summary refs log tree commit diff
path: root/gnu
diff options
context:
space:
mode:
Diffstat (limited to 'gnu')
-rw-r--r--gnu/build/image.scm2
-rw-r--r--gnu/build/vm.scm4
-rw-r--r--gnu/local.mk7
-rw-r--r--gnu/packages/admin.scm11
-rw-r--r--gnu/packages/adns.scm4
-rw-r--r--gnu/packages/autotools.scm4
-rw-r--r--gnu/packages/backup.scm4
-rw-r--r--gnu/packages/base.scm71
-rw-r--r--gnu/packages/bison.scm15
-rw-r--r--gnu/packages/boost.scm16
-rw-r--r--gnu/packages/bootstrap.scm6
-rw-r--r--gnu/packages/build-tools.scm7
-rw-r--r--gnu/packages/commencement.scm28
-rw-r--r--gnu/packages/compression.scm47
-rw-r--r--gnu/packages/crypto.scm2
-rw-r--r--gnu/packages/cups.scm17
-rw-r--r--gnu/packages/curl.scm55
-rw-r--r--gnu/packages/docbook.scm12
-rw-r--r--gnu/packages/emulators.scm19
-rw-r--r--gnu/packages/engineering.scm4
-rw-r--r--gnu/packages/file.scm5
-rw-r--r--gnu/packages/fontutils.scm6
-rw-r--r--gnu/packages/gawk.scm4
-rw-r--r--gnu/packages/gdb.scm7
-rw-r--r--gnu/packages/gettext.scm4
-rw-r--r--gnu/packages/ghostscript.scm3
-rw-r--r--gnu/packages/gl.scm7
-rw-r--r--gnu/packages/glib.scm17
-rw-r--r--gnu/packages/gnupg.scm4
-rw-r--r--gnu/packages/guile.scm17
-rw-r--r--gnu/packages/icu4c.scm8
-rw-r--r--gnu/packages/image.scm3
-rw-r--r--gnu/packages/jemalloc.scm4
-rw-r--r--gnu/packages/kerberos.scm7
-rw-r--r--gnu/packages/ld-wrapper.in3
-rw-r--r--gnu/packages/libevent.scm15
-rw-r--r--gnu/packages/libffi.scm5
-rw-r--r--gnu/packages/libidn.scm5
-rw-r--r--gnu/packages/linux.scm5
-rw-r--r--gnu/packages/llvm.scm98
-rw-r--r--gnu/packages/make-bootstrap.scm4
-rw-r--r--gnu/packages/maths.scm13
-rw-r--r--gnu/packages/multiprecision.scm4
-rw-r--r--gnu/packages/node.scm22
-rw-r--r--gnu/packages/openldap.scm18
-rw-r--r--gnu/packages/package-management.scm2
-rw-r--r--gnu/packages/patches/docbook-xsl-nonrecursive-string-subst.patch11
-rw-r--r--gnu/packages/patches/docbook-xsl-support-old-url.patch17
-rw-r--r--gnu/packages/patches/glibc-bootstrap-system.patch38
-rw-r--r--gnu/packages/patches/icu4c-CVE-2020-10531.patch127
-rw-r--r--gnu/packages/patches/libffi-3.3-powerpc-fixes.patch138
-rw-r--r--gnu/packages/patches/meson-for-build-rpath.patch24
-rw-r--r--gnu/packages/patches/python-babel-fix-parse-future-test.patch68
-rw-r--r--gnu/packages/patches/zziplib-CVE-2018-16548.patch49
-rw-r--r--gnu/packages/python-xyz.scm16
-rw-r--r--gnu/packages/python.scm5
-rw-r--r--gnu/packages/ruby.scm56
-rw-r--r--gnu/packages/tex.scm42
-rw-r--r--gnu/packages/texinfo.scm27
-rw-r--r--gnu/packages/tls.scm77
-rw-r--r--gnu/packages/vpn.scm2
-rw-r--r--gnu/packages/web.scm23
-rw-r--r--gnu/packages/wicd.scm5
-rw-r--r--gnu/packages/xml.scm4
-rw-r--r--gnu/packages/xorg.scm28
-rw-r--r--gnu/system/locale.scm3
-rw-r--r--gnu/system/shadow.scm8
-rw-r--r--gnu/system/vm.scm6
68 files changed, 677 insertions, 722 deletions
diff --git a/gnu/build/image.scm b/gnu/build/image.scm
index 8a2d0eb5fd..ff63039c16 100644
--- a/gnu/build/image.scm
+++ b/gnu/build/image.scm
@@ -61,7 +61,7 @@
    (inexact->exact (ceiling (/ size 1024)))))
 
 (define (estimate-partition-size root)
-  "Given the ROOT directory, evalute and return its size.  As this doesn't
+  "Given the ROOT directory, evaluate and return its size.  As this doesn't
 take the partition metadata size into account, take a 25% margin."
   (* 1.25 (file-size root)))
 
diff --git a/gnu/build/vm.scm b/gnu/build/vm.scm
index 287d099f79..5a292e965b 100644
--- a/gnu/build/vm.scm
+++ b/gnu/build/vm.scm
@@ -164,8 +164,8 @@ the #:references-graphs parameter of 'derivation'."
          "-cpu" "max"
          "-m" (number->string memory-size)
          "-nic" "user,model=virtio-net-pci"
-         "-object" "rng-random,filename=/dev/urandom,id=guixsd-vm-rng"
-         "-device" "virtio-rng-pci,rng=guixsd-vm-rng"
+         "-object" "rng-random,filename=/dev/urandom,id=guix-vm-rng"
+         "-device" "virtio-rng-pci,rng=guix-vm-rng"
          "-virtfs"
          (string-append "local,id=store_dev,path="
                         (%store-directory)
diff --git a/gnu/local.mk b/gnu/local.mk
index 91b7c3a14c..922c1c518b 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -907,6 +907,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/diffutils-gets-undeclared.patch		\
   %D%/packages/patches/dkimproxy-add-ipv6-support.patch		\
   %D%/packages/patches/docbook-xsl-nonrecursive-string-subst.patch	\
+  %D%/packages/patches/docbook-xsl-support-old-url.patch	\
   %D%/packages/patches/doc++-include-directives.patch		\
   %D%/packages/patches/doc++-segfault-fix.patch			\
   %D%/packages/patches/docker-fix-tests.patch			\
@@ -1147,7 +1148,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/icecat-use-system-media-libs.patch	\
   %D%/packages/patches/icedtea-6-hotspot-gcc-segfault-workaround.patch  \
   %D%/packages/patches/icedtea-7-hotspot-gcc-segfault-workaround.patch  \
-  %D%/packages/patches/icu4c-CVE-2020-10531.patch  		\
   %D%/packages/patches/id3lib-CVE-2007-4460.patch			\
   %D%/packages/patches/id3lib-UTF16-writing-bug.patch			\
   %D%/packages/patches/ilmbase-fix-tests.patch			\
@@ -1316,7 +1316,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/mediastreamer2-srtp2.patch		\
   %D%/packages/patches/mesa-skip-disk-cache-test.patch		\
   %D%/packages/patches/mescc-tools-boot.patch			\
-  %D%/packages/patches/meson-for-build-rpath.patch		\
   %D%/packages/patches/metabat-fix-compilation.patch		\
   %D%/packages/patches/mhash-keygen-test-segfault.patch		\
   %D%/packages/patches/mingw-w64-6.0.0-gcc.patch		\
@@ -1489,6 +1488,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/python-aionotify-0.2.0-py3.8.patch	\
   %D%/packages/patches/python-argcomplete-1.11.1-fish31.patch	\
   %D%/packages/patches/python-axolotl-AES-fix.patch		\
+  %D%/packages/patches/python-babel-fix-parse-future-test.patch	\
   %D%/packages/patches/python-cairocffi-dlopen-path.patch	\
   %D%/packages/patches/python-cross-compile.patch		\
   %D%/packages/patches/python2-larch-coverage-4.0a6-compatibility.patch \
@@ -1706,8 +1706,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/xsane-fix-pdf-floats.patch		\
   %D%/packages/patches/xsane-fix-snprintf-buffer-length.patch	\
   %D%/packages/patches/xsane-support-ipv6.patch			\
-  %D%/packages/patches/xsane-tighten-default-umask.patch	\
-  %D%/packages/patches/zziplib-CVE-2018-16548.patch
+  %D%/packages/patches/xsane-tighten-default-umask.patch
 
 MISC_DISTRO_FILES =				\
   %D%/packages/ld-wrapper.in
diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index 2cfa4a05e3..81ddeaca77 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -529,7 +529,8 @@ or via the @code{facter} Ruby library.")
      `(("ncurses" ,ncurses)))
     (native-inputs
      `(("autoconf" ,autoconf)
-       ("automake" ,automake)))
+       ("automake" ,automake)
+       ("python" ,python-minimal-wrapper)))     ; for scripts/MakeHeader.py
     (home-page "https://htop.dev")
     (synopsis "Interactive process viewer")
     (description
@@ -626,10 +627,16 @@ re-executing them as necessary.")
                                    "--disable-uucpd"
                                    "--disable-whois")
                                  '()))
+       ;; Make sure that canonical "coreutils" package is not referred.
+       #:make-flags
+       (list (string-append "CPPFLAGS=-DPATHDEF_CP=\\\""
+                            (assoc-ref %build-inputs "coreutils*")
+                            "/bin/cp\\\""))
        ;; On some systems, 'libls.sh' may fail with an error such as:
        ;; "Failed to tell switch -a apart from -A".
        #:parallel-tests? #f))
-    (inputs `(("ncurses" ,ncurses)
+    (inputs `(("coreutils*" ,coreutils)
+              ("ncurses" ,ncurses)
               ("readline" ,readline)))        ;for 'ftp'
     (native-inputs (if (member (%current-system)
                                (package-supported-systems net-tools))
diff --git a/gnu/packages/adns.scm b/gnu/packages/adns.scm
index 57f34942d5..a67a00284b 100644
--- a/gnu/packages/adns.scm
+++ b/gnu/packages/adns.scm
@@ -65,7 +65,7 @@ scripts.")
 (define-public c-ares
   (package
     (name "c-ares")
-    (version "1.16.0")
+    (version "1.16.1")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -73,7 +73,7 @@ scripts.")
                     ".tar.gz"))
               (sha256
                (base32
-                "129sm0wzij0mp8vdv68v18hnykcjb6ivi66wnqnnw598q7bql1fy"))))
+                "1kl6bzlcmxn0524h5qldlbh99wf96whhvk54w3p4igf3xk8150yh"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
diff --git a/gnu/packages/autotools.scm b/gnu/packages/autotools.scm
index 775576ff5d..96f2925180 100644
--- a/gnu/packages/autotools.scm
+++ b/gnu/packages/autotools.scm
@@ -169,9 +169,9 @@ files with a system-specific shebang."
     (inputs `(("guile"
                ;; XXX: Kludge to hide the circular dependency.
                ,(module-ref (resolve-interface '(gnu packages guile))
-                            'guile-2.0))
+                            'guile-3.0/fixed))
               ("autoconf" ,autoconf)
-              ("bash" ,bash)))
+              ("bash" ,bash-minimal)))
     (arguments
      '(#:modules ((guix build utils))
        #:builder
diff --git a/gnu/packages/backup.scm b/gnu/packages/backup.scm
index 27741e9c5c..770bb23a9c 100644
--- a/gnu/packages/backup.scm
+++ b/gnu/packages/backup.scm
@@ -812,8 +812,8 @@ NTFS volumes using @code{ntfs-3g}, preserving NTFS-specific attributes.")
                     (output-dir
                      (assoc-ref outputs "out"))
 
-                    ;; Just a default... not so useful on guixsd though
-                    ;; You probably want to a service with file(s) to point to.
+                    ;; Just a default... not so useful on Guix Systems though.
+                    ;; You probably want a service with file(s) to point to.
                     (confdir "/etc/dirvish")
 
                     (perl (string-append (assoc-ref %build-inputs "perl")
diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index e8f7bb5f9c..cc10a4b673 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -15,6 +15,7 @@
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018, 2019 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2020 Vitaliy Shatrov <D0dyBo0D0dyBo0@protonmail.com>
+;;; Copyright © 2020 Chris Marusich <cmmarusich@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -37,6 +38,7 @@
   #:use-module (gnu packages)
   #:use-module (gnu packages acl)
   #:use-module (gnu packages algebra)
+  #:use-module (gnu packages attr)
   #:use-module (gnu packages bash)
   #:use-module (gnu packages bison)
   #:use-module (gnu packages ed)
@@ -93,14 +95,14 @@ command-line arguments, multiple languages, and so on.")
 (define-public grep
   (package
    (name "grep")
-   (version "3.4")
+   (version "3.5")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/grep/grep-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "1yy33kiwrxrwj2nxa4fg15bvmwyghqbs8qwkdvy5phm784f7brjq"))
+              "0jm4hynsqf32rw1j3kv239wzg47qm6glqh6841ar9ay20xvwfamq"))
             (patches (search-patches "grep-timing-sensitive-test.patch"))))
    (build-system gnu-build-system)
    (native-inputs `(("perl" ,perl)))             ;some of the tests require it
@@ -141,7 +143,19 @@ including, for example, recursive directory searching.")
                                 ".tar.gz"))
             (sha256
              (base32
-              "0alqagh0nliymz23kfjg6g9w3cr086k0sfni56gi8fhzqwa3xksk"))))
+              "0alqagh0nliymz23kfjg6g9w3cr086k0sfni56gi8fhzqwa3xksk"))
+            ;; Remove this snippet once upstream releases a fixed version.
+            ;; This snippet changes Makefile.in, even though the upstream
+            ;; patch changes testsuite/local.mk, since we build sed from a
+            ;; release tarball.  See: https://bugs.gnu.org/36150
+            (snippet
+             '(begin
+                (substitute* "Makefile.in"
+                  (("^  abs_srcdir='\\$\\(abs_srcdir\\)'.*" previous-line)
+                   (string-append
+                    previous-line
+                    "  CONFIG_HEADER='$(CONFIG_HEADER)'\t\t\\\n")))))
+            (modules '((guix build utils)))))
    (build-system gnu-build-system)
    (synopsis "Stream editor")
    (native-inputs
@@ -317,6 +331,7 @@ used to apply commands with arbitrarily long arguments.")
             (patches (search-patches "coreutils-ls.patch"))))
    (build-system gnu-build-system)
    (inputs `(("acl"  ,acl)                        ; TODO: add SELinux
+             ("attr" ,attr)                       ;for xattrs in ls, mv, etc
              ("gmp"  ,gmp)                        ;bignums in 'expr', yay!
 
              ;; Do not use libcap when cross-compiling since it's not quite
@@ -489,14 +504,14 @@ change.  GNU make offers many powerful extensions over the standard utility.")
 (define-public binutils
   (package
    (name "binutils")
-   (version "2.34")
+   (version "2.35.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/binutils/binutils-"
                                 version ".tar.bz2"))
             (sha256
              (base32
-              "1rin1f5c7wm4n3piky6xilcrpf2s0n3dd5vqq8irrxkcic3i1w49"))
+              "0hhrigj2ai1hcdm6rsvdrqmvn8xydhhnw17i2gsdkz261wfpl3ij"))
             (patches (search-patches "binutils-loongson-workaround.patch"))))
    (build-system gnu-build-system)
 
@@ -521,17 +536,7 @@ change.  GNU make offers many powerful extensions over the standard utility.")
 
