Publish srcux candidate 0000000788-20261022-030227HEADdevelop

109 files changed, 4409 insertions, 792 deletions

diff --git a/app-admin/apache-tools/apache-tools-2.4.69.ebuild b/app-admin/apache-tools/apache-tools-2.4.69.ebuild
index a6ac248cc099..e0b32ac004e1 100644
--- a/app-admin/apache-tools/apache-tools-2.4.69.ebuild
+++ b/app-admin/apache-tools/apache-tools-2.4.69.ebuild
@@ -16,7 +16,7 @@ S="${WORKDIR}/httpd-${PV}"
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos ~x64-solaris"
 IUSE="ssl"
 
 RDEPEND="
diff --git a/app-editors/neovim/Manifest b/app-editors/neovim/Manifest
index fc0a70d12f29..110c342f16a6 100644
--- a/app-editors/neovim/Manifest
+++ b/app-editors/neovim/Manifest
@@ -1,4 +1,4 @@
 DIST neovim-0.11.7.tar.gz 13018335 BLAKE2B c1951bee1d6284317555e79cb92b855a25ecb4b97619ecf0e4244b43bc6673b40be6ab3cebe1451642a13b293c8474cffb96ced3ee4a6943a153d4b9043e2ef5 SHA512 23e13f8c2964bff4d69c69cce137aaaaae9d0219750793da1834d099478f7a9d7170ae3d66cf096824ff42bbd0c9196e4a31858b84032533678e359fe75c6f79
-DIST neovim-0.12.0.tar.gz 13648075 BLAKE2B caa5899489b0d0fba4f1214a342d0c2bb4f6e37c7c263bbde8fe01b103e0f0230d94518a69121e228cec1d70fdcbea15683e9a02d055dcbfb6afabbc28fba19a SHA512 1897ddcf730a6593e561b7bb555405a5fd5aa495bd73a6434ec0358b525b53925e0b45346697fb846bd36c724e1fa3b7a310908152bafb1c3724a08e86a97c5b
 DIST neovim-0.12.4.tar.gz 13711232 BLAKE2B b3ed3a197b225c79359d89dff615215f14180e81622b73a9ed3425b413b6b7d8a06fc2a6ebb4f0a556e7413287e96350136803dc2824b912917019437c83fe71 SHA512 24656352a4d4785068640a3c53246bbfaf14c2d2e59f9ec8348399db17bc4104032ae62e56797038a65fc086d893dac1ce692a5eb4d186226b65f4cf694c835e
 DIST neovim-0.12.5.tar.gz 13720423 BLAKE2B 7fc7098d67e21981999ed01f5beac3ea6d1c0f80fe3f67a19436bd2ce73f17934720d8c307dcec81697ace9644f7f5b4fa08e95e7e6052ffdd89b04f6bc5af0d SHA512 94b681395a60ce06ec327c578f875b828256891d660c9e34f1f9c0b48577d2f85cbe0c2a8f377fba3b068782cc54dcaeda046045a2bdb7166340e12cf3d70354
+DIST neovim-0.12.6.tar.gz 13722771 BLAKE2B 23809190a67920ca54050325e8b1881f78fcbda97282b95b475109c3ded8247a1ed202f34357db7dd58ece888e76fc54874ca1d9d073f6b4ca0146065750f538 SHA512 7baf1a6c5e46845b415f522ad17129a3af33c698356f1f7f276481a7f55e3fc994ba1399aac85e1cd1b8436cc59f733ff1fddc12cdb027c295be1abd2dd20448
diff --git a/app-editors/neovim/neovim-0.12.0-r1.ebuild b/app-editors/neovim/neovim-0.12.6.ebuild
index 6bb4d8add213..bf60a46f7a07 100644
--- a/app-editors/neovim/neovim-0.12.0-r1.ebuild
+++ b/app-editors/neovim/neovim-0.12.6.ebuild
@@ -16,7 +16,7 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://github.com/neovim/neovim.git"
 else
 	SRC_URI="https://github.com/neovim/neovim/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86 ~x64-macos"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~x86"
 fi
 
 LICENSE="Apache-2.0 vim"
@@ -108,8 +108,8 @@ src_install() {
 
 	# symlink tree-sitter parsers
 	dodir /usr/share/nvim/runtime
-	for parser in c lua markdown query vim vimdoc; do
-		dosym ../../../../$(get_libdir)/libtree-sitter-${parser}.so /usr/share/nvim/runtime/parser/${parser}.so
+	for parser in c lua markdown markdown_inline query vim vimdoc; do
+		dosym ../../../../$(get_libdir)/libtree-sitter-${parser/_/-}.so /usr/share/nvim/runtime/parser/${parser}.so
 	done
 
 	# conditionally install a symlink for nvimpager
diff --git a/app-misc/ddcutil/ddcutil-2.2.7.ebuild b/app-misc/ddcutil/ddcutil-2.2.7.ebuild
index bad789d7510e..8f506b73091f 100644
--- a/app-misc/ddcutil/ddcutil-2.2.7.ebuild
+++ b/app-misc/ddcutil/ddcutil-2.2.7.ebuild
@@ -53,6 +53,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-1.4.1-no-werror.patch
 	"${FILESDIR}"/${PN}-2.2.7-fix-build-without-dbus.patch
 	"${FILESDIR}"/${PN}-2.2.7-fix-build-without-X.patch
+	"${FILESDIR}"/${PN}-2.2.7-remove-execinfo.patch
 )
 
 pkg_pretend() {
diff --git a/app-misc/ddcutil/files/ddcutil-2.2.7-remove-execinfo.patch b/app-misc/ddcutil/files/ddcutil-2.2.7-remove-execinfo.patch
new file mode 100644
index 000000000000..b09c00ff1ff2
--- /dev/null
+++ b/app-misc/ddcutil/files/ddcutil-2.2.7-remove-execinfo.patch
@@ -0,0 +1,21 @@
+https://bugs.gentoo.org/984145
+https://github.com/rockowitz/ddcutil/commit/ebff872
+---
+ src/util/linux_util.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/src/util/linux_util.c b/src/util/linux_util.c
+index 2d36afbcc..21849e2df 100644
+--- a/src/util/linux_util.c
++++ b/src/util/linux_util.c
+@@ -10,7 +10,6 @@
+ 
+ /** \cond */
+ #include <assert.h>
+-#include <execinfo.h>      // for segv handler
+ #include <fcntl.h>
+ #include <glib-2.0/glib.h>
+ #include <inttypes.h>
+-- 
+2.55.0
+
diff --git a/dev-build/kas/Manifest b/dev-build/kas/Manifest
index 97a8a8159cad..0cc6d057b83f 100644
--- a/dev-build/kas/Manifest
+++ b/dev-build/kas/Manifest
@@ -1,3 +1,4 @@
 DIST kas-5.1.gh.tar.gz 141260 BLAKE2B 1168202fa2ff6d6b72fcde049add8030d963f9b4d25ea882f1d0fea62f6a7624a2de449d13f8925ddaa82b743ec9fac68cc8bc1f73b84feead6c83740940d9bf SHA512 a399f248eb9a1d39a95c525ae43f642db1096a57b2caf94397af80e99cbb218a905186661b850d72b1f3997b7b10782a53980cac793f7859ee95d633f355e583
 DIST kas-5.2.gh.tar.gz 143789 BLAKE2B dce3c92db2e7afcc1d05751e16859724e77eb262d4d21227be160eec7c7d6fb331bb734f5d112eb6b4b4bba05e8266a8b51c1059350cb20a0e81889ef54d9fda SHA512 c9f38f66f68d1b59e5f8bc629cd7808f2e0ca13173e21d0521eb382666c7f12cfd14dba072c5316aae997318044061606c4a0258fe32c6c824a488337e014b3d
 DIST kas-5.4.gh.tar.gz 151139 BLAKE2B 93c9c7d6233a0564090ab0a744a7ff1116ca2eb2344208c705dc46fcf21f69a1f9f598ffa71ee9c5ebf41c7c9a8c2ec819214ee945239789b070d4cf21708a55 SHA512 5bf549ec9f8bccaa2adfd77387e3a267a5afe281f30efb0a3b3d116a47e1d87fc3bcfeeedd5f08d0bacfda97fe5aa39f7fdb6ea6a30f15e99ad6473b442bec8b
+DIST kas-5.5.gh.tar.gz 154788 BLAKE2B cf16512cb1cff434a4186d5e5210ee4840acf7aa23749de71c0b6f31f491c7c270cfdfd4c70c8ffb8dc447f046deaf60c25f76a4c3dfa8c42df26a3ee08f55ae SHA512 e9b00b66736409c1d0150b3f2389e8878ffeade969d9fb92f953a8e72869966b6e18570ca84c885b947fdeeed6f626b6a77cc753c5bd9fa448c3679327da6606
diff --git a/dev-build/kas/kas-5.5.ebuild b/dev-build/kas/kas-5.5.ebuild
new file mode 100644
index 000000000000..21c8d3492dd2
--- /dev/null
+++ b/dev-build/kas/kas-5.5.ebuild
@@ -0,0 +1,100 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1 optfeature
+
+DESCRIPTION="Setup tool for bitbake based projects"
+HOMEPAGE="
+	https://github.com/siemens/kas
+	https://kas.readthedocs.io/en/latest/
+	https://pypi.org/project/kas/
+"
+# pypi does not package tests
+SRC_URI="
+	https://github.com/siemens/kas/archive/refs/tags/${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+
+RDEPEND="
+	dev-python/colorlog[${PYTHON_USEDEP}]
+	>=dev-python/pyyaml-3.0.0[${PYTHON_USEDEP}]
+	>=dev-python/distro-1.0.0[${PYTHON_USEDEP}]
+	>=dev-python/jsonschema-2.5.0[${PYTHON_USEDEP}]
+	>=dev-python/kconfiglib-14.1.0[${PYTHON_USEDEP}]
+	>=dev-python/gitpython-3.1.0[${PYTHON_USEDEP}]
+	dev-libs/newt[${PYTHON_USEDEP}]
+"
+
+BDEPEND="
+	${RDEPEND}
+	test? (
+		dev-python/python-gnupg[${PYTHON_USEDEP}]
+		dev-vcs/git
+		dev-vcs/mercurial
+	)
+"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+EPYTEST_DESELECT=(
+	"tests/test_build.py::test_provenance"
+	"tests/test_commands.py::test_for_all_repos"
+	"tests/test_commands.py::test_checkout_with_ci_rewrite"
+	"tests/test_commands.py::test_checkout_create_refs[noenv]"
+	"tests/test_commands.py::test_checkout_shallow[noenv]"
+	"tests/test_commands.py::test_checkout[noenv]"
+	"tests/test_commands.py::test_invalid_checkout[noenv-test-invalid-tag.yml-RepoRefError]"
+	"tests/test_commands.py::test_repo_includes[noenv]"
+	"tests/test_commands.py::test_repo_includes"
+	"tests/test_commands.py::test_shallow_updates[noenv]"
+	"tests/test_refspec.py::test_refspec_switch[noenv]"
+	"tests/test_refspec.py::test_refspec_absolute[noenv]"
+	"tests/test_refspec.py::test_tag_commit_do_not_match[noenv]"
+	"tests/test_refspec.py::test_unsafe_tag_warning[noenv]"
+	"tests/test_refspec.py::test_unsafe_branch_warning[noenv]"
+	"tests/test_refspec.py::test_tag_branch_same_name[noenv]"
+	"tests/test_refspec.py::test_refspec_warning[noenv]"
+	"tests/test_refspec.py::test_branch_and_tag[noenv]"
+	"tests/test_refspec.py::test_commit_expand[noenv]"
+	"tests/test_refspec.py::test_tag_commit_do_not_match[noenv]"
+	"tests/test_refspec.py::test_sha_like_branch_tag[noenv]"
+	"tests/test_refspec.py::test_sha_like_branch_exist[noenv]"
+	"tests/test_refspec.py::test_sha_like_branch_nonexist[noenv]"
+	"tests/test_refspec.py::test_sha_like_tag_nonexist[noenv]"
+	"tests/test_refspec.py::test_sha_like_tag_exist[noenv]"
+	"tests/test_refspec.py::test_abbrev_sha_like_branch_nonexist[noenv]"
+	"tests/test_refspec.py::test_abbrev_sha_like_branch_exist[noenv]"
+	"tests/test_refspec.py::test_abbrev_sha_like_tag_nonexist[noenv]"
+	"tests/test_refspec.py::test_abbrev_sha_like_tag_exist[noenv]"
+	"tests/test_signature_verify.py::test_signed_gpg_invalid[noenv]"
+	"tests/test_signature_verify.py::test_signed_gpg_remove_key[noenv]"
+	"tests/test_signature_verify.py::test_signed_gpg_local_key"
+	"tests/test_commands.py::test_dump[noenv]"
+	"tests/test_commands.py::test_diff"
+	"tests/test_commands.py::test_lockfile"
+	"tests/test_environment_variables.py::test_env_section_export_bb_extra_white"
+	"tests/test_environment_variables.py::test_env_section_export_bb_env_passthrough_additions"
+	"tests/test_environment_variables.py::test_ssh_agent_setup"
+)
+
+EPYTEST_IGNORE=(
+	"tests/test_layers.py"
+	"tests/test_menu.py"
+	"tests/test_patch.py"
+)
+
+pkg_postinst() {
+	optfeature_header "Install optional tools to clone repositories:"
+	optfeature "git repository support" dev-vcs/git
+	optfeature "mercurial repository support" dev-vcs/mercurial
+}
diff --git a/dev-cpp/aws-crt-cpp/Manifest b/dev-cpp/aws-crt-cpp/Manifest
index 8b89c7bdb504..1c1b9f2b49b5 100644
--- a/dev-cpp/aws-crt-cpp/Manifest
+++ b/dev-cpp/aws-crt-cpp/Manifest
@@ -3,3 +3,4 @@ DIST aws-crt-cpp-0.43.8.tar.gz 419135 BLAKE2B e49c624bf58ac7754a63d102440890ad1b
 DIST aws-crt-cpp-0.43.9.tar.gz 419126 BLAKE2B 0d83c63c5718c968982c6ca396e32c14fa0d4025ab637218653237c788f0d946c4be9b0d8dbee7dce2860f476307d5d44de2a90c1386f2e7f35fa6b0108e59d4 SHA512 5d99469ce215dcedca671e95fa6bbb573b9898f8bc90a1523e66626b7036a7729475a6804766e546aeaf9b408f1614b6da194acdfc42da076e8c86515a946a26
 DIST aws-crt-cpp-0.44.0.tar.gz 424083 BLAKE2B d803395c7bdf8224cfabd88f475fcf674def7157468ac6cafa74b270e6e96130af49dbdb456a9f5a70c6fbec4b6175852aea93deb19199e105d929f78dce021d SHA512 d2013fa02ef1c59a79be885c131fe626fba2d3cdec24547c667891200f9135e11f39138955877164f862acafd39e135268bd9613acac019548cf2d799dbe5edc
 DIST aws-crt-cpp-0.44.1.tar.gz 424092 BLAKE2B c295c62f483524468a115fd26ba430e1726160171a908f4c3e822f5fec1514f68e2c384e62d8dd5b472122cef6966d8be2f728c83e3c98a1cea4279a25a96739 SHA512 5b86d52939c89774c283cbab06c09787bd9900e5529453dd1cff26f467105e41bfa3a406d22079ce9cf077de020d6d0747d3f2b145afebb8bd486cf30c62371f
+DIST aws-crt-cpp-0.44.2.tar.gz 424170 BLAKE2B b31ce3adc199cc616789d0ee15cea8de7faee2df8af824edbfd207093474dc1607dcb226b9ac9e241d9caa5fbae0f5f339c32036938ba6e8a1c99cfc76cef4e2 SHA512 293741fcfba984829bb061f5f052710d3e94990a39db711e3877658ef682cf96ac19d96fc79a726c728f6c52b8dee1180326aa93cfdd692fe4cf57ee50956478
diff --git a/dev-cpp/aws-crt-cpp/aws-crt-cpp-0.44.2.ebuild b/dev-cpp/aws-crt-cpp/aws-crt-cpp-0.44.2.ebuild
new file mode 100644
index 000000000000..c2739af2c1c8
--- /dev/null
+++ b/dev-cpp/aws-crt-cpp/aws-crt-cpp-0.44.2.ebuild
@@ -0,0 +1,55 @@
+# Copyright 2025-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake
+
+DESCRIPTION="C++ wrapper around the aws-c-* libraries"
+HOMEPAGE="https://github.com/awslabs/aws-crt-cpp"
+SRC_URI="https://github.com/awslabs/aws-crt-cpp/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="test"
+
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	dev-libs/aws-c-auth:=
+	dev-libs/aws-c-cal:=
+	dev-libs/aws-c-common:=
+	dev-libs/aws-c-event-stream:=
+	dev-libs/aws-c-http:=
+	dev-libs/aws-c-io:=
+	dev-libs/aws-c-mqtt:=
+	dev-libs/aws-c-s3:=
+	dev-libs/aws-c-sdkutils:=
+	dev-libs/aws-checksums:=
+"
+RDEPEND="${DEPEND}"
+BDEPEND="dev-libs/aws-c-common"
+
+src_configure()
+{
+	local mycmakeargs=(
+		-DBUILD_DEPS=OFF # disable embedded 3rd-party repositories.
+		-DBUILD_TESTING=$(usex test)
+	)
+
+	use test && mycmakeargs+=(
+		-DENABLE_NET_TESTS=OFF # Network Sandbox cause these to fail.
+	)
+
+	cmake_src_configure
+}
+
+src_install()
+{
+	cmake_src_install
+
+	if use test; then
+		rm -r "${D}/usr/bin" || die "Error removing testbinaries from /usr/bin"
+	fi
+}
diff --git a/dev-python/b2sdk/Manifest b/dev-python/b2sdk/Manifest
index 9a99b7283c87..a55dfe86f292 100644
--- a/dev-python/b2sdk/Manifest
+++ b/dev-python/b2sdk/Manifest
@@ -1,2 +1,2 @@
-DIST b2sdk-2.13.0.gh.tar.gz 497308 BLAKE2B c34f4144bd54305668f041a61a77b08871857ad08746e4deeaa83ca499ba09d985c4fcfa86d761c589248258296bd24a21093e7b52cad45296d011001fe62e22 SHA512 7e615a1fa43ff1288d5f34ea7530dc0ed90195db331f21eeaa26f32083a27fdbc5d18c81f30a591d7d10c84637af24bcc67db2597b23a8697ba04001c2c23923
 DIST b2sdk-2.13.1.gh.tar.gz 556425 BLAKE2B 660ee67f87060a8b3168afb60006449641ab182d113ee88b765269b84f44eaafaccb2ba3b5cae34e91885decfb8610b42abec8ee546c7204b7ade5a89310a2b0 SHA512 04efb0da37a96451f390713585072f1cec00e9139fb6c4481cc6e06977f823faa8f483fe210bbed76b4fcd0c21fe1714baef70b27305555ea2111724de8d550e
+DIST b2sdk-2.13.2.gh.tar.gz 556998 BLAKE2B 1283d73077635347fd849947c831079257902d4e210bcb61e1e1b698c097d559928c5e9286bd8936644b0c68c7755d2cea1a1b22c80d0fea66c970e5b2f0cd6d SHA512 814382606b387a6020c9cbd8675ed8f52d41e6f93f9cbfe3f633f458b1bda6e1f6e5bdfcb0d8eaa059bed48431ba4e29026368f41d3da3f38541c9086abb7e91
diff --git a/dev-python/b2sdk/b2sdk-2.13.0.ebuild b/dev-python/b2sdk/b2sdk-2.13.2.ebuild
index 1c369300e6f9..4a89df5755bf 100644
--- a/dev-python/b2sdk/b2sdk-2.13.0.ebuild
+++ b/dev-python/b2sdk/b2sdk-2.13.2.ebuild
@@ -24,6 +24,7 @@ KEYWORDS="~amd64"
 # pydantic can be used but it has a fallback
 RDEPEND="
 	>=dev-python/annotated-types-0.5.0[${PYTHON_USEDEP}]
+	>=dev-python/certifi-2026.10.19[${PYTHON_USEDEP}]
 	>=dev-python/logfury-1.0.1[${PYTHON_USEDEP}]
 	>=dev-python/requests-2.33.0[${PYTHON_USEDEP}]
 	>=dev-python/tenacity-9.1.2[${PYTHON_USEDEP}]
diff --git a/dev-python/bracex/Manifest b/dev-python/bracex/Manifest
index 42199b83d543..7800f5df69c7 100644
--- a/dev-python/bracex/Manifest
+++ b/dev-python/bracex/Manifest
@@ -2,3 +2,5 @@ DIST bracex-3.0.1.tar.gz 44019 BLAKE2B 12a8d7510c80e48b2461efbc85078aee51f0bf93b
 DIST bracex-3.0.1.tar.gz.provenance 9626 BLAKE2B 24fee61e3b213b97bc72a053c8377ea82c397eb2e1361c639c040a68dc81e25a318e41c3699cfad9f9d8f7ba934f163c7bac5d2a78edbf5e54223b7924bd4daf SHA512 377c69a0f72fb83cfb74659b6c76c6a733f92b85174dd42952746e7e905a2b9d60e4ca8d76df126857d685de557daa6da192f50d1903124addf7bf48efa77861
 DIST bracex-3.1.tar.gz 29040 BLAKE2B 63c4440f9a4b2e374cf576c912b064240010d664be6bf578ea6b58110c2e4a72142693651fc0bbf692d9cc4caef23e192bdca6acbed0fab3e7e6c4d6a5d2ac5c SHA512 ea08acb29cabe0a0903af382b73c9e63ec02c4af6784728cd332949a0c19db44d1beef487455075f66b08599132ae3524d616b1646f41c39e86f9c691739a8c3
 DIST bracex-3.1.tar.gz.provenance 9559 BLAKE2B 784da80e4cc9a89a66dcbc3cfb6cc9482762c53598d60608c7d88f7332d17b87128b647f78d202a993eb98d9b7874fe23f5eb29b8293a4bd64bdb0a1401efbd8 SHA512 440ee763aa7b6ff243e48db7584faa2e7b73604b95354c19fa93bd72eec4b95f0b87da952b85b225ec0236f3ff281aa09921161a23a9101901d8f5092524745f
+DIST bracex-3.2.tar.gz 29771 BLAKE2B aff9fed33dcae630bad4050f6b431be59357b8ba1591ea31af95a98f9d04550f47909fe27cfa0d6bce1adf925c5b8786037197bce4e8dd1cd16e66908b5b7cca SHA512 bde1249d3d599a6b5ae3ca1c0d5b14314d758394ea96981a043b4db2bfb4c82b1bdfb6e4800c2a41b58471497eb120b4a69bfbc4a436cb88773872f81fd0e7ba
+DIST bracex-3.2.tar.gz.provenance 9515 BLAKE2B d2478c25e923a95820fc04a775ed7fa9e70dbb295f22b30c89b4d128f2a0003a0e0686522ca7e16d9bcb2bb2235f448a81877f4570172327da086cbe07d53a90 SHA512 179af3706a336581c9b96bf5254f09184f491ca55cabf7cd69d3dad6cf36b2228d174bc9a76737894da566845e985e846fea94e0d3145bbd47b444a11bf52f9a
diff --git a/dev-python/bracex/bracex-3.2.ebuild b/dev-python/bracex/bracex-3.2.ebuild
new file mode 100644
index 000000000000..06fae3104a7d
--- /dev/null
+++ b/dev-python/bracex/bracex-3.2.ebuild
@@ -0,0 +1,29 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=hatchling
+PYPI_VERIFY_REPO=https://github.com/facelessuser/bracex
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Bash style brace expansion for Python"
+HOMEPAGE="
+	https://github.com/facelessuser/bracex/
+	https://pypi.org/project/bracex/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+BDEPEND="
+	test? (
+		dev-vcs/git
+	)
+"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
diff --git a/dev-python/fastapi/Manifest b/dev-python/fastapi/Manifest
index b77ca9390610..507a763c986d 100644
--- a/dev-python/fastapi/Manifest
+++ b/dev-python/fastapi/Manifest
@@ -1,4 +1,2 @@
-DIST fastapi-0.143.3.tar.gz 469834 BLAKE2B 6384f8b551b38c1fc83779ef2a4a318e0cb4b01067e852e876b809d8dc8c2bf59dcbb109780337df3dd83b70ff61b30676fceb95745478439f580de2ad544c16 SHA512 f70e98e10e6d5d5b1db0fd6795179dff1bf7f737a0fee452732a49a22dca092efded647d27cf8fdb61b5eeba29311230fcca9d974ac258dc131d05080a134e7e
-DIST fastapi-0.146.0.tar.gz 471622 BLAKE2B dc332799da2b2c3da0c0374bd4dba73d5189357664dbb4bdc34a0facb229fb13507835e8a04d829ef80eae1c1ea8e8657f73ba2d15c222d4a1119d5e2abd4e1e SHA512 bf7c8a7e137ac5541bc36e7cd0c0042ca02da6d8b7bd6bd5b7fea11578d69854bbfde980981a81735b5dc889611a3a21364be4c5388add324d1552550a2736cc
-DIST fastapi-0.150.0.tar.gz 483799 BLAKE2B e3c7522a21be4a890abc9344a090e3d005791d318ea2a6616bb4dd39bace457c630cfd8d9c96df6166f98fe74e221e2d5912a904cc39a068428ab26a09bc0ca2 SHA512 926b2e6261725efb705ebb3a2048b36a9c18efc55598208c3de1541ce5de130d0c418cdb63d5be98ea20d1e7ec4959903308655f4154f40567ee00755bd1ce32
 DIST fastapi-0.156.4.tar.gz 500884 BLAKE2B b566123362fbd40001981e13d6df980956c8d2b58ffc494caa724eca4c6910cd5b7dd784a6191c90610e12ed8ac5ce69d9790b66b94338b02a1a96711b381ded SHA512 443976e73fd51878d6f6dc5d92fdecad0d7f31734eecbf5bbf64b32dd4281253ad2bb3f90cf3b5aa288ef4386b30aeddd509903c31204f7439657714ba35e5fc
+DIST fastapi-0.159.1.tar.gz 522004 BLAKE2B e96c6265c9b2cfe56136a492360f4aee38477bb6bd1df293d9f8627b7d49bb71766bc753875cb4339770d730682a650d15e636d4eca7314bf235642c4079fc73 SHA512 cc63af68adf7b1c94a66d1a35dbd8f06eaa99a67d06de1fa5a04c30916f8c261556e0d0489f163dce600f4ee9a97f30093a21fdf30a4f9f1b04da0a382161f5b
diff --git a/dev-python/fastapi/fastapi-0.146.0.ebuild b/dev-python/fastapi/fastapi-0.146.0.ebuild
deleted file mode 100644
index c7146bfca44a..000000000000
--- a/dev-python/fastapi/fastapi-0.146.0.ebuild
+++ /dev/null
@@ -1,126 +0,0 @@
-# Copyright 2025-2026 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=pdm-backend
-PYTHON_COMPAT=( python3_{13..14} )
-#may be not stricly required
-PYTHON_REQ_USE="threads(+)"
-
-inherit distutils-r1 optfeature pypi
-
-DESCRIPTION="High performance framework, easy to learn, fast to code, ready for production"
-HOMEPAGE="
-	https://fastapi.tiangolo.com/
-	https://github.com/fastapi/fastapi/
-	https://pypi.org/project/fastapi/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~amd64"
-
-RDEPEND="
-	>=dev-python/annotated-doc-0.0.4[${PYTHON_USEDEP}]
-	>=dev-python/opentelemetry-api-1.44.0[${PYTHON_USEDEP}]
-	>=dev-python/pydantic-2.9.0[${PYTHON_USEDEP}]
-	>=dev-python/starlette-0.46.0[${PYTHON_USEDEP}]
-	>=dev-python/typing-extensions-4.8.0[${PYTHON_USEDEP}]
-	>=dev-python/typing-inspection-0.4.2[${PYTHON_USEDEP}]
-"
-
-#FIXME: add missing deps
-BDEPEND="
-	test? (
-		dev-python/a2wsgi[${PYTHON_USEDEP}]
-		dev-python/dirty-equals[${PYTHON_USEDEP}]
-		dev-python/flask[${PYTHON_USEDEP}]
-		dev-python/httpx[${PYTHON_USEDEP}]
-		dev-python/httpx2[${PYTHON_USEDEP}]
-		dev-python/pydantic-settings[${PYTHON_USEDEP}]
-		dev-python/python-multipart[${PYTHON_USEDEP}]
-		dev-python/sqlalchemy[${PYTHON_USEDEP}]
-		dev-python/typer[${PYTHON_USEDEP}]
-	)
-"
-
-EPYTEST_PLUGINS=( anyio inline-snapshot pytest-timeout )
-# workaround broken toml config
-: ${EPYTEST_TIMEOUT:=30}
-# the test suite is flaky as hell
-EPYTEST_RERUNS=5
-# 3k tests+, so use xdist to speed them up
-EPYTEST_XDIST=1
-distutils_enable_tests pytest
-
-# There are some JSON response tests that will exercise orjson or ujson if they are available.
-# These are properly skipped if the optional dependencies are not installed at the cost of a little spam.
-python_test() {
-	local EPYTEST_IGNORE=(
-		# python/strawberry-graphql (in guru, test dep only)
-		tests/test_tutorial/test_graphql/test_tutorial001.py
-		# dev-python/sqlmodel (in guru, test dep only)
-		tests/test_tutorial/test_sql_databases/test_tutorial001.py
-		tests/test_tutorial/test_sql_databases/test_tutorial002.py
-		# dev-python/fastapi-cli (missing, test and optfeature)
-		tests/test_fastapi_cli.py
-		# dev-python/pwdlib (in guru, test dep only)
-		tests/test_tutorial/test_security/test_tutorial004.py
-		tests/test_tutorial/test_security/test_tutorial005.py
-		# Wants dev-python/multipart _just_ to complain that it's not the right multipart lib.
-		tests/test_multipart_installation.py
-		# scripts/tests use CliRunner.isolated_filesystem() removed in recent typer
-		scripts/tests
-	)
-	local EPYTEST_DESELECT=(
-		# Requires investigation - missing ./image.png test file (?)
-		tests/test_tutorial/test_additional_responses/test_tutorial004.py::test_path_operation_img
-
-		# Broken by brotli being available, also fragile to random ordering
-		tests/test_tutorial/test_header_param_models/test_tutorial001.py::test_header_param_model_invalid
-		tests/test_tutorial/test_header_param_models/test_tutorial003.py::test_header_param_model_invalid
-		tests/test_tutorial/test_header_param_models/test_tutorial003.py::test_header_param_model_no_underscore
-		# opentelemetry-*
-		tests/test_telemetry/test_background.py::test_background_task_integrations
-		tests/test_telemetry/test_data.py::test_request_objects_are_not_exported
-		tests/test_telemetry/test_environment_integrations.py
-		tests/test_telemetry/test_integrations.py::test_current_contrib
-		tests/test_telemetry/test_integrations.py::test_current_logfire
-		tests/test_telemetry/test_integrations.py::test_current_sentry
-		tests/test_telemetry/test_integrations.py::test_inactive_sentry_does_not_disable_native
-		tests/test_telemetry/test_integrations.py::test_logfire_global_provider_without_fastapi_instrumentor
-		tests/test_telemetry/test_native_integrations.py
-		tests/test_telemetry/test_runtime.py::test_concurrent_provider_owner_wins
-		tests/test_telemetry/test_runtime.py::test_environment_export_initializes_after_fork
-		tests/test_telemetry/test_runtime.py::test_failed_registration_closes_new_exporter
-		tests/test_telemetry/test_runtime.py::test_real_otlp_exception_export_without_traces_or_metrics
-		tests/test_telemetry/test_runtime.py::test_real_otlp_export_and_repeated_lifespans
-		tests/test_telemetry/test_runtime.py::test_registration_provider_prefers_public_metric_reader
-		tests/test_telemetry/test_runtime.py::test_unsupported_provider_warns_without_preventing_startup
-	)
-	epytest
-}
-
-pkg_postinst() {
-	# not part of any upstream extra
-	optfeature "alternative JSON library" "dev-python/ujson" # orjson, too but it's deprecated
-
-	# pyproject.toml:project.optional-dependencies.standard
-	# Following optfeatures should be exposed, but missing deps
-	#	optfeature "fastAPI CLI" "dev-python/fastapi-cli" - missing - depends on this package!
-	#	optfeature "compressed file support" "dev-python/fastar" - missing
-	#	optfeature "pydantic extra types support" "dev-python/pydantic-extra-types" - in guru
-	optfeature_header "standard extras"
-	optfeature "ASGI server support" "dev-python/uvicorn"
-	optfeature "email validation support" "dev-python/email-validator"
-	optfeature "TestClient for testing FastAPI applications" "dev-python/httpx"
-	optfeature "templating support" "dev-python/jinja2"
-	optfeature "multipart form data support" "dev-python/python-multipart"
-	optfeature "settings management support" "dev-python/pydantic-settings"
-
-	# pyproject.toml:project.optional-dependencies.all - includes all the above plus:
-	optfeature_header "all extras"
-	optfeature "session middleware support" "dev-python/itsdangerous"
-	optfeature "YAML support" "dev-python/pyyaml"
-}
diff --git a/dev-python/fastapi/fastapi-0.150.0.ebuild b/dev-python/fastapi/fastapi-0.150.0.ebuild
deleted file mode 100644
index 6c8cef00f625..000000000000
--- a/dev-python/fastapi/fastapi-0.150.0.ebuild
+++ /dev/null
@@ -1,128 +0,0 @@
-# Copyright 2025-2026 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=pdm-backend
-PYTHON_COMPAT=( python3_{13..14} )
-#may be not stricly required
-PYTHON_REQ_USE="threads(+)"
-
-inherit distutils-r1 optfeature pypi
-
-DESCRIPTION="High performance framework, easy to learn, fast to code, ready for production"
-HOMEPAGE="
-	https://fastapi.tiangolo.com/
-	https://github.com/fastapi/fastapi/
-	https://pypi.org/project/fastapi/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~amd64"
-
-RDEPEND="
-	>=dev-python/annotated-doc-0.0.4[${PYTHON_USEDEP}]
-	>=dev-python/opentelemetry-api-1.44.0[${PYTHON_USEDEP}]
-	>=dev-python/pydantic-2.9.0[${PYTHON_USEDEP}]
-	>=dev-python/starlette-0.46.0[${PYTHON_USEDEP}]
-	>=dev-python/typing-extensions-4.8.0[${PYTHON_USEDEP}]
-	>=dev-python/typing-inspection-0.4.2[${PYTHON_USEDEP}]
-"
-
-#FIXME: add missing deps
-BDEPEND="
-	test? (
-		dev-python/a2wsgi[${PYTHON_USEDEP}]
-		dev-python/dirty-equals[${PYTHON_USEDEP}]
-		dev-python/flask[${PYTHON_USEDEP}]
-		dev-python/httpx[${PYTHON_USEDEP}]
-		dev-python/httpx2[${PYTHON_USEDEP}]
-		dev-python/pydantic-settings[${PYTHON_USEDEP}]
-		dev-python/python-multipart[${PYTHON_USEDEP}]
-		dev-python/sqlalchemy[${PYTHON_USEDEP}]
-		dev-python/typer[${PYTHON_USEDEP}]
-	)
-"
-
-EPYTEST_PLUGINS=( anyio inline-snapshot pytest-timeout )
-# workaround broken toml config
-: ${EPYTEST_TIMEOUT:=30}
-# the test suite is flaky as hell
-EPYTEST_RERUNS=5
-# 3k tests+, so use xdist to speed them up
-EPYTEST_XDIST=1
-distutils_enable_tests pytest
-
-# There are some JSON response tests that will exercise orjson or ujson if they are available.
-# These are properly skipped if the optional dependencies are not installed at the cost of a little spam.
-python_test() {
-	local EPYTEST_IGNORE=(
-		# python/strawberry-graphql (in guru, test dep only)
-		tests/test_tutorial/test_graphql/test_tutorial001.py
-		# dev-python/sqlmodel (in guru, test dep only)
-		tests/test_tutorial/test_sql_databases/test_tutorial001.py
-		tests/test_tutorial/test_sql_databases/test_tutorial002.py
-		# dev-python/fastapi-cli (missing, test and optfeature)
-		tests/test_fastapi_cli.py
-		# dev-python/pwdlib (in guru, test dep only)
-		tests/test_tutorial/test_security/test_tutorial004.py
-		tests/test_tutorial/test_security/test_tutorial005.py
-		# Wants dev-python/multipart _just_ to complain that it's not the right multipart lib.
-		tests/test_multipart_installation.py
-		# scripts/tests use CliRunner.isolated_filesystem() removed in recent typer
-		scripts/tests
-	)
-	local EPYTEST_DESELECT=(
-		# Requires investigation - missing ./image.png test file (?)
-		tests/test_tutorial/test_additional_responses/test_tutorial004.py::test_path_operation_img
-		# Broken by brotli being available, also fragile to random ordering
-		tests/test_tutorial/test_header_param_models/test_tutorial001.py::test_header_param_model_invalid
-		tests/test_tutorial/test_header_param_models/test_tutorial003.py::test_header_param_model_invalid
-		tests/test_tutorial/test_header_param_models/test_tutorial003.py::test_header_param_model_no_underscore
-		# opentelemetry-*
-		tests/test_telemetry/test_background.py::test_background_task_integrations
-		tests/test_telemetry/test_data.py::test_request_objects_are_not_exported
-		tests/test_telemetry/test_environment_integrations.py
-		tests/test_telemetry/test_integrations.py::test_current_contrib
-		tests/test_telemetry/test_integrations.py::test_current_logfire
-		tests/test_telemetry/test_integrations.py::test_current_sentry
-		tests/test_telemetry/test_integrations.py::test_inactive_sentry_does_not_disable_native
-		tests/test_telemetry/test_integrations.py::test_logfire_global_provider_without_fastapi_instrumentor
-		tests/test_telemetry/test_native_integrations.py
-		tests/test_telemetry/test_runtime.py::test_concurrent_provider_owner_wins
-		tests/test_telemetry/test_runtime.py::test_environment_export_initializes_after_fork
-		tests/test_telemetry/test_runtime.py::test_failed_registration_closes_new_exporter
-		tests/test_telemetry/test_runtime.py::test_real_otlp_exception_export_without_traces_or_metrics
-		tests/test_telemetry/test_runtime.py::test_real_otlp_export_and_repeated_lifespans
-		tests/test_telemetry/test_runtime.py::test_registration_provider_prefers_public_metric_reader
-		tests/test_telemetry/test_runtime.py::test_unsupported_provider_warns_without_preventing_startup
-		# TODO
-		'tests/test_tutorial/test_testing_dependencies/test_tutorial001.py::test_override_in_items_run[tutorial001_py310]'
-		'tests/test_tutorial/test_testing_dependencies/test_tutorial001.py::test_override_in_items_run[tutorial001_en_py310]'
-	)
-	epytest
-}
-
-pkg_postinst() {
-	# not part of any upstream extra
-	optfeature "alternative JSON library" "dev-python/ujson" # orjson, too but it's deprecated
-
-	# pyproject.toml:project.optional-dependencies.standard
-	# Following optfeatures should be exposed, but missing deps
-	#	optfeature "fastAPI CLI" "dev-python/fastapi-cli" - missing - depends on this package!
-	#	optfeature "compressed file support" "dev-python/fastar" - missing
-	#	optfeature "pydantic extra types support" "dev-python/pydantic-extra-types" - in guru
-	optfeature_header "standard extras"
-	optfeature "ASGI server support" "dev-python/uvicorn"
-	optfeature "email validation support" "dev-python/email-validator"
-	optfeature "TestClient for testing FastAPI applications" "dev-python/httpx"
-	optfeature "templating support" "dev-python/jinja2"
-	optfeature "multipart form data support" "dev-python/python-multipart"
-	optfeature "settings management support" "dev-python/pydantic-settings"
-
-	# pyproject.toml:project.optional-dependencies.all - includes all the above plus:
-	optfeature_header "all extras"
-	optfeature "session middleware support" "dev-python/itsdangerous"
-	optfeature "YAML support" "dev-python/pyyaml"
-}
diff --git a/dev-python/fastapi/fastapi-0.143.3.ebuild b/dev-python/fastapi/fastapi-0.159.1.ebuild
index c7146bfca44a..1e1bf586041a 100644
--- a/dev-python/fastapi/fastapi-0.143.3.ebuild
+++ b/dev-python/fastapi/fastapi-0.159.1.ebuild
@@ -76,7 +76,6 @@ python_test() {
 	local EPYTEST_DESELECT=(
 		# Requires investigation - missing ./image.png test file (?)
 		tests/test_tutorial/test_additional_responses/test_tutorial004.py::test_path_operation_img
-
 		# Broken by brotli being available, also fragile to random ordering
 		tests/test_tutorial/test_header_param_models/test_tutorial001.py::test_header_param_model_invalid
 		tests/test_tutorial/test_header_param_models/test_tutorial003.py::test_header_param_model_invalid
@@ -98,6 +97,11 @@ python_test() {
 		tests/test_telemetry/test_runtime.py::test_real_otlp_export_and_repeated_lifespans
 		tests/test_telemetry/test_runtime.py::test_registration_provider_prefers_public_metric_reader
 		tests/test_telemetry/test_runtime.py::test_unsupported_provider_warns_without_preventing_startup
+		# TODO
+		tests/test_dependency_contextmanager.py::test_{a,}sync_state
+		tests/test_dependency_contextmanager.py::test_{a,}sync_raise_other
+		# tutorial tests are flaky
+		tests/test_tutorial/
 	)
 	epytest
 }
diff --git a/dev-python/fastbencode/Manifest b/dev-python/fastbencode/Manifest
index d43ee83ec364..37d4e60f4a6f 100644
--- a/dev-python/fastbencode/Manifest
+++ b/dev-python/fastbencode/Manifest
@@ -2,17 +2,30 @@ DIST fastbencode-0.3.10.tar.gz 17005 BLAKE2B bfd1f207260bb3dd435c01160b8d3868534
 DIST fastbencode-0.3.10.tar.gz.provenance 9673 BLAKE2B f6ae595eed244d5f730d6aff79cf2c0e82ae5f387cc590deeed83273508eae157f84f03f0d77f03412e7878257e6f889e93b1c4b9c73f29053678920bd302a32 SHA512 1bcafc77ae527a3c8532cab32d4119e25f3b8f44538614023b0d6a5f69ed3f31927f8b0808a482e682f3f8078d5ea4ea6da235ff44ece416d67c45327a197c65
 DIST fastbencode-0.3.11.tar.gz 20011 BLAKE2B 04d82eafc36dad08ec2af0b0749ed5120bd545ee240d030fb6e2f9bdc86dc0cce873871f4dd5072c65165510402e9151dfe4409b63d6e0024c14bfb93a5d3e23 SHA512 e21b7e5a9333f1e350f359145716656ebf824ef9a607007cb8268b8884b90a4f5b8507f4523457ff7ac89e6b34e071bc7c53aa57f4118d1f43f8418e3604af0a
 DIST fastbencode-0.3.11.tar.gz.provenance 10049 BLAKE2B de896250abe4d4c2ff3cb93a16134041acbd3960ea6f940ff9ff0743518f0124074774681807fab4c4f390bb951b08c58ebdd8879b2af371aa9dd9c1a0c3ae79 SHA512 4f631ea12506c03f593d182c70a227a9feab80be6792e7a6320f5be9f86c6e6ef855a8e25dd8f47f1e1135643bde9c544bfd8fdbc6ef6a05652d94f86782fc67
+DIST fastbencode-0.3.12.tar.gz 20074 BLAKE2B 1bf676880d98138539b51de2a3c4d10187fdb1cdbf026869015f3463d097b28d900bfffd073d994922af2e226c6532ef3b99b21d023792e88132394b22e18170 SHA512 d07796dc4ba51cb5188586f19abac1feb86397de2a9ff289a8fbb77f635052870a721cb480606557df4acf12b3e24cd2db7fae85d0b7a0ea37a058f50e6def00
+DIST fastbencode-0.3.12.tar.gz.provenance 10033 BLAKE2B c49dee70bcf5a78a15d6d5998bfc17ca4baa36f58bdbe7c342a1bb2922ac69366599dfc71385f04aa8c77317f03ba5159f2c3059fd97159da6de3fa4c082f0c3 SHA512 61ce1cf099a2ef95a8ab35bbc2afb1b40fba208e1c7f5f4f2893af54f86ab314132fb2d8f51504036e0bad31d148247d83e216afc418dc8e45732498cf2c5743
 DIST heck-0.5.0.crate 11517 BLAKE2B 5365ec43b2239a76b33a174f1a4292ece4147f9d382a68c6c60db78fdc8bad0afb1d51a65bcb25e96675372faa4ea37c318265030b0546ba51942f7c929e1835 SHA512 f044fc9c3d22466629fd8f772ec0555350fd611c0cfadca51d99a3d2f10e155f77c1091916c8a95a6b9b499f366c2e99a5fbf45b010f988bfb9b2501bf9f6a76
 DIST libc-0.2.183.crate 816918 BLAKE2B d0c26ca25b0808575aa540a5f0f43acaaa5a972269c5f101122538a1733b37b6aac3696a0d7298fe16974b06efb0b92072252eef40b17b977af24cc857963daf SHA512 017986d4fa8c362f8900c1c82c7381066382a7272cfe114243b8d47637d042c87b5ebef7881cf46727e00e541a0a8270a32db694ce8d78372672cf08224a90b2
+DIST libc-0.2.191.crate 855401 BLAKE2B 04788709363e27f063bd30d2e568d27b8a217d2702ccc32c28ac0f82c5f786e534f053d9133aa086d2186c060724adf0bd2c6fdf705ac6cde563561ecaba4e94 SHA512 f90bff0e667425a6680514097c44ad99454dfe9d2bec02a72633e94f300a6e39cba0a7887a7124ee3c2235d41836faff706649fa86b9970df7a7f72a460ea964
 DIST once_cell-1.21.4.crate 35010 BLAKE2B 9117ed1d478e626b7b7be2e3ff8b68a382b051112c7ca4425367bdae86977671f8b5c576131c82fb437740b6d98b72501f718f4172d39781decac2385e8fbd4d SHA512 af67669b0107f44268ba74c355200cb2ed1aab235a6989a8bc54323eb2c9a45677010f8672e7790edadd4c981e939436e0c3a099d33c06dce9c14fd5ede86155
 DIST portable-atomic-1.13.1.crate 197001 BLAKE2B 6d0898c2a537a9bf204b7749cca5f5fddf280772b56eb7ce8fdd9cf7d71561137b26ef89f415c40277a1c89981333eef78e5bb4624515a294ba28fdaeb4c70ea SHA512 2a1b31ac9814af884640b3398ab824a9795c72d260527a0966b193113808cfbb3345d50cd1beaebb45863437c3d06c8706d34b26efecceefc649319a4bc274a3
+DIST portable-atomic-1.15.0.crate 202705 BLAKE2B bf956c2bf08953b0ae1384d5c1703edf12c4a9b9d1f035b49043f4fb5e0a1ad005263affaf02331a77f098471fe2da8eee7b16861c33df9ef0d76444c614e291 SHA512 257cd168d0362b7b1d5e6ed9032cde9b0ac6e69d90b7e27347c39702a5ea020159c271e37e8045cf10661170f9354638791cfc972587bff3cba01da137f5a2c0
 DIST proc-macro2-1.0.106.crate 59765 BLAKE2B 87f95795621c4c992c370dc3a1240a2d5580e3362356525efe640f8f26ad0492b3c88755d575c080ff7db11376b0d82f31141bf6f86c895249b85e46c081220f SHA512 b726e2c92af434bfa88cd4f53c3fe6db647503567675fb439890dee3d15f5111137e3242b28d164114ce081c10acf3fd11950753ddb349190c87ee04e7d97744
+DIST proc-macro2-1.0.107.crate 59588 BLAKE2B 91df0c573e3e1f09c1aeedcad0381cf18186d72c3d50b077b1d232fbb67d1c87ed09f3c6dc515140041c2dab5ce7706042c8235b93099df7d1c962d4a3a99160 SHA512 c109d5509624a57156e0eae22a3aec89a1a163623e8b4e376a13d872a46e4bf6855ee3cd4428c07cdf5c22f2284b6ce755f9cc7e075480e4587ce4f2d40fa903
 DIST pyo3-0.28.2.crate 1202843 BLAKE2B 18158e22631ab35348eab1f117f16b311932de832d910f37a71cf481ec04ced03c37baaf63f1c8afc7ecccef039fc8f9072cbe0dd5109a74e7fb9f6b3ddb18a4 SHA512 fd4a03eb1cdfa40c1ed67b588cd4da31c90972f95c669b20a1099fb9304cd9506337f674e0bc9efd1d22a453162aac79a36ab18ca97eaca3515d640e2e9b923f
+DIST pyo3-0.30.1.crate 1345706 BLAKE2B 42f28e632d23a90b6e1ec4eae54ee17c1c75312f3f53d896dcfc43e047f0fe72d94e33c793f47f108a5b3c98885bc78d978e347a68f771d710228c3e1d97ba9e SHA512 68799fc448f68b204d4825ce4e1a0b000febf18d968740fa9f94df9507b3a2697fb1c4b642d88ad1f1fb2b214fcd1b9a3a8089eccd8b0418c08b4ae69b7bfdec
 DIST pyo3-build-config-0.28.2.crate 35958 BLAKE2B 87163e11ff52061e11943f54e0fea1101ec6f877b4e6ecda33e32a19d1a8af3a6a83ab23d17f744fb0176e35f819669e931f88c55d611c8f7ea52eacd1c683a3 SHA512 f9b4863baffdf474ba9121edc19323d91565dd1411acabda03a307c8aae4969657167a80e197d4c8656e711e424053aced6a1de7978cedd38815304835fc5dbb
+DIST pyo3-build-config-0.30.1.crate 42996 BLAKE2B e49f6b13e5a4379f3a0db2c305a96cd0b19955f22b3fd08fba4373a1ec886847abf619beddb7fc111e99bc174b47211d9de68230db8ea03e12e534bb5ceab7bf SHA512 9801d582931f1d6b835792ffa04439310544b068c9f94f1329487328d43010646dd81233575a4338c44e7fe86714a579186c04ee07604b94f8af5066730eb699
 DIST pyo3-ffi-0.28.2.crate 80837 BLAKE2B ac17690399e5cf84602a974860d84856d9489c7d94ec618cdb3b4c5bcee81d3767a727f22dca0a06d492ee28ecf24c84f48cd391a6d81229b1464fbb17654ac5 SHA512 f6b4fdea320922b81395e593fe135fd4b4f483250fe94d84019c97a3a9f98b6e2122134e09613021f194782038ffea1d32d3c65b1458e15ce3021d39fd582738
+DIST pyo3-ffi-0.30.1.crate 93717 BLAKE2B 383cac05d9e768c9059cfd5f714e30848c87584bfcb0b8e421805f2da9f3b5a9a3f27d467cf9432b0f41b68003f9141dfdfeb29cdb1248cc68b01072dc01ec34 SHA512 32945d4b6f08723ae1129810ac71e12f5dc9c5de3710cadedb91bba17cbcf21acbf269598241117b45dc36141d28e6d1a58f1c07957b8664de62e991f30c82e9
 DIST pyo3-macros-0.28.2.crate 8960 BLAKE2B 54fdb3f2d04c1f04d3cdb4d8422cd9fe1098df2f2740eaf61e2868e19f0a93c677486cef56576e39ba2010e426901c95846b7b81285858094ef1fdf48edc65b1 SHA512 7125a41bd5ceaa5c85a2ac5ed1bf07708cf95f58dd18a8ba9000a3139ebc06e90776b4254820410e940c80ed45f7c09165c8fe57d8f79069622849c6c0861bcb
+DIST pyo3-macros-0.30.1.crate 9055 BLAKE2B f49eedcd8922df4e0b9b0e119a6b5d06be3afe3f0d6d3fcd332716aae593fffc8fea94b02a4de7410bd678f7ab0ffb499c3e11bc45f72c2d8fa4e41c400dca9b SHA512 26f3b4d1aa86da4a305b01d780ce7de3359d3bfeadcbdbb39b9803d0a7634cf3611dfd5a285d21e97d51f61a6c590fdef8ddda45ec9abe870575519e6bbb4f33
 DIST pyo3-macros-backend-0.28.2.crate 87939 BLAKE2B c70e46d44c935e58957cd53a76a1e6d2e97ee1bdc39c926b1a23ce391785f212c30e150286fc78724e945679ac1ff04a10ec958b6d3dfe30c4acee795f6c2e63 SHA512 24203c47d91be9acc949cfc70ec8b4aa32e089275cf9b0061a9909f5e60895c56446692be0056e13cc4df8efc0698e0655626f9524241b54cd172d8a25e42f98
+DIST pyo3-macros-backend-0.30.1.crate 97593 BLAKE2B 6ff2e6e445f40b15ab8347a13b4786359875d16621ada11c0b8a5fc0efca84e306f95c1f2d5e87431bbd6303ead0d80aa469e3c53e0cb4360d6ea9524e0c9eb7 SHA512 29f96ff877d55ea3141435a30b8482743590f2dfd3fd9d24291cba8c834148cc2e0790125c8c0c3af650bf1c9b5e521a1a2ff3874dfa58bb3673dc11876ddf89
 DIST quote-1.0.45.crate 31564 BLAKE2B 1b2c2c3e6ebabfe10affa4c43ca0bfd1f52d8fd49e1df463e13e63a82de41272089c8e09e4c02e8a33cfee768ace26d4d42a50752de8fb5a776c59806139ad5d SHA512 df96ede01ebd0ed642b758bf1d0862d0e116fc2b3343e14edb657ce5438ccabe743dec4a0a40de4dee98c134d169af9aba459faadf9c7a832b26377e755d49b0
+DIST quote-1.0.47.crate 31622 BLAKE2B d912f17bdb5f2db29f5349e976e12da52db9d2197dd9900cb00e907d1e9b06ab177e9b020c1d53f6a6cd087e3a973aed5af63eac282da77792b2a6d6e1b35b07 SHA512 544f4324d425ae011905e0d1b52e367d4660bc34457b2f802af94e1def1e6c4e39ffba3beeb40d75753967d15b6dccce18fea273e7f3d46b63d5c89898d19441
 DIST syn-2.0.117.crate 306011 BLAKE2B bbaec02c4322f522bdfc87caa4ce6fd1e09bbf8f4a102d9ed8728efacdd843a2750f616dce5b2d3a3e46bbb7d57439fbd10e328bc1d4a01e980986cd815798af SHA512 035c2e63542592b6a4058a2a82d4c2c1f5793f84fb1b04cbd393337a26fcf661a1f3bea439ce98a1fe943b1c4d36d2bda16df3bbc3fa6ca35e1548d530dc8416
+DIST syn-3.0.9.crate 313970 BLAKE2B 63ba393b429909b75de710e1da70bbf5b5d4ba76917786ae5ac165ad57806a02b54af3fb7eaa5213f1e59e086ddf6807f08d4e37de2fc4b0a7270a290850fa91 SHA512 94ff1cfd429e4ca9c3a72c7e7012c5ccac2178134d4fb82683601bf466094e6178dd5bbc558e973a7f03e890e4e08cf8622dba2a2898fdde608a33b244e42cc5
 DIST target-lexicon-0.13.5.crate 26928 BLAKE2B f8c62cb91f68a635e6ce3fc254df9ce378b5e8f62c1147404c967484b9ed97fb33d7993b4671611db76566063e999d658d201f856f70196ec678d72cc758cf6d SHA512 956df27c01e1186c5356117ffd07810fc0b62fb919d5bfd215955ba85be00ef675212a3c0dc36679986be7b825442fec5c93c7643b7e1e19c04572e6463546fc
 DIST unicode-ident-1.0.24.crate 49298 BLAKE2B 34ba2906a3ebc06f52a4ba77dff96a8f3fb977718d260886fa9e051c5830765641b65a63977110f3a79f31fa177b385f81b01d56c80f6a0324d36eae72e2ebf0 SHA512 7be712d8d0075ac9341790180e312f66264d3e0255c91b38df0951baa5e446dec24551bb2125a66a1cb9b6ca2f1ea37c0cc15fa3dd74f398ecf4d5302c7dc259
+DIST unicode-ident-1.0.27.crate 48807 BLAKE2B 2f756c8e8a8a4653e616e15c217d72a01af3e6538105c6cfbad6e89b1cf6bb5ba591855b5b7580989b44eef37279789a550331778ed924ee4906cd68dc8d2aa8 SHA512 c952d72be2eea9d70114072a1aabd17573ac672e23f3a549d2a2b6375d14215eb1f0a2dc00c89819eb40f26341a6e24c54cb7be1fe92494d9c01b5941ce25670
diff --git a/dev-python/fastbencode/fastbencode-0.3.12.ebuild b/dev-python/fastbencode/fastbencode-0.3.12.ebuild
new file mode 100644
index 000000000000..e134f9d7d233
--- /dev/null
+++ b/dev-python/fastbencode/fastbencode-0.3.12.ebuild
@@ -0,0 +1,92 @@
+# Copyright 2025-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+CARGO_OPTIONAL=1
+RUST_MIN_VER=1.83.0
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYPI_VERIFY_REPO=https://github.com/breezy-team/fastbencode
+PYTHON_COMPAT=( python3_{13..14} )
+
+CRATES="
+	heck@0.5.0
+	libc@0.2.191
+	once_cell@1.21.4
+	portable-atomic@1.15.0
+	proc-macro2@1.0.107
+	pyo3-build-config@0.30.1
+	pyo3-ffi@0.30.1
+	pyo3-macros-backend@0.30.1
+	pyo3-macros@0.30.1
+	pyo3@0.30.1
+	quote@1.0.47
+	syn@3.0.9
+	target-lexicon@0.13.5
+	unicode-ident@1.0.27
+"
+
+inherit cargo distutils-r1 pypi
+
+DESCRIPTION="Implementation of bencode with Rust implementation"
+HOMEPAGE="
+	https://github.com/breezy-team/fastbencode/
+	https://pypi.org/project/fastbencode/
+"
+SRC_URI+="
+	native-extensions? (
+		${CARGO_CRATE_URIS}
+	)
+"
+
+LICENSE="Apache-2.0"
+LICENSE+=" native-extensions? ("
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0-with-LLVM-exceptions Unicode-3.0
+	|| ( Apache-2.0 MIT )
+"
+LICENSE+=" )"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~x86"
+IUSE="+native-extensions"
+
+BDEPEND="
+	native-extensions? (
+		${RUST_DEPEND}
+		dev-python/setuptools-rust[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests unittest
+
+QA_FLAGS_IGNORED="usr/lib.*/py.*/site-packages/fastbencode/_bencode_rs.*.so"
+
+pkg_setup() {
+	use native-extensions && rust_pkg_setup
+}
+
+src_unpack() {
+	pypi_src_unpack
+	cargo_crate_unpack
+	cargo_gen_config
+}
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	# treat build failures as fatal
+	sed -i -e '/optional/d' setup.py || die
+
+	if ! use native-extensions; then
+		# setup.py is only used for setuptools-rust
+		rm setup.py || die
+	fi
+}
+
+src_test() {
+	rm -r fastbencode || die
+	distutils-r1_src_test
+}
diff --git a/dev-python/httpx2/Manifest b/dev-python/httpx2/Manifest
index e7bdaf9964db..7ff96488307b 100644
--- a/dev-python/httpx2/Manifest
+++ b/dev-python/httpx2/Manifest
@@ -4,3 +4,4 @@ DIST httpx2-2.13.0.gh.tar.gz 2103962 BLAKE2B 6d940bdcc39f36ddcf50377457931ee9e2c
 DIST httpx2-2.13.1.gh.tar.gz 2105524 BLAKE2B d9f3c016df2add101bc785582ccd14e5ef400e6b6f6cb8c470a4dce89bfecd73fff210a279cefe0fb316d478f2ba6a10e2579157f18647b769e5c1c520a77e0d SHA512 7be45b81164b24e800c2de533c4c7ef2fdc2cb6e9d24d95287c15ca1efb79eabdce33fcf50b85d288727bea3a9dc6c8365190c587c50ba1d327a36b31c614a8c
 DIST httpx2-2.14.0.gh.tar.gz 2133484 BLAKE2B 1bf1b2dd3a368dde55f318ba48b14d85397a6181723de5326f818b5421531a0dabea246dc6f240565d4d1881c7e9634d0a3bbc3f27ad4384cee71f952a68f337 SHA512 9b85631b99be2e0ee89ba9ed30405edc71c811e31587c03adf97dc45069e25b3eebad4ef6b83cb4c10c3c6cde9eb0f46d1151c1674b048aaac19b33ec3f05083
 DIST httpx2-2.15.1.gh.tar.gz 2095535 BLAKE2B 16c619d85792eb7533d157e8b298869f1ea2e50c63324bf6cf144ef0d06d496154a63a277ceef0dc9f6cba2c36adc43d9dee5b5bba1b4230387526a00ea96080 SHA512 f034a31a762b637d67e280d54c13f355ce5cb6d609dc18bbe3ac510fe8b35207acada045c7e3296e8de89c948348318af6f6bfec6ee6a2a2afbb3a09fd9d80c0
+DIST httpx2-2.16.0.gh.tar.gz 2097489 BLAKE2B c7dc51bcc515b303c8488161bba1ae994050d669a6af40f02ba36d65fe342d92a00ca29e527740e3283b82c2be4995e5bdb628ff710b80fca1b384f552ceb920 SHA512 1c95223e18d394ce75fc3dfae44374198fa9e0dace3d6e375a9d1f64fac80ad4af9146f8e591ed7eb60dc583478a3db1a04e3ba9f2385c2e74d65fa97ee0a51a
diff --git a/dev-python/httpx2/httpx2-2.16.0.ebuild b/dev-python/httpx2/httpx2-2.16.0.ebuild
new file mode 100644
index 000000000000..157aa4c1af39
--- /dev/null
+++ b/dev-python/httpx2/httpx2-2.16.0.ebuild
@@ -0,0 +1,103 @@
+# Copyright 2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=hatchling
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1
+
+# This package combines httpx2 and httpcore2 (because of exact version pin).
+DESCRIPTION="The next generation HTTP client (Pydantic fork)"
+HOMEPAGE="
+	https://pypi.org/project/httpx2/
+	https://pypi.org/project/httpcore2/
+	https://github.com/pydantic/httpx2/
+"
+SRC_URI="
+	https://github.com/pydantic/httpx2/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="cli"
+
+RDEPEND="
+	>=dev-python/anyio-4.10[${PYTHON_USEDEP}]
+	>=dev-python/idna-3.18[${PYTHON_USEDEP}]
+	>=dev-python/h11-0.16[${PYTHON_USEDEP}]
+	>=dev-python/truststore-0.10[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		>=dev-python/typing-extensions-4.5.0[${PYTHON_USEDEP}]
+	' 3.12)
+	cli? (
+		>=dev-python/click-8.4[${PYTHON_USEDEP}]
+		=dev-python/pygments-2*[${PYTHON_USEDEP}]
+		>=dev-python/rich-10[${PYTHON_USEDEP}]
+	)
+"
+BDEPEND="
+	dev-python/hatch-fancy-pypi-readme[${PYTHON_USEDEP}]
+	dev-python/uv-dynamic-versioning[${PYTHON_USEDEP}]
+	test? (
+		>=app-arch/brotli-1.2.0[python,${PYTHON_USEDEP}]
+		>=dev-python/brotlicffi-1.2.0.0[${PYTHON_USEDEP}]
+		dev-python/chardet[${PYTHON_USEDEP}]
+		dev-python/cryptography[${PYTHON_USEDEP}]
+		dev-python/h2[${PYTHON_USEDEP}]
+		dev-python/starlette[${PYTHON_USEDEP}]
+		dev-python/socksio[${PYTHON_USEDEP}]
+		dev-python/trio[${PYTHON_USEDEP}]
+		dev-python/trustme[${PYTHON_USEDEP}]
+		dev-python/typing-extensions[${PYTHON_USEDEP}]
+		dev-python/uvicorn[${PYTHON_USEDEP}]
+		dev-python/websockets[${PYTHON_USEDEP}]
+		>=dev-python/wsproto-1.2[${PYTHON_USEDEP}]
+		$(python_gen_cond_dep '
+			>=dev-python/backports-zstd-1.0.0[${PYTHON_USEDEP}]
+		' 3.12 3.13)
+	)
+"
+
+EPYTEST_PLUGINS=( anyio flaky pytest-{httpbin,trio} )
+EPYTEST_RERUNS=5
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+python_compile() {
+	local -x UV_DYNAMIC_VERSIONING_BYPASS=${PV}
+
+	cd src/httpcore2 || die
+	distutils-r1_python_compile
+	cd ../httpx2 || die
+	distutils-r1_python_compile
+	cd ../.. || die
+}
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		# Internet
+		tests/httpx2/client/test_proxies.py::test_async_proxy_close
+		tests/httpx2/client/test_proxies.py::test_sync_proxy_close
+		# random charset case mismatch
+		tests/httpx2/models/test_responses.py::test_response_decode_text_using_autodetect
+		tests/httpx2/client/test_client.py::test_client_decode_text_using_autodetect
+		tests/httpx2/client/test_client.py::test_client_decode_text_using_explicit_encoding
+		# *shrug* looks like assertion misfiring
+		tests/httpx2/test_alias.py::test_alias_finder_handles_top_level_import
+		tests/httpx2/test_alias.py::test_alias_httpcore_top_level_import
+		tests/httpx2/test_alias.py::test_alias_top_level_import
+	)
+
+	local EPYTEST_IGNORE=()
+	if ! use cli; then
+		EPYTEST_IGNORE+=(
+			tests/httpx2/test_main.py
+		)
+	fi
+
+	epytest tests/{httpcore2,httpx2}
+}
diff --git a/dev-python/hypothesis-gentoo/Manifest b/dev-python/hypothesis-gentoo/Manifest
index 6d6ef0d64df3..01587df49337 100644
--- a/dev-python/hypothesis-gentoo/Manifest
+++ b/dev-python/hypothesis-gentoo/Manifest
@@ -1,2 +1 @@
-DIST hypothesis_gentoo-3.tar.gz 2201 BLAKE2B 7fc480dbbf559ffca71be6eb5cc5c6186e892ad53776bc5d84ddc649be8d1fe9a181cecacb82806c161078d57a9b286434b921f15cd4b57a6ad6005baa300e05 SHA512 2b3df0b18bf3513de77712e3fdda1c14ac049f957c85fe50da4126146e2a95354079a69ebc3c8af962c30808ba97df21a8084ce0c6c5013c0a45fb8e83e9c02a
 DIST hypothesis_gentoo-4.tar.gz 2183 BLAKE2B 1037b30bf586eba5fa682bac338296ad43add9ce81422cf2b7a1ed44fb531e65c696f1cf3af04d1d94103162f9273a67165b830e359031083386c70c575c04c2 SHA512 68df70dbcdad5f53de0851730896883549686ad4b50be9663fb8ff4e7d9133e44c44158df2bf1741a91bd8b80fd5e0c064b141ecbda3c068d111ec70bc46d4a6
diff --git a/dev-python/hypothesis-gentoo/hypothesis-gentoo-3.ebuild b/dev-python/hypothesis-gentoo/hypothesis-gentoo-3.ebuild
deleted file mode 100644
index 18025c328ad0..000000000000
--- a/dev-python/hypothesis-gentoo/hypothesis-gentoo-3.ebuild
+++ /dev/null
@@ -1,24 +0,0 @@
-# Copyright 2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{13..14} )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Plugin to create 'gentoo' hypothesis profile, disabling health checks"
-HOMEPAGE="
-	https://github.com/projg2/hypothesis-gentoo/
-	https://pypi.org/project/hypothesis-gentoo/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-
-# No RDEP on hypothesis -- it is only imported in the hypothesis hook
-
-EPYTEST_PLUGINS=( hypothesis )
-distutils_enable_tests pytest
diff --git a/dev-python/hypothesis-gentoo/hypothesis-gentoo-4.ebuild b/dev-python/hypothesis-gentoo/hypothesis-gentoo-4.ebuild
index 0c052f77302a..9f042eabb145 100644
--- a/dev-python/hypothesis-gentoo/hypothesis-gentoo-4.ebuild
+++ b/dev-python/hypothesis-gentoo/hypothesis-gentoo-4.ebuild
@@ -10,7 +10,8 @@ inherit distutils-r1 pypi
 
