gnu: linux-libre 6.6: Update to 6.6.136.

* gnu/packages/linux.scm (linux-libre-6.6-version): Update to 6.6.136.
(linux-libre-6.6-pristine-source): Update hash.

.guix-authorizations

@@ -16,6 +16,8 @@
   ( ;; primary: "D0C2 EAC1 3310 822D 98DE  B57C E9C5 A2D9 0898 A02F"
    "01FD 85F4 1A7B 7F82 0583  06A5 935E BE07 36DC 857E"
    (name "avp"))
+  ("5D54 CF25 57B2 38E8 8DC1  80A2 2D22 3241 0AB7 4043"
+   (name "baleine"))
   ( ;; primary: "34FF 38BC D151 25A6 E340  A0B5 3453 2F9F AFCA 8B8E"
    "A3A4 B419 0074 087C A7DE  5698 BC45 CA67 E2F8 D007"
    (name "bavier"))

CODEOWNERS

@@ -274,6 +274,7 @@ guix/build-system/ant\.scm                         @guix/java
 guix/build-system/clojure\.scm                     @guix/java
 guix/build-system/maven\.scm                       @guix/java
 
+gnu/packages/javascript\.scm                       @guix/javascript
 gnu/packages/node-xyz\.scm                         @guix/javascript
 gnu/packages/node\.scm                             @guix/javascript
 guix/build-system/node\.scm                        @guix/javascript

doc/guix.texi

@@ -2658,12 +2658,13 @@ bootloaders.
 
 Once you are done partitioning the target hard disk drive, you have to
 create a file system on the relevant partition(s)@footnote{Currently
-Guix System supports only ext4, btrfs, bcachefs, JFS, F2FS, and XFS
-file systems.  In particular, code that reads file system UUIDs and
-labels works only for these file system types.  For bcachefs, also add
-the @code{bcachefs-linux-module} to your @code{operating-system}'s
-@code{initrd-modules}.}.  For the ESP, if you have one and assuming it is
-@file{/dev/sda1}, run:
+Guix System can mount only ext4, btrfs, JFS, F2FS, and XFS file systems
+at boot time.  In particular, code that reads file system UUIDs and
+labels works only for these file system types.  The code for bcachefs is
+in place, but support for loading out-of-tree kernel modules in the
+initrd is not.}.
+
+For the ESP, if you have one and assuming it is @file{/dev/sda1}, run:
 
 @example
 mkfs.fat -F32 /dev/sda1
@@ -19215,7 +19216,7 @@ Partitioning}, for an example.
 
 When using GRUB as the bootloader, the LUKS password is only requested
 once: GRUB passes the master key to the initial RAM disk automatically.
-@xref{Bootloader Configuration, Automatic LUKS Master Key Passing}, for
+@xref{grub-luks-root-device-key, Automatic LUKS Master Key Passing}, for
 details.
 
 @end defvar
@@ -45250,6 +45251,12 @@ Extra command line options for @code{guix-data-service}.
 @item @code{extra-process-jobs-options} (default: @var{'()})
 Extra command line options for @code{guix-data-service-process-jobs}.
 
+@item @code{extra-environment-variables} (default: @var{'()})
+Extra environment variables for @code{guix-data-service}.
+
+@item @code{extra-process-jobs-environment-variables} (default: @var{'()})
+Extra environment variables for @code{guix-data-service-process-jobs}.
+
 @item @code{git-repositories} (default: @var{#f})
 List of git-repository information to insert into the database.
 
@@ -48959,8 +48966,28 @@ This option in enabled by default.  In some cases involving the
 in RAM, it can be handy to disable the option by setting it to
 @code{#f}.
 
-@subsubheading Automatic LUKS Master Key Passing
+@item @code{extra-initrd} (default: @code{#f})
+File name of an additional initrd to load during the boot.  It may or
+may not point to a file in the store, but the main use case is for
+out-of-store files containing secrets.
 
+For any use case not involving secrets, you should use regular initrd
+(@pxref{operating-system Reference, @code{initrd}}) instead.
+
+Be careful when using this option, since pointing to a file that is not
+readable by the grub while booting will cause the boot to fail and
+require a manual edit of the initrd line in the grub menu.
+
+Currently only supported by GRUB.
+@end table
+
+@end deftp
+
+@anchor{grub-luks-root-device-key}
+@unnumberedsubsec Automatic LUKS Master Key Passing
+
+@cindex LUKS, root file system encryption
+@cindex passphrase, for LUKS-encrypted root
 When booting from a LUKS-encrypted device using GRUB, the password is
 normally requested twice: once by GRUB to access @file{/boot}, and a
 second time by the initial RAM disk to mount the root file system.
@@ -49001,22 +49028,7 @@ No configuration is required: GRUB's @code{procfs} and @code{luks}
 modules are loaded automatically when encrypted devices are declared
 via @code{luks-device-mapping} (@pxref{Mapped Devices}).
 
-@item @code{extra-initrd} (default: @code{#f})
-File name of an additional initrd to load during the boot.  It may or
-may not point to a file in the store, but the main use case is for
-out-of-store files containing secrets.
-
-For any use case not involving secrets, you should use regular initrd
-(@pxref{operating-system Reference, @code{initrd}}) instead.
-
-Be careful when using this option, since pointing to a file that is not
-readable by the grub while booting will cause the boot to fail and
-require a manual edit of the initrd line in the grub menu.
-
-Currently only supported by GRUB.
-@end table
-
-@end deftp
+@unnumberedsubsec Additional Boot Entries
 
 @cindex dual boot
 @cindex boot menu
@@ -49145,9 +49157,13 @@ example of chainloading a different GNU/Linux system.
 @end table
 @end deftp
 
+@unnumberedsubsec Themes
+
 @cindex HDPI
 @cindex HiDPI
 @cindex resolution
+@cindex themes, for GRUB
+@cindex bootloader themes
 @c FIXME: Write documentation once it's stable.
 For now only GRUB has theme support.  GRUB themes are created using
 the @code{grub-theme} form, which is not fully documented yet.
@@ -49167,7 +49183,7 @@ Return the default GRUB theme used by the operating system if no
 @code{theme} field is specified in @code{bootloader-configuration}
 record.
 
-It comes with a fancy background image displaying the GNU and Guix
+It comes with a fancy background image displaying the Guix
 logos.
 @end deffn
 

etc/teams.scm

@@ -844,7 +844,8 @@ and the maven-build-system."
         #:name "JavaScript team"
         #:description
         "JavaScript/Node.js packages, the node build system."
-        #:scope (list "gnu/packages/node-xyz.scm"
+        #:scope (list "gnu/packages/javascript.scm"
+                      "gnu/packages/node-xyz.scm"
                       "gnu/packages/node.scm"
                       "guix/build-system/node.scm"
                       "guix/build/node-build-system.scm"

gnu/build/linux-container.scm

@@ -445,10 +445,14 @@ load path must be adjusted as needed."
           ;; Behave like an init process: create a sub-process that calls
           ;; THUNK, and wait for child processes.  Furthermore, forward
           ;; RELAYED-SIGNALS to the child process.
-          (match (primitive-fork)
-            (0
+          ;; We presently use `safe-clone` here due to a bug in the interaction
+          ;; between Guix and `primitive-fork` in Guile 3.0.11:
+          ;; https://codeberg.org/guix/guix/issues/7690#issuecomment-12744123
+          (safe-clone
+            SIGCHLD
+            (lambda ()
              (call-with-clean-exit thunk))
-            (pid
+            (lambda (pid)
              (install-signal-handlers pid)
              (let loop ()
                (match (wait-child-process)

gnu/local.mk

@@ -1178,6 +1178,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/curlftpfs-fix-no_verify_hostname.patch	\
   %D%/packages/patches/cursynth-wave-rand.patch			\
   %D%/packages/patches/cvc5-reproducible-build.patch		\
+  %D%/packages/patches/cvc5-symfpu-compatibility.patch		\
   %D%/packages/patches/cvs-CVE-2017-12836.patch		\
   %D%/packages/patches/cyrus-sasl-fix-time-h.patch              \
   %D%/packages/patches/d-feet-drop-unused-meson-argument.patch	\
@@ -2349,8 +2350,16 @@ dist_patch_DATA =						\
   %D%/packages/patches/renpy-fix-integer-slots.patch			\
   %D%/packages/patches/reposurgeon-add-missing-docbook-files.patch	\
   %D%/packages/patches/rdkit-unbundle-external-dependencies.patch	\
+  %D%/packages/patches/r-biostrings-r4.6.0-compat.patch		\
+  %D%/packages/patches/r-h5mread-0001-h5mread-1.3.2-Get-rid-of-non-API-calls-to-R.patch \
   %D%/packages/patches/r-httpuv-1.6.6-unvendor-libuv.patch	\
+  %D%/packages/patches/r-mscoreutils-0001-fix-non-API-call-to-R-SETLENGTH-by-using-lengthgets.patch \
+  %D%/packages/patches/r-rsamtools-r-4.6.0-compat.patch		\
+  %D%/packages/patches/r-snpstats-0001-fixed-non-API-except-for-IS_S4_OBJECT.patch \
+  %D%/packages/patches/r-snpstats-0002-fixed-IS_S4_OBJECT.patch \
   %D%/packages/patches/r-sapa-lapack.patch			\
+  %D%/packages/patches/r-shortread-0001-ShortRead-1.69.3-Get-rid-of-non-API-calls-to-R.patch \
+  %D%/packages/patches/r-sparsearray-r-4.6.0-compat.patch	\
   %D%/packages/patches/ripperx-missing-file.patch		\
   %D%/packages/patches/rpcbind-CVE-2017-8779.patch		\
   %D%/packages/patches/rtosc-0.3.1-fix-invalid-comparison-operator.patch	\
@@ -2400,6 +2409,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/rust-codex-0.120.0-connectors-cache-test-race.patch	\
   %D%/packages/patches/rust-codex-0.120.0-remove-libwebrtc.patch	\
   %D%/packages/patches/rust-codex-0.120.0-test-timeout.patch	\
+  %D%/packages/patches/rust-codex-0.124.0-code-mode-stub-toolname.patch	\
+  %D%/packages/patches/rust-codex-0.124.0-remove-patch-sections.patch	\
   %D%/packages/patches/rust-ring-0.17-ring-core.patch		\
   %D%/packages/patches/rw-igraph-0.10.patch			\
   %D%/packages/patches/rxvt-unicode-fix-cursor-position.patch	\

gnu/packages/admin.scm

@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012-2025 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012-2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Cyril Roelandt <tipecaml@gmail.com>
 ;;; Copyright © 2014, 2015, 2016, 2018, 2019, 2020 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014, 2015-2018, 2020-2023 Eric Bavier <bavier@posteo.net>
@@ -3751,59 +3751,68 @@ summarizes network bandwidth by process and remote host.")
 (define-public munge
   (package
     (name "munge")
-    (version "0.5.14")
+    (version "0.5.18")
     (source (origin
-              (method url-fetch)
-              (uri (string-append "https://github.com/dun/munge/releases/"
-                                  "download/munge-" version "/munge-"
-                                  version ".tar.xz"))
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/dun/munge")
+                     (commit (string-append "munge-" version))))
+              (file-name (git-file-name name version))
               (sha256
                (base32
-                "0h06sghb4rqvv1ywyd6mzsmbcgh712v6ygrff0gzm440y4ca41k6"))
+                "1b7gm680dlvmgvj9vxy7n0cqmnv1rl9n4563vasxdxx54f78j30s"))
               (modules '((guix build utils)))
               (snippet
-               '(begin
-                  ;; Don't insist on write access to /var.
-                  (substitute* "src/etc/Makefile.in"
-                    (("\\$\\(INSTALL\\)(.*)localstatedir" _ middle)
-                     (string-append "-$(INSTALL)" middle "localstatedir"))
-                    (("\\$\\(MKDIR_P\\) .*(local|run)statedir.*")
-                     ""))
-                  #t))))
+               ;; Don't insist on write access to /var.
+               #~(substitute* "src/etc/Makefile.am"
+                   (("\\$\\(MKDIR_P\\) .*(local|run)statedir.*" all)
+                    (string-append ": " all))))))
     (inputs
      (list openssl libgcrypt))
+    (native-inputs
+     (list autoconf
+           automake
+           libtool
+           procps))                               ;for tests
     (build-system gnu-build-system)
     (arguments
-     `(#:configure-flags
-       (list "--localstatedir=/var"
-             (string-append "--with-pkgconfigdir="
-                            (assoc-ref %outputs "out") "/lib/pkgconfig")
-             (string-append "--with-libgcrypt-prefix="
-                            (assoc-ref %build-inputs "libgcrypt"))
-             ,@(if (%current-target-system)
-                 ;; Assume yes on pipes when cross compiling.
-                 `("ac_cv_file__dev_spx=yes"
-                   "x_ac_cv_check_fifo_recvfd=yes")
-                 '()))
-       #:phases
-       (modify-phases %standard-phases
-         ;; XXX Many test series fail.  Some might be fixable, others do no-no
-         ;; things like invoking ‘sudo’.
-         (add-after 'unpack 'skip-failing-tests
-           (lambda _
-             (for-each (lambda (test)
-                         (substitute* "t/Makefile.in"
-                           (((string-append test "\\.t ")) "")))
-                       (list "0100-munged-lock"
-                             "0010-basic"
-                             "0011-munged-cmdline"
-                             "0012-munge-cmdline"
-                             "0013-unmunge-cmdline"
-                             "0101-munged-security-socket"
-                             "0102-munged-security-keyfile"
-                             "0103-munged-security-logfile"
-                             "0110-munged-origin-addr"))
-             #t)))))
+     (list #:configure-flags
+           #~(list "--localstatedir=/var"
+                   "--disable-static"
+                   #$@(if (%current-target-system)
+                          ;; Assume yes on pipes when cross compiling.
+                          `("ac_cv_file__dev_spx=yes"
+                            "x_ac_cv_check_fifo_recvfd=yes")
+                          '())
+
+                   ;; The '.pc' file is not installed when omitting this flag.
+                   (string-append "--with-pkgconfigdir="
+                                  #$output "/lib/pkgconfig"))
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-before 'bootstrap 'pre-bootstrap
+                 (lambda _
+                   (for-each patch-shebang (find-files "build-aux"))))
+               (add-after 'unpack 'skip-failing-tests
+                 (lambda _
+                   ;; Pass '--force' to 'munged'; without it, it fails with "Socket
+                   ;; is inaccessible" due to the build directory not being
+                   ;; world-readable.
+                   (substitute* "tests/sharness.d/03-munged.sh"
+                     (("--group-update-time=-1" all)
+                      (string-append all " --force")))
+
+                   ;; The tests below invoke 'sudo' or have special expectations
+                   ;; about network interfaces.
+                   (for-each (lambda (test)
+                               (substitute* "tests/Makefile.am"
+                                 (((string-append test "\\.t "))
+                                  "")))
+                             (list "0100-munged-lock"
+                                   "0101-munged-security-socket"
+                                   "0102-munged-security-keyfile"
+                                   "0103-munged-security-logfile"
+                                   "0110-munged-origin-addr")))))))
     (home-page "https://dun.github.io/munge/")
     (synopsis "Cluster computing authentication service")
     (description

gnu/packages/bioinformatics.scm

@@ -913,7 +913,7 @@ suite native in R.")
 (define-public r-bpcells
   (package
     (name "r-bpcells")
-    (version "0.3.0")
+    (version "0.3.1")
     (source
      (origin
        (method git-fetch)
@@ -922,7 +922,7 @@ suite native in R.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "12h1di45fg06nhsliii7v0h1z567pkpis1xm4ar1qr8ns1n8iljw"))
+        (base32 "0yqgcajq83g25mznwcngaw7pi6vcqxqdnynpgb95yci57k3wrp6j"))
        (modules '((guix build utils)))
        (snippet
         '(delete-file-recursively "r/src/vendor/highway"))))
@@ -931,13 +931,15 @@ suite native in R.")
     (arguments
      (list
       #:phases
-      '(modify-phases %standard-phases
+      `(modify-phases %standard-phases
          (add-after 'unpack 'chdir
-           (lambda _
-             (substitute* "r/configure"
-               (("tools/hwy-test.cpp" m)
-                (string-append m " $HWY_LIBS $HWY_CFLAGS")))
-             (chdir "r"))))))
+           (lambda _ (chdir "r")))
+         ,@(if (target-x86-32?)
+               '((add-after 'chdir 'require-sse2
+                   ;; This avoids falling back to the scalar backend in
+                   ;; highway, which fails to build.
+                   (lambda _ (setenv "CFLAGS" "-msse2"))))
+               '()))))
     (propagated-inputs
      (list r-dplyr
            r-ggplot2

gnu/packages/codex.scm

@@ -18,10 +18,10 @@
 
 ;;; This module is separate from (gnu packages rust-apps) to avoid a
 ;;; circular module dependency: (gnu packages rust-sources), which
-;;; defines rust-codex-0.120.0, transitively loads (gnu packages
+;;; defines rust-codex-0.124.0, transitively loads (gnu packages
 ;;; rust-apps) through its #:use-module chain.  If the codex package
 ;;; lived in rust-apps.scm, loading rust-sources would trigger loading
-;;; rust-apps before rust-codex-0.120.0 is defined, causing an unbound
+;;; rust-apps before rust-codex-0.124.0 is defined, causing an unbound
 ;;; variable error.
 
 (define-module (gnu packages codex)
@@ -54,14 +54,14 @@
 (define-public codex
   (package
     (name "codex")
-    (version (package-version rust-codex-0.120.0))
+    (version (package-version rust-codex-0.124.0))
     (source
      (origin
-       (inherit (package-source rust-codex-0.120.0))
+       (inherit (package-source rust-codex-0.124.0))
        (patches (search-patches
                  "codex-acp-0.11.1-disable-code-mode.patch"
-                 "rust-codex-0.117.0-remove-patch-sections.patch"
-                 "rust-codex-0.120.0-connectors-cache-test-race.patch"
+                 "rust-codex-0.124.0-code-mode-stub-toolname.patch"
+                 "rust-codex-0.124.0-remove-patch-sections.patch"
                  "rust-codex-0.120.0-remove-libwebrtc.patch"
                  "rust-codex-0.98.0-test-shebangs.patch"
                  "rust-codex-0.120.0-test-timeout.patch"))))
@@ -69,7 +69,12 @@
     (arguments
      (list
       #:install-source? #f
-      #:cargo-install-paths '(list "cli" "exec" "exec-server"
+      ;; exec-server is library-only in 0.124 (no [[bin]] in
+      ;; exec-server/Cargo.toml); cargo install --path exec-server fails
+      ;; with "no packages found with binaries or examples".  Drop it
+      ;; from the install paths -- the library is consumed via the
+      ;; workspace by other binaries here, not installed standalone.
+      #:cargo-install-paths '(list "cli" "exec"
                                    "linux-sandbox" "mcp-server"
                                    "app-server" "tui")
       ;; schema_fixtures_match_generated (upstream fixture is stale:
@@ -317,7 +322,164 @@
                                 ;; (chatgpt.com, api.github.com) wait
                                 ;; for TCP timeout instead of failing
                                 ;; instantly at TLS, eating the budget.
-                                "--skip" "mcp_server_status_list_tools_and_auth_only_skips_slow_inventory_calls")
+                                "--skip" "mcp_server_status_list_tools_and_auth_only_skips_slow_inventory_calls"
+                                ;;; BEGIN Stack overflow in 'current_thread'
+                                ;;; tokio runtime.  The sibling tests in
+                                ;;; tracing_tests.rs use the local helper
+                                ;;; run_current_thread_test_with_stack
+                                ;;; (4 MiB) but this one uses bare
+                                ;;; #[tokio::test] on the 2 MiB default
+                                ;;; test-thread stack, and TurnStart's
+                                ;;; future graph exceeds it.  With
+                                ;;; RUST_MIN_STACK raised the overflow is
+                                ;;; gone but the test then deterministically
+                                ;;; times out waiting for a span tagged
+                                ;;; codex.op = "user_input" on the remote
+                                ;;; trace that upstream never emits on that
+                                ;;; trace in our environment.
+                                "--skip" "turn_start_jsonrpc_span_parents_core_turn_spans"
+                                ;;; END tracing test stack/timeout
+                                ;;; BEGIN The upstream loader resolves the
+                                ;;; MCP OAuth credentials store mode by
+                                ;;; calling
+                                ;;; resolve_mcp_oauth_credentials_store_mode
+                                ;;; with env!("CARGO_PKG_VERSION") -- which
+                                ;;; in the released 0.124.0 tarball is
+                                ;;; "0.124.0".  These fixture tests
+                                ;;; construct the expected Config by
+                                ;;; passing the LOCAL_DEV_BUILD_VERSION
+                                ;;; constant ("0.0.0") to the same
+                                ;;; resolver, and the resolver only returns
+                                ;;; File for "0.0.0" -- Auto otherwise.
+                                ;;; Upstream CI builds from a checkout
+                                ;;; still carrying version = "0.0.0" so the
+                                ;;; tests pass there; they cannot pass
+                                ;;; against a released tag.
+                                "--skip" "test_precedence_fixture_with_gpt3_profile"
+                                "--skip" "test_precedence_fixture_with_gpt5_profile"
+                                "--skip" "test_precedence_fixture_with_o3_profile"
+                                "--skip" "test_precedence_fixture_with_zdr_profile"
+                                ;;; END LOCAL_DEV_BUILD_VERSION fixture mismatch
+                                ;;; BEGIN Verifies that Codex's user-shell
+                                ;;; spawn produces a child where
+                                ;;; CODEX_SANDBOX_NETWORK_DISABLED is unset
+                                ;;; (asserts stdout == "not-set").  We
+                                ;;; deliberately set that env var at the
+                                ;;; check phase to trigger upstream's
+                                ;;; skip_if_no_network! guards; the var then
+                                ;;; leaks into the spawned shell and the
+                                ;;; assertion fails.  The guix skip is a
+                                ;;; direct cost of the network-gate fix --
+                                ;;; trading one broken test for two that
+                                ;;; now skip cleanly.
+                                "--skip" "user_shell_command_does_not_set_network_sandbox_env_var"
+                                ;;; END CODEX_SANDBOX_NETWORK_DISABLED leak
+                                ;;; BEGIN The exec-server/tests/file_system
+                                ;;; integration tests invoke the real
+                                ;;; system bwrap, which tries to execvp the
+                                ;;; test binary at the cargo target path
+                                ;;; under the build dir.  Same root cause
+                                ;;; as the existing
+                                ;;; sandbox_reenables_writable_subpaths_under_unreadable_parents
+                                ;;; skip: guix builds live under /tmp but
+                                ;;; bwrap's mount namespace excludes /tmp,
+                                ;;; making the binary invisible inside the
+                                ;;; namespace.
+                                "--skip" "file_system_copy_preserves_symlink_source"
+                                "--skip" "file_system_copy_rejects_symlink_escape_destination"
+                                "--skip" "file_system_copy_rejects_symlink_escape_source"
+                                "--skip" "file_system_create_directory_rejects_symlink_escape"
+                                "--skip" "file_system_read_directory_rejects_symlink_escape"
+                                "--skip" "file_system_remove_rejects_symlink_escape"
+                                "--skip" "file_system_remove_removes_symlink_not_target"
+                                "--skip" "file_system_sandboxed_read_allows_readable_root"
+                                "--skip" "file_system_sandboxed_read_rejects_symlink_escape"
+                                "--skip" "file_system_sandboxed_read_rejects_symlink_parent_dotdot_escape"
+                                "--skip" "file_system_sandboxed_write_allows_additional_write_root"
+                                "--skip" "file_system_sandboxed_write_rejects_symlink_escape"
+                                "--skip" "file_system_sandboxed_write_rejects_unwritable_path"
+                                ;;; END bwrap-cant-see-/tmp file_system tests
+                                ;;; BEGIN Landlock is unavailable on Guix,
+                                ;;; so the sandbox cannot deny network
+                                ;;; syscalls.  These tests expect
+                                ;;; SandboxErr::Denied for the nc, ping,
+                                ;;; ssh, getent, and dev_tcp_redirection
+                                ;;; commands but those commands instead
+                                ;;; block on connect() until the test's 2s
+                                ;;; timeout fires (Timeout, exit 124).
+                                ;;; Same root cause as the Landlock skips
+                                ;;; at the top of this list; new test names
+                                ;;; in 0.124.
+                                "--skip" "sandbox_blocks_nc"
+                                "--skip" "sandbox_blocks_ping"
+                                "--skip" "sandbox_blocks_dev_tcp_redirection"
+                                "--skip" "sandbox_blocks_getent"
+                                "--skip" "sandbox_blocks_ssh"
+                                ;;; END Landlock network block
+                                ;;; BEGIN Requires github.com network access.
+                                ;;; With no "extraKnownMarketplaces" entry
+                                ;;; in settings.json,
+                                ;;; collect_marketplace_import_sources
+                                ;;; inserts a fallback entry for the
+                                ;;; "claude-plugins-official" marketplace
+                                ;;; pointing at the github shorthand
+                                ;;; "anthropics/claude-plugins-official".
+                                ;;; add_marketplace -> parse_marketplace_source
+                                ;;; expands that to a github.com/.git URL
+                                ;;; and clone_git_source runs 'git clone'.
+                                ;;; The Guix build sandbox has no network,
+                                ;;; so the clone fails and the marketplace
+                                ;;; lands in failed_marketplaces.  No mock
+                                ;;; cloner is injected via
+                                ;;; ExternalAgentConfigService::new_for_test,
+                                ;;; so there is no in-tree way to satisfy
+                                ;;; the test offline.
+                                "--skip" "import_plugins_infers_claude_official_marketplace_when_missing_from_settings"
+                                ;;; END github.com network access
+                                ;;; BEGIN Async race between the rollout
+                                ;;; writer task and a direct SQLite read.
+                                ;;; The test calls
+                                ;;; update_memory_settings_with_app_server,
+                                ;;; which routes through the in-memory
+                                ;;; thread path on the app-server's
+                                ;;; ThreadMemoryModeSet handler ->
+                                ;;; Session::set_thread_memory_mode ->
+                                ;;; persist_thread_memory_mode_update,
+                                ;;; which writes a RolloutItem::SessionMeta
+                                ;;; with the new mode to the rollout file
+                                ;;; via recorder.record_items + flush.  The
+                                ;;; rollout writer task then asynchronously
+                                ;;; calls sync_thread_state_after_write,
+                                ;;; which calls state_db::apply_rollout_items
+                                ;;; to mirror the SessionMeta into SQLite.
+                                ;;; flush() only awaits the rollout-file
+                                ;;; write, not the subsequent SQLite sync.
+                                ;;; The test opens a fresh StateRuntime and
+                                ;;; reads get_thread_memory_mode
+                                ;;; immediately, so it observes the creation
+                                ;;; default of "enabled" written by
+                                ;;; upsert_thread_with_creation_memory_mode
+                                ;;; instead of the new "disabled".  Upstream
+                                ;;; CI wins this race; we lose.
+                                "--skip" "update_memory_settings_updates_current_thread_memory_mode"
+                                ;;; END memory-mode rollout/sqlite race
+                                ;;; BEGIN The Stopwatch::new constructor in
+                                ;;; codex_shell_escalation anchors
+                                ;;; T0 = Instant::now() at construction;
+                                ;;; the spawned cancellation task fires at
+                                ;;; T0 + limit.  The test captures
+                                ;;; start = Instant::now() at T1 > T0 (after
+                                ;;; cancellation_token() returns) and
+                                ;;; asserts start.elapsed() >= limit,
+                                ;;; i.e. (T0 + limit) - T1 >= limit, which
+                                ;;; is always false by the offset T1 - T0.
+                                ;;; The test only passes when scheduler
+                                ;;; jitter on the sleep wakeup happens to
+                                ;;; exceed that offset.  Upstream wins the
+                                ;;; race; we don't always.
+                                "--skip" "cancellation_receiver_fires_after_limit"
+                                ;;; END Stopwatch construction/start offset race
+                                )
       #:cargo-package-crates
       ''(;;; Tier 0: No internal deps.
          "codex-ansi-escape"
@@ -358,22 +520,31 @@
          "codex-debug-client"
          "codex-analytics"
          "codex-rollout"
+         "codex-rollout-trace"
          "codex-terminal-detection"
          "codex-utils-approval-presets"
          "codex-utils-cli"
+         "codex-uds"
+         "codex-install-context"
+         "codex-device-key"
          ;;; Tier 2.
          "codex-app-server-protocol"
          "codex-rmcp-client"
          "codex-otel"
+         "codex-thread-store"
          "codex-state"
          "codex-features"
+         "codex-model-provider"
          "codex-config"
+         "codex-agent-identity"
+         "codex-aws-auth"
          "codex-hooks"
-         "codex-instructions"
          "codex-code-mode"
          "codex-feedback"
          "codex-skills"
+         "codex-test-binary-support"
          "codex-core"
+         "codex-core-plugins"
          "codex-utils-sandbox-summary"
          "codex-linux-sandbox"
          "codex-sandboxing"
@@ -425,7 +596,7 @@
               ;; Update them to match the actual package version.
               (let ((snap-files (find-files "." "\\.snap$")))
                 (substitute* snap-files
-                  (("\\(v0\\.0\\.0\\)   ") "(v0.120.0) ")))))
+                  (("\\(v0\\.0\\.0\\)   ") "(v0.124.0) ")))))
           (add-after 'chdir-to-workspace 'patch-git-deps-to-vendor
             (lambda _
               ;; Replace git dependencies with version references so cargo
@@ -436,32 +607,55 @@
                 (("runfiles = \\{ git = [^}]+\\}")
                  "runfiles = \"0.1.0\""))
               ;; Remove workspace members that have unbuildable deps
-              ;; (libwebrtc requires git fetch, v8-poc requires V8).
+              ;; (v8-poc requires V8).  code-mode stays a workspace member
+              ;; so its codex-protocol resolves to the same local copy as
+              ;; the rest of the build; disabling its default features
+              ;; (below) avoids pulling in V8.
               (substitute* "Cargo.toml"
-                (("\"v8-poc\",") "")
-                (("\"code-mode\",") ""))
-              ;; Disable V8 runtime in codex-code-mode: remove path
-              ;; so cargo resolves it from the vendor (where it has
-              ;; optional = true on v8) and disable default features.
+                (("\"v8-poc\",") ""))
+              ;; Disable V8 runtime in codex-code-mode by turning off
+              ;; default features.  Keep path= so code-mode is resolved
+              ;; from the local source tree and shares codex-protocol
+              ;; (and other workspace crates) with the rest of the build;
+              ;; resolving it from the vendor instead introduces a
+              ;; duplicate codex-protocol and causes E0308 type
+              ;; mismatches in codex-tools.
               (substitute* "Cargo.toml"
                 (("codex-code-mode = \\{ path = \"code-mode\" \\}")
-                 "codex-code-mode = { version = \"0.120.0\", default-features = false }"))))
+                 "codex-code-mode = { path = \"code-mode\", default-features = false }"))
+              ;; cargo build at workspace root ignores per-dep
+              ;; default-features=false and builds code-mode with its
+              ;; own default features, which include v8-runtime and
+              ;; would pull in V8.  Make the default feature empty.
+              (substitute* "code-mode/Cargo.toml"
+                (("^default = \\[\"v8-runtime\"\\]") "default = []"))))
           (add-after 'patch-git-deps-to-vendor 'add-version-to-workspace-deps
             (lambda _
               ;; cargo package requires all dependencies to have versions.
-              ;; cargo package requires all dependencies to have versions.
-              ;; Add version = "0.120.0" to internal path dependencies.
+              ;; Add version = "0.124.0" to internal path dependencies.
               (let ((cargo-files (find-files "." "^Cargo\\.toml$")))
                 (substitute* cargo-files
                   ;; Handle inline deps: name = { path = "..." }
                   (("(codex-[a-z0-9-]+) = \\{ path = " all name)
-                   (string-append name " = { version = \"0.120.0\", path = "))
+                   (string-append name " = { version = \"0.124.0\", path = "))
                   ;; Handle inline deps with package: name = { package = "...", path = "..." }
                   (("(codex-[a-z0-9-]+) = \\{ package = " all name)
-                   (string-append name " = { version = \"0.120.0\", package = "))
+                   (string-append name " = { version = \"0.124.0\", package = "))
                   ;; Handle section deps: [dependencies.X] with path = "..."
                   (("^(path = \"\\.\\./[^\"]*\")" all path-line)
-                   (string-append path-line "\nversion = \"0.120.0\""))))))
+                   (string-append path-line "\nversion = \"0.124.0\""))))))
+          (add-after 'chdir-to-workspace 'use-gnu-store-in-sandbox
+            (lambda _
+              ;; LINUX_PLATFORM_DEFAULT_READ_ROOTS in linux-sandbox/src/
+              ;; bwrap.rs is the read-only baseline that codex's bwrap
+              ;; sandbox bind-mounts so commands can read /usr/bin/ls,
+              ;; libc, etc.  Upstream lists "/nix/store" for NixOS;
+              ;; Guix's equivalent is "/gnu/store".  Without this swap,
+              ;; the codex sandbox cannot locate any binaries on a Guix
+              ;; system because every "system" path resolves into
+              ;; /gnu/store/<hash>-pkg/bin/...
+              (substitute* "linux-sandbox/src/bwrap.rs"
+                (("\"/nix/store\"") "\"/gnu/store\""))))
           (add-after 'chdir-to-workspace 'patch-hardcoded-paths
             (lambda* (#:key inputs #:allow-other-keys)
               (let ((bash-bin (string-append
@@ -561,10 +755,12 @@
                 ;; double quotes.
                 (substitute*
                   (list "core/src/plugins/startup_sync_tests.rs"
+                        "core/src/tools/runtimes/shell/unix_escalation_tests.rs"
                         "core/tests/suite/client.rs"
                         "core/tests/suite/js_repl.rs"
                         "core/tests/suite/skill_approval.rs"
                         "core/tests/suite/user_notification.rs"
+                        "exec-server/tests/file_system.rs"
                         "login/src/auth/auth_tests.rs"
                         "models-manager/src/manager_tests.rs"
                         "sandboxing/src/bwrap_tests.rs")
@@ -613,7 +809,17 @@
               ;; ~/... and 30 snapshot tests fail.
               (setenv "HOME" "/tmp/guix-home")
               (mkdir-p "/tmp/guix-home")
-              (setenv "USER" "nixbld"))))))
+              (setenv "USER" "nixbld")
+              ;; Default libtest thread stack is 2 MiB, which is not
+              ;; enough for tokio current_thread tests that drive
+              ;; codex-core's full turn pipeline.  Upstream gates such
+              ;; tests through run_current_thread_test_with_stack (4 MiB)
+              ;; in app-server/src/message_processor/tracing_tests.rs;
+              ;; raise the global default so future additions that
+              ;; forget the wrapper still pass.
+              (setenv "RUST_MIN_STACK" "8388608")
+              ;; Disable network access.
+              (setenv "CODEX_SANDBOX_NETWORK_DISABLED" "1"))))))
     (native-inputs `(("bubblewrap" ,bubblewrap) ;tests need bwrap on PATH
                      ("clang" ,clang)
                      ("cmake-minimal" ,cmake-minimal)