                           ;; Make sure 'ar' and 'ranlib' produce archives in a
                           ;; deterministic fashion.
-                          "--enable-deterministic-archives")
-
-      ;; XXX: binutils 2.34 was mistakenly released without generated manuals:
-      ;; <https://sourceware.org/bugzilla/show_bug.cgi?id=25491>.  To avoid a
-      ;; circular dependency on texinfo, prevent the build system from creating
-      ;; the manuals by calling "true" instead of "makeinfo"...
-      #:make-flags '("MAKEINFO=true")))
-
-   ;; ...and "hide" this package so that users who install binutils get the
-   ;; version with documentation defined below.
-   (properties '((hidden? . #t)))
+                          "--enable-deterministic-archives")))
 
    (synopsis "Binary utilities: bfd gas gprof ld")
    (description
@@ -544,18 +549,6 @@ included.")
    (license gpl3+)
    (home-page "https://www.gnu.org/software/binutils/")))
 
-;; Work around a problem with binutils 2.34 whereby manuals are missing from
-;; the release tarball.  Remove this and the related code above when updating.
-(define-public binutils+documentation
-  (package/inherit
-   binutils
-   (native-inputs
-    `(("texinfo" ,texinfo)))
-   (arguments
-    (substitute-keyword-arguments (package-arguments binutils)
-      ((#:make-flags _ ''()) ''())))
-   (properties '())))
-
 ;; FIXME: ath9k-firmware-htc-binutils.patch do not apply on 2.34 because of a
 ;; big refactoring of xtensa-modules.c (commit 567607c11fbf7105 upstream).
 ;; Keep this version around until the patch is updated.
@@ -576,7 +569,7 @@ included.")
    (properties '())))
 
 (define-public binutils-gold
-  (package/inherit binutils+documentation
+  (package/inherit binutils
     (name "binutils-gold")
     (arguments
      `(#:phases
@@ -684,13 +677,13 @@ the store.")
   ;; version 2.28, GNU/Hurd used a different glibc branch.
   (package
    (name "glibc")
-   (version "2.31")
+   (version "2.32")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/glibc/glibc-" version ".tar.xz"))
             (sha256
              (base32
-              "05zxkyz9bv3j9h0xyid1rhvh3klhsmrpkf3bcs6frvlgyr2gwilj"))
+              "0di848ibffrnwq7g2dvgqrnn4xqhj3h96csn69q4da51ymafl9qn"))
             (snippet
              ;; Disable 'ldconfig' and /etc/ld.so.cache.  The latter is
              ;; required on LFS distros to avoid loading the distro's libc.so
@@ -782,6 +775,11 @@ the store.")
                   '("--disable-werror")
                   '()))
 
+      ;; Arrange so that /etc/rpc & co. go to $out/etc.
+      #:make-flags (list (string-append "sysconfdir="
+                                        (assoc-ref %outputs "out")
+                                        "/etc"))
+
       #:tests? #f                                 ; XXX
       #:phases (modify-phases %standard-phases
                  (add-before
@@ -936,6 +934,17 @@ with the Linux kernel.")
 ;; Below are old libc versions, which we use mostly to build locale data in
 ;; the old format (which the new libc cannot cope with.)
 
+(define-public glibc-2.31
+  (package
+    (inherit glibc)
+    (version "2.31")
+    (source (origin
+              (inherit (package-source glibc))
+              (uri (string-append "mirror://gnu/glibc/glibc-" version ".tar.xz"))
+              (sha256
+               (base32
+                "05zxkyz9bv3j9h0xyid1rhvh3klhsmrpkf3bcs6frvlgyr2gwilj"))))))
+
 (define-public glibc-2.30
   (package
     (inherit glibc)
diff --git a/gnu/packages/bison.scm b/gnu/packages/bison.scm
index 4c6da7d9b7..2f533550f2 100644
--- a/gnu/packages/bison.scm
+++ b/gnu/packages/bison.scm
@@ -33,7 +33,7 @@
 (define-public bison
   (package
     (name "bison")
-    (version "3.5.3")
+    (version "3.6.3")
     (source
      (origin
       (method url-fetch)
@@ -41,7 +41,7 @@
                           version ".tar.xz"))
       (sha256
        (base32
-        "1i57hbczvr8674z73775jxdd3y59qggs5lmfd60gmwm5i1gmpy1b"))))
+        "0gdpnjh6ra9xa9vj6hzjdf0c04x4pjyy8vssm3qdb7fya4v7knq6"))))
     (build-system gnu-build-system)
     (arguments
      '(;; Building in parallel on many-core systems may cause an error such as
@@ -68,17 +68,6 @@ simple tools through complex programming languages.
 Bison also provides an implementation of @command{yacc}, as specified by POSIX.")
     (license gpl3+)))
 
-(define-public bison-3.6
-  (package
-    (inherit bison)
-    (version "3.6.3")
-    (source
-     (origin
-      (method url-fetch)
-      (uri (string-append "mirror://gnu/bison/bison-" version ".tar.xz"))
-      (sha256
-       (base32 "0gdpnjh6ra9xa9vj6hzjdf0c04x4pjyy8vssm3qdb7fya4v7knq6"))))))
-
 (define-public bison-3.0
   (package
     (inherit bison)
diff --git a/gnu/packages/boost.scm b/gnu/packages/boost.scm
index b1ab8a4ec9..709b10fba0 100644
--- a/gnu/packages/boost.scm
+++ b/gnu/packages/boost.scm
@@ -14,6 +14,7 @@
 ;;; Copyright © 2019, 2020 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;; Copyright © 2020 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2020 Jonathan Brielmaier <jonathan.brielmaier@web.de>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -61,21 +62,15 @@
 (define-public boost
   (package
     (name "boost")
-    (version "1.72.0")
+    (version "1.74.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dl.bintray.com/boostorg/release/"
                                   version "/source/boost_"
                                   (version-with-underscores version) ".tar.bz2"))
-              (patches
-               (list (boost-patch
-                      ;; 1.72.0 was released with a faulty coroutine submodule:
-                      ;; <https://github.com/boostorg/coroutine/issues/46>.
-                      "0001-revert-cease-dependence-on-range.patch" version
-                      "1zcqxzh56m1s635wqwk15j3zcs2gmjvjy2f0hid7i78s4pgm0yfs")))
               (sha256
                (base32
-                "08h7cv61fd0lzb4z50xanfqn0pdgvizjrpd1kcdgj725pisb5jar"))))
+                "1c8nw4jz17zy2y27h7p554a5jza1ymz8phkz71p9181ifx8c3gw3"))))
     (build-system gnu-build-system)
     (inputs `(("icu4c" ,icu4c)
               ("zlib" ,zlib)))
@@ -83,7 +78,7 @@
      `(("perl" ,perl)
        ,@(if (%current-target-system)
              '()
-             `(("python" ,python-wrapper)))
+             `(("python" ,python-minimal-wrapper)))
        ("tcsh" ,tcsh)))
     (arguments
      `(#:imported-modules ((guix build python-build-system)
@@ -124,8 +119,7 @@
                    (out (assoc-ref outputs "out")))
                (substitute* '("libs/config/configure"
                               "libs/spirit/classic/phoenix/test/runtest.sh"
-                              "tools/build/src/engine/execunix.cpp"
-                              "tools/build/src/engine/Jambase")
+                              "tools/build/src/engine/execunix.cpp")
                  (("/bin/sh") (which "sh")))
 
                (setenv "SHELL" (which "sh"))
diff --git a/gnu/packages/bootstrap.scm b/gnu/packages/bootstrap.scm
index c39e60ec8b..fee2ae1199 100644
--- a/gnu/packages/bootstrap.scm
+++ b/gnu/packages/bootstrap.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2018, 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2019 Carl Dong <contact@carldong.me>
 ;;; Copyright © 2019 Léo Le Bouter <lle-bout@zaclys.net>
+;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -740,9 +741,12 @@ exec ~a/bin/.gcc-wrapped -B~a/lib \
                            "1m5miqkyng45l745n0sfafdpjkqv9225xf44jqkygwsipj2cv9ks")))))))))
     (native-search-paths
      (list (search-path-specification
-            (variable "CPATH")
+            (variable "C_INCLUDE_PATH")
             (files '("include")))
            (search-path-specification
+            (variable "CPLUS_INCLUDE_PATH")
+            (files '("include/c++" "include")))
+           (search-path-specification
             (variable "LIBRARY_PATH")
             (files '("lib" "lib64")))))
     (synopsis "Bootstrap binaries of the GNU Compiler Collection")
diff --git a/gnu/packages/build-tools.scm b/gnu/packages/build-tools.scm
index 85ff7bb352..6bff33eba5 100644
--- a/gnu/packages/build-tools.scm
+++ b/gnu/packages/build-tools.scm
@@ -179,7 +179,7 @@ files and generates build instructions for the Ninja build system.")
 (define-public meson
   (package
     (name "meson")
-    (version "0.53.2")
+    (version "0.55.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/mesonbuild/meson/"
@@ -187,7 +187,7 @@ files and generates build instructions for the Ninja build system.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "07y2hh9dfn1m9g4bsy49nbn3vdmd0b2iwr8bxg19fhqq6c7q73ry"))))
+                "1070kjiirxxdfppmrhi3wsc6rykay1zlciqrzayjhjg0hkw42mrv"))))
     (build-system python-build-system)
     (arguments
      `(;; FIXME: Tests require many additional inputs, a fix for the RUNPATH
@@ -231,8 +231,7 @@ resembles Python.")
     (inherit meson)
     (name "meson-for-build")
     (source (origin
-              (inherit (package-source meson))
-              (patches (search-patches "meson-for-build-rpath.patch"))))
+              (inherit (package-source meson))))
 
     ;; People should probably install "meson", not "meson-for-build".
     (properties `((hidden? . #t)))))
diff --git a/gnu/packages/commencement.scm b/gnu/packages/commencement.scm
index 0938bc3d46..4bd50032af 100644
--- a/gnu/packages/commencement.scm
+++ b/gnu/packages/commencement.scm
@@ -788,17 +788,14 @@ $MES -e '(mescc)' module/mescc.scm -- \"$@\"
              (substitute* "config.h"
                (("#define GETCWD_BROKEN 1") "#undef GETCWD_BROKEN"))
              (let ((config.h (open-file "config.h" "a")))
-               (display (string-append
-                         ;; XXX TODO: remove nested ,(string-append ...) and
-                         ;; store file name on next rebuild cycle
-                         ,(string-append "
+               (display "
 // tcc: error: undefined symbol 'enable_hostname_completion'
 #define enable_hostname_completion(on_or_off) 0
 
-// /gnu/store/" "cq0cmv35s9dhilx14zaghlc08gpc0hwr-tcc-boot0-0.9.26-6.c004e9a/lib/libc.a: error: 'sigprocmask' defined twice
+// /gnu/store/…-tcc-boot0-0.9.26-6.c004e9a/lib/libc.a: error: 'sigprocmask' defined twice
 #define HAVE_POSIX_SIGNALS 1
 #define endpwent(x) 0
-"))
+"
                         config.h)
                (close config.h))
              #t))
@@ -2379,7 +2376,6 @@ exec " gcc "/bin/" program
     (version (package-version gcc-4.9))
     (source (bootstrap-origin (package-source gcc-4.9)))
     (native-inputs `(("gcc-wrapper" ,gcc-mesboot1-wrapper)
-                     ("gcc" ,gcc-mesboot1)
                      ("headers" ,glibc-headers-mesboot)
                      ,@(%boot-mesboot4-inputs)))
     (arguments
@@ -2639,7 +2635,7 @@ exec " gcc "/bin/" program
 
 (define gawk-boot0
   (package
-    (inherit patch)
+    (inherit gawk)
     (source (bootstrap-origin (package-source gawk)))
     (name "gawk-boot0")
     (native-inputs '())
@@ -3281,9 +3277,9 @@ memoized as a function of '%current-system'."
             `(modify-phases ,phases
                (add-before 'configure 'pre-configure
                  (lambda* (#:key inputs #:allow-other-keys)
-                   ;; Don't clobber CPATH with the bootstrap libc.
-                   (setenv "NATIVE_CPATH" (getenv "CPATH"))
-                   (unsetenv "CPATH")
+                   ;; Don't clobber include paths with the bootstrap libc.
+                   (unsetenv "C_INCLUDE_PATH")
+                   (unsetenv "CPLUS_INCLUDE_PATH")
 
                    ;; Tell 'libpthread' where to find 'libihash' on Hurd systems.
                    ,@(if (hurd-system?)
@@ -3294,13 +3290,6 @@ memoized as a function of '%current-system'."
                                            (assoc-ref %build-inputs "kernel-headers")
                                            "/lib/libihash.a\n"))))
                        '())
-
-                   ;; 'rpcgen' needs native libc headers to be built.
-                   (substitute* "sunrpc/Makefile"
-                     (("sunrpc-CPPFLAGS =.*" all)
-                      (string-append "CPATH = $(NATIVE_CPATH)\n"
-                                     "export CPATH\n"
-                                     all "\n")))
                    #t)))))))
     (propagated-inputs `(("kernel-headers" ,(kernel-headers-boot0))))
     (native-inputs
@@ -3318,9 +3307,6 @@ memoized as a function of '%current-system'."
              `(("mig" ,mig-boot0))
              '())
 