 DESCRIPTION="Plugin to create 'gentoo' hypothesis profile, disabling health checks"
 HOMEPAGE="
-	https://github.com/projg2/hypothesis-gentoo/
+	https://gitweb.gentoo.org/proj/hypothesis-gentoo.git/
+	https://github.com/gentoo/hypothesis-gentoo/
 	https://pypi.org/project/hypothesis-gentoo/
 "
 
diff --git a/dev-python/inflect/Manifest b/dev-python/inflect/Manifest
index 4b9be661ac51..06ffe1addaaf 100644
--- a/dev-python/inflect/Manifest
+++ b/dev-python/inflect/Manifest
@@ -1 +1,2 @@
 DIST inflect-7.5.0.tar.gz 73751 BLAKE2B a17c5cb5bfcd10530f29537335ffd1b4725fb1f53e78ef7ce1f40a3031fa486baae3400878e575c8ce6a77b4953332f051ec65dcba024a14c527301e51079edb SHA512 ee9f69dff451017a2aad2226d8c6ae02b4b7b4bc4d4c49f3efee50d85eeef43c49c6c6ef3e7f30fa2c5ef21e065ff5242140d5a98bc71af17c7e70d9e75e54c1
+DIST inflect-7.6.0.tar.gz 83035 BLAKE2B 618f5d773cae5abdad423fbf8c439c2ddbc56b3dee974550f837c49264f6d14c65e5f50a71770f181494a96c055ded8e2d4dde0c90cc6edbe5dd25d0dca19f36 SHA512 8a768c5a096548c4b7cbde75a07ead131813d4ed5478ecdb6e722cee9ed6e073afaf171d353096872362017e4854aba02400a8e9af05590cc2e4770f4d21d44a
diff --git a/dev-python/inflect/inflect-7.6.0.ebuild b/dev-python/inflect/inflect-7.6.0.ebuild
new file mode 100644
index 000000000000..1a23334f4b1c
--- /dev/null
+++ b/dev-python/inflect/inflect-7.6.0.ebuild
@@ -0,0 +1,31 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Correctly inflect words and numbers"
+HOMEPAGE="
+	https://pypi.org/project/inflect/
+	https://github.com/jaraco/inflect/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	dev-python/jaraco-functools[${PYTHON_USEDEP}]
+	>=dev-python/typeguard-4.0.1[${PYTHON_USEDEP}]
+	>=dev-python/more-itertools-8.5.0[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	>=dev-python/setuptools-scm-3.4.1[${PYTHON_USEDEP}]
+"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
diff --git a/dev-python/pbs-installer/Manifest b/dev-python/pbs-installer/Manifest
index 6165021d6a82..1ba02fb1252c 100644
--- a/dev-python/pbs-installer/Manifest
+++ b/dev-python/pbs-installer/Manifest
@@ -1,8 +1,6 @@
-DIST pbs_installer-2026.10.1.tar.gz 81120 BLAKE2B f439ff09203b8b628184b587fdcb6e59c296406a22d6dc0d2b49eaab8d55f9621acef6e1d9b533a1be6fb417cf2d8a64d940fc57e4f681f256d4a907df41741c SHA512 2ee04905365d3cc627dd606a64ea4b9be96dc63508f9a86b2f7b944ab4cbb07a09f8336366a0780aecfd2cab90b66416ee01a6b9d7e72581ec7ec3ad0cd594cd
-DIST pbs_installer-2026.10.1.tar.gz.provenance 9959 BLAKE2B dbd0e4d6682ea9f692f7c372e1136cfffeaa5dca96c15d56f297359b24bc7fbc12ae54b97750febe8130cc92bb09d2b46054bd942c05ba4d7978d8114769c84f SHA512 f9a8af41b085d413989577c992be521c6237135811b6a2a83af04d1526188b9c4293087a246ef99d61548ec33b169bf5a9dca97b708a7284af8e9ea7e1b12272
 DIST pbs_installer-2026.10.13.tar.gz 82375 BLAKE2B a84a7e86b809cc2600b6ac5fd87f214519d3d866c01c421976b3496f6ec05139aeac4707c1b550d20146720211556a62168a7c7a21b8d38e9e95e770e913cceb SHA512 9fd739f02ee1617915670b88527333fdf0ad727640c1475cce60c1855b9065566b7d7fdebc141773f6c037c870950034e710a58e4a909d90a545611581ac1dca
 DIST pbs_installer-2026.10.13.tar.gz.provenance 9835 BLAKE2B d7990b681753b6bb50fd3e06190d064636021b511e3c013d61a8a7d908d476a1329cdd188f91b9647bf2dd9db15bcb7e397d3364a52d9e18db0daa05ace28b16 SHA512 2b6355efcc9022e5a2275b3cb6fcc6d50d8a0d1db0bd4ad4d7696f577267fd71bb64cef4007acf6003227e7c5a487d8f028c69d7727b1269d672ef550a900c02
+DIST pbs_installer-2026.10.21.tar.gz 84379 BLAKE2B 244a6e13c84704ddc85f82692badf187130c5742274ed1b420a3db0286c5da01c44c1b7d6eb6585b588ef05cb85230bd65d0374d1be443cff478e5890a6c9611 SHA512 0dc4878a9933699be4d530123220e7080772dc6b68dc85fb32431a584cbb33b84154693c5eec4804840259b0aed38d8255e4063ccd112f74efe5eb674b1f915d
+DIST pbs_installer-2026.10.21.tar.gz.provenance 9835 BLAKE2B 8c2d73ba0b5e1068d24dbde4ef3a7624cb4190cd6a2c7c4401e545c1f0758fbf9bab595889bce8b8a61538265271447682c441d3f558d85b95b398a84495092a SHA512 4f9e11ac6ba51a5ae1e0e8dc22bdeba242694ea2032b65b379524b309b79df4146403620440b2ac03f097f9cd304a70d47245fe2f6c6868352b3ba91b16a4c3f
 DIST pbs_installer-2026.10.3.tar.gz 81131 BLAKE2B cc8e52bc72ea442ba1854d9a1f9aeada361def24b145f5cc68885740f8472abf34e48619f780bc11bceb0131a6c1da0dae593df91d1777380554a3059547d23a SHA512 d05194ac0b36f0c510cbe90263bf7b5d4a8cfa7f55a170c128905cd291d026a64a757217a41b1a9c36aed51c353a32ed8c27cfda210f51686d603eee4c18a2fa
 DIST pbs_installer-2026.10.3.tar.gz.provenance 9994 BLAKE2B eb89d404d27042c7428187a46ddd036d6c4df7730e85519bc0e8fc8aeea2d30e3e34d396e0f5d37ad59a6c7899f9c244ede7da68e32f36a016af9e0f385f9c6e SHA512 4912cdd2730b36c2f015df898c2d230b3e0db2253e27177edf09f4f628146aef721e770b8d5da49a288f554d37e1633956bdfeb97b54d5cc76c47de63ac0cb28
-DIST pbs_installer-2026.9.29.tar.gz 77902 BLAKE2B cf42ecc98a55c39a0a90cc82f8fa082b856cf15e74bca224627defa2113ad6b662d57bcf0dc1dcfb86a9cf8ae87555c2585c029e3260b8b55c4dba163c45bf07 SHA512 108c2d89e94ffaefd297ce372b8d3805f46f7555b53f95863e086b853f23832a342ae5271ecc712612e376687808b6ab8957731b8f317613ad34df8b46ed8998
-DIST pbs_installer-2026.9.29.tar.gz.provenance 10037 BLAKE2B e31a0b3a56944ce3a99b09757664250dde0f79999e6648457a3869ad9647259d10466576f2896e5e456687d18477b52da961b9fe0a94362f5d9416eded202a3b SHA512 a8ffe65f3015b6c17b5b35c3a7c985ced3399a93ca7da74e1a0b8a05a1e022117e618445b0fc51f8c453617a199380b1ba337f913c733ec6525578e56cd0e0aa
diff --git a/dev-python/pbs-installer/pbs-installer-2026.10.1.ebuild b/dev-python/pbs-installer/pbs-installer-2026.10.1.ebuild
deleted file mode 100644
index ad138f3a6f5d..000000000000
--- a/dev-python/pbs-installer/pbs-installer-2026.10.1.ebuild
+++ /dev/null
@@ -1,33 +0,0 @@
-# Copyright 2024-2026 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=pdm-backend
-PYPI_VERIFY_REPO=https://github.com/frostming/pbs-installer
-PYTHON_COMPAT=( python3_{13..14} )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Installer for Python Build Standalone"
-HOMEPAGE="
-	https://pypi.org/project/pbs-installer/
-	https://github.com/frostming/pbs-installer/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~amd64 ~arm64 ~x86"
-
-# httpx is needed to download builds
-# zstandard is needed to install them
-RDEPEND="
-	$(python_gen_cond_dep '
-		>=dev-python/backports-zstd-1.0.0[${PYTHON_USEDEP}]
-	' 3.12 3.13)
-	<dev-python/httpx-1[${PYTHON_USEDEP}]
-	>=dev-python/httpx-0.27.0[${PYTHON_USEDEP}]
-"
-
-EPYTEST_PLUGINS=()
-distutils_enable_tests import-check
diff --git a/dev-python/pbs-installer/pbs-installer-2026.9.29.ebuild b/dev-python/pbs-installer/pbs-installer-2026.10.21.ebuild
index 6d8f79ea02ba..6d8f79ea02ba 100644
--- a/dev-python/pbs-installer/pbs-installer-2026.9.29.ebuild
+++ b/dev-python/pbs-installer/pbs-installer-2026.10.21.ebuild
diff --git a/dev-python/pypdf/Manifest b/dev-python/pypdf/Manifest
index e87d1d65c43f..5af33842c8b2 100644
--- a/dev-python/pypdf/Manifest
+++ b/dev-python/pypdf/Manifest
@@ -8,4 +8,6 @@ DIST pypdf-6.21.0.tar.gz 7088285 BLAKE2B d88a8775a88855a3d3c68ad428d2e3cc71287e2
 DIST pypdf-6.21.0.tar.gz.provenance 9668 BLAKE2B ae490f77ca9169550fb48cdbd1b159e0f5bcef6a09a9e838f0d1bfb741dc41fc0fdc96a871f5d287cb4658894ac9014bffc28a1956013350422485b2da1dfeb8 SHA512 619a8e31272eae7b659cf7374a2409db6a287c8b6c7241d51b526f6cf1826f3d4f9f955a117b2eee8d04b1fea8e98d5e83ca61947923a92964a23ce1b84fd6fa
 DIST pypdf-6.21.1.tar.gz 7088597 BLAKE2B e3cdea6c02aca7c3f16c2531ef3c8250dbd1a0faaaf3895797a9ede3be33b7fd1bc37e2e60c42425868b0c0d5b0c3f1a399ed93095b9d38a5605488ae69136f4 SHA512 55c7729de15efcc03cea0f368f08cc51ad7236f898bc71f972b02345303e544bf4f5084104189a36b3c7f2813434ab400a0034d2e5763582b67ef008923f27bb
 DIST pypdf-6.21.1.tar.gz.provenance 9621 BLAKE2B 34db44b123f964f28d53fa1e9e9d514196943e2e1e64cba2ba77bbff26a31d51cf9ef2a0f6ddffe162a10f40e45b56184bc569eab8336938dd7fff7b2fa4270b SHA512 9b34342f0cb640e5f7c293f8199d1d6a15a0422f21901651d483237983fa9c6b7d5ab44c0c0a44eecc6366822d4ccaea25903f78d758cf9de4abde69d9868b5a
+DIST pypdf-6.21.2.tar.gz 7144571 BLAKE2B c50233a589b15580d36bb26f91570b117af093ee58d6d47a1874fdf5c82771c64c854465189b08f9f08a1e6df530b3cde4ad2d46fe82d91aab925c5fc3660f67 SHA512 3c2ecd1837ee6786139f40a8b9360f70752addfeb2d9696f38f86c5c5d7193842e5ce44372673fa300e913c05fda51f97118cb9833557de1384c836dd2c1e402
+DIST pypdf-6.21.2.tar.gz.provenance 9715 BLAKE2B 1f06c2ee2b6d11d72b6fdd2ee246e13b9c925705089632fff0c3af666f1fd3dc7917166cd0960dae066fac3255abac6eb84c9a1b14919e147ea6a34d93678283 SHA512 bb6b414fa2d278195c4c4c0ea3e431ff309fd6632d8b8d4474ebc624448ddfbdcc0770aecba814e60f48ecf5fda9d0fca9e5a1bc0e872f87706601e9dbc72e19
 DIST pypdf-sample-files-818dc013ad1f537198e9fcfae8a6b0dffe25ffa3.gh.tar.gz 11850954 BLAKE2B fbd0af91de44f2d224b3266727f0dfc462efb4d23176f4ebff147cbfa37337d891859c468b545d0c00796048584e6b621dc622d667e3d45c0b89b92f29ca3030 SHA512 bc601bfaf17f31c6358f594eaf879479e97028d7f5e5825c309a5d1eb843bfea5080c9e151287a0d915ecbc3f4d4755e326ac8fa1ceeb696c76b9f5ecc0d7e9f
diff --git a/dev-python/pypdf/pypdf-6.21.2.ebuild b/dev-python/pypdf/pypdf-6.21.2.ebuild
new file mode 100644
index 000000000000..716a7acd1c4e
--- /dev/null
+++ b/dev-python/pypdf/pypdf-6.21.2.ebuild
@@ -0,0 +1,66 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit-core
+PYPI_VERIFY_REPO=https://github.com/py-pdf/pypdf
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1 pypi
+
+SAMPLE_COMMIT=818dc013ad1f537198e9fcfae8a6b0dffe25ffa3
+DESCRIPTION="Python library to work with PDF files"
+HOMEPAGE="
+	https://pypi.org/project/pypdf/
+	https://github.com/py-pdf/pypdf/
+"
+SRC_URI+="
+	test? (
+		https://github.com/py-pdf/sample-files/archive/${SAMPLE_COMMIT}.tar.gz
+			-> ${PN}-sample-files-${SAMPLE_COMMIT}.gh.tar.gz
+	)
+"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+
+BDEPEND="
+	test? (
+		>=dev-python/cryptography-3.1[${PYTHON_USEDEP}]
+		dev-python/fonttools[${PYTHON_USEDEP}]
+		>=dev-python/pillow-8.0.0[jpeg,jpeg2k,tiff,zlib,${PYTHON_USEDEP}]
+		dev-python/pyyaml[${PYTHON_USEDEP}]
+		media-libs/jbig2dec[png]
+	)
+"
+
+EPYTEST_PLUGINS=( pytest-timeout )
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+EPYTEST_DESELECT=(
+	# probably requires extra deps
+	tests/test_appearance_stream.py::test_appearance_stream_rtl
+	# speed test, uses tons of memory
+	tests/test_filters.py::test_flatedecode__decode_png_prediction__speed
+	# apparently we get half the limit somehow?
+	tests/generic/test_data_structures.py::test_dictionary_object__read_from_stream__missing_length__limit
+	tests/generic/test_data_structures.py::test_dictionary_object__read_from_stream__read_unsized__limit
+	tests/test_configuration.py::test_apply_configuration
+	tests/test_configuration.py::test_apply_configuration__nested
+	tests/test_configuration.py::test_get_configuration
+	tests/test_configuration.py::test_overwrite_configuration
+)
+
+src_unpack() {
+	default
+	if use test; then
+		mv "sample-files-${SAMPLE_COMMIT}" "${S}"/sample-files || die
+	fi
+}
+
+python_test() {
+	epytest -o addopts= -m "not enable_socket"
+}
diff --git a/dev-python/python-dateutil/Manifest b/dev-python/python-dateutil/Manifest
index 82d26649de2c..75b164019f13 100644
--- a/dev-python/python-dateutil/Manifest
+++ b/dev-python/python-dateutil/Manifest
@@ -1 +1,3 @@
 DIST python-dateutil-2.9.0.post0.tar.gz 342432 BLAKE2B b3469ff9900afd98f474f162083570c28ac93378efc772b5f365fa0d5d4354a96867a024065adc430b71d7bde6909195ac4ebe3ad1d17e638fded0b4b40f9954 SHA512 f76522de0ff21547327eaf6966e80a15c57f8f92588d520eabd354a732e5c4b51d9c3ac5effd9eaa6dd451d1bce329a54a3f4c6bf4f1bd08ff06b0305c994e5a
+DIST python_dateutil-3.0.0.tar.gz 271066 BLAKE2B e544a0b27bd0aa7454a3009ee656bfb3ba585e8b3dff09387ff36ce0fd85e6fb5aee9b59b81a7a6858ef60978d47a7e59e5c0a942278618a53b0819aab76a79f SHA512 638dcea7a840163bfd79d174b3ccd43254d712b92c1739dc93f937ecce122994ff25d19a579705cd6ba77336901e879ab4c7f68ca599b5576656a3b6783c2c69
+DIST python_dateutil-3.0.0.tar.gz.provenance 9820 BLAKE2B 07fde7908756488b73ee54def14c4a9078cb0874b94d663b12c41bc09099431795879af08f9ca89051874fdf9ad78b432a274703cb097d65cec9f29c17318765 SHA512 12931ab7f8c33f03339fae727acb592ed858940f8bb13b8512955ea62c1d9fa6266c597e2df24e149d68fcd4356cdb321fbb54640bb6a049152ea82f4213fef8
diff --git a/dev-python/python-dateutil/python-dateutil-3.0.0.ebuild b/dev-python/python-dateutil/python-dateutil-3.0.0.ebuild
new file mode 100644
index 000000000000..1b282f70b2ad
--- /dev/null
+++ b/dev-python/python-dateutil/python-dateutil-3.0.0.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYPI_VERIFY_REPO=https://github.com/dateutil/dateutil
+PYTHON_FULLY_TESTED=( python3_{12..15} python3_{14..15}t )
+# TODO: restore pypy3.12 somehow
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Extensions to the standard Python datetime module"
+HOMEPAGE="
+	https://dateutil.readthedocs.io/
+	https://pypi.org/project/python-dateutil/
+	https://github.com/dateutil/dateutil/
+"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+
+RDEPEND="
+	>=dev-python/six-1.5[${PYTHON_USEDEP}]
+	dev-python/tzdata[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools-scm[${PYTHON_USEDEP}]
+	test? (
+		dev-python/attrs[${PYTHON_USEDEP}]
+		dev-python/freezegun[${PYTHON_USEDEP}]
+		$(python_gen_cond_dep '
+			dev-python/hypothesis[${PYTHON_USEDEP}]
+		' "${PYTHON_FULLY_TESTED[@]}")
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}/python-dateutil-2.9.0-no-pytest-cov.patch"
+)
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_IGNORE=()
+	local EPYTEST_PLUGINS=( "${EPYTEST_PLUGINS[@]}" )
+	if has_version "dev-python/hypothesis[${PYTHON_USEDEP}]"; then
+		EPYTEST_PLUGINS+=( hypothesis )
+	else
+		EPYTEST_IGNORE+=(
+			tests/property
+		)
+	fi
+
+	epytest
+}
diff --git a/dev-python/shtab/Manifest b/dev-python/shtab/Manifest
index a2594b11f23a..fed2b87b91b1 100644
--- a/dev-python/shtab/Manifest
+++ b/dev-python/shtab/Manifest
@@ -1,6 +1,4 @@
-DIST shtab-1.10.0.tar.gz 56370 BLAKE2B e4312d778aced10e250fa6a50717ed0aac8e13351f9fc6740019689ff893e9665bcbb23fa9e4d18305fc7b1ef5ce0fe1e283434eec5992cb74b8f86956aef90a SHA512 831b2913339e1f6861bebb6f60528d5aeadd2ffbaf4725993dd47cd628201b2c79e781cdbeb630bed17513ea32e3db99dad3457b958392009206eefe0a6c68e8
-DIST shtab-1.10.0.tar.gz.provenance 9014 BLAKE2B f1adca976da5202048c371d19225fbdf45204cedae04b6a6b72f90cdd6c1348e812fbad32299469d35d86155d2998e2daf742aa8b0a6459fc689b09a26c60d83 SHA512 23bc47830f5dc2f3cef04d243c325efacc117d162ff092c20b856ac5c9eba97efb96ac7b586b4038d349ad0fff3fd83ddb0fc90ab18eb68c36a463182ba7a1b8
-DIST shtab-1.11.0.tar.gz 58653 BLAKE2B 8e93804da4bd3122e7e0b4618a89bb775f15c50759008e2e5546df7ddff5dd8f9ac0951a8df71d9a8ff0db4b6efa3cc2d160c369f5ef40923de975261062ddd3 SHA512 eac92034b92297acafc57c6d2ad6d40084294fd7ee05392fbad3657185f78848c39f4cb73a6fff034dec0df886bfcc552a6367c50e58cf779b74f679d04ffd8b
-DIST shtab-1.11.0.tar.gz.provenance 9263 BLAKE2B 938172b2866834a73845731006fb74279f372b85290beb651d5ee5e35ef80b924b222b17bf1fbc30fc2e73d93d68f5c2584b83ea3d08ee64865febf9c3f7c783 SHA512 90f85d016c37fc3411f9e8a124866ff6096b7833adebca3b16fdedc6eea12020784459ed3508a5c0e9bf169f1d7a2872eebcfccac8d6a43307f16c49bd559c28
 DIST shtab-1.12.1.tar.gz 66195 BLAKE2B dd884496a7c7feb07b91913376776c379d6e475f71109dc335f1d0737de0cd6737b19179d050bb01c1457ac44e0e53e8a41d2708ef333cf631fd3938fa9e324a SHA512 3b7efd1c8e5985912eab61a6ceb7609031e0b1a29c5fc28d809db36c87774ed3b32cc8cd816b71cf306015e250012c400c456b1138cf69666f2aca568e5b41b6
 DIST shtab-1.12.1.tar.gz.provenance 9310 BLAKE2B 97a746947bb7b03c06d2692c7351ea4fd1a12616b07cec67d6ee89c0f788b4a7d064afb97c47b8dbd0e627aac370cd9a594b912b31e0257bebb1708f4a90896b SHA512 6f6cdf627b74ef55a85ff27abb745a1e6ef63d48df99645cac74c335416d2aa4caeaca077242928401fe2bd5c4a79ffc20a0fdf6a882c74c409cb3f52982b393
+DIST shtab-1.13.0.tar.gz 67655 BLAKE2B 770ac69b625bf19fd3adcda3ab03c95acefb81940d0b6a7321da53cfa6b2bc43026220bc2704f6769448a32a61bf8e14239b700bd1f5b72a92ec2de8ada2e981 SHA512 21b241a07d0bdc7c3a89ae45bc0ab53fc6d5c9515cd14bcfb1167e6d8349d8ccd7027b519d3ee85c4c4ec5a6f8f0db7eed436c145832c2fe86e75926441379df
+DIST shtab-1.13.0.tar.gz.provenance 9480 BLAKE2B a9f4d0dcf37d781dd761a2b0d32240d573fb48e02b2a2c94f4423b986f918b4c264c6f2cf53572889260629bec8271119764cd5391cc0819c3efba005b75fd7e SHA512 9948247769709a786bce6cfe45a5c84f06842b32f6557b4201ab2947cd6066d82c57d05d5438e7b01d2a25285252afbe6a08d29eae49964a6d429ec028306587
diff --git a/dev-python/shtab/shtab-1.10.0.ebuild b/dev-python/shtab/shtab-1.10.0.ebuild
deleted file mode 100644
index 54cd635fb7e8..000000000000
--- a/dev-python/shtab/shtab-1.10.0.ebuild
+++ /dev/null
@@ -1,31 +0,0 @@
-# Copyright 2024-2026 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYPI_VERIFY_REPO=https://github.com/tqdm/shtab
-PYTHON_COMPAT=( python3_{13..14} )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Automagic shell tab completion for Python CLI applications"
-HOMEPAGE="
-	https://github.com/tqdm/shtab/
-	https://pypi.org/project/shtab/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="amd64 ~arm arm64 ~loong ~ppc64 ~riscv x86"
-
-BDEPEND="
-	dev-python/setuptools-scm[${PYTHON_USEDEP}]
-"
-
-EPYTEST_PLUGINS=()
-distutils_enable_tests pytest
-
-python_test() {
-	epytest -o addopts=
-}
diff --git a/dev-python/shtab/shtab-1.11.0.ebuild b/dev-python/shtab/shtab-1.13.0.ebuild
index 54cd635fb7e8..6799197f5470 100644
--- a/dev-python/shtab/shtab-1.11.0.ebuild
+++ b/dev-python/shtab/shtab-1.13.0.ebuild
@@ -17,10 +17,13 @@ HOMEPAGE="
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="amd64 ~arm arm64 ~loong ~ppc64 ~riscv x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
 