gnu/packages/django.scm

@@ -201,13 +201,13 @@ your project into different processes.")
 (define-public python-django
   (package
     (name "python-django")
-    (version "5.2.11")
+    (version "5.2.13")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "django" version))
        (sha256
-        (base32 "1lq2dynfw6jmvzrzgfrlij2qnxcksaxgnrfr0pj3bvmrv0m2jbbz"))))
+        (base32 "1i1vlffzhwbzp6r6y8ycvwklc45diy4c6i897z379l48a7dqj5d3"))))
     (build-system pyproject-build-system)
     (arguments
      '(#:test-flags

gnu/packages/duckdb.scm

@@ -148,13 +148,13 @@ system.")
 (define-public r-duckdb
   (package
     (name "r-duckdb")
-    (version "1.5.1")
+    (version "1.5.2")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "duckdb" version))
        (sha256
-        (base32 "177621m08whqqk4yhj3zrr08l3d9hhlqh3gm9jzhi5cplg47cksq"))
+        (base32 "1dldlfwvc33czvlxfmwaj4p9y6sjjj5iqy98yda47a8kclrqmyam"))
        ;; This package bundles the duckdb sources and builds a custom variant
        ;; of duckdb.  I'd be happy to link it with our duckdb library instead,
        ;; but it does not seem possible to do that.

gnu/packages/electronics.scm

@@ -2331,7 +2331,7 @@ Automation}, portable and vendor neutral FPGA place and route tool.")
 (define-public nvc
   (package
     (name "nvc")
-    (version "1.19.3")
+    (version "1.20.1")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -2340,7 +2340,7 @@ Automation}, portable and vendor neutral FPGA place and route tool.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "1zizz2dafm53lzpjayy6vig5pz5ri9cszdivg0jzzh8s3ggkpy1i"))))
+                "1b38x2ch468s4p6mrq6c8s0d95vb84p6w4v8in79l4w7sfy8jnr0"))))
     (build-system gnu-build-system)
     (arguments
      (list #:out-of-source? #t
@@ -3461,7 +3461,7 @@ form of AXI, AXI lite, and AXI stream modules.")
 (define-public python-edalize
   (package
     (name "python-edalize")
-    (version "0.6.6")
+    (version "0.6.8")
     (source
      (origin
        (method git-fetch)
@@ -3470,7 +3470,7 @@ form of AXI, AXI lite, and AXI stream modules.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "115nc15n2cx4x9irjim07zkg0287418djqd6ja7rm8jrnyldvln9"))))
+        (base32 "04m2lhkclw9fj92k43c06j003qnq9i1yhy2131fvcnkkr0d9438m"))))
     (build-system pyproject-build-system)
     (arguments
      (list
@@ -4516,7 +4516,7 @@ unique design feature of Trilinos is its focus on packages.")
 (define-public verilator
   (package
     (name "verilator")
-    (version "5.046")
+    (version "5.048")
     (source
      (origin
        (method git-fetch)
@@ -4525,7 +4525,7 @@ unique design feature of Trilinos is its focus on packages.")
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1gr1qhxvl4856hnmnx46dqd2qp0jhdh959zm2qfmxzzh19np7xkm"))))
+        (base32 "16c1x66kqmc5ldqjij81kypj471fibfihcqn6kz4wbxvnn0smyn6"))))
     (native-inputs
      (list autoconf
            automake

gnu/packages/freedesktop.scm

@@ -3417,50 +3417,50 @@ interfaces.")
 (define-public xdg-desktop-portal-wlr
   (package
     (name "xdg-desktop-portal-wlr")
-    (version "0.7.1")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/emersion/xdg-desktop-portal-wlr")
-                     (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "1mbq3czka9swwmfaasnaj89y2m254p3qa522ayclh688jdwh70hq"))
-              (patches (search-patches "xdg-desktop-portal-wlr-harcoded-length.patch"))))
+    (version "0.8.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/emersion/xdg-desktop-portal-wlr")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1jj0a9s3h3i04qsxkhcpxjzbb17hs9ngdy7wkypja09233zdz10w"))
+       (patches (search-patches "xdg-desktop-portal-wlr-harcoded-length.patch"))))
     (build-system meson-build-system)
     (arguments
-     `(#:configure-flags
-       '("-Dsystemd=disabled"
-         "-Dsd-bus-provider=libelogind")
-       #:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'hardcode-binaries
-           (lambda* (#:key inputs #:allow-other-keys)
-             (let ((sh (search-input-file inputs "/bin/sh"))
-                   (grim (search-input-file inputs "/bin/grim"))
-                   (slurp (search-input-file inputs "/bin/slurp")))
-               (substitute* "src/screenshot/screenshot.c"
-                 (("grim") grim)
-                 (("slurp") slurp)
-                 (("execl\\(\"/bin/sh\", \"/bin/sh\"")
-                  (string-append "execl(\"" sh "\", \"" sh "\"")))
-               (substitute* "src/screencast/screencast.c"
-                 (("execvp\\(\"sh")
-                  (string-append "execvp(\"" sh))))))
-         (add-after 'install 'install-documentation
-           (lambda* (#:key outputs #:allow-other-keys)
-             (install-file "../source/README.md"
-                           (string-append (assoc-ref outputs "out")
-                                          "/share/doc/" ,name)))))))
-    (native-inputs
-     (list cmake-minimal pkg-config scdoc))
-    (inputs (list elogind
-                  bash-minimal
+     (list
+      #:configure-flags
+      #~(list "-Dsystemd=disabled"
+              "-Dsd-bus-provider=libelogind")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'hardcode-binaries
+            (lambda* (#:key inputs #:allow-other-keys)
+              (let ((sh (search-input-file inputs "/bin/sh"))
+                    (grim (search-input-file inputs "/bin/grim"))
+                    (slurp (search-input-file inputs "/bin/slurp")))
+                (substitute* '("src/screencast/chooser.c"
+                               "src/screenshot/screenshot.c")
+                  (("grim") grim)
+                  (("slurp") slurp)
+                  (("/bin/sh") sh))
+                (substitute* "src/screencast/screencast.c"
+                  (("execvp\\(\"sh")
+                   (format #f "execvp(\"~a" sh))))))
+          (add-after 'install 'install-documentation
+            (lambda _
+              (install-file "../source/README.md"
+                            (string-append #$output "/share/doc/"
+                                           #$name)))))))
+    (native-inputs (list cmake-minimal pkg-config scdoc))
+    (inputs (list bash-minimal
+                  elogind
                   grim
                   iniparser
-                  mesa
                   libinih
+                  mesa
                   pipewire
                   slurp
                   wayland

gnu/packages/geo.scm

@@ -425,14 +425,29 @@ hierarchical hexagonal geospatial indexing system")
                (base32
                 "00qdk9a4048pzfj2rhzkfw3lvm642znf6kr4x29i3d94494pxsnn"))))
     (build-system cmake-build-system)
-    (arguments `(#:phases
-                 (modify-phases %standard-phases
-                   (add-after
-                    'unpack 'patch-test-shebangs
-                    (lambda _
-                      (substitute* '("tests/xmltester/testrunner.sh"
-                                     "tests/xmltester/safe_to_xml.sh")
-                        (("/bin/sh") (which "sh"))))))))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         ,@(if (or (target-x86-32?) (target-arm32?))
+               '((add-after 'unpack 'disable-broken-tests
+                   (lambda _
+                     ;; This test fails due to limited accuracy.
+                     (delete-file "tests/xmltester/tests/general/TestCentroid.xml")
+                     (with-directory-excursion "tests/unit"
+                       ;; These also fail due to limited accuracy.
+                       (delete-file "algorithm/MinimumAreaRectangleTest.cpp")
+                       (delete-file "capi/GEOSMinimumRotatedRectangleTest.cpp")
+                       ;; It is unclear why these fail, but I'm guessing:
+                       ;; limited accuracy.
+                       (delete-file "linearref/LengthIndexedLineTest.cpp")
+                       (delete-file "math/DDTest.cpp")))))
+               '())
+         (add-after
+             'unpack 'patch-test-shebangs
+           (lambda _
+             (substitute* '("tests/xmltester/testrunner.sh"
+                            "tests/xmltester/safe_to_xml.sh")
+               (("/bin/sh") (which "sh"))))))))
     (inputs
      (list glib))
     (home-page "https://libgeos.org/")
@@ -955,6 +970,29 @@ hydrology and waste deposition.")
         (base32
          "03r6mspfv22fs4x4jcgv25v9gsj5k6zy8incvyf94qf50g47s2bc"))))
     (build-system cmake-build-system)
+    (arguments
+     (if (target-32bit?)
+         (list
+          #:phases
+          '(modify-phases %standard-phases
+             (add-after 'unpack 'patch-tests
+               (lambda _
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/unit/test_factory.cpp"
+                   (("^TEST\\(factory, AuthorityFactory_createUnitOfMeasure_linear_us_survey_foot\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_grids.cpp"
+                   (("^TEST_F\\(GridTest, VerticalShiftGridSet_gtx\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_defmodel.cpp"
+                   (("^TEST\\(defmodel, evaluator_horizontal_unit_metre\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/CMakeLists.txt"
+                   (("proj_add_gie_test\\(\"4D-API-cs2cs-style\".+") "")
+                   (("proj_add_gie_test\\(\"Builtins\".+") "")
+                   (("proj_add_gie_test\\(\"peirce_q\".+") ""))))))
+         '()))
     (native-inputs (list googletest pkg-config))
     (propagated-inputs (list curl libtiff sqlite)) ;required by proj.pc
     (home-page "https://proj.org/")
@@ -984,7 +1022,34 @@ lets developers use the functionality of Proj in their own software.")
                            version ".tar.gz"))
        (sha256
         (base32
-         "1g0hkpiablvhsmw0kn5frwgdir3q7avc45p6lc1zhhhzkv5ikydh"))))))
+         "1g0hkpiablvhsmw0kn5frwgdir3q7avc45p6lc1zhhhzkv5ikydh"))))
+    (arguments
+     (if (target-32bit?)
+         (list
+          #:phases
+          '(modify-phases %standard-phases
+             (add-after 'unpack 'patch-tests
+               (lambda _
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/unit/test_factory.cpp"
+                   (("^TEST\\(factory, AuthorityFactory_createUnitOfMeasure_linear_us_survey_foot\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_grids.cpp"
+                   (("^TEST_F\\(GridTest, VerticalShiftGridSet_gtx\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 (substitute* "test/unit/test_defmodel.cpp"
+                   (("^TEST\\(defmodel, evaluator_horizontal_unit_metre\\) \\{" m)
+                    (string-append m "\nGTEST_SKIP();\n")))
+                 ;; These regression tests fail due to accuracy problems.
+                 (substitute* "test/CMakeLists.txt"
+                   (("proj_add_gie_test\\(\"4D-API-cs2cs-style\".+") "")
+                   (("proj_add_gie_test\\(\"Builtins\".+") "")
+                   (("proj_add_gie_test\\(\"peirce_q\".+") "")
+                   (("proj_add_gie_test\\(\"adams_ws2\".+") ""))
+                 (substitute* "test/cli/CMakeLists.txt"
+                   (("proj_add_test_script_sh\\(\"testvarious\" CS2CS_BIN\\)") ""))))))
+         '()))))
+
 
 (define-public python-obspy
   (package

gnu/packages/golang-check.scm

@@ -245,6 +245,55 @@ go-fuzz-headers.")
 @end itemize")
     (license license:expat)))
 
+(define-public go-github-com-alexkohler-prealloc
+  (package
+    (name "go-github-com-alexkohler-prealloc")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/alexkohler/prealloc")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "011i8yqzyjgwj17k44xvvg4bxfv8z20s0416r2d3yf4s3wqqygpq"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/alexkohler/prealloc"))
+    (home-page "https://github.com/alexkohler/prealloc")
+    (synopsis "Find slice declarations that could be preallocated")
+    (description
+     "This package is a Go static analysis tool to find slice declarations
+that could potentially be preallocated.")
+    (license license:expat)))
+
+(define-public go-github-com-alingse-asasalint
+  (package
+    (name "go-github-com-alingse-asasalint")
+    (version "0.0.11")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/alingse/asasalint")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1avz33cx3gcpps26rxijv7ic0njfmsdkbcp2mqg5yxhdcpq57s0q"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/alingse/asasalint"))
+    (propagated-inputs
+     (list go-golang-org-x-tools))
+    (home-page "https://github.com/alingse/asasalint")
+    (synopsis "Lint pass any slice as any in variadic function")
+    (description
+     "Golang linter, lint that pass any slice as any in variadic function.")
+    (license license:expat)))
+
 (define-public go-github-com-andreyvit-diff
   (package
     (name "go-github-com-andreyvit-diff")

gnu/packages/golang-crypto.scm

@@ -1600,7 +1600,7 @@ RSA, RSA-PSS, and ECDSA, though hooks are present for adding your own.")
 (define-public go-github-com-google-go-tpm
   (package
     (name "go-github-com-google-go-tpm")
-    (version "0.9.1")
+    (version "0.9.4")
     (source
      (origin
        (method git-fetch)
@@ -1609,7 +1609,7 @@ RSA, RSA-PSS, and ECDSA, though hooks are present for adding your own.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1c5j5cvwl45ka93nknmv454ivd7kp9n8yql19gr6z01z0s1ph7sg"))))
+        (base32 "1sp1mbr6vz36zy9w36iksirbsj5p2jslsl8zs1cdj8s4ig4lkd9d"))))
     (build-system go-build-system)
     (arguments
      (list

gnu/packages/golang-maths.scm

@@ -456,6 +456,29 @@ penalization.")
 FFT (Schonhage-Strassen method for multiplying integers).")
     (license license:bsd-3)))
 
+(define-public go-github-com-robinus2-golang-moving-average
+  (package
+    (name "go-github-com-robinus2-golang-moving-average")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/RobinUS2/golang-moving-average")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "02z3ad29653fz7whxkjjpq820ig9j8m68xj4kay14jyazkr5in1f"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/RobinUS2/golang-moving-average"))
+    (home-page "https://github.com/RobinUS2/golang-moving-average")
+    (synopsis "Moving average implementation for Go")
+    (description
+     "This package provides a moving average implementation for Go.")
+    (license license:asl2.0)))
+
 (define-public go-github-com-shopspring-decimal
   (package
     (name "go-github-com-shopspring-decimal")

gnu/packages/golang-web.scm

@@ -386,19 +386,25 @@ devices.")
             ;; - cloud.google.com/go/compute/metadata
             ;; - cloud.google.com/go/iam
             ;; - cloud.google.com/go/kms
+            ;; - cloud.google.com/go/logging
             ;; - cloud.google.com/go/longrunning
             ;; - cloud.google.com/go/monitoring
             ;; - cloud.google.com/go/security
+            ;; - cloud.google.com/go/spanner
             ;; - cloud.google.com/go/storage
+            ;; - cloud.google.com/go/trace
             (for-each delete-file-recursively
                       (list "auth"
                             "compute/metadata"
                             "iam"
                             "kms"
+                            "logging"
                             "longrunning"
                             "monitoring"
                             "security"
-                            "storage"))))))
+                            "spanner"
+                            "storage"
+                            "trace"))))))
     (build-system go-build-system)
     (arguments
      (list
@@ -440,7 +446,6 @@ devices.")
               "pubsub/v2/internal/scheduler"
               "pubsub/v2/internal/testutil"
               "rpcreplay"
-              "spanner/spansql"
               "translate")))
     (propagated-inputs
      (list ;; go-cloud-google-com-go-storage
@@ -695,6 +700,65 @@ Service (KMS) API.")
 see: @url{https://cloud.google.com/iam, IAM specification} for more details.")
     (license license:asl2.0)))
 
+(define-public go-cloud-google-com-go-logging
+  (package
+    (name "go-cloud-google-com-go-logging")
+    (version "1.16.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/googleapis/google-cloud-go")
+              (commit (go-version->git-ref version #:subdir "logging"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "14khzbcymknsz4p40ibc8v1zsy33b33yn7fcvkfp4rkzw69wv356"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet
+        #~(begin
+            (define (delete-all-but directory . preserve)
+              (with-directory-excursion directory
+                (let* ((pred (negate (cut member <>
+                                          (cons* "." ".." preserve))))
+                       (items (scandir "." pred)))
+                  (for-each (cut delete-file-recursively <>) items))))
+            (delete-all-but "." "logging")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "cloud.google.com/go/logging"
+      #:unpack-path "cloud.google.com/go"))
+    (native-inputs
+     ;; XXX: Remove when cycle is fixed.
+     (list go-github-com-envoyproxy-go-control-plane))
+    (propagated-inputs
+     (list go-cloud-google-com-go
+           go-cloud-google-com-go-compute-metadata
+           go-cloud-google-com-go-iam
+           go-cloud-google-com-go-longrunning
+           go-cloud-google-com-go-storage
+           go-github-com-google-go-cmp
+           go-github-com-googleapis-gax-go-v2
+           go-go-opencensus-io
+           go-go-opentelemetry-io-otel-sdk
+           go-go-opentelemetry-io-otel-trace
+           go-golang-org-x-oauth2
+           go-google-golang-org-api
+           go-google-golang-org-genproto
+           go-google-golang-org-genproto-googleapis-api
+           go-google-golang-org-genproto-googleapis-rpc
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf))
+    (home-page "https://cloud.google.com/go")
+    (synopsis "Cloud Logging API")
+    (description
+     "Package logging contains a Cloud Logging client suitable for writing
+logs.  For reading logs, and working with sinks, metrics and monitored
+resources, see package cloud.google.com/go/logging/logadmin.")
+    (license license:asl2.0)))
+
 (define-public go-cloud-google-com-go-longrunning
   (package
     (name "go-cloud-google-com-go-longrunning")
@@ -832,6 +896,78 @@ its service definition.")
      "This package provides a Go Client Library for Certificate Authority API.")
     (license license:asl2.0)))
 
+(define-public go-cloud-google-com-go-spanner
+  (package
+    (name "go-cloud-google-com-go-spanner")
+    (version "1.91.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/googleapis/google-cloud-go")
+              (commit (go-version->git-ref version #:subdir "spanner"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "05jgalbqb9n1whlpdkj40rvyk8lg39q5w4l463ycsj2301pmr90h"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet
+        #~(begin
+            (define (delete-all-but directory . preserve)
+              (with-directory-excursion directory
+                (let* ((pred (negate (cut member <>
+                                          (cons* "." ".." preserve))))
+                       (items (scandir "." pred)))
+                  (for-each (cut delete-file-recursively <>) items))))
+            (delete-all-but "." "spanner")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "cloud.google.com/go/spanner"
+      #:unpack-path "cloud.google.com/go"
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'remove-benchmarks
+            (lambda* (#:key import-path #:allow-other-keys)
+              (with-directory-excursion (string-append "src/" import-path)
+                (delete-file-recursively "benchmarks")))))))
+    (native-inputs
+     (list go-github-com-google-go-cmp
+           ;; XXX: Remove when cycle is fixed.
+           go-github-com-envoyproxy-go-control-plane))
+    (propagated-inputs
+     (list go-cloud-google-com-go
+           go-cloud-google-com-go-iam
+           go-cloud-google-com-go-longrunning
+           go-cloud-google-com-go-monitoring
+           go-github-com-google-uuid
+           go-github-com-googleapis-gax-go-v2
+           go-github-com-googlecloudplatform-grpc-gcp-go-grpcgcp
+           go-go-opencensus-io
+           go-go-opentelemetry-io-contrib-detectors-gcp
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-metric
+           go-go-opentelemetry-io-otel-sdk
+           go-go-opentelemetry-io-otel-sdk-metric
+           go-go-opentelemetry-io-otel-trace
+           go-golang-org-x-oauth2
+           go-golang-org-x-sync
+           go-google-golang-org-api
+           go-google-golang-org-genproto
+           go-google-golang-org-genproto-googleapis-api
+           go-google-golang-org-genproto-googleapis-rpc
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf))
+    (home-page "https://cloud.google.com/go")
+    (synopsis "Cloud Spanner databases Go client")
+    (description
+     "Package spanner provides a client for reading and writing to Cloud
+Spanner databases.  See
+@url{https://cloud.google.com/spanner/docs/getting-started/go/} for an
+introduction to Cloud Spanner and additional help on using this API.")
+    (license license:asl2.0)))
+
 (define-public go-cloud-google-com-go-storage
   (package
     (name "go-cloud-google-com-go-storage")
@@ -897,6 +1033,59 @@ Google Cloud Storage stores data in named objects, which are grouped into
 buckets.")
     (license license:asl2.0)))
 
+(define-public go-cloud-google-com-go-trace
+  (package
+    (name "go-cloud-google-com-go-trace")
+    (version "1.14.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/googleapis/google-cloud-go")
+              (commit (go-version->git-ref version #:subdir "trace"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "14khzbcymknsz4p40ibc8v1zsy33b33yn7fcvkfp4rkzw69wv356"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet
+        #~(begin
+            (define (delete-all-but directory . preserve)
+              (with-directory-excursion directory
+                (let* ((pred (negate (cut member <>
+                                          (cons* "." ".." preserve))))
+                       (items (scandir "." pred)))
+                  (for-each (cut delete-file-recursively <>) items))))
+            (delete-all-but "." "trace")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:import-path "cloud.google.com/go/trace"
+      #:unpack-path "cloud.google.com/go"))
+    (propagated-inputs
+     (list go-github-com-googleapis-gax-go-v2
+           go-google-golang-org-api
+           go-google-golang-org-genproto
+           go-google-golang-org-genproto-googleapis-api
+           go-google-golang-org-genproto-googleapis-rpc
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf))
+    (home-page "https://cloud.google.com/go")
+    (synopsis "Go Client Library for Cloud Trace API")
+    (description
+     "This package implements the @url{https://cloud.google.com/stackdriver,
+Stackdriver} Trace API in Golang.  Stackdriver Trace is a distributed tracing
+system that collects latency data from your applications and displays it in
+the Google Cloud Platform Console.
+
+It sends application trace data to Stackdriver Trace for viewing.  Trace data
+is collected for all App Engine applications by default.  Trace data from
+other applications can be provided using this API.  This library is used to
+interact with the Trace API directly.")
+    (license license:asl2.0)))
+
 (define-public go-code-gitea-io-sdk-gitea
   (package
     (name "go-code-gitea-io-sdk-gitea")
@@ -1406,6 +1595,39 @@ AWS Lambda and API Gateway or ALB without changing the existing HTTP
 handlers.")
     (license license:asl2.0)))
 
+(define-public go-github-com-akutz-memconn
+  (package
+    (name "go-github-com-akutz-memconn")
+    (version "0.1.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/akutz/memconn")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1mhghzcx2zxr4bpyf4wx3j7ph9srw38wxg78svwbjh930r2kzssq"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/akutz/memconn"
+      #:test-flags
+      #~(list "-skip" (string-join
+                       ;; Tests fail with insecure algorithm
+                       (list "TestTLS_Memu"
+                             "TestTLS_Memb"
+                             "TestTLS_TCP"
+                             "TestTLS_UNIX"
+                             "TestTLS_HTTP_Memu"
+                             "TestTLS_HTTP_Memb")
+                       "|"))))
+    (home-page "https://github.com/akutz/memconn")
+    (synopsis "In-memory network stack for Go")
+    (description
+     "This package provides named, in-memory network connections for Go.")
+    (license license:asl2.0)))
+
 (define-public go-github-com-alexliesenfeld-health
   (package
     (name "go-github-com-alexliesenfeld-health")
@@ -3595,6 +3817,33 @@ differentiate between installs of Mozilla software in @code{installs.ini} and
                              "TestStructToDateTime")
                        "|"))))))
 
+(define-public go-github-com-brunoscheufler-aws-ecs-metadata-go
+  (package
+    (name "go-github-com-brunoscheufler-aws-ecs-metadata-go")
+    (version "0.0.0-20221221133751-67e37ae746cd")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/BrunoScheufler/aws-ecs-metadata-go")
+              (commit (go-version->git-ref version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1x9kn49sl6793zqq4nrbsyfhqh7i3xr25syck2ybpcqkd3mmb8k6"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/brunoscheufler/aws-ecs-metadata-go"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (home-page "https://github.com/brunoscheufler/aws-ecs-metadata-go")
+    (synopsis "Retrieve AWS ECS Task metadata")
+    (description
+     "This package provides a minimal wrapper library to fetch
+@acronym{Elastic Container Service, ECS} Task metadata from any Go service
+running in container provisioned by AWS Fargate.")
+    (license license:expat)))
+
 (define-public go-github-com-buger-jsonparser
   (package
     (name "go-github-com-buger-jsonparser")
@@ -6166,7 +6415,7 @@ application's http.Handlers.")
 (define-public go-github-com-files-com-files-sdk-go-v3
   (package
     (name "go-github-com-files-com-files-sdk-go-v3")
-    (version "3.3.7")
+    (version "3.3.95")
     (source
      (origin
        (method git-fetch)
@@ -6175,7 +6424,7 @@ application's http.Handlers.")
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1syx75vbamwrx5x5glf4542ml8myj9kqqkig8hmy97lhzq4d4n7a"))))
+        (base32 "19mxsybv9lyq57nf5xvll41g7f6z90lq9hrdx1p4w20mj0f51wyj"))))
     (build-system go-build-system)
     (arguments
      (list
@@ -6191,7 +6440,6 @@ application's http.Handlers.")
            go-github-com-stretchr-testify))
     (propagated-inputs
      (list go-github-com-appscode-go-querystring
-           go-github-com-bradfitz-iter
            go-github-com-chilts-sid
            go-github-com-dustin-go-humanize
            go-github-com-hashicorp-go-retryablehttp
@@ -6201,6 +6449,7 @@ application's http.Handlers.")
            go-github-com-sabhiram-go-gitignore
            go-github-com-samber-lo
            go-github-com-winfsp-cgofuse
+           go-golang-org-x-sync
            go-golang-org-x-sys
            go-golang-org-x-text
            go-moul-io-http2curl-v2))
@@ -8245,6 +8494,51 @@ Terraform by using the enterprise certificates feature.")
 for clients and servers based on @code{gRPC} and Google API conventions.")
     (license license:bsd-3)))
 
+(define-public go-github-com-googlecloudplatform-grpc-gcp-go-grpcgcp
+  (package
+    (name "go-github-com-googlecloudplatform-grpc-gcp-go-grpcgcp")
+    (version "1.6.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/GoogleCloudPlatform/grpc-gcp-go")
+              (commit (go-version->git-ref version #:subdir "grpcgcp"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0p7zwbi6gg99mzi7albscf7jn63qxs714h6vars735an13bbvl12"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:go go-1.25
+      #:import-path "github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp"
+      #:unpack-path "github.com/GoogleCloudPlatform/grpc-gcp-go"
+      ;; gcp_multiendpoint_test.go:441: endpoint wanted "localhost:50051", got
+      ;; "127.0.0.3:50051"
+      #:test-flags #~(list "-skip" "TestGCPMultiEndpoint")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'pre-check
+            (lambda _
+              ;; See: <https://go.dev/blog/synctest>.
+              (setenv "GOEXPERIMENT" "synctest")
+              (setenv "GODEBUG" "asynctimerchan=0"))))))
+    (native-inputs
+     (list go-github-com-golang-mock
+           go-github-com-google-go-cmp))
+    (propagated-inputs
+     (list go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-metric
+           go-go-opentelemetry-io-otel-sdk-metric
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf))
+    (home-page "https://github.com/GoogleCloudPlatform/grpc-gcp-go")
+    (synopsis "Grpc supports for Google Cloud APIs")
+    (description
+     "Package grpcgcp provides gRPC supports for Google Cloud APIs.  For now
+it provides connection management with affinity support.")
+    (license license:asl2.0)))
+
 (define-public go-github-com-googlecloudplatform-opentelemetry-operations-go-detectors-gcp
   (package
     (name
@@ -8334,6 +8628,110 @@ testing of the detection functions in real GCP environments.")
 send collected metrics to Google Cloud.")
     (license license:asl2.0)))
 