-       ;; A native GCC is needed to build `cross-rpcgen'.
-       ("native-gcc" ,@(assoc-ref (%boot0-inputs) "gcc"))
-
        ;; Here, we use the bootstrap Bash, which is not satisfactory
        ;; because we don't want to depend on bootstrap tools.
        ("static-bash" ,@(assoc-ref (%boot0-inputs) "bash"))))))
diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index 43831e0ff2..c51b8c671a 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -473,7 +473,7 @@ compressed with pbzip2 can be decompressed with bzip2).")
 (define-public xz
   (package
    (name "xz")
-   (version "5.2.4")
+   (version "5.2.5")
    (source (origin
             (method url-fetch)
             (uri (list (string-append "http://tukaani.org/xz/xz-" version
@@ -482,7 +482,7 @@ compressed with pbzip2 can be decompressed with bzip2).")
                                       version ".tar.gz")))
             (sha256
              (base32
-              "0ibi2zsfaz6l756spjwc5rayf4ckgc9hwmy8qinppcyk4svz64mm"))))
+              "045s9agl3bpv3swlwydhgsqh7791957vmgw2plw8f1rks07r3x7n"))))
    (build-system gnu-build-system)
    (arguments
     `(#:phases
@@ -1384,14 +1384,14 @@ or junctions, and always follows hard links.")
 (define-public zstd
   (package
     (name "zstd")
-    (version "1.4.4")
+    (version "1.4.5")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://github.com/facebook/zstd/releases/download/"
                            "v" version "/zstd-" version ".tar.gz"))
        (sha256
-        (base32 "05ckxap00qvc0j51d3ci38150cxsw82w7s9zgd5fgzspnzmp1vsr"))))
+        (base32 "17nf0r20360i80689bg5ipxbk2413b2dn3z7wj8byqpiddy1rscq"))))
     (build-system gnu-build-system)
     (outputs '("out"                    ;1.2MiB executables and documentation
                "lib"                    ;1.2MiB shared library and headers
@@ -1399,6 +1399,13 @@ or junctions, and always follows hard links.")
     (arguments
      `(#:phases
        (modify-phases %standard-phases
+         (add-after 'unpack 'remove-bogus-check
+           (lambda _
+             ;; lib/Makefile falsely claims that no .pc file can be created.
+             (substitute* "lib/Makefile"
+               (("error configured .*dir ")
+                "true "))
+             #t))
          (delete 'configure)            ;no configure script
          (add-after 'install 'adjust-library-locations
            (lambda* (#:key outputs #:allow-other-keys)
@@ -1423,9 +1430,12 @@ or junctions, and always follows hard links.")
                #t))))
        #:make-flags
        (list "CC=gcc"
-             (string-append "PREFIX=" (assoc-ref %outputs "out"))
-             (string-append "LIBDIR=" (assoc-ref %outputs "lib") "/lib")
-             (string-append "INCLUDEDIR=" (assoc-ref %outputs "lib") "/include")
+             (string-append "prefix=" (assoc-ref %outputs "out"))
+             (string-append "libdir=" (assoc-ref %outputs "lib") "/lib")
+             (string-append "includedir=" (assoc-ref %outputs "lib") "/include")
+             ;; Auto-detection is over-engineered and buggy.
+             "PCLIBDIR=lib"
+             "PCINCDIR=include"
              ;; Skip auto-detection of, and creating a dependency on, the build
              ;; environment's ‘xz’ for what amounts to a dubious feature anyway.
              "HAVE_LZMA=0"
@@ -1594,26 +1604,25 @@ recreates the stored directory structure by default.")
 (define-public zziplib
   (package
     (name "zziplib")
-    (version "0.13.69")
+    (version "0.13.71")
     (home-page "https://github.com/gdraheim/zziplib")
     (source (origin
               (method git-fetch)
               (uri (git-reference (url home-page)
                                   (commit (string-append "v" version))))
               (file-name (git-file-name name version))
-              (patches (search-patches "zziplib-CVE-2018-16548.patch"))
               (sha256
                (base32
-                "0fbk9k7ryas2wh2ykwkvm1pbi40i88rfvc3dydh9xyd7w2jcki92"))))
+                "109vznm9cxkqbj5r83qdgcdfk0j4kbg96dqr0q085nhwpgkw7viz"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:phases (modify-phases %standard-phases
-                  (add-before 'check 'make-files-writable
-                    (lambda _
-                      (for-each make-file-writable
-                                (find-files "test" #:directories? #t))
-                      #t)))
-
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'make-files-writable
+           (lambda _
+             (for-each make-file-writable
+                       (find-files "." #:directories? #t))
+             #t)))
        ;; XXX: The default test target attempts to download external resources and
        ;; fails without error: <https://github.com/gdraheim/zziplib/issues/53>.
        ;; To prevent confusing log messages, just run a simple zip test that works.
@@ -1622,9 +1631,7 @@ recreates the stored directory structure by default.")
      `(("zlib" ,zlib)))
     (native-inputs `(("perl" ,perl)     ; for the documentation
                      ("pkg-config" ,pkg-config)
-                     ;; for the documentation; Python 3 not supported,
-                     ;; http://forums.gentoo.org/viewtopic-t-863161-start-0.html
-                     ("python" ,python-2)
+                     ("python" ,python)
                      ("zip" ,zip))) ; to create test files
     (synopsis "Library for accessing zip files")
     (description
diff --git a/gnu/packages/crypto.scm b/gnu/packages/crypto.scm
index a45d2741e6..348e9103ff 100644
--- a/gnu/packages/crypto.scm
+++ b/gnu/packages/crypto.scm
@@ -376,7 +376,7 @@ secure operations. ")
              (lambda _
                (invoke "./worgen" "8-12" "top1000.txt" "3-10" "top400nouns.txt"
                        "3-6" "top150adjectives.txt" "3-6")
-               (invoke "./eschalot" "-r" "^guix|^guixsd")
+               (invoke "./eschalot" "-r" "^guix|^GuixSystem")
                (invoke "./eschalot" "-r" "^gnu|^free")
                (invoke "./eschalot" "-r" "^cyber|^hack")
                (invoke "./eschalot" "-r" "^troll")))
diff --git a/gnu/packages/cups.scm b/gnu/packages/cups.scm
index 173f8ca0f5..f13fc2f132 100644
--- a/gnu/packages/cups.scm
+++ b/gnu/packages/cups.scm
@@ -28,6 +28,7 @@
   #:use-module (gnu packages algebra)
   #:use-module (gnu packages autotools)
   #:use-module (gnu packages avahi)
+  #:use-module (gnu packages base)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages fonts)     ; font-dejavu
   #:use-module (gnu packages fontutils)
@@ -59,7 +60,7 @@
 (define-public cups-filters
   (package
     (name "cups-filters")
-    (version "1.27.4")
+    (version "1.28.5")
     (source(origin
               (method url-fetch)
               (uri
@@ -67,7 +68,7 @@
                               "cups-filters-" version ".tar.xz"))
               (sha256
                (base32
-                "110b1xhb5vfpcx0zq9kkas7pj281skx5dpnnr22idx509jfdzj8b"))
+                "03zn534whjxi3s7g0srdib1qhvwk0f826c5bci17jl5zpk3myhm8"))
               (modules '((guix build utils)))
               (snippet
                ;; install backends, banners and filters to cups-filters output
@@ -127,17 +128,18 @@
                         #t)))
                   (add-after 'install 'wrap-filters
                     (lambda* (#:key inputs outputs #:allow-other-keys)
-                      ;; Some filters expect to find 'gs' in $PATH.  We cannot
-                      ;; just hard-code its absolute file name in the source
+                      ;; Some filters expect to find things in $PATH.  We cannot
+                      ;; just hard-code all absolute file names in the source
                       ;; because foomatic-rip, for example, has tests like
                       ;; 'startswith(cmd, "gs")'.
                       (let ((out         (assoc-ref outputs "out"))
-                            (ghostscript (assoc-ref inputs "ghostscript")))
+                            (ghostscript (assoc-ref inputs "ghostscript"))
+                            (grep        (assoc-ref inputs "grep")))
                         (for-each (lambda (file)
                                     (wrap-program file
                                       `("PATH" ":" prefix
-                                        (,(string-append ghostscript
-                                                         "/bin")))))
+                                        (,(string-append ghostscript "/bin:"
+                                                         grep "/bin")))))
                                   (find-files (string-append
                                                out "/lib/cups/filter")))
                         #t))))))
@@ -150,6 +152,7 @@
        ("freetype"     ,freetype)
        ("font-dejavu"  ,font-dejavu) ; also needed by test suite
        ("ghostscript"  ,ghostscript/cups)
+       ("grep"         ,grep)
        ("ijs"          ,ijs)
        ("dbus"         ,dbus)
        ("lcms"         ,lcms)
diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index 55b7e4393b..973107860a 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -11,6 +11,7 @@
 ;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
 ;;; Copyright © 2020 Dale Mellor <guix-devel-0brg6b@rdmp.org>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -53,15 +54,14 @@
 (define-public curl
   (package
    (name "curl")
-   (version "7.69.1")
-   (replacement curl-7.71.0)
+   (version "7.73.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "https://curl.haxx.se/download/curl-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "0kwxh76iq9fblk7iyv4f75bmcmasarp2bcm1mm07wyvzd7kdbiq3"))
+              "12j0qaij1ppgspray8xvs2qk3h3m23wdqh27x87y1aw8xaj7qk3w"))
             (patches (search-patches "curl-use-ssl-cert-env.patch"))))
    (build-system gnu-build-system)
    (outputs '("out"
@@ -73,9 +73,10 @@
              ("nghttp2" ,nghttp2 "lib")
              ("zlib" ,zlib)))
    (native-inputs
-     `(("perl" ,perl)
+     `(("nghttp2" ,nghttp2)
+       ("perl" ,perl)
        ("pkg-config" ,pkg-config)
-       ("python" ,python-wrapper)))
+       ("python" ,python-minimal-wrapper)))
    (native-search-paths
     ;; These variables are introduced by curl-use-ssl-cert-env.patch.
     (list (search-path-specification
@@ -126,25 +127,6 @@
            (substitute* "tests/runtests.pl"
              (("/bin/sh") (which "sh")))
 
-           ;; XXX FIXME: Test #1510 seems to work on some machines and not
-           ;; others, possibly based on the kernel version.  It works on Guix System
-           ;; on x86_64 with linux-libre-4.1, but fails on Hydra for both i686
-           ;; and x86_64 with the following error:
-           ;;
-           ;; test 1510...[HTTP GET connection cache limit (CURLOPT_MAXCONNECTS)]
-           ;;
-           ;;  1510: output (log/stderr1510) FAILED:
-           ;; --- log/check-expected    2015-06-27 07:45:53.166720834 +0000
-           ;; +++ log/check-generated   2015-06-27 07:45:53.166720834 +0000
-           ;; @@ -1,5 +1,5 @@
-           ;;  * Connection #0 to host server1.example.com left intact[LF]
-           ;;  * Connection #1 to host server2.example.com left intact[LF]
-           ;;  * Connection #2 to host server3.example.com left intact[LF]
-           ;; -* Closing connection 0[LF]
-           ;; +* Closing connection 1[LF]
-           ;;  * Connection #3 to host server4.example.com left intact[LF]
-           (delete-file "tests/data/test1510")
-
            ;; The top-level "make check" does "make -C tests quiet-test", which
            ;; is too quiet.  Use the "test" target instead, which is more
            ;; verbose.
@@ -171,31 +153,6 @@ tunneling, and so on.")
     (name "curl-minimal")
     (inputs (alist-delete "openldap" (package-inputs curl))))))
 
-;; Replacement package to fix CVE-2020-8169 and CVE-2020-8177.
-(define curl-7.71.0
-  (package
-    (inherit curl)
-    (version "7.71.0")
-    (source (origin
-              (inherit (package-source curl))
-              (uri (string-append "https://curl.haxx.se/download/curl-"
-                                  version ".tar.xz"))
-              (sha256
-               (base32
-                "0wlppmx9iry8slh4pqcxj7lwc6fqwnlhh9ri2pcym2rx76a8gwfd"))))
-    (arguments
-     (substitute-keyword-arguments (package-arguments curl)
-       ((#:phases phases)
-        `(modify-phases ,phases
-           (replace 'check
-             (lambda _
-               ;; Test 1510 is now disabled upstream, and the test runner
-               ;; complains that it can not disable a non-existing test.
-               ;; Thus, override the phase to not delete the test.
-               (substitute* "tests/runtests.pl"
-                 (("/bin/sh") (which "sh")))
-               (invoke "make" "-C" "tests" "test")))))))))
-
 (define-public kurly
   (package
     (name "kurly")
diff --git a/gnu/packages/docbook.scm b/gnu/packages/docbook.scm
index ee09b9d0b4..2c7f920011 100644
--- a/gnu/packages/docbook.scm
+++ b/gnu/packages/docbook.scm
@@ -167,15 +167,17 @@ by no means limited to these applications.)  This package provides XML DTDs.")
 (define-public docbook-xsl
   (package
     (name "docbook-xsl")
-    (version "1.79.1")
+    (version "1.79.2")
     (source (origin
               (method url-fetch)
-              (uri (string-append "mirror://sourceforge/docbook/docbook-xsl/"
-                                  version "/docbook-xsl-" version ".tar.bz2"))
-              (patches (search-patches "docbook-xsl-nonrecursive-string-subst.patch"))
+              (uri (string-append "https://github.com/docbook/xslt10-stylesheets"
+                                  "/releases/download/release%2F" version
+                                  "/docbook-xsl-" version ".tar.bz2"))
+              (patches (search-patches "docbook-xsl-support-old-url.patch"
+                                       "docbook-xsl-nonrecursive-string-subst.patch"))
               (sha256
                (base32
-                "0s59lihif2fr7rznckxr2kfyrvkirv76r1zvidp9b5mj28p4apvj"))
+                "0wd33z41kdsybyx3ay21w6bdlmgpd9kyn3mr5y520lsf8km28r9i"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/emulators.scm b/gnu/packages/emulators.scm
index cf48b20675..0ce04dfaa5 100644
--- a/gnu/packages/emulators.scm
+++ b/gnu/packages/emulators.scm
@@ -1808,17 +1808,6 @@ performance, features, and ease of use.")
                     (guix build utils))
          #:phases
          (modify-phases %standard-phases
-           (add-after 'unpack 'install-bindings-to-python-output
-             (lambda* (#:key outputs #:allow-other-keys)
-               ;; python-build-system will build the bindings and install them to
-               ;; the "out" output, so change the build-internal names of the
-               ;; outputs.
-               ;;
-               ;; TODO: remove this once #40469 lands, through the core-updates
-               ;; holding zone, on master.
-               (set-car! (assoc "out" outputs) "lib")
-               (set-car! (assoc "python" outputs) "out")
-               #t))
            (add-before 'build 'build-library
              (lambda* (#:key inputs #:allow-other-keys)
                (invoke "make"
@@ -1831,7 +1820,7 @@ performance, features, and ease of use.")
                        "UNICORN_STATIC=no"
                        (string-append
                         "PREFIX="
-                        (assoc-ref outputs "lib")))))
+                        (assoc-ref outputs "out")))))
            (add-before 'build 'prepare-bindings
              (lambda* (#:key outputs #:allow-other-keys)
                (chdir "bindings/python")
@@ -1844,7 +1833,7 @@ performance, features, and ease of use.")
                  (("_path_list = \\[.*")
                   (string-append
                    "_path_list = [\""
-                   (assoc-ref outputs "lib")
+                   (assoc-ref outputs "out")
                    ;; eat the rest of the list
                    "/lib\"] + 0*[")))
                #t))
@@ -1865,10 +1854,10 @@ performance, features, and ease of use.")
                (let* ((python-samples (find-files "." "sample_.*"))
                       (c-samples (find-files "../../samples" ".*\\.c"))
                       (python-docdir
-                        (string-append (assoc-ref outputs "out")
+                        (string-append (assoc-ref outputs "python")
                                        "/share/doc/unicorn/samples"))
                       (c-docdir
-                        (string-append (assoc-ref outputs "lib")
+                        (string-append (assoc-ref outputs "out")
                                        "/share/doc/unicorn/samples")))
                  (for-each (cut install-file <> c-docdir) c-samples)
                  (for-each (cut install-file <> python-docdir) python-samples)
diff --git a/gnu/packages/engineering.scm b/gnu/packages/engineering.scm
index 2e1ffa1355..14d3de88ba 100644
--- a/gnu/packages/engineering.scm
+++ b/gnu/packages/engineering.scm
@@ -2785,9 +2785,7 @@ GUI.")
       ;; The GUI, which we elide, requires tcl and tk.
       (native-inputs `(("autoconf" ,autoconf)
                        ("automake" ,automake)
-                       ;; Requires bison 3.6+ but we currently only have 3.5.
-                       ;; Bison 3.6 will be available in the next core update.
-                       ("bison-3.6" ,bison-3.6)
+                       ("bison" ,bison)
                        ("clisp" ,clisp)
                        ("dejagnu" ,dejagnu)
                        ("flex" ,flex)
diff --git a/gnu/packages/file.scm b/gnu/packages/file.scm
index bac951f9c5..bed272ae35 100644
--- a/gnu/packages/file.scm
+++ b/gnu/packages/file.scm
@@ -4,6 +4,7 @@
 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2020 Michael Rohleder <mike@rohleder.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -30,14 +31,14 @@
 (define-public file
   (package
     (name "file")
-    (version "5.38")
+    (version "5.39")
     (source (origin
               (method url-fetch)
               (uri (string-append "ftp://ftp.astron.com/pub/file/file-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0d7s376b4xqymnrsjxi3nsv3f5v89pzfspzml2pcajdk5by2yg2r"))))
+                "1lgs2w2sgamzf27kz5h7pajz7v62554q21fbs11n4mfrfrm2hpgh"))))
    (build-system gnu-build-system)
 
    ;; When cross-compiling, this package depends upon a native install of
diff --git a/gnu/packages/fontutils.scm b/gnu/packages/fontutils.scm
index b3852fe093..f55d43db3a 100644
--- a/gnu/packages/fontutils.scm
+++ b/gnu/packages/fontutils.scm
@@ -6,7 +6,7 @@
 ;;; Copyright © 2017 Rene Saavedra <rennes@openmailbox.org>
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017 Nikita <nikita@n0.is>
-;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2017, 2018, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2018, 2019 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2019, 2020 Marius Bakke <mbakke@fastmail.com>
@@ -423,14 +423,14 @@ X11-system or any other graphical user interface.")
 (define-public teckit
   (package
     (name "teckit")
-    (version "2.5.9")                   ;signed by key 0xC9183BEA0288CDEE
+    (version "2.5.10")                  ; signed by key 0xC9183BEA0288CDEE
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://github.com/silnrsi/teckit/releases/"
                            "download/v" version "/teckit-" version ".tar.gz"))
        (sha256
-        (base32 "0gbxyip4wdibirdg2pvzayzyy927vxyd6dfyfiflx8zg88qzn8v8"))))
+        (base32 "12qnf8nhxyr4d5pc01s3vc6h726506957an4vvmmfz633cqi5796"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags '("--disable-static")))
diff --git a/gnu/packages/gawk.scm b/gnu/packages/gawk.scm
index d8494e9c1c..6b5eaa1f4c 100644
--- a/gnu/packages/gawk.scm
+++ b/gnu/packages/gawk.scm
@@ -30,13 +30,13 @@
 (define-public gawk
   (package
    (name "gawk")
-   (version "5.0.1")
+   (version "5.1.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/gawk/gawk-" version
                                 ".tar.xz"))
             (sha256
-             (base32 "15570p7g2x54asvr2fsc56sxzmm08fbk4mzpcs5n92fp9vq8cklf"))))
+             (base32 "1gc2cccqy1x1bf6rhwlmd8q7dz7gnam6nwgl38bxapv6qm5flpyg"))))
    (build-system gnu-build-system)
    (arguments
     `(#:phases (modify-phases %standard-phases
diff --git a/gnu/packages/gdb.scm b/gnu/packages/gdb.scm
index 828e49509d..9b96fd180b 100644
--- a/gnu/packages/gdb.scm
+++ b/gnu/packages/gdb.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2020 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2020 Vincent Legoll <vincent.legoll@gmail.com>
 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -118,6 +119,12 @@
                             mig/32-bit
                             mig)))
               '())))
+    ;; TODO: Add support for the GDB_DEBUG_FILE_DIRECTORY environment
+    ;; variable in GDB itself instead of relying on some glue code in
+    ;; the Guix-provided .gdbinit file.
+    (native-search-paths (list (search-path-specification
+                                (variable "GDB_DEBUG_FILE_DIRECTORY")
+                                (files '("lib/debug")))))
     (home-page "https://www.gnu.org/software/gdb/")
     (synopsis "The GNU debugger")
     (description
diff --git a/gnu/packages/gettext.scm b/gnu/packages/gettext.scm
index 426be35a25..c955a0d286 100644
--- a/gnu/packages/gettext.scm
+++ b/gnu/packages/gettext.scm
@@ -46,14 +46,14 @@
 (define-public gettext-minimal
   (package
     (name "gettext-minimal")
-    (version "0.20.1")
+    (version "0.21")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnu/gettext/gettext-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0p3zwkk27wm2m2ccfqm57nj7vqkmfpn7ja1nf65zmhz8qqs5chb6"))))
+                "04kbg1sx0ncfrsbr85ggjslqkzzb243fcw9nyh3rrv1a22ihszf7"))))
     (build-system gnu-build-system)
     (outputs '("out"
                "doc"))                            ;9 MiB of HTML
diff --git a/gnu/packages/ghostscript.scm b/gnu/packages/ghostscript.scm
index 4d56f05cf2..bbda8c27ad 100644
--- a/gnu/packages/ghostscript.scm
+++ b/gnu/packages/ghostscript.scm
@@ -9,6 +9,7 @@
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018, 2020 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -266,7 +267,7 @@ printing, and psresize, for adjusting page sizes.")
     (native-inputs
      `(("perl" ,perl)
        ("pkg-config" ,pkg-config)       ;needed for freetype
-       ("python" ,python-wrapper)
+       ("python" ,python-minimal-wrapper)
        ("tcl" ,tcl)
 
