               (for-each
+                (match-lambda
+                  ((shell . path)
+                   (mkdir-p (in-vicinity #$output (dirname path)))
+                   (let ((binary
+                          (if #$(%current-target-system)
+                              (search-input-file native-inputs "bin/tectonic")
+                              (in-vicinity #$output "bin/tectonic"))))
+                     (with-output-to-file (in-vicinity #$output path)
+                       (lambda _
+                         (invoke binary "-X" "show" "shell-completions" shell))))))
+                '(("bash"   . "share/bash-completion/completions/tectonic")
+                  ("elvish" . "share/elvish/lib/tectonic")
+                  ("fish"   . "share/fish/vendor_completions.d/tectonic.fish")
+                  ("zsh"    . "share/zsh/site-functions/_tectonic"))))))))
     (native-inputs
      (list pkg-config))
     (inputs
@@ -4068,14 +4080,14 @@ common-sense defaults.")
 (define-public spotifyd
   (package
     (name "spotifyd")
-    (version "0.4.1")
+    (version "0.4.2")
     (source
      (origin
        (method url-fetch)
        (uri (crate-uri "spotifyd" version))
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
-        (base32 "1m0z1q35by9wskjy2imnf8g8liy4g2ljyd69z6fryvvw64j0qzd6"))))
+        (base32 "1456kqv3yy4wqqfck3qfd46rjqscrz6z7cs3iyrbh6561338mv7w"))))
     (build-system cargo-build-system)
     (arguments
      `(#:install-source? #f
@@ -4085,7 +4097,7 @@ common-sense defaults.")
                         "pulseaudio_backend"
                         "rodio_backend")))
     (native-inputs (list pkg-config))
-    (inputs (cons* alsa-lib dbus pulseaudio (cargo-inputs 'spotifyd)))
+    (inputs (cons* alsa-lib dbus openssl pulseaudio (cargo-inputs 'spotifyd)))
     (home-page "https://github.com/Spotifyd/spotifyd")
     (synopsis "Spotify streaming daemon with Spotify Connect support")
     (description

gnu/packages/rust-sources.scm

@@ -215,7 +215,7 @@
                        "gemoji")
                       (invoke "cargo" "run")))))))
      (native-inputs (list gemoji-source-for-rust-deunicode-1))
-     ;; scripts/Cargo.lock
+     ;; scripts/Cargo.toml
      (inputs (cargo-inputs 'rust-deunicode-1))
      (home-page "https://lib.rs/crates/deunicode")
      (synopsis "Convert Unicode strings to pure ASCII")
@@ -224,6 +224,30 @@
 transliterating them.  It supports Emoji and Chinese.")
      (license license:bsd-3))))
 
+(define-public rust-deunicode-1.6.2.cfb8552
+  (let ((commit "cfb8552fbbdf6d1f3f996ee4f2e78ec5e482bcef"))
+    (hidden-package
+     (package
+       (inherit rust-deunicode-1)
+       (version "1.6.2")
+       (source (origin
+                 (inherit (package-source rust-deunicode-1))
+                 (uri (git-reference
+                       (url "https://github.com/kornelski/deunicode")
+                       (commit commit)))
+                 (file-name (git-file-name "rust-deunicode" version))
+                 ;; scripts/Cargo.toml now depends on the local deunicode
+                 ;; crate, so keep the shipped generated data long enough for
+                 ;; the generator to build before it overwrites them.
+                 (snippet '(delete-file-recursively "scripts/gemoji"))
+                 (sha256
+                  (base32
+                   "1khwjqx1qplwf9g1n6vgh2wk3j02j5gils95xx2kc4absbv20wdc"))))
+       ;; scripts/Cargo.toml now includes a local path dependency on the
+       ;; deunicode crate itself.  That self-dependency is resolved from the
+       ;; checkout and does not need a cargo input.
+       (inputs (cargo-inputs 'rust-deunicode-1.6.2.cfb8552))))))
+
 ;; Workspace dependency of zed.
 ;;
 ;; Cargo side: Cargo unifies dependency versions across zed's
@@ -866,6 +890,39 @@ UTF-32 support.")
       (list #:skip-build? #t
             #:cargo-package-crates ''("ring"))))))
 
+(define-public rust-rust-sdks-0.0.0.e2d1d1d
+  (let ((commit "e2d1d1d230c6fc9df171ccb181423f957bb3c1f0")
+        (revision "0"))
+    (hidden-package
+     (package
+       (name "rust-sdks")
+       (version (git-version "0.0.0" revision commit))
+       (source
+        (origin
+          (method git-fetch)
+          (uri (git-reference
+                (url "https://github.com/juberti-oai/rust-sdks.git")
+                (commit commit)))
+          (file-name (git-file-name name version))
+          (sha256
+           (base32 "00xwa6w00kdv9nd4a2206wyz3aw61al914xd1g8kj4gx9bmdhic2"))))
+       (build-system cargo-build-system)
+       (arguments
+        (list #:skip-build? #t
+              #:install-source? #t
+              ;; rust-codex patches out the libwebrtc git dependency, so only
+              ;; the remaining workspace members are currently needed here.
+              #:cargo-package-crates ''("livekit-runtime"
+                                        "livekit-protocol")
+              #:cargo-package-flags ''("--no-metadata" "--no-verify"
+                                       "--exclude-lockfile")))
+       (inputs (cargo-inputs 'rust-rust-sdks-0.0.0.e2d1d1d))
+       (home-page "https://github.com/juberti-oai/rust-sdks")
+       (synopsis "Workspace crates from rust-sdks")
+       (description
+        "This package provides the rust-sdks workspace crates used by Codex.")
+       (license license:asl2.0)))))
+
 (define-public rust-rustc-demangle-capi-0.1
   (hidden-package
    (package
@@ -1171,172 +1228,273 @@ language models.")
        (description "This package provides a Rust allocator backed by jemalloc.")
        (license (list license:expat license:asl2.0))))))
 