+(define-public go-github-com-googlecloudplatform-opentelemetry-operations-go-exporter-trace
+  (package
+    (name "go-github-com-googlecloudplatform-opentelemetry-operations-go-exporter-trace")
+    (version "1.32.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/GoogleCloudPlatform/opentelemetry-operations-go")
+              (commit (go-version->git-ref version #:subdir "exporter/trace"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0nizaaydcvvi718g5v4pgx8in6d546mmkrf7h3sxhz2yyyygvms3"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet
+        #~(begin
+            (define (delete-all-but directory . preserve)
+              (with-directory-excursion directory
+                (let* ((pred (negate (cut member <>
+                                          (cons* "." ".." preserve))))
+                       (items (scandir "." pred)))
+                  (for-each (cut delete-file-recursively <>) items))))
+            (delete-all-but "exporter" "trace")
+            (delete-all-but "." "exporter")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path
+      (string-append "github.com/GoogleCloudPlatform/"
+                     "opentelemetry-operations-go/exporter/trace")
+      #:unpack-path
+      "github.com/GoogleCloudPlatform/opentelemetry-operations-go"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (propagated-inputs
+     (list go-cloud-google-com-go-trace
+           go-github-com-googlecloudplatform-opentelemetry-operations-go-internal-cloudmock
+           go-github-com-googlecloudplatform-opentelemetry-operations-go-internal-resourcemapping
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-sdk
+           go-go-opentelemetry-io-otel-trace
+           go-golang-org-x-oauth2
+           go-google-golang-org-api
+           go-google-golang-org-genproto-googleapis-rpc
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf))
+    (home-page "https://github.com/GoogleCloudPlatform/opentelemetry-operations-go")
+    (synopsis "OpenTelemetry Google Cloud Trace Exporter")
+    (description
+     "@code{OpenTelemetry} Google Cloud Trace Exporter allows the user to send
+collected traces and spans to Google Cloud.")
+    (license license:asl2.0)))
+
+(define-public go-github-com-googlecloudplatform-opentelemetry-operations-go-internal-cloudmock
+  (package
+    (name "go-github-com-googlecloudplatform-opentelemetry-operations-go-internal-cloudmock")
+    (version "0.56.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/GoogleCloudPlatform/opentelemetry-operations-go")
+              (commit (go-version->git-ref version
+                                           #:subdir "internal/cloudmock"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0nizaaydcvvi718g5v4pgx8in6d546mmkrf7h3sxhz2yyyygvms3"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet
+        #~(begin
+            (define (delete-all-but directory . preserve)
+              (with-directory-excursion directory
+                (let* ((pred (negate (cut member <>
+                                          (cons* "." ".." preserve))))
+                       (items (scandir "." pred)))
+                  (for-each (cut delete-file-recursively <>) items))))
+            (delete-all-but "internal" "cloudmock")
+            (delete-all-but "." "internal")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path
+      (string-append "github.com/GoogleCloudPlatform/"
+                     "opentelemetry-operations-go/internal/cloudmock")
+      #:unpack-path
+      "github.com/GoogleCloudPlatform/opentelemetry-operations-go"))
+    (propagated-inputs
+     (list go-cloud-google-com-go-logging
+           go-cloud-google-com-go-monitoring
+           go-cloud-google-com-go-trace
+           go-google-golang-org-genproto-googleapis-api
+           go-google-golang-org-grpc
+           go-google-golang-org-protobuf))
+    (home-page "https://github.com/GoogleCloudPlatform/opentelemetry-operations-go")
+    (synopsis "OpenTelemetry Google Cloud mock library")
+    ;; XXX: There is not any documentation for this package upstrream.
+    (description
+     "This package provides OpenTelemetry Google Cloud mock Go library.")
+    (license license:asl2.0)))
+
 (define-public go-github-com-googlecloudplatform-opentelemetry-operations-go-internal-resourcemapping
   (package
     (name "go-github-com-googlecloudplatform-opentelemetry-operations-go-internal-resourcemapping")
@@ -9803,6 +10201,55 @@ protocol) - used to discover UPnP services on a network
  by the IBM Cloud @code{OpenAPI} SDK Generator (openapi-sdkgen).")
     (license license:asl2.0)))
 
+(define-public go-github-com-ibm-sarama
+  (package
+    (name "go-github-com-ibm-sarama")
+    (version "1.48.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/IBM/sarama")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0ak07aqb9hznvhbnkw34vak30pzbwvh2aff22lww8gcba4c9qdn7"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/IBM/sarama"
+      #:unpack-path "github.com/IBM/sarama"
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'remove-examples
+            (lambda* (#:key tests? unpack-path #:allow-other-keys)
+              (with-directory-excursion (string-append "src/" unpack-path)
+                (delete-file-recursively "examples")))))))
+    (native-inputs
+     (list go-github-com-stretchr-testify
+           go-github-com-davecgh-go-spew
+           go-go-uber-org-goleak))
+    (propagated-inputs
+     (list go-github-com-eapache-go-resiliency
+           go-github-com-eapache-queue
+           go-github-com-jcmturner-gofork
+           go-github-com-jcmturner-gokrb5-v8
+           go-github-com-klauspost-compress
+           go-github-com-pierrec-lz4-v4
+           go-github-com-rcrowley-go-metrics
+           go-golang-org-x-net
+           go-golang-org-x-sync
+           go-golang-org-x-sys))
+    (home-page "https://github.com/IBM/sarama")
+    (synopsis "Go library for Apache Kafka")
+    (description
+     "Package sarama is a pure Go client library for dealing with Apache Kafka
+(versions 0.8 and later).  It includes a high-level API for easily producing
+and consuming messages, and a low-level API for controlling bytes on the wire
+when the high-level API is insufficient.  Usage examples for the high-level
+APIs are provided inline with their full documentation.")
+    (license license:expat)))
+
 (define-public go-github-com-igungor-gofakes3
   (package
     (name "go-github-com-igungor-gofakes3")
@@ -13629,24 +14076,24 @@ standard library.")
     (build-system go-build-system)
     (arguments
      (list
-      ;; TODO: Enable tests and build when all missing inputs are packages, use
-      ;; as source only package for Kubo.
-      #:skip-build? #t
-      #:tests? #f
-      #:import-path "github.com/openzipkin/zipkin-go"))
+      #:import-path "github.com/openzipkin/zipkin-go"
+      ;; span_test.go:56: expected valid endpoint, got error: host lookup
+      ;; failure: lookup www.google.com on [::1]:53: read udp
+      ;; [::1]:56302->[::1]:53: read: connection refused
+      #:test-flags #~(list "-skip" "TestRemoteEndpoint|TestHTTPClient")))
     (native-inputs
      (list go-github-com-onsi-ginkgo-v2
            go-github-com-onsi-gomega))
     (propagated-inputs
-     (list ;; go-github-com-ibm-sarama
-           ;; go-github-com-rabbitmq-amqp091-go
+     (list go-github-com-ibm-sarama
+           go-github-com-rabbitmq-amqp091-go
            go-google-golang-org-grpc
            go-google-golang-org-protobuf))
     (home-page "https://github.com/openzipkin/zipkin-go")
     (synopsis "Zipkin Library for Go")
     (description
      "Package zipkin implements a native Zipkin instrumentation library for
-Go.")
+Go.  @url{https://zipkin.io/, Zipkin} is a distributed tracing system.")
     (license license:asl2.0)))
 
 (define-public go-github-com-oracle-oci-go-sdk-v65
@@ -15574,6 +16021,38 @@ currently implements
 of the specification.")
       (license license:expat)))
 
+(define-public go-github-com-rabbitmq-amqp091-go
+  (package
+    (name "go-github-com-rabbitmq-amqp091-go")
+    (version "1.11.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/rabbitmq/amqp091-go")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1xn0ykx08l8gg66qk6jhz2md4as8n9fqm0smzcbislyqp4d3gpr8"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/rabbitmq/amqp091-go"
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'remove-examples
+            (lambda* (#:key tests? import-path #:allow-other-keys)
+              (with-directory-excursion (string-append "src/" import-path)
+                (delete-file-recursively "_examples")))))))
+    (native-inputs
+     (list go-go-uber-org-goleak))
+    (home-page "https://github.com/rabbitmq/amqp091-go")
+    (synopsis "Go RabbitMQ Client Library")
+    (description
+     "Package amqp091 is an @acronym{Advanced Message Queuing Protocol, AMQP}
+0.9.1 client with @code{RabbitMQ} extensions.")
+    (license license:bsd-2)))
+
 (define-public go-github-com-rasky-go-xdr
   (package
     (name "go-github-com-rasky-go-xdr")
@@ -16233,6 +16712,7 @@ and consumers to transparently record signed metadata to a ledger.")
       #:test-subdirs
       #~(list "internal/algorithmregistry"
               "internal/safeint"
+              "pkg/client/read"
               "pkg/client/write"
               "pkg/types/dsse"
               "pkg/types/hashedrekord"
@@ -16247,7 +16727,8 @@ and consumers to transparently record signed metadata to a ledger.")
            go-github-com-stretchr-testify
            go-sigs-k8s-io-release-utils))
     (propagated-inputs
-     (list go-cloud-google-com-go-storage
+     (list go-cloud-google-com-go-spanner
+           go-cloud-google-com-go-storage
            go-github-com-aws-aws-sdk-go-v2
            go-github-com-aws-aws-sdk-go-v2-config
            go-github-com-aws-aws-sdk-go-v2-credentials
@@ -16264,12 +16745,14 @@ and consumers to transparently record signed metadata to a ledger.")
            go-github-com-sigstore-sigstore
            ;; go-github-com-sigstore-sigstore-go                 ;cycles
            go-github-com-sigstore-sigstore-pkg-signature-kms-aws
+           go-github-com-chainguard-dev-clog
            go-github-com-sigstore-sigstore-pkg-signature-kms-gcp
            go-github-com-tink-crypto-tink-go-awskms-v2
            go-github-com-tink-crypto-tink-go-gcpkms-v2
            go-github-com-tink-crypto-tink-go-v2
            go-github-com-transparency-dev-formats
            go-github-com-transparency-dev-merkle
+           go-github-com-transparency-dev-tessera
            go-go-opentelemetry-io-otel
            go-go-opentelemetry-io-otel-exporters-prometheus
            go-go-opentelemetry-io-otel-sdk-metric
@@ -16283,9 +16766,6 @@ and consumers to transparently record signed metadata to a ledger.")
            go-k8s-io-klog-v2
 
            ;; TODO: Complete packaging.
-           ;; go-cloud-google-com-go-spanner
-           ;; go-github-com-chainguard-dev-clog
-           ;; go-github-com-transparency-dev-tessera
            #;go-go-step-sm-crypto))
     (home-page "https://github.com/sigstore/rekor-tiles")
     (synopsis "Tile-based transparency log for Sigstore")
@@ -17917,7 +18397,95 @@ caching protocol.  It provides support to programmatically store and retrieve
 build caches, instead of relying on the standard actions/cache YAML step.")
     (license license:expat)))
 
+(define-public go-github-com-transparency-dev-tessera
+  (package
+    (name "go-github-com-transparency-dev-tessera")
+    (version "1.0.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/transparency-dev/tessera")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "101y83j67g7r1bqk49qj8mwxgys88wkxz5lf7pvjp4c6b10w5gck"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/transparency-dev/tessera"
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'fix-access-to-state-tree-state
+            (lambda* (#:key import-path #:allow-other-keys)
+              (with-directory-excursion (string-append "src/" import-path)
+                (make-file-writable "testdata/log/.state/treeState.lock"))))
+          (add-after 'check 'remove-testdata
+            (lambda* (#:key import-path #:allow-other-keys)
+              (with-directory-excursion (string-append "src/" import-path)
+                (delete-file-recursively "testdata")))))))
+    (native-inputs
+     (list strace
+           ;; XXX: Remove when cycle is fixed.
+           go-github-com-envoyproxy-go-control-plane))
+    (propagated-inputs
+     (list go-cloud-google-com-go-spanner
+           go-cloud-google-com-go-storage
+           go-github-com-avast-retry-go-v4
+           go-github-com-aws-aws-sdk-go-v2
+           go-github-com-aws-aws-sdk-go-v2-config
+           go-github-com-aws-aws-sdk-go-v2-credentials
+           go-github-com-aws-aws-sdk-go-v2-service-s3
+           go-github-com-aws-smithy-go
+           go-github-com-bitfield-script
+           go-github-com-cenkalti-backoff-v5
+           go-github-com-charmbracelet-bubbletea
+           go-github-com-charmbracelet-lipgloss
+           go-github-com-dgraph-io-badger-v4
+           go-github-com-dustin-go-humanize
+           go-github-com-gdamore-tcell-v2
+           go-github-com-go-sql-driver-mysql
+           go-github-com-google-go-cmp
+           go-github-com-googlecloudplatform-opentelemetry-operations-go-exporter-metric
+           go-github-com-googlecloudplatform-opentelemetry-operations-go-exporter-trace
+           go-github-com-hashicorp-golang-lru-v2
+           go-github-com-muesli-termenv
+           go-github-com-rivo-tview
+           go-github-com-robinus2-golang-moving-average
+           go-github-com-transparency-dev-formats
+           go-github-com-transparency-dev-merkle
+           go-go-opentelemetry-io-contrib-detectors-aws-ec2-v2
+           go-go-opentelemetry-io-contrib-detectors-aws-ecs
+           go-go-opentelemetry-io-contrib-detectors-gcp
+           go-go-opentelemetry-io-contrib-propagators-aws
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-exporters-otlp-otlpmetric-otlpmetricgrpc
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracegrpc
+           go-go-opentelemetry-io-otel-metric
+           go-go-opentelemetry-io-otel-sdk
+           go-go-opentelemetry-io-otel-sdk-metric
+           go-golang-org-x-crypto
+           go-golang-org-x-exp
+           go-golang-org-x-mod
+           go-golang-org-x-net
+           go-golang-org-x-sync
+           go-golang-org-x-time
+           go-google-golang-org-api
+           go-google-golang-org-grpc
+           go-k8s-io-klog-v2))
+    (home-page "https://github.com/transparency-dev/tessera")
+    (synopsis "Go library for building tile-based transparency logs (tlogs)")
+    (description
+     "Tessera is a Go library for building tile-based transparency logs (tlogs).
+ It is the logical successor to the approach
+@url{https://github.com/google/trillian, Trillian v1} takes in building and
+operating logs.  The implementation and its APIs bake-in current
+best-practices based on the lessons learned over the past decade of building
+and operating transparency logs in production environments and at scale.")
+    (license license:asl2.0)))
+
 (define-public go-github-com-tv42-httpunix
+
   (let ((commit "2ba4b9c3382c77e7b9ea89d00746e6111d142a22")
         (revision "0"))
     (package
@@ -19686,6 +20254,101 @@ lists)
      "Package sdk provides an auto-instrumentable @code{OpenTelemetry} SDK.")
     (license license:asl2.0)))
 
+(define-public go-go-opentelemetry-io-contrib-detectors-aws-ec2-v2
+  (package
+    (name "go-go-opentelemetry-io-contrib-detectors-aws-ec2-v2")
+    (version "2.5.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/open-telemetry/opentelemetry-go-contrib")
+              (commit (go-version->git-ref version
+                                           #:subdir "detectors/aws/ec2"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0nh7g1zxr3drqcbhsnnkqaz2hn1rnawg8jalixng23c9hwfgqaly"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet
+        #~(begin
+            (define (delete-all-but directory . preserve)
+              (with-directory-excursion directory
+                (let* ((pred (negate (cut member <>
+                                          (cons* "." ".." preserve))))
+                       (items (scandir "." pred)))
+                  (for-each (cut delete-file-recursively <>) items))))
+            (delete-all-but "detectors/aws" "ec2")
+            (delete-all-but "detectors" "aws")
+            (delete-all-but "." "detectors")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "go.opentelemetry.io/contrib/detectors/aws/ec2/v2"
+      #:unpack-path "go.opentelemetry.io/contrib"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (propagated-inputs
+     (list go-github-com-aws-aws-sdk-go-v2
+           go-github-com-aws-aws-sdk-go-v2-config
+           go-github-com-aws-aws-sdk-go-v2-feature-ec2-imds
+           go-github-com-aws-smithy-go
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-sdk))
+    (home-page "https://github.com/open-telemetry/opentelemetry-go-contrib")
+    (synopsis "Resource detector for EC2 instances")
+    (description
+     "Package ec2 provides a resource detector for @acronym{Amazon Elastic
+Compute Cloud, EC2} instances using @code{aws-sdk-go-v2}.")
+    (license license:asl2.0)))
+
+(define-public go-go-opentelemetry-io-contrib-detectors-aws-ecs
+  (package
+    (name "go-go-opentelemetry-io-contrib-detectors-aws-ecs")
+    (version "1.43.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/open-telemetry/opentelemetry-go-contrib")
+              (commit (go-version->git-ref version
+                                           #:subdir "detectors/aws/ecs"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0nh7g1zxr3drqcbhsnnkqaz2hn1rnawg8jalixng23c9hwfgqaly"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet
+        #~(begin
+            (define (delete-all-but directory . preserve)
+              (with-directory-excursion directory
+                (let* ((pred (negate (cut member <>
+                                          (cons* "." ".." preserve))))
+                       (items (scandir "." pred)))
+                  (for-each (cut delete-file-recursively <>) items))))
+            (delete-all-but "detectors/aws" "ecs")
+            (delete-all-but "detectors" "aws")
+            (delete-all-but "." "detectors")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "go.opentelemetry.io/contrib/detectors/aws/ecs"
+      #:unpack-path "go.opentelemetry.io/contrib"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (propagated-inputs
+     (list go-github-com-brunoscheufler-aws-ecs-metadata-go
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-sdk))
+    (home-page "https://go.opentelemetry.io/contrib")
+    (synopsis "OTLP resource detector for AWS ECS instances")
+    (description
+     "Package ecs provides a resource detector for AWS @acronym{Elastic
+Container Service, ECS} instances.")
+    (license license:asl2.0)))
+
 (define-public go-go-opentelemetry-io-contrib-detectors-gcp
   (package
     (name "go-go-opentelemetry-io-contrib-detectors-gcp")
@@ -20289,7 +20952,7 @@ protobuf payloads.")
 (define-public go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracegrpc
   (package
     (name "go-go-opentelemetry-io-otel-exporters-otlp-otlptrace-otlptracegrpc")
-    (version "1.36.0")
+    (version "1.43.0")
     (source
      (origin
        (method git-fetch)
@@ -20299,15 +20962,12 @@ protobuf payloads.")
                                            #:subdir "exporters/otlp/otlptrace/otlptracegrpc"))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1kvfbqc56p1h9rh9cvgn37ya6k10613r0f2rhjiwrrkgs2mszk30"))
+        (base32 "0583dw99k25k07pnq8hhhb45kwqhsx30lbk9yxsh4m50ji65wl8h"))
        (modules '((guix build utils)
                   (ice-9 ftw)
                   (srfi srfi-26)))
        (snippet
         #~(begin
-            ;; XXX: 'delete-all-but' is copied from the turbovnc package.
-            ;; Consider implementing it as a reusable procedure in
-            ;; guix/build/utils or guix/build-system/go.
             (define (delete-all-but directory . preserve)
               (with-directory-excursion directory
                 (let* ((pred (negate (cut member <>
@@ -20315,23 +20975,27 @@ protobuf payloads.")
                        (items (scandir "." pred)))
                   (for-each (cut delete-file-recursively <>) items))))
             (delete-all-but "exporters/otlp/otlptrace" "otlptracegrpc")
+            (delete-all-but "exporters/otlp" "otlptrace")
             (delete-all-but "." "exporters")))))
     (build-system go-build-system)
     (arguments
      (list
-      ;; TODO: Enable when all missing inputs are available, use as source
-      ;; only package for Boxo.
-      #:skip-build? #t
-      #:tests? #f
       #:import-path
       "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
       #:unpack-path "go.opentelemetry.io/otel"))
     (native-inputs
-     (list go-github-com-stretchr-testify))
+     (list go-github-com-stretchr-testify
+           go-go-uber-org-goleak))
     (propagated-inputs
      (list go-github-com-cenkalti-backoff-v5
+           go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-exporters-otlp-otlptrace
+           go-go-opentelemetry-io-otel-metric
+           go-go-opentelemetry-io-otel-metric-x
+           go-go-opentelemetry-io-otel-sdk
+           go-go-opentelemetry-io-otel-sdk-metric
+           go-go-opentelemetry-io-otel-trace
            go-go-opentelemetry-io-proto-otlp
-           go-go-uber-org-goleak
            go-google-golang-org-genproto-googleapis-rpc
            go-google-golang-org-grpc
            go-google-golang-org-protobuf))
@@ -20646,6 +21310,50 @@ logging library.  Instead, install one of the bridges listed in the
      "Package metric provides an implementation of the metric part of the
 OpenTelemetry API.")))
 
+(define-public go-go-opentelemetry-io-otel-metric-x
+  (package
+    (name "go-go-opentelemetry-io-otel-metric-x")
+    (version "0.0.0-20260424084752-468c62dac625")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/open-telemetry/opentelemetry-go")
+              (commit (go-version->git-ref version #:subdir "metric/x"))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "16x0aw116dadi73vzh8bcwasy79sblvh6k1q7yfx8n841x48ry8r"))
+       (modules '((guix build utils)
+                  (ice-9 ftw)
+                  (srfi srfi-26)))
+       (snippet
+        #~(begin
+            (define (delete-all-but directory . preserve)
+              (with-directory-excursion directory
+                (let* ((pred (negate (cut member <>
+                                          (cons* "." ".." preserve))))
+                       (items (scandir "." pred)))
+                  (for-each (cut delete-file-recursively <>) items))))
+            (delete-all-but "metric" "x")
+            (delete-all-but "." "metric")))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "go.opentelemetry.io/otel/metric/x"
+      #:unpack-path "go.opentelemetry.io/otel"))
+    (propagated-inputs
+     (list go-go-opentelemetry-io-otel
+           go-go-opentelemetry-io-otel-metric
+           go-go-opentelemetry-io-otel-trace))
+    (home-page "https://github.com/open-telemetry/opentelemetry-go")
+    (synopsis "Experimental Metric Options")
+    (description
+     "This package contains experimental options for the OpenTelemetry metric
+package.  These options are currently under development and not part of the
+stable API. They may be changed in backwards-incompatible ways, or removed
+entirely.")
+    (license license:asl2.0)))
+
 (define-public go-go-opentelemetry-io-otel-sdk
   (package
     (name "go-go-opentelemetry-io-otel-sdk")
@@ -22770,6 +23478,34 @@ carries no encryption keys and cannot decode the traffic that it proxies.")))
     (propagated-inputs '())
     (inputs '())))
 
+(define-public sarama-tools
+  (package/inherit go-github-com-ibm-sarama
+    (name "sarama-tools")
+    (arguments
+     (substitute-keyword-arguments arguments
+       ((#:install-source? _ #t) #f)
+       ((#:skip-build? _ #t) #f)
+       ((#:tests? _ #t) #f)
+       ((#:import-path _) "github.com/IBM/sarama/tools/...")))
+    (native-inputs (package-propagated-inputs go-github-com-ibm-sarama))
+    (propagated-inputs '())
+    (inputs '())
+    (description
+     "This package contains applications that are useful for exploration of
+Kafka cluster, or instrumentation.  Some of these tools mirror tools that ship
+with Kafka, but these tools won't require installing the JVM to function.
+
+@itemize
+@item @command{kafka-console-producer}: a command line tool to produce a
+single message to your Kafka custer.
+@item @command{kafka-console-partitionconsumer}: a command line
+tool to consume a single partition of a topic on your Kafka cluster.
+@item @command{kafka-console-consumer}: a command line tool to consume
+arbitrary partitions of a topic on your Kafka cluster.
+@item @command{kafka-producer-performance}: a command line tool to performance
+test producers (sync and async) on your Kafka cluster.
+@end itemize")))
+
 (define-public snowflake-proxy
   (package/inherit
       go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-snowflake-v2

gnu/packages/golang-xyz.scm

@@ -525,6 +525,35 @@ file along with an index.html file.")
      "Package tcell provides a gruid Driver for making terminal apps.")
     (license license:isc)))
 
+(define-public go-codeberg-org-chavacava-garif
+  (package
+    (name "go-codeberg-org-chavacava-garif")
+    (version "0.2.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://codeberg.org/chavacava/garif.git")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0cz037yb9gnk9fd61pni6m0n9cbrwmlxxija5vm91mplyxlih05h"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "codeberg.org/chavacava/garif"))
+    (native-inputs
+     (list go-github-com-stretchr-testify))
+    (home-page "https://codeberg.org/chavacava/garif")
+    (synopsis "Create and manipulate SARIF logs")
+    (description
+     "This package defines all the Go structures required to model a log file.
+
+SARIF, from Static Analysis Results Interchange Format, is a standard
+JSON-based format for the output of static analysis tools defined and promoted
+by @url{https://www.oasis-open.org/, OASIS}.")
+    (license license:expat)))
+
 (define-public go-codeberg-org-emersion-go-scfg
   (package
     (name "go-codeberg-org-emersion-go-scfg")
@@ -613,6 +642,33 @@ recursively any exported one.  It also won't merge structs inside
 maps (because they are not addressable using Go reflection).")
     (license license:bsd-3)))
 
+(define-public go-fyne-io-systray
+  (package
+    (name "go-fyne-io-systray")
+    (version "1.11.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/fyne-io/systray")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0yrd4f3n8wrqcqradmqq9w0b31hd5hali876xkynfhm3nhaz4j1i"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "fyne.io/systray"))
+    (propagated-inputs
+     (list go-github-com-godbus-dbus-v5
+           go-golang-org-x-sys))
+    (home-page "https://fyne.io/systray/")
+    (synopsis "Place an icon and menu in the notification area")
+    (description
+     "This package is a cross-platform Go library to place an icon and menu in
+the notification area.")
+    (license license:asl2.0)))
+
 (define-public go-git-sr-ht-rjarry-go-opt
   (package
     (name "go-git-sr-ht-rjarry-go-opt")
@@ -2981,6 +3037,38 @@ input from the terminal while not echoing the input back (similar to
 and is therefore compatible with cross-compiling.")
     (license license:expat)))
 
+(define-public go-github-com-bitfield-script
+  (package
+    (name "go-github-com-bitfield-script")
+    (version "0.24.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/bitfield/script")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1pzmz7n39sh9sprclzd0m0l0flf626286fh51m065yjhkqzrjw89"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/bitfield/script"
+      #:test-flags #~(list "-vet=off")))
+    (native-inputs
+     (list go-github-com-google-go-cmp))
+    (propagated-inputs
+     (list go-github-com-itchyny-gojq
+           go-github-com-rogpeppe-go-internal
+           go-mvdan-cc-sh-v3))
+    (home-page "https://github.com/bitfield/script")
+    (synopsis "Making it easy to write shell-like scripts in Go")
+    (description
+     "Package script aims to make it easy to write shell-type scripts in Go,
+for general system administration purposes: reading files, counting lines,
+matching strings, and so on.")
+    (license license:expat)))
+
 (define-public go-github-com-bitly-go-hostpool
   (package
     (name "go-github-com-bitly-go-hostpool")
@@ -4433,6 +4521,34 @@ over strings.")
 @code{https://en.wikipedia.org/wiki/WebP, WebP} images.")
     (license license:bsd-3)))
 
+(define-public go-github-com-chainguard-dev-clog
+  (package
+    (name "go-github-com-chainguard-dev-clog")
+    (version "1.8.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/chainguard-dev/clog")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0b95vw8czs2r9lscyi85vppbyqj672zm6z2n9siy1s9yv6fkys62"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "github.com/chainguard-dev/clog"))
+    (home-page "https://github.com/chainguard-dev/clog")
+    (synopsis "Context aware slog")
+    (description
+     "This package provides a context-aware Go std lib
+@url{https://pkg.go.dev/log/slog, @code{slog}}.  The context Logger can be
+used to use Loggers from the context.  This is sometimes preferred over the
+@url{https://github.com/chainguard-dev/clog#context-handler, Context Handler},
+since this can make it easier to use different loggers in different
+contexts (e.g. testing).")
+    (license license:asl2.0)))
+
 (define-public go-github-com-charlievieth-fastwalk
   (package
     (name "go-github-com-charlievieth-fastwalk")
@@ -8967,6 +9083,41 @@ sub-interfaces are also provided for cases where the full Channel interface
 cannot be met (for example, @code{InChannel} for write-only channels).")
     (license license:expat)))
 
+(define-public go-github-com-eapache-go-resiliency
+  (package
+    (name "go-github-com-eapache-go-resiliency")
+    (version "1.7.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/eapache/go-resiliency")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "07a1r3c2spd37k3riy4fxz8v8ibxiprf8a3vw788whz4mlp6gm40"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:skip-build? #t
+      #:import-path "github.com/eapache/go-resiliency"))
+    (home-page "https://github.com/eapache/go-resiliency")
+    (synopsis "Resiliency patterns for golang")
+    (description
+     "Resiliency patterns for golang.  Based in part on
+@url{https://github.com/Netflix/Hystrix, Hystrix},
+@@url{https://github.com/Shopify/semian, Semian}, and others.
+
+Currently implemented patterns include:
+@itemize
+@item circuit-breaker
+@item semaphore
+@item deadline/timeout
+@item batching
+@item retriable
+@end itemize")
+    (license license:expat)))
+
 (define-public go-github-com-eapache-queue
   (package
     (name "go-github-com-eapache-queue")
@@ -30438,8 +30589,8 @@ The yaml package supports most of YAML 1.2, but preserves some behavior from
 ;; to build NNCP and remove vendor) dependency for Golang.  Full build depends
 ;; on Bazel <https://bazel.build/>.
 (define-public go-gvisor-dev-gvisor
-  (let ((commit "634ce95eed8d5b8e6b3e2ea30542c34cb30af148")
-        (revision "0"))
+  (let ((commit "9414b50a5633100fd7299a5a7998742575dcb669")
+        (revision "1"))
     (package
       (name "go-gvisor-dev-gvisor")
       (version (git-version "0.0.0" revision commit))
@@ -30451,7 +30602,7 @@ The yaml package supports most of YAML 1.2, but preserves some behavior from
                (commit commit)))
          (file-name (git-file-name name version))
          (sha256
-          (base32 "1l3si6qlchwgsvaq6lxyvj8iq8n8pqxlayb1hbdf3pynxi52hfkw"))))
+          (base32 "0vqaclb2ignkcs7n463bj349m0xybdsv71i6afhzh8r05hdywzax"))))
       (build-system go-build-system)
       (arguments
        (list

gnu/packages/guile-xyz.scm

@@ -7764,8 +7764,8 @@ is an attempt to combine both into something useful.")
       (license license:asl2.0))))
 