        ;; When cross-compiling, some of the natively-built tools require all
diff --git a/gnu/packages/gl.scm b/gnu/packages/gl.scm
index a8b142cacb..4e372c530b 100644
--- a/gnu/packages/gl.scm
+++ b/gnu/packages/gl.scm
@@ -13,6 +13,7 @@
 ;;; Copyright © 2019 Pierre Neidhardt <mail@ambrevar.xyz>
 ;;; Copyright © 2020 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2020 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -357,6 +358,12 @@ also known as DXTn or DXTC) for Mesa.")
                        (("'u_format_test',") ""))
                      #t)))
                '())
+         (add-after 'unpack 'fix-tests
+           (lambda _
+             ;; See <https://gitlab.freedesktop.org/mesa/mesa/-/issues/3181>.
+             (substitute* "src/compiler/glsl/glcpp/tests/084-unbalanced-parentheses.c.expected"
+              (("unexpected \\$end") "unexpected end of file"))
+             #t))
          (add-before 'configure 'fix-dlopen-libnames
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (let ((out (assoc-ref outputs "out")))
diff --git a/gnu/packages/glib.scm b/gnu/packages/glib.scm
index cde95b13eb..c45c7d4937 100644
--- a/gnu/packages/glib.scm
+++ b/gnu/packages/glib.scm
@@ -13,6 +13,8 @@
 ;;; Copyright © 2019 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;; Copyright © 2019, 2020 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2020 Nicolò Balzarotti <nicolo@nixo.xyz>
+;;; Copyright © 2020 Florian Pelz <pelzflorian@pelzflorian.de>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -208,7 +210,7 @@ shared NFS home directories.")
       ("m4" ,m4) ; for installing m4 macros
       ("dbus" ,dbus)                              ; for GDBus tests
       ("pkg-config" ,pkg-config)
-      ("python" ,python-wrapper)
+      ("python" ,python-minimal-wrapper)
       ("perl" ,perl)                              ; needed by GIO tests
       ("tzdata" ,tzdata-for-tests)))                  ; for tests/gdatetime.c
    (arguments
@@ -325,11 +327,14 @@ shared NFS home directories.")
               (for-each (lambda (x) (apply disable x)) failing-tests)
               #t)))
         (replace 'check
-          (lambda _
-            (setenv "MESON_TESTTHREADS"
-                    (number->string (parallel-job-count)))
-            ;; Do not run tests marked as "flaky".
-            (invoke "meson" "test" "--no-suite" "flaky")))
+          (lambda* (#:key tests? #:allow-other-keys)
+            (if tests?
+                (begin
+                  (setenv "MESON_TESTTHREADS"
+                          (number->string (parallel-job-count)))
+                  ;; Do not run tests marked as "flaky".
+                  (invoke "meson" "test" "--no-suite" "flaky"))
+                #t)))
         ;; TODO: meson does not permit the bindir to be outside of prefix.
         ;; See https://github.com/mesonbuild/meson/issues/2561
         ;; We can remove this once meson is patched.
diff --git a/gnu/packages/gnupg.scm b/gnu/packages/gnupg.scm
index c0f827b7e3..4044a9c3fa 100644
--- a/gnu/packages/gnupg.scm
+++ b/gnu/packages/gnupg.scm
@@ -128,14 +128,14 @@ Daemon and possibly more in the future.")
 (define-public libgcrypt
   (package
     (name "libgcrypt")
-    (version "1.8.5")
+    (version "1.8.6")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnupg/libgcrypt/libgcrypt-"
                                  version ".tar.bz2"))
              (sha256
               (base32
-                "1hvsazms1bfd769q0ngl0r9g5i4m9mpz9jmvvrdzyzk3rfa2ljiv"))))
+               "0xdrsxgqw5v7szshjdgdv60rgpvzzaqic32ahqrzr6bvc402gfhc"))))
     (build-system gnu-build-system)
     (propagated-inputs
      `(("libgpg-error-host" ,libgpg-error)))
diff --git a/gnu/packages/guile.scm b/gnu/packages/guile.scm
index 74f4e5adbc..912df146f1 100644
--- a/gnu/packages/guile.scm
+++ b/gnu/packages/guile.scm
@@ -284,14 +284,14 @@ without requiring the source code to be rewritten.")
   (package
     (inherit guile-2.2)
     (name "guile")
-    (version "3.0.2")
+    (version "3.0.4")
     (source (origin
               (inherit (package-source guile-2.2))
               (uri (string-append "mirror://gnu/guile/guile-"
                                   version ".tar.xz"))
               (sha256
                (base32
-                "12lziar4j27j9whqp2n18427q45y9ghq7gdd8lqhmj1k0lr7vi2k"))))
+                "0c8dkyvs6xbxp7rgnhkyakajzhakay7qn9kahj1mj49x5vf4fybb"))))
     (arguments
      ;; XXX: JIT-enabled Guile crashes in obscure ways on GNU/Hurd.
      (if (hurd-target?)
@@ -309,17 +309,8 @@ without requiring the source code to be rewritten.")
                      "share/guile/site/3.0")))))))
 
 (define-public guile-3.0-latest
-  ;; TODO: Make this 'guile-3.0' on the next rebuild cycle.
-  (package
-    (inherit guile-3.0)
-    (version "3.0.4")
-    (source (origin
-              (inherit (package-source guile-3.0))
-              (uri (string-append "mirror://gnu/guile/guile-"
-                                  version ".tar.xz"))
-              (sha256
-               (base32
-                "0c8dkyvs6xbxp7rgnhkyakajzhakay7qn9kahj1mj49x5vf4fybb"))))))
+  ;; The latest 3.0.x version.
+  guile-3.0)
 
 (define-public guile-next
   (deprecated-package "guile-next" guile-3.0))
diff --git a/gnu/packages/icu4c.scm b/gnu/packages/icu4c.scm
index 2fadc2ad8d..d467096708 100644
--- a/gnu/packages/icu4c.scm
+++ b/gnu/packages/icu4c.scm
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2015, 2016 Mark H Weaver <mhw@netris.org>
-;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2019, 2020 Marius Bakke <mbakke@fastmail.com>
@@ -39,7 +39,7 @@
 (define-public icu4c
   (package
    (name "icu4c")
-   (version "66.1")
+   (version "67.1")
    (source (origin
             (method url-fetch)
             (uri (string-append
@@ -48,10 +48,8 @@
                   "/icu4c-"
                   (string-map (lambda (x) (if (char=? x #\.) #\_ x)) version)
                   "-src.tgz"))
-            (patch-flags '("-p2"))
-            (patches (search-patches "icu4c-CVE-2020-10531.patch"))
             (sha256
-             (base32 "0bharwzc9nzkbrcf405z2nb3h7q0711z450arz0mjmdrk8hg58sj"))))
+             (base32 "1p6mhvxl0xr2n0g6xdps3mwzwlv6mjsz3xlpm793p9aiybb0ra4l"))))
    (build-system gnu-build-system)
    ;; When cross-compiling, this package needs a source directory of a
    ;; native-build of itself.
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 5044a527ce..03bcf1a2fa 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -26,6 +26,7 @@
 ;;; Copyright © 2020 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;; Copyright © 2020 R Veera Kumar <vkor@vkten.in>
 ;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -691,7 +692,7 @@ arithmetic ops.")
      `(("autoconf" ,autoconf)
        ("automake" ,automake)
        ("libtool" ,libtool)
-       ("python" ,python-wrapper)))     ;for tests
+       ("python" ,python-minimal-wrapper)))     ;for tests
     (synopsis "Decoder of the JBIG2 image compression format")
     (description
       "JBIG2 is designed for lossy or lossless encoding of @code{bilevel} (1-bit
diff --git a/gnu/packages/jemalloc.scm b/gnu/packages/jemalloc.scm
index c4b87b540d..906330a4b6 100644
--- a/gnu/packages/jemalloc.scm
+++ b/gnu/packages/jemalloc.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
-;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2017, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017 Eric Bavier <bavier@member.fsf.org>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -54,7 +54,7 @@
              #t)))
        ,@(if (any (cute string-prefix? <> (or (%current-target-system)
                                               (%current-system)))
-                 '("x64_64" "i686"))
+                 '("x86_64" "i686"))
            ;; Transparent huge pages are only enabled by default on Intel processors
            '()
            '(#:configure-flags (list "--disable-thp")))))
diff --git a/gnu/packages/kerberos.scm b/gnu/packages/kerberos.scm
index 20ed94b33b..0f3ff96388 100644
--- a/gnu/packages/kerberos.scm
+++ b/gnu/packages/kerberos.scm
@@ -10,6 +10,7 @@
 ;;; Copyright © 2017 Alex Vong <alexvong1995@gmail.com>
 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -41,6 +42,7 @@
   #:use-module (gnu packages compression)
   #:use-module (gnu packages readline)
   #:use-module (gnu packages sqlite)
+  #:use-module (gnu packages tcl)
   #:use-module (gnu packages texinfo)
   #:use-module (gnu packages tls)
   #:use-module ((guix licenses) #:prefix license:)
@@ -70,7 +72,10 @@
     (build-system gnu-build-system)
     (native-inputs
      `(("bison" ,bison)
-       ("perl" ,perl)))
+       ("perl" ,perl)
+       ("tcl" ,tcl)))                   ;required for some tests
+    (inputs
+     `(("openssl" ,openssl)))
     (arguments
      `(;; XXX: On 32-bit systems, 'kdb5_util' hangs on an fcntl/F_SETLKW call
        ;; while running the tests in 'src/tests'. Also disable tests when
diff --git a/gnu/packages/ld-wrapper.in b/gnu/packages/ld-wrapper.in
index 2b68b87fb9..0d53e746af 100644
--- a/gnu/packages/ld-wrapper.in
+++ b/gnu/packages/ld-wrapper.in
@@ -11,11 +11,12 @@
 # <https://lists.gnu.org/archive/html/guile-devel/2016-03/msg00000.html>.
 
 unset GUILE_LOAD_COMPILED_PATH
+unset GUILE_SYSTEM_COMPILED_PATH
 main="(@ (gnu build-support ld-wrapper) ld-wrapper)"
 exec @GUILE@ -c "(load-compiled \"@SELF@.go\") (apply $main (cdr (command-line)))" "$@"
 !#
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2020 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2020 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
diff --git a/gnu/packages/libevent.scm b/gnu/packages/libevent.scm
index dab574a155..8ae7c4c131 100644
--- a/gnu/packages/libevent.scm
+++ b/gnu/packages/libevent.scm
@@ -41,7 +41,7 @@
 (define-public libevent
   (package
     (name "libevent")
-    (version "2.1.11")
+    (version "2.1.12")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -49,12 +49,13 @@
                     version "-stable/libevent-" version "-stable.tar.gz"))
               (sha256
                (base32
-                "0g988zqm45sj1hlhhz4il5z4dpi5dl74hzjwzl4md37a09iaqnx6"))))
+                "1fq30imk8zd26x8066di3kpc5zyfc5z6frr3zll685zcx4dxxrlj"))))
     (build-system gnu-build-system)
     (outputs '("out" "bin"))
     (arguments
      ;; This skips some of the tests which fail on armhf and aarch64.
-     '(#:configure-flags '("--disable-libevent-regress")))
+     '(#:configure-flags '("--disable-libevent-regress"
+                           "--disable-openssl")))
     (inputs
      `(("python" ,python-wrapper)))     ;for 'event_rpcgen.py'
     (native-inputs
@@ -76,7 +77,7 @@ loop.")
 (define-public libev
   (package
     (name "libev")
-    (version "4.31")
+    (version "4.33")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://dist.schmorp.de/libev/Attic/libev-"
@@ -84,7 +85,7 @@ loop.")
                                   ".tar.gz"))
               (sha256
                (base32
-                "0nkfqv69wfyy2bpga4d53iqydycpik8jp8x6q70353hia8mmv1gd"))))
+                "1sjs4324is7fp21an4aas2z4dwsvs6z4xwrmp72vwpq1s6wbfzjh"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags '("--disable-static")))
@@ -102,14 +103,14 @@ limited support for fork events.")
 (define-public libuv
   (package
     (name "libuv")
-    (version "1.35.0")
+    (version "1.38.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dist.libuv.org/dist/v" version
                                   "/libuv-v" version ".tar.gz"))
               (sha256
                (base32
-                "0126mfmaw3s92dsga60sydgwjmzwg9cd36n127pydmisah17v50f"))))
+                "0iy6yp9nrxpj643w7la3kl3j59ni59b0l4v6n23a63s8kqkpvkhf"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags '("--disable-static")
diff --git a/gnu/packages/libffi.scm b/gnu/packages/libffi.scm
index ec8703ffdb..0e6a31d78c 100644
--- a/gnu/packages/libffi.scm
+++ b/gnu/packages/libffi.scm
@@ -2,7 +2,7 @@
 ;;; Copyright © 2012, 2013, 2014 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014 Federico Beffa <beffa@fbengineering.ch>
 ;;; Copyright © 2015, 2019 Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>
-;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016, 2017 Ben Woodcroft <donttrustben@gmail.com>
 ;;; Copyright © 2017, 2019, 2020 Marius Bakke <marius@gnu.org>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
@@ -50,7 +50,8 @@
                               name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0mi0cpf8aa40ljjmzxb7im6dbj45bb0kllcd09xgmp834y9agyvj"))))
+                "0mi0cpf8aa40ljjmzxb7im6dbj45bb0kllcd09xgmp834y9agyvj"))
+              (patches (search-patches "libffi-3.3-powerpc-fixes.patch"))))
     (build-system gnu-build-system)
     (arguments
      `(;; Prevent the build system from passing -march and -mtune to the
diff --git a/gnu/packages/libidn.scm b/gnu/packages/libidn.scm
index 8731ed3f83..b46cdfc0a5 100644
--- a/gnu/packages/libidn.scm
+++ b/gnu/packages/libidn.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2017 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2017 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2020 Michael Rohleder <mike@rohleder.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -33,14 +34,14 @@
 (define-public libidn
   (package
    (name "libidn")
-   (version "1.35")
+   (version "1.36")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/libidn/libidn-" version
                                 ".tar.gz"))
             (sha256
              (base32
-              "07pyy0afqikfq51z5kbzbj9ldbd12mri0zvx0mfv3ds6bc0g26pi"))))
+              "0f20n634whpmdwr81c2r0vxxjwchgkvhsr1i8s2bm0ad6h473dhl"))))
    (build-system gnu-build-system)
    ;; FIXME: No Java and C# libraries are currently built.
    (arguments
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 1d3daafc77..4e97ae9b5c 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -1487,7 +1487,10 @@ providing the system administrator with some help in common tasks.")
                "static"))       ;2.9 MiB static .a libraries
     (arguments
      `(#:configure-flags (list "--disable-use-tty-group"
-                               "--enable-fs-paths-default=/run/current-system/profile/sbin"
+                               (string-append
+                                "--enable-fs-paths-default="
+                                "/run/setuid-programs"
+                                ":/run/current-system/profile/sbin")
                                ;; Don't try to chown root:root mount and umount
                                "--disable-makeinstall-chown"
                                "--localstatedir=/var"
diff --git a/gnu/packages/llvm.scm b/gnu/packages/llvm.scm
index c500430dd5..127a8f5e55 100644
--- a/gnu/packages/llvm.scm
+++ b/gnu/packages/llvm.scm
@@ -87,6 +87,68 @@ as \"x86_64-linux\"."
       (string-append "https://releases.llvm.org/" version "/" component "-"
                      version ".src.tar.xz")))
 