-(define-public rust-codex-0.0.0.785c0c43
-  (let ((commit "785c0c43df941e6997ff3a9e8a9dd48da2661f20")
-        (revision "0"))
-    (hidden-package
-     (package
-       (name "rust-codex")
-       (version (git-version "0.0.0" revision commit))
-       (source
-        (origin
-          (method git-fetch)
-          (uri (git-reference
-                (url "https://github.com/zed-industries/codex")
-                (commit commit)))
-          (file-name (git-file-name name version))
-          (sha256
-           (base32 "0rwj1ykknng39mhzna3fw3rcl3vngynsjdcj1namgkvw91zd9dl7"))
-          (patches (search-patches "rust-codex-0.98.0-core-remove-self-dep.patch"))))
-       (build-system cargo-build-system)
-       (arguments
-        (list
-         #:skip-build? #t
-         #:cargo-package-crates
-         ;; Order matters: dependencies must come before packages that need them
-         ''("codex-async-utils"        ; No internal deps
-            "codex-client"             ; No internal deps
-            "codex-execpolicy"         ; No internal deps
-            "codex-file-search"        ; No internal deps
-            "codex-git"                ; No internal deps
-            "codex-keyring-store"      ; No internal deps
-            "codex-utils-absolute-path" ; No internal deps
-            "codex-utils-cache"        ; No internal deps
-            "codex-utils-cargo-bin"    ; No internal deps
-            "codex-utils-home-dir"     ; No internal deps
-            "codex-utils-json-to-toml" ; No internal deps
-            "codex-utils-pty"          ; No internal deps
-            "codex-utils-readiness"    ; No internal deps
-            "codex-utils-string"       ; No internal deps
-            "codex-utils-image"        ; Depends on codex-utils-cache
-            "codex-apply-patch"        ; Depends on codex-utils-cargo-bin
-            "codex-protocol"           ; Depends on codex-git, codex-utils-*
-            "codex-windows-sandbox"    ; Depends on codex-utils-absolute-path, codex-protocol
-            "codex-api"                ; Depends on codex-client, codex-protocol
-            "codex-experimental-api-macros" ; Macro crate (must come before app-server-protocol)
-            "codex-app-server-protocol" ; Depends on codex-protocol, codex-experimental-api-macros
-            "codex-rmcp-client"        ; Depends on codex-keyring-store, codex-protocol
-            "codex-otel"               ; Depends on codex-app-server-protocol, codex-api
-            "codex-state"              ; Depends on codex-protocol, codex-otel
-            "codex-core"               ; Depends on many packages above
-            "codex-linux-sandbox"      ; Depends on codex-core, codex-utils-absolute-path
-            "codex-arg0"               ; Depends on codex-apply-patch, codex-core, codex-linux-sandbox
-            "codex-lmstudio"           ; Depends on codex-core
-            "codex-login"              ; Depends on codex-core
-            "codex-ollama"             ; Depends on codex-core
-            "codex-common"             ; Depends on codex-core, codex-lmstudio, codex-ollama
-            "codex-mcp-server")         ; Depends on codex-core, codex-common
-         #:phases
-         #~(modify-phases %standard-phases
-            (add-after 'unpack 'chdir-to-workspace
-              (lambda _
-                (chdir "codex-rs")))
-            (add-after 'chdir-to-workspace 'patch-git-deps-to-vendor
-              (lambda _
-                ;; Avoid git fetches in offline builds by pointing patches
-                ;; at the vendored sources provided via cargo-inputs.
-                (substitute* "Cargo.toml"
-                  (("crossterm = \\{ git = [^}]+\\}")
-                   "crossterm = { version = \"0.28.1\" }")
-                  (("ratatui = \\{ git = [^}]+\\}")
-                   "ratatui = { version = \"0.29.0\" }")
-                  (("tokio-tungstenite = \\{ git = [^}]+\\}")
-                   "tokio-tungstenite = { version = \"0.28.0\" }")
-                  ;; Point nucleo git dependency to vendored checkout.
-                  (("nucleo = \\{ git = [^}]+\\}")
-                   "nucleo = { version = \"0.5.0\" }")
-                  ;; Point runfiles git dependency to vendored checkout.
-                  (("runfiles = \\{ git = [^}]+\\}")
-                   "runfiles = { version = \"0.1.0\" }"))))
-            (add-after 'chdir-to-workspace 'add-version-to-workspace-deps
-              (lambda _
-                ;; cargo package requires all dependencies to have versions.
-                ;; Add version = "0.0.0" to internal path dependencies.
-                (let ((cargo-files (find-files "." "^Cargo\\.toml$")))
-                  (substitute* cargo-files
-                    ;; Handle inline deps: name = { path = "..." }
-                    (("(codex-[a-z0-9-]+) = \\{ path = " all name)
-                     (string-append name " = { version = \"0.0.0\", path = "))
-                    ;; Handle inline deps with package: name = { package = "...", path = "..." }
-                    (("(codex-[a-z0-9-]+) = \\{ package = " all name)
-                     (string-append name " = { version = \"0.0.0\", package = "))
-                    ;; Handle section deps: [dependencies.X] with path = "..."
-                    (("^(path = \"\\.\\./[^\"]*\")" all path-line)
-                     (string-append path-line "\nversion = \"0.0.0\"")))))))))
-       (inputs (cargo-inputs 'rust-codex-0.0.0.785c0c43))
-       (home-page "https://github.com/zed-industries/codex")
-       (synopsis "Zed Codex workspace crates")
-       (description
-        "This package provides the workspace crates for the Zed Codex CLI
-and runtime for AI-assisted coding.")
-       (license license:asl2.0)))))
-
-(define-public rust-codex-0.98.0
+(define-public rust-codex-0.117.0
   (hidden-package
    (package
      (name "rust-codex")
-     (version "0.98.0")
+     (version "0.117.0")
      (source
       (origin
         (method git-fetch)
         (uri (git-reference
               (url "https://github.com/openai/codex")
-              (commit "82464689ce0ba8a3b2065e73a8aa0cfdf2ad0625")))
+              (commit "4c70bff480af37b1bf1a9b352b8341060fe55755")))
         (file-name (git-file-name name version))
         (sha256
-         (base32 "1mn322gbir4gn4y5jihdqg0wprjlnx771chyfmmm7ri7pnim1zmc"))
+         (base32 "0xnszwd3xhh4j64zxlk611kcphvrw4ihky1f517y4m8cl4lpqdqk"))
+        (patches (search-patches
+                  "rust-codex-0.117.0-core-remove-self-dep.patch"
+                  "codex-acp-0.11.1-disable-code-mode.patch"))))
+     (build-system cargo-build-system)
+     (arguments
+      (list
+       #:skip-build? #t
+       #:cargo-package-crates
+       ;; All workspace crates from openai/codex 0.117.0.
+       ;; Order matters: dependencies must come before packages that need them.
+       ''(;; Topologically sorted by internal dependency order.