 BDEPEND="
 	dev-python/setuptools-scm[${PYTHON_USEDEP}]
+	test? (
+		dev-python/click[${PYTHON_USEDEP}]
+	)
 "
 
 EPYTEST_PLUGINS=()
diff --git a/dev-python/soupsieve/Manifest b/dev-python/soupsieve/Manifest
index d2c311bfa9a5..dde29782db88 100644
--- a/dev-python/soupsieve/Manifest
+++ b/dev-python/soupsieve/Manifest
@@ -3,3 +3,4 @@ DIST soupsieve-2.9.2.gh.tar.gz 157707 BLAKE2B b57eef6a67ddf33c03bdd418a22229877b
 DIST soupsieve-3.0.1.gh.tar.gz 119766 BLAKE2B 01a1f300d336182a3e055fcad4ee5d321c311ace28363f5c800e36cc5c7c813b66786b3e8f464c90511be236ff64709122759a5332c7127f7d4c11fc27dab461 SHA512 4609a5c9701e1b51a1dfa447bb33993a2ce3a781c9f0b8fa1fdee1fed3bdd05b9e79f25967d82f64252be8c66b823f652365236dcfd4a82c5b835a5fc8504955
 DIST soupsieve-3.0.2.gh.tar.gz 119863 BLAKE2B 0a3f4628f5727e1b757ab7c91ceb95aace7be3e8606d6bd3d965444203dcd595a4acd8b4b45ede24da4bc6ff52843942c45c675082d25c1b6bff43f4dde7f7b3 SHA512 891bdf03ffc4497141aecc888ee5c55b3d138031e24a79562b38d2c17bfc364fd6025fcd15210bdce238b5534882ef9088e1b6f2e887ed09d86ee432a8177aa5
 DIST soupsieve-3.0.3.gh.tar.gz 120295 BLAKE2B 65a48c2a450c2026cb60c404ea6bd375e02af65d7f57cedb3931d7349ad1178fc78068d6ba803b2fad4c37f8cfcedecf1cd41f1280bf472ed76fab596a73e274 SHA512 64dd71a019cad6e7279f09c4342aa0d0a8cf4fbc7ed0ab12ae7fb3bb0e9e6ba22b2f2c42c44738322a2c17ed3ec8bfb1bd01bc20f62b384edd6804a9fe1e7cdb
+DIST soupsieve-3.0.4.gh.tar.gz 123598 BLAKE2B cb2bcda9aa825fea667a8099a6996135dd5ff579d68401c01f6fa3b92400b24bcc8e383d82b17ccb90844251fc20fc51da60238c99abbbbe920e1ec4eba7bc2e SHA512 00b35d354395668c55304dfbc83172415b1d553e29ad4fe95d67f47607f86567127b7109fde93cd3251d8dcc0803eb42a40146e5e03249356c15c6646bb9b377
diff --git a/dev-python/soupsieve/soupsieve-3.0.4.ebuild b/dev-python/soupsieve/soupsieve-3.0.4.ebuild
new file mode 100644
index 000000000000..a386cbdf6652
--- /dev/null
+++ b/dev-python/soupsieve/soupsieve-3.0.4.ebuild
@@ -0,0 +1,34 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=hatchling
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1
+
+DESCRIPTION="A modern CSS selector implementation for BeautifulSoup"
+HOMEPAGE="
+	https://github.com/facelessuser/soupsieve/
+	https://pypi.org/project/soupsieve/
+"
+SRC_URI="
+	https://github.com/facelessuser/soupsieve/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+BDEPEND="
+	test? (
+		dev-python/beautifulsoup4[${PYTHON_USEDEP}]
+		dev-python/lxml[${PYTHON_USEDEP}]
+		dev-python/html5lib[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
diff --git a/dev-python/sqlalchemy/Manifest b/dev-python/sqlalchemy/Manifest
index c145e350d5d0..94add9e2fb05 100644
--- a/dev-python/sqlalchemy/Manifest
+++ b/dev-python/sqlalchemy/Manifest
@@ -7,3 +7,4 @@ DIST sqlalchemy-2.1.1.tar.gz 10503203 BLAKE2B 18c76e58bb243bc9fff745f3c04435a407
 DIST sqlalchemy-2.1.3.tar.gz 10525778 BLAKE2B 7093aecf1b69b410852a6926d0cb4e4c2e0b7b091c9eda4cd6e5a224dbdbe1a29f17ed350abfdf5d0565a2dcfa7f1a00ea31f3c5e553b70652b56be6fac8ad7b SHA512 abce5dac76e71c7bd059da30b0b61291f5fb1f49417fe1c02220ea4903b142a2b58ec2d2c288b65113420e0ddf9e7b09b89a38a8093686f9ee2d872b5e1d791d
 DIST sqlalchemy-2.1.4.tar.gz 10544216 BLAKE2B 70414f34f9b1007ca105873c2c7c1789f44656340a6ed6d9fbb28a276f6db0afef69e21fb90abd0f325d2f53a4475f45a7da87db670fc600ae904ab20ef66647 SHA512 fbdafec12fb50654ef73eec69a4bbe885a5fce15cf4a48a26ee322a7e758a6aacab5efb441cff0bbd921065b85dab45b327818c01a1dc856294cf7781a2c1e60
 DIST sqlalchemy-2.1.5.tar.gz 10569593 BLAKE2B 8c483c039900d5535af9ed430d918d9421b81627bcb29b4c7ac32ac1249ff75d08ed76e83c62034940a27a520ec9af049f4364ed21a3b247a5a1c145c0c98cb1 SHA512 2961597ee9bf72fa6cfd1a325a74d5ca1f52066483b6cf343a88c90bdd3084e0e87bcc877743528bbfd1808f11a37c37b4d6cb699a3478840879eb2a010a5b3a
+DIST sqlalchemy-2.1.6.tar.gz 10589700 BLAKE2B 7d0ca8d28d9fa29a9214af70bc7adfa4ee5b5400fe2fc3ae262f55ec9b3962367d2b1afb830939fab8bf901ad7faf78b562cdd70660d49c961a5963fef7b574c SHA512 f575cba9dfb34482dfe9edf64963fc1228be1eb315552c9c37f9f2a47f9e7fdb224a54582c6e41a88d3e58574d06c6b17172e98ebf7543adc5a645790594def7
diff --git a/dev-python/sqlalchemy/sqlalchemy-2.1.6.ebuild b/dev-python/sqlalchemy/sqlalchemy-2.1.6.ebuild
new file mode 100644
index 000000000000..d9cf5b3c5b56
--- /dev/null
+++ b/dev-python/sqlalchemy/sqlalchemy-2.1.6.ebuild
@@ -0,0 +1,103 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYPI_PN=SQLAlchemy
+PYTHON_COMPAT=( python3_{13..14} )
+PYTHON_REQ_USE="sqlite?"
+
+inherit distutils-r1 optfeature pypi
+
+DESCRIPTION="Python SQL toolkit and Object Relational Mapper"
+HOMEPAGE="
+	https://www.sqlalchemy.org/
+	https://pypi.org/project/SQLAlchemy/
+	https://github.com/sqlalchemy/sqlalchemy/
+"
+
+LICENSE="MIT"
+SLOT="0"
+if [[ ${PV} != *_beta* ]]; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~x64-solaris"
+fi
+IUSE="examples +sqlite test"
+
+RDEPEND="
+	>=dev-python/typing-extensions-4.6.0[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/cython[${PYTHON_USEDEP}]
+	test? (
+		$(python_gen_impl_dep sqlite)
+	)
+"
+
+EPYTEST_PLUGINS=()
+EPYTEST_RERUNS=5
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_IGNORE=(
+		test/ext/mypy/test_mypy_plugin_py3k.py
+		test/typing/test_mypy.py
+		# hardcode call counts specific to Python versions
+		test/aaa_profiling
+	)
+	local EPYTEST_DESELECT=(
+		# warning tests are unreliable
+		test/base/test_warnings.py
+		# TODO: flaky? xdist?
+		test/base/test_concurrency_py3k.py::TestAsyncioCompat::test_await_fallback_no_greenlet
+	)
+	local sqlite_version=$(sqlite3 --version | cut -d' ' -f1)
+	case ${EPYTHON} in
+		python3.15)
+			EPYTEST_DESELECT+=(
+				# repr() changes
+				test/orm/declarative/test_dc_transforms.py::DCTransformsTest::test_basic_constructor_repr_base_cls
+				test/orm/declarative/test_dc_transforms_future_anno_sync.py::DCTransformsTest::test_basic_constructor_repr_base_cls
+				# exception message changes
+				test/engine/test_processors.py::PyDateProcessorTest::test_no_string
+			)
+			;;
+	esac
+	if ! has_version "dev-python/greenlet[${PYTHON_USEDEP}]"; then
+		EPYTEST_DESELECT+=(
+			test/ext/asyncio/test_engine_py3k.py::TextSyncDBAPI::test_sync_driver_execution
+			test/ext/asyncio/test_engine_py3k.py::TextSyncDBAPI::test_sync_driver_run_sync
+			"test/engine/test_pool.py::PoolEventsTest::test_checkin_event_gc[False-True]"
+			"test/engine/test_pool.py::PoolEventsTest::test_checkin_event_gc[True-True]"
+			"test/engine/test_pool.py::PoolEventsTest::test_checkin_event_gc[has_terminate-is_asyncio]"
+			"test/engine/test_pool.py::PoolEventsTest::test_checkin_event_gc[not_has_terminate-is_asyncio]"
+			"test/engine/test_pool.py::QueuePoolTest::test_userspace_disconnectionerror_weakref_finalizer[True-_exclusions0]"
+			"test/engine/test_pool.py::QueuePoolTest::test_userspace_disconnectionerror_weakref_finalizer[True]"
+		)
+	fi
+
+	# upstream's test suite is horribly hacky; it relies on disabling
+	# the warnings plugin and turning warnings into errors;  this also
+	# means that any DeprecationWarnings from third-party plugins cause
+	# everything to explode
+	epytest --reruns-delay=2 -m "not gc_intensive and not timing_intensive and not mypy"
+}
+
+python_install_all() {
+	if use examples; then
+		docompress -x "/usr/share/doc/${PF}/examples"
+		dodoc -r examples
+	fi
+
+	distutils-r1_python_install_all
+}
+
+pkg_postinst() {
+	optfeature "asyncio support" dev-python/greenlet
+	optfeature "MySQL support" \
+		dev-python/mysqlclient \
+		dev-python/pymysql
+	optfeature "postgresql support" dev-python/psycopg:2
+}
diff --git a/dev-python/tornado/Manifest b/dev-python/tornado/Manifest
index 62d409037691..ffdb1c51e433 100644
--- a/dev-python/tornado/Manifest
+++ b/dev-python/tornado/Manifest
@@ -1,6 +1,4 @@
 DIST tornado-6.5.10.tar.gz 537910 BLAKE2B 6ec1bcba8c7dc2175206528b97be64e6dbbfb51ae6c9cdd1d0dc0bdc4eff55c1a9a0ebe9c700ea18e88fef3197b0d7efe1812fab5196dfab5cdfd71b6d1568bc SHA512 0a3a38162a91d7d82f0d790d37788c5761bd9663af0356641bd6bd0ec5f6d490e5013965db1f91f28959d925127640cffbd4b661415b43ca5b50ee812841f445
 DIST tornado-6.5.10.tar.gz.provenance 9454 BLAKE2B 4a8faa5670534337aead096a06c10b3f77c0ba8dc13e70d94dc92fae59a28e072333ef37635cf2db12fe20de17e175e96da6b575e73c8426103320b6a58f71ac SHA512 c03ebd606a6543a816ffff74217061702ffbdfbeb209ac7541f50d6beca4caf8568e32b40712a3b9ef567f15d50453fe789a84f6e4c2420201216a50776c6951
-DIST tornado-6.5.8.tar.gz 520493 BLAKE2B e48ca20fe0551b8536162071e0b9267ccd167df617c25f930481668e733c656904109014e65462e561d47acc557cfe32f86a422e8f7e840b4262acbafb2b720a SHA512 88c096ca30357644c07b6013cd514b5e64135b26a77d9ff17640951632d6f68c9a68d7fa80224743f7900fbf5ddde838088bd9838395651d87d876c8d1d1a2fe
-DIST tornado-6.5.8.tar.gz.provenance 9416 BLAKE2B 1f4d1d9289f8aa8fdde1dda19454da15e9056111f0225e0701eb385ef42b0fae26a6bb9dc5df3ffb9796e4d805db5aa7406aa466ec9389802df1033cdb5231a6 SHA512 b1c364aed55ecb3cbab7343de9ebfaa181579ca81a57e498953c7d0e657bd8b08ee9fb6e5f72d8205f379fbd25237054bfecdb9982fc973e4bb55a00a0411444
-DIST tornado-6.5.9.tar.gz 536145 BLAKE2B 13071c50a8f0701d750f26aa5fb3669ee5c78c4d249d570b519a672d8fdfa76d38f90633ad21fa1c7d551c50c5f6d0dab53ebb694685d52f1cc1269cb0728564 SHA512 e497f0cacca0ca0d34b65117a72e9ebe0056f77ced09eb5d200dea24da8c28182d5704d1b17510fc139841718fce6a19c7f154d416e59292f4236eb717a0a75c
-DIST tornado-6.5.9.tar.gz.provenance 9473 BLAKE2B 9c58b5c0753dee0f9e111cd5007512fffc91964cad3eeed7e11758aff96f239692492f35f220f08ef10bfd249013d3d1c550a4f79a3669c86abd5ef5fd2922a7 SHA512 20cb384accabf2c8659f90446c2f39d3b3535662114e0707521a870e291879da15a8c6c0fac61a6e64a26e4f64ccfc8d8f1dd3db60717b3121a52263422fb061
+DIST tornado-6.6.tar.gz 617998 BLAKE2B 988b37f28f57a5aee35e068d93bbbf3b28ab9c52bc830ecf9474e48b47b68c944a1fac7309531f9da1cd253fd49eae079c01b4e8bc2896a59fdf77299ef16c7d SHA512 8c679f13e158f2cd9a7106e057d74c8a6a8c3ed53bfd0fc7963f876e814b0604db3a75e55de376dbf4c644130de9a7d9d64145fbce276533a05787dec1e60f79
+DIST tornado-6.6.tar.gz.provenance 9611 BLAKE2B 71c82dae3d52f8fcce94c75054192a7b4fa47d507a1161892cd15d373ea3c6efa810419b3381d9942982e635e8df778992d0cecee0c48aab263c850eb94704dc SHA512 466427fad2a37ee372bf268e899745b031a6c1c16463d42e3a3f74a2aa9207b21d62164cdc476c5523b8e0dece8c39847753a6f47a97d69442cddc257f331a70
diff --git a/dev-python/tornado/tornado-6.5.8.ebuild b/dev-python/tornado/tornado-6.5.8.ebuild
deleted file mode 100644
index f73a5bc3e333..000000000000
--- a/dev-python/tornado/tornado-6.5.8.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2026 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_EXT=1
-DISTUTILS_USE_PEP517=setuptools
-PYPI_VERIFY_REPO=https://github.com/tornadoweb/tornado
-PYTHON_COMPAT=( python3_{13..14} )
-PYTHON_REQ_USE="threads(+)"
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Python web framework and asynchronous networking library"
-HOMEPAGE="
-	https://www.tornadoweb.org/
-	https://github.com/tornadoweb/tornado/
-	https://pypi.org/project/tornado/
-"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=dev-python/twisted-16.0.0[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	test? (
-		${RDEPEND}
-		$(python_gen_cond_dep '
-			>=dev-python/pycurl-7.19.3.1[${PYTHON_USEDEP}]
-		' 'python*')
-	)
-"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-6.3.2-ignore-deprecationwarning.patch"
-)
-
-src_prepare() {
-	# network-sandbox? ipv6?
-	sed -i -e 's:test_localhost:_&:' \
-		tornado/test/netutil_test.py || die
-
-	distutils-r1_src_prepare
-}
-
-python_test() {
-	local -x ASYNC_TEST_TIMEOUT=60
-	# Avoid time-sensitive tests
-	# https://github.com/tornadoweb/tornado/blob/10974e6ebee80a26a2a65bb9bd715cf858fafde5/tornado/test/util.py#L19
-	local -x TRAVIS=1
-	local -x NO_NETWORK=1
-
-	cd "${T}" || die
-	"${EPYTHON}" -m tornado.test.runtests --verbose ||
-		die "tests failed under ${EPYTHON}"
-}
diff --git a/dev-python/tornado/tornado-6.5.9.ebuild b/dev-python/tornado/tornado-6.6.ebuild
index 34eff013d738..f2af848e67e8 100644
--- a/dev-python/tornado/tornado-6.5.9.ebuild
+++ b/dev-python/tornado/tornado-6.6.ebuild
@@ -30,9 +30,8 @@ RDEPEND="
 BDEPEND="
 	test? (
 		${RDEPEND}
-		$(python_gen_cond_dep '
-			>=dev-python/pycurl-7.19.3.1[${PYTHON_USEDEP}]
-		' 'python*')
+		dev-python/hypothesis[${PYTHON_USEDEP}]
+		>=dev-python/pycurl-7.19.3.1[${PYTHON_USEDEP}]
 	)
 "
 
