(cherry picked from commit 4a9fbcf)

Changes: https://github.com/kristapsdz/lowdown/releases/tag/VERSION_2_0_3

- 2.0.3 notably adds support for building a proper Darwin dylib, but
  messes up the naming scheme of versioned dylibs, so we still have to
  rename them in postInstall.
  See kristapsdz/lowdown#168.
- make regress no longer ignores failures (?!), so we can no longer run
  the test suite on darwin if sandboxing is enabled.
  See kristapsdz/lowdown@4bfd934330ffdb92126.

Co-authored-by: sternenseemann <sternenseemann@systemli.org>
(cherry picked from commit 44da5f3)

This version finally installs correctly named .dylibs on darwin!

(cherry picked from commit 5d1fa9f)

(cherry picked from commit 363e4c1)

…0-unstable-2026-01-25 (#483767)

- Updates gnupg 2.4.8 to 2.4.9

- Update freepg patches to source-2.4.9-freepg

- Use `substituteInPlace` with `--replace-fail` to make keyserver change
  more robust.

- Update `static.patch` to generated `configure` (Thanks alyssais)

(cherry picked from commit 88088f7)

(cherry picked from commit 9d0740c)

https://github.com/libexpat/libexpat/blob/R_2_7_4/expat/Changes

Fixes: CVE-2026-24515, CVE-2026-25210
(cherry picked from commit 11d0d9b)

Upstream MR:
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/475.

This patch made it onto Debian's libsoup-3.6.5-3. More context:
https://bugs.debian.org/1109685.

(cherry picked from commit f8dcea1)

Tested that 6.18 and 6.19 now build without this.

(cherry picked from commit 5d4365c)

(cherry picked from commit 4469240)

…rm_nova (#486587)

(cherry picked from commit 466bc97)

https://docs.python.org/release/3.14.3/whatsnew/changelog.html

Fixes: CVE-2026-1299, CVE-2025-11468, CVE-2025-15282, CVE-2026-0672,
       CVE-2026-0865
(cherry picked from commit 08371b9)

CPython fixed python/cpython#141732 in
python/cpython#141736, but exceptiongroup 1.3.1,
including its test suite, still matches the old repr behavior.
The CPython fix has only been backported to 3.13 so far, where it was
first included in version 3.13.12, so we only need to patch for 3.13
and 3.15+.

Upstream issue: agronholm/exceptiongroup#154

(cherry picked from commit 294b175)

(cherry picked from commit 2cfaed4)

#492079 introduced a patch for CVE-2026-25068, which was backported to
staging-25.11 in #492453. However, the patch fails to compile when
ported directly to 25.11 since the way of doing error handling changed
from an `SNDERR` macro to an `snd_error` function between v1.2.14 (which
is on 25.11) and on v1.2.15. In order to fix this, we vendor the patch
and change the offending line like so:

```diff
- +			snd_error(TOPOLOGY, "mixer: unexpected channel count %d", map->num_channels);
+ +			SNDERR("mixer: unexpected channel count %d", map->num_channels);
```

Not-cherry-picked-because: fix that does not apply to unstable since it is on a later version of package

…ld on staging (#490309)

…14 (#493885)

This is only supported when running with `python -m test` through
libregrtest.

(cherry picked from commit ed44282)
https://hydra.nixos.org/build/322755322/nixlog/3/tail

This package currently fails to build during the patch application step
as it includes patches that were incorporated into libsoup 3.6.6. These
patches were introduced in #468891 and #489681. Since they are now part
of a regular release, we thus drop these patches.

The List of commits where these changes are present can be seen at
https://gitlab.gnome.org/GNOME/libsoup/-/compare/3.6.5...3.6.6.

(cherry picked from commit fa66658)
https://hydra.nixos.org/build/322622408/nixlog/1/tail

(cherry picked from commit f3e179d)

Without the change the `gtwebengine` fails to buil as:

    /nix/store/...-minizip-1.3.2/include/minizip/ioapi.h:74:10: fatal error: ints.h: No such file or directory
       74 | #include "ints.h"
          |          ^~~~~~~~

(cherry picked from commit 373ddfd)
We're affected also here:
https://hydra.nixos.org/build/322951570/nixlog/1

…494524)

This was caused by a python's patch-level bump.
It broke the build

(cherry picked from commit add6806)
https://hydra.nixos.org/build/322840575/nixlog/1/tail

Diff: wandb/wandb@v0.21.4...v0.24.0

Changelog: https://github.com/wandb/wandb/raw/v0.24.0/CHANGELOG.md
(cherry picked from commit 4db10e8)

But we can't use finalAttrs, as buildPythonPackage apparently
doesn't support it on 25.11 yet.
We need to update to 0.25.0 to fix failing tests:
https://hydra.nixos.org/build/323071433/nixlog/5/tail

Diff: wandb/wandb@v0.24.0...v0.25.0

Changelog: https://github.com/wandb/wandb/raw/0.25.0/CHANGELOG.md
(cherry picked from commit f3db9f3)

(cherry picked from commit 8ad1a1b)
https://hydra.nixos.org/build/322941365/nixlog/3/tail

It's a partial cherry-pick from commit 13aff78
https://hydra.nixos.org/build/322879205/nixlog/3/tail