+(define-public llvm-10
+  (package
+    (name "llvm")
+    (version "10.0.1")
+    (source
+     (origin
+      (method url-fetch)
+      (uri (llvm-uri "llvm" version))
+      (sha256
+       (base32
+        "1wydhbp9kyjp5y0rc627imxgkgqiv3dfirbqil9dgpnbaw5y7n65"))))
+    (build-system cmake-build-system)
+    (outputs '("out" "opt-viewer"))
+    (native-inputs
+     `(("python" ,python-2) ;bytes->str conversion in clang>=3.7 needs python-2
+       ("perl"   ,perl)))
+    (inputs
+     `(("libffi" ,libffi)))
+    (propagated-inputs
+     `(("zlib" ,zlib)))                 ;to use output from llvm-config
+    (arguments
+     `(#:configure-flags '("-DCMAKE_SKIP_BUILD_RPATH=FALSE"
+                           "-DCMAKE_BUILD_WITH_INSTALL_RPATH=FALSE"
+                           "-DBUILD_SHARED_LIBS:BOOL=TRUE"
+                           "-DLLVM_ENABLE_FFI:BOOL=TRUE"
+                           "-DLLVM_REQUIRES_RTTI=1" ; For some third-party utilities
+                           "-DLLVM_INSTALL_UTILS=ON") ; Needed for rustc.
+
+       ;; Don't use '-g' during the build, to save space.
+       #:build-type "Release"
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'build 'shared-lib-workaround
+           ;; Even with CMAKE_SKIP_BUILD_RPATH=FALSE, llvm-tblgen
+           ;; doesn't seem to get the correct rpath to be able to run
+           ;; from the build directory.  Set LD_LIBRARY_PATH as a
+           ;; workaround.
+           (lambda _
+             (setenv "LD_LIBRARY_PATH"
+                     (string-append (getcwd) "/lib"))
+             #t))
+         (add-after 'install 'install-opt-viewer
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (opt-viewer-out (assoc-ref outputs "opt-viewer"))
+                    (opt-viewer-share-dir (string-append opt-viewer-out "/share"))
+                    (opt-viewer-dir (string-append opt-viewer-share-dir "/opt-viewer")))
+               (mkdir-p opt-viewer-share-dir)
+               (rename-file (string-append out "/share/opt-viewer")
+                            opt-viewer-dir))
+             #t)))))
+    (home-page "https://www.llvm.org")
+    (synopsis "Optimizing compiler infrastructure")
+    (description
+     "LLVM is a compiler infrastructure designed for compile-time, link-time,
+runtime, and idle-time optimization of programs from arbitrary programming
+languages.  It currently supports compilation of C and C++ programs, using
+front-ends derived from GCC 4.0.1.  A new front-end for the C family of
+languages is in development.  The compiler infrastructure includes mirror sets
+of programming tools as well as libraries with equivalent functionality.")
+    (license license:asl2.0)))  ;with LLVM exceptions, see LICENSE.txt
+
 (define* (clang-runtime-from-llvm llvm hash
                                   #:optional (patches '()))
   (package
@@ -548,11 +610,11 @@ of programming tools as well as libraries with equivalent functionality.")
 (define-public clang-runtime-10
   (clang-runtime-from-llvm
    llvm-10
-   "0x9c531k6ww21s2mkdwqx1vbdjmx6d4wmfb8gdbj0wqa796sczba"))
+   "1yjqjri753w0fzmxcyz687nvd97sbc9rsqrxzpq720na47hwh3fr"))
 
 (define-public clang-10
   (clang-from-llvm llvm-10 clang-runtime-10
-                   "08fbxa2a0kr3ni35ckppj0kyvlcyaywrhpqwcdrdy0z900mhcnw8"
+                   "091bvcny2lh32zy8f3m9viayyhb2zannrndni7325rl85cwgr6pr"
                    #:patches '("clang-10.0-libc-search-path.patch")
                    #:tools-extra
                    (origin
@@ -561,7 +623,7 @@ of programming tools as well as libraries with equivalent functionality.")
                                              (package-version llvm-10)))
                      (sha256
                       (base32
-                       "074ija5s2jsdn0k035r2dzmryjmqxdnyg4xwvaqych2bazv8rpxc")))))
+                       "06n1yp638rh24xdxv9v2df0qajxbjz4w59b7dd4ky36drwmpi4yh")))))
 
 (define-public clang-toolchain-10
   (make-clang-toolchain clang-10))
@@ -597,6 +659,36 @@ of programming tools as well as libraries with equivalent functionality.")
 (define-public clang-toolchain-9
   (make-clang-toolchain clang-9))
 
+;; Default LLVM and Clang version.
+(define-public llvm llvm-9)
+(define-public clang-runtime clang-runtime-9)
+(define-public clang clang-9)
+(define-public clang-toolchain clang-toolchain-9)
+
+(define-public lld
+  (package
+    (name "lld")
+    (version (package-version llvm-10))
+    (source (origin
+              (method url-fetch)
+              (uri (llvm-uri "lld" version))
+              (sha256
+               (base32
+                "0ynzi35r4fckvp6842alpd43qr810j3728yfslc66fk2mbh4j52r"))))
+    (build-system cmake-build-system)
+    (inputs
+     `(("llvm" ,llvm-10)))
+    (arguments
+     `(#:build-type "Release"
+       ;; TODO: Tests require the lit tool, which isn't installed by the LLVM
+       ;; package.
+       #:tests? #f))
+    (home-page "https://lld.llvm.org/")
+    (synopsis "Linker from the LLVM project")
+    (description "LLD is a high-performance linker, built as a set of reusable
+components which highly leverage existing libraries in the larger LLVM Project.")
+    (license license:asl2.0))) ; With LLVM exception
+
 (define-public llvm-8
   (package
     (inherit llvm-9)
diff --git a/gnu/packages/make-bootstrap.scm b/gnu/packages/make-bootstrap.scm
index b2d3e2a326..04fdbce429 100644
--- a/gnu/packages/make-bootstrap.scm
+++ b/gnu/packages/make-bootstrap.scm
@@ -375,10 +375,6 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
                                              (package-arguments binutils))
                                   ((#:configure-flags flags _ ...)
                                    flags)))
-       #:make-flags ,(match (memq #:make-flags (package-arguments binutils))
-                       ((#:make-flags flags _ ...)
-                        flags)
-                       (_ ''()))
        #:strip-flags '("--strip-all")
        #:phases (modify-phases %standard-phases
                   (add-before 'configure 'all-static
diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
index 2a909ec1d4..1c02a1ab0f 100644
--- a/gnu/packages/maths.scm
+++ b/gnu/packages/maths.scm
@@ -3610,16 +3610,17 @@ parts of it.")
 (define-public openblas
   (package
     (name "openblas")
-    (version "0.3.9")
+    (version "0.3.10")
     (source
      (origin
-       (method url-fetch)
-       (uri (string-append "mirror://sourceforge/openblas/v" version "/OpenBLAS%20"
-                           version "%20version.tar.gz"))
-       (file-name (string-append name "-" version ".tar.gz"))
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/xianyi/OpenBLAS")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
        (sha256
         (base32
-         "14iz9xnrb9xiwgj84j94mc74gg0zn2vsy9fmsijxxma1n7dck4w3"))))
+         "174id98ga82bhz2v7sy9yj6pqy0h0088p3mkdikip69p9rh3d17b"))))
     (build-system gnu-build-system)
     (arguments
      `(#:test-target "test"
diff --git a/gnu/packages/multiprecision.scm b/gnu/packages/multiprecision.scm
index b3a5ec5894..c1880e3a7e 100644
--- a/gnu/packages/multiprecision.scm
+++ b/gnu/packages/multiprecision.scm
@@ -113,13 +113,13 @@ It is aimed at use in, for example, cryptography and computational algebra.")
 (define-public mpfr
   (package
    (name "mpfr")
-   (version "4.0.2")
+   (version "4.1.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/mpfr/mpfr-" version
                                 ".tar.xz"))
             (sha256 (base32
-                     "12m3amcavhpqygc499s3fzqlb8f2j2rr7fkqsm10xbjfc04fffqx"))))
+                     "0zwaanakrqjf84lfr5hfsdr7hncwv9wj0mchlr7cmxigfgqs760c"))))
    (build-system gnu-build-system)
    (outputs '("out" "debug"))
    (propagated-inputs `(("gmp" ,gmp)))            ; <mpfr.h> refers to <gmp.h>
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index f0b989b88a..cfcd08e94f 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -48,14 +48,14 @@
 (define-public node
   (package
     (name "node")
-    (version "10.20.0")
+    (version "10.22.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nodejs.org/dist/v" version
                                   "/node-v" version ".tar.xz"))
               (sha256
                (base32
-                "0cvjwnl0wkcsyw3kannbdv01s235wrnp11n2s6swzjx95gpichfi"))
+                "1nz18fa550li10r0kzsm28c2rvvq61nq8bqdygip0rmvbi2paxg0"))
               (modules '((guix build utils)))
               (snippet
                `(begin
@@ -201,24 +201,6 @@ devices.")
     (properties '((max-silent-time . 7200)     ;2h, needed on ARM
                   (timeout . 21600)))))        ;6h
 
-;; TODO: Make this the default node on core-updates.  This cannot be done on
-;; master since this version of node requires a newer nghttp2 library at link
-;; time.
-(define-public node-10.22
-  (package
-    (inherit node)
-    (version "10.22.0")
-    (source (origin
-              (inherit (package-source node))
-              (uri (string-append "https://nodejs.org/dist/v" version
-                                  "/node-v" version ".tar.xz"))
-              (sha256
-               (base32
-                "1nz18fa550li10r0kzsm28c2rvvq61nq8bqdygip0rmvbi2paxg0"))))
-    (inputs
-     (alist-replace "nghttp2" (list nghttp2-1.41 "lib")
-                    (package-inputs node)))))
-
 (define-public libnode
   (package
     (inherit node)
diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
index 6e863388d8..9c9b1f07b3 100644
--- a/gnu/packages/openldap.scm
+++ b/gnu/packages/openldap.scm
@@ -61,8 +61,7 @@
 (define-public openldap
   (package
    (name "openldap")
-   (replacement openldap-2.4.50)
-   (version "2.4.49")
+   (version "2.4.50")
    (source (origin
             (method url-fetch)
 
@@ -79,7 +78,7 @@
                         "openldap-release/openldap-" version ".tgz")))
             (sha256
              (base32
-              "0vp524rsngdcykf6ki7vprsyg7gj8z7hszg8xwxz50219fa1gcg3"))))
+              "1f46nlfwmys110j36sifm7ah8m8f3s10c3vaiikmmigmifapvdaw"))))
    (build-system gnu-build-system)
    (inputs `(("bdb" ,bdb-5.3)
              ("cyrus-sasl" ,cyrus-sasl)
@@ -127,19 +126,6 @@
    (license openldap2.8)
    (home-page "https://www.openldap.org/")))
 
-(define openldap-2.4.50
-  (package
-    (inherit openldap)
-    (version "2.4.50")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://www.openldap.org/software/download/"
-                                  "OpenLDAP/openldap-release/openldap-" version
-                                  ".tgz"))
-              (sha256
-               (base32
-                "1f46nlfwmys110j36sifm7ah8m8f3s10c3vaiikmmigmifapvdaw"))))))
-
 (define-public nss-pam-ldapd
   (package
     (name "nss-pam-ldapd")
diff --git a/gnu/packages/package-management.scm b/gnu/packages/package-management.scm
index ba338415ce..d59859335a 100644
--- a/gnu/packages/package-management.scm
+++ b/gnu/packages/package-management.scm
@@ -392,7 +392,7 @@ $(prefix)/etc/init.d\n")))
 
          ("glibc-utf8-locales" ,glibc-utf8-locales)))
       (propagated-inputs
-       `(("gnutls" ,(if (%current-target-system) gnutls-3.6.14 gnutls))
+       `(("gnutls" ,gnutls)
          ("guile-gcrypt" ,guile-gcrypt)
          ("guile-json" ,guile-json-4)
          ("guile-sqlite3" ,guile-sqlite3)
diff --git a/gnu/packages/patches/docbook-xsl-nonrecursive-string-subst.patch b/gnu/packages/patches/docbook-xsl-nonrecursive-string-subst.patch
index 4199dd18a5..fed4b76429 100644
--- a/gnu/packages/patches/docbook-xsl-nonrecursive-string-subst.patch
+++ b/gnu/packages/patches/docbook-xsl-nonrecursive-string-subst.patch
@@ -5,7 +5,7 @@ https://bugzilla.samba.org/show_bug.cgi?id=9515
 https://bugzilla.gnome.org/show_bug.cgi?id=736077 (for xsltproc)
 
 Patch copied from Debian:
-https://anonscm.debian.org/cgit/collab-maint/docbook-xsl.git/tree/debian/patches/765567_non-recursive_string_subst.patch
+https://salsa.debian.org/debian/docbook-xsl/-/blob/master/debian/patches/765567_non-recursive_string_subst.patch
 
 Description: use EXSLT "replace" function when available
  A recursive implementation  of string.subst is problematic,
@@ -15,11 +15,12 @@ Bug-Debian: https://bugs.debian.org/750593
 
 --- a/lib/lib.xsl
 +++ b/lib/lib.xsl
-@@ -10,7 +10,10 @@
+@@ -6,7 +6,11 @@
+ 
       This module implements DTD-independent functions
  
-      ******************************************************************** -->
--<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+-     ******************************************************************** --><xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
++     ******************************************************************** -->
 +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
 +                xmlns:str="http://exslt.org/strings"
 +                exclude-result-prefixes="str"
@@ -27,7 +28,7 @@ Bug-Debian: https://bugs.debian.org/750593
  
  <xsl:template name="dot.count">
    <!-- Returns the number of "." characters in a string -->
-@@ -56,6 +59,9 @@
+@@ -52,6 +56,9 @@
    <xsl:param name="replacement"/>
  
    <xsl:choose>
diff --git a/gnu/packages/patches/docbook-xsl-support-old-url.patch b/gnu/packages/patches/docbook-xsl-support-old-url.patch
new file mode 100644
index 0000000000..5b7dda458f
--- /dev/null
+++ b/gnu/packages/patches/docbook-xsl-support-old-url.patch
@@ -0,0 +1,17 @@
+Docbook 1.79.2 makes very few changes apart from changing the canonical URL
+to cdn.docbook.org.  This patch adds support for the previous URL to avoid
+breaking packages that still use that.
+
+Adapted from Debian:
+https://salsa.debian.org/debian/docbook-xsl/-/blob/master/debian/patches/0005-catalog.xml-Compatibility-with-1.79.1-or-earlier.patch
+
+--- a/catalog.xml
++++ b/catalog.xml
+@@ -5,4 +5,7 @@
+   <rewriteSystem systemIdStartString="http://cdn.docbook.org/release/xsl/current/" rewritePrefix="./"/>
+   <rewriteURI uriStartString="http://cdn.docbook.org/release/xsl/1.79.2/" rewritePrefix="./"/>
+   <rewriteSystem systemIdStartString="http://cdn.docbook.org/release/xsl/1.79.2/" rewritePrefix="./"/>
++  <!-- Also support old URI of v1.79.1 or earlier -->
++  <rewriteURI uriStartString="http://docbook.sourceforge.net/release/xsl/current/" rewritePrefix="./"/>
++  <rewriteSystem systemIdStartString="http://docbook.sourceforge.net/release/xsl/current/" rewritePrefix="./"/>
+ </catalog>
diff --git a/gnu/packages/patches/glibc-bootstrap-system.patch b/gnu/packages/patches/glibc-bootstrap-system.patch
index 39eb47ef26..fcaf17132d 100644
--- a/gnu/packages/patches/glibc-bootstrap-system.patch
+++ b/gnu/packages/patches/glibc-bootstrap-system.patch
@@ -3,17 +3,10 @@ and popen(3) need to be tweaked to use the right shell.  For the bootstrap
 glibc, we just use whatever `sh' can be found in $PATH.  The final glibc
 instead uses the hard-coded absolute file name of `bash'.
 