diff --git a/dev-python/types-python-dateutil/Manifest b/dev-python/types-python-dateutil/Manifest
index b6bbe1776292..317e31638100 100644
--- a/dev-python/types-python-dateutil/Manifest
+++ b/dev-python/types-python-dateutil/Manifest
@@ -1 +1,2 @@
 DIST types_python_dateutil-2.9.0.20260807.tar.gz 17618 BLAKE2B 17d3866132f2501a5a78574386279cd49a77a555e20e68085e238d7f0851895c70b1cdbe8560158cb3f122fc312914e158170e04721d0a2909f2a4010a7c92a1 SHA512 3903f9d2295885416e9f1de5c67f55dd4f243d734267e3197b0788275fc5124837fedf27c964045cf47da355ee83fef654540d80ba82ed78501539fc2f151999
+DIST types_python_dateutil-2.9.0.20261021.tar.gz 17792 BLAKE2B 9333a25b887891916311a5f5a446d36ea1d28e6cddf33fd700e99efc706b350356d2c8dc31a32730c8f099c62710b5763ba4f983c4066a61894de78d2c01f08e SHA512 06f753afe882c48e5b78b573528c9dffa4f06208018898db5f10f514f6c154ba3bec3e98650a634210265c0b0f9fbf1d7424a303d21b971aadca67c41313beba
diff --git a/dev-python/types-python-dateutil/types-python-dateutil-2.9.0.20261021.ebuild b/dev-python/types-python-dateutil/types-python-dateutil-2.9.0.20261021.ebuild
new file mode 100644
index 000000000000..866a75258277
--- /dev/null
+++ b/dev-python/types-python-dateutil/types-python-dateutil-2.9.0.20261021.ebuild
@@ -0,0 +1,23 @@
+# Copyright 2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Typing stubs for python-dateutil"
+HOMEPAGE="
+	https://github.com/python/typeshed/
+	https://pypi.org/project/types-python-dateutil/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+
+BDEPEND="
+	>=dev-python/setuptools-82.0.1[${PYTHON_USEDEP}]
+"
diff --git a/dev-python/uv-build/Manifest b/dev-python/uv-build/Manifest
index a199ed0a136a..670371f241cc 100644
--- a/dev-python/uv-build/Manifest
+++ b/dev-python/uv-build/Manifest
@@ -1,2 +1,3 @@
 DIST uv_build-0.12.17.tar.gz 434807 BLAKE2B 8823907abc14637a684723b683284cc8b6a40b2467adbab74059b139388aeb1ff8870bdc09a497bad3e06af60c4e9c360c8d57cc6dd62e26e9239f4cf041f827 SHA512 a833a0578c6d543eabe51089d330f0d93d141bea5ff2bc1a194ad27a7ad4a1c7189321cdcf6012465b819bffd620affb42d4fb148bce69beeee0e32537a74668
 DIST uv_build-0.13.4.tar.gz 464427 BLAKE2B 899bd8d7628bc5a291a6f974e569484a61d1aff51745e004cb663167128470147f2dae454457e010fa495e9d9de19527e9185e90c88018e51b4352359ceca349 SHA512 2e74b38cd01468281f481fa3b1ea289e1d262986e97bf3bfd27812c08676825567c547144bc9ed090bede4eb8db3114e6e8330eeaf96a91602bdd5212ae76433
+DIST uv_build-0.13.5.tar.gz 466761 BLAKE2B 85333e905fa03c1615a2ce67b19d4266d84757419bd2c04737ceee3fc000ce543aebb0e51f7bccdf7a681ab691aeee1491f8c335f4ffc3b1d52ebe75d5fb4ad7 SHA512 a7e3c3029179dc9a2c91519f7d161f707cce9b87e0b6a1802b257a63b8a468ba0fa64ea2010571426b30746ed3f83742c26c2c3045f06b587375c60231e52f9f
diff --git a/dev-python/uv-build/uv-build-0.13.5.ebuild b/dev-python/uv-build/uv-build-0.13.5.ebuild
new file mode 100644
index 000000000000..0250a02341f9
--- /dev/null
+++ b/dev-python/uv-build/uv-build-0.13.5.ebuild
@@ -0,0 +1,100 @@
+# Copyright 2025-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maturin compiles uv-build executable for every impl, we do not want
+# that, so we use another backend.  And since we use another backend,
+# why not dogfood it in the first place?
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="PEP517 uv build backend"
+HOMEPAGE="
+	https://github.com/astral-sh/uv/
+	https://pypi.org/project/uv-build/
+"
+
+LICENSE="|| ( Apache-2.0 MIT )"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~s390 ~x86"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=dev-python/uv-${PV}
+"
+BDEPEND="
+	test? (
+		app-arch/unzip
+		dev-python/build[${PYTHON_USEDEP}]
+	)
+"
+
+src_prepare() {
+	distutils-r1_src_prepare
+
+	# use the executable from dev-python/uv instead of building
+	# a largely overlapping uv-build executable (at least for now)
+	sed -i -e '/USE_UV_EXECUTABLE/s:False:True:' python/uv_build/__init__.py || die
+
+	# replace the build-system section
+	sed -i -e '/\[build-system\]/,$d' pyproject.toml || die
+	cat >> pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["uv_build<9999"]
+		build-backend = "uv_build"
+		backend-path = ["src"]
+	EOF
+
+	# rename to make uv-build find it
+	mv python src || die
+}
+
+python_test() {
+	"${EPYTHON}" -m build -n || die "Self-build failed with ${EPYTHON}"
+
+	local zip_result=$(
+		unzip -t "dist/uv_build-${PV}-py3-none-any.whl" || die
+	)
+	local zip_expected="\
+Archive:  dist/uv_build-${PV}-py3-none-any.whl
+    testing: uv_build/                OK
+    testing: uv_build/__init__.py     OK
+    testing: uv_build/__main__.py     OK
+    testing: uv_build/py.typed        OK
+    testing: uv_build-${PV}.dist-info/   OK
+    testing: uv_build-${PV}.dist-info/WHEEL   OK
+    testing: uv_build-${PV}.dist-info/METADATA   OK
+    testing: uv_build-${PV}.dist-info/RECORD   OK
+No errors detected in compressed data of dist/uv_build-${PV}-py3-none-any.whl.\
+"
+	if [[ ${zip_result} != ${zip_expected} ]]; then
+		eerror ".zip result:\n${zip_result}"
+		eerror ".zip expected:\n${zip_expected}"
+		die ".whl result mismatch"
+	fi
+
+	local tar_result=$(
+		tar -tf "dist/uv_build-${PV}.tar.gz" || die
+	)
+	local tar_expected="\
+uv_build-${PV}/PKG-INFO
+uv_build-${PV}/pyproject.toml
+uv_build-${PV}/pyproject.toml.orig
+uv_build-${PV}/
+uv_build-${PV}/README.md
+uv_build-${PV}/src
+uv_build-${PV}/src/uv_build
+uv_build-${PV}/src/uv_build/__init__.py
+uv_build-${PV}/src/uv_build/__main__.py
+uv_build-${PV}/src/uv_build/py.typed\
+"
+	if [[ ${tar_result} != ${tar_expected} ]]; then
+		eerror ".tar.gz result:\n${tar_result}"
+		eerror ".tar.gz expected:\n${tar_expected}"
+		die ".tar.gz result mismatch"
+	fi
+}
diff --git a/dev-python/uv/Manifest b/dev-python/uv/Manifest
index 7158f373e5c9..3b0355c8f40b 100644
--- a/dev-python/uv/Manifest
+++ b/dev-python/uv/Manifest
@@ -2,3 +2,5 @@ DIST uv-0.12.17-crates.tar.xz 43846848 BLAKE2B f899f093a14a7195cb93d81aa71c31d68
 DIST uv-0.12.17.gh.tar.gz 8706123 BLAKE2B e45aae4ea550252440e8f646a505ba4d295e1eafe94092798e79e5db26320dae4b899cc7d04d96387791996e55e4ced2cbcff6ffcd9edc056c9580f5e175751f SHA512 ae554aa9d096afa7e1c35a1e50ba11c0553cd182ba75e5dd425613add092d38c46b3cbd47b026f03674394d6d0852162d5953c4cacef511c7157378d1790b8a1
 DIST uv-0.13.4-crates.tar.xz 44003088 BLAKE2B 671f829d9f64a3f5aa2d1ec7e3f705eadb63529c43f65796a25ef0307f763ce4611f2ee41ee38ffeb19a2eac91d918129be4deb128c6a879c5bcd204862854ea SHA512 94d07b0fa8edbf6364366268be678055125e7baa854c8bc30aaf6721210fc63a1ef0dd5f07e0a511b2cd132f2fcf25690b6c2fa828b97b3893785ed18d40a51e
 DIST uv-0.13.4.gh.tar.gz 8930524 BLAKE2B 6db88a4d14037a65f0c2f1a5e98a1a3a6c0697300906af3f753d7ce87320b4086067abe13a60fd335d713f427fc1e2bda7a4917eb1d985daf03aa795672eb188 SHA512 06bc16f6e10b31cbdf1265623990cfe52bc0e040a53edd63b952807b340aec274d412ff7f17111e235596c7f054186fb7024abb0e563f43abb03309df7070f8a
+DIST uv-0.13.5-crates.tar.xz 44020328 BLAKE2B 054a712a0df9ab235bdc65da39218ec4e76bdf9df7946ab137e1744359fb5b6ebf35e3b8f91cc17f3ab484654e4ab35aaa2f071e3a9034d395d99b14a5133c5f SHA512 272bd68eb45f516d885c587392b08857e5e6db825878a9b686686e588e7a87c1944b38ae063f780060d87615eec51e0a9cff786480adb9e1e4d13bd17c2b23a6
+DIST uv-0.13.5.gh.tar.gz 8966770 BLAKE2B 18e1ad6a5a68f5750ca3c2e97856418a0fc04dd0e59dacd4cc04fecf09c9c4e1dece02959e96d2d86cf41c83b4da5f5f767279058cf34845f76420172bd5d613 SHA512 22ae38ec22e9aa1f816e39516357a8f05c296cbf7cffe1f48657a10d3b80252492397ba5dd6dace15846626c6cdcc0c456a38c4ba51d856dd72d3ad025b9e6c7
diff --git a/dev-python/uv/uv-0.13.5.ebuild b/dev-python/uv/uv-0.13.5.ebuild
new file mode 100644
index 000000000000..c3bba465dc41
--- /dev/null
+++ b/dev-python/uv/uv-0.13.5.ebuild
@@ -0,0 +1,161 @@
+# Copyright 2024-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+CRATES="
+"
+RUST_MIN_VER="1.97.0"
+
+inherit cargo check-reqs
+
+CRATE_PV=${PV}
+DESCRIPTION="A Python package installer and resolver, written in Rust"
+HOMEPAGE="
+	https://github.com/astral-sh/uv/
+	https://pypi.org/project/uv/
+"
+# pypi sdist misses scripts/, needed for tests
+SRC_URI="
+	https://github.com/astral-sh/uv/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+	${CARGO_CRATE_URIS}
+"
+if [[ ${PKGBUMPING} != ${PVR} ]]; then
+	SRC_URI+="
+		https://github.com/gentoo-crate-dist/uv/releases/download/${CRATE_PV}/uv-${CRATE_PV}-crates.tar.xz
+	"
+fi
+
+# most of the code
+LICENSE="|| ( Apache-2.0 MIT )"
+# crates/pep508-rs is || ( Apache-2.0 BSD-2 ) which is covered below
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD-2 BSD CC0-1.0
+	CDLA-Permissive-2.0 ISC MIT MPL-2.0 Unicode-3.0 Unicode-DFS-2016
+	ZLIB
+"
+# ring crate
+LICENSE+=" openssl"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~s390 ~x86"
+IUSE="test"
+RESTRICT="test"
+PROPERTIES="test_network"
+
+DEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-arch/zstd:=
+"
+RDEPEND="
+	${DEPEND}
+"
+# git/curl: https://bugs.gentoo.org/984287
+BDEPEND="
+	virtual/pkgconfig
+	test? (
+		dev-lang/python:3.9
+		dev-lang/python:3.10
+		dev-lang/python:3.11
+		dev-lang/python:3.12
+		dev-lang/python:3.13
+		!!~dev-python/uv-0.5.0
+		|| (
+			>=dev-vcs/git-2.57
+			<net-misc/curl-8.23
+		)
+	)
+"
+
+QA_FLAGS_IGNORED="usr/bin/.*"
+
+check_space() {
+	local CHECKREQS_DISK_BUILD=3G
+	use debug && CHECKREQS_DISK_BUILD=9G
+	check-reqs_pkg_setup
+}
+
+pkg_pretend() {
+	check_space
+}
+
+pkg_setup() {
+	check_space
+	rust_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# force thin lto, makes build much faster and less memory hungry
+	# (i.e. makes it possible to actually build uv on 32-bit PPC)
+	sed -i -e '/lto/s:fat:thin:' Cargo.toml || die
+
+	# enable system libraries where supported
+	export ZSTD_SYS_USE_PKG_CONFIG=1
+	# TODO: unbundle tikv-jemalloc-sys?
+
+	# remove unbundled sources, just in case
+	find "${ECARGO_VENDOR}"/zstd-sys-*/ -name '*.c' -delete || die
+}
+
+src_configure() {
+	local myfeatures=(
+		test-git
+		test-pypi
+		test-python
+	)
+
+	cargo_src_configure --no-default-features
+	# otherwise, rustc/llvm runs out of address space
+	use arm && export RUSTFLAGS="${RUSTFLAGS} -Copt-level=0"
+}
+
+src_compile() {
+	cd crates/uv || die
+	cargo_src_compile
+}
+
+src_test() {
+	cd crates/uv || die
+	cargo_src_test --no-fail-fast
+}
+
+src_install() {
+	dobin "$(cargo_target_dir)"/{uv,uvx}
+
+	insinto /etc/xdg/uv
+	newins - uv.toml <<-EOF || die
+		# These defaults match Fedora, see:
+		# https://src.fedoraproject.org/rpms/uv/pull-request/18
+
+		# By default ("automatic"), uv downloads missing Python versions
+		# automatically and keeps them in the user's home directory.
+		# Disable that to make downloading opt-in, and especially
+		# to avoid unnecessarily fetching custom Python when the distro
+		# package would be preferable.  Python builds can still be
+		# downloaded manually via "uv python install".
+		#
+		# https://docs.astral.sh/uv/reference/settings/#python-downloads
+		python-downloads = "manual"
+
+		# By default ("managed"), uv always prefers self-installed
+		# Python versions over the system Python, independently
+		# of versions.  Since we generally expect users to use that
+		# to install old Python versions not in ::gentoo anymore,
+		# this effectively means that uv would end up preferring very
+		# old Python versions over the newer ones that are provided
+		# by the system.  Default to using the system versions to avoid
+		# this counter-intuitive behavior.
+		#
+		# https://docs.astral.sh/uv/reference/settings/#python-preference
+		python-preference = "system"
+
+		# Always use system certificates.
+		#
+		# https://docs.astral.sh/uv/reference/settings/#system-certs
+		system-certs = true
+	EOF
+}
diff --git a/dev-python/vcsgraph/Manifest b/dev-python/vcsgraph/Manifest
index be9baeb3ed50..fe0d7b7405c6 100644
--- a/dev-python/vcsgraph/Manifest
+++ b/dev-python/vcsgraph/Manifest
@@ -1,3 +1,6 @@
 DIST vcsgraph-0.3.2-crates.tar.xz 1958984 BLAKE2B e315d3dca011e5ad422e4944a2972ca8698c3b8993e7c7f8be6c81a9dd04e6188a2ad41432ed6364713ecc7037f484c6c4812af5f783f15779b4ddaaead9bb0c SHA512 73e3a54e2a5aae51135c73c72316f49e0d52f4ccef7dc3a1540b1040d47a334d7a19ddaca841009dc01fa7aa36daea337df417cfd976c90b9fc0e57f0bb82d00
 DIST vcsgraph-0.3.2.tar.gz 99202 BLAKE2B 670a41a48f10c24ff15a590db7393bcc2d5ff1ae8f8c816ed4e3a574b963f6b5b183435a4832998b316f7e3971626010410a8dd8a741a574ab4b2b283079a7db SHA512 2aa4802221d4a4cc4bc0f341ef521912bc493cbe1765a7880b4dedc1f598e7f398c7781d6a0a222a2cd4afcc17178fb50347c6c06bda1071d0b22c65885c654c
 DIST vcsgraph-0.3.2.tar.gz.provenance 9838 BLAKE2B 4724f8083025ca24eb3881aa8f964ae4b13d74384ea722d422587ffec345840963461cd34e62be92361754618a24c3107eb6f29e538d4f05bca1616f2be51568 SHA512 5553f43e89d8e236c5e7bb5f061f6f9e8b6bbf667b77e13defeb1c0c3de69734911d344c54772eb31e8a447371e2d322dad1fe9eb9bd647ad77939288a13deb4
+DIST vcsgraph-0.3.3-crates.tar.xz 2089584 BLAKE2B 4f300434ae93b427fe71815f99425d3f1d527c9c22084e396c91ea1d22b02497a90029de94f6b7d26e9eb0e2d731a4092ae8f6fc05361d37790101fe61f334ed SHA512 4ca79c24e87590e01a11d543cfb4c2c00d9f03d00c6b141a1b74d3cc86e6f80d4fe54c34b35f5c01e7d19ae778f47c472babff6ac75bc2ccccd51ada963a56d0
+DIST vcsgraph-0.3.3.tar.gz 99280 BLAKE2B d77f09a184afd7c30851fd59e0a97352ab3c51c56513ae5218efb189d2f1a56c115dc1b7fdbbc7c1b78c9c84a9a8a22c2dc39bcb7f9e8288060619b01baedabd SHA512 977a8f5dad82525192b51769ed6b745c200ea7d6a04570d85074403af054f973f548e89ab97d1e11b53ecc9545a26c7089c153a420f4e6746fcf51d56fa58aa3
+DIST vcsgraph-0.3.3.tar.gz.provenance 9810 BLAKE2B 8b928a7c95447db0e1b656ff07135e6cd61f1a200741ef72f5dcd5078b19d57ae891b94d6767c43096b383c8aaf32beed9a2811a22a82bf1dfa0aa1c523ebc91 SHA512 cefb068f2e2b392004cb715f1107712fcf30e9befa6ea881e178e285388bc7787e2a511e1900868ca9313b5fa45a38f47c8fdd2bd02de8925693786b55113343
diff --git a/dev-python/vcsgraph/vcsgraph-0.3.3.ebuild b/dev-python/vcsgraph/vcsgraph-0.3.3.ebuild
new file mode 100644
index 000000000000..2a45f28a9d42
--- /dev/null
+++ b/dev-python/vcsgraph/vcsgraph-0.3.3.ebuild
@@ -0,0 +1,45 @@
+# Copyright 2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYPI_VERIFY_REPO=https://github.com/breezy-team/vcsgraph
+PYTHON_COMPAT=( python3_{13..14} )
+
+RUST_MIN_VER="1.83"
+CRATES=""
+
+inherit cargo distutils-r1 pypi
+
+DESCRIPTION="Graph algorithms for version control systems"
+HOMEPAGE="
+	https://pypi.org/project/vcsgraph/
+	https://github.com/breezy-team/vcsgraph/
+"
+SRC_URI+="
+	https://github.com/gentoo-crate-dist/${PN}/releases/download/v${PV}/${P}-crates.tar.xz
+"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~x86"
+
+BDEPEND="
+	dev-python/setuptools-rust[${PYTHON_USEDEP}]
+"
+
+distutils_enable_tests unittest
+
+QA_FLAGS_IGNORED="usr/lib.*/py.*/site-packages/vcsgraph/_graph_rs.*.so"
+
+src_unpack() {
+	pypi_src_unpack
+	cargo_gen_config
+}
+
+python_test() {
+	cd "${BUILD_DIR}/install$(python_get_sitedir)" || die
+	eunittest
+}
diff --git a/dev-python/virtualenv/Manifest b/dev-python/virtualenv/Manifest
index f621e97955e9..2b84f4a853bd 100644
--- a/dev-python/virtualenv/Manifest
+++ b/dev-python/virtualenv/Manifest
@@ -8,6 +8,8 @@ DIST virtualenv-21.14.10.tar.gz 5501185 BLAKE2B e7e0af87a1d923ca899db15ac92a1a87
 DIST virtualenv-21.14.10.tar.gz.provenance 9622 BLAKE2B cefdd192e473a913d659fcd9f9da0dfd44a96f8b2c3638a94adced0246d0ec585c3f01893ee390a848d01f5340ea4b1324fe2c4acb9b3280af18eb789c09eacb SHA512 c856eb9343a104cf8f5388be5bfa0cfb6f5286d2cbdfb425d4613b32b38d0be0a530eb6bf9f89d2deef040dc009e6bb657b23334120c3cedb1e3a96cb316e8f3
 DIST virtualenv-21.14.11.tar.gz 5503091 BLAKE2B 73e59fbf96059002e43819076f17912a2fb1a70cc6b188e10d62eb9d39badf3156dcbcdf5f7280b5bba793a42c0a6cdec734f90534eab59c5c67616f577961a2 SHA512 426cf1fa668754df3defb33f8fb92808b57c8093d573269005345206bbf4adab6fca1a8aaa669fd94678681c3fcd685cb545bf4ed1092b01608e32743d9fe65d
 DIST virtualenv-21.14.11.tar.gz.provenance 9939 BLAKE2B f1b9d5aacc24af5f6da163863444c58827b272312a03fd5986dd4425298b28d4948e66ccf61614adc76c3f341e084e7fccf6a0a8da20834cb798dcfc3b9d8ea6 SHA512 84f2025ce55b8285dd5fd82f8a5c7c8a6e1743ac775aa9fb3a502f9314dc72d0c83584e9534c907cf3572b7b2226786102614f178730f7a10d68feb60774bf88
+DIST virtualenv-21.14.12.tar.gz 5562800 BLAKE2B e74bae47559d4e42d62cb55b4eb454c89010e7bbe4c01e77353f1330d7d7b5b1d8674a44ab434f8348ae799c03630312a6fc1beccf833c19551a6bfab8e5efe5 SHA512 8ad3ba141e199b74861ca2480a940f022ce117d13c225973eedc96537b6ec99132255d7f34296199e6e6c3dede3db76d3f9c131f3504a805cb56b9d7bb8c8394
+DIST virtualenv-21.14.12.tar.gz.provenance 9575 BLAKE2B f92c135942161076edaf72fc7b458384804533d21d44e283f8be940a01d5bdf76502f4f70fa8ba88173ef2872b7253bfd1e47b36b229543e103ecac90eb27afc SHA512 4cdd9414ea7d623ddcae7d3ea52056843a196f2fe00415a2ed7b2835aaa093d48c595043b9a5fc0dd421627b2d0f32b123ceea4b141c327fafa0fd241af025bf
 DIST virtualenv-21.14.3.tar.gz 5464634 BLAKE2B e82707e1a51d55efef6b902fd8f5aa617003fa43d61558a504d7c26186fd64cbf5c559ccb17b0710b2bde0dea7130652d606cc71dfd82936ffe51c046bb74499 SHA512 6ed46584d704a2ea4b4241348a0c8a3dcc7ae0fb5096fe096f60cac1e589b7f634ef46c377b31f3db220b8b0d2cc2f4f1a46294171c662d8fbd8d2d4a569caec
 DIST virtualenv-21.14.3.tar.gz.provenance 9808 BLAKE2B 2bd41496285aa992dcebae332feda3bc0b6f6c06483ae09278ebb4e9835df510a66d29806033afda3cce87ea3899aeb4d5eee8f53ce1df2d2543ee32e13127fd SHA512 98c0db6aed32e36ce3b88ae8193a725e9abecff06cbe7e3821e172c82f9bfa03e2e247f50314740f700a0c2d828b254d6bbfb0e74a7919d10d5d33ebac54701b
 DIST virtualenv-21.14.5.tar.gz 5467127 BLAKE2B 029434d3c647a5898664b98ddd9fcb7577bc6cbe4e7e5cce308bcac83181e48d55556a9936b4928c26f9f5365bf3551047742d29a82b2233cb047df88336db3c SHA512 d58e9332fc6d79a04d534db9b597cbc7e4abebab11858223baa29cf0284bca72646a909c844c0d141c35e63f7b999879af1eed53d0c51e8e4213c3a494ee615f
diff --git a/dev-python/virtualenv/virtualenv-21.14.12.ebuild b/dev-python/virtualenv/virtualenv-21.14.12.ebuild
new file mode 100644
index 000000000000..f7348466af1b
--- /dev/null
+++ b/dev-python/virtualenv/virtualenv-21.14.12.ebuild
@@ -0,0 +1,131 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=hatchling
+PYPI_VERIFY_REPO=https://github.com/pypa/virtualenv
+PYTHON_TESTED=( python3_{13..14} )
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Virtual Python Environment builder"
+HOMEPAGE="
+	https://virtualenv.pypa.io/en/stable/
+	https://pypi.org/project/virtualenv/
+	https://github.com/pypa/virtualenv/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=dev-python/distlib-0.3.7[${PYTHON_USEDEP}]
+	>=dev-python/filelock-3.24.2[${PYTHON_USEDEP}]
+	>=dev-python/packaging-23.1[${PYTHON_USEDEP}]
+	>=dev-python/platformdirs-3.9.1[${PYTHON_USEDEP}]
+	>=dev-python/python-discovery-1.6[${PYTHON_USEDEP}]
+
+	dev-python/ensurepip-pip
+	>=dev-python/ensurepip-setuptools-70.1
+	dev-python/ensurepip-wheel
+"
+# coverage is used somehow magically in virtualenv, maybe it actually
+# tests something useful
+BDEPEND="
+	dev-python/hatch-vcs[${PYTHON_USEDEP}]
+	test? (
+		${RDEPEND}
+		$(python_gen_cond_dep '
+			dev-python/coverage[${PYTHON_USEDEP}]
+			>=dev-python/hatchling-1.27[${PYTHON_USEDEP}]
+			>=dev-python/pip-22.2.1[${PYTHON_USEDEP}]
+			>=dev-python/pytest-mock-3.6.1[${PYTHON_USEDEP}]
+			dev-python/pytest-rerunfailures[${PYTHON_USEDEP}]
+			dev-python/pytest-timeout[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+			>=dev-python/setuptools-67.8[${PYTHON_USEDEP}]
+			dev-python/time-machine[${PYTHON_USEDEP}]
+			dev-python/wheel[${PYTHON_USEDEP}]
+			>=dev-python/packaging-20.0[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+
+src_prepare() {
+	local PATCHES=(
+		# use wheels from ensurepip bundle
+		"${FILESDIR}/${PN}-21.5.1-ensurepip.patch"
+	)
+
+	distutils-r1_src_prepare
+
+	# workaround test failures due to warnings from setuptools-scm, sigh
+	echo '[tool.setuptools_scm]' >> pyproject.toml || die
+
+	# remove useless pins
+	sed -i -e 's:,<[=0-9.]*::' pyproject.toml || die
+
+	# remove bundled wheels
+	rm src/virtualenv/seed/wheels/embed/*.whl || die
+}
+
+python_test() {
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		einfo "Skipping testing on ${EPYTHON}"
+		return
+	fi
+
+	local EPYTEST_DESELECT=(
+		tests/unit/seed/embed/test_bootstrap_link_via_app_data.py::test_seed_link_via_app_data
+		# tests for old wheels with py3.7 support
+		tests/unit/seed/embed/test_pip_invoke.py::test_base_bootstrap_via_pip_invoke
+		tests/unit/seed/wheels/test_wheels_util.py::test_wheel_not_support
+		# broken by different wheel versions in ensurepip
+		tests/unit/seed/wheels/test_acquire_find_wheel.py::test_find_latest_string
+		tests/unit/seed/wheels/test_acquire_find_wheel.py::test_find_exact
+		tests/unit/seed/wheels/test_acquire_find_wheel.py::test_find_latest_none
+		tests/unit/seed/wheels/test_acquire.py::test_download_wheel_bad_output
+		tests/unit/seed/wheels/test_wheels_util.py::test_embed_wheel_below_oldest_supported_is_missing
+		# hangs on a busy system, sigh
+		tests/unit/test_util.py::test_reentrant_file_lock_is_thread_safe
+		# TODO
+		tests/unit/create/via_global_ref/test_build_c_ext.py::test_can_build_c_extensions
+		# random resource leaks or xdist
+		tests/unit/test_file_limit.py::test_too_many_open_files
+		# Internet
+		tests/unit/create/test_creator.py::test_create_distutils_cfg
+		tests/unit/seed/embed/test_pip_invoke.py::test_pip_reseed_removes_previous_version_metadata
+		# we do not use bundled wheels
+		tests/unit/seed/wheels/test_bundle.py::test_every_wheel_on_disk_has_sha256
+		# requires bundled packages in pip
+		tests/unit/test_sbom.py::test_sbom_spdx_declared_license
+		# require pre-commit = internet
+		tests/unit/test_wheel_age.py::test_generator_converges
+		tests/unit/test_wheel_age.py::test_generator_updates_license
+		# TODO
+		tests/unit/seed/embed/test_bootstrap_link_via_app_data.py::test_pip_launcher_record_matches_contents
+		tests/unit/seed/wheels/test_acquire.py::test_download_wheel_skips_local_pip_module
+		tests/unit/seed/wheels/test_acquire_find_wheel.py::test_find_latest
+		# some platformdirs nonsense (bundled packages?)
+		tests/unit/config/test___main__.py::test_module_entry_from_target_install
+	)
+
+	local -x TZ=UTC
+	local EPYTEST_PLUGINS=( pytest-{mock,rerunfailures} time-machine )
+	local EPYTEST_RERUNS=5
+	local EPYTEST_TIMEOUT=180
+	local EPYTEST_XDIST=1
+	epytest -o addopts=
+}
+
+src_install() {
+	distutils-r1_src_install
+
+	# remove bundled wheels, we're using ensurepip bundle instead
+	find "${ED}" -name '*.whl' -delete || die
+}
diff --git a/dev-python/wcmatch/Manifest b/dev-python/wcmatch/Manifest
index f2ac1761d057..3bb4e0ae20e9 100644
--- a/dev-python/wcmatch/Manifest
+++ b/dev-python/wcmatch/Manifest
@@ -1,2 +1,3 @@
 DIST wcmatch-11.0.1.gh.tar.gz 150081 BLAKE2B c80a055c02d0fc671fae4ef7dd291c8e58bdf91a446394a22c845a6b5c0ad9842874631f0e446b7e407d34e61a938c9e18e6925b459205b85e93bed00d42fd9d SHA512 72ae74717212fd9d1cc8c726c6e07f6b2aa88fc6c508d03a8f616dc902fe5b08d356454b392fbfb4bc626df25c55153be8ec1cd42cc345a532a4cf489ea412c3
 DIST wcmatch-11.1.gh.tar.gz 134230 BLAKE2B 8f87a7db63317b7e06cab2a0ef1192db4fec701ff0c3a759df0e7315dadded6575302ef66f1ec73202dc3a6d92cbac9186ede3286592101e3e36798ce5647667 SHA512 4729a2d1a70753e5bfe4183099a1fd052316b7249c1d69b55d776d87459d20fa01b4146d606e80afb52c3eb457d5d612409d1846cf2c56563306c7fc3530df0d
+DIST wcmatch-11.2.gh.tar.gz 139990 BLAKE2B 4635312c36ee79ed13e076f9f262bd7cfbe1166c69645d9f80f534f50313460c72c1f690b793d48578c55fe72faceb0feec7cf8a703096ce3815dbd7e8f53ca3 SHA512 475c8b652d1cf876ad4b0d13e2adef4742f1bcad072de22f000f08f6b8924dfe41fe24149e246501a0dc23da2c2b3807f66c8f90fe71216f1ee4d529906d5c74
diff --git a/dev-python/wcmatch/wcmatch-11.2.ebuild b/dev-python/wcmatch/wcmatch-11.2.ebuild
new file mode 100644
index 000000000000..7e487e22e2a9
--- /dev/null
+++ b/dev-python/wcmatch/wcmatch-11.2.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+DISTUTILS_USE_PEP517=hatchling
+
+inherit distutils-r1
+
+DESCRIPTION="Wildcard/glob file name matcher"
+HOMEPAGE="
+	https://github.com/facelessuser/wcmatch/
+	https://pypi.org/project/wcmatch/
+"
+SRC_URI="
+	https://github.com/facelessuser/wcmatch/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+
+RDEPEND="
+	>=dev-python/bracex-3.2[${PYTHON_USEDEP}]
+"
+
+BDEPEND="
+	test? (
+		dev-vcs/git
+	)
+"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+python_prepare_all() {
+	# tests require some files in homedir
+	> "${HOME}"/test1.txt || die
+	> "${HOME}"/test2.txt || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	# https://github.com/python/cpython/issues/155823
+	local -x PYTHON_JIT=0
+	epytest
+}
diff --git a/dev-python/xlsxwriter/Manifest b/dev-python/xlsxwriter/Manifest
index 0033b568b31e..e70c39c777c8 100644
--- a/dev-python/xlsxwriter/Manifest
+++ b/dev-python/xlsxwriter/Manifest
@@ -1 +1,2 @@
 DIST XlsxWriter-RELEASE_3.2.9.gh.tar.gz 24923295 BLAKE2B 7a344b5670b6264c8e7bb8fd633566e88b77368788edabd67f7ff6cfb66d28cfc2791e97ad367a3bf8d5e91e9c3f238e6656c87076779a3b21594af96891f2e8 SHA512 7cfcc6e4123a998c369fd352f2ef725ee2781f001d867a7b2c1c1cb6ede5852f9b33e4e2f237dcbe583e0c1ee0573bb068d2a0d39b1fd8fd21ac7192b36ac695
+DIST XlsxWriter-RELEASE_3.3.0.gh.tar.gz 25040885 BLAKE2B 0b170561a92c690795f501d37a72503a852d96a6c8cef5a3368d29d56a2662fd8704a5e510b18b9aa786717a1e2c81c6a159da3eed7881b287f69bd9c148da6b SHA512 9b80288e20471bf793cb24a3a3ef34a56e17210fb5dfa5c7b8b4e5c69fe0b2e41cbfc00f487899cc051f631fab8dac30986c4b038cc05e8ab290236df93dc434
diff --git a/dev-python/xlsxwriter/xlsxwriter-3.3.0.ebuild b/dev-python/xlsxwriter/xlsxwriter-3.3.0.ebuild
new file mode 100644
index 000000000000..fea7791b689e
--- /dev/null
+++ b/dev-python/xlsxwriter/xlsxwriter-3.3.0.ebuild
@@ -0,0 +1,29 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1
+
+TAG=RELEASE_${PV}
+MY_P=XlsxWriter-${TAG}
+DESCRIPTION="Python module for creating Excel XLSX files"
+HOMEPAGE="
+	https://github.com/jmcnamara/XlsxWriter/
+	https://pypi.org/project/xlsxwriter/
+"
+SRC_URI="
+	https://github.com/jmcnamara/XlsxWriter/archive/${TAG}.tar.gz
+		-> ${MY_P}.gh.tar.gz
+"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
diff --git a/dev-python/zipp/Manifest b/dev-python/zipp/Manifest
index 6d8c477ad6f7..35a4899f97dd 100644
--- a/dev-python/zipp/Manifest
+++ b/dev-python/zipp/Manifest
@@ -1,2 +1,3 @@
 DIST zipp-4.1.0.tar.gz 26214 BLAKE2B 8ef46c33c39adb1894599278307bfea4c1b9fbede22bff698585185fe3bc814a5460502896f8cdb38beb99d37a83e881cdded0db8686d0a25e4fccdb56bb4bbe SHA512 1648ee2581e958ff11472357784b34111f86fd2c2281bb35ca8122f238c721c5a1e54332ffe1fb03208dfee2706adb39ede5389b2d3612c9134f3662bef54ffa
 DIST zipp-4.1.1.tar.gz 27649 BLAKE2B af88a8dc9dfdbc94c08316ad25d07ca964ed47d9d69900e1dd380abfa81a4bfe755cc9909f5f027bc090522c62e4768dbd4cbc7c202bca8f252479b5048627ee SHA512 218a1c11f143bb581c396d4652f46680cce04098440ba202599a8953f2bc5ffbaecaba97048c62fd34d1ed55fe9490859c22ad091107e79cbebf23ac1a12729b
+DIST zipp-4.1.2.tar.gz 27864 BLAKE2B a54f6737aaefd1f9e8651a3d051c00d301563e5f51610e6101c4061f18f4db8fa30c505918a90c4df9be51264807065ae741397be914b68c7ea126bd8949116b SHA512 8c4e21bd4547aef94d0a7fe3d85df6fb36b66a6ae162674565b7d209b563ce3eeb5bcd5fdeacb864faab91c49b39a7526d57bf68982c74a87b360eaea7d1b028
diff --git a/dev-python/zipp/zipp-4.1.2.ebuild b/dev-python/zipp/zipp-4.1.2.ebuild
new file mode 100644
index 000000000000..de79dbca9cea
--- /dev/null
+++ b/dev-python/zipp/zipp-4.1.2.ebuild
@@ -0,0 +1,54 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit-core
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Backport of pathlib-compatible object wrapper for zip files"
+HOMEPAGE="
+	https://github.com/jaraco/zipp/
+	https://pypi.org/project/zipp/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~x64-solaris"
+
+# big_o is only used in test_complexity, that we ignore
+BDEPEND="
+	test? (
+		dev-python/jaraco-functools[${PYTHON_USEDEP}]
+		dev-python/jaraco-itertools[${PYTHON_USEDEP}]
+		dev-python/jaraco-test[${PYTHON_USEDEP}]
+		dev-python/more-itertools[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest
+
+EPYTEST_IGNORE=(
+	# performance tests are flaky by design
+	tests/test_complexity.py
+)
+
+src_configure() {
+	grep -q 'build-backend = "setuptools' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "zipp"
+		version = "${PV}"
+		description = "Backport of pathlib-compatible object wrapper for zip files"
+	EOF
+}
diff --git a/dev-util/bpftool/Manifest b/dev-util/bpftool/Manifest
index a639c1b28c1f..5b9a38d99385 100644
--- a/dev-util/bpftool/Manifest
+++ b/dev-util/bpftool/Manifest
@@ -1,2 +1,3 @@
 DIST bpftool-libbpf-v7.6.0-sources.tar.gz 1527883 BLAKE2B 5918519009b1ee258c33506cb52d216b08fbcd6365083a71d74b11e2c788fd4c6f7cfd78c84bb85074eb463dfa8d087b8e35c79d00f3a0810979640af6b334e6 SHA512 d443601227acd9a0db15896da186b0a47d426c44f2b6eaa822391594aa23d617a94ee94f284abb841529d41ef7c585a1087dd5ab1708ce068cc02b3c08b0a51b
 DIST bpftool-libbpf-v7.7.0-sources.tar.gz 1553943 BLAKE2B db13d16f12af61d97312dd821088e81062d3bbc6d954e0d463026bb99e6acdca4a232db26a1b735d70bd91cd954fd628e0a699517d4b1b38838ad3ac5aa82721 SHA512 d74b3ace03981791e08ac50d6b977a27de67bfd5e088e0ecb424eaebb58c30b85ef306f51d0e9244666511b430606b1ed52382d360348da40787c0045b6c8f43
+DIST bpftool-libbpf-v7.8.1-sources.tar.gz 1594958 BLAKE2B 9717db9c8de3e4c4c9b8a5ab373e6bc14cb7710b045e900cce4d58862aec83e79ef3f9fd7efe575cfb694e33d100b0935c00767320c5322b59889a2b4cea99bc SHA512 8e13487a70ea5a7da7b697a95e4bb6b7d02954d19d37a7ce1d499ae75eca266557095ed5dabf27cbbe184771e451c7f707ba054b5ad383854fc999dc79c34fc9
diff --git a/dev-util/bpftool/bpftool-7.8.1.ebuild b/dev-util/bpftool/bpftool-7.8.1.ebuild
new file mode 100644
index 000000000000..47eb44cb9907
--- /dev/null
+++ b/dev-util/bpftool/bpftool-7.8.1.ebuild
@@ -0,0 +1,166 @@
+# Copyright 2021-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( {17..23} )
+LLVM_OPTIONAL=1
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit flag-o-matic linux-info llvm-r2 python-any-r1 shell-completion toolchain-funcs
+
+DESCRIPTION="Tool for inspection and simple manipulation of eBPF programs and maps"
+HOMEPAGE="https://github.com/libbpf/bpftool"
+
+if [[ ${PV} == *9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/libbpf/bpftool.git"
+	EGIT_SUBMODULES=(libbpf)
+else
+	# bpftool typically vendors whatever libbpf is current at the time
+	# of a release, while libbpf publishes minor updates more frequently.
+	# Uncomment the following to bundle an updated libbpf e.g. in case of
+	# security or crasher bugs in libbpf and to keep the two synchronized.
+	# This allows us to quickly update the vendored lib with a revbump.
+	# Currently bpftool-x.y vendors libbpf-1.y; DO NOT mix different y versions.
+	# See the libbpf repo (https://github.com/libbpf/libbpf) for possible updates.
+	# LIBBPF_VERSION=1.7.0
+
+	if [[ ! -z ${LIBBPF_VERSION} ]] ; then
+		SRC_URI="https://github.com/libbpf/bpftool/archive/refs/tags/v${PV}.tar.gz -> bpftool-${PV}.tar.gz
+			https://github.com/libbpf/libbpf/archive/refs/tags/v${LIBBPF_VERSION}.tar.gz
+			  -> libbpf-${LIBBPF_VERSION}.tar.gz"
+	else
+		# use tarball with bundled libbpf
+		SRC_URI="https://github.com/libbpf/bpftool/releases/download/v${PV}/bpftool-libbpf-v${PV}-sources.tar.gz"
+		S="${WORKDIR}/bpftool-libbpf-v${PV}-sources"
+	fi
+
+	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+LICENSE="|| ( GPL-2 BSD-2 )"
+SLOT="0"
+IUSE="caps +clang llvm"
+REQUIRED_USE="llvm? ( ${LLVM_REQUIRED_USE} )"
+
+RDEPEND="
+	caps? ( sys-libs/libcap:= )
+	llvm? ( $(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}') )
+	!llvm? ( sys-libs/binutils-libs:= )
+	virtual/zlib:=
+	virtual/libelf:=
+"
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-5.8
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	app-arch/tar
+	dev-python/docutils
+	clang? ( $(llvm_gen_dep 'llvm-core/clang:${LLVM_SLOT}[llvm_targets_BPF]') )
+	!clang? ( sys-devel/bpf-toolchain )
+"
+
+CONFIG_CHECK="~DEBUG_INFO_BTF"
+
+pkg_setup() {
+	linux-info_pkg_setup
+	python-any-r1_pkg_setup
+	use llvm && llvm-r2_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# prepare libbpf if necessary
+	if [[ ! -z ${LIBBPF_VERSION} ]] ; then
+		rm -rf libbpf || die
+		ln -s "${WORKDIR}/libbpf-${LIBBPF_VERSION}" libbpf || die
+	fi
+
+	# remove -Werror from libbpf (bug 887981)
+	sed -i -e 's/\-Werror//g' libbpf/src/Makefile || die
+
+	# remove -Werror from bpftool feature detection
+	sed -i -e 's/-Werror//g' src/Makefile.feature || die
+
+	# remove hardcoded/unhelpful flags from bpftool
+	sed -e '/CFLAGS += -O2$/d' \
+		-e '/CFLAGS += -W$/d' \
+		-e '/CFLAGS += -Wextra$/d' \
+		-i src/Makefile || die
+
+	# always build bpf bits with std=gnu11 for kernel compatibility (bug 955156)
+	sed -i 's/-fno-stack-protector/& -std=gnu11/g' src/Makefile || die
+
+	if ! use clang; then
+		# make people aware of what they are doing
+		ewarn "Using bpf-toolchain instead of clang due to USE=-clang."
+		ewarn "Please report any odd behaviours you observe, since using gcc for BPF"
+		ewarn "is still under development in both the Linux kernel and gcc itself."
+
+		# prevent attribute warning about preserve_access_index
+		# since gcc does not support '#pragma clang attribute push':
+		# https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=675b4e2
+		sed -i 's/std=gnu11/& -DBPF_NO_PRESERVE_ACCESS_INDEX/g' src/Makefile || die
+
+		# remove bpf target & add assembly annotations to fix CO-RE feature detection
+		sed -i -e 's/-target bpf/-dA/' src/Makefile.feature || die
+
+		# remove bpf target from skeleton build
+		sed -i -e 's/--target=bpf//g' src/Makefile || die
+	fi
+
+	# Use rst2man or rst2man.py depending on which one exists (#930076)
+	type -P rst2man >/dev/null || sed -i -e 's/rst2man/rst2man.py/g' docs/Makefile || die
+}
+
+src_configure() {
+	# filter LTO after discussion about UB in libbpf:
+	# https://lore.kernel.org/bpf/20260321024446.692008-1-irogers@google.com/
+	filter-lto
+
+	default
+}
+
+bpftool_make() {
+	# which BPF compiler should we use?
+	if use clang; then
+		export CLANG="$(get_llvm_prefix -b)/bin/clang"
+		export LLVM_STRIP="$(get_llvm_prefix -b)/bin/llvm-strip"
+	else
+		# use bpf-toolchain
+		export CLANG="bpf-unknown-none-gcc"
+		export LLVM_STRIP="bpf-unknown-none-strip"
+	fi
+
+	tc-export AR CC LD
+
+	# add EXTRA_CFLAGS to be consistent with our libbpf ebuild
+	local extra_cflags="-fno-strict-aliasing"
+
+	emake \
+		ARCH="$(tc-arch-kernel)" \
+		EXTRA_CFLAGS="${extra_cflags}" \
+		HOSTAR="$(tc-getBUILD_AR)" \
+		HOSTCC="$(tc-getBUILD_CC)" \
+		HOSTLD="$(tc-getBUILD_LD)" \
+		bash_compdir="$(get_bashcompdir)" \
+		feature-libcap="$(usex caps 1 0)" \
+		feature-llvm="$(usex llvm 1 0)" \
+		prefix="${EPREFIX}"/usr \
+		V=1 \
+		"$@"
+}
+
+src_compile() {
+	bpftool_make -C src
+	bpftool_make -C docs
+}
+
+src_install() {
+	bpftool_make DESTDIR="${D}" -C src install
+	bpftool_make mandir="${ED}"/usr/share/man -C docs install
+}
diff --git a/eclass/nginx.eclass b/eclass/nginx.eclass
index d517c15ef727..80d3a5bc965f 100644
--- a/eclass/nginx.eclass
+++ b/eclass/nginx.eclass
@@ -436,6 +436,11 @@ _ngx_set_mod_depend() {
 		[stream_geoip]="dev-libs/geoip"
 		[stream_ssl]="dev-libs/openssl:="
 	)
+	if ver_test -ge "1.31.7-r1" && ver_test -lt "1.31.100"; then
+		# Bug 984654.
+		COMMON_DEPEND[http_geoip]+=" dev-libs/libmaxminddb:="
+		COMMON_DEPEND[stream_geoip]+=" dev-libs/libmaxminddb:="
+	fi
 	local COMMON_DEPEND_DEF
 	# Bash does not have an easy way to copy an associative array, so its value
 	# is obtained using the 'declare' builtin.
diff --git a/gui-apps/wf-kill/files/killtopview.patch b/gui-apps/wf-kill/files/killtopview.patch
new file mode 100644
index 000000000000..f653351524f9
--- /dev/null
+++ b/gui-apps/wf-kill/files/killtopview.patch
@@ -0,0 +1,162 @@
+diff --git a/proto/wayfire-kill-view.xml b/proto/wayfire-kill-view.xml
+index 4fe0c56..8274569 100644
+--- a/proto/wayfire-kill-view.xml
++++ b/proto/wayfire-kill-view.xml
+@@ -36,6 +36,12 @@
+       </description>
+     </request>
+ 
++    <request name="top_view_kill">
++      <description summary="send close to the top view">
++	Send close to the top view.
++      </description>
++    </request>
++
+     <event name="view_pid">
+       <description summary="Send view pid to a client">
+ 	Provide client with a view pid.
+diff --git a/src/client/wf-kill.cpp b/src/client/wf-kill.cpp
+index 762b7cf..cb7a0eb 100644
+--- a/src/client/wf-kill.cpp
++++ b/src/client/wf-kill.cpp
+@@ -27,6 +27,7 @@
+ #include <string.h>
+ #include <sys/types.h>
+ #include <signal.h>
++#include <getopt.h>
+ 
+ #include "wf-kill.hpp"
+ 
+@@ -113,11 +114,43 @@ WfKill::WfKill(int argc, char *argv[])
+         std::cout << "Wayfire kill view protocol not advertised by compositor. Is wf-kill plugin enabled?" << std::endl;
+         return;
+     }
+-    wf_kill_view_base_view_kill(wf_kill_view_manager);
+     wf_kill_view_base_add_listener(wf_kill_view_manager,
+         &kill_view_listener, this);
+ 
+-    send_kill = (argc > 1 && !strcmp(argv[1], "-k"));
++    send_kill = false;
++    top_view = false;
++    struct option opts[] = {
++        { "kill-view",         no_argument, NULL, 'k' },
++        { "top-view",          no_argument, NULL, 't' },
++        { 0,             0,                 NULL,  0  }
++    };
++
++    int c, i;
++    while((c = getopt_long(argc, argv, "kt", opts, &i)) != -1)
++    {
++        switch(c)
++        {
++            case 'k':
++                send_kill = true;
++                break;
++
++            case 't':
++                top_view = true;
++                break;
++
++            default:
++                printf("Unsupported command line argument %s\n", optarg);
++                return;
++        }
++    }
++    if (top_view)
++    {
++        wf_kill_view_base_top_view_kill(wf_kill_view_manager);
++    } else
++    {
++        wf_kill_view_base_view_kill(wf_kill_view_manager);
++    }
++
+     running = 1;
+     while(running)
+         wl_display_dispatch(display);
+diff --git a/src/client/wf-kill.hpp b/src/client/wf-kill.hpp
+index 6065675..9b85064 100644
+--- a/src/client/wf-kill.hpp
++++ b/src/client/wf-kill.hpp
+@@ -35,6 +35,7 @@ class WfKill
+ 
+     int running;
+     int send_kill;
++    int top_view;
+     wl_display *display;
+     wf_kill_view_base *wf_kill_view_manager;
+ };
+diff --git a/src/plugin/wayfire-kill-view.cpp b/src/plugin/wayfire-kill-view.cpp
+index a18e5cd..73f078b 100644
+--- a/src/plugin/wayfire-kill-view.cpp
++++ b/src/plugin/wayfire-kill-view.cpp
+@@ -38,13 +38,8 @@
+ static void bind_manager(wl_client *client, void *data,
+     uint32_t version, uint32_t id);
+ 
+-void wf_kill_view::send_view_info()
++static pid_t get_pid_for_view(wayfire_view view)
+ {
+-    wayfire_view view = wf::get_core().get_cursor_focus_view();
+-    if (!view)
+-    {
+-        return;
+-    }
+     pid_t pid = 0;
+     wlr_surface *wlr_surface = view->get_wlr_surface();
+ #if WF_HAS_XWAYLAND
+@@ -58,6 +53,18 @@ void wf_kill_view::send_view_info()
+         wl_client_get_credentials(view->get_client(), &pid, 0, 0);
+     }
+ 
++    return pid;
++}
++
++void wf_kill_view::send_view_info()
++{
++    wayfire_view view = wf::get_core().get_cursor_focus_view();
++    if (!view)
++    {
++        return;
++    }
++    pid_t pid = get_pid_for_view(view);
++
+     view->close();
+ 
+     for (auto r : client_resources)
+@@ -68,7 +75,6 @@ void wf_kill_view::send_view_info()
+ 
+ void wf_kill_view::send_cancel()
+ {
+-
+     for (auto r : client_resources)
+     {
+         wf_kill_view_base_send_cancel(r);
+@@ -157,9 +163,28 @@ static void view_kill(struct wl_client *client, struct wl_resource *resource)
+     }
+ }
+ 
++static void top_view_kill(struct wl_client *client, struct wl_resource *resource)
++{
++    wf_kill_view *wd = (wf_kill_view*)wl_resource_get_user_data(resource);
++    auto view = wf::get_core().get_active_output()->get_active_view();
++    if (!view)
++    {
++        return;
++    }
++    pid_t pid = get_pid_for_view(view);
++
++    view->close();
++
++    for (auto r : wd->client_resources)
++    {
++        wf_kill_view_base_send_view_pid(r, pid);
++    }
++}
++
+ static const struct wf_kill_view_base_interface wf_kill_view_impl =
+ {
+     .view_kill = view_kill,
++    .top_view_kill = top_view_kill,
+ };
+ 
+ static void destroy_client(wl_resource *resource)
diff --git a/gui-apps/wf-kill/files/wf-kill-lifetime.patch b/gui-apps/wf-kill/files/wf-kill-lifetime.patch
new file mode 100644
index 000000000000..df2b99c7d0d8
--- /dev/null
+++ b/gui-apps/wf-kill/files/wf-kill-lifetime.patch
@@ -0,0 +1,120 @@
+--- a/src/plugin/wayfire-kill-view.cpp
++++ b/src/plugin/wayfire-kill-view.cpp
+@@ -25,12 +25,14 @@
+ 
+ #include <sys/time.h>
+ #include <wayfire/core.hpp>
++#include <wayfire/seat.hpp>
+ #include <wayfire/view.hpp>
+ #include <wayfire/plugin.hpp>
+ #include <wayfire/output.hpp>
+ #include <wayfire/output-layout.hpp>
+ #include <wayfire/nonstd/wlroots-full.hpp>
+ #include <linux/input-event-codes.h>
++#include <algorithm>
+ 
+ #include "wayfire-kill-view.hpp"
+ #include "wayfire-kill-view-server-protocol.h"
+@@ -87,13 +89,28 @@
+ 
+ void wf_kill_view::deactivate(uint32_t b)
+ {
+-    for (auto& o : wf::get_core().output_layout->get_outputs())
++    /* Iterate the grabs actually created, not the current output set: an output
++     * hotplugged after the grab started has no entry, and input_grabs[o] would
++     * default-insert a null unique_ptr and then deref it. Only drive
++     * deactivate/ungrab for outputs that still exist; a grab belonging to an
++     * output removed mid-kill is simply dropped. */
++    auto outputs = wf::get_core().output_layout->get_outputs();
++    for (auto& [o, grab] : input_grabs)
+     {
+-        o->deactivate_plugin(&grab_interface);
+-        input_grabs[o]->ungrab_input();
+-        input_grabs[o].reset();
++        if (!grab)
++        {
++            continue;
++        }
++
++        if (std::find(outputs.begin(), outputs.end(), o) != outputs.end())
++        {
++            o->deactivate_plugin(&grab_interface);
++            grab->ungrab_input();
++        }
+     }
+ 
++    input_grabs.clear();
++
+     idle_set_cursor.run_once([=] ()
+     {
+         if (b == BTN_LEFT)
+@@ -131,17 +148,39 @@
+ 
+ wf_kill_view::~wf_kill_view()
+ {
+-    wl_global_destroy(manager);
++    /* Detach every bound client resource before this plugin is freed. Destroying
++     * the global only stops new binds; existing resources keep user_data pointing
++     * at the freed plugin, so a later request or disconnect would be a UAF. After
++     * this, view_kill/top_view_kill/destroy_client see a null user_data and no-op. */
++    for (auto r : client_resources)
++    {
++        if (r)
++        {
++            wl_resource_set_user_data(r, nullptr);
++        }
++    }
++    client_resources.clear();
+ 
+-    for (auto& o : wf::get_core().output_layout->get_outputs())
++    if (manager)
+     {
+-        input_grabs[o].reset();
++        wl_global_destroy(manager);
+     }
++
++    for (auto& [o, grab] : input_grabs)
++    {
++        (void)o;
++        grab.reset();
++    }
++    input_grabs.clear();
+ }
+ 
+ static void view_kill(struct wl_client *client, struct wl_resource *resource)
+ {
+     wf_kill_view *wd = (wf_kill_view*)wl_resource_get_user_data(resource);
++    if (!wd)
++    {
++        return;
++    }
+ 
+     bool set_cursor = false;
+     for (auto& o : wf::get_core().output_layout->get_outputs())
+@@ -170,7 +209,14 @@
+ static void top_view_kill(struct wl_client *client, struct wl_resource *resource)
+ {
+     wf_kill_view *wd = (wf_kill_view*)wl_resource_get_user_data(resource);
+-    auto view = wf::get_core().get_active_output()->get_active_view();
++    if (!wd)
++    {
++        return;
++    }
++
++    /* get_active_output() moved off compositor_core_t onto the seat; the active
++     * view of the active output is now reachable directly as seat->get_active_view(). */
++    auto view = wf::get_core().seat->get_active_view();
+     if (!view)
+     {
+         return;
+@@ -194,6 +240,10 @@
+ static void destroy_client(wl_resource *resource)
+ {
+     wf_kill_view *wd = (wf_kill_view*)wl_resource_get_user_data(resource);
++    if (!wd)
++    {
++        return;
++    }
+ 
+     for (auto& r : wd->client_resources)
+     {
diff --git a/gui-apps/wf-kill/wf-kill-9999.ebuild b/gui-apps/wf-kill/wf-kill-9999.ebuild
index b3ca1a20d747..109a3bb96203 100644
--- a/gui-apps/wf-kill/wf-kill-9999.ebuild
+++ b/gui-apps/wf-kill/wf-kill-9999.ebuild
@@ -23,4 +23,5 @@ RDEPEND="${DEPEND}"
 
