From 40f967cc3be92733a21936d58d5ec434a7741375 Mon Sep 17 00:00:00 2001
From: Danilo Piparo <danilo.piparo@cern.ch>
Date: Sun, 25 Oct 2026 22:20:16 +0100
Subject: [PATCH 1/3] [builtins] Update giflib to 6.1.3

---
 builtins/libgif/CMakeLists.txt | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/builtins/libgif/CMakeLists.txt b/builtins/libgif/CMakeLists.txt
index a9ad0531f7c18..28f5dc63f0ae1 100644
--- a/builtins/libgif/CMakeLists.txt
+++ b/builtins/libgif/CMakeLists.txt
@@ -5,10 +5,10 @@
 # For the list of contributors see $ROOTSYS/README/CREDITS.
 
 # **PLEASE UPDATE ALSO THE FOLLOWING LINE WHEN UPDATING THE VERSION**
-# 19 Feb 2024, https://sourceforge.net/projects/giflib/files/giflib-5.x/
-set(ROOT_LIBGIF_VERSION 5.2.2)
-set(ROOT_LIBGIF_HASH "302b2758bbdb8b5c63eafad21b15a53bb7aef7e5d4d278fce170c160364082b5")
-# The sources come w/o CMakeList.txt as of version 5.2.2. We add ours, it's very simple.
+# 12 Mar 2026, https://sourceforge.net/projects/giflib/files/giflib-6.x/
+set(ROOT_LIBGIF_VERSION 6.1.3)
+set(ROOT_LIBGIF_HASH "b65b66b99f0424b93525f987386f22fc5efb9da2bfc92ad4a532249aaffbab0e")
+# The sources come w/o CMakeList.txt as of version 6.1.3. We add ours, it's very simple.
 set(ROOT_LIBGIF_PATCH_FILE ${CMAKE_CURRENT_SOURCE_DIR}/libgif_add_cmakelists.patch)
 
 set(ROOT_LIBGIF_PREFIX ${CMAKE_BINARY_DIR}/builtins/LIBGIF-prefix)
@@ -36,7 +36,7 @@ endif()
 ExternalProject_Add(
     BUILTIN_LIBGIF
     PREFIX ${ROOT_LIBGIF_PREFIX}
-    URL ${lcgpackages}/giflib-${ROOT_LIBGIF_VERSION}.tar.gz
+    URL https://root.cern/download/giflib-${ROOT_LIBGIF_VERSION}.tar.gz
     URL_HASH SHA256=${ROOT_LIBGIF_HASH}
     ${LIBGIF_PATCH_COMMAND}
     CMAKE_ARGS -G ${CMAKE_GENERATOR}

From c6b4369aee1842a526ac6e120e0daa0378eeffa9 Mon Sep 17 00:00:00 2001
From: Danilo Piparo <danilo.piparo@cern.ch>
Date: Sun, 25 Oct 2026 22:21:23 +0100
Subject: [PATCH 2/3] [builtins] Update libpng to 1.6.59

---
 builtins/libpng/CMakeLists.txt | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/builtins/libpng/CMakeLists.txt b/builtins/libpng/CMakeLists.txt
index 6135ef5ffba62..3f112c2b77f77 100644
--- a/builtins/libpng/CMakeLists.txt
+++ b/builtins/libpng/CMakeLists.txt
@@ -5,9 +5,9 @@
 # For the list of contributors see $ROOTSYS/README/CREDITS.
 
 # **PLEASE UPDATE ALSO THE FOLLOWING LINE WHEN UPDATING THE VERSION**
-# Feb 2026, https://github.com/pnggroup/libpng/releases/tag/v1.6.55
-set(ROOT_LIBPNG_VERSION 1.6.55)
-set(ROOT_LIBPNG_HASH "4b0abab6d219e95690ebe4db7fc9aa95f4006c83baaa022373c0c8442271283d")
+# Sep 2026, https://github.com/pnggroup/libpng/releases/tag/v1.6.59
+set(ROOT_LIBPNG_VERSION 1.6.59)
+set(ROOT_LIBPNG_HASH "86a3e4b501f7f50e392c4e456ea158893e9a595b1c63eb88c7bb9f6cf8772dad")
 
 set(ROOT_LIBPNG_PREFIX ${CMAKE_BINARY_DIR}/builtins/LIBPNG-prefix)
 
@@ -44,7 +44,7 @@ endif()
 ExternalProject_Add(
     BUILTIN_LIBPNG
     PREFIX ${ROOT_LIBPNG_PREFIX}
-    URL ${lcgpackages}/libpng-${ROOT_LIBPNG_VERSION}.tar.gz
+    URL https://root.cern/download/libpng-${ROOT_LIBPNG_VERSION}.tar.gz
     URL_HASH SHA256=${ROOT_LIBPNG_HASH}
     CMAKE_ARGS -G ${CMAKE_GENERATOR}
     -DCMAKE_POLICY_VERSION_MINIMUM=3.5

From 02467126e50bb8f3f772ecb06b4d7d3404cccc76 Mon Sep 17 00:00:00 2001
From: Danilo Piparo <danilo.piparo@cern.ch>
Date: Sun, 25 Oct 2026 22:22:04 +0100
Subject: [PATCH 3/3] [RN] Update builtin versions

---
 README/ReleaseNotes/v642/index.md | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/README/ReleaseNotes/v642/index.md b/README/ReleaseNotes/v642/index.md
index 67b4367d89bd0..38d125ec78c03 100644
--- a/README/ReleaseNotes/v642/index.md
+++ b/README/ReleaseNotes/v642/index.md
@@ -397,8 +397,24 @@ installation it was configured against, which is where RooFit looks for it. See
 ROOT build: `-Dcuda=ON` still builds the CUDA backend together with everything
 else.
 
-## Versions of built-in packages
+## Built-in packages
 
+**It is strongly recommended to rely on sytem packages, and not built-in ones.**
+All the built-in packages are now collected in the builtins directory.
 The version of the following packages has been updated:
 
- - xrootd: 5.9.5
+ - CDT: 2.0.0
+ - civetweb: 1.16.git588860
+ - bvh: 2.0.gitad9f7e
+ - ftgl: 2.4.0
+ - giflib: 6.1.3
+ - gl2ps: 1.4.2
+ - libmathtext: 2016
+ - libpng: 1.6.59
+ - libtiff: 4.7.26
+ - openssl: 3.5.9
+ - openui5: 1.152.0
+ - pcre: now pcre2, version 10.47
+ - rendercore: 2.3
+ - xrootd: 6.2.0
+ - xxhash: 0.8.3