 (define-public guile-knots
-  (let ((commit "f767eca066495e6582e89ba1b91907c0c5657878")
-        (revision "34"))
+  (let ((commit "49996c432a4616e03ecaf01cb42afc5fd78eafd5")
+        (revision "35"))
     (package
     (name "guile-knots")
     (version (git-version "0.1" revision commit))
@@ -7776,7 +7776,7 @@ is an attempt to combine both into something useful.")
                     (commit commit)))
               (sha256
                (base32
-                "18fqmpyrrxy8phxxm5b7d1qhhvc3rsrs243xiinkj2hn2ca1cqi8"))
+                "0i6vk432shy7qmsq1hli71a9kmgf8yy9hx3bck0r9qzsldv1m3m9"))
               (file-name (git-file-name name version))))
     (build-system gnu-build-system)
     (arguments

gnu/packages/java-bootstrap.scm

@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019, 2021 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2014-2019, 2021, 2026 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2021, 2026 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017, 2022 Marius Bakke <marius@gnu.org>
@@ -226,6 +226,18 @@ JNI.")
              (setenv "JAVACMD" (search-input-file inputs "/bin/jamvm"))
              (setenv "JAVAC" (search-input-file inputs "/bin/jikes"))
              (setenv "CLASSPATH" (search-input-file inputs "/lib/rt.jar"))))
+         ,@(if (target-x86-32?)
+               ;; XXX: On i686 isFile() always seems to return true.  Patching
+               ;; this here is very ugly, but the effects are limited.  None
+               ;; of these changes remain by the time we've built Icedtea and
+               ;; the other JDKs.
+               '((add-after 'unpack 'disable-isFile-checks
+                   (lambda _
+                     (substitute* "src/main/org/apache/tools/ant/util/ResourceUtils.java"
+                       (("destFile = \\(\\(FileProvider\\).*") ""))
+                     (substitute* "src/main/org/apache/tools/ant/taskdefs/Mkdir.java"
+                       (("dir.isFile\\(\\)") "false")))))
+               '())
          (replace 'build
            (lambda* (#:key inputs outputs #:allow-other-keys)
              ;; Ant complains if this file doesn't exist.

gnu/packages/java.scm

@@ -1285,7 +1285,13 @@ new Date();"))))
                 ;; It looks like the "--disable-warnings-as-errors" option of
                 ;; the 'configure' phase is not working.
                 (substitute* "make/autoconf/generated-configure.sh"
-                  (("-Werror") ""))))))
+                  (("-Werror") ""))))
+            #$@(if (target-x86-32?)
+                   ;; On i686 the C2 compiler sometimes crashes when importing
+                   ;; certificates.
+                   #~((add-before 'install-keystore 'disable-C2-compiler
+                        (lambda _ (setenv "_JAVA_OPTIONS" "-XX:TieredStopAtLevel=1"))))
+                   #~())))
        ((#:disallowed-references refs '())
         (cons* (this-package-native-input "openjdk")
                (gexp-input (this-package-native-input "openjdk") "jdk")
@@ -1844,12 +1850,50 @@ blacklisted.certs.pem"
 (define-public openjdk24
   (make-openjdk
    openjdk23 "24.0.1"
-   "0h6sbzbjyqg85iml41pswdh2z3d7h2hhb0sd5yll37r1mj5lsxmx"))
+   "0h6sbzbjyqg85iml41pswdh2z3d7h2hhb0sd5yll37r1mj5lsxmx"
+   (arguments
+    (substitute-keyword-arguments (package-arguments base)
+      ((#:configure-flags flags #~(list))
+       (if (target-x86-32?)
+           #~(cons* "--enable-deprecated-ports=yes" #$flags)
+          flags))))))
 
 (define-public openjdk25
   (make-openjdk
    openjdk24 "25.0.2"
-   "03aa34lscr3qbdl6qz3gqyp0nzkqfj02362mzmpkiq3y2g5xdnrj"))
+   "03aa34lscr3qbdl6qz3gqyp0nzkqfj02362mzmpkiq3y2g5xdnrj"
+   (arguments
+    (substitute-keyword-arguments (package-arguments base)
+      ((#:configure-flags flags #~(list))
+       (if (target-x86-32?)
+           ;; Full builds on 32-bit x86 architectures are not supported as of
+           ;; this version.  Best we can do is to build with the "zero" variant.
+           #~(cons* "--with-jvm-variants=zero"
+                    "--disable-precompiled-headers"
+                    #$flags)
+           flags))
+      ((#:phases phases #~%standard-phases)
+       (if (target-x86-32?)
+           #~(modify-phases #$phases
+               (replace 'install
+                 (lambda _
+                   (let ((images (car (find-files "build" "-zero-release"
+                                                  #:directories? #t))))
+                     (copy-recursively (string-append images "/images/jdk")
+                                       #$output:jdk)
+                     (copy-recursively (string-append images "/images/jre")
+                                       #$output)
+                     (copy-recursively (string-append images "/images/docs")
+                                       #$output:doc))))
+               (replace 'install-libjvm
+                 (lambda _
+                   (let ((lib-out (string-append #$output "/lib"))
+                         (lib-jdk (string-append #$output:jdk "/lib")))
+                     (symlink (string-append lib-jdk "/zero/libjvm.so")
+                              (string-append lib-jdk "/libjvm.so"))
+                     (symlink (string-append lib-out "/zero/libjvm.so")
+                              (string-append lib-out "/libjvm.so"))))))
+           phases))))))
 
 ;;; Convenience alias to point to the latest version of OpenJDK.
 (define-public openjdk openjdk25)

gnu/packages/kde-utils.scm

@@ -485,11 +485,23 @@ to camera devices supported by @code{libgphoto2} using
        (uri (string-append "mirror://kde/stable/release-service/" version
                            "/src/kate-" version ".tar.xz"))
        (sha256
-        (base32 "0ah6cy92yir68z25460ccl48i5nrfqswpzil9a7l69h3qxspsk88"))))
+        (base32 "0ah6cy92yir68z25460ccl48i5nrfqswpzil9a7l69h3qxspsk88"))
+       (modules '((guix build utils)))
+       ;; Unbundle SingleApplication.
+       (snippet
+        '(begin
+           (delete-file-recursively "3rdparty/SingleApplication")
+           (with-directory-excursion "apps/kate"
+             (substitute* "CMakeLists.txt"
+               ((".*3rdparty.*") "")
+               ((" -DQAPPLICATION_CLASS=FreeStandingSingleApplication") ""))
+             (substitute* "main.cpp"
+               (("(#include )\"SingleApplication\\/SingleApplication\"" _ keep)
+                (string-append keep "<SingleApplication>"))))))))
     (build-system qt-build-system)
     (native-inputs
      (list extra-cmake-modules kdoctools xorg-server-for-tests))
-    ;; TODO: Unbundle rapidjson and SingleApplication.
+    ;; TODO: Unbundle rapidjson.
     (inputs
      (list breeze-icons ;; default icon set
            karchive
@@ -515,11 +527,20 @@ to camera devices supported by @code{libgphoto2} using
            libxkbcommon
            plasma-activities
            qtsvg
-           qtwayland))
+           qtwayland
+           single-application))
     (arguments
      (list #:qtbase qtbase
            #:phases
            #~(modify-phases %standard-phases
+               (add-after 'unpack 'link-single-application
+                 (lambda _
+                   (substitute* "apps/kate/CMakeLists.txt"
+                     (("target_link_libraries\\(kate-bin PRIVATE kateprivate"
+                       all)
+                      (string-append all " "
+                                     #$(this-package-input "single-application")
+                                     "/lib/libSingleApplication.a")))))
                (add-after 'unpack 'patch-tests
                  (lambda* (#:key inputs #:allow-other-keys)
                    ;; This test requires a 'bin' diretory under '/usr'.

gnu/packages/linux.scm

@@ -87,6 +87,7 @@
 ;;; Copyright © 2025 John Kehayias <john.kehayias@protonmail.com>
 ;;; Copyright © 2025 Arjan Adriaanse <arjan@adriaan.se>
 ;;; Copyright © 2026 Justin Veilleux <terramorpha@cock.li>
+;;; Copyright © 2026 Simen Endsjø <contact@simendsjo.me>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -531,7 +532,7 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
 ;; The current "stable" kernels. That is, the most recently released major
 ;; versions that are still supported upstream.
 
-(define-public linux-libre-6.19-version "6.19.12")
+(define-public linux-libre-6.19-version "6.19.14")
 (define-public linux-libre-6.19-gnu-revision "gnu")
 (define deblob-scripts-6.19
   (linux-libre-deblob-scripts
@@ -541,12 +542,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "05jpciyypvmy6byaxjl49b1fvzxcnlhknf0xabrdj5152iznrzkh")))
 (define-public linux-libre-6.19-pristine-source
   (let ((version linux-libre-6.19-version)
-        (hash (base32 "1md8b270pdyk9d8cq0qyr8qmymcijmj3gc39nn394wpr0l94yp6f")))
+        (hash (base32 "11giqsz9qa7s9lm94nn4h1bcb2411crsbfyvzrvhfjmy75kvzs6d")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-6.19)))
 
-(define-public linux-libre-6.18-version "6.18.22")
+(define-public linux-libre-6.18-version "6.18.25")
 (define-public linux-libre-6.18-gnu-revision "gnu")
 (define deblob-scripts-6.18
   (linux-libre-deblob-scripts
@@ -556,7 +557,7 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "0qlih8w8wg4v5cwbmd34rbhb6mjgbx69i9rx3s2vxw7h42q9l0ai")))
 (define-public linux-libre-6.18-pristine-source
   (let ((version linux-libre-6.18-version)
-        (hash (base32 "0nazlm6j5blyd4qgl0z6xc3qk00vz3cfvx5mqv18awv5ygx94g52")))
+        (hash (base32 "160qplwzx48rcvh53wz60c7xdnw11sdhfs6fysd2c2s3sh3hls19")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-6.18)))
@@ -565,7 +566,7 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
 ;; Here are the support timelines:
 ;; <https://www.kernel.org/category/releases.html>
 
-(define-public linux-libre-6.12-version "6.12.81")
+(define-public linux-libre-6.12-version "6.12.84")
 (define-public linux-libre-6.12-gnu-revision "gnu")
 (define deblob-scripts-6.12
   (linux-libre-deblob-scripts
@@ -575,12 +576,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "1x48hpmvajz7v5wn1vdd7l5r14mq4ngzh5npz3pj81z4f1g61i0a")))
 (define-public linux-libre-6.12-pristine-source
   (let ((version linux-libre-6.12-version)
-        (hash (base32 "0iw84bqdbh9dlaqd1bqgldg50riw2b5is7ipqnbp0sll8cv9rc62")))
+        (hash (base32 "1pajzxxp2jpjzjav4inbz58hm4xdacj10fp899wmalqzgcx4cvnm")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-6.12)))
 
-(define-public linux-libre-6.6-version "6.6.134")
+(define-public linux-libre-6.6-version "6.6.136")
 (define-public linux-libre-6.6-gnu-revision "gnu")
 (define deblob-scripts-6.6
   (linux-libre-deblob-scripts
@@ -590,12 +591,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "0xp9b2vkrb0g0rn4i33b59rhp4sgh1dbwzk28vwz7kwac6l5rcpi")))
 (define-public linux-libre-6.6-pristine-source
   (let ((version linux-libre-6.6-version)
-        (hash (base32 "1grp1wqgzjsk6xyl0nvd2hxlxjj0wgz04x544zkz8srp6rxnjy33")))
+        (hash (base32 "0wglpjmrwdghbdh3rs3qw5kyacrcdw77cqzwwmp7h798k0dd5ckg")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-6.6)))
 
-(define-public linux-libre-6.1-version "6.1.168")
+(define-public linux-libre-6.1-version "6.1.169")
 (define-public linux-libre-6.1-gnu-revision "gnu")
 (define deblob-scripts-6.1
   (linux-libre-deblob-scripts
@@ -605,12 +606,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "1w5pfws6l39dpc3lzazs1n6r4m96f6rdf6vb2scy5fhmrd933ldc")))
 (define-public linux-libre-6.1-pristine-source
   (let ((version linux-libre-6.1-version)
-        (hash (base32 "0vkp75sfnjvfqxjh6gqcx24h2m6qj6xkwlw6b118cja43vjnz1g0")))
+        (hash (base32 "0b7g7awbn1zryrh0pnjsh00d7j7ivda8i380jddhfj8ph1sfdjz0")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-6.1)))
 
-(define-public linux-libre-5.15-version "5.15.202")
+(define-public linux-libre-5.15-version "5.15.203")
 (define-public linux-libre-5.15-gnu-revision "gnu")
 (define deblob-scripts-5.15
   (linux-libre-deblob-scripts
@@ -620,12 +621,12 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "1s6km2r2mad0wpf7nqn4rqsykw1lm386l1yskmil24239fbva1f1")))
 (define-public linux-libre-5.15-pristine-source
   (let ((version linux-libre-5.15-version)
-        (hash (base32 "1m6d53qx1ah4jwpa8hwjdmq0jn2hf7xmz1li6rwpdqjp97vvvh8b")))
+        (hash (base32 "0r6w6glfpzp6qz0kbxzpmabxwgw1y5k9a407lj98gsap5bcfgsqb")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-5.15)))
 
-(define-public linux-libre-5.10-version "5.10.252")
+(define-public linux-libre-5.10-version "5.10.253")
 (define-public linux-libre-5.10-gnu-revision "gnu1")
 (define deblob-scripts-5.10
   (linux-libre-deblob-scripts
@@ -635,7 +636,7 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
    (base32 "1hgza8fsps7bkjf4i0f2xgvrh1r183z3i6lxrr2nr8qbi5d13qs7")))
 (define-public linux-libre-5.10-pristine-source
   (let ((version linux-libre-5.10-version)
-        (hash (base32 "1yqa4zmvi5ihf50kxcff06abfi6xw0b9ajzagvy6gdzfr7igpcrl")))
+        (hash (base32 "1j2sszv8j9s6qlrvbnyj1qf9aapl0srbps3g4bvf5s2hh29281zc")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-5.10)))
@@ -2797,6 +2798,76 @@ kernel modules to control the keyboard on most Tuxedo computers. The @code{tuxed
 module is also needed for the @code{tuxedo-control-center} (short tcc) package.")
     (license license:gpl2+)))
 
+(define-public evdi
+  (package
+    (name "evdi")
+    (version "1.14.15")                  ;inherited by libevdi
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/DisplayLink/evdi")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "065mfwmb4nw71s0f0ax9si8xpbr1sah1bhxvq1k81yicvi83wsxn"))))
+    (build-system linux-module-build-system)
+    (arguments
+     (list #:tests? #f                  ;no test suite
+           #:phases #~(modify-phases %standard-phases
+                        (add-after 'unpack 'chdir
+                          (lambda _
+                            (chdir "module")))
+                        ;; Looks like the value is only there to detect RHEL
+                        ;; derivatives, so we can safely delete the include.
+                        (add-after 'unpack 'embed-/etc/os-release
+                          (lambda _
+                            (substitute* "module/Makefile"
+                              (("include /etc/os-release") "")))))))
+    (home-page "https://github.com/DisplayLink/evdi")
+    (synopsis
+     "@acronym{EVDI, Extensible Virtual Display Interface} Linux kernel module")
+    (description
+     "The @acronym{EVDI, Extensible Virtual Display Interface} is a Linux kernel
+module that enables management of multiple screens, allowing user-space programs
+to take control over what happens with the image.  It is essentially a virtual
+display for which applications using the @code{libevdi} library can add, remove,
+and receive screen updates.
+
+The EVDI driver uses the standard Linux @acronym{DRM, Direct Rendering Manager}.
+Its displays can be controlled by standard tools such as @command{xrandr} and
+display settings applets in graphical environments.")
+    (license license:gpl2)))
+
+(define-public libevdi
+  (package
+    (inherit evdi)
+    (name "libevdi")
+    (build-system gnu-build-system)
+    (arguments
+     (list #:tests? #f                  ;no test suite
+           #:make-flags
+           #~(list (string-append "CC=" #$(cc-for-target)))
+           #:phases #~(modify-phases %standard-phases
+                        (delete 'configure)
+                        (add-after 'unpack 'chdir
+                          (lambda _
+                            (chdir "library")))
+                        (replace 'install
+                          (lambda* _
+                            (let* ((lib (string-append #$output "/lib")))
+                              (mkdir-p lib)
+                              (install-file "libevdi.so" lib)))))))
+    (inputs (list libdrm))
+    (native-inputs (list pkg-config))
+    (synopsis
+     "@acronym{EVDI, Extensible Virtual Display Interface} user-space library")
+    (description
+     "Libevdi is a library that gives applications easy access to
+@acronym{EVDI, Extensible Virtual Display Interface} devices provided by the
+@code{evdi} driver package.")
+    (license license:lgpl2.1)))
+
 (define-public ec
   (package
     (name "ec")

gnu/packages/lisp-xyz.scm

@@ -22847,16 +22847,6 @@ specification}, a toolkit for writing GUIs in Common Lisp.")
 (define-public cl-mcclim
   (sbcl-package->cl-source-package sbcl-mcclim))
 
-(define-public ecl-mcclim
-  (let ((pkg (sbcl-package->ecl-package sbcl-mcclim)))
-    (package
-      (inherit pkg)
-      (arguments
-       (substitute-keyword-arguments arguments
-         ;; Tests fail with "FUNCTION: Not a valid argument (R1
-         ;; (GENERATE-REGION))."  on ECL.
-         ((#:tests? _ #f) #f))))))
-
 (define-public sbcl-md5
   (package
     (name "sbcl-md5")
@@ -29767,7 +29757,7 @@ the Processing language and shares some of the API.")
   ;; Update together with emacs-slime.
   (package
     (name "sbcl-slime-swank")
-    (version "2.31")
+    (version "2.32")
     (source
      (origin
        (file-name (git-file-name "cl-slime-swank" version))
@@ -29776,7 +29766,7 @@ the Processing language and shares some of the API.")
              (url "https://github.com/slime/slime/")
              (commit (string-append "v" version))))
        (sha256
-        (base32 "0nv99wq2vz053p0rn9953rhmyz4g40zdl01mz7z9xbklxzbsx6x7"))
+        (base32 "0s7m7j7y1p8fb6ncpxcxdrrrxp5aw67xl7wrqy8zjjvwzljbs548"))
        (modules '((guix build utils)))
        (snippet
         ;; The doc folder drags `gawk' into the closure.  Doc is already

gnu/packages/mail.scm

@@ -1355,7 +1355,7 @@ security functionality including PGP, S/MIME, SSH, and SSL.")
 (define-public mu
   (package
     (name "mu")
-    (version "1.14.0")
+    (version "1.14.1")
     (source
      (origin
        (method git-fetch)
@@ -1364,7 +1364,7 @@ security functionality including PGP, S/MIME, SSH, and SSL.")
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1fhnnm58ndfd6hzdagrsgcdcm2qlcjlda13vyx5d9lclhxgdn0vf"))))
+        (base32 "0dv27pq2jmgqlzsy2gcmh7vddiwiwd55j299blb9k8g0xhkg8riz"))))
     (build-system meson-build-system)
     (native-inputs
      (list pkg-config

gnu/packages/maths.scm

@@ -458,7 +458,8 @@ programming languages.")
              (url "https://github.com/cvc5/cvc5/")
              (commit (string-append "cvc5-" version))))
        (file-name (git-file-name name version))
-       (patches (search-patches "cvc5-reproducible-build.patch"))
+       (patches (search-patches "cvc5-reproducible-build.patch"
+                                "cvc5-symfpu-compatibility.patch"))
        (sha256
         (base32 "0ynz7di4dyyiiydgmf0z9dc2jl7nm44xi0amch29rcgznwr4wy5m"))))
     (build-system cmake-build-system)
@@ -745,6 +746,54 @@ complete with events and to-dos.")
       (home-page "https://codeberg.org/dgoodmaniii/dozenal")
       (license license:gpl3+))))
 
+(define-public drat-trim
+  (package
+    (name "drat-trim")
+    (version "05.22.2023")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/marijnheule/drat-trim")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "084miqj57xr7c74y649acm5xjkddpjn4ybfh469jcbakzp8w0pdi"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:tests? #f ;no tests
+      #:make-flags
+      #~(list (string-join
+                (list "FLAGS=-DLONGTYPE"
+                      ;; _POSIX_C_SOURCE required for getc_unlocked(3).
+                      "-D_POSIX_C_SOURCE=200809")
+                " "))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'always-pass-flags
+            (lambda _
+              (substitute* "Makefile"
+                ;; Ensure that drat-trim and gapless target also respect FLAGS.
+                (("-std=c99 -O2")
+                 "-std=c99 $(FLAGS) -O2"))))
+          (delete 'configure) ;no configure script
+          (replace 'install
+            (lambda* (#:key outputs #:allow-other-keys)
+              (let* ((bin (string-append #$output "/bin")))
+                (for-each (lambda (exec)
+                            (install-file exec bin))
+                          '("drat-trim"
+                            "lrat-check"))))))))
+    (synopsis "Proof checker for unsatisfiability of propositional formulas")
+    (description
+     "The proof checker DRAT-trim can be used to check whether a propositional
+formula in the DIMACS format is unsatisfiable.  Given a propositional formula and
+a clausal proof, DRAT-trim validates that the proof is a certificate of
+unsatisfiability of the formula.")
+    (home-page "https://www.cs.utexas.edu/~marijn/drat-trim/")
+    (license license:expat)))
+
 (define-public dsfmt
   (package
     (name "dsfmt")
@@ -2475,6 +2524,9 @@ similar to MATLAB, GNU Octave or SciPy.")
                    ;; "--enable-doxygen"
                    "--enable-dot"
                    "--enable-netcdf-4"
+                   #$@(if (or (target-x86-32?) (target-arm32?))
+                          '("CFLAGS=-Wno-error=incompatible-pointer-types")
+                          '())
                    (string-append "--with-plugin-dir=" #$output "/lib/hdf5-plugins"))
            #:phases
            #~(modify-phases %standard-phases
@@ -2486,7 +2538,15 @@ similar to MATLAB, GNU Octave or SciPy.")
                      (("testurl.sh") ""))
                    (substitute* "nczarr_test/Makefile.in"
                      (("/bin/bash")
-                      (search-input-file inputs "bin/bash")))))
+                      (search-input-file inputs "bin/bash")))
+                   ;; This test fails on 32 bit platforms.
+                   #$@(if (or (target-x86-32?) (target-arm32?))
+                          '((substitute* '("ncdump/tst_netcdf4_4.sh"
+                                           "ncdump/tst_nccopy4.sh")
+                              (("#!/bin/sh" m) (string-append m "\nexit 0\n")))
+                            (substitute* "ncdump/Makefile.in"
+                              (("tst_netcdf4_4.log") "")))
+                          '())))
                (add-before 'configure 'fix-source-date
                  (lambda _
                    ;; As we ${SOURCE_DATE_EPOCH} evaluates to "1" in the build
@@ -8314,8 +8374,11 @@ s-expression-based format.")
    (license license:gpl3+)))
 
 (define-public symfpu
-  (let ((commit "22d993d880f66b2e470c3928e0e61bdf61419702")
-        (revision "0"))
+  ;; Currently, we use the "experimental" branch of the symfpu repository.  The
+  ;; default "master" branch hasn't been updated in ~7 years and both bitwuzla
+  ;; and cvc5 require fixes from the "experimental" branch.
+  (let ((commit "aeaa3fa62730148c855f5a9e0a9b7040d48e0b7e")
+        (revision "1"))
     (package
       (name "symfpu")
       (version (git-version "0" revision commit))
@@ -8327,7 +8390,7 @@ s-expression-based format.")
                (commit commit)))
          (file-name (git-file-name name version))
          (sha256
-          (base32 "1h20zzkyi225290kc6mzg8i4dwkj0p1vlwfgc9ycs61snlyd8gr8"))))
+          (base32 "0wj9pwr2jiliy4rw4nvy51427dwhwj86azi14qc5vzsdb44c6fdx"))))
       (build-system copy-build-system)
       (arguments
        (list
@@ -8369,7 +8432,7 @@ operations.")
 (define-public bitwuzla
   (package
     (name "bitwuzla")
-    (version "0.8.2")
+    (version "0.9.0")
     (source
      (origin
        (method git-fetch)
@@ -8378,21 +8441,16 @@ operations.")
              (commit version)))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0nakqz29cfkn91yvx1xzsk50rlqbiihslflbjanv4lflcl2zx6mz"))))
+        (base32 "012h3fj25f5zk9qy353vqn5jpp26db45xjbxi7ns02pkhlm46f6x"))))
     (build-system meson-build-system)
     (arguments
      `(#:configure-flags '("-Dtesting=enabled" "-Ddefault_library=shared"
-                           "-Dkissat=true")
-       #:phases (modify-phases %standard-phases
-                  (add-after 'unpack 'make-git-optional
-                    (lambda _
-                      (substitute* "src/meson.build"
-                        (("run_command\\('git',")
-                         "run_command('sh', '-c', 'git',")))))))
+                           "-Dkissat=true")))
     (native-inputs (list googletest pkg-config))
-    (inputs (list cadical
+    (inputs (list cadical-2.1
                   gmp
                   kissat
+                  mpfr
                   symfpu))
     (synopsis "SMT solver optimized for the theory of bit-vectors")
     (description
@@ -9660,6 +9718,7 @@ researchers and developers alike to get started on SAT.")
          "1snimig4cp97p570nin2i38my72zvwypldyhr125i1z6cd9pa046"))))
     (build-system gnu-build-system)
     (inputs (list xz gzip lzip bzip2 p7zip))
+    (native-inputs (list drat-trim))
     (arguments
      (list
       #:test-target "test"

gnu/packages/messaging.scm

@@ -2839,7 +2839,7 @@ implementation of an MQTT version client class.")
 (define-public psi-plus
   (package
     (name "psi-plus")
-    (version "1.5.1484")
+    (version "1.5.2115")
     (source
      (origin
        (method git-fetch)
@@ -2853,7 +2853,7 @@ implementation of an MQTT version client class.")
         `(begin
            (delete-file-recursively "3rdparty")))
        (sha256
-        (base32 "1jsm39nzzbqkp3zc0xqx7jid6p4q1ra28xad38wjr2l1jb8qjn24"))))
+        (base32 "14za9rh7nszv5px5a2w43ysi9977zws8a5mxsh7wc8ksr693faz2"))))
     (build-system qt-build-system)
     (arguments
      `(#:tests? #f                      ; No target
@@ -2910,19 +2910,13 @@ implementation of an MQTT version client class.")
                 "qite/qiteaudio.h")
                (("qiteaudiorecorder.h")
                 "qite/qiteaudiorecorder.h"))))
-         (add-after 'install 'wrap-env
+         (add-after 'install 'wrap-executable
            (lambda* (#:key outputs #:allow-other-keys)
              (let ((out (assoc-ref outputs "out")))
-               (for-each
-                (lambda (name)
-                  (let ((file (string-append out "/bin/" name))
-                        (gst-plugin-path (getenv "GST_PLUGIN_SYSTEM_PATH"))
-                        (gi-typelib-path (getenv "GI_TYPELIB_PATH")))
-                    (wrap-program file
-                      `("GST_PLUGIN_SYSTEM_PATH" ":" prefix (,gst-plugin-path))
-                      `("GI_TYPELIB_PATH" ":" prefix (,gi-typelib-path)))))
-                '("psi-plus")))))
-         (add-after 'wrap-env 'glib-or-gtk-compile-schemas
+               (wrap-program (string-append out "/bin/psi-plus")
+                 `("GST_PLUGIN_SYSTEM_PATH" ":" prefix (,(getenv "GST_PLUGIN_SYSTEM_PATH")))
+                 `("GI_TYPELIB_PATH" ":" prefix (,(getenv "GI_TYPELIB_PATH")))))))
+         (add-after 'wrap-executable 'glib-or-gtk-compile-schemas
            (assoc-ref glib-or-gtk:%standard-phases 'glib-or-gtk-compile-schemas))
          (add-after 'glib-or-gtk-compile-schemas 'glib-or-gtk-wrap
            (assoc-ref glib-or-gtk:%standard-phases 'glib-or-gtk-wrap)))))
@@ -2945,6 +2939,7 @@ implementation of an MQTT version client class.")
            libgcrypt
            libgpg-error
            libidn
+           libomemo-c
            libotr
            libsignal-protocol-c
            tidy-html
@@ -2964,11 +2959,11 @@ implementation of an MQTT version client class.")
            libxcb
            libxscrnsaver
            zlib))
-    (home-page "https://psi-plus.com/")
+    (home-page "https://psi-im.com/")
     (synopsis "Qt-based XMPP Client")
     (description
-     "Psi+ is a spin-off of Psi XMPP client.  It is a powerful XMPP client
-designed for experienced users.")
+     "Psi+ is a powerful XMPP client designed for experienced users.
+It's a spin-off of the Psi XMPP client.")
     (license license:gpl2+)))
 
 (define-deprecated-package psi

gnu/packages/music.scm

@@ -7465,31 +7465,6 @@ standalone JACK application.")
     ;; Expat or CC0
     (license (list license:expat license:cc0))))
 
-(define-public regrader
-  (package
-    (inherit vl1-emulator)
-    (name "regrader")
-    (version "1.0.0")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/linuxmao-org/regrader")
-             (commit (string-append "v" version))
-             ;; bundles a specific commit of the DISTRHO plugin framework
-             (recursive? #t)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32
-         "0gl4d5lf2afqknz22jz7hh7029sc9v1xrz6nbz9dlv42bwc0cvl0"))))
-    (home-page "https://github.com/linuxmao-org/regrader")
-    (synopsis "Delay effect plugin")
-    (description
-     "Regrader is a delay effect where the repeats degrade in resolution.
-This is an unofficial port of the Regrader plugin created by Igorski.  It
-is available as an LV2 plugin and a standalone JACK application.")
-    (license license:expat)))
-
 (define-public fogpad
   (package
     (inherit vl1-emulator)

gnu/packages/networking.scm

@@ -2139,62 +2139,6 @@ replies, fping will send out a ping packet and move on to the next target in a
 round-robin fashion.")
     (license license:expat)))
 
-(define-public gandi-cli
-  (package
-    (name "gandi-cli")
-    (version "1.6")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (pypi-uri name version))
-       (sha256
-        (base32 "1h36jahbp7273wn3yd747kbiwjc0bm3sja67bcxdsd54ln0vyndg"))))
-    (build-system pyproject-build-system)
-    (arguments
-     (list
-      #:test-flags
-      #~(list "--pyargs" "gandi.cli")
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'embed-store-file-names
-            (lambda _
-              (substitute* (list "gandi/cli/modules/cert.py"
-                                 "gandi/cli/tests/commands/test_certificate.py")
-                (("openssl") (which "openssl")))))
-          (add-after 'install 'install-documentation
-            ;; The included man page may be outdated but we install it anyway,
-            ;; since it's mentioned in 'gandi --help' and better than nothing.
-            (lambda _
-              (let* ((man1 (string-append #$output "/share/man/man1")))
-                (mkdir-p man1)
-                (with-output-to-file (string-append man1 "/gandi.1")
-                  (lambda _
-                    (invoke "rst2man.py" "gandicli.man.rst")))))))))
-    (native-inputs
-     (list python-docutils-0.19
-           python-pytest
-           python-pytest-cov
-           python-setuptools
-           python-wheel))
-    (inputs
-     (list openssl
-           python-click-7
-           python-ipy
-           python-pyyaml
-           python-requests))
-    (propagated-inputs
-     (list openssh))
-    (home-page "https://cli.gandi.net")
-    (synopsis "Command-line interface to the Gandi.net Web API")
-    (description
-     "This package provides a command-line client (@command{gandi}) to buy,
-manage, and delete Internet resources from Gandi.net such as domain names,
-virtual machines, and certificates.")
-    (license license:gpl3+)))
-
-(define-deprecated-package gandi.cli
-  gandi-cli)
-
 (define-public go-sctp
   ;; docker-libnetwork-cmd-proxy requires this exact commit.
   ;; This commit is mentioned in docker-libnetwork-cmd-proxy's vendor.conf.