 PATCHES=(
         "${FILESDIR}/killtopview.patch"
+        "${FILESDIR}/wf-kill-lifetime.patch"
 )
diff --git a/gui-libs/pixdecor/files/pixdecor-render-hook-tracking.patch b/gui-libs/pixdecor/files/pixdecor-render-hook-tracking.patch
new file mode 100644
index 000000000000..867bfe8105b5
--- /dev/null
+++ b/gui-libs/pixdecor/files/pixdecor-render-hook-tracking.patch
@@ -0,0 +1,130 @@
+--- a/src/decoration.cpp
++++ b/src/decoration.cpp
+@@ -24,6 +24,7 @@
+ #include <wayfire/plugins/ipc/ipc-method-repository.hpp>
+ #include <wayfire/util.hpp>
+ #include <chrono>
++#include <set>
+ #include "shell-theme.hpp"
+ 
+ namespace wf
+@@ -92,7 +93,31 @@
+     wf::wl_idle_call idle_update_views;
+     std::function<void(void)> update_event;
+     wf::effect_hook_t pre_hook;
+-    bool hook_set = false;
++    /* Outputs that currently have pre_hook registered, tracked per-output so
++     * hotplug and option changes cannot desync a single global flag. */
++    std::set<wf::output_t*> hook_outputs;
++
++    bool effect_needs_hook()
++    {
++        return effect_animate || (std::string(effect_type) == "smoke") ||
++            (std::string(effect_type) == "ink");
++    }
++
++    void add_pre_hook(wf::output_t *o)
++    {
++        if (hook_outputs.insert(o).second)
++        {
++            o->render->add_effect(&pre_hook, wf::OUTPUT_EFFECT_PRE);
++        }
++    }
++
++    void remove_pre_hook(wf::output_t *o)
++    {
++        if (hook_outputs.erase(o))
++        {
++            o->render->rem_effect(&pre_hook);
++        }
++    }
+ 
+     wf::axis_callback shade_axis_cb;
+ 
+@@ -170,16 +195,16 @@
+     wf::signal::connection_t<wf::output_added_signal> on_output_added =
+         [=] (wf::output_added_signal *ev)
+     {
+-        if (effect_animate || (std::string(effect_type) == "smoke") || (std::string(effect_type) == "ink"))
++        if (effect_needs_hook())
+         {
+-            ev->output->render->add_effect(&pre_hook, wf::OUTPUT_EFFECT_PRE);
++            add_pre_hook(ev->output);
+         }
+     };
+ 
+     wf::signal::connection_t<wf::output_removed_signal> on_output_removed =
+         [=] (wf::output_removed_signal *ev)
+     {
+-        ev->output->render->rem_effect(&pre_hook);
++        remove_pre_hook(ev->output);
+     };
+ 
+     void pop_transformer(wayfire_view view)
+@@ -473,14 +498,12 @@
+             }
+         };
+ 
+-        if (std::string(effect_type) != "none")
++        if (effect_needs_hook())
+         {
+             for (auto& o : wf::get_core().output_layout->get_outputs())
+             {
+-                o->render->add_effect(&pre_hook, wf::OUTPUT_EFFECT_PRE);
++                add_pre_hook(o);
+             }
+-
+-            hook_set = true;
+         }
+ 
+         titlebar.set_callback([=] {recreate_frames();});
+@@ -630,13 +653,11 @@
+             }
+         }
+ 
+-        if (hook_set)
++        for (auto& o : wf::get_core().output_layout->get_outputs())
+         {
+-            for (auto& o : wf::get_core().output_layout->get_outputs())
+-            {
+-                o->render->rem_effect(&pre_hook);
+-            }
++            remove_pre_hook(o);
+         }
++        hook_outputs.clear();
+ 
+         on_output_added.disconnect();
+         on_output_removed.disconnect();
+@@ -676,27 +697,17 @@
+ 
+     void option_changed_cb(bool resize_decorations, bool recreate_decorations)
+     {
+-        if (effect_animate || (std::string(effect_type) == "smoke") || (std::string(effect_type) == "ink"))
++        if (effect_needs_hook())
+         {
+-            if (!hook_set)
++            for (auto& o : wf::get_core().output_layout->get_outputs())
+             {
+-                for (auto& o : wf::get_core().output_layout->get_outputs())
+-                {
+-                    o->render->add_effect(&pre_hook, wf::OUTPUT_EFFECT_PRE);
+-                }
+-
+-                hook_set = true;
++                add_pre_hook(o);
+             }
+         } else
+         {
+-            if (hook_set)
++            for (auto& o : wf::get_core().output_layout->get_outputs())
+             {
+-                for (auto& o : wf::get_core().output_layout->get_outputs())
+-                {
+-                    o->render->rem_effect(&pre_hook);
+-                }
+-
+-                hook_set = false;
++                remove_pre_hook(o);
+             }
+         }
+ 
diff --git a/gui-libs/pixdecor/files/pixdecor-shade-deco-lifetime.patch b/gui-libs/pixdecor/files/pixdecor-shade-deco-lifetime.patch
new file mode 100644
index 000000000000..cd98d36c431b
--- /dev/null
+++ b/gui-libs/pixdecor/files/pixdecor-shade-deco-lifetime.patch
@@ -0,0 +1,18 @@
+--- a/src/shade.hpp
++++ b/src/shade.hpp
+@@ -167,10 +167,13 @@
+     {
+         if (auto toplevel = wf::toplevel_cast(view))
+         {
+-            if (deco)
++            /* Re-resolve the decorator each frame: a cached observer_ptr dangles
++             * if the decoration is removed/recreated while the shade runs. */
++            auto live_deco = toplevel->toplevel()->get_data<simple_decorator_t>();
++            if (live_deco)
+             {
+                 /* SSD */
+-                deco->get_margins(toplevel->toplevel()->pending());
++                live_deco->get_margins(toplevel->toplevel()->pending());
+             } else
+             {
+                 /* CSD */
diff --git a/gui-libs/pixdecor/files/pixdecor-shade-output-lifetime.patch b/gui-libs/pixdecor/files/pixdecor-shade-output-lifetime.patch
new file mode 100644
index 000000000000..0ae4bd78f0b0
--- /dev/null
+++ b/gui-libs/pixdecor/files/pixdecor-shade-output-lifetime.patch
@@ -0,0 +1,122 @@
+--- a/src/shade.hpp
++++ b/src/shade.hpp
+@@ -4,6 +4,7 @@
+ #include <cmath>
+ 
+ #include <wayfire/output.hpp>
++#include <wayfire/output-layout.hpp>
+ #include <wayfire/opengl.hpp>
+ #include <wayfire/core.hpp>
+ #include <wayfire/view-transform.hpp>
+@@ -34,7 +35,11 @@
+ {
+     nonstd::observer_ptr<simple_decorator_t> deco = nullptr;
+     wayfire_view view;
+-    wf::output_t *output;
++    /* The output that currently holds pre_hook. Re-resolved from the view and
++     * migrated when the view changes output, and detached (while the output is
++     * still alive) when that output is removed, so a cached pointer can never
++     * dangle into a rem_effect() use-after-free. */
++    wf::output_t *hook_output = nullptr;
+     int titlebar_height;
+     wf::option_wrapper_t<wf::animation_description_t> shade_duration{"pixdecor/shade_duration"};
+ 
+@@ -136,13 +141,10 @@
+     pixdecor_shade(wayfire_view view, int titlebar_height) : wf::scene::view_2d_transformer_t(view)
+     {
+         this->view   = view;
+-        this->output = view->get_output();
+         this->titlebar_height = titlebar_height;
+         this->progression.shade.set(0.0, 1.0);
+-        if (output)
+-        {
+-            output->render->add_effect(&pre_hook, wf::OUTPUT_EFFECT_PRE);
+-        }
++        set_hook_output(view->get_output());
++        wf::get_core().output_layout->connect(&on_output_removed);
+ 
+         if (auto toplevel = wf::toplevel_cast(view))
+         {
+@@ -163,8 +165,55 @@
+         }
+     }
+ 
++    /* Move pre_hook onto output o (which may be null), removing it from whatever
++     * output currently holds it. All add/rem of pre_hook goes through here so the
++     * tracked output stays in sync and is only ever a live pointer. */
++    void set_hook_output(wf::output_t *o)
++    {
++        if (hook_output == o)
++        {
++            return;
++        }
++
++        if (hook_output)
++        {
++            hook_output->render->rem_effect(&pre_hook);
++        }
++
++        hook_output = o;
++        if (hook_output)
++        {
++            hook_output->render->add_effect(&pre_hook, wf::OUTPUT_EFFECT_PRE);
++        }
++    }
++
++    wf::signal::connection_t<wf::output_removed_signal> on_output_removed =
++        [=] (wf::output_removed_signal *ev)
++    {
++        if (ev->output != hook_output)
++        {
++            return;
++        }
++
++        /* Detach while the output is still alive, then re-home onto the view's
++         * current output if it has already migrated, so the animation can finish
++         * instead of leaving a stale hook (or dangling pointer) behind. */
++        hook_output->render->rem_effect(&pre_hook);
++        hook_output = nullptr;
++        if (auto o = view ? view->get_output() : nullptr; o && (o != ev->output))
++        {
++            set_hook_output(o);
++        }
++    };
++
+     wf::effect_hook_t pre_hook = [=] ()
+     {
++        /* Follow the view if it has moved to another output since last frame. */
++        if (view && view->get_output() && (view->get_output() != hook_output))
++        {
++            set_hook_output(view->get_output());
++        }
++
+         if (auto toplevel = wf::toplevel_cast(view))
+         {
+             /* Re-resolve the decorator each frame: a cached observer_ptr dangles
+@@ -202,11 +251,7 @@
+         view->damage();
+         if (!this->progression.running() && !last_direction)
+         {
+-            if (output)
+-            {
+-                output->render->rem_effect(&pre_hook);
+-            }
+-
++            set_hook_output(nullptr);
+             pop_transformer(view);
+         }
+     };
+@@ -282,10 +327,9 @@
+ 
+     virtual ~pixdecor_shade()
+     {
+-        if (output)
+-        {
+-            output->render->rem_effect(&pre_hook);
+-        }
++        /* hook_output is kept valid (nulled when its output is removed), so this
++         * detaches cleanly instead of dereferencing a freed output. */
++        set_hook_output(nullptr);
+     }
+ };
+ }
diff --git a/gui-libs/pixdecor/pixdecor-9999-r4.ebuild b/gui-libs/pixdecor/pixdecor-9999-r4.ebuild
new file mode 100644
index 000000000000..f4e4c2471ce1
--- /dev/null
+++ b/gui-libs/pixdecor/pixdecor-9999-r4.ebuild
@@ -0,0 +1,63 @@
+# Copyright 2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit git-r3 meson
+
+DESCRIPTION="Wayfire decorator with rounded corners, shadows, and animated effects"
+HOMEPAGE="https://github.com/soreau/pixdecor"
+EGIT_REPO_URI="https://github.com/soreau/pixdecor.git"
+EGIT_BRANCH="master"
+# Keep the downstream patches reproducible until they are promoted upstream.
+EGIT_COMMIT="222e61d971b045a821cf212a6e221367c05d966b"
+
+PATCHES=(
+    "${FILESDIR}/${PN}-sculpted-frames.patch"
+    "${FILESDIR}/${PN}-shell-theme.patch"
+    "${FILESDIR}/${PN}-shade-input.patch"
+    "${FILESDIR}/${PN}-render-hook-tracking.patch"
+    "${FILESDIR}/${PN}-shade-deco-lifetime.patch"
+    "${FILESDIR}/${PN}-shade-output-lifetime.patch"
+)
+
+LICENSE="MIT"
+SLOT="0"
+# Upstream has no test suite.
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/glib:2
+	dev-libs/wayland
+	gui-libs/wf-config:=
+	gui-libs/wlroots:0.20=
+	>=gui-wm/wayfire-0.11.0:=[gles3]
+	media-libs/libglvnd
+	x11-libs/cairo
+	x11-libs/pango
+	x11-libs/pixman
+"
+DEPEND="
+	${RDEPEND}
+	media-libs/glm
+	sys-kernel/linux-headers
+"
+BDEPEND="
+	sys-devel/gettext
+	virtual/pkgconfig
+"
+
+src_install() {
+    meson_src_install
+    exeinto "/usr/$(get_libdir)/wayfire/pixdecor-shell-r4"
+    doexe "${BUILD_DIR}/src/libpixdecor.so"
+    dodoc README.md
+}
+
+pkg_postinst() {
+	elog "Add pixdecor to the plugins list in the [core] section of wayfire.ini."
+	elog "Disable other decoration plugins; Pixdecor owns window frames."
+	elog "Frame settings are in WCM -> Pix Decoration -> Window frames."
+	elog "Sculpted adds border depth and pinstripe color/opacity."
+	elog "This revision installs to pixdecor-shell-r4; point wayfire.ini at it."
+}
diff --git a/gui-libs/wayfire-plugins-extra/files/wayfire-plugins-extra-0.11.2-join-views-multi-view.patch b/gui-libs/wayfire-plugins-extra/files/wayfire-plugins-extra-0.11.2-join-views-multi-view.patch
new file mode 100644
index 000000000000..9689ad1ab60a
--- /dev/null
+++ b/gui-libs/wayfire-plugins-extra/files/wayfire-plugins-extra-0.11.2-join-views-multi-view.patch
@@ -0,0 +1,89 @@
+--- a/src/join-views.cpp
++++ b/src/join-views.cpp
+@@ -1,3 +1,5 @@
++#include <map>
++#include <memory>
+ #include <wayfire/signal-definitions.hpp>
+ #include <wayfire/per-output-plugin.hpp>
+ #include <wayfire/plugins/common/shared-core-data.hpp>
+@@ -5,41 +7,62 @@
+ 
+ class JoinViewsSingleton
+ {
++    /* One geometry-changed connection per mapped view, so every parent keeps
++     * positioning its children -- not just the most recently mapped view. */
++    using geometry_conn_t = wf::signal::connection_t<wf::view_geometry_changed_signal>;
++    std::map<wf::view_interface_t*, std::shared_ptr<geometry_conn_t>> geometry_conns;
++
++    void reposition_children(wayfire_toplevel_view view)
++    {
++        if (!view || !view->is_mapped())
++        {
++            return;
++        }
++
++        auto parent_geometry = view->get_pending_geometry();
++        int cx = parent_geometry.x + parent_geometry.width / 2;
++        int cy = parent_geometry.y + parent_geometry.height / 2;
++        for (auto child : view->children)
++        {
++            auto target = child->get_pending_geometry();
++            target.x = cx - target.width / 2;
++            target.y = cy - target.height / 2;
++            child->set_geometry(target);
++        }
++    }
++
+   public:
+-    wf::signal::connection_t<wf::view_geometry_changed_signal> on_geometry_changed{[=
+-        ] (wf::view_geometry_changed_signal *ev)
++    wf::signal::connection_t<wf::view_mapped_signal> on_view_map{[=] (wf::view_mapped_signal *ev)
+         {
+-            auto view = wf::toplevel_cast(ev->view);
+-            if (!view || !view->is_mapped())
++            auto view = ev->view;
++            if (!view || geometry_conns.count(view.get()))
+             {
+                 return;
+             }
+ 
+-            auto parent_geometry = view->get_pending_geometry();
+-            int cx = parent_geometry.x + parent_geometry.width / 2;
+-            int cy = parent_geometry.y + parent_geometry.height / 2;
+-            for (auto child : view->children)
++            auto conn = std::make_shared<geometry_conn_t>(
++                [=] (wf::view_geometry_changed_signal *gev)
+             {
+-                auto target = child->get_pending_geometry();
+-                target.x = cx - target.width / 2;
+-                target.y = cy - target.height / 2;
+-                child->set_geometry(target);
+-            }
++                reposition_children(gev->view);
++            });
++            view->connect(conn.get());
++            geometry_conns[view.get()] = conn;
+         }
+     };
+ 
+-    wf::signal::connection_t<wf::view_mapped_signal> on_view_map{[=] (wf::view_mapped_signal *ev)
++    wf::signal::connection_t<wf::view_unmapped_signal> on_view_unmap{[=] (wf::view_unmapped_signal *ev)
+         {
+-            auto view = ev->view;
+-            /* Make sure only a single connection is made */
+-            on_geometry_changed.disconnect();
+-            view->connect(&on_geometry_changed);
++            if (ev->view)
++            {
++                geometry_conns.erase(ev->view.get());
++            }
+         }
+     };
+ 
+     void handle_new_output(wf::output_t *output)
+     {
+         output->connect(&on_view_map);
++        output->connect(&on_view_unmap);
+     }
+ 
+     JoinViewsSingleton()
diff --git a/gui-libs/wayfire-plugins-extra/wayfire-plugins-extra-0.11.2-r4.ebuild b/gui-libs/wayfire-plugins-extra/wayfire-plugins-extra-0.11.2-r4.ebuild
new file mode 100644
index 000000000000..449b2a072ce3
--- /dev/null
+++ b/gui-libs/wayfire-plugins-extra/wayfire-plugins-extra-0.11.2-r4.ebuild
@@ -0,0 +1,65 @@
+# Copyright 2019-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit meson
+
+DESCRIPTION="extra plugins for wayfire"
+HOMEPAGE="https://github.com/WayfireWM/wayfire-plugins-extra"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/WayfireWM/wayfire-plugins-extra.git"
+	SLOT="0/0.12"
+else
+	SRC_URI="https://github.com/WayfireWM/wayfire-plugins-extra/releases/download/v${PV}/${P}.tar.xz"
+	KEYWORDS="~amd64 ~arm64"
+	SLOT="0/$(ver_cut 1-2)"
+fi
+
+LICENSE="MIT"
+
+# No upstream suite; private integration fixtures are in tests/force-fullscreen-hotplug.
+RESTRICT="test"
+
+WAYFIRE_REVDEP="
+	dev-libs/glib:2
+	dev-libs/libsigc++:2
+	gui-libs/wf-config:=
+	gui-libs/wlroots:0.20
+	x11-libs/cairo
+"
+
+DEPEND="
+	${WAYFIRE_REVDEP}
+	dev-cpp/glibmm:2
+	dev-libs/boost
+	dev-libs/libevdev
+	dev-libs/wayland
+	>=gui-wm/wayfire-0.11:=
+	media-libs/glm
+	media-libs/libglvnd
+"
+RDEPEND="${DEPEND}"
+BDEPEND="
+	>=dev-libs/wayland-protocols-1.12
+	dev-util/wayland-scanner
+	sys-devel/gettext
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}/wayfire-plugins-extra-0.11.0-workspace-focus.patch"
+	"${FILESDIR}/wayfire-plugins-extra-0.11.0-force-fullscreen-teardown.patch"
+	"${FILESDIR}/wayfire-plugins-extra-0.11.2-force-fullscreen-physical-scope.patch"
+	"${FILESDIR}/wayfire-plugins-extra-0.11.2-join-views-multi-view.patch"
+)
+
+src_install() {
+	meson_src_install
+
+	# A distinct library path permits replacement while the old plugin is cached.
+	exeinto "/usr/$(get_libdir)/wayfire/force-fullscreen-physical-r3"
+	doexe "${BUILD_DIR}/src/libforce-fullscreen.so"
+}
diff --git a/gui-wm/wayfire/files/wayfire-0.11.0-ipc-backpressure.patch b/gui-wm/wayfire/files/wayfire-0.11.0-ipc-backpressure.patch
new file mode 100644
index 000000000000..8d787b5590fa
--- /dev/null
+++ b/gui-wm/wayfire/files/wayfire-0.11.0-ipc-backpressure.patch
@@ -0,0 +1,166 @@
+--- a/plugins/ipc/ipc.hpp
++++ b/plugins/ipc/ipc.hpp
+@@ -33,6 +33,18 @@
+     /** Handle incoming data on the socket */
+     std::function<void(uint32_t)> handle_fd_activity;
+     void handle_fd_incoming(uint32_t);
++
++    /** Outgoing bytes not yet written because the reader is slow/backpressured. */
++    std::vector<char> out_buffer;
++    size_t out_sent = 0;
++    bool want_writable = false;
++
++    /** Append bytes to the outgoing queue. */
++    void queue_output(const char *data, size_t size);
++    /** Try to drain the outgoing queue; arms a writable watch on EAGAIN. */
++    void flush_output();
++    /** Toggle WL_EVENT_WRITABLE interest on the client's event source. */
++    void set_writable_watch(bool on);
+ };
+ 
+ /**
+--- a/plugins/ipc/ipc.cpp
++++ b/plugins/ipc/ipc.cpp
+@@ -10,6 +10,7 @@
+ #include <sys/ioctl.h>
+ #include <unistd.h>
+ #include <cstring>
++#include <cerrno>
+ 
+ /**
+  * Handle WL_EVENT_READABLE on the socket.
+@@ -147,6 +148,7 @@
+ 
+ static constexpr int MAX_MESSAGE_LEN = (1 << 20);
+ static constexpr int HEADER_LEN = 4;
++static constexpr size_t MAX_OUTPUT_QUEUE = 16u * 1024 * 1024;
+ 
+ wf::ipc::client_t::client_t(server_t *ipc, int fd)
+ {
+@@ -205,6 +207,11 @@
+         return;
+     }
+ 
++    if (event_mask & WL_EVENT_WRITABLE)
++    {
++        flush_output();
++    }
++
+     int available = 0;
+     if (ioctl(this->fd, FIONREAD, &available) != 0)
+     {
+@@ -291,47 +298,95 @@
+     close(this->fd);
+ }
+ 
+-static bool write_exact(int fd, const char *buf, ssize_t n)
++void wf::ipc::client_t::queue_output(const char *data, size_t size)
++{
++    out_buffer.insert(out_buffer.end(), data, data + size);
++}
++
++void wf::ipc::client_t::set_writable_watch(bool on)
++{
++    if (on == want_writable)
++    {
++        return;
++    }
++
++    want_writable = on;
++    wl_event_source_fd_update(source,
++        WL_EVENT_READABLE | (on ? WL_EVENT_WRITABLE : 0));
++}
++
++void wf::ipc::client_t::flush_output()
+ {
+-    while (n > 0)
++    while (out_sent < out_buffer.size())
+     {
+-        ssize_t w = write(fd, buf, n);
+-        if (w <= 0)
++        ssize_t w = write(fd, out_buffer.data() + out_sent, out_buffer.size() - out_sent);
++        if (w > 0)
+         {
+-            return false;
++            out_sent += (size_t)w;
++            continue;
++        }
++
++        if ((w < 0) && (errno == EINTR))
++        {
++            continue;
+         }
+ 
+-        n   -= w;
+-        buf += w;
++        if ((w < 0) && ((errno == EAGAIN) || (errno == EWOULDBLOCK)))
++        {
++            // Reader is slow: keep the remainder queued and flush when writable
++            // instead of dropping the connection on transient backpressure.
++            set_writable_watch(true);
++            return;
++        }
++
++        LOGE("Error sending json to client!");
++        shutdown(fd, SHUT_RDWR);
++        out_buffer.clear();
++        out_sent = 0;
++        set_writable_watch(false);
++        return;
+     }
+ 
+-    return true;
++    out_buffer.clear();
++    out_sent = 0;
++    set_writable_watch(false);
+ }
+ 
+ bool wf::ipc::client_t::send_json(wf::json_t json)
+ {
+-    bool status = false;
++    bool status = true;
+     json.map_serialized([&] (const char *buffer, size_t size)
+     {
+         if (size > MAX_MESSAGE_LEN)
+         {
+             LOGE("Error sending json to client: message too long!");
+-            shutdown(fd, SHUT_RDWR);
++            status = false;
+             return;
+         }
+ 
+         uint32_t len = size;
+-        if (!write_exact(fd, (char*)&len, 4) || !write_exact(fd, buffer, len))
+-        {
+-            LOGE("Error sending json to client!");
+-            shutdown(fd, SHUT_RDWR);
+-            return;
+-        }
+-
+-        status = true;
++        queue_output((const char*)&len, sizeof(len));
++        queue_output(buffer, size);
+     });
+ 
+-    return status;
++    if (!status)
++    {
++        shutdown(fd, SHUT_RDWR);
++        return false;
++    }
++
++    if ((out_buffer.size() - out_sent) > MAX_OUTPUT_QUEUE)
++    {
++        LOGE("IPC client output backlog too large; dropping connection");
++        shutdown(fd, SHUT_RDWR);
++        out_buffer.clear();
++        out_sent = 0;
++        set_writable_watch(false);
++        return false;
++    }
++
++    flush_output();
++    return true;
+ }
+ 
+ namespace wf
diff --git a/gui-wm/wayfire/wayfire-0.11.0-r69.ebuild b/gui-wm/wayfire/wayfire-0.11.0-r69.ebuild
new file mode 100644
index 000000000000..8a7c439b3c7d
--- /dev/null
+++ b/gui-wm/wayfire/wayfire-0.11.0-r69.ebuild
@@ -0,0 +1,310 @@
+# Copyright 2019-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit dot-a meson toolchain-funcs
+
+DESCRIPTION="compiz like 3D wayland compositor"
+HOMEPAGE="https://github.com/WayfireWM/wayfire"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/WayfireWM/${PN}.git"
+	SLOT="0/0.12"
+
+	IUSE="vulkan"
+
+	# vulkan support is experimental and uses a bundled fork of wlroots
+	# keep it only in the live ebuild for now
+	RDEPEND="vulkan? ( media-libs/vulkan-loader )"
+	DEPEND="vulkan? ( dev-util/vulkan-headers )"
+	COMMON_DEPEND="
+		!vulkan? (
+			gui-libs/wlroots:0.20[drm(+),libinput(+),x11-backend,X?]
+		)
+		vulkan? (
+			dev-libs/libliftoff
+			media-libs/lcms:2
+			media-libs/libdisplay-info:=
+			media-libs/mesa
+			sys-auth/seatd:=
+			x11-libs/libdrm
+			x11-libs/xcb-util-errors
+			x11-libs/xcb-util-renderutil
+			x11-libs/xcb-util-wm
+		)
+	"
+else
+	SRC_URI="https://github.com/WayfireWM/${PN}/releases/download/v${PV}/${P}.tar.xz"
+	KEYWORDS="~amd64 ~arm64 ~riscv"
+	SLOT="0/$(ver_cut 1-2)"
+
+	COMMON_DEPEND="gui-libs/wlroots:0.20[drm(+),libinput(+),x11-backend,X?]"
+fi
+
+LICENSE="MIT"
+IUSE+=" X +dbus +gles3 nls openmp test"
+RESTRICT="!test? ( test )"
+
+# bundled wlroots has the following dependency string according to included headers.
+# wlroots[drm,gles2-renderer,libinput,x11-backend?,X?]
+# enable x11-backend with X and vice versa
+COMMON_DEPEND+="
+	dev-cpp/nlohmann_json
+	dev-libs/glib:2
+	dev-libs/libevdev
+	dev-libs/libinput:=
+	dev-libs/wayland
+	dev-libs/yyjson:=
+	>=dev-libs/wayland-protocols-1.12
+	gui-libs/wf-config:${SLOT}
+	media-libs/glm
+	media-libs/libglvnd
+	media-libs/libjpeg-turbo:=
+	media-libs/libpng:=
+	virtual/libudev:=
+	x11-libs/cairo
+	x11-libs/libxkbcommon
+	x11-libs/pango
+	x11-libs/pixman
+	dbus? ( sys-apps/dbus )
+	X? ( x11-libs/libxcb:= )
+"
+
+RDEPEND+="
+	>=dev-lang/python-3.11
+	${COMMON_DEPEND}
+	x11-misc/xkeyboard-config
+"
+DEPEND+="
+	${COMMON_DEPEND}
+	test? ( dev-cpp/doctest )
+"
+BDEPEND="
+	dev-util/wayland-scanner
+	virtual/pkgconfig
+	openmp? (
+		|| (
+			sys-devel/gcc[openmp]
+			llvm-runtimes/clang-runtime[openmp]
+		)
+	)
+	nls? (
+		sys-devel/gettext
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-transparent-cube.patch
+	"${FILESDIR}"/${P}-rotate-layer-shell.patch
+	"${FILESDIR}"/${P}-screensaver-layer.patch
+	"${FILESDIR}"/${P}-desktop-sampling.patch
+	"${FILESDIR}"/${P}-cube-damage-stacking.patch
+	"${FILESDIR}"/${P}-cube-panel-overlay.patch
+	"${FILESDIR}"/${P}-stitched-outputs.patch
+	"${FILESDIR}"/${P}-virtual-output-polish.patch
+	"${FILESDIR}"/${P}-wcm-displays.patch
+	"${FILESDIR}"/${P}-window-scope.patch
+	"${FILESDIR}"/${P}-float-on-top.patch
+	"${FILESDIR}"/${P}-physical-tiling.patch
+	"${FILESDIR}"/${P}-cube-key-repeat.patch
+	"${FILESDIR}"/${P}-cube-repeat-minimum-20.patch
+	"${FILESDIR}"/${P}-scope-toggle.patch
+	"${FILESDIR}"/${P}-dialog-family-stacking.patch
+	"${FILESDIR}"/${P}-physical-grid.patch
+	"${FILESDIR}"/${P}-grid-preview.patch
+	"${FILESDIR}"/${P}-grid-cycle.patch
+	"${FILESDIR}"/${P}-physical-output-focus.patch
+	"${FILESDIR}"/${P}-oswitch-local-symbols.patch
+	"${FILESDIR}"/${P}-oswitch-wrap.patch
+	"${FILESDIR}"/${P}-popup-physical-scope.patch
+	"${FILESDIR}"/${P}-move-snapping.patch
+	"${FILESDIR}"/${P}-move-held-redraw.patch
+	"${FILESDIR}"/${P}-workspace-backgrounds.patch
+	"${FILESDIR}"/${P}-show-desktop-workspace.patch
+	"${FILESDIR}"/${P}-vswitch-held-target.patch
+	"${FILESDIR}"/${P}-decoration-window-menu.patch
+	"${FILESDIR}"/${P}-layer-move-old-damage.patch
+	"${FILESDIR}"/${P}-workspace-grid-events.patch
+	"${FILESDIR}"/${P}-r35-fullscreen-subpasses.patch
+	"${FILESDIR}"/${P}-r36-cube-fixed-top.patch
+	"${FILESDIR}"/${P}-r37-cube-carried-visibility.patch
+	"${FILESDIR}"/${P}-r38-cube-workspace-lifecycle.patch
+	"${FILESDIR}"/${P}-r39-cube-workspace-rows.patch
+	"${FILESDIR}"/${P}-r40-cube-row-translation.patch
+	"${FILESDIR}"/${P}-r41-cube-complete-row-translation.patch
+	"${FILESDIR}"/${P}-r42-grid-monitor-window-move.patch
+	"${FILESDIR}"/${P}-r43-cube-mouse-overview.patch
+	"${FILESDIR}"/${P}-r44-cube-rigid-stack.patch
+	"${FILESDIR}"/${P}-r45-cube-stack-tilt.patch
+	"${FILESDIR}"/${P}-r46-cube-resting-faces.patch
+	"${FILESDIR}"/${P}-r47-cube-direct-drag.patch
+	"${FILESDIR}"/${P}-r48-cube-wheel-zoom.patch
+	"${FILESDIR}"/${P}-r49-cube-square-footprint.patch
+	"${FILESDIR}"/${P}-r50-cube-center-pivot.patch
+	"${FILESDIR}"/${P}-r51-cube-centered-entry.patch
+	"${FILESDIR}"/${P}-r53-cube-warp.patch
+	"${FILESDIR}"/${P}-r55-cube-backdrop-opacity.patch
+	"${FILESDIR}"/${P}-r56-cube-warp-rest.patch
+	"${FILESDIR}"/${P}-r57-cube-hyperspace.patch
+	"${FILESDIR}"/${P}-r58-cube-nebula.patch
+	"${FILESDIR}"/${P}-r59-ambient-background.patch
+	"${FILESDIR}"/${P}-r60-ambient-package-split.patch
+	"${FILESDIR}"/${P}-r65-output-transforms.patch
+	"${FILESDIR}"/${P}-drag-escape.patch
+	"${FILESDIR}"/${P}-r67-grid-gap.patch
+	"${FILESDIR}"/${P}-r68-ipc-control.patch
+	"${FILESDIR}"/${P}-ipc-backpressure.patch
+)
+
+# SCREENSAVER changes scene layer indices. Rebuild plugins against the matching
+# ABI; wf-config above retains its upstream 0.11 subslot.
+SLOT="${SLOT}.screensaver1"
+
+pkg_pretend() {
+	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
+}
+
+pkg_setup() {
+	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
+}
+
+src_prepare() {
+	default
+
+	local dbusrunsession=$(usev dbus dbus-run-session)
+	sed -e "s:@EPREFIX@:${EPREFIX}:g" -e "s:@DBUS_RUN_SESSION@:${dbusrunsession}:" \
+		"${FILESDIR}"/wayfire-session-2 > "${T}"/wayfire-session || die
+	sed -e "s:@EPREFIX@:${EPREFIX}:" \
+		"${FILESDIR}"/wayfire-session.desktop > "${T}"/wayfire-session.desktop || die
+}
+
+src_configure() {
+	lto-guarantee-fat
+
+	local emesonargs=(
+		$(meson_feature test tests)
+		$(meson_feature X xwayland)
+		$(meson_use gles3 enable_gles32)
+		$(meson_feature nls build_locales)
+		$(meson_use openmp enable_openmp)
+		-Duse_system_wfconfig=enabled
+	)
+
+	if [[ ${PV} == 9999 ]]; then
+		emesonargs+=(
+			$(meson_feature !vulkan use_system_wlroots)
+			$(meson_use vulkan vulkan_effects)
+		)
+	else
+		emesonargs+=(
+		-Duse_system_wlroots=enabled
+		-Dvulkan_effects=false
+		)
+	fi
+
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+
+	exeinto "/usr/$(get_libdir)/wayfire/ipc-control-r68"
+	doexe "${BUILD_DIR}/plugins/ipc-rules/libipc-rules.so"
+	doexe "${BUILD_DIR}/plugins/wm-actions/libwm-actions.so"
+
+	exeinto "/usr/$(get_libdir)/wayfire/cube-ambient-r59"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+
+	# A distinct packaged path permits upgrading a resident cached plugin.
+	exeinto "/usr/$(get_libdir)/wayfire/wm-actions"
+	doexe "${BUILD_DIR}/plugins/wm-actions/libwm-actions.so"
+	exeinto "/usr/$(get_libdir)/wayfire/grid"
+	doexe "${BUILD_DIR}/plugins/grid/libgrid.so"
+	exeinto "/usr/$(get_libdir)/wayfire/grid-physical"
+	doexe "${BUILD_DIR}/plugins/grid/libgrid.so"
+	exeinto "/usr/$(get_libdir)/wayfire/move-physical"
+	doexe "${BUILD_DIR}/plugins/single_plugins/libmove.so"
+	exeinto "/usr/$(get_libdir)/wayfire/grid-preview"
+	doexe "${BUILD_DIR}/plugins/grid/libgrid.so"
+	exeinto "/usr/$(get_libdir)/wayfire/grid-cycle"
+	doexe "${BUILD_DIR}/plugins/grid/libgrid.so"
+	exeinto "/usr/$(get_libdir)/wayfire/oswitch-physical-r24"
+	doexe "${BUILD_DIR}/plugins/single_plugins/liboswitch.so"
+	exeinto "/usr/$(get_libdir)/wayfire/grid-move-r27"
+	doexe "${BUILD_DIR}/plugins/grid/libgrid.so"
+	# Legacy activation paths remain valid, now containing ordinary Grid only.
+	exeinto "/usr/$(get_libdir)/wayfire/grid-occupancy-r54"
+	doexe "${BUILD_DIR}/plugins/grid/libgrid.so"
+	exeinto "/usr/$(get_libdir)/wayfire/grid-occupancy-r52"
+	doexe "${BUILD_DIR}/plugins/grid/libgrid.so"
+	exeinto "/usr/$(get_libdir)/wayfire/grid-monitor-r42"
+	doexe "${BUILD_DIR}/plugins/grid/libgrid.so"
+	exeinto "/usr/$(get_libdir)/wayfire/move-snap-r27"
+	doexe "${BUILD_DIR}/plugins/single_plugins/libmove.so"
+	exeinto "/usr/$(get_libdir)/wayfire/grid-gap-r67"
+	doexe "${BUILD_DIR}/plugins/grid/libgrid.so"
+	exeinto "/usr/$(get_libdir)/wayfire/move-gap-r67"
+	doexe "${BUILD_DIR}/plugins/single_plugins/libmove.so"
+	exeinto "/usr/$(get_libdir)/wayfire/move-redraw-r28"
+	doexe "${BUILD_DIR}/plugins/single_plugins/libmove.so"
+	exeinto "/usr/$(get_libdir)/wayfire/wm-actions-desktop-r30"
+	doexe "${BUILD_DIR}/plugins/wm-actions/libwm-actions.so"
+	exeinto "/usr/$(get_libdir)/wayfire/vswitch-held-r31"
+	doexe "${BUILD_DIR}/plugins/vswitch/libvswitch.so"
+	exeinto "/usr/$(get_libdir)/wayfire/vswitch-held-r37"
+	doexe "${BUILD_DIR}/plugins/vswitch/libvswitch.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-r38"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-r39"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-r40"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-r41"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-nebula-r58"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-hyperspace-r57"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-warp-rest-r56"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-backdrop-r55"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-warp-r53"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-centered-entry-r51"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-center-r50"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-square-r49"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-wheel-r48"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-direct-r47"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-rest-r46"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-tilt-r45"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-stack-r44"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/cube-overview-r43"
+	doexe "${BUILD_DIR}/plugins/cube/libcube.so"
+	exeinto "/usr/$(get_libdir)/wayfire/vswitch-held-r39"
+	doexe "${BUILD_DIR}/plugins/vswitch/libvswitch.so"
+	dobin "${T}"/wayfire-session
+
+	insinto "/usr/share/wayland-sessions/"
+	insopts -m644
+	doins wayfire.desktop
+	doins "${T}"/wayfire-session.desktop
+
+	insinto "/usr/share/wayfire/"
+	doins wayfire.ini
+
+	insinto "/etc"
+	doins "${FILESDIR}"/wayfire.env
+
+	strip-lto-bytecode
+}
diff --git a/media-sound/mpd/Manifest b/media-sound/mpd/Manifest
index 1786877b6ea4..403bacfe5ee0 100644
--- a/media-sound/mpd/Manifest
+++ b/media-sound/mpd/Manifest
@@ -1,3 +1,5 @@
 DIST mpd-0.24.12.tar.xz 1020148 BLAKE2B 5a6114d7085229985f09acd95566e272629c491059ee92300961e58635bd981004480584c42eed8726556fd8b92ebc9c4dfb50dddfb77dfb17b477f4ed785a20 SHA512 868e6f97c63876ad36c1aa901c5e17ac501d9feccc9bffcc8a104e786c282d3e58ad2c0f8a2bb1fdada40fb5c9a8c55f7af19f396e54e58938231463daa0a624
 DIST mpd-0.24.15.tar.xz 1023324 BLAKE2B cc15e6f0ce1803ed4b50fa83e61d019c4492e4bbc7af0cb2795f4df5a5d25abe31c7d88ba4a62e1ec803277e7a11858837585d0cb29b3cabc611c7e9da1e52f9 SHA512 5d373ab224dfad85ee19c6ec02d16958e0e5b0872ab6b3746218c81938d741937542823da8bf97ebeb7cab8da98b005e5249319717e72d25a435ded71ecdbe98
 DIST mpd-0.24.15.tar.xz.sig 566 BLAKE2B 51d6315040cbfe977a256acbd2b21c66c1940bad5df4a0d5b7417cb978c7094f4249189f1e3409bfd697fd4952dc3be175e32721001960b92fa08af614b7bd40 SHA512 2546e794cf0a6b748b04073fd4f0a0100113a3adcc5ffc6c6d09de3c08a435fce5d80a2cc760f960f5780215c6e4e05ed16302db886e4671c34e47a6ddce067f
+DIST mpd-0.24.16.tar.xz 1039200 BLAKE2B 96b2cd7988c43da7661ad5d77db8aaf9c5291af6a8adc4e29a2256eaab0e1df338aeaf12d3106b2085c2b96fc34c4869b00008337a6d6500da20247d05c44e1e SHA512 3c68b127e361b23d1b58580609949598258a4e4b9d5f2d85d79ecfb776a876a7464c1d597dece92e731bb9a4f4341d21330f39256e8d05d4de2b5f00a596ad78
+DIST mpd-0.24.16.tar.xz.sig 566 BLAKE2B fe5654895c79b06f278eaf5abf273720fddb0092dc4355b26a9f1a2f579ced60c6f5d56ca409f56567902f68258ec17b7d9118cb6278c8437c119dd807e7d123 SHA512 322a38c5b8cc292f94c0ba72d4b995892a500884966b4cf8683757aab3664e4dd6d243e2e9161a6beb189e2d9063ddbbcb049ddb2f50cea4fb9bfb19ae550fba
diff --git a/media-sound/mpd/files/mpd-0.24.16-link_smbclient.patch b/media-sound/mpd/files/mpd-0.24.16-link_smbclient.patch
new file mode 100644
index 000000000000..600d198c62f0
--- /dev/null
+++ b/media-sound/mpd/files/mpd-0.24.16-link_smbclient.patch
@@ -0,0 +1,12 @@
+PR merged https://github.com/MusicPlayerDaemon/MPD/pull/2600.patch
+fix linker failure
+--- a/src/lib/smbclient/meson.build
++++ b/src/lib/smbclient/meson.build
+@@ -11,6 +11,7 @@ smbclient = static_library(
+   'Context.cxx',
+   include_directories: inc,
+   dependencies: [
++    protocol_dep,
+     smbclient_dep,
+   ],
+ )
diff --git a/media-sound/mpd/files/mpd-0.24.16.user.confd b/media-sound/mpd/files/mpd-0.24.16.user.confd
new file mode 100644
index 000000000000..7f34dfb02319
--- /dev/null
+++ b/media-sound/mpd/files/mpd-0.24.16.user.confd
@@ -0,0 +1,14 @@
+# Copyright 2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+#MPD_CFGFILE="${XDG_CONFIG_HOME}/mpd/mpd.conf"
+
+# For all command line options, please see `mpd --help`
+#MPD_EXTRA_ARGS="--verbose"
+
+# See https://mpd.readthedocs.io/en/stable/user.html#startup
+rc_ulimit=""
+# Required by io-uring
+#rc_ulimit="${rc_ulimit} -l 65535"
+# Required for real-time
+#rc_ulimit="${rc_ulimit} -r 40"
diff --git a/media-sound/mpd/files/mpd-0.24.16.user.init b/media-sound/mpd/files/mpd-0.24.16.user.init
new file mode 100644
index 000000000000..4ca6ab94a1c1
--- /dev/null
+++ b/media-sound/mpd/files/mpd-0.24.16.user.init
@@ -0,0 +1,19 @@
+#!/sbin/openrc-run
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+: ${MPD_CFGFILE:=${XDG_CONFIG_HOME:-${HOME}/.config}/mpd/mpd.conf}
+
+command=/usr/bin/mpd
+command_args="${MPD_EXTRA_ARGS} ${MPD_CFGFILE}"
+command_args_foreground="--no-daemon"
+required_files="${MPD_CFGFILE}"
+supervisor="supervise-daemon"
+
+extra_started_commands="reload"
+
+reload() {
+	ebegin "Reloading ${RC_SVCNAME}"
+	supervise-daemon "${RC_SVCNAME}" --signal HUP
+	eend $?
+}
diff --git a/media-sound/mpd/mpd-0.24.16.ebuild b/media-sound/mpd/mpd-0.24.16.ebuild
new file mode 100644
index 000000000000..89a4629d26ca
--- /dev/null
+++ b/media-sound/mpd/mpd-0.24.16.ebuild
@@ -0,0 +1,370 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+inherit eapi9-ver flag-o-matic linux-info meson python-any-r1 systemd verify-sig xdg
+
+DESCRIPTION="The Music Player Daemon (mpd)"
+HOMEPAGE="https://www.musicpd.org https://github.com/MusicPlayerDaemon/MPD"
+SRC_URI="
+	https://www.musicpd.org/download/${PN}/$(ver_cut 1-2)/${P}.tar.xz
+	verify-sig? ( https://www.musicpd.org/download/${PN}/$(ver_cut 1-2)/${P}.tar.xz.sig )
+"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+IUSE="+alsa ao audiofile bzip2 cdio chromaprint +curl doc +dbus
+	+eventfd expat faad +ffmpeg flac fluidsynth gme httpd +icu +id3tag +inotify
+	+io-uring jack lame libmpdclient libsamplerate libsoxr mad mikmod mms
+	modplug +mpg123 musepack nfs openal openmpt opus oss pipewire pulseaudio qobuz
+	recorder samba selinux shout sid signalfd snapcast sndfile sndio sqlite
+	systemd test tremor twolame upnp vorbis wav wavpack webdav wildmidi
+	zeroconf zip zlib"
+
+OUTPUT_PLUGINS="alsa ao jack httpd openal oss pipewire pulseaudio shout snapcast sndio recorder"
+DECODER_PLUGINS="audiofile faad ffmpeg flac fluidsynth mad mikmod
+	modplug mpg123 musepack opus openmpt flac sid tremor vorbis wavpack wildmidi"
+ENCODER_PLUGINS="flac lame opus twolame vorbis wav"
+
+REQUIRED_USE="
+	|| ( ${OUTPUT_PLUGINS} )
+	|| ( ${DECODER_PLUGINS} )
+	?? ( tremor vorbis )
+	httpd? ( || ( ${ENCODER_PLUGINS} ) )
+	recorder? ( || ( ${ENCODER_PLUGINS} ) )
+	shout? ( || ( ${ENCODER_PLUGINS} ) )
+	snapcast? ( wav )
+	qobuz? ( curl )
+	upnp? ( curl expat )
+	webdav? ( curl expat )
+"
+
+RESTRICT="!test? ( test )"
+
+COMMON_ENCODERS="
+	lame? ( media-sound/lame )
+	twolame? ( media-sound/twolame )
+"
+RDEPEND="
+	acct-user/mpd
+	dev-libs/libfmt:=
+	dev-libs/libpcre2:=
+	alsa? (
+		media-libs/alsa-lib
+		media-sound/alsa-utils
+	)
+	ao? ( media-libs/libao[alsa?,pulseaudio?] )
+	audiofile? ( media-libs/audiofile:= )
+	bzip2? ( app-arch/bzip2 )
+	cdio? (
+		dev-libs/libcdio:=
+		dev-libs/libcdio-paranoia:=
+	)
+	chromaprint? ( media-libs/chromaprint:= )
+	curl? ( net-misc/curl )
+	dbus? ( sys-apps/dbus )
+	expat? ( dev-libs/expat )
+	faad? ( media-libs/faad2 )
+	ffmpeg? ( media-video/ffmpeg:= )
+	flac? ( media-libs/flac:= )
+	fluidsynth? ( media-sound/fluidsynth:= )
+	gme? ( media-libs/game-music-emu )
+	httpd? ( ${COMMON_ENCODERS} )
+	icu? (
+		dev-libs/icu:=
+		virtual/libiconv
+	)
+	id3tag? ( media-libs/libid3tag:= )
+	io-uring? ( sys-libs/liburing:= )
+	jack? ( virtual/jack )
+	libmpdclient? ( media-libs/libmpdclient )
+	libsamplerate? ( media-libs/libsamplerate )
+	libsoxr? ( media-libs/soxr )
+	mad? ( media-libs/libmad )
+	mikmod? ( media-libs/libmikmod )
+	mms? ( media-libs/libmms )
+	modplug? ( media-libs/libmodplug )
+	mpg123? ( media-sound/mpg123-base )
+	musepack? ( media-sound/musepack-tools )
+	nfs? ( net-fs/libnfs:= )
+	openal? ( media-libs/openal )
+	openmpt? ( media-libs/libopenmpt )
+	opus? (
+		media-libs/libogg
+		media-libs/opus
+	)
+	pulseaudio? ( media-libs/libpulse )
+	pipewire? ( media-video/pipewire:= )
+	qobuz? (
+		!ffmpeg? ( dev-libs/libgcrypt:= )
+		ffmpeg? ( media-video/ffmpeg )
+	)
+	recorder? ( ${COMMON_ENCODERS} )
+	samba? ( net-fs/samba:= )
+	selinux? ( sec-policy/selinux-mpd )
+	shout? (
+		${COMMON_ENCODERS}
+		media-libs/libshout
+	)
+	sid? ( media-libs/libsidplayfp:= )
+	sndfile? ( media-libs/libsndfile )
+	sndio? ( media-sound/sndio:= )
+	sqlite? ( dev-db/sqlite:3 )
+	systemd? ( sys-apps/systemd:= )
+	tremor? (
+		media-libs/libogg
+		media-libs/tremor
+	)
+	upnp? ( <net-libs/libupnp-1.18.0 )
+	vorbis? (
+		media-libs/libogg
+		media-libs/libvorbis
+	)
+	wavpack? ( media-sound/wavpack )
+	wildmidi? ( media-sound/wildmidi )
+	zeroconf? ( net-dns/avahi[dbus] )
+	zip? ( dev-libs/zziplib:= )
+	zlib? ( virtual/zlib:= )
+"
+DEPEND="
+	${RDEPEND}
+	qobuz? ( >=dev-cpp/nlohmann_json-3.11.3 )
+	snapcast? ( >=dev-cpp/nlohmann_json-3.11.3 )
+	test? ( dev-cpp/gtest )
+"
+BDEPEND="
+	virtual/pkgconfig
+	doc? (
+		$(python_gen_any_dep '
+			dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+		')
+	)
+	verify-sig? ( sec-keys/openpgp-keys-mpd )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/${PN}.asc
+
+PATCHES=(
+	# PR merged
+	"${FILESDIR}"/${P}-link_smbclient.patch
+)
+
+python_check_deps() {
+	use doc || return 0
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	use doc && python-any-r1_pkg_setup
+
+	if use eventfd; then
+		CONFIG_CHECK+=" ~EVENTFD"
+		ERROR_EVENTFD="${P} requires eventfd in-kernel support."
+	fi
+
+	if use signalfd; then
+		CONFIG_CHECK+=" ~SIGNALFD"
+		ERROR_SIGNALFD="${P} requires signalfd in-kernel support."
+	fi
+
+	if use inotify; then
+		CONFIG_CHECK+=" ~INOTIFY_USER"
+		ERROR_INOTIFY_USER="${P} requires inotify in-kernel support."
+	fi
+
+	if use io-uring; then
+		CONFIG_CHECK+=" ~IO_URING"
+		ERROR_IO_URING="${P} requires io-uring in-kernel support."
+	fi
+
+	if use eventfd || use signalfd || use inotify || use io-uring; then
+		linux-info_pkg_setup
+	fi
+}
+
+src_configure() {
+	local emesonargs=(
+		# media-libs/adplug is not packaged anymore
+		-Dadplug=disabled
+		$(meson_feature alsa)
+		$(meson_feature ao)
+		$(meson_feature audiofile)
+		$(meson_feature bzip2)
+		$(meson_feature cdio cdio_paranoia)
+		$(meson_feature chromaprint)
+		-Dcue=true
+		$(meson_feature curl)
+		$(meson_feature dbus)
+		$(meson_use eventfd)
+		$(meson_feature expat)
+		$(meson_feature faad)
+		$(meson_feature ffmpeg)
+		-Dfifo=true
+		$(meson_feature flac)
+		$(meson_feature fluidsynth)
+		$(meson_feature gme)
+		$(meson_use httpd )
+		$(meson_feature icu)
+		$(meson_feature id3tag)
+		$(meson_use inotify)
+		-Dipv6=enabled
+		$(meson_feature cdio iso9660)
+		$(meson_feature io-uring io_uring)
+		$(meson_feature jack)
+		$(meson_feature libmpdclient)
+		$(meson_feature libsamplerate)
+		$(meson_feature mad)
+		$(meson_feature mikmod)
+		$(meson_feature mms)
+		$(meson_feature modplug)
+		$(meson_feature musepack mpcdec)
+		$(meson_feature mpg123)
+		$(meson_feature nfs)
+		$(meson_feature openal)
+		$(meson_feature openmpt)
+		$(meson_feature opus)
+		$(meson_feature oss)
+		-Dpipe=true
+		$(meson_feature pipewire)
+		$(meson_feature pulseaudio pulse)
+		$(meson_feature qobuz)
+		$(meson_use recorder)
+		$(meson_feature shout)
+		$(meson_use signalfd)
+		$(meson_feature samba smbclient)
+		$(meson_use snapcast)
+		$(meson_feature sid sidplay)
+		$(meson_feature sndfile)
+		$(meson_feature sndio)
+		$(meson_feature libsoxr soxr)
+		$(meson_feature sqlite)
+		$(meson_feature systemd)
+		$(meson_use test)
+		$(meson_feature dbus udisks)
+		-Dupnp=$(usex upnp pupnp disabled)
+		$(meson_feature tremor)
+		$(meson_feature vorbis)
+		$(meson_use wav wave_encoder)
+		$(meson_feature wavpack)
+		$(meson_feature wildmidi)
+		$(meson_feature webdav)
+		-Dzeroconf=$(usex zeroconf avahi disabled)
+		$(meson_feature zlib)
+		$(meson_feature zip zzip)
+
+		--libdir="/usr/$(get_libdir)"
+		$(meson_feature doc documentation)
+		-Dsolaris_output=disabled
+
+		-Ddatabase=true
+		-Ddaemon=true
+		-Ddsd=true
+		-Dtcp=true
+
+		-Dsystemd_system_unit_dir="$(systemd_get_systemunitdir)"
+		-Dsystemd_user_unit_dir="$(systemd_get_userunitdir)"
+
+		$(meson_feature icu iconv)
+	)
+
+	if use samba || use upnp; then
+		emesonargs+=( -Dneighbor=true )
+	fi
+
+	append-lfs-flags
+
+	# set useflag for encoders
+	if use httpd || use shout || use recorder; then
+		emesonargs+=(
+			# not in tree
+			-Dshine=disabled
+			$(meson_feature lame)
+			$(meson_feature twolame)
+			$(meson_feature vorbis vorbisenc)
+		)
+	else
+		# avoid links even w/o encoder
+		emesonargs+=(
+			-Dlame=disabled
+			-Dtwolame=disabled
+		)
+	fi
+
+	# nlohmann_json is only required with these plugins enabled
+	if use qobuz || use snapcast; then
+		emesonargs+=(
+			-Dnlohmann_json=enabled
+		)
+	fi
+
+	meson_src_configure
+}
+
+src_install() {
+	if use doc; then
+		local HTML_DOCS=( "${BUILD_DIR}"/doc/html/. )
+	else
+		newman "${FILESDIR}"/${PN}.1-0.24.2 ${PN}.1
+		newman "${FILESDIR}"/${PN}.conf.5-0.24.9 ${PN}.conf.5
+	fi
+
+	meson_src_install
+
+	insinto /etc
+	newins doc/mpdconf.example mpd.conf
+
+	if ! use systemd; then
+		# define a log_file that should not be set when using systemd
+		sed -e '0,/^#log_file.*$/s::log_file "/var/log/mpd/mpd.log"\n&:' \
+			-i "${ED}/etc/mpd.conf" || die
+	fi
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/${PN}-0.23.15.logrotate" "${PN}"
+
+	newinitd "${FILESDIR}/${PN}-0.24.15.init" "${PN}"
+	newconfd "${FILESDIR}/${PN}-0.24.15.confd" "${PN}"
+
+	exeinto /etc/user/init.d
+	newexe "${FILESDIR}/${PN}-0.24.16.user.init" "${PN}"
+	exeinto /etc/user/conf.d
+	newexe "${FILESDIR}/${PN}-0.24.16.user.confd" "${PN}"
+
+	# set memlock limit for io-uring
+	# see https://mpd.readthedocs.io/en/latest/user.html#startup
+	if use io-uring; then
+		sed -e '/#rc_ulimit="${rc_ulimit} -l/s/^#//' \
+			-i "${ED}/etc/conf.d/mpd" "${ED}/etc/user/conf.d/mpd" || die
+	fi
+
+	keepdir /var/lib/mpd
+	keepdir /var/lib/mpd/music
+	keepdir /var/lib/mpd/playlists
+	keepdir /var/log/mpd
+
+	rm -r "${ED}"/usr/share/doc/mpd || die
+
+	fowners mpd: -R /var/lib/mpd
+	fowners mpd: -R /var/log/mpd
+}
+
+pkg_postinst() {
+	xdg_pkg_postinst
+
+	if ver_replacing -lt 0.24.8-r1; then
+		ewarn "The 'group' parameter is no longer used by default, because it"
+		ewarn "overrides the group(s) defined in the user database."
+		ewarn "Since the user 'mpd' is already part of the 'audio' group, please"
+		ewarn "consider removing 'group' parameter in ${EROOT}/etc/mpd.conf ."
+	fi
+	if ver_replacing -lt 0.24.15; then
+		ewarn "The daemon is now started directly as an unprivileged user."
+		ewarn "Update MPD_USER in ${EROOT}/etc/conf.d/mpd to override the default user 'mpd'."
+		ewarn "'user' and 'pid_file' must no longer be set in ${EROOT}/etc/mpd.conf ."
+	fi
+}
diff --git a/media-video/ffmpeg/ffmpeg-9999.ebuild b/media-video/ffmpeg/ffmpeg-9999.ebuild
index 3d51f555141a..efb4d7be615b 100644
--- a/media-video/ffmpeg/ffmpeg-9999.ebuild
+++ b/media-video/ffmpeg/ffmpeg-9999.ebuild
@@ -96,7 +96,6 @@ FFMPEG_IUSE_MAP=(
 	ocr:libtesseract
 	openal
 	opencl
-	opengl
 	openh264:libopenh264
 	openmpt:libopenmpt
 	openssl:openssl,!gnutls@v3ifgpl # still LGPL2.1+ if USE=-gpl
@@ -249,7 +248,6 @@ COMMON_DEPEND="
 	ocr? ( app-text/tesseract:=[${MULTILIB_USEDEP}] )
 	openal? ( media-libs/openal[${MULTILIB_USEDEP}] )
 	opencl? ( virtual/opencl[${MULTILIB_USEDEP}] )
-	opengl? ( media-libs/libglvnd[X,${MULTILIB_USEDEP}] )
 	openh264? ( media-libs/openh264:=[${MULTILIB_USEDEP}] )
 	openmpt? ( media-libs/libopenmpt[${MULTILIB_USEDEP}] )
 	openssl? ( >=dev-libs/openssl-3:=[${MULTILIB_USEDEP}] )
diff --git a/net-dns/bind/Manifest b/net-dns/bind/Manifest
index e611e7bff520..2adb6e73c84b 100644
--- a/net-dns/bind/Manifest
+++ b/net-dns/bind/Manifest
@@ -2,3 +2,5 @@ DIST bind-9.20.27.tar.xz 5932248 BLAKE2B 7f2f0f030748e722d12800bae567f9cfb1ddeba
 DIST bind-9.20.27.tar.xz.asc 870 BLAKE2B e24deaa0cbc186b31b86e983e5c9f2c53550d8978d84e291d67027cf558d4b39b2fe6e217e3bc61685645bc249a1576087915980420a3336c67f6992ba05227a SHA512 255a523bb73c94e04c4cfd6b00a60bc57a1351767fef2421258e358ca5c13a359e53d1b6921792447b655aac7911fc22cd2ded8e5b114221c08fa7bc17d3a154
 DIST bind-9.20.29.tar.xz 5966372 BLAKE2B 0707c48f2d8eb898578bf1d6c2e626e17f93b50394855dd697ccd7e8b98c0926366112cc7dab9f6becd3d01210958e365bcc60142558cdf4ce28002dcc2906de SHA512 afedc73a1376d662eec86b7f0e5795a3b0302e7184af83f90d06e3b5054efb54f5d7ab73f777e0d1b84b25aa27f299de688c508e28f0a22e67ba5eb07aa46077
 DIST bind-9.20.29.tar.xz.asc 870 BLAKE2B a3c564fb898fa4cf00ef5bf47339f9cfcad78180cf6bdd723e243854b53f3bc7549e3074ea6d2ea3852bb68b5910c5270d9e4abc376c6c839f7dea91b31719c7 SHA512 456be1551ccb858da7de072e51b1c5c9a3688cae3ac0d070ff84dcd3cb6a2ccfdf5afca3c06cf44089abcf5ae8f24f626fc5ded84bce521494dd7c56e6a786f2
+DIST bind-9.20.30.tar.xz 6004232 BLAKE2B 5ab0bba53c631817984d03a630f2f71a52a06a5a17bae34229af723e9acddcd13d12c4f40a90ecdb1967ce2fa8406977a84590985a143b38dc93c5894839424a SHA512 3717897d35311e2056f0c0cb7d97c32348b4e2202762f3b98dd0e405f78fa2281e5f7f07341df67e58c303f1c7acb81e707dd727db7b2e5592f1af549eae3325
+DIST bind-9.20.30.tar.xz.asc 870 BLAKE2B d1d60ab0d7318cb44280826046c28ac330655c96504b9f5618a63f9a33de3f9c314d6dcd36063e14fb97f021dc0fc8444ab10bd192b6d3f65ec82681fd290517 SHA512 149d38eb30f2b66207a691311e9d83a06ef8d56c8a491f87d84ccd2bd75316b5f4cdef2f1c84fe5b6b6da2d254ed389008825184dd88099a70f7fe0b3d7086c9
diff --git a/net-dns/bind/bind-9.20.30.ebuild b/net-dns/bind/bind-9.20.30.ebuild
new file mode 100644
index 000000000000..127a82589b3b
--- /dev/null
+++ b/net-dns/bind/bind-9.20.30.ebuild
@@ -0,0 +1,286 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/isc.asc
+inherit autotools eapi9-ver systemd tmpfiles toolchain-funcs verify-sig
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/bind/"
+SRC_URI="
+	https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz
+	verify-sig? ( https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz.asc )
+"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux systemtap test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	dev-libs/userspace-rcu:=
+	>=dev-libs/libuv-1.37.0:=
+	virtual/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	>=sys-libs/libcap-2.1.0
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? ( dev-util/cmocka )
+	systemtap? ( dev-debug/systemtap )
+	verify-sig? ( sec-keys/openpgp-keys-isc )
+"
+
+src_prepare() {
+	default
+	eautoreconf
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		export DTRACE="${BROOT}"/usr/bin/stap-dtrace
+	fi
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable geoip)
+		$(use_enable systemtap tracing)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	find "${ED}"/usr/lib* -name '*.la' -delete || die
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named,run/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named,run/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/net-dns/knot/Manifest b/net-dns/knot/Manifest
index 59cb58b03796..c573ad4c9522 100644
--- a/net-dns/knot/Manifest
+++ b/net-dns/knot/Manifest
@@ -1,12 +1,10 @@
-DIST knot-3.5.5-manpages.tar.xz 41160 BLAKE2B 9dea7dd8500e82712f19816f16a00a4d3cb4fee1fd426c966052386472873438e7b63a64b49dccdb2a460fea1f5e9e2f1b8f27f16ce1a908c03ac4e1d367cf03 SHA512 eac4c2571b997809b8e4fedcdec51992ed6642877b022dafa80d3cfa9a0ed85a13b3fda8785b5a998de4756f72add4a399d9417968d978f522a1bbd90045307a
-DIST knot-3.5.5.tar.xz 1734192 BLAKE2B 5ee478109a26e3b163da169e7e22a03780727528f84953e399f25670d48392b6b407388c38b152bc90399f517b70676168735c1aba4028326237b92cdf904938 SHA512 983789c7fbbb191d4bd8e9f13050a5d5310a8bc69184b6d3440711fff88fa631ca6703b0800dd5581bd84850b4253dddfb36c2bdd46f6f158333b5ad934fdfdc
-DIST knot-3.5.5.tar.xz.asc 833 BLAKE2B 478aa1fba542f1e5cf00ea35af2d99cf2fe1b88e566dbc056696542e74508f58790c14a88e74a09bb06247a811a58bd4534e7d36cea6825f2111b9020c21e190 SHA512 b20be4fde7d62954898e8e1e9b9d81cad5a543d7d7636fcccebaa313905491c900f7c02c0782b8287f6262736bd08a1a208cda5557776dbeed8aaab589ef1b68
-DIST knot-3.5.6-manpages.tar.xz 41136 BLAKE2B 43b295092f42418566206600585f994c7a46498bacc40e0fa5f3a9ab441715c35a95757ee91e4d1b51a317e58b37fc3b248c33a6f77b7b72d6560c93a5341bdf SHA512 41af9e9bba8a06c9902b17a65052e9b0d9ba0cf79b15134181e0c58ecbcab770ef6f9d10a54d1d1707e56ab54953c28c39331dad9a013b54ad59df3402f951e0
-DIST knot-3.5.6.tar.xz 1734776 BLAKE2B f03a2da9390e89bd7955505d3f59ca54689e2183b1ea0f82efbf5abedd71f16902c6d09f77adceaedd29573d52135c168441dbf46721709b370269220b68f49b SHA512 bd1818552ab076a007aae2d14fdae053e7ffabb37bcfd6cd4485b866fe2d80675f3a4367a87afe4c4a32ea529a503f2b6857632eb74f7cac0598f15b093d286b
-DIST knot-3.5.6.tar.xz.asc 833 BLAKE2B e50abb5e54db106e965ea01d8bed5ee183cc98922368d58144552cb2a6a55af738abd44195624397fc965fead72a687c8cd76554f60ea34013a6b2e6e94652ef SHA512 5647f932b145d6a4fd12e205fe895fe18df67a3e9c33a8bb3fc93b93762bbe46a359b86cf2482e0089eddb8fbe9fe22f306df94527804c9b3bf35631914c1101
+DIST knot-3.5.10.tar.xz 1772508 BLAKE2B 6dac5723600c11b78a58a6986f922c6235489620ae66f70339bb021fb9d3d0c66e523cd38ca2c4cf2864804a4190058b9f1c8754ebe5e66b607abcb09edef0b4 SHA512 1e3c65e8f336b54c73b3fa5ee0b600c28243ba0a8909b814658d5a87388f518e5340e10562d913d1c999ea969cefda64b01354cf792fb0661751b9c4e93a66a1
+DIST knot-3.5.10.tar.xz.asc 833 BLAKE2B 84df2f415667704bf076e8d989d9de84c9dd44df153878e5032ff9b863ac11257e3f63a8ea7924ed4c33d25230aede1c65a76f1c3afe41da78b534de587134b7 SHA512 51904a6c8632b27b643a94bcfb83c1074f029c8ca9ed86fe1e41da76220a5075b836b5d45652c58bdefdeffe865cdb5b214d912b5de4e27702d6247ce4ebcd24
 DIST knot-3.5.8-manpages.tar.xz 41224 BLAKE2B b5e09b5d3af811a9e83a5f6e07c18bdd515fbbc3195ec72057f9b0586bf3be620f76c796d549413734e866d3e3738fb8607e74880eac05475363dd0618230a71 SHA512 9e69b6e29a71085a29c8666e82149a3d3bc4196d49294c096708109870f4ab3a980d1b3b70e12b05058fe8cbb42ebb74cb506f31bba827a788241bba459a666e
 DIST knot-3.5.8.tar.xz 1736408 BLAKE2B e7793b469c7782a3aa14c8e02fb038d8d1d943283a9cd4dde7bee6a7296d5c4149e0752f8741317dabadbe4dfe930c715a8c82b6c27bb483b8f358c17acac3c4 SHA512 de7212d4b2d6b5868e848db55a3b276ff650bfe46b1fb8df5a6702d6e1408d85ad25b692a95eb26bd5165e8ebf2b2b9bed6fac46d8f6b870698bb32a97c179f3
 DIST knot-3.5.8.tar.xz.asc 833 BLAKE2B d1bf720b9b20478884ec6336722ac09c0e40a401a8b5c1adb58ae0c43adca5ecd8b941f85b53e2b6b4808bfc768315291f33d3a542ca44b75e7e9159269574b6 SHA512 9f85e7db04d310fed38811b7ee86da80bff4571ea974bc39e81d737a1fd4a587a5ff3fdcb6cea7a04c8ab2590d814411f6fc8b3b8e352ce4a7471c24901f26b4
 DIST knot-3.6.0-manpages.tar.xz 42052 BLAKE2B 11c9c090fc5a9ee4b9d695fbc5252dc315d29d8d121e6ee700c9cb6abd619c1d4ebc32ed734596ef5d3f34a74d96791e165e0758f40fa4074c854b4a9aa378b9 SHA512 f224279e8f850b7edf445a794d205c387cbc01671745bf3ca197bbd30e282dd490cd28b73b8b1e23c3add879a3ec07b0e54212764f73f1f451a39195c937e3f9
 DIST knot-3.6.0.tar.xz 1852000 BLAKE2B 454d12deb35c91fd3c3e71cfd4021bd0d36fb39446e3cef41a47df3bbc0362950de1a21eb742d936dbce13a822891b313da335b8bb21026b88d4d985d8c763c0 SHA512 83369a94ce7f35f41b08d599844e4c9586c29ba8efcf841e90560734b81df72054ddd62df609b84149944a36672bb71219c66e6e0c8ee7e41d5c421fc256e64a
 DIST knot-3.6.0.tar.xz.asc 833 BLAKE2B e8e9ca59ba1586854ab8de727dcd29fca23e7bb9a7572015f67e8e0173d2824419c91e6bc44d25ff4771bad59f15d03411dd4f8732174eff9e7d25e582d0b415 SHA512 31985e81306275b1cf1c382b0a97317a7220a1166ae680f1ed6dc02bb16dfe0789ccec3f98947d89d5966494132686169eb70c9222d0beada2f6c02072fa2c99
+DIST knot-3.6.2.tar.xz 1857304 BLAKE2B 185c8a9c3935dfd7a214b40b38fd54136c715ac8defa4bf3080ed7f66d979fbdd8a62f34470456215608ef46fcde494d87772309bec5cab21f1c48efff9efe50 SHA512 a3178530cb8f4e1739a70f4267a543ec285e83139f551a5aac664db38a560309e6e7b3cb6f65d74b7b23b69a4636c918f7eee71f107500b0bc5f6453ac340f0a
+DIST knot-3.6.2.tar.xz.asc 833 BLAKE2B 1e1c31f0525c49ab99840a3e74995d356759853005e69c10b2da8951c690d58cd2f25680cda4495d5250874013bc0d42a487911f1981f46ca3e59dca54939155 SHA512 100a8cf3d72b215e5c67a17badf7af2f6b2dffaebb020ed92fe1e25d3a411172729668d826ec3d29f207c0e5106a112da107b2c034f84e2d6fb54177bb29dbf6
diff --git a/net-dns/knot/files/knot-3.init b/net-dns/knot/files/knot-3.init
index d2be37b17893..c89efa78d60b 100644
--- a/net-dns/knot/files/knot-3.init
+++ b/net-dns/knot/files/knot-3.init
@@ -1,10 +1,9 @@
 #!/sbin/openrc-run
-# Copyright 2024 Gentoo Authors
+# Copyright 2024-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 : ${KNOT_USER:=knot}
 : ${KNOT_GROUP:=knot}
-: ${KNOT_PIDFILE:=/run/knot.pid}
 : ${KNOT_CONFIG:=/etc/knot/knot.conf}
 