+          "codex-utils-absolute-path"
+          "codex-git-utils"
+          "codex-experimental-api-macros"
+          "codex-execpolicy"
+          "codex-utils-cache"
+          "codex-utils-image"
+          "codex-utils-string"
+          "codex-protocol"
+          "codex-utils-cargo-bin"
+          "codex-app-server-protocol"
+          "codex-utils-rustls-provider"
+          "codex-client"
+          "codex-config"
+          "codex-keyring-store"
+          "codex-terminal-detection"
+          "codex-login"
+          "codex-utils-plugins"
+          "codex-plugin"
+          "codex-analytics"
+          "codex-ansi-escape"
+          "codex-api"
+          "codex-apply-patch"
+          "codex-async-utils"
+          "codex-code-mode"
+          "codex-connectors"
+          "codex-instructions"
+          "codex-otel"
+          "codex-skills"
+          "codex-core-skills"
+          "codex-utils-pty"
+          "codex-exec-server"
+          "codex-features"
+          "codex-hooks"
+          "codex-utils-home-dir"
+          "codex-network-proxy"
+          "codex-rmcp-client"
+          "codex-file-search"
+          "codex-state"
+          "codex-utils-path"
+          "codex-rollout"
+          "codex-sandboxing"
+          "codex-secrets"
+          "codex-shell-command"
+          "codex-shell-escalation"
+          "codex-utils-output-truncation"
+          "codex-utils-readiness"
+          "codex-utils-stream-parser"
+          "codex-utils-template"
+          "codex-windows-sandbox"
+          "codex-core"
+          "codex-linux-sandbox"
+          "codex-arg0"
+          "codex-backend-openapi-models"
+          "codex-backend-client"
+          "codex-utils-cli"
+          "codex-chatgpt"
+          "codex-cloud-requirements"
+          "codex-feedback"
+          "codex-utils-json-to-toml"
+          "codex-app-server"
+          "codex-app-server-client"
+          "codex-app-server-test-client"
+          "codex-cloud-tasks-client"
+          "codex-utils-approval-presets"
+          "codex-utils-elapsed"
+          "codex-utils-fuzzy-match"
+          "codex-lmstudio"
+          "codex-ollama"
+          "codex-utils-oss"
+          "codex-utils-sandbox-summary"
+          "codex-utils-sleep-inhibitor"
+          "codex-exec"
+          "codex-mcp-server"
+          "codex-process-hardening"
+          "codex-responses-api-proxy"
+          "codex-stdio-to-uds"
+          "codex-debug-client"
+          "codex-execpolicy-legacy")
+       #:phases
+       #~(modify-phases %standard-phases
+          (add-after 'unpack 'chdir-to-workspace
+            (lambda _
+              (chdir "codex-rs")))
+          (add-after 'chdir-to-workspace 'patch-git-deps-to-vendor
+            (lambda _
+              (substitute* "Cargo.toml"
+                (("crossterm = \\{ git = [^}]+\\}")
+                 "crossterm = { version = \"0.28.1\" }")
+                (("ratatui = \\{ git = [^}]+\\}")
+                 "ratatui = { version = \"0.29.0\" }")
+                (("tokio-tungstenite = \\{ git = [^}]+\\}")
+                 "tokio-tungstenite = { version = \"0.28.0\" }")
+                (("tungstenite = \\{ git = [^}]+\\}")
+                 "tungstenite = { version = \"0.27.0\" }")
+                (("nucleo = \\{ git = [^}]+\\}")
+                 "nucleo = { version = \"0.5.0\" }")
+                (("runfiles = \\{ git = [^}]+\\}")
+                 "runfiles = { version = \"0.1.0\" }"))
+              ;; Disable V8 runtime in codex-code-mode.
+              (substitute* "Cargo.toml"
+                (("codex-code-mode = \\{ path = \"code-mode\" \\}")
+                 "codex-code-mode = { path = \"code-mode\", default-features = false }"))))
+          (add-after 'patch-git-deps-to-vendor 'add-version-to-workspace-deps
+            (lambda _
+              ;; cargo package requires all dependencies to have versions.
+              ;; Add version = "0.117.0" to internal path dependencies.
+              (let ((cargo-files (find-files "." "^Cargo\\.toml$")))
+                (substitute* cargo-files
+                  (("(codex-[a-z0-9-]+) = \\{ path = " all name)
+                   (string-append name " = { version = \"0.117.0\", path = "))
+                  (("(codex-[a-z0-9-]+) = \\{ package = " all name)
+                   (string-append name " = { version = \"0.117.0\", package = "))
+                  (("^(path = \"\\.\\./[^\"]*\")" all path-line)
+                   (string-append path-line "\nversion = \"0.117.0\"")))))))))
+     (inputs (cargo-inputs 'rust-codex-0.0.0.785c0c43))
+     (home-page "https://github.com/openai/codex")
+     (synopsis "OpenAI Codex workspace crates (for codex-acp)")
+     (description
+      "This package provides the workspace crates from the OpenAI Codex
+repository, used as dependencies by codex-acp.")
+     (license license:asl2.0))))
+
+(define-public rust-codex-0.120.0
+  (hidden-package
+   (package
+     (name "rust-codex")
+     (version "0.120.0")
+     (source
+      (origin
+        (method git-fetch)
+        (uri (git-reference
+              (url "https://github.com/openai/codex")
+              (commit "65319eb1400cbd2890c43d572263dabd25f18ba9")))
+        (file-name (git-file-name name version))
+        (sha256
+         (base32 "0gqzkqndb8jwvb9j5dxqgidyzk67x00ccfzhg54gdlv4adc1cgwj"))
         (modules '((guix build utils)))
         (snippet '(begin
                     ;;; These are JSON manifests with a dotslash
                     ;;; shebang that download and run pre-built
                     ;;; binaries (ripgrep, bash) at runtime.
                     (delete-file "codex-cli/bin/rg")
-                    (delete-file "codex-rs/exec-server/tests/suite/bash")
                     ;; Bundled bubblewrap source tree; includes a
                     ;; compiled BPF blob (demos/flatpak.bpf).
                     (delete-file-recursively "codex-rs/vendor/bubblewrap")))
-        (patches (search-patches "rust-codex-0.98.0-core-remove-self-dep.patch"
-                                 "rust-codex-0.98.0-windows-sandbox-protocol-version.patch"
-                                 "rust-codex-0.98.0-test-shebangs.patch"))))
+        (patches (search-patches
+                  "codex-acp-0.11.1-disable-code-mode.patch"
+                  "rust-codex-0.120.0-core-remove-self-dep.patch"
+                  "rust-codex-0.120.0-remove-libwebrtc.patch"))))
      (build-system cargo-build-system)
      (arguments
       (list
        #:skip-build? #t
        #:cargo-package-crates
        ;; Order matters: dependencies must come before packages that need them
-       ''("codex-async-utils"        ; No internal deps
-          "codex-client"             ; No internal deps
-          "codex-execpolicy"         ; No internal deps
-          "codex-file-search"        ; No internal deps
-          "codex-git"                ; No internal deps
-          "codex-keyring-store"      ; No internal deps