gnu/packages/package-management.scm

@@ -1204,8 +1204,8 @@ transactions from C or Python.")
     (license license:gpl2+)))
 
 (define-public bffe
-  (let ((commit "723fd5ea6af1b14c215baf80524c8ff4b21fcc82")
-        (revision "17"))
+  (let ((commit "d6c90f217595674c7910a858edcb735f88d3a14f")
+        (revision "18"))
     (package
       (name "bffe")
       (version (git-version "0" revision commit))
@@ -1216,7 +1216,7 @@ transactions from C or Python.")
                       (commit commit)))
                 (sha256
                  (base32
-                  "1sd62arq80kkfjnynivrp7jh8j359965ank8sglq1wgfdah9k8ii"))
+                  "0f7i68k6l5ylg8nch54xw4bxn0hayx2ng9j5dvwvai1vi887vmbj"))
                 (file-name (string-append name "-" version "-checkout"))))
       (build-system gnu-build-system)
       (native-inputs

gnu/packages/parallel.scm

@@ -82,7 +82,7 @@
 (define-public parallel
   (package
     (name "parallel")
-    (version "20260322")
+    (version "20260422")
     (outputs '("out" "doc"))
     (source
      (origin
@@ -90,7 +90,7 @@
       (uri (string-append "mirror://gnu/parallel/parallel-"
                           version ".tar.bz2"))
       (sha256
-       (base32 "1q7g5f13nlwichgh0dk8w5fqjnfnxvwxk6rjy0fd5l7l6blq0ikn"))
+       (base32 "1fq7v60x9jm8mg19qn8n0sfhrygccmw6mncwyjr1g8kfsrjz2k36"))
       (snippet
        '(begin
           (use-modules (guix build utils))
@@ -734,7 +734,7 @@ single-instruction multiple-data (SIMD) intrinsics.")
               (substitute* "src/include/pmix_config.h"
                 (("#define PMIX_CONFIGURE_CLI .*")
                  "#define PMIX_CONFIGURE_CLI \"[scrubbed]\"\n")))))))
-    (inputs (list libevent `(,hwloc "lib") zlib))
+    (inputs (list libevent `(,hwloc "lib") munge zlib))
     (native-inputs
      (list autoconf
            automake

gnu/packages/patches/cvc5-symfpu-compatibility.patch

@@ -0,0 +1,165 @@
+Ensures that cvc5 is compatible with our version of SymFPU.
+
+Taken from: https://github.com/cvc5/cvc5/commit/2ed457049cf52bd0f21a6332c1be487d82bf5678
+
+diff --git a/cmake/FindSymFPU.cmake b/cmake/FindSymFPU.cmake
+index 765ee8d36..05a86e9ee 100644
+--- a/cmake/FindSymFPU.cmake
++++ b/cmake/FindSymFPU.cmake
+@@ -29,8 +29,8 @@ if(NOT SymFPU_FOUND_SYSTEM)
+   include(ExternalProject)
+   include(deps-helper)
+ 
+-  set(SymFPU_COMMIT "e6ac3af9c2c574498ea171c957425b407625448b")
+-  set(SymFPU_CHECKSUM "823aa663fcc2f6844ae5e9ea83ceda4ed393cdb3dadefce9b3c7c41cd0f4f702")
++  set(SymFPU_COMMIT "227a7246b8ce513b393cc2645d6d65d3490ea1de")
++  set(SymFPU_CHECKSUM "ff22e37dbc133120ada5760878974811737bec65b12a8883f92b1ed9e3f96e99")
+ 
+   ExternalProject_Add(
+     SymFPU-EP
+diff --git a/src/theory/fp/fp_word_blaster.cpp b/src/theory/fp/fp_word_blaster.cpp
+index 7f2086c35..3efb0eeed 100644
+--- a/src/theory/fp/fp_word_blaster.cpp
++++ b/src/theory/fp/fp_word_blaster.cpp
+@@ -119,6 +119,23 @@ CVC5_SYM_ITE_DFN(traits::ubv);
+ 
+ #undef CVC5_SYM_ITE_DFN
+ 
++#define CVC5_SYM_ITE_BOOL_DFN(T)                                   \
++  template <>                                                      \
++  struct ite<bool, T>                                              \
++  {                                                                \
++    static const T iteOp(const bool& cond, const T& l, const T& r) \
++    {                                                              \
++      return cond ? l : r;                                         \
++    }                                                              \
++  }
++
++CVC5_SYM_ITE_BOOL_DFN(traits::rm);
++CVC5_SYM_ITE_BOOL_DFN(traits::prop);
++CVC5_SYM_ITE_BOOL_DFN(traits::sbv);
++CVC5_SYM_ITE_BOOL_DFN(traits::ubv);
++
++#undef CVC5_SYM_ITE_BOOL_DFN
++
+ template <>
+ traits::ubv orderEncode<traits, traits::ubv>(const traits::ubv& b)
+ {
+@@ -564,6 +581,13 @@ symbolicBitVector<isSigned> symbolicBitVector<isSigned>::modularAdd(
+   return *this + op;
+ }
+ 
++template <bool isSigned>
++symbolicBitVector<isSigned> symbolicBitVector<isSigned>::modularSubtract(
++    const symbolicBitVector<isSigned>& op) const
++{
++  return *this - op;
++}
++
+ template <bool isSigned>
+ symbolicBitVector<isSigned> symbolicBitVector<isSigned>::modularNegate() const
+ {
+diff --git a/src/theory/fp/fp_word_blaster.h b/src/theory/fp/fp_word_blaster.h
+index 6ce365382..8179ceb32 100644
+--- a/src/theory/fp/fp_word_blaster.h
++++ b/src/theory/fp/fp_word_blaster.h
+@@ -242,6 +242,8 @@ class symbolicBitVector : public nodeWrapper
+   symbolicBitVector<isSigned> modularDecrement() const;
+   symbolicBitVector<isSigned> modularAdd(
+       const symbolicBitVector<isSigned>& op) const;
++  symbolicBitVector<isSigned> modularSubtract(
++      const symbolicBitVector<isSigned>& op) const;
+   symbolicBitVector<isSigned> modularNegate() const;
+ 
+   /*** Comparisons ***/
+diff --git a/src/util/floatingpoint_literal_symfpu_traits.cpp b/src/util/floatingpoint_literal_symfpu_traits.cpp
+index af56c2b87..181069427 100644
+--- a/src/util/floatingpoint_literal_symfpu_traits.cpp
++++ b/src/util/floatingpoint_literal_symfpu_traits.cpp
+@@ -223,6 +223,13 @@ wrappedBitVector<isSigned> wrappedBitVector<isSigned>::modularAdd(
+   return *this + op;
+ }
+ 
++template <bool isSigned>
++wrappedBitVector<isSigned> wrappedBitVector<isSigned>::modularSubtract(
++    const wrappedBitVector<isSigned>& op) const
++{
++  return *this - op;
++}
++
+ template <bool isSigned>
+ wrappedBitVector<isSigned> wrappedBitVector<isSigned>::modularNegate() const
+ {
+diff --git a/src/util/floatingpoint_literal_symfpu_traits.h b/src/util/floatingpoint_literal_symfpu_traits.h
+index 78fc69a18..b49ef3a2a 100644
+--- a/src/util/floatingpoint_literal_symfpu_traits.h
++++ b/src/util/floatingpoint_literal_symfpu_traits.h
+@@ -199,6 +199,8 @@ class wrappedBitVector : public BitVector
+   wrappedBitVector<isSigned> modularDecrement() const;
+   wrappedBitVector<isSigned> modularAdd(
+       const wrappedBitVector<isSigned>& op) const;
++  wrappedBitVector<isSigned> modularSubtract(
++      const wrappedBitVector<isSigned>& op) const;
+   wrappedBitVector<isSigned> modularNegate() const;
+ 
+   /** Bit-vector equality. */
+diff --git a/test/regress/cli/CMakeLists.txt b/test/regress/cli/CMakeLists.txt
+index 915a19e09..35ff58bc7 100644
+--- a/test/regress/cli/CMakeLists.txt
++++ b/test/regress/cli/CMakeLists.txt
+@@ -949,12 +949,15 @@ set(regress_0_tests
+   regress0/fp/issue6164.smt2
+   regress0/fp/issue7002.smt2
+   regress0/fp/issue7569.smt2
++  regress0/fp/issue9505.smt2
+   regress0/fp/issue9854.smt2
+   regress0/fp/issue9858.smt2
+   regress0/fp/issue9864.smt2
+   regress0/fp/issue9966.smt2
+   regress0/fp/issue9972.smt2
+   regress0/fp/issue9972-2.smt2
++  regress0/fp/issue11139.smt2
++  regress0/fp/issue12335.smt2
+   regress0/fp/issuepr650.smt2
+   regress0/fp/proj-issue329-prereg-context.smt2
+   regress0/fp/proj-issue477-fp-set-comprehension.smt2
+diff --git a/test/regress/cli/regress0/fp/issue11139.smt2 b/test/regress/cli/regress0/fp/issue11139.smt2
+new file mode 100644
+index 000000000..f4c00360e
+--- /dev/null
++++ b/test/regress/cli/regress0/fp/issue11139.smt2
+@@ -0,0 +1,9 @@
++; COMMAND-LINE: --check-models
++; EXPECT: sat
++(set-logic QF_FP)
++(declare-const FP_VAR_a (_ FloatingPoint 11 53))
++(declare-const FP_VAR_b (_ FloatingPoint 11 53))
++(assert ( = (fp #b0 #b00000000000 #b0000000000000000000000000000000000000000000000000000)
++(fp.div RTN (fp.fma RTP FP_VAR_a FP_VAR_a 
++(fp #b0 #b00000000000 #b0000000000000000000000000000000000000000000000000000)) FP_VAR_b)))
++(check-sat)
+diff --git a/test/regress/cli/regress0/fp/issue12335.smt2 b/test/regress/cli/regress0/fp/issue12335.smt2
+new file mode 100644
+index 000000000..bc2580a89
+--- /dev/null
++++ b/test/regress/cli/regress0/fp/issue12335.smt2
+@@ -0,0 +1,7 @@
++; EXPECT: sat
++(set-logic FP)
++(declare-const x Float32)
++(declare-const a Float32)
++(assert (forall ((V Float32) (A Float32)) (or (not (fp.lt V x)) (not (fp.eq a a)) (not (fp.gt A (fp (_ bv0 1) (_ bv0 8) (_ bv0 23)))) (not (fp.eq (fp.div RNE A V) (fp (_ bv0 1) (_ bv0 8) (_ bv0 23)))))))
++(assert (fp.geq a (fp (_ bv0 1) (_ bv0 8) (_ bv0 23))))
++(check-sat)
+diff --git a/test/regress/cli/regress0/fp/issue9505.smt2 b/test/regress/cli/regress0/fp/issue9505.smt2
+new file mode 100644
+index 000000000..05674b8ff
+--- /dev/null
++++ b/test/regress/cli/regress0/fp/issue9505.smt2
+@@ -0,0 +1,6 @@
++; COMMAND-LINE: --fp-exp
++; EXPECT: sat
++(set-logic QF_FP)
++(declare-fun m () (_ FloatingPoint 4 12))
++(assert (fp.eq (fp (_ bv0 1) (_ bv0 8) (_ bv0 23)) ((_ to_fp 8 24) roundNearestTiesToEven (fp.rem m (fp (_ bv0 1) (_     bv9 4) (_ bv1536 11))))))
++(check-sat)

gnu/packages/patches/r-biostrings-r4.6.0-compat.patch

@@ -0,0 +1,513 @@
+This patch shas been backported from the development version or Biostrings.
+
+From 100602242840322b5f6c267faaf8198c1a5aa2af Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Thu, 5 Mar 2026 22:36:30 -0800
+Subject: [PATCH] Biostrings 2.79.5: Get rid of never-used SparseMIndex and
+ SparseList classes
+
+This also eliminates the non-API calls to R.
+---
+ DESCRIPTION                 |   3 +-
+ NAMESPACE                   |   2 -
+ R/MIndex-class.R            |  79 -------------------------
+ R/SparseList-class.R        |  80 -------------------------
+ man/Biostrings-internals.Rd |   9 ---
+ src/Biostrings.h            |  41 -------------
+ src/MIndex_class.c          |  67 ---------------------
+ src/R_init_Biostrings.c     |   1 -
+ src/SparseList_utils.c      | 113 ------------------------------------
+ 9 files changed, 1 insertion(+), 394 deletions(-)
+ delete mode 100644 R/SparseList-class.R
+ delete mode 100644 src/SparseList_utils.c
+
+diff --git a/DESCRIPTION b/DESCRIPTION
+index a5d027cc..dbc323ea 100644
+--- a/DESCRIPTION
++++ b/DESCRIPTION
+@@ -76,3 +76,3 @@ Collate: utils.R IUPAC_CODE_MAP.R AMINO_ACID_CODE.R GENETIC_CODE.R
+         injectHardMask.R padAndClip.R strsplit-methods.R misc.R
+-        SparseList-class.R MIndex-class.R lowlevel-matching.R
++        MIndex-class.R lowlevel-matching.R
+         match-utils.R matchPattern.R maskMotif.R matchLRPatterns.R
+diff --git a/NAMESPACE b/NAMESPACE
+index ba1e3bfa..cf14db67 100644
+--- a/NAMESPACE
++++ b/NAMESPACE
+@@ -206,7 +206,6 @@ exportMethods(
+ ### ==========================================================================
+ ### STRING MATCHING
+ ### --------------------------------------------------------------------------
+-###   SparseList-class.R
+ ###   MIndex-class.R
+ ###   lowlevel-matching.R
+ ###   match-utils.R
+@@ -220,7 +219,6 @@ exportMethods(
+ ###   matchPDict.R
+ 
+ exportClasses(
+-    #SparseList,
+     MIndex, ByPos_MIndex,
+     PreprocessedTB, Twobit, ACtree2,
+     PDict3Parts,
+diff --git a/R/MIndex-class.R b/R/MIndex-class.R
+index 022f6746..f50f215e 100644
+--- a/R/MIndex-class.R
++++ b/R/MIndex-class.R
+@@ -218,82 +218,3 @@ ByPos_MIndex.combine <- function(mi_list)
+     new("ByPos_MIndex", width0=ans_width0, NAMES=ans_names, ends=ans_ends)
+ }
+ 
+-
+-### - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+-### The "SparseMIndex" class (DISABLED FOR NOW).
+-### 
+-### Slot description:
+-###
+-###   ends_envir: a key-value list (environment) where the values are integer
+-###       vectors containing the ending positions of the pattern whose
+-###       position in the original dictionary is given by the key (the keys are
+-###       strings representing positive integers).
+-### 
+-
+-if (FALSE) {
+-
+-  setClass("SparseMIndex",
+-    contains="MIndex",
+-    representation(
+-        ends_envir="environment"
+-    )
+-  )
+-
+-  setMethod("show", "SparseMIndex",
+-    function(object)
+-    {
+-        cat("Sparse MIndex object of length ", length(object), "\n", sep="")
+-    }
+-  )
+-
+-  setMethod("[[", "SparseMIndex",
+-    function(x, i, j, ...)
+-    {
+-        i <- normalizeDoubleBracketSubscript(i, x)
+-        ans_end <- x@ends_envir[[formatC(i, width=10, format="d", flag="0")]]
+-        if (is.null(ans_end))
+-            ans_end <- integer(0)
+-        ans_width <- rep.int(x@width0[i], length(ans_end))
+-        ans_start <- ans_end - x@width0[i] + 1L
+-        new2("IRanges", start=ans_start, width=ans_width, check=FALSE)
+-    }
+-  )
+-
+-  ### An example of a SparseMIndex object of length 5 where only the
+-  ### 2nd pattern has matches:
+-  ###   > width0 <- c(9L, 10L, 8L, 4L, 10L)
+-  ###   > ends_envir <- new.env(hash=TRUE, parent=emptyenv())
+-  ###   > ends_envir[['0000000002']] <- c(199L, 402L)
+-  ###   > mindex <- new("SparseMIndex", width0=width0, NAMES=letters[1:5], ends_envir=ends_envir)
+-  ###   > mindex[[1]]
+-  ###   > mindex[[2]]
+-  ###   > mindex[[6]] # Error in mindex[[6]] : subscript out of bounds
+-  ###   > names(mindex)
+-  ###   > mindex[["a"]]
+-  ###   > mindex[["b"]]
+-  ###   > mindex[["aa"]] # Error in mindex[["aa"]] : pattern name ‘aa’ not found
+-  ###   > startIndex(mindex)
+-  ###   > endIndex(mindex)
+-  ###   > elementNROWS(mindex)
+-  ###
+-  setMethod("startIndex", "SparseMIndex",
+-    function(x)
+-    {
+-        all.names <- TRUE
+-        .Call2("SparseMIndex_endIndex",
+-              x@ends_envir, x@width0, x@NAMES, all.names,
+-              PACKAGE="Biostrings")
+-    }
+-  )
+-  setMethod("endIndex", "SparseMIndex",
+-    function(x)
+-    {
+-        all.names <- TRUE
+-        .Call2("SparseMIndex_endIndex",
+-              x@ends_envir, NULL, x@NAMES, all.names,
+-              PACKAGE="Biostrings")
+-    }
+-  )
+-
+-}
+-
+diff --git a/R/SparseList-class.R b/R/SparseList-class.R
+deleted file mode 100644
+index 8295fd0f..00000000
+--- a/R/SparseList-class.R
++++ /dev/null
+@@ -1,80 +0,0 @@
+-### =========================================================================
+-### SparseList objects
+-### -------------------------------------------------------------------------
+-###
+-
+-setClass("SparseList",
+-    representation(
+-        length="integer",
+-        env="environment"
+-    )
+-)
+-
+-### Typical use:
+-###   env <- new.env(hash=TRUE, parent=emptyenv())
+-###   key <- formatC(98L, width=10, format="d", flag="0")
+-###   value <- 3:-2
+-###   assign(key, value, envir=env)
+-###   x <- new("SparseList", length=100L, env=env)
+-###   length(x)
+-###   ls(x)
+-###   ls(x, all.names=TRUE)
+-###   as.list(x)
+-###   as.list(x, all.names=TRUE)
+-###   x[[1]]
+-###   x[[98]
+-###   x[[101]]]
+-###
+-
+-setMethod("length", "SparseList", function(x) x@length)
+-
+-### 'pos', 'envir' and 'pattern' args are ignored
+-setMethod("ls", signature(name="SparseList"),
+-    function(name, pos, envir, all.names=FALSE, pattern)
+-    {
+-        if (!all.names)
+-            return(ls(name@env, all.names=TRUE))
+-        seq_len(length(name))
+-    }
+-)
+-
+-setMethod("as.list", "SparseList",
+-    function(x, all.names=FALSE, ...)
+-    {
+-        if (!all.names)
+-            return(as.list(x@env, all.names=TRUE))
+-        ans <- vector(mode="list", length=length(x))
+-        symbols <- ls(x)
+-        for (symb in symbols)
+-            ans[[as.integer(symb)]] <- get(symb, envir=x@env)
+-        ans
+-    }
+-)
+-
+-### Supported 'i' types: character or numeric vector of length 1.
+-setMethod("[[", "SparseList",
+-    function(x, i, j, ...)
+-    {
+-        if (!missing(j) || length(list(...)) > 0)
+-            stop("invalid subsetting")
+-        if (missing(i))
+-            stop("subscript is missing")
+-        if (!is.character(i) && !is.numeric(i))
+-            stop("invalid subscript type")
+-        if (length(i) < 1L)
+-            stop("attempt to select less than one element")
+-        if (length(i) > 1L)
+-            stop("attempt to select more than one element")
+-        if (is.na(i))
+-            stop("subscript cannot be NA")
+-        if (is.character(i))
+-            return(get(i, envir=x@env))
+-        if (!is.integer(i))
+-            i <- as.integer(i)
+-        if (i < 1L || i > length(x))
+-            stop("subscript out of bounds")
+-        i <- formatC(i, width=10, format="d", flag="0")
+-        get(i, envir=x@env)
+-    }
+-)
+-
+diff --git a/man/Biostrings-internals.Rd b/man/Biostrings-internals.Rd
+index 791b0870..609b7694 100644
+--- a/man/Biostrings-internals.Rd
++++ b/man/Biostrings-internals.Rd
+@@ -26,15 +26,6 @@
+ \alias{make_XStringSet_from_strings}
+ \alias{make_XStringSet_from_strings,XStringSet-method}
+ 
+-% SparseList class and methods:
+-\alias{class:SparseList}
+-\alias{SparseList-class}
+-\alias{SparseList}
+-
+-\alias{length,SparseList-method}
+-%\alias{ls,SparseList-method}
+-\alias{as.list,SparseList-method}
+-\alias{[[,SparseList-method}
+ 
+ \title{Biostrings internals}
+ 
+diff --git a/src/Biostrings.h b/src/Biostrings.h
+index 6e725bd5..e86d0ff2 100644
+--- a/src/Biostrings.h
++++ b/src/Biostrings.h
+@@ -446,40 +446,6 @@ SEXP XStringSetList_unstrsplit(
+ );
+ 
+ 
+-/* SparseList_utils.c */
+-
+-SEXP _SparseList_int2symb(int symb_as_int);
+-
+-int _SparseList_symb2int(SEXP symbol);
+-
+-SEXP _get_val_from_env(
+-	SEXP symbol,
+-	SEXP env,
+-	int error_on_unbound_value
+-);
+-
+-SEXP _get_val_from_SparseList(
+-	int symb_as_int,
+-	SEXP env,
+-	int error_on_unbound_value
+-);
+-
+-int _get_int_from_SparseList(
+-	int symb_as_int,
+-	SEXP env
+-);
+-
+-void _set_env_from_IntAE(
+-	SEXP env,
+-	const IntAE *int_ae
+-);
+-
+-void _set_env_from_IntAEAE(
+-	SEXP env,
+-	const IntAEAE *int_aeae
+-);
+-
+-
+ /* match_reporting.c */
+ 
+ int _get_match_storing_code(const char *ms_mode);
+@@ -558,13 +524,6 @@ SEXP ByPos_MIndex_endIndex(
+ 	SEXP x_width0
+ );
+ 
+-SEXP SparseMIndex_endIndex(
+-	SEXP x_ends_envir,
+-	SEXP x_width0,
+-	SEXP x_names,
+-	SEXP all_names
+-);
+-
+ SEXP ByPos_MIndex_combine(SEXP ends_listlist);
+ 
+ 
+diff --git a/src/MIndex_class.c b/src/MIndex_class.c
+index 00212fe9..dd6ad546 100644
+--- a/src/MIndex_class.c
++++ b/src/MIndex_class.c
+@@ -157,73 +157,6 @@ SEXP ByPos_MIndex_endIndex(SEXP x_high2low, SEXP x_ends, SEXP x_width0)
+ 	return ans;
+ }
+ 
+-/*
+- * --- .Call ENTRY POINT ---
+- * All the keys in 'x_ends_envir' must be representing integers left-padded with 0s
+- * so they have the same length. This works properly:
+-     library(Biostrings)
+-     ends_envir <- new.env(parent=emptyenv())
+-     ends_envir[['0000000010']] <- -2:1
+-     ends_envir[['0000000004']] <- 9:6
+-     .Call("SparseMIndex_endIndex",
+-           ends_envir, NULL, letters[1:10], TRUE,
+-           PACKAGE="Biostrings")
+-     .Call("SparseMIndex_endIndex",
+-           ends_envir, NULL, letters[1:10], FALSE,
+-           PACKAGE="Biostrings")
+- * but this doesn't:
+-     ends_envir[['3']] <- 33L
+-     .Call("SparseMIndex_endIndex",
+-           ends_envir, NULL, letters[1:10], FALSE,
+-           PACKAGE="Biostrings")
+- */
+-SEXP SparseMIndex_endIndex(SEXP x_ends_envir, SEXP x_width0, SEXP x_names, SEXP all_names)
+-{
+-	SEXP ans, ans_elt, ans_names, symbols, end;
+-	int nelt, i, j;
+-	IntAE *poffsets, *poffsets_order;
+-
+-	PROTECT(symbols = R_lsInternal(x_ends_envir, 1));
+-	poffsets = new_IntAE_from_CHARACTER(symbols, -1);
+-	nelt = IntAE_get_nelt(poffsets);
+-	if (LOGICAL(all_names)[0]) {
+-		PROTECT(ans = NEW_LIST(LENGTH(x_names)));
+-		for (i = 0; i < nelt; i++) {
+-			j = poffsets->elts[i];
+-			end = _get_val_from_env(STRING_ELT(symbols, i), x_ends_envir, 1);
+-			PROTECT(ans_elt = duplicate(end));
+-			if (x_width0 != R_NilValue)
+-				add_val_to_INTEGER(ans_elt, 1 - INTEGER(x_width0)[j]);
+-			SET_ELEMENT(ans, j, ans_elt);
+-			UNPROTECT(1);
+-		}
+-		SET_NAMES(ans, duplicate(x_names));
+-		UNPROTECT(1);
+-	} else {
+-		//poffsets_order = new_IntAE(nelt, 0, 0);
+-		//get_order_of_int_array(poffsets->elts, nelt, 0, 0,
+-		//		       poffsets_order->elts, 0);
+-		//IntAE_set_nelt(poffsets_order) = nelt; /* = poffsets_order->_buflength */
+-		PROTECT(ans = NEW_LIST(nelt));
+-		PROTECT(ans_names = NEW_CHARACTER(nelt));
+-		for (i = 0; i < nelt; i++) {
+-			//j = poffsets_order->elts[i];
+-			j = i;
+-			end = _get_val_from_env(STRING_ELT(symbols, j), x_ends_envir, 1);
+-			PROTECT(ans_elt = duplicate(end));
+-			if (x_width0 != R_NilValue)
+-				add_val_to_INTEGER(ans_elt, 1 - INTEGER(x_width0)[i]);
+-			SET_ELEMENT(ans, i, ans_elt);
+-			UNPROTECT(1);
+-			SET_STRING_ELT(ans_names, i, duplicate(STRING_ELT(x_names, poffsets->elts[j])));
+-		}
+-		SET_NAMES(ans, ans_names);
+-		UNPROTECT(2);
+-	}
+-	UNPROTECT(1);
+-	return ans;
+-}
+-
+ /*
+  * --- .Call ENTRY POINT ---
+  */
+diff --git a/src/R_init_Biostrings.c b/src/R_init_Biostrings.c
+index 4d2943f8..c1410dbd 100644
+--- a/src/R_init_Biostrings.c
++++ b/src/R_init_Biostrings.c
+@@ -88,7 +88,6 @@ static const R_CallMethodDef callMethods[] = {
+ 
+ /* MIndex_class.c */
+ 	CALLMETHOD_DEF(ByPos_MIndex_endIndex, 3),
+-	CALLMETHOD_DEF(SparseMIndex_endIndex, 4),
+ 	CALLMETHOD_DEF(ByPos_MIndex_combine, 1),
+ 
+ /* lowlevel_matching.c */
+diff --git a/src/SparseList_utils.c b/src/SparseList_utils.c
+deleted file mode 100644
+index 18597b55..00000000
+--- a/src/SparseList_utils.c
++++ /dev/null
+@@ -1,113 +0,0 @@
+-/****************************************************************************
+- *                        Fast SparseList utilities                         *
+- *                            Author: H. Pag\`es                            *
+- ****************************************************************************/
+-#include "Biostrings.h"
+-#include "S4Vectors_interface.h"
+-
+-
+-SEXP _SparseList_int2symb(int symb_as_int)
+-{
+-	char symbbuf[11];
+-
+-	snprintf(symbbuf, sizeof(symbbuf), "%010d", symb_as_int);
+-	return mkChar(symbbuf); /* UNPROTECTED! */
+-}
+-
+-int _SparseList_symb2int(SEXP symbol)
+-{
+-	int symb_as_int;
+-
+-	sscanf(CHAR(symbol), "%d", &symb_as_int);
+-	return symb_as_int;
+-}
+-
+-/* 'symbol' must be a CHARSXP */
+-SEXP _get_val_from_env(SEXP symbol, SEXP env, int error_on_unbound_value)
+-{
+-	SEXP ans;
+-
+-	/* The following code was inspired by R's do_get() code.
+-	 * Note that do_get() doesn't use PROTECT at all and so do we...
+-	 */
+-	ans = findVar(install(translateChar(symbol)), env);
+-	if (ans == R_UnboundValue) {
+-		if (error_on_unbound_value)
+-			error("Biostrings internal error in _get_val_from_env(): "
+-			      "unbound value");
+-		return R_UnboundValue;
+-	}
+-	if (TYPEOF(ans) == PROMSXP)
+-		ans = eval(ans, env);
+-	if (ans != R_NilValue && NAMED(ans) == 0)
+-		SET_NAMED(ans, 1);
+-	return ans;
+-}
+-
+-SEXP _get_val_from_SparseList(int symb_as_int, SEXP env, int error_on_unbound_value)
+-{
+-	SEXP symbol, ans;
+-
+-	PROTECT(symbol = _SparseList_int2symb(symb_as_int));
+-	ans = _get_val_from_env(symbol, env, error_on_unbound_value);
+-	UNPROTECT(1);
+-	return ans;
+-}
+-
+-int _get_int_from_SparseList(int symb_as_int, SEXP env)
+-{
+-	SEXP value;
+-	int val;
+-
+-	value = _get_val_from_SparseList(symb_as_int, env, 0);
+-	if (value == R_UnboundValue)
+-		return NA_INTEGER;
+-	if (LENGTH(value) != 1)
+-		error("Biostrings internal error in _get_int_from_SparseList(): "
+-		      "value is not a single integer");
+-	val = INTEGER(value)[0];
+-	if (val == NA_INTEGER)
+-		error("Biostrings internal error in _get_int_from_SparseList(): "
+-		      "value is NA");
+-	return val;
+-}
+-
+-void _set_env_from_IntAE(SEXP env, const IntAE *int_ae)
+-{
+-	int nelt, symb_as_int, elt;
+-	SEXP symbol, value;
+-
+-	nelt = IntAE_get_nelt(int_ae);
+-	for (symb_as_int = 1; symb_as_int <= nelt; symb_as_int++)
+-	{
+-		elt = int_ae->elts[symb_as_int - 1];
+-		if (elt == NA_INTEGER)
+-			continue;
+-		PROTECT(symbol = _SparseList_int2symb(symb_as_int));
+-		PROTECT(value = ScalarInteger(elt));
+-		defineVar(install(translateChar(symbol)), value, env);
+-		UNPROTECT(2);
+-	}
+-	return;
+-}
+-
+-void _set_env_from_IntAEAE(SEXP env, const IntAEAE *int_aeae)
+-{
+-	int nelt, symb_as_int;
+-	IntAE *ae;
+-	SEXP symbol, value;
+-
+-	nelt = IntAEAE_get_nelt(int_aeae);
+-	for (symb_as_int = 1; symb_as_int <= nelt; symb_as_int++)
+-	{
+-		ae = int_aeae->elts[symb_as_int - 1];
+-		if (IntAE_get_nelt(ae) == 0)
+-			continue;
+-		PROTECT(symbol = _SparseList_int2symb(symb_as_int));
+-		PROTECT(value = new_INTEGER_from_IntAE(ae));
+-		defineVar(install(translateChar(symbol)), value, env);
+-		UNPROTECT(2);
+-	}
+-	return;
+-}
+-

gnu/packages/patches/r-h5mread-0001-h5mread-1.3.2-Get-rid-of-non-API-calls-to-R.patch