 name="knot"
@@ -13,7 +12,7 @@ command="/usr/sbin/knotd"
 command_args="-c ${KNOT_CONFIG}"
 command_user="${KNOT_USER}:${KNOT_GROUP}"
 command_background=true
-pidfile="${KNOT_PIDFILE}"
+pidfile="/run/${RC_SVCNAME}.pid"
 
 extra_commands="checkconfig"
 extra_started_commands="reload"
diff --git a/net-dns/knot/files/knot.confd b/net-dns/knot/files/knot.confd
index f4821e9d725d..8a375a9db0f1 100644
--- a/net-dns/knot/files/knot.confd
+++ b/net-dns/knot/files/knot.confd
@@ -1,7 +1,6 @@
-# Copyright 2024 Gentoo Authors
+# Copyright 2024-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 #KNOT_USER=knot
 #KNOT_GROUP=knot
-#KNOT_PIDFILE=/run/knot.pid
 #KNOT_CONFIG=/etc/knot/knot.conf
diff --git a/net-dns/knot/knot-3.5.6.ebuild b/net-dns/knot/knot-3.5.10.ebuild
index 569a3e11864a..44706041d444 100644
--- a/net-dns/knot/knot-3.5.6.ebuild
+++ b/net-dns/knot/knot-3.5.10.ebuild
@@ -4,7 +4,7 @@
 EAPI=8
 
 PYTHON_COMPAT=( python3_{13..14} )
-inherit autotools eapi9-ver python-r1 systemd tmpfiles verify-sig
+inherit eapi9-ver python-r1 systemd tmpfiles verify-sig
 
 # subslot: libknot major.libdnssec major.libzscanner major
 KNOT_SUBSLOT="16.10.5"
@@ -13,7 +13,6 @@ DESCRIPTION="High-performance authoritative-only DNS server"
 HOMEPAGE="https://www.knot-dns.cz/ https://gitlab.nic.cz/knot/knot-dns"
 SRC_URI="
 	https://knot-dns.nic.cz/release/${P}.tar.xz
-	!doc? ( https://raw.githubusercontent.com/PPN-SD/gentoo-manpages/refs/tags/${P}/${P}-manpages.tar.xz )
 	verify-sig? ( https://knot-dns.nic.cz/release/${P}.tar.xz.asc )
 "
 LICENSE="GPL-2+"
@@ -57,8 +56,8 @@ COMMON_DEPEND="
 	)
 "
 RDEPEND="
-	dev-db/lmdb:=
-	net-libs/gnutls:=[pkcs11?]
+	>=dev-db/lmdb-0.9.15:=
+	>=net-libs/gnutls-3.7.3:=[pkcs11?]
 	daemon? (
 		${COMMON_DEPEND}
 		acct-group/knot
@@ -68,14 +67,14 @@ RDEPEND="
 		dbus? ( sys-apps/dbus )
 		geoip? ( dev-libs/libmaxminddb:= )
 		redis? ( >=dev-libs/hiredis-1.1.0:= )
-		systemd? ( sys-apps/systemd:= )
+		systemd? ( >=sys-apps/systemd-221:= )
 	)
 	prometheus? (
 		dev-python/prometheus-client[${PYTHON_USEDEP}]
 		dev-python/psutil[${PYTHON_USEDEP}]
 	)
 	python? ( ${PYTHON_DEPS} )
-	quic? ( net-libs/ngtcp2[gnutls] )
+	quic? ( >=net-libs/ngtcp2-0.17.0[gnutls] )
 	selinux? ( sec-policy/selinux-knot )
 	utils? (
 		${COMMON_DEPEND}
@@ -132,23 +131,18 @@ src_unpack() {
 	default
 }
 
-src_prepare() {
-	default
-	# avoid the old ltmain.sh modified by upstream which causes a linking issue
-	# reproduced with test and musl
-	eautoreconf
-}
-
 src_configure() {
-	local u
+	use doc || export ac_cv_path_SPHINXBUILD=
+
 	local my_conf=(
 		--with-storage="${EPREFIX}/var/lib/${PN}"
-		--with-rundir="${EPREFIX}/var/run/${PN}"
+		--with-rundir="${EPREFIX}/run/${PN}"
 		$(use_enable caps cap_ng)
 		$(use_enable daemon)
 		# enable-dnstap defines support for kdig only
 		$(use_enable dnstap dnstap $(usex utils))
-		$(use_enable doc documentation)
+		# always enable for manpages
+		--enable-documentation
 		$(use_with doh libnghttp2)
 		$(use_enable fastparser)
 		$(use_enable geoip maxminddb)
@@ -162,6 +156,7 @@ src_configure() {
 	)
 	# modules are only used by daemon
 	# module-dnstap defines support for knotd only
+	local u
 	if use daemon; then
 		for u in "${KNOT_MODULES[@]}"; do
 			my_conf+=( --with-module-${u} )
@@ -193,41 +188,7 @@ src_compile() {
 }
 
 src_install() {
-	if use doc; then
-		local HTML_DOCS=( doc/_build/html/{*.html,*.js,_sources,_static} )
-	else
-		# install the manpages only for the activated options, order from doc/Makefile.am
-		pushd "${WORKDIR}"/man/ >/dev/null || die
-		local manp=()
-		if use daemon; then
-			manp+=(
-				knot.conf.5
-				knotc.8
-				knotd.8
-			)
-		fi
-		if use utils; then
-			use daemon && manp+=(
-				kcatalogprint.8
-				keymgr.8
-				kjournalprint.8
-				kzonecheck.1
-				kzonesign.1
-			)
-			manp+=(
-				kdig.1
-				khost.1
-				knsupdate.1
-				knsec3hash.1
-			)
-			use xdp && manp+=(
-				kxdpgun.8
-			)
-		fi
-		[[ "${#manp[@]}" -ne 0 ]] && doman "${manp[@]}"
-		popd >/dev/null || die
-	fi
-
+	use doc && local HTML_DOCS=( doc/_build/html/{*.html,*.js,_sources,_static} )
 	if use python; then
 		# install only .py files, not build system leftovers (e.g. .in)
 		python_moduleinto libknot
@@ -247,16 +208,26 @@ src_install() {
 	default
 
 	if use daemon; then
-		rm -r "${ED}"/var/run/ || die
+		rm -r "${ED}"/run/ || die
 
-		keepdir /var/lib/knot
+		keepdir /var/lib/${PN}
+
+		fowners -R :knot /etc/${PN}
+		fperms 750 /etc/${PN}
+		fperms 640 /etc/${PN}/${PN}.sample.conf
+		fperms 640 /etc/${PN}/example.com.zone
 
 		newinitd "${FILESDIR}"/knot-3.init knot
 		newconfd "${FILESDIR}"/knot.confd knot
 
+		systemd_dounit distro/common/knot.service
+
 		newtmpfiles "${FILESDIR}"/${PN}.tmpfile ${PN}.conf
 
-		use systemd && systemd_newunit distro/common/knot.service knot.service
+		if use dbus; then
+			insinto /usr/share/dbus-1/system.d
+			doins distro/common/cz.nic.knotd.conf
+		fi
 	fi
 
 	find "${D}" -name '*.la' -delete || die
diff --git a/net-dns/knot/knot-3.5.5-r2.ebuild b/net-dns/knot/knot-3.6.2.ebuild
index 4340d70ec3a9..4545f48cfc00 100644
--- a/net-dns/knot/knot-3.5.5-r2.ebuild
+++ b/net-dns/knot/knot-3.6.2.ebuild
@@ -4,21 +4,21 @@
 EAPI=8
 
 PYTHON_COMPAT=( python3_{13..14} )
-inherit autotools eapi9-ver python-r1 systemd tmpfiles verify-sig
+inherit eapi9-ver python-r1 systemd tmpfiles verify-sig
 
-# subslot: libknot major.libdnssec major.libzscanner major
-KNOT_SUBSLOT="16.10.5"
+# subslot: libknot major.libzscanner major
+KNOT_SUBSLOT="17.5"
 
 DESCRIPTION="High-performance authoritative-only DNS server"
 HOMEPAGE="https://www.knot-dns.cz/ https://gitlab.nic.cz/knot/knot-dns"
 SRC_URI="
 	https://knot-dns.nic.cz/release/${P}.tar.xz
-	!doc? ( https://raw.githubusercontent.com/PPN-SD/gentoo-manpages/refs/tags/${P}/${P}-manpages.tar.xz )
 	verify-sig? ( https://knot-dns.nic.cz/release/${P}.tar.xz.asc )
 "
-LICENSE="GPL-2+"
+# OPENLDAP: include code from lmdb-0.9 for automatic migration to lmdb-1
+LICENSE="GPL-2+ OPENLDAP"
 SLOT="0/${KNOT_SUBSLOT}"
-KEYWORDS="amd64 ~arm64 ~riscv x86"
+KEYWORDS="~amd64 ~arm64 ~riscv ~x86"
 
 # Modules without dep and enabled by default. Built unconditionally.
 KNOT_MODULES=(
@@ -27,6 +27,7 @@ KNOT_MODULES=(
 	"cookies"
 	"dnserr"
 	"dnsproxy"
+	"ecs"
 	"noudp"
 	"onlinesign"
 	"probe"
@@ -57,8 +58,8 @@ COMMON_DEPEND="
 	)
 "
 RDEPEND="
-	dev-db/lmdb:=
-	net-libs/gnutls:=[pkcs11?]
+	>=dev-db/lmdb-0.9.15:=
+	>=net-libs/gnutls-3.7.3:=[pkcs11?]
 	daemon? (
 		${COMMON_DEPEND}
 		acct-group/knot
@@ -68,14 +69,14 @@ RDEPEND="
 		dbus? ( sys-apps/dbus )
 		geoip? ( dev-libs/libmaxminddb:= )
 		redis? ( >=dev-libs/hiredis-1.1.0:= )
-		systemd? ( sys-apps/systemd:= )
+		systemd? ( >=sys-apps/systemd-221:= )
 	)
 	prometheus? (
 		dev-python/prometheus-client[${PYTHON_USEDEP}]
 		dev-python/psutil[${PYTHON_USEDEP}]
 	)
 	python? ( ${PYTHON_DEPS} )
-	quic? ( net-libs/ngtcp2[gnutls] )
+	quic? ( >=net-libs/ngtcp2-0.17.0[gnutls] )
 	selinux? ( sec-policy/selinux-knot )
 	utils? (
 		${COMMON_DEPEND}
@@ -103,6 +104,7 @@ BDEPEND="
 	)
 	python? ( ${PYTHON_DEPS} )
 	test? (
+		elibc_musl? ( sys-libs/timezone-data )
 		pkcs11? ( dev-libs/softhsm )
 	)
 	verify-sig? ( sec-keys/openpgp-keys-knot )
@@ -132,23 +134,18 @@ src_unpack() {
 	default
 }
 
-src_prepare() {
-	default
-	# avoid the old ltmain.sh modified by upstream which causes a linking issue
-	# reproduced with test and musl
-	eautoreconf
-}
-
 src_configure() {
-	local u
+	use doc || export ac_cv_path_SPHINXBUILD=
+
 	local my_conf=(
 		--with-storage="${EPREFIX}/var/lib/${PN}"
-		--with-rundir="${EPREFIX}/var/run/${PN}"
+		--with-rundir="${EPREFIX}/run/${PN}"
 		$(use_enable caps cap_ng)
 		$(use_enable daemon)
 		# enable-dnstap defines support for kdig only
 		$(use_enable dnstap dnstap $(usex utils))
-		$(use_enable doc documentation)
+		# always enable for manpages
+		--enable-documentation
 		$(use_with doh libnghttp2)
 		$(use_enable fastparser)
 		$(use_enable geoip maxminddb)
@@ -162,6 +159,7 @@ src_configure() {
 	)
 	# modules are only used by daemon
 	# module-dnstap defines support for knotd only
+	local u
 	if use daemon; then
 		for u in "${KNOT_MODULES[@]}"; do
 			my_conf+=( --with-module-${u} )
@@ -193,41 +191,7 @@ src_compile() {
 }
 
 src_install() {
-	if use doc; then
-		local HTML_DOCS=( doc/_build/html/{*.html,*.js,_sources,_static} )
-	else
-		# install the manpages only for the activated options, order from doc/Makefile.am
-		pushd "${WORKDIR}"/man/ >/dev/null || die
-		local manp=()
-		if use daemon; then
-			manp+=(
-				knot.conf.5
-				knotc.8
-				knotd.8
-			)
-		fi
-		if use utils; then
-			use daemon && manp+=(
-				kcatalogprint.8
-				keymgr.8
-				kjournalprint.8
-				kzonecheck.1
-				kzonesign.1
-			)
-			manp+=(
-				kdig.1
-				khost.1
-				knsupdate.1
-				knsec3hash.1
-			)
-			use xdp && manp+=(
-				kxdpgun.8
-			)
-		fi
-		[[ "${#manp[@]}" -ne 0 ]] && doman "${manp[@]}"
-		popd >/dev/null || die
-	fi
-
+	use doc && local HTML_DOCS=( doc/_build/html/{*.html,*.js,_sources,_static} )
 	if use python; then
 		# install only .py files, not build system leftovers (e.g. .in)
 		python_moduleinto libknot
@@ -247,16 +211,26 @@ src_install() {
 	default
 
 	if use daemon; then
-		rm -r "${ED}"/var/run/ || die
+		rm -r "${ED}"/run/ || die
 
-		keepdir /var/lib/knot
+		keepdir /var/lib/${PN}
+
+		fowners -R :knot /etc/${PN}
+		fperms 750 /etc/${PN}
+		fperms 640 /etc/${PN}/${PN}.sample.conf
+		fperms 640 /etc/${PN}/example.com.zone
 
 		newinitd "${FILESDIR}"/knot-3.init knot
 		newconfd "${FILESDIR}"/knot.confd knot
 
+		systemd_dounit distro/common/knot.service
+
 		newtmpfiles "${FILESDIR}"/${PN}.tmpfile ${PN}.conf
 
-		use systemd && systemd_newunit distro/common/knot.service knot.service
+		if use dbus; then
+			insinto /usr/share/dbus-1/system.d
+			doins distro/common/cz.nic.knotd.conf
+		fi
 	fi
 
 	find "${D}" -name '*.la' -delete || die
@@ -270,8 +244,8 @@ pkg_postinst() {
 		ewarn "must be loaded by an instance of Redis."
 	fi
 
-	if ver_replacing -lt 3.5; then
+	if ver_replacing -lt 3.6; then
 		elog "See documentation for migration:"
-		elog "https://www.knot-dns.cz/docs/3.5/html/migration.html#upgrade-3-4-x-to-3-5-x"
+		elog "https://www.knot-dns.cz/docs/3.6/html/migration.html#upgrade-3-5-x-to-3-6-x"
 	fi
 }
diff --git a/net-dns/pdns-recursor/Manifest b/net-dns/pdns-recursor/Manifest
index a618d5f98967..275ebc4d4bce 100644
--- a/net-dns/pdns-recursor/Manifest
+++ b/net-dns/pdns-recursor/Manifest
@@ -40,6 +40,7 @@ DIST mio-1.1.1.crate 105630 BLAKE2B db279c3e46108375f5391a5ebc3ae07e8ccbcc9f6a71
 DIST once_cell-1.21.3.crate 34534 BLAKE2B 3578aaef305cad2fdffdc40c392775a3540bfab3f3aeafd22466d9507bf8346b9fcc200929d48525b051070c0aaa423ecbcaa12868b34dca007991effb224166 SHA512 32a87506c6f4598f3ca2c88556014ef2093d5db9a08602335e847caa537a866492fa74c894e7e1da2e4289a1d3dbffcb90a9e37a4a1453203832f434b8206990
 DIST pdns-recursor-5.4.6.tar.xz 1397776 BLAKE2B 5348817622a35eacf1cc3697c5e0a870a8fb9ba5b1bd6d20dce8579be7ae87c3ef627ba6f457bab2bc224f5288c5d75dafebd6d0ccfcd3f8001e56d80ba58f2a SHA512 e998430bf1637d33552b2baea6430aab87cbecae3e4a1634e02fe19f0997a2213b0266b748e41c6c28fbacb6d80d1cc8141c807cd0dec0d70aedbec436da78f0
 DIST pdns-recursor-5.4.7.tar.xz 1398536 BLAKE2B 5133789e245c823dd54b6940d65f6a8e12d6731754132866e18f7b87f68b9046372973add31bc68e845e90012edfe9cbb2d0ea82c7da7a31204b0ca8d4a7f44e SHA512 8d0e026400ac0f14832a5a14e13a06a5f94c44c4771266d1bda59b8d69441e121aa43ec3d3fe70f85bbc06ee7c0bb45ab48035f317739064934bc711db29a730
+DIST pdns-recursor-5.4.8.tar.xz 1399720 BLAKE2B 8af7903bbf66f92a367af411f7f726bc531d15ca32cc2098ff43573f90228ee5699693b3d52815de46a026cadefa853b82f7b3f5d46263a8f398f228f9ff773b SHA512 92b79015316d48aff2bb55a664ad99013e0f31fa02ec686a8b7c8b1f7cfd59fc18f774962bd9ce9f5fe925cdcaa5aae7187dc8e2f525c279c8226528956ab7db
 DIST percent-encoding-2.3.2.crate 11583 BLAKE2B 58925243b23a6a1decc3d92c4ce17d06af5206844ad283b49e69e523ac0db2c36c3f4407af4104ab92c029c2581c228bdf416a054a2531191a9e912448ba4408 SHA512 495b4aac88a7a46420811671d6bd82817e4eb2fe51d5068d11c5b50d0d927895d54c855cb07d4f4ad5a2d42b22f9419ad0183c14781dbfa240804fd49761035a
 DIST pin-project-lite-0.2.16.crate 30504 BLAKE2B efd0b426fcc6ea8852bce499fac61f9755a11c6a2999cbec514f093ba7b3f94b1f2d437ee9abb243e31f3838ac1c74491a212851d7798eb249e209b35e015332 SHA512 971adfe54cfed304647fd944c1c915e78b37eaf0de3a582fb984a5e91f1b7d4db2cf0f53a9a64b64427062d4b41c0a36baddef782411a76ae3be0f8ca45f0718
 DIST pin-utils-0.1.0.crate 7580 BLAKE2B 457e1287202f16d1873b24bf4f1de1828300128c4ba3131758e64f9784d36d47365f22d85493c3a85d854f0d8dbb4c6cef3a0f5b064014dc03943e58b7ba9178 SHA512 828422b8440cc82ac6b0743e0112fa7540d437aed457564999092b1462cd7672cd6b1f0201b67075431aeedd3d9c5127468a3dd028744109944f7f023c82fd70
diff --git a/net-dns/pdns-recursor/files/pdns-recursor-r3 b/net-dns/pdns-recursor/files/pdns-recursor-r3
index 02f8408e275b..a744a3078d62 100644
--- a/net-dns/pdns-recursor/files/pdns-recursor-r3
+++ b/net-dns/pdns-recursor/files/pdns-recursor-r3
@@ -24,6 +24,10 @@ depend() {
 	need net
 }
 