---- a/sysdeps/posix/system.c
-+++ b/sysdeps/posix/system.c
-@@ -140,7 +140,7 @@ do_system (const char *line)
-   __posix_spawnattr_setflags (&spawn_attr,
- 			      POSIX_SPAWN_SETSIGDEF | POSIX_SPAWN_SETSIGMASK);
- 
--  status = __posix_spawn (&pid, SHELL_PATH, 0, &spawn_attr,
-+  status = posix_spawnp (&pid, SHELL_NAME, 0, &spawn_attr,
- 			  (char *const[]){ (char*) SHELL_NAME,
- 					   (char*) "-c",
- 					   (char *) line, NULL },
+In addition, status should be initialized to 0 and not -1.
+
+diff --git a/libio/iopopen.c b/libio/iopopen.c
+index ebc381ed7c..e0d3ed1bc3 100644
 --- a/libio/iopopen.c
 +++ b/libio/iopopen.c
 @@ -85,7 +85,7 @@ spawn_process (posix_spawn_file_actions_t *fa, FILE *fp, const char *command,
@@ -25,4 +18,25 @@ instead uses the hard-coded absolute file name of `bash'.
  		     (char *const[]){ (char*) "sh", (char*) "-c",
  		     (char *) command, NULL }, __environ) != 0)
      return false;
-
+diff --git a/sysdeps/posix/system.c b/sysdeps/posix/system.c
+index a03f478fc7..94da6facf3 100644
+--- a/sysdeps/posix/system.c
++++ b/sysdeps/posix/system.c
+@@ -101,7 +101,7 @@ cancel_handler (void *arg)
+ static int
+ do_system (const char *line)
+ {
+-  int status = -1;
++  int status = 0;
+   int ret;
+   pid_t pid;
+   struct sigaction sa;
+@@ -145,7 +145,7 @@ do_system (const char *line)
+   __posix_spawnattr_setflags (&spawn_attr,
+ 			      POSIX_SPAWN_SETSIGDEF | POSIX_SPAWN_SETSIGMASK);
+ 
+-  ret = __posix_spawn (&pid, SHELL_PATH, 0, &spawn_attr,
++  ret = posix_spawnp (&pid, SHELL_NAME, 0, &spawn_attr,
+ 		       (char *const[]){ (char *) SHELL_NAME,
+ 					(char *) "-c",
+ 					(char *) line, NULL },
diff --git a/gnu/packages/patches/icu4c-CVE-2020-10531.patch b/gnu/packages/patches/icu4c-CVE-2020-10531.patch
deleted file mode 100644
index c2ab923bdc..0000000000
--- a/gnu/packages/patches/icu4c-CVE-2020-10531.patch
+++ /dev/null
@@ -1,127 +0,0 @@
-Fix CVE-2020-10531:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10531
-
-Patch copied from upstream source repository (changes to the test suite
-are commented out):
-
-https://github.com/unicode-org/icu/commit/b7d08bc04a4296982fcef8b6b8a354a9e4e7afca
-
-From b7d08bc04a4296982fcef8b6b8a354a9e4e7afca Mon Sep 17 00:00:00 2001
-From: Frank Tang <ftang@chromium.org>
-Date: Sat, 1 Feb 2020 02:39:04 +0000
-Subject: [PATCH] ICU-20958 Prevent SEGV_MAPERR in append
-
-See #971
----
- icu4c/source/common/unistr.cpp          |  6 ++-
- icu4c/source/test/intltest/ustrtest.cpp | 62 +++++++++++++++++++++++++
- icu4c/source/test/intltest/ustrtest.h   |  1 +
- 3 files changed, 68 insertions(+), 1 deletion(-)
-
-diff --git a/icu4c/source/common/unistr.cpp b/icu4c/source/common/unistr.cpp
-index 901bb3358ba..077b4d6ef20 100644
---- a/icu4c/source/common/unistr.cpp
-+++ b/icu4c/source/common/unistr.cpp
-@@ -1563,7 +1563,11 @@ UnicodeString::doAppend(const UChar *srcChars, int32_t srcStart, int32_t srcLeng
-   }
- 
-   int32_t oldLength = length();
--  int32_t newLength = oldLength + srcLength;
-+  int32_t newLength;
-+  if (uprv_add32_overflow(oldLength, srcLength, &newLength)) {
-+    setToBogus();
-+    return *this;
-+  }
- 
-   // Check for append onto ourself
-   const UChar* oldArray = getArrayStart();
-#diff --git a/icu4c/source/test/intltest/ustrtest.cpp b/icu4c/source/test/intltest/ustrtest.cpp
-#index b6515ea813c..ad38bdf53a3 100644
-#--- a/icu4c/source/test/intltest/ustrtest.cpp
-#+++ b/icu4c/source/test/intltest/ustrtest.cpp
-#@@ -67,6 +67,7 @@ void UnicodeStringTest::runIndexedTest( int32_t index, UBool exec, const char* &
-#     TESTCASE_AUTO(TestWCharPointers);
-#     TESTCASE_AUTO(TestNullPointers);
-#     TESTCASE_AUTO(TestUnicodeStringInsertAppendToSelf);
-#+    TESTCASE_AUTO(TestLargeAppend);
-#     TESTCASE_AUTO_END;
-# }
-# 
-#@@ -2310,3 +2311,64 @@ void UnicodeStringTest::TestUnicodeStringInsertAppendToSelf() {
-#     str.insert(2, sub);
-#     assertEquals("", u"abbcdcde", str);
-# }
-#+
-#+void UnicodeStringTest::TestLargeAppend() {
-#+    if(quick) return;
-#+
-#+    IcuTestErrorCode status(*this, "TestLargeAppend");
-#+    // Make a large UnicodeString
-#+    int32_t len = 0xAFFFFFF;
-#+    UnicodeString str;
-#+    char16_t *buf = str.getBuffer(len);
-#+    // A fast way to set buffer to valid Unicode.
-#+    // 4E4E is a valid unicode character
-#+    uprv_memset(buf, 0x4e, len * 2);
-#+    str.releaseBuffer(len);
-#+    UnicodeString dest;
-#+    // Append it 16 times
-#+    // 0xAFFFFFF times 16 is 0xA4FFFFF1,
-#+    // which is greater than INT32_MAX, which is 0x7FFFFFFF.
-#+    int64_t total = 0;
-#+    for (int32_t i = 0; i < 16; i++) {
-#+        dest.append(str);
-#+        total += len;
-#+        if (total <= INT32_MAX) {
-#+            assertFalse("dest is not bogus", dest.isBogus());
-#+        } else {
-#+            assertTrue("dest should be bogus", dest.isBogus());
-#+        }
-#+    }
-#+    dest.remove();
-#+    total = 0;
-#+    for (int32_t i = 0; i < 16; i++) {
-#+        dest.append(str);
-#+        total += len;
-#+        if (total + len <= INT32_MAX) {
-#+            assertFalse("dest is not bogus", dest.isBogus());
-#+        } else if (total <= INT32_MAX) {
-#+            // Check that a string of exactly the maximum size works
-#+            UnicodeString str2;
-#+            int32_t remain = INT32_MAX - total;
-#+            char16_t *buf2 = str2.getBuffer(remain);
-#+            if (buf2 == nullptr) {
-#+                // if somehow memory allocation fail, return the test
-#+                return;
-#+            }
-#+            uprv_memset(buf2, 0x4e, remain * 2);
-#+            str2.releaseBuffer(remain);
-#+            dest.append(str2);
-#+            total += remain;
-#+            assertEquals("When a string of exactly the maximum size works", (int64_t)INT32_MAX, total);
-#+            assertEquals("When a string of exactly the maximum size works", INT32_MAX, dest.length());
-#+            assertFalse("dest is not bogus", dest.isBogus());
-#+
-#+            // Check that a string size+1 goes bogus
-#+            str2.truncate(1);
-#+            dest.append(str2);
-#+            total++;
-#+            assertTrue("dest should be bogus", dest.isBogus());
-#+        } else {
-#+            assertTrue("dest should be bogus", dest.isBogus());
-#+        }
-#+    }
-#+}
-#diff --git a/icu4c/source/test/intltest/ustrtest.h b/icu4c/source/test/intltest/ustrtest.h
-#index 218befdcc68..4a356a92c7a 100644
-#--- a/icu4c/source/test/intltest/ustrtest.h
-#+++ b/icu4c/source/test/intltest/ustrtest.h
-#@@ -97,6 +97,7 @@ class UnicodeStringTest: public IntlTest {
-#     void TestWCharPointers();
-#     void TestNullPointers();
-#     void TestUnicodeStringInsertAppendToSelf();
-#+    void TestLargeAppend();
-# };
-# 
-# #endif
diff --git a/gnu/packages/patches/libffi-3.3-powerpc-fixes.patch b/gnu/packages/patches/libffi-3.3-powerpc-fixes.patch
new file mode 100644
index 0000000000..971ed26180
--- /dev/null
+++ b/gnu/packages/patches/libffi-3.3-powerpc-fixes.patch
@@ -0,0 +1,138 @@
+This is a combination of the following 4 commits:
+https://github.com/libffi/libffi/commit/01a75ed76ea7e57f1b7a5c183e2b1e890e6aa0fd.patch
+https://github.com/libffi/libffi/commit/6663047f56c2932a6b10a790f4ac6666dd181326.patch
+https://github.com/libffi/libffi/commit/e50b9ef8b910fa642ef158f6642e60d54d7ad740.patch
+https://github.com/libffi/libffi/commit/4d6d2866ae43e55325e8ee96561221804602cd7a.patch
+
+From 2dbfa92a95e3bacabca431b89d2a5925e48a0e40 Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <slyfox@gentoo.org>
+Date: Thu, 28 Nov 2019 12:42:41 +0000
+
+powerpc: fix build failure on power7 and older (#532)
+
+Build failure looks as:
+```
+libtool: compile:  powerpc-unknown-linux-gnu-gcc \
+    -O2 -mcpu=powerpc -mtune=powerpc -pipe ... -c src/powerpc/ffi.c ...
+In file included from src/powerpc/ffi.c:33:
+src/powerpc/ffi_powerpc.h:65:9: error: '__int128' is not supported on this target
+   65 | typedef __int128 float128;
+      |         ^~~~~~~~
+```
+
+The fix avoids using __int128 in favour of aligned char[16].
+
+Closes: https://github.com/libffi/libffi/issues/531
+Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
+
+Address platforms with no __int128.
+
+powerpc64: Use memcpy to help platforms with no __int128. (#534)
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+
+Update powerpc sysv assembly for ffi_powerpc.h changes (#541)
+
+Some of the flag bits were moved when adding powerpc64 vector support.
+
+Fixes #536
+---
+ src/powerpc/ffi_linux64.c | 12 ++++++------
+ src/powerpc/ffi_powerpc.h |  2 +-
+ src/powerpc/sysv.S        | 12 +++++-------
+ 3 files changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/src/powerpc/ffi_linux64.c b/src/powerpc/ffi_linux64.c
+index de0d033..4d50878 100644
+--- a/src/powerpc/ffi_linux64.c
++++ b/src/powerpc/ffi_linux64.c
+@@ -547,9 +547,9 @@ ffi_prep_args64 (extended_cif *ecif, unsigned long *const stack)
+               if (next_arg.ul == gpr_end.ul)
+                 next_arg.ul = rest.ul;
+               if (vecarg_count < NUM_VEC_ARG_REGISTERS64 && i < nfixedargs)
+-                *vec_base.f128++ = **p_argv.f128;
++		memcpy (vec_base.f128++, *p_argv.f128, sizeof (float128));
+               else
+-                *next_arg.f128 = **p_argv.f128;
++		memcpy (next_arg.f128, *p_argv.f128, sizeof (float128));
+               if (++next_arg.f128 == gpr_end.f128)
+                 next_arg.f128 = rest.f128;
+               vecarg_count++;
+@@ -680,9 +680,9 @@ ffi_prep_args64 (extended_cif *ecif, unsigned long *const stack)
+                     {
+                       if (vecarg_count < NUM_VEC_ARG_REGISTERS64
+                           && i < nfixedargs)
+-                        *vec_base.f128++ = *arg.f128++;
++		        memcpy (vec_base.f128++, arg.f128, sizeof (float128));
+                       else
+-                        *next_arg.f128 = *arg.f128++;
++		        memcpy (next_arg.f128, arg.f128++, sizeof (float128));
+                       if (++next_arg.f128 == gpr_end.f128)
+                         next_arg.f128 = rest.f128;
+                       vecarg_count++;
+@@ -986,9 +986,9 @@ ffi_closure_helper_LINUX64 (ffi_cif *cif,
+                   do
+                     {
+                       if (pvec < end_pvec && i < nfixedargs)
+-                        *to.f128 = *pvec++;
++		        memcpy (to.f128, pvec++, sizeof (float128));
+                       else
+-                        *to.f128 = *from.f128;
++		        memcpy (to.f128, from.f128, sizeof (float128));
+                       to.f128++;
+                       from.f128++;
+                     }
+diff --git a/src/powerpc/ffi_powerpc.h b/src/powerpc/ffi_powerpc.h
+index 5ee2a70..8e2f2f0 100644
+--- a/src/powerpc/ffi_powerpc.h
++++ b/src/powerpc/ffi_powerpc.h
+@@ -62,7 +62,7 @@ typedef _Float128 float128;
+ #elif defined(__FLOAT128__)
+ typedef __float128 float128;
+ #else
+-typedef __int128 float128;
++typedef char float128[16] __attribute__((aligned(16)));
+ #endif
+ 
+ void FFI_HIDDEN ffi_closure_SYSV (void);
+diff --git a/src/powerpc/sysv.S b/src/powerpc/sysv.S
+index 1474ce7..df97734 100644
+--- a/src/powerpc/sysv.S
++++ b/src/powerpc/sysv.S
+@@ -104,17 +104,16 @@ ENTRY(ffi_call_SYSV)
+ 	bctrl
+ 
+ 	/* Now, deal with the return value.  */
+-	mtcrf	0x01,%r31 /* cr7  */
++	mtcrf	0x03,%r31 /* cr6-cr7  */
+ 	bt-	31,L(small_struct_return_value)
+ 	bt-	30,L(done_return_value)
+ #ifndef __NO_FPRS__
+ 	bt-	29,L(fp_return_value)
+ #endif
+ 	stw	%r3,0(%r30)
+-	bf+	28,L(done_return_value)
++	bf+	27,L(done_return_value)
+ 	stw	%r4,4(%r30)
+-	mtcrf	0x02,%r31 /* cr6  */
+-	bf	27,L(done_return_value)
++	bf	26,L(done_return_value)
+ 	stw     %r5,8(%r30)
+ 	stw	%r6,12(%r30)
+ 	/* Fall through...  */
+@@ -145,10 +144,9 @@ L(done_return_value):
+ #ifndef __NO_FPRS__
+ L(fp_return_value):
+ 	.cfi_restore_state
+-	bf	28,L(float_return_value)
++	bf	27,L(float_return_value)
+ 	stfd	%f1,0(%r30)
+-	mtcrf   0x02,%r31 /* cr6  */
+-	bf	27,L(done_return_value)
++	bf	26,L(done_return_value)
+ 	stfd	%f2,8(%r30)
+ 	b	L(done_return_value)
+ L(float_return_value):
+-- 
+2.26.0
+
diff --git a/gnu/packages/patches/meson-for-build-rpath.patch b/gnu/packages/patches/meson-for-build-rpath.patch
deleted file mode 100644
index ef9a73f07c..0000000000
--- a/gnu/packages/patches/meson-for-build-rpath.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-This patch removes a part of meson that clears the rpath upon installation.
-This will only be applied to a special version of meson, used for the
-meson-build-system.
-
-Original patch for Meson 0.42.0 by Peter Mikkelsen <petermikkelsen10@gmail.com>
-
---- meson-0.47.1/mesonbuild/minstall.py.old	2018-08-10 11:01:27.812327013 +0200
-+++ meson-0.47.1/mesonbuild/minstall.py	2018-08-10 11:01:51.940368505 +0200
-@@ -436,15 +436,6 @@
-                         print("Symlink creation does not work on this platform. "
-                               "Skipping all symlinking.")
-                         printed_symlink_error = True
--            if os.path.isfile(outname):
--                try:
--                    depfixer.fix_rpath(outname, install_rpath, final_path,
--                                       install_name_mappings, verbose=False)
--                except SystemExit as e:
--                    if isinstance(e.code, int) and e.code == 0:
--                        pass
--                    else:
--                        raise
- 
- def run(args):
-     parser = buildparser()
diff --git a/gnu/packages/patches/python-babel-fix-parse-future-test.patch b/gnu/packages/patches/python-babel-fix-parse-future-test.patch
new file mode 100644
index 0000000000..8a90166ec5
--- /dev/null
+++ b/gnu/packages/patches/python-babel-fix-parse-future-test.patch
@@ -0,0 +1,68 @@
+From 7bdaa28a55e8d8228d5434effa4b1473ab7b3669 Mon Sep 17 00:00:00 2001
+From: Felix Schwarz <felix.schwarz@oss.schwarz.eu>
+Date: Tue, 5 May 2020 08:05:56 +0000
+Subject: [PATCH] fix tests when using Python 3.9a6
+
+In Python 3.9a6 integer values for future flags were changed to prevent
+collision with compiler flags. We need to retrieve these at runtime so
+the test suite works with Python <= 3.8 as well as Python 3.9.
+---
+ tests/test_util.py | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/tests/test_util.py b/tests/test_util.py
+index a6a4450c..b9343aaa 100644
+--- a/tests/test_util.py
++++ b/tests/test_util.py
+@@ -11,6 +11,7 @@
+ # individuals. For the exact contribution history, see the revision
+ # history and logs, available at http://babel.edgewall.org/log/.
+ 
++import __future__
+ import unittest
+ 
+ import pytest
+@@ -20,6 +21,12 @@
+ from babel.util import parse_future_flags
+ 
+ 
++class _FF:
++    division         = __future__.division.compiler_flag
++    print_function   = __future__.print_function.compiler_flag
++    with_statement   = __future__.with_statement.compiler_flag
++    unicode_literals = __future__.unicode_literals.compiler_flag
++
+ def test_distinct():
+     assert list(util.distinct([1, 2, 1, 3, 4, 4])) == [1, 2, 3, 4]
+     assert list(util.distinct('foobar')) == ['f', 'o', 'b', 'a', 'r']
+@@ -70,25 +77,25 @@ def test_parse_encoding_non_ascii():
+ from __future__ import print_function,
+     division, with_statement,
+     unicode_literals
+-''', 0x10000 | 0x2000 | 0x8000 | 0x20000),
++''', _FF.print_function | _FF.division | _FF.with_statement | _FF.unicode_literals),
+     ('''
+ from __future__ import print_function, division
+ print('hello')
+-''', 0x10000 | 0x2000),
++''', _FF.print_function | _FF.division),
+     ('''
+ from __future__ import print_function, division, unknown,,,,,
+ print 'hello'
+-''', 0x10000 | 0x2000),
++''', _FF.print_function | _FF.division),
+     ('''
+ from __future__ import (
+     print_function,
+     division)
+-''', 0x10000 | 0x2000),
++''', _FF.print_function | _FF.division),
+     ('''
+ from __future__ import \\
+     print_function, \\
+     division
+-''', 0x10000 | 0x2000),
++''', _FF.print_function | _FF.division),
+ ])
+ def test_parse_future(source, result):
+     fp = BytesIO(source.encode('latin-1'))
diff --git a/gnu/packages/patches/zziplib-CVE-2018-16548.patch b/gnu/packages/patches/zziplib-CVE-2018-16548.patch
deleted file mode 100644
index a17c6a9768..0000000000
--- a/gnu/packages/patches/zziplib-CVE-2018-16548.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-The following 3 patches applied to 0.13.69 in this order, combined:
-https://github.com/gdraheim/zziplib/commit/9411bde3e4a70a81ff3ffd256b71927b2d90dcbb.patch
-https://github.com/gdraheim/zziplib/commit/d2e5d5c53212e54a97ad64b793a4389193fec687.patch
-https://github.com/gdraheim/zziplib/commit/0e1dadb05c1473b9df2d7b8f298dab801778ef99.patch
-
-diff --git a/test/test.zip b/test/test.zip
-index 2c992ea..952d475 100644
-Binary files a/test/test.zip and b/test/test.zip differ
-diff --git a/zzip/zip.c b/zzip/zip.c
-index 14e2e06..f97a40a 100644
---- a/zzip/zip.c
-+++ b/zzip/zip.c
-@@ -472,9 +472,15 @@ __zzip_parse_root_directory(int fd,
-         } else
-         {
-             if (io->fd.seeks(fd, zz_rootseek + zz_offset, SEEK_SET) < 0)
-+	    {
-+	    	free(hdr0);
-                 return ZZIP_DIR_SEEK;
-+	    }
-             if (io->fd.read(fd, &dirent, sizeof(dirent)) < __sizeof(dirent))
-+	    {
-+	    	free(hdr0);
-                 return ZZIP_DIR_READ;
-+	    }
-             d = &dirent;
-         }
- 
-@@ -574,11 +580,18 @@ __zzip_parse_root_directory(int fd,
- 
-         if (hdr_return)
-             *hdr_return = hdr0;
-+	else
-+	{
-+	    /* If it is not assigned to *hdr_return, it will never be free()'d */
-+	    free(hdr0);
-+	}
-     }                           /* else zero (sane) entries */
-+    else
-+        free(hdr0);
- #  ifndef ZZIP_ALLOW_MODULO_ENTRIES
--    return (entries != zz_entries ? ZZIP_CORRUPTED : 0);
-+    return (entries != zz_entries) ? ZZIP_CORRUPTED : 0;
- #  else
--    return ((entries & (unsigned)0xFFFF) != zz_entries ? ZZIP_CORRUPTED : 0);
-+    return ((entries & (unsigned)0xFFFF) != zz_entries) ? ZZIP_CORRUPTED : 0;
- #  endif
- }
- 
diff --git a/gnu/packages/python-xyz.scm b/gnu/packages/python-xyz.scm
index 2a3143b739..69aaaa1670 100644
--- a/gnu/packages/python-xyz.scm
+++ b/gnu/packages/python-xyz.scm
@@ -645,25 +645,15 @@ by @code{binstar}, @code{binstar-build}, and @code{chalmers}.")
       (uri (pypi-uri "Babel" version))
       (sha256
        (base32
-        "0f0f2vvs1mpdpz2c0mg1mnc3sih8bizmc1h9m67kdsnqs3i2mb0s"))))
+        "0f0f2vvs1mpdpz2c0mg1mnc3sih8bizmc1h9m67kdsnqs3i2mb0s"))
+      (patches (search-patches "python-babel-fix-parse-future-test.patch"))))
     (build-system python-build-system)
     (native-inputs
      `(("python-freezegun" ,python-freezegun)
        ("python-pytest" ,python-pytest)))
     (propagated-inputs
      `(("python-pytz" ,python-pytz)))
-    (arguments
-     `(#:phases (modify-phases %standard-phases
-                  (replace 'check
-                    (lambda _
-                      (invoke "pytest" "-vv" "-k"
-                              (string-append
-                               ;; XXX: These tests fail when using Pytest 4.x and
-                               ;; Babel 2.6.0.  Try removing this for later versions.
-                               "not test_no_inherit_metazone_marker_never_in_output"
-                               " and not test_smoke_dates"
-                               " and not test_smoke_numbers")))))))
-    (home-page "http://babel.pocoo.org/")
+    (home-page "https://babel.pocoo.org/")
     (synopsis
      "Tools for internationalizing Python applications")
     (description
diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm
index 8f2651decf..d99ff18af2 100644
--- a/gnu/packages/python.scm
+++ b/gnu/packages/python.scm
@@ -59,6 +59,7 @@
 ;;; Copyright © 2018 Vagrant Cascadian <vagrant@debian.org>
 ;;; Copyright © 2019 Tanguy Le Carrour <tanguy@bioneland.org>
 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2020 Greg Hogan <code@greghogan.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -364,7 +365,7 @@ data types.")
 (define-public python-3.8
   (package (inherit python-2)
     (name "python")
-    (version "3.8.2")
+    (version "3.8.5")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://www.python.org/ftp/python/"
@@ -376,7 +377,7 @@ data types.")
                         "python-3-search-paths.patch"))
               (sha256
                (base32
-                "1ps5v323cp5czfshqjmbsqw7nvrdpcbk06f62jbzaqik4gfffii6"))
+                "1c43dbv9lvlp3ynqmgdi4rh8q94swanhqarqrdx62zmigpakw073"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/ruby.scm b/gnu/packages/ruby.scm
index cd452f88d3..42d4faa234 100644
--- a/gnu/packages/ruby.scm
+++ b/gnu/packages/ruby.scm
@@ -88,7 +88,7 @@
         license:gpl2+
         license:gpl3+))
 