@@ -0,0 +1,142 @@
+From 7fe34542bff0183c3a6a35a62df9035a71698eb2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 15:54:23 -0800
+Subject: [PATCH] h5mread 1.3.2: Get rid of non-API calls to R
+
+---
+ DESCRIPTION                |  2 +-
+ R/H5File-class.R           | 27 ++++++++++++++++-----------
+ src/h5mread_index.c        |  5 +++--
+ src/h5mread_startscounts.c |  3 ++-
+ 4 files changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/R/H5File-class.R b/R/H5File-class.R
+index 2735166..6aeb80f 100644
+--- a/R/H5File-class.R
++++ b/R/H5File-class.R
+@@ -73,19 +73,23 @@
+     }
+ }
+ 
+-.h5openfile <- function(filepath, s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
++.h5openfile <- function(filepath, readonly=TRUE,
++                        s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
+ {
+     if (!isSingleString(filepath))
+         stop(wmsg("'filepath' must be a single string specifying ",
+                   "the path or URL to an HDF5 file"))
++    if (!isTRUEorFALSE(readonly))
++        stop(wmsg("'readonly' must be TRUE or FALSE"))
+     if (!isTRUEorFALSE(s3))
+         stop(wmsg("'s3' must be TRUE or FALSE"))
+-
++    if (s3 && !readonly)
++        stop(wmsg("'readonly' must be set to TRUE when 's3' is TRUE"))
+     if (s3) {
+         ID <- .h5openS3file(filepath, s3credentials=s3credentials,
+                                       use.rhdf5=use.rhdf5)
+     } else {
+-        ID <- .h5openlocalfile(filepath, readonly=TRUE, use.rhdf5=use.rhdf5)
++        ID <- .h5openlocalfile(filepath, readonly=readonly, use.rhdf5=use.rhdf5)
+     }
+     ID
+ }
+@@ -136,16 +140,16 @@
+ 
+ .ID_is_closed <- function(ID) { is.null(ID) || is.na(ID) }
+ 
+-.open_H5FileID_xp <- function(xp, filepath, s3=FALSE, s3credentials=NULL,
+-                                            use.rhdf5=FALSE)
++.open_H5FileID_xp <- function(xp, filepath, readonly=TRUE,
++                              s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
+ {
+     ID <- .get_H5FileID_xp_ID(xp)
+     if (!.ID_is_closed(ID)) {
+         ## H5FileID object is already open.
+         return(FALSE)
+     }
+-    ID <- .h5openfile(filepath, s3=s3, s3credentials=s3credentials,
+-                                use.rhdf5=use.rhdf5)
++    ID <- .h5openfile(filepath, readonly=readonly,
++                      s3=s3, s3credentials=s3credentials, use.rhdf5=use.rhdf5)
+     .set_H5FileID_xp_ID(xp, ID)
+     TRUE
+ }
+@@ -183,10 +187,11 @@ close.H5FileID <- function(con, ...)
+     .close_H5FileID_xp(con@xp, ..., use.rhdf5=con@from_rhdf5)
+ }
+ 
+-H5FileID <- function(filepath, s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
++H5FileID <- function(filepath, readonly=TRUE,
++                     s3=FALSE, s3credentials=NULL, use.rhdf5=FALSE)
+ {
+-    ID <- .h5openfile(filepath, s3=s3, s3credentials=s3credentials,
+-                                use.rhdf5=use.rhdf5)
++    ID <- .h5openfile(filepath, readonly=readonly,
++                      s3=s3, s3credentials=s3credentials, use.rhdf5=use.rhdf5)
+     xp <- .new_H5FileID_xp(ID)
+     reg.finalizer(xp,
+                   function(e) .close_H5FileID_xp(e, use.rhdf5=use.rhdf5),
+@@ -272,7 +277,7 @@ H5File <- function(filepath, s3=FALSE, s3credentials=NULL, .no_rhdf5_h5id=FALSE)
+         rhdf5_h5id <- new("H5FileID")
+     } else {
+         rhdf5_h5id <- H5FileID(filepath, s3=s3, s3credentials=s3credentials,
+-                                         use.rhdf5=TRUE)
++                               use.rhdf5=TRUE)
+     }
+     if (!s3)
+         filepath <- file_path_as_absolute(filepath)
+diff --git a/src/h5mread_index.c b/src/h5mread_index.c
+index 7284815..ec93c25 100644
+--- a/src/h5mread_index.c
++++ b/src/h5mread_index.c
+@@ -9,6 +9,7 @@
+ #include "h5mread_helpers.h"
+ #include "TouchedChunks.h"
+ 
++#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <stdlib.h>  /* for malloc, free */
+ #include <string.h>  /* for memcmp */
+ //#include <time.h>
+@@ -444,7 +445,7 @@ static int read_chunk_data_4_5(const H5DSetDescriptor *h5dset,
+ 		const size_t *Rarray_dim, SEXP Rarray,
+ 		int method, int use_H5Dread_chunk)
+ {
+-	void *out = DATAPTR(Rarray);
++	void *out = DATAPTR_RW(Rarray);
+ 	if (out == NULL)
+ 		return -1;
+ 
+@@ -874,7 +875,7 @@ static int read_data_6(const AllTChunks *all_tchunks,
+ 	size_t *inner_nchip_buf = R_alloc0_size_t_array(ndim);
+ 	LLongAEAE *inner_breakpoint_bufs = new_LLongAEAE(ndim, ndim);
+ 
+-	void *out = DATAPTR(Rarray);
++	void *out = DATAPTR_RW(Rarray);
+ 	if (out == NULL) {
+ 		_destroy_TChunkIterator(&tchunk_iter);
+ 		return -1;
+diff --git a/src/h5mread_startscounts.c b/src/h5mread_startscounts.c
+index de57fd5..959014f 100644
+--- a/src/h5mread_startscounts.c
++++ b/src/h5mread_startscounts.c
+@@ -8,6 +8,7 @@
+ #include "uaselection.h"
+ #include "h5mread_helpers.h"
+ 
++#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <stdlib.h>  /* for malloc, free */
+ //#include <time.h>
+ 
+@@ -402,7 +403,7 @@ SEXP _h5mread_startscounts(const H5DSetDescriptor *h5dset,
+ 	SEXP ans = PROTECT(allocVector(h5dset->h5type->Rtype, ans_len));
+ 
+ 	if (ans_len != 0) {
+-		void *mem = DATAPTR(ans);
++		void *mem = DATAPTR_RW(ans);
+ 		if (mem == NULL)
+ 			goto on_error;
+ 
+-- 
+2.52.0
+

gnu/packages/patches/r-mscoreutils-0001-fix-non-API-call-to-R-SETLENGTH-by-using-lengthgets.patch

@@ -0,0 +1,67 @@
+From a827c9fdeb77edefe6cca81bdb9e0344bc8d3742 Mon Sep 17 00:00:00 2001
+From: Sebastian Gibb <mail@sebastiangibb.de>
+Date: Sat, 13 Dec 2025 23:06:12 +0100
+Subject: [PATCH] fix: non-API call to R: SETLENGTH by using lengthgets
+
+---
+ DESCRIPTION  |  2 +-
+ NEWS.md      |  6 ++++++
+ src/join.c   | 12 ++++--------
+ src/reduce.c |  6 ++----
+ 4 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/src/join.c b/src/join.c
+index f13a703..3849fdf 100644
+--- a/src/join.c
++++ b/src/join.c
+@@ -111,12 +111,10 @@ SEXP C_join_inner(SEXP x, SEXP y, SEXP tolerance, SEXP nomatch) {
+             ++j;
+         }
+     }
+-    SETLENGTH(rx, j);
+-    SETLENGTH(ry, j);
+     SEXP out = PROTECT(allocVector(VECSXP, 2));
+     SEXP nms = PROTECT(allocVector(STRSXP, 2));
+-    SET_VECTOR_ELT(out, 0, rx);
+-    SET_VECTOR_ELT(out, 1, ry);
++    SET_VECTOR_ELT(out, 0, lengthgets(rx, j));
++    SET_VECTOR_ELT(out, 1, lengthgets(ry, j));
+     SET_STRING_ELT(nms, 0, mkChar("x"));
+     SET_STRING_ELT(nms, 1, mkChar("y"));
+     setAttrib(out, R_NamesSymbol, nms);
+@@ -201,12 +199,10 @@ SEXP C_join_outer(SEXP x, SEXP y, SEXP tolerance, SEXP nomatch) {
+         ++i;
+     }
+ 
+-    SETLENGTH(rx, i);
+-    SETLENGTH(ry, i);
+     SEXP out = PROTECT(allocVector(VECSXP, 2));
+     SEXP nms = PROTECT(allocVector(STRSXP, 2));
+-    SET_VECTOR_ELT(out, 0, rx);
+-    SET_VECTOR_ELT(out, 1, ry);
++    SET_VECTOR_ELT(out, 0, lengthgets(rx, i));
++    SET_VECTOR_ELT(out, 1, lengthgets(ry, i));
+     SET_STRING_ELT(nms, 0, mkChar("x"));
+     SET_STRING_ELT(nms, 1, mkChar("y"));
+     setAttrib(out, R_NamesSymbol, nms);
+diff --git a/src/reduce.c b/src/reduce.c
+index 5f87966..8e48058 100644
+--- a/src/reduce.c
++++ b/src/reduce.c
+@@ -66,11 +66,9 @@ SEXP C_reduce(SEXP start, SEXP end, SEXP check) {
+         }
+     }
+ 
+-    SETLENGTH(rs, pos + 1);
+-    SETLENGTH(re, pos + 1);
+     SEXP out = PROTECT(allocVector(VECSXP, 2));
+-    SET_VECTOR_ELT(out, 0, rs);
+-    SET_VECTOR_ELT(out, 1, re);
++    SET_VECTOR_ELT(out, 0, lengthgets(rs, pos + 1));
++    SET_VECTOR_ELT(out, 1, lengthgets(re, pos + 1));
+ 
+     UNPROTECT(4);
+ 
+-- 
+2.52.0
+

gnu/packages/patches/r-rsamtools-r-4.6.0-compat.patch

@@ -0,0 +1,114 @@
+From 57dc6579d8b53af9e633016705fa9a1cbe58c8c8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 16:48:20 -0800
+Subject: [PATCH] Rsamtools 2.27.1: Get rid of non-API calls to R
+
+---
+ DESCRIPTION     | 2 +-
+ src/utilities.h | 3 +--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/utilities.h b/src/utilities.h
+index bffb98f7..f9d5e09f 100644
+--- a/src/utilities.h
++++ b/src/utilities.h
+@@ -51,8 +51,7 @@ SEXP find_mate_within_groups(SEXP group_sizes,
+ /* call-building macros */
+ 
+ #define NEW_CALL(S, T, NAME, ENV, N)            \
+-    PROTECT(S = T = allocList(N));              \
+-    SET_TYPEOF(T, LANGSXP);                     \
++    PROTECT(S = T = LCONS(R_NilValue, allocList(N-1))); \
+     SETCAR(T, findFun(install(NAME), ENV));     \
+     T = CDR(T)
+ #define CSET_CDR(T, NAME, VALUE)                \
+
+From 8cdec143023e8348a4f8bdc310acd609d14fe493 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 16:59:42 -0800
+Subject: [PATCH] oops, forgot to also get rid of non-API call to FORMALS()
+
+---
+ src/pileupbam.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pileupbam.c b/src/pileupbam.c
+index f3256ba..7725628 100644
+--- a/src/pileupbam.c
++++ b/src/pileupbam.c
+@@ -655,7 +655,7 @@ SEXP apply_pileups(SEXP files, SEXP names, SEXP regions, SEXP param,
+     if (R_NilValue == regions)
+         Rf_error("'NULL' regions not (yet) supported");
+     _checkparams(regions, R_NilValue, R_NilValue);
+-    if (!Rf_isFunction(callback) || 1L != Rf_length(FORMALS(callback)))
++    if (!Rf_isFunction(callback) || 1L != Rf_length(R_ClosureFormals(callback)))
+         Rf_error("'callback' must be a function of 1 argument");
+     call = PROTECT(Rf_lang2(callback, R_NilValue));
+ 
+
+From ee01a1f13f3b012b0717247d1f21580225b6f3a0 Mon Sep 17 00:00:00 2001
+From: vjcitn <stvjc@channing.harvard.edu>
+Date: Wed, 8 Apr 2026 14:04:26 -0400
+Subject: [PATCH] API solutions
+
+---
+ DESCRIPTION     |  2 +-
+ src/tabixfile.c |  4 ++++
+ src/utilities.c | 13 ++++++++++---
+ 3 files changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/src/tabixfile.c b/src/tabixfile.c
+index 230a381..6f96568 100644
+--- a/src/tabixfile.c
++++ b/src/tabixfile.c
+@@ -187,8 +187,12 @@ SEXP index_tabix(SEXP filename, SEXP format, SEXP seq, SEXP begin, SEXP end,
+         LOGICAL(zeroBased)[0] == TRUE)
+         conf.preset |= TBX_UCSC;
+ 
++/* following is deprecated in HTSLIB with no precise replacement proposed */
++/* seems unimportant */
++/*
+     if (bgzf_is_bgzf(fn) != 1)
+         Rf_error("file does not appear to be bgzip'd");
++*/
+     if (tbx_index_build(fn, 0, &conf) == -1)
+         Rf_error("index build failed");
+ 
+diff --git a/src/utilities.c b/src/utilities.c
+index e224f91..d15c1d1 100644
+--- a/src/utilities.c
++++ b/src/utilities.c
+@@ -5,6 +5,13 @@
+ #include "XVector_interface.h"
+ #include <htslib/khash.h>
+ 
++#include <Rversion.h>
++
++#if R_VERSION < R_Version(4, 6, 0)
++# define R_getVar(x,y,z) findVar(x,y)
++#endif
++
++
+ void *_Rs_Realloc_impl(void *p, size_t n, size_t t)
+ {
+     /* R_Realloc(p, 0, *) fails inappropriately */
+@@ -30,7 +37,7 @@ SEXP _get_namespace(const char *pkg)
+ void _as_strand(SEXP vec)
+ {
+     SEXP nmspc = PROTECT(_get_namespace("Rsamtools"));
+-    SEXP lvls = PROTECT(eval(findVar(install(".STRAND_LEVELS"), nmspc), nmspc));
++    SEXP lvls = PROTECT(eval(R_getVar(install(".STRAND_LEVELS"), nmspc, TRUE), nmspc));
+     _as_factor_SEXP(vec, lvls);
+     UNPROTECT(2);
+ }
+@@ -38,8 +45,8 @@ void _as_strand(SEXP vec)
+ void _as_nucleotide(SEXP vec)
+ {
+     SEXP nmspc = PROTECT(_get_namespace("Rsamtools"));
+-    SEXP lvls = PROTECT(eval(findVar(install(".PILEUP_NUCLEOTIDE_LEVELS"),
+-                                     nmspc), nmspc));
++    SEXP lvls = PROTECT(eval(R_getVar(install(".PILEUP_NUCLEOTIDE_LEVELS"),
++                                     nmspc, TRUE), nmspc));
+     _as_factor_SEXP(vec, lvls);
+     UNPROTECT(2);
+ }

gnu/packages/patches/r-shortread-0001-ShortRead-1.69.3-Get-rid-of-non-API-calls-to-R.patch

@@ -0,0 +1,103 @@
+From e39852a54312bbc6ba435848890cc2a7f612357c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Fri, 6 Mar 2026 17:04:19 -0800
+Subject: [PATCH] ShortRead 1.69.3: Get rid of non-API calls to R
+
+---
+ DESCRIPTION |  2 +-
+ src/call.h  |  3 +--
+ src/io.c    | 10 +++++-----
+ 3 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/src/call.h b/src/call.h
+index e15bb5e..e72bbd6 100644
+--- a/src/call.h
++++ b/src/call.h
+@@ -6,8 +6,7 @@ extern "C" {
+ #endif
+ 
+ #define NEW_CALL(S, T, NAME, ENV, N)				\
+-    PROTECT((S) = (T) = allocList((N)));			\
+-    SET_TYPEOF((T), LANGSXP);                                   \
++    PROTECT((S) = (T) = LCONS(R_NilValue, allocList((N)-1)));	\
+     SETCAR((T), findFun(install((NAME)), (ENV)));               \
+     (T) = CDR((T))
+ #define CSET_CDR(T, NAME, VALUE)				\
+diff --git a/src/io.c b/src/io.c
+index 25a0111..9cf4bf8 100644
+--- a/src/io.c
++++ b/src/io.c
+@@ -46,9 +46,9 @@ SEXP write_fastq(SEXP id, SEXP sread, SEXP quality,
+                  SEXP fname, SEXP fmode, SEXP full, SEXP compress,
+                  SEXP max_width)
+ {
+-    if (!(IS_S4_OBJECT(id) && strcmp(get_classname(id), "BStringSet") == 0))
++    if (!(Rf_isS4(id) && strcmp(get_classname(id), "BStringSet") == 0))
+         Rf_error("'%s' must be '%s'", "id", "BStringSet");
+-    if (!(IS_S4_OBJECT(sread) &&
++    if (!(Rf_isS4(sread) &&
+           strcmp(get_classname(sread), "DNAStringSet") == 0))
+         Rf_error("'%s' must be '%s'", "sread", "DNAStringSet");
+     /* check in R -- C-level R_check_super... is not adequate */
+@@ -693,14 +693,14 @@ int _solexa_export_make_id(SEXP result)
+         *x = INTEGER(VECTOR_ELT(result, SLX_X)),
+         *y = INTEGER(VECTOR_ELT(result, SLX_Y)), *pairedReadNumber = NULL;
+     const SEXP
+-        * run = STRING_PTR(VECTOR_ELT(result, SLX_RUN)),
++        * run = STRING_PTR_RO(VECTOR_ELT(result, SLX_RUN)),
+         *multiplexIndex = NULL,
+-        *machine = STRING_PTR(VECTOR_ELT(result, SLX_MACHINE));
++        *machine = STRING_PTR_RO(VECTOR_ELT(result, SLX_MACHINE));
+     const Rboolean
+         withMultiplexIndex = R_NilValue != VECTOR_ELT(result, SLX_MULTIPLEX),
+         withPairedReadNumber = R_NilValue != VECTOR_ELT(result, SLX_PAIRID);
+     if (withMultiplexIndex)
+-        multiplexIndex = STRING_PTR(VECTOR_ELT(result, SLX_MULTIPLEX));
++        multiplexIndex = STRING_PTR_RO(VECTOR_ELT(result, SLX_MULTIPLEX));
+     if (withPairedReadNumber)
+         pairedReadNumber = INTEGER(VECTOR_ELT(result, SLX_PAIRID));
+ 
+-- 
+2.52.0
+
+
+From 2e3368a35e3955a0a92b7f3e2c8dface6709d135 Mon Sep 17 00:00:00 2001
+From: vjcitn <stvjc@channing.harvard.edu>
+Date: Thu, 16 Apr 2026 16:54:15 +0000
+Subject: [PATCH] fixapi
+
+---
+ src/util.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/util.c b/src/util.c
+index 4a10a90..59c089b 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -6,6 +6,14 @@ unsigned char _bDecode(char);
+ unsigned char _dnaDecode(char);
+ unsigned char _rnaDecode(char);
+ 
++
++#include <Rversion.h>
++
++#if R_VERSION < R_Version(4, 6, 0)
++# define R_getVar(x,y,z) findVar(x,y)
++#endif
++
++
+ /*
+  * Encode / decode XString wrappers
+  */
+@@ -80,7 +88,7 @@ SEXP _get_namespace(const char *pkg)
+ SEXP _get_strand_levels()
+ {
+     SEXP nmspc = PROTECT(_get_namespace("ShortRead"));
+-    SEXP ans = eval(findVar(install(".STRAND_LEVELS"), nmspc), nmspc);
++    SEXP ans = eval(R_getVar(install(".STRAND_LEVELS"), nmspc, TRUE), nmspc);
+     UNPROTECT(1);
+     return ans;
+ }
+-- 
+2.52.0
+