-          "codex-utils-absolute-path" ; No internal deps
-          "codex-utils-cache"        ; No internal deps
-          "codex-utils-cargo-bin"    ; No internal deps
-          "codex-utils-home-dir"     ; No internal deps
-          "codex-utils-json-to-toml" ; No internal deps
-          "codex-utils-pty"          ; No internal deps
-          "codex-utils-readiness"    ; No internal deps
-          "codex-utils-string"       ; No internal deps
-          "codex-utils-image"        ; Depends on codex-utils-cache
-          "codex-apply-patch"        ; Depends on codex-utils-cargo-bin
-          "codex-protocol"           ; Depends on codex-git, codex-utils-*
-          "codex-windows-sandbox"    ; Depends on codex-utils-absolute-path, codex-protocol
-          "codex-api"                ; Depends on codex-client, codex-protocol
-          "codex-experimental-api-macros" ; Macro crate (must come before app-server-protocol)
-          "codex-app-server-protocol" ; Depends on codex-protocol, codex-experimental-api-macros
-          "codex-rmcp-client"        ; Depends on codex-keyring-store, codex-protocol
-          "codex-otel"               ; Depends on codex-app-server-protocol, codex-api
-          "codex-state"              ; Depends on codex-protocol, codex-otel
-          "codex-core"               ; Depends on many packages above
-          "codex-linux-sandbox"      ; Depends on codex-core, codex-utils-absolute-path
-          "codex-arg0"               ; Depends on codex-apply-patch, codex-core, codex-linux-sandbox
-          "codex-lmstudio"           ; Depends on codex-core
-          "codex-login"              ; Depends on codex-core
-          "codex-ollama"             ; Depends on codex-core
-          "codex-common"             ; Depends on codex-core, codex-lmstudio, codex-ollama
-          "codex-mcp-server"          ; Depends on codex-core, codex-common
-          "codex-network-proxy")      ; Depends on codex-core, rama
+       ''(;; Topologically sorted by internal dependency order.
+          "codex-experimental-api-macros"
+          "codex-utils-absolute-path"
+          "codex-git-utils"
+          "codex-async-utils"
+          "codex-execpolicy"
+          "codex-utils-home-dir"
+          "codex-utils-rustls-provider"
+          "codex-network-proxy"
+          "codex-utils-cache"
+          "codex-utils-image"
+          "codex-utils-string"
+          "codex-utils-template"
+          "codex-protocol"
+          "codex-shell-command"
+          "codex-utils-cargo-bin"
+          "codex-app-server-protocol"
+          "codex-client"
+          "codex-api"
+          "codex-otel"
+          "codex-features"
+          "codex-model-provider-info"
+          "codex-config"
+          "codex-keyring-store"
+          "codex-terminal-detection"
+          "codex-login"
+          "codex-utils-plugins"
+          "codex-plugin"
+          "codex-analytics"
+          "codex-ansi-escape"
+          "codex-utils-pty"
+          "codex-exec-server"
+          "codex-apply-patch"
+          "codex-code-mode"
+          "codex-connectors"
+          "codex-instructions"
+          "codex-skills"
+          "codex-core-skills"
+          "codex-feedback"
+          "codex-hooks"
+          "codex-rmcp-client"
+          "codex-mcp"
+          "codex-collaboration-mode-templates"
+          "codex-response-debug-context"
+          "codex-utils-output-truncation"
+          "codex-models-manager"
+          "codex-file-search"
+          "codex-state"
+          "codex-utils-path"
+          "codex-rollout"
+          "codex-sandboxing"
+          "codex-secrets"
+          "codex-shell-escalation"
+          "codex-tools"
+          "codex-utils-readiness"
+          "codex-utils-stream-parser"
+          "codex-windows-sandbox"
+          "codex-core"
+          "codex-linux-sandbox"
+          "codex-arg0"
+          "codex-backend-openapi-models"
+          "codex-backend-client"
+          "codex-utils-cli"
+          "codex-chatgpt"
+          "codex-cloud-requirements"
+          "codex-utils-json-to-toml"
+          "codex-app-server"
+          "codex-app-server-client"
+          "codex-app-server-test-client"
+          "codex-cloud-tasks-client"
+          "codex-cloud-tasks-mock-client"
+          "codex-utils-approval-presets"
+          "codex-utils-elapsed"
+          "codex-utils-fuzzy-match"
+          "codex-lmstudio"
+          "codex-ollama"
+          "codex-utils-oss"
+          "codex-utils-sandbox-summary"
+          "codex-utils-sleep-inhibitor"
+          "codex-realtime-webrtc"
+          "codex-exec"
+          "codex-mcp-server"
+          "codex-process-hardening"
+          "codex-responses-api-proxy"
+          "codex-stdio-to-uds"
+          "codex-debug-client"
+          "codex-execpolicy-legacy")
        #:phases
        #~(modify-phases %standard-phases
           (add-after 'unpack 'chdir-to-workspace
@@ -1354,19 +1512,23 @@ and runtime for AI-assisted coding.")
                 (("nucleo = \\{ git = [^}]+\\}")
                  "nucleo = { version = \"0.5.0\" }")
                 (("runfiles = \\{ git = [^}]+\\}")
-                 "runfiles = { version = \"0.1.0\" }"))))
-          (add-after 'chdir-to-workspace 'add-version-to-workspace-deps
+                 "runfiles = { version = \"0.1.0\" }"))
+              ;; Disable V8 runtime in codex-code-mode.
+              (substitute* "Cargo.toml"
+                (("codex-code-mode = \\{ path = \"code-mode\" \\}")
+                 "codex-code-mode = { path = \"code-mode\", default-features = false }"))))
+          (add-after 'patch-git-deps-to-vendor 'add-version-to-workspace-deps
             (lambda _
               ;; cargo package requires all dependencies to have versions.
-              ;; Add version = "0.98.0" to internal path dependencies.
+              ;; Add version = "0.120.0" to internal path dependencies.
               (let ((cargo-files (find-files "." "^Cargo\\.toml$")))
                 (substitute* cargo-files
                   (("(codex-[a-z0-9-]+) = \\{ path = " all name)
-                   (string-append name " = { version = \"0.98.0\", path = "))
+                   (string-append name " = { version = \"0.120.0\", path = "))
                   (("(codex-[a-z0-9-]+) = \\{ package = " all name)
-                   (string-append name " = { version = \"0.98.0\", package = "))
-                  (("(mcp-types) = \\{ path = " all name)
-                   (string-append name " = { version = \"0.98.0\", path = ")))))))))
+                   (string-append name " = { version = \"0.120.0\", package = "))
+                  (("^(path = \"\\.\\./[^\"]*\")" all path-line)
+                   (string-append path-line "\nversion = \"0.120.0\"")))))))))
      (inputs (cargo-inputs 'rust-codex-0.0.0.785c0c43))
      (home-page "https://github.com/openai/codex")
      (synopsis "OpenAI Codex workspace crates")