-(define-public ruby
+(define-public ruby-2.6
   (package
     (name "ruby")
     (version "2.6.5")
@@ -146,7 +146,7 @@ a focus on simplicity and productivity.")
 
 (define-public ruby-2.7
   (package
-    (inherit ruby)
+    (inherit ruby-2.6)
     (version "2.7.1")
     (source
      (origin
@@ -189,7 +189,7 @@ a focus on simplicity and productivity.")
 
 (define-public ruby-2.5
   (package
-    (inherit ruby)
+    (inherit ruby-2.6)
     (version "2.5.8")
     (source
      (origin
@@ -208,7 +208,7 @@ a focus on simplicity and productivity.")
 
 (define-public ruby-2.4
   (package
-    (inherit ruby)
+    (inherit ruby-2.6)
     (version "2.4.10")
     (source
      (origin
@@ -225,6 +225,8 @@ a focus on simplicity and productivity.")
                    (delete-file-recursively "ext/fiddle/libffi-3.2.1")
                    #t))))))
 
+(define-public ruby ruby-2.7)
+
 (define-public mruby
   (package
     (name "mruby")
@@ -1213,14 +1215,6 @@ syntax to the minimum while remaining clear.")
      `(#:test-target "test:all"
        #:phases
        (modify-phases %standard-phases
-         (replace 'replace-git-ls-files
-           (lambda _
-             ;; TODO: Remove after the fix of using 'cut' to better mimic the
-             ;; git ls-files output is merged in ruby-build-system.
-             (substitute* "asciidoctor.gemspec"
-               (("`git ls-files -z`")
-                "`find . -type f -print0 |sort -z|cut -zc3-`"))
-             #t))
          (add-after 'extract-gemspec 'strip-version-requirements
            (lambda _
              (delete-file "Gemfile")
@@ -1419,17 +1413,7 @@ loader for the file type associated with a filename extension, and it augments
          "1dmk94z6ivhrz5hsq68vl5vgydhkz89n394rha1ymddw3rymbfcv"))))
     (build-system ruby-build-system)
     (arguments
-     `(#:test-target "spec"
-       #:phases
-       (modify-phases %standard-phases
-         (replace 'replace-git-ls-files
-           (lambda _
-             ;; TODO: Remove after the fix of using 'cut' to better mimic the
-             ;; git ls-files output is merged in ruby-build-system.
-             (substitute* "treetop.gemspec"
-               (("`git ls-files -z`")
-                "`find . -type f -print0 |sort -z|cut -zc3-`"))
-             #t)))))
+     `(#:test-target "spec"))
     (native-inputs
      `(("ruby-activesupport" ,ruby-activesupport)
        ("ruby-rr" ,ruby-rr)
@@ -1551,15 +1535,6 @@ only what they care about.")
            (lambda _
              (delete-file "Gemfile")
              (delete-file "Gemfile.lock")
-             #t))
-         (replace 'replace-git-ls-files
-           (lambda _
-             ;; TODO: Remove after the fix of using 'cut' to better mimic the
-             ;; git ls-files output is merged in ruby-build-system.
-             (substitute* "standard.gemspec"
-               (("`git ls-files -z`")
-                "`find . -type f -not -regex '.*\\.gem$' -print0 \
-|sort -z|cut -zc3-`"))
              #t)))))
     (native-inputs
      `(("ruby-gimme" ,ruby-gimme)
@@ -1602,14 +1577,6 @@ to save time in the following ways:
            (lambda _
              (substitute* (find-files "." "\\.rb$")
                (("require.*bundler/setup.*") ""))
-             #t))
-         (replace 'replace-git-ls-files
-           (lambda _
-             ;; TODO: Remove after the fix of using 'cut' to better mimic the
-             ;; git ls-files output is merged in ruby-build-system.
-             (substitute* "chunky_png.gemspec"
-               (("`git ls-files`")
-                "`find . -type f -not -regex '.*\\.gem$' |sort |cut -c3-`"))
              #t)))))
     (native-inputs
      `(("bundler" ,bundler)
@@ -1726,15 +1693,6 @@ web pages.")
                  (("(.*add_.*dependency '[_A-Za-z0-9-]+').*" _ stripped)
                   (string-append stripped "\n")))
                #t))
-           (replace 'replace-git-ls-files
-             ;; TODO: Remove after the fix of using 'cut' to better mimic the
-             ;; git ls-files output is merged in ruby-build-system.
-             (lambda _
-               (substitute* "asciidoctor-pdf.gemspec"
-                 (("`git ls-files -z`")
-                  "`find . -type f -not -regex '.*\\.gem$' -print0 \
-|sort -z|cut -zc3-`"))
-               #t))
            ;; The tests rely on the Gem being installed, so move the check phase
            ;; after the install phase.
            (delete 'check)
diff --git a/gnu/packages/tex.scm b/gnu/packages/tex.scm
index f297252de4..2623c256d5 100644
--- a/gnu/packages/tex.scm
+++ b/gnu/packages/tex.scm
@@ -3336,29 +3336,25 @@ language that is written in a Cyrillic alphabet.")
     (license license:lppl1.3c+)))
 
 (define-public texlive-latex-psnfss
-  (package
-    (name "texlive-latex-psnfss")
-    (version (number->string %texlive-revision))
-    (source (origin
-              (method svn-fetch)
-              (uri (texlive-ref "latex" "psnfss"))
-              (file-name (string-append name "-" version "-checkout"))
-              (sha256
-               (base32
-                "1920dcq8613yzprasbg80fh4fcjcidvvl54wkx438nimyxcri7qz"))))
-    (build-system texlive-build-system)
-    (arguments '(#:tex-directory "latex/psnfss"))
-    (home-page "https://www.ctan.org/pkg/psnfss")
-    (synopsis "Font support for common PostScript fonts")
-    (description
-     "The PSNFSS collection includes a set of files that provide a complete
-working setup of the LaTeX font selection scheme (NFSS2) for use with common
-PostScript fonts.  It covers the so-called \"Base\" fonts (which are built
-into any Level 2 PostScript printing device and the Ghostscript interpreter)
-and a number of free fonts.  It provides font definition files, macros and
-font metrics.  The bundle as a whole is part of the LaTeX required set of
-packages.")
-    (license license:lppl1.2+)))
+  (let ((template (simple-texlive-package
+                   "texlive-latex-psnfss"
+                   (list "/doc/latex/psnfss/"
+                         "/tex/latex/psnfss/")
+                   (base32
+                    "12p23in2nz1n08hw3m6kf5mcbn9zbhjsvdx0nsb7zcvywbljb9i2")
+                   #:trivial? #t)))
+    (package
+      (inherit template)
+      (home-page "https://www.ctan.org/pkg/psnfss")
+      (synopsis "Font support for common PostScript fonts")
+      (description "The PSNFSS collection includes a set of files that
+provide a complete working setup of the LaTeX font selection
+scheme (NFSS2) for use with common PostScript fonts.  It covers the
+so-called \"Base\" fonts (which are built into any Level 2 PostScript
+printing device and the Ghostscript interpreter) and a number of free
+fonts.  It provides font definition files, macros and font metrics.
+The bundle as a whole is part of the LaTeX required set of packages.")
+      (license license:lppl1.2+))))
 