gnu/packages/patches/r-snpstats-0001-fixed-non-API-except-for-IS_S4_OBJECT.patch

@@ -0,0 +1,412 @@
+From 803cda41994a22890e0a6e379e6588084d4bc91b Mon Sep 17 00:00:00 2001
+From: vjcitn <stvjc@channing.harvard.edu>
+Date: Fri, 13 Mar 2026 04:04:59 -0400
+Subject: [PATCH 1/2] fixed non-API except for IS_S4_OBJECT
+
+---
+ src/bind.c             |  8 ++++----
+ src/glm_test_R.c       | 20 ++++++++++----------
+ src/imputation.c       |  8 ++++----
+ src/input.c            |  2 +-
+ src/plink.c            |  2 +-
+ src/read_uncertain.c   |  4 ++--
+ src/readped.c          |  2 +-
+ src/single_snp_tests.c |  8 ++++----
+ src/snp_summary.c      |  8 ++++----
+ src/snpmpy.c           |  8 ++++----
+ src/structure.c        |  4 ++--
+ src/subset.c           |  2 +-
+ src/switch.c           |  2 +-
+ src/tdt.c              |  8 ++++----
+ src/testBig.c          |  2 +-
+ 15 files changed, 44 insertions(+), 44 deletions(-)
+
+diff --git a/src/bind.c b/src/bind.c
+index 44b1536..fa87e7c 100644
+--- a/src/bind.c
++++ b/src/bind.c
+@@ -19,7 +19,7 @@ SEXP snp_rbind(SEXP args) {
+     const SEXP This = CAR(args);
+     Class = getAttrib(This, R_ClassSymbol);
+     if (TYPEOF(Class) != STRSXP) {
+-      Class = R_data_class(This, FALSE);
++      Class = R_class(This);
+     }
+     const char *cli = CHAR(STRING_ELT(Class, 0));
+     if(!IS_S4_OBJECT(This)) {
+@@ -66,7 +66,7 @@ SEXP snp_rbind(SEXP args) {
+   SEXP Result, Rnames, Dnames, Diploid = R_NilValue;
+   PROTECT(Result = allocMatrix(RAWSXP, nr, nc));
+   classgets(Result, duplicate(Class));
+-  SET_S4_OBJECT(Result);
++  Rf_asS4(Result, TRUE, 0);
+   PROTECT(Rnames = allocVector(STRSXP, nr));
+   PROTECT(Dnames = allocVector(VECSXP, 2));
+   SET_VECTOR_ELT(Dnames, 0, Rnames);
+@@ -148,7 +148,7 @@ SEXP snp_cbind(SEXP args) {
+     SEXP This = CAR(args);
+     Class = getAttrib(This, R_ClassSymbol);
+     if (TYPEOF(Class) != STRSXP) {
+-      Class = R_data_class(This, FALSE);
++      Class = R_class(This);
+     }
+     const char *cli = CHAR(STRING_ELT(Class, 0));
+     if(!IS_S4_OBJECT(This)) {
+@@ -205,7 +205,7 @@ SEXP snp_cbind(SEXP args) {
+   SEXP Result, Cnames, Dnames;
+   PROTECT(Result = allocMatrix(RAWSXP, nr, nc));
+   classgets(Result, duplicate(Class));
+-  SET_S4_OBJECT(Result);
++  Rf_asS4(Result, TRUE, 0);
+   PROTECT(Dnames = allocVector(VECSXP, 2));
+   setAttrib(Result, R_DimNamesSymbol, Dnames);
+   PROTECT(Cnames = allocVector(STRSXP, nc));
+diff --git a/src/glm_test_R.c b/src/glm_test_R.c
+index d865182..dc8ebef 100644
+--- a/src/glm_test_R.c
++++ b/src/glm_test_R.c
+@@ -19,8 +19,8 @@ SEXP snp_lhs_score(const SEXP Y, const SEXP X, const SEXP Stratum,
+ 
+   /* Y should be a SnpMatrix or an XSnpMatrix */
+   const char *classY = NULL;
+-  if (TYPEOF(R_data_class(Y, FALSE)) == STRSXP) {
+-    classY = CHAR(STRING_ELT(R_data_class(Y, FALSE), 0));
++  if (TYPEOF(R_class(Y)) == STRSXP) {
++    classY = CHAR(STRING_ELT(R_class(Y), 0));
+   } else {
+     classY = CHAR(STRING_ELT(getAttrib(Y, R_ClassSymbol), 0));
+   }
+@@ -431,8 +431,8 @@ SEXP snp_rhs_score(SEXP Y, SEXP family, SEXP link,
+   /* Z should be a SnpMatrix or an XSnpMatrix */
+ 
+   const char *classZ = NULL;
+-  if (TYPEOF(R_data_class(Z, FALSE)) == STRSXP) {
+-    classZ = CHAR(STRING_ELT(R_data_class(Z, FALSE), 0));
++  if (TYPEOF(R_class(Z)) == STRSXP) {
++    classZ = CHAR(STRING_ELT(R_class(Z), 0));
+   } else {
+     classZ = CHAR(STRING_ELT(getAttrib(Z, R_ClassSymbol), 0));
+   }
+@@ -1003,8 +1003,8 @@ SEXP snp_lhs_estimate(const SEXP Y, const SEXP X, const SEXP Stratum,
+ 
+   /* Y should be a SnpMatrix or an XSnpMatrix */
+   const char *classY = NULL;
+-  if (TYPEOF(R_data_class(Y, FALSE)) == STRSXP) {
+-    classY = CHAR(STRING_ELT(R_data_class(Y, FALSE), 0));
++  if (TYPEOF(R_class(Y)) == STRSXP) {
++    classY = CHAR(STRING_ELT(R_class(Y), 0));
+   } else {
+     classY = CHAR(STRING_ELT(getAttrib(Y, R_ClassSymbol), 0));
+   }
+@@ -1286,7 +1286,7 @@ SEXP snp_lhs_estimate(const SEXP Y, const SEXP X, const SEXP Stratum,
+   LOGICAL(Lhs)[0] = 1;
+   setAttrib(Estimates, install("snpLHS"), Lhs);
+   UNPROTECT(6);
+-  SET_S4_OBJECT(Estimates);
++  Rf_asS4(Estimates, TRUE, 0);
+   return(Estimates);
+ }
+ 
+@@ -1360,8 +1360,8 @@ SEXP snp_rhs_estimate(SEXP Y, SEXP family, SEXP link,
+ /* Z should be a SnpMatrix or an XSnpMatrix */
+ 
+   const char *classZ = NULL;
+-  if (TYPEOF(R_data_class(Z, FALSE)) == STRSXP) {
+-    classZ = CHAR(STRING_ELT(R_data_class(Z, FALSE), 0));
++  if (TYPEOF(R_class(Z)) == STRSXP) {
++    classZ = CHAR(STRING_ELT(R_class(Z), 0));
+   } else {
+     classZ = CHAR(STRING_ELT(getAttrib(Z, R_ClassSymbol), 0));
+   }
+@@ -1724,7 +1724,7 @@ SEXP snp_rhs_estimate(SEXP Y, SEXP family, SEXP link,
+ 
+   UNPROTECT(gen_names? 7: 6);
+ 
+-  SET_S4_OBJECT(Estimates);
++  Rf_asS4(Estimates, TRUE, 0);
+   return(Estimates);
+   
+ }
+diff --git a/src/imputation.c b/src/imputation.c
+index ff9403b..d796c1b 100644
+--- a/src/imputation.c
++++ b/src/imputation.c
+@@ -77,7 +77,7 @@ SEXP snp_impute(const SEXP X, const SEXP Y, const SEXP Xord, const SEXP Yord,
+   int *diploid = NULL;
+   SEXP cl = GET_CLASS(X);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(X, FALSE); /* S4 way of getting class attribute */
++    cl = R_class(X); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP Diploid = R_do_slot(X, mkString("diploid"));
+@@ -395,7 +395,7 @@ SEXP snp_impute(const SEXP X, const SEXP Y, const SEXP Xord, const SEXP Yord,
+   PROTECT(Maxpred = allocVector(INTSXP, 1));
+   INTEGER(Maxpred)[0] = maxpred;
+   setAttrib(Result, install("Max.predictors"), Maxpred);
+-  SET_S4_OBJECT(Result);
++  Rf_asS4(Result, TRUE, 0);
+ 
+   /* Tidy up */
+ 
+@@ -701,7 +701,7 @@ SEXP impute_snps(const SEXP Rules, const SEXP Snps, const SEXP Subset,
+   int *diploid_in=NULL, *diploid=NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
++    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP Diploid = R_do_slot(Snps, mkString("diploid"));
+@@ -753,7 +753,7 @@ SEXP impute_snps(const SEXP Rules, const SEXP Snps, const SEXP Subset,
+     SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+     setAttrib(Class, install("package"), Package);
+     classgets(Result, Class);
+-    SET_S4_OBJECT(Result);
++    Rf_asS4(Result, TRUE, 0);
+   }
+   PROTECT(Dimnames = allocVector(VECSXP, 2));
+   SET_VECTOR_ELT(Dimnames, 0, VECTOR_ELT(names, 0));
+diff --git a/src/input.c b/src/input.c
+index 1d2a95b..60cdad8 100644
+--- a/src/input.c
++++ b/src/input.c
+@@ -330,7 +330,7 @@ SEXP insnp_new(const SEXP Filenames, const SEXP Sample_id, const SEXP Snp_id,
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Class, install("package"), Package);
+   classgets(Result, Class);
+-  SET_S4_OBJECT(Result);
++  Rf_asS4(Result, TRUE, 0);
+   unsigned char *result = RAW(Result);
+   memset(result, 0x00, Nsample*Nsnp);
+ 
+diff --git a/src/plink.c b/src/plink.c
+index a413440..9095c2d 100644
+--- a/src/plink.c
++++ b/src/plink.c
+@@ -59,7 +59,7 @@ SEXP readbed(SEXP Bed, SEXP Id, SEXP Snps, SEXP Rsel, SEXP Csel) {
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Class, install("package"), Package);
+   classgets(Result, Class);
+-  SET_S4_OBJECT(Result);
++  Rf_asS4(Result, TRUE, 0);
+   
+   unsigned char *result = RAW(Result); 
+   R_xlen_t ncell = (R_xlen_t)nrow*(R_xlen_t)ncol;
+diff --git a/src/read_uncertain.c b/src/read_uncertain.c
+index 2e3b901..fd82617 100644
+--- a/src/read_uncertain.c
++++ b/src/read_uncertain.c
+@@ -137,7 +137,7 @@ SEXP read_mach(const SEXP Filename, const SEXP Colnames, const SEXP Nsubject) {
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Class, install("package"), Package);
+   classgets(Result, Class);
+-  SET_S4_OBJECT(Result);
++  Rf_asS4(Result, TRUE, 0);
+   UNPROTECT(2);
+  
+   /* Read in data */
+@@ -278,7 +278,7 @@ SEXP read_impute(const SEXP Filename, const SEXP Rownames, const SEXP Nsnp,
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Class, install("package"), Package);
+   classgets(Result, Class);
+-  SET_S4_OBJECT(Result);
++  Rf_asS4(Result, TRUE, 0);
+   UNPROTECT(2);
+ 
+   char buffer[BUFFERSIZE];
+diff --git a/src/readped.c b/src/readped.c
+index 4e8563e..020d05f 100644
+--- a/src/readped.c
++++ b/src/readped.c
+@@ -327,7 +327,7 @@ SEXP readped(SEXP filename, SEXP snp_names, SEXP missing, SEXP X, SEXP sep) {
+   else
+     SET_STRING_ELT(SMClass, 0, mkChar("SnpMatrix"));
+   classgets(Smat, SMClass);
+-  SET_S4_OBJECT(Smat);
++  Rf_asS4(Smat, TRUE, 0);
+   PROTECT(DimNames = allocVector(VECSXP, 2));
+   SET_VECTOR_ELT(DimNames, 0, duplicate(Rnames));
+   protected += 2;
+diff --git a/src/single_snp_tests.c b/src/single_snp_tests.c
+index a242e17..08bd098 100644
+--- a/src/single_snp_tests.c
++++ b/src/single_snp_tests.c
+@@ -53,8 +53,8 @@ SEXP score_single(const SEXP Phenotype, const SEXP Stratum, const SEXP Snps,
+   /* SNPs ---- should be a SnpMatrix or an XSnpMatrix */
+ 
+   const char *classS = NULL;
+-  if (TYPEOF(R_data_class(Snps, FALSE)) == STRSXP) {
+-    classS = CHAR(STRING_ELT(R_data_class(Snps, FALSE), 0));
++  if (TYPEOF(R_class(Snps)) == STRSXP) {
++    classS = CHAR(STRING_ELT(R_class(Snps), 0));
+   } else {
+     classS = CHAR(STRING_ELT(getAttrib(Snps, R_ClassSymbol), 0));
+   }
+@@ -108,8 +108,8 @@ SEXP score_single(const SEXP Phenotype, const SEXP Stratum, const SEXP Snps,
+   index_db name_index;
+   if (!isNull(Rules)) {
+     const char *classR = NULL;
+-    if (TYPEOF(R_data_class(Rules, FALSE)) == STRSXP) {
+-      classR = CHAR(STRING_ELT(R_data_class(Rules, FALSE), 0));
++    if (TYPEOF(R_class(Rules)) == STRSXP) {
++      classR = CHAR(STRING_ELT(R_class(Rules), 0));
+     } else {
+       classR = CHAR(STRING_ELT(getAttrib(Rules, R_ClassSymbol), 0));
+     }
+diff --git a/src/snp_summary.c b/src/snp_summary.c
+index 9b53693..6f181c9 100644
+--- a/src/snp_summary.c
++++ b/src/snp_summary.c
+@@ -47,8 +47,8 @@ SEXP X_snp_summary(const SEXP Snps, const SEXP Rules, const SEXP Uncertain) {
+   SEXP ruleNames = R_NilValue;
+   if (!isNull(Rules)) {
+     const char *classR = NULL;
+-    if (TYPEOF(R_data_class(Rules, FALSE)) == STRSXP) {
+-      classR = CHAR(STRING_ELT(R_data_class(Rules, FALSE), 0));
++    if (TYPEOF(R_class(Rules)) == STRSXP) {
++      classR = CHAR(STRING_ELT(R_class(Rules), 0));
+     } else {
+       classR = CHAR(STRING_ELT(getAttrib(Rules, R_ClassSymbol), 0));
+     }
+@@ -321,8 +321,8 @@ SEXP snp_summary(const SEXP Snps, const SEXP Rules, const SEXP Uncertain) {
+   SEXP ruleNames = R_NilValue;
+   if (!isNull(Rules)) {
+     const char *classR = NULL;
+-    if (TYPEOF(R_data_class(Rules, FALSE)) == STRSXP) {
+-      classR = CHAR(STRING_ELT(R_data_class(Rules, FALSE), 0));
++    if (TYPEOF(R_class(Rules)) == STRSXP) {
++      classR = CHAR(STRING_ELT(R_class(Rules), 0));
+     } else {
+       classR = CHAR(STRING_ELT(getAttrib(Rules, R_ClassSymbol), 0));
+     }
+diff --git a/src/snpmpy.c b/src/snpmpy.c
+index 2447048..56b84d9 100644
+--- a/src/snpmpy.c
++++ b/src/snpmpy.c
+@@ -34,7 +34,7 @@ SEXP snp_pre(const SEXP Snps, const SEXP Mat, const SEXP Frequency,
+   int *ifdiploid = NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
++    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP diploid = R_do_slot(Snps, mkString("diploid"));
+@@ -55,7 +55,7 @@ SEXP snp_pre(const SEXP Snps, const SEXP Mat, const SEXP Frequency,
+ 
+   cl = GET_CLASS(Mat);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Mat, FALSE); /* S4 way of getting class attribute */
++    cl = R_class(Mat); /* S4 way of getting class attribute */
+   }
+   if (strcmp(CHAR(STRING_ELT(cl, 0)), "matrix"))
+     error("Argument error - Mat wrong type");
+@@ -161,7 +161,7 @@ SEXP snp_post(const SEXP Snps, const SEXP Mat, const SEXP Frequency,
+   int *ifdiploid = NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
++    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP diploid = R_do_slot(Snps, mkString("diploid"));
+@@ -182,7 +182,7 @@ SEXP snp_post(const SEXP Snps, const SEXP Mat, const SEXP Frequency,
+ 
+   cl = GET_CLASS(Mat);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Mat, FALSE); /* S4 way of getting class attribute */
++    cl = R_class(Mat); /* S4 way of getting class attribute */
+   }
+   if (strcmp(CHAR(STRING_ELT(cl, 0)), "matrix"))
+     error("Argument error - Mat wrong type");
+diff --git a/src/structure.c b/src/structure.c
+index 2a05635..1f9b62e 100644
+--- a/src/structure.c
++++ b/src/structure.c
+@@ -66,7 +66,7 @@ SEXP xxt(const SEXP Snps, const SEXP Strata, const SEXP Correct_for_missing,
+   int *ifDiploid = NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
++    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP Diploid = R_do_slot(Snps, mkString("diploid"));
+@@ -409,7 +409,7 @@ SEXP ibs_count(const SEXP Snps, const SEXP Uncertain) {
+   int *ifDiploid = NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
++    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+     SEXP Diploid = R_do_slot(Snps, mkString("diploid"));
+diff --git a/src/subset.c b/src/subset.c
+index cc7992d..4c2e2c4 100644
+--- a/src/subset.c
++++ b/src/subset.c
+@@ -55,7 +55,7 @@ SEXP subset(SEXP X, SEXP Rows, SEXP Cols) {
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Rclass, install("package"), Package);
+   setAttrib(Result, R_ClassSymbol, Rclass);
+-  SET_S4_OBJECT(Result);
++  Rf_asS4(Result, TRUE, 0);
+   PROTECT(Rdim = allocVector(INTSXP, 2));
+   int *rdim = INTEGER(Rdim);
+   rdim[0] = nrows;
+diff --git a/src/switch.c b/src/switch.c
+index 60f7e6c..e2a3287 100644
+--- a/src/switch.c
++++ b/src/switch.c
+@@ -16,7 +16,7 @@ SEXP test_switch(const SEXP Snps, const SEXP Snps2, const SEXP Split,
+   int *female = NULL;
+   SEXP cl = GET_CLASS(Snps);
+   if (TYPEOF(cl) != STRSXP) {
+-    cl = R_data_class(Snps, FALSE); /* S4 way of getting class attribute */
++    cl = R_class(Snps); /* S4 way of getting class attribute */
+   }
+   SEXP diploid = NULL;
+   if (!strcmp(CHAR(STRING_ELT(cl, 0)), "XSnpMatrix")) {
+diff --git a/src/tdt.c b/src/tdt.c
+index cece0d9..000d1c7 100644
+--- a/src/tdt.c
++++ b/src/tdt.c
+@@ -43,8 +43,8 @@ SEXP score_tdt(const SEXP Proband, const SEXP Father, const SEXP Mother,
+   /* SNPs ---- should be a SnpMatrix or an XSnpMatrix */
+ 
+   const char *classS = NULL;
+-  if (TYPEOF(R_data_class(Snps, FALSE)) == STRSXP) {
+-    classS = CHAR(STRING_ELT(R_data_class(Snps, FALSE), 0));
++  if (TYPEOF(R_class(Snps)) == STRSXP) {
++    classS = CHAR(STRING_ELT(R_class(Snps), 0));
+   } else {
+     classS = CHAR(STRING_ELT(getAttrib(Snps, R_ClassSymbol), 0));
+   }
+@@ -84,8 +84,8 @@ SEXP score_tdt(const SEXP Proband, const SEXP Father, const SEXP Mother,
+   GTYPE **gt2ht = NULL;
+   if (!isNull(Rules)) {
+     const char *classR = NULL;
+-    if (TYPEOF(R_data_class(Rules, FALSE)) == STRSXP) {
+-      classR = CHAR(STRING_ELT(R_data_class(Rules, FALSE), 0));
++    if (TYPEOF(R_class(Rules)) == STRSXP) {
++      classR = CHAR(STRING_ELT(R_class(Rules), 0));
+     } else {
+       classR = CHAR(STRING_ELT(getAttrib(Rules, R_ClassSymbol), 0));
+     }
+diff --git a/src/testBig.c b/src/testBig.c
+index a6eb76f..3dca1da 100644
+--- a/src/testBig.c
++++ b/src/testBig.c
+@@ -18,7 +18,7 @@ SEXP snp_big(SEXP nrow, SEXP ncol) {
+   SET_STRING_ELT(Package, 0, mkChar("snpStats"));
+   setAttrib(Class, install("package"), Package);
+   classgets(Result, Class);
+-  SET_S4_OBJECT(Result);
++  Rf_asS4(Result, TRUE, 0);
+ 
+   PROTECT(Dnames = allocVector(VECSXP, 2));
+   setAttrib(Result, R_DimNamesSymbol, Dnames);
+-- 
+2.52.0
+

gnu/packages/patches/r-snpstats-0002-fixed-IS_S4_OBJECT.patch

@@ -0,0 +1,149 @@
+From a505297e347aa72510ecfc83e7009668693e1260 Mon Sep 17 00:00:00 2001
+From: vjcitn <stvjc@channing.harvard.edu>
+Date: Fri, 13 Mar 2026 04:06:37 -0400
+Subject: [PATCH 2/2] fixed IS_S4_OBJECT
+
+---
+ src/bind.c             | 4 ++--
+ src/fst.c              | 2 +-
+ src/glm_test_R.c       | 8 ++++----
+ src/single_snp_tests.c | 2 +-
+ src/snp_summary.c      | 6 +++---
+ src/tdt.c              | 2 +-
+ 6 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/src/bind.c b/src/bind.c
+index fa87e7c..b3ef928 100644
+--- a/src/bind.c
++++ b/src/bind.c
+@@ -22,7 +22,7 @@ SEXP snp_rbind(SEXP args) {
+       Class = R_class(This);
+     }
+     const char *cli = CHAR(STRING_ELT(Class, 0));
+-    if(!IS_S4_OBJECT(This)) {
++    if(!Rf_isS4(This)) {
+       warning("rbinding SnpMatrix object without S4 object bit");
+     }
+     int nci = ncols(This);
+@@ -151,7 +151,7 @@ SEXP snp_cbind(SEXP args) {
+       Class = R_class(This);
+     }
+     const char *cli = CHAR(STRING_ELT(Class, 0));
+-    if(!IS_S4_OBJECT(This)) {
++    if(!Rf_isS4(This)) {
+       warning("cbinding SnpMatrix object without S4 object bit");
+     }
+     SEXP Di = R_NilValue;
+diff --git a/src/fst.c b/src/fst.c
+index bbc39c0..5451a51 100644
+--- a/src/fst.c
++++ b/src/fst.c
+@@ -23,7 +23,7 @@ SEXP Fst(SEXP Snps, SEXP Group, SEXP HapMap) {
+     ifX = 0; /* to avoid warning message */
+     error("Argument error - class(Snps)");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
++  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+ 
+diff --git a/src/glm_test_R.c b/src/glm_test_R.c
+index dc8ebef..fe9d9c8 100644
+--- a/src/glm_test_R.c
++++ b/src/glm_test_R.c
+@@ -24,7 +24,7 @@ SEXP snp_lhs_score(const SEXP Y, const SEXP X, const SEXP Stratum,
+   } else {
+     classY = CHAR(STRING_ELT(getAttrib(Y, R_ClassSymbol), 0));
+   }
+-  if(!IS_S4_OBJECT(Y)) {
++  if(!Rf_isS4(Y)) {
+     error("Y in snp_lhs_score is missing S4 Object bit");
+   }
+   int ifX = 0;
+@@ -443,7 +443,7 @@ SEXP snp_rhs_score(SEXP Y, SEXP family, SEXP link,
+     ifX = 1;
+   else 
+     error("Argument error - class(Z)");
+-  if (!IS_S4_OBJECT(Z)) {
++  if (!Rf_isS4(Z)) {
+     error("Z in snp_rhs_score is missing S4 Object bit");
+   }
+  
+@@ -1008,7 +1008,7 @@ SEXP snp_lhs_estimate(const SEXP Y, const SEXP X, const SEXP Stratum,
+   } else {
+     classY = CHAR(STRING_ELT(getAttrib(Y, R_ClassSymbol), 0));
+   }
+-  if(!IS_S4_OBJECT(Y)) {
++  if(!Rf_isS4(Y)) {
+     error("Y in snp_lhs_score is missing S4 Object bit");
+   }
+   int ifX = 0;
+@@ -1365,7 +1365,7 @@ SEXP snp_rhs_estimate(SEXP Y, SEXP family, SEXP link,
+   } else {
+     classZ = CHAR(STRING_ELT(getAttrib(Z, R_ClassSymbol), 0));
+   }
+-  if(!IS_S4_OBJECT(Z)) {
++  if(!Rf_isS4(Z)) {
+     error("Z in snp_rhs_score is missing S4 Object bit");
+   }
+   int ifX = 0;
+diff --git a/src/single_snp_tests.c b/src/single_snp_tests.c
+index 08bd098..b577300 100644
+--- a/src/single_snp_tests.c
++++ b/src/single_snp_tests.c
+@@ -67,7 +67,7 @@ SEXP score_single(const SEXP Phenotype, const SEXP Stratum, const SEXP Snps,
+     ifX = 0; /* to avoid warning message */
+     error("Argument error - class(Snps)");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
++  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+ 
+diff --git a/src/snp_summary.c b/src/snp_summary.c
+index 6f181c9..c2f1c73 100644
+--- a/src/snp_summary.c
++++ b/src/snp_summary.c
+@@ -24,7 +24,7 @@ SEXP X_snp_summary(const SEXP Snps, const SEXP Rules, const SEXP Uncertain) {
+   if (Snps == R_NilValue) {
+     error("Argument error - Snps = NULL");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
++  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+   const unsigned char *snps = RAW(Snps);
+@@ -298,7 +298,7 @@ SEXP snp_summary(const SEXP Snps, const SEXP Rules, const SEXP Uncertain) {
+   if (Snps == R_NilValue) {
+     error("Argument error - Snps = NULL");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
++  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+   const unsigned char *snps = RAW(Snps);
+@@ -538,7 +538,7 @@ SEXP row_summary(const SEXP Snps) {
+   if (Snps == R_NilValue) {
+     error("Argument error - Snps = NULL");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
++  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+   const unsigned char *snps = RAW(Snps);
+diff --git a/src/tdt.c b/src/tdt.c
+index 000d1c7..634e1b3 100644
+--- a/src/tdt.c
++++ b/src/tdt.c
+@@ -57,7 +57,7 @@ SEXP score_tdt(const SEXP Proband, const SEXP Father, const SEXP Mother,
+     ifX = 0; /* to avoid warning message */
+     error("Argument error - class(Snps)");
+   }
+-  if(!IS_S4_OBJECT(Snps)) {
++  if(!Rf_isS4(Snps)) {
+     error("Argument error - Snps is not S4 object");
+   }
+ 
+-- 
+2.52.0
+

gnu/packages/patches/r-sparsearray-r-4.6.0-compat.patch

@@ -0,0 +1,259 @@
+From 633aa6e3f671e9b58b3508b3944ff0dd45f34f8a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Thu, 5 Mar 2026 14:58:23 -0800
+Subject: [PATCH] SparseArray 1.11.11: Get rid of non-API calls to R
+
+From 65383c02f986832b1416c6ad39da800d8ced05df Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Herv=C3=A9=20Pag=C3=A8s?= <hpages.on.github@gmail.com>
+Date: Tue, 31 Mar 2026 11:38:20 -0700
+Subject: [PATCH] SparseArray 1.11.13: Use R_getVar() instead of findVar() when
+ R >= 4.6.0
+
+---
+ DESCRIPTION                     |  2 +-
+ src/Makevars                    |  1 +
+ src/Rvector_utils.c             | 15 ++++++++-------
+ src/SparseArray_aperm.c         |  2 +-
+ src/SparseArray_matrixStats.c   |  5 +++--
+ src/SparseArray_subassignment.c |  6 +++---
+ src/SparseVec.h                 |  3 ++-
+ src/leaf_utils.c                |  5 +++--
+ src/test.c                      |  3 +++
+ 9 files changed, 25 insertions(+), 17 deletions(-)
+
+diff --git a/src/Makevars b/src/Makevars
+index 0ee3615..1c5b86e 100644
+--- a/src/Makevars
++++ b/src/Makevars
+@@ -1,2 +1,3 @@
++## See https://cran.r-project.org/doc/manuals/r-release/R-exts.html#OpenMP-support
+ PKG_CFLAGS = $(SHLIB_OPENMP_CFLAGS)
+ PKG_LIBS = $(SHLIB_OPENMP_CFLAGS)
+diff --git a/src/Rvector_utils.c b/src/Rvector_utils.c
+index ad80168..7e61ac1 100644
+--- a/src/Rvector_utils.c
++++ b/src/Rvector_utils.c
+@@ -4,6 +4,7 @@
+  ****************************************************************************/
+ #include "Rvector_utils.h"
+ 
++#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <string.h>  /* for memset() and memcpy() */
+ 
+ 
+@@ -242,7 +243,7 @@ void _fill_Rvector_block_with_val(SEXP Rvector,
+ 				     (const SEXP) val);
+ 		return;
+ 	}
+-	_set_elts_to_val(TYPEOF(Rvector), DATAPTR(Rvector),
++	_set_elts_to_val(TYPEOF(Rvector), DATAPTR_RW(Rvector),
+ 			 block_offset, block_len, val);
+ }
+ 
+@@ -260,7 +261,7 @@ void _fill_Rvector_block_with_zeros(SEXP Rvector,
+ 				     R_NilValue);
+ 		return;
+ 	}
+-	_set_elts_to_zero(Rtype, DATAPTR(Rvector), block_offset, block_len);
++	_set_elts_to_zero(Rtype, DATAPTR_RW(Rvector), block_offset, block_len);
+ 	return;
+ }
+ 
+@@ -268,7 +269,7 @@ void _fill_Rvector_block_with_zeros(SEXP Rvector,
+ void _fill_Rvector_block_with_ones(SEXP Rvector,
+ 		R_xlen_t block_offset, R_xlen_t block_len)
+ {
+-	_set_elts_to_one(TYPEOF(Rvector), DATAPTR(Rvector),
++	_set_elts_to_one(TYPEOF(Rvector), DATAPTR_RW(Rvector),
+ 			 block_offset, block_len);
+ 	return;
+ }
+@@ -277,7 +278,7 @@ void _fill_Rvector_block_with_ones(SEXP Rvector,
+ void _fill_Rvector_block_with_minus_one(SEXP Rvector,
+ 		R_xlen_t block_offset, R_xlen_t block_len)
+ {
+-	_set_elts_to_minus_one(TYPEOF(Rvector), DATAPTR(Rvector),
++	_set_elts_to_minus_one(TYPEOF(Rvector), DATAPTR_RW(Rvector),
+ 			 block_offset, block_len);
+ 	return;
+ }
+@@ -293,7 +294,7 @@ void _fill_Rvector_block_with_NA(SEXP Rvector,
+ 					  NA_STRING);
+ 		return;
+ 	}
+-	_set_elts_to_NA(Rtype, DATAPTR(Rvector), block_offset, block_len);
++	_set_elts_to_NA(Rtype, DATAPTR_RW(Rvector), block_offset, block_len);
+ 	return;
+ }
+ 
+@@ -460,7 +461,7 @@ void _fill_Rvector_subset_with_zeros(SEXP Rvector,
+ 				R_NilValue);
+ 		return;
+ 	}
+-	_set_selected_elts_to_zero(Rtype, DATAPTR(Rvector),
++	_set_selected_elts_to_zero(Rtype, DATAPTR_RW(Rvector),
+ 				selection, selection_len, selection_offset);
+ 	return;
+ }
+@@ -470,7 +471,7 @@ void _fill_Rvector_subset_with_ones(SEXP Rvector,
+ 		const int *selection, int selection_len,
+ 		R_xlen_t selection_offset)
+ {
+-	_set_selected_elts_to_one(TYPEOF(Rvector), DATAPTR(Rvector),
++	_set_selected_elts_to_one(TYPEOF(Rvector), DATAPTR_RW(Rvector),
+ 				  selection, selection_len, selection_offset);
+ 	return;
+ }
+diff --git a/src/SparseArray_aperm.c b/src/SparseArray_aperm.c
+index 0bd092e..bbeaf2c 100644
+--- a/src/SparseArray_aperm.c
++++ b/src/SparseArray_aperm.c
+@@ -721,7 +721,7 @@ static SEXP REC_grow_output_tree(const int *dim, int ndim,
+ 	const type *nzvals_p = NULL;  /* -Wmaybe-uninitialized */	\
+ 	type v;								\
+ 	if (nzvals != R_NilValue) {  /* standard leaf */		\
+-		nzvals_p = (const type *) DATAPTR(nzvals);		\
++		nzvals_p = DATAPTR_RO(nzvals);				\
+ 	} else {  /* lacunar leaf */					\
+ 		v = type ## 1;						\
+ 	}								\
+diff --git a/src/SparseArray_matrixStats.c b/src/SparseArray_matrixStats.c
+index b626553..debacf6 100644
+--- a/src/SparseArray_matrixStats.c
++++ b/src/SparseArray_matrixStats.c
+@@ -16,6 +16,7 @@
+ #include "leaf_utils.h"
+ #include "SparseArray_summarization.h"
+ 
++#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <string.h>  /* for memcpy() and memset() */
+ 
+ 
+@@ -272,7 +273,7 @@ SEXP C_colStats_SVT(SEXP x_dim, SEXP x_dimnames, SEXP x_type,
+ 	int warn = 0;
+ 	REC_colStats_SVT(x_SVT, x_bg_is_na, INTEGER(x_dim), LENGTH(x_dim),
+ 			 &summarize_op,
+-			 DATAPTR(ans), ans_Rtype,
++			 DATAPTR_RW(ans), ans_Rtype,
+ 			 out_incs, ans_ndim, pardim,
+ 			 &warn);
+ 	if (warn)
+@@ -1175,7 +1176,7 @@ SEXP C_rowStats_SVT(SEXP x_dim, SEXP x_dimnames, SEXP x_type,
+ 		SVT_rowMinsMaxs(x_SVT, x_Rtype, x_bg_is_na,
+ 			INTEGER(x_dim), LENGTH(x_dim),
+ 			opcode, narm,
+-			DATAPTR(ans), LENGTH(ans), ans_Rtype,
++			DATAPTR_RW(ans), LENGTH(ans), ans_Rtype,
+ 			out_incs, ans_ndim, nstrata);
+ 		break;
+ 	    case SUM_OPCODE:
+diff --git a/src/SparseArray_subassignment.c b/src/SparseArray_subassignment.c
+index 4cf1c3d..c3b2d5e 100644
+--- a/src/SparseArray_subassignment.c
++++ b/src/SparseArray_subassignment.c
+@@ -966,13 +966,13 @@ static inline int next_coords0(NindexIterator *Nindex_iter)
+ 		midx_p++;
+ 		coords0_p++;
+ 	}
+-	printf("coords0: ");
++	//printf("coords0: ");
+ 	coords0_p = Nindex_iter->coords0_buf;
+ 	for (along = Nindex_iter->margin; along < Nindex_iter->ndim; along++) {
+-		printf(" %3d", *coords0_p);
++		//printf(" %3d", *coords0_p);
+ 		coords0_p++;
+ 	}
+-	printf("\n");
++	//printf("\n");
+ 	return 1;
+ }
+ 
+diff --git a/src/SparseVec.h b/src/SparseVec.h
+index 894709b..73cd841 100644
+--- a/src/SparseVec.h
++++ b/src/SparseVec.h
+@@ -5,6 +5,7 @@
+ 
+ #include "Rvector_utils.h"
+ 
++#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <limits.h>  /* for INT_MAX */
+ 
+ 
+@@ -122,7 +123,7 @@ static inline SparseVec toSparseVec(SEXP nzvals, SEXP nzoffs,
+ 		if (IS_STRSXP_OR_VECSXP(Rtype)) {
+ 			sv.nzvals = nzvals;
+ 		} else {
+-			sv.nzvals = DATAPTR(nzvals);
++			sv.nzvals = DATAPTR_RW(nzvals);
+ 		}
+ 	}
+ 	sv.nzoffs = INTEGER(nzoffs);
+diff --git a/src/leaf_utils.c b/src/leaf_utils.c
+index e8066c3..c5ff3aa 100644
+--- a/src/leaf_utils.c
++++ b/src/leaf_utils.c
+@@ -10,6 +10,7 @@
+ #include "SparseVec_subsetting.h"
+ #include "SparseVec_subassignment.h"
+ 
++#include <R_ext/Altrep.h>  /* only for DATAPTR_RW() */
+ #include <string.h>  /* for memcpy() */
+ 
+ 
+@@ -129,7 +130,7 @@ SEXP _make_leaf_from_two_arrays(SEXPTYPE Rtype,
+ 			return ans;
+ 		}
+ 		ans_nzvals = PROTECT(allocVector(Rtype, nzcount));
+-		memcpy(DATAPTR(ans_nzvals), nzvals_p, Rtype_size * nzcount);
++		memcpy(DATAPTR_RW(ans_nzvals), nzvals_p, Rtype_size * nzcount);
+ 	}
+ 	SEXP ans = zip_leaf(ans_nzvals, ans_nzoffs, 0);
+ 	UNPROTECT(2);
+@@ -156,7 +157,7 @@ static SEXP make_leaf_from_Rvector_subset(SEXP Rvector,
+ 
+ 	if (avoid_copy_if_all_selected &&
+ 	    selection_offset == 0 && selection_len == XLENGTH(Rvector) &&
+-	    ATTRIB(Rvector) == R_NilValue)
++	    !ANY_ATTRIB(Rvector))
+ 	{
+ 		/* The full 'Rvector' is selected so can be reused as-is
+ 		   with no need to copy the selected elements to a new SEXP. */
+diff --git a/src/test.c b/src/test.c
+index 493538f..2205fa2 100644
+--- a/src/test.c
++++ b/src/test.c
+@@ -111,6 +111,9 @@ SEXP C_simple_omp_parallel_for_loop(SEXP nloop)
+ 	for (int i = 0; i < INTEGER(nloop)[0]; i++) {
+ #ifdef _OPENMP
+ 		int thread_num = omp_get_thread_num();
++		/* Can't use Rprintf() here because it's not thread-safe (it
++		   can trigger R's garbage collector which itself is not
++		   thread-safe). */
+ 		printf("thread_num = %d\n", thread_num);
+ #endif
+ 	}
+diff --git a/src/readSparseCSV.c b/src/readSparseCSV.c
+index a3d8da0..de1cb95 100644
+--- a/src/readSparseCSV.c
++++ b/src/readSparseCSV.c
+@@ -11,6 +11,7 @@
+ #include "ExtendableJaggedArray.h"
+ 
+ #include <R_ext/Connections.h>
++#include <Rversion.h>
+ 
+ #include <string.h>  /* for memcpy() */
+ 
+@@ -111,7 +112,11 @@ static SEXP dump_env_as_list_or_R_NilValue(SEXP env, int ans_len)
+ 	is_empty = 1;
+ 	for (i = 0; i < ans_len; i++) {
+ 		key = PROTECT(idx0_to_key(i));
++#if R_VERSION < R_Version(4, 6, 0)
+ 		ans_elt = findVar(install(translateChar(key)), env);
++#else
++		ans_elt = R_getVar(install(translateChar(key)), env, FALSE);
++#endif
+ 		UNPROTECT(1);
+ 		if (ans_elt == R_UnboundValue)
+ 			continue;

gnu/packages/patches/rust-codex-0.124.0-code-mode-stub-toolname.patch

@@ -0,0 +1,25 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-04-26
+License: ASL2.0
+Subject: Stub CodeModeTurnHost::invoke_tool signature uses ToolName.
+
+In codex 0.117 the upstream trait took `tool_name: String`, so the
+disable-code-mode patch's `cfg(not(feature = "v8-runtime"))` stub used
+String to match.  In codex 0.124 the upstream trait takes
+`codex_protocol::ToolName`, and core/src/tools/code_mode/mod.rs's impl
+of CodeModeTurnHost passes `ToolName`, so the stub must match the new
+signature here too.  This patch is applied only to codex 0.124+ on top
+of the shared disable-code-mode patch; codex-acp (which still pins
+rust-v0.117.0 where code-mode has no codex-protocol dep) keeps the
+String-based stub.
+
+--- a/codex-rs/code-mode/src/lib.rs
++++ b/codex-rs/code-mode/src/lib.rs
+@@ -77,7 +77,7 @@
+ #[cfg(not(feature = "v8-runtime"))]
+ #[async_trait::async_trait]
+ pub trait CodeModeTurnHost: Send + Sync {
+-    async fn invoke_tool(&self, tool_name: String, input: Option<serde_json::Value>, cancellation_token: tokio_util::sync::CancellationToken) -> Result<serde_json::Value, String>;
++    async fn invoke_tool(&self, tool_name: codex_protocol::ToolName, input: Option<serde_json::Value>, cancellation_token: tokio_util::sync::CancellationToken) -> Result<serde_json::Value, String>;
+     async fn notify(&self, call_id: String, cell_id: String, text: String) -> Result<(), String>;
+ }