gnu/packages/sequoia.scm

@@ -110,7 +110,7 @@
     (inputs
      (cons* nettle openssl sqlite (cargo-inputs 'sequoia-chameleon-gnupg)))
     (native-inputs
-     (list clang gnupg pkg-config sequoia-sq))
+     (list capnproto clang gnupg pkg-config sequoia-sq))
     (home-page "https://sequoia-pgp.org/")
     (synopsis "Sequoia's reimplementation of the GnuPG interface")
     (description "This package provides Sequoia's reimplementation of the
@@ -306,7 +306,7 @@ This Guix package is built to use the nettle cryptographic library.")
 (define-public sequoia
   (package
     (name "sequoia")
-    (version "2.0.0")
+    (version "2.2.0")
     (source #f)
     (build-system trivial-build-system)
     (arguments

gnu/packages/shells.scm

@@ -133,7 +133,7 @@ direct descendant of NetBSD's Almquist Shell (@command{ash}).")
 (define-public fish
   (package
     (name "fish")
-    (version "4.5.0")
+    (version "4.6.0")
     (source
      (origin
        (method url-fetch)
@@ -141,7 +141,7 @@ direct descendant of NetBSD's Almquist Shell (@command{ash}).")
                            "releases/download/" version "/"
                            "fish-" version ".tar.xz"))
        (sha256
-        (base32 "1vb45i480723lin9jabnqx9x3m77kipnkzi60844wqsby661y5c9"))
+        (base32 "1ak12wpjllckv566k9jjy59si25whsib3j8ip8yqmqm06gvnb4gw"))
        ;; TODO: Unbundle corrosion.
        (patches (search-patches "corrosion-honor-CARGO_BUILD_TARGET.patch"))))
     (build-system cmake-build-system)
@@ -156,6 +156,7 @@ direct descendant of NetBSD's Almquist Shell (@command{ash}).")
       (list gettext-minimal             ;localization support
             pkg-config
             procps                      ;for the test suite
+            python-pexpect              ;for the test suite
             ;; python-sphinx            ;for documentation TODO: cargo-xtask
             rust
             `(,rust "cargo"))
@@ -230,13 +231,9 @@ direct descendant of NetBSD's Almquist Shell (@command{ash}).")
                                    "src/highlight/file_tester.rs"
                                    "src/highlight/highlight.rs"
                                    (find-files "tests"))
-                 (("/bin/pwd" pwd) (string-append coreutils pwd))
-                 (("/bin/echo" echo) (string-append coreutils echo))
                  (("/bin/sh" sh) (string-append bash sh))
-                 (("/bin/ls" ls) (string-append coreutils ls))
-                 (("/test/root/bin") "")
-                 (("/bin/ca\"" ca) (string-append coreutils ca))
-                 (("/bin/c\"" ca) (string-append coreutils ca))
+                 (("/usr/bin/en\"") (string-append coreutils "/bin/en\""))
+                 (("/usr/bin/e\"") (string-append coreutils "/bin/e\""))
                  (("\"/bin") "\"/tmp")
                  (("\"/usr") "\"/tmp"))
                (substitute* "tests/test_driver.py"

gnu/packages/speech.scm

@@ -9,6 +9,7 @@
 ;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2021 qblade <qblade@protonmail.com>
 ;;; Copyright © 2024 Sébastien Lerique <sl@eauchat.org>
+;;; Copyright © 2026 Anderson Torres <anderson.torres.8519@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -643,7 +644,7 @@ recognition engine.")
 (define-public ekho
   (package
     (name "ekho")
-    (version "8.6")
+    (version "9.0")
     (source
      (origin
        (method url-fetch)
@@ -651,12 +652,34 @@ recognition engine.")
         (string-append "mirror://sourceforge/e-guidedog/Ekho/"
                        version "/ekho-" version ".tar.xz"))
        (sha256
-        (base32 "1hxdh8bs4zs83w19z897wb4n8n0kyv0ycjfwbi5w0j7mcxsqwh27"))))
-    (native-inputs
-     (list pkg-config))
-    (inputs
-     (list alsa-lib espeak-ng libsndfile pulseaudio))
+        (base32 "04wcz9g8cbpq3x0ymxwg2kyd82pjbk620b6hm11285283k1z13px"))))
     (build-system gnu-build-system)
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'remove-configure-script
+            ;; Trigger the rebuild of configure script
+            (lambda _
+              (delete-file "configure")))
+          (add-before 'configure 'set-cxxflag-utf8cpp
+            (lambda _
+              (setenv "CXXFLAGS"
+                      (string-append "-I"
+                                     #$(this-package-input "utfcpp")
+                                     "/include/utf8cpp")))))))
+    (inputs
+     (list alsa-lib
+           espeak-ng
+           libsndfile
+           pulseaudio
+           sonic
+           utfcpp))
+    (native-inputs
+     (list autoconf
+           automake
+           libtool
+           pkg-config))
     (native-search-paths
      (list (search-path-specification
             (variable "EKHO_DATA_PATH")
@@ -664,7 +687,7 @@ recognition engine.")
     (home-page "https://eguidedog.net/ekho.php")
     (synopsis "Chinese text-to-speech software")
     (description
-     "Ehko is a Text-To-Speech (TTS) software.  It supports Cantonese,
+     "Ehko is a @acronym{TTS, Text-To-Speak} software.  It supports Cantonese,
 Mandarin, Toisanese, Zhaoan Hakka, Tibetan, Ngangien and Korean (in trial).
 It can also speak English through eSpeak or Festival.")
     (license (list license:gpl2+

gnu/packages/ssh.scm

@@ -19,7 +19,7 @@
 ;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
 ;;; Copyright © 2023 Simon Streit <simon@netpanic.org>
 ;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
-;;; Copyright © 2024, 2025 Ashish SHUKLA <ashish.is@lostca.se>
+;;; Copyright © 2024-2026 Ashish SHUKLA <ashish.is@lostca.se>
 ;;; Copyright © 2024, 2025 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;; Copyright © 2025 Ghislain Vaillant <ghislain.vaillant@inria.fr>
 ;;; Copyright © 2025 Cayetano Santos <csantosb@inventati.org>
@@ -237,7 +237,7 @@ a server that supports the SSH-2 protocol.")
 (define-public openssh
   (package
    (name "openssh")
-   (version "10.2p1")
+   (version "10.3p1")
    (source
     (origin
       (method url-fetch)
@@ -245,7 +245,7 @@ a server that supports the SSH-2 protocol.")
                           "openssh-" version ".tar.gz"))
       (patches (search-patches "openssh-trust-guix-store-directory.patch"))
       (sha256
-       (base32 "1clqyxh6mrbwjg964df0hjwmd361mxnx3nx17wk5jyck3422ri6c"))))
+       (base32 "1x25iv8yfcfpf3b1ap72indbfna0wz48xz8ny2sg9p4jpcv2ls2n"))))
    (build-system gnu-build-system)
    (arguments
     (list

gnu/packages/statistics.scm

@@ -384,15 +384,15 @@ comparison and diagnostics.")
 (define r-with-tests
   (package
     (name "r-with-tests")
-    (version "4.5.3")
+    (version "4.6.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://cran/src/base/R-"
                                   (version-major version) "/R-"
-                                  version ".tar.gz"))
+                                  version ".tar.xz"))
               (sha256
                (base32
-                "1wmqnm813lb58c0vwhjymnkfih3a6mq4cr9xa6n72wiw57a1wp5a"))))
+                "09sszy5fykpl2lyzxw5rgiabb3f5l62bqamnm7g2q9d57xlv7wli"))))
     (build-system gnu-build-system)
     (arguments
      (list