 ;; For user profiles
 (define-public texlive-base
diff --git a/gnu/packages/texinfo.scm b/gnu/packages/texinfo.scm
index dea26a6395..b53b56fbf2 100644
--- a/gnu/packages/texinfo.scm
+++ b/gnu/packages/texinfo.scm
@@ -5,7 +5,7 @@
 ;;; Copyright © 2017, 2019 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2019 Pierre-Moana Levesque <pierre.moana.levesque@gmail.com>
-;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
+;;; Copyright © 2019, 2020 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2020 Nicolas Goaziou <mail@nicolasgoaziou.fr>
 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
@@ -59,21 +59,18 @@
      ;; with the native compiler, the environment is reset. This leads to
      ;; multiple environment variables missing. Do not reset the environment
      ;; to prevent that.
-     (if (%current-target-system)
-         '(#:phases
-           (modify-phases %standard-phases
-             (add-before 'configure 'fix-cross-configure
-               (lambda _
-                 (substitute* "configure"
-                   (("env -i")
-                    "env "))
-                 #t))))
-         '()))
+     `(#:phases
+       (if ,(%current-target-system)
+            (modify-phases %standard-phases
+              (add-before 'configure 'fix-cross-configure
+                (lambda _
+                  (substitute* "configure"
+                    (("env -i")
+                     "env "))
+                  #t)))
+            %standard-phases)))
     (inputs `(("ncurses" ,ncurses)
-              ;; TODO: remove `if' in the next rebuild cycle.
-              ,@(if (%current-target-system)
-                    `(("perl" ,perl))
-                    '())))
+              ("perl" ,perl)))
     ;; When cross-compiling, texinfo will build some of its own binaries with
     ;; the native compiler. This means ncurses is needed both in both inputs
     ;; and native-inputs.
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 82e6321de6..0f38d937d3 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -15,6 +15,7 @@
 ;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org>
 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -58,6 +59,7 @@
   #:use-module (gnu packages linux)
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages nettle)
+  #:use-module (gnu packages networking)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
@@ -164,9 +166,7 @@ living in the same process.")
 (define-public gnutls
   (package
     (name "gnutls")
-    ;; XXX Unversion openconnect's "gnutls" input when ungrafting.
-    (replacement gnutls-3.6.14)
-    (version "3.6.12")
+    (version "3.6.15")
     (source (origin
              (method url-fetch)
              (uri
@@ -178,13 +178,15 @@ living in the same process.")
              (patches (search-patches "gnutls-skip-trust-store-test.patch"))
              (sha256
               (base32
-               "0jvca1qahn9lrwv6f5kfs95icirc15b2a8x9fzczyj996ipg3b5z"))))
+               "0n0m93ymzd0q9hbknxc2ycanz49sqlkyyf73g9fk7n787llc7a0f"))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? ,(not (or (%current-target-system)
                           (hurd-target?)))
-       ;; Ensure we don't keep a reference to net-tools.
-       #:disallowed-references ,(if (hurd-target?) '() (list net-tools))
+       ;; Ensure we don't keep a reference to the tools used for testing.
+       #:disallowed-references ,(if (hurd-target?)
+                                    '()
+                                    (list net-tools iproute socat))
        #:configure-flags
        (list
              ;; GnuTLS doesn't consult any environment variables to specify
@@ -212,8 +214,16 @@ living in the same process.")
              "--without-p11-kit")
 
        #:phases (modify-phases %standard-phases
-                  (add-after
-                   'install 'move-doc
+                  ;; fastopen.sh fails to connect to the server in the builder
+                  ;; environment (see:
+                  ;; https://gitlab.com/gnutls/gnutls/-/issues/1095).
+                  (add-after 'unpack 'disable-failing-tests
+                    (lambda _
+                      (substitute* "tests/fastopen.sh"
+                        (("^unset RETCODE")
+                         "exit 77\n"))            ;skip
+                      #t))
+                  (add-after 'install 'move-doc
                    (lambda* (#:key outputs #:allow-other-keys)
                      ;; Copy the 4.1 MiB of section 3 man pages to "doc".
                      (let* ((out    (assoc-ref outputs "out"))
@@ -228,9 +238,13 @@ living in the same process.")
                "debug"
                "doc"))                            ;4.1 MiB of man pages
     (native-inputs
-     `(,@(if (hurd-target?) '()
-             `(("net-tools" ,net-tools)))
+     `(,@(if (hurd-target?)
+             '()
+             `(("net-tools" ,net-tools)
+               ("iproute" ,iproute)               ;for 'ss'
+               ("socat" ,socat)))                 ;several tests rely on it
        ("pkg-config" ,pkg-config)
+       ("texinfo" ,texinfo)
        ("which" ,which)
        ,@(if (hurd-target?) '()
              `(("datefudge" ,datefudge)))         ;tests rely on 'datefudge'
@@ -254,26 +268,6 @@ required structures.")
     (properties '((ftp-server . "ftp.gnutls.org")
                   (ftp-directory . "/gcrypt/gnutls")))))
 
-(define-public gnutls-3.6.14
-  (package
-    (inherit gnutls)
-    (version "3.6.14")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://gnupg/gnutls/v"
-                                  (version-major+minor version)
-                                  "/gnutls-" version ".tar.xz"))
-              (patches (search-patches "gnutls-skip-trust-store-test.patch"
-                                       "gnutls-cross.patch"))
-              (sha256
-               (base32
-                "0qwxsfizynly0ns537vnhnlm5lh03la4vbsmz675n0n7vqd7ac2n"))))
-    (native-inputs
-     `(,@(if (%current-target-system)             ;for cross-build
-             `(("guile" ,guile-3.0))              ;to create .go files
-             '())
-       ,@(package-native-inputs gnutls)))))
-
 (define-public gnutls/guile-2.0
   ;; GnuTLS for Guile 2.0.
   (package/inherit gnutls
@@ -305,8 +299,7 @@ required structures.")
 (define-public openssl
   (package
    (name "openssl")
-   (version "1.1.1f")
-   (replacement openssl-1.1.1g)
+   (version "1.1.1g")
    (source (origin
              (method url-fetch)
              (uri (list (string-append "https://www.openssl.org/source/openssl-"
@@ -318,7 +311,7 @@ required structures.")
                                        "/openssl-" version ".tar.gz")))
              (sha256
               (base32
-               "0d9zv9srjqivs8nn099fpbjv1wyhfcb8lzy491dpmfngdvz6nv0q"))
+               "0ikdcc038i7jk8h7asq5xcn8b1xc2rrbc88yfm4hqbz3y5s4gc6x"))
              (patches (search-patches "openssl-1.1-c-rehash-in.patch"))))
    (build-system gnu-build-system)
    (outputs '("out"
@@ -430,24 +423,6 @@ required structures.")
    (license license:openssl)
    (home-page "https://www.openssl.org/")))
 
-(define openssl-1.1.1g
-  (package
-   (inherit openssl)
-   (version "1.1.1g")
-   (source (origin
-             (method url-fetch)
-             (uri (list (string-append "https://www.openssl.org/source/openssl-"
-                                       version ".tar.gz")
-                        (string-append "ftp://ftp.openssl.org/source/"
-                                       "openssl-" version ".tar.gz")
-                        (string-append "ftp://ftp.openssl.org/source/old/"
-                                       (string-trim-right version char-set:letter)
-                                       "/openssl-" version ".tar.gz")))
-             (patches (search-patches "openssl-1.1-c-rehash-in.patch"))
-             (sha256
-              (base32
-               "0ikdcc038i7jk8h7asq5xcn8b1xc2rrbc88yfm4hqbz3y5s4gc6x"))))))
-
 (define-public openssl-1.0
   (package
     (inherit openssl)
diff --git a/gnu/packages/vpn.scm b/gnu/packages/vpn.scm
index e451ca1891..67f099d19e 100644
--- a/gnu/packages/vpn.scm
+++ b/gnu/packages/vpn.scm
@@ -265,7 +265,7 @@ the user specifically asks to proxy, so the @dfn{VPN} interface no longer
     `(("libxml2" ,libxml2)
       ;; XXX ‘DTLS is insecure in GnuTLS v3.6.3 through v3.6.12.’
       ;; See <https://gitlab.com/gnutls/gnutls/-/issues/960>.
-      ("gnutls" ,gnutls-3.6.14)
+      ("gnutls" ,gnutls)
       ("zlib" ,zlib)))
    (inputs
     `(("lz4" ,lz4)
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index f7c6bedd6d..5ca9cf19d0 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -823,7 +823,7 @@ libraries for working with JNLP applets.")
 (define-public jansson
   (package
     (name "jansson")
-    (version "2.12")
+    (version "2.13.1")
     (source (origin
              (method url-fetch)
              (uri
@@ -831,7 +831,7 @@ libraries for working with JNLP applets.")
                              version ".tar.bz2"))
              (sha256
               (base32
-               "1lp1mv8pjp5yziws66cy0dhpcam4bbjqhffk13v4vgdybp674pb4"))))
+               "1g8h18vh8gyxlwfmvdivdp1siad26ywj5zr4j4avgdyjg7wa147f"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags '("--disable-static")))
@@ -7333,8 +7333,7 @@ derivation by David Revoy from the original MonsterID by Andreas Gohr.")
 (define-public nghttp2
   (package
     (name "nghttp2")
-    (version "1.40.0")
-    (replacement nghttp2-1.41)
+    (version "1.41.0")
     (source
      (origin
        (method url-fetch)
@@ -7343,7 +7342,7 @@ derivation by David Revoy from the original MonsterID by Andreas Gohr.")
                            "nghttp2-" version ".tar.xz"))
        (sha256
         (base32
-         "0wwhwv7cvi1vxpdjwvg0kpa4jzhszclpnwrwfcw728zz53a47z09"))))
+         "1hk77vngjmvvzb5y1gi1aqwf6qywrc7yak08zvzb7x81qs6mphmb"))))
     (build-system gnu-build-system)
     (outputs (list "out"
                    "lib"))              ; only libnghttp2
@@ -7417,20 +7416,6 @@ compressed JSON header blocks.
 @end itemize\n")
     (license license:expat)))
 
-(define-public nghttp2-1.41                       ;fixes CVE-2020-11080
-  (package
-    (inherit nghttp2)
-    (version "1.41.0")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (string-append "https://github.com/nghttp2/nghttp2/"
-                           "releases/download/v" version "/"
-                           "nghttp2-" version ".tar.xz"))
-       (sha256
-        (base32
-         "1hk77vngjmvvzb5y1gi1aqwf6qywrc7yak08zvzb7x81qs6mphmb"))))))
-
 (define-public hpcguix-web
   (let ((commit "9de63562b06b4aef3a3afe5ecb18d3c91e57ee74")
         (revision "5"))
diff --git a/gnu/packages/wicd.scm b/gnu/packages/wicd.scm
index fec39ad530..073d440479 100644
--- a/gnu/packages/wicd.scm
+++ b/gnu/packages/wicd.scm
@@ -123,7 +123,10 @@
                        "--no-install-kde"
                        "--no-install-gnome-shell-extensions"
 
-                       "--distro=guixsd"
+                       ;; Don't pass --distro= despite setup.py's complaints.
+                       ;; Guix isn't recognised, and if it ever would be we'd
+                       ;; rather ask upstream to follow standards instead.
+
                        "--wicdgroup=netdev"
                        "--loggroup=root"
                        "--logperms=0640"
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index 97d42b2ae2..af2da1bbb6 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -2226,13 +2226,13 @@ because lxml.etree already has it's own implementation of XPath 1.0.")
 (define-public python-lxml
   (package
     (name "python-lxml")
-    (version "4.4.2")
+    (version "4.5.2")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "lxml" version))
        (sha256
-        (base32 "01nvb5j8vs9nk4z5s3250b1m22b4d08kffa36if3g1mdygdrvxpg"))))
+        (base32 "1xhx76hr1w3lllfcg9a01f2y0zwyf59ijnvlh08299mjh8b3mhfd"))))
     (build-system python-build-system)
     (arguments
      `(#:phases (modify-phases %standard-phases
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index f7b2cd7ab4..b1a4d4a9bd 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -2,7 +2,7 @@
 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2014, 2015, 2017, 2018, 2020 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014, 2015 Eric Bavier <bavier@member.fsf.org>
-;;; Copyright © 2015, 2016, 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 Eric Dvorsak <eric@dvorsak.fr>
 ;;; Copyright © 2016 Mathieu Lirzin <mthl@gnu.org>
 ;;; Copyright © 2015 Cyrill Schenkel <cyrill.schenkel@gmail.com>
@@ -5388,13 +5388,11 @@ over Xlib, including:
              ;; The default is to use "uname -srm", which captures the kernel
              ;; version and makes builds non-reproducible.
              "--with-os-name=GNU"
-
-             "--with-os-vendor=GuixSD"    ;not strictly needed, but looks nice
-
+             "--with-os-vendor=Guix"    ; not strictly needed, but looks nice
 
              ;; For the log file, etc.
              "--localstatedir=/var"
-             ;; For sddm
+             ;; For sddm.
              "--enable-kdrive"
              "--enable-xephyr")
 
@@ -5464,18 +5462,17 @@ draggable titlebars and borders.")
 (define-public libx11
   (package
     (name "libx11")
-    (version "1.6.9")
-    (replacement libx11/fixed)
+    (version "1.6.12")
     (source
       (origin
         (method url-fetch)
         (uri (string-append
-               "mirror://xorg/individual/lib/libX11-"
+               "ftp://ftp.freedesktop.org/pub/xorg//individual/lib/libX11-"
                version
                ".tar.bz2"))
         (sha256
           (base32
-            "1ldyn9c6pyx54sxzaw120n3q42rqi7b503aqmyjky6fn038fiiww"))))
+            "1ivfzl1qwk8zh7gc0m5vb58gdxz11jwg7w3d356w16j1d5s2427i"))))
     (build-system gnu-build-system)
     (outputs '("out"
                "doc"))                            ;8 MiB of man pages + XML
@@ -5503,19 +5500,6 @@ draggable titlebars and borders.")
     (description "Xorg Core X11 protocol client library.")
     (license license:x11)))
 
-(define libx11/fixed  ; Fixes CVE-2020-14344
-  (package
-    (inherit libx11)
-    (version "1.6.A")
-    (source
-      (origin
-        (method url-fetch)
-        (uri (string-append
-               "mirror://xorg/individual/lib/libX11-1.6.10.tar.bz2"))
-        (sha256
-          (base32
-            "09k2pqmqbn2m1bpgl7jfxyqxaaxsnzbnp2bp8ycmqldqi5ln4j5g"))))))
-
 ;; packages of height 5 in the propagated-inputs tree
 
 (define-public libxcursor
diff --git a/gnu/system/locale.scm b/gnu/system/locale.scm
index 689d238d1a..4771192cfb 100644
--- a/gnu/system/locale.scm
+++ b/gnu/system/locale.scm
@@ -147,8 +147,7 @@ data format changes between libc versions."
 
 (define %default-locale-libcs
   ;; The libcs for which we build locales by default.
-  ;; List the previous and current libc to ease transition.
-  (list glibc-2.29 glibc))
+  (list glibc-2.31 glibc))
 
 (define %default-locale-definitions
   ;; Arbitrary set of locales that are built by default.  They are here mostly
diff --git a/gnu/system/shadow.scm b/gnu/system/shadow.scm
index a69339bc07..8c76bc2b11 100644
--- a/gnu/system/shadow.scm
+++ b/gnu/system/shadow.scm
@@ -3,6 +3,7 @@
 ;;; Copyright © 2016 Alex Griffin <a@ajgrf.com>
 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -162,7 +163,12 @@ XTerm*utf8: always
 XTerm*metaSendsEscape: true\n"))
         (gdbinit   (plain-file "gdbinit" "\
 # Tell GDB where to look for separate debugging files.
-set debug-file-directory ~/.guix-profile/lib/debug
+guile
+(use-modules (gdb))
+(execute (string-append \"set debug-file-directory \"
+                        (or (getenv \"GDB_DEBUG_FILE_DIRECTORY\")
+                            \"~/.guix-profile/lib/debug\")))
+end
 
 # Authorize extensions found in the store, such as the
 # pretty-printers of libstdc++.
diff --git a/gnu/system/vm.scm b/gnu/system/vm.scm
index 80a8618729..3a5204e11b 100644
--- a/gnu/system/vm.scm
+++ b/gnu/system/vm.scm
@@ -529,7 +529,7 @@ the operating system."
                      ;; Even as root in a VM, the initializer would fail due to
                      ;; lack of privileges if we use a root-directory that is on
                      ;; a file system that is shared with the host (e.g., /tmp).
-                     (root-directory "/guixsd-system-root"))
+                     (root-directory "/guix-system-root"))
                 (set-path-environment-variable "PATH" '("bin" "sbin") '(#+tar))
                 (mkdir root-directory)
                 (initialize root-directory)
@@ -820,8 +820,8 @@ with '-virtfs' options for the host file systems listed in SHARED-FS."
             '())
 
      "-no-reboot"
-     "-object" "rng-random,filename=/dev/urandom,id=guixsd-vm-rng"
-     "-device" "virtio-rng-pci,rng=guixsd-vm-rng"
+     "-object" "rng-random,filename=/dev/urandom,id=guix-vm-rng"
+     "-device" "virtio-rng-pci,rng=guix-vm-rng"
 
      #$@(map virtfs-option shared-fs)
      "-vga std"