gnu/packages/patches/rust-codex-0.124.0-remove-patch-sections.patch

@@ -0,0 +1,29 @@
+Author: Danny Milosavljevic <dannym@friendly-machines.com>
+Date: 2026-04-23
+License: ASL2.0
+Subject: Remove [patch.crates-io] and [patch.'ssh://...'] sections.
+
+The [patch] sections point to git repositories which are unavailable
+in an offline build.  The vendored crossterm, ratatui,
+tokio-tungstenite and tungstenite forks are provided as cargo-inputs
+instead.
+
+--- a/codex-rs/Cargo.toml	2026-04-23 22:49:56.599115735 +0000
++++ b/codex-rs/Cargo.toml	2026-04-23 22:49:56.601899894 +0000
+@@ -470,16 +470,3 @@
+ inherits = "test"
+ opt-level = 0
+ 
+-[patch.crates-io]
+-# Uncomment to debug local changes.
+-# ratatui = { path = "../../ratatui" }
+-crossterm = { git = "https://github.com/nornagon/crossterm", rev = "87db8bfa6dc99427fd3b071681b07fc31c6ce995" }
+-ratatui = { git = "https://github.com/nornagon/ratatui", rev = "9b2ad1298408c45918ee9f8241a6f95498cdbed2" }
+-tokio-tungstenite = { git = "https://github.com/openai-oss-forks/tokio-tungstenite", rev = "132f5b39c862e3a970f731d709608b3e6276d5f6" }
+-tungstenite = { git = "https://github.com/openai-oss-forks/tungstenite-rs", rev = "9200079d3b54a1ff51072e24d81fd354f085156f" }
+-
+-# Uncomment to debug local changes.
+-# rmcp = { path = "../../rust-sdk/crates/rmcp" }
+-
+-[patch."ssh://git@github.com/openai-oss-forks/tungstenite-rs.git"]
+-tungstenite = { git = "https://github.com/openai-oss-forks/tungstenite-rs", rev = "9200079d3b54a1ff51072e24d81fd354f085156f" }

gnu/packages/php.scm

@@ -68,14 +68,14 @@
 (define-public php-8.5
   (package
     (name "php")
-    (version "8.5.3")
+    (version "8.5.5")
     (home-page "https://www.php.net/")
     (source
      (origin
        (method url-fetch)
        (uri (string-append home-page "distributions/" "php-" version ".tar.xz"))
        (sha256
-        (base32 "1fbfqc9bggxj73g8drzxmkr122q4hwad4ik0kav5cwzhi9dp4rff"))
+        (base32 "1wh27552f6vd20f1yy4l0jlvknfq0kn5hapmiq55f05xyj1c7glm"))
        (modules '((guix build utils)))
        (snippet
         '(with-directory-excursion "ext"
@@ -90,6 +90,9 @@
     (build-system gnu-build-system)
     (arguments
      (list
+      #:modules
+      `((ice-9 textual-ports)
+        ,@%default-gnu-imported-modules)
       #:configure-flags
       #~(let-syntax ((with (syntax-rules ()
                              ((_ option input)
@@ -330,7 +333,56 @@
               (setenv "TEST_PHP_ARGS"
                       (format #f "-j~a" (if parallel-tests?
                                             (parallel-job-count)
-                                            1))))))
+                                            1)))))
+          (add-after 'unpack 'regenerate-ssl-certs
+            (lambda _
+              ;; The X.509 certificates shipped with PHP have an expiration
+              ;; date, which causes tests to fail after that date.  Generate
+              ;; them to avoid the problem entirely.
+              (define (concat-files result . files)
+                (call-with-output-file result
+                  (lambda (out)
+                    (for-each
+                     (lambda (file)
+                       (put-string out
+                                   (call-with-input-file file
+                                     get-string-all))
+                       (newline out))
+                     files))))
+              (define* (gen-ssl-cert key cert #:optional ca-cert-key ca-cert)
+                (let ((csr (string-append cert ".csr")))
+                  (unless (file-exists? key)
+                    (invoke "openssl" "genrsa" "-out" key "2048"))
+                  (invoke "openssl" "x509" "-x509toreq" "-in" cert "-key" key "-out" csr)
+                  (if ca-cert-key
+                      (begin
+                        (invoke "openssl" "x509"
+                                "-CA" ca-cert
+                                "-CAkey" ca-cert-key
+                                "-req"
+                                "-in" csr
+                                "-days" "+1"
+                                "-CAserial" "serial"
+                                "-CAcreateserial"
+                                "-out" cert))
+                      (invoke "openssl" "x509"
+                              "-req"
+                              "-in" csr
+                              "-signkey" key
+                              "-out" cert
+                              "-days" "30"))))
+              (let ((ca-key "ext/openssl/tests/sni_server_ca.key")
+                    (ca-cert "ext/openssl/tests/sni_server_ca.pem"))
+                (gen-ssl-cert ca-key ca-cert)
+                (for-each
+                 (lambda (suffix)
+                   (let ((key-name (string-append "ext/openssl/tests/sni_server_" suffix "_key.pem"))
+                         (cert-name (string-append "ext/openssl/tests/sni_server_" suffix "_cert.pem"))
+                         (result (string-append "ext/openssl/tests/sni_server_" suffix ".pem")))
+                     (gen-ssl-cert key-name cert-name
+                                   ca-key ca-cert)
+                     (concat-files result key-name cert-name)))
+                 '("cs" "us" "uk"))))))
       #:test-target "test"))
     (inputs
      (list aspell
@@ -392,13 +444,13 @@ systems, web content management systems and web frameworks.")
   (package
     (inherit php-8.5)
     (home-page "https://www.php.net/")
-    (version "8.4.18")
+    (version "8.4.20")
     (source
      (origin
        (method url-fetch)
        (uri (string-append home-page "distributions/" "php-" version ".tar.xz"))
        (sha256
-        (base32 "0401yjrchg6dnq8qdd86qanzmzrv6dscm2671kp6bsd8nhcrnylm"))
+        (base32 "1xr1w82apzsscrsndnphlgqvbj78g0smrp06pcgg8hlsr3vwcm74"))
        (modules '((guix build utils)))
        (snippet
         '(with-directory-excursion "ext"

gnu/packages/prolog.scm

@@ -237,7 +237,7 @@ it.")
 (define-public trealla
   (package
     (name "trealla")
-    (version "2.94.2")
+    (version "2.94.5")
     (source
      (origin
        (method git-fetch)
@@ -246,7 +246,7 @@ it.")
           (url "https://github.com/trealla-prolog/trealla")
           (commit (string-append "v" version))))
        (sha256
-        (base32 "15pxb1j0gwkbsp3406h0smscv9plm92splnha7gl5gz58am4109p"))
+        (base32 "1q56l81ph4brmmxka8kpld9rw0qxksdhgg30cqdcmnll45y688f4"))
        (file-name (git-file-name name version))))
     (build-system gnu-build-system)
     (inputs

gnu/packages/rust-sources.scm

@@ -1537,6 +1537,168 @@ repository, used as dependencies by codex-acp.")
 and runtime for AI-assisted coding.")
      (license license:asl2.0))))
 
+(define-public rust-codex-0.124.0
+  (hidden-package
+   (package
+     (inherit rust-codex-0.120.0)
+     (version "0.124.0")
+     (source
+      (origin
+        (method git-fetch)
+        (uri (git-reference
+              (url "https://github.com/openai/codex")
+              (commit "e9fb49366c93a1478ec71cc41ecee415a197d036")))
+        (file-name (git-file-name "rust-codex" "0.124.0"))
+        (sha256
+         (base32 "06il60npjnc0h91afyp3wk725cgy3ywk3hx2sbvzdxx6037z6nb0"))
+        (modules '((guix build utils)))
+        (snippet '(begin
+                    ;;; These are JSON manifests with a dotslash
+                    ;;; shebang that download and run pre-built
+                    ;;; binaries (ripgrep, bash) at runtime.
+                    (delete-file "codex-cli/bin/rg")
+                    ;; Bundled bubblewrap source tree; includes a
+                    ;; compiled BPF blob (demos/flatpak.bpf).
+                    (delete-file-recursively "codex-rs/vendor/bubblewrap")))
+        (patches (search-patches
+                  "codex-acp-0.11.1-disable-code-mode.patch"
+                  "rust-codex-0.124.0-code-mode-stub-toolname.patch"
+                  "rust-codex-0.124.0-remove-patch-sections.patch"
+                  "rust-codex-0.120.0-remove-libwebrtc.patch"))))
+     (arguments
+      (substitute-keyword-arguments (package-arguments rust-codex-0.120.0)
+        ;; 0.124 differs from 0.120 by a single removal
+        ;; (codex-instructions) and ten additions placed at topo-correct
+        ;; positions; the order also shifts in a few spots to satisfy new
+        ;; deps (e.g. codex-utils-cargo-bin moves before codex-app-server-
+        ;; protocol).  Replace the whole list rather than computing a
+        ;; delta against the inherited one.
+        ((#:cargo-package-crates _)
+         ''(;; Topologically sorted by internal dependency order.
+            "codex-async-utils"
+            "codex-utils-absolute-path"
+            "codex-execpolicy"
+            "codex-utils-home-dir"
+            "codex-utils-rustls-provider"
+            "codex-network-proxy"
+            "codex-utils-cache"
+            "codex-utils-image"
+            "codex-utils-string"
+            "codex-utils-template"
+            "codex-protocol"
+            "codex-agent-identity"
+            "codex-experimental-api-macros"
+            "codex-shell-command"
+            "codex-utils-cargo-bin"
+            "codex-app-server-protocol"
+            "codex-client"
+            "codex-api"
+            "codex-otel"
+            "codex-features"
+            "codex-model-provider-info"
+            "codex-utils-path"
+            "codex-config"
+            "codex-sandboxing"
+            "codex-utils-pty"
+            "codex-exec-server"
+            "codex-git-utils"
+            "codex-keyring-store"
+            "codex-terminal-detection"
+            "codex-login"
+            "codex-utils-plugins"
+            "codex-plugin"
+            "codex-analytics"
+            "codex-ansi-escape"
+            "codex-apply-patch"
+            "codex-code-mode"
+            "codex-connectors"
+            "codex-skills"
+            "codex-utils-output-truncation"
+            "codex-core-skills"
+            "codex-core-plugins"
+            "codex-feedback"
+            "codex-hooks"
+            "codex-rmcp-client"
+            "codex-mcp"
+            "codex-aws-auth"
+            "codex-model-provider"
+            "codex-collaboration-mode-templates"
+            "codex-response-debug-context"
+            "codex-models-manager"
+            "codex-file-search"
+            "codex-state"
+            "codex-rollout"
+            "codex-rollout-trace"
+            "codex-secrets"
+            "codex-shell-escalation"
+            "codex-thread-store"
+            "codex-tools"
+            "codex-utils-readiness"
+            "codex-utils-stream-parser"
+            "codex-windows-sandbox"
+            "codex-core"
+            "codex-linux-sandbox"
+            "codex-arg0"
+            "codex-backend-openapi-models"
+            "codex-backend-client"
+            "codex-utils-cli"
+            "codex-chatgpt"
+            "codex-cloud-requirements"
+            "codex-device-key"
+            "codex-utils-json-to-toml"
+            "codex-app-server"
+            "codex-app-server-client"
+            "codex-app-server-test-client"
+            "codex-cloud-tasks-client"
+            "codex-cloud-tasks-mock-client"
+            "codex-install-context"
+            "codex-realtime-webrtc"
+            "codex-utils-approval-presets"
+            "codex-utils-elapsed"
+            "codex-utils-fuzzy-match"
+            "codex-lmstudio"
+            "codex-ollama"
+            "codex-utils-oss"
+            "codex-utils-sandbox-summary"
+            "codex-utils-sleep-inhibitor"
+            "codex-exec"
+            "codex-mcp-server"
+            "codex-process-hardening"
+            "codex-responses-api-proxy"
+            "codex-uds"
+            "codex-stdio-to-uds"
+            "codex-debug-client"
+            "codex-execpolicy-legacy"
+            "codex-test-binary-support"))
+        ((#:phases orig)
+         ;; Two changes from the inherited phases:
+         ;; (1) 'add-version-to-workspace-deps stamps the literal
+         ;;     0.120.0 version inside its substitute pattern, so we
+         ;;     swap the whole phase for one stamping 0.124.0 (and
+         ;;     using a regex that also matches the codex_windows_
+         ;;     sandbox underscore alias introduced in 0.124).
+         ;; (2) Add a new phase 'break-dev-dep-cycles to strip the
+         ;;     codex-test-binary-support dev-dep from exec-server and
+         ;;     core; it forms a cycle (test-binary-support -> arg0 ->
+         ;;     {exec-server,core} -> test-binary-support) that cargo
+         ;;     package --no-verify still rejects.
+         #~(modify-phases #$orig
+             (replace 'add-version-to-workspace-deps
+               (lambda _
+                 (let ((cargo-files (find-files "." "^Cargo\\.toml$")))
+                   (substitute* cargo-files
+                     (("(codex[_-][a-z0-9_-]+) = \\{ path = " all name)
+                      (string-append name " = { version = \"0.124.0\", path = "))
+                     (("(codex[_-][a-z0-9_-]+) = \\{ package = " all name)
+                      (string-append name " = { version = \"0.124.0\", package = "))
+                     (("^(path = \"\\.\\./[^\"]*\")" all path-line)
+                      (string-append path-line "\nversion = \"0.124.0\""))))))
+             (add-after 'add-version-to-workspace-deps 'break-dev-dep-cycles
+               (lambda _
+                 (substitute* '("exec-server/Cargo.toml" "core/Cargo.toml")
+                   (("^codex-test-binary-support = \\{[^}]*\\}\n") ""))))))))
+     (inputs (cargo-inputs 'rust-codex-0.124.0)))))
+
 ;; Also update (@ (gnu packages gnome) glycin-loaders) when updating this.
 (define-public rust-glycin-3
   (package

gnu/packages/statistics.scm

@@ -384,15 +384,15 @@ comparison and diagnostics.")
 (define r-with-tests
   (package
     (name "r-with-tests")
-    (version "4.5.3")
+    (version "4.6.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://cran/src/base/R-"
                                   (version-major version) "/R-"
-                                  version ".tar.gz"))
+                                  version ".tar.xz"))
               (sha256
                (base32
-                "1wmqnm813lb58c0vwhjymnkfih3a6mq4cr9xa6n72wiw57a1wp5a"))))
+                "09sszy5fykpl2lyzxw5rgiabb3f5l62bqamnm7g2q9d57xlv7wli"))))
     (build-system gnu-build-system)
     (arguments
      (list

gnu/packages/syncthing.scm

@@ -50,7 +50,7 @@
 (define-public syncthing
   (package
     (name "syncthing")
-    (version "2.0.14")
+    (version "2.0.16")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/syncthing/syncthing"
@@ -58,7 +58,7 @@
                                   "/syncthing-source-v" version ".tar.gz"))
               (sha256
                (base32
-                "00isf0j9nf0752wrn79nh4aj5ij5gapv1kvhrg8ydmmw1gi6rhzy"))))
+                "0sgij3i2mhl6m9n2d98cz86f17215kfdc3z913k8yz4n8gwkcf7r"))))
     ;; TODO: Build from git, remove vendor.
     (build-system go-build-system)
     ;; The primary Syncthing executable goes to "out", while the auxiliary
@@ -73,6 +73,7 @@
        #:import-path "github.com/syncthing/syncthing"
        ;; Check 'go.mod' in the source distribution for the required version of Go.
        ;; We don't need to install the source code for end-user applications.
+       #:go go-1.25
        #:install-source? #f
        #:phases
        #~(modify-phases %standard-phases

gnu/packages/tor-browsers.scm

@@ -115,16 +115,16 @@ Firefox locales.")
 
 ;; We copy the official build id, which is defined at
 ;; tor-browser-build/rbm.conf (browser_release_date).
-(define %torbrowser-build-date "20260404073000")
+(define %torbrowser-build-date "20260420133000")
 
 ;; To find the last version, look at https://www.torproject.org/download/.
-(define %torbrowser-version "15.0.9")
+(define %torbrowser-version "15.0.10")
 
 ;; To find the last Firefox version, browse
 ;; https://archive.torproject.org/tor-package-archive/torbrowser/<%torbrowser-version>
 ;; There should be only one archive that starts with
 ;; "src-firefox-tor-browser-".
-(define %torbrowser-firefox-version "140.9.1esr-15.0-1-build1")
+(define %torbrowser-firefox-version "140.10.0esr-15.0-1-build2")
 
 ;; See tor-browser-build/rbm.conf for the list.
 (define %torbrowser-locales (list "ar" "be" "bg" "ca" "cs" "da" "de" "el" "es-ES" "fa"
@@ -139,11 +139,11 @@ Firefox locales.")
     (method git-fetch)
     (uri (git-reference
           (url "https://gitlab.torproject.org/tpo/translation.git")
-          (commit "ce651a6f8aa3a6c5ff9c3f9c77d3cb9585dcc903")))
+          (commit "b09d79a755bda88aa22580243e335b7187099aef")))
     (file-name "translation-base-browser")
     (sha256
      (base32
-      "0cr82adjkqkbamb4qk7xpr84lch4js4n126pzsm1993np0ap7vjp"))))
+      "1rafwbb27z9bscsqzb3n4bfda0k1x4mhwnnl0cy6hkk5av0wjq27"))))
 
 ;; See tor-browser-build/projects/translation/config.
 (define torbrowser-translation-specific
@@ -151,11 +151,11 @@ Firefox locales.")
     (method git-fetch)
     (uri (git-reference
           (url "https://gitlab.torproject.org/tpo/translation.git")
-          (commit "685a144cb5cfdb50afc1e4effae48a63b3a81ee3")))
+          (commit "acc7524bf476d29487aa85641c68b99e28c47e7d")))
     (file-name "translation-tor-browser")
     (sha256
      (base32
-      "02z1cfzyg10g4z4iz5z1k3jjv7k0ydmsf6i923iir02yw2jgznp7"))))
+      "1ic4cqi35qycli6j7k0dm760npi7bp9m9sgdzjj7aid83bp5kb4j"))))
 
 (define torbrowser-assets
   ;; This is a prebuilt Torbrowser from which we take the assets we need.
@@ -171,7 +171,7 @@ Firefox locales.")
          version "/tor-browser-linux-x86_64-" version ".tar.xz"))
        (sha256
         (base32
-         "039nys7h83avkva16rg7lvrxh08pczw08vklxrh90pm38fpipddk"))))
+         "1vmax8ynwmrcgjr55xggrrs7dpkx9j1q505plgb84cmn4f9s6l9y"))))
     (arguments
      (list
       #:install-plan
@@ -212,7 +212,7 @@ Browser.")
          ".tar.xz"))
        (sha256
         (base32
-         "0jvlznd2rc68c9bl7al405dpgk0806hznxn198ji0nryjr5hmzd5"))))
+         "0q059g1aj14403ixs3drw4z3w8q8w34w01cy92zzmq2cnxjhqglj"))))
     (build-system mozilla-build-system)
     (inputs
      (list lyrebird
@@ -789,17 +789,17 @@ attacks on the privacy of Tor users.")
 
 ;; We copy the official build id, which can be found there:
 ;; https://cdn.mullvad.net/browser/update_responses/update_1/release.
-(define %mullvadbrowser-build-date "20260404073000")
+(define %mullvadbrowser-build-date "20260420133000")
 
 ;; To find the last version, look at
 ;; https://mullvad.net/en/download/browser/linux.
-(define %mullvadbrowser-version "15.0.9")
+(define %mullvadbrowser-version "15.0.10")
 
 ;; To find the last Firefox version, browse
 ;; https://archive.torproject.org/tor-package-archive/mullvadbrowser/<%mullvadbrowser-version>
 ;; There should be only one archive that starts with
 ;; "src-firefox-mullvad-browser-".
-(define %mullvadbrowser-firefox-version "140.9.1esr-15.0-1-build1")
+(define %mullvadbrowser-firefox-version "140.10.0esr-15.0-1-build2")
 
 ;; See tor-browser-build/projects/translation/config.
 (define mullvadbrowser-translation-base
@@ -807,11 +807,11 @@ attacks on the privacy of Tor users.")
     (method git-fetch)
     (uri (git-reference
           (url "https://gitlab.torproject.org/tpo/translation.git")
-          (commit "ce651a6f8aa3a6c5ff9c3f9c77d3cb9585dcc903")))
+          (commit "b09d79a755bda88aa22580243e335b7187099aef")))
     (file-name "translation-base-browser")
     (sha256
      (base32
-      "0cr82adjkqkbamb4qk7xpr84lch4js4n126pzsm1993np0ap7vjp"))))
+      "1rafwbb27z9bscsqzb3n4bfda0k1x4mhwnnl0cy6hkk5av0wjq27"))))
 
 ;; See tor-browser-build/projects/translation/config.
 (define mullvadbrowser-translation-specific
@@ -839,7 +839,7 @@ attacks on the privacy of Tor users.")
          version "/mullvad-browser-linux-x86_64-" version ".tar.xz"))
        (sha256
         (base32
-         "154nraw83lhyrhrahvd35zvclnshcfvgjq16cr2z9jg5sz7c4hhs"))))
+         "03y9z302xjvsnwac4x4ghb88y40pm78vhikli1yyary65qyicxfm"))))
     (arguments
      (list
       #:install-plan
@@ -882,7 +882,7 @@ Mullvad Browser.")
          %mullvadbrowser-firefox-version ".tar.xz"))
        (sha256
         (base32
-         "0i860k6i2dc86jj9hg2hvm0g071iha7zxngnrn21kbilqr4hi61z"))))
+         "19wr2jkc2p0i3y7j43xjx54g6ckpxfr5bgsawqvrfkx6ls81mfh4"))))
     (arguments
      (substitute-keyword-arguments arguments
        ((#:phases phases)

gnu/packages/vim.scm

@@ -232,39 +232,39 @@ with the editor vim.")))
     (inherit vim)
     (name "vim-full")
     (arguments
-     (cons*
-       #:configure-flags
-       #~(list (string-append "--with-lua-prefix="
-                              #$(this-package-input "lua"))
-               "--with-features=huge"
-               "--enable-python3interp=yes"
-               "--enable-perlinterp=yes"
-               "--enable-rubyinterp=yes"
-               "--enable-tclinterp=yes"
-               "--enable-luainterp=yes"
-               "--enable-cscope"
-               "--enable-sniff"
-               "--enable-multibyte"
-               "--enable-xim"
-               "--disable-selinux"
-               "--enable-gui")
-       (substitute-keyword-arguments arguments
-         ((#:phases phases)
-          #~(modify-phases #$phases
-              (add-before 'check 'skip-some-more-tests
-                (lambda _
-                  ;; Fontconfig can't figure out its cache directory.
-                  (substitute* "src/testdir/test_startup.vim"
-                    ((".*Test_progname.*" line)
-                     (string-append line "return\n")))))
-              ;; Some tests require an X server, but do not start one.
-              (add-before 'check 'start-xserver
-                (lambda _
-                  (setenv "DISPLAY" ":1")
-                  (zero? (system #$(file-append
-                                     (this-package-native-input
-                                       "xorg-server")
-                                     "/bin/Xvfb :1 &"))))))))))
+     (substitute-keyword-arguments arguments
+       ((#:configure-flags flags #~'())
+        #~(cons* (string-append "--with-lua-prefix="
+                                #$(this-package-input "lua"))
+                 "--with-features=huge"
+                 "--enable-python3interp=yes"
+                 "--enable-perlinterp=yes"
+                 "--enable-rubyinterp=yes"
+                 "--enable-tclinterp=yes"
+                 "--enable-luainterp=yes"
+                 "--enable-cscope"
+                 "--enable-sniff"
+                 "--enable-multibyte"
+                 "--enable-xim"
+                 "--disable-selinux"
+                 "--enable-gui"
+                 #$flags))
+       ((#:phases phases)
+        #~(modify-phases #$phases
+            (add-before 'check 'skip-some-more-tests
+              (lambda _
+                ;; Fontconfig can't figure out its cache directory.
+                (substitute* "src/testdir/test_startup.vim"
+                  ((".*Test_progname.*" line)
+                   (string-append line "return\n")))))
+            ;; Some tests require an X server, but do not start one.
+            (add-before 'check 'start-xserver
+              (lambda _
+                (setenv "DISPLAY" ":1")
+                (zero? (system #$(file-append
+                                   (this-package-native-input
+                                     "xorg-server")
+                                   "/bin/Xvfb :1 &")))))))))
     (native-inputs
      (modify-inputs native-inputs
        (prepend pkg-config xorg-server-for-tests)))

gnu/packages/web.scm

@@ -584,6 +584,7 @@ the same, being completely separated from the Internet.")
       #:configure-flags
       #~(list "--with-http_ssl_module"
               "--with-http_v2_module"
+              "--with-http_v3_module"
               "--with-http_xslt_module"
               "--with-http_gzip_static_module"
               "--with-http_gunzip_module"
@@ -5851,8 +5852,8 @@ Cloud.")
     (license license:expat)))
 
 (define-public guix-data-service
-  (let ((commit "9a03cdff18c097a2987dfd12d55d0e3572969a98")
-        (revision "75"))
+  (let ((commit "58744bbdc513331e5d5129fffd27e8c5d0336d2e")
+        (revision "76"))
     (package
       (name "guix-data-service")
       (version (string-append "0.0.1-" revision "." (string-take commit 7)))
@@ -5864,7 +5865,7 @@ Cloud.")
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "0lc9np1ijr10ym9xn3bhanq3zgsl2br6k5lnq90f4igmpc5jf1bh"))))
+                  "0ijwhmf42nriwp5770yh0pikszqnymhvgzpziy72a19dq58cv1lj"))))
       (build-system gnu-build-system)
       (arguments
        (list

gnu/services/databases.scm

@@ -11,6 +11,7 @@
 ;;; Copyright © 2021 Aljosha Papsch <ep@stern-data.com>
 ;;; Copyright © 2025, 2026 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;; Copyright © 2025, 2026 Ashvith Shetty <ashvithshetty0010@zohomail.in>
+;;; Copyright © 2026 Mattia Bunel <mattia.bunel@ehess.fr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -115,8 +116,8 @@
   (plain-file "pg_hba.conf"
               "
 local	all	all			peer
-host	all	all	127.0.0.1/32 	md5
-host	all	all	::1/128 	md5"))
+host	all	all	127.0.0.1/32 	scram-sha-256
+host	all	all	::1/128 	scram-sha-256"))
 
 (define %default-postgres-ident
   (plain-file "pg_ident.conf"

gnu/services/guix.scm

@@ -108,6 +108,10 @@
             guix-data-service-host
             guix-data-service-getmail-idle-mailboxes
             guix-data-service-commits-getmail-retriever-configuration
+            guix-data-service-extra-options
+            guix-data-service-extra-process-jobs-options
+            guix-data-service-extra-environment-variables
+            guix-data-service-extra-process-jobs-environment-variables
             guix-data-service-configuration-git-repositories
             guix-data-service-configuration-build-servers
 
@@ -587,6 +591,12 @@
   (extra-process-jobs-options
    guix-data-service-extra-process-jobs-options
    (default '()))
+  (extra-environment-variables
+   guix-data-service-extra-environment-variables
+   (default '()))
+  (extra-process-jobs-environment-variables
+   guix-data-service-extra-process-jobs-environment-variables
+   (default '()))
   (git-repositories guix-data-service-configuration-git-repositories
                     (default #f))
   (build-servers    guix-data-service-configuration-build-servers
@@ -601,6 +611,8 @@ ca-certificates.crt file in the system profile."
 (define (guix-data-service-shepherd-services config)
   (match-record config <guix-data-service-configuration>
     (package user group port host extra-options extra-process-jobs-options
+             extra-environment-variables
+             extra-process-jobs-environment-variables
              git-repositories build-servers)
     (list
      (shepherd-service
@@ -626,7 +638,8 @@ ca-certificates.crt file in the system profile."
                 `(,(string-append
                     "GUIX_LOCPATH="
                     #$(libc-utf8-locales-for-target) "/lib/locale")
-                  "LC_ALL=en_US.UTF-8")
+                  "LC_ALL=en_US.UTF-8"
+                  #$@extra-environment-variables)
                 #:log-file "/var/log/guix-data-service/web.log"))
       (stop #~(make-kill-destructor)))
 
@@ -678,7 +691,8 @@ ca-certificates.crt file in the system profile."
           `(,(string-append
               "GUIX_LOCPATH="
               #$(libc-utf8-locales-for-target) "/lib/locale")
-            "LC_ALL=en_US.utf8")
+            "LC_ALL=en_US.utf8"
+            #$@extra-environment-variables)
           #:log-file "/var/log/guix-data-service/setup-database.log"))
       (auto-start? #t))
 
@@ -700,7 +714,8 @@ ca-certificates.crt file in the system profile."
                   ,(string-append
                     "GUIX_LOCPATH="
                     #$(libc-utf8-locales-for-target) "/lib/locale")
-                  "LC_ALL=en_US.UTF-8")
+                  "LC_ALL=en_US.UTF-8"
+                  #$@extra-process-jobs-environment-variables)
                 #:log-file "/var/log/guix-data-service/process-jobs.log"))
       (stop #~(make-kill-destructor))))))
 

gnu/system/linux-container.scm

@@ -356,13 +356,18 @@ Run the container with the given options."))
                          (mappings '())
                          (mounts '())
                          (namespaces %namespaces)
-                         (guest-uid 0) (guest-gid 0))
+                         (guest-uid 0) (guest-gid 0)
+                         (child-is-pid1? #t))
   "Evaluate EXP, a gexp, in a new process executing in separate namespaces as
 listed in NAMESPACES.  Add MOUNTS, a list of <file-system>, and MAPPINGS, a
 list of <file-system-mapping>, to the set of directories visible in the
 process's mount namespace.  Inside the namespaces, run code as GUEST-UID and
 GUEST-GID.  Return the process' exit status as a monadic value.
 
+When CHILD-IS-PID1? is true, and if NAMESPACES contains 'pid', then the child
+process runs directly as PID 1. See the documentation for
+`(@@ (gnu build linux-container) call-with-container)` for further details.
+
 This is useful to implement processes that, unlike derivations, are not
 entirely pure and need to access the outside world or to perform side
 effects."
@@ -406,4 +411,5 @@ effects."
                   #:populate-file-system populate-file-system
                   #:namespaces namespaces
                   #:guest-uid guest-uid
-                  #:guest-gid guest-gid))))))
+                  #:guest-gid guest-gid
+                  #:child-is-pid1? child-is-pid1?))))))

guix/scripts/environment.scm

@@ -1000,6 +1000,12 @@ WHILE-LIST."
             ;; Call an additional setup procedure, if provided.
             (when setup-hook
               (setup-hook profile)))
+
+          ;; Do not run the shell as PID 1 since that prevents proper signal
+          ;; handling: per `man 2 kill`, only signals for which the init process
+          ;; has explicitly installed signal handlers can be sent to it.
+          #:child-is-pid1? #f
+
           #:guest-uid uid
           #:guest-gid gid
           #:writable-root? writable-root?

guix/scripts/home.scm

@@ -372,7 +372,8 @@ immediately.  Return the exit status of the process in the container."
                     (check? #f)))
    #:mappings (append network-mappings mappings)
    #:guest-uid uid
-   #:guest-gid gid))
+   #:guest-gid gid
+   #:child-is-pid1? #f))
 
 
 ;;;