+start_pre() {
+	checkpath -q -d -m 0700 -o pdns:pdns /run/pdns-recursor
+}
+
 ping() {
 	ebegin "Pinging ${name}"
 	${control_command} ${control_command_args} ping >/dev/null 2>&1
diff --git a/net-dns/pdns-recursor/pdns-recursor-5.4.8.ebuild b/net-dns/pdns-recursor/pdns-recursor-5.4.8.ebuild
new file mode 100644
index 000000000000..b50658cad6df
--- /dev/null
+++ b/net-dns/pdns-recursor/pdns-recursor-5.4.8.ebuild
@@ -0,0 +1,197 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+
+RUST_MIN_VER="1.85.0"
+CRATES="
+	anstyle@1.0.13
+	atomic-waker@1.1.2
+	base64@0.22.1
+	bytes@1.11.1
+	cc@1.2.49
+	cfg-if@1.0.4
+	clap@4.5.53
+	clap_builder@4.5.53
+	clap_lex@0.7.6
+	codespan-reporting@0.13.1
+	cxx@1.0.196
+	cxx-build@1.0.196
+	cxxbridge-cmd@1.0.196
+	cxxbridge-flags@1.0.196
+	cxxbridge-macro@1.0.196
+	equivalent@1.0.2
+	find-msvc-tools@0.1.5
+	foldhash@0.2.0
+	form_urlencoded@1.2.2
+	futures-channel@0.3.31
+	futures-core@0.3.31
+	futures-task@0.3.31
+	futures-util@0.3.31
+	getrandom@0.2.16
+	hashbrown@0.16.1
+	http@1.4.0
+	http-body@1.0.1
+	http-body-util@0.1.3
+	httparse@1.10.1
+	httpdate@1.0.3
+	hyper@1.8.1
+	hyper-rustls@0.27.7
+	hyper-util@0.1.19
+	indexmap@2.12.1
+	ipnet@2.11.0
+	itoa@1.0.15
+	libc@0.2.178
+	link-cplusplus@1.0.12
+	mio@1.1.1
+	once_cell@1.21.3
+	percent-encoding@2.3.2
+	pin-project-lite@0.2.16
+	pin-utils@0.1.0
+	proc-macro2@1.0.103
+	quote@1.0.42
+	ring@0.17.14
+	rustls@0.23.35
+	rustls-pki-types@1.13.1
+	rustls-webpki@0.103.13
+	ryu@1.0.20
+	scratch@1.0.9
+	serde@1.0.228
+	serde_core@1.0.228
+	serde_derive@1.0.228
+	serde_yaml@0.9.34+deprecated
+	shlex@1.3.0
+	smallvec@1.15.1
+	socket2@0.6.1
+	strsim@0.11.1
+	subtle@2.6.1
+	syn@2.0.111
+	termcolor@1.4.1
+	tokio@1.48.0
+	tokio-rustls@0.26.4
+	tower-service@0.3.3
+	tracing@0.1.43
+	tracing-core@0.1.35
+	try-lock@0.2.5
+	unicode-ident@1.0.22
+	unicode-width@0.2.2
+	unsafe-libyaml@0.2.11
+	untrusted@0.9.0
+	want@0.3.1
+	wasi@0.11.1+wasi-snapshot-preview1
+	winapi-util@0.1.11
+	windows-link@0.2.1
+	windows-sys@0.52.0
+	windows-sys@0.60.2
+	windows-sys@0.61.2
+	windows-targets@0.52.6
+	windows-targets@0.53.5
+	windows_aarch64_gnullvm@0.52.6
+	windows_aarch64_gnullvm@0.53.1
+	windows_aarch64_msvc@0.52.6
+	windows_aarch64_msvc@0.53.1
+	windows_i686_gnu@0.52.6
+	windows_i686_gnu@0.53.1
+	windows_i686_gnullvm@0.52.6
+	windows_i686_gnullvm@0.53.1
+	windows_i686_msvc@0.52.6
+	windows_i686_msvc@0.53.1
+	windows_x86_64_gnu@0.52.6
+	windows_x86_64_gnu@0.53.1
+	windows_x86_64_gnullvm@0.52.6
+	windows_x86_64_gnullvm@0.53.1
+	windows_x86_64_msvc@0.52.6
+	windows_x86_64_msvc@0.53.1
+	zeroize@1.8.2
+"
+
+inherit cargo flag-o-matic lua-single
+
+DESCRIPTION="The PowerDNS Recursor"
+HOMEPAGE="https://www.powerdns.com/"
+SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.xz ${CARGO_CRATE_URIS}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~x86"
+IUSE="debug dns-over-tls dnstap snmp sodium systemd test valgrind"
+REQUIRED_USE="${LUA_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+DEPEND="${LUA_DEPS}
+	dnstap? ( dev-libs/fstrm )
+	systemd? ( sys-apps/systemd:0= )
+	snmp? ( net-analyzer/net-snmp )
+	sodium? ( dev-libs/libsodium:= )
+	elibc_glibc? (
+		arm? ( >=sys-libs/glibc-2.34 )
+		x86? ( >=sys-libs/glibc-2.34 )
+	)
+	dev-libs/openssl:=
+	>=dev-libs/boost-1.54:=[context]"
+RDEPEND="${DEPEND}
+	!<net-dns/pdns-2.9.20-r1
+	acct-user/pdns
+	acct-group/pdns"
+DEPEND="${DEPEND}
+	valgrind? ( dev-debug/valgrind )"
+BDEPEND="virtual/pkgconfig"
+
+S="${WORKDIR}"/${P/_/-}
+
+pkg_setup() {
+	lua-single_pkg_setup
+	filter-flags -ftree-vectorize
+	filter-lto
+	rust_pkg_setup
+}
+
+src_configure() {
+	econf \
+		--enable-experimental-64bit-time_t-support-on-glibc \
+		--sysconfdir=/etc/powerdns \
+		--with-nod-cache-dir=/var/lib/powerdns \
+		--with-service-user=pdns \
+		--with-service-group=pdns \
+		--with-lua="${ELUA}" \
+		$(use_enable debug verbose-logging) \
+		$(use_enable systemd) \
+		$(use_enable dns-over-tls) \
+		$(use_enable dnstap dnstap) \
+		$(use_enable test unit-tests) \
+		$(use_enable valgrind) \
+		$(use_with sodium libsodium) \
+		$(use_with snmp net-snmp)
+}
+
+src_compile() {
+	default
+}
+
+src_install() {
+	default
+
+	# rename .yml to .conf to facilitate easy upgrade and switch to .yml
+	mv "${D}"/etc/powerdns/recursor.{yml-dist,conf} || die
+
+	sed -i \
+		-e 's/^#   set\([ug]\)id: '\'\''$/    set\1id: '\''pdns'\''/' \
+		-e 's/^#   chroot: '\'\''$/    chroot: '\''\/var\/lib\/powerdns'\''/' \
+		"${D}"/etc/powerdns/recursor.conf || die
+
+	newinitd "${FILESDIR}"/pdns-recursor-r3 pdns-recursor
+
+	keepdir /var/lib/powerdns
+}
+
+src_test() {
+	default
+}
+
+pkg_postinst() {
+	einfo "Starting with 5.1.x we default to using the new yaml configuration file format."
+	einfo "The old configuration file format is still supported for now, but please update"
+	einfo "your recursor.conf to yaml using 'rec_control show-yaml'."
+}
diff --git a/net-dns/pdns/Manifest b/net-dns/pdns/Manifest
index 7db3b1c05dae..20f09e9e2aee 100644
--- a/net-dns/pdns/Manifest
+++ b/net-dns/pdns/Manifest
@@ -1 +1,2 @@
 DIST pdns-5.1.4.tar.bz2 1536977 BLAKE2B 3c0a4487f1e00925459b71d1ca6a06b21ed2489f209ed599b7e6f6068fb41e434b89474f46644ef7eca09aaf541164708b4be49ec9821ceb1728955101094e2a SHA512 63289f93af4c50176565a6cbcf387ee40645b9a16166eb9cb9fad2d743aba989839e9a8476388c027fa752762d02215095ec2803eca846fbcdbd0fcd40a2a6d9
+DIST pdns-5.1.5.tar.bz2 1556885 BLAKE2B 3bbcca509d440b20c257d5f73a813ab9571645ca8ce83d755e1b0edba8887c77f9c70f30a61943e888367bf8d5e24ef7fe18065e29392118903688bfba8a6ef0 SHA512 8b45a69dbbb40ecd2fc328d2aaabd1cb5a36c3ee3525b42ef499c0e9343c442279139f0eafd5d7d9853169ad70db8662af60e84e1b3df318c9e74306624337fd
diff --git a/net-dns/pdns/pdns-5.1.5.ebuild b/net-dns/pdns/pdns-5.1.5.ebuild
new file mode 100644
index 000000000000..b92d9d7b95e1
--- /dev/null
+++ b/net-dns/pdns/pdns-5.1.5.ebuild
@@ -0,0 +1,145 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit lua-single python-any-r1
+
+DESCRIPTION="The PowerDNS Daemon"
+HOMEPAGE="https://www.powerdns.com/"
+SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+IUSE="debug doc geoip ldap lmdb lua-records maxminddb mysql odbc postgres remote sodium sqlite systemd tools tinydns test"
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="${LUA_REQUIRED_USE}"
+
+DEPEND="${LUA_DEPS}
+	dev-libs/openssl:=
+	dev-libs/boost:=
+	lmdb? ( >=dev-db/lmdb-0.9.29 )
+	lua-records? ( >=net-misc/curl-7.21.3 )
+	mysql? ( dev-db/mysql-connector-c:= )
+	postgres? ( dev-db/postgresql:= )
+	ldap? ( >=net-nds/openldap-2.0.27-r4:= app-crypt/mit-krb5 )
+	odbc? ( dev-db/unixODBC )
+	sqlite? ( dev-db/sqlite:3 )
+	geoip? ( >=dev-cpp/yaml-cpp-0.5.1:= dev-libs/geoip )
+	maxminddb? ( >=dev-cpp/yaml-cpp-0.5.1:= dev-libs/libmaxminddb:= )
+	sodium? ( dev-libs/libsodium:= )
+	tinydns? ( >=dev-db/tinycdb-0.77 )
+	elibc_glibc? ( x86? ( >=sys-libs/glibc-2.34 ) )"
+RDEPEND="${DEPEND}
+	acct-user/pdns
+	acct-group/pdns"
+
+BDEPEND="${PYTHON_DEPS}
+	virtual/pkgconfig
+	doc? ( app-text/doxygen[dot] )"
+
+S="${WORKDIR}"/${P/_/-}
+
+pkg_setup() {
+	lua-single_pkg_setup
+	python-any-r1_pkg_setup
+}
+
+geoipbackend_disable() {
+	local lib="${1}"
+	sed -i \
+		-e "/^${lib}_\(CFLAGS\|LIBS\) = / s/ = .*/ = /" \
+		modules/geoipbackend/Makefile || die
+	echo "#undef HAVE_${lib}" >>config.h || die
+}
+
+src_configure() {
+	local cnf_dynmodules="bind lua2 pipe" # the default backends, always enabled
+
+	use geoip || use maxminddb && cnf_dynmodules+=" geoip"
+	use ldap && cnf_dynmodules+=" ldap"
+	use lmdb && cnf_dynmodules+=" lmdb"
+	use mysql && cnf_dynmodules+=" gmysql"
+	use odbc && cnf_dynmodules+=" godbc"
+	use postgres && cnf_dynmodules+=" gpgsql"
+	use remote && cnf_dynmodules+=" remote"
+	use sqlite && cnf_dynmodules+=" gsqlite3"
+	use tinydns && cnf_dynmodules+=" tinydns"
+
+	econf \
+		--enable-experimental-64bit-time_t-support-on-glibc \
+		--disable-static \
+		--sysconfdir=/etc/powerdns \
+		--libdir=/usr/$(get_libdir)/powerdns \
+		--with-service-user=pdns \
+		--with-service-group=pdns \
+		--with-modules= \
+		--with-dynmodules="${cnf_dynmodules}" \
+		--with-mysql-lib=/usr/$(get_libdir) \
+		--with-lua="${ELUA}" \
+		$(use_enable debug verbose-logging) \
+		$(use_enable lua-records) \
+		$(use_enable test unit-tests) \
+		$(use_enable tools) \
+		$(use_enable systemd) \
+		$(use_with sodium libsodium)
+
+	# Force automagic detected support to be disabled
+	use geoip || geoipbackend_disable GEOIP
+	use maxminddb || geoipbackend_disable MMDB
+}
+
+src_compile() {
+	default
+	use doc && emake -C codedocs codedocs
+}
+
+src_install() {
+	default
+
+	mv "${D}"/etc/powerdns/pdns.conf{-dist,}
+
+	fperms 0700 /etc/powerdns
+	fperms 0600 /etc/powerdns/pdns.conf
+
+	# set defaults: setuid=pdns, setgid=pdns
+	sed -i \
+		-e 's/^# set\([ug]\)id=$/set\1id=pdns/g' \
+		"${D}"/etc/powerdns/pdns.conf
+
+	newinitd "${FILESDIR}"/pdns-r1 pdns
+
+	keepdir /var/empty
+
+	if use doc; then
+		docinto html
+		dodoc -r codedocs/html/.
+	fi
+
+	# Install development headers
+	insinto /usr/include/pdns
+	doins pdns/*.hh
+	insinto /usr/include/pdns/backends/gsql
+	doins pdns/backends/gsql/*.hh
+
+	if use ldap ; then
+		insinto /etc/openldap/schema
+		doins "${FILESDIR}"/dnsdomain2.schema
+	fi
+
+	find "${D}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	elog "PowerDNS provides multiple instances support. You can create more instances"
+	elog "by symlinking the pdns init script to another name."
+	elog
+	elog "The name must be in the format pdns.<suffix> and PowerDNS will use the"
+	elog "/etc/powerdns/pdns-<suffix>.conf configuration file instead of the default."
+}
diff --git a/net-dns/redis-knot/Manifest b/net-dns/redis-knot/Manifest
index e0d9155cbf1c..e1e73a054196 100644
--- a/net-dns/redis-knot/Manifest
+++ b/net-dns/redis-knot/Manifest
@@ -1,8 +1,8 @@
-DIST knot-3.5.5.tar.xz 1734192 BLAKE2B 5ee478109a26e3b163da169e7e22a03780727528f84953e399f25670d48392b6b407388c38b152bc90399f517b70676168735c1aba4028326237b92cdf904938 SHA512 983789c7fbbb191d4bd8e9f13050a5d5310a8bc69184b6d3440711fff88fa631ca6703b0800dd5581bd84850b4253dddfb36c2bdd46f6f158333b5ad934fdfdc
-DIST knot-3.5.5.tar.xz.asc 833 BLAKE2B 478aa1fba542f1e5cf00ea35af2d99cf2fe1b88e566dbc056696542e74508f58790c14a88e74a09bb06247a811a58bd4534e7d36cea6825f2111b9020c21e190 SHA512 b20be4fde7d62954898e8e1e9b9d81cad5a543d7d7636fcccebaa313905491c900f7c02c0782b8287f6262736bd08a1a208cda5557776dbeed8aaab589ef1b68
-DIST knot-3.5.6.tar.xz 1734776 BLAKE2B f03a2da9390e89bd7955505d3f59ca54689e2183b1ea0f82efbf5abedd71f16902c6d09f77adceaedd29573d52135c168441dbf46721709b370269220b68f49b SHA512 bd1818552ab076a007aae2d14fdae053e7ffabb37bcfd6cd4485b866fe2d80675f3a4367a87afe4c4a32ea529a503f2b6857632eb74f7cac0598f15b093d286b
-DIST knot-3.5.6.tar.xz.asc 833 BLAKE2B e50abb5e54db106e965ea01d8bed5ee183cc98922368d58144552cb2a6a55af738abd44195624397fc965fead72a687c8cd76554f60ea34013a6b2e6e94652ef SHA512 5647f932b145d6a4fd12e205fe895fe18df67a3e9c33a8bb3fc93b93762bbe46a359b86cf2482e0089eddb8fbe9fe22f306df94527804c9b3bf35631914c1101
+DIST knot-3.5.10.tar.xz 1772508 BLAKE2B 6dac5723600c11b78a58a6986f922c6235489620ae66f70339bb021fb9d3d0c66e523cd38ca2c4cf2864804a4190058b9f1c8754ebe5e66b607abcb09edef0b4 SHA512 1e3c65e8f336b54c73b3fa5ee0b600c28243ba0a8909b814658d5a87388f518e5340e10562d913d1c999ea969cefda64b01354cf792fb0661751b9c4e93a66a1
+DIST knot-3.5.10.tar.xz.asc 833 BLAKE2B 84df2f415667704bf076e8d989d9de84c9dd44df153878e5032ff9b863ac11257e3f63a8ea7924ed4c33d25230aede1c65a76f1c3afe41da78b534de587134b7 SHA512 51904a6c8632b27b643a94bcfb83c1074f029c8ca9ed86fe1e41da76220a5075b836b5d45652c58bdefdeffe865cdb5b214d912b5de4e27702d6247ce4ebcd24
 DIST knot-3.5.8.tar.xz 1736408 BLAKE2B e7793b469c7782a3aa14c8e02fb038d8d1d943283a9cd4dde7bee6a7296d5c4149e0752f8741317dabadbe4dfe930c715a8c82b6c27bb483b8f358c17acac3c4 SHA512 de7212d4b2d6b5868e848db55a3b276ff650bfe46b1fb8df5a6702d6e1408d85ad25b692a95eb26bd5165e8ebf2b2b9bed6fac46d8f6b870698bb32a97c179f3
 DIST knot-3.5.8.tar.xz.asc 833 BLAKE2B d1bf720b9b20478884ec6336722ac09c0e40a401a8b5c1adb58ae0c43adca5ecd8b941f85b53e2b6b4808bfc768315291f33d3a542ca44b75e7e9159269574b6 SHA512 9f85e7db04d310fed38811b7ee86da80bff4571ea974bc39e81d737a1fd4a587a5ff3fdcb6cea7a04c8ab2590d814411f6fc8b3b8e352ce4a7471c24901f26b4
 DIST knot-3.6.0.tar.xz 1852000 BLAKE2B 454d12deb35c91fd3c3e71cfd4021bd0d36fb39446e3cef41a47df3bbc0362950de1a21eb742d936dbce13a822891b313da335b8bb21026b88d4d985d8c763c0 SHA512 83369a94ce7f35f41b08d599844e4c9586c29ba8efcf841e90560734b81df72054ddd62df609b84149944a36672bb71219c66e6e0c8ee7e41d5c421fc256e64a
 DIST knot-3.6.0.tar.xz.asc 833 BLAKE2B e8e9ca59ba1586854ab8de727dcd29fca23e7bb9a7572015f67e8e0173d2824419c91e6bc44d25ff4771bad59f15d03411dd4f8732174eff9e7d25e582d0b415 SHA512 31985e81306275b1cf1c382b0a97317a7220a1166ae680f1ed6dc02bb16dfe0789ccec3f98947d89d5966494132686169eb70c9222d0beada2f6c02072fa2c99
+DIST knot-3.6.2.tar.xz 1857304 BLAKE2B 185c8a9c3935dfd7a214b40b38fd54136c715ac8defa4bf3080ed7f66d979fbdd8a62f34470456215608ef46fcde494d87772309bec5cab21f1c48efff9efe50 SHA512 a3178530cb8f4e1739a70f4267a543ec285e83139f551a5aac664db38a560309e6e7b3cb6f65d74b7b23b69a4636c918f7eee71f107500b0bc5f6453ac340f0a
+DIST knot-3.6.2.tar.xz.asc 833 BLAKE2B 1e1c31f0525c49ab99840a3e74995d356759853005e69c10b2da8951c690d58cd2f25680cda4495d5250874013bc0d42a487911f1981f46ca3e59dca54939155 SHA512 100a8cf3d72b215e5c67a17badf7af2f6b2dffaebb020ed92fe1e25d3a411172729668d826ec3d29f207c0e5106a112da107b2c034f84e2d6fb54177bb29dbf6
diff --git a/net-dns/redis-knot/redis-knot-3.5.6.ebuild b/net-dns/redis-knot/redis-knot-3.5.10.ebuild
index d8199f90a76b..d8199f90a76b 100644
--- a/net-dns/redis-knot/redis-knot-3.5.6.ebuild
+++ b/net-dns/redis-knot/redis-knot-3.5.10.ebuild
diff --git a/net-dns/redis-knot/redis-knot-3.5.5.ebuild b/net-dns/redis-knot/redis-knot-3.6.2.ebuild
index 66a569e2c362..d8199f90a76b 100644
--- a/net-dns/redis-knot/redis-knot-3.5.5.ebuild
+++ b/net-dns/redis-knot/redis-knot-3.6.2.ebuild
@@ -17,7 +17,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="LGPL-2.1+"
 SLOT="0"
-KEYWORDS="amd64 ~arm64 ~riscv x86"
+KEYWORDS="~amd64 ~arm64 ~riscv ~x86"
 
 # no test, it requires a Redis instance and RLTest (not packaged)
 BDEPEND="verify-sig? ( sec-keys/openpgp-keys-knot )"
diff --git a/net-proxy/mitmproxy-linux/Manifest b/net-proxy/mitmproxy-linux/Manifest
index 81cd24c72b1d..879e2d424699 100644
--- a/net-proxy/mitmproxy-linux/Manifest
+++ b/net-proxy/mitmproxy-linux/Manifest
@@ -1,55 +1,42 @@
-DIST addr2line-0.25.0.crate 41982 BLAKE2B 0401c84ba99e49f1879e65f94b288f4f170f1fe9636647000461144c22f96ee8e222068318002c9d8202a21e338c41986fc008e5b2eac572e409a719c0a62591 SHA512 98c3184fb0d57968b1d27526002d476fbffa21493335d254d5d14dd975a7f579c14c8aa3cde196c63f2344093f3aaeb840222de54b0c09787c130f1b643f9c03
 DIST addr2line-0.25.1.crate 43134 BLAKE2B 1538b50e123fe0a3fa0940ba4718cc86720e63f874fc7d949917720feb57e6daefa471caaee4c14e200ca385af738effd388861982c128933390b6a6227b7d2d SHA512 c400f3b6ccaff8a1c0d7d82c708a1784b8fd5ba64b6e420e85819d59b1cadb55fa59c852925093b921469f272d1d5140cf12f013ae75d1e1bc85021097df8fc2
-DIST adler2-2.0.1.crate 13366 BLAKE2B 3b28bbd7f89424567ff1bb36b984bf4fd767370459f5548545218cbe1c9f082fedd932fccc7e6acd83a1dfa06a371124801a772e5555ede7d6c2cd1ac57930a4 SHA512 555b2b7ba6f8116acccd0bcd16ed34cc78162c81023cff31a8566ffcd456c03832089fca2d5b668ceaac4fe8f922d31aa9c487f226a36cace294ff4a219bd91d
-DIST boringtun-2f3c85f5c4a601018c10b464b1ca890d9504bf6e.gh.tar.gz 219297 BLAKE2B af42c888259ce9d0d36c8b6925459e86fac14059e6b8a3532783050d77627f91c4cd7a0b61bd290e86bbe37ab155d9f798f5478b0f09650dabba08cdc9f60696 SHA512 485675e3fa9317d09814a67162199691df87d04b970c4f69536607584b07f6ab8d2379ef89b22d674e569b8a874a1298bc59a8537c077c81658594bbd502470e
-DIST cfg-if-1.0.1.crate 8683 BLAKE2B 7d7f98e46b98e0f6fe069fff5dede72390adb7522f13be35c37f99713641e98dff87bd58e594908565a6f42ec898f11597e8a82a01ca2e8e65b38563e09956a8 SHA512 56af0d562fe60022e8df9c5b4e9b2eed6d7ca1874c4d3bbb52148d6f3c6f7d30e0b63d4b1e652ccfc8881a663fb6f450a48447d5a8cce0c2e5a2ac12c6ac655f
-DIST compiler_builtins-0.1.160.crate 242364 BLAKE2B c85996e22b19e08eb4fb0d679b0b357d60f072ed2611b332d042f6d02d02f5c8fad6bad32baa5c86d5142ddeb79ff939fbb25ed68a9f8134f4a25c6cb961387c SHA512 b8a10cf1b1b42fdc070ba7b3ea4a018c912beb1540b1aef2622302e6ad876b1d488c8ef08b90d2fcab4d32d9c836c0fa552c52c1fe96afc2ad0e1be95c3ef6f6
-DIST dlmalloc-0.2.10.crate 86645 BLAKE2B e0b0369c83a5853ccc361439c33cce90b0448cfc00550d76bf49fd29095ad4528b65c513c77c2208ab09684c24721c4abf5f0dce378605da8361dc3e3f2cdc9e SHA512 5e04bfae17685a5b55f2d2550a790e73c5b377cde82c113275cf80e60c258746cf8f236942bc0717c96fd753332a7cb051ff773b7af6cc410061200b88857a81
+DIST addr2line-0.27.1.crate 43584 BLAKE2B 6fff579e446d40e1e5244cef6bc5ae39353938fa6d18dd0bd829c6aacf070efa6e1e6ccb99be334ff722ec1504d3f898963076bca8e7f4dae7f00d2efdceb473 SHA512 0a5c5495da259972662a70028786af8ecaae2ab1d996757530fe8f6d5e72e609b802fb1961bad933a62b49cbffaa3de4831f28e1dcdefcf82e035d4f8cd59798
 DIST dlmalloc-0.2.11.crate 86742 BLAKE2B 78c25b9fc71c2827d81325f454060c533c113ef7d60c4d9ee7676c088ebd2814c6d13a9afc0f33844265a0f66e783da5bad77d129acd2768ca491642d5bb0ef5 SHA512 d53ccf5558782cd8f83a9e81576918c824f7f24be9b57edc60e7d865388d2766c93a4e9901dce2d63423f351bf63adb7e6c61661b27470b608997bee0a58b118
 DIST dlmalloc-0.2.13.crate 27636 BLAKE2B 98827337808476d78259cf7a17870a2cf7ad4a84e25a8fe00a27f7e2778ba2e62b6e9f038e4d7a6cbee76a6bc0801ab904ee8966c33c959b8d3ececec210dafe SHA512 b62571ded7e5fb0a62e4da7f419b78167addbbdcd8e4fad7e43968394d8030b932c9f23dc6052b106abf9cdd3ef5858c43300235d734989301250743e8e501ae
-DIST dlmalloc-0.2.9.crate 85868 BLAKE2B c9b3f2b2ad3d43d4559ef0c390de5eb77c2e83c08bfb5a1a050a49d0e6f45391f4597efec8150267d346b09aa26e4b9f244b5d09333ec4154a386daef3f2c413 SHA512 5a9397b0d65f1f10d8e3e7bd84266129dd6a4e2a7c2822e84249121bb0badff15fb530242984efaa78744d919f49658d3c425d9f89dc2741b139eafa71b14ade
+DIST dlmalloc-0.2.14.crate 33285 BLAKE2B 605adfb88a4208eded6c75f66b85a8e2481f6b2caf700e51dbaf0efd79b7ff4393ab973513c9ae1ddb1f474c405fd230fa93fd6723d50ab2c6f52d71de0a8d3d SHA512 48014190fd00ce900138baac576002fef1976acb2d5c58016c27280e709d29a359bff4bf13a309cb2509034e30ae437b86c1c7b16c3e5b8d63acbf00f28a4f66
 DIST foldhash-0.2.0.crate 23329 BLAKE2B 49af83a79ca7954f05d8a52566d7d20cbe057c89c2c767ef76b4c8d83bf099196d053054c8fbaac74da7fd5eb0224fe43731102f2f0bcb18ccdbc0c8150774c3 SHA512 1495281089a8a1b7bbacf8004a5e8051bb00bf37718e9ddce9d43e4e198f529135f864b6850ee4422456b0d4731ae58647f0a1aaae0d67921c389f5d108fc163
-DIST fortanix-sgx-abi-0.5.0.crate 13334 BLAKE2B ccdfdd2e7a0592b0efcd4269695b7367e1e6fd2da7aac3b6e2b174375e787ec00134c3156286656155839367c031aabb748e50c15aa539ab3b3da22de3fef132 SHA512 4239bd0fe3a2c9e0b4a0e0eb82bacb417e1f798fb4d908bb5cc021ddfe6e41688f8ee16f9a18cda692ef78afb264a440af7444cfde43a0c29d0299781ea43ccb
 DIST fortanix-sgx-abi-0.6.1.crate 13691 BLAKE2B e97992a0e93a290bef2adc7115a158385c0c8b59f50744a2a6c7a3b73d164c3dc7b6278118062c64cac98234d9ffffdb94365e79bb489ead5f48c222d87c8771 SHA512 422cee56dfc9066c2c9de032ba92ea5b9cd572193a10b94ce2a9886fb0875375497e7c46b4bc3684d14293b4f82733b519663c807bf73ded62e9c5b1cdd08b64
-DIST getopts-0.2.23.crate 21409 BLAKE2B fbe2c229f7aff2bdaac17ff5c670363c135e69651cb924af1950d79c7eace1616a30425a181cd0116004ca8167bcb1364e208d92ad16a2280f1e77798d680657 SHA512 8d4c08e88a8532d107052c34305b6381e8759958a12eafe8791816fbed85e405fe901aa11c8a8e0110a6d44f87cd1f55a332d2c76c7c12d13a86e00731842e43
 DIST getopts-0.2.24.crate 21467 BLAKE2B e5468cb141bc8be43ec84606c873fa6e16a49e902e247f7c38a08c6e8088d36964d99b41ae3a98a5350cd8fd15ee8d46762b818c79d1198c0aed576de191b640 SHA512 3b0fd721340f732d3ed3dee38c61a46d83c920d24d96fdc780927c2a02fb9a6910eca4caa57db83d500d76bfb0e7f424a166204fcc4c5a4d87ca3ed30008f5aa
-DIST gimli-0.32.0.crate 286715 BLAKE2B 761fa6ceaf967f03b235e07f05d596ea0535cbb38678f6c543f8ca682058450e29e82ffaf3960689b945646db0d2b7afe503ac4d6bdaa52c3ad4de7315295d73 SHA512 9ba4a781c98507fb5a4cd3a8a0fccc03cae5a78eb7e67d001f02396e157b340d6aabf96b7ce54e89bbc00ab61921d3434c355aa0b0b7b968056db2f526392c96
 DIST gimli-0.32.3.crate 289789 BLAKE2B d2794b527c4e0fc8ba10d12711deba8606bbbbe3625227d9b886b3d6846760d9dbc7ec258fbc13673017bb0706a9cdcd573b760d21857fc55deaec7b4be30994 SHA512 e3ec768bcec1e4232b46d7c0a63470d5d966098017d344001ff600587df9ff8419b133b2037fd0869946414718da0da9285b1255468dd5375e46bed3d3a95503
-DIST hashbrown-0.15.4.crate 140447 BLAKE2B f0b1aeaa46dc1354a9558d405bd1cbf72723e8a61a3322743f8bd6d2c17b336b9eedad27756799a054633797373b56b2b957d5ad923b19751074f0294f63d0b2 SHA512 bc96bfe26897240a370fe221515b5ad1dbd07c11de0cbfc1f7721ffbd97546b43a82a88461b3390a6edce9faeb156ca369ed95eecb29fa82c35726a325c26b52
+DIST gimli-0.34.0.crate 335386 BLAKE2B a9e8deef05c4150409d6d4328f1de3b898f6624d21474e99ea32635211ead3617c68b849a6d1a39d2a6b8ba8dca0243bb82658c4f028525d1fc2d0cb35b87baa SHA512 f2de1b87b77ac60cc6e96b56c1e6892dacc6d78817d5cb1bd3d748f900d8ecc01e63947efcf31fd8838ba062ba03dee59be38a786f9e8a8e9b2d29c7a38281d0
 DIST hashbrown-0.16.1.crate 147785 BLAKE2B c506e64340b65fb462545c52e85a192b21e33025c91adf1d8255e799e8a5743814c60be971db56c0b9b1208dff8147ed4a28d8e37caf8f5646fd367d8d0bc9d7 SHA512 0739f1b2101488f88778e221d86738ce557b8ae12470e2a4444099eb90d876382030d00e789dd4ee44dcd7833a87a6e570fa11ba5823beb1cab3a56784ec2669
 DIST hermit-abi-0.5.2.crate 17435 BLAKE2B 695192149342273199ffb026de57e2d906249757b9b4bbceb6b40d3b2298a942a75390aeaa3ad4cad71e5d44687379dfc49598bacdb2cf989ab48864c4b2b517 SHA512 0392a8350288e5d500967bee8e98626024b47a7da331f833b9528bd7318cf43f41eefa46aa6aebd19febfadcbcb2d7c9f70d6ca3631c1618d63c60366dbe7c15
-DIST libc-0.2.174.crate 779933 BLAKE2B 20ffcbbcad6961e732521940f0595039dc0576d85b2d3b2ad3f1decd37571132a4cd7505b2e108078a4379fc4cec46290b5633bcbcc6e7009c3b474c1a852628 SHA512 243f2ffd5741ef859e4dc5b7ee0396071943b1d10429efcaecb322957e256c4be88a7a649029dfd47e6456acc73ee257893fb6c4e8b4d0fe66a12bc5d1c13c73
 DIST libc-0.2.178.crate 783720 BLAKE2B 72f5fecacf0494b3962ff893d647155af88e9942b14d110e521b25e5d65d95d41dc00f83431b82632a53c6e0ae7fd537d018d7bf29df65d5e56b908a893d77d0 SHA512 968b954e2edde88d14135decd9eaadc31ca1aad80529a6696591c06c4414d615c97ce0873f77bfebe08b862faa5f3cb79a6648ab90734d462bef06e06ea43dde
 DIST libc-0.2.183.crate 816918 BLAKE2B d0c26ca25b0808575aa540a5f0f43acaaa5a972269c5f101122538a1733b37b6aac3696a0d7298fe16974b06efb0b92072252eef40b17b977af24cc857963daf SHA512 017986d4fa8c362f8900c1c82c7381066382a7272cfe114243b8d47637d042c87b5ebef7881cf46727e00e541a0a8270a32db694ce8d78372672cf08224a90b2
 DIST libc-0.2.185.crate 821775 BLAKE2B e0e93466a29c9d19f7d9ab3581b491908d06873a9c57a96b0cae2eed0f0d1cb184ebe80bc61e36d5ab316ab35dca529a322b29e6895f7f339e72c79cca7f8ca2 SHA512 c8dbcaaf2e5d8377a4d1003af4a7210fbfe4f9b1e8497f07d88a231a8d5c9f67014e650a5e18e913e7b4d6a1835c4cbc9c31ce0cd224ea28acbdbb39034a300e
-DIST memchr-2.7.5.crate 97603 BLAKE2B ee41ef722d90265064db3ffe22d52eff8f7627ac1ae9b0bad6ca9fa06c1027dca8d67e594e03b03c944dbf85930d2dbf030c5aaed369020ca1a1ba00f153d91a SHA512 2606ee16a7dc02db95dac17cebd2cac9deb2e23d7ea62972cdb19145c06eaf75631347a49c4e6ceeff89fb6e90e992f9bca0a9c955eb5130f89ba2bd865936e1
 DIST memchr-2.7.6.crate 97616 BLAKE2B 3429786e97f1aa078892e417c8ed8198ec727969517309049b842e44097e58038583508aa974e6246888c18e11f9d23863c1bb012b542c5685250fe34e250d7b SHA512 38843817334da88ad74ce679b4401cf948cf8138815f3acc5eb0d005da3aabceb2216e20887e79344396569a2fa136e3aa1f7f3251a00d07dd6934cee79f4fad
-DIST miniz_oxide-0.8.9.crate 67132 BLAKE2B 1a11c5aeef43ac93635942e0c4f17538150f8307fb280b0d66436e4b6697638f0b1bafbdebb377a5dba14a75f213024201e325747419623e5f7d57060bba4445 SHA512 3f6fd786c5fa5b4abafaf21244dd4830d26688d5b6975522bda595206517f354d92d13fb95235667cbc39c0275371c737164d9c7a58e32e09da86eed2f239242
-DIST mitmproxy_linux-0.12.10.tar.gz 1297842 BLAKE2B 5de458088ff7e3026e491735bc0a556cc4e272a3b63a10ba74b95f624238e0664cdb8081daa093ee21a745b81fc275f3e6deb5278ca35189cde1dae4cc48b324 SHA512 230cf9a6712cce6ed9e6af26cf3961622a168617958bcbab1d2dae414f96b1c4d4da52960cdb197d44aec948baed3d9f4f2a065a8565befbc3c7f0e27564d08e
+DIST miniz_oxide-0.9.1.crate 70519 BLAKE2B 4ae01532c37a6b745bc7d8a7ad5e61bf83a389f98244ac8d6d20f44b1ef157fef7ade9b8ff2609ef69db4dd94cd31589cd5c59d04ca6c682a2be0e24af15c214 SHA512 6f3688acb94d702264f9a244dce31a6e0ed6ffa4ad198aedc04ce6da3a573df96de51c64f1d13ee0af59a7102450c420710eca99d1be8a15cdd2ed5a66819864
 DIST mitmproxy_linux-0.12.11.tar.gz 1297950 BLAKE2B 09bd7d12103306a1e8db28cf1ce99572b1887984383cf33181452f8fe8e951bf8cb80f12cb928614ff10f546049696c3486066058c5abd5254926c8a361bee88 SHA512 2e658fa7d3ae52334f87906f003a6ebaee88071416a776f8fa2fe5eaf4907302525ab0cdca38e975875e81188ff77b4b44b2b8e868881e53f760f7cd76ced6d6
-DIST mitmproxy_linux-0.12.9.tar.gz 1299779 BLAKE2B 2fe79a859c8e15c21dc7b554dd0087c4f6d268f8fc7c2f4f9790fd6ef2dacae8126a55c666ab04477fb7e9ef1b62a2d814c1ee8ced427b8be89f3b1a59c1b4d2 SHA512 dafe7d2d92088ed05aacb505d22732e6d62d852464225cec712df2d2a9edf20a4cc53ad547e1f4a602396ca9d11b29128f38b7b076bedb905a86cace1e9fb127
-DIST mitmproxy_rs-0.12.10-crates.tar.xz 41559496 BLAKE2B b84fc9a618b8abe8b79b1757d66872ce3dfe44048c200fd217ecd234abe6114af417987360d4fcdf691a35a19164116690343be537b8dd8936a2cb57253871fc SHA512 df72556e9c94fbb3a48d3f3bc31a65a3ad5767d94294004111df4428da610fb26f53b06f77a0ba9a51a9a3e99ddbd0aae5609cf42cb44ff125f0761266d3d803
+DIST mitmproxy_linux-0.12.15.tar.gz 1298806 BLAKE2B 14225c1f936369d09ed95082862a2184f6bb29e845e94da7d73a62d51355b0cc3955108904796292f593f6966cb4ee7a52e5b3353dba1fa9222e0db9dde89de8 SHA512 bce700514831e47ed2e8a7b34c63ad0e172e028597b521fadd283ccd8c3a771131c4d086e4ae7373becabedbf676fba5daae3da30d4a36acb21ea71e4340c800
 DIST mitmproxy_rs-0.12.11-crates.tar.xz 42414204 BLAKE2B 26a76a54c9e4d9ae4bee50f2de0f1802ce3f0b8869a0d3738b95c6e26697173e47bd6f6fe0b81671a0f433060b682d9fef24fab3e56b0f17439cb38ebc5d15a1 SHA512 c629a2c21de7f818b333f18574975ee91cdf38d7f40de130153af45718bedbdca0417ccd6d263508d4d362f3025e5a9dc52f396930c8ba990b95438c71ef5aa1
-DIST mitmproxy_rs-0.12.9-crates.tar.xz 45242028 BLAKE2B b34979c3a573701a2f6f2f029a1cec05d4bc59013dc94c87a0e2b7d340c6bc8f7b2415d171b944f63a7d881ae87941a1e6fa61265218a3eea46fb7a127ef286d SHA512 ed4d48dd443eb777e5b387d38bf36ec6ee1d51e1c0aa650f0b27f8e34ae13a5c1eabfa766565879a661b2c4d6e458800e668f3a80a693eb9d5527ee0eb52314c
+DIST mitmproxy_rs-0.12.15-crates.tar.xz 42546604 BLAKE2B 2f4406433c20df9af2deddfec6406c918daf95b00c32669c799dbf246308947a2497d6c5d29b91810c0652834db1ca97fa3a07591072576577de91507d7182a5 SHA512 bd8fa43d960c261cc944a70aa470f2c007513a7aa8cf872240f685b1c9d64afb8e059d1739a3f0535697b9f370d5e3c37b2a9c5371eea9cd565c8be9761da1f8
 DIST moto-rt-0.16.0.crate 25412 BLAKE2B 6b18ae96975a037b1e1cee217a0c01df8d03fbb7defb633f4846d3ee5f9f6625ff5ac3dc9e33fdb02880d4f2dd3ee5e2cec9ccad6e3b51c93280abce5b99a148 SHA512 a46283badf03aae0b9bfc01699c9a09e7a8ebc1f2d88393df9da6eb133173f09e5640043fd015e6915b1abbb339939e7f37f427f36b4d8fc4c656cf20436cd78
-DIST object-0.37.1.crate 338929 BLAKE2B b2bc4f27968ec308b8d569e71de449adf5cf545aa2054d65cda03cfa44e3d3b108bd39e1288e1c983d08656b4c50a384c2101f2bf049b7d67d42e60c95160cba SHA512 ca9c7857185b6fb7f81a594d73df10cace40b47d7475f8d4ac0c6be9c3f327dc98a86fd4fc8f70da762eb978a0427ecff1e3c181bd3efeefbf3d2f51615b9745
+DIST moto-rt-0.16.4.crate 26411 BLAKE2B f1a1558db4a34d5f312b15b719e61acbee775b59ff583649897b7856f8bc65bd4ac7b698a363f87049c788419365b3645baeb9f3fa5660193ac6cb1d9db20be7 SHA512 cae7d7bd6c86700f1f46693ace0f04d4cd895c854be7dd4578aa6dcf4c4aadaddbec977d7393594ee4aa4f59635d7978ba98e2753c44313ffa3c87b72ee06f8c
 DIST object-0.37.3.crate 344032 BLAKE2B 7cef4fb0adfe2c0ce56705404b1e1b2b22afbd741cdc16bb5a2c76c9c2df03eca801b0cbd9077a4ad153b97c37d20637608018f532918e82d1f27c75f603dbac SHA512 e6a72ff6ed5066e0b6fd4b5c37dc0c3d334052f3d123fa0aea2dfa45c8ba5700fd6a66f4f76efbd8823f0935c6d1bf9cb3aadcb8eec1370b0126511606038aa8
 DIST r-efi-5.3.0.crate 64532 BLAKE2B 54bc882e333f7ba52b6dd6ac92b8a282581c10b47de91a4c4b71b15a27b2df885ab52ae2fcc8a546367ee1ce98300dcaec3c33cbd7393b134383528540bb7d14 SHA512 e748db9729dbddf215d5c37630fa272197dd2921297800209ca7bfcd6ffd8530b598b944d95547ad9723655cafdfb69b1c1fade9ba5f8c2ac5c55ec38258fdad
 DIST r-efi-alloc-2.1.0.crate 14475 BLAKE2B b316af45913ed4fe3b3efd01f800aaafcad9d1d0d05a8ed3685a85246f458cf65f4da50229322ce059a9eea0d341af41b765ef321be31161ec07c3768d6f88ed SHA512 9213827d81f2809341b9ec101bb6d94dc5d4a0e8b87252a34bf21dc200dcc13d7b20013c7ec87ad0e9c24384f4b4f31b37f4bc2126bb8479db7bb1118ab7acef
-DIST rustc-demangle-0.1.25.crate 29590 BLAKE2B affc3a85edfae0bd4a3a0165a9fa8d0d8c5be7958b70f98769d24eb6fe44c33bb05c33fc312bf35c887ce927c2f8feeb287b50f4f230d8dd74109be8faa34999 SHA512 d130a885b62470f4429dd5a9b11cb81e045c42e093125c2fed1eb79d07dd0990cd38e049a314babd1fd8b8ffab0bbcb0453fc7aae3e3adb7006e943d416162a8
 DIST rustc-demangle-0.1.27.crate 30448 BLAKE2B c301ebc7d127c679d95dc77798f738263aed592a9d08cc6a5e3f53a4b48fcdb8ddc824550c35c6274093315d71dd720588e1bb7d6145d1e3975dcdef72c45932 SHA512 da827b28e0be62af85b4b5dc15de06d78058bdf19888ebc7c55a46b533d81e2d8ba922bf032bcfa5334c6c43dd5bb272ae9510ffcf9ca2711a284bfbe245fcc4
-DIST rustc-literal-escaper-0.0.2.crate 11073 BLAKE2B fe7423ab43605fabf26788a98629a1dc37da5ded1339ed13d63e00f7e4d6167284e82da42c439db3d09d580e8fd1a5c12b8192bb9a676de09f89f9ccd9912525 SHA512 01b3a3b918133bedd6ce02a182a1eeb1459d33cb538808951eb64dcdc3ced542768cfe76a226b825f827d8506d9bb967c562df5697c9b48f471494710c676db3
-DIST rustc-literal-escaper-0.0.5.crate 14220 BLAKE2B f871e30a7015cc0e498dfbd75d322d4263ca3a986cea898d86ea50c696421e8922d112719631d429bf51d19bec2fa3f1b7a2aa8dbff0f011a4e71d81db511371 SHA512 a14118bdf2c5024b48a2ee2c06b371e94d951eff50db37b8727d25dd8ac37249c7bdf6c7d450873e5810778e28d0da950e8c630ffe81d01b46860db94164fac4
+DIST rustc-demangle-0.1.28.crate 30857 BLAKE2B 31b6d585541db03aca743eca652bdc082de8f9c8231e2304b7c4fd5c902aa6084e5812bd229a859e871b2794d542a87e2129f37fd84edebd642cbf8e2fa84b54 SHA512 dba9b342306c4b1115497a058e605c291476a5ac6745a2ddd1704cc9eec0c5175fcd0c0c937595c043e4e77f70977b014cd5bbd25f9c446f5600e83035631e91
 DIST rustc-literal-escaper-0.0.7.crate 14206 BLAKE2B 35fed836884a7cfe1aea188626b9f9ec1e58924a2a37a39f455567c4df06313c516abed00d4ec6cc6dc1a1b2d8a30bda9606579621a16cda17201392e0a4bf1c SHA512 c259bb0c807db7ada27c2b7919d015ae8672d0f92a281fff733dba9e65b4a045bd65885df59a4ee6779778786426e08c1e856fe8286e5ffe886a15f5e8a4c37c
-DIST unicode-width-0.2.1.crate 279344 BLAKE2B d4128c165016a76196e0eda9cc4a0edccf326cc3c7ecf0e1b43848446e758c703e9a9e843dbd256a523e1654ae3faaf6c172e21b0b6324757610fc5333c56e8e SHA512 705ce2ca2964761d9fcf014ef5ad9af2973b5f7c0c3561fece10378d817135afc5f24b9ac16290b98edecab77a01ddee9ec8dca5bd2b4eaec1f3124065ab8708
-DIST unwinding-0.2.7.crate 28125 BLAKE2B 5feb8262e1e7297311678525c7ba275fa2892d9cc05a2283fcfce424eb1d565be929e306d9c4ec9234771316f943578e2621abb4489b0ff40c85588f3c448f24 SHA512 a9d9988295fe5ecd0a06967714a41e3488aac4699748660baa91fb05cd34b34871ad37d38533d3e0baa64fb1ab9ba592edcf5fcb4441994c76de18b125c6e57e
+DIST rustc-literal-escaper-0.0.8.crate 14104 BLAKE2B 670f82d3d62ff7c5492145af230b798849ddc1e68a81ecdc11981bc934f3ea020f61bdecb0ec6ff5c0c6e882a3c933c18ce57ae0cfcc201ed8f42ee8c0411220 SHA512 fcaf927c34d05cf706678c8b021f349f14daab1c00621dbf3d8ceab2790a148d8e760db317685bd32e883b61590fad96ab33681481f91086f86a2dbee40572f8
+DIST unwinding-0.2.10.crate 29566 BLAKE2B 4f9807a5739fa234c8ab1805cdc763305d6fa3e6f97debdc562c80008ff5f36e228a19e8d6a63c17534b6c96f0b75fb27aa3b3b3943801bcbfadd5dd2df54fa4 SHA512 97c1b10ed42d4b16f670fe03104c1c1bb94e99f362b568bdb6a618e776dd72c562de14a84b54042c3550fa819750196edccc2e1d6f84c830b8645394fe83a6a7
 DIST unwinding-0.2.8.crate 27968 BLAKE2B 50a0730e27e060276798c8a18bae204e8c406d9ebdfea1d51bfa90fefd73e30bf1f84ad3c1fb7cf7085ac43f365813a9385f7d8cb569c97cd9cc1b549ed48b12 SHA512 38e39047febadfb04677fc46179125740bce28d2bd60adb9384b9f4cfe44719e151f03844f8620a9a18c994889ff30e6a27b78151422a3f348588a7770e7110b
 DIST vex-sdk-0.27.1.crate 11762 BLAKE2B c00330dcae5207197dfba07c0713210652140c9a36baadbc76efab3d4287023b79cf1763f7226e96e6fbd0b2c7531b7b6ad3c00ee90ea5829b1c19d521e6aa67 SHA512 f8a9925aac64164f50b0b57a911f41266073323c8bb6697f622263d4bad5fa81348162895be9374c062b1121dc4f0b4217340fb17cb94895ad01e33d744ca51b
-DIST wasi-0.11.1+wasi-snapshot-preview1.crate 28477 BLAKE2B bcc773ba28cbe8d820e9e9fbb275fb4451bc7f39b3bd88bcd93850bf2bdb5300489bd8eca27489ccc5f6269b00f4e1b505ae3a33a35d708cd5a414ad307be149 SHA512 29e3c903763db2580a15f50db487c5e1d4e90763e48d90a5b3f681e468a24f9df1a01773bd1ffa0e3cd293dd8cb4d6fbabfaa63c0e13889c811a56f4554ada49
 DIST wasi-0.14.4+wasi-0.2.4.crate 145408 BLAKE2B 800151a792b2dc1b4676494e2c78b205e09ebe3ac5e7a960bce2797e1a1c09db9d0897413e45b7d3cb30e80e1cd61dbb53537eeb4f37761cc695eaa5d1365eba SHA512 77c1e1eb7a59ad3a0c9624db557f6e1a8aa21b70d2dd225e4f5eed20ecc231ac2fe62aa6f3c1a3435f59e3afcbd49c3913be4082cdf0ebd20bc6bcd7826b6eda
 DIST wasip1-1.0.0.crate 26437 BLAKE2B 0c6e0422b5b265c5d39ce8a2bef08d27b5da5b13eb891082bb43ba84ab8960dab8fb3e05946e5a36eb070d65e087d0fa70fd099ed2121791386b10655fba14cd SHA512 80e84db4c1c9f7d75ae04e9aa2f75cee3a7fb637d9531631bf48378a4c94150088a0b05079cafd7f3d86777fc8249541ae3d903afa6fc53c281acb389f0ad6be
 DIST wasip2-1.0.3+wasi-0.2.9.crate 134512 BLAKE2B f60f74c4132db0605658ec48ee0087992b82e8969d890be15d9b2610aa235f43dfa266863b3f86e323ded9bf17a585beae232defc087ffc01ad175169ff6e818 SHA512 74c4baa90ecb4c1a87a931e03dc0ed7b472fadaa837d286e28c1c948a08bd2af88ed6f4bcf2900bdc85bddb358026d676aaf200899ec395cb98883e2d1a5ae2c
+DIST wasip2-1.0.4+wasi-0.2.12.crate 135311 BLAKE2B d016ad82ee36ba316bda8e13fab53007b812372d1baf8718c39013a6e46ba4be123b31ff117ca89d1f5152b537dff13dde37887542ee37fc5a6df1dece020a6e SHA512 42c79d515531dd74efcca7fc3518ec57a34d5a4c73cf36f462fa1fc87151dd22d227021667e7743aae587962806b96840fecda029e5469c69047a494b13e290b
 DIST wasip3-0.6.0+wasi-0.3.0-rc-2026-03-15.crate 141033 BLAKE2B d6db30e2b7c189857294800a5bc293d6dc2b51de85272480900f025d98e5daceba0c54e37d4c75e6e22d1808f2f489b12d348dc140ced0474fc8254294c78f3d SHA512 544708dbfea321077bcac33d974f45bce0151a4acfce18a5e72aea57654f36729bf32d74ecd4a1ac6fa1cf87c3221bb384be7bd736bcf27262cb294b06c5e8de
+DIST wasip3-0.7.0+wasi-0.3.0.crate 140573 BLAKE2B 9e30d8de8b2d2b323db136778c4fd7c729f8b56b016d7a2a4c793aec9e2d9598cca53ba4b20d3bc9987144a74d1431f21f4504f27212e0f5556ddafaf33d63f4 SHA512 76aa66f908ee9dad630b689538427a357baad664d0fd07cb0da7cc4955452d6a04c97ad9cdedb17a37380d080b2810cc57a671260ab4d40c34cd713dd4f7d4f5
 DIST windows-sys-0.60.2.crate 2518479 BLAKE2B c2e2f614066e5a9d7ec461d9d25bd441188797ad85e1e923baeb0193e82f5c138ae7fb4ad0255d483f60f7a94e3f5cd8373d01b7485c052c9498937bc40da992 SHA512 a48aa1b66479451e431032737b63dc62eac6f63c251534e258de75bbee4858829faf5e641756566f00e153b08548ba32beb437b5ea42e9531e3fcbd8eb25209d
 DIST windows-targets-0.53.5.crate 7126 BLAKE2B 17a0452fe72a42df4aec8b4ae7798bd611df4f3b093709aee7b8dc991fbc2351edd23e134d12412fb47e9930ae30476b55841d52be5e764fc42a7922e3134ad3 SHA512 285a2ad1c370d8485a84c3921b180416c79ad596ace5ce30a1100fe0d9725139e9302f5728d4874789d8abe5c53e9b30ff4738d969da1c07940bde2b01c7a203
 DIST windows_aarch64_gnullvm-0.53.1.crate 787748 BLAKE2B 78729e1107cf64ffc6a3d70c14cc93e7867578be51d3f6f442914a5f2d065fa86be843b72cd24d707eb59b779e9a719eb28d025619cdc219e379827acb4a16c2 SHA512 5e480e54af09c142ff75e77f733327dd3862f32620e0b075e02bf8119e955ef2f3acfa00f7c7a4d6a2b034d03d70c45e191a40c8af628484d0e76a0b15870cdc
diff --git a/net-proxy/mitmproxy-linux/mitmproxy-linux-0.12.10.ebuild b/net-proxy/mitmproxy-linux/mitmproxy-linux-0.12.15.ebuild
index 24affee65cc1..b899ab81e286 100644
--- a/net-proxy/mitmproxy-linux/mitmproxy-linux-0.12.10.ebuild
+++ b/net-proxy/mitmproxy-linux/mitmproxy-linux-0.12.15.ebuild
@@ -3,29 +3,47 @@
 