gnu/packages/terminals.scm

@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2015-2021, 2023-2025 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2015-2021, 2023-2026 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Mckinley Olsen <mck.olsen@gmail.com>
 ;;; Copyright © 2016, 2017, 2019 Alex Griffin <a@ajgrf.com>
 ;;; Copyright © 2016 David Craven <david@craven.ch>
@@ -1479,7 +1479,7 @@ basic input/output.")
 (define-public alacritty
   (package
     (name "alacritty")
-    (version "0.16.1")
+    (version "0.17.0")
     (source
      (origin
        ;; XXX: The crate at "crates.io" contains only the alacritty subproject
@@ -1491,99 +1491,90 @@ basic input/output.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0swxzcqsaqi9shkr0v4pww6wgysq612j9wcqijfrv4gsksff3qr0"))))
+        (base32 "1aw5v127f0jr3jq5cclsbvbvf82g6s195dh1vjlcwjpbc0gl56w9"))))
     (build-system cargo-build-system)
     (arguments
-     `(#:install-source? #f
+     (list
+       #:imported-modules (append %copy-build-system-modules
+                                  %cargo-build-system-modules)
+       #:modules '((guix build cargo-build-system)
+                   ((guix build copy-build-system) #:prefix copy:)
+                   (guix build utils))
+       #:install-source? #f
+       #:cargo-install-paths ''("alacritty")
        #:cargo-test-flags
-       '("--"
-         ;; Changes in clap regularly break this test.
-         "--skip=cli::tests::completions")
+       ''("--"
+          ;; Changes in clap regularly break this test.
+          "--skip=cli::tests::completions")
        #:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'patch-xdg-open
-           (lambda* (#:key inputs #:allow-other-keys)
-             (substitute* "alacritty/src/config/ui_config.rs"
-               (("xdg-open") (search-input-file inputs "/bin/xdg-open")))))
-         (add-after 'configure 'add-absolute-library-references
-           (lambda* (#:key inputs vendor-dir #:allow-other-keys)
-             ;; Fix dlopen()ing some libraries on pure Wayland (no $DISPLAY):
-             ;; Failed to initialize any backend! Wayland status: NoWaylandLib
-             ;; XXX We patch transitive dependencies that aren't even direct
-             ;; inputs to this package, because of the way Guix's Rust build
-             ;; system currently works.  <http://issues.guix.gnu.org/46399>
-             ;; might fix this and allow patching them directly.
-             (substitute* (find-files vendor-dir "\\.rs$")
-               (("libEGL\\.so")
-                (search-input-file inputs "lib/libEGL.so"))
-               (("libGL\\.so")
-                (search-input-file inputs "lib/libGL.so"))
-               ;; Lots of libraries from rust-x11-dl and others.
-               (("libX[[:alpha:]]*\\.so" all)
-                (search-input-file inputs (string-append "lib/" all)))
-
-               ;; There are several libwayland libraries.
-               (("libwayland\\.so" all)
-                (search-input-file inputs (string-append "lib/" all)))
-               (("libwayland-[[:alpha:]]*\\.so" all)
-                (search-input-file inputs (string-append "lib/" all)))
-               (("libxkbcommon-x11\\.so")
-                (search-input-file inputs "lib/libxkbcommon-x11.so"))
-               (("libxkbcommon\\.so")
-                (search-input-file inputs "lib/libxkbcommon.so")))))
-         (replace 'install
-           ;; Upstream install script only takes care of executable.
-           (lambda* (#:key native-inputs inputs outputs #:allow-other-keys)
-             (let* ((out   (assoc-ref outputs "out"))
-                    (bin   (string-append out "/bin"))
-                    (share (string-append out "/share"))
-                    (icons (string-append share "/icons/hicolor/scalable/apps"))
-                    (tic   (search-input-file (or native-inputs inputs) "/bin/tic"))
-                    (man   (string-append share "/man"))
-                    (alacritty-bin (car (find-files "target" "^alacritty$"))))
-               ;; Install the executable.
-               (install-file alacritty-bin bin)
-               ;; Install man pages.
-               (mkdir-p (string-append man "/man1"))
-               (mkdir-p (string-append man "/man5"))
-               (define (create-manpage manpage)
-                 (let ((mandir (string-append
-                                 "/man" (string-take-right manpage 1) "/")))
-                   (with-input-from-file (string-append manpage ".scd")
+       #~(modify-phases %standard-phases
+           (add-after 'unpack 'patch-xdg-open
+             (lambda* (#:key inputs #:allow-other-keys)
+               (substitute* "alacritty/src/config/ui_config.rs"
+                 (("xdg-open") (search-input-file inputs "/bin/xdg-open")))))
+           (add-after 'configure 'add-absolute-library-references
+             (lambda* (#:key inputs vendor-dir #:allow-other-keys)
+               ;; Fix dlopen()ing some libraries on pure Wayland (no $DISPLAY):
+               ;; Failed to initialize any backend! Wayland status: NoWaylandLib
+               ;; XXX We patch transitive dependencies that aren't even direct
+               ;; inputs to this package, because of the way Guix's Rust build
+               ;; system currently works.  <http://issues.guix.gnu.org/46399>
+               ;; might fix this and allow patching them directly.
+               (define shared-library-regex
+                 ;; Using regex decreases the time it takes to run the
+                 ;; substitution over 12000 files by about 40%.
+                 (string-join
+                   (list "libEGL\\.so"              ; rust-glutin
+                         "libGL\\.so"               ; rust-x11-dl, rust-glutin
+                         "libX[[:alpha:]]*\\.so"    ; rust-x11-dl
+                         ; rust-wayland-sys, rust-wayland-backend
+                         "libwayland-[[:alpha:]]*\\.so"
+                         ;; rust-xkbcommon-dl
+                         "libxkbcommon\\.so"
+                         "libxkbcommon-x11\\.so")
+                   "|"))
+               (substitute* (find-files vendor-dir "\\.rs$")
+                 ((shared-library-regex all)
+                  (search-input-file inputs (string-append "lib/" all))))))
+           (add-after 'install 'install-more
+             (lambda* (#:key native-inputs inputs #:allow-other-keys
+                       #:rest args)
+               (let ((tic (search-input-file
+                            (or native-inputs inputs) "/bin/tic"))
+                     (terminfo (string-append #$output "/share/terminfo")))
+                 (define (create-manpage manpage)
+                   (with-input-from-file manpage
                      (lambda _
-                       (with-output-to-file (string-append man mandir manpage)
-                         (lambda _ (invoke "scdoc")))))))
-               (with-directory-excursion "extra/man"
-                 (for-each create-manpage '("alacritty.1"
-                                            "alacritty-msg.1"
-                                            "alacritty.5"
-                                            "alacritty-bindings.5")))
-               ;; Install desktop file.
-               (install-file "extra/linux/Alacritty.desktop"
-                             (string-append share "/applications"))
-               (install-file "extra/linux/org.alacritty.Alacritty.appdata.xml"
-                             (string-append share "/metainfo"))
-               ;; Install icon.
-               (mkdir-p icons)
-               (copy-file "extra/logo/alacritty-term.svg"
-                          (string-append icons "/Alacritty.svg"))
-               ;; Install terminfo.
-               (mkdir-p (string-append share "/terminfo"))
-               ;; We don't compile alacritty-common entry because
-               ;; it's being used only for inheritance.
-               (invoke tic "-x" "-e" "alacritty,alacritty-direct"
-                       "-o" (string-append share "/terminfo/")
-                       "extra/alacritty.info")
-               ;; Install completions.
-               (mkdir-p (string-append
-                         out "/share/bash-completion/completions"))
-               (copy-file "extra/completions/alacritty.bash"
-                          (string-append
-                           out "/share/bash-completion/completions/alacritty"))
-               (install-file "extra/completions/_alacritty"
-                             (string-append share "/zsh/site-functions"))
-               (install-file "extra/completions/alacritty.fish"
-                             (string-append share "/fish/vendor_completions.d"))))))))
+                       (with-output-to-file (string-drop-right manpage 4)
+                         (lambda _ (invoke "scdoc"))))))
+                 (with-directory-excursion "extra/man"
+                   (for-each create-manpage
+                             (find-files "." "^alacritty.*\\.[[:digit:]]\\.scd$")))
+                 (apply (assoc-ref copy:%standard-phases 'install)
+                        #:install-plan
+                        '(("extra/man" "share/man/man1" #:include-regexp ("\\.1$"))
+                          ("extra/man" "share/man/man5" #:include-regexp ("\\.5$"))
+                          ("extra/man" "share/man/man7" #:include-regexp ("\\.7$"))
+                          ("extra/linux/Alacritty.desktop" "share/applications/")
+                          ("extra/linux/org.alacritty.Alacritty.appdata.xml"
+                           "share/metainfo/")
+                          ("extra/logo/alacritty-term.svg"
+                           "share/icons/hicolor/scalable/apps/Alacritty.svg")
+                          ;; completions
+                          ("extra/completions/alacritty.bash"
+                           "share/bash-completion/completions/alacritty")
+                          ("extra/completions/_alacritty"
+                           "share/zsh/site-functions/")
+                          ("extra/completions/alacritty.fish"
+                           "share/fish/vendor_completions.d/"))
+                        args)
+                 ;; Install terminfo.
+                 (mkdir-p terminfo)
+                 ;; We don't compile alacritty-common entry because
+                 ;; it's being used only for inheritance.
+                 (invoke tic "-x" "-e" "alacritty,alacritty-direct"
+                         "-o" terminfo
+                         "extra/alacritty.info")))))))
     (native-inputs
      (list ncurses
            pkg-config