 EAPI=8
 
+CRATES="
+"
+
 # Extra crates required at runtime via rustc-build-sysroot crate.
 # Note: versions are locked in /usr/lib/rust/*/lib/rustlib/src/rust/library/Cargo.lock.
-CRATES="
+CRATES+="
 	addr2line@0.25.1
+	addr2line@0.27.1
 	dlmalloc@0.2.11
+	dlmalloc@0.2.13
+	dlmalloc@0.2.14
 	foldhash@0.2.0
 	fortanix-sgx-abi@0.6.1
 	getopts@0.2.24
 	gimli@0.32.3
+	gimli@0.34.0
 	hashbrown@0.16.1
 	hermit-abi@0.5.2
 	libc@0.2.178
 	libc@0.2.183
+	libc@0.2.185
 	memchr@2.7.6
+	miniz_oxide@0.9.1
 	moto-rt@0.16.0
+	moto-rt@0.16.4
 	object@0.37.3
 	r-efi-alloc@2.1.0
 	r-efi@5.3.0
 	rustc-demangle@0.1.27
+	rustc-demangle@0.1.28
 	rustc-literal-escaper@0.0.7
+	rustc-literal-escaper@0.0.8
 	unwinding@0.2.8
+	unwinding@0.2.10
 	vex-sdk@0.27.1
 	wasi@0.14.4+wasi-0.2.4
+	wasip1@1.0.0
+	wasip2@1.0.3+wasi-0.2.9
+	wasip2@1.0.4+wasi-0.2.12
+	wasip3@0.6.0+wasi-0.3.0-rc-2026-03-15
+	wasip3@0.7.0+wasi-0.3.0
 	windows-sys@0.60.2
 	windows-targets@0.53.5
 	windows_aarch64_gnullvm@0.53.1
@@ -36,16 +54,13 @@ CRATES="
 	windows_x86_64_gnu@0.53.1
 	windows_x86_64_gnullvm@0.53.1
 	windows_x86_64_msvc@0.53.1
+	wit-bindgen@0.57.1
 	wit-bindgen@0.45.1
 "
 
 # Implied by crates above.
 RUST_MIN_VER=1.95.0
-RUST_MAX_VER=1.96.1
-
-declare -A GIT_CRATES=(
-	[boringtun]='https://github.com/cloudflare/boringtun;2f3c85f5c4a601018c10b464b1ca890d9504bf6e;boringtun-%commit%/boringtun'
-)
+RUST_MAX_VER=1.99.0
 
 DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=maturin
@@ -88,10 +103,6 @@ src_prepare() {
 
 	distutils-r1_src_prepare
 
-	# replace upstream crate substitution with our crate substitution, sigh
-	local bor_dep=$(grep ^boringtun "${ECARGO_HOME}"/config.toml || die)
-	sed -i -e "/boringtun/s;^.*$;${bor_dep};" Cargo.toml || die
-
 	# this only implicitly builds mitmproxy-linux-ebpf, and is broken
 	# https://github.com/mitmproxy/mitmproxy/issues/7663
 	rm mitmproxy-linux/build.rs || die
diff --git a/net-proxy/mitmproxy-linux/mitmproxy-linux-0.12.9.ebuild b/net-proxy/mitmproxy-linux/mitmproxy-linux-0.12.9.ebuild
deleted file mode 100644
index 1795c536f9a8..000000000000
--- a/net-proxy/mitmproxy-linux/mitmproxy-linux-0.12.9.ebuild
+++ /dev/null
@@ -1,118 +0,0 @@
-# Copyright 2024-2026 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Extra crates required at runtime via rustc-build-sysroot crate.
-# Note: versions are locked in /usr/lib/rust/*/lib/rustlib/src/rust/library/Cargo.lock.
-CRATES="
-	addr2line@0.25.0
-	adler2@2.0.1
-	cfg-if@1.0.1
-	compiler_builtins@0.1.160
-	dlmalloc@0.2.9
-	dlmalloc@0.2.10
-	fortanix-sgx-abi@0.5.0
-	fortanix-sgx-abi@0.6.1
-	getopts@0.2.23
-	gimli@0.32.0
-	hashbrown@0.15.4
-	hermit-abi@0.5.2
-	libc@0.2.174
-	memchr@2.7.5
-	miniz_oxide@0.8.9
-	object@0.37.1
-	r-efi-alloc@2.1.0
-	r-efi@5.3.0
-	rustc-demangle@0.1.25
-	rustc-literal-escaper@0.0.2
-	rustc-literal-escaper@0.0.5
-	unwinding@0.2.7
-	unicode-width@0.2.1
-	wasi@0.11.1+wasi-snapshot-preview1
-"
-
-# Implied by crates above.
-RUST_MIN_VER=1.89.0
-RUST_MAX_VER=1.90.0
-
-declare -A GIT_CRATES=(
-	[boringtun]='https://github.com/cloudflare/boringtun;2f3c85f5c4a601018c10b464b1ca890d9504bf6e;boringtun-%commit%/boringtun'
-)
-
-DISTUTILS_EXT=1
-DISTUTILS_USE_PEP517=maturin
-PYTHON_COMPAT=( python3_{13..14} )
-RUST_REQ_USE="llvm_targets_BPF(+),rust-src"
-
-inherit cargo distutils-r1 pypi
-
-DESCRIPTION="mitmproxy's Rust bits"
-HOMEPAGE="
-	https://github.com/mitmproxy/mitmproxy_rs/
-	https://pypi.org/project/mitmproxy-rs/
-"
-SRC_URI+="
-	${CARGO_CRATE_URIS}
-	https://github.com/gentoo-crate-dist/mitmproxy_rs/releases/download/v${PV}/mitmproxy_rs-${PV}-crates.tar.xz
-"
-
-LICENSE="MIT"
-# Dependent crate licenses
-LICENSE+="
-	0BSD Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD-2 BSD ISC
-	LGPL-3+ MIT Unicode-3.0 WTFPL-2 ZLIB
-"
-SLOT="0"
-KEYWORDS="amd64 ~arm64"
-
-BDEPEND="
-	dev-util/bpf-linker
-"
-
-src_prepare() {
-	local PATCHES=(
-		# aya-ebpf overwrites libc functions with incompatible
-		# implementations that break everything, and therefore
-		# can only be used for bpf* targets
-		# https://github.com/aya-rs/aya/issues/1254
-		"${FILESDIR}/${PN}-0.11.5-no-host-aya-ebpf.patch"
-	)
-
-	distutils-r1_src_prepare
-
-	# replace upstream crate substitution with our crate substitution, sigh
-	local bor_dep=$(grep ^boringtun "${ECARGO_HOME}"/config.toml || die)
-	sed -i -e "/boringtun/s;^.*$;${bor_dep};" Cargo.toml || die
-
-	# this only implicitly builds mitmproxy-linux-ebpf, and is broken
-	# https://github.com/mitmproxy/mitmproxy/issues/7663
-	rm mitmproxy-linux/build.rs || die
-}
-
-src_configure() {
-	# first, we must build mitmproxy-linux-ebpf for the bpf target
-	# bpf-linker requires BPF target that is only available in nightly
-	local -x RUSTC_BOOTSTRAP=1
-	# no clue why this needs to be explicit
-	local -x RUSTFLAGS="-C linker=bpf-linker"
-
-	local cmd=(
-		"${CARGO}" build
-		-Z build-std=core
-		--bins
-		--release
-		--target=bpfel-unknown-none
-	)
-
-	pushd mitmproxy-linux-ebpf >/dev/null || die
-	echo "${cmd[*]}" >&2
-	"${cmd[@]}" || die "${cmd[*]} failed"
-	popd >/dev/null || die
-
-	export OUT_DIR="${S}/target/bpfel-unknown-none/release"
-}
-
-python_test() {
-	cargo_src_test --manifest-path mitmproxy-linux/Cargo.toml
-}
diff --git a/net-proxy/mitmproxy-rs/Manifest b/net-proxy/mitmproxy-rs/Manifest
index e760aef1e8d8..89fb823057c2 100644
--- a/net-proxy/mitmproxy-rs/Manifest
+++ b/net-proxy/mitmproxy-rs/Manifest
@@ -1,7 +1,4 @@
-DIST boringtun-2f3c85f5c4a601018c10b464b1ca890d9504bf6e.gh.tar.gz 219297 BLAKE2B af42c888259ce9d0d36c8b6925459e86fac14059e6b8a3532783050d77627f91c4cd7a0b61bd290e86bbe37ab155d9f798f5478b0f09650dabba08cdc9f60696 SHA512 485675e3fa9317d09814a67162199691df87d04b970c4f69536607584b07f6ab8d2379ef89b22d674e569b8a874a1298bc59a8537c077c81658594bbd502470e
-DIST mitmproxy_rs-0.12.10-crates.tar.xz 41559496 BLAKE2B b84fc9a618b8abe8b79b1757d66872ce3dfe44048c200fd217ecd234abe6114af417987360d4fcdf691a35a19164116690343be537b8dd8936a2cb57253871fc SHA512 df72556e9c94fbb3a48d3f3bc31a65a3ad5767d94294004111df4428da610fb26f53b06f77a0ba9a51a9a3e99ddbd0aae5609cf42cb44ff125f0761266d3d803
-DIST mitmproxy_rs-0.12.10.tar.gz 1331077 BLAKE2B f839b15af573d01d00457ef08f8dcfe9f4f706d54a7a759116ed6b5ceda73b3c0eb20341891d689ab43e4a341d153a7617f9cb3655e83d112eeb79ce598975ff SHA512 f82c928f8f99d74ce58e526dae4477038100f9f5e3f36bec60c11156c93a2b2de1aa6ad0d35a43300daf380f99298f399bbc42d41b2cf4f426d13fb857610f18
 DIST mitmproxy_rs-0.12.11-crates.tar.xz 42414204 BLAKE2B 26a76a54c9e4d9ae4bee50f2de0f1802ce3f0b8869a0d3738b95c6e26697173e47bd6f6fe0b81671a0f433060b682d9fef24fab3e56b0f17439cb38ebc5d15a1 SHA512 c629a2c21de7f818b333f18574975ee91cdf38d7f40de130153af45718bedbdca0417ccd6d263508d4d362f3025e5a9dc52f396930c8ba990b95438c71ef5aa1
 DIST mitmproxy_rs-0.12.11.tar.gz 1329685 BLAKE2B 87faed980fceba45ddaf29050a36d956cf614dd5259af972ca882ba3577f124b42dae2d2ea59926789e8348b1f85c7464ddd208631e50785231dc481176c57b8 SHA512 f4dd2e40466e3c00a3816d005013585d172be16af5a7ac9875f23a781ccf8a0aaf8113832065f552f35c5823a4d57d9a3d472928e2d551f8c817a6b752d9cb19
-DIST mitmproxy_rs-0.12.9-crates.tar.xz 45242028 BLAKE2B b34979c3a573701a2f6f2f029a1cec05d4bc59013dc94c87a0e2b7d340c6bc8f7b2415d171b944f63a7d881ae87941a1e6fa61265218a3eea46fb7a127ef286d SHA512 ed4d48dd443eb777e5b387d38bf36ec6ee1d51e1c0aa650f0b27f8e34ae13a5c1eabfa766565879a661b2c4d6e458800e668f3a80a693eb9d5527ee0eb52314c
-DIST mitmproxy_rs-0.12.9.tar.gz 1334424 BLAKE2B aed8aeebc1f6864ac31b6615491aa0fea6d5ee52c1f1dec2ffc68700fdeb3207ae504c4c9bc2c00c6b1531e66c58032200096c79c150944e667b22ce8088c0de SHA512 794211b9a3e623c0d59c172b8ea910f30031d000c41f470e5d78c1a87add01b20f15ec3dedd82924ce34ffcb1e7fcfd1a5557d638580f0e21b61aa3a522b286d
+DIST mitmproxy_rs-0.12.15-crates.tar.xz 42546604 BLAKE2B 2f4406433c20df9af2deddfec6406c918daf95b00c32669c799dbf246308947a2497d6c5d29b91810c0652834db1ca97fa3a07591072576577de91507d7182a5 SHA512 bd8fa43d960c261cc944a70aa470f2c007513a7aa8cf872240f685b1c9d64afb8e059d1739a3f0535697b9f370d5e3c37b2a9c5371eea9cd565c8be9761da1f8
+DIST mitmproxy_rs-0.12.15.tar.gz 1332240 BLAKE2B 9afa00106f8b8b7f81215bb419845e7c37bf4750a0bf5aa7243c1528d4d2b01b01cc02da25edca6c4e655b22cf3b9443c22d5b8939642e73960e8df4442f8cac SHA512 9be4c22e8cc22b16e4186d4fd5b204a8ce6ddfb7ccb1b96af6e2c845414f2c3e0581ac8677e2b72b6deb3c21d8702fe03f917b6ebe6dc08422309ef8316c9197
diff --git a/net-proxy/mitmproxy-rs/mitmproxy-rs-0.12.10.ebuild b/net-proxy/mitmproxy-rs/mitmproxy-rs-0.12.15.ebuild
index 31eeb36e74c7..4247bb8603d5 100644
--- a/net-proxy/mitmproxy-rs/mitmproxy-rs-0.12.10.ebuild
+++ b/net-proxy/mitmproxy-rs/mitmproxy-rs-0.12.15.ebuild
@@ -3,16 +3,13 @@
 
 EAPI=8
 
-CRATES=""
-
-declare -A GIT_CRATES=(
-	[boringtun]='https://github.com/cloudflare/boringtun;2f3c85f5c4a601018c10b464b1ca890d9504bf6e;boringtun-%commit%/boringtun'
-)
+CRATES="
+"
 
 DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=maturin
 PYTHON_COMPAT=( python3_{13..14} )
-RUST_MIN_VER=1.88.0
+RUST_MIN_VER=1.95.0
 
 inherit cargo distutils-r1 pypi
 
@@ -39,14 +36,6 @@ RDEPEND="
 	~net-proxy/mitmproxy-linux-${PV}[${PYTHON_USEDEP}]
 "
 
-src_prepare() {
-	distutils-r1_src_prepare
-
-	# replace upstream crate substitution with our crate substitution, sigh
-	local bor_dep=$(grep ^boringtun "${ECARGO_HOME}"/config.toml || die)
-	sed -i -e "/boringtun/s;^.*$;${bor_dep};" Cargo.toml || die
-}
-
 python_test() {
 	cargo_src_test --manifest-path mitmproxy-rs/Cargo.toml
 }
diff --git a/net-proxy/mitmproxy-rs/mitmproxy-rs-0.12.9.ebuild b/net-proxy/mitmproxy-rs/mitmproxy-rs-0.12.9.ebuild
deleted file mode 100644
index 81ff1669f261..000000000000
--- a/net-proxy/mitmproxy-rs/mitmproxy-rs-0.12.9.ebuild
+++ /dev/null
@@ -1,53 +0,0 @@
-# Copyright 2024-2026 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-CRATvES=""
-
-declare -A GIT_CRATES=(
-	[boringtun]='https://github.com/cloudflare/boringtun;2f3c85f5c4a601018c10b464b1ca890d9504bf6e;boringtun-%commit%/boringtun'
-)
-
-DISTUTILS_EXT=1
-DISTUTILS_USE_PEP517=maturin
-PYTHON_COMPAT=( python3_{13..14} )
-RUST_MIN_VER=1.89.0
-RUST_MAX_VER=1.90.0
-
-inherit cargo distutils-r1 pypi
-
-DESCRIPTION="mitmproxy's Rust bits"
-HOMEPAGE="
-	https://github.com/mitmproxy/mitmproxy_rs/
-	https://pypi.org/project/mitmproxy-rs/
-"
-SRC_URI+="
-	${CARGO_CRATE_URIS}
-	https://github.com/gentoo-crate-dist/mitmproxy_rs/releases/download/v${PV}/${P/-/_}-crates.tar.xz
-"
-
-LICENSE="MIT"
-# Dependent crate licenses
-LICENSE+="
-	0BSD Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD-2 BSD ISC
-	LGPL-3+ MIT Unicode-3.0 WTFPL-2 ZLIB
-"
-SLOT="0"
-KEYWORDS="amd64 ~arm64"
-
-RDEPEND="
-	~net-proxy/mitmproxy-linux-${PV}[${PYTHON_USEDEP}]
-"
-
-src_prepare() {
-	distutils-r1_src_prepare
-
-	# replace upstream crate substitution with our crate substitution, sigh
-	local bor_dep=$(grep ^boringtun "${ECARGO_HOME}"/config.toml || die)
-	sed -i -e "/boringtun/s;^.*$;${bor_dep};" Cargo.toml || die
-}
-
-python_test() {
-	cargo_src_test --manifest-path mitmproxy-rs/Cargo.toml
-}
diff --git a/net-vpn/tor/tor-0.4.9.14.ebuild b/net-vpn/tor/tor-0.4.9.14.ebuild
index 8788b0883035..b993702ac229 100644
--- a/net-vpn/tor/tor-0.4.9.14.ebuild
+++ b/net-vpn/tor/tor-0.4.9.14.ebuild
@@ -30,7 +30,7 @@ else
 	S="${WORKDIR}/${MY_PF}"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
-		KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+		KEYWORDS="~amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~sparc ~x86"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20250713 )"
diff --git a/profiles/features/wd40/package.use.mask b/profiles/features/wd40/package.use.mask
index a34a852d9f71..f8f928810acf 100644
--- a/profiles/features/wd40/package.use.mask
+++ b/profiles/features/wd40/package.use.mask
@@ -73,6 +73,7 @@ dev-python/srt test
 dev-python/sympy test
 dev-python/textdistance test
 dev-python/time-machine test
+dev-python/tornado test
 dev-python/wcag-contrast-ratio test
 dev-python/xarray test
 dev-python/yarl test
diff --git a/sys-libs/musl/files/musl-1.2.6-CVE-2026-107891.patch b/sys-libs/musl/files/musl-1.2.6-CVE-2026-107891.patch
new file mode 100644
index 000000000000..3a72d563c217
--- /dev/null
+++ b/sys-libs/musl/files/musl-1.2.6-CVE-2026-107891.patch
@@ -0,0 +1,166 @@
+>From 7813e9119eb5fe681b6750b8a033a0490bca0941 Mon Sep 17 00:00:00 2001
+From: Szabolcs Nagy <nsz@port70.net>
+Date: Thu, 23 Apr 2026 21:22:18 +0000
+Subject: [PATCH] regex: avoid int overflow in regcomp
+
+regcomp has many int arith ops that may overflow. before tre_expand_ast
+int values are limited by 2x the input length n, e.g.:
+
+  input ERE        int field    max value
+  aaaaaaaaaaaa...  position     n
+  ()()()()()()...  submatch_id  n/2+1
+  ()||||||||||...  num_tags     2n-3
+
+so overflow before expand requires large n (and a lot of memory). later
+some values can become big due to repetitions:
+
+  input ERE                     int field that overflows
+  (((a{255}){255}){255}){255}   position
+  ((a|b*){255,}){255,}          num_transitions
+
+num_transitions and memory use can be big without {k,} repetitions too:
+
+  input ERE        what             max value
+  (a|a|a|a...|a)*  num_transitions  n^2/4
+  (()|a|a|...|a)*  sum tnfa tags    > n^3/16 - n^2
+
+so memory can run out quickly as n grows (with 31bit va space 1700 long
+input is enough even without {k,}) about half is tnfa and half is ast
+firstpos/lastpos data. but overflow can happen before allocations fail.
+
+fix early overflow by limiting n. the stack usage is in [n,11n] without
+repetitions, usually 7n, so the stack limit got adjusted too. the limit
+is such that almost all inputs that worked before still work.
+
+overflows during and after expand are fixed by explicit checks via a
+check_add helper and xcalloc instead of xmalloc.
+---
+ src/regex/regcomp.c | 41 +++++++++++++++++++++++++++++++++++------
+ 1 file changed, 35 insertions(+), 6 deletions(-)
+
+diff --git a/src/regex/regcomp.c b/src/regex/regcomp.c
+index b4b81968..a7115b12 100644
+--- a/src/regex/regcomp.c
++++ b/src/regex/regcomp.c
+@@ -1680,6 +1680,12 @@ tre_add_tags(tre_mem_t mem, tre_stack_t *stack, tre_ast_node_t *tree,
+   AST to TNFA compilation routines.
+ */
+ 
++/* check if a+b overflows for a,b in [0,INT_MAX] */
++static int check_add(unsigned a, unsigned b)
++{
++	return a + b > INT_MAX;
++}
++
+ typedef enum {
+   COPY_RECURSE,
+   COPY_SET_RESULT_PTR
+@@ -1731,6 +1737,8 @@ tre_copy_ast(tre_mem_t mem, tre_stack_t *stack, tre_ast_node_t *ast,
+ 		    /* XXX - e.g. [ab] has only one position but two
+ 		       nodes, so we are creating holes in the state space
+ 		       here.  Not fatal, just wastes memory. */
++		    if (check_add(pos, *pos_add))
++		      return REG_ESPACE;
+ 		    pos += *pos_add;
+ 		    num_copied++;
+ 		  }
+@@ -1826,6 +1834,8 @@ tre_copy_ast(tre_mem_t mem, tre_stack_t *stack, tre_ast_node_t *ast,
+ 	  break;
+ 	}
+     }
++  if (check_add(*pos_add, num_copied))
++    return REG_ESPACE;
+   *pos_add += num_copied;
+   return status;
+ }
+@@ -1870,6 +1880,8 @@ tre_expand_ast(tre_mem_t mem, tre_stack_t *stack, tre_ast_node_t *ast,
+ 		tre_literal_t *lit= node->obj;
+ 		if (!IS_SPECIAL(lit) || IS_BACKREF(lit))
+ 		  {
++		    if (check_add(lit->position, pos_add))
++		      return REG_ESPACE;
+ 		    lit->position += pos_add;
+ 		    if (lit->position > max_pos)
+ 		      max_pos = lit->position;
+@@ -1998,6 +2010,8 @@ tre_expand_ast(tre_mem_t mem, tre_stack_t *stack, tre_ast_node_t *ast,
+ 	      }
+ 
+ 	    iter_depth--;
++	    if (check_add(pos_add_total, pos_add - pos_add_last))
++	      return REG_ESPACE;
+ 	    pos_add_total += pos_add - pos_add_last;
+ 	    if (iter_depth == 0)
+ 	      pos_add = pos_add_total;
+@@ -2010,6 +2024,8 @@ tre_expand_ast(tre_mem_t mem, tre_stack_t *stack, tre_ast_node_t *ast,
+ 	}
+     }
+ 
++  if (check_add(*position, pos_add_total))
++    return REG_ESPACE;
+   *position += pos_add_total;
+ 
+   /* `max_pos' should never be larger than `*position' if the above
+@@ -2711,9 +2727,19 @@ regcomp(regex_t *restrict preg, const char *restrict regex, int cflags)
+   /* Parse context. */
+   tre_parse_ctx_t parse_ctx;
+ 
++  /* Limits: before tre_expand_ast, int values like position, subid or
++   * num_tags are bounded by 2x input length, used stack entries are
++   * bounded by 16x input length. input length is checked upfront to
++   * avoid overflows before expand. later, values that can grow big are
++   * bounds checked via check_add and xcalloc. */
++  const int input_limit = 1024000;
++  const int stack_limit = 8*input_limit;
++  if (strnlen(regex, input_limit) >= input_limit)
++    return REG_ESPACE;
++
+   /* Allocate a stack used throughout the compilation process for various
+      purposes. */
+-  stack = tre_stack_new(512, 1024000, 128);
++  stack = tre_stack_new(512, stack_limit, 128);
+   if (!stack)
+     return REG_ESPACE;
+   /* Allocate a fast memory allocator. */
+@@ -2801,9 +2827,12 @@ regcomp(regex_t *restrict preg, const char *restrict regex, int cflags)
+ 	   for example "a*" or "ab*".	Figure out a simple way to detect
+ 	   this possibility. */
+   tmp_ast_l = tree;
+-  tmp_ast_r = tre_ast_new_literal(mem, 0, 0, parse_ctx.position++);
++  tmp_ast_r = tre_ast_new_literal(mem, 0, 0, parse_ctx.position);
+   if (tmp_ast_r == NULL)
+     ERROR_EXIT(REG_ESPACE);
++  if (check_add(parse_ctx.position, 1))
++    ERROR_EXIT(REG_ESPACE);
++  parse_ctx.position++;
+ 
+   tree = tre_ast_new_catenation(mem, tmp_ast_l, tmp_ast_r);
+   if (tree == NULL)
+@@ -2813,22 +2842,22 @@ regcomp(regex_t *restrict preg, const char *restrict regex, int cflags)
+   if (errcode != REG_OK)
+     ERROR_EXIT(errcode);
+ 
+-  counts = xmalloc(sizeof(int) * parse_ctx.position);
++  counts = xcalloc(sizeof(int), parse_ctx.position);
+   if (counts == NULL)
+     ERROR_EXIT(REG_ESPACE);
+ 
+-  offs = xmalloc(sizeof(int) * parse_ctx.position);
++  offs = xcalloc(sizeof(int), parse_ctx.position);
+   if (offs == NULL)
+     ERROR_EXIT(REG_ESPACE);
+ 
+-  for (i = 0; i < parse_ctx.position; i++)
+-    counts[i] = 0;
+   tre_ast_to_tnfa(tree, NULL, counts, NULL);
+ 
+   add = 0;
+   for (i = 0; i < parse_ctx.position; i++)
+     {
+       offs[i] = add;
++      if (check_add(add, counts[i] + 1))
++        ERROR_EXIT(REG_ESPACE);
+       add += counts[i] + 1;
+       counts[i] = 0;
+     }
+-- 
+2.21.0
diff --git a/sys-libs/musl/musl-1.2.6-r3.ebuild b/sys-libs/musl/musl-1.2.6-r3.ebuild
new file mode 100644
index 000000000000..97f4a81fef74
--- /dev/null
+++ b/sys-libs/musl/musl-1.2.6-r3.ebuild
@@ -0,0 +1,264 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit crossdev flag-o-matic toolchain-funcs prefix
+
+DESCRIPTION="Light, fast and, simple C library focused on standards-conformance and safety"
+HOMEPAGE="https://musl.libc.org"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.musl-libc.org/git/musl"
+	inherit git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/musl.asc
+	inherit verify-sig
+
+	SRC_URI="
+		https://musl.libc.org/releases/${P}.tar.gz
+		https://distfiles.gentoo.org/pub/proj/musl/${P}-patches.tar.xz
+		verify-sig? ( https://musl.libc.org/releases/${P}.tar.gz.asc )
+	"
+	KEYWORDS="-* ~amd64 ~arm ~arm64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~x86"
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-musl )"
+fi
+
+GETENT_COMMIT="93a08815f8598db442d8b766b463d0150ed8e2ab"
+GETENT_FILE="musl-getent-${GETENT_COMMIT}.c"
+SRC_URI+="
+	https://dev.gentoo.org/~blueness/musl-misc/getconf.c
+	https://gitlab.alpinelinux.org/alpine/aports/-/raw/${GETENT_COMMIT}/main/musl/getent.c -> ${GETENT_FILE}
+	https://dev.gentoo.org/~blueness/musl-misc/iconv.c
+"
+
+LICENSE="MIT LGPL-2 GPL-2"
+SLOT="0"
+IUSE="crypt headers-only split-usr"
+
+QA_SONAME="usr/lib/libc.so"
+QA_DT_NEEDED="usr/lib/libc.so"
+# bug #830213
+QA_PRESTRIPPED="usr/lib/crtn.o"
+
+# We want crypt on by default for this as sys-libs/libxcrypt isn't (yet?)
+# built as part as crossdev. Also, elide the blockers when in cross-*,
+# as it doesn't make sense to block the normal CBUILD libxcrypt at all
+# there when we're installing into /usr/${CHOST} anyway.
+if is_crosspkg ; then
+	IUSE="${IUSE/crypt/+crypt}"
+else
+	RDEPEND="crypt? ( !sys-libs/libxcrypt[system] )"
+	PDEPEND="!crypt? ( sys-libs/libxcrypt[system] )"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-getifaddrs-qemu-workaround.patch
+	"${WORKDIR}"/${P}-patches
+	"${FILESDIR}"/${P}-riscv32-syscalls.patch
+	"${FILESDIR}"/${P}-riscv32-syscalls-2.patch
+	"${FILESDIR}"/${PN}-1.2.6-CVE-2026-107891.patch
+)
+
+just_headers() {
+	use headers-only && target_is_not_host
+}
+
+pkg_setup() {
+	if [[ ${CTARGET} == ${CHOST} ]] ; then
+		case ${CHOST} in
+			*-musl*) ;;
+			*) die "Use sys-devel/crossdev to build a musl toolchain" ;;
+		esac
+	fi
+
+	# Fix for bug #667126, copied from glibc ebuild:
+	# make sure host make.conf doesn't pollute us
+	if target_is_not_host || tc-is-cross-compiler ; then
+		CHOST=${CTARGET} strip-unsupported-flags
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif use verify-sig ; then
+		# We only verify the release; not the additional (fixed, safe) files
+		# we download.
+		# (Seem to get IPC error on verifying in cross?)
+		! target_is_not_host && verify-sig_verify_detached "${DISTDIR}"/${P}.tar.gz{,.asc}
+	fi
+
+	default
+}
+
+src_prepare() {
+	default
+
+	mkdir "${WORKDIR}"/misc || die
+	cp "${DISTDIR}"/getconf.c "${WORKDIR}"/misc/getconf.c || die
+	cp "${DISTDIR}/${GETENT_FILE}" "${WORKDIR}"/misc/getent.c || die
+	cp "${DISTDIR}"/iconv.c "${WORKDIR}"/misc/iconv.c || die
+}
+
+src_configure() {
+	strip-flags && filter-lto # Prevent issues caused by aggressive optimizations & bug #877343
+	tc-getCC ${CTARGET}
+
+	just_headers && export CC=true
+
+	local sysroot
+	target_is_not_host && sysroot=/usr/${CTARGET}
+	./configure \
+		--target=${CTARGET} \
+		--prefix="${EPREFIX}${sysroot}/usr" \
+		--syslibdir="${EPREFIX}${sysroot}/lib" \
+		--disable-gcc-wrapper || die
+}
+
+src_compile() {
+	emake obj/include/bits/alltypes.h
+	just_headers && return 0
+
+	emake
+	if ! is_crosspkg ; then
+		emake -C "${T}" getconf getent iconv \
+			CC="$(tc-getCC)" \
+			CFLAGS="${CFLAGS}" \
+			CPPFLAGS="${CPPFLAGS}" \
+			LDFLAGS="${LDFLAGS}" \
+			VPATH="${WORKDIR}/misc"
+	fi
+
+	$(tc-getCC) ${CPPFLAGS} ${CFLAGS} -c -o libssp_nonshared.o "${FILESDIR}"/stack_chk_fail_local.c || die
+	$(tc-getAR) -rcs libssp_nonshared.a libssp_nonshared.o || die
+}
+
+src_install() {
+	local target="install"
+	just_headers && target="install-headers"
+	emake DESTDIR="${D}" ${target}
+	just_headers && return 0
+
+	# musl provides ldd via a sym link to its ld.so
+	local sysroot=
+	target_is_not_host && sysroot=/usr/${CTARGET}
+	local ldso=$(basename "${ED}${sysroot}"/lib/ld-musl-*)
+	dosym -r "${sysroot}/lib/${ldso}" "${sysroot}/usr/bin/ldd"
+
+	if ! use crypt ; then
+		# Allow sys-libs/libxcrypt[system] to provide it instead
+		rm "${ED}${sysroot}/usr/include/crypt.h" || die
+		rm "${ED}${sysroot}"/usr/*/libcrypt.a || die
+	fi
+
+	if ! is_crosspkg ; then
+		# Fish out of config:
+		#   ARCH = ...
+		#   SUBARCH = ...
+		# and print $(ARCH)$(SUBARCH).
+		local arch=$(awk '{ k[$1] = $3 } END { printf("%s%s", k["ARCH"], k["SUBARCH"]); }' config.mak)
+
+		# The musl build system seems to create a symlink:
+		# ${D}/lib/ld-musl-${arch}.so.1 -> /usr/lib/libc.so.1 (absolute)
+		# During cross or within prefix, there's no guarantee that the host is
+		# using musl so that file may not exist. Use a relative symlink within
+		# ${D} instead.
+		rm "${ED}"/lib/ld-musl-${arch}.so.1 || die
+		if use split-usr; then
+			dosym ../usr/lib/libc.so /lib/ld-musl-${arch}.so.1
+			# If it's still a dead symlink, OK, we really do need to abort.
+			[[ -e "${ED}"/lib/ld-musl-${arch}.so.1 ]] || die
+		else
+			dosym libc.so /usr/lib/ld-musl-${arch}.so.1
+			[[ -e "${ED}"/usr/lib/ld-musl-${arch}.so.1 ]] || die
+		fi
+
+		cp "${FILESDIR}"/ldconfig.in-r3 "${T}"/ldconfig.in || die
+		sed -e "s|@@ARCH@@|${arch}|" "${T}"/ldconfig.in > "${T}"/ldconfig || die
+		eprefixify "${T}"/ldconfig
+		into /
+		dosbin "${T}"/ldconfig
+		into /usr
+		dobin "${T}"/getconf
+		dobin "${T}"/getent
+		dobin "${T}"/iconv
+		newenvd - "00musl" <<-EOF
+		# 00musl autogenerated by sys-libs/musl ebuild; DO NOT EDIT.
+		LDPATH="include ld.so.conf.d/*.conf"
+		EOF
+	fi
+
+	if target_is_not_host ; then
+		into /usr/${CTARGET}
+		dolib.a libssp_nonshared.a
+	else
+		dolib.a libssp_nonshared.a
+	fi
+}
+
+# Simple test to make sure our new musl isn't completely broken.
+# Make sure we don't test with statically built binaries since
+# they will fail.  Also, skip if this musl is a cross compiler.
+#
+# If coreutils is built with USE=multicall, some of these files
+# will just be wrapper scripts, not actual ELFs we can test.
+musl_sanity_check() {
+	cd / #228809
+
+	# We enter ${ED} so to avoid trouble if the path contains
+	# special characters; for instance if the path contains the
+	# colon character (:), then the linker will try to split it
+	# and look for the libraries in an unexpected place. This can
+	# lead to unsafe code execution if the generated prefix is
+	# within a world-writable directory.
+	# (e.g. /var/tmp/portage:${HOSTNAME})
+	pushd "${ED}"/usr/$(get_libdir) >/dev/null
+
+	# first let's find the actual dynamic linker here
+	# symlinks may point to the wrong abi
+	local newldso=$(find . -maxdepth 1 -name 'libc.so' -type f -print -quit)
+
+	einfo Last-minute run tests with ${newldso} in /usr/$(get_libdir) ...
+
+	local x striptest
+	for x in cal date env free ls true uname uptime ; do
+		x=$(type -p ${x})
+		[[ -z ${x} || ${x} != ${EPREFIX}/* ]] && continue
+		striptest=$(LC_ALL="C" file -L ${x} 2>/dev/null) || continue
+		case ${striptest} in
+		*"statically linked"*) continue;;
+		*"static-pie linked"*) continue;;
+		*"ASCII text"*) continue;;
+		esac
+		# We need to clear the locale settings as the upgrade might want
+		# incompatible locale data.  This test is not for verifying that.
+		LC_ALL=C \
+		${newldso} --library-path . ${x} > /dev/null \
+			|| die "simple run test (${x}) failed"
+	done
+
+	popd >/dev/null
+}
+
+pkg_preinst() {
+	# Nothing to do if just installing headers
+	just_headers && return
+
+	# Prepare /etc/ld.so.conf.d/ for files
+	mkdir -p "${EROOT}"/etc/ld.so.conf.d
+
+	[[ -n ${ROOT} ]] && return 0
+	[[ -d ${ED}/usr/$(get_libdir) ]] || return 0
+	target_is_not_host && return 0
+	musl_sanity_check
+}
+
+pkg_postinst() {
+	target_is_not_host && return 0
+
+	[[ -n "${ROOT}" ]] && return 0
+
+	ldconfig || die
+}
diff --git a/www-apps/rutorrent/Manifest b/www-apps/rutorrent/Manifest
index 3dac05671c39..690df41ac6e8 100644
--- a/www-apps/rutorrent/Manifest
+++ b/www-apps/rutorrent/Manifest
@@ -1,2 +1,2 @@
-DIST rutorrent-5.3.15.tar.gz 3836159 BLAKE2B 23ee9e5263241dadec104c5a178ed31fa06263e39adff832fb6aed1e10a79e6358e5ff300a9b495674c5818ef67ca655ab25f1bd3e2520a7f465c13956e668b3 SHA512 240f5ba1c029166e87973f640192e30a91d1f4de7ad55ad70b2f8c4300d8c5ca1c2a7cd9a07e2ae22d2c58a9f291906eac717b621a88f88414815fdb7c2e63e4
 DIST rutorrent-5.3.16.tar.gz 3874792 BLAKE2B 6c3decbff1bef1826d117c6e6c0c531f3cb8c0dfd19b4bfa0fae17270aa1119a0672d20fcdef6740bfc1388234ea0828c386a175330094f235514d929dbe4653 SHA512 e5559f371ce37a6a20ea026e3a226d80dfa12c614895e807eb664e9685f440f46aebcf835c47a80e38bcf25f2806df87114b7811cc81ee609d02c3d94cca4c74
+DIST rutorrent-5.3.18.tar.gz 3977839 BLAKE2B 1419f4825122512d1773c748093b595c3381c5872acd39954db26526a126095234104cb493aa9341e3d8adaddcbfd24f6cd809df4ae0bc421d9d57f83649e234 SHA512 d06f96ce09df94a299462e35d950df8062905102ef4c83b428c3c91e49756b77554da8ea755fd372fb45ecbf685315653ea0093f8c548f83bc3dff50362e1773
diff --git a/www-apps/rutorrent/rutorrent-5.3.15.ebuild b/www-apps/rutorrent/rutorrent-5.3.18.ebuild
index 6810ce31b6c8..6810ce31b6c8 100644
--- a/www-apps/rutorrent/rutorrent-5.3.15.ebuild
+++ b/www-apps/rutorrent/rutorrent-5.3.18.ebuild
diff --git a/www-client/opera/opera-138.0.6044.24.ebuild b/www-client/opera/opera-138.0.6044.24-r1.ebuild
index 9e07d5e923a0..461a9267a64d 100644
--- a/www-client/opera/opera-138.0.6044.24.ebuild
+++ b/www-client/opera/opera-138.0.6044.24-r1.ebuild
@@ -31,7 +31,7 @@ fi
 # Commit ref from `strings libffmpeg.so | grep -F "FFmpeg version"` matches this Chromium version
 # or use Chromicler to handle bumps.
 # Does not _need_ to be updated for every new version of Opera, only when it breaks.
-CHROMIUM_VERSION="153"
+CHROMIUM_VERSION="154"
 SRC_URI="
 	amd64? ( ${SRC_URI_BASE[*]/%//${PV}/linux/${MY_PN}_${PV}_amd64.deb} )
 	arm64? ( https://deb.opera.com/opera-stable/pool/non-free/o/${MY_PN}/${MY_PN}_${PV}_arm64.deb )
diff --git a/www-servers/apache/apache-2.4.69.ebuild b/www-servers/apache/apache-2.4.69.ebuild
index 17dcf0af3c01..f1a1ef255833 100644
--- a/www-servers/apache/apache-2.4.69.ebuild
+++ b/www-servers/apache/apache-2.4.69.ebuild
@@ -147,7 +147,7 @@ HOMEPAGE="https://httpd.apache.org/"
 # some helper scripts are Apache-1.1, thus both are here
 LICENSE="Apache-2.0 Apache-1.1"
 SLOT="2"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-macos ~x64-solaris"
 
 DEPEND="${RDEPEND}"
 
diff --git a/www-servers/nginx/nginx-1.31.7-r1.ebuild b/www-servers/nginx/nginx-1.31.7-r1.ebuild
new file mode 100644
index 000000000000..17a2764b6216
--- /dev/null
+++ b/www-servers/nginx/nginx-1.31.7-r1.ebuild
@@ -0,0 +1,43 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+NGINX_SUBSYSTEMS=(+http stream mail)
+NGINX_MODULES=(
+	+http_{charset,gzip,ssi,userid,access,auth_basic,mirror,autoindex,geo,map}
+	+http_{split_clients,referer,rewrite,proxy,fastcgi,uwsgi,scgi,grpc}
+	+http_{memcached,limit_conn,limit_req,empty_gif,browser,upstream_hash}
+	+http_{upstream_ip_hash,upstream_least_conn,upstream_random}
+	+http_{upstream_keepalive,upstream_zone}
+	http_{ssl,v2,v3,realip,addition,xslt,image_filter,geoip,sub,dav,flv,mp4}
+	http_{gunzip,gzip_static,auth_request,random_index,secure_link,degradation}
+	http_{slice,stub_status,perl}
+	+mail_{pop3,imap,smtp}
+	mail_ssl
+	+stream_{limit_conn,access,geo,map,split_clients,return,pass,set}
+	+stream_{upstream_hash,upstream_least_conn,upstream_random,upstream_zone}
+	stream_{ssl,realip,geoip,ssl_preread}
+)
+NGINX_TESTS_COMMIT=ff61b0ffdb77c4279be2aab1529a5ad06bfcc119
+NGINX_MISC_FILES=(
+	nginx-{r2.logrotate,r2.service,r5.conf,r6.initd,r1.confd,r1.tmpfiles}
+)
+NGINX_SUPPORT_MODULE_STUBS=1
+
+inherit nginx
+
+KEYWORDS="amd64 arm arm64 ~loong ~ppc ~ppc64 ~riscv x86"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-httpoxy-mitigation-r1.patch"
+)
+
+src_prepare() {
+	nginx_src_prepare
+
+	if use test ; then
+		# Fails with network-sandbox (bug #976129)
+		rm "${NGX_TESTS_S}"/tunnel_next_upstream.t || die
+	fi
+}