gnu/packages/tls.scm

@@ -2,7 +2,7 @@
 ;;; Copyright © 2012-2017, 2019-2025 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2021 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014 Ian Denhardt <ian@zenhack.net>
-;;; Copyright © 2013, 2015 Andreas Enge <andreas@enge.fr>
+;;; Copyright © 2013, 2015, 2026 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
 ;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2016, 2017, 2019, 2021-2024 Efraim Flashner <efraim@flashner.co.il>
@@ -98,7 +98,7 @@
 (define-public libtasn1
   (package
     (name "libtasn1")
-    (version "4.20.0")
+    (version "4.21.0")
     (source
      (origin
       (method url-fetch)
@@ -106,7 +106,7 @@
                           version ".tar.gz"))
       (sha256
        (base32
-        "0v57hwsv4wijb0fvfp6s9jx35izhhgfjssq3fvpaxm029jyy7q4j"))))
+        "11ywcy8n115c8b3vmf7hmgkdhlfy4phlcwvp8114di9w495492hx"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags '("--disable-static")))
@@ -430,7 +430,7 @@ OpenSSL for TARGET."
 (define-public openssl-1.1
   (package
     (name "openssl")
-    (version "1.1.1u")
+    (version "1.1.1w")
     (source (origin
               (method url-fetch)
               (uri (list (string-append "https://www.openssl.org/source/openssl-"
@@ -443,7 +443,7 @@ OpenSSL for TARGET."
               (patches (search-patches "openssl-1.1-c-rehash-in.patch"))
               (sha256
                (base32
-                "1ipbcdlqyxbj5lagasrq2p6gn0036wq6hqp7gdnd1v1ya95xiy72"))))
+                "1j3anw4554lk3m9cvjngvh1c2gbdkhgiz160jnnm7n5l1jarhc6g"))))
     (build-system gnu-build-system)
     (outputs '("out"
                "doc"        ;6.8 MiB of man3 pages and full HTML documentation
@@ -452,14 +452,11 @@ OpenSSL for TARGET."
     (arguments
      (list
       #:make-flags
-      ;; 'test_ssl_new.t' in 1.1.1n and 3.0.3 fails due to an expired
-      ;; certificate: <https://github.com/openssl/openssl/issues/18441>.  Skip
-      ;; it.
-      #~(list #$@(if (or (target-arm?) (target-riscv64?))
-                     ;; 'test_afalg' seems to be dependent on kernel features:
-                     ;; <https://github.com/openssl/openssl/issues/12242>.
-                     #~("TESTS=-test_afalg -tls_ssl_new")
-                     #~("TESTS=-test_ssl_new")))
+      (if (or (target-arm?) (target-riscv64?))
+          ;; 'test_afalg' seems to be dependent on kernel features:
+          ;; <https://github.com/openssl/openssl/issues/12242>.
+           #~(list "TESTS=-test_afalg")
+           #~(list))
       #:test-target "test"
       ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
       ;; so we explicitly disallow it here.
@@ -550,10 +547,11 @@ OpenSSL for TARGET."
     (license license:openssl)
     (home-page "https://www.openssl.org/")))
 
-(define-public openssl-3.0
+(define-public openssl-3.5
+  ;; LTS series with EOL 2030-04-08
   (package
-    (inherit openssl-1.1)
-    (version "3.0.8")
+    (name "openssl")
+    (version "3.5.5")
     (source (origin
               (method url-fetch)
               (uri (list (string-append "https://www.openssl.org/source/openssl-"
@@ -566,38 +564,136 @@ OpenSSL for TARGET."
               (patches (search-patches "openssl-3.0-c-rehash-in.patch"))
               (sha256
                (base32
-                "0gjb7qjl2jnzs1liz3rrccrddxbk6q3lg8z27jn1xwzx72zx44vc"))))
+                "129aphl9yy5xd67cwacf000llkhpi1s8phmlhgws2rcb599r335j"))))
+    (build-system gnu-build-system)
+    (outputs '("out"
+               "doc"
+               "static"))
     (arguments
-     (substitute-keyword-arguments (package-arguments openssl-1.1)
-       ((#:phases phases '%standard-phases)
-        #~(modify-phases #$phases
-            (add-before 'configure 'configure-perl
-              (lambda* (#:key native-inputs inputs #:allow-other-keys)
-                (setenv "HASHBANGPERL"
-                        (search-input-file (or native-inputs inputs)
-                                           "/bin/perl"))))
-            #$@(if (target-hurd?)
-                   #~((delete 'patch-configure))
-                   #~())
-            #$@(if (target-hurd64?)
-                   #~((add-after 'unpack 'apply-hurd-patch
-                        (lambda _
-                          (let ((patch-file
-                                 #$(local-file
-                                    (search-patch "openssl-hurd64.patch"))))
-                            (invoke "patch" "--force" "-p1" "-i"
-                                    patch-file)))))
-                   #~())))
-       ((#:configure-flags flags #~'())
-        (if (system-hurd?)              ;must not be used when
-            #~(append #$flags           ;cross-compiling!
-                      #$(if (target-hurd64?)
-                            #~'("hurd-x86_64")
-                            #~'("hurd-x86")))
-            flags))))
+     (list
+      #:parallel-tests? #f
+      #:make-flags
+      (if (or (target-arm?) (target-riscv64?))
+          ;; 'test_afalg' seems to be dependent on kernel features:
+          ;; <https://github.com/openssl/openssl/issues/12242>.
+           #~(list "TESTS=-test_afalg")
+           #~(list))
+      #:test-target "test"
+      #:configure-flags
+        (if (system-hurd?)
+            (if (target-hurd64?)
+                #~(list "hurd-x86_64")
+                #~(list "hurd-x86"))
+            #~(list))
+      ;; Changes to OpenSSL sometimes cause Perl to "sneak in" to the closure,
+      ;; so we explicitly disallow it here.
+      #:disallowed-references (list (this-package-native-input "perl"))
+      #:phases
+      #~(modify-phases %standard-phases
+          (replace 'configure
+            (lambda* (#:key configure-flags native-inputs inputs target #:allow-other-keys)
+              ;; It's not a shebang so patch-source-shebangs misses it.
+              (substitute* "config"
+                (("/usr/bin/env")
+                 (which "env")))
+              #$@(if (%current-target-system)
+                     #~((setenv "CROSS_COMPILE" (string-append target "-"))
+                        (setenv "CONFIGURE_TARGET_ARCH"
+                                #$(target->openssl-target
+                                   this-package
+                                   (%current-target-system))))
+                     #~())
+              ;; Configure PERL.
+              (setenv "HASHBANGPERL"
+                      (search-input-file (or native-inputs inputs)
+                                         "/bin/perl"))
+              (apply
+               invoke #$@(if (%current-target-system)
+                             #~("./Configure")
+                             #~("./config"))
+               "shared"                 ;build shared libraries
+               "--libdir=lib"
+
+               ;; The default for this catch-all directory is
+               ;; PREFIX/ssl.  Change that to something more
+               ;; conventional.
+               (string-append "--openssldir=" #$output
+                              "/share/openssl-"
+                              #$(package-version this-package))
+
+               (string-append "--prefix=" #$output)
+               (string-append "-Wl,-rpath," (string-append #$output "/lib"))
+               #$@(if (%current-target-system)
+                      #~((getenv "CONFIGURE_TARGET_ARCH"))
+                      #~())
+               configure-flags)
+              ;; Output the configure variables.
+              (invoke "perl" "configdata.pm" "--dump")))
+          (add-after 'install 'move-static-libraries
+            (lambda _
+              ;; Move static libraries to the "static" output.
+              (let* ((lib    (string-append #$output "/lib"))
+                     (slib   (string-append #$output:static "/lib")))
+                (for-each (lambda (file)
+                            (install-file file slib)
+                            (delete-file file))
+                          (find-files
+                           lib
+                           #$(if (target-mingw?)
+                                 '(lambda (filename _)
+                                    (and (string-suffix? ".a" filename)
+                                         (not (string-suffix? ".dll.a"
+                                                              filename))))
+                                 "\\.a$"))))))
+          (add-after 'install 'move-extra-documentation
+            (lambda _
+              ;; Move man pages and full HTML documentation to "doc".
+              (let* ((man    (string-append #$output "/share/man"))
+                     (html   (string-append #$output "/share/doc/openssl"))
+                     (man-target (string-append #$output:doc "/share/man"))
+                     (html-target (string-append
+                                   #$output:doc "/share/doc/openssl")))
+                (mkdir-p (dirname man-target))
+                (mkdir-p (dirname html-target))
+                (rename-file man man-target)
+                (rename-file html html-target))))
+          (add-after 'install 'remove-miscellany
+            (lambda _
+              ;; The 'misc' directory contains random undocumented shell and
+              ;; Perl scripts.  Remove them to avoid retaining a reference on
+              ;; Perl.
+              (delete-file-recursively
+               (string-append #$output "/share/openssl-"
+                              #$(package-version this-package) "/misc")))))))
+    (native-inputs (list perl))
+    (native-search-paths
+     (list $SSL_CERT_DIR $SSL_CERT_FILE))
+    (home-page "https://www.openssl.org/")
+    (synopsis "SSL/TLS implementation")
+    (description "OpenSSL is an implementation of SSL/TLS.")
     (license license:asl2.0)))
 
-(define-public openssl openssl-3.0)
+(define-public openssl-3.0
+  ;; LTS series with EOL 2026-09-07
+  (package
+    (inherit openssl-3.5)
+    (version "3.0.19")
+    (source (origin
+              (method url-fetch)
+              (uri (list (string-append "https://www.openssl.org/source/openssl-"
+                                        version ".tar.gz")
+                         (string-append "ftp://ftp.openssl.org/source/"
+                                        "openssl-" version ".tar.gz")
+                         (string-append "ftp://ftp.openssl.org/source/old/"
+                                        (string-trim-right version char-set:letter)
+                                        "/openssl-" version ".tar.gz")))
+              (patches (search-patches "openssl-3.0-c-rehash-in.patch"
+                                       "openssl-hurd64.patch"))
+              (sha256
+               (base32
+                "0wihnr5bjdc3v0r4viwb1d1lf1rfkbrcmwzj7vjqpqdap11l2nps"))))))
+
+(define-public openssl openssl-3.5)
 
 (define-public bearssl
   (package
@@ -821,7 +917,7 @@ certificates for free.")
                 "0pfrpi77964cg15dm6y0w03l64xs0k2nqc15qh2xmv8vdnjyhywx"))
               (patches (search-patches "perl-net-ssleay-colon-parsing.patch"))))
     (build-system perl-build-system)
-    (inputs (list openssl))
+    (inputs (list openssl-3.0))
     (arguments
      `(#:phases
        (modify-phases %